[parser] Validate the target of property access assignment as expression

This drops possible remaining pattern errors from the access target. This is
necessary since sub patterns with default values (assignment expression) aren't
otherwise identifiable as being property accesses.

Bug: v8:9560
Change-Id: Ie6781c0d161e00790268f7d9db81377d045f93b6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1725624
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62982}

src/parsing/expression-scope.h

@@ -84,6 +84,12 @@ class ExpressionScope {
     AsExpressionParsingScope()->ClearExpressionError();
   }
 
+  void ValidateAsExpression() {
+    if (!CanBeExpression()) return;
+    AsExpressionParsingScope()->ValidateExpression();
+    AsExpressionParsingScope()->ClearPatternError();
+  }
+
   // Record async arrow parameters errors in all ambiguous async arrow scopes in
   // the chain up to the first unambiguous scope.
   void RecordAsyncArrowParametersError(const Scanner::Location& loc,
@@ -481,6 +487,14 @@ class ExpressionParsingScope : public ExpressionScope<Types> {
     clear(kExpressionIndex);
   }
 
+  void ClearPatternError() {
+    DCHECK(verified_);
+#ifdef DEBUG
+    verified_ = false;
+#endif
+    clear(kPatternIndex);
+  }
+
   void TrackVariable(VariableProxy* variable) {
     if (!this->CanBeDeclaration()) {
       this->parser()->scope()->AddUnresolved(variable);

src/parsing/parser-base.h

@@ -2662,6 +2662,7 @@ ParserBase<Impl>::ParseAssignmentExpressionCoverGrammar() {
     expression_scope()->RecordDeclarationError(
         Scanner::Location(lhs_beg_pos, end_position()),
         MessageTemplate::kInvalidPropertyBindingPattern);
+    expression_scope()->ValidateAsExpression();
   } else if (expression->IsPattern() && op == Token::ASSIGN) {
     // Destructuring assignmment.
     if (expression->is_parenthesized()) {

test/mjsunit/regress/regress-9560.js

@@ -0,0 +1,9 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var value = 0;
+
+[{ set prop(v) { value = v } }.prop = 12 ] = [ 1 ]
+
+assertEquals(1, value);