LibJS: Check AssignmentExpression LHS in parser

There are many cases which shouldn't even parse, like

null = ...
true = ...
false = ...
123 = ...
"foo" = ...

However this *is* valid syntax:

foo() = ...

So we still have to keep the current code doing a runtime check if the
LHS value is a resolvable reference. I believe this was declared valid
syntax to *in theory* allow functions returning references - though in
practice that isn't a thing.

Fixes #2204.

1 files changed, 4 insertions, 0 deletions

diff --git a/Libraries/LibJS/Parser.cpp b/Libraries/LibJS/Parser.cpp
index d7cb24a16a..1622220c81 100644
--- a/Libraries/LibJS/Parser.cpp
+++ b/Libraries/LibJS/Parser.cpp
@@ -755,6 +755,10 @@ NonnullRefPtr<Expression> Parser::parse_secondary_expression(NonnullRefPtr<Expre
         return parse_call_expression(move(lhs));
     case TokenType::Equals:
         consume();
+        if (!lhs->is_identifier() && !lhs->is_member_expression() && !lhs->is_call_expression()) {
+            syntax_error("Invalid left-hand side in assignment");
+            return create_ast_node<ErrorExpression>();
+        }
         return create_ast_node<AssignmentExpression>(AssignmentOp::Assignment, move(lhs), parse_expression(min_precedence, associativity));
     case TokenType::Period:
         consume();