Fix crashes when parsing destructuring expressions

x = [y] = z

would crash because [y] is a literal and not a valid lvalue
in ES5, something our parser didn't catch correctly.

Change-Id: I0d7abd9b3f812f1de61c77dccfab5d1778dac793
Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>

2 files changed, 3 insertions, 2 deletions

diff --git a/src/qml/compiler/qv4codegen.cpp b/src/qml/compiler/qv4codegen.cpp
index a262908960..8ada1d505e 100644
--- a/src/qml/compiler/qv4codegen.cpp
+++ b/src/qml/compiler/qv4codegen.cpp
@@ -784,9 +784,10 @@ bool Codegen::visit(BinaryExpression *ast)
         left = left.asLValue();
         if (throwSyntaxErrorOnEvalOrArgumentsInStrictMode(left, ast->left->lastSourceLocation()))
             return false;
-        expression(ast->right).loadInAccumulator();
+        Reference r = expression(ast->right);
         if (hasError)
             return false;
+        r.loadInAccumulator();
         if (_expr.accept(nx))
             _expr.setResult(left.storeConsumeAccumulator());
         else
diff --git a/src/qml/compiler/qv4codegen_p.h b/src/qml/compiler/qv4codegen_p.h
index a46d47cb67..d51dc29517 100644
--- a/src/qml/compiler/qv4codegen_p.h
+++ b/src/qml/compiler/qv4codegen_p.h
@@ -188,7 +188,7 @@ public:
             Const
         } type = Invalid;
 
-        bool isLValue() const { return !isReadonly; }
+        bool isLValue() const { return !isReadonly && type > Accumulator; }
 
         Reference(Codegen *cg, Type type = Invalid) : type(type), codegen(cg) {}
         Reference() {}