Normative: Add "Runtime Errors for Function Call Assignment Targets" to Annex B

[rkirsling]

Replaces #2193.

This PR specifies the web reality that the following are not early errors in sloppy mode on browser-hosted engines:

f() = 1;
f() *= 1;
f()++;
for (f() in [1]) {}
for (f() of [1]) {}

It aligns with the new Annex B editorial convention (#2952) and amounts to:

• augmenting AssignmentTargetType with a new value ~web-compat~
• throwing a ReferenceError immediately after performing the function call in each case

[bakkot]

Thanks!

Web reality has the error occurring before evaluation of the RHS (try (function(){})() = console.log(0)), and with this PR it would happen after (specifically, Evaluation for assignment expressions will evaluate both sides and then perform PutValue, and only then will the error be thrown). I think we should try to match web reality as closely as possibly.

This is maybe what you're trying to achieve with the "Late Errors" section? But the spec doesn't have a notion of "late errors"; there's just parse failures, early errors which happen at the same time as parse errors, and errors which occur as explicit steps in the evaluation semantics or other AOs. Since this is not a parse failure it has to specified as an actual algorithmic step.

[rkirsling]

Oops, yeah, I see that function f() { print("lhs"); } f() = print("rhs"); prints just lhs before throwing a ReferenceError. I was misunderstanding the precise behavior; will update.

[rkirsling]

Interestingly, we don't have agreement among browsers on how far the LHS processing goes.

λ eshost -sx "function f() { print("1"); return { valueOf() { print("2"); } }; } f() += 1;"
#### SpiderMonkey, V8
1
ReferenceError: [...]

λ eshost -sx "function f() { print("1"); return { valueOf() { print("2"); } }; } ++f();"
#### SpiderMonkey
1
2
ReferenceError: cannot assign to function call

#### V8
1
ReferenceError: Invalid left-hand side expression in prefix operation

(JSC omitted as it doesn't currently call f() at all.)

I am inclined to specify V8's behavior here; we should only go as far as web reality obliges us to.

---

Edit: JSC's behavior has now been updated to match V8's.

[rkirsling]

Okay, updated. Technically, nothing outside of AssignmentTargetType needs to be marked normative optional—for now, I've marked every usage of ~web-compat~, just in case we find it clearest for non-browser hosts, but I'm more than happy to undo all that if it's too noisy.

[rkirsling]

Added tests in tc39/test262#4459.

[michaelficarra]

LGTM otherwise!

[bakkot]

LGTM other than comments, which we can address when landing.