Check for LHS Object-coercibility in MemberExpression

The spec says that if the LHS (base) of a MemberExpression fails CheckObjectCoercible / RequireObjectCoercible that the resulting TypeError should be propagated, which should preven the RHS of an enclosing AssignmentExpression from being evaluated.  So do that, even though apparently no one else does (see https://bugs.chromium.org/p/v8/issues/detail?id=7847 and tc39/ecma262#1224).

server/interpreter.js

@@ -6180,7 +6180,12 @@ stepFuncs_['MemberExpression'] = function (thread, stack, state, node) {
   }
   stack.pop();
   if (state.wantRef_) {
-    stack[stack.length - 1].ref = [state.tmp_, key];
+    var base = state.tmp_;
+    if (base === null || base === undefined) {
+      throw new this.Error(perms, this.TYPE_ERROR,
+          "Can't convert " + base + ' to Object');
+    }
+    stack[stack.length - 1].ref = [base, key];
   } else {
     var perms = state.scope.perms;
     stack[stack.length - 1].value =

server/tests/db/test_01_es5.js

@@ -1162,18 +1162,20 @@ tests.instanceofNonObjectPrototype = function() {
   }
 };
 
-tests.nulUndefinedProps = function() {
+tests.nullUndefinedProps = function() {
   try {
     undefined.foo;
     console.assert(false, "undefined.foo didn't throw");
   } catch (e) {
     console.assert(e.name === 'TypeError', 'undefined.foo wrong error');
   }
   try {
-    undefined.foo = undefined;
+    var c = 0;
+    undefined.foo = c++;
     console.assert(false, "undefined.foo = ... didn't throw");
   } catch (e) {
     console.assert(e.name === 'TypeError', 'undefined.foo = ... wrong error');
+    console.assert(c === 0, 'undefined.foo = ... evaluated RHS');
   }
   try {
     null.foo;
@@ -1182,10 +1184,12 @@ tests.nulUndefinedProps = function() {
     console.assert(e.name === 'TypeError', 'null.foo wrong error');
   }
   try {
-    null.foo = undefined;
+    c = 0;
+    null.foo = c++;
     console.assert(false, "null.foo = ... didn't throw");
   } catch (e) {
     console.assert(e.name === 'TypeError', 'null.foo = ... wrong error');
+    console.assert(c === 0, 'null.foo = ... evaluated RHS');
   }
 };
 

server/tests/testcases.js

@@ -770,12 +770,13 @@ module.exports = [
 
   { name: 'undefined.foo = ...', src: `
     try {
-      undefined.foo = undefined;
+      var c = 0;
+      undefined.foo = c++;
     } catch (e) {
-      e.name;
+      e.name + ',' + c;
     }
     `,
-    expected: 'TypeError' },
+    expected: 'TypeError,0' },
 
   { name: 'null.foo', src: `
     try {
@@ -788,12 +789,13 @@ module.exports = [
 
   { name: 'null.foo = ...', src: `
     try {
-      null.foo = undefined;
+      var c = 0;
+      null.foo = c++;
     } catch (e) {
-      e.name;
+      e.name + ',' + c;
     }
     `,
-    expected: 'TypeError' },
+    expected: 'TypeError,0' },
 
   { name: 'deleteProp', src: `
     var o = {foo: 'bar'};