From 6c31f2a68a92dd786b28ccfe86d31c1810a7692b Mon Sep 17 00:00:00 2001
From: Tim Ledbetter <timledbetter@gmail.com>
Date: Wed, 31 Jan 2024 22:27:11 +0000
Subject: [PATCH] LibJS: Don't crash when attempting to load from an invalid
 reference

Previously, attempting to load a value from an invalid reference would
cause a crash. We now return a CodeGenerationError rather than hitting
an assertion. This is not a complete solution, as ideally we would want
to return a ReferenceError, but this now matches the behavior we see
when we attempt to store something to an invalid reference.
---
 Userland/Libraries/LibJS/Bytecode/Generator.cpp            | 5 ++++-
 .../Libraries/LibJS/Tests/invalid-lhs-in-assignment.js     | 7 +++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/Userland/Libraries/LibJS/Bytecode/Generator.cpp b/Userland/Libraries/LibJS/Bytecode/Generator.cpp
index 91f97d567c..2a11de594a 100644
--- a/Userland/Libraries/LibJS/Bytecode/Generator.cpp
+++ b/Userland/Libraries/LibJS/Bytecode/Generator.cpp
@@ -268,7 +268,10 @@ CodeGenerationErrorOr<Optional<Generator::ReferenceRegisters>> Generator::emit_l
         }
         return Optional<ReferenceRegisters> {};
     }
-    VERIFY_NOT_REACHED();
+    return CodeGenerationError {
+        &node,
+        "Unimplemented/invalid node used a reference"sv
+    };
 }
 
 CodeGenerationErrorOr<void> Generator::emit_store_to_reference(JS::ASTNode const& node)
diff --git a/Userland/Libraries/LibJS/Tests/invalid-lhs-in-assignment.js b/Userland/Libraries/LibJS/Tests/invalid-lhs-in-assignment.js
index ad329dc826..7f753cad14 100644
--- a/Userland/Libraries/LibJS/Tests/invalid-lhs-in-assignment.js
+++ b/Userland/Libraries/LibJS/Tests/invalid-lhs-in-assignment.js
@@ -5,6 +5,13 @@ test.xfail("assignment to function call", () => {
     }).toThrowWithMessage(ReferenceError, "Invalid left-hand side in assignment");
 });
 
+test.xfail("Postfix operator after function call", () => {
+    expect(() => {
+        function foo() {}
+        foo()++;
+    }).toThrow(ReferenceError);
+});
+
 test("assignment to function call in strict mode", () => {
     expect("'use strict'; foo() = 'foo'").toEval();
 });