FunctionCallBracketNode should store the base value to the temporary when subscript...

FunctionCallBracketNode should store the base value to the temporary when subscript has assignment
https://bugs.webkit.org/show_bug.cgi?id=144678

Reviewed by Geoffrey Garen.

Currently, FunctionCallBracketNode directly use the RegisterID returned by emitNode.
But if the base part is the local register and the subscript part has assignment to it, the base result is accidentally rewritten.

function t() { var ok = {null: function () { } }; ok[ok = null](); }
t();  // Should not throw error.

This patch takes care about `subscriptHasAssignment`.
By using `emitNodeForLeftHandSide`, when there's assignment to local variables in RHS,
it correctly moves the LHS value to a temporary register.

* bytecompiler/NodesCodegen.cpp:
(JSC::FunctionCallBracketNode::emitBytecode):
* parser/ASTBuilder.h:
(JSC::ASTBuilder::makeFunctionCallNode):
* parser/NodeConstructors.h:
(JSC::FunctionCallBracketNode::FunctionCallBracketNode):
* parser/Nodes.h:
* tests/stress/assignment-in-function-call-bracket-node.js: Added.
(shouldBe):
(shouldBe.):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@183955 268f45cc-cd09-0410-ab3c-d52691b4dbfc