JavaScriptMinifier: Fix bad state after '{}' in property value

JavaScriptMinifier: Fix bad state after '{}' in property value

Previously, $push contained:

	self::PROPERTY_EXPRESSION_OP => [
		self::TYPE_PAREN_OPEN => self::PROPERTY_EXPRESSION_OP
	],

But $pop contained:

	self::PROPERTY_EXPRESSION_OP => [ self::TYPE_BRACE_CLOSE => true ]

This meant that when a closing brace was found inside a property
expression, it would wrongly pop the stack, eventhough we are still
inside the property expression.

The impact is that everything after this is one level higher in
the stack than it should be, causing various other types to be
misinterpreted. Including in the following contrived example:

	call( function () {
		try {
		} catch (e) {
			obj = {
				key: 1 ? 0 : {} // A
			}; // B
		} // C
		return name === 'input';
	} );

In the above, the closing brace at A would close the 'obj.key' assignment
(PROPERTY_EXPRESSION_OP), instead of waiting for the closing brace at B to
decide that.

Then the closing brace at B would wrongly close the 'catch' block (instead of
the 'obj' assignment). And lastly, the closing brace at C would close the
function body (STATEMENT).

This resulted in keyword 'return' being interpreted while in state
PAREN_EXPRESSION_OP instead of STATEMENT, where PAREN_EXPRESSION_OP is the
arguments list to `call()`. In an argument list, TYPE_RETURN is not valid,
which means we stay in that state, instead of progressing to EXPRESSION_NO_NL,
which then wrongly allows for a line break to be inserted.

Bug: T201606
Change-Id: I07b809a7ca56e282ecb48b5c89c217b4b8da6856