deps: cherry-pick 3c39bac from V8 upstream

Original Commit Message:
  Don't skip hole checks inside patterns in parameter lists

  Previously, b6e9f625c17f3a688139426771e2cb34fbdcb46e fixed self-assignment
  in parameters to throw. But it failed to deal with the case of
  destructuring with defaults. This patch extends that previous approach
  to always treat the end of a parameter as its initializer position,
  whether it has an initializer or not.

  This is the minimal change to make it easy to merge; a follow-up
  will rename the field of Parameter from "initializer_end_position"
  to "end_position".

  BUG=v8:5454
  Review-Url: https://codereview/chromium.org/2390943002
  Cr-Commit-Position: refs/heads/master@{#39962}

deps/v8/src/parsing/parser.cc

@@ -4445,9 +4445,6 @@ Block* Parser::BuildParameterInitializationBlock(
     // TODO(adamk): Should this be RelocInfo::kNoPosition, since
     // it's just copying from a temp var to the real param var?
     descriptor.initialization_pos = parameter.pattern->position();
-    // The initializer position which will end up in,
-    // Variable::initializer_position(), used for hole check elimination.
-    int initializer_position = parameter.pattern->position();
     Expression* initial_value =
         factory()->NewVariableProxy(parameters.scope->parameter(i));
     if (parameter.initializer != nullptr) {
@@ -4465,7 +4462,6 @@ Block* Parser::BuildParameterInitializationBlock(
           condition, parameter.initializer, initial_value,
           RelocInfo::kNoPosition);
       descriptor.initialization_pos = parameter.initializer->position();
-      initializer_position = parameter.initializer_end_position;
     }
 
     Scope* param_scope = scope_;
@@ -4490,7 +4486,7 @@ Block* Parser::BuildParameterInitializationBlock(
     {
       BlockState block_state(&scope_, param_scope);
       DeclarationParsingResult::Declaration decl(
-          parameter.pattern, initializer_position, initial_value);
+          parameter.pattern, parameter.initializer_end_position, initial_value);
       PatternRewriter::DeclareAndInitializeVariables(param_block, &descriptor,
                                                      &decl, nullptr, CHECK_OK);
     }

deps/v8/test/mjsunit/regress/regress-5454.js

@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(function(...[b = !b]) { }, ReferenceError);
+assertThrows(() => (function([b = !b]) { })([]), ReferenceError);
+assertThrows(() => (function({b = !b}) { })({}), ReferenceError);
+
+assertThrows((...[b = !b]) => { }, ReferenceError);
+assertThrows(() => (([b = !b]) => { })([]), ReferenceError);
+assertThrows(() => (({b = !b}) => { })({}), ReferenceError);