From 17e2b7fe084e157e4784c2b5432ec6a3782a03e8 Mon Sep 17 00:00:00 2001
From: Cristian Cavalli <cristiancavall@cristiancavall0.mtv.corp.google.com>
Date: Mon, 17 Oct 2016 10:37:39 -0700
Subject: [PATCH] deps: cherry-pick 3c39bac from V8 upstream Original Commit
 Message:   Don't skip hole checks inside patterns in parameter lists

  Previously, b6e9f625c17f3a688139426771e2cb34fbdcb46e fixed self-assignment
  in parameters to throw. But it failed to deal with the case of
  destructuring with defaults. This patch extends that previous approach
  to always treat the end of a parameter as its initializer position,
  whether it has an initializer or not.

  This is the minimal change to make it easy to merge; a follow-up
  will rename the field of Parameter from "initializer_end_position"
  to "end_position".

  BUG=v8:5454
  Review-Url: https://codereview/chromium.org/2390943002
  Cr-Commit-Position: refs/heads/master@{#39962}
---
 deps/v8/src/parsing/parser.cc                |  6 +-----
 deps/v8/test/mjsunit/regress/regress-5454.js | 11 +++++++++++
 2 files changed, 12 insertions(+), 5 deletions(-)
 create mode 100644 deps/v8/test/mjsunit/regress/regress-5454.js

diff --git a/deps/v8/src/parsing/parser.cc b/deps/v8/src/parsing/parser.cc
index 7fd6d5b302b0d0..df67d15c0ff8fb 100644
--- a/deps/v8/src/parsing/parser.cc
+++ b/deps/v8/src/parsing/parser.cc
@@ -4445,9 +4445,6 @@ Block* Parser::BuildParameterInitializationBlock(
     // TODO(adamk): Should this be RelocInfo::kNoPosition, since
     // it's just copying from a temp var to the real param var?
     descriptor.initialization_pos = parameter.pattern->position();
-    // The initializer position which will end up in,
-    // Variable::initializer_position(), used for hole check elimination.
-    int initializer_position = parameter.pattern->position();
     Expression* initial_value =
         factory()->NewVariableProxy(parameters.scope->parameter(i));
     if (parameter.initializer != nullptr) {
@@ -4465,7 +4462,6 @@ Block* Parser::BuildParameterInitializationBlock(
           condition, parameter.initializer, initial_value,
           RelocInfo::kNoPosition);
       descriptor.initialization_pos = parameter.initializer->position();
-      initializer_position = parameter.initializer_end_position;
     }
 
     Scope* param_scope = scope_;
@@ -4490,7 +4486,7 @@ Block* Parser::BuildParameterInitializationBlock(
     {
       BlockState block_state(&scope_, param_scope);
       DeclarationParsingResult::Declaration decl(
-          parameter.pattern, initializer_position, initial_value);
+          parameter.pattern, parameter.initializer_end_position, initial_value);
       PatternRewriter::DeclareAndInitializeVariables(param_block, &descriptor,
                                                      &decl, nullptr, CHECK_OK);
     }
diff --git a/deps/v8/test/mjsunit/regress/regress-5454.js b/deps/v8/test/mjsunit/regress/regress-5454.js
new file mode 100644
index 00000000000000..ca6a9433b24025
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5454.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(function(...[b = !b]) { }, ReferenceError);
+assertThrows(() => (function([b = !b]) { })([]), ReferenceError);
+assertThrows(() => (function({b = !b}) { })({}), ReferenceError);
+
+assertThrows((...[b = !b]) => { }, ReferenceError);
+assertThrows(() => (([b = !b]) => { })([]), ReferenceError);
+assertThrows(() => (({b = !b}) => { })({}), ReferenceError);