deps: cherry-pick 3c39bac from V8 upstream

Original commit message:
  Don't skip hole checks inside patterns in parameter lists

  Previously, b6e9f625c17f3a688139426771e2cb34fbdcb46e fixed self-assignment
  in parameters to throw. But it failed to deal with the case of
  destructuring with defaults. This patch extends that previous approach
  to always treat the end of a parameter as its initializer position,
  whether it has an initializer or not.

  This is the minimal change to make it easy to merge; a follow-up
  will rename the field of Parameter from "initializer_end_position"
  to "end_position".

  BUG=v8:5454
  Review-Url: https://codereview/chromium.org/2390943002
  Cr-Commit-Position: refs/heads/master@{#39962}

PR-URL: #9138
Reviewed-By: targos - Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: bnoordhuis - Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: jasnell - James M Snell <jasnell@gmail.com>

Author: Cristian Cavalli

deps/v8/include/v8-version.h

@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 5
 #define V8_MINOR_VERSION 1
 #define V8_BUILD_NUMBER 281
-#define V8_PATCH_LEVEL 86
+#define V8_PATCH_LEVEL 87
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)

deps/v8/src/parsing/parser.cc

@@ -4445,9 +4445,6 @@ Block* Parser::BuildParameterInitializationBlock(
     // TODO(adamk): Should this be RelocInfo::kNoPosition, since
     // it's just copying from a temp var to the real param var?
     descriptor.initialization_pos = parameter.pattern->position();
-    // The initializer position which will end up in,
-    // Variable::initializer_position(), used for hole check elimination.
-    int initializer_position = parameter.pattern->position();
     Expression* initial_value =
         factory()->NewVariableProxy(parameters.scope->parameter(i));
     if (parameter.initializer != nullptr) {
@@ -4465,7 +4462,6 @@ Block* Parser::BuildParameterInitializationBlock(
           condition, parameter.initializer, initial_value,
           RelocInfo::kNoPosition);
       descriptor.initialization_pos = parameter.initializer->position();
-      initializer_position = parameter.initializer_end_position;
     }
 
     Scope* param_scope = scope_;
@@ -4490,7 +4486,7 @@ Block* Parser::BuildParameterInitializationBlock(
     {
       BlockState block_state(&scope_, param_scope);
       DeclarationParsingResult::Declaration decl(
-          parameter.pattern, initializer_position, initial_value);
+          parameter.pattern, parameter.initializer_end_position, initial_value);
       PatternRewriter::DeclareAndInitializeVariables(param_block, &descriptor,
                                                      &decl, nullptr, CHECK_OK);
     }

deps/v8/test/mjsunit/regress/regress-5454.js

@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(function(...[b = !b]) { }, ReferenceError);
+assertThrows(() => (function([b = !b]) { })([]), ReferenceError);
+assertThrows(() => (function({b = !b}) { })({}), ReferenceError);
+
+assertThrows((...[b = !b]) => { }, ReferenceError);
+assertThrows(() => (([b = !b]) => { })([]), ReferenceError);
+assertThrows(() => (({b = !b}) => { })({}), ReferenceError);