Use Scope::function_kind_ to distinguish arrow function scopes

Use Scope::function_kind_ to distinguish arrow function scopes

Previously, arrow function scopes had a separate ScopeType. However,
Scope::DeserializeScopeChain() erroneously deserialized ARROW_SCOPE
ScopeInfos as FUNCTION_SCOPE. This could lead to bugs such as the
attached one, where "super" was disallowed where it should have
been allowed.

This patch utilizes the Scope's FunctionKind to distinguish arrow
functions from others. Besides fixing the above bug, this also
simplifies code in various places that had to deal with two different
ScopeTypes both of which meant "function".

BUG=v8:4466
LOG=n

Committed: https://crrev.com/24565b859869f8867059b7120f27a25d785f2850
Cr-Commit-Position: refs/heads/master@{#31154}

[adamk, 2015-10-06 22:11:28]

adamk@chromium.org changed reviewers:
+ bmeurer@chromium.org

[adamk, 2015-10-06 22:11:28]

+bmeurer for debug/OWNERS.

[Dan Ehrenberg, 2015-10-07 00:25:41]

lgtm

LGTM modulo testing. Which usage site was the one that wasn't working according
to the previous scheme?

https://codereview.chromium.org/1386253002/diff/1/test/mjsunit/es6/regress/re...
File test/mjsunit/es6/regress/regress-4466.js (right):

https://codereview.chromium.org/1386253002/diff/1/test/mjsunit/es6/regress/re...
test/mjsunit/es6/regress/regress-4466.js:16: let outer = (y) => {
You might want to reference y here, as the original bug report noted that not
referencing it suppresses the issue (by making it so that the scope is removed
earlier?). Did you test this against HEAD to ensure that it fails?

[adamk, 2015-10-07 00:34:31]

The broken usage site was in Scope::ReceiverScope (as mentioned in the bug). In
particular, it's a while loop that tries to walk up a chain of arrow function
scopes looking for a context where a super reference is valid.

https://codereview.chromium.org/1386253002/diff/1/test/mjsunit/es6/regress/re...
File test/mjsunit/es6/regress/regress-4466.js (right):

https://codereview.chromium.org/1386253002/diff/1/test/mjsunit/es6/regress/re...
test/mjsunit/es6/regress/regress-4466.js:16: let outer = (y) => {
On 2015/10/07 00:25:41, Dan Ehrenberg wrote:
> You might want to reference y here, as the original bug report noted that not
> referencing it suppresses the issue (by making it so that the scope is removed
> earlier?). Did you test this against HEAD to ensure that it fails?

Yes, this test fails without this patch. The usages in the inner arrow function
are sufficient to force the outer scopes to be reified.

[Dan Ehrenberg, 2015-10-07 00:42:59]

lgtm

[Benedikt Meurer, 2015-10-07 03:39:06]

LGTM on debug

[adamk, 2015-10-07 14:53:59]

The CQ bit was checked by adamk@chromium.org

[commit-bot: I haz the power, 2015-10-07 14:54:17]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1386253002/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1386253002/1

[commit-bot: I haz the power, 2015-10-07 14:55:50]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2015-10-07 14:55:57]

Patchset 1 (id:??) landed as
https://crrev.com/24565b859869f8867059b7120f27a25d785f2850
Cr-Commit-Position: refs/heads/master@{#31154}