Bisect down to a v8 roll:

https://codereview.chromium.org/2104893006

This seems to be pretty crashing reliably -- should we revert the roll?

Possibly related crashes on Android too:

https://uberchromegw.corp.google.com/i/chromium.perf/builders/Linux%20Perf%20%285%29/builds/15645/steps/rasterize_and_record_micro.key_mobile_sites_smooth/logs/stdio/text

I'm doing a revert here: https://codereview.chromium.org/2111853002/

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/0d4110d82c8b9c3d743aa6d14e63ca5aaec0c241

commit 0d4110d82c8b9c3d743aa6d14e63ca5aaec0c241
Author: skyostil <skyostil@chromium.org>
Date: Thu Jun 30 09:50:04 2016

Revert of Update V8 to version 5.3.336. (patchset #1 id:1 of https://codereview.chromium.org/2104893006/ )

Reason for revert:
Causing crashes on the perf waterfall (see bug for logs):

 Received signal 11 SEGV_MAPERR 000000000010
        #0 0x7f3bf49793b7 base::debug::(anonymous namespace)::StackDumpSignalHandler()
        #1 0x7f3bf46b9330 <unknown>
        #2 0x7f3bf0c84899 v8::internal::compiler::GraphTrimmer::TrimGraph()
        #3 0x7f3bf0ce9c8e v8::internal::compiler::EffectControlLinearizationPhase::Run()
        #4 0x7f3bf0ce399b v8::internal::compiler::PipelineImpl::OptimizeGraph()
        #5 0x7f3bf0ce3904 v8::internal::compiler::PipelineCompilationJob::OptimizeGraphImpl()
        #6 0x7f3bf0c3acd8 v8::internal::CompilationJob::OptimizeGraph()
        #7 0x7f3bf0f6ec18 v8::internal::OptimizingCompileDispatcher::CompileNext()
        #8 0x7f3bf0f6f645 v8::internal::OptimizingCompileDispatcher::CompileTask::Run()
        #9 0x7f3bf49edaa7 base::(anonymous namespace)::WorkerThread::ThreadMain()
        #10 0x7f3bf49e5b13 base::(anonymous namespace)::ThreadFunc()

BUG= 624463 

Original issue's description:
> Update V8 to version 5.3.336.
>
> Summary of changes available at:
> https://chromium.googlesource.com/v8/v8/+log/81ce7501..e1fa935d
>
> Please follow these instructions for assigning/CC'ing issues:
> https://github.com/v8/v8/wiki/Triaging%20issues
>
> Please close rolling in case of a roll revert:
> https://v8-roll.appspot.com/
> This only works with a Google account.
>
> CQ_INCLUDE_TRYBOTS=tryserver.blink:linux_blink_rel;tryserver.chromium.linux:linux_optional_gpu_tests_rel
>
> TBR=hablich@chromium.org,machenbach@chromium.org,yangguo@chromium.org,vogelheim@chromium.org
>
> Committed: https://crrev.com/1a92fc945f648e9d787dda5c247cdfea088b6d65
> Cr-Commit-Position: refs/heads/master@{#402773}

TBR=hablich@chromium.org,machenbach@chromium.org,vogelheim@chromium.org,yangguo@chromium.org,v8-autoroll@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2111853002
Cr-Commit-Position: refs/heads/master@{#403133}

[modify] https://crrev.com/0d4110d82c8b9c3d743aa6d14e63ca5aaec0c241/DEPS

Also the root cause for these Android crashes -- the stack trace is just wrong:

https://uberchromegw.corp.google.com/i/chromium.perf/builders/Android%20Galaxy%20S5%20Perf%20%282%29/builds/2751/steps/oilpan_gc_times.sync_scroll.key_mobile_sites_smooth/logs/stdio/text

We think we have identified the offending change on the V8 side. We will get verification once our auto-roller is turned again after the branch cut and we start rolling V8 again. V8's branch will be cut on a version that doesn't contain the issue.