Don't run the second pass of the pending phantom callbacks if the heap has been torn down.

src/isolate.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_ISOLATE_H_
 #define V8_ISOLATE_H_
 
 #include <queue>
+#include <set>
+
 #include "include/v8-debug.h"
 #include "src/allocation.h"
 #include "src/assert-scope.h"
 #include "src/base/atomicops.h"
 #include "src/builtins.h"
+#include "src/cancelable-task.h"
 #include "src/contexts.h"
 #include "src/date.h"
 #include "src/execution.h"
 #include "src/frames.h"
 #include "src/futex-emulation.h"
 #include "src/global-handles.h"
 #include "src/handles.h"
 #include "src/hashmap.h"
 #include "src/heap/heap.h"
 #include "src/optimizing-compile-dispatcher.h"
@@ skipping 1102 matching lines @@
 
   void set_array_buffer_allocator(v8::ArrayBuffer::Allocator* allocator) {
     array_buffer_allocator_ = allocator;
   }
   v8::ArrayBuffer::Allocator* array_buffer_allocator() const {
     return array_buffer_allocator_;
   }
 
   FutexWaitListNode* futex_wait_list_node() { return &futex_wait_list_node_; }
 
+  void RegisterCancelableTask(CancelableTask* task);
+  void RemoveCancelableTask(CancelableTask* task);
+
  protected:
   explicit Isolate(bool enable_serializer);
 
  private:
   friend struct GlobalState;
   friend struct InitializeGlobalState;
   Handle<JSObject> SetUpSubregistry(Handle<JSObject> registry, Handle<Map> map,
                                     const char* name);
 
   // These fields are accessed through the API, offsets must be kept in sync
@@ skipping 215 matching lines @@
 
   v8::Isolate::UseCounterCallback use_counter_callback_;
   BasicBlockProfiler* basic_block_profiler_;
 
   List<Object*> partial_snapshot_cache_;
 
   v8::ArrayBuffer::Allocator* array_buffer_allocator_;
 
   FutexWaitListNode futex_wait_list_node_;
 
+  std::set<CancelableTask*> cancelable_tasks_;
+
   friend class ExecutionAccess;
   friend class HandleScopeImplementer;
   friend class OptimizingCompileDispatcher;
   friend class SweeperThread;
   friend class ThreadManager;
   friend class Simulator;
   friend class StackGuard;
   friend class ThreadId;
   friend class TestMemoryAllocatorScope;
   friend class TestCodeRangeScope;
@@ skipping 208 matching lines @@
   }
 
   EmbeddedVector<char, 128> filename_;
   FILE* file_;
   int scope_depth_;
 };
 
 } }  // namespace v8::internal
 
 #endif  // V8_ISOLATE_H_