Disable experimental natives when creating a start-up snapshot.

src/bootstrapper.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/bootstrapper.h"
 
 #include "src/accessors.h"
 #include "src/api-natives.h"
 #include "src/code-stubs.h"
 #include "src/extensions/externalize-string-extension.h"
@@ skipping 2873 matching lines @@
     InstallJSFunctionResultCaches();
     InitializeNormalizedMapCaches();
     if (!InstallNatives()) return;
 
     MakeFunctionInstancePrototypeWritable();
 
     if (!ConfigureGlobalObjects(global_proxy_template)) return;
     isolate->counters()->contexts_created_from_scratch()->Increment();
   }
 
-  // Install experimental natives.
-  if (!InstallExperimentalNatives()) return;
-  InitializeExperimentalGlobal();
+  // Install experimental natives. Do not include them into the snapshot as we
+  // should be able to turn them off at runtime. Re-installing them after
+  // they have already been deserialized would also fail.
+  if (!isolate->serializer_enabled()) {
+    if (!InstallExperimentalNatives()) return;
+    InitializeExperimentalGlobal();
+  }
 
   // The serializer cannot serialize typed arrays. Reset those typed arrays
   // for each new context.
   InitializeBuiltinTypedArrays();
 
   result_ = native_context();
 }
 
 
 // Support for thread preemption.
@@ skipping 18 matching lines @@
   return from + sizeof(NestingCounterType);
 }
 
 
 // Called when the top-level V8 mutex is destroyed.
 void Bootstrapper::FreeThreadResources() {
   DCHECK(!IsActive());
 }
 
 } }  // namespace v8::internal