Oilpan: In ASan, poison all unmarked objects before start sweeping

Source/platform/heap/ThreadState.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 876 matching lines @@
             {
                 TRACE_EVENT0("blink_gc", "ThreadState::invokePreFinalizers");
                 invokePreFinalizers(*Heap::s_markingVisitor);
             }
         }
 
         if (isMainThread())
             ScriptForbiddenScope::exit();
     }
 
+#if defined(ADDRESS_SANITIZER)
+// TODO(haraken): Currently we cannot enable the poisoning because we have
+// real bugs where destructors touch other on-heap objects. Remove all the bugs
+// and enable the poisoning.
+#if 0
+    for (int i = 0; i < NumberOfHeaps; i++)
+        m_heaps[i]->poisonUnmarkedObjects();
+#endif
+#endif
+
 #if ENABLE(OILPAN)
     if (gcState() == EagerSweepScheduled) {
         // Eager sweeping should happen only in testing.
         setGCState(Sweeping);
         completeSweep();
     } else {
         // The default behavior is lazy sweeping.
         setGCState(Sweeping);
         scheduleIdleLazySweep();
     }
@@ skipping 391 matching lines @@
         json->beginArray(it->key.ascii().data());
         for (size_t age = 0; age <= maxHeapObjectAge; ++age)
             json->pushInteger(it->value.ages[age]);
         json->endArray();
     }
     TRACE_EVENT_OBJECT_SNAPSHOT_WITH_ID(TRACE_DISABLED_BY_DEFAULT("blink_gc"), statsName, this, json.release());
 }
 #endif
 
 } // namespace blink