(Only) poison unmarked heap objects prior to sweeping.

third_party/WebKit/Source/platform/heap/HeapPage.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 236 matching lines @@
 {
     ASSERT(getThreadState()->isInGC());
     ASSERT(!m_firstUnsweptPage);
 
     // Move all pages to a list of unswept pages.
     m_firstUnsweptPage = m_firstPage;
     m_firstPage = nullptr;
 }
 
 #if defined(ADDRESS_SANITIZER)
-void BaseArena::poisonArena(BlinkGC::ObjectsToPoison objectsToPoison, BlinkGC::Poisoning poisoning)
+void BaseArena::poisonArena()
 {
-    // TODO(sof): support complete poisoning of all arenas.
-    ASSERT(objectsToPoison != BlinkGC::MarkedAndUnmarked || arenaIndex() == BlinkGC::EagerSweepArenaIndex);
-
-    // This method may either be called to poison (SetPoison) heap
-    // object payloads prior to sweeping, or it may be called at
-    // the completion of a sweep to unpoison (ClearPoison) the
-    // objects remaining in the heap. Those will all be live and unmarked.
-    //
-    // Poisoning may be limited to unmarked objects only, or apply to all.
-    if (poisoning == BlinkGC::SetPoison) {
-        for (BasePage* page = m_firstUnsweptPage; page; page = page->next())
-            page->poisonObjects(objectsToPoison, poisoning);
-        return;
-    }
-    // Support clearing of poisoning after sweeping has completed,
-    // in which case the pages of the live objects are reachable
-    // via m_firstPage.
-    ASSERT(!m_firstUnsweptPage);
-    for (BasePage* page = m_firstPage; page; page = page->next())
-        page->poisonObjects(objectsToPoison, poisoning);
+    for (BasePage* page = m_firstUnsweptPage; page; page = page->next())
+        page->poisonUnmarkedObjects();
 }
 #endif
 
 Address BaseArena::lazySweep(size_t allocationSize, size_t gcInfoIndex)
 {
     // If there are no pages to be swept, return immediately.
     if (!m_firstUnsweptPage)
         return nullptr;
 
     RELEASE_ASSERT(getThreadState()->isSweepingInProgress());
@@ skipping 943 matching lines @@
             header->unmark();
         headerAddress += size;
         startOfGap = headerAddress;
         ASSERT(headerAddress <= payloadEnd());
     }
     if (startOfGap != payloadEnd())
         arenaForNormalPage()->addToFreeList(startOfGap, payloadEnd() - startOfGap);
 }
 
 #if defined(ADDRESS_SANITIZER)
-void NormalPage::poisonObjects(BlinkGC::ObjectsToPoison objectsToPoison, BlinkGC::Poisoning poisoning)
+void NormalPage::poisonUnmarkedObjects()
 {
     for (Address headerAddress = payload(); headerAddress < payloadEnd();) {
         HeapObjectHeader* header = reinterpret_cast<HeapObjectHeader*>(headerAddress);
         ASSERT(header->size() < blinkPagePayloadSize());
         // Check if a free list entry first since we cannot call
         // isMarked on a free list entry.
         if (header->isFree()) {
             headerAddress += header->size();
             continue;
         }
         ASSERT(header->checkHeader());
-        if (objectsToPoison == BlinkGC::MarkedAndUnmarked || !header->isMarked()) {
-            if (poisoning == BlinkGC::SetPoison)
-                ASAN_POISON_MEMORY_REGION(header->payload(), header->payloadSize());
-            else
-                ASAN_UNPOISON_MEMORY_REGION(header->payload(), header->payloadSize());
-        }
+        if (!header->isMarked())
+            ASAN_POISON_MEMORY_REGION(header->payload(), header->payloadSize());
         headerAddress += header->size();
     }
 }
 #endif
 
 void NormalPage::populateObjectStartBitMap()
 {
     memset(&m_objectStartBitMap, 0, objectStartBitMapSize);
     Address start = payload();
     for (Address headerAddress = start; headerAddress < payloadEnd();) {
@@ skipping 211 matching lines @@
 }
 
 void LargeObjectPage::makeConsistentForMutator()
 {
     HeapObjectHeader* header = heapObjectHeader();
     if (header->isMarked())
         header->unmark();
 }
 
 #if defined(ADDRESS_SANITIZER)
-void LargeObjectPage::poisonObjects(BlinkGC::ObjectsToPoison objectsToPoison, BlinkGC::Poisoning poisoning)
+void LargeObjectPage::poisonUnmarkedObjects()
 {
     HeapObjectHeader* header = heapObjectHeader();
-    if (objectsToPoison == BlinkGC::MarkedAndUnmarked || !header->isMarked()) {
-        if (poisoning == BlinkGC::SetPoison)
-            ASAN_POISON_MEMORY_REGION(header->payload(), header->payloadSize());
-        else
-            ASAN_UNPOISON_MEMORY_REGION(header->payload(), header->payloadSize());
-    }
+    if (!header->isMarked())
+        ASAN_POISON_MEMORY_REGION(header->payload(), header->payloadSize());
 }
 #endif
 
 void LargeObjectPage::checkAndMarkPointer(Visitor* visitor, Address address)
 {
     ASSERT(contains(address));
     if (!containedInObjectPayload(address) || heapObjectHeader()->isDead())
         return;
     markPointer(visitor, heapObjectHeader());
 }
@@ skipping 78 matching lines @@
 
     m_hasEntries = true;
     size_t index = hash(address);
     ASSERT(!(index & 1));
     Address cachePage = roundToBlinkPageStart(address);
     m_entries[index + 1] = m_entries[index];
     m_entries[index] = cachePage;
 }
 
 } // namespace blink