(Only) poison unmarked heap objects prior to sweeping.

third_party/WebKit/Source/platform/heap/HeapPage.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 360 matching lines @@
     // The following methods are not performance-sensitive.
     virtual size_t objectPayloadSizeForTesting() = 0;
     virtual bool isEmpty() = 0;
     virtual void removeFromHeap() = 0;
     virtual void sweep() = 0;
     virtual void makeConsistentForGC() = 0;
     virtual void makeConsistentForMutator() = 0;
     virtual void invalidateObjectStartBitmap() = 0;
 
 #if defined(ADDRESS_SANITIZER)
-    virtual void poisonObjects(BlinkGC::ObjectsToPoison, BlinkGC::Poisoning) = 0;
+    virtual void poisonUnmarkedObjects() = 0;
 #endif
     // Check if the given address points to an object in this
     // heap page. If so, find the start of that object and mark it
     // using the given Visitor. Otherwise do nothing. The pointer must
     // be within the same aligned blinkPageSize as the this-pointer.
     //
     // This is used during conservative stack scanning to
     // conservatively mark all objects that could be referenced from
     // the stack.
     virtual void checkAndMarkPointer(Visitor*, Address) = 0;
@@ skipping 70 matching lines @@
     }
 
     size_t objectPayloadSizeForTesting() override;
     bool isEmpty() override;
     void removeFromHeap() override;
     void sweep() override;
     void makeConsistentForGC() override;
     void makeConsistentForMutator() override;
     void invalidateObjectStartBitmap() override { m_objectStartBitMapComputed = false; }
 #if defined(ADDRESS_SANITIZER)
-    void poisonObjects(BlinkGC::ObjectsToPoison, BlinkGC::Poisoning) override;
+    void poisonUnmarkedObjects() override;
 #endif
     void checkAndMarkPointer(Visitor*, Address) override;
     void markOrphaned() override;
 
     void takeSnapshot(WebMemoryAllocatorDump*, ThreadState::GCSnapshotInfo&, HeapSnapshotInfo&) override;
 #if ENABLE(ASSERT)
     // Returns true for the whole blinkPageSize page that the page is on, even
     // for the header, and the unmapped guard page at the start. That ensures
     // the result can be used to populate the negative page cache.
     bool contains(Address) override;
@@ skipping 36 matching lines @@
     }
 
     size_t objectPayloadSizeForTesting() override;
     bool isEmpty() override;
     void removeFromHeap() override;
     void sweep() override;
     void makeConsistentForGC() override;
     void makeConsistentForMutator() override;
     void invalidateObjectStartBitmap() override { }
 #if defined(ADDRESS_SANITIZER)
-    void poisonObjects(BlinkGC::ObjectsToPoison, BlinkGC::Poisoning) override;
+    void poisonUnmarkedObjects() override;
 #endif
     void checkAndMarkPointer(Visitor*, Address) override;
     void markOrphaned() override;
 
     void takeSnapshot(WebMemoryAllocatorDump*, ThreadState::GCSnapshotInfo&, HeapSnapshotInfo&) override;
 #if ENABLE(ASSERT)
     // Returns true for any address that is on one of the pages that this
     // large object uses. That ensures that we can use a negative result to
     // populate the negative page cache.
     bool contains(Address) override;
@@ skipping 131 matching lines @@
     virtual void clearFreeLists() { }
     void makeConsistentForGC();
     void makeConsistentForMutator();
 #if ENABLE(ASSERT)
     virtual bool isConsistentForGC() = 0;
 #endif
     size_t objectPayloadSizeForTesting();
     void prepareHeapForTermination();
     void prepareForSweep();
 #if defined(ADDRESS_SANITIZER)
-    void poisonArena(BlinkGC::ObjectsToPoison, BlinkGC::Poisoning);
+    void poisonArena();
 #endif
     Address lazySweep(size_t, size_t gcInfoIndex);
     void sweepUnsweptPage();
     // Returns true if we have swept all pages within the deadline.
     // Returns false otherwise.
     bool lazySweepWithDeadline(double deadlineSeconds);
     void completeSweep();
 
     ThreadState* getThreadState() { return m_threadState; }
     int arenaIndex() const { return m_index; }
@@ skipping 194 matching lines @@
         SET_MEMORY_ACCESSIBLE(result, allocationSize - sizeof(HeapObjectHeader));
         ASSERT(findPageFromAddress(headerAddress + allocationSize - 1));
         return result;
     }
     return outOfLineAllocate(allocationSize, gcInfoIndex);
 }
 
 } // namespace blink
 
 #endif // HeapPage_h