(Only) poison unmarked heap objects prior to sweeping.

third_party/WebKit/Source/platform/heap/ThreadState.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 1015 matching lines @@
     // to disallow a GC during the pre-finalizers.
     setGCState(Sweeping);
 
     // Allocation is allowed during the pre-finalizers and destructors.
     // However, they must not mutate an object graph in a way in which
     // a dead object gets resurrected.
     invokePreFinalizers();
 
     m_accumulatedSweepingTime = 0;
 
-#if defined(ADDRESS_SANITIZER)
-    poisonEagerArena(BlinkGC::SetPoison);
-#endif
     eagerSweep();
+
 #if defined(ADDRESS_SANITIZER)
     poisonAllHeaps();
 #endif
-
     if (previousGCState == EagerSweepScheduled) {
         // Eager sweeping should happen only in testing.
         completeSweep();
     } else {
         // The default behavior is lazy sweeping.
         scheduleIdleLazySweep();
     }
 }
 
 #if defined(ADDRESS_SANITIZER)
 void ThreadState::poisonAllHeaps()
 {
     // TODO(Oilpan): enable the poisoning always.
 #if ENABLE(OILPAN)
-    // Unpoison the live objects remaining in the eager arenas..
-    poisonEagerArena(BlinkGC::ClearPoison);
     // ..along with poisoning all unmarked objects in the other arenas.
     for (int i = 1; i < BlinkGC::NumberOfArenas; i++)
-        m_arenas[i]->poisonArena(BlinkGC::UnmarkedOnly, BlinkGC::SetPoison);
+        m_arenas[i]->poisonArena();
 #endif
 }
 
-void ThreadState::poisonEagerArena(BlinkGC::Poisoning poisoning)
+void ThreadState::poisonEagerArena()
 {
     // TODO(Oilpan): enable the poisoning always.
 #if ENABLE(OILPAN)
-    m_arenas[BlinkGC::EagerSweepArenaIndex]->poisonArena(BlinkGC::MarkedAndUnmarked, poisoning);
+    m_arenas[BlinkGC::EagerSweepArenaIndex]->poisonArena();
 #endif
 }
 #endif
 
 void ThreadState::eagerSweep()
 {
+#if defined(ADDRESS_SANITIZER)
+    poisonEagerArena();
+#endif
     ASSERT(checkThread());
     // Some objects need to be finalized promptly and cannot be handled
     // by lazy sweeping. Keep those in a designated heap and sweep it
     // eagerly.
     ASSERT(isSweepingInProgress());
 
     // Mirroring the completeSweep() condition; see its comment.
     if (sweepForbidden())
         return;
 
@@ skipping 472 matching lines @@
     threadDump->addScalar("dead_count", "objects", totalDeadCount);
     threadDump->addScalar("live_size", "bytes", totalLiveSize);
     threadDump->addScalar("dead_size", "bytes", totalDeadSize);
 
     WebMemoryAllocatorDump* heapsDump = BlinkGCMemoryDumpProvider::instance()->createMemoryAllocatorDumpForCurrentGC(heapsDumpName);
     WebMemoryAllocatorDump* classesDump = BlinkGCMemoryDumpProvider::instance()->createMemoryAllocatorDumpForCurrentGC(classesDumpName);
     BlinkGCMemoryDumpProvider::instance()->currentProcessMemoryDump()->addOwnershipEdge(classesDump->guid(), heapsDump->guid());
 }
 
 } // namespace blink