(Only) poison unmarked heap objects prior to sweeping.

third_party/WebKit/Source/platform/heap/ThreadState.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 562 matching lines @@
     size_t totalMemorySize();
     double heapGrowingRate();
     double partitionAllocGrowingRate();
     bool judgeGCThreshold(size_t allocatedObjectSizeThreshold, double heapGrowingRateThreshold);
 
     void runScheduledGC(BlinkGC::StackState);
 
     void eagerSweep();
 
 #if defined(ADDRESS_SANITIZER)
-    void poisonEagerArena(BlinkGC::Poisoning);
+    void poisonEagerArena();
     void poisonAllHeaps();
 #endif
 
     // When ThreadState is detaching from non-main thread its
     // heap is expected to be empty (because it is going away).
     // Perform registered cleanup tasks and garbage collection
     // to sweep away any objects that are left on this heap.
     // We assert that nothing must remain after this cleanup.
     // If assertion does not hold we crash as we are potentially
     // in the dangling pointer situation.
@@ skipping 112 matching lines @@
 
 template<> class ThreadStateFor<AnyThread> {
     STATIC_ONLY(ThreadStateFor);
 public:
     static ThreadState* state() { return ThreadState::current(); }
 };
 
 } // namespace blink
 
 #endif // ThreadState_h