Index: third_party/WebKit/Source/platform/heap/HeapPage.cpp |
diff --git a/third_party/WebKit/Source/platform/heap/HeapPage.cpp b/third_party/WebKit/Source/platform/heap/HeapPage.cpp |
index 8dc5d2d0155f2c76ae5d63252c4a9b1b2475f910..7078cfc0017398d52b37f261edefb2c40fc0c91c 100644 |
--- a/third_party/WebKit/Source/platform/heap/HeapPage.cpp |
+++ b/third_party/WebKit/Source/platform/heap/HeapPage.cpp |
@@ -563,6 +563,13 @@ void NormalPageArena::sweepAndCompact() { |
freedPageCount++; |
BasePage* nextPage; |
availablePages->unlink(&nextPage); |
+ // Clear out the page before adding it to the free page pool, which |
+ // decommits it. Recommitting the page must find a zeroed page later. |
+ // We cannot assume that the OS will hand back a zeroed page across |
+ // its "decommit" operation. |
+ DCHECK(!availablePages->isLargeObjectPage()); |
+ NormalPage* unusedPage = reinterpret_cast<NormalPage*>(availablePages); |
+ memset(unusedPage->payload(), 0, unusedPage->payloadSize()); |
availablePages->removeFromHeap(); |
availablePages = static_cast<NormalPage*>(nextPage); |
} |
@@ -1504,8 +1511,7 @@ void NormalPage::sweepAndCompact(CompactionContext& context) { |
#if ENABLE(ASSERT) || defined(LEAK_SANITIZER) || defined(ADDRESS_SANITIZER) || \ |
defined(MEMORY_SANITIZER) |
- // Zap the page, which is now available and will either be compacted into |
- // or freed. |
+ // Zap the unused portion, until it is either compacted into or freed. |
if (currentPage != this) { |
FreeList::zapFreedMemory(payload(), payloadSize()); |
} else { |