I think the finalization needs at least
Heap().MakeConsistentForGC();
as this clears this linear allocation area. Otherwise, we might be left with a stale linear allocation area that randomly points into free space.
We need to also check other things e.g.
Heap().FlushHeapDoesNotContainCacheIfNeeded();
Heap().ClearArenaAges();
Comment 1 by bugdroid1@chromium.org
, May 2 2018