By what?

With Discardables. When Blink's allocator detects a fault in a memory section it swaps it out for a new one, and taints the old so it is only reused when no more remains.

Live objects get swapped between Discardable buffers quite frequently. They're not expected to stay at the same position in memory.