This GC does not probably survive to pointer scrambling. If believe in C I can validly do something like

    int *ptr = ...;
    intptr_t iptr = (intptr_t) ptr;
    ptr = NULL;
    iptr ^= MAGIC;
    // do something else
    ptr = (int*) (iptr ^ MAGIC);

At the end of this ptr is again a valid pointer to the same thing it was pointing at the beginning. However, if a GC scan will happen during the "do something else" block, it won't see the actual pointer value and it might free the pointed object.

I don't think it is possible to write a GC for C if the program is allowed to do this kind of things, because there is too little structure at runtime. And in any case, this kind of GC is not a GC "for C", as it heavily relies on knowing the compiler internals.

EDIT: Re-reading, I didn't mean to be harsh. This is still interesting to read, I am just noting a weakness that is not mentioned in the article. BTW, I know that glibc actually does some pointer scrambling like I said to mitigate some types of attack.