Hacker News Reader

I think the trick is that after you complete the next mark phase, you have visited every possible pointer to the unmapped page.

Only if the program hasn't written a new reference to the unmapped page in that time. You need to check on writes too.