[LSAN] Mask out tags from pointers on ARM in MaybeUserPointer heuristic

[kstoimenov]

Summary

This caused false positives because the existing logic was not taking into account that pointers could have a tag in them.

[vitalybuka]

compiler-rt/lib/lsan/lsan_common.cpp

281–283

This way is shorter: compiler will optimize to the same code https://godbolt.org/z/YKcPP1YGT
Keep what ever version you prefer.

[kstoimenov]

Updated constexpr.

compiler-rt/lib/lsan/lsan_common.cpp

 
 static inline bool MaybeUserPointer(uptr p) {
   // Since our heap is located in mmap-ed memory, we can assume a sensible lower
   // bound on heap addresses.
   const uptr kMinAddress = 4 * 4096;
   if (p < kMinAddress)
     return false;
 #  if defined(__x86_64__)
+  // TODO: add logic similar to ARM when Intel LAM is available.
   // Accept only canonical form user-space addresses.
   return ((p >> 47) == 0);
 #  elif defined(__mips64)
   return ((p >> 40) == 0);
 #  elif defined(__aarch64__)
+  // TBI (Top Byte Ignore) feature of AArch64: bits [63:56] are ignored in
+  // address translation and can be used to store a tag.
+  constexpr uptr kPointerMask = 255ULL << 48;
   // Accept up to 48 bit VMA.
-  return ((p >> 48) == 0);
+  return ((p & kPointerMask) == 0);
 #  elif defined(__loongarch_lp64)
   // Allow 47-bit user-space VMA at current.
   return ((p >> 47) == 0);
 #  else
   return true;
 #  endif
 }