Merge branch 'lang/memory-scanfix' into lang/foundations

# Conflicts:
#	selfhost/ludicc.seed.ll
#	selfhost/ludicc.win.seed.ll

selfhost/backend/emit_fence_ir.ludic

@@ -1265,13 +1265,22 @@ function emit_fence_frame() -> void {
   emith("no:\n")
   emith("  ret i1 0\n")
   emith("}\n")
+  emith("; a candidate is followed only if it could be a heap block's start: 16-aligned (malloc's), inside the\n")
+  emith("; user address space (above the first 4 GB, below 2^47 - a word with high bits is data, and some\n")
+  emith("; zones fault looking one up), and not in the frame arena; only then does malloc_size look at it\n")
   emith("define internal void @lp_visit(i64 %w) {\n")
   emith("entry:\n")
-  emith("  %z = icmp eq i64 %w, 0\n")
-  emith("  %al = and i64 %w, 7\n")
+  emith("  %al = and i64 %w, 15\n")
   emith("  %mis = icmp ne i64 %al, 0\n")
-  emith("  %skip = or i1 %z, %mis\n")
-  emith("  br i1 %skip, label %out, label %size\n")
+  emith("  %low = icmp ult i64 %w, 4294967296\n")
+  emith("  %high = icmp uge i64 %w, 140737488355328\n")
+  emith("  %s1 = or i1 %mis, %low\n")
+  emith("  %s2 = or i1 %s1, %high\n")
+  emith("  br i1 %s2, label %out, label %arena\n")
+  emith("arena:\n")
+  emith("  %wp = inttoptr i64 %w to ptr\n")
+  emith("  %inar = call i1 @lp_in_arena(ptr %wp)\n")
+  emith("  br i1 %inar, label %out, label %size\n")
   emith("size:\n")
   emith("  %p = inttoptr i64 %w to ptr\n")
   emith("  %sz = call i64 @malloc_size(ptr %p)\n")