stack: Lower IsPtr() floor from 8MiB to to 4MiB

That's frequent to have pointer lower in the address space. This was not
well tested but will be well tested in v2. This will modify stack
bucketing, generally helping in AnyPointer mode.

Author: maruel

stack/stack.go

@@ -124,12 +124,16 @@ type Arg struct {
 // IsPtr returns true if we guess it's a pointer. It's only a guess, it can be
 // easily be confused by a bitmask.
 func (a *Arg) IsPtr() bool {
-	// Assumes all pointers are above 8MiB and positive; assuming that above half
-	// the memory is kernel memory. This is not always true.
+	// Assumes all values are above 4MiB and positive are pointers; assuming that
+	// above half the memory is kernel memory.
+	//
+	// This is not always true but this should be good enough to help
+	// implementing AnyPointer.
+	//
 	// Assume the stack was generated with the same bitness (32 vs 64) than the
 	// code processing it.
-	const maxInt = uint64(int((^uint(0)) >> 1))
-	return a.Value > 8*1024*1024 && a.Value < maxInt
+	const maxInt = uint64((^uint(0)) >> 1)
+	return a.Value > 4*1024*1024 && a.Value < maxInt
 }
 
 var lookup = []string{"0", "1", "2", "3", "4", "5", "6", "7", "8", "9"}