Recover CI fixes that resist folding into natural targets

Three semantic CI fixes whose intent doesn't translate back into the
historical APIs of their natural target commits:

* sizeclasstable.h: restore sentinel slot's slab_mask = ~size_t(0) so
  the bounds-checked memcpy shim treats foreign pointers as unbounded
  and any memcpy bound check trivially passes the sentinel through to
  the destination's native checks.
* arena.cc: replace the indirect mock_index probe in can_consolidate
  with an explicit in-range guard so GCC's release-mode -Warray-bounds
  analysis sees a visible guard covering the mock_store[] read.
* largearenarange.cc: pass MinBaseSizeBits<Pal>() as the
  MIN_REFILL_SIZE_BITS template arg so PalRange has enough to reserve
  on Windows.

Also rolls in small clang-format-15 drift and a stray duplicate include
that surfaced after re-targeting the bulk of the original CI fix into
the commits that introduced each affected line.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: mjp41

src/snmalloc/backend_helpers/inplacerep.h

@@ -234,8 +234,7 @@ namespace snmalloc
     static ArenaVariant get_variant(uintptr_t addr)
     {
       auto w = unit_at<0>(addr)->word_one;
-      return static_cast<ArenaVariant>(
-        (w & VARIANT_MASK) >> VARIANT_SHIFT);
+      return static_cast<ArenaVariant>((w & VARIANT_MASK) >> VARIANT_SHIFT);
     }
 
     static void set_variant(uintptr_t addr, ArenaVariant v)

src/snmalloc/ds/sizeclasstable.h

@@ -420,13 +420,16 @@ namespace snmalloc
   constexpr SizeClassTable sizeclass_metadata = SizeClassTable();
 
   // Sentinel must remain zero-initialised so fast-path lookups via
-  // `start(sc)` return zero size and slab_mask without a branch.
+  // `start(sc)` return zero size without a branch. Slab_mask is
+  // `~size_t(0)` so foreign-pointer `remaining_bytes` underflows to a
+  // huge value (see `SizeClassTable::SizeClassTable`).
   static_assert(
     sizeclass_metadata.start(sizeclass_t{}).size == 0,
     "sentinel slot must have size 0");
   static_assert(
-    sizeclass_metadata.start(sizeclass_t{}).slab_mask == 0,
-    "sentinel slot must have slab_mask 0");
+    sizeclass_metadata.start(sizeclass_t{}).slab_mask == ~size_t(0),
+    "sentinel slot must have slab_mask ~0 for foreign-pointer "
+    "remaining_bytes underflow");
 
   static_assert(
     bits::BITS - sizeclass_metadata.DIV_MULT_SHIFT <= MAX_CAPACITY_BITS);

src/test/func/aligned_dealloc/aligned_dealloc.cc

@@ -22,7 +22,6 @@
 #include "test/snmalloc_testlib.h"
 
 #include <iostream>
-#include "test/snmalloc_testlib.h"
 
 using namespace snmalloc;
 

src/test/func/arena/arena.cc

@@ -202,11 +202,11 @@ namespace snmalloc
 
     // Mirrors PagemapRep::can_consolidate, which reads
     // entry.is_boundary() from the pagemap. The boundary flag lives
-    // per-chunk in mock_store; mock_index asserts the index is in
-    // range, so any caller that probes outside the arena trips the
-    // assertion — this catches accidental out-of-region probes in
-    // Arena unit tests rather than as a release-build
-    // segfault.
+    // per-chunk in mock_store. An out-of-region probe returns false
+    // (cannot consolidate) — both because that is the right semantic
+    // (no neighbour exists outside the arena) and because it gives
+    // GCC's release-mode `-Warray-bounds` analysis a visible guard
+    // covering the `mock_store[...]` read on this branch.
     static bool can_consolidate(uintptr_t addr)
     {
       size_t idx = addr >> MIN_CHUNK_BITS;
@@ -1472,6 +1472,7 @@ namespace snmalloc
 
     auto r1 = arena.remove_block(chunk_size(4));
     SNMALLOC_ASSERT(r1 == top_addr);
+    UNUSED(r1);
 
     printf("  Block at arena top edge: OK\n");
   }

src/test/func/arenabins/arenabins.cc

@@ -542,8 +542,7 @@ namespace
   /// (defined directly in terms of `bin_subsets`).
   template<size_t B>
   size_t reference_find(
-    size_t n_chunks,
-    const typename ArenaBinsTestAccess<B, 0>::Bitmap& bm)
+    size_t n_chunks, const typename ArenaBinsTestAccess<B, 0>::Bitmap& bm)
   {
     using Bins = ArenaBinsTestAccess<B, 0>;
     using Bitmap = typename Bins::Bitmap;

src/test/func/large_offset_frontend/large_offset_frontend.cc

@@ -32,7 +32,6 @@
 
 #include <iostream>
 #include <snmalloc/snmalloc.h>
-#include "test/setup.h"
 
 #ifdef assert
 #  undef assert

src/test/func/largearenarange/largearenarange.cc

@@ -53,8 +53,9 @@ namespace
   static constexpr size_t MAX_BITS = bits::BITS - 1;
   static constexpr size_t MIN_REFILL_BITS = MinBaseSizeBits<Pal>();
 
-  using ArenaRange =
-    Pipe<ParentSource, LargeArenaRange<REFILL_BITS, MAX_BITS, TestPagemap>>;
+  using ArenaRange = Pipe<
+    ParentSource,
+    LargeArenaRange<REFILL_BITS, MAX_BITS, TestPagemap, MIN_REFILL_BITS>>;
 
   // --- Tests ---
 

src/test/func/smallarenarange/smallarenarange.cc

@@ -18,8 +18,8 @@
 #include <map>
 #include <new>
 #include <set>
-#include <snmalloc/backend_helpers/authmap.h>
 #include <snmalloc/backend_helpers/arena.h>
+#include <snmalloc/backend_helpers/authmap.h>
 #include <snmalloc/backend_helpers/inplacerep.h>
 #include <snmalloc/backend_helpers/smallarenarange.h>
 #include <vector>