- Convert to FlatPtr instead of doing pointer arithmetic on a too-large
pointer type in find_min_and_max_block_addresses(). This makes the
range more accurate.
- Untag possible cell pointers in add_possible_value() before doing the
rejection. Otherwise we end up rejecting most pointers since the tags
sit in the highest bits!
This fixes a crash when running the Speedometer benchmark.