1465448 - Spectre mitigations for CodeGenerator::visitFunctionDispatch

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, enhancement, P2)

Description

[Nicolas B. Pierron [:nbp]]

Spectre issues are issues where a branch is taken based on speculation instead of being based on a condition. The speculative execution can then do multiple sequential reads allowing to probe any memory's content by looking at loaded cache line of any controlled buffer.

Extracted from Bug 1452136 audit:
 - branchTestObjGroupUnsafe
 - CodeGenerator::visitFunctionDispatch(LFunctionDispatch* lir)

A speculative execution of the dispatch implies that we would not have loaded the "input->group()" address from "input", while taking one of these branches based on speculation.

This could cause issues if we have follow-up uses of "input" after in dominated branches. This is not frequent in common code bases therefore we could special case the clobber to only be made if the MIR instruction has uses within the non-default case.

If we do not have follow-up uses of "input" then this would be like a miss predicted branch with no option of reading data through the input register.

TODO: We should use spectre-safe variant if the mir has more uses out-side the fallback case.

Note: We could factor out the load of the object group.

Comment 1

[Ted Campbell [:tcampbell]]

Fixed by IonBuilder removal in Bug 1673553. The FunctionDispatch type was removed.