2065986 - Make JIT Bailout compatible with CET Shadow Stack on x86_64

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, enhancement, P3)

Description

[Abhishek Sharma]

The bailout code currently rebuilds Baseline stack frames and copies them directly into the native stack in the bailout tail. However, when CET Shadow Stack is enabled - the return addresses within these newly materialized frames are absent from the shadow stack and cause a violation. The bailout process needs to be modified to use actual call instructions when rebuilding these frames to be compatible with CET Shadow Stack.

Comment 1

[Abhishek Sharma]

Attachment: Bug 2065986 - pt1. Introduce bailout stubs in the baseline interpreter and fallback ics r=jandem!,iain!

Add bailout stubs to the Baseline Interpreter and the Fallback IC compiler. These
are currently a no-op - but will be jumped to by the bailout tail after copying
a single frame's contents. This allows the frame's return address, that is presently
directly copied into the stack, to be materialized with an actual call - making
bailout compatible with CET shadow stack.

Comment 2

[Abhishek Sharma]

Attachment: Bug 2065986 - pt2. Add bailout stub information to the BaselineBailoutInfo r=jandem!,iain!

The BaselineStackBuilder now adds BailoutStubInfo corresponding to each
rebuilt stack frame to the BaselineBailoutInfo. The stub info tells the
bailout tail where each frame's contents end and the bailout stub that
will materialize the frame's return address.

Comment 3

[Abhishek Sharma]

Attachment: Bug 2065986 - pt3. Use bailout stub info to reconstruct stack r=jandem!,iain!

The bailout process is modified in x86_64 to use bailout stub information
to rebuild the stack one frame at a time instead of the existing bulk copy.

• The bailout tail uses the bailout stub information to setup the bailout
  registers, copy contents of frames (besides the return address) and jumps
  to the appropriate bailout stub.
• The bailout stub is setup so that simply calling back into the bailout
  tail materializes the expected return address - and the bailout tail can
  continue with the next frame.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/de748cf25a7e
https://hg.mozilla.org/integration/autoland/rev/d7cc6883723b
pt1. Introduce bailout stubs in the baseline interpreter and fallback ics r=jandem,iain
https://github.com/mozilla-firefox/firefox/commit/1f504e17f70d
https://hg.mozilla.org/integration/autoland/rev/b5ee4a72ac47
pt2. Add bailout stub information to the BaselineBailoutInfo r=jandem,iain
https://github.com/mozilla-firefox/firefox/commit/251c0992cd1f
https://hg.mozilla.org/integration/autoland/rev/45306dee8419
pt3. Use bailout stub info to reconstruct stack r=jandem,iain

Comment 5

[amarc]

https://hg.mozilla.org/mozilla-central/rev/d7cc6883723b
https://hg.mozilla.org/mozilla-central/rev/b5ee4a72ac47
https://hg.mozilla.org/mozilla-central/rev/45306dee8419