[CFI] Disable indirect call checking into JITd code

CFI-icall checking makes use of compile-time information to verify
whether a given indirect call is valid; however, this is impossible to
verify for calls into JITed code. Mark functions calling into JITed code
with an attribute disabling CFI-icall checking.

Bug=v8:7164

Change-Id: I20161510b810744ff5e234d77cf603913482a539
Reviewed-on: https://chromium-review.googlesource.com/861305Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50516}

src/base/macros.h

@@ -169,18 +169,23 @@ V8_INLINE Dest bit_cast(Source const& source) {
 #define DISABLE_ASAN
 #endif
 
-// DISABLE_CFI_PERF -- Disable Control Flow Integrity checks for Perf reasons.
-#if !defined(DISABLE_CFI_PERF)
+// Helper macro to define no_sanitize attributes only with clang.
 #if defined(__clang__) && defined(__has_attribute)
 #if __has_attribute(no_sanitize)
-#define DISABLE_CFI_PERF __attribute__((no_sanitize("cfi")))
-#endif
+#define CLANG_NO_SANITIZE(what) __attribute__((no_sanitize(what)))
 #endif
 #endif
-#if !defined(DISABLE_CFI_PERF)
-#define DISABLE_CFI_PERF
+#if !defined(CLANG_NO_SANITIZE)
+#define CLANG_NO_SANITIZE(what)
 #endif
 
+// DISABLE_CFI_PERF -- Disable Control Flow Integrity checks for Perf reasons.
+#define DISABLE_CFI_PERF CLANG_NO_SANITIZE("cfi")
+
+// DISABLE_CFI_ICALL -- Disable Control Flow Integrity indirect call checks,
+// useful because calls into JITed code can not be CFI verified.
+#define DISABLE_CFI_ICALL CLANG_NO_SANITIZE("cfi-icall")
+
 #if V8_CC_GNU
 #define V8_IMMEDIATE_CRASH() __builtin_trap()
 #else

src/simulator.h

@@ -105,7 +105,7 @@ class GeneratedCode {
         reinterpret_cast<byte*>(fn_ptr_), args...);
   }
 #else
-  Return Call(Args... args) {
+  DISABLE_CFI_ICALL Return Call(Args... args) {
     // When running without a simulator we call the entry directly.
     return fn_ptr_(args...);
   }