[Liftoff] Implement retpoline for indirect calls

As SSCA mitigation, use retpoline for each indirect call. We currently
only support retpolines on ia32 and x64.

R=titzer@chromium.org

Bug: v8:6600, chromium:798964
Change-Id: I32472c15e149977b00bf923f4d87e259b7b54800
Reviewed-on: https://chromium-review.googlesource.com/1052113Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53108}

src/wasm/baseline/ia32/liftoff-assembler-ia32.h

@@ -1565,9 +1565,11 @@ void LiftoffAssembler::CallRuntime(Zone* zone, Runtime::FunctionId fid) {
 void LiftoffAssembler::CallIndirect(wasm::FunctionSig* sig,
                                     compiler::CallDescriptor* call_descriptor,
                                     Register target) {
-  if (target == no_reg) {
-    add(esp, Immediate(kPointerSize));
-    call(Operand(esp, -4));
+  // Since we have more cache registers than parameter registers, the
+  // {LiftoffCompiler} should always be able to place {target} in a register.
+  DCHECK(target.is_valid());
+  if (FLAG_untrusted_code_mitigations) {
+    RetpolineCall(target);
   } else {
     call(target);
   }

src/wasm/baseline/x64/liftoff-assembler-x64.h

@@ -1422,7 +1422,11 @@ void LiftoffAssembler::CallIndirect(wasm::FunctionSig* sig,
     popq(kScratchRegister);
     target = kScratchRegister;
   }
+  if (FLAG_untrusted_code_mitigations) {
+    RetpolineCall(target);
+  } else {
     call(target);
+  }
 }
 
 void LiftoffAssembler::AllocateStackSlot(Register addr, uint32_t size) {