[wasm] enable kRetpoline on call_indirect

Change-Id: If97eda2cc2da4501da7f4a753107f58c2797f237
Reviewed-on: https://chromium-review.googlesource.com/885181
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51775}

src/compiler/wasm-compiler.cc

@@ -2530,7 +2530,7 @@ Node* WasmGraphBuilder::BuildCCall(MachineSignature* sig, Node* function,
 Node* WasmGraphBuilder::BuildWasmCall(wasm::FunctionSig* sig, Node** args,
                                       Node*** rets,
                                       wasm::WasmCodePosition position,
-                                      Node* wasm_context) {
+                                      Node* wasm_context, bool use_retpoline) {
   if (wasm_context == nullptr) {
     DCHECK_NOT_NULL(wasm_context_);
     wasm_context = wasm_context_.get();
@@ -2551,7 +2551,8 @@ Node* WasmGraphBuilder::BuildWasmCall(wasm::FunctionSig* sig, Node** args,
   args[params + 2] = *effect_;
   args[params + 3] = *control_;
 
-  auto call_descriptor = GetWasmCallDescriptor(jsgraph()->zone(), sig);
+  auto call_descriptor =
+      GetWasmCallDescriptor(jsgraph()->zone(), sig, use_retpoline);
   const Operator* op = jsgraph()->common()->Call(call_descriptor);
   Node* call = graph()->NewNode(op, static_cast<int>(count), args);
   SetSourcePosition(call, position);
@@ -2698,7 +2699,9 @@ Node* WasmGraphBuilder::CallIndirect(uint32_t sig_index, Node** args,
                        Uint32Constant(fixed_offset + kPointerSize)),
       *effect_, *control_);
   args[0] = entry;
-  return BuildWasmCall(sig, args, rets, position);
+  constexpr Node* wasm_context = nullptr;
+  const bool use_retpoline = FLAG_untrusted_code_mitigations;
+  return BuildWasmCall(sig, args, rets, position, wasm_context, use_retpoline);
 }
 
 Node* WasmGraphBuilder::BuildI32Rol(Node* left, Node* right) {

src/compiler/wasm-compiler.h

@@ -508,7 +508,7 @@ class WasmGraphBuilder {
   Node* BuildCCall(MachineSignature* sig, Node* function, Args... args);
   Node* BuildWasmCall(wasm::FunctionSig* sig, Node** args, Node*** rets,
                       wasm::WasmCodePosition position,
-                      Node* wasm_context = nullptr);
+                      Node* wasm_context = nullptr, bool use_retpoline = false);
 
   Node* BuildF32CopySign(Node* left, Node* right);
   Node* BuildF64CopySign(Node* left, Node* right);
@@ -631,7 +631,7 @@ class WasmGraphBuilder {
 constexpr int kWasmContextParameterIndex = 0;
 
 V8_EXPORT_PRIVATE CallDescriptor* GetWasmCallDescriptor(
-    Zone* zone, wasm::FunctionSig* signature);
+    Zone* zone, wasm::FunctionSig* signature, bool use_retpoline = false);
 V8_EXPORT_PRIVATE CallDescriptor* GetI32WasmCallDescriptor(
     Zone* zone, CallDescriptor* call_descriptor);
 V8_EXPORT_PRIVATE CallDescriptor* GetI32WasmCallDescriptorForSimd(

src/compiler/wasm-linkage.cc

@@ -223,7 +223,8 @@ static constexpr Allocator parameter_registers(kGPParamRegisters,
 }  // namespace
 
 // General code uses the above configuration data.
-CallDescriptor* GetWasmCallDescriptor(Zone* zone, wasm::FunctionSig* fsig) {
+CallDescriptor* GetWasmCallDescriptor(Zone* zone, wasm::FunctionSig* fsig,
+                                      bool use_retpoline) {
   // The '+ 1' here is to accomodate the wasm_context as first parameter.
   LocationSignature::Builder locations(zone, fsig->return_count(),
                                        fsig->parameter_count() + 1);
@@ -273,7 +274,8 @@ CallDescriptor* GetWasmCallDescriptor(Zone* zone, wasm::FunctionSig* fsig) {
       compiler::Operator::kNoProperties,  // properties
       kCalleeSaveRegisters,               // callee-saved registers
       kCalleeSaveFPRegisters,             // callee-saved fp regs
-      CallDescriptor::kNoFlags,                  // flags
+      use_retpoline ? CallDescriptor::kRetpoline
+                    : CallDescriptor::kNoFlags,  // flags
       "wasm-call",                               // debug name
       0,                                         // allocatable registers
       rets.stack_offset - params.stack_offset);  // stack_return_count