PPC/s390: [turbofan] Remove branch_load_poisoning flag.

Port b048c16b

Original Commit Message:

    The goal is to remove CL to remove the confusing implications for
    full poisoning.

    This is an alternative to
    https://chromium-review.googlesource.com/c/chromium/src/+/1253341
    where chrome has to work around our implication system.

    In the optimizing compiler, we already have a bottleneck for setting
    mitigation level in src/compiler/pipeline.cc, so it is easy to change
    back to partial mitigations.

R=jarin@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I96d0651eed2638abddb5486da1e2b55a84e97264
Reviewed-on: https://chromium-review.googlesource.com/c/1261797Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#56385}

src/builtins/ppc/builtins-ppc.cc

@@ -2484,10 +2484,11 @@ void Builtins::Generate_CEntry(MacroAssembler* masm, int result_size,
   __ StoreP(cp, MemOperand(fp, StandardFrameConstants::kContextOffset));
   __ bind(&skip);
 
-  // Reset the masking register.
-  if (FLAG_branch_load_poisoning) {
+  // Reset the masking register. This is done independent of the underlying
+  // feature flag {FLAG_untrusted_code_mitigations} to make the snapshot work
+  // with both configurations. It is safe to always do this, because the
+  // underlying register is caller-saved and can be arbitrarily clobbered.
   __ ResetSpeculationPoisonRegister();
-  }
 
   // Compute the handler entry address and jump to it.
   ConstantPoolUnavailableScope constant_pool_unavailable(masm);

src/builtins/s390/builtins-s390.cc

@@ -2487,10 +2487,11 @@ void Builtins::Generate_CEntry(MacroAssembler* masm, int result_size,
   __ StoreP(cp, MemOperand(fp, StandardFrameConstants::kContextOffset));
   __ bind(&skip);
 
-  // Reset the masking register.
-  if (FLAG_branch_load_poisoning) {
+  // Reset the masking register. This is done independent of the underlying
+  // feature flag {FLAG_untrusted_code_mitigations} to make the snapshot work
+  // with both configurations. It is safe to always do this, because the
+  // underlying register is caller-saved and can be arbitrarily clobbered.
   __ ResetSpeculationPoisonRegister();
-  }
 
   // Compute the handler entry address and jump to it.
   __ Move(r3, pending_handler_entrypoint_address);