Bug 1433111 - Add JS Shell and about:config switch for Value masking. r=jandem

dom/ipc/ContentPrefs.cpp

@@ -127,6 +127,7 @@ const char* mozilla::dom::ContentPrefs::gEarlyPrefs[] = {
   "javascript.options.shared_memory",
   "javascript.options.spectre.index_masking",
   "javascript.options.spectre.string_mitigations",
+  "javascript.options.spectre.value_masking",
   "javascript.options.streams",
   "javascript.options.strict",
   "javascript.options.strict.debug",

js/src/jsapi.cpp

@@ -7259,6 +7259,9 @@ JS_SetGlobalJitCompilerOption(JSContext* cx, JSJitCompilerOption opt, uint32_t v
       case JSJITCOMPILER_SPECTRE_STRING_MITIGATIONS:
         jit::JitOptions.spectreStringMitigations = !!value;
         break;
+      case JSJITCOMPILER_SPECTRE_VALUE_MASKING:
+        jit::JitOptions.spectreValueMasking = !!value;
+        break;
       case JSJITCOMPILER_ASMJS_ATOMICS_ENABLE:
         jit::JitOptions.asmJSAtomicsEnable = !!value;
         break;

js/src/jsapi.h

@@ -5913,7 +5913,8 @@ JS_SetOffthreadIonCompilationEnabled(JSContext* cx, bool enabled);
     Register(SIMULATOR_ALWAYS_INTERRUPT, "simulator.always-interrupt")      \
     Register(SPECTRE_INDEX_MASKING, "spectre.index-masking")                \
     Register(SPECTRE_STRING_MITIGATIONS, "spectre.string-mitigations")      \
-Register(ASMJS_ATOMICS_ENABLE, "asmjs.atomics.enable")  \
+    Register(SPECTRE_VALUE_MASKING, "spectre.value-masking")                \
+    Register(ASMJS_ATOMICS_ENABLE, "asmjs.atomics.enable")                  \
     Register(WASM_FOLD_OFFSETS, "wasm.fold-offsets")
 
 typedef enum JSJitCompilerOption {

js/src/shell/js.cpp

@@ -8526,9 +8526,11 @@ SetContextOptions(JSContext* cx, const OptionParser& op)
         if (strcmp(str, "on") == 0) {
             jit::JitOptions.spectreIndexMasking = true;
             jit::JitOptions.spectreStringMitigations = true;
+            jit::JitOptions.spectreValueMasking = true;
         } else if (strcmp(str, "off") == 0) {
             jit::JitOptions.spectreIndexMasking = false;
             jit::JitOptions.spectreStringMitigations = false;
+            jit::JitOptions.spectreValueMasking = false;
         } else {
             return OptionFailure("spectre-mitigations", str);
         }

js/xpconnect/src/XPCJSContext.cpp

@@ -811,6 +811,7 @@ ReloadPrefsCallback(const char* pref, void* data)
     bool spectreIndexMasking = Preferences::GetBool(JS_OPTIONS_DOT_STR "spectre.index_masking");
     bool spectreStringMitigations =
         Preferences::GetBool(JS_OPTIONS_DOT_STR "spectre.string_mitigations");
+    bool spectreValueMasking = Preferences::GetBool(JS_OPTIONS_DOT_STR "spectre.value_masking");
 
     sSharedMemoryEnabled = Preferences::GetBool(JS_OPTIONS_DOT_STR "shared_memory");
 
@@ -875,6 +876,7 @@ ReloadPrefsCallback(const char* pref, void* data)
     JS_SetGlobalJitCompilerOption(cx, JSJITCOMPILER_SPECTRE_INDEX_MASKING, spectreIndexMasking);
     JS_SetGlobalJitCompilerOption(cx, JSJITCOMPILER_SPECTRE_STRING_MITIGATIONS,
                                   spectreStringMitigations);
+    JS_SetGlobalJitCompilerOption(cx, JSJITCOMPILER_SPECTRE_VALUE_MASKING, spectreValueMasking);
 }
 
 XPCJSContext::~XPCJSContext()

modules/libpref/init/all.js

@@ -1553,6 +1553,7 @@ pref("javascript.options.dump_stack_on_debuggee_would_run", false);
 // Spectre security vulnerability mitigations.
 pref("javascript.options.spectre.index_masking", true);
 pref("javascript.options.spectre.string_mitigations", true);
+pref("javascript.options.spectre.value_masking", true);
 
 // Streams API
 pref("javascript.options.streams", false);