Fix aarch64 JIT crash when cinder_jit region exhausted

Summary:
`allocFromCinderJitRegion()` bump-allocates JIT code out of the fixed-size, linker-reserved `__cinder_jit` region but never checked that the requested size fit in the remaining space. Once the region was exhausted, `s_cinder_jit_free -= size` underflowed (it is a `size_t`) and the function returned `s_cinder_jit_cur` pointing past the end of the mapped RWX region instead of returning `nullptr` to fall back to hinted/`mmap` allocation. The caller (`allocPages` -> `ensureSpace`/`ensureSplitSpace` -> `addCode`) then `memcpy`'d the generated code into unmapped memory, crashing with SIGSEGV in `__folly_memcpy_aarch64_sve` on the JIT compile worker thread. This matches the production aarch64 stack trace.

The fix adds a bounds check inside `cinder_jit_region_mutex_` that returns `nullptr` when `size > s_cinder_jit_free`, so an exhausting or over-large request cleanly falls back to `mmap`. A rejected request consumes no region space.

Reviewed By: alexmalyshev

Differential Revision: D109663217

fbshipit-source-id: 2a22a6c0fe76a1dbc713f7457ee1feefec76708a

Author: DinoV

cinderx/Jit/code_allocator.cpp

@@ -148,6 +148,9 @@ uint8_t* allocFromCinderJitRegion(size_t size) {
   }
 
   std::lock_guard lock{cinder_jit_region_mutex_};
+  if (size > s_cinder_jit_free) {
+    return nullptr;
+  }
   uint8_t* res = s_cinder_jit_cur;
   s_cinder_jit_cur.fetch_add(size, std::memory_order_relaxed);
   s_cinder_jit_free -= size;

cinderx/RuntimeTests/hinted_code_allocation_test.cpp

@@ -18,6 +18,7 @@
 #include <array>
 #include <cstdint>
 #include <memory>
+#include <vector>
 
 using namespace cinderx::jit;
 
@@ -92,4 +93,47 @@ TEST_F(HintedCodeAllocationTest, AllocatesWithinCinderJitRegion) {
 #endif
 }
 
+// A request the linker-reserved region can't satisfy must fall back to mmap
+// rather than handing back a pointer past the end of the region.
+TEST_F(HintedCodeAllocationTest, FallsBackWhenRequestExceedsRegion) {
+#if defined(__linux__)
+  char* region_start = __cinder_jit_start;
+  char* region_end = __cinder_jit_end;
+
+  if (region_start == nullptr) {
+    GTEST_SKIP() << "binary not linked with the .cinder_jit linker script";
+  }
+  ASSERT_NE(region_end, nullptr)
+      << "binary not linked with the .cinder_jit linker script";
+  ASSERT_LT(region_start, region_end);
+
+  // Build a code blob larger than the whole region so the bump allocator can
+  // never satisfy it, forcing the mmap fallback. 0x90 is a nop on x86-64; the
+  // exact bytes don't matter, only that they're really copied into the
+  // allocation (exercising the memcpy that crashed in production).
+  size_t region_size = static_cast<size_t>(region_end - region_start);
+  std::vector<uint8_t> blob(region_size + 4096, 0x90);
+  blob.back() = 0xc3; // ret
+
+  asmjit::CodeHolder code;
+  code.init(code_allocator_->asmJitEnvironment());
+
+  cinderx::jit::codegen::arch::Builder as(&code);
+  ASSERT_EQ(as.section(code.textSection()), asmjit::kErrorOk);
+  ASSERT_EQ(as.embed(blob.data(), blob.size()), asmjit::kErrorOk);
+  ASSERT_EQ(as.finalize(), asmjit::kErrorOk);
+
+  AllocateResult result = code_allocator_->addCode(&code);
+  ASSERT_EQ(result.error, asmjit::kErrorOk);
+  ASSERT_NE(result.addr, nullptr);
+
+  // The allocation must have come from the mmap fallback, outside the region.
+  char* addr = static_cast<char*>(result.addr);
+  EXPECT_TRUE(addr < region_start || addr >= region_end)
+      << "oversized request was satisfied from inside the reserved region";
+#else
+  GTEST_SKIP() << "cinder_jit region allocation is only supported on Linux";
+#endif
+}
+
 } // namespace