signals: Scrub the x87 state when simulating longjmp on i686 (#62669)
jl_simulate_longjmp edits only the general-purpose registers of the
interrupted context; the kernel's sigreturn then restores the saved FPU
state - possibly mid-computation with live x87 stack entries. The
resumed code (an exception handler, or a cancellation reset point
re-executing its check) expects the i386 ABI's function-boundary state,
so the leaked entries overflow the x87 register stack and poison every
subsequent float result with NaNs (and, through the GC's double-based
heap heuristics, can corrupt the process outright). Scrub the saved x87
state to all-registers-empty on both the linux and windows x86 context
layouts; the control word is preserved.
Observed as NaN timing results and a SIGSEGV in the i686 cancellation
tests, where the reset-point delivery exercises this path heavily.
This pull request was written with the assistance of generative AI.
Co-authored-by: Keno Fischer <Keno@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>