[BOLT] Only run pac-ret passes if AllowPacret is set.

Tests:
- negate-ra-state-incorrect.s: added the --allow-experimental-pacret flag.
- negate-ra-state-flag.cpp: fails if the flag is not set.

Author: bgergely0

bolt/lib/Rewrite/BinaryPassManager.cpp

@@ -352,7 +352,7 @@ Error BinaryFunctionPassManager::runPasses() {
 Error BinaryFunctionPassManager::runAllPasses(BinaryContext &BC) {
   BinaryFunctionPassManager Manager(BC);
 
-  if (BC.isAArch64())
+  if (BC.isAArch64() && AllowPacret)
     Manager.registerPass(std::make_unique<MarkRAStates>());
 
   Manager.registerPass(
@@ -515,7 +515,8 @@ Error BinaryFunctionPassManager::runAllPasses(BinaryContext &BC) {
     // relocations out of range and crash during linking.
     Manager.registerPass(std::make_unique<LongJmpPass>(PrintLongJmp));
 
-    Manager.registerPass(std::make_unique<InsertNegateRAState>());
+    if (AllowPacret)
+      Manager.registerPass(std::make_unique<InsertNegateRAState>());
   }
 
   // This pass should always run last.*

bolt/test/AArch64/negate-ra-state-flag.cpp

@@ -0,0 +1,27 @@
+// This test checks that BOLT refuses to optimize binaries
+// compiled with -mbranch-protection=pac-ret, unless the
+// --allow-experimental-pacret flag is set.
+
+// REQUIRES: system-linux,bolt-runtime
+// RUN: %clangxx --target=aarch64-unknown-linux-gnu \
+// RUN: -mbranch-protection=pac-ret -Wl,-q %s -o %t.exe
+// RUN: not --crash llvm-bolt %t.exe -o %t.bolt.exe 2>&1 | FileCheck %s
+
+// CHECK: BOLT-ERROR: set --allow-experimental-pacret to allow processing
+
+extern "C" int printf(const char *, ...);
+
+void bar() { throw 10; }
+
+void foo() {
+  try {
+    bar();
+  } catch (int e) {
+    printf("Exception caught: %d\n", e);
+  }
+}
+
+int main() {
+  foo();
+  return 0;
+}

bolt/test/AArch64/negate-ra-state-incorrect.s

@@ -1,6 +1,7 @@
 # RUN: llvm-mc -filetype=obj -triple aarch64-unknown-unknown %s -o %t.o
 # RUN: %clang %cflags  %t.o -o %t.exe -Wl,-q
-# RUN: llvm-bolt %t.exe -o %t.exe.bolt | FileCheck %s
+# RUN: llvm-bolt %t.exe -o %t.exe.bolt --allow-experimental-pacret \
+# RUN: | FileCheck %s
 
 # check that the output is listing foo as incorrect
 # CHECK: BOLT-INFO: inconsistent RAStates in function foo