linux: park -fno-semantic-interposition + -fno-plt (JNI alias clash)

Both flags are incompatible with default-visibility JNI export aliases
emitted by NETTY_JNI_ALIAS in netty/netty-tcnative. Under
-fno-semantic-interposition the compiler treats those aliases as
PC-rel-addressable from inside the DSO, but the aarch64 linker
(ld.lld) sees their declared default visibility and refuses the
resulting relocation:

  ld.lld: error: relocation R_AARCH64_ADR_PREL_PG_HI21 cannot be used
  against symbol 'Java_io_netty_channel_unix_Socket_recvFrom';
  recompile with -fPIC

Move both flags to labs.disabled.txt with the failure mode and the
re-enable condition (move NETTY_JNI_ALIAS to STV_PROTECTED, or stop
emitting default-visibility JNI aliases) inline.

Author: sgammon

labs.disabled.txt

@@ -65,6 +65,28 @@
 # and the userspace runtime contract is ready to require CET support.
 -fcf-protection=full
 #
+# Skip the dynamic-symbol interposition contract for own-DSO defs and
+# remove the lazy-binding PLT for external calls. Together they let
+# clang resolve intra-DSO calls/constants with PC-relative addressing
+# (-fno-semantic-interposition) and route external calls through a
+# read-only GOT (-fno-plt + -Wl,-z,now). Net effect on Linux: smaller
+# code, faster cold start, no writable PLT-stub gadget surface.
+#
+# Incompatible with our NETTY_JNI_ALIAS pattern: the macro emits the
+# `Java_<class>_<method>` entry symbols as `__attribute__((alias,
+# visibility("default")))`. Under -fno-semantic-interposition the
+# compiler treats them as protected-equivalent and addresses them with
+# `adrp+add` PC-relative, but ld.lld (correctly) sees their declared
+# default visibility and refuses the relocation:
+#   ld.lld: error: relocation R_AARCH64_ADR_PREL_PG_HI21 cannot be used
+#   against symbol 'Java_io_netty_channel_unix_Socket_recvFrom';
+#   recompile with -fPIC
+# Re-enable only if NETTY_JNI_ALIAS moves to STV_PROTECTED (which keeps
+# dlsym discoverability while marking the alias non-interposable) or we
+# stop emitting default-visibility JNI aliases altogether.
+-fno-semantic-interposition
+-fno-plt
+#
 # Per-basic-block sections — prerequisite for a Propeller-style
 # symbol-ordering pass at the consumer's final link, where hot blocks
 # get reordered across function boundaries to shrink the icache

linux.txt

@@ -27,22 +27,16 @@
 # darwin: cmake build aborts. Linux only.
 -fexperimental-relative-c++-abi-vtables
 
-# Skip the dynamic-symbol interposition contract for our own definitions:
-# under ELF the linker assumes any global symbol in a shared library can
-# be replaced via LD_PRELOAD, which forces every intra-library call through
-# the GOT/PLT and disables a wide range of inlining + IPO. Disabling it
-# lets clang resolve calls and constants directly inside the same DSO.
-# Combined with -fno-plt below, the call-site overhead approaches a static
-# build's. Linux/ELF only — Mach-O has different visibility semantics and
-# clang ignores this flag there.
--fno-semantic-interposition
-
-# Skip the PLT for external calls and route them through GOT loads instead.
-# Pairs with -Wl,-z,now (full RELRO): the GOT is resolved at load time and
-# made read-only, so removing the lazy-binding PLT shrinks code size,
-# eliminates a layer of indirection on hot calls, and removes the writable
-# PLT-stub gadget surface from the binary. Linux/ELF only.
--fno-plt
+# NOTE: -fno-semantic-interposition and -fno-plt are parked in
+# labs.disabled.txt — both are incompatible with default-visibility
+# `Java_*` aliases that JNI exports require. The compiler treats own-DSO
+# default-visibility symbols as PC-rel-addressable under
+# -fno-semantic-interposition, and the aarch64 linker (ld.lld) then
+# rejects the resulting `R_AARCH64_ADR_PREL_PG_HI21` relocation against
+# the alias with "cannot be used against symbol 'Java_…'; recompile with
+# -fPIC". Re-enable only if we move JNI exports to STV_PROTECTED (which
+# would need a coordinated change to NETTY_JNI_ALIAS) or stop emitting
+# default-visibility aliases altogether.
 
 # NOTE: -U_FORTIFY_SOURCE, -D_FORTIFY_SOURCE=2, and
 # -D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_FAST are parked in