Skip BOLT optimization for HACL hash compressors

[zanieb]

Optimized x86-64 GNU/Linux builds can perform invalid stack writes in the HACL SHA-2 and BLAKE2 compressors because BOLT's allocation combiner removes their required stack allocation while retaining frame-pointer-relative accesses below the red zone. Extend -skip-funcs for the affected compressor symbols so BOLT leaves these functions intact while continuing to optimize the rest of the interpreter.

See #1186

[zanieb]

Suggested change

	# https://github.com/astral-sh/uv/issues/20618
	# https://github.com/astral-sh/python-build-standalone/issues/1186

[jjhelmus]

Switching to -frame-opt=none is another option. It is safer but could have an effect on performance.

[zanieb]

I dunno why we'd turn that off broadly instead of skipping the relevant functions, I imagine it would affect performance?

[jjhelmus]

I dunno why we'd turn that off broadly instead of skipping the relevant functions, I imagine it would affect performance?

The identified functions are those in which we know that the stack redline is being violated. There could be others. Disabling frame optimization would prevent cases in other, yet unknown, functions.

[jjhelmus]

I imagine it would affect performance?

-frame-opt=none has a sizable effect on performance, from a quick fastmark benchmark, the score drops by ~1%.

[jjhelmus]

Codex did not find any other functions with unsafe stack-frame removal resulting from BOLT outside the HACL related one. These function are implemented in assembly verified C so excluding them from additional optimization is reasonable.

[jjhelmus]

FWIW this issue only occurs because frame pointer/leaf from pointer are included (-fno-omit-frame-pointer -mno-omit-leaf-frame-pointer). Prior to this change the functions use stack pointer based access which is detected by BOLT's allocation combiner.