fix(coregrind): arm64 FP-chain unwind fallback when CFI is missing

VG_(get_StackTrace) on arm64 was CFI-only, so Callgrind's OFF->ON
shadow-stack seeding stopped at the first frame without unwind info --
notably CPython's -X perf JIT trampolines, which have no FDEs but keep
the AAPCS64 frame chain alive (that is their design: perf/samply walk
them by FP). The truncated seed left the seeded context stack one entry
deep after the innermost frame popped; bbcc.c's underflow check then
misread the fn-stack base sentinel as a signal marker on every return,
and handleUnderflow fabricated named nodes for obj-skipped interpreter
functions with inverted, full-cost edges (_ctypes_callproc ->
PyCFuncPtr_call -> _TAIL_CALL_* -> ... as the graph root). x86_64 never
hit this because its unwinder already has the %rbp fallback.

Follow the frame records {saved X29, saved X30} when CFI fails, with
guards: record in-stack and 8-aligned, SP must progress, next record
strictly higher (saved X29 == 0 accepted as chain terminator), pc 0/1
stops the walk. Caller IPs keep the CFI path's -1 bias.

Callgrind's seeder correspondingly records ret_addr = ips[frame+1] + 1,
undoing that bias so the arm64 return matcher (exact-X30 matching, no
SP movement on bl/ret) can pop seeded frames.

An A/B run confirmed raising CLG_RECON_MAX_FRAMES alone does not help:
the seed was CFI-truncated at ~8 frames, nowhere near the 256 cap.

Regression coverage: callgrind-utils/tests/objskip_seed_underflow.rs, a
minimal fixture whose asm trampoline maintains FP but has no CFI and
which starts instrumentation two obj-skipped frames deep; it asserts no
skipped frame leaks into the folded graph and that the workload parents
under the trampoline.

Author: not-matthias

callgrind/callstack.c

@@ -568,7 +568,15 @@ void CLG_(reconstruct_call_stack_from_native)(ThreadId tid)
          * SP, sps[frame+1]; the outermost frame keeps its own SP as nothing
          * returns past it during measurement. */
         ce->sp       = (frame + 1 < (Int)n) ? sps[frame + 1] : sps[frame];
-        ce->ret_addr = (frame + 1 < (Int)n) ? ips[frame + 1] : 0;
+        /* ret_addr must be the exact architectural return target: the arm64
+         * return detector (setup_bbcc) matches it against bb_addr() of the
+         * returned-into block, and push_call_stack records the exact X30 there.
+         * But VG_(get_StackTrace) reports each caller IP as return_addr - 1 (so
+         * symbolization lands in the calling instruction, not the one after);
+         * undo that bias here, else every seeded frame's return is off by one,
+         * is misread as a jump, and the seeded skipped interpreter/ctypes frames
+         * never pop -- leaking them as the graph root. */
+        ce->ret_addr = (frame + 1 < (Int)n) ? ips[frame + 1] + 1 : 0;
         cs->sp++;
         ensure_stack_size(cs->sp + 1);
         cs->entry[cs->sp].cxt = 0;

coregrind/m_stacktrace.c

@@ -1249,8 +1249,11 @@ UInt VG_(get_StackTrace_wrk) ( ThreadId tid_if_known,
    ips[0] = uregs.pc;
    i = 1;
 
-   /* Loop unwinding the stack, using CFI. */
+   /* Loop unwinding the stack: CFI first, AAPCS64 frame-pointer chain as
+      the fallback. */
    while (True) {
+      Addr old_sp;
+
       if (debug) {
          VG_(printf)("i: %d, pc: 0x%lx, sp: 0x%lx\n",
                      i, uregs.pc, uregs.sp);
@@ -1259,6 +1262,8 @@ UInt VG_(get_StackTrace_wrk) ( ThreadId tid_if_known,
       if (i >= max_n_ips)
          break;
 
+      old_sp = uregs.sp;
+
       if (VG_(use_CF_info)( &uregs, fp_min, fp_max )) {
          if (sps) sps[i] = uregs.sp;
          if (fps) fps[i] = uregs.x29;
@@ -1271,6 +1276,50 @@ UInt VG_(get_StackTrace_wrk) ( ThreadId tid_if_known,
          continue;
       }
 
+      /* If VG_(use_CF_info) fails, the location has no unwind info: JIT
+         pages (e.g. CPython's -X perf trampolines) or hand-written
+         assembly.  Fall back to following the AAPCS64 frame-pointer chain:
+         X29 points at a frame record { saved X29, saved X30 }.  Code built
+         for fp-based profilers (perf, samply) maintains this chain exactly
+         where CFI is missing.  Mirrors the amd64 %rbp fallback, with the
+         same guards: the record must lie inside the stack, the recovered
+         SP must make progress towards the stack base, and the next record
+         must be strictly further up (a saved X29 of 0 is the conventional
+         chain terminator: emit this frame, the bounds check ends the walk
+         on the next iteration).  Stop rather than emit a bogus trail. */
+      if (VG_IS_8_ALIGNED(uregs.x29)
+          && fp_min <= uregs.x29
+          && uregs.x29 <= fp_max - 2 * sizeof(Addr)) {
+         Addr next_x29 = ((Addr*)uregs.x29)[0];
+         Addr next_pc  = ((Addr*)uregs.x29)[1];
+         /* End-of-chain sentinel, same test the other unwinders in this
+            file use.  Recorded pcs are decremented by 1 (see below) so the
+            symbol lookup lands on the call insn rather than the return
+            address; both 0 and 1 collapse to the null address 0 after that
+            -1, so treat either as "no real caller" and stop. */
+         if (0 == next_pc || 1 == next_pc) break;
+         uregs.sp = uregs.x29 + 2 * sizeof(Addr);
+         if (old_sp >= uregs.sp
+             || (next_x29 != 0 && next_x29 <= uregs.x29)) {
+            if (debug)
+               VG_(printf)("     FF end of stack sp %#lx next x29 %#lx\n",
+                           uregs.sp, next_x29);
+            break;
+         }
+         uregs.x29 = next_x29;
+         uregs.x30 = next_pc;
+         uregs.pc  = next_pc;
+         if (sps) sps[i] = uregs.sp;
+         if (fps) fps[i] = uregs.x29;
+         ips[i++] = uregs.pc - 1; /* -1: refer to calling insn, not the RA */
+         if (debug)
+            VG_(printf)("USING FP: pc: 0x%lx, sp: 0x%lx\n",
+                        uregs.pc, uregs.sp);
+         uregs.pc = uregs.pc - 1;
+         RECURSIVE_MERGE(cmrf,ips,i);
+         continue;
+      }
+
       /* No luck.  We have to give up. */
       break;
    }