Fix mprotect failures by enabling cranelift-jit selinux-fix

The sample program in cranelift/filetests/src/function_runner.rs
would abort with an mprotect failure under certain circumstances,
see #4453 (comment)

Root cause was that enabling PROT_EXEC on the main process heap
may be prohibited, depending on Linux distro and version.

This only shows up in the doc test sample program because the main
clif-util is multi-threaded and therefore allocations will happen
on glibc's per-thread heap, which is allocated via mmap, and not
the main process heap.

Work around the problem by enabling the "selinux-fix" feature of
the cranelift-jit crate dependency in the filetests.  Note that
this didn't compile out of the box, so a separate fix is also
required and provided as part of this PR.

Going forward, it would be preferable to always use mmap to allocate
the backing memory for JITted code.

cranelift/filetests/Cargo.toml

@@ -16,7 +16,7 @@ cranelift-interpreter = { workspace = true }
 cranelift-native = { workspace = true }
 cranelift-reader = { workspace = true }
 cranelift-preopt = { workspace = true }
-cranelift-jit = { workspace = true }
+cranelift-jit = { workspace = true, features = ["selinux-fix"] }
 cranelift-module = { workspace = true }
 file-per-thread-logger = "0.1.2"
 filecheck = "0.5.0"

cranelift/jit/src/memory.rs

@@ -251,7 +251,7 @@ impl Memory {
         let iter = self.allocations[self.already_protected..].iter();
 
         #[cfg(feature = "selinux-fix")]
-        return iter.filter(|&PtrLen { ref map, len, .. }| len != 0 && map.is_some());
+        return iter.filter(|&PtrLen { ref map, len, .. }| *len != 0 && map.is_some());
 
         #[cfg(not(feature = "selinux-fix"))]
         return iter.filter(|&PtrLen { len, .. }| *len != 0);