Unlimited Lives: Secure In-Process Rollback with Isolated Domains