oo7: Low-Overhead Defense Against Spectre Attacks via Program Analysis