Define _FORTIFY_SOURCE=2 under the same conditions in gn as gyp.

build/config/compiler/BUILD.gn

 # Copyright (c) 2013 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//build/config/android/config.gni")
 import("//build/config/chrome_build.gni")
 if (current_cpu == "arm") {
   import("//build/config/arm.gni")
 }
 if (current_cpu == "mipsel" || current_cpu == "mips64el") {
@@ skipping 644 matching lines @@
       "-Wsign-compare",
     ]
 
     # In Chromium code, we define __STDC_foo_MACROS in order to get the
     # C99 macros on Mac and Linux.
     defines = [
       "__STDC_CONSTANT_MACROS",
       "__STDC_FORMAT_MACROS",
     ]
 
-    if (using_sanitizer) {
+    if (!using_sanitizer && (!is_linux || !is_clang || is_official_build)) {

[Dirk Pranke, 2015/05/19 19:53:30]

I can see this matches the logic in GYP, but trying to parse this to figure out
when this actually will get applied is a little weird:

!is_linux => mac or android
!is_clang => android

so we want this on android or on official (non-win) builds; is that right? This
seems like a confusing way to write this, and it's not clear to me whether we
actually want to set this in clang builds (which most of the official builds
will be?)

[Sam McNally, 2015/05/20 01:40:29]

My understanding from the comments is that we want this always on for
non-Windows, but clang doesn't work with this on recent versions of linux. That
special case then has its own special case because the bots used for official
builds are running Ubuntu 12.04 which is old enough to avoid the clang bug.

How about !(is_linux && is_clang && !is_official_build) instead? Or one step
further: !(using_sanitizer || (is_linux && is_clang && !is_official_build)).
These make the "on by default unless..." intent a bit clearer.

[Nico, 2015/05/21 19:19:55]

Yes, this is correct.

       # _FORTIFY_SOURCE isn't really supported by Clang now, see
       # http://llvm.org/bugs/show_bug.cgi?id=16821.
       # It seems to work fine with Ubuntu 12 headers though, so use it in
       # official builds.
       #
       # Non-chromium code is not guaranteed to compile cleanly with
       # _FORTIFY_SOURCE. Also, fortified build may fail when optimizations are
       # disabled, so only do that for Release build.
       defines += [ "_FORTIFY_SOURCE=2" ]
     }
@@ skipping 448 matching lines @@
       cflags += [ "-gsplit-dwarf" ]
     }
   }
 }
 
 config("no_symbols") {
   if (!is_win) {
     cflags = [ "-g0" ]
   }
 }