Define _FORTIFY_SOURCE=2 under the same conditions in gn as gyp.

build/config/compiler/BUILD.gn

Index: build/config/compiler/BUILD.gn
diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
index 2ef116ce87df01b155b99fe7cb240cd45b31bcd3..256b3e3efebfbe343aeef9d0b564e0a6b9ed69b0 100644
--- a/build/config/compiler/BUILD.gn
+++ b/build/config/compiler/BUILD.gn
@@ -662,7 +662,7 @@ config("chromium_code") {
       "__STDC_FORMAT_MACROS",
     ]
 
-    if (using_sanitizer) {
+    if (!using_sanitizer && (!is_linux || !is_clang || is_official_build)) {

[Dirk Pranke, 2015/05/19 19:53:30]

I can see this matches the logic in GYP, but trying to parse this to figure out
when this actually will get applied is a little weird:

!is_linux => mac or android
!is_clang => android

so we want this on android or on official (non-win) builds; is that right? This
seems like a confusing way to write this, and it's not clear to me whether we
actually want to set this in clang builds (which most of the official builds
will be?)

[Sam McNally, 2015/05/20 01:40:29]

My understanding from the comments is that we want this always on for
non-Windows, but clang doesn't work with this on recent versions of linux. That
special case then has its own special case because the bots used for official
builds are running Ubuntu 12.04 which is old enough to avoid the clang bug.

How about !(is_linux && is_clang && !is_official_build) instead? Or one step
further: !(using_sanitizer || (is_linux && is_clang && !is_official_build)).
These make the "on by default unless..." intent a bit clearer.

[Nico, 2015/05/21 19:19:55]

Yes, this is correct.

       # _FORTIFY_SOURCE isn't really supported by Clang now, see
       # http://llvm.org/bugs/show_bug.cgi?id=16821.
       # It seems to work fine with Ubuntu 12 headers though, so use it in