port cfi to gn

build/config/compiler/BUILD.gn

 # Copyright (c) 2013 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//build/config/android/config.gni")
 import("//build/config/chrome_build.gni")
 if (current_cpu == "arm") {
   import("//build/config/arm.gni")
 }
 if (current_cpu == "mipsel" || current_cpu == "mips64el") {
@@ skipping 79 matching lines @@
 }
 
 # compiler ---------------------------------------------------------------------
 #
 # Base compiler configuration.
 #
 # See also "runtime_library" below for related stuff and a discussion about
 # where stuff should go. Put warning related stuff in the "warnings" config.
 
 config("compiler") {
+  arflags = []
   cflags = []
   cflags_c = []
   cflags_cc = []
   cflags_objc = []
   cflags_objcc = []
   ldflags = []
   defines = []
 
   # In general, Windows is totally different, but all the other builds share
   # some common GCC configuration. This section sets up Windows and the common
@@ skipping 82 matching lines @@
         cflags += [ "-fstack-protector" ]
       }
     }
 
     # Linker warnings.
     if (!(is_chromeos && current_cpu == "arm") && !is_mac && !is_ios) {
       # TODO(jochen): Enable this on chromeos on arm. http://crbug.com/356580
       ldflags += [ "-Wl,--fatal-warnings" ]
     }
 
-    # Common options for AddressSanitizer, LeakSanitizer, ThreadSanitizer and
-    # MemorySanitizer
-    if (using_sanitizer) {
+    # Common options for AddressSanitizer, LeakSanitizer, ThreadSanitizer,
+    # MemorySanitizer and non-official CFI builds.
+    if (using_sanitizer || (is_cfi && !is_official_build)) {
       cflags += [
         "-fno-omit-frame-pointer",
         "-gline-tables-only",
       ]
     }
     if (is_asan) {
       asan_blacklist_path =
           rebase_path("//tools/memory/asan/blacklist.txt", root_build_dir)
       cflags += [
         "-fsanitize=address",
@@ skipping 17 matching lines @@
     }
     if (is_msan) {
       msan_blacklist_path =
           rebase_path("//tools/msan/blacklist.txt", root_build_dir)
       cflags += [
         "-fsanitize=memory",
         "-fsanitize-memory-track-origins=$msan_track_origins",
         "-fsanitize-blacklist=$msan_blacklist_path",
       ]
     }
+    if (is_cfi && !is_nacl) {
+      cfi_blacklist_path =
+          rebase_path("//tools/cfi/blacklist.txt", root_build_dir)
+      cflags += [
+        "-flto",
+        "-fsanitize=cfi-vcall",
+        "-fsanitize=cfi-derived-cast",
+        "-fsanitize=cfi-unrelated-cast",
+        "-fsanitize-blacklist=$cfi_blacklist_path",
+      ]
+      ldflags += [ "-flto" ]
+
+      gold_plugin_path = rebase_path(
+              "//third_party/llvm-build/Release+Asserts/lib/LLVMgold.so",
+              root_build_dir)
+      arflags += [

[brettw, 2015/09/03 04:41:20]

My initial reaction is "I don't want this" but if we need it, I guess adding
something like this is fine.

Can you give me some background about why this is needed? I though "ar"
basically cat-s the files together, so I'm not sure why plugin would be
necessary or what it could even do.

A second question would be whether we would definitely want this applied to all
"ar" commands regardless of target. If that's the case, we can more simply make
this change by just adding these flags to the command that's executed when we do
an "alink".

To try this, look in build/toolchain/gcc_toolchain.gni in the "alink" step and
just append the flags to the ar command for the toolchain definitions in
build/toolchain/linux/BUILD.gn

If we do need to add arflags to gn, we'll have to do it in three phases, the GN
changes, push the binary, then check in the build changes.

[pcc1, 2015/09/04 21:56:59]

Archive files contain a symbol table for each object in the archive. If the
inputs are LTO objects, the plugin is needed to build the symbol table.
There's the complication that we don't want these flags to appear in NaCl
targets at least for now (mainly because the NaCl threat model is different, but
also for the more practical reason that the NaCl toolchain was built without LTO
plugin support, so passing the --plugin flag fails for NaCl archives). I
couldn't get the flags to be different for NaCl targets by adding if statements
within the alink block. Specifically, this didn't help (I also tried is_nacl):

diff --git a/build/toolchain/gcc_toolchain.gni
b/build/toolchain/gcc_toolchain.gni
index 924bf1b..79d171b 100644
--- a/build/toolchain/gcc_toolchain.gni
+++ b/build/toolchain/gcc_toolchain.gni
@@ -3,6 +3,7 @@
 # found in the LICENSE file.
 
 import("//build/toolchain/toolchain.gni")
+import("//build/config/sanitizers/sanitizers.gni")
 
 # This value will be inherited in the toolchain below.
 concurrent_links = exec_script("get_concurrent_links.py", [], "value")
@@ -173,7 +174,14 @@ template("gcc_toolchain") {
 
     tool("alink") {
       rspfile = "{{output}}.rsp"
-      command = "rm -f {{output}} && $ar rcs {{arflags}} {{output}} @$rspfile"
+      arflags = ""
+      if (is_cfi && current_os != "nacl") {
+        gold_plugin_path = rebase_path(
+                 "//third_party/llvm-build/Release+Asserts/lib/LLVMgold.so",
+                 root_build_dir)
+        arflags = "--plugin $gold_plugin_path"
+      }
+      command = "rm -f {{output}} && $ar rcs $arflags {{output}} @$rspfile"
       description = "AR {{output}}"
       rspfile_content = "{{inputs}}"
       outputs = [
I suppose this is how we'll have to proceed, correct?

+        "--plugin",
+        gold_plugin_path,
+      ]
+
+      # Apply a lower LTO optimization level in non-official builds.
+      if (!is_official_build) {
+        if (is_linux) {
+          ldflags += [ "-Wl,-plugin-opt,O1" ]
+        } else if (is_mac) {
+          ldflags += [ "-Wl,-mllvm,-O1" ]
+        }
+      }
+
+      # Work-around for http://openradar.appspot.com/20356002
+      if (is_mac) {
+        ldflags += [ "-Wl,-all_load" ]
+      }
+
+      # Without this flag, LTO produces a .text section that is larger
+      # than the maximum call displacement, preventing the linker from
+      # relocating calls (http://llvm.org/PR22999).
+      if (current_cpu == "arm") {
+        ldflags += [ "-Wl,-plugin-opt,-function-sections" ]
+      }
+
+      if (use_cfi_diag) {
+        cflags += [
+          "-fno-sanitize-trap=cfi",
+          "-fsanitize-recover=cfi",
+        ]
+      } else {
+        defines += [ "CFI_ENFORCEMENT" ]
+      }
+    }
 
     if (use_custom_libcxx) {
       cflags_cc += [ "-nostdinc++" ]
       include_dirs = [
         "//buildtools/third_party/libc++/trunk/include",
         "//buildtools/third_party/libc++abi/trunk/include",
       ]
     }
   }
 
@@ skipping 207 matching lines @@
       "-fPIC",
       "-pipe",  # Use pipes for communicating between sub-processes. Faster.
     ]
 
     ldflags += [
       "-fPIC",
       "-Wl,-z,noexecstack",
       "-Wl,-z,now",
       "-Wl,-z,relro",
     ]
-    if (!using_sanitizer) {
+    if (!using_sanitizer && !use_cfi_diag) {
       ldflags += [ "-Wl,-z,defs" ]
     }
   }
 
   # Linux-specific compiler flags setup.
   # ------------------------------------
   if (is_linux) {
     cflags += [ "-pthread" ]
     ldflags += [ "-pthread" ]
   }
@@ skipping 612 matching lines @@
 # rtti ------------------------------------------------------------------------
 #
 # Allows turning Run-Time Type Identification on or off.
 
 config("rtti") {
   if (is_win) {
     cflags_cc = [ "/GR" ]
   }
 }
 config("no_rtti") {
-  if (is_win) {
-    cflags_cc = [ "/GR-" ]
-  } else {
-    cflags_cc = [ "-fno-rtti" ]
-    cflags_objcc = cflags_cc
+  # CFI diagnostics require RTTI.
+  if (!use_cfi_diag) {
+    if (is_win) {
+      cflags_cc = [ "/GR-" ]
+    } else {
+      cflags_cc = [ "-fno-rtti" ]
+      cflags_objcc = cflags_cc
+    }
   }
 }
 
 # Warnings ---------------------------------------------------------------------
 
 # This will generate warnings when using Clang if code generates exit-time
 # destructors, which will slow down closing the program.
 # TODO(thakis): Make this a blacklist instead, http://crbug.com/101600
 config("wexit_time_destructors") {
   # TODO: Enable on Windows too, http://crbug.com/404525
@@ skipping 225 matching lines @@
       cflags += [ "-gsplit-dwarf" ]
     }
   }
 }
 
 config("no_symbols") {
   if (!is_win) {
     cflags = [ "-g0" ]
   }
 }