port cfi to gn

build/config/sanitizers/sanitizers.gni

 # Copyright 2015 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 declare_args() {
   # Use libc++ (buildtools/third_party/libc++ and
   # buildtools/third_party/libc++abi) instead of stdlibc++ as standard library.
   # This is intended to be used for instrumented builds.
   use_custom_libcxx = (is_asan && is_linux) || is_tsan || is_msan
 
   # Track where uninitialized memory originates from. From fastest to slowest:
   # 0 - no tracking, 1 - track only the initial allocation site, 2 - track the
   # chain of stores leading from allocation site to use site.
   msan_track_origins = 2
 
   # Use dynamic libraries instrumented by one of the sanitizers instead of the
   # standard system libraries. Set this flag to download prebuilt binaries from
   # GCS.
   use_prebuilt_instrumented_libraries = false
 
   # Enable building with SyzyAsan which can find certain types of memory
   # errors. Only works on Windows. See
   # https://code.google.com/p/sawbuck/wiki/SyzyASanHowTo
   is_syzyasan = false
+
+  # Compile with Control Flow Integrity to protect virtual calls and casts.
+  # See http://clang.llvm.org/docs/ControlFlowIntegrity.html
+  is_cfi = false
+
+  # Whether Control Flow Integrity prints diagnostics instead of crashing.

[brettw, 2015/09/10 23:16:34]

Can you rephrase this comment to make more clear what happens in the true vs.
false case?

[pcc, 2015/09/11 02:38:56]

Done.

+  use_cfi_diag = false
 }
 
 # MSan only links Chrome properly in release builds (brettw -- 9/1/2015). The
 # same is possibly true for the other non-ASan sanitizers. But regardless of
 # whether it links, one would normally never run a sanitizer in debug mode.
 # Running in debug mode probably indicates you forgot to set the "is_debug =
 # false" flag in the build args. ASan seems to run fine in debug mode.
 #
 # If you find a use-case where you want to compile a sanitizer in debug mode
 # and have verified it works, ask brettw and we can consider removing it from
 # this condition. We may also be able to find another way to enable your case
 # without having people accidentally get broken builds by compiling an
 # unsupported or unadvisable configurations.
 #
 # For one-off testing, just comment this assertion out.
 assert(!is_debug || !(is_msan || is_lsan || is_tsan),
        "Sanitizers should generally be used in release (set is_debug=false).")