port cfi to gn

build/config/BUILDCONFIG.gn

Index: build/config/BUILDCONFIG.gn
diff --git a/build/config/BUILDCONFIG.gn b/build/config/BUILDCONFIG.gn
index 6bc28eccf710cf6e6b2f40609d1a79b7ef67837b..3d7d7961ee3180ce843c36fdc3364b1f6d0488a1 100644
--- a/build/config/BUILDCONFIG.gn
+++ b/build/config/BUILDCONFIG.gn
@@ -145,6 +145,13 @@ declare_args() {
   # Compile for Thread Sanitizer to find threading bugs.
   is_tsan = false
 
+  # Compile with Control Flow Integrity to protect virtual calls and casts.
+  # See http://clang.llvm.org/docs/ControlFlowIntegrity.html
+  is_cfi = false

[brettw, 2015/09/03 04:41:20]

I was thinking of removing the *san flags from here (trying to keep the global
file small). Doing this will require refactoring the symbol configuration a bit
that I was procrastinating on. But even more sanitizers makes me realize we
really need to do this.

In the mean time, can you move your flags to
build/config/sanitizers/sanitizers.gni and import that file when you need to use
the flags?

Until I clean up the symbols a CFI build will presumably need symbol_level=1 set
to work properly (assuming you really do need this level of symbols). You can
add an assert in the sanitizers.gni file that this is the case (maybe you can
also tolerate 2?) so people don't screw up.

Then you can do it with no changes to this file.

[pcc1, 2015/09/04 21:56:59]

Done.
The CFI build does not require symbols other than for better stack traces, so
the default is probably fine.

+
+  # Whether Control Flow Integrity prints diagnostics instead of crashing.
+  use_cfi_diag = false
+
   if (current_os == "chromeos") {
     # Allows the target toolchain to be injected as arguments. This is needed
     # to support the CrOS build system which supports per-build-configuration
@@ -438,7 +445,7 @@ if (symbol_level == -1) {
   # Mac and Windows have them separate, so in Release Linux, default them off.
   if (is_debug || !is_linux) {
     symbol_level = 2
-  } else if (is_asan || is_lsan || is_tsan || is_msan) {
+  } else if (is_asan || is_lsan || is_tsan || is_msan || is_cfi) {
     # Sanitizers require symbols for filename suppressions to work.
     symbol_level = 1
   } else {