port cfi to gn

build/config/compiler/BUILD.gn

Index: build/config/compiler/BUILD.gn
diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
index e7af924c4dc5703a2ea49ce18f1444b829262161..a4c6604fab6a570330bbb75863fbe4584210db58 100644
--- a/build/config/compiler/BUILD.gn
+++ b/build/config/compiler/BUILD.gn
@@ -97,6 +97,7 @@ if (!is_win) {
 # where stuff should go. Put warning related stuff in the "warnings" config.
 
 config("compiler") {
+  arflags = []
   cflags = []
   cflags_c = []
   cflags_cc = []
@@ -199,9 +200,9 @@ config("compiler") {
       ldflags += [ "-Wl,--fatal-warnings" ]
     }
 
-    # Common options for AddressSanitizer, LeakSanitizer, ThreadSanitizer and
-    # MemorySanitizer
-    if (using_sanitizer) {
+    # Common options for AddressSanitizer, LeakSanitizer, ThreadSanitizer,
+    # MemorySanitizer and non-official CFI builds.
+    if (using_sanitizer || (is_cfi && !is_official_build)) {
       cflags += [
         "-fno-omit-frame-pointer",
         "-gline-tables-only",
@@ -239,6 +240,56 @@ config("compiler") {
         "-fsanitize-blacklist=$msan_blacklist_path",
       ]
     }
+    if (is_cfi && !is_nacl) {
+      cfi_blacklist_path =
+          rebase_path("//tools/cfi/blacklist.txt", root_build_dir)
+      cflags += [
+        "-flto",
+        "-fsanitize=cfi-vcall",
+        "-fsanitize=cfi-derived-cast",
+        "-fsanitize=cfi-unrelated-cast",
+        "-fsanitize-blacklist=$cfi_blacklist_path",
+      ]
+      ldflags += [ "-flto" ]
+
+      gold_plugin_path = rebase_path(
+              "//third_party/llvm-build/Release+Asserts/lib/LLVMgold.so",
+              root_build_dir)
+      arflags += [

[brettw, 2015/09/03 04:41:20]

My initial reaction is "I don't want this" but if we need it, I guess adding
something like this is fine.

Can you give me some background about why this is needed? I though "ar"
basically cat-s the files together, so I'm not sure why plugin would be
necessary or what it could even do.

A second question would be whether we would definitely want this applied to all
"ar" commands regardless of target. If that's the case, we can more simply make
this change by just adding these flags to the command that's executed when we do
an "alink".

To try this, look in build/toolchain/gcc_toolchain.gni in the "alink" step and
just append the flags to the ar command for the toolchain definitions in
build/toolchain/linux/BUILD.gn

If we do need to add arflags to gn, we'll have to do it in three phases, the GN
changes, push the binary, then check in the build changes.

[pcc1, 2015/09/04 21:56:59]

Archive files contain a symbol table for each object in the archive. If the
inputs are LTO objects, the plugin is needed to build the symbol table.
There's the complication that we don't want these flags to appear in NaCl
targets at least for now (mainly because the NaCl threat model is different, but
also for the more practical reason that the NaCl toolchain was built without LTO
plugin support, so passing the --plugin flag fails for NaCl archives). I
couldn't get the flags to be different for NaCl targets by adding if statements
within the alink block. Specifically, this didn't help (I also tried is_nacl):

diff --git a/build/toolchain/gcc_toolchain.gni
b/build/toolchain/gcc_toolchain.gni
index 924bf1b..79d171b 100644
--- a/build/toolchain/gcc_toolchain.gni
+++ b/build/toolchain/gcc_toolchain.gni
@@ -3,6 +3,7 @@
 # found in the LICENSE file.
 
 import("//build/toolchain/toolchain.gni")
+import("//build/config/sanitizers/sanitizers.gni")
 
 # This value will be inherited in the toolchain below.
 concurrent_links = exec_script("get_concurrent_links.py", [], "value")
@@ -173,7 +174,14 @@ template("gcc_toolchain") {
 
     tool("alink") {
       rspfile = "{{output}}.rsp"
-      command = "rm -f {{output}} && $ar rcs {{arflags}} {{output}} @$rspfile"
+      arflags = ""
+      if (is_cfi && current_os != "nacl") {
+        gold_plugin_path = rebase_path(
+                 "//third_party/llvm-build/Release+Asserts/lib/LLVMgold.so",
+                 root_build_dir)
+        arflags = "--plugin $gold_plugin_path"
+      }
+      command = "rm -f {{output}} && $ar rcs $arflags {{output}} @$rspfile"
       description = "AR {{output}}"
       rspfile_content = "{{inputs}}"
       outputs = [
I suppose this is how we'll have to proceed, correct?

+        "--plugin",
+        gold_plugin_path,
+      ]
+
+      # Apply a lower LTO optimization level in non-official builds.
+      if (!is_official_build) {
+        if (is_linux) {
+          ldflags += [ "-Wl,-plugin-opt,O1" ]
+        } else if (is_mac) {
+          ldflags += [ "-Wl,-mllvm,-O1" ]
+        }
+      }
+
+      # Work-around for http://openradar.appspot.com/20356002
+      if (is_mac) {
+        ldflags += [ "-Wl,-all_load" ]
+      }
+
+      # Without this flag, LTO produces a .text section that is larger
+      # than the maximum call displacement, preventing the linker from
+      # relocating calls (http://llvm.org/PR22999).
+      if (current_cpu == "arm") {
+        ldflags += [ "-Wl,-plugin-opt,-function-sections" ]
+      }
+
+      if (use_cfi_diag) {
+        cflags += [
+          "-fno-sanitize-trap=cfi",
+          "-fsanitize-recover=cfi",
+        ]
+      } else {
+        defines += [ "CFI_ENFORCEMENT" ]
+      }
+    }
 
     if (use_custom_libcxx) {
       cflags_cc += [ "-nostdinc++" ]
@@ -466,7 +517,7 @@ config("compiler") {
       "-Wl,-z,now",
       "-Wl,-z,relro",
     ]
-    if (!using_sanitizer) {
+    if (!using_sanitizer && !use_cfi_diag) {
       ldflags += [ "-Wl,-z,defs" ]
     }
   }
@@ -1099,11 +1150,14 @@ config("rtti") {
   }
 }
 config("no_rtti") {
-  if (is_win) {
-    cflags_cc = [ "/GR-" ]
-  } else {
-    cflags_cc = [ "-fno-rtti" ]
-    cflags_objcc = cflags_cc
+  # CFI diagnostics require RTTI.
+  if (!use_cfi_diag) {
+    if (is_win) {
+      cflags_cc = [ "/GR-" ]
+    } else {
+      cflags_cc = [ "-fno-rtti" ]
+      cflags_objcc = cflags_cc
+    }
   }
 }