Enable Control Flow Integrity for the official Linux Chrome.

Enable Control Flow Integrity for the official Linux Chrome.

This CL turns on CFI, a security check:
https://sites.google.com/a/chromium.org/dev/developers/testing/control-flow-integrity
http://clang.llvm.org/docs/ControlFlowIntegrity.html

This feature enables LTO (Link-Time Optimization) builds, which slow down the linker by 3x-4x.
CFI also comes with a code size overhead of about 7%-9%. The runtime CPU cost is less than 1%,
and should not be an issue.

BUG=chromium:464797
Intent to Implement thread:
https://groups.google.com/a/chromium.org/d/msg/chromium-dev/pbJqt6ccMII/7iJC2oklCAAJ

This is a second attempt to land the CL. The first one:
https://codereview.chromium.org/1393283005/

Committed: https://crrev.com/abbfcc7930834381e05c31068ac2256cb9ea4f49
Cr-Commit-Position: refs/heads/master@{#363267}

[krasin, 2015-12-04 06:30:43]

krasin@google.com changed reviewers:
+ thakis@chromium.org

[krasin, 2015-12-04 06:32:06]

Hi Nico,

please, approve this CL. I will submit it once master.chromium.perf is restarted
(https://crbug.com/565486).
If the restart does not happen before Friday, 2PM, I will submit on Monday.

[krasin, 2015-12-04 17:08:47]

The restart happened. We don't have any blockers anymore and it should be ok to
submit this CL.

[Nico, 2015-12-04 17:23:18]

lgtm, good luck on this try :-)

[krasin, 2015-12-04 17:25:36]

The CQ bit was checked by krasin@google.com

[commit-bot: I haz the power, 2015-12-04 17:27:06]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1501593003/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1501593003/1

[krasin, 2015-12-04 17:27:20]

On 2015/12/04 17:23:18, Nico wrote:
> lgtm, good luck on this try :-)

Thank you!
I like that the timeout issue was solved in a generic way
(https://codereview.chromium.org/1492843006/), which means I don't have to hunt
for every single buildbot to adjust the timeout. Theoretically, there still
could be some GYP buildbots which build the official build, but I have not found
any yet.

[krasin, 2015-12-04 17:28:20]

Err. Not the timeout issue (that is still not solved generically), but the link
concurrency limit issue.
Not sure why my brain has glitched like that.

[krasin, 2015-12-04 17:28:41]

Description was changed from

==========
Enable Control Flow Integrity for the official Linux Chrome.

This CL turns on CFI, a security check:
https://sites.google.com/a/chromium.org/dev/developers/testing/control-flow-i...
http://clang.llvm.org/docs/ControlFlowIntegrity.html

This feature enables LTO (Link-Time Optimization) builds, which slow down the
linker by 3x-4x.
CFI also comes with a code size overhead of about 7%-9%. The runtime CPU cost is
less than 1%,
and should not be an issue.

BUG=chromium:464797
Intent to Implement thread:
https://groups.google.com/a/chromium.org/d/msg/chromium-dev/pbJqt6ccMII/7iJC2...

This is a second attempt to land the CL. The first one:
https://codereview.chromium.org/1393283005/
==========

to

==========
Enable Control Flow Integrity for the official Linux Chrome.

This CL turns on CFI, a security check:
https://sites.google.com/a/chromium.org/dev/developers/testing/control-flow-i...
http://clang.llvm.org/docs/ControlFlowIntegrity.html

This feature enables LTO (Link-Time Optimization) builds, which slow down the
linker by 3x-4x.
CFI also comes with a code size overhead of about 7%-9%. The runtime CPU cost is
less than 1%,
and should not be an issue.

BUG=chromium:464797
Intent to Implement thread:
https://groups.google.com/a/chromium.org/d/msg/chromium-dev/pbJqt6ccMII/7iJC2...

This is a second attempt to land the CL. The first one:
https://codereview.chromium.org/1393283005/
==========

[commit-bot: I haz the power, 2015-12-04 18:16:07]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-12-04 18:16:08]

Try jobs failed on following builders:
  linux_chromium_asan_rel_ng on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[krasin, 2015-12-04 18:18:09]

The CQ bit was checked by krasin@google.com

[commit-bot: I haz the power, 2015-12-04 18:18:31]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1501593003/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1501593003/1

[commit-bot: I haz the power, 2015-12-04 19:28:28]

Description was changed from

==========
Enable Control Flow Integrity for the official Linux Chrome.

This CL turns on CFI, a security check:
https://sites.google.com/a/chromium.org/dev/developers/testing/control-flow-i...
http://clang.llvm.org/docs/ControlFlowIntegrity.html

This feature enables LTO (Link-Time Optimization) builds, which slow down the
linker by 3x-4x.
CFI also comes with a code size overhead of about 7%-9%. The runtime CPU cost is
less than 1%,
and should not be an issue.

BUG=chromium:464797
Intent to Implement thread:
https://groups.google.com/a/chromium.org/d/msg/chromium-dev/pbJqt6ccMII/7iJC2...

This is a second attempt to land the CL. The first one:
https://codereview.chromium.org/1393283005/
==========

to

==========
Enable Control Flow Integrity for the official Linux Chrome.

This CL turns on CFI, a security check:
https://sites.google.com/a/chromium.org/dev/developers/testing/control-flow-i...
http://clang.llvm.org/docs/ControlFlowIntegrity.html

This feature enables LTO (Link-Time Optimization) builds, which slow down the
linker by 3x-4x.
CFI also comes with a code size overhead of about 7%-9%. The runtime CPU cost is
less than 1%,
and should not be an issue.

BUG=chromium:464797
Intent to Implement thread:
https://groups.google.com/a/chromium.org/d/msg/chromium-dev/pbJqt6ccMII/7iJC2...

This is a second attempt to land the CL. The first one:
https://codereview.chromium.org/1393283005/
==========

[commit-bot: I haz the power, 2015-12-04 19:28:29]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2015-12-04 19:29:31]

Description was changed from

==========
Enable Control Flow Integrity for the official Linux Chrome.

This CL turns on CFI, a security check:
https://sites.google.com/a/chromium.org/dev/developers/testing/control-flow-i...
http://clang.llvm.org/docs/ControlFlowIntegrity.html

This feature enables LTO (Link-Time Optimization) builds, which slow down the
linker by 3x-4x.
CFI also comes with a code size overhead of about 7%-9%. The runtime CPU cost is
less than 1%,
and should not be an issue.

BUG=chromium:464797
Intent to Implement thread:
https://groups.google.com/a/chromium.org/d/msg/chromium-dev/pbJqt6ccMII/7iJC2...

This is a second attempt to land the CL. The first one:
https://codereview.chromium.org/1393283005/
==========

to

==========
Enable Control Flow Integrity for the official Linux Chrome.

This CL turns on CFI, a security check:
https://sites.google.com/a/chromium.org/dev/developers/testing/control-flow-i...
http://clang.llvm.org/docs/ControlFlowIntegrity.html

This feature enables LTO (Link-Time Optimization) builds, which slow down the
linker by 3x-4x.
CFI also comes with a code size overhead of about 7%-9%. The runtime CPU cost is
less than 1%,
and should not be an issue.

BUG=chromium:464797
Intent to Implement thread:
https://groups.google.com/a/chromium.org/d/msg/chromium-dev/pbJqt6ccMII/7iJC2...

This is a second attempt to land the CL. The first one:
https://codereview.chromium.org/1393283005/

Committed: https://crrev.com/abbfcc7930834381e05c31068ac2256cb9ea4f49
Cr-Commit-Position: refs/heads/master@{#363267}
==========

[commit-bot: I haz the power, 2015-12-04 19:29:32]

Patchset 1 (id:??) landed as
https://crrev.com/abbfcc7930834381e05c31068ac2256cb9ea4f49
Cr-Commit-Position: refs/heads/master@{#363267}

[krasin, 2015-12-05 00:01:20]

A revert of this CL (patchset #1 id:1) has been created in
https://codereview.chromium.org/1501873002/ by krasin@google.com.

The reason for reverting is: Buildbot timed out:
https://build.chromium.org/p/chromium.chrome/builders/Google%20Chrome%20Linux...

"command timed out: 3600 seconds without output, attempting to kill"

It's hard to say why does the buildbot so much slower than a local build.
Possibly, not enough RAM..