Enable Control Flow Integrity for the official Linux Chrome.

build/config/sanitizers/sanitizers.gni

 # Copyright 2015 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+import("//build/config/chrome_build.gni")
+
 declare_args() {
   # Compile for Address Sanitizer to find memory bugs.
   is_asan = false
 
   # Compile for Leak Sanitizer to find leaks.
   is_lsan = false
 
   # Compile for Memory Sanitizer to find uninitialized reads.
   is_msan = false
 
@@ skipping 15 matching lines @@
   # Use dynamic libraries instrumented by one of the sanitizers instead of the
   # standard system libraries. Set this flag to download prebuilt binaries from
   # GCS.
   use_prebuilt_instrumented_libraries = false
 
   # Enable building with SyzyAsan which can find certain types of memory
   # errors. Only works on Windows. See
   # https://code.google.com/p/sawbuck/wiki/SyzyASanHowTo
   is_syzyasan = false
 
-  # Compile with Control Flow Integrity to protect virtual calls and casts.
-  # See http://clang.llvm.org/docs/ControlFlowIntegrity.html
-  is_cfi = false
-
   # By default, Control Flow Integrity will crash the program if it detects a
   # violation. Set this to true to print detailed diagnostics instead.
   use_cfi_diag = false
 
   # Compile for fuzzing with LLVM LibFuzzer.
   # See http://www.chromium.org/developers/testing/libfuzzer
   use_libfuzzer = false
 }
 
 # Args that are in turn dependent on other args must be in a separate
 # declare_args block. User overrides are only applied at the end of a
 # declare_args block.
 declare_args() {
+  # Compile with Control Flow Integrity to protect virtual calls and casts.
+  # See http://clang.llvm.org/docs/ControlFlowIntegrity.html
+  is_cfi = is_linux && !is_chromeos && target_cpu == "x64" &&
+           is_chrome_branded && is_official_build
+
   # Use libc++ (buildtools/third_party/libc++ and
   # buildtools/third_party/libc++abi) instead of stdlibc++ as standard library.
   # This is intended to be used for instrumented builds.
   use_custom_libcxx =
       (is_asan && is_linux) || is_tsan || is_msan || is_ubsan || use_libfuzzer
 
   use_sanitizer_coverage = use_libfuzzer
 }
 
 using_sanitizer =
@@ skipping 14 matching lines @@
 # without having people accidentally get broken builds by compiling an
 # unsupported or unadvisable configurations.
 #
 # For one-off testing, just comment this assertion out.
 assert(
     !is_debug || !(is_msan || is_lsan || is_tsan || is_ubsan || is_ubsan_vptr),
     "Sanitizers should generally be used in release (set is_debug=false).")
 
 assert(!(is_android && is_asan && !is_component_build),
        "is_asan on Android requires is_component_build to be set")