Enable Control Flow Integrity for the official Linux Chrome.

Enable Control Flow Integrity for the official Linux Chrome.

This CL turns on CFI, a security check:
https://sites.google.com/a/chromium.org/dev/developers/testing/control-flow-integrity
http://clang.llvm.org/docs/ControlFlowIntegrity.html

This feature enables LTO (Link-Time Optimization) builds, which slow down the linker by 3x-4x.
CFI also comes with a code size overhead of about 7%-9%. The runtime CPU cost is less than 1%,
and should not be an issue.

BUG=chromium:464797
Intent to Implement thread:
https://groups.google.com/a/chromium.org/d/msg/chromium-dev/pbJqt6ccMII/7iJC2oklCAAJ

This is a fourth attempt to land the CL. Previous attempts:
https://codereview.chromium.org/1502373003/
https://codereview.chromium.org/1501593003/
https://codereview.chromium.org/1393283005/

The last time it failed, it was https://crbug.com/567637
(mismatched deps expectations for the installer).
Fixing the expectations.

Committed: https://crrev.com/64719eadd90a3131a744baa89a1183bdcb1e2375
Cr-Commit-Position: refs/heads/master@{#363895}

[krasin, 2015-12-08 19:30:16]

krasin@google.com changed reviewers:
+ gab@chromium.org, thakis@chromium.org

[gab, 2015-12-08 20:13:16]

gab@chromium.org changed reviewers:
- gab@chromium.org

[gab, 2015-12-08 20:13:16]

Sorry, removing self, not a chrome\installer\linux OWNER.

[Nico, 2015-12-08 20:25:33]

lgtm

[krasin, 2015-12-08 20:54:40]

The CQ bit was checked by krasin@google.com to run a CQ dry run

[krasin, 2015-12-08 20:55:41]

krasin@google.com changed reviewers:
+ thestig@chromium.org

[commit-bot: I haz the power, 2015-12-08 20:57:19]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1502233004/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1502233004/1

[pcc1, 2015-12-08 21:03:01]

pcc@chromium.org changed reviewers:
+ pcc@chromium.org

[pcc1, 2015-12-08 21:03:01]

https://codereview.chromium.org/1502233004/diff/1/build/common.gypi
File build/common.gypi (right):

https://codereview.chromium.org/1502233004/diff/1/build/common.gypi#newcode852
build/common.gypi:852: # downloaded. See src/tools/clang/scripts/update.sh
FYI, update.sh is no more. (Probably can be addressed in a follow-up or in the
next attempt if needed.)

[Lei Zhang, 2015-12-08 21:03:02]

thestig@chromium.org changed reviewers:
- pcc@chromium.org

[Lei Zhang, 2015-12-08 21:03:02]

lgtm

[krasin, 2015-12-08 21:08:16]

https://codereview.chromium.org/1502233004/diff/1/build/common.gypi
File build/common.gypi (right):

https://codereview.chromium.org/1502233004/diff/1/build/common.gypi#newcode852
build/common.gypi:852: # downloaded. See src/tools/clang/scripts/update.sh
On 2015/12/08 21:03:01, pcc1 wrote:
> FYI, update.sh is no more. (Probably can be addressed in a follow-up or in the
> next attempt if needed.)

Thanks. I agree and will address in a follow up.

[commit-bot: I haz the power, 2015-12-08 23:16:14]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-12-08 23:16:15]

Dry run: This issue passed the CQ dry run.

[krasin, 2015-12-08 23:16:50]

The CQ bit was checked by krasin@google.com

[commit-bot: I haz the power, 2015-12-08 23:18:01]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1502233004/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1502233004/1

[commit-bot: I haz the power, 2015-12-09 01:54:14]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2015-12-09 01:55:13]

Description was changed from

==========
Enable Control Flow Integrity for the official Linux Chrome.

This CL turns on CFI, a security check:
https://sites.google.com/a/chromium.org/dev/developers/testing/control-flow-i...
http://clang.llvm.org/docs/ControlFlowIntegrity.html

This feature enables LTO (Link-Time Optimization) builds, which slow down the
linker by 3x-4x.
CFI also comes with a code size overhead of about 7%-9%. The runtime CPU cost is
less than 1%,
and should not be an issue.

BUG=chromium:464797
Intent to Implement thread:
https://groups.google.com/a/chromium.org/d/msg/chromium-dev/pbJqt6ccMII/7iJC2...

This is a fourth attempt to land the CL. Previous attempts:
https://codereview.chromium.org/1502373003/
https://codereview.chromium.org/1501593003/
https://codereview.chromium.org/1393283005/

The last time it failed, it was https://crbug.com/567637
(mismatched deps expectations for the installer).
Fixing the expectations.
==========

to

==========
Enable Control Flow Integrity for the official Linux Chrome.

This CL turns on CFI, a security check:
https://sites.google.com/a/chromium.org/dev/developers/testing/control-flow-i...
http://clang.llvm.org/docs/ControlFlowIntegrity.html

This feature enables LTO (Link-Time Optimization) builds, which slow down the
linker by 3x-4x.
CFI also comes with a code size overhead of about 7%-9%. The runtime CPU cost is
less than 1%,
and should not be an issue.

BUG=chromium:464797
Intent to Implement thread:
https://groups.google.com/a/chromium.org/d/msg/chromium-dev/pbJqt6ccMII/7iJC2...

This is a fourth attempt to land the CL. Previous attempts:
https://codereview.chromium.org/1502373003/
https://codereview.chromium.org/1501593003/
https://codereview.chromium.org/1393283005/

The last time it failed, it was https://crbug.com/567637
(mismatched deps expectations for the installer).
Fixing the expectations.

Committed: https://crrev.com/64719eadd90a3131a744baa89a1183bdcb1e2375
Cr-Commit-Position: refs/heads/master@{#363895}
==========

[commit-bot: I haz the power, 2015-12-09 01:55:13]

Patchset 1 (id:??) landed as
https://crrev.com/64719eadd90a3131a744baa89a1183bdcb1e2375
Cr-Commit-Position: refs/heads/master@{#363895}

[Nico, 2015-12-09 15:25:08]

A revert of this CL (patchset #1 id:1) has been created in
https://codereview.chromium.org/1517443002/ by thakis@chromium.org.

The reason for reverting is: Broken at clang trunk (http://crbug.com/568121).