[libfuzzer] Add 'vptr' flag to builds with UndefinedBehaviourSanitizer.

tools/ubsan/security_blacklist.txt

+# This black list is a merge of blacklist.txt and vptr_blacklist.txt.
+
+#############################################################################
+# UBSan security blacklist.
+
+#############################################################################
+# YASM does some funny things that UBsan doesn't like.
+# https://crbug.com/489901
+src:*/third_party/yasm/*
+
+#############################################################################
+# V8 gives too many false positives. Ignore them for now.
+src:*/v8/*
+
+#############################################################################
+# Ignore system libraries.
+src:*/usr/*
+
+#############################################################################
+# V8 UBsan supressions, commented out for now since we are ignorning v8
+# completely.
+# fun:*v8*internal*FastD2I*
+# fun:*v8*internal*ComputeIntegerHash*
+# fun:*v8*internal*ComputeLongHash*
+# fun:*v8*internal*ComputePointerHash*
+# src:*/v8/src/base/bits.cc
+# src:*/v8/src/base/functional.cc
+# Undefined behaviour (integer overflow) is expected but ignored in this
+# function.
+# fun:*JsonParser*ParseJsonNumber*
+
+# Runtime numeric functions.
+# src:*/v8/src/runtime/runtime-numbers.cc
+
+# Shifts of negative numbers
+# fun:*v8*internal*HPositionInfo*TagPosition*
+# fun:*v8*internal*Range*Shl*
+# fun:*v8*internal*RelocInfoWriter*WriteTaggedData*
+
+#############################################################################
+# Undefined arithmetic that can be safely ignored.
+src:*/third_party/WebKit/Source/wtf/SaturatedArithmetic.h
+src:*/ppapi/shared_impl/id_assignment.h
+
+#############################################################################
+# ICU supressions. Mostly hash functions where integer overflow is OK.
+fun:*hashEntry*
+fun:*LocaleCacheKey*hashCode*
+fun:*google*protobuf*hash*
+fun:*(hash|Hash)*
+
+#############################################################################
+# Bounds blacklist.
+# Array at the end of struct pattern:
+# Maybe UBSan itself can be improved here?
+# e.g.
+# struct blah {
+#   int a;
+#   char foo[2]; // not actually 2
+# }
+src:*/net/disk_cache/blockfile/backend_impl.cc
+src:*/net/disk_cache/blockfile/entry_impl.cc
+src:*/third_party/icu/source/common/rbbi.cpp
+src:*/third_party/icu/source/common/rbbitblb.cpp
+src:*/third_party/icu/source/common/ucmndata.c
+
+#############################################################################
+# Delete in destructor on a this where this == nullptr
+fun:*re2*RegexpD*
+
+#############################################################################
+# Harmless float division by zero.
+fun:*RendererFrameManager*CullUnlockedFrames*
+
 #############################################################################
 # UBSan vptr blacklist.
 # Function and type based blacklisting use a mangled name, and it is especially
 # tricky to represent C++ types. For now, any possible changes by name manglings
 # are simply represented as wildcard expressions of regexp, and thus it might be
 # over-blacklisted.
 
 #############################################################################
 # Identical layouts.
 # If base and derived classes have identifical memory layouts (i.e., the same
@@ skipping 93 matching lines @@
 #############################################################################
 # UBsan is unable to handle static_cast<A*>(nullptr) and crashes on SIGSEGV.
 #
 
 # static_cast<StartPageService*> in StartPageServiceFactory::GetForProfile.
 type:*StartPageService*
 
 # Remove once function attribute level blacklisting is implemented.
 # See crbug.com/476063.
 fun:*forbidGCDuringConstruction*
+
+#############################################################################
+# UBsan goes into an infinite recursion when __dynamic_cast instrumented with
+# "vptr". See crbug.com/609786.
+
+src:*/third_party/libc\+\+abi/trunk/src/private_typeinfo.cpp