Implement use_cfi_cast to optionally enable cast checks.

base/tools_sanity_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // This file contains intentional memory errors, some of which may lead to
 // crashes if the test is ran without special memory testing tools. We use these
 // errors to verify the sanity of the tools.
 
 #include <stddef.h>
 
@@ skipping 325 matching lines @@
 
 TEST(ToolsSanityTest, AtomicsAreIgnored) {
   base::subtle::Atomic32 shared = 0;
   ReleaseStoreThread thread1(&shared);
   AcquireLoadThread thread2(&shared);
   RunInParallel(&thread1, &thread2);
   EXPECT_EQ(kMagicValue, shared);
 }
 
 #if defined(CFI_ENFORCEMENT)
+// TODO(krasin): remove CFI_CAST_CHECK, see https://crbug.com/626794.
+#if defined(CFI_CAST_CHECK)
 TEST(ToolsSanityTest, BadCast) {
   class A {
     virtual void f() {}
   };
 
   class B {
     virtual void f() {}
   };
 
   A a;
   EXPECT_DEATH((void)(B*)&a, "ILL_ILLOPN");
 }
-#endif
+#endif // CFI_CAST_CHECK
+
+TEST(ToolsSanityTest, BadVirtualCall) {
+  class A {
+   public:
+    virtual void f() {}
+  };
+
+  class B {
+   public:
+    virtual void f() {}
+  };
+
+  A a;
+  B b;
+  A *a_ptr = &a;
+  // Make a_ptr to point to b instead.
+  *reinterpret_cast<void**>(a_ptr) = *reinterpret_cast<void**>(&b);
+  EXPECT_DEATH(a_ptr->f(), "ILL_ILLOPN");

[pcc1, 2016/07/11 21:56:47]

I'm not sure if this is quite the test we need here, because I would have
expected whole-program vtable optimization to devirtualize this call (and remove
the check here). If this test is passing locally for you, we should figure out
why.

[krasin1, 2016/07/12 03:33:55]

I've played a bit with the code, and the compiler gets confused with 

*reinterpret_cast<void**>(a_ptr) = *reinterpret_cast<void**>(&b);

all the time (with any possible outcome: not devirtualized, devirtualized,
incorrectly devirtualized). I have modified the code to make sure it could not
be devirtualized. Please, take a look.

+}
+
+#endif // CFI_ENFORCEMENT
 
 }  // namespace base