Implement use_cfi_cast to optionally enable cast checks.

base/tools_sanity_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // This file contains intentional memory errors, some of which may lead to
 // crashes if the test is ran without special memory testing tools. We use these
 // errors to verify the sanity of the tools.
 
 #include <stddef.h>
 
@@ skipping 325 matching lines @@
 
 TEST(ToolsSanityTest, AtomicsAreIgnored) {
   base::subtle::Atomic32 shared = 0;
   ReleaseStoreThread thread1(&shared);
   AcquireLoadThread thread2(&shared);
   RunInParallel(&thread1, &thread2);
   EXPECT_EQ(kMagicValue, shared);
 }
 
 #if defined(CFI_ENFORCEMENT)
+// TODO(krasin): remove CFI_CAST_CHECK, see https://crbug.com/626794.
+#if defined(CFI_CAST_CHECK)
 TEST(ToolsSanityTest, BadCast) {
   class A {
     virtual void f() {}
   };
 
   class B {
     virtual void f() {}
   };
 
   A a;
   EXPECT_DEATH((void)(B*)&a, "ILL_ILLOPN");
 }
-#endif
+#endif // CFI_CAST_CHECK
+
+class A {
+ public:
+  A(): n_(0) {}
+  virtual void f() { n_++; }
+ protected:
+  int n_;
+};
+
+class B: public A {
+ public:
+  void f() override { n_--; }
+};
+
+__attribute__((noinline)) void KillVptrAndCall(A *obj) {

[pcc1, 2016/07/12 18:54:28]

Use NOINLINE macro here.

[krasin1, 2016/07/12 20:30:05]

Done.

+  *reinterpret_cast<void **>(obj) = 0;
+  obj->f();
+}
+
+TEST(ToolsSanityTest, BadVirtualCall) {
+  A a;
+  B b;
+  EXPECT_DEATH({ KillVptrAndCall(&a); KillVptrAndCall(&b); }, "ILL_ILLOPN");
+}
+
+#endif // CFI_ENFORCEMENT
 
 }  // namespace base