Implement use_cfi_cast to optionally enable cast checks.

base/tools_sanity_unittest.cc

Index: base/tools_sanity_unittest.cc
diff --git a/base/tools_sanity_unittest.cc b/base/tools_sanity_unittest.cc
index 8d13837887b854a2dfad5178e1c74ed59687bda3..bb7e6f34032d2872d3a80642c64ba7d37dfa8af3 100644
--- a/base/tools_sanity_unittest.cc
+++ b/base/tools_sanity_unittest.cc
@@ -343,6 +343,8 @@ TEST(ToolsSanityTest, AtomicsAreIgnored) {
 }
 
 #if defined(CFI_ENFORCEMENT)
+// TODO(krasin): remove CFI_CAST_CHECK, see https://crbug.com/626794.
+#if defined(CFI_CAST_CHECK)
 TEST(ToolsSanityTest, BadCast) {
   class A {
     virtual void f() {}
@@ -355,6 +357,27 @@ TEST(ToolsSanityTest, BadCast) {
   A a;
   EXPECT_DEATH((void)(B*)&a, "ILL_ILLOPN");
 }
-#endif
+#endif // CFI_CAST_CHECK
+
+TEST(ToolsSanityTest, BadVirtualCall) {
+  class A {
+   public:
+    virtual void f() {}
+  };
+
+  class B {
+   public:
+    virtual void f() {}
+  };
+
+  A a;
+  B b;
+  A *a_ptr = &a;
+  // Make a_ptr to point to b instead.
+  *reinterpret_cast<void**>(a_ptr) = *reinterpret_cast<void**>(&b);
+  EXPECT_DEATH(a_ptr->f(), "ILL_ILLOPN");

[pcc1, 2016/07/11 21:56:47]

I'm not sure if this is quite the test we need here, because I would have
expected whole-program vtable optimization to devirtualize this call (and remove
the check here). If this test is passing locally for you, we should figure out
why.

[krasin1, 2016/07/12 03:33:55]

I've played a bit with the code, and the compiler gets confused with 

*reinterpret_cast<void**>(a_ptr) = *reinterpret_cast<void**>(&b);

all the time (with any possible outcome: not devirtualized, devirtualized,
incorrectly devirtualized). I have modified the code to make sure it could not
be devirtualized. Please, take a look.

+}
+
+#endif // CFI_ENFORCEMENT
 
 }  // namespace base