Implement use_cfi_cast to optionally enable cast checks.

build/config/sanitizers/BUILD.gn

Index: build/config/sanitizers/BUILD.gn
diff --git a/build/config/sanitizers/BUILD.gn b/build/config/sanitizers/BUILD.gn
index 0b099f41003757215e0a26feb6264833c449c49f..4a7de41ca63af98bbf6668103916af1d27d17d50 100644
--- a/build/config/sanitizers/BUILD.gn
+++ b/build/config/sanitizers/BUILD.gn
@@ -155,11 +155,13 @@ config("default_sanitizer_ldflags") {
     }
 
     if (is_cfi && !is_nacl) {
-      ldflags += [
-        "-fsanitize=cfi-vcall",
-        "-fsanitize=cfi-derived-cast",
-        "-fsanitize=cfi-unrelated-cast",
-      ]
+      ldflags += [ "-fsanitize=cfi-vcall" ]
+      if (use_cfi_cast) {
+        ldflags += [
+          "-fsanitize=cfi-derived-cast",
+          "-fsanitize=cfi-unrelated-cast",
+        ]
+      }
       if (use_cfi_diag) {
         ldflags += [
           "-fno-sanitize-trap=cfi",
@@ -249,17 +251,26 @@ config("asan_flags") {
 }
 
 config("cfi_flags") {
+  defines = []
   cflags = []
   if (is_cfi && !is_nacl) {
     cfi_blacklist_path =
         rebase_path("//tools/cfi/blacklist.txt", root_build_dir)
     cflags += [
       "-fsanitize=cfi-vcall",
-      "-fsanitize=cfi-derived-cast",
-      "-fsanitize=cfi-unrelated-cast",
       "-fsanitize-blacklist=$cfi_blacklist_path",
     ]
 
+    if (use_cfi_cast) {
+      cflags += [
+        "-fsanitize=cfi-derived-cast",
+        "-fsanitize=cfi-unrelated-cast",
+      ]
+
+      # TODO(krasin): remove CFI_CAST_CHECK, see https://crbug.com/626794.
+      defines += [ "CFI_CAST_CHECK" ]
+    }
+
     if (use_cfi_diag) {
       cflags += [
         "-fno-sanitize-trap=cfi",
@@ -270,7 +281,7 @@ config("cfi_flags") {
         "-O1",
       ]
     } else {
-      defines = [ "CFI_ENFORCEMENT" ]
+      defines += [ "CFI_ENFORCEMENT" ]
     }
   }
 }