Launch CFI for virtual calls on Linux x86-64.

build/config/sanitizers/sanitizers.gni

Index: build/config/sanitizers/sanitizers.gni
diff --git a/build/config/sanitizers/sanitizers.gni b/build/config/sanitizers/sanitizers.gni
index a7a9707c49e1820b10377db961721aa67d6ac876..9977ddc5b41d95a832b6fa5b1f0a202d9fceae79 100644
--- a/build/config/sanitizers/sanitizers.gni
+++ b/build/config/sanitizers/sanitizers.gni
@@ -2,6 +2,8 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+import("//build/config/chrome_build.gni")
+
 declare_args() {
   # Compile for Address Sanitizer to find memory bugs.
   is_asan = false
@@ -46,8 +48,9 @@ declare_args() {
   # Compile with Control Flow Integrity to protect virtual calls and casts.
   # See http://clang.llvm.org/docs/ControlFlowIntegrity.html
   #
-  # TODO(pcc): Remove this flag if/when CFI is enabled in official builds.
-  is_cfi = false
+  # TODO(pcc): Remove this flag if/when CFI is enabled in all official builds.
+  is_cfi = target_os == "linux" && !is_chromeos && target_cpu == "x64" &&
+           is_chrome_branded && is_official_build
 
   # Enable checks for bad casts: derived cast and unrelated cast.
   # TODO(krasin): remove this, when we're ready to add these checks by default.