Reland of Enable whitelist generation for official builds.

build/toolchain/gcc_toolchain.gni

 # Copyright (c) 2013 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//build/config/clang/clang.gni")
 import("//build/config/nacl/config.gni")
 import("//build/config/sanitizers/sanitizers.gni")
 import("//build/config/v8_target_cpu.gni")
 import("//build/toolchain/cc_wrapper.gni")
 import("//build/toolchain/goma.gni")
 import("//build/toolchain/toolchain.gni")
+import("//tools/grit/grit_rule.gni")
 
 # This template defines a toolchain for something that works like gcc
 # (including clang).
 #
 # It requires the following variables specifying the executables to run:
 #  - ar
 #  - cc
 #  - cxx
 #  - ld
 #
@@ skipping 191 matching lines @@
     }
 
     # These library switches can apply to all tools below.
     lib_switch = "-l"
     lib_dir_switch = "-L"
 
     # Object files go in this directory.
     object_subdir = "{{target_out_dir}}/{{label_name}}"
 
     tool("cc") {
+      whitelist_flag = " "
+      if (enable_resource_whitelist_generation) {
+        whitelist_flag = " --resource-whitelist=\"{{output}}.whitelist\""
+      }
       depfile = "{{output}}.d"
       command = "$cc -MMD -MF $depfile ${rebuild_string}{{defines}} {{include_dirs}} {{cflags}} {{cflags_c}}${extra_cppflags}${extra_cflags} -c {{source}} -o {{output}}"
       depsformat = "gcc"
       description = "CC {{output}}"
       outputs = [
+        # The whitelist file is also an output, but ninja does not
+        # currently support multiple outputs for tool("cc").
         "$object_subdir/{{source_name_part}}.o",
       ]
+      compile_wrapper = rebase_path("//build/toolchain/gcc_compile_wrapper.py",
+                                    root_build_dir)
+      command = "$python_path \"$compile_wrapper\"$whitelist_flag $command"
     }
 
     tool("cxx") {
+      whitelist_flag = " "
+      if (enable_resource_whitelist_generation) {
+        whitelist_flag = " --resource-whitelist=\"{{output}}.whitelist\""
+      }
       depfile = "{{output}}.d"
       command = "$cxx -MMD -MF $depfile ${rebuild_string}{{defines}} {{include_dirs}} {{cflags}} {{cflags_cc}}${extra_cppflags}${extra_cxxflags} -c {{source}} -o {{output}}"
       depsformat = "gcc"
       description = "CXX {{output}}"
       outputs = [
+        # The whitelist file is also an output, but ninja does not
+        # currently support multiple outputs for tool("cxx").
         "$object_subdir/{{source_name_part}}.o",
       ]
+      compile_wrapper = rebase_path("//build/toolchain/gcc_compile_wrapper.py",
+                                    root_build_dir)
+      command = "$python_path \"$compile_wrapper\"$whitelist_flag $command"
     }
 
     tool("asm") {
       # For GCC we can just use the C compiler to compile assembly.
       depfile = "{{output}}.d"
       command = "$cc -MMD -MF $depfile ${rebuild_string}{{defines}} {{include_dirs}} {{asmflags}} -c {{source}} -o {{output}}"
       depsformat = "gcc"
       description = "ASM {{output}}"
       outputs = [
         "$object_subdir/{{source_name_part}}.o",
       ]
     }
 
     tool("alink") {
       rspfile = "{{output}}.rsp"
+      whitelist_flag = " "
+      if (enable_resource_whitelist_generation) {
+        whitelist_flag = " --resource-whitelist=\"{{output}}.whitelist\""
+      }
 
       # This needs a Python script to avoid using simple sh features in this
       # command, in case the host does not use a POSIX shell (e.g. compiling
       # POSIX-like toolchains such as NaCl on Windows).
       ar_wrapper =
           rebase_path("//build/toolchain/gcc_ar_wrapper.py", root_build_dir)
-      command = "$python_path \"$ar_wrapper\" --output={{output}} --ar=\"$ar\" {{arflags}} rcsD @\"$rspfile\""
+      command = "$python_path \"$ar_wrapper\"$whitelist_flag --output={{output}} --ar=\"$ar\" {{arflags}} rcsD @\"$rspfile\""
       description = "AR {{output}}"
       rspfile_content = "{{inputs}}"
       outputs = [
         "{{output_dir}}/{{target_output_name}}{{output_extension}}",
       ]
 
       # Shared libraries go in the target out directory by default so we can
       # generate different targets with the same name and not have them collide.
       default_output_dir = "{{target_out_dir}}"
       default_output_extension = ".a"
       output_prefix = "lib"
     }
 
     tool("solink") {
       soname = "{{target_output_name}}{{output_extension}}"  # e.g. "libfoo.so".
       sofile = "{{output_dir}}/$soname"  # Possibly including toolchain dir.
       rspfile = sofile + ".rsp"
       pool = "//build/toolchain:link_pool($default_toolchain)"
+      whitelist_flag = " "
+      if (enable_resource_whitelist_generation) {
+        whitelist_file = "$sofile.whitelist"
+        whitelist_flag = " --resource-whitelist=\"$whitelist_file\""
+      }
 
       if (defined(invoker.strip)) {
         unstripped_sofile = "{{root_out_dir}}/lib.unstripped/$soname"
       } else {
         unstripped_sofile = sofile
       }
 
       # These variables are not built into GN but are helpers that
       # implement (1) linking to produce a .so, (2) extracting the symbols
       # from that file (3) if the extracted list differs from the existing
       # .TOC file, overwrite it, otherwise, don't change it.
       tocfile = sofile + ".TOC"
 
       link_command = "$ld -shared {{ldflags}}${extra_ldflags} -o \"$unstripped_sofile\" -Wl,-soname=\"$soname\" @\"$rspfile\""
 
       assert(defined(readelf), "to solink you must have a readelf")
       assert(defined(nm), "to solink you must have an nm")
       strip_switch = ""
       if (defined(invoker.strip)) {
         strip_switch = "--strip=${invoker.strip}"
       }
 
       # This needs a Python script to avoid using a complex shell command
       # requiring sh control structures, pipelines, and POSIX utilities.
       # The host might not have a POSIX shell and utilities (e.g. Windows).
       solink_wrapper = rebase_path("//build/toolchain/gcc_solink_wrapper.py")
-      command = "$python_path \"$solink_wrapper\" --readelf=\"$readelf\" --nm=\"$nm\" $strip_switch --sofile=\"$unstripped_sofile\" --tocfile=\"$tocfile\" --output=\"$sofile\" -- $link_command"
+      command = "$python_path \"$solink_wrapper\" --readelf=\"$readelf\" --nm=\"$nm\" $strip_switch --sofile=\"$unstripped_sofile\" --tocfile=\"$tocfile\" --output=\"$sofile\"$whitelist_flag -- $link_command"
 
       rspfile_content = "-Wl,--whole-archive {{inputs}} {{solibs}} -Wl,--no-whole-archive $solink_libs_section_prefix {{libs}} $solink_libs_section_postfix"
 
       description = "SOLINK $sofile"
 
       # Use this for {{output_extension}} expansions unless a target manually
       # overrides it (in which case {{output_extension}} will be what the target
       # specifies).
       default_output_extension = default_shlib_extension
 
       default_output_dir = "{{root_out_dir}}"
       if (shlib_subdir != ".") {
         default_output_dir += "/$shlib_subdir"
       }
 
       output_prefix = "lib"
 
       # Since the above commands only updates the .TOC file when it changes, ask
       # Ninja to check if the timestamp actually changed to know if downstream
       # dependencies should be recompiled.
       restat = true
 
       # Tell GN about the output files. It will link to the sofile but use the
       # tocfile for dependency management.
       outputs = [
         sofile,
         tocfile,
       ]
+      if (enable_resource_whitelist_generation) {
+        outputs += [ whitelist_file ]
+      }
       if (sofile != unstripped_sofile) {
         outputs += [ unstripped_sofile ]
       }
       link_output = sofile
       depend_output = tocfile
     }
 
     tool("solink_module") {
       soname = "{{target_output_name}}{{output_extension}}"  # e.g. "libfoo.so".
       sofile = "{{output_dir}}/$soname"
@@ skipping 120 matching lines @@
     forward_variables_from(invoker, [ "strip" ])
 
     toolchain_args = {
       if (defined(invoker.toolchain_args)) {
         forward_variables_from(invoker.toolchain_args, "*")
       }
       is_clang = true
     }
   }
 }