[Windows MSVC CFG] Link with CFG only on executables.

build/config/win/BUILD.gn

 # Copyright (c) 2013 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//build/config/clang/clang.gni")
 import("//build/config/compiler/compiler.gni")
 import("//build/config/sanitizers/sanitizers.gni")
 import("//build/config/win/visual_studio_version.gni")
 import("//build/toolchain/toolchain.gni")
 
@@ skipping 234 matching lines @@
   # Chrome.dll module like chrome_<base address>, where <base address>
   # typically changes with each launch. This in turn means that breakpoints in
   # Chrome.dll don't stick from one launch to the next. For this reason, we
   # turn ASLR off in debug builds.
   if (is_debug) {
     ldflags += [ "/DYNAMICBASE:NO" ]
   } else {
     ldflags += [ "/DYNAMICBASE" ]
   }
 
+  if (win_linker_timing) {
+    ldflags += [
+      "/time",
+      "/verbose:incr",
+    ]
+  }
+}
+
+config("cfi_linker") {
   # Control Flow Guard (CFG)
   # https://msdn.microsoft.com/en-us/library/windows/desktop/mt637065.aspx
   # /DYNAMICBASE (ASLR) is turned off in debug builds, therefore CFG can’t be
   # turned on either.
   # TODO(thakis): Turn this on with lld once supported, https://crbug.com/693709
   if (!is_debug && !use_lld) {
     # Turn on CFG in msvc linker, regardless of compiler used.
-    ldflags += [ "/guard:cf" ]
-  }
-
-  if (win_linker_timing) {
-    ldflags += [
-      "/time",
-      "/verbose:incr",
-    ]
+    ldflags = [ "/guard:cf" ]
   }
 }
 
 # CRT --------------------------------------------------------------------------
 
 # Configures how the runtime library (CRT) is going to be used.
 # See https://msdn.microsoft.com/en-us/library/2kzt1wy3.aspx for a reference of
 # what each value does.
 config("default_crt") {
   if (is_component_build) {
@@ skipping 133 matching lines @@
 
 # Internal stuff --------------------------------------------------------------
 
 # Config used by the MIDL template to disable warnings.
 config("midl_warnings") {
   if (is_clang) {
     # MIDL generates code like "#endif !_MIDL_USE_GUIDDEF_".
     cflags = [ "-Wno-extra-tokens" ]
   }
 }