Add preliminary support for UBsan's vptr in Chromium (-fsanitize=vptr).

build/common.gypi

 # Copyright (c) 2012 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # IMPORTANT:
 # Please don't directly include this file if you are building via gyp_chromium,
 # since gyp_chromium is automatically forcing its inclusion.
 {
   # Variables expected to be overriden on the GYP command line (-D) or by
   # ~/.gyp/include.gypi.
@@ skipping 373 matching lines @@
       # Track where uninitialized memory originates from. From fastest to
       # slowest: 0 - no tracking, 1 - track only the initial allocation site, 2
       # - track the chain of stores leading from allocation site to use site.
       'msan_track_origins%': 1,
 
       # Enable building with UBSan (Clang's -fsanitize=undefined option).
       # -fsanitize=undefined only works with clang, but ubsan=1 implies clang=1
       # See http://clang.llvm.org/docs/UsersManual.html
       'ubsan%': 0,
 
+      # Enable building with UBsan's vptr (Clang's -fsanitize=vptr -fsanitize=null options).
+      # -fsanitize=vptr only works with clang, but ubsan_vptr=1 implies clang=1
+      'ubsan_vptr%': 0,
+      'ubsan_vptr_blacklist%': '<(PRODUCT_DIR)/../../tools/ubsan_vptr/blacklist.txt',
+
       # Use the dynamic libraries instrumented by one of the sanitizers
       # instead of the standard system libraries.
       'use_instrumented_libraries%': 0,
 
       # Use libc++ (third_party/libc++ and third_party/libc++abi) instead of
       # stdlibc++ as standard library. This is intended to use for instrumented
       # builds.
       'use_custom_libcxx%': 0,
 
       # Use a modified version of Clang to intercept allocated types and sizes
@@ skipping 655 matching lines @@
     'use_sanitizer_options%': '<(use_sanitizer_options)',
     'syzyasan%': '<(syzyasan)',
     'syzygy_optimize%': '<(syzygy_optimize)',
     'lsan%': '<(lsan)',
     'msan%': '<(msan)',
     'msan_blacklist%': '<(msan_blacklist)',
     'msan_track_origins%': '<(msan_track_origins)',
     'tsan%': '<(tsan)',
     'tsan_blacklist%': '<(tsan_blacklist)',
     'ubsan%': '<(ubsan)',
+    'ubsan_vptr%': '<(ubsan_vptr)',
+    'ubsan_vptr_blacklist%': '<(ubsan_vptr_blacklist)',
     'use_instrumented_libraries%': '<(use_instrumented_libraries)',
     'use_custom_libcxx%': '<(use_custom_libcxx)',
     'clang_type_profiler%': '<(clang_type_profiler)',
     'order_profiling%': '<(order_profiling)',
     'order_text_section%': '<(order_text_section)',
     'enable_extensions%': '<(enable_extensions)',
     'enable_plugin_installation%': '<(enable_plugin_installation)',
     'enable_plugins%': '<(enable_plugins)',
     'enable_session_service%': '<(enable_session_service)',
     'enable_themes%': '<(enable_themes)',
@@ skipping 370 matching lines @@
         'syzygy_optimize%': 0,
       }],
       # Get binutils version so we can enable debug fission if we can.
       ['os_posix==1 and OS!="mac" and OS!="ios"', {
         'conditions': [
           # compiler_version doesn't work with clang
           # TODO(mithro): Land https://codereview.chromium.org/199793014/ so
           # compiler_version works with clang.
           # TODO(glider): set clang to 1 earlier for ASan and TSan builds so
           # that it takes effect here.
-          ['clang==0 and asan==0 and lsan==0 and tsan==0 and msan==0 and ubsan==0', {
+          ['clang==0 and asan==0 and lsan==0 and tsan==0 and msan==0 and ubsan==0 and ubsan_vptr==0', {
             'binutils_version%': '<!pymod_do_main(compiler_version target assembler)',
           }],
           # On Android we know the binutils version in the toolchain.
           ['OS=="android"', {
             'binutils_version%': 222,
           }],
           ['host_arch=="x64"', {
             'binutils_dir%': 'third_party/binutils/Linux_x64/Release/bin',
           }],
           ['host_arch=="ia32"', {
             'binutils_dir%': 'third_party/binutils/Linux_ia32/Release/bin',
           }],
           # Our version of binutils in third_party/binutils
           ['linux_use_bundled_binutils==1', {
             'binutils_version%': 224,
           }],
         ],
       }, {
         'binutils_version%': 0,
       }],
       # The version of GCC in use, set later in platforms that use GCC and have
       # not explicitly chosen to build with clang. Currently, this means all
       # platforms except Windows, Mac and iOS.
       # TODO(glider): set clang to 1 earlier for ASan and TSan builds so that
       # it takes effect here.
-      ['os_posix==1 and OS!="mac" and OS!="ios" and clang==0 and asan==0 and lsan==0 and tsan==0 and msan==0', {
+      ['os_posix==1 and OS!="mac" and OS!="ios" and clang==0 and asan==0 and lsan==0 and tsan==0 and msan==0 and ubsan_vptr==0', {
         'conditions': [
           ['OS=="android"', {
             # We directly set the gcc versions since we know what we use.
             'gcc_version%': 48,
           }, {
             'gcc_version%': '<!pymod_do_main(compiler_version target compiler)',
           }],
           ['android_webview_build==1', {
             # Android WebView uses a hermetic toolchain even for host, so set it
             # manually here.
@@ skipping 543 matching lines @@
       }],
       ['enable_mdns==1 or OS=="mac"', {
         'grit_defines': ['-D', 'enable_service_discovery'],
         'enable_service_discovery%': 1
       }],
       ['clang_use_chrome_plugins==1 and OS!="win"', {
         'clang_chrome_plugins_flags': [
           '<!@(<(DEPTH)/tools/clang/scripts/plugin_flags.sh)'
         ],
       }],
-
       ['asan==1 or msan==1 or lsan==1 or tsan==1', {
         'clang%': 1,
         'use_allocator%': 'none',
       }],
       ['ubsan==1', {
         'clang%': 1,
       }],
+      ['ubsan_vptr==1', {
+        'clang%': 1,
+        'use_allocator%': 'none',

[earthdok, 2014/06/26 16:48:31]

UBSan doesn't replace the allocator. Why are we setting this?

+        'clang_use_chrome_plugins%': 0,  # Temporally turn plugins off as Ubsan's vptr now relies on custom Clang binaries.

[earthdok, 2014/06/26 16:48:31]

Please either pass this explicitly in GYP_DEFINES (preferable) or at least put a
TODO here.

+      }],
       ['asan==1 and OS=="mac"', {
         # TODO(glider): we do not strip ASan binaries until the dynamic ASan
         # runtime is fully adopted. See http://crbug.com/242503.
         'mac_strip_release': 0,
       }],
       ['tsan==1', {
         'use_custom_libcxx%': 1,
       }],
       ['msan==1', {
         # Use a just-built, MSan-instrumented libc++ instead of the system-wide
@@ skipping 443 matching lines @@
         'defines': ['SYSTEM_NATIVELY_SIGNALS_MEMORY_PRESSURE'],
       }],
       ['use_udev==1', {
         'defines': ['USE_UDEV'],
       }],
       ['fastbuild!=0', {
         'xcode_settings': {
           'GCC_GENERATE_DEBUGGING_SYMBOLS': 'NO',
         },
         'conditions': [
-          ['clang==1 and asan==0 and msan==0 and tsan==0', {
+          ['clang==1 and asan==0 and msan==0 and tsan==0 and ubsan_vptr==0', {
             # Clang creates chubby debug information, which makes linking very
             # slow. For now, don't create debug information with clang.  See
             # http://crbug.com/70000
             'conditions': [
               ['OS=="linux"', {
                 'variables': {
                   'debug_extra_cflags': '-g0',
                 },
               }],
               # Android builds symbols on release by default, disable them.
@@ skipping 1314 matching lines @@
             ],
           }],
           ['clang==1 and "<(GENERATOR)"=="ninja"', {
             'cflags': [
               # See http://crbug.com/110262
               '-fcolor-diagnostics',
             ],
           }],
           # Common options for AddressSanitizer, LeakSanitizer,
           # ThreadSanitizer and MemorySanitizer.
-          ['asan==1 or lsan==1 or tsan==1 or msan==1 or ubsan==1', {
+          ['asan==1 or lsan==1 or tsan==1 or msan==1 or ubsan==1 or ubsan_vptr==1', {
             'target_conditions': [
               ['_toolset=="target"', {
                 'cflags': [
                   '-fno-omit-frame-pointer',
                   '-gline-tables-only',
                 ],
                 'cflags!': [
                   '-fomit-frame-pointer',
                 ],
               }],
             ],
           }],
-          ['asan==1 or lsan==1 or tsan==1 or msan==1', {
+          ['asan==1 or lsan==1 or tsan==1 or msan==1 or ubsan_vptr==1', {

[earthdok, 2014/06/26 16:48:31]

Again, why define MEMORY_TOOL_REPLACES_ALLOCATOR?

             'target_conditions': [
               ['_toolset=="target"', {
                 'ldflags!': [
                   # Functions interposed by the sanitizers can make ld think
                   # that some libraries aren't needed when they actually are,
                   # http://crbug.com/234010. As workaround, disable --as-needed.
                   '-Wl,--as-needed',
                 ],
                 'defines': [
                   'MEMORY_TOOL_REPLACES_ALLOCATOR',
@@ skipping 39 matching lines @@
                   '-w',  # http://crbug.com/162783
                 ],
                 'ldflags': [
                   '-fsanitize=undefined',
                   # -fsanitize=vptr is incompatible with -fno-rtti.
                   '-fno-sanitize=vptr',
                 ],
               }],
             ],
           }],
+          ['ubsan_vptr==1', {
+            'target_conditions': [
+              ['_toolset=="target"', {
+                'cflags': [
+                  '-fsanitize=vptr',
+                  '-fsanitize=null',  # Avoid dereferences on null pointer objects.
+                  '-fsanitize-blacklist=<(ubsan_vptr_blacklist)',
+                  '-w',  # http://crbug.com/162783
+                ],
+                'cflags_cc!': [
+                  '-fno-rtti',
+                ],
+                'cflags!': [
+                  '-fno-rtti',
+                ],
+                'ldflags': [
+                  '-fsanitize=vptr',  # -fsanitize=null is not necessary.
+                ],
+                'defines': [
+                  'UNDEFINED_SANITIZER',
+                ],
+              }],
+            ],
+          }],
           ['asan_coverage!=0', {
             'target_conditions': [
               ['_toolset=="target"', {
                 'cflags': [
                   '-mllvm -asan-coverage=<(asan_coverage)',
                 ],
               }],
             ],
           }],
           ['lsan==1', {
@@ skipping 1573 matching lines @@
     # settings in target dicts.  SYMROOT is a special case, because many other
     # Xcode variables depend on it, including variables such as
     # PROJECT_DERIVED_FILE_DIR.  When a source group corresponding to something
     # like PROJECT_DERIVED_FILE_DIR is added to a project, in order for the
     # files to appear (when present) in the UI as actual files and not red
     # red "missing file" proxies, the correct path to PROJECT_DERIVED_FILE_DIR,
     # and therefore SYMROOT, needs to be set at the project level.
     'SYMROOT': '<(DEPTH)/xcodebuild',
   },
 }