Enable _FORTIFY_SOURCE=2 with clang (unless sanitizers are used).

Enable _FORTIFY_SOURCE=2 with clang for official builds (unless sanitizers are used).

BUG=392573
NOTRY=true

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=282200

[Lei Zhang, 2014-07-09 23:10:09]

lgtm with green trybots.

[Nico, 2014-07-09 23:18:59]

On 2014/07/09 23:10:09, Lei Zhang wrote:
> lgtm with green trybots.

I think the clang trybots only compile, so they won't tell us much :-/

(But maybe you can patch this in and repeat your experiment and see if the
library deps change at all)

[Nico, 2014-07-09 23:19:56]

Oh, and I'll build and run a few tests locally.


On Wed, Jul 9, 2014 at 4:18 PM, <thakis@chromium.org> wrote:

> On 2014/07/09 23:10:09, Lei Zhang wrote:
>
>> lgtm with green trybots.
>>
>
> I think the clang trybots only compile, so they won't tell us much :-/
>
> (But maybe you can patch this in and repeat your experiment and see if the
> library deps change at all)
>
> https://codereview.chromium.org/377383004/
>

To unsubscribe from this group and stop receiving emails from it, send an email
to chromium-reviews+unsubscribe@chromium.org.

[Nico, 2014-07-09 23:39:45]

Reading the bug linked from https://codereview.chromium.org/138913015 , this
seems to be a problem with the ubuntu 13 headers, but not the 12 headers.

So this might cause issues for folks building on newer ubuntus. Maybe we should
only do this if buildtype=="Official" for now?

[Lei Zhang, 2014-07-09 23:42:13]

On 2014/07/09 23:39:45, Nico (away) wrote:
> Reading the bug linked from https://codereview.chromium.org/138913015 , this
> seems to be a problem with the ubuntu 13 headers, but not the 12 headers.
> 
> So this might cause issues for folks building on newer ubuntus. Maybe we
should
> only do this if buildtype=="Official" for now?

I'm fine with that.

[Nico, 2014-07-10 00:24:02]

Ok, now official-only.

I asked the security folks how much they like this -- if they don't like it
much, I'll remove _FORTIFY_SOURCE completely, else I guess I'll try to fix that
clang bug.

[Nico, 2014-07-10 00:47:04]

The CQ bit was checked by thakis@chromium.org

[commit-bot: I haz the power, 2014-07-10 00:48:31]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/thakis@chromium.org/377383004/40001

[commit-bot: I haz the power, 2014-07-10 00:51:03]

Change committed as 282200

[Lei Zhang, 2014-07-10 01:35:08]

Even with it turned on, the only _chk symbol referenced is __longjmp_chk. You'll
still need to fix up the dependency expectation in c/b/installer/linux