(https://codereview.chromium.org/2702583004 does 2)

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/390d2eb8431b01a37bd96831ab8ee210fd73bdcb

commit 390d2eb8431b01a37bd96831ab8ee210fd73bdcb
Author: thakis <thakis@chromium.org>
Date: Wed Feb 22 01:18:31 2017

win: Don't pass /guard:cf to lld for now

It doesn't understand the flag yet.

BUG= 693709 
NOTRY=true

Review-Url: https://codereview.chromium.org/2702583004
Cr-Commit-Position: refs/heads/master@{#451867}

[modify] https://crrev.com/390d2eb8431b01a37bd96831ab8ee210fd73bdcb/build/config/win/BUILD.gn

I have a work in progress patch for implementing /guard:cf in LLD.

Part of this landed: https://reviews.llvm.org/D42592
Longjmp protection is in review: https://reviews.llvm.org/D43217

After that, we need to implement delayload IAT protection, but once longjmp protection is rolled into clang we can remove the !use_lld check in the cfi_linker gn config.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d463a9c847bfad6c24b5e42de1fc58d1c03f60fc

commit d463a9c847bfad6c24b5e42de1fc58d1c03f60fc
Author: Nico Weber <thakis@chromium.org>
Date: Thu Mar 01 01:16:57 2018

Pass /guard:cf,nolongjmp to lld now that it has some support for it.

Bug:  693709 
Change-Id: I4e846d36fac5ca170c47c8e20906b0cf2715fbf5
Reviewed-on: https://chromium-review.googlesource.com/941904
Reviewed-by: Reid Kleckner <rnk@chromium.org>
Commit-Queue: Nico Weber <thakis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#539968}
[modify] https://crrev.com/d463a9c847bfad6c24b5e42de1fc58d1c03f60fc/build/config/win/BUILD.gn

rnk: did you talk to pennymac about the missing CGF bits and if they're critical?

Oops, no, the delayload IAT protection got lost along the way.

We talked to security folks, they say delayload IAT protection isn't blocking.

This is still valid, we should do IAT protection at some point.

Actually, let me open a new bug for that and close this one: https://crbug.com/854771 is the new IAT bug. LLD does understand /guard:cf, and that's what this bug was about.