Chrome Version: trunk
OS: Linux

What steps will reproduce the problem?
(1) cat args.gn
allow_posix_link_time_opt = true
dcheck_always_on = true
is_cfi = true
is_component_build = false
is_debug = false
strip_absolute_paths_from_debug_symbols = true
use_cfi_cast = true
use_cfi_diag = true
use_goma = true
use_thin_lto = true
(2) ninja angle_unittests
(3) UBSAN_OPTIONS=print_stacktrace=1 ./angle_unittests --gtest_filter=FragmentShaderValidationTest.LayoutQualifierInCondition


What is the expected result?

test passes


What happens instead?

../../third_party/angle/src/compiler/translator/glslang_tab.cpp:4774:95: runtime error: control flow integrity check for type 'sh::TIntermTyped' failed during cast to unrelated type (vtable address 0x0000002b4950)
0x0000002b4950: note: vtable is of type 'sh::TIntermDeclaration'
 00 00 00 00  a0 f7 92 00 00 00 00 00  e0 f7 92 00 00 00 00 00  70 c8 92 00 00 00 00 00  50 b5 71 00
              ^ 
    #0 0x9649e4 in yyparse(sh::TParseContext*, void*) out_gn/cfi_bot/../../third_party/angle/src/compiler/translator/glslang_tab.cpp:4774:95
    #1 0x93ee2c in sh::PaParseStrings(unsigned long, char const* const*, int const*, sh::TParseContext*) out_gn/cfi_bot/../../third_party/angle/src/compiler/translator/ParseContext.cpp:5071:17
    #2 0x8faf5d in sh::TCompiler::compileTreeImpl(char const* const*, unsigned long, unsigned long) out_gn/cfi_bot/../../third_party/angle/src/compiler/translator/Compiler.cpp:304:21
    #3 0x7bb50a in sh::ShaderCompileTreeTest::compile(std::string const&) out_gn/cfi_bot/../../third_party/angle/src/tests/test_utils/ShaderCompileTreeTest.cpp:41:29
    #4 0x7393a2 in FragmentShaderValidationTest_LayoutQualifierInCondition_Test::TestBody() out_gn/cfi_bot/../../third_party/angle/src/tests/compiler_tests/ShaderValidation_test.cpp:681:9
    #5 0x7dbcff in testing::Test::Run() out_gn/cfi_bot/../../third_party/googletest/src/googletest/src/gtest.cc:2471:5
    #6 0x7dc45d in testing::TestInfo::Run() out_gn/cfi_bot/../../third_party/googletest/src/googletest/src/gtest.cc:2653:11
    #7 0x7dcb61 in testing::TestCase::Run() out_gn/cfi_bot/../../third_party/googletest/src/googletest/src/gtest.cc:2771:28
    #8 0x7e0ce2 in testing::internal::UnitTestImpl::RunAllTests() out_gn/cfi_bot/../../third_party/googletest/src/googletest/src/gtest.cc:4648:43
    #9 0x7e0a0c in testing::UnitTest::Run() out_gn/cfi_bot/../../third_party/googletest/src/googletest/src/gtest.cc:4256:10
    #10 0x88b112 in base::TestSuite::Run() out_gn/cfi_bot/../../base/test/test_suite.cc:271:16
    #11 0x7bbc44 in (anonymous namespace)::RunHelper(base::TestSuite*) out_gn/cfi_bot/../../gpu/angle_unittest_main.cc:19:22
    #12 0x7bbe2d in int base::internal::Invoker<base::internal::BindState<int (*)(base::TestSuite*), base::internal::UnretainedWrapper<base::TestSuite> >, int ()>::RunImpl<int (* const&)(base::TestSuite*), std::tuple<base::internal::UnretainedWrapper<base::TestSuite> > const&, 0ul>(int (* const&)(base::TestSuite*), std::tuple<base::internal::UnretainedWrapper<base::TestSuite> > const&, base::IndexSequence<0ul>) out_gn/cfi_bot/../../base/bind_internal.h:351:12
    #13 0x890c7e in base::(anonymous namespace)::LaunchUnitTestsInternal(base::Callback<int (), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&, int, int, bool, base::Callback<void (), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&) out_gn/cfi_bot/../../base/test/launcher/unit_test_launcher.cc:216:27
    #14 0x890f3d in base::LaunchUnitTestsSerially(int, char**, base::Callback<int (), (base::internal::CopyMode)1, (base::internal::RepeatMode)1> const&) out_gn/cfi_bot/../../base/test/launcher/unit_test_launcher.cc:470:10
    #15 0x7bbb93 in main out_gn/cfi_bot/../../gpu/angle_unittest_main.cc:29:12
    #16 0x7fcd423cef44 in __libc_start_main /build/eglibc-MjiXCM/eglibc-2.19/csu/libc-start.c:287

Please use labels and text to provide additional information.

Appears to be caused by https://chromium-review.googlesource.com/539639

This issue is affecting the "CFI Linux Full" bot, e.g. https://build.chromium.org/p/chromium.fyi/builders/CFI%20Linux%20Full/builds/2317
and is blocking us from moving it to chromium.memory.