I noticed from www-client/chromium-124.0.6367.118 build that it still use -fstack-protector. This should overwrite the -fstack-protector-strong option that we are using by default in hardened profile and default profile with gcc[ssp] I'm wondering if there a particular reason about why google still keeping -fstack-protector
I'm honestly not sure why Google do that, but I'm not inclined to change the upstream defaults here - I think that there's too much risk of it unintentionally (and silently) breaking something. If we ever get a test suite up and running I'd be willing to be more adventurous with our configurations, but until then I can only suggest opening a ticket upstream to ask your question.