Enable -fstack-protector-strong on macOS and MacCatalyst when clang supports it

[Copilot]

Removes the years-old workaround that hard-coded -fstack-protector on macOS/MacCatalyst due to a clang 7.0.2 bug. Modern clang supports -fstack-protector-strong, providing better stack canary coverage.

Changes

• eng/native/configurecompiler.cmake: replace the unconditional -fstack-protector (+ stale comment) for CLR_CMAKE_HOST_OSX/CLR_CMAKE_HOST_MACCATALYST with a check_c_compiler_flag(-fstack-protector-strong …) probe — same pattern already used for all other non-Apple Unix targets. Falls back to -fstack-protector if the flag is not supported, so older toolchains are unaffected.

[Copilot]

Pull request overview

This PR updates native compiler configuration to prefer -fstack-protector-strong on macOS/MacCatalyst when supported, removing an old clang workaround and aligning Apple desktop targets with other Unix hosts.

Changes:

• Removes the hard-coded macOS/MacCatalyst -fstack-protector fallback.
• Adds a compiler flag probe for -fstack-protector-strong.
• Preserves existing Apple arm64 LSE/default CPU handling.

Comments suppressed due to low confidence (1)

eng/native/configurecompiler.cmake:637

• The Apple-specific if opened on line 625 is still active here, so this stack-protector probe is now nested under CLR_CMAKE_HOST_OSX OR CLR_CMAKE_HOST_MACCATALYST and the endif label at line 637 closes the wrong block. That means non-Apple Unix hosts no longer get -fstack-protector-strong, and CMake may also reject the mismatched endif label. Close the Apple block before starting the general non-browser/WASI probe.

  if(NOT CLR_CMAKE_HOST_BROWSER AND NOT CLR_CMAKE_HOST_WASI)
    check_c_compiler_flag(-fstack-protector-strong COMPILER_SUPPORTS_F_STACK_PROTECTOR_STRONG)
    if (COMPILER_SUPPORTS_F_STACK_PROTECTOR_STRONG)
      add_compile_options(-fstack-protector-strong)
    endif()
  endif(CLR_CMAKE_HOST_OSX OR CLR_CMAKE_HOST_MACCATALYST)

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/runtime-infrastructure
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

[am11]

Suggested change

	check_c_compiler_flag(-fstack-protector-strong COMPILER_SUPPORTS_F_STACK_PROTECTOR_STRONG)
	if (COMPILER_SUPPORTS_F_STACK_PROTECTOR_STRONG)
	add_compile_options(-fstack-protector-strong)
	endif()
	add_compile_options(-fstack-protector-strong)

All supported versions of clang (3.6+, AppleClang 6) and gcc (4.9+) support this flag, we can simplify it.