Split CFI blacklist by CFI mode

Group failing casts and vcalls separately. This ensures the release
build disables CFI checking as narrowly as possible--currently only
CFI-vcall is enabled for release but checking is also disabled for bad-
cast blacklist entries as well.

Bug: 772906
Change-Id: Id8a91d1b01cbf858cf6be4f2b91fe548a521ef83
Reviewed-on: https://chromium-review.googlesource.com/706145Reviewed-by: Peter Collingbourne <pcc@chromium.org>
Commit-Queue: Peter Collingbourne <pcc@chromium.org>
Cr-Commit-Position: refs/heads/master@{#509613}

tools/cfi/blacklist.txt

+[cfi-unrelated-cast|cfi-derived-cast]
+
 # e.g. RolloverProtectedTickClock
 fun:*MutableInstance*
 
@@ -26,16 +28,6 @@ src:*nacl_message_scanner.cc*
 # src/base/win/event_trace_provider_unittest.cc
 type:*EtwTraceProvider*
 
-# These classes are used to communicate between chrome.exe and
-# chrome_child.dll (see src/sandbox/win/src/sandbox.h,
-# src/chrome/app/chrome_main.cc).
-type:sandbox::BrokerServices
-type:sandbox::TargetPolicy
-type:sandbox::TargetServices
-
-# Likewise (base/win/scoped_handle.cc).
-type:*ActiveVerifier*
-
 #############################################################################
 # Base class's constructor accesses a derived class.
 
@@ -67,6 +59,8 @@ src:*wtf/PartitionAllocator.h*
 #############################################################################
 # Methods disabled due to perf considerations.
 
+[cfi-vcall]
+
 # Skia
 
 # https://crbug.com/638056#c1
@@ -113,3 +107,18 @@ fun:*traceImpl*
 
 # b/64003142
 fun:*internal_default_instance*
+
+#############################################################################
+# Cross-DSO vcalls
+
+[cfi-vcall|cfi-unrelated-cast|cfi-derived-cast]
+
+# These classes are used to communicate between chrome.exe and
+# chrome_child.dll (see src/sandbox/win/src/sandbox.h,
+# src/chrome/app/chrome_main.cc).
+type:sandbox::BrokerServices
+type:sandbox::TargetPolicy
+type:sandbox::TargetServices
+
+# Likewise (base/win/scoped_handle.cc).
+type:*ActiveVerifier*