From the discussion in https://github.com/WebKit/WebKit/pull/21785 [...] the build system for Chromium has an option which basically means “I wanna make a production build” which is toggles everything the authors want to have in the official builds. We could rename the USE_CXX_STDLIB_ASSERTIONS to something else like and make it cover a set of recommended hardening options—C++ library assertions would be the first one. I think that could be part of this issue.

Another comment from the GitHub discuission... not sure if it may be good to split to a separate bug depending on this one, but leaving it here for the sake of having the notes all here: > > Alternatively (or additionally) we can also disable them [the > > "production build" options by default with CMAKE_BUILD_TYPE=None, > > which is the recommended way to go for distributors and lets CMake > > pick only the compiler flags defined in the environment. > > I'm not sure: > > * The WebKit build warns you if the build type is missing, and > forcibly sets it. We would have to change that > * Many major distributors set the build type for all packages to > avoid problems like the above. GNOME uses RelWithDebInfo. I think > Mageia does too. Fedora does not. I'm not sure about Debian. > > Intuitively, the idea sounds good to me though. Setting nice flags > _except_ if you have a "plain" build type seems good and equivalent > to how meson works. It could also work by just using the build type > as input for the default value of a new option.

Discussion regarding hardening flags: https://github.com/WebKit/WebKit/pull/21785#pullrequestreview-1781881751