Use hermetic toolchain on Mac, except for local iOS builds

Copied from https://chromium.googlesource.com/chromium/src/+/d04b06a98/build_overrides/build.gni

BUG=chromium:763924

Review-Url: https://codereview.webrtc.org/3013003002
Cr-Commit-Position: refs/heads/master@{#19781}

.gn

@@ -25,7 +25,8 @@ check_targets = [ "//webrtc/*" ]
 # These are the list of GN files that run exec_script. This whitelist exists
 # to force additional review for new uses of exec_script, which is strongly
 # discouraged except for gypi_to_gn calls.
-exec_script_whitelist = build_dotfile_settings.exec_script_whitelist
+exec_script_whitelist = build_dotfile_settings.exec_script_whitelist +
+                        [ "//build_overrides/build.gni" ]
 
 default_args = {
   # Webrtc does not support component builds because we are not using the

build_overrides/build.gni

@@ -35,5 +35,14 @@ lint_suppressions_file = "//tools_webrtc/android/suppressions.xml"
 # so we just ignore that assert. See https://crbug.com/648948 for more info.
 ignore_elf32_limitations = true
 
-# Use bundled hermetic Xcode installation maintainted by Chromium.
-use_system_xcode = false
+# Use bundled hermetic Xcode installation maintainted by Chromium,
+# except for local iOS builds where it's unsupported.
+if (host_os == "mac") {
+  _result = exec_script("//build/mac/should_use_hermetic_xcode.py",
+                        [ target_os ],
+                        "value")
+  assert(_result != 2,
+         "Do not allow building targets with the default" +
+             "hermetic toolchain if the minimum OS version is not met.")
+  use_system_xcode = _result == 0
+}