Use hermetic toolchain on Mac, except for local iOS builds

Copied from https://chromium.googlesource.com/chromium/src/+/d04b06a98/build_overrides/build.gni

BUG=chromium:763924

Review-Url: https://codereview.webrtc.org/3013003002
Cr-Commit-Position: refs/heads/master@{#19781}
diff --git a/.gn b/.gn
index 2fe0610..7591ffb 100644
--- a/.gn
+++ b/.gn
@@ -25,7 +25,8 @@
 # These are the list of GN files that run exec_script. This whitelist exists
 # to force additional review for new uses of exec_script, which is strongly
 # discouraged except for gypi_to_gn calls.
-exec_script_whitelist = build_dotfile_settings.exec_script_whitelist
+exec_script_whitelist = build_dotfile_settings.exec_script_whitelist +
+                        [ "//build_overrides/build.gni" ]
 
 default_args = {
   # Webrtc does not support component builds because we are not using the
diff --git a/build_overrides/build.gni b/build_overrides/build.gni
index 3f5940a..81cb3e7 100644
--- a/build_overrides/build.gni
+++ b/build_overrides/build.gni
@@ -35,5 +35,14 @@
 # so we just ignore that assert. See https://crbug.com/648948 for more info.
 ignore_elf32_limitations = true
 
-# Use bundled hermetic Xcode installation maintainted by Chromium.
-use_system_xcode = false
+# Use bundled hermetic Xcode installation maintainted by Chromium,
+# except for local iOS builds where it's unsupported.
+if (host_os == "mac") {
+  _result = exec_script("//build/mac/should_use_hermetic_xcode.py",
+                        [ target_os ],
+                        "value")
+  assert(_result != 2,
+         "Do not allow building targets with the default" +
+             "hermetic toolchain if the minimum OS version is not met.")
+  use_system_xcode = _result == 0
+}