Try building Tor Browser with SafeStack
SafeStack is part of the Levee project and prevents stack smashing attacks. It is reported to have a negligible performance hit.
Together, Levee's components, SafeStack and CPI or CPS, are supposed to prevent code flow hijacking. Once CPI and CPS have been released, we should try those as well.