chromium: Update all channels to latest versions.

With this commit, the following new upstream versions are introduced: stable: 35.0.1916.114 -> 35.0.1916.153 beta: 35.0.1916.86 -> 36.0.1985.67 dev: 36.0.1964.2 -> 37.0.2054.3 All builds successfully tested on my machine, however in order to update the beta and dev channels, a few additional modifications were necessary: * Update/rebase USER_NS sandbox patch for version 36 and higher. * Create address_input_strings.grdp before running gyp in version 37. * Remove an empty string leftover from 0517041. * Add patch for building bundled Angle for version 37. The patch for Angle is to remove reliance on git being present during build and is from https://chromium-review.googlesource.com/202048 but with own modifications to remove/fix Windows-specific parts within the patch file. Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-06-16 20:24:56 +02:00 · 2014-06-16 20:24:56 +02:00 · 4cbedd7322
commit 4cbedd7322
parent 3d665679c1
5 changed files with 385 additions and 32 deletions
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -132,6 +132,8 @@ let
      find -iname '*.gyp*' \( -type f -o -type l \) \
        -exec sed -i -e 's|<(DEPTH)|'"$(pwd)"'|g' {} + \
        -exec chmod u+w {} +
+    '' + optionalString (!versionOlder source.version "37.0.0.0") ''
+      python third_party/libaddressinput/chromium/tools/update-strings.py
    '';

    postPatch = let
@ -160,6 +162,9 @@ let
      linux_sandbox_chrome_path="${libExecPath}/${packageName}";
      werror = "";

+      # FIXME: In version 37, omnibox.mojom.js doesn't seem to be generated.
+      use_mojo = versionOlder source.version "37.0.0.0";
+
      # Google API keys, see:
      #   http://www.chromium.org/developers/how-tos/api-keys
      # Note: These are for NixOS/nixpkgs use ONLY. For your own distribution,
--- a/pkgs/applications/networking/browsers/chromium/source/angle_build_37.patch
+++ b/pkgs/applications/networking/browsers/chromium/source/angle_build_37.patch
@ -0,0 +1,347 @@
+commit 9c4b24a52e0ff478aa170d33e26c44acd8c68be3
+Author: Jamie Madill <jmadill@chromium.org>
+Date:   Thu Jun 12 13:41:17 2014 -0400
+
+    Use commit_id.py on Windows, and handle missing git.
+    
+    This allows us to delete the Windows batch file.
+    
+    Changes the commit_id script to take the working directory so that it
+    can be called from a different working directory than the angle
+    repository is in.
+    
+    Renames the generated commit header to angle_commit.h. This is being
+    written to the shared generated code directory for the entire build,
+    and "commit.h" is insufficiently unique.
+    
+    BUG=angle:669
+    
+    Change-Id: I35e80411a7e8ba1e02ce3f6a4fc54ed4dbc918f3
+    Reviewed-on: https://chromium-review.googlesource.com/202048
+    Reviewed-by: Geoff Lang <geofflang@chromium.org>
+    Tested-by: Jamie Madill <jmadill@chromium.org>
+    [Removed and/or fixed up Windows specific hunks]
+    Signed-off-by: aszlig <aszlig@redmoonstudios.org>
+
+diff --git a/generate_projects b/generate_projects
+index 6743254..8175277 100644
+--- a/generate_projects
+++ b/generate_projects
+@@ -34,6 +34,7 @@ if __name__ == '__main__':
+     gyp_cmd += ' -D angle_build_tests=' + ('1' if build_tests else '0')
+     gyp_cmd += ' -D angle_build_samples=' + ('1' if build_samples else '0')
+     gyp_cmd += ' -D release_symbols=' + ('true' if release_symbols else 'false')
+    gyp_cmd += ' -D angle_use_commit_id=0'
+     gyp_cmd += ' ' + os.path.join(script_dir, 'all.gyp')
+ 
+     print 'Generating projects to ' + generation_dir + ' from gyp files...'
+diff --git a/projects/build/all.sln b/projects/build/all.sln
+index 1aa0796..5862edd 100644
+--- a/projects/build/all.sln
+++ b/projects/build/all.sln
+@@ -3,11 +3,11 @@ Microsoft Visual Studio Solution File, Format Version 11.00
+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "All", "All.vcxproj", "{D048EF6F-5312-AF41-8D8A-DB22CD8634E6}"
+ 	ProjectSection(ProjectDependencies) = postProject
+ 		{63FB0B97-D1D9-5158-8E85-7F5B1E403817} = {63FB0B97-D1D9-5158-8E85-7F5B1E403817}
+-		{3B7F5656-177F-52EE-26B3-D6A75368D0A9} = {3B7F5656-177F-52EE-26B3-D6A75368D0A9}
+ 		{C7BAF548-697D-2DCB-9DF3-9D1506A7B444} = {C7BAF548-697D-2DCB-9DF3-9D1506A7B444}
+ 		{276D20F5-2943-414C-0FF6-21F4723A5CF6} = {276D20F5-2943-414C-0FF6-21F4723A5CF6}
+ 		{C15697F6-5057-016E-BD29-422971875679} = {C15697F6-5057-016E-BD29-422971875679}
+ 		{19386E01-D811-FA3B-9F1E-122BB0C0E9F5} = {19386E01-D811-FA3B-9F1E-122BB0C0E9F5}
+		{3B7F5656-177F-52EE-26B3-D6A75368D0A9} = {3B7F5656-177F-52EE-26B3-D6A75368D0A9}
+ 		{22DC02D5-1598-943C-13E1-82185B469F81} = {22DC02D5-1598-943C-13E1-82185B469F81}
+ 		{7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81} = {7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81}
+ 		{FBAEE4F6-562A-588F-01F9-72DCABB3B061} = {FBAEE4F6-562A-588F-01F9-72DCABB3B061}
+@@ -30,9 +30,6 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "All", "All.vcxproj", "{D048
+ 	EndProjectSection
+ EndProject
+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "commit_id", "..\src\commit_id.vcxproj", "{3B7F5656-177F-52EE-26B3-D6A75368D0A9}"
+-	ProjectSection(ProjectDependencies) = postProject
+-		{63FB0B97-D1D9-5158-8E85-7F5B1E403817} = {63FB0B97-D1D9-5158-8E85-7F5B1E403817}
+-	EndProjectSection
+ EndProject
+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "copy_compiler_dll", "..\src\copy_compiler_dll.vcxproj", "{22DC02D5-1598-943C-13E1-82185B469F81}"
+ 	ProjectSection(ProjectDependencies) = postProject
+@@ -68,7 +65,6 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libEGL", "..\src\libEGL.vcx
+ 	ProjectSection(ProjectDependencies) = postProject
+ 		{7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81} = {7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81}
+ 		{3B7F5656-177F-52EE-26B3-D6A75368D0A9} = {3B7F5656-177F-52EE-26B3-D6A75368D0A9}
+-		{63FB0B97-D1D9-5158-8E85-7F5B1E403817} = {63FB0B97-D1D9-5158-8E85-7F5B1E403817}
+ 	EndProjectSection
+ EndProject
+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libGLESv2", "..\src\libGLESv2.vcxproj", "{7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81}"
+diff --git a/projects/samples/samples.sln b/projects/samples/samples.sln
+index 53cec34..b927860 100644
+--- a/projects/samples/samples.sln
+++ b/projects/samples/samples.sln
+@@ -1,9 +1,6 @@
+ Microsoft Visual Studio Solution File, Format Version 11.00
+ # Visual C++ Express 2010
+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "commit_id", "..\src\commit_id.vcxproj", "{3B7F5656-177F-52EE-26B3-D6A75368D0A9}"
+-	ProjectSection(ProjectDependencies) = postProject
+-		{63FB0B97-D1D9-5158-8E85-7F5B1E403817} = {63FB0B97-D1D9-5158-8E85-7F5B1E403817}
+-	EndProjectSection
+ EndProject
+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "copy_compiler_dll", "..\src\copy_compiler_dll.vcxproj", "{22DC02D5-1598-943C-13E1-82185B469F81}"
+ 	ProjectSection(ProjectDependencies) = postProject
+@@ -39,7 +36,6 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libEGL", "..\src\libEGL.vcx
+ 	ProjectSection(ProjectDependencies) = postProject
+ 		{7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81} = {7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81}
+ 		{3B7F5656-177F-52EE-26B3-D6A75368D0A9} = {3B7F5656-177F-52EE-26B3-D6A75368D0A9}
+-		{63FB0B97-D1D9-5158-8E85-7F5B1E403817} = {63FB0B97-D1D9-5158-8E85-7F5B1E403817}
+ 	EndProjectSection
+ EndProject
+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libGLESv2", "..\src\libGLESv2.vcxproj", "{7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81}"
+diff --git a/projects/src/angle.sln b/projects/src/angle.sln
+index 0d6ec65..cdf9f53 100644
+--- a/projects/src/angle.sln
+++ b/projects/src/angle.sln
+@@ -1,9 +1,6 @@
+ Microsoft Visual Studio Solution File, Format Version 11.00
+ # Visual C++ Express 2010
+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "commit_id", "commit_id.vcxproj", "{3B7F5656-177F-52EE-26B3-D6A75368D0A9}"
+-	ProjectSection(ProjectDependencies) = postProject
+-		{63FB0B97-D1D9-5158-8E85-7F5B1E403817} = {63FB0B97-D1D9-5158-8E85-7F5B1E403817}
+-	EndProjectSection
+ EndProject
+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "copy_compiler_dll", "copy_compiler_dll.vcxproj", "{22DC02D5-1598-943C-13E1-82185B469F81}"
+ 	ProjectSection(ProjectDependencies) = postProject
+@@ -16,7 +13,6 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libEGL", "libEGL.vcxproj",
+ 	ProjectSection(ProjectDependencies) = postProject
+ 		{7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81} = {7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81}
+ 		{3B7F5656-177F-52EE-26B3-D6A75368D0A9} = {3B7F5656-177F-52EE-26B3-D6A75368D0A9}
+-		{63FB0B97-D1D9-5158-8E85-7F5B1E403817} = {63FB0B97-D1D9-5158-8E85-7F5B1E403817}
+ 	EndProjectSection
+ EndProject
+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libGLESv2", "libGLESv2.vcxproj", "{7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81}"
+diff --git a/src/angle.gypi b/src/angle.gypi
+index 5339369..ef16749 100644
+--- a/src/angle.gypi
+++ b/src/angle.gypi
+@@ -7,6 +7,12 @@
+     {
+         'angle_code': 1,
+         'angle_post_build_script%': 0,
+        'angle_gen_path': '<(SHARED_INTERMEDIATE_DIR)/angle',
+        'angle_id_script_base': 'commit_id.py',
+        'angle_id_script': '<(angle_gen_path)/<(angle_id_script_base)',
+        'angle_id_header_base': 'commit.h',
+        'angle_id_header': '<(angle_gen_path)/id/<(angle_id_header_base)',
+        'angle_use_commit_id%': '<!(python <(angle_id_script_base) check ..)',
+     },
+     'includes':
+     [
+@@ -23,57 +29,71 @@
+             'copies':
+             [
+                 {
+-                    'destination': '<(SHARED_INTERMEDIATE_DIR)',
+-                    'files': [ 'commit_id.bat', 'copy_compiler_dll.bat', 'commit_id.py' ],
+                    'destination': '<(angle_gen_path)',
+                    'files': [ 'copy_compiler_dll.bat', '<(angle_id_script_base)' ],
+                 },
+             ],
+         },
+-
+    ],
+    'conditions':
+    [
+        ['angle_use_commit_id!=0',
+         {
+-            'target_name': 'commit_id',
+-            'type': 'none',
+-            'includes': [ '../build/common_defines.gypi', ],
+-            'dependencies': [ 'copy_scripts', ],
+-            'conditions':
+            'targets':
+             [
+-                ['OS=="win"',
+                 {
+                    'target_name': 'commit_id',
+                    'type': 'none',
+                    'includes': [ '../build/common_defines.gypi', ],
+                    'dependencies': [ 'copy_scripts', ],
+                     'actions':
+                     [
+                         {
+-                            'action_name': 'Generate Commit ID Header',
+-                            'message': 'Generating commit ID header...',
+                            'action_name': 'Generate ANGLE Commit ID Header',
+                            'message': 'Generating ANGLE Commit ID',
+                            # reference the git index as an input, so we rebuild on changes to the index
+                            'inputs': [ '<(angle_id_script)', '<(angle_path)/.git/index' ],
+                            'outputs': [ '<(angle_id_header)' ],
+                             'msvs_cygwin_shell': 0,
+-                            'inputs': [ '<(SHARED_INTERMEDIATE_DIR)/commit_id.bat', '<(angle_path)/.git/index' ],
+-                            'outputs': [ '<(SHARED_INTERMEDIATE_DIR)/commit.h' ],
+-                            'action': [ '<(SHARED_INTERMEDIATE_DIR)/commit_id.bat', '<(SHARED_INTERMEDIATE_DIR)' ],
+                            'action':
+                            [
+                                'python', '<(angle_id_script)', 'gen', '<(angle_path)', '<(angle_id_header)'
+                            ],
+                         },
+                     ],
+-                },
+-                { # OS != win
+-                    'actions':
+                    'direct_dependent_settings':
+                    {
+                        'include_dirs':
+                        [
+                            '<(angle_gen_path)',
+                        ],
+                    },
+                }
+            ]
+        },
+        { # angle_use_commit_id==0
+            'targets':
+            [
+                {
+                    'target_name': 'commit_id',
+                    'type': 'none',
+                    'copies':
+                     [
+                         {
+-                            'action_name': 'Generate Commit ID Header',
+-                            'message': 'Generating commit ID header...',
+-                            'inputs': [ '<(SHARED_INTERMEDIATE_DIR)/commit_id.py', '<(angle_path)/.git/index' ],
+-                            'outputs': [ '<(SHARED_INTERMEDIATE_DIR)/commit.h' ],
+-                            'action': [ 'python', '<(SHARED_INTERMEDIATE_DIR)/commit_id.py', '<(SHARED_INTERMEDIATE_DIR)/commit.h' ],
+-                        },
+                            'destination': '<(angle_gen_path)/id',
+                            'files': [ '<(angle_id_header_base)' ]
+                        }
+                     ],
+-                }],
+-            ],
+-            'direct_dependent_settings':
+-            {
+-                'include_dirs':
+-                [
+-                    '<(SHARED_INTERMEDIATE_DIR)',
+-                ],
+-            },
+-        },
+-    ],
+-    'conditions':
+-    [
+                    'direct_dependent_settings':
+                    {
+                        'include_dirs':
+                        [
+                            '<(angle_gen_path)',
+                        ],
+                    },
+                }
+            ]
+        }],
+         ['OS=="win"',
+         {
+             'targets':
+@@ -93,7 +113,7 @@
+                             'outputs': [ '<(PRODUCT_DIR)/D3DCompiler_46.dll' ],
+                             'action':
+                             [
+-                                "<(SHARED_INTERMEDIATE_DIR)/copy_compiler_dll.bat",
+                                "<(angle_gen_path)/copy_compiler_dll.bat",
+                                 "$(PlatformName)",
+                                 "<(windows_sdk_path)",
+                                 "<(PRODUCT_DIR)"
+diff --git a/src/commit.h b/src/commit.h
+new file mode 100644
+index 0000000..4c89a65
+--- /dev/null
+++ b/src/commit.h
+@@ -0,0 +1,14 @@
+//
+// Copyright (c) 2014 The ANGLE Project Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// commit.h:
+//   This is a default commit hash header, when git is not available.
+//
+
+#define ANGLE_COMMIT_HASH "unknown hash"
+#define ANGLE_COMMIT_HASH_SIZE 12
+#define ANGLE_COMMIT_DATE "unknown date"
+
+#define ANGLE_DISABLE_PROGRAM_BINARY_LOAD
+diff --git a/src/commit_id.py b/src/commit_id.py
+index 6339cca..7f711e7 100644
+--- a/src/commit_id.py
+++ b/src/commit_id.py
+@@ -1,19 +1,35 @@
+ import subprocess as sp
+ import sys
+import os
+ 
+-def grab_output(*command):
+-    return sp.Popen(command, stdout=sp.PIPE).communicate()[0].strip()
+# Usage: commit_id.py check <angle_dir> (checks if git is present)
+# Usage: commit_id.py gen <angle_dir> <file_to_write> (generates commit id)
+ 
+def grab_output(command, cwd):
+    return sp.Popen(command, stdout=sp.PIPE, shell=True, cwd=cwd).communicate()[0].strip()
+
+operation = sys.argv[1]
+cwd = sys.argv[2]
+
+if operation == 'check':
+    index_path = os.path.join(cwd, '.git', 'index')
+    if os.path.exists(index_path):
+        print("1")
+    else:
+        print("0")
+    sys.exit(0)
+
+output_file = sys.argv[3]
+ commit_id_size = 12
+ 
+ try:
+-    commit_id = grab_output('git', 'rev-parse', '--short=%d' % commit_id_size, 'HEAD')
+-    commit_date = grab_output('git', 'show', '-s', '--format=%ci', 'HEAD')
+    commit_id = grab_output('git rev-parse --short=%d HEAD' % commit_id_size, cwd)
+    commit_date = grab_output('git show -s --format=%ci HEAD', cwd)
+ except:
+     commit_id = 'invalid-hash'
+     commit_date = 'invalid-date'
+ 
+-hfile = open(sys.argv[1], 'w')
+hfile = open(output_file, 'w')
+ 
+ hfile.write('#define ANGLE_COMMIT_HASH "%s"\n'    % commit_id)
+ hfile.write('#define ANGLE_COMMIT_HASH_SIZE %d\n' % commit_id_size)
+diff --git a/src/common/version.h b/src/common/version.h
+index b9781d7..d9148d1 100644
+--- a/src/common/version.h
+++ b/src/common/version.h
+@@ -1,4 +1,4 @@
+-#include "commit.h"
+#include "id/commit.h"
+ 
+ #define ANGLE_MAJOR_VERSION 2
+ #define ANGLE_MINOR_VERSION 1
+diff --git a/src/libGLESv2/ProgramBinary.cpp b/src/libGLESv2/ProgramBinary.cpp
+index 8525ffb..e3ffa47 100644
+--- a/src/libGLESv2/ProgramBinary.cpp
+++ b/src/libGLESv2/ProgramBinary.cpp
+@@ -1018,6 +1018,9 @@ bool ProgramBinary::linkVaryings(InfoLog &infoLog, FragmentShader *fragmentShade
+ 
+ bool ProgramBinary::load(InfoLog &infoLog, const void *binary, GLsizei length)
+ {
+#ifdef ANGLE_DISABLE_PROGRAM_BINARY_LOAD
+    return false;
+#else
+     BinaryInputStream stream(binary, length);
+ 
+     int format = stream.readInt<int>();
+@@ -1260,6 +1263,7 @@ bool ProgramBinary::load(InfoLog &infoLog, const void *binary, GLsizei length)
+     initializeUniformStorage();
+ 
+     return true;
+#endif // #ifdef ANGLE_DISABLE_PROGRAM_BINARY_LOAD
+ }
+ 
+ bool ProgramBinary::save(void* binary, GLsizei bufSize, GLsizei *length)
--- a/pkgs/applications/networking/browsers/chromium/source/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/source/default.nix
@ -38,7 +38,8 @@ stdenv.mkDerivation {
      third_party/WebKit/Source/build/scripts/preprocessor.pm
  '' + optionalString useOpenSSL ''
    cat $opensslPatches | patch -p1 -d third_party/openssl/openssl
-  '' + optionalString (!versionOlder version "34.0.0.0") ''
+  '' + optionalString (!versionOlder version "37.0.0.0") ''
+    patch -p1 -d third_party/angle < "${./angle_build_37.patch}"
  '';

  outputs = [ "out" "sandbox" "bundled" "main" ];
--- a/pkgs/applications/networking/browsers/chromium/source/sandbox_userns_36.patch
+++ b/pkgs/applications/networking/browsers/chromium/source/sandbox_userns_36.patch
@ -1,4 +1,4 @@
-commit c66c07a2ebcd1b68f412a5a2945fef15b3ba567c
+commit 0fec7e4a742f001c9816a8b58a1120fb44230867
 Author: aszlig <aszlig@redmoonstudios.org>
 Date:   Thu May 16 14:17:56 2013 +0200

@ -47,7 +47,7 @@ index 9e39fba..00e4c79 100644
 
 #if defined(OS_CHROMEOS)
 diff --git a/base/process/launch_posix.cc b/base/process/launch_posix.cc
-index fe4da1a..7f118b8 100644
+index 457234f..a99ce9b 100644
 --- a/base/process/launch_posix.cc
 +++ b/base/process/launch_posix.cc
@@ -40,6 +40,10 @@
@ -111,7 +111,7 @@ index fe4da1a..7f118b8 100644
     // DANGER: fork() rule: in the child, if you don't end up doing exec*(),
     // you call _exit() instead of exit(). This is because _exit() does not
     // call any previously-registered (in the parent) exit handlers, which
-@@ -451,6 +480,40 @@ bool LaunchProcess(const std::vector<std::string>& argv,
+@@ -452,6 +481,40 @@ bool LaunchProcess(const std::vector<std::string>& argv,
     _exit(127);
   } else {
     // Parent process
@ -153,10 +153,10 @@ index fe4da1a..7f118b8 100644
       // While this isn't strictly disk IO, waiting for another process to
       // finish is the sort of thing ThreadRestrictions is trying to prevent.
 diff --git a/content/browser/zygote_host/zygote_host_impl_linux.cc b/content/browser/zygote_host/zygote_host_impl_linux.cc
-index 94bdc16..3398615 100644
+index 9d63ad9..0885705 100644
 --- a/content/browser/zygote_host/zygote_host_impl_linux.cc
 +++ b/content/browser/zygote_host/zygote_host_impl_linux.cc
-@@ -143,6 +143,9 @@ void ZygoteHostImpl::Init(const std::string& sandbox_cmd) {
+@@ -144,6 +144,9 @@ void ZygoteHostImpl::Init(const std::string& sandbox_cmd) {
   // A non empty sandbox_cmd means we want a SUID sandbox.
   using_suid_sandbox_ = !sandbox_cmd.empty();
 
@ -166,10 +166,10 @@ index 94bdc16..3398615 100644
   // Start up the sandbox host process and get the file descriptor for the
   // renderers to talk to it.
   const int sfd = RenderSandboxHostLinux::GetInstance()->GetRendererSocket();
-@@ -162,11 +165,24 @@ void ZygoteHostImpl::Init(const std::string& sandbox_cmd) {
-     dummy_fd.reset(socket(AF_UNIX, SOCK_DGRAM, 0));
-     CHECK_GE(dummy_fd.get(), 0);
-     fds_to_map.push_back(std::make_pair(dummy_fd.get(), kZygoteIdFd));
+@@ -156,11 +159,24 @@ void ZygoteHostImpl::Init(const std::string& sandbox_cmd) {
+     sandbox_client->PrependWrapper(&cmd_line);
+     sandbox_client->SetupLaunchOptions(&options, &fds_to_map, &dummy_fd);
+     sandbox_client->SetupLaunchEnvironment();
 +    userns_sandbox = sandbox_client->IsNoSuid();
   }
 
@ -192,7 +192,7 @@ index 94bdc16..3398615 100644
   dummy_fd.reset();
 
 diff --git a/content/zygote/zygote_main_linux.cc b/content/zygote/zygote_main_linux.cc
-index cc28a6f..e8f665a 100644
+index 11f0602..b7b8214 100644
 --- a/content/zygote/zygote_main_linux.cc
 +++ b/content/zygote/zygote_main_linux.cc
@@ -389,6 +389,13 @@ static bool EnterSuidSandbox(sandbox::SetuidSandboxClient* setuid_sandbox) {
@ -210,10 +210,10 @@ index cc28a6f..e8f665a 100644
   // Previously, we required that the binary be non-readable. This causes the
   // kernel to mark the process as non-dumpable at startup. The thinking was
 diff --git a/sandbox/linux/suid/client/setuid_sandbox_client.cc b/sandbox/linux/suid/client/setuid_sandbox_client.cc
-index 3300cb4..4bfa516 100644
+index fc03cdd..a972faa 100644
 --- a/sandbox/linux/suid/client/setuid_sandbox_client.cc
 +++ b/sandbox/linux/suid/client/setuid_sandbox_client.cc
-@@ -212,6 +212,10 @@ bool SetuidSandboxClient::IsInNewNETNamespace() const {
+@@ -229,6 +229,10 @@ bool SetuidSandboxClient::IsInNewNETNamespace() const {
   return env_->HasVar(kSandboxNETNSEnvironmentVarName);
 }
 
@ -224,7 +224,7 @@ index 3300cb4..4bfa516 100644
 bool SetuidSandboxClient::IsSandboxed() const {
   return sandboxed_;
 }
-@@ -267,8 +271,7 @@ void SetuidSandboxClient::PrependWrapper(base::CommandLine* cmd_line,
+@@ -277,8 +281,7 @@ void SetuidSandboxClient::PrependWrapper(base::CommandLine* cmd_line) {
                                     "LinuxSUIDSandboxDevelopment.";
   }
 
@ -234,10 +234,10 @@ index 3300cb4..4bfa516 100644
     LOG(FATAL) << "The SUID sandbox helper binary was found, but is not "
                   "configured correctly. Rather than run without sandboxing "
                   "I'm aborting now. You need to make sure that "
-@@ -284,6 +287,12 @@ void SetuidSandboxClient::PrependWrapper(base::CommandLine* cmd_line,
-     options->allow_new_privs = true;
-     UnsetExpectedEnvironmentVariables(&options->environ);
+@@ -286,6 +289,12 @@ void SetuidSandboxClient::PrependWrapper(base::CommandLine* cmd_line) {
   }
+ 
+   cmd_line->PrependWrapper(sandbox_binary);
 +
 +  if (!((st.st_uid == 0) &&
 +        (st.st_mode & S_ISUID) &&
@ -246,12 +246,12 @@ index 3300cb4..4bfa516 100644
 +  }
 }
 
- void SetuidSandboxClient::SetupLaunchEnvironment() {
+ void SetuidSandboxClient::SetupLaunchOptions(
 diff --git a/sandbox/linux/suid/client/setuid_sandbox_client.h b/sandbox/linux/suid/client/setuid_sandbox_client.h
-index 332c63b..4f603f8 100644
+index 2bbad7a..8605475 100644
 --- a/sandbox/linux/suid/client/setuid_sandbox_client.h
 +++ b/sandbox/linux/suid/client/setuid_sandbox_client.h
-@@ -70,6 +70,8 @@ class SANDBOX_EXPORT SetuidSandboxClient {
+@@ -66,6 +66,8 @@ class SANDBOX_EXPORT SetuidSandboxClient {
   bool IsInNewPIDNamespace() const;
   // Did the setuid helper create a new network namespace ?
   bool IsInNewNETNamespace() const;
--- a/pkgs/applications/networking/browsers/chromium/source/sources.nix
+++ b/pkgs/applications/networking/browsers/chromium/source/sources.nix
@ -1,21 +1,21 @@
 # This file is autogenerated from update.sh in the parent directory.
 {
  dev = {
-    version = "36.0.1964.2";
-    sha256 = "0yrp1553pl0310h5pkfh2x27xhfrrxrpc25zad36f3k73iwmbg4c";
-    sha256bin32 = "02brz6lj7vfyyapc942dhdw7z26ksvnm7xqryfxn49y1rkd26xrf";
-    sha256bin64 = "0ibry2bfjcqnihwb8ykyl48qk25bzfxmw948sm70xnrmwbkv42ny";
+    version = "37.0.2054.3";
+    sha256 = "1sly1fb9wh10m36crikahn7wgsq7j090jaga4l8zk4kihzprcnj2";
+    sha256bin32 = "0242ypzgzskkmsw3iyirxzlm1gbng94lv723ffcr018grq9yg4gs";
+    sha256bin64 = "17kzb7k0vn96wa6a4xfx05885li1qjg8bp6y3ngs2i0wws9ypfd9";
  };
  beta = {
-    version = "35.0.1916.86";
-    sha256 = "0pjgpif8fiq14fk05pxs3js0pcg2jwmw0fklcci11rzq6rcm7r2g";
-    sha256bin32 = "1js71l88hqfli6c342iigwddxrqrzlx5fcazfxwlps4bdwgig6f8";
-    sha256bin64 = "1sqavz6lh0ryf8jlw8jcfwk265spxs70bhigcgcqsd6647fbdqsr";
+    version = "36.0.1985.67";
+    sha256 = "11gp21j96zr93g2bicwsq335zj83rx6jz44439cn3msgfqdfm3hp";
+    sha256bin32 = "1ndllz5y4d37xjc004rdby8viif300qskpxfz4bb26z681frh6d1";
+    sha256bin64 = "0yy6qr9ykd52qxxbx4kv1cmqmlw4hppah8s4lnw4lnd55xj9xb8q";
  };
  stable = {
-    version = "35.0.1916.114";
-    sha256 = "1bvpkwjchkzx1qfc93hd8md6sz5sd7pl55xc8b8m3iakbp0csvsn";
-    sha256bin32 = "0zm5770cv9dld37xall9lpl9faa0bgjcp8hjx6l1ivfhs6lxbxxa";
-    sha256bin64 = "18p302aj2d7xdza9kf438vbz3wqh8db7v2dq5d9b4b3ak6w9ld03";
+    version = "35.0.1916.153";
+    sha256 = "03p7wmlvbrgd8m94344z4azkhrffwrr5c76dm8c4jcxs0x1yn318";
+    sha256bin32 = "0xm34xwdai8ns6bkq5dshh4izls70rwgvya23md4vxq6iv78sykn";
+    sha256bin64 = "1x2cm1i8v8d69856b42anms33clv63adzpqy58in6i9vba13swif";
  };
 }