chromium: Update all channels to latest versions.

With this commit, the following new upstream versions are introduced:

stable: 35.0.1916.114 -> 35.0.1916.153
beta:   35.0.1916.86  -> 36.0.1985.67
dev:    36.0.1964.2   -> 37.0.2054.3

All builds successfully tested on my machine, however in order to update
the beta and dev channels, a few additional modifications were
necessary:

 * Update/rebase USER_NS sandbox patch for version 36 and higher.
 * Create address_input_strings.grdp before running gyp in version 37.
 * Remove an empty string leftover from 0517041.
 * Add patch for building bundled Angle for version 37.

The patch for Angle is to remove reliance on git being present during
build and is from https://chromium-review.googlesource.com/202048 but
with own modifications to remove/fix Windows-specific parts within the
patch file.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>

5 files changed, 385 insertions, 32 deletions

diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index 631f12143d8b..d38bd442184b 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -132,6 +132,8 @@ let
       find -iname '*.gyp*' \( -type f -o -type l \) \
         -exec sed -i -e 's|<(DEPTH)|'"$(pwd)"'|g' {} + \
         -exec chmod u+w {} +
+    '' + optionalString (!versionOlder source.version "37.0.0.0") ''
+      python third_party/libaddressinput/chromium/tools/update-strings.py
     '';
 
     postPatch = let
@@ -160,6 +162,9 @@ let
       linux_sandbox_chrome_path="${libExecPath}/${packageName}";
       werror = "";
 
+      # FIXME: In version 37, omnibox.mojom.js doesn't seem to be generated.
+      use_mojo = versionOlder source.version "37.0.0.0";
+
       # Google API keys, see:
       #   http://www.chromium.org/developers/how-tos/api-keys
       # Note: These are for NixOS/nixpkgs use ONLY. For your own distribution,
diff --git a/pkgs/applications/networking/browsers/chromium/source/angle_build_37.patch b/pkgs/applications/networking/browsers/chromium/source/angle_build_37.patch
new file mode 100644
index 000000000000..a3e8c91174a4
--- /dev/null
+++ b/pkgs/applications/networking/browsers/chromium/source/angle_build_37.patch
@@ -0,0 +1,347 @@
+commit 9c4b24a52e0ff478aa170d33e26c44acd8c68be3
+Author: Jamie Madill <jmadill@chromium.org>
+Date:   Thu Jun 12 13:41:17 2014 -0400
+
+    Use commit_id.py on Windows, and handle missing git.
+    
+    This allows us to delete the Windows batch file.
+    
+    Changes the commit_id script to take the working directory so that it
+    can be called from a different working directory than the angle
+    repository is in.
+    
+    Renames the generated commit header to angle_commit.h. This is being
+    written to the shared generated code directory for the entire build,
+    and "commit.h" is insufficiently unique.
+    
+    BUG=angle:669
+    
+    Change-Id: I35e80411a7e8ba1e02ce3f6a4fc54ed4dbc918f3
+    Reviewed-on: https://chromium-review.googlesource.com/202048
+    Reviewed-by: Geoff Lang <geofflang@chromium.org>
+    Tested-by: Jamie Madill <jmadill@chromium.org>
+    [Removed and/or fixed up Windows specific hunks]
+    Signed-off-by: aszlig <aszlig@redmoonstudios.org>
+
+diff --git a/generate_projects b/generate_projects
+index 6743254..8175277 100644
+--- a/generate_projects
++++ b/generate_projects
+@@ -34,6 +34,7 @@ if __name__ == '__main__':
+     gyp_cmd += ' -D angle_build_tests=' + ('1' if build_tests else '0')
+     gyp_cmd += ' -D angle_build_samples=' + ('1' if build_samples else '0')
+     gyp_cmd += ' -D release_symbols=' + ('true' if release_symbols else 'false')
++    gyp_cmd += ' -D angle_use_commit_id=0'
+     gyp_cmd += ' ' + os.path.join(script_dir, 'all.gyp')
+ 
+     print 'Generating projects to ' + generation_dir + ' from gyp files...'
+diff --git a/projects/build/all.sln b/projects/build/all.sln
+index 1aa0796..5862edd 100644
+--- a/projects/build/all.sln
++++ b/projects/build/all.sln
+@@ -3,11 +3,11 @@ Microsoft Visual Studio Solution File, Format Version 11.00
+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "All", "All.vcxproj", "{D048EF6F-5312-AF41-8D8A-DB22CD8634E6}"

+ 	ProjectSection(ProjectDependencies) = postProject

+ 		{63FB0B97-D1D9-5158-8E85-7F5B1E403817} = {63FB0B97-D1D9-5158-8E85-7F5B1E403817}

+-		{3B7F5656-177F-52EE-26B3-D6A75368D0A9} = {3B7F5656-177F-52EE-26B3-D6A75368D0A9}

+ 		{C7BAF548-697D-2DCB-9DF3-9D1506A7B444} = {C7BAF548-697D-2DCB-9DF3-9D1506A7B444}

+ 		{276D20F5-2943-414C-0FF6-21F4723A5CF6} = {276D20F5-2943-414C-0FF6-21F4723A5CF6}

+ 		{C15697F6-5057-016E-BD29-422971875679} = {C15697F6-5057-016E-BD29-422971875679}

+ 		{19386E01-D811-FA3B-9F1E-122BB0C0E9F5} = {19386E01-D811-FA3B-9F1E-122BB0C0E9F5}

++		{3B7F5656-177F-52EE-26B3-D6A75368D0A9} = {3B7F5656-177F-52EE-26B3-D6A75368D0A9}

+ 		{22DC02D5-1598-943C-13E1-82185B469F81} = {22DC02D5-1598-943C-13E1-82185B469F81}

+ 		{7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81} = {7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81}

+ 		{FBAEE4F6-562A-588F-01F9-72DCABB3B061} = {FBAEE4F6-562A-588F-01F9-72DCABB3B061}

+@@ -30,9 +30,6 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "All", "All.vcxproj", "{D048
+ 	EndProjectSection

+ EndProject

+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "commit_id", "..\src\commit_id.vcxproj", "{3B7F5656-177F-52EE-26B3-D6A75368D0A9}"

+-	ProjectSection(ProjectDependencies) = postProject

+-		{63FB0B97-D1D9-5158-8E85-7F5B1E403817} = {63FB0B97-D1D9-5158-8E85-7F5B1E403817}

+-	EndProjectSection

+ EndProject

+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "copy_compiler_dll", "..\src\copy_compiler_dll.vcxproj", "{22DC02D5-1598-943C-13E1-82185B469F81}"

+ 	ProjectSection(ProjectDependencies) = postProject

+@@ -68,7 +65,6 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libEGL", "..\src\libEGL.vcx
+ 	ProjectSection(ProjectDependencies) = postProject

+ 		{7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81} = {7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81}

+ 		{3B7F5656-177F-52EE-26B3-D6A75368D0A9} = {3B7F5656-177F-52EE-26B3-D6A75368D0A9}

+-		{63FB0B97-D1D9-5158-8E85-7F5B1E403817} = {63FB0B97-D1D9-5158-8E85-7F5B1E403817}

+ 	EndProjectSection

+ EndProject

+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libGLESv2", "..\src\libGLESv2.vcxproj", "{7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81}"

+diff --git a/projects/samples/samples.sln b/projects/samples/samples.sln
+index 53cec34..b927860 100644
+--- a/projects/samples/samples.sln
++++ b/projects/samples/samples.sln
+@@ -1,9 +1,6 @@
+ Microsoft Visual Studio Solution File, Format Version 11.00

+ # Visual C++ Express 2010

+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "commit_id", "..\src\commit_id.vcxproj", "{3B7F5656-177F-52EE-26B3-D6A75368D0A9}"

+-	ProjectSection(ProjectDependencies) = postProject

+-		{63FB0B97-D1D9-5158-8E85-7F5B1E403817} = {63FB0B97-D1D9-5158-8E85-7F5B1E403817}

+-	EndProjectSection

+ EndProject

+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "copy_compiler_dll", "..\src\copy_compiler_dll.vcxproj", "{22DC02D5-1598-943C-13E1-82185B469F81}"

+ 	ProjectSection(ProjectDependencies) = postProject

+@@ -39,7 +36,6 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libEGL", "..\src\libEGL.vcx
+ 	ProjectSection(ProjectDependencies) = postProject

+ 		{7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81} = {7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81}

+ 		{3B7F5656-177F-52EE-26B3-D6A75368D0A9} = {3B7F5656-177F-52EE-26B3-D6A75368D0A9}

+-		{63FB0B97-D1D9-5158-8E85-7F5B1E403817} = {63FB0B97-D1D9-5158-8E85-7F5B1E403817}

+ 	EndProjectSection

+ EndProject

+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libGLESv2", "..\src\libGLESv2.vcxproj", "{7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81}"

+diff --git a/projects/src/angle.sln b/projects/src/angle.sln
+index 0d6ec65..cdf9f53 100644
+--- a/projects/src/angle.sln
++++ b/projects/src/angle.sln
+@@ -1,9 +1,6 @@
+ Microsoft Visual Studio Solution File, Format Version 11.00

+ # Visual C++ Express 2010

+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "commit_id", "commit_id.vcxproj", "{3B7F5656-177F-52EE-26B3-D6A75368D0A9}"

+-	ProjectSection(ProjectDependencies) = postProject

+-		{63FB0B97-D1D9-5158-8E85-7F5B1E403817} = {63FB0B97-D1D9-5158-8E85-7F5B1E403817}

+-	EndProjectSection

+ EndProject

+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "copy_compiler_dll", "copy_compiler_dll.vcxproj", "{22DC02D5-1598-943C-13E1-82185B469F81}"

+ 	ProjectSection(ProjectDependencies) = postProject

+@@ -16,7 +13,6 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libEGL", "libEGL.vcxproj",
+ 	ProjectSection(ProjectDependencies) = postProject

+ 		{7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81} = {7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81}

+ 		{3B7F5656-177F-52EE-26B3-D6A75368D0A9} = {3B7F5656-177F-52EE-26B3-D6A75368D0A9}

+-		{63FB0B97-D1D9-5158-8E85-7F5B1E403817} = {63FB0B97-D1D9-5158-8E85-7F5B1E403817}

+ 	EndProjectSection

+ EndProject

+ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libGLESv2", "libGLESv2.vcxproj", "{7FBD6F69-B9A4-69F1-A12B-8DACB3F8CD81}"

+diff --git a/src/angle.gypi b/src/angle.gypi
+index 5339369..ef16749 100644
+--- a/src/angle.gypi
++++ b/src/angle.gypi
+@@ -7,6 +7,12 @@
+     {
+         'angle_code': 1,
+         'angle_post_build_script%': 0,
++        'angle_gen_path': '<(SHARED_INTERMEDIATE_DIR)/angle',
++        'angle_id_script_base': 'commit_id.py',
++        'angle_id_script': '<(angle_gen_path)/<(angle_id_script_base)',
++        'angle_id_header_base': 'commit.h',
++        'angle_id_header': '<(angle_gen_path)/id/<(angle_id_header_base)',
++        'angle_use_commit_id%': '<!(python <(angle_id_script_base) check ..)',
+     },
+     'includes':
+     [
+@@ -23,57 +29,71 @@
+             'copies':
+             [
+                 {
+-                    'destination': '<(SHARED_INTERMEDIATE_DIR)',
+-                    'files': [ 'commit_id.bat', 'copy_compiler_dll.bat', 'commit_id.py' ],
++                    'destination': '<(angle_gen_path)',
++                    'files': [ 'copy_compiler_dll.bat', '<(angle_id_script_base)' ],
+                 },
+             ],
+         },
+-
++    ],
++    'conditions':
++    [
++        ['angle_use_commit_id!=0',
+         {
+-            'target_name': 'commit_id',
+-            'type': 'none',
+-            'includes': [ '../build/common_defines.gypi', ],
+-            'dependencies': [ 'copy_scripts', ],
+-            'conditions':
++            'targets':
+             [
+-                ['OS=="win"',
+                 {
++                    'target_name': 'commit_id',
++                    'type': 'none',
++                    'includes': [ '../build/common_defines.gypi', ],
++                    'dependencies': [ 'copy_scripts', ],
+                     'actions':
+                     [
+                         {
+-                            'action_name': 'Generate Commit ID Header',
+-                            'message': 'Generating commit ID header...',
++                            'action_name': 'Generate ANGLE Commit ID Header',
++                            'message': 'Generating ANGLE Commit ID',
++                            # reference the git index as an input, so we rebuild on changes to the index
++                            'inputs': [ '<(angle_id_script)', '<(angle_path)/.git/index' ],
++                            'outputs': [ '<(angle_id_header)' ],
+                             'msvs_cygwin_shell': 0,
+-                            'inputs': [ '<(SHARED_INTERMEDIATE_DIR)/commit_id.bat', '<(angle_path)/.git/index' ],
+-                            'outputs': [ '<(SHARED_INTERMEDIATE_DIR)/commit.h' ],
+-                            'action': [ '<(SHARED_INTERMEDIATE_DIR)/commit_id.bat', '<(SHARED_INTERMEDIATE_DIR)' ],
++                            'action':
++                            [
++                                'python', '<(angle_id_script)', 'gen', '<(angle_path)', '<(angle_id_header)'
++                            ],
+                         },
+                     ],
+-                },
+-                { # OS != win
+-                    'actions':
++                    'direct_dependent_settings':
++                    {
++                        'include_dirs':
++                        [
++                            '<(angle_gen_path)',
++                        ],
++                    },
++                }
++            ]
++        },
++        { # angle_use_commit_id==0
++            'targets':
++            [
++                {
++                    'target_name': 'commit_id',
++                    'type': 'none',
++                    'copies':
+                     [
+                         {
+-                            'action_name': 'Generate Commit ID Header',
+-                            'message': 'Generating commit ID header...',
+-                            'inputs': [ '<(SHARED_INTERMEDIATE_DIR)/commit_id.py', '<(angle_path)/.git/index' ],
+-                            'outputs': [ '<(SHARED_INTERMEDIATE_DIR)/commit.h' ],
+-                            'action': [ 'python', '<(SHARED_INTERMEDIATE_DIR)/commit_id.py', '<(SHARED_INTERMEDIATE_DIR)/commit.h' ],
+-                        },
++                            'destination': '<(angle_gen_path)/id',
++                            'files': [ '<(angle_id_header_base)' ]
++                        }
+                     ],
+-                }],
+-            ],
+-            'direct_dependent_settings':
+-            {
+-                'include_dirs':
+-                [
+-                    '<(SHARED_INTERMEDIATE_DIR)',
+-                ],
+-            },
+-        },
+-    ],
+-    'conditions':
+-    [
++                    'direct_dependent_settings':
++                    {
++                        'include_dirs':
++                        [
++                            '<(angle_gen_path)',
++                        ],
++                    },
++                }
++            ]
++        }],
+         ['OS=="win"',
+         {
+             'targets':
+@@ -93,7 +113,7 @@
+                             'outputs': [ '<(PRODUCT_DIR)/D3DCompiler_46.dll' ],
+                             'action':
+                             [
+-                                "<(SHARED_INTERMEDIATE_DIR)/copy_compiler_dll.bat",
++                                "<(angle_gen_path)/copy_compiler_dll.bat",
+                                 "$(PlatformName)",
+                                 "<(windows_sdk_path)",
+                                 "<(PRODUCT_DIR)"
+diff --git a/src/commit.h b/src/commit.h
+new file mode 100644
+index 0000000..4c89a65
+--- /dev/null
++++ b/src/commit.h
+@@ -0,0 +1,14 @@
++//
++// Copyright (c) 2014 The ANGLE Project Authors. All rights reserved.
++// Use of this source code is governed by a BSD-style license that can be
++// found in the LICENSE file.
++//
++// commit.h:
++//   This is a default commit hash header, when git is not available.
++//
++
++#define ANGLE_COMMIT_HASH "unknown hash"
++#define ANGLE_COMMIT_HASH_SIZE 12
++#define ANGLE_COMMIT_DATE "unknown date"
++
++#define ANGLE_DISABLE_PROGRAM_BINARY_LOAD
+diff --git a/src/commit_id.py b/src/commit_id.py
+index 6339cca..7f711e7 100644
+--- a/src/commit_id.py
++++ b/src/commit_id.py
+@@ -1,19 +1,35 @@
+ import subprocess as sp
+ import sys
++import os
+ 
+-def grab_output(*command):
+-    return sp.Popen(command, stdout=sp.PIPE).communicate()[0].strip()
++# Usage: commit_id.py check <angle_dir> (checks if git is present)
++# Usage: commit_id.py gen <angle_dir> <file_to_write> (generates commit id)
+ 
++def grab_output(command, cwd):
++    return sp.Popen(command, stdout=sp.PIPE, shell=True, cwd=cwd).communicate()[0].strip()
++
++operation = sys.argv[1]
++cwd = sys.argv[2]
++
++if operation == 'check':
++    index_path = os.path.join(cwd, '.git', 'index')
++    if os.path.exists(index_path):
++        print("1")
++    else:
++        print("0")
++    sys.exit(0)
++
++output_file = sys.argv[3]
+ commit_id_size = 12
+ 
+ try:
+-    commit_id = grab_output('git', 'rev-parse', '--short=%d' % commit_id_size, 'HEAD')
+-    commit_date = grab_output('git', 'show', '-s', '--format=%ci', 'HEAD')
++    commit_id = grab_output('git rev-parse --short=%d HEAD' % commit_id_size, cwd)
++    commit_date = grab_output('git show -s --format=%ci HEAD', cwd)
+ except:
+     commit_id = 'invalid-hash'
+     commit_date = 'invalid-date'
+ 
+-hfile = open(sys.argv[1], 'w')
++hfile = open(output_file, 'w')
+ 
+ hfile.write('#define ANGLE_COMMIT_HASH "%s"\n'    % commit_id)
+ hfile.write('#define ANGLE_COMMIT_HASH_SIZE %d\n' % commit_id_size)
+diff --git a/src/common/version.h b/src/common/version.h
+index b9781d7..d9148d1 100644
+--- a/src/common/version.h
++++ b/src/common/version.h
+@@ -1,4 +1,4 @@
+-#include "commit.h"
++#include "id/commit.h"
+ 
+ #define ANGLE_MAJOR_VERSION 2
+ #define ANGLE_MINOR_VERSION 1
+diff --git a/src/libGLESv2/ProgramBinary.cpp b/src/libGLESv2/ProgramBinary.cpp
+index 8525ffb..e3ffa47 100644
+--- a/src/libGLESv2/ProgramBinary.cpp
++++ b/src/libGLESv2/ProgramBinary.cpp
+@@ -1018,6 +1018,9 @@ bool ProgramBinary::linkVaryings(InfoLog &infoLog, FragmentShader *fragmentShade
+ 
+ bool ProgramBinary::load(InfoLog &infoLog, const void *binary, GLsizei length)
+ {
++#ifdef ANGLE_DISABLE_PROGRAM_BINARY_LOAD
++    return false;
++#else
+     BinaryInputStream stream(binary, length);
+ 
+     int format = stream.readInt<int>();
+@@ -1260,6 +1263,7 @@ bool ProgramBinary::load(InfoLog &infoLog, const void *binary, GLsizei length)
+     initializeUniformStorage();
+ 
+     return true;
++#endif // #ifdef ANGLE_DISABLE_PROGRAM_BINARY_LOAD
+ }
+ 
+ bool ProgramBinary::save(void* binary, GLsizei bufSize, GLsizei *length)
diff --git a/pkgs/applications/networking/browsers/chromium/source/default.nix b/pkgs/applications/networking/browsers/chromium/source/default.nix
index 2c7e7277b814..6a6b299ee511 100644
--- a/pkgs/applications/networking/browsers/chromium/source/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/source/default.nix
@@ -38,7 +38,8 @@ stdenv.mkDerivation {
       third_party/WebKit/Source/build/scripts/preprocessor.pm
   '' + optionalString useOpenSSL ''
     cat $opensslPatches | patch -p1 -d third_party/openssl/openssl
-  '' + optionalString (!versionOlder version "34.0.0.0") ''
+  '' + optionalString (!versionOlder version "37.0.0.0") ''
+    patch -p1 -d third_party/angle < "${./angle_build_37.patch}"
   '';
 
   outputs = [ "out" "sandbox" "bundled" "main" ];
diff --git a/pkgs/applications/networking/browsers/chromium/source/sandbox_userns_36.patch b/pkgs/applications/networking/browsers/chromium/source/sandbox_userns_36.patch
index 8338aa65482d..57f5992a3fa8 100644
--- a/pkgs/applications/networking/browsers/chromium/source/sandbox_userns_36.patch
+++ b/pkgs/applications/networking/browsers/chromium/source/sandbox_userns_36.patch
@@ -1,4 +1,4 @@
-commit c66c07a2ebcd1b68f412a5a2945fef15b3ba567c
+commit 0fec7e4a742f001c9816a8b58a1120fb44230867
 Author: aszlig <aszlig@redmoonstudios.org>
 Date:   Thu May 16 14:17:56 2013 +0200
 
@@ -47,7 +47,7 @@ index 9e39fba..00e4c79 100644
  
  #if defined(OS_CHROMEOS)
 diff --git a/base/process/launch_posix.cc b/base/process/launch_posix.cc
-index fe4da1a..7f118b8 100644
+index 457234f..a99ce9b 100644
 --- a/base/process/launch_posix.cc
 +++ b/base/process/launch_posix.cc
 @@ -40,6 +40,10 @@
@@ -111,7 +111,7 @@ index fe4da1a..7f118b8 100644
      // DANGER: fork() rule: in the child, if you don't end up doing exec*(),
      // you call _exit() instead of exit(). This is because _exit() does not
      // call any previously-registered (in the parent) exit handlers, which
-@@ -451,6 +480,40 @@ bool LaunchProcess(const std::vector<std::string>& argv,
+@@ -452,6 +481,40 @@ bool LaunchProcess(const std::vector<std::string>& argv,
      _exit(127);
    } else {
      // Parent process
@@ -153,10 +153,10 @@ index fe4da1a..7f118b8 100644
        // While this isn't strictly disk IO, waiting for another process to
        // finish is the sort of thing ThreadRestrictions is trying to prevent.
 diff --git a/content/browser/zygote_host/zygote_host_impl_linux.cc b/content/browser/zygote_host/zygote_host_impl_linux.cc
-index 94bdc16..3398615 100644
+index 9d63ad9..0885705 100644
 --- a/content/browser/zygote_host/zygote_host_impl_linux.cc
 +++ b/content/browser/zygote_host/zygote_host_impl_linux.cc
-@@ -143,6 +143,9 @@ void ZygoteHostImpl::Init(const std::string& sandbox_cmd) {
+@@ -144,6 +144,9 @@ void ZygoteHostImpl::Init(const std::string& sandbox_cmd) {
    // A non empty sandbox_cmd means we want a SUID sandbox.
    using_suid_sandbox_ = !sandbox_cmd.empty();
  
@@ -166,10 +166,10 @@ index 94bdc16..3398615 100644
    // Start up the sandbox host process and get the file descriptor for the
    // renderers to talk to it.
    const int sfd = RenderSandboxHostLinux::GetInstance()->GetRendererSocket();
-@@ -162,11 +165,24 @@ void ZygoteHostImpl::Init(const std::string& sandbox_cmd) {
-     dummy_fd.reset(socket(AF_UNIX, SOCK_DGRAM, 0));
-     CHECK_GE(dummy_fd.get(), 0);
-     fds_to_map.push_back(std::make_pair(dummy_fd.get(), kZygoteIdFd));
+@@ -156,11 +159,24 @@ void ZygoteHostImpl::Init(const std::string& sandbox_cmd) {
+     sandbox_client->PrependWrapper(&cmd_line);
+     sandbox_client->SetupLaunchOptions(&options, &fds_to_map, &dummy_fd);
+     sandbox_client->SetupLaunchEnvironment();
 +    userns_sandbox = sandbox_client->IsNoSuid();
    }
  
@@ -192,7 +192,7 @@ index 94bdc16..3398615 100644
    dummy_fd.reset();
  
 diff --git a/content/zygote/zygote_main_linux.cc b/content/zygote/zygote_main_linux.cc
-index cc28a6f..e8f665a 100644
+index 11f0602..b7b8214 100644
 --- a/content/zygote/zygote_main_linux.cc
 +++ b/content/zygote/zygote_main_linux.cc
 @@ -389,6 +389,13 @@ static bool EnterSuidSandbox(sandbox::SetuidSandboxClient* setuid_sandbox) {
@@ -210,10 +210,10 @@ index cc28a6f..e8f665a 100644
    // Previously, we required that the binary be non-readable. This causes the
    // kernel to mark the process as non-dumpable at startup. The thinking was
 diff --git a/sandbox/linux/suid/client/setuid_sandbox_client.cc b/sandbox/linux/suid/client/setuid_sandbox_client.cc
-index 3300cb4..4bfa516 100644
+index fc03cdd..a972faa 100644
 --- a/sandbox/linux/suid/client/setuid_sandbox_client.cc
 +++ b/sandbox/linux/suid/client/setuid_sandbox_client.cc
-@@ -212,6 +212,10 @@ bool SetuidSandboxClient::IsInNewNETNamespace() const {
+@@ -229,6 +229,10 @@ bool SetuidSandboxClient::IsInNewNETNamespace() const {
    return env_->HasVar(kSandboxNETNSEnvironmentVarName);
  }
  
@@ -224,7 +224,7 @@ index 3300cb4..4bfa516 100644
  bool SetuidSandboxClient::IsSandboxed() const {
    return sandboxed_;
  }
-@@ -267,8 +271,7 @@ void SetuidSandboxClient::PrependWrapper(base::CommandLine* cmd_line,
+@@ -277,8 +281,7 @@ void SetuidSandboxClient::PrependWrapper(base::CommandLine* cmd_line) {
                                      "LinuxSUIDSandboxDevelopment.";
    }
  
@@ -234,10 +234,10 @@ index 3300cb4..4bfa516 100644
      LOG(FATAL) << "The SUID sandbox helper binary was found, but is not "
                    "configured correctly. Rather than run without sandboxing "
                    "I'm aborting now. You need to make sure that "
-@@ -284,6 +287,12 @@ void SetuidSandboxClient::PrependWrapper(base::CommandLine* cmd_line,
-     options->allow_new_privs = true;
-     UnsetExpectedEnvironmentVariables(&options->environ);
+@@ -286,6 +289,12 @@ void SetuidSandboxClient::PrependWrapper(base::CommandLine* cmd_line) {
    }
+ 
+   cmd_line->PrependWrapper(sandbox_binary);
 +
 +  if (!((st.st_uid == 0) &&
 +        (st.st_mode & S_ISUID) &&
@@ -246,12 +246,12 @@ index 3300cb4..4bfa516 100644
 +  }
  }
  
- void SetuidSandboxClient::SetupLaunchEnvironment() {
+ void SetuidSandboxClient::SetupLaunchOptions(
 diff --git a/sandbox/linux/suid/client/setuid_sandbox_client.h b/sandbox/linux/suid/client/setuid_sandbox_client.h
-index 332c63b..4f603f8 100644
+index 2bbad7a..8605475 100644
 --- a/sandbox/linux/suid/client/setuid_sandbox_client.h
 +++ b/sandbox/linux/suid/client/setuid_sandbox_client.h
-@@ -70,6 +70,8 @@ class SANDBOX_EXPORT SetuidSandboxClient {
+@@ -66,6 +66,8 @@ class SANDBOX_EXPORT SetuidSandboxClient {
    bool IsInNewPIDNamespace() const;
    // Did the setuid helper create a new network namespace ?
    bool IsInNewNETNamespace() const;
diff --git a/pkgs/applications/networking/browsers/chromium/source/sources.nix b/pkgs/applications/networking/browsers/chromium/source/sources.nix
index bd5ded3f4c63..1905311c824c 100644
--- a/pkgs/applications/networking/browsers/chromium/source/sources.nix
+++ b/pkgs/applications/networking/browsers/chromium/source/sources.nix
@@ -1,21 +1,21 @@
 # This file is autogenerated from update.sh in the parent directory.
 {
   dev = {
-    version = "36.0.1964.2";
-    sha256 = "0yrp1553pl0310h5pkfh2x27xhfrrxrpc25zad36f3k73iwmbg4c";
-    sha256bin32 = "02brz6lj7vfyyapc942dhdw7z26ksvnm7xqryfxn49y1rkd26xrf";
-    sha256bin64 = "0ibry2bfjcqnihwb8ykyl48qk25bzfxmw948sm70xnrmwbkv42ny";
+    version = "37.0.2054.3";
+    sha256 = "1sly1fb9wh10m36crikahn7wgsq7j090jaga4l8zk4kihzprcnj2";
+    sha256bin32 = "0242ypzgzskkmsw3iyirxzlm1gbng94lv723ffcr018grq9yg4gs";
+    sha256bin64 = "17kzb7k0vn96wa6a4xfx05885li1qjg8bp6y3ngs2i0wws9ypfd9";
   };
   beta = {
-    version = "35.0.1916.86";
-    sha256 = "0pjgpif8fiq14fk05pxs3js0pcg2jwmw0fklcci11rzq6rcm7r2g";
-    sha256bin32 = "1js71l88hqfli6c342iigwddxrqrzlx5fcazfxwlps4bdwgig6f8";
-    sha256bin64 = "1sqavz6lh0ryf8jlw8jcfwk265spxs70bhigcgcqsd6647fbdqsr";
+    version = "36.0.1985.67";
+    sha256 = "11gp21j96zr93g2bicwsq335zj83rx6jz44439cn3msgfqdfm3hp";
+    sha256bin32 = "1ndllz5y4d37xjc004rdby8viif300qskpxfz4bb26z681frh6d1";
+    sha256bin64 = "0yy6qr9ykd52qxxbx4kv1cmqmlw4hppah8s4lnw4lnd55xj9xb8q";
   };
   stable = {
-    version = "35.0.1916.114";
-    sha256 = "1bvpkwjchkzx1qfc93hd8md6sz5sd7pl55xc8b8m3iakbp0csvsn";
-    sha256bin32 = "0zm5770cv9dld37xall9lpl9faa0bgjcp8hjx6l1ivfhs6lxbxxa";
-    sha256bin64 = "18p302aj2d7xdza9kf438vbz3wqh8db7v2dq5d9b4b3ak6w9ld03";
+    version = "35.0.1916.153";
+    sha256 = "03p7wmlvbrgd8m94344z4azkhrffwrr5c76dm8c4jcxs0x1yn318";
+    sha256bin32 = "0xm34xwdai8ns6bkq5dshh4izls70rwgvya23md4vxq6iv78sykn";
+    sha256bin64 = "1x2cm1i8v8d69856b42anms33clv63adzpqy58in6i9vba13swif";
   };
 }