Merge pull request #15762 (Chromium update)

This is the original pull request plus some commits from me to bring all
channels to the latest versions, because the fixed security
vulnerabilites might not be fixed in the dev version we had before.

I've tested the whole changeset on my Hydra at:

https://headcounter.org/hydra/eval/322006

Thanks to @srp for the initial commit and thus implicitly also for the
security notice.

Cc: @abbradar
(backported from commit b5f95a5303a4bf20b513c2a4f636b82cb588239a)
Reason: Lots of security fixes (see e2d067d)

pkgs/applications/networking/browsers/chromium/common.nix

···
     use_system_flac = true;
     use_system_libevent = true;
     use_system_libexpat = true;
-    use_system_libjpeg = true;
-    use_system_libpng = versionOlder upstream-info.version "51.0.0.0";
+    # XXX: System libjpeg fails to link for version 52.0.2743.10
+    use_system_libjpeg = upstream-info.version != "52.0.2743.10";
+    use_system_libpng = false;
     use_system_libwebp = true;
     use_system_libxml = true;
     use_system_opus = true;
···
       ++ optionals gnomeSupport [ gnome.GConf libgcrypt ]
       ++ optional enableSELinux libselinux
       ++ optionals cupsSupport [ libgcrypt cups ]
-      ++ optional pulseSupport libpulseaudio
-      ++ optional (versionOlder version "51.0.0.0") libexif;
+      ++ optional pulseSupport libpulseaudio;
 
     patches = [
-      ./patches/build_fixes_46.patch
       ./patches/widevine.patch
-      (if versionOlder version "50.0.0.0"
-       then ./patches/nix_plugin_paths_46.patch
-       else ./patches/nix_plugin_paths_50.patch)
+      (if versionOlder version "52.0.0.0"
+       then ./patches/nix_plugin_paths_50.patch
+       else ./patches/nix_plugin_paths_52.patch)
     ];
 
     postPatch = ''
···
         -e "/python_arch/s/: *'[^']*'/: '""'/" \
         build/common.gypi chrome/chrome_tests.gypi
 
-      ${optionalString (versionOlder version "51.0.0.0") ''
-        sed -i -e '/module_path *=.*libexif.so/ {
-          s|= [^;]*|= base::FilePath().AppendASCII("${libexif}/lib/libexif.so")|
-        }' chrome/utility/media_galleries/image_metadata_extractor.cc
-      ''}
-
       sed -i -e '/lib_loader.*Load/s!"\(libudev\.so\)!"${udev}/lib/\1!' \
         device/udev_linux/udev?_loader.cc
 
       sed -i -e '/libpci_loader.*Load/s!"\(libpci\.so\)!"${pciutils}/lib/\1!' \
         gpu/config/gpu_info_collector_linux.cc
-    '' + optionalString (!versionOlder version "51.0.0.0") ''
+
       sed -i -re 's/([^:])\<(isnan *\()/\1std::\2/g' \
         chrome/browser/ui/webui/engagement/site_engagement_ui.cc
+    '' + optionalString (versionAtLeast version "52.0.0.0") ''
+      sed -i -re 's/([^:])\<(isnan *\()/\1std::\2/g' \
+        third_party/pdfium/xfa/fxbarcode/utils.h
     '';
 
     gypFlags = mkGypFlags (gypFlagsUseSystemLibs // {
···
       google_api_key = "AIzaSyDGi15Zwl11UNe6Y-5XW_upsfyw31qwZPI";
       google_default_client_id = "404761575300.apps.googleusercontent.com";
       google_default_client_secret = "9rIFQjfnkykEmqb6FfjJQD1D";
-
-    } // optionalAttrs (versionOlder version "51.0.0.0") {
-      use_system_libexif = true;
     } // optionalAttrs proprietaryCodecs {
       # enable support for the H.264 codec
       proprietary_codecs = true;

pkgs/applications/networking/browsers/chromium/patches/build_fixes_46.patch

···
-diff --git a/chrome/test/data/webui_test_resources.grd b/chrome/test/data/webui_test_resources.grd
-index 6f8530d..f92a76a 100644
---- a/chrome/test/data/webui_test_resources.grd
-+++ b/chrome/test/data/webui_test_resources.grd
-@@ -6,9 +6,4 @@
-     </output>
-     <output filename="webui_test_resources.pak" type="data_package" />
-   </outputs>
--  <release seq="1">
--    <includes>
--      <include name="IDR_WEBUI_TEST_I18N_PROCESS_CSS_TEST" file="webui/i18n_process_css_test.html" flattenhtml="true" allowexternalscript="true" type="BINDATA" />
--    </includes>
--  </release>
- </grit>

pkgs/applications/networking/browsers/chromium/patches/nix_plugin_paths_46.patch pkgs/applications/networking/browsers/chromium/patches/nix_plugin_paths_52.patch

···
 diff --git a/chrome/common/chrome_paths.cc b/chrome/common/chrome_paths.cc
-index 74bf041..5f34198 100644
+index f4e119d..d9775bd 100644
 --- a/chrome/common/chrome_paths.cc
 +++ b/chrome/common/chrome_paths.cc
-@@ -66,21 +66,14 @@ static base::LazyInstance<base::FilePath>
+@@ -68,21 +68,14 @@ static base::LazyInstance<base::FilePath>
      g_invalid_specified_user_data_dir = LAZY_INSTANCE_INITIALIZER;
  
  // Gets the path for internal plugins.
 -bool GetInternalPluginsDirectory(base::FilePath* result) {
--#if defined(OS_MACOSX) && !defined(OS_IOS)
+-#if defined(OS_MACOSX)
 -  // If called from Chrome, get internal plugins from a subdirectory of the
 -  // framework.
 -  if (base::mac::AmIBundled()) {
···
 +      *result = base::FilePath(value);
  }
  
- #if defined(OS_WIN)
-@@ -253,11 +246,11 @@ bool PathProvider(int key, base::FilePath* result) {
+ // Gets the path for bundled implementations of components. Note that these
+@@ -272,7 +265,7 @@ bool PathProvider(int key, base::FilePath* result) {
        create_dir = true;
        break;
      case chrome::DIR_INTERNAL_PLUGINS:
 -      if (!GetInternalPluginsDirectory(&cur))
 +      if (!GetInternalPluginsDirectory(&cur, "ALL"))
+         return false;
+       break;
+     case chrome::DIR_COMPONENTS:
+@@ -280,7 +273,7 @@ bool PathProvider(int key, base::FilePath* result) {
          return false;
        break;
      case chrome::DIR_PEPPER_FLASH_PLUGIN:
···
          return false;
        cur = cur.Append(kPepperFlashBaseDirectory);
        break;
-@@ -314,7 +307,7 @@ bool PathProvider(int key, base::FilePath* result) {
+@@ -323,7 +316,7 @@ bool PathProvider(int key, base::FilePath* result) {
      // We currently need a path here to look up whether the plugin is disabled
      // and what its permissions are.
      case chrome::FILE_NACL_PLUGIN:
···
          return false;
        cur = cur.Append(kInternalNaClPluginFileName);
        break;
-@@ -349,7 +342,7 @@ bool PathProvider(int key, base::FilePath* result) {
+@@ -358,7 +351,7 @@ bool PathProvider(int key, base::FilePath* result) {
          cur = cur.DirName();
        }
  #else
···
          return false;
  #endif
        cur = cur.Append(FILE_PATH_LITERAL("pnacl"));
-@@ -366,7 +359,7 @@ bool PathProvider(int key, base::FilePath* result) {
-     // In the component case, this is the source adapter. Otherwise, it is the
-     // actual Pepper module that gets loaded.
-     case chrome::FILE_WIDEVINE_CDM_ADAPTER:
--      if (!GetInternalPluginsDirectory(&cur))
-+      if (!GetInternalPluginsDirectory(&cur, "WIDEVINE"))
-         return false;
-       cur = cur.AppendASCII(kWidevineCdmAdapterFileName);
-       break;

pkgs/applications/networking/browsers/chromium/upstream-info.nix

···
 # This file is autogenerated from update.sh in the same directory.
 {
   beta = {
-    sha256 = "0l1434wqhi6c24qyb5ysg1wnd0s9l9i1k6kh6wr3s4acrsbb7p12";
-    sha256bin64 = "1ssw92l8zwj8x0zs5h6vxl7d7gj0lqb0x71vsazgd4d0p23nglb1";
-    version = "51.0.2704.47";
+    sha256 = "1sgfwh2b0aw6l5v4ggk7frcy306x3ygxk81p3h6zdy5s1rpf8hxj";
+    sha256bin64 = "14qj8l5dapha87ndyzcs3spaxp3s9sapcjcplkisbivis09a29cb";
+    version = "51.0.2704.63";
   };
   dev = {
-    sha256 = "0czp4p434yqr5rv3w2vypkyis13x8lc4xph8yh84r9big1ga6fqs";
-    sha256bin64 = "0hahamx9k14czswqdh8iwh69lsml0acca5kxvp2kw471g3s55n78";
-    version = "52.0.2729.3";
+    sha256 = "1bbwbn0svgr2pfkza8pdq61bjzlj50axdm5bqqxi51hab51fc9ww";
+    sha256bin64 = "1s02q72b84g9p5i7y1hh1c67qjb92934dqqwd7w6j0jz8ix71nzc";
+    version = "52.0.2743.10";
   };
   stable = {
-    sha256 = "1ijpbmn38znjjb3h8579x5gsclgjx122lvm0afv17gf2j3w5w4qj";
-    sha256bin64 = "17vqvxmy6llg7dpc3pxi0qhwpm9qc9rsq8lgknhwwygvkl8g14sb";
-    version = "50.0.2661.102";
+    sha256 = "1sgfwh2b0aw6l5v4ggk7frcy306x3ygxk81p3h6zdy5s1rpf8hxj";
+    sha256bin64 = "1kjnxxf2ak8v1akzxz46r7a7r6bhxjb2y9fhr1fqvks3m4jc5zqw";
+    version = "51.0.2704.63";
   };
 }