[rpms/chromium] epel9-next: - Update to 138.0.7204.157

[Than Ngo <than@redhat.com>]

          A new commit has been pushed.

          Repo   : rpms/chromium
          Branch : epel9-next
          Commit : f3139ecb557b81a10db2ebd2371f47226689561b
          Author : Than Ngo <than@redhat.com>
          Date   : 2025-07-16T11:50:20+02:00
          Stats  : +32/-20 in 4 file(s)
          URL    : https://src.fedoraproject.org/rpms/chromium/c/f3139ecb557b81a10db2ebd2371f47226689561b?branch=epel9-next

          Log:
          - Update to 138.0.7204.157
* CVE-2025-7656: Integer overflow in V8
* CVE-2025-7657: Use after free in WebRTC
* CVE-2025-6558: Incorrect validation of untrusted input in ANGLE and GPU

---
diff --git a/chromium.spec b/chromium.spec
index 0d2420c..f0189e0 100644
--- a/chromium.spec
+++ b/chromium.spec
@@ -244,8 +244,8 @@
 %endif
 
 Name:	chromium
-Version: 138.0.7204.100
-Release: 2%{?dist}
+Version: 138.0.7204.157
+Release: 1%{?dist}
 Summary: A WebKit (Blink) powered web browser that Google doesn't want you to use
 Url: http://www.chromium.org/Home
 License: BSD-3-Clause AND LGPL-2.1-or-later AND Apache-2.0 AND IJG AND MIT AND GPL-2.0-or-later AND ISC AND OpenSSL AND (MPL-1.1 OR GPL-2.0-only OR LGPL-2.0-only)
@@ -415,7 +415,7 @@ Patch406: fix-different-data-layouts.patch
 Patch407: 0002-Add-ppc64-trap-instructions.patch
 
 Patch408: fix-ppc64-linux-syscalls-headers.patch
-Patch409: use-sysconf-page-size-on-ppc64.patch
+Patch409: fix-page-allocator-overflow.patch
 Patch410: 0001-Enable-ppc64-pointer-compression.patch
 
 Patch411: dawn-fix-ppc64le-detection.patch
@@ -1741,6 +1741,12 @@ fi
 %endif
 
 %changelog
+* Wed Jul 16 2025 Than Ngo <than@redhat.com> - 138.0.7204.157-1
+- Update to 138.0.7204.157
+  * CVE-2025-7656: Integer overflow in V8
+  * CVE-2025-7657: Use after free in WebRTC
+  * CVE-2025-6558: Incorrect validation of untrusted input in ANGLE and GPU
+
 * Fri Jul 11 2025 Tom Stellard <tstellar@redhat.com> -138.0.7204.100-2
 - Update rust-clanglib patch for clang 21
 

diff --git a/fix-page-allocator-overflow.patch b/fix-page-allocator-overflow.patch
new file mode 100644
index 0000000..85edd60
--- /dev/null
+++ b/fix-page-allocator-overflow.patch
@@ -0,0 +1,22 @@
+--- a/base/allocator/dispatcher/tls.h
++++ b/base/allocator/dispatcher/tls.h
+@@ -83,6 +83,8 @@
+   constexpr static size_t AllocationChunkSize = 16384;
+ #elif BUILDFLAG(IS_LINUX) && defined(ARCH_CPU_ARM64)
+   constexpr static size_t AllocationChunkSize = 16384;
++#elif BUILDFLAG(IS_LINUX) && defined(ARCH_CPU_PPC64)
++  constexpr static size_t AllocationChunkSize = 16384;
+ #else
+   constexpr static size_t AllocationChunkSize = 4096;
+ #endif
+--- a/base/allocator/partition_allocator/src/partition_alloc/partition_alloc_constants.h
++++ b/base/allocator/partition_allocator/src/partition_alloc/partition_alloc_constants.h
+@@ -392,7 +400,7 @@
+ // TODO(casey.smalley@arm.com): under 64k pages we can end up in a situation
+ // where a normal slot span will be large enough to contain multiple items,
+ // but the address will go over the final partition page after being aligned.
+-#if PA_BUILDFLAG(IS_LINUX) && PA_BUILDFLAG(PA_ARCH_CPU_ARM64)
++#if PA_BUILDFLAG(IS_LINUX) && (PA_BUILDFLAG(PA_ARCH_CPU_ARM64) || PA_BUILDFLAG(PA_ARCH_CPU_PPC64))
+ constexpr size_t kMaxSupportedAlignment = kSuperPageSize / 4;
+ #else
+ constexpr size_t kMaxSupportedAlignment = kSuperPageSize / 2;

diff --git a/sources b/sources
index ae4b866..1332c42 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 SHA512 (node-v22.14.0-stripped.tar.gz) = affddb541009c6d378049c2d7845b981335d9e7aa387efcc472e5efb621c345cd58ca69778a394f7e4ebbb5e4b1a115a389838ef1b6458ef5e98f2071b166e15
-SHA512 (chromium-138.0.7204.100-clean.tar.xz) = c5381b42dbfa87e2390a64a1ef8699f444edbefd8b79b8ce98eeb340d891cf243e2efa8718810fdf6e1cc04e1dff788bd6285d51a78e4bd46bb6047afa664f22
+SHA512 (chromium-138.0.7204.157-clean.tar.xz) = 5351130d8395a661376eebc27835ff8169c3a5aaefc003fd43b4262c1307f0313ba1c4d3c67465119356951797ec09fa902cbf61681a43d4b6403d213f135d5d

diff --git a/use-sysconf-page-size-on-ppc64.patch b/use-sysconf-page-size-on-ppc64.patch
deleted file mode 100644
index 838bff5..0000000
--- a/use-sysconf-page-size-on-ppc64.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-Index: chromium-128.0.6613.113/base/allocator/partition_allocator/src/partition_alloc/page_allocator_constants.h
-===================================================================
---- chromium-128.0.6613.113.orig/base/allocator/partition_allocator/src/partition_alloc/page_allocator_constants.h
-+++ chromium-128.0.6613.113/base/allocator/partition_allocator/src/partition_alloc/page_allocator_constants.h
-@@ -187,7 +187,11 @@ SystemPageBaseMask() {
-   return ~SystemPageOffsetMask();
- }
- 
-+#if PA_BUILDFLAG(PA_ARCH_CPU_PPC64_FAMILY)
-+constexpr size_t kPageMetadataShift = 6;  // 64 bytes per partition page.
-+#else
- constexpr size_t kPageMetadataShift = 5;  // 32 bytes per partition page.
-+#endif
- constexpr size_t kPageMetadataSize = 1 << kPageMetadataShift;
- 
- }  // namespace internal