anchor.diff:      use_system_stlport = true;
       use_system_xdg_utils = true;
       use_system_yasm = true;
  -    use_system_zlib = true;
  +    use_system_zlib = false; # http://crbug.com/143623
   
       use_system_harfbuzz = false;
       use_system_icu = false;
  -    use_system_libwebp = false; # See chromium issue #133161
  +    use_system_libwebp = false; # http://crbug.com/133161
       use_system_skia = false;
  -    use_system_sqlite = false; # See chromium issue #22208
  +    use_system_sqlite = false; # http://crbug.com/22208
       use_system_v8 = false;
     };
   
  
positive.code:   seccompPatch = let
      pre22 = versionOlder sourceInfo.version "22.0.0.0";
    in if pre22 then ./enable_seccomp.patch else ./enable_seccomp22.patch;
  
    # XXX: this reverts r151720 to prevent http://crbug.com/143623
    maybeRevertZlibChanges = let
      below22_91 = versionOlder sourceInfo.version "22.0.1229.91";
      patch = fetchurl {
        name = "revert-r151720";
        url = "http://git.chromium.org/gitweb/?p=chromium.git;a=commitdiff_plain;"
            + "hp=4419ec6414b33b6b19bb2e380b4998ed5193ecab;"
            + "h=0fabb4fda7059a8757422e8a44e70deeab28e698";
        sha256 = "0n0d6mkg89g8q63cifapzpg9dxfs2n6xvk4k13szhymvf67b77pf";
      };
    in optional (below22_91) patch;
  
  in stdenv.mkDerivation rec {
    name = "${packageName}-${version}";
  
negative.code: 
    patches = optional (!cfg.selinux) seccompPatch
           ++ optional cfg.cups ./cups_allow_deprecated.patch
           ++ optional cfg.pulseaudio ./pulseaudio_array_bounds.patch;
  
    postPatch = optionalString cfg.openssl ''
      cat $opensslPatches | patch -p1 -d third_party/openssl/openssl
  