diff -r a9cd24eaa361 -r 7fa561e5d7c7 mozilla-fix-top-level-asm.patch
--- a/mozilla-fix-top-level-asm.patch	Sat Mar 07 09:48:10 2020 +0100
+++ b/mozilla-fix-top-level-asm.patch	Mon Mar 30 21:49:01 2020 +0200
@@ -8,10 +8,14 @@
  1 file changed, 4 insertions(+), 1 deletion(-)
 
 diff --git a/security/sandbox/linux/moz.build b/security/sandbox/linux/moz.build
-index aae85843e9f6..208368dfd189 100644
 --- a/security/sandbox/linux/moz.build
 +++ b/security/sandbox/linux/moz.build
-@@ -61,7 +61,6 @@ UNIFIED_SOURCES += [
+@@ -56,32 +56,32 @@ UNIFIED_SOURCES += [
+     '../chromium/base/time/time_now_posix.cc',
+     '../chromium/sandbox/linux/bpf_dsl/bpf_dsl.cc',
+     '../chromium/sandbox/linux/bpf_dsl/codegen.cc',
+     '../chromium/sandbox/linux/bpf_dsl/dump_bpf.cc',
+     '../chromium/sandbox/linux/bpf_dsl/policy.cc',
      '../chromium/sandbox/linux/bpf_dsl/policy_compiler.cc',
      '../chromium/sandbox/linux/bpf_dsl/syscall_set.cc',
      '../chromium/sandbox/linux/seccomp-bpf/die.cc',
@@ -19,7 +23,15 @@
      'broker/SandboxBrokerCommon.cpp',
      'Sandbox.cpp',
      'SandboxBrokerClient.cpp',
-@@ -77,6 +76,7 @@ UNIFIED_SOURCES += [
+     'SandboxFilter.cpp',
+     'SandboxFilterUtil.cpp',
+     'SandboxHooks.cpp',
+     'SandboxInfo.cpp',
+     'SandboxLogging.cpp',
+     'SandboxOpenedFiles.cpp',
+     'SandboxReporterClient.cpp',
+ ]
+ 
  SOURCES += [
      '../chromium/base/strings/safe_sprintf.cc',
      '../chromium/base/third_party/icu/icu_utf.cc',
@@ -27,7 +39,17 @@
      '../chromium/sandbox/linux/seccomp-bpf/trap.cc',
      '../chromium/sandbox/linux/services/syscall_wrappers.cc',
  ]
-@@ -96,6 +96,9 @@ if CONFIG['CC_TYPE'] in ('clang', 'gcc'):
+ 
+ # This copy of SafeSPrintf doesn't need to avoid the Chromium logging
+ # dependency like the one in libxul does, but this way the behavior is
+ # consistent.  See also the comment in SandboxLogging.h.
+ SOURCES['../chromium/base/strings/safe_sprintf.cc'].flags += ['-DNDEBUG']
+@@ -91,16 +91,19 @@ if CONFIG['CC_TYPE'] in ('clang', 'gcc')
+     SOURCES['../chromium/base/third_party/icu/icu_utf.cc'].flags += ['-Wno-implicit-fallthrough']
+     SOURCES['../chromium/sandbox/linux/seccomp-bpf/trap.cc'].flags += ['-Wno-unreachable-code-return']
+ 
+ if CONFIG['CC_TYPE'] in ('clang', 'gcc'):
+     CXXFLAGS += ['-Wno-shadow']
      SOURCES['../chromium/sandbox/linux/services/syscall_wrappers.cc'].flags += [
          '-Wno-empty-body',
      ]
@@ -37,6 +59,8 @@
  
  # gcc lto likes to put the top level asm in syscall.cc in a different partition
  # from the function using it which breaks the build.  Work around that by
--- 
-2.23.0
-
+ # forcing there to be only one partition.
+ for f in CONFIG['OS_CXXFLAGS']:
+     if f.startswith('-flto') and CONFIG['CC_TYPE'] != 'clang':
+         LDFLAGS += ['--param lto-partitions=1']
+