linux: make the seccomp sandbox work again

linux: make the seccomp sandbox work again

We were hitting a stack overflow on renderer startup, because of the following:
When we patch out syscalls, we need a scratch space near (within a 32-bit jump)
of the original code.  We pick the scratch space as the end of the nearest empty
region available before the code we're patching.  For the vdso region, the
stack lies directly before it and so the region we'd grab was directly before
the stack.  This meant that as soon as the stack attempted to grow it'd fail
because it ran into our patch region, and we'd hit a stack overflow.

The fix is to specially note when we're near the stack region, and instead put
our scratch space as far away from the stack as possible.

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=35759

[Evan Martin, 2010-01-08 00:33:39]

In particular, please check that I'm not misunderstanding anything!

[Markus (顧孟勤), 2010-01-08 00:55:18]

LGTM