Plumb executable flag through proxy to base::SharedMemory::Create.

content/public/common/child_process_sandbox_support_linux.h

Index: content/public/common/child_process_sandbox_support_linux.h
diff --git a/content/public/common/child_process_sandbox_support_linux.h b/content/public/common/child_process_sandbox_support_linux.h
index c373ba45e709dc546538cc985e5046fb6f2100cf..5ac0f8238156a711aa452cb7bc59be4a6cec8425 100644
--- a/content/public/common/child_process_sandbox_support_linux.h
+++ b/content/public/common/child_process_sandbox_support_linux.h
@@ -13,9 +13,13 @@
 
 namespace content {
 
-// Returns a file descriptor for a shared memory segment.
-// The second argument is ignored because SHM segments are always
-// mappable with PROT_EXEC on Linux.
+// Returns a file descriptor for a shared memory segment.  The
+// executable flag indicates that the caller intends to use mprotect
+// with PROT_EXEC after making a mapping, but not that it intends to
+// mmap with PROT_EXEC in the first place.  (Some systems, such as
+// ChromeOS, disallow PROT_EXEC in mmap on /dev/shm files but do allow
+// PROT_EXEC in mprotect on mappings from such files.  This function
+// can yield an object that has that constraint.)
 CONTENT_EXPORT int MakeSharedMemorySegmentViaIPC(size_t length,
                                                  bool executable);