build: dual-version build tooling + broad-CPU baseline

build-version.sh builds a specific Chromium version into its own tree/out so
149 (stable) and 151 (latest) coexist without clobbering; versions.txt pins
the supported versions and their stealth roles.

args.gn: pin the tree to the SSE4.2 (x86-64-v2) baseline (-mno-avx/avx2/bmi/
lzcnt/fma...). Chromium 151's clang auto-vectorizes some baseline paths with
post-Haswell instructions that trip a PA_CHECK at static init on pre-2013 CPUs
(issue #20); stock Chrome runs there, so we match it.

Author: arham766

build/args.gn

@@ -31,4 +31,16 @@ enable_widevine = false
 target_cpu = "x64"
 target_os = "linux"
 
+# Broad-CPU compatibility (issue #20). Chromium 151's bundled clang auto-vectorizes
+# some baseline paths (e.g. PartitionAlloc's bucket-index lookup) with post-Haswell
+# instructions — LZCNT/TZCNT (BMI/ABM), AVX2, FMA. On pre-2013 CPUs that lack them
+# (e.g. Intel Sandy Bridge / Xeon E5-2600 v1) LZCNT/TZCNT silently decode as BSR/BSF
+# with different zero-input semantics, corrupting a bucket index and tripping a
+# PA_CHECK at static-init -> SIGTRAP before main() (no runtime flag can intervene).
+# Stock Chrome runs on these CPUs, so we pin the whole tree back to the SSE4.2 (x86-64-v2)
+# baseline. Keeps SSE4.2/POPCNT; drops AVX/AVX2/BMI/FMA. Costs ~nothing in practice and
+# restores compatibility down to ~Nehalem-era hardware.
+extra_cflags = "-mno-avx -mno-avx2 -mno-bmi -mno-bmi2 -mno-lzcnt -mno-fma -mno-f16c -mno-movbe"
+extra_cxxflags = "-mno-avx -mno-avx2 -mno-bmi -mno-bmi2 -mno-lzcnt -mno-fma -mno-f16c -mno-movbe"
+
 # ThinLTO is on by default for official builds; left implicit.

build/build-version.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Build a specific Chromium version of Fortress into its OWN tree/out/bundle, so multiple
+# versions (e.g. 149 stable + 151 latest) coexist without clobbering each other.
+#
+# Usage:  build/build-version.sh <chromium-version> [platform]
+#   e.g.  build/build-version.sh 149.0.7827.200 linux-x64
+#         build/build-version.sh 151.0.7908.0   linux-x64
+#
+# Each version gets its own workdir  .fortress-build-<major>/  (each needs ~100GB + hours).
+# The patch series is 3-way applied; if a patch fails on an older/newer tree, re-anchor it
+# (see DUAL_VERSION_BUILD.md) and re-run.
+set -euo pipefail
+REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+VER="${1:?usage: build-version.sh <chromium-version> [platform]}"
+PLATFORM="${2:-linux-x64}"
+MAJOR="${VER%%.*}"
+WORK="$REPO/.fortress-build-$MAJOR"
+
+echo "==> Fortress $MAJOR | Chromium $VER | workdir $WORK"
+
+# Build the versioned tree (build.sh reads CHROMIUM_VERSION from the env).
+CHROMIUM_VERSION="$VER" "$REPO/build/build.sh" "$WORK"
+
+# Bundle with a VERSION-TAGGED asset name so both majors can ship in one release:
+#   tilion-fortress-<major>-<platform>.tar.gz
+DEST="$WORK/dist"
+"$REPO/packaging/build-bundle.sh" "$WORK/chromium/src/out/Fortress" "$REPO/fonts" "$DEST" "$MAJOR-$PLATFORM"
+
+echo "==> built: $WORK/chromium/src/out/Fortress/chrome"
+echo "==> bundle: $DEST/tilion-fortress-$MAJOR-$PLATFORM.tar.gz"
+echo "==> verify:  python3 $REPO/tools/gauntlet.py --bundle $DEST/tilion-fortress"

build/versions.txt

@@ -0,0 +1,12 @@
+# Fortress supported Chromium versions (build with build/build-version.sh <version>).
+# Pin the EXACT current stable patch from https://chromiumdash.appspot.com/releases before a build.
+#
+# major  version           channel   role
+149      149.0.7827.200     stable    RECOMMENDED default — matches the mass of real users (stealth)
+151      151.0.7908.0       ahead     newest features; note: ahead-of-stable trips some UA checks
+#
+# Notes:
+#  - 149 is current/near-stable and where most real Chrome users sit (staged rollout + enterprise
+#    lag), so it is the better stealth default per the version-realism research.
+#  - 151 stays available for anyone who wants the newest engine, but reports a version ahead of
+#    stable (a soft tell on rebrowser). Ship both; default installers/SDK to 149.