diff --git a/DEPS b/DEPS
index 96b0a5f..fb03bc3 100644
--- a/DEPS
+++ b/DEPS
@@ -145,11 +145,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': 'c711a8649301281c2faaa932fb80ea4d51fcf08b',
+  'skia_revision': 'fdd03910d6c635292d2083803c701704f5536f1f',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': 'b0db4f562fd85fd0f7a981e3d407b44cf41cae18',
+  'v8_revision': '33faa512cb633005dd8e13a91ca4fb12033ba376',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -157,7 +157,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling ANGLE
   # and whatever else without interference from each other.
-  'angle_revision': '369f9e5df60b349e3d7ad8693fc90ede86e609f5',
+  'angle_revision': '017c9d8ea78b0945f9034b91e85166f94a57dd9e',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling SwiftShader
   # and whatever else without interference from each other.
@@ -208,7 +208,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling catapult
   # and whatever else without interference from each other.
-  'catapult_revision': 'ec6ed57a688e94bbd5ad3d5929e6bcfe1af824ef',
+  'catapult_revision': '4f68ff26e4e9a74f1d227d98c9df781e868e4d5e',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libFuzzer
   # and whatever else without interference from each other.
@@ -280,7 +280,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
-  'dawn_revision': '574b951188bbfa23a144f05519f5fcc048b88fe2',
+  'dawn_revision': '54b4df706968359c8c5a332e06de3dc3d372e2c8',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
@@ -809,7 +809,7 @@
 
   # Build tools for Chrome OS. Note: This depends on third_party/pyelftools.
   'src/third_party/chromite': {
-      'url': Var('chromium_git') + '/chromiumos/chromite.git' + '@' + '3bd52c2334a004f6197204aa0a37acda2f0fb988',
+      'url': Var('chromium_git') + '/chromiumos/chromite.git' + '@' + '31899ec2ac049bf0f50f7513d44efac85910da02',
       'condition': 'checkout_linux',
   },
 
@@ -903,7 +903,7 @@
   },
 
   'src/third_party/glslang/src':
-    Var('chromium_git') + '/external/github.com/KhronosGroup/glslang.git' + '@' + 'eea340047eca2119516d79ad059ce33632ea366e',
+    Var('chromium_git') + '/external/github.com/KhronosGroup/glslang.git' + '@' + 'a0eb5efd2bad6f44a44774b884acb658f6e15229',
 
   'src/third_party/google_toolbox_for_mac/src': {
       'url': Var('chromium_git') + '/external/github.com/google/google-toolbox-for-mac.git' + '@' + Var('google_toolbox_for_mac_revision'),
@@ -1207,7 +1207,7 @@
   },
 
   'src/third_party/perfetto':
-    Var('android_git') + '/platform/external/perfetto.git' + '@' +  'f50c2ff2f70cce05fbff61d26f3d3133be590866',
+    Var('android_git') + '/platform/external/perfetto.git' + '@' +  'e52728367fa36746208b3b875007ef190873ab5a',
 
   'src/third_party/perl': {
       'url': Var('chromium_git') + '/chromium/deps/perl.git' + '@' + '6f3e5028eb65d0b4c5fdd792106ac4c84eee1eb3',
@@ -1375,7 +1375,7 @@
     Var('chromium_git') + '/external/khronosgroup/webgl.git' + '@' + 'abaae129d9a0c6e1e092067e0b105475df43352e',
 
   'src/third_party/webrtc':
-    Var('webrtc_git') + '/src.git' + '@' + '0c67c80ac3fd82352edaba1f014a3928727cf2b7',
+    Var('webrtc_git') + '/src.git' + '@' + '59bbd65561111fe25e8f0d481e64962598e7c87f',
 
   'src/third_party/xdg-utils': {
       'url': Var('chromium_git') + '/chromium/deps/xdg-utils.git' + '@' + 'd80274d5869b17b8c9067a1022e4416ee7ed5e0d',
@@ -1416,7 +1416,7 @@
     Var('chromium_git') + '/v8/v8.git' + '@' +  Var('v8_revision'),
 
   'src-internal': {
-    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@f0390f88f270e9eb2ced17a343902404abc3c0ad',
+    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@9873ee0de15a87fdf436169bc895ab5df3f509fb',
     'condition': 'checkout_src_internal',
   },
 
diff --git a/android_webview/browser/aw_feature_list.cc b/android_webview/browser/aw_feature_list.cc
index 928f0e64..21a18de3 100644
--- a/android_webview/browser/aw_feature_list.cc
+++ b/android_webview/browser/aw_feature_list.cc
@@ -42,6 +42,10 @@
 
 // Alphabetical:
 
+// Viz for WebView architecture.
+const base::Feature kVizForWebView{"VizForWebView",
+                                   base::FEATURE_DISABLED_BY_DEFAULT};
+
 // Enable brotli compression support in WebView.
 const base::Feature kWebViewBrotliSupport{"WebViewBrotliSupport",
                                           base::FEATURE_DISABLED_BY_DEFAULT};
diff --git a/android_webview/browser/aw_feature_list.h b/android_webview/browser/aw_feature_list.h
index a642e2a..7dcb60af 100644
--- a/android_webview/browser/aw_feature_list.h
+++ b/android_webview/browser/aw_feature_list.h
@@ -14,6 +14,7 @@
 // alongside the definition of their values in the .cc file.
 
 // Alphabetical:
+extern const base::Feature kVizForWebView;
 extern const base::Feature kWebViewBrotliSupport;
 extern const base::Feature kWebViewConnectionlessSafeBrowsing;
 extern const base::Feature kWebViewSniffMimeType;
diff --git a/android_webview/browser/gfx/DEPS b/android_webview/browser/gfx/DEPS
index 2f8f9a0..f1e883d 100644
--- a/android_webview/browser/gfx/DEPS
+++ b/android_webview/browser/gfx/DEPS
@@ -3,6 +3,7 @@
   "-android_webview/browser",
   "+android_webview/browser/gfx",
   "+android_webview/native_jni",
+  "+android_webview/browser/aw_feature_list.h",
   "+android_webview/common/aw_switches.h",
   "+android_webview/public/browser",
 ]
diff --git a/android_webview/browser/gfx/task_forwarding_sequence.cc b/android_webview/browser/gfx/task_forwarding_sequence.cc
index b1558fc..2b44ecf 100644
--- a/android_webview/browser/gfx/task_forwarding_sequence.cc
+++ b/android_webview/browser/gfx/task_forwarding_sequence.cc
@@ -50,7 +50,12 @@
 void TaskForwardingSequence::ScheduleOrRetainTask(
     base::OnceClosure task,
     std::vector<gpu::SyncToken> sync_token_fences) {
-  ScheduleTask(std::move(task), std::move(sync_token_fences));
+  uint32_t order_num = sync_point_order_data_->GenerateUnprocessedOrderNumber();
+  // Use a weak ptr because the task executor holds the tasks, and the
+  // sequence will be destroyed before the task executor.
+  task_queue_->ScheduleOrRetainTask(base::BindOnce(
+      &TaskForwardingSequence::RunTask, weak_ptr_factory_.GetWeakPtr(),
+      std::move(task), std::move(sync_token_fences), order_num));
 }
 
 // Should not be called because tasks aren't reposted to wait for sync tokens,
diff --git a/android_webview/browser/gfx/task_queue_web_view.cc b/android_webview/browser/gfx/task_queue_web_view.cc
index 49f38ae..a9e8994 100644
--- a/android_webview/browser/gfx/task_queue_web_view.cc
+++ b/android_webview/browser/gfx/task_queue_web_view.cc
@@ -4,58 +4,73 @@
 
 #include "android_webview/browser/gfx/task_queue_web_view.h"
 
+#include <memory>
+#include <utility>
+
+#include "android_webview/browser/aw_feature_list.h"
 #include "base/auto_reset.h"
 #include "base/bind.h"
-#include "base/lazy_instance.h"
+#include "base/containers/queue.h"
+#include "base/no_destructor.h"
+#include "base/synchronization/condition_variable.h"
+#include "base/synchronization/lock.h"
+#include "base/thread_annotations.h"
+#include "base/threading/thread_checker.h"
+#include "base/threading/thread_local.h"
 #include "base/trace_event/trace_event.h"
 
 namespace android_webview {
-base::LazyInstance<base::ThreadLocalBoolean>::DestructorAtExit
-    ScopedAllowGL::allow_gl;
 
-// static
-bool ScopedAllowGL::IsAllowed() {
-  return allow_gl.Get().Get();
+namespace {
+
+base::ThreadLocalBoolean* GetAllowGL() {
+  static base::NoDestructor<base::ThreadLocalBoolean> allow_gl;
+  return allow_gl.get();
 }
 
-ScopedAllowGL::ScopedAllowGL() {
-  DCHECK(!allow_gl.Get().Get());
-  allow_gl.Get().Set(true);
+// This task queue is used when the client and gpu service runs on the same
+// thread (render thread). It has some simple logic to avoid reentrancy; in most
+// cases calling schedule will actually run the task immediately.
+class TaskQueueSingleThread : public TaskQueueWebView {
+ public:
+  TaskQueueSingleThread();
+  ~TaskQueueSingleThread() override = default;
 
-  TaskQueueWebView* service = TaskQueueWebView::GetInstance();
-  DCHECK(service);
-}
+  // TaskQueueWebView overrides.
+  void ScheduleTask(base::OnceClosure task, bool out_of_order) override;
+  void ScheduleOrRetainTask(base::OnceClosure task) override;
+  void ScheduleIdleTask(base::OnceClosure task) override;
+  void ScheduleClientTask(base::OnceClosure task) override;
+  void RunAllTasks() override;
+  void InitializeVizThread(const scoped_refptr<base::SingleThreadTaskRunner>&
+                               viz_task_runner) override;
+  void ScheduleOnVizAndBlock(VizTask viz_task) override;
 
-ScopedAllowGL::~ScopedAllowGL() {
-  TaskQueueWebView* service = TaskQueueWebView::GetInstance();
-  DCHECK(service);
-  service->RunAllTasks();
-  allow_gl.Get().Set(false);
-}
+ private:
+  // Flush the idle queue until it is empty.
+  void PerformAllIdleWork();
+  void RunTasks();
 
-// static
-TaskQueueWebView* TaskQueueWebView::GetInstance() {
-  static TaskQueueWebView* task_queue =
-      TaskQueueWebView::CreateTaskQueueWebView();
-  return task_queue;
-}
+  // All access to task queue should happen on a single thread.
+  THREAD_CHECKER(task_queue_thread_checker_);
+  base::circular_deque<base::OnceClosure> tasks_;
+  base::queue<base::OnceClosure> idle_tasks_;
+  base::queue<base::OnceClosure> client_tasks_;
 
-// static
-TaskQueueWebView* TaskQueueWebView::CreateTaskQueueWebView() {
-  return new TaskQueueWebView();
-}
+  bool inside_run_tasks_ = false;
+  bool inside_run_idle_tasks_ = false;
 
-TaskQueueWebView::TaskQueueWebView() {
+  DISALLOW_COPY_AND_ASSIGN(TaskQueueSingleThread);
+};
+
+TaskQueueSingleThread::TaskQueueSingleThread() {
   DETACH_FROM_THREAD(task_queue_thread_checker_);
 }
 
-TaskQueueWebView::~TaskQueueWebView() {
-  DCHECK(tasks_.empty());
-}
-
-void TaskQueueWebView::ScheduleTask(base::OnceClosure task, bool out_of_order) {
+void TaskQueueSingleThread::ScheduleTask(base::OnceClosure task,
+                                         bool out_of_order) {
   DCHECK_CALLED_ON_VALID_THREAD(task_queue_thread_checker_);
-  LOG_IF(FATAL, !ScopedAllowGL::IsAllowed())
+  LOG_IF(FATAL, !GetAllowGL()->Get())
       << "ScheduleTask outside of ScopedAllowGL";
   if (out_of_order)
     tasks_.emplace_front(std::move(task));
@@ -64,20 +79,24 @@
   RunTasks();
 }
 
-void TaskQueueWebView::ScheduleIdleTask(base::OnceClosure task) {
-  LOG_IF(FATAL, !ScopedAllowGL::IsAllowed())
-      << "ScheduleDelayedWork outside of ScopedAllowGL";
-  DCHECK_CALLED_ON_VALID_THREAD(task_queue_thread_checker_);
-  idle_tasks_.push(std::make_pair(base::Time::Now(), std::move(task)));
+void TaskQueueSingleThread::ScheduleOrRetainTask(base::OnceClosure task) {
+  ScheduleTask(std::move(task), false);
 }
 
-void TaskQueueWebView::ScheduleClientTask(base::OnceClosure task) {
+void TaskQueueSingleThread::ScheduleIdleTask(base::OnceClosure task) {
+  LOG_IF(FATAL, !GetAllowGL()->Get())
+      << "ScheduleDelayedWork outside of ScopedAllowGL";
+  DCHECK_CALLED_ON_VALID_THREAD(task_queue_thread_checker_);
+  idle_tasks_.push(std::move(task));
+}
+
+void TaskQueueSingleThread::ScheduleClientTask(base::OnceClosure task) {
   DCHECK_CALLED_ON_VALID_THREAD(task_queue_thread_checker_);
   client_tasks_.emplace(std::move(task));
 }
 
-void TaskQueueWebView::RunTasks() {
-  TRACE_EVENT0("android_webview", "TaskQueueWebView::RunTasks");
+void TaskQueueSingleThread::RunTasks() {
+  TRACE_EVENT0("android_webview", "TaskQueueSingleThread::RunTasks");
   DCHECK_CALLED_ON_VALID_THREAD(task_queue_thread_checker_);
   if (inside_run_tasks_)
     return;
@@ -88,7 +107,7 @@
   }
 }
 
-void TaskQueueWebView::RunAllTasks() {
+void TaskQueueSingleThread::RunAllTasks() {
   DCHECK_CALLED_ON_VALID_THREAD(task_queue_thread_checker_);
   RunTasks();
   PerformAllIdleWork();
@@ -112,17 +131,208 @@
   }
 }
 
-void TaskQueueWebView::PerformAllIdleWork() {
-  TRACE_EVENT0("android_webview", "TaskQueuewebview::PerformAllIdleWork");
+void TaskQueueSingleThread::PerformAllIdleWork() {
+  TRACE_EVENT0("android_webview", "TaskQueueWebview::PerformAllIdleWork");
   DCHECK_CALLED_ON_VALID_THREAD(task_queue_thread_checker_);
   if (inside_run_idle_tasks_)
     return;
   base::AutoReset<bool> inside(&inside_run_idle_tasks_, true);
   while (idle_tasks_.size() > 0) {
-    base::OnceClosure task = std::move(idle_tasks_.front().second);
+    base::OnceClosure task = std::move(idle_tasks_.front());
     idle_tasks_.pop();
     std::move(task).Run();
   }
 }
 
+void TaskQueueSingleThread::InitializeVizThread(
+    const scoped_refptr<base::SingleThreadTaskRunner>& viz_task_runner) {
+  NOTREACHED();
+}
+
+void TaskQueueSingleThread::ScheduleOnVizAndBlock(VizTask viz_task) {
+  NOTREACHED();
+}
+
+// This class is used with kVizForWebView. The client is the single viz
+// thread and the gpu service runs on the render thread. Render thread is
+// allowed to block on the viz thread, but not the other way around. This
+// achieves viz scheduling tasks to gpu by first blocking render thread
+// on the viz thread so render thread is ready to receive and run tasks.
+//
+// This class does not implement methods only needed by command buffer.
+// It does not reply on ScopedAllowGL either.
+class TaskQueueViz : public TaskQueueWebView {
+ public:
+  TaskQueueViz();
+  ~TaskQueueViz() override;
+
+  // TaskQueueWebView overrides.
+  void ScheduleTask(base::OnceClosure task, bool out_of_order) override;
+  void ScheduleOrRetainTask(base::OnceClosure task) override;
+  void ScheduleIdleTask(base::OnceClosure task) override;
+  void ScheduleClientTask(base::OnceClosure task) override;
+  void RunAllTasks() override;
+  void InitializeVizThread(const scoped_refptr<base::SingleThreadTaskRunner>&
+                               viz_task_runner) override;
+  void ScheduleOnVizAndBlock(VizTask viz_task) override;
+
+ private:
+  void RunOnViz(VizTask viz_task);
+  void SignalDone();
+  void EmplaceTask(base::OnceClosure task);
+
+  scoped_refptr<base::SingleThreadTaskRunner> viz_task_runner_;
+
+  // Only accessed on viz thread.
+  bool allow_schedule_task_ = false;
+
+  base::Lock lock_;
+  base::ConditionVariable condvar_{&lock_};
+  bool done_ GUARDED_BY(lock_) = true;
+  base::circular_deque<base::OnceClosure> tasks_ GUARDED_BY(lock_);
+
+  DISALLOW_COPY_AND_ASSIGN(TaskQueueViz);
+};
+
+TaskQueueViz::TaskQueueViz() = default;
+TaskQueueViz::~TaskQueueViz() = default;
+
+void TaskQueueViz::ScheduleTask(base::OnceClosure task, bool out_of_order) {
+  TRACE_EVENT0("android_webview", "ScheduleTask");
+  DCHECK(viz_task_runner_->BelongsToCurrentThread());
+  DCHECK(allow_schedule_task_);
+  // |out_of_order| is not needed by TaskForwardingSequence. Not supporting
+  // it allows slightly more efficient swapping the task queue in
+  // ScheduleOnVizAndBlock .
+  DCHECK(!out_of_order);
+  EmplaceTask(std::move(task));
+}
+
+void TaskQueueViz::ScheduleOrRetainTask(base::OnceClosure task) {
+  DCHECK(viz_task_runner_->BelongsToCurrentThread());
+  // The two branches end up doing the exact same thing only because retain can
+  // use the same task queue. The code says the intention which is
+  // |ScheduleOrRetainTask| behaves the same as |ScheduleTask| if
+  // |allow_schedule_task_| is true.
+  // Sharing the queue makes it clear |ScheduleTask| and |ScheduleOrRetainTask|
+  // but however has a non-practical risk of live-locking the render thread.
+  if (allow_schedule_task_) {
+    ScheduleTask(std::move(task), false);
+    return;
+  }
+  EmplaceTask(std::move(task));
+}
+
+void TaskQueueViz::EmplaceTask(base::OnceClosure task) {
+  base::AutoLock lock(lock_);
+  tasks_.emplace_back(std::move(task));
+  condvar_.Signal();
+}
+
+void TaskQueueViz::ScheduleIdleTask(base::OnceClosure task) {
+  NOTREACHED();
+}
+
+void TaskQueueViz::ScheduleClientTask(base::OnceClosure task) {
+  DCHECK(viz_task_runner_);
+  viz_task_runner_->PostTask(FROM_HERE, std::move(task));
+}
+
+void TaskQueueViz::RunAllTasks() {
+  // Intentional no-op.
+}
+
+void TaskQueueViz::InitializeVizThread(
+    const scoped_refptr<base::SingleThreadTaskRunner>& viz_task_runner) {
+  DCHECK(!viz_task_runner_);
+  viz_task_runner_ = viz_task_runner;
+}
+
+void TaskQueueViz::ScheduleOnVizAndBlock(VizTask viz_task) {
+  TRACE_EVENT0("android_webview", "ScheduleOnVizAndBlock");
+
+  // Expected behavior is |viz_task| on the viz thread. From |viz_task| until
+  // the done closure is called (which may not be in the viz_task), viz thread
+  // is allowed to call ScheduleTask.
+  //
+  // Implementation is uses a normal run-loop like logic. The done closure
+  // marks |done_| true, and run loop exists when |done_| is true *and* the task
+  // queue is empty. A condition variable is signaled when |done_| is set or
+  // when something is appended to the task queue.
+  {
+    base::AutoLock lock(lock_);
+    DCHECK(done_);
+    done_ = false;
+  }
+
+  // Unretained safe because this object is never deleted.
+  viz_task_runner_->PostTask(
+      FROM_HERE, base::BindOnce(&TaskQueueViz::RunOnViz, base::Unretained(this),
+                                std::move(viz_task)));
+
+  {
+    base::AutoLock lock(lock_);
+    while (!done_ || !tasks_.empty()) {
+      if (tasks_.empty())
+        condvar_.Wait();
+      base::circular_deque<base::OnceClosure> tasks;
+      tasks.swap(tasks_);
+      {
+        base::AutoUnlock unlock(lock_);
+        if (!tasks.empty()) {
+          TRACE_EVENT0("android_webview", "RunTasks");
+          while (tasks.size()) {
+            std::move(tasks.front()).Run();
+            tasks.pop_front();
+          }
+        }
+      }
+    }
+    DCHECK(done_);
+  }
+}
+
+void TaskQueueViz::RunOnViz(VizTask viz_task) {
+  DCHECK(viz_task_runner_->BelongsToCurrentThread());
+  DCHECK(!allow_schedule_task_);
+  allow_schedule_task_ = true;
+  // Unretained safe because this object is never deleted.
+  std::move(viz_task).Run(
+      base::BindOnce(&TaskQueueViz::SignalDone, base::Unretained(this)));
+}
+
+void TaskQueueViz::SignalDone() {
+  DCHECK(viz_task_runner_->BelongsToCurrentThread());
+  DCHECK(allow_schedule_task_);
+  allow_schedule_task_ = false;
+
+  base::AutoLock lock(lock_);
+  DCHECK(!done_);
+  done_ = true;
+  condvar_.Signal();
+}
+
+}  // namespace
+
+ScopedAllowGL::ScopedAllowGL() {
+  DCHECK(!GetAllowGL()->Get());
+  GetAllowGL()->Set(true);
+}
+
+ScopedAllowGL::~ScopedAllowGL() {
+  TaskQueueWebView* service = TaskQueueWebView::GetInstance();
+  DCHECK(service);
+  service->RunAllTasks();
+  GetAllowGL()->Set(false);
+}
+
+// static
+TaskQueueWebView* TaskQueueWebView::GetInstance() {
+  static TaskQueueWebView* task_queue =
+      base::FeatureList::IsEnabled(features::kVizForWebView)
+          ? static_cast<TaskQueueWebView*>(new TaskQueueViz)
+          : static_cast<TaskQueueWebView*>(new TaskQueueSingleThread);
+  return task_queue;
+}
+
 }  // namespace android_webview
diff --git a/android_webview/browser/gfx/task_queue_web_view.h b/android_webview/browser/gfx/task_queue_web_view.h
index 7830fe9..785f70d 100644
--- a/android_webview/browser/gfx/task_queue_web_view.h
+++ b/android_webview/browser/gfx/task_queue_web_view.h
@@ -5,17 +5,10 @@
 #ifndef ANDROID_WEBVIEW_BROWSER_GFX_TASK_QUEUE_WEB_VIEW_H_
 #define ANDROID_WEBVIEW_BROWSER_GFX_TASK_QUEUE_WEB_VIEW_H_
 
-#include <stddef.h>
-
-#include <memory>
-#include <utility>
-
-#include "base/containers/queue.h"
-#include "base/lazy_instance.h"
+#include "base/callback.h"
 #include "base/macros.h"
-#include "base/threading/thread_checker.h"
-#include "base/threading/thread_local.h"
-#include "base/time/time.h"
+#include "base/memory/scoped_refptr.h"
+#include "base/single_thread_task_runner.h"
 
 namespace android_webview {
 
@@ -25,12 +18,7 @@
   ScopedAllowGL();
   ~ScopedAllowGL();
 
-  static bool IsAllowed();
-
  private:
-  static base::LazyInstance<base::ThreadLocalBoolean>::DestructorAtExit
-      allow_gl;
-
   DISALLOW_COPY_AND_ASSIGN(ScopedAllowGL);
 };
 
@@ -41,40 +29,38 @@
  public:
   // Static method that makes sure this is only one copy of this class.
   static TaskQueueWebView* GetInstance();
-  ~TaskQueueWebView();
+
+  // Methods only used when kVizForWebView is enabled, ie client is the viz
+  // thread.
+  virtual void InitializeVizThread(
+      const scoped_refptr<base::SingleThreadTaskRunner>& viz_task_runner) = 0;
+  // The calling OnceClosure unblocks the render thread, and disallows further
+  // calls to ScheduleTask.
+  using VizTask = base::OnceCallback<void(base::OnceClosure)>;
+  virtual void ScheduleOnVizAndBlock(VizTask viz_task) = 0;
 
   // Called by TaskForwardingSequence. |out_of_order| indicates if task should
   // be run ahead of already enqueued tasks.
-  void ScheduleTask(base::OnceClosure task, bool out_of_order);
+  virtual void ScheduleTask(base::OnceClosure task, bool out_of_order) = 0;
+
+  // Called by TaskForwardingSequence.
+  virtual void ScheduleOrRetainTask(base::OnceClosure task) = 0;
 
   // Called by DeferredGpuCommandService to schedule delayed tasks.
-  void ScheduleIdleTask(base::OnceClosure task);
+  // This should not be called when kVizForWebView is enabled.
+  virtual void ScheduleIdleTask(base::OnceClosure task) = 0;
 
   // Called by both DeferredGpuCommandService and
   // SkiaOutputSurfaceDisplayContext to post task to client thread.
-  void ScheduleClientTask(base::OnceClosure task);
+  virtual void ScheduleClientTask(base::OnceClosure task) = 0;
 
-  // Called by ScopedAllowGL and ScheduleTask().
-  void RunAllTasks();
-  void RunTasks();
+ protected:
+  friend ScopedAllowGL;
 
- private:
-  static TaskQueueWebView* CreateTaskQueueWebView();
-  TaskQueueWebView();
+  virtual ~TaskQueueWebView() = default;
 
-  // Flush the idle queue until it is empty.
-  void PerformAllIdleWork();
-
-  // All access to task queue should happen on a single thread.
-  THREAD_CHECKER(task_queue_thread_checker_);
-  base::circular_deque<base::OnceClosure> tasks_;
-  base::queue<std::pair<base::Time, base::OnceClosure>> idle_tasks_;
-  base::queue<base::OnceClosure> client_tasks_;
-
-  bool inside_run_tasks_ = false;
-  bool inside_run_idle_tasks_ = false;
-
-  DISALLOW_COPY_AND_ASSIGN(TaskQueueWebView);
+  // Called by ScopedAllowGL.
+  virtual void RunAllTasks() = 0;
 };
 
 }  // namespace android_webview
diff --git a/ash/BUILD.gn b/ash/BUILD.gn
index cc1ddc2..46e30b6 100644
--- a/ash/BUILD.gn
+++ b/ash/BUILD.gn
@@ -2277,7 +2277,7 @@
     "//ash/components/fast_ink",
     "//ash/public/cpp",
     "//ash/public/cpp:test_support",
-    "//ash/public/interfaces:test_interfaces",
+    "//ash/public/mojom:test_interfaces",
     "//base",
     "//base:i18n",
     "//base/test:test_support",
diff --git a/ash/accelerators/accelerator_controller_unittest.cc b/ash/accelerators/accelerator_controller_unittest.cc
index ab0b36b..19eabc83 100644
--- a/ash/accelerators/accelerator_controller_unittest.cc
+++ b/ash/accelerators/accelerator_controller_unittest.cc
@@ -26,7 +26,7 @@
 #include "ash/public/cpp/ash_switches.h"
 #include "ash/public/cpp/shell_window_ids.h"
 #include "ash/public/cpp/test/shell_test_api.h"
-#include "ash/public/interfaces/ime_info.mojom.h"
+#include "ash/public/mojom/ime_info.mojom.h"
 #include "ash/session/session_controller_impl.h"
 #include "ash/session/test_session_controller_client.h"
 #include "ash/shell.h"
diff --git a/ash/app_list/app_list_controller_impl.h b/ash/app_list/app_list_controller_impl.h
index b6891d1..5f900acc 100644
--- a/ash/app_list/app_list_controller_impl.h
+++ b/ash/app_list/app_list_controller_impl.h
@@ -28,7 +28,7 @@
 #include "ash/public/cpp/shelf_types.h"
 #include "ash/public/cpp/tablet_mode_observer.h"
 #include "ash/public/cpp/wallpaper_controller_observer.h"
-#include "ash/public/interfaces/voice_interaction_controller.mojom.h"
+#include "ash/public/mojom/voice_interaction_controller.mojom.h"
 #include "ash/session/session_observer.h"
 #include "ash/shell_observer.h"
 #include "ash/wm/mru_window_tracker.h"
diff --git a/ash/assistant/assistant_alarm_timer_controller.h b/ash/assistant/assistant_alarm_timer_controller.h
index 67f986f..9ae44c4 100644
--- a/ash/assistant/assistant_alarm_timer_controller.h
+++ b/ash/assistant/assistant_alarm_timer_controller.h
@@ -9,7 +9,7 @@
 #include "ash/assistant/model/assistant_alarm_timer_model.h"
 #include "ash/assistant/model/assistant_alarm_timer_model_observer.h"
 #include "ash/assistant/model/assistant_ui_model_observer.h"
-#include "ash/public/interfaces/assistant_controller.mojom.h"
+#include "ash/public/mojom/assistant_controller.mojom.h"
 #include "base/macros.h"
 #include "base/timer/timer.h"
 #include "mojo/public/cpp/bindings/binding.h"
diff --git a/ash/assistant/assistant_cache_controller.h b/ash/assistant/assistant_cache_controller.h
index aa31a622..78b022f1 100644
--- a/ash/assistant/assistant_cache_controller.h
+++ b/ash/assistant/assistant_cache_controller.h
@@ -9,7 +9,7 @@
 #include "ash/assistant/model/assistant_cache_model.h"
 #include "ash/assistant/model/assistant_ui_model_observer.h"
 #include "ash/public/cpp/assistant/default_voice_interaction_observer.h"
-#include "ash/public/interfaces/voice_interaction_controller.mojom.h"
+#include "ash/public/mojom/voice_interaction_controller.mojom.h"
 #include "base/macros.h"
 
 namespace ash {
diff --git a/ash/assistant/assistant_controller.h b/ash/assistant/assistant_controller.h
index 89ef054d..b89c910 100644
--- a/ash/assistant/assistant_controller.h
+++ b/ash/assistant/assistant_controller.h
@@ -25,9 +25,9 @@
 #include "ash/assistant/ui/assistant_view_delegate.h"
 #include "ash/public/cpp/assistant/assistant_image_downloader.h"
 #include "ash/public/cpp/assistant/default_voice_interaction_observer.h"
-#include "ash/public/interfaces/assistant_controller.mojom.h"
-#include "ash/public/interfaces/assistant_volume_control.mojom.h"
-#include "ash/public/interfaces/voice_interaction_controller.mojom.h"
+#include "ash/public/mojom/assistant_controller.mojom.h"
+#include "ash/public/mojom/assistant_volume_control.mojom.h"
+#include "ash/public/mojom/voice_interaction_controller.mojom.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "base/observer_list.h"
diff --git a/ash/assistant/assistant_notification_controller.h b/ash/assistant/assistant_notification_controller.h
index 6a7e63e0..f46b6b6 100644
--- a/ash/assistant/assistant_notification_controller.h
+++ b/ash/assistant/assistant_notification_controller.h
@@ -13,7 +13,7 @@
 #include "ash/assistant/model/assistant_notification_model.h"
 #include "ash/assistant/model/assistant_notification_model_observer.h"
 #include "ash/assistant/model/assistant_ui_model_observer.h"
-#include "ash/public/interfaces/assistant_controller.mojom.h"
+#include "ash/public/mojom/assistant_controller.mojom.h"
 #include "base/macros.h"
 #include "chromeos/services/assistant/public/mojom/assistant.mojom.h"
 #include "mojo/public/cpp/bindings/binding.h"
diff --git a/ash/assistant/assistant_screen_context_controller.h b/ash/assistant/assistant_screen_context_controller.h
index 22a5c37f..37beb81b 100644
--- a/ash/assistant/assistant_screen_context_controller.h
+++ b/ash/assistant/assistant_screen_context_controller.h
@@ -11,7 +11,7 @@
 #include "ash/assistant/assistant_controller_observer.h"
 #include "ash/assistant/model/assistant_screen_context_model.h"
 #include "ash/assistant/model/assistant_ui_model_observer.h"
-#include "ash/public/interfaces/assistant_controller.mojom.h"
+#include "ash/public/mojom/assistant_controller.mojom.h"
 #include "base/macros.h"
 #include "mojo/public/cpp/bindings/binding.h"
 #include "ui/gfx/geometry/rect.h"
diff --git a/ash/assistant/assistant_setup_controller.cc b/ash/assistant/assistant_setup_controller.cc
index e0217fdc..80e5a85 100644
--- a/ash/assistant/assistant_setup_controller.cc
+++ b/ash/assistant/assistant_setup_controller.cc
@@ -9,7 +9,7 @@
 #include "ash/assistant/util/deep_link_util.h"
 #include "ash/assistant/util/i18n_util.h"
 #include "ash/public/cpp/voice_interaction_controller.h"
-#include "ash/public/interfaces/voice_interaction_controller.mojom.h"
+#include "ash/public/mojom/voice_interaction_controller.mojom.h"
 #include "ash/shell.h"
 #include "base/bind.h"
 #include "base/bind_helpers.h"
diff --git a/ash/display/cros_display_config.h b/ash/display/cros_display_config.h
index bcc19cf..98ac39f 100644
--- a/ash/display/cros_display_config.h
+++ b/ash/display/cros_display_config.h
@@ -10,7 +10,7 @@
 #include <string>
 
 #include "ash/ash_export.h"
-#include "ash/public/interfaces/cros_display_config.mojom.h"
+#include "ash/public/mojom/cros_display_config.mojom.h"
 #include "base/macros.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
 #include "mojo/public/cpp/bindings/interface_ptr_set.h"
diff --git a/ash/display/cros_display_config_unittest.cc b/ash/display/cros_display_config_unittest.cc
index dc6448a..8038831 100644
--- a/ash/display/cros_display_config_unittest.cc
+++ b/ash/display/cros_display_config_unittest.cc
@@ -6,7 +6,7 @@
 
 #include "ash/display/cros_display_config.h"
 #include "ash/display/touch_calibrator_controller.h"
-#include "ash/public/interfaces/cros_display_config.mojom.h"
+#include "ash/public/mojom/cros_display_config.mojom.h"
 #include "ash/shell.h"
 #include "ash/test/ash_test_base.h"
 #include "ash/touch/ash_touch_transform_controller.h"
diff --git a/ash/display/resolution_notification_controller.h b/ash/display/resolution_notification_controller.h
index 7484613..253a28e 100644
--- a/ash/display/resolution_notification_controller.h
+++ b/ash/display/resolution_notification_controller.h
@@ -9,7 +9,7 @@
 
 #include "ash/ash_export.h"
 #include "ash/display/window_tree_host_manager.h"
-#include "ash/public/interfaces/cros_display_config.mojom.h"
+#include "ash/public/mojom/cros_display_config.mojom.h"
 #include "base/callback.h"
 #include "base/gtest_prod_util.h"
 #include "base/macros.h"
diff --git a/ash/ime/ime_controller.h b/ash/ime/ime_controller.h
index 5bbe32b..4edbb237b 100644
--- a/ash/ime/ime_controller.h
+++ b/ash/ime/ime_controller.h
@@ -10,8 +10,8 @@
 
 #include "ash/ash_export.h"
 #include "ash/public/cpp/cast_config_controller.h"
-#include "ash/public/interfaces/ime_controller.mojom.h"
-#include "ash/public/interfaces/ime_info.mojom.h"
+#include "ash/public/mojom/ime_controller.mojom.h"
+#include "ash/public/mojom/ime_info.mojom.h"
 #include "base/macros.h"
 #include "base/observer_list.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
diff --git a/ash/ime/ime_controller_unittest.cc b/ash/ime/ime_controller_unittest.cc
index 149df4a..67c0e90 100644
--- a/ash/ime/ime_controller_unittest.cc
+++ b/ash/ime/ime_controller_unittest.cc
@@ -8,7 +8,7 @@
 
 #include "ash/ime/mode_indicator_observer.h"
 #include "ash/ime/test_ime_controller_client.h"
-#include "ash/public/interfaces/ime_info.mojom.h"
+#include "ash/public/mojom/ime_info.mojom.h"
 #include "ash/shell.h"
 #include "ash/system/ime/ime_observer.h"
 #include "ash/system/tray/system_tray_notifier.h"
diff --git a/ash/ime/test_ime_controller_client.cc b/ash/ime/test_ime_controller_client.cc
index 65943b6..f9ee31be 100644
--- a/ash/ime/test_ime_controller_client.cc
+++ b/ash/ime/test_ime_controller_client.cc
@@ -8,7 +8,7 @@
 #include <string>
 #include <utility>
 
-#include "ash/public/interfaces/ime_controller.mojom.h"
+#include "ash/public/mojom/ime_controller.mojom.h"
 
 namespace ash {
 
diff --git a/ash/ime/test_ime_controller_client.h b/ash/ime/test_ime_controller_client.h
index 40f8ab1..3b044e24 100644
--- a/ash/ime/test_ime_controller_client.h
+++ b/ash/ime/test_ime_controller_client.h
@@ -5,7 +5,7 @@
 #ifndef ASH_IME_TEST_IME_CONTROLLER_CLIENT_H_
 #define ASH_IME_TEST_IME_CONTROLLER_CLIENT_H_
 
-#include "ash/public/interfaces/ime_controller.mojom.h"
+#include "ash/public/mojom/ime_controller.mojom.h"
 #include "base/macros.h"
 #include "mojo/public/cpp/bindings/binding.h"
 
diff --git a/ash/lock_screen_action/lock_screen_note_display_state_handler.cc b/ash/lock_screen_action/lock_screen_note_display_state_handler.cc
index e38fb85..ac20077 100644
--- a/ash/lock_screen_action/lock_screen_note_display_state_handler.cc
+++ b/ash/lock_screen_action/lock_screen_note_display_state_handler.cc
@@ -7,7 +7,7 @@
 #include <utility>
 
 #include "ash/lock_screen_action/lock_screen_note_launcher.h"
-#include "ash/public/interfaces/tray_action.mojom.h"
+#include "ash/public/mojom/tray_action.mojom.h"
 #include "ash/shell.h"
 #include "ash/system/power/scoped_backlights_forced_off.h"
 #include "ash/tray_action/tray_action.h"
diff --git a/ash/lock_screen_action/lock_screen_note_display_state_handler_unittest.cc b/ash/lock_screen_action/lock_screen_note_display_state_handler_unittest.cc
index a7bc435..9ee7a84 100644
--- a/ash/lock_screen_action/lock_screen_note_display_state_handler_unittest.cc
+++ b/ash/lock_screen_action/lock_screen_note_display_state_handler_unittest.cc
@@ -10,7 +10,7 @@
 
 #include "ash/accessibility/test_accessibility_controller_client.h"
 #include "ash/public/cpp/ash_switches.h"
-#include "ash/public/interfaces/tray_action.mojom.h"
+#include "ash/public/mojom/tray_action.mojom.h"
 #include "ash/shell.h"
 #include "ash/system/power/power_button_controller.h"
 #include "ash/test/ash_test_base.h"
diff --git a/ash/lock_screen_action/lock_screen_note_launcher.cc b/ash/lock_screen_action/lock_screen_note_launcher.cc
index f6313cb6..503fced 100644
--- a/ash/lock_screen_action/lock_screen_note_launcher.cc
+++ b/ash/lock_screen_action/lock_screen_note_launcher.cc
@@ -4,7 +4,7 @@
 
 #include "ash/lock_screen_action/lock_screen_note_launcher.h"
 
-#include "ash/public/interfaces/tray_action.mojom.h"
+#include "ash/public/mojom/tray_action.mojom.h"
 #include "ash/shell.h"
 #include "ash/tray_action/tray_action.h"
 #include "base/bind.h"
diff --git a/ash/login/ui/lock_contents_view_unittest.cc b/ash/login/ui/lock_contents_view_unittest.cc
index e0a323e..c91dfc0 100644
--- a/ash/login/ui/lock_contents_view_unittest.cc
+++ b/ash/login/ui/lock_contents_view_unittest.cc
@@ -30,7 +30,7 @@
 #include "ash/login/ui/views_utils.h"
 #include "ash/public/cpp/ash_features.h"
 #include "ash/public/cpp/ash_pref_names.h"
-#include "ash/public/interfaces/tray_action.mojom.h"
+#include "ash/public/mojom/tray_action.mojom.h"
 #include "ash/root_window_controller.h"
 #include "ash/session/session_controller_impl.h"
 #include "ash/shell.h"
diff --git a/ash/login/ui/login_data_dispatcher.h b/ash/login/ui/login_data_dispatcher.h
index 55f720c..e7f5d5a 100644
--- a/ash/login/ui/login_data_dispatcher.h
+++ b/ash/login/ui/login_data_dispatcher.h
@@ -12,7 +12,7 @@
 #include "ash/ash_export.h"
 #include "ash/detachable_base/detachable_base_pairing_status.h"
 #include "ash/public/cpp/login_screen_model.h"
-#include "ash/public/interfaces/tray_action.mojom.h"
+#include "ash/public/mojom/tray_action.mojom.h"
 #include "base/macros.h"
 #include "base/observer_list.h"
 
diff --git a/ash/login/ui/login_test_base.cc b/ash/login/ui/login_test_base.cc
index 1722ded..a54d0ec 100644
--- a/ash/login/ui/login_test_base.cc
+++ b/ash/login/ui/login_test_base.cc
@@ -10,7 +10,7 @@
 #include "ash/login/ui/lock_screen.h"
 #include "ash/login/ui/login_test_utils.h"
 #include "ash/public/cpp/shell_window_ids.h"
-#include "ash/public/interfaces/tray_action.mojom.h"
+#include "ash/public/mojom/tray_action.mojom.h"
 #include "ash/session/test_session_controller_client.h"
 #include "ash/shell.h"
 #include "ash/wallpaper/wallpaper_controller_impl.h"
diff --git a/ash/login/ui/note_action_launch_button.cc b/ash/login/ui/note_action_launch_button.cc
index ef1b6d7..e4f1dd6 100644
--- a/ash/login/ui/note_action_launch_button.cc
+++ b/ash/login/ui/note_action_launch_button.cc
@@ -6,7 +6,7 @@
 
 #include <memory>
 
-#include "ash/public/interfaces/tray_action.mojom.h"
+#include "ash/public/mojom/tray_action.mojom.h"
 #include "ash/resources/vector_icons/vector_icons.h"
 #include "ash/shelf/shelf_constants.h"
 #include "ash/strings/grit/ash_strings.h"
diff --git a/ash/login/ui/note_action_launch_button_unittest.cc b/ash/login/ui/note_action_launch_button_unittest.cc
index 984f661b..e9c78f2 100644
--- a/ash/login/ui/note_action_launch_button_unittest.cc
+++ b/ash/login/ui/note_action_launch_button_unittest.cc
@@ -9,7 +9,7 @@
 
 #include "ash/login/ui/login_test_base.h"
 #include "ash/login/ui/views_utils.h"
-#include "ash/public/interfaces/tray_action.mojom.h"
+#include "ash/public/mojom/tray_action.mojom.h"
 #include "ash/shell.h"
 #include "ash/tray_action/test_tray_action_client.h"
 #include "base/macros.h"
diff --git a/ash/mojo_test_interface_factory.cc b/ash/mojo_test_interface_factory.cc
index ae67861..c8d9c1788 100644
--- a/ash/mojo_test_interface_factory.cc
+++ b/ash/mojo_test_interface_factory.cc
@@ -6,7 +6,7 @@
 
 #include <utility>
 
-#include "ash/public/interfaces/status_area_widget_test_api.test-mojom.h"
+#include "ash/public/mojom/status_area_widget_test_api.test-mojom.h"
 #include "ash/system/status_area_widget_test_api.h"
 #include "base/bind.h"
 #include "base/single_thread_task_runner.h"
diff --git a/ash/public/cpp/BUILD.gn b/ash/public/cpp/BUILD.gn
index 2447bdf..2af825f4 100644
--- a/ash/public/cpp/BUILD.gn
+++ b/ash/public/cpp/BUILD.gn
@@ -244,7 +244,7 @@
   ]
 
   public_deps = [
-    "//ash/public/interfaces",
+    "//ash/public/mojom",
     "//base",
     "//components/arc/common:notifications",
     "//components/session_manager:base",
@@ -262,7 +262,7 @@
   ]
 
   deps = [
-    "//ash/public/interfaces",
+    "//ash/public/mojom",
     "//base",
     "//chromeos/services/multidevice_setup/public/mojom",
     "//chromeos/services/network_config/public/mojom",
@@ -286,7 +286,7 @@
 
   deps = [
     ":manifest",
-    "//ash/public/interfaces:test_interfaces",
+    "//ash/public/mojom:test_interfaces",
     "//base",
     "//services/service_manager/public/cpp",
     "//services/service_manager/public/mojom",
diff --git a/ash/public/cpp/OWNERS b/ash/public/cpp/OWNERS
index 978703ff..5d0ae32f 100644
--- a/ash/public/cpp/OWNERS
+++ b/ash/public/cpp/OWNERS
@@ -8,7 +8,5 @@
 per-file *.mojom=set noparent
 per-file *.mojom=file://ipc/SECURITY_OWNERS
 
-per-file *_struct_traits*.*=set noparent
-per-file *_struct_traits*.*=file://ipc/SECURITY_OWNERS
 per-file *_mojom_traits*.*=set noparent
 per-file *_mojom_traits*.*=file://ipc/SECURITY_OWNERS
diff --git a/ash/public/cpp/app_list/OWNERS b/ash/public/cpp/app_list/OWNERS
index 6467b609..31a5ff3d 100644
--- a/ash/public/cpp/app_list/OWNERS
+++ b/ash/public/cpp/app_list/OWNERS
@@ -1,6 +1,6 @@
 xiyuan@chromium.org
 
-per-file *_struct_traits*.*=set noparent
-per-file *_struct_traits*.*=file://ipc/SECURITY_OWNERS
+per-file *_mojom_traits*.*=set noparent
+per-file *_mojom_traits*.*=file://ipc/SECURITY_OWNERS
 
 # COMPONENT: UI>Shell>Launcher
\ No newline at end of file
diff --git a/ash/public/cpp/app_list/app_list_struct_traits.cc b/ash/public/cpp/app_list/app_list_mojom_traits.cc
similarity index 95%
rename from ash/public/cpp/app_list/app_list_struct_traits.cc
rename to ash/public/cpp/app_list/app_list_mojom_traits.cc
index 55425c9..06ec819c5 100644
--- a/ash/public/cpp/app_list/app_list_struct_traits.cc
+++ b/ash/public/cpp/app_list/app_list_mojom_traits.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "ash/public/cpp/app_list/app_list_struct_traits.h"
+#include "ash/public/cpp/app_list/app_list_mojom_traits.h"
 
 #include "mojo/public/cpp/base/string16_mojom_traits.h"
 #include "ui/gfx/image/mojom/image_skia_mojom_traits.h"
diff --git a/ash/public/cpp/app_list/app_list_struct_traits.h b/ash/public/cpp/app_list/app_list_mojom_traits.h
similarity index 97%
rename from ash/public/cpp/app_list/app_list_struct_traits.h
rename to ash/public/cpp/app_list/app_list_mojom_traits.h
index ff27216..3dfb1f8 100644
--- a/ash/public/cpp/app_list/app_list_struct_traits.h
+++ b/ash/public/cpp/app_list/app_list_mojom_traits.h
@@ -2,12 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef ASH_PUBLIC_CPP_APP_LIST_APP_LIST_STRUCT_TRAITS_H_
-#define ASH_PUBLIC_CPP_APP_LIST_APP_LIST_STRUCT_TRAITS_H_
+#ifndef ASH_PUBLIC_CPP_APP_LIST_APP_LIST_MOJOM_TRAITS_H_
+#define ASH_PUBLIC_CPP_APP_LIST_APP_LIST_MOJOM_TRAITS_H_
 
 #include "ash/public/cpp/app_list/app_list_types.h"
 #include "ash/public/cpp/ash_public_export.h"
-#include "ash/public/interfaces/app_list.mojom-shared.h"
+#include "ash/public/mojom/app_list.mojom-shared.h"
 #include "base/containers/span.h"
 #include "base/strings/string16.h"
 #include "mojo/public/mojom/base/string16.mojom.h"
@@ -244,4 +244,4 @@
 
 }  // namespace mojo
 
-#endif  // ASH_PUBLIC_CPP_APP_LIST_APP_LIST_STRUCT_TRAITS_H_
+#endif  // ASH_PUBLIC_CPP_APP_LIST_APP_LIST_MOJOM_TRAITS_H_
diff --git a/ash/public/cpp/assistant/assistant_state_base.h b/ash/public/cpp/assistant/assistant_state_base.h
index 2ed231b..37191f5 100644
--- a/ash/public/cpp/assistant/assistant_state_base.h
+++ b/ash/public/cpp/assistant/assistant_state_base.h
@@ -7,7 +7,7 @@
 
 #include <string>
 
-#include "ash/public/interfaces/voice_interaction_controller.mojom.h"
+#include "ash/public/mojom/voice_interaction_controller.mojom.h"
 #include "base/macros.h"
 #include "base/optional.h"
 
diff --git a/ash/public/cpp/assistant/assistant_state_proxy.cc b/ash/public/cpp/assistant/assistant_state_proxy.cc
index 289aff7..cd236e1 100644
--- a/ash/public/cpp/assistant/assistant_state_proxy.cc
+++ b/ash/public/cpp/assistant/assistant_state_proxy.cc
@@ -6,7 +6,7 @@
 #include <utility>
 
 #include "ash/public/cpp/assistant/assistant_state_proxy.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "services/service_manager/public/cpp/connector.h"
 
 namespace ash {
diff --git a/ash/public/cpp/assistant/assistant_state_proxy.h b/ash/public/cpp/assistant/assistant_state_proxy.h
index fc18b9f..e7b890e 100644
--- a/ash/public/cpp/assistant/assistant_state_proxy.h
+++ b/ash/public/cpp/assistant/assistant_state_proxy.h
@@ -10,7 +10,7 @@
 
 #include "ash/public/cpp/assistant/assistant_state_base.h"
 #include "ash/public/cpp/assistant/default_voice_interaction_observer.h"
-#include "ash/public/interfaces/voice_interaction_controller.mojom.h"
+#include "ash/public/mojom/voice_interaction_controller.mojom.h"
 #include "base/callback.h"
 #include "base/macros.h"
 #include "base/observer_list.h"
diff --git a/ash/public/cpp/assistant/default_voice_interaction_observer.h b/ash/public/cpp/assistant/default_voice_interaction_observer.h
index f49a5d61..f697e07 100644
--- a/ash/public/cpp/assistant/default_voice_interaction_observer.h
+++ b/ash/public/cpp/assistant/default_voice_interaction_observer.h
@@ -7,7 +7,7 @@
 
 #include <string>
 
-#include "ash/public/interfaces/voice_interaction_controller.mojom.h"
+#include "ash/public/mojom/voice_interaction_controller.mojom.h"
 #include "base/macros.h"
 #include "base/observer_list_types.h"
 
diff --git a/ash/public/cpp/default_scale_factor_retriever.cc b/ash/public/cpp/default_scale_factor_retriever.cc
index 2a4c49a..8d0269a 100644
--- a/ash/public/cpp/default_scale_factor_retriever.cc
+++ b/ash/public/cpp/default_scale_factor_retriever.cc
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 #include "ash/public/cpp/default_scale_factor_retriever.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "base/bind.h"
 
 namespace ash {
diff --git a/ash/public/cpp/default_scale_factor_retriever.h b/ash/public/cpp/default_scale_factor_retriever.h
index 59d4a73..148d3d5 100644
--- a/ash/public/cpp/default_scale_factor_retriever.h
+++ b/ash/public/cpp/default_scale_factor_retriever.h
@@ -6,7 +6,7 @@
 #define ASH_PUBLIC_CPP_DEFAULT_SCALE_FACTOR_RETRIEVER_H_
 
 #include "ash/public/cpp/ash_public_export.h"
-#include "ash/public/interfaces/cros_display_config.mojom.h"
+#include "ash/public/mojom/cros_display_config.mojom.h"
 #include "base/callback.h"
 #include "base/memory/weak_ptr.h"
 #include "base/time/time.h"
diff --git a/ash/public/cpp/default_scale_factor_retriever_unittest.cc b/ash/public/cpp/default_scale_factor_retriever_unittest.cc
index 9035e33..2a9a82a 100644
--- a/ash/public/cpp/default_scale_factor_retriever_unittest.cc
+++ b/ash/public/cpp/default_scale_factor_retriever_unittest.cc
@@ -4,7 +4,7 @@
 
 #include "ash/public/cpp/default_scale_factor_retriever.h"
 
-#include "ash/public/interfaces/cros_display_config.mojom.h"
+#include "ash/public/mojom/cros_display_config.mojom.h"
 #include "base/bind.h"
 #include "base/run_loop.h"
 #include "base/test/scoped_task_environment.h"
diff --git a/ash/public/cpp/manifest.cc b/ash/public/cpp/manifest.cc
index 58c8fc55..7e7622e6 100644
--- a/ash/public/cpp/manifest.cc
+++ b/ash/public/cpp/manifest.cc
@@ -4,14 +4,14 @@
 
 #include "ash/public/cpp/manifest.h"
 
-#include "ash/public/interfaces/assistant_controller.mojom.h"
-#include "ash/public/interfaces/assistant_volume_control.mojom.h"
-#include "ash/public/interfaces/constants.mojom.h"
-#include "ash/public/interfaces/cros_display_config.mojom.h"
-#include "ash/public/interfaces/ime_controller.mojom.h"
-#include "ash/public/interfaces/tray_action.mojom.h"
-#include "ash/public/interfaces/voice_interaction_controller.mojom.h"
-#include "ash/public/interfaces/vpn_list.mojom.h"
+#include "ash/public/mojom/assistant_controller.mojom.h"
+#include "ash/public/mojom/assistant_volume_control.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
+#include "ash/public/mojom/cros_display_config.mojom.h"
+#include "ash/public/mojom/ime_controller.mojom.h"
+#include "ash/public/mojom/tray_action.mojom.h"
+#include "ash/public/mojom/voice_interaction_controller.mojom.h"
+#include "ash/public/mojom/vpn_list.mojom.h"
 #include "base/no_destructor.h"
 #include "chromeos/services/multidevice_setup/public/mojom/constants.mojom.h"
 #include "chromeos/services/network_config/public/mojom/constants.mojom.h"
diff --git a/ash/public/cpp/test_manifest.cc b/ash/public/cpp/test_manifest.cc
index 95c0028..ca0736ba 100644
--- a/ash/public/cpp/test_manifest.cc
+++ b/ash/public/cpp/test_manifest.cc
@@ -4,7 +4,7 @@
 
 #include "ash/public/cpp/test_manifest.h"
 
-#include "ash/public/interfaces/status_area_widget_test_api.test-mojom.h"
+#include "ash/public/mojom/status_area_widget_test_api.test-mojom.h"
 #include "base/no_destructor.h"
 #include "services/service_manager/public/cpp/manifest_builder.h"
 
diff --git a/ash/public/cpp/voice_interaction_controller.h b/ash/public/cpp/voice_interaction_controller.h
index 29a5030..e8c7774 100644
--- a/ash/public/cpp/voice_interaction_controller.h
+++ b/ash/public/cpp/voice_interaction_controller.h
@@ -10,7 +10,7 @@
 #include "ash/public/cpp/ash_public_export.h"
 #include "ash/public/cpp/assistant/assistant_state_base.h"
 #include "ash/public/cpp/assistant/default_voice_interaction_observer.h"
-#include "ash/public/interfaces/voice_interaction_controller.mojom.h"
+#include "ash/public/mojom/voice_interaction_controller.mojom.h"
 #include "base/observer_list.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
 #include "mojo/public/cpp/bindings/interface_ptr_set.h"
diff --git a/ash/public/cpp/voice_interaction_controller_unittest.cc b/ash/public/cpp/voice_interaction_controller_unittest.cc
index 824a0bc..281c108 100644
--- a/ash/public/cpp/voice_interaction_controller_unittest.cc
+++ b/ash/public/cpp/voice_interaction_controller_unittest.cc
@@ -7,7 +7,7 @@
 #include <memory>
 #include <utility>
 
-#include "ash/public/interfaces/voice_interaction_controller.mojom.h"
+#include "ash/public/mojom/voice_interaction_controller.mojom.h"
 #include "base/test/scoped_task_environment.h"
 #include "mojo/public/cpp/bindings/binding.h"
 #include "testing/gtest/include/gtest/gtest.h"
diff --git a/ash/public/interfaces/BUILD.gn b/ash/public/mojom/BUILD.gn
similarity index 97%
rename from ash/public/interfaces/BUILD.gn
rename to ash/public/mojom/BUILD.gn
index 2c34bda80..df05b94 100644
--- a/ash/public/interfaces/BUILD.gn
+++ b/ash/public/mojom/BUILD.gn
@@ -4,7 +4,7 @@
 
 import("//mojo/public/tools/bindings/mojom.gni")
 
-mojom("interfaces") {
+mojom("mojom") {
   disable_variants = true
 
   sources = [
@@ -49,7 +49,7 @@
     "status_area_widget_test_api.test-mojom",
   ]
   deps = [
-    ":interfaces",
+    ":mojom",
     "//components/account_id/mojom",
     "//mojo/public/mojom/base",
     "//ui/gfx/geometry/mojom",
diff --git a/ash/public/interfaces/OWNERS b/ash/public/mojom/OWNERS
similarity index 61%
rename from ash/public/interfaces/OWNERS
rename to ash/public/mojom/OWNERS
index 2c44a46..ae29a36aa 100644
--- a/ash/public/interfaces/OWNERS
+++ b/ash/public/mojom/OWNERS
@@ -1,6 +1,6 @@
 per-file *.mojom=set noparent
 per-file *.mojom=file://ipc/SECURITY_OWNERS
-per-file *_struct_traits*.*=set noparent
-per-file *_struct_traits*.*=file://ipc/SECURITY_OWNERS
+per-file *_mojom_traits*.*=set noparent
+per-file *_mojom_traits*.*=file://ipc/SECURITY_OWNERS
 per-file *.typemap=set noparent
 per-file *.typemap=file://ipc/SECURITY_OWNERS
diff --git a/ash/public/interfaces/assistant_controller.mojom b/ash/public/mojom/assistant_controller.mojom
similarity index 100%
rename from ash/public/interfaces/assistant_controller.mojom
rename to ash/public/mojom/assistant_controller.mojom
diff --git a/ash/public/interfaces/assistant_volume_control.mojom b/ash/public/mojom/assistant_volume_control.mojom
similarity index 100%
rename from ash/public/interfaces/assistant_volume_control.mojom
rename to ash/public/mojom/assistant_volume_control.mojom
diff --git a/ash/public/interfaces/constants.mojom b/ash/public/mojom/constants.mojom
similarity index 100%
rename from ash/public/interfaces/constants.mojom
rename to ash/public/mojom/constants.mojom
diff --git a/ash/public/interfaces/cros_display_config.mojom b/ash/public/mojom/cros_display_config.mojom
similarity index 100%
rename from ash/public/interfaces/cros_display_config.mojom
rename to ash/public/mojom/cros_display_config.mojom
diff --git a/ash/public/interfaces/ime_controller.mojom b/ash/public/mojom/ime_controller.mojom
similarity index 98%
rename from ash/public/interfaces/ime_controller.mojom
rename to ash/public/mojom/ime_controller.mojom
index 11146b1..9edb3a6 100644
--- a/ash/public/interfaces/ime_controller.mojom
+++ b/ash/public/mojom/ime_controller.mojom
@@ -4,7 +4,7 @@
 
 module ash.mojom;
 
-import "ash/public/interfaces/ime_info.mojom";
+import "ash/public/mojom/ime_info.mojom";
 import "mojo/public/mojom/base/string16.mojom";
 import "ui/base/ime/chromeos/public/mojom/ime_keyset.mojom";
 import "ui/gfx/geometry/mojom/geometry.mojom";
diff --git a/ash/public/interfaces/ime_info.mojom b/ash/public/mojom/ime_info.mojom
similarity index 100%
rename from ash/public/interfaces/ime_info.mojom
rename to ash/public/mojom/ime_info.mojom
diff --git a/ash/public/interfaces/status_area_widget_test_api.test-mojom b/ash/public/mojom/status_area_widget_test_api.test-mojom
similarity index 100%
rename from ash/public/interfaces/status_area_widget_test_api.test-mojom
rename to ash/public/mojom/status_area_widget_test_api.test-mojom
diff --git a/ash/public/interfaces/tray_action.mojom b/ash/public/mojom/tray_action.mojom
similarity index 100%
rename from ash/public/interfaces/tray_action.mojom
rename to ash/public/mojom/tray_action.mojom
diff --git a/ash/public/interfaces/voice_interaction_controller.mojom b/ash/public/mojom/voice_interaction_controller.mojom
similarity index 100%
rename from ash/public/interfaces/voice_interaction_controller.mojom
rename to ash/public/mojom/voice_interaction_controller.mojom
diff --git a/ash/public/interfaces/vpn_list.mojom b/ash/public/mojom/vpn_list.mojom
similarity index 100%
rename from ash/public/interfaces/vpn_list.mojom
rename to ash/public/mojom/vpn_list.mojom
diff --git a/ash/shelf/home_button_controller.h b/ash/shelf/home_button_controller.h
index 782b194..f05d5e2 100644
--- a/ash/shelf/home_button_controller.h
+++ b/ash/shelf/home_button_controller.h
@@ -10,7 +10,7 @@
 #include "ash/app_list/app_list_controller_observer.h"
 #include "ash/public/cpp/assistant/default_voice_interaction_observer.h"
 #include "ash/public/cpp/tablet_mode_observer.h"
-#include "ash/public/interfaces/voice_interaction_controller.mojom.h"
+#include "ash/public/mojom/voice_interaction_controller.mojom.h"
 #include "ash/session/session_observer.h"
 #include "base/macros.h"
 
diff --git a/ash/shell/content/client/shell_content_browser_client.cc b/ash/shell/content/client/shell_content_browser_client.cc
index 4aa9d82..b0827469 100644
--- a/ash/shell/content/client/shell_content_browser_client.cc
+++ b/ash/shell/content/client/shell_content_browser_client.cc
@@ -8,7 +8,7 @@
 #include <utility>
 
 #include "ash/public/cpp/window_properties.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "ash/shell.h"
 #include "ash/shell/content/client/shell_browser_main_parts.h"
 #include "base/base_switches.h"
diff --git a/ash/shell/example_app_list_client.cc b/ash/shell/example_app_list_client.cc
index 63e0e5c9..6cf1bbd 100644
--- a/ash/shell/example_app_list_client.cc
+++ b/ash/shell/example_app_list_client.cc
@@ -10,7 +10,7 @@
 #include "ash/app_list/app_list_controller_impl.h"
 #include "ash/app_list/model/app_list_item.h"
 #include "ash/app_list/model/search/search_result.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "ash/session/session_controller_impl.h"
 #include "ash/shell.h"
 #include "ash/shell/example_factory.h"
diff --git a/ash/system/ime/tray_ime_chromeos.h b/ash/system/ime/tray_ime_chromeos.h
index 82b3e927..e312b2ca 100644
--- a/ash/system/ime/tray_ime_chromeos.h
+++ b/ash/system/ime/tray_ime_chromeos.h
@@ -7,7 +7,7 @@
 
 #include <stddef.h>
 
-#include "ash/public/interfaces/ime_info.mojom.h"
+#include "ash/public/mojom/ime_info.mojom.h"
 #include "ash/system/ime_menu/ime_list_view.h"
 #include "base/macros.h"
 
diff --git a/ash/system/ime_menu/ime_list_view.cc b/ash/system/ime_menu/ime_list_view.cc
index 5db375d..43221480 100644
--- a/ash/system/ime_menu/ime_list_view.cc
+++ b/ash/system/ime_menu/ime_list_view.cc
@@ -9,7 +9,7 @@
 #include "ash/keyboard/keyboard_controller_impl.h"
 #include "ash/keyboard/ui/keyboard_util.h"
 #include "ash/keyboard/virtual_keyboard_controller.h"
-#include "ash/public/interfaces/ime_info.mojom.h"
+#include "ash/public/mojom/ime_info.mojom.h"
 #include "ash/resources/vector_icons/vector_icons.h"
 #include "ash/shell.h"
 #include "ash/strings/grit/ash_strings.h"
diff --git a/ash/system/ime_menu/ime_menu_tray.h b/ash/system/ime_menu/ime_menu_tray.h
index 9608c94..1f454b8 100644
--- a/ash/system/ime_menu/ime_menu_tray.h
+++ b/ash/system/ime_menu/ime_menu_tray.h
@@ -7,8 +7,8 @@
 
 #include "ash/ash_export.h"
 #include "ash/public/cpp/keyboard/keyboard_controller_observer.h"
-#include "ash/public/interfaces/ime_controller.mojom.h"
-#include "ash/public/interfaces/ime_info.mojom.h"
+#include "ash/public/mojom/ime_controller.mojom.h"
+#include "ash/public/mojom/ime_info.mojom.h"
 #include "ash/system/ime/ime_observer.h"
 #include "ash/system/tray/tray_background_view.h"
 #include "ash/system/tray/tray_bubble_view.h"
diff --git a/ash/system/ime_menu/ime_menu_tray_unittest.cc b/ash/system/ime_menu/ime_menu_tray_unittest.cc
index ee46020..6622b352 100644
--- a/ash/system/ime_menu/ime_menu_tray_unittest.cc
+++ b/ash/system/ime_menu/ime_menu_tray_unittest.cc
@@ -7,7 +7,7 @@
 #include "ash/accelerators/accelerator_controller_impl.h"
 #include "ash/ime/ime_controller.h"
 #include "ash/ime/test_ime_controller_client.h"
-#include "ash/public/interfaces/ime_info.mojom.h"
+#include "ash/public/mojom/ime_info.mojom.h"
 #include "ash/shell.h"
 #include "ash/system/ime_menu/ime_list_view.h"
 #include "ash/system/status_area_widget.h"
diff --git a/ash/system/network/sms_observer_unittest.cc b/ash/system/network/sms_observer_unittest.cc
index 7cde9ea..8c6794671 100644
--- a/ash/system/network/sms_observer_unittest.cc
+++ b/ash/system/network/sms_observer_unittest.cc
@@ -6,7 +6,7 @@
 
 #include <memory>
 
-#include "ash/public/interfaces/vpn_list.mojom.h"
+#include "ash/public/mojom/vpn_list.mojom.h"
 #include "ash/shell.h"
 #include "ash/test/ash_test_base.h"
 #include "base/macros.h"
diff --git a/ash/system/network/vpn_list.h b/ash/system/network/vpn_list.h
index 816c145..c49b486 100644
--- a/ash/system/network/vpn_list.h
+++ b/ash/system/network/vpn_list.h
@@ -9,7 +9,7 @@
 #include <vector>
 
 #include "ash/ash_export.h"
-#include "ash/public/interfaces/vpn_list.mojom.h"
+#include "ash/public/mojom/vpn_list.mojom.h"
 #include "base/macros.h"
 #include "base/observer_list.h"
 #include "base/time/time.h"
diff --git a/ash/system/network/vpn_list_unittest.cc b/ash/system/network/vpn_list_unittest.cc
index 0754c4e..c64edd9 100644
--- a/ash/system/network/vpn_list_unittest.cc
+++ b/ash/system/network/vpn_list_unittest.cc
@@ -7,7 +7,7 @@
 #include <algorithm>
 #include <vector>
 
-#include "ash/public/interfaces/vpn_list.mojom.h"
+#include "ash/public/mojom/vpn_list.mojom.h"
 #include "base/macros.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
diff --git a/ash/system/palette/palette_tray_unittest.cc b/ash/system/palette/palette_tray_unittest.cc
index e58fa5d2..cdc3b9e 100644
--- a/ash/system/palette/palette_tray_unittest.cc
+++ b/ash/system/palette/palette_tray_unittest.cc
@@ -15,7 +15,7 @@
 #include "ash/public/cpp/ash_switches.h"
 #include "ash/public/cpp/stylus_utils.h"
 #include "ash/public/cpp/voice_interaction_controller.h"
-#include "ash/public/interfaces/voice_interaction_controller.mojom.h"
+#include "ash/public/mojom/voice_interaction_controller.mojom.h"
 #include "ash/root_window_controller.h"
 #include "ash/session/session_controller_impl.h"
 #include "ash/session/test_session_controller_client.h"
diff --git a/ash/system/palette/tools/metalayer_mode.h b/ash/system/palette/tools/metalayer_mode.h
index ef08630..05ac1ad 100644
--- a/ash/system/palette/tools/metalayer_mode.h
+++ b/ash/system/palette/tools/metalayer_mode.h
@@ -8,7 +8,7 @@
 #include "ash/ash_export.h"
 #include "ash/highlighter/highlighter_controller.h"
 #include "ash/public/cpp/assistant/default_voice_interaction_observer.h"
-#include "ash/public/interfaces/voice_interaction_controller.mojom.h"
+#include "ash/public/mojom/voice_interaction_controller.mojom.h"
 #include "ash/system/palette/common_palette_tool.h"
 #include "base/memory/weak_ptr.h"
 #include "ui/events/event_handler.h"
diff --git a/ash/system/palette/tools/metalayer_unittest.cc b/ash/system/palette/tools/metalayer_unittest.cc
index 633ad035..8a0e9c8e 100644
--- a/ash/system/palette/tools/metalayer_unittest.cc
+++ b/ash/system/palette/tools/metalayer_unittest.cc
@@ -7,7 +7,7 @@
 #include "ash/highlighter/highlighter_controller.h"
 #include "ash/highlighter/highlighter_controller_test_api.h"
 #include "ash/public/cpp/voice_interaction_controller.h"
-#include "ash/public/interfaces/voice_interaction_controller.mojom.h"
+#include "ash/public/mojom/voice_interaction_controller.mojom.h"
 #include "ash/shell.h"
 #include "ash/system/palette/mock_palette_tool_delegate.h"
 #include "ash/system/palette/palette_ids.h"
diff --git a/ash/system/status_area_widget_test_api.h b/ash/system/status_area_widget_test_api.h
index 10af7197..f75896b 100644
--- a/ash/system/status_area_widget_test_api.h
+++ b/ash/system/status_area_widget_test_api.h
@@ -7,7 +7,7 @@
 
 #include <memory>
 
-#include "ash/public/interfaces/status_area_widget_test_api.test-mojom.h"
+#include "ash/public/mojom/status_area_widget_test_api.test-mojom.h"
 #include "ash/system/status_area_widget.h"
 #include "base/macros.h"
 
diff --git a/ash/tray_action/test_tray_action_client.h b/ash/tray_action/test_tray_action_client.h
index 0fd13b06..ff6c02af 100644
--- a/ash/tray_action/test_tray_action_client.h
+++ b/ash/tray_action/test_tray_action_client.h
@@ -7,7 +7,7 @@
 
 #include <vector>
 
-#include "ash/public/interfaces/tray_action.mojom.h"
+#include "ash/public/mojom/tray_action.mojom.h"
 #include "base/macros.h"
 #include "mojo/public/cpp/bindings/binding.h"
 
diff --git a/ash/tray_action/tray_action.h b/ash/tray_action/tray_action.h
index b1f6c181..660b1cb4 100644
--- a/ash/tray_action/tray_action.h
+++ b/ash/tray_action/tray_action.h
@@ -8,7 +8,7 @@
 #include <memory>
 
 #include "ash/ash_export.h"
-#include "ash/public/interfaces/tray_action.mojom.h"
+#include "ash/public/mojom/tray_action.mojom.h"
 #include "base/macros.h"
 #include "base/observer_list.h"
 #include "base/scoped_observer.h"
diff --git a/ash/tray_action/tray_action_observer.h b/ash/tray_action/tray_action_observer.h
index 4866bca..f857f07 100644
--- a/ash/tray_action/tray_action_observer.h
+++ b/ash/tray_action/tray_action_observer.h
@@ -6,7 +6,7 @@
 #define ASH_TRAY_ACTION_TRAY_ACTION_OBSERVER_H_
 
 #include "ash/ash_export.h"
-#include "ash/public/interfaces/tray_action.mojom.h"
+#include "ash/public/mojom/tray_action.mojom.h"
 
 namespace ash {
 
diff --git a/ash/wm/lock_action_handler_layout_manager.cc b/ash/wm/lock_action_handler_layout_manager.cc
index df7fb34..95f2541 100644
--- a/ash/wm/lock_action_handler_layout_manager.cc
+++ b/ash/wm/lock_action_handler_layout_manager.cc
@@ -9,7 +9,7 @@
 
 #include "ash/lock_screen_action/lock_screen_action_background_controller.h"
 #include "ash/public/cpp/shell_window_ids.h"
-#include "ash/public/interfaces/tray_action.mojom.h"
+#include "ash/public/mojom/tray_action.mojom.h"
 #include "ash/shell.h"
 #include "ash/tray_action/tray_action.h"
 #include "ash/wm/lock_window_state.h"
diff --git a/ash/wm/lock_action_handler_layout_manager_unittest.cc b/ash/wm/lock_action_handler_layout_manager_unittest.cc
index f571ca8..60dcce4 100644
--- a/ash/wm/lock_action_handler_layout_manager_unittest.cc
+++ b/ash/wm/lock_action_handler_layout_manager_unittest.cc
@@ -17,7 +17,7 @@
 #include "ash/lock_screen_action/test_lock_screen_action_background_controller.h"
 #include "ash/public/cpp/keyboard/keyboard_switches.h"
 #include "ash/public/cpp/shell_window_ids.h"
-#include "ash/public/interfaces/tray_action.mojom.h"
+#include "ash/public/mojom/tray_action.mojom.h"
 #include "ash/root_window_controller.h"
 #include "ash/screen_util.h"
 #include "ash/session/test_session_controller_client.h"
diff --git a/base/synchronization/waitable_event.h b/base/synchronization/waitable_event.h
index a65c725..8f78084e 100644
--- a/base/synchronization/waitable_event.h
+++ b/base/synchronization/waitable_event.h
@@ -96,9 +96,10 @@
   //   delete e;
   void Wait();
 
-  // Wait up until wait_delta has passed for the event to be signaled.  Returns
-  // true if the event was signaled. Handles spurious wakeups and guarantees
-  // that |wait_delta| will have elapsed if this returns false.
+  // Wait up until wait_delta has passed for the event to be signaled
+  // (real-time; ignores time overrides).  Returns true if the event was
+  // signaled. Handles spurious wakeups and guarantees that |wait_delta| will
+  // have elapsed if this returns false.
   //
   // TimedWait can synchronise its own destruction like |Wait|.
   bool TimedWait(const TimeDelta& wait_delta);
diff --git a/base/synchronization/waitable_event_mac.cc b/base/synchronization/waitable_event_mac.cc
index ee601bb..fb654ab 100644
--- a/base/synchronization/waitable_event_mac.cc
+++ b/base/synchronization/waitable_event_mac.cc
@@ -19,6 +19,7 @@
 #include "base/threading/scoped_blocking_call.h"
 #include "base/threading/thread_restrictions.h"
 #include "base/time/time.h"
+#include "base/time/time_override.h"
 #include "build/build_config.h"
 
 namespace base {
@@ -140,11 +141,12 @@
   }
 
   // TimeTicks takes care of overflow but we special case is_max() nonetheless
-  // to avoid invoking Now() unnecessarily (same for the increment step of the
-  // for loop if the condition variable returns early).
-  // Ref: https://crbug.com/910524#c7
+  // to avoid invoking TimeTicksNowIgnoringOverride() unnecessarily (same for
+  // the increment step of the for loop if the condition variable returns
+  // early). Ref: https://crbug.com/910524#c7
   const TimeTicks end_time =
-      wait_delta.is_max() ? TimeTicks::Max() : TimeTicks::Now() + wait_delta;
+      wait_delta.is_max() ? TimeTicks::Max()
+                          : subtle::TimeTicksNowIgnoringOverride() + wait_delta;
   // Fake |kr| value to boostrap the for loop.
   kern_return_t kr = MACH_RCV_INTERRUPTED;
   for (mach_msg_timeout_t timeout = wait_delta.is_max()
@@ -160,8 +162,8 @@
            end_time.is_max()
                ? MACH_MSG_TIMEOUT_NONE
                : std::max<int64_t>(
-                     0,
-                     (end_time - TimeTicks::Now()).InMillisecondsRoundedUp())) {
+                     0, (end_time - subtle::TimeTicksNowIgnoringOverride())
+                            .InMillisecondsRoundedUp())) {
     kr = mach_msg(&msg.header, options, 0, rcv_size, receive_right_->Name(),
                   timeout, MACH_PORT_NULL);
   }
diff --git a/base/synchronization/waitable_event_posix.cc b/base/synchronization/waitable_event_posix.cc
index d89e3a27..6ebadc6 100644
--- a/base/synchronization/waitable_event_posix.cc
+++ b/base/synchronization/waitable_event_posix.cc
@@ -17,6 +17,7 @@
 #include "base/threading/scoped_blocking_call.h"
 #include "base/threading/thread_restrictions.h"
 #include "base/time/time.h"
+#include "base/time/time_override.h"
 
 // -----------------------------------------------------------------------------
 // A WaitableEvent on POSIX is implemented as a wait-list. Currently we don't
@@ -196,14 +197,16 @@
   // again before unlocking it.
 
   // TimeTicks takes care of overflow but we special case is_max() nonetheless
-  // to avoid invoking Now() unnecessarily (same for the increment step of the
-  // for loop if the condition variable returns early).
-  // Ref: https://crbug.com/910524#c7
+  // to avoid invoking TimeTicksNowIgnoringOverride() unnecessarily (same for
+  // the increment step of the for loop if the condition variable returns
+  // early). Ref: https://crbug.com/910524#c7
   const TimeTicks end_time =
-      wait_delta.is_max() ? TimeTicks::Max() : TimeTicks::Now() + wait_delta;
+      wait_delta.is_max() ? TimeTicks::Max()
+                          : subtle::TimeTicksNowIgnoringOverride() + wait_delta;
   for (TimeDelta remaining = wait_delta; remaining > TimeDelta() && !sw.fired();
-       remaining = end_time.is_max() ? TimeDelta::Max()
-                                     : end_time - TimeTicks::Now()) {
+       remaining = end_time.is_max()
+                       ? TimeDelta::Max()
+                       : end_time - subtle::TimeTicksNowIgnoringOverride()) {
     if (end_time.is_max())
       sw.cv()->Wait();
     else
diff --git a/base/synchronization/waitable_event_win.cc b/base/synchronization/waitable_event_win.cc
index 7c7fbf2..36583c3 100644
--- a/base/synchronization/waitable_event_win.cc
+++ b/base/synchronization/waitable_event_win.cc
@@ -17,6 +17,7 @@
 #include "base/threading/scoped_blocking_call.h"
 #include "base/threading/thread_restrictions.h"
 #include "base/time/time.h"
+#include "base/time/time_override.h"
 
 namespace base {
 
@@ -88,13 +89,14 @@
   }
 
   // TimeTicks takes care of overflow but we special case is_max() nonetheless
-  // to avoid invoking Now() unnecessarily.
+  // to avoid invoking TimeTicksNowIgnoringOverride() unnecessarily.
   // WaitForSingleObject(handle_.Get(), INFINITE) doesn't spuriously wakeup so
   // we don't need to worry about is_max() for the increment phase of the loop.
   const TimeTicks end_time =
-      wait_delta.is_max() ? TimeTicks::Max() : TimeTicks::Now() + wait_delta;
+      wait_delta.is_max() ? TimeTicks::Max()
+                          : subtle::TimeTicksNowIgnoringOverride() + wait_delta;
   for (TimeDelta remaining = wait_delta; remaining > TimeDelta();
-       remaining = end_time - TimeTicks::Now()) {
+       remaining = end_time - subtle::TimeTicksNowIgnoringOverride()) {
     // Truncate the timeout to milliseconds, rounded up to avoid spinning
     // (either by returning too early or because a < 1ms timeout on Windows
     // tends to return immediately).
diff --git a/base/task/sequence_manager/task_queue_impl.cc b/base/task/sequence_manager/task_queue_impl.cc
index b9a93a4..8dddc849 100644
--- a/base/task/sequence_manager/task_queue_impl.cc
+++ b/base/task/sequence_manager/task_queue_impl.cc
@@ -557,6 +557,8 @@
   while (!main_thread_only().delayed_incoming_queue.empty()) {
     Task* task =
         const_cast<Task*>(&main_thread_only().delayed_incoming_queue.top());
+    // TODO(crbug.com/990245): Remove after the crash has been resolved.
+    sequence_manager_->RecordCrashKeys(*task);
     if (!task->task || task->task.IsCancelled()) {
       main_thread_only().delayed_incoming_queue.pop();
       continue;
diff --git a/base/test/scoped_task_environment.h b/base/test/scoped_task_environment.h
index bb226e4..c4709f5 100644
--- a/base/test/scoped_task_environment.h
+++ b/base/test/scoped_task_environment.h
@@ -87,27 +87,26 @@
     // Delayed tasks and Time/TimeTicks::Now() use the real-time system clock.
     SYSTEM_TIME,
 
-    // Delayed tasks use a mock clock which only advances (in increments to the
-    // soonest delay) when reaching idle during a FastForward*() call to this
-    // ScopedTaskEnvironment. Or when RunLoop::Run() goes idle on the main
-    // thread with no tasks remaining in the thread pool.
-    // Note: this does not affect threads outside this ScopedTaskEnvironment's
-    // purview (notably: independent base::Thread's).
+    // Delayed tasks use a mock clock which only advances when reaching "idle"
+    // during RunLoop::Run() call on the main thread or a FastForward*() call to
+    // this ScopedTaskEnvironment. "idle" is defined as the main thread and
+    // thread pool being out of ready tasks. When idle, time advances to the
+    // soonest delay -- between main thread and thread pool delayed tasks --
+    // according to the semantics of the current Run*() or FastForward*().
+    //
+    // This also mocks Time/TimeTicks::Now() with the same mock clock.
+    //
+    // Warning some platform APIs are still real-time, e.g.:
+    //   * PlatformThread::Sleep
+    //   * WaitableEvent::TimedWait
+    //   * ConditionVariable::TimedWait
+    //   * Delayed tasks on unmanaged base::Thread's and other custom task
+    //     runners.
     MOCK_TIME,
 
-    // Mock Time/TimeTicks::Now() with the same mock clock used for delayed
-    // tasks. This is useful when a delayed task under test needs to check the
-    // amount of time that has passed since a previous sample of Now() (e.g.
-    // cache expiry).
-    //
-    // Warning some platform APIs are still real-time, and don't interact with
-    // MOCK_TIME as expected, e.g.:
-    //   PlatformThread::Sleep
-    //   WaitableEvent::TimedWait
-    //   ConditionVariable::TimedWait
-    //
-    // TODO(crbug.com/905412): Make MOCK_TIME always mock Time/TimeTicks::Now().
-    MOCK_TIME_AND_NOW,
+    // TODO(gab): MOCK_TIME is now equivalent to MOCK_TIME_AND_NOW. Mass migrate
+    // users of MOCK_TIME_AND_NOW to MOCK_TIME.
+    MOCK_TIME_AND_NOW = MOCK_TIME,
 
     // TODO(gab): Consider making MOCK_TIME the default mode.
     DEFAULT = SYSTEM_TIME
diff --git a/base/threading/platform_thread.h b/base/threading/platform_thread.h
index 339e81f..c85f232 100644
--- a/base/threading/platform_thread.h
+++ b/base/threading/platform_thread.h
@@ -145,10 +145,11 @@
   // Yield the current thread so another thread can be scheduled.
   static void YieldCurrentThread();
 
-  // Sleeps for the specified duration. Note: The sleep duration may be in
-  // base::Time or base::TimeTicks, depending on platform. If you're looking to
-  // use this in unit tests testing delayed tasks, this will be unreliable -
-  // instead, use base::test::ScopedTaskEnvironment with MOCK_TIME mode.
+  // Sleeps for the specified duration (real-time; ignores time overrides).
+  // Note: The sleep duration may be in base::Time or base::TimeTicks, depending
+  // on platform. If you're looking to use this in unit tests testing delayed
+  // tasks, this will be unreliable - instead, use
+  // base::test::ScopedTaskEnvironment with MOCK_TIME mode.
   static void Sleep(base::TimeDelta duration);
 
   // Sets the thread name visible to debuggers/tools. This will try to
diff --git a/base/threading/platform_thread_win.cc b/base/threading/platform_thread_win.cc
index b368609..35cc6a57 100644
--- a/base/threading/platform_thread_win.cc
+++ b/base/threading/platform_thread_win.cc
@@ -16,6 +16,7 @@
 #include "base/threading/scoped_blocking_call.h"
 #include "base/threading/thread_id_name_manager.h"
 #include "base/threading/thread_restrictions.h"
+#include "base/time/time_override.h"
 #include "base/win/scoped_handle.h"
 #include "base/win/windows_version.h"
 #include "build/build_config.h"
@@ -218,9 +219,13 @@
 void PlatformThread::Sleep(TimeDelta duration) {
   // When measured with a high resolution clock, Sleep() sometimes returns much
   // too early. We may need to call it repeatedly to get the desired duration.
-  TimeTicks end = TimeTicks::Now() + duration;
-  for (TimeTicks now = TimeTicks::Now(); now < end; now = TimeTicks::Now())
+  // PlatformThread::Sleep doesn't support mock-time, so this always uses
+  // real-time.
+  const TimeTicks end = subtle::TimeTicksNowIgnoringOverride() + duration;
+  for (TimeTicks now = subtle::TimeTicksNowIgnoringOverride(); now < end;
+       now = subtle::TimeTicksNowIgnoringOverride()) {
     ::Sleep(static_cast<DWORD>((end - now).InMillisecondsRoundedUp()));
+  }
 }
 
 // static
diff --git a/base/timer/elapsed_timer.cc b/base/timer/elapsed_timer.cc
index 74d2f55..f75b40b 100644
--- a/base/timer/elapsed_timer.cc
+++ b/base/timer/elapsed_timer.cc
@@ -6,6 +6,10 @@
 
 namespace base {
 
+namespace {
+bool g_mock_elapsed_timers_for_test = false;
+}  // namespace
+
 ElapsedTimer::ElapsedTimer() : begin_(TimeTicks::Now()) {}
 
 ElapsedTimer::ElapsedTimer(ElapsedTimer&& other) : begin_(other.begin_) {}
@@ -15,6 +19,8 @@
 }
 
 TimeDelta ElapsedTimer::Elapsed() const {
+  if (g_mock_elapsed_timers_for_test)
+    return ScopedMockElapsedTimersForTest::kMockElapsedTime;
   return TimeTicks::Now() - begin_;
 }
 
@@ -23,7 +29,24 @@
       begin_(is_supported_ ? ThreadTicks::Now() : ThreadTicks()) {}
 
 TimeDelta ElapsedThreadTimer::Elapsed() const {
-  return is_supported_ ? (ThreadTicks::Now() - begin_) : TimeDelta();
+  if (!is_supported_)
+    return TimeDelta();
+  if (g_mock_elapsed_timers_for_test)
+    return ScopedMockElapsedTimersForTest::kMockElapsedTime;
+  return ThreadTicks::Now() - begin_;
+}
+
+// static
+constexpr TimeDelta ScopedMockElapsedTimersForTest::kMockElapsedTime;
+
+ScopedMockElapsedTimersForTest::ScopedMockElapsedTimersForTest() {
+  DCHECK(!g_mock_elapsed_timers_for_test);
+  g_mock_elapsed_timers_for_test = true;
+}
+
+ScopedMockElapsedTimersForTest::~ScopedMockElapsedTimersForTest() {
+  DCHECK(g_mock_elapsed_timers_for_test);
+  g_mock_elapsed_timers_for_test = false;
 }
 
 }  // namespace base
diff --git a/base/timer/elapsed_timer.h b/base/timer/elapsed_timer.h
index 59de957..c39f01a 100644
--- a/base/timer/elapsed_timer.h
+++ b/base/timer/elapsed_timer.h
@@ -49,6 +49,25 @@
   DISALLOW_COPY_AND_ASSIGN(ElapsedThreadTimer);
 };
 
+// Whenever there's a ScopedMockElapsedTimersForTest in scope,
+// Elapsed(Thread)Timers will always return kMockElapsedTime from Elapsed().
+// This is useful, for example, in unit tests that verify that their impl
+// records timing histograms. It enables such tests to observe reliable timings.
+class BASE_EXPORT ScopedMockElapsedTimersForTest {
+ public:
+  static constexpr TimeDelta kMockElapsedTime =
+      TimeDelta::FromMilliseconds(1337);
+
+  // ScopedMockElapsedTimersForTest is not thread-safe (it must be instantiated
+  // in a test before other threads begin using ElapsedTimers; and it must
+  // conversely outlive any usage of ElapsedTimer in that test).
+  ScopedMockElapsedTimersForTest();
+  ~ScopedMockElapsedTimersForTest();
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(ScopedMockElapsedTimersForTest);
+};
+
 }  // namespace base
 
 #endif  // BASE_TIMER_ELAPSED_TIMER_H_
diff --git a/base/timer/elapsed_timer_unittest.cc b/base/timer/elapsed_timer_unittest.cc
index 8b65985..5127be34 100644
--- a/base/timer/elapsed_timer_unittest.cc
+++ b/base/timer/elapsed_timer_unittest.cc
@@ -27,6 +27,17 @@
   EXPECT_GE(timer.Elapsed(), 2 * kSleepDuration);
 }
 
+TEST(ElapsedTimerTest, Mocked) {
+  ScopedMockElapsedTimersForTest mock_elapsed_timer;
+
+  ElapsedTimer timer;
+  EXPECT_EQ(timer.Elapsed(), ScopedMockElapsedTimersForTest::kMockElapsedTime);
+
+  // Real-time doesn't matter.
+  PlatformThread::Sleep(kSleepDuration);
+  EXPECT_EQ(timer.Elapsed(), ScopedMockElapsedTimersForTest::kMockElapsedTime);
+}
+
 class ElapsedThreadTimerTest : public ::testing::Test {
  protected:
   void SetUp() override {
@@ -73,4 +84,18 @@
   EXPECT_LT(timer.Elapsed(), kSleepDuration);
 }
 
+TEST_F(ElapsedThreadTimerTest, Mocked) {
+  if (!ThreadTicks::IsSupported())
+    return;
+
+  ScopedMockElapsedTimersForTest mock_elapsed_timer;
+
+  ElapsedThreadTimer timer;
+  EXPECT_EQ(timer.Elapsed(), ScopedMockElapsedTimersForTest::kMockElapsedTime);
+
+  // Real-time doesn't matter.
+  PlatformThread::Sleep(kSleepDuration);
+  EXPECT_EQ(timer.Elapsed(), ScopedMockElapsedTimersForTest::kMockElapsedTime);
+}
+
 }  // namespace base
diff --git a/build/fuchsia/linux.sdk.sha1 b/build/fuchsia/linux.sdk.sha1
index ae7bfa2..df757a60 100644
--- a/build/fuchsia/linux.sdk.sha1
+++ b/build/fuchsia/linux.sdk.sha1
@@ -1 +1 @@
-8906280394466493984
\ No newline at end of file
+8906254133666028832
\ No newline at end of file
diff --git a/build/fuchsia/mac.sdk.sha1 b/build/fuchsia/mac.sdk.sha1
index 6d24487..1e20e6e 100644
--- a/build/fuchsia/mac.sdk.sha1
+++ b/build/fuchsia/mac.sdk.sha1
@@ -1 +1 @@
-8906280210551708592
\ No newline at end of file
+8906256854985066048
\ No newline at end of file
diff --git a/chrome/android/chrome_java_sources.gni b/chrome/android/chrome_java_sources.gni
index bca0a06..e34dd34 100644
--- a/chrome/android/chrome_java_sources.gni
+++ b/chrome/android/chrome_java_sources.gni
@@ -1392,6 +1392,7 @@
   "java/src/org/chromium/chrome/browser/services/AndroidEduOwnerCheckCallback.java",
   "java/src/org/chromium/chrome/browser/services/GoogleServicesManager.java",
   "java/src/org/chromium/chrome/browser/services/gcm/ChromeGcmListenerService.java",
+  "java/src/org/chromium/chrome/browser/services/gcm/GCMBackgroundService.java",
   "java/src/org/chromium/chrome/browser/services/gcm/GCMBackgroundTask.java",
   "java/src/org/chromium/chrome/browser/services/gcm/GcmUma.java",
   "java/src/org/chromium/chrome/browser/services/gcm/InvalidationGcmUpstreamSender.java",
diff --git a/chrome/android/java/AndroidManifest.xml b/chrome/android/java/AndroidManifest.xml
index dd75dd5b..545468e1 100644
--- a/chrome/android/java/AndroidManifest.xml
+++ b/chrome/android/java/AndroidManifest.xml
@@ -1091,6 +1091,8 @@
               <action android:name="com.google.android.c2dm.intent.RECEIVE" />
             </intent-filter>
         </service>
+        <service android:name="org.chromium.chrome.browser.services.gcm.GCMBackgroundService"
+            android:exported="false"/>
         <meta-data android:name="ipc.invalidation.ticl.gcm_upstream_service_class"
             android:value="org.chromium.chrome.browser.services.gcm.InvalidationGcmUpstreamSender" />
         <service android:name="org.chromium.chrome.browser.services.gcm.InvalidationGcmUpstreamSender"
diff --git a/chrome/android/java/monochrome_public_bundle__base_bundle_module.AndroidManifest.expected b/chrome/android/java/monochrome_public_bundle__base_bundle_module.AndroidManifest.expected
index 441a2a3b4d..337c7b9 100644
--- a/chrome/android/java/monochrome_public_bundle__base_bundle_module.AndroidManifest.expected
+++ b/chrome/android/java/monochrome_public_bundle__base_bundle_module.AndroidManifest.expected
@@ -1530,6 +1530,9 @@
     </service>
     <service
         android:exported="false"
+        android:name="org.chromium.chrome.browser.services.gcm.GCMBackgroundService"/>
+    <service
+        android:exported="false"
         android:name="org.chromium.chrome.browser.services.gcm.InvalidationGcmUpstreamSender"/>
     <service
         android:exported="false"
diff --git a/chrome/android/java/res/drawable/navigation_bubble_shadow.xml b/chrome/android/java/res/drawable/navigation_bubble_shadow.xml
new file mode 100644
index 0000000..345a9af7
--- /dev/null
+++ b/chrome/android/java/res/drawable/navigation_bubble_shadow.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2019 The Chromium Authors. All rights reserved.
+     Use of this source code is governed by a BSD-style license that can be
+     found in the LICENSE file. -->
+
+<layer-list
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    android:id="@+id/navigation_bubble_shadow">
+
+    <!-- Drop Shadow -->
+    <item>
+        <shape android:shape="rectangle">
+            <padding
+                android:bottom="@dimen/navigation_bubble_shadow_padding"
+                android:left="@dimen/navigation_bubble_shadow_padding"
+                android:right="@dimen/navigation_bubble_shadow_padding"
+                android:top="@dimen/navigation_bubble_shadow_padding" />
+
+            <corners android:radius="@dimen/navigation_bubble_radius" />
+            <solid android:color="#00CCCCCC" />
+
+        </shape>
+    </item>
+    <item>
+        <shape android:shape="rectangle">
+            <padding
+                android:bottom="@dimen/navigation_bubble_shadow_padding"
+                android:left="@dimen/navigation_bubble_shadow_padding"
+                android:right="@dimen/navigation_bubble_shadow_padding"
+                android:top="@dimen/navigation_bubble_shadow_padding" />
+
+            <corners android:radius="@dimen/navigation_bubble_radius" />
+            <solid android:color="#10CCCCCC" />
+        </shape>
+    </item>
+    <item>
+        <shape android:shape="rectangle">
+            <padding
+                android:bottom="@dimen/navigation_bubble_shadow_padding"
+                android:left="@dimen/navigation_bubble_shadow_padding"
+                android:right="@dimen/navigation_bubble_shadow_padding"
+                android:top="@dimen/navigation_bubble_shadow_padding" />
+
+            <corners android:radius="@dimen/navigation_bubble_radius" />
+            <solid android:color="#20CCCCCC" />
+        </shape>
+    </item>
+    <item>
+        <shape android:shape="rectangle">
+            <padding
+                android:bottom="@dimen/navigation_bubble_shadow_padding"
+                android:left="@dimen/navigation_bubble_shadow_padding"
+                android:right="@dimen/navigation_bubble_shadow_padding"
+                android:top="@dimen/navigation_bubble_shadow_padding" />
+
+            <corners android:radius="@dimen/navigation_bubble_radius" />
+            <solid android:color="#30CCCCCC" />
+        </shape>
+    </item>
+    <item>
+        <shape android:shape="rectangle">
+            <padding
+                android:bottom="@dimen/navigation_bubble_shadow_padding"
+                android:left="@dimen/navigation_bubble_shadow_padding"
+                android:right="@dimen/navigation_bubble_shadow_padding"
+                android:top="@dimen/navigation_bubble_shadow_padding" />
+
+            <corners android:radius="@dimen/navigation_bubble_radius" />
+            <solid android:color="#50CCCCCC" />
+        </shape>
+    </item>
+
+    <!-- Background Color (white) -->
+    <item>
+        <shape android:shape="rectangle">
+            <corners android:radius="@dimen/navigation_bubble_radius" />
+            <solid android:color="@color/navigation_bubble_background_color" />
+        </shape>
+    </item>
+</layer-list>
diff --git a/chrome/android/java/res/layout/navigation_bubble.xml b/chrome/android/java/res/layout/navigation_bubble.xml
index a9ca81d..f4c7ee29 100644
--- a/chrome/android/java/res/layout/navigation_bubble.xml
+++ b/chrome/android/java/res/layout/navigation_bubble.xml
@@ -6,26 +6,33 @@
 
 <org.chromium.chrome.browser.gesturenav.NavigationBubble
     xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:tools="http://schemas.android.com/tools"
-    android:minHeight="@dimen/navigation_bubble_default_height"
+    xmlns:app="http://schemas.android.com/apk/res-auto"
+    android:minHeight="@dimen/navigation_bubble_size"
+    android:layout_width="wrap_content"
     android:gravity="center_vertical"
+    android:background="@drawable/navigation_bubble_shadow"
     android:orientation="horizontal">
 
     <org.chromium.ui.widget.ChromeImageView
-        android:id="@+id/navigation_bubble_icon"
-        android:layout_width="@dimen/navigation_bubble_icon_size"
-        android:layout_height="@dimen/navigation_bubble_icon_size"
-        android:layout_marginStart="@dimen/navigation_bubble_icon_leading_margin" />
+        android:id="@+id/navigation_bubble_arrow"
+        android:layout_width="@dimen/navigation_bubble_arrow_size"
+        android:layout_height="@dimen/navigation_bubble_arrow_size"
+        app:srcCompat="@drawable/ic_arrow_back_24dp"
+        android:visibility="gone"
+        android:paddingStart="@dimen/navigation_bubble_start_padding"
+        android:paddingTop="@dimen/navigation_bubble_top_padding"
+        android:paddingBottom="@dimen/navigation_bubble_bottom_padding"
+        android:importantForAccessibility="no" />
     <TextView
         android:id="@+id/navigation_bubble_text"
         android:layout_width="wrap_content"
         android:layout_height="match_parent"
         android:gravity="center"
-        android:paddingStart="@dimen/navigation_bubble_horizontal_padding"
-        android:paddingTop="@dimen/navigation_bubble_vertical_padding"
-        android:paddingEnd="@dimen/navigation_bubble_horizontal_padding"
-        android:paddingBottom="@dimen/navigation_bubble_vertical_padding"
         android:textAppearance="@style/TextAppearance.BlackTitle2"
-        android:maxLines="1"
-        android:ellipsize="end" />
+        android:paddingTop="@dimen/navigation_bubble_text_top_padding"
+        android:paddingStart="@dimen/navigation_bubble_text_start_padding"
+        android:paddingEnd="@dimen/navigation_bubble_text_end_padding"
+        android:paddingBottom="@dimen/navigation_bubble_text_bottom_padding"
+        android:visibility="gone"
+        android:maxLines="1" />
 </org.chromium.chrome.browser.gesturenav.NavigationBubble>
diff --git a/chrome/android/java/res/values/colors.xml b/chrome/android/java/res/values/colors.xml
index d2ca0cf..71a5271ed 100644
--- a/chrome/android/java/res/values/colors.xml
+++ b/chrome/android/java/res/values/colors.xml
@@ -178,9 +178,7 @@
     <color name="payments_section_chevron">#B2B2B2</color>
 
     <!-- History Navigation UI colors -->
-    <color name="navigation_bubble_stroke_color">@color/hairline_stroke_color</color>
     <color name="navigation_bubble_background_color">@color/default_bg_color_elev_4</color>
-    <color name="navigation_bubble_ripple_color">@color/modern_grey_800</color>
 
     <!-- Other colors -->
     <color name="media_viewer_bg">#000000</color>
diff --git a/chrome/android/java/res/values/dimens.xml b/chrome/android/java/res/values/dimens.xml
index c4577f9..a0a37da 100644
--- a/chrome/android/java/res/values/dimens.xml
+++ b/chrome/android/java/res/values/dimens.xml
@@ -625,11 +625,15 @@
     <dimen name="radio_button_with_description_vertical_padding">10dp</dimen>
 
     <!-- History Navigation UI Item -->
-    <dimen name="navigation_bubble_border_width">1dp</dimen>
-    <dimen name="navigation_bubble_default_height">32dp</dimen>
-    <dimen name="navigation_bubble_bg_vertical_inset">0dp</dimen>
-    <dimen name="navigation_bubble_vertical_padding">4dp</dimen>
-    <dimen name="navigation_bubble_horizontal_padding">8dp</dimen>
-    <dimen name="navigation_bubble_icon_size">20dp</dimen>
-    <dimen name="navigation_bubble_icon_leading_margin">8dp</dimen>
+    <dimen name="navigation_bubble_size">40dp</dimen>
+    <dimen name="navigation_bubble_radius">20dp</dimen>
+    <dimen name="navigation_bubble_shadow_padding">1dp</dimen>
+    <dimen name="navigation_bubble_arrow_size">28dp</dimen>
+    <dimen name="navigation_bubble_start_padding">2dp</dimen>
+    <dimen name="navigation_bubble_top_padding">4dp</dimen>
+    <dimen name="navigation_bubble_bottom_padding">4dp</dimen>
+    <dimen name="navigation_bubble_text_top_padding">3dp</dimen>
+    <dimen name="navigation_bubble_text_bottom_padding">5dp</dimen>
+    <dimen name="navigation_bubble_text_start_padding">2dp</dimen>
+    <dimen name="navigation_bubble_text_end_padding">8dp</dimen>
 </resources>
diff --git a/chrome/android/java/res_night/values-night/colors.xml b/chrome/android/java/res_night/values-night/colors.xml
index 0685d50..59c0560 100644
--- a/chrome/android/java/res_night/values-night/colors.xml
+++ b/chrome/android/java/res_night/values-night/colors.xml
@@ -33,6 +33,6 @@
     <color name="photo_picker_special_tile_bg_color">@color/modern_grey_800</color>
 
     <!-- History Navigation UI colors -->
-    <color name="navigation_bubble_ripple_color">@android:color/white</color>
+    <color name="navigation_bubble_background_color">@android:color/white</color>
 
 </resources>
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/gesturenav/NavigationBubble.java b/chrome/android/java/src/org/chromium/chrome/browser/gesturenav/NavigationBubble.java
index cfcb17d8..c1d2402 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/gesturenav/NavigationBubble.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/gesturenav/NavigationBubble.java
@@ -10,22 +10,19 @@
 import android.view.View;
 import android.view.ViewGroup;
 import android.view.animation.Animation.AnimationListener;
+import android.widget.ImageView;
 import android.widget.LinearLayout;
 import android.widget.TextView;
 
 import org.chromium.base.ApiCompatibilityUtils;
 import org.chromium.chrome.R;
-import org.chromium.ui.widget.ChromeImageView;
-import org.chromium.ui.widget.RippleBackgroundHelper;
 
 /**
  * View class for a bubble used in gesture navigation UI that consists of an icon
  * and an optional text.
  */
 public class NavigationBubble extends LinearLayout {
-    private final RippleBackgroundHelper mRippleBackgroundHelper;
-
-    private ChromeImageView mIcon;
+    private ImageView mIcon;
     private TextView mText;
     private AnimationListener mListener;
 
@@ -45,19 +42,12 @@
         if (Build.VERSION.SDK_INT < Build.VERSION_CODES.LOLLIPOP) {
             setLayerType(View.LAYER_TYPE_SOFTWARE, null);
         }
-
-        // Reset icon and background. Height is used as corner radius to ensure we have a circle.
-        mRippleBackgroundHelper = new RippleBackgroundHelper(this,
-                R.color.navigation_bubble_background_color, R.color.navigation_bubble_ripple_color,
-                getResources().getDimensionPixelSize(R.dimen.navigation_bubble_default_height),
-                R.color.navigation_bubble_stroke_color, R.dimen.navigation_bubble_border_width,
-                getResources().getDimensionPixelSize(R.dimen.navigation_bubble_bg_vertical_inset));
     }
 
     @Override
     protected void onFinishInflate() {
         super.onFinishInflate();
-        mIcon = findViewById(R.id.navigation_bubble_icon);
+        mIcon = findViewById(R.id.navigation_bubble_arrow);
         mText = findViewById(R.id.navigation_bubble_text);
     }
 
@@ -107,14 +97,6 @@
         }
     }
 
-    @Override
-    protected void drawableStateChanged() {
-        super.drawableStateChanged();
-        if (mRippleBackgroundHelper != null) {
-            mRippleBackgroundHelper.onDrawableStateChanged();
-        }
-    }
-
     /**
      * Sets the icon at the start of the icon view.
      * @param icon The resource id pointing to the icon.
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/services/gcm/ChromeGcmListenerService.java b/chrome/android/java/src/org/chromium/chrome/browser/services/gcm/ChromeGcmListenerService.java
index 8eead94..65b49ad 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/services/gcm/ChromeGcmListenerService.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/services/gcm/ChromeGcmListenerService.java
@@ -5,6 +5,7 @@
 package org.chromium.chrome.browser.services.gcm;
 
 import android.content.Context;
+import android.content.Intent;
 import android.os.Build;
 import android.os.Bundle;
 import android.os.SystemClock;
@@ -35,6 +36,7 @@
  */
 public class ChromeGcmListenerService extends GcmListenerService {
     private static final String TAG = "ChromeGcmListener";
+    private static final String SHARING_APP_ID = "com.google.chrome.sharing.fcm";
 
     @Override
     public void onCreate() {
@@ -90,6 +92,35 @@
     }
 
     /**
+     * Returns if we deliver the GCMMessage with a background service by calling
+     * Context#startService. This will only work if Android has put us in a whitelist to allow
+     * background services to be started.
+     */
+    private static boolean maybeBypassScheduler(GCMMessage message) {
+        // Android only puts us on a whitelist for high priority messages.
+        if (message.getOriginalPriority() != GCMMessage.Priority.HIGH
+                || !SHARING_APP_ID.equals(message.getAppId())) {
+            return false;
+        }
+
+        // Receiving a high priority push message should put us in a whitelist to start
+        // background services.
+        try {
+            Context context = ContextUtils.getApplicationContext();
+            Intent intent = new Intent(context, GCMBackgroundService.class);
+            intent.putExtras(message.toBundle());
+            context.startService(intent);
+            return true;
+        } catch (IllegalStateException e) {
+            // Failed to start service, maybe we're not whitelisted? Fallback to using
+            // BackgroundTaskScheduler to start Chrome.
+            // TODO(knollr): Add metrics for this.
+            Log.e(TAG, "Could not start background service", e);
+            return false;
+        }
+    }
+
+    /**
      * If Chrome is backgrounded, messages coming from lazy subscriptions are
      * persisted on disk and replayed next time Chrome is forgrounded. If Chrome is forgrounded or
      * if the message isn't coming from a lazy subscription, this method either schedules |message|
@@ -123,6 +154,11 @@
         }
 
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N) {
+            if (maybeBypassScheduler(message)) {
+                // We've bypassed the scheduler, so nothing to do here.
+                return;
+            }
+
             Bundle extras = message.toBundle();
 
             // TODO(peter): Add UMA for measuring latency introduced by the BackgroundTaskScheduler.
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/services/gcm/GCMBackgroundService.java b/chrome/android/java/src/org/chromium/chrome/browser/services/gcm/GCMBackgroundService.java
new file mode 100644
index 0000000..1ce2695a
--- /dev/null
+++ b/chrome/android/java/src/org/chromium/chrome/browser/services/gcm/GCMBackgroundService.java
@@ -0,0 +1,43 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.chrome.browser.services.gcm;
+
+import android.annotation.TargetApi;
+import android.app.IntentService;
+import android.content.Intent;
+import android.os.Build;
+import android.os.Bundle;
+
+import org.chromium.base.Log;
+import org.chromium.base.task.PostTask;
+import org.chromium.components.gcm_driver.GCMMessage;
+import org.chromium.content_public.browser.UiThreadTaskTraits;
+
+/**
+ * Service that dispatches a GCM message in the background. Launched from ChromeGcmListenerService
+ * if we received a high priority push message, as that should allow us to start a background
+ * service even if Chrome is not running.
+ */
+@TargetApi(Build.VERSION_CODES.N)
+public class GCMBackgroundService extends IntentService {
+    private static final String TAG = "GCMBackgroundService";
+
+    public GCMBackgroundService() {
+        super(TAG);
+    }
+
+    @Override
+    protected void onHandleIntent(Intent intent) {
+        Bundle extras = intent.getExtras();
+        GCMMessage message = GCMMessage.createFromBundle(extras);
+        if (message == null) {
+            Log.e(TAG, "The received bundle containing message data could not be validated.");
+            return;
+        }
+
+        PostTask.runSynchronously(UiThreadTaskTraits.DEFAULT,
+                () -> ChromeGcmListenerService.dispatchMessageToDriver(this, message));
+    }
+}
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/signin/SigninFragmentBase.java b/chrome/android/java/src/org/chromium/chrome/browser/signin/SigninFragmentBase.java
index 3cd983e..c1860e8e 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/signin/SigninFragmentBase.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/signin/SigninFragmentBase.java
@@ -75,14 +75,13 @@
     private static final int ADD_ACCOUNT_REQUEST_CODE = 1;
 
     @IntDef({SigninFlowType.DEFAULT, SigninFlowType.FORCED, SigninFlowType.CHOOSE_ACCOUNT,
-            SigninFlowType.ADD_ACCOUNT, SigninFlowType.CONSENT_BUMP})
+            SigninFlowType.ADD_ACCOUNT})
     @Retention(RetentionPolicy.SOURCE)
     @interface SigninFlowType {
         int DEFAULT = 0;
         int FORCED = 1;
         int CHOOSE_ACCOUNT = 2;
         int ADD_ACCOUNT = 3;
-        int CONSENT_BUMP = 4;
     }
 
     private @SigninFlowType int mSigninFlowType;
@@ -159,17 +158,6 @@
         return result;
     }
 
-    /**
-     * Creates an argument bundle for the consent bump screen.
-     * @param accountName The name of the signed in account.
-     */
-    protected static Bundle createArgumentsForConsentBumpFlow(String accountName) {
-        Bundle result = new Bundle();
-        result.putInt(ARGUMENT_SIGNIN_FLOW_TYPE, SigninFlowType.CONSENT_BUMP);
-        result.putString(ARGUMENT_ACCOUNT_NAME, accountName);
-        return result;
-    }
-
     protected SigninFragmentBase() {
         mAccountsChangedObserver = this::triggerUpdateAccounts;
         mProfileDataCacheObserver = (String accountId) -> updateProfileData();
@@ -206,11 +194,6 @@
         return mSigninFlowType == SigninFlowType.FORCED;
     }
 
-    /** Returns whether this fragment is in Consent bump mode. */
-    protected boolean isConsentBump() {
-        return mSigninFlowType == SigninFlowType.CONSENT_BUMP;
-    }
-
     @Override
     public void onCreate(@Nullable Bundle savedInstanceState) {
         super.onCreate(savedInstanceState);
@@ -289,8 +272,6 @@
             endImageViewDrawable = SigninView.getCheckmarkDrawable(getContext());
             mView.getRefuseButton().setVisibility(View.GONE);
             mView.getAcceptButtonEndPadding().setVisibility(View.INVISIBLE);
-        } else if (mSigninFlowType == SigninFlowType.CONSENT_BUMP) {
-            endImageViewDrawable = SigninView.getCheckmarkDrawable(getContext());
         } else {
             endImageViewDrawable = SigninView.getExpandArrowDrawable(getContext());
         }
@@ -378,7 +359,7 @@
     }
 
     private void onAccountPickerClicked() {
-        if (isForcedSignin() || isConsentBump() || !areControlsEnabled()) return;
+        if (isForcedSignin() || !areControlsEnabled()) return;
         showAccountPicker();
     }
 
diff --git a/chrome/android/modules/chrome_feature_module_tmpl.gni b/chrome/android/modules/chrome_feature_module_tmpl.gni
index ed1de3b..5121556 100644
--- a/chrome/android/modules/chrome_feature_module_tmpl.gni
+++ b/chrome/android/modules/chrome_feature_module_tmpl.gni
@@ -137,6 +137,7 @@
             !build_apk_secondary_abi || android_64bit_target_cpu
         _native_need_placeholder =
             build_apk_secondary_abi && _include_32_bit_webview
+        not_needed([ "_include_32_bit_webview" ])
       } else {
         assert(_loadable_modules_32_bit != [])
         not_needed([
diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
index eb6cd6b..9e883b9 100644
--- a/chrome/browser/BUILD.gn
+++ b/chrome/browser/BUILD.gn
@@ -1028,8 +1028,6 @@
     "page_load_metrics/resource_tracker.h",
     "password_manager/chrome_password_manager_client.cc",
     "password_manager/chrome_password_manager_client.h",
-    "password_manager/password_manager_util_linux.cc",
-    "password_manager/password_manager_util_linux.h",
     "password_manager/password_manager_util_mac.h",
     "password_manager/password_manager_util_mac.mm",
     "password_manager/password_manager_util_win.cc",
diff --git a/chrome/browser/DEPS b/chrome/browser/DEPS
index 75fc5c9..678317b 100644
--- a/chrome/browser/DEPS
+++ b/chrome/browser/DEPS
@@ -330,7 +330,7 @@
   "+third_party/widevine/cdm/widevine_cdm_common.h",
 
   # Code under //ash runs out-of-process in mash so it must be accessed via mojo
-  # interfaces in //ash/public/interfaces. See //ash/README.md.
+  # interfaces in //ash/public/mojom. See //ash/README.md.
   "-ash",
   "+ash/public",
   "+ash/keyboard/ui/public",
diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
index 1c5a794..0cbb885 100644
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc
@@ -1609,10 +1609,6 @@
     {"debug-packed-apps", flag_descriptions::kDebugPackedAppName,
      flag_descriptions::kDebugPackedAppDescription, kOsDesktop,
      SINGLE_VALUE_TYPE(switches::kDebugPackedApps)},
-    {"automatic-password-generation",
-     flag_descriptions::kAutomaticPasswordGenerationName,
-     flag_descriptions::kAutomaticPasswordGenerationDescription, kOsAll,
-     FEATURE_VALUE_TYPE(autofill::features::kAutomaticPasswordGeneration)},
     {"new-password-form-parsing",
      flag_descriptions::kNewPasswordFormParsingName,
      flag_descriptions::kNewPasswordFormParsingDescription, kOsAll,
@@ -3632,11 +3628,6 @@
      flag_descriptions::kEnableFilesystemInIncognitoDescription, kOsAll,
      FEATURE_VALUE_TYPE(storage::features::kEnableFilesystemInIncognito)},
 
-    {"enable-incognito-window-counter",
-     flag_descriptions::kEnableIncognitoWindowCounterName,
-     flag_descriptions::kEnableIncognitoWindowCounterDescription, kOsDesktop,
-     FEATURE_VALUE_TYPE(features::kEnableIncognitoWindowCounter)},
-
     {"enable-send-tab-to-self", flag_descriptions::kSendTabToSelfName,
      flag_descriptions::kSendTabToSelfDescription, kOsAll,
      FEATURE_VALUE_TYPE(switches::kSyncSendTabToSelf)},
diff --git a/chrome/browser/accessibility/accessibility_extension_api.cc b/chrome/browser/accessibility/accessibility_extension_api.cc
index 55e9b36..135b4ca 100644
--- a/chrome/browser/accessibility/accessibility_extension_api.cc
+++ b/chrome/browser/accessibility/accessibility_extension_api.cc
@@ -45,7 +45,7 @@
 #include "ash/public/cpp/accessibility_focus_ring_info.h"
 #include "ash/public/cpp/event_rewriter_controller.h"
 #include "ash/public/cpp/window_tree_host_lookup.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "chrome/browser/chromeos/accessibility/accessibility_manager.h"
 #include "chrome/browser/chromeos/arc/accessibility/arc_accessibility_helper_bridge.h"
 #include "ui/aura/window_tree_host.h"
diff --git a/chrome/browser/apps/app_service/app_icon_factory.cc b/chrome/browser/apps/app_service/app_icon_factory.cc
index 3a362e5..da0b36a 100644
--- a/chrome/browser/apps/app_service/app_icon_factory.cc
+++ b/chrome/browser/apps/app_service/app_icon_factory.cc
@@ -160,65 +160,6 @@
                      std::move(callback)));
 }
 
-// Like RunCallbackWithCompressedData, but calls "fallback(callback)" if the
-// data is empty.
-void RunCallbackWithCompressedDataWithFallback(
-    int size_hint_in_dip,
-    bool is_placeholder_icon,
-    apps::IconEffects icon_effects,
-    apps::mojom::Publisher::LoadIconCallback callback,
-    base::OnceCallback<void(apps::mojom::Publisher::LoadIconCallback)> fallback,
-    std::vector<uint8_t> data) {
-  if (data.empty()) {
-    std::move(fallback).Run(std::move(callback));
-    return;
-  }
-  constexpr int default_icon_resource = 0;
-  RunCallbackWithCompressedData(size_hint_in_dip, default_icon_resource,
-                                is_placeholder_icon, icon_effects,
-                                std::move(callback), std::move(data));
-}
-
-// Runs |callback| passing an IconValuePtr with an uncompressed image: a
-// SkBitmap.
-void RunCallbackWithUncompressedSkBitmap(
-    int size_hint_in_dip,
-    bool is_placeholder_icon,
-    apps::IconEffects icon_effects,
-    apps::mojom::Publisher::LoadIconCallback callback,
-    const SkBitmap& bitmap) {
-  apps::mojom::IconValuePtr iv = apps::mojom::IconValue::New();
-  iv->icon_compression = apps::mojom::IconCompression::kUncompressed;
-  iv->uncompressed = gfx::ImageSkia(gfx::ImageSkiaRep(bitmap, 0.0f));
-  iv->is_placeholder_icon = is_placeholder_icon;
-  if (icon_effects && !iv->uncompressed.isNull()) {
-    ApplyIconEffects(icon_effects, size_hint_in_dip, &iv->uncompressed);
-  }
-  std::move(callback).Run(std::move(iv));
-}
-
-// Runs |callback| after converting (in a separate sandboxed process) from a
-// std::vector<uint8_t> to a SkBitmap. It calls "fallback(callback)" if the
-// data is empty.
-void RunCallbackWithCompressedDataToUncompressWithFallback(
-    int size_hint_in_dip,
-    bool is_placeholder_icon,
-    apps::IconEffects icon_effects,
-    apps::mojom::Publisher::LoadIconCallback callback,
-    base::OnceCallback<void(apps::mojom::Publisher::LoadIconCallback)> fallback,
-    std::vector<uint8_t> data) {
-  if (data.empty()) {
-    std::move(fallback).Run(std::move(callback));
-    return;
-  }
-  data_decoder::DecodeImage(
-      content::GetSystemConnector(), data,
-      data_decoder::mojom::ImageCodec::DEFAULT, false,
-      data_decoder::kDefaultMaxSizeInBytes, gfx::Size(),
-      base::BindOnce(&RunCallbackWithUncompressedSkBitmap, size_hint_in_dip,
-                     is_placeholder_icon, icon_effects, std::move(callback)));
-}
-
 // Runs |callback| passing an IconValuePtr with an uncompressed image: an
 // ImageSkia.
 //
@@ -265,6 +206,53 @@
       icon_effects, std::move(callback), image.AsImageSkia());
 }
 
+// Runs |callback| passing an IconValuePtr with an uncompressed image: a
+// SkBitmap.
+void RunCallbackWithUncompressedSkBitmap(
+    int size_hint_in_dip,
+    bool is_placeholder_icon,
+    apps::IconEffects icon_effects,
+    apps::mojom::Publisher::LoadIconCallback callback,
+    const SkBitmap& bitmap) {
+  constexpr int default_icon_resource = 0;
+  gfx::ImageSkia image = gfx::ImageSkia(gfx::ImageSkiaRep(bitmap, 0.0f));
+  RunCallbackWithUncompressedImageSkia(size_hint_in_dip, default_icon_resource,
+                                       is_placeholder_icon, icon_effects,
+                                       std::move(callback), image);
+}
+
+// Runs |callback| after converting (in a separate sandboxed process) from a
+// std::vector<uint8_t> to a SkBitmap. It calls "fallback(callback)" if the
+// data is empty.
+void RunCallbackWithFallback(
+    int size_hint_in_dip,
+    bool is_placeholder_icon,
+    apps::IconEffects icon_effects,
+    apps::mojom::IconCompression icon_compression,
+    apps::mojom::Publisher::LoadIconCallback callback,
+    base::OnceCallback<void(apps::mojom::Publisher::LoadIconCallback)> fallback,
+    std::vector<uint8_t> data) {
+  if (data.empty()) {
+    std::move(fallback).Run(std::move(callback));
+    return;
+  }
+
+  if (icon_compression == apps::mojom::IconCompression::kCompressed) {
+    constexpr int default_icon_resource = 0;
+    RunCallbackWithCompressedData(size_hint_in_dip, default_icon_resource,
+                                  is_placeholder_icon, icon_effects,
+                                  std::move(callback), std::move(data));
+    return;
+  }
+
+  data_decoder::DecodeImage(
+      content::GetSystemConnector(), data,
+      data_decoder::mojom::ImageCodec::DEFAULT, false,
+      data_decoder::kDefaultMaxSizeInBytes, gfx::Size(),
+      base::BindOnce(&RunCallbackWithUncompressedSkBitmap, size_hint_in_dip,
+                     is_placeholder_icon, icon_effects, std::move(callback)));
+}
+
 }  // namespace
 
 namespace apps {
@@ -334,23 +322,13 @@
     case apps::mojom::IconCompression::kUnknown:
       break;
 
-    case apps::mojom::IconCompression::kUncompressed: {
-      base::PostTaskWithTraitsAndReplyWithResult(
-          FROM_HERE, {base::MayBlock(), base::TaskPriority::USER_VISIBLE},
-          base::BindOnce(&ReadFileAsCompressedData, path),
-          base::BindOnce(&RunCallbackWithCompressedDataToUncompressWithFallback,
-                         size_hint_in_dip, is_placeholder_icon, icon_effects,
-                         std::move(callback), std::move(fallback)));
-
-      return;
-    }
-
+    case apps::mojom::IconCompression::kUncompressed:
     case apps::mojom::IconCompression::kCompressed: {
       base::PostTaskWithTraitsAndReplyWithResult(
           FROM_HERE, {base::MayBlock(), base::TaskPriority::USER_VISIBLE},
           base::BindOnce(&ReadFileAsCompressedData, path),
-          base::BindOnce(&RunCallbackWithCompressedDataWithFallback,
-                         size_hint_in_dip, is_placeholder_icon, icon_effects,
+          base::BindOnce(&RunCallbackWithFallback, size_hint_in_dip,
+                         is_placeholder_icon, icon_effects, icon_compression,
                          std::move(callback), std::move(fallback)));
       return;
     }
diff --git a/chrome/browser/apps/app_service/arc_apps.cc b/chrome/browser/apps/app_service/arc_apps.cc
index 90e3ac0..8913983 100644
--- a/chrome/browser/apps/app_service/arc_apps.cc
+++ b/chrome/browser/apps/app_service/arc_apps.cc
@@ -170,7 +170,7 @@
 ArcApps::ArcApps(Profile* profile) : ArcApps(profile, nullptr) {}
 
 ArcApps::ArcApps(Profile* profile, apps::AppServiceProxy* proxy)
-    : binding_(this), profile_(profile), prefs_(nullptr) {
+    : binding_(this), profile_(profile) {
   if (!arc::IsArcAllowedForProfile(profile_) ||
       (arc::ArcServiceManager::Get() == nullptr)) {
     return;
@@ -184,12 +184,13 @@
     return;
   }
 
-  prefs_ = ArcAppListPrefs::Get(profile);
-  if (!prefs_) {
+  // Make some observee-observer connections.
+  ArcAppListPrefs* prefs = ArcAppListPrefs::Get(profile_);
+  if (!prefs) {
     return;
   }
-  prefs_->AddObserver(this);
-  prefs_->app_connection_holder()->AddObserver(this);
+  prefs->AddObserver(this);
+  prefs->app_connection_holder()->AddObserver(this);
 
   apps::mojom::PublisherPtr publisher;
   binding_.Bind(mojo::MakeRequest(&publisher));
@@ -204,25 +205,51 @@
     std::move(pending).Run(nullptr);
   }
   pending_load_icon_calls_.clear();
+}
 
-  if (prefs_) {
-    auto* holder = prefs_->app_connection_holder();
+void ArcApps::Shutdown() {
+  // Disconnect the observee-observer connections that we made during the
+  // constructor.
+  //
+  // This isn't entirely correct. The object returned by
+  // ArcAppListPrefs::Get(some_profile) can vary over the lifetime of that
+  // profile. If it changed, we'll try to disconnect from different
+  // ArcAppListPrefs-related objects than the ones we connected to, at the time
+  // of this object's construction.
+  //
+  // Even so, this is probably harmless, assuming that calling
+  // foo->RemoveObserver(bar) is a no-op (and e.g. does not crash) if bar
+  // wasn't observing foo in the first place, and assuming that the dangling
+  // observee-observer connection on the old foo's are never followed again.
+  //
+  // To fix this properly, we would probably need to add something like an
+  // OnArcAppListPrefsWillBeDestroyed method to ArcAppListPrefs::Observer, and
+  // in this class's implementation of that method, disconnect. Furthermore,
+  // when the new ArcAppListPrefs object is created, we'll have to somehow be
+  // notified so we can re-connect this object as an observer.
+  ArcAppListPrefs* prefs = ArcAppListPrefs::Get(profile_);
+  if (prefs) {
+    auto* holder = prefs->app_connection_holder();
     // The null check is for unit tests. On production, |holder| is always
     // non-null.
     if (holder) {
       holder->RemoveObserver(this);
     }
-    prefs_->RemoveObserver(this);
+    prefs->RemoveObserver(this);
   }
 }
 
 void ArcApps::Connect(apps::mojom::SubscriberPtr subscriber,
                       apps::mojom::ConnectOptionsPtr opts) {
   std::vector<apps::mojom::AppPtr> apps;
-  for (const auto& app_id : prefs_->GetAppIds()) {
-    std::unique_ptr<ArcAppListPrefs::AppInfo> app_info = prefs_->GetApp(app_id);
-    if (app_info) {
-      apps.push_back(Convert(app_id, *app_info));
+  ArcAppListPrefs* prefs = ArcAppListPrefs::Get(profile_);
+  if (prefs) {
+    for (const auto& app_id : prefs->GetAppIds()) {
+      std::unique_ptr<ArcAppListPrefs::AppInfo> app_info =
+          prefs->GetApp(app_id);
+      if (app_info) {
+        apps.push_back(Convert(prefs, app_id, *app_info));
+      }
     }
   }
   subscriber->OnApps(std::move(apps));
@@ -303,8 +330,12 @@
 
 void ArcApps::SetPermission(const std::string& app_id,
                             apps::mojom::PermissionPtr permission) {
+  ArcAppListPrefs* prefs = ArcAppListPrefs::Get(profile_);
+  if (!prefs) {
+    return;
+  }
   const std::unique_ptr<ArcAppListPrefs::AppInfo> app_info =
-      prefs_->GetApp(app_id);
+      prefs->GetApp(app_id);
   if (!app_info) {
     LOG(ERROR) << "SetPermission failed, could not find app with id " << app_id;
     return;
@@ -345,8 +376,12 @@
 }
 
 void ArcApps::OpenNativeSettings(const std::string& app_id) {
+  ArcAppListPrefs* prefs = ArcAppListPrefs::Get(profile_);
+  if (!prefs) {
+    return;
+  }
   const std::unique_ptr<ArcAppListPrefs::AppInfo> app_info =
-      prefs_->GetApp(app_id);
+      prefs->GetApp(app_id);
   if (!app_info) {
     LOG(ERROR) << "Cannot open native settings for " << app_id
                << ". App is not found.";
@@ -358,7 +393,11 @@
 }
 
 void ArcApps::OnConnectionReady() {
-  AppConnectionHolder* app_connection_holder = prefs_->app_connection_holder();
+  ArcAppListPrefs* prefs = ArcAppListPrefs::Get(profile_);
+  if (!prefs) {
+    return;
+  }
+  AppConnectionHolder* app_connection_holder = prefs->app_connection_holder();
   for (auto& pending : pending_load_icon_calls_) {
     std::move(pending).Run(app_connection_holder);
   }
@@ -367,12 +406,18 @@
 
 void ArcApps::OnAppRegistered(const std::string& app_id,
                               const ArcAppListPrefs::AppInfo& app_info) {
-  Publish(Convert(app_id, app_info));
+  ArcAppListPrefs* prefs = ArcAppListPrefs::Get(profile_);
+  if (prefs) {
+    Publish(Convert(prefs, app_id, app_info));
+  }
 }
 
 void ArcApps::OnAppStatesChanged(const std::string& app_id,
                                  const ArcAppListPrefs::AppInfo& app_info) {
-  Publish(Convert(app_id, app_info));
+  ArcAppListPrefs* prefs = ArcAppListPrefs::Get(profile_);
+  if (prefs) {
+    Publish(Convert(prefs, app_id, app_info));
+  }
 }
 
 void ArcApps::OnAppRemoved(const std::string& app_id) {
@@ -403,14 +448,19 @@
 }
 
 void ArcApps::OnAppLastLaunchTimeUpdated(const std::string& app_id) {
-  std::unique_ptr<ArcAppListPrefs::AppInfo> app_info = prefs_->GetApp(app_id);
-  if (app_info) {
-    apps::mojom::AppPtr app = apps::mojom::App::New();
-    app->app_type = apps::mojom::AppType::kArc;
-    app->app_id = app_id;
-    app->last_launch_time = app_info->last_launch_time;
-    Publish(std::move(app));
+  ArcAppListPrefs* prefs = ArcAppListPrefs::Get(profile_);
+  if (!prefs) {
+    return;
   }
+  std::unique_ptr<ArcAppListPrefs::AppInfo> app_info = prefs->GetApp(app_id);
+  if (!app_info) {
+    return;
+  }
+  apps::mojom::AppPtr app = apps::mojom::App::New();
+  app->app_type = apps::mojom::AppType::kArc;
+  app->app_id = app_id;
+  app->last_launch_time = app_info->last_launch_time;
+  Publish(std::move(app));
 }
 
 void ArcApps::OnPackageInstalled(
@@ -424,20 +474,28 @@
 }
 
 void ArcApps::OnPackageListInitialRefreshed() {
-  for (const auto& app_id : prefs_->GetAppIds()) {
-    std::unique_ptr<ArcAppListPrefs::AppInfo> app_info = prefs_->GetApp(app_id);
+  ArcAppListPrefs* prefs = ArcAppListPrefs::Get(profile_);
+  if (!prefs) {
+    return;
+  }
+  for (const auto& app_id : prefs->GetAppIds()) {
+    std::unique_ptr<ArcAppListPrefs::AppInfo> app_info = prefs->GetApp(app_id);
     if (app_info) {
-      Publish(Convert(app_id, *app_info));
+      Publish(Convert(prefs, app_id, *app_info));
     }
   }
 }
 
 const base::FilePath ArcApps::GetCachedIconFilePath(const std::string& app_id,
                                                     int32_t size_hint_in_dip) {
+  ArcAppListPrefs* prefs = ArcAppListPrefs::Get(profile_);
+  if (!prefs) {
+    return base::FilePath();
+  }
   // TODO(crbug.com/826982): process the app_id argument like the private
   // GetAppFromAppOrGroupId function and the ArcAppIcon::mapped_app_id_ field
   // in arc_app_icon.cc?
-  return prefs_->GetIconPath(
+  return prefs->GetIconPath(
       app_id,
       ArcAppIconDescriptor(size_hint_in_dip,
                            apps_util::GetPrimaryDisplayUIScaleFactor()));
@@ -457,22 +515,25 @@
     return;
   }
 
-  std::unique_ptr<ArcAppListPrefs::AppInfo> app_info = prefs_->GetApp(app_id);
-  if (app_info) {
-    base::OnceCallback<void(apps::ArcApps::AppConnectionHolder*)> pending =
-        base::BindOnce(&LoadIcon0, icon_compression,
-                       apps_util::ConvertDipToPx(size_hint_in_dip),
-                       app_info->package_name, app_info->activity,
-                       app_info->icon_resource_id, std::move(callback));
+  ArcAppListPrefs* prefs = ArcAppListPrefs::Get(profile_);
+  if (prefs) {
+    std::unique_ptr<ArcAppListPrefs::AppInfo> app_info = prefs->GetApp(app_id);
+    if (app_info) {
+      base::OnceCallback<void(apps::ArcApps::AppConnectionHolder*)> pending =
+          base::BindOnce(&LoadIcon0, icon_compression,
+                         apps_util::ConvertDipToPx(size_hint_in_dip),
+                         app_info->package_name, app_info->activity,
+                         app_info->icon_resource_id, std::move(callback));
 
-    AppConnectionHolder* app_connection_holder =
-        prefs_->app_connection_holder();
-    if (app_connection_holder->IsConnected()) {
-      std::move(pending).Run(app_connection_holder);
-    } else {
-      pending_load_icon_calls_.push_back(std::move(pending));
+      AppConnectionHolder* app_connection_holder =
+          prefs->app_connection_holder();
+      if (app_connection_holder->IsConnected()) {
+        std::move(pending).Run(app_connection_holder);
+      } else {
+        pending_load_icon_calls_.push_back(std::move(pending));
+      }
+      return;
     }
-    return;
   }
 
   // On failure, we still run the callback, with the zero IconValue.
@@ -509,7 +570,8 @@
   return apps::mojom::InstallSource::kUser;
 }
 
-apps::mojom::AppPtr ArcApps::Convert(const std::string& app_id,
+apps::mojom::AppPtr ArcApps::Convert(ArcAppListPrefs* prefs,
+                                     const std::string& app_id,
                                      const ArcAppListPrefs::AppInfo& app_info) {
   apps::mojom::AppPtr app = apps::mojom::App::New();
 
@@ -530,7 +592,7 @@
   app->last_launch_time = app_info.last_launch_time;
   app->install_time = app_info.install_time;
 
-  app->install_source = GetInstallSource(prefs_, app_info.package_name);
+  app->install_source = GetInstallSource(prefs, app_info.package_name);
 
   app->is_platform_app = apps::mojom::OptionalBool::kFalse;
   app->recommendable = apps::mojom::OptionalBool::kTrue;
@@ -543,7 +605,7 @@
   app->show_in_management = show;
 
   std::unique_ptr<ArcAppListPrefs::PackageInfo> package =
-      prefs_->GetPackage(app_info.package_name);
+      prefs->GetPackage(app_info.package_name);
   if (package) {
     UpdateAppPermissions(package->permissions, &app->permissions);
   }
@@ -564,12 +626,15 @@
   if (!package_info.permissions.has_value()) {
     return;
   }
-  std::vector<apps::mojom::AppPtr> apps;
-  for (const auto& app_id :
-       prefs_->GetAppsForPackage(package_info.package_name)) {
-    std::unique_ptr<ArcAppListPrefs::AppInfo> app_info = prefs_->GetApp(app_id);
-    if (app_info) {
-      Publish(Convert(app_id, *app_info));
+  ArcAppListPrefs* prefs = ArcAppListPrefs::Get(profile_);
+  if (prefs) {
+    for (const auto& app_id :
+         prefs->GetAppsForPackage(package_info.package_name)) {
+      std::unique_ptr<ArcAppListPrefs::AppInfo> app_info =
+          prefs->GetApp(app_id);
+      if (app_info) {
+        Publish(Convert(prefs, app_id, *app_info));
+      }
     }
   }
 }
diff --git a/chrome/browser/apps/app_service/arc_apps.h b/chrome/browser/apps/app_service/arc_apps.h
index 28de1334..fe6f0f6 100644
--- a/chrome/browser/apps/app_service/arc_apps.h
+++ b/chrome/browser/apps/app_service/arc_apps.h
@@ -50,6 +50,9 @@
  private:
   ArcApps(Profile* profile, apps::AppServiceProxy* proxy);
 
+  // KeyedService overrides.
+  void Shutdown() override;
+
   // apps::mojom::Publisher overrides.
   void Connect(apps::mojom::SubscriberPtr subscriber,
                apps::mojom::ConnectOptionsPtr opts) override;
@@ -101,7 +104,8 @@
                          IconEffects icon_effects,
                          LoadIconCallback callback);
 
-  apps::mojom::AppPtr Convert(const std::string& app_id,
+  apps::mojom::AppPtr Convert(ArcAppListPrefs* prefs,
+                              const std::string& app_id,
                               const ArcAppListPrefs::AppInfo& app_info);
   void Publish(apps::mojom::AppPtr app);
   void ConvertAndPublishPackageApps(
@@ -111,7 +115,6 @@
   mojo::InterfacePtrSet<apps::mojom::Subscriber> subscribers_;
 
   Profile* profile_;
-  ArcAppListPrefs* prefs_;
 
   std::vector<base::OnceCallback<void(AppConnectionHolder*)>>
       pending_load_icon_calls_;
diff --git a/chrome/browser/ash_service_registry.cc b/chrome/browser/ash_service_registry.cc
index 6c70986..896fe5b 100644
--- a/chrome/browser/ash_service_registry.cc
+++ b/chrome/browser/ash_service_registry.cc
@@ -5,7 +5,7 @@
 #include "chrome/browser/ash_service_registry.h"
 
 #include "ash/ash_service.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "content/public/common/service_manager_connection.h"
 
 namespace ash_service_registry {
diff --git a/chrome/browser/browser_process_platform_part_chromeos.cc b/chrome/browser/browser_process_platform_part_chromeos.cc
index 564992c..9af1e63 100644
--- a/chrome/browser/browser_process_platform_part_chromeos.cc
+++ b/chrome/browser/browser_process_platform_part_chromeos.cc
@@ -6,7 +6,7 @@
 
 #include <utility>
 
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "base/bind.h"
 #include "base/logging.h"
 #include "base/memory/singleton.h"
diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
index bdf21f77..2e56a1c 100644
--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc
@@ -384,7 +384,7 @@
 #include "services/audio/public/mojom/constants.mojom.h"
 #elif defined(OS_CHROMEOS)
 #include "ash/public/cpp/tablet_mode.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "chrome/browser/ash_service_registry.h"
 #include "chrome/browser/chromeos/arc/fileapi/arc_content_file_system_backend_delegate.h"
 #include "chrome/browser/chromeos/arc/fileapi/arc_documents_provider_backend_delegate.h"
diff --git a/chrome/browser/chromeos/BUILD.gn b/chrome/browser/chromeos/BUILD.gn
index 2735f64..55af8d55 100644
--- a/chrome/browser/chromeos/BUILD.gn
+++ b/chrome/browser/chromeos/BUILD.gn
@@ -550,6 +550,8 @@
     "arc/intent_helper/arc_intent_picker_app_fetcher.h",
     "arc/intent_helper/arc_settings_service.cc",
     "arc/intent_helper/arc_settings_service.h",
+    "arc/intent_helper/custom_tab_session_impl.cc",
+    "arc/intent_helper/custom_tab_session_impl.h",
     "arc/intent_helper/open_with_menu.cc",
     "arc/intent_helper/open_with_menu.h",
     "arc/intent_helper/start_smart_selection_action_menu.cc",
diff --git a/chrome/browser/chromeos/accessibility/accessibility_manager.cc b/chrome/browser/chromeos/accessibility/accessibility_manager.cc
index b435d54d..5eacf83 100644
--- a/chrome/browser/chromeos/accessibility/accessibility_manager.cc
+++ b/chrome/browser/chromeos/accessibility/accessibility_manager.cc
@@ -17,7 +17,7 @@
 #include "ash/public/cpp/accessibility_focus_ring_controller.h"
 #include "ash/public/cpp/accessibility_focus_ring_info.h"
 #include "ash/public/cpp/ash_pref_names.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "ash/root_window_controller.h"
 #include "ash/shell.h"
 #include "ash/sticky_keys/sticky_keys_controller.h"
diff --git a/chrome/browser/chromeos/accessibility/select_to_speak_browsertest.cc b/chrome/browser/chromeos/accessibility/select_to_speak_browsertest.cc
index 255c2e0d..c75561a 100644
--- a/chrome/browser/chromeos/accessibility/select_to_speak_browsertest.cc
+++ b/chrome/browser/chromeos/accessibility/select_to_speak_browsertest.cc
@@ -8,9 +8,9 @@
 #include "ash/accessibility/accessibility_focus_ring_controller_impl.h"
 #include "ash/accessibility/accessibility_focus_ring_layer.h"
 #include "ash/public/cpp/ash_features.h"
-#include "ash/public/interfaces/constants.mojom.h"
-#include "ash/public/interfaces/status_area_widget_test_api.test-mojom-test-utils.h"
-#include "ash/public/interfaces/status_area_widget_test_api.test-mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
+#include "ash/public/mojom/status_area_widget_test_api.test-mojom-test-utils.h"
+#include "ash/public/mojom/status_area_widget_test_api.test-mojom.h"
 #include "ash/root_window_controller.h"
 #include "ash/shell.h"
 #include "ash/system/status_area_widget.h"
diff --git a/chrome/browser/chromeos/arc/arc_service_launcher.cc b/chrome/browser/chromeos/arc/arc_service_launcher.cc
index b97db77..05fa4553 100644
--- a/chrome/browser/chromeos/arc/arc_service_launcher.cc
+++ b/chrome/browser/chromeos/arc/arc_service_launcher.cc
@@ -7,7 +7,7 @@
 #include <utility>
 
 #include "ash/public/cpp/default_scale_factor_retriever.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "base/bind.h"
 #include "base/logging.h"
 #include "base/task/post_task.h"
diff --git a/chrome/browser/chromeos/arc/intent_helper/arc_external_protocol_dialog.cc b/chrome/browser/chromeos/arc/intent_helper/arc_external_protocol_dialog.cc
index 05a47460..a824ef8 100644
--- a/chrome/browser/chromeos/arc/intent_helper/arc_external_protocol_dialog.cc
+++ b/chrome/browser/chromeos/arc/intent_helper/arc_external_protocol_dialog.cc
@@ -4,11 +4,13 @@
 
 #include "chrome/browser/chromeos/arc/intent_helper/arc_external_protocol_dialog.h"
 
+#include <map>
 #include <memory>
 #include <string>
 
 #include "base/bind.h"
 #include "base/memory/ref_counted.h"
+#include "base/metrics/histogram_functions.h"
 #include "chrome/browser/apps/intent_helper/apps_navigation_types.h"
 #include "chrome/browser/apps/intent_helper/page_transition_util.h"
 #include "chrome/browser/chromeos/apps/intent_helper/chromeos_apps_navigation_throttle.h"
@@ -441,6 +443,26 @@
       break;
   }
 
+  const std::map<base::StringPiece, Scheme> string_to_scheme = {
+      {"bitcoin", Scheme::BITCOIN}, {"geo", Scheme::GEO},
+      {"im", Scheme::IM},           {"irc", Scheme::IRC},
+      {"magnet", Scheme::MAGNET},   {"mailto", Scheme::MAILTO},
+      {"mms", Scheme::MMS},         {"sip", Scheme::SIP},
+      {"skype", Scheme::SKYPE},     {"sms", Scheme::SMS},
+      {"spotify", Scheme::SPOTIFY}, {"ssh", Scheme::SSH},
+      {"tel", Scheme::TEL},         {"telnet", Scheme::TELNET},
+      {"webcal", Scheme::WEBCAL}};
+
+  bool protocol_accepted =
+      (reason == apps::IntentPickerCloseReason::OPEN_APP) ? true : false;
+
+  Scheme url_scheme = Scheme::OTHER;
+  base::StringPiece scheme = url.scheme_piece();
+  auto scheme_it = string_to_scheme.find(scheme);
+  if (scheme_it != string_to_scheme.end())
+    url_scheme = scheme_it->second;
+  RecordUmaDialogAction(url_scheme, protocol_accepted, should_persist);
+
   chromeos::ChromeOsAppsNavigationThrottle::RecordUma(
       selected_app_package, app_type, reason, apps::Source::kExternalProtocol,
       should_persist);
@@ -622,4 +644,120 @@
   return IsChromeAnAppCandidate(handlers);
 }
 
+void RecordUmaDialogAction(Scheme scheme, bool accepted, bool persisted) {
+  ProtocolAction action = GetProtocolAction(scheme, accepted, persisted);
+  if (accepted) {
+    base::UmaHistogramEnumeration(
+        "ChromeOS.Apps.ExternalProtocolDialog.Accepted", action,
+        ProtocolAction::kMaxValue);
+  } else {
+    base::UmaHistogramEnumeration(
+        "ChromeOS.Apps.ExternalProtocolDialog.Rejected", action,
+        ProtocolAction::kMaxValue);
+  }
+}
+
+ProtocolAction GetProtocolAction(Scheme scheme, bool accepted, bool persisted) {
+  switch (scheme) {
+    case Scheme::OTHER:
+      if (!accepted)
+        return ProtocolAction::OTHER_REJECTED;
+      if (persisted)
+        return ProtocolAction::OTHER_ACCEPTED_PERSISTED;
+      return ProtocolAction::OTHER_ACCEPTED_NOT_PERSISTED;
+    case Scheme::BITCOIN:
+      if (!accepted)
+        return ProtocolAction::BITCOIN_REJECTED;
+      if (persisted)
+        return ProtocolAction::BITCOIN_ACCEPTED_PERSISTED;
+      return ProtocolAction::BITCOIN_ACCEPTED_NOT_PERSISTED;
+    case Scheme::GEO:
+      if (!accepted)
+        return ProtocolAction::GEO_REJECTED;
+      if (persisted)
+        return ProtocolAction::GEO_ACCEPTED_PERSISTED;
+      return ProtocolAction::GEO_ACCEPTED_NOT_PERSISTED;
+    case Scheme::IM:
+      if (!accepted)
+        return ProtocolAction::IM_REJECTED;
+      if (persisted)
+        return ProtocolAction::IM_ACCEPTED_PERSISTED;
+      return ProtocolAction::IM_ACCEPTED_NOT_PERSISTED;
+    case Scheme::IRC:
+      if (!accepted)
+        return ProtocolAction::IRC_REJECTED;
+      if (persisted)
+        return ProtocolAction::IRC_ACCEPTED_PERSISTED;
+      return ProtocolAction::IRC_ACCEPTED_NOT_PERSISTED;
+    case Scheme::MAGNET:
+      if (!accepted)
+        return ProtocolAction::MAGNET_REJECTED;
+      if (persisted)
+        return ProtocolAction::MAGNET_ACCEPTED_PERSISTED;
+      return ProtocolAction::MAGNET_ACCEPTED_NOT_PERSISTED;
+    case Scheme::MAILTO:
+      if (!accepted)
+        return ProtocolAction::MAILTO_REJECTED;
+      if (persisted)
+        return ProtocolAction::MAILTO_ACCEPTED_PERSISTED;
+      return ProtocolAction::MAILTO_ACCEPTED_NOT_PERSISTED;
+    case Scheme::MMS:
+      if (!accepted)
+        return ProtocolAction::MMS_REJECTED;
+      if (persisted)
+        return ProtocolAction::MMS_ACCEPTED_PERSISTED;
+      return ProtocolAction::MMS_ACCEPTED_NOT_PERSISTED;
+    case Scheme::SIP:
+      if (!accepted)
+        return ProtocolAction::SIP_REJECTED;
+      if (persisted)
+        return ProtocolAction::SIP_ACCEPTED_PERSISTED;
+      return ProtocolAction::SIP_ACCEPTED_NOT_PERSISTED;
+    case Scheme::SKYPE:
+      if (!accepted)
+        return ProtocolAction::SKYPE_REJECTED;
+      if (persisted)
+        return ProtocolAction::SKYPE_ACCEPTED_PERSISTED;
+      return ProtocolAction::SKYPE_ACCEPTED_NOT_PERSISTED;
+    case Scheme::SMS:
+      if (!accepted)
+        return ProtocolAction::SMS_REJECTED;
+      if (persisted)
+        return ProtocolAction::SMS_ACCEPTED_PERSISTED;
+      return ProtocolAction::SMS_ACCEPTED_NOT_PERSISTED;
+    case Scheme::SPOTIFY:
+      if (!accepted)
+        return ProtocolAction::SPOTIFY_REJECTED;
+      if (persisted)
+        return ProtocolAction::SPOTIFY_ACCEPTED_PERSISTED;
+      return ProtocolAction::SPOTIFY_ACCEPTED_NOT_PERSISTED;
+    case Scheme::SSH:
+      if (!accepted)
+        return ProtocolAction::SSH_REJECTED;
+      if (persisted)
+        return ProtocolAction::SSH_ACCEPTED_PERSISTED;
+      return ProtocolAction::SSH_ACCEPTED_NOT_PERSISTED;
+    case Scheme::TEL:
+      if (!accepted)
+        return ProtocolAction::TEL_REJECTED;
+      if (persisted)
+        return ProtocolAction::TEL_ACCEPTED_PERSISTED;
+      return ProtocolAction::TEL_ACCEPTED_NOT_PERSISTED;
+    case Scheme::TELNET:
+      if (!accepted)
+        return ProtocolAction::TELNET_REJECTED;
+      if (persisted)
+        return ProtocolAction::TELNET_ACCEPTED_PERSISTED;
+      return ProtocolAction::TELNET_ACCEPTED_NOT_PERSISTED;
+    case Scheme::WEBCAL:
+      if (!accepted)
+        return ProtocolAction::WEBCAL_REJECTED;
+      if (persisted)
+        return ProtocolAction::WEBCAL_ACCEPTED_PERSISTED;
+      return ProtocolAction::WEBCAL_ACCEPTED_NOT_PERSISTED;
+  }
+  NOTREACHED();
+  return ProtocolAction::OTHER_REJECTED;
+}
+
 }  // namespace arc
diff --git a/chrome/browser/chromeos/arc/intent_helper/arc_external_protocol_dialog.h b/chrome/browser/chromeos/arc/intent_helper/arc_external_protocol_dialog.h
index 04b24d57..0752b7e 100644
--- a/chrome/browser/chromeos/arc/intent_helper/arc_external_protocol_dialog.h
+++ b/chrome/browser/chromeos/arc/intent_helper/arc_external_protocol_dialog.h
@@ -42,6 +42,81 @@
   ASK_USER,
 };
 
+// These enums are used to define the buckets for an enumerated UMA histogram
+// and need to be synced with enums.xml. This enum class should also be
+// treated as append-only.
+enum class ProtocolAction {
+  OTHER_ACCEPTED_PERSISTED = 0,
+  OTHER_ACCEPTED_NOT_PERSISTED = 1,
+  OTHER_REJECTED = 2,
+  BITCOIN_ACCEPTED_PERSISTED = 3,
+  BITCOIN_ACCEPTED_NOT_PERSISTED = 4,
+  BITCOIN_REJECTED = 5,
+  GEO_ACCEPTED_PERSISTED = 6,
+  GEO_ACCEPTED_NOT_PERSISTED = 7,
+  GEO_REJECTED = 8,
+  IM_ACCEPTED_PERSISTED = 9,
+  IM_ACCEPTED_NOT_PERSISTED = 10,
+  IM_REJECTED = 11,
+  IRC_ACCEPTED_PERSISTED = 12,
+  IRC_ACCEPTED_NOT_PERSISTED = 13,
+  IRC_REJECTED = 14,
+  MAGNET_ACCEPTED_PERSISTED = 15,
+  MAGNET_ACCEPTED_NOT_PERSISTED = 16,
+  MAGNET_REJECTED = 17,
+  MAILTO_ACCEPTED_PERSISTED = 18,
+  MAILTO_ACCEPTED_NOT_PERSISTED = 19,
+  MAILTO_REJECTED = 20,
+  MMS_ACCEPTED_PERSISTED = 21,
+  MMS_ACCEPTED_NOT_PERSISTED = 22,
+  MMS_REJECTED = 23,
+  SIP_ACCEPTED_PERSISTED = 24,
+  SIP_ACCEPTED_NOT_PERSISTED = 25,
+  SIP_REJECTED = 26,
+  SKYPE_ACCEPTED_PERSISTED = 27,
+  SKYPE_ACCEPTED_NOT_PERSISTED = 28,
+  SKYPE_REJECTED = 29,
+  SMS_ACCEPTED_PERSISTED = 30,
+  SMS_ACCEPTED_NOT_PERSISTED = 31,
+  SMS_REJECTED = 32,
+  SPOTIFY_ACCEPTED_PERSISTED = 33,
+  SPOTIFY_ACCEPTED_NOT_PERSISTED = 34,
+  SPOTIFY_REJECTED = 35,
+  SSH_ACCEPTED_PERSISTED = 36,
+  SSH_ACCEPTED_NOT_PERSISTED = 37,
+  SSH_REJECTED = 38,
+  TEL_ACCEPTED_PERSISTED = 39,
+  TEL_ACCEPTED_NOT_PERSISTED = 40,
+  TEL_REJECTED = 41,
+  TELNET_ACCEPTED_PERSISTED = 42,
+  TELNET_ACCEPTED_NOT_PERSISTED = 43,
+  TELNET_REJECTED = 44,
+  WEBCAL_ACCEPTED_PERSISTED = 45,
+  WEBCAL_ACCEPTED_NOT_PERSISTED = 46,
+  WEBCAL_REJECTED = 47,
+  kMaxValue = WEBCAL_REJECTED
+};
+
+// Possible schemes for recording external protocol dialog metrics
+enum class Scheme {
+  BITCOIN,
+  GEO,
+  IM,
+  IRC,
+  MAGNET,
+  MAILTO,
+  MMS,
+  SIP,
+  SKYPE,
+  SMS,
+  SPOTIFY,
+  SSH,
+  TEL,
+  TELNET,
+  WEBCAL,
+  OTHER
+};
+
 // Shows ARC version of the dialog. Returns true if ARC is supported, running,
 // and in a context where it is allowed to handle external protocol.
 bool RunArcExternalProtocolDialog(const GURL& url,
@@ -66,6 +141,10 @@
 bool IsChromeAnAppCandidateForTesting(
     const std::vector<mojom::IntentHandlerInfoPtr>& handlers);
 
+void RecordUmaDialogAction(Scheme scheme, bool accepted, bool persisted);
+
+ProtocolAction GetProtocolAction(Scheme scheme, bool accepted, bool persisted);
+
 }  // namespace arc
 
 #endif  // CHROME_BROWSER_CHROMEOS_ARC_INTENT_HELPER_ARC_EXTERNAL_PROTOCOL_DIALOG_H_
diff --git a/chrome/browser/chromeos/arc/intent_helper/custom_tab_session_impl.cc b/chrome/browser/chromeos/arc/intent_helper/custom_tab_session_impl.cc
new file mode 100644
index 0000000..fc88ef9
--- /dev/null
+++ b/chrome/browser/chromeos/arc/intent_helper/custom_tab_session_impl.cc
@@ -0,0 +1,82 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/arc/intent_helper/custom_tab_session_impl.h"
+
+#include <utility>
+
+#include "ash/public/cpp/arc_custom_tab.h"
+#include "base/bind.h"
+#include "base/metrics/histogram_macros.h"
+#include "content/public/browser/web_contents.h"
+#include "mojo/public/cpp/bindings/interface_request.h"
+#include "ui/aura/window.h"
+
+// static
+arc::mojom::CustomTabSessionPtr CustomTabSessionImpl::Create(
+    std::unique_ptr<content::WebContents> web_contents,
+    std::unique_ptr<ash::ArcCustomTab> custom_tab) {
+  if (!custom_tab)
+    return nullptr;
+
+  // This object will be deleted when the mojo connection is closed.
+  auto* tab =
+      new CustomTabSessionImpl(std::move(web_contents), std::move(custom_tab));
+  arc::mojom::CustomTabSessionPtr ptr;
+  tab->Bind(&ptr);
+  return ptr;
+}
+
+CustomTabSessionImpl::CustomTabSessionImpl(
+    std::unique_ptr<content::WebContents> web_contents,
+    std::unique_ptr<ash::ArcCustomTab> custom_tab)
+    : ArcCustomTabModalDialogHost(std::move(custom_tab),
+                                  std::move(web_contents)),
+      binding_(this),
+      weak_ptr_factory_(this) {
+  aura::Window* window = web_contents_->GetNativeView();
+  custom_tab_->Attach(window);
+  window->Show();
+}
+
+CustomTabSessionImpl::~CustomTabSessionImpl() {
+  // Keep in sync with ArcCustomTabsSessionEndReason in
+  // tools/metrics/histograms/enums.xml.
+  enum class SessionEndReason {
+    CLOSED = 0,
+    FORWARDED_TO_NORMAL_TAB = 1,
+    kMaxValue = FORWARDED_TO_NORMAL_TAB,
+  } session_end_reason = forwarded_to_normal_tab_
+                             ? SessionEndReason::FORWARDED_TO_NORMAL_TAB
+                             : SessionEndReason::CLOSED;
+  UMA_HISTOGRAM_ENUMERATION("Arc.CustomTabs.SessionEndReason",
+                            session_end_reason);
+  auto elapsed = lifetime_timer_.Elapsed();
+  UMA_HISTOGRAM_LONG_TIMES("Arc.CustomTabs.SessionLifetime2.All", elapsed);
+  switch (session_end_reason) {
+    case SessionEndReason::CLOSED:
+      UMA_HISTOGRAM_LONG_TIMES("Arc.CustomTabs.SessionLifetime2.Closed",
+                               elapsed);
+      break;
+    case SessionEndReason::FORWARDED_TO_NORMAL_TAB:
+      UMA_HISTOGRAM_LONG_TIMES(
+          "Arc.CustomTabs.SessionLifetime2.ForwardedToNormalTab", elapsed);
+      break;
+  }
+}
+
+void CustomTabSessionImpl::OnOpenInChromeClicked() {
+  forwarded_to_normal_tab_ = true;
+}
+
+void CustomTabSessionImpl::Bind(arc::mojom::CustomTabSessionPtr* ptr) {
+  binding_.Bind(mojo::MakeRequest(ptr));
+  binding_.set_connection_error_handler(base::BindOnce(
+      &CustomTabSessionImpl::Close, weak_ptr_factory_.GetWeakPtr()));
+}
+
+// Deletes this object when the mojo connection is closed.
+void CustomTabSessionImpl::Close() {
+  delete this;
+}
diff --git a/chrome/browser/chromeos/arc/intent_helper/custom_tab_session_impl.h b/chrome/browser/chromeos/arc/intent_helper/custom_tab_session_impl.h
new file mode 100644
index 0000000..97901f44
--- /dev/null
+++ b/chrome/browser/chromeos/arc/intent_helper/custom_tab_session_impl.h
@@ -0,0 +1,63 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_CHROMEOS_ARC_INTENT_HELPER_CUSTOM_TAB_SESSION_IMPL_H_
+#define CHROME_BROWSER_CHROMEOS_ARC_INTENT_HELPER_CUSTOM_TAB_SESSION_IMPL_H_
+
+#include <memory>
+
+#include "base/macros.h"
+#include "base/memory/weak_ptr.h"
+#include "base/timer/elapsed_timer.h"
+#include "chrome/browser/ui/ash/arc_custom_tab_modal_dialog_host.h"
+#include "components/arc/common/intent_helper.mojom.h"
+#include "mojo/public/cpp/bindings/binding.h"
+
+namespace ash {
+class ArcCustomTab;
+}  // namespace ash
+
+namespace content {
+class WebContents;
+}  // namespace content
+
+// Implementation of CustomTabSession interface.
+class CustomTabSessionImpl : public arc::mojom::CustomTabSession,
+                             public ArcCustomTabModalDialogHost {
+ public:
+  static arc::mojom::CustomTabSessionPtr Create(
+      std::unique_ptr<content::WebContents> web_contents,
+      std::unique_ptr<ash::ArcCustomTab> custom_tab);
+
+  // arc::mojom::CustomTabSession:
+  void OnOpenInChromeClicked() override;
+
+ private:
+  CustomTabSessionImpl(std::unique_ptr<content::WebContents> web_contents,
+                       std::unique_ptr<ash::ArcCustomTab> custom_tab);
+  ~CustomTabSessionImpl() override;
+
+  void Bind(arc::mojom::CustomTabSessionPtr* ptr);
+
+  void Close();
+
+  // Used to bind the CustomTabSession interface implementation to a message
+  // pipe.
+  mojo::Binding<arc::mojom::CustomTabSession> binding_;
+
+  // Tracks the lifetime of the ARC Custom Tab session.
+  base::ElapsedTimer lifetime_timer_;
+
+  // Set to true when the user requests to view the web contents in a normal
+  // Chrome tab instead of an ARC Custom Tab.
+  bool forwarded_to_normal_tab_ = false;
+
+  // Note: This should remain the last member so it'll be destroyed and
+  // invalidate its weak pointers before any other members are destroyed.
+  base::WeakPtrFactory<CustomTabSessionImpl> weak_ptr_factory_;
+
+  DISALLOW_COPY_AND_ASSIGN(CustomTabSessionImpl);
+};
+
+#endif  // CHROME_BROWSER_CHROMEOS_ARC_INTENT_HELPER_CUSTOM_TAB_SESSION_IMPL_H_
diff --git a/chrome/browser/chromeos/arc/voice_interaction/voice_interaction_controller_client.h b/chrome/browser/chromeos/arc/voice_interaction/voice_interaction_controller_client.h
index 451eca0..7e6f1587 100644
--- a/chrome/browser/chromeos/arc/voice_interaction/voice_interaction_controller_client.h
+++ b/chrome/browser/chromeos/arc/voice_interaction/voice_interaction_controller_client.h
@@ -7,7 +7,7 @@
 
 #include <memory>
 
-#include "ash/public/interfaces/voice_interaction_controller.mojom.h"
+#include "ash/public/mojom/voice_interaction_controller.mojom.h"
 #include "chrome/browser/chromeos/arc/arc_session_manager.h"
 #include "components/prefs/pref_change_registrar.h"
 #include "components/user_manager/user_manager.h"
diff --git a/chrome/browser/chromeos/assistant/assistant_util.cc b/chrome/browser/chromeos/assistant/assistant_util.cc
index 080e95b8..f036913 100644
--- a/chrome/browser/chromeos/assistant/assistant_util.cc
+++ b/chrome/browser/chromeos/assistant/assistant_util.cc
@@ -6,7 +6,7 @@
 
 #include <string>
 
-#include "ash/public/interfaces/voice_interaction_controller.mojom-shared.h"
+#include "ash/public/mojom/voice_interaction_controller.mojom-shared.h"
 #include "chrome/browser/chromeos/login/demo_mode/demo_session.h"
 #include "chrome/browser/chromeos/profiles/profile_helper.h"
 #include "chrome/browser/profiles/profile.h"
diff --git a/chrome/browser/chromeos/assistant/assistant_util.h b/chrome/browser/chromeos/assistant/assistant_util.h
index 8ddacb1..8bc01ff 100644
--- a/chrome/browser/chromeos/assistant/assistant_util.h
+++ b/chrome/browser/chromeos/assistant/assistant_util.h
@@ -5,7 +5,7 @@
 #ifndef CHROME_BROWSER_CHROMEOS_ASSISTANT_ASSISTANT_UTIL_H_
 #define CHROME_BROWSER_CHROMEOS_ASSISTANT_ASSISTANT_UTIL_H_
 
-#include "ash/public/interfaces/voice_interaction_controller.mojom.h"
+#include "ash/public/mojom/voice_interaction_controller.mojom.h"
 
 class Profile;
 
diff --git a/chrome/browser/chromeos/extensions/autotest_private/autotest_private_api.cc b/chrome/browser/chromeos/extensions/autotest_private/autotest_private_api.cc
index 12f6fc1..c853822 100644
--- a/chrome/browser/chromeos/extensions/autotest_private/autotest_private_api.cc
+++ b/chrome/browser/chromeos/extensions/autotest_private/autotest_private_api.cc
@@ -14,7 +14,7 @@
 #include "ash/public/cpp/shelf_prefs.h"
 #include "ash/public/cpp/tablet_mode.h"
 #include "ash/public/cpp/window_properties.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "ash/shell.h"
 #include "ash/wm/wm_event.h"
 #include "base/base64.h"
diff --git a/chrome/browser/chromeos/extensions/default_app_order.cc b/chrome/browser/chromeos/extensions/default_app_order.cc
index e9f89db..68e338f 100644
--- a/chrome/browser/chromeos/extensions/default_app_order.cc
+++ b/chrome/browser/chromeos/extensions/default_app_order.cc
@@ -63,6 +63,8 @@
     app_list::kDefaultPageBreak1,  // First default page break
     extension_misc::kGoogleMapsAppId,
     app_list::kInternalAppIdSettings,
+    default_web_apps::kSettingsAppId,
+    default_web_apps::kOsSettingsAppId,
     app_list::kInternalAppIdDiscover,
     extension_misc::kGeniusAppId,
     extension_misc::kCalculatorAppId,
diff --git a/chrome/browser/chromeos/extensions/default_web_app_ids.h b/chrome/browser/chromeos/extensions/default_web_app_ids.h
index bddfa529..bd27caa 100644
--- a/chrome/browser/chromeos/extensions/default_web_app_ids.h
+++ b/chrome/browser/chromeos/extensions/default_web_app_ids.h
@@ -24,6 +24,12 @@
 // "https://google.com/chromebook/whatsnew/embedded/")).
 constexpr char kReleaseNotesAppId[] = "kddjchdmnnpakappplfnloipgcbioilo";
 
+// Generated as web_app::GenerateAppIdFromURL(GURL("chrome://settings/")).
+constexpr char kSettingsAppId[] = "inogagmajamaleonmanpkpkkigmklfad";
+
+// Generated as web_app::GenerateAppIdFromURL(GURL("chrome://os-settings/")).
+constexpr char kOsSettingsAppId[] = "odknhmnlageboeamepcngndbggdpaobj";
+
 }  // namespace default_web_apps
 }  // namespace chromeos
 
diff --git a/chrome/browser/chromeos/lock_screen_apps/note_taking_browsertest.cc b/chrome/browser/chromeos/lock_screen_apps/note_taking_browsertest.cc
index 31400cde..cf273f3 100644
--- a/chrome/browser/chromeos/lock_screen_apps/note_taking_browsertest.cc
+++ b/chrome/browser/chromeos/lock_screen_apps/note_taking_browsertest.cc
@@ -4,7 +4,7 @@
 
 #include "apps/launcher.h"
 #include "ash/public/cpp/ash_switches.h"
-#include "ash/public/interfaces/tray_action.mojom.h"
+#include "ash/public/mojom/tray_action.mojom.h"
 #include "base/command_line.h"
 #include "base/run_loop.h"
 #include "base/scoped_observer.h"
diff --git a/chrome/browser/chromeos/lock_screen_apps/state_controller.cc b/chrome/browser/chromeos/lock_screen_apps/state_controller.cc
index d57bcba..d7b7c4e5 100644
--- a/chrome/browser/chromeos/lock_screen_apps/state_controller.cc
+++ b/chrome/browser/chromeos/lock_screen_apps/state_controller.cc
@@ -7,7 +7,7 @@
 #include <utility>
 
 #include "ash/public/cpp/stylus_utils.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "base/base64.h"
 #include "base/bind.h"
 #include "base/command_line.h"
diff --git a/chrome/browser/chromeos/lock_screen_apps/state_controller.h b/chrome/browser/chromeos/lock_screen_apps/state_controller.h
index 8de24d2..b996dbe 100644
--- a/chrome/browser/chromeos/lock_screen_apps/state_controller.h
+++ b/chrome/browser/chromeos/lock_screen_apps/state_controller.h
@@ -8,7 +8,7 @@
 #include <memory>
 #include <string>
 
-#include "ash/public/interfaces/tray_action.mojom.h"
+#include "ash/public/mojom/tray_action.mojom.h"
 #include "base/callback.h"
 #include "base/memory/weak_ptr.h"
 #include "base/observer_list.h"
diff --git a/chrome/browser/chromeos/lock_screen_apps/state_controller_unittest.cc b/chrome/browser/chromeos/lock_screen_apps/state_controller_unittest.cc
index 38aa51b..dbb2b29 100644
--- a/chrome/browser/chromeos/lock_screen_apps/state_controller_unittest.cc
+++ b/chrome/browser/chromeos/lock_screen_apps/state_controller_unittest.cc
@@ -10,7 +10,7 @@
 #include <vector>
 
 #include "ash/public/cpp/ash_switches.h"
-#include "ash/public/interfaces/tray_action.mojom.h"
+#include "ash/public/mojom/tray_action.mojom.h"
 #include "ash/session/test_session_controller_client.h"
 #include "base/base64.h"
 #include "base/bind.h"
diff --git a/chrome/browser/chromeos/lock_screen_apps/state_observer.h b/chrome/browser/chromeos/lock_screen_apps/state_observer.h
index fe1ede3e..5bada44 100644
--- a/chrome/browser/chromeos/lock_screen_apps/state_observer.h
+++ b/chrome/browser/chromeos/lock_screen_apps/state_observer.h
@@ -5,7 +5,7 @@
 #ifndef CHROME_BROWSER_CHROMEOS_LOCK_SCREEN_APPS_STATE_OBSERVER_H_
 #define CHROME_BROWSER_CHROMEOS_LOCK_SCREEN_APPS_STATE_OBSERVER_H_
 
-#include "ash/public/interfaces/tray_action.mojom.h"
+#include "ash/public/mojom/tray_action.mojom.h"
 
 namespace lock_screen_apps {
 
diff --git a/chrome/browser/chromeos/login/lock/screen_locker.cc b/chrome/browser/chromeos/login/lock/screen_locker.cc
index c077b2e..9b0b601b 100644
--- a/chrome/browser/chromeos/login/lock/screen_locker.cc
+++ b/chrome/browser/chromeos/login/lock/screen_locker.cc
@@ -8,7 +8,7 @@
 #include "ash/public/cpp/login_screen.h"
 #include "ash/public/cpp/login_screen_model.h"
 #include "ash/public/cpp/login_types.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/lazy_instance.h"
diff --git a/chrome/browser/chromeos/login/screens/recommend_apps/recommend_apps_fetcher_impl.cc b/chrome/browser/chromeos/login/screens/recommend_apps/recommend_apps_fetcher_impl.cc
index 3404fcf..bf15225 100644
--- a/chrome/browser/chromeos/login/screens/recommend_apps/recommend_apps_fetcher_impl.cc
+++ b/chrome/browser/chromeos/login/screens/recommend_apps/recommend_apps_fetcher_impl.cc
@@ -4,8 +4,8 @@
 
 #include "chrome/browser/chromeos/login/screens/recommend_apps/recommend_apps_fetcher_impl.h"
 
-#include "ash/public/interfaces/constants.mojom.h"
-#include "ash/public/interfaces/cros_display_config.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
+#include "ash/public/mojom/cros_display_config.mojom.h"
 #include "base/base64url.h"
 #include "base/bind.h"
 #include "base/json/json_reader.h"
diff --git a/chrome/browser/chromeos/login/screens/recommend_apps/recommend_apps_fetcher_impl.h b/chrome/browser/chromeos/login/screens/recommend_apps/recommend_apps_fetcher_impl.h
index 0643a13..327ba59 100644
--- a/chrome/browser/chromeos/login/screens/recommend_apps/recommend_apps_fetcher_impl.h
+++ b/chrome/browser/chromeos/login/screens/recommend_apps/recommend_apps_fetcher_impl.h
@@ -9,7 +9,7 @@
 #include <string>
 #include <vector>
 
-#include "ash/public/interfaces/cros_display_config.mojom.h"
+#include "ash/public/mojom/cros_display_config.mojom.h"
 #include "base/callback.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
diff --git a/chrome/browser/chromeos/login/screens/recommend_apps/recommend_apps_fetcher_impl_unittest.cc b/chrome/browser/chromeos/login/screens/recommend_apps/recommend_apps_fetcher_impl_unittest.cc
index e1b34e0..42a79df 100644
--- a/chrome/browser/chromeos/login/screens/recommend_apps/recommend_apps_fetcher_impl_unittest.cc
+++ b/chrome/browser/chromeos/login/screens/recommend_apps/recommend_apps_fetcher_impl_unittest.cc
@@ -7,8 +7,8 @@
 #include <memory>
 #include <vector>
 
-#include "ash/public/interfaces/constants.mojom.h"
-#include "ash/public/interfaces/cros_display_config.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
+#include "ash/public/mojom/cros_display_config.mojom.h"
 #include "base/base64url.h"
 #include "base/files/file_path.h"
 #include "base/run_loop.h"
diff --git a/chrome/browser/chromeos/policy/display_resolution_handler.h b/chrome/browser/chromeos/policy/display_resolution_handler.h
index d212f380..49836c96 100644
--- a/chrome/browser/chromeos/policy/display_resolution_handler.h
+++ b/chrome/browser/chromeos/policy/display_resolution_handler.h
@@ -10,7 +10,7 @@
 #include <string>
 #include <vector>
 
-#include "ash/public/interfaces/cros_display_config.mojom.h"
+#include "ash/public/mojom/cros_display_config.mojom.h"
 #include "chrome/browser/chromeos/policy/display_settings_handler.h"
 
 namespace policy {
diff --git a/chrome/browser/chromeos/policy/display_rotation_default_handler.h b/chrome/browser/chromeos/policy/display_rotation_default_handler.h
index ba0914e..2e7272db 100644
--- a/chrome/browser/chromeos/policy/display_rotation_default_handler.h
+++ b/chrome/browser/chromeos/policy/display_rotation_default_handler.h
@@ -10,7 +10,7 @@
 #include <string>
 #include <vector>
 
-#include "ash/public/interfaces/cros_display_config.mojom.h"
+#include "ash/public/mojom/cros_display_config.mojom.h"
 #include "chrome/browser/chromeos/policy/display_settings_handler.h"
 #include "ui/display/display.h"
 
diff --git a/chrome/browser/chromeos/policy/display_settings_handler.cc b/chrome/browser/chromeos/policy/display_settings_handler.cc
index c7398f39..61e79a4 100644
--- a/chrome/browser/chromeos/policy/display_settings_handler.cc
+++ b/chrome/browser/chromeos/policy/display_settings_handler.cc
@@ -5,7 +5,7 @@
 #include "chrome/browser/chromeos/policy/display_settings_handler.h"
 
 #include <utility>
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/location.h"
diff --git a/chrome/browser/chromeos/policy/display_settings_handler.h b/chrome/browser/chromeos/policy/display_settings_handler.h
index 154fbd9..6a2102c 100644
--- a/chrome/browser/chromeos/policy/display_settings_handler.h
+++ b/chrome/browser/chromeos/policy/display_settings_handler.h
@@ -8,7 +8,7 @@
 #include <memory>
 #include <vector>
 
-#include "ash/public/interfaces/cros_display_config.mojom.h"
+#include "ash/public/mojom/cros_display_config.mojom.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "chrome/browser/chromeos/settings/cros_settings.h"
diff --git a/chrome/browser/chromeos/preferences.cc b/chrome/browser/chromeos/preferences.cc
index c4afed00..cac8585 100644
--- a/chrome/browser/chromeos/preferences.cc
+++ b/chrome/browser/chromeos/preferences.cc
@@ -10,8 +10,8 @@
 #include "ash/public/cpp/ash_constants.h"
 #include "ash/public/cpp/ash_pref_names.h"
 #include "ash/public/cpp/ash_prefs.h"
-#include "ash/public/interfaces/constants.mojom.h"
-#include "ash/public/interfaces/cros_display_config.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
+#include "ash/public/mojom/cros_display_config.mojom.h"
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/i18n/time_formatting.h"
diff --git a/chrome/browser/chromeos/preferences.h b/chrome/browser/chromeos/preferences.h
index 85580e8..cd4486b 100644
--- a/chrome/browser/chromeos/preferences.h
+++ b/chrome/browser/chromeos/preferences.h
@@ -7,7 +7,7 @@
 
 #include <string>
 
-#include "ash/public/interfaces/cros_display_config.mojom.h"
+#include "ash/public/mojom/cros_display_config.mojom.h"
 #include "base/macros.h"
 #include "chrome/browser/chromeos/language_preferences.h"
 #include "components/prefs/pref_change_registrar.h"
diff --git a/chrome/browser/extensions/bookmark_app_extension_util.cc b/chrome/browser/extensions/bookmark_app_extension_util.cc
index fe3a7db7..e90dc3b3 100644
--- a/chrome/browser/extensions/bookmark_app_extension_util.cc
+++ b/chrome/browser/extensions/bookmark_app_extension_util.cc
@@ -4,56 +4,18 @@
 
 #include "chrome/browser/extensions/bookmark_app_extension_util.h"
 
-#include <utility>
-
-#include "base/callback.h"
 #include "build/build_config.h"
-#include "chrome/browser/extensions/launch_util.h"
 #include "chrome/browser/profiles/profile.h"
-#include "chrome/browser/ui/extensions/application_launch.h"
 #include "chrome/browser/web_applications/extensions/web_app_extension_shortcut.h"
 #include "chrome/common/chrome_features.h"
 #include "chrome/common/chrome_switches.h"
-#include "extensions/browser/extension_prefs.h"
-#include "extensions/common/extension.h"
 
 #if defined(OS_MACOSX)
 #include "chrome/browser/web_applications/extensions/web_app_extension_shortcut_mac.h"
-#include "chrome/common/chrome_switches.h"
-#endif
-
-#if defined(OS_CHROMEOS)
-// gn check complains on Linux Ozone.
-#include "ash/public/cpp/shelf_model.h"  // nogncheck
 #endif
 
 namespace extensions {
 
-bool CanBookmarkAppReparentTab(Profile* profile,
-                               const Extension* extension,
-                               bool shortcut_created) {
-  // Reparent the web contents into its own window only if that is the
-  // extension's launch type.
-  if (!extension ||
-      extensions::GetLaunchType(extensions::ExtensionPrefs::Get(profile),
-                                extension) != extensions::LAUNCH_TYPE_WINDOW) {
-    return false;
-  }
-#if defined(OS_MACOSX)
-  // On macOS it is only possible to reparent the window when the shortcut (app
-  // shim) was created.  See https://crbug.com/915571.
-  return shortcut_created;
-#else
-  return true;
-#endif
-}
-
-void BookmarkAppReparentTab(content::WebContents* contents,
-                            const std::string& app_id) {
-  // Reparent the tab into an app window immediately when opening as a window.
-  ReparentWebContentsIntoAppBrowser(contents, app_id);
-}
-
 bool CanBookmarkAppRevealAppShim() {
 #if defined(OS_MACOSX)
   return true;
diff --git a/chrome/browser/extensions/bookmark_app_extension_util.h b/chrome/browser/extensions/bookmark_app_extension_util.h
index 7c496bd..843bb98 100644
--- a/chrome/browser/extensions/bookmark_app_extension_util.h
+++ b/chrome/browser/extensions/bookmark_app_extension_util.h
@@ -5,26 +5,12 @@
 #ifndef CHROME_BROWSER_EXTENSIONS_BOOKMARK_APP_EXTENSION_UTIL_H_
 #define CHROME_BROWSER_EXTENSIONS_BOOKMARK_APP_EXTENSION_UTIL_H_
 
-#include <string>
-
-#include "base/callback_forward.h"
-
 class Profile;
 
-namespace content {
-class WebContents;
-}
-
 namespace extensions {
 
 class Extension;
 
-bool CanBookmarkAppReparentTab(Profile* profile,
-                               const Extension* extension,
-                               bool shortcut_created);
-void BookmarkAppReparentTab(content::WebContents* contents,
-                            const std::string& app_id);
-
 bool CanBookmarkAppRevealAppShim();
 void BookmarkAppRevealAppShim(Profile* profile, const Extension* extension);
 
diff --git a/chrome/browser/extensions/system_display/display_info_provider_chromeos.cc b/chrome/browser/extensions/system_display/display_info_provider_chromeos.cc
index fe86a10..1e414cf 100644
--- a/chrome/browser/extensions/system_display/display_info_provider_chromeos.cc
+++ b/chrome/browser/extensions/system_display/display_info_provider_chromeos.cc
@@ -8,8 +8,8 @@
 #include <cmath>
 
 #include "ash/public/cpp/tablet_mode.h"
-#include "ash/public/interfaces/constants.mojom.h"
-#include "ash/public/interfaces/cros_display_config.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
+#include "ash/public/mojom/cros_display_config.mojom.h"
 #include "base/bind.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/stringprintf.h"
diff --git a/chrome/browser/extensions/system_display/display_info_provider_chromeos.h b/chrome/browser/extensions/system_display/display_info_provider_chromeos.h
index f3c69c5c..135e1c59 100644
--- a/chrome/browser/extensions/system_display/display_info_provider_chromeos.h
+++ b/chrome/browser/extensions/system_display/display_info_provider_chromeos.h
@@ -9,7 +9,7 @@
 #include <memory>
 
 #include "ash/public/cpp/tablet_mode_observer.h"
-#include "ash/public/interfaces/cros_display_config.mojom.h"
+#include "ash/public/mojom/cros_display_config.mojom.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "extensions/browser/api/system_display/display_info_provider.h"
diff --git a/chrome/browser/extensions/system_display/display_info_provider_chromeos_unittest.cc b/chrome/browser/extensions/system_display/display_info_provider_chromeos_unittest.cc
index 82459eb..a601c21 100644
--- a/chrome/browser/extensions/system_display/display_info_provider_chromeos_unittest.cc
+++ b/chrome/browser/extensions/system_display/display_info_provider_chromeos_unittest.cc
@@ -12,7 +12,7 @@
 #include "ash/public/cpp/ash_switches.h"
 #include "ash/public/cpp/tablet_mode.h"
 #include "ash/public/cpp/test/shell_test_api.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "ash/shell.h"
 #include "base/bind.h"
 #include "base/command_line.h"
diff --git a/chrome/browser/feedback/system_logs/log_sources/chrome_internal_log_source.cc b/chrome/browser/feedback/system_logs/log_sources/chrome_internal_log_source.cc
index 827f49d3..40f4f72 100644
--- a/chrome/browser/feedback/system_logs/log_sources/chrome_internal_log_source.cc
+++ b/chrome/browser/feedback/system_logs/log_sources/chrome_internal_log_source.cc
@@ -32,7 +32,7 @@
 #include "extensions/common/extension_set.h"
 
 #if defined(OS_CHROMEOS)
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "chrome/browser/chromeos/arc/arc_util.h"
 #include "chrome/browser/chromeos/login/demo_mode/demo_session.h"
 #include "chrome/browser/metrics/chromeos_metrics_provider.h"
diff --git a/chrome/browser/feedback/system_logs/log_sources/chrome_internal_log_source.h b/chrome/browser/feedback/system_logs/log_sources/chrome_internal_log_source.h
index 759f5e3d..5f74d5a 100644
--- a/chrome/browser/feedback/system_logs/log_sources/chrome_internal_log_source.h
+++ b/chrome/browser/feedback/system_logs/log_sources/chrome_internal_log_source.h
@@ -10,7 +10,7 @@
 #include "components/feedback/system_logs/system_logs_source.h"
 
 #if defined(OS_CHROMEOS)
-#include "ash/public/interfaces/cros_display_config.mojom.h"
+#include "ash/public/mojom/cros_display_config.mojom.h"
 #endif
 
 namespace system_logs {
diff --git a/chrome/browser/flag-metadata.json b/chrome/browser/flag-metadata.json
index 9fb248c..018284fd 100644
--- a/chrome/browser/flag-metadata.json
+++ b/chrome/browser/flag-metadata.json
@@ -346,11 +346,6 @@
     "expiry_milestone": 82
   },
   {
-    "name": "automatic-password-generation",
-    "owners": [ "ioanap", "fhorschig" ],
-    "expiry_milestone": 76
-  },
-  {
     "name": "background-task-component-update",
     "owners": [ "sorin", "waffles", "tiborg" ],
     "expiry_milestone": 76
@@ -2277,7 +2272,7 @@
   {
     "name": "manual-password-generation-android",
     "owners": [ "ioanap" ],
-    "expiry_milestone": 76
+    "expiry_milestone": 78
   },
   {
     "name": "media-router-cast-allow-all-ips",
diff --git a/chrome/browser/flag_descriptions.cc b/chrome/browser/flag_descriptions.cc
index e311603..4e6e19af9 100644
--- a/chrome/browser/flag_descriptions.cc
+++ b/chrome/browser/flag_descriptions.cc
@@ -918,11 +918,6 @@
     "Enable the use of PINs with the Web Authentication API and compatible "
     "security keys.";
 
-const char kEnableIncognitoWindowCounterName[] = "Incognito Window Counter";
-const char kEnableIncognitoWindowCounterDescription[] =
-    "Shows the count of Incognito windows next to the Incognito icon on the "
-    "toolbar.";
-
 const char kEnableWasmBaselineName[] = "WebAssembly baseline compiler";
 const char kEnableWasmBaselineDescription[] =
     "Enables WebAssembly baseline compilation and tier up.";
diff --git a/chrome/browser/flag_descriptions.h b/chrome/browser/flag_descriptions.h
index 30b0894..650c7beb 100644
--- a/chrome/browser/flag_descriptions.h
+++ b/chrome/browser/flag_descriptions.h
@@ -548,9 +548,6 @@
 extern const char kEnableWebUsbName[];
 extern const char kEnableWebUsbDescription[];
 
-extern const char kEnableIncognitoWindowCounterName[];
-extern const char kEnableIncognitoWindowCounterDescription[];
-
 extern const char kEnableWasmBaselineName[];
 extern const char kEnableWasmBaselineDescription[];
 
diff --git a/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.cc b/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.cc
index cf5c235..ce3747b 100644
--- a/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.cc
+++ b/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.cc
@@ -16,6 +16,8 @@
 #include "chrome/browser/page_load_metrics/metrics_web_contents_observer.h"
 #include "chrome/browser/page_load_metrics/page_load_metrics_util.h"
 #include "chrome/browser/page_load_metrics/resource_tracker.h"
+#include "chrome/browser/subresource_filter/chrome_subresource_filter_client.h"
+#include "components/subresource_filter/content/browser/content_subresource_filter_throttle_manager.h"
 #include "components/subresource_filter/core/common/common_features.h"
 #include "components/ukm/content/source_url_recorder.h"
 #include "content/public/browser/global_request_id.h"
@@ -60,8 +62,9 @@
 
 // static
 std::unique_ptr<AdsPageLoadMetricsObserver>
-AdsPageLoadMetricsObserver::CreateIfNeeded() {
-  if (!base::FeatureList::IsEnabled(subresource_filter::kAdTagging))
+AdsPageLoadMetricsObserver::CreateIfNeeded(content::WebContents* web_contents) {
+  if (!base::FeatureList::IsEnabled(subresource_filter::kAdTagging) ||
+      !ChromeSubresourceFilterClient::FromWebContents(web_contents))
     return nullptr;
   return std::make_unique<AdsPageLoadMetricsObserver>();
 }
@@ -247,16 +250,24 @@
 void AdsPageLoadMetricsObserver::OnDidFinishSubFrameNavigation(
     content::NavigationHandle* navigation_handle,
     const page_load_metrics::PageLoadExtraInfo& extra_info) {
+  // If the AdsPageLoadMetricsObserver is created, this does not return nullptr.
+  auto* client = ChromeSubresourceFilterClient::FromWebContents(
+      navigation_handle->GetWebContents());
+  // AdsPageLoadMetricsObserver is not created unless there is a
+  // ChromeSubresourceFilterClient
+  DCHECK(client);
   FrameTreeNodeId frame_tree_node_id = navigation_handle->GetFrameTreeNodeId();
-  bool is_adframe = DetectAds(navigation_handle);
 
   // NOTE: Frame look-up only used for determining cross-origin status, not
   // granting security permissions.
-  content::RenderFrameHost* ad_host = FindFrameMaybeUnsafe(navigation_handle);
+  content::RenderFrameHost* frame_host =
+      FindFrameMaybeUnsafe(navigation_handle);
 
-  RecordAdFrameData(frame_tree_node_id, is_adframe, ad_host,
+  bool is_adframe = client->GetThrottleManager()->IsFrameTaggedAsAd(frame_host);
+
+  RecordAdFrameData(frame_tree_node_id, is_adframe, frame_host,
                     /*frame_navigated=*/true);
-  ProcessOngoingNavigationResource(ad_host);
+  ProcessOngoingNavigationResource(frame_host);
 }
 
 void AdsPageLoadMetricsObserver::FrameReceivedFirstUserActivation(
@@ -305,20 +316,6 @@
   }
 }
 
-void AdsPageLoadMetricsObserver::OnSubframeNavigationEvaluated(
-    content::NavigationHandle* navigation_handle,
-    subresource_filter::LoadPolicy load_policy,
-    bool is_ad_subframe) {
-  // We don't track DISALLOW frames because their resources won't be loaded
-  // and therefore would provide bad histogram data. Note that WOULD_DISALLOW
-  // is only seen in dry runs.
-  if (is_ad_subframe &&
-      load_policy != subresource_filter::LoadPolicy::DISALLOW) {
-    unfinished_subresource_ad_frames_.insert(
-        navigation_handle->GetFrameTreeNodeId());
-  }
-}
-
 void AdsPageLoadMetricsObserver::OnPageInteractive(
     const page_load_metrics::mojom::PageLoadTiming& timing,
     const page_load_metrics::PageLoadExtraInfo& info) {
@@ -417,16 +414,6 @@
   subresource_observer_.RemoveAll();
 }
 
-bool AdsPageLoadMetricsObserver::DetectSubresourceFilterAd(
-    FrameTreeNodeId frame_tree_node_id) {
-  return unfinished_subresource_ad_frames_.erase(frame_tree_node_id);
-}
-
-bool AdsPageLoadMetricsObserver::DetectAds(
-    content::NavigationHandle* navigation_handle) {
-  return DetectSubresourceFilterAd(navigation_handle->GetFrameTreeNodeId());
-}
-
 int AdsPageLoadMetricsObserver::GetUnaccountedAdBytes(
     int process_id,
     const page_load_metrics::mojom::ResourceDataUpdatePtr& resource) const {
diff --git a/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.h b/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.h
index fc26f7569..af5abdf1 100644
--- a/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.h
+++ b/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.h
@@ -31,7 +31,8 @@
 
   // Returns a new AdsPageLoadMetricObserver. If the feature is disabled it
   // returns nullptr.
-  static std::unique_ptr<AdsPageLoadMetricsObserver> CreateIfNeeded();
+  static std::unique_ptr<AdsPageLoadMetricsObserver> CreateIfNeeded(
+      content::WebContents* web_contents);
 
   // For a given subframe, returns whether or not the subframe's url would be
   // considering same origin to the main frame's url. |use_parent_origin|
@@ -103,23 +104,10 @@
 
  private:
   // subresource_filter::SubresourceFilterObserver:
-  void OnSubframeNavigationEvaluated(
-      content::NavigationHandle* navigation_handle,
-      subresource_filter::LoadPolicy load_policy,
-      bool is_ad_subframe) override;
   void OnAdSubframeDetected(
       content::RenderFrameHost* render_frame_host) override;
   void OnSubresourceFilterGoingAway() override;
 
-  // Determines if the URL of a frame matches the SubresourceFilter block
-  // list. Should only be called once per frame navigation.
-  bool DetectSubresourceFilterAd(FrameTreeNodeId frame_tree_node_id);
-
-  // This should only be called once per frame navigation, as the
-  // SubresourceFilter detector clears its state about detected frames after
-  // each call in order to free up memory.
-  bool DetectAds(content::NavigationHandle* navigation_handle);
-
   // Gets the number of bytes that we may have not attributed to ad
   // resources due to the resource being reported as an ad late.
   int GetUnaccountedAdBytes(
@@ -166,11 +154,6 @@
   // |ad_frames_data_storage_|.
   std::map<FrameTreeNodeId, std::list<FrameData>::iterator> ad_frames_data_;
 
-  // The set of frames that have yet to finish but that the SubresourceFilter
-  // has reported are ads. Once DetectSubresourceFilterAd is called the id is
-  // removed from the set.
-  std::set<FrameTreeNodeId> unfinished_subresource_ad_frames_;
-
   // When the observer receives report of a document resource loading for a
   // sub-frame before the sub-frame commit occurs, hold onto the resource
   // request info (delay it) until the sub-frame commits.
diff --git a/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer_browsertest.cc b/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer_browsertest.cc
index 4b251ab..58db92f4 100644
--- a/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer_browsertest.cc
+++ b/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer_browsertest.cc
@@ -1082,3 +1082,37 @@
   EXPECT_EQ(1, samples.front().count);
   EXPECT_LE(min_percent, samples.front().min);
 }
+
+IN_PROC_BROWSER_TEST_F(AdsPageLoadMetricsObserverBrowserTest,
+                       DisallowedAdFrames_NotMeasured) {
+  base::HistogramTester histogram_tester;
+  ukm::TestAutoSetUkmRecorder ukm_recorder;
+
+  ResetConfiguration(subresource_filter::Configuration(
+      subresource_filter::mojom::ActivationLevel::kEnabled,
+      subresource_filter::ActivationScope::ALL_SITES));
+
+  // cross_site_iframe_factory loads URLs like:
+  // http://b.com:40919/cross_site_iframe_factory.html?b()
+  SetRulesetToDisallowURLsWithPathSuffix("b()");
+  const GURL main_url(embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(b,b,c,d)"));
+
+  auto waiter = CreatePageLoadMetricsTestWaiter();
+  ui_test_utils::NavigateToURL(browser(), main_url);
+
+  // One favicon resource and 2 resources for frames a,c,d
+  waiter->AddPageExpectation(
+      page_load_metrics::PageLoadMetricsTestWaiter::TimingField::kLoadEvent);
+  waiter->Wait();
+
+  // Navigate away to force the histogram recording.
+  ui_test_utils::NavigateToURL(browser(), GURL(url::kAboutBlankURL));
+
+  // Check that adframes are not included in UKM's or UMA metrics.
+  auto entries =
+      ukm_recorder.GetEntriesByName(ukm::builders::AdFrameLoad::kEntryName);
+  EXPECT_EQ(0u, entries.size());
+  histogram_tester.ExpectTotalCount(
+      "PageLoad.Clients.Ads.Bytes.AdFrames.Aggregate.Total", 0);
+}
diff --git a/chrome/browser/page_load_metrics/page_load_metrics_initialize.cc b/chrome/browser/page_load_metrics/page_load_metrics_initialize.cc
index 9ec490f..0ad976f 100644
--- a/chrome/browser/page_load_metrics/page_load_metrics_initialize.cc
+++ b/chrome/browser/page_load_metrics/page_load_metrics_initialize.cc
@@ -128,7 +128,7 @@
     tracker->AddObserver(
         std::make_unique<DataSaverSiteBreakdownMetricsObserver>());
     std::unique_ptr<AdsPageLoadMetricsObserver> ads_observer =
-        AdsPageLoadMetricsObserver::CreateIfNeeded();
+        AdsPageLoadMetricsObserver::CreateIfNeeded(tracker->GetWebContents());
     if (ads_observer)
       tracker->AddObserver(std::move(ads_observer));
 
diff --git a/chrome/browser/password_manager/chrome_password_manager_client.cc b/chrome/browser/password_manager/chrome_password_manager_client.cc
index d73473b..3f96466 100644
--- a/chrome/browser/password_manager/chrome_password_manager_client.cc
+++ b/chrome/browser/password_manager/chrome_password_manager_client.cc
@@ -143,11 +143,6 @@
   return nullptr;
 }
 
-const signin::IdentityManager* GetIdentityManagerForOriginalProfile(
-    Profile* profile) {
-  return IdentityManagerFactory::GetForProfile(profile->GetOriginalProfile());
-}
-
 #if !defined(OS_ANDROID)
 // Adds |observer| to the input observers of |widget_host|.
 void AddToWidgetInputEventObservers(
@@ -190,10 +185,7 @@
       content_credential_manager_(this),
       password_generation_driver_bindings_(web_contents, this),
       observer_(nullptr),
-      credentials_filter_(
-          this,
-          base::BindRepeating(&GetSyncService, profile_),
-          base::BindRepeating(&GetIdentityManagerForOriginalProfile, profile_)),
+      credentials_filter_(this, base::BindRepeating(&GetSyncService, profile_)),
       helper_(this) {
   ContentPasswordManagerDriverFactory::CreateForWebContents(web_contents, this,
                                                             autofill_client);
@@ -210,7 +202,7 @@
       password_manager::prefs::kCredentialsEnableService, GetPrefs());
   static base::NoDestructor<password_manager::StoreMetricsReporter> reporter(
       *saving_and_filling_passwords_enabled_, this, GetSyncService(profile_),
-      GetIdentityManagerForOriginalProfile(profile_), GetPrefs());
+      GetIdentityManager(), GetPrefs());
   driver_factory_->RequestSendLoggingAvailability();
 }
 
@@ -739,7 +731,14 @@
 
 #if defined(SYNC_PASSWORD_REUSE_DETECTION_ENABLED)
 void ChromePasswordManagerClient::OnPaste() {
-  password_reuse_detection_manager_.OnPaste(GetTextFromClipboard());
+  // TODO(vakh): This method should just call |GetTextFromClipboard()| directly
+  // but it seems to be causing crbug.com/973928 so for now, call the clipboard
+  // API directly to see if that fixes the issue.
+  // See https://crbug.com/973928#c21 for details.
+  base::string16 text;
+  ui::Clipboard::GetForCurrentThread()->ReadText(ui::ClipboardType::kCopyPaste,
+                                                 &text);
+  password_reuse_detection_manager_.OnPaste(std::move(text));
 }
 
 base::string16 ChromePasswordManagerClient::GetTextFromClipboard() {
@@ -968,6 +967,10 @@
       profile_, ServiceAccessType::EXPLICIT_ACCESS);
 }
 
+signin::IdentityManager* ChromePasswordManagerClient::GetIdentityManager() {
+  return IdentityManagerFactory::GetForProfile(profile_->GetOriginalProfile());
+}
+
 bool ChromePasswordManagerClient::IsUnderAdvancedProtection() const {
 #if BUILDFLAG(FULL_SAFE_BROWSING)
   return safe_browsing::AdvancedProtectionStatusManager::
diff --git a/chrome/browser/password_manager/chrome_password_manager_client.h b/chrome/browser/password_manager/chrome_password_manager_client.h
index d72b903..7d7e7dd 100644
--- a/chrome/browser/password_manager/chrome_password_manager_client.h
+++ b/chrome/browser/password_manager/chrome_password_manager_client.h
@@ -138,6 +138,7 @@
   password_manager::PasswordRequirementsService*
   GetPasswordRequirementsService() override;
   favicon::FaviconService* GetFaviconService() override;
+  signin::IdentityManager* GetIdentityManager() override;
   bool IsUnderAdvancedProtection() const override;
   void UpdateFormManagers() override;
   void NavigateToManagePasswordsPage(
diff --git a/chrome/browser/password_manager/password_manager_util_linux.cc b/chrome/browser/password_manager/password_manager_util_linux.cc
deleted file mode 100644
index 8989495..0000000
--- a/chrome/browser/password_manager/password_manager_util_linux.cc
+++ /dev/null
@@ -1,21 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chrome/browser/password_manager/password_manager_util_linux.h"
-
-#if !defined(OS_CHROMEOS)
-
-#include "base/strings/stringprintf.h"
-
-const char kLibsecretAndGnomeAppString[] = "chrome";
-
-// Generates a profile-specific app string based on profile_id_.
-std::string GetProfileSpecificAppString(LocalProfileId id) {
-  // Originally, the application string was always just "chrome" and used only
-  // so that we had *something* to search for since GNOME Keyring won't search
-  // for nothing. Now we use it to distinguish passwords for different profiles.
-  return base::StringPrintf("%s-%d", kLibsecretAndGnomeAppString, id);
-}
-
-#endif  // !OS_CHROMEOS
diff --git a/chrome/browser/password_manager/password_manager_util_linux.h b/chrome/browser/password_manager/password_manager_util_linux.h
deleted file mode 100644
index 16366a27..0000000
--- a/chrome/browser/password_manager/password_manager_util_linux.h
+++ /dev/null
@@ -1,25 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROME_BROWSER_PASSWORD_MANAGER_PASSWORD_MANAGER_UTIL_LINUX_H_
-#define CHROME_BROWSER_PASSWORD_MANAGER_PASSWORD_MANAGER_UTIL_LINUX_H_
-
-#include <limits>
-#include <string>
-
-#include "build/build_config.h"
-#include "chrome/browser/password_manager/password_store_factory.h"
-
-#if !defined(OS_CHROMEOS)
-
-constexpr int kMaxPossibleTimeTValue = std::numeric_limits<int>::max();
-
-extern const char kLibsecretAndGnomeAppString[];
-
-// Generates a profile-specific app string based on profile_id_.
-std::string GetProfileSpecificAppString(LocalProfileId id);
-
-#endif  // !OS_CHROMEOS
-
-#endif  // CHROME_BROWSER_PASSWORD_MANAGER_PASSWORD_MANAGER_UTIL_LINUX_H_
diff --git a/chrome/browser/password_manager/password_store_factory.cc b/chrome/browser/password_manager/password_store_factory.cc
index 811b41b..cfd6520 100644
--- a/chrome/browser/password_manager/password_store_factory.cc
+++ b/chrome/browser/password_manager/password_store_factory.cc
@@ -8,10 +8,6 @@
 #include <utility>
 
 #include "base/bind.h"
-#include "base/command_line.h"
-#include "base/environment.h"
-#include "base/metrics/histogram_macros.h"
-#include "base/rand_util.h"
 #include "build/build_config.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/profiles/incognito_helpers.h"
@@ -22,9 +18,7 @@
 #include "chrome/browser/sync/profile_sync_service_factory.h"
 #include "chrome/browser/web_data_service_factory.h"
 #include "chrome/common/chrome_paths_internal.h"
-#include "chrome/common/chrome_switches.h"
 #include "components/keyed_service/content/browser_context_dependency_manager.h"
-#include "components/os_crypt/os_crypt_switches.h"
 #include "components/password_manager/core/browser/login_database.h"
 #include "components/password_manager/core/browser/password_manager_constants.h"
 #include "components/password_manager/core/browser/password_manager_onboarding.h"
@@ -61,8 +55,6 @@
 namespace {
 
 #if defined(USE_X11)
-constexpr LocalProfileId kInvalidLocalProfileId =
-    static_cast<LocalProfileId>(0);
 constexpr PasswordStoreX::MigrationToLoginDBStep
     kMigrationToLoginDBNotAttempted = PasswordStoreX::NOT_ATTEMPTED;
 #endif
@@ -128,28 +120,6 @@
 
 PasswordStoreFactory::~PasswordStoreFactory() {}
 
-#if defined(USE_X11)
-LocalProfileId PasswordStoreFactory::GetLocalProfileId(
-    PrefService* prefs) const {
-  LocalProfileId id =
-      prefs->GetInteger(password_manager::prefs::kLocalProfileId);
-  if (id == kInvalidLocalProfileId) {
-    // Note that there are many more users than this. Thus, by design, this is
-    // not a unique id. However, it is large enough that it is very unlikely
-    // that it would be repeated twice on a single machine. It is still possible
-    // for that to occur though, so the potential results of it actually
-    // happening should be considered when using this value.
-    static const int kLocalProfileIdMask = (1 << 24) - 1;
-    do {
-      id = base::RandInt(0, kLocalProfileIdMask);
-      // TODO(mdm): scan other profiles to make sure they are not using this id?
-    } while (id == kInvalidLocalProfileId);
-    prefs->SetInteger(password_manager::prefs::kLocalProfileId, id);
-  }
-  return id;
-}
-#endif
-
 scoped_refptr<RefcountedKeyedService>
 PasswordStoreFactory::BuildServiceInstanceFor(
     content::BrowserContext* context) const {
@@ -225,8 +195,6 @@
 #if defined(USE_X11)
   // Notice that the preprocessor conditions above are exactly those that will
   // result in using PasswordStoreX in BuildServiceInstanceFor().
-  registry->RegisterIntegerPref(password_manager::prefs::kLocalProfileId,
-                                kInvalidLocalProfileId);
   registry->RegisterIntegerPref(
       password_manager::prefs::kMigrationToLoginDBStep,
       kMigrationToLoginDBNotAttempted);
diff --git a/chrome/browser/password_manager/password_store_factory.h b/chrome/browser/password_manager/password_store_factory.h
index 9d5c794f..8c5e78b00 100644
--- a/chrome/browser/password_manager/password_store_factory.h
+++ b/chrome/browser/password_manager/password_store_factory.h
@@ -13,21 +13,12 @@
 #include "components/keyed_service/content/refcounted_browser_context_keyed_service_factory.h"
 #include "components/keyed_service/core/service_access_type.h"
 
-class PrefService;
 class Profile;
 
 namespace password_manager {
 class PasswordStore;
 }
 
-#if !defined(OS_MACOSX) && !defined(OS_CHROMEOS) && defined(OS_POSIX)
-// Local profile ids are used to associate resources stored outside the profile
-// directory, like saved passwords in GNOME Keyring / KWallet, with a profile.
-// With high probability, they are unique on the local machine. They are almost
-// certainly not unique globally, by design. Do not send them over the network.
-typedef int LocalProfileId;
-#endif
-
 // Singleton that owns all PasswordStores and associates them with
 // Profiles.
 class PasswordStoreFactory
@@ -49,10 +40,6 @@
   PasswordStoreFactory();
   ~PasswordStoreFactory() override;
 
-#if !defined(OS_MACOSX) && !defined(OS_CHROMEOS) && defined(OS_POSIX)
-  LocalProfileId GetLocalProfileId(PrefService* prefs) const;
-#endif
-
   // RefcountedBrowserContextKeyedServiceFactory:
   scoped_refptr<RefcountedKeyedService> BuildServiceInstanceFor(
       content::BrowserContext* context) const override;
diff --git a/chrome/browser/prefs/browser_prefs.cc b/chrome/browser/prefs/browser_prefs.cc
index 1e604e9..a162849 100644
--- a/chrome/browser/prefs/browser_prefs.cc
+++ b/chrome/browser/prefs/browser_prefs.cc
@@ -480,6 +480,9 @@
 // Deprecated 7/2019
 const char kLastKnownGoogleURL[] = "browser.last_known_google_url";
 const char kLastPromptedGoogleURL[] = "browser.last_prompted_google_url";
+#if defined(USE_X11)
+constexpr char kLocalProfileId[] = "profile.local_profile_id";
+#endif
 
 // Register prefs used only for migration (clearing or moving to a new key).
 void RegisterProfilePrefsForMigration(
@@ -550,6 +553,9 @@
 
   registry->RegisterStringPref(kLastKnownGoogleURL, std::string());
   registry->RegisterStringPref(kLastPromptedGoogleURL, std::string());
+#if defined(USE_X11)
+  registry->RegisterIntegerPref(kLocalProfileId, 0);
+#endif
 }
 
 }  // namespace
@@ -1141,4 +1147,9 @@
   profile_prefs->ClearPref(kWebAuthnLastTransportUsedPrefName);
   profile_prefs->ClearPref(kWebAuthnBlePairedMacAddressesPrefName);
 #endif  // defined(OS_ANDROID)
+
+  // Added 7/2019.
+#if defined(USE_X11)
+  profile_prefs->ClearPref(kLocalProfileId);
+#endif
 }
diff --git a/chrome/browser/resources/chromeos/chromevox/cvox2/background/panel_test.extjs b/chrome/browser/resources/chromeos/chromevox/cvox2/background/panel_test.extjs
index ca3397e..c70eb411 100644
--- a/chrome/browser/resources/chromeos/chromevox/cvox2/background/panel_test.extjs
+++ b/chrome/browser/resources/chromeos/chromevox/cvox2/background/panel_test.extjs
@@ -22,21 +22,6 @@
   /** @override */
   testGenCppIncludes: function() {
     ChromeVoxE2ETest.prototype.  testGenCppIncludes.call(this);
-
-    // See https://crbug.com/795840 for details and history.
-    GEN(`
-#if !defined(NDEBUG) || defined(MEMORY_SANITIZER)
-#define MAYBE_ActivateMenu DISABLED_ActivateMenu
-#else
-#define MAYBE_ActivateMenu ActivateMenu
-#endif
-
-#if !defined(NDEBUG) || defined(MEMORY_SANITIZER) || defined(ADDRESS_SANITIZER)
-#define MAYBE_LinkMenu DISABLED_LinkMenu
-#else
-#define MAYBE_LinkMenu LinkMenu
-#endif
-    `);
   },
 
   /**
@@ -86,7 +71,8 @@
   */}
 };
 
-TEST_F('ChromeVoxPanelTest', 'MAYBE_ActivateMenu', function() {
+// TODO: Flaky timeouts. https://crbug.com/795840 and https://crbug.com/990229
+TEST_F('ChromeVoxPanelTest', 'DISABLED_ActivateMenu', function() {
   var mockFeedback = this.createMockFeedback();
   this.runWithLoadedTree(this.linksDoc, function(root) {
     var openMenus = new PanelCommand(PanelCommandType.OPEN_MENUS);
@@ -104,7 +90,8 @@
   });
 });
 
-TEST_F('ChromeVoxPanelTest', 'MAYBE_LinkMenu', function() {
+// TODO: Flaky timeouts. https://crbug.com/795840 and https://crbug.com/990229
+TEST_F('ChromeVoxPanelTest', 'DISABLED_LinkMenu', function() {
   var mockFeedback = this.createMockFeedback();
   this.runWithLoadedTree(this.linksDoc, function(root) {
     var openMenus = new PanelCommand(PanelCommandType.OPEN_MENUS, 'role_link');
diff --git a/chrome/browser/resources/settings/google_assistant_page/google_assistant_page.js b/chrome/browser/resources/settings/google_assistant_page/google_assistant_page.js
index a901f4e3..559d651 100644
--- a/chrome/browser/resources/settings/google_assistant_page/google_assistant_page.js
+++ b/chrome/browser/resources/settings/google_assistant_page/google_assistant_page.js
@@ -16,7 +16,7 @@
  * Indicates user's activity control consent status.
  *
  * Note: This should be kept in sync with ash::mojom::ConsentStatus in
- * ash/public/interfaces/voice_interaction_controller.mojom
+ * ash/public/mojom/voice_interaction_controller.mojom
  * @enum {number}
  */
 const ConsentStatus = {
diff --git a/chrome/browser/spellchecker/spell_check_host_chrome_impl.cc b/chrome/browser/spellchecker/spell_check_host_chrome_impl.cc
index 0a656b5c..44f7af39 100644
--- a/chrome/browser/spellchecker/spell_check_host_chrome_impl.cc
+++ b/chrome/browser/spellchecker/spell_check_host_chrome_impl.cc
@@ -104,8 +104,10 @@
   // a response is received (including an error) from the remote Spelling
   // service, calls CallSpellingServiceDone.
   auto* host = content::RenderProcessHost::FromID(render_process_id_);
-  if (!host)
+  if (!host) {
+    std::move(callback).Run(false, std::vector<SpellCheckResult>());
     return;
+  }
   client_.RequestTextCheck(
       host->GetBrowserContext(), SpellingServiceClient::SPELLCHECK, text,
       base::BindOnce(&SpellCheckHostChromeImpl::CallSpellingServiceDone,
diff --git a/chrome/browser/sync/sync_ui_util.cc b/chrome/browser/sync/sync_ui_util.cc
index 41d276e83..7ee628d 100644
--- a/chrome/browser/sync/sync_ui_util.cc
+++ b/chrome/browser/sync/sync_ui_util.cc
@@ -260,12 +260,16 @@
   const syncer::SyncService* service =
       ProfileSyncServiceFactory::GetForProfile(profile);
 
+  // If there is no SyncService (probably because sync is disabled from the
+  // command line), then there's no error to show.
+  if (!service)
+    return NO_SYNC_ERROR;
+
   // The order or priority is going to be: 1. Unrecoverable errors.
   // 2. Auth errors. 3. Outdated client errors. 4. Passphrase errors.
   // Note that an unrecoverable error is sometimes caused by the Chrome client
   // being outdated; that case is handled separately below.
-  if (service && service->HasUnrecoverableError() &&
-      !service->RequiresClientUpgrade()) {
+  if (service->HasUnrecoverableError() && !service->RequiresClientUpgrade()) {
     // Display different messages and buttons for managed accounts.
     if (!signin_util::IsUserSignoutAllowedForProfile(profile)) {
       // For a managed user, the user is directed to the signout
@@ -294,28 +298,25 @@
     return AUTH_ERROR;
   }
 
-  // Check for sync errors if the sync service is enabled.
-  if (service) {
-    // Check if the Chrome client needs to be updated.
-    if (service->RequiresClientUpgrade()) {
-      *content_string_id = IDS_SYNC_ERROR_USER_MENU_UPGRADE_MESSAGE;
-      *button_string_id = IDS_SYNC_ERROR_USER_MENU_UPGRADE_BUTTON;
-      return UPGRADE_CLIENT_ERROR;
-    }
+  // Check if the Chrome client needs to be updated.
+  if (service->RequiresClientUpgrade()) {
+    *content_string_id = IDS_SYNC_ERROR_USER_MENU_UPGRADE_MESSAGE;
+    *button_string_id = IDS_SYNC_ERROR_USER_MENU_UPGRADE_BUTTON;
+    return UPGRADE_CLIENT_ERROR;
+  }
 
-    // Check for a sync passphrase error.
-    if (ShouldShowPassphraseError(service)) {
-      *content_string_id = IDS_SYNC_ERROR_USER_MENU_PASSPHRASE_MESSAGE;
-      *button_string_id = IDS_SYNC_ERROR_USER_MENU_PASSPHRASE_BUTTON;
-      return PASSPHRASE_ERROR;
-    }
+  // Check for a sync passphrase error.
+  if (ShouldShowPassphraseError(service)) {
+    *content_string_id = IDS_SYNC_ERROR_USER_MENU_PASSPHRASE_MESSAGE;
+    *button_string_id = IDS_SYNC_ERROR_USER_MENU_PASSPHRASE_BUTTON;
+    return PASSPHRASE_ERROR;
+  }
 
-    // Check for a sync confirmation error.
-    if (ShouldRequestSyncConfirmation(service)) {
-      *content_string_id = IDS_SYNC_SETTINGS_NOT_CONFIRMED;
-      *button_string_id = IDS_SYNC_ERROR_USER_MENU_CONFIRM_SYNC_SETTINGS_BUTTON;
-      return SETTINGS_UNCONFIRMED_ERROR;
-    }
+  // Check for a sync confirmation error.
+  if (ShouldRequestSyncConfirmation(service)) {
+    *content_string_id = IDS_SYNC_SETTINGS_NOT_CONFIRMED;
+    *button_string_id = IDS_SYNC_ERROR_USER_MENU_CONFIRM_SYNC_SETTINGS_BUTTON;
+    return SETTINGS_UNCONFIRMED_ERROR;
   }
 
   // There is no error.
diff --git a/chrome/browser/sync/test/integration/profile_sync_service_harness.cc b/chrome/browser/sync/test/integration/profile_sync_service_harness.cc
index 4d8d9ce..f15630a 100644
--- a/chrome/browser/sync/test/integration/profile_sync_service_harness.cc
+++ b/chrome/browser/sync/test/integration/profile_sync_service_harness.cc
@@ -340,18 +340,6 @@
   return true;
 }
 
-bool ProfileSyncServiceHarness::HasUnsyncedItems() {
-  base::RunLoop loop;
-  bool result = false;
-  service()->HasUnsyncedItemsForTest(
-      base::BindLambdaForTesting([&](bool has_unsynced_items) {
-        result = has_unsynced_items;
-        loop.Quit();
-      }));
-  loop.Run();
-  return result;
-}
-
 bool ProfileSyncServiceHarness::AwaitMutualSyncCycleCompletion(
     ProfileSyncServiceHarness* partner) {
   std::vector<ProfileSyncServiceHarness*> harnesses;
diff --git a/chrome/browser/sync/test/integration/profile_sync_service_harness.h b/chrome/browser/sync/test/integration/profile_sync_service_harness.h
index 6677080..1f714dc 100644
--- a/chrome/browser/sync/test/integration/profile_sync_service_harness.h
+++ b/chrome/browser/sync/test/integration/profile_sync_service_harness.h
@@ -104,11 +104,6 @@
   // Starts the sync service after a previous stop.
   bool StartSyncService();
 
-  // Returns whether this client has unsynced items. Avoid verifying false
-  // return values, because tests typically shouldn't make assumptions about
-  // other datatypes.
-  bool HasUnsyncedItems();
-
   // Calling this acts as a barrier and blocks the caller until |this| and
   // |partner| have both completed a sync cycle.  When calling this method,
   // the |partner| should be the passive responder who responds to the actions
diff --git a/chrome/browser/sync/test/integration/single_client_custom_passphrase_sync_test.cc b/chrome/browser/sync/test/integration/single_client_custom_passphrase_sync_test.cc
index 2fd3a08..d54acf9d 100644
--- a/chrome/browser/sync/test/integration/single_client_custom_passphrase_sync_test.cc
+++ b/chrome/browser/sync/test/integration/single_client_custom_passphrase_sync_test.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "base/base64.h"
 #include "base/test/scoped_feature_list.h"
 #include "chrome/browser/sync/test/integration/bookmarks_helper.h"
 #include "chrome/browser/sync/test/integration/encryption_helper.h"
@@ -455,6 +456,63 @@
   EXPECT_TRUE(WaitForClientBookmarkWithTitle("some bookmark"));
 }
 
+// TODO(https://crbug.com/952074): re-enable once flakiness is addressed.
+#if defined(THREAD_SANITIZER)
+#define MAYBE_PRE_ShouldLoadDirectoryCustomPassphraseInUSSMode \
+  DISABLED_PRE_ShouldLoadDirectoryCustomPassphraseInUSSMode
+#else
+#define MAYBE_PRE_ShouldLoadDirectoryCustomPassphraseInUSSMode \
+  PRE_ShouldLoadDirectoryCustomPassphraseInUSSMode
+#endif
+
+IN_PROC_BROWSER_TEST_F(SingleClientCustomPassphraseSyncTest,
+                       MAYBE_PRE_ShouldLoadDirectoryCustomPassphraseInUSSMode) {
+  base::test::ScopedFeatureList override_features;
+  override_features.InitWithFeatures(
+      /*enabled_features=*/{switches::kSyncUseScryptForNewCustomPassphrases},
+      /*disabled_features=*/{switches::kSyncUSSNigori});
+  ASSERT_TRUE(SetupSync());
+  ASSERT_TRUE(WaitForNigori(PassphraseType::KEYSTORE_PASSPHRASE));
+  GetSyncService()->GetUserSettings()->SetEncryptionPassphrase("hunter2");
+  ASSERT_TRUE(WaitForNigori(PassphraseType::CUSTOM_PASSPHRASE));
+}
+
+// TODO(https://crbug.com/952074): re-enable once flakiness is addressed.
+#if defined(THREAD_SANITIZER)
+#define MAYBE_ShouldLoadDirectoryCustomPassphraseInUSSMode \
+  DISABLED_ShouldLoadDirectoryCustomPassphraseInUSSMode
+#else
+#define MAYBE_ShouldLoadDirectoryCustomPassphraseInUSSMode \
+  ShouldLoadDirectoryCustomPassphraseInUSSMode
+#endif
+
+IN_PROC_BROWSER_TEST_F(SingleClientCustomPassphraseSyncTest,
+                       MAYBE_ShouldLoadDirectoryCustomPassphraseInUSSMode) {
+  // We should be able to decrypt bookmarks with passphrase, which was set when
+  // kSyncUSSNigori was disabled, without providing it again once kSyncUSSNigori
+  // is enabled.
+  base::test::ScopedFeatureList override_features;
+  override_features.InitWithFeatures(
+      /*enabled_features=*/{switches::kSyncUSSBookmarks,
+                            switches::kSyncUSSPasswords,
+                            switches::kSyncUSSAutofillWalletMetadata,
+                            switches::kSyncUSSNigori},
+      /*disabled_features=*/{});
+  NigoriSpecifics nigori;
+  ASSERT_TRUE(GetServerNigori(GetFakeServer(), &nigori));
+  std::string decoded_scrypt_salt;
+  ASSERT_TRUE(base::Base64Decode(nigori.custom_passphrase_key_derivation_salt(),
+                                 &decoded_scrypt_salt));
+  const KeyParams key_params = {
+      KeyDerivationParams::CreateForScrypt(decoded_scrypt_salt), "hunter2"};
+  InjectEncryptedServerBookmark(
+      "some bookmark", GURL("http://example.com/doesnt-matter"), key_params);
+  ASSERT_TRUE(SetupClients());
+
+  EXPECT_TRUE(WaitForPassphraseRequiredState(/*desired_state=*/false));
+  EXPECT_TRUE(WaitForClientBookmarkWithTitle("some bookmark"));
+}
+
 INSTANTIATE_TEST_SUITE_P(USS,
                          SingleClientCustomPassphraseDoNotUseScryptSyncTest,
                          testing::Values(false, true));
diff --git a/chrome/browser/sync/test/integration/two_client_sessions_sync_test.cc b/chrome/browser/sync/test/integration/two_client_sessions_sync_test.cc
index 64308f9..708c60f7 100644
--- a/chrome/browser/sync/test/integration/two_client_sessions_sync_test.cc
+++ b/chrome/browser/sync/test/integration/two_client_sessions_sync_test.cc
@@ -191,7 +191,6 @@
 
   // Client 1 now deletes client 0's tabs. This frees the memory of sessions1.
   DeleteForeignSession(1, sessions1[0]->session_tag);
-  ASSERT_TRUE(GetClient(1)->HasUnsyncedItems());
   ASSERT_TRUE(GetClient(1)->AwaitMutualSyncCycleCompletion(GetClient(0)));
   EXPECT_FALSE(GetSessionData(1, &sessions1));
 }
@@ -212,7 +211,6 @@
 
   // Client 1 now deletes client 0's tabs. This frees the memory of sessions1.
   DeleteForeignSession(1, sessions1[0]->session_tag);
-  ASSERT_TRUE(GetClient(1)->HasUnsyncedItems());
   ASSERT_TRUE(GetClient(1)->AwaitMutualSyncCycleCompletion(GetClient(0)));
   ASSERT_FALSE(GetSessionData(1, &sessions1));
 
diff --git a/chrome/browser/ui/BUILD.gn b/chrome/browser/ui/BUILD.gn
index faafa5e..3381620e 100644
--- a/chrome/browser/ui/BUILD.gn
+++ b/chrome/browser/ui/BUILD.gn
@@ -1427,6 +1427,8 @@
       "ash/ambient/photo_controller_impl.h",
       "ash/arc_chrome_actions_client.cc",
       "ash/arc_chrome_actions_client.h",
+      "ash/arc_custom_tab_modal_dialog_host.cc",
+      "ash/arc_custom_tab_modal_dialog_host.h",
       "ash/ash_shell_init.cc",
       "ash/ash_shell_init.h",
       "ash/ash_util.cc",
diff --git a/chrome/browser/ui/ash/arc_custom_tab_modal_dialog_host.cc b/chrome/browser/ui/ash/arc_custom_tab_modal_dialog_host.cc
new file mode 100644
index 0000000..94ae4ba
--- /dev/null
+++ b/chrome/browser/ui/ash/arc_custom_tab_modal_dialog_host.cc
@@ -0,0 +1,53 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/ui/ash/arc_custom_tab_modal_dialog_host.h"
+
+#include <utility>
+
+#include "ash/public/cpp/arc_custom_tab.h"
+#include "components/web_modal/modal_dialog_host.h"
+#include "components/web_modal/web_contents_modal_dialog_manager.h"
+#include "content/public/browser/web_contents.h"
+#include "ui/gfx/geometry/point.h"
+#include "ui/gfx/geometry/size.h"
+
+ArcCustomTabModalDialogHost::ArcCustomTabModalDialogHost(
+    std::unique_ptr<ash::ArcCustomTab> custom_tab,
+    std::unique_ptr<content::WebContents> web_contents)
+    : custom_tab_(std::move(custom_tab)),
+      web_contents_(std::move(web_contents)) {
+  // Attach any required WebContents helpers. Browser tabs automatically get
+  // them attached in TabHelpers::AttachTabHelpers.
+  web_modal::WebContentsModalDialogManager::CreateForWebContents(
+      web_contents_.get());
+  web_modal::WebContentsModalDialogManager::FromWebContents(web_contents_.get())
+      ->SetDelegate(this);
+}
+
+ArcCustomTabModalDialogHost::~ArcCustomTabModalDialogHost() = default;
+
+web_modal::WebContentsModalDialogHost*
+ArcCustomTabModalDialogHost::GetWebContentsModalDialogHost() {
+  return this;
+}
+
+gfx::NativeView ArcCustomTabModalDialogHost::GetHostView() const {
+  return custom_tab_->GetHostView();
+}
+
+gfx::Point ArcCustomTabModalDialogHost::GetDialogPosition(
+    const gfx::Size& size) {
+  return web_contents_->GetViewBounds().origin();
+}
+
+gfx::Size ArcCustomTabModalDialogHost::GetMaximumDialogSize() {
+  return web_contents_->GetViewBounds().size();
+}
+
+void ArcCustomTabModalDialogHost::AddObserver(
+    web_modal::ModalDialogHostObserver* observer) {}
+
+void ArcCustomTabModalDialogHost::RemoveObserver(
+    web_modal::ModalDialogHostObserver* observer) {}
diff --git a/chrome/browser/ui/ash/arc_custom_tab_modal_dialog_host.h b/chrome/browser/ui/ash/arc_custom_tab_modal_dialog_host.h
new file mode 100644
index 0000000..b654d82
--- /dev/null
+++ b/chrome/browser/ui/ash/arc_custom_tab_modal_dialog_host.h
@@ -0,0 +1,61 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_UI_ASH_ARC_CUSTOM_TAB_MODAL_DIALOG_HOST_H_
+#define CHROME_BROWSER_UI_ASH_ARC_CUSTOM_TAB_MODAL_DIALOG_HOST_H_
+
+#include <memory>
+
+#include "base/macros.h"
+#include "components/web_modal/web_contents_modal_dialog_host.h"
+#include "components/web_modal/web_contents_modal_dialog_manager_delegate.h"
+#include "ui/gfx/native_widget_types.h"
+
+namespace ash {
+class ArcCustomTab;
+}  // namespace ash
+
+namespace contents {
+class WebContents;
+}  // namespace contents
+
+namespace gfx {
+class Point;
+class Size;
+}  // namespace gfx
+
+namespace web_modal {
+class ModalDialogHostObserver;
+}  // namespace web_modal
+
+// Implements a WebContentsModalDialogHost for an ARC Custom Tab. This allows a
+// web contents modal dialog to be drawn in the ARC Custom Tab.
+class ArcCustomTabModalDialogHost
+    : public web_modal::WebContentsModalDialogHost,
+      public web_modal::WebContentsModalDialogManagerDelegate {
+ public:
+  ArcCustomTabModalDialogHost(
+      std::unique_ptr<ash::ArcCustomTab> custom_tab,
+      std::unique_ptr<content::WebContents> web_contents);
+  ~ArcCustomTabModalDialogHost() override = 0;
+
+  // web_modal::WebContentsModalDialogManagerDelegate:
+  web_modal::WebContentsModalDialogHost* GetWebContentsModalDialogHost()
+      override;
+
+  // web_modal::WebContentsModalDialogHost:
+  gfx::NativeView GetHostView() const override;
+  gfx::Point GetDialogPosition(const gfx::Size& size) override;
+  gfx::Size GetMaximumDialogSize() override;
+  void AddObserver(web_modal::ModalDialogHostObserver* observer) override;
+  void RemoveObserver(web_modal::ModalDialogHostObserver* observer) override;
+
+ protected:
+  std::unique_ptr<ash::ArcCustomTab> custom_tab_;
+  std::unique_ptr<content::WebContents> web_contents_;
+
+  DISALLOW_COPY_AND_ASSIGN(ArcCustomTabModalDialogHost);
+};
+
+#endif  // CHROME_BROWSER_UI_ASH_ARC_CUSTOM_TAB_MODAL_DIALOG_HOST_H_
diff --git a/chrome/browser/ui/ash/assistant/assistant_client.cc b/chrome/browser/ui/ash/assistant/assistant_client.cc
index 1fa685a..f7efb3c 100644
--- a/chrome/browser/ui/ash/assistant/assistant_client.cc
+++ b/chrome/browser/ui/ash/assistant/assistant_client.cc
@@ -6,7 +6,7 @@
 
 #include <utility>
 
-#include "ash/public/interfaces/voice_interaction_controller.mojom.h"
+#include "ash/public/mojom/voice_interaction_controller.mojom.h"
 #include "chrome/browser/chromeos/arc/voice_interaction/voice_interaction_controller_client.h"
 #include "chrome/browser/chromeos/assistant/assistant_util.h"
 #include "chrome/browser/chromeos/profiles/profile_helper.h"
diff --git a/chrome/browser/ui/ash/chrome_browser_main_extra_parts_ash.cc b/chrome/browser/ui/ash/chrome_browser_main_extra_parts_ash.cc
index dcde18b..7a66927f 100644
--- a/chrome/browser/ui/ash/chrome_browser_main_extra_parts_ash.cc
+++ b/chrome/browser/ui/ash/chrome_browser_main_extra_parts_ash.cc
@@ -9,7 +9,7 @@
 #include "ash/public/cpp/ash_features.h"
 #include "ash/public/cpp/shelf_model.h"
 #include "ash/public/cpp/window_properties.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "ash/shell.h"
 #include "base/command_line.h"
 #include "base/task/post_task.h"
diff --git a/chrome/browser/ui/ash/chrome_new_window_client.cc b/chrome/browser/ui/ash/chrome_new_window_client.cc
index b4c90ce..416e3fe 100644
--- a/chrome/browser/ui/ash/chrome_new_window_client.cc
+++ b/chrome/browser/ui/ash/chrome_new_window_client.cc
@@ -11,13 +11,14 @@
 #include "ash/public/cpp/arc_custom_tab.h"
 #include "ash/public/cpp/ash_features.h"
 #include "ash/public/cpp/keyboard_shortcut_viewer.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "base/macros.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/timer/elapsed_timer.h"
 #include "chrome/browser/apps/launch_service/launch_service.h"
 #include "chrome/browser/chromeos/arc/arc_web_contents_data.h"
 #include "chrome/browser/chromeos/arc/fileapi/arc_content_file_system_url_util.h"
+#include "chrome/browser/chromeos/arc/intent_helper/custom_tab_session_impl.h"
 #include "chrome/browser/chromeos/file_manager/app_id.h"
 #include "chrome/browser/chromeos/profiles/profile_helper.h"
 #include "chrome/browser/extensions/api/terminal/terminal_extension_helper.h"
@@ -51,9 +52,6 @@
 #include "components/user_manager/user.h"
 #include "components/user_manager/user_manager.h"
 #include "components/version_info/version_info.h"
-#include "components/web_modal/web_contents_modal_dialog_host.h"
-#include "components/web_modal/web_contents_modal_dialog_manager.h"
-#include "components/web_modal/web_contents_modal_dialog_manager_delegate.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/service_manager_connection.h"
 #include "content/public/common/user_agent.h"
@@ -66,9 +64,6 @@
 #include "ui/aura/window.h"
 #include "ui/base/page_transition_types.h"
 #include "ui/base/window_open_disposition.h"
-#include "ui/gfx/geometry/point.h"
-#include "ui/gfx/geometry/size.h"
-#include "ui/gfx/native_widget_types.h"
 #include "url/url_constants.h"
 
 using arc::mojom::ChromePage;
@@ -159,152 +154,49 @@
   return result;
 }
 
-// Implementation of CustomTabSession interface.
-class CustomTabSessionImpl
-    : public arc::mojom::CustomTabSession,
-      public web_modal::WebContentsModalDialogHost,
-      public web_modal::WebContentsModalDialogManagerDelegate {
- public:
-  static arc::mojom::CustomTabSessionPtr Create(
-      Profile* profile,
-      const GURL& url,
-      std::unique_ptr<ash::ArcCustomTab> custom_tab) {
-    if (!custom_tab)
-      return nullptr;
+// Creates a web contents for an ARC Custom Tab using the given profile and url.
+std::unique_ptr<content::WebContents> CreateArcCustomTabWebContents(
+    Profile* profile,
+    const GURL& url) {
+  scoped_refptr<content::SiteInstance> site_instance =
+      tab_util::GetSiteInstanceForNewTab(profile, url);
+  content::WebContents::CreateParams create_params(profile, site_instance);
+  std::unique_ptr<content::WebContents> web_contents =
+      content::WebContents::Create(create_params);
 
-    // This object will be deleted when the mojo connection is closed.
-    auto* tab = new CustomTabSessionImpl(profile, url, std::move(custom_tab));
-    arc::mojom::CustomTabSessionPtr ptr;
-    tab->Bind(&ptr);
-    return ptr;
+  // Use the same version number as browser_commands.cc
+  // TODO(hashimoto): Get the actual Android version from the container.
+  constexpr char kOsOverrideForTabletSite[] = "Linux; Android 9; Chrome tablet";
+  // Override the user agent to request mobile version web sites.
+  const std::string product =
+      version_info::GetProductNameAndVersionForUserAgent();
+  const std::string user_agent = content::BuildUserAgentFromOSAndProduct(
+      kOsOverrideForTabletSite, product);
+  web_contents->SetUserAgentOverride(user_agent,
+                                     false /*override_in_new_tabs=*/);
+
+  content::NavigationController::LoadURLParams load_url_params(url);
+  load_url_params.source_site_instance = site_instance;
+  load_url_params.override_user_agent =
+      content::NavigationController::UA_OVERRIDE_TRUE;
+  web_contents->GetController().LoadURLWithParams(load_url_params);
+
+  // Add a flag to remember this tab originated in the ARC context.
+  web_contents->SetUserData(&arc::ArcWebContentsData::kArcTransitionFlag,
+                            std::make_unique<arc::ArcWebContentsData>());
+
+  return web_contents;
+}
+
+// Returns an ARC window with the given task ID.
+aura::Window* GetArcWindow(int32_t task_id) {
+  for (auto* window : ChromeLauncherController::instance()->GetArcWindows()) {
+    if (arc::GetWindowTaskId(window) == task_id)
+      return window;
   }
 
-  // web_modal::WebContentsModalDialogManagerDelegate:
-  web_modal::WebContentsModalDialogHost* GetWebContentsModalDialogHost()
-      override {
-    return this;
-  }
-
-  // web_modal::WebContentsModalDialogHost:
-  gfx::NativeView GetHostView() const override {
-    return custom_tab_->GetHostView();
-  }
-
-  gfx::Point GetDialogPosition(const gfx::Size& size) override {
-    return web_contents_->GetViewBounds().origin();
-  }
-
-  gfx::Size GetMaximumDialogSize() override {
-    return web_contents_->GetViewBounds().size();
-  }
-
-  void AddObserver(web_modal::ModalDialogHostObserver* observer) override {
-  }
-
-  void RemoveObserver(web_modal::ModalDialogHostObserver* observer) override {
-  }
-
-  // arc::mojom::CustomTabSession:
-  void OnOpenInChromeClicked() override { forwarded_to_normal_tab_ = true; }
-
- private:
-  CustomTabSessionImpl(Profile* profile,
-                       const GURL& url,
-                       std::unique_ptr<ash::ArcCustomTab> custom_tab)
-      : binding_(this),
-        custom_tab_(std::move(custom_tab)),
-        web_contents_(CreateWebContents(profile, url)),
-        weak_ptr_factory_(this) {
-    aura::Window* window = web_contents_->GetNativeView();
-    custom_tab_->Attach(window);
-    window->Show();
-  }
-
-  ~CustomTabSessionImpl() override {
-    // Keep in sync with ArcCustomTabsSessionEndReason in
-    // //tools/metrics/histograms/enums.xml.
-    enum class SessionEndReason {
-      CLOSED = 0,
-      FORWARDED_TO_NORMAL_TAB = 1,
-      kMaxValue = FORWARDED_TO_NORMAL_TAB,
-    } session_end_reason = forwarded_to_normal_tab_
-                               ? SessionEndReason::FORWARDED_TO_NORMAL_TAB
-                               : SessionEndReason::CLOSED;
-    UMA_HISTOGRAM_ENUMERATION("Arc.CustomTabs.SessionEndReason",
-                              session_end_reason);
-    auto elapsed = lifetime_timer_.Elapsed();
-    UMA_HISTOGRAM_LONG_TIMES("Arc.CustomTabs.SessionLifetime2.All", elapsed);
-    switch (session_end_reason) {
-      case SessionEndReason::CLOSED:
-        UMA_HISTOGRAM_LONG_TIMES("Arc.CustomTabs.SessionLifetime2.Closed",
-                                 elapsed);
-        break;
-      case SessionEndReason::FORWARDED_TO_NORMAL_TAB:
-        UMA_HISTOGRAM_LONG_TIMES(
-            "Arc.CustomTabs.SessionLifetime2.ForwardedToNormalTab", elapsed);
-        break;
-    }
-  }
-
-  void Bind(arc::mojom::CustomTabSessionPtr* ptr) {
-    binding_.Bind(mojo::MakeRequest(ptr));
-    binding_.set_connection_error_handler(base::BindOnce(
-        &CustomTabSessionImpl::Close, weak_ptr_factory_.GetWeakPtr()));
-  }
-
-  // Deletes this object when the mojo connection is closed.
-  void Close() { delete this; }
-
-  std::unique_ptr<content::WebContents> CreateWebContents(Profile* profile,
-                                                          const GURL& url) {
-    scoped_refptr<content::SiteInstance> site_instance =
-        tab_util::GetSiteInstanceForNewTab(profile, url);
-    content::WebContents::CreateParams create_params(profile, site_instance);
-    std::unique_ptr<content::WebContents> web_contents =
-        content::WebContents::Create(create_params);
-
-    // Use the same version number as browser_commands.cc
-    // TODO(hashimoto): Get the actual Android version from the container.
-    constexpr char kOsOverrideForTabletSite[] =
-        "Linux; Android 9; Chrome tablet";
-    // Override the user agent to request mobile version web sites.
-    const std::string product =
-        version_info::GetProductNameAndVersionForUserAgent();
-    const std::string user_agent = content::BuildUserAgentFromOSAndProduct(
-        kOsOverrideForTabletSite, product);
-    web_contents->SetUserAgentOverride(user_agent,
-                                       false /*override_in_new_tabs=*/);
-
-    content::NavigationController::LoadURLParams load_url_params(url);
-    load_url_params.source_site_instance = site_instance;
-    load_url_params.override_user_agent =
-        content::NavigationController::UA_OVERRIDE_TRUE;
-    web_contents->GetController().LoadURLWithParams(load_url_params);
-
-    // Add a flag to remember this tab originated in the ARC context.
-    web_contents->SetUserData(&arc::ArcWebContentsData::kArcTransitionFlag,
-                              std::make_unique<arc::ArcWebContentsData>());
-
-    // Attach any required WebContents helpers. Browser tabs automatically get
-    // them attached in TabHelpers::AttachTabHelpers.
-    web_modal::WebContentsModalDialogManager::CreateForWebContents(
-        web_contents.get());
-    web_modal::WebContentsModalDialogManager::FromWebContents(
-        web_contents.get())
-        ->SetDelegate(this);
-
-    return web_contents;
-  }
-
-  mojo::Binding<arc::mojom::CustomTabSession> binding_;
-  std::unique_ptr<ash::ArcCustomTab> custom_tab_;
-  std::unique_ptr<content::WebContents> web_contents_;
-  base::ElapsedTimer lifetime_timer_;
-  bool forwarded_to_normal_tab_ = false;
-  base::WeakPtrFactory<CustomTabSessionImpl> weak_ptr_factory_;
-
-  DISALLOW_COPY_AND_ASSIGN(CustomTabSessionImpl);
-};
+  return nullptr;
+}
 
 }  // namespace
 
@@ -565,24 +457,18 @@
   GURL url_to_open = ConvertArcUrlToExternalFileUrlIfNeeded(url);
   Profile* profile = ProfileManager::GetActiveUserProfile();
 
-  aura::Window* arc_window = nullptr;
-  for (auto* window : ChromeLauncherController::instance()->GetArcWindows()) {
-    if (arc::GetWindowTaskId(window) == task_id) {
-      arc_window = window;
-      break;
-    }
-  }
+  aura::Window* arc_window = GetArcWindow(task_id);
   if (!arc_window) {
     LOG(ERROR) << "No ARC window with the specified task ID " << task_id;
-    std::move(callback).Run(
-        CustomTabSessionImpl::Create(profile, url, nullptr));
+    std::move(callback).Run(nullptr);
     return;
   }
 
   auto custom_tab =
       ash::ArcCustomTab::Create(arc_window, surface_id, top_margin);
-  std::move(callback).Run(
-      CustomTabSessionImpl::Create(profile, url, std::move(custom_tab)));
+  auto web_contents = CreateArcCustomTabWebContents(profile, url);
+  std::move(callback).Run(CustomTabSessionImpl::Create(std::move(web_contents),
+                                                       std::move(custom_tab)));
 }
 
 content::WebContents* ChromeNewWindowClient::OpenUrlImpl(
diff --git a/chrome/browser/ui/ash/ime_controller_client.cc b/chrome/browser/ui/ash/ime_controller_client.cc
index e261390..990227a 100644
--- a/chrome/browser/ui/ash/ime_controller_client.cc
+++ b/chrome/browser/ui/ash/ime_controller_client.cc
@@ -7,7 +7,7 @@
 #include <memory>
 #include <vector>
 
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "base/logging.h"
 #include "base/strings/utf_string_conversions.h"
 #include "content/public/browser/system_connector.h"
diff --git a/chrome/browser/ui/ash/ime_controller_client.h b/chrome/browser/ui/ash/ime_controller_client.h
index 73da8e50..623e34d4 100644
--- a/chrome/browser/ui/ash/ime_controller_client.h
+++ b/chrome/browser/ui/ash/ime_controller_client.h
@@ -5,8 +5,8 @@
 #ifndef CHROME_BROWSER_UI_ASH_IME_CONTROLLER_CLIENT_H_
 #define CHROME_BROWSER_UI_ASH_IME_CONTROLLER_CLIENT_H_
 
-#include "ash/public/interfaces/ime_controller.mojom.h"
-#include "ash/public/interfaces/ime_info.mojom.h"
+#include "ash/public/mojom/ime_controller.mojom.h"
+#include "ash/public/mojom/ime_info.mojom.h"
 #include "base/macros.h"
 #include "mojo/public/cpp/bindings/binding.h"
 #include "ui/base/ime/chromeos/ime_keyboard.h"
diff --git a/chrome/browser/ui/ash/keyboard/chrome_keyboard_controller_client.cc b/chrome/browser/ui/ash/keyboard/chrome_keyboard_controller_client.cc
index 539d526..7feb0d8 100644
--- a/chrome/browser/ui/ash/keyboard/chrome_keyboard_controller_client.cc
+++ b/chrome/browser/ui/ash/keyboard/chrome_keyboard_controller_client.cc
@@ -9,7 +9,7 @@
 #include "ash/keyboard/ui/keyboard_ui_controller.h"
 #include "ash/keyboard/ui/resources/keyboard_resource_util.h"
 #include "ash/public/cpp/keyboard/keyboard_switches.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/command_line.h"
diff --git a/chrome/browser/ui/ash/keyboard/chrome_keyboard_controller_client_test_helper.cc b/chrome/browser/ui/ash/keyboard/chrome_keyboard_controller_client_test_helper.cc
index f4bff52a..7d9791bf 100644
--- a/chrome/browser/ui/ash/keyboard/chrome_keyboard_controller_client_test_helper.cc
+++ b/chrome/browser/ui/ash/keyboard/chrome_keyboard_controller_client_test_helper.cc
@@ -9,7 +9,7 @@
 #include <vector>
 
 #include "ash/public/cpp/keyboard/keyboard_controller.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "ash/shell.h"
 #include "base/bind.h"
 #include "base/callback.h"
diff --git a/chrome/browser/ui/ash/session_controller_client_impl.cc b/chrome/browser/ui/ash/session_controller_client_impl.cc
index ae37fc8..2a5843e 100644
--- a/chrome/browser/ui/ash/session_controller_client_impl.cc
+++ b/chrome/browser/ui/ash/session_controller_client_impl.cc
@@ -11,7 +11,7 @@
 #include "ash/public/cpp/ash_pref_names.h"
 #include "ash/public/cpp/session/session_controller.h"
 #include "ash/public/cpp/session/session_types.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "base/bind.h"
 #include "base/logging.h"
 #include "base/strings/utf_string_conversions.h"
diff --git a/chrome/browser/ui/ash/test_ime_controller.h b/chrome/browser/ui/ash/test_ime_controller.h
index 205d504c..58c0640 100644
--- a/chrome/browser/ui/ash/test_ime_controller.h
+++ b/chrome/browser/ui/ash/test_ime_controller.h
@@ -9,8 +9,8 @@
 #include <string>
 #include <utility>
 
-#include "ash/public/interfaces/ime_controller.mojom.h"
-#include "ash/public/interfaces/ime_info.mojom.h"
+#include "ash/public/mojom/ime_controller.mojom.h"
+#include "ash/public/mojom/ime_info.mojom.h"
 #include "mojo/public/cpp/bindings/binding.h"
 
 class TestImeController : ash::mojom::ImeController {
diff --git a/chrome/browser/ui/ash/vpn_list_forwarder.cc b/chrome/browser/ui/ash/vpn_list_forwarder.cc
index 6b4d417..f02d2bc 100644
--- a/chrome/browser/ui/ash/vpn_list_forwarder.cc
+++ b/chrome/browser/ui/ash/vpn_list_forwarder.cc
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/ash/vpn_list_forwarder.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "base/bind.h"
 #include "base/location.h"
 #include "base/logging.h"
diff --git a/chrome/browser/ui/ash/vpn_list_forwarder.h b/chrome/browser/ui/ash/vpn_list_forwarder.h
index 1e56e31..7128b0a 100644
--- a/chrome/browser/ui/ash/vpn_list_forwarder.h
+++ b/chrome/browser/ui/ash/vpn_list_forwarder.h
@@ -5,7 +5,7 @@
 #ifndef CHROME_BROWSER_UI_ASH_VPN_LIST_FORWARDER_H_
 #define CHROME_BROWSER_UI_ASH_VPN_LIST_FORWARDER_H_
 
-#include "ash/public/interfaces/vpn_list.mojom.h"
+#include "ash/public/mojom/vpn_list.mojom.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "chrome/browser/ui/app_list/arc/arc_vpn_provider_manager.h"
diff --git a/chrome/browser/ui/views/apps/chrome_native_app_window_views_aura_ash.cc b/chrome/browser/ui/views/apps/chrome_native_app_window_views_aura_ash.cc
index 1261998..f05e291d 100644
--- a/chrome/browser/ui/views/apps/chrome_native_app_window_views_aura_ash.cc
+++ b/chrome/browser/ui/views/apps/chrome_native_app_window_views_aura_ash.cc
@@ -17,7 +17,7 @@
 #include "ash/public/cpp/tablet_mode.h"
 #include "ash/public/cpp/window_properties.h"
 #include "ash/public/cpp/window_state_type.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "ash/wm/window_state.h"
 #include "base/bind.h"
 #include "base/logging.h"
diff --git a/chrome/browser/ui/views/frame/browser_non_client_frame_view_ash.cc b/chrome/browser/ui/views/frame/browser_non_client_frame_view_ash.cc
index e68e94b..ef480767 100644
--- a/chrome/browser/ui/views/frame/browser_non_client_frame_view_ash.cc
+++ b/chrome/browser/ui/views/frame/browser_non_client_frame_view_ash.cc
@@ -17,7 +17,7 @@
 #include "ash/public/cpp/touch_uma.h"
 #include "ash/public/cpp/window_properties.h"
 #include "ash/public/cpp/window_state_type.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "ash/wm/window_util.h"
 #include "base/command_line.h"
 #include "base/metrics/user_metrics.h"
diff --git a/chrome/browser/ui/views/frame/browser_non_client_frame_view_ash_browsertest.cc b/chrome/browser/ui/views/frame/browser_non_client_frame_view_ash_browsertest.cc
index 05dc597..eea38a8 100644
--- a/chrome/browser/ui/views/frame/browser_non_client_frame_view_ash_browsertest.cc
+++ b/chrome/browser/ui/views/frame/browser_non_client_frame_view_ash_browsertest.cc
@@ -14,7 +14,7 @@
 #include "ash/public/cpp/test/shell_test_api.h"
 #include "ash/public/cpp/window_pin_type.h"
 #include "ash/public/cpp/window_properties.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "ash/shell.h"                                  // mash-ok
 #include "ash/wm/overview/overview_controller.h"        // mash-ok
 #include "ash/wm/splitview/split_view_controller.h"     // mash-ok
diff --git a/chrome/browser/ui/views/frame/top_controls_slide_controller_chromeos_browsertest.cc b/chrome/browser/ui/views/frame/top_controls_slide_controller_chromeos_browsertest.cc
index 0698f172..bb91a65b 100644
--- a/chrome/browser/ui/views/frame/top_controls_slide_controller_chromeos_browsertest.cc
+++ b/chrome/browser/ui/views/frame/top_controls_slide_controller_chromeos_browsertest.cc
@@ -11,9 +11,9 @@
 #include "ash/public/cpp/ash_switches.h"
 #include "ash/public/cpp/tablet_mode.h"
 #include "ash/public/cpp/test/shell_test_api.h"
-#include "ash/public/interfaces/constants.mojom.h"
-#include "ash/public/interfaces/cros_display_config.mojom-test-utils.h"
-#include "ash/public/interfaces/cros_display_config.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
+#include "ash/public/mojom/cros_display_config.mojom-test-utils.h"
+#include "ash/public/mojom/cros_display_config.mojom.h"
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/command_line.h"
diff --git a/chrome/browser/ui/views/profiles/avatar_toolbar_button.cc b/chrome/browser/ui/views/profiles/avatar_toolbar_button.cc
index 5fc83820..17dcae7 100644
--- a/chrome/browser/ui/views/profiles/avatar_toolbar_button.cc
+++ b/chrome/browser/ui/views/profiles/avatar_toolbar_button.cc
@@ -28,7 +28,6 @@
 #include "chrome/browser/ui/view_ids.h"
 #include "chrome/browser/ui/views/chrome_layout_provider.h"
 #include "chrome/browser/ui/views/toolbar/toolbar_ink_drop_util.h"
-#include "chrome/common/chrome_features.h"
 #include "chrome/grit/generated_resources.h"
 #include "components/signin/public/identity_manager/identity_manager.h"
 #include "ui/base/l10n/l10n_util.h"
@@ -70,7 +69,7 @@
       profile_observer_(this),
       identity_manager_observer_(this),
       weak_ptr_factory_(this) {
-  if (IsIncognitoCounterActive())
+  if (IsIncognito())
     browser_list_observer_.Add(BrowserList::GetInstance());
 
   profile_observer_.Add(
@@ -96,16 +95,11 @@
   Init();
 
 #if defined(OS_CHROMEOS)
-  // On CrOS the avatar toolbar button should only show as badging for Incognito
-  // and Guest sessions. It should not be instantiated for regular profiles and
-  // it should not be enabled as there's no profile switcher to trigger / show,
-  // unless incognito window counter is available.
+  // On CrOS this button should only show as badging for Incognito and Guest
+  // sessions. It's only enabled for Incognito where a menu is available for
+  // closing all Incognito windows.
   DCHECK(!profile_->IsRegularProfile());
-  SetEnabled(IsIncognitoCounterActive());
-#else
-  // The profile switcher is only available outside incognito or if incognito
-  // window counter is enabled.
-  SetEnabled(!IsIncognito() || IsIncognitoCounterActive());
+  SetEnabled(IsIncognito());
 #endif  // !defined(OS_CHROMEOS)
 
   if (base::FeatureList::IsEnabled(features::kAnimatedAvatarButton)) {
@@ -147,21 +141,13 @@
     const SkColor text_color = GetThemeProvider()->GetColor(
         ThemeProperties::COLOR_TOOLBAR_BUTTON_ICON);
     SetEnabledTextColors(text_color);
-    // TODO(pbos): Remove this call once the incognito chip always triggers a
-    // menu.
-    if (!IsIncognitoCounterActive())
-      SetTextColor(STATE_DISABLED, text_color);
   }
 
   if (IsIncognito()) {
     int incognito_window_count =
         BrowserList::GetIncognitoSessionsActiveForProfile(profile_);
-    if (IsIncognitoCounterActive()) {
-      SetAccessibleName(l10n_util::GetPluralStringFUTF16(
-          IDS_INCOGNITO_BUBBLE_ACCESSIBLE_TITLE, incognito_window_count));
-    } else {
-      incognito_window_count = 1;
-    }
+    SetAccessibleName(l10n_util::GetPluralStringFUTF16(
+        IDS_INCOGNITO_BUBBLE_ACCESSIBLE_TITLE, incognito_window_count));
     text = l10n_util::GetPluralStringFUTF16(IDS_AVATAR_BUTTON_INCOGNITO,
                                             incognito_window_count);
   } else if (!suppress_avatar_button_state_ &&
@@ -205,9 +191,6 @@
   // TODO(bsep): Other toolbar buttons have ToolbarView as a listener and let it
   // call ExecuteCommandWithDisposition on their behalf. Unfortunately, it's not
   // possible to plumb IsKeyEvent through, so this has to be a special case.
-  if (IsIncognito() && !IsIncognitoCounterActive())
-    return;
-
   browser_->window()->ShowAvatarBubbleFromAvatarButton(
       BrowserWindow::AVATAR_BUBBLE_MODE_DEFAULT, signin::ManageAccountsParams(),
       signin_metrics::AccessPoint::ACCESS_POINT_AVATAR_BUBBLE_SIGN_IN,
@@ -329,11 +312,6 @@
   return profile_->IsIncognitoProfile();
 }
 
-bool AvatarToolbarButton::IsIncognitoCounterActive() const {
-  return IsIncognito() &&
-         base::FeatureList::IsEnabled(features::kEnableIncognitoWindowCounter);
-}
-
 bool AvatarToolbarButton::ShouldShowGenericIcon() const {
   // This function should only be used for regular profiles. Guest and Incognito
   // sessions should be handled separately and never call this function.
diff --git a/chrome/browser/ui/web_applications/web_app_ui_manager_impl.cc b/chrome/browser/ui/web_applications/web_app_ui_manager_impl.cc
index 8d0f02e..67a9d14 100644
--- a/chrome/browser/ui/web_applications/web_app_ui_manager_impl.cc
+++ b/chrome/browser/ui/web_applications/web_app_ui_manager_impl.cc
@@ -7,8 +7,10 @@
 #include <utility>
 
 #include "base/callback.h"
+#include "build/build_config.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_list.h"
+#include "chrome/browser/ui/extensions/application_launch.h"
 #include "chrome/browser/ui/web_applications/app_browser_controller.h"
 #include "chrome/browser/ui/web_applications/web_app_dialog_manager.h"
 #include "chrome/browser/web_applications/system_web_app_manager.h"
@@ -107,6 +109,26 @@
 #endif  // defined(OS_CHROMEOS)
 }
 
+bool WebAppUiManagerImpl::CanReparentAppTabToWindow(
+    const AppId& app_id,
+    bool shortcut_created) const {
+#if defined(OS_MACOSX)
+  // On macOS it is only possible to reparent the window when the shortcut (app
+  // shim) was created. See https://crbug.com/915571.
+  return shortcut_created;
+#else
+  return true;
+#endif
+}
+
+void WebAppUiManagerImpl::ReparentAppTabToWindow(content::WebContents* contents,
+                                                 const AppId& app_id,
+                                                 bool shortcut_created) {
+  DCHECK(CanReparentAppTabToWindow(app_id, shortcut_created));
+  // Reparent the tab into an app window immediately.
+  ReparentWebContentsIntoAppBrowser(contents, app_id);
+}
+
 void WebAppUiManagerImpl::OnBrowserAdded(Browser* browser) {
   base::Optional<AppId> app_id = GetAppIdForBrowser(browser);
   if (!app_id.has_value())
diff --git a/chrome/browser/ui/web_applications/web_app_ui_manager_impl.h b/chrome/browser/ui/web_applications/web_app_ui_manager_impl.h
index 9bf0305..47e4fea 100644
--- a/chrome/browser/ui/web_applications/web_app_ui_manager_impl.h
+++ b/chrome/browser/ui/web_applications/web_app_ui_manager_impl.h
@@ -42,6 +42,11 @@
   void MigrateOSAttributes(const AppId& from, const AppId& to) override;
   bool CanAddAppToQuickLaunchBar() const override;
   void AddAppToQuickLaunchBar(const AppId& app_id) override;
+  bool CanReparentAppTabToWindow(const AppId& app_id,
+                                 bool shortcut_created) const override;
+  void ReparentAppTabToWindow(content::WebContents* contents,
+                              const AppId& app_id,
+                              bool shortcut_created) override;
 
   // BrowserListObserver:
   void OnBrowserAdded(Browser* browser) override;
diff --git a/chrome/browser/ui/webui/chromeos/assistant_optin/assistant_optin_ui.cc b/chrome/browser/ui/webui/chromeos/assistant_optin/assistant_optin_ui.cc
index 2e65bdf..3c3e38d 100644
--- a/chrome/browser/ui/webui/chromeos/assistant_optin/assistant_optin_ui.cc
+++ b/chrome/browser/ui/webui/chromeos/assistant_optin/assistant_optin_ui.cc
@@ -8,7 +8,7 @@
 #include <string>
 #include <utility>
 
-#include "ash/public/interfaces/voice_interaction_controller.mojom.h"
+#include "ash/public/mojom/voice_interaction_controller.mojom.h"
 #include "base/bind.h"
 #include "base/macros.h"
 #include "base/strings/string_number_conversions.h"
diff --git a/chrome/browser/ui/webui/chromeos/first_run/first_run_handler.cc b/chrome/browser/ui/webui/chromeos/first_run/first_run_handler.cc
index d05e0369..46afde2 100644
--- a/chrome/browser/ui/webui/chromeos/first_run/first_run_handler.cc
+++ b/chrome/browser/ui/webui/chromeos/first_run/first_run_handler.cc
@@ -6,7 +6,7 @@
 
 #include <utility>
 
-#include "ash/public/interfaces/voice_interaction_controller.mojom.h"
+#include "ash/public/mojom/voice_interaction_controller.mojom.h"
 #include "base/bind.h"
 #include "base/values.h"
 #include "chrome/browser/chromeos/assistant/assistant_util.h"
diff --git a/chrome/browser/ui/webui/chromeos/login/core_oobe_handler.cc b/chrome/browser/ui/webui/chromeos/login/core_oobe_handler.cc
index 12aa9301..45bb2d4e 100644
--- a/chrome/browser/ui/webui/chromeos/login/core_oobe_handler.cc
+++ b/chrome/browser/ui/webui/chromeos/login/core_oobe_handler.cc
@@ -9,7 +9,7 @@
 #include "ash/public/cpp/ash_features.h"
 #include "ash/public/cpp/event_rewriter_controller.h"
 #include "ash/public/cpp/tablet_mode.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "ash/shell.h"
 #include "base/bind.h"
 #include "base/command_line.h"
diff --git a/chrome/browser/ui/webui/chromeos/login/core_oobe_handler.h b/chrome/browser/ui/webui/chromeos/login/core_oobe_handler.h
index dd2d01d..55f77dd 100644
--- a/chrome/browser/ui/webui/chromeos/login/core_oobe_handler.h
+++ b/chrome/browser/ui/webui/chromeos/login/core_oobe_handler.h
@@ -10,7 +10,7 @@
 #include <vector>
 
 #include "ash/public/cpp/tablet_mode_observer.h"
-#include "ash/public/interfaces/cros_display_config.mojom.h"
+#include "ash/public/mojom/cros_display_config.mojom.h"
 #include "base/callback.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
diff --git a/chrome/browser/ui/webui/chromeos/login/oobe_display_chooser.cc b/chrome/browser/ui/webui/chromeos/login/oobe_display_chooser.cc
index 57c06c6f..479dee3 100644
--- a/chrome/browser/ui/webui/chromeos/login/oobe_display_chooser.cc
+++ b/chrome/browser/ui/webui/chromeos/login/oobe_display_chooser.cc
@@ -6,7 +6,7 @@
 
 #include <stdint.h>
 
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/strings/string_number_conversions.h"
diff --git a/chrome/browser/ui/webui/chromeos/login/oobe_display_chooser.h b/chrome/browser/ui/webui/chromeos/login/oobe_display_chooser.h
index 5f2c676..802504f 100644
--- a/chrome/browser/ui/webui/chromeos/login/oobe_display_chooser.h
+++ b/chrome/browser/ui/webui/chromeos/login/oobe_display_chooser.h
@@ -5,7 +5,7 @@
 #ifndef CHROME_BROWSER_UI_WEBUI_CHROMEOS_LOGIN_OOBE_DISPLAY_CHOOSER_H_
 #define CHROME_BROWSER_UI_WEBUI_CHROMEOS_LOGIN_OOBE_DISPLAY_CHOOSER_H_
 
-#include "ash/public/interfaces/cros_display_config.mojom.h"
+#include "ash/public/mojom/cros_display_config.mojom.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "base/scoped_observer.h"
diff --git a/chrome/browser/ui/webui/chromeos/login/signin_screen_handler.cc b/chrome/browser/ui/webui/chromeos/login/signin_screen_handler.cc
index ab2a3c4..affc2df 100644
--- a/chrome/browser/ui/webui/chromeos/login/signin_screen_handler.cc
+++ b/chrome/browser/ui/webui/chromeos/login/signin_screen_handler.cc
@@ -13,7 +13,7 @@
 #include "ash/public/cpp/login_constants.h"
 #include "ash/public/cpp/tablet_mode.h"
 #include "ash/public/cpp/wallpaper_types.h"
-#include "ash/public/interfaces/tray_action.mojom.h"
+#include "ash/public/mojom/tray_action.mojom.h"
 #include "base/bind.h"
 #include "base/i18n/number_formatting.h"
 #include "base/location.h"
diff --git a/chrome/browser/ui/webui/settings/chromeos/device_keyboard_handler.cc b/chrome/browser/ui/webui/settings/chromeos/device_keyboard_handler.cc
index 1363650..c38687e 100644
--- a/chrome/browser/ui/webui/settings/chromeos/device_keyboard_handler.cc
+++ b/chrome/browser/ui/webui/settings/chromeos/device_keyboard_handler.cc
@@ -6,7 +6,7 @@
 
 #include "ash/public/cpp/keyboard_shortcut_viewer.h"
 #include "ash/public/cpp/tablet_mode.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/values.h"
diff --git a/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc b/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
index 1fd4dd7..c8dfecd 100644
--- a/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
+++ b/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
@@ -64,7 +64,7 @@
 
 #if defined(OS_CHROMEOS)
 #include "ash/public/cpp/ash_switches.h"
-#include "ash/public/interfaces/voice_interaction_controller.mojom.h"
+#include "ash/public/mojom/voice_interaction_controller.mojom.h"
 #include "base/system/sys_info.h"
 #include "chrome/browser/chromeos/account_manager/account_manager_util.h"
 #include "chrome/browser/chromeos/arc/arc_util.h"
diff --git a/chrome/browser/web_applications/components/install_finalizer.cc b/chrome/browser/web_applications/components/install_finalizer.cc
index 86efc3b3..23485f24 100644
--- a/chrome/browser/web_applications/components/install_finalizer.cc
+++ b/chrome/browser/web_applications/components/install_finalizer.cc
@@ -4,6 +4,7 @@
 
 #include "chrome/browser/web_applications/components/install_finalizer.h"
 
+#include "base/logging.h"
 #include "chrome/browser/web_applications/components/web_app_ui_manager.h"
 
 namespace web_app {
@@ -20,4 +21,17 @@
   ui_manager().AddAppToQuickLaunchBar(app_id);
 }
 
+bool InstallFinalizer::CanReparentTab(const AppId& app_id,
+                                      bool shortcut_created) const {
+  return ui_manager().CanReparentAppTabToWindow(app_id, shortcut_created);
+}
+
+void InstallFinalizer::ReparentTab(const AppId& app_id,
+                                   bool shortcut_created,
+                                   content::WebContents* web_contents) {
+  DCHECK(web_contents);
+  return ui_manager().ReparentAppTabToWindow(web_contents, app_id,
+                                             shortcut_created);
+}
+
 }  // namespace web_app
diff --git a/chrome/browser/web_applications/components/install_finalizer.h b/chrome/browser/web_applications/components/install_finalizer.h
index 9431c53..31233b3 100644
--- a/chrome/browser/web_applications/components/install_finalizer.h
+++ b/chrome/browser/web_applications/components/install_finalizer.h
@@ -64,10 +64,10 @@
   virtual bool CanAddAppToQuickLaunchBar() const;
   virtual void AddAppToQuickLaunchBar(const AppId& app_id);
 
-  virtual bool CanReparentTab(const AppId& app_id,
-                              bool shortcut_created) const = 0;
+  virtual bool CanReparentTab(const AppId& app_id, bool shortcut_created) const;
   virtual void ReparentTab(const AppId& app_id,
-                           content::WebContents* web_contents) = 0;
+                           bool shortcut_created,
+                           content::WebContents* web_contents);
 
   virtual bool CanRevealAppShim() const = 0;
   virtual void RevealAppShim(const AppId& app_id) = 0;
diff --git a/chrome/browser/web_applications/components/web_app_ui_manager.h b/chrome/browser/web_applications/components/web_app_ui_manager.h
index 36eb459..ee39033ed 100644
--- a/chrome/browser/web_applications/components/web_app_ui_manager.h
+++ b/chrome/browser/web_applications/components/web_app_ui_manager.h
@@ -10,6 +10,10 @@
 
 class Profile;
 
+namespace content {
+class WebContents;
+}
+
 namespace web_app {
 
 // WebAppUiManagerImpl can be used only in UI code.
@@ -37,6 +41,12 @@
 
   virtual bool CanAddAppToQuickLaunchBar() const = 0;
   virtual void AddAppToQuickLaunchBar(const AppId& app_id) = 0;
+
+  virtual bool CanReparentAppTabToWindow(const AppId& app_id,
+                                         bool shortcut_created) const = 0;
+  virtual void ReparentAppTabToWindow(content::WebContents* contents,
+                                      const AppId& app_id,
+                                      bool shortcut_created) = 0;
 };
 
 }  // namespace web_app
diff --git a/chrome/browser/web_applications/extensions/bookmark_app_install_finalizer.cc b/chrome/browser/web_applications/extensions/bookmark_app_install_finalizer.cc
index be9a890..5d6b25b 100644
--- a/chrome/browser/web_applications/extensions/bookmark_app_install_finalizer.cc
+++ b/chrome/browser/web_applications/extensions/bookmark_app_install_finalizer.cc
@@ -208,15 +208,15 @@
 bool BookmarkAppInstallFinalizer::CanReparentTab(const web_app::AppId& app_id,
                                                  bool shortcut_created) const {
   const Extension* app = GetExtensionById(profile_, app_id);
-  return CanBookmarkAppReparentTab(profile_, app, shortcut_created);
-}
+  // Reparent the web contents into its own window only if that is the
+  // app's launch type.
+  if (!app ||
+      extensions::GetLaunchType(extensions::ExtensionPrefs::Get(profile_),
+                                app) != extensions::LAUNCH_TYPE_WINDOW) {
+    return false;
+  }
 
-void BookmarkAppInstallFinalizer::ReparentTab(
-    const web_app::AppId& app_id,
-    content::WebContents* web_contents) {
-  DCHECK(web_contents);
-  DCHECK(!profile_->IsOffTheRecord());
-  BookmarkAppReparentTab(web_contents, app_id);
+  return InstallFinalizer::CanReparentTab(app_id, shortcut_created);
 }
 
 bool BookmarkAppInstallFinalizer::CanRevealAppShim() const {
diff --git a/chrome/browser/web_applications/extensions/bookmark_app_install_finalizer.h b/chrome/browser/web_applications/extensions/bookmark_app_install_finalizer.h
index 112f259eb..6eea5b6 100644
--- a/chrome/browser/web_applications/extensions/bookmark_app_install_finalizer.h
+++ b/chrome/browser/web_applications/extensions/bookmark_app_install_finalizer.h
@@ -39,8 +39,6 @@
                          CreateOsShortcutsCallback callback) override;
   bool CanReparentTab(const web_app::AppId& app_id,
                       bool shortcut_created) const override;
-  void ReparentTab(const web_app::AppId& app_id,
-                   content::WebContents* web_contents) override;
   bool CanRevealAppShim() const override;
   void RevealAppShim(const web_app::AppId& app_id) override;
   bool CanSkipAppUpdateForSync(
diff --git a/chrome/browser/web_applications/extensions/install_manager_bookmark_app_unittest.cc b/chrome/browser/web_applications/extensions/install_manager_bookmark_app_unittest.cc
index e9ad6f88..0e1fa3c 100644
--- a/chrome/browser/web_applications/extensions/install_manager_bookmark_app_unittest.cc
+++ b/chrome/browser/web_applications/extensions/install_manager_bookmark_app_unittest.cc
@@ -108,6 +108,7 @@
   }
   void AddAppToQuickLaunchBar(const web_app::AppId& app_id) override {}
   void ReparentTab(const web_app::AppId& app_id,
+                   bool shortcut_created,
                    content::WebContents* web_contents) override {}
   void RevealAppShim(const web_app::AppId& app_id) override {}
 };
diff --git a/chrome/browser/web_applications/extensions/pending_app_install_task_unittest.cc b/chrome/browser/web_applications/extensions/pending_app_install_task_unittest.cc
index 9669d55..4ae9dd5 100644
--- a/chrome/browser/web_applications/extensions/pending_app_install_task_unittest.cc
+++ b/chrome/browser/web_applications/extensions/pending_app_install_task_unittest.cc
@@ -218,6 +218,7 @@
   }
 
   void ReparentTab(const AppId& app_id,
+                   bool shortcut_created,
                    content::WebContents* web_contents) override {
     ++num_reparent_tab_calls_;
   }
diff --git a/chrome/browser/web_applications/pending_app_manager_impl_browsertest.cc b/chrome/browser/web_applications/pending_app_manager_impl_browsertest.cc
index 57bc5b1d..8ab64ae 100644
--- a/chrome/browser/web_applications/pending_app_manager_impl_browsertest.cc
+++ b/chrome/browser/web_applications/pending_app_manager_impl_browsertest.cc
@@ -102,7 +102,8 @@
   InstallApp(std::move(install_options));
   base::Optional<AppId> app_id = registrar().FindAppWithUrlInScope(url);
   EXPECT_TRUE(app_id.has_value());
-  EXPECT_EQ("Manifest test app", registrar().GetAppShortName(app_id.value()));
+  EXPECT_TRUE(registrar().GetAppScope(*app_id).has_value());
+  EXPECT_EQ("Manifest test app", registrar().GetAppShortName(*app_id));
 }
 
 IN_PROC_BROWSER_TEST_F(PendingAppManagerImplBrowserTest,
diff --git a/chrome/browser/web_applications/test/test_install_finalizer.cc b/chrome/browser/web_applications/test/test_install_finalizer.cc
index 71d3a11..3fbf706 100644
--- a/chrome/browser/web_applications/test/test_install_finalizer.cc
+++ b/chrome/browser/web_applications/test/test_install_finalizer.cc
@@ -93,6 +93,7 @@
 }
 
 void TestInstallFinalizer::ReparentTab(const AppId& app_id,
+                                       bool shortcut_created,
                                        content::WebContents* web_contents) {
   ++num_reparent_tab_calls_;
 }
diff --git a/chrome/browser/web_applications/test/test_install_finalizer.h b/chrome/browser/web_applications/test/test_install_finalizer.h
index 3e3c1cd0..611460e3 100644
--- a/chrome/browser/web_applications/test/test_install_finalizer.h
+++ b/chrome/browser/web_applications/test/test_install_finalizer.h
@@ -40,6 +40,7 @@
   bool CanReparentTab(const AppId& app_id,
                       bool shortcut_created) const override;
   void ReparentTab(const AppId& app_id,
+                   bool shortcut_created,
                    content::WebContents* web_contents) override;
   bool CanRevealAppShim() const override;
   void RevealAppShim(const AppId& app_id) override;
diff --git a/chrome/browser/web_applications/test/test_web_app_ui_manager.cc b/chrome/browser/web_applications/test/test_web_app_ui_manager.cc
index 4660cd44..3f855e4 100644
--- a/chrome/browser/web_applications/test/test_web_app_ui_manager.cc
+++ b/chrome/browser/web_applications/test/test_web_app_ui_manager.cc
@@ -51,4 +51,14 @@
 
 void TestWebAppUiManager::AddAppToQuickLaunchBar(const AppId& app_id) {}
 
+bool TestWebAppUiManager::CanReparentAppTabToWindow(
+    const AppId& app_id,
+    bool shortcut_created) const {
+  return false;
+}
+
+void TestWebAppUiManager::ReparentAppTabToWindow(content::WebContents* contents,
+                                                 const AppId& app_id,
+                                                 bool shortcut_created) {}
+
 }  // namespace web_app
diff --git a/chrome/browser/web_applications/test/test_web_app_ui_manager.h b/chrome/browser/web_applications/test/test_web_app_ui_manager.h
index e0aa3e4c..64dd76b 100644
--- a/chrome/browser/web_applications/test/test_web_app_ui_manager.h
+++ b/chrome/browser/web_applications/test/test_web_app_ui_manager.h
@@ -27,6 +27,11 @@
   void MigrateOSAttributes(const AppId& from, const AppId& to) override;
   bool CanAddAppToQuickLaunchBar() const override;
   void AddAppToQuickLaunchBar(const AppId& app_id) override;
+  bool CanReparentAppTabToWindow(const AppId& app_id,
+                                 bool shortcut_created) const override;
+  void ReparentAppTabToWindow(content::WebContents* contents,
+                              const AppId& app_id,
+                              bool shortcut_created) override;
 
  private:
   std::map<AppId, size_t> app_id_to_num_windows_map_;
diff --git a/chrome/browser/web_applications/web_app_install_finalizer.cc b/chrome/browser/web_applications/web_app_install_finalizer.cc
index ab08dcc..28a2706 100644
--- a/chrome/browser/web_applications/web_app_install_finalizer.cc
+++ b/chrome/browser/web_applications/web_app_install_finalizer.cc
@@ -122,15 +122,9 @@
 
 bool WebAppInstallFinalizer::CanReparentTab(const AppId& app_id,
                                             bool shortcut_created) const {
-  // TODO(loyso): Implement it.
-  NOTIMPLEMENTED();
-  return true;
-}
-
-void WebAppInstallFinalizer::ReparentTab(const AppId& app_id,
-                                         content::WebContents* web_contents) {
-  // TODO(loyso): Implement it.
-  NOTIMPLEMENTED();
+  // TODO(loyso): Return false here if the app's launch container is not
+  // kWindow.
+  return InstallFinalizer::CanReparentTab(app_id, shortcut_created);
 }
 
 bool WebAppInstallFinalizer::CanRevealAppShim() const {
diff --git a/chrome/browser/web_applications/web_app_install_finalizer.h b/chrome/browser/web_applications/web_app_install_finalizer.h
index 108c694..a51b6157 100644
--- a/chrome/browser/web_applications/web_app_install_finalizer.h
+++ b/chrome/browser/web_applications/web_app_install_finalizer.h
@@ -38,8 +38,6 @@
                          CreateOsShortcutsCallback callback) override;
   bool CanReparentTab(const AppId& app_id,
                       bool shortcut_created) const override;
-  void ReparentTab(const AppId& app_id,
-                   content::WebContents* web_contents) override;
   bool CanRevealAppShim() const override;
   void RevealAppShim(const AppId& app_id) override;
   bool CanSkipAppUpdateForSync(
diff --git a/chrome/browser/web_applications/web_app_install_task.cc b/chrome/browser/web_applications/web_app_install_task.cc
index ee12664..58f0a49 100644
--- a/chrome/browser/web_applications/web_app_install_task.cc
+++ b/chrome/browser/web_applications/web_app_install_task.cc
@@ -547,16 +547,16 @@
     add_to_quick_launch_bar = install_params_->add_to_quick_launch_bar;
 
   if (add_to_quick_launch_bar &&
-      install_finalizer_->CanAddAppToQuickLaunchBar())
+      install_finalizer_->CanAddAppToQuickLaunchBar()) {
     install_finalizer_->AddAppToQuickLaunchBar(app_id);
+  }
 
-  // TODO(loyso): Reparenting must be implemented in
-  // chrome/browser/ui/web_applications/ UI layer as a post-install step.
   if (!background_installation_) {
     const bool can_reparent_tab =
         install_finalizer_->CanReparentTab(app_id, shortcut_created);
+
     if (can_reparent_tab && web_app_info->open_as_window)
-      install_finalizer_->ReparentTab(app_id, web_contents());
+      install_finalizer_->ReparentTab(app_id, shortcut_created, web_contents());
 
     // TODO(loyso): Make revealing app shim independent from CanReparentTab.
     if (can_reparent_tab && install_finalizer_->CanRevealAppShim())
diff --git a/chrome/common/chrome_features.cc b/chrome/common/chrome_features.cc
index c875a23..1d402f5 100644
--- a/chrome/common/chrome_features.cc
+++ b/chrome/common/chrome_features.cc
@@ -67,7 +67,7 @@
 // as AppServiceAsh. Enabling any one of those client-specific feature flags
 // also implicitly enables AppServiceServer.
 const base::Feature kAppServiceAsh{"AppServiceAsh",
-                                   base::FEATURE_DISABLED_BY_DEFAULT};
+                                   base::FEATURE_ENABLED_BY_DEFAULT};
 const base::Feature kAppServiceServer{"AppServiceServer",
                                       base::FEATURE_ENABLED_BY_DEFAULT};
 #endif  // !defined(OS_ANDROID)
@@ -297,11 +297,6 @@
     "EnableAmbientAuthenticationInGuestSession",
     base::FEATURE_ENABLED_BY_DEFAULT};
 
-// Show the number of open incognito windows besides incognito icon on the
-// toolbar.
-const base::Feature kEnableIncognitoWindowCounter{
-    "EnableIncognitoWindowCounter", base::FEATURE_ENABLED_BY_DEFAULT};
-
 #if !defined(OS_ANDROID)
 // Upload enterprise cloud reporting without the extension.
 const base::Feature kEnterpriseReportingInBrowser{
diff --git a/chrome/common/chrome_features.h b/chrome/common/chrome_features.h
index c00528d..e66f4df3 100644
--- a/chrome/common/chrome_features.h
+++ b/chrome/common/chrome_features.h
@@ -174,9 +174,6 @@
 COMPONENT_EXPORT(CHROME_FEATURES)
 extern const base::Feature kEnableAmbientAuthenticationInIncognito;
 
-COMPONENT_EXPORT(CHROME_FEATURES)
-extern const base::Feature kEnableIncognitoWindowCounter;
-
 #if !defined(OS_ANDROID)
 COMPONENT_EXPORT(CHROME_FEATURES)
 extern const base::Feature kEnterpriseReportingInBrowser;
diff --git a/chrome/gpu/OWNERS b/chrome/gpu/OWNERS
index 0346939..66f58e1 100644
--- a/chrome/gpu/OWNERS
+++ b/chrome/gpu/OWNERS
@@ -1,2 +1,5 @@
-kcwu@chromium.org
-posciak@chromium.org
+file://components/arc/video_accelerator/OWNERS
+file://media/OWNERS
+
+per-file chrome_content_gpu_client*=file://components/arc/video_accelerator/OWNERS
+per-file widevine_cdm_proxy*=file://media/OWNERS
diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
index 0b1c9c5e..c3ee08146 100644
--- a/chrome/test/BUILD.gn
+++ b/chrome/test/BUILD.gn
@@ -1367,7 +1367,7 @@
       deps += [
         "//ash:test_support",
         "//ash/keyboard/ui:test_support",
-        "//ash/public/interfaces:test_interfaces",
+        "//ash/public/mojom:test_interfaces",
         "//chrome/browser/chromeos:arc_test_support",
         "//chrome/browser/chromeos:test_support",
         "//chrome/browser/media/router:test_support",
diff --git a/chromeos/services/assistant/assistant_manager_service.h b/chromeos/services/assistant/assistant_manager_service.h
index 64b08c2..7bfb5d8 100644
--- a/chromeos/services/assistant/assistant_manager_service.h
+++ b/chromeos/services/assistant/assistant_manager_service.h
@@ -8,7 +8,7 @@
 #include <memory>
 #include <string>
 
-#include "ash/public/interfaces/assistant_controller.mojom.h"
+#include "ash/public/mojom/assistant_controller.mojom.h"
 #include "base/callback_forward.h"
 #include "chromeos/services/assistant/assistant_settings_manager.h"
 #include "chromeos/services/assistant/public/mojom/assistant.mojom.h"
diff --git a/chromeos/services/assistant/assistant_manager_service_impl.cc b/chromeos/services/assistant/assistant_manager_service_impl.cc
index b7e698f..16c563d 100644
--- a/chromeos/services/assistant/assistant_manager_service_impl.cc
+++ b/chromeos/services/assistant/assistant_manager_service_impl.cc
@@ -7,7 +7,7 @@
 #include <algorithm>
 #include <utility>
 
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "base/barrier_closure.h"
 #include "base/bind.h"
 #include "base/feature_list.h"
diff --git a/chromeos/services/assistant/assistant_manager_service_impl.h b/chromeos/services/assistant/assistant_manager_service_impl.h
index 2e60ef2a..3d2f7ecd 100644
--- a/chromeos/services/assistant/assistant_manager_service_impl.h
+++ b/chromeos/services/assistant/assistant_manager_service_impl.h
@@ -9,7 +9,7 @@
 #include <string>
 #include <vector>
 
-#include "ash/public/interfaces/assistant_controller.mojom.h"
+#include "ash/public/mojom/assistant_controller.mojom.h"
 #include "base/synchronization/lock.h"
 #include "base/threading/thread.h"
 #include "chromeos/assistant/internal/action/cros_action_module.h"
diff --git a/chromeos/services/assistant/fake_assistant_manager_service_impl.h b/chromeos/services/assistant/fake_assistant_manager_service_impl.h
index d926a43b..2e2c7ad 100644
--- a/chromeos/services/assistant/fake_assistant_manager_service_impl.h
+++ b/chromeos/services/assistant/fake_assistant_manager_service_impl.h
@@ -8,7 +8,7 @@
 #include <memory>
 #include <string>
 
-#include "ash/public/interfaces/assistant_controller.mojom.h"
+#include "ash/public/mojom/assistant_controller.mojom.h"
 #include "base/component_export.h"
 #include "base/macros.h"
 #include "base/timer/timer.h"
diff --git a/chromeos/services/assistant/platform/audio_output_provider_impl.cc b/chromeos/services/assistant/platform/audio_output_provider_impl.cc
index c56e910ec..9d4ed960 100644
--- a/chromeos/services/assistant/platform/audio_output_provider_impl.cc
+++ b/chromeos/services/assistant/platform/audio_output_provider_impl.cc
@@ -7,7 +7,7 @@
 #include <algorithm>
 #include <utility>
 
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "base/bind.h"
 #include "chromeos/services/assistant/media_session/assistant_media_session.h"
 #include "chromeos/services/assistant/platform/audio_stream_handler.h"
diff --git a/chromeos/services/assistant/platform/audio_stream_handler.cc b/chromeos/services/assistant/platform/audio_stream_handler.cc
index 00e2afa88..a3a5806 100644
--- a/chromeos/services/assistant/platform/audio_stream_handler.cc
+++ b/chromeos/services/assistant/platform/audio_stream_handler.cc
@@ -4,7 +4,7 @@
 
 #include "chromeos/services/assistant/platform/audio_stream_handler.h"
 
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "base/bind.h"
 #include "chromeos/services/assistant/platform/audio_media_data_source.h"
 #include "chromeos/services/assistant/public/mojom/constants.mojom.h"
diff --git a/chromeos/services/assistant/platform/volume_control_impl.cc b/chromeos/services/assistant/platform/volume_control_impl.cc
index e7727d82..269f690 100644
--- a/chromeos/services/assistant/platform/volume_control_impl.cc
+++ b/chromeos/services/assistant/platform/volume_control_impl.cc
@@ -6,7 +6,7 @@
 
 #include <utility>
 
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "chromeos/services/assistant/media_session/assistant_media_session.h"
 
 namespace chromeos {
diff --git a/chromeos/services/assistant/platform/volume_control_impl.h b/chromeos/services/assistant/platform/volume_control_impl.h
index dcd24a3e..7d14396 100644
--- a/chromeos/services/assistant/platform/volume_control_impl.h
+++ b/chromeos/services/assistant/platform/volume_control_impl.h
@@ -5,7 +5,7 @@
 #ifndef CHROMEOS_SERVICES_ASSISTANT_PLATFORM_VOLUME_CONTROL_IMPL_H_
 #define CHROMEOS_SERVICES_ASSISTANT_PLATFORM_VOLUME_CONTROL_IMPL_H_
 
-#include "ash/public/interfaces/assistant_volume_control.mojom.h"
+#include "ash/public/mojom/assistant_volume_control.mojom.h"
 #include "base/macros.h"
 #include "libassistant/shared/public/platform_audio_output.h"
 #include "mojo/public/cpp/bindings/binding.h"
diff --git a/chromeos/services/assistant/service.cc b/chromeos/services/assistant/service.cc
index dfa3e820..426f46d9d 100644
--- a/chromeos/services/assistant/service.cc
+++ b/chromeos/services/assistant/service.cc
@@ -9,7 +9,7 @@
 #include <utility>
 
 #include "ash/public/cpp/session/session_controller.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/logging.h"
diff --git a/chromeos/services/assistant/service.h b/chromeos/services/assistant/service.h
index 156f83d..1ae8f42b 100644
--- a/chromeos/services/assistant/service.h
+++ b/chromeos/services/assistant/service.h
@@ -11,8 +11,8 @@
 #include "ash/public/cpp/assistant/assistant_state_proxy.h"
 #include "ash/public/cpp/assistant/default_voice_interaction_observer.h"
 #include "ash/public/cpp/session/session_activation_observer.h"
-#include "ash/public/interfaces/assistant_controller.mojom.h"
-#include "ash/public/interfaces/voice_interaction_controller.mojom.h"
+#include "ash/public/mojom/assistant_controller.mojom.h"
+#include "ash/public/mojom/voice_interaction_controller.mojom.h"
 #include "base/callback.h"
 #include "base/cancelable_callback.h"
 #include "base/component_export.h"
diff --git a/components/arc/common/voice_interaction_framework.mojom b/components/arc/common/voice_interaction_framework.mojom
index 56bcc58..b1b8ba99 100644
--- a/components/arc/common/voice_interaction_framework.mojom
+++ b/components/arc/common/voice_interaction_framework.mojom
@@ -9,7 +9,7 @@
 import "components/arc/common/gfx.mojom";
 
 // There is another copy of the VoiceInteractionState definition in
-// //ash/public/interfaces/voice_interaction_controller.mojom
+// //ash/public/mojom/voice_interaction_controller.mojom
 // Please also update the other one if you change it.
 // The duplicate definition is because we do not use extensible widely
 // (crbug.com/731893).
diff --git a/components/autofill/content/renderer/autofill_agent.cc b/components/autofill/content/renderer/autofill_agent.cc
index 7b886347f..c4f8436 100644
--- a/components/autofill/content/renderer/autofill_agent.cc
+++ b/components/autofill/content/renderer/autofill_agent.cc
@@ -910,9 +910,12 @@
                           weak_ptr_factory_.GetWeakPtr(), element));
 }
 
-bool AutofillAgent::TryToShowTouchToFill(const WebFormControlElement& element) {
-  // This is currently only implemented for passwords. Consider supporting other
-  // autofill types in the future as well.
+bool AutofillAgent::ShouldSuppressKeyboard(
+    const WebFormControlElement& element) {
+  // The keyboard should be suppressed if we can show the Touch To Fill UI.
+  //
+  // Note: This is currently only implemented for passwords. Consider supporting
+  // other autofill types in the future as well.
   return IsTouchToFillEnabled() &&
          password_autofill_agent_->TryToShowTouchToFill(element);
 }
diff --git a/components/autofill/content/renderer/autofill_agent.h b/components/autofill/content/renderer/autofill_agent.h
index ce3619c5..e552ea1 100644
--- a/components/autofill/content/renderer/autofill_agent.h
+++ b/components/autofill/content/renderer/autofill_agent.h
@@ -204,7 +204,7 @@
       const blink::WebFormControlElement& element) override;
   void SelectControlDidChange(
       const blink::WebFormControlElement& element) override;
-  bool TryToShowTouchToFill(
+  bool ShouldSuppressKeyboard(
       const blink::WebFormControlElement& element) override;
 
   void HandleFocusChangeComplete();
diff --git a/components/autofill/content/renderer/password_generation_agent.cc b/components/autofill/content/renderer/password_generation_agent.cc
index 8a9f32db..bcc694e 100644
--- a/components/autofill/content/renderer/password_generation_agent.cc
+++ b/components/autofill/content/renderer/password_generation_agent.cc
@@ -143,12 +143,10 @@
     PasswordAutofillAgent* password_agent,
     blink::AssociatedInterfaceRegistry* registry)
     : content::RenderFrameObserver(render_frame),
-      enabled_(password_generation::IsPasswordGenerationEnabled()),
       mark_generation_element_(
           base::CommandLine::ForCurrentProcess()->HasSwitch(
               switches::kShowAutofillSignatures)),
       password_agent_(password_agent) {
-  LogBoolean(Logger::STRING_GENERATION_RENDERER_ENABLED, enabled_);
   registry->AddInterface(base::BindRepeating(
       &PasswordGenerationAgent::BindPendingReceiver, base::Unretained(this)));
   password_agent_->SetPasswordGenerationAgent(this);
diff --git a/components/autofill/content/renderer/password_generation_agent.h b/components/autofill/content/renderer/password_generation_agent.h
index 460bbce..2844b8f 100644
--- a/components/autofill/content/renderer/password_generation_agent.h
+++ b/components/autofill/content/renderer/password_generation_agent.h
@@ -91,10 +91,6 @@
   }
 #endif
 
- protected:
-  // Use to force enable during testing.
-  void set_enabled(bool enabled) { enabled_ = enabled; }
-
  private:
   // Contains information about generation status for an element for the
   // lifetime of the possible interaction.
@@ -168,9 +164,6 @@
   // generation.
   std::map<uint32_t, PasswordFormGenerationData> generation_enabled_fields_;
 
-  // If this feature is enabled. Controlled by Finch.
-  bool enabled_;
-
   // True iff the generation element should be marked with special HTML
   // attribute (only for experimental purposes).
   const bool mark_generation_element_;
diff --git a/components/autofill/core/browser/autofill_type.cc b/components/autofill/core/browser/autofill_type.cc
index a019c24..d141a0dbc 100644
--- a/components/autofill/core/browser/autofill_type.cc
+++ b/components/autofill/core/browser/autofill_type.cc
@@ -94,6 +94,9 @@
     case PROBABLY_NEW_PASSWORD:
     case NOT_NEW_PASSWORD:
     case CONFIRMATION_PASSWORD:
+    case NOT_PASSWORD:
+    case SINGLE_USERNAME:
+    case NOT_USERNAME:
       return PASSWORD_FIELD;
 
     case NO_SERVER_DATA:
@@ -123,9 +126,9 @@
 
     case UNKNOWN_TYPE:
       return NO_GROUP;
-    default:
-      return NO_GROUP;
   }
+  NOTREACHED();
+  return NO_GROUP;
 }
 
 FieldTypeGroup GroupTypeOfHtmlFieldType(HtmlFieldType field_type,
@@ -193,9 +196,9 @@
     case HTML_TYPE_UNSPECIFIED:
     case HTML_TYPE_UNRECOGNIZED:
       return NO_GROUP;
-    default:
-      return NO_GROUP;
   }
+  NOTREACHED();
+  return NO_GROUP;
 }
 
 AutofillType::AutofillType(ServerFieldType field_type)
diff --git a/components/autofill/core/browser/form_structure.cc b/components/autofill/core/browser/form_structure.cc
index c9d4881b..7828bd2 100644
--- a/components/autofill/core/browser/form_structure.cc
+++ b/components/autofill/core/browser/form_structure.cc
@@ -1560,13 +1560,13 @@
 }
 
 void FormStructure::RationalizeAddressLineFields(
-    SectionedFieldsIndexes& sections_of_address_indexes,
+    SectionedFieldsIndexes* sections_of_address_indexes,
     AutofillMetrics::FormInteractionsUkmLogger* form_interactions_ukm_logger) {
   // The rationalization happens within sections.
-  for (sections_of_address_indexes.Reset();
-       !sections_of_address_indexes.IsFinished();
-       sections_of_address_indexes.WalkForwardToTheNextSection()) {
-    auto current_section = sections_of_address_indexes.CurrentSection();
+  for (sections_of_address_indexes->Reset();
+       !sections_of_address_indexes->IsFinished();
+       sections_of_address_indexes->WalkForwardToTheNextSection()) {
+    auto current_section = sections_of_address_indexes->CurrentSection();
 
     // The rationalization only applies to sections that have 2 or 3 visible
     // street address predictions.
@@ -1689,8 +1689,8 @@
 }
 
 void FormStructure::RationalizeAddressStateCountry(
-    SectionedFieldsIndexes& sections_of_state_indexes,
-    SectionedFieldsIndexes& sections_of_country_indexes,
+    SectionedFieldsIndexes* sections_of_state_indexes,
+    SectionedFieldsIndexes* sections_of_country_indexes,
     AutofillMetrics::FormInteractionsUkmLogger* form_interactions_ukm_logger) {
   // Walk on the sections of state and country indexes simultaneously. If they
   // both point to the same section, it means that that section includes both
@@ -1701,24 +1701,24 @@
   // the pointer that points to the earlier section forward. Stop when both
   // sections of indexes are processed. (This resembles the merge in the merge
   // sort.)
-  sections_of_state_indexes.Reset();
-  sections_of_country_indexes.Reset();
+  sections_of_state_indexes->Reset();
+  sections_of_country_indexes->Reset();
 
-  while (!sections_of_state_indexes.IsFinished() ||
-         !sections_of_country_indexes.IsFinished()) {
+  while (!sections_of_state_indexes->IsFinished() ||
+         !sections_of_country_indexes->IsFinished()) {
     auto current_section_of_state_indexes =
-        sections_of_state_indexes.CurrentSection();
+        sections_of_state_indexes->CurrentSection();
     auto current_section_of_country_indexes =
-        sections_of_country_indexes.CurrentSection();
+        sections_of_country_indexes->CurrentSection();
     // If there are still sections left with both country and state type, and
     // state and country current sections are equal, then that section has both
     // state and country. No rationalization needed.
-    if (!sections_of_state_indexes.IsFinished() &&
-        !sections_of_country_indexes.IsFinished() &&
-        fields_[sections_of_state_indexes.CurrentIndex()]->section ==
-            fields_[sections_of_country_indexes.CurrentIndex()]->section) {
-      sections_of_state_indexes.WalkForwardToTheNextSection();
-      sections_of_country_indexes.WalkForwardToTheNextSection();
+    if (!sections_of_state_indexes->IsFinished() &&
+        !sections_of_country_indexes->IsFinished() &&
+        fields_[sections_of_state_indexes->CurrentIndex()]->section ==
+            fields_[sections_of_country_indexes->CurrentIndex()]->section) {
+      sections_of_state_indexes->WalkForwardToTheNextSection();
+      sections_of_country_indexes->WalkForwardToTheNextSection();
       continue;
     }
 
@@ -1732,14 +1732,14 @@
         upper_index = current_section_of_state_indexes[0];
         lower_index = current_section_of_state_indexes[1];
       }
-      sections_of_state_indexes.WalkForwardToTheNextSection();
+      sections_of_state_indexes->WalkForwardToTheNextSection();
     } else {
       // We only rationalize when we have exactly two visible fields of a kind.
       if (current_section_of_country_indexes.size() == 2) {
         upper_index = current_section_of_country_indexes[0];
         lower_index = current_section_of_country_indexes[1];
       }
-      sections_of_country_indexes.WalkForwardToTheNextSection();
+      sections_of_country_indexes->WalkForwardToTheNextSection();
     }
 
     // This is when upper and lower indexes are not changed, meaning that there
@@ -1799,13 +1799,13 @@
   }
 
   RationalizeAddressLineFields(
-      sectioned_field_indexes_by_type[ADDRESS_HOME_STREET_ADDRESS],
+      &(sectioned_field_indexes_by_type[ADDRESS_HOME_STREET_ADDRESS]),
       form_interactions_ukm_logger);
   // Since the billing types are mapped to the non-billing ones, no need to
   // take care of ADDRESS_BILLING_STATE and .. .
   RationalizeAddressStateCountry(
-      sectioned_field_indexes_by_type[ADDRESS_HOME_STATE],
-      sectioned_field_indexes_by_type[ADDRESS_HOME_COUNTRY],
+      &(sectioned_field_indexes_by_type[ADDRESS_HOME_STATE]),
+      &(sectioned_field_indexes_by_type[ADDRESS_HOME_COUNTRY]),
       form_interactions_ukm_logger);
 }
 
diff --git a/components/autofill/core/browser/form_structure.h b/components/autofill/core/browser/form_structure.h
index ad64a76..fa8777ff 100644
--- a/components/autofill/core/browser/form_structure.h
+++ b/components/autofill/core/browser/form_structure.h
@@ -454,13 +454,13 @@
   // Two or three fields predicted as the whole address should be address lines
   // 1, 2 and 3 instead.
   void RationalizeAddressLineFields(
-      SectionedFieldsIndexes& sections_of_address_indexes,
+      SectionedFieldsIndexes* sections_of_address_indexes,
       AutofillMetrics::FormInteractionsUkmLogger*);
 
   // Rationalize state and country interdependently.
   void RationalizeAddressStateCountry(
-      SectionedFieldsIndexes& sections_of_state_indexes,
-      SectionedFieldsIndexes& sections_of_country_indexes,
+      SectionedFieldsIndexes* sections_of_state_indexes,
+      SectionedFieldsIndexes* sections_of_country_indexes,
       AutofillMetrics::FormInteractionsUkmLogger*);
 
   // Tunes the fields with identical predictions.
diff --git a/components/autofill/core/common/autofill_features.cc b/components/autofill/core/common/autofill_features.cc
index b0504b4f..edde051 100644
--- a/components/autofill/core/common/autofill_features.cc
+++ b/components/autofill/core/common/autofill_features.cc
@@ -194,11 +194,6 @@
     "AutofillUseImprovedLabelDisambiguation",
     base::FEATURE_DISABLED_BY_DEFAULT};
 
-// Controls whether password generation is offered automatically on fields
-// perceived as eligible for generation.
-const base::Feature kAutomaticPasswordGeneration = {
-    "AutomaticPasswordGeneration", base::FEATURE_ENABLED_BY_DEFAULT};
-
 #if defined(OS_ANDROID)
 // Controls whether the Autofill manual fallback for Addresses and Payments is
 // present on Android.
diff --git a/components/autofill/core/common/autofill_features.h b/components/autofill/core/common/autofill_features.h
index e3a45a80..be02d8a 100644
--- a/components/autofill/core/common/autofill_features.h
+++ b/components/autofill/core/common/autofill_features.h
@@ -57,7 +57,6 @@
 extern const base::Feature kAutofillUploadThrottling;
 extern const base::Feature kAutofillUseApi;
 extern const base::Feature kAutofillUseImprovedLabelDisambiguation;
-extern const base::Feature kAutomaticPasswordGeneration;
 
 #if defined(OS_ANDROID)
 extern const base::Feature kAutofillManualFallbackAndroid;
diff --git a/components/autofill/core/common/password_generation_util.cc b/components/autofill/core/common/password_generation_util.cc
index 2b74353e..8bab183 100644
--- a/components/autofill/core/common/password_generation_util.cc
+++ b/components/autofill/core/common/password_generation_util.cc
@@ -44,10 +44,5 @@
                             event, EVENT_ENUM_COUNT);
 }
 
-bool IsPasswordGenerationEnabled() {
-  return base::FeatureList::IsEnabled(
-      autofill::features::kAutomaticPasswordGeneration);
-}
-
 }  // namespace password_generation
 }  // namespace autofill
diff --git a/components/autofill/core/common/save_password_progress_logger.cc b/components/autofill/core/common/save_password_progress_logger.cc
index 7c88efc..7408ebf 100644
--- a/components/autofill/core/common/save_password_progress_logger.cc
+++ b/components/autofill/core/common/save_password_progress_logger.cc
@@ -423,8 +423,6 @@
       return "Generation disabled: saving disabled";
     case SavePasswordProgressLogger::STRING_GENERATION_DISABLED_NO_SYNC:
       return "Generation disabled: no sync";
-    case STRING_GENERATION_RENDERER_ENABLED:
-      return "Generation renderer enabled";
     case STRING_GENERATION_RENDERER_INVALID_PASSWORD_FORM:
       return "Generation invalid PasswordForm";
     case STRING_GENERATION_RENDERER_POSSIBLE_ACCOUNT_CREATION_FORMS:
@@ -484,6 +482,10 @@
       return "HttpAuthManager::DetachObserver";
     case SavePasswordProgressLogger::STRING_SHOW_ONBOARDING:
       return "Show onboarding experience and offer to save password";
+    case STRING_LEAK_DETECTION_FINISHED:
+      return "Leak detection finished with result";
+    case STRING_LEAK_DETECTION_SIGNED_OUT_ERROR:
+      return "Leak detection failed: signed out";
     case SavePasswordProgressLogger::STRING_INVALID:
       return "INVALID";
       // Intentionally no default: clause here -- all IDs need to get covered.
diff --git a/components/autofill/core/common/save_password_progress_logger.h b/components/autofill/core/common/save_password_progress_logger.h
index 00e2a28..484204c 100644
--- a/components/autofill/core/common/save_password_progress_logger.h
+++ b/components/autofill/core/common/save_password_progress_logger.h
@@ -149,7 +149,6 @@
     STRING_REUSE_FOUND,
     STRING_GENERATION_DISABLED_SAVING_DISABLED,
     STRING_GENERATION_DISABLED_NO_SYNC,
-    STRING_GENERATION_RENDERER_ENABLED,
     STRING_GENERATION_RENDERER_INVALID_PASSWORD_FORM,
     STRING_GENERATION_RENDERER_POSSIBLE_ACCOUNT_CREATION_FORMS,
     STRING_GENERATION_RENDERER_NO_PASSWORD_MANAGER_ACCESS,
@@ -178,6 +177,8 @@
     STRING_HTTPAUTH_ON_SET_OBSERVER,
     STRING_HTTPAUTH_ON_DETACH_OBSERVER,
     STRING_SHOW_ONBOARDING,
+    STRING_LEAK_DETECTION_FINISHED,
+    STRING_LEAK_DETECTION_SIGNED_OUT_ERROR,
     STRING_INVALID,  // Represents a string returned in a case of an error.
     STRING_MAX = STRING_INVALID
   };
diff --git a/components/password_manager/core/browser/BUILD.gn b/components/password_manager/core/browser/BUILD.gn
index 44db9f5e..dd15f5a 100644
--- a/components/password_manager/core/browser/BUILD.gn
+++ b/components/password_manager/core/browser/BUILD.gn
@@ -530,6 +530,7 @@
     sources += [
       "hsts_query_unittest.cc",
       "http_credentials_cleaner_unittest.cc",
+      "leak_detection_delegate_unittest.cc",
     ]
   }
   if (password_reuse_detection_support) {
diff --git a/components/password_manager/core/browser/leak_detection/BUILD.gn b/components/password_manager/core/browser/leak_detection/BUILD.gn
index e2f41faa..6541850 100644
--- a/components/password_manager/core/browser/leak_detection/BUILD.gn
+++ b/components/password_manager/core/browser/leak_detection/BUILD.gn
@@ -14,6 +14,7 @@
 source_set("leak_detection_interface_headers") {
   sources = [
     "leak_detection_check.h",
+    "leak_detection_delegate_interface.h",
     "leak_detection_request_factory.h",
   ]
   deps = [
diff --git a/components/password_manager/core/browser/leak_detection/authenticated_leak_check.cc b/components/password_manager/core/browser/leak_detection/authenticated_leak_check.cc
index 9c409052..e78a078a 100644
--- a/components/password_manager/core/browser/leak_detection/authenticated_leak_check.cc
+++ b/components/password_manager/core/browser/leak_detection/authenticated_leak_check.cc
@@ -6,11 +6,19 @@
 
 namespace password_manager {
 
-AuthenticatedLeakCheck::AuthenticatedLeakCheck() = default;
+AuthenticatedLeakCheck::AuthenticatedLeakCheck(
+    LeakDetectionDelegateInterface* delegate,
+    signin::IdentityManager* identity_manager)
+    : delegate_(delegate), identity_manager_(identity_manager) {}
+
 AuthenticatedLeakCheck::~AuthenticatedLeakCheck() = default;
 
 void AuthenticatedLeakCheck::Start(const GURL& url,
                                    base::StringPiece16 username,
-                                   base::StringPiece16 password) {}
+                                   base::StringPiece16 password) {
+  // TODO(crbug.com/986298): get the access token here.
+  std::ignore = delegate_;
+  std::ignore = identity_manager_;
+}
 
 }  // namespace password_manager
diff --git a/components/password_manager/core/browser/leak_detection/authenticated_leak_check.h b/components/password_manager/core/browser/leak_detection/authenticated_leak_check.h
index 73f09df..f2e6b019 100644
--- a/components/password_manager/core/browser/leak_detection/authenticated_leak_check.h
+++ b/components/password_manager/core/browser/leak_detection/authenticated_leak_check.h
@@ -7,17 +7,30 @@
 
 #include "components/password_manager/core/browser/leak_detection/leak_detection_check.h"
 
+namespace signin {
+class IdentityManager;
+}  // namespace signin
+
 namespace password_manager {
 
+class LeakDetectionDelegateInterface;
+
 // Performs a leak-check for {username, password} for Chrome signed-in users.
 class AuthenticatedLeakCheck : public LeakDetectionCheck {
  public:
-  AuthenticatedLeakCheck();
+  AuthenticatedLeakCheck(LeakDetectionDelegateInterface* delegate,
+                         signin::IdentityManager* identity_manager);
   ~AuthenticatedLeakCheck() override;
 
   void Start(const GURL& url,
              base::StringPiece16 username,
              base::StringPiece16 password) override;
+
+ private:
+  // Delegate for the instance. Should outlive |this|.
+  LeakDetectionDelegateInterface* delegate_;
+  // Identity manager for the profile.
+  signin::IdentityManager* identity_manager_;
 };
 
 }  // namespace password_manager
diff --git a/components/password_manager/core/browser/leak_detection/authenticated_leak_check_unittest.cc b/components/password_manager/core/browser/leak_detection/authenticated_leak_check_unittest.cc
index c7bdfd5..0ec113b3 100644
--- a/components/password_manager/core/browser/leak_detection/authenticated_leak_check_unittest.cc
+++ b/components/password_manager/core/browser/leak_detection/authenticated_leak_check_unittest.cc
@@ -9,7 +9,7 @@
 namespace password_manager {
 
 TEST(AuthenticatedLeakCheck, Create) {
-  AuthenticatedLeakCheck check;
+  AuthenticatedLeakCheck check(nullptr, nullptr);
 }
 
 }  // namespace password_manager
diff --git a/components/password_manager/core/browser/leak_detection/leak_detection_delegate_interface.h b/components/password_manager/core/browser/leak_detection/leak_detection_delegate_interface.h
new file mode 100644
index 0000000..c408d0f1
--- /dev/null
+++ b/components/password_manager/core/browser/leak_detection/leak_detection_delegate_interface.h
@@ -0,0 +1,46 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_PASSWORD_MANAGER_CORE_BROWSER_LEAK_DETECTION_LEAK_DETECTION_DELEGATE_INTERFACE_H_
+#define COMPONENTS_PASSWORD_MANAGER_CORE_BROWSER_LEAK_DETECTION_LEAK_DETECTION_DELEGATE_INTERFACE_H_
+
+#include "url/gurl.h"
+
+namespace password_manager {
+
+enum class LeakDetectionError {
+  // The user isn't signed-in to Chrome.
+  kNotSignIn,
+  // TODO(crbug.com/986298): add more errors.
+};
+
+// Interface with callbacks for LeakDetectionCheck. Used to get the result of
+// the check.
+class LeakDetectionDelegateInterface {
+ public:
+  LeakDetectionDelegateInterface() = default;
+  virtual ~LeakDetectionDelegateInterface() = default;
+
+  // Not copyable or movable
+  LeakDetectionDelegateInterface(const LeakDetectionDelegateInterface&) =
+      delete;
+  LeakDetectionDelegateInterface& operator=(
+      const LeakDetectionDelegateInterface&) = delete;
+  LeakDetectionDelegateInterface(LeakDetectionDelegateInterface&&) = delete;
+  LeakDetectionDelegateInterface& operator=(LeakDetectionDelegateInterface&&) =
+      delete;
+
+  // Called when the request is finished without error.
+  // |leak| is true iff the checked credential was leaked.
+  // |url| and |username| are taken from Start() for presentation in the UI.
+  virtual void OnLeakDetectionDone(bool leaked,
+                                   const GURL& url,
+                                   base::StringPiece16 username) = 0;
+
+  virtual void OnError(LeakDetectionError error) = 0;
+};
+
+}  // namespace password_manager
+
+#endif  // COMPONENTS_PASSWORD_MANAGER_CORE_BROWSER_LEAK_DETECTION_LEAK_DETECTION_DELEGATE_INTERFACE_H_
diff --git a/components/password_manager/core/browser/leak_detection/leak_detection_request_factory.h b/components/password_manager/core/browser/leak_detection/leak_detection_request_factory.h
index 298f261..127ffaf 100644
--- a/components/password_manager/core/browser/leak_detection/leak_detection_request_factory.h
+++ b/components/password_manager/core/browser/leak_detection/leak_detection_request_factory.h
@@ -7,9 +7,14 @@
 
 #include <memory>
 
+namespace signin {
+class IdentityManager;
+}  // namespace signin
+
 namespace password_manager {
 
 class LeakDetectionCheck;
+class LeakDetectionDelegateInterface;
 
 // The interface for creating instances of requests for checking if
 // {username, password} pair was leaked in the internet.
@@ -28,7 +33,11 @@
 
   // The leak check is available only for signed-in users and if the feature is
   // available.
-  virtual std::unique_ptr<LeakDetectionCheck> TryCreateLeakCheck() const = 0;
+  // |delegate| gets the results for the fetch.
+  // |identity_manager| is used to obtain the token.
+  virtual std::unique_ptr<LeakDetectionCheck> TryCreateLeakCheck(
+      LeakDetectionDelegateInterface* delegate,
+      signin::IdentityManager* identity_manager) const = 0;
 };
 
 }  // namespace password_manager
diff --git a/components/password_manager/core/browser/leak_detection/leak_detection_request_factory_impl.cc b/components/password_manager/core/browser/leak_detection/leak_detection_request_factory_impl.cc
index 72654eb..23bc008 100644
--- a/components/password_manager/core/browser/leak_detection/leak_detection_request_factory_impl.cc
+++ b/components/password_manager/core/browser/leak_detection/leak_detection_request_factory_impl.cc
@@ -13,10 +13,12 @@
 LeakDetectionRequestFactoryImpl::~LeakDetectionRequestFactoryImpl() = default;
 
 std::unique_ptr<LeakDetectionCheck>
-LeakDetectionRequestFactoryImpl::TryCreateLeakCheck() const {
+LeakDetectionRequestFactoryImpl::TryCreateLeakCheck(
+    LeakDetectionDelegateInterface* delegate,
+    signin::IdentityManager* identity_manager) const {
   if (!base::FeatureList::IsEnabled(features::kLeakDetection))
     return nullptr;
-  return std::make_unique<AuthenticatedLeakCheck>();
+  return std::make_unique<AuthenticatedLeakCheck>(delegate, identity_manager);
 }
 
 }  // namespace password_manager
\ No newline at end of file
diff --git a/components/password_manager/core/browser/leak_detection/leak_detection_request_factory_impl.h b/components/password_manager/core/browser/leak_detection/leak_detection_request_factory_impl.h
index 27d5acf0..e8b7d10 100644
--- a/components/password_manager/core/browser/leak_detection/leak_detection_request_factory_impl.h
+++ b/components/password_manager/core/browser/leak_detection/leak_detection_request_factory_impl.h
@@ -19,7 +19,9 @@
   LeakDetectionRequestFactoryImpl();
   ~LeakDetectionRequestFactoryImpl() override;
 
-  std::unique_ptr<LeakDetectionCheck> TryCreateLeakCheck() const override;
+  std::unique_ptr<LeakDetectionCheck> TryCreateLeakCheck(
+      LeakDetectionDelegateInterface* delegate,
+      signin::IdentityManager* identity_manager) const override;
 };
 
 }  // namespace password_manager
diff --git a/components/password_manager/core/browser/leak_detection/leak_detection_request_factory_impl_unittest.cc b/components/password_manager/core/browser/leak_detection/leak_detection_request_factory_impl_unittest.cc
index 3c91cd3e..e9de548 100644
--- a/components/password_manager/core/browser/leak_detection/leak_detection_request_factory_impl_unittest.cc
+++ b/components/password_manager/core/browser/leak_detection/leak_detection_request_factory_impl_unittest.cc
@@ -6,17 +6,34 @@
 
 #include "base/test/scoped_feature_list.h"
 #include "components/password_manager/core/browser/leak_detection/leak_detection_check.h"
+#include "components/password_manager/core/browser/leak_detection/leak_detection_delegate_interface.h"
 #include "components/password_manager/core/common/password_manager_features.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace password_manager {
+namespace {
+
+class TestLeakDetectionDelegateInterface
+    : public LeakDetectionDelegateInterface {
+ public:
+  TestLeakDetectionDelegateInterface() = default;
+  ~TestLeakDetectionDelegateInterface() override = default;
+
+  // LeakDetectionDelegateInterface:
+  void OnLeakDetectionDone(bool leaked,
+                           const GURL& url,
+                           base::StringPiece16 username) override {}
+  void OnError(LeakDetectionError error) override {}
+};
+}  // namespace
 
 TEST(LeakDetectionRequestFactoryImpl, DisabledFeature) {
   base::test::ScopedFeatureList feature_list;
   feature_list.InitAndDisableFeature(features::kLeakDetection);
 
   LeakDetectionRequestFactoryImpl factory;
-  EXPECT_FALSE(factory.TryCreateLeakCheck());
+  TestLeakDetectionDelegateInterface delegate;
+  EXPECT_FALSE(factory.TryCreateLeakCheck(&delegate, nullptr));
 }
 
 }  // namespace password_manager
diff --git a/components/password_manager/core/browser/leak_detection_delegate.cc b/components/password_manager/core/browser/leak_detection_delegate.cc
index 59296df..643b0a6 100644
--- a/components/password_manager/core/browser/leak_detection_delegate.cc
+++ b/components/password_manager/core/browser/leak_detection_delegate.cc
@@ -5,20 +5,52 @@
 #include "components/password_manager/core/browser/leak_detection_delegate.h"
 
 #include "components/autofill/core/common/password_form.h"
+#include "components/autofill/core/common/save_password_progress_logger.h"
 #include "components/password_manager/core/browser/leak_detection/leak_detection_check.h"
 #include "components/password_manager/core/browser/leak_detection/leak_detection_request_factory_impl.h"
+#include "components/password_manager/core/browser/password_manager_client.h"
+#include "components/password_manager/core/browser/password_manager_util.h"
 
 namespace password_manager {
 
-LeakDetectionDelegate::LeakDetectionDelegate()
-    : leak_factory_(std::make_unique<LeakDetectionRequestFactoryImpl>()) {}
+using Logger = autofill::SavePasswordProgressLogger;
+
+LeakDetectionDelegate::LeakDetectionDelegate(PasswordManagerClient* client)
+    : client_(client),
+      leak_factory_(std::make_unique<LeakDetectionRequestFactoryImpl>()) {}
 
 LeakDetectionDelegate::~LeakDetectionDelegate() = default;
 
 void LeakDetectionDelegate::StartLeakCheck(const autofill::PasswordForm& form) {
-  leak_check_ = leak_factory_->TryCreateLeakCheck();
+  if (client_->IsIncognito())
+    return;
+  leak_check_ =
+      leak_factory_->TryCreateLeakCheck(this, client_->GetIdentityManager());
   if (leak_check_)
     leak_check_->Start(form.origin, form.username_value, form.password_value);
 }
 
+void LeakDetectionDelegate::OnLeakDetectionDone(bool leaked,
+                                                const GURL& url,
+                                                base::StringPiece16 username) {
+  leak_check_.reset();
+  if (password_manager_util::IsLoggingActive(client_)) {
+    BrowserSavePasswordProgressLogger logger(client_->GetLogManager());
+    logger.LogBoolean(Logger::STRING_LEAK_DETECTION_FINISHED, leaked);
+  }
+}
+
+void LeakDetectionDelegate::OnError(LeakDetectionError error) {
+  leak_check_.reset();
+
+  if (password_manager_util::IsLoggingActive(client_)) {
+    BrowserSavePasswordProgressLogger logger(client_->GetLogManager());
+    switch (error) {
+      case LeakDetectionError::kNotSignIn:
+        logger.LogMessage(Logger::STRING_LEAK_DETECTION_SIGNED_OUT_ERROR);
+        break;
+    }
+  }
+}
+
 }  // namespace password_manager
diff --git a/components/password_manager/core/browser/leak_detection_delegate.h b/components/password_manager/core/browser/leak_detection_delegate.h
index 62cddd12..f9681bb 100644
--- a/components/password_manager/core/browser/leak_detection_delegate.h
+++ b/components/password_manager/core/browser/leak_detection_delegate.h
@@ -7,6 +7,7 @@
 
 #include <memory>
 
+#include "components/password_manager/core/browser/leak_detection/leak_detection_delegate_interface.h"
 #include "components/password_manager/core/browser/leak_detection/leak_detection_request_factory.h"
 
 namespace autofill {
@@ -16,12 +17,13 @@
 namespace password_manager {
 
 class LeakDetectionCheck;
+class PasswordManagerClient;
 
 // The helper class that incapsulates the requests and their processing.
-class LeakDetectionDelegate {
+class LeakDetectionDelegate : public LeakDetectionDelegateInterface {
  public:
-  LeakDetectionDelegate();
-  ~LeakDetectionDelegate();
+  explicit LeakDetectionDelegate(PasswordManagerClient* client);
+  ~LeakDetectionDelegate() override;
 
   // Not copyable or movable
   LeakDetectionDelegate(const LeakDetectionDelegate&) = delete;
@@ -33,11 +35,20 @@
   void set_leak_factory(std::unique_ptr<LeakDetectionRequestFactory> factory) {
     leak_factory_ = std::move(factory);
   }
+
+  LeakDetectionCheck* leak_check() const { return leak_check_.get(); }
 #endif  // defined(UNIT_TEST)
 
   void StartLeakCheck(const autofill::PasswordForm& form);
 
  private:
+  // LeakDetectionDelegateInterface:
+  void OnLeakDetectionDone(bool leaked,
+                           const GURL& url,
+                           base::StringPiece16 username) override;
+  void OnError(LeakDetectionError error) override;
+
+  PasswordManagerClient* client_;
   // The factory that creates objects for performing a leak check up.
   std::unique_ptr<LeakDetectionRequestFactory> leak_factory_;
 
diff --git a/components/password_manager/core/browser/leak_detection_delegate_unittest.cc b/components/password_manager/core/browser/leak_detection_delegate_unittest.cc
new file mode 100644
index 0000000..1c37f1d
--- /dev/null
+++ b/components/password_manager/core/browser/leak_detection_delegate_unittest.cc
@@ -0,0 +1,98 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <utility>
+
+#include "components/password_manager/core/browser/leak_detection_delegate.h"
+
+#include "base/strings/utf_string_conversions.h"
+#include "components/password_manager/core/browser/leak_detection/leak_detection_check.h"
+#include "components/password_manager/core/browser/stub_password_manager_client.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace password_manager {
+namespace {
+
+using base::ASCIIToUTF16;
+using testing::ByMove;
+using testing::Eq;
+using testing::Return;
+
+autofill::PasswordForm CreateTestForm() {
+  autofill::PasswordForm form;
+  form.origin = GURL("http://www.example.com/a/LoginAuth");
+  form.username_value = ASCIIToUTF16("Adam");
+  form.password_value = ASCIIToUTF16("p4ssword");
+  form.signon_realm = "http://www.example.com/";
+  return form;
+}
+
+class MockPasswordManagerClient : public StubPasswordManagerClient {
+ public:
+  MockPasswordManagerClient() = default;
+  ~MockPasswordManagerClient() override = default;
+
+  MOCK_CONST_METHOD0(IsIncognito, bool());
+};
+
+class MockLeakDetectionCheck : public LeakDetectionCheck {
+ public:
+  MOCK_METHOD3(Start,
+               void(const GURL&, base::StringPiece16, base::StringPiece16));
+};
+
+class MockLeakDetectionRequestFactory : public LeakDetectionRequestFactory {
+ public:
+  MOCK_CONST_METHOD2(
+      TryCreateLeakCheck,
+      std::unique_ptr<LeakDetectionCheck>(LeakDetectionDelegateInterface*,
+                                          signin::IdentityManager*));
+};
+
+}  // namespace
+
+class LeakDetectionDelegateTest : public testing::Test {
+ public:
+  LeakDetectionDelegateTest() : delegate_(&client_) {
+    auto mock_factory = std::make_unique<
+        testing::StrictMock<MockLeakDetectionRequestFactory>>();
+    mock_factory_ = mock_factory.get();
+    delegate_.set_leak_factory(std::move(mock_factory));
+  }
+  ~LeakDetectionDelegateTest() override = default;
+
+  MockPasswordManagerClient& client() { return client_; }
+  MockLeakDetectionRequestFactory& factory() { return *mock_factory_; }
+  LeakDetectionDelegate& delegate() { return delegate_; }
+
+ private:
+  MockPasswordManagerClient client_;
+  MockLeakDetectionRequestFactory* mock_factory_ = nullptr;
+  LeakDetectionDelegate delegate_;
+};
+
+TEST_F(LeakDetectionDelegateTest, InIncognito) {
+  const autofill::PasswordForm form = CreateTestForm();
+  EXPECT_CALL(client(), IsIncognito).WillOnce(Return(true));
+  EXPECT_CALL(factory(), TryCreateLeakCheck).Times(0);
+  delegate().StartLeakCheck(form);
+
+  EXPECT_FALSE(delegate().leak_check());
+}
+
+TEST_F(LeakDetectionDelegateTest, StartCheck) {
+  const autofill::PasswordForm form = CreateTestForm();
+  EXPECT_CALL(client(), IsIncognito).WillOnce(Return(false));
+  auto check_instance = std::make_unique<MockLeakDetectionCheck>();
+  EXPECT_CALL(*check_instance, Start(form.origin, Eq(form.username_value),
+                                     Eq(form.password_value)));
+  EXPECT_CALL(factory(), TryCreateLeakCheck)
+      .WillOnce(Return(ByMove(std::move(check_instance))));
+  delegate().StartLeakCheck(form);
+
+  EXPECT_TRUE(delegate().leak_check());
+}
+
+}  // namespace password_manager
diff --git a/components/password_manager/core/browser/password_manager.cc b/components/password_manager/core/browser/password_manager.cc
index 38f2c61b4..d59f1d8 100644
--- a/components/password_manager/core/browser/password_manager.cc
+++ b/components/password_manager/core/browser/password_manager.cc
@@ -399,7 +399,12 @@
 }
 
 PasswordManager::PasswordManager(PasswordManagerClient* client)
-    : client_(client) {
+    : client_(client)
+#if !defined(OS_IOS)
+      ,
+      leak_delegate_(client)
+#endif  // !defined(OS_IOS)
+{
   DCHECK(client_);
 }
 
diff --git a/components/password_manager/core/browser/password_manager_client.h b/components/password_manager/core/browser/password_manager_client.h
index 3e57b3b..108c855 100644
--- a/components/password_manager/core/browser/password_manager_client.h
+++ b/components/password_manager/core/browser/password_manager_client.h
@@ -35,6 +35,10 @@
 class FaviconService;
 }
 
+namespace signin {
+class IdentityManager;
+}  // namespace signin
+
 class GURL;
 
 #if BUILDFLAG(FULL_SAFE_BROWSING)
@@ -302,6 +306,9 @@
   // Returns the favicon service used to retrieve icons for an origin.
   virtual favicon::FaviconService* GetFaviconService();
 
+  // Returns the identity manager for profile.
+  virtual signin::IdentityManager* GetIdentityManager() = 0;
+
   // Whether the primary account of the current profile is under Advanced
   // Protection - a type of Google Account that helps protect our most at-risk
   // users.
diff --git a/components/password_manager/core/browser/password_manager_unittest.cc b/components/password_manager/core/browser/password_manager_unittest.cc
index 13d052d..80b3fba 100644
--- a/components/password_manager/core/browser/password_manager_unittest.cc
+++ b/components/password_manager/core/browser/password_manager_unittest.cc
@@ -96,7 +96,10 @@
 
 class MockLeakDetectionRequestFactory : public LeakDetectionRequestFactory {
  public:
-  MOCK_CONST_METHOD0(TryCreateLeakCheck, std::unique_ptr<LeakDetectionCheck>());
+  MOCK_CONST_METHOD2(
+      TryCreateLeakCheck,
+      std::unique_ptr<LeakDetectionCheck>(LeakDetectionDelegateInterface*,
+                                          signin::IdentityManager*));
 };
 
 class MockStoreResultFilter : public StubCredentialsFilter {
@@ -3869,7 +3872,7 @@
   EXPECT_CALL(*check_instance,
               Start(form.origin, base::StringPiece16(form.username_value),
                     base::StringPiece16(form.password_value)));
-  EXPECT_CALL(*weak_factory, TryCreateLeakCheck())
+  EXPECT_CALL(*weak_factory, TryCreateLeakCheck)
       .WillOnce(Return(ByMove(std::move(check_instance))));
 
   // Now the password manager waits for the navigation to complete.
diff --git a/components/password_manager/core/browser/stub_password_manager_client.cc b/components/password_manager/core/browser/stub_password_manager_client.cc
index 2176b56..24d1742f 100644
--- a/components/password_manager/core/browser/stub_password_manager_client.cc
+++ b/components/password_manager/core/browser/stub_password_manager_client.cc
@@ -112,6 +112,10 @@
   return base::OptionalOrNullptr(metrics_recorder_);
 }
 
+signin::IdentityManager* StubPasswordManagerClient::GetIdentityManager() {
+  return nullptr;
+}
+
 bool StubPasswordManagerClient::IsIsolationForPasswordSitesEnabled() const {
   return false;
 }
diff --git a/components/password_manager/core/browser/stub_password_manager_client.h b/components/password_manager/core/browser/stub_password_manager_client.h
index 8ba4273..2683d021 100644
--- a/components/password_manager/core/browser/stub_password_manager_client.h
+++ b/components/password_manager/core/browser/stub_password_manager_client.h
@@ -70,6 +70,7 @@
 #endif
   ukm::SourceId GetUkmSourceId() override;
   PasswordManagerMetricsRecorder* GetMetricsRecorder() override;
+  signin::IdentityManager* GetIdentityManager() override;
   bool IsIsolationForPasswordSitesEnabled() const override;
   bool IsNewTabPage() const override;
 
diff --git a/components/password_manager/core/browser/sync_credentials_filter.cc b/components/password_manager/core/browser/sync_credentials_filter.cc
index a3d88e3..7b8155a9 100644
--- a/components/password_manager/core/browser/sync_credentials_filter.cc
+++ b/components/password_manager/core/browser/sync_credentials_filter.cc
@@ -22,12 +22,11 @@
 namespace password_manager {
 
 SyncCredentialsFilter::SyncCredentialsFilter(
-    const PasswordManagerClient* client,
-    SyncServiceFactoryFunction sync_service_factory_function,
-    IdentityManagerFactoryFunction identity_manager_factory_function)
+    PasswordManagerClient* client,
+    SyncServiceFactoryFunction sync_service_factory_function)
     : client_(client),
-      sync_service_factory_function_(sync_service_factory_function),
-      identity_manager_factory_function_(identity_manager_factory_function) {}
+      sync_service_factory_function_(std::move(sync_service_factory_function)) {
+}
 
 SyncCredentialsFilter::~SyncCredentialsFilter() {}
 
@@ -37,7 +36,7 @@
          !form.form_data.is_gaia_with_skip_save_password_form &&
          !sync_util::IsSyncAccountCredential(
              form, sync_service_factory_function_.Run(),
-             identity_manager_factory_function_.Run());
+             client_->GetIdentityManager());
 }
 
 bool SyncCredentialsFilter::ShouldSaveGaiaPasswordHash(
@@ -58,17 +57,15 @@
 
 bool SyncCredentialsFilter::IsSyncAccountEmail(
     const std::string& username) const {
-  return sync_util::IsSyncAccountEmail(
-      username, identity_manager_factory_function_.Run());
+  return sync_util::IsSyncAccountEmail(username, client_->GetIdentityManager());
 }
 
 void SyncCredentialsFilter::ReportFormLoginSuccess(
     const PasswordFormManagerInterface& form_manager) const {
   if (!form_manager.IsNewLogin() &&
-      sync_util::IsSyncAccountCredential(
-          form_manager.GetPendingCredentials(),
-          sync_service_factory_function_.Run(),
-          identity_manager_factory_function_.Run())) {
+      sync_util::IsSyncAccountCredential(form_manager.GetPendingCredentials(),
+                                         sync_service_factory_function_.Run(),
+                                         client_->GetIdentityManager())) {
     base::RecordAction(base::UserMetricsAction(
         "PasswordManager_SyncCredentialFilledAndLoginSuccessfull"));
   }
diff --git a/components/password_manager/core/browser/sync_credentials_filter.h b/components/password_manager/core/browser/sync_credentials_filter.h
index dbcac09..ba17e12 100644
--- a/components/password_manager/core/browser/sync_credentials_filter.h
+++ b/components/password_manager/core/browser/sync_credentials_filter.h
@@ -16,10 +16,6 @@
 #include "components/password_manager/core/browser/password_manager_client.h"
 #include "components/sync/driver/sync_service.h"
 
-namespace signin {
-class IdentityManager;
-}
-
 namespace password_manager {
 
 // The sync- and GAIA- aware implementation of the filter.
@@ -27,17 +23,13 @@
  public:
   using SyncServiceFactoryFunction =
       base::RepeatingCallback<const syncer::SyncService*(void)>;
-  using IdentityManagerFactoryFunction =
-      base::RepeatingCallback<const signin::IdentityManager*(void)>;
 
   // Implements protection of sync credentials. Uses |client| to get the last
   // commited entry URL for a check against GAIA reauth site. Uses the factory
-  // functions repeatedly to get the sync service and identity manager to pass
-  // them to sync_util methods.
+  // function repeatedly to get the sync service to pass to sync_util methods.
   SyncCredentialsFilter(
-      const PasswordManagerClient* client,
-      SyncServiceFactoryFunction sync_service_factory_function,
-      IdentityManagerFactoryFunction identity_manager_factory_function);
+      PasswordManagerClient* client,
+      SyncServiceFactoryFunction sync_service_factory_function);
   ~SyncCredentialsFilter() override;
 
   // CredentialsFilter
@@ -51,14 +43,10 @@
   bool IsSyncAccountEmail(const std::string& username) const override;
 
  private:
-  const PasswordManagerClient* const client_;
+  PasswordManagerClient* const client_;
 
   const SyncServiceFactoryFunction sync_service_factory_function_;
 
-  // For incognito profile, |identity_manager_factory_function_| returns the
-  // sign in manager of its original profile.
-  const IdentityManagerFactoryFunction identity_manager_factory_function_;
-
   DISALLOW_COPY_AND_ASSIGN(SyncCredentialsFilter);
 };
 
diff --git a/components/password_manager/core/browser/sync_credentials_filter_unittest.cc b/components/password_manager/core/browser/sync_credentials_filter_unittest.cc
index 3d690061..04bf66b0 100644
--- a/components/password_manager/core/browser/sync_credentials_filter_unittest.cc
+++ b/components/password_manager/core/browser/sync_credentials_filter_unittest.cc
@@ -49,9 +49,8 @@
 
 class FakePasswordManagerClient : public StubPasswordManagerClient {
  public:
-  FakePasswordManagerClient()
-      : password_store_(new testing::NiceMock<MockPasswordStore>),
-        is_incognito_(false) {
+  explicit FakePasswordManagerClient(signin::IdentityManager* identity_manager)
+      : identity_manager_(identity_manager) {
 #if defined(SYNC_PASSWORD_REUSE_DETECTION_ENABLED)
     // Initializes and configures prefs.
     prefs_ = std::make_unique<TestingPrefServiceSimple>();
@@ -74,6 +73,9 @@
   MockPasswordStore* GetPasswordStore() const override {
     return password_store_.get();
   }
+  signin::IdentityManager* GetIdentityManager() override {
+    return identity_manager_;
+  }
 
   void set_last_committed_entry_url(const char* url_spec) {
     last_committed_entry_url_ = GURL(url_spec);
@@ -89,8 +91,10 @@
 
  private:
   GURL last_committed_entry_url_;
-  scoped_refptr<testing::NiceMock<MockPasswordStore>> password_store_;
-  bool is_incognito_;
+  scoped_refptr<testing::NiceMock<MockPasswordStore>> password_store_ =
+      new testing::NiceMock<MockPasswordStore>;
+  bool is_incognito_ = false;
+  signin::IdentityManager* identity_manager_;
 #if defined(SYNC_PASSWORD_REUSE_DETECTION_ENABLED)
   std::unique_ptr<TestingPrefServiceSimple> prefs_;
 #endif  // SYNC_PASSWORD_REUSE_DETECTION_ENABLED
@@ -106,7 +110,8 @@
   enum class LoginState { NEW, EXISTING };
 
   CredentialsFilterTest()
-      : password_manager_(&client_),
+      : client_(identity_manager()),
+        password_manager_(&client_),
         pending_(SimpleGaiaForm("user@gmail.com")),
         form_manager_(&password_manager_,
                       &client_,
@@ -116,8 +121,6 @@
                       &fetcher_),
         filter_(&client_,
                 base::BindRepeating(&SyncUsernameTestBase::sync_service,
-                                    base::Unretained(this)),
-                base::BindRepeating(&SyncUsernameTestBase::identity_manager,
                                     base::Unretained(this))) {
     form_manager_.Init(nullptr);
     fetcher_.Fetch();
diff --git a/components/password_manager/core/browser/sync_username_test_base.h b/components/password_manager/core/browser/sync_username_test_base.h
index 330953d..440b998 100644
--- a/components/password_manager/core/browser/sync_username_test_base.h
+++ b/components/password_manager/core/browser/sync_username_test_base.h
@@ -38,7 +38,7 @@
 
   const syncer::SyncService* sync_service() const { return &sync_service_; }
 
-  const signin::IdentityManager* identity_manager() {
+  signin::IdentityManager* identity_manager() {
     return identity_test_env_.identity_manager();
   }
 
diff --git a/components/password_manager/core/common/password_manager_pref_names.cc b/components/password_manager/core/common/password_manager_pref_names.cc
index 3187504..af2b0a4 100644
--- a/components/password_manager/core/common/password_manager_pref_names.cc
+++ b/components/password_manager/core/common/password_manager_pref_names.cc
@@ -15,7 +15,6 @@
 const char kCredentialsEnableService[] = "credentials_enable_service";
 
 #if !defined(OS_MACOSX) && !defined(OS_CHROMEOS) && defined(OS_POSIX)
-const char kLocalProfileId[] = "profile.local_profile_id";
 const char kMigrationToLoginDBStep[] = "profile.migration_to_logindb_step";
 #endif
 
diff --git a/components/password_manager/core/common/password_manager_pref_names.h b/components/password_manager/core/common/password_manager_pref_names.h
index ff9e02d..2a6f899 100644
--- a/components/password_manager/core/common/password_manager_pref_names.h
+++ b/components/password_manager/core/common/password_manager_pref_names.h
@@ -29,9 +29,6 @@
 extern const char kCredentialsEnableService[];
 
 #if !defined(OS_MACOSX) && !defined(OS_CHROMEOS) && defined(OS_POSIX)
-// The local profile id for this profile.
-extern const char kLocalProfileId[];
-
 // The current state of the migration to LoginDB from Keyring/Kwallet on Linux.
 extern const char kMigrationToLoginDBStep[];
 #endif
diff --git a/components/policy/resources/policy_templates.json b/components/policy/resources/policy_templates.json
index cd994a1..7a5f2dd5 100644
--- a/components/policy/resources/policy_templates.json
+++ b/components/policy/resources/policy_templates.json
@@ -15992,7 +15992,6 @@
         'dynamic_refresh': True,
         'per_profile': False,
       },
-      'future': True,
       'example_value': False,
       'id': 532,
       'caption': '''Allows wilco diagnostics and telemetry controller''',
@@ -16044,7 +16043,6 @@
         'dynamic_refresh': True,
         'per_profile': False,
       },
-      'future': True,
       'example_value': {
         "url": "https://example.com/wilcodtcconfig",
         "hash": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
diff --git a/components/sync/driver/glue/sync_engine_backend.cc b/components/sync/driver/glue/sync_engine_backend.cc
index 2539c36..47514ff0 100644
--- a/components/sync/driver/glue/sync_engine_backend.cc
+++ b/components/sync/driver/glue/sync_engine_backend.cc
@@ -349,7 +349,8 @@
         NIGORI, std::make_unique<ForwardingModelTypeControllerDelegate>(
                     nigori_processor->GetControllerDelegate().get()));
     sync_encryption_handler_ = std::make_unique<NigoriSyncBridgeImpl>(
-        std::move(nigori_processor), &encryptor_);
+        std::move(nigori_processor), &encryptor_,
+        params.restored_key_for_bootstrapping);
   } else {
     sync_encryption_handler_ = std::make_unique<SyncEncryptionHandlerImpl>(
         &user_share_, &encryptor_, params.restored_key_for_bootstrapping,
diff --git a/components/sync/engine_impl/model_type_worker.cc b/components/sync/engine_impl/model_type_worker.cc
index ad4adb08..14fcd0e 100644
--- a/components/sync/engine_impl/model_type_worker.cc
+++ b/components/sync/engine_impl/model_type_worker.cc
@@ -378,8 +378,10 @@
 
 void ModelTypeWorker::PassiveApplyUpdates(StatusController* status) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  // This should only be called at the end of the very first download cycle.
-  DCHECK(!model_type_state_.initial_sync_done())
+  // This should only be called at the end of the very first download cycle,
+  // except for NIGORI, which can be downloaded in multiple configuration sync
+  // cycles and hence repeatedly ends up in PassiveApplyUpdates().
+  DCHECK(type_ == NIGORI || !model_type_state_.initial_sync_done())
       << "PassiveApplyUpdates() called after initial sync has been done for "
       << ModelTypeToString(type_);
   // Indicate to the processor that the initial download is done. The initial
diff --git a/components/sync/engine_impl/sync_manager_impl.cc b/components/sync/engine_impl/sync_manager_impl.cc
index 92108c4..cd300d3 100644
--- a/components/sync/engine_impl/sync_manager_impl.cc
+++ b/components/sync/engine_impl/sync_manager_impl.cc
@@ -243,8 +243,12 @@
   DCHECK(initialized_);
 
   // Don't download non-blocking types that have already completed initial sync.
-  to_download.RemoveAll(
-      model_type_registry_->GetInitialSyncDoneNonBlockingTypes());
+  ModelTypeSet to_remove =
+      model_type_registry_->GetInitialSyncDoneNonBlockingTypes();
+  // NIGORI is the exception, because we may want to download it several times
+  // during configuration (see DataTypeManagerImpl::PrepareConfigureParams()).
+  to_remove.Remove(NIGORI);
+  to_download.RemoveAll(to_remove);
 
   DVLOG(1) << "Configuring -"
            << "\n\t"
diff --git a/components/sync/nigori/nigori_sync_bridge_impl.cc b/components/sync/nigori/nigori_sync_bridge_impl.cc
index ca1fb10e..fe73afed 100644
--- a/components/sync/nigori/nigori_sync_bridge_impl.cc
+++ b/components/sync/nigori/nigori_sync_bridge_impl.cc
@@ -361,13 +361,52 @@
   return encoded_key;
 }
 
+// Unpacks explicit passphrase keys. Returns serialized sync_pb::NigoriKey if
+// successful. If |packed_key| is empty or decoding/decryption errors occur.
+// Should be aligned with Directory implementation (
+// Cryptographer::UnpackBootstrapToken()) unless it is removed.
+std::string UnpackExplicitPassphraseKey(const Encryptor& encryptor,
+                                        const std::string& packed_key) {
+  if (packed_key.empty()) {
+    return std::string();
+  }
+
+  std::string decoded_key;
+  if (!base::Base64Decode(packed_key, &decoded_key)) {
+    DLOG(ERROR) << "Failed to decode explicit passphrase key.";
+    return std::string();
+  }
+
+  std::string decrypted_key;
+  if (!encryptor.DecryptString(decoded_key, &decrypted_key)) {
+    DLOG(ERROR) << "Failed to decrypt expliciti passphrase key.";
+    return std::string();
+  }
+  return decrypted_key;
+}
+
+bool CanDecryptWithSerializedNigoriKey(
+    const std::string& serialized_key,
+    const sync_pb::EncryptedData& encrypted_data) {
+  if (serialized_key.empty()) {
+    return false;
+  }
+  Cryptographer cryptographer;
+  cryptographer.ImportNigoriKey(serialized_key);
+  return cryptographer.CanDecrypt(encrypted_data);
+}
+
 }  // namespace
 
 NigoriSyncBridgeImpl::NigoriSyncBridgeImpl(
     std::unique_ptr<NigoriLocalChangeProcessor> processor,
-    const Encryptor* encryptor)
+    const Encryptor* encryptor,
+    const std::string& packed_explicit_passphrase_key)
     : encryptor_(encryptor),
       processor_(std::move(processor)),
+      serialized_explicit_passphrase_key_(
+          UnpackExplicitPassphraseKey(*encryptor,
+                                      packed_explicit_passphrase_key)),
       passphrase_type_(NigoriSpecifics::UNKNOWN),
       encrypt_everything_(false) {
   DCHECK(encryptor);
@@ -752,9 +791,18 @@
   NOTIMPLEMENTED();
   DCHECK(!encryption_keybag.blob().empty());
   if (!cryptographer_.CanDecrypt(encryption_keybag)) {
-    // This will lead to OnPassphraseRequired() call later.
-    cryptographer_.SetPendingKeys(encryption_keybag);
-    return;
+    // Historically, prior to USS, key derived from explicit passphrase was
+    // stored in prefs and effectively we do migration here.
+    if (CanDecryptWithSerializedNigoriKey(serialized_explicit_passphrase_key_,
+                                          encryption_keybag)) {
+      // ImportNigoriKey() will set default key from
+      // |serialized_explicit_passphrase_key_|.
+      cryptographer_.ImportNigoriKey(serialized_explicit_passphrase_key_);
+    } else {
+      // This will lead to OnPassphraseRequired() call later.
+      cryptographer_.SetPendingKeys(encryption_keybag);
+      return;
+    }
   }
   // |cryptographer_| can already have explicit passphrase, in that case it
   // should be able to decrypt |encryption_keybag|. We need to take keys from
@@ -823,6 +871,12 @@
   return cryptographer_;
 }
 
+std::string NigoriSyncBridgeImpl::PackExplicitPassphraseKeyForTesting(
+    const Encryptor& encryptor,
+    const Cryptographer& cryptographer) {
+  return PackExplicitPassphraseKey(encryptor, cryptographer);
+}
+
 base::Time NigoriSyncBridgeImpl::GetExplicitPassphraseTime() const {
   switch (passphrase_type_) {
     case NigoriSpecifics::IMPLICIT_PASSPHRASE:
diff --git a/components/sync/nigori/nigori_sync_bridge_impl.h b/components/sync/nigori/nigori_sync_bridge_impl.h
index f655a832..64f6113 100644
--- a/components/sync/nigori/nigori_sync_bridge_impl.h
+++ b/components/sync/nigori/nigori_sync_bridge_impl.h
@@ -40,7 +40,8 @@
  public:
   // |encryptor| must be not null and must outlive this object.
   NigoriSyncBridgeImpl(std::unique_ptr<NigoriLocalChangeProcessor> processor,
-                       const Encryptor* encryptor);
+                       const Encryptor* encryptor,
+                       const std::string& packed_explicit_passphrase_key);
   ~NigoriSyncBridgeImpl() override;
 
   // SyncEncryptionHandler implementation.
@@ -74,6 +75,9 @@
   // tests and decide whether this method should be a part of
   // SyncEncryptionHandler interface.
   const Cryptographer& GetCryptographerForTesting() const;
+  static std::string PackExplicitPassphraseKeyForTesting(
+      const Encryptor& encryptor,
+      const Cryptographer& cryptographer);
 
  private:
   base::Optional<ModelError> UpdateLocalState(
@@ -102,6 +106,11 @@
 
   const std::unique_ptr<NigoriLocalChangeProcessor> processor_;
 
+  // Stores serialized sync_pb::NigoriKey derived from explicit passphrase and
+  // loaded from the prefs. Empty if prefs doesn't contain this key or in case
+  // of decryption/decoding errors.
+  const std::string serialized_explicit_passphrase_key_;
+
   // Base64 encoded keystore keys. The last element is the current keystore
   // key. These keys are not a part of Nigori node and are persisted
   // separately. Should be encrypted with OSCrypt before persisting.
diff --git a/components/sync/nigori/nigori_sync_bridge_impl_unittest.cc b/components/sync/nigori/nigori_sync_bridge_impl_unittest.cc
index d38e4a0..fbd03e03 100644
--- a/components/sync/nigori/nigori_sync_bridge_impl_unittest.cc
+++ b/components/sync/nigori/nigori_sync_bridge_impl_unittest.cc
@@ -114,6 +114,88 @@
   return {KeyDerivationParams::CreateForScrypt("some_constant_salt"), key};
 }
 
+std::string PackKeyAsExplicitPassphrase(const KeyParams& key_params,
+                                        const Encryptor& encryptor) {
+  Cryptographer cryptographer;
+  cryptographer.AddKey(key_params);
+  return NigoriSyncBridgeImpl::PackExplicitPassphraseKeyForTesting(
+      encryptor, cryptographer);
+}
+
+// Builds NigoriSpecifics with following fields:
+// 1. encryption_keybag contains all keys derived from |keybag_keys_params|
+// and encrypted with a key derived from |keybag_decryptor_params|.
+// keystore_decryptor_token is always saved in encryption_keybag, even if it
+// is not derived from any params in |keybag_keys_params|.
+// 2. keystore_decryptor_token contains the key derived from
+// |keybag_decryptor_params| and encrypted with a key derived from
+// |keystore_key_params|.
+// 3. passphrase_type is KEYSTORE_PASSHPRASE.
+// 4. Other fields are default.
+sync_pb::NigoriSpecifics BuildKeystoreNigoriSpecifics(
+    const std::vector<KeyParams>& keybag_keys_params,
+    const KeyParams& keystore_decryptor_params,
+    const KeyParams& keystore_key_params) {
+  sync_pb::NigoriSpecifics specifics;
+
+  Cryptographer cryptographer;
+  cryptographer.AddKey(keystore_decryptor_params);
+  for (const KeyParams& key_params : keybag_keys_params) {
+    cryptographer.AddNonDefaultKey(key_params);
+  }
+  EXPECT_TRUE(cryptographer.GetKeys(specifics.mutable_encryption_keybag()));
+
+  std::string serialized_keystore_decryptor =
+      cryptographer.GetDefaultNigoriKeyData();
+  Cryptographer keystore_cryptographer;
+  keystore_cryptographer.AddKey(keystore_key_params);
+  EXPECT_TRUE(keystore_cryptographer.EncryptString(
+      serialized_keystore_decryptor,
+      specifics.mutable_keystore_decryptor_token()));
+
+  specifics.set_passphrase_type(sync_pb::NigoriSpecifics::KEYSTORE_PASSPHRASE);
+  return specifics;
+}
+
+// Builds NigoriSpecifics with following fields:
+// 1. encryption_keybag contains keys derived from |passphrase_key_params|
+// and |*old_key_params| (if |old_key_params| isn't nullopt). Encrypted with
+// key derived from |passphrase_key_params|.
+// 2. custom_passphrase_time is current time.
+// 3. passphrase_type is CUSTOM_PASSPHRASE.
+// 4. encrypt_everything is true.
+// 5. Other fields are default.
+sync_pb::NigoriSpecifics BuildCustomPassphraseNigoriSpecifics(
+    const KeyParams& passphrase_key_params,
+    const base::Optional<KeyParams>& old_key_params = base::nullopt) {
+  sync_pb::NigoriSpecifics specifics;
+
+  Cryptographer cryptographer;
+  cryptographer.AddKey(passphrase_key_params);
+  if (old_key_params) {
+    cryptographer.AddNonDefaultKey(*old_key_params);
+  }
+  EXPECT_TRUE(cryptographer.GetKeys(specifics.mutable_encryption_keybag()));
+
+  specifics.set_custom_passphrase_key_derivation_method(
+      EnumKeyDerivationMethodToProto(
+          passphrase_key_params.derivation_params.method()));
+  if (passphrase_key_params.derivation_params.method() ==
+      KeyDerivationMethod::SCRYPT_8192_8_11) {
+    // Persist the salt used for key derivation in Nigori if we're using
+    // scrypt.
+    std::string encoded_salt;
+    base::Base64Encode(passphrase_key_params.derivation_params.scrypt_salt(),
+                       &encoded_salt);
+    specifics.set_custom_passphrase_key_derivation_salt(encoded_salt);
+  }
+  specifics.set_custom_passphrase_time(TimeToProtoTime(base::Time::Now()));
+  specifics.set_passphrase_type(sync_pb::NigoriSpecifics::CUSTOM_PASSPHRASE);
+  specifics.set_encrypt_everything(true);
+
+  return specifics;
+}
+
 class MockNigoriLocalChangeProcessor : public NigoriLocalChangeProcessor {
  public:
   MockNigoriLocalChangeProcessor() = default;
@@ -153,8 +235,9 @@
     auto processor =
         std::make_unique<testing::NiceMock<MockNigoriLocalChangeProcessor>>();
     processor_ = processor.get();
-    bridge_ = std::make_unique<NigoriSyncBridgeImpl>(std::move(processor),
-                                                     &encryptor_);
+    bridge_ = std::make_unique<NigoriSyncBridgeImpl>(
+        std::move(processor), &encryptor_,
+        /*packed_explicit_passphrase_key=*/std::string());
     bridge_->AddObserver(&observer_);
   }
 
@@ -164,81 +247,6 @@
   MockNigoriLocalChangeProcessor* processor() { return processor_; }
   MockObserver* observer() { return &observer_; }
 
-  // Builds NigoriSpecifics with following fields:
-  // 1. encryption_keybag contains all keys derived from |keybag_keys_params|
-  // and encrypted with a key derived from |keybag_decryptor_params|.
-  // keystore_decryptor_token is always saved in encryption_keybag, even if it
-  // is not derived from any params in |keybag_keys_params|.
-  // 2. keystore_decryptor_token contains the key derived from
-  // |keybag_decryptor_params| and encrypted with a key derived from
-  // |keystore_key_params|.
-  // 3. passphrase_type is KEYSTORE_PASSHPRASE.
-  // 4. Other fields are default.
-  sync_pb::NigoriSpecifics BuildKeystoreNigoriSpecifics(
-      const std::vector<KeyParams>& keybag_keys_params,
-      const KeyParams& keystore_decryptor_params,
-      const KeyParams& keystore_key_params) {
-    sync_pb::NigoriSpecifics specifics;
-
-    Cryptographer cryptographer;
-    cryptographer.AddKey(keystore_decryptor_params);
-    for (const KeyParams& key_params : keybag_keys_params) {
-      cryptographer.AddNonDefaultKey(key_params);
-    }
-    EXPECT_TRUE(cryptographer.GetKeys(specifics.mutable_encryption_keybag()));
-
-    std::string serialized_keystore_decryptor =
-        cryptographer.GetDefaultNigoriKeyData();
-    Cryptographer keystore_cryptographer;
-    keystore_cryptographer.AddKey(keystore_key_params);
-    EXPECT_TRUE(keystore_cryptographer.EncryptString(
-        serialized_keystore_decryptor,
-        specifics.mutable_keystore_decryptor_token()));
-
-    specifics.set_passphrase_type(
-        sync_pb::NigoriSpecifics::KEYSTORE_PASSPHRASE);
-    return specifics;
-  }
-
-  // Builds NigoriSpecifics with following fields:
-  // 1. encryption_keybag contains keys derived from |passphrase_key_params|
-  // and |*old_key_params| (if |old_key_params| isn't nullopt). Encrypted with
-  // key derived from |passphrase_key_params|.
-  // 2. custom_passphrase_time is current time.
-  // 3. passphrase_type is CUSTOM_PASSPHRASE.
-  // 4. encrypt_everything is true.
-  // 5. Other fields are default.
-  sync_pb::NigoriSpecifics BuildCustomPassphraseNigoriSpecifics(
-      const KeyParams& passphrase_key_params,
-      const base::Optional<KeyParams>& old_key_params = base::nullopt) {
-    sync_pb::NigoriSpecifics specifics;
-
-    Cryptographer cryptographer;
-    cryptographer.AddKey(passphrase_key_params);
-    if (old_key_params) {
-      cryptographer.AddNonDefaultKey(*old_key_params);
-    }
-    EXPECT_TRUE(cryptographer.GetKeys(specifics.mutable_encryption_keybag()));
-
-    specifics.set_custom_passphrase_key_derivation_method(
-        EnumKeyDerivationMethodToProto(
-            passphrase_key_params.derivation_params.method()));
-    if (passphrase_key_params.derivation_params.method() ==
-        KeyDerivationMethod::SCRYPT_8192_8_11) {
-      // Persist the salt used for key derivation in Nigori if we're using
-      // scrypt.
-      std::string encoded_salt;
-      base::Base64Encode(passphrase_key_params.derivation_params.scrypt_salt(),
-                         &encoded_salt);
-      specifics.set_custom_passphrase_key_derivation_salt(encoded_salt);
-    }
-    specifics.set_custom_passphrase_time(TimeToProtoTime(base::Time::Now()));
-    specifics.set_passphrase_type(sync_pb::NigoriSpecifics::CUSTOM_PASSPHRASE);
-    specifics.set_encrypt_everything(true);
-
-    return specifics;
-  }
-
  private:
   const FakeEncryptor encryptor_;
   std::unique_ptr<NigoriSyncBridgeImpl> bridge_;
@@ -558,7 +566,7 @@
 TEST_F(NigoriSyncBridgeImplTest, ShouldNotAllowCustomPassphraseChange) {
   EntityData entity_data;
   *entity_data.specifics.mutable_nigori() =
-      BuildCustomPassphraseNigoriSpecifics(Pbkdf2KeyParams("passphrase"), {});
+      BuildCustomPassphraseNigoriSpecifics(Pbkdf2KeyParams("passphrase"));
   ASSERT_TRUE(bridge()->SetKeystoreKeys({"keystore_key"}));
   ASSERT_THAT(bridge()->MergeSyncData(std::move(entity_data)),
               Eq(base::nullopt));
@@ -567,6 +575,36 @@
   bridge()->SetEncryptionPassphrase("new_passphrase");
 }
 
+// Tests that we can use packed explicit passphrase key passed to bridge to
+// decrypt custom passphrase NigoriSpecifics.
+TEST(NigoriSyncBridgeImplTestWithPackedExplicitPassphrase,
+     ShouldDecryptWithExplicitPassphraseFromPrefs) {
+  const KeyParams kKeyParams = Pbkdf2KeyParams("passphrase");
+
+  const FakeEncryptor encryptor;
+  auto processor =
+      std::make_unique<testing::NiceMock<MockNigoriLocalChangeProcessor>>();
+  auto bridge = std::make_unique<NigoriSyncBridgeImpl>(
+      std::move(processor), &encryptor,
+      PackKeyAsExplicitPassphrase(kKeyParams, encryptor));
+  testing::NiceMock<MockObserver> observer;
+  bridge->AddObserver(&observer);
+
+  EntityData entity_data;
+  *entity_data.specifics.mutable_nigori() =
+      BuildCustomPassphraseNigoriSpecifics(kKeyParams);
+  ASSERT_TRUE(bridge->SetKeystoreKeys({"keystore_key"}));
+
+  EXPECT_CALL(observer, OnCryptographerStateChanged(NotNull()));
+  EXPECT_CALL(observer, OnPassphraseRequired(_, _, _)).Times(0);
+  ASSERT_THAT(bridge->MergeSyncData(std::move(entity_data)), Eq(base::nullopt));
+
+  const Cryptographer& cryptographer = bridge->GetCryptographerForTesting();
+  EXPECT_THAT(cryptographer, CanDecryptWith(kKeyParams));
+  EXPECT_THAT(cryptographer, HasDefaultKeyDerivedFrom(kKeyParams));
+  bridge->RemoveObserver(&observer);
+}
+
 }  // namespace
 
 }  // namespace syncer
diff --git a/content/browser/accessibility/ax_platform_node_textrangeprovider_win_browsertest.cc b/content/browser/accessibility/ax_platform_node_textrangeprovider_win_browsertest.cc
index b607aab..6f22d98 100644
--- a/content/browser/accessibility/ax_platform_node_textrangeprovider_win_browsertest.cc
+++ b/content/browser/accessibility/ax_platform_node_textrangeprovider_win_browsertest.cc
@@ -92,21 +92,33 @@
     observer.Wait();
   }
 
+  BrowserAccessibilityManager* GetManager() const {
+    WebContentsImpl* web_contents =
+        static_cast<WebContentsImpl*>(shell()->web_contents());
+    return web_contents->GetRootBrowserAccessibilityManager();
+  }
+
   void GetTextRangeProviderFromTextNode(
-      ComPtr<ITextRangeProvider>& text_range_provider,
-      BrowserAccessibility* target_browser_accessibility) {
-    auto* provider_simple =
-        ToBrowserAccessibilityWin(target_browser_accessibility)->GetCOM();
-    ASSERT_NE(nullptr, provider_simple);
+      const BrowserAccessibility& target_node,
+      ITextRangeProvider** text_range_provider) {
+    BrowserAccessibilityComWin* target_node_com =
+        ToBrowserAccessibilityWin(&target_node)->GetCOM();
+    ASSERT_NE(nullptr, target_node_com);
 
     ComPtr<ITextProvider> text_provider;
-    EXPECT_HRESULT_SUCCEEDED(
-        provider_simple->GetPatternProvider(UIA_TextPatternId, &text_provider));
+    ASSERT_HRESULT_SUCCEEDED(
+        target_node_com->GetPatternProvider(UIA_TextPatternId, &text_provider));
     ASSERT_NE(nullptr, text_provider.Get());
 
-    EXPECT_HRESULT_SUCCEEDED(
-        text_provider->get_DocumentRange(&text_range_provider));
-    ASSERT_NE(nullptr, text_range_provider.Get());
+    ASSERT_HRESULT_SUCCEEDED(
+        text_provider->get_DocumentRange(text_range_provider));
+  }
+
+  void GetDocumentRangeForMarkup(const std::string& html_markup,
+                                 ITextRangeProvider** text_range_provider) {
+    LoadInitialAccessibilityTreeFromHtml(html_markup);
+    GetTextRangeProviderFromTextNode(*GetManager()->GetRoot(),
+                                     text_range_provider);
   }
 
   // Run through ITextRangeProvider::ScrollIntoView top tests. It's assumed that
@@ -338,6 +350,35 @@
     ScrollIntoViewBrowserTestTemplate(expected_role_start, fstart, fstart_arg,
                                       expected_role_end, fend, fend_arg, false);
   }
+
+  void AssertMoveByUnitForMarkup(
+      const TextUnit& unit,
+      const std::string& html_markup,
+      const std::vector<const wchar_t*>& expected_text) {
+    ComPtr<ITextRangeProvider> text_range;
+
+    GetDocumentRangeForMarkup(html_markup, &text_range);
+    ASSERT_NE(nullptr, text_range.Get());
+    text_range->ExpandToEnclosingUnit(unit);
+
+    size_t index = 0;
+    int count_moved = 1;
+    while (count_moved == 1 && index < expected_text.size()) {
+      EXPECT_UIA_TEXTRANGE_EQ(text_range, expected_text[index++]);
+      ASSERT_HRESULT_SUCCEEDED(text_range->Move(unit, 1, &count_moved));
+    }
+    EXPECT_EQ(expected_text.size(), index);
+    EXPECT_EQ(0, count_moved);
+
+    count_moved = -1;
+    index = expected_text.size();
+    while (count_moved == -1 && index > 0) {
+      EXPECT_UIA_TEXTRANGE_EQ(text_range, expected_text[--index]);
+      ASSERT_HRESULT_SUCCEEDED(text_range->Move(unit, -1, &count_moved));
+    }
+    EXPECT_EQ(0, count_moved);
+    EXPECT_EQ(0u, index);
+  }
 };
 
 IN_PROC_BROWSER_TEST_F(AXPlatformNodeTextRangeProviderWinBrowserTest,
@@ -365,7 +406,7 @@
   EXPECT_EQ(0u, node->PlatformChildCount());
 
   ComPtr<ITextRangeProvider> text_range_provider;
-  GetTextRangeProviderFromTextNode(text_range_provider, node);
+  GetTextRangeProviderFromTextNode(*node, &text_range_provider);
   ASSERT_NE(nullptr, text_range_provider.Get());
   EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"AsdfAsdfAsdf");
 
@@ -569,7 +610,7 @@
   EXPECT_EQ(0u, node->PlatformChildCount());
 
   ComPtr<ITextRangeProvider> text_range_provider;
-  GetTextRangeProviderFromTextNode(text_range_provider, node);
+  GetTextRangeProviderFromTextNode(*node, &text_range_provider);
   ASSERT_NE(nullptr, text_range_provider.Get());
   EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"plain 1");
 
@@ -642,7 +683,7 @@
   EXPECT_EQ(0u, node->PlatformChildCount());
 
   ComPtr<ITextRangeProvider> text_range_provider;
-  GetTextRangeProviderFromTextNode(text_range_provider, node);
+  GetTextRangeProviderFromTextNode(*node, &text_range_provider);
   ASSERT_NE(nullptr, text_range_provider.Get());
   EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"plain 1");
 
@@ -795,8 +836,6 @@
       FindNode(ax::mojom::Role::kStaticText, "end");
   ASSERT_NE(nullptr, end_node);
 
-  ComPtr<ITextRangeProvider> text_range_provider;
-
   std::vector<base::string16> paragraphs = {
       L"start",
       L"text with [:before] and [:after]content, then a",
@@ -806,7 +845,8 @@
   };
 
   // FORWARD NAVIGATION
-  GetTextRangeProviderFromTextNode(text_range_provider, start_node);
+  ComPtr<ITextRangeProvider> text_range_provider;
+  GetTextRangeProviderFromTextNode(*start_node, &text_range_provider);
   ASSERT_NE(nullptr, text_range_provider.Get());
   EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"start");
 
@@ -877,7 +917,7 @@
       /*expected_count*/ 1);
 
   // REVERSE NAVIGATION
-  GetTextRangeProviderFromTextNode(text_range_provider, end_node);
+  GetTextRangeProviderFromTextNode(*end_node, &text_range_provider);
   ASSERT_NE(nullptr, text_range_provider.Get());
   EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"end");
 
@@ -973,8 +1013,6 @@
       FindNode(ax::mojom::Role::kStaticText, "end");
   ASSERT_NE(nullptr, end_node);
 
-  ComPtr<ITextRangeProvider> text_range_provider;
-
   std::vector<base::string16> paragraphs = {
       L"start",
       L"some text\n\n\n",
@@ -983,7 +1021,8 @@
   };
 
   // FORWARD NAVIGATION
-  GetTextRangeProviderFromTextNode(text_range_provider, start_node);
+  ComPtr<ITextRangeProvider> text_range_provider;
+  GetTextRangeProviderFromTextNode(*start_node, &text_range_provider);
   ASSERT_NE(nullptr, text_range_provider.Get());
   EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"start");
 
@@ -1019,7 +1058,7 @@
       /*expected_count*/ 1);
 
   // REVERSE NAVIGATION
-  GetTextRangeProviderFromTextNode(text_range_provider, end_node);
+  GetTextRangeProviderFromTextNode(*end_node, &text_range_provider);
   ASSERT_NE(nullptr, text_range_provider.Get());
   EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"end");
 
@@ -1069,7 +1108,7 @@
   EXPECT_EQ(0u, node->PlatformChildCount());
 
   ComPtr<ITextRangeProvider> text_range_provider;
-  GetTextRangeProviderFromTextNode(text_range_provider, node);
+  GetTextRangeProviderFromTextNode(*node, &text_range_provider);
   ASSERT_NE(nullptr, text_range_provider.Get());
   EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"After frame");
 
@@ -1086,12 +1125,12 @@
   EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(text_range_provider,
                                    TextPatternRangeEndpoint_End, TextUnit_Word,
                                    /*count*/ -3,
-                                   /*expected_text*/ L"Text in",
+                                   /*expected_text*/ L"Text in ",
                                    /*expected_count*/ -3);
   EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(text_range_provider,
                                    TextPatternRangeEndpoint_End, TextUnit_Word,
                                    /*count*/ 2,
-                                   /*expected_text*/ L"Text in iframe\nAfter",
+                                   /*expected_text*/ L"Text in iframe\nAfter ",
                                    /*expected_count*/ 2);
   EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(
       text_range_provider, TextPatternRangeEndpoint_End, TextUnit_Line,
@@ -1123,11 +1162,11 @@
 
   EXPECT_UIA_MOVE(text_range_provider, TextUnit_Word,
                   /*count*/ 2,
-                  /*expected_text*/ L"Text",
+                  /*expected_text*/ L"Text ",
                   /*expected_count*/ 2);
   EXPECT_UIA_MOVE(text_range_provider, TextUnit_Word,
                   /*count*/ -1,
-                  /*expected_text*/ L"frame",
+                  /*expected_text*/ L"frame\n",
                   /*expected_count*/ -1);
   EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(
       text_range_provider, TextPatternRangeEndpoint_End, TextUnit_Character,
@@ -1204,7 +1243,7 @@
   EXPECT_EQ(0u, node->PlatformChildCount());
 
   ComPtr<ITextRangeProvider> text_range_provider;
-  GetTextRangeProviderFromTextNode(text_range_provider, node);
+  GetTextRangeProviderFromTextNode(*node, &text_range_provider);
   ASSERT_NE(nullptr, text_range_provider.Get());
   EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"After frame");
 
@@ -1221,12 +1260,12 @@
   EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(text_range_provider,
                                    TextPatternRangeEndpoint_End, TextUnit_Word,
                                    /*count*/ -3,
-                                   /*expected_text*/ L"Text in",
+                                   /*expected_text*/ L"Text in ",
                                    /*expected_count*/ -3);
   EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(text_range_provider,
                                    TextPatternRangeEndpoint_End, TextUnit_Word,
                                    /*count*/ 2,
-                                   /*expected_text*/ L"Text in iframe\nAfter",
+                                   /*expected_text*/ L"Text in iframe\nAfter ",
                                    /*expected_count*/ 2);
   EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(
       text_range_provider, TextPatternRangeEndpoint_End, TextUnit_Line,
@@ -1269,7 +1308,7 @@
   EXPECT_EQ(0u, node->PlatformChildCount());
 
   ComPtr<ITextRangeProvider> text_range_provider;
-  GetTextRangeProviderFromTextNode(text_range_provider, node);
+  GetTextRangeProviderFromTextNode(*node, &text_range_provider);
   ASSERT_NE(nullptr, text_range_provider.Get());
   EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"plain");
 
@@ -1299,4 +1338,28 @@
       text_range_provider->ExpandToEnclosingUnit(TextUnit_Format));
   EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"italic\ntext");
 }
+
+IN_PROC_BROWSER_TEST_F(AXPlatformNodeTextRangeProviderWinBrowserTest,
+                       EntireMarkupSuccessiveMoveByWord) {
+  AssertMoveByUnitForMarkup(TextUnit_Word, "this is a test.",
+                            {L"this ", L"is ", L"a ", L"test."});
+
+  AssertMoveByUnitForMarkup(TextUnit_Word,
+                            "    this    is      a      test.    ",
+                            {L"this ", L"is ", L"a ", L"test."});
+
+  AssertMoveByUnitForMarkup(
+      TextUnit_Word, "It said: to be continued...",
+      {L"It ", L"said: ", L"to ", L"be ", L"continued..."});
+
+  AssertMoveByUnitForMarkup(TextUnit_Word,
+                            "a <a>link with multiple words</a> and text after.",
+                            {L"a ", L"link ", L"with ", L"multiple ", L"words ",
+                             L"and ", L"text ", L"after."});
+
+  // AssertMoveByUnitForMarkup(
+  //     TextUnit_Word, "<ul><li>item one</li><li>item two</li></ul>",
+  //     {L"* ", L"item ", L"one\n", L"* ", L"item ", L"two"});
+}
+
 }  // namespace content
diff --git a/content/browser/accessibility/browser_accessibility_manager_mac.mm b/content/browser/accessibility/browser_accessibility_manager_mac.mm
index cd44745..790b79d 100644
--- a/content/browser/accessibility/browser_accessibility_manager_mac.mm
+++ b/content/browser/accessibility/browser_accessibility_manager_mac.mm
@@ -336,7 +336,7 @@
       // Use native VoiceOver support for live regions.
       base::scoped_nsobject<BrowserAccessibilityCocoa> retained_node(
           [native_node retain]);
-      base::PostDelayedTaskWithTraits(
+      base::PostDelayedTask(
           FROM_HERE, {BrowserThread::UI},
           base::BindOnce(
               [](base::scoped_nsobject<BrowserAccessibilityCocoa> node) {
diff --git a/content/browser/accessibility/browser_accessibility_state_impl.cc b/content/browser/accessibility/browser_accessibility_state_impl.cc
index 73a7642..bb9d5499 100644
--- a/content/browser/accessibility/browser_accessibility_state_impl.cc
+++ b/content/browser/accessibility/browser_accessibility_state_impl.cc
@@ -79,14 +79,15 @@
   // gives us better numbers.
 
   // Some things can be done on another thread safely.
-  base::PostDelayedTaskWithTraits(
-      FROM_HERE, {base::MayBlock(), base::TaskPriority::BEST_EFFORT},
+  base::PostDelayedTask(
+      FROM_HERE,
+      {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
       base::BindOnce(
           &BrowserAccessibilityStateImpl::UpdateHistogramsOnOtherThread, this),
       base::TimeDelta::FromSeconds(ACCESSIBILITY_HISTOGRAM_DELAY_SECS));
 
   // Other things must be done on the UI thread (e.g. to access PrefService).
-  base::PostDelayedTaskWithTraits(
+  base::PostDelayedTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&BrowserAccessibilityStateImpl::UpdateHistogramsOnUIThread,
                      this),
diff --git a/content/browser/accessibility/browser_accessibility_state_impl_mac.mm b/content/browser/accessibility/browser_accessibility_state_impl_mac.mm
index fc61262..7297514 100644
--- a/content/browser/accessibility/browser_accessibility_state_impl_mac.mm
+++ b/content/browser/accessibility/browser_accessibility_state_impl_mac.mm
@@ -52,9 +52,8 @@
 }  // namespace
 
 void BrowserAccessibilityStateImpl::PlatformInitialize() {
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::UI},
-      base::BindOnce(&SetupAccessibilityDisplayOptionsNotifier));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(&SetupAccessibilityDisplayOptionsNotifier));
 }
 
 void BrowserAccessibilityStateImpl::
diff --git a/content/browser/android/background_sync_network_observer_android.cc b/content/browser/android/background_sync_network_observer_android.cc
index 4d91dda..1e2358a4 100644
--- a/content/browser/android/background_sync_network_observer_android.cc
+++ b/content/browser/android/background_sync_network_observer_android.cc
@@ -20,7 +20,7 @@
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   scoped_refptr<BackgroundSyncNetworkObserverAndroid::Observer> observer(
       new BackgroundSyncNetworkObserverAndroid::Observer(callback));
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&BackgroundSyncNetworkObserverAndroid::Observer::Init,
                      observer));
@@ -51,7 +51,7 @@
                                 const JavaParamRef<jobject>& jcaller,
                                 jint new_connection_type) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(callback_, static_cast<network::mojom::ConnectionType>(
                                     new_connection_type)));
diff --git a/content/browser/android/scoped_surface_request_manager.cc b/content/browser/android/scoped_surface_request_manager.cc
index 55d170b..56575514 100644
--- a/content/browser/android/scoped_surface_request_manager.cc
+++ b/content/browser/android/scoped_surface_request_manager.cc
@@ -67,7 +67,7 @@
     gl::ScopedJavaSurface surface) {
   // base::Unretained is safe because the lifetime of this object is tied to
   // the lifetime of the browser process.
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&ScopedSurfaceRequestManager::CompleteRequestOnUiThread,
                      base::Unretained(this), request_token,
diff --git a/content/browser/android/synchronous_compositor_host.cc b/content/browser/android/synchronous_compositor_host.cc
index 3bbc04d..ad84d03 100644
--- a/content/browser/android/synchronous_compositor_host.cc
+++ b/content/browser/android/synchronous_compositor_host.cc
@@ -57,10 +57,9 @@
       scoped_refptr<SynchronousCompositorSyncCallBridge> bridge,
       int process_id) {
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(&CreateOnIOThread, std::move(receiver),
-                       std::move(bridge), process_id));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&CreateOnIOThread, std::move(receiver),
+                                  std::move(bridge), process_id));
   }
 
   static void CreateOnIOThread(
diff --git a/content/browser/android/synchronous_compositor_sync_call_bridge.cc b/content/browser/android/synchronous_compositor_sync_call_bridge.cc
index d5ea161..b837497 100644
--- a/content/browser/android/synchronous_compositor_sync_call_bridge.cc
+++ b/content/browser/android/synchronous_compositor_sync_call_bridge.cc
@@ -56,12 +56,11 @@
   frame_futures_.pop_front();
 
   if (compositor_frame) {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::UI},
-        base::BindOnce(&SynchronousCompositorSyncCallBridge::
-                           ProcessFrameMetadataOnUIThread,
-                       this, metadata_version,
-                       compositor_frame->metadata.Clone()));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(&SynchronousCompositorSyncCallBridge::
+                                      ProcessFrameMetadataOnUIThread,
+                                  this, metadata_version,
+                                  compositor_frame->metadata.Clone()));
     frame_ptr->frame.reset(new viz::CompositorFrame);
     *frame_ptr->frame = std::move(*compositor_frame);
   }
diff --git a/content/browser/back_forward_cache_browsertest.cc b/content/browser/back_forward_cache_browsertest.cc
index 02937342..8591e44 100644
--- a/content/browser/back_forward_cache_browsertest.cc
+++ b/content/browser/back_forward_cache_browsertest.cc
@@ -809,6 +809,25 @@
 
   // The page had an active WebGL context when we navigated away,
   // so it shouldn't have been cached.
+}
+
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
+                       DisableBackforwardCacheForTesting) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  // Disable the BackForwardCache.
+  web_contents()->GetController().back_forward_cache().DisableForTesting();
+
+  // Navigate to a page that would normally be cacheable.
+  NavigateToURL(shell(),
+                embedded_test_server()->GetURL("a.com", "/title1.html"));
+  RenderFrameDeletedObserver delete_rfh_a(current_frame_host());
+
+  // Navigate away.
+  NavigateToURL(shell(),
+                embedded_test_server()->GetURL("b.com", "/title1.html"));
+
+  // The page should be deleted (not cached).
   delete_rfh_a.WaitUntilDeleted();
 }
 
diff --git a/content/browser/background_sync/background_sync_base_browsertest.cc b/content/browser/background_sync/background_sync_base_browsertest.cc
index 1e24d4f..e7761f46 100644
--- a/content/browser/background_sync/background_sync_base_browsertest.cc
+++ b/content/browser/background_sync/background_sync_base_browsertest.cc
@@ -51,7 +51,7 @@
       base::Unretained(this), run_loop.QuitClosure(),
       base::ThreadTaskRunnerHandle::Get(), &is_pending);
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           &BackgroundSyncBaseBrowserTest::RegistrationPendingOnIOThread,
@@ -182,7 +182,7 @@
   StoragePartitionImpl* storage = GetStorage();
   BackgroundSyncContextImpl* sync_context = storage->GetBackgroundSyncContext();
 
-  base::PostTaskWithTraitsAndReply(
+  base::PostTaskAndReply(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           &BackgroundSyncBaseBrowserTest::SetMaxSyncAttemptsOnIOThread,
diff --git a/content/browser/background_sync/background_sync_context_impl.cc b/content/browser/background_sync/background_sync_context_impl.cc
index 5edaf76..caf3b18a 100644
--- a/content/browser/background_sync/background_sync_context_impl.cc
+++ b/content/browser/background_sync/background_sync_context_impl.cc
@@ -25,7 +25,7 @@
 
 BackgroundSyncContextImpl::BackgroundSyncContextImpl()
     : base::RefCountedDeleteOnSequence<BackgroundSyncContextImpl>(
-          base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO})) {}
+          base::CreateSingleThreadTaskRunner({BrowserThread::IO})) {}
 
 BackgroundSyncContextImpl::~BackgroundSyncContextImpl() {
   // The destructor must run on the IO thread because it implicitly accesses
@@ -68,7 +68,7 @@
         devtools_context) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&BackgroundSyncContextImpl::CreateBackgroundSyncManager,
                      this, service_worker_context, devtools_context));
@@ -76,7 +76,7 @@
 
 void BackgroundSyncContextImpl::Shutdown() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&BackgroundSyncContextImpl::ShutdownOnIO, this));
 }
@@ -84,7 +84,7 @@
 void BackgroundSyncContextImpl::CreateOneShotSyncService(
     blink::mojom::OneShotBackgroundSyncServiceRequest request) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           &BackgroundSyncContextImpl::CreateOneShotSyncServiceOnIOThread, this,
@@ -94,7 +94,7 @@
 void BackgroundSyncContextImpl::CreatePeriodicSyncService(
     blink::mojom::PeriodicBackgroundSyncServiceRequest request) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           &BackgroundSyncContextImpl::CreatePeriodicSyncServiceOnIOThread, this,
@@ -146,7 +146,7 @@
     base::OnceCallback<void(base::TimeDelta)> callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  base::PostTaskWithTraitsAndReplyWithResult(
+  base::PostTaskAndReplyWithResult(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           &BackgroundSyncContextImpl::GetSoonestWakeupDeltaOnIOThread, this,
@@ -158,7 +158,7 @@
 void BackgroundSyncContextImpl::RevivePeriodicBackgroundSyncRegistrations(
     url::Origin origin) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&BackgroundSyncContextImpl::
                          RevivePeriodicBackgroundSyncRegistrationsOnIOThread,
@@ -201,7 +201,7 @@
     blink::mojom::BackgroundSyncType sync_type,
     base::OnceClosure done_closure) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           &BackgroundSyncContextImpl::FireBackgroundSyncEventsOnIOThread, this,
@@ -229,8 +229,7 @@
     base::OnceClosure done_closure) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                           std::move(done_closure));
+  base::PostTask(FROM_HERE, {BrowserThread::UI}, std::move(done_closure));
 }
 
 void BackgroundSyncContextImpl::CreateBackgroundSyncManager(
diff --git a/content/browser/background_sync/background_sync_manager.cc b/content/browser/background_sync/background_sync_manager.cc
index eab7111..f2dde2b 100644
--- a/content/browser/background_sync/background_sync_manager.cc
+++ b/content/browser/background_sync/background_sync_manager.cc
@@ -607,7 +607,7 @@
     return;
   }
 
-  base::PostTaskWithTraitsAndReplyWithResult(
+  base::PostTaskAndReplyWithResult(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&GetControllerParameters, service_worker_context_,
                      std::make_unique<BackgroundSyncParameters>(*parameters_)),
@@ -769,7 +769,7 @@
   }
 
   BackgroundSyncType sync_type = GetBackgroundSyncType(options);
-  base::PostTaskWithTraitsAndReplyWithResult(
+  base::PostTaskAndReplyWithResult(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(
           &GetBackgroundSyncPermissionOnUIThread, service_worker_context_,
@@ -815,14 +815,14 @@
       blink::mojom::BackgroundSyncType::ONE_SHOT) {
     bool is_reregistered =
         existing_registration && existing_registration->IsFiring();
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&NotifyOneShotBackgroundSyncRegisteredOnUIThread,
                        service_worker_context_, origin,
                        /* can_fire= */ AreOptionConditionsMet(),
                        is_reregistered));
   } else {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(
             &NotifyPeriodicBackgroundSyncRegisteredOnUIThread,
@@ -872,7 +872,7 @@
           : parameters_->max_sync_attempts);
 
   if (registration.sync_type() == BackgroundSyncType::PERIODIC) {
-    base::PostTaskWithTraitsAndReplyWithResult(
+    base::PostTaskAndReplyWithResult(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(
             &GetNextEventDelay, service_worker_context_, registration,
@@ -1143,7 +1143,7 @@
   }
 
   registration->set_resolved();
-  base::PostTaskWithTraitsAndReplyWithResult(
+  base::PostTaskAndReplyWithResult(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&CreateBackgroundSyncEventKeepAliveOnUIThread,
                      service_worker_context_, std::move(*registration_info)),
@@ -1597,7 +1597,7 @@
           weak_ptr_factory_.GetWeakPtr(), std::move(callback)));
 
   for (const auto* registration : to_revive) {
-    base::PostTaskWithTraitsAndReplyWithResult(
+    base::PostTaskAndReplyWithResult(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(
             &GetNextEventDelay, service_worker_context_, *registration,
@@ -1921,7 +1921,7 @@
   if (registration->sync_type() == BackgroundSyncType::PERIODIC ||
       (!succeeded &&
        registration->num_attempts() < registration->max_attempts())) {
-    base::PostTaskWithTraitsAndReplyWithResult(
+    base::PostTaskAndReplyWithResult(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(
             &GetNextEventDelay, service_worker_context_, *registration,
@@ -2009,14 +2009,14 @@
 
     if (registration_info->sync_type ==
         blink::mojom::BackgroundSyncType::ONE_SHOT) {
-      base::PostTaskWithTraits(
+      base::PostTask(
           FROM_HERE, {BrowserThread::UI},
           base::BindOnce(&NotifyOneShotBackgroundSyncCompletedOnUIThread,
                          service_worker_context_, origin, status_code,
                          registration->num_attempts(),
                          registration->max_attempts()));
     } else {
-      base::PostTaskWithTraits(
+      base::PostTask(
           FROM_HERE, {BrowserThread::UI},
           base::BindOnce(&NotifyPeriodicBackgroundSyncCompletedOnUIThread,
                          service_worker_context_, origin, status_code,
diff --git a/content/browser/background_sync/background_sync_network_observer.cc b/content/browser/background_sync/background_sync_network_observer.cc
index 00c7b463..5de3c35 100644
--- a/content/browser/background_sync/background_sync_network_observer.cc
+++ b/content/browser/background_sync/background_sync_network_observer.cc
@@ -31,7 +31,7 @@
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   DCHECK(connection_changed_callback_);
 
-  base::PostTaskWithTraitsAndReplyWithResult(
+  base::PostTaskAndReplyWithResult(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&GetNetworkConnectionTracker),
       base::BindOnce(
diff --git a/content/browser/background_sync/background_sync_proxy.cc b/content/browser/background_sync/background_sync_proxy.cc
index 2fcd3e3..18952f2 100644
--- a/content/browser/background_sync/background_sync_proxy.cc
+++ b/content/browser/background_sync/background_sync_proxy.cc
@@ -102,16 +102,16 @@
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
   // Schedule Chrome wakeup.
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                           base::BindOnce(&Core::ScheduleBrowserWakeUp,
-                                          ui_core_weak_ptr_, sync_type));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(&Core::ScheduleBrowserWakeUp, ui_core_weak_ptr_,
+                                sync_type));
 }
 
 void BackgroundSyncProxy::SendSuspendedPeriodicSyncOrigins(
     std::set<url::Origin> suspended_origins) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&Core::SendSuspendedPeriodicSyncOrigins, ui_core_weak_ptr_,
                      std::move(suspended_origins)));
diff --git a/content/browser/bad_message.cc b/content/browser/bad_message.cc
index 80136c4..7d89732a 100644
--- a/content/browser/bad_message.cc
+++ b/content/browser/bad_message.cc
@@ -57,9 +57,9 @@
   base::debug::DumpWithoutCrashing();
 
   if (!BrowserThread::CurrentlyOn(BrowserThread::UI)) {
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                             base::BindOnce(&ReceivedBadMessageOnUIThread,
-                                            render_process_id, reason));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(&ReceivedBadMessageOnUIThread,
+                                  render_process_id, reason));
     return;
   }
   ReceivedBadMessageOnUIThread(render_process_id, reason);
diff --git a/content/browser/bad_message.h b/content/browser/bad_message.h
index 8514757..f4df43c 100644
--- a/content/browser/bad_message.h
+++ b/content/browser/bad_message.h
@@ -243,6 +243,7 @@
   RFHI_BEGIN_NAVIGATION_NON_WEBBY_TRANSITION = 215,
   RFH_NO_MATCHING_NAVIGATION_REQUEST_ON_COMMIT = 216,
   AUTH_INVALID_ICON_URL = 217,
+  MDDH_INVALID_STREAM_SELECTION_INFO = 218,
 
   // Please add new elements here. The naming convention is abbreviated class
   // name (e.g. RenderFrameHost becomes RFH) plus a unique description of the
diff --git a/content/browser/blob_storage/blob_registry_wrapper.cc b/content/browser/blob_storage/blob_registry_wrapper.cc
index ad140325..10ec70d 100644
--- a/content/browser/blob_storage/blob_registry_wrapper.cc
+++ b/content/browser/blob_storage/blob_registry_wrapper.cc
@@ -55,11 +55,10 @@
     scoped_refptr<ChromeBlobStorageContext> blob_storage_context,
     scoped_refptr<storage::FileSystemContext> file_system_context) {
   scoped_refptr<BlobRegistryWrapper> result(new BlobRegistryWrapper());
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&BlobRegistryWrapper::InitializeOnIOThread, result,
-                     std::move(blob_storage_context),
-                     std::move(file_system_context)));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&BlobRegistryWrapper::InitializeOnIOThread,
+                                result, std::move(blob_storage_context),
+                                std::move(file_system_context)));
   return result;
 }
 
diff --git a/content/browser/blob_storage/blob_storage_browsertest.cc b/content/browser/blob_storage/blob_storage_browsertest.cc
index dca837e67..a6a76a39e 100644
--- a/content/browser/blob_storage/blob_storage_browsertest.cc
+++ b/content/browser/blob_storage/blob_storage_browsertest.cc
@@ -62,10 +62,9 @@
   }
 
   void SetBlobLimits() {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(&SetBlobLimitsOnIO, GetBlobContext(),
-                       std::cref(limits_)));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&SetBlobLimitsOnIO, GetBlobContext(),
+                                  std::cref(limits_)));
   }
 
   void SimpleTest(const GURL& test_url, bool incognito = false) {
@@ -101,7 +100,7 @@
 
   auto blob_context = GetBlobContext();
   base::RunLoop loop;
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO}, base::BindLambdaForTesting([&]() {
         const storage::BlobMemoryController& memory_controller =
             blob_context->context()->memory_controller();
diff --git a/content/browser/blob_storage/chrome_blob_storage_context.cc b/content/browser/blob_storage/chrome_blob_storage_context.cc
index 805b0e5..16416fd 100644
--- a/content/browser/blob_storage/chrome_blob_storage_context.cc
+++ b/content/browser/blob_storage/chrome_blob_storage_context.cc
@@ -118,8 +118,9 @@
     // If we're not incognito mode, schedule all of our file tasks to enable
     // disk on the storage context.
     if (!context->IsOffTheRecord() && io_thread_valid) {
-      file_task_runner = base::CreateTaskRunnerWithTraits(
-          {base::MayBlock(), base::TaskPriority::USER_VISIBLE,
+      file_task_runner = base::CreateTaskRunner(
+          {base::ThreadPool(), base::MayBlock(),
+           base::TaskPriority::USER_VISIBLE,
            base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN});
       // Removes our old blob directories if they exist.
       BrowserThread::PostBestEffortTask(
@@ -129,7 +130,7 @@
     }
 
     if (io_thread_valid) {
-      base::PostTaskWithTraits(
+      base::PostTask(
           FROM_HERE, {BrowserThread::IO},
           base::BindOnce(&ChromeBlobStorageContext::InitializeOnIOThread, blob,
                          std::move(blob_storage_dir),
@@ -149,7 +150,7 @@
                                         std::move(file_task_runner)));
   // Signal the BlobMemoryController when it's appropriate to calculate its
   // storage limits.
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {content::BrowserThread::IO, base::TaskPriority::BEST_EFFORT},
       base::BindOnce(&storage::BlobMemoryController::CalculateBlobStorageLimits,
                      context_->mutable_memory_controller()->GetWeakPtr()));
@@ -188,7 +189,7 @@
     blink::mojom::BlobURLTokenPtr token) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   network::mojom::URLLoaderFactoryPtr blob_url_loader_factory_ptr;
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           [](scoped_refptr<ChromeBlobStorageContext> context,
@@ -211,7 +212,7 @@
     const GURL& url) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   network::mojom::URLLoaderFactoryPtr blob_url_loader_factory_ptr;
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           [](scoped_refptr<ChromeBlobStorageContext> context,
@@ -233,7 +234,7 @@
     const std::string& uuid) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   blink::mojom::BlobPtr blob_ptr;
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           [](scoped_refptr<ChromeBlobStorageContext> context,
diff --git a/content/browser/browser_associated_interface_unittest.cc b/content/browser/browser_associated_interface_unittest.cc
index 33804af..403dc73 100644
--- a/content/browser/browser_associated_interface_unittest.cc
+++ b/content/browser/browser_associated_interface_unittest.cc
@@ -167,9 +167,8 @@
 TEST_F(BrowserAssociatedInterfaceTest, Basic) {
   TestBrowserThreadBundle browser_threads_;
   mojo::MessagePipe pipe;
-  ProxyRunner proxy(
-      std::move(pipe.handle0), true,
-      base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO}));
+  ProxyRunner proxy(std::move(pipe.handle0), true,
+                    base::CreateSingleThreadTaskRunner({BrowserThread::IO}));
   AddFilterToChannel(new TestDriverMessageFilter, proxy.channel());
 
   TestClientRunner client(std::move(pipe.handle1));
diff --git a/content/browser/browser_child_process_host_impl.cc b/content/browser/browser_child_process_host_impl.cc
index c2aa719..c6293b2 100644
--- a/content/browser/browser_child_process_host_impl.cc
+++ b/content/browser/browser_child_process_host_impl.cc
@@ -187,7 +187,7 @@
   g_child_process_list.Get().remove(this);
 
   if (notify_child_disconnected_) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&NotifyProcessHostDisconnected, data_.Duplicate()));
   }
@@ -417,14 +417,14 @@
   early_exit_watcher_.StopWatching();
 #endif
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&NotifyProcessHostConnected, data_.Duplicate()));
 
   delegate_->OnChannelConnected(peer_pid);
 
   if (IsProcessLaunched()) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&NotifyProcessLaunchedAndConnected, data_.Duplicate()));
   }
@@ -476,7 +476,7 @@
         GetTerminationInfo(true /* known_dead */);
 #if defined(OS_ANDROID)
     delegate_->OnProcessCrashed(info.exit_code);
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&NotifyProcessKilled, data_.Duplicate(), info));
 #else  // OS_ANDROID
@@ -484,7 +484,7 @@
       case base::TERMINATION_STATUS_PROCESS_CRASHED:
       case base::TERMINATION_STATUS_ABNORMAL_TERMINATION: {
         delegate_->OnProcessCrashed(info.exit_code);
-        base::PostTaskWithTraits(
+        base::PostTask(
             FROM_HERE, {BrowserThread::UI},
             base::BindOnce(&NotifyProcessCrashed, data_.Duplicate(), info));
         UMA_HISTOGRAM_ENUMERATION("ChildProcess.Crashed2",
@@ -497,7 +497,7 @@
 #endif
       case base::TERMINATION_STATUS_PROCESS_WAS_KILLED: {
         delegate_->OnProcessCrashed(info.exit_code);
-        base::PostTaskWithTraits(
+        base::PostTask(
             FROM_HERE, {BrowserThread::UI},
             base::BindOnce(&NotifyProcessKilled, data_.Duplicate(), info));
         // Report that this child process was killed.
@@ -641,7 +641,7 @@
   delegate_->OnProcessLaunched();
 
   if (is_channel_connected_) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&NotifyProcessLaunchedAndConnected, data_.Duplicate()));
   }
diff --git a/content/browser/browser_context.cc b/content/browser/browser_context.cc
index 332f2c7..3b6793f5 100644
--- a/content/browser/browser_context.cc
+++ b/content/browser/browser_context.cc
@@ -273,8 +273,7 @@
         main_thread_task_runner_(std::move(main_thread_task_runner)),
         service_manager_connection_(ServiceManagerConnection::Create(
             std::move(request),
-            base::CreateSingleThreadTaskRunnerWithTraits(
-                {BrowserThread::IO}))) {
+            base::CreateSingleThreadTaskRunner({BrowserThread::IO}))) {
     service_manager_connection_->SetDefaultServiceRequestHandler(
         base::BindRepeating(
             &BrowserContextServiceManagerConnectionHolder::OnServiceRequest,
@@ -478,7 +477,7 @@
 
   ChromeBlobStorageContext* blob_context =
       ChromeBlobStorageContext::GetFor(browser_context);
-  base::PostTaskWithTraitsAndReplyWithResult(
+  base::PostTaskAndReplyWithResult(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&ChromeBlobStorageContext::CreateMemoryBackedBlob,
                      base::WrapRefCounted(blob_context), data, length,
@@ -601,7 +600,7 @@
                      base::WrapRefCounted(database_tracker)));
 
   if (BrowserThread::IsThreadInitialized(BrowserThread::IO)) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&SaveSessionStateOnIOThread,
                        static_cast<AppCacheServiceImpl*>(
@@ -678,7 +677,7 @@
 
     scoped_refptr<FileServiceIOThreadState> file_service_io_thread_state =
         base::MakeRefCounted<FileServiceIOThreadState>(
-            base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO}));
+            base::CreateSingleThreadTaskRunner({BrowserThread::IO}));
     connection->AddServiceRequestHandler(
         file::mojom::kServiceName,
         base::BindRepeating(
diff --git a/content/browser/browser_main_loop.cc b/content/browser/browser_main_loop.cc
index 4858db38a..ff21b67 100644
--- a/content/browser/browser_main_loop.cc
+++ b/content/browser/browser_main_loop.cc
@@ -445,8 +445,8 @@
 
   static void RequestHDRStatus() {
     // The request must be sent to the GPU process from the IO thread.
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO},
-                             base::BindOnce(&HDRProxy::RequestOnIOThread));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&HDRProxy::RequestOnIOThread));
   }
 
  private:
@@ -463,8 +463,8 @@
     }
   }
   static void GotResultOnIOThread(bool hdr_enabled) {
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                             base::BindOnce(&HDRProxy::GotResult, hdr_enabled));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(&HDRProxy::GotResult, hdr_enabled));
   }
   static void GotResult(bool hdr_enabled) {
     display::win::ScreenWin::SetHDREnabled(hdr_enabled);
@@ -718,7 +718,7 @@
 
   {
     base::SetRecordActionTaskRunner(
-        base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::UI}));
+        base::CreateSingleThreadTaskRunner({BrowserThread::UI}));
   }
 
   // TODO(boliu): kSingleProcess check is a temporary workaround for
@@ -859,7 +859,7 @@
 
   startup_task_runner_ = std::make_unique<StartupTaskRunner>(
       base::BindOnce(&BrowserStartupComplete),
-      base::CreateSingleThreadTaskRunnerWithTraits(
+      base::CreateSingleThreadTaskRunner(
           {BrowserThread::UI, BrowserTaskType::kBootstrap}));
 #else
   startup_task_runner_ = std::make_unique<StartupTaskRunner>(
@@ -1013,7 +1013,7 @@
   // Teardown may start in PostMainMessageLoopRun, and during teardown we
   // need to be able to perform IO.
   base::ThreadRestrictions::SetIOAllowed(true);
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           base::IgnoreResult(&base::ThreadRestrictions::SetIOAllowed), true));
@@ -1024,7 +1024,7 @@
   // no persistent work is being done after ThreadPoolInstance::Shutdown() in
   // order to move towards atomic shutdown.
   base::ThreadRestrictions::SetWaitAllowed(true);
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           base::IgnoreResult(&base::ThreadRestrictions::SetWaitAllowed), true));
@@ -1213,15 +1213,14 @@
   // BrowserGpuChannelHostFactory below, since that depends on an initialized
   // ShaderCacheFactory.
   InitShaderCacheFactorySingleton(
-      base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO}));
+      base::CreateSingleThreadTaskRunner({BrowserThread::IO}));
 
   // Initialize the FontRenderParams on IO thread. This needs to be initialized
   // before gpu process initialization below.
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(
-          &viz::GpuHostImpl::InitFontRenderParams,
-          gfx::GetFontRenderParams(gfx::FontRenderParamsQuery(), nullptr)));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&viz::GpuHostImpl::InitFontRenderParams,
+                                gfx::GetFontRenderParams(
+                                    gfx::FontRenderParamsQuery(), nullptr)));
 
   bool always_uses_gpu = true;
   bool established_gpu_channel = false;
@@ -1377,7 +1376,7 @@
       !established_gpu_channel && always_uses_gpu) {
     TRACE_EVENT_INSTANT0("gpu", "Post task to launch GPU process",
                          TRACE_EVENT_SCOPE_THREAD);
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(base::IgnoreResult(&GpuProcessHost::Get),
                        GPU_PROCESS_KIND_SANDBOXED, true /* force_create */));
@@ -1548,7 +1547,7 @@
 
   if (base::FeatureList::IsEnabled(features::kAudioServiceLaunchOnStartup)) {
     // Schedule the audio service startup on the main thread.
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE,
         {content::BrowserThread::UI, base::TaskPriority::BEST_EFFORT},
         base::BindOnce([]() {
diff --git a/content/browser/browser_main_loop_unittest.cc b/content/browser/browser_main_loop_unittest.cc
index f3ed33e..baaa3c1 100644
--- a/content/browser/browser_main_loop_unittest.cc
+++ b/content/browser/browser_main_loop_unittest.cc
@@ -72,7 +72,7 @@
   browser_main_loop.CreateThreads();
   EXPECT_GE(base::ThreadPoolInstance::Get()
                 ->GetMaxConcurrentNonBlockedTasksWithTraitsDeprecated(
-                    {base::TaskPriority::USER_VISIBLE}),
+                    {base::ThreadPool(), base::TaskPriority::USER_VISIBLE}),
             base::SysInfo::NumberOfProcessors() - 1);
   browser_main_loop.ShutdownThreadsAndCleanUp();
 }
@@ -94,9 +94,8 @@
   StrickMockTask task;
 
   // No task should run because IO thread has not been initialized yet.
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO}, task.Get());
-  base::CreateTaskRunnerWithTraits({BrowserThread::IO})
-      ->PostTask(FROM_HERE, task.Get());
+  base::PostTask(FROM_HERE, {BrowserThread::IO}, task.Get());
+  base::CreateTaskRunner({BrowserThread::IO})->PostTask(FROM_HERE, task.Get());
 
   content::RunAllPendingInMessageLoop(BrowserThread::IO);
 
diff --git a/content/browser/browser_thread_browsertest.cc b/content/browser/browser_thread_browsertest.cc
index 96fc0e0..f53229fa1 100644
--- a/content/browser/browser_thread_browsertest.cc
+++ b/content/browser/browser_thread_browsertest.cc
@@ -23,11 +23,11 @@
   void SetUp() override {
     // This should fail because the ThreadPool + TaskExecutor weren't created
     // yet.
-    EXPECT_DCHECK_DEATH(base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO},
-                                                 base::DoNothing()));
+    EXPECT_DCHECK_DEATH(
+        base::PostTask(FROM_HERE, {BrowserThread::IO}, base::DoNothing()));
 
     // Obtaining a TaskRunner should also fail.
-    EXPECT_DCHECK_DEATH(base::CreateTaskRunnerWithTraits({BrowserThread::IO}));
+    EXPECT_DCHECK_DEATH(base::CreateTaskRunner({BrowserThread::IO}));
 
     ContentBrowserTest::SetUp();
   }
diff --git a/content/browser/browser_thread_impl.cc b/content/browser/browser_thread_impl.cc
index 41ccdb2..cfd4de7 100644
--- a/content/browser/browser_thread_impl.cc
+++ b/content/browser/browser_thread_impl.cc
@@ -113,7 +113,7 @@
     // if the UI thread is running a MessageLoopForIO.
     if (!base::MessageLoopCurrentForIO::IsSet()) {
       file_descriptor_watcher_.emplace(
-          base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO}));
+          base::CreateSingleThreadTaskRunner({BrowserThread::IO}));
     }
     base::FileDescriptorWatcher::AssertAllowed();
 #endif
@@ -256,7 +256,7 @@
     const base::Location& from_here,
     scoped_refptr<base::TaskRunner> task_runner,
     base::OnceClosure task) {
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {content::BrowserThread::IO, base::TaskPriority::BEST_EFFORT},
       base::BindOnce(base::IgnoreResult(&base::TaskRunner::PostTask),
                      std::move(task_runner), from_here, std::move(task)));
diff --git a/content/browser/browser_thread_impl.h b/content/browser/browser_thread_impl.h
index 43a94f1..71e9c67 100644
--- a/content/browser/browser_thread_impl.h
+++ b/content/browser/browser_thread_impl.h
@@ -46,7 +46,7 @@
   static void ResetGlobalsForTesting(BrowserThread::ID identifier);
 
   // Exposed for BrowserTaskExecutor. Other code should use
-  // base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::UI/IO}).
+  // base::CreateSingleThreadTaskRunner({BrowserThread::UI/IO}).
   using BrowserThread::GetTaskRunnerForThread;
 
  private:
diff --git a/content/browser/browser_thread_unittest.cc b/content/browser/browser_thread_unittest.cc
index b371ffc..60a6dc10 100644
--- a/content/browser/browser_thread_unittest.cc
+++ b/content/browser/browser_thread_unittest.cc
@@ -167,7 +167,7 @@
       : callback_task_runner_(base::ThreadTaskRunnerHandle::Get()),
         callback_(callback),
         ui_task_runner_(
-            base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::UI})),
+            base::CreateSingleThreadTaskRunner({BrowserThread::UI})),
         did_shutdown_(did_shutdown) {
     ui_task_runner_->PostTask(FROM_HERE, base::BindOnce(&Watch, this));
   }
@@ -196,9 +196,9 @@
   bool* did_shutdown_;
 };
 
-TEST_F(BrowserThreadTest, PostTaskWithTraits) {
+TEST_F(BrowserThreadTest, PostTask) {
   base::RunLoop run_loop;
-  EXPECT_TRUE(base::PostTaskWithTraits(
+  EXPECT_TRUE(base::PostTask(
       FROM_HERE, {BrowserThread::IO, NonNestable()},
       base::BindOnce(&BasicFunction, run_loop.QuitWhenIdleClosure(),
                      BrowserThread::IO)));
@@ -222,9 +222,9 @@
   run_loop.Run();
 }
 
-TEST_F(BrowserThreadTest, PostTaskViaTaskRunnerWithTraits) {
+TEST_F(BrowserThreadTest, PostTaskViaTaskRunner) {
   scoped_refptr<base::TaskRunner> task_runner =
-      base::CreateTaskRunnerWithTraits({BrowserThread::IO});
+      base::CreateTaskRunner({BrowserThread::IO});
   base::RunLoop run_loop;
   EXPECT_TRUE(task_runner->PostTask(
       FROM_HERE, base::BindOnce(&BasicFunction, run_loop.QuitWhenIdleClosure(),
@@ -232,9 +232,9 @@
   run_loop.Run();
 }
 
-TEST_F(BrowserThreadTest, PostTaskViaSequencedTaskRunnerWithTraits) {
+TEST_F(BrowserThreadTest, PostTaskViaSequencedTaskRunner) {
   scoped_refptr<base::SequencedTaskRunner> task_runner =
-      base::CreateSequencedTaskRunnerWithTraits({BrowserThread::IO});
+      base::CreateSequencedTaskRunner({BrowserThread::IO});
   base::RunLoop run_loop;
   EXPECT_TRUE(task_runner->PostTask(
       FROM_HERE, base::BindOnce(&BasicFunction, run_loop.QuitWhenIdleClosure(),
@@ -242,9 +242,9 @@
   run_loop.Run();
 }
 
-TEST_F(BrowserThreadTest, PostTaskViaSingleThreadTaskRunnerWithTraits) {
+TEST_F(BrowserThreadTest, PostTaskViaSingleThreadTaskRunner) {
   scoped_refptr<base::SingleThreadTaskRunner> task_runner =
-      base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO});
+      base::CreateSingleThreadTaskRunner({BrowserThread::IO});
   base::RunLoop run_loop;
   EXPECT_TRUE(task_runner->PostTask(
       FROM_HERE, base::BindOnce(&BasicFunction, run_loop.QuitWhenIdleClosure(),
@@ -253,9 +253,9 @@
 }
 
 #if defined(OS_WIN)
-TEST_F(BrowserThreadTest, PostTaskViaCOMSTATaskRunnerWithTraits) {
+TEST_F(BrowserThreadTest, PostTaskViaCOMSTATaskRunner) {
   scoped_refptr<base::SingleThreadTaskRunner> task_runner =
-      base::CreateCOMSTATaskRunnerWithTraits({BrowserThread::UI});
+      base::CreateCOMSTATaskRunner({BrowserThread::UI});
   base::RunLoop run_loop;
   EXPECT_TRUE(task_runner->PostTask(
       FROM_HERE, base::BindOnce(&BasicFunction, run_loop.QuitWhenIdleClosure(),
@@ -264,22 +264,22 @@
 }
 #endif  // defined(OS_WIN)
 
-TEST_F(BrowserThreadTest, ReleaseViaTaskRunnerWithTraits) {
+TEST_F(BrowserThreadTest, ReleaseViaTaskRunner) {
   scoped_refptr<base::SingleThreadTaskRunner> task_runner =
-      base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::UI});
+      base::CreateSingleThreadTaskRunner({BrowserThread::UI});
   base::RunLoop run_loop;
   ExpectRelease(run_loop.QuitWhenIdleClosure());
   task_runner->ReleaseSoon(FROM_HERE, base::WrapRefCounted(this));
   run_loop.Run();
 }
 
-TEST_F(BrowserThreadTest, PostTaskAndReplyWithTraits) {
+TEST_F(BrowserThreadTest, PostTaskAndReply) {
   // Most of the heavy testing for PostTaskAndReply() is done inside the
   // task runner test.  This just makes sure we get piped through at all.
   base::RunLoop run_loop;
-  ASSERT_TRUE(base::PostTaskWithTraitsAndReply(FROM_HERE, {BrowserThread::IO},
-                                               base::DoNothing(),
-                                               run_loop.QuitWhenIdleClosure()));
+  ASSERT_TRUE(base::PostTaskAndReply(FROM_HERE, {BrowserThread::IO},
+                                     base::DoNothing(),
+                                     run_loop.QuitWhenIdleClosure()));
   run_loop.Run();
 }
 
@@ -339,8 +339,8 @@
   StrictMockTask best_effort_task;
   StrictMockTask regular_task;
 
-  auto task_runner = base::CreateTaskRunnerWithTraits(
-      {BrowserThread::UI, base::TaskPriority::HIGHEST});
+  auto task_runner =
+      base::CreateTaskRunner({BrowserThread::UI, base::TaskPriority::HIGHEST});
 
   task_runner->PostTask(FROM_HERE, regular_task.Get());
   BrowserThread::PostBestEffortTask(FROM_HERE, task_runner,
diff --git a/content/browser/browsing_data/browsing_data_remover_impl.cc b/content/browser/browsing_data/browsing_data_remover_impl.cc
index 29bd9847..e9cafd49 100644
--- a/content/browser/browsing_data/browsing_data_remover_impl.cc
+++ b/content/browser/browsing_data/browsing_data_remover_impl.cc
@@ -239,9 +239,9 @@
   // after a delay.
   slow_pending_tasks_closure_.Reset(base::BindRepeating(
       &BrowsingDataRemoverImpl::RecordUnfinishedSubTasks, GetWeakPtr()));
-  base::PostDelayedTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                                  slow_pending_tasks_closure_.callback(),
-                                  kSlowTaskTimeout);
+  base::PostDelayedTask(FROM_HERE, {BrowserThread::UI},
+                        slow_pending_tasks_closure_.callback(),
+                        kSlowTaskTimeout);
 
   RemoveImpl(removal_task.delete_begin, removal_task.delete_end,
              removal_task.remove_mask, removal_task.filter_builder.get(),
@@ -585,7 +585,7 @@
   // Yield to the UI thread before executing the next removal task.
   // TODO(msramek): Consider also adding a backoff if too many tasks
   // are scheduled.
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&BrowsingDataRemoverImpl::RunNextTask, GetWeakPtr()));
 }
diff --git a/content/browser/browsing_data/browsing_data_remover_impl_unittest.cc b/content/browser/browsing_data/browsing_data_remover_impl_unittest.cc
index 481ec0d..dd7bcb0 100644
--- a/content/browser/browsing_data/browsing_data_remover_impl_unittest.cc
+++ b/content/browser/browsing_data/browsing_data_remover_impl_unittest.cc
@@ -182,7 +182,7 @@
     storage_partition_removal_data_.remove_begin = begin;
     storage_partition_removal_data_.remove_end = end;
 
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(
             &StoragePartitionRemovalTestStoragePartition::AsyncRunCallback,
@@ -207,7 +207,7 @@
     storage_partition_removal_data_.cookie_deletion_filter =
         std::move(cookie_deletion_filter);
 
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(
             &StoragePartitionRemovalTestStoragePartition::AsyncRunCallback,
diff --git a/content/browser/browsing_data/clear_site_data_handler_browsertest.cc b/content/browser/browsing_data/clear_site_data_handler_browsertest.cc
index bbe68255..cf1c327 100644
--- a/content/browser/browsing_data/clear_site_data_handler_browsertest.cc
+++ b/content/browser/browsing_data/clear_site_data_handler_browsertest.cc
@@ -263,7 +263,7 @@
     blink::mojom::ServiceWorkerRegistrationOptions options(
         scope_url, blink::mojom::ScriptType::kClassic,
         blink::mojom::ServiceWorkerUpdateViaCache::kImports);
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(
             &ServiceWorkerContextWrapper::RegisterServiceWorker,
@@ -274,7 +274,7 @@
 
     // Wait for its activation.
     base::RunLoop run_loop;
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&ServiceWorkerActivationObserver::SignalActivation,
                        base::Unretained(service_worker_context),
@@ -293,7 +293,7 @@
     std::vector<StorageUsageInfo> service_workers;
     base::RunLoop run_loop;
 
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(
             &ServiceWorkerContextWrapper::GetAllOriginsInfo,
diff --git a/content/browser/browsing_data/same_site_data_remover_impl.cc b/content/browser/browsing_data/same_site_data_remover_impl.cc
index a013638..20fc9b3 100644
--- a/content/browser/browsing_data/same_site_data_remover_impl.cc
+++ b/content/browser/browsing_data/same_site_data_remover_impl.cc
@@ -16,7 +16,9 @@
 #include "content/public/browser/storage_partition.h"
 #include "net/cookies/canonical_cookie.h"
 #include "net/cookies/cookie_monster.h"
+#include "net/cookies/cookie_util.h"
 #include "services/network/public/mojom/cookie_manager.mojom.h"
+#include "url/origin.h"
 
 namespace content {
 
@@ -41,11 +43,24 @@
   }
 }
 
+bool DoesOriginMatchDomain(const std::set<std::string>& same_site_none_domains,
+                           const url::Origin& origin,
+                           storage::SpecialStoragePolicy* policy) {
+  for (const std::string& domain : same_site_none_domains) {
+    if (net::cookie_util::IsDomainMatch(domain, origin.host())) {
+      return true;
+    }
+  }
+  return false;
+}
+
 }  // namespace
 
 SameSiteDataRemoverImpl::SameSiteDataRemoverImpl(
     BrowserContext* browser_context)
-    : browser_context_(browser_context) {
+    : browser_context_(browser_context),
+      storage_partition_(
+          BrowserContext::GetDefaultStoragePartition(browser_context_)) {
   DCHECK(browser_context_);
 }
 
@@ -56,15 +71,34 @@
   return same_site_none_domains_;
 }
 
+void SameSiteDataRemoverImpl::OverrideStoragePartitionForTesting(
+    StoragePartition* storage_partition) {
+  storage_partition_ = storage_partition;
+}
+
 void SameSiteDataRemoverImpl::DeleteSameSiteNoneCookies(
     base::OnceClosure closure) {
   same_site_none_domains_.clear();
-  StoragePartition* storage_partition =
-      BrowserContext::GetDefaultStoragePartition(browser_context_);
-  auto* cookie_manager = storage_partition->GetCookieManagerForBrowserProcess();
+  auto* cookie_manager =
+      storage_partition_->GetCookieManagerForBrowserProcess();
   cookie_manager->GetAllCookies(
       base::BindOnce(&OnGetAllCookies, std::move(closure), cookie_manager,
                      &same_site_none_domains_));
 }
 
+void SameSiteDataRemoverImpl::ClearStoragePartitionData(
+    base::OnceClosure closure) {
+  const uint32_t storage_partition_removal_mask =
+      content::StoragePartition::REMOVE_DATA_MASK_ALL &
+      ~content::StoragePartition::REMOVE_DATA_MASK_COOKIES;
+  const uint32_t quota_storage_removal_mask =
+      StoragePartition::QUOTA_MANAGED_STORAGE_MASK_ALL;
+  // TODO(crbug.com/987177): Figure out how to handle protected storage.
+
+  storage_partition_->ClearData(
+      storage_partition_removal_mask, quota_storage_removal_mask,
+      base::BindRepeating(&DoesOriginMatchDomain, same_site_none_domains_),
+      nullptr, false, base::Time(), base::Time::Max(), std::move(closure));
+}
+
 }  // namespace content
diff --git a/content/browser/browsing_data/same_site_data_remover_impl.h b/content/browser/browsing_data/same_site_data_remover_impl.h
index 030caef..3e05535 100644
--- a/content/browser/browsing_data/same_site_data_remover_impl.h
+++ b/content/browser/browsing_data/same_site_data_remover_impl.h
@@ -32,8 +32,17 @@
   // have been deleted.
   void DeleteSameSiteNoneCookies(base::OnceClosure closure);
 
+  // Clears additional storage for domains that have cookies with SameSite value
+  // NO_RESTRICTION from the StoragePartition. Storage is cleared based on the
+  // domains of the cookies deleted in DeleteSameSiteNoneCookies().
+  void ClearStoragePartitionData(base::OnceClosure closure);
+
+  // For testing purposes only.
+  void OverrideStoragePartitionForTesting(StoragePartition* storage_partition);
+
  private:
   BrowserContext* browser_context_;
+  StoragePartition* storage_partition_;
   std::set<std::string> same_site_none_domains_;
 
   DISALLOW_COPY_AND_ASSIGN(SameSiteDataRemoverImpl);
diff --git a/content/browser/browsing_data/same_site_data_remover_impl_unittest.cc b/content/browser/browsing_data/same_site_data_remover_impl_unittest.cc
index fa22d4c..209e472 100644
--- a/content/browser/browsing_data/same_site_data_remover_impl_unittest.cc
+++ b/content/browser/browsing_data/same_site_data_remover_impl_unittest.cc
@@ -15,9 +15,11 @@
 #include "content/public/browser/storage_partition.h"
 #include "content/public/test/test_browser_context.h"
 #include "content/public/test/test_browser_thread_bundle.h"
+#include "content/public/test/test_storage_partition.h"
 #include "net/cookies/cookie_monster.h"
 #include "net/url_request/url_request_context.h"
 #include "services/network/public/mojom/cookie_manager.mojom.h"
+#include "storage/browser/test/mock_special_storage_policy.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -27,6 +29,42 @@
 
 namespace content {
 
+struct StoragePartitionSameSiteRemovalData {
+  uint32_t removal_mask = 0;
+  uint32_t quota_storage_removal_mask = 0;
+  StoragePartition::OriginMatcherFunction origin_matcher;
+};
+
+class SameSiteRemoverTestStoragePartition : public TestStoragePartition {
+ public:
+  SameSiteRemoverTestStoragePartition() {}
+  ~SameSiteRemoverTestStoragePartition() override {}
+
+  void ClearData(uint32_t removal_mask,
+                 uint32_t quota_storage_removal_mask,
+                 const OriginMatcherFunction& origin_matcher,
+                 network::mojom::CookieDeletionFilterPtr cookie_deletion_filter,
+                 bool perform_storage_cleanup,
+                 const base::Time begin,
+                 const base::Time end,
+                 base::OnceClosure callback) override {
+    storage_partition_removal_data_.removal_mask = removal_mask;
+    storage_partition_removal_data_.quota_storage_removal_mask =
+        quota_storage_removal_mask;
+    storage_partition_removal_data_.origin_matcher = origin_matcher;
+    std::move(callback).Run();
+  }
+
+  const StoragePartitionSameSiteRemovalData& GetStoragePartitionRemovalData() {
+    return storage_partition_removal_data_;
+  }
+
+ private:
+  StoragePartitionSameSiteRemovalData storage_partition_removal_data_;
+
+  DISALLOW_COPY_AND_ASSIGN(SameSiteRemoverTestStoragePartition);
+};
+
 class SameSiteDataRemoverImplTest : public testing::Test {
  public:
   SameSiteDataRemoverImplTest()
@@ -94,6 +132,13 @@
     run_loop.Run();
   }
 
+  void ClearStoragePartitionData() {
+    base::RunLoop run_loop;
+    GetSameSiteDataRemoverImpl()->ClearStoragePartitionData(
+        run_loop.QuitClosure());
+    run_loop.Run();
+  }
+
  private:
   TestBrowserThreadBundle thread_bundle_;
   std::unique_ptr<BrowserContext> browser_context_;
@@ -231,4 +276,42 @@
   ASSERT_EQ(cookies[0].Name(), "TestCookie2");
 }
 
+TEST_F(SameSiteDataRemoverImplTest, TestStoragePartitionDataRemoval) {
+  SameSiteRemoverTestStoragePartition storage_partition;
+  storage_partition.set_cookie_manager_for_browser_process(GetCookieManager());
+  GetSameSiteDataRemoverImpl()->OverrideStoragePartitionForTesting(
+      &storage_partition);
+
+  CreateCookieForTest("TestCookie1", ".google.com",
+                      net::CookieSameSite::NO_RESTRICTION,
+                      net::CookieOptions::SameSiteCookieContext::CROSS_SITE);
+  DeleteSameSiteNoneCookies();
+
+  ClearStoragePartitionData();
+  StoragePartitionSameSiteRemovalData removal_data =
+      storage_partition.GetStoragePartitionRemovalData();
+
+  const uint32_t expected_removal_mask =
+      content::StoragePartition::REMOVE_DATA_MASK_ALL &
+      ~content::StoragePartition::REMOVE_DATA_MASK_COOKIES;
+  EXPECT_EQ(removal_data.removal_mask, expected_removal_mask);
+
+  const uint32_t expected_quota_storage_mask =
+      StoragePartition::QUOTA_MANAGED_STORAGE_MASK_ALL;
+  EXPECT_EQ(removal_data.quota_storage_removal_mask,
+            expected_quota_storage_mask);
+
+  scoped_refptr<MockSpecialStoragePolicy> special_storage_policy =
+      new MockSpecialStoragePolicy;
+  EXPECT_TRUE(removal_data.origin_matcher.Run(
+      url::Origin::Create(GURL("http://www.google.com/test")),
+      special_storage_policy.get()));
+  EXPECT_TRUE(removal_data.origin_matcher.Run(
+      url::Origin::Create(GURL("http://google.com")),
+      special_storage_policy.get()));
+  EXPECT_FALSE(removal_data.origin_matcher.Run(
+      url::Origin::Create(GURL("http://youtube.com")),
+      special_storage_policy.get()));
+}
+
 }  // namespace content
diff --git a/content/browser/byte_stream.h b/content/browser/byte_stream.h
index 6e3719f..1ac82cac 100644
--- a/content/browser/byte_stream.h
+++ b/content/browser/byte_stream.h
@@ -68,8 +68,8 @@
 //      std::unique_ptr<ByteStreamWriter> writer;
 //      std::unique_ptr<ByteStreamReader> reader;
 //      CreateByteStream(
-//          base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO}),
-//          base::CreateSequencedTaskRunnerWithTraits({base::MayBlock, ...}),
+//          base::CreateSingleThreadTaskRunner({BrowserThread::IO}),
+//          base::CreateSequencedTaskRunner({base::MayBlock, ...}),
 //          kStreamBufferSize /* e.g. 10240.  */,
 //          &writer,
 //          &reader);         // Presumed passed to FILE thread for reading.
diff --git a/content/browser/cache_storage/cache_storage_cache_entry_handler.cc b/content/browser/cache_storage/cache_storage_cache_entry_handler.cc
index 120a9325..a1978da4 100644
--- a/content/browser/cache_storage/cache_storage_cache_entry_handler.cc
+++ b/content/browser/cache_storage/cache_storage_cache_entry_handler.cc
@@ -244,8 +244,8 @@
   if (BrowserThread::CurrentlyOn(BrowserThread::IO)) {
     std::move(callback).Run(result);
   } else {
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO},
-                             base::BindOnce(std::move(callback), result));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(std::move(callback), result));
   }
 }
 
@@ -399,12 +399,11 @@
                            disk_cache_index, side_data_disk_cache_index,
                            blob->uuid, MakeRequest(&blob->blob));
   } else {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(&FinalizeBlobOnIOThread, blob_context_,
-                       std::move(blob_entry), disk_cache_index,
-                       side_data_disk_cache_index, blob->uuid,
-                       MakeRequest(&blob->blob)));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&FinalizeBlobOnIOThread, blob_context_,
+                                  std::move(blob_entry), disk_cache_index,
+                                  side_data_disk_cache_index, blob->uuid,
+                                  MakeRequest(&blob->blob)));
   }
 
   return blob;
diff --git a/content/browser/cache_storage/cache_storage_context_impl.cc b/content/browser/cache_storage/cache_storage_context_impl.cc
index 6bfe06f8..6566e0b6 100644
--- a/content/browser/cache_storage/cache_storage_context_impl.cc
+++ b/content/browser/cache_storage/cache_storage_context_impl.cc
@@ -32,9 +32,9 @@
 
 scoped_refptr<base::SequencedTaskRunner> CreateSchedulerTaskRunner() {
   if (!base::FeatureList::IsEnabled(kCacheStorageSequenceFeature))
-    return base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO});
-  return base::CreateSequencedTaskRunnerWithTraits(
-      {base::TaskPriority::USER_VISIBLE});
+    return base::CreateSingleThreadTaskRunner({BrowserThread::IO});
+  return base::CreateSequencedTaskRunner(
+      {base::ThreadPool(), base::TaskPriority::USER_VISIBLE});
 }
 
 }  // namespace
@@ -61,8 +61,9 @@
   special_storage_policy_ = std::move(special_storage_policy);
 
   scoped_refptr<base::SequencedTaskRunner> cache_task_runner =
-      base::CreateSequencedTaskRunnerWithTraits(
-          {base::MayBlock(), base::TaskPriority::USER_VISIBLE,
+      base::CreateSequencedTaskRunner(
+          {base::ThreadPool(), base::MayBlock(),
+           base::TaskPriority::USER_VISIBLE,
            base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN});
 
   task_runner_->PostTask(
@@ -77,7 +78,7 @@
   // running with a different target sequence then the quota client code will
   // get a cross-sequence wrapper that is guaranteed to initialize its internal
   // SequenceBound<> object after the real manager is created.
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&CacheStorageContextImpl::CreateQuotaClientsOnIOThread,
                      base::WrapRefCounted(this),
@@ -129,7 +130,7 @@
     return;
   // We can only get a WeakPtr to the BlobStorageContext on the IO thread.
   // Bounce there first before setting the context on the manager.
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           &CacheStorageContextImpl::GetBlobStorageContextWeakPtrOnIOThread,
diff --git a/content/browser/child_process_security_policy_impl.cc b/content/browser/child_process_security_policy_impl.cc
index 3c18dc77..45467cf 100644
--- a/content/browser/child_process_security_policy_impl.cc
+++ b/content/browser/child_process_security_policy_impl.cc
@@ -555,15 +555,14 @@
   // successfully executed a task on the IO thread. This should ensure that any
   // pending tasks on the IO thread will have completed before we remove the
   // entry.
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(
-          [](ChildProcessSecurityPolicyImpl* policy, int child_id) {
-            DCHECK_CURRENTLY_ON(BrowserThread::IO);
-            base::AutoLock lock(policy->lock_);
-            policy->pending_remove_state_.erase(child_id);
-          },
-          base::Unretained(this), child_id));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(
+                     [](ChildProcessSecurityPolicyImpl* policy, int child_id) {
+                       DCHECK_CURRENTLY_ON(BrowserThread::IO);
+                       base::AutoLock lock(policy->lock_);
+                       policy->pending_remove_state_.erase(child_id);
+                     },
+                     base::Unretained(this), child_id));
 }
 
 void ChildProcessSecurityPolicyImpl::RegisterWebSafeScheme(
diff --git a/content/browser/child_process_security_policy_unittest.cc b/content/browser/child_process_security_policy_unittest.cc
index 4be4b936..7147849 100644
--- a/content/browser/child_process_security_policy_unittest.cc
+++ b/content/browser/child_process_security_policy_unittest.cc
@@ -1143,7 +1143,7 @@
 
   // Post a task that will run on the IO thread before the task that
   // Remove() will post to the IO thread.
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO}, base::BindLambdaForTesting([&]() {
         // Capture state on the IO thread before Remove() is called.
         io_before_remove = p->CanAccessDataForOrigin(kRendererID, url);
@@ -1166,15 +1166,15 @@
   p->Remove(kRendererID);
 
   // Post a task to run after the task Remove() posted on the IO thread.
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO},
-                           base::BindLambdaForTesting([&]() {
-                             io_after_io_task_completed =
-                                 p->CanAccessDataForOrigin(kRendererID, url);
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindLambdaForTesting([&]() {
+                   io_after_io_task_completed =
+                       p->CanAccessDataForOrigin(kRendererID, url);
 
-                             // Tell the UI thread that the task from Remove()
-                             // has completed on the IO thread.
-                             pending_remove_complete_event.Signal();
-                           }));
+                   // Tell the UI thread that the task from Remove()
+                   // has completed on the IO thread.
+                   pending_remove_complete_event.Signal();
+                 }));
 
   // Capture state after Remove() has been called, but before its IO thread
   // task has run. We know the IO thread task hasn't run yet because the
@@ -1198,7 +1198,7 @@
   bool io_after_remove_complete = false;
   base::WaitableEvent after_remove_complete_event;
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO}, base::BindLambdaForTesting([&]() {
         io_after_remove_complete = p->CanAccessDataForOrigin(kRendererID, url);
 
@@ -1267,8 +1267,8 @@
   // Post a task to the IO loop that then posts a task to the UI loop.
   // This should cause the |run_loop| to return after the removal has completed.
   base::RunLoop run_loop;
-  base::PostTaskWithTraitsAndReply(FROM_HERE, {BrowserThread::IO},
-                                   base::DoNothing(), run_loop.QuitClosure());
+  base::PostTaskAndReply(FROM_HERE, {BrowserThread::IO}, base::DoNothing(),
+                         run_loop.QuitClosure());
   run_loop.Run();
 
   // Verify invalid ID is rejected now that Remove() has complted.
@@ -2054,21 +2054,21 @@
 
   // Post a task that will run on the IO thread before the task that
   // Remove() will post to the IO thread.
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::IO}, base::BindLambdaForTesting([&]() {
-        // Capture state on the IO thread before Remove() is called.
-        io_before_remove = p->HasSecurityState(kRendererID);
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindLambdaForTesting([&]() {
+                   // Capture state on the IO thread before Remove() is called.
+                   io_before_remove = p->HasSecurityState(kRendererID);
 
-        // Tell the UI thread we are ready for Remove() to be called.
-        ready_for_remove_event.Signal();
+                   // Tell the UI thread we are ready for Remove() to be called.
+                   ready_for_remove_event.Signal();
 
-        // Wait for Remove() to be called on the UI thread.
-        remove_called_event.Wait();
+                   // Wait for Remove() to be called on the UI thread.
+                   remove_called_event.Wait();
 
-        // Capture state after Remove() is called, but before its task on
-        // the IO thread runs.
-        io_while_io_task_pending = p->HasSecurityState(kRendererID);
-      }));
+                   // Capture state after Remove() is called, but before its
+                   // task on the IO thread runs.
+                   io_while_io_task_pending = p->HasSecurityState(kRendererID);
+                 }));
 
   ready_for_remove_event.Wait();
 
@@ -2077,7 +2077,7 @@
   p->Remove(kRendererID);
 
   // Post a task to run after the task Remove() posted on the IO thread.
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO}, base::BindLambdaForTesting([&]() {
         io_after_io_task_completed = p->HasSecurityState(kRendererID);
 
@@ -2108,14 +2108,14 @@
   bool io_after_remove_complete = false;
   base::WaitableEvent after_remove_complete_event;
 
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::IO}, base::BindLambdaForTesting([&]() {
-        io_after_remove_complete = p->HasSecurityState(kRendererID);
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindLambdaForTesting([&]() {
+                   io_after_remove_complete = p->HasSecurityState(kRendererID);
 
-        // Tell the UI thread that this task has
-        // has completed on the IO thread.
-        after_remove_complete_event.Signal();
-      }));
+                   // Tell the UI thread that this task has
+                   // has completed on the IO thread.
+                   after_remove_complete_event.Signal();
+                 }));
 
   // Wait for the task we just posted to the IO thread to complete.
   after_remove_complete_event.Wait();
diff --git a/content/browser/child_process_task_port_provider_mac_unittest.cc b/content/browser/child_process_task_port_provider_mac_unittest.cc
index 94e48e3..00e10f5 100644
--- a/content/browser/child_process_task_port_provider_mac_unittest.cc
+++ b/content/browser/child_process_task_port_provider_mac_unittest.cc
@@ -186,7 +186,7 @@
   ASSERT_TRUE(base::mac::CreateMachPort(&receive_right, &send_right));
 
   scoped_refptr<base::SequencedTaskRunner> task_runner =
-      base::CreateSequencedTaskRunner({});
+      base::CreateSequencedTaskRunner({base::ThreadPool()});
 
   MockChildProcess child_process;
   EXPECT_CALL(child_process, GetTaskPort(_))
diff --git a/content/browser/compositor/viz_process_transport_factory.cc b/content/browser/compositor/viz_process_transport_factory.cc
index 803d06c..10021391 100644
--- a/content/browser/compositor/viz_process_transport_factory.cc
+++ b/content/browser/compositor/viz_process_transport_factory.cc
@@ -179,11 +179,10 @@
                 std::move(request), std::move(client));
           }
         };
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(connect_on_io_thread,
-                       std::move(frame_sink_manager_request),
-                       frame_sink_manager_client.PassInterface()));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(connect_on_io_thread,
+                                  std::move(frame_sink_manager_request),
+                                  frame_sink_manager_client.PassInterface()));
   } else {
     DCHECK(!viz_compositor_thread_);
 
diff --git a/content/browser/content_index/content_index_context_impl.cc b/content/browser/content_index/content_index_context_impl.cc
index 62a6b799..d6df2d2 100644
--- a/content/browser/content_index/content_index_context_impl.cc
+++ b/content/browser/content_index/content_index_context_impl.cc
@@ -28,12 +28,11 @@
     base::OnceCallback<void(SkBitmap)> icon_callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&ContentIndexDatabase::GetIcon,
-                     content_index_database_.GetWeakPtrForIO(),
-                     service_worker_registration_id, description_id,
-                     std::move(icon_callback)));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&ContentIndexDatabase::GetIcon,
+                                content_index_database_.GetWeakPtrForIO(),
+                                service_worker_registration_id, description_id,
+                                std::move(icon_callback)));
 }
 
 void ContentIndexContextImpl::GetAllEntries(GetAllEntriesCallback callback) {
@@ -42,17 +41,16 @@
   GetAllEntriesCallback wrapped_callback = base::BindOnce(
       [](GetAllEntriesCallback callback, blink::mojom::ContentIndexError error,
          std::vector<ContentIndexEntry> entries) {
-        base::PostTaskWithTraits(
+        base::PostTask(
             FROM_HERE, {BrowserThread::UI},
             base::BindOnce(std::move(callback), error, std::move(entries)));
       },
       std::move(callback));
 
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&ContentIndexDatabase::GetAllEntries,
-                     content_index_database_.GetWeakPtrForIO(),
-                     std::move(wrapped_callback)));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&ContentIndexDatabase::GetAllEntries,
+                                content_index_database_.GetWeakPtrForIO(),
+                                std::move(wrapped_callback)));
 }
 
 void ContentIndexContextImpl::GetEntry(int64_t service_worker_registration_id,
@@ -62,18 +60,16 @@
 
   GetEntryCallback wrapped_callback = base::BindOnce(
       [](GetEntryCallback callback, base::Optional<ContentIndexEntry> entry) {
-        base::PostTaskWithTraits(
-            FROM_HERE, {BrowserThread::UI},
-            base::BindOnce(std::move(callback), std::move(entry)));
+        base::PostTask(FROM_HERE, {BrowserThread::UI},
+                       base::BindOnce(std::move(callback), std::move(entry)));
       },
       std::move(callback));
 
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&ContentIndexDatabase::GetEntry,
-                     content_index_database_.GetWeakPtrForIO(),
-                     service_worker_registration_id, description_id,
-                     std::move(wrapped_callback)));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&ContentIndexDatabase::GetEntry,
+                                content_index_database_.GetWeakPtrForIO(),
+                                service_worker_registration_id, description_id,
+                                std::move(wrapped_callback)));
 }
 
 void ContentIndexContextImpl::OnUserDeletedItem(
@@ -82,7 +78,7 @@
     const std::string& description_id) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&ContentIndexDatabase::DeleteEntry,
                      content_index_database_.GetWeakPtrForIO(),
diff --git a/content/browser/content_index/content_index_database.cc b/content/browser/content_index/content_index_database.cc
index 084ed7d..8071bc91 100644
--- a/content/browser/content_index/content_index_database.cc
+++ b/content/browser/content_index/content_index_database.cc
@@ -175,7 +175,7 @@
 
   std::vector<ContentIndexEntry> entries;
   entries.push_back(std::move(entry));
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&ContentIndexDatabase::NotifyProviderContentAdded,
                      weak_ptr_factory_ui_.GetWeakPtr(), std::move(entries)));
@@ -209,7 +209,7 @@
 
   std::move(callback).Run(blink::mojom::ContentIndexError::NONE);
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&ContentIndexDatabase::NotifyProviderContentDeleted,
                      weak_ptr_factory_ui_.GetWeakPtr(),
@@ -293,7 +293,7 @@
 
   DCHECK_EQ(data.size(), 1u);
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&DeserializeIcon, std::make_unique<std::string>(data[0]),
                      std::move(icon_callback)));
diff --git a/content/browser/content_index/content_index_service_impl.cc b/content/browser/content_index/content_index_service_impl.cc
index 78b8297..10edeba 100644
--- a/content/browser/content_index/content_index_service_impl.cc
+++ b/content/browser/content_index/content_index_service_impl.cc
@@ -42,7 +42,7 @@
   auto* storage_partition = static_cast<StoragePartitionImpl*>(
       render_process_host->GetStoragePartition());
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           &CreateOnIO, std::move(request), origin,
diff --git a/content/browser/cookie_store/cookie_store_context.cc b/content/browser/cookie_store/cookie_store_context.cc
index 09613c4..02d2f9c 100644
--- a/content/browser/cookie_store/cookie_store_context.cc
+++ b/content/browser/cookie_store/cookie_store_context.cc
@@ -15,7 +15,7 @@
 
 CookieStoreContext::CookieStoreContext()
     : base::RefCountedDeleteOnSequence<CookieStoreContext>(
-          base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO})) {}
+          base::CreateSingleThreadTaskRunner({BrowserThread::IO})) {}
 
 CookieStoreContext::~CookieStoreContext() {
   // The destructor must be called on the IO thread, because it runs
@@ -33,7 +33,7 @@
   initialize_called_ = true;
 #endif  // DCHECK_IS_ON()
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           &CookieStoreContext::InitializeOnIOThread, this,
@@ -60,7 +60,7 @@
   network_context->GetCookieManager(
       mojo::MakeRequest(&cookie_manager_ptr_info));
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           &CookieStoreContext::ListenToCookieChangesOnIOThread, this,
@@ -82,10 +82,9 @@
   DCHECK(initialize_called_) << __func__ << " called before Initialize()";
 #endif  // DCHECK_IS_ON()
 
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&CookieStoreContext::CreateServiceOnIOThread, this,
-                     std::move(request), origin));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&CookieStoreContext::CreateServiceOnIOThread,
+                                this, std::move(request), origin));
 }
 
 void CookieStoreContext::InitializeOnIOThread(
diff --git a/content/browser/dom_storage/dom_storage_context_wrapper.cc b/content/browser/dom_storage/dom_storage_context_wrapper.cc
index 599e7dd..ab947e5 100644
--- a/content/browser/dom_storage/dom_storage_context_wrapper.cc
+++ b/content/browser/dom_storage/dom_storage_context_wrapper.cc
@@ -111,15 +111,17 @@
     data_path = profile_path.Append(local_partition_path);
 
   scoped_refptr<base::SequencedTaskRunner> primary_sequence =
-      base::CreateSequencedTaskRunnerWithTraits(
-          {base::MayBlock(), base::TaskPriority::USER_BLOCKING,
+      base::CreateSequencedTaskRunner(
+          {base::ThreadPool(), base::MayBlock(),
+           base::TaskPriority::USER_BLOCKING,
            base::TaskShutdownBehavior::BLOCK_SHUTDOWN});
   scoped_refptr<base::SequencedTaskRunner> commit_sequence =
-      base::CreateSequencedTaskRunnerWithTraits(
-          {base::MayBlock(), base::TaskPriority::BEST_EFFORT,
+      base::CreateSequencedTaskRunner(
+          {base::ThreadPool(), base::MayBlock(),
+           base::TaskPriority::BEST_EFFORT,
            base::TaskShutdownBehavior::BLOCK_SHUTDOWN});
   auto mojo_task_runner =
-      base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO});
+      base::CreateSingleThreadTaskRunner({BrowserThread::IO});
 
   base::FilePath legacy_localstorage_path =
       data_path.empty() ? data_path
diff --git a/content/browser/dom_storage/session_storage_area_impl_unittest.cc b/content/browser/dom_storage/session_storage_area_impl_unittest.cc
index ca5f602..5d2ded49 100644
--- a/content/browser/dom_storage/session_storage_area_impl_unittest.cc
+++ b/content/browser/dom_storage/session_storage_area_impl_unittest.cc
@@ -69,9 +69,9 @@
         test_origin1_(url::Origin::Create(GURL("https://host1.com:1/"))),
         test_origin2_(url::Origin::Create(GURL("https://host2.com:2/"))) {
     auto file_runner =
-        base::CreateSequencedTaskRunnerWithTraits({base::MayBlock()});
+        base::CreateSequencedTaskRunner({base::ThreadPool(), base::MayBlock()});
     CreateStrongBindingOnTaskRunner(
-        base::CreateSequencedTaskRunnerWithTraits({base::MayBlock()}),
+        base::CreateSequencedTaskRunner({base::ThreadPool(), base::MayBlock()}),
         &leveldb_service_,
         std::make_unique<leveldb::LevelDBServiceImpl>(std::move(file_runner)));
 
diff --git a/content/browser/dom_storage/session_storage_namespace_impl.cc b/content/browser/dom_storage/session_storage_namespace_impl.cc
index 12ed30e6..54487ba 100644
--- a/content/browser/dom_storage/session_storage_namespace_impl.cc
+++ b/content/browser/dom_storage/session_storage_namespace_impl.cc
@@ -114,8 +114,8 @@
   if (!BrowserThread::CurrentlyOn(BrowserThread::UI)) {
     // If this fails to post then that's fine, as the mojo state should
     // already be destructed.
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                             deleteNamespaceRunner.Release());
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   deleteNamespaceRunner.Release());
   }
 }
 
diff --git a/content/browser/download/download_browsertest.cc b/content/browser/download/download_browsertest.cc
index 3c99573..64c1c6d 100644
--- a/content/browser/download/download_browsertest.cc
+++ b/content/browser/download/download_browsertest.cc
@@ -1517,15 +1517,13 @@
   // a chance to get the second stall onto the IO thread queue after the cancel
   // message created by Shutdown and before the notification callback
   // created by the IO thread in canceling the request.
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&base::PlatformThread::Sleep,
-                     base::TimeDelta::FromMilliseconds(25)));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&base::PlatformThread::Sleep,
+                                base::TimeDelta::FromMilliseconds(25)));
   DownloadManagerForShell(shell())->Shutdown();
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&base::PlatformThread::Sleep,
-                     base::TimeDelta::FromMilliseconds(25)));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&base::PlatformThread::Sleep,
+                                base::TimeDelta::FromMilliseconds(25)));
 }
 
 // Try to shutdown just after we release the download file, by delaying
diff --git a/content/browser/download/download_manager_impl.cc b/content/browser/download/download_manager_impl.cc
index 9bed8bbb..58d870d 100644
--- a/content/browser/download/download_manager_impl.cc
+++ b/content/browser/download/download_manager_impl.cc
@@ -139,7 +139,7 @@
   failed_created_info->url_chain.push_back(params->url());
   failed_created_info->result = reason;
   std::unique_ptr<ByteStreamReader> empty_byte_stream;
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(
           &DownloadManager::StartDownload, download_manager,
@@ -301,7 +301,7 @@
       interrupted_download_cleared_from_history_(0) {
   DCHECK(browser_context);
   download::SetIOTaskRunner(
-      base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO}));
+      base::CreateSingleThreadTaskRunner({BrowserThread::IO}));
 
   if (!in_progress_manager_) {
     in_progress_manager_ =
diff --git a/content/browser/download/drag_download_file.cc b/content/browser/download/drag_download_file.cc
index 20084144..18e264e 100644
--- a/content/browser/download/drag_download_file.cc
+++ b/content/browser/download/drag_download_file.cc
@@ -214,7 +214,7 @@
   // the UI thread so that it calls RemoveObserver on the right thread, and so
   // that this task will run after the InitiateDownload task runs on the UI
   // thread.
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&DragDownloadFileUI::Delete, base::Unretained(drag_ui_)));
   drag_ui_ = nullptr;
@@ -231,7 +231,7 @@
   observer_ = observer;
   DCHECK(observer_.get());
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&DragDownloadFileUI::InitiateDownload,
                      base::Unretained(drag_ui_), std::move(file_), file_path_));
@@ -247,9 +247,9 @@
 void DragDownloadFile::Stop() {
   CheckThread();
   if (drag_ui_) {
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                             base::BindOnce(&DragDownloadFileUI::Cancel,
-                                            base::Unretained(drag_ui_)));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(&DragDownloadFileUI::Cancel,
+                                  base::Unretained(drag_ui_)));
   }
 }
 
diff --git a/content/browser/download/drag_download_file_browsertest.cc b/content/browser/download/drag_download_file_browsertest.cc
index 6fbae09..77529099 100644
--- a/content/browser/download/drag_download_file_browsertest.cc
+++ b/content/browser/download/drag_download_file_browsertest.cc
@@ -54,9 +54,8 @@
   ~DragDownloadFileTest() override {}
 
   void Succeed() {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::UI},
-        base::RunLoop::QuitCurrentWhenIdleClosureDeprecated());
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::RunLoop::QuitCurrentWhenIdleClosureDeprecated());
   }
 
   void FailFast() {
diff --git a/content/browser/download/drag_download_util.cc b/content/browser/download/drag_download_util.cc
index ab829be..2be6a091 100644
--- a/content/browser/download/drag_download_util.cc
+++ b/content/browser/download/drag_download_util.cc
@@ -98,15 +98,13 @@
 
 void PromiseFileFinalizer::OnDownloadCompleted(
     const base::FilePath& file_path) {
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::UI},
-      base::BindOnce(&PromiseFileFinalizer::Cleanup, this));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(&PromiseFileFinalizer::Cleanup, this));
 }
 
 void PromiseFileFinalizer::OnDownloadAborted() {
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::UI},
-      base::BindOnce(&PromiseFileFinalizer::Cleanup, this));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(&PromiseFileFinalizer::Cleanup, this));
 }
 
 PromiseFileFinalizer::~PromiseFileFinalizer() {}
diff --git a/content/browser/download/mhtml_generation_browsertest.cc b/content/browser/download/mhtml_generation_browsertest.cc
index 7c3693b..39f3462 100644
--- a/content/browser/download/mhtml_generation_browsertest.cc
+++ b/content/browser/download/mhtml_generation_browsertest.cc
@@ -247,7 +247,7 @@
   }
 
   void TaskY() {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&RespondAndDisconnectMockWriter::TaskZ,
                        scoped_refptr<RespondAndDisconnectMockWriter>(this)));
@@ -801,8 +801,8 @@
   // Posts the quit closure to the UI thread to unblock the serialization Job
   // after receiving the first task complete notification.
   void PostClosure() {
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                             std::move(first_run_loop_closure_));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   std::move(first_run_loop_closure_));
   }
 
   base::OnceClosure first_run_loop_closure_;
diff --git a/content/browser/download/mhtml_generation_manager.cc b/content/browser/download/mhtml_generation_manager.cc
index ba2eb1bc5..7d2c613 100644
--- a/content/browser/download/mhtml_generation_manager.cc
+++ b/content/browser/download/mhtml_generation_manager.cc
@@ -457,8 +457,8 @@
   DCHECK(download::GetDownloadTaskRunner()->RunsTasksInCurrentSequence());
 
   watcher_.reset();
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                           base::BindOnce(std::move(callback), save_status));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(std::move(callback), save_status));
 }
 
 void MHTMLGenerationManager::Job::DoneWritingToDisk(
diff --git a/content/browser/download/save_file_manager.cc b/content/browser/download/save_file_manager.cc
index fa5bc07..d468089b 100644
--- a/content/browser/download/save_file_manager.cc
+++ b/content/browser/download/save_file_manager.cc
@@ -376,9 +376,9 @@
   DCHECK(!LookupSaveFile(save_file->save_item_id()));
   save_file_map_[save_file->save_item_id()] = std::move(save_file);
 
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                           base::BindOnce(&SaveFileManager::OnStartSave, this,
-                                          save_file_create_info));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(&SaveFileManager::OnStartSave, this,
+                                save_file_create_info));
 }
 
 // We do forward an update to the UI thread here, since we do not use timer to
@@ -394,7 +394,7 @@
 
     download::DownloadInterruptReason reason =
         save_file->AppendDataToFile(data.data(), data.size());
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&SaveFileManager::OnUpdateSaveProgress, this,
                        save_file->save_item_id(), save_file->BytesSoFar(),
@@ -425,10 +425,9 @@
     save_file->Detach();
   }
 
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::UI},
-      base::BindOnce(&SaveFileManager::OnSaveFinished, this, save_item_id,
-                     bytes_so_far, is_success));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(&SaveFileManager::OnSaveFinished, this,
+                                save_item_id, bytes_so_far, is_success));
 }
 
 // Notifications sent from the file thread and run on the UI thread.
@@ -488,7 +487,7 @@
       base::DeleteFile(save_file->FullPath(), false);
     } else if (save_file->save_source() ==
                SaveFileCreateInfo::SAVE_FILE_FROM_NET) {
-      base::PostTaskWithTraits(
+      base::PostTask(
           FROM_HERE, {BrowserThread::UI},
           base::BindOnce(&SaveFileManager::ClearURLLoader, this, save_item_id));
     }
@@ -537,11 +536,10 @@
     }
   }
 
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::UI},
-      base::BindOnce(&SaveFileManager::OnFinishSavePageJob, this,
-                     render_process_id, render_frame_routing_id,
-                     save_package_id));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(&SaveFileManager::OnFinishSavePageJob, this,
+                                render_process_id, render_frame_routing_id,
+                                save_package_id));
 }
 
 void SaveFileManager::OnFinishSavePageJob(int render_process_id,
diff --git a/content/browser/download/web_ui_download_url_loader_factory_getter.cc b/content/browser/download/web_ui_download_url_loader_factory_getter.cc
index cbf07e8..a4419bc 100644
--- a/content/browser/download/web_ui_download_url_loader_factory_getter.cc
+++ b/content/browser/download/web_ui_download_url_loader_factory_getter.cc
@@ -22,7 +22,7 @@
 }
 
 WebUIDownloadURLLoaderFactoryGetter::~WebUIDownloadURLLoaderFactoryGetter() {
-  base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::UI})
+  base::CreateSingleThreadTaskRunner({BrowserThread::UI})
       ->DeleteSoon(FROM_HERE, std::move(factory_));
 }
 
diff --git a/content/browser/file_url_loader_factory.cc b/content/browser/file_url_loader_factory.cc
index 3eb1a4e..6ebe53f 100644
--- a/content/browser/file_url_loader_factory.cc
+++ b/content/browser/file_url_loader_factory.cc
@@ -741,7 +741,7 @@
       shared_cors_origin_access_list_(
           std::move(shared_cors_origin_access_list)),
       task_runner_(base::CreateSequencedTaskRunner(
-          {base::MayBlock(), task_priority,
+          {base::ThreadPool(), base::MayBlock(), task_priority,
            base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN})) {}
 
 FileURLLoaderFactory::~FileURLLoaderFactory() = default;
@@ -859,8 +859,8 @@
   // TODO(crbug.com/924416): Re-evaluate how TaskPriority is set here and in
   // other file URL-loading-related code. Some callers require USER_VISIBLE
   // (i.e., BEST_EFFORT is not enough).
-  auto task_runner = base::CreateSequencedTaskRunnerWithTraits(
-      {base::MayBlock(), base::TaskPriority::USER_VISIBLE,
+  auto task_runner = base::CreateSequencedTaskRunner(
+      {base::ThreadPool(), base::MayBlock(), base::TaskPriority::USER_VISIBLE,
        base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN});
   task_runner->PostTask(
       FROM_HERE,
diff --git a/content/browser/fileapi/browser_file_system_helper.cc b/content/browser/fileapi/browser_file_system_helper.cc
index 35f48de..2e90937 100644
--- a/content/browser/fileapi/browser_file_system_helper.cc
+++ b/content/browser/fileapi/browser_file_system_helper.cc
@@ -107,7 +107,7 @@
   base::FilePath platform_path;
   context->operation_runner()->SyncGetPlatformPath(url, &platform_path);
 
-  base::PostTaskWithTraitsAndReply(
+  base::PostTaskAndReply(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&GrantReadAccessOnUIThread, process_id, platform_path),
       base::BindOnce(std::move(callback), platform_path));
@@ -135,8 +135,7 @@
 
   scoped_refptr<storage::FileSystemContext> file_system_context =
       new storage::FileSystemContext(
-          base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO})
-              .get(),
+          base::CreateSingleThreadTaskRunner({BrowserThread::IO}).get(),
           g_fileapi_task_runner.Get().get(),
           BrowserContext::GetMountPoints(browser_context),
           browser_context->GetSpecialStoragePolicy(), quota_manager_proxy,
@@ -179,7 +178,7 @@
   // Make sure if this file is ok to be read (in the current architecture
   // which means roughly same as the renderer is allowed to get the platform
   // path to the file).
-  base::PostTaskWithTraitsAndReplyWithResult(
+  base::PostTaskAndReplyWithResult(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&CheckCanReadFileSystemFileOnUIThread, process_id, url),
       base::BindOnce(&GetPlatformPathOnFileThread,
diff --git a/content/browser/fileapi/file_system_browsertest.cc b/content/browser/fileapi/file_system_browsertest.cc
index d748fd7..74d2dff 100644
--- a/content/browser/fileapi/file_system_browsertest.cc
+++ b/content/browser/fileapi/file_system_browsertest.cc
@@ -83,7 +83,7 @@
 
   static void SetLowQuota(scoped_refptr<QuotaManager> qm) {
     if (!BrowserThread::CurrentlyOn(BrowserThread::IO)) {
-      base::PostTaskWithTraits(
+      base::PostTask(
           FROM_HERE, {BrowserThread::IO},
           base::BindOnce(&FileSystemBrowserTestWithLowQuota::SetLowQuota, qm));
       return;
diff --git a/content/browser/fileapi/file_system_manager_impl.cc b/content/browser/fileapi/file_system_manager_impl.cc
index 8bee5e2..cf7ab36 100644
--- a/content/browser/fileapi/file_system_manager_impl.cc
+++ b/content/browser/fileapi/file_system_manager_impl.cc
@@ -788,7 +788,7 @@
           [](base::WeakPtr<FileSystemManagerImpl> file_system_manager,
              GetPlatformPathCallback callback,
              const base::FilePath& platform_path) {
-            base::PostTaskWithTraits(
+            base::PostTask(
                 FROM_HERE, {BrowserThread::IO},
                 base::BindOnce(&FileSystemManagerImpl::DidGetPlatformPath,
                                std::move(file_system_manager),
diff --git a/content/browser/fileapi/file_system_operation_runner_unittest.cc b/content/browser/fileapi/file_system_operation_runner_unittest.cc
index 10bcc0be..e32aafb 100644
--- a/content/browser/fileapi/file_system_operation_runner_unittest.cc
+++ b/content/browser/fileapi/file_system_operation_runner_unittest.cc
@@ -192,7 +192,8 @@
     base::FilePath base_dir = base_.GetPath();
     file_system_context_ = new FileSystemContext(
         base::ThreadTaskRunnerHandle::Get().get(),
-        base::CreateSequencedTaskRunnerWithTraits({base::MayBlock()}).get(),
+        base::CreateSequencedTaskRunner({base::ThreadPool(), base::MayBlock()})
+            .get(),
         storage::ExternalMountPoints::CreateRefCounted().get(),
         base::MakeRefCounted<MockSpecialStoragePolicy>().get(), nullptr,
         std::vector<std::unique_ptr<storage::FileSystemBackend>>(),
diff --git a/content/browser/fileapi/file_system_url_loader_factory.cc b/content/browser/fileapi/file_system_url_loader_factory.cc
index 38b7ec8d..47cf257 100644
--- a/content/browser/fileapi/file_system_url_loader_factory.cc
+++ b/content/browser/fileapi/file_system_url_loader_factory.cc
@@ -656,7 +656,7 @@
                           file_system_context, storage_domain};
   return std::make_unique<FileSystemURLLoaderFactory>(
       std::move(params),
-      base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO}));
+      base::CreateSingleThreadTaskRunner({BrowserThread::IO}));
 }
 
 }  // namespace content
diff --git a/content/browser/fileapi/file_system_url_loader_factory_browsertest.cc b/content/browser/fileapi/file_system_url_loader_factory_browsertest.cc
index cc7d53e..5ab183bb 100644
--- a/content/browser/fileapi/file_system_url_loader_factory_browsertest.cc
+++ b/content/browser/fileapi/file_system_url_loader_factory_browsertest.cc
@@ -179,10 +179,9 @@
   bool IsIncognito() { return GetParam() == TestMode::kIncognito; }
 
   void SetUpOnMainThread() override {
-    io_task_runner_ =
-        base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO});
+    io_task_runner_ = base::CreateSingleThreadTaskRunner({BrowserThread::IO});
     blocking_task_runner_ =
-        base::CreateSequencedTaskRunnerWithTraits({base::MayBlock()});
+        base::CreateSequencedTaskRunner({base::ThreadPool(), base::MayBlock()});
 
     special_storage_policy_ = new MockSpecialStoragePolicy;
 
diff --git a/content/browser/font_unique_name_lookup/font_unique_name_lookup.cc b/content/browser/font_unique_name_lookup/font_unique_name_lookup.cc
index db75f376..4c628eb 100644
--- a/content/browser/font_unique_name_lookup/font_unique_name_lookup.cc
+++ b/content/browser/font_unique_name_lookup/font_unique_name_lookup.cc
@@ -348,38 +348,35 @@
 }
 
 void FontUniqueNameLookup::ScheduleLoadOrUpdateTable() {
-  base::PostTaskWithTraits(FROM_HERE,
-                           {base::MayBlock(), base::TaskPriority::BEST_EFFORT,
-                            base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
-                           base::BindOnce(
-                               [](FontUniqueNameLookup* instance) {
-                                 // Error from LoadFromFile() is ignored:
-                                 // Loading the cache file could be recovered
-                                 // from by rebuilding the font table.
-                                 // UpdateTableIfNeeded() checks whether the
-                                 // internal base::MappedReadOnlyRegion has a
-                                 // size, which it doesn't if the LoadFromFile()
-                                 // failed. If it doesn't have a size, the table
-                                 // is rebuild by calling UpdateTable().
-                                 base::TimeTicks prepare_table_start_time =
-                                     base::TimeTicks::Now();
-                                 bool loaded_from_file =
-                                     instance->LoadFromFile();
-                                 if (loaded_from_file) {
-                                   LogUMALookupTableLoadFromFileDuration(
-                                       base::TimeTicks::Now() -
-                                       prepare_table_start_time);
-                                 }
-                                 if (instance->UpdateTableIfNeeded()) {
-                                   instance->PersistToFile();
-                                 }
-                                 LogUMALookupTableReadyDuration(
-                                     base::TimeTicks::Now() -
-                                     prepare_table_start_time);
-                                 instance->proto_storage_ready_.Signal();
-                                 instance->PostCallbacks();
-                               },
-                               base::Unretained(this)));
+  base::PostTask(
+      FROM_HERE,
+      {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT,
+       base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
+      base::BindOnce(
+          [](FontUniqueNameLookup* instance) {
+            // Error from LoadFromFile() is ignored:
+            // Loading the cache file could be recovered
+            // from by rebuilding the font table.
+            // UpdateTableIfNeeded() checks whether the
+            // internal base::MappedReadOnlyRegion has a
+            // size, which it doesn't if the LoadFromFile()
+            // failed. If it doesn't have a size, the table
+            // is rebuild by calling UpdateTable().
+            base::TimeTicks prepare_table_start_time = base::TimeTicks::Now();
+            bool loaded_from_file = instance->LoadFromFile();
+            if (loaded_from_file) {
+              LogUMALookupTableLoadFromFileDuration(base::TimeTicks::Now() -
+                                                    prepare_table_start_time);
+            }
+            if (instance->UpdateTableIfNeeded()) {
+              instance->PersistToFile();
+            }
+            LogUMALookupTableReadyDuration(base::TimeTicks::Now() -
+                                           prepare_table_start_time);
+            instance->proto_storage_ready_.Signal();
+            instance->PostCallbacks();
+          },
+          base::Unretained(this)));
 }
 
 base::FilePath FontUniqueNameLookup::TableCacheFilePath() {
diff --git a/content/browser/font_unique_name_lookup/font_unique_name_lookup_service.cc b/content/browser/font_unique_name_lookup/font_unique_name_lookup_service.cc
index be58b95..55fbde1 100644
--- a/content/browser/font_unique_name_lookup/font_unique_name_lookup_service.cc
+++ b/content/browser/font_unique_name_lookup/font_unique_name_lookup_service.cc
@@ -35,8 +35,9 @@
 scoped_refptr<base::SequencedTaskRunner>
 FontUniqueNameLookupService::GetTaskRunner() {
   static base::NoDestructor<scoped_refptr<base::SequencedTaskRunner>> runner(
-      base::CreateSequencedTaskRunnerWithTraits(
-          {base::MayBlock(), base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN,
+      base::CreateSequencedTaskRunner(
+          {base::ThreadPool(), base::MayBlock(),
+           base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN,
            base::TaskPriority::USER_BLOCKING}));
   return *runner;
 }
diff --git a/content/browser/frame_host/back_forward_cache.cc b/content/browser/frame_host/back_forward_cache.cc
index 26435128..e69e57e 100644
--- a/content/browser/frame_host/back_forward_cache.cc
+++ b/content/browser/frame_host/back_forward_cache.cc
@@ -93,7 +93,7 @@
   if (rfh->GetParent())
     return false;
 
-  if (!IsBackForwardCacheEnabled())
+  if (!IsBackForwardCacheEnabled() || is_disabled_for_testing_)
     return false;
 
   // Note that we check is_loading on the rfh directly, rather than calling
@@ -174,9 +174,17 @@
   return rfh;
 }
 
-// Remove all entries from the BackForwardCache.
 void BackForwardCache::Flush() {
   render_frame_hosts_.clear();
 }
 
+void BackForwardCache::DisableForTesting() {
+  is_disabled_for_testing_ = true;
+
+  // This could happen if a test populated some pages in the cache, then
+  // called DisableForTesting(). This is not something we currently expect tests
+  // to do.
+  DCHECK(render_frame_hosts_.empty());
+}
+
 }  // namespace content
diff --git a/content/browser/frame_host/back_forward_cache.h b/content/browser/frame_host/back_forward_cache.h
index 5177ce9c..e1d0c3a 100644
--- a/content/browser/frame_host/back_forward_cache.h
+++ b/content/browser/frame_host/back_forward_cache.h
@@ -49,6 +49,17 @@
   // Remove all entries from the BackForwardCache.
   void Flush();
 
+  // Disables the BackForwardCache so that no documents will be stored/served.
+  // This allows tests to "force" not using the BackForwardCache, this can be
+  // useful when:
+  // * Tests rely on a new document being loaded.
+  // * Tests want to test this case specifically.
+  // Note: It's preferable to make tests BackForwardCache compatible
+  // when feasible, rather than using this method. Also please consider whether
+  // you actually should have 2 tests, one with the document cached
+  // (BackForwardCache enabled), and one without.
+  void DisableForTesting();
+
  private:
   // Contains the set of stored RenderFrameHost.
   // Invariant:
@@ -56,6 +67,9 @@
   // - Once the list is full, the least recently used document is evicted.
   std::list<std::unique_ptr<RenderFrameHostImpl>> render_frame_hosts_;
 
+  // Whether the BackforwardCached has been disabled for testing.
+  bool is_disabled_for_testing_ = false;
+
   DISALLOW_COPY_AND_ASSIGN(BackForwardCache);
 };
 }  // namespace content
diff --git a/content/browser/frame_host/debug_urls.cc b/content/browser/frame_host/debug_urls.cc
index d993753..fc475c8 100644
--- a/content/browser/frame_host/debug_urls.cc
+++ b/content/browser/frame_host/debug_urls.cc
@@ -173,9 +173,9 @@
   if (url == kChromeUIDelayedBrowserUIHang) {
     // Webdriver-safe url to hang the ui thread. Webdriver waits for the onload
     // event in javascript which needs a little more time to fire.
-    base::PostDelayedTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                                    base::BindOnce(&HangCurrentThread),
-                                    base::TimeDelta::FromSeconds(2));
+    base::PostDelayedTask(FROM_HERE, {BrowserThread::UI},
+                          base::BindOnce(&HangCurrentThread),
+                          base::TimeDelta::FromSeconds(2));
     return true;
   }
 
@@ -222,8 +222,8 @@
   }
 
   if (url == kChromeUIPpapiFlashCrashURL || url == kChromeUIPpapiFlashHangURL) {
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO},
-                             base::BindOnce(&HandlePpapiFlashDebugURL, url));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&HandlePpapiFlashDebugURL, url));
     return true;
   }
 
diff --git a/content/browser/frame_host/keep_alive_handle_factory.cc b/content/browser/frame_host/keep_alive_handle_factory.cc
index ffaf0540..70b5ad3 100644
--- a/content/browser/frame_host/keep_alive_handle_factory.cc
+++ b/content/browser/frame_host/keep_alive_handle_factory.cc
@@ -39,9 +39,9 @@
 
   void DetachLater(base::TimeDelta timeout) {
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
-    base::PostDelayedTaskWithTraits(
-        FROM_HERE, {BrowserThread::UI},
-        base::BindOnce(&Context::Detach, AsWeakPtr()), timeout);
+    base::PostDelayedTask(FROM_HERE, {BrowserThread::UI},
+                          base::BindOnce(&Context::Detach, AsWeakPtr()),
+                          timeout);
   }
 
   void AddBinding(std::unique_ptr<mojom::KeepAliveHandle> impl,
diff --git a/content/browser/frame_host/navigation_controller_impl_browsertest.cc b/content/browser/frame_host/navigation_controller_impl_browsertest.cc
index 937adc3..ec7a461 100644
--- a/content/browser/frame_host/navigation_controller_impl_browsertest.cc
+++ b/content/browser/frame_host/navigation_controller_impl_browsertest.cc
@@ -1088,9 +1088,8 @@
                        ErrorPageReplacement) {
   NavigationController& controller = shell()->web_contents()->GetController();
   GURL error_url = embedded_test_server()->GetURL("/close-socket");
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&net::URLRequestFailedJob::AddUrlHandler));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&net::URLRequestFailedJob::AddUrlHandler));
 
   EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
   EXPECT_EQ(1, controller.GetEntryCount());
diff --git a/content/browser/frame_host/navigation_handle_impl.cc b/content/browser/frame_host/navigation_handle_impl.cc
index 4b780d2..d242c50 100644
--- a/content/browser/frame_host/navigation_handle_impl.cc
+++ b/content/browser/frame_host/navigation_handle_impl.cc
@@ -181,11 +181,7 @@
 }
 
 const net::HttpResponseHeaders* NavigationHandleImpl::GetResponseHeaders() {
-  if (response_headers_for_testing_)
-    return response_headers_for_testing_.get();
-  return navigation_request_->response()
-             ? navigation_request_->response()->head.headers.get()
-             : nullptr;
+  return navigation_request_->GetResponseHeaders();
 }
 
 net::HttpResponseInfo::ConnectionInfo
diff --git a/content/browser/frame_host/navigation_handle_impl.h b/content/browser/frame_host/navigation_handle_impl.h
index d2f6c86..f700a04 100644
--- a/content/browser/frame_host/navigation_handle_impl.h
+++ b/content/browser/frame_host/navigation_handle_impl.h
@@ -171,11 +171,6 @@
     return navigation_request_->navigation_type();
   }
 
-  void set_response_headers_for_testing(
-      scoped_refptr<net::HttpResponseHeaders> response_headers) {
-    response_headers_for_testing_ = response_headers;
-  }
-
   CSPDisposition should_check_main_world_csp() const {
     return navigation_request_->common_params()
         .initiator_csp_info.should_check_main_world_csp;
@@ -190,10 +185,6 @@
   }
 
  private:
-  // TODO(clamy): Transform NavigationHandleImplTest into NavigationRequestTest
-  // once NavigationHandleImpl has become a wrapper around NavigationRequest.
-  // Then remove them from friends.
-  friend class NavigationHandleImplTest;
   friend class NavigationRequest;
 
   // If |redirect_chain| is empty, then the redirect chain will be created to
@@ -209,10 +200,6 @@
   // The NavigationRequest that owns this NavigationHandle.
   NavigationRequest* navigation_request_;
 
-  // Allows to override response_headers_ in tests.
-  // TODO(clamy): Clean this up once the architecture of unit tests is better.
-  scoped_refptr<net::HttpResponseHeaders> response_headers_for_testing_;
-
   base::WeakPtrFactory<NavigationHandleImpl> weak_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(NavigationHandleImpl);
diff --git a/content/browser/frame_host/navigation_handle_impl_browsertest.cc b/content/browser/frame_host/navigation_handle_impl_browsertest.cc
index 75fb301..11756b5 100644
--- a/content/browser/frame_host/navigation_handle_impl_browsertest.cc
+++ b/content/browser/frame_host/navigation_handle_impl_browsertest.cc
@@ -101,8 +101,7 @@
              navigation_handle_impl->request_context_type());
     request_context_type_ = navigation_handle_impl->request_context_type();
 
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                             did_call_will_start_);
+    base::PostTask(FROM_HERE, {BrowserThread::UI}, did_call_will_start_);
     return will_start_result_;
   }
 
@@ -112,8 +111,7 @@
     CHECK_EQ(request_context_type_,
              navigation_handle_impl->request_context_type());
 
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                             did_call_will_redirect_);
+    base::PostTask(FROM_HERE, {BrowserThread::UI}, did_call_will_redirect_);
     return will_redirect_result_;
   }
 
@@ -123,8 +121,7 @@
     CHECK_EQ(request_context_type_,
              navigation_handle_impl->request_context_type());
 
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                             did_call_will_fail_);
+    base::PostTask(FROM_HERE, {BrowserThread::UI}, did_call_will_fail_);
     return will_fail_result_;
   }
 
@@ -134,8 +131,7 @@
     CHECK_EQ(request_context_type_,
              navigation_handle_impl->request_context_type());
 
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                             did_call_will_process_);
+    base::PostTask(FROM_HERE, {BrowserThread::UI}, did_call_will_process_);
     return will_process_result_;
   }
 
@@ -1891,9 +1887,8 @@
   GURL start_url(embedded_test_server()->GetURL("foo.com", "/title1.html"));
   GURL error_url(embedded_test_server()->GetURL("/close-socket"));
   EXPECT_NE(start_url.host(), error_url.host());
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&net::URLRequestFailedJob::AddUrlHandler));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&net::URLRequestFailedJob::AddUrlHandler));
 
   {
     NavigationHandleObserver observer(shell()->web_contents(), start_url);
diff --git a/content/browser/frame_host/navigation_request.cc b/content/browser/frame_host/navigation_request.cc
index 69de10b..625ea70 100644
--- a/content/browser/frame_host/navigation_request.cc
+++ b/content/browser/frame_host/navigation_request.cc
@@ -1766,14 +1766,13 @@
     // is no onbeforeunload handler or if a NavigationThrottle cancelled it,
     // then this could cause reentrancy into NavigationController. So use a
     // PostTask to avoid that.
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::UI},
-        base::BindOnce(
-            &NavigationRequest::OnRequestFailedInternal,
-            weak_factory_.GetWeakPtr(),
-            network::URLLoaderCompletionStatus(result.net_error_code()),
-            true /* skip_throttles */, result.error_page_content(),
-            collapse_frame));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(&NavigationRequest::OnRequestFailedInternal,
+                                  weak_factory_.GetWeakPtr(),
+                                  network::URLLoaderCompletionStatus(
+                                      result.net_error_code()),
+                                  true /* skip_throttles */,
+                                  result.error_page_content(), collapse_frame));
 
     // DO NOT ADD CODE after this. The previous call to OnRequestFailedInternal
     // has destroyed the NavigationRequest.
@@ -3090,4 +3089,10 @@
   modified_request_headers_.SetHeader(header_name, header_value);
 }
 
+const net::HttpResponseHeaders* NavigationRequest::GetResponseHeaders() {
+  if (response_headers_for_testing_)
+    return response_headers_for_testing_.get();
+  return response_head_.get() ? response_head_->head.headers.get() : nullptr;
+}
+
 }  // namespace content
diff --git a/content/browser/frame_host/navigation_request.h b/content/browser/frame_host/navigation_request.h
index f293305a..ec904e29 100644
--- a/content/browser/frame_host/navigation_request.h
+++ b/content/browser/frame_host/navigation_request.h
@@ -487,10 +487,15 @@
   void SetRequestHeader(const std::string& header_name,
                         const std::string& header_value);
 
+  void set_response_headers_for_testing(
+      scoped_refptr<net::HttpResponseHeaders> response_headers) {
+    response_headers_for_testing_ = response_headers;
+  }
+
+  const net::HttpResponseHeaders* GetResponseHeaders();
+
  private:
-  // TODO(clamy): Transform NavigationHandleImplTest into NavigationRequestTest
-  // once NavigationHandleImpl has become a wrapper around NavigationRequest.
-  friend class NavigationHandleImplTest;
+  friend class NavigationRequestTest;
 
   NavigationRequest(FrameTreeNode* frame_tree_node,
                     mojom::CommonNavigationParamsPtr common_params,
@@ -1025,6 +1030,10 @@
   std::vector<std::string> removed_request_headers_;
   net::HttpRequestHeaders modified_request_headers_;
 
+  // Allows to override response_headers_ in tests.
+  // TODO(clamy): Clean this up once the architecture of unit tests is better.
+  scoped_refptr<net::HttpResponseHeaders> response_headers_for_testing_;
+
   base::WeakPtrFactory<NavigationRequest> weak_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(NavigationRequest);
diff --git a/content/browser/frame_host/navigation_handle_impl_unittest.cc b/content/browser/frame_host/navigation_request_unittest.cc
similarity index 92%
rename from content/browser/frame_host/navigation_handle_impl_unittest.cc
rename to content/browser/frame_host/navigation_request_unittest.cc
index 9a06f82..07f931ad 100644
--- a/content/browser/frame_host/navigation_handle_impl_unittest.cc
+++ b/content/browser/frame_host/navigation_request_unittest.cc
@@ -2,12 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/browser/frame_host/navigation_handle_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "base/bind.h"
 #include "base/macros.h"
 #include "base/optional.h"
 #include "build/build_config.h"
-#include "content/browser/frame_host/navigation_request.h"
 #include "content/public/browser/navigation_throttle.h"
 #include "content/public/browser/ssl_status.h"
 #include "content/public/common/url_constants.h"
@@ -59,9 +58,9 @@
   base::RepeatingClosure deletion_callback_;
 };
 
-class NavigationHandleImplTest : public RenderViewHostImplTestHarness {
+class NavigationRequestTest : public RenderViewHostImplTestHarness {
  public:
-  NavigationHandleImplTest()
+  NavigationRequestTest()
       : was_callback_called_(false),
         callback_result_(NavigationThrottle::DEFER) {}
 
@@ -91,9 +90,9 @@
     callback_result_ = NavigationThrottle::DEFER;
 
     // It's safe to use base::Unretained since the NavigationHandle is owned by
-    // the NavigationHandleImplTest.
+    // the NavigationRequestTest.
     request_->WillStartRequest(
-        base::Bind(&NavigationHandleImplTest::UpdateThrottleCheckResult,
+        base::Bind(&NavigationRequestTest::UpdateThrottleCheckResult,
                    base::Unretained(this)));
   }
 
@@ -107,10 +106,10 @@
     callback_result_ = NavigationThrottle::DEFER;
 
     // It's safe to use base::Unretained since the NavigationHandle is owned by
-    // the NavigationHandleImplTest.
+    // the NavigationRequestTest.
     request_->WillRedirectRequest(
         GURL(), nullptr,
-        base::Bind(&NavigationHandleImplTest::UpdateThrottleCheckResult,
+        base::Bind(&NavigationRequestTest::UpdateThrottleCheckResult,
                    base::Unretained(this)));
   }
 
@@ -125,9 +124,9 @@
     request_->set_net_error(net_error_code);
 
     // It's safe to use base::Unretained since the NavigationHandle is owned by
-    // the NavigationHandleImplTest.
+    // the NavigationRequestTest.
     request_->WillFailRequest(
-        base::Bind(&NavigationHandleImplTest::UpdateThrottleCheckResult,
+        base::Bind(&NavigationRequestTest::UpdateThrottleCheckResult,
                    base::Unretained(this)));
   }
 
@@ -140,20 +139,15 @@
     was_callback_called_ = false;
     callback_result_ = NavigationThrottle::DEFER;
 
-    // It's safe to use base::Unretained since the NavigationHandle is owned
-    // by the NavigationHandleImplTest. The ConnectionInfo is different from
-    // that sent to WillRedirectRequest to verify that it's correctly plumbed
-    // in both cases.
+    // It's safe to use base::Unretained since the NavigationHandle is owned by
+    // the NavigationRequestTest. The ConnectionInfo is different from that sent
+    // to WillRedirectRequest to verify that it's correctly plumbed in both
+    // cases.
     request_->WillProcessResponse(
-        base::Bind(&NavigationHandleImplTest::UpdateThrottleCheckResult,
+        base::Bind(&NavigationRequestTest::UpdateThrottleCheckResult,
                    base::Unretained(this)));
   }
 
-  // Returns the handle used in tests.
-  NavigationHandleImpl* test_handle() const {
-    return request_->navigation_handle();
-  }
-
   // Whether the callback was called.
   bool was_callback_called() const { return was_callback_called_; }
 
@@ -163,7 +157,7 @@
   }
 
   NavigationRequest::NavigationHandleState state() {
-    return test_handle()->state();
+    return request_->handle_state();
   }
 
   bool is_deferring() {
@@ -198,10 +192,10 @@
   TestNavigationThrottle* CreateTestNavigationThrottle(
       NavigationThrottle::ThrottleCheckResult result) {
     TestNavigationThrottle* test_throttle =
-        new TestNavigationThrottle(test_handle());
+        new TestNavigationThrottle(request_->navigation_handle());
     test_throttle->SetResponseForAllMethods(TestNavigationThrottle::SYNCHRONOUS,
                                             result);
-    test_handle()->RegisterThrottleForTesting(
+    request_->RegisterThrottleForTesting(
         std::unique_ptr<TestNavigationThrottle>(test_throttle));
     return test_throttle;
   }
@@ -250,7 +244,7 @@
 
 // Checks that the request_context_type is properly set.
 // Note: can be extended to cover more internal members.
-TEST_F(NavigationHandleImplTest, SimpleDataChecksRedirectAndProcess) {
+TEST_F(NavigationRequestTest, SimpleDataChecksRedirectAndProcess) {
   const GURL kUrl1 = GURL("http://chromium.org");
   const GURL kUrl2 = GURL("http://google.com");
   auto navigation =
@@ -278,7 +272,7 @@
             navigation->GetNavigationHandle()->GetConnectionInfo());
 }
 
-TEST_F(NavigationHandleImplTest, SimpleDataCheckNoRedirect) {
+TEST_F(NavigationRequestTest, SimpleDataCheckNoRedirect) {
   const GURL kUrl = GURL("http://chromium.org");
   auto navigation =
       NavigationSimulatorImpl::CreateRendererInitiated(kUrl, main_rfh());
@@ -293,7 +287,7 @@
             navigation->GetNavigationHandle()->GetConnectionInfo());
 }
 
-TEST_F(NavigationHandleImplTest, SimpleDataChecksFailure) {
+TEST_F(NavigationRequestTest, SimpleDataChecksFailure) {
   const GURL kUrl = GURL("http://chromium.org");
   auto navigation =
       NavigationSimulatorImpl::CreateRendererInitiated(kUrl, main_rfh());
@@ -319,7 +313,7 @@
 
 // Checks that a navigation deferred during WillStartRequest can be properly
 // cancelled.
-TEST_F(NavigationHandleImplTest, MAYBE_CancelDeferredWillStart) {
+TEST_F(NavigationRequestTest, MAYBE_CancelDeferredWillStart) {
   TestNavigationThrottle* test_throttle =
       CreateTestNavigationThrottle(NavigationThrottle::DEFER);
   EXPECT_EQ(NavigationRequest::INITIAL, state());
@@ -349,7 +343,7 @@
 
 // Checks that a navigation deferred during WillRedirectRequest can be properly
 // cancelled.
-TEST_F(NavigationHandleImplTest, MAYBE_CancelDeferredWillRedirect) {
+TEST_F(NavigationRequestTest, MAYBE_CancelDeferredWillRedirect) {
   TestNavigationThrottle* test_throttle =
       CreateTestNavigationThrottle(NavigationThrottle::DEFER);
   EXPECT_EQ(NavigationRequest::INITIAL, state());
@@ -379,7 +373,7 @@
 
 // Checks that a navigation deferred during WillFailRequest can be properly
 // cancelled.
-TEST_F(NavigationHandleImplTest, MAYBE_CancelDeferredWillFail) {
+TEST_F(NavigationRequestTest, MAYBE_CancelDeferredWillFail) {
   TestNavigationThrottle* test_throttle = CreateTestNavigationThrottle(
       TestNavigationThrottle::WILL_FAIL_REQUEST, NavigationThrottle::DEFER);
   EXPECT_EQ(NavigationRequest::INITIAL, state());
@@ -414,7 +408,7 @@
 #endif
 
 // Checks that a navigation deferred can be canceled and not ignored.
-TEST_F(NavigationHandleImplTest, MAYBE_CancelDeferredWillRedirectNoIgnore) {
+TEST_F(NavigationRequestTest, MAYBE_CancelDeferredWillRedirectNoIgnore) {
   TestNavigationThrottle* test_throttle =
       CreateTestNavigationThrottle(NavigationThrottle::DEFER);
   EXPECT_EQ(NavigationRequest::INITIAL, state());
@@ -445,7 +439,7 @@
 
 // Checks that a navigation deferred by WillFailRequest can be canceled and not
 // ignored.
-TEST_F(NavigationHandleImplTest, MAYBE_CancelDeferredWillFailNoIgnore) {
+TEST_F(NavigationRequestTest, MAYBE_CancelDeferredWillFailNoIgnore) {
   TestNavigationThrottle* test_throttle = CreateTestNavigationThrottle(
       TestNavigationThrottle::WILL_FAIL_REQUEST, NavigationThrottle::DEFER);
   EXPECT_EQ(NavigationRequest::INITIAL, state());
@@ -473,7 +467,7 @@
 
 // Checks that data from the SSLInfo passed into SimulateWillStartRequest() is
 // stored on the handle.
-TEST_F(NavigationHandleImplTest, WillFailRequestSetsSSLInfo) {
+TEST_F(NavigationRequestTest, WillFailRequestSetsSSLInfo) {
   uint16_t cipher_suite = 0xc02f;  // TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
   int connection_status = 0;
   net::SSLConnectionStatusSetCipherSuite(cipher_suite, &connection_status);
@@ -545,8 +539,7 @@
 // throttle in WillFailRequest(), as well as after deferring the failure.  This
 // is allowed, since at that point the final RenderFrameHost will have already
 // been chosen. See https://crbug.com/817881.
-TEST_F(NavigationHandleImplTest,
-       MAYBE_WillFailRequestCanAccessRenderFrameHost) {
+TEST_F(NavigationRequestTest, MAYBE_WillFailRequestCanAccessRenderFrameHost) {
   std::unique_ptr<ContentBrowserClient> client(
       new ThrottleTestContentBrowserClient);
   ContentBrowserClient* old_browser_client =
diff --git a/content/browser/frame_host/origin_policy_throttle_unittest.cc b/content/browser/frame_host/origin_policy_throttle_unittest.cc
index 440d24e..86d85fb0 100644
--- a/content/browser/frame_host/origin_policy_throttle_unittest.cc
+++ b/content/browser/frame_host/origin_policy_throttle_unittest.cc
@@ -182,7 +182,7 @@
       ->SetOriginPolicyManagerForBrowserProcessForTesting(
           test_origin_policy_manager.GetPtr());
 
-  nav_handle->set_response_headers_for_testing(headers);
+  nav_handle->navigation_request()->set_response_headers_for_testing(headers);
   navigation->ReadyToCommit();
   EXPECT_TRUE(navigation->IsDeferred());
   OriginPolicyThrottle* policy_throttle = static_cast<OriginPolicyThrottle*>(
@@ -239,7 +239,7 @@
       "HTTP/1.1 200 OK\nSec-Origin-Policy: policy=policy-1\n\n";
   auto headers = base::MakeRefCounted<net::HttpResponseHeaders>(
       net::HttpUtil::AssembleRawHeaders(raw_headers));
-  nav_handle->set_response_headers_for_testing(headers);
+  nav_handle->navigation_request()->set_response_headers_for_testing(headers);
   navigation->ReadyToCommit();
 
   // The policy manager has to be called even though this is an exception
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index 9e18718..376a4fb 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -4182,13 +4182,13 @@
     registry_->AddInterface(
         base::Bind(&MediaDevicesDispatcherHost::Create, GetProcess()->GetID(),
                    GetRoutingID(), base::Unretained(media_stream_manager)),
-        base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO}));
+        base::CreateSingleThreadTaskRunner({BrowserThread::IO}));
 
     registry_->AddInterface(
         base::BindRepeating(&MediaStreamDispatcherHost::Create,
                             GetProcess()->GetID(), GetRoutingID(),
                             base::Unretained(media_stream_manager)),
-        base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO}));
+        base::CreateSingleThreadTaskRunner({BrowserThread::IO}));
   }
 
 #if BUILDFLAG(ENABLE_MEDIA_REMOTING)
@@ -4262,7 +4262,7 @@
   registry_->AddInterface(
       base::BindRepeating(SpeechRecognitionDispatcherHost::Create,
                           GetProcess()->GetID(), routing_id_),
-      base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO}));
+      base::CreateSingleThreadTaskRunner({BrowserThread::IO}));
 
   file_system_manager_.reset(new FileSystemManagerImpl(
       GetProcess()->GetID(),
@@ -4271,7 +4271,7 @@
   registry_->AddInterface(
       base::BindRepeating(&FileSystemManagerImpl::BindRequest,
                           base::Unretained(file_system_manager_.get())),
-      base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO}));
+      base::CreateSingleThreadTaskRunner({BrowserThread::IO}));
 
   registry_->AddInterface(base::BindRepeating(
       &BackgroundFetchServiceImpl::CreateForFrame, GetProcess(), routing_id_));
@@ -4981,8 +4981,9 @@
     if (common_params.url.SchemeIs(url::kContentScheme)) {
       // Only content:// URLs can load content:// subresources
       auto content_factory = std::make_unique<ContentURLLoaderFactory>(
-          base::CreateSequencedTaskRunnerWithTraits(
-              {base::MayBlock(), base::TaskPriority::BEST_EFFORT,
+          base::CreateSequencedTaskRunner(
+              {base::ThreadPool(), base::MayBlock(),
+               base::TaskPriority::BEST_EFFORT,
                base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN}));
       non_network_url_loader_factories_.emplace(url::kContentScheme,
                                                 std::move(content_factory));
@@ -5102,7 +5103,7 @@
             std::move(factory_bundle_for_prefetch),
             EnsurePrefetchedSignedExchangeCache());
       } else {
-        base::PostTaskWithTraits(
+        base::PostTask(
             FROM_HERE, {BrowserThread::IO},
             base::BindOnce(
                 &PrefetchURLLoaderService::GetFactory,
@@ -5178,7 +5179,7 @@
     // it until its request endpoint is sent. Now that the request endpoint was
     // sent, it can be used, so add it to ServiceWorkerObjectHost.
     if (remote_object.is_valid()) {
-      base::PostTaskWithTraits(
+      base::PostTask(
           FROM_HERE, {BrowserThread::IO},
           base::BindOnce(
               &ServiceWorkerObjectHost::AddRemoteObjectPtrAndUpdateState,
@@ -6199,11 +6200,10 @@
             ->GetServiceWorkerContext()));
   }
 
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&PushMessagingManager::AddPushMessagingReceiver,
-                     push_messaging_manager_->AsWeakPtr(),
-                     std::move(receiver)));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&PushMessagingManager::AddPushMessagingReceiver,
+                                push_messaging_manager_->AsWeakPtr(),
+                                std::move(receiver)));
 }
 
 void RenderFrameHostImpl::GetVirtualAuthenticatorManager(
@@ -6234,7 +6234,7 @@
         std::move(host_receiver), std::move(frontend_remote), host_id,
         routing_id_, GetProcess()->GetID(), mojo::GetBadMessageCallback());
   } else {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&AppCacheServiceImpl::RegisterHostForFrame,
                        appcache_service_impl->AsWeakPtr(),
diff --git a/content/browser/frame_host/render_frame_host_manager.cc b/content/browser/frame_host/render_frame_host_manager.cc
index b95a5cb5..6238ee9 100644
--- a/content/browser/frame_host/render_frame_host_manager.cc
+++ b/content/browser/frame_host/render_frame_host_manager.cc
@@ -2941,7 +2941,7 @@
   int32_t routing_id =
       success ? render_frame_host_->GetRoutingID() : MSG_ROUTING_NONE;
   // Invoking the callback asynchronously to meet the APIs promise.
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(
           [](RenderFrameHost::PrepareForInnerWebContentsAttachCallback callback,
diff --git a/content/browser/frame_host/render_frame_message_filter.cc b/content/browser/frame_host/render_frame_message_filter.cc
index a2ee08bf..98994c5 100644
--- a/content/browser/frame_host/render_frame_message_filter.cc
+++ b/content/browser/frame_host/render_frame_message_filter.cc
@@ -364,7 +364,7 @@
     // through and allow it to be interrupted so that the embedder can deal.
   }
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&DownloadUrlOnUIThread, std::move(parameters),
                      std::move(blob_data_handle), std::move(blob_url_token)));
@@ -402,7 +402,7 @@
 
   params_reply->devtools_frame_token = base::UnguessableToken::Create();
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(
           &CreateChildFrameOnUI, render_process_id_, params.parent_routing_id,
diff --git a/content/browser/gpu/browser_gpu_channel_host_factory.cc b/content/browser/gpu/browser_gpu_channel_host_factory.cc
index 23c2d0db..4666b18 100644
--- a/content/browser/gpu/browser_gpu_channel_host_factory.cc
+++ b/content/browser/gpu/browser_gpu_channel_host_factory.cc
@@ -101,7 +101,7 @@
   scoped_refptr<EstablishRequest> establish_request =
       new EstablishRequest(gpu_client_id, gpu_client_tracing_id);
   // PostTask outside the constructor to ensure at least one reference exists.
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           &BrowserGpuChannelHostFactory::EstablishRequest::EstablishOnIO,
@@ -165,7 +165,7 @@
         base::BindOnce(
             &BrowserGpuChannelHostFactory::EstablishRequest::RestartTimeout,
             this));
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(
             &BrowserGpuChannelHostFactory::EstablishRequest::EstablishOnIO,
@@ -266,7 +266,7 @@
     base::FilePath cache_dir =
         GetContentClient()->browser()->GetShaderDiskCacheDirectory();
     if (!cache_dir.empty()) {
-      base::PostTaskWithTraits(
+      base::PostTask(
           FROM_HERE, {BrowserThread::IO},
           base::BindOnce(
               &BrowserGpuChannelHostFactory::InitializeShaderDiskCacheOnIO,
@@ -281,7 +281,7 @@
       base::FilePath gr_cache_dir =
           GetContentClient()->browser()->GetGrShaderDiskCacheDirectory();
       if (!gr_cache_dir.empty()) {
-        base::PostTaskWithTraits(
+        base::PostTask(
             FROM_HERE, {BrowserThread::IO},
             base::BindOnce(
                 &BrowserGpuChannelHostFactory::InitializeGrShaderDiskCacheOnIO,
diff --git a/content/browser/gpu/ca_transaction_gpu_coordinator.cc b/content/browser/gpu/ca_transaction_gpu_coordinator.cc
index fca572f..e8f21b5 100644
--- a/content/browser/gpu/ca_transaction_gpu_coordinator.cc
+++ b/content/browser/gpu/ca_transaction_gpu_coordinator.cc
@@ -64,7 +64,7 @@
 
 void CATransactionGPUCoordinator::OnActivateForTransaction() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&CATransactionGPUCoordinator::OnActivateForTransactionOnIO,
                      this));
@@ -78,7 +78,7 @@
   // (and removed from the list of post-commit observers) soon after.
   pending_commit_count_++;
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&CATransactionGPUCoordinator::OnEnterPostCommitOnIO,
                      this));
diff --git a/content/browser/gpu/chromeos/video_capture_dependencies.cc b/content/browser/gpu/chromeos/video_capture_dependencies.cc
index 22e8d8f..e941ce73 100644
--- a/content/browser/gpu/chromeos/video_capture_dependencies.cc
+++ b/content/browser/gpu/chromeos/video_capture_dependencies.cc
@@ -16,7 +16,7 @@
 void VideoCaptureDependencies::CreateJpegDecodeAccelerator(
     chromeos_camera::mojom::MjpegDecodeAcceleratorRequest accelerator) {
   if (!BrowserThread::CurrentlyOn(BrowserThread::IO)) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&VideoCaptureDependencies::CreateJpegDecodeAccelerator,
                        std::move(accelerator)));
@@ -37,7 +37,7 @@
 void VideoCaptureDependencies::CreateJpegEncodeAccelerator(
     chromeos_camera::mojom::JpegEncodeAcceleratorRequest accelerator) {
   if (!BrowserThread::CurrentlyOn(BrowserThread::IO)) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&VideoCaptureDependencies::CreateJpegEncodeAccelerator,
                        std::move(accelerator)));
diff --git a/content/browser/gpu/gpu_data_manager_impl_private.cc b/content/browser/gpu/gpu_data_manager_impl_private.cc
index 206f43c..92846a9c 100644
--- a/content/browser/gpu/gpu_data_manager_impl_private.cc
+++ b/content/browser/gpu/gpu_data_manager_impl_private.cc
@@ -236,8 +236,8 @@
 void OnVideoMemoryUsageStats(
     GpuDataManager::VideoMemoryUsageStatsCallback callback,
     const gpu::VideoMemoryUsageStats& stats) {
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                           base::BindOnce(std::move(callback), stats));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(std::move(callback), stats));
 }
 
 void RequestVideoMemoryUsageStats(
@@ -254,7 +254,7 @@
   // This function is called on the IO thread, but GPUInfo on GpuDataManagerImpl
   // should be updated on the UI thread since it can call into functions that
   // expect to run in the UI thread.
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(
           [](const gpu::DxDiagNode& dx_diagnostics) {
@@ -268,7 +268,7 @@
   // This function is called on the IO thread, but GPUInfo on GpuDataManagerImpl
   // should be updated on the UI thread since it can call into functions that
   // expect to run in the UI thread.
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(
           [](const gpu::Dx12VulkanVersionInfo& dx12_vulkan_version_info) {
@@ -419,9 +419,8 @@
         base::BindOnce(&UpdateDx12VulkanInfoOnIO));
   });
 
-  base::PostDelayedTaskWithTraits(FROM_HERE, {BrowserThread::IO},
-                                  std::move(task),
-                                  base::TimeDelta::FromMilliseconds(15000));
+  base::PostDelayedTask(FROM_HERE, {BrowserThread::IO}, std::move(task),
+                        base::TimeDelta::FromMilliseconds(15000));
 #else
   NOTREACHED();
 #endif
diff --git a/content/browser/gpu/gpu_ipc_browsertests.cc b/content/browser/gpu/gpu_ipc_browsertests.cc
index df37c30c..48f813c 100644
--- a/content/browser/gpu/gpu_ipc_browsertests.cc
+++ b/content/browser/gpu/gpu_ipc_browsertests.cc
@@ -318,7 +318,7 @@
   // channel on the IO thread, which then notifies the main thread about the
   // error state.
   base::RunLoop wait_for_io_run_loop;
-  base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO})
+  base::CreateSingleThreadTaskRunner({BrowserThread::IO})
       ->PostTask(FROM_HERE, wait_for_io_run_loop.QuitClosure());
   // Waits for the IO thread to run.
   wait_for_io_run_loop.Run();
diff --git a/content/browser/gpu/gpu_memory_buffer_manager_singleton.cc b/content/browser/gpu/gpu_memory_buffer_manager_singleton.cc
index bcbf14e..043b247c 100644
--- a/content/browser/gpu/gpu_memory_buffer_manager_singleton.cc
+++ b/content/browser/gpu/gpu_memory_buffer_manager_singleton.cc
@@ -35,7 +35,7 @@
           base::BindRepeating(&content::GetGpuService),
           client_id,
           std::make_unique<gpu::GpuMemoryBufferSupport>(),
-          base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO})) {
+          base::CreateSingleThreadTaskRunner({BrowserThread::IO})) {
   DCHECK(!g_gpu_memory_buffer_manager);
   g_gpu_memory_buffer_manager = this;
 }
diff --git a/content/browser/gpu/gpu_process_host.cc b/content/browser/gpu/gpu_process_host.cc
index 4e949d2..28b60bd4 100644
--- a/content/browser/gpu/gpu_process_host.cc
+++ b/content/browser/gpu/gpu_process_host.cc
@@ -454,7 +454,7 @@
 void BindDiscardableMemoryRequestOnUI(
     discardable_memory::mojom::DiscardableSharedMemoryManagerRequest request) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           &BindDiscardableMemoryRequestOnIO, std::move(request),
@@ -466,8 +466,7 @@
 class GpuProcessHost::ConnectionFilterImpl : public ConnectionFilter {
  public:
   explicit ConnectionFilterImpl(int gpu_process_id) {
-    auto task_runner =
-        base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::UI});
+    auto task_runner = base::CreateSingleThreadTaskRunner({BrowserThread::UI});
     registry_.AddInterface(base::BindRepeating(&FieldTrialRecorder::Create),
                            task_runner);
 #if defined(OS_ANDROID)
@@ -564,7 +563,7 @@
 // static
 void GpuProcessHost::GetHasGpuProcess(base::OnceCallback<void(bool)> callback) {
   if (!BrowserThread::CurrentlyOn(BrowserThread::IO)) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&GpuProcessHost::GetHasGpuProcess, std::move(callback)));
     return;
@@ -588,9 +587,9 @@
 #if !defined(OS_WIN)
   DCHECK_NE(kind, GPU_PROCESS_KIND_UNSANDBOXED_NO_GL);
 #endif
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO},
-                           base::BindOnce(&RunCallbackOnIO, kind, force_create,
-                                          std::move(callback)));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&RunCallbackOnIO, kind, force_create,
+                                std::move(callback)));
 }
 
 void GpuProcessHost::BindInterface(
@@ -793,7 +792,7 @@
         NOTREACHED();
         break;
     }
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&OnGpuProcessHostDestroyedOnUI, host_id_, message));
   }
@@ -868,7 +867,7 @@
   params.deadline_to_synchronize_surfaces =
       switches::GetDeadlineToSynchronizeSurfaces();
   params.main_thread_task_runner =
-      base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::UI});
+      base::CreateSingleThreadTaskRunner({BrowserThread::UI});
   gpu_host_ = std::make_unique<viz::GpuHostImpl>(
       this, std::move(viz_main_pending_remote), std::move(params));
 
@@ -1029,11 +1028,10 @@
 #else
   // TODO(crbug.com/819474): The switch from GPU to software compositing should
   // be handled here instead of by ImageTransportFactory.
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::UI}, base::BindOnce([]() {
-        if (auto* factory = ImageTransportFactory::GetInstance())
-          factory->DisableGpuCompositing();
-      }));
+  base::PostTask(FROM_HERE, {BrowserThread::UI}, base::BindOnce([]() {
+                   if (auto* factory = ImageTransportFactory::GetInstance())
+                     factory->DisableGpuCompositing();
+                 }));
 #endif
 }
 
@@ -1049,7 +1047,7 @@
 
 void GpuProcessHost::BindDiscardableMemoryRequest(
     discardable_memory::mojom::DiscardableSharedMemoryManagerRequest request) {
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&BindDiscardableMemoryRequestOnUI, std::move(request)));
 }
diff --git a/content/browser/gpu/in_process_gpu_thread_browsertests.cc b/content/browser/gpu/in_process_gpu_thread_browsertests.cc
index 21e8c2b5..b4902aaa 100644
--- a/content/browser/gpu/in_process_gpu_thread_browsertests.cc
+++ b/content/browser/gpu/in_process_gpu_thread_browsertests.cc
@@ -33,9 +33,9 @@
 
 void WaitUntilGpuProcessHostIsCreated() {
   base::RunLoop run_loop;
-  base::PostTaskWithTraitsAndReply(FROM_HERE, {content::BrowserThread::IO},
-                                   base::BindOnce(&CreateGpuProcessHost),
-                                   run_loop.QuitClosure());
+  base::PostTaskAndReply(FROM_HERE, {content::BrowserThread::IO},
+                         base::BindOnce(&CreateGpuProcessHost),
+                         run_loop.QuitClosure());
   run_loop.Run();
 }
 
diff --git a/content/browser/gpu/viz_devtools_connector.cc b/content/browser/gpu/viz_devtools_connector.cc
index f005ec0f..b797102 100644
--- a/content/browser/gpu/viz_devtools_connector.cc
+++ b/content/browser/gpu/viz_devtools_connector.cc
@@ -23,8 +23,8 @@
   int port = 0;
   if (local_addr)
     port = local_addr->port();
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO},
-                           base::BindOnce(std::move(callback), result, port));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(std::move(callback), result, port));
 }
 
 void CreateSocketOnUiThread(
@@ -54,7 +54,7 @@
       switches::kEnableVizDevTools, kVizDevToolsDefaultPort);
   // Jump to the UI thread to get the network context, create the socket, then
   // jump back to the IO thread to complete the callback.
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(
           &CreateSocketOnUiThread, std::move(server_socket_request), port,
diff --git a/content/browser/histogram_controller.cc b/content/browser/histogram_controller.cc
index 495edaf..63a2051 100644
--- a/content/browser/histogram_controller.cc
+++ b/content/browser/histogram_controller.cc
@@ -44,7 +44,7 @@
     int sequence_number,
     const std::vector<std::string>& pickled_histograms) {
   if (!BrowserThread::CurrentlyOn(BrowserThread::UI)) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&HistogramController::OnHistogramDataCollected,
                        base::Unretained(this), sequence_number,
@@ -168,11 +168,10 @@
       ++pending_processes;
     }
   }
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::UI},
-      base::BindOnce(&HistogramController::OnPendingProcesses,
-                     base::Unretained(this), sequence_number, pending_processes,
-                     true));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(&HistogramController::OnPendingProcesses,
+                                base::Unretained(this), sequence_number,
+                                pending_processes, true));
 }
 
 void HistogramController::GetHistogramData(int sequence_number) {
@@ -193,7 +192,7 @@
   }
   OnPendingProcesses(sequence_number, pending_processes, false);
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&HistogramController::GetHistogramDataFromChildProcesses,
                      base::Unretained(this), sequence_number));
diff --git a/content/browser/histogram_synchronizer.cc b/content/browser/histogram_synchronizer.cc
index 9dc2eed..9c792bb 100644
--- a/content/browser/histogram_synchronizer.cc
+++ b/content/browser/histogram_synchronizer.cc
@@ -189,9 +189,8 @@
 // static
 void HistogramSynchronizer::FetchHistograms() {
   if (!BrowserThread::CurrentlyOn(BrowserThread::UI)) {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::UI},
-        base::BindOnce(&HistogramSynchronizer::FetchHistograms));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(&HistogramSynchronizer::FetchHistograms));
     return;
   }
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -249,7 +248,7 @@
 
   // Post a task that would be called after waiting for wait_time.  This acts
   // as a watchdog, to cancel the requests for non-responsive processes.
-  base::PostDelayedTaskWithTraits(
+  base::PostDelayedTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&RequestContext::Unregister, sequence_number), wait_time);
 }
diff --git a/content/browser/hyphenation/hyphenation_impl.cc b/content/browser/hyphenation/hyphenation_impl.cc
index 35e84f0..568e2795 100644
--- a/content/browser/hyphenation/hyphenation_impl.cc
+++ b/content/browser/hyphenation/hyphenation_impl.cc
@@ -66,8 +66,9 @@
 // static
 scoped_refptr<base::SequencedTaskRunner> HyphenationImpl::GetTaskRunner() {
   static base::NoDestructor<scoped_refptr<base::SequencedTaskRunner>> runner(
-      base::CreateSequencedTaskRunnerWithTraits(
-          {base::MayBlock(), base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN,
+      base::CreateSequencedTaskRunner(
+          {base::ThreadPool(), base::MayBlock(),
+           base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN,
            base::TaskPriority::USER_BLOCKING}));
   return *runner;
 }
diff --git a/content/browser/image_capture/image_capture_impl.cc b/content/browser/image_capture/image_capture_impl.cc
index b5e2afe..51ab2353 100644
--- a/content/browser/image_capture/image_capture_impl.cc
+++ b/content/browser/image_capture/image_capture_impl.cc
@@ -96,7 +96,7 @@
       mojo::WrapCallbackWithDefaultInvokeIfNotRun(
           media::BindToCurrentLoop(std::move(callback)),
           mojo::CreateEmptyPhotoState());
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&GetPhotoStateOnIOThread, source_id,
                      BrowserMainLoop::GetInstance()->media_stream_manager(),
@@ -114,7 +114,7 @@
   SetOptionsCallback scoped_callback =
       mojo::WrapCallbackWithDefaultInvokeIfNotRun(
           media::BindToCurrentLoop(std::move(callback)), false);
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&SetOptionsOnIOThread, source_id,
                      BrowserMainLoop::GetInstance()->media_stream_manager(),
@@ -132,7 +132,7 @@
       mojo::WrapCallbackWithDefaultInvokeIfNotRun(
           media::BindToCurrentLoop(std::move(callback)),
           media::mojom::Blob::New());
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&TakePhotoOnIOThread, source_id,
                      BrowserMainLoop::GetInstance()->media_stream_manager(),
diff --git a/content/browser/indexed_db/indexed_db_backing_store.cc b/content/browser/indexed_db/indexed_db_backing_store.cc
index bc2fa07..776bbee 100644
--- a/content/browser/indexed_db/indexed_db_backing_store.cc
+++ b/content/browser/indexed_db/indexed_db_backing_store.cc
@@ -1597,7 +1597,7 @@
     DCHECK(descriptor.blob());
     scoped_refptr<LocalWriteClosure> write_closure(
         new LocalWriteClosure(chained_blob_writer, task_runner_.get()));
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {content::BrowserThread::IO},
         base::BindOnce(
             &LocalWriteClosure::WriteBlobToFileOnIOThread, write_closure, path,
diff --git a/content/browser/indexed_db/indexed_db_browsertest.cc b/content/browser/indexed_db/indexed_db_browsertest.cc
index d4a94f9..730f778 100644
--- a/content/browser/indexed_db/indexed_db_browsertest.cc
+++ b/content/browser/indexed_db/indexed_db_browsertest.cc
@@ -155,10 +155,9 @@
   static void SetTempQuota(int per_host_quota_kilobytes,
                            scoped_refptr<QuotaManager> qm) {
     if (!BrowserThread::CurrentlyOn(BrowserThread::IO)) {
-      base::PostTaskWithTraits(
-          FROM_HERE, {BrowserThread::IO},
-          base::BindOnce(&IndexedDBBrowserTest::SetTempQuota,
-                         per_host_quota_kilobytes, qm));
+      base::PostTask(FROM_HERE, {BrowserThread::IO},
+                     base::BindOnce(&IndexedDBBrowserTest::SetTempQuota,
+                                    per_host_quota_kilobytes, qm));
       return;
     }
     DCHECK_CURRENTLY_ON(BrowserThread::IO);
diff --git a/content/browser/indexed_db/indexed_db_callbacks.cc b/content/browser/indexed_db/indexed_db_callbacks.cc
index 8415255..ee2f0ab 100644
--- a/content/browser/indexed_db/indexed_db_callbacks.cc
+++ b/content/browser/indexed_db/indexed_db_callbacks.cc
@@ -176,7 +176,7 @@
       base::WaitableEvent::ResetPolicy::AUTOMATIC,
       base::WaitableEvent::InitialState::NOT_SIGNALED);
   bool result;
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           [](scoped_refptr<ChromeBlobStorageContext> inner_blob_context,
diff --git a/content/browser/indexed_db/indexed_db_context_impl.cc b/content/browser/indexed_db/indexed_db_context_impl.cc
index d8b87576..0305f70 100644
--- a/content/browser/indexed_db/indexed_db_context_impl.cc
+++ b/content/browser/indexed_db/indexed_db_context_impl.cc
@@ -89,8 +89,8 @@
     : force_keep_session_state_(false),
       special_storage_policy_(special_storage_policy),
       quota_manager_proxy_(quota_manager_proxy),
-      task_runner_(base::CreateSequencedTaskRunnerWithTraits(
-          {base::MayBlock(), base::WithBaseSyncPrimitives(),
+      task_runner_(base::CreateSequencedTaskRunner(
+          {base::ThreadPool(), base::MayBlock(), base::WithBaseSyncPrimitives(),
            base::TaskPriority::USER_VISIBLE,
            // BLOCK_SHUTDOWN to support clearing session-only storage.
            base::TaskShutdownBehavior::BLOCK_SHUTDOWN})),
diff --git a/content/browser/indexed_db/indexed_db_dispatcher_host_unittest.cc b/content/browser/indexed_db/indexed_db_dispatcher_host_unittest.cc
index 0cb1e5a7..6542d66e 100644
--- a/content/browser/indexed_db/indexed_db_dispatcher_host_unittest.cc
+++ b/content/browser/indexed_db/indexed_db_dispatcher_host_unittest.cc
@@ -184,7 +184,7 @@
         quota_manager_(base::MakeRefCounted<MockQuotaManager>(
             false /*is_incognito*/,
             browser_context_.GetPath(),
-            base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO}),
+            base::CreateSingleThreadTaskRunner({BrowserThread::IO}),
             special_storage_policy_)),
         context_impl_(base::MakeRefCounted<IndexedDBContextImpl>(
             CreateAndReturnTempDir(&temp_dir_),
diff --git a/content/browser/indexed_db/indexed_db_internals_ui.cc b/content/browser/indexed_db/indexed_db_internals_ui.cc
index d280fa2f..e4a348ca3 100644
--- a/content/browser/indexed_db/indexed_db_internals_ui.cc
+++ b/content/browser/indexed_db/indexed_db_internals_ui.cc
@@ -119,7 +119,7 @@
       context_impl->GetAllOriginsDetails());
   bool is_incognito = context_impl->is_incognito();
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&IndexedDBInternalsUI::OnOriginsReady,
                      base::Unretained(this), std::move(info_list),
@@ -261,11 +261,10 @@
   zip::ZipWithFilterCallback(context->data_path(), zip_path,
                              base::Bind(AllowWhitelistedPaths, paths));
 
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::UI},
-      base::BindOnce(&IndexedDBInternalsUI::OnDownloadDataReady,
-                     base::Unretained(this), partition_path, origin, temp_path,
-                     zip_path, connection_count));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(&IndexedDBInternalsUI::OnDownloadDataReady,
+                                base::Unretained(this), partition_path, origin,
+                                temp_path, zip_path, connection_count));
 }
 
 void IndexedDBInternalsUI::ForceCloseOriginOnIndexedDBThread(
@@ -281,11 +280,10 @@
   context->ForceClose(origin, IndexedDBContextImpl::FORCE_CLOSE_INTERNALS_PAGE);
   size_t connection_count = context->GetConnectionCount(origin);
 
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::UI},
-      base::BindOnce(&IndexedDBInternalsUI::OnForcedSchemaDowngrade,
-                     base::Unretained(this), partition_path, origin,
-                     connection_count));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(&IndexedDBInternalsUI::OnForcedSchemaDowngrade,
+                                base::Unretained(this), partition_path, origin,
+                                connection_count));
 }
 
 void IndexedDBInternalsUI::ForceSchemaDowngradeOriginOnIndexedDBThread(
@@ -303,11 +301,10 @@
       origin, IndexedDBContextImpl::FORCE_SCHEMA_DOWNGRADE_INTERNALS_PAGE);
   size_t connection_count = context->GetConnectionCount(origin);
 
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::UI},
-      base::BindOnce(&IndexedDBInternalsUI::OnForcedSchemaDowngrade,
-                     base::Unretained(this), partition_path, origin,
-                     connection_count));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(&IndexedDBInternalsUI::OnForcedSchemaDowngrade,
+                                base::Unretained(this), partition_path, origin,
+                                connection_count));
 }
 
 void IndexedDBInternalsUI::OnForcedClose(const base::FilePath& partition_path,
@@ -415,11 +412,12 @@
 }
 
 FileDeleter::~FileDeleter() {
-  base::PostTaskWithTraits(FROM_HERE,
-                           {base::MayBlock(), base::TaskPriority::BEST_EFFORT,
-                            base::TaskShutdownBehavior::BLOCK_SHUTDOWN},
-                           base::BindOnce(base::IgnoreResult(&base::DeleteFile),
-                                          std::move(temp_dir_), true));
+  base::PostTask(
+      FROM_HERE,
+      {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT,
+       base::TaskShutdownBehavior::BLOCK_SHUTDOWN},
+      base::BindOnce(base::IgnoreResult(&base::DeleteFile),
+                     std::move(temp_dir_), true));
 }
 
 void IndexedDBInternalsUI::OnDownloadStarted(
diff --git a/content/browser/indexed_db/scopes/leveldb_scopes.cc b/content/browser/indexed_db/scopes/leveldb_scopes.cc
index 2f6da7ff..c4ed13a 100644
--- a/content/browser/indexed_db/scopes/leveldb_scopes.cc
+++ b/content/browser/indexed_db/scopes/leveldb_scopes.cc
@@ -184,12 +184,12 @@
   // reasonably soon.
   switch (mode) {
     case TaskRunnerMode::kNewCleanupAndRevertSequences:
-      revert_runner_ = base::CreateSequencedTaskRunnerWithTraits(
-          {base::MayBlock(), base::WithBaseSyncPrimitives(),
+      revert_runner_ = base::CreateSequencedTaskRunner(
+          {base::ThreadPool(), base::MayBlock(), base::WithBaseSyncPrimitives(),
            base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN,
            base::TaskPriority::USER_BLOCKING});
-      cleanup_runner_ = base::CreateSequencedTaskRunnerWithTraits(
-          {base::MayBlock(), base::WithBaseSyncPrimitives(),
+      cleanup_runner_ = base::CreateSequencedTaskRunner(
+          {base::ThreadPool(), base::MayBlock(), base::WithBaseSyncPrimitives(),
            base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN,
            base::TaskPriority::USER_VISIBLE});
       break;
diff --git a/content/browser/indexed_db/transaction_impl.cc b/content/browser/indexed_db/transaction_impl.cc
index 794ce15..dee4c60 100644
--- a/content/browser/indexed_db/transaction_impl.cc
+++ b/content/browser/indexed_db/transaction_impl.cc
@@ -161,7 +161,7 @@
     // |io_helper_| is owned by |this| and this call is synchronized with a
     // WaitableEvent, so |io_helper_| is guaranteed to remain alive throughout
     // the duration of the LoadBlobsOnIOThread() invocation.
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&TransactionImpl::IOHelper::LoadBlobsOnIOThread,
                        base::Unretained(io_helper_.get()), std::move(value_ptr),
diff --git a/content/browser/interface_provider_filtering.cc b/content/browser/interface_provider_filtering.cc
index 27a4f97..0eb8a8f 100644
--- a/content/browser/interface_provider_filtering.cc
+++ b/content/browser/interface_provider_filtering.cc
@@ -51,10 +51,9 @@
   service_manager::mojom::InterfaceProviderPtr provider;
   auto filtered_request = mojo::MakeRequest(&provider);
   if (!BrowserThread::CurrentlyOn(BrowserThread::UI)) {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::UI},
-        base::BindOnce(&FilterInterfacesImpl, spec, process_id,
-                       std::move(request), std::move(provider)));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(&FilterInterfacesImpl, spec, process_id,
+                                  std::move(request), std::move(provider)));
   } else {
     FilterInterfacesImpl(spec, process_id, std::move(request),
                          std::move(provider));
diff --git a/content/browser/loader/cross_origin_read_blocking_checker.cc b/content/browser/loader/cross_origin_read_blocking_checker.cc
index e98febff..7bbf739cf 100644
--- a/content/browser/loader/cross_origin_read_blocking_checker.cc
+++ b/content/browser/loader/cross_origin_read_blocking_checker.cc
@@ -119,10 +119,9 @@
     if (NavigationURLLoaderImpl::IsNavigationLoaderOnUIEnabled()) {
       // base::Unretained is safe because |blob_io_state_| will be deleted on
       // the IO thread.
-      base::PostTaskWithTraits(
-          FROM_HERE, {BrowserThread::IO},
-          base::BindOnce(&BlobIOState::StartSniffing,
-                         base::Unretained(blob_io_state_.get())));
+      base::PostTask(FROM_HERE, {BrowserThread::IO},
+                     base::BindOnce(&BlobIOState::StartSniffing,
+                                    base::Unretained(blob_io_state_.get())));
     } else {
       blob_io_state_->StartSniffing();
     }
diff --git a/content/browser/loader/loader_browsertest.cc b/content/browser/loader/loader_browsertest.cc
index 4fd3d38..bcad745 100644
--- a/content/browser/loader/loader_browsertest.cc
+++ b/content/browser/loader/loader_browsertest.cc
@@ -66,12 +66,11 @@
  protected:
   void SetUpOnMainThread() override {
     base::FilePath path = GetTestFilePath("", "");
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&net::URLRequestMockHTTPJob::AddUrlHandlers, path));
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(&net::URLRequestFailedJob::AddUrlHandler));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&net::URLRequestFailedJob::AddUrlHandler));
     host_resolver()->AddRule("*", "127.0.0.1");
   }
 
@@ -285,8 +284,8 @@
   if (request.relative_url != relative_url)
     return nullptr;
 
-  base::PostTaskWithTraits(FROM_HERE, {content::BrowserThread::UI},
-                           crash_network_service_callback);
+  base::PostTask(FROM_HERE, {content::BrowserThread::UI},
+                 crash_network_service_callback);
 
   return std::make_unique<net::test_server::HungResponse>();
 }
diff --git a/content/browser/loader/navigation_url_loader_impl.cc b/content/browser/loader/navigation_url_loader_impl.cc
index d845bf06..1c8a8c7 100644
--- a/content/browser/loader/navigation_url_loader_impl.cc
+++ b/content/browser/loader/navigation_url_loader_impl.cc
@@ -279,7 +279,7 @@
     return;
   }
 
-  base::PostTaskWithTraits(from_here, {thread_id}, std::move(task));
+  base::PostTask(from_here, {thread_id}, std::move(task));
 }
 
 }  // namespace
@@ -381,10 +381,9 @@
     navigation_ui_data_ = std::move(navigation_ui_data);
     service_worker_navigation_handle_ = service_worker_navigation_handle;
 
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::UI},
-        base::BindOnce(&NavigationURLLoaderImpl::OnRequestStarted, owner_,
-                       base::TimeTicks::Now()));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(&NavigationURLLoaderImpl::OnRequestStarted,
+                                  owner_, base::TimeTicks::Now()));
 
     DCHECK(network_loader_factory_info);
     network_loader_factory_ = network::SharedURLLoaderFactory::Create(
@@ -1074,7 +1073,7 @@
     // TODO(davidben): This copy could be avoided if ResourceResponse weren't
     // reference counted and the loader stack passed unique ownership of the
     // response. https://crbug.com/416050
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&NavigationURLLoaderImpl::OnReceiveRedirect, owner_,
                        redirect_info, response->DeepCopy(), base::Time::Now()));
@@ -1141,7 +1140,7 @@
     }
 
     status_ = status;
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&NavigationURLLoaderImpl::OnComplete, owner_, status));
   }
@@ -1185,7 +1184,7 @@
             service_worker_provider_host_->UpdateUrls(GURL(), GURL());
           } else if (service_worker_navigation_handle_) {
             DCHECK(NavigationURLLoaderImpl::IsNavigationLoaderOnUIEnabled());
-            base::PostTaskWithTraits(
+            base::PostTask(
                 FROM_HERE, {BrowserThread::IO},
                 base::BindOnce(
                     [](base::WeakPtr<ServiceWorkerProviderHost> host) {
@@ -1478,10 +1477,10 @@
 
 #if defined(OS_ANDROID)
   non_network_url_loader_factories_[url::kContentScheme] =
-      std::make_unique<ContentURLLoaderFactory>(
-          base::CreateSequencedTaskRunnerWithTraits(
-              {base::MayBlock(), base::TaskPriority::BEST_EFFORT,
-               base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN}));
+      std::make_unique<ContentURLLoaderFactory>(base::CreateSequencedTaskRunner(
+          {base::ThreadPool(), base::MayBlock(),
+           base::TaskPriority::BEST_EFFORT,
+           base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN}));
 #endif
 
   std::set<std::string> known_schemes;
diff --git a/content/browser/loader/prefetch_browsertest_base.cc b/content/browser/loader/prefetch_browsertest_base.cc
index 43b8c54..dc95ba2 100644
--- a/content/browser/loader/prefetch_browsertest_base.cc
+++ b/content/browser/loader/prefetch_browsertest_base.cc
@@ -63,7 +63,7 @@
             &PrefetchBrowserTestBase::OnPrefetchURLLoaderCalled,
             base::Unretained(this)));
   } else {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(
             &PrefetchURLLoaderService::RegisterPrefetchLoaderCallbackForTest,
diff --git a/content/browser/manifest/manifest_icon_downloader.cc b/content/browser/manifest/manifest_icon_downloader.cc
index a627fe2..111a5f7 100644
--- a/content/browser/manifest/manifest_icon_downloader.cc
+++ b/content/browser/manifest/manifest_icon_downloader.cc
@@ -123,11 +123,10 @@
   // webapp storage system as well.
   if (chosen.height() > ideal_icon_size_in_px ||
       chosen.width() > ideal_icon_width_in_px) {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(&ManifestIconDownloader::ScaleIcon,
-                       ideal_icon_width_in_px, ideal_icon_size_in_px, chosen,
-                       std::move(callback)));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&ManifestIconDownloader::ScaleIcon,
+                                  ideal_icon_width_in_px, ideal_icon_size_in_px,
+                                  chosen, std::move(callback)));
     return;
   }
 
@@ -144,8 +143,8 @@
       bitmap, skia::ImageOperations::RESIZE_BEST, ideal_icon_width_in_px,
       ideal_icon_height_in_px);
 
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                           base::BindOnce(std::move(callback), scaled));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(std::move(callback), scaled));
 }
 
 int ManifestIconDownloader::FindClosestBitmapIndex(
diff --git a/content/browser/media/android/media_player_renderer.cc b/content/browser/media/android/media_player_renderer.cc
index 5d684852..a93d75a 100644
--- a/content/browser/media/android/media_player_renderer.cc
+++ b/content/browser/media/android/media_player_renderer.cc
@@ -95,7 +95,7 @@
     return;
   }
 
-  base::PostDelayedTaskWithTraits(
+  base::PostDelayedTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&MediaPlayerRenderer::CreateMediaPlayer,
                      weak_factory_.GetWeakPtr(),
diff --git a/content/browser/media/android/media_resource_getter_impl.cc b/content/browser/media/android/media_resource_getter_impl.cc
index 5bf938f..100a9eca 100644
--- a/content/browser/media/android/media_resource_getter_impl.cc
+++ b/content/browser/media/android/media_resource_getter_impl.cc
@@ -55,16 +55,16 @@
 void ReturnResultOnUIThread(
     base::OnceCallback<void(const std::string&)> callback,
     const std::string& result) {
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                           base::BindOnce(std::move(callback), result));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(std::move(callback), result));
 }
 
 void ReturnResultOnUIThreadAndClosePipe(
     network::mojom::RestrictedCookieManagerPtr pipe,
     base::OnceCallback<void(const std::string&)> callback,
     const std::string& result) {
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                           base::BindOnce(std::move(callback), result));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(std::move(callback), result));
 }
 
 void OnSyncGetPlatformPathDone(
diff --git a/content/browser/media/audio_input_stream_broker.cc b/content/browser/media/audio_input_stream_broker.cc
index 31d686ff..0189a68 100644
--- a/content/browser/media/audio_input_stream_broker.cc
+++ b/content/browser/media/audio_input_stream_broker.cc
@@ -39,9 +39,8 @@
 
 void UpdateKeyboardMicRegistration(KeyboardMicAction action) {
   if (!BrowserThread::CurrentlyOn(BrowserThread::UI)) {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::UI},
-        base::BindOnce(&UpdateKeyboardMicRegistration, action));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(&UpdateKeyboardMicRegistration, action));
     return;
   }
   BrowserMainLoop* browser_main_loop = BrowserMainLoop::GetInstance();
diff --git a/content/browser/media/audio_stream_broker.cc b/content/browser/media/audio_stream_broker.cc
index 875d810e..ed153e4 100644
--- a/content/browser/media/audio_stream_broker.cc
+++ b/content/browser/media/audio_stream_broker.cc
@@ -95,8 +95,8 @@
     if (auto* process_host = RenderProcessHost::FromID(id))
       process_host->OnMediaStreamAdded();
   };
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                           base::BindOnce(impl, render_process_id));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(impl, render_process_id));
 }
 
 // static
@@ -106,8 +106,8 @@
     if (auto* process_host = RenderProcessHost::FromID(id))
       process_host->OnMediaStreamRemoved();
   };
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                           base::BindOnce(impl, render_process_id));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(impl, render_process_id));
 }
 
 AudioStreamBrokerFactory::AudioStreamBrokerFactory() {}
diff --git a/content/browser/media/audio_stream_monitor.cc b/content/browser/media/audio_stream_monitor.cc
index 35d95f3..17125d9 100644
--- a/content/browser/media/audio_stream_monitor.cc
+++ b/content/browser/media/audio_stream_monitor.cc
@@ -84,7 +84,7 @@
 void AudioStreamMonitor::StartMonitoringStream(int render_process_id,
                                                int render_frame_id,
                                                int stream_id) {
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(
           [](const StreamID& sid) {
@@ -100,7 +100,7 @@
 void AudioStreamMonitor::StopMonitoringStream(int render_process_id,
                                               int render_frame_id,
                                               int stream_id) {
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(
           [](const StreamID& sid) {
@@ -117,7 +117,7 @@
                                                   int render_frame_id,
                                                   int stream_id,
                                                   bool is_audible) {
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(
           [](const StreamID& sid, bool is_audible) {
diff --git a/content/browser/media/forwarding_audio_stream_factory.cc b/content/browser/media/forwarding_audio_stream_factory.cc
index 0ac9c15d..141b5e0 100644
--- a/content/browser/media/forwarding_audio_stream_factory.cc
+++ b/content/browser/media/forwarding_audio_stream_factory.cc
@@ -158,7 +158,7 @@
     AudioStreamBroker::LoopbackSink* sink) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   loopback_sinks_.insert(sink);
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&ForwardingAudioStreamFactory::LoopbackStreamStarted,
                      owner_));
@@ -168,7 +168,7 @@
     AudioStreamBroker::LoopbackSink* sink) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   loopback_sinks_.erase(sink);
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&ForwardingAudioStreamFactory::LoopbackStreamStopped,
                      owner_));
@@ -219,7 +219,7 @@
   // as it doesn't post in case it is already executed on the right thread. That
   // causes issues in unit tests where the UI thread and the IO thread are the
   // same.
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce([](std::unique_ptr<Core>) {}, std::move(core_)));
 }
@@ -241,7 +241,7 @@
 
     // Unretained is safe since the destruction of |core_| will be posted to the
     // IO thread later.
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&Core::SetMuted, base::Unretained(core_.get()), muted));
   }
@@ -259,12 +259,11 @@
 
   // Unretained is safe since the destruction of |core_| will be posted to the
   // IO thread later.
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&Core::CleanupStreamsBelongingTo,
-                     base::Unretained(core_.get()),
-                     render_frame_host->GetProcess()->GetID(),
-                     render_frame_host->GetRoutingID()));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&Core::CleanupStreamsBelongingTo,
+                                base::Unretained(core_.get()),
+                                render_frame_host->GetProcess()->GetID(),
+                                render_frame_host->GetRoutingID()));
 }
 
 void ForwardingAudioStreamFactory::Core::CleanupStreamsBelongingTo(
diff --git a/content/browser/media/in_process_audio_loopback_stream_creator.cc b/content/browser/media/in_process_audio_loopback_stream_creator.cc
index 981c0edc..eaf99f8 100644
--- a/content/browser/media/in_process_audio_loopback_stream_creator.cc
+++ b/content/browser/media/in_process_audio_loopback_stream_creator.cc
@@ -122,17 +122,16 @@
   // Deletion of factory_.core() is posted to the IO thread when |factory_| is
   // destroyed, so Unretained is safe below.
   if (loopback_source) {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(&CreateLoopbackStreamHelper, factory_.core(),
-                       static_cast<WebContentsImpl*>(loopback_source)
-                           ->GetAudioStreamFactory()
-                           ->core(),
-                       params, total_segments, std::move(client)));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&CreateLoopbackStreamHelper, factory_.core(),
+                                  static_cast<WebContentsImpl*>(loopback_source)
+                                      ->GetAudioStreamFactory()
+                                      ->core(),
+                                  params, total_segments, std::move(client)));
     return;
   }
   // A null |frame_of_source_web_contents| requests system-wide loopback.
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&CreateSystemWideLoopbackStreamHelper, factory_.core(),
                      params, total_segments, std::move(client)));
diff --git a/content/browser/media/media_devices_permission_checker.cc b/content/browser/media/media_devices_permission_checker.cc
index 24d7727..f3fcd75 100644
--- a/content/browser/media/media_devices_permission_checker.cc
+++ b/content/browser/media/media_devices_permission_checker.cc
@@ -117,7 +117,7 @@
     return;
   }
 
-  base::PostTaskWithTraitsAndReplyWithResult(
+  base::PostTaskAndReplyWithResult(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&CheckSinglePermissionOnUIThread, device_type,
                      render_process_id, render_frame_id),
@@ -137,7 +137,7 @@
     return;
   }
 
-  base::PostTaskWithTraitsAndReplyWithResult(
+  base::PostTaskAndReplyWithResult(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&DoCheckPermissionsOnUIThread, requested,
                      render_process_id, render_frame_id),
diff --git a/content/browser/media/media_devices_util.cc b/content/browser/media/media_devices_util.cc
index 1369712..e715618 100644
--- a/content/browser/media/media_devices_util.cc
+++ b/content/browser/media/media_devices_util.cc
@@ -120,7 +120,7 @@
     }
   }
 
-  base::PostTaskWithTraitsAndReplyWithResult(
+  base::PostTaskAndReplyWithResult(
       FROM_HERE, {BrowserThread::UI},
       base::Bind(&GetDefaultMediaDeviceIDOnUIThread, device_type,
                  render_process_id, render_frame_id),
diff --git a/content/browser/media/media_internals.cc b/content/browser/media/media_internals.cc
index e9c9d4f..f1895dd5 100644
--- a/content/browser/media/media_internals.cc
+++ b/content/browser/media/media_internals.cc
@@ -262,7 +262,7 @@
     int render_frame_id) {
   // Page title information can only be retrieved from the UI thread.
   if (!BrowserThread::CurrentlyOn(BrowserThread::UI)) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&SendWebContentsTitleHelper, cache_key, std::move(dict),
                        render_process_id, render_frame_id));
@@ -559,9 +559,9 @@
 void MediaInternals::SendUpdate(const base::string16& update) {
   // SendUpdate() may be called from any thread, but must run on the UI thread.
   if (!BrowserThread::CurrentlyOn(BrowserThread::UI)) {
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                             base::BindOnce(&MediaInternals::SendUpdate,
-                                            base::Unretained(this), update));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(&MediaInternals::SendUpdate,
+                                  base::Unretained(this), update));
     return;
   }
 
diff --git a/content/browser/media/media_internals_audio_focus_helper.cc b/content/browser/media/media_internals_audio_focus_helper.cc
index 4b90a36..a22e0cdc 100644
--- a/content/browser/media/media_internals_audio_focus_helper.cc
+++ b/content/browser/media/media_internals_audio_focus_helper.cc
@@ -68,7 +68,7 @@
     media_session::mojom::AudioFocusRequestStatePtr session) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&MediaInternalsAudioFocusHelper::SendAudioFocusState,
                      base::Unretained(this)));
@@ -78,7 +78,7 @@
     media_session::mojom::AudioFocusRequestStatePtr session) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&MediaInternalsAudioFocusHelper::SendAudioFocusState,
                      base::Unretained(this)));
diff --git a/content/browser/media/media_internals_proxy.cc b/content/browser/media/media_internals_proxy.cc
index bfa38b2..d8157702 100644
--- a/content/browser/media/media_internals_proxy.cc
+++ b/content/browser/media/media_internals_proxy.cc
@@ -45,7 +45,7 @@
 #endif
 
   // Ask MediaInternals for its data on IO thread.
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&MediaInternalsProxy::GetEverythingOnIOThread, this));
 }
diff --git a/content/browser/media/midi_host.cc b/content/browser/media/midi_host.cc
index b79d272..1e9c2138 100644
--- a/content/browser/media/midi_host.cc
+++ b/content/browser/media/midi_host.cc
@@ -235,10 +235,9 @@
 template <typename Method, typename... Params>
 void MidiHost::CallClient(Method method, Params... params) {
   if (!BrowserThread::CurrentlyOn(BrowserThread::IO)) {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(&MidiHost::CallClient<Method, Params...>, AsWeakPtr(),
-                       method, std::move(params)...));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&MidiHost::CallClient<Method, Params...>,
+                                  AsWeakPtr(), method, std::move(params)...));
     return;
   }
   (midi_client_.get()->*method)(std::move(params)...);
diff --git a/content/browser/mojo_sandbox_browsertest.cc b/content/browser/mojo_sandbox_browsertest.cc
index d36c83d..ed9218e 100644
--- a/content/browser/mojo_sandbox_browsertest.cc
+++ b/content/browser/mojo_sandbox_browsertest.cc
@@ -29,7 +29,7 @@
 
   void SetUpOnMainThread() override {
     base::RunLoop run_loop;
-    base::PostTaskWithTraitsAndReply(
+    base::PostTaskAndReply(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&MojoSandboxTest::StartUtilityProcessOnIoThread,
                        base::Unretained(this)),
@@ -39,7 +39,7 @@
 
   void TearDownOnMainThread() override {
     base::RunLoop run_loop;
-    base::PostTaskWithTraitsAndReply(
+    base::PostTaskAndReply(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&MojoSandboxTest::StopUtilityProcessOnIoThread,
                        base::Unretained(this)),
diff --git a/content/browser/native_file_system/file_system_chooser.cc b/content/browser/native_file_system/file_system_chooser.cc
index 5f0bc2d..41a6221 100644
--- a/content/browser/native_file_system/file_system_chooser.cc
+++ b/content/browser/native_file_system/file_system_chooser.cc
@@ -160,8 +160,10 @@
     // TODO(mek): If we change FileSystemFileHandle to be able to represent a
     // file that doesn't exist on disk, we should be able to get rid of this
     // step and make the whole API slightly more robust.
-    base::PostTaskWithTraits(
-        FROM_HERE, {base::TaskPriority::USER_BLOCKING, base::MayBlock()},
+    base::PostTask(
+        FROM_HERE,
+        {base::ThreadPool(), base::TaskPriority::USER_BLOCKING,
+         base::MayBlock()},
         base::BindOnce(
             [](const std::vector<base::FilePath>& files,
                scoped_refptr<base::TaskRunner> callback_runner,
diff --git a/content/browser/native_file_system/native_file_system_handle_base.cc b/content/browser/native_file_system/native_file_system_handle_base.cc
index 8e68957d..44d1b69 100644
--- a/content/browser/native_file_system/native_file_system_handle_base.cc
+++ b/content/browser/native_file_system/native_file_system_handle_base.cc
@@ -119,7 +119,7 @@
       }
     }
     usage_indicator_tracker_ = base::SequenceBound<UsageIndicatorTracker>(
-        base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::UI}),
+        base::CreateSingleThreadTaskRunner({BrowserThread::UI}),
         context_.process_id, context_.frame_id, bool{is_directory},
         base::FilePath(directory_path));
     UpdateUsage();
diff --git a/content/browser/native_file_system/native_file_system_manager_impl.cc b/content/browser/native_file_system/native_file_system_manager_impl.cc
index 1b166c4d3..b98b802 100644
--- a/content/browser/native_file_system/native_file_system_manager_impl.cc
+++ b/content/browser/native_file_system/native_file_system_manager_impl.cc
@@ -142,11 +142,10 @@
   }
 
   auto* manager = storage_partition->GetNativeFileSystemManager();
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&NativeFileSystemManagerImpl::BindRequest,
-                     base::Unretained(manager), binding_context,
-                     std::move(request)));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&NativeFileSystemManagerImpl::BindRequest,
+                                base::Unretained(manager), binding_context,
+                                std::move(request)));
 }
 
 void NativeFileSystemManagerImpl::GetSandboxedFileSystem(
@@ -179,7 +178,7 @@
 
   FileSystemChooser::Options options(type, std::move(accepts),
                                      include_accepts_all);
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(
           &ShowFilePickerOnUIThread, context.origin, context.process_id,
@@ -187,7 +186,7 @@
           base::BindOnce(&NativeFileSystemManagerImpl::DidChooseEntries,
                          weak_factory_.GetWeakPtr(), context, options,
                          std::move(callback)),
-          base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO})));
+          base::CreateSingleThreadTaskRunner({BrowserThread::IO})));
 }
 
 blink::mojom::NativeFileSystemEntryPtr
@@ -406,7 +405,7 @@
     return;
   }
   if (result == SensitiveDirectoryResult::kTryAgain) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(
             &ShowFilePickerOnUIThread, binding_context.origin,
@@ -414,7 +413,7 @@
             base::BindOnce(&NativeFileSystemManagerImpl::DidChooseEntries,
                            weak_factory_.GetWeakPtr(), binding_context, options,
                            std::move(callback)),
-            base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO})));
+            base::CreateSingleThreadTaskRunner({BrowserThread::IO})));
     return;
   }
 
diff --git a/content/browser/navigation_browsertest.cc b/content/browser/navigation_browsertest.cc
index 783b5ec..fd1c4542 100644
--- a/content/browser/navigation_browsertest.cc
+++ b/content/browser/navigation_browsertest.cc
@@ -484,9 +484,8 @@
   {
     TestNavigationObserver observer(shell()->web_contents());
     GURL error_url(embedded_test_server()->GetURL("/close-socket"));
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(&net::URLRequestFailedJob::AddUrlHandler));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&net::URLRequestFailedJob::AddUrlHandler));
     NavigateToURL(shell(), error_url);
     EXPECT_EQ(error_url, observer.last_navigation_url());
     NavigationEntry* entry =
diff --git a/content/browser/net/quota_policy_cookie_store.cc b/content/browser/net/quota_policy_cookie_store.cc
index 85a9fec..159c97b 100644
--- a/content/browser/net/quota_policy_cookie_store.cc
+++ b/content/browser/net/quota_policy_cookie_store.cc
@@ -82,12 +82,13 @@
 
     if (!client_task_runner.get()) {
       client_task_runner =
-          base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO});
+          base::CreateSingleThreadTaskRunner({BrowserThread::IO});
     }
 
     if (!background_task_runner.get()) {
-      background_task_runner = base::CreateSequencedTaskRunnerWithTraits(
-          {base::MayBlock(), net::GetCookieStoreBackgroundSequencePriority(),
+      background_task_runner = base::CreateSequencedTaskRunner(
+          {base::ThreadPool(), base::MayBlock(),
+           net::GetCookieStoreBackgroundSequencePriority(),
            base::TaskShutdownBehavior::BLOCK_SHUTDOWN});
     }
 
diff --git a/content/browser/net/quota_policy_cookie_store_unittest.cc b/content/browser/net/quota_policy_cookie_store_unittest.cc
index eda510f1..6dead69 100644
--- a/content/browser/net/quota_policy_cookie_store_unittest.cc
+++ b/content/browser/net/quota_policy_cookie_store_unittest.cc
@@ -77,7 +77,8 @@
     scoped_refptr<net::SQLitePersistentCookieStore> sqlite_store(
         new net::SQLitePersistentCookieStore(
             temp_dir_.GetPath().Append(kTestCookiesFilename),
-            base::CreateSequencedTaskRunnerWithTraits({base::MayBlock()}),
+            base::CreateSequencedTaskRunner(
+                {base::ThreadPool(), base::MayBlock()}),
             background_task_runner_, true, nullptr));
     store_ = new QuotaPolicyCookieStore(sqlite_store.get(), storage_policy);
     Load(cookies);
@@ -111,7 +112,7 @@
 
   TestBrowserThreadBundle bundle_;
   const scoped_refptr<base::SequencedTaskRunner> background_task_runner_ =
-      base::CreateSequencedTaskRunnerWithTraits({base::MayBlock()});
+      base::CreateSequencedTaskRunner({base::ThreadPool(), base::MayBlock()});
   base::WaitableEvent loaded_event_;
   base::WaitableEvent destroy_event_;
   base::ScopedTempDir temp_dir_;
diff --git a/content/browser/network_service_client.cc b/content/browser/network_service_client.cc
index 03c12f9..7a52f40 100644
--- a/content/browser/network_service_client.cc
+++ b/content/browser/network_service_client.cc
@@ -167,7 +167,7 @@
     auto continue_after_inteceptor_io =
         base::BindOnce(&LoginHandlerDelegate::ContinueAfterInterceptorIO,
                        weak_factory_.GetWeakPtr());
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&DevToolsURLLoaderInterceptor::HandleAuthRequest,
                        request_id_.child_id, routing_id_,
@@ -188,7 +188,7 @@
       bool use_fallback,
       const base::Optional<net::AuthCredentials>& auth_credentials) {
     DCHECK_CURRENTLY_ON(BrowserThread::IO);
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&LoginHandlerDelegate::ContinueAfterInterceptorUI,
                        std::move(self_weak), use_fallback, auth_credentials));
@@ -364,7 +364,7 @@
     std::move(auth_challenge_responder)->OnAuthCredentials(base::nullopt);
     return;
   }
-  base::PostTaskWithTraitsAndReplyWithResult(
+  base::PostTaskAndReplyWithResult(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&GetWebContentsFromRegistry, window_id),
       base::BindOnce(&OnAuthRequiredContinuation, process_id, routing_id,
@@ -405,7 +405,7 @@
     return;
   }
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&CreateSSLClientAuthDelegateOnIO,
                      std::move(client_cert_responder_info),
@@ -488,7 +488,7 @@
     const base::Optional<network::ResourceResponseHead>& head,
     network::mojom::AuthChallengeResponderPtr auth_challenge_responder) {
   if (window_id) {
-    base::PostTaskWithTraitsAndReplyWithResult(
+    base::PostTaskAndReplyWithResult(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&GetIsMainFrameFromRegistry, *window_id),
         base::BindOnce(&OnAuthRequiredContinuationForWindowId, *window_id,
@@ -512,7 +512,7 @@
     network::mojom::ClientCertificateResponderPtr cert_responder) {
   // Use |window_id| if it's provided.
   if (window_id) {
-    base::PostTaskWithTraitsAndReplyWithResult(
+    base::PostTaskAndReplyWithResult(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&GetWebContentsFromRegistry, *window_id),
         base::BindOnce(&OnCertificateRequestedContinuation, process_id,
@@ -555,8 +555,9 @@
     bool async,
     const std::vector<base::FilePath>& file_paths,
     OnFileUploadRequestedCallback callback) {
-  base::PostTaskWithTraits(
-      FROM_HERE, {base::MayBlock(), base::TaskPriority::USER_BLOCKING},
+  base::PostTask(
+      FROM_HERE,
+      {base::ThreadPool(), base::MayBlock(), base::TaskPriority::USER_BLOCKING},
       base::BindOnce(&HandleFileUploadRequest, process_id, async, file_paths,
                      std::move(callback),
                      base::SequencedTaskRunnerHandle::Get()));
diff --git a/content/browser/network_service_instance_impl.cc b/content/browser/network_service_instance_impl.cc
index d19639b5..0b54ba6 100644
--- a/content/browser/network_service_instance_impl.cc
+++ b/content/browser/network_service_instance_impl.cc
@@ -186,7 +186,7 @@
         g_network_service_ptr->set_connection_error_handler(
             base::BindOnce(&OnNetworkServiceCrash));
       } else {
-        base::PostTaskWithTraits(
+        base::PostTask(
             FROM_HERE, {BrowserThread::IO},
             base::BindOnce(CreateNetworkServiceOnIO,
                            mojo::MakeRequest(g_network_service_ptr)));
@@ -304,7 +304,7 @@
     return;
   }
 
-  base::PostTaskWithTraitsAndReplyWithResult(
+  base::PostTaskAndReplyWithResult(
       FROM_HERE, {BrowserThread::UI, base::TaskPriority::BEST_EFFORT},
       base::BindOnce(&GetNetworkConnectionTracker), std::move(callback));
 }
diff --git a/content/browser/payments/payment_app_context_impl.cc b/content/browser/payments/payment_app_context_impl.cc
index 3d064815..8b12d2e 100644
--- a/content/browser/payments/payment_app_context_impl.cc
+++ b/content/browser/payments/payment_app_context_impl.cc
@@ -25,7 +25,7 @@
   DCHECK(!did_shutdown_on_io_.IsSet());
 #endif
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&PaymentAppContextImpl::CreatePaymentAppDatabaseOnIO, this,
                      service_worker_context));
@@ -38,16 +38,15 @@
   // IO thread. When the last reference to |this| is released, |this| is
   // automatically scheduled for deletion on the UI thread (see
   // content::BrowserThread::DeleteOnUIThread in the header file).
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&PaymentAppContextImpl::ShutdownOnIO, this));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&PaymentAppContextImpl::ShutdownOnIO, this));
 }
 
 void PaymentAppContextImpl::CreatePaymentManager(
     payments::mojom::PaymentManagerRequest request) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&PaymentAppContextImpl::CreatePaymentManagerOnIO, this,
                      std::move(request)));
diff --git a/content/browser/payments/payment_app_info_fetcher.cc b/content/browser/payments/payment_app_info_fetcher.cc
index 2ccd84c6..b3d4989 100644
--- a/content/browser/payments/payment_app_info_fetcher.cc
+++ b/content/browser/payments/payment_app_info_fetcher.cc
@@ -38,7 +38,7 @@
   std::unique_ptr<std::vector<GlobalFrameRoutingId>> provider_hosts =
       service_worker_context->GetProviderHostIds(context_url.GetOrigin());
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&PaymentAppInfoFetcher::StartOnUI, context_url,
                      std::move(provider_hosts), std::move(callback)));
@@ -166,10 +166,9 @@
 void PaymentAppInfoFetcher::SelfDeleteFetcher::RunCallbackAndDestroy() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(std::move(callback_),
-                     std::move(fetched_payment_app_info_)));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(std::move(callback_),
+                                std::move(fetched_payment_app_info_)));
   delete this;
 }
 
diff --git a/content/browser/payments/payment_app_installer.cc b/content/browser/payments/payment_app_installer.cc
index c2ee504cd..c1cfdff 100644
--- a/content/browser/payments/payment_app_installer.cc
+++ b/content/browser/payments/payment_app_installer.cc
@@ -138,7 +138,7 @@
     scoped_refptr<PaymentAppContextImpl> payment_app_context =
         partition->GetPaymentAppContext();
 
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&SelfDeleteInstaller::SetPaymentAppInfoOnIO, this,
                        payment_app_context, registration_id_, scope_.spec(),
@@ -163,7 +163,7 @@
   void OnSetPaymentAppInfo(payments::mojom::PaymentHandlerStatus status) {
     DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&SelfDeleteInstaller::FinishInstallation, this,
                        status == payments::mojom::PaymentHandlerStatus::SUCCESS
diff --git a/content/browser/payments/payment_app_provider_impl.cc b/content/browser/payments/payment_app_provider_impl.cc
index f6a4b3f..e0d088e3 100644
--- a/content/browser/payments/payment_app_provider_impl.cc
+++ b/content/browser/payments/payment_app_provider_impl.cc
@@ -138,10 +138,9 @@
       payments::mojom::PaymentHandlerResponsePtr response) override {
     DCHECK_CURRENTLY_ON(BrowserThread::IO);
     service_worker_version_->FinishRequest(request_id_, false);
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::UI},
-        base::BindOnce(std::move(invoke_payment_app_callback_),
-                       std::move(response)));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(std::move(invoke_payment_app_callback_),
+                                  std::move(response)));
 
     ClearCallbackRepositoryAndCloseWindow();
     delete this;
@@ -150,20 +149,18 @@
   void OnResponseForCanMakePayment(bool can_make_payment) override {
     DCHECK_CURRENTLY_ON(BrowserThread::IO);
     service_worker_version_->FinishRequest(request_id_, false);
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::UI},
-        base::BindOnce(std::move(payment_event_result_callback_),
-                       can_make_payment));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(std::move(payment_event_result_callback_),
+                                  can_make_payment));
     delete this;
   }
 
   void OnResponseForAbortPayment(bool payment_aborted) override {
     DCHECK_CURRENTLY_ON(BrowserThread::IO);
     service_worker_version_->FinishRequest(request_id_, false);
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::UI},
-        base::BindOnce(std::move(payment_event_result_callback_),
-                       payment_aborted));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(std::move(payment_event_result_callback_),
+                                  payment_aborted));
 
     ClearCallbackRepositoryAndCloseWindow();
     delete this;
@@ -173,7 +170,7 @@
     DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
     if (event_type_ == ServiceWorkerMetrics::EventType::PAYMENT_REQUEST) {
-      base::PostTaskWithTraits(
+      base::PostTask(
           FROM_HERE, {BrowserThread::UI},
           base::BindOnce(std::move(invoke_payment_app_callback_),
                          payments::mojom::PaymentHandlerResponse::New(
@@ -181,7 +178,7 @@
     } else if (event_type_ ==
                    ServiceWorkerMetrics::EventType::CAN_MAKE_PAYMENT ||
                event_type_ == ServiceWorkerMetrics::EventType::ABORT_PAYMENT) {
-      base::PostTaskWithTraits(
+      base::PostTask(
           FROM_HERE, {BrowserThread::UI},
           base::BindOnce(std::move(payment_event_result_callback_), false));
     }
@@ -229,7 +226,7 @@
 
     InvokePaymentAppCallbackRepository::GetInstance()->RemoveCallback(
         browser_context_);
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&CloseClientWindowOnUIThread, browser_context_));
   }
@@ -256,9 +253,8 @@
 void DidGetAllPaymentAppsOnIO(
     PaymentAppProvider::GetAllPaymentAppsCallback callback,
     PaymentAppProvider::PaymentApps apps) {
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::UI},
-      base::BindOnce(std::move(callback), std::move(apps)));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(std::move(callback), std::move(apps)));
 }
 
 void GetAllPaymentAppsOnIO(
@@ -278,8 +274,8 @@
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
   if (service_worker_status != blink::ServiceWorkerStatusCode::kOk) {
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                             base::BindOnce(std::move(callback), false));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(std::move(callback), false));
     return;
   }
 
@@ -307,8 +303,8 @@
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
   if (service_worker_status != blink::ServiceWorkerStatusCode::kOk) {
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                             base::BindOnce(std::move(callback), false));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(std::move(callback), false));
     return;
   }
 
@@ -336,7 +332,7 @@
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
   if (service_worker_status != blink::ServiceWorkerStatusCode::kOk) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(
             std::move(callback),
@@ -402,7 +398,7 @@
   scoped_refptr<ServiceWorkerContextWrapper> service_worker_context =
       partition->GetServiceWorkerContext();
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&FindRegistrationOnIO, std::move(service_worker_context),
                      registration_id, std::move(callback)));
@@ -588,7 +584,7 @@
   scoped_refptr<PaymentAppContextImpl> payment_app_context =
       partition->GetPaymentAppContext();
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&GetAllPaymentAppsOnIO, payment_app_context,
                      base::BindOnce(&CheckPermissionForPaymentApps,
@@ -647,7 +643,7 @@
   DCHECK(base::IsStringUTF8(sw_scope));
   GURL scope = GURL(sw_scope);
   if (!url.is_valid() || !scope.is_valid() || method.empty()) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(
             std::move(callback),
@@ -757,7 +753,7 @@
     PaymentEventResponseType reason) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&AbortInvokePaymentApp, browser_context, reason));
 }
diff --git a/content/browser/payments/payment_instrument_icon_fetcher.cc b/content/browser/payments/payment_instrument_icon_fetcher.cc
index d0d47d2d..370b112 100644
--- a/content/browser/payments/payment_instrument_icon_fetcher.cc
+++ b/content/browser/payments/payment_instrument_icon_fetcher.cc
@@ -39,9 +39,8 @@
 
   if (bitmap.drawsNothing()) {
     if (icons.empty()) {
-      base::PostTaskWithTraits(
-          FROM_HERE, {BrowserThread::IO},
-          base::BindOnce(std::move(callback), std::string()));
+      base::PostTask(FROM_HERE, {BrowserThread::IO},
+                     base::BindOnce(std::move(callback), std::string()));
     } else {
       // If could not download or decode the chosen image(e.g. not supported,
       // invalid), try it again with remaining icons.
@@ -58,8 +57,8 @@
       base::StringPiece(reinterpret_cast<const char*>(&bitmap_data[0]),
                         bitmap_data.size()),
       &encoded_data);
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO},
-                           base::BindOnce(std::move(callback), encoded_data));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(std::move(callback), encoded_data));
 }
 
 void DownloadBestMatchingIcon(
@@ -70,9 +69,8 @@
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   if (web_contents == nullptr) {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(std::move(callback), std::string()));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(std::move(callback), std::string()));
     return;
   }
 
@@ -87,9 +85,8 @@
     // developers in advance unlike when fetching or decoding fails. We already
     // checked whether they are valid in renderer side. So, if the icon url is
     // invalid, it's something wrong.
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(std::move(callback), std::string()));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(std::move(callback), std::string()));
     return;
   }
 
@@ -156,10 +153,9 @@
     PaymentInstrumentIconFetcherCallback callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::UI},
-      base::BindOnce(&StartOnUI, scope, std::move(provider_hosts), icons,
-                     std::move(callback)));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(&StartOnUI, scope, std::move(provider_hosts),
+                                icons, std::move(callback)));
 }
 
 }  // namespace content
diff --git a/content/browser/plugin_data_remover_impl.cc b/content/browser/plugin_data_remover_impl.cc
index 43ec1a50..da5c6ca 100644
--- a/content/browser/plugin_data_remover_impl.cc
+++ b/content/browser/plugin_data_remover_impl.cc
@@ -75,13 +75,11 @@
   }
 
   void Init(const std::string& mime_type) {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(&Context::InitOnIOThread, this, mime_type));
-    base::PostDelayedTaskWithTraits(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(&Context::OnTimeout, this),
-        base::TimeDelta::FromMilliseconds(kRemovalTimeoutMs));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&Context::InitOnIOThread, this, mime_type));
+    base::PostDelayedTask(FROM_HERE, {BrowserThread::IO},
+                          base::BindOnce(&Context::OnTimeout, this),
+                          base::TimeDelta::FromMilliseconds(kRemovalTimeoutMs));
   }
 
   void InitOnIOThread(const std::string& mime_type) {
diff --git a/content/browser/plugin_private_storage_helper.cc b/content/browser/plugin_private_storage_helper.cc
index 9821dced..cb1f385 100644
--- a/content/browser/plugin_private_storage_helper.cc
+++ b/content/browser/plugin_private_storage_helper.cc
@@ -327,7 +327,7 @@
               filesystem_context_.get(), origin.GetOrigin(),
               plugin_path.BaseName().MaybeAsASCII(), begin_, end_,
               decrement_callback);
-      base::PostTaskWithTraits(
+      base::PostTask(
           FROM_HERE, {BrowserThread::IO},
           base::BindOnce(
               &PluginPrivateDataByOriginChecker::CheckFilesOnIOThread,
diff --git a/content/browser/plugin_service_impl.cc b/content/browser/plugin_service_impl.cc
index a599f98..2805ae2d 100644
--- a/content/browser/plugin_service_impl.cc
+++ b/content/browser/plugin_service_impl.cc
@@ -114,8 +114,8 @@
 }
 
 void PluginServiceImpl::Init() {
-  plugin_list_task_runner_ = base::CreateSequencedTaskRunnerWithTraits(
-      {base::MayBlock(), base::TaskPriority::USER_VISIBLE,
+  plugin_list_task_runner_ = base::CreateSequencedTaskRunner(
+      {base::ThreadPool(), base::MayBlock(), base::TaskPriority::USER_VISIBLE,
        base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN});
 
   // Setup the sequence checker right after setting up the task runner.
@@ -274,9 +274,9 @@
     int render_frame_id,
     const base::FilePath& path,
     PpapiPluginProcessHost::BrokerClient* client) {
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                           base::BindOnce(&PluginServiceImpl::RecordBrokerUsage,
-                                          render_process_id, render_frame_id));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(&PluginServiceImpl::RecordBrokerUsage,
+                                render_process_id, render_frame_id));
 
   PpapiPluginProcessHost* plugin_host = FindOrStartPpapiBrokerProcess(
       render_process_id, path);
diff --git a/content/browser/plugin_service_impl_browsertest.cc b/content/browser/plugin_service_impl_browsertest.cc
index 8da4c73..9f22cc9 100644
--- a/content/browser/plugin_service_impl_browsertest.cc
+++ b/content/browser/plugin_service_impl_browsertest.cc
@@ -85,7 +85,7 @@
     client->SetRunLoop(&run_loop);
 
     PluginServiceImpl* service = PluginServiceImpl::GetInstance();
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&PluginServiceImpl::OpenChannelToPpapiPlugin,
                        base::Unretained(service), 0, plugin_path_, profile_dir_,
diff --git a/content/browser/power_monitor_browsertest.cc b/content/browser/power_monitor_browsertest.cc
index be44abb1..667d4d9c 100644
--- a/content/browser/power_monitor_browsertest.cc
+++ b/content/browser/power_monitor_browsertest.cc
@@ -147,10 +147,9 @@
   void StartUtilityProcess(mojom::PowerMonitorTestPtr* power_monitor_test,
                            base::Closure utility_bound_closure) {
     utility_bound_closure_ = std::move(utility_bound_closure);
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(&StartUtilityProcessOnIOThread,
-                       mojo::MakeRequest(power_monitor_test)));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&StartUtilityProcessOnIOThread,
+                                  mojo::MakeRequest(power_monitor_test)));
   }
 
   void set_renderer_bound_closure(base::Closure closure) {
@@ -247,10 +246,9 @@
   EXPECT_EQ(1, request_count_from_gpu());
 
   mojom::PowerMonitorTestPtr power_monitor_gpu;
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&BindInterfaceForGpuOnIOThread,
-                     mojo::MakeRequest(&power_monitor_gpu)));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&BindInterfaceForGpuOnIOThread,
+                                mojo::MakeRequest(&power_monitor_gpu)));
 
   // Ensure that the PowerMonitorTestImpl instance has been created and is
   // observing power state changes in the child process before simulating a
diff --git a/content/browser/push_messaging/push_messaging_manager.cc b/content/browser/push_messaging/push_messaging_manager.cc
index f38ac3231..6066fa4 100644
--- a/content/browser/push_messaging/push_messaging_manager.cc
+++ b/content/browser/push_messaging/push_messaging_manager.cc
@@ -373,7 +373,7 @@
   // the subscription algorithm instead of trying to subscribe.
 
   if (!data.options->application_server_key.empty()) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&Core::RegisterOnUI, base::Unretained(ui_core_.get()),
                        std::move(data)));
@@ -414,7 +414,7 @@
   }
   data.options->application_server_key =
       std::vector<uint8_t>(fixed_sender_id.begin(), fixed_sender_id.end());
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&Core::RegisterOnUI, base::Unretained(ui_core_.get()),
                      std::move(data)));
@@ -428,7 +428,7 @@
     if (!is_incognito()) {
       // This might happen if InstanceIDProfileService::IsInstanceIDEnabled
       // returns false because the Instance ID kill switch was enabled.
-      base::PostTaskWithTraits(
+      base::PostTask(
           FROM_HERE, {BrowserThread::IO},
           base::BindOnce(
               &PushMessagingManager::SendSubscriptionError, io_parent_,
@@ -440,7 +440,7 @@
       if (!IsRequestFromDocument(render_frame_id_) ||
           !data.options->user_visible_only) {
         // Throw a permission denied error under the same circumstances.
-        base::PostTaskWithTraits(
+        base::PostTask(
             FROM_HERE, {BrowserThread::IO},
             base::BindOnce(&PushMessagingManager::SendSubscriptionError,
                            io_parent_, std::move(data),
@@ -499,7 +499,7 @@
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   // Notification permission should always be denied in incognito.
   DCHECK_EQ(blink::mojom::PermissionStatus::DENIED, status);
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           &PushMessagingManager::SendSubscriptionError, io_parent_,
@@ -525,7 +525,7 @@
 
   if (status ==
       blink::mojom::PushRegistrationStatus::SUCCESS_FROM_PUSH_SERVICE) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&PushMessagingManager::PersistRegistrationOnIO,
                        io_parent_, std::move(data), push_subscription_id,
@@ -536,10 +536,9 @@
                            : blink::mojom::PushRegistrationStatus::
                                  SUCCESS_FROM_PUSH_SERVICE));
   } else {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(&PushMessagingManager::SendSubscriptionError, io_parent_,
-                       std::move(data), status));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&PushMessagingManager::SendSubscriptionError,
+                                  io_parent_, std::move(data), status));
   }
 }
 
@@ -653,7 +652,7 @@
     DCHECK_EQ(1u, sender_ids.size());
     sender_id = sender_ids[0];
   }
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&Core::UnregisterFromService,
                      base::Unretained(ui_core_.get()), std::move(callback),
@@ -672,7 +671,7 @@
     // This shouldn't be possible in incognito mode, since we've already checked
     // that we have an existing registration. Hence it's ok to throw an error.
     DCHECK(!is_incognito());
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(
             &PushMessagingManager::DidUnregister, io_parent_,
@@ -695,7 +694,7 @@
     blink::mojom::PushUnregistrationStatus unregistration_status) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&PushMessagingManager::DidUnregister, io_parent_,
                      std::move(callback), unregistration_status));
@@ -788,7 +787,7 @@
 
       const GURL origin = registration->scope().GetOrigin();
 
-      base::PostTaskWithTraits(
+      base::PostTask(
           FROM_HERE, {BrowserThread::UI},
           base::BindOnce(&Core::GetSubscriptionInfoOnUI,
                          base::Unretained(ui_core_.get()), origin,
@@ -862,7 +861,7 @@
     blink::mojom::PushGetRegistrationStatus status =
         blink::mojom::PushGetRegistrationStatus::SUCCESS;
 
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(std::move(callback), status,
                        blink::mojom::PushSubscription::New(
@@ -875,7 +874,7 @@
       // Shouldn't be possible to have a stored push subscription in a profile
       // with no push service, but this case can occur when the renderer is
       // shutting down.
-      base::PostTaskWithTraits(
+      base::PostTask(
           FROM_HERE, {BrowserThread::IO},
           base::BindOnce(
               std::move(callback),
@@ -908,9 +907,9 @@
     blink::mojom::PushGetRegistrationStatus get_status,
     blink::mojom::PushUnregistrationStatus unsubscribe_status) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO},
-                           base::BindOnce(std::move(callback), get_status,
-                                          nullptr /* subscription */));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(std::move(callback), get_status,
+                                nullptr /* subscription */));
 }
 
 // Helper methods on both IO and UI threads, merged from
diff --git a/content/browser/push_messaging/push_messaging_router.cc b/content/browser/push_messaging/push_messaging_router.cc
index faf51767..09af32c 100644
--- a/content/browser/push_messaging/push_messaging_router.cc
+++ b/content/browser/push_messaging/push_messaging_router.cc
@@ -28,9 +28,8 @@
     const PushMessagingRouter::DeliverMessageCallback& deliver_message_callback,
     blink::mojom::PushDeliveryStatus delivery_status) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::UI},
-      base::BindOnce(deliver_message_callback, delivery_status));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(deliver_message_callback, delivery_status));
 }
 
 }  // namespace
@@ -53,7 +52,7 @@
       base::WrapRefCounted<DevToolsBackgroundServicesContextImpl>(
           service_worker_context->storage_partition()
               ->GetDevToolsBackgroundServicesContext());
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&PushMessagingRouter::FindServiceWorkerRegistration,
                      std::move(service_worker_context),
diff --git a/content/browser/quota_dispatcher_host.cc b/content/browser/quota_dispatcher_host.cc
index 91bbbd59..faf2e15 100644
--- a/content/browser/quota_dispatcher_host.cc
+++ b/content/browser/quota_dispatcher_host.cc
@@ -53,7 +53,7 @@
   // one provided by QuotaDispatcher.
 
   // Bind on the IO thread.
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           &BindConnectorOnIOThread, host->GetID(), MSG_ROUTING_NONE,
@@ -67,7 +67,7 @@
     int render_frame_id,
     blink::mojom::QuotaDispatcherHostRequest request) {
   // Bind on the IO thread.
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           &BindConnectorOnIOThread, host->GetID(), render_frame_id,
diff --git a/content/browser/renderer_host/media/media_stream_dispatcher_host.cc b/content/browser/renderer_host/media/media_stream_dispatcher_host.cc
index 1da266df..8c615a1 100644
--- a/content/browser/renderer_host/media/media_stream_dispatcher_host.cc
+++ b/content/browser/renderer_host/media/media_stream_dispatcher_host.cc
@@ -11,13 +11,14 @@
 #include "base/logging.h"
 #include "base/task/post_task.h"
 #include "base/task_runner_util.h"
+#include "content/browser/bad_message.h"
 #include "content/browser/renderer_host/media/media_stream_manager.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/render_frame_host.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
-#include "third_party/blink/public/mojom/mediastream/media_stream.mojom-shared.h"
+#include "third_party/blink/public/mojom/mediastream/media_stream.mojom.h"
 #include "url/origin.h"
 
 namespace content {
@@ -123,22 +124,34 @@
     int32_t page_request_id,
     const blink::StreamControls& controls,
     bool user_gesture,
+    blink::mojom::StreamSelectionInfoPtr audio_stream_selection_info_ptr,
     GenerateStreamCallback callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
+  if (audio_stream_selection_info_ptr->strategy ==
+          blink::mojom::StreamSelectionStrategy::SEARCH_BY_SESSION_ID &&
+      (!audio_stream_selection_info_ptr->session_id.has_value() ||
+       audio_stream_selection_info_ptr->session_id->is_empty())) {
+    bad_message::ReceivedBadMessage(
+        render_process_id_, bad_message::MDDH_INVALID_STREAM_SELECTION_INFO);
+    return;
+  }
+
   base::PostTaskAndReplyWithResult(
       base::CreateSingleThreadTaskRunner({BrowserThread::UI}).get(), FROM_HERE,
       base::BindOnce(salt_and_origin_callback_, render_process_id_,
                      render_frame_id_),
       base::BindOnce(&MediaStreamDispatcherHost::DoGenerateStream,
                      weak_factory_.GetWeakPtr(), page_request_id, controls,
-                     user_gesture, std::move(callback)));
+                     user_gesture, std::move(audio_stream_selection_info_ptr),
+                     std::move(callback)));
 }
 
 void MediaStreamDispatcherHost::DoGenerateStream(
     int32_t page_request_id,
     const blink::StreamControls& controls,
     bool user_gesture,
+    blink::mojom::StreamSelectionInfoPtr audio_stream_selection_info_ptr,
     GenerateStreamCallback callback,
     MediaDeviceSaltAndOrigin salt_and_origin) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
@@ -153,7 +166,8 @@
 
   media_stream_manager_->GenerateStream(
       render_process_id_, render_frame_id_, requester_id_, page_request_id,
-      controls, std::move(salt_and_origin), user_gesture, std::move(callback),
+      controls, std::move(salt_and_origin), user_gesture,
+      std::move(audio_stream_selection_info_ptr), std::move(callback),
       base::BindRepeating(&MediaStreamDispatcherHost::OnDeviceStopped,
                           weak_factory_.GetWeakPtr()),
       base::BindRepeating(&MediaStreamDispatcherHost::OnDeviceChanged,
diff --git a/content/browser/renderer_host/media/media_stream_dispatcher_host.h b/content/browser/renderer_host/media/media_stream_dispatcher_host.h
index ae91c484..2614a0a 100644
--- a/content/browser/renderer_host/media/media_stream_dispatcher_host.h
+++ b/content/browser/renderer_host/media/media_stream_dispatcher_host.h
@@ -53,10 +53,12 @@
   void CancelAllRequests();
 
   // mojom::MediaStreamDispatcherHost implementation
-  void GenerateStream(int32_t request_id,
-                      const blink::StreamControls& controls,
-                      bool user_gesture,
-                      GenerateStreamCallback callback) override;
+  void GenerateStream(
+      int32_t request_id,
+      const blink::StreamControls& controls,
+      bool user_gesture,
+      blink::mojom::StreamSelectionInfoPtr audio_stream_selection_info_ptr,
+      GenerateStreamCallback callback) override;
   void CancelRequest(int32_t request_id) override;
   void StopStreamDevice(
       const std::string& device_id,
@@ -72,11 +74,13 @@
       bool is_secure) override;
   void OnStreamStarted(const std::string& label) override;
 
-  void DoGenerateStream(int32_t request_id,
-                        const blink::StreamControls& controls,
-                        bool user_gesture,
-                        GenerateStreamCallback callback,
-                        MediaDeviceSaltAndOrigin salt_and_origin);
+  void DoGenerateStream(
+      int32_t request_id,
+      const blink::StreamControls& controls,
+      bool user_gesture,
+      blink::mojom::StreamSelectionInfoPtr audio_stream_selection_info_ptr,
+      GenerateStreamCallback callback,
+      MediaDeviceSaltAndOrigin salt_and_origin);
   void DoOpenDevice(int32_t request_id,
                     const std::string& device_id,
                     blink::mojom::MediaStreamType type,
diff --git a/content/browser/renderer_host/media/media_stream_dispatcher_host_unittest.cc b/content/browser/renderer_host/media/media_stream_dispatcher_host_unittest.cc
index 67a0b2e..41b89370 100644
--- a/content/browser/renderer_host/media/media_stream_dispatcher_host_unittest.cc
+++ b/content/browser/renderer_host/media/media_stream_dispatcher_host_unittest.cc
@@ -107,6 +107,9 @@
     quit_closures_.push(quit_closure);
     MediaStreamDispatcherHost::GenerateStream(
         page_request_id, controls, false,
+        blink::mojom::StreamSelectionInfo::New(
+            blink::mojom::StreamSelectionStrategy::SEARCH_BY_DEVICE_ID,
+            base::nullopt),
         base::BindOnce(&MockMediaStreamDispatcherHost::OnStreamGenerated,
                        base::Unretained(this), page_request_id));
   }
diff --git a/content/browser/renderer_host/media/media_stream_manager.cc b/content/browser/renderer_host/media/media_stream_manager.cc
index 8987a1d..964cedd3 100644
--- a/content/browser/renderer_host/media/media_stream_manager.cc
+++ b/content/browser/renderer_host/media/media_stream_manager.cc
@@ -97,6 +97,9 @@
 using blink::TrackControls;
 using blink::mojom::MediaStreamRequestResult;
 using blink::mojom::MediaStreamType;
+using blink::mojom::StreamSelectionInfo;
+using blink::mojom::StreamSelectionInfoPtr;
+using blink::mojom::StreamSelectionStrategy;
 
 namespace {
 // Creates a random label used to identify requests.
@@ -284,6 +287,7 @@
       int requester_id,
       int page_request_id,
       bool user_gesture,
+      StreamSelectionInfoPtr audio_stream_selection_info_ptr,
       MediaStreamRequestType request_type,
       const StreamControls& controls,
       MediaDeviceSaltAndOrigin salt_and_origin,
@@ -293,6 +297,8 @@
         requester_id(requester_id),
         page_request_id(page_request_id),
         user_gesture(user_gesture),
+        audio_stream_selection_info_ptr(
+            std::move(audio_stream_selection_info_ptr)),
         controls(controls),
         salt_and_origin(std::move(salt_and_origin)),
         device_stopped_cb(std::move(device_stopped_cb)),
@@ -439,6 +445,11 @@
 
   const bool user_gesture;
 
+  // Information as of how to select a stream for an audio device provided by
+  // the caller.
+  // NB: This information is invalid after the request has been processed.
+  StreamSelectionInfoPtr audio_stream_selection_info_ptr;
+
   const StreamControls controls;
 
   const MediaDeviceSaltAndOrigin salt_and_origin;
@@ -635,9 +646,14 @@
     MediaAccessRequestCallback callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
+  StreamSelectionInfoPtr audio_stream_selection_info_ptr =
+      StreamSelectionInfo::New(
+          blink::mojom::StreamSelectionStrategy::SEARCH_BY_DEVICE_ID,
+          base::nullopt);
   auto request = std::make_unique<DeviceRequest>(
       render_process_id, render_frame_id, requester_id, page_request_id,
-      false /* user gesture */, blink::MEDIA_DEVICE_ACCESS, controls,
+      false /* user gesture */, std::move(audio_stream_selection_info_ptr),
+      blink::MEDIA_DEVICE_ACCESS, controls,
       MediaDeviceSaltAndOrigin{std::string() /* salt */,
                                std::string() /* group_id_salt */,
                                security_origin});
@@ -664,6 +680,7 @@
     const StreamControls& controls,
     MediaDeviceSaltAndOrigin salt_and_origin,
     bool user_gesture,
+    StreamSelectionInfoPtr audio_stream_selection_info_ptr,
     GenerateStreamCallback generate_stream_cb,
     DeviceStoppedCallback device_stopped_cb,
     DeviceChangedCallback device_changed_cb) {
@@ -672,8 +689,9 @@
 
   DeviceRequest* request = new DeviceRequest(
       render_process_id, render_frame_id, requester_id, page_request_id,
-      user_gesture, blink::MEDIA_GENERATE_STREAM, controls,
-      std::move(salt_and_origin), std::move(device_stopped_cb));
+      user_gesture, std::move(audio_stream_selection_info_ptr),
+      blink::MEDIA_GENERATE_STREAM, controls, std::move(salt_and_origin),
+      std::move(device_stopped_cb));
   request->device_changed_cb = std::move(device_changed_cb);
 
   const std::string& label = AddRequest(base::WrapUnique(request));
@@ -898,9 +916,16 @@
   } else {
     NOTREACHED();
   }
+  // For pepper, we default to searching for a device always based on device ID,
+  // independently of whether the request is for an audio or a video device.
+  StreamSelectionInfoPtr audio_stream_selection_info_ptr =
+      StreamSelectionInfo::New(
+          blink::mojom::StreamSelectionStrategy::SEARCH_BY_DEVICE_ID,
+          base::nullopt);
   auto request = std::make_unique<DeviceRequest>(
       render_process_id, render_frame_id, requester_id, page_request_id,
-      false /* user gesture */, blink::MEDIA_OPEN_DEVICE_PEPPER_ONLY, controls,
+      false /* user gesture */, std::move(audio_stream_selection_info_ptr),
+      blink::MEDIA_OPEN_DEVICE_PEPPER_ONLY, controls,
       std::move(salt_and_origin), std::move(device_stopped_cb));
 
   request->open_device_cb = std::move(open_device_cb);
@@ -1450,17 +1475,49 @@
   DCHECK(existing_device);
   DCHECK(existing_request_state);
 
-  std::string source_id = GetHMACForMediaDeviceID(
+  std::string hashed_source_id = GetHMACForMediaDeviceID(
       new_request.salt_and_origin.device_id_salt,
       new_request.salt_and_origin.origin, new_device.id);
 
+  bool is_audio_capture =
+      new_device.type == MediaStreamType::DEVICE_AUDIO_CAPTURE &&
+      new_request.audio_type() == MediaStreamType::DEVICE_AUDIO_CAPTURE;
+  StreamSelectionStrategy strategy =
+      new_request.audio_stream_selection_info_ptr->strategy;
+  if (is_audio_capture &&
+      strategy == blink::mojom::StreamSelectionStrategy::FORCE_NEW_STREAM) {
+    return false;
+  }
+
+  base::Optional<base::UnguessableToken> requested_session_id =
+      new_request.audio_stream_selection_info_ptr->session_id;
+#if DCHECK_IS_ON()
+  if (strategy == StreamSelectionStrategy::SEARCH_BY_SESSION_ID) {
+    DCHECK(requested_session_id);
+    DCHECK(!requested_session_id->is_empty());
+  }
+#endif
   for (const LabeledDeviceRequest& labeled_request : requests_) {
     const DeviceRequest* request = labeled_request.second.get();
     if (request->requesting_process_id == new_request.requesting_process_id &&
         request->requesting_frame_id == new_request.requesting_frame_id &&
         request->request_type() == new_request.request_type()) {
       for (const MediaStreamDevice& device : request->devices) {
-        if (device.id == source_id && device.type == new_device.type) {
+        bool is_same_device =
+            device.id == hashed_source_id && device.type == new_device.type;
+        // If |strategy| is equal to SEARCH_BY_DEVICE_ID, the
+        // search is performed only based on the |device.id|. If, however,
+        // |strategy| is equal to SEARCH_BY_SESSION_ID, the
+        // search also includes the session ID provided in the request.
+        // NB: this only applies to audio. In case of media stream types that
+        // are not an audio capture, the session id is always ignored.
+        bool is_same_session =
+            !is_audio_capture ||
+            strategy == StreamSelectionStrategy::SEARCH_BY_DEVICE_ID ||
+            (strategy == StreamSelectionStrategy::SEARCH_BY_SESSION_ID &&
+             device.session_id() == *requested_session_id);
+
+        if (is_same_device && is_same_session) {
           *existing_device = device;
           // Make sure that the audio |effects| reflect what the request
           // is set to and not what the capabilities are.
diff --git a/content/browser/renderer_host/media/media_stream_manager.h b/content/browser/renderer_host/media/media_stream_manager.h
index e9b2a3c..253adb8 100644
--- a/content/browser/renderer_host/media/media_stream_manager.h
+++ b/content/browser/renderer_host/media/media_stream_manager.h
@@ -54,7 +54,7 @@
 #include "third_party/blink/public/common/mediastream/media_devices.h"
 #include "third_party/blink/public/common/mediastream/media_stream_controls.h"
 #include "third_party/blink/public/common/mediastream/media_stream_request.h"
-#include "third_party/blink/public/mojom/mediastream/media_stream.mojom-shared.h"
+#include "third_party/blink/public/mojom/mediastream/media_stream.mojom.h"
 
 namespace media {
 class AudioSystem;
@@ -176,16 +176,18 @@
   // to determine where the infobar will appear to the user. |device_stopped_cb|
   // is set to receive device stopped notifications. |device_change_cb| is set
   // to receive device changed notifications.
-  void GenerateStream(int render_process_id,
-                      int render_frame_id,
-                      int requester_id,
-                      int page_request_id,
-                      const blink::StreamControls& controls,
-                      MediaDeviceSaltAndOrigin salt_and_origin,
-                      bool user_gesture,
-                      GenerateStreamCallback generate_stream_cb,
-                      DeviceStoppedCallback device_stopped_cb,
-                      DeviceChangedCallback device_changed_cb);
+  void GenerateStream(
+      int render_process_id,
+      int render_frame_id,
+      int requester_id,
+      int page_request_id,
+      const blink::StreamControls& controls,
+      MediaDeviceSaltAndOrigin salt_and_origin,
+      bool user_gesture,
+      blink::mojom::StreamSelectionInfoPtr audio_stream_selection_info_ptr,
+      GenerateStreamCallback generate_stream_cb,
+      DeviceStoppedCallback device_stopped_cb,
+      DeviceChangedCallback device_changed_cb);
 
   // Cancel an open request identified by |page_request_id| for the given frame.
   // Must be called on the IO thread.
diff --git a/content/browser/renderer_host/media/media_stream_manager_unittest.cc b/content/browser/renderer_host/media/media_stream_manager_unittest.cc
index c0d5468..525a0101 100644
--- a/content/browser/renderer_host/media/media_stream_manager_unittest.cc
+++ b/content/browser/renderer_host/media/media_stream_manager_unittest.cc
@@ -46,6 +46,9 @@
 #include "media/audio/fake_audio_manager.h"
 #endif
 
+using blink::mojom::StreamSelectionInfo;
+using blink::mojom::StreamSelectionInfoPtr;
+using blink::mojom::StreamSelectionStrategy;
 using testing::_;
 using testing::Invoke;
 
@@ -257,23 +260,8 @@
     blink::MediaStreamDevice video_device;
     blink::MediaStreamDevice audio_device;
     MediaStreamManager::GenerateStreamCallback generate_stream_callback =
-        base::BindOnce(
-            [](base::RunLoop* wait_loop, bool request_audio,
-               blink::MediaStreamDevice* audio_device,
-               blink::MediaStreamDevice* video_device,
-               blink::mojom::MediaStreamRequestResult result,
-               const std::string& label,
-               const blink::MediaStreamDevices& audio_devices,
-               const blink::MediaStreamDevices& video_devices) {
-              if (request_audio) {
-                EXPECT_EQ(1u, audio_devices.size());
-                *audio_device = audio_devices[0];
-              }
-              ASSERT_EQ(1u, video_devices.size());
-              *video_device = video_devices[0];
-              wait_loop->Quit();
-            },
-            &run_loop_, request_audio, &audio_device, &video_device);
+        base::BindOnce(GenerateStreamCallback, &run_loop_, request_audio,
+                       true /* request_video */, &audio_device, &video_device);
     MediaStreamManager::DeviceStoppedCallback stopped_callback;
     MediaStreamManager::DeviceChangedCallback changed_callback;
 
@@ -297,6 +285,9 @@
     media_stream_manager_->GenerateStream(
         render_process_id, render_frame_id, requester_id, page_request_id,
         controls, MediaDeviceSaltAndOrigin(), false /* user_gesture */,
+        StreamSelectionInfo::New(
+            blink::mojom::StreamSelectionStrategy::SEARCH_BY_DEVICE_ID,
+            base::nullopt),
         std::move(generate_stream_callback), std::move(stopped_callback),
         std::move(changed_callback));
     run_loop_.Run();
@@ -327,6 +318,64 @@
     }
   }
 
+  static void GenerateStreamCallback(
+      base::RunLoop* wait_loop,
+      bool request_audio,
+      bool request_video,
+      blink::MediaStreamDevice* audio_device,
+      blink::MediaStreamDevice* video_device,
+      blink::mojom::MediaStreamRequestResult result,
+      const std::string& label,
+      const blink::MediaStreamDevices& audio_devices,
+      const blink::MediaStreamDevices& video_devices) {
+    if (request_audio) {
+      EXPECT_EQ(1u, audio_devices.size());
+      *audio_device = audio_devices[0];
+    } else {
+      EXPECT_EQ(0u, audio_devices.size());
+    }
+
+    if (request_video) {
+      ASSERT_EQ(1u, video_devices.size());
+      *video_device = video_devices[0];
+    } else {
+      EXPECT_EQ(0u, video_devices.size());
+    }
+
+    wait_loop->Quit();
+  }
+
+  blink::MediaStreamDevice CreateOrSearchAudioDeviceStream(
+      const StreamSelectionStrategy& strategy,
+      const base::Optional<base::UnguessableToken>& session_id,
+      const blink::StreamControls& controls =
+          blink::StreamControls(true /* request_audio */,
+                                false /* request_video */),
+      int render_process_id = 1,
+      int render_frame_id = 1,
+      int requester_id = 1,
+      int page_request_id = 1) {
+    base::RunLoop run_loop;
+    blink::MediaStreamDevice audio_device;
+
+    MediaStreamManager::GenerateStreamCallback generate_stream_callback =
+        base::BindOnce(GenerateStreamCallback, &run_loop, true, false,
+                       &audio_device, nullptr);
+    MediaStreamManager::DeviceStoppedCallback stopped_callback;
+    MediaStreamManager::DeviceChangedCallback changed_callback;
+
+    StreamSelectionInfoPtr info =
+        StreamSelectionInfo::New(strategy, session_id);
+    media_stream_manager_->GenerateStream(
+        render_process_id, render_frame_id, requester_id, page_request_id,
+        controls, MediaDeviceSaltAndOrigin(), false /* user_gesture */,
+        std::move(info), std::move(generate_stream_callback),
+        std::move(stopped_callback), std::move(changed_callback));
+    run_loop.Run();
+
+    return audio_device;
+  }
+
   // media_stream_manager_ needs to outlive thread_bundle_ because it is a
   // MessageLoopCurrent::DestructionObserver. audio_manager_ needs to outlive
   // thread_bundle_ because it uses the underlying message loop.
@@ -542,6 +591,83 @@
     EXPECT_TRUE(base::IsAsciiDigit(c) || (c >= 'a' && c <= 'f'));
 }
 
+TEST_F(MediaStreamManagerTest, GenerateSameStreamForAudioDevice) {
+  media_stream_manager_->UseFakeUIFactoryForTests(base::BindRepeating([]() {
+    return std::make_unique<FakeMediaStreamUIProxy>(
+        true /* tests_use_fake_render_frame_hosts */);
+  }));
+
+  const int num_call_iterations = 3;
+
+  // Test that if |info.strategy| has value SEARCH_BY_DEVICE_ID, we only create
+  // a single session for a device.
+  std::set<base::UnguessableToken> session_ids;
+  for (int i = 0; i < num_call_iterations; ++i) {
+    blink::MediaStreamDevice audio_device = CreateOrSearchAudioDeviceStream(
+        blink::mojom::StreamSelectionStrategy::SEARCH_BY_DEVICE_ID,
+        base::nullopt);
+
+    EXPECT_EQ(audio_device.id, "default");
+    EXPECT_EQ(blink::mojom::MediaStreamType::DEVICE_AUDIO_CAPTURE,
+              audio_device.type);
+    EXPECT_TRUE(audio_device.session_id());
+    session_ids.insert(audio_device.session_id());
+  }
+  EXPECT_EQ(session_ids.size(), 1u);
+}
+
+TEST_F(MediaStreamManagerTest, GenerateDifferentStreamsForAudioDevice) {
+  media_stream_manager_->UseFakeUIFactoryForTests(base::BindRepeating([]() {
+    return std::make_unique<FakeMediaStreamUIProxy>(
+        true /* tests_use_fake_render_frame_hosts */);
+  }));
+
+  const size_t num_call_iterations = 3;
+
+  // Test that if |info.strategy| is provided as FORCE_NEW_STREAM, we create a
+  // new stream each time.
+  std::set<base::UnguessableToken> session_ids;
+  for (size_t i = 0; i < num_call_iterations; ++i) {
+    blink::MediaStreamDevice audio_device = CreateOrSearchAudioDeviceStream(
+        blink::mojom::StreamSelectionStrategy::FORCE_NEW_STREAM, base::nullopt);
+
+    EXPECT_EQ(audio_device.id, "default");
+    EXPECT_EQ(blink::mojom::MediaStreamType::DEVICE_AUDIO_CAPTURE,
+              audio_device.type);
+    EXPECT_TRUE(audio_device.session_id());
+    session_ids.insert(audio_device.session_id());
+  }
+  EXPECT_EQ(session_ids.size(), num_call_iterations);
+}
+
+TEST_F(MediaStreamManagerTest, GenerateAndReuseStreamForAudioDevice) {
+  media_stream_manager_->UseFakeUIFactoryForTests(base::BindRepeating([]() {
+    return std::make_unique<FakeMediaStreamUIProxy>(
+        true /* tests_use_fake_render_frame_hosts */);
+  }));
+
+  const int num_call_iterations = 3;
+
+  // Test that if |info.strategy| is provided as SEARCH_BY_SESSION_ID with
+  // |info.session_id| set to an non-existing ID a new stream is provided and
+  // that if the ID is valid, that the stream is reused.
+  auto token = base::UnguessableToken::Create();
+  blink::MediaStreamDevice reference_device = CreateOrSearchAudioDeviceStream(
+      blink::mojom::StreamSelectionStrategy::SEARCH_BY_SESSION_ID, token);
+  EXPECT_NE(reference_device.session_id(), token);
+
+  for (int i = 0; i < num_call_iterations; ++i) {
+    blink::MediaStreamDevice audio_device = CreateOrSearchAudioDeviceStream(
+        blink::mojom::StreamSelectionStrategy::SEARCH_BY_SESSION_ID,
+        reference_device.session_id());
+    EXPECT_EQ(audio_device.id, "default");
+    EXPECT_EQ(blink::mojom::MediaStreamType::DEVICE_AUDIO_CAPTURE,
+              audio_device.type);
+    EXPECT_TRUE(audio_device.session_id());
+    EXPECT_EQ(audio_device.session_id(), reference_device.session_id());
+  }
+}
+
 TEST_F(MediaStreamManagerTest, GetDisplayMediaRequestVideoOnly) {
   RequestAndStopGetDisplayMedia(false /* request_audio */);
 }
@@ -588,6 +714,9 @@
   media_stream_manager_->GenerateStream(
       render_process_id, render_frame_id, requester_id, page_request_id,
       controls, MediaDeviceSaltAndOrigin(), false /* user_gesture */,
+      StreamSelectionInfo::New(
+          blink::mojom::StreamSelectionStrategy::SEARCH_BY_DEVICE_ID,
+          base::nullopt),
       std::move(generate_stream_callback),
       MediaStreamManager::DeviceStoppedCallback(),
       MediaStreamManager::DeviceChangedCallback());
@@ -615,18 +744,9 @@
 
   blink::MediaStreamDevice video_device;
   MediaStreamManager::GenerateStreamCallback generate_stream_callback =
-      base::BindOnce(
-          [](base::RunLoop* wait_loop, blink::MediaStreamDevice* video_device,
-             blink::mojom::MediaStreamRequestResult result,
-             const std::string& label,
-             const blink::MediaStreamDevices& audio_devices,
-             const blink::MediaStreamDevices& video_devices) {
-            EXPECT_EQ(0u, audio_devices.size());
-            ASSERT_EQ(1u, video_devices.size());
-            *video_device = video_devices[0];
-            wait_loop->Quit();
-          },
-          &run_loop_, &video_device);
+      base::BindOnce(GenerateStreamCallback, &run_loop_,
+                     false /* request_audio */, true /* request_video */,
+                     nullptr, &video_device);
   MediaStreamManager::DeviceStoppedCallback stopped_callback =
       base::BindRepeating(
           [](const std::string& label, const blink::MediaStreamDevice& device) {
@@ -642,6 +762,9 @@
   media_stream_manager_->GenerateStream(
       render_process_id, render_frame_id, requester_id, page_request_id,
       controls, MediaDeviceSaltAndOrigin(), false /* user_gesture */,
+      StreamSelectionInfo::New(
+          blink::mojom::StreamSelectionStrategy::SEARCH_BY_DEVICE_ID,
+          base::nullopt),
       std::move(generate_stream_callback), std::move(stopped_callback),
       std::move(changed_callback));
   run_loop_.Run();
@@ -675,18 +798,9 @@
 
   blink::MediaStreamDevice video_device;
   MediaStreamManager::GenerateStreamCallback generate_stream_callback =
-      base::BindOnce(
-          [](base::RunLoop* wait_loop, blink::MediaStreamDevice* video_device,
-             blink::mojom::MediaStreamRequestResult result,
-             const std::string& label,
-             const blink::MediaStreamDevices& audio_devices,
-             const blink::MediaStreamDevices& video_devices) {
-            EXPECT_EQ(0u, audio_devices.size());
-            ASSERT_EQ(1u, video_devices.size());
-            *video_device = video_devices[0];
-            wait_loop->Quit();
-          },
-          &run_loop_, &video_device);
+      base::BindOnce(GenerateStreamCallback, &run_loop_,
+                     false /* request_audio */, true /* request_video */,
+                     nullptr, &video_device);
   MediaStreamManager::DeviceStoppedCallback stopped_callback;
   MediaStreamManager::DeviceChangedCallback changed_callback =
       base::BindRepeating(
@@ -710,6 +824,9 @@
   media_stream_manager_->GenerateStream(
       render_process_id, render_frame_id, requester_id, page_request_id,
       controls, MediaDeviceSaltAndOrigin(), false /* user_gesture */,
+      StreamSelectionInfo::New(
+          blink::mojom::StreamSelectionStrategy::SEARCH_BY_DEVICE_ID,
+          base::nullopt),
       std::move(generate_stream_callback), std::move(stopped_callback),
       std::move(changed_callback));
   run_loop_.Run();
diff --git a/content/browser/renderer_host/render_message_filter.cc b/content/browser/renderer_host/render_message_filter.cc
index 2624494..1ec165d 100644
--- a/content/browser/renderer_host/render_message_filter.cc
+++ b/content/browser/renderer_host/render_message_filter.cc
@@ -173,9 +173,9 @@
 void RenderMessageFilter::SetThreadPriority(int32_t ns_tid,
                                             base::ThreadPriority priority) {
   constexpr base::TaskTraits kTraits = {
-      base::MayBlock(), base::TaskPriority::USER_BLOCKING,
+      base::ThreadPool(), base::MayBlock(), base::TaskPriority::USER_BLOCKING,
       base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN};
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, kTraits,
       base::BindOnce(&RenderMessageFilter::SetThreadPriorityOnFileThread, this,
                      static_cast<base::PlatformThreadId>(ns_tid), priority));
diff --git a/content/browser/renderer_host/render_process_host_browsertest.cc b/content/browser/renderer_host/render_process_host_browsertest.cc
index 700cf263..7b5e494 100644
--- a/content/browser/renderer_host/render_process_host_browsertest.cc
+++ b/content/browser/renderer_host/render_process_host_browsertest.cc
@@ -771,8 +771,8 @@
     // Cycle UI and IO loop once to ensure OnChannelClosing() has been delivered
     // to audio stream owners and they get a chance to notify of stream closure.
     base::RunLoop run_loop;
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO},
-                             media::BindToCurrentLoop(run_loop.QuitClosure()));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   media::BindToCurrentLoop(run_loop.QuitClosure()));
     run_loop.Run();
   }
 
@@ -871,8 +871,8 @@
     // Cycle UI and IO loop once to ensure OnChannelClosing() has been delivered
     // to audio stream owners and they get a chance to notify of stream closure.
     base::RunLoop run_loop;
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO},
-                             media::BindToCurrentLoop(run_loop.QuitClosure()));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   media::BindToCurrentLoop(run_loop.QuitClosure()));
     run_loop.Run();
   }
 
@@ -937,8 +937,8 @@
     // Cycle UI and IO loop once to ensure OnChannelClosing() has been delivered
     // to audio stream owners and they get a chance to notify of stream closure.
     base::RunLoop run_loop;
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO},
-                             media::BindToCurrentLoop(run_loop.QuitClosure()));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   media::BindToCurrentLoop(run_loop.QuitClosure()));
     run_loop.Run();
   }
 
diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
index dfc6de6..75c23880 100644
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc
@@ -724,10 +724,9 @@
 
  private:
   void PostTask() {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::UI},
-        base::BindOnce(&RenderProcessHostIsReadyObserver::CallTask,
-                       weak_factory_.GetWeakPtr()));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(&RenderProcessHostIsReadyObserver::CallTask,
+                                  weak_factory_.GetWeakPtr()));
   }
 
   void CallTask() {
@@ -1159,7 +1158,7 @@
 void AddCorbExceptionForPluginOnIOThread(int process_id) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&AddCorbExceptionForPluginOnUIThread, process_id));
 }
@@ -1526,10 +1525,9 @@
   if (!GetBrowserContext()->IsOffTheRecord() &&
       !base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kDisableGpuShaderDiskCache)) {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(&CacheShaderInfo, GetID(),
-                       storage_partition_impl_->GetPath()));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&CacheShaderInfo, GetID(),
+                                  storage_partition_impl_->GetPath()));
   }
 
   // This instance of PushMessagingManager is only used from clients bound to
@@ -1548,7 +1546,7 @@
       ChildProcessHostImpl::ChildProcessUniqueIdToTracingProcessId(id);
   gpu_client_.reset(new viz::GpuClient(
       std::make_unique<BrowserGpuClientDelegate>(), id, tracing_id,
-      base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO})));
+      base::CreateSingleThreadTaskRunner({BrowserThread::IO})));
 }
 
 // static
@@ -1610,8 +1608,8 @@
 
   if (!base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kDisableGpuShaderDiskCache)) {
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO},
-                             base::BindOnce(&RemoveShaderInfo, GetID()));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&RemoveShaderInfo, GetID()));
   }
 
   if (cleanup_corb_exception_for_plugin_upon_destruction_)
@@ -1698,7 +1696,7 @@
     // on separate threads.
     in_process_renderer_.reset(
         g_renderer_main_thread_factory(InProcessChildThreadParams(
-            base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO}),
+            base::CreateSingleThreadTaskRunner({BrowserThread::IO}),
             &mojo_invitation_, child_connection_->service_token())));
 
     base::Thread::Options options;
@@ -1760,7 +1758,7 @@
 
 void RenderProcessHostImpl::InitializeChannelProxy() {
   scoped_refptr<base::SingleThreadTaskRunner> io_task_runner =
-      base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO});
+      base::CreateSingleThreadTaskRunner({BrowserThread::IO});
 
   // Acquire a Connector which will route connections to a new instance of the
   // renderer service.
@@ -1949,7 +1947,7 @@
 void RenderProcessHostImpl::BindFileSystemManager(
     blink::mojom::FileSystemManagerRequest request) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&FileSystemManagerImpl::BindRequest,
                      base::Unretained(file_system_manager_impl_.get()),
@@ -1969,7 +1967,7 @@
     return;
 
   IncrementKeepAliveRefCount();
-  base::PostDelayedTaskWithTraits(
+  base::PostDelayedTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(
           &RenderProcessHostImpl::CancelProcessShutdownDelayForUnload,
@@ -2042,11 +2040,11 @@
       base::BindRepeating(&RenderProcessHostImpl::BindWebDatabaseHostImpl,
                           base::Unretained(this)));
 
-  registry->AddInterface(
-      base::BindRepeating(&MimeRegistryImpl::Create),
-      base::CreateSequencedTaskRunnerWithTraits(
-          {base::MayBlock(), base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN,
-           base::TaskPriority::USER_BLOCKING}));
+  registry->AddInterface(base::BindRepeating(&MimeRegistryImpl::Create),
+                         base::CreateSequencedTaskRunner(
+                             {base::ThreadPool(), base::MayBlock(),
+                              base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN,
+                              base::TaskPriority::USER_BLOCKING}));
 #if BUILDFLAG(USE_MINIKIN_HYPHENATION)
   registry->AddInterface(
       base::BindRepeating(&hyphenation::HyphenationImpl::Create),
@@ -2098,8 +2096,8 @@
 
   registry->AddInterface(
       base::BindRepeating(&FileUtilitiesHostImpl::Create, GetID()),
-      base::CreateSequencedTaskRunnerWithTraits(
-          {base::MayBlock(), base::TaskPriority::USER_VISIBLE}));
+      base::CreateSequencedTaskRunner({base::ThreadPool(), base::MayBlock(),
+                                       base::TaskPriority::USER_VISIBLE}));
 
   registry->AddInterface(base::BindRepeating(
       &RenderProcessHostImpl::CreateMediaStreamTrackMetricsHost,
@@ -3384,7 +3382,7 @@
     return;
 
   if (is_initialized_) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&WebRtcLog::ClearLogMessageCallback, GetID()));
   }
@@ -3445,7 +3443,7 @@
     // that destroys the ResourceContext. Therefore the ClearResourceContext
     // task must be posted now to ensure it gets ahead of the destruction of
     // the ResourceContext in the IOThread sequence.
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&RenderFrameMessageFilter::ClearResourceContext,
                        render_frame_message_filter_));
diff --git a/content/browser/renderer_host/render_process_host_impl.h b/content/browser/renderer_host/render_process_host_impl.h
index 6e7166e..8dd811f 100644
--- a/content/browser/renderer_host/render_process_host_impl.h
+++ b/content/browser/renderer_host/render_process_host_impl.h
@@ -672,7 +672,7 @@
     registry->AddInterface(
         base::Bind(&InterfaceGetter<CallbackType>::GetInterfaceOnUIThread,
                    instance_weak_factory_->GetWeakPtr(), callback),
-        base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::UI}));
+        base::CreateSingleThreadTaskRunner({BrowserThread::UI}));
   }
 
   // Callback to unblock process shutdown after waiting for unload handlers to
diff --git a/content/browser/renderer_host/render_widget_helper.cc b/content/browser/renderer_host/render_widget_helper.cc
index c5f088023..d711d4e 100644
--- a/content/browser/renderer_host/render_widget_helper.cc
+++ b/content/browser/renderer_host/render_widget_helper.cc
@@ -47,9 +47,9 @@
 void RenderWidgetHelper::Init(int render_process_id) {
   render_process_id_ = render_process_id;
 
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO},
-                           base::BindOnce(&AddWidgetHelper, render_process_id_,
-                                          base::WrapRefCounted(this)));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&AddWidgetHelper, render_process_id_,
+                                base::WrapRefCounted(this)));
 }
 
 int RenderWidgetHelper::GetNextRoutingID() {
@@ -70,17 +70,16 @@
                                          int* route_id) {
   *route_id = GetNextRoutingID();
 
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::UI},
-      base::BindOnce(&RenderWidgetHelper::OnCreateWidgetOnUI, this, opener_id,
-                     *route_id, widget.PassInterface()));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(&RenderWidgetHelper::OnCreateWidgetOnUI, this,
+                                opener_id, *route_id, widget.PassInterface()));
 }
 
 void RenderWidgetHelper::CreateNewFullscreenWidget(int opener_id,
                                                    mojom::WidgetPtr widget,
                                                    int* route_id) {
   *route_id = GetNextRoutingID();
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&RenderWidgetHelper::OnCreateFullscreenWidgetOnUI, this,
                      opener_id, *route_id, widget.PassInterface()));
diff --git a/content/browser/sandbox_support_mac_impl.mm b/content/browser/sandbox_support_mac_impl.mm
index be9bf2a..8bf0c31 100644
--- a/content/browser/sandbox_support_mac_impl.mm
+++ b/content/browser/sandbox_support_mac_impl.mm
@@ -24,8 +24,7 @@
 }
 
 void SandboxSupportMacImpl::GetSystemColors(GetSystemColorsCallback callback) {
-  auto task_runner =
-      base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::UI});
+  auto task_runner = base::CreateSingleThreadTaskRunner({BrowserThread::UI});
   base::PostTaskAndReplyWithResult(
       task_runner.get(), FROM_HERE,
       base::BindOnce(&ThemeHelperMac::DuplicateReadOnlyColorMapRegion,
diff --git a/content/browser/scheduler/browser_task_executor_unittest.cc b/content/browser/scheduler/browser_task_executor_unittest.cc
index d0c8965..327736c9 100644
--- a/content/browser/scheduler/browser_task_executor_unittest.cc
+++ b/content/browser/scheduler/browser_task_executor_unittest.cc
@@ -54,7 +54,7 @@
     base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE, task_2.Get());
   }));
 
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI}, task_1.Get());
+  base::PostTask(FROM_HERE, {BrowserThread::UI}, task_1.Get());
 
   BrowserTaskExecutor::RunAllPendingTasksOnThreadForTesting(BrowserThread::UI);
 
@@ -68,10 +68,10 @@
   StrictMockTask task_1;
   StrictMockTask task_2;
   EXPECT_CALL(task_1, Run).WillOnce(testing::Invoke([&]() {
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO}, task_2.Get());
+    base::PostTask(FROM_HERE, {BrowserThread::IO}, task_2.Get());
   }));
 
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO}, task_1.Get());
+  base::PostTask(FROM_HERE, {BrowserThread::IO}, task_1.Get());
 
   BrowserTaskExecutor::RunAllPendingTasksOnThreadForTesting(BrowserThread::IO);
 
@@ -87,15 +87,15 @@
   StrictMockTask task_3;
 
   EXPECT_CALL(task_1, Run).WillOnce(Invoke([&]() {
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO}, task_2.Get());
+    base::PostTask(FROM_HERE, {BrowserThread::IO}, task_2.Get());
     BrowserTaskExecutor::RunAllPendingTasksOnThreadForTesting(
         BrowserThread::IO);
   }));
   EXPECT_CALL(task_2, Run).WillOnce(Invoke([&]() {
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO}, task_3.Get());
+    base::PostTask(FROM_HERE, {BrowserThread::IO}, task_3.Get());
   }));
 
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO}, task_1.Get());
+  base::PostTask(FROM_HERE, {BrowserThread::IO}, task_1.Get());
   BrowserTaskExecutor::RunAllPendingTasksOnThreadForTesting(BrowserThread::IO);
 
   // Cleanup pending tasks, as TestBrowserThreadBundle will run them.
@@ -200,15 +200,15 @@
   StrictMockTask user_visible;
   StrictMockTask user_blocking;
 
-  base::PostTaskWithTraits(FROM_HERE,
-                           {BrowserThread::UI, base::TaskPriority::BEST_EFFORT},
-                           best_effort.Get());
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::UI, base::TaskPriority::USER_VISIBLE},
-      user_visible.Get());
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::UI, base::TaskPriority::USER_BLOCKING},
-      user_blocking.Get());
+  base::PostTask(FROM_HERE,
+                 {BrowserThread::UI, base::TaskPriority::BEST_EFFORT},
+                 best_effort.Get());
+  base::PostTask(FROM_HERE,
+                 {BrowserThread::UI, base::TaskPriority::USER_VISIBLE},
+                 user_visible.Get());
+  base::PostTask(FROM_HERE,
+                 {BrowserThread::UI, base::TaskPriority::USER_BLOCKING},
+                 user_blocking.Get());
 
   EXPECT_CALL(user_visible, Run);
   EXPECT_CALL(user_blocking, Run);
@@ -218,7 +218,7 @@
 
 TEST_F(BrowserTaskExecutorWithCustomSchedulerTest,
        BestEffortTasksRunAfterStartup) {
-  auto ui_best_effort_runner = base::CreateSingleThreadTaskRunnerWithTraits(
+  auto ui_best_effort_runner = base::CreateSingleThreadTaskRunner(
       {BrowserThread::UI, base::TaskPriority::BEST_EFFORT});
 
   StrictMockTask best_effort;
@@ -226,12 +226,12 @@
   ui_best_effort_runner->PostTask(FROM_HERE, best_effort.Get());
   ui_best_effort_runner->PostDelayedTask(
       FROM_HERE, best_effort.Get(), base::TimeDelta::FromMilliseconds(100));
-  base::PostDelayedTaskWithTraits(
+  base::PostDelayedTask(
       FROM_HERE, {BrowserThread::UI, base::TaskPriority::BEST_EFFORT},
       best_effort.Get(), base::TimeDelta::FromMilliseconds(100));
-  base::PostTaskWithTraits(FROM_HERE,
-                           {BrowserThread::UI, base::TaskPriority::BEST_EFFORT},
-                           best_effort.Get());
+  base::PostTask(FROM_HERE,
+                 {BrowserThread::UI, base::TaskPriority::BEST_EFFORT},
+                 best_effort.Get());
   scoped_task_environment_.RunUntilIdle();
 
   BrowserTaskExecutor::EnableAllQueues();
diff --git a/content/browser/scheduler/responsiveness/README b/content/browser/scheduler/responsiveness/README
index 96429ebb..a5a3922 100644
--- a/content/browser/scheduler/responsiveness/README
+++ b/content/browser/scheduler/responsiveness/README
@@ -3,7 +3,7 @@
 
 There are four types of work executed on the UI and IO threads.
 1) Both the UI and IO threads can have tasks posted to them via the Task
-   Scheduler [e.g. via base::PostTaskWithTraits with a BrowserThread::ID].
+   Scheduler [e.g. via base::PostTask with a BrowserThread::ID].
 2) The UI thread processes native events directly from the message loop
    [NSEvents on macOS, MSGs on Windows, InputEvents on Android, XEvents on
    X11, etc.]
diff --git a/content/browser/scheduler/responsiveness/jank_monitor.cc b/content/browser/scheduler/responsiveness/jank_monitor.cc
index dbfe34f..5b25f54 100644
--- a/content/browser/scheduler/responsiveness/jank_monitor.cc
+++ b/content/browser/scheduler/responsiveness/jank_monitor.cc
@@ -172,7 +172,7 @@
 
 scoped_refptr<base::SequencedTaskRunner>
 JankMonitor::CreateMonitorTaskRunner() {
-  return base::CreateSequencedTaskRunnerWithTraits({});
+  return base::CreateSequencedTaskRunner({base::ThreadPool()});
 }
 
 std::unique_ptr<MetricSource> JankMonitor::CreateMetricSource () {
diff --git a/content/browser/scheduler/responsiveness/jank_monitor_unittest.cc b/content/browser/scheduler/responsiveness/jank_monitor_unittest.cc
index a333525c..b8d57cb 100644
--- a/content/browser/scheduler/responsiveness/jank_monitor_unittest.cc
+++ b/content/browser/scheduler/responsiveness/jank_monitor_unittest.cc
@@ -171,21 +171,20 @@
 
   // Post a janky task to the UI thread. Number of callback calls should be
   // incremented by 1.
-  base::PostTaskWithTraits(FROM_HERE, {content::BrowserThread::UI},
-                           base::BindLambdaForTesting(janky_task));
+  base::PostTask(FROM_HERE, {content::BrowserThread::UI},
+                 base::BindLambdaForTesting(janky_task));
   RunAllThreadsUntilIdle();
   VALIDATE_TEST_OBSERVER_CALLS();
 
   // Post a non janky task. Number of callback calls should remain the same.
-  base::PostTaskWithTraits(FROM_HERE, {content::BrowserThread::UI},
-                           base::DoNothing());
+  base::PostTask(FROM_HERE, {content::BrowserThread::UI}, base::DoNothing());
   RunAllThreadsUntilIdle();
   VALIDATE_TEST_OBSERVER_CALLS();
 
   // Post a janky task again. Monitor thread timer should fire again. Number of
   // callback calls should be incremented by 1 again.
-  base::PostTaskWithTraits(FROM_HERE, {content::BrowserThread::UI},
-                           base::BindLambdaForTesting(janky_task));
+  base::PostTask(FROM_HERE, {content::BrowserThread::UI},
+                 base::BindLambdaForTesting(janky_task));
   RunAllThreadsUntilIdle();
   VALIDATE_TEST_OBSERVER_CALLS();
 }
@@ -208,8 +207,8 @@
 
   // Post a janky task to the IO thread. This should increment the number of
   // callback calls by 1.
-  base::PostTaskWithTraits(FROM_HERE, {content::BrowserThread::IO},
-                           base::BindLambdaForTesting(janky_task));
+  base::PostTask(FROM_HERE, {content::BrowserThread::IO},
+                 base::BindLambdaForTesting(janky_task));
   RunAllThreadsUntilIdle();
   VALIDATE_TEST_OBSERVER_CALLS();
 }
@@ -235,8 +234,8 @@
       // The callback shouldn't be called.
       VALIDATE_TEST_OBSERVER_CALLS();
     };
-    base::PostTaskWithTraits(FROM_HERE, {content::BrowserThread::UI},
-                             base::BindLambdaForTesting(nested_janky_task));
+    base::PostTask(FROM_HERE, {content::BrowserThread::UI},
+                   base::BindLambdaForTesting(nested_janky_task));
     // Spin a nested run loop to run |nested_janky_task|.
     base::RunLoop(base::RunLoop::Type::kNestableTasksAllowed).RunUntilIdle();
     expected_jank_stopped_++;
@@ -244,8 +243,8 @@
 
   // Post a janky task to the UI thread. Number of callback calls should be
   // incremented by 1.
-  base::PostTaskWithTraits(FROM_HERE, {content::BrowserThread::UI},
-                           base::BindLambdaForTesting(janky_task));
+  base::PostTask(FROM_HERE, {content::BrowserThread::UI},
+                 base::BindLambdaForTesting(janky_task));
   RunAllThreadsUntilIdle();
   VALIDATE_TEST_OBSERVER_CALLS();
 }
@@ -272,8 +271,8 @@
 
       // Monitor should observe that the jank has started.
     };
-    base::PostTaskWithTraits(FROM_HERE, {content::BrowserThread::IO},
-                             base::BindLambdaForTesting(janky_task_io));
+    base::PostTask(FROM_HERE, {content::BrowserThread::IO},
+                   base::BindLambdaForTesting(janky_task_io));
     RunAllThreadsUntilIdle();
     // TestJankMonitor::OnJankStopped() shouldn't be called.
     VALIDATE_TEST_OBSERVER_CALLS();
@@ -281,8 +280,8 @@
     FastForwardAllThreadsByMs(500);
     expected_jank_stopped_++;
   };
-  base::PostTaskWithTraits(FROM_HERE, {content::BrowserThread::UI},
-                           base::BindLambdaForTesting(janky_task_ui));
+  base::PostTask(FROM_HERE, {content::BrowserThread::UI},
+                 base::BindLambdaForTesting(janky_task_ui));
   RunAllThreadsUntilIdle();
   // Expect that TestJankMonitor::OnJankStopped() was called.
   VALIDATE_TEST_OBSERVER_CALLS();
@@ -292,8 +291,8 @@
 // timer on new activity.
 TEST_F(JankMonitorTest, StartStopTimer) {
   // Activity on the UI thread - timer should be running.
-  base::PostTaskWithTraits(FROM_HERE, {content::BrowserThread::UI},
-                           base::BindOnce(base::DoNothing::Once()));
+  base::PostTask(FROM_HERE, {content::BrowserThread::UI},
+                 base::BindOnce(base::DoNothing::Once()));
   RunAllThreadsUntilIdle();
   EXPECT_TRUE(monitor_->timer_running());
 
@@ -303,8 +302,8 @@
   EXPECT_FALSE(monitor_->timer_running());
 
   // Activity on IO thread - timer should be restarted.
-  base::PostTaskWithTraits(FROM_HERE, {content::BrowserThread::IO},
-                           base::BindOnce(base::DoNothing::Once()));
+  base::PostTask(FROM_HERE, {content::BrowserThread::IO},
+                 base::BindOnce(base::DoNothing::Once()));
   RunAllThreadsUntilIdle();
   EXPECT_TRUE(monitor_->timer_running());
 
diff --git a/content/browser/scheduler/responsiveness/metric_source.cc b/content/browser/scheduler/responsiveness/metric_source.cc
index ca180779..1119a16 100644
--- a/content/browser/scheduler/responsiveness/metric_source.cc
+++ b/content/browser/scheduler/responsiveness/metric_source.cc
@@ -33,7 +33,7 @@
   RegisterMessageLoopObserverUI();
   native_event_observer_ui_ = CreateNativeEventObserver();
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {content::BrowserThread::IO},
       base::BindOnce(&MetricSource::SetUpOnIOThread, base::Unretained(this)));
 }
@@ -47,7 +47,7 @@
   message_loop_observer_ui_.reset();
   native_event_observer_ui_.reset();
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {content::BrowserThread::IO},
       base::BindOnce(&MetricSource::TearDownOnIOThread, base::Unretained(this),
                      std::move(on_finish_destroy)));
@@ -108,7 +108,7 @@
 
   message_loop_observer_io_.reset();
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {content::BrowserThread::UI},
       base::BindOnce(&MetricSource::TearDownOnUIThread, base::Unretained(this),
                      std::move(on_finish_destroy)));
diff --git a/content/browser/scheduler/responsiveness/metric_source_unittest.cc b/content/browser/scheduler/responsiveness/metric_source_unittest.cc
index 89e4170..15a36a9 100644
--- a/content/browser/scheduler/responsiveness/metric_source_unittest.cc
+++ b/content/browser/scheduler/responsiveness/metric_source_unittest.cc
@@ -22,8 +22,10 @@
 class FakeDelegate : public MetricSource::Delegate {
  public:
   FakeDelegate()
-      : set_up_on_io_thread_(false), tear_down_on_io_thread_(false),
-        will_run_task_on_io_thread_(0), did_run_task_on_io_thread_(0) {}
+      : set_up_on_io_thread_(false),
+        tear_down_on_io_thread_(false),
+        will_run_task_on_io_thread_(0),
+        did_run_task_on_io_thread_(0) {}
   ~FakeDelegate() override = default;
 
   void SetUpOnIOThread() override { set_up_on_io_thread_ = true; }
@@ -153,14 +155,12 @@
   test_browser_thread_bundle_.RunIOThreadUntilIdle();
   test_browser_thread_bundle_.RunUntilIdle();
 
-  base::PostTaskWithTraits(FROM_HERE, {content::BrowserThread::UI},
-                           base::DoNothing());
+  base::PostTask(FROM_HERE, {content::BrowserThread::UI}, base::DoNothing());
   test_browser_thread_bundle_.RunUntilIdle();
   EXPECT_GT(delegate->will_run_task_on_ui_thread(), 0);
   EXPECT_GT(delegate->did_run_task_on_ui_thread(), 0);
 
-  base::PostTaskWithTraits(FROM_HERE, {content::BrowserThread::IO},
-                           base::DoNothing());
+  base::PostTask(FROM_HERE, {content::BrowserThread::IO}, base::DoNothing());
   test_browser_thread_bundle_.RunUntilIdle();
   EXPECT_GT(delegate->will_run_task_on_io_thread(), 0);
   EXPECT_GT(delegate->did_run_task_on_io_thread(), 0);
diff --git a/content/browser/scheduler/responsiveness/watcher_unittest.cc b/content/browser/scheduler/responsiveness/watcher_unittest.cc
index 33c90ebe..681af6c 100644
--- a/content/browser/scheduler/responsiveness/watcher_unittest.cc
+++ b/content/browser/scheduler/responsiveness/watcher_unittest.cc
@@ -235,24 +235,23 @@
 
 TEST_F(ResponsivenessWatcherRealIOThreadTest, MessageLoopObserver) {
   // Post a do-nothing task onto the UI thread.
-  base::PostTaskWithTraits(FROM_HERE, {content::BrowserThread::UI},
-                           base::BindOnce([]() {}));
+  base::PostTask(FROM_HERE, {content::BrowserThread::UI},
+                 base::BindOnce([]() {}));
 
   // Post a do-nothing task onto the IO thread.
-  base::PostTaskWithTraits(FROM_HERE, {content::BrowserThread::IO},
-                           base::BindOnce([]() {}));
+  base::PostTask(FROM_HERE, {content::BrowserThread::IO},
+                 base::BindOnce([]() {}));
 
   // Post a task onto the IO thread that hops back to the UI thread. This
   // guarantees that both of the do-nothing tasks have already been processed.
   base::RunLoop run_loop;
-  base::PostTaskWithTraits(FROM_HERE, {content::BrowserThread::IO},
-                           base::BindOnce(
-                               [](base::OnceClosure quit_closure) {
-                                 base::PostTaskWithTraits(
-                                     FROM_HERE, {content::BrowserThread::UI},
-                                     std::move(quit_closure));
-                               },
-                               run_loop.QuitClosure()));
+  base::PostTask(FROM_HERE, {content::BrowserThread::IO},
+                 base::BindOnce(
+                     [](base::OnceClosure quit_closure) {
+                       base::PostTask(FROM_HERE, {content::BrowserThread::UI},
+                                      std::move(quit_closure));
+                     },
+                     run_loop.QuitClosure()));
   run_loop.Run();
 
   ASSERT_GE(watcher_->NumTasksOnUIThread(), 1);
diff --git a/content/browser/scheduler/scoped_do_not_use_ui_default_queue_from_io_unittest.cc b/content/browser/scheduler/scoped_do_not_use_ui_default_queue_from_io_unittest.cc
index 9c7ac2cc..d950421a 100644
--- a/content/browser/scheduler/scoped_do_not_use_ui_default_queue_from_io_unittest.cc
+++ b/content/browser/scheduler/scoped_do_not_use_ui_default_queue_from_io_unittest.cc
@@ -33,14 +33,13 @@
     TestBrowserThreadBundle thread_bundle;
     base::RunLoop run_loop;
 
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO}, base::BindLambdaForTesting([&]() {
           ScopedDoNotUseUIDefaultQueueFromIO do_not_post_to_ui_default(
               FROM_HERE);
 
           // Posting to the UI thread with no other traits is prohibited.
-          base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                                   base::DoNothing());
+          base::PostTask(FROM_HERE, {BrowserThread::UI}, base::DoNothing());
         }));
 
     run_loop.Run();
@@ -52,26 +51,24 @@
 
   base::RunLoop run_loop;
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO}, base::BindLambdaForTesting([&]() {
         {
           ScopedDoNotUseUIDefaultQueueFromIO do_not_post_to_ui_default(
               FROM_HERE);
 
           // Posting with non default BrowserTaskType is OK.
-          base::PostTaskWithTraits(
-              FROM_HERE, {BrowserThread::IO, BrowserTaskType::kNavigation},
-              base::DoNothing());
+          base::PostTask(FROM_HERE,
+                         {BrowserThread::IO, BrowserTaskType::kNavigation},
+                         base::DoNothing());
 
           // Posting to the IO thread default queue is OK.
-          base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO},
-                                   base::DoNothing());
+          base::PostTask(FROM_HERE, {BrowserThread::IO}, base::DoNothing());
         }
 
         // After |do_not_post_to_ui_default| has gone out of scope it's fine to
         // post to the UI thread's default queue again.
-        base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                                 run_loop.QuitClosure());
+        base::PostTask(FROM_HERE, {BrowserThread::UI}, run_loop.QuitClosure());
       }));
 
   run_loop.Run();
@@ -82,13 +79,12 @@
       TestBrowserThreadBundle::REAL_IO_THREAD);
   base::RunLoop run_loop;
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI}, base::BindLambdaForTesting([&]() {
         ScopedDoNotUseUIDefaultQueueFromIO do_not_post_to_ui_default(FROM_HERE);
 
         // It's fine to post from the UI thread.
-        base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                                 run_loop.QuitClosure());
+        base::PostTask(FROM_HERE, {BrowserThread::UI}, run_loop.QuitClosure());
       }));
 
   run_loop.Run();
diff --git a/content/browser/screenlock_monitor/screenlock_monitor_device_source_win.cc b/content/browser/screenlock_monitor/screenlock_monitor_device_source_win.cc
index 486470e..5cb6645 100644
--- a/content/browser/screenlock_monitor/screenlock_monitor_device_source_win.cc
+++ b/content/browser/screenlock_monitor/screenlock_monitor_device_source_win.cc
@@ -25,8 +25,8 @@
       base::BindOnce(base::IgnoreResult(&::WTSRegisterSessionNotification),
                      window_->hwnd(), NOTIFY_FOR_ALL_SESSIONS);
 
-  base::CreateCOMSTATaskRunnerWithTraits({})->PostTask(FROM_HERE,
-                                                       std::move(wts_register));
+  base::CreateCOMSTATaskRunner({base::ThreadPool()})
+      ->PostTask(FROM_HERE, std::move(wts_register));
 }
 
 ScreenlockMonitorDeviceSource::SessionMessageWindow::~SessionMessageWindow() {
diff --git a/content/browser/security_exploit_browsertest.cc b/content/browser/security_exploit_browsertest.cc
index 3b898c91..f922ccd 100644
--- a/content/browser/security_exploit_browsertest.cc
+++ b/content/browser/security_exploit_browsertest.cc
@@ -282,7 +282,7 @@
     // initialization, ref. comment on InitializeAndListen() above.
     embedded_test_server()->StartAcceptingConnections();
 
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&net::URLRequestSlowDownloadJob::AddUrlHandler));
   }
diff --git a/content/browser/service_manager/common_browser_interfaces.cc b/content/browser/service_manager/common_browser_interfaces.cc
index 76d973c..9fe6be0d 100644
--- a/content/browser/service_manager/common_browser_interfaces.cc
+++ b/content/browser/service_manager/common_browser_interfaces.cc
@@ -46,8 +46,9 @@
     registry_.AddInterface(base::BindRepeating(&FontCacheDispatcher::Create));
     registry_.AddInterface(
         base::BindRepeating(&DWriteFontProxyImpl::Create),
-        base::CreateSequencedTaskRunnerWithTraits(
-            {base::TaskPriority::USER_BLOCKING, base::MayBlock()}));
+        base::CreateSequencedTaskRunner({base::ThreadPool(),
+                                         base::TaskPriority::USER_BLOCKING,
+                                         base::MayBlock()}));
 #elif defined(OS_MACOSX)
     registry_.AddInterface(
         base::BindRepeating(&SandboxSupportMacImpl::BindRequest,
@@ -103,7 +104,7 @@
     auto gpu_client = std::make_unique<viz::GpuClient>(
         std::make_unique<BrowserGpuClientDelegate>(), gpu_client_id,
         gpu_client_tracing_id,
-        base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO}));
+        base::CreateSingleThreadTaskRunner({BrowserThread::IO}));
     gpu_client->SetConnectionErrorHandler(
         base::BindOnce(&ConnectionFilterImpl::OnGpuConnectionClosed,
                        base::Unretained(this), source_info.identity));
diff --git a/content/browser/service_manager/service_manager_context.cc b/content/browser/service_manager/service_manager_context.cc
index 51d0680..c12f40db 100644
--- a/content/browser/service_manager/service_manager_context.cc
+++ b/content/browser/service_manager/service_manager_context.cc
@@ -636,9 +636,9 @@
 #if defined(OS_LINUX)
   RegisterInProcessService(
       font_service::mojom::kServiceName,
-      base::CreateSequencedTaskRunnerWithTraits(
-          base::TaskTraits({base::MayBlock(), base::WithBaseSyncPrimitives(),
-                            base::TaskPriority::USER_BLOCKING})),
+      base::CreateSequencedTaskRunner({base::ThreadPool(), base::MayBlock(),
+                                       base::WithBaseSyncPrimitives(),
+                                       base::TaskPriority::USER_BLOCKING}),
       base::BindRepeating(&CreateFontService));
 #endif
 
@@ -650,13 +650,13 @@
   GetContentClient()->browser()->WillStartServiceManager();
 
   if (base::FeatureList::IsEnabled(features::kTracingServiceInProcess)) {
-    RegisterInProcessService(
-        tracing::mojom::kServiceName,
-        base::CreateSequencedTaskRunnerWithTraits(
-            {base::MayBlock(), base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN,
-             base::WithBaseSyncPrimitives(),
-             base::TaskPriority::USER_BLOCKING}),
-        base::BindRepeating(&CreateTracingService));
+    RegisterInProcessService(tracing::mojom::kServiceName,
+                             base::CreateSequencedTaskRunner(
+                                 {base::ThreadPool(), base::MayBlock(),
+                                  base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN,
+                                  base::WithBaseSyncPrimitives(),
+                                  base::TaskPriority::USER_BLOCKING}),
+                             base::BindRepeating(&CreateTracingService));
   }
 
   if (IsInProcessNetworkService()) {
@@ -722,8 +722,9 @@
     // thread affinity on the clients. We therefore require a single-thread
     // runner.
     scoped_refptr<base::SingleThreadTaskRunner> device_blocking_task_runner =
-        base::CreateSingleThreadTaskRunnerWithTraits(
-            {base::MayBlock(), base::TaskPriority::BEST_EFFORT});
+        base::CreateSingleThreadTaskRunner({base::ThreadPool(),
+                                            base::MayBlock(),
+                                            base::TaskPriority::BEST_EFFORT});
 #if defined(OS_ANDROID)
     JNIEnv* env = base::android::AttachCurrentThread();
     base::android::ScopedJavaGlobalRef<jobject> java_nfc_delegate;
diff --git a/content/browser/service_process_host_impl.cc b/content/browser/service_process_host_impl.cc
index 50034ead..f0873d3 100644
--- a/content/browser/service_process_host_impl.cc
+++ b/content/browser/service_process_host_impl.cc
@@ -30,8 +30,7 @@
  public:
   ServiceProcessTracker()
       : ui_task_runner_(
-            base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::UI})) {
-  }
+            base::CreateSingleThreadTaskRunner({BrowserThread::UI})) {}
   ~ServiceProcessTracker() = default;
 
   ServiceProcessInfo AddProcess(const base::Process& process,
@@ -201,7 +200,7 @@
 void ServiceProcessHost::Launch(mojo::GenericPendingReceiver receiver,
                                 Options options) {
   DCHECK(receiver.interface_name().has_value());
-  base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO})
+  base::CreateSingleThreadTaskRunner({BrowserThread::IO})
       ->PostTask(FROM_HERE,
                  base::BindOnce(&LaunchServiceProcessOnIOThread,
                                 std::move(receiver), std::move(options)));
diff --git a/content/browser/site_per_process_browsertest.cc b/content/browser/site_per_process_browsertest.cc
index 71ae4e1..0a6c35a 100644
--- a/content/browser/site_per_process_browsertest.cc
+++ b/content/browser/site_per_process_browsertest.cc
@@ -634,23 +634,21 @@
     // OnUpdateViewportIntersection returns. This additional post on the IO
     // thread guarantees that by the time OnUpdateViewportIntersectionOnUI runs,
     // the message has been handled on the UI thread.
-    base::PostTaskWithTraits(
-        FROM_HERE, {content::BrowserThread::IO},
-        base::BindOnce(&UpdateViewportIntersectionMessageFilter::
-                           OnUpdateViewportIntersectionPostOnIO,
-                       this, viewport_intersection, compositing_rect,
-                       occlusion_state));
+    base::PostTask(FROM_HERE, {content::BrowserThread::IO},
+                   base::BindOnce(&UpdateViewportIntersectionMessageFilter::
+                                      OnUpdateViewportIntersectionPostOnIO,
+                                  this, viewport_intersection, compositing_rect,
+                                  occlusion_state));
   }
   void OnUpdateViewportIntersectionPostOnIO(
       const gfx::Rect& viewport_intersection,
       const gfx::Rect& compositing_rect,
       blink::FrameOcclusionState occlusion_state) {
-    base::PostTaskWithTraits(
-        FROM_HERE, {content::BrowserThread::UI},
-        base::BindOnce(&UpdateViewportIntersectionMessageFilter::
-                           OnUpdateViewportIntersectionOnUI,
-                       this, viewport_intersection, compositing_rect,
-                       occlusion_state));
+    base::PostTask(FROM_HERE, {content::BrowserThread::UI},
+                   base::BindOnce(&UpdateViewportIntersectionMessageFilter::
+                                      OnUpdateViewportIntersectionOnUI,
+                                  this, viewport_intersection, compositing_rect,
+                                  occlusion_state));
   }
   void OnUpdateViewportIntersectionOnUI(
       const gfx::Rect& viewport_intersection,
@@ -7932,14 +7930,14 @@
                            WindowOpenDisposition disposition,
                            const gfx::Rect& initial_rect,
                            bool user_gesture) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {content::BrowserThread::UI},
         base::BindOnce(&PendingWidgetMessageFilter::OnReceivedRoutingIDOnUI,
                        this, pending_widget_routing_id));
   }
 
   void OnShowWidget(int routing_id, const gfx::Rect& initial_rect) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {content::BrowserThread::UI},
         base::BindOnce(&PendingWidgetMessageFilter::OnReceivedRoutingIDOnUI,
                        this, routing_id));
@@ -9835,10 +9833,9 @@
   ~SetIsInertMessageFilter() override {}
 
   void OnSetIsInert(bool is_inert) {
-    base::PostTaskWithTraits(
-        FROM_HERE, {content::BrowserThread::UI},
-        base::BindOnce(&SetIsInertMessageFilter::OnSetIsInertOnUI, this,
-                       is_inert));
+    base::PostTask(FROM_HERE, {content::BrowserThread::UI},
+                   base::BindOnce(&SetIsInertMessageFilter::OnSetIsInertOnUI,
+                                  this, is_inert));
   }
   void OnSetIsInertOnUI(bool is_inert) {
     is_inert_ = is_inert;
@@ -14868,6 +14865,10 @@
 // dies before the response for the navigation comes back, the response will
 // not trigger a process kill and will be allowed to commit in a new process.
 // See https://crbug.com/968259.
+// Note: This test needs to do a browser-initiated navigation because doing
+// a renderer-initiated navigation would lead to the navigation being canceled.
+// This behavior change has been introduced with PerNavigationMojoInterface and
+// is documented here https://crbug.com/988368.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        ProcessDiesBeforeCrossSiteNavigationCompletes) {
   GURL first_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
@@ -14878,7 +14879,9 @@
   // Start a cross-site navigation and proceed only up to the request start.
   GURL second_url(embedded_test_server()->GetURL("b.com", "/title1.html"));
   TestNavigationManager delayer(web_contents(), second_url);
-  EXPECT_TRUE(ExecuteScript(shell(), JsReplace("location = $1", second_url)));
+  web_contents()->GetController().LoadURL(
+      second_url, Referrer(), ui::PageTransition::PAGE_TRANSITION_TYPED,
+      std::string());
   EXPECT_TRUE(delayer.WaitForRequestStart());
 
   // Terminate the current a.com process.
diff --git a/content/browser/site_per_process_hit_test_browsertest.cc b/content/browser/site_per_process_hit_test_browsertest.cc
index f94b997..9976836 100644
--- a/content/browser/site_per_process_hit_test_browsertest.cc
+++ b/content/browser/site_per_process_hit_test_browsertest.cc
@@ -3871,9 +3871,9 @@
 
   bool OnMessageReceived(const IPC::Message& message) override {
     if (message.type() == WidgetHostMsg_SetCursor::ID) {
-      base::PostTaskWithTraits(FROM_HERE, {content::BrowserThread::UI},
-                               base::BindOnce(&CursorMessageFilter::OnSetCursor,
-                                              this, message.routing_id()));
+      base::PostTask(FROM_HERE, {content::BrowserThread::UI},
+                     base::BindOnce(&CursorMessageFilter::OnSetCursor, this,
+                                    message.routing_id()));
     }
     return false;
   }
diff --git a/content/browser/site_per_process_mac_browsertest.mm b/content/browser/site_per_process_mac_browsertest.mm
index db2f0b7..9085805 100644
--- a/content/browser/site_per_process_mac_browsertest.mm
+++ b/content/browser/site_per_process_mac_browsertest.mm
@@ -52,10 +52,9 @@
  private:
   void OnResult(const std::string& string, const gfx::Point& point) {
     if (!BrowserThread::CurrentlyOn(BrowserThread::UI)) {
-      base::PostTaskWithTraits(
-          FROM_HERE, {BrowserThread::UI},
-          base::BindOnce(&TextInputClientMacHelper::OnResult,
-                         base::Unretained(this), string, point));
+      base::PostTask(FROM_HERE, {BrowserThread::UI},
+                     base::BindOnce(&TextInputClientMacHelper::OnResult,
+                                    base::Unretained(this), string, point));
       return;
     }
     word_ = string;
diff --git a/content/browser/speech/speech_recognition_browsertest.cc b/content/browser/speech/speech_recognition_browsertest.cc
index 77c202e..a2143cfe 100644
--- a/content/browser/speech/speech_recognition_browsertest.cc
+++ b/content/browser/speech/speech_recognition_browsertest.cc
@@ -60,7 +60,7 @@
 
     // Posting callback to allow current SpeechRecognizerImpl dispatching event
     // to complete before transitioning to the next FSM state.
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {content::BrowserThread::IO},
         base::BindOnce(std::move(on_params_cb),
                        media::AudioParameters::UnavailableDeviceParams()));
@@ -229,10 +229,9 @@
     // AudioCaptureSourcer::Stop() again.
     SpeechRecognizerImpl::SetAudioEnvironmentForTesting(nullptr, nullptr);
 
-    base::PostTaskWithTraits(
-        FROM_HERE, {content::BrowserThread::UI},
-        base::BindOnce(&SpeechRecognitionBrowserTest::SendResponse,
-                       base::Unretained(this)));
+    base::PostTask(FROM_HERE, {content::BrowserThread::UI},
+                   base::BindOnce(&SpeechRecognitionBrowserTest::SendResponse,
+                                  base::Unretained(this)));
   }
 
   void SendResponse() {}
diff --git a/content/browser/speech/speech_recognition_dispatcher_host.cc b/content/browser/speech/speech_recognition_dispatcher_host.cc
index 9e2e1014..418dd84 100644
--- a/content/browser/speech/speech_recognition_dispatcher_host.cc
+++ b/content/browser/speech/speech_recognition_dispatcher_host.cc
@@ -73,7 +73,7 @@
     return;
   }
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&SpeechRecognitionDispatcherHost::StartRequestOnUI,
                      AsWeakPtr(), render_process_id_, render_frame_id_,
@@ -137,7 +137,7 @@
   StoragePartition* storage_partition = BrowserContext::GetStoragePartition(
       browser_context, web_contents->GetSiteInstance());
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           &SpeechRecognitionDispatcherHost::StartSessionOnIO,
diff --git a/content/browser/speech/speech_recognition_manager_impl.cc b/content/browser/speech/speech_recognition_manager_impl.cc
index 6c093d7..ef6371fe 100644
--- a/content/browser/speech/speech_recognition_manager_impl.cc
+++ b/content/browser/speech/speech_recognition_manager_impl.cc
@@ -195,7 +195,7 @@
     RenderFrameDeleted(RenderFrameHost* render_frame_host) {
   auto iters = observed_frames_.equal_range(render_frame_host);
   for (auto it = iters.first; it != iters.second; ++it) {
-    base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO})
+    base::CreateSingleThreadTaskRunner({BrowserThread::IO})
         ->PostTask(FROM_HERE,
                    base::BindOnce(parent_observer_->frame_deleted_callback_,
                                   it->second));
@@ -302,7 +302,7 @@
 
   // The deletion observer is owned by this class, so it's safe to use
   // Unretained.
-  base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::UI})
+  base::CreateSingleThreadTaskRunner({BrowserThread::UI})
       ->PostTask(
           FROM_HERE,
           base::BindOnce(&SpeechRecognitionManagerImpl::FrameDeletionObserver::
@@ -412,7 +412,7 @@
 
   // The deletion observer is owned by this class, so it's safe to use
   // Unretained.
-  base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::UI})
+  base::CreateSingleThreadTaskRunner({BrowserThread::UI})
       ->PostTask(
           FROM_HERE,
           base::BindOnce(&SpeechRecognitionManagerImpl::FrameDeletionObserver::
diff --git a/content/browser/speech/speech_recognizer_impl.cc b/content/browser/speech/speech_recognizer_impl.cc
index bc113e9..2216a4e6 100644
--- a/content/browser/speech/speech_recognizer_impl.cc
+++ b/content/browser/speech/speech_recognizer_impl.cc
@@ -224,22 +224,21 @@
   DCHECK(!device_id.empty());
   device_id_ = device_id;
 
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO},
-                           base::BindOnce(&SpeechRecognizerImpl::DispatchEvent,
-                                          this, FSMEventArgs(EVENT_PREPARE)));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&SpeechRecognizerImpl::DispatchEvent, this,
+                                FSMEventArgs(EVENT_PREPARE)));
 }
 
 void SpeechRecognizerImpl::AbortRecognition() {
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO},
-                           base::BindOnce(&SpeechRecognizerImpl::DispatchEvent,
-                                          this, FSMEventArgs(EVENT_ABORT)));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&SpeechRecognizerImpl::DispatchEvent, this,
+                                FSMEventArgs(EVENT_ABORT)));
 }
 
 void SpeechRecognizerImpl::StopAudioCapture() {
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&SpeechRecognizerImpl::DispatchEvent, this,
-                     FSMEventArgs(EVENT_STOP_CAPTURE)));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&SpeechRecognizerImpl::DispatchEvent, this,
+                                FSMEventArgs(EVENT_STOP_CAPTURE)));
 }
 
 bool SpeechRecognizerImpl::IsActive() const {
@@ -277,14 +276,14 @@
   // Convert audio from native format to fixed format used by WebSpeech.
   FSMEventArgs event_args(EVENT_AUDIO_DATA);
   event_args.audio_data = audio_converter_->Convert(data);
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&SpeechRecognizerImpl::DispatchEvent, this, event_args));
   // See http://crbug.com/506051 regarding why one extra convert call can
   // sometimes be required. It should be a rare case.
   if (!audio_converter_->data_was_converted()) {
     event_args.audio_data = audio_converter_->Convert(data);
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&SpeechRecognizerImpl::DispatchEvent, this, event_args));
   }
@@ -295,7 +294,7 @@
 
 void SpeechRecognizerImpl::OnCaptureError(const std::string& message) {
   FSMEventArgs event_args(EVENT_AUDIO_ERROR);
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&SpeechRecognizerImpl::DispatchEvent, this, event_args));
 }
@@ -304,7 +303,7 @@
     const std::vector<blink::mojom::SpeechRecognitionResultPtr>& results) {
   FSMEventArgs event_args(EVENT_ENGINE_RESULT);
   event_args.engine_results = mojo::Clone(results);
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&SpeechRecognizerImpl::DispatchEvent, this, event_args));
 }
@@ -318,7 +317,7 @@
     const blink::mojom::SpeechRecognitionError& error) {
   FSMEventArgs event_args(EVENT_ENGINE_ERROR);
   event_args.engine_error = error;
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&SpeechRecognizerImpl::DispatchEvent, this, event_args));
 }
diff --git a/content/browser/speech/speech_recognizer_impl_android.cc b/content/browser/speech/speech_recognizer_impl_android.cc
index 583a8356..c72dd84 100644
--- a/content/browser/speech/speech_recognizer_impl_android.cc
+++ b/content/browser/speech/speech_recognizer_impl_android.cc
@@ -42,13 +42,13 @@
     const std::string& device_id) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   // TODO(xians): Open the correct device for speech on Android.
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&SpeechRecognitionEventListener::OnRecognitionStart,
                      base::Unretained(listener()), session_id()));
   SpeechRecognitionSessionConfig config =
       SpeechRecognitionManager::GetInstance()->GetSessionConfig(session_id());
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(
           &content::SpeechRecognizerImplAndroid::StartRecognitionOnUIThread,
@@ -71,7 +71,7 @@
 void SpeechRecognizerImplAndroid::AbortRecognition() {
   if (BrowserThread::CurrentlyOn(BrowserThread::IO)) {
     state_ = STATE_IDLE;
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&content::SpeechRecognizerImplAndroid::AbortRecognition,
                        this));
@@ -85,7 +85,7 @@
 
 void SpeechRecognizerImplAndroid::StopAudioCapture() {
   if (BrowserThread::CurrentlyOn(BrowserThread::IO)) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&content::SpeechRecognizerImplAndroid::StopAudioCapture,
                        this));
@@ -111,10 +111,9 @@
     JNIEnv* env,
     const JavaParamRef<jobject>& obj) {
   if (BrowserThread::CurrentlyOn(BrowserThread::UI)) {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(&SpeechRecognizerImplAndroid::OnAudioStart, this,
-                       nullptr, nullptr));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&SpeechRecognizerImplAndroid::OnAudioStart,
+                                  this, nullptr, nullptr));
     return;
   }
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
@@ -126,10 +125,9 @@
     JNIEnv* env,
     const JavaParamRef<jobject>& obj) {
   if (BrowserThread::CurrentlyOn(BrowserThread::UI)) {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(&SpeechRecognizerImplAndroid::OnSoundStart, this,
-                       nullptr, nullptr));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&SpeechRecognizerImplAndroid::OnSoundStart,
+                                  this, nullptr, nullptr));
     return;
   }
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
@@ -139,10 +137,9 @@
 void SpeechRecognizerImplAndroid::OnSoundEnd(JNIEnv* env,
                                              const JavaParamRef<jobject>& obj) {
   if (BrowserThread::CurrentlyOn(BrowserThread::UI)) {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(&SpeechRecognizerImplAndroid::OnSoundEnd, this, nullptr,
-                       nullptr));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&SpeechRecognizerImplAndroid::OnSoundEnd,
+                                  this, nullptr, nullptr));
     return;
   }
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
@@ -152,10 +149,9 @@
 void SpeechRecognizerImplAndroid::OnAudioEnd(JNIEnv* env,
                                              const JavaParamRef<jobject>& obj) {
   if (BrowserThread::CurrentlyOn(BrowserThread::UI)) {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(&SpeechRecognizerImplAndroid::OnAudioEnd, this, nullptr,
-                       nullptr));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&SpeechRecognizerImplAndroid::OnAudioEnd,
+                                  this, nullptr, nullptr));
     return;
   }
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
@@ -185,7 +181,7 @@
         options[i], static_cast<double>(scores[i])));
   }
   result->is_provisional = provisional;
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           &SpeechRecognizerImplAndroid::OnRecognitionResultsOnIOThread, this,
@@ -203,7 +199,7 @@
     const JavaParamRef<jobject>& obj,
     jint error) {
   if (BrowserThread::CurrentlyOn(BrowserThread::UI)) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&SpeechRecognizerImplAndroid::OnRecognitionError, this,
                        nullptr, nullptr, error));
@@ -221,7 +217,7 @@
     JNIEnv* env,
     const JavaParamRef<jobject>& obj) {
   if (BrowserThread::CurrentlyOn(BrowserThread::UI)) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&SpeechRecognizerImplAndroid::OnRecognitionEnd, this,
                        nullptr, nullptr));
diff --git a/content/browser/speech/tts_linux.cc b/content/browser/speech/tts_linux.cc
index 4a158e8..8bf1b751 100644
--- a/content/browser/speech/tts_linux.cc
+++ b/content/browser/speech/tts_linux.cc
@@ -111,10 +111,11 @@
   if (!command_line.HasSwitch(switches::kEnableSpeechDispatcher))
     return;
 
-  base::PostTaskWithTraits(FROM_HERE,
-                           {base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-                           base::BindOnce(&TtsPlatformImplLinux::Initialize,
-                                          base::Unretained(this)));
+  base::PostTask(
+      FROM_HERE,
+      {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
+      base::BindOnce(&TtsPlatformImplLinux::Initialize,
+                     base::Unretained(this)));
 }
 
 void TtsPlatformImplLinux::Initialize() {
@@ -344,7 +345,7 @@
   // be in a separate thread.
   if (!BrowserThread::CurrentlyOn(BrowserThread::UI)) {
     current_notification_ = type;
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&TtsPlatformImplLinux::OnSpeechEvent,
                        base::Unretained(TtsPlatformImplLinux::GetInstance()),
@@ -364,7 +365,7 @@
   // be in a separate thread.
   if (!BrowserThread::CurrentlyOn(BrowserThread::UI)) {
     current_notification_ = state;
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&TtsPlatformImplLinux::OnSpeechEvent,
                        base::Unretained(TtsPlatformImplLinux::GetInstance()),
diff --git a/content/browser/ssl/ssl_client_auth_handler.cc b/content/browser/ssl/ssl_client_auth_handler.cc
index 92be63ba..8d063da 100644
--- a/content/browser/ssl/ssl_client_auth_handler.cc
+++ b/content/browser/ssl/ssl_client_auth_handler.cc
@@ -30,7 +30,7 @@
 
   ~ClientCertificateDelegateImpl() override {
     if (!continue_called_) {
-      base::PostTaskWithTraits(
+      base::PostTask(
           FROM_HERE, {BrowserThread::IO},
           base::BindOnce(&SSLClientAuthHandler::CancelCertificateSelection,
                          handler_));
@@ -42,7 +42,7 @@
                                scoped_refptr<net::SSLPrivateKey> key) override {
     DCHECK(!continue_called_);
     continue_called_ = true;
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&SSLClientAuthHandler::ContinueWithCertificate, handler_,
                        std::move(cert), std::move(key)));
@@ -66,8 +66,7 @@
   if (handler) {
     handler->SetCancellationCallback(std::move(callback));
   } else if (callback) {
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                             std::move(callback));
+    base::PostTask(FROM_HERE, {BrowserThread::UI}, std::move(callback));
   }
 }
 
@@ -95,9 +94,9 @@
   // contrast, simply posting SetCancellationCallback to the IO thread would
   // result in |cancellation_callback| never being called if |handler| had
   // already been destroyed when the task ran.
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO},
-                           base::BindOnce(&TrySetCancellationCallback, handler,
-                                          std::move(cancellation_callback)));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&TrySetCancellationCallback, handler,
+                                std::move(cancellation_callback)));
 }
 
 }  // namespace
@@ -161,8 +160,8 @@
 
 SSLClientAuthHandler::~SSLClientAuthHandler() {
   if (cancellation_callback_) {
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                             std::move(cancellation_callback_));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   std::move(cancellation_callback_));
   }
 }
 
@@ -210,14 +209,14 @@
     // before checking ClientCertStore; ClientCertStore itself should probably
     // be handled by the embedder (https://crbug.com/394131), especially since
     // this doesn't work on Android (https://crbug.com/345641).
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&SSLClientAuthHandler::ContinueWithCertificate,
                        weak_factory_.GetWeakPtr(), nullptr, nullptr));
     return;
   }
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&SelectCertificateOnUIThread, web_contents_getter_,
                      base::RetainedRef(cert_request_info_),
diff --git a/content/browser/ssl/ssl_error_handler.cc b/content/browser/ssl/ssl_error_handler.cc
index b7be110..ee32e913 100644
--- a/content/browser/ssl/ssl_error_handler.cc
+++ b/content/browser/ssl/ssl_error_handler.cc
@@ -70,9 +70,9 @@
       delegate_->CancelSSLRequest(net::ERR_ABORTED, &ssl_info());
     return;
   }
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO},
-                           base::BindOnce(&CompleteCancelRequest, delegate_,
-                                          ssl_info(), net::ERR_ABORTED));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&CompleteCancelRequest, delegate_, ssl_info(),
+                                net::ERR_ABORTED));
 }
 
 void SSLErrorHandler::DenyRequest() {
@@ -82,9 +82,9 @@
       delegate_->CancelSSLRequest(cert_error_, &ssl_info());
     return;
   }
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO},
-                           base::BindOnce(&CompleteCancelRequest, delegate_,
-                                          ssl_info(), cert_error_));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&CompleteCancelRequest, delegate_, ssl_info(),
+                                cert_error_));
 }
 
 void SSLErrorHandler::ContinueRequest() {
@@ -94,8 +94,8 @@
       delegate_->ContinueSSLRequest();
     return;
   }
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::IO},
-                           base::BindOnce(&CompleteContinueRequest, delegate_));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&CompleteContinueRequest, delegate_));
 }
 
 }  // namespace content
diff --git a/content/browser/ssl/ssl_manager.cc b/content/browser/ssl/ssl_manager.cc
index b5fd0f8..ebb63a79 100644
--- a/content/browser/ssl/ssl_manager.cc
+++ b/content/browser/ssl/ssl_manager.cc
@@ -169,7 +169,7 @@
 
   // TODO(jam): remove the logic to call this from IO thread once the
   // network service code path is the only one.
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&HandleSSLErrorOnUI, web_contents_getter, delegate,
                      BrowserThread::IO, is_main_frame_request, url, net_error,
diff --git a/content/browser/storage_partition_impl.cc b/content/browser/storage_partition_impl.cc
index becc3e0..abda4f3b 100644
--- a/content/browser/storage_partition_impl.cc
+++ b/content/browser/storage_partition_impl.cc
@@ -98,7 +98,7 @@
 void OnClearedCookies(base::OnceClosure callback, uint32_t num_deleted) {
   // The final callback needs to happen from UI thread.
   if (!BrowserThread::CurrentlyOn(BrowserThread::UI)) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&OnClearedCookies, std::move(callback), num_deleted));
     return;
@@ -144,9 +144,8 @@
 
 void ClearedShaderCache(base::OnceClosure callback) {
   if (!BrowserThread::CurrentlyOn(BrowserThread::UI)) {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::UI},
-        base::BindOnce(&ClearedShaderCache, std::move(callback)));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(&ClearedShaderCache, std::move(callback)));
     return;
   }
   std::move(callback).Run();
@@ -461,10 +460,9 @@
   std::unique_ptr<std::vector<GlobalFrameRoutingId>> host_ids =
       service_worker_context->GetProviderHostIds(url.GetOrigin());
   if (!host_ids->empty()) {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::UI},
-        base::BindOnce(ReportCookiesReadOnUI, *host_ids, url, site_for_cookies,
-                       cookie_list));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(ReportCookiesReadOnUI, *host_ids, url,
+                                  site_for_cookies, cookie_list));
   }
 }
 
@@ -479,10 +477,9 @@
   std::unique_ptr<std::vector<GlobalFrameRoutingId>> host_ids =
       service_worker_context->GetProviderHostIds(url.GetOrigin());
   if (!host_ids->empty()) {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::UI},
-        base::BindOnce(ReportCookiesChangedOnUI, *host_ids, url,
-                       site_for_cookies, cookie_list));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(ReportCookiesChangedOnUI, *host_ids, url,
+                                  site_for_cookies, cookie_list));
   }
 }
 
@@ -784,7 +781,7 @@
     if (NavigationURLLoaderImpl::IsNavigationLoaderOnUIEnabled()) {
       GetAppCacheService()->Shutdown();
     } else {
-      base::PostTaskWithTraits(
+      base::PostTask(
           FROM_HERE, {BrowserThread::IO},
           base::BindOnce(&ChromeAppCacheService::Shutdown, appcache_service_));
     }
@@ -821,7 +818,7 @@
   // that utilizes the QuotaManager.
   partition->quota_manager_ = new storage::QuotaManager(
       in_memory, partition_path,
-      base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO}).get(),
+      base::CreateSingleThreadTaskRunner({BrowserThread::IO}).get(),
       context->GetSpecialStoragePolicy(),
       base::BindRepeating(&StoragePartitionImpl::GetQuotaSettings,
                           partition->weak_factory_.GetWeakPtr()));
@@ -1229,11 +1226,10 @@
     const std::vector<net::CookieWithStatus>& cookie_list) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   if (is_service_worker) {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(&OnServiceWorkerCookiesChangedOnIO,
-                       service_worker_context_, url, site_for_cookies,
-                       std::move(cookie_list)));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&OnServiceWorkerCookiesChangedOnIO,
+                                  service_worker_context_, url,
+                                  site_for_cookies, std::move(cookie_list)));
   } else {
     std::vector<GlobalFrameRoutingId> destination;
     destination.emplace_back(process_id, routing_id);
@@ -1250,7 +1246,7 @@
     const std::vector<net::CookieWithStatus>& cookie_list) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   if (is_service_worker) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&OnServiceWorkerCookiesReadOnIO, service_worker_context_,
                        url, site_for_cookies, std::move(cookie_list)));
@@ -1431,10 +1427,9 @@
 
 void StoragePartitionImpl::DataDeletionHelper::OnTaskComplete(int tracing_id) {
   if (!BrowserThread::CurrentlyOn(BrowserThread::UI)) {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::UI},
-        base::BindOnce(&DataDeletionHelper::OnTaskComplete,
-                       base::Unretained(this), tracing_id));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(&DataDeletionHelper::OnTaskComplete,
+                                  base::Unretained(this), tracing_id));
     return;
   }
   DCHECK_GT(task_count_, 0);
@@ -1494,7 +1489,7 @@
       remove_mask_ & REMOVE_DATA_MASK_FILE_SYSTEMS ||
       remove_mask_ & REMOVE_DATA_MASK_SERVICE_WORKERS ||
       remove_mask_ & REMOVE_DATA_MASK_CACHE_STORAGE) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(
             &DataDeletionHelper::ClearQuotaManagedDataOnIOThread,
@@ -1527,11 +1522,10 @@
   }
 
   if (remove_mask_ & REMOVE_DATA_MASK_SHADER_CACHE) {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(
-            &ClearShaderCacheOnIOThread, path, begin, end,
-            CreateTaskCompletionClosure(TracingDataType::kShaderCache)));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&ClearShaderCacheOnIOThread, path, begin, end,
+                                  CreateTaskCompletionClosure(
+                                      TracingDataType::kShaderCache)));
   }
 
 #if BUILDFLAG(ENABLE_PLUGINS)
diff --git a/content/browser/storage_partition_impl_map.cc b/content/browser/storage_partition_impl_map.cc
index a71e54b..cc007b25 100644
--- a/content/browser/storage_partition_impl_map.cc
+++ b/content/browser/storage_partition_impl_map.cc
@@ -350,8 +350,9 @@
 StoragePartitionImplMap::StoragePartitionImplMap(
     BrowserContext* browser_context)
     : browser_context_(browser_context),
-      file_access_runner_(base::CreateSequencedTaskRunnerWithTraits(
-          {base::MayBlock(), base::TaskPriority::BEST_EFFORT})),
+      file_access_runner_(
+          base::CreateSequencedTaskRunner({base::ThreadPool(), base::MayBlock(),
+                                           base::TaskPriority::BEST_EFFORT})),
       resource_context_initialized_(false) {}
 
 StoragePartitionImplMap::~StoragePartitionImplMap() {
@@ -435,8 +436,9 @@
   base::FilePath domain_root = browser_context_->GetPath().Append(
       GetStoragePartitionDomainPath(partition_domain));
 
-  base::PostTaskWithTraits(
-      FROM_HERE, {base::MayBlock(), base::TaskPriority::BEST_EFFORT},
+  base::PostTask(
+      FROM_HERE,
+      {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT},
       base::BindOnce(&BlockingObliteratePath, browser_context_->GetPath(),
                      domain_root, paths_to_keep,
                      base::ThreadTaskRunnerHandle::Get(), on_gc_required));
@@ -499,7 +501,7 @@
   // Check first to avoid memory leak in unittests.
   if (BrowserThread::IsThreadInitialized(BrowserThread::IO)) {
     if (!NavigationURLLoaderImpl::IsNavigationLoaderOnUIEnabled()) {
-      base::PostTaskWithTraits(
+      base::PostTask(
           FROM_HERE, {BrowserThread::IO},
           base::BindOnce(
               &ChromeAppCacheService::InitializeOnLoaderThread,
@@ -514,14 +516,14 @@
     partition->GetCacheStorageContext()->SetBlobParametersForCache(
         ChromeBlobStorageContext::GetFor(browser_context_));
 
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&ServiceWorkerContextWrapper::InitializeResourceContext,
                        partition->GetServiceWorkerContext(),
                        browser_context_->GetResourceContext()));
 
     if (!NavigationURLLoaderImpl::IsNavigationLoaderOnUIEnabled()) {
-      base::PostTaskWithTraits(
+      base::PostTask(
           FROM_HERE, {BrowserThread::IO},
           base::BindOnce(&PrefetchURLLoaderService::InitializeResourceContext,
                          partition->GetPrefetchURLLoaderService(),
@@ -530,10 +532,9 @@
                              browser_context_))));
     }
 
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(&BackgroundFetchContext::InitializeOnIOThread,
-                       partition->GetBackgroundFetchContext()));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&BackgroundFetchContext::InitializeOnIOThread,
+                                  partition->GetBackgroundFetchContext()));
 
     // We do not call InitializeURLRequestContext() for media contexts because,
     // other than the HTTP cache, the media contexts share the same backing
diff --git a/content/browser/storage_partition_impl_unittest.cc b/content/browser/storage_partition_impl_unittest.cc
index 1124cb8..48b30baf 100644
--- a/content/browser/storage_partition_impl_unittest.cc
+++ b/content/browser/storage_partition_impl_unittest.cc
@@ -558,10 +558,9 @@
 
     // AwaitCompletionHelper and MessageLoop don't work on a
     // SequencedTaskRunner, so post a task on the IO thread.
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(&AwaitCompletionHelper::Notify,
-                       base::Unretained(await_completion)));
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&AwaitCompletionHelper::Notify,
+                                  base::Unretained(await_completion)));
   }
 
   // We don't own this pointer.
@@ -729,8 +728,7 @@
     if (!quota_manager_.get()) {
       quota_manager_ = new MockQuotaManager(
           browser_context_->IsOffTheRecord(), browser_context_->GetPath(),
-          base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO})
-              .get(),
+          base::CreateSingleThreadTaskRunner({BrowserThread::IO}).get(),
           browser_context_->GetSpecialStoragePolicy());
     }
     return quota_manager_.get();
diff --git a/content/browser/system_connector_impl.cc b/content/browser/system_connector_impl.cc
index 5ecc0868..e40694a2 100644
--- a/content/browser/system_connector_impl.cc
+++ b/content/browser/system_connector_impl.cc
@@ -48,10 +48,9 @@
 
   if (!storage) {
     mojo::PendingRemote<service_manager::mojom::Connector> remote;
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::UI},
-        base::BindOnce(&BindReceiverOnMainThread,
-                       remote.InitWithNewPipeAndPassReceiver()));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(&BindReceiverOnMainThread,
+                                  remote.InitWithNewPipeAndPassReceiver()));
     storage.emplace(std::move(remote));
   }
 
diff --git a/content/browser/tracing/background_startup_tracing_observer.cc b/content/browser/tracing/background_startup_tracing_observer.cc
index b481674..921d563 100644
--- a/content/browser/tracing/background_startup_tracing_observer.cc
+++ b/content/browser/tracing/background_startup_tracing_observer.cc
@@ -67,7 +67,7 @@
   const BackgroundTracingRule* startup_rule = FindStartupRuleInConfig(*config);
   DCHECK(startup_rule);
   // Post task to avoid reentrancy.
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {content::BrowserThread::UI},
       base::BindOnce(
           &BackgroundTracingManagerImpl::OnRuleTriggered,
diff --git a/content/browser/tracing/background_tracing_manager_browsertest.cc b/content/browser/tracing/background_tracing_manager_browsertest.cc
index e76e245..4773fafd 100644
--- a/content/browser/tracing/background_tracing_manager_browsertest.cc
+++ b/content/browser/tracing/background_tracing_manager_browsertest.cc
@@ -221,11 +221,11 @@
     file_contents_.assign(output_str.data(), bytes_written);
 
     // Post the callbacks.
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                             base::BindOnce(std::move(done_callback), true));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(std::move(done_callback), true));
 
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                             wait_for_trace_received_.QuitWhenIdleClosure());
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   wait_for_trace_received_.QuitWhenIdleClosure());
   }
 
  private:
diff --git a/content/browser/tracing/background_tracing_manager_impl.cc b/content/browser/tracing/background_tracing_manager_impl.cc
index b4f133d..85d3fc6 100644
--- a/content/browser/tracing/background_tracing_manager_impl.cc
+++ b/content/browser/tracing/background_tracing_manager_impl.cc
@@ -75,7 +75,7 @@
       base::BindOnce(&BackgroundTracingAgentClientImpl::Create,
                      child_process_id, std::move(pending_provider));
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&BackgroundTracingManagerImpl::AddPendingAgentConstructor,
                      std::move(constructor)));
@@ -325,7 +325,7 @@
     BackgroundTracingManagerImpl::TriggerHandle handle,
     StartedFinalizingCallback callback) {
   if (!BrowserThread::CurrentlyOn(BrowserThread::UI)) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&BackgroundTracingManagerImpl::TriggerNamedEvent,
                        base::Unretained(this), handle, std::move(callback)));
diff --git a/content/browser/tracing/background_tracing_rule.cc b/content/browser/tracing/background_tracing_rule.cc
index ac60ae87..1ade66c5 100644
--- a/content/browser/tracing/background_tracing_rule.cc
+++ b/content/browser/tracing/background_tracing_rule.cc
@@ -260,7 +260,7 @@
     if (histogram_name != histogram_name_)
       return;
 
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {content::BrowserThread::UI},
         base::BindOnce(
             &BackgroundTracingManagerImpl::OnRuleTriggered,
@@ -269,7 +269,7 @@
   }
 
   void AbortTracing() {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {content::BrowserThread::UI},
         base::BindOnce(
             &BackgroundTracingManagerImpl::AbortScenario,
diff --git a/content/browser/tracing/cast_tracing_agent.cc b/content/browser/tracing/cast_tracing_agent.cc
index 7cc70e41..0e829a6 100644
--- a/content/browser/tracing/cast_tracing_agent.cc
+++ b/content/browser/tracing/cast_tracing_agent.cc
@@ -205,8 +205,9 @@
 
   CastDataSource()
       : DataSourceBase(tracing::mojom::kSystemTraceDataSourceName),
-        worker_task_runner_(base::CreateSequencedTaskRunnerWithTraits(
-            {base::MayBlock(), base::TaskPriority::BEST_EFFORT,
+        worker_task_runner_(base::CreateSequencedTaskRunner(
+            {base::ThreadPool(), base::MayBlock(),
+             base::TaskPriority::BEST_EFFORT,
              base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN})) {
     DETACH_FROM_SEQUENCE(perfetto_sequence_checker_);
   }
@@ -267,8 +268,9 @@
     : BaseAgent("systemTraceEvents",
                 tracing::mojom::TraceDataType::STRING,
                 base::kNullProcessId),
-      worker_task_runner_(base::CreateSequencedTaskRunnerWithTraits(
-          {base::MayBlock(), base::TaskPriority::BEST_EFFORT,
+      worker_task_runner_(base::CreateSequencedTaskRunner(
+          {base::ThreadPool(), base::MayBlock(),
+           base::TaskPriority::BEST_EFFORT,
            base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN})) {
   tracing::PerfettoTracedProcess::Get()->AddDataSource(
       CastDataSource::GetInstance());
diff --git a/content/browser/tracing/cros_tracing_agent.cc b/content/browser/tracing/cros_tracing_agent.cc
index 80456348..ccfc52a6 100644
--- a/content/browser/tracing/cros_tracing_agent.cc
+++ b/content/browser/tracing/cros_tracing_agent.cc
@@ -55,7 +55,8 @@
       return;
     }
     debug_daemon_->SetStopAgentTracingTaskRunner(
-        base::CreateSequencedTaskRunnerWithTraits({base::MayBlock()}));
+        base::CreateSequencedTaskRunner(
+            {base::ThreadPool(), base::MayBlock()}));
     debug_daemon_->StartAgentTracing(
         trace_config,
         base::BindOnce(&CrOSSystemTracingSession::StartTracingCallbackProxy,
@@ -110,16 +111,15 @@
   void StartTracing(
       tracing::PerfettoProducer* perfetto_producer,
       const perfetto::DataSourceConfig& data_source_config) override {
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::UI},
-        base::BindOnce(&CrOSDataSource::StartTracingOnUI,
-                       base::Unretained(this), perfetto_producer,
-                       data_source_config));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(&CrOSDataSource::StartTracingOnUI,
+                                  base::Unretained(this), perfetto_producer,
+                                  data_source_config));
   }
 
   // Called from the tracing::PerfettoProducer on its sequence.
   void StopTracing(base::OnceClosure stop_complete_callback) override {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&CrOSDataSource::StopTracingOnUI, base::Unretained(this),
                        std::move(stop_complete_callback)));
@@ -192,7 +192,7 @@
     }
 
     // Destruction and reset of fields should happen on the UI thread.
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&CrOSDataSource::OnTraceDataOnUI, base::Unretained(this),
                        std::move(stop_complete_callback)));
diff --git a/content/browser/tracing/perfetto_file_tracer.cc b/content/browser/tracing/perfetto_file_tracer.cc
index 3aa3e8b..997c3e2 100644
--- a/content/browser/tracing/perfetto_file_tracer.cc
+++ b/content/browser/tracing/perfetto_file_tracer.cc
@@ -82,8 +82,9 @@
 }
 
 PerfettoFileTracer::PerfettoFileTracer()
-    : background_task_runner_(base::CreateSequencedTaskRunnerWithTraits(
-          {base::MayBlock(), base::TaskPriority::BEST_EFFORT,
+    : background_task_runner_(base::CreateSequencedTaskRunner(
+          {base::ThreadPool(), base::MayBlock(),
+           base::TaskPriority::BEST_EFFORT,
            base::TaskShutdownBehavior::BLOCK_SHUTDOWN})),
       background_drainer_(background_task_runner_) {
   GetSystemConnector()->BindInterface(tracing::mojom::kServiceName,
diff --git a/content/browser/tracing/tracing_controller_browsertest.cc b/content/browser/tracing/tracing_controller_browsertest.cc
index e9a1ea02..1bb6bd2a 100644
--- a/content/browser/tracing/tracing_controller_browsertest.cc
+++ b/content/browser/tracing/tracing_controller_browsertest.cc
@@ -78,9 +78,9 @@
     scoped_refptr<base::RefCountedString> chunk_ptr =
         base::RefCountedString::TakeString(&trace_);
 
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                             base::BindOnce(done_callback_, std::move(metadata),
-                                            base::RetainedRef(chunk_ptr)));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(done_callback_, std::move(metadata),
+                                  base::RetainedRef(chunk_ptr)));
   }
 
  protected:
diff --git a/content/browser/tracing/tracing_controller_impl_data_endpoint.cc b/content/browser/tracing/tracing_controller_impl_data_endpoint.cc
index daa335e..3270233 100644
--- a/content/browser/tracing/tracing_controller_impl_data_endpoint.cc
+++ b/content/browser/tracing/tracing_controller_impl_data_endpoint.cc
@@ -39,10 +39,9 @@
     scoped_refptr<base::RefCountedString> str =
         base::RefCountedString::TakeString(&tmp);
 
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::UI},
-        base::BindOnce(completion_callback_, std::move(metadata),
-                       base::RetainedRef(str)));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(completion_callback_, std::move(metadata),
+                                  base::RetainedRef(str)));
   }
 
   void ReceiveTraceChunk(std::unique_ptr<std::string> chunk) override {
@@ -65,8 +64,8 @@
                                  base::TaskPriority write_priority)
       : file_path_(trace_file_path),
         completion_callback_(callback),
-        may_block_task_runner_(base::CreateSequencedTaskRunnerWithTraits(
-            {base::MayBlock(), write_priority})) {}
+        may_block_task_runner_(base::CreateSequencedTaskRunner(
+            {base::ThreadPool(), base::MayBlock(), write_priority})) {}
 
   void ReceiveTraceChunk(std::unique_ptr<std::string> chunk) override {
     may_block_task_runner_->PostTask(
@@ -111,7 +110,7 @@
       file_ = nullptr;
     }
 
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&FileTraceDataEndpoint::FinalizeOnUIThread, this));
   }
@@ -133,10 +132,10 @@
                               bool compress_with_background_priority)
       : endpoint_(endpoint),
         already_tried_open_(false),
-        background_task_runner_(base::CreateSequencedTaskRunnerWithTraits(
-            {compress_with_background_priority
-                 ? base::TaskPriority::BEST_EFFORT
-                 : base::TaskPriority::USER_VISIBLE})) {}
+        background_task_runner_(base::CreateSequencedTaskRunner(
+            {base::ThreadPool(), compress_with_background_priority
+                                     ? base::TaskPriority::BEST_EFFORT
+                                     : base::TaskPriority::USER_VISIBLE})) {}
 
   void ReceiveTraceChunk(std::unique_ptr<std::string> chunk) override {
     background_task_runner_->PostTask(
diff --git a/content/browser/url_loader_factory_getter.cc b/content/browser/url_loader_factory_getter.cc
index cf5e999..a30aac9 100644
--- a/content/browser/url_loader_factory_getter.cc
+++ b/content/browser/url_loader_factory_getter.cc
@@ -139,10 +139,9 @@
   HandleNetworkFactoryRequestOnUIThread(
       std::move(pending_network_factory_request), false);
 
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&URLLoaderFactoryGetter::InitializeOnIOThread, this,
-                     network_factory.PassInterface()));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&URLLoaderFactoryGetter::InitializeOnIOThread,
+                                this, network_factory.PassInterface()));
 }
 
 void URLLoaderFactoryGetter::OnStoragePartitionDestroyed() {
@@ -182,7 +181,7 @@
       is_corb_enabled ? &network_factory_corb_enabled_ : &network_factory_;
   if (factory->encountered_error() || !factory->is_bound()) {
     network::mojom::URLLoaderFactoryPtr network_factory;
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(
             &URLLoaderFactoryGetter::HandleNetworkFactoryRequestOnUIThread,
@@ -233,7 +232,7 @@
 void URLLoaderFactoryGetter::FlushNetworkInterfaceOnIOThreadForTesting() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   base::RunLoop run_loop;
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&URLLoaderFactoryGetter::FlushNetworkInterfaceForTesting,
                      this, run_loop.QuitClosure()));
diff --git a/content/browser/utility_process_host.cc b/content/browser/utility_process_host.cc
index 85b12bc..5321f77 100644
--- a/content/browser/utility_process_host.cc
+++ b/content/browser/utility_process_host.cc
@@ -323,7 +323,7 @@
     // support single process mode this way.
     in_process_thread_.reset(
         g_utility_main_thread_factory(InProcessChildThreadParams(
-            base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO}),
+            base::CreateSingleThreadTaskRunner({BrowserThread::IO}),
             process_->GetInProcessMojoInvitation(),
             process_->child_connection()->service_token())));
     in_process_thread_->Start();
diff --git a/content/browser/utility_process_host_browsertest.cc b/content/browser/utility_process_host_browsertest.cc
index 0c9fd30..dd5c8671 100644
--- a/content/browser/utility_process_host_browsertest.cc
+++ b/content/browser/utility_process_host_browsertest.cc
@@ -45,7 +45,7 @@
     done_closure_ =
         base::BindOnce(&UtilityProcessHostBrowserTest::DoneRunning,
                        base::Unretained(this), run_loop.QuitClosure(), crash);
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(
             &UtilityProcessHostBrowserTest::RunUtilityProcessOnIOThread,
@@ -95,8 +95,7 @@
     // If service crashes then this never gets called.
     ASSERT_EQ(false, expect_crash);
     ResetServiceOnIOThread();
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                             std::move(done_closure_));
+    base::PostTask(FROM_HERE, {BrowserThread::UI}, std::move(done_closure_));
   }
 
   mojom::TestServicePtr service_;
@@ -133,7 +132,7 @@
     EXPECT_EQ(kTestProcessName, data.metrics_name);
     EXPECT_EQ(false, has_crashed);
     has_crashed = true;
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&UtilityProcessHostBrowserTest::ResetServiceOnIOThread,
                        base::Unretained(this)));
diff --git a/content/browser/video_capture_service.cc b/content/browser/video_capture_service.cc
index 4f9cdfb..56547f1f 100644
--- a/content/browser/video_capture_service.cc
+++ b/content/browser/video_capture_service.cc
@@ -21,10 +21,9 @@
 #include "services/video_capture/video_capture_service_impl.h"
 
 #if defined(OS_WIN)
-#define CREATE_IN_PROCESS_TASK_RUNNER base::CreateCOMSTATaskRunnerWithTraits
+#define CREATE_IN_PROCESS_TASK_RUNNER base::CreateCOMSTATaskRunner
 #else
-#define CREATE_IN_PROCESS_TASK_RUNNER \
-  base::CreateSingleThreadTaskRunnerWithTraits
+#define CREATE_IN_PROCESS_TASK_RUNNER base::CreateSingleThreadTaskRunner
 #endif
 
 namespace content {
@@ -37,7 +36,7 @@
     mojo::PendingReceiver<video_capture::mojom::VideoCaptureService> receiver) {
   static base::NoDestructor<video_capture::VideoCaptureServiceImpl> service(
       std::move(receiver),
-      base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::UI}));
+      base::CreateSingleThreadTaskRunner({BrowserThread::UI}));
 }
 
 mojo::Remote<video_capture::mojom::VideoCaptureService>& GetUIThreadRemote() {
@@ -80,7 +79,7 @@
         storage;
     auto& remote = storage->GetOrCreateValue();
     if (!remote.is_bound()) {
-      base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::UI})
+      base::CreateSingleThreadTaskRunner({BrowserThread::UI})
           ->PostTask(FROM_HERE,
                      base::BindOnce(&BindProxyRemoteOnUIThread,
                                     remote.BindNewPipeAndPassReceiver()));
@@ -96,8 +95,9 @@
     auto receiver = remote.BindNewPipeAndPassReceiver();
     if (features::IsVideoCaptureServiceEnabledForBrowserProcess()) {
       auto dedicated_task_runner = CREATE_IN_PROCESS_TASK_RUNNER(
-          base::TaskTraits({base::MayBlock(), base::WithBaseSyncPrimitives(),
-                            base::TaskPriority::BEST_EFFORT}),
+          base::TaskTraits{base::ThreadPool(), base::MayBlock(),
+                           base::WithBaseSyncPrimitives(),
+                           base::TaskPriority::BEST_EFFORT},
           base::SingleThreadTaskRunnerThreadMode::DEDICATED);
       dedicated_task_runner->PostTask(
           FROM_HERE,
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index bc53deb9a..8893afd 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -4149,7 +4149,7 @@
     // Android), the downloader service will be invalid. Pre-Mojo, this would
     // hang the callback indefinitely since the IPC would be dropped. Now,
     // respond with a 400 HTTP error code to indicate that something went wrong.
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&WebContentsImpl::OnDidDownloadImage,
                        weak_factory_.GetWeakPtr(), std::move(callback),
diff --git a/content/browser/web_contents/web_contents_view_aura.cc b/content/browser/web_contents/web_contents_view_aura.cc
index ab27502c..9bf849b9 100644
--- a/content/browser/web_contents/web_contents_view_aura.cc
+++ b/content/browser/web_contents/web_contents_view_aura.cc
@@ -505,11 +505,12 @@
 
 void WebContentsViewAura::AsyncDropTempFileDeleter::DeleteFileAsync(
     const base::FilePath& path) const {
-  base::PostTaskWithTraits(FROM_HERE,
-                           {base::MayBlock(), base::TaskPriority::BEST_EFFORT,
-                            base::TaskShutdownBehavior::BLOCK_SHUTDOWN},
-                           base::BindOnce(base::IgnoreResult(&base::DeleteFile),
-                                          std::move(path), false));
+  base::PostTask(
+      FROM_HERE,
+      {base::ThreadPool(), base::MayBlock(), base::TaskPriority::BEST_EFFORT,
+       base::TaskShutdownBehavior::BLOCK_SHUTDOWN},
+      base::BindOnce(base::IgnoreResult(&base::DeleteFile), std::move(path),
+                     false));
 }
 #endif
 
diff --git a/content/browser/web_contents/web_contents_view_mac.mm b/content/browser/web_contents/web_contents_view_mac.mm
index 1d1f44d..b35b9b4 100644
--- a/content/browser/web_contents/web_contents_view_mac.mm
+++ b/content/browser/web_contents/web_contents_view_mac.mm
@@ -548,8 +548,10 @@
         new PromiseFileFinalizer(drag_file_downloader.get()));
   } else {
     // The writer will take care of closing and deletion.
-    base::PostTaskWithTraits(
-        FROM_HERE, {base::TaskPriority::USER_VISIBLE, base::MayBlock()},
+    base::PostTask(
+        FROM_HERE,
+        {base::ThreadPool(), base::TaskPriority::USER_VISIBLE,
+         base::MayBlock()},
         base::BindOnce(&PromiseWriterHelper, drop_data, std::move(file)));
   }
 
diff --git a/content/browser/web_package/bundled_exchanges_reader.cc b/content/browser/web_package/bundled_exchanges_reader.cc
index 4bfafff76..a2f3692 100644
--- a/content/browser/web_package/bundled_exchanges_reader.cc
+++ b/content/browser/web_package/bundled_exchanges_reader.cc
@@ -24,7 +24,7 @@
 BundledExchangesReader::SharedFile::SharedFile(const base::FilePath& file_path)
     : file_path_(file_path) {
   base::PostTaskAndReplyWithResult(
-      FROM_HERE, {base::MayBlock()},
+      FROM_HERE, {base::ThreadPool(), base::MayBlock()},
       base::BindOnce(
           [](const base::FilePath& file_path) -> std::unique_ptr<base::File> {
             return std::make_unique<base::File>(
@@ -55,8 +55,9 @@
 BundledExchangesReader::SharedFile::~SharedFile() {
   // Move the last reference to |file_| that leads an internal blocking call
   // that is not permitted here.
-  base::PostTaskWithTraits(
-      FROM_HERE, {base::TaskPriority::BEST_EFFORT, base::MayBlock()},
+  base::PostTask(
+      FROM_HERE,
+      {base::ThreadPool(), base::TaskPriority::BEST_EFFORT, base::MayBlock()},
       base::BindOnce([](std::unique_ptr<base::File> file) {},
                      std::move(file_)));
 }
@@ -69,7 +70,7 @@
     return;
 
   base::PostTaskAndReplyWithResult(
-      FROM_HERE, {base::MayBlock()},
+      FROM_HERE, {base::ThreadPool(), base::MayBlock()},
       base::BindOnce(
           [](base::File* file) -> base::File { return file->Duplicate(); },
           file_.get()),
diff --git a/content/browser/web_package/prefetched_signed_exchange_cache.cc b/content/browser/web_package/prefetched_signed_exchange_cache.cc
index 641843b8..68858647d 100644
--- a/content/browser/web_package/prefetched_signed_exchange_cache.cc
+++ b/content/browser/web_package/prefetched_signed_exchange_cache.cc
@@ -263,7 +263,7 @@
     }
 
     if (NavigationURLLoaderImpl::IsNavigationLoaderOnUIEnabled()) {
-      base::PostTaskWithTraits(
+      base::PostTask(
           FROM_HERE, {BrowserThread::IO},
           base::BindOnce(
               &InnerResponseURLLoader::CreateMojoBlobReader,
@@ -681,7 +681,7 @@
   BrowserThread::ID thread_id =
       NavigationURLLoaderImpl::GetLoaderRequestControllerThreadID();
   if (!BrowserThread::CurrentlyOn(thread_id)) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {thread_id},
         base::BindOnce(&PrefetchedSignedExchangeCache::RecordHistograms, this));
     return;
diff --git a/content/browser/web_package/prefetched_signed_exchange_cache_adapter.cc b/content/browser/web_package/prefetched_signed_exchange_cache_adapter.cc
index c7c171b..ffe17eb 100644
--- a/content/browser/web_package/prefetched_signed_exchange_cache_adapter.cc
+++ b/content/browser/web_package/prefetched_signed_exchange_cache_adapter.cc
@@ -21,10 +21,9 @@
     return;
   }
 
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&storage::BlobBuilderFromStream::Abort,
-                     std::move(blob_builder)));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&storage::BlobBuilderFromStream::Abort,
+                                std::move(blob_builder)));
 }
 
 }  // namespace
@@ -86,7 +85,7 @@
   }
   blob_is_streaming_ = true;
   if (NavigationURLLoaderImpl::IsNavigationLoaderOnUIEnabled()) {
-    base::PostTaskWithTraitsAndReplyWithResult(
+    base::PostTaskAndReplyWithResult(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(
             &PrefetchedSignedExchangeCacheAdapter::CreateBlobBuilderFromStream,
diff --git a/content/browser/web_package/signed_exchange_devtools_proxy.cc b/content/browser/web_package/signed_exchange_devtools_proxy.cc
index 097b592..096b871 100644
--- a/content/browser/web_package/signed_exchange_devtools_proxy.cc
+++ b/content/browser/web_package/signed_exchange_devtools_proxy.cc
@@ -30,7 +30,7 @@
     return;
   }
 
-  base::PostTaskWithTraits(from_here, {BrowserThread::UI}, std::move(task));
+  base::PostTask(from_here, {BrowserThread::UI}, std::move(task));
 }
 
 void AddErrorMessageToConsoleOnUI(
diff --git a/content/browser/web_package/signed_exchange_handler.cc b/content/browser/web_package/signed_exchange_handler.cc
index 4c923ef0..acf890d 100644
--- a/content/browser/web_package/signed_exchange_handler.cc
+++ b/content/browser/web_package/signed_exchange_handler.cc
@@ -533,7 +533,7 @@
   //   property, or
   const std::string& stapled_ocsp_response = unverified_cert_chain_->ocsp();
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&VerifyCert, certificate, url, stapled_ocsp_response,
                      sct_list_from_cert_cbor, frame_tree_node_id_getter_,
diff --git a/content/browser/web_package/signed_exchange_reporter.cc b/content/browser/web_package/signed_exchange_reporter.cc
index ca7e0ac..0b5927e 100644
--- a/content/browser/web_package/signed_exchange_reporter.cc
+++ b/content/browser/web_package/signed_exchange_reporter.cc
@@ -214,7 +214,7 @@
     report_->elapsed_time = base::TimeTicks::Now() - request_start_;
   }
 
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&ReportResultOnUI, std::move(frame_tree_node_id_getter_),
                      std::move(report_)));
diff --git a/content/browser/web_package/signed_exchange_subresource_prefetch_browsertest.cc b/content/browser/web_package/signed_exchange_subresource_prefetch_browsertest.cc
index cc7e608..81790df 100644
--- a/content/browser/web_package/signed_exchange_subresource_prefetch_browsertest.cc
+++ b/content/browser/web_package/signed_exchange_subresource_prefetch_browsertest.cc
@@ -70,7 +70,7 @@
     }
   } else {
     base::RunLoop run_loop;
-    base::PostTaskWithTraitsAndReply(
+    base::PostTaskAndReply(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(
             [](scoped_refptr<PrefetchedSignedExchangeCache> cache,
@@ -266,7 +266,7 @@
     scoped_refptr<ChromeBlobStorageContext> blob_context =
         ChromeBlobStorageContext::GetFor(
             shell()->web_contents()->GetBrowserContext());
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(&SignedExchangePrefetchBrowserTest::SetBlobLimitsOnIO,
                        blob_context));
diff --git a/content/browser/webrtc/webrtc_internals.cc b/content/browser/webrtc/webrtc_internals.cc
index c943ada..a3b018fa 100644
--- a/content/browser/webrtc/webrtc_internals.cc
+++ b/content/browser/webrtc/webrtc_internals.cc
@@ -454,7 +454,7 @@
   pending_updates_.push(PendingUpdate(command, std::move(value)));
 
   if (queue_was_empty) {
-    base::PostDelayedTaskWithTraits(
+    base::PostDelayedTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(&WebRTCInternals::ProcessPendingUpdates,
                        weak_factory_.GetWeakPtr()),
diff --git a/content/browser/webrtc/webrtc_internals_unittest.cc b/content/browser/webrtc/webrtc_internals_unittest.cc
index 7dc60bfc..9e8d137 100644
--- a/content/browser/webrtc/webrtc_internals_unittest.cc
+++ b/content/browser/webrtc/webrtc_internals_unittest.cc
@@ -172,7 +172,7 @@
   webrtc_internals.OnAddPeerConnection(0, 3, 4, kUrl, kRtcConfiguration,
                                        kContraints);
 
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI}, loop.QuitClosure());
+  base::PostTask(FROM_HERE, {BrowserThread::UI}, loop.QuitClosure());
   loop.Run();
 
   EXPECT_EQ("", observer.command());
@@ -188,7 +188,7 @@
   webrtc_internals.OnAddPeerConnection(0, 3, 4, kUrl, kRtcConfiguration,
                                        kContraints);
   webrtc_internals.OnUpdatePeerConnection(3, 4, "update_type", "update_value");
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI}, loop.QuitClosure());
+  base::PostTask(FROM_HERE, {BrowserThread::UI}, loop.QuitClosure());
   loop.Run();
 
   // Make sure we don't have a log entry since there was no observer.
@@ -217,7 +217,7 @@
   webrtc_internals.OnAddPeerConnection(0, 3, 4, kUrl, kRtcConfiguration,
                                        kContraints);
   webrtc_internals.OnUpdatePeerConnection(3, 4, "update_type", "update_value");
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI}, loop.QuitClosure());
+  base::PostTask(FROM_HERE, {BrowserThread::UI}, loop.QuitClosure());
   loop.Run();
 
   // Make sure we have a log entry since there was an observer.
diff --git a/content/browser/webui/shared_resources_data_source.cc b/content/browser/webui/shared_resources_data_source.cc
index 9d2308a..9d894c7 100644
--- a/content/browser/webui/shared_resources_data_source.cc
+++ b/content/browser/webui/shared_resources_data_source.cc
@@ -385,7 +385,7 @@
   // TODO (rbpotter): Remove this once the OOBE Polymer 2 migration is complete.
 #if defined(OS_CHROMEOS)
   if (UsingMultiplePolymerVersions())
-    return base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::UI});
+    return base::CreateSingleThreadTaskRunner({BrowserThread::UI});
 #endif  // defined(OS_CHROMEOS)
 
   int idr = GetIdrForPath(path);
@@ -393,7 +393,7 @@
       idr == IDR_WEBUI_CSS_TEXT_DEFAULTS_MD) {
     // Use UI thread to load CSS since its construction touches non-thread-safe
     // gfx::Font names in ui::ResourceBundle.
-    return base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::UI});
+    return base::CreateSingleThreadTaskRunner({BrowserThread::UI});
   }
 
   return nullptr;
diff --git a/content/browser/webui/url_data_manager.cc b/content/browser/webui/url_data_manager.cc
index 2b11121..7c4b225f 100644
--- a/content/browser/webui/url_data_manager.cc
+++ b/content/browser/webui/url_data_manager.cc
@@ -75,22 +75,20 @@
 
 void URLDataManager::AddDataSource(URLDataSourceImpl* source) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&AddDataSourceOnIOThread,
-                     browser_context_->GetResourceContext(),
-                     base::WrapRefCounted(source)));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&AddDataSourceOnIOThread,
+                                browser_context_->GetResourceContext(),
+                                base::WrapRefCounted(source)));
 }
 
 void URLDataManager::UpdateWebUIDataSource(
     const std::string& source_name,
     std::unique_ptr<base::DictionaryValue> update) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&UpdateWebUIDataSourceOnIOThread,
-                     browser_context_->GetResourceContext(), source_name,
-                     base::Owned(update.release())));
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&UpdateWebUIDataSourceOnIOThread,
+                                browser_context_->GetResourceContext(),
+                                source_name, base::Owned(update.release())));
 }
 
 // static
@@ -128,9 +126,8 @@
   }
   if (schedule_delete) {
     // Schedule a task to delete the DataSource back on the UI thread.
-    base::PostTaskWithTraits(
-        FROM_HERE, {BrowserThread::UI},
-        base::BindOnce(&URLDataManager::DeleteDataSources));
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(&URLDataManager::DeleteDataSources));
   }
 }
 
diff --git a/content/browser/webui/web_ui_url_loader_factory.cc b/content/browser/webui/web_ui_url_loader_factory.cc
index d37554be..3ef29b7 100644
--- a/content/browser/webui/web_ui_url_loader_factory.cc
+++ b/content/browser/webui/web_ui_url_loader_factory.cc
@@ -133,8 +133,8 @@
   // Since the bytes are from the memory mapped resource file, copying the
   // data can lead to disk access. Needs to be posted to a SequencedTaskRunner
   // as Mojo requires a SequencedTaskRunnerHandle in scope.
-  base::CreateSequencedTaskRunnerWithTraits(
-      {base::TaskPriority::USER_BLOCKING, base::MayBlock(),
+  base::CreateSequencedTaskRunner(
+      {base::ThreadPool(), base::TaskPriority::USER_BLOCKING, base::MayBlock(),
        base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN})
       ->PostTask(FROM_HERE,
                  base::BindOnce(ReadData, headers, replacements, gzipped,
@@ -273,7 +273,7 @@
     }
 
     if (request.url.host_piece() == kChromeUIBlobInternalsHost) {
-      base::PostTaskWithTraits(
+      base::PostTask(
           FROM_HERE, {BrowserThread::IO},
           base::BindOnce(&StartBlobInternalsURLLoader, request,
                          client.PassInterface(),
@@ -292,7 +292,7 @@
     // from frames can happen while the RFH is changed for a cross-process
     // navigation. The URLDataSources just need the WebContents; the specific
     // frame doesn't matter.
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(
             &StartURLLoader, request, render_frame_host_->GetFrameTreeNodeId(),
diff --git a/content/browser/worker_host/dedicated_worker_host.cc b/content/browser/worker_host/dedicated_worker_host.cc
index 7f003e01..7d808211 100644
--- a/content/browser/worker_host/dedicated_worker_host.cc
+++ b/content/browser/worker_host/dedicated_worker_host.cc
@@ -232,7 +232,7 @@
     // request endpoint was sent, it can be used, so add it to
     // ServiceWorkerObjectHost.
     if (service_worker_remote_object) {
-      base::PostTaskWithTraits(
+      base::PostTask(
           FROM_HERE, {BrowserThread::IO},
           base::BindOnce(
               &ServiceWorkerObjectHost::AddRemoteObjectPtrAndUpdateState,
diff --git a/content/browser/worker_host/mock_shared_worker.cc b/content/browser/worker_host/mock_shared_worker.cc
index c452b2f9..433fb11 100644
--- a/content/browser/worker_host/mock_shared_worker.cc
+++ b/content/browser/worker_host/mock_shared_worker.cc
@@ -99,6 +99,7 @@
 
 void MockSharedWorkerFactory::CreateSharedWorker(
     blink::mojom::SharedWorkerInfoPtr info,
+    const std::string& user_agent,
     bool pause_on_start,
     const base::UnguessableToken& devtools_worker_token,
     blink::mojom::RendererPreferencesPtr renderer_preferences,
diff --git a/content/browser/worker_host/mock_shared_worker.h b/content/browser/worker_host/mock_shared_worker.h
index d10ae02..db949313 100644
--- a/content/browser/worker_host/mock_shared_worker.h
+++ b/content/browser/worker_host/mock_shared_worker.h
@@ -74,6 +74,7 @@
   // blink::mojom::SharedWorkerFactory methods:
   void CreateSharedWorker(
       blink::mojom::SharedWorkerInfoPtr info,
+      const std::string& user_agent,
       bool pause_on_start,
       const base::UnguessableToken& devtools_worker_token,
       blink::mojom::RendererPreferencesPtr renderer_preferences,
diff --git a/content/browser/worker_host/shared_worker_host.cc b/content/browser/worker_host/shared_worker_host.cc
index 26750d5..858601c 100644
--- a/content/browser/worker_host/shared_worker_host.cc
+++ b/content/browser/worker_host/shared_worker_host.cc
@@ -49,8 +49,8 @@
 void AllowFileSystemOnIOThreadResponse(base::OnceCallback<void(bool)> callback,
                                        bool result) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                           base::BindOnce(std::move(callback), result));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(std::move(callback), result));
 }
 
 void AllowFileSystemOnIOThread(const GURL& url,
@@ -240,9 +240,10 @@
   // Send the CreateSharedWorker message.
   factory_ = std::move(factory);
   factory_->CreateSharedWorker(
-      std::move(info), pause_on_start, devtools_worker_token,
-      std::move(renderer_preferences), std::move(preference_watcher_request),
-      std::move(content_settings), service_worker_handle_->TakeProviderInfo(),
+      std::move(info), GetContentClient()->browser()->GetUserAgent(),
+      pause_on_start, devtools_worker_token, std::move(renderer_preferences),
+      std::move(preference_watcher_request), std::move(content_settings),
+      service_worker_handle_->TakeProviderInfo(),
       appcache_handle_
           ? base::make_optional(appcache_handle_->appcache_host_id())
           : base::nullopt,
@@ -256,7 +257,7 @@
   // request endpoint was sent, it can be used, so add it to
   // ServiceWorkerObjectHost.
   if (service_worker_remote_object.is_valid()) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::IO},
         base::BindOnce(
             &ServiceWorkerObjectHost::AddRemoteObjectPtrAndUpdateState,
@@ -303,7 +304,7 @@
 void SharedWorkerHost::AllowFileSystem(
     const GURL& url,
     base::OnceCallback<void(bool)> callback) {
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&AllowFileSystemOnIOThread, url,
                      RenderProcessHost::FromID(worker_process_id_)
@@ -314,7 +315,7 @@
 
 void SharedWorkerHost::AllowIndexedDB(const GURL& url,
                                       base::OnceCallback<void(bool)> callback) {
-  base::PostTaskWithTraitsAndReplyWithResult(
+  base::PostTaskAndReplyWithResult(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&AllowIndexedDBOnIOThread, url,
                      RenderProcessHost::FromID(worker_process_id_)
@@ -327,7 +328,7 @@
 void SharedWorkerHost::AllowCacheStorage(
     const GURL& url,
     base::OnceCallback<void(bool)> callback) {
-  base::PostTaskWithTraitsAndReplyWithResult(
+  base::PostTaskAndReplyWithResult(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&AllowCacheStorageOnIOThread, url,
                      RenderProcessHost::FromID(worker_process_id_)
diff --git a/content/browser/worker_host/worker_browsertest.cc b/content/browser/worker_host/worker_browsertest.cc
index 0ebffbf..1a0abd5 100644
--- a/content/browser/worker_host/worker_browsertest.cc
+++ b/content/browser/worker_host/worker_browsertest.cc
@@ -99,8 +99,7 @@
 
   static void QuitUIMessageLoop(base::OnceClosure callback,
                                 bool is_main_frame /* unused */) {
-    base::PostTaskWithTraits(FROM_HERE, {BrowserThread::UI},
-                             std::move(callback));
+    base::PostTask(FROM_HERE, {BrowserThread::UI}, std::move(callback));
   }
 
   void NavigateAndWaitForAuth(const GURL& url) {
diff --git a/content/browser/worker_host/worker_script_fetch_initiator.cc b/content/browser/worker_host/worker_script_fetch_initiator.cc
index 8c625326..0115cce5 100644
--- a/content/browser/worker_host/worker_script_fetch_initiator.cc
+++ b/content/browser/worker_host/worker_script_fetch_initiator.cc
@@ -66,7 +66,7 @@
     return;
   }
 
-  base::PostTaskWithTraits(from_here, {thread_id}, std::move(task));
+  base::PostTask(from_here, {thread_id}, std::move(task));
 }
 
 }  // namespace
@@ -199,7 +199,7 @@
   // 2. (IO thread) ResourceContext destructs.
   // Since |storage_partition| is alive, we must be before step 1, so this
   // task we post to the IO thread must run before step 2.
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           &WorkerScriptFetchInitiator::CreateScriptLoaderOnIO,
diff --git a/content/public/common/content_features.cc b/content/public/common/content_features.cc
index cfdb7314..be36e306 100644
--- a/content/public/common/content_features.cc
+++ b/content/public/common/content_features.cc
@@ -342,7 +342,7 @@
 
 // Whether we should use the navigation_client mojo interface for navigations.
 const base::Feature kPerNavigationMojoInterface = {
-    "PerNavigationMojoInterface", base::FEATURE_DISABLED_BY_DEFAULT};
+    "PerNavigationMojoInterface", base::FEATURE_ENABLED_BY_DEFAULT};
 
 // If Pepper 3D Image Chromium is allowed, this feature controls whether it is
 // enabled.
diff --git a/content/renderer/media/stream/mock_mojo_media_stream_dispatcher_host.cc b/content/renderer/media/stream/mock_mojo_media_stream_dispatcher_host.cc
index 55ac711..b28f661 100644
--- a/content/renderer/media/stream/mock_mojo_media_stream_dispatcher_host.cc
+++ b/content/renderer/media/stream/mock_mojo_media_stream_dispatcher_host.cc
@@ -25,13 +25,18 @@
     int32_t request_id,
     const blink::StreamControls& controls,
     bool user_gesture,
+    blink::mojom::StreamSelectionInfoPtr audio_stream_selection_info_ptr,
     GenerateStreamCallback callback) {
   request_id_ = request_id;
   audio_devices_.clear();
   video_devices_.clear();
   ++request_stream_counter_;
 
-  if (controls.audio.requested) {
+  blink::mojom::StreamSelectionStrategy strategy =
+      audio_stream_selection_info_ptr->strategy;
+  if (controls.audio.requested &&
+      (strategy == blink::mojom::StreamSelectionStrategy::SEARCH_BY_DEVICE_ID ||
+       strategy == blink::mojom::StreamSelectionStrategy::FORCE_NEW_STREAM)) {
     blink::MediaStreamDevice audio_device;
     audio_device.id = controls.audio.device_id + session_id_.ToString();
     audio_device.name = "microphone";
diff --git a/content/renderer/media/stream/mock_mojo_media_stream_dispatcher_host.h b/content/renderer/media/stream/mock_mojo_media_stream_dispatcher_host.h
index 433fa34..438bc5be 100644
--- a/content/renderer/media/stream/mock_mojo_media_stream_dispatcher_host.h
+++ b/content/renderer/media/stream/mock_mojo_media_stream_dispatcher_host.h
@@ -24,10 +24,12 @@
 
   blink::mojom::MediaStreamDispatcherHostPtr CreateInterfacePtrAndBind();
 
-  void GenerateStream(int32_t request_id,
-                      const blink::StreamControls& controls,
-                      bool user_gesture,
-                      GenerateStreamCallback callback) override;
+  void GenerateStream(
+      int32_t request_id,
+      const blink::StreamControls& controls,
+      bool user_gesture,
+      blink::mojom::StreamSelectionInfoPtr audio_stream_selection_info_ptr,
+      GenerateStreamCallback callback) override;
   void CancelRequest(int32_t request_id) override;
   void StopStreamDevice(
       const std::string& device_id,
diff --git a/content/renderer/media/stream/user_media_processor.cc b/content/renderer/media/stream/user_media_processor.cc
index 370dcca..5b89657 100644
--- a/content/renderer/media/stream/user_media_processor.cc
+++ b/content/renderer/media/stream/user_media_processor.cc
@@ -58,6 +58,7 @@
 using blink::WebMediaStreamSource;
 using blink::mojom::MediaStreamRequestResult;
 using blink::mojom::MediaStreamType;
+using blink::mojom::StreamSelectionStrategy;
 using EchoCancellationType =
     blink::AudioProcessingProperties::EchoCancellationType;
 
@@ -525,6 +526,10 @@
         audio_input_capabilities) {
   blink::AudioDeviceCaptureCapabilities capabilities;
   for (const auto& device : audio_input_capabilities) {
+    // Find the first occurrence of blink::MediaStreamAudioSource that matches
+    // the same device ID as |device|. If more than one exists, any such source
+    // will contain the same non-reconfigurable settings that limit the
+    // associated capabilities.
     blink::MediaStreamAudioSource* audio_source = nullptr;
     auto it =
         std::find_if(local_sources_.begin(), local_sources_.end(),
@@ -562,7 +567,8 @@
   DCHECK(current_request_info_->stream_controls()->audio.requested);
   auto settings = SelectSettingsAudioCapture(
       capabilities, web_request.AudioConstraints(),
-      web_request.ShouldDisableHardwareNoiseSuppression());
+      web_request.ShouldDisableHardwareNoiseSuppression(),
+      true /* is_reconfiguration_allowed */);
   if (!settings.HasValue()) {
     blink::WebString failed_constraint_name =
         blink::WebString::FromASCII(settings.failed_constraint_name());
@@ -589,12 +595,51 @@
   SetupVideoInput();
 }
 
+base::Optional<base::UnguessableToken>
+UserMediaProcessor::DetermineExistingAudioSessionId() {
+  DCHECK(current_request_info_->web_request().Audio());
+
+  auto settings = current_request_info_->audio_capture_settings();
+  auto device_id = settings.device_id();
+
+  // Create a copy of the blink::WebMediaStreamSource objects that are
+  // associated to the same audio device capture based on its device ID.
+  std::vector<blink::WebMediaStreamSource> matching_sources;
+  std::copy_if(local_sources_.begin(), local_sources_.end(),
+               std::back_inserter(matching_sources),
+               [&device_id](const blink::WebMediaStreamSource& web_source) {
+                 DCHECK(!web_source.IsNull());
+                 return web_source.Id().Utf8() == device_id;
+               });
+
+  // Return the session ID associated to the source that has the same settings
+  // that have been previously selected, if one exists.
+  if (!matching_sources.empty()) {
+    for (auto& matching_source : matching_sources) {
+      blink::MediaStreamAudioSource* audio_source =
+          static_cast<blink::MediaStreamAudioSource*>(
+              matching_source.GetPlatformSource());
+      if (audio_source->HasSameReconfigurableSettings(
+              settings.audio_processing_properties())) {
+        return audio_source->device().session_id();
+      }
+    }
+  }
+
+  return base::nullopt;
+}
+
 void UserMediaProcessor::SetupVideoInput() {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DCHECK(current_request_info_);
 
   if (!current_request_info_->web_request().Video()) {
-    GenerateStreamForCurrentRequestInfo();
+    base::Optional<base::UnguessableToken> audio_session_id =
+        DetermineExistingAudioSessionId();
+    GenerateStreamForCurrentRequestInfo(
+        audio_session_id, audio_session_id.has_value()
+                              ? StreamSelectionStrategy::SEARCH_BY_SESSION_ID
+                              : StreamSelectionStrategy::FORCE_NEW_STREAM);
     return;
   }
 
@@ -693,7 +738,9 @@
   GenerateStreamForCurrentRequestInfo();
 }
 
-void UserMediaProcessor::GenerateStreamForCurrentRequestInfo() {
+void UserMediaProcessor::GenerateStreamForCurrentRequestInfo(
+    base::Optional<base::UnguessableToken> requested_audio_capture_session_id,
+    blink::mojom::StreamSelectionStrategy strategy) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DCHECK(current_request_info_);
   blink::WebRtcLogMessage(base::StringPrintf(
@@ -709,6 +756,8 @@
       current_request_info_->request_id(),
       *current_request_info_->stream_controls(),
       current_request_info_->is_processing_user_gesture(),
+      blink::mojom::StreamSelectionInfo::New(
+          strategy, requested_audio_capture_session_id),
       base::BindOnce(&UserMediaProcessor::OnStreamGenerated,
                      weak_factory_.GetWeakPtr(),
                      current_request_info_->request_id()));
@@ -988,6 +1037,21 @@
   audio_source->SetStopCallback(base::Bind(
       &UserMediaProcessor::OnLocalSourceStopped, weak_factory_.GetWeakPtr()));
 
+#if DCHECK_IS_ON()
+  for (const auto& local_source : local_sources_) {
+    blink::WebPlatformMediaStreamSource* platform_source =
+        static_cast<blink::WebPlatformMediaStreamSource*>(
+            local_source.GetPlatformSource());
+    DCHECK(platform_source);
+    if (platform_source->device().id == audio_source->device().id) {
+      blink::MediaStreamAudioSource* audio_platform_source =
+          static_cast<blink::MediaStreamAudioSource*>(platform_source);
+      DCHECK(audio_source->HasSameNonReconfigurableSettings(
+          audio_platform_source));
+    }
+  }
+#endif  // DCHECK_IS_ON()
+
   blink::WebMediaStreamSource::Capabilities capabilities;
   capabilities.echo_cancellation = {true, false};
   capabilities.echo_cancellation_type.reserve(3);
diff --git a/content/renderer/media/stream/user_media_processor.h b/content/renderer/media/stream/user_media_processor.h
index ed69043..d472a19 100644
--- a/content/renderer/media/stream/user_media_processor.h
+++ b/content/renderer/media/stream/user_media_processor.h
@@ -16,6 +16,7 @@
 #include "base/memory/weak_ptr.h"
 #include "base/sequence_checker.h"
 #include "content/common/content_export.h"
+#include "third_party/blink/public/common/mediastream/media_stream_request.h"
 #include "third_party/blink/public/mojom/mediastream/media_devices.mojom.h"
 #include "third_party/blink/public/mojom/mediastream/media_stream.mojom.h"
 #include "third_party/blink/public/platform/modules/mediastream/media_stream_dispatcher_eventhandler.h"
@@ -276,7 +277,13 @@
       const blink::VideoCaptureSettings& settings);
   void SelectVideoContentSettings();
 
-  void GenerateStreamForCurrentRequestInfo();
+  base::Optional<base::UnguessableToken> DetermineExistingAudioSessionId();
+
+  void GenerateStreamForCurrentRequestInfo(
+      base::Optional<base::UnguessableToken>
+          requested_audio_capture_session_id = base::nullopt,
+      blink::mojom::StreamSelectionStrategy strategy =
+          blink::mojom::StreamSelectionStrategy::SEARCH_BY_DEVICE_ID);
 
   // UserMediaProcessor owns blink::WebMediaStreamDeviceObserver instead of
   // RenderFrameImpl (or RenderFrameObserver) to ensure tear-down occurs in the
diff --git a/content/renderer/worker/embedded_shared_worker_stub.cc b/content/renderer/worker/embedded_shared_worker_stub.cc
index 57c147bc..2fb27de 100644
--- a/content/renderer/worker/embedded_shared_worker_stub.cc
+++ b/content/renderer/worker/embedded_shared_worker_stub.cc
@@ -41,6 +41,7 @@
 
 EmbeddedSharedWorkerStub::EmbeddedSharedWorkerStub(
     blink::mojom::SharedWorkerInfoPtr info,
+    const std::string& user_agent,
     bool pause_on_start,
     const base::UnguessableToken& devtools_worker_token,
     const blink::mojom::RendererPreferences& renderer_preferences,
@@ -58,7 +59,6 @@
     service_manager::mojom::InterfaceProviderPtr interface_provider)
     : binding_(this, std::move(request)),
       host_(std::move(host)),
-      name_(info->name),
       url_(info->url),
       renderer_preferences_(renderer_preferences),
       preference_watcher_request_(std::move(preference_watcher_request)) {
@@ -115,7 +115,8 @@
   }
 
   impl_->StartWorkerContext(
-      url_, blink::WebString::FromUTF8(name_),
+      url_, blink::WebString::FromUTF8(info->name),
+      blink::WebString::FromUTF8(user_agent),
       blink::WebString::FromUTF8(info->content_security_policy),
       info->content_security_policy_type, info->creation_address_space,
       devtools_worker_token,
diff --git a/content/renderer/worker/embedded_shared_worker_stub.h b/content/renderer/worker/embedded_shared_worker_stub.h
index 90c389ec..dfd5842 100644
--- a/content/renderer/worker/embedded_shared_worker_stub.h
+++ b/content/renderer/worker/embedded_shared_worker_stub.h
@@ -56,6 +56,7 @@
  public:
   EmbeddedSharedWorkerStub(
       blink::mojom::SharedWorkerInfoPtr info,
+      const std::string& user_agent,
       bool pause_on_start,
       const base::UnguessableToken& devtools_worker_token,
       const blink::mojom::RendererPreferences& renderer_preferences,
@@ -98,7 +99,6 @@
 
   mojo::Binding<blink::mojom::SharedWorker> binding_;
   blink::mojom::SharedWorkerHostPtr host_;
-  const std::string name_;
   bool running_ = false;
   GURL url_;
   blink::mojom::RendererPreferences renderer_preferences_;
diff --git a/content/renderer/worker/shared_worker_factory_impl.cc b/content/renderer/worker/shared_worker_factory_impl.cc
index 0fd5d46..42d3eb1 100644
--- a/content/renderer/worker/shared_worker_factory_impl.cc
+++ b/content/renderer/worker/shared_worker_factory_impl.cc
@@ -23,6 +23,7 @@
 
 void SharedWorkerFactoryImpl::CreateSharedWorker(
     blink::mojom::SharedWorkerInfoPtr info,
+    const std::string& user_agent,
     bool pause_on_start,
     const base::UnguessableToken& devtools_worker_token,
     blink::mojom::RendererPreferencesPtr renderer_preferences,
@@ -40,7 +41,7 @@
     service_manager::mojom::InterfaceProviderPtr interface_provider) {
   // Bound to the lifetime of the underlying blink::WebSharedWorker instance.
   new EmbeddedSharedWorkerStub(
-      std::move(info), pause_on_start, devtools_worker_token,
+      std::move(info), user_agent, pause_on_start, devtools_worker_token,
       *renderer_preferences, std::move(preference_watcher_request),
       std::move(content_settings), std::move(service_worker_provider_info),
       appcache_host_id.value_or(base::UnguessableToken()),
diff --git a/content/renderer/worker/shared_worker_factory_impl.h b/content/renderer/worker/shared_worker_factory_impl.h
index 42036a1c..50cd29d 100644
--- a/content/renderer/worker/shared_worker_factory_impl.h
+++ b/content/renderer/worker/shared_worker_factory_impl.h
@@ -25,6 +25,7 @@
   // mojom::SharedWorkerFactory methods:
   void CreateSharedWorker(
       blink::mojom::SharedWorkerInfoPtr info,
+      const std::string& user_agent,
       bool pause_on_start,
       const base::UnguessableToken& devtools_worker_token,
       blink::mojom::RendererPreferencesPtr renderer_preferences,
diff --git a/content/test/BUILD.gn b/content/test/BUILD.gn
index 57744f3..bc2368d 100644
--- a/content/test/BUILD.gn
+++ b/content/test/BUILD.gn
@@ -1580,7 +1580,7 @@
     "../browser/frame_host/mixed_content_navigation_throttle_unittest.cc",
     "../browser/frame_host/navigation_controller_impl_unittest.cc",
     "../browser/frame_host/navigation_entry_impl_unittest.cc",
-    "../browser/frame_host/navigation_handle_impl_unittest.cc",
+    "../browser/frame_host/navigation_request_unittest.cc",
     "../browser/frame_host/navigation_throttle_runner_unittest.cc",
     "../browser/frame_host/navigator_impl_unittest.cc",
     "../browser/frame_host/origin_policy_throttle_unittest.cc",
diff --git a/content/test/data/media/getusermedia.html b/content/test/data/media/getusermedia.html
index ecedfb0..676d2cf0 100644
--- a/content/test/data/media/getusermedia.html
+++ b/content/test/data/media/getusermedia.html
@@ -846,32 +846,29 @@
     }).catch(failTest);
   }
 
-  function getUserMediaEchoCancellationOnAndOff() {
-    var stream;
-    navigator.mediaDevices.getUserMedia({
-      audio: {
-        deviceId: {exact: "default"},
-        echoCancellation: {exact: true}
-      }
-    }).then(s => {
-      stream = s;
-      assertTrue(stream.getAudioTracks()[0].getSettings().echoCancellation);
-      // Chromium's current implementation does not support tracks from the
-      // same source to have different echo cancellation settings. This
-      // getUserMedia() call is expected to fail.
-      navigator.mediaDevices.getUserMedia({
-        audio: {
-          deviceId: {exact: "default"},
-          echoCancellation: {exact: false}
-        }
-      }).then(
-          s => failTest("Unexpected accepted promise from getUserMedia()"),
-          e => {
-            assertEquals(e.name, "OverconstrainedError");
-            stream.getAudioTracks()[0].stop();
-            reportTestSuccess();
-          });
-    }).catch(failTest);
+  async function getUserMediaEchoCancellationOnAndOff() {
+    try {
+      var streams;
+
+      streams = await navigator.mediaDevices.getUserMedia({
+          audio: {
+              deviceId: {exact: "default"},
+              echoCancellation: {exact: true}
+          }
+      });
+      assertTrue(streams.getAudioTracks()[0].getSettings().echoCancellation);
+
+      streams = await navigator.mediaDevices.getUserMedia({
+          audio: {
+              deviceId: {exact: "default"},
+              echoCancellation: {exact: false}
+          }
+      });
+      assertFalse(streams.getAudioTracks()[0].getSettings().echoCancellation);
+      reportTestSuccess();
+    } catch(err) {
+      failTest('getUserMedia() failed, error: ' + err.message);
+    }
   }
 
   var resolveTrackEndedAfterServiceCrash;
diff --git a/content/test/data/media/webrtc_test_utilities.js b/content/test/data/media/webrtc_test_utilities.js
index 997da3c..83f8fd8 100644
--- a/content/test/data/media/webrtc_test_utilities.js
+++ b/content/test/data/media/webrtc_test_utilities.js
@@ -233,3 +233,9 @@
     failTest(description);
   }
 }
+
+function assertFalse(booleanExpression, description) {
+  if (!!booleanExpression) {
+    failTest(description);
+  }
+}
diff --git a/content/test/navigation_simulator_impl.cc b/content/test/navigation_simulator_impl.cc
index 15642ccfb..48fe6101 100644
--- a/content/test/navigation_simulator_impl.cc
+++ b/content/test/navigation_simulator_impl.cc
@@ -610,8 +610,7 @@
         new net::HttpResponseHeaders(std::string());
     response_headers->AddHeader(std::string("Content-Type: ") +
                                 contents_mime_type_);
-    request_->navigation_handle()->set_response_headers_for_testing(
-        response_headers);
+    request_->set_response_headers_for_testing(response_headers);
   }
 
   bool is_cross_process_navigation =
@@ -672,9 +671,8 @@
   if (state_ == INITIALIZATION)
     Start();
 
-  NavigationHandleImpl* handle = request_->navigation_handle();
-  CHECK(!handle->GetResponseHeaders());
-  handle->set_response_headers_for_testing(response_headers);
+  CHECK(!request_->GetResponseHeaders());
+  request_->set_response_headers_for_testing(response_headers);
 
   state_ = FAILED;
 
diff --git a/content/test/test_render_frame_host.cc b/content/test/test_render_frame_host.cc
index c5bdfb3..5ad4f3f1 100644
--- a/content/test/test_render_frame_host.cc
+++ b/content/test/test_render_frame_host.cc
@@ -309,12 +309,12 @@
     FrameHostMsg_DidCommitProvisionalLoad_Params* params,
     mojom::DidCommitProvisionalLoadInterfaceParamsPtr interface_params,
     bool was_within_same_document) {
-  if (GetNavigationHandle() && !GetNavigationHandle()->GetResponseHeaders()) {
+  if (navigation_request() && !navigation_request()->GetResponseHeaders()) {
     scoped_refptr<net::HttpResponseHeaders> response_headers =
         new net::HttpResponseHeaders(std::string());
     response_headers->AddHeader(std::string("Content-Type: ") +
                                 params->contents_mime_type);
-    GetNavigationHandle()->set_response_headers_for_testing(response_headers);
+    navigation_request()->set_response_headers_for_testing(response_headers);
   }
 
   if (was_within_same_document) {
diff --git a/content/test/test_web_contents.cc b/content/test/test_web_contents.cc
index a884126..9c09554d 100644
--- a/content/test/test_web_contents.cc
+++ b/content/test/test_web_contents.cc
@@ -374,6 +374,7 @@
     NavigationHandle* navigation_handle,
     scoped_refptr<net::HttpResponseHeaders> response_headers) {
   static_cast<NavigationHandleImpl*>(navigation_handle)
+      ->navigation_request()
       ->set_response_headers_for_testing(response_headers);
 }
 
diff --git a/docs/enterprise/active_directory_native_integration.md b/docs/enterprise/active_directory_native_integration.md
index 1383f6b..e433f3a 100644
--- a/docs/enterprise/active_directory_native_integration.md
+++ b/docs/enterprise/active_directory_native_integration.md
@@ -7,9 +7,9 @@
 their AD servers using group policy. There is no need to synchronize users to
 Google.
 
-[Google Chrome Enterprise Help article](https://support.google.com/chrome/a/answer/7497916)
+[Google Chrome Enterprise Help article](https://support.google.com/chrome/a?p=ad)
 
-[Troubleshoot Active Directory](https://support.google.com/chrome/a/answer/7497305)
+[Troubleshoot Active Directory](https://support.google.com/chrome/a?p=troubleshoot_ad)
 
 [TOC]
 
@@ -73,7 +73,7 @@
 
 Moreover, users may sign up for a Play Store account from within their user
 session, see step 5 of the
-[Help article](https://support.google.com/chrome/a/answer/7497916).
+[Help article](https://support.google.com/chrome/a?p=ad).
 For this purpose, DM Server creates a LaForge account for the user. A LaForge
 account is a shadow Gaia account with scope limited to the Play Store. To prove
 the user's identity, a SAML flow is employed with DM Server as service provider
diff --git a/docs/enterprise/policies.md b/docs/enterprise/policies.md
index cb06803d..d99f0335 100644
--- a/docs/enterprise/policies.md
+++ b/docs/enterprise/policies.md
@@ -35,7 +35,7 @@
 ** Chrome OS **
 
 Chrome OS devices can be either cloud-managed or Active Directory managed
-([AdManagement](https://support.google.com/chrome/a/answer/7497916?hl=en)).
+([AdManagement](https://support.google.com/chrome/a?p=ad)).
 
 The cloud source is usually called DMServer (device management server).
 Organization admins can configure both device and cloud policies using
diff --git a/docs/enterprise/saml_authentication.md b/docs/enterprise/saml_authentication.md
index 1cd1bbd9..66b14a8 100644
--- a/docs/enterprise/saml_authentication.md
+++ b/docs/enterprise/saml_authentication.md
@@ -14,7 +14,7 @@
 by a third-party IdP (identity provider). GAIA supports this model via the
 industry-standard
 [SAML protocol](https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language).
-A domain can be [configured](https://support.google.com/a/answer/6349809) to
+A domain can be [configured](https://support.google.com/a?p=sso) to
 use SAML authentication.
 
 ## Obtaining the user’s password
diff --git a/extensions/browser/api/feedback_private/DEPS b/extensions/browser/api/feedback_private/DEPS
index d3e51a7..52cd4ec2 100644
--- a/extensions/browser/api/feedback_private/DEPS
+++ b/extensions/browser/api/feedback_private/DEPS
@@ -1,4 +1,4 @@
 include_rules = [
   "+components/feedback",
-  "+ash/public/interfaces",
+  "+ash/public/mojom",
 ]
diff --git a/extensions/browser/api/feedback_private/feedback_service.cc b/extensions/browser/api/feedback_private/feedback_service.cc
index 0df3fea..82157d249 100644
--- a/extensions/browser/api/feedback_private/feedback_service.cc
+++ b/extensions/browser/api/feedback_private/feedback_service.cc
@@ -17,8 +17,8 @@
 #include "net/base/network_change_notifier.h"
 
 #if defined(OS_CHROMEOS)
-#include "ash/public/interfaces/assistant_controller.mojom.h"
-#include "ash/public/interfaces/constants.mojom.h"
+#include "ash/public/mojom/assistant_controller.mojom.h"
+#include "ash/public/mojom/constants.mojom.h"
 #include "extensions/browser/api/feedback_private/log_source_access_manager.h"
 #include "services/service_manager/public/cpp/connector.h"
 #endif  // defined(OS_CHROMEOS)
diff --git a/extensions/browser/api/web_request/web_request_proxying_websocket.cc b/extensions/browser/api/web_request/web_request_proxying_websocket.cc
index 0a4e292..6a8553d 100644
--- a/extensions/browser/api/web_request/web_request_proxying_websocket.cc
+++ b/extensions/browser/api/web_request/web_request_proxying_websocket.cc
@@ -378,9 +378,9 @@
   // best.
   network::mojom::WebSocketHandshakeClientPtr handshake_client;
   binding_as_handshake_client_.Bind(mojo::MakeRequest(&handshake_client));
-  binding_as_handshake_client_.set_connection_error_handler(
-      base::BindOnce(&WebRequestProxyingWebSocket::OnError,
-                     base::Unretained(this), net::ERR_FAILED));
+  binding_as_handshake_client_.set_connection_error_with_reason_handler(
+      base::BindOnce(&WebRequestProxyingWebSocket::OnMojoConnectionError,
+                     base::Unretained(this)));
   network::mojom::AuthenticationHandlerPtr auth_handler;
   binding_as_auth_handler_.Bind(mojo::MakeRequest(&auth_handler));
   network::mojom::TrustedHeaderClientPtr trusted_header_client;
@@ -484,4 +484,12 @@
   proxies_->RemoveProxy(this);
 }
 
+void WebRequestProxyingWebSocket::OnMojoConnectionError(
+    uint32_t custom_reason,
+    const std::string& description) {
+  forwarding_handshake_client_.ResetWithReason(custom_reason, description);
+  OnError(net::ERR_FAILED);
+  // Deletes |this|.
+}
+
 }  // namespace extensions
diff --git a/extensions/browser/api/web_request/web_request_proxying_websocket.h b/extensions/browser/api/web_request/web_request_proxying_websocket.h
index ff2a39cc..fe5e2d4 100644
--- a/extensions/browser/api/web_request/web_request_proxying_websocket.h
+++ b/extensions/browser/api/web_request/web_request_proxying_websocket.h
@@ -107,6 +107,8 @@
   void PauseIncomingMethodCallProcessing();
   void ResumeIncomingMethodCallProcessing();
   void OnError(int result);
+  void OnMojoConnectionError(uint32_t custom_reason,
+                             const std::string& description);
 
   WebSocketFactory factory_;
   content::BrowserContext* const browser_context_;
diff --git a/ios/chrome/browser/autofill/form_input_accessory_view.mm b/ios/chrome/browser/autofill/form_input_accessory_view.mm
index c318028b..1cb6fd5c 100644
--- a/ios/chrome/browser/autofill/form_input_accessory_view.mm
+++ b/ios/chrome/browser/autofill/form_input_accessory_view.mm
@@ -133,7 +133,7 @@
     return;
   }
 
-  self.tintColor = [UIColor colorNamed:kTintColor];
+  self.tintColor = [UIColor colorNamed:kBlueColor];
   self.translatesAutoresizingMaskIntoConstraints = NO;
   UIView* leadingViewContainer = [[UIView alloc] init];
   leadingViewContainer.translatesAutoresizingMaskIntoConstraints = NO;
diff --git a/ios/chrome/browser/passwords/ios_chrome_password_manager_client.h b/ios/chrome/browser/passwords/ios_chrome_password_manager_client.h
index ac39364b..2e91b129 100644
--- a/ios/chrome/browser/passwords/ios_chrome_password_manager_client.h
+++ b/ios/chrome/browser/passwords/ios_chrome_password_manager_client.h
@@ -115,6 +115,7 @@
   ukm::SourceId GetUkmSourceId() override;
   password_manager::PasswordManagerMetricsRecorder* GetMetricsRecorder()
       override;
+  signin::IdentityManager* GetIdentityManager() override;
   password_manager::PasswordRequirementsService*
   GetPasswordRequirementsService() override;
   bool IsIsolationForPasswordSitesEnabled() const override;
diff --git a/ios/chrome/browser/passwords/ios_chrome_password_manager_client.mm b/ios/chrome/browser/passwords/ios_chrome_password_manager_client.mm
index 8bbe96b..f59a1f6d 100644
--- a/ios/chrome/browser/passwords/ios_chrome_password_manager_client.mm
+++ b/ios/chrome/browser/passwords/ios_chrome_password_manager_client.mm
@@ -53,11 +53,6 @@
   return ProfileSyncServiceFactory::GetForBrowserStateIfExists(browser_state);
 }
 
-const signin::IdentityManager* GetIdentityManager(
-    ios::ChromeBrowserState* browser_state) {
-  return IdentityManagerFactory::GetForBrowserState(browser_state);
-}
-
 }  // namespace
 
 IOSChromePasswordManagerClient::IOSChromePasswordManagerClient(
@@ -65,14 +60,13 @@
     : delegate_(delegate),
       credentials_filter_(
           this,
-          base::BindRepeating(&GetSyncService, delegate_.browserState),
-          base::BindRepeating(&GetIdentityManager, delegate_.browserState)),
+          base::BindRepeating(&GetSyncService, delegate_.browserState)),
       helper_(this) {
   saving_passwords_enabled_.Init(
       password_manager::prefs::kCredentialsEnableService, GetPrefs());
   static base::NoDestructor<password_manager::StoreMetricsReporter> reporter(
       *saving_passwords_enabled_, this, GetSyncService(delegate_.browserState),
-      GetIdentityManager(delegate_.browserState), GetPrefs());
+      GetIdentityManager(), GetPrefs());
   log_manager_ = autofill::LogManager::Create(
       ios::PasswordManagerLogRouterFactory::GetForBrowserState(
           delegate_.browserState),
@@ -226,6 +220,10 @@
   return base::OptionalOrNullptr(metrics_recorder_);
 }
 
+signin::IdentityManager* IOSChromePasswordManagerClient::GetIdentityManager() {
+  return IdentityManagerFactory::GetForBrowserState(delegate_.browserState);
+}
+
 password_manager::PasswordRequirementsService*
 IOSChromePasswordManagerClient::GetPasswordRequirementsService() {
   return IOSPasswordRequirementsServiceFactory::GetForBrowserState(
diff --git a/ios/chrome/browser/ui/alert_view_controller/alert_view_controller.mm b/ios/chrome/browser/ui/alert_view_controller/alert_view_controller.mm
index 9aaad54..f55292bc 100644
--- a/ios/chrome/browser/ui/alert_view_controller/alert_view_controller.mm
+++ b/ios/chrome/browser/ui/alert_view_controller/alert_view_controller.mm
@@ -387,13 +387,13 @@
     UIColor* textColor = nil;
     if (action.style == UIAlertActionStyleDefault) {
       font = [UIFont preferredFontForTextStyle:UIFontTextStyleBody];
-      textColor = [UIColor colorNamed:kTintColor];
+      textColor = [UIColor colorNamed:kBlueColor];
     } else if (action.style == UIAlertActionStyleCancel) {
       font = [UIFont preferredFontForTextStyle:UIFontTextStyleHeadline];
-      textColor = [UIColor colorNamed:kTintColor];
+      textColor = [UIColor colorNamed:kBlueColor];
     } else {  // Style is UIAlertActionStyleDestructive
       font = [UIFont preferredFontForTextStyle:UIFontTextStyleBody];
-      textColor = [UIColor colorNamed:kDestructiveTintColor];
+      textColor = [UIColor colorNamed:kRedColor];
     }
     button.titleLabel.font = font;
     button.titleLabel.adjustsFontForContentSizeCategory = YES;
diff --git a/ios/chrome/browser/ui/appearance/appearance_customization.mm b/ios/chrome/browser/ui/appearance/appearance_customization.mm
index 00baa5f..3012889 100644
--- a/ios/chrome/browser/ui/appearance/appearance_customization.mm
+++ b/ios/chrome/browser/ui/appearance/appearance_customization.mm
@@ -16,10 +16,10 @@
   Class containerClass = [TableViewNavigationController class];
   UIBarButtonItem* barButtonItemAppearance = [UIBarButtonItem
       appearanceWhenContainedInInstancesOfClasses:@[ containerClass ]];
-  barButtonItemAppearance.tintColor = [UIColor colorNamed:kTintColor];
+  barButtonItemAppearance.tintColor = [UIColor colorNamed:kBlueColor];
 
   Class navigationBarClass = [SettingsNavigationController class];
   UINavigationBar* navigationBarAppearance = [UINavigationBar
       appearanceWhenContainedInInstancesOfClasses:@[ navigationBarClass ]];
-  navigationBarAppearance.tintColor = [UIColor colorNamed:kTintColor];
+  navigationBarAppearance.tintColor = [UIColor colorNamed:kBlueColor];
 }
diff --git a/ios/chrome/browser/ui/authentication/cells/account_control_item.mm b/ios/chrome/browser/ui/authentication/cells/account_control_item.mm
index 9fd731b..e3d9b55 100644
--- a/ios/chrome/browser/ui/authentication/cells/account_control_item.mm
+++ b/ios/chrome/browser/ui/authentication/cells/account_control_item.mm
@@ -36,9 +36,9 @@
   cell.textLabel.textColor = UIColor.cr_labelColor;
 
   cell.detailTextLabel.text = self.detailText;
-  cell.detailTextLabel.textColor =
-      self.shouldDisplayError ? [UIColor colorNamed:kDestructiveTintColor]
-                              : UIColor.cr_secondaryLabelColor;
+  cell.detailTextLabel.textColor = self.shouldDisplayError
+                                       ? [UIColor colorNamed:kRedColor]
+                                       : UIColor.cr_secondaryLabelColor;
 }
 
 #pragma mark - Helper methods
diff --git a/ios/chrome/browser/ui/authentication/cells/account_control_item_unittest.mm b/ios/chrome/browser/ui/authentication/cells/account_control_item_unittest.mm
index 6288a33b..6f8e623 100644
--- a/ios/chrome/browser/ui/authentication/cells/account_control_item_unittest.mm
+++ b/ios/chrome/browser/ui/authentication/cells/account_control_item_unittest.mm
@@ -83,6 +83,6 @@
   EXPECT_NSEQ(mainText, accountCell.textLabel.text);
   EXPECT_NSEQ(detailText, accountCell.detailTextLabel.text);
   EXPECT_EQ(UITableViewCellAccessoryCheckmark, accountCell.accessoryType);
-  EXPECT_NSEQ([UIColor colorNamed:kDestructiveTintColor],
+  EXPECT_NSEQ([UIColor colorNamed:kRedColor],
               accountCell.detailTextLabel.textColor);
 }
diff --git a/ios/chrome/browser/ui/authentication/cells/signin_promo_view.mm b/ios/chrome/browser/ui/authentication/cells/signin_promo_view.mm
index 9bdbebb..9bb1f14 100644
--- a/ios/chrome/browser/ui/authentication/cells/signin_promo_view.mm
+++ b/ios/chrome/browser/ui/authentication/cells/signin_promo_view.mm
@@ -105,7 +105,7 @@
     UIButton* primaryButton;
     UIEdgeInsets primaryButtonInsets;
     primaryButton = [[UIButton alloc] init];
-    primaryButton.backgroundColor = [UIColor colorNamed:kTintColor];
+    primaryButton.backgroundColor = [UIColor colorNamed:kBlueColor];
     [primaryButton.titleLabel
         setFont:[UIFont preferredFontForTextStyle:UIFontTextStyleHeadline]];
     primaryButton.layer.cornerRadius = kButtonCornerRadius;
@@ -130,7 +130,7 @@
     secondaryButton = [[UIButton alloc] init];
     [secondaryButton.titleLabel
         setFont:[UIFont preferredFontForTextStyle:UIFontTextStyleSubheadline]];
-    [secondaryButton setTitleColor:[UIColor colorNamed:kTintColor]
+    [secondaryButton setTitleColor:[UIColor colorNamed:kBlueColor]
                           forState:UIControlStateNormal];
     _secondaryButton = secondaryButton;
     DCHECK(_secondaryButton);
diff --git a/ios/chrome/browser/ui/authentication/cells/table_view_account_item.mm b/ios/chrome/browser/ui/authentication/cells/table_view_account_item.mm
index 3c6080f7..f65631b 100644
--- a/ios/chrome/browser/ui/authentication/cells/table_view_account_item.mm
+++ b/ios/chrome/browser/ui/authentication/cells/table_view_account_item.mm
@@ -53,8 +53,8 @@
   if (self.shouldDisplayError) {
     cell.errorIcon.image = [[UIImage imageNamed:@"settings_error"]
         imageWithRenderingMode:UIImageRenderingModeAlwaysTemplate];
-    cell.errorIcon.tintColor = [UIColor colorNamed:kDestructiveTintColor];
-    cell.detailTextLabel.textColor = [UIColor colorNamed:kDestructiveTintColor];
+    cell.errorIcon.tintColor = [UIColor colorNamed:kRedColor];
+    cell.detailTextLabel.textColor = [UIColor colorNamed:kRedColor];
   } else {
     cell.errorIcon.image = nil;
     cell.detailTextLabel.textColor = UIColor.cr_secondaryLabelColor;
diff --git a/ios/chrome/browser/ui/authentication/chrome_signin_view_controller.mm b/ios/chrome/browser/ui/authentication/chrome_signin_view_controller.mm
index 58379b5..38ded65 100644
--- a/ios/chrome/browser/ui/authentication/chrome_signin_view_controller.mm
+++ b/ios/chrome/browser/ui/authentication/chrome_signin_view_controller.mm
@@ -344,7 +344,7 @@
 
 - (void)setPrimaryButtonStyling:(MDCButton*)button {
   UIColor* hintColor = UIColor.cr_systemBackgroundColor;
-  UIColor* backgroundColor = [UIColor colorNamed:kTintColor];
+  UIColor* backgroundColor = [UIColor colorNamed:kBlueColor];
   UIColor* titleColor = [UIColor colorNamed:kSolidButtonTextColor];
 
 #if defined(__IPHONE_13_0) && (__IPHONE_OS_VERSION_MAX_ALLOWED >= __IPHONE_13_0)
@@ -370,7 +370,7 @@
 - (void)setSecondaryButtonStyling:(MDCButton*)button {
   UIColor* hintColor = UIColor.cr_systemBackgroundColor;
   UIColor* backgroundColor = UIColor.cr_systemBackgroundColor;
-  UIColor* titleColor = [UIColor colorNamed:kTintColor];
+  UIColor* titleColor = [UIColor colorNamed:kBlueColor];
 
 #if defined(__IPHONE_13_0) && (__IPHONE_OS_VERSION_MAX_ALLOWED >= __IPHONE_13_0)
   if (@available(iOS 13, *)) {
@@ -1004,7 +1004,7 @@
         [[MDCActivityIndicator alloc] initWithFrame:CGRectZero];
     [_activityIndicator setDelegate:self];
     [_activityIndicator setStrokeWidth:3];
-    [_activityIndicator setCycleColors:@[ [UIColor colorNamed:kTintColor] ]];
+    [_activityIndicator setCycleColors:@[ [UIColor colorNamed:kBlueColor] ]];
     [self.view addSubview:_activityIndicator];
   }
 
diff --git a/ios/chrome/browser/ui/authentication/unified_consent/identity_chooser/identity_chooser_cell.mm b/ios/chrome/browser/ui/authentication/unified_consent/identity_chooser/identity_chooser_cell.mm
index 0f6aed7e..b6ad5a8 100644
--- a/ios/chrome/browser/ui/authentication/unified_consent/identity_chooser/identity_chooser_cell.mm
+++ b/ios/chrome/browser/ui/authentication/unified_consent/identity_chooser/identity_chooser_cell.mm
@@ -34,7 +34,7 @@
               reuseIdentifier:(NSString*)reuseIdentifier {
   self = [super initWithStyle:style reuseIdentifier:reuseIdentifier];
   if (self) {
-    self.tintColor = [UIColor colorNamed:kTintColor];
+    self.tintColor = [UIColor colorNamed:kBlueColor];
 
     _identityView = [[IdentityView alloc] initWithFrame:CGRectZero];
     _identityView.translatesAutoresizingMaskIntoConstraints = NO;
diff --git a/ios/chrome/browser/ui/autofill/manual_fill/fallback_view_controller.mm b/ios/chrome/browser/ui/autofill/manual_fill/fallback_view_controller.mm
index ce7e4653..ac419cd 100644
--- a/ios/chrome/browser/ui/autofill/manual_fill/fallback_view_controller.mm
+++ b/ios/chrome/browser/ui/autofill/manual_fill/fallback_view_controller.mm
@@ -83,7 +83,7 @@
 
   [super viewDidLoad];
 
-  self.view.tintColor = [UIColor colorNamed:kTintColor];
+  self.view.tintColor = [UIColor colorNamed:kBlueColor];
 
   self.tableView.separatorStyle = UITableViewCellSeparatorStyleNone;
   self.tableView.sectionHeaderHeight = 0;
diff --git a/ios/chrome/browser/ui/autofill/manual_fill/manual_fill_accessory_view_controller.mm b/ios/chrome/browser/ui/autofill/manual_fill/manual_fill_accessory_view_controller.mm
index 4806680..fdd0c79 100644
--- a/ios/chrome/browser/ui/autofill/manual_fill/manual_fill_accessory_view_controller.mm
+++ b/ios/chrome/browser/ui/autofill/manual_fill/manual_fill_accessory_view_controller.mm
@@ -262,7 +262,7 @@
   base::RecordAction(base::UserMetricsAction("ManualFallback_OpenPassword"));
   [self animateKeyboardButtonHidden:NO];
   [self resetTintColors];
-  [self.passwordButton setTintColor:[UIColor colorNamed:kTintColor]];
+  [self.passwordButton setTintColor:[UIColor colorNamed:kBlueColor]];
   [self.delegate passwordButtonPressed:sender];
 }
 
@@ -270,7 +270,7 @@
   base::RecordAction(base::UserMetricsAction("ManualFallback_OpenCreditCard"));
   [self animateKeyboardButtonHidden:NO];
   [self resetTintColors];
-  [self.cardsButton setTintColor:[UIColor colorNamed:kTintColor]];
+  [self.cardsButton setTintColor:[UIColor colorNamed:kBlueColor]];
   [self.delegate cardButtonPressed:sender];
 }
 
@@ -278,7 +278,7 @@
   base::RecordAction(base::UserMetricsAction("ManualFallback_OpenProfile"));
   [self animateKeyboardButtonHidden:NO];
   [self resetTintColors];
-  [self.accountButton setTintColor:[UIColor colorNamed:kTintColor]];
+  [self.accountButton setTintColor:[UIColor colorNamed:kBlueColor]];
   [self.delegate accountButtonPressed:sender];
 }
 
diff --git a/ios/chrome/browser/ui/autofill/manual_fill/manual_fill_cell_button.mm b/ios/chrome/browser/ui/autofill/manual_fill/manual_fill_cell_button.mm
index 902e785..8e2745c8 100644
--- a/ios/chrome/browser/ui/autofill/manual_fill/manual_fill_cell_button.mm
+++ b/ios/chrome/browser/ui/autofill/manual_fill/manual_fill_cell_button.mm
@@ -51,7 +51,7 @@
 #pragma mark - Private
 
 - (void)initializeStyling {
-  [self setTitleColor:[UIColor colorNamed:kTintColor]
+  [self setTitleColor:[UIColor colorNamed:kBlueColor]
              forState:UIControlStateNormal];
   self.translatesAutoresizingMaskIntoConstraints = NO;
   self.titleLabel.font = [UIFont preferredFontForTextStyle:UIFontTextStyleBody];
diff --git a/ios/chrome/browser/ui/badges/badge_button.mm b/ios/chrome/browser/ui/badges/badge_button.mm
index 54dd12a..64feb956 100644
--- a/ios/chrome/browser/ui/badges/badge_button.mm
+++ b/ios/chrome/browser/ui/badges/badge_button.mm
@@ -52,7 +52,7 @@
 
 - (void)setAccepted:(BOOL)accepted animated:(BOOL)animated {
   void (^changeTintColor)() = ^{
-    self.tintColor = accepted ? [UIColor colorNamed:kTintColor]
+    self.tintColor = accepted ? [UIColor colorNamed:kBlueColor]
                               : [UIColor colorWithWhite:0
                                                   alpha:kButtonInactiveAlpha];
   };
diff --git a/ios/chrome/browser/ui/bookmarks/bookmark_edit_view_controller.mm b/ios/chrome/browser/ui/bookmarks/bookmark_edit_view_controller.mm
index 8779616e..973c133 100644
--- a/ios/chrome/browser/ui/bookmarks/bookmark_edit_view_controller.mm
+++ b/ios/chrome/browser/ui/bookmarks/bookmark_edit_view_controller.mm
@@ -261,7 +261,7 @@
                            target:nil
                            action:nil];
 
-  deleteButton.tintColor = [UIColor colorNamed:kDestructiveTintColor];
+  deleteButton.tintColor = [UIColor colorNamed:kRedColor];
   // Setting the image to nil will cause the default shadowImage to be used,
   // we need to create a new one.
   [self.navigationController.toolbar setShadowImage:[UIImage new]
@@ -548,8 +548,7 @@
         base::mac::ObjCCastStrict<UITableViewHeaderFooterView>(footerView);
     headerFooterView.textLabel.font =
         [UIFont preferredFontForTextStyle:UIFontTextStyleCaption1];
-    headerFooterView.textLabel.textColor =
-        [UIColor colorNamed:kDestructiveTintColor];
+    headerFooterView.textLabel.textColor = [UIColor colorNamed:kRedColor];
   }
   return footerView;
 }
diff --git a/ios/chrome/browser/ui/bookmarks/bookmark_folder_editor_view_controller.mm b/ios/chrome/browser/ui/bookmarks/bookmark_folder_editor_view_controller.mm
index bb9b8d3..9a7fce19 100644
--- a/ios/chrome/browser/ui/bookmarks/bookmark_folder_editor_view_controller.mm
+++ b/ios/chrome/browser/ui/bookmarks/bookmark_folder_editor_view_controller.mm
@@ -487,7 +487,7 @@
       initWithBarButtonSystemItem:UIBarButtonSystemItemFlexibleSpace
                            target:nil
                            action:nil];
-  deleteButton.tintColor = [UIColor colorNamed:kDestructiveTintColor];
+  deleteButton.tintColor = [UIColor colorNamed:kRedColor];
   [self.navigationController.toolbar setShadowImage:[UIImage new]
                                  forToolbarPosition:UIBarPositionAny];
   [self setToolbarItems:@[ spaceButton, deleteButton, spaceButton ]
diff --git a/ios/chrome/browser/ui/bookmarks/bookmark_home_view_controller.mm b/ios/chrome/browser/ui/bookmarks/bookmark_home_view_controller.mm
index 32482d6..e2488a7b 100644
--- a/ios/chrome/browser/ui/bookmarks/bookmark_home_view_controller.mm
+++ b/ios/chrome/browser/ui/bookmarks/bookmark_home_view_controller.mm
@@ -1518,7 +1518,7 @@
                                        style:UIBarButtonItemStylePlain
                                       target:self
                                       action:@selector(leadingButtonClicked)];
-  self.deleteButton.tintColor = [UIColor colorNamed:kDestructiveTintColor];
+  self.deleteButton.tintColor = [UIColor colorNamed:kRedColor];
   self.deleteButton.enabled = NO;
   self.deleteButton.accessibilityIdentifier =
       kBookmarkHomeLeadingButtonIdentifier;
diff --git a/ios/chrome/browser/ui/content_suggestions/cells/content_suggestions_articles_header_item.mm b/ios/chrome/browser/ui/content_suggestions/cells/content_suggestions_articles_header_item.mm
index 34e54a8..7462fe8 100644
--- a/ios/chrome/browser/ui/content_suggestions/cells/content_suggestions_articles_header_item.mm
+++ b/ios/chrome/browser/ui/content_suggestions/cells/content_suggestions_articles_header_item.mm
@@ -95,7 +95,7 @@
     _label.adjustsFontSizeToFitWidth = YES;
 
     _button = [UIButton buttonWithType:UIButtonTypeSystem];
-    _button.tintColor = [UIColor colorNamed:kTintColor];
+    _button.tintColor = [UIColor colorNamed:kBlueColor];
     _button.translatesAutoresizingMaskIntoConstraints = NO;
     _button.titleLabel.font =
         [UIFont preferredFontForTextStyle:UIFontTextStyleFootnote];
diff --git a/ios/chrome/browser/ui/content_suggestions/cells/content_suggestions_footer_item.mm b/ios/chrome/browser/ui/content_suggestions/cells/content_suggestions_footer_item.mm
index da14003..f9e639228 100644
--- a/ios/chrome/browser/ui/content_suggestions/cells/content_suggestions_footer_item.mm
+++ b/ios/chrome/browser/ui/content_suggestions/cells/content_suggestions_footer_item.mm
@@ -85,10 +85,10 @@
   self = [super initWithFrame:frame];
   if (self) {
     _activityIndicator = [[MDCActivityIndicator alloc] init];
-    _activityIndicator.cycleColors = @[ [UIColor colorNamed:kTintColor] ];
+    _activityIndicator.cycleColors = @[ [UIColor colorNamed:kBlueColor] ];
     _activityIndicator.translatesAutoresizingMaskIntoConstraints = NO;
     _button = [UIButton buttonWithType:UIButtonTypeSystem];
-    _button.tintColor = [UIColor colorNamed:kTintColor];
+    _button.tintColor = [UIColor colorNamed:kBlueColor];
     _button.translatesAutoresizingMaskIntoConstraints = NO;
     _button.titleLabel.font =
         [UIFont preferredFontForTextStyle:UIFontTextStyleFootnote];
diff --git a/ios/chrome/browser/ui/fancy_ui/primary_action_button.mm b/ios/chrome/browser/ui/fancy_ui/primary_action_button.mm
index ad20782..e841bee 100644
--- a/ios/chrome/browser/ui/fancy_ui/primary_action_button.mm
+++ b/ios/chrome/browser/ui/fancy_ui/primary_action_button.mm
@@ -38,7 +38,7 @@
 
   UIColor* hintColor = UIColor.cr_systemBackgroundColor;
   UIColor* inkColor = [UIColor colorWithWhite:1 alpha:0.2f];
-  UIColor* backgroundColor = [UIColor colorNamed:kTintColor];
+  UIColor* backgroundColor = [UIColor colorNamed:kBlueColor];
   UIColor* disabledColor = [UIColor colorNamed:kDisabledTintColor];
   UIColor* titleColor = [UIColor colorNamed:kSolidButtonTextColor];
 
diff --git a/ios/chrome/browser/ui/find_bar/find_bar_view.mm b/ios/chrome/browser/ui/find_bar/find_bar_view.mm
index 83c14da..128933ab 100644
--- a/ios/chrome/browser/ui/find_bar/find_bar_view.mm
+++ b/ios/chrome/browser/ui/find_bar/find_bar_view.mm
@@ -152,8 +152,8 @@
       self.darkMode, [UIColor colorNamed:kTextfieldPlaceholderColor],
       [UIColor colorNamed:kTextfieldPlaceholderDarkColor]);
   UIColor* buttonTintColor = color::IncognitoDynamicColor(
-      self.darkMode, [UIColor colorNamed:kTintColor],
-      [UIColor colorNamed:kTintDarkColor]);
+      self.darkMode, [UIColor colorNamed:kBlueColor],
+      [UIColor colorNamed:kBlueDarkColor]);
 
   self.inputField.backgroundColor = inputFieldBackground;
   NSString* placeholder = [self.inputField placeholder];
diff --git a/ios/chrome/browser/ui/first_run/welcome_to_chrome_view.mm b/ios/chrome/browser/ui/first_run/welcome_to_chrome_view.mm
index f883822..ce86373 100644
--- a/ios/chrome/browser/ui/first_run/welcome_to_chrome_view.mm
+++ b/ios/chrome/browser/ui/first_run/welcome_to_chrome_view.mm
@@ -296,7 +296,7 @@
     UIImage* selectedImage = [[UIImage imageNamed:kCheckBoxCheckedImageName]
         imageWithRenderingMode:UIImageRenderingModeAlwaysTemplate];
     [_checkBoxButton setImage:selectedImage forState:UIControlStateSelected];
-    _checkBoxButton.tintColor = [UIColor colorNamed:kTintColor];
+    _checkBoxButton.tintColor = [UIColor colorNamed:kBlueColor];
   }
   return _checkBoxButton;
 }
@@ -441,7 +441,7 @@
                                         url:GURL(kTermsOfServiceUrl)];
   [_TOSLabelLinkController addLinkWithRange:privacyLinkTextRange
                                         url:GURL(kPrivacyNoticeUrl)];
-  [_TOSLabelLinkController setLinkColor:[UIColor colorNamed:kTintColor]];
+  [_TOSLabelLinkController setLinkColor:[UIColor colorNamed:kBlueColor]];
 
   CGSize TOSLabelSize = [self.TOSLabel sizeThatFits:containerSize];
   CGFloat TOSLabelTopPadding = kTOSLabelTopPadding[[self heightSizeClassIdiom]];
diff --git a/ios/chrome/browser/ui/history/history_table_view_controller.mm b/ios/chrome/browser/ui/history/history_table_view_controller.mm
index c2691bb..0d238cb6 100644
--- a/ios/chrome/browser/ui/history/history_table_view_controller.mm
+++ b/ios/chrome/browser/ui/history/history_table_view_controller.mm
@@ -1102,8 +1102,7 @@
                                         action:@selector(openPrivacySettings)];
     _clearBrowsingDataButton.accessibilityIdentifier =
         kHistoryToolbarClearBrowsingButtonIdentifier;
-    _clearBrowsingDataButton.tintColor =
-        [UIColor colorNamed:kDestructiveTintColor];
+    _clearBrowsingDataButton.tintColor = [UIColor colorNamed:kRedColor];
   }
   return _clearBrowsingDataButton;
 }
@@ -1119,7 +1118,7 @@
                action:@selector(deleteSelectedItemsFromHistory)];
     _deleteButton.accessibilityIdentifier =
         kHistoryToolbarDeleteButtonIdentifier;
-    _deleteButton.tintColor = [UIColor colorNamed:kDestructiveTintColor];
+    _deleteButton.tintColor = [UIColor colorNamed:kRedColor];
   }
   return _deleteButton;
 }
diff --git a/ios/chrome/browser/ui/page_info/page_info_view_controller.mm b/ios/chrome/browser/ui/page_info/page_info_view_controller.mm
index a44d6f48..9feb008e8 100644
--- a/ios/chrome/browser/ui/page_info/page_info_view_controller.mm
+++ b/ios/chrome/browser/ui/page_info/page_info_view_controller.mm
@@ -509,9 +509,9 @@
 
   [button.titleLabel setFont:font];
   [button.titleLabel setTextAlignment:NSTextAlignmentLeft];
-  [button setTitleColor:[UIColor colorNamed:kTintColor]
+  [button setTitleColor:[UIColor colorNamed:kBlueColor]
                forState:UIControlStateNormal];
-  [button setTitleColor:[UIColor colorNamed:kTintColor]
+  [button setTitleColor:[UIColor colorNamed:kBlueColor]
                forState:UIControlStateSelected];
 
   [subviews addObject:button];
diff --git a/ios/chrome/browser/ui/reading_list/reading_list_table_view_controller.mm b/ios/chrome/browser/ui/reading_list/reading_list_table_view_controller.mm
index d58cc2f..3c617164 100644
--- a/ios/chrome/browser/ui/reading_list/reading_list_table_view_controller.mm
+++ b/ios/chrome/browser/ui/reading_list/reading_list_table_view_controller.mm
@@ -303,6 +303,10 @@
     self.tableView.separatorStyle = UITableViewCellSeparatorStyleSingleLine;
     self.tableView.backgroundView = nil;
   } else {
+    // TODO(crbug.com/988909): Remove this.  Workround for out-of-sync tableView
+    // and model data when ReadingListTableViewController is incorrectly kept
+    // alive.
+    [self.tableView reloadData];
     [self tableIsEmpty];
   }
 }
diff --git a/ios/chrome/browser/ui/recent_tabs/recent_tabs_table_view_controller.mm b/ios/chrome/browser/ui/recent_tabs/recent_tabs_table_view_controller.mm
index ebc707c..18863e2 100644
--- a/ios/chrome/browser/ui/recent_tabs/recent_tabs_table_view_controller.mm
+++ b/ios/chrome/browser/ui/recent_tabs/recent_tabs_table_view_controller.mm
@@ -229,7 +229,7 @@
   if (self.styler.tintColor) {
     historyItem.textColor = self.styler.tintColor;
   } else {
-    historyItem.textColor = [UIColor colorNamed:kTintColor];
+    historyItem.textColor = [UIColor colorNamed:kBlueColor];
   }
   historyItem.accessibilityIdentifier =
       kRecentTabsShowFullHistoryCellAccessibilityIdentifier;
diff --git a/ios/chrome/browser/ui/sad_tab/sad_tab_view.mm b/ios/chrome/browser/ui/sad_tab/sad_tab_view.mm
index 01f10a5..e4e4623 100644
--- a/ios/chrome/browser/ui/sad_tab/sad_tab_view.mm
+++ b/ios/chrome/browser/ui/sad_tab/sad_tab_view.mm
@@ -547,7 +547,7 @@
 - (UIButton*)actionButton {
   if (!_actionButton) {
     _actionButton = [[MDCFlatButton alloc] init];
-    [_actionButton setBackgroundColor:[UIColor colorNamed:kTintColor]
+    [_actionButton setBackgroundColor:[UIColor colorNamed:kBlueColor]
                              forState:UIControlStateNormal];
     [_actionButton setBackgroundColor:[UIColor colorNamed:kDisabledTintColor]
                              forState:UIControlStateDisabled];
diff --git a/ios/chrome/browser/ui/send_tab_to_self/send_tab_to_self_table_view_controller.mm b/ios/chrome/browser/ui/send_tab_to_self/send_tab_to_self_table_view_controller.mm
index 39ab6cdb9..8890184 100644
--- a/ios/chrome/browser/ui/send_tab_to_self/send_tab_to_self_table_view_controller.mm
+++ b/ios/chrome/browser/ui/send_tab_to_self/send_tab_to_self_table_view_controller.mm
@@ -176,7 +176,7 @@
       l10n_util::GetNSString(IDS_IOS_SEND_TAB_TO_SELF_TARGET_DEVICE_ACTION);
   self.sendToDevice.buttonTextColor =
       [UIColor colorNamed:kSolidButtonTextColor];
-  self.sendToDevice.buttonBackgroundColor = [UIColor colorNamed:kTintColor];
+  self.sendToDevice.buttonBackgroundColor = [UIColor colorNamed:kBlueColor];
   self.sendToDevice.boldButtonText = NO;
   self.sendToDevice.accessibilityIdentifier = kSendTabToSelfModalSendButton;
   [model addItem:self.sendToDevice
diff --git a/ios/chrome/browser/ui/settings/autofill/autofill_add_credit_card_view_controller.mm b/ios/chrome/browser/ui/settings/autofill/autofill_add_credit_card_view_controller.mm
index 86febe04..80ed308 100644
--- a/ios/chrome/browser/ui/settings/autofill/autofill_add_credit_card_view_controller.mm
+++ b/ios/chrome/browser/ui/settings/autofill/autofill_add_credit_card_view_controller.mm
@@ -129,7 +129,7 @@
   TableViewTextButtonItem* cameraButtonItem =
       [[TableViewTextButtonItem alloc] initWithType:ItemTypeUseCameraButton];
   cameraButtonItem.buttonBackgroundColor = UIColor.cr_systemBackgroundColor;
-  cameraButtonItem.buttonTextColor = [UIColor colorNamed:kTintColor];
+  cameraButtonItem.buttonTextColor = [UIColor colorNamed:kBlueColor];
   cameraButtonItem.buttonText = l10n_util::GetNSString(
       IDS_IOS_AUTOFILL_ADD_CREDIT_CARD_OPEN_CAMERA_BUTTON_LABEL);
   cameraButtonItem.textAlignment = NSTextAlignmentNatural;
diff --git a/ios/chrome/browser/ui/settings/cells/settings_switch_cell.mm b/ios/chrome/browser/ui/settings/cells/settings_switch_cell.mm
index 3076e6b..a1ecf1f 100644
--- a/ios/chrome/browser/ui/settings/cells/settings_switch_cell.mm
+++ b/ios/chrome/browser/ui/settings/cells/settings_switch_cell.mm
@@ -81,7 +81,7 @@
 
     _switchView = [[UISwitch alloc] initWithFrame:CGRectZero];
     _switchView.translatesAutoresizingMaskIntoConstraints = NO;
-    _switchView.onTintColor = [UIColor colorNamed:kTintColor];
+    _switchView.onTintColor = [UIColor colorNamed:kBlueColor];
     [_switchView
         setContentCompressionResistancePriority:UILayoutPriorityDefaultHigh + 1
                                         forAxis:
diff --git a/ios/chrome/browser/ui/settings/password/password_details_table_view_controller.mm b/ios/chrome/browser/ui/settings/password/password_details_table_view_controller.mm
index 0a635b0..d8f28a4 100644
--- a/ios/chrome/browser/ui/settings/password/password_details_table_view_controller.mm
+++ b/ios/chrome/browser/ui/settings/password/password_details_table_view_controller.mm
@@ -227,7 +227,7 @@
   TableViewTextItem* item =
       [[TableViewTextItem alloc] initWithType:ItemTypeCopySite];
   item.text = l10n_util::GetNSString(IDS_IOS_SETTINGS_SITE_COPY_BUTTON);
-  item.textColor = [UIColor colorNamed:kTintColor];
+  item.textColor = [UIColor colorNamed:kBlueColor];
   // Accessibility label adds the header to the text, so that accessibility
   // users do not have to rely on the visual grouping to understand which part
   // of the credential is being copied.
@@ -245,7 +245,7 @@
   TableViewTextItem* item =
       [[TableViewTextItem alloc] initWithType:ItemTypeCopyUsername];
   item.text = l10n_util::GetNSString(IDS_IOS_SETTINGS_USERNAME_COPY_BUTTON);
-  item.textColor = [UIColor colorNamed:kTintColor];
+  item.textColor = [UIColor colorNamed:kBlueColor];
   // Accessibility label adds the header to the text, so that accessibility
   // users do not have to rely on the visual grouping to understand which part
   // of the credential is being copied.
@@ -264,7 +264,7 @@
   TableViewTextItem* item =
       [[TableViewTextItem alloc] initWithType:ItemTypeCopyPassword];
   item.text = l10n_util::GetNSString(IDS_IOS_SETTINGS_PASSWORD_COPY_BUTTON);
-  item.textColor = [UIColor colorNamed:kTintColor];
+  item.textColor = [UIColor colorNamed:kBlueColor];
   // Accessibility label adds the header to the text, so that accessibility
   // users do not have to rely on the visual grouping to understand which part
   // of the credential is being copied.
@@ -283,7 +283,7 @@
   TableViewTextItem* item =
       [[TableViewTextItem alloc] initWithType:ItemTypeShowHide];
   item.text = [self showHideButtonText];
-  item.textColor = [UIColor colorNamed:kTintColor];
+  item.textColor = [UIColor colorNamed:kBlueColor];
   item.accessibilityTraits |= UIAccessibilityTraitButton;
   return item;
 }
@@ -293,7 +293,7 @@
   TableViewTextItem* item =
       [[TableViewTextItem alloc] initWithType:ItemTypeDelete];
   item.text = l10n_util::GetNSString(IDS_IOS_SETTINGS_PASSWORD_DELETE_BUTTON);
-  item.textColor = [UIColor colorNamed:kDestructiveTintColor];
+  item.textColor = [UIColor colorNamed:kRedColor];
   item.accessibilityTraits |= UIAccessibilityTraitButton;
   return item;
 }
diff --git a/ios/chrome/browser/ui/settings/password/passwords_table_view_controller.mm b/ios/chrome/browser/ui/settings/password/passwords_table_view_controller.mm
index c6420bf..fa07b44 100644
--- a/ios/chrome/browser/ui/settings/password/passwords_table_view_controller.mm
+++ b/ios/chrome/browser/ui/settings/password/passwords_table_view_controller.mm
@@ -438,7 +438,7 @@
   TableViewTextItem* exportPasswordsItem =
       [[TableViewTextItem alloc] initWithType:ItemTypeExportPasswordsButton];
   exportPasswordsItem.text = l10n_util::GetNSString(IDS_IOS_EXPORT_PASSWORDS);
-  exportPasswordsItem.textColor = [UIColor colorNamed:kTintColor];
+  exportPasswordsItem.textColor = [UIColor colorNamed:kBlueColor];
   exportPasswordsItem.accessibilityIdentifier = @"exportPasswordsItem_button";
   exportPasswordsItem.accessibilityTraits = UIAccessibilityTraitButton;
   return exportPasswordsItem;
@@ -734,7 +734,7 @@
 - (void)setExportPasswordsButtonEnabled:(BOOL)enabled {
   if (enabled) {
     DCHECK(exportReady_ && !self.editing);
-    exportPasswordsItem_.textColor = [UIColor colorNamed:kTintColor];
+    exportPasswordsItem_.textColor = [UIColor colorNamed:kBlueColor];
     exportPasswordsItem_.accessibilityTraits &= ~UIAccessibilityTraitNotEnabled;
   } else {
     exportPasswordsItem_.textColor = UIColor.cr_labelColor;
diff --git a/ios/chrome/browser/ui/settings/password/passwords_table_view_controller_unittest.mm b/ios/chrome/browser/ui/settings/password/passwords_table_view_controller_unittest.mm
index ee70673..3c894f6 100644
--- a/ios/chrome/browser/ui/settings/password/passwords_table_view_controller_unittest.mm
+++ b/ios/chrome/browser/ui/settings/password/passwords_table_view_controller_unittest.mm
@@ -334,7 +334,7 @@
 
   CheckTextCellTextWithId(IDS_IOS_EXPORT_PASSWORDS, 2, 0);
 
-  EXPECT_NSEQ([UIColor colorNamed:kTintColor], exportButton.textColor);
+  EXPECT_NSEQ([UIColor colorNamed:kBlueColor], exportButton.textColor);
   EXPECT_FALSE(exportButton.accessibilityTraits &
                UIAccessibilityTraitNotEnabled);
 }
@@ -371,7 +371,7 @@
   [passwords_controller setEditing:YES animated:NO];
   [passwords_controller setEditing:NO animated:NO];
 
-  EXPECT_NSEQ([UIColor colorNamed:kTintColor], exportButton.textColor);
+  EXPECT_NSEQ([UIColor colorNamed:kBlueColor], exportButton.textColor);
   EXPECT_FALSE(exportButton.accessibilityTraits &
                UIAccessibilityTraitNotEnabled);
 }
diff --git a/ios/chrome/browser/ui/settings/settings_table_view_controller.mm b/ios/chrome/browser/ui/settings/settings_table_view_controller.mm
index 6212759..24fe63a 100644
--- a/ios/chrome/browser/ui/settings/settings_table_view_controller.mm
+++ b/ios/chrome/browser/ui/settings/settings_table_view_controller.mm
@@ -1042,8 +1042,7 @@
     googleServicesItem.image =
         [UIImage imageNamed:kSyncAndGoogleServicesSyncOnImageName];
   } else if (!IsTransientSyncError(syncSetupService->GetSyncServiceState())) {
-    googleServicesItem.detailTextColor =
-        [UIColor colorNamed:kDestructiveTintColor];
+    googleServicesItem.detailTextColor = [UIColor colorNamed:kRedColor];
     googleServicesItem.detailText =
         GetSyncErrorDescriptionForSyncSetupService(syncSetupService);
     googleServicesItem.image =
diff --git a/ios/chrome/browser/ui/settings/table_cell_catalog_view_controller.mm b/ios/chrome/browser/ui/settings/table_cell_catalog_view_controller.mm
index 925ecaa..1f5fac3d 100644
--- a/ios/chrome/browser/ui/settings/table_cell_catalog_view_controller.mm
+++ b/ios/chrome/browser/ui/settings/table_cell_catalog_view_controller.mm
@@ -134,10 +134,10 @@
   TableViewImageItem* textImageItem2 =
       [[TableViewImageItem alloc] initWithType:ItemTypeTextAccessoryImage];
   textImageItem2.title = @"Image item without image, and disabled";
-  textImageItem2.textColor = [UIColor colorNamed:kDestructiveTintColor];
+  textImageItem2.textColor = [UIColor colorNamed:kRedColor];
   textImageItem2.detailText =
       @"Very very very long detail text for the image cell without image";
-  textImageItem2.detailTextColor = [UIColor colorNamed:kDestructiveTintColor];
+  textImageItem2.detailTextColor = [UIColor colorNamed:kRedColor];
   textImageItem2.enabled = NO;
   [model addItem:textImageItem2 toSectionWithIdentifier:SectionIdentifierText];
 
diff --git a/ios/chrome/browser/ui/tab_grid/tab_grid_bottom_toolbar.mm b/ios/chrome/browser/ui/tab_grid/tab_grid_bottom_toolbar.mm
index 71b347e3..cdb1b583 100644
--- a/ios/chrome/browser/ui/tab_grid/tab_grid_bottom_toolbar.mm
+++ b/ios/chrome/browser/ui/tab_grid/tab_grid_bottom_toolbar.mm
@@ -48,6 +48,15 @@
                                withEvent:event];
 }
 
+// Returns UIToolbar's intrinsicContentSize for compact layout, and CGSizeZero
+// for floating button layout.
+- (CGSize)intrinsicContentSize {
+  if ([self shouldUseCompactLayout]) {
+    return _toolbar.intrinsicContentSize;
+  }
+  return CGSizeZero;
+}
+
 #pragma mark - Public
 
 // TODO(crbug.com/929981): "traitCollectionDidChange:" method won't get called
diff --git a/ios/chrome/browser/ui/table_view/cells/table_view_link_header_footer_item.mm b/ios/chrome/browser/ui/table_view/cells/table_view_link_header_footer_item.mm
index 144b6eb..72ec411 100644
--- a/ios/chrome/browser/ui/table_view/cells/table_view_link_header_footer_item.mm
+++ b/ios/chrome/browser/ui/table_view/cells/table_view_link_header_footer_item.mm
@@ -72,7 +72,7 @@
     _textView.adjustsFontForContentSizeCategory = YES;
     _textView.translatesAutoresizingMaskIntoConstraints = NO;
     _textView.linkTextAttributes =
-        @{NSForegroundColorAttributeName : [UIColor colorNamed:kTintColor]};
+        @{NSForegroundColorAttributeName : [UIColor colorNamed:kBlueColor]};
 
     [self.contentView addSubview:_textView];
 
diff --git a/ios/chrome/browser/ui/table_view/cells/table_view_text_button_item.mm b/ios/chrome/browser/ui/table_view/cells/table_view_text_button_item.mm
index b497f5d..022bc206 100644
--- a/ios/chrome/browser/ui/table_view/cells/table_view_text_button_item.mm
+++ b/ios/chrome/browser/ui/table_view/cells/table_view_text_button_item.mm
@@ -73,7 +73,7 @@
   cell.button.accessibilityIdentifier = self.buttonAccessibilityIdentifier;
   cell.button.backgroundColor = self.buttonBackgroundColor
                                     ? self.buttonBackgroundColor
-                                    : [UIColor colorNamed:kTintColor];
+                                    : [UIColor colorNamed:kBlueColor];
   cell.button.enabled = self.enabled;
   if (!self.enabled) {
     cell.button.backgroundColor = [cell.button.backgroundColor
diff --git a/ios/chrome/browser/ui/tabs/tab_view.mm b/ios/chrome/browser/ui/tabs/tab_view.mm
index bebd0ab..432f4f3 100644
--- a/ios/chrome/browser/ui/tabs/tab_view.mm
+++ b/ios/chrome/browser/ui/tabs/tab_view.mm
@@ -14,7 +14,6 @@
 #include "ios/chrome/browser/drag_and_drop/drop_and_navigate_delegate.h"
 #include "ios/chrome/browser/drag_and_drop/drop_and_navigate_interaction.h"
 #include "ios/chrome/browser/system_flags.h"
-#import "ios/chrome/browser/ui/colors/MDCPalette+CrAdditions.h"
 #import "ios/chrome/browser/ui/image_util/image_util.h"
 #include "ios/chrome/browser/ui/util/rtl_geometry.h"
 #import "ios/chrome/browser/ui/util/uikit_ui_util.h"
@@ -329,8 +328,7 @@
   _activityIndicator =
       [[MDCActivityIndicator alloc] initWithFrame:faviconFrame];
   [_activityIndicator setTranslatesAutoresizingMaskIntoConstraints:NO];
-  [_activityIndicator
-      setCycleColors:@[ [[MDCPalette cr_bluePalette] tint500] ]];
+  [_activityIndicator setCycleColors:@[ [UIColor colorNamed:kBlueColor] ]];
   [_activityIndicator setRadius:ui::AlignValueToUpperPixel(kFaviconSize / 2)];
   [self addSubview:_activityIndicator];
 }
diff --git a/ios/chrome/common/colors/resources/BUILD.gn b/ios/chrome/common/colors/resources/BUILD.gn
index 5c96f79..5eec532 100644
--- a/ios/chrome/common/colors/resources/BUILD.gn
+++ b/ios/chrome/common/colors/resources/BUILD.gn
@@ -8,9 +8,14 @@
   deps = [
     ":background_color",
     ":background_dark_color",
-    ":destructive_tint_color",
+    ":blue_color",
+    ":blue_dark_color",
     ":disabled_tint_color",
+    ":green_color",
+    ":green_dark_color",
     ":mdc_ink_color",
+    ":red_color",
+    ":red_dark_color",
     ":scrim_background_color",
     ":solid_button_text_color",
     ":text_primary_color",
@@ -20,8 +25,6 @@
     ":textfield_background_dark_color",
     ":textfield_placeholder_color",
     ":textfield_placeholder_dark_color",
-    ":tint_color",
-    ":tint_dark_color",
   ]
 }
 
@@ -37,9 +40,15 @@
   ]
 }
 
-colorset("destructive_tint_color") {
+colorset("blue_color") {
   sources = [
-    "destructive_tint_color.colorset/Contents.json",
+    "blue_color.colorset/Contents.json",
+  ]
+}
+
+colorset("blue_dark_color") {
+  sources = [
+    "blue_dark_color.colorset/Contents.json",
   ]
 }
 
@@ -49,6 +58,30 @@
   ]
 }
 
+colorset("green_color") {
+  sources = [
+    "green_color.colorset/Contents.json",
+  ]
+}
+
+colorset("green_dark_color") {
+  sources = [
+    "green_dark_color.colorset/Contents.json",
+  ]
+}
+
+colorset("red_color") {
+  sources = [
+    "red_color.colorset/Contents.json",
+  ]
+}
+
+colorset("red_dark_color") {
+  sources = [
+    "red_dark_color.colorset/Contents.json",
+  ]
+}
+
 colorset("mdc_ink_color") {
   sources = [
     "mdc_ink_color.colorset/Contents.json",
@@ -108,15 +141,3 @@
     "textfield_background_dark_color.colorset/Contents.json",
   ]
 }
-
-colorset("tint_color") {
-  sources = [
-    "tint_color.colorset/Contents.json",
-  ]
-}
-
-colorset("tint_dark_color") {
-  sources = [
-    "tint_dark_color.colorset/Contents.json",
-  ]
-}
diff --git a/ios/chrome/common/colors/resources/tint_color.colorset/Contents.json b/ios/chrome/common/colors/resources/blue_color.colorset/Contents.json
similarity index 100%
rename from ios/chrome/common/colors/resources/tint_color.colorset/Contents.json
rename to ios/chrome/common/colors/resources/blue_color.colorset/Contents.json
diff --git a/ios/chrome/common/colors/resources/blue_dark_color.colorset/Contents.json b/ios/chrome/common/colors/resources/blue_dark_color.colorset/Contents.json
new file mode 100644
index 0000000..2f40cc2
--- /dev/null
+++ b/ios/chrome/common/colors/resources/blue_dark_color.colorset/Contents.json
@@ -0,0 +1,20 @@
+{
+  "info" : {
+    "version" : 1,
+    "author" : "xcode"
+  },
+  "colors" : [
+    {
+      "idiom" : "universal",
+      "color" : {
+        "color-space" : "display-p3",
+        "components" : {
+          "red" : "0x8A",
+          "alpha" : "1.000",
+          "blue" : "0xF9",
+          "green" : "0xB4"
+        }
+      }
+    }
+  ]
+}
diff --git a/ios/chrome/common/colors/resources/green_color.colorset/Contents.json b/ios/chrome/common/colors/resources/green_color.colorset/Contents.json
new file mode 100644
index 0000000..ca15f7d
--- /dev/null
+++ b/ios/chrome/common/colors/resources/green_color.colorset/Contents.json
@@ -0,0 +1,38 @@
+{
+  "info" : {
+    "version" : 1,
+    "author" : "xcode"
+  },
+  "colors" : [
+    {
+      "idiom" : "universal",
+      "color" : {
+        "color-space" : "display-p3",
+        "components" : {
+          "red" : "0x16",
+          "alpha" : "1.000",
+          "blue" : "0x37",
+          "green" : "0x80"
+        }
+      }
+    },
+    {
+      "idiom" : "universal",
+      "appearances" : [
+        {
+          "appearance" : "luminosity",
+          "value" : "dark"
+        }
+      ],
+      "color" : {
+        "color-space" : "display-p3",
+        "components" : {
+          "red" : "0x5B",
+          "alpha" : "1.000",
+          "blue" : "0x74",
+          "green" : "0xB9"
+        }
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/ios/chrome/common/colors/resources/green_dark_color.colorset/Contents.json b/ios/chrome/common/colors/resources/green_dark_color.colorset/Contents.json
new file mode 100644
index 0000000..60a05784
--- /dev/null
+++ b/ios/chrome/common/colors/resources/green_dark_color.colorset/Contents.json
@@ -0,0 +1,20 @@
+{
+  "info" : {
+    "version" : 1,
+    "author" : "xcode"
+  },
+  "colors" : [
+    {
+      "idiom" : "universal",
+      "color" : {
+        "color-space" : "display-p3",
+        "components" : {
+          "red" : "0x5B",
+          "alpha" : "1.000",
+          "blue" : "0x74",
+          "green" : "0xB9"
+        }
+      }
+    }
+  ]
+}
diff --git a/ios/chrome/common/colors/resources/destructive_tint_color.colorset/Contents.json b/ios/chrome/common/colors/resources/red_color.colorset/Contents.json
similarity index 100%
rename from ios/chrome/common/colors/resources/destructive_tint_color.colorset/Contents.json
rename to ios/chrome/common/colors/resources/red_color.colorset/Contents.json
diff --git a/ios/chrome/common/colors/resources/red_dark_color.colorset/Contents.json b/ios/chrome/common/colors/resources/red_dark_color.colorset/Contents.json
new file mode 100644
index 0000000..39e898e9
--- /dev/null
+++ b/ios/chrome/common/colors/resources/red_dark_color.colorset/Contents.json
@@ -0,0 +1,20 @@
+{
+  "info" : {
+    "version" : 1,
+    "author" : "xcode"
+  },
+  "colors" : [
+    {
+      "idiom" : "universal",
+      "color" : {
+        "color-space" : "display-p3",
+        "components" : {
+          "red" : "0xF2",
+          "alpha" : "1.000",
+          "blue" : "0x82",
+          "green" : "0x8B"
+        }
+      }
+    }
+  ]
+}
diff --git a/ios/chrome/common/colors/semantic_color_names.h b/ios/chrome/common/colors/semantic_color_names.h
index 0b523903..dfa2b8f 100644
--- a/ios/chrome/common/colors/semantic_color_names.h
+++ b/ios/chrome/common/colors/semantic_color_names.h
@@ -7,8 +7,9 @@
 
 #import <UIKit/UIKit.h>
 
+// Element Colors
+
 extern NSString* const kBackgroundColor;
-extern NSString* const kDestructiveTintColor;
 extern NSString* const kDisabledTintColor;
 extern NSString* const kMDCInkColor;
 extern NSString* const kScrimBackgroundColor;
@@ -17,7 +18,17 @@
 extern NSString* const kTextSecondaryColor;
 extern NSString* const kTextfieldBackgroundColor;
 extern NSString* const kTextfieldPlaceholderColor;
-extern NSString* const kTintColor;
+
+// Standard Colors
+
+// Standard blue color. This is most commonly used for the tint color on
+// standard buttons and controls.
+extern NSString* const kBlueColor;
+// Standard green color.
+extern NSString* const kGreenColor;
+// Standard red color. This is most commonly used for the tint color on
+// destructive controls.
+extern NSString* const kRedColor;
 
 // Temporary colors for iOS 12. Because overridePreferredInterfaceStyle isn't
 // available in iOS 12, any views that should always be dark (e.g. incognito)
@@ -27,6 +38,9 @@
 extern NSString* const kTextPrimaryDarkColor;
 extern NSString* const kTextfieldBackgroundDarkColor;
 extern NSString* const kTextfieldPlaceholderDarkColor;
-extern NSString* const kTintDarkColor;
+
+extern NSString* const kBlueDarkColor;
+extern NSString* const kGreenDarkColor;
+extern NSString* const kRedDarkColor;
 
 #endif  // IOS_CHROME_COMMON_COLORS_SEMANTIC_COLOR_NAMES_H_
diff --git a/ios/chrome/common/colors/semantic_color_names.mm b/ios/chrome/common/colors/semantic_color_names.mm
index 1e5ceff..483f6ac 100644
--- a/ios/chrome/common/colors/semantic_color_names.mm
+++ b/ios/chrome/common/colors/semantic_color_names.mm
@@ -8,8 +8,8 @@
 #error "This file requires ARC support."
 #endif
 
+#pragma mark - Element Colors
 NSString* const kBackgroundColor = @"background_color";
-NSString* const kDestructiveTintColor = @"destructive_tint_color";
 NSString* const kDisabledTintColor = @"disabled_tint_color";
 NSString* const kMDCInkColor = @"mdc_ink_color";
 NSString* const kScrimBackgroundColor = @"scrim_background_color";
@@ -18,7 +18,11 @@
 NSString* const kTextSecondaryColor = @"text_secondary_color";
 NSString* const kTextfieldBackgroundColor = @"textfield_background_color";
 NSString* const kTextfieldPlaceholderColor = @"textfield_placeholder_color";
-NSString* const kTintColor = @"tint_color";
+
+#pragma mark - Standard Colors
+NSString* const kBlueColor = @"blue_color";
+NSString* const kGreenColor = @"green_color";
+NSString* const kRedColor = @"red_color";
 
 // Temporary for iOS 12
 NSString* const kBackgroundDarkColor = @"background_dark_color";
@@ -27,4 +31,7 @@
     @"textfield_background_dark_color";
 NSString* const kTextfieldPlaceholderDarkColor =
     @"textfield_placeholder_dark_color";
-NSString* const kTintDarkColor = @"tint_dark_color";
+
+NSString* const kBlueDarkColor = @"blue_dark_color";
+NSString* const kGreenDarkColor = @"green_dark_color";
+NSString* const kRedDarkColor = @"red_dark_color";
diff --git a/ios/web/navigation/crw_wk_navigation_handler.mm b/ios/web/navigation/crw_wk_navigation_handler.mm
index a7fc7bbc..699cb33 100644
--- a/ios/web/navigation/crw_wk_navigation_handler.mm
+++ b/ios/web/navigation/crw_wk_navigation_handler.mm
@@ -777,35 +777,7 @@
   // |context| will be nil if this navigation has been already committed and
   // finished.
   if (context) {
-    web::NavigationManager* navigationManager =
-        self.webStateImpl->GetNavigationManager();
-    GURL pendingURL;
-    if (navigationManager->GetPendingItemIndex() == -1) {
-      if (context->GetItem()) {
-        // Item may not exist if navigation was stopped (see
-        // crbug.com/969915).
-        pendingURL = context->GetItem()->GetURL();
-      }
-    } else {
-      if (navigationManager->GetPendingItem()) {
-        pendingURL = navigationManager->GetPendingItem()->GetURL();
-      }
-    }
-    if ((pendingURL == webViewURL) || (context->IsLoadingHtmlString()) ||
-        (!web::GetWebClient()->IsSlimNavigationManagerEnabled() &&
-         ui::PageTransitionCoreTypeIs(context->GetPageTransition(),
-                                      ui::PAGE_TRANSITION_RELOAD) &&
-         navigationManager->GetLastCommittedItem())) {
-      // Commit navigation if at least one of these is true:
-      //  - Navigation has pending item (this should always be true, but
-      //    pending item may not exist due to crbug.com/925304).
-      //  - Navigation is loadHTMLString:baseURL: navigation, which does not
-      //    create a pending item, but modifies committed item instead.
-      //  - Transition type is reload with Legacy Navigation Manager (Legacy
-      //    Navigation Manager does not create pending item for reload due to
-      //    crbug.com/676129)
       context->SetHasCommitted(true);
-    }
     self.webStateImpl->SetContentsMimeType(
         base::SysNSStringToUTF8(context->GetMimeType()));
   }
@@ -2070,12 +2042,6 @@
 
 // Updates the WKBackForwardListItemHolder navigation item.
 - (void)updateCurrentBackForwardListItemHolderInWebView:(WKWebView*)webView {
-  if (!self.currentNavItem) {
-    // TODO(crbug.com/925304): Pending item (which stores the holder) should be
-    // owned by NavigationContext object. Pending item should never be null.
-    return;
-  }
-
   web::WKBackForwardListItemHolder* holder =
       self.currentBackForwardListItemHolder;
 
@@ -2217,9 +2183,7 @@
   // be extracted from the landing page.)
   web::NavigationItem* currentItem = self.currentNavItem;
 
-  // TODO(crbug.com/925304): Pending item (which should be used here) should be
-  // owned by NavigationContext object. Pending item should never be null.
-  if (currentItem && !currentItem->GetReferrer().url.is_valid()) {
+  if (!currentItem->GetReferrer().url.is_valid()) {
     currentItem->SetReferrer(referrer);
   }
 
diff --git a/ios/web/web_state/ui/crw_web_controller.mm b/ios/web/web_state/ui/crw_web_controller.mm
index 71c359de..ed650c4 100644
--- a/ios/web/web_state/ui/crw_web_controller.mm
+++ b/ios/web/web_state/ui/crw_web_controller.mm
@@ -366,10 +366,17 @@
         setNativeControllerWebUsageEnabled:_webUsageEnabled];
     if (enabled) {
       // Don't create the web view; let it be lazy created as needed.
+
+      // The gesture is removed when the web usage is disabled. Add it back when
+      // it is enabled again.
+      [_containerView addGestureRecognizer:[self touchTrackingRecognizer]];
     } else {
       self.webStateImpl->ClearTransientContent();
-      _touchTrackingRecognizer.touchTrackingDelegate = nil;
-      _touchTrackingRecognizer = nil;
+      if (_touchTrackingRecognizer) {
+        [_containerView removeGestureRecognizer:_touchTrackingRecognizer];
+        _touchTrackingRecognizer.touchTrackingDelegate = nil;
+        _touchTrackingRecognizer = nil;
+      }
       _currentURLLoadWasTrigerred = NO;
     }
   }
diff --git a/ios/web/web_state/web_state_observer_inttest.mm b/ios/web/web_state/web_state_observer_inttest.mm
index 4c5ce18..d0b526db 100644
--- a/ios/web/web_state/web_state_observer_inttest.mm
+++ b/ios/web/web_state/web_state_observer_inttest.mm
@@ -311,7 +311,7 @@
       PageTransitionCoreTypeIs(ui::PageTransition::PAGE_TRANSITION_TYPED,
                                (*context)->GetPageTransition()));
   EXPECT_FALSE((*context)->IsSameDocument());
-  EXPECT_FALSE((*context)->HasCommitted());
+  EXPECT_TRUE((*context)->HasCommitted());
   EXPECT_FALSE((*context)->IsDownload());
   EXPECT_FALSE((*context)->IsPost());
   EXPECT_FALSE((*context)->GetError());
diff --git a/ios/web_view/internal/passwords/web_view_password_manager_client.h b/ios/web_view/internal/passwords/web_view_password_manager_client.h
index a12427f..2411e50 100644
--- a/ios/web_view/internal/passwords/web_view_password_manager_client.h
+++ b/ios/web_view/internal/passwords/web_view_password_manager_client.h
@@ -100,6 +100,7 @@
   ukm::SourceId GetUkmSourceId() override;
   password_manager::PasswordManagerMetricsRecorder* GetMetricsRecorder()
       override;
+  signin::IdentityManager* GetIdentityManager() override;
   bool IsIsolationForPasswordSitesEnabled() const override;
   bool IsNewTabPage() const override;
 
diff --git a/ios/web_view/internal/passwords/web_view_password_manager_client.mm b/ios/web_view/internal/passwords/web_view_password_manager_client.mm
index f7d7efd..f6e1b77 100644
--- a/ios/web_view/internal/passwords/web_view_password_manager_client.mm
+++ b/ios/web_view/internal/passwords/web_view_password_manager_client.mm
@@ -181,6 +181,11 @@
   return nullptr;
 }
 
+signin::IdentityManager* WebViewPasswordManagerClient::GetIdentityManager() {
+  NOTREACHED();
+  return nullptr;
+}
+
 void WebViewPasswordManagerClient::PromptUserToEnableAutosignin() {
   // TODO(crbug.com/435048): Implement this method.
 }
diff --git a/ipc/ipc_perftest_util.h b/ipc/ipc_perftest_util.h
index cf245a70..5925e3db 100644
--- a/ipc/ipc_perftest_util.h
+++ b/ipc/ipc_perftest_util.h
@@ -26,6 +26,10 @@
 #include "mojo/public/cpp/bindings/binding.h"
 #include "mojo/public/cpp/system/core.h"
 
+#if defined(OS_WIN)
+#include <windows.h>
+#endif
+
 namespace IPC {
 
 scoped_refptr<base::SingleThreadTaskRunner> GetIOThreadTaskRunner();
diff --git a/media/gpu/v4l2/v4l2_decode_surface.cc b/media/gpu/v4l2/v4l2_decode_surface.cc
index a835fce..2ce74ab 100644
--- a/media/gpu/v4l2/v4l2_decode_surface.cc
+++ b/media/gpu/v4l2/v4l2_decode_surface.cc
@@ -6,6 +6,7 @@
 
 #include <linux/media.h>
 #include <linux/videodev2.h>
+#include <poll.h>
 #include <sys/ioctl.h>
 
 #include "base/logging.h"
@@ -128,8 +129,19 @@
                                  V4L2WritableBufferRef output_buffer,
                                  scoped_refptr<VideoFrame> frame,
                                  int request_fd) {
-  // First reinit the request to make sure we can use it for a new submission.
-  int ret = HANDLE_EINTR(ioctl(request_fd, MEDIA_REQUEST_IOC_REINIT));
+  constexpr int kPollTimeoutMs = 500;
+  int ret;
+  struct pollfd poll_fd = {request_fd, POLLPRI, 0};
+
+  // First poll the request to ensure its previous task is done
+  ret = poll(&poll_fd, 1, kPollTimeoutMs);
+  if (ret != 1) {
+    VPLOGF(1) << "Failed to poll request: ";
+    return base::nullopt;
+  }
+
+  // Then reinit the request to make sure we can use it for a new submission.
+  ret = HANDLE_EINTR(ioctl(request_fd, MEDIA_REQUEST_IOC_REINIT));
   if (ret < 0) {
     VPLOGF(1) << "Failed to reinit request: ";
     return base::nullopt;
diff --git a/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.cc b/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.cc
index e518704..35947d1 100644
--- a/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.cc
+++ b/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.cc
@@ -76,8 +76,6 @@
     V4L2_PIX_FMT_H264_SLICE, V4L2_PIX_FMT_VP8_FRAME, V4L2_PIX_FMT_VP9_FRAME,
 };
 
-V4L2SliceVideoDecodeAccelerator::InputRecord::InputRecord() : request_fd(-1) {}
-
 V4L2SliceVideoDecodeAccelerator::OutputRecord::OutputRecord()
     : at_client(false),
       num_times_sent_to_client(0),
@@ -168,7 +166,7 @@
   DCHECK(!decoder_thread_.IsRunning());
   DCHECK(!device_poll_thread_.IsRunning());
 
-  DCHECK(input_buffer_map_.empty());
+  DCHECK(requests_.empty());
   DCHECK(output_buffer_map_.empty());
 }
 
@@ -478,7 +476,6 @@
   VLOGF(2);
   DCHECK(decoder_thread_task_runner_->BelongsToCurrentThread());
   DCHECK(!input_queue_->IsStreaming());
-  DCHECK(input_buffer_map_.empty());
 
   if (input_queue_->AllocateBuffers(kNumInputBuffers, V4L2_MEMORY_MMAP) <
       kNumInputBuffers) {
@@ -486,14 +483,14 @@
     return false;
   }
 
-  input_buffer_map_.resize(input_queue_->AllocatedBuffersCount());
-
   // The remainder of this method only applies if requests are used.
   if (!supports_requests_)
     return true;
 
+  DCHECK(requests_.empty());
+
   DCHECK(media_fd_.is_valid());
-  for (auto& input_record : input_buffer_map_) {
+  for (size_t i = 0; i < input_queue_->AllocatedBuffersCount(); i++) {
     int request_fd;
 
     int ret = HANDLE_EINTR(
@@ -502,8 +499,10 @@
       VPLOGF(1) << "Failed to create request: ";
       return false;
     }
-    input_record.request_fd = base::ScopedFD(request_fd);
+
+    requests_.push(base::ScopedFD(request_fd));
   }
+  DCHECK_EQ(requests_.size(), input_queue_->AllocatedBuffersCount());
 
   return true;
 }
@@ -583,12 +582,10 @@
 
   DCHECK(!input_queue_->IsStreaming());
 
-  if (input_buffer_map_.empty())
-    return;
-
   input_queue_->DeallocateBuffers();
 
-  input_buffer_map_.clear();
+  if (supports_requests_)
+    requests_ = {};
 }
 
 void V4L2SliceVideoDecodeAccelerator::DismissPictures(
@@ -664,7 +661,7 @@
             << "INPUT[" << decoder_input_queue_.size() << "]"
             << " => DEVICE[" << input_queue_->FreeBuffersCount() << "+"
             << input_queue_->QueuedBuffersCount() << "/"
-            << input_buffer_map_.size() << "]->["
+            << input_queue_->AllocatedBuffersCount() << "]->["
             << output_queue_->FreeBuffersCount() << "+"
             << output_queue_->QueuedBuffersCount() << "/"
             << output_buffer_map_.size() << "]"
@@ -1927,17 +1924,24 @@
   int input = input_buffer.BufferId();
   int output = output_buffer.BufferId();
 
-  InputRecord& input_record = input_buffer_map_[input];
-
   scoped_refptr<V4L2DecodeSurface> dec_surface;
 
   if (supports_requests_) {
-    auto ret = V4L2RequestDecodeSurface::Create(
-        std::move(input_buffer), std::move(output_buffer), nullptr,
-        input_record.request_fd.get());
+    // Here we just borrow the older request to use it, before
+    // immediately putting it back at the back of the queue.
+    base::ScopedFD request = std::move(requests_.front());
+    requests_.pop();
+    auto ret = V4L2RequestDecodeSurface::Create(std::move(input_buffer),
+                                                std::move(output_buffer),
+                                                nullptr, request.get());
+    requests_.push(std::move(request));
 
-    if (!ret)
+    // Not being able to create the decode surface at this stage is a
+    // fatal error.
+    if (!ret) {
+      NOTIFY_ERROR(PLATFORM_FAILURE);
       return nullptr;
+    }
 
     dec_surface = std::move(ret).value();
   } else {
@@ -2044,7 +2048,8 @@
   DCHECK(decoder_thread_.task_runner()->BelongsToCurrentThread());
 
   // VIDEO_OUTPUT queue's memory usage.
-  const size_t input_queue_buffers_count = input_buffer_map_.size();
+  const size_t input_queue_buffers_count =
+      input_queue_->AllocatedBuffersCount();
   size_t input_queue_memory_usage = 0;
   std::string input_queue_buffers_memory_type =
       V4L2Device::V4L2MemoryToString(V4L2_MEMORY_MMAP);
diff --git a/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.h b/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.h
index e3ee341..1a4262eb 100644
--- a/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.h
+++ b/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.h
@@ -77,12 +77,6 @@
                     base::trace_event::ProcessMemoryDump* pmd) override;
 
  private:
-  // Record for input buffers.
-  struct InputRecord {
-    InputRecord();
-    // Request fd used for this input buffer if request API is used.
-    base::ScopedFD request_fd;
-  };
 
   // Record for output buffers.
   struct OutputRecord {
@@ -375,8 +369,6 @@
   base::Thread device_poll_thread_;
 
   scoped_refptr<V4L2Queue> input_queue_;
-  // Mapping of int index to an input buffer record.
-  std::vector<InputRecord> input_buffer_map_;
   // Set to true by CreateInputBuffers() if the codec driver supports requests
   bool supports_requests_ = false;
   // Stores the media file descriptor if request API is used
@@ -388,6 +380,8 @@
   std::map<int32_t, V4L2WritableBufferRef> output_wait_map_;
   // Mapping of int index to an output buffer record.
   std::vector<OutputRecord> output_buffer_map_;
+  // FIFO queue of requests, only used if supports_requests_ == true.
+  std::queue<base::ScopedFD> requests_;
 
   VideoCodecProfile video_profile_;
   uint32_t input_format_fourcc_;
diff --git a/services/media_session/public/cpp/BUILD.gn b/services/media_session/public/cpp/BUILD.gn
index d9fda822..3781d7d6 100644
--- a/services/media_session/public/cpp/BUILD.gn
+++ b/services/media_session/public/cpp/BUILD.gn
@@ -71,7 +71,7 @@
   sources = [
     "media_image_manager_unittest.cc",
     "media_position_unittest.cc",
-    "struct_traits_unittest.cc",
+    "mojom_traits_unittest.cc",
   ]
 
   deps = [
diff --git a/services/media_session/public/cpp/struct_traits_unittest.cc b/services/media_session/public/cpp/mojom_traits_unittest.cc
similarity index 100%
rename from services/media_session/public/cpp/struct_traits_unittest.cc
rename to services/media_session/public/cpp/mojom_traits_unittest.cc
diff --git a/services/network/public/mojom/websocket.mojom b/services/network/public/mojom/websocket.mojom
index 651d27e..d17451e 100644
--- a/services/network/public/mojom/websocket.mojom
+++ b/services/network/public/mojom/websocket.mojom
@@ -112,14 +112,13 @@
   // Notify the renderer that a closing handshake has been initiated by the
   // server, so that it can set the Javascript readyState to CLOSING.
   OnClosingHandshake();
-
-  OnFailChannel(string reason);
 };
 
 interface WebSocket {
   // The client side may observe the following disconnection reason from the
   // service side:
   const uint32 kInsufficientResources = 1;
+  const uint32 kInternalFailure = 2;
 
   // Send a non-control frame to the remote server.
   // - |fin| indicates that this frame is the last in the current message.
diff --git a/services/network/websocket.cc b/services/network/websocket.cc
index 8c267df5..70409f1 100644
--- a/services/network/websocket.cc
+++ b/services/network/websocket.cc
@@ -222,7 +222,9 @@
   DVLOG(3) << "WebSocketEventHandler::OnFailChannel @"
            << reinterpret_cast<void*>(this) << " message=\"" << message << "\"";
 
-  impl_->client_->OnFailChannel(message);
+  impl_->handshake_client_.ResetWithReason(mojom::WebSocket::kInternalFailure,
+                                           message);
+  impl_->client_.ResetWithReason(mojom::WebSocket::kInternalFailure, message);
   impl_->Reset();
 }
 
diff --git a/services/proxy_resolver/public/cpp/OWNERS b/services/proxy_resolver/public/cpp/OWNERS
index 68cd819d..59d61d19 100644
--- a/services/proxy_resolver/public/cpp/OWNERS
+++ b/services/proxy_resolver/public/cpp/OWNERS
@@ -1,7 +1,5 @@
 per-file *_mojom_traits*.*=set noparent
 per-file *_mojom_traits*.*=file://ipc/SECURITY_OWNERS
-per-file *_struct_traits*.*=set noparent
-per-file *_struct_traits*.*=file://ipc/SECURITY_OWNERS
 per-file *.typemap=set noparent
 per-file *.typemap=file://ipc/SECURITY_OWNERS
 per-file manifest.cc=set noparent
diff --git a/services/proxy_resolver/public/cpp/mojo_host_struct_traits.cc b/services/proxy_resolver/public/cpp/mojo_host_mojom_traits.cc
similarity index 96%
rename from services/proxy_resolver/public/cpp/mojo_host_struct_traits.cc
rename to services/proxy_resolver/public/cpp/mojo_host_mojom_traits.cc
index 123a70a..8ab173c 100644
--- a/services/proxy_resolver/public/cpp/mojo_host_struct_traits.cc
+++ b/services/proxy_resolver/public/cpp/mojo_host_mojom_traits.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "services/proxy_resolver/public/cpp/mojo_host_struct_traits.h"
+#include "services/proxy_resolver/public/cpp/mojo_host_mojom_traits.h"
 
 #include <utility>
 
diff --git a/services/proxy_resolver/public/cpp/mojo_host_struct_traits.h b/services/proxy_resolver/public/cpp/mojo_host_mojom_traits.h
similarity index 78%
rename from services/proxy_resolver/public/cpp/mojo_host_struct_traits.h
rename to services/proxy_resolver/public/cpp/mojo_host_mojom_traits.h
index 01c80a8..5dfd827b 100644
--- a/services/proxy_resolver/public/cpp/mojo_host_struct_traits.h
+++ b/services/proxy_resolver/public/cpp/mojo_host_mojom_traits.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef SERVICES_PROXY_RESOLVER_PUBLIC_CPP_MOJO_HOST_STRUCT_TRAITS_H_
-#define SERVICES_PROXY_RESOLVER_PUBLIC_CPP_MOJO_HOST_STRUCT_TRAITS_H_
+#ifndef SERVICES_PROXY_RESOLVER_PUBLIC_CPP_MOJO_HOST_MOJOM_TRAITS_H_
+#define SERVICES_PROXY_RESOLVER_PUBLIC_CPP_MOJO_HOST_MOJOM_TRAITS_H_
 
 #include "base/strings/string_piece.h"
 #include "mojo/public/cpp/bindings/enum_traits.h"
@@ -24,4 +24,4 @@
 
 }  // namespace mojo
 
-#endif  // SERVICES_PROXY_RESOLVER_PUBLIC_CPP_MOJO_HOST_STRUCT_TRAITS_H_
+#endif  // SERVICES_PROXY_RESOLVER_PUBLIC_CPP_MOJO_HOST_MOJOM_TRAITS_H_
diff --git a/services/proxy_resolver/public/cpp/proxy_resolver.typemap b/services/proxy_resolver/public/cpp/proxy_resolver.typemap
index 7f6d138..bed4b933 100644
--- a/services/proxy_resolver/public/cpp/proxy_resolver.typemap
+++ b/services/proxy_resolver/public/cpp/proxy_resolver.typemap
@@ -9,11 +9,11 @@
   "//net/proxy_resolution/proxy_resolve_dns_operation.h",
 ]
 traits_headers = [
-  "//services/proxy_resolver/public/cpp/mojo_host_struct_traits.h",
+  "//services/proxy_resolver/public/cpp/mojo_host_mojom_traits.h",
   "//services/proxy_resolver/public/cpp/proxy_resolver_mojom_traits.h",
 ]
 sources = [
-  "//services/proxy_resolver/public/cpp/mojo_host_struct_traits.cc",
+  "//services/proxy_resolver/public/cpp/mojo_host_mojom_traits.cc",
   "//services/proxy_resolver/public/cpp/proxy_resolver_mojom_traits.cc",
 ]
 type_mappings = [
diff --git a/services/service_manager/public/cpp/bind_source_info_mojom_traits.h b/services/service_manager/public/cpp/bind_source_info_mojom_traits.h
index 531323e..9f57eec 100644
--- a/services/service_manager/public/cpp/bind_source_info_mojom_traits.h
+++ b/services/service_manager/public/cpp/bind_source_info_mojom_traits.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef SERVICES_SERVICE_MANAGER_PUBLIC_CPP_BIND_SOURCE_INFO_STRUCT_TRAITS_H_
-#define SERVICES_SERVICE_MANAGER_PUBLIC_CPP_BIND_SOURCE_INFO_STRUCT_TRAITS_H_
+#ifndef SERVICES_SERVICE_MANAGER_PUBLIC_CPP_BIND_SOURCE_INFO_MOJOM_TRAITS_H_
+#define SERVICES_SERVICE_MANAGER_PUBLIC_CPP_BIND_SOURCE_INFO_MOJOM_TRAITS_H_
 
 #include "services/service_manager/public/cpp/bind_source_info.h"
 #include "services/service_manager/public/mojom/service.mojom.h"
@@ -31,4 +31,4 @@
 
 }  // namespace mojo
 
-#endif  // SERVICES_SERVICE_MANAGER_PUBLIC_CPP_BIND_SOURCE_INFO_STRUCT_TRAITS_H_
+#endif  // SERVICES_SERVICE_MANAGER_PUBLIC_CPP_BIND_SOURCE_INFO_MOJOM_TRAITS_H_
diff --git a/services/service_manager/public/cpp/identity_mojom_traits.h b/services/service_manager/public/cpp/identity_mojom_traits.h
index e0e44af..6291d42 100644
--- a/services/service_manager/public/cpp/identity_mojom_traits.h
+++ b/services/service_manager/public/cpp/identity_mojom_traits.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef SERVICES_SERVICE_MANAGER_PUBLIC_CPP_IDENTITY_STRUCT_TRAITS_H_
-#define SERVICES_SERVICE_MANAGER_PUBLIC_CPP_IDENTITY_STRUCT_TRAITS_H_
+#ifndef SERVICES_SERVICE_MANAGER_PUBLIC_CPP_IDENTITY_MOJOM_TRAITS_H_
+#define SERVICES_SERVICE_MANAGER_PUBLIC_CPP_IDENTITY_MOJOM_TRAITS_H_
 
 #include "base/component_export.h"
 #include "services/service_manager/public/cpp/identity.h"
@@ -38,4 +38,4 @@
 
 }  // namespace mojo
 
-#endif  // SERVICES_SERVICE_MANAGER_PUBLIC_CPP_IDENTITY_STRUCT_TRAITS_H_
+#endif  // SERVICES_SERVICE_MANAGER_PUBLIC_CPP_IDENTITY_MOJOM_TRAITS_H_
diff --git a/services/service_manager/public/cpp/interface_provider_spec_mojom_traits.h b/services/service_manager/public/cpp/interface_provider_spec_mojom_traits.h
index 62e50e6..e7c8a8f 100644
--- a/services/service_manager/public/cpp/interface_provider_spec_mojom_traits.h
+++ b/services/service_manager/public/cpp/interface_provider_spec_mojom_traits.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef SERVICES_SERVICE_MANAGER_PUBLIC_CPP_INTERFACE_PROVIDER_SPEC_STRUCT_TRAITS_H_
-#define SERVICES_SERVICE_MANAGER_PUBLIC_CPP_INTERFACE_PROVIDER_SPEC_STRUCT_TRAITS_H_
+#ifndef SERVICES_SERVICE_MANAGER_PUBLIC_CPP_INTERFACE_PROVIDER_SPEC_MOJOM_TRAITS_H_
+#define SERVICES_SERVICE_MANAGER_PUBLIC_CPP_INTERFACE_PROVIDER_SPEC_MOJOM_TRAITS_H_
 
 #include "services/service_manager/public/cpp/interface_provider_spec.h"
 #include "services/service_manager/public/mojom/interface_provider_spec.mojom.h"
@@ -82,4 +82,4 @@
 
 }  // namespace mojo
 
-#endif  // SERVICES_SERVICE_MANAGER_PUBLIC_CPP_INTERFACE_PROVIDER_SPEC_STRUCT_TRAITS_H_
+#endif  // SERVICES_SERVICE_MANAGER_PUBLIC_CPP_INTERFACE_PROVIDER_SPEC_MOJOM_TRAITS_H_
diff --git a/services/video_capture/public/mojom/OWNERS b/services/video_capture/public/mojom/OWNERS
index ac44cd00..f486cf5 100644
--- a/services/video_capture/public/mojom/OWNERS
+++ b/services/video_capture/public/mojom/OWNERS
@@ -1,5 +1,5 @@
 per-file *.mojom=set noparent
 per-file *.mojom=file://ipc/SECURITY_OWNERS
 
-per-file *_struct_traits*.*=set noparent
-per-file *_struct_traits*.*=file://ipc/SECURITY_OWNERS
+per-file *_mojom_traits*.*=set noparent
+per-file *_mojom_traits*.*=file://ipc/SECURITY_OWNERS
diff --git a/testing/buildbot/chromium.linux.json b/testing/buildbot/chromium.linux.json
index 5abda53..e0f1e306 100644
--- a/testing/buildbot/chromium.linux.json
+++ b/testing/buildbot/chromium.linux.json
@@ -2151,8 +2151,7 @@
       {
         "isolate_coverage_data": true,
         "name": "check_network_annotations",
-        "script": "check_network_annotations.py",
-        "swarming": {}
+        "script": "check_network_annotations.py"
       }
     ]
   },
diff --git a/testing/buildbot/waterfalls.pyl b/testing/buildbot/waterfalls.pyl
index 8b75ad4..5a12b065 100644
--- a/testing/buildbot/waterfalls.pyl
+++ b/testing/buildbot/waterfalls.pyl
@@ -3331,7 +3331,6 @@
       'Linux Builder': {
         'mixins': [
           'code-coverage',
-          'linux-trusty',
         ],
         'additional_compile_targets': [
           'all'
diff --git a/third_party/blink/public/mojom/mediastream/media_stream.mojom b/third_party/blink/public/mojom/mediastream/media_stream.mojom
index 010a9b57..6d9e5ad 100644
--- a/third_party/blink/public/mojom/mediastream/media_stream.mojom
+++ b/third_party/blink/public/mojom/mediastream/media_stream.mojom
@@ -63,6 +63,21 @@
   NUM_MEDIA_REQUEST_RESULTS
 };
 
+// Strategies used to search an audio device stream.
+enum StreamSelectionStrategy {
+  SEARCH_BY_SESSION_ID,
+  SEARCH_BY_DEVICE_ID,
+  FORCE_NEW_STREAM,
+};
+
+// See MediaStreamDispatcherHost below for information.
+struct StreamSelectionInfo {
+  StreamSelectionStrategy strategy;
+  // When |strategy| is set to be SEARCH_BY_SESSION_ID, |session_id| must be
+  // specified and valid. It can be null otherwise.
+  mojo_base.mojom.UnguessableToken? session_id;
+};
+
 // See public/common/media_stream_request.h.
 struct MediaStreamDevice {
   MediaStreamType type;
@@ -104,7 +119,21 @@
 // make media stream requests.
 interface MediaStreamDispatcherHost {
   // Requests a new media stream.
-  GenerateStream(int32 request_id, StreamControls controls, bool user_gesture)
+  // |request_id| is used by the renderer to identify the stream generation
+  // request.
+  // |controls| contains track-related settings such as device ID or MediaStream
+  // type.
+  // |user_gesture| indicates whether the call was made in the context of a user
+  // gesture.
+  // |audio_stream_selection_info| is used to request a specific stream using
+  // the associated session ID and is only used for audio devices when
+  // |audio_stream_selection_info.strategy| is SEARCH_BY_SESSION_ID; when it is
+  // FORCE_NEW_STREAM, a new stream with a new session ID is always generated;
+  // finally, when it is SEARCH_BY_DEVICE_ID, an existing stream is used if the
+  // device associated to the request already has an opened stream available, or
+  // a new one otherwise.
+  GenerateStream(int32 request_id, StreamControls controls, bool user_gesture,
+                 StreamSelectionInfo audio_stream_selection_info)
       => (MediaStreamRequestResult result, string label,
          array<MediaStreamDevice> audio_devices,
          array<MediaStreamDevice> video_devices);
diff --git a/third_party/blink/public/mojom/web_feature/web_feature.mojom b/third_party/blink/public/mojom/web_feature/web_feature.mojom
index 7bcf3e9..275a47f 100644
--- a/third_party/blink/public/mojom/web_feature/web_feature.mojom
+++ b/third_party/blink/public/mojom/web_feature/web_feature.mojom
@@ -2365,6 +2365,13 @@
   kContentIndexAdd = 2983,
   kContentIndexDelete = 2984,
   kContentIndexGet = 2985,
+  kV8SpeechGrammar_Constructor = 2986,
+  kV8SpeechGrammarList_AddFromString_Method = 2987,
+  kV8SpeechGrammarList_Constructor = 2988,
+  kV8SpeechGrammarList_Item_Method = 2989,
+  kV8SpeechRecognition_Constructor = 2990,
+  kV8SpeechRecognition_Grammars_AttributeGetter = 2991,
+  kV8SpeechRecognition_Grammars_AttributeSetter = 2992,
 
   // Add new features immediately above this line. Don't change assigned
   // numbers of any item, and don't reuse removed slots.
diff --git a/third_party/blink/public/mojom/worker/shared_worker_factory.mojom b/third_party/blink/public/mojom/worker/shared_worker_factory.mojom
index c05ed08..733eafb 100644
--- a/third_party/blink/public/mojom/worker/shared_worker_factory.mojom
+++ b/third_party/blink/public/mojom/worker/shared_worker_factory.mojom
@@ -32,6 +32,7 @@
   // |interface_provider| instead of receiving plumbing it here.
   CreateSharedWorker(
       SharedWorkerInfo info,
+      string user_agent,
       bool pause_on_start,
       mojo_base.mojom.UnguessableToken devtools_worker_token,
       RendererPreferences renderer_preferences,
diff --git a/third_party/blink/public/platform/modules/mediastream/media_stream_audio_processor_options.h b/third_party/blink/public/platform/modules/mediastream/media_stream_audio_processor_options.h
index 801832b1..e3740ec 100644
--- a/third_party/blink/public/platform/modules/mediastream/media_stream_audio_processor_options.h
+++ b/third_party/blink/public/platform/modules/mediastream/media_stream_audio_processor_options.h
@@ -66,6 +66,12 @@
   // Returns whether WebRTC-provided echo cancellation is enabled.
   bool EchoCancellationIsWebRtcProvided() const;
 
+  bool HasSameReconfigurableSettings(
+      const AudioProcessingProperties& other) const;
+
+  bool HasSameNonReconfigurableSettings(
+      const AudioProcessingProperties& other) const;
+
   // Converts this struct to an equivalent media::AudioProcessingSettings.
   // TODO(https://crbug.com/878757): Eliminate this class in favor of the media
   // one.
diff --git a/third_party/blink/public/platform/modules/mediastream/media_stream_audio_source.h b/third_party/blink/public/platform/modules/mediastream/media_stream_audio_source.h
index a55ea463..db41237d 100644
--- a/third_party/blink/public/platform/modules/mediastream/media_stream_audio_source.h
+++ b/third_party/blink/public/platform/modules/mediastream/media_stream_audio_source.h
@@ -13,6 +13,7 @@
 #include "base/memory/weak_ptr.h"
 #include "media/base/limits.h"
 #include "third_party/blink/public/platform/modules/mediastream/media_stream_audio_deliverer.h"
+#include "third_party/blink/public/platform/modules/mediastream/media_stream_audio_processor_options.h"
 #include "third_party/blink/public/platform/modules/mediastream/web_platform_media_stream_source.h"
 #include "third_party/blink/public/platform/web_common.h"
 #include "third_party/blink/public/platform/web_media_stream_source.h"
@@ -105,6 +106,25 @@
   // method to provide safe down-casting to their type.
   virtual void* GetClassIdentifier() const;
 
+  // Returns true if the source has audio processing properties and the
+  // reconfigurable settings associated to audio processing match
+  // |selected_properties|; false otherwise.
+  bool HasSameReconfigurableSettings(
+      const blink::AudioProcessingProperties& selected_properties) const;
+
+  // Returns true if |this| and |other_source| have audio processing properties
+  // and the set of settings that cannot be reconfigured associated to these
+  // audio sources match; false otherwise.
+  bool HasSameNonReconfigurableSettings(
+      MediaStreamAudioSource* other_source) const;
+
+  // Returns the audio processing properties associated to this source if any,
+  // or nullopt otherwise.
+  virtual base::Optional<blink::AudioProcessingProperties>
+  GetAudioProcessingProperties() const {
+    return base::nullopt;
+  }
+
  protected:
   // Returns a new MediaStreamAudioTrack. |id| is the blink track's ID in UTF-8.
   // Subclasses may override this to provide an extended implementation.
diff --git a/third_party/blink/public/web/modules/mediastream/local_media_stream_audio_source.h b/third_party/blink/public/web/modules/mediastream/local_media_stream_audio_source.h
index 7ed542d..d37c860 100644
--- a/third_party/blink/public/web/modules/mediastream/local_media_stream_audio_source.h
+++ b/third_party/blink/public/web/modules/mediastream/local_media_stream_audio_source.h
@@ -44,6 +44,9 @@
   // MediaStreamAudioSource implementation.
   void ChangeSourceImpl(const MediaStreamDevice& new_device) final;
 
+  base::Optional<blink::AudioProcessingProperties>
+  GetAudioProcessingProperties() const final;
+
  private:
   // MediaStreamAudioSource implementation.
   bool EnsureSourceIsStarted() final;
diff --git a/third_party/blink/public/web/modules/mediastream/media_stream_constraints_util_audio.h b/third_party/blink/public/web/modules/mediastream/media_stream_constraints_util_audio.h
index 24953db8..898eb07 100644
--- a/third_party/blink/public/web/modules/mediastream/media_stream_constraints_util_audio.h
+++ b/third_party/blink/public/web/modules/mediastream/media_stream_constraints_util_audio.h
@@ -143,10 +143,15 @@
 //    Moreover, the echo_cancellation constraint influences most other
 //    audio-processing properties for which no explicit value is provided in
 //    their corresponding constraints.
+// |is_reconfiguration_allowed| indicates whether it is possible to reconfigure
+// settings on an open audio track.
+// TODO(crbug.com/796964): remove |is_reconfiguration_allowed| when both
+// getUserMedia and applyConstraints code paths allow for reconfiguration.
 BLINK_MODULES_EXPORT blink::AudioCaptureSettings SelectSettingsAudioCapture(
     const AudioDeviceCaptureCapabilities& capabilities,
     const blink::WebMediaConstraints& constraints,
-    bool should_disable_hardware_noise_suppression);
+    bool should_disable_hardware_noise_suppression,
+    bool is_reconfiguration_allowed = false);
 
 // This variant of SelectSettings takes an existing MediaStreamAudioSource
 // as input in order to determine settings that are compatible with it.
diff --git a/third_party/blink/public/web/modules/mediastream/processed_local_audio_source.h b/third_party/blink/public/web/modules/mediastream/processed_local_audio_source.h
index a03283d..504a947 100644
--- a/third_party/blink/public/web/modules/mediastream/processed_local_audio_source.h
+++ b/third_party/blink/public/web/modules/mediastream/processed_local_audio_source.h
@@ -74,6 +74,9 @@
     return audio_processing_properties_;
   }
 
+  base::Optional<blink::AudioProcessingProperties>
+  GetAudioProcessingProperties() const final;
+
   // The following accessors are valid after the source is started (when the
   // first track is connected).
   scoped_refptr<webrtc::AudioProcessorInterface> GetAudioProcessor() const;
diff --git a/third_party/blink/public/web/web_autofill_client.h b/third_party/blink/public/web/web_autofill_client.h
index 62cfdfe..f102b74 100644
--- a/third_party/blink/public/web/web_autofill_client.h
+++ b/third_party/blink/public/web/web_autofill_client.h
@@ -65,9 +65,9 @@
   virtual void DidCompleteFocusChangeInFrame() {}
   virtual void DidReceiveLeftMouseDownOrGestureTapInNode(const WebNode&) {}
 
-  // Asks the client to show the touch to fill UI for the given control element.
-  // Returns whether the touch to fill UI was actually shown.
-  virtual bool TryToShowTouchToFill(const WebFormControlElement&) {
+  // Asks the client whether to suppess the keyboard for the given control
+  // element.
+  virtual bool ShouldSuppressKeyboard(const WebFormControlElement&) {
     return false;
   }
 
diff --git a/third_party/blink/public/web/web_local_frame.h b/third_party/blink/public/web/web_local_frame.h
index f62985f2..ef349381 100644
--- a/third_party/blink/public/web/web_local_frame.h
+++ b/third_party/blink/public/web/web_local_frame.h
@@ -723,9 +723,9 @@
   // checkbox, radio etc.)
   virtual void AdvanceFocusInForm(WebFocusType) = 0;
 
-  // Asks the active WebAutofillClient to show the touch to fill UI for the
-  // currently focused field. Returns whether this request succeeded.
-  virtual bool TryToShowTouchToFillForFocusedElement() = 0;
+  // Returns whether the keyboard should be suppressed for the currently focused
+  // element.
+  virtual bool ShouldSuppressKeyboardForFocusedElement() = 0;
 
   // Performance --------------------------------------------------------
 
diff --git a/third_party/blink/public/web/web_shared_worker.h b/third_party/blink/public/web/web_shared_worker.h
index 1f69bc7..47ff8341 100644
--- a/third_party/blink/public/web/web_shared_worker.h
+++ b/third_party/blink/public/web/web_shared_worker.h
@@ -71,6 +71,7 @@
   virtual void StartWorkerContext(
       const WebURL& script_url,
       const WebString& name,
+      const WebString& user_agent,
       const WebString& content_security_policy,
       mojom::ContentSecurityPolicyType,
       mojom::IPAddressSpace,
diff --git a/third_party/blink/renderer/bindings/core/v8/script_streamer.cc b/third_party/blink/renderer/bindings/core/v8/script_streamer.cc
index ab83755e..dc5e6f7 100644
--- a/third_party/blink/renderer/bindings/core/v8/script_streamer.cc
+++ b/third_party/blink/renderer/bindings/core/v8/script_streamer.cc
@@ -467,10 +467,10 @@
   // Script streaming tasks are high priority, as they can block the parser,
   // and they can (and probably will) block during their own execution as
   // they wait for more input.
-  //
   // TODO(leszeks): Decrease the priority of these tasks where possible.
-  worker_pool::PostTaskWithTraits(
-      FROM_HERE, {base::TaskPriority::USER_BLOCKING, base::MayBlock()},
+  worker_pool::PostTask(
+      FROM_HERE,
+      {base::ThreadPool(), base::TaskPriority::USER_BLOCKING, base::MayBlock()},
       CrossThreadBindOnce(RunScriptStreamingTask,
                           WTF::Passed(std::move(script_streaming_task)),
                           WrapCrossThreadPersistent(this),
diff --git a/third_party/blink/renderer/bindings/scripts/web_idl/idl_compiler.py b/third_party/blink/renderer/bindings/scripts/web_idl/idl_compiler.py
index 2ff02d4..595740d 100644
--- a/third_party/blink/renderer/bindings/scripts/web_idl/idl_compiler.py
+++ b/third_party/blink/renderer/bindings/scripts/web_idl/idl_compiler.py
@@ -72,6 +72,8 @@
         self._merge_partial_dictionaries()
         # Merge mixins.
         self._merge_interface_mixins()
+        # Process inheritances.
+        self._process_interface_inheritances()
         # Updates on IRs are finished.  Create API objects.
         self._create_public_objects()
 
@@ -151,6 +153,34 @@
                 ])
             self._ir_map.add(new_interface)
 
+    def _process_interface_inheritances(self):
+        def is_own_member(member):
+            return 'Unfogeable' in member.extended_attributes
+
+        def create_inheritance_stack(obj, table):
+            if obj.inherited is None:
+                return [obj]
+            return [obj] + create_inheritance_stack(
+                table.get(obj.inherited.identifier, None), table)
+
+        old_interfaces = self._ir_map.find_by_kind(
+            IdentifierIRMap.IR.Kind.INTERFACE)
+        self._ir_map.move_to_new_phase()
+        for old_interface in old_interfaces.itervalues():
+            new_interface = old_interface.make_copy()
+            inheritance_stack = create_inheritance_stack(
+                old_interface, old_interfaces)
+            for interface in inheritance_stack[1:]:
+                new_interface.attributes.extend([
+                    attribute.make_copy() for attribute in interface.attributes
+                    if is_own_member(attribute)
+                ])
+                new_interface.operations.extend([
+                    operation.make_copy() for operation in interface.operations
+                    if is_own_member(operation)
+                ])
+            self._ir_map.add(new_interface)
+
     def _create_public_objects(self):
         """Creates public representations of compiled objects."""
         dictionary_irs = self._ir_map.find_by_kind(
diff --git a/third_party/blink/renderer/core/animation/animation_sim_test.cc b/third_party/blink/renderer/core/animation/animation_sim_test.cc
index e7487e4..dfd11a3 100644
--- a/third_party/blink/renderer/core/animation/animation_sim_test.cc
+++ b/third_party/blink/renderer/core/animation/animation_sim_test.cc
@@ -4,9 +4,11 @@
 
 #include "third_party/blink/public/web/web_script_source.h"
 #include "third_party/blink/renderer/core/animation/animatable.h"
+#include "third_party/blink/renderer/core/animation/keyframe_effect_model.h"
+#include "third_party/blink/renderer/core/animation/string_keyframe.h"
 #include "third_party/blink/renderer/core/css/css_style_sheet.h"
-#include "third_party/blink/renderer/core/css/property_definition.h"
-#include "third_party/blink/renderer/core/css/property_registration.h"
+#include "third_party/blink/renderer/core/css/css_test_helpers.h"
+#include "third_party/blink/renderer/core/dom/element.h"
 #include "third_party/blink/renderer/core/frame/web_local_frame_impl.h"
 #include "third_party/blink/renderer/core/page/page.h"
 #include "third_party/blink/renderer/core/testing/sim/sim_compositor.h"
@@ -48,16 +50,10 @@
   //   initialValue: '0%',
   //   inherits: false
   // })
-  DummyExceptionStateForTesting exception_state;
-  PropertyDefinition* property_definition = PropertyDefinition::Create();
-  property_definition->setName("--x");
-  property_definition->setSyntax("<percentage>");
-  property_definition->setInitialValue("0%");
-  property_definition->setInherits(false);
-  PropertyRegistration::registerProperty(&GetDocument(), property_definition,
-                                         exception_state);
-  EXPECT_FALSE(exception_state.HadException());
+  css_test_helpers::RegisterProperty(GetDocument(), "--x", "<percentage>", "0%",
+                                     false);
 
+  DummyExceptionStateForTesting exception_state;
   // target.style.setProperty('--x', '100%');
   target->style()->setProperty(&GetDocument(), "--x", "100%", g_empty_string,
                                exception_state);
diff --git a/third_party/blink/renderer/core/animation/keyframe_effect_model_test.cc b/third_party/blink/renderer/core/animation/keyframe_effect_model_test.cc
index 3d23fce..e0594f8 100644
--- a/third_party/blink/renderer/core/animation/keyframe_effect_model_test.cc
+++ b/third_party/blink/renderer/core/animation/keyframe_effect_model_test.cc
@@ -39,8 +39,7 @@
 #include "third_party/blink/renderer/core/animation/invalidatable_interpolation.h"
 #include "third_party/blink/renderer/core/animation/string_keyframe.h"
 #include "third_party/blink/renderer/core/css/css_primitive_value.h"
-#include "third_party/blink/renderer/core/css/property_definition.h"
-#include "third_party/blink/renderer/core/css/property_registration.h"
+#include "third_party/blink/renderer/core/css/css_test_helpers.h"
 #include "third_party/blink/renderer/core/css/property_registry.h"
 #include "third_party/blink/renderer/core/css/resolver/style_resolver.h"
 #include "third_party/blink/renderer/core/dom/element.h"
@@ -140,13 +139,8 @@
     const String& zero_value,
     const String& one_value,
     ExceptionState& exception_state) {
-  PropertyDefinition* property_definition = PropertyDefinition::Create();
-  property_definition->setName(property_name);
-  property_definition->setSyntax(type);
-  property_definition->setInitialValue(zero_value);
-  property_definition->setInherits(false);
-  PropertyRegistration::registerProperty(document, property_definition,
-                                         exception_state);
+  css_test_helpers::RegisterProperty(*document, property_name, type, zero_value,
+                                     false);
 
   StringKeyframeVector keyframes =
       KeyframesAtZeroAndOne(property_name, zero_value, one_value);
diff --git a/third_party/blink/renderer/core/css/style_engine.h b/third_party/blink/renderer/core/css/style_engine.h
index a66992f..d48b51a1 100644
--- a/third_party/blink/renderer/core/css/style_engine.h
+++ b/third_party/blink/renderer/core/css/style_engine.h
@@ -302,6 +302,9 @@
 
   void NodeWillBeRemoved(Node&);
   void ChildrenRemoved(ContainerNode& parent);
+  void PseudoElementRemoved(Element& originating_element) {
+    layout_tree_rebuild_root_.ChildrenRemoved(originating_element);
+  }
 
   unsigned StyleForElementCount() const { return style_for_element_count_; }
   void IncStyleForElementCount() { style_for_element_count_++; }
diff --git a/third_party/blink/renderer/core/css/style_traversal_root.cc b/third_party/blink/renderer/core/css/style_traversal_root.cc
index 901b140..c9957993 100644
--- a/third_party/blink/renderer/core/css/style_traversal_root.cc
+++ b/third_party/blink/renderer/core/css/style_traversal_root.cc
@@ -56,16 +56,4 @@
   Clear();
 }
 
-#if DCHECK_IS_ON()
-bool StyleTraversalRoot::IsConnectedToDocument(Node& node) const {
-  if (node.IsDocumentNode())
-    return true;
-  for (Node& parent : NodeTraversal::AncestorsOf(node)) {
-    if (parent.IsDocumentNode())
-      return true;
-  }
-  return false;
-}
-#endif  // DCHECK_IS_ON()
-
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/css/style_traversal_root.h b/third_party/blink/renderer/core/css/style_traversal_root.h
index 3f83e14..2b46beb 100644
--- a/third_party/blink/renderer/core/css/style_traversal_root.h
+++ b/third_party/blink/renderer/core/css/style_traversal_root.h
@@ -71,10 +71,6 @@
  private:
   friend class StyleTraversalRootTestImpl;
 
-#if DCHECK_IS_ON()
-  bool IsConnectedToDocument(Node&) const;
-#endif  // DCHECK_IS_ON()
-
   // The current root for dirty nodes.
   Member<Node> root_node_;
 
diff --git a/third_party/blink/renderer/core/dom/element.cc b/third_party/blink/renderer/core/dom/element.cc
index 5d93cc5d..0df5d48 100644
--- a/third_party/blink/renderer/core/dom/element.cc
+++ b/third_party/blink/renderer/core/dom/element.cc
@@ -2661,8 +2661,7 @@
   }
 
   if (child_change.ReattachLayoutTree()) {
-    // Don't mark pseudo element which is about to be removed for re-attachment.
-    if (new_style || (old_style && !IsPseudoElement()))
+    if (new_style || old_style)
       SetNeedsReattachLayoutTree();
     return child_change;
   }
@@ -4476,6 +4475,7 @@
   if (element->NeedsReattachLayoutTree() &&
       !PseudoElementLayoutObjectIsNeeded(element->GetComputedStyle())) {
     GetElementRareData()->SetPseudoElement(kPseudoIdFirstLetter, nullptr);
+    GetDocument().GetStyleEngine().PseudoElementRemoved(*this);
   }
 }
 
@@ -4497,6 +4497,7 @@
         return;
     }
     GetElementRareData()->SetPseudoElement(pseudo_id, nullptr);
+    GetDocument().GetStyleEngine().PseudoElementRemoved(*this);
   }
 }
 
diff --git a/third_party/blink/renderer/core/exported/web_shared_worker_impl.cc b/third_party/blink/renderer/core/exported/web_shared_worker_impl.cc
index a9faf55..24301180 100644
--- a/third_party/blink/renderer/core/exported/web_shared_worker_impl.cc
+++ b/third_party/blink/renderer/core/exported/web_shared_worker_impl.cc
@@ -193,6 +193,7 @@
 void WebSharedWorkerImpl::StartWorkerContext(
     const WebURL& script_request_url,
     const WebString& name,
+    const WebString& user_agent,
     const WebString& content_security_policy,
     mojom::ContentSecurityPolicyType policy_type,
     mojom::IPAddressSpace creation_address_space,
@@ -204,6 +205,7 @@
   DCHECK(IsMainThread());
   script_request_url_ = script_request_url;
   name_ = name;
+  user_agent_ = user_agent;
   creation_address_space_ = creation_address_space;
   // Chrome doesn't use interface versioning.
   content_settings_info_ = mojom::blink::WorkerContentSettingsProxyPtrInfo(
@@ -286,8 +288,7 @@
   // worker script fetch on the worker thread.
   auto creation_params = std::make_unique<GlobalScopeCreationParams>(
       script_request_url_, script_type,
-      OffMainThreadWorkerScriptFetchOption::kEnabled, name_,
-      shadow_page_->GetDocument()->UserAgent(),
+      OffMainThreadWorkerScriptFetchOption::kEnabled, name_, user_agent_,
       std::move(web_worker_fetch_context), Vector<CSPHeaderAndType>(),
       outside_settings_object->GetReferrerPolicy(),
       outside_settings_object->GetSecurityOrigin(), starter_secure_context,
diff --git a/third_party/blink/renderer/core/exported/web_shared_worker_impl.h b/third_party/blink/renderer/core/exported/web_shared_worker_impl.h
index bb4238b..0c28b25 100644
--- a/third_party/blink/renderer/core/exported/web_shared_worker_impl.h
+++ b/third_party/blink/renderer/core/exported/web_shared_worker_impl.h
@@ -93,6 +93,7 @@
   void StartWorkerContext(
       const WebURL&,
       const WebString& name,
+      const WebString& user_agent,
       const WebString& content_security_policy,
       mojom::ContentSecurityPolicyType,
       mojom::IPAddressSpace,
@@ -152,6 +153,7 @@
 
   WebURL script_request_url_;
   WebString name_;
+  WebString user_agent_;
   mojom::IPAddressSpace creation_address_space_;
 
   service_manager::mojom::blink::InterfaceProviderPtrInfo
diff --git a/third_party/blink/renderer/core/exported/web_view_test.cc b/third_party/blink/renderer/core/exported/web_view_test.cc
index 28c2eaa6..143c6376 100644
--- a/third_party/blink/renderer/core/exported/web_view_test.cc
+++ b/third_party/blink/renderer/core/exported/web_view_test.cc
@@ -3364,12 +3364,12 @@
   }
   void UserGestureObserved() override { ++user_gesture_notifications_count_; }
 
-  bool TryToShowTouchToFill(const WebFormControlElement&) override {
-    return can_show_touch_to_fill_;
+  bool ShouldSuppressKeyboard(const WebFormControlElement&) override {
+    return should_suppress_keyboard_;
   }
 
-  void SetCanShowTouchToFill(bool can_show_touch_to_fill) {
-    can_show_touch_to_fill_ = can_show_touch_to_fill;
+  void SetShouldSuppressKeyboard(bool should_suppress_keyboard) {
+    should_suppress_keyboard_ = should_suppress_keyboard;
   }
 
   void ClearChangeCounts() { text_changes_ = 0; }
@@ -3384,7 +3384,7 @@
   int text_changes_ = 0;
   int text_changes_from_user_gesture_ = 0;
   int user_gesture_notifications_count_ = 0;
-  bool can_show_touch_to_fill_ = false;
+  bool should_suppress_keyboard_ = false;
 };
 
 TEST_F(WebViewTest, LosingFocusDoesNotTriggerAutofillTextChange) {
@@ -4682,25 +4682,25 @@
 
 #endif
 
-TEST_F(WebViewTest, PasswordFieldCanBeAutofilled) {
+TEST_F(WebViewTest, ShouldSuppressKeyboardForPasswordField) {
   RegisterMockedHttpURLLoad("input_field_password.html");
   // Pretend client has fill data for all fields it's queried.
   MockAutofillClient client;
-  client.SetCanShowTouchToFill(true);
+  client.SetShouldSuppressKeyboard(true);
   WebViewImpl* web_view = web_view_helper_.InitializeAndLoad(
       base_url_ + "input_field_password.html");
   WebLocalFrameImpl* frame = web_view->MainFrameImpl();
   frame->SetAutofillClient(&client);
   // No field is focused.
-  EXPECT_FALSE(frame->TryToShowTouchToFillForFocusedElement());
+  EXPECT_FALSE(frame->ShouldSuppressKeyboardForFocusedElement());
 
   // Focusing a field should result in treating it autofillable.
   web_view->SetInitialFocus(false);
-  EXPECT_TRUE(frame->TryToShowTouchToFillForFocusedElement());
+  EXPECT_TRUE(frame->ShouldSuppressKeyboardForFocusedElement());
 
   // Pretend that |client| no longer has autofill data available.
-  client.SetCanShowTouchToFill(false);
-  EXPECT_FALSE(frame->TryToShowTouchToFillForFocusedElement());
+  client.SetShouldSuppressKeyboard(false);
+  EXPECT_FALSE(frame->ShouldSuppressKeyboardForFocusedElement());
   frame->SetAutofillClient(nullptr);
 }
 
diff --git a/third_party/blink/renderer/core/frame/local_frame_view.cc b/third_party/blink/renderer/core/frame/local_frame_view.cc
index cd5faa5..4ecbcc2 100644
--- a/third_party/blink/renderer/core/frame/local_frame_view.cc
+++ b/third_party/blink/renderer/core/frame/local_frame_view.cc
@@ -695,8 +695,6 @@
           continue;
         LayoutFromRootObject(*root);
 
-        root->PaintingLayer()->UpdateLayerPositionsAfterLayout();
-
         // We need to ensure that we mark up all layoutObjects up to the
         // LayoutView for paint invalidation. This simplifies our code as we
         // just always do a full tree walk.
@@ -766,7 +764,6 @@
 
   FontCachePurgePreventer font_cache_purge_preventer;
   StyleRetainScope style_retain_scope;
-  bool in_subtree_layout = IsSubtreeLayout();
   {
     base::AutoReset<bool> change_scheduling_enabled(&layout_scheduling_enabled_,
                                                     false);
@@ -779,6 +776,8 @@
       ClearLayoutSubtreeRootsAndMarkContainingBlocks();
     GetLayoutView()->ClearHitTestCache();
 
+    bool in_subtree_layout = IsSubtreeLayout();
+
     // TODO(crbug.com/460956): The notion of a single root for layout is no
     // longer applicable. Remove or update this code.
     if (in_subtree_layout)
@@ -874,8 +873,9 @@
 
   frame_timing_requests_dirty_ = true;
 
-  if (!in_subtree_layout)
-    GetLayoutView()->EnclosingLayer()->UpdateLayerPositionsAfterLayout();
+  // FIXME: Could find the common ancestor layer of all dirty subtrees and
+  // mark from there. crbug.com/462719
+  GetLayoutView()->EnclosingLayer()->UpdateLayerPositionsAfterLayout();
 
   TRACE_EVENT_OBJECT_SNAPSHOT_WITH_ID(
       TRACE_DISABLED_BY_DEFAULT("blink.debug.layout.trees"), "LayoutTree", this,
diff --git a/third_party/blink/renderer/core/frame/visual_viewport.cc b/third_party/blink/renderer/core/frame/visual_viewport.cc
index a07e8e4..824136e 100644
--- a/third_party/blink/renderer/core/frame/visual_viewport.cc
+++ b/third_party/blink/renderer/core/frame/visual_viewport.cc
@@ -131,7 +131,7 @@
         GetChromeClient()->GetDeviceEmulationTransform();
     if (!device_emulation_transform.IsIdentity()) {
       TransformPaintPropertyNode::State state{device_emulation_transform};
-      state.in_subtree_of_page_scale = false;
+      state.flags.in_subtree_of_page_scale = false;
       if (!device_emulation_transform_node_) {
         device_emulation_transform_node_ = TransformPaintPropertyNode::Create(
             *transform_parent, std::move(state));
@@ -157,7 +157,7 @@
     DCHECK(!transform_parent->IsInSubtreeOfPageScale());
 
     TransformPaintPropertyNode::State state;
-    state.in_subtree_of_page_scale = false;
+    state.flags.in_subtree_of_page_scale = false;
     state.compositor_element_id = GetCompositorOverscrollElasticityElementId();
     // TODO(crbug.com/877794) Should create overscroll elasticity transform node
     // based on settings.
@@ -175,7 +175,7 @@
   {
     TransformPaintPropertyNode::State state{
         TransformationMatrix().Scale(Scale())};
-    state.in_subtree_of_page_scale = false;
+    state.flags.in_subtree_of_page_scale = false;
     state.compositor_element_id = GetCompositorElementId();
 
     if (!scale_transform_node_) {
diff --git a/third_party/blink/renderer/core/frame/web_local_frame_impl.cc b/third_party/blink/renderer/core/frame/web_local_frame_impl.cc
index 6a93ae6..15d73b8 100644
--- a/third_party/blink/renderer/core/frame/web_local_frame_impl.cc
+++ b/third_party/blink/renderer/core/frame/web_local_frame_impl.cc
@@ -2491,7 +2491,7 @@
   next_element->focus();
 }
 
-bool WebLocalFrameImpl::TryToShowTouchToFillForFocusedElement() {
+bool WebLocalFrameImpl::ShouldSuppressKeyboardForFocusedElement() {
   if (!autofill_client_)
     return false;
 
@@ -2499,7 +2499,7 @@
   auto* focused_form_control_element = ToHTMLFormControlElementOrNull(
       GetFrame()->GetDocument()->FocusedElement());
   return focused_form_control_element &&
-         autofill_client_->TryToShowTouchToFill(focused_form_control_element);
+         autofill_client_->ShouldSuppressKeyboard(focused_form_control_element);
 }
 
 void WebLocalFrameImpl::PerformMediaPlayerAction(
diff --git a/third_party/blink/renderer/core/frame/web_local_frame_impl.h b/third_party/blink/renderer/core/frame/web_local_frame_impl.h
index bad6072..17f53ee 100644
--- a/third_party/blink/renderer/core/frame/web_local_frame_impl.h
+++ b/third_party/blink/renderer/core/frame/web_local_frame_impl.h
@@ -304,7 +304,7 @@
                             WebString& clip_html,
                             WebRect& clip_rect) override;
   void AdvanceFocusInForm(WebFocusType) override;
-  bool TryToShowTouchToFillForFocusedElement() override;
+  bool ShouldSuppressKeyboardForFocusedElement() override;
   void PerformMediaPlayerAction(const WebPoint&,
                                 const WebMediaPlayerAction&) override;
   void OnPortalActivated(const base::UnguessableToken& portal_token,
diff --git a/third_party/blink/renderer/core/paint/image_paint_timing_detector.cc b/third_party/blink/renderer/core/paint/image_paint_timing_detector.cc
index af391d77..a94e6abe 100644
--- a/third_party/blink/renderer/core/paint/image_paint_timing_detector.cc
+++ b/third_party/blink/renderer/core/paint/image_paint_timing_detector.cc
@@ -60,10 +60,10 @@
   return a->insertion_index < b->insertion_index;
 }
 
-ImagePaintTimingDetector::ImagePaintTimingDetector(LocalFrameView* frame_view)
-    : frame_view_(frame_view),
-      callback_manager_(
-          MakeGarbageCollected<PaintTimingCallbackManagerImpl>()) {}
+ImagePaintTimingDetector::ImagePaintTimingDetector(
+    LocalFrameView* frame_view,
+    PaintTimingCallbackManager* callback_manager)
+    : frame_view_(frame_view), callback_manager_(callback_manager) {}
 
 void ImagePaintTimingDetector::PopulateTraceValue(
     TracedValue& value,
@@ -171,22 +171,15 @@
 }
 
 void ImagePaintTimingDetector::RegisterNotifySwapTime() {
-  auto callback = CrossThreadBindOnce(&ImagePaintTimingDetector::ReportSwapTime,
-                                      WrapCrossThreadWeakPersistent(this),
-                                      last_registered_frame_index_);
-  // ReportSwapTime on layerTreeView will queue a swap-promise, the callback is
-  // called when the swap for current render frame completes or fails to happen.
-  LocalFrame& frame = frame_view_->GetFrame();
-  if (!frame.GetPage())
-    return;
-
-  callback_manager_->RegisterCallback(frame, std::move(callback));
+  auto callback = WTF::Bind(&ImagePaintTimingDetector::ReportSwapTime,
+                            WrapCrossThreadWeakPersistent(this),
+                            last_registered_frame_index_);
+  callback_manager_->RegisterCallback(std::move(callback));
   num_pending_swap_callbacks_++;
 }
 
 void ImagePaintTimingDetector::ReportSwapTime(
     unsigned last_queued_frame_index,
-    WebWidgetClient::SwapResult result,
     base::TimeTicks timestamp) {
   if (!is_recording_)
     return;
diff --git a/third_party/blink/renderer/core/paint/image_paint_timing_detector.h b/third_party/blink/renderer/core/paint/image_paint_timing_detector.h
index 7dac666..7f0894b 100644
--- a/third_party/blink/renderer/core/paint/image_paint_timing_detector.h
+++ b/third_party/blink/renderer/core/paint/image_paint_timing_detector.h
@@ -203,7 +203,7 @@
   friend class ImagePaintTimingDetectorTest;
 
  public:
-  ImagePaintTimingDetector(LocalFrameView*);
+  ImagePaintTimingDetector(LocalFrameView*, PaintTimingCallbackManager*);
   void RecordImage(const LayoutObject&,
                    const IntSize& intrinsic_size,
                    const ImageResourceContent&,
@@ -222,6 +222,10 @@
   inline bool FinishedReportingImages() const {
     return !is_recording_ && num_pending_swap_callbacks_ == 0;
   }
+  void ResetCallbackManager(PaintTimingCallbackManager* manager) {
+    callback_manager_ = manager;
+  }
+  void ReportSwapTime(unsigned last_queued_frame_index, base::TimeTicks);
 
   void Trace(blink::Visitor*);
 
@@ -231,13 +235,6 @@
   ImageRecord* FindLargestPaintCandidate() const;
 
   void PopulateTraceValue(TracedValue&, const ImageRecord& first_image_paint);
-  // This is provided for unit test to force invoking swap promise callback.
-  void ReportSwapTime(unsigned last_queued_frame_index,
-                      WebWidgetClient::SwapResult,
-                      base::TimeTicks);
-  void ResetCallbackManagerForTesting(PaintTimingCallbackManager* manager) {
-    callback_manager_ = manager;
-  }
   void RegisterNotifySwapTime();
   void ReportCandidateToTrace(ImageRecord&);
   void ReportNoCandidateToTrace();
diff --git a/third_party/blink/renderer/core/paint/image_paint_timing_detector_test.cc b/third_party/blink/renderer/core/paint/image_paint_timing_detector_test.cc
index f923dab..99c2aab 100644
--- a/third_party/blink/renderer/core/paint/image_paint_timing_detector_test.cc
+++ b/third_party/blink/renderer/core/paint/image_paint_timing_detector_test.cc
@@ -176,7 +176,7 @@
         MakeGarbageCollected<MockPaintTimingCallbackManager>();
     GetPaintTimingDetector()
         .GetImagePaintTimingDetector()
-        ->ResetCallbackManagerForTesting(mock_callback_manager_);
+        ->ResetCallbackManager(mock_callback_manager_);
     UpdateAllLifecyclePhases();
   }
 
@@ -188,7 +188,7 @@
         MakeGarbageCollected<MockPaintTimingCallbackManager>();
     GetChildPaintTimingDetector()
         .GetImagePaintTimingDetector()
-        ->ResetCallbackManagerForTesting(child_mock_callback_manager_);
+        ->ResetCallbackManager(child_mock_callback_manager_);
     UpdateAllLifecyclePhases();
   }
 
@@ -263,7 +263,7 @@
     return original_image_resource;
   }
 
-  CallbackQueue callback_queue_;
+  PaintTimingCallbackManager::CallbackQueue callback_queue_;
   Persistent<MockPaintTimingCallbackManager> mock_callback_manager_;
   Persistent<MockPaintTimingCallbackManager> child_mock_callback_manager_;
 };
diff --git a/third_party/blink/renderer/core/paint/largest_contentful_paint_calculator_test.cc b/third_party/blink/renderer/core/paint/largest_contentful_paint_calculator_test.cc
index 62108861..f43b595 100644
--- a/third_party/blink/renderer/core/paint/largest_contentful_paint_calculator_test.cc
+++ b/third_party/blink/renderer/core/paint/largest_contentful_paint_calculator_test.cc
@@ -26,11 +26,11 @@
 
     mock_text_callback_manager_ =
         MakeGarbageCollected<MockPaintTimingCallbackManager>();
-    GetTextPaintTimingDetector()->ResetCallbackManagerForTesting(
+    GetTextPaintTimingDetector()->ResetCallbackManager(
         mock_text_callback_manager_);
     mock_image_callback_manager_ =
         MakeGarbageCollected<MockPaintTimingCallbackManager>();
-    GetImagePaintTimingDetector()->ResetCallbackManagerForTesting(
+    GetImagePaintTimingDetector()->ResetCallbackManager(
         mock_image_callback_manager_);
   }
 
diff --git a/third_party/blink/renderer/core/paint/paint_property_tree_builder.cc b/third_party/blink/renderer/core/paint/paint_property_tree_builder.cc
index aeae43ac..dae96c44 100644
--- a/third_party/blink/renderer/core/paint/paint_property_tree_builder.cc
+++ b/third_party/blink/renderer/core/paint/paint_property_tree_builder.cc
@@ -482,9 +482,9 @@
   if (paint_offset_translation) {
     TransformPaintPropertyNode::State state{
         FloatSize(ToIntSize(*paint_offset_translation))};
-    state.flattens_inherited_transform =
+    state.flags.flattens_inherited_transform =
         context_.current.should_flatten_inherited_transform;
-    state.affected_by_outer_viewport_bounds_delta =
+    state.flags.affected_by_outer_viewport_bounds_delta =
         IsAffectedByOuterViewportBoundsDelta();
     state.direct_compositing_reasons =
         full_context_.direct_compositing_reasons &
@@ -747,13 +747,13 @@
           // animations. This is currently a cyclic dependency but we could
           // calculate most of the compositable animation reasons up front to
           // only consider animations which are candidates for compositing.
-          state.animation_is_axis_aligned =
+          state.flags.animation_is_axis_aligned =
               ActiveTransformAnimationIsAxisAligned(
                   object_, full_context_.direct_compositing_reasons);
         }
       }
 
-      state.flattens_inherited_transform =
+      state.flags.flattens_inherited_transform =
           context_.current.should_flatten_inherited_transform;
 
       if (RuntimeEnabledFeatures::CompositeAfterPaintEnabled() ||
@@ -1690,7 +1690,7 @@
               TransformationMatrix().ApplyPerspective(style.Perspective()),
               PerspectiveOrigin(ToLayoutBox(object_)) +
                   FloatSize(context_.current.paint_offset))};
-      state.flattens_inherited_transform =
+      state.flags.flattens_inherited_transform =
           context_.current.should_flatten_inherited_transform;
       if (RuntimeEnabledFeatures::CompositeAfterPaintEnabled() ||
           RuntimeEnabledFeatures::BlinkGenPropertyTreesEnabled())
@@ -1756,7 +1756,7 @@
     if (!content_to_parent_space.IsIdentity()) {
       TransformPaintPropertyNode::State state{
           TransformationMatrix(content_to_parent_space)};
-      state.flattens_inherited_transform =
+      state.flags.flattens_inherited_transform =
           context_.current.should_flatten_inherited_transform;
       OnUpdate(properties_->UpdateReplacedContentTransform(
           *context_.current.transform, std::move(state)));
@@ -1947,7 +1947,7 @@
       FloatPoint scroll_position = FloatPoint(box.ScrollOrigin()) +
                                    box.GetScrollableArea()->GetScrollOffset();
       TransformPaintPropertyNode::State state{-ToFloatSize(scroll_position)};
-      state.flattens_inherited_transform =
+      state.flags.flattens_inherited_transform =
           context_.current.should_flatten_inherited_transform;
       state.direct_compositing_reasons =
           full_context_.direct_compositing_reasons &
diff --git a/third_party/blink/renderer/core/paint/paint_timing_detector.cc b/third_party/blink/renderer/core/paint/paint_timing_detector.cc
index 6ccfd00..9385ee0 100644
--- a/third_party/blink/renderer/core/paint/paint_timing_detector.cc
+++ b/third_party/blink/renderer/core/paint/paint_timing_detector.cc
@@ -28,6 +28,7 @@
 #include "third_party/blink/renderer/platform/graphics/paint/property_tree_state.h"
 #include "third_party/blink/renderer/platform/graphics/paint/scoped_paint_chunk_properties.h"
 #include "third_party/blink/renderer/platform/wtf/cross_thread_functional.h"
+#include "third_party/blink/renderer/platform/wtf/functional.h"
 
 namespace blink {
 
@@ -59,9 +60,18 @@
 PaintTimingDetector::PaintTimingDetector(LocalFrameView* frame_view)
     : frame_view_(frame_view),
       text_paint_timing_detector_(
-          MakeGarbageCollected<TextPaintTimingDetector>(frame_view, this)),
+          MakeGarbageCollected<TextPaintTimingDetector>(frame_view,
+                                                        this,
+                                                        nullptr /*set later*/)),
       image_paint_timing_detector_(
-          MakeGarbageCollected<ImagePaintTimingDetector>(frame_view)) {}
+          MakeGarbageCollected<ImagePaintTimingDetector>(
+              frame_view,
+              nullptr /*set later*/)),
+      callback_manager_(
+          MakeGarbageCollected<PaintTimingCallbackManagerImpl>(frame_view)) {
+  text_paint_timing_detector_->ResetCallbackManager(callback_manager_.Get());
+  image_paint_timing_detector_->ResetCallbackManager(callback_manager_.Get());
+}
 
 void PaintTimingDetector::NotifyPaintFinished() {
   if (text_paint_timing_detector_) {
@@ -76,6 +86,8 @@
     if (image_paint_timing_detector_->FinishedReportingImages())
       image_paint_timing_detector_ = nullptr;
   }
+  if (callback_manager_->CountCallbacks() > 0)
+    callback_manager_->RegisterPaintTimeCallbackForCombinedCallbacks();
 }
 
 // static
@@ -328,12 +340,42 @@
   visitor->Trace(image_paint_timing_detector_);
   visitor->Trace(frame_view_);
   visitor->Trace(largest_contentful_paint_calculator_);
+  visitor->Trace(callback_manager_);
 }
 
-void PaintTimingCallbackManagerImpl::RegisterCallback(
-    LocalFrame& frame,
-    ReportTimeCallback callback) {
-  frame.GetPage()->GetChromeClient().NotifySwapTime(frame, std::move(callback));
+void PaintTimingCallbackManagerImpl::
+    RegisterPaintTimeCallbackForCombinedCallbacks() {
+  DCHECK(!frame_callbacks_->empty());
+  LocalFrame& frame = frame_view_->GetFrame();
+  if (!frame.GetPage())
+    return;
+
+  auto combined_callback = CrossThreadBindOnce(
+      &PaintTimingCallbackManagerImpl::ReportPaintTime,
+      WrapCrossThreadWeakPersistent(this), std::move(frame_callbacks_));
+  frame_callbacks_ =
+      std::make_unique<PaintTimingCallbackManager::CallbackQueue>();
+
+  // |ReportPaintTime| on |layerTreeView| will queue a swap-promise, the
+  // callback is called when the swap for current render frame completes or
+  // fails to happen.
+  frame.GetPage()->GetChromeClient().NotifySwapTime(
+      frame, std::move(combined_callback));
+}
+
+void PaintTimingCallbackManagerImpl::ReportPaintTime(
+    std::unique_ptr<PaintTimingCallbackManager::CallbackQueue> frame_callbacks,
+    WebWidgetClient::SwapResult result,
+    base::TimeTicks paint_time) {
+  while (!frame_callbacks->empty()) {
+    std::move(frame_callbacks->front()).Run(paint_time);
+    frame_callbacks->pop();
+  }
+}
+
+void PaintTimingCallbackManagerImpl::Trace(Visitor* visitor) {
+  visitor->Trace(frame_view_);
+  PaintTimingCallbackManager::Trace(visitor);
 }
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/paint/paint_timing_detector.h b/third_party/blink/renderer/core/paint/paint_timing_detector.h
index 3cd50468..269d629 100644
--- a/third_party/blink/renderer/core/paint/paint_timing_detector.h
+++ b/third_party/blink/renderer/core/paint/paint_timing_detector.h
@@ -25,9 +25,6 @@
 class TextPaintTimingDetector;
 struct WebFloatRect;
 
-using ReportTimeCallback =
-    WTF::CrossThreadOnceFunction<void(WebWidgetClient::SwapResult,
-                                      base::TimeTicks)>;
 // |PaintTimingCallbackManager| is an interface between
 // |ImagePaintTimingDetector|/|TextPaintTimingDetector| and |ChromeClient|.
 // As |ChromeClient| is shared among the paint-timing-detecters, it
@@ -39,21 +36,71 @@
 // without having to popping the |TextPaintTimingDetector|'s.
 class PaintTimingCallbackManager : public GarbageCollectedMixin {
  public:
-  virtual void RegisterCallback(LocalFrame&, ReportTimeCallback) = 0;
+  using LocalThreadCallback = base::OnceCallback<void(base::TimeTicks)>;
+  using CallbackQueue = std::queue<LocalThreadCallback>;
+
+  virtual void RegisterCallback(
+      PaintTimingCallbackManager::LocalThreadCallback) = 0;
 };
 
-using ReportTimeCallback =
-    WTF::CrossThreadOnceFunction<void(WebWidgetClient::SwapResult,
-                                      base::TimeTicks)>;
-
-class PaintTimingCallbackManagerImpl
-    : public GarbageCollected<PaintTimingCallbackManagerImpl>,
+// This class is responsible for managing the swap-time callback for Largest
+// Image Paint and Largest Text Paint. In frames where both text and image are
+// painted, Largest Image Paint and Largest Text Paint need to assign the same
+// paint-time for their records. In this case, |PaintTimeCallbackManager|
+// requests a swap-time callback and share the swap-time with LIP and LTP.
+// Otherwise LIP and LTP would have to request their own swap-time callbacks.
+// An extra benefit of this design is that |LargestContentfulPaintCalculator|
+// can thus hook to the end of the LIP and LTP's record assignments.
+//
+// |GarbageCollectedFinalized| inheritance is required by the swap-time callback
+// registration.
+class PaintTimingCallbackManagerImpl final
+    : public GarbageCollectedFinalized<PaintTimingCallbackManagerImpl>,
       public PaintTimingCallbackManager {
   USING_GARBAGE_COLLECTED_MIXIN(PaintTimingCallbackManagerImpl);
 
  public:
-  void RegisterCallback(LocalFrame&, ReportTimeCallback) override;
-  void Trace(Visitor* visitor) override {}
+  PaintTimingCallbackManagerImpl(LocalFrameView* frame_view)
+      : frame_view_(frame_view),
+        frame_callbacks_(
+            std::make_unique<std::queue<
+                PaintTimingCallbackManager::LocalThreadCallback>>()) {}
+  ~PaintTimingCallbackManagerImpl() { frame_callbacks_.reset(); }
+
+  // Instead of registering the callback right away, this impl of the interface
+  // combine the callback into |frame_callbacks_| before registering a separate
+  // swap-time callback for the combined callbacks. When the swap-time callback
+  // is invoked, the swap-time is then assigned to each callback of
+  // |frame_callbacks_|.
+  void RegisterCallback(
+      PaintTimingCallbackManager::LocalThreadCallback callback) override {
+    frame_callbacks_->push(std::move(callback));
+  }
+
+  void RegisterPaintTimeCallbackForCombinedCallbacks();
+
+  inline size_t CountCallbacks() { return frame_callbacks_->size(); }
+
+  void ReportPaintTime(
+      std::unique_ptr<std::queue<
+          PaintTimingCallbackManager::LocalThreadCallback>> frame_callbacks,
+      WebWidgetClient::SwapResult,
+      base::TimeTicks paint_time);
+
+  void Trace(Visitor* visitor) override;
+
+ private:
+  Member<LocalFrameView> frame_view_;
+  // |frame_callbacks_| stores the callbacks of |TextPaintTimingDetector| and
+  // |ImagePaintTimingDetector| in an (animated) frame. It is passed as an
+  // argument of a swap-time callback which once is invoked, invokes every
+  // callback in |frame_callbacks_|. This hierarchical callback design is to
+  // reduce the need of calling ChromeClient to register swap-time callbacks for
+  // both detectos.
+  // Although |frame_callbacks_| intends to store callbacks
+  // of a frame, it occasionally has to do that for more than one frame, when it
+  // fails to register a swap-time callback.
+  std::unique_ptr<PaintTimingCallbackManager::CallbackQueue> frame_callbacks_;
 };
 
 // PaintTimingDetector contains some of paint metric detectors,
@@ -137,6 +184,8 @@
 
   Member<LargestContentfulPaintCalculator> largest_contentful_paint_calculator_;
 
+  Member<PaintTimingCallbackManagerImpl> callback_manager_;
+
   // Largest image information.
   base::TimeTicks largest_image_paint_time_;
   uint64_t largest_image_paint_size_ = 0;
diff --git a/third_party/blink/renderer/core/paint/paint_timing_test_helper.h b/third_party/blink/renderer/core/paint/paint_timing_test_helper.h
index 7817bca..8d1dfb2 100644
--- a/third_party/blink/renderer/core/paint/paint_timing_test_helper.h
+++ b/third_party/blink/renderer/core/paint/paint_timing_test_helper.h
@@ -4,7 +4,6 @@
 #include "third_party/blink/renderer/core/paint/paint_timing_detector.h"
 namespace blink {
 
-using CallbackQueue = std::queue<WebWidgetClient::ReportTimeCallback>;
 // |MockPaintTimingCallbackManager| is used to mock
 // |ChromeClient::NotifySwapTime()|'s swap-time queueing and invoking for
 // unit-tests. Find more details in |PaintTimingCallbackManager|.
@@ -15,14 +14,13 @@
 
  public:
   ~MockPaintTimingCallbackManager() {}
-  void RegisterCallback(LocalFrame& frame,
-                        ReportTimeCallback callback) override {
-    callback_queue_.push(ConvertToBaseOnceCallback(std::move(callback)));
+  void RegisterCallback(
+      PaintTimingCallbackManager::LocalThreadCallback callback) override {
+    callback_queue_.push(std::move(callback));
   }
   void InvokeSwapTimeCallback(base::TimeTicks swap_time) {
     DCHECK_GT(callback_queue_.size(), 0UL);
-    std::move(callback_queue_.front())
-        .Run(WebWidgetClient::SwapResult::kDidSwap, swap_time);
+    std::move(callback_queue_.front()).Run(swap_time);
     callback_queue_.pop();
   }
 
@@ -31,7 +29,7 @@
   void Trace(Visitor* visitor) override {}
 
  private:
-  CallbackQueue callback_queue_;
+  PaintTimingCallbackManager::CallbackQueue callback_queue_;
 };
 }  // namespace blink
 
diff --git a/third_party/blink/renderer/core/paint/text_paint_timing_detector.cc b/third_party/blink/renderer/core/paint/text_paint_timing_detector.cc
index dc996c3..390ea30 100644
--- a/third_party/blink/renderer/core/paint/text_paint_timing_detector.cc
+++ b/third_party/blink/renderer/core/paint/text_paint_timing_detector.cc
@@ -33,9 +33,10 @@
 
 TextPaintTimingDetector::TextPaintTimingDetector(
     LocalFrameView* frame_view,
-    PaintTimingDetector* paint_timing_detector)
+    PaintTimingDetector* paint_timing_detector,
+    PaintTimingCallbackManager* callback_manager)
     : records_manager_(frame_view, paint_timing_detector),
-      callback_manager_(MakeGarbageCollected<PaintTimingCallbackManagerImpl>()),
+      callback_manager_(callback_manager),
       frame_view_(frame_view) {}
 
 void LargestTextPaintManager::PopulateTraceValue(
@@ -110,9 +111,8 @@
     if (!awaiting_swap_promise_) {
       // |WrapCrossThreadWeakPersistent| guarantees that when |this| is killed,
       // the callback function will not be invoked.
-      RegisterNotifySwapTime(
-          CrossThreadBindOnce(&TextPaintTimingDetector::ReportSwapTime,
-                              WrapCrossThreadWeakPersistent(this)));
+      RegisterNotifySwapTime(WTF::Bind(&TextPaintTimingDetector::ReportSwapTime,
+                                       WrapCrossThreadWeakPersistent(this)));
     }
   }
 }
@@ -131,18 +131,12 @@
 }
 
 void TextPaintTimingDetector::RegisterNotifySwapTime(
-    ReportTimeCallback callback) {
-  // ReportSwapTime on layerTreeView will queue a swap-promise, the callback is
-  // called when the swap for current render frame completes or fails to happen.
-  LocalFrame& frame = frame_view_->GetFrame();
-  if (!frame.GetPage())
-    return;
-  callback_manager_->RegisterCallback(frame, std::move(callback));
+    PaintTimingCallbackManager::LocalThreadCallback callback) {
+  callback_manager_->RegisterCallback(std::move(callback));
   awaiting_swap_promise_ = true;
 }
 
-void TextPaintTimingDetector::ReportSwapTime(WebWidgetClient::SwapResult result,
-                                             base::TimeTicks timestamp) {
+void TextPaintTimingDetector::ReportSwapTime(base::TimeTicks timestamp) {
   if (!is_recording_)
     return;
   if (!records_manager_.HasTextElementTiming()) {
diff --git a/third_party/blink/renderer/core/paint/text_paint_timing_detector.h b/third_party/blink/renderer/core/paint/text_paint_timing_detector.h
index f441637..149c826 100644
--- a/third_party/blink/renderer/core/paint/text_paint_timing_detector.h
+++ b/third_party/blink/renderer/core/paint/text_paint_timing_detector.h
@@ -193,13 +193,12 @@
 // https://docs.google.com/document/d/1DRVd4a2VU8-yyWftgOparZF-sf16daf0vfbsHuz2rws/edit#heading=h.lvno2v283uls
 class CORE_EXPORT TextPaintTimingDetector final
     : public GarbageCollectedFinalized<TextPaintTimingDetector> {
-  using ReportTimeCallback =
-      WTF::CrossThreadOnceFunction<void(WebWidgetClient::SwapResult,
-                                        base::TimeTicks)>;
   friend class TextPaintTimingDetectorTest;
 
  public:
-  explicit TextPaintTimingDetector(LocalFrameView*, PaintTimingDetector*);
+  explicit TextPaintTimingDetector(LocalFrameView*,
+                                   PaintTimingDetector*,
+                                   PaintTimingCallbackManager*);
   bool ShouldWalkObject(const LayoutBoxModelObject&) const;
   void RecordAggregatedText(const LayoutBoxModelObject& aggregator,
                             const IntRect& aggregated_visual_rect,
@@ -210,17 +209,17 @@
   void StopRecordingLargestTextPaint();
   bool IsRecording() const { return is_recording_; }
   inline bool FinishedReportingText() const { return !is_recording_; }
+  void ResetCallbackManager(PaintTimingCallbackManager* manager) {
+    callback_manager_ = manager;
+  }
+  void ReportSwapTime(base::TimeTicks timestamp);
   void Trace(blink::Visitor*);
 
  private:
   friend class LargestContentfulPaintCalculatorTest;
 
-  void ReportSwapTime(WebWidgetClient::SwapResult result,
-                      base::TimeTicks timestamp);
-  void RegisterNotifySwapTime(ReportTimeCallback callback);
-  void ResetCallbackManagerForTesting(PaintTimingCallbackManager* manager) {
-    callback_manager_ = manager;
-  }
+  void RegisterNotifySwapTime(
+      PaintTimingCallbackManager::LocalThreadCallback callback);
 
   TextRecordsManager records_manager_;
 
diff --git a/third_party/blink/renderer/core/paint/text_paint_timing_detector_test.cc b/third_party/blink/renderer/core/paint/text_paint_timing_detector_test.cc
index 0219171..b3171ed 100644
--- a/third_party/blink/renderer/core/paint/text_paint_timing_detector_test.cc
+++ b/third_party/blink/renderer/core/paint/text_paint_timing_detector_test.cc
@@ -138,8 +138,7 @@
         KURL("http://test.com"));
     mock_callback_manager_ =
         MakeGarbageCollected<MockPaintTimingCallbackManager>();
-    GetTextPaintTimingDetector()->ResetCallbackManagerForTesting(
-        mock_callback_manager_);
+    GetTextPaintTimingDetector()->ResetCallbackManager(mock_callback_manager_);
     UpdateAllLifecyclePhases();
   }
 
@@ -149,7 +148,7 @@
                                                        ASSERT_NO_EXCEPTION);
     child_frame_mock_callback_manager_ =
         MakeGarbageCollected<MockPaintTimingCallbackManager>();
-    GetChildFrameTextPaintTimingDetector()->ResetCallbackManagerForTesting(
+    GetChildFrameTextPaintTimingDetector()->ResetCallbackManager(
         child_frame_mock_callback_manager_);
     UpdateAllLifecyclePhases();
   }
diff --git a/third_party/blink/renderer/core/workers/worker_global_scope.cc b/third_party/blink/renderer/core/workers/worker_global_scope.cc
index 650f293..42fdc3c 100644
--- a/third_party/blink/renderer/core/workers/worker_global_scope.cc
+++ b/third_party/blink/renderer/core/workers/worker_global_scope.cc
@@ -526,10 +526,10 @@
 }
 
 void WorkerGlobalScope::RemoveURLFromMemoryCache(const KURL& url) {
+  // MemoryCache can be accessed only from the main thread.
   PostCrossThreadTask(
-      *thread_->GetParentExecutionContextTaskRunners()->Get(
-          TaskType::kNetworking),
-      FROM_HERE, CrossThreadBindOnce(&RemoveURLFromMemoryCacheInternal, url));
+      *Thread::MainThread()->GetTaskRunner(), FROM_HERE,
+      CrossThreadBindOnce(&RemoveURLFromMemoryCacheInternal, url));
 }
 
 NOINLINE void WorkerGlobalScope::InitializeURL(const KURL& url) {
diff --git a/third_party/blink/renderer/devtools/front_end/inspector_main/RenderingOptions.js b/third_party/blink/renderer/devtools/front_end/inspector_main/RenderingOptions.js
index 596acee1..42c7c8e0 100644
--- a/third_party/blink/renderer/devtools/front_end/inspector_main/RenderingOptions.js
+++ b/third_party/blink/renderer/devtools/front_end/inspector_main/RenderingOptions.js
@@ -34,41 +34,42 @@
     this.registerRequiredCSS('inspector_main/renderingOptions.css');
 
     this._appendCheckbox(
-        Common.UIString('Paint flashing'),
-        Common.UIString('Highlights areas of the page (green) that need to be repainted'),
+        ls`Paint flashing`,
+        ls
+        `Highlights areas of the page (green) that need to be repainted. May not be suitable for people prone to photosensitive epilepsy.`,
         Common.moduleSetting('showPaintRects'));
     this._appendCheckbox(
-        Common.UIString('Layout Shift Regions'),
-        Common.UIString('Highlights areas of the page (blue) that were shifted'),
+        ls`Layout Shift Regions`,
+        ls
+        `Highlights areas of the page (blue) that were shifted. May not be suitable for people prone to photosensitive epilepsy.`,
         Common.moduleSetting('showLayoutShiftRegions'));
+        this._appendCheckbox(
+            ls`Layer borders`, ls`Shows layer borders (orange/olive) and tiles (cyan).`,
+            Common.moduleSetting('showDebugBorders'));
+        this._appendCheckbox(
+            ls`FPS meter`, ls`Plots frames per second, frame rate distribution, and GPU memory.`,
+            Common.moduleSetting('showFPSCounter'));
     this._appendCheckbox(
-        Common.UIString('Layer borders'), Common.UIString('Shows layer borders (orange/olive) and tiles (cyan)'),
-        Common.moduleSetting('showDebugBorders'));
-    this._appendCheckbox(
-        Common.UIString('FPS meter'),
-        Common.UIString('Plots frames per second, frame rate distribution, and GPU memory'),
-        Common.moduleSetting('showFPSCounter'));
-    this._appendCheckbox(
-        Common.UIString('Scrolling performance issues'),
-        Common.UIString(
-            'Highlights elements (teal) that can slow down scrolling, including touch & wheel event handlers and other main-thread scrolling situations.'),
+        ls`Scrolling performance issues`,
+        ls
+        `Highlights elements (teal) that can slow down scrolling, including touch & wheel event handlers and other main-thread scrolling situations.`,
         Common.moduleSetting('showScrollBottleneckRects'));
-    this._appendCheckbox(
-        Common.UIString('Highlight ad frames'), Common.UIString('Highlights frames (red) detected to be ads.'),
-        Common.moduleSetting('showAdHighlights'));
-    this._appendCheckbox(
-        Common.UIString('Hit-test borders'), Common.UIString('Shows borders around hit-test regions'),
-        Common.moduleSetting('showHitTestBorders'));
-    this.contentElement.createChild('div').classList.add('panel-section-separator');
+        this._appendCheckbox(
+            ls`Highlight ad frames`, ls`Highlights frames (red) detected to be ads.`,
+            Common.moduleSetting('showAdHighlights'));
+        this._appendCheckbox(
+            ls`Hit-test borders`, ls`Shows borders around hit-test regions.`,
+            Common.moduleSetting('showHitTestBorders'));
+        this.contentElement.createChild('div').classList.add('panel-section-separator');
 
-    const mediaSetting = Common.moduleSetting('emulatedCSSMedia');
-    const mediaSelect = UI.SettingsUI.createControlForSetting(mediaSetting);
-    if (mediaSelect) {
-      const mediaRow = this.contentElement.createChild('span', 'media-row');
-      mediaRow.createChild('label').textContent = Common.UIString('Emulate CSS media');
-      mediaRow.createChild('p').textContent = Common.UIString('Forces media type for testing print and screen styles');
-      mediaRow.appendChild(mediaSelect);
-    }
+        const mediaSetting = Common.moduleSetting('emulatedCSSMedia');
+        const mediaSelect = UI.SettingsUI.createControlForSetting(mediaSetting);
+        if (mediaSelect) {
+          const mediaRow = this.contentElement.createChild('span', 'media-row');
+          mediaRow.createChild('label').textContent = ls`Emulate CSS media`;
+          mediaRow.createChild('p').textContent = ls`Forces media type for testing print and screen styles.`;
+          mediaRow.appendChild(mediaSelect);
+        }
   }
 
   /**
diff --git a/third_party/blink/renderer/devtools/front_end/inspector_main/inspector_main_strings.grdp b/third_party/blink/renderer/devtools/front_end/inspector_main/inspector_main_strings.grdp
index 0b6428b..8a40cad9 100644
--- a/third_party/blink/renderer/devtools/front_end/inspector_main/inspector_main_strings.grdp
+++ b/third_party/blink/renderer/devtools/front_end/inspector_main/inspector_main_strings.grdp
@@ -1,5 +1,8 @@
 <?xml version="1.0" encoding="utf-8"?>
 <grit-part>
+  <message name="IDS_DEVTOOLS_035f93937dfd06c795a75877c9e6ddeb" desc="">
+    Plots frames per second, frame rate distribution, and GPU memory.
+  </message>
   <message name="IDS_DEVTOOLS_099969ccad146161b304e766f9a1fe56" desc="Title of a setting under the Network category that can be invoked through the Command Menu">
     Show ads on this site, if allowed
   </message>
@@ -12,23 +15,20 @@
   <message name="IDS_DEVTOOLS_0ef16a6645018dec4609e392c7e9bda1" desc="Title of a setting under the DevTools category that can be invoked through the Command Menu">
     Do not auto-open DevTools for popups
   </message>
-  <message name="IDS_DEVTOOLS_115c68d941dcba0167cee3483c1bbbb2" desc="Text in Rendering Options">
-    Shows layer borders (orange/olive) and tiles (cyan)
-  </message>
   <message name="IDS_DEVTOOLS_1808fb32cf4e8a03daa326b48d4246eb" desc="Title of a setting under the Appearance category in Settings">
     Disable paused state overlay
   </message>
   <message name="IDS_DEVTOOLS_1e7cf45a622bb0fe494f9e4da1016982" desc="Text in Rendering Options">
     Layout Shift Regions
   </message>
-  <message name="IDS_DEVTOOLS_2b1a578586beb46008e1542e9283ad99" desc="Text in Rendering Options">
+  <message name="IDS_DEVTOOLS_2b1a578586beb46008e1542e9283ad99" desc="">
     Scrolling performance issues
   </message>
-  <message name="IDS_DEVTOOLS_417316246f12b8235535182cc9eebe45" desc="Text in Rendering Options">
-    Forces media type for testing print and screen styles
+  <message name="IDS_DEVTOOLS_36bec95bf12fb795a5a100251f0cc421" desc="">
+    Shows layer borders (orange/olive) and tiles (cyan).
   </message>
-  <message name="IDS_DEVTOOLS_441e4ae4f15d6bdee7939aa9bfd61010" desc="Text in Rendering Options">
-    Plots frames per second, frame rate distribution, and GPU memory
+  <message name="IDS_DEVTOOLS_43f244627bf87f76a0dee86f364df473" desc="">
+    Highlights areas of the page (blue) that were shifted. May not be suitable for people prone to photosensitive epilepsy.
   </message>
   <message name="IDS_DEVTOOLS_482a4dca0bbd8fcdda5acc6f95f3c279" desc="A title of the 'DevTools' setting category">
     DevTools
@@ -36,12 +36,12 @@
   <message name="IDS_DEVTOOLS_53f2f05226edcd77bd4351cb27d07ba8" desc="Text in Rendering Options">
     Highlights frames (red) detected to be ads.
   </message>
+  <message name="IDS_DEVTOOLS_6526f858ca97d80241dacb00b40504bb" desc="">
+    Shows borders around hit-test regions.
+  </message>
   <message name="IDS_DEVTOOLS_6eac03f446434baa29ece59d88410812" desc="Text in Rendering Options">
     FPS meter
   </message>
-  <message name="IDS_DEVTOOLS_6f762270888a17bde49797355db7a410" desc="Text in Rendering Options">
-    Shows borders around hit-test regions
-  </message>
   <message name="IDS_DEVTOOLS_7962fd6013e985379fd3a4964d769703" desc="Text in Rendering Options">
     Hit-test borders
   </message>
@@ -66,9 +66,6 @@
   <message name="IDS_DEVTOOLS_886f598a8a9e6a4bfe0c09fcf7779611" desc="Title of a setting under the DevTools category that can be invoked through the Command Menu">
     Emulate a focused page
   </message>
-  <message name="IDS_DEVTOOLS_901fd018d4023042914dedd5fee7f0d6" desc="Text in Rendering Options">
-    Highlights areas of the page (blue) that were shifted
-  </message>
   <message name="IDS_DEVTOOLS_9182eda0635ccdc88276ba9e013c5c1b" desc="Title of a setting under the DevTools category that can be invoked through the Command Menu">
     Do not emulate a focused page
   </message>
@@ -81,12 +78,18 @@
   <message name="IDS_DEVTOOLS_a15932c4dfbbcbc1ac6f5c27c6fa530f" desc="Text in Rendering Options">
     Highlights elements (teal) that can slow down scrolling, including touch &amp; wheel event handlers and other main-thread scrolling situations.
   </message>
+  <message name="IDS_DEVTOOLS_a4c766a2e6eb33e7575331b6affd9778" desc="">
+    Highlights areas of the page (green) that need to be repainted. May not be suitable for people prone to photosensitive epilepsy.
+  </message>
   <message name="IDS_DEVTOOLS_a6e8f9aed2ac6481dc25a18a33342d03" desc="Title of the 'Rendering' tool in the bottom drawer">
     Rendering
   </message>
   <message name="IDS_DEVTOOLS_cb835af5f855f79e8611dd3f8fec6aac" desc="Title of an action in the inspector main tool to reload">
     Reload page
   </message>
+  <message name="IDS_DEVTOOLS_d013165b46f5c1f0f780ea3fc92c04f1" desc="">
+    Forces media type for testing print and screen styles.
+  </message>
   <message name="IDS_DEVTOOLS_d543dbe64db0c952d6e13c9519218b3e" desc="Title of an action in the inspector main tool to hard reload">
     Hard reload page
   </message>
@@ -96,7 +99,4 @@
   <message name="IDS_DEVTOOLS_f23c9ba06e7123f0b4c906de90fbcc9f" desc="Title of a setting under the DevTools category that can be invoked through the Command Menu">
     Auto-open DevTools for popups
   </message>
-  <message name="IDS_DEVTOOLS_f6b139a6b392ab11c9c5c8210c525688" desc="Text in Rendering Options">
-    Highlights areas of the page (green) that need to be repainted
-  </message>
 </grit-part>
\ No newline at end of file
diff --git a/third_party/blink/renderer/modules/mediastream/local_media_stream_audio_source.cc b/third_party/blink/renderer/modules/mediastream/local_media_stream_audio_source.cc
index 5f717ede..1de720ff 100644
--- a/third_party/blink/renderer/modules/mediastream/local_media_stream_audio_source.cc
+++ b/third_party/blink/renderer/modules/mediastream/local_media_stream_audio_source.cc
@@ -139,4 +139,20 @@
   EnsureSourceIsStarted();
 }
 
+using EchoCancellationType =
+    blink::AudioProcessingProperties::EchoCancellationType;
+
+base::Optional<blink::AudioProcessingProperties>
+LocalMediaStreamAudioSource::GetAudioProcessingProperties() const {
+  blink::AudioProcessingProperties properties;
+  properties.DisableDefaultProperties();
+
+  if (device().input.effects() & media::AudioParameters::ECHO_CANCELLER) {
+    properties.echo_cancellation_type =
+        EchoCancellationType::kEchoCancellationSystem;
+  }
+
+  return properties;
+}
+
 }  // namespace blink
diff --git a/third_party/blink/renderer/modules/mediastream/media_stream_constraints_util_audio.cc b/third_party/blink/renderer/modules/mediastream/media_stream_constraints_util_audio.cc
index ae07883..bc429507 100644
--- a/third_party/blink/renderer/modules/mediastream/media_stream_constraints_util_audio.cc
+++ b/third_party/blink/renderer/modules/mediastream/media_stream_constraints_util_audio.cc
@@ -307,7 +307,8 @@
                             bool has_active_source,
                             bool is_device_capture,
                             media::AudioParameters device_parameters,
-                            AudioProcessingProperties properties)
+                            AudioProcessingProperties properties,
+                            bool is_reconfiguration_allowed)
       : ec_mode_allowed_values_(EchoCancellationTypeSet({allowed_values})),
         device_parameters_(device_parameters),
         is_device_capture_(is_device_capture) {
@@ -325,6 +326,15 @@
       return;
     }
 
+    // If HW echo cancellation is used, reconfiguration is not supported and
+    // only the current values are allowed. Otherwise, allow all possible values
+    // for echo cancellation.
+    if (is_reconfiguration_allowed &&
+        properties.echo_cancellation_type !=
+            EchoCancellationType::kEchoCancellationSystem) {
+      return;
+    }
+
     ec_mode_allowed_values_ =
         EchoCancellationTypeSet({properties.echo_cancellation_type});
     ec_allowed_values_ =
@@ -551,7 +561,8 @@
   static ProcessingBasedContainer CreateRemoteApmProcessedContainer(
       const SourceInfo& source_info,
       bool is_device_capture,
-      const media::AudioParameters& device_parameters) {
+      const media::AudioParameters& device_parameters,
+      bool is_reconfiguration_allowed) {
     return ProcessingBasedContainer(
         ProcessingType::kApmProcessed,
         {EchoCancellationType::kEchoCancellationAec3,
@@ -568,7 +579,8 @@
             device_parameters.channels()), /* channels_range */
         IntRangeSet::FromValue(
             device_parameters.sample_rate()), /* sample_rate_range */
-        source_info, is_device_capture, device_parameters);
+        source_info, is_device_capture, device_parameters,
+        is_reconfiguration_allowed);
   }
 
   // Creates an instance of ProcessingBasedContainer for the WebRTC processed
@@ -579,7 +591,8 @@
   static ProcessingBasedContainer CreateApmProcessedContainer(
       const SourceInfo& source_info,
       bool is_device_capture,
-      const media::AudioParameters& device_parameters) {
+      const media::AudioParameters& device_parameters,
+      bool is_reconfiguration_allowed) {
     return ProcessingBasedContainer(
         ProcessingType::kApmProcessed,
         {EchoCancellationType::kEchoCancellationAec3,
@@ -595,7 +608,8 @@
         IntRangeSet::FromValue(1),               /* channels_range */
         IntRangeSet::FromValue(
             blink::kAudioProcessingSampleRate), /* sample_rate_range */
-        source_info, is_device_capture, device_parameters);
+        source_info, is_device_capture, device_parameters,
+        is_reconfiguration_allowed);
   }
 
   // Creates an instance of ProcessingBasedContainer for the processed source
@@ -606,7 +620,8 @@
   static ProcessingBasedContainer CreateNoApmProcessedContainer(
       const SourceInfo& source_info,
       bool is_device_capture,
-      const media::AudioParameters& device_parameters) {
+      const media::AudioParameters& device_parameters,
+      bool is_reconfiguration_allowed) {
     return ProcessingBasedContainer(
         ProcessingType::kNoApmProcessed,
         {EchoCancellationType::kEchoCancellationDisabled},
@@ -622,7 +637,8 @@
             device_parameters.channels()), /* channels_range */
         IntRangeSet::FromValue(
             device_parameters.sample_rate()), /* sample_rate_range */
-        source_info, is_device_capture, device_parameters);
+        source_info, is_device_capture, device_parameters,
+        is_reconfiguration_allowed);
   }
 
   // Creates an instance of ProcessingBasedContainer for the unprocessed source
@@ -632,7 +648,8 @@
   static ProcessingBasedContainer CreateUnprocessedContainer(
       const SourceInfo& source_info,
       bool is_device_capture,
-      const media::AudioParameters& device_parameters) {
+      const media::AudioParameters& device_parameters,
+      bool is_reconfiguration_allowed) {
     return ProcessingBasedContainer(
         ProcessingType::kUnprocessed,
         {EchoCancellationType::kEchoCancellationDisabled},
@@ -648,7 +665,8 @@
             device_parameters.channels()), /* channels_range */
         IntRangeSet::FromValue(
             device_parameters.sample_rate()), /* sample_rate_range */
-        source_info, is_device_capture, device_parameters);
+        source_info, is_device_capture, device_parameters,
+        is_reconfiguration_allowed);
   }
 
   const char* ApplyConstraintSet(const ConstraintSet& constraint_set) {
@@ -838,7 +856,8 @@
       IntRangeSet sample_rate_range,
       SourceInfo source_info,
       bool is_device_capture,
-      media::AudioParameters device_parameters)
+      media::AudioParameters device_parameters,
+      bool is_reconfiguration_allowed)
       : processing_type_(processing_type),
         sample_size_container_(sample_size_range),
         channels_container_(channels_range),
@@ -855,7 +874,8 @@
     }
     echo_cancellation_container_ = EchoCancellationContainer(
         echo_cancellation_types, source_info.HasActiveSource(),
-        is_device_capture, device_parameters, source_info.properties());
+        is_device_capture, device_parameters, source_info.properties(),
+        is_reconfiguration_allowed);
 
     boolean_containers_[kGoogAudioMirroring] =
         BooleanContainer(goog_audio_mirroring_set);
@@ -951,7 +971,8 @@
 class DeviceContainer {
  public:
   DeviceContainer(const AudioDeviceCaptureCapability& capability,
-                  bool is_device_capture)
+                  bool is_device_capture,
+                  bool is_reconfiguration_allowed)
       : device_parameters_(capability.Parameters()) {
     if (!capability.DeviceID().empty()) {
       device_id_container_ =
@@ -971,33 +992,37 @@
     // Three variations of the processing-based container. Each variant is
     // associated to a different type of audio processing configuration, namely
     // unprocessed, processed by WebRTC, or processed by other means.
-    if (source_info.type() == SourceType::kNone ||
+    if (is_reconfiguration_allowed || source_info.type() == SourceType::kNone ||
         source_info.type() == SourceType::kUnprocessed) {
       processing_based_containers_.push_back(
           ProcessingBasedContainer::CreateUnprocessedContainer(
-              source_info, is_device_capture, device_parameters_));
+              source_info, is_device_capture, device_parameters_,
+              is_reconfiguration_allowed));
     }
-    if (source_info.type() == SourceType::kNone ||
+    if (is_reconfiguration_allowed || source_info.type() == SourceType::kNone ||
         source_info.type() == SourceType::kNoApmProcessed) {
       processing_based_containers_.push_back(
           ProcessingBasedContainer::CreateNoApmProcessedContainer(
-              source_info, is_device_capture, device_parameters_));
+              source_info, is_device_capture, device_parameters_,
+              is_reconfiguration_allowed));
     }
-    if (source_info.type() == SourceType::kNone ||
+    if (is_reconfiguration_allowed || source_info.type() == SourceType::kNone ||
         source_info.type() == SourceType::kApmProcessed) {
       if (IsApmInAudioServiceEnabled()) {
         processing_based_containers_.push_back(
             ProcessingBasedContainer::CreateRemoteApmProcessedContainer(
-                source_info, is_device_capture, device_parameters_));
+                source_info, is_device_capture, device_parameters_,
+                is_reconfiguration_allowed));
       } else {
         processing_based_containers_.push_back(
             ProcessingBasedContainer::CreateApmProcessedContainer(
-                source_info, is_device_capture, device_parameters_));
+                source_info, is_device_capture, device_parameters_,
+                is_reconfiguration_allowed));
       }
     }
 
 #if DCHECK_IS_ON()
-    if (source_info.type() == SourceType::kNone)
+    if (is_reconfiguration_allowed || source_info.type() == SourceType::kNone)
       DCHECK_EQ(processing_based_containers_.size(), 3u);
     else
       DCHECK_EQ(processing_based_containers_.size(), 1u);
@@ -1188,6 +1213,7 @@
       channels = source_parameters.channels();
       sample_rate = source_parameters.sample_rate();
       latency = source_parameters.GetBufferDuration().InSecondsF();
+      properties = *(source->GetAudioProcessingProperties());
 
       if (!processed_source) {
         source_type = SourceType::kUnprocessed;
@@ -1236,10 +1262,12 @@
  public:
   CandidatesContainer(const AudioDeviceCaptureCapabilities& capabilities,
                       std::string& media_stream_source,
-                      std::string& default_device_id)
+                      std::string& default_device_id,
+                      bool is_reconfiguration_allowed)
       : default_device_id_(default_device_id) {
     for (const auto& capability : capabilities) {
-      devices_.emplace_back(capability, media_stream_source.empty());
+      devices_.emplace_back(capability, media_stream_source.empty(),
+                            is_reconfiguration_allowed);
       DCHECK(!devices_.back().IsEmpty());
     }
   }
@@ -1343,7 +1371,8 @@
 AudioCaptureSettings SelectSettingsAudioCapture(
     const AudioDeviceCaptureCapabilities& capabilities,
     const blink::WebMediaConstraints& constraints,
-    bool should_disable_hardware_noise_suppression) {
+    bool should_disable_hardware_noise_suppression,
+    bool is_reconfiguration_allowed) {
   if (capabilities.empty())
     return AudioCaptureSettings();
 
@@ -1354,7 +1383,7 @@
     default_device_id = capabilities.begin()->DeviceID();
 
   CandidatesContainer candidates(capabilities, media_stream_source,
-                                 default_device_id);
+                                 default_device_id, is_reconfiguration_allowed);
   DCHECK(!candidates.IsEmpty());
 
   auto* failed_constraint_name =
diff --git a/third_party/blink/renderer/modules/mediastream/media_stream_constraints_util_audio_test.cc b/third_party/blink/renderer/modules/mediastream/media_stream_constraints_util_audio_test.cc
index b053c5da..c1a7ae7 100644
--- a/third_party/blink/renderer/modules/mediastream/media_stream_constraints_util_audio_test.cc
+++ b/third_party/blink/renderer/modules/mediastream/media_stream_constraints_util_audio_test.cc
@@ -172,10 +172,19 @@
         blink::scheduler::GetSingleThreadTaskRunnerForTesting());
   }
 
-  AudioCaptureSettings SelectSettings() {
+  AudioCaptureSettings SelectSettings(
+      bool is_reconfigurable = false,
+      base::Optional<AudioDeviceCaptureCapabilities> capabilities =
+          base::nullopt) {
     blink::WebMediaConstraints constraints =
         constraint_factory_.CreateWebMediaConstraints();
-    return SelectSettingsAudioCapture(capabilities_, constraints, false);
+    if (capabilities) {
+      return SelectSettingsAudioCapture(*capabilities, constraints, false,
+                                        is_reconfigurable);
+    } else {
+      return SelectSettingsAudioCapture(capabilities_, constraints, false,
+                                        is_reconfigurable);
+    }
   }
 
   // When googExperimentalEchoCancellation is not explicitly set, its default
@@ -429,6 +438,8 @@
   const AudioDeviceCaptureCapability* system_echo_canceller_device_ = nullptr;
   const AudioDeviceCaptureCapability* four_channels_device_ = nullptr;
   const AudioDeviceCaptureCapability* variable_latency_device_ = nullptr;
+  std::unique_ptr<ProcessedLocalAudioSource> system_echo_canceller_source_ =
+      nullptr;
   const std::vector<media::Point> kMicPositions = {{8, 8, 8}, {4, 4, 4}};
 
   // TODO(grunell): Store these as separate constants and compare against those
@@ -1496,6 +1507,42 @@
   }
 }
 
+TEST_P(MediaStreamConstraintsUtilAudioTest,
+       ReconfigurationSystemEchoCancellation) {
+  // This test is relevant only for device capture, where HW EC can be found.
+  if (!IsDeviceCapture())
+    return;
+
+  // Create a capability that is based on a already opened source with system
+  // echo cancellation enabled.
+  AudioProcessingProperties properties;
+  properties.echo_cancellation_type =
+      EchoCancellationType::kEchoCancellationSystem;
+  std::unique_ptr<ProcessedLocalAudioSource> system_echo_canceller_source =
+      GetProcessedLocalAudioSource(
+          properties, false /* disable_local_echo */,
+          false /* render_to_associated_sink */,
+          media::AudioParameters::PlatformEffectsMask::ECHO_CANCELLER);
+  AudioDeviceCaptureCapabilities capabilities = {
+      AudioDeviceCaptureCapability(system_echo_canceller_source.get())};
+  AudioDeviceCaptureCapability* system_echo_canceller_with_source =
+      &capabilities[0];
+
+  constraint_factory_.Reset();
+  constraint_factory_.basic().device_id.SetExact(blink::WebString::FromASCII(
+      system_echo_canceller_with_source->DeviceID()));
+  constraint_factory_.basic().echo_cancellation.SetExact(true);
+  auto result = SelectSettings(true, capabilities);
+  EXPECT_TRUE(result.HasValue());
+
+  constraint_factory_.Reset();
+  constraint_factory_.basic().device_id.SetExact(blink::WebString::FromASCII(
+      system_echo_canceller_with_source->DeviceID()));
+  constraint_factory_.basic().echo_cancellation.SetExact(false);
+  result = SelectSettings(true, capabilities);
+  EXPECT_FALSE(result.HasValue());
+}
+
 // Test advanced constraints sets that can be satisfied.
 TEST_P(MediaStreamConstraintsUtilAudioTest, AdvancedCompatibleConstraints) {
   constraint_factory_.AddAdvanced().render_to_associated_sink.SetExact(true);
diff --git a/third_party/blink/renderer/modules/mediastream/mock_mojo_media_stream_dispatcher_host.cc b/third_party/blink/renderer/modules/mediastream/mock_mojo_media_stream_dispatcher_host.cc
index c339b45f..f2c005e 100644
--- a/third_party/blink/renderer/modules/mediastream/mock_mojo_media_stream_dispatcher_host.cc
+++ b/third_party/blink/renderer/modules/mediastream/mock_mojo_media_stream_dispatcher_host.cc
@@ -26,13 +26,18 @@
     int32_t request_id,
     const StreamControls& controls,
     bool user_gesture,
+    mojom::blink::StreamSelectionInfoPtr audio_stream_selection_info_ptr,
     GenerateStreamCallback callback) {
   request_id_ = request_id;
   audio_devices_.clear();
   video_devices_.clear();
   ++request_stream_counter_;
 
-  if (controls.audio.requested) {
+  blink::mojom::StreamSelectionStrategy strategy =
+      audio_stream_selection_info_ptr->strategy;
+  if (controls.audio.requested &&
+      (strategy == blink::mojom::StreamSelectionStrategy::SEARCH_BY_DEVICE_ID ||
+       strategy == blink::mojom::StreamSelectionStrategy::FORCE_NEW_STREAM)) {
     MediaStreamDevice audio_device;
     audio_device.id = controls.audio.device_id + session_id_.ToString();
     audio_device.name = "microphone";
diff --git a/third_party/blink/renderer/modules/mediastream/mock_mojo_media_stream_dispatcher_host.h b/third_party/blink/renderer/modules/mediastream/mock_mojo_media_stream_dispatcher_host.h
index 6116d7d..aa8edb7 100644
--- a/third_party/blink/renderer/modules/mediastream/mock_mojo_media_stream_dispatcher_host.h
+++ b/third_party/blink/renderer/modules/mediastream/mock_mojo_media_stream_dispatcher_host.h
@@ -24,10 +24,12 @@
 
   mojom::blink::MediaStreamDispatcherHostPtr CreateInterfacePtrAndBind();
 
-  void GenerateStream(int32_t request_id,
-                      const StreamControls& controls,
-                      bool user_gesture,
-                      GenerateStreamCallback callback) override;
+  void GenerateStream(
+      int32_t request_id,
+      const StreamControls& controls,
+      bool user_gesture,
+      mojom::blink::StreamSelectionInfoPtr audio_stream_selection_info_ptr,
+      GenerateStreamCallback callback) override;
   void CancelRequest(int32_t request_id) override;
   void StopStreamDevice(
       const WTF::String& device_id,
diff --git a/third_party/blink/renderer/modules/mediastream/processed_local_audio_source.cc b/third_party/blink/renderer/modules/mediastream/processed_local_audio_source.cc
index 482ac13b..5947567 100644
--- a/third_party/blink/renderer/modules/mediastream/processed_local_audio_source.cc
+++ b/third_party/blink/renderer/modules/mediastream/processed_local_audio_source.cc
@@ -125,6 +125,11 @@
   return nullptr;
 }
 
+base::Optional<blink::AudioProcessingProperties>
+ProcessedLocalAudioSource::GetAudioProcessingProperties() const {
+  return audio_processing_properties_;
+}
+
 void* ProcessedLocalAudioSource::GetClassIdentifier() const {
   return kProcessedLocalAudioSourceIdentifier;
 }
diff --git a/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.cc b/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.cc
index 5c55489..69fb50e 100644
--- a/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.cc
+++ b/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.cc
@@ -68,7 +68,7 @@
 }
 
 ServiceWorkerGlobalScopeProxy::~ServiceWorkerGlobalScopeProxy() {
-  DCHECK(IsMainThread());
+  DCHECK(parent_task_runner_->BelongsToCurrentThread());
   // Verify that the proxy has been detached.
   DCHECK(!embedded_worker_);
 }
@@ -312,19 +312,18 @@
     : embedded_worker_(&embedded_worker),
       client_(&client),
       worker_global_scope_(nullptr) {
-  DCHECK(IsMainThread());
   DETACH_FROM_THREAD(worker_thread_checker_);
   parent_task_runner_ = Thread::Current()->GetTaskRunner();
 }
 
 void ServiceWorkerGlobalScopeProxy::Detach() {
-  DCHECK(IsMainThread());
+  DCHECK(parent_task_runner_->BelongsToCurrentThread());
   embedded_worker_ = nullptr;
   client_ = nullptr;
 }
 
 void ServiceWorkerGlobalScopeProxy::TerminateWorkerContext() {
-  DCHECK(IsMainThread());
+  DCHECK(parent_task_runner_->BelongsToCurrentThread());
   embedded_worker_->TerminateWorkerContext();
 }
 
diff --git a/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.h b/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.h
index b479e31..08e3e46 100644
--- a/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.h
+++ b/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.h
@@ -62,6 +62,9 @@
 // An instance of this class is supposed to outlive until
 // workerThreadTerminated() is called by its corresponding
 // WorkerGlobalScope.
+//
+// TODO(bashi): Update the above comment and method comments once we move
+// creation of this class off the main thread.
 class ServiceWorkerGlobalScopeProxy final : public WebServiceWorkerContextProxy,
                                             public WorkerReportingProxy {
  public:
diff --git a/third_party/blink/renderer/modules/speech/speech_grammar.idl b/third_party/blink/renderer/modules/speech/speech_grammar.idl
index b7aa5f61..3d922c0 100644
--- a/third_party/blink/renderer/modules/speech/speech_grammar.idl
+++ b/third_party/blink/renderer/modules/speech/speech_grammar.idl
@@ -27,6 +27,7 @@
 
 [
     Constructor,
+    Measure,
     NoInterfaceObject
 ] interface SpeechGrammar {
     [URL,CallWith=ScriptState] attribute DOMString src;
diff --git a/third_party/blink/renderer/modules/speech/speech_grammar_list.idl b/third_party/blink/renderer/modules/speech/speech_grammar_list.idl
index ce1ee32d..cdc19d4 100644
--- a/third_party/blink/renderer/modules/speech/speech_grammar_list.idl
+++ b/third_party/blink/renderer/modules/speech/speech_grammar_list.idl
@@ -27,10 +27,11 @@
 
 [
     Constructor,
+    Measure,
     NoInterfaceObject
 ] interface SpeechGrammarList {
     readonly attribute unsigned long length;
-    getter SpeechGrammar item(unsigned long index);
+    [Measure] getter SpeechGrammar item(unsigned long index);
     [CallWith=ScriptState, Measure] void addFromUri(DOMString src, optional float weight);
-    void addFromString(DOMString string, optional float weight);
+    [Measure] void addFromString(DOMString string, optional float weight);
 };
diff --git a/third_party/blink/renderer/modules/speech/speech_recognition.idl b/third_party/blink/renderer/modules/speech/speech_recognition.idl
index cad81b2b..bc93835 100644
--- a/third_party/blink/renderer/modules/speech/speech_recognition.idl
+++ b/third_party/blink/renderer/modules/speech/speech_recognition.idl
@@ -29,10 +29,11 @@
     ActiveScriptWrappable,
     Constructor,
     ConstructorCallWith=ExecutionContext,
+    Measure,
     NoInterfaceObject
 ] interface SpeechRecognition : EventTarget {
     // recognition parameters
-    attribute SpeechGrammarList grammars;
+    [Measure] attribute SpeechGrammarList grammars;
     attribute DOMString lang;
     attribute boolean continuous;
     attribute boolean interimResults;
diff --git a/third_party/blink/renderer/modules/storage/storage_controller_test.cc b/third_party/blink/renderer/modules/storage/storage_controller_test.cc
index 34f0a607..ed4f5c0f 100644
--- a/third_party/blink/renderer/modules/storage/storage_controller_test.cc
+++ b/third_party/blink/renderer/modules/storage/storage_controller_test.cc
@@ -57,7 +57,7 @@
 
   mojom::blink::StoragePartitionServicePtr storage_partition_service_ptr;
   PostCrossThreadTask(
-      *base::CreateSequencedTaskRunnerWithTraits({}), FROM_HERE,
+      *base::CreateSequencedTaskRunner({base::ThreadPool()}), FROM_HERE,
       CrossThreadBindOnce(
           [](mojom::blink::StoragePartitionServiceRequest request) {
             mojo::MakeStrongBinding(
@@ -108,7 +108,7 @@
   Persistent<FakeAreaSource> source_area =
       MakeGarbageCollected<FakeAreaSource>(kPageUrl);
 
-  auto task_runner = base::CreateSequencedTaskRunnerWithTraits({});
+  auto task_runner = base::CreateSequencedTaskRunner({base::ThreadPool()});
 
   auto mock_storage_partition_service =
       std::make_unique<MockStoragePartitionService>();
diff --git a/third_party/blink/renderer/modules/storage/storage_namespace_test.cc b/third_party/blink/renderer/modules/storage/storage_namespace_test.cc
index e4752c3..0083124 100644
--- a/third_party/blink/renderer/modules/storage/storage_namespace_test.cc
+++ b/third_party/blink/renderer/modules/storage/storage_namespace_test.cc
@@ -53,7 +53,7 @@
 
   mojom::blink::StoragePartitionServicePtr storage_partition_service_ptr;
   PostCrossThreadTask(
-      *base::CreateSequencedTaskRunnerWithTraits({}), FROM_HERE,
+      *base::CreateSequencedTaskRunner({base::ThreadPool()}), FROM_HERE,
       CrossThreadBindOnce(
           [](mojom::blink::StoragePartitionServiceRequest request) {
             mojo::MakeStrongBinding(
diff --git a/third_party/blink/renderer/modules/webdatabase/web_database_host.cc b/third_party/blink/renderer/modules/webdatabase/web_database_host.cc
index 72ad465..1d7c1ef 100644
--- a/third_party/blink/renderer/modules/webdatabase/web_database_host.cc
+++ b/third_party/blink/renderer/modules/webdatabase/web_database_host.cc
@@ -38,8 +38,9 @@
   if (!shared_remote_) {
     DCHECK(pending_remote_);
     shared_remote_ = mojo::SharedRemote<mojom::blink::WebDatabaseHost>(
-        std::move(pending_remote_), base::CreateSequencedTaskRunnerWithTraits(
-                                        {base::WithBaseSyncPrimitives()}));
+        std::move(pending_remote_),
+        base::CreateSequencedTaskRunner(
+            {base::ThreadPool(), base::WithBaseSyncPrimitives()}));
   }
 
   return *shared_remote_;
diff --git a/third_party/blink/renderer/modules/webgpu/gpu_compute_pass_encoder.cc b/third_party/blink/renderer/modules/webgpu/gpu_compute_pass_encoder.cc
index e3e21e2..70d2e98 100644
--- a/third_party/blink/renderer/modules/webgpu/gpu_compute_pass_encoder.cc
+++ b/third_party/blink/renderer/modules/webgpu/gpu_compute_pass_encoder.cc
@@ -39,6 +39,20 @@
       dynamicOffsets.data());
 }
 
+void GPUComputePassEncoder::pushDebugGroup(String groupLabel) {
+  GetProcs().computePassEncoderPushDebugGroup(GetHandle(),
+                                              groupLabel.Utf8().data());
+}
+
+void GPUComputePassEncoder::popDebugGroup() {
+  GetProcs().computePassEncoderPopDebugGroup(GetHandle());
+}
+
+void GPUComputePassEncoder::insertDebugMarker(String markerLabel) {
+  GetProcs().computePassEncoderInsertDebugMarker(GetHandle(),
+                                                 markerLabel.Utf8().data());
+}
+
 void GPUComputePassEncoder::setPipeline(GPUComputePipeline* pipeline) {
   GetProcs().computePassEncoderSetPipeline(GetHandle(), pipeline->GetHandle());
 }
diff --git a/third_party/blink/renderer/modules/webgpu/gpu_compute_pass_encoder.h b/third_party/blink/renderer/modules/webgpu/gpu_compute_pass_encoder.h
index c11752f..de3ec931 100644
--- a/third_party/blink/renderer/modules/webgpu/gpu_compute_pass_encoder.h
+++ b/third_party/blink/renderer/modules/webgpu/gpu_compute_pass_encoder.h
@@ -28,6 +28,9 @@
   void setBindGroup(uint32_t index,
                     GPUBindGroup* bindGroup,
                     const Vector<uint64_t>& dynamicOffsets);
+  void pushDebugGroup(String groupLabel);
+  void popDebugGroup();
+  void insertDebugMarker(String markerLabel);
   void setPipeline(GPUComputePipeline* pipeline);
   void dispatch(uint32_t x, uint32_t y, uint32_t z);
   void dispatchIndirect(GPUBuffer* indirectBuffer, uint64_t indirectOffset);
diff --git a/third_party/blink/renderer/modules/webgpu/gpu_compute_pass_encoder.idl b/third_party/blink/renderer/modules/webgpu/gpu_compute_pass_encoder.idl
index 58507fd..82e2e93 100644
--- a/third_party/blink/renderer/modules/webgpu/gpu_compute_pass_encoder.idl
+++ b/third_party/blink/renderer/modules/webgpu/gpu_compute_pass_encoder.idl
@@ -7,9 +7,14 @@
 [
     RuntimeEnabled=WebGPU
 ] interface GPUComputePassEncoder {
+    // GPUProgrammablePassEncoder methods
     void setBindGroup(unsigned long index,
                       GPUBindGroup bindGroup,
                       optional sequence<unsigned long long> dynamicOffsets = []);
+    void pushDebugGroup(DOMString groupLabel);
+    void popDebugGroup();
+    void insertDebugMarker(DOMString markerLabel);
+
     void setPipeline(GPUComputePipeline pipeline);
 
     void dispatch(unsigned long x,
diff --git a/third_party/blink/renderer/modules/webgpu/gpu_render_pass_descriptor.idl b/third_party/blink/renderer/modules/webgpu/gpu_render_pass_descriptor.idl
index 2508ef9..9483f11 100644
--- a/third_party/blink/renderer/modules/webgpu/gpu_render_pass_descriptor.idl
+++ b/third_party/blink/renderer/modules/webgpu/gpu_render_pass_descriptor.idl
@@ -6,7 +6,7 @@
 
 dictionary GPURenderPassDescriptor {
     required sequence<GPURenderPassColorAttachmentDescriptor> colorAttachments;
-    GPURenderPassDepthStencilAttachmentDescriptor depthStencilAttachment = null;
+    GPURenderPassDepthStencilAttachmentDescriptor depthStencilAttachment;
 };
 
 enum GPULoadOp {
diff --git a/third_party/blink/renderer/modules/webgpu/gpu_render_pass_encoder.cc b/third_party/blink/renderer/modules/webgpu/gpu_render_pass_encoder.cc
index 83e7763..deaf3646 100644
--- a/third_party/blink/renderer/modules/webgpu/gpu_render_pass_encoder.cc
+++ b/third_party/blink/renderer/modules/webgpu/gpu_render_pass_encoder.cc
@@ -42,6 +42,20 @@
       dynamicOffsets.data());
 }
 
+void GPURenderPassEncoder::pushDebugGroup(String groupLabel) {
+  GetProcs().renderPassEncoderPushDebugGroup(GetHandle(),
+                                             groupLabel.Utf8().data());
+}
+
+void GPURenderPassEncoder::popDebugGroup() {
+  GetProcs().renderPassEncoderPopDebugGroup(GetHandle());
+}
+
+void GPURenderPassEncoder::insertDebugMarker(String markerLabel) {
+  GetProcs().renderPassEncoderInsertDebugMarker(GetHandle(),
+                                                markerLabel.Utf8().data());
+}
+
 void GPURenderPassEncoder::setPipeline(GPURenderPipeline* pipeline) {
   GetProcs().renderPassEncoderSetPipeline(GetHandle(), pipeline->GetHandle());
 }
diff --git a/third_party/blink/renderer/modules/webgpu/gpu_render_pass_encoder.h b/third_party/blink/renderer/modules/webgpu/gpu_render_pass_encoder.h
index 5b3dada..af3389e 100644
--- a/third_party/blink/renderer/modules/webgpu/gpu_render_pass_encoder.h
+++ b/third_party/blink/renderer/modules/webgpu/gpu_render_pass_encoder.h
@@ -30,6 +30,9 @@
   void setBindGroup(uint32_t index,
                     GPUBindGroup* bindGroup,
                     const Vector<uint64_t>& dynamicOffsets);
+  void pushDebugGroup(String groupLabel);
+  void popDebugGroup();
+  void insertDebugMarker(String markerLabel);
   void setPipeline(GPURenderPipeline* pipeline);
 
   void setBlendColor(GPUColor* color);
diff --git a/third_party/blink/renderer/modules/webgpu/gpu_render_pass_encoder.idl b/third_party/blink/renderer/modules/webgpu/gpu_render_pass_encoder.idl
index 4a9f785..20deb2c 100644
--- a/third_party/blink/renderer/modules/webgpu/gpu_render_pass_encoder.idl
+++ b/third_party/blink/renderer/modules/webgpu/gpu_render_pass_encoder.idl
@@ -7,9 +7,14 @@
 [
     RuntimeEnabled=WebGPU
 ] interface GPURenderPassEncoder {
+    // GPUProgrammablePassEncoder methods
     void setBindGroup(unsigned long index,
                       GPUBindGroup bindGroup,
                       optional sequence<unsigned long long> dynamicOffsets = []);
+    void pushDebugGroup(DOMString groupLabel);
+    void popDebugGroup();
+    void insertDebugMarker(DOMString markerLabel);
+
     void setPipeline(GPURenderPipeline pipeline);
 
     void setBlendColor(GPUColor color);
diff --git a/third_party/blink/renderer/modules/webgpu/gpu_render_pipeline.cc b/third_party/blink/renderer/modules/webgpu/gpu_render_pipeline.cc
index 3385724..a2cea2c 100644
--- a/third_party/blink/renderer/modules/webgpu/gpu_render_pipeline.cc
+++ b/third_party/blink/renderer/modules/webgpu/gpu_render_pipeline.cc
@@ -221,11 +221,13 @@
   OwnedPipelineStageDescriptor vertex_stage_info =
       AsDawnType(webgpu_desc->vertexStage());
   dawn_desc.vertexStage = &std::get<0>(vertex_stage_info);
-
-  // TODO(crbug.com/dawn/136): Support vertex-only pipelines.
-  OwnedPipelineStageDescriptor fragment_stage_info =
-      AsDawnType(webgpu_desc->fragmentStage());
-  dawn_desc.fragmentStage = &std::get<0>(fragment_stage_info);
+  OwnedPipelineStageDescriptor fragment_stage_info;
+  if (webgpu_desc->hasFragmentStage()) {
+    fragment_stage_info = AsDawnType(webgpu_desc->fragmentStage());
+    dawn_desc.fragmentStage = &std::get<0>(fragment_stage_info);
+  } else {
+    dawn_desc.fragmentStage = nullptr;
+  }
 
   // TODO(crbug.com/dawn/131): Update Dawn to match WebGPU vertex input
   v8::Isolate* isolate = script_state->GetIsolate();
diff --git a/third_party/blink/renderer/modules/webgpu/gpu_render_pipeline_descriptor.idl b/third_party/blink/renderer/modules/webgpu/gpu_render_pipeline_descriptor.idl
index 6ac853b..e53432f 100644
--- a/third_party/blink/renderer/modules/webgpu/gpu_render_pipeline_descriptor.idl
+++ b/third_party/blink/renderer/modules/webgpu/gpu_render_pipeline_descriptor.idl
@@ -6,13 +6,12 @@
 
 dictionary GPURenderPipelineDescriptor : GPUPipelineDescriptorBase {
     required GPUPipelineStageDescriptor vertexStage;
-    // TODO(crbug.com/dawn/136): Support vertex-only pipelines.
-    required GPUPipelineStageDescriptor fragmentStage;
+    GPUPipelineStageDescriptor fragmentStage;
 
     required GPUPrimitiveTopology primitiveTopology;
     GPURasterizationStateDescriptor rasterizationState;
     required sequence<GPUColorStateDescriptor> colorStates;
-    GPUDepthStencilStateDescriptor depthStencilState = null;
+    GPUDepthStencilStateDescriptor depthStencilState;
     required GPUVertexInputDescriptor vertexInput;
 
     unsigned long sampleCount = 1;
diff --git a/third_party/blink/renderer/modules/websockets/websocket_channel_impl.cc b/third_party/blink/renderer/modules/websockets/websocket_channel_impl.cc
index 7cf1e8f1..2cd97c9 100644
--- a/third_party/blink/renderer/modules/websockets/websocket_channel_impl.cc
+++ b/third_party/blink/renderer/modules/websockets/websocket_channel_impl.cc
@@ -179,7 +179,8 @@
     std::unique_ptr<SourceLocation> location) {
   auto* channel = MakeGarbageCollected<WebSocketChannelImpl>(
       execution_context, client, std::move(location),
-      std::make_unique<WebSocketHandleImpl>());
+      std::make_unique<WebSocketHandleImpl>(
+          execution_context->GetTaskRunner(TaskType::kNetworking)));
   channel->handshake_throttle_ =
       channel->GetBaseFetchContext()->CreateWebSocketHandshakeThrottle();
   return channel;
@@ -260,11 +261,9 @@
     // a mojo connection error.
     mojo::MakeRequest(&connector);
   }
-  handle_->Connect(
-      std::move(connector), url, protocols,
-      GetBaseFetchContext()->GetSiteForCookies(),
-      execution_context_->UserAgent(), this,
-      execution_context_->GetTaskRunner(TaskType::kNetworking).get());
+  handle_->Connect(std::move(connector), url, protocols,
+                   GetBaseFetchContext()->GetSiteForCookies(),
+                   execution_context_->UserAgent(), this);
 
   if (handshake_throttle_) {
     // The use of WrapWeakPersistent is safe and motivated by the fact that if
diff --git a/third_party/blink/renderer/modules/websockets/websocket_channel_impl_test.cc b/third_party/blink/renderer/modules/websockets/websocket_channel_impl_test.cc
index 7988bff..88493b6 100644
--- a/third_party/blink/renderer/modules/websockets/websocket_channel_impl_test.cc
+++ b/third_party/blink/renderer/modules/websockets/websocket_channel_impl_test.cc
@@ -92,8 +92,7 @@
                const Vector<String>& protocols,
                const KURL& site_for_cookies,
                const String& user_agent_override,
-               WebSocketChannelImpl* channel,
-               base::SingleThreadTaskRunner*) override {
+               WebSocketChannelImpl* channel) override {
     Connect(url, protocols, site_for_cookies, user_agent_override, channel);
   }
   MOCK_METHOD5(Connect,
diff --git a/third_party/blink/renderer/modules/websockets/websocket_handle.h b/third_party/blink/renderer/modules/websockets/websocket_handle.h
index c7c1aee..6c2a9a5 100644
--- a/third_party/blink/renderer/modules/websockets/websocket_handle.h
+++ b/third_party/blink/renderer/modules/websockets/websocket_handle.h
@@ -32,7 +32,6 @@
 #define THIRD_PARTY_BLINK_RENDERER_MODULES_WEBSOCKETS_WEBSOCKET_HANDLE_H_
 
 #include <stdint.h>
-#include "base/single_thread_task_runner.h"
 #include "services/network/public/mojom/websocket.mojom-blink.h"
 #include "third_party/blink/public/mojom/websockets/websocket_connector.mojom-blink.h"
 #include "third_party/blink/renderer/platform/wtf/forward.h"
@@ -66,8 +65,7 @@
                        const Vector<String>& protocols,
                        const KURL& site_for_cookies,
                        const String& user_agent_override,
-                       WebSocketChannelImpl*,
-                       base::SingleThreadTaskRunner*) = 0;
+                       WebSocketChannelImpl*) = 0;
   virtual void Send(bool fin, MessageType, const char* data, wtf_size_t) = 0;
   virtual void AddReceiveFlowControlQuota(int64_t quota) = 0;
   virtual void Close(uint16_t code, const String& reason) = 0;
diff --git a/third_party/blink/renderer/modules/websockets/websocket_handle_impl.cc b/third_party/blink/renderer/modules/websockets/websocket_handle_impl.cc
index 85b4cfaf..acd288de 100644
--- a/third_party/blink/renderer/modules/websockets/websocket_handle_impl.cc
+++ b/third_party/blink/renderer/modules/websockets/websocket_handle_impl.cc
@@ -21,8 +21,10 @@
 
 }  // namespace
 
-WebSocketHandleImpl::WebSocketHandleImpl()
-    : channel_(nullptr),
+WebSocketHandleImpl::WebSocketHandleImpl(
+    scoped_refptr<base::SingleThreadTaskRunner> task_runner)
+    : task_runner_(std::move(task_runner)),
+      channel_(nullptr),
       handshake_client_binding_(this),
       client_binding_(this) {
   NETWORK_DVLOG(1) << this << " created";
@@ -40,25 +42,21 @@
                                   const Vector<String>& protocols,
                                   const KURL& site_for_cookies,
                                   const String& user_agent_override,
-                                  WebSocketChannelImpl* channel,
-                                  base::SingleThreadTaskRunner* task_runner) {
+                                  WebSocketChannelImpl* channel) {
   NETWORK_DVLOG(1) << this << " connect(" << url.GetString() << ")";
 
   DCHECK(!channel_);
   DCHECK(channel);
   channel_ = channel;
 
-  // Here we detect mojo connection errors on |client_binding_|. See also
-  // CreateWebSocket in //network/services/public/mojom/network_context.mojom.
-  network::mojom::blink::WebSocketHandshakeClientPtr handshake_client_proxy;
   Vector<network::mojom::blink::HttpHeaderPtr> additional_headers;
+  network::mojom::blink::WebSocketHandshakeClientPtr handshake_client_proxy;
   handshake_client_binding_.Bind(
-      mojo::MakeRequest(&handshake_client_proxy, task_runner), task_runner);
-  network::mojom::blink::WebSocketClientPtr client_proxy;
-  client_binding_.Bind(mojo::MakeRequest(&client_proxy, task_runner),
-                       task_runner);
-  client_binding_.set_connection_error_with_reason_handler(WTF::Bind(
+      mojo::MakeRequest(&handshake_client_proxy, task_runner_), task_runner_);
+  handshake_client_binding_.set_connection_error_with_reason_handler(WTF::Bind(
       &WebSocketHandleImpl::OnConnectionError, WTF::Unretained(this)));
+  network::mojom::blink::WebSocketClientPtr client_proxy;
+  pending_client_receiver_ = mojo::MakeRequest(&client_proxy);
 
   connector->Connect(url, protocols, site_for_cookies, user_agent_override,
                      std::move(handshake_client_proxy),
@@ -121,19 +119,12 @@
 
 void WebSocketHandleImpl::OnConnectionError(uint32_t custom_reason,
                                             const std::string& description) {
-  // Our connection to the WebSocket was dropped. This could be due to
-  // exceeding the maximum number of concurrent websockets from this process.
-  // This handler is sufficient to detect all mojo connection errors, as
-  // any error will result in the data connection being dropped.
-  // By detecting the errors on this channel, we ensure that any FailChannel
-  // messages from the network service will be processed first.
   NETWORK_DVLOG(1) << " OnConnectionError( reason: " << custom_reason
                    << ", description:" << description;
-  OnFailChannel("Unknown reason");
-}
-
-void WebSocketHandleImpl::OnFailChannel(const String& message) {
-  NETWORK_DVLOG(1) << this << " OnFailChannel(" << message << ")";
+  String message = "Unknown reason";
+  if (custom_reason == network::mojom::blink::WebSocket::kInternalFailure) {
+    message = String::FromUTF8(description.c_str(), description.size());
+  }
 
   WebSocketChannelImpl* channel = channel_;
   Disconnect();
@@ -169,6 +160,12 @@
   if (!channel_)
     return;
 
+  // From now on, we will detect mojo errors via |client_binding_|.
+  handshake_client_binding_.Close();
+  client_binding_.Bind(std::move(pending_client_receiver_), task_runner_);
+  client_binding_.set_connection_error_with_reason_handler(WTF::Bind(
+      &WebSocketHandleImpl::OnConnectionError, WTF::Unretained(this)));
+
   DCHECK(!websocket_);
   websocket_ = std::move(websocket);
   channel_->DidConnect(this, protocol, extensions, receive_quota_threshold);
diff --git a/third_party/blink/renderer/modules/websockets/websocket_handle_impl.h b/third_party/blink/renderer/modules/websockets/websocket_handle_impl.h
index dce31cda..5354633 100644
--- a/third_party/blink/renderer/modules/websockets/websocket_handle_impl.h
+++ b/third_party/blink/renderer/modules/websockets/websocket_handle_impl.h
@@ -38,6 +38,10 @@
 #include "third_party/blink/renderer/platform/heap/persistent.h"
 #include "third_party/blink/renderer/platform/wtf/wtf_size_t.h"
 
+namespace base {
+class SingleThreadTaskRunner;
+}  // namespace base
+
 namespace blink {
 
 class WebSocketHandleImpl
@@ -45,7 +49,7 @@
       public network::mojom::blink::WebSocketHandshakeClient,
       public network::mojom::blink::WebSocketClient {
  public:
-  WebSocketHandleImpl();
+  explicit WebSocketHandleImpl(scoped_refptr<base::SingleThreadTaskRunner>);
   ~WebSocketHandleImpl() override;
 
   void Connect(mojom::blink::WebSocketConnectorPtr,
@@ -53,8 +57,7 @@
                const Vector<String>& protocols,
                const KURL& site_for_cookies,
                const String& user_agent_override,
-               WebSocketChannelImpl*,
-               base::SingleThreadTaskRunner*) override;
+               WebSocketChannelImpl*) override;
   void Send(bool fin, MessageType, const char* data, wtf_size_t) override;
   void AddReceiveFlowControlQuota(int64_t quota) override;
   void Close(uint16_t code, const String& reason) override;
@@ -82,11 +85,12 @@
                      uint16_t code,
                      const String& reason) override;
   void OnClosingHandshake() override;
-  void OnFailChannel(const String& reason) override;
 
+  scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
   WeakPersistent<WebSocketChannelImpl> channel_;
 
   network::mojom::blink::WebSocketPtr websocket_;
+  network::mojom::blink::WebSocketClientRequest pending_client_receiver_;
   mojo::Binding<network::mojom::blink::WebSocketHandshakeClient>
       handshake_client_binding_;
   mojo::Binding<network::mojom::blink::WebSocketClient> client_binding_;
diff --git a/third_party/blink/renderer/platform/bindings/parkable_string_test.cc b/third_party/blink/renderer/platform/bindings/parkable_string_test.cc
index 3cdb9dc..b07f73b 100644
--- a/third_party/blink/renderer/platform/bindings/parkable_string_test.cc
+++ b/third_party/blink/renderer/platform/bindings/parkable_string_test.cc
@@ -796,6 +796,7 @@
 }
 
 TEST_F(ParkableStringTest, ReportTotalUnparkingTime) {
+  base::ScopedMockElapsedTimersForTest mock_elapsed_timers;
   base::HistogramTester histogram_tester;
 
   // On some platforms, initialization takes time, though it happens when
@@ -811,7 +812,8 @@
   ParkableString parkable(String(data.data(), data.size()).ReleaseImpl());
 
   ParkAndWait(parkable);
-  for (int i = 0; i < 10; ++i) {
+  const int kNumIterations = 10;
+  for (int i = 0; i < kNumIterations; ++i) {
     parkable.ToString();
     ASSERT_FALSE(parkable.Impl()->is_parked());
     WaitForAging();
@@ -822,16 +824,21 @@
   const size_t compressed_size = parkable.Impl()->compressed_size();
 
   scoped_task_environment_.FastForwardUntilNoTasksRemain();
-  histogram_tester.ExpectTotalCount("Memory.ParkableString.MainThreadTime.5min",
-                                    1);
-  histogram_tester.ExpectBucketCount(
-      "Memory.ParkableString.MainThreadTime.5min", 0, 0);
+
+  // The string is unparked kNumIterations times.
+  histogram_tester.ExpectUniqueSample(
+      "Memory.ParkableString.MainThreadTime.5min",
+      base::ScopedMockElapsedTimersForTest::kMockElapsedTime.InMilliseconds() *
+          kNumIterations,
+      1);
 
   if (base::ThreadTicks::IsSupported()) {
-    histogram_tester.ExpectTotalCount(
-        "Memory.ParkableString.ParkingThreadTime.5min", 1);
-    histogram_tester.ExpectBucketCount(
-        "Memory.ParkableString.ParkingThreadTime.5min", 0, 0);
+    // The string is only compressed once despite the multiple parking/unparking
+    // calls.
+    histogram_tester.ExpectUniqueSample(
+        "Memory.ParkableString.ParkingThreadTime.5min",
+        base::ScopedMockElapsedTimersForTest::kMockElapsedTime.InMilliseconds(),
+        1);
   }
 
   histogram_tester.ExpectUniqueSample("Memory.ParkableString.TotalSizeKb.5min",
diff --git a/third_party/blink/renderer/platform/blob/blob_bytes_provider.cc b/third_party/blink/renderer/platform/blob/blob_bytes_provider.cc
index 12b859ad..123bf4a7 100644
--- a/third_party/blink/renderer/platform/blob/blob_bytes_provider.cc
+++ b/third_party/blink/renderer/platform/blob/blob_bytes_provider.cc
@@ -117,8 +117,8 @@
 // static
 BlobBytesProvider* BlobBytesProvider::CreateAndBind(
     mojom::blink::BytesProviderRequest request) {
-  auto task_runner = base::CreateSequencedTaskRunnerWithTraits(
-      {base::MayBlock(), base::TaskPriority::USER_VISIBLE});
+  auto task_runner = base::CreateSequencedTaskRunner(
+      {base::ThreadPool(), base::MayBlock(), base::TaskPriority::USER_VISIBLE});
   auto provider = base::WrapUnique(new BlobBytesProvider(task_runner));
   auto* result = provider.get();
   // TODO(mek): Consider binding BytesProvider on the IPC thread instead, only
diff --git a/third_party/blink/renderer/platform/exported/mediastream/media_stream_audio_processor.cc b/third_party/blink/renderer/platform/exported/mediastream/media_stream_audio_processor.cc
index 7bcc552..0e39022 100644
--- a/third_party/blink/renderer/platform/exported/mediastream/media_stream_audio_processor.cc
+++ b/third_party/blink/renderer/platform/exported/mediastream/media_stream_audio_processor.cc
@@ -385,8 +385,9 @@
                                      std::move(dump_file), worker_queue_.get());
   } else {
     // Post the file close to avoid blocking the main thread.
-    base::PostTaskWithTraits(
-        FROM_HERE, {base::TaskPriority::LOWEST, base::MayBlock()},
+    base::PostTask(
+        FROM_HERE,
+        {base::ThreadPool(), base::TaskPriority::LOWEST, base::MayBlock()},
         base::BindOnce([](base::File) {}, std::move(dump_file)));
   }
 }
diff --git a/third_party/blink/renderer/platform/exported/mediastream/media_stream_audio_processor_options.cc b/third_party/blink/renderer/platform/exported/mediastream/media_stream_audio_processor_options.cc
index c70fc40c..86fdef7 100644
--- a/third_party/blink/renderer/platform/exported/mediastream/media_stream_audio_processor_options.cc
+++ b/third_party/blink/renderer/platform/exported/mediastream/media_stream_audio_processor_options.cc
@@ -101,6 +101,27 @@
   return echo_cancellation_type == EchoCancellationType::kEchoCancellationAec3;
 }
 
+bool AudioProcessingProperties::HasSameReconfigurableSettings(
+    const AudioProcessingProperties& other) const {
+  return echo_cancellation_type == other.echo_cancellation_type;
+}
+
+bool AudioProcessingProperties::HasSameNonReconfigurableSettings(
+    const AudioProcessingProperties& other) const {
+  return disable_hw_noise_suppression == other.disable_hw_noise_suppression &&
+         goog_audio_mirroring == other.goog_audio_mirroring &&
+         goog_auto_gain_control == other.goog_auto_gain_control &&
+         goog_experimental_echo_cancellation ==
+             other.goog_experimental_echo_cancellation &&
+         goog_typing_noise_detection == other.goog_typing_noise_detection &&
+         goog_noise_suppression == other.goog_noise_suppression &&
+         goog_experimental_noise_suppression ==
+             other.goog_experimental_noise_suppression &&
+         goog_highpass_filter == other.goog_highpass_filter &&
+         goog_experimental_auto_gain_control ==
+             other.goog_experimental_auto_gain_control;
+}
+
 media::AudioProcessingSettings
 AudioProcessingProperties::ToAudioProcessingSettings() const {
   media::AudioProcessingSettings out;
diff --git a/third_party/blink/renderer/platform/exported/mediastream/media_stream_audio_source.cc b/third_party/blink/renderer/platform/exported/mediastream/media_stream_audio_source.cc
index fe3a7ac7..d06b192 100644
--- a/third_party/blink/renderer/platform/exported/mediastream/media_stream_audio_source.cc
+++ b/third_party/blink/renderer/platform/exported/mediastream/media_stream_audio_source.cc
@@ -127,6 +127,33 @@
   return nullptr;
 }
 
+bool MediaStreamAudioSource::HasSameReconfigurableSettings(
+    const blink::AudioProcessingProperties& selected_properties) const {
+  base::Optional<blink::AudioProcessingProperties> configured_properties =
+      GetAudioProcessingProperties();
+  if (!configured_properties)
+    return false;
+
+  return selected_properties.HasSameReconfigurableSettings(
+      *configured_properties);
+}
+
+bool MediaStreamAudioSource::HasSameNonReconfigurableSettings(
+    MediaStreamAudioSource* other_source) const {
+  if (!other_source)
+    return false;
+
+  base::Optional<blink::AudioProcessingProperties> others_properties =
+      other_source->GetAudioProcessingProperties();
+  base::Optional<blink::AudioProcessingProperties> this_properties =
+      GetAudioProcessingProperties();
+
+  if (!others_properties || !this_properties)
+    return false;
+
+  return this_properties->HasSameNonReconfigurableSettings(*others_properties);
+}
+
 void MediaStreamAudioSource::DoChangeSource(
     const MediaStreamDevice& new_device) {
   DCHECK(task_runner_->BelongsToCurrentThread());
diff --git a/third_party/blink/renderer/platform/exported/platform.cc b/third_party/blink/renderer/platform/exported/platform.cc
index 0fd9f40f..da94409 100644
--- a/third_party/blink/renderer/platform/exported/platform.cc
+++ b/third_party/blink/renderer/platform/exported/platform.cc
@@ -208,13 +208,14 @@
   Thread::SetMainThread(std::move(main_thread));
 
   ProcessHeap::Init();
-  MemoryPressureListenerRegistry::Initialize();
   base::trace_event::MemoryDumpManager::GetInstance()->RegisterDumpProvider(
       BlinkGCMemoryDumpProvider::Instance(), "BlinkGC",
       base::ThreadTaskRunnerHandle::Get());
 
   ThreadState::AttachMainThread();
 
+  MemoryPressureListenerRegistry::Initialize();
+
   // font_family_names are used by platform/fonts and are initialized by core.
   // In case core is not available (like on PPAPI plugins), we need to init
   // them here.
diff --git a/third_party/blink/renderer/platform/graphics/compositing/paint_artifact_compositor_test.cc b/third_party/blink/renderer/platform/graphics/compositing/paint_artifact_compositor_test.cc
index a83c2838..7711f6d 100644
--- a/third_party/blink/renderer/platform/graphics/compositing/paint_artifact_compositor_test.cc
+++ b/third_party/blink/renderer/platform/graphics/compositing/paint_artifact_compositor_test.cc
@@ -499,7 +499,8 @@
         CreateTransform(*transform1, TransformationMatrix().Rotate3d(0, 45, 0));
     TransformPaintPropertyNode::State transform3_state{
         TransformationMatrix().Rotate3d(0, 45, 0)};
-    transform3_state.flattens_inherited_transform = transform_is_flattened;
+    transform3_state.flags.flattens_inherited_transform =
+        transform_is_flattened;
     auto transform3 = TransformPaintPropertyNode::Create(
         *transform2, std::move(transform3_state));
 
@@ -552,7 +553,8 @@
     auto transform2 = TransformPaintPropertyNode::CreateAlias(*real_transform2);
     TransformPaintPropertyNode::State transform3_state{
         TransformationMatrix().Rotate3d(0, 45, 0)};
-    transform3_state.flattens_inherited_transform = transform_is_flattened;
+    transform3_state.flags.flattens_inherited_transform =
+        transform_is_flattened;
     auto real_transform3 = TransformPaintPropertyNode::Create(
         *transform2, std::move(transform3_state));
     auto transform3 = TransformPaintPropertyNode::CreateAlias(*real_transform3);
@@ -4032,7 +4034,7 @@
   TransformationMatrix matrix;
   matrix.Scale(2);
   TransformPaintPropertyNode::State transform_state{matrix};
-  transform_state.in_subtree_of_page_scale = false;
+  transform_state.flags.in_subtree_of_page_scale = false;
   transform_state.compositor_element_id =
       CompositorElementIdFromUniqueObjectId(1);
 
@@ -4058,12 +4060,12 @@
 // the page scale transform node or ancestors, and is set on descendants.
 TEST_P(PaintArtifactCompositorTest, InSubtreeOfPageScale) {
   TransformPaintPropertyNode::State ancestor_transform_state;
-  ancestor_transform_state.in_subtree_of_page_scale = false;
+  ancestor_transform_state.flags.in_subtree_of_page_scale = false;
   auto ancestor_transform = TransformPaintPropertyNode::Create(
       TransformPaintPropertyNode::Root(), std::move(ancestor_transform_state));
 
   TransformPaintPropertyNode::State page_scale_transform_state;
-  page_scale_transform_state.in_subtree_of_page_scale = false;
+  page_scale_transform_state.flags.in_subtree_of_page_scale = false;
   page_scale_transform_state.compositor_element_id =
       CompositorElementIdFromUniqueObjectId(1);
   auto page_scale_transform = TransformPaintPropertyNode::Create(
@@ -4072,7 +4074,7 @@
   TransformPaintPropertyNode::State descendant_transform_state;
   descendant_transform_state.compositor_element_id =
       CompositorElementIdFromUniqueObjectId(2);
-  descendant_transform_state.in_subtree_of_page_scale = true;
+  descendant_transform_state.flags.in_subtree_of_page_scale = true;
   descendant_transform_state.direct_compositing_reasons =
       CompositingReason::kWillChangeTransform;
   auto descendant_transform = TransformPaintPropertyNode::Create(
@@ -4111,7 +4113,7 @@
   TransformationMatrix matrix;
   matrix.Scale(2);
   TransformPaintPropertyNode::State transform_state{matrix};
-  transform_state.in_subtree_of_page_scale = false;
+  transform_state.flags.in_subtree_of_page_scale = false;
   transform_state.compositor_element_id =
       CompositorElementIdFromUniqueObjectId(1);
   auto scale_transform_node = TransformPaintPropertyNode::Create(
diff --git a/third_party/blink/renderer/platform/graphics/paint/geometry_mapper_test.cc b/third_party/blink/renderer/platform/graphics/paint/geometry_mapper_test.cc
index 0fc92e1..7ff77ef1 100644
--- a/third_party/blink/renderer/platform/graphics/paint/geometry_mapper_test.cc
+++ b/third_party/blink/renderer/platform/graphics/paint/geometry_mapper_test.cc
@@ -265,7 +265,7 @@
 
   auto inverse_rotate_transform = TransformationMatrix().Rotate3d(-45, 0, 0);
   TransformPaintPropertyNode::State inverse_state{inverse_rotate_transform};
-  inverse_state.flattens_inherited_transform = true;
+  inverse_state.flags.flattens_inherited_transform = true;
   auto transform2 =
       TransformPaintPropertyNode::Create(*transform1, std::move(inverse_state));
   local_state.SetTransform(*transform2);
diff --git a/third_party/blink/renderer/platform/graphics/paint/transform_paint_property_node.cc b/third_party/blink/renderer/platform/graphics/paint/transform_paint_property_node.cc
index 25fde9aa..3faf429 100644
--- a/third_party/blink/renderer/platform/graphics/paint/transform_paint_property_node.cc
+++ b/third_party/blink/renderer/platform/graphics/paint/transform_paint_property_node.cc
@@ -13,10 +13,11 @@
       TransformPaintPropertyNode, root,
       base::AdoptRef(new TransformPaintPropertyNode(
           nullptr,
-          State{FloatSize(), &ScrollPaintPropertyNode::Root(),
-                false /* flattens_inherited_transform */,
-                false /* affected_by_outer_viewport_bounds_delta */,
-                false /* in_subtree_of_page_scale */},
+          State{
+              FloatSize(), &ScrollPaintPropertyNode::Root(),
+              State::Flags{false /* flattens_inherited_transform */,
+                           false /* affected_by_outer_viewport_bounds_delta */,
+                           false /* in_subtree_of_page_scale */}},
           true /* is_parent_alias */)));
   return *root;
 }
@@ -61,9 +62,9 @@
     json->SetString("matrix", Matrix().ToString());
     json->SetString("origin", Origin().ToString());
   }
-  if (!state_.flattens_inherited_transform)
+  if (!state_.flags.flattens_inherited_transform)
     json->SetBoolean("flattensInheritedTransform", false);
-  if (!state_.in_subtree_of_page_scale)
+  if (!state_.flags.in_subtree_of_page_scale)
     json->SetBoolean("in_subtree_of_page_scale", false);
   if (state_.backface_visibility != BackfaceVisibility::kInherited) {
     json->SetString("backface",
diff --git a/third_party/blink/renderer/platform/graphics/paint/transform_paint_property_node.h b/third_party/blink/renderer/platform/graphics/paint/transform_paint_property_node.h
index ba34755..ce73d6c 100644
--- a/third_party/blink/renderer/platform/graphics/paint/transform_paint_property_node.h
+++ b/third_party/blink/renderer/platform/graphics/paint/transform_paint_property_node.h
@@ -125,10 +125,13 @@
   struct State {
     TransformAndOrigin transform_and_origin;
     scoped_refptr<const ScrollPaintPropertyNode> scroll;
-    bool flattens_inherited_transform = false;
-    bool affected_by_outer_viewport_bounds_delta = false;
-    bool in_subtree_of_page_scale = true;
-    bool animation_is_axis_aligned = false;
+    // Use bitfield packing instead of separate bools to save space.
+    struct Flags {
+      bool flattens_inherited_transform : 1;
+      bool affected_by_outer_viewport_bounds_delta : 1;
+      bool in_subtree_of_page_scale : 1;
+      bool animation_is_axis_aligned : 1;
+    } flags = {false, false, true, false};
     BackfaceVisibility backface_visibility = BackfaceVisibility::kInherited;
     unsigned rendering_context_id = 0;
     CompositingReasons direct_compositing_reasons = CompositingReason::kNone;
@@ -138,11 +141,14 @@
     PaintPropertyChangeType ComputeChange(
         const State& other,
         const AnimationState& animation_state) const {
-      if (flattens_inherited_transform != other.flattens_inherited_transform ||
-          affected_by_outer_viewport_bounds_delta !=
-              other.affected_by_outer_viewport_bounds_delta ||
-          in_subtree_of_page_scale != other.in_subtree_of_page_scale ||
-          animation_is_axis_aligned != other.animation_is_axis_aligned ||
+      if (flags.flattens_inherited_transform !=
+              other.flags.flattens_inherited_transform ||
+          flags.affected_by_outer_viewport_bounds_delta !=
+              other.flags.affected_by_outer_viewport_bounds_delta ||
+          flags.in_subtree_of_page_scale !=
+              other.flags.in_subtree_of_page_scale ||
+          flags.animation_is_axis_aligned !=
+              other.flags.animation_is_axis_aligned ||
           backface_visibility != other.backface_visibility ||
           rendering_context_id != other.rendering_context_id ||
           compositor_element_id != other.compositor_element_id ||
@@ -274,13 +280,13 @@
   // used to keep bottom-fixed elements appear fixed to the bottom of the
   // screen in the presence of URL bar movement.
   bool IsAffectedByOuterViewportBoundsDelta() const {
-    return state_.affected_by_outer_viewport_bounds_delta;
+    return state_.flags.affected_by_outer_viewport_bounds_delta;
   }
 
   // If true, this node is a descendant of the page scale transform. This is
   // important for avoiding raster during pinch-zoom (see: crbug.com/951861).
   bool IsInSubtreeOfPageScale() const {
-    return state_.in_subtree_of_page_scale;
+    return state_.flags.in_subtree_of_page_scale;
   }
 
   const cc::LayerStickyPositionConstraint* GetStickyConstraint() const {
@@ -296,7 +302,7 @@
   // the plane of its parent. This is implemented by flattening the total
   // accumulated transform from its ancestors.
   bool FlattensInheritedTransform() const {
-    return state_.flattens_inherited_transform;
+    return state_.flags.flattens_inherited_transform;
   }
 
   // Returns the local BackfaceVisibility value set on this node. To be used
@@ -324,8 +330,8 @@
   bool FlattensInheritedTransformSameAsParent() const {
     if (IsRoot())
       return true;
-    return state_.flattens_inherited_transform ==
-           Parent()->Unalias().state_.flattens_inherited_transform;
+    return state_.flags.flattens_inherited_transform ==
+           Parent()->Unalias().state_.flags.flattens_inherited_transform;
   }
 
   // Returns the first non-inherited BackefaceVisibility value along the
@@ -360,7 +366,7 @@
            CompositingReason::kActiveTransformAnimation;
   }
   bool TransformAnimationIsAxisAligned() const {
-    return state_.animation_is_axis_aligned;
+    return state_.flags.animation_is_axis_aligned;
   }
 
   bool RequiresCompositingForRootScroller() const {
diff --git a/third_party/blink/renderer/platform/heap/cancelable_task_scheduler.cc b/third_party/blink/renderer/platform/heap/cancelable_task_scheduler.cc
index e0af134..482d431 100644
--- a/third_party/blink/renderer/platform/heap/cancelable_task_scheduler.cc
+++ b/third_party/blink/renderer/platform/heap/cancelable_task_scheduler.cc
@@ -22,10 +22,8 @@
 
   ~TaskData() {
     // The task runner is responsible for unregistering the task in case the
-    // task hasn't been cancelled. The first check returns true if the task
-    // hasn't been executed, the second returns true if it has.
-    Status previous;
-    if (TryRun(&previous) || previous == kRunning) {
+    // task hasn't been cancelled.
+    if (TryCancel()) {
       scheduler_->UnregisterAndSignal(this);
     }
   }
@@ -33,6 +31,7 @@
   void Run() {
     if (TryRun()) {
       std::move(task_).Run();
+      scheduler_->UnregisterAndSignal(this);
     }
   }
 
@@ -51,17 +50,11 @@
   // |kRunning|: The task is currently running and cannot be canceled anymore.
   enum Status : uint8_t { kWaiting, kCancelled, kRunning };
 
-  friend size_t RemoveCancelledTasks(WTF::HashSet<TaskData*>*);
-
-  bool TryRun(Status* previous = nullptr) {
+  bool TryRun() {
     Status expected = kWaiting;
-    const bool success = status_.compare_exchange_strong(
-        expected, kRunning, std::memory_order_acq_rel,
-        std::memory_order_acquire);
-    if (previous) {
-      *previous = expected;
-    }
-    return success;
+    return status_.compare_exchange_strong(expected, kRunning,
+                                           std::memory_order_acq_rel,
+                                           std::memory_order_acquire);
   }
 
   Task task_;
@@ -98,8 +91,8 @@
 
 std::unique_ptr<CancelableTaskScheduler::TaskData>
 CancelableTaskScheduler::Register(Task task) {
-  base::AutoLock lock(lock_);
   auto task_data = std::make_unique<TaskData>(std::move(task), this);
+  base::AutoLock lock(lock_);
   tasks_.insert(task_data.get());
   return task_data;
 }
diff --git a/third_party/blink/renderer/platform/instrumentation/memory_pressure_listener.cc b/third_party/blink/renderer/platform/instrumentation/memory_pressure_listener.cc
index c2b7361..deb1822 100644
--- a/third_party/blink/renderer/platform/instrumentation/memory_pressure_listener.cc
+++ b/third_party/blink/renderer/platform/instrumentation/memory_pressure_listener.cc
@@ -51,6 +51,10 @@
 void MemoryPressureListenerRegistry::Initialize() {
   is_low_end_device_ = ::base::SysInfo::IsLowEndDevice();
   ApproximatedDeviceMemory::Initialize();
+  // Make sure the instance of MemoryPressureListenerRegistry is created on
+  // the main thread. Otherwise we might try to create the instance on a
+  // thread which doesn't have ThreadState (e.g., the IO thread).
+  MemoryPressureListenerRegistry::Instance();
 }
 
 // static
diff --git a/third_party/blink/renderer/platform/mediastream/audio_service_audio_processor_proxy.cc b/third_party/blink/renderer/platform/mediastream/audio_service_audio_processor_proxy.cc
index 4630f85e..e696e89 100644
--- a/third_party/blink/renderer/platform/mediastream/audio_service_audio_processor_proxy.cc
+++ b/third_party/blink/renderer/platform/mediastream/audio_service_audio_processor_proxy.cc
@@ -59,8 +59,9 @@
     processor_controls_->StartEchoCancellationDump(std::move(dump_file));
   } else {
     // Post the file close to avoid blocking the main thread.
-    base::PostTaskWithTraits(
-        FROM_HERE, {base::TaskPriority::LOWEST, base::MayBlock()},
+    base::PostTask(
+        FROM_HERE,
+        {base::ThreadPool(), base::TaskPriority::LOWEST, base::MayBlock()},
         base::BindOnce([](base::File) {}, std::move(dump_file)));
   }
 }
diff --git a/third_party/blink/renderer/platform/scheduler/TaskSchedulingInBlink.md b/third_party/blink/renderer/platform/scheduler/TaskSchedulingInBlink.md
index e65265e..1e7ba82 100644
--- a/third_party/blink/renderer/platform/scheduler/TaskSchedulingInBlink.md
+++ b/third_party/blink/renderer/platform/scheduler/TaskSchedulingInBlink.md
@@ -155,7 +155,7 @@
 behind the scenes.
 
 Do not create your own dedicated thread if you need ordering for your tasks,
-use worker_pool::CreateTaskRunnerWithTraits instead —
+use worker_pool::CreateTaskRunner instead —
 this creates a sequence (virtual thread which can run tasks in order on
 any of the threads in the thread pool).
 (Note: this doesn't exist yet because we haven't encountered a use case in Blink
diff --git a/third_party/blink/renderer/platform/scheduler/common/worker_pool.cc b/third_party/blink/renderer/platform/scheduler/common/worker_pool.cc
index cad9a8d..50634f1 100644
--- a/third_party/blink/renderer/platform/scheduler/common/worker_pool.cc
+++ b/third_party/blink/renderer/platform/scheduler/common/worker_pool.cc
@@ -12,16 +12,17 @@
 namespace worker_pool {
 
 void PostTask(const base::Location& location, CrossThreadOnceClosure closure) {
-  PostTaskWithTraits(location,
-                     {base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
-                     std::move(closure));
+  PostTask(
+      location,
+      {base::ThreadPool(), base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
+      std::move(closure));
 }
 
-void PostTaskWithTraits(const base::Location& location,
-                        const base::TaskTraits& traits,
-                        CrossThreadOnceClosure closure) {
-  base::PostTaskWithTraits(location, traits,
-                           ConvertToBaseOnceCallback(std::move(closure)));
+void PostTask(const base::Location& location,
+              const base::TaskTraits& traits,
+              CrossThreadOnceClosure closure) {
+  base::PostTask(location, traits,
+                 ConvertToBaseOnceCallback(std::move(closure)));
 }
 
 }  // namespace worker_pool
diff --git a/third_party/blink/renderer/platform/scheduler/public/worker_pool.h b/third_party/blink/renderer/platform/scheduler/public/worker_pool.h
index 7400971..e801685 100644
--- a/third_party/blink/renderer/platform/scheduler/public/worker_pool.h
+++ b/third_party/blink/renderer/platform/scheduler/public/worker_pool.h
@@ -27,11 +27,11 @@
 // (e.g. FrameScheduler for main thread tasks).
 PLATFORM_EXPORT void PostTask(const base::Location&, CrossThreadOnceClosure);
 
-PLATFORM_EXPORT void PostTaskWithTraits(const base::Location&,
-                                        const base::TaskTraits&,
-                                        CrossThreadOnceClosure);
+PLATFORM_EXPORT void PostTask(const base::Location&,
+                              const base::TaskTraits&,
+                              CrossThreadOnceClosure);
 
-// TODO(altimin): Expose CreateSequencedTaskRunnerWithTraits when the
+// TODO(altimin): Expose CreateSequencedTaskRunner when the
 // need arises.
 
 }  // namespace worker_pool
diff --git a/third_party/blink/tools/blinkpy/presubmit/audit_non_blink_usage.py b/third_party/blink/tools/blinkpy/presubmit/audit_non_blink_usage.py
index 3989bb54..00c9188 100755
--- a/third_party/blink/tools/blinkpy/presubmit/audit_non_blink_usage.py
+++ b/third_party/blink/tools/blinkpy/presubmit/audit_non_blink_usage.py
@@ -33,7 +33,7 @@
             'base::AdoptRef',
             'base::AutoReset',
             'base::Contains',
-            'base::CreateSequencedTaskRunnerWithTraits',
+            'base::CreateSequencedTaskRunner',
             'base::DefaultTickClock',
             'base::ElapsedTimer',
             'base::File',
@@ -182,6 +182,7 @@
             'base::TaskPriority',
             'base::TaskShutdownBehavior',
             'base::WithBaseSyncPrimitives',
+            'base::ThreadPool',
 
             # Byte order
             'base::ByteSwap',
diff --git a/third_party/blink/web_tests/NeverFixTests b/third_party/blink/web_tests/NeverFixTests
index fe8f8cd8..29adf27d 100644
--- a/third_party/blink/web_tests/NeverFixTests
+++ b/third_party/blink/web_tests/NeverFixTests
@@ -1622,6 +1622,7 @@
 
 # Requires --use-fake-ui-for-media-stream to run.
 external/wpt/mediacapture-streams/MediaStream-default-feature-policy.https.html [ WontFix ]
+virtual/audio-service/external/wpt/mediacapture-streams/MediaStream-default-feature-policy.https.html [ WontFix ]
 
 # These directories have manual tests that don't have to run with
 # run_web_tests.py; see https://crbug.com/359838.
@@ -2137,6 +2138,8 @@
 virtual/blink-cors/external/wpt/xhr/send-authentication-prompt-2-manual.htm [ WontFix ]
 virtual/feature-policy-permissions/external/wpt/mediacapture-streams/MediaStream-MediaElement-preload-none-manual.https.html [ WontFix ]
 virtual/feature-policy-permissions/external/wpt/mediacapture-streams/MediaStreamTrack-end-manual.https.html [ WontFix ]
+virtual/audio-service/external/wpt/mediacapture-streams/MediaStream-MediaElement-preload-none-manual.https.html [ WontFix ]
+virtual/audio-service/external/wpt/mediacapture-streams/MediaStreamTrack-end-manual.https.html [ WontFix ]
 virtual/omt-worker-fetch/external/wpt/service-workers/service-worker/fetch-event-is-history-backward-navigation-manual.https.html [ WontFix ]
 virtual/omt-worker-fetch/external/wpt/service-workers/service-worker/fetch-event-is-history-forward-navigation-manual.https.html [ WontFix ]
 virtual/omt-worker-fetch/external/wpt/service-workers/service-worker/fetch-event-is-reload-navigation-manual.https.html [ WontFix ]
@@ -2245,6 +2248,7 @@
 crbug.com/946022 [ Win7 ] images/image-zoom-to-25.html [ WontFix ]
 crbug.com/946022 [ Win7 ] images/image-zoom-to-500.html [ WontFix ]
 crbug.com/946022 [ Win7 ] media/controls/overflow-menu-hide-on-resize.html [ WontFix ]
+crbug.com/946022 [ Win7 ] virtual/audio-service/media/controls/overflow-menu-hide-on-resize.html [ WontFix ]
 crbug.com/946022 [ Win7 ] paint/invalidation/resize-iframe-text.html [ WontFix ]
 crbug.com/946022 [ Win7 ] paint/invalidation/scroll/scrollbar-damage-and-full-viewport-repaint.html [ WontFix ]
 crbug.com/946022 [ Win7 ] paint/invalidation/window-resize/ [ WontFix ]
diff --git a/third_party/blink/web_tests/SlowTests b/third_party/blink/web_tests/SlowTests
index 3b4112f4..b0f70fc 100644
--- a/third_party/blink/web_tests/SlowTests
+++ b/third_party/blink/web_tests/SlowTests
@@ -44,6 +44,8 @@
 crbug.com/24182 jquery/traversing.html [ Slow ]
 crbug.com/24182 media/controls/controls-cast-do-not-fade-out.html [ Slow ]
 crbug.com/24182 media/controls/controls-cast-overlay-slow-fade.html [ Slow ]
+crbug.com/24182 virtual/audio-service/media/controls/controls-cast-do-not-fade-out.html [ Slow ]
+crbug.com/24182 virtual/audio-service/media/controls/controls-cast-overlay-slow-fade.html [ Slow ]
 crbug.com/24182 svg/filters/big-sized-filter.svg [ Slow ]
 crbug.com/24182 tables/mozilla/other/slashlogo.html [ Slow ]
 crbug.com/24182 fast/canvas/color-space/canvas-colorManaged-toBlob-toDataURL.html [ Slow ]
@@ -117,6 +119,10 @@
 crbug.com/73609 http/tests/media/video-preload-metadata.html [ Slow ]
 crbug.com/869829 http/tests/media/video-cancel-load.html [ Slow ]
 crbug.com/870259 http/tests/media/video-throttled-load-metadata.html [ Slow ]
+crbug.com/73609 virtual/audio-service/http/tests/media/video-play-stall.html [ Slow ]
+crbug.com/73609 virtual/audio-service/http/tests/media/video-preload-metadata.html [ Slow ]
+crbug.com/869829 virtual/audio-service/http/tests/media/video-cancel-load.html [ Slow ]
+crbug.com/870259 virtual/audio-service/http/tests/media/video-throttled-load-metadata.html [ Slow ]
 
 # Many of the virtual animations tests are slow.
 crbug.com/243871 virtual/threaded/fast/scroll-behavior/ [ Slow ]
@@ -150,6 +156,7 @@
 crbug.com/346259 http/tests/websocket/no-crash-on-cookie-flood.html [ Slow ]
 
 crbug.com/522646 http/tests/media/encrypted-media/encrypted-media-encrypted-event-different-origin.html [ Slow ]
+crbug.com/522646 virtual/audio-service/http/tests/media/encrypted-media/encrypted-media-encrypted-event-different-origin.html [ Slow ]
 crbug.com/411164 [ Win ] http/tests/security/powerfulFeatureRestrictions/serviceworker-on-insecure-origin.html [ Slow ]
 crbug.com/411164 [ Win ] virtual/blink-cors/http/tests/security/powerfulFeatureRestrictions/serviceworker-on-insecure-origin.html [ Slow ]
 crbug.com/510337 http/tests/devtools/console/console-format.js [ Slow ]
@@ -216,6 +223,7 @@
 
 # Media controls tests have to wait for panel to fade out.
 crbug.com/722825 media/controls/video-enter-exit-fullscreen-without-hovering-doesnt-show-controls.html [ Slow ]
+crbug.com/722825 virtual/audio-service/media/controls/video-enter-exit-fullscreen-without-hovering-doesnt-show-controls.html [ Slow ]
 
 crbug.com/719298 fast/dnd/dropEffect-for-effectAllowed.html [ Slow ]
 
@@ -229,6 +237,7 @@
 crbug.com/451577 [ Linux ] http/tests/devtools/layers/layer-canvas-log.js [ Slow ]
 
 crbug.com/793771 media/controls/scrubbing.html [ Slow ]
+crbug.com/793771 virtual/audio-service/media/controls/scrubbing.html [ Slow ]
 
 # These tests need to do many iterations and so can't be fast.
 crbug.com/748418 http/tests/streams/chromium/deep-recursion-getwriter.html [ Slow ]
@@ -269,8 +278,10 @@
 crbug.com/864887 [ Mac ] fast/scroll-snap/snaps-after-scrollbar-scrolling.html [ Slow ]
 
 crbug.com/865262 [ Mac ] media/controls/text-track-menu-pointer-selection.html [ Slow ]
+crbug.com/865262 [ Mac ] virtual/audio-service/media/controls/text-track-menu-pointer-selection.html [ Slow ]
 
 crbug.com/942951 media/controls/controls-layout-in-different-size.html [ Slow ]
+crbug.com/942951 virtual/audio-service/media/controls/controls-layout-in-different-size.html [ Slow ]
 
 crbug.com/910627 webexposed/global-interface-listing-shared-worker.html [ Slow ]
 crbug.com/910627 virtual/stable/webexposed/global-interface-listing-shared-worker.html [ Slow ]
@@ -435,6 +446,11 @@
 crbug.com/874695 http/tests/media/video-buffered.html [ Slow ]
 crbug.com/874695 http/tests/media/video-load-metadata-decode-error.html [ Slow ]
 crbug.com/874695 http/tests/media/video-play-stall-before-meta-data.html [ Slow ]
+crbug.com/874695 virtual/audio-service/http/tests/media/controls/toggle-class-with-state-source-buffer.html [ Slow ]
+crbug.com/874695 virtual/audio-service/http/tests/media/preload-conditions.html [ Slow ]
+crbug.com/874695 virtual/audio-service/http/tests/media/video-buffered.html [ Slow ]
+crbug.com/874695 virtual/audio-service/http/tests/media/video-load-metadata-decode-error.html [ Slow ]
+crbug.com/874695 virtual/audio-service/http/tests/media/video-play-stall-before-meta-data.html [ Slow ]
 crbug.com/874695 http/tests/misc/adopt-iframe-src-attr-after-remove.html [ Slow ]
 crbug.com/874695 http/tests/misc/async-script-removed.html [ Slow ]
 crbug.com/874695 http/tests/misc/client-hints-accept-meta-preloader.html [ Slow ]
@@ -493,6 +509,27 @@
 crbug.com/874695 media/video-controls-visibility-multimodal-mouse-after-touch.html [ Slow ]
 crbug.com/874695 media/video-controls-visibility-multimodal-touch-after-mouse.html [ Slow ]
 crbug.com/874695 media/video-played-collapse.html [ Slow ]
+crbug.com/874695 virtual/audio-service/media/audio-controls-do-not-fade-out.html [ Slow ]
+crbug.com/874695 virtual/audio-service/media/autoplay-muted.html [ Slow ]
+crbug.com/874695 virtual/audio-service/media/color-profile-video-seek-filter.html [ Slow ]
+crbug.com/874695 virtual/audio-service/media/controls/video-enter-exit-fullscreen-while-hovering-shows-controls.html [ Slow ]
+crbug.com/874695 virtual/audio-service/media/encrypted-media/encrypted-media-onencrypted.html [ Slow ]
+crbug.com/874695 virtual/audio-service/media/encrypted-media/encrypted-media-setmediakeys-at-same-time.html [ Slow ]
+crbug.com/874695 virtual/audio-service/media/media-controls-tap-show-controls-without-activating.html [ Slow ]
+crbug.com/874695 virtual/audio-service/media/media-ended.html [ Slow ]
+crbug.com/874695 virtual/audio-service/media/remoteplayback/prompt-twice-throws.html [ Slow ]
+crbug.com/874695 virtual/audio-service/media/track/track-cue-gc-wrapper.html [ Slow ]
+crbug.com/874695 virtual/audio-service/media/unsupported-rtsp.html [ Slow ]
+crbug.com/874695 virtual/audio-service/media/video-controls-always-visible-when-control-hovered.html [ Slow ]
+crbug.com/874695 virtual/audio-service/media/video-controls-auto-hide-after-play-by-touch.html [ Slow ]
+crbug.com/874695 virtual/audio-service/media/video-controls-dont-show-on-focus-when-disabled.html [ Slow ]
+crbug.com/874695 virtual/audio-service/media/video-controls-focus-movement-on-hide.html [ Slow ]
+crbug.com/874695 virtual/audio-service/media/video-controls-hide-after-touch-on-control.html [ Slow ]
+crbug.com/874695 virtual/audio-service/media/video-controls-hide-on-move-outside-controls.html [ Slow ]
+crbug.com/874695 virtual/audio-service/media/video-controls-show-on-focus.html [ Slow ]
+crbug.com/874695 virtual/audio-service/media/video-controls-visibility-multimodal-mouse-after-touch.html [ Slow ]
+crbug.com/874695 virtual/audio-service/media/video-controls-visibility-multimodal-touch-after-mouse.html [ Slow ]
+crbug.com/874695 virtual/audio-service/media/video-played-collapse.html [ Slow ]
 crbug.com/874695 paint/invalidation/filters/filter-repaint-accelerated-child-with-filter-child.html [ Slow ]
 crbug.com/874695 paint/invalidation/filters/filter-repaint-accelerated-on-accelerated-filter.html [ Slow ]
 crbug.com/874695 paint/invalidation/filters/filter-repaint-on-accelerated-layer.html [ Slow ]
@@ -604,6 +641,7 @@
 crbug.com/893015 [ Linux ] virtual/streaming-preload/http/tests/fetch/chromium/response-text-gc-crash.html [ Slow ]
 
 crbug.com/914981 [ Mac ] media/controls/overflow-menu-pointer-selection.html [ Slow ]
+crbug.com/914981 [ Mac ] virtual/audio-service/media/controls/overflow-menu-pointer-selection.html [ Slow ]
 crbug.com/914981 [ Mac ] virtual/mouseevent_fractional/fast/events/no-fake-mousemove.html [ Slow ]
 crbug.com/914981 [ Mac ] fast/events/no-fake-mousemove.html [ Slow ]
 
diff --git a/third_party/blink/web_tests/TestExpectations b/third_party/blink/web_tests/TestExpectations
index cb9ac21d..2f048a4 100644
--- a/third_party/blink/web_tests/TestExpectations
+++ b/third_party/blink/web_tests/TestExpectations
@@ -39,6 +39,7 @@
 # These two are left over from crbug.com/881040, I rebaselined them twice and
 # they continue to fail.
 crbug.com/881040 media/controls/lazy-loaded-style.html [ Failure Pass ]
+crbug.com/881040 virtual/audio-service/media/controls/lazy-loaded-style.html [ Failure Pass ]
 
 # With --enable-display-compositor-pixel-dump enabled by default, these three
 # tests fail. See crbug.com/887140 for more info.
@@ -75,8 +76,10 @@
 crbug.com/801992 http/tests/misc/iframe-script-modify-attr.html [ Pass Crash ]
 crbug.com/819800 external/wpt/payment-request/allowpaymentrequest/setting-allowpaymentrequest-timing.https.sub.html [ Failure ]
 crbug.com/872952 http/tests/media/autoplay/document-user-activation-feature-policy-iframe-no-gesture.html [ Failure Pass Timeout ]
+crbug.com/872952 virtual/audio-service/http/tests/media/autoplay/document-user-activation-feature-policy-iframe-no-gesture.html [ Failure Pass Timeout ]
 crbug.com/895001 external/wpt/html/user-activation/message-event-activation-api-iframe-cross-origin.sub.tentative.html [ Timeout Pass ]
 crbug.com/895001 http/tests/media/autoplay/webaudio-autoplay-iframe-with-gesture.html [ Timeout Pass ]
+crbug.com/895001 virtual/audio-service/http/tests/media/autoplay/webaudio-autoplay-iframe-with-gesture.html [ Timeout Pass ]
 crbug.com/901502 http/tests/devtools/oopif/oopif-storage.js [ Pass Failure ]
 crbug.com/906879 http/tests/inspector-protocol/network/navigation-blocking-xorigin-iframe.js [ Pass Failure ]
 crbug.com/949003 http/tests/printing/cross-site-frame-scrolled.html [ Pass Failure ]
@@ -535,11 +538,13 @@
 crbug.com/949909 external/wpt/css/css-text-decor/text-decoration-040-manual.html [ Skip ]
 
 crbug.com/722825 media/controls/video-enter-exit-fullscreen-while-hovering-shows-controls.html [ Timeout Pass ]
+crbug.com/722825 virtual/audio-service/media/controls/video-enter-exit-fullscreen-while-hovering-shows-controls.html [ Timeout Pass ]
 
 #### crbug.com/783229 overflow
 crbug.com/724701 overflow/overflow-basic-004.html [ Failure ]
 
 crbug.com/846753 [ Mac ] http/tests/media/reload-after-dialog.html [ Failure Pass Timeout ]
+crbug.com/846753 [ Mac ] virtual/audio-service/http/tests/media/reload-after-dialog.html [ Failure Pass Timeout ]
 
 ### external/wpt/css/css-tables/
 crbug.com/598134 external/wpt/css/css-tables/table-has-box-sizing-border-box-002.html [ Failure ]
@@ -863,6 +868,7 @@
 crbug.com/591099 [ Mac ] images/feature-policy-oversized-images-resize.html [ Failure ]
 crbug.com/974717 [ Linux ] images/feature-policy-oversized-images-resize.html [ Failure Pass ]
 # crbug.com/591099 [ Mac10.11 ] media/track/track-cue-rendering-position-auto-rtl.html [ Failure ]
+crbug.com/591099 [ Mac10.11 ] virtual/audio-service/media/track/track-cue-rendering-position-auto-rtl.html [ Failure ]
 crbug.com/591099 [ Mac10.11 ] virtual/scalefactor200/fast/hidpi/static/popup-menu-appearance.html [ Failure ]
 crbug.com/591099 [ Mac10.13 ] compositing/geometry/root-layer-update.html [ Failure ]
 crbug.com/591099 [ Mac10.13 ] compositing/overlap-blending/reflection-opacity-huge.html [ Failure ]
@@ -1170,7 +1176,9 @@
 crbug.com/591099 [ Mac10.13 ] images/imagemap-focus-ring.html [ Failure ]
 crbug.com/591099 [ Mac10.13 ] images/imagemap-overflowing-polygon-focus-ring.html [ Failure ]
 crbug.com/591099 [ Mac10.13 ] media/video-colorspace-yuv420.html [ Failure ]
+crbug.com/591099 [ Mac10.13 ] virtual/audio-service/media/video-colorspace-yuv420.html [ Failure ]
 crbug.com/591099 [ Mac10.13 ] media/video-empty-source.html [ Failure ]
+crbug.com/591099 [ Mac10.13 ] virtual/audio-service/media/video-empty-source.html [ Failure ]
 crbug.com/591099 [ Mac10.13 ] paint/invalidation/background/background-misaligned.html [ Failure ]
 crbug.com/591099 [ Mac10.13 ] paint/invalidation/block-no-inflow-children.html [ Failure ]
 crbug.com/591099 [ Mac10.13 ] paint/invalidation/bugzilla-7235.html [ Failure ]
@@ -2269,10 +2277,14 @@
 crbug.com/280342 [ Mac ] http/tests/media/progress-events-generated-correctly.html [ Failure Pass ]
 crbug.com/280342 [ Linux ] http/tests/media/progress-events-generated-correctly.html [ Failure Pass ]
 crbug.com/280342 [ Win ] http/tests/media/progress-events-generated-correctly.html [ Failure Pass ]
+crbug.com/280342 [ Mac ] virtual/audio-service/http/tests/media/progress-events-generated-correctly.html [ Failure Pass ]
+crbug.com/280342 [ Linux ] virtual/audio-service/http/tests/media/progress-events-generated-correctly.html [ Failure Pass ]
+crbug.com/280342 [ Win ] virtual/audio-service/http/tests/media/progress-events-generated-correctly.html [ Failure Pass ]
 
 crbug.com/520736 [ Win7 ] media/W3C/video/networkState/networkState_during_progress.html [ Failure Pass ]
 crbug.com/520736 [ Linux ] media/W3C/video/networkState/networkState_during_progress.html [ Failure Pass ]
 crbug.com/909095 [ Mac ] media/W3C/video/networkState/networkState_during_progress.html [ Failure Pass ]
+crbug.com/909095 virtual/audio-service/media/W3C/video/networkState/networkState_during_progress.html [ Failure Pass ]
 
 crbug.com/862716 [ Mac ] css3/filters/effect-brightness-clamping-hw.html [ Failure Pass Timeout ]
 crbug.com/862716 [ Linux ] css3/filters/effect-brightness-clamping-hw.html [ Failure Pass Timeout ]
@@ -2341,6 +2353,7 @@
 
 crbug.com/432129 html/marquee/marquee-scroll.html [ Failure Pass ]
 crbug.com/326139 crbug.com/390125 media/video-frame-accurate-seek.html [ Failure Pass ]
+crbug.com/326139 crbug.com/390125 virtual/audio-service/media/video-frame-accurate-seek.html [ Failure Pass ]
 crbug.com/421283 html/marquee/marquee-scrollamount.html [ Pass Failure ]
 
 # TODO(oshima): Mac Android are currently not supported.
@@ -2422,6 +2435,7 @@
 
 crbug.com/688613 external/wpt/mediacapture-streams/MediaStreamTrack-MediaElement-disabled-audio-is-silence.https.html [ Skip ]
 crbug.com/688613 virtual/feature-policy-permissions/external/wpt/mediacapture-streams/MediaStreamTrack-MediaElement-disabled-audio-is-silence.https.html [ Skip ]
+crbug.com/688613 virtual/audio-service/external/wpt/mediacapture-streams/MediaStreamTrack-MediaElement-disabled-audio-is-silence.https.html [ Skip ]
 
 
 crbug.com/766135 fast/dom/Window/redirect-with-timer.html [ Timeout Pass ]
@@ -2568,6 +2582,7 @@
 crbug.com/467635 fast/dom/HTMLImageElement/image-sizes-meta-viewport.html [ Skip ]
 
 crbug.com/636239 [ Win7 ] media/video-zoom-controls.html [ Failure ]
+crbug.com/636239 [ Win7 ] virtual/audio-service/media/video-zoom-controls.html [ Failure ]
 
 # The spec for "Propagation to the Initial Containing Block" was changed.
 # https://drafts.csswg.org/css-writing-modes-4/#icb
@@ -2625,11 +2640,13 @@
 crbug.com/658305 css3/filters/filter-effect-removed.html [ Failure Pass ]
 
 crbug.com/524160 [ Debug ] http/tests/media/media-source/stream_memory_tests/mediasource-appendbuffer-quota-exceeded-default-buffers.html [ Timeout ]
+crbug.com/524160 [ Debug ] virtual/audio-service/http/tests/media/media-source/stream_memory_tests/mediasource-appendbuffer-quota-exceeded-default-buffers.html [ Timeout ]
 
 # Run the tests with the default MSE buffer sizes in the main test suite and the tests for 1MB buffers set via command line in a virtual test suite
 # with the --mse-audio-buffer-size-limit=1048576 and --mse-video-buffer-size-limit=1048576 command-line parameters.
 crbug.com/630342 virtual/mse-1mb-buffers/http/tests/media/media-source/stream_memory_tests/mediasource-appendbuffer-quota-exceeded-default-buffers.html [ Skip ]
 crbug.com/630342 http/tests/media/media-source/stream_memory_tests/mediasource-appendbuffer-quota-exceeded-1mb-buffers.html [ Skip ]
+crbug.com/630342 virtual/audio-service/http/tests/media/media-source/stream_memory_tests/mediasource-appendbuffer-quota-exceeded-1mb-buffers.html [ Skip ]
 
 # On these platforms (all but Android) media tests don't currently use gpu-accelerated (proprietary) codecs, so no
 # benefit to running them again with gpu acceleration enabled.
@@ -2641,7 +2658,9 @@
 crbug.com/467477 fast/multicol/vertical-rl/nested-columns.html [ Failure ]
 
 crbug.com/400841 media/video-canvas-draw.html [ Failure ]
+crbug.com/400841 virtual/audio-service/media/video-canvas-draw.html [ Failure ]
 crbug.com/400829 virtual/stable/media/stable/video-object-fit-stable.html [ Failure ]
+crbug.com/400829 virtual/audio-service/media/stable/video-object-fit-stable.html [ Failure ]
 
 # These contain faulty expectations. https://chromium-review.googlesource.com/c/v8/v8/+/1350790 should fix the
 # faulty return values but to allow landing that patch, the tests have to be deactivated in the meanwhile.
@@ -3020,12 +3039,18 @@
 crbug.com/654477 fast/layers/video-layer.html [ Failure ]
 # These could likely be removed - see https://chromium-review.googlesource.com/c/chromium/src/+/1252141
 crbug.com/654477 media/controls-focus-ring.html [ Failure ]
+crbug.com/654477 virtual/audio-service/media/controls-focus-ring.html [ Failure ]
 crbug.com/654477 [ Mac10.10 ] http/tests/media/video-buffered-range-contains-currentTime.html [ Failure ]
 crbug.com/654477 [ Mac10.11 ] http/tests/media/video-buffered-range-contains-currentTime.html [ Failure ]
 crbug.com/654477 [ Retina ] http/tests/media/video-buffered-range-contains-currentTime.html [ Failure ]
 crbug.com/638621 [ Win7 ] http/tests/media/video-buffered-range-contains-currentTime.html [ Failure ]
+crbug.com/654477 [ Mac10.10 ] virtual/audio-service/http/tests/media/video-buffered-range-contains-currentTime.html [ Failure ]
+crbug.com/654477 [ Mac10.11 ] virtual/audio-service/http/tests/media/video-buffered-range-contains-currentTime.html [ Failure ]
+crbug.com/654477 [ Retina ] virtual/audio-service/http/tests/media/video-buffered-range-contains-currentTime.html [ Failure ]
+crbug.com/638621 [ Win7 ] virtual/audio-service/http/tests/media/video-buffered-range-contains-currentTime.html [ Failure ]
 
 crbug.com/637930 http/tests/media/video-buffered.html [ Pass Failure ]
+crbug.com/637930 virtual/audio-service/http/tests/media/video-buffered.html [ Pass Failure ]
 
 crbug.com/613659 external/wpt/quirks/percentage-height-calculation.html [ Failure ]
 crbug.com/613661 external/wpt/quirks/table-cell-nowrap-minimum-width-calculation.html [ Failure ]
@@ -3298,6 +3323,16 @@
 crbug.com/785230 external/wpt/css/css-text-decor/text-decoration-thickness-vertical-002.html [ Failure ]
 
 # ====== New tests from wpt-importer added here ======
+crbug.com/626703 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-rule-nested-balancing-002.html [ Failure ]
+crbug.com/626703 external/wpt/css/css-multicol/multicol-breaking-000.html [ Failure ]
+crbug.com/626703 external/wpt/css/css-multicol/multicol-breaking-001.html [ Failure ]
+crbug.com/626703 external/wpt/css/css-multicol/multicol-breaking-nobackground-000.html [ Failure ]
+crbug.com/626703 external/wpt/css/css-multicol/multicol-span-all-rule-001.html [ Failure ]
+crbug.com/626703 external/wpt/css/css-multicol/multicol-breaking-nobackground-001.html [ Failure ]
+crbug.com/626703 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-span-all-rule-001.html [ Failure ]
+crbug.com/626703 external/wpt/css/css-multicol/multicol-rule-nested-balancing-002.html [ Failure ]
+crbug.com/626703 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-rule-nested-balancing-001.html [ Failure ]
+crbug.com/626703 external/wpt/css/css-multicol/multicol-rule-nested-balancing-001.html [ Failure ]
 crbug.com/626703 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-span-all-children-height-005.html [ Failure ]
 crbug.com/626703 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-span-all-children-height-004a.html [ Failure ]
 crbug.com/626703 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-span-all-children-height-004b.html [ Failure ]
@@ -3570,6 +3605,7 @@
 crbug.com/626703 external/wpt/webvtt/rendering/cues-with-video/processing-model/bidi/start_alignment.html [ Failure ]
 crbug.com/626703 [ Retina ] external/wpt/html/browsers/the-window-object/apis-for-creating-and-navigating-browsing-contexts-by-name/open-features-tokenization-top-left.html [ Timeout ]
 crbug.com/626703 external/wpt/mediacapture-streams/MediaStream-MediaElement-srcObject.https.html [ Timeout ]
+crbug.com/626703 virtual/audio-service/external/wpt/mediacapture-streams/MediaStream-MediaElement-srcObject.https.html [ Timeout ]
 crbug.com/626703 virtual/feature-policy-permissions/external/wpt/mediacapture-streams/MediaStream-MediaElement-srcObject.https.html [ Timeout ]
 crbug.com/626703 [ Linux ] external/wpt/html/cross-origin/anonymous.tentative.html [ Failure Crash ]
 crbug.com/626703 [ Mac10.12 ] external/wpt/html/cross-origin/anonymous.tentative.html [ Failure Crash ]
@@ -4839,6 +4875,8 @@
 #crbug.com/765738 [ Linux Win Mac ] http/tests/wasm/wasm_remote_postMessage_test.https.html [ Pass Timeout ]
 crbug.com/892212 http/tests/wasm/wasm_remote_postMessage_test.https.html [ Pass Failure Timeout ]
 
+crbug.com/990331 virtual/audio-service/http/tests/media/media-source/mediasource-play.html [ Pass Timeout ]
+
 # ====== Random order flaky tests from here ======
 # These tests are flaky when run in random order, which is the default on Linux & Mac since since 2016-12-16.
 
@@ -4919,6 +4957,7 @@
 
 crbug.com/689781 external/wpt/media-source/mediasource-duration.html [ Failure Pass ]
 crbug.com/689781 [ Win Mac ] http/tests/media/media-source/mediasource-duration.html [ Failure Pass ]
+crbug.com/689781 [ Win Mac ] virtual/audio-service/http/tests/media/media-source/mediasource-duration.html [ Failure Pass ]
 
 crbug.com/681468 fast/forms/suggestion-picker/date-suggestion-picker-appearance-zoom125.html [ Failure Pass ]
 crbug.com/681468 fast/forms/suggestion-picker/date-suggestion-picker-appearance-zoom200.html [ Failure Pass ]
@@ -4963,6 +5002,7 @@
 
 # Sheriff failures 2017-02-21
 crbug.com/73609 http/tests/media/video-play-stall.html [ Pass Timeout ]
+crbug.com/73609 virtual/audio-service/http/tests/media/video-play-stall.html [ Pass Timeout ]
 
 # Sheriff failures 2017-03-10
 crbug.com/741210 [ Mac ] inspector-protocol/emulation/device-emulation-restore.js [ Failure ]
@@ -4983,6 +5023,7 @@
 crbug.com/722212 virtual/mouseevent_fractional/fast/events/pointerevents/mouse-pointer-event-properties.html [ Failure Timeout Pass ]
 # Crashes on win
 crbug.com/722943 media/audio-repaint.html [ Skip ]
+crbug.com/722943 virtual/audio-service/media/audio-repaint.html [ Skip ]
 
 # Sheriff failures 2018-08-13
 crbug.com/873454 css3/filters/effect-reference-image-hw.html [ Failure Pass ]
@@ -5009,6 +5050,7 @@
 crbug.com/718155 fullscreen/full-screen-iframe-not-allowed.html [ Failure ]
 crbug.com/718155 fullscreen/full-screen-restrictions.html [ Failure Timeout ]
 crbug.com/718155 media/video-controls-fullscreen-iframe-not-allowed.html [ Failure ]
+crbug.com/718155 virtual/audio-service/media/video-controls-fullscreen-iframe-not-allowed.html [ Failure ]
 crbug.com/718155 virtual/android/fullscreen/full-screen-iframe-not-allowed.html [ Failure ]
 crbug.com/718155 virtual/android/fullscreen/full-screen-restrictions.html [ Failure Timeout ]
 
@@ -5071,7 +5113,9 @@
 crbug.com/745887 [ Win ] fast/frames/sandboxed-iframe-plugins.html [ Failure Pass ]
 
 crbug.com/746128 [ Win7 Debug ] media/controls/video-enter-exit-fullscreen-without-hovering-doesnt-show-controls.html [ Failure ]
+crbug.com/746128 [ Win7 Debug ] virtual/audio-service/media/controls/video-enter-exit-fullscreen-without-hovering-doesnt-show-controls.html [ Failure ]
 crbug.com/746128 [ Mac ] media/controls/video-enter-exit-fullscreen-without-hovering-doesnt-show-controls.html [ Failure Pass ]
+crbug.com/746128 [ Mac ] virtual/audio-service/media/controls/video-enter-exit-fullscreen-without-hovering-doesnt-show-controls.html [ Failure Pass ]
 
 crbug.com/731018 [ Mac ] sensor/accelerometer.html [ Failure Pass Crash ]
 crbug.com/731018 [ Mac ] sensor/ambient-light-sensor.html [ Failure Pass Crash ]
@@ -5081,12 +5125,17 @@
 
 # Tests failing when enabling new modern media controls
 crbug.com/831942 media/webkit-media-controls-webkit-appearance.html [ Failure Pass ]
+crbug.com/831942 virtual/audio-service/media/webkit-media-controls-webkit-appearance.html [ Failure Pass ]
 crbug.com/831957 compositing/video/video-controls-layer-creation-squashing.html [ Failure Pass ]
 crbug.com/832157 external/wpt/html/semantics/embedded-content/media-elements/track/track-element/track-cue-rendering-after-controls-added.html [ Skip ]
 crbug.com/832169 media/media-controls-fit-properly-while-zoomed.html [ Failure Pass ]
+crbug.com/832169 virtual/audio-service/media/media-controls-fit-properly-while-zoomed.html [ Failure Pass ]
 crbug.com/832447 media/controls/controls-page-zoom-in.html [ Failure Pass ]
 crbug.com/832447 media/controls/controls-page-zoom-out.html [ Failure Pass ]
+crbug.com/832447 virtual/audio-service/media/controls/controls-page-zoom-in.html [ Failure Pass ]
+crbug.com/832447 virtual/audio-service/media/controls/controls-page-zoom-out.html [ Failure Pass ]
 crbug.com/849694 [ Mac ] http/tests/media/controls/toggle-class-with-state-source-buffer.html [ Failure Pass ]
+crbug.com/849694 [ Mac ] virtual/audio-service/http/tests/media/controls/toggle-class-with-state-source-buffer.html [ Failure Pass ]
 
 # ContentSecurityPolicy modifies the SchemeRegistry before some initialization.
 crbug.com/686118 http/tests/security/contentSecurityPolicy/register-bypassing-scheme.html [ Pass Crash ]
@@ -5199,6 +5248,9 @@
 crbug.com/694855 media/audio-src-suspend-after-have-metadata.html [ Skip ]
 crbug.com/694855 media/video-src-skip-suspend-after-have-metadata.html [ Skip ]
 crbug.com/694855 media/video-src-suspend-after-have-metadata.html [ Skip ]
+crbug.com/694855 virtual/audio-service/media/audio-src-suspend-after-have-metadata.html [ Skip ]
+crbug.com/694855 virtual/audio-service/media/video-src-skip-suspend-after-have-metadata.html [ Skip ]
+crbug.com/694855 virtual/audio-service/media/video-src-suspend-after-have-metadata.html [ Skip ]
 
 ### See crbug.com/891427 comment near the top of this file:
 ###crbug.com/849979 media/video-layer-crash.html [ Pass Timeout ]
@@ -5248,6 +5300,7 @@
 
 # Sheriff failures 2017-10-23
 crbug.com/772411 http/tests/media/autoplay-crossorigin.html [ Timeout Failure Pass ]
+crbug.com/772411 virtual/audio-service/http/tests/media/autoplay-crossorigin.html [ Timeout Failure Pass ]
 crbug.com/777222 http/tests/devtools/inspect-iframe-from-different-domain.js [ Pass Failure Timeout ]
 
 crbug.com/778745 http/tests/inspector-protocol/cachestorage/read-cached-response.js [ Pass Failure ]
@@ -5324,6 +5377,12 @@
 crbug.com/783154 [ Mac ] media/controls/doubletap-on-play-button.html [ Skip ]
 crbug.com/783154 [ Mac ] media/controls/doubletap-to-toggle-fullscreen.html [ Skip ]
 crbug.com/783154 [ Mac ] media/controls/click-anywhere-to-play-pause.html [ Skip ]
+crbug.com/783154 [ Mac ] virtual/audio-service/media/controls/doubletap-to-jump-backwards.html [ Skip ]
+crbug.com/783154 [ Mac ] virtual/audio-service/media/controls/doubletap-to-jump-forwards.html [ Skip ]
+crbug.com/783154 [ Mac ] virtual/audio-service/media/controls/doubletap-to-jump-forwards-too-short.html [ Skip ]
+crbug.com/783154 [ Mac ] virtual/audio-service/media/controls/doubletap-on-play-button.html [ Skip ]
+crbug.com/783154 [ Mac ] virtual/audio-service/media/controls/doubletap-to-toggle-fullscreen.html [ Skip ]
+crbug.com/783154 [ Mac ] virtual/audio-service/media/controls/click-anywhere-to-play-pause.html [ Skip ]
 
 # Seen flaky on Linux, suppressing on Windows as well
 crbug.com/831720 [ Win ] media/controls/doubletap-to-jump-forwards-too-short.html [ Pass Failure ]
@@ -5331,6 +5390,11 @@
 crbug.com/831720 [ Mac ] media/controls/tap-to-hide-controls.html [ Pass Failure ]
 crbug.com/831720 [ Win ] media/controls/tap-to-hide-controls.html [ Pass Failure ]
 crbug.com/831720 [ Linux ] media/controls/tap-to-hide-controls.html [ Pass Failure ]
+crbug.com/831720 [ Win ] virtual/audio-service/media/controls/doubletap-to-jump-forwards-too-short.html [ Pass Failure ]
+crbug.com/831720 [ Linux ] virtual/audio-service/media/controls/doubletap-to-jump-forwards-too-short.html [ Pass Failure ]
+crbug.com/831720 [ Mac ] virtual/audio-service/media/controls/tap-to-hide-controls.html [ Pass Failure ]
+crbug.com/831720 [ Win ] virtual/audio-service/media/controls/tap-to-hide-controls.html [ Pass Failure ]
+crbug.com/831720 [ Linux ] virtual/audio-service/media/controls/tap-to-hide-controls.html [ Pass Failure ]
 
 crbug.com/802915 css3/blending/isolation-should-include-non-local-background.html [ Failure ]
 
@@ -5341,6 +5405,7 @@
 
 # Does not work on Mac
 crbug.com/793771 [ Mac ] media/controls/scrubbing.html [ Skip ]
+crbug.com/793771 [ Mac Win ] virtual/audio-service/media/controls/scrubbing.html [ Skip ]
 
 # Different paths may have different anti-aliasing pixels 2018-02-21
 skbug.com/7641 external/wpt/css/css-paint-api/paint2d-paths.https.html [ Failure Pass ]
@@ -5359,6 +5424,7 @@
 
 # Sheriff failures 2018-02-20
 crbug.com/789921 media/controls/repaint-on-resize.html [ Failure Pass ]
+crbug.com/789921 virtual/audio-service/media/controls/repaint-on-resize.html [ Failure Pass ]
 
 # Sheriff failures 2018-02-21
 crbug.com/814585 [ Linux ] fast/css3-text/css3-text-decoration/text-underline-position/text-underline-position-cjk.html [ Pass Failure ]
@@ -5385,7 +5451,9 @@
 crbug.com/807110 external/wpt/media-source/mediasource-sequencemode-append-buffer.html [ Failure Pass ]
 crbug.com/807110 external/wpt/media-source/mediasource-sourcebuffer-mode-timestamps.html [ Failure Pass ]
 crbug.com/794338 media/video-rotation.html [ Failure Pass ]
+crbug.com/794338 virtual/audio-service/media/video-rotation.html [ Failure Pass ]
 crbug.com/811605 media/video-poster-after-loadedmetadata.html [ Failure Pass ]
+crbug.com/811605 virtual/audio-service/media/video-poster-after-loadedmetadata.html [ Failure Pass ]
 
 crbug.com/813704 http/tests/images/png-partial-load-as-document.html [ Failure Pass ]
 
@@ -5420,6 +5488,8 @@
 # Sheriff 2018-03-22
 crbug.com/824775 [ Win ] media/controls/video-controls-with-cast-rendering.html [ Pass Failure ]
 crbug.com/824775 [ Mac ] media/controls/video-controls-with-cast-rendering.html [ Pass Failure ]
+crbug.com/824775 [ Win ] virtual/audio-service/media/controls/video-controls-with-cast-rendering.html [ Pass Failure ]
+crbug.com/824775 [ Mac ] virtual/audio-service/media/controls/video-controls-with-cast-rendering.html [ Pass Failure ]
 crbug.com/824848 [ Linux ] external/wpt/html/semantics/links/following-hyperlinks/activation-behavior.window.html [ Pass Failure ]
 crbug.com/824848 [ Mac ] external/wpt/html/semantics/links/following-hyperlinks/activation-behavior.window.html [ Pass Failure ]
 crbug.com/824848 [ Win ] external/wpt/html/semantics/links/following-hyperlinks/activation-behavior.window.html [ Pass Failure ]
@@ -5440,7 +5510,9 @@
 
 # Sheriff 2018-03-26
 crbug.com/825733 [ Win ] media/color-profile-video-seek-filter.html [ Pass Timeout Failure ]
+crbug.com/825733 [ Win ] virtual/audio-service/media/color-profile-video-seek-filter.html [ Pass Timeout Failure ]
 crbug.com/754986 media/video-transformed.html [ Pass Failure ]
+crbug.com/754986 virtual/audio-service/media/video-transformed.html [ Pass Failure ]
 
 # Sheriff 2018-03-29
 crbug.com/827209 [ Win ] fast/events/middleClickAutoscroll-latching.html [ Pass Timeout Failure ]
@@ -5481,6 +5553,10 @@
 crbug.com/833658 [ Linux ] media/video-controls-focus-movement-on-hide.html [ Pass Failure ]
 crbug.com/833658 [ Win ] media/video-controls-focus-movement-on-hide.html [ Pass Failure ]
 crbug.com/833658 [ Mac ] media/video-controls-focus-movement-on-hide.html [ Pass Failure ]
+crbug.com/833655 [ Linux ] virtual/audio-service/media/controls/closed-captions-dynamic-update.html [ Skip ]
+crbug.com/833658 [ Linux ] virtual/audio-service/media/video-controls-focus-movement-on-hide.html [ Pass Failure ]
+crbug.com/833658 [ Win ] virtual/audio-service/media/video-controls-focus-movement-on-hide.html [ Pass Failure ]
+crbug.com/833658 [ Mac ] virtual/audio-service/media/video-controls-focus-movement-on-hide.html [ Pass Failure ]
 
 # Sheriff 2018-04-23
 crbug.com/833331 [ Win10 ] inspector-protocol/page/pageNavigateToFragment.js [ Pass Failure ]
@@ -5771,6 +5847,7 @@
 # Sheriff 2018-11-26
 crbug.com/908276 [ Mac ] external/wpt/webstorage/storage_setitem.html [ Pass Timeout ]
 crbug.com/908347 media/autoplay/webaudio-audio-context-resume.html [ Failure Pass ]
+crbug.com/908347 virtual/audio-service/media/autoplay/webaudio-audio-context-resume.html [ Failure Pass ]
 
 # Sheriff 2018-11-29
 crbug.com/910139 custom-elements/form-submission-file.html [ Crash Pass ]
@@ -5791,6 +5868,7 @@
 
 # Sheriff 2018-12-13
 crbug.com/910452 media/controls/buttons-after-reset.html [ Pass Failure ]
+crbug.com/910452 virtual/audio-service/media/controls/buttons-after-reset.html [ Pass Failure ]
 crbug.com/914782 [ Linux ] fast/scrolling/no-hover-during-scroll.html [ Pass Failure ]
 
 # Sheriff 2018-12-14
@@ -5868,6 +5946,9 @@
 crbug.com/922951 media/controls/overflow-menu-hide-on-click-outside-stoppropagation.html [ Skip ]
 crbug.com/922951 media/controls/overflow-menu-hide-on-click-outside.html [ Skip ]
 crbug.com/922951 media/controls/overflow-menu-toggle-class-for-animation.html [ Skip ]
+crbug.com/922951 virtual/audio-service/media/controls/overflow-menu-hide-on-click-outside-stoppropagation.html [ Skip ]
+crbug.com/922951 virtual/audio-service/media/controls/overflow-menu-hide-on-click-outside.html [ Skip ]
+crbug.com/922951 virtual/audio-service/media/controls/overflow-menu-toggle-class-for-animation.html [ Skip ]
 crbug.com/922951 scrollbars/resize-scales-with-dpi-150.html [ Skip ]
 crbug.com/922951 svg/animations/dynamic-modify-transform-without-baseval.html [ Skip ]
 crbug.com/922951 svg/animations/target-condition-crash.html [ Skip ]
@@ -5951,6 +6032,7 @@
 
 # Sheriff 2019-02-12
 crbug.com/931349 [ Mac ] media/video-played-ranges-1.html [ Failure Timeout Pass ]
+crbug.com/931349 [ Mac ] virtual/audio-service/media/video-played-ranges-1.html [ Failure Timeout Pass ]
 
 # Sheriff 2019-02-13
 crbug.com/931646 [ Win7 ] http/tests/preload/meta-viewport-link-headers-imagesrcset.html [ Failure Pass ]
@@ -5987,6 +6069,7 @@
 # Sheriff 2019-02-26
 crbug.com/936083 external/wpt/import-maps/builtin-import-scheme.tentative.html [ Failure Pass ]
 crbug.com/936165 media/autoplay-muted.html [ Timeout Pass ]
+crbug.com/936165 virtual/audio-service/media/autoplay-muted.html [ Timeout Pass ]
 
 # Sheriff 2019-02-27
 crbug.com/936279 external/wpt/import-maps/fallback-disallowed.sub.tentative.html [ Failure Pass Timeout ]
@@ -6019,6 +6102,7 @@
 
 # Caused a revert of a good change.
 crbug.com/931533 media/video-played-collapse.html [ Pass Failure ]
+crbug.com/931533 virtual/audio-service/media/video-played-collapse.html [ Pass Failure ]
 
 # Test was blocking WPT importer
 crbug.com/941471 external/wpt/css/css-transforms/transform-flattening-001.html [ Pass Failure Crash ]
@@ -6076,6 +6160,7 @@
 crbug.com/919789 images/image-zoom-to-25.html [ Pass Timeout ]
 crbug.com/919789 images/image-zoom-to-500.html [ Pass Timeout ]
 crbug.com/919789 media/controls/overflow-menu-hide-on-resize.html [ Pass Timeout ]
+crbug.com/919789 virtual/audio-service/media/controls/overflow-menu-hide-on-resize.html [ Pass Timeout ]
 crbug.com/919789 [ Linux Mac10.13 ] paint/invalidation/resize-iframe-text.html [ Pass Timeout ]
 crbug.com/919789 paint/invalidation/scroll/scrollbar-damage-and-full-viewport-repaint.html [ Pass Timeout ]
 crbug.com/919789 paint/invalidation/window-resize/ [ Pass Timeout ]
@@ -6202,9 +6287,14 @@
 crbug.com/963141 media/video-object-fit-change.html [ Pass Failure ]
 crbug.com/963141 [ Mac Win ] media/controls/video-overlay-cast-light-rendering.html [ Pass Failure ]
 crbug.com/963141 [ Mac ] media/video-aspect-ratio.html [ Pass Failure ]
+crbug.com/963141 [ Mac Win ] virtual/audio-service/media/video-object-fit.html [ Pass Failure ]
+crbug.com/963141 virtual/audio-service/media/video-object-fit-change.html [ Pass Failure ]
+crbug.com/963141 [ Mac Win ] virtual/audio-service/media/controls/video-overlay-cast-light-rendering.html [ Pass Failure ]
+crbug.com/963141 [ Mac ] virtual/audio-service/media/video-aspect-ratio.html [ Pass Failure ]
 
 # Sheriff 2019-05-16
 crbug.com/963141 [ Linux ] media/video-object-fit.html [ Pass Failure ]
+crbug.com/963141 [ Linux ] virtual/audio-service/media/video-object-fit.html [ Pass Failure ]
 crbug.com/963740 compositing/video-frame-size-change.html [ Pass Failure ]
 
 # Sheriff 2019-05-17
@@ -6221,6 +6311,7 @@
 crbug.com/963739 [ Fuchsia ] synthetic_gestures/smooth-scroll-tiny-delta.html [ Pass Timeout ]
 crbug.com/964239 external/wpt/css/css-scroll-snap/scroll-margin.html [ Pass Failure ]
 crbug.com/965389 [ Mac ] media/track/track-cue-rendering-position-auto.html [ Pass Failure ]
+crbug.com/965389 [ Mac ] virtual/audio-service/media/track/track-cue-rendering-position-auto.html [ Pass Failure ]
 
 # Sheriff 2019-05-27
 crbug.com/942411 [ Win ] http/tests/devtools/network/network-search.js [ Pass Timeout ]
@@ -6243,8 +6334,10 @@
 
 # Sheriff 2019-06-05
 crbug.com/971259 media/controls/volumechange-stopimmediatepropagation.html [ Pass Failure ]
+crbug.com/971259 virtual/audio-service/media/controls/volumechange-stopimmediatepropagation.html [ Pass Failure ]
 crbug.com/971262 http/tests/devtools/profiler/live-line-level-heap-profile.js [ Pass Timeout ]
 crbug.com/971319 [ Mac ] media/audio-garbage-collect.html [ Pass Timeout ]
+crbug.com/971319 [ Mac ] virtual/audio-service/media/audio-garbage-collect.html [ Pass Timeout ]
 
 # Sheriff 2019-06-06
 crbug.com/971590 fast/dom/timer-throttling-out-of-view-cross-origin-page.html [ Pass Failure ]
@@ -6355,6 +6448,9 @@
 crbug.com/986477 [ Win ] external/wpt/cookies/path/match.html [ Pass Timeout ]
 crbug.com/986477 [ Win ] virtual/samesite-by-default-cookies/external/wpt/cookies/path/match.html [ Pass Timeout ]
 
+
+crbug.com/987269 [ Linux ] virtual/audio-service/http/tests/media/autoplay/document-user-activation-cross-origin-feature-policy-disabled.html [ Pass Failure ]
+crbug.com/987269 [ Linux ] virtual/audio-service/http/tests/media/autoplay/document-user-activation-cross-origin-feature-policy-header.html [ Pass Failure ]
 # Sheriff 2019-07-24
 crbug.com/986019 animations/play-state.html [ Pass Timeout ]
 crbug.com/986019 virtual/threaded/animations/play-state.html [ Pass Timeout ]
@@ -6363,6 +6459,7 @@
 crbug.com/987132 [ Mac ] fast/forms/select/option-strip-whitespace.html [ Failure ]
 crbug.com/986282 external/wpt/client-hints/accept-ch-lifetime.tentative.https.html [ Pass Failure ]
 crbug.com/987138 [ Linux Win ] media/controls/doubletap-to-jump-forwards.html [ Pass Timeout ]
+crbug.com/987138 [ Linux Win ] virtual/audio-service/media/controls/doubletap-to-jump-forwards.html [ Pass Timeout ]
 
 # Sheriff 2019-07-26
 crbug.com/835943 [ Debug ] http/tests/appcache/non-html.xhtml [ Crash Pass ]
diff --git a/third_party/blink/web_tests/VirtualTestSuites b/third_party/blink/web_tests/VirtualTestSuites
index d2d5139..105b1be3 100644
--- a/third_party/blink/web_tests/VirtualTestSuites
+++ b/third_party/blink/web_tests/VirtualTestSuites
@@ -1212,5 +1212,20 @@
     "prefix": "conditional-appcache-delay",
     "base": "http/tests/loading/appcache-delay",
     "args": ["--enable-features=VerifyHTMLFetchedFromAppCacheBeforeDelay"]
+  },
+  {
+    "prefix": "audio-service",
+    "base": "http/tests/media",
+    "args": ["--enable-features=AudioServiceOutOfProcess,AudioServiceSandbox"]
+  },
+  {
+    "prefix": "audio-service",
+    "base": "media",
+    "args": ["--enable-features=AudioServiceOutOfProcess,AudioServiceSandbox"]
+  },
+  {
+    "prefix": "audio-service",
+    "base": "external/wpt/mediacapture-streams",
+    "args": ["--enable-features=AudioServiceOutOfProcess,AudioServiceSandbox"]
   }
 ]
diff --git a/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_6.json b/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_6.json
index 64d131e..31e50de 100644
--- a/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_6.json
+++ b/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_6.json
@@ -56759,6 +56759,30 @@
      {}
     ]
    ],
+   "css/css-multicol/multicol-rule-nested-balancing-001.html": [
+    [
+     "css/css-multicol/multicol-rule-nested-balancing-001.html",
+     [
+      [
+       "/css/css-multicol/multicol-rule-nested-balancing-001-ref.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
+   "css/css-multicol/multicol-rule-nested-balancing-002.html": [
+    [
+     "css/css-multicol/multicol-rule-nested-balancing-002.html",
+     [
+      [
+       "/css/css-multicol/multicol-rule-nested-balancing-002-ref.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
    "css/css-multicol/multicol-rule-none-000.xht": [
     [
      "css/css-multicol/multicol-rule-none-000.xht",
@@ -57587,6 +57611,18 @@
      {}
     ]
    ],
+   "css/css-multicol/multicol-span-all-rule-001.html": [
+    [
+     "css/css-multicol/multicol-span-all-rule-001.html",
+     [
+      [
+       "/css/css-multicol/multicol-span-all-rule-001-ref.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
    "css/css-multicol/multicol-span-float-001.xht": [
     [
      "css/css-multicol/multicol-span-float-001.xht",
@@ -126133,9 +126169,21 @@
    "content-security-policy/script-src/simpleSourcedScript.js": [
     []
    ],
+   "content-security-policy/script-src/support/change-scripthash-before-execute.js": [
+    []
+   ],
+   "content-security-policy/script-src/support/change-scriptnonce-before-execute.js": [
+    []
+   ],
+   "content-security-policy/script-src/support/empty.css": [
+    []
+   ],
    "content-security-policy/script-src/support/inject-script.js": [
     []
    ],
+   "content-security-policy/script-src/support/inline-script-should-be-blocked.js": [
+    []
+   ],
    "content-security-policy/script-src/support/post-message.js": [
     []
    ],
@@ -139681,6 +139729,12 @@
    "css/css-multicol/multicol-rule-large-001-ref.xht": [
     []
    ],
+   "css/css-multicol/multicol-rule-nested-balancing-001-ref.html": [
+    []
+   ],
+   "css/css-multicol/multicol-rule-nested-balancing-002-ref.html": [
+    []
+   ],
    "css/css-multicol/multicol-rule-ref.xht": [
     []
    ],
@@ -139846,6 +139900,9 @@
    "css/css-multicol/multicol-span-all-restyle-004-ref.html": [
     []
    ],
+   "css/css-multicol/multicol-span-all-rule-001-ref.html": [
+    []
+   ],
    "css/css-multicol/multicol-span-float-001-ref.xht": [
     []
    ],
@@ -173899,6 +173956,12 @@
    "upgrade-insecure-requests/module-worker-upgrade.https-expected.txt": [
     []
    ],
+   "upgrade-insecure-requests/shared-worker-redirect-upgrade.https-expected.txt": [
+    []
+   ],
+   "upgrade-insecure-requests/shared-worker-upgrade.https-expected.txt": [
+    []
+   ],
    "upgrade-insecure-requests/support/generate.py": [
     []
    ],
@@ -197490,12 +197553,30 @@
      {}
     ]
    ],
+   "content-security-policy/script-src/scripthash-basic-blocked-error-event.html": [
+    [
+     "content-security-policy/script-src/scripthash-basic-blocked-error-event.html",
+     {}
+    ]
+   ],
    "content-security-policy/script-src/scripthash-basic-blocked.sub.html": [
     [
      "content-security-policy/script-src/scripthash-basic-blocked.sub.html",
      {}
     ]
    ],
+   "content-security-policy/script-src/scripthash-changed-1.html": [
+    [
+     "content-security-policy/script-src/scripthash-changed-1.html",
+     {}
+    ]
+   ],
+   "content-security-policy/script-src/scripthash-changed-2.html": [
+    [
+     "content-security-policy/script-src/scripthash-changed-2.html",
+     {}
+    ]
+   ],
    "content-security-policy/script-src/scripthash-default-src.sub.html": [
     [
      "content-security-policy/script-src/scripthash-default-src.sub.html",
@@ -197532,6 +197613,18 @@
      {}
     ]
    ],
+   "content-security-policy/script-src/scriptnonce-changed-1.html": [
+    [
+     "content-security-policy/script-src/scriptnonce-changed-1.html",
+     {}
+    ]
+   ],
+   "content-security-policy/script-src/scriptnonce-changed-2.html": [
+    [
+     "content-security-policy/script-src/scriptnonce-changed-2.html",
+     {}
+    ]
+   ],
    "content-security-policy/script-src/scriptnonce-ignore-unsafeinline.sub.html": [
     [
      "content-security-policy/script-src/scriptnonce-ignore-unsafeinline.sub.html",
@@ -250811,12 +250904,24 @@
      {}
     ]
    ],
+   "mathml/relations/css-styling/writing-mode/writing-mode-001.tentative.html": [
+    [
+     "mathml/relations/css-styling/writing-mode/writing-mode-001.tentative.html",
+     {}
+    ]
+   ],
    "mathml/relations/css-styling/writing-mode/writing-mode-002.html": [
     [
      "mathml/relations/css-styling/writing-mode/writing-mode-002.html",
      {}
     ]
    ],
+   "mathml/relations/css-styling/writing-mode/writing-mode-002.tentative.html": [
+    [
+     "mathml/relations/css-styling/writing-mode/writing-mode-002.tentative.html",
+     {}
+    ]
+   ],
    "mathml/relations/html5-tree/class-2.html": [
     [
      "mathml/relations/html5-tree/class-2.html",
@@ -287249,6 +287354,12 @@
      {}
     ]
    ],
+   "svg/painting/parsing/marker-computed.svg": [
+    [
+     "svg/painting/parsing/marker-computed.svg",
+     {}
+    ]
+   ],
    "svg/painting/parsing/marker-end-computed.svg": [
     [
      "svg/painting/parsing/marker-end-computed.svg",
@@ -287267,6 +287378,12 @@
      {}
     ]
    ],
+   "svg/painting/parsing/marker-invalid.svg": [
+    [
+     "svg/painting/parsing/marker-invalid.svg",
+     {}
+    ]
+   ],
    "svg/painting/parsing/marker-mid-computed.svg": [
     [
      "svg/painting/parsing/marker-mid-computed.svg",
@@ -287303,6 +287420,12 @@
      {}
     ]
    ],
+   "svg/painting/parsing/marker-valid.svg": [
+    [
+     "svg/painting/parsing/marker-valid.svg",
+     {}
+    ]
+   ],
    "svg/painting/parsing/paint-order-computed.svg": [
     [
      "svg/painting/parsing/paint-order-computed.svg",
@@ -288659,6 +288782,18 @@
      {}
     ]
    ],
+   "upgrade-insecure-requests/shared-worker-redirect-upgrade.https.html": [
+    [
+     "upgrade-insecure-requests/shared-worker-redirect-upgrade.https.html",
+     {}
+    ]
+   ],
+   "upgrade-insecure-requests/shared-worker-upgrade.https.html": [
+    [
+     "upgrade-insecure-requests/shared-worker-upgrade.https.html",
+     {}
+    ]
+   ],
    "upgrade-insecure-requests/websocket-upgrade.https.html": [
     [
      "upgrade-insecure-requests/websocket-upgrade.https.html",
@@ -322344,7 +322479,7 @@
    "support"
   ],
   "common/security-features/tools/generate.py": [
-   "a97a396e304717f763c313d07f541a69fd7304d0",
+   "0b18a391a62279680e2cbb6905d41084a622f236",
    "support"
   ],
   "common/security-features/tools/spec_validator.py": [
@@ -324671,10 +324806,22 @@
    "c46a99136d8b1f80029178d575cb32990007da61",
    "testharness"
   ],
+  "content-security-policy/script-src/scripthash-basic-blocked-error-event.html": [
+   "62b869335f0d01fe49e7fbd0a7d18ce90e5dede3",
+   "testharness"
+  ],
   "content-security-policy/script-src/scripthash-basic-blocked.sub.html": [
    "d254053ecedad157389460beef5b54990c5ae751",
    "testharness"
   ],
+  "content-security-policy/script-src/scripthash-changed-1.html": [
+   "9da41dd1ef3869df2daf56d33f2a5a4a9b8aca73",
+   "testharness"
+  ],
+  "content-security-policy/script-src/scripthash-changed-2.html": [
+   "927d60a8d78fcf531970793ac7778c895d4f8167",
+   "testharness"
+  ],
   "content-security-policy/script-src/scripthash-default-src.sub.html": [
    "6025a67179fe2e71c60e811e7740f84f16da5d2a",
    "testharness"
@@ -324699,6 +324846,14 @@
    "2001afcd9cac51a007569bf8ea0642dc905b5422",
    "testharness"
   ],
+  "content-security-policy/script-src/scriptnonce-changed-1.html": [
+   "75f92f354ad1c550104d6c6f75096ad0f8e8916f",
+   "testharness"
+  ],
+  "content-security-policy/script-src/scriptnonce-changed-2.html": [
+   "f2321dd656e64c9b4831aae39c0717e53cec3aca",
+   "testharness"
+  ],
   "content-security-policy/script-src/scriptnonce-ignore-unsafeinline.sub.html": [
    "b595b76389ffce3e8ee642e9581073f4dbbe04a1",
    "testharness"
@@ -324715,10 +324870,26 @@
    "2cae85ec301fa2cd15005468b7efab6440ec2f17",
    "testharness"
   ],
+  "content-security-policy/script-src/support/change-scripthash-before-execute.js": [
+   "a04e8575b2599f6ad40760957c8483cdc1023f58",
+   "support"
+  ],
+  "content-security-policy/script-src/support/change-scriptnonce-before-execute.js": [
+   "2676b34728f9e3d965adb36b59f15ccf54b0c3a0",
+   "support"
+  ],
+  "content-security-policy/script-src/support/empty.css": [
+   "e69de29bb2d1d6434b8b29ae775ad8c2e48c5391",
+   "support"
+  ],
   "content-security-policy/script-src/support/inject-script.js": [
    "c04033c46f09b55eb604d22d23fc2595a0928335",
    "support"
   ],
+  "content-security-policy/script-src/support/inline-script-should-be-blocked.js": [
+   "f32d25074bd3c906de734fcf65cc3b23a8637e81",
+   "support"
+  ],
   "content-security-policy/script-src/support/post-message.js": [
    "69daa31d2f1b645d394ca41dab119924209d4871",
    "support"
@@ -367688,19 +367859,19 @@
    "reftest"
   ],
   "css/css-multicol/multicol-breaking-000-ref.html": [
-   "3d496cd391a09975106410abd5f4d297d93d1337",
+   "916f7161de60cf4dae2dab6baf29cba9483847db",
    "support"
   ],
   "css/css-multicol/multicol-breaking-000.html": [
-   "391985d6a897c50955d2259cea4eedf1718f02a7",
+   "98f808164e7d83e789811f48964e85ea0efac064",
    "reftest"
   ],
   "css/css-multicol/multicol-breaking-001-ref.html": [
-   "46357f940d29e578e07fd505c4143084ce58afee",
+   "db2b45c4dd669ae3d35af6b910c97e318a2cb700",
    "support"
   ],
   "css/css-multicol/multicol-breaking-001.html": [
-   "69c9049266d12abcedfdb8fd8bdadeacbf8c505d",
+   "e1ba966923368009e785427483a8ee3cc65981a0",
    "reftest"
   ],
   "css/css-multicol/multicol-breaking-002-ref.html": [
@@ -367720,27 +367891,27 @@
    "reftest"
   ],
   "css/css-multicol/multicol-breaking-004-ref.html": [
-   "016885a9e640a7e1cbd5e59fc0886cfb63219d60",
+   "f48ebb2108eb26239792981ae87dd7d2c4b4ef4f",
    "support"
   ],
   "css/css-multicol/multicol-breaking-004.html": [
-   "34b9f59137eca3a63caacb860e0b4a7487121e66",
+   "82931ac85165637a5114a8b41be14ccfcf2e1857",
    "reftest"
   ],
   "css/css-multicol/multicol-breaking-nobackground-000-ref.html": [
-   "e7ebcff4a082e2455d303163ee7b86131331427f",
+   "7a99354061cfeb982fffb921c850484dd02eac15",
    "support"
   ],
   "css/css-multicol/multicol-breaking-nobackground-000.html": [
-   "a66a58fc746bff81deda9918d00dba816e1b9a72",
+   "768ec63298f03eb28a80a4e33f140314168b010d",
    "reftest"
   ],
   "css/css-multicol/multicol-breaking-nobackground-001-ref.html": [
-   "006ec1d2221d80cb39e58228aacc5a779349d4bf",
+   "ecba5cd0d9a1cc25ff1d8111ab780cb89ee80747",
    "support"
   ],
   "css/css-multicol/multicol-breaking-nobackground-001.html": [
-   "d47fcd31a0a78194e872f1b26f561b4377cc8766",
+   "78eda2331f0de812df260c48b63a679a08c39a0f",
    "reftest"
   ],
   "css/css-multicol/multicol-breaking-nobackground-002-ref.html": [
@@ -368363,6 +368534,22 @@
    "055a015d7779866d9f5ee9f0c84c8e77c37e2151",
    "visual"
   ],
+  "css/css-multicol/multicol-rule-nested-balancing-001-ref.html": [
+   "29acc05a2223a01015cc01106be6a49fee821237",
+   "support"
+  ],
+  "css/css-multicol/multicol-rule-nested-balancing-001.html": [
+   "0491bd37f1a6dea3428c04ac441a45c128a81860",
+   "reftest"
+  ],
+  "css/css-multicol/multicol-rule-nested-balancing-002-ref.html": [
+   "f557966178833f12063fa9b228f152cf66dce13b",
+   "support"
+  ],
+  "css/css-multicol/multicol-rule-nested-balancing-002.html": [
+   "b38f90947a917fba51d6b7192e567ec7816de1c8",
+   "reftest"
+  ],
   "css/css-multicol/multicol-rule-none-000.xht": [
    "32ca043957782f09c69bd77bd4933345228b81d7",
    "reftest"
@@ -368859,6 +369046,14 @@
    "41ac007f00009d60c43b034bce68ded4cf23a007",
    "reftest"
   ],
+  "css/css-multicol/multicol-span-all-rule-001-ref.html": [
+   "0ab9ac553457c0f801a724029f7b6dd20764da48",
+   "support"
+  ],
+  "css/css-multicol/multicol-span-all-rule-001.html": [
+   "215aa567409735ecc234002321eb38d19b7543cf",
+   "reftest"
+  ],
   "css/css-multicol/multicol-span-float-001-ref.xht": [
    "50addc37797b085d7c59e7389f99fca1c54c50c1",
    "support"
@@ -402600,7 +402795,7 @@
    "testharness"
   ],
   "css/cssom/interfaces-expected.txt": [
-   "7ffb564d6729b1086084b86bc26e8cd7649ee630",
+   "c364cca8132816f617bfd155208ace3450f02d68",
    "support"
   ],
   "css/cssom/interfaces.html": [
@@ -442680,7 +442875,7 @@
    "support"
   ],
   "interfaces/cssom.idl": [
-   "798adc19f2a974beef4dd4ab8822524f807496b7",
+   "dc9b78fda6180dba6b7958c3429a77e0fb5048b2",
    "support"
   ],
   "interfaces/dedicated-workers.idl": [
@@ -443028,7 +443223,7 @@
    "support"
   ],
   "interfaces/web-nfc.idl": [
-   "365b38ff191920a39a98417097c2e7fc8a7e3574",
+   "13afc27663da2f3deb9c939032836073d49f83e9",
    "support"
   ],
   "interfaces/web-share.idl": [
@@ -444592,11 +444787,19 @@
    "testharness"
   ],
   "mathml/relations/css-styling/writing-mode/writing-mode-001.html": [
-   "01a93eb15f0af1b4fc7455e5b208898cca6e88e3",
+   "cbc8ce7da217a3b990cc2493cd8fe666b3517a8e",
+   "testharness"
+  ],
+  "mathml/relations/css-styling/writing-mode/writing-mode-001.tentative.html": [
+   "642ee66965181d2894d0c5ea67e21939f48eb66f",
    "testharness"
   ],
   "mathml/relations/css-styling/writing-mode/writing-mode-002.html": [
-   "97be6292eb0b40f4431dd8c7f11fe0e5711d838f",
+   "85c869eba3bc3ebc5c1c209b81b29d6f03b0ae9a",
+   "testharness"
+  ],
+  "mathml/relations/css-styling/writing-mode/writing-mode-002.tentative.html": [
+   "e86f03a4f0267bd2f62b36c7e1aa32352ee2adc6",
    "testharness"
   ],
   "mathml/relations/html5-tree/class-1-ref.html": [
@@ -474855,6 +475058,10 @@
    "18402493f3c779b9427b383cc668033ac46c4936",
    "testharness"
   ],
+  "svg/painting/parsing/marker-computed.svg": [
+   "329dedbbce239c627ccf47c7a14b59b00ac7ebd2",
+   "testharness"
+  ],
   "svg/painting/parsing/marker-end-computed.svg": [
    "da641abb9441a49829f5e8f1f4b5a599914b5515",
    "testharness"
@@ -474867,6 +475074,10 @@
    "5be036e994637be7abfe4440618cd4bb16b5d5a7",
    "testharness"
   ],
+  "svg/painting/parsing/marker-invalid.svg": [
+   "64112cd6a779547dfc6d23ceb92ff9003f1b4669",
+   "testharness"
+  ],
   "svg/painting/parsing/marker-mid-computed.svg": [
    "eddfd6171143906feb118a1bb6534c245a7ea8ff",
    "testharness"
@@ -474891,6 +475102,10 @@
    "fd6f2d6fe425ec1e4ab5c7ee6425a5e4ead823bc",
    "testharness"
   ],
+  "svg/painting/parsing/marker-valid.svg": [
+   "23d3f24f5cca3077002f1a02f669df9505ec745b",
+   "testharness"
+  ],
   "svg/painting/parsing/paint-order-computed.svg": [
    "29f5fa91bae31a8f55e895ead7fe999e53fdc963",
    "testharness"
@@ -482071,8 +482286,24 @@
    "3f2790a1092267e23e489b2ca181d99286ef0f42",
    "testharness"
   ],
+  "upgrade-insecure-requests/shared-worker-redirect-upgrade.https-expected.txt": [
+   "49422377eb365b514bda6f3c2845f269e97a340a",
+   "support"
+  ],
+  "upgrade-insecure-requests/shared-worker-redirect-upgrade.https.html": [
+   "5bfcb133b4ca781796c0992641658ac30b0b6c0a",
+   "testharness"
+  ],
+  "upgrade-insecure-requests/shared-worker-upgrade.https-expected.txt": [
+   "453ab3432e59e74ea3e2a023706bc6a0143b706a",
+   "support"
+  ],
+  "upgrade-insecure-requests/shared-worker-upgrade.https.html": [
+   "7be1042ff7433aeda678e64e4a01f6e2ebbcb1bf",
+   "testharness"
+  ],
   "upgrade-insecure-requests/support/generate.py": [
-   "1b0c2897feed76afb338ba11a93f01022a024550",
+   "ee27203699707fcf7f48e51ef8a7d541c0791260",
    "support"
   ],
   "upgrade-insecure-requests/support/redirect-cors.py": [
@@ -482080,7 +482311,7 @@
    "support"
   ],
   "upgrade-insecure-requests/support/testharness-helper.sub.js": [
-   "f578e8987a1be5f34fc1fd8b8d8bcc026db4eed7",
+   "da20d2644b312d6225497081c67fa4b66f12b43a",
    "support"
   ],
   "upgrade-insecure-requests/websocket-upgrade.https.html": [
@@ -485772,7 +486003,7 @@
    "wdspec"
   ],
   "webdriver/tests/perform_actions/validity.py": [
-   "ce8a0d60f7df192e21c6abbad1871bb0ac8f5f78",
+   "656406718e725d353643f863ba820abb313538c3",
    "wdspec"
   ],
   "webdriver/tests/permissions/set.py": [
diff --git a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-000-ref.html b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-000-ref.html
index 3d496cd39..916f7161 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-000-ref.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-000-ref.html
@@ -52,7 +52,7 @@
 <div class="outer">
   <div class="blueborders"></div>
   <div class="innerbg" style="left: 0"></div>
-  <div class="inner lefthalf" style="left: 0; height: 60px">
+  <div class="inner lefthalf" style="left: 0">
     AAAAA<br>
     BBBBB<br>
     CCCCC
diff --git a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-000.html b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-000.html
index 391985d..98f8081 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-000.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-000.html
@@ -5,6 +5,7 @@
 <link rel="author" title="Mozilla" href="https://mozilla.org/">
 <link rel="help" href="https://drafts.csswg.org/css-multicol/#column-gaps-and-rules">
 <link rel="help" href="https://drafts.csswg.org/css-multicol/#cf">
+<link rel="help" href="https://github.com/w3c/csswg-drafts/issues/2309">
 <link rel="match" href="multicol-breaking-000-ref.html">
 <style>
 
diff --git a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-001-ref.html b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-001-ref.html
index 46357f94..db2b45c 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-001-ref.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-001-ref.html
@@ -67,7 +67,7 @@
     JJJJJ
   </div>
   <div class="innerbg" style="left: 204px"></div>
-  <div class="inner lefthalf" style="left: 204px; height: 80px">
+  <div class="inner lefthalf" style="left: 204px">
     KKKKK<br>
     LLLLL<br>
     MMMMM<br>
diff --git a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-001.html b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-001.html
index 69c9049..e1ba966 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-001.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-001.html
@@ -5,6 +5,7 @@
 <link rel="author" title="Mozilla" href="https://mozilla.org/">
 <link rel="help" href="https://drafts.csswg.org/css-multicol/#column-gaps-and-rules">
 <link rel="help" href="https://drafts.csswg.org/css-multicol/#cf">
+<link rel="help" href="https://github.com/w3c/csswg-drafts/issues/2309">
 <link rel="match" href="multicol-breaking-001-ref.html">
 <style>
 
diff --git a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-004-ref.html b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-004-ref.html
index 016885a9..f48ebb21 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-004-ref.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-004-ref.html
@@ -77,7 +77,7 @@
   </div>
   <div class="border-bottom" style="left: 0"></div>
   <div class="innerbg" style="left: 204px"></div>
-  <div class="inner lefthalf" style="left: 204px; height: 80px">
+  <div class="inner lefthalf" style="left: 204px">
     KKKKK<br>
     LLLLL<br>
     MMMMM<br>
diff --git a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-004.html b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-004.html
index 34b9f59..82931ac85 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-004.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-004.html
@@ -6,6 +6,7 @@
 <link rel="author" title="Mozilla" href="https://mozilla.org/">
 <link rel="help" href="https://drafts.csswg.org/css-multicol/#column-gaps-and-rules">
 <link rel="help" href="https://drafts.csswg.org/css-multicol/#cf">
+<link rel="help" href="https://github.com/w3c/csswg-drafts/issues/2309">
 <link rel="help" href="https://drafts.csswg.org/css-break/#break-decoration">
 <link rel="match" href="multicol-breaking-004-ref.html">
 <style>
diff --git a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-nobackground-000-ref.html b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-nobackground-000-ref.html
index e7ebcff..7a99354 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-nobackground-000-ref.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-nobackground-000-ref.html
@@ -32,7 +32,7 @@
 </style>
 
 <div class="outer">
-  <div class="inner lefthalf" style="left: 0; height: 60px">
+  <div class="inner lefthalf" style="left: 0">
     AAAAA<br>
     BBBBB<br>
     CCCCC
diff --git a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-nobackground-000.html b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-nobackground-000.html
index a66a58f..768ec63 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-nobackground-000.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-nobackground-000.html
@@ -5,6 +5,7 @@
 <link rel="author" title="Mozilla" href="https://mozilla.org/">
 <link rel="help" href="https://drafts.csswg.org/css-multicol/#column-gaps-and-rules">
 <link rel="help" href="https://drafts.csswg.org/css-multicol/#cf">
+<link rel="help" href="https://github.com/w3c/csswg-drafts/issues/2309">
 <link rel="match" href="multicol-breaking-nobackground-000-ref.html">
 <style>
 
diff --git a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-nobackground-001-ref.html b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-nobackground-001-ref.html
index 006ec1d..ecba5cd 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-nobackground-001-ref.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-nobackground-001-ref.html
@@ -46,7 +46,7 @@
     IIIII<br>
     JJJJJ
   </div>
-  <div class="inner lefthalf" style="left: 204px; height: 80px">
+  <div class="inner lefthalf" style="left: 204px">
     KKKKK<br>
     LLLLL<br>
     MMMMM<br>
diff --git a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-nobackground-001.html b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-nobackground-001.html
index d47fcd31..78eda233 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-nobackground-001.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-breaking-nobackground-001.html
@@ -5,6 +5,7 @@
 <link rel="author" title="Mozilla" href="https://mozilla.org/">
 <link rel="help" href="https://drafts.csswg.org/css-multicol/#column-gaps-and-rules">
 <link rel="help" href="https://drafts.csswg.org/css-multicol/#cf">
+<link rel="help" href="https://github.com/w3c/csswg-drafts/issues/2309">
 <link rel="match" href="multicol-breaking-nobackground-001-ref.html">
 <style>
 
diff --git a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-rule-nested-balancing-001-ref.html b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-rule-nested-balancing-001-ref.html
new file mode 100644
index 0000000..29acc05
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-rule-nested-balancing-001-ref.html
@@ -0,0 +1,43 @@
+<!DOCTYPE html>
+<html>
+  <meta charset="utf-8">
+  <title>CSS Multi-column Layout Test Reference: Test the column rules' block-size with nested balancing multicol container</title>
+  <link rel="author" title="Ting-Yu Lin" href="tlin@mozilla.com">
+  <link rel="author" title="Mozilla" href="https://www.mozilla.org/">
+
+  <style>
+  .outer {
+    column-count: 2;
+    column-rule: 6px solid black;
+    column-fill: auto;
+    width: 400px;
+    height: 250px;
+  }
+  .inner {
+    column-count: 2;
+    column-rule: 3px solid gray;
+    column-fill: auto;
+    height: 200px;
+  }
+  .outer-block {
+    background-color: lightgreen;
+    height: 200px;
+  }
+  .inner-block {
+    background-color: lightblue;
+    height: 150px;
+  }
+  .space {
+    height: 50px;
+  }
+  </style>
+
+  <article class="outer">
+    <div class="outer-block"></div>
+    <div class="space"></div>
+    <article class="inner">
+      <div class="inner-block"></div><div class="space"></div>
+      <div class="inner-block"></div><div class="space"></div>
+    </article>
+  </article>
+</html>
diff --git a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-rule-nested-balancing-001.html b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-rule-nested-balancing-001.html
new file mode 100644
index 0000000..0491bd3
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-rule-nested-balancing-001.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html>
+  <meta charset="utf-8">
+  <title>CSS Multi-column Layout Test: Test the column rules' block-size with nested balancing multicol container</title>
+  <link rel="author" title="Ting-Yu Lin" href="tlin@mozilla.com">
+  <link rel="author" title="Mozilla" href="https://www.mozilla.org/">
+  <link rel="help" href="https://drafts.csswg.org/css-multicol-1/#cf">
+  <link rel="help" href="https://drafts.csswg.org/css-multicol-1/#column-gaps-and-rules">
+  <link rel="help" href="https://github.com/w3c/csswg-drafts/issues/2309">
+  <link rel="match" href="multicol-rule-nested-balancing-001-ref.html">
+  <meta name="assert" content="This test verifies that the column-rules are extended to the content block-end edges of their corresponding inner and outer multicol container.">
+
+  <style>
+  .outer {
+    column-count: 2;
+    column-rule: 6px solid black;
+    width: 400px;
+    height: 250px;
+  }
+  .inner {
+    column-count: 2;
+    column-rule: 3px solid gray;
+    height: 200px;
+  }
+  .outer-block {
+    background-color: lightgreen;
+    height: 200px;
+  }
+  .inner-block {
+    background-color: lightblue;
+    height: 300px;
+  }
+  </style>
+
+  <article class="outer">
+    <div class="outer-block"></div>
+    <article class="inner">
+      <div class="inner-block"></div>
+    </article>
+  </article>
+</html>
diff --git a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-rule-nested-balancing-002-ref.html b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-rule-nested-balancing-002-ref.html
new file mode 100644
index 0000000..f557966
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-rule-nested-balancing-002-ref.html
@@ -0,0 +1,43 @@
+<!DOCTYPE html>
+<html>
+  <meta charset="utf-8">
+  <title>CSS Multi-column Layout Test Reference: Test the column rules' block-size with nested balancing multicol container</title>
+  <link rel="author" title="Ting-Yu Lin" href="tlin@mozilla.com">
+  <link rel="author" title="Mozilla" href="https://www.mozilla.org/">
+
+  <style>
+  .outer {
+    column-count: 2;
+    column-rule: 6px solid black;
+    column-fill: auto;
+    width: 400px;
+    height: 250px;
+  }
+  .inner {
+    column-count: 2;
+    column-rule: 3px solid gray;
+    column-fill: auto;
+    height: 200px;
+  }
+  .outer-block {
+    background-color: lightgreen;
+    height: 200px;
+  }
+  .inner-block {
+    background-color: lightblue;
+    height: 200px;
+  }
+  .space {
+    height: 50px;
+  }
+  </style>
+
+  <article class="outer">
+    <div class="outer-block"></div>
+    <div class="space"></div>
+    <article class="inner">
+      <div class="inner-block"></div>
+      <div class="inner-block"></div>
+    </article>
+  </article>
+</html>
diff --git a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-rule-nested-balancing-002.html b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-rule-nested-balancing-002.html
new file mode 100644
index 0000000..b38f9094
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-rule-nested-balancing-002.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html>
+  <meta charset="utf-8">
+  <title>CSS Multi-column Layout Test: Test the column rules' block-size with nested balancing multicol container</title>
+  <link rel="author" title="Ting-Yu Lin" href="tlin@mozilla.com">
+  <link rel="author" title="Mozilla" href="https://www.mozilla.org/">
+  <link rel="help" href="https://drafts.csswg.org/css-multicol-1/#cf">
+  <link rel="help" href="https://drafts.csswg.org/css-multicol-1/#column-gaps-and-rules">
+  <link rel="help" href="https://github.com/w3c/csswg-drafts/issues/2309">
+  <link rel="match" href="multicol-rule-nested-balancing-002-ref.html">
+  <meta name="assert" content="This test verifies that the column-rules are extended to the content block-end edges of their corresponding inner and outer multicol container, where the inner container has height: auto.">
+
+  <style>
+  .outer {
+    column-count: 2;
+    column-rule: 6px solid black;
+    width: 400px;
+    height: 250px;
+  }
+  .inner {
+    column-count: 2;
+    column-rule: 3px solid gray;
+    height: auto;
+  }
+  .outer-block {
+    background-color: lightgreen;
+    height: 200px;
+  }
+  .inner-block {
+    background-color: lightblue;
+    height: 400px;
+  }
+  </style>
+
+  <article class="outer">
+    <div class="outer-block"></div>
+    <article class="inner">
+      <div class="inner-block"></div>
+    </article>
+  </article>
+</html>
diff --git a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-span-all-rule-001-ref.html b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-span-all-rule-001-ref.html
new file mode 100644
index 0000000..0ab9ac5
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-span-all-rule-001-ref.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<html>
+  <meta charset="utf-8">
+  <title>CSS Multi-column Layout Test: Test the column-rule's block-size</title>
+  <link rel="author" title="Ting-Yu Lin" href="tlin@mozilla.com">
+  <link rel="author" title="Mozilla" href="https://www.mozilla.org/">
+
+  <style>
+  article {
+    column-count: 2;
+    column-rule: 6px solid;
+    width: 400px;
+    height: 500px;
+    background-color: lightgreen;
+    border: 2em solid purple;
+    padding: 2em;
+  }
+  div.block {
+    width: 100px;
+    height: 200px;
+  }
+  div.column-span {
+    column-span: all;
+    height: 50px;
+    background-color: lightblue;
+  }
+  </style>
+
+  <article>
+    <div class="block">block1</div>
+    <div class="column-span">column-span1</div>
+    <div class="block">block2</div>
+    <div class="column-span">column-span2</div>
+    <div class="block" style="height: 400px;">block3</div>
+  </article>
+</html>
diff --git a/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-span-all-rule-001.html b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-span-all-rule-001.html
new file mode 100644
index 0000000..215aa567
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/css-multicol/multicol-span-all-rule-001.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<html>
+  <meta charset="utf-8">
+  <title>CSS Multi-column Layout Test: Test the column rule's block-size</title>
+  <link rel="author" title="Ting-Yu Lin" href="tlin@mozilla.com">
+  <link rel="author" title="Mozilla" href="https://www.mozilla.org/">
+  <link rel="help" href="https://drafts.csswg.org/css-multicol-1/#column-span">
+  <link rel="help" href="https://drafts.csswg.org/css-multicol-1/#column-gaps-and-rules">
+  <link rel="help" href="https://github.com/w3c/csswg-drafts/issues/2309">
+  <link rel="match" href="multicol-span-all-rule-001-ref.html">
+  <meta name="assert" content="This test verifies that the column-rule after the last column-span is extended to the content block-end edge of the multicol container.">
+
+  <style>
+  article {
+    column-count: 2;
+    column-rule: 6px solid;
+    width: 400px;
+    height: 500px;
+    background-color: lightgreen;
+    border: 2em solid purple;
+    padding: 2em;
+  }
+  div.block {
+    width: 100px;
+    height: 200px;
+  }
+  div.column-span {
+    column-span: all;
+    height: 50px;
+    background-color: lightblue;
+  }
+  </style>
+
+  <article>
+    <!-- Each block spreads its height evenly into two columns, and
+         each column contains 100px height. -->
+    <div class="block">block1</div>
+    <div class="column-span">column-span1</div>
+    <div class="block">block2</div>
+    <div class="column-span">column-span2</div>
+    <!-- The column rule after column-span2 should extend to the content edge
+         of the multicol container as if block3 has "height: 400px;"  -->
+    <div class="block">block3</div>
+  </article>
+</html>
diff --git a/third_party/blink/web_tests/external/wpt/css/css-pseudo/before-dynamic-display-none.html b/third_party/blink/web_tests/external/wpt/css/css-pseudo/before-dynamic-display-none.html
new file mode 100644
index 0000000..d8844f9
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/css-pseudo/before-dynamic-display-none.html
@@ -0,0 +1,22 @@
+<!doctype html>
+<title>CSS Test: ::before box removed when display set to 'none'.</title>
+<link rel="help" href="https://drafts.csswg.org/css-pseudo-4/#generated-content">
+<link rel="match" href="../reference/pass_if_pass_below.html">
+<style>
+  #id::before {
+    content: "FAIL";
+    position: absolute;
+    width: 100px;
+    height: 100px;
+    background-color: red;
+  }
+  #id.none::before {
+    display: none;
+  }
+</style>
+<p>Test passes if there is the word "PASS" below.</p>
+<div id="id" class="open">PASS</div>
+<script>
+  id.offsetTop;
+  id.className = "none";
+</script>
diff --git a/third_party/blink/web_tests/external/wpt/css/cssom-view/parsing/scroll-behavior-computed.html b/third_party/blink/web_tests/external/wpt/css/cssom-view/parsing/scroll-behavior-computed.html
new file mode 100644
index 0000000..ffea289
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/cssom-view/parsing/scroll-behavior-computed.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<title>CSSOM View: getComputedStyle().scrollBehavior</title>
+<link rel="help" href="https://drafts.csswg.org/cssom-view/#propdef-scroll-behavior">
+<meta name="assert" content="scroll-behavior computed value is as specified.">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/css/support/computed-testcommon.js"></script>
+</head>
+<body>
+<div id="target"></div>
+<script>
+test_computed_value("scroll-behavior", 'auto');
+test_computed_value("scroll-behavior", 'smooth');
+</script>
+</body>
+</html>
diff --git a/third_party/blink/web_tests/external/wpt/css/cssom-view/parsing/scroll-behavior-invalid.html b/third_party/blink/web_tests/external/wpt/css/cssom-view/parsing/scroll-behavior-invalid.html
new file mode 100644
index 0000000..6dfe36e
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/cssom-view/parsing/scroll-behavior-invalid.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<title>CSSOM View: parsing scroll-behavior with invalid values</title>
+<link rel="help" href="https://drafts.csswg.org/cssom-view/#propdef-scroll-behavior">
+<meta name="assert" content="scroll-behavior supports only the grammar 'auto | smooth'.">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/css/support/parsing-testcommon.js"></script>
+</head>
+<body>
+<script>
+test_invalid_value("scroll-behavior", 'normal');
+test_invalid_value("scroll-behavior", 'auto smooth');
+test_invalid_value("scroll-behavior", 'auto, smooth');
+</script>
+</body>
+</html>
diff --git a/third_party/blink/web_tests/external/wpt/css/cssom-view/parsing/scroll-behavior-valid.html b/third_party/blink/web_tests/external/wpt/css/cssom-view/parsing/scroll-behavior-valid.html
new file mode 100644
index 0000000..6e708b9
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/cssom-view/parsing/scroll-behavior-valid.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<title>CSSOM View: parsing scroll-behavior with valid values</title>
+<link rel="help" href="https://drafts.csswg.org/cssom-view/#propdef-scroll-behavior">
+<meta name="assert" content="scroll-behavior supports the full grammar 'auto | smooth'.">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/css/support/parsing-testcommon.js"></script>
+</head>
+<body>
+<script>
+test_valid_value("scroll-behavior", 'auto');
+test_valid_value("scroll-behavior", 'smooth');
+</script>
+</body>
+</html>
diff --git a/third_party/blink/web_tests/external/wpt/css/cssom/interfaces-expected.txt b/third_party/blink/web_tests/external/wpt/css/cssom/interfaces-expected.txt
index 7ffb564..c364cca 100644
--- a/third_party/blink/web_tests/external/wpt/css/cssom/interfaces-expected.txt
+++ b/third_party/blink/web_tests/external/wpt/css/cssom/interfaces-expected.txt
@@ -106,6 +106,10 @@
 PASS CSSRule interface: existence and properties of interface prototype object
 PASS CSSRule interface: existence and properties of interface prototype object's "constructor" property
 PASS CSSRule interface: existence and properties of interface prototype object's @@unscopables property
+PASS CSSRule interface: attribute cssText
+PASS CSSRule interface: attribute parentRule
+PASS CSSRule interface: attribute parentStyleSheet
+PASS CSSRule interface: attribute type
 PASS CSSRule interface: constant STYLE_RULE on interface object
 PASS CSSRule interface: constant STYLE_RULE on interface prototype object
 PASS CSSRule interface: constant CHARSET_RULE on interface object
@@ -122,10 +126,6 @@
 FAIL CSSRule interface: constant MARGIN_RULE on interface prototype object assert_own_property: expected property "MARGIN_RULE" missing
 PASS CSSRule interface: constant NAMESPACE_RULE on interface object
 PASS CSSRule interface: constant NAMESPACE_RULE on interface prototype object
-PASS CSSRule interface: attribute type
-PASS CSSRule interface: attribute cssText
-PASS CSSRule interface: attribute parentRule
-PASS CSSRule interface: attribute parentStyleSheet
 PASS CSSStyleRule interface: existence and properties of interface object
 PASS CSSStyleRule interface object length
 PASS CSSStyleRule interface object name
@@ -138,6 +138,10 @@
 PASS Stringification of sheet.cssRules[4]
 PASS CSSStyleRule interface: sheet.cssRules[4] must inherit property "selectorText" with the proper type
 PASS CSSStyleRule interface: sheet.cssRules[4] must inherit property "style" with the proper type
+PASS CSSRule interface: sheet.cssRules[4] must inherit property "cssText" with the proper type
+PASS CSSRule interface: sheet.cssRules[4] must inherit property "parentRule" with the proper type
+PASS CSSRule interface: sheet.cssRules[4] must inherit property "parentStyleSheet" with the proper type
+PASS CSSRule interface: sheet.cssRules[4] must inherit property "type" with the proper type
 PASS CSSRule interface: sheet.cssRules[4] must inherit property "STYLE_RULE" with the proper type
 PASS CSSRule interface: sheet.cssRules[4] must inherit property "CHARSET_RULE" with the proper type
 PASS CSSRule interface: sheet.cssRules[4] must inherit property "IMPORT_RULE" with the proper type
@@ -146,10 +150,6 @@
 PASS CSSRule interface: sheet.cssRules[4] must inherit property "PAGE_RULE" with the proper type
 FAIL CSSRule interface: sheet.cssRules[4] must inherit property "MARGIN_RULE" with the proper type assert_inherits: property "MARGIN_RULE" not found in prototype chain
 PASS CSSRule interface: sheet.cssRules[4] must inherit property "NAMESPACE_RULE" with the proper type
-PASS CSSRule interface: sheet.cssRules[4] must inherit property "type" with the proper type
-PASS CSSRule interface: sheet.cssRules[4] must inherit property "cssText" with the proper type
-PASS CSSRule interface: sheet.cssRules[4] must inherit property "parentRule" with the proper type
-PASS CSSRule interface: sheet.cssRules[4] must inherit property "parentStyleSheet" with the proper type
 PASS CSSImportRule interface: existence and properties of interface object
 PASS CSSImportRule interface object length
 PASS CSSImportRule interface object name
@@ -164,6 +164,10 @@
 PASS CSSImportRule interface: sheet.cssRules[0] must inherit property "href" with the proper type
 PASS CSSImportRule interface: sheet.cssRules[0] must inherit property "media" with the proper type
 PASS CSSImportRule interface: sheet.cssRules[0] must inherit property "styleSheet" with the proper type
+PASS CSSRule interface: sheet.cssRules[0] must inherit property "cssText" with the proper type
+PASS CSSRule interface: sheet.cssRules[0] must inherit property "parentRule" with the proper type
+PASS CSSRule interface: sheet.cssRules[0] must inherit property "parentStyleSheet" with the proper type
+PASS CSSRule interface: sheet.cssRules[0] must inherit property "type" with the proper type
 PASS CSSRule interface: sheet.cssRules[0] must inherit property "STYLE_RULE" with the proper type
 PASS CSSRule interface: sheet.cssRules[0] must inherit property "CHARSET_RULE" with the proper type
 PASS CSSRule interface: sheet.cssRules[0] must inherit property "IMPORT_RULE" with the proper type
@@ -172,10 +176,6 @@
 PASS CSSRule interface: sheet.cssRules[0] must inherit property "PAGE_RULE" with the proper type
 FAIL CSSRule interface: sheet.cssRules[0] must inherit property "MARGIN_RULE" with the proper type assert_inherits: property "MARGIN_RULE" not found in prototype chain
 PASS CSSRule interface: sheet.cssRules[0] must inherit property "NAMESPACE_RULE" with the proper type
-PASS CSSRule interface: sheet.cssRules[0] must inherit property "type" with the proper type
-PASS CSSRule interface: sheet.cssRules[0] must inherit property "cssText" with the proper type
-PASS CSSRule interface: sheet.cssRules[0] must inherit property "parentRule" with the proper type
-PASS CSSRule interface: sheet.cssRules[0] must inherit property "parentStyleSheet" with the proper type
 PASS CSSGroupingRule interface: existence and properties of interface object
 PASS CSSGroupingRule interface object length
 PASS CSSGroupingRule interface object name
@@ -202,6 +202,10 @@
 FAIL CSSGroupingRule interface: calling insertRule(CSSOMString, unsigned long) on sheet.cssRules[2] with too few arguments must throw TypeError assert_inherits: property "insertRule" not found in prototype chain
 FAIL CSSGroupingRule interface: sheet.cssRules[2] must inherit property "deleteRule(unsigned long)" with the proper type assert_inherits: property "deleteRule" not found in prototype chain
 FAIL CSSGroupingRule interface: calling deleteRule(unsigned long) on sheet.cssRules[2] with too few arguments must throw TypeError assert_inherits: property "deleteRule" not found in prototype chain
+PASS CSSRule interface: sheet.cssRules[2] must inherit property "cssText" with the proper type
+PASS CSSRule interface: sheet.cssRules[2] must inherit property "parentRule" with the proper type
+PASS CSSRule interface: sheet.cssRules[2] must inherit property "parentStyleSheet" with the proper type
+PASS CSSRule interface: sheet.cssRules[2] must inherit property "type" with the proper type
 PASS CSSRule interface: sheet.cssRules[2] must inherit property "STYLE_RULE" with the proper type
 PASS CSSRule interface: sheet.cssRules[2] must inherit property "CHARSET_RULE" with the proper type
 PASS CSSRule interface: sheet.cssRules[2] must inherit property "IMPORT_RULE" with the proper type
@@ -210,10 +214,6 @@
 PASS CSSRule interface: sheet.cssRules[2] must inherit property "PAGE_RULE" with the proper type
 FAIL CSSRule interface: sheet.cssRules[2] must inherit property "MARGIN_RULE" with the proper type assert_inherits: property "MARGIN_RULE" not found in prototype chain
 PASS CSSRule interface: sheet.cssRules[2] must inherit property "NAMESPACE_RULE" with the proper type
-PASS CSSRule interface: sheet.cssRules[2] must inherit property "type" with the proper type
-PASS CSSRule interface: sheet.cssRules[2] must inherit property "cssText" with the proper type
-PASS CSSRule interface: sheet.cssRules[2] must inherit property "parentRule" with the proper type
-PASS CSSRule interface: sheet.cssRules[2] must inherit property "parentStyleSheet" with the proper type
 FAIL CSSMarginRule interface: existence and properties of interface object assert_own_property: self does not have own property "CSSMarginRule" expected property "CSSMarginRule" missing
 FAIL CSSMarginRule interface object length assert_own_property: self does not have own property "CSSMarginRule" expected property "CSSMarginRule" missing
 FAIL CSSMarginRule interface object name assert_own_property: self does not have own property "CSSMarginRule" expected property "CSSMarginRule" missing
@@ -226,6 +226,10 @@
 FAIL Stringification of sheet.cssRules[2].cssRules[0] assert_equals: Unexpected exception when evaluating object expected null but got object "TypeError: Cannot read property '0' of undefined"
 FAIL CSSMarginRule interface: sheet.cssRules[2].cssRules[0] must inherit property "name" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "TypeError: Cannot read property '0' of undefined"
 FAIL CSSMarginRule interface: sheet.cssRules[2].cssRules[0] must inherit property "style" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "TypeError: Cannot read property '0' of undefined"
+FAIL CSSRule interface: sheet.cssRules[2].cssRules[0] must inherit property "cssText" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "TypeError: Cannot read property '0' of undefined"
+FAIL CSSRule interface: sheet.cssRules[2].cssRules[0] must inherit property "parentRule" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "TypeError: Cannot read property '0' of undefined"
+FAIL CSSRule interface: sheet.cssRules[2].cssRules[0] must inherit property "parentStyleSheet" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "TypeError: Cannot read property '0' of undefined"
+FAIL CSSRule interface: sheet.cssRules[2].cssRules[0] must inherit property "type" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "TypeError: Cannot read property '0' of undefined"
 FAIL CSSRule interface: sheet.cssRules[2].cssRules[0] must inherit property "STYLE_RULE" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "TypeError: Cannot read property '0' of undefined"
 FAIL CSSRule interface: sheet.cssRules[2].cssRules[0] must inherit property "CHARSET_RULE" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "TypeError: Cannot read property '0' of undefined"
 FAIL CSSRule interface: sheet.cssRules[2].cssRules[0] must inherit property "IMPORT_RULE" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "TypeError: Cannot read property '0' of undefined"
@@ -234,10 +238,6 @@
 FAIL CSSRule interface: sheet.cssRules[2].cssRules[0] must inherit property "PAGE_RULE" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "TypeError: Cannot read property '0' of undefined"
 FAIL CSSRule interface: sheet.cssRules[2].cssRules[0] must inherit property "MARGIN_RULE" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "TypeError: Cannot read property '0' of undefined"
 FAIL CSSRule interface: sheet.cssRules[2].cssRules[0] must inherit property "NAMESPACE_RULE" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "TypeError: Cannot read property '0' of undefined"
-FAIL CSSRule interface: sheet.cssRules[2].cssRules[0] must inherit property "type" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "TypeError: Cannot read property '0' of undefined"
-FAIL CSSRule interface: sheet.cssRules[2].cssRules[0] must inherit property "cssText" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "TypeError: Cannot read property '0' of undefined"
-FAIL CSSRule interface: sheet.cssRules[2].cssRules[0] must inherit property "parentRule" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "TypeError: Cannot read property '0' of undefined"
-FAIL CSSRule interface: sheet.cssRules[2].cssRules[0] must inherit property "parentStyleSheet" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "TypeError: Cannot read property '0' of undefined"
 PASS CSSNamespaceRule interface: existence and properties of interface object
 PASS CSSNamespaceRule interface object length
 PASS CSSNamespaceRule interface object name
@@ -250,6 +250,10 @@
 PASS Stringification of sheet.cssRules[1]
 PASS CSSNamespaceRule interface: sheet.cssRules[1] must inherit property "namespaceURI" with the proper type
 PASS CSSNamespaceRule interface: sheet.cssRules[1] must inherit property "prefix" with the proper type
+PASS CSSRule interface: sheet.cssRules[1] must inherit property "cssText" with the proper type
+PASS CSSRule interface: sheet.cssRules[1] must inherit property "parentRule" with the proper type
+PASS CSSRule interface: sheet.cssRules[1] must inherit property "parentStyleSheet" with the proper type
+PASS CSSRule interface: sheet.cssRules[1] must inherit property "type" with the proper type
 PASS CSSRule interface: sheet.cssRules[1] must inherit property "STYLE_RULE" with the proper type
 PASS CSSRule interface: sheet.cssRules[1] must inherit property "CHARSET_RULE" with the proper type
 PASS CSSRule interface: sheet.cssRules[1] must inherit property "IMPORT_RULE" with the proper type
@@ -258,10 +262,6 @@
 PASS CSSRule interface: sheet.cssRules[1] must inherit property "PAGE_RULE" with the proper type
 FAIL CSSRule interface: sheet.cssRules[1] must inherit property "MARGIN_RULE" with the proper type assert_inherits: property "MARGIN_RULE" not found in prototype chain
 PASS CSSRule interface: sheet.cssRules[1] must inherit property "NAMESPACE_RULE" with the proper type
-PASS CSSRule interface: sheet.cssRules[1] must inherit property "type" with the proper type
-PASS CSSRule interface: sheet.cssRules[1] must inherit property "cssText" with the proper type
-PASS CSSRule interface: sheet.cssRules[1] must inherit property "parentRule" with the proper type
-PASS CSSRule interface: sheet.cssRules[1] must inherit property "parentStyleSheet" with the proper type
 PASS CSSStyleDeclaration interface: existence and properties of interface object
 PASS CSSStyleDeclaration interface object length
 PASS CSSStyleDeclaration interface object name
diff --git a/third_party/blink/web_tests/external/wpt/interfaces/cssom.idl b/third_party/blink/web_tests/external/wpt/interfaces/cssom.idl
index 798adc1..dc9b78f 100644
--- a/third_party/blink/web_tests/external/wpt/interfaces/cssom.idl
+++ b/third_party/blink/web_tests/external/wpt/interfaces/cssom.idl
@@ -69,18 +69,20 @@
 
 [Exposed=Window]
 interface CSSRule {
+  attribute CSSOMString cssText;
+  readonly attribute CSSRule? parentRule;
+  readonly attribute CSSStyleSheet? parentStyleSheet;
+
+  // the following attribute and constants are historial
+  readonly attribute unsigned short type;
   const unsigned short STYLE_RULE = 1;
-  const unsigned short CHARSET_RULE = 2; // historical
+  const unsigned short CHARSET_RULE = 2;
   const unsigned short IMPORT_RULE = 3;
   const unsigned short MEDIA_RULE = 4;
   const unsigned short FONT_FACE_RULE = 5;
   const unsigned short PAGE_RULE = 6;
   const unsigned short MARGIN_RULE = 9;
   const unsigned short NAMESPACE_RULE = 10;
-  readonly attribute unsigned short type;
-  attribute CSSOMString cssText;
-  readonly attribute CSSRule? parentRule;
-  readonly attribute CSSStyleSheet? parentStyleSheet;
 };
 
 [Exposed=Window]
diff --git a/third_party/blink/web_tests/external/wpt/interfaces/web-nfc.idl b/third_party/blink/web_tests/external/wpt/interfaces/web-nfc.idl
index 365b38f..13afc276 100644
--- a/third_party/blink/web_tests/external/wpt/interfaces/web-nfc.idl
+++ b/third_party/blink/web_tests/external/wpt/interfaces/web-nfc.idl
@@ -14,7 +14,7 @@
   sequence<NDEFRecordInit> records;
 };
 
-typedef (DOMString or unrestricted double or ArrayBuffer or Dictionary) NDEFRecordData;
+typedef (DOMString or unrestricted double or ArrayBuffer or object) NDEFRecordData;
 
 [Constructor(NDEFRecordInit recordInit), Exposed=Window]
 interface NDEFRecord {
diff --git a/third_party/blink/web_tests/external/wpt/mathml/relations/css-styling/writing-mode/writing-mode-001.html b/third_party/blink/web_tests/external/wpt/mathml/relations/css-styling/writing-mode/writing-mode-001.html
index 01a93eb..cbc8ce7 100644
--- a/third_party/blink/web_tests/external/wpt/mathml/relations/css-styling/writing-mode/writing-mode-001.html
+++ b/third_party/blink/web_tests/external/wpt/mathml/relations/css-styling/writing-mode/writing-mode-001.html
@@ -18,11 +18,7 @@
   function runTests() {
       var reference = document.getElementById("horizontal-tb_ltr");
 
-      ["horizontal-tb_rtl",
-       "vertical-lr_ltr",
-       "vertical-lr_rtl",
-       "vertical-rl_ltr",
-       "vertical-rl_rtl"].forEach(id => {
+      ["horizontal-tb_rtl"].forEach(id => {
            var element = document.getElementById(id);
 
            test(function() {
@@ -69,53 +65,5 @@
       </mrow>
     </math>
   </p>
-  <p>
-    <math style="writing-mode: vertical-lr;">
-      <mrow id="vertical-lr_ltr">
-        <mspace style="background: blue"
-                width="20px" height="30px" depth="40px"></mspace>
-        <mspace style="background: black"
-                width="50px" depth="60px"></mspace>
-        <mspace style="background: yellow"
-                width="70px" height="80px"></mspace>
-      </mrow>
-    </math>
-  </p>
-  <p>
-    <math style="writing-mode: vertical-lr; direction: rtl;">
-      <mrow id="vertical-lr_rtl">
-        <mspace style="background: blue"
-                width="20px" height="30px" depth="40px"></mspace>
-        <mspace style="background: black"
-                width="50px" depth="60px"></mspace>
-        <mspace style="background: yellow"
-                width="70px" height="80px"></mspace>
-      </mrow>
-    </math>
-  </p>
-  <p>
-    <math style="writing-mode: vertical-rl;">
-      <mrow id="vertical-rl_ltr">
-        <mspace style="background: blue"
-                width="20px" height="30px" depth="40px"></mspace>
-        <mspace style="background: black"
-                width="50px" depth="60px"></mspace>
-        <mspace style="background: yellow"
-                width="70px" height="80px"></mspace>
-      </mrow>
-    </math>
-  </p>
-  <p>
-    <math style="writing-mode: vertical-rl; direction: rtl;">
-      <mrow id="vertical-rl_rtl">
-        <mspace style="background: blue"
-                width="20px" height="30px" depth="40px"></mspace>
-        <mspace style="background: black"
-                width="50px" depth="60px"></mspace>
-        <mspace style="background: yellow"
-                width="70px" height="80px"></mspace>
-      </mrow>
-    </math>
-  </p>
 </body>
 </html>
diff --git a/third_party/blink/web_tests/external/wpt/mathml/relations/css-styling/writing-mode/writing-mode-001.tentative.html b/third_party/blink/web_tests/external/wpt/mathml/relations/css-styling/writing-mode/writing-mode-001.tentative.html
new file mode 100644
index 0000000..642ee669
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/mathml/relations/css-styling/writing-mode/writing-mode-001.tentative.html
@@ -0,0 +1,111 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<title>writing mode</title>
+<link rel="help" href="https://mathml-refresh.github.io/mathml-core/#layout-algorithms">
+<meta name="assert" content="Verify CSS writing mode (writing-mode and directionproperties) for mrow.">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/mathml/support/feature-detection.js"></script>
+<script src="/mathml/support/layout-comparison.js"></script>
+<script>
+  var epsilon = 1;
+
+  setup({ explicit_done: true });
+  window.addEventListener("load", runTests);
+
+  function runTests() {
+      var reference = document.getElementById("horizontal-tb_ltr");
+
+      // These tests are kept in a separate tentative.html file until it is
+      // clear how to handle vertical math layout.
+      // See https://github.com/mathml-refresh/mathml/issues/18
+      ["vertical-lr_ltr",
+       "vertical-lr_rtl",
+       "vertical-rl_ltr",
+       "vertical-rl_rtl"].forEach(id => {
+           var element = document.getElementById(id);
+
+           test(function() {
+               var style = window.getComputedStyle(element);
+               var writingMode = id.split("_");
+               assert_equals(style.getPropertyValue("writing-mode"),
+                             writingMode[0], "writing-mode");
+               assert_equals(style.getPropertyValue("direction"),
+                             writingMode[1], "direction");
+           }, `Inheritance of CSS writing-mode and direction (id='${id}')`);
+
+           test(function() {
+              assert_true(MathMLFeatureDetection.has_mspace());
+              compareLayout(element, reference, epsilon);
+           }, `Layout of mrow (id='${id}')`);
+      });
+      done();
+  }
+</script>
+</head>
+<body>
+  <div id="log"></div>
+  <p>
+    <math>
+      <mrow id="horizontal-tb_ltr">
+        <mspace style="background: blue"
+                width="20px" height="30px" depth="40px"></mspace>
+        <mspace style="background: black"
+                width="50px" depth="60px"></mspace>
+        <mspace style="background: yellow"
+                width="70px" height="80px"></mspace>
+      </mrow>
+    </math>
+  </p>
+  <p>
+    <math style="writing-mode: vertical-lr;">
+      <mrow id="vertical-lr_ltr">
+        <mspace style="background: blue"
+                width="20px" height="30px" depth="40px"></mspace>
+        <mspace style="background: black"
+                width="50px" depth="60px"></mspace>
+        <mspace style="background: yellow"
+                width="70px" height="80px"></mspace>
+      </mrow>
+    </math>
+  </p>
+  <p>
+    <math style="writing-mode: vertical-lr; direction: rtl;">
+      <mrow id="vertical-lr_rtl">
+        <mspace style="background: blue"
+                width="20px" height="30px" depth="40px"></mspace>
+        <mspace style="background: black"
+                width="50px" depth="60px"></mspace>
+        <mspace style="background: yellow"
+                width="70px" height="80px"></mspace>
+      </mrow>
+    </math>
+  </p>
+  <p>
+    <math style="writing-mode: vertical-rl;">
+      <mrow id="vertical-rl_ltr">
+        <mspace style="background: blue"
+                width="20px" height="30px" depth="40px"></mspace>
+        <mspace style="background: black"
+                width="50px" depth="60px"></mspace>
+        <mspace style="background: yellow"
+                width="70px" height="80px"></mspace>
+      </mrow>
+    </math>
+  </p>
+  <p>
+    <math style="writing-mode: vertical-rl; direction: rtl;">
+      <mrow id="vertical-rl_rtl">
+        <mspace style="background: blue"
+                width="20px" height="30px" depth="40px"></mspace>
+        <mspace style="background: black"
+                width="50px" depth="60px"></mspace>
+        <mspace style="background: yellow"
+                width="70px" height="80px"></mspace>
+      </mrow>
+    </math>
+  </p>
+</body>
+</html>
diff --git a/third_party/blink/web_tests/external/wpt/mathml/relations/css-styling/writing-mode/writing-mode-002.html b/third_party/blink/web_tests/external/wpt/mathml/relations/css-styling/writing-mode/writing-mode-002.html
index 97be629..85c869e 100644
--- a/third_party/blink/web_tests/external/wpt/mathml/relations/css-styling/writing-mode/writing-mode-002.html
+++ b/third_party/blink/web_tests/external/wpt/mathml/relations/css-styling/writing-mode/writing-mode-002.html
@@ -21,11 +21,7 @@
           if (tag == "annotation" || tag == "annotation-xml")
               continue; // These tags have display: none.
 
-          ["horizontal-tb_rtl",
-           "vertical-lr_ltr",
-           "vertical-lr_rtl",
-           "vertical-rl_ltr",
-           "vertical-rl_rtl"].forEach(id => {
+          ["horizontal-tb_rtl"].forEach(id => {
                var writingMode = id.split("_");
                var writingModeString = `writing-mode: ${writingMode[0]}; direction: ${writingMode[1]};`;
 
diff --git a/third_party/blink/web_tests/external/wpt/mathml/relations/css-styling/writing-mode/writing-mode-002.tentative.html b/third_party/blink/web_tests/external/wpt/mathml/relations/css-styling/writing-mode/writing-mode-002.tentative.html
new file mode 100644
index 0000000..e86f03a
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/mathml/relations/css-styling/writing-mode/writing-mode-002.tentative.html
@@ -0,0 +1,88 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<title>writing mode</title>
+<link rel="help" href="https://mathml-refresh.github.io/mathml-core/#layout-algorithms">
+<meta name="assert" content="Verify CSS writing mode (writing-mode and direction properties) for mrow.">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/mathml/support/feature-detection.js"></script>
+<script src="/mathml/support/layout-comparison.js"></script>
+<script src="/mathml/support/mathml-fragments.js"></script>
+<script>
+  var epsilon = 1;
+
+  setup({ explicit_done: true });
+  window.addEventListener("load", runTests);
+
+  function runTests() {
+      for (tag in MathMLFragments) {
+          if (tag == "annotation" || tag == "annotation-xml")
+              continue; // These tags have display: none.
+
+          // These tests are kept in a separate tentative.html file until it is
+          // clear how to handle vertical math layout.
+          // See https://github.com/mathml-refresh/mathml/issues/18
+          ["vertical-lr_ltr",
+           "vertical-lr_rtl",
+           "vertical-rl_ltr",
+           "vertical-rl_rtl"].forEach(id => {
+               var writingMode = id.split("_");
+               var writingModeString = `writing-mode: ${writingMode[0]}; direction: ${writingMode[1]};`;
+
+               document.body.insertAdjacentHTML("beforeend", `<div>\
+<math>${MathMLFragments[tag]}</math>\
+<math>${MathMLFragments[tag]}</math>\
+</div>`);
+               var div = document.body.lastElementChild;
+
+               var styleMath = div.firstElementChild;
+               styleMath.setAttribute("style", writingModeString);
+               var styleElement = FragmentHelper.element(styleMath);
+
+               var referenceMath = div.lastElementChild;
+               var referenceElement = FragmentHelper.element(referenceMath);
+
+               [styleMath, referenceMath].forEach(math => {
+                   Array.from(math.getElementsByClassName("mathml-container")).forEach(container => {
+                       container.insertAdjacentHTML("beforeend", "\
+<mspace style='background: blue'\
+        width='20px' height='30px' depth='40px'></mspace>\
+<mspace style='background: black'\
+        width='50px' depth='60px'></mspace>\
+<mspace style='background: yellow'\
+        width='70px' height='80px'></mspace>");
+                   });
+                   Array.from(math.getElementsByClassName("foreign-container")).forEach(container => {
+                       container.insertAdjacentHTML("beforeend", "\
+<span style='display: inline-block; background: lightblue;\
+             inline-size: 20px; block-size: 30px;\
+             vertical-align: bottom;'></span>\
+<span style='display: inline-block; background: pink;\
+             inline-size: 40px; block-size: 50px;\
+             vertical-align: bottom;'></span>");
+                   });
+               });
+
+               test(function() {
+                   assert_true(MathMLFeatureDetection.has_mspace());
+                   var style = window.getComputedStyle(styleElement);
+                   assert_equals(style.getPropertyValue("writing-mode"),
+                                 writingMode[0], "writing-mode");
+                   assert_equals(style.getPropertyValue("direction"),
+                             writingMode[1], "direction");
+                   compareLayout(styleElement, referenceElement, epsilon);
+               }, `Layout of ${tag} (${writingModeString})`);
+
+               div.style = "display: none;"; // Hide the div after testing.
+           });
+      }
+      done();
+  }
+</script>
+</head>
+<body>
+  <div id="log"></div>
+</body>
+</html>
diff --git a/third_party/blink/web_tests/external/wpt/svg/animations/correct-events-for-short-animations-with-syncbases.html b/third_party/blink/web_tests/external/wpt/svg/animations/correct-events-for-short-animations-with-syncbases.html
new file mode 100644
index 0000000..96552df4
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/svg/animations/correct-events-for-short-animations-with-syncbases.html
@@ -0,0 +1,51 @@
+<!DOCTYPE html>
+
+<title>Correct events for short animations with syncbases</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<link rel="author" title="Edvard Thörnros" href="mailto:edvardt@opera.com">
+<link rel="help" href="https://svgwg.org/specs/animations/#TimingAttributes">
+
+<svg viewBox="0 0 250 50" xmlns="http://www.w3.org/2000/svg">
+  <g id="a" opacity="0">
+    <animate attributeName="opacity" from="0" to="1" begin="0ms;last.end+100ms" dur="10ms" fill="freeze"
+      id="first"/>
+    <animate attributeName="opacity" from="1" to="0" begin="last.end" dur="10ms" fill="freeze"/>
+    <rect x="0" y="0" width="50" height="50" fill="#AA0"/>
+  </g>
+  <g id="b" opacity="0">
+    <animate attributeName="opacity" from="1" to="1" begin="first.end+10ms" dur="10ms" fill="freeze"
+      id="last" onend="onend_filling()"/>
+    <animate attributeName="opacity" from="1" to="0" begin="last.end+1ms" dur="10ms" fill="freeze"
+      onbegin="onend_clearing()"/>
+    <rect x="50" y="0" width="50" height="50" fill="#AA0"/>
+  </g>
+</svg>
+<script>
+  let onend_clearing = null;
+  let onend_filling = null;
+
+  async_test(t => {
+    let svg = document.querySelector("svg");
+    // Deliberate no a
+    let b = document.querySelector("#b");
+    let passed = false;
+    let triggers = 0;
+    let filling_steps = 0;
+    let runs = 3; // Issue 379751 broke after 2 cycles, hence this is a 3.
+    onend_filling = t.step_func(() => {
+      filling_steps++;
+      if (filling_steps < (runs + 1)) return;
+      svg.pauseAnimations();
+      assert_unreached("Fired too many onend events.");
+    });
+    onend_clearing = t.step_func(() => {
+      triggers++;
+      if (triggers != runs) return;
+      svg.pauseAnimations();
+      // We don't check the first element, since it might have started fading in
+      assert_not_equals(window.getComputedStyle(b, null).opacity, "1");
+      t.done();
+    });
+  });
+</script>
diff --git a/third_party/blink/web_tests/external/wpt/webdriver/tests/perform_actions/validity.py b/third_party/blink/web_tests/external/wpt/webdriver/tests/perform_actions/validity.py
index ce8a0d6..656406718 100644
--- a/third_party/blink/web_tests/external/wpt/webdriver/tests/perform_actions/validity.py
+++ b/third_party/blink/web_tests/external/wpt/webdriver/tests/perform_actions/validity.py
@@ -62,3 +62,16 @@
     }]
     response = perform_actions(session, actions)
     assert_success(response)
+
+
+@pytest.mark.parametrize("action_type", ["none", "key", "pointer"])
+def test_action_without_id(session, action_type):
+    actions = [{
+        "type": action_type,
+        "actions": [{
+            "type": "pause",
+            "duration": 1
+        }]
+    }]
+    response = perform_actions(session, actions)
+    assert_error(response, "invalid argument")
diff --git a/third_party/blink/web_tests/svg/animations/correct-events-for-short-animations-with-syncbases.html b/third_party/blink/web_tests/svg/animations/correct-events-for-short-animations-with-syncbases.html
deleted file mode 100644
index 786cb188..0000000
--- a/third_party/blink/web_tests/svg/animations/correct-events-for-short-animations-with-syncbases.html
+++ /dev/null
@@ -1,69 +0,0 @@
-<!DOCTYPE html>
-
-<title>Correct events for short animations with syncbases</title>
-<script src="../../resources/testharness.js"></script>
-<script src="../../resources/testharnessreport.js"></script>
-
-<svg viewBox="0 0 250 50" xmlns="http://www.w3.org/2000/svg">
-  <g id="a" opacity="0">
-    <animate attributeName="opacity" from="0" to="1" begin="0ms;last.end+10ms" dur="10ms" fill="freeze"
-      id="first"/>
-    <animate attributeName="opacity" from="1" to="0" begin="last.end" dur="1ms" fill="freeze"/>
-    <rect x="0" y="0" width="50" height="50" fill="#0F0"/>
-  </g>
-  <g id="b" opacity="0">
-    <animate attributeName="opacity" from="1" to="1" begin="first.end+10ms" dur="1ms" fill="freeze"/>
-    <animate attributeName="opacity" from="1" to="0" begin="last.end" dur="1ms" fill="freeze"/>
-    <rect x="50" y="0" width="50" height="50" fill="#F00"/>
-  </g>
-  <g id="c" opacity="0">
-    <animate attributeName="opacity" from="1" to="1" begin="first.end+20ms" dur="1ms" fill="freeze"/>
-    <animate attributeName="opacity" from="1" to="0" begin="last.end" dur="1ms" fill="freeze"/>
-    <rect x="100" y="0" width="50" height="50" fill="#F00"/>
-  </g>
-  <g id="d" opacity="0">
-    <animate attributeName="opacity" from="1" to="1" begin="first.end+30ms" dur="1ms" fill="freeze"/>
-    <animate attributeName="opacity" from="1" to="0" begin="last.end" dur="1ms" fill="freeze"/>
-    <rect x="150" y="0" width="50" height="50" fill="#F00"/>
-  </g>
-  <g id="e" opacity="0">
-    <animate attributeName="opacity" from="1" to="1" begin="first.end+40ms" dur="1ms" fill="freeze"
-      id="last" onend="onend_filling()"/>
-    <animate attributeName="opacity" from="1" to="0" begin="last.end" dur="1ms" fill="freeze"
-      onbegin="onend_clearing()"/>
-    <rect x="200" y="0" width="50" height="50" fill="#F00"/>
-  </g>
-</svg>
-<script>
-  let onend_clearing = null;
-  let onend_filling = null;
-
-  async_test(t => {
-    let svg = document.querySelector("svg");
-    // Deliberate no a
-    let b = document.querySelector("#b");
-    let c = document.querySelector("#c");
-    let d = document.querySelector("#d");
-    let e = document.querySelector("#e");
-    let passed = false;
-    let triggers = 0;
-    let filling_steps = 0;
-    onend_filling = t.step_func(() => {
-      filling_steps++;
-      if (filling_steps < 5) return;
-      svg.pauseAnimations();
-      assert_unreached("Fired too many onend events.");
-    });
-    onend_clearing = t.step_func(() => {
-      triggers++;
-      if (triggers != 3) return;
-      svg.pauseAnimations();
-      // We don't check the first element, since it might have started fading in
-      assert_equals(window.getComputedStyle(b, null).opacity, "0");
-      assert_equals(window.getComputedStyle(c, null).opacity, "0");
-      assert_equals(window.getComputedStyle(d, null).opacity, "0");
-      assert_equals(window.getComputedStyle(e, null).opacity, "0");
-      t.done();
-    });
-  });
-</script>
diff --git a/third_party/blink/web_tests/virtual/audio-service/external/wpt/mediacapture-streams/README.txt b/third_party/blink/web_tests/virtual/audio-service/external/wpt/mediacapture-streams/README.txt
new file mode 100644
index 0000000..53221e3
--- /dev/null
+++ b/third_party/blink/web_tests/virtual/audio-service/external/wpt/mediacapture-streams/README.txt
@@ -0,0 +1,2 @@
+Runs external/wpt/mediacapture-streams tests with
+--enable-features=AudioServiceOutOfProcess,AudioServiceSandbox
diff --git a/third_party/blink/web_tests/virtual/audio-service/http/tests/media/README.txt b/third_party/blink/web_tests/virtual/audio-service/http/tests/media/README.txt
new file mode 100644
index 0000000..ff4c6ba
--- /dev/null
+++ b/third_party/blink/web_tests/virtual/audio-service/http/tests/media/README.txt
@@ -0,0 +1,2 @@
+Runs http/tests/media tests with
+--enable-features=AudioServiceOutOfProcess,AudioServiceSandbox
diff --git a/third_party/blink/web_tests/virtual/audio-service/media/README.txt b/third_party/blink/web_tests/virtual/audio-service/media/README.txt
new file mode 100644
index 0000000..bcd289d
--- /dev/null
+++ b/third_party/blink/web_tests/virtual/audio-service/media/README.txt
@@ -0,0 +1,2 @@
+Runs media tests with
+--enable-features=AudioServiceOutOfProcess,AudioServiceSandbox
diff --git a/third_party/webrtc_overrides/task_queue_factory.cc b/third_party/webrtc_overrides/task_queue_factory.cc
index 3be3b27..f345c509 100644
--- a/third_party/webrtc_overrides/task_queue_factory.cc
+++ b/third_party/webrtc_overrides/task_queue_factory.cc
@@ -19,7 +19,7 @@
 class WebrtcTaskQueue final : public webrtc::TaskQueueBase {
  public:
   explicit WebrtcTaskQueue(const base::TaskTraits& traits)
-      : task_runner_(base::CreateSequencedTaskRunnerWithTraits(traits)),
+      : task_runner_(base::CreateSequencedTaskRunner(traits)),
         is_active_(new base::RefCountedData<bool>(true)) {
     DCHECK(task_runner_);
   }
@@ -102,19 +102,21 @@
   switch (priority) {
     case webrtc::TaskQueueFactory::Priority::HIGH:
 #if defined(OS_ANDROID)
-      return {base::WithBaseSyncPrimitives(), base::TaskPriority::HIGHEST};
+      return {base::ThreadPool(), base::WithBaseSyncPrimitives(),
+              base::TaskPriority::HIGHEST};
 #else
-      return {base::TaskPriority::HIGHEST};
+      return {base::ThreadPool(), base::TaskPriority::HIGHEST};
 #endif
       break;
     case webrtc::TaskQueueFactory::Priority::LOW:
-      return {base::MayBlock(), base::TaskPriority::BEST_EFFORT};
+      return {base::ThreadPool(), base::MayBlock(),
+              base::TaskPriority::BEST_EFFORT};
     case webrtc::TaskQueueFactory::Priority::NORMAL:
     default:
 #if defined(OS_ANDROID)
-      return {base::WithBaseSyncPrimitives()};
+      return {base::ThreadPool(), base::WithBaseSyncPrimitives()};
 #else
-      return {};
+      return {base::ThreadPool()};
 #endif
   }
 }
diff --git a/tools/android/checkxmlstyle/checkxmlstyle.py b/tools/android/checkxmlstyle/checkxmlstyle.py
index 2c4d28f5..0cca798 100644
--- a/tools/android/checkxmlstyle/checkxmlstyle.py
+++ b/tools/android/checkxmlstyle/checkxmlstyle.py
@@ -63,7 +63,7 @@
   """Checks color (A)RGB values are of format either RRGGBB or AARRGGBB."""
   errors = []
   for f in IncludedFiles(input_api):
-    # Ingnore vector drawable xmls
+    # Ignore vector drawable xmls
     contents = input_api.ReadFile(f)
     if '<vector' in contents:
       continue
@@ -92,20 +92,24 @@
 def _CheckColorReferences(input_api, output_api):
   """Checks no (A)RGB values are defined outside colors.xml."""
   errors = []
+  warnings = []
   for f in IncludedFiles(input_api):
     if (f.LocalPath().endswith('/colors.xml') or
         f.LocalPath().endswith('/color_palette.xml')):
       continue
-    # Ingnore vector drawable xmls
+    # Ignore new references in vector/shape drawable xmls
     contents = input_api.ReadFile(f)
-    if '<vector' in contents:
-      continue
+    is_vector_drawable = '<vector' in contents or '<shape' in contents
     for line_number, line in f.ChangedContents():
       if COLOR_PATTERN.search(line):
-        errors.append(
-            '  %s:%d\n    \t%s' % (f.LocalPath(), line_number, line.strip()))
+        issue = '  %s:%d\n    \t%s' % (f.LocalPath(), line_number, line.strip())
+        if is_vector_drawable:
+          warnings.append(issue)
+        else:
+          errors.append(issue)
+  result = []
   if errors:
-    return [output_api.PresubmitError(
+    result += [output_api.PresubmitError(
   '''
   Android Color Reference Check failed:
     Your new code added new color references that are not color resources from
@@ -117,7 +121,24 @@
     See https://crbug.com/775198 for more information.
   ''',
         errors)]
-  return []
+  if warnings:
+    result += [output_api.PresubmitPromptWarning(
+  '''
+  Android Color Reference Check warning:
+    Your new code added new color references that are not color resources from
+    chrome/android/java/res/values/colors.xml, listed below.
+
+    This is typically not needed even in vector/shape drawables. Please consider
+    using an existing color resources if possible.
+
+    Only bypass this check if you are confident that you should be using a HEX
+    reference, e.g. you are adding an illustration or a shadow using XML rather
+    than a PNG/9-patch.
+
+    Please contact src/chrome/android/java/res/OWNERS for questions.
+  ''',
+        warnings)]
+  return result
 
 
 def _CheckDuplicateColors(input_api, output_api):
diff --git a/tools/android/checkxmlstyle/checkxmlstyle_test.py b/tools/android/checkxmlstyle/checkxmlstyle_test.py
index 61046bd68..459f579b 100755
--- a/tools/android/checkxmlstyle/checkxmlstyle_test.py
+++ b/tools/android/checkxmlstyle/checkxmlstyle_test.py
@@ -98,9 +98,10 @@
              '</vector>']
     mock_input_api = MockInputApi()
     mock_input_api.files = [MockFile('chrome/java/res_test/test.xml', lines)]
-    errors = checkxmlstyle._CheckColorReferences(
+    result = checkxmlstyle._CheckColorReferences(
         mock_input_api, MockOutputApi())
-    self.assertEqual(0, len(errors))
+    self.assertEqual(1, len(result))
+    self.assertEqual(result[0].type, 'warning')
 
   def testInvalidReference(self):
     lines = ['<TextView',
diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
index 2e6cfe2..8f5f3dbf 100644
--- a/tools/metrics/histograms/enums.xml
+++ b/tools/metrics/histograms/enums.xml
@@ -2484,6 +2484,57 @@
   <int value="6" label="Not allowed"/>
 </enum>
 
+<enum name="ArcExternalProtocolAction">
+  <int value="0" label="other App accepted and persisted"/>
+  <int value="1" label="other App accepted and not persisted"/>
+  <int value="2" label="other App rejected"/>
+  <int value="3" label="bitcoin:// App accepted and persisted"/>
+  <int value="4" label="bitcoin:// App accepted and not persisted"/>
+  <int value="5" label="bitcoin:// App rejected"/>
+  <int value="6" label="geo:// App accepted and persisted"/>
+  <int value="7" label="geo:// App accepted and not persisted"/>
+  <int value="8" label="geo:// App rejected"/>
+  <int value="9" label="im:// App accepted and persisted"/>
+  <int value="10" label="im:// App accepted and not persisted"/>
+  <int value="11" label="im:// App rejected"/>
+  <int value="12" label="irc:// App accepted and persisted"/>
+  <int value="13" label="irc:// App accepted and not persisted"/>
+  <int value="14" label="irc:// App rejected"/>
+  <int value="15" label="magnet:// App accepted and persisted"/>
+  <int value="16" label="magnet:// App accepted and not persisted"/>
+  <int value="17" label="magnet:// App rejected"/>
+  <int value="18" label="mailto:// App accepted and persisted"/>
+  <int value="19" label="mailto:// App accepted and not persisted"/>
+  <int value="20" label="mailto:// App rejected"/>
+  <int value="21" label="mms:// App accepted and persisted"/>
+  <int value="22" label="mms:// App accepted and not persisted"/>
+  <int value="23" label="mms:// App rejected"/>
+  <int value="24" label="sip:// App accepted and persisted"/>
+  <int value="25" label="sip:// App accepted and not persisted"/>
+  <int value="26" label="sip:// App rejected"/>
+  <int value="27" label="skype:// App accepted and persisted"/>
+  <int value="28" label="skype:// App accepted and not persisted"/>
+  <int value="29" label="skype:// App rejected"/>
+  <int value="30" label="sms:// App accepted and persisted"/>
+  <int value="31" label="sms:// App accepted and not persisted"/>
+  <int value="32" label="sms:// App rejected"/>
+  <int value="33" label="spotify:// App accepted and persisted"/>
+  <int value="34" label="spotify:// App accepted and not persisted"/>
+  <int value="35" label="spotify:// App rejected"/>
+  <int value="36" label="ssh:// App accepted and persisted"/>
+  <int value="37" label="ssh:// App accepted and not persisted"/>
+  <int value="38" label="ssh:// App rejected"/>
+  <int value="39" label="tel:// App accepted and persisted"/>
+  <int value="40" label="tel:// App accepted and not persisted"/>
+  <int value="41" label="tel:// App rejected"/>
+  <int value="42" label="telnet:// App accepted and persisted"/>
+  <int value="43" label="telnet:// App accepted and not persisted"/>
+  <int value="44" label="telnet:// App rejected"/>
+  <int value="45" label="webcal:// App accepted and persisted"/>
+  <int value="46" label="webcal:// App accepted and not persisted"/>
+  <int value="47" label="webcal:// App rejected"/>
+</enum>
+
 <enum name="ArcIntentHandlerAction">
   <summary>Defines Arc intent handler actions</summary>
   <int value="0" label="Error after showing picker"/>
@@ -4933,6 +4984,7 @@
   <int value="215" label="RFHI_BEGIN_NAVIGATION_NON_WEBBY_TRANSITION"/>
   <int value="216" label="RFH_NO_MATCHING_NAVIGATION_REQUEST_ON_COMMIT"/>
   <int value="217" label="AUTH_INVALID_ICON_URL"/>
+  <int value="218" label="MDDH_INVALID_STREAM_SELECTION_INFO"/>
 </enum>
 
 <enum name="BadMessageReasonExtensions">
@@ -24183,6 +24235,13 @@
   <int value="2983" label="ContentIndexAdd"/>
   <int value="2984" label="ContentIndexDelete"/>
   <int value="2985" label="ContentIndexGet"/>
+  <int value="2986" label="V8SpeechGrammar_Constructor"/>
+  <int value="2987" label="V8SpeechGrammarList_AddFromString_Method"/>
+  <int value="2988" label="V8SpeechGrammarList_Constructor"/>
+  <int value="2989" label="V8SpeechGrammarList_Item_Method"/>
+  <int value="2990" label="V8SpeechRecognition_Constructor"/>
+  <int value="2991" label="V8SpeechRecognition_Grammars_AttributeGetter"/>
+  <int value="2992" label="V8SpeechRecognition_Grammars_AttributeSetter"/>
 </enum>
 
 <enum name="FeaturePolicyAllowlistType">
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index ca2cf27..1853eed 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -18805,6 +18805,29 @@
   </summary>
 </histogram>
 
+<histogram name="ChromeOS.Apps.ExternalProtocolDialog.Accepted"
+    enum="ArcExternalProtocolAction" expires_after="2019-09-17">
+  <owner>dominickn@chromium.org</owner>
+  <owner>melzhang@chromium.org</owner>
+  <owner>mxcai@chromium.org</owner>
+  <summary>
+    Records the response when users that are shown the intent picker accept
+    opening an external protocol in an app as well as whether the app is
+    persisted.
+  </summary>
+</histogram>
+
+<histogram name="ChromeOS.Apps.ExternalProtocolDialog.Rejected"
+    enum="ArcExternalProtocolAction" expires_after="2019-09-17">
+  <owner>dominickn@chromium.org</owner>
+  <owner>melzhang@chromium.org</owner>
+  <owner>mxcai@chromium.org</owner>
+  <summary>
+    Records the response when users that are shown the intent picker reject
+    opening an external protocol in an app.
+  </summary>
+</histogram>
+
 <histogram name="ChromeOS.Apps.IntentPickerAction"
     enum="ArcIntentHandlerAction">
   <owner>elijahtaylor@google.com</owner>
@@ -135413,7 +135436,7 @@
   </summary>
 </histogram>
 
-<histogram base="true" name="Sync.E2ELatency" units="ms" expires_after="M80">
+<histogram base="true" name="Sync.E2ELatency" units="ms" expires_after="M90">
   <owner>mastiz@chromium.org</owner>
   <owner>melandory@chromium.org</owner>
   <summary>
diff --git a/tools/perf/benchmarks/blink_perf_unittest.py b/tools/perf/benchmarks/blink_perf_unittest.py
index 2223ab7..d3ca94d 100644
--- a/tools/perf/benchmarks/blink_perf_unittest.py
+++ b/tools/perf/benchmarks/blink_perf_unittest.py
@@ -2,6 +2,8 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 import os
+import shutil
+import tempfile
 import unittest
 
 from telemetry import decorators
@@ -24,11 +26,15 @@
       '..', '..', '..', 'third_party', 'blink', 'perf_tests',
       'resources')
   def setUp(self):
-    self._options = options_for_unittests.GetCopy()
+    self._options = options_for_unittests.GetRunOptions(
+        output_dir=tempfile.mkdtemp())
     # pylint: disable=protected-access
     self._measurement = blink_perf._BlinkPerfMeasurement()
     # pylint: enable=protected-access
 
+  def tearDown(self):
+    shutil.rmtree(self._options.output_dir)
+
   def _CreateStorySetForTestFile(self, test_file_name):
     story_set = story.StorySet(base_dir=self._BLINK_PERF_TEST_DATA_DIR,
         serving_dirs={self._BLINK_PERF_TEST_DATA_DIR,
@@ -41,9 +47,10 @@
     return story_set
 
   def testBlinkPerfTracingMetricsForMeasureTime(self):
-    results = self.RunMeasurement(measurement=self._measurement,
-        ps=self._CreateStorySetForTestFile('append-child-measure-time.html'),
-        options=self._options)
+    results = self.RunMeasurement(
+        self._measurement,
+        self._CreateStorySetForTestFile('append-child-measure-time.html'),
+        run_options=self._options)
     self.assertFalse(results.had_failures)
     self.assertEquals(len(list(results.IterRunsWithTraces())), 1)
 
@@ -62,10 +69,11 @@
     self.assertGreater(update_layout_trees[0].mean, 0.001)
 
   def testBlinkPerfTracingMetricsForMeasureFrameTime(self):
-    results = self.RunMeasurement(measurement=self._measurement,
-        ps=self._CreateStorySetForTestFile(
+    results = self.RunMeasurement(
+        self._measurement,
+        self._CreateStorySetForTestFile(
             'color-changes-measure-frame-time.html'),
-        options=self._options)
+        run_options=self._options)
     self.assertFalse(results.had_failures)
     self.assertEquals(len(list(results.IterRunsWithTraces())), 1)
 
@@ -85,10 +93,11 @@
     self.assertGreater(frame_view_painttrees[0].mean, 0.001)
 
   def testBlinkPerfTracingMetricsForMeasurePageLoadTime(self):
-    results = self.RunMeasurement(measurement=self._measurement,
-        ps=self._CreateStorySetForTestFile(
+    results = self.RunMeasurement(
+        self._measurement,
+        self._CreateStorySetForTestFile(
             'simple-html-measure-page-load-time.html'),
-        options=self._options)
+        run_options=self._options)
     self.assertFalse(results.had_failures)
     self.assertEquals(len(list(results.IterRunsWithTraces())), 1)
 
@@ -109,10 +118,10 @@
 
   @decorators.Disabled('mac')  # Flaky on mac: crbug.com/960554
   def testBlinkPerfTracingMetricsForMeasureAsync(self):
-    results = self.RunMeasurement(measurement=self._measurement,
-        ps=self._CreateStorySetForTestFile(
-            'simple-blob-measure-async.html'),
-        options=self._options)
+    results = self.RunMeasurement(
+        self._measurement,
+        self._CreateStorySetForTestFile('simple-blob-measure-async.html'),
+        run_options=self._options)
     self.assertFalse(results.had_failures)
     self.assertEquals(len(list(results.IterRunsWithTraces())), 1)
 
@@ -147,19 +156,19 @@
     self.assertGreater(read_data[0].mean, 0.001)
 
   def testBlinkPerfLifecycleMethods(self):
-    results = self.RunMeasurement(measurement=self._measurement,
-        ps=self._CreateStorySetForTestFile(
-            'lifecycle-methods.html'),
-        options=self._options)
+    results = self.RunMeasurement(
+        self._measurement,
+        self._CreateStorySetForTestFile('lifecycle-methods.html'),
+        run_options=self._options)
     self.assertFalse(results.had_failures)
     self.assertEquals(len(list(results.IterRunsWithTraces())), 0)
 
   def testExtraChromeCategories(self):
     self._options.extra_chrome_categories = 'cc,blink'
-    results = self.RunMeasurement(measurement=self._measurement,
-        ps=self._CreateStorySetForTestFile(
-            'lifecycle-methods.html'),
-        options=self._options)
+    results = self.RunMeasurement(
+        self._measurement,
+        self._CreateStorySetForTestFile('lifecycle-methods.html'),
+        run_options=self._options)
     self.assertFalse(results.had_failures)
     self.assertEquals(len(list(results.IterRunsWithTraces())), 1)
 
diff --git a/tools/perf/contrib/cluster_telemetry/screenshot_unittest.py b/tools/perf/contrib/cluster_telemetry/screenshot_unittest.py
index 1907bea..eb01ca8 100644
--- a/tools/perf/contrib/cluster_telemetry/screenshot_unittest.py
+++ b/tools/perf/contrib/cluster_telemetry/screenshot_unittest.py
@@ -15,8 +15,9 @@
 class ScreenshotUnitTest(page_test_test_case.PageTestTestCase):
 
   def setUp(self):
-    self._options = options_for_unittests.GetCopy()
     self._png_outdir = tempfile.mkdtemp('_png_test')
+    self._options = options_for_unittests.GetRunOptions(
+        output_dir=self._png_outdir)
 
   def tearDown(self):
     shutil.rmtree(self._png_outdir)
@@ -25,12 +26,13 @@
   def testScreenshot(self):
     # Screenshots for Cluster Telemetry purposes currently only supported on
     # Linux platform.
-    page_set = self.CreateStorySetFromFileInUnittestDataDir(
+    story_set = self.CreateStorySetFromFileInUnittestDataDir(
       'screenshot_test.html')
     measurement = screenshot.Screenshot(self._png_outdir)
-    self.RunMeasurement(measurement, page_set, options=self._options)
+    self.RunMeasurement(measurement, story_set, run_options=self._options)
 
-    path = self._png_outdir + '/' + page_set.stories[0].file_safe_name + '.png'
+    path = os.path.join(
+        self._png_outdir, story_set.stories[0].file_safe_name + '.png')
     self.assertTrue(os.path.exists(path))
     self.assertTrue(os.path.isfile(path))
     self.assertTrue(os.access(path, os.R_OK))
diff --git a/tools/perf/contrib/oilpan/oilpan_gc_times_unittest.py b/tools/perf/contrib/oilpan/oilpan_gc_times_unittest.py
index 455fa67a..7c254479 100644
--- a/tools/perf/contrib/oilpan/oilpan_gc_times_unittest.py
+++ b/tools/perf/contrib/oilpan/oilpan_gc_times_unittest.py
@@ -2,6 +2,9 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+import shutil
+import tempfile
+
 from contrib.oilpan import oilpan_gc_times
 
 from telemetry import decorators
@@ -92,7 +95,11 @@
   _GC_REASONS = ['precise', 'conservative', 'idle']
 
   def setUp(self):
-    self._options = options_for_unittests.GetCopy()
+    self._options = options_for_unittests.GetRunOptions(
+        output_dir=tempfile.mkdtemp())
+
+  def tearDowmn(self):
+    shutil.rmtree(self._options.output_dir)
 
   # Disable for accessing private API of _OilpanGCTimesBase.
   # pylint: disable=protected-access
@@ -148,10 +155,11 @@
 
   @decorators.Disabled('all')
   def testForSmoothness(self):
-    ps = self.CreateStorySetFromFileInUnittestDataDir(
+    story_set = self.CreateStorySetFromFileInUnittestDataDir(
         'create_many_objects.html')
     measurement = oilpan_gc_times.OilpanGCTimesForSmoothness()
-    results = self.RunMeasurement(measurement, ps, options=self._options)
+    results = self.RunMeasurement(
+        measurement, story_set, run_options=self._options)
     self.assertFalse(results.had_failures)
 
     gc_events = []
@@ -162,10 +170,11 @@
 
   @decorators.Disabled('all')
   def testForBlinkPerf(self):
-    ps = self.CreateStorySetFromFileInUnittestDataDir(
+    story_set = self.CreateStorySetFromFileInUnittestDataDir(
         'create_many_objects.html')
     measurement = oilpan_gc_times.OilpanGCTimesForBlinkPerf()
-    results = self.RunMeasurement(measurement, ps, options=self._options)
+    results = self.RunMeasurement(
+        measurement, story_set, run_options=self._options)
     self.assertFalse(results.had_failures)
 
     gc_events = []
diff --git a/tools/perf/measurements/multipage_skpicture_printer_unittest.py b/tools/perf/measurements/multipage_skpicture_printer_unittest.py
index 14ae2132..bf20882 100644
--- a/tools/perf/measurements/multipage_skpicture_printer_unittest.py
+++ b/tools/perf/measurements/multipage_skpicture_printer_unittest.py
@@ -15,8 +15,9 @@
 class MultipageSkpicturePrinterUnitTest(page_test_test_case.PageTestTestCase):
 
   def setUp(self):
-    self._options = options_for_unittests.GetCopy()
     self._mskp_outdir = tempfile.mkdtemp('_mskp_test')
+    self._options = options_for_unittests.GetRunOptions(
+        output_dir=self._mskp_outdir)
 
   def tearDown(self):
     shutil.rmtree(self._mskp_outdir)
@@ -24,7 +25,7 @@
   # Picture printing is not supported on all platforms.
   @decorators.Disabled('android', 'chromeos')
   def testSkpicturePrinter(self):
-    ps = self.CreateStorySetFromFileInUnittestDataDir('blank.html')
+    story_set = self.CreateStorySetFromFileInUnittestDataDir('blank.html')
     measurement = multipage_skpicture_printer.MultipageSkpicturePrinter(
         self._mskp_outdir)
-    self.RunMeasurement(measurement, ps, options=self._options)
+    self.RunMeasurement(measurement, story_set, run_options=self._options)
diff --git a/tools/perf/measurements/rasterize_and_record_micro_unittest.py b/tools/perf/measurements/rasterize_and_record_micro_unittest.py
index 14d086d..330d2cf3b 100644
--- a/tools/perf/measurements/rasterize_and_record_micro_unittest.py
+++ b/tools/perf/measurements/rasterize_and_record_micro_unittest.py
@@ -3,6 +3,8 @@
 # found in the LICENSE file.
 
 import logging
+import shutil
+import tempfile
 
 from telemetry import decorators
 from telemetry.page import legacy_page_test
@@ -22,17 +24,22 @@
   """
 
   def setUp(self):
-    self._options = options_for_unittests.GetCopy()
+    self._options = options_for_unittests.GetRunOptions(
+        output_dir=tempfile.mkdtemp())
     self._options.browser_options.wpr_mode = wpr_modes.WPR_OFF
 
+  def tearDown(self):
+    shutil.rmtree(self._options.output_dir)
+
   @decorators.Disabled('win', 'chromeos', 'linux')
   def testRasterizeAndRecordMicro(self):
-    ps = self.CreateStorySetFromFileInUnittestDataDir('blank.html')
+    story_set = self.CreateStorySetFromFileInUnittestDataDir('blank.html')
     measurement = rasterize_and_record_micro.RasterizeAndRecordMicro(
         rasterize_repeat=1, record_repeat=1, start_wait_time=0.0,
         report_detailed_results=True)
     try:
-      results = self.RunMeasurement(measurement, ps, options=self._options)
+      results = self.RunMeasurement(
+          measurement, story_set, run_options=self._options)
     except legacy_page_test.TestNotSupportedOnPlatformError as failure:
       logging.warning(str(failure))
       return
diff --git a/tools/perf/measurements/skpicture_printer_unittest.py b/tools/perf/measurements/skpicture_printer_unittest.py
index d23c6fa4..4203731 100644
--- a/tools/perf/measurements/skpicture_printer_unittest.py
+++ b/tools/perf/measurements/skpicture_printer_unittest.py
@@ -15,8 +15,9 @@
 class SkpicturePrinterUnitTest(page_test_test_case.PageTestTestCase):
 
   def setUp(self):
-    self._options = options_for_unittests.GetCopy()
     self._skp_outdir = tempfile.mkdtemp('_skp_test')
+    self._options = options_for_unittests.GetRunOptions(
+        output_dir=self._skp_outdir)
 
   def tearDown(self):
     shutil.rmtree(self._skp_outdir)
@@ -24,9 +25,10 @@
   # Picture printing is not supported on all platforms.
   @decorators.Disabled('android', 'chromeos')
   def testSkpicturePrinter(self):
-    ps = self.CreateStorySetFromFileInUnittestDataDir('blank.html')
+    story_set = self.CreateStorySetFromFileInUnittestDataDir('blank.html')
     measurement = skpicture_printer.SkpicturePrinter(self._skp_outdir)
-    results = self.RunMeasurement(measurement, ps, options=self._options)
+    results = self.RunMeasurement(
+        measurement, story_set, run_options=self._options)
 
     saved_picture_count = results.FindAllPageSpecificValuesNamed(
         'saved_picture_count')
diff --git a/ui/accessibility/ax_node_position_unittest.cc b/ui/accessibility/ax_node_position_unittest.cc
index 82053f9..f0d72eb3 100644
--- a/ui/accessibility/ax_node_position_unittest.cc
+++ b/ui/accessibility/ax_node_position_unittest.cc
@@ -2040,18 +2040,12 @@
   TestPositionType test_position = null_position->AsPositionBeforeCharacter();
   EXPECT_NE(nullptr, test_position);
   EXPECT_TRUE(test_position->IsNullPosition());
-  test_position = null_position->AsLeafTextPositionBeforeCharacter();
-  EXPECT_NE(nullptr, test_position);
-  EXPECT_TRUE(test_position->IsNullPosition());
   test_position = null_position->AsPositionAfterCharacter();
   EXPECT_NE(nullptr, test_position);
   EXPECT_TRUE(test_position->IsNullPosition());
-  test_position = null_position->AsLeafTextPositionAfterCharacter();
-  EXPECT_NE(nullptr, test_position);
-  EXPECT_TRUE(test_position->IsNullPosition());
 }
 
-TEST_F(AXPositionTest, AsPositionBeforeCharacter) {
+TEST_F(AXPositionTest, AsPositionBeforeCharacterNoAdjustment) {
   // A text offset that is on the line break right after "Line 1".
   TestPositionType text_position = AXNodePosition::CreateTextPosition(
       tree_.data().tree_id, root_.id, 6 /* text_offset */,
@@ -2075,7 +2069,7 @@
   EXPECT_TRUE(test_position->IsTextPosition());
   EXPECT_EQ(text_field_.id, test_position->anchor_id());
   EXPECT_EQ(6, test_position->text_offset());
-  EXPECT_EQ(ax::mojom::TextAffinity::kDownstream, test_position->affinity());
+  EXPECT_EQ(ax::mojom::TextAffinity::kUpstream, test_position->affinity());
 
   text_position = AXNodePosition::CreateTextPosition(
       tree_.data().tree_id, text_field_.id, 13 /* text_offset */,
@@ -2120,7 +2114,7 @@
   EXPECT_EQ(0, test_position->text_offset());
 }
 
-TEST_F(AXPositionTest, AsPositionAfterCharacter) {
+TEST_F(AXPositionTest, AsPositionAfterCharacterNoAdjustment) {
   // A text offset that is after "Line 2".
   TestPositionType text_position = AXNodePosition::CreateTextPosition(
       tree_.data().tree_id, root_.id, 13 /* text_offset */,
@@ -2203,25 +2197,13 @@
   EXPECT_EQ(6, test_position->text_offset());
 }
 
-TEST_F(AXPositionTest, AsLeafTextPositionBeforeCharacter) {
+TEST_F(AXPositionTest, AsPositionBeforeCharacter) {
   TestPositionType text_position = AXNodePosition::CreateTextPosition(
-      tree_.data().tree_id, root_.id, 0 /* text_offset */,
-      ax::mojom::TextAffinity::kDownstream);
-  ASSERT_NE(nullptr, text_position);
-  ASSERT_TRUE(text_position->IsTextPosition());
-  TestPositionType test_position =
-      text_position->AsLeafTextPositionBeforeCharacter();
-  EXPECT_NE(nullptr, test_position);
-  EXPECT_TRUE(test_position->IsTextPosition());
-  EXPECT_EQ(inline_box1_.id, test_position->anchor_id());
-  EXPECT_EQ(0, test_position->text_offset());
-
-  text_position = AXNodePosition::CreateTextPosition(
       tree_.data().tree_id, inline_box1_.id, 3 /* text_offset */,
       ax::mojom::TextAffinity::kDownstream);
   ASSERT_NE(nullptr, text_position);
   ASSERT_TRUE(text_position->IsTextPosition());
-  test_position = text_position->AsLeafTextPositionBeforeCharacter();
+  TestPositionType test_position = text_position->AsPositionBeforeCharacter();
   EXPECT_NE(nullptr, test_position);
   EXPECT_TRUE(test_position->IsTextPosition());
   EXPECT_EQ(inline_box1_.id, test_position->anchor_id());
@@ -2232,7 +2214,7 @@
       ax::mojom::TextAffinity::kDownstream);
   ASSERT_NE(nullptr, text_position);
   ASSERT_TRUE(text_position->IsTextPosition());
-  test_position = text_position->AsLeafTextPositionBeforeCharacter();
+  test_position = text_position->AsPositionBeforeCharacter();
   EXPECT_NE(nullptr, test_position);
   EXPECT_TRUE(test_position->IsTextPosition());
   EXPECT_EQ(inline_box2_.id, test_position->anchor_id());
@@ -2240,10 +2222,10 @@
 
   text_position = AXNodePosition::CreateTextPosition(
       tree_.data().tree_id, inline_box2_.id, 0 /* text_offset */,
-      ax::mojom::TextAffinity::kDownstream);
+      ax::mojom::TextAffinity::kUpstream);
   ASSERT_NE(nullptr, text_position);
   ASSERT_TRUE(text_position->IsTextPosition());
-  test_position = text_position->AsLeafTextPositionBeforeCharacter();
+  test_position = text_position->AsPositionBeforeCharacter();
   EXPECT_NE(nullptr, test_position);
   EXPECT_TRUE(test_position->IsTextPosition());
   EXPECT_EQ(inline_box2_.id, test_position->anchor_id());
@@ -2251,22 +2233,30 @@
 
   text_position = AXNodePosition::CreateTextPosition(
       tree_.data().tree_id, inline_box2_.id, 6 /* text_offset */,
+      ax::mojom::TextAffinity::kUpstream);
+  ASSERT_NE(nullptr, text_position);
+  ASSERT_TRUE(text_position->IsTextPosition());
+  test_position = text_position->AsPositionBeforeCharacter();
+  EXPECT_NE(nullptr, test_position);
+  EXPECT_TRUE(test_position->IsNullPosition());
+
+  text_position = AXNodePosition::CreateTextPosition(
+      tree_.data().tree_id, root_.id, 13 /* text_offset */,
       ax::mojom::TextAffinity::kDownstream);
   ASSERT_NE(nullptr, text_position);
   ASSERT_TRUE(text_position->IsTextPosition());
-  test_position = text_position->AsLeafTextPositionBeforeCharacter();
+  test_position = text_position->AsPositionBeforeCharacter();
   EXPECT_NE(nullptr, test_position);
   EXPECT_TRUE(test_position->IsNullPosition());
 }
 
-TEST_F(AXPositionTest, AsLeafTextPositionAfterCharacter) {
+TEST_F(AXPositionTest, AsPositionAfterCharacter) {
   TestPositionType text_position = AXNodePosition::CreateTextPosition(
       tree_.data().tree_id, inline_box1_.id, 0 /* text_offset */,
       ax::mojom::TextAffinity::kDownstream);
   ASSERT_NE(nullptr, text_position);
   ASSERT_TRUE(text_position->IsTextPosition());
-  TestPositionType test_position =
-      text_position->AsLeafTextPositionAfterCharacter();
+  TestPositionType test_position = text_position->AsPositionAfterCharacter();
   EXPECT_NE(nullptr, test_position);
   EXPECT_TRUE(test_position->IsNullPosition());
 
@@ -2275,7 +2265,7 @@
       ax::mojom::TextAffinity::kDownstream);
   ASSERT_NE(nullptr, text_position);
   ASSERT_TRUE(text_position->IsTextPosition());
-  test_position = text_position->AsLeafTextPositionAfterCharacter();
+  test_position = text_position->AsPositionAfterCharacter();
   EXPECT_NE(nullptr, test_position);
   EXPECT_TRUE(test_position->IsTextPosition());
   EXPECT_EQ(inline_box1_.id, test_position->anchor_id());
@@ -2283,10 +2273,10 @@
 
   text_position = AXNodePosition::CreateTextPosition(
       tree_.data().tree_id, line_break_.id, 1 /* text_offset */,
-      ax::mojom::TextAffinity::kDownstream);
+      ax::mojom::TextAffinity::kUpstream);
   ASSERT_NE(nullptr, text_position);
   ASSERT_TRUE(text_position->IsTextPosition());
-  test_position = text_position->AsLeafTextPositionAfterCharacter();
+  test_position = text_position->AsPositionAfterCharacter();
   EXPECT_NE(nullptr, test_position);
   EXPECT_TRUE(test_position->IsTextPosition());
   EXPECT_EQ(line_break_.id, test_position->anchor_id());
@@ -2294,25 +2284,23 @@
 
   text_position = AXNodePosition::CreateTextPosition(
       tree_.data().tree_id, inline_box2_.id, 0 /* text_offset */,
-      ax::mojom::TextAffinity::kDownstream);
+      ax::mojom::TextAffinity::kUpstream);
   ASSERT_NE(nullptr, text_position);
   ASSERT_TRUE(text_position->IsTextPosition());
-  test_position = text_position->AsLeafTextPositionAfterCharacter();
+  test_position = text_position->AsPositionAfterCharacter();
   EXPECT_NE(nullptr, test_position);
   EXPECT_TRUE(test_position->IsTextPosition());
   EXPECT_EQ(line_break_.id, test_position->anchor_id());
   EXPECT_EQ(1, test_position->text_offset());
 
   text_position = AXNodePosition::CreateTextPosition(
-      tree_.data().tree_id, root_.id, 13 /* text_offset */,
+      tree_.data().tree_id, root_.id, 0 /* text_offset */,
       ax::mojom::TextAffinity::kDownstream);
   ASSERT_NE(nullptr, text_position);
   ASSERT_TRUE(text_position->IsTextPosition());
-  test_position = text_position->AsLeafTextPositionAfterCharacter();
+  test_position = text_position->AsPositionAfterCharacter();
   EXPECT_NE(nullptr, test_position);
-  EXPECT_TRUE(test_position->IsTextPosition());
-  EXPECT_EQ(inline_box2_.id, test_position->anchor_id());
-  EXPECT_EQ(6, test_position->text_offset());
+  EXPECT_TRUE(test_position->IsNullPosition());
 }
 
 TEST_F(AXPositionTest, CreateNextAndPreviousCharacterPositionWithNullPosition) {
diff --git a/ui/accessibility/ax_position.h b/ui/accessibility/ax_position.h
index 3c2aeee..3399b6bd 100644
--- a/ui/accessibility/ax_position.h
+++ b/ui/accessibility/ax_position.h
@@ -862,30 +862,26 @@
 
   // Returns a text position located right before the next character (from this
   // position) in the tree's text representation, following these conditions:
+  //
   //   - If this position is at the end of its anchor, normalize it to the start
-  //   of the next text anchor, regardless of the position's affinity. Both
-  //   positions are equal when compared, but we consider the start of an anchor
-  //   to be a position BEFORE its first character and the end to be AFTER its
-  //   last character.
+  //   of the next text anchor, regardless of the position's affinity.
+  //   Both text positions are equal when compared, but we consider the start of
+  //   an anchor to be a position BEFORE its first character and the end of the
+  //   previous to be AFTER its last character.
+  //
   //   - Skip any empty text anchors; they're "invisible" to the text
   //   representation and the next character could be ahead.
+  //
   //   - Return a null position if there is no next character forward.
-  // Don't return a leaf equivalent position, but try and return a position that
-  // has the same anchor as the current position if the resulting position is
-  // enclosed by the same anchor.
+  //
+  // If possible, return a position anchored at the current position's anchor;
+  // this is necessary because we don't want to return any position that might
+  // be located in the shadow DOM or in a position anchored at a node that is
+  // not visible to a specific platform's APIs.
   AXPositionInstance AsPositionBeforeCharacter() const {
-    AXPositionInstance text_position = AsLeafTextPositionBeforeCharacter();
-
-    // If possible, return a position anchored at the current position. This is
-    // necessary because we don't want to return any position that might be in
-    // the shadow DOM or a position anchored at a node that is not visible to
-    // platform APIs, if the original position didn't meet any of these
-    // criteria.
-    AXPositionInstance common_ancestor =
-        text_position->LowestCommonAncestor(*this);
-    if (GetAnchor() == common_ancestor->GetAnchor())
-      text_position = std::move(common_ancestor);
-
+    AXPositionInstance text_position = AsTextPosition();
+    while (text_position->AtEndOfAnchor())
+      text_position = text_position->CreateNextTextAnchorPosition();
     return text_position;
   }
 
@@ -893,35 +889,7 @@
   // this position) in the tree's text representation.
   // See `AsPositionBeforeCharacter`, as this is its "reversed" version.
   AXPositionInstance AsPositionAfterCharacter() const {
-    AXPositionInstance text_position = AsLeafTextPositionAfterCharacter();
-
-    // If possible, return a position anchored at the current position. This is
-    // necessary because we don't want to return any position that might be in
-    // the shadow DOM or a position anchored at a node that is not visible to
-    // platform APIs, if the original position didn't meet any of these
-    // criteria.
-    AXPositionInstance common_ancestor =
-        text_position->LowestCommonAncestor(*this);
-    if (GetAnchor() == common_ancestor->GetAnchor())
-      text_position = std::move(common_ancestor);
-
-    return text_position;
-  }
-
-  // Same as `AsPositionBeforeCharacter`, but returns the leaf equivalent text
-  // position.
-  AXPositionInstance AsLeafTextPositionBeforeCharacter() const {
-    AXPositionInstance text_position = AsLeafTextPosition();
-    // This loop satisfies all the conditions described above.
-    while (text_position->AtEndOfAnchor())
-      text_position = text_position->CreateNextTextAnchorPosition();
-    return text_position;
-  }
-
-  // Same as `AsPositionAfterCharacter`, but returns the leaf equivalent text
-  // position.
-  AXPositionInstance AsLeafTextPositionAfterCharacter() const {
-    AXPositionInstance text_position = AsLeafTextPosition();
+    AXPositionInstance text_position = AsTextPosition();
     while (text_position->AtStartOfAnchor()) {
       text_position = text_position->CreatePreviousTextAnchorPosition();
       text_position = text_position->CreatePositionAtEndOfAnchor();
diff --git a/ui/accessibility/platform/ax_platform_node_mac.mm b/ui/accessibility/platform/ax_platform_node_mac.mm
index fb21f885..6400d79 100644
--- a/ui/accessibility/platform/ax_platform_node_mac.mm
+++ b/ui/accessibility/platform/ax_platform_node_mac.mm
@@ -494,6 +494,76 @@
     node_->GetDelegate()->AccessibilityPerformAction(data);
 }
 
+// This method, while deprecated, is still called internally by AppKit.
+- (NSArray*)accessibilityAttributeNames {
+  if (!node_)
+    return @[];
+  // These attributes are required on all accessibility objects.
+  NSArray* const kAllRoleAttributes = @[
+    NSAccessibilityChildrenAttribute,
+    NSAccessibilityParentAttribute,
+    NSAccessibilityPositionAttribute,
+    NSAccessibilityRoleAttribute,
+    NSAccessibilitySizeAttribute,
+    NSAccessibilitySubroleAttribute,
+    // Title is required for most elements. Cocoa asks for the value even if it
+    // is omitted here, but won't present it to accessibility APIs without this.
+    NSAccessibilityTitleAttribute,
+    // Attributes which are not required, but are general to all roles.
+    NSAccessibilityRoleDescriptionAttribute,
+    NSAccessibilityEnabledAttribute,
+    NSAccessibilityFocusedAttribute,
+    NSAccessibilityHelpAttribute,
+    NSAccessibilityTopLevelUIElementAttribute,
+    NSAccessibilityWindowAttribute,
+  ];
+  // Attributes required for user-editable controls.
+  NSArray* const kValueAttributes = @[ NSAccessibilityValueAttribute ];
+  // Attributes required for unprotected textfields and labels.
+  NSArray* const kUnprotectedTextAttributes = @[
+    NSAccessibilityInsertionPointLineNumberAttribute,
+    NSAccessibilityNumberOfCharactersAttribute,
+    NSAccessibilitySelectedTextAttribute,
+    NSAccessibilitySelectedTextRangeAttribute,
+    NSAccessibilityVisibleCharacterRangeAttribute,
+  ];
+  // Required for all text, including protected textfields.
+  NSString* const kTextAttributes = NSAccessibilityPlaceholderValueAttribute;
+  base::scoped_nsobject<NSMutableArray> axAttributes(
+      [[NSMutableArray alloc] init]);
+  [axAttributes addObjectsFromArray:kAllRoleAttributes];
+  switch (node_->GetData().role) {
+    case ax::mojom::Role::kTextField:
+    case ax::mojom::Role::kTextFieldWithComboBox:
+    case ax::mojom::Role::kStaticText:
+      [axAttributes addObject:kTextAttributes];
+      if (!node_->GetData().HasState(ax::mojom::State::kProtected))
+        [axAttributes addObjectsFromArray:kUnprotectedTextAttributes];
+      FALLTHROUGH;
+    case ax::mojom::Role::kCheckBox:
+    case ax::mojom::Role::kComboBoxMenuButton:
+    case ax::mojom::Role::kMenuItemCheckBox:
+    case ax::mojom::Role::kMenuItemRadio:
+    case ax::mojom::Role::kRadioButton:
+    case ax::mojom::Role::kSearchBox:
+    case ax::mojom::Role::kSlider:
+    case ax::mojom::Role::kSliderThumb:
+    case ax::mojom::Role::kToggleButton:
+      [axAttributes addObjectsFromArray:kValueAttributes];
+      break;
+      // TODO(tapted): Add additional attributes based on role.
+    default:
+      break;
+  }
+  if (node_->GetData().HasBoolAttribute(ax::mojom::BoolAttribute::kSelected)) {
+    [axAttributes addObjectsFromArray:@[ NSAccessibilitySelectedAttribute ]];
+  }
+  if (ui::IsMenuItem(node_->GetData().role)) {
+    [axAttributes addObjectsFromArray:@[ @"AXMenuItemMarkChar" ]];
+  }
+  return axAttributes.autorelease();
+}
+
 // Despite it being deprecated, AppKit internally calls this function sometimes
 // in unclear circumstances. It is implemented in terms of the new a11y API
 // here.
diff --git a/ui/accessibility/platform/ax_platform_node_textrangeprovider_win.cc b/ui/accessibility/platform/ax_platform_node_textrangeprovider_win.cc
index 154d3cf..63c1d43 100644
--- a/ui/accessibility/platform/ax_platform_node_textrangeprovider_win.cc
+++ b/ui/accessibility/platform/ax_platform_node_textrangeprovider_win.cc
@@ -32,7 +32,7 @@
 AXPlatformNodeTextRangeProviderWin::~AXPlatformNodeTextRangeProviderWin() {}
 
 ITextRangeProvider* AXPlatformNodeTextRangeProviderWin::CreateTextRangeProvider(
-    ui::AXPlatformNodeWin* owner,
+    AXPlatformNodeWin* owner,
     AXPositionInstance start,
     AXPositionInstance end) {
   CComObject<AXPlatformNodeTextRangeProviderWin>* text_range_provider = nullptr;
@@ -127,14 +127,14 @@
       // boundary, thus we only need to move the end position.
       AXPositionInstance end_backup = end_->Clone();
       end_ = start_->CreateNextCharacterPosition(
-          ui::AXBoundaryBehavior::CrossBoundary);
+          AXBoundaryBehavior::CrossBoundary);
 
       if (end_->IsNullPosition()) {
         // The previous could fail if the start is at the end of the last anchor
         // of the tree, try expanding to the previous character instead.
         AXPositionInstance start_backup = start_->Clone();
         start_ = start_->CreatePreviousCharacterPosition(
-            ui::AXBoundaryBehavior::CrossBoundary);
+            AXBoundaryBehavior::CrossBoundary);
 
         if (start_->IsNullPosition()) {
           // Text representation is empty, undo everything and exit.
@@ -143,35 +143,42 @@
           return S_OK;
         }
         end_ = start_->CreateNextCharacterPosition(
-            ui::AXBoundaryBehavior::CrossBoundary);
+            AXBoundaryBehavior::CrossBoundary);
         DCHECK(!end_->IsNullPosition());
       }
       break;
     }
     case TextUnit_Format:
       start_ = start_->CreatePreviousFormatStartPosition(
-          ui::AXBoundaryBehavior::StopIfAlreadyAtBoundary);
+          AXBoundaryBehavior::StopIfAlreadyAtBoundary);
       end_ = start_->CreateNextFormatEndPosition(
-          ui::AXBoundaryBehavior::StopIfAlreadyAtBoundary);
+          AXBoundaryBehavior::StopIfAlreadyAtBoundary);
       break;
     case TextUnit_Word:
       start_ = start_->CreatePreviousWordStartPosition(
-          ui::AXBoundaryBehavior::StopIfAlreadyAtBoundary);
-      end_ = start_->CreateNextWordEndPosition(
-          ui::AXBoundaryBehavior::StopIfAlreadyAtBoundary);
+          AXBoundaryBehavior::StopIfAlreadyAtBoundary);
+
+      // Since start_ is already located at a word boundary, we need to cross it
+      // in order to move to the next one; the only edge case here is the last
+      // word in the document, which will result in a null position.
+      end_ = start_->CreateNextWordStartPosition(
+          AXBoundaryBehavior::CrossBoundary);
+      if (end_->IsNullPosition())
+        end_ = start_->CreatePositionAtEndOfDocument();
       break;
     case TextUnit_Line:
       start_ = start_->CreatePreviousLineStartPosition(
-          ui::AXBoundaryBehavior::StopIfAlreadyAtBoundary);
+          AXBoundaryBehavior::StopIfAlreadyAtBoundary);
       end_ = start_->CreateNextLineEndPosition(
-          ui::AXBoundaryBehavior::StopIfAlreadyAtBoundary);
+          AXBoundaryBehavior::StopIfAlreadyAtBoundary);
       break;
     case TextUnit_Paragraph:
       start_ = start_->CreatePreviousParagraphStartPosition(
-          ui::AXBoundaryBehavior::StopIfAlreadyAtBoundary);
+          AXBoundaryBehavior::StopIfAlreadyAtBoundary);
       end_ = start_->CreateNextParagraphEndPosition(
-          ui::AXBoundaryBehavior::StopIfAlreadyAtBoundary);
+          AXBoundaryBehavior::StopIfAlreadyAtBoundary);
       break;
+
     // Since web content is not paginated, TextUnit_Page is not supported.
     // Substituting it by the next larger unit: TextUnit_Document.
     case TextUnit_Page:
@@ -186,9 +193,8 @@
   // Some text positions are equal when compared, but they could be located at
   // different anchors, affecting how `GetEnclosingElement` works. Normalize the
   // endpoints to correctly enclose characters of the text representation.
-  AXPositionInstance normalized_start =
-      start_->AsLeafTextPositionBeforeCharacter();
-  AXPositionInstance normalized_end = end_->AsLeafTextPositionBeforeCharacter();
+  AXPositionInstance normalized_start = start_->AsPositionBeforeCharacter();
+  AXPositionInstance normalized_end = end_->AsPositionBeforeCharacter();
 
   if (!normalized_start->IsNullPosition()) {
     DCHECK_EQ(*start_, *normalized_start);
@@ -730,7 +736,7 @@
   UIA_VALIDATE_BOUNDS(root_screen_bounds);
   target_point += root_screen_bounds.OffsetFromOrigin();
 
-  ui::AXActionData action_data;
+  AXActionData action_data;
   action_data.action = ax::mojom::Action::kScrollToPoint;
   action_data.target_node_id = common_ancestor_anchor->id();
   action_data.target_point = target_point;
@@ -787,7 +793,7 @@
   return range.GetText(AXTextConcatenationBehavior::kAsInnerText);
 }
 
-ui::AXPlatformNodeWin* AXPlatformNodeTextRangeProviderWin::owner() const {
+AXPlatformNodeWin* AXPlatformNodeTextRangeProviderWin::owner() const {
   return owner_;
 }
 
@@ -821,19 +827,23 @@
     int* units_moved) {
   DCHECK_NE(count, 0);
 
-  CreateNextPositionFunction create_next_position = nullptr;
-  if (count > 0)
-    create_next_position =
-        is_start_endpoint ? &AXPositionInstanceType::CreateNextWordStartPosition
-                          : &AXPositionInstanceType::CreateNextWordEndPosition;
-  else
-    create_next_position =
-        is_start_endpoint
-            ? &AXPositionInstanceType::CreatePreviousWordStartPosition
-            : &AXPositionInstanceType::CreatePreviousWordEndPosition;
+  bool going_forward = count > 0;
+  AXPositionInstance new_position = MoveEndpointByUnitHelper(
+      std::move(endpoint),
+      going_forward ? &AXPositionInstanceType::CreateNextWordStartPosition
+                    : &AXPositionInstanceType::CreatePreviousWordStartPosition,
+      count, units_moved);
 
-  return MoveEndpointByUnitHelper(std::move(endpoint), create_next_position,
-                                  count, units_moved);
+  if (going_forward && *units_moved < count &&
+      !new_position->AsPositionBeforeCharacter()->IsNullPosition()) {
+    AXPositionInstance next_word_position =
+        new_position->CreatePositionAtEndOfDocument();
+    DCHECK(!next_word_position->IsNullPosition());
+
+    new_position = std::move(next_word_position);
+    ++*units_moved;
+  }
+  return new_position;
 }
 
 AXPlatformNodeTextRangeProviderWin::AXPositionInstance
@@ -886,7 +896,7 @@
   auto current_endpoint = endpoint->Clone();
   const bool forwards = count > 0;
   const int count_abs = std::abs(count);
-  const auto behavior = ui::AXBoundaryBehavior::CrossBoundary;
+  const auto behavior = AXBoundaryBehavior::CrossBoundary;
   int iteration = 0;
   for (iteration = 0; iteration < count_abs; ++iteration) {
     AXPositionInstance next_endpoint;
diff --git a/ui/accessibility/platform/ax_platform_node_textrangeprovider_win.h b/ui/accessibility/platform/ax_platform_node_textrangeprovider_win.h
index ad602a2..3e8c4d3 100644
--- a/ui/accessibility/platform/ax_platform_node_textrangeprovider_win.h
+++ b/ui/accessibility/platform/ax_platform_node_textrangeprovider_win.h
@@ -30,7 +30,7 @@
 
   // Creates an instance of the class.
   static ITextRangeProvider* CreateTextRangeProvider(
-      ui::AXPlatformNodeWin* owner,
+      AXPlatformNodeWin* owner,
       AXNodePosition::AXPositionInstance start,
       AXNodePosition::AXPositionInstance end);
 
@@ -89,7 +89,7 @@
   friend class AXPlatformNodeTextRangeProviderTest;
   friend class AXPlatformNodeTextProviderTest;
   base::string16 GetString();
-  ui::AXPlatformNodeWin* owner() const;
+  AXPlatformNodeWin* owner() const;
   AXPlatformNodeDelegate* GetDelegate(
       const AXPositionInstanceType* position) const;
 
@@ -128,7 +128,7 @@
       const int count,
       int* units_moved);
 
-  CComPtr<ui::AXPlatformNodeWin> owner_;
+  CComPtr<AXPlatformNodeWin> owner_;
   AXPositionInstance start_;
   AXPositionInstance end_;
 };
diff --git a/ui/accessibility/platform/ax_platform_node_textrangeprovider_win_unittest.cc b/ui/accessibility/platform/ax_platform_node_textrangeprovider_win_unittest.cc
index 1b1cf4c..7af0152 100644
--- a/ui/accessibility/platform/ax_platform_node_textrangeprovider_win_unittest.cc
+++ b/ui/accessibility/platform/ax_platform_node_textrangeprovider_win_unittest.cc
@@ -976,7 +976,7 @@
   // Start endpoint is already on a word's start boundary.
   ASSERT_HRESULT_SUCCEEDED(
       text_range_provider->ExpandToEnclosingUnit(TextUnit_Word));
-  EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"definitely");
+  EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"definitely ");
 
   // Start endpoint is between a word's start and end boundaries.
   int count;
@@ -984,11 +984,11 @@
       TextPatternRangeEndpoint_Start, TextUnit_Character, /*count*/ -2,
       &count));
   ASSERT_EQ(-2, count);
-  EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"xtdefinitely");
+  EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"xtdefinitely ");
 
   ASSERT_HRESULT_SUCCEEDED(text_range_provider->MoveEndpointByUnit(
-      TextPatternRangeEndpoint_End, TextUnit_Character, /*count*/ 5, &count));
-  ASSERT_EQ(5, count);
+      TextPatternRangeEndpoint_End, TextUnit_Character, /*count*/ 4, &count));
+  ASSERT_EQ(4, count);
   EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"xtdefinitely not ");
 
   ASSERT_HRESULT_SUCCEEDED(
@@ -1009,7 +1009,7 @@
 
   ASSERT_HRESULT_SUCCEEDED(
       text_range_provider->ExpandToEnclosingUnit(TextUnit_Word));
-  EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"not");
+  EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"not ");
 }
 
 TEST_F(AXPlatformNodeTextRangeProviderTest,
@@ -1576,19 +1576,19 @@
   // Move forward.
   EXPECT_UIA_MOVE(text_range_provider, TextUnit_Word,
                   /*count*/ 1,
-                  /*expected_text*/ L"line",
+                  /*expected_text*/ L"line ",
                   /*expected_count*/ 1);
   EXPECT_UIA_MOVE(text_range_provider, TextUnit_Word,
                   /*count*/ 2,
-                  /*expected_text*/ L"text",
+                  /*expected_text*/ L"text\n\n",
                   /*expected_count*/ 2);
   EXPECT_UIA_MOVE(text_range_provider, TextUnit_Word,
                   /*count*/ 2,
-                  /*expected_text*/ L"line",
+                  /*expected_text*/ L"line\n",
                   /*expected_count*/ 2);
   EXPECT_UIA_MOVE(text_range_provider, TextUnit_Word,
                   /*count*/ 3,
-                  /*expected_text*/ L"Paragraph",
+                  /*expected_text*/ L"Paragraph ",
                   /*expected_count*/ 3);
   EXPECT_UIA_MOVE(text_range_provider, TextUnit_Word,
                   /*count*/ 6,
@@ -1604,26 +1604,26 @@
   // Move backward.
   EXPECT_UIA_MOVE(text_range_provider, TextUnit_Word,
                   /*count*/ -3,
-                  /*expected_text*/ L"Paragraph",
+                  /*expected_text*/ L"Paragraph ",
                   /*expected_count*/ -3);
   EXPECT_UIA_MOVE(text_range_provider, TextUnit_Word,
                   /*count*/ -3,
-                  /*expected_text*/ L"line",
+                  /*expected_text*/ L"line\n",
                   /*expected_count*/ -3);
   EXPECT_UIA_MOVE(text_range_provider, TextUnit_Word,
                   /*count*/ -2,
-                  /*expected_text*/ L"text",
+                  /*expected_text*/ L"text\n\n",
                   /*expected_count*/ -2);
   EXPECT_UIA_MOVE(text_range_provider, TextUnit_Word,
                   /*count*/ -6,
-                  /*expected_text*/ L"First",
+                  /*expected_text*/ L"First ",
                   /*expected_count*/ -3);
 
   // Moving backward by any number of words at the start of document
   // should have no effect.
   EXPECT_UIA_MOVE(text_range_provider, TextUnit_Word,
                   /*count*/ -20,
-                  /*expected_text*/ L"First",
+                  /*expected_text*/ L"First ",
                   /*expected_count*/ 0);
 
   // Degenerate range moves.
@@ -2137,7 +2137,7 @@
   EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(text_range_provider,
                                    TextPatternRangeEndpoint_End, TextUnit_Word,
                                    /*count*/ -1,
-                                   /*expected_text*/ L"more",
+                                   /*expected_text*/ L"more ",
                                    /*expected_count*/ -1);
   EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(text_range_provider,
                                    TextPatternRangeEndpoint_End, TextUnit_Word,
@@ -2158,9 +2158,9 @@
       /*expected_count*/ -3);
   EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(text_range_provider,
                                    TextPatternRangeEndpoint_End, TextUnit_Word,
-                                   /*count*/ -2,
+                                   /*count*/ -1,
                                    /*expected_text*/ L"more text",
-                                   /*expected_count*/ -2);
+                                   /*expected_count*/ -1);
 
   // Moving the end past the start, then reverting.
   EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(text_range_provider,
@@ -2171,13 +2171,13 @@
   EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(text_range_provider,
                                    TextPatternRangeEndpoint_End, TextUnit_Word,
                                    /*count*/ 3,
-                                   /*expected_text*/ L" textmore text",
+                                   /*expected_text*/ L"textmore text",
                                    /*expected_count*/ 3);
   EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(
       text_range_provider, TextPatternRangeEndpoint_Start, TextUnit_Word,
-      /*count*/ 2,
+      /*count*/ 1,
       /*expected_text*/ L"more text",
-      /*expected_count*/ 2);
+      /*expected_count*/ 1);
 
   // Moving the endpoints further than both ends of the document.
   EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(text_range_provider,
@@ -2386,7 +2386,7 @@
   ASSERT_HRESULT_SUCCEEDED(text_range_provider->MoveEndpointByUnit(
       TextPatternRangeEndpoint_End, TextUnit_Word, /*count*/ 1, &count));
   ASSERT_EQ(1, count);
-  EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"some textmore");
+  EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"some textmore ");
 
   ASSERT_HRESULT_SUCCEEDED(text_range_provider->MoveEndpointByUnit(
       TextPatternRangeEndpoint_End, TextUnit_Word, /*count*/ -1, &count));