diff --git a/base/win/message_window.cc b/base/win/message_window.cc
index 97dd7812..8858b41 100644
--- a/base/win/message_window.cc
+++ b/base/win/message_window.cc
@@ -73,7 +73,7 @@
 }
 
 MessageWindow::~MessageWindow() {
-  DCHECK(CalledOnValidThread());
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
 
   if (window_ != NULL) {
     BOOL result = DestroyWindow(window_);
@@ -98,7 +98,7 @@
 
 bool MessageWindow::DoCreate(MessageCallback message_callback,
                              const wchar_t* window_name) {
-  DCHECK(CalledOnValidThread());
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
   DCHECK(message_callback_.is_null());
   DCHECK(!window_);
 
diff --git a/base/win/message_window.h b/base/win/message_window.h
index 97cc8d4..2fef480 100644
--- a/base/win/message_window.h
+++ b/base/win/message_window.h
@@ -12,13 +12,13 @@
 #include "base/compiler_specific.h"
 #include "base/macros.h"
 #include "base/strings/string16.h"
-#include "base/threading/non_thread_safe.h"
+#include "base/threading/thread_checker.h"
 
 namespace base {
 namespace win {
 
 // Implements a message-only window.
-class BASE_EXPORT MessageWindow : public base::NonThreadSafe {
+class BASE_EXPORT MessageWindow {
  public:
   // Used to register a process-wide message window class.
   class WindowClass;
@@ -63,6 +63,8 @@
   // Handle of the input window.
   HWND window_;
 
+  THREAD_CHECKER(thread_checker_);
+
   DISALLOW_COPY_AND_ASSIGN(MessageWindow);
 };
 
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabsConnection.java b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabsConnection.java
index e956f15e..0caac7e5 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabsConnection.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabsConnection.java
@@ -29,7 +29,6 @@
 
 import org.chromium.base.CommandLine;
 import org.chromium.base.Log;
-import org.chromium.base.SysUtils;
 import org.chromium.base.ThreadUtils;
 import org.chromium.base.TimeUtils;
 import org.chromium.base.TraceEvent;
@@ -287,8 +286,7 @@
                     if (!initialized) initializeBrowser(mApplication);
 
                     // (2)
-                    if (mayCreateSpareWebContents && mSpeculation == null
-                            && !SysUtils.isLowEndDevice()) {
+                    if (mayCreateSpareWebContents && mSpeculation == null) {
                         WarmupManager.getInstance().createSpareWebContents();
                     }
 
@@ -626,9 +624,12 @@
                     "CustomTabs.NonDefaultSessionPrerenderMatched", result != null);
         }
 
+        // Since the prerender is used, discard the spare webcontents.
+        if (result != null) WarmupManager.getInstance().destroySpareWebContents();
         return result;
     }
 
+    @VisibleForTesting
     String getSpeculatedUrl(CustomTabsSessionToken session) {
         if (mSpeculation == null || session == null || !session.equals(mSpeculation.session)) {
             return null;
@@ -1040,9 +1041,6 @@
         boolean throttle = !shouldPrerenderOnCellularForSession(session);
         if (throttle && !mClientManager.isPrerenderingAllowed(uid)) return false;
 
-        // A prerender will be requested. Time to destroy the spare WebContents.
-        WarmupManager.getInstance().destroySpareWebContents();
-
         Intent extrasIntent = new Intent();
         if (extras != null) extrasIntent.putExtras(extras);
         if (IntentHandler.getExtraHeadersFromIntent(extrasIntent) != null) return false;
@@ -1052,9 +1050,9 @@
         Rect contentBounds = ExternalPrerenderHandler.estimateContentSize(mApplication, true);
         String referrer = getReferrer(session, extrasIntent);
 
-        Pair<WebContents, WebContents> webContentsPair =
-                mExternalPrerenderHandler.addPrerender(Profile.getLastUsedProfile(), url, referrer,
-                        contentBounds, shouldPrerenderOnCellularForSession(session));
+        boolean forced = shouldPrerenderOnCellularForSession(session);
+        Pair<WebContents, WebContents> webContentsPair = mExternalPrerenderHandler.addPrerender(
+                Profile.getLastUsedProfile(), url, referrer, contentBounds, forced);
         if (webContentsPair == null) return false;
         WebContents dummyWebContents = webContentsPair.first;
         if (webContentsPair.second != null) {
@@ -1067,6 +1065,9 @@
         RecordHistogram.recordBooleanHistogram("CustomTabs.PrerenderSessionUsesDefaultParameters",
                 mClientManager.usesDefaultSessionParameters(session));
 
+        // Forced prerenders are often discarded, and take a small amount of memory. In this case,
+        // don't kill the spare renderer as it's highly likely to be used later.
+        if (!forced) WarmupManager.getInstance().destroySpareWebContents();
         return true;
     }
 
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabsConnectionTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabsConnectionTest.java
index 96d4bc8..2a1179e0 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabsConnectionTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabsConnectionTest.java
@@ -160,13 +160,13 @@
         ThreadUtils.runOnUiThreadBlocking(new Runnable() {
             @Override
             public void run() {
-                Assert.assertFalse(WarmupManager.getInstance().hasSpareWebContents());
                 String referrer =
                         mCustomTabsConnection.getReferrerForSession(token).getUrl();
                 WebContents webContents =
                         mCustomTabsConnection.takePrerenderedUrl(token, URL, referrer);
                 Assert.assertNotNull(webContents);
                 webContents.destroy();
+                Assert.assertFalse(WarmupManager.getInstance().hasSpareWebContents());
             }
         });
     }
@@ -357,9 +357,10 @@
         ThreadUtils.runOnUiThreadBlocking(new Runnable() {
             @Override
             public void run() {
-                Assert.assertNull(WarmupManager.getInstance().takeSpareWebContents(false, false));
+                Assert.assertEquals(URL, mCustomTabsConnection.getSpeculatedUrl(token));
             }
         });
+
         Assert.assertTrue(mCustomTabsConnection.mayLaunchUrl(token, null, null, null));
         // mayLaunchUrl() posts a task, the following has to run after it.
         ThreadUtils.runOnUiThreadBlocking(new Runnable() {
@@ -635,4 +636,52 @@
             });
         }
     }
+
+    @Test
+    @SmallTest
+    @Restriction(RESTRICTION_TYPE_NON_LOW_END_DEVICE)
+    public void testCellularPrerenderingDoesntKillSpareRenderer() throws Exception {
+        final CustomTabsSessionToken token =
+                CustomTabsSessionToken.createDummySessionTokenForTesting();
+        Assert.assertTrue(mCustomTabsConnection.newSession(token));
+        mCustomTabsConnection.setShouldPrerenderOnCellularForSession(token, true);
+        mCustomTabsConnection.warmup(0);
+
+        Assert.assertTrue(mCustomTabsConnection.mayLaunchUrl(token, Uri.parse(URL), null, null));
+        ThreadUtils.runOnUiThreadBlocking(new Runnable() {
+            @Override
+            public void run() {
+                Assert.assertTrue(WarmupManager.getInstance().hasSpareWebContents());
+                String referrer = mCustomTabsConnection.getReferrerForSession(token).getUrl();
+                WebContents webContents =
+                        mCustomTabsConnection.takePrerenderedUrl(token, URL, referrer);
+                Assert.assertNotNull(webContents);
+                webContents.destroy();
+                // destroyed when the prerender is used.
+                Assert.assertFalse(WarmupManager.getInstance().hasSpareWebContents());
+            }
+        });
+    }
+
+    @Test
+    @SmallTest
+    @Restriction(RESTRICTION_TYPE_NON_LOW_END_DEVICE)
+    public void testUnmatchedCellularPrerenderingDoesntKillSpareRenderer() throws Exception {
+        final CustomTabsSessionToken token =
+                CustomTabsSessionToken.createDummySessionTokenForTesting();
+        Assert.assertTrue(mCustomTabsConnection.newSession(token));
+        mCustomTabsConnection.setShouldPrerenderOnCellularForSession(token, true);
+        mCustomTabsConnection.warmup(0);
+
+        Assert.assertTrue(mCustomTabsConnection.mayLaunchUrl(token, Uri.parse(URL), null, null));
+        ThreadUtils.runOnUiThreadBlocking(new Runnable() {
+            @Override
+            public void run() {
+                Assert.assertTrue(WarmupManager.getInstance().hasSpareWebContents());
+                String referrer = mCustomTabsConnection.getReferrerForSession(token).getUrl();
+                Assert.assertNull(mCustomTabsConnection.takePrerenderedUrl(token, URL2, referrer));
+                Assert.assertTrue(WarmupManager.getInstance().hasSpareWebContents());
+            }
+        });
+    }
 }
diff --git a/chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.cc b/chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.cc
index 48ef2a1a..fed1fc3 100644
--- a/chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.cc
+++ b/chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.cc
@@ -36,11 +36,9 @@
     "lfnfbcjdepjffcaiagkdmlmiipelnfbb",  // Citrix Receiver (branded)
     "mfaihdlpglflfgpfjcifdjdjcckigekc",  // ARC Runtime
     "ngjnkanfphagcaokhjecbgkboelgfcnf",  // Print button
-    "gbchcmhmhahfdphkhkmpfmihenigjmpp",  // Chrome Remote Desktop
     "cjanmonomjogheabiocdamfpknlpdehm",  // HP printer driver
     "ioofdkhojeeimmagbjbknkejkgbphdfl",  // RICOH Print for Chrome
     "pmnllmkmjilbojkpgplbdmckghmaocjh",  // Scan app by François Beaufort
-    "khpfeaanjngmcnplbdlpegiifgpfgdco",  // Smart Card Connector App
     "haeblkpifdemlfnkogkipmghfcbonief",  // Charismathics Smart Card Middleware
     "mpnkhdpphjiihmlmkcamhpogecnnfffa",  // Service NSW Kiosk Utility
 
@@ -59,7 +57,6 @@
     "kgimkbnclbekdkabkpjhpakhhalfanda",  // Bejeweled demo
     "joodangkbfjnajiiifokapkpmhfnpleo",  // Calculator
     "fpgfohogebplgnamlafljlcidjedbdeb",  // Calendar demo
-    "hfhhnacclhffhdffklopdkcgdhifgngh",  // Camera
     "cdjikkcakjcdjemakobkmijmikhkegcj",  // Chrome Remote Desktop demo
     "jkoildpomkimndcphjpffmephmcmkfhn",  // Chromebook Demo App
     "lbhdhapagjhalobandnbdnmblnmocojh",  // Crackle demo
@@ -121,6 +118,44 @@
     "ilnpadgckeacioehlommkaafedibdeob",  // Enterprise DeviceAttributes
     "oflckobdemeldmjddmlbaiaookhhcngo",  // Citrix Receiver QA version
     "ljacajndfccfgnfohlgkdphmbnpkjflk",  // Chrome Remote Desktop (Dev Build)
+
+    // Google Apps:
+    "mclkkofklkfljcocdinagocijmpgbhab",  // Google input tools
+    "gbkeegbaiigmenfmjfclcdgdpimamgkj",  // Office Editing Docs/Sheets/Slides
+    "aapbdbdomjkkjkaonfhkkikfgjllcleb",  // Google Translate
+    "mgijmajocgfcbeboacabfgobmjgjcoja",  // Google Dictionary
+    "mfhehppjhmmnlfbbopchdfldgimhfhfk",  // Google Classroom
+    "mkaakpdehdafacodkgkpghoibnmamcme",  // Google Drawings
+    "pnhechapfaindjhompbnflcldabbghjo",  // Secure Shell
+    "fcgckldmmjdbpdejkclmfnnnehhocbfp",  // Google Finance
+    "jhknlonaankphkkbnmjdlpehkinifeeg",  // Google Forms
+    "jndclpdbaamdhonoechobihbbiimdgai",  // Chromebook Recovery Utility
+    "aohghmighlieiainnegkcijnfilokake",  // Google Docs
+    "eemlkeanncmjljgehlbplemhmdmalhdc",  // Chrome Connectivity Diagnostics
+    "eoieeedlomnegifmaghhjnghhmcldobl",  // Google Apps Script
+    "ndjpildffkeodjdaeebdhnncfhopkajk",  // Network File Share for Chrome OS
+    "pfoeakahkgllhkommkfeehmkfcloagkl",  // Fusion Tables
+    "aapocclcgogkmnckokdopfmhonfmgoek",  // Google Slides
+    "khpfeaanjngmcnplbdlpegiifgpfgdco",  // Smart Card Connector
+    "hmjkmjkepdijhoojdojkdfohbdgmmhki",  // Google Keep - notes and lists
+    "felcaaldnbdncclmgdcncolpebgiejap",  // Google Sheets
+    "gbchcmhmhahfdphkhkmpfmihenigjmpp",  // Chrome Remote Desktop
+    "khkjfddibboofomnlkndfedpoccieiee",  // Study Kit
+    "becloognjehhioodmnimnehjcibkloed",  // Coding with Chrome
+    "hfhhnacclhffhdffklopdkcgdhifgngh",  // Camera
+    "adokjfanaflbkibffcbhihgihpgijcei",  // Share to Classroom
+    "heildphpnddilhkemkielfhnkaagiabh",  // Legacy Browser Support
+    "lpcaedmchfhocbbapmcbpinfpgnhiddi",  // Google Keep Chrome Extension
+    "ldipcbpaocekfooobnbcddclnhejkcpn",  // Google Scholar Button
+    "nnckehldicaciogcbchegobnafnjkcne",  // Google Tone
+    "pfmgfdlgomnbgkofeojodiodmgpgmkac",  // Data Saver
+    "djcfdncoelnlbldjfhinnjlhdjlikmph",  // High Contrast
+    "ipkjmjaledkapilfdigkgfmpekpfnkih",  // Color Enhancer
+    "kcnhkahnjcbndmmehfkdnkjomaanaooo",  // Google Voice
+    "nlbjncdgjeocebhnmkbbbdekmmmcbfjd",  // RSS Subscription Extension
+    "aoggjnmghgmcllfenalipjhmooomfdce",  // SAML SSO for Chrome Apps
+    "fhndealchbngfhdoncgcokameljahhog",  // Certificate Enrollment for Chrome OS
+    "npeicpdbkakmehahjeeohfdhnlpdklia",  // WebRTC Network Limiter
 };
 
 // List of manifest entries from https://developer.chrome.com/apps/manifest.
diff --git a/chrome/browser/chromeos/settings/device_settings_service.h b/chrome/browser/chromeos/settings/device_settings_service.h
index 0840b621..4cf876eb 100644
--- a/chrome/browser/chromeos/settings/device_settings_service.h
+++ b/chrome/browser/chromeos/settings/device_settings_service.h
@@ -109,7 +109,7 @@
   // the InstallAttributes class.
   void SetDeviceMode(policy::DeviceMode device_mode);
 
-  const enterprise_management::PolicyData* policy_data() {
+  const enterprise_management::PolicyData* policy_data() const {
     return policy_data_.get();
   }
 
@@ -123,8 +123,12 @@
   // Returns the currently used owner key.
   scoped_refptr<ownership::PublicKey> GetPublicKey();
 
-  // Returns the status generated by the last operation.
-  Status status() { return store_status_; }
+  // Returns the status generated by the *last operation*.
+  // WARNING: It is not correct to take this method as an indication of whether
+  // DeviceSettingsService contains valid device settings. In order to answer
+  // that question, simply check whether device_settings() is different from
+  // nullptr.
+  Status status() const { return store_status_; }
 
   // Triggers an attempt to pull the public half of the owner key from disk and
   // load the device settings.
diff --git a/chrome/common/chrome_features.cc b/chrome/common/chrome_features.cc
index 61a830d..d6efa416 100644
--- a/chrome/common/chrome_features.cc
+++ b/chrome/common/chrome_features.cc
@@ -85,7 +85,14 @@
                                            base::FEATURE_DISABLED_BY_DEFAULT};
 #endif  // defined(OS_MACOSX)
 
-const base::Feature kTabsInCbd{"TabsInCBD", base::FEATURE_DISABLED_BY_DEFAULT};
+const base::Feature kTabsInCbd {
+  "TabsInCBD",
+#if defined(OS_ANDROID)
+      base::FEATURE_ENABLED_BY_DEFAULT
+#else
+      base::FEATURE_DISABLED_BY_DEFAULT
+#endif
+};
 
 // Whether to capture page thumbnails when the page load finishes (in addition
 // to any other times this might happen).
diff --git a/content/browser/appcache/appcache_url_loader_factory.cc b/content/browser/appcache/appcache_url_loader_factory.cc
index ce57fbdf..37c105a 100644
--- a/content/browser/appcache/appcache_url_loader_factory.cc
+++ b/content/browser/appcache/appcache_url_loader_factory.cc
@@ -17,9 +17,9 @@
 #include "content/common/url_loader.mojom.h"
 #include "content/common/url_loader_factory.mojom.h"
 #include "content/public/browser/browser_thread.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/associated_binding.h"
+#include "mojo/public/cpp/bindings/associated_interface_ptr.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
-#include "mojo/public/cpp/bindings/interface_ptr.h"
 
 namespace content {
 
@@ -30,7 +30,7 @@
                           public mojom::URLLoader {
  public:
   AppCacheURLLoader(const ResourceRequest& request,
-                    mojom::URLLoaderRequest url_loader_request,
+                    mojom::URLLoaderAssociatedRequest url_loader_request,
                     int32_t routing_id,
                     int32_t request_id,
                     mojom::URLLoaderClientPtr client_info,
@@ -110,7 +110,7 @@
   ResourceRequest request_;
 
   // URLLoader proxy for the network service.
-  mojom::URLLoaderPtr network_loader_request_;
+  mojom::URLLoaderAssociatedPtr network_loader_request_;
 
   // Routing id of the request. This is 0 for navigation requests. For
   // subresource requests it is non zero.
@@ -132,7 +132,7 @@
   scoped_refptr<URLLoaderFactoryGetter> factory_getter_;
 
   // Binds the URLLoaderClient with us.
-  mojo::Binding<mojom::URLLoader> binding_;
+  mojo::AssociatedBinding<mojom::URLLoader> binding_;
 
   DISALLOW_COPY_AND_ASSIGN(AppCacheURLLoader);
 };
@@ -160,7 +160,7 @@
 }
 
 void AppCacheURLLoaderFactory::CreateLoaderAndStart(
-    mojom::URLLoaderRequest url_loader_request,
+    mojom::URLLoaderAssociatedRequest url_loader_request,
     int32_t routing_id,
     int32_t request_id,
     uint32_t options,
@@ -182,4 +182,4 @@
   NOTREACHED();
 }
 
-}  // namespace content
+}  // namespace content
\ No newline at end of file
diff --git a/content/browser/appcache/appcache_url_loader_factory.h b/content/browser/appcache/appcache_url_loader_factory.h
index 9c85d93..f615395 100644
--- a/content/browser/appcache/appcache_url_loader_factory.h
+++ b/content/browser/appcache/appcache_url_loader_factory.h
@@ -29,12 +29,13 @@
                                      URLLoaderFactoryGetter* factory_getter);
 
   // mojom::URLLoaderFactory implementation.
-  void CreateLoaderAndStart(mojom::URLLoaderRequest url_loader_request,
-                            int32_t routing_id,
-                            int32_t request_id,
-                            uint32_t options,
-                            const ResourceRequest& request,
-                            mojom::URLLoaderClientPtr client) override;
+  void CreateLoaderAndStart(
+      mojom::URLLoaderAssociatedRequest url_loader_request,
+      int32_t routing_id,
+      int32_t request_id,
+      uint32_t options,
+      const ResourceRequest& request,
+      mojom::URLLoaderClientPtr client) override;
   void SyncLoad(int32_t routing_id,
                 int32_t request_id,
                 const ResourceRequest& request,
diff --git a/content/browser/loader/mojo_async_resource_handler.cc b/content/browser/loader/mojo_async_resource_handler.cc
index 1b3667993..7ec6e4a 100644
--- a/content/browser/loader/mojo_async_resource_handler.cc
+++ b/content/browser/loader/mojo_async_resource_handler.cc
@@ -60,7 +60,7 @@
   GetNumericArg("resource-buffer-size", &g_allocation_size);
 }
 
-void NotReached(mojom::URLLoaderRequest mojo_request,
+void NotReached(mojom::URLLoaderAssociatedRequest mojo_request,
                 mojom::URLLoaderClientPtr url_loader_client) {
   NOTREACHED();
 }
@@ -115,7 +115,7 @@
 MojoAsyncResourceHandler::MojoAsyncResourceHandler(
     net::URLRequest* request,
     ResourceDispatcherHostImpl* rdh,
-    mojom::URLLoaderRequest mojo_request,
+    mojom::URLLoaderAssociatedRequest mojo_request,
     mojom::URLLoaderClientPtr url_loader_client,
     ResourceType resource_type)
     : ResourceHandler(request),
@@ -587,7 +587,7 @@
 }
 
 void MojoAsyncResourceHandler::OnTransfer(
-    mojom::URLLoaderRequest mojo_request,
+    mojom::URLLoaderAssociatedRequest mojo_request,
     mojom::URLLoaderClientPtr url_loader_client) {
   binding_.Unbind();
   binding_.Bind(std::move(mojo_request));
diff --git a/content/browser/loader/mojo_async_resource_handler.h b/content/browser/loader/mojo_async_resource_handler.h
index 8ceb935..bbe3370 100644
--- a/content/browser/loader/mojo_async_resource_handler.h
+++ b/content/browser/loader/mojo_async_resource_handler.h
@@ -18,7 +18,7 @@
 #include "content/common/content_export.h"
 #include "content/common/url_loader.mojom.h"
 #include "content/public/common/resource_type.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/associated_binding.h"
 #include "mojo/public/cpp/system/data_pipe.h"
 #include "mojo/public/cpp/system/simple_watcher.h"
 #include "net/base/io_buffer.h"
@@ -54,7 +54,7 @@
  public:
   MojoAsyncResourceHandler(net::URLRequest* request,
                            ResourceDispatcherHostImpl* rdh,
-                           mojom::URLLoaderRequest mojo_request,
+                           mojom::URLLoaderAssociatedRequest mojo_request,
                            mojom::URLLoaderClientPtr url_loader_client,
                            ResourceType resource_type);
   ~MojoAsyncResourceHandler() override;
@@ -121,13 +121,13 @@
       const tracked_objects::Location& from_here,
       UploadProgressTracker::UploadProgressReportCallback callback);
 
-  void OnTransfer(mojom::URLLoaderRequest mojo_request,
+  void OnTransfer(mojom::URLLoaderAssociatedRequest mojo_request,
                   mojom::URLLoaderClientPtr url_loader_client);
   void SendUploadProgress(const net::UploadProgress& progress);
   void OnUploadProgressACK();
 
   ResourceDispatcherHostImpl* rdh_;
-  mojo::Binding<mojom::URLLoader> binding_;
+  mojo::AssociatedBinding<mojom::URLLoader> binding_;
 
   bool has_checked_for_sufficient_resources_ = false;
   bool sent_received_response_message_ = false;
diff --git a/content/browser/loader/mojo_async_resource_handler_unittest.cc b/content/browser/loader/mojo_async_resource_handler_unittest.cc
index e9cc4b3..906c85fe5e 100644
--- a/content/browser/loader/mojo_async_resource_handler_unittest.cc
+++ b/content/browser/loader/mojo_async_resource_handler_unittest.cc
@@ -208,7 +208,7 @@
   MojoAsyncResourceHandlerWithStubOperations(
       net::URLRequest* request,
       ResourceDispatcherHostImpl* rdh,
-      mojom::URLLoaderRequest mojo_request,
+      mojom::URLLoaderAssociatedRequest mojo_request,
       mojom::URLLoaderClientPtr url_loader_client)
       : MojoAsyncResourceHandler(request,
                                  rdh,
@@ -291,7 +291,7 @@
   TestURLLoaderFactory() {}
   ~TestURLLoaderFactory() override {}
 
-  void CreateLoaderAndStart(mojom::URLLoaderRequest request,
+  void CreateLoaderAndStart(mojom::URLLoaderAssociatedRequest request,
                             int32_t routing_id,
                             int32_t request_id,
                             uint32_t options,
@@ -301,7 +301,7 @@
     client_ptr_ = std::move(client_ptr);
   }
 
-  mojom::URLLoaderRequest PassLoaderRequest() {
+  mojom::URLLoaderAssociatedRequest PassLoaderRequest() {
     return std::move(loader_request_);
   }
 
@@ -315,7 +315,7 @@
   }
 
  private:
-  mojom::URLLoaderRequest loader_request_;
+  mojom::URLLoaderAssociatedRequest loader_request_;
   mojom::URLLoaderClientPtr client_ptr_;
 
   DISALLOW_COPY_AND_ASSIGN(TestURLLoaderFactory);
@@ -419,7 +419,7 @@
   TestResourceDispatcherHostDelegate rdh_delegate_;
   ResourceDispatcherHostImpl rdh_;
   mojom::URLLoaderFactoryPtr url_loader_factory_;
-  mojom::URLLoaderPtr url_loader_proxy_;
+  mojom::URLLoaderAssociatedPtr url_loader_proxy_;
   TestURLLoaderClient url_loader_client_;
   std::unique_ptr<TestBrowserContext> browser_context_;
   net::TestDelegate url_request_delegate_;
diff --git a/content/browser/loader/navigation_url_loader_network_service.cc b/content/browser/loader/navigation_url_loader_network_service.cc
index f484182c..49b37ab1 100644
--- a/content/browser/loader/navigation_url_loader_network_service.cc
+++ b/content/browser/loader/navigation_url_loader_network_service.cc
@@ -83,7 +83,7 @@
       mojom::URLLoaderFactoryPtrInfo factory_for_webui,
       scoped_refptr<URLLoaderFactoryGetter> url_loader_factory_getter,
       const base::Callback<WebContents*(void)>& web_contents_getter,
-      mojom::URLLoaderRequest url_loader_request,
+      mojom::URLLoaderAssociatedRequest url_loader_request,
       mojom::URLLoaderClientPtr url_loader_client_ptr,
       std::unique_ptr<service_manager::Connector> connector) {
     DCHECK_CURRENTLY_ON(BrowserThread::IO);
@@ -139,7 +139,7 @@
   }
 
   // This could be called multiple times.
-  void Restart(mojom::URLLoaderRequest url_loader_request,
+  void Restart(mojom::URLLoaderAssociatedRequest url_loader_request,
                mojom::URLLoaderClientPtr url_loader_client_ptr) {
     url_loader_request_ = std::move(url_loader_request);
     url_loader_client_ptr_ = std::move(url_loader_client_ptr);
@@ -183,7 +183,7 @@
   mojom::URLLoaderFactory* network_factory_;
 
   // Kept around until we create a loader.
-  mojom::URLLoaderRequest url_loader_request_;
+  mojom::URLLoaderAssociatedRequest url_loader_request_;
   mojom::URLLoaderClientPtr url_loader_client_ptr_;
 
   DISALLOW_COPY_AND_ASSIGN(URLLoaderRequestController);
@@ -237,7 +237,8 @@
 
   int frame_tree_node_id = request_info->frame_tree_node_id;
 
-  mojom::URLLoaderRequest loader_request = mojo::MakeRequest(&url_loader_ptr_);
+  mojom::URLLoaderAssociatedRequest loader_associated_request =
+      mojo::MakeRequest(&url_loader_associated_ptr_);
   mojom::URLLoaderClientPtr url_loader_client_ptr_to_pass;
   binding_.Bind(mojo::MakeRequest(&url_loader_client_ptr_to_pass));
 
@@ -270,7 +271,7 @@
           static_cast<StoragePartitionImpl*>(storage_partition)
               ->url_loader_factory_getter(),
           base::Bind(&GetWebContentsFromFrameTreeNodeID, frame_tree_node_id),
-          base::Passed(std::move(loader_request)),
+          base::Passed(std::move(loader_associated_request)),
           base::Passed(std::move(url_loader_client_ptr_to_pass)),
           base::Passed(ServiceManagerConnection::GetForProcess()
                            ->GetConnector()
@@ -283,7 +284,7 @@
 }
 
 void NavigationURLLoaderNetworkService::FollowRedirect() {
-  url_loader_ptr_->FollowRedirect();
+  url_loader_associated_ptr_->FollowRedirect();
 }
 
 void NavigationURLLoaderNetworkService::ProceedWithResponse() {}
diff --git a/content/browser/loader/navigation_url_loader_network_service.h b/content/browser/loader/navigation_url_loader_network_service.h
index 204e4f4..bee6717 100644
--- a/content/browser/loader/navigation_url_loader_network_service.h
+++ b/content/browser/loader/navigation_url_loader_network_service.h
@@ -65,7 +65,7 @@
   NavigationURLLoaderDelegate* delegate_;
 
   mojo::Binding<mojom::URLLoaderClient> binding_;
-  mojom::URLLoaderPtr url_loader_ptr_;
+  mojom::URLLoaderAssociatedPtr url_loader_associated_ptr_;
   scoped_refptr<ResourceResponse> response_;
   SSLStatus ssl_status_;
 
diff --git a/content/browser/loader/resource_dispatcher_host_impl.cc b/content/browser/loader/resource_dispatcher_host_impl.cc
index f29936f..207130f 100644
--- a/content/browser/loader/resource_dispatcher_host_impl.cc
+++ b/content/browser/loader/resource_dispatcher_host_impl.cc
@@ -882,7 +882,7 @@
     int routing_id,
     int request_id,
     const ResourceRequest& request_data,
-    mojom::URLLoaderRequest mojo_request,
+    mojom::URLLoaderAssociatedRequest mojo_request,
     mojom::URLLoaderClientPtr url_loader_client) {
   DCHECK(requester_info->IsRenderer() || requester_info->IsNavigationPreload());
   // TODO(pkasting): Remove ScopedTracker below once crbug.com/477117 is fixed.
@@ -946,7 +946,7 @@
     int request_id,
     const ResourceRequest& request_data,
     LoaderMap::iterator iter,
-    mojom::URLLoaderRequest mojo_request,
+    mojom::URLLoaderAssociatedRequest mojo_request,
     mojom::URLLoaderClientPtr url_loader_client) {
   DCHECK(requester_info->IsRenderer());
   int child_id = requester_info->child_id();
@@ -1029,7 +1029,7 @@
     int request_id,
     const ResourceRequest& request_data,
     int route_id,
-    mojom::URLLoaderRequest mojo_request,
+    mojom::URLLoaderAssociatedRequest mojo_request,
     mojom::URLLoaderClientPtr url_loader_client) {
   DCHECK(requester_info->IsRenderer());
   // Caller should ensure that |request_data| is associated with a transfer.
@@ -1084,7 +1084,7 @@
     const ResourceRequest& request_data,
     const SyncLoadResultCallback& sync_result_handler,  // only valid for sync
     int route_id,
-    mojom::URLLoaderRequest mojo_request,
+    mojom::URLLoaderAssociatedRequest mojo_request,
     mojom::URLLoaderClientPtr url_loader_client) {
   DCHECK(requester_info->IsRenderer() || requester_info->IsNavigationPreload());
   int child_id = requester_info->child_id();
@@ -1200,7 +1200,7 @@
     const SyncLoadResultCallback& sync_result_handler,  // only valid for sync
     int route_id,
     const net::HttpRequestHeaders& headers,
-    mojom::URLLoaderRequest mojo_request,
+    mojom::URLLoaderAssociatedRequest mojo_request,
     mojom::URLLoaderClientPtr url_loader_client,
     HeaderInterceptorResult interceptor_result) {
   DCHECK(requester_info->IsRenderer() || requester_info->IsNavigationPreload());
@@ -1459,7 +1459,7 @@
     int route_id,
     int child_id,
     ResourceContext* resource_context,
-    mojom::URLLoaderRequest mojo_request,
+    mojom::URLLoaderAssociatedRequest mojo_request,
     mojom::URLLoaderClientPtr url_loader_client) {
   DCHECK(requester_info->IsRenderer() || requester_info->IsNavigationPreload());
   // TODO(pkasting): Remove ScopedTracker below once crbug.com/456331 is fixed.
@@ -1527,7 +1527,7 @@
 std::unique_ptr<ResourceHandler>
 ResourceDispatcherHostImpl::CreateBaseResourceHandler(
     net::URLRequest* request,
-    mojom::URLLoaderRequest mojo_request,
+    mojom::URLLoaderAssociatedRequest mojo_request,
     mojom::URLLoaderClientPtr url_loader_client,
     ResourceType resource_type) {
   std::unique_ptr<ResourceHandler> handler;
@@ -2186,7 +2186,7 @@
     int routing_id,
     int request_id,
     const ResourceRequest& request,
-    mojom::URLLoaderRequest mojo_request,
+    mojom::URLLoaderAssociatedRequest mojo_request,
     mojom::URLLoaderClientPtr url_loader_client) {
   OnRequestResourceInternal(requester_info, routing_id, request_id, request,
                             std::move(mojo_request),
diff --git a/content/browser/loader/resource_dispatcher_host_impl.h b/content/browser/loader/resource_dispatcher_host_impl.h
index 08add84..9ac1b25 100644
--- a/content/browser/loader/resource_dispatcher_host_impl.h
+++ b/content/browser/loader/resource_dispatcher_host_impl.h
@@ -282,7 +282,7 @@
                                  int routing_id,
                                  int request_id,
                                  const ResourceRequest& request,
-                                 mojom::URLLoaderRequest mojo_request,
+                                 mojom::URLLoaderAssociatedRequest mojo_request,
                                  mojom::URLLoaderClientPtr url_loader_client);
 
   void OnSyncLoadWithMojo(ResourceRequesterInfo* requester_info,
@@ -527,7 +527,7 @@
                                  int routing_id,
                                  int request_id,
                                  const ResourceRequest& request_data,
-                                 mojom::URLLoaderRequest mojo_request,
+                                 mojom::URLLoaderAssociatedRequest mojo_request,
                                  mojom::URLLoaderClientPtr url_loader_client);
 
   void OnSyncLoad(ResourceRequesterInfo* requester_info,
@@ -544,7 +544,7 @@
                                 int request_id,
                                 const ResourceRequest& request_data,
                                 LoaderMap::iterator iter,
-                                mojom::URLLoaderRequest mojo_request,
+                                mojom::URLLoaderAssociatedRequest mojo_request,
                                 mojom::URLLoaderClientPtr url_loader_client);
 
   // If |request_data| is for a request being transferred from another process,
@@ -553,7 +553,7 @@
                         int request_id,
                         const ResourceRequest& request_data,
                         int route_id,
-                        mojom::URLLoaderRequest mojo_request,
+                        mojom::URLLoaderAssociatedRequest mojo_request,
                         mojom::URLLoaderClientPtr url_loader_client);
 
   void BeginRequest(
@@ -562,7 +562,7 @@
       const ResourceRequest& request_data,
       const SyncLoadResultCallback& sync_result_handler,  // only valid for sync
       int route_id,
-      mojom::URLLoaderRequest mojo_request,
+      mojom::URLLoaderAssociatedRequest mojo_request,
       mojom::URLLoaderClientPtr url_loader_client);
 
   // There are requests which need decisions to be made like the following:
@@ -580,7 +580,7 @@
       const SyncLoadResultCallback& sync_result_handler,  // only valid for sync
       int route_id,
       const net::HttpRequestHeaders& headers,
-      mojom::URLLoaderRequest mojo_request,
+      mojom::URLLoaderAssociatedRequest mojo_request,
       mojom::URLLoaderClientPtr url_loader_client,
       HeaderInterceptorResult interceptor_result);
 
@@ -594,13 +594,13 @@
       int route_id,
       int child_id,
       ResourceContext* resource_context,
-      mojom::URLLoaderRequest mojo_request,
+      mojom::URLLoaderAssociatedRequest mojo_request,
       mojom::URLLoaderClientPtr url_loader_client);
 
   // Creates either MojoAsyncResourceHandler or AsyncResourceHandler.
   std::unique_ptr<ResourceHandler> CreateBaseResourceHandler(
       net::URLRequest* request,
-      mojom::URLLoaderRequest mojo_request,
+      mojom::URLLoaderAssociatedRequest mojo_request,
       mojom::URLLoaderClientPtr url_loader_client,
       ResourceType resource_type);
 
diff --git a/content/browser/loader/resource_message_filter.cc b/content/browser/loader/resource_message_filter.cc
index d5b751d..57d7409 100644
--- a/content/browser/loader/resource_message_filter.cc
+++ b/content/browser/loader/resource_message_filter.cc
@@ -85,7 +85,7 @@
 }
 
 void ResourceMessageFilter::CreateLoaderAndStart(
-    mojom::URLLoaderRequest request,
+    mojom::URLLoaderAssociatedRequest request,
     int32_t routing_id,
     int32_t request_id,
     uint32_t options,
diff --git a/content/browser/loader/resource_message_filter.h b/content/browser/loader/resource_message_filter.h
index 61f7a27f..4e4d580 100644
--- a/content/browser/loader/resource_message_filter.h
+++ b/content/browser/loader/resource_message_filter.h
@@ -70,7 +70,7 @@
 
   base::WeakPtr<ResourceMessageFilter> GetWeakPtr();
 
-  void CreateLoaderAndStart(mojom::URLLoaderRequest request,
+  void CreateLoaderAndStart(mojom::URLLoaderAssociatedRequest request,
                             int32_t routing_id,
                             int32_t request_id,
                             uint32_t options,
diff --git a/content/browser/loader/resource_request_info_impl.cc b/content/browser/loader/resource_request_info_impl.cc
index 4476e6fd..2d9e6e90 100644
--- a/content/browser/loader/resource_request_info_impl.cc
+++ b/content/browser/loader/resource_request_info_impl.cc
@@ -346,7 +346,7 @@
     int origin_pid,
     int request_id,
     ResourceRequesterInfo* requester_info,
-    mojom::URLLoaderRequest url_loader_request,
+    mojom::URLLoaderAssociatedRequest url_loader_request,
     mojom::URLLoaderClientPtr url_loader_client) {
   route_id_ = route_id;
   render_frame_id_ = render_frame_id;
diff --git a/content/browser/loader/resource_request_info_impl.h b/content/browser/loader/resource_request_info_impl.h
index 85a99f9..d9dac75 100644
--- a/content/browser/loader/resource_request_info_impl.h
+++ b/content/browser/loader/resource_request_info_impl.h
@@ -36,7 +36,8 @@
                                 public base::SupportsUserData::Data {
  public:
   using TransferCallback =
-      base::Callback<void(mojom::URLLoaderRequest, mojom::URLLoaderClientPtr)>;
+      base::Callback<void(mojom::URLLoaderAssociatedRequest,
+                          mojom::URLLoaderClientPtr)>;
 
   // Returns the ResourceRequestInfoImpl associated with the given URLRequest.
   CONTENT_EXPORT static ResourceRequestInfoImpl* ForRequest(
@@ -124,7 +125,7 @@
                          int origin_pid,
                          int request_id,
                          ResourceRequesterInfo* requester_info,
-                         mojom::URLLoaderRequest url_loader_request,
+                         mojom::URLLoaderAssociatedRequest url_loader_request,
                          mojom::URLLoaderClientPtr url_loader_client);
 
   // Whether this request is part of a navigation that should replace the
diff --git a/content/browser/loader/url_loader_factory_impl.cc b/content/browser/loader/url_loader_factory_impl.cc
index 9256cec..048e212e 100644
--- a/content/browser/loader/url_loader_factory_impl.cc
+++ b/content/browser/loader/url_loader_factory_impl.cc
@@ -47,7 +47,7 @@
 }
 
 void URLLoaderFactoryImpl::CreateLoaderAndStart(
-    mojom::URLLoaderRequest request,
+    mojom::URLLoaderAssociatedRequest request,
     int32_t routing_id,
     int32_t request_id,
     uint32_t options,
@@ -69,7 +69,7 @@
 // static
 void URLLoaderFactoryImpl::CreateLoaderAndStart(
     ResourceRequesterInfo* requester_info,
-    mojom::URLLoaderRequest request,
+    mojom::URLLoaderAssociatedRequest request,
     int32_t routing_id,
     int32_t request_id,
     const ResourceRequest& url_request,
diff --git a/content/browser/loader/url_loader_factory_impl.h b/content/browser/loader/url_loader_factory_impl.h
index a9df19d..585b2144 100644
--- a/content/browser/loader/url_loader_factory_impl.h
+++ b/content/browser/loader/url_loader_factory_impl.h
@@ -22,7 +22,7 @@
  public:
   ~URLLoaderFactoryImpl() override;
 
-  void CreateLoaderAndStart(mojom::URLLoaderRequest request,
+  void CreateLoaderAndStart(mojom::URLLoaderAssociatedRequest request,
                             int32_t routing_id,
                             int32_t request_id,
                             uint32_t options,
@@ -34,7 +34,7 @@
                 SyncLoadCallback callback) override;
 
   static void CreateLoaderAndStart(ResourceRequesterInfo* requester_info,
-                                   mojom::URLLoaderRequest request,
+                                   mojom::URLLoaderAssociatedRequest request,
                                    int32_t routing_id,
                                    int32_t request_id,
                                    const ResourceRequest& url_request,
diff --git a/content/browser/loader/url_loader_factory_impl_unittest.cc b/content/browser/loader/url_loader_factory_impl_unittest.cc
index 80a4a93..2254eb4 100644
--- a/content/browser/loader/url_loader_factory_impl_unittest.cc
+++ b/content/browser/loader/url_loader_factory_impl_unittest.cc
@@ -149,7 +149,7 @@
   constexpr int32_t kRoutingId = 81;
   constexpr int32_t kRequestId = 28;
   NavigationResourceThrottle::set_ui_checks_always_succeed_for_testing(true);
-  mojom::URLLoaderPtr loader;
+  mojom::URLLoaderAssociatedPtr loader;
   base::FilePath root;
   PathService::Get(DIR_TEST_DATA, &root);
   net::URLRequestMockHTTPJob::AddUrlHandlers(root,
@@ -228,7 +228,7 @@
 
 TEST_P(URLLoaderFactoryImplTest, GetFailedResponse) {
   NavigationResourceThrottle::set_ui_checks_always_succeed_for_testing(true);
-  mojom::URLLoaderPtr loader;
+  mojom::URLLoaderAssociatedPtr loader;
   ResourceRequest request;
   TestURLLoaderClient client;
   net::URLRequestFailedJob::AddUrlHandler();
@@ -257,7 +257,7 @@
 // In this case, the loading fails after receiving a response.
 TEST_P(URLLoaderFactoryImplTest, GetFailedResponse2) {
   NavigationResourceThrottle::set_ui_checks_always_succeed_for_testing(true);
-  mojom::URLLoaderPtr loader;
+  mojom::URLLoaderAssociatedPtr loader;
   ResourceRequest request;
   TestURLLoaderClient client;
   net::URLRequestFailedJob::AddUrlHandler();
@@ -285,7 +285,7 @@
 
 // This test tests a case where resource loading is cancelled before started.
 TEST_P(URLLoaderFactoryImplTest, InvalidURL) {
-  mojom::URLLoaderPtr loader;
+  mojom::URLLoaderAssociatedPtr loader;
   ResourceRequest request;
   TestURLLoaderClient client;
   request.url = GURL();
@@ -310,7 +310,7 @@
 
 // This test tests a case where resource loading is cancelled before started.
 TEST_P(URLLoaderFactoryImplTest, ShouldNotRequestURL) {
-  mojom::URLLoaderPtr loader;
+  mojom::URLLoaderAssociatedPtr loader;
   RejectingResourceDispatcherHostDelegate rdh_delegate;
   rdh_.SetDelegate(&rdh_delegate);
   ResourceRequest request;
@@ -340,7 +340,7 @@
   constexpr int32_t kRoutingId = 1;
   constexpr int32_t kRequestId = 2;
 
-  mojom::URLLoaderPtr loader;
+  mojom::URLLoaderAssociatedPtr loader;
   base::FilePath root;
   PathService::Get(DIR_TEST_DATA, &root);
   net::URLRequestMockHTTPJob::AddUrlHandlers(root,
@@ -408,7 +408,7 @@
   constexpr int32_t kRoutingId = 1;
   constexpr int32_t kRequestId = 2;
 
-  mojom::URLLoaderPtr loader;
+  mojom::URLLoaderAssociatedPtr loader;
   base::FilePath root;
   PathService::Get(DIR_TEST_DATA, &root);
   net::URLRequestSlowDownloadJob::AddUrlHandler();
@@ -466,7 +466,7 @@
   constexpr int32_t kRoutingId = 81;
   constexpr int32_t kRequestId = 28;
   NavigationResourceThrottle::set_ui_checks_always_succeed_for_testing(true);
-  mojom::URLLoaderPtr loader;
+  mojom::URLLoaderAssociatedPtr loader;
   base::FilePath root;
   PathService::Get(DIR_TEST_DATA, &root);
   net::URLRequestMockHTTPJob::AddUrlHandlers(root,
@@ -527,7 +527,7 @@
   constexpr int32_t kRoutingId = 81;
   constexpr int32_t kRequestId = 28;
   NavigationResourceThrottle::set_ui_checks_always_succeed_for_testing(true);
-  mojom::URLLoaderPtr loader;
+  mojom::URLLoaderAssociatedPtr loader;
   base::FilePath root;
   PathService::Get(DIR_TEST_DATA, &root);
   net::URLRequestFailedJob::AddUrlHandler();
diff --git a/content/browser/service_worker/service_worker_fetch_dispatcher.cc b/content/browser/service_worker/service_worker_fetch_dispatcher.cc
index a37683d..81e72bc 100644
--- a/content/browser/service_worker/service_worker_fetch_dispatcher.cc
+++ b/content/browser/service_worker/service_worker_fetch_dispatcher.cc
@@ -41,11 +41,11 @@
 
 namespace {
 
-// This class wraps a mojo::InterfacePtr<URLLoader>. It also is a
+// This class wraps a mojo::AssociatedInterfacePtr<URLLoader>. It also is a
 // URLLoader implementation and delegates URLLoader calls to the wrapped loader.
 class DelegatingURLLoader final : public mojom::URLLoader {
  public:
-  explicit DelegatingURLLoader(mojom::URLLoaderPtr loader)
+  explicit DelegatingURLLoader(mojom::URLLoaderAssociatedPtr loader)
       : binding_(this), loader_(std::move(loader)) {}
   ~DelegatingURLLoader() override {}
 
@@ -73,7 +73,7 @@
   }
 
   mojo::Binding<mojom::URLLoader> binding_;
-  mojom::URLLoaderPtr loader_;
+  mojom::URLLoaderAssociatedPtr loader_;
 
   DISALLOW_COPY_AND_ASSIGN(DelegatingURLLoader);
 };
@@ -657,15 +657,16 @@
       std::move(url_loader_client_ptr), std::move(on_response), request);
   mojom::URLLoaderClientPtr url_loader_client_ptr_to_pass;
   url_loader_client->Bind(&url_loader_client_ptr_to_pass);
-  mojom::URLLoaderPtr url_loader_ptr;
+  mojom::URLLoaderAssociatedPtr url_loader_associated_ptr;
 
   url_loader_factory->CreateLoaderAndStart(
-      mojo::MakeRequest(&url_loader_ptr), original_info->GetRouteID(),
-      request_id, mojom::kURLLoadOptionNone, request,
-      std::move(url_loader_client_ptr_to_pass));
+      mojo::MakeRequest(&url_loader_associated_ptr),
+      original_info->GetRouteID(), request_id, mojom::kURLLoadOptionNone,
+      request, std::move(url_loader_client_ptr_to_pass));
 
   std::unique_ptr<DelegatingURLLoader> url_loader(
-      base::MakeUnique<DelegatingURLLoader>(std::move(url_loader_ptr)));
+      base::MakeUnique<DelegatingURLLoader>(
+          std::move(url_loader_associated_ptr)));
   preload_handle_->url_loader = url_loader->CreateInterfacePtrAndBind();
   url_loader_assets_ =
       new URLLoaderAssets(std::move(url_loader_factory), std::move(url_loader),
diff --git a/content/browser/site_per_process_browsertest.cc b/content/browser/site_per_process_browsertest.cc
index 9ef3a74..0812caa 100644
--- a/content/browser/site_per_process_browsertest.cc
+++ b/content/browser/site_per_process_browsertest.cc
@@ -2405,7 +2405,7 @@
   FailingLoadFactory() {}
   ~FailingLoadFactory() override {}
 
-  void CreateLoaderAndStart(mojom::URLLoaderRequest loader,
+  void CreateLoaderAndStart(mojom::URLLoaderAssociatedRequest loader,
                             int32_t routing_id,
                             int32_t request_id,
                             uint32_t options,
diff --git a/content/browser/webui/web_ui_url_loader_factory.cc b/content/browser/webui/web_ui_url_loader_factory.cc
index 63702b6..e85627c 100644
--- a/content/browser/webui/web_ui_url_loader_factory.cc
+++ b/content/browser/webui/web_ui_url_loader_factory.cc
@@ -222,7 +222,7 @@
   }
 
   // mojom::URLLoaderFactory implementation:
-  void CreateLoaderAndStart(mojom::URLLoaderRequest loader,
+  void CreateLoaderAndStart(mojom::URLLoaderAssociatedRequest loader,
                             int32_t routing_id,
                             int32_t request_id,
                             uint32_t options,
diff --git a/content/child/throttling_url_loader.h b/content/child/throttling_url_loader.h
index 5f3b088..49615f0 100644
--- a/content/child/throttling_url_loader.h
+++ b/content/child/throttling_url_loader.h
@@ -85,7 +85,7 @@
   mojom::URLLoaderClient* forwarding_client_;
   mojo::Binding<mojom::URLLoaderClient> client_binding_;
 
-  mojom::URLLoaderPtr url_loader_;
+  mojom::URLLoaderAssociatedPtr url_loader_;
 
   // Set if start is deferred.
   mojom::URLLoaderFactory* url_loader_factory_ = nullptr;
diff --git a/content/child/throttling_url_loader_unittest.cc b/content/child/throttling_url_loader_unittest.cc
index 89d9c09..96b8b919 100644
--- a/content/child/throttling_url_loader_unittest.cc
+++ b/content/child/throttling_url_loader_unittest.cc
@@ -45,7 +45,7 @@
 
  private:
   // mojom::URLLoaderFactory implementation.
-  void CreateLoaderAndStart(mojom::URLLoaderRequest request,
+  void CreateLoaderAndStart(mojom::URLLoaderAssociatedRequest request,
                             int32_t routing_id,
                             int32_t request_id,
                             uint32_t options,
diff --git a/content/child/url_loader_client_impl_unittest.cc b/content/child/url_loader_client_impl_unittest.cc
index 8f56588..f5a590d 100644
--- a/content/child/url_loader_client_impl_unittest.cc
+++ b/content/child/url_loader_client_impl_unittest.cc
@@ -12,8 +12,8 @@
 #include "content/child/test_request_peer.h"
 #include "content/common/url_loader_factory.mojom.h"
 #include "ipc/ipc_sender.h"
+#include "mojo/public/cpp/bindings/associated_interface_ptr_info.h"
 #include "mojo/public/cpp/bindings/binding.h"
-#include "mojo/public/cpp/bindings/interface_ptr.h"
 #include "net/url_request/redirect_info.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -52,7 +52,7 @@
     return false;
   }
 
-  void CreateLoaderAndStart(mojom::URLLoaderRequest request,
+  void CreateLoaderAndStart(mojom::URLLoaderAssociatedRequest request,
                             int32_t routing_id,
                             int32_t request_id,
                             uint32_t options,
diff --git a/content/common/url_loader_factory.mojom b/content/common/url_loader_factory.mojom
index 834a90ae..13b8d2e6 100644
--- a/content/common/url_loader_factory.mojom
+++ b/content/common/url_loader_factory.mojom
@@ -18,7 +18,7 @@
   // method will be called when certain events related to that loading
   // (e.g., response arrival) happen. |request_id| is for compatibility with
   // the existing Chrome IPC.
-  CreateLoaderAndStart(URLLoader& loader,
+  CreateLoaderAndStart(associated URLLoader& loader,
                        int32 routing_id,
                        int32 request_id,
                        uint32 options,
diff --git a/content/network/network_service_url_loader_factory_impl.cc b/content/network/network_service_url_loader_factory_impl.cc
index 0487083..58fef65 100644
--- a/content/network/network_service_url_loader_factory_impl.cc
+++ b/content/network/network_service_url_loader_factory_impl.cc
@@ -21,7 +21,7 @@
     default;
 
 void NetworkServiceURLLoaderFactoryImpl::CreateLoaderAndStart(
-    mojom::URLLoaderRequest request,
+    mojom::URLLoaderAssociatedRequest request,
     int32_t routing_id,
     int32_t request_id,
     uint32_t options,
diff --git a/content/network/network_service_url_loader_factory_impl.h b/content/network/network_service_url_loader_factory_impl.h
index 94d60285..851e71a7 100644
--- a/content/network/network_service_url_loader_factory_impl.h
+++ b/content/network/network_service_url_loader_factory_impl.h
@@ -23,7 +23,7 @@
   ~NetworkServiceURLLoaderFactoryImpl() override;
 
   // mojom::URLLoaderFactory implementation.
-  void CreateLoaderAndStart(mojom::URLLoaderRequest request,
+  void CreateLoaderAndStart(mojom::URLLoaderAssociatedRequest request,
                             int32_t routing_id,
                             int32_t request_id,
                             uint32_t options,
diff --git a/content/network/url_loader_impl.cc b/content/network/url_loader_impl.cc
index e1cc149..8d2143e 100644
--- a/content/network/url_loader_impl.cc
+++ b/content/network/url_loader_impl.cc
@@ -153,11 +153,12 @@
 
 }  // namespace
 
-URLLoaderImpl::URLLoaderImpl(NetworkContext* context,
-                             mojom::URLLoaderRequest url_loader_request,
-                             int32_t options,
-                             const ResourceRequest& request,
-                             mojom::URLLoaderClientPtr url_loader_client)
+URLLoaderImpl::URLLoaderImpl(
+    NetworkContext* context,
+    mojom::URLLoaderAssociatedRequest url_loader_request,
+    int32_t options,
+    const ResourceRequest& request,
+    mojom::URLLoaderClientPtr url_loader_client)
     : context_(context),
       options_(options),
       connected_(true),
diff --git a/content/network/url_loader_impl.h b/content/network/url_loader_impl.h
index 9abea13..98337d9 100644
--- a/content/network/url_loader_impl.h
+++ b/content/network/url_loader_impl.h
@@ -12,7 +12,7 @@
 #include "base/memory/weak_ptr.h"
 #include "content/common/content_export.h"
 #include "content/common/url_loader.mojom.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/associated_binding.h"
 #include "mojo/public/cpp/system/simple_watcher.h"
 #include "net/url_request/url_request.h"
 
@@ -25,7 +25,7 @@
                                      public net::URLRequest::Delegate {
  public:
   URLLoaderImpl(NetworkContext* context,
-                mojom::URLLoaderRequest url_loader_request,
+                mojom::URLLoaderAssociatedRequest url_loader_request,
                 int32_t options,
                 const ResourceRequest& request,
                 mojom::URLLoaderClientPtr url_loader_client);
@@ -60,7 +60,7 @@
   int32_t options_;
   bool connected_;
   std::unique_ptr<net::URLRequest> url_request_;
-  mojo::Binding<mojom::URLLoader> binding_;
+  mojo::AssociatedBinding<mojom::URLLoader> binding_;
   mojom::URLLoaderClientPtr url_loader_client_;
 
   mojo::ScopedDataPipeProducerHandle response_body_stream_;
diff --git a/content/network/url_loader_unittest.cc b/content/network/url_loader_unittest.cc
index 175fba7..69af3fd 100644
--- a/content/network/url_loader_unittest.cc
+++ b/content/network/url_loader_unittest.cc
@@ -72,13 +72,13 @@
   void Load(const GURL& url,
             TestURLLoaderClient* client,
             uint32_t options = 0) {
-    mojom::URLLoaderPtr loader;
+    mojom::URLLoaderAssociatedPtr loader;
 
     ResourceRequest request =
         CreateResourceRequest("GET", RESOURCE_TYPE_MAIN_FRAME, url);
 
-    URLLoaderImpl loader_impl(context(), mojo::MakeRequest(&loader), options,
-                              request, client->CreateInterfacePtr());
+    URLLoaderImpl loader_impl(context(), mojo::MakeIsolatedRequest(&loader),
+                              options, request, client->CreateInterfacePtr());
 
     client->RunUntilComplete();
   }
diff --git a/ios/chrome/browser/passwords/ios_chrome_save_password_infobar_delegate.h b/ios/chrome/browser/passwords/ios_chrome_save_password_infobar_delegate.h
index 47bfb4dc..0b187f7 100644
--- a/ios/chrome/browser/passwords/ios_chrome_save_password_infobar_delegate.h
+++ b/ios/chrome/browser/passwords/ios_chrome_save_password_infobar_delegate.h
@@ -34,6 +34,8 @@
 
   ~IOSChromeSavePasswordInfoBarDelegate() override;
 
+  bool ShouldExpire(const NavigationDetails& details) const override;
+
  private:
   IOSChromeSavePasswordInfoBarDelegate(
       bool is_smart_lock_branding_enabled,
diff --git a/ios/chrome/browser/passwords/ios_chrome_save_password_infobar_delegate.mm b/ios/chrome/browser/passwords/ios_chrome_save_password_infobar_delegate.mm
index 7e444c5f3..e5a17976 100644
--- a/ios/chrome/browser/passwords/ios_chrome_save_password_infobar_delegate.mm
+++ b/ios/chrome/browser/passwords/ios_chrome_save_password_infobar_delegate.mm
@@ -72,3 +72,8 @@
   set_infobar_response(password_manager::metrics_util::CLICKED_NEVER);
   return true;
 }
+
+bool IOSChromeSavePasswordInfoBarDelegate::ShouldExpire(
+    const NavigationDetails& details) const {
+  return !details.is_redirect && ConfirmInfoBarDelegate::ShouldExpire(details);
+}
diff --git a/ios/chrome/browser/physical_web/BUILD.gn b/ios/chrome/browser/physical_web/BUILD.gn
index 832f113..3257f057 100644
--- a/ios/chrome/browser/physical_web/BUILD.gn
+++ b/ios/chrome/browser/physical_web/BUILD.gn
@@ -3,6 +3,7 @@
 # found in the LICENSE file.
 
 source_set("physical_web") {
+  configs += [ "//build/config/compiler:enable_arc" ]
   sources = [
     "create_physical_web_data_source.h",
     "create_physical_web_data_source.mm",
diff --git a/ios/chrome/browser/physical_web/create_physical_web_data_source.mm b/ios/chrome/browser/physical_web/create_physical_web_data_source.mm
index 5844c61f..df210f7 100644
--- a/ios/chrome/browser/physical_web/create_physical_web_data_source.mm
+++ b/ios/chrome/browser/physical_web/create_physical_web_data_source.mm
@@ -7,6 +7,10 @@
 #include "base/memory/ptr_util.h"
 #import "ios/chrome/browser/physical_web/ios_chrome_physical_web_data_source.h"
 
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
 std::unique_ptr<physical_web::PhysicalWebDataSource>
 CreateIOSChromePhysicalWebDataSource(PrefService* prefService) {
   return base::MakeUnique<IOSChromePhysicalWebDataSource>(prefService);
diff --git a/ios/chrome/browser/physical_web/ios_chrome_physical_web_data_source.mm b/ios/chrome/browser/physical_web/ios_chrome_physical_web_data_source.mm
index 43247b3..2366193 100644
--- a/ios/chrome/browser/physical_web/ios_chrome_physical_web_data_source.mm
+++ b/ios/chrome/browser/physical_web/ios_chrome_physical_web_data_source.mm
@@ -8,6 +8,10 @@
 #import "ios/chrome/browser/physical_web/physical_web_initial_state_recorder.h"
 #import "ios/chrome/common/physical_web/physical_web_scanner.h"
 
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
 IOSChromePhysicalWebDataSource::IOSChromePhysicalWebDataSource(
     PrefService* pref_service) {
   initialStateRecorder_.reset([[PhysicalWebInitialStateRecorder alloc]
diff --git a/ios/chrome/browser/physical_web/physical_web_initial_state_recorder.mm b/ios/chrome/browser/physical_web/physical_web_initial_state_recorder.mm
index a05bbb4..56528ca 100644
--- a/ios/chrome/browser/physical_web/physical_web_initial_state_recorder.mm
+++ b/ios/chrome/browser/physical_web/physical_web_initial_state_recorder.mm
@@ -7,12 +7,15 @@
 #import <CoreBluetooth/CoreBluetooth.h>
 #import <CoreLocation/CoreLocation.h>
 
-#include "base/mac/scoped_nsobject.h"
 #include "base/metrics/histogram_macros.h"
 #include "components/prefs/pref_service.h"
 #include "ios/chrome/browser/physical_web/physical_web_constants.h"
 #include "ios/chrome/browser/pref_names.h"
 
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
 namespace {
 
 const double kStartupDelaySeconds = 10.0;
@@ -62,8 +65,8 @@
 @implementation PhysicalWebInitialStateRecorder {
   int preferenceState_;
   BOOL recordedState_;
-  base::scoped_nsobject<NSTimer> startupDelayTimer_;
-  base::scoped_nsobject<CBCentralManager> centralManager_;
+  NSTimer* startupDelayTimer_;
+  CBCentralManager* centralManager_;
 }
 
 - (instancetype)initWithPrefService:(PrefService*)prefService {
@@ -81,21 +84,20 @@
 
 - (void)dealloc {
   [self invalidate];
-  [super dealloc];
 }
 
 - (void)invalidate {
-  if (startupDelayTimer_.get()) {
+  if (startupDelayTimer_) {
     [startupDelayTimer_ invalidate];
-    startupDelayTimer_.reset();
+    startupDelayTimer_ = nil;
   }
   [centralManager_ setDelegate:nil];
-  centralManager_.reset();
+  centralManager_ = nil;
 }
 
 - (void)centralManagerDidUpdateState:(CBCentralManager*)central {
   [centralManager_ setDelegate:nil];
-  centralManager_.reset();
+  centralManager_ = nil;
 
   BOOL bluetoothEnabled = [centralManager_ state] == CBManagerStatePoweredOn;
 
@@ -117,20 +119,20 @@
     return;
   }
   recordedState_ = YES;
-  startupDelayTimer_.reset(
-      [[NSTimer scheduledTimerWithTimeInterval:kStartupDelaySeconds
-                                        target:self
-                                      selector:@selector(startupDelayElapsed:)
-                                      userInfo:nil
-                                       repeats:NO] retain]);
+  startupDelayTimer_ =
+      [NSTimer scheduledTimerWithTimeInterval:kStartupDelaySeconds
+                                       target:self
+                                     selector:@selector(startupDelayElapsed:)
+                                     userInfo:nil
+                                      repeats:NO];
 }
 
 - (void)startupDelayElapsed:(NSTimer*)timer {
-  startupDelayTimer_.reset();
+  startupDelayTimer_ = nil;
 
   // The Bluetooth enabled state must be checked asynchronously. When the state
   // is ready, it will call our centralManagerDidUpdateState method.
-  centralManager_.reset([[CBCentralManager alloc]
+  centralManager_ = [[CBCentralManager alloc]
       initWithDelegate:self
                  queue:dispatch_get_main_queue()
                options:@{
@@ -139,7 +141,7 @@
                  // Passing ShowPowerAlert=NO disables the prompt so we can
                  // check the Bluetooth enabled state silently.
                  CBCentralManagerOptionShowPowerAlertKey : @NO
-               }]);
+               }];
 }
 
 - (void)recordStateWithPreferenceState:(int)preferenceState
diff --git a/ios/chrome/browser/physical_web/start_physical_web_discovery.mm b/ios/chrome/browser/physical_web/start_physical_web_discovery.mm
index 5f517762..0a0734c15 100644
--- a/ios/chrome/browser/physical_web/start_physical_web_discovery.mm
+++ b/ios/chrome/browser/physical_web/start_physical_web_discovery.mm
@@ -18,6 +18,10 @@
 #include "ios/chrome/browser/search_engines/template_url_service_factory.h"
 #include "url/gurl.h"
 
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
 void StartPhysicalWebDiscovery(PrefService* pref_service,
                                ios::ChromeBrowserState* browser_state) {
   // Do not scan if the Physical Web feature is disabled by a command line flag
diff --git a/third_party/WebKit/LayoutTests/FlagExpectations/enable-browser-side-navigation b/third_party/WebKit/LayoutTests/FlagExpectations/enable-browser-side-navigation
index 2729ef4..3027b09 100644
--- a/third_party/WebKit/LayoutTests/FlagExpectations/enable-browser-side-navigation
+++ b/third_party/WebKit/LayoutTests/FlagExpectations/enable-browser-side-navigation
@@ -5,11 +5,6 @@
 crbug.com/551000 http/tests/inspector/network/x-frame-options-deny.html [ Failure ]
 crbug.com/551000 virtual/mojo-loading/http/tests/inspector/network/x-frame-options-deny.html [ Failure ]
 
-# https://crbug.com/690946 PlzNavigate: Missing line number in console messages when the 'frame-src' CSP is infringed.
-# SourceLocation is not set when the navigation is initiated outside of a script.
-crbug.com/690946 http/tests/security/contentSecurityPolicy/frame-src-cross-origin-load.html [ Failure ]
-crbug.com/690946 virtual/mojo-loading/http/tests/security/contentSecurityPolicy/frame-src-cross-origin-load.html [ Failure ]
-
 # These tests are flaky.
 Bug(none) http/tests/security/popup-allowed-by-sandbox-can-navigate.html [ Failure ]
 Bug(none) virtual/mojo-loading/http/tests/security/popup-allowed-by-sandbox-can-navigate.html [ Failure ]
@@ -20,11 +15,36 @@
 Bug(718942) http/tests/misc/onload-detach-during-csp-frame-src-none.html [ Failure ]
 Bug(718942) http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked-with-redirect.html [ Failure ]
 Bug(718942) http/tests/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked.html [ Failure ]
+Bug(718942) http/tests/security/contentSecurityPolicy/frame-src-cross-origin-load.html [ Failure ]
 Bug(718942) virtual/mojo-loading/http/tests/misc/onload-detach-during-csp-frame-src-none.html [ Failure ]
 Bug(718942) virtual/mojo-loading/http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked-with-redirect.html [ Failure ]
 Bug(718942) virtual/mojo-loading/http/tests/security/contentSecurityPolicy/1.1/form-action-src-redirect-blocked.html [ Failure ]
+Bug(718942) virtual/mojo-loading/http/tests/security/contentSecurityPolicy/frame-src-cross-origin-load.html [ Failure ]
 Bug(718942) virtual/off-main-thread-fetch/http/tests/misc/onload-detach-during-csp-frame-src-none.html [ Failure ]
 
+# Console error message source location is present with PlzNavigate. It means
+# that URLs are potentially disclosed across cross-origin renderers.
+# See https://crbug.com/726178.
+# One solution would be to send console messages from the browser to the
+# devtool process without the round-trip in the renderer.
+# See https://crbug.com/721329
+Bug(726178) http/tests/security/mixedContent/insecure-frame-in-data-iframe-in-main-frame-blocked.html [ Failure ]
+Bug(726178) http/tests/security/mixedContent/insecure-iframe-in-iframe.html [ Failure ]
+Bug(726178) http/tests/security/mixedContent/insecure-iframe-in-main-frame-allowed.html [ Failure ]
+Bug(726178) http/tests/security/mixedContent/insecure-iframe-in-main-frame-blocked.html [ Failure ]
+Bug(726178) http/tests/security/mixedContent/insecure-iframe-in-main-frame.html [ Failure ]
+Bug(726178) http/tests/security/mixedContent/nonwebby-scheme-in-iframe-allowed.https.html [ Failure ]
+Bug(726178) http/tests/security/mixedContent/redirect-http-to-https-iframe-in-main-frame.html [ Failure ]
+Bug(726178) http/tests/security/mixedContent/redirect-https-to-http-iframe-in-main-frame.html [ Failure ]
+Bug(726178) virtual/mojo-loading/http/tests/security/mixedContent/insecure-frame-in-data-iframe-in-main-frame-blocked.html [ Failure ]
+Bug(726178) virtual/mojo-loading/http/tests/security/mixedContent/insecure-iframe-in-iframe.html [ Failure ]
+Bug(726178) virtual/mojo-loading/http/tests/security/mixedContent/insecure-iframe-in-main-frame-allowed.html [ Failure ]
+Bug(726178) virtual/mojo-loading/http/tests/security/mixedContent/insecure-iframe-in-main-frame-blocked.html [ Failure ]
+Bug(726178) virtual/mojo-loading/http/tests/security/mixedContent/insecure-iframe-in-main-frame.html [ Failure ]
+Bug(726178) virtual/mojo-loading/http/tests/security/mixedContent/nonwebby-scheme-in-iframe-allowed.https.html [ Failure ]
+Bug(726178) virtual/mojo-loading/http/tests/security/mixedContent/redirect-http-to-https-iframe-in-main-frame.html [ Failure ]
+Bug(726178) virtual/mojo-loading/http/tests/security/mixedContent/redirect-https-to-http-iframe-in-main-frame.html [ Failure ]
+
 # PlzNavigate: Navigation requests upgraded via upgrade-insecure-requests will not get reported	
 # See https://crbug.com/713388
 Bug(713388) external/wpt/content-security-policy/securitypolicyviolation/upgrade-insecure-requests-reporting.https.html [ Timeout ]
diff --git a/third_party/WebKit/LayoutTests/SlowTests b/third_party/WebKit/LayoutTests/SlowTests
index 52d36d23..0d4a85c 100644
--- a/third_party/WebKit/LayoutTests/SlowTests
+++ b/third_party/WebKit/LayoutTests/SlowTests
@@ -257,8 +257,8 @@
 crbug.com/357427 virtual/mojo-loading/http/tests/workers/terminate-during-sync-operation-filesystem.html [ Slow ]
 crbug.com/364250 [ Debug ] virtual/threaded/animations/interpolation/transform-interpolation.html [ Slow ]
 crbug.com/364250 [ Debug ] virtual/threaded/animations/interpolation/webkit-transform-interpolation.html [ Slow ]
-crbug.com/402379 [ Win7 Debug ] storage/indexeddb/cursor-continue-validity.html [ Slow ]
-crbug.com/402379 [ Win7 Debug ] storage/indexeddb/mozilla/indexes.html [ Slow ]
+crbug.com/402379 [ Debug ] storage/indexeddb/cursor-continue-validity.html [ Slow ]
+crbug.com/402379 [ Debug ] storage/indexeddb/mozilla/indexes.html [ Slow ]
 crbug.com/504706 [ Linux ] inspector/profiler/heap-snapshot-containment-expansion-preserved-when-sorting.html [ Slow ]
 crbug.com/504706 [ Linux ] inspector/profiler/heap-snapshot-containment-sorting.html [ Slow ]
 crbug.com/440452 virtual/display_list_2d_canvas/fast/canvas/canvas-partial-invalidation-zoomed.html [ Slow ]
diff --git a/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-track-sizing-with-margins-and-orthogonal-flows.html b/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-track-sizing-with-margins-and-orthogonal-flows.html
index e81060ea..b15a428 100644
--- a/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-track-sizing-with-margins-and-orthogonal-flows.html
+++ b/third_party/WebKit/LayoutTests/fast/css-grid-layout/grid-track-sizing-with-margins-and-orthogonal-flows.html
@@ -4,7 +4,7 @@
 <link href="../css-intrinsic-dimensions/resources/width-keyword-classes.css" rel="stylesheet">
 <style>
 .grid { font: 20px/1 Ahem; }
-.item { margin: 10px 5px 5px 15px; }
+.item { margin: 10px 5px 20px 15px; }
 </style>
 <script src="../../resources/testharness.js"></script>
 <script src="../../resources/testharnessreport.js"></script>
@@ -15,18 +15,18 @@
 <p>This test checks that grid items' margin is computed correctly for content-sized tracks when using different writing modes.</p>
 
 <div style="position: relative">
-    <div class="grid fit-content itemsStart" data-expected-width="40" data-expected-height="140">
+    <div class="grid fit-content itemsStart" data-expected-width="40" data-expected-height="200">
         <div class="item verticalLR" data-offset-x="15" data-offset-y="10"  data-expected-width="20" data-expected-height="20">X</div>
-        <div class="item verticalLR" data-offset-x="15" data-offset-y="45"  data-expected-width="20" data-expected-height="20">X</div>
-        <div class="item verticalLR" data-offset-x="15" data-offset-y="80"  data-expected-width="20" data-expected-height="20">X</div>
-        <div class="item verticalLR" data-offset-x="15" data-offset-y="115" data-expected-width="20" data-expected-height="20">X</div>
+        <div class="item verticalLR" data-offset-x="15" data-offset-y="60"  data-expected-width="20" data-expected-height="20">X</div>
+        <div class="item verticalLR" data-offset-x="15" data-offset-y="110" data-expected-width="20" data-expected-height="20">X</div>
+        <div class="item verticalLR" data-offset-x="15" data-offset-y="160" data-expected-width="20" data-expected-height="20">X</div>
     </div>
 </div>
 
 <br>
 
 <div style="position: relative">
-    <div class="grid gridAutoFlowColumnSparse fit-content itemsStart" data-expected-width="160" data-expected-height="35">
+    <div class="grid gridAutoFlowColumnSparse fit-content itemsStart" data-expected-width="160" data-expected-height="50">
         <div class="item verticalLR" data-offset-x="15"  data-offset-y="10" data-expected-width="20" data-expected-height="20">X</div>
         <div class="item verticalLR" data-offset-x="55"  data-offset-y="10" data-expected-width="20" data-expected-height="20">X</div>
         <div class="item verticalLR" data-offset-x="95"  data-offset-y="10" data-expected-width="20" data-expected-height="20">X</div>
@@ -37,7 +37,7 @@
 <br>
 
 <div style="position: relative">
-    <div class="grid fit-content verticalLR itemsStart" data-expected-width="160" data-expected-height="35">
+    <div class="grid fit-content verticalLR itemsStart" data-expected-width="160" data-expected-height="50">
         <div class="item horizontalTB" data-offset-x="15"  data-offset-y="10" data-expected-width="20" data-expected-height="20">X</div>
         <div class="item horizontalTB" data-offset-x="55"  data-offset-y="10" data-expected-width="20" data-expected-height="20">X</div>
         <div class="item horizontalTB" data-offset-x="95"  data-offset-y="10" data-expected-width="20" data-expected-height="20">X</div>
@@ -48,11 +48,11 @@
 <br>
 
 <div style="position: relative">
-    <div class="grid gridAutoFlowColumnSparse fit-content verticalLR itemsStart" data-expected-width="40" data-expected-height="140">
+    <div class="grid gridAutoFlowColumnSparse fit-content verticalLR itemsStart" data-expected-width="40" data-expected-height="200">
         <div class="item horizontalTB" data-offset-x="15" data-offset-y="10"  data-expected-width="20" data-expected-height="20">X</div>
-        <div class="item horizontalTB" data-offset-x="15" data-offset-y="45"  data-expected-width="20" data-expected-height="20">X</div>
-        <div class="item horizontalTB" data-offset-x="15" data-offset-y="80"  data-expected-width="20" data-expected-height="20">X</div>
-        <div class="item horizontalTB" data-offset-x="15" data-offset-y="115" data-expected-width="20" data-expected-height="20">X</div>
+        <div class="item horizontalTB" data-offset-x="15" data-offset-y="60"  data-expected-width="20" data-expected-height="20">X</div>
+        <div class="item horizontalTB" data-offset-x="15" data-offset-y="110" data-expected-width="20" data-expected-height="20">X</div>
+        <div class="item horizontalTB" data-offset-x="15" data-offset-y="160" data-expected-width="20" data-expected-height="20">X</div>
     </div>
 </div>
 
diff --git a/third_party/WebKit/Source/core/frame/LocalFrameClient.h b/third_party/WebKit/Source/core/frame/LocalFrameClient.h
index 58be94c..76b023f 100644
--- a/third_party/WebKit/Source/core/frame/LocalFrameClient.h
+++ b/third_party/WebKit/Source/core/frame/LocalFrameClient.h
@@ -120,6 +120,7 @@
 
   virtual NavigationPolicy DecidePolicyForNavigation(
       const ResourceRequest&,
+      Document* origin_document,
       DocumentLoader*,
       NavigationType,
       NavigationPolicy,
diff --git a/third_party/WebKit/Source/core/loader/EmptyClients.cpp b/third_party/WebKit/Source/core/loader/EmptyClients.cpp
index 9871f76..038fd032 100644
--- a/third_party/WebKit/Source/core/loader/EmptyClients.cpp
+++ b/third_party/WebKit/Source/core/loader/EmptyClients.cpp
@@ -138,6 +138,7 @@
 
 NavigationPolicy EmptyLocalFrameClient::DecidePolicyForNavigation(
     const ResourceRequest&,
+    Document* origin_document,
     DocumentLoader*,
     NavigationType,
     NavigationPolicy,
diff --git a/third_party/WebKit/Source/core/loader/EmptyClients.h b/third_party/WebKit/Source/core/loader/EmptyClients.h
index 9138d0c..da74d8cd 100644
--- a/third_party/WebKit/Source/core/loader/EmptyClients.h
+++ b/third_party/WebKit/Source/core/loader/EmptyClients.h
@@ -290,6 +290,7 @@
 
   NavigationPolicy DecidePolicyForNavigation(
       const ResourceRequest&,
+      Document* origin_document,
       DocumentLoader*,
       NavigationType,
       NavigationPolicy,
diff --git a/third_party/WebKit/Source/core/loader/FrameLoader.cpp b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
index 3ad3d197..fcf4fe1 100644
--- a/third_party/WebKit/Source/core/loader/FrameLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
@@ -1256,6 +1256,7 @@
 
 NavigationPolicy FrameLoader::ShouldContinueForNavigationPolicy(
     const ResourceRequest& request,
+    Document* origin_document,
     const SubstituteData& substitute_data,
     DocumentLoader* loader,
     ContentSecurityPolicyDisposition
@@ -1291,8 +1292,8 @@
   bool replaces_current_history_item =
       frame_load_type == kFrameLoadTypeReplaceCurrentItem;
   policy = Client()->DecidePolicyForNavigation(
-      request, loader, type, policy, replaces_current_history_item,
-      is_client_redirect, form,
+      request, origin_document, loader, type, policy,
+      replaces_current_history_item, is_client_redirect, form,
       should_check_main_world_content_security_policy);
   if (policy == kNavigationPolicyCurrentTab ||
       policy == kNavigationPolicyIgnore ||
@@ -1325,10 +1326,15 @@
                     kCheckContentSecurityPolicy,
                 settings && settings->GetBrowserSideNavigationEnabled(),
                 ContentSecurityPolicy::CheckHeaderType::kCheckReportOnly);
+
   return ShouldContinueForNavigationPolicy(
-      request, substitute_data, loader,
-      should_check_main_world_content_security_policy, type, policy,
-      frame_load_type, is_client_redirect, form);
+      request,
+      // |origin_document| is not set. It doesn't really matter here. It is
+      // useful for PlzNavigate (aka browser-side-navigation). It is used
+      // during the first navigation and not during redirects.
+      nullptr,  // origin_document
+      substitute_data, loader, should_check_main_world_content_security_policy,
+      type, policy, frame_load_type, is_client_redirect, form);
 }
 
 NavigationPolicy FrameLoader::CheckLoadCanStart(
@@ -1362,7 +1368,8 @@
   ModifyRequestForCSP(resource_request, nullptr);
 
   return ShouldContinueForNavigationPolicy(
-      resource_request, frame_load_request.GetSubstituteData(), nullptr,
+      resource_request, frame_load_request.OriginDocument(),
+      frame_load_request.GetSubstituteData(), nullptr,
       frame_load_request.ShouldCheckMainWorldContentSecurityPolicy(),
       navigation_type, navigation_policy, type,
       frame_load_request.ClientRedirect() ==
diff --git a/third_party/WebKit/Source/core/loader/FrameLoader.h b/third_party/WebKit/Source/core/loader/FrameLoader.h
index d1a16d0..8f38a8a 100644
--- a/third_party/WebKit/Source/core/loader/FrameLoader.h
+++ b/third_party/WebKit/Source/core/loader/FrameLoader.h
@@ -186,6 +186,7 @@
   // returns NavigationPolicyCurrentTab.
   NavigationPolicy ShouldContinueForNavigationPolicy(
       const ResourceRequest&,
+      Document* origin_document,
       const SubstituteData&,
       DocumentLoader*,
       ContentSecurityPolicyDisposition,
diff --git a/third_party/WebKit/Source/web/LocalFrameClientImpl.cpp b/third_party/WebKit/Source/web/LocalFrameClientImpl.cpp
index 78a1ecf..7c07259c 100644
--- a/third_party/WebKit/Source/web/LocalFrameClientImpl.cpp
+++ b/third_party/WebKit/Source/web/LocalFrameClientImpl.cpp
@@ -494,6 +494,7 @@
 
 NavigationPolicy LocalFrameClientImpl::DecidePolicyForNavigation(
     const ResourceRequest& request,
+    Document* origin_document,
     DocumentLoader* loader,
     NavigationType type,
     NavigationPolicy policy,
@@ -555,8 +556,14 @@
   if (form)
     navigation_info.form = WebFormElement(form);
 
+  // The frame has navigated either by itself or by the action of the
+  // |origin_document| when it is defined. |source_location| represents the
+  // line of code that has initiated the navigation. It is used to let web
+  // developpers locate the root cause of blocked navigations.
   std::unique_ptr<SourceLocation> source_location =
-      SourceLocation::Capture(web_frame_->GetFrame()->GetDocument());
+      origin_document
+          ? SourceLocation::Capture(origin_document)
+          : SourceLocation::Capture(web_frame_->GetFrame()->GetDocument());
   if (source_location && !source_location->IsUnknown()) {
     navigation_info.source_location.url = source_location->Url();
     navigation_info.source_location.line_number = source_location->LineNumber();
diff --git a/third_party/WebKit/Source/web/LocalFrameClientImpl.h b/third_party/WebKit/Source/web/LocalFrameClientImpl.h
index 76554d2b..5e1b0a19 100644
--- a/third_party/WebKit/Source/web/LocalFrameClientImpl.h
+++ b/third_party/WebKit/Source/web/LocalFrameClientImpl.h
@@ -107,6 +107,7 @@
   void DispatchDidChangeThemeColor() override;
   NavigationPolicy DecidePolicyForNavigation(
       const ResourceRequest&,
+      Document* origin_document,
       DocumentLoader*,
       NavigationType,
       NavigationPolicy,