diff --git a/DEPS b/DEPS
index a8a5c92..a722968 100644
--- a/DEPS
+++ b/DEPS
@@ -40,7 +40,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': 'fbcbbfc7642d55d441d9cbc9409058702e6b78c8',
+  'v8_revision': '743b9df19d93bd8119ce81fb7fa7c9d4f748851e',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
diff --git a/build/toolchain/toolchain.gni b/build/toolchain/toolchain.gni
index 0dde8d9f..233b693 100644
--- a/build/toolchain/toolchain.gni
+++ b/build/toolchain/toolchain.gni
@@ -39,13 +39,7 @@
 declare_args() {
   if (is_clang) {
     # Clang compiler version. Clang files are placed at version-dependent paths.
-    clang_version = "3.9.0"
-
-    if (llvm_force_head_revision) {
-      # TODO(hans): Remove after next Clang roll.
-      # ToT Clang has a higher version number.
-      clang_version = "4.0.0"
-    }
+    clang_version = "4.0.0"
   }
 }
 
diff --git a/chrome/VERSION b/chrome/VERSION
index 1f31d15..3d45c4ef 100644
--- a/chrome/VERSION
+++ b/chrome/VERSION
@@ -1,4 +1,4 @@
 MAJOR=54
 MINOR=0
-BUILD=2823
+BUILD=2824
 PATCH=0
diff --git a/chrome/android/java/res/layout/password_entry_editor_interactive.xml b/chrome/android/java/res/layout/password_entry_editor_interactive.xml
index 4b5540160..3e43d50 100644
--- a/chrome/android/java/res/layout/password_entry_editor_interactive.xml
+++ b/chrome/android/java/res/layout/password_entry_editor_interactive.xml
@@ -13,8 +13,7 @@
         android:layout_width="match_parent"
         android:layout_height="wrap_content"
         android:orientation="vertical"
-        android:title="@string/password_entry_editor_title" 
-        android:visibility="gone">
+        android:title="@string/password_entry_editor_title">
         
         <TextView
             android:text="@string/password_entry_editor_site_title"
diff --git a/chrome/android/java/res/menu/password_entry_editor_action_bar_menu.xml b/chrome/android/java/res/menu/password_entry_editor_action_bar_menu.xml
new file mode 100644
index 0000000..ccd3c82
--- /dev/null
+++ b/chrome/android/java/res/menu/password_entry_editor_action_bar_menu.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2016 The Chromium Authors. All rights reserved.
+     Use of this source code is governed by a BSD-style license that can be
+     found in the LICENSE file. -->
+
+<menu xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:chrome="http://schemas.android.com/apk/res-auto" >
+
+    <item
+        android:id="@+id/action_delete_saved_password"
+        android:icon="@drawable/ic_delete_white_24dp"
+        android:title="@string/password_entry_editor_delete_stored_password_action_title"
+        android:contentDescription="@string/password_entry_editor_delete_stored_password"
+        chrome:showAsAction="ifRoom"/>
+</menu>
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/preferences/password/PasswordEntryEditor.java b/chrome/android/java/src/org/chromium/chrome/browser/preferences/password/PasswordEntryEditor.java
index c8e15c13..fc894c30 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/preferences/password/PasswordEntryEditor.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/preferences/password/PasswordEntryEditor.java
@@ -7,6 +7,9 @@
 import android.app.Fragment;
 import android.os.Bundle;
 import android.view.LayoutInflater;
+import android.view.Menu;
+import android.view.MenuInflater;
+import android.view.MenuItem;
 import android.view.View;
 import android.view.ViewGroup;
 import android.widget.Button;
@@ -34,6 +37,9 @@
     @Override
     public void onCreate(Bundle savedInstanceState) {
         super.onCreate(savedInstanceState);
+        if (ChromeFeatureList.isEnabled(VIEW_PASSWORDS)) {
+            setHasOptionsMenu(true);
+        }
     }
 
     @Override
@@ -72,6 +78,21 @@
         return v;
     }
 
+    @Override
+    public void onCreateOptionsMenu(Menu menu, MenuInflater inflater) {
+        inflater.inflate(R.menu.password_entry_editor_action_bar_menu, menu);
+    }
+
+    @Override
+    public boolean onOptionsItemSelected(MenuItem item) {
+        int id = item.getItemId();
+        if (id == R.id.action_delete_saved_password) {
+            removeItem();
+            return true;
+        }
+        return super.onOptionsItemSelected(item);
+    }
+
     // Delete was clicked.
     private void removeItem() {
         final PasswordUIView passwordUIView = new PasswordUIView();
diff --git a/chrome/android/java/strings/android_chrome_strings.grd b/chrome/android/java/strings/android_chrome_strings.grd
index c28c012..963126d2 100644
--- a/chrome/android/java/strings/android_chrome_strings.grd
+++ b/chrome/android/java/strings/android_chrome_strings.grd
@@ -369,6 +369,12 @@
       <message name="IDS_PASSWORD_ENTRY_EDITOR_VIEW_STORED_PASSWORD" desc='Content description for the button that allows users to view the stored password upon reauthentication.'>
         Unmask password
       </message>
+      <message name="IDS_PASSWORD_ENTRY_EDITOR_DELETE_STORED_PASSWORD_ACTION_TITLE" desc='Title for button on action bar that deletes the stored password.'>
+        Delete password
+      </message>
+      <message name="IDS_PASSWORD_ENTRY_EDITOR_DELETE_STORED_PASSWORD" desc='Content description for the button that allows users to delete the stored password.'>
+        Delete stored password
+      </message>
 
       <!-- Homepage preferences -->
       <message name="IDS_HOMEPAGE_DEFAULT_TITLE" desc="Label for checkbox to use the default homepage">
diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
index 7129b381..61bbab31 100644
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd
@@ -6311,6 +6311,12 @@
       <message name="IDS_FLAGS_V8_CACHE_STRATEGIES_FOR_CACHE_STORAGE_AGGRESSIVE" desc="The V8 cache for CacheStorage supports three strategies: disabled; caching same as if the script is in HTTPCache; force caching on the first load. This option describes the 3rd of these, force caching on the first load.">
         Aggressive
       </message>
+      <message name="IDS_FLAGS_SPECULATIVE_LAUNCH_SERVICE_WORKER_NAME" desc="Name of the about::flags setting for speculative launch of service workers.">
+        Speculative launch of service workers.
+      </message>
+      <message name="IDS_FLAGS_SPECULATIVE_LAUNCH_SERVICE_WORKER_DESCRIPTION" desc="Description of the about::flags setting for speculative launch of service workers.">
+        Speculatively launch service workers using touch and mouse events.
+      </message>
 
       <!-- Data Reduction Proxy -->
       <message name="IDS_FLAGS_DATA_REDUCTION_PROXY_LO_FI_NAME" desc="An about::flags experiment title to enable/disable Data Saver Lo-Fi" translateable="false">
diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
index 74b692c..08e1cde0 100644
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc
@@ -1119,6 +1119,10 @@
      IDS_FLAGS_SUGGESTIONS_WITH_SUB_STRING_MATCH_DESCRIPTION, kOsAll,
      SINGLE_VALUE_TYPE(
          autofill::switches::kEnableSuggestionsWithSubstringMatch)},
+    {"enable-speculative-launch-service-worker",
+     IDS_FLAGS_SPECULATIVE_LAUNCH_SERVICE_WORKER_NAME,
+     IDS_FLAGS_SPECULATIVE_LAUNCH_SERVICE_WORKER_DESCRIPTION, kOsAll,
+     FEATURE_VALUE_TYPE(features::kSpeculativeLaunchServiceWorker)},
     {"enable-supervised-user-managed-bookmarks-folder",
      IDS_FLAGS_SUPERVISED_USER_MANAGED_BOOKMARKS_FOLDER_NAME,
      IDS_FLAGS_SUPERVISED_USER_MANAGED_BOOKMARKS_FOLDER_DESCRIPTION, kOsAll,
diff --git a/chrome/browser/android/bookmarks/bookmark_bridge.cc b/chrome/browser/android/bookmarks/bookmark_bridge.cc
index d9b0e1b..7e603442 100644
--- a/chrome/browser/android/bookmarks/bookmark_bridge.cc
+++ b/chrome/browser/android/bookmarks/bookmark_bridge.cc
@@ -101,7 +101,7 @@
       partner_bookmarks_shim_(NULL) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   profile_ = ProfileAndroid::FromProfileAndroid(j_profile);
-  bookmark_model_ = BookmarkModelFactory::GetForProfile(profile_);
+  bookmark_model_ = BookmarkModelFactory::GetForBrowserContext(profile_);
   managed_bookmark_service_ =
       ManagedBookmarkServiceFactory::GetForProfile(profile_);
 
diff --git a/chrome/browser/android/bookmarks/partner_bookmarks_shim_unittest.cc b/chrome/browser/android/bookmarks/partner_bookmarks_shim_unittest.cc
index d98d65a..3d84a52 100644
--- a/chrome/browser/android/bookmarks/partner_bookmarks_shim_unittest.cc
+++ b/chrome/browser/android/bookmarks/partner_bookmarks_shim_unittest.cc
@@ -65,7 +65,7 @@
     profile_.reset(new TestingProfile());
     profile_->CreateBookmarkModel(true);
 
-    model_ = BookmarkModelFactory::GetForProfile(profile_.get());
+    model_ = BookmarkModelFactory::GetForBrowserContext(profile_.get());
     bookmarks::test::WaitForBookmarkModelToLoad(model_);
   }
 
diff --git a/chrome/browser/android/history_report/history_report_jni_bridge.cc b/chrome/browser/android/history_report/history_report_jni_bridge.cc
index 26ed8f56..3892b58 100644
--- a/chrome/browser/android/history_report/history_report_jni_bridge.cc
+++ b/chrome/browser/android/history_report/history_report_jni_bridge.cc
@@ -52,7 +52,7 @@
   usage_reports_buffer_service_.reset(
       new UsageReportsBufferService(profile->GetPath()));
   usage_reports_buffer_service_->Init();
-  bookmark_model_.reset(BookmarkModelFactory::GetForProfile(profile));
+  bookmark_model_.reset(BookmarkModelFactory::GetForBrowserContext(profile));
   base::Callback<void(void)> on_change = base::Bind(
       &history_report::HistoryReportJniBridge::NotifyDataChanged,
       base::Unretained(this));
diff --git a/chrome/browser/android/omnibox/autocomplete_controller_android.cc b/chrome/browser/android/omnibox/autocomplete_controller_android.cc
index 4a6b524..6d49b822 100644
--- a/chrome/browser/android/omnibox/autocomplete_controller_android.cc
+++ b/chrome/browser/android/omnibox/autocomplete_controller_android.cc
@@ -531,7 +531,8 @@
       ConvertUTF16ToJavaString(env, match.fill_into_edit);
   ScopedJavaLocalRef<jstring> destination_url =
       ConvertUTF8ToJavaString(env, match.destination_url.spec());
-  BookmarkModel* bookmark_model = BookmarkModelFactory::GetForProfile(profile_);
+  BookmarkModel* bookmark_model =
+      BookmarkModelFactory::GetForBrowserContext(profile_);
   return Java_AutocompleteController_buildOmniboxSuggestion(
       env,
       match.type,
diff --git a/chrome/browser/android/provider/chrome_browser_provider.cc b/chrome/browser/android/provider/chrome_browser_provider.cc
index 2d70930b..e1cda59 100644
--- a/chrome/browser/android/provider/chrome_browser_provider.cc
+++ b/chrome/browser/android/provider/chrome_browser_provider.cc
@@ -825,7 +825,7 @@
       handling_extensive_changes_(false) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   profile_ = g_browser_process->profile_manager()->GetLastUsedProfile();
-  bookmark_model_ = BookmarkModelFactory::GetForProfile(profile_);
+  bookmark_model_ = BookmarkModelFactory::GetForBrowserContext(profile_);
   top_sites_ = TopSitesFactory::GetForProfile(profile_);
   favicon_service_ = FaviconServiceFactory::GetForProfile(
       profile_, ServiceAccessType::EXPLICIT_ACCESS),
diff --git a/chrome/browser/android/signin/signin_manager_android.cc b/chrome/browser/android/signin/signin_manager_android.cc
index f836f8dd..bfeaaaa8 100644
--- a/chrome/browser/android/signin/signin_manager_android.cc
+++ b/chrome/browser/android/signin/signin_manager_android.cc
@@ -230,7 +230,7 @@
 
 void SigninManagerAndroid::OnBrowsingDataRemoverDone(
     const base::android::ScopedJavaGlobalRef<jobject>& callback) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile_);
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile_);
   model->RemoveAllUserBookmarks();
 
   // All the Profile data has been wiped. Clear the last signed in username as
diff --git a/chrome/browser/android/tab_android.cc b/chrome/browser/android/tab_android.cc
index f61e979c..a64861bc 100644
--- a/chrome/browser/android/tab_android.cc
+++ b/chrome/browser/android/tab_android.cc
@@ -756,7 +756,7 @@
   bookmarks::ManagedBookmarkService* managed =
       ManagedBookmarkServiceFactory::GetForProfile(profile);
   bookmarks::BookmarkModel* model =
-      BookmarkModelFactory::GetForProfile(profile);
+      BookmarkModelFactory::GetForBrowserContext(profile);
 
   model->GetNodesByURL(url, &nodes);
   std::sort(nodes.begin(), nodes.end(), &bookmarks::MoreRecentlyAdded);
diff --git a/chrome/browser/app_controller_mac_browsertest.mm b/chrome/browser/app_controller_mac_browsertest.mm
index 7bd1c79..d9fc6b4 100644
--- a/chrome/browser/app_controller_mac_browsertest.mm
+++ b/chrome/browser/app_controller_mac_browsertest.mm
@@ -518,7 +518,7 @@
   // Use the existing profile as profile 1.
   Profile* profile1 = browser()->profile();
   bookmarks::test::WaitForBookmarkModelToLoad(
-      BookmarkModelFactory::GetForProfile(profile1));
+      BookmarkModelFactory::GetForBrowserContext(profile1));
 
   // Create profile 2.
   base::FilePath path2 = profile_manager->GenerateNextProfileDirectoryPath();
@@ -526,7 +526,7 @@
       Profile::CreateProfile(path2, NULL, Profile::CREATE_MODE_SYNCHRONOUS);
   profile_manager->RegisterTestingProfile(profile2, false, true);
   bookmarks::test::WaitForBookmarkModelToLoad(
-      BookmarkModelFactory::GetForProfile(profile2));
+      BookmarkModelFactory::GetForBrowserContext(profile2));
 
   // Switch to profile 1, create bookmark 1 and force the menu to build.
   [ac windowChangedToProfile:profile1];
diff --git a/chrome/browser/autocomplete/chrome_autocomplete_provider_client.cc b/chrome/browser/autocomplete/chrome_autocomplete_provider_client.cc
index a0b1ac5..b58ba5a7 100644
--- a/chrome/browser/autocomplete/chrome_autocomplete_provider_client.cc
+++ b/chrome/browser/autocomplete/chrome_autocomplete_provider_client.cc
@@ -99,7 +99,7 @@
 }
 
 bookmarks::BookmarkModel* ChromeAutocompleteProviderClient::GetBookmarkModel() {
-  return BookmarkModelFactory::GetForProfile(profile_);
+  return BookmarkModelFactory::GetForBrowserContext(profile_);
 }
 
 history::URLDatabase* ChromeAutocompleteProviderClient::GetInMemoryDatabase() {
diff --git a/chrome/browser/autocomplete/in_memory_url_index_factory.cc b/chrome/browser/autocomplete/in_memory_url_index_factory.cc
index 42a43e3..95849abd 100644
--- a/chrome/browser/autocomplete/in_memory_url_index_factory.cc
+++ b/chrome/browser/autocomplete/in_memory_url_index_factory.cc
@@ -45,13 +45,13 @@
   Profile* profile = Profile::FromBrowserContext(context);
   SchemeSet chrome_schemes_to_whitelist;
   chrome_schemes_to_whitelist.insert(content::kChromeUIScheme);
-  InMemoryURLIndex* in_memory_url_index = new InMemoryURLIndex(
-      BookmarkModelFactory::GetForProfile(profile),
-      HistoryServiceFactory::GetForProfile(profile,
-                                           ServiceAccessType::IMPLICIT_ACCESS),
-      TemplateURLServiceFactory::GetForProfile(profile),
-      content::BrowserThread::GetBlockingPool(), profile->GetPath(),
-      chrome_schemes_to_whitelist);
+  InMemoryURLIndex* in_memory_url_index =
+      new InMemoryURLIndex(BookmarkModelFactory::GetForBrowserContext(profile),
+                           HistoryServiceFactory::GetForProfile(
+                               profile, ServiceAccessType::IMPLICIT_ACCESS),
+                           TemplateURLServiceFactory::GetForProfile(profile),
+                           content::BrowserThread::GetBlockingPool(),
+                           profile->GetPath(), chrome_schemes_to_whitelist);
   in_memory_url_index->Init();
   return in_memory_url_index;
 }
diff --git a/chrome/browser/bookmarks/bookmark_html_writer.cc b/chrome/browser/bookmarks/bookmark_html_writer.cc
index df558550..7b82ea1 100644
--- a/chrome/browser/bookmarks/bookmark_html_writer.cc
+++ b/chrome/browser/bookmarks/bookmark_html_writer.cc
@@ -25,6 +25,7 @@
 #include "chrome/browser/bookmarks/bookmark_model_factory.h"
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/favicon/favicon_service_factory.h"
+#include "chrome/browser/profiles/profile.h"
 #include "components/bookmarks/browser/bookmark_codec.h"
 #include "components/bookmarks/browser/bookmark_model.h"
 #include "components/favicon/core/favicon_service.h"
@@ -409,10 +410,12 @@
 }
 
 void BookmarkFaviconFetcher::ExportBookmarks() {
-  ExtractUrls(BookmarkModelFactory::GetForProfile(
-      profile_)->bookmark_bar_node());
-  ExtractUrls(BookmarkModelFactory::GetForProfile(profile_)->other_node());
-  ExtractUrls(BookmarkModelFactory::GetForProfile(profile_)->mobile_node());
+  ExtractUrls(BookmarkModelFactory::GetForBrowserContext(profile_)
+                  ->bookmark_bar_node());
+  ExtractUrls(
+      BookmarkModelFactory::GetForBrowserContext(profile_)->other_node());
+  ExtractUrls(
+      BookmarkModelFactory::GetForBrowserContext(profile_)->mobile_node());
   if (!bookmark_urls_.empty())
     FetchNextFavicon();
   else
@@ -448,10 +451,11 @@
   BookmarkCodec codec;
   BrowserThread::PostTask(
       BrowserThread::FILE, FROM_HERE,
-      base::Bind(&Writer::DoWrite,
-                 new Writer(codec.Encode(BookmarkModelFactory::GetForProfile(
-                                profile_)),
-                            path_, favicons_map_.release(), observer_)));
+      base::Bind(
+          &Writer::DoWrite,
+          new Writer(codec.Encode(
+                         BookmarkModelFactory::GetForBrowserContext(profile_)),
+                     path_, favicons_map_.release(), observer_)));
   if (g_fetcher) {
     base::ThreadTaskRunnerHandle::Get()->DeleteSoon(FROM_HERE, g_fetcher);
     g_fetcher = nullptr;
diff --git a/chrome/browser/bookmarks/bookmark_html_writer_unittest.cc b/chrome/browser/bookmarks/bookmark_html_writer_unittest.cc
index 9f28dcc..3df0d935 100644
--- a/chrome/browser/bookmarks/bookmark_html_writer_unittest.cc
+++ b/chrome/browser/bookmarks/bookmark_html_writer_unittest.cc
@@ -156,7 +156,7 @@
   profile.CreateFaviconService();
   profile.CreateBookmarkModel(true);
 
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(&profile);
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(&profile);
   bookmarks::test::WaitForBookmarkModelToLoad(model);
 
   // Create test PNG representing favicon for url1.
diff --git a/chrome/browser/bookmarks/bookmark_model_factory.cc b/chrome/browser/bookmarks/bookmark_model_factory.cc
index 89f159f67..079bf756 100644
--- a/chrome/browser/bookmarks/bookmark_model_factory.cc
+++ b/chrome/browser/bookmarks/bookmark_model_factory.cc
@@ -30,28 +30,16 @@
 
 // static
 BookmarkModel* BookmarkModelFactory::GetForBrowserContext(
-    content::BrowserContext* browser_context) {
+    content::BrowserContext* context) {
   return static_cast<BookmarkModel*>(
-      GetInstance()->GetServiceForBrowserContext(browser_context, true));
+      GetInstance()->GetServiceForBrowserContext(context, true));
 }
 
 // static
 BookmarkModel* BookmarkModelFactory::GetForBrowserContextIfExists(
-    content::BrowserContext* browser_context) {
+    content::BrowserContext* context) {
   return static_cast<BookmarkModel*>(
-      GetInstance()->GetServiceForBrowserContext(browser_context, false));
-}
-
-// static
-BookmarkModel* BookmarkModelFactory::GetForProfile(Profile* profile) {
-  return static_cast<BookmarkModel*>(
-      GetInstance()->GetServiceForBrowserContext(profile, true));
-}
-
-// static
-BookmarkModel* BookmarkModelFactory::GetForProfileIfExists(Profile* profile) {
-  return static_cast<BookmarkModel*>(
-      GetInstance()->GetServiceForBrowserContext(profile, false));
+      GetInstance()->GetServiceForBrowserContext(context, false));
 }
 
 // static
diff --git a/chrome/browser/bookmarks/bookmark_model_factory.h b/chrome/browser/bookmarks/bookmark_model_factory.h
index bb17bb6..bd388e3 100644
--- a/chrome/browser/bookmarks/bookmark_model_factory.h
+++ b/chrome/browser/bookmarks/bookmark_model_factory.h
@@ -12,13 +12,12 @@
 template <typename T> struct DefaultSingletonTraits;
 }
 
-class Profile;
-
 namespace bookmarks {
 class BookmarkModel;
 }
 
-// Singleton that owns all BookmarkModels and associates them with Profiles.
+// Singleton that owns all BookmarkModels and associates them with
+// BrowserContexts.
 class BookmarkModelFactory : public BrowserContextKeyedServiceFactory {
  public:
   static bookmarks::BookmarkModel* GetForBrowserContext(
@@ -27,12 +26,6 @@
   static bookmarks::BookmarkModel* GetForBrowserContextIfExists(
       content::BrowserContext* browser_context);
 
-  // TODO(pke): Remove GetForProfile and GetForProfileIfExists and use
-  // GetForBrowserContext/GetForBrowserContextIfExists everywhere.
-  static bookmarks::BookmarkModel* GetForProfile(Profile* profile);
-
-  static bookmarks::BookmarkModel* GetForProfileIfExists(Profile* profile);
-
   static BookmarkModelFactory* GetInstance();
 
  private:
diff --git a/chrome/browser/bookmarks/managed_bookmark_service_unittest.cc b/chrome/browser/bookmarks/managed_bookmark_service_unittest.cc
index 2f8053c..c45cf36 100644
--- a/chrome/browser/bookmarks/managed_bookmark_service_unittest.cc
+++ b/chrome/browser/bookmarks/managed_bookmark_service_unittest.cc
@@ -56,7 +56,7 @@
 
   void ResetModel() {
     profile_.CreateBookmarkModel(false);
-    model_ = BookmarkModelFactory::GetForProfile(&profile_);
+    model_ = BookmarkModelFactory::GetForBrowserContext(&profile_);
     bookmarks::test::WaitForBookmarkModelToLoad(model_);
     model_->AddObserver(&observer_);
     managed_ = ManagedBookmarkServiceFactory::GetForProfile(&profile_);
diff --git a/chrome/browser/browser_commands_unittest.cc b/chrome/browser/browser_commands_unittest.cc
index 5d1a60b..644b870 100644
--- a/chrome/browser/browser_commands_unittest.cc
+++ b/chrome/browser/browser_commands_unittest.cc
@@ -158,7 +158,7 @@
   // We use profile() here, since it's a TestingProfile.
   profile()->CreateBookmarkModel(true);
 
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   bookmarks::test::WaitForBookmarkModelToLoad(model);
 
   // Navigate to a url.
diff --git a/chrome/browser/browsing_data/browsing_data_remover_unittest.cc b/chrome/browser/browsing_data/browsing_data_remover_unittest.cc
index 774f5e3..3fa5213 100644
--- a/chrome/browser/browsing_data/browsing_data_remover_unittest.cc
+++ b/chrome/browser/browsing_data/browsing_data_remover_unittest.cc
@@ -1590,7 +1590,7 @@
   TestingProfile* profile = GetProfile();
   profile->CreateBookmarkModel(true);
   bookmarks::BookmarkModel* bookmark_model =
-      BookmarkModelFactory::GetForProfile(profile);
+      BookmarkModelFactory::GetForBrowserContext(profile);
   bookmarks::test::WaitForBookmarkModelToLoad(bookmark_model);
   bookmark_model->AddURL(bookmark_model->bookmark_bar_node(), 0,
                          base::ASCIIToUTF16("a"), bookmarked_page);
diff --git a/chrome/browser/chrome_service_worker_browsertest.cc b/chrome/browser/chrome_service_worker_browsertest.cc
index ac5f1c4d..834b3d97 100644
--- a/chrome/browser/chrome_service_worker_browsertest.cc
+++ b/chrome/browser/chrome_service_worker_browsertest.cc
@@ -12,6 +12,7 @@
 #include "base/run_loop.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
+#include "base/test/histogram_tester.h"
 #include "build/build_config.h"
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/profiles/profile.h"
@@ -26,6 +27,8 @@
 #include "content/public/browser/service_worker_context.h"
 #include "content/public/browser/storage_partition.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/common/content_features.h"
+#include "content/public/common/content_switches.h"
 #include "content/public/test/browser_test_utils.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "ppapi/shared_impl/ppapi_switches.h"
@@ -516,4 +519,86 @@
             ExecutePNACLUrlLoaderTest("OtherCORSCredentials"));
 }
 
+class ServiceWorkerSpeculativeLaunchTest : public ChromeServiceWorkerTest {
+ protected:
+  ServiceWorkerSpeculativeLaunchTest() {}
+  ~ServiceWorkerSpeculativeLaunchTest() override {}
+
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    command_line->AppendSwitchASCII(
+        switches::kEnableFeatures,
+        features::kSpeculativeLaunchServiceWorker.name);
+  }
+
+  base::HistogramTester histogram_tester_;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(ServiceWorkerSpeculativeLaunchTest);
+};
+
+IN_PROC_BROWSER_TEST_F(ServiceWorkerSpeculativeLaunchTest, MouseDown) {
+  WriteFile(
+      FILE_PATH_LITERAL("sw.js"),
+      "self.onfetch = function(e) {"
+      "  e.respondWith(new Response('<title>Done</title>',"
+      "                             {headers: {'Content-Type': 'text/html'}}));"
+      "};");
+  WriteFile(
+      FILE_PATH_LITERAL("test.html"),
+      "<script>"
+      "navigator.serviceWorker.register('./sw.js', {scope: './scope/'})"
+      "  .then(function(reg) {"
+      "      reg.addEventListener('updatefound', function() {"
+      "          var worker = reg.installing;"
+      "          worker.addEventListener('statechange', function() {"
+      "              if (worker.state == 'activated')"
+      "                document.title = 'READY';"
+      "            });"
+      "        });"
+      "    });"
+      "</script>"
+      "<body style='margin:0; padding:0;'>"
+      "<a href='./scope/' style='position:fixed; width:1px; height:1px;'></a>"
+      "</body>");
+
+  embedded_test_server()->ServeFilesFromDirectory(service_worker_dir_.path());
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  content::ServiceWorkerContext* sw_context =
+      content::BrowserContext::GetDefaultStoragePartition(browser()->profile())
+          ->GetServiceWorkerContext();
+
+  const base::string16 expected_title1 = base::ASCIIToUTF16("READY");
+  content::TitleWatcher title_watcher1(
+      browser()->tab_strip_model()->GetActiveWebContents(), expected_title1);
+  ui_test_utils::NavigateToURL(browser(),
+                               embedded_test_server()->GetURL("/test.html"));
+  EXPECT_EQ(expected_title1, title_watcher1.WaitAndGetTitle());
+
+  histogram_tester_.ExpectBucketCount("ServiceWorker.StartNewWorker.Status",
+                                      0 /* SERVICE_WORKER_OK */, 1);
+
+  sw_context->StopAllServiceWorkersForOrigin(
+      embedded_test_server()->base_url());
+
+  const base::string16 expected_title2 = base::ASCIIToUTF16("Done");
+  content::TitleWatcher title_watcher2(
+      browser()->tab_strip_model()->GetActiveWebContents(), expected_title2);
+
+  histogram_tester_.ExpectTotalCount(
+      "ServiceWorker.StartWorker.StatusByPurpose_NAVIGATION_HINT_LINK_MOUSE_"
+      "DOWN",
+      0);
+  content::SimulateMouseClickAt(
+      browser()->tab_strip_model()->GetActiveWebContents(), 0,
+      blink::WebMouseEvent::ButtonLeft, gfx::Point(0, 0));
+  EXPECT_EQ(expected_title2, title_watcher2.WaitAndGetTitle());
+
+  // The service worker must be started by a navigation hint.
+  histogram_tester_.ExpectBucketCount(
+      "ServiceWorker.StartWorker.StatusByPurpose_NAVIGATION_HINT_LINK_MOUSE_"
+      "DOWN",
+      0 /* SERVICE_WORKER_OK */, 1);
+}
+
 }  // namespace
diff --git a/chrome/browser/chromeos/extensions/file_manager/private_api_mount.cc b/chrome/browser/chromeos/extensions/file_manager/private_api_mount.cc
index 2943bbff..3da5dc9 100644
--- a/chrome/browser/chromeos/extensions/file_manager/private_api_mount.cc
+++ b/chrome/browser/chromeos/extensions/file_manager/private_api_mount.cc
@@ -163,8 +163,8 @@
   disk_mount_manager->MountPath(
       file_path.AsUTF8Unsafe(),
       base::FilePath(display_name.Extension()).AsUTF8Unsafe(),
-      display_name.AsUTF8Unsafe(),
-      chromeos::MOUNT_TYPE_ARCHIVE);
+      display_name.AsUTF8Unsafe(), chromeos::MOUNT_TYPE_ARCHIVE,
+      chromeos::MOUNT_ACCESS_MODE_READ_WRITE);
 }
 
 bool FileManagerPrivateRemoveMountFunction::RunAsync() {
diff --git a/chrome/browser/chromeos/file_manager/fake_disk_mount_manager.cc b/chrome/browser/chromeos/file_manager/fake_disk_mount_manager.cc
index a01759e..82fcf407 100644
--- a/chrome/browser/chromeos/file_manager/fake_disk_mount_manager.cc
+++ b/chrome/browser/chromeos/file_manager/fake_disk_mount_manager.cc
@@ -13,12 +13,13 @@
     const std::string& source_path,
     const std::string& source_format,
     const std::string& mount_label,
-    chromeos::MountType type)
+    chromeos::MountType type,
+    chromeos::MountAccessMode access_mode)
     : source_path(source_path),
       source_format(source_format),
       mount_label(mount_label),
-      type(type) {
-}
+      type(type),
+      access_mode(access_mode) {}
 
 FakeDiskMountManager::MountRequest::MountRequest(const MountRequest& other) =
     default;
@@ -75,9 +76,10 @@
 void FakeDiskMountManager::MountPath(const std::string& source_path,
                                      const std::string& source_format,
                                      const std::string& mount_label,
-                                     chromeos::MountType type) {
+                                     chromeos::MountType type,
+                                     chromeos::MountAccessMode access_mode) {
   mount_requests_.push_back(
-      MountRequest(source_path, source_format, mount_label, type));
+      MountRequest(source_path, source_format, mount_label, type, access_mode));
 
   const MountPointInfo mount_point(
       source_path,
diff --git a/chrome/browser/chromeos/file_manager/fake_disk_mount_manager.h b/chrome/browser/chromeos/file_manager/fake_disk_mount_manager.h
index 0439a86..0645f68 100644
--- a/chrome/browser/chromeos/file_manager/fake_disk_mount_manager.h
+++ b/chrome/browser/chromeos/file_manager/fake_disk_mount_manager.h
@@ -22,13 +22,15 @@
     MountRequest(const std::string& source_path,
                  const std::string& source_format,
                  const std::string& mount_label,
-                 chromeos::MountType type);
+                 chromeos::MountType type,
+                 chromeos::MountAccessMode access_mode);
     MountRequest(const MountRequest& other);
 
     std::string source_path;
     std::string source_format;
     std::string mount_label;
     chromeos::MountType type;
+    chromeos::MountAccessMode access_mode;
   };
 
   struct UnmountRequest {
@@ -62,7 +64,8 @@
   void MountPath(const std::string& source_path,
                  const std::string& source_format,
                  const std::string& mount_label,
-                 chromeos::MountType type) override;
+                 chromeos::MountType type,
+                 chromeos::MountAccessMode access_mode) override;
   void UnmountPath(const std::string& mount_path,
                    chromeos::UnmountOptions options,
                    const UnmountPathCallback& callback) override;
diff --git a/chrome/browser/chromeos/file_manager/volume_manager.cc b/chrome/browser/chromeos/file_manager/volume_manager.cc
index ab8f815..01991a06 100644
--- a/chrome/browser/chromeos/file_manager/volume_manager.cc
+++ b/chrome/browser/chromeos/file_manager/volume_manager.cc
@@ -135,6 +135,12 @@
   return name;
 }
 
+chromeos::MountAccessMode GetExternalStorageAccessMode(const Profile* profile) {
+  return profile->GetPrefs()->GetBoolean(prefs::kExternalStorageReadOnly)
+             ? chromeos::MOUNT_ACCESS_MODE_READ_ONLY
+             : chromeos::MOUNT_ACCESS_MODE_READ_WRITE;
+}
+
 }  // namespace
 
 Volume::Volume()
@@ -494,9 +500,10 @@
         // Initiate disk mount operation. MountPath auto-detects the filesystem
         // format if the second argument is empty. The third argument (mount
         // label) is not used in a disk mount operation.
-        disk_mount_manager_->MountPath(
-            disk->device_path(), std::string(), std::string(),
-            chromeos::MOUNT_TYPE_DEVICE);
+        disk_mount_manager_->MountPath(disk->device_path(), std::string(),
+                                       std::string(),
+                                       chromeos::MOUNT_TYPE_DEVICE,
+                                       GetExternalStorageAccessMode(profile_));
         mounting = true;
       }
 
@@ -609,9 +616,10 @@
         // MountPath auto-detects filesystem format if second argument is
         // empty. The third argument (mount label) is not used in a disk mount
         // operation.
-        disk_mount_manager_->MountPath(
-            device_path, std::string(), std::string(),
-            chromeos::MOUNT_TYPE_DEVICE);
+        disk_mount_manager_->MountPath(device_path, std::string(),
+                                       std::string(),
+                                       chromeos::MOUNT_TYPE_DEVICE,
+                                       GetExternalStorageAccessMode(profile_));
       }
 
       FOR_EACH_OBSERVER(
diff --git a/chrome/browser/chromeos/file_manager/volume_manager_unittest.cc b/chrome/browser/chromeos/file_manager/volume_manager_unittest.cc
index fd32587..1cfb161a 100644
--- a/chrome/browser/chromeos/file_manager/volume_manager_unittest.cc
+++ b/chrome/browser/chromeos/file_manager/volume_manager_unittest.cc
@@ -437,6 +437,33 @@
   EXPECT_EQ(1U, observer.events().size());
   EXPECT_EQ(1U, disk_mount_manager_->mount_requests().size());
   EXPECT_EQ(0U, disk_mount_manager_->unmount_requests().size());
+  // Read-write mode by default.
+  EXPECT_EQ(chromeos::MOUNT_ACCESS_MODE_READ_WRITE,
+            disk_mount_manager_->mount_requests()[0].access_mode);
+
+  volume_manager()->RemoveObserver(&observer);
+}
+
+TEST_F(VolumeManagerTest, OnDiskEvent_ChangedInReadonly) {
+  profile()->GetPrefs()->SetBoolean(prefs::kExternalStorageReadOnly, true);
+
+  // Changed event should cause mounting (if possible).
+  LoggingObserver observer;
+  volume_manager()->AddObserver(&observer);
+
+  const chromeos::disks::DiskMountManager::Disk kDisk(
+      "device1", "", "", "", "", "", "", "", "", "", "", "",
+      chromeos::DEVICE_TYPE_UNKNOWN, 0, false, false, true, false, false,
+      false);
+  volume_manager()->OnDiskEvent(chromeos::disks::DiskMountManager::DISK_CHANGED,
+                                &kDisk);
+
+  EXPECT_EQ(1U, observer.events().size());
+  EXPECT_EQ(1U, disk_mount_manager_->mount_requests().size());
+  EXPECT_EQ(0U, disk_mount_manager_->unmount_requests().size());
+  // Shoule mount a disk in read-only mode.
+  EXPECT_EQ(chromeos::MOUNT_ACCESS_MODE_READ_ONLY,
+            disk_mount_manager_->mount_requests()[0].access_mode);
 
   volume_manager()->RemoveObserver(&observer);
 }
@@ -524,8 +551,8 @@
           chromeos::DEVICE_TYPE_UNKNOWN, 0, false, false, false, false, false,
           false));
   disk_mount_manager_->AddDiskForTest(disk.release());
-  disk_mount_manager_->MountPath(
-      "device1", "", "", chromeos::MOUNT_TYPE_DEVICE);
+  disk_mount_manager_->MountPath("device1", "", "", chromeos::MOUNT_TYPE_DEVICE,
+                                 chromeos::MOUNT_ACCESS_MODE_READ_WRITE);
 
   const chromeos::disks::DiskMountManager::MountPointInfo kMountPoint(
       "device1",
@@ -674,10 +701,10 @@
 
 TEST_F(VolumeManagerTest, OnExternalStorageDisabledChanged) {
   // Here create two mount points.
-  disk_mount_manager_->MountPath(
-      "mount1", "", "", chromeos::MOUNT_TYPE_DEVICE);
-  disk_mount_manager_->MountPath(
-      "mount2", "", "", chromeos::MOUNT_TYPE_DEVICE);
+  disk_mount_manager_->MountPath("mount1", "", "", chromeos::MOUNT_TYPE_DEVICE,
+                                 chromeos::MOUNT_ACCESS_MODE_READ_WRITE);
+  disk_mount_manager_->MountPath("mount2", "", "", chromeos::MOUNT_TYPE_DEVICE,
+                                 chromeos::MOUNT_ACCESS_MODE_READ_ONLY);
 
   // Initially, there are two mount points.
   ASSERT_EQ(2U, disk_mount_manager_->mount_points().size());
diff --git a/chrome/browser/chromeos/login/kiosk_browsertest.cc b/chrome/browser/chromeos/login/kiosk_browsertest.cc
index 5f960f1..e0c229a 100644
--- a/chrome/browser/chromeos/login/kiosk_browsertest.cc
+++ b/chrome/browser/chromeos/login/kiosk_browsertest.cc
@@ -360,7 +360,8 @@
 
   void MountUsbStick() {
     DCHECK(!usb_mount_path_.empty());
-    MountPath(usb_mount_path_, "", "", chromeos::MOUNT_TYPE_DEVICE);
+    MountPath(usb_mount_path_, "", "", chromeos::MOUNT_TYPE_DEVICE,
+              chromeos::MOUNT_ACCESS_MODE_READ_ONLY);
   }
 
   void UnMountUsbStick() {
diff --git a/chrome/browser/chromeos/preferences.cc b/chrome/browser/chromeos/preferences.cc
index 62e9162..33bffeb 100644
--- a/chrome/browser/chromeos/preferences.cc
+++ b/chrome/browser/chromeos/preferences.cc
@@ -300,6 +300,8 @@
 
   registry->RegisterBooleanPref(prefs::kExternalStorageDisabled, false);
 
+  registry->RegisterBooleanPref(prefs::kExternalStorageReadOnly, false);
+
   registry->RegisterStringPref(prefs::kTermsOfServiceURL, "");
 
   registry->RegisterBooleanPref(prefs::kTouchHudProjectionEnabled, false);
diff --git a/chrome/browser/content_settings/content_settings_browsertest.cc b/chrome/browser/content_settings/content_settings_browsertest.cc
index f107c8fd..dc8aa11 100644
--- a/chrome/browser/content_settings/content_settings_browsertest.cc
+++ b/chrome/browser/content_settings/content_settings_browsertest.cc
@@ -24,6 +24,7 @@
 #include "components/content_settings/core/browser/cookie_settings.h"
 #include "components/content_settings/core/browser/host_content_settings_map.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/notification_observer.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/plugin_service.h"
@@ -32,13 +33,14 @@
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/common/mhtml_generation_params.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/test_utils.h"
 #include "media/cdm/cdm_paths.h"
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/test/url_request/url_request_mock_http_job.h"
-
+#include "testing/gmock/include/gmock/gmock.h"
 #include "widevine_cdm_version.h"  // In SHARED_INTERMEDIATE_DIR.
 
 #if defined(OS_MACOSX)
@@ -64,6 +66,20 @@
       &settings->allowed_local_shared_objects());
 }
 
+class MockWebContentsLoadFailObserver : public content::WebContentsObserver {
+ public:
+  explicit MockWebContentsLoadFailObserver(content::WebContents* web_contents)
+      : content::WebContentsObserver(web_contents) {}
+  virtual ~MockWebContentsLoadFailObserver() {}
+
+  MOCK_METHOD1(DidFinishNavigation,
+               void(content::NavigationHandle* navigation_handle));
+};
+
+MATCHER(IsErrorTooManyRedirects, "") {
+  return arg->GetNetErrorCode() == net::ERR_TOO_MANY_REDIRECTS;
+}
+
 }  // namespace
 
 class ContentSettingsTest : public InProcessBrowserTest {
@@ -236,12 +252,15 @@
   CookieSettingsFactory::GetForProfile(browser()->profile())
       ->SetDefaultCookieSetting(CONTENT_SETTING_BLOCK);
 
-  ui_test_utils::NavigateToURL(browser(), test_url);
-
   content::WebContents* web_contents =
       browser()->tab_strip_model()->GetActiveWebContents();
-  ASSERT_EQ(base::UTF8ToUTF16(test_url.spec() + " failed to load"),
-            web_contents->GetTitle());
+
+  MockWebContentsLoadFailObserver observer(web_contents);
+  EXPECT_CALL(observer, DidFinishNavigation(IsErrorTooManyRedirects()));
+
+  ui_test_utils::NavigateToURL(browser(), test_url);
+
+  ASSERT_TRUE(::testing::Mock::VerifyAndClearExpectations(&observer));
 
   EXPECT_TRUE(TabSpecificContentSettings::FromWebContents(web_contents)->
       IsContentBlocked(CONTENT_SETTINGS_TYPE_COOKIES));
diff --git a/chrome/browser/extensions/api/bookmark_manager_private/bookmark_manager_private_api.cc b/chrome/browser/extensions/api/bookmark_manager_private/bookmark_manager_private_api.cc
index 30e14d6c..089383e 100644
--- a/chrome/browser/extensions/api/bookmark_manager_private/bookmark_manager_private_api.cc
+++ b/chrome/browser/extensions/api/bookmark_manager_private/bookmark_manager_private_api.cc
@@ -158,7 +158,7 @@
 
   if (node_data.same_profile) {
     std::vector<const BookmarkNode*> nodes = data.GetNodes(
-        BookmarkModelFactory::GetForProfile(profile), profile_path);
+        BookmarkModelFactory::GetForBrowserContext(profile), profile_path);
     for (size_t i = 0; i < nodes.size(); ++i) {
       node_data.elements.push_back(
           CreateNodeDataElementFromBookmarkNode(*nodes[i]));
@@ -280,8 +280,7 @@
   EventRouter::Get(browser_context_)->UnregisterObserver(this);
   event_router_.reset(new BookmarkManagerPrivateEventRouter(
       browser_context_,
-      BookmarkModelFactory::GetForProfile(
-          Profile::FromBrowserContext(browser_context_))));
+      BookmarkModelFactory::GetForBrowserContext(browser_context_)));
 }
 
 BookmarkManagerPrivateDragEventRouter::BookmarkManagerPrivateDragEventRouter(
@@ -400,7 +399,8 @@
 
   std::unique_ptr<Paste::Params> params(Paste::Params::Create(*args_));
   EXTENSION_FUNCTION_VALIDATE(params);
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(GetProfile());
+  BookmarkModel* model =
+      BookmarkModelFactory::GetForBrowserContext(GetProfile());
   const BookmarkNode* parent_node = GetNodeFromString(model, params->parent_id);
   if (!CanBeModified(parent_node))
     return false;
@@ -435,7 +435,8 @@
     return true;
   }
 
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(GetProfile());
+  BookmarkModel* model =
+      BookmarkModelFactory::GetForBrowserContext(GetProfile());
   const BookmarkNode* parent_node = GetNodeFromString(model, params->parent_id);
   if (!parent_node) {
     error_ = bookmark_keys::kNoParentError;
@@ -454,7 +455,8 @@
       SortChildren::Params::Create(*args_));
   EXTENSION_FUNCTION_VALIDATE(params);
 
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(GetProfile());
+  BookmarkModel* model =
+      BookmarkModelFactory::GetForBrowserContext(GetProfile());
   const BookmarkNode* parent_node = GetNodeFromString(model, params->parent_id);
   if (!CanBeModified(parent_node))
     return false;
@@ -552,7 +554,8 @@
   std::unique_ptr<StartDrag::Params> params(StartDrag::Params::Create(*args_));
   EXTENSION_FUNCTION_VALIDATE(params);
 
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(GetProfile());
+  BookmarkModel* model =
+      BookmarkModelFactory::GetForBrowserContext(GetProfile());
   std::vector<const BookmarkNode*> nodes;
   EXTENSION_FUNCTION_VALIDATE(
       GetNodesFromVector(model, params->id_list, &nodes));
@@ -578,7 +581,8 @@
   std::unique_ptr<Drop::Params> params(Drop::Params::Create(*args_));
   EXTENSION_FUNCTION_VALIDATE(params);
 
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(GetProfile());
+  BookmarkModel* model =
+      BookmarkModelFactory::GetForBrowserContext(GetProfile());
 
   const BookmarkNode* drop_parent = GetNodeFromString(model, params->parent_id);
   if (!CanBeModified(drop_parent))
@@ -625,7 +629,8 @@
   const BookmarkNode* node = NULL;
 
   if (params->id.empty()) {
-    BookmarkModel* model = BookmarkModelFactory::GetForProfile(GetProfile());
+    BookmarkModel* model =
+        BookmarkModelFactory::GetForBrowserContext(GetProfile());
     node = model->root_node();
   } else {
     node = GetBookmarkNodeFromId(params->id);
@@ -663,7 +668,8 @@
       CreateWithMetaInfo::Params::Create(*args_));
   EXTENSION_FUNCTION_VALIDATE(params);
 
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(GetProfile());
+  BookmarkModel* model =
+      BookmarkModelFactory::GetForBrowserContext(GetProfile());
   const BookmarkNode* node = CreateBookmarkNode(
       model, params->bookmark, &params->meta_info.additional_properties);
   if (!node)
@@ -714,7 +720,8 @@
       return true;
     }
 
-    BookmarkModel* model = BookmarkModelFactory::GetForProfile(GetProfile());
+    BookmarkModel* model =
+        BookmarkModelFactory::GetForBrowserContext(GetProfile());
     const BookmarkNode* node = model->root_node();
 
     GetMetaInfo::Results::Value result;
@@ -744,7 +751,8 @@
   if (!CanBeModified(node))
     return false;
 
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(GetProfile());
+  BookmarkModel* model =
+      BookmarkModelFactory::GetForBrowserContext(GetProfile());
   if (model->is_permanent_node(node)) {
     error_ = bookmark_keys::kModifySpecialError;
     return false;
@@ -769,7 +777,8 @@
   if (!CanBeModified(node))
     return false;
 
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(GetProfile());
+  BookmarkModel* model =
+      BookmarkModelFactory::GetForBrowserContext(GetProfile());
   if (model->is_permanent_node(node)) {
     error_ = bookmark_keys::kModifySpecialError;
     return false;
diff --git a/chrome/browser/extensions/api/bookmark_manager_private/bookmark_manager_private_apitest.cc b/chrome/browser/extensions/api/bookmark_manager_private/bookmark_manager_private_apitest.cc
index 1ec66b72..c64ba831 100644
--- a/chrome/browser/extensions/api/bookmark_manager_private/bookmark_manager_private_apitest.cc
+++ b/chrome/browser/extensions/api/bookmark_manager_private/bookmark_manager_private_apitest.cc
@@ -35,7 +35,7 @@
 IN_PROC_BROWSER_TEST_F(ExtensionApiTest, MAYBE_BookmarkManager) {
   // Add managed bookmarks.
   Profile* profile = browser()->profile();
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile);
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile);
   bookmarks::ManagedBookmarkService* managed =
       ManagedBookmarkServiceFactory::GetForProfile(profile);
   bookmarks::test::WaitForBookmarkModelToLoad(model);
@@ -61,7 +61,7 @@
 
   // Provide some testing data here, since bookmark editing will be disabled
   // within the extension.
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile);
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile);
   bookmarks::test::WaitForBookmarkModelToLoad(model);
   const BookmarkNode* bar = model->bookmark_bar_node();
   const BookmarkNode* folder =
diff --git a/chrome/browser/extensions/api/bookmarks/bookmark_api_helpers_unittest.cc b/chrome/browser/extensions/api/bookmarks/bookmark_api_helpers_unittest.cc
index 392b95e..82aa4deb 100644
--- a/chrome/browser/extensions/api/bookmarks/bookmark_api_helpers_unittest.cc
+++ b/chrome/browser/extensions/api/bookmarks/bookmark_api_helpers_unittest.cc
@@ -43,7 +43,7 @@
 
   void SetUp() override {
     profile_.CreateBookmarkModel(false);
-    model_ = BookmarkModelFactory::GetForProfile(&profile_);
+    model_ = BookmarkModelFactory::GetForBrowserContext(&profile_);
     managed_ = ManagedBookmarkServiceFactory::GetForProfile(&profile_);
     bookmarks::test::WaitForBookmarkModelToLoad(model_);
 
diff --git a/chrome/browser/extensions/api/bookmarks/bookmark_apitest.cc b/chrome/browser/extensions/api/bookmarks/bookmark_apitest.cc
index 39fd914..75fe9438 100644
--- a/chrome/browser/extensions/api/bookmarks/bookmark_apitest.cc
+++ b/chrome/browser/extensions/api/bookmarks/bookmark_apitest.cc
@@ -31,7 +31,7 @@
   // Add test managed and supervised bookmarks to verify that the bookmarks API
   // can read them and can't modify them.
   Profile* profile = browser()->profile();
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile);
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile);
   bookmarks::ManagedBookmarkService* managed =
       ManagedBookmarkServiceFactory::GetForProfile(profile);
   bookmarks::test::WaitForBookmarkModelToLoad(model);
diff --git a/chrome/browser/extensions/api/bookmarks/bookmarks_api.cc b/chrome/browser/extensions/api/bookmarks/bookmarks_api.cc
index 686b5acd..a4fdd28 100644
--- a/chrome/browser/extensions/api/bookmarks/bookmarks_api.cc
+++ b/chrome/browser/extensions/api/bookmarks/bookmarks_api.cc
@@ -96,7 +96,8 @@
 }  // namespace
 
 bool BookmarksFunction::RunAsync() {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(GetProfile());
+  BookmarkModel* model =
+      BookmarkModelFactory::GetForBrowserContext(GetProfile());
   if (!model->loaded()) {
     // Bookmarks are not ready yet.  We'll wait.
     model->AddObserver(this);
@@ -109,7 +110,7 @@
 }
 
 BookmarkModel* BookmarksFunction::GetBookmarkModel() {
-  return BookmarkModelFactory::GetForProfile(GetProfile());
+  return BookmarkModelFactory::GetForBrowserContext(GetProfile());
 }
 
 ManagedBookmarkService* BookmarksFunction::GetManagedBookmarkService() {
@@ -132,7 +133,7 @@
     return NULL;
 
   const BookmarkNode* node = ::bookmarks::GetBookmarkNodeByID(
-      BookmarkModelFactory::GetForProfile(GetProfile()), id);
+      BookmarkModelFactory::GetForBrowserContext(GetProfile()), id);
   if (!node)
     error_ = keys::kNoNodeError;
 
@@ -245,7 +246,7 @@
 
 BookmarkEventRouter::BookmarkEventRouter(Profile* profile)
     : browser_context_(profile),
-      model_(BookmarkModelFactory::GetForProfile(profile)),
+      model_(BookmarkModelFactory::GetForBrowserContext(profile)),
       managed_(ManagedBookmarkServiceFactory::GetForProfile(profile)) {
   model_->AddObserver(this);
 }
@@ -476,9 +477,8 @@
 
   std::vector<const BookmarkNode*> nodes;
   ::bookmarks::GetMostRecentlyAddedEntries(
-      BookmarkModelFactory::GetForProfile(GetProfile()),
-      params->number_of_items,
-      &nodes);
+      BookmarkModelFactory::GetForBrowserContext(GetProfile()),
+      params->number_of_items, &nodes);
 
   std::vector<BookmarkTreeNode> tree_nodes;
   for (const BookmarkNode* node : nodes) {
@@ -493,7 +493,7 @@
 bool BookmarksGetTreeFunction::RunOnReady() {
   std::vector<BookmarkTreeNode> nodes;
   const BookmarkNode* node =
-      BookmarkModelFactory::GetForProfile(GetProfile())->root_node();
+      BookmarkModelFactory::GetForBrowserContext(GetProfile())->root_node();
   bookmark_api_helpers::AddNode(GetManagedBookmarkService(), node, &nodes,
                                 true);
   results_ = bookmarks::GetTree::Results::Create(nodes);
@@ -527,10 +527,8 @@
     query.word_phrase_query.reset(
         new base::string16(base::UTF8ToUTF16(*params->query.as_string)));
     ::bookmarks::GetBookmarksMatchingProperties(
-        BookmarkModelFactory::GetForProfile(GetProfile()),
-        query,
-        std::numeric_limits<int>::max(),
-        &nodes);
+        BookmarkModelFactory::GetForBrowserContext(GetProfile()), query,
+        std::numeric_limits<int>::max(), &nodes);
   } else {
     DCHECK(params->query.as_object);
     const bookmarks::Search::Params::Query::Object& object =
@@ -545,10 +543,8 @@
     if (object.title)
       query.title.reset(new base::string16(base::UTF8ToUTF16(*object.title)));
     ::bookmarks::GetBookmarksMatchingProperties(
-        BookmarkModelFactory::GetForProfile(GetProfile()),
-        query,
-        std::numeric_limits<int>::max(),
-        &nodes);
+        BookmarkModelFactory::GetForBrowserContext(GetProfile()), query,
+        std::numeric_limits<int>::max(), &nodes);
   }
 
   std::vector<BookmarkTreeNode> tree_nodes;
@@ -607,7 +603,8 @@
       bookmarks::Create::Params::Create(*args_));
   EXTENSION_FUNCTION_VALIDATE(params.get());
 
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(GetProfile());
+  BookmarkModel* model =
+      BookmarkModelFactory::GetForBrowserContext(GetProfile());
   const BookmarkNode* node = CreateBookmarkNode(model, params->bookmark, NULL);
   if (!node)
     return false;
@@ -639,7 +636,8 @@
   if (!node)
     return false;
 
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(GetProfile());
+  BookmarkModel* model =
+      BookmarkModelFactory::GetForBrowserContext(GetProfile());
   if (model->is_permanent_node(node)) {
     error_ = keys::kModifySpecialError;
     return false;
@@ -717,7 +715,8 @@
   if (!CanBeModified(node))
     return false;
 
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(GetProfile());
+  BookmarkModel* model =
+      BookmarkModelFactory::GetForBrowserContext(GetProfile());
   if (model->is_permanent_node(node)) {
     error_ = keys::kModifySpecialError;
     return false;
diff --git a/chrome/browser/extensions/api/declarative_content/declarative_content_apitest.cc b/chrome/browser/extensions/api/declarative_content/declarative_content_apitest.cc
index 25f94ac5..1897544 100644
--- a/chrome/browser/extensions/api/declarative_content/declarative_content_apitest.cc
+++ b/chrome/browser/extensions/api/declarative_content/declarative_content_apitest.cc
@@ -230,7 +230,7 @@
 
   // Check rule evaluation on add/remove bookmark.
   bookmarks::BookmarkModel* bookmark_model =
-      BookmarkModelFactory::GetForProfile(browser()->profile());
+      BookmarkModelFactory::GetForBrowserContext(browser()->profile());
   const bookmarks::BookmarkNode* node =
       bookmark_model->AddURL(bookmark_model->other_node(), 0,
                              base::ASCIIToUTF16("title"),
diff --git a/chrome/browser/extensions/api/declarative_content/declarative_content_is_bookmarked_condition_tracker.cc b/chrome/browser/extensions/api/declarative_content/declarative_content_is_bookmarked_condition_tracker.cc
index ac22f8d7..879edc8 100644
--- a/chrome/browser/extensions/api/declarative_content/declarative_content_is_bookmarked_condition_tracker.cc
+++ b/chrome/browser/extensions/api/declarative_content/declarative_content_is_bookmarked_condition_tracker.cc
@@ -11,7 +11,6 @@
 #include "base/values.h"
 #include "chrome/browser/bookmarks/bookmark_model_factory.h"
 #include "chrome/browser/extensions/api/declarative_content/content_constants.h"
-#include "chrome/browser/profiles/profile.h"
 #include "components/bookmarks/browser/bookmark_model.h"
 #include "content/public/browser/web_contents.h"
 #include "extensions/common/permissions/permissions_data.h"
@@ -130,8 +129,8 @@
 bool DeclarativeContentIsBookmarkedConditionTracker::PerWebContentsTracker::
 IsCurrentUrlBookmarked() {
   bookmarks::BookmarkModel* bookmark_model =
-      BookmarkModelFactory::GetForProfile(
-          Profile::FromBrowserContext(web_contents()->GetBrowserContext()));
+      BookmarkModelFactory::GetForBrowserContext(
+          web_contents()->GetBrowserContext());
   // BookmarkModel can be null during unit test execution.
   return bookmark_model &&
       bookmark_model->IsBookmarked(web_contents()->GetVisibleURL());
@@ -153,7 +152,7 @@
       extensive_bookmark_changes_in_progress_(0),
       scoped_bookmarks_observer_(this) {
   bookmarks::BookmarkModel* bookmark_model =
-      BookmarkModelFactory::GetForProfile(Profile::FromBrowserContext(context));
+      BookmarkModelFactory::GetForBrowserContext(context);
   // Can be null during unit test execution.
   if (bookmark_model)
     scoped_bookmarks_observer_.Add(bookmark_model);
diff --git a/chrome/browser/extensions/api/declarative_content/declarative_content_is_bookmarked_condition_tracker_unittest.cc b/chrome/browser/extensions/api/declarative_content/declarative_content_is_bookmarked_condition_tracker_unittest.cc
index 69eabb1..ae3295e8 100644
--- a/chrome/browser/extensions/api/declarative_content/declarative_content_is_bookmarked_condition_tracker_unittest.cc
+++ b/chrome/browser/extensions/api/declarative_content/declarative_content_is_bookmarked_condition_tracker_unittest.cc
@@ -100,8 +100,8 @@
   DeclarativeContentIsBookmarkedConditionTrackerTest() {
     profile()->CreateBookmarkModel(true);
     bookmarks::test::WaitForBookmarkModelToLoad(
-        BookmarkModelFactory::GetForProfile(profile()));
-    bookmark_model_ = BookmarkModelFactory::GetForProfile(profile());
+        BookmarkModelFactory::GetForBrowserContext(profile()));
+    bookmark_model_ = BookmarkModelFactory::GetForBrowserContext(profile());
     tracker_.reset(new DeclarativeContentIsBookmarkedConditionTracker(
         profile(),
         &delegate_));
diff --git a/chrome/browser/extensions/lazy_background_page_apitest.cc b/chrome/browser/extensions/lazy_background_page_apitest.cc
index 26383374..22f04e0 100644
--- a/chrome/browser/extensions/lazy_background_page_apitest.cc
+++ b/chrome/browser/extensions/lazy_background_page_apitest.cc
@@ -464,7 +464,7 @@
     LazyBackgroundObserver page_complete(browser()->profile()),
                            page2_complete(incognito_browser->profile());
     BookmarkModel* bookmark_model =
-        BookmarkModelFactory::GetForProfile(browser()->profile());
+        BookmarkModelFactory::GetForBrowserContext(browser()->profile());
     bookmarks::test::WaitForBookmarkModelToLoad(bookmark_model);
     const BookmarkNode* parent = bookmark_model->bookmark_bar_node();
     bookmark_model->AddURL(
@@ -580,7 +580,7 @@
 
   // Send an event by making a bookmark.
   BookmarkModel* bookmark_model =
-      BookmarkModelFactory::GetForProfile(browser()->profile());
+      BookmarkModelFactory::GetForBrowserContext(browser()->profile());
   bookmarks::test::WaitForBookmarkModelToLoad(bookmark_model);
   bookmarks::AddIfNotBookmarked(bookmark_model,
                                 GURL("http://www.google.com"),
diff --git a/chrome/browser/favicon/favicon_utils.cc b/chrome/browser/favicon/favicon_utils.cc
index fc8cd05..a662aeb 100644
--- a/chrome/browser/favicon/favicon_utils.cc
+++ b/chrome/browser/favicon/favicon_utils.cc
@@ -28,7 +28,7 @@
                         original_profile, ServiceAccessType::IMPLICIT_ACCESS),
       HistoryServiceFactory::GetForProfile(original_profile,
                                            ServiceAccessType::IMPLICIT_ACCESS),
-      BookmarkModelFactory::GetForProfileIfExists(original_profile));
+      BookmarkModelFactory::GetForBrowserContextIfExists(original_profile));
 }
 
 bool ShouldDisplayFavicon(content::WebContents* web_contents) {
diff --git a/chrome/browser/history/android/android_history_provider_service_unittest.cc b/chrome/browser/history/android/android_history_provider_service_unittest.cc
index c03ec13..000ffc442 100644
--- a/chrome/browser/history/android/android_history_provider_service_unittest.cc
+++ b/chrome/browser/history/android/android_history_provider_service_unittest.cc
@@ -58,7 +58,7 @@
 
     testing_profile_->CreateBookmarkModel(true);
     bookmarks::test::WaitForBookmarkModelToLoad(
-        BookmarkModelFactory::GetForProfile(testing_profile_));
+        BookmarkModelFactory::GetForBrowserContext(testing_profile_));
     ASSERT_TRUE(testing_profile_->CreateHistoryService(true, false));
     service_.reset(new AndroidHistoryProviderService(testing_profile_));
   }
@@ -66,7 +66,7 @@
   void TearDown() override {
     testing_profile_->DestroyHistoryService();
     profile_manager_.DeleteTestingProfile(chrome::kInitialProfile);
-    testing_profile_=NULL;
+    testing_profile_ = nullptr;
   }
 
  protected:
@@ -85,11 +85,7 @@
 class CallbackHelper : public base::RefCountedThreadSafe<CallbackHelper> {
  public:
   CallbackHelper()
-      : success_(false),
-        statement_(NULL),
-        cursor_position_(0),
-        count_(0) {
-  }
+      : success_(false), statement_(nullptr), cursor_position_(0), count_(0) {}
 
   bool success() const {
     return success_;
@@ -113,7 +109,7 @@
   }
 
   void OnQueryResult(AndroidStatement* statement) {
-    success_ = statement != NULL;
+    success_ = statement != nullptr;
     statement_ = statement;
     base::MessageLoop::current()->QuitWhenIdle();
   }
diff --git a/chrome/browser/history/android/android_provider_backend_unittest.cc b/chrome/browser/history/android/android_provider_backend_unittest.cc
index c00d7c3..00d38f0f 100644
--- a/chrome/browser/history/android/android_provider_backend_unittest.cc
+++ b/chrome/browser/history/android/android_provider_backend_unittest.cc
@@ -186,7 +186,8 @@
     TestingProfile* testing_profile = profile_manager_.CreateTestingProfile(
         chrome::kInitialProfile);
     testing_profile->CreateBookmarkModel(true);
-    bookmark_model_ = BookmarkModelFactory::GetForProfile(testing_profile);
+    bookmark_model_ =
+        BookmarkModelFactory::GetForBrowserContext(testing_profile);
     history_client_.reset(new ChromeHistoryClient(bookmark_model_));
     history_backend_client_ = history_client_->CreateBackendClient();
     bookmarks::test::WaitForBookmarkModelToLoad(bookmark_model_);
diff --git a/chrome/browser/history/android/bookmark_model_sql_handler.cc b/chrome/browser/history/android/bookmark_model_sql_handler.cc
index 37537434..3eba981 100644
--- a/chrome/browser/history/android/bookmark_model_sql_handler.cc
+++ b/chrome/browser/history/android/bookmark_model_sql_handler.cc
@@ -88,7 +88,7 @@
   Profile* profile = ProfileManager::GetLastUsedProfile();
   if (!profile)
     return NULL;
-  return BookmarkModelFactory::GetForProfile(profile);
+  return BookmarkModelFactory::GetForBrowserContext(profile);
 }
 
 BookmarkModelSQLHandler::BookmarkModelSQLHandler(
diff --git a/chrome/browser/history/android/bookmark_model_sql_handler_unittest.cc b/chrome/browser/history/android/bookmark_model_sql_handler_unittest.cc
index 529f982..52d6cca 100644
--- a/chrome/browser/history/android/bookmark_model_sql_handler_unittest.cc
+++ b/chrome/browser/history/android/bookmark_model_sql_handler_unittest.cc
@@ -48,7 +48,8 @@
         chrome::kInitialProfile);
     // Create the BookmarkModel that doesn't need to invoke load().
     testing_profile->CreateBookmarkModel(true);
-    bookmark_model_ = BookmarkModelFactory::GetForProfile(testing_profile);
+    bookmark_model_ =
+        BookmarkModelFactory::GetForBrowserContext(testing_profile);
     bookmarks::test::WaitForBookmarkModelToLoad(bookmark_model_);
     ASSERT_TRUE(bookmark_model_);
     // Get the BookmarkModel from LastUsedProfile, this is the same way that
diff --git a/chrome/browser/history/android/sqlite_cursor_unittest.cc b/chrome/browser/history/android/sqlite_cursor_unittest.cc
index fbcb8d9..082653a 100644
--- a/chrome/browser/history/android/sqlite_cursor_unittest.cc
+++ b/chrome/browser/history/android/sqlite_cursor_unittest.cc
@@ -64,7 +64,7 @@
 
     testing_profile_->CreateBookmarkModel(true);
     bookmarks::test::WaitForBookmarkModelToLoad(
-        BookmarkModelFactory::GetForProfile(testing_profile_));
+        BookmarkModelFactory::GetForBrowserContext(testing_profile_));
 
     testing_profile_->CreateFaviconService();
     ASSERT_TRUE(testing_profile_->CreateHistoryService(true, false));
diff --git a/chrome/browser/history/history_service_factory.cc b/chrome/browser/history/history_service_factory.cc
index 30f9f3e..ae573881 100644
--- a/chrome/browser/history/history_service_factory.cc
+++ b/chrome/browser/history/history_service_factory.cc
@@ -77,14 +77,13 @@
 
 KeyedService* HistoryServiceFactory::BuildServiceInstanceFor(
     content::BrowserContext* context) const {
-  Profile* profile = Profile::FromBrowserContext(context);
   std::unique_ptr<history::HistoryService> history_service(
       new history::HistoryService(
           base::WrapUnique(new ChromeHistoryClient(
-              BookmarkModelFactory::GetForProfile(profile))),
-          base::WrapUnique(new history::ContentVisitDelegate(profile))));
+              BookmarkModelFactory::GetForBrowserContext(context))),
+          base::WrapUnique(new history::ContentVisitDelegate(context))));
   if (!history_service->Init(
-          history::HistoryDatabaseParamsForPath(profile->GetPath()))) {
+          history::HistoryDatabaseParamsForPath(context->GetPath()))) {
     return nullptr;
   }
   return history_service.release();
diff --git a/chrome/browser/importer/external_process_importer_host.cc b/chrome/browser/importer/external_process_importer_host.cc
index 6552f7f..9f68e8a 100644
--- a/chrome/browser/importer/external_process_importer_host.cc
+++ b/chrome/browser/importer/external_process_importer_host.cc
@@ -12,6 +12,7 @@
 #include "chrome/browser/importer/importer_lock_dialog.h"
 #include "chrome/browser/importer/importer_progress_observer.h"
 #include "chrome/browser/importer/in_process_importer_bridge.h"
+#include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/search_engines/template_url_service_factory.h"
 #include "components/bookmarks/browser/bookmark_model.h"
 #include "components/search_engines/template_url_service.h"
@@ -94,7 +95,7 @@
 ExternalProcessImporterHost::~ExternalProcessImporterHost() {
   if (installed_bookmark_observer_) {
     DCHECK(profile_);
-    BookmarkModelFactory::GetForProfile(profile_)->RemoveObserver(this);
+    BookmarkModelFactory::GetForBrowserContext(profile_)->RemoveObserver(this);
   }
 }
 
@@ -192,7 +193,7 @@
   // BookmarkModel should be loaded before adding IE favorites. So we observe
   // the BookmarkModel if needed, and start the task after it has been loaded.
   if ((items & importer::FAVORITES) && !writer_->BookmarkModelIsLoaded()) {
-    BookmarkModelFactory::GetForProfile(profile_)->AddObserver(this);
+    BookmarkModelFactory::GetForBrowserContext(profile_)->AddObserver(this);
     waiting_for_bookmarkbar_model_ = true;
     installed_bookmark_observer_ = true;
   }
diff --git a/chrome/browser/importer/profile_writer.cc b/chrome/browser/importer/profile_writer.cc
index 9e817ecb..642bbf3 100644
--- a/chrome/browser/importer/profile_writer.cc
+++ b/chrome/browser/importer/profile_writer.cc
@@ -84,7 +84,7 @@
 ProfileWriter::ProfileWriter(Profile* profile) : profile_(profile) {}
 
 bool ProfileWriter::BookmarkModelIsLoaded() const {
-  return BookmarkModelFactory::GetForProfile(profile_)->loaded();
+  return BookmarkModelFactory::GetForBrowserContext(profile_)->loaded();
 }
 
 bool ProfileWriter::TemplateURLServiceIsLoaded() const {
@@ -127,7 +127,7 @@
   if (bookmarks.empty())
     return;
 
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile_);
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile_);
   DCHECK(model->loaded());
 
   // If the bookmark bar is currently empty, we should import directly to it.
diff --git a/chrome/browser/importer/profile_writer_unittest.cc b/chrome/browser/importer/profile_writer_unittest.cc
index 8bfc115..dbed3192 100644
--- a/chrome/browser/importer/profile_writer_unittest.cc
+++ b/chrome/browser/importer/profile_writer_unittest.cc
@@ -138,7 +138,7 @@
   profile2.CreateBookmarkModel(true);
 
   BookmarkModel* bookmark_model2 =
-      BookmarkModelFactory::GetForProfile(&profile2);
+      BookmarkModelFactory::GetForBrowserContext(&profile2);
   bookmarks::test::WaitForBookmarkModelToLoad(bookmark_model2);
   bookmarks::AddIfNotBookmarked(
       bookmark_model2, GURL("http://www.bing.com"), base::ASCIIToUTF16("Bing"));
@@ -147,7 +147,7 @@
 
   CreateImportedBookmarksEntries();
   BookmarkModel* bookmark_model1 =
-      BookmarkModelFactory::GetForProfile(&profile1);
+      BookmarkModelFactory::GetForBrowserContext(&profile1);
   bookmarks::test::WaitForBookmarkModelToLoad(bookmark_model1);
 
   scoped_refptr<TestProfileWriter> profile_writer(
@@ -171,7 +171,7 @@
 
   CreateImportedBookmarksEntries();
   BookmarkModel* bookmark_model =
-      BookmarkModelFactory::GetForProfile(&profile);
+      BookmarkModelFactory::GetForBrowserContext(&profile);
   bookmarks::test::WaitForBookmarkModelToLoad(bookmark_model);
 
   scoped_refptr<TestProfileWriter> profile_writer(
diff --git a/chrome/browser/ntp_snippets/content_suggestions_service_factory.cc b/chrome/browser/ntp_snippets/content_suggestions_service_factory.cc
index 0dc8e0a..942343b 100644
--- a/chrome/browser/ntp_snippets/content_suggestions_service_factory.cc
+++ b/chrome/browser/ntp_snippets/content_suggestions_service_factory.cc
@@ -127,9 +127,8 @@
   // Create the BookmarkSuggestionsProvider.
   if (base::FeatureList::IsEnabled(
           ntp_snippets::kBookmarkSuggestionsFeature)) {
-    // TODO(pke): GetForBrowserContext
     BookmarkModel* bookmark_model =
-        BookmarkModelFactory::GetForProfile(profile);
+        BookmarkModelFactory::GetForBrowserContext(profile);
     std::unique_ptr<BookmarkSuggestionsProvider> bookmark_suggestions_provider =
         base::MakeUnique<BookmarkSuggestionsProvider>(
             service, service->category_factory(), bookmark_model);
diff --git a/chrome/browser/profiles/profile_impl.cc b/chrome/browser/profiles/profile_impl.cc
index e9f2bd287..5e842004 100644
--- a/chrome/browser/profiles/profile_impl.cc
+++ b/chrome/browser/profiles/profile_impl.cc
@@ -660,7 +660,7 @@
 #if !defined(OS_CHROMEOS)
   // Listen for bookmark model load, to bootstrap the sync service.
   // On CrOS sync service will be initialized after sign in.
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(this);
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(this);
   model->AddObserver(new BookmarkModelLoadedObserver(this));
 #endif
 
diff --git a/chrome/browser/profiles/profile_manager_unittest.cc b/chrome/browser/profiles/profile_manager_unittest.cc
index b3423f4..29375a7e 100644
--- a/chrome/browser/profiles/profile_manager_unittest.cc
+++ b/chrome/browser/profiles/profile_manager_unittest.cc
@@ -300,9 +300,9 @@
   EXPECT_TRUE(HistoryServiceFactory::GetForProfile(
       profile1, ServiceAccessType::EXPLICIT_ACCESS));
   profile1->CreateBookmarkModel(true);
-  EXPECT_TRUE(BookmarkModelFactory::GetForProfile(profile1));
+  EXPECT_TRUE(BookmarkModelFactory::GetForBrowserContext(profile1));
   profile2->CreateBookmarkModel(true);
-  EXPECT_TRUE(BookmarkModelFactory::GetForProfile(profile2));
+  EXPECT_TRUE(BookmarkModelFactory::GetForBrowserContext(profile2));
   ASSERT_TRUE(profile2->CreateHistoryService(true, false));
   EXPECT_TRUE(HistoryServiceFactory::GetForProfile(
       profile2, ServiceAccessType::EXPLICIT_ACCESS));
diff --git a/chrome/browser/profiles/profile_statistics_aggregator.cc b/chrome/browser/profiles/profile_statistics_aggregator.cc
index 303be356..4b6d693e 100644
--- a/chrome/browser/profiles/profile_statistics_aggregator.cc
+++ b/chrome/browser/profiles/profile_statistics_aggregator.cc
@@ -191,7 +191,7 @@
     return;
 
   bookmarks::BookmarkModel* bookmark_model =
-      BookmarkModelFactory::GetForProfileIfExists(profile_);
+      BookmarkModelFactory::GetForBrowserContextIfExists(profile_);
 
   if (bookmark_model) {
     if (bookmark_model->loaded()) {
diff --git a/chrome/browser/resources/md_history/browser_service.js b/chrome/browser/resources/md_history/browser_service.js
index d4c4579..952a506 100644
--- a/chrome/browser/resources/md_history/browser_service.js
+++ b/chrome/browser/resources/md_history/browser_service.js
@@ -69,6 +69,13 @@
       ]);
     },
 
+    /**
+     * @param {string} sessionTag
+     */
+    deleteForeignSession: function(sessionTag) {
+      chrome.send('deleteForeignSession', [sessionTag]);
+    },
+
     openClearBrowsingData: function() {
       chrome.send('clearBrowsingData');
     },
diff --git a/chrome/browser/resources/md_history/compiled_resources2.gyp b/chrome/browser/resources/md_history/compiled_resources2.gyp
index 9be96f4e..c363db9 100644
--- a/chrome/browser/resources/md_history/compiled_resources2.gyp
+++ b/chrome/browser/resources/md_history/compiled_resources2.gyp
@@ -125,6 +125,8 @@
     {
       'target_name': 'synced_device_manager',
       'dependencies': [
+        '<(DEPTH)/ui/webui/resources/cr_elements/cr_shared_menu/compiled_resources2.gyp:cr_shared_menu',
+        'browser_service',
         'synced_device_card',
       ],
       'includes': ['../../../../third_party/closure_compiler/compile_js2.gypi'],
diff --git a/chrome/browser/resources/md_history/grouped_list.html b/chrome/browser/resources/md_history/grouped_list.html
index cf1c109..b1f2a6b 100644
--- a/chrome/browser/resources/md_history/grouped_list.html
+++ b/chrome/browser/resources/md_history/grouped_list.html
@@ -96,7 +96,6 @@
                   <template is="dom-repeat" items="[[domain.visits]]"
                       as="item" initial-count="5" index-as="itemIndex">
                     <history-item item="[[item]]"
-                        starred="[[item.starred]]"
                         selected="{{item.selected}}"
                         has-time-gap="[[needsTimeGap_(
                             groupIndex, domainIndex, itemIndex)]]"
diff --git a/chrome/browser/resources/md_history/history_item.html b/chrome/browser/resources/md_history/history_item.html
index 44bb6c6..28de141 100644
--- a/chrome/browser/resources/md_history/history_item.html
+++ b/chrome/browser/resources/md_history/history_item.html
@@ -104,12 +104,15 @@
         -webkit-margin-end: 12px;
       }
 
-      #bookmark-star {
+      #star-container {
         -webkit-margin-end: 4px;
         -webkit-margin-start: 12px;
+        width: 32px;
+      }
+
+      #bookmark-star {
         color: rgb(68, 136, 255);
         height: 32px;
-        visibility: hidden;
         width: 32px;
       }
 
@@ -118,10 +121,6 @@
         width: 16px;
       }
 
-      :host([starred]) #bookmark-star {
-        visibility: visible;
-      }
-
       #time-gap-separator {
         -webkit-border-start: 1px solid #888;
         -webkit-margin-start: 77px;
@@ -147,19 +146,21 @@
             </a>
             <span id="domain">[[item.domain]]</span>
           </div>
-          <button is="paper-icon-button-light" id="bookmark-star"
-              title="$i18n{removeBookmark}" on-tap="onRemoveBookmarkTap_">
-            <iron-icon icon="cr:star"></iron-icon>
-          </button>
+          <div id="star-container">
+            <template is="dom-if" if="[[item.starred]]">
+              <button is="paper-icon-button-light" id="bookmark-star"
+                  title="$i18n{removeBookmark}" on-tap="onRemoveBookmarkTap_">
+                <iron-icon icon="cr:star"></iron-icon>
+              </button>
+            </template>
+          </div>
           <button is="paper-icon-button-light" id="menu-button"
               class="icon-button" title="$i18n{moreActionsButton}"
               on-tap="onMenuButtonTap_">
             <iron-icon icon="cr:more-vert"></iron-icon>
           </button>
         </div>
-        <template is="dom-if" if="[[hasTimeGap]]">
-          <div id="time-gap-separator"></div>
-        </template>
+        <div id="time-gap-separator" hidden="[[!hasTimeGap]]"></div>
       </div>
     </div>
   </template>
diff --git a/chrome/browser/resources/md_history/history_item.js b/chrome/browser/resources/md_history/history_item.js
index 5a3fa26..3146359 100644
--- a/chrome/browser/resources/md_history/history_item.js
+++ b/chrome/browser/resources/md_history/history_item.js
@@ -11,9 +11,6 @@
       // from the history backend, as well as fields computed by history-list.
       item: {type: Object, observer: 'showIcon_'},
 
-      // True if the website is a bookmarked page.
-      starred: {type: Boolean, reflectToAttribute: true},
-
       // Search term used to obtain this history-item.
       searchTerm: {type: String},
 
@@ -50,7 +47,10 @@
      * @private
      */
     onRemoveBookmarkTap_: function() {
-      if (this.$['bookmark-star'] == this.root.activeElement)
+      if (!this.item.starred)
+        return;
+
+      if (this.$$('#bookmark-star') == this.root.activeElement)
         this.$['menu-button'].focus();
 
       md_history.BrowserService.getInstance()
diff --git a/chrome/browser/resources/md_history/history_list.html b/chrome/browser/resources/md_history/history_list.html
index 79887af45..9148450 100644
--- a/chrome/browser/resources/md_history/history_list.html
+++ b/chrome/browser/resources/md_history/history_list.html
@@ -29,7 +29,6 @@
         hidden$="[[!hasResults(historyData_.length)]]">
       <template>
         <history-item item="[[item]]"
-            starred="[[item.starred]]"
             selected="{{item.selected}}"
             is-first-item="[[isFirstItem_(index)]]"
             is-card-start="[[isCardStart_(item, index, historyData_.length)]]"
diff --git a/chrome/browser/resources/md_history/list_container.html b/chrome/browser/resources/md_history/list_container.html
index 1d4fade..2bac344 100644
--- a/chrome/browser/resources/md_history/list_container.html
+++ b/chrome/browser/resources/md_history/list_container.html
@@ -6,10 +6,11 @@
 <link rel="import" href="chrome://resources/polymer/v1_0/paper-item/paper-item.html">
 <link rel="import" href="chrome://history/grouped_list.html">
 <link rel="import" href="chrome://history/history_list.html">
+<link rel="import" href="chrome://history/shared_style.html">
 
 <dom-module id="history-list-container">
   <template>
-    <style include="cr-shared-style">
+    <style include="shared-style cr-shared-style">
       :host {
         display: block;
         height: 100%;
@@ -24,13 +25,6 @@
       #dialog .body {
         white-space: pre-wrap;
       }
-
-      paper-item {
-        -webkit-user-select: none;
-        cursor: pointer;
-        font: inherit;
-        white-space: nowrap;
-      }
     </style>
     <iron-pages id="content" attr-for-selected="id"
         selected="[[selectedPage_]]">
@@ -61,10 +55,12 @@
     </dialog>
 
     <cr-shared-menu id="sharedMenu">
-      <paper-item id="menuMoreButton" on-tap="onMoreFromSiteTap_">
+      <paper-item id="menuMoreButton" class="menu-item"
+          on-tap="onMoreFromSiteTap_">
         $i18n{moreFromSite}
       </paper-item>
-      <paper-item id="menuRemoveButton" on-tap="onRemoveFromHistoryTap_">
+      <paper-item id="menuRemoveButton" class="menu-item"
+          on-tap="onRemoveFromHistoryTap_">
         $i18n{removeFromHistory}
       </paper-item>
     </cr-shared-menu>
diff --git a/chrome/browser/resources/md_history/shared_style.html b/chrome/browser/resources/md_history/shared_style.html
index 1e3d1a4..294b914 100644
--- a/chrome/browser/resources/md_history/shared_style.html
+++ b/chrome/browser/resources/md_history/shared_style.html
@@ -51,6 +51,13 @@
         justify-content: center;
       }
 
+      .menu-item {
+        -webkit-user-select: none;
+        cursor: pointer;
+        font: inherit;
+        white-space: nowrap;
+      }
+
       .website-icon {
         -webkit-margin-end: 16px;
         background-repeat: no-repeat;
diff --git a/chrome/browser/resources/md_history/synced_device_card.html b/chrome/browser/resources/md_history/synced_device_card.html
index 5aaf1f9..e6d57d7 100644
--- a/chrome/browser/resources/md_history/synced_device_card.html
+++ b/chrome/browser/resources/md_history/synced_device_card.html
@@ -32,20 +32,18 @@
         padding: 8px 0;
       }
 
-      #open-tabs {
-        -webkit-margin-start: 20px;
-        color: rgb(102, 136, 238);
-        cursor: pointer;
-      }
-
       #last-update-time {
         color: var(--secondary-text-color);
       }
 
-      .card-title .icon-button {
+      #right-buttons {
         -webkit-margin-end: 4px;
       }
 
+      #menu-button {
+        -webkit-margin-end: 8px;
+      }
+
       #collapse {
         border-bottom: 1px solid var(--card-border-color);
         overflow: hidden;
@@ -77,11 +75,17 @@
           [[device]]
           <span id="last-update-time">[[lastUpdateTime]]</span>
         </div>
-        <button is="paper-icon-button-light" class="icon-button"
-            title$="[[getCollapseTitle_(cardOpen_)]]">
-          <iron-icon icon="cr:expand-less" id="dropdown-indicator">
-          </iron-icon>
-        </button>
+        <div id="right-buttons">
+          <button is="paper-icon-button-light" id="menu-button"
+              class="icon-button" on-tap="onMenuButtonTap_">
+            <iron-icon icon="cr:more-vert"></iron-icon>
+          </button>
+          <button is="paper-icon-button-light" class="icon-button"
+              title$="[[getCollapseTitle_(cardOpen_)]]">
+            <iron-icon icon="cr:expand-less" id="dropdown-indicator">
+            </iron-icon>
+          </button>
+        </div>
       </div>
 
       <iron-collapse opened="{{cardOpen_}}" id="collapse">
@@ -99,9 +103,6 @@
                 hidden$="[[!isWindowSeparatorIndex_(index, separatorIndexes)]]">
             </div>
           </template>
-          <div class="item-container">
-            <p on-tap="openAllTabs_" id="open-tabs">$i18n{openAll}</p>
-          </div>
         </div>
       </iron-collapse>
     </div>
diff --git a/chrome/browser/resources/md_history/synced_device_card.js b/chrome/browser/resources/md_history/synced_device_card.js
index 4e80778..71760a79 100644
--- a/chrome/browser/resources/md_history/synced_device_card.js
+++ b/chrome/browser/resources/md_history/synced_device_card.js
@@ -7,10 +7,10 @@
 
   properties: {
     // Name of the synced device.
-    device: {type: String, value: ''},
+    device: String,
 
     // When the device information was last updated.
-    lastUpdateTime: {type: String, value: ''},
+    lastUpdateTime: String,
 
     /**
      * The list of tabs open for this device.
@@ -35,19 +35,11 @@
 
     searchTerm: String,
 
+    // Internal identifier for the device.
     sessionTag: String,
   },
 
   /**
-   * Opens all the tabs displayed on the device in separate tabs.
-   * @private
-   */
-  openAllTabs_: function() {
-    md_history.BrowserService.getInstance().openForeignSessionAllTabs(
-        this.sessionTag);
-  },
-
-  /**
    * @param {TapEvent} e
    * @private
    */
@@ -97,4 +89,16 @@
     return cardOpen ? loadTimeData.getString('collapseSessionButton') :
                       loadTimeData.getString('expandSessionButton');
   },
+
+  /**
+   * @param {CustomEvent} e
+   * @private
+   */
+  onMenuButtonTap_: function(e) {
+    this.fire('toggle-menu', {
+      target: Polymer.dom(e).localTarget,
+      tag: this.sessionTag
+    });
+    e.stopPropagation();  // Prevent iron-collapse.
+  },
 });
diff --git a/chrome/browser/resources/md_history/synced_device_manager.html b/chrome/browser/resources/md_history/synced_device_manager.html
index c17c1b00..bd8b029 100644
--- a/chrome/browser/resources/md_history/synced_device_manager.html
+++ b/chrome/browser/resources/md_history/synced_device_manager.html
@@ -2,15 +2,13 @@
 <link rel="import" href="chrome://resources/polymer/v1_0/iron-list/iron-list.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/paper-button/paper-button.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/paper-item/paper-item.html">
-<link rel="import" href="chrome://resources/polymer/v1_0/paper-menu/paper-menu.html">
-<link rel="import" href="chrome://resources/html/cr/ui/position_util.html">
+<link rel="import" href="chrome://resources/cr_elements/cr_shared_menu/cr_shared_menu.html">
 <link rel="import" href="chrome://history/shared_style.html">
 <link rel="import" href="chrome://history/synced_device_card.html">
 
 <dom-module id="history-synced-device-manager">
-  <style include="shared-style"></style>
   <template>
-    <style>
+    <style include="shared-style">
       :host {
         display: block;
         overflow: auto;
@@ -87,6 +85,15 @@
         $i18n{signInButton}
       </paper-button>
     </div>
+
+    <cr-shared-menu id="menu">
+      <paper-item class="menu-item" on-tap="onOpenAllTap_">
+        $i18n{openAll}
+      </paper-item>
+      <paper-item class="menu-item" on-tap="onDeleteSessionTap_">
+        $i18n{deleteSession}
+      </paper-item>
+    </cr-shared-menu>
   </template>
   <script src="chrome://history/synced_device_manager.js"></script>
 </dom-module>
diff --git a/chrome/browser/resources/md_history/synced_device_manager.js b/chrome/browser/resources/md_history/synced_device_manager.js
index 433fb7f8..030d1ca 100644
--- a/chrome/browser/resources/md_history/synced_device_manager.js
+++ b/chrome/browser/resources/md_history/synced_device_manager.js
@@ -57,6 +57,10 @@
     }
   },
 
+  listeners: {
+    'toggle-menu': 'onToggleMenu_',
+  },
+
   /** @override */
   attached: function() {
     // Update the sign in state.
@@ -80,13 +84,13 @@
         tab.windowId = windowId;
       });
 
+      var windowAdded = false;
       if (!this.searchTerm) {
         // Add all the tabs if there is no search term.
         tabs = tabs.concat(newTabs);
-        separatorIndexes.push(tabs.length - 1);
+        windowAdded = true;
       } else {
         var searchText = this.searchTerm.toLowerCase();
-        var windowAdded = false;
         for (var j = 0; j < newTabs.length; j++) {
           var tab = newTabs[j];
           if (tab.title.toLowerCase().indexOf(searchText) != -1) {
@@ -94,10 +98,9 @@
             windowAdded = true;
           }
         }
-        if (windowAdded)
-          separatorIndexes.push(tabs.length - 1);
       }
-
+      if (windowAdded && i != session.windows.length - 1)
+        separatorIndexes.push(tabs.length - 1);
     }
     return {
       device: session.name,
@@ -109,12 +112,27 @@
     };
   },
 
-
   onSignInTap_: function() {
     chrome.send('SyncSetupShowSetupUI');
     chrome.send('SyncSetupStartSignIn', [false]);
   },
 
+  onToggleMenu_: function(e) {
+    this.$.menu.toggleMenu(e.detail.target, e.detail.tag);
+  },
+
+  onOpenAllTap_: function() {
+    md_history.BrowserService.getInstance().openForeignSessionAllTabs(
+        this.$.menu.itemData);
+    this.$.menu.closeMenu();
+  },
+
+  onDeleteSessionTap_: function() {
+    md_history.BrowserService.getInstance().deleteForeignSession(
+        this.$.menu.itemData);
+    this.$.menu.closeMenu();
+  },
+
   /** @private */
   clearDisplayedSyncedDevices_: function() {
     this.syncedDevices_ = [];
diff --git a/chrome/browser/safe_browsing/incident_reporting/last_download_finder_unittest.cc b/chrome/browser/safe_browsing/incident_reporting/last_download_finder_unittest.cc
index 30902af..a360ddf65 100644
--- a/chrome/browser/safe_browsing/incident_reporting/last_download_finder_unittest.cc
+++ b/chrome/browser/safe_browsing/incident_reporting/last_download_finder_unittest.cc
@@ -72,7 +72,7 @@
   std::unique_ptr<history::HistoryService> history_service(
       new history::HistoryService(
           base::WrapUnique(new ChromeHistoryClient(
-              BookmarkModelFactory::GetForProfile(profile))),
+              BookmarkModelFactory::GetForBrowserContext(profile))),
           std::unique_ptr<history::VisitDelegate>()));
   if (history_service->Init(
           history::HistoryDatabaseParamsForPath(profile->GetPath()))) {
diff --git a/chrome/browser/storage/durable_storage_browsertest.cc b/chrome/browser/storage/durable_storage_browsertest.cc
index 4327cd3..1719f42 100644
--- a/chrome/browser/storage/durable_storage_browsertest.cc
+++ b/chrome/browser/storage/durable_storage_browsertest.cc
@@ -43,7 +43,7 @@
 
   void Bookmark(Browser* browser) {
     bookmarks::BookmarkModel* bookmark_model =
-        BookmarkModelFactory::GetForProfile(browser->profile());
+        BookmarkModelFactory::GetForBrowserContext(browser->profile());
     bookmarks::test::WaitForBookmarkModelToLoad(bookmark_model);
     bookmarks::AddIfNotBookmarked(bookmark_model, url_, base::ASCIIToUTF16(""));
   }
@@ -120,7 +120,7 @@
   EXPECT_TRUE(is_persistent);
 
   bookmarks::BookmarkModel* bookmark_model =
-      BookmarkModelFactory::GetForProfile(browser()->profile());
+      BookmarkModelFactory::GetForBrowserContext(browser()->profile());
   bookmarks::RemoveAllBookmarks(bookmark_model, url_);
 
   // Unbookmarking doesn't change the permission.
diff --git a/chrome/browser/storage/durable_storage_permission_context.cc b/chrome/browser/storage/durable_storage_permission_context.cc
index 1bcc08e..7eac71f 100644
--- a/chrome/browser/storage/durable_storage_permission_context.cc
+++ b/chrome/browser/storage/durable_storage_permission_context.cc
@@ -40,7 +40,8 @@
 
   // TODO(dgrogan): Remove bookmarks check in favor of site engagement. In the
   // meantime maybe grant permission to A2HS origins as well.
-  BookmarkModel* model = BookmarkModelFactory::GetForProfileIfExists(profile());
+  BookmarkModel* model =
+      BookmarkModelFactory::GetForBrowserContextIfExists(profile());
   if (model) {
     std::vector<bookmarks::BookmarkModel::URLAndTitle> bookmarks;
     model->GetBookmarks(&bookmarks);
diff --git a/chrome/browser/sync/chrome_sync_client.cc b/chrome/browser/sync/chrome_sync_client.cc
index 08ed031..77ae249 100644
--- a/chrome/browser/sync/chrome_sync_client.cc
+++ b/chrome/browser/sync/chrome_sync_client.cc
@@ -137,7 +137,7 @@
   // SyncSessionsClient implementation.
   bookmarks::BookmarkModel* GetBookmarkModel() override {
     DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
-    return BookmarkModelFactory::GetForProfile(profile_);
+    return BookmarkModelFactory::GetForBrowserContext(profile_);
   }
   favicon::FaviconService* GetFaviconService() override {
     DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
@@ -229,7 +229,7 @@
 
 bookmarks::BookmarkModel* ChromeSyncClient::GetBookmarkModel() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  return BookmarkModelFactory::GetForProfile(profile_);
+  return BookmarkModelFactory::GetForBrowserContext(profile_);
 }
 
 favicon::FaviconService* ChromeSyncClient::GetFaviconService() {
diff --git a/chrome/browser/sync/test/integration/bookmarks_helper.cc b/chrome/browser/sync/test/integration/bookmarks_helper.cc
index 0e254903..55ce8066 100644
--- a/chrome/browser/sync/test/integration/bookmarks_helper.cc
+++ b/chrome/browser/sync/test/integration/bookmarks_helper.cc
@@ -255,15 +255,15 @@
                     const GURL& icon_url,
                     const gfx::Image& image,
                     bookmarks_helper::FaviconSource favicon_source) {
-    BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile);
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile);
 
-    FaviconChangeObserver observer(model, node);
-    favicon::FaviconService* favicon_service =
-        FaviconServiceFactory::GetForProfile(
-            profile, ServiceAccessType::EXPLICIT_ACCESS);
-    if (favicon_source == bookmarks_helper::FROM_UI) {
-      favicon_service->SetFavicons(
-          node->url(), icon_url, favicon_base::FAVICON, image);
+  FaviconChangeObserver observer(model, node);
+  favicon::FaviconService* favicon_service =
+      FaviconServiceFactory::GetForProfile(profile,
+                                           ServiceAccessType::EXPLICIT_ACCESS);
+  if (favicon_source == bookmarks_helper::FROM_UI) {
+    favicon_service->SetFavicons(node->url(), icon_url, favicon_base::FAVICON,
+                                 image);
     } else {
       ProfileSyncService* pss =
           ProfileSyncServiceFactory::GetForProfile(profile);
@@ -454,7 +454,7 @@
 namespace bookmarks_helper {
 
 BookmarkModel* GetBookmarkModel(int index) {
-  return BookmarkModelFactory::GetForProfile(
+  return BookmarkModelFactory::GetForBrowserContext(
       sync_datatype_helper::test()->GetProfile(index));
 }
 
@@ -477,7 +477,7 @@
 }
 
 BookmarkModel* GetVerifierBookmarkModel() {
-  return BookmarkModelFactory::GetForProfile(
+  return BookmarkModelFactory::GetForBrowserContext(
       sync_datatype_helper::test()->verifier());
 }
 
diff --git a/chrome/browser/sync/test/integration/sync_test.cc b/chrome/browser/sync/test/integration/sync_test.cc
index 931c86787..5175399 100644
--- a/chrome/browser/sync/test/integration/sync_test.cc
+++ b/chrome/browser/sync/test/integration/sync_test.cc
@@ -713,7 +713,7 @@
 
 void SyncTest::WaitForDataModels(Profile* profile) {
   bookmarks::test::WaitForBookmarkModelToLoad(
-      BookmarkModelFactory::GetForProfile(profile));
+      BookmarkModelFactory::GetForBrowserContext(profile));
   ui_test_utils::WaitForHistoryToLoad(HistoryServiceFactory::GetForProfile(
       profile, ServiceAccessType::EXPLICIT_ACCESS));
   search_test_utils::WaitForTemplateURLServiceToLoad(
diff --git a/chrome/browser/ui/app_list/search/omnibox_result.cc b/chrome/browser/ui/app_list/search/omnibox_result.cc
index 3404e9e..dd08dde 100644
--- a/chrome/browser/ui/app_list/search/omnibox_result.cc
+++ b/chrome/browser/ui/app_list/search/omnibox_result.cc
@@ -166,7 +166,8 @@
 }
 
 void OmniboxResult::UpdateIcon() {
-  BookmarkModel* bookmark_model = BookmarkModelFactory::GetForProfile(profile_);
+  BookmarkModel* bookmark_model =
+      BookmarkModelFactory::GetForBrowserContext(profile_);
   bool is_bookmarked =
       bookmark_model && bookmark_model->IsBookmarked(match_.destination_url);
 
diff --git a/chrome/browser/ui/bookmarks/bookmark_browsertest.cc b/chrome/browser/ui/bookmarks/bookmark_browsertest.cc
index 92d47ecb..50d898b 100644
--- a/chrome/browser/ui/bookmarks/bookmark_browsertest.cc
+++ b/chrome/browser/ui/bookmarks/bookmark_browsertest.cc
@@ -83,7 +83,7 @@
 
   BookmarkModel* WaitForBookmarkModel(Profile* profile) {
     BookmarkModel* bookmark_model =
-        BookmarkModelFactory::GetForProfile(profile);
+        BookmarkModelFactory::GetForBrowserContext(profile);
     bookmarks::test::WaitForBookmarkModelToLoad(bookmark_model);
     return bookmark_model;
   }
diff --git a/chrome/browser/ui/bookmarks/bookmark_context_menu_controller.cc b/chrome/browser/ui/bookmarks/bookmark_context_menu_controller.cc
index b4d26e4..5bf1e21 100644
--- a/chrome/browser/ui/bookmarks/bookmark_context_menu_controller.cc
+++ b/chrome/browser/ui/bookmarks/bookmark_context_menu_controller.cc
@@ -53,7 +53,7 @@
       navigator_(navigator),
       parent_(parent),
       selection_(selection),
-      model_(BookmarkModelFactory::GetForProfile(profile)),
+      model_(BookmarkModelFactory::GetForBrowserContext(profile)),
       weak_factory_(this) {
   DCHECK(profile_);
   DCHECK(model_->loaded());
diff --git a/chrome/browser/ui/bookmarks/bookmark_context_menu_controller_unittest.cc b/chrome/browser/ui/bookmarks/bookmark_context_menu_controller_unittest.cc
index 5045a15..2143adce9 100644
--- a/chrome/browser/ui/bookmarks/bookmark_context_menu_controller_unittest.cc
+++ b/chrome/browser/ui/bookmarks/bookmark_context_menu_controller_unittest.cc
@@ -55,7 +55,7 @@
     TestingProfile::Builder builder;
     profile_ = builder.Build();
     profile_->CreateBookmarkModel(true);
-    model_ = BookmarkModelFactory::GetForProfile(profile_.get());
+    model_ = BookmarkModelFactory::GetForBrowserContext(profile_.get());
     bookmarks::test::WaitForBookmarkModelToLoad(model_);
     AddTestData(model_);
   }
@@ -240,7 +240,7 @@
       TestingProfile::Builder().BuildIncognito(profile_.get());
 
   incognito->CreateBookmarkModel(true);
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(incognito);
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(incognito);
   bookmarks::test::WaitForBookmarkModelToLoad(model);
   AddTestData(model);
 
diff --git a/chrome/browser/ui/bookmarks/bookmark_drag_drop.cc b/chrome/browser/ui/bookmarks/bookmark_drag_drop.cc
index af3e729..e753432 100644
--- a/chrome/browser/ui/bookmarks/bookmark_drag_drop.cc
+++ b/chrome/browser/ui/bookmarks/bookmark_drag_drop.cc
@@ -29,7 +29,7 @@
                   const BookmarkNode* parent_node,
                   int index,
                   bool copy) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile);
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile);
 #if !defined(OS_ANDROID)
   bookmarks::ScopedGroupBookmarkActions group_drops(model);
 #endif
diff --git a/chrome/browser/ui/bookmarks/bookmark_tab_helper.cc b/chrome/browser/ui/bookmarks/bookmark_tab_helper.cc
index 32e65e2a..ce60bdd0 100644
--- a/chrome/browser/ui/bookmarks/bookmark_tab_helper.cc
+++ b/chrome/browser/ui/bookmarks/bookmark_tab_helper.cc
@@ -76,9 +76,8 @@
       bookmark_model_(NULL),
       delegate_(NULL),
       bookmark_drag_(NULL) {
-  Profile* profile =
-      Profile::FromBrowserContext(web_contents->GetBrowserContext());
-  bookmark_model_ = BookmarkModelFactory::GetForProfile(profile);
+  bookmark_model_ = BookmarkModelFactory::GetForBrowserContext(
+      web_contents->GetBrowserContext());
   if (bookmark_model_)
     bookmark_model_->AddObserver(this);
 }
diff --git a/chrome/browser/ui/bookmarks/bookmark_utils.cc b/chrome/browser/ui/bookmarks/bookmark_utils.cc
index 7b2d6b1..13c2e18 100644
--- a/chrome/browser/ui/bookmarks/bookmark_utils.cc
+++ b/chrome/browser/ui/bookmarks/bookmark_utils.cc
@@ -184,8 +184,8 @@
 int GetBookmarkDragOperation(content::BrowserContext* browser_context,
                              const BookmarkNode* node) {
   PrefService* prefs = user_prefs::UserPrefs::Get(browser_context);
-  Profile* profile = Profile::FromBrowserContext(browser_context);
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile);
+  BookmarkModel* model =
+      BookmarkModelFactory::GetForBrowserContext(browser_context);
 
   int move = ui::DragDropTypes::DRAG_MOVE;
   if (!prefs->GetBoolean(bookmarks::prefs::kEditBookmarksEnabled) ||
@@ -224,7 +224,7 @@
   if (!IsValidBookmarkDropLocation(profile, data, parent, index))
     return ui::DragDropTypes::DRAG_NONE;
 
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile);
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile);
   if (!model->client()->CanBeEditedByUser(parent))
     return ui::DragDropTypes::DRAG_NONE;
 
@@ -257,7 +257,7 @@
   if (!data.is_valid())
     return false;
 
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile);
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile);
   if (!model->client()->CanBeEditedByUser(drop_parent))
     return false;
 
diff --git a/chrome/browser/ui/bookmarks/bookmark_utils_desktop.cc b/chrome/browser/ui/bookmarks/bookmark_utils_desktop.cc
index 7a3d527..62fc536c 100644
--- a/chrome/browser/ui/bookmarks/bookmark_utils_desktop.cc
+++ b/chrome/browser/ui/bookmarks/bookmark_utils_desktop.cc
@@ -239,7 +239,7 @@
 
 void ShowBookmarkAllTabsDialog(Browser* browser) {
   Profile* profile = browser->profile();
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile);
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile);
   DCHECK(model && model->loaded());
 
   const BookmarkNode* parent = model->GetParentForNewNodes();
diff --git a/chrome/browser/ui/browser_commands.cc b/chrome/browser/ui/browser_commands.cc
index 8a77489..b67422e8 100644
--- a/chrome/browser/ui/browser_commands.cc
+++ b/chrome/browser/ui/browser_commands.cc
@@ -132,7 +132,7 @@
 bool CanBookmarkCurrentPageInternal(const Browser* browser,
                                     bool check_remove_bookmark_ui) {
   BookmarkModel* model =
-      BookmarkModelFactory::GetForProfile(browser->profile());
+      BookmarkModelFactory::GetForBrowserContext(browser->profile());
   return browser_defaults::bookmarks_enabled &&
       browser->profile()->GetPrefs()->GetBoolean(
           bookmarks::prefs::kEditBookmarksEnabled) &&
@@ -727,7 +727,7 @@
   content::RecordAction(UserMetricsAction("Star"));
 
   BookmarkModel* model =
-      BookmarkModelFactory::GetForProfile(browser->profile());
+      BookmarkModelFactory::GetForBrowserContext(browser->profile());
   if (!model || !model->loaded())
     return;  // Ignore requests until bookmarks are loaded.
 
diff --git a/chrome/browser/ui/cocoa/applescript/bookmark_applescript_utils_unittest.mm b/chrome/browser/ui/cocoa/applescript/bookmark_applescript_utils_unittest.mm
index 5b218989..4f2fc760 100644
--- a/chrome/browser/ui/cocoa/applescript/bookmark_applescript_utils_unittest.mm
+++ b/chrome/browser/ui/cocoa/applescript/bookmark_applescript_utils_unittest.mm
@@ -67,7 +67,7 @@
   [appDelegate_.get() setTest:this];
   DCHECK([NSApp delegate] == nil);
   [NSApp setDelegate:appDelegate_];
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string modelString("a f1:[ b d c ] d f2:[ e f g ] h ");
   bookmarks::test::AddNodesFromModelString(model, root, modelString);
diff --git a/chrome/browser/ui/cocoa/applescript/bookmark_node_applescript.mm b/chrome/browser/ui/cocoa/applescript/bookmark_node_applescript.mm
index 524f75c..7b3affe 100644
--- a/chrome/browser/ui/cocoa/applescript/bookmark_node_applescript.mm
+++ b/chrome/browser/ui/cocoa/applescript/bookmark_node_applescript.mm
@@ -124,7 +124,8 @@
     return NULL;
   }
 
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(lastProfile);
+  BookmarkModel* model =
+      BookmarkModelFactory::GetForBrowserContext(lastProfile);
   if (!model->loaded()) {
     AppleScript::SetError(AppleScript::errBookmarkModelLoad);
     return NULL;
diff --git a/chrome/browser/ui/cocoa/applescript/browsercrapplication+applescript.mm b/chrome/browser/ui/cocoa/applescript/browsercrapplication+applescript.mm
index 36e076d..6651ea17 100644
--- a/chrome/browser/ui/cocoa/applescript/browsercrapplication+applescript.mm
+++ b/chrome/browser/ui/cocoa/applescript/browsercrapplication+applescript.mm
@@ -81,7 +81,8 @@
     return nil;
   }
 
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(lastProfile);
+  BookmarkModel* model =
+      BookmarkModelFactory::GetForBrowserContext(lastProfile);
   if (!model->loaded()) {
     AppleScript::SetError(AppleScript::errBookmarkModelLoad);
     return nil;
@@ -105,7 +106,8 @@
     return nil;
   }
 
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(lastProfile);
+  BookmarkModel* model =
+      BookmarkModelFactory::GetForBrowserContext(lastProfile);
   if (!model->loaded()) {
     AppleScript::SetError(AppleScript::errBookmarkModelLoad);
     return NULL;
diff --git a/chrome/browser/ui/cocoa/bookmarks/bookmark_all_tabs_controller_unittest.mm b/chrome/browser/ui/cocoa/bookmarks/bookmark_all_tabs_controller_unittest.mm
index 74bdde10..f42ebe03 100644
--- a/chrome/browser/ui/cocoa/bookmarks/bookmark_all_tabs_controller_unittest.mm
+++ b/chrome/browser/ui/cocoa/bookmarks/bookmark_all_tabs_controller_unittest.mm
@@ -44,7 +44,8 @@
   const BookmarkNode* folder_a_;
 
   void CreateModel() {
-    BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+    BookmarkModel* model =
+        BookmarkModelFactory::GetForBrowserContext(profile());
     const BookmarkNode* root = model->bookmark_bar_node();
     folder_a_ = model->AddFolder(root, 0, ASCIIToUTF16("a"));
     model->AddURL(folder_a_, 0, ASCIIToUTF16("a-0"), GURL("http://a-0.com"));
diff --git a/chrome/browser/ui/cocoa/bookmarks/bookmark_bar_bridge_unittest.mm b/chrome/browser/ui/cocoa/bookmarks/bookmark_bar_bridge_unittest.mm
index 981860b..2035789 100644
--- a/chrome/browser/ui/cocoa/bookmarks/bookmark_bar_bridge_unittest.mm
+++ b/chrome/browser/ui/cocoa/bookmarks/bookmark_bar_bridge_unittest.mm
@@ -100,7 +100,7 @@
 
 // Call all the callbacks; make sure they are all redirected to the objc object.
 TEST_F(BookmarkBarBridgeTest, TestRedirect) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
 
   base::scoped_nsobject<NSView> parentView(
       [[NSView alloc] initWithFrame:NSMakeRect(0, 0, 100, 100)]);
diff --git a/chrome/browser/ui/cocoa/bookmarks/bookmark_bar_controller.mm b/chrome/browser/ui/cocoa/bookmarks/bookmark_bar_controller.mm
index 0ddbeff..23e7eddd 100644
--- a/chrome/browser/ui/cocoa/bookmarks/bookmark_bar_controller.mm
+++ b/chrome/browser/ui/cocoa/bookmarks/bookmark_bar_controller.mm
@@ -300,7 +300,8 @@
 
     browser_ = browser;
     initialWidth_ = initialWidth;
-    bookmarkModel_ = BookmarkModelFactory::GetForProfile(browser_->profile());
+    bookmarkModel_ =
+        BookmarkModelFactory::GetForBrowserContext(browser_->profile());
     managedBookmarkService_ =
         ManagedBookmarkServiceFactory::GetForProfile(browser_->profile());
     buttons_.reset([[NSMutableArray alloc] init]);
diff --git a/chrome/browser/ui/cocoa/bookmarks/bookmark_bar_controller_unittest.mm b/chrome/browser/ui/cocoa/bookmarks/bookmark_bar_controller_unittest.mm
index bdb05cd73..9ba3378b 100644
--- a/chrome/browser/ui/cocoa/bookmarks/bookmark_bar_controller_unittest.mm
+++ b/chrome/browser/ui/cocoa/bookmarks/bookmark_bar_controller_unittest.mm
@@ -523,7 +523,7 @@
 // Confirm our "no items" container goes away when we add the 1st
 // bookmark, and comes back when we delete the bookmark.
 TEST_F(BookmarkBarControllerTest, NoItemContainerGoesAway) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* bar = model->bookmark_bar_node();
 
   [bar_ loaded:model];
@@ -556,7 +556,7 @@
 
 // Confirm off the side button only enabled when reasonable.
 TEST_F(BookmarkBarControllerTest, OffTheSideButtonHidden) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
 
   [bar_ loaded:model];
   EXPECT_TRUE([bar_ offTheSideButtonIsHidden]);
@@ -605,7 +605,7 @@
 // off-the-side menu while it is open.  This test tries to bang hard
 // in this area to reproduce the crash.
 TEST_F(BookmarkBarControllerTest, DeleteFromOffTheSideWhileItIsOpen) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   [bar_ loaded:model];
 
   // Add a lot of bookmarks (per the bug).
@@ -687,7 +687,7 @@
 }
 
 TEST_F(BookmarkBarControllerTest, MenuForFolderNode) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
 
   // First make sure something (e.g. "(empty)" string) is always present.
   NSMenu* menu = [bar_ menuForFolderNode:model->bookmark_bar_node()];
@@ -751,7 +751,7 @@
 }
 
 TEST_F(BookmarkBarControllerTest, TestAddRemoveAndClear) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   NSView* buttonView = [bar_ buttonView];
   EXPECT_EQ(0U, [[bar_ buttons] count]);
   unsigned int initial_subview_count = [[buttonView subviews] count];
@@ -801,7 +801,7 @@
 // Make sure we don't create too many buttons; we only really need
 // ones that will be visible.
 TEST_F(BookmarkBarControllerTest, TestButtonLimits) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   EXPECT_EQ(0U, [[bar_ buttons] count]);
   // Add one; make sure we see it.
   const BookmarkNode* parent = model->bookmark_bar_node();
@@ -861,7 +861,7 @@
 
 TEST_F(BookmarkBarControllerTest, CheckForGrowth) {
   WithNoAnimation at_all; // Turn off Cocoa auto animation in this scope.
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   GURL gurl1("http://www.google.com");
   base::string16 title1(ASCIIToUTF16("x"));
   bookmarks::AddIfNotBookmarked(model, gurl1, title1);
@@ -888,7 +888,7 @@
 }
 
 TEST_F(BookmarkBarControllerTest, DeleteBookmark) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
 
   const char* urls[] = { "https://secret.url.com",
                          "http://super.duper.web.site.for.doodz.gov",
@@ -912,7 +912,7 @@
 // checkForBookmarkButtonGrowth:.
 
 TEST_F(BookmarkBarControllerTest, Cell) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   [bar_ loaded:model];
 
   const BookmarkNode* parent = model->bookmark_bar_node();
@@ -944,7 +944,7 @@
 // Test that middle clicking on a bookmark button results in an open action,
 // except for offTheSideButton, as it just opens its folder menu.
 TEST_F(BookmarkBarControllerTest, MiddleClick) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   GURL gurl1("http://www.google.com/");
   base::string16 title1(ASCIIToUTF16("x"));
   bookmarks::AddIfNotBookmarked(model, gurl1, title1);
@@ -990,13 +990,13 @@
 }
 
 TEST_F(BookmarkBarControllerTest, DisplaysHelpMessageOnEmpty) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   [bar_ loaded:model];
   EXPECT_FALSE([[[bar_ buttonView] noItemContainer] isHidden]);
 }
 
 TEST_F(BookmarkBarControllerTest, HidesHelpMessageWithBookmark) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
 
   const BookmarkNode* parent = model->bookmark_bar_node();
   model->AddURL(parent, parent->child_count(),
@@ -1007,7 +1007,7 @@
 }
 
 TEST_F(BookmarkBarControllerTest, BookmarkButtonSizing) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
 
   const BookmarkNode* parent = model->bookmark_bar_node();
   model->AddURL(parent, parent->child_count(),
@@ -1058,7 +1058,7 @@
     [nstitles addObject:base::SysUTF8ToNSString(titles[i])];
   }
 
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* parent = model->bookmark_bar_node();
   [bar_ addURLs:nsurls withTitles:nstitles at:NSZeroPoint];
   EXPECT_EQ(4, parent->child_count());
@@ -1079,7 +1079,7 @@
 
 TEST_F(BookmarkBarControllerTest, TestDragButton) {
   WithNoAnimation at_all;
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
 
   GURL gurls[] = { GURL("http://www.google.com/a"),
                    GURL("http://www.google.com/b"),
@@ -1151,7 +1151,7 @@
 }
 
 TEST_F(BookmarkBarControllerTest, TestCopyButton) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
 
   GURL gurls[] = { GURL("http://www.google.com/a"),
                    GURL("http://www.google.com/b"),
@@ -1181,7 +1181,7 @@
 // Fake a theme with colored text.  Apply it and make sure bookmark
 // buttons have the same colored text.  Repeat more than once.
 TEST_F(BookmarkBarControllerTest, TestThemedButton) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   bookmarks::AddIfNotBookmarked(
       model, GURL("http://www.foo.com"), ASCIIToUTF16("small"));
   BookmarkButton* button = [[bar_ buttons] objectAtIndex:0];
@@ -1207,7 +1207,7 @@
 // Test that delegates and targets of buttons are cleared on dealloc.
 TEST_F(BookmarkBarControllerTest, TestClearOnDealloc) {
   // Make some bookmark buttons.
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   GURL gurls[] = { GURL("http://www.foo.com/"),
                    GURL("http://www.bar.com/"),
                    GURL("http://www.baz.com/") };
@@ -1242,7 +1242,7 @@
 }
 
 TEST_F(BookmarkBarControllerTest, TestFolders) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
 
   // Create some folder buttons.
   const BookmarkNode* parent = model->bookmark_bar_node();
@@ -1286,7 +1286,7 @@
 // click on a folder folder menus should show until another click on a folder
 // button, and a click outside the bar and its folder menus.
 TEST_F(BookmarkBarControllerTest, TestFolderButtons) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1b 2f:[ 2f1b 2f2b ] 3b 4f:[ 4f1b 4f2b ] ");
   bookmarks::test::AddNodesFromModelString(model, root, model_string);
@@ -1350,7 +1350,7 @@
   EXPECT_TRUE([bar_ offTheSideButtonIsHidden]);
 
   // Create some buttons.
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* parent = model->bookmark_bar_node();
   for (int x = 0; x < 30; x++) {
     model->AddURL(parent, parent->child_count(),
@@ -1429,7 +1429,7 @@
 
 TEST_F(BookmarkBarControllerTest, DropDestination) {
   // Make some buttons.
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* parent = model->bookmark_bar_node();
   model->AddFolder(parent, parent->child_count(), ASCIIToUTF16("folder 1"));
   model->AddFolder(parent, parent->child_count(), ASCIIToUTF16("folder 2"));
@@ -1467,7 +1467,7 @@
 }
 
 TEST_F(BookmarkBarControllerTest, CloseFolderOnAnimate) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   [bar_ setStateAnimationsEnabled:YES];
   const BookmarkNode* parent = model->bookmark_bar_node();
   const BookmarkNode* folder = model->AddFolder(parent,
@@ -1505,7 +1505,7 @@
 }
 
 TEST_F(BookmarkBarControllerTest, MoveRemoveAddButtons) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1b 2f:[ 2f1b 2f2b ] 3b ");
   bookmarks::test::AddNodesFromModelString(model, root, model_string);
@@ -1587,7 +1587,7 @@
   ASSERT_TRUE([bar_ appsPageShortcutButtonIsHidden]);
 
   // Add three buttons to the bookmark bar.
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1b 2f:[ 2f1b 2f2b ] 3b ");
   bookmarks::test::AddNodesFromModelString(model, root, model_string);
@@ -1666,7 +1666,7 @@
 }
 
 TEST_F(BookmarkBarControllerTest, BookmarksWithAppsPageShortcut) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1b 2f:[ 2f1b 2f2b ] 3b ");
   bookmarks::test::AddNodesFromModelString(model, root, model_string);
@@ -1753,7 +1753,8 @@
     frame.origin.y = 100;
     [[[bar_ view] superview] setFrame:frame];
 
-    BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+    BookmarkModel* model =
+        BookmarkModelFactory::GetForBrowserContext(profile());
     parent_ = model->bookmark_bar_node();
     // { one, { two-one, two-two }, three }
     model->AddURL(parent_, parent_->child_count(), ASCIIToUTF16("title"),
@@ -1878,7 +1879,7 @@
 };
 
 TEST_F(BookmarkBarControllerDragDropTest, DragMoveBarBookmarkToOffTheSide) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1bWithLongName 2fWithLongName:[ "
       "2f1bWithLongName 2f2fWithLongName:[ 2f2f1bWithLongName "
@@ -1930,7 +1931,7 @@
 }
 
 TEST_F(BookmarkBarControllerDragDropTest, DragOffTheSideToOther) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1bWithLongName 2bWithLongName "
       "3bWithLongName 4bWithLongName 5bWithLongName 6bWithLongName "
@@ -1987,7 +1988,7 @@
 }
 
 TEST_F(BookmarkBarControllerDragDropTest, DragBookmarkData) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1b 2f:[ 2f1b 2f2f:[ 2f2f1b 2f2f2b 2f2f3b ] "
                                   "2f3b ] 3b 4b ");
@@ -2047,7 +2048,7 @@
 }
 
 TEST_F(BookmarkBarControllerDragDropTest, AddURLs) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1b 2f:[ 2f1b 2f2f:[ 2f2f1b 2f2f2b 2f2f3b ] "
                                  "2f3b ] 3b 4b ");
@@ -2079,7 +2080,7 @@
 }
 
 TEST_F(BookmarkBarControllerDragDropTest, ControllerForNode) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1b 2f:[ 2f1b 2f2b ] 3b ");
   bookmarks::test::AddNodesFromModelString(model, root, model_string);
@@ -2095,7 +2096,7 @@
 }
 
 TEST_F(BookmarkBarControllerDragDropTest, DropPositionIndicator) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1b 2f:[ 2f1b 2f2b 2f3b ] 3b 4b ");
   bookmarks::test::AddNodesFromModelString(model, root, model_string);
@@ -2134,7 +2135,7 @@
 }
 
 TEST_F(BookmarkBarControllerDragDropTest, PulseButton) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   GURL gurl("http://www.google.com");
   const BookmarkNode* node = model->AddURL(root, root->child_count(),
@@ -2178,7 +2179,7 @@
 }
 
 TEST_F(BookmarkBarControllerDragDropTest, DragBookmarkDataToTrash) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1b 2f:[ 2f1b 2f2f:[ 2f2f1b 2f2f2b 2f2f3b ] "
                                   "2f3b ] 3b 4b ");
diff --git a/chrome/browser/ui/cocoa/bookmarks/bookmark_bar_folder_controller_unittest.mm b/chrome/browser/ui/cocoa/bookmarks/bookmark_bar_folder_controller_unittest.mm
index ff6ba4b..9743fcc 100644
--- a/chrome/browser/ui/cocoa/bookmarks/bookmark_bar_folder_controller_unittest.mm
+++ b/chrome/browser/ui/cocoa/bookmarks/bookmark_bar_folder_controller_unittest.mm
@@ -36,7 +36,7 @@
 void DeleteBookmark(BookmarkButton* button, Profile* profile) {
   const BookmarkNode* node = [button bookmarkNode];
   if (node) {
-    BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile);
+    BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile);
     model->Remove(node);
   }
 }
@@ -147,7 +147,8 @@
   }
 
   void CreateModel() {
-    BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+    BookmarkModel* model =
+        BookmarkModelFactory::GetForBrowserContext(profile());
     const BookmarkNode* parent = model->bookmark_bar_node();
     const BookmarkNode* folderA = model->AddFolder(parent,
                                                    parent->child_count(),
@@ -189,14 +190,16 @@
 
   // Remove the bookmark with the long title.
   void RemoveLongTitleNode() {
-    BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+    BookmarkModel* model =
+        BookmarkModelFactory::GetForBrowserContext(profile());
     model->Remove(longTitleNode_);
   }
 
   // Add LOTS of nodes to our model if needed (e.g. scrolling).
   // Returns the number of nodes added.
   int AddLotsOfNodes() {
-    BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+    BookmarkModel* model =
+        BookmarkModelFactory::GetForBrowserContext(profile());
     for (int i = 0; i < kLotsOfNodesCount; i++) {
       model->AddURL(folderA_, folderA_->child_count(),
                     ASCIIToUTF16("repeated title"),
@@ -298,7 +301,7 @@
 // Confirm we grow right until end of screen, then start growing left
 // until end of screen again, then right.
 TEST_F(BookmarkBarFolderControllerTest, PositionRightLeftRight) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* parent = model->bookmark_bar_node();
   const BookmarkNode* folder = parent;
 
@@ -747,7 +750,7 @@
 
 TEST_F(BookmarkBarFolderControllerMenuTest, DragMoveBarBookmarkToFolder) {
   WithNoAnimation at_all;
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1b 2f:[ 2f1b 2f2f:[ 2f2f1b 2f2f2b "
       "2f2f3b ] 2f3b ] 3b 4f:[ 4f1f:[ 4f1f1b 4f1f2b 4f1f3b ] 4f2f:[ 4f2f1b "
@@ -820,7 +823,7 @@
 }
 
 TEST_F(BookmarkBarFolderControllerMenuTest, DragCopyBarBookmarkToFolder) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1b 2f:[ 2f1b 2f2f:[ 2f2f1b 2f2f2b "
       "2f2f3b ] 2f3b ] 3b 4f:[ 4f1f:[ 4f1f1b 4f1f2b 4f1f3b ] 4f2f:[ 4f2f1b "
@@ -884,7 +887,7 @@
 }
 
 TEST_F(BookmarkBarFolderControllerMenuTest, DragMoveBarBookmarkToSubfolder) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1b 2f:[ 2f1b 2f2f:[ 2f2f1b 2f2f2b "
       "2f2f3b ] 2f3b ] 3b 4f:[ 4f1f:[ 4f1f1b 4f1f2b 4f1f3b ] 4f2f:[ 4f2f1b "
@@ -949,7 +952,7 @@
 }
 
 TEST_F(BookmarkBarFolderControllerMenuTest, DragMoveWithinFolder) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1b 2f:[ 2f1b 2f2f:[ 2f2f1b 2f2f2b "
       "2f2f3b ] 2f3b ] 3b 4f:[ 4f1f:[ 4f1f1b 4f1f2b 4f1f3b ] 4f2f:[ 4f2f1b "
@@ -998,7 +1001,7 @@
 }
 
 TEST_F(BookmarkBarFolderControllerMenuTest, DragParentOntoChild) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1b 2f:[ 2f1b 2f2f:[ 2f2f1b 2f2f2b "
       "2f2f3b ] 2f3b ] 3b 4f:[ 4f1f:[ 4f1f1b 4f1f2b 4f1f3b ] 4f2f:[ 4f2f1b "
@@ -1035,7 +1038,7 @@
 }
 
 TEST_F(BookmarkBarFolderControllerMenuTest, DragMoveChildToParent) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1b 2f:[ 2f1b 2f2f:[ 2f2f1b 2f2f2b "
       "2f2f3b ] 2f3b ] 3b 4f:[ 4f1f:[ 4f1f1b 4f1f2b 4f1f3b ] 4f2f:[ 4f2f1b "
@@ -1087,7 +1090,7 @@
 }
 
 TEST_F(BookmarkBarFolderControllerMenuTest, DragWindowResizing) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string(
       "a b:[ b1 b2 b3 ] reallyReallyLongBookmarkName c ");
@@ -1127,7 +1130,7 @@
 }
 
 TEST_F(BookmarkBarFolderControllerMenuTest, MoveRemoveAddButtons) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1b 2f:[ 2f1b 2f2b 2f3b ] 3b 4b ");
   bookmarks::test::AddNodesFromModelString(model, root, model_string);
@@ -1190,7 +1193,7 @@
 }
 
 TEST_F(BookmarkBarFolderControllerMenuTest, RemoveLastButtonOtherBookmarks) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* otherBookmarks = model->other_node();
 
   BookmarkButton* otherButton = [bar_ otherBookmarksButton];
@@ -1227,7 +1230,7 @@
 }
 
 TEST_F(BookmarkBarFolderControllerMenuTest, ControllerForNode) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1b 2f:[ 2f1b 2f2b ] 3b ");
   bookmarks::test::AddNodesFromModelString(model, root, model_string);
@@ -1262,7 +1265,7 @@
 }
 
 TEST_F(BookmarkBarFolderControllerMenuTest, MenuSizingAndScrollArrows) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1b 2b 3b ");
   bookmarks::test::AddNodesFromModelString(model, root, model_string);
@@ -1359,7 +1362,7 @@
 
 // See http://crbug.com/46101
 TEST_F(BookmarkBarFolderControllerMenuTest, HoverThenDeleteBookmark) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const BookmarkNode* folder = model->AddFolder(root,
                                                 root->child_count(),
@@ -1427,7 +1430,7 @@
 @end
 
 TEST_F(BookmarkBarFolderControllerMenuTest, DragBookmarkData) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1b 2f:[ 2f1b 2f2f:[ 2f2f1b 2f2f2b 2f2f3b ] "
                                  "2f3b ] 3b 4b ");
@@ -1489,7 +1492,7 @@
 }
 
 TEST_F(BookmarkBarFolderControllerMenuTest, DragBookmarkDataToTrash) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1b 2f:[ 2f1b 2f2f:[ 2f2f1b 2f2f2b 2f2f3b ] "
                                  "2f3b ] 3b 4b ");
@@ -1532,7 +1535,7 @@
 }
 
 TEST_F(BookmarkBarFolderControllerMenuTest, AddURLs) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1b 2f:[ 2f1b 2f2f:[ 2f2f1b 2f2f2b 2f2f3b ] "
                                  "2f3b ] 3b 4b ");
@@ -1577,7 +1580,7 @@
 }
 
 TEST_F(BookmarkBarFolderControllerMenuTest, DropPositionIndicator) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1b 2f:[ 2f1b 2f2f:[ 2f2f1b 2f2f2b 2f2f3b ] "
                                  "2f3b ] 3b 4b ");
@@ -1637,7 +1640,7 @@
 };
 
 TEST_F(BookmarkBarFolderControllerClosingTest, DeleteClosesFolder) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   const std::string model_string("1b 2f:[ 2f1b 2f2f:[ 2f2f1b 2f2f2b ] "
                                  "2f3b ] 3b ");
diff --git a/chrome/browser/ui/cocoa/bookmarks/bookmark_bar_folder_view_unittest.mm b/chrome/browser/ui/cocoa/bookmarks/bookmark_bar_folder_view_unittest.mm
index fcb01b3..089d304 100644
--- a/chrome/browser/ui/cocoa/bookmarks/bookmark_bar_folder_view_unittest.mm
+++ b/chrome/browser/ui/cocoa/bookmarks/bookmark_bar_folder_view_unittest.mm
@@ -67,7 +67,7 @@
     view_.reset([[BookmarkBarFolderView alloc] init]);
 
     mock_controller_.reset(GetMockController(
-        YES, BookmarkModelFactory::GetForProfile(profile())));
+        YES, BookmarkModelFactory::GetForBrowserContext(profile())));
 
     mock_button_.reset(GetMockButton(mock_controller_.get()));
     [view_ awakeFromNib];
@@ -129,7 +129,7 @@
 
   id GetMockButton(id mock_controller) {
     BookmarkModel* bookmark_model =
-        BookmarkModelFactory::GetForProfile(profile());
+        BookmarkModelFactory::GetForBrowserContext(profile());
     const BookmarkNode* node =
         bookmark_model->AddURL(bookmark_model->bookmark_bar_node(),
                                0,
@@ -167,10 +167,10 @@
       testing_profile_manager()->CreateTestingProfile("other");
   other_profile->CreateBookmarkModel(true);
   bookmarks::test::WaitForBookmarkModelToLoad(
-      BookmarkModelFactory::GetForProfile(other_profile));
+      BookmarkModelFactory::GetForBrowserContext(other_profile));
 
   mock_controller_.reset(GetMockController(
-      YES, BookmarkModelFactory::GetForProfile(other_profile)));
+      YES, BookmarkModelFactory::GetForBrowserContext(other_profile)));
   [view_ setController:mock_controller_];
 
   id drag_info = GetFakeDragInfoForType(
@@ -212,7 +212,7 @@
   EXPECT_TRUE([view_ dropIndicatorShown]);
   EXPECT_EQ([view_ dropIndicatorPosition], kFakeIndicatorPos);
   mock_controller_.reset(GetMockController(
-      NO, BookmarkModelFactory::GetForProfile(profile())));
+      NO, BookmarkModelFactory::GetForBrowserContext(profile())));
   [view_ setController:mock_controller_];
   [[[mock_controller_ expect] andReturnUnsignedInteger:NSDragOperationNone]
    draggingEntered:drag_info];
diff --git a/chrome/browser/ui/cocoa/bookmarks/bookmark_bar_view_cocoa_unittest.mm b/chrome/browser/ui/cocoa/bookmarks/bookmark_bar_view_cocoa_unittest.mm
index b0d8d40..528969b 100644
--- a/chrome/browser/ui/cocoa/bookmarks/bookmark_bar_view_cocoa_unittest.mm
+++ b/chrome/browser/ui/cocoa/bookmarks/bookmark_bar_view_cocoa_unittest.mm
@@ -223,7 +223,7 @@
   [info reset];
 
   BookmarkModel* bookmark_model =
-      BookmarkModelFactory::GetForProfile(profile());
+      BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* node =
       bookmark_model->AddURL(bookmark_model->bookmark_bar_node(),
                              0,
@@ -264,7 +264,7 @@
   other_profile->CreateBookmarkModel(true);
 
   BookmarkModel* bookmark_model =
-      BookmarkModelFactory::GetForProfile(profile());
+      BookmarkModelFactory::GetForBrowserContext(profile());
   bookmarks::test::WaitForBookmarkModelToLoad(bookmark_model);
 
   const BookmarkNode* node =
@@ -285,7 +285,8 @@
   [info setDragDataType:ui::ClipboardUtil::UTIForPasteboardType(
                             kBookmarkButtonDragType)];
   [info setButton:dragged_button.get()];
-  [info setBookmarkModel:BookmarkModelFactory::GetForProfile(other_profile)];
+  [info setBookmarkModel:BookmarkModelFactory::GetForBrowserContext(
+                             other_profile)];
   EXPECT_EQ([view_ draggingEntered:(id)info.get()], NSDragOperationMove);
   EXPECT_TRUE([view_ performDragOperation:(id)info.get()]);
   EXPECT_TRUE([info dragButtonToPong]);
diff --git a/chrome/browser/ui/cocoa/bookmarks/bookmark_bubble_controller_unittest.mm b/chrome/browser/ui/cocoa/bookmarks/bookmark_bubble_controller_unittest.mm
index c914868..ea9e7f7 100644
--- a/chrome/browser/ui/cocoa/bookmarks/bookmark_bubble_controller_unittest.mm
+++ b/chrome/browser/ui/cocoa/bookmarks/bookmark_bubble_controller_unittest.mm
@@ -82,7 +82,8 @@
       [controller_ close];
       controller_ = nil;
     }
-    BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+    BookmarkModel* model =
+        BookmarkModelFactory::GetForBrowserContext(profile());
     bookmarks::ManagedBookmarkService* managed =
         ManagedBookmarkServiceFactory::GetForProfile(profile());
     controller_ = [[BookmarkBubbleController alloc]
@@ -101,7 +102,7 @@
   }
 
   BookmarkModel* GetBookmarkModel() {
-    return BookmarkModelFactory::GetForProfile(profile());
+    return BookmarkModelFactory::GetForBrowserContext(profile());
   }
 
   const BookmarkNode* CreateTestBookmark() {
@@ -391,7 +392,7 @@
 // the user clicking the star, then sending the "cancel" command to represent
 // them pressing escape. The bookmark should not be there.
 TEST_F(BookmarkBubbleControllerTest, EscapeRemovesNewBookmark) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   bookmarks::ManagedBookmarkService* managed =
       ManagedBookmarkServiceFactory::GetForProfile(profile());
   const BookmarkNode* node = CreateTestBookmark();
diff --git a/chrome/browser/ui/cocoa/bookmarks/bookmark_button_cell_unittest.mm b/chrome/browser/ui/cocoa/bookmarks/bookmark_button_cell_unittest.mm
index d83d85f9..04b1493 100644
--- a/chrome/browser/ui/cocoa/bookmarks/bookmark_button_cell_unittest.mm
+++ b/chrome/browser/ui/cocoa/bookmarks/bookmark_button_cell_unittest.mm
@@ -99,7 +99,7 @@
   [cell setMenu:[[[NSMenu alloc] initWithTitle:@"foo"] autorelease]];
   EXPECT_FALSE([cell menu]);
 
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* node = model->bookmark_bar_node();
   [cell setEmpty:NO];
   [cell setBookmarkNode:node];
@@ -110,7 +110,7 @@
 }
 
 TEST_F(BookmarkButtonCellTest, BookmarkNode) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   base::scoped_nsobject<BookmarkButtonCell> cell(
       [[BookmarkButtonCell alloc] initTextCell:@"Testing"]);
 
@@ -160,7 +160,7 @@
 
 // Subfolder arrow details.
 TEST_F(BookmarkButtonCellTest, FolderArrow) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* bar = model->bookmark_bar_node();
   const BookmarkNode* node = model->AddURL(bar, bar->child_count(),
                                            base::ASCIIToUTF16("title"),
@@ -184,7 +184,7 @@
 }
 
 TEST_F(BookmarkButtonCellTest, VerticalTextOffset) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* bar = model->bookmark_bar_node();
   const BookmarkNode* node = model->AddURL(bar, bar->child_count(),
                                            base::ASCIIToUTF16("title"),
diff --git a/chrome/browser/ui/cocoa/bookmarks/bookmark_button_unittest.mm b/chrome/browser/ui/cocoa/bookmarks/bookmark_button_unittest.mm
index 1c34670..a510d2b 100644
--- a/chrome/browser/ui/cocoa/bookmarks/bookmark_button_unittest.mm
+++ b/chrome/browser/ui/cocoa/bookmarks/bookmark_button_unittest.mm
@@ -91,7 +91,7 @@
   // Since this returns (does not actually begin a modal drag), success!
   [button beginDrag:downEvent];
 
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* node = model->bookmark_bar_node();
   [cell setBookmarkNode:node];
   EXPECT_FALSE([button isEmpty]);
@@ -144,7 +144,7 @@
   [button setDelegate:delegate];
 
   // Add a deletable bookmark to the button.
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* barNode = model->bookmark_bar_node();
   const BookmarkNode* node = model->AddURL(barNode, 0,
                                            base::ASCIIToUTF16("hi mom"),
diff --git a/chrome/browser/ui/cocoa/bookmarks/bookmark_drag_drop_cocoa.mm b/chrome/browser/ui/cocoa/bookmarks/bookmark_drag_drop_cocoa.mm
index 7fc523e..21481ef 100644
--- a/chrome/browser/ui/cocoa/bookmarks/bookmark_drag_drop_cocoa.mm
+++ b/chrome/browser/ui/cocoa/bookmarks/bookmark_drag_drop_cocoa.mm
@@ -79,8 +79,8 @@
                                            pressure:1.0];
 
   // TODO(avi): Do better than this offset.
-  NSImage* drag_image = MakeDragImage(
-      BookmarkModelFactory::GetForProfile(profile), nodes);
+  NSImage* drag_image =
+      MakeDragImage(BookmarkModelFactory::GetForBrowserContext(profile), nodes);
   NSSize image_size = [drag_image size];
   position.x -= std::floor(image_size.width / 2);
   position.y -= std::floor(image_size.height / 5);
diff --git a/chrome/browser/ui/cocoa/bookmarks/bookmark_editor_base_controller.mm b/chrome/browser/ui/cocoa/bookmarks/bookmark_editor_base_controller.mm
index dd75c04..43648fb1 100644
--- a/chrome/browser/ui/cocoa/bookmarks/bookmark_editor_base_controller.mm
+++ b/chrome/browser/ui/cocoa/bookmarks/bookmark_editor_base_controller.mm
@@ -342,7 +342,7 @@
 #pragma mark Folder Tree Management
 
 - (BookmarkModel*)bookmarkModel {
-  return BookmarkModelFactory::GetForProfile(profile_);
+  return BookmarkModelFactory::GetForBrowserContext(profile_);
 }
 
 - (Profile*)profile {
@@ -481,7 +481,7 @@
   // of ancestor nodes.  Then crawl down the folderTreeArray looking
   // for each ancestor in order while building up the selectionPath.
   std::stack<const BookmarkNode*> nodeStack;
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile_);
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile_);
   const BookmarkNode* rootNode = model->root_node();
   const BookmarkNode* node = desiredNode;
   while (node != rootNode) {
@@ -539,7 +539,7 @@
 
 - (void)buildFolderTree {
   // Build up a tree of the current folder configuration.
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile_);
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile_);
   const BookmarkNode* rootNode = model->root_node();
   NSMutableArray* baseArray = [self addChildFoldersFromNode:rootNode];
   DCHECK(baseArray);
diff --git a/chrome/browser/ui/cocoa/bookmarks/bookmark_editor_base_controller_unittest.mm b/chrome/browser/ui/cocoa/bookmarks/bookmark_editor_base_controller_unittest.mm
index 7c3f346b..c857da1 100644
--- a/chrome/browser/ui/cocoa/bookmarks/bookmark_editor_base_controller_unittest.mm
+++ b/chrome/browser/ui/cocoa/bookmarks/bookmark_editor_base_controller_unittest.mm
@@ -44,7 +44,8 @@
     //             b-30
     //             b-31
     //            b-4
-    BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+    BookmarkModel* model =
+        BookmarkModelFactory::GetForBrowserContext(profile());
     const BookmarkNode* root = model->bookmark_bar_node();
     folder_a_ = model->AddFolder(root, 0, ASCIIToUTF16("a"));
     model->AddURL(folder_a_, 0, ASCIIToUTF16("a-0"), GURL("http://a-0.com"));
@@ -107,7 +108,7 @@
 };
 
 TEST_F(BookmarkEditorBaseControllerTest, VerifyBookmarkTestModel) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   EXPECT_EQ(4, root->child_count());
   // a
@@ -187,7 +188,7 @@
 }
 
 TEST_F(BookmarkEditorBaseControllerTest, CreateTwoFolders) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* bar = model->bookmark_bar_node();
   // Create 2 folders which are children of the bar.
   [controller_ selectTestNodeInBrowser:bar];
@@ -201,7 +202,7 @@
 }
 
 TEST_F(BookmarkEditorBaseControllerTest, SelectedFolderDeleted) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   [controller_ selectTestNodeInBrowser:folder_b_3_];
   EXPECT_EQ(folder_b_3_, [controller_ selectedNode]);
 
@@ -213,7 +214,7 @@
 }
 
 TEST_F(BookmarkEditorBaseControllerTest, SelectedFoldersParentDeleted) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
   [controller_ selectTestNodeInBrowser:folder_b_3_];
   EXPECT_EQ(folder_b_3_, [controller_ selectedNode]);
@@ -226,7 +227,7 @@
 }
 
 TEST_F(BookmarkEditorBaseControllerTest, FolderAdded) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* root = model->bookmark_bar_node();
 
   // Add a folder node to the model, and verify it can be selected in the tree:
@@ -240,7 +241,7 @@
 
 // Verifies expandeNodes and getExpandedNodes.
 TEST_F(BookmarkEditorBaseControllerTest, ExpandedState) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
 
   // Sets up the state we're going to expand.
   BookmarkExpandedStateTracker::Nodes nodes;
diff --git a/chrome/browser/ui/cocoa/bookmarks/bookmark_editor_controller_unittest.mm b/chrome/browser/ui/cocoa/bookmarks/bookmark_editor_controller_unittest.mm
index bd8eda46..5a9a095 100644
--- a/chrome/browser/ui/cocoa/bookmarks/bookmark_editor_controller_unittest.mm
+++ b/chrome/browser/ui/cocoa/bookmarks/bookmark_editor_controller_unittest.mm
@@ -32,7 +32,8 @@
     CocoaProfileTest::SetUp();
     ASSERT_TRUE(profile());
 
-    BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+    BookmarkModel* model =
+        BookmarkModelFactory::GetForBrowserContext(profile());
     default_parent_ = model->bookmark_bar_node();
     default_name_ = "http://www.zim-bop-a-dee.com/";
     default_title_ = ASCIIToUTF16("ooh title");
@@ -95,7 +96,7 @@
 TEST_F(BookmarkEditorControllerTest, NodeDeleted) {
   // Delete the bookmark being edited and verify the sheet cancels itself:
   ASSERT_TRUE([test_window() attachedSheet]);
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   model->Remove(default_parent_->GetChild(0));
   ASSERT_FALSE([test_window() attachedSheet]);
 }
@@ -146,7 +147,8 @@
     CocoaProfileTest::SetUp();
     ASSERT_TRUE(profile());
 
-    BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+    BookmarkModel* model =
+        BookmarkModelFactory::GetForBrowserContext(profile());
     const BookmarkNode* parent = model->bookmark_bar_node();
     controller_ = [[BookmarkEditorController alloc]
                    initWithParentWindow:test_window()
@@ -182,7 +184,8 @@
     CocoaProfileTest::SetUp();
     ASSERT_TRUE(profile());
 
-    BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+    BookmarkModel* model =
+        BookmarkModelFactory::GetForBrowserContext(profile());
     const BookmarkNode* parent = model->bookmark_bar_node();
     default_title_ = ASCIIToUTF16("wooh title");
     const BookmarkNode* node =
@@ -224,7 +227,8 @@
     CocoaProfileTest::SetUp();
     ASSERT_TRUE(profile());
 
-    BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+    BookmarkModel* model =
+        BookmarkModelFactory::GetForBrowserContext(profile());
     const BookmarkNode* parent = model->bookmark_bar_node();
     base::string16 title = ASCIIToUTF16("wooh title");
     const char* url_name = "http://www.foobar.com/心得寫作";
@@ -278,7 +282,8 @@
     //             bb-4
     //            b-1
     //            b-2
-    BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+    BookmarkModel* model =
+        BookmarkModelFactory::GetForBrowserContext(profile());
     const BookmarkNode* root = model->bookmark_bar_node();
     folder_a_ = model->AddFolder(root, 0, ASCIIToUTF16("a"));
     model->AddURL(folder_a_, 0, ASCIIToUTF16("a-0"), GURL("http://a-0.com"));
@@ -344,7 +349,8 @@
   // bookmark_bb_3_ so that it points to the new node for testing.
   void UpdateBB3() {
     std::vector<const BookmarkNode*> nodes;
-    BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+    BookmarkModel* model =
+        BookmarkModelFactory::GetForBrowserContext(profile());
     model->GetNodesByURL(bb3_url_1_, &nodes);
     if (nodes.empty())
       model->GetNodesByURL(bb3_url_2_, &nodes);
@@ -355,7 +361,7 @@
 };
 
 TEST_F(BookmarkEditorControllerTreeTest, VerifyBookmarkTestModel) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   model->root_node();
   const BookmarkNode* root = model->bookmark_bar_node();
   EXPECT_EQ(4, root->child_count());
diff --git a/chrome/browser/ui/cocoa/bookmarks/bookmark_folder_target_unittest.mm b/chrome/browser/ui/cocoa/bookmarks/bookmark_folder_target_unittest.mm
index d00cfc81..b6f9c00 100644
--- a/chrome/browser/ui/cocoa/bookmarks/bookmark_folder_target_unittest.mm
+++ b/chrome/browser/ui/cocoa/bookmarks/bookmark_folder_target_unittest.mm
@@ -40,7 +40,8 @@
     CocoaProfileTest::SetUp();
     ASSERT_TRUE(profile());
 
-    BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+    BookmarkModel* model =
+        BookmarkModelFactory::GetForBrowserContext(profile());
     bmbNode_ = model->bookmark_bar_node();
   }
 
diff --git a/chrome/browser/ui/cocoa/bookmarks/bookmark_menu_bridge.mm b/chrome/browser/ui/cocoa/bookmarks/bookmark_menu_bridge.mm
index 74fc155b..ffe175b 100644
--- a/chrome/browser/ui/cocoa/bookmarks/bookmark_menu_bridge.mm
+++ b/chrome/browser/ui/cocoa/bookmarks/bookmark_menu_bridge.mm
@@ -202,7 +202,7 @@
 BookmarkModel* BookmarkMenuBridge::GetBookmarkModel() {
   if (!profile_)
     return NULL;
-  return BookmarkModelFactory::GetForProfile(profile_);
+  return BookmarkModelFactory::GetForBrowserContext(profile_);
 }
 
 Profile* BookmarkMenuBridge::GetProfile() {
diff --git a/chrome/browser/ui/cocoa/bookmarks/bookmark_menu_cocoa_controller_unittest.mm b/chrome/browser/ui/cocoa/bookmarks/bookmark_menu_cocoa_controller_unittest.mm
index b702282..3aad9f8 100644
--- a/chrome/browser/ui/cocoa/bookmarks/bookmark_menu_cocoa_controller_unittest.mm
+++ b/chrome/browser/ui/cocoa/bookmarks/bookmark_menu_cocoa_controller_unittest.mm
@@ -32,7 +32,7 @@
 - (id)initWithProfile:(Profile*)profile {
   if ((self = [super init])) {
     base::string16 empty;
-    BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile);
+    BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile);
     const BookmarkNode* bookmark_bar = model->bookmark_bar_node();
     nodes_[0] = model->AddURL(bookmark_bar, 0, empty, GURL("http://0.com"));
     nodes_[1] = model->AddURL(bookmark_bar, 1, empty, GURL("http://1.com"));
diff --git a/chrome/browser/ui/cocoa/bookmarks/bookmark_model_observer_for_cocoa_unittest.mm b/chrome/browser/ui/cocoa/bookmarks/bookmark_model_observer_for_cocoa_unittest.mm
index 0b6e39a..cabbd11 100644
--- a/chrome/browser/ui/cocoa/bookmarks/bookmark_model_observer_for_cocoa_unittest.mm
+++ b/chrome/browser/ui/cocoa/bookmarks/bookmark_model_observer_for_cocoa_unittest.mm
@@ -24,7 +24,7 @@
 
 
 TEST_F(BookmarkModelObserverForCocoaTest, TestCallback) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* node = model->AddURL(model->bookmark_bar_node(),
                                            0, base::ASCIIToUTF16("super"),
                                            GURL("http://www.google.com"));
diff --git a/chrome/browser/ui/cocoa/bookmarks/bookmark_name_folder_controller.mm b/chrome/browser/ui/cocoa/bookmarks/bookmark_name_folder_controller.mm
index 4d4ca0e..6f9436a 100644
--- a/chrome/browser/ui/cocoa/bookmarks/bookmark_name_folder_controller.mm
+++ b/chrome/browser/ui/cocoa/bookmarks/bookmark_name_folder_controller.mm
@@ -82,7 +82,7 @@
 - (void)runAsModalSheet {
   // Ping me when things change out from under us.
   observer_.reset(new BookmarkModelObserverForCocoa(
-      BookmarkModelFactory::GetForProfile(profile_), ^() {
+      BookmarkModelFactory::GetForBrowserContext(profile_), ^() {
         [self cancel:nil];
       }));
   observer_->StartObservingNode(node_);
@@ -101,7 +101,7 @@
   NSString* name = [nameField_ stringValue];
   if ([name length] == 0)
     name = l10n_util::GetNSStringWithFixup(IDS_BOOKMARK_EDITOR_NEW_FOLDER_NAME);
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile_);
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile_);
   if (node_) {
     model->SetTitle(node_, base::SysNSStringToUTF16(name));
   } else {
diff --git a/chrome/browser/ui/cocoa/bookmarks/bookmark_name_folder_controller_unittest.mm b/chrome/browser/ui/cocoa/bookmarks/bookmark_name_folder_controller_unittest.mm
index 7e9a3b0..d5c13291 100644
--- a/chrome/browser/ui/cocoa/bookmarks/bookmark_name_folder_controller_unittest.mm
+++ b/chrome/browser/ui/cocoa/bookmarks/bookmark_name_folder_controller_unittest.mm
@@ -25,7 +25,7 @@
 
 // Simple add of a node (at the end).
 TEST_F(BookmarkNameFolderControllerTest, AddNew) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* parent = model->bookmark_bar_node();
   EXPECT_EQ(0, parent->child_count());
 
@@ -54,7 +54,7 @@
 
 // Add new but specify a sibling.
 TEST_F(BookmarkNameFolderControllerTest, AddNewWithSibling) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* parent = model->bookmark_bar_node();
 
   // Add 2 nodes.  We will place the new folder in the middle of these.
@@ -83,7 +83,7 @@
 
 // Make sure we are allowed to create a folder named "New Folder".
 TEST_F(BookmarkNameFolderControllerTest, AddNewDefaultName) {
- BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* parent = model->bookmark_bar_node();
   EXPECT_EQ(0, parent->child_count());
 
@@ -103,7 +103,7 @@
 
 // Make sure we are allowed to create a folder with an empty name.
 TEST_F(BookmarkNameFolderControllerTest, AddNewBlankName) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* parent = model->bookmark_bar_node();
   EXPECT_EQ(0, parent->child_count());
 
@@ -122,7 +122,7 @@
 }
 
 TEST_F(BookmarkNameFolderControllerTest, Rename) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* parent = model->bookmark_bar_node();
   const BookmarkNode* folder = model->AddFolder(parent,
                                                 parent->child_count(),
@@ -145,7 +145,7 @@
 }
 
 TEST_F(BookmarkNameFolderControllerTest, EditAndConfirmOKButton) {
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* parent = model->bookmark_bar_node();
   EXPECT_EQ(0, parent->child_count());
 
diff --git a/chrome/browser/ui/cocoa/browser_window_controller.mm b/chrome/browser/ui/cocoa/browser_window_controller.mm
index feba74a2..907fb1e5 100644
--- a/chrome/browser/ui/cocoa/browser_window_controller.mm
+++ b/chrome/browser/ui/cocoa/browser_window_controller.mm
@@ -1551,7 +1551,7 @@
         browser_.get(), url, alreadyMarked);
   } else {
     BookmarkModel* model =
-        BookmarkModelFactory::GetForProfile(browser_->profile());
+        BookmarkModelFactory::GetForBrowserContext(browser_->profile());
     bookmarks::ManagedBookmarkService* managed =
         ManagedBookmarkServiceFactory::GetForProfile(browser_->profile());
     const BookmarkNode* node = model->GetMostRecentlyAddedUserNodeForURL(url);
diff --git a/chrome/browser/ui/cocoa/cocoa_profile_test.mm b/chrome/browser/ui/cocoa/cocoa_profile_test.mm
index fec2695..15bf25d 100644
--- a/chrome/browser/ui/cocoa/cocoa_profile_test.mm
+++ b/chrome/browser/ui/cocoa/cocoa_profile_test.mm
@@ -72,7 +72,7 @@
 
   profile_->CreateBookmarkModel(true);
   bookmarks::test::WaitForBookmarkModelToLoad(
-      BookmarkModelFactory::GetForProfile(profile_));
+      BookmarkModelFactory::GetForBrowserContext(profile_));
 
   browser_.reset(CreateBrowser());
   ASSERT_TRUE(browser_.get());
diff --git a/chrome/browser/ui/cocoa/view_id_util_browsertest.mm b/chrome/browser/ui/cocoa/view_id_util_browsertest.mm
index 73827e4c..55103fe 100644
--- a/chrome/browser/ui/cocoa/view_id_util_browsertest.mm
+++ b/chrome/browser/ui/cocoa/view_id_util_browsertest.mm
@@ -56,7 +56,7 @@
 
     // Create a bookmark to test VIEW_ID_BOOKMARK_BAR_ELEMENT
     BookmarkModel* bookmark_model =
-        BookmarkModelFactory::GetForProfile(browser()->profile());
+        BookmarkModelFactory::GetForBrowserContext(browser()->profile());
     if (bookmark_model) {
       if (!bookmark_model->loaded())
         bookmarks::test::WaitForBookmarkModelToLoad(bookmark_model);
diff --git a/chrome/browser/ui/omnibox/chrome_omnibox_client.cc b/chrome/browser/ui/omnibox/chrome_omnibox_client.cc
index 8ded01b..1105bd3 100644
--- a/chrome/browser/ui/omnibox/chrome_omnibox_client.cc
+++ b/chrome/browser/ui/omnibox/chrome_omnibox_client.cc
@@ -190,7 +190,7 @@
 }
 
 bookmarks::BookmarkModel* ChromeOmniboxClient::GetBookmarkModel() {
-  return BookmarkModelFactory::GetForProfile(profile_);
+  return BookmarkModelFactory::GetForBrowserContext(profile_);
 }
 
 TemplateURLService* ChromeOmniboxClient::GetTemplateURLService() {
diff --git a/chrome/browser/ui/omnibox/omnibox_view_browsertest.cc b/chrome/browser/ui/omnibox/omnibox_view_browsertest.cc
index 60e5b31..9fea9c0 100644
--- a/chrome/browser/ui/omnibox/omnibox_view_browsertest.cc
+++ b/chrome/browser/ui/omnibox/omnibox_view_browsertest.cc
@@ -306,7 +306,7 @@
     }
 
     BookmarkModel* bookmark_model =
-        BookmarkModelFactory::GetForProfile(profile);
+        BookmarkModelFactory::GetForBrowserContext(profile);
     ASSERT_TRUE(bookmark_model);
     bookmarks::test::WaitForBookmarkModelToLoad(bookmark_model);
 
diff --git a/chrome/browser/ui/sync/profile_signin_confirmation_helper.cc b/chrome/browser/ui/sync/profile_signin_confirmation_helper.cc
index 8d3818b..bd962524 100644
--- a/chrome/browser/ui/sync/profile_signin_confirmation_helper.cc
+++ b/chrome/browser/ui/sync/profile_signin_confirmation_helper.cc
@@ -33,7 +33,8 @@
 const int kHistoryEntriesBeforeNewProfilePrompt = 10;
 
 bool HasBookmarks(Profile* profile) {
-  BookmarkModel* bookmarks = BookmarkModelFactory::GetForProfile(profile);
+  BookmarkModel* bookmarks =
+      BookmarkModelFactory::GetForBrowserContext(profile);
   bool has_bookmarks = bookmarks && bookmarks->HasBookmarks();
   if (has_bookmarks)
     DVLOG(1) << "SigninConfirmationHelper: profile contains bookmarks";
diff --git a/chrome/browser/ui/sync/profile_signin_confirmation_helper_unittest.cc b/chrome/browser/ui/sync/profile_signin_confirmation_helper_unittest.cc
index ce887fd..1fc48d9 100644
--- a/chrome/browser/ui/sync/profile_signin_confirmation_helper_unittest.cc
+++ b/chrome/browser/ui/sync/profile_signin_confirmation_helper_unittest.cc
@@ -144,7 +144,7 @@
 
     // Initialize the services we check.
     profile_->CreateBookmarkModel(true);
-    model_ = BookmarkModelFactory::GetForProfile(profile_.get());
+    model_ = BookmarkModelFactory::GetForBrowserContext(profile_.get());
     bookmarks::test::WaitForBookmarkModelToLoad(model_);
     ASSERT_TRUE(profile_->CreateHistoryService(true, false));
 #if defined(ENABLE_EXTENSIONS)
diff --git a/chrome/browser/ui/tab_helpers.cc b/chrome/browser/ui/tab_helpers.cc
index d46da69..3aad1e61 100644
--- a/chrome/browser/ui/tab_helpers.cc
+++ b/chrome/browser/ui/tab_helpers.cc
@@ -188,9 +188,8 @@
 #if BUILDFLAG(ANDROID_JAVA_UI)
   banners::AppBannerManagerAndroid::CreateForWebContents(web_contents);
   BookmarkLastVisitUpdater::CreateForWebContentsWithBookmarkModel(
-      web_contents,
-      BookmarkModelFactory::GetForProfile(
-          Profile::FromBrowserContext(web_contents->GetBrowserContext())));
+      web_contents, BookmarkModelFactory::GetForBrowserContext(
+                        web_contents->GetBrowserContext()));
   ContextMenuHelper::CreateForWebContents(web_contents);
   DataUseTabHelper::CreateForWebContents(web_contents);
 
diff --git a/chrome/browser/ui/views/bookmarks/bookmark_bar_view.cc b/chrome/browser/ui/views/bookmarks/bookmark_bar_view.cc
index 884ab33..520c8bf 100644
--- a/chrome/browser/ui/views/bookmarks/bookmark_bar_view.cc
+++ b/chrome/browser/ui/views/bookmarks/bookmark_bar_view.cc
@@ -1661,7 +1661,7 @@
 
   set_context_menu_controller(this);
 
-  model_ = BookmarkModelFactory::GetForProfile(browser_->profile());
+  model_ = BookmarkModelFactory::GetForBrowserContext(browser_->profile());
   managed_ = ManagedBookmarkServiceFactory::GetForProfile(browser_->profile());
   if (model_) {
     model_->AddObserver(this);
diff --git a/chrome/browser/ui/views/bookmarks/bookmark_bar_view_test.cc b/chrome/browser/ui/views/bookmarks/bookmark_bar_view_test.cc
index ae92edf..8e29d52 100644
--- a/chrome/browser/ui/views/bookmarks/bookmark_bar_view_test.cc
+++ b/chrome/browser/ui/views/bookmarks/bookmark_bar_view_test.cc
@@ -288,7 +288,7 @@
 
     profile_.reset(new TestingProfile());
     profile_->CreateBookmarkModel(true);
-    model_ = BookmarkModelFactory::GetForProfile(profile_.get());
+    model_ = BookmarkModelFactory::GetForBrowserContext(profile_.get());
     bookmarks::test::WaitForBookmarkModelToLoad(model_);
     profile_->GetPrefs()->SetBoolean(bookmarks::prefs::kShowBookmarkBar, true);
 
diff --git a/chrome/browser/ui/views/bookmarks/bookmark_bar_view_unittest.cc b/chrome/browser/ui/views/bookmarks/bookmark_bar_view_unittest.cc
index f9f9b64..5f92ab6 100644
--- a/chrome/browser/ui/views/bookmarks/bookmark_bar_view_unittest.cc
+++ b/chrome/browser/ui/views/bookmarks/bookmark_bar_view_unittest.cc
@@ -85,13 +85,14 @@
 
   void WaitForBookmarkModelToLoad() {
     bookmarks::test::WaitForBookmarkModelToLoad(
-        BookmarkModelFactory::GetForProfile(profile()));
+        BookmarkModelFactory::GetForBrowserContext(profile()));
   }
 
   // Adds nodes to the bookmark bar node from |string|. See
   // bookmarks::test::AddNodesFromModelString() for details on |string|.
   void AddNodesToBookmarkBarFromModelString(const std::string& string) {
-    BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+    BookmarkModel* model =
+        BookmarkModelFactory::GetForBrowserContext(profile());
     bookmarks::test::AddNodesFromModelString(model, model->bookmark_bar_node(),
                                              string);
   }
@@ -196,7 +197,7 @@
 TEST_F(BookmarkBarViewTest, ButtonsDynamicallyAddedAfterModelHasNodes) {
   profile()->CreateBookmarkModel(true);
   WaitForBookmarkModelToLoad();
-  EXPECT_TRUE(BookmarkModelFactory::GetForProfile(profile())->loaded());
+  EXPECT_TRUE(BookmarkModelFactory::GetForBrowserContext(profile())->loaded());
   AddNodesToBookmarkBarFromModelString("a b c d e f ");
   CreateBookmarkBarView();
   EXPECT_EQ(0, test_helper_->GetBookmarkButtonCount());
@@ -214,7 +215,7 @@
 // Verifies buttons are added as the model and size change.
 TEST_F(BookmarkBarViewTest, ButtonsDynamicallyAdded) {
   CreateBookmarkModelAndBookmarkBarView();
-  EXPECT_TRUE(BookmarkModelFactory::GetForProfile(profile())->loaded());
+  EXPECT_TRUE(BookmarkModelFactory::GetForBrowserContext(profile())->loaded());
   AddNodesToBookmarkBarFromModelString("a b c d e f ");
   EXPECT_EQ(0, test_helper_->GetBookmarkButtonCount());
   SizeUntilButtonsVisible(1);
@@ -239,7 +240,7 @@
 // Various assertions for removing nodes.
 TEST_F(BookmarkBarViewTest, RemoveNode) {
   CreateBookmarkModelAndBookmarkBarView();
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* bookmark_bar_node = model->bookmark_bar_node();
   AddNodesToBookmarkBarFromModelString("a b c d e f ");
   EXPECT_EQ(0, test_helper_->GetBookmarkButtonCount());
@@ -258,7 +259,7 @@
 // Assertions for moving a node on the bookmark bar.
 TEST_F(BookmarkBarViewTest, MoveNode) {
   CreateBookmarkModelAndBookmarkBarView();
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* bookmark_bar_node = model->bookmark_bar_node();
   AddNodesToBookmarkBarFromModelString("a b c d e f ");
   EXPECT_EQ(0, test_helper_->GetBookmarkButtonCount());
@@ -290,7 +291,7 @@
 // Assertions for changing the title of a node.
 TEST_F(BookmarkBarViewTest, ChangeTitle) {
   CreateBookmarkModelAndBookmarkBarView();
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile());
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile());
   const BookmarkNode* bookmark_bar_node = model->bookmark_bar_node();
   AddNodesToBookmarkBarFromModelString("a b c d e f ");
   EXPECT_EQ(0, test_helper_->GetBookmarkButtonCount());
diff --git a/chrome/browser/ui/views/bookmarks/bookmark_bubble_view.cc b/chrome/browser/ui/views/bookmarks/bookmark_bubble_view.cc
index c91ea3c..ec906adf 100644
--- a/chrome/browser/ui/views/bookmarks/bookmark_bubble_view.cc
+++ b/chrome/browser/ui/views/bookmarks/bookmark_bubble_view.cc
@@ -92,7 +92,7 @@
   bookmark_bubble_->SetArrowPaintType(views::BubbleBorder::PAINT_TRANSPARENT);
 
   if (bookmark_bubble_->observer_) {
-    BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile);
+    BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile);
     const BookmarkNode* node = model->GetMostRecentlyAddedUserNodeForURL(url);
     bookmark_bubble_->observer_->OnBookmarkBubbleShown(node);
   }
@@ -108,7 +108,7 @@
   if (apply_edits_) {
     ApplyEdits();
   } else if (remove_bookmark_) {
-    BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile_);
+    BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile_);
     const BookmarkNode* node = model->GetMostRecentlyAddedUserNodeForURL(url_);
     if (node)
       model->Remove(node);
@@ -255,8 +255,8 @@
       profile_(profile),
       url_(url),
       newly_bookmarked_(newly_bookmarked),
-      parent_model_(BookmarkModelFactory::GetForProfile(profile_),
-                    BookmarkModelFactory::GetForProfile(profile_)
+      parent_model_(BookmarkModelFactory::GetForBrowserContext(profile_),
+                    BookmarkModelFactory::GetForBrowserContext(profile_)
                         ->GetMostRecentlyAddedUserNodeForURL(url)),
       remove_button_(nullptr),
       edit_button_(nullptr),
@@ -268,7 +268,7 @@
 
 base::string16 BookmarkBubbleView::GetTitle() {
   BookmarkModel* bookmark_model =
-      BookmarkModelFactory::GetForProfile(profile_);
+      BookmarkModelFactory::GetForBrowserContext(profile_);
   const BookmarkNode* node =
       bookmark_model->GetMostRecentlyAddedUserNodeForURL(url_);
   if (node)
@@ -315,8 +315,9 @@
 }
 
 void BookmarkBubbleView::ShowEditor() {
-  const BookmarkNode* node = BookmarkModelFactory::GetForProfile(
-      profile_)->GetMostRecentlyAddedUserNodeForURL(url_);
+  const BookmarkNode* node =
+      BookmarkModelFactory::GetForBrowserContext(profile_)
+          ->GetMostRecentlyAddedUserNodeForURL(url_);
   gfx::NativeWindow native_parent =
       anchor_widget() ? anchor_widget()->GetNativeWindow()
                       : platform_util::GetTopLevel(parent_window());
@@ -336,7 +337,7 @@
   // Set this to make sure we don't attempt to apply edits again.
   apply_edits_ = false;
 
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile_);
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile_);
   const BookmarkNode* node = model->GetMostRecentlyAddedUserNodeForURL(url_);
   if (node) {
     const base::string16 new_title = title_tf_->text();
diff --git a/chrome/browser/ui/views/bookmarks/bookmark_bubble_view_unittest.cc b/chrome/browser/ui/views/bookmarks/bookmark_bubble_view_unittest.cc
index 0aa083b..bd8313386 100644
--- a/chrome/browser/ui/views/bookmarks/bookmark_bubble_view_unittest.cc
+++ b/chrome/browser/ui/views/bookmarks/bookmark_bubble_view_unittest.cc
@@ -35,7 +35,7 @@
 
     profile()->CreateBookmarkModel(true);
     BookmarkModel* bookmark_model =
-        BookmarkModelFactory::GetForProfile(profile());
+        BookmarkModelFactory::GetForBrowserContext(profile());
     bookmarks::test::WaitForBookmarkModelToLoad(bookmark_model);
 
     bookmarks::AddIfNotBookmarked(
diff --git a/chrome/browser/ui/views/bookmarks/bookmark_context_menu_unittest.cc b/chrome/browser/ui/views/bookmarks/bookmark_context_menu_unittest.cc
index 26064fe5..5f4997e 100644
--- a/chrome/browser/ui/views/bookmarks/bookmark_context_menu_unittest.cc
+++ b/chrome/browser/ui/views/bookmarks/bookmark_context_menu_unittest.cc
@@ -70,7 +70,7 @@
     profile_.reset(new TestingProfile());
     profile_->CreateBookmarkModel(true);
 
-    model_ = BookmarkModelFactory::GetForProfile(profile_.get());
+    model_ = BookmarkModelFactory::GetForBrowserContext(profile_.get());
     bookmarks::test::WaitForBookmarkModelToLoad(model_);
 
     AddTestData();
diff --git a/chrome/browser/ui/views/bookmarks/bookmark_drag_drop_views.cc b/chrome/browser/ui/views/bookmarks/bookmark_drag_drop_views.cc
index fe5c259d8..9eaa155 100644
--- a/chrome/browser/ui/views/bookmarks/bookmark_drag_drop_views.cc
+++ b/chrome/browser/ui/views/bookmarks/bookmark_drag_drop_views.cc
@@ -36,7 +36,7 @@
       base::MessageLoop::current());
 
   int operation = ui::DragDropTypes::DRAG_COPY | ui::DragDropTypes::DRAG_LINK;
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile);
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile);
   if (bookmarks::CanAllBeEditedByUser(model->client(), nodes))
     operation |= ui::DragDropTypes::DRAG_MOVE;
 
diff --git a/chrome/browser/ui/views/bookmarks/bookmark_editor_view.cc b/chrome/browser/ui/views/bookmarks/bookmark_editor_view.cc
index 4edbd56..d645c17f 100644
--- a/chrome/browser/ui/views/bookmarks/bookmark_editor_view.cc
+++ b/chrome/browser/ui/views/bookmarks/bookmark_editor_view.cc
@@ -64,7 +64,7 @@
       title_tf_(NULL),
       parent_(parent),
       details_(details),
-      bb_model_(BookmarkModelFactory::GetForProfile(profile)),
+      bb_model_(BookmarkModelFactory::GetForBrowserContext(profile)),
       running_menu_for_root_(false),
       show_tree_(configuration == SHOW_TREE) {
   DCHECK(profile);
diff --git a/chrome/browser/ui/views/bookmarks/bookmark_editor_view_unittest.cc b/chrome/browser/ui/views/bookmarks/bookmark_editor_view_unittest.cc
index d09cf03..20c893c 100644
--- a/chrome/browser/ui/views/bookmarks/bookmark_editor_view_unittest.cc
+++ b/chrome/browser/ui/views/bookmarks/bookmark_editor_view_unittest.cc
@@ -35,7 +35,7 @@
     profile_.reset(new TestingProfile());
     profile_->CreateBookmarkModel(true);
 
-    model_ = BookmarkModelFactory::GetForProfile(profile_.get());
+    model_ = BookmarkModelFactory::GetForBrowserContext(profile_.get());
     bookmarks::test::WaitForBookmarkModelToLoad(model_);
 
     AddTestData();
diff --git a/chrome/browser/ui/views/bookmarks/bookmark_menu_delegate.cc b/chrome/browser/ui/views/bookmarks/bookmark_menu_delegate.cc
index 991e509..bb7a429 100644
--- a/chrome/browser/ui/views/bookmarks/bookmark_menu_delegate.cc
+++ b/chrome/browser/ui/views/bookmarks/bookmark_menu_delegate.cc
@@ -118,7 +118,7 @@
 }
 
 const BookmarkModel* BookmarkMenuDelegate::GetBookmarkModel() const {
-  return BookmarkModelFactory::GetForProfile(profile_);
+  return BookmarkModelFactory::GetForBrowserContext(profile_);
 }
 
 bookmarks::ManagedBookmarkService*
diff --git a/chrome/browser/ui/views/bookmarks/bookmark_menu_delegate_unittest.cc b/chrome/browser/ui/views/bookmarks/bookmark_menu_delegate_unittest.cc
index 1dce3a13..6314241e 100644
--- a/chrome/browser/ui/views/bookmarks/bookmark_menu_delegate_unittest.cc
+++ b/chrome/browser/ui/views/bookmarks/bookmark_menu_delegate_unittest.cc
@@ -30,7 +30,7 @@
 
     profile()->CreateBookmarkModel(true);
 
-    model_ = BookmarkModelFactory::GetForProfile(profile());
+    model_ = BookmarkModelFactory::GetForBrowserContext(profile());
     bookmarks::test::WaitForBookmarkModelToLoad(model_);
 
     AddTestData();
diff --git a/chrome/browser/ui/views/toolbar/app_menu.cc b/chrome/browser/ui/views/toolbar/app_menu.cc
index 5640a70..99f143d5 100644
--- a/chrome/browser/ui/views/toolbar/app_menu.cc
+++ b/chrome/browser/ui/views/toolbar/app_menu.cc
@@ -803,8 +803,8 @@
 
 AppMenu::~AppMenu() {
   if (bookmark_menu_delegate_.get()) {
-    BookmarkModel* model = BookmarkModelFactory::GetForProfile(
-        browser_->profile());
+    BookmarkModel* model =
+        BookmarkModelFactory::GetForBrowserContext(browser_->profile());
     if (model)
       model->RemoveObserver(this);
   }
@@ -841,8 +841,8 @@
       views::MenuRunner::MENU_DELETED)
     return;
   if (bookmark_menu_delegate_.get()) {
-    BookmarkModel* model = BookmarkModelFactory::GetForProfile(
-        browser_->profile());
+    BookmarkModel* model =
+        BookmarkModelFactory::GetForBrowserContext(browser_->profile());
     if (model)
       model->RemoveObserver(this);
   }
@@ -1234,7 +1234,7 @@
     return;  // Already created the menu.
 
   BookmarkModel* model =
-      BookmarkModelFactory::GetForProfile(browser_->profile());
+      BookmarkModelFactory::GetForBrowserContext(browser_->profile());
   if (!model->loaded())
     return;
 
diff --git a/chrome/browser/ui/views/toolbar/toolbar_view_browsertest.cc b/chrome/browser/ui/views/toolbar/toolbar_view_browsertest.cc
index 696ff67..7fc42ce 100644
--- a/chrome/browser/ui/views/toolbar/toolbar_view_browsertest.cc
+++ b/chrome/browser/ui/views/toolbar/toolbar_view_browsertest.cc
@@ -113,7 +113,7 @@
   updater->ExecuteCommand(IDC_SHOW_BOOKMARK_BAR);
 
   BookmarkModel* model =
-      BookmarkModelFactory::GetForProfile(browser()->profile());
+      BookmarkModelFactory::GetForBrowserContext(browser()->profile());
   bookmarks::AddIfNotBookmarked(
       model, GURL("http://foo.com"), base::ASCIIToUTF16("Foo"));
 
diff --git a/chrome/browser/ui/webui/browsing_history_handler.cc b/chrome/browser/ui/webui/browsing_history_handler.cc
index 7430801..1d077ead 100644
--- a/chrome/browser/ui/webui/browsing_history_handler.cc
+++ b/chrome/browser/ui/webui/browsing_history_handler.cc
@@ -619,7 +619,7 @@
 void BrowsingHistoryHandler::HandleRemoveBookmark(const base::ListValue* args) {
   base::string16 url = ExtractStringValue(args);
   Profile* profile = Profile::FromWebUI(web_ui());
-  BookmarkModel* model = BookmarkModelFactory::GetForProfile(profile);
+  BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile);
   bookmarks::RemoveAllBookmarks(model, GURL(url));
 }
 
@@ -671,7 +671,8 @@
 
 void BrowsingHistoryHandler::ReturnResultsToFrontEnd() {
   Profile* profile = Profile::FromWebUI(web_ui());
-  BookmarkModel* bookmark_model = BookmarkModelFactory::GetForProfile(profile);
+  BookmarkModel* bookmark_model =
+      BookmarkModelFactory::GetForBrowserContext(profile);
   SupervisedUserService* supervised_user_service = NULL;
 #if defined(ENABLE_SUPERVISED_USERS)
   if (profile->IsSupervised())
diff --git a/chrome/browser/ui/webui/md_history_ui.cc b/chrome/browser/ui/webui/md_history_ui.cc
index 87642eb..01e7845d 100644
--- a/chrome/browser/ui/webui/md_history_ui.cc
+++ b/chrome/browser/ui/webui/md_history_ui.cc
@@ -49,6 +49,8 @@
   source->AddLocalizedString("delete", IDS_MD_HISTORY_DELETE);
   source->AddLocalizedString("deleteConfirm",
                              IDS_HISTORY_DELETE_PRIOR_VISITS_CONFIRM_BUTTON);
+  source->AddLocalizedString("deleteSession",
+                             IDS_HISTORY_OTHER_SESSIONS_HIDE_FOR_NOW);
   source->AddLocalizedString(
       "deleteWarning", IDS_HISTORY_DELETE_PRIOR_VISITS_WARNING_NO_INCOGNITO);
   source->AddLocalizedString("expandSessionButton",
diff --git a/chrome/browser/ui/webui/omnibox/omnibox_page_handler.cc b/chrome/browser/ui/webui/omnibox/omnibox_page_handler.cc
index 7f29d6f2..28eadd6 100644
--- a/chrome/browser/ui/webui/omnibox/omnibox_page_handler.cc
+++ b/chrome/browser/ui/webui/omnibox/omnibox_page_handler.cc
@@ -21,6 +21,7 @@
 #include "chrome/browser/autocomplete/chrome_autocomplete_scheme_classifier.h"
 #include "chrome/browser/bookmarks/bookmark_model_factory.h"
 #include "chrome/browser/history/history_service_factory.h"
+#include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/search/search.h"
 #include "chrome/browser/search_engines/template_url_service_factory.h"
 #include "components/bookmarks/browser/bookmark_model.h"
@@ -149,7 +150,8 @@
           controller_->providers());
 
   // Fill AutocompleteMatch::starred.
-  BookmarkModel* bookmark_model = BookmarkModelFactory::GetForProfile(profile_);
+  BookmarkModel* bookmark_model =
+      BookmarkModelFactory::GetForBrowserContext(profile_);
   if (bookmark_model) {
     for (size_t i = 0; i < result->combined_results.size(); ++i) {
       result->combined_results[i]->starred = bookmark_model->IsBookmarked(
diff --git a/chrome/browser/win/chrome_elf_init.cc b/chrome/browser/win/chrome_elf_init.cc
index d954dbe4..5c091296 100644
--- a/chrome/browser/win/chrome_elf_init.cc
+++ b/chrome/browser/win/chrome_elf_init.cc
@@ -18,7 +18,6 @@
 #include "chrome_elf/dll_hash/dll_hash.h"
 #include "components/variations/variations_associated_data.h"
 #include "content/public/browser/browser_thread.h"
-#include "content/public/common/content_features.h"
 
 const char kBrowserBlacklistTrialName[] = "BrowserBlacklist";
 const char kBrowserBlacklistTrialDisabledGroupName[] = "NoBlacklist";
@@ -110,22 +109,6 @@
       FROM_HERE,
       base::Bind(&ReportSuccessfulBlocks),
       base::TimeDelta::FromSeconds(kBlacklistReportingDelaySec));
-
-  // Make sure the early finch emergency "off switch" for
-  // sandbox::MITIGATION_EXTENSION_POINT_DISABLE is set properly in reg.
-  // Note: the very existence of this key signals elf to not enable
-  // this mitigation on browser next start.
-  base::win::RegKey finch_security_registry_key(
-      HKEY_CURRENT_USER, elf_sec::kRegSecurityFinchPath, KEY_READ);
-
-  if (base::FeatureList::IsEnabled(features::kWinSboxDisableExtensionPoints)) {
-    if (finch_security_registry_key.Valid())
-      finch_security_registry_key.DeleteKey(L"");
-  } else {
-    if (!finch_security_registry_key.Valid())
-      finch_security_registry_key.Create(
-          HKEY_CURRENT_USER, elf_sec::kRegSecurityFinchPath, KEY_WRITE);
-  }
 }
 
 void BrowserBlacklistBeaconSetup() {
diff --git a/chrome/common/pref_names.cc b/chrome/common/pref_names.cc
index e55a3fd..d3a8501a 100644
--- a/chrome/common/pref_names.cc
+++ b/chrome/common/pref_names.cc
@@ -1748,6 +1748,10 @@
 // storage for the user.
 const char kExternalStorageDisabled[] = "hardware.external_storage_disabled";
 
+// A pref holding the value of the policy used to limit mounting of external
+// storage to read-only mode for the user.
+const char kExternalStorageReadOnly[] = "hardware.external_storage_read_only";
+
 // Copy of owner swap mouse buttons option to use on login screen.
 const char kOwnerPrimaryMouseButtonRight[] = "owner.mouse.primary_right";
 
diff --git a/chrome/common/pref_names.h b/chrome/common/pref_names.h
index 4f95e3d..e013ace 100644
--- a/chrome/common/pref_names.h
+++ b/chrome/common/pref_names.h
@@ -622,6 +622,7 @@
 extern const char kDeviceActivityTimes[];
 extern const char kDeviceLocation[];
 extern const char kExternalStorageDisabled[];
+extern const char kExternalStorageReadOnly[];
 extern const char kOwnerPrimaryMouseButtonRight[];
 extern const char kOwnerTapToClickEnabled[];
 extern const char kUptimeLimit[];
diff --git a/chrome/test/base/testing_profile.cc b/chrome/test/base/testing_profile.cc
index eadc2369..943b927 100644
--- a/chrome/test/base/testing_profile.cc
+++ b/chrome/test/base/testing_profile.cc
@@ -194,18 +194,17 @@
 
 std::unique_ptr<KeyedService> BuildHistoryService(
     content::BrowserContext* context) {
-  Profile* profile = Profile::FromBrowserContext(context);
   return base::WrapUnique(new history::HistoryService(
       base::WrapUnique(new ChromeHistoryClient(
-          BookmarkModelFactory::GetForProfile(profile))),
-      base::WrapUnique(new history::ContentVisitDelegate(profile))));
+          BookmarkModelFactory::GetForBrowserContext(context))),
+      base::WrapUnique(new history::ContentVisitDelegate(context))));
 }
 
 std::unique_ptr<KeyedService> BuildInMemoryURLIndex(
     content::BrowserContext* context) {
   Profile* profile = Profile::FromBrowserContext(context);
   std::unique_ptr<InMemoryURLIndex> in_memory_url_index(
-      new InMemoryURLIndex(BookmarkModelFactory::GetForProfile(profile),
+      new InMemoryURLIndex(BookmarkModelFactory::GetForBrowserContext(profile),
                            HistoryServiceFactory::GetForProfile(
                                profile, ServiceAccessType::IMPLICIT_ACCESS),
                            TemplateURLServiceFactory::GetForProfile(profile),
diff --git a/chrome/test/data/webui/cr_elements/cr_shared_menu_tests.js b/chrome/test/data/webui/cr_elements/cr_shared_menu_tests.js
index 25ecbe7..c35bb2b 100644
--- a/chrome/test/data/webui/cr_elements/cr_shared_menu_tests.js
+++ b/chrome/test/data/webui/cr_elements/cr_shared_menu_tests.js
@@ -20,6 +20,13 @@
     });
   }
 
+  function afterClose(callback) {
+    menu.addEventListener('iron-overlay-closed', function f() {
+      menu.removeEventListener('iron-overlay-closed', f);
+      callback();
+    });
+  }
+
   suiteSetup(function() {
     return PolymerTest.importHtml(
         'chrome://resources/polymer/v1_0/paper-item/paper-item.html');
@@ -39,13 +46,15 @@
     menu.appendChild(item3);
 
     button = document.createElement('button');
-    button.addEventListener('tap', function() {
+    button.addEventListener('tap', function(e) {
       menu.toggleMenu(button, {});
+      e.stopPropagation();  // Prevent 'tap' from closing the dialog.
     });
 
     button2 = document.createElement('button');
-    button2.addEventListener('tap', function() {
+    button2.addEventListener('tap', function(e) {
       menu.toggleMenu(button2, {});
+      e.stopPropagation();  // Prevent 'tap' from closing the dialog.
     });
 
     document.body.appendChild(menu);
@@ -89,12 +98,14 @@
       assertEquals(item1, menu.shadowRoot.activeElement);
 
       menu.closeMenu();
-      assertFalse(menu.menuOpen);
 
-      // Button should regain focus after closing the menu.
-      assertEquals(button, document.activeElement);
+      afterClose(function() {
+        assertFalse(menu.menuOpen);
+        // Button should regain focus after closing the menu.
+        assertEquals(button, document.activeElement);
+        done();
+      });
 
-      done();
     });
   });
 
@@ -109,8 +120,10 @@
 
       afterOpen(function() {
         menu.closeMenu();
-        assertEquals(button2, document.activeElement);
-        done();
+        afterClose(function() {
+          assertEquals(button2, document.activeElement);
+          done();
+        });
       });
     });
   });
@@ -125,9 +138,11 @@
     afterOpen(function() {
       input.focus();
       menu.closeMenu();
-      assertEquals(input, document.activeElement);
 
-      done();
+      afterClose(function() {
+        assertEquals(input, document.activeElement);
+        done();
+      });
     });
   });
 
diff --git a/chrome/test/data/webui/md_history/history_item_test.js b/chrome/test/data/webui/md_history/history_item_test.js
index 94744a0..83ce632a 100644
--- a/chrome/test/data/webui/md_history/history_item_test.js
+++ b/chrome/test/data/webui/md_history/history_item_test.js
@@ -81,23 +81,19 @@
         return flush().then(function() {
           element.set('historyData_.1.starred', true);
           element.set('historyData_.5.starred', true);
+          return flush();
+        }).then(function() {
 
           items = Polymer.dom(element.root).querySelectorAll('history-item');
 
-          items[1].$['bookmark-star'].focus();
-          MockInteractions.tap(items[1].$['bookmark-star']);
+          items[1].$$('#bookmark-star').focus();
+          MockInteractions.tap(items[1].$$('#bookmark-star'));
 
           // Check that focus is shifted to overflow menu icon.
           assertEquals(items[1].root.activeElement, items[1].$['menu-button']);
           // Check that all items matching this url are unstarred.
           assertEquals(element.historyData_[1].starred, false);
           assertEquals(element.historyData_[5].starred, false);
-          assertEquals(
-              window.getComputedStyle(items[1].$['bookmark-star']).visibility,
-              'hidden');
-          assertEquals(
-              window.getComputedStyle(items[5].$['bookmark-star']).visibility,
-              'hidden');
         });
       });
 
diff --git a/chrome/test/data/webui/md_history/history_overflow_menu_test.js b/chrome/test/data/webui/md_history/history_overflow_menu_test.js
index 9ec62aa8..5f6a0cc 100644
--- a/chrome/test/data/webui/md_history/history_overflow_menu_test.js
+++ b/chrome/test/data/webui/md_history/history_overflow_menu_test.js
@@ -59,7 +59,6 @@
 
         sharedMenu.closeMenu();
         assertFalse(sharedMenu.menuOpen);
-        assertEquals(MENU_EVENT.detail.target, sharedMenu.lastAnchor_);
       });
 
       test('menu closes when search changes', function() {
diff --git a/chrome/test/data/webui/md_history/history_synced_tabs_test.js b/chrome/test/data/webui/md_history/history_synced_tabs_test.js
index 17b0c4e..f4545fa 100644
--- a/chrome/test/data/webui/md_history/history_synced_tabs_test.js
+++ b/chrome/test/data/webui/md_history/history_synced_tabs_test.js
@@ -96,8 +96,8 @@
           assertEquals(2, cards.length);
 
           // Ensure separators between windows are added appropriately.
-          assertEquals(1, numWindowSeparators(cards[0]));
-          assertEquals(2, numWindowSeparators(cards[1]));
+          assertEquals(0, numWindowSeparators(cards[0]));
+          assertEquals(1, numWindowSeparators(cards[1]));
         });
       });
 
@@ -128,7 +128,7 @@
           assertEquals(2, cards.length);
 
           // There are now 2 windows in the first device.
-          assertEquals(2, numWindowSeparators(cards[0]));
+          assertEquals(1, numWindowSeparators(cards[0]));
 
           // Check that the actual link changes.
           assertEquals(
@@ -161,18 +161,18 @@
           assertEquals(2, cards.length);
 
           // Ensure separators between windows are added appropriately.
-          assertEquals(1, numWindowSeparators(cards[0]));
-          assertEquals(3, numWindowSeparators(cards[1]));
+          assertEquals(0, numWindowSeparators(cards[0]));
+          assertEquals(2, numWindowSeparators(cards[1]));
           element.searchTerm = 'g';
 
           return flush();
         }).then(function() {
           var cards = getCards();
 
-          assertEquals(1, numWindowSeparators(cards[0]));
+          assertEquals(0, numWindowSeparators(cards[0]));
           assertEquals(1, cards[0].tabs.length);
           assertEquals('http://www.google.com', cards[0].tabs[0].title);
-          assertEquals(2, numWindowSeparators(cards[1]));
+          assertEquals(1, numWindowSeparators(cards[1]));
           assertEquals(3, cards[1].tabs.length);
           assertEquals('http://www.gmail.com', cards[1].tabs[0].title);
           assertEquals('http://www.gmail.com', cards[1].tabs[1].title);
diff --git a/chrome_elf/chrome_elf_main.cc b/chrome_elf/chrome_elf_main.cc
index 718bd8da..e2b57aa5 100644
--- a/chrome_elf/chrome_elf_main.cc
+++ b/chrome_elf/chrome_elf_main.cc
@@ -16,7 +16,6 @@
 #include "chrome_elf/blacklist/blacklist.h"
 #include "chrome_elf/blacklist/crashpad_helper.h"
 #include "chrome_elf/chrome_elf_constants.h"
-#include "chrome_elf/chrome_elf_security.h"
 #include "components/crash/content/app/crashpad.h"
 #include "components/crash/core/common/crash_keys.h"
 
@@ -121,9 +120,6 @@
 #endif
 
     install_static::InitializeProcessType();
-    if (install_static::g_process_type ==
-        install_static::ProcessType::BROWSER_PROCESS)
-      EarlyBrowserSecurity();
 
     __try {
       blacklist::Initialize(false);  // Don't force, abort if beacon is present.
diff --git a/chromeos/CHROMEOS_LKGM b/chromeos/CHROMEOS_LKGM
index 42dc3c4..c7dc3da 100644
--- a/chromeos/CHROMEOS_LKGM
+++ b/chromeos/CHROMEOS_LKGM
@@ -1 +1 @@
-8680.0.0
\ No newline at end of file
+8683.0.0
\ No newline at end of file
diff --git a/chromeos/disks/disk_mount_manager.cc b/chromeos/disks/disk_mount_manager.cc
index 48ecf910..f75e1ac4 100644
--- a/chromeos/disks/disk_mount_manager.cc
+++ b/chromeos/disks/disk_mount_manager.cc
@@ -68,7 +68,8 @@
   void MountPath(const std::string& source_path,
                  const std::string& source_format,
                  const std::string& mount_label,
-                 MountType type) override {
+                 MountType type,
+                 MountAccessMode access_mode) override {
     // Hidden and non-existent devices should not be mounted.
     if (type == MOUNT_TYPE_DEVICE) {
       DiskMap::const_iterator it = disks_.find(source_path);
@@ -79,7 +80,7 @@
       }
     }
     cros_disks_client_->Mount(
-        source_path, source_format, mount_label, MOUNT_ACCESS_MODE_READ_WRITE,
+        source_path, source_format, mount_label, access_mode,
         // When succeeds, OnMountCompleted will be called by
         // "MountCompleted" signal instead.
         base::Bind(&base::DoNothing),
diff --git a/chromeos/disks/disk_mount_manager.h b/chromeos/disks/disk_mount_manager.h
index 82506b9..949b1a7e 100644
--- a/chromeos/disks/disk_mount_manager.h
+++ b/chromeos/disks/disk_mount_manager.h
@@ -254,14 +254,19 @@
       const EnsureMountInfoRefreshedCallback& callback,
       bool force) = 0;
 
-  // Mounts a device.
+  // Mounts a device or an archive file.
+  // |source_path| specifies either a device or an archive file path.
+  // When |type|=MOUNT_TYPE_ARCHIVE, caller may set two optional arguments:
+  // |source_format| and |mount_label|. See CrosDisksClient::Mount for detail.
+  // |access_mode| specifies read-only or read-write mount mode for a device.
   // Note that the mount operation may fail. To find out the result, one should
   // observe DiskMountManager for |Observer::OnMountEvent| event, which will be
   // raised upon the mount operation completion.
   virtual void MountPath(const std::string& source_path,
                          const std::string& source_format,
                          const std::string& mount_label,
-                         MountType type) = 0;
+                         MountType type,
+                         MountAccessMode access_mode) = 0;
 
   // Unmounts a mounted disk.
   // |UnmountOptions| enum defined in chromeos/dbus/cros_disks_client.h.
diff --git a/chromeos/disks/mock_disk_mount_manager.cc b/chromeos/disks/mock_disk_mount_manager.cc
index 9ac9616..ba076bb 100644
--- a/chromeos/disks/mock_disk_mount_manager.cc
+++ b/chromeos/disks/mock_disk_mount_manager.cc
@@ -150,8 +150,7 @@
   EXPECT_CALL(*this, FindDiskBySourcePath(_))
       .Times(AnyNumber());
   EXPECT_CALL(*this, EnsureMountInfoRefreshed(_, _)).Times(AnyNumber());
-  EXPECT_CALL(*this, MountPath(_, _, _, _))
-      .Times(AnyNumber());
+  EXPECT_CALL(*this, MountPath(_, _, _, _, _)).Times(AnyNumber());
   EXPECT_CALL(*this, UnmountPath(_, _, _))
       .Times(AnyNumber());
   EXPECT_CALL(*this, FormatMountedDevice(_))
diff --git a/chromeos/disks/mock_disk_mount_manager.h b/chromeos/disks/mock_disk_mount_manager.h
index a37f8a05..ff57e437 100644
--- a/chromeos/disks/mock_disk_mount_manager.h
+++ b/chromeos/disks/mock_disk_mount_manager.h
@@ -37,8 +37,12 @@
                      const DiskMountManager::MountPointMap&(void));
   MOCK_METHOD2(EnsureMountInfoRefreshed,
                void(const EnsureMountInfoRefreshedCallback&, bool));
-  MOCK_METHOD4(MountPath, void(const std::string&, const std::string&,
-                               const std::string&, MountType));
+  MOCK_METHOD5(MountPath,
+               void(const std::string&,
+                    const std::string&,
+                    const std::string&,
+                    MountType,
+                    MountAccessMode));
   MOCK_METHOD3(UnmountPath, void(const std::string&,
                                  UnmountOptions,
                                  const DiskMountManager::UnmountPathCallback&));
diff --git a/components/nacl/broker/BUILD.gn b/components/nacl/broker/BUILD.gn
index 82b9bcc..c7d36f6 100644
--- a/components/nacl/broker/BUILD.gn
+++ b/components/nacl/broker/BUILD.gn
@@ -108,7 +108,6 @@
       "//chrome:nacl64_exe_version",
       "//components/crash/content/app:app_breakpad_mac_win_to_be_deleted",
       "//components/nacl/loader:nacl_helper_win_64",
-      "//content/public/common:static_features",
       "//content/public/common:static_switches",
       "//ppapi/proxy:ipc",
       "//sandbox",
diff --git a/content/app/sandbox_helper_win.cc b/content/app/sandbox_helper_win.cc
index 3791888e..6e06e5c4 100644
--- a/content/app/sandbox_helper_win.cc
+++ b/content/app/sandbox_helper_win.cc
@@ -19,9 +19,6 @@
         sandbox::MITIGATION_DEP |
         sandbox::MITIGATION_DEP_NO_ATL_THUNK |
         sandbox::MITIGATION_HARDEN_TOKEN_IL_POLICY);
-    // Note: these mitigations are "post-startup".  Some mitigations that need
-    // to be enabled sooner (e.g. MITIGATION_EXTENSION_POINT_DISABLE) are done
-    // so in Chrome_ELF.
   }
 }
 
diff --git a/content/browser/service_worker/service_worker_browsertest.cc b/content/browser/service_worker/service_worker_browsertest.cc
index 912a61ca..d66879da 100644
--- a/content/browser/service_worker/service_worker_browsertest.cc
+++ b/content/browser/service_worker/service_worker_browsertest.cc
@@ -384,14 +384,15 @@
                               const base::string16& message,
                               int line_number,
                               const GURL& source_url) override {
-    messages_.push_back(message);
-    if (!quit_.is_null() && messages_.size() == expected_message_count_) {
-      BrowserThread::PostTask(BrowserThread::UI, FROM_HERE, quit_);
-      quit_.Reset();
-    }
+    DCHECK_CURRENTLY_ON(BrowserThread::IO);
+    BrowserThread::PostTask(
+        BrowserThread::UI, FROM_HERE,
+        base::Bind(&ConsoleListener::OnReportConsoleMessageOnUI,
+                   base::Unretained(this), message));
   }
 
   void WaitForConsoleMessages(size_t expected_message_count) {
+    DCHECK_CURRENTLY_ON(BrowserThread::UI);
     if (messages_.size() >= expected_message_count)
       return;
 
@@ -407,6 +408,14 @@
   const std::vector<base::string16>& messages() const { return messages_; }
 
  private:
+  void OnReportConsoleMessageOnUI(const base::string16& message) {
+    DCHECK_CURRENTLY_ON(BrowserThread::UI);
+    messages_.push_back(message);
+    if (messages_.size() == expected_message_count_)
+      quit_.Run();
+  }
+
+  // These parameters must be accessed on the UI thread.
   std::vector<base::string16> messages_;
   size_t expected_message_count_;
   base::Closure quit_;
@@ -939,22 +948,16 @@
                     SERVICE_WORKER_ERROR_EVENT_WAITUNTIL_REJECTED);
 }
 
-// Has errors under TSan. See https://crbug.com/631323.
-#if defined(THREAD_SANITIZER)
-#define MAYBE_InstallWithWaitUntil_RejectConsoleMessage \
-  DISABLED_InstallWithWaitUntil_RejectConsoleMessage
-#else
-#define MAYBE_InstallWithWaitUntil_RejectConsoleMessage \
-  InstallWithWaitUntil_RejectConsoleMessage
-#endif
 IN_PROC_BROWSER_TEST_F(ServiceWorkerVersionBrowserTest,
-                       MAYBE_InstallWithWaitUntil_RejectConsoleMessage) {
+                       InstallWithWaitUntil_RejectConsoleMessage) {
   RunOnIOThread(base::Bind(&self::SetUpRegistrationOnIOThread,
                            base::Unretained(this),
                            "/service_worker/worker_install_rejected.js"));
 
   ConsoleListener console_listener;
-  version_->embedded_worker()->AddListener(&console_listener);
+  RunOnIOThread(base::Bind(&EmbeddedWorkerInstance::AddListener,
+                           base::Unretained(version_->embedded_worker()),
+                           &console_listener));
 
   // Dispatch install on a worker.
   ServiceWorkerStatusCode status = SERVICE_WORKER_ERROR_FAILED;
@@ -971,7 +974,9 @@
   console_listener.WaitForConsoleMessages(1);
   ASSERT_NE(base::string16::npos,
             console_listener.messages()[0].find(expected));
-  version_->embedded_worker()->RemoveListener(&console_listener);
+  RunOnIOThread(base::Bind(&EmbeddedWorkerInstance::RemoveListener,
+                           base::Unretained(version_->embedded_worker()),
+                           &console_listener));
 }
 
 class WaitForLoaded : public EmbeddedWorkerInstance::Listener {
@@ -979,6 +984,7 @@
   explicit WaitForLoaded(const base::Closure& quit) : quit_(quit) {}
 
   void OnThreadStarted() override {
+    DCHECK_CURRENTLY_ON(BrowserThread::IO);
     BrowserThread::PostTask(BrowserThread::UI, FROM_HERE, quit_);
   }
   bool OnMessageReceived(const IPC::Message& message) override { return false; }
@@ -987,14 +993,7 @@
   base::Closure quit_;
 };
 
-// Has errors under TSan. See https://crbug.com/631323.
-#if defined(THREAD_SANITIZER)
-#define MAYBE_TimeoutStartingWorker DISABLED_TimeoutStartingWorker
-#else
-#define MAYBE_TimeoutStartingWorker TimeoutStartingWorker
-#endif
-IN_PROC_BROWSER_TEST_F(ServiceWorkerVersionBrowserTest,
-                       MAYBE_TimeoutStartingWorker) {
+IN_PROC_BROWSER_TEST_F(ServiceWorkerVersionBrowserTest, TimeoutStartingWorker) {
   RunOnIOThread(base::Bind(&self::SetUpRegistrationOnIOThread,
                            base::Unretained(this),
                            "/service_worker/while_true_worker.js"));
@@ -1004,13 +1003,17 @@
   base::RunLoop start_run_loop;
   base::RunLoop load_run_loop;
   WaitForLoaded wait_for_load(load_run_loop.QuitClosure());
-  version_->embedded_worker()->AddListener(&wait_for_load);
+  RunOnIOThread(base::Bind(&EmbeddedWorkerInstance::AddListener,
+                           base::Unretained(version_->embedded_worker()),
+                           &wait_for_load));
   BrowserThread::PostTask(
       BrowserThread::IO, FROM_HERE,
       base::Bind(&self::StartOnIOThread, base::Unretained(this),
                  start_run_loop.QuitClosure(), &status));
   load_run_loop.Run();
-  version_->embedded_worker()->RemoveListener(&wait_for_load);
+  RunOnIOThread(base::Bind(&EmbeddedWorkerInstance::RemoveListener,
+                           base::Unretained(version_->embedded_worker()),
+                           &wait_for_load));
 
   // The script has loaded but start has not completed yet.
   ASSERT_EQ(SERVICE_WORKER_ERROR_FAILED, status);
@@ -1112,15 +1115,8 @@
   EXPECT_EQ("cache_name", response2.cache_storage_cache_name);
 }
 
-// Has errors under TSan. See https://crbug.com/631323.
-#if defined(THREAD_SANITIZER)
-#define MAYBE_FetchEvent_respondWithRejection \
-  DISABLED_FetchEvent_respondWithRejection
-#else
-#define MAYBE_FetchEvent_respondWithRejection FetchEvent_respondWithRejection
-#endif
 IN_PROC_BROWSER_TEST_F(ServiceWorkerVersionBrowserTest,
-                       MAYBE_FetchEvent_respondWithRejection) {
+                       FetchEvent_respondWithRejection) {
   ServiceWorkerFetchEventResult result;
   ServiceWorkerResponse response;
   std::unique_ptr<storage::BlobDataHandle> blob_data_handle;
@@ -1130,7 +1126,9 @@
                            "/service_worker/fetch_event_rejected.js"));
 
   ConsoleListener console_listener;
-  version_->embedded_worker()->AddListener(&console_listener);
+  RunOnIOThread(base::Bind(&EmbeddedWorkerInstance::AddListener,
+                           base::Unretained(version_->embedded_worker()),
+                           &console_listener));
 
   FetchOnRegisteredWorker(&result, &response, &blob_data_handle);
   const base::string16 expected1 = base::ASCIIToUTF16(
@@ -1141,7 +1139,9 @@
   ASSERT_NE(base::string16::npos,
             console_listener.messages()[0].find(expected1));
   ASSERT_EQ(0u, console_listener.messages()[1].find(expected2));
-  version_->embedded_worker()->RemoveListener(&console_listener);
+  RunOnIOThread(base::Bind(&EmbeddedWorkerInstance::RemoveListener,
+                           base::Unretained(version_->embedded_worker()),
+                           &console_listener));
 
   ASSERT_EQ(SERVICE_WORKER_FETCH_EVENT_RESULT_RESPONSE, result);
   EXPECT_EQ(0, response.status_code);
@@ -1781,13 +1781,13 @@
     RegisterAndActivateServiceWorker();
 
     NavigateToTestPage();
-    EXPECT_EQ(0, GetSideDataSize());
+    WaitUntilSideDataSizeIs(0);
 
     NavigateToTestPage();
-    EXPECT_EQ(0, GetSideDataSize());
+    WaitUntilSideDataSizeIs(0);
 
     NavigateToTestPage();
-    EXPECT_EQ(0, GetSideDataSize());
+    WaitUntilSideDataSizeIs(0);
   }
 
   void CheckStrategyIsNormal() {
@@ -1796,17 +1796,17 @@
     NavigateToTestPage();
     // fetch_event_response_via_cache.js returns |cloned_response| for the first
     // load. So the V8 code cache should not be stored to the CacheStorage.
-    EXPECT_EQ(0, GetSideDataSize());
+    WaitUntilSideDataSizeIs(0);
 
     NavigateToTestPage();
     // V8ScriptRunner::setCacheTimeStamp() stores 12 byte data (tag +
     // timestamp).
-    EXPECT_EQ(kV8CacheTimeStampDataSize, GetSideDataSize());
+    WaitUntilSideDataSizeIs(kV8CacheTimeStampDataSize);
 
     NavigateToTestPage();
     // The V8 code cache must be stored to the CacheStorage which must be bigger
     // than 12 byte.
-    EXPECT_GT(GetSideDataSize(), kV8CacheTimeStampDataSize);
+    WaitUntilSideDataSizeIsBiggerThan(kV8CacheTimeStampDataSize);
   }
 
   void CheckStrategyIsAggressive() {
@@ -1815,15 +1815,15 @@
     NavigateToTestPage();
     // fetch_event_response_via_cache.js returns |cloned_response| for the first
     // load. So the V8 code cache should not be stored to the CacheStorage.
-    EXPECT_EQ(0, GetSideDataSize());
+    WaitUntilSideDataSizeIs(0);
 
     NavigateToTestPage();
     // The V8 code cache must be stored to the CacheStorage which must be bigger
     // than 12 byte.
-    EXPECT_GT(GetSideDataSize(), kV8CacheTimeStampDataSize);
+    WaitUntilSideDataSizeIsBiggerThan(kV8CacheTimeStampDataSize);
 
     NavigateToTestPage();
-    EXPECT_GT(GetSideDataSize(), kV8CacheTimeStampDataSize);
+    WaitUntilSideDataSizeIsBiggerThan(kV8CacheTimeStampDataSize);
   }
 
  private:
@@ -1861,6 +1861,20 @@
         std::string("cache_name"), embedded_test_server()->GetURL(kScriptUrl));
   }
 
+  void WaitUntilSideDataSizeIs(int expected_size) {
+    while (true) {
+      if (GetSideDataSize() == expected_size)
+        return;
+    }
+  }
+
+  void WaitUntilSideDataSizeIsBiggerThan(int minimum_size) {
+    while (true) {
+      if (GetSideDataSize() > minimum_size)
+        return;
+    }
+  }
+
   DISALLOW_COPY_AND_ASSIGN(ServiceWorkerV8CacheStrategiesTest);
 };
 
diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.cc
index 6c23bd38..873f2c9d 100644
--- a/content/child/runtime_features.cc
+++ b/content/child/runtime_features.cc
@@ -261,6 +261,9 @@
       base::FeatureList::IsEnabled(features::kWebPayments));
 #endif
 
+  if (base::FeatureList::IsEnabled(features::kSpeculativeLaunchServiceWorker))
+    WebRuntimeFeatures::enableSpeculativeLaunchServiceWorker(true);
+
   // Enable explicitly enabled features, and then disable explicitly disabled
   // ones.
   if (command_line.HasSwitch(switches::kEnableBlinkFeatures)) {
diff --git a/content/common/sandbox_win.cc b/content/common/sandbox_win.cc
index 2cd1e9c3..e3b8f7d 100644
--- a/content/common/sandbox_win.cc
+++ b/content/common/sandbox_win.cc
@@ -31,7 +31,6 @@
 #include "base/win/windows_version.h"
 #include "content/common/content_switches_internal.h"
 #include "content/public/common/content_client.h"
-#include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/sandbox_init.h"
 #include "content/public/common/sandboxed_process_launcher_delegate.h"
@@ -725,10 +724,8 @@
       sandbox::MITIGATION_IMAGE_LOAD_NO_REMOTE |
       sandbox::MITIGATION_IMAGE_LOAD_NO_LOW_LABEL;
 
-  if (base::FeatureList::IsEnabled(features::kWinSboxDisableExtensionPoints))
-    mitigations |= sandbox::MITIGATION_EXTENSION_POINT_DISABLE;
-
   sandbox::ResultCode result = sandbox::SBOX_ERROR_GENERIC;
+
   result = policy->SetProcessMitigations(mitigations);
 
   if (result != sandbox::SBOX_ALL_OK)
diff --git a/content/public/common/BUILD.gn b/content/public/common/BUILD.gn
index 2df12fd..ae955f65 100644
--- a/content/public/common/BUILD.gn
+++ b/content/public/common/BUILD.gn
@@ -68,24 +68,6 @@
   public_configs = [ ":static_switches_defines" ]
 }
 
-# This target allows you to use the content_features constants and statically
-# link to it, without depending on the rest of content. This is only for use
-# without content, or you will get multiply defined symbols.
-source_set("static_features") {
-  public = [
-    "content_features.h",
-  ]
-  sources = [
-    "//content/common/content_export.h",
-    "content_features.cc",
-  ]
-  public_deps = [
-    "//base",
-  ]
-
-  public_configs = [ ":static_switches_defines" ]
-}
-
 source_set("common_sources") {
   # External code should depend on via ":common" above.
   visibility = [ "//content/*" ]
diff --git a/content/public/common/content_features.cc b/content/public/common/content_features.cc
index 300b692..d2a1f789 100644
--- a/content/public/common/content_features.cc
+++ b/content/public/common/content_features.cc
@@ -112,6 +112,10 @@
 const base::Feature kScrollAnchoring{"ScrollAnchoring",
                                      base::FEATURE_DISABLED_BY_DEFAULT};
 
+// Speculatively launches Service Workers on mouse/touch events.
+const base::Feature kSpeculativeLaunchServiceWorker{
+    "SpeculativeLaunchServiceWorker", base::FEATURE_DISABLED_BY_DEFAULT};
+
 // Enables implementation of the Cache-Control: stale-while-revalidate directive
 // which permits servers to allow the use of stale resources while revalidation
 // proceeds in the background. See http://crbug.com/348877
diff --git a/content/public/common/content_features.h b/content/public/common/content_features.h
index 7a1d388..6f87268 100644
--- a/content/public/common/content_features.h
+++ b/content/public/common/content_features.h
@@ -37,6 +37,7 @@
 CONTENT_EXPORT extern const base::Feature kPointerEvents;
 CONTENT_EXPORT extern const base::Feature kRenderingPipelineThrottling;
 CONTENT_EXPORT extern const base::Feature kScrollAnchoring;
+CONTENT_EXPORT extern const base::Feature kSpeculativeLaunchServiceWorker;
 CONTENT_EXPORT extern const base::Feature kStaleWhileRevalidate;
 CONTENT_EXPORT extern const base::Feature kTokenBinding;
 CONTENT_EXPORT extern const base::Feature kWeakMemoryCache;
diff --git a/infra/config/recipes.cfg b/infra/config/recipes.cfg
index acebb64..66c71c7d 100644
--- a/infra/config/recipes.cfg
+++ b/infra/config/recipes.cfg
@@ -5,7 +5,7 @@
   project_id: "build"
   url: "https://chromium.googlesource.com/chromium/tools/build.git"
   branch: "master"
-  revision: "08908190287b7639a699eb6ebd2fd3767df4aa96"
+  revision: "9ce845e8065c98ab9d6d650337d0e06f1e5b493d"
 }
 deps {
   project_id: "depot_tools"
diff --git a/media/gpu/v4l2_video_encode_accelerator.cc b/media/gpu/v4l2_video_encode_accelerator.cc
index 20d7109..87b0e273 100644
--- a/media/gpu/v4l2_video_encode_accelerator.cc
+++ b/media/gpu/v4l2_video_encode_accelerator.cc
@@ -1144,7 +1144,7 @@
   struct v4l2_requestbuffers reqbufs;
   memset(&reqbufs, 0, sizeof(reqbufs));
   // Driver will modify to the appropriate number of buffers.
-  reqbufs.count = 1;
+  reqbufs.count = kInputBufferCount;
   reqbufs.type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
   // TODO(posciak): Once we start doing zero-copy, we should decide based on
   // the current pipeline setup which memory type to use. This should probably
diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index fb4f390..3a8c0941 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations
@@ -1211,9 +1211,8 @@
 
 crbug.com/577380 [ Linux Debug ] http/tests/serviceworker/chromium/registration-stress.html [ Failure ]
 
-crbug.com/634199 http/tests/serviceworker/fetch-event-network-error.html [ Crash Pass ]
-
-crbug.com/634264 http/tests/security/xss-DENIED-cross-origin-stack-overflow.html [ Crash ]
+crbug.com/635390 fast/repaint/scrollbar-damage-and-full-viewport-repaint.html [ Failure Pass ]
+crbug.com/634264 http/tests/security/xss-DENIED-cross-origin-stack-overflow.html [ Crash Timeout ]
 
 crbug.com/587593 [ Android ] fast/js/pic/cached-single-entry-transition.html [ Pass Failure ]
 
@@ -1256,8 +1255,6 @@
 
 crbug.com/605525 [ Win ] http/tests/xmlhttprequest/redirect-cross-origin-post.html [ Failure Pass ]
 
-crbug.com/603703 [ Linux Mac ] imported/wpt/web-animations/interfaces/AnimationTimeline/document-timeline.html [ Failure Pass ]
-
 crbug.com/600248 imported/wpt/web-animations/interfaces/AnimationEffectTiming/endDelay.html [ Pass Failure ]
 crbug.com/600248 imported/wpt/web-animations/interfaces/Animation/constructor.html [ Failure Timeout ]
 crbug.com/600248 imported/wpt/web-animations/interfaces/Animation/finished.html [ Pass Failure ]
diff --git a/third_party/WebKit/LayoutTests/custom-elements/constructor-context-dies-before-super.html b/third_party/WebKit/LayoutTests/custom-elements/constructor-context-dies-before-super.html
index cbf88e51..7b23222 100644
--- a/third_party/WebKit/LayoutTests/custom-elements/constructor-context-dies-before-super.html
+++ b/third_party/WebKit/LayoutTests/custom-elements/constructor-context-dies-before-super.html
@@ -1,6 +1,5 @@
 <!DOCTYPE html>
 <script src="../resources/testharness.js"></script>
-<script src="../resources/testharness-helpers.js"></script>
 <script src="../resources/testharnessreport.js"></script>
 <script src="../fast/dom/custom/testutils.js"></script>
 <body>
diff --git a/third_party/WebKit/LayoutTests/custom-elements/constructor-context-dies-cross-context-call.html b/third_party/WebKit/LayoutTests/custom-elements/constructor-context-dies-cross-context-call.html
index 7bfdca4..bdf6faf6 100644
--- a/third_party/WebKit/LayoutTests/custom-elements/constructor-context-dies-cross-context-call.html
+++ b/third_party/WebKit/LayoutTests/custom-elements/constructor-context-dies-cross-context-call.html
@@ -1,6 +1,5 @@
 <!DOCTYPE html>
 <script src="../resources/testharness.js"></script>
-<script src="../resources/testharness-helpers.js"></script>
 <script src="../resources/testharnessreport.js"></script>
 <script src="../fast/dom/custom/testutils.js"></script>
 <body>
diff --git a/third_party/WebKit/LayoutTests/custom-elements/constructor-may-poach-upgrading-element.html b/third_party/WebKit/LayoutTests/custom-elements/constructor-may-poach-upgrading-element.html
index d69e429f..feac93d 100644
--- a/third_party/WebKit/LayoutTests/custom-elements/constructor-may-poach-upgrading-element.html
+++ b/third_party/WebKit/LayoutTests/custom-elements/constructor-may-poach-upgrading-element.html
@@ -1,6 +1,5 @@
 <!DOCTYPE html>
 <script src="../resources/testharness.js"></script>
-<script src="../resources/testharness-helpers.js"></script>
 <script src="../resources/testharnessreport.js"></script>
 <script src="spec/resources/custom-elements-helpers.js"></script>
 <body>
diff --git a/third_party/WebKit/LayoutTests/custom-elements/define-context-dies-retrieving-prototype.html b/third_party/WebKit/LayoutTests/custom-elements/define-context-dies-retrieving-prototype.html
index 11f624b6..f8435ca4 100644
--- a/third_party/WebKit/LayoutTests/custom-elements/define-context-dies-retrieving-prototype.html
+++ b/third_party/WebKit/LayoutTests/custom-elements/define-context-dies-retrieving-prototype.html
@@ -1,6 +1,5 @@
 <!DOCTYPE html>
 <script src="../resources/testharness.js"></script>
-<script src="../resources/testharness-helpers.js"></script>
 <script src="../resources/testharnessreport.js"></script>
 <script src="../fast/dom/custom/testutils.js"></script>
 <body>
diff --git a/third_party/WebKit/LayoutTests/custom-elements/gc.html b/third_party/WebKit/LayoutTests/custom-elements/gc.html
index beb67e1..a8957d6 100644
--- a/third_party/WebKit/LayoutTests/custom-elements/gc.html
+++ b/third_party/WebKit/LayoutTests/custom-elements/gc.html
@@ -1,6 +1,5 @@
 <!DOCTYPE html>
 <script src="../resources/testharness.js"></script>
-<script src="../resources/testharness-helpers.js"></script>
 <script src="../resources/testharnessreport.js"></script>
 <body>
 <script>
diff --git a/third_party/WebKit/LayoutTests/custom-elements/isolated-worlds.html b/third_party/WebKit/LayoutTests/custom-elements/isolated-worlds.html
index f7e635e..a41e4d3 100644
--- a/third_party/WebKit/LayoutTests/custom-elements/isolated-worlds.html
+++ b/third_party/WebKit/LayoutTests/custom-elements/isolated-worlds.html
@@ -1,6 +1,5 @@
 <!DOCTYPE html>
 <script src="../resources/testharness.js"></script>
-<script src="../resources/testharness-helpers.js"></script>
 <script src="../resources/testharnessreport.js"></script>
 <script src="spec/resources/custom-elements-helpers.js"></script>
 <body>
diff --git a/third_party/WebKit/LayoutTests/custom-elements/spec/construct.html b/third_party/WebKit/LayoutTests/custom-elements/spec/construct.html
index 220f2ca..18a7f798 100644
--- a/third_party/WebKit/LayoutTests/custom-elements/spec/construct.html
+++ b/third_party/WebKit/LayoutTests/custom-elements/spec/construct.html
@@ -3,7 +3,6 @@
 <link rel="help" href="https://html.spec.whatwg.org/multipage/dom.html#elements-in-the-dom">
 <meta name="author" title="Dominic Cooney" href="mailto:dominicc@chromium.org">
 <script src="../../resources/testharness.js"></script>
-<script src="../../resources/testharness-helpers.js"></script>
 <script src="../../resources/testharnessreport.js"></script>
 <script src="resources/custom-elements-helpers.js"></script>
 <body>
diff --git a/third_party/WebKit/LayoutTests/custom-elements/v0-v1-interop.html b/third_party/WebKit/LayoutTests/custom-elements/v0-v1-interop.html
index a1c7288..ce7e824 100644
--- a/third_party/WebKit/LayoutTests/custom-elements/v0-v1-interop.html
+++ b/third_party/WebKit/LayoutTests/custom-elements/v0-v1-interop.html
@@ -1,6 +1,5 @@
 <!DOCTYPE html>
 <script src="../resources/testharness.js"></script>
-<script src="../resources/testharness-helpers.js"></script>
 <script src="../resources/testharnessreport.js"></script>
 <script src="spec/resources/custom-elements-helpers.js"></script>
 <body>
diff --git a/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-001.html b/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-001.html
deleted file mode 100644
index c8e7da1..0000000
--- a/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-001.html
+++ /dev/null
@@ -1,39 +0,0 @@
-<html> 
-<head>
-
-<style>
-.editing { 
-    border: 2px solid red; 
-    padding: 12px; 
-    font-size: 24px; 
-}
-</style>
-<script src=../editing.js language="JavaScript" type="text/JavaScript" ></script>
-
-<script>
-
-function editingTest() {
-    for (i = 0; i < 4; i++) {
-        moveSelectionForwardByCharacterCommand();    
-    }
-    deleteCommand();
-}
-
-</script>
-
-<title>Editing Test</title> 
-</head> 
-<body>
-<div contenteditable id="root" class="editing">
-<div id="test">
-One 
-<div>Two</div>
-</div>
-</div>
-
-<script>
-runEditingTest();
-</script>
-
-</body>
-</html>
diff --git a/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-002.html b/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-002.html
deleted file mode 100644
index 4ff70941..0000000
--- a/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-002.html
+++ /dev/null
@@ -1,40 +0,0 @@
-<html> 
-<head>
-
-<style>
-.editing { 
-    border: 2px solid red; 
-    padding: 12px; 
-    font-size: 24px; 
-}
-</style>
-<script src=../editing.js language="JavaScript" type="text/JavaScript" ></script>
-
-<script>
-
-function editingTest() {
-    for (i = 0; i < 4; i++) {
-        moveSelectionForwardByCharacterCommand();    
-    }
-    deleteCommand();
-}
-
-</script>
-
-<title>Editing Test</title> 
-</head> 
-<body>
-<div contenteditable id="root" class="editing">
-<div id="test">
-One 
-<div>Two</div>
-Three
-</div>
-</div>
-
-<script>
-runEditingTest();
-</script>
-
-</body>
-</html>
diff --git a/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-003.html b/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-003.html
deleted file mode 100644
index 509061f..0000000
--- a/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-003.html
+++ /dev/null
@@ -1,40 +0,0 @@
-<html> 
-<head>
-
-<style>
-.editing { 
-    border: 2px solid red; 
-    padding: 12px; 
-    font-size: 24px; 
-}
-</style>
-<script src=../editing.js language="JavaScript" type="text/JavaScript" ></script>
-
-<script>
-
-function editingTest() {
-    for (i = 0; i < 4; i++) {
-        moveSelectionForwardByCharacterCommand();    
-    }
-    deleteCommand();
-}
-
-</script>
-
-<title>Editing Test</title> 
-</head> 
-<body>
-<div contenteditable id="root" class="editing">
-<div id="test">
-One 
-<div>Two<br></div>
-Three
-</div>
-</div>
-
-<script>
-runEditingTest();
-</script>
-
-</body>
-</html>
diff --git a/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-004.html b/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-004.html
deleted file mode 100644
index f78f64c..0000000
--- a/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-004.html
+++ /dev/null
@@ -1,41 +0,0 @@
-<html> 
-<head>
-
-<style>
-.editing { 
-    border: 2px solid red; 
-    padding: 12px; 
-    font-size: 24px; 
-}
-</style>
-<script src=../editing.js language="JavaScript" type="text/JavaScript" ></script>
-
-<script>
-
-function editingTest() {
-    for (i = 0; i < 4; i++) {
-        moveSelectionForwardByCharacterCommand();    
-    }
-    deleteCommand();
-}
-
-</script>
-
-<title>Editing Test</title> 
-</head> 
-<body>
-<div contenteditable id="root" class="editing">
-<div id="test">
-One 
-<div>Two<br>
-</div>
-Three
-</div>
-</div>
-
-<script>
-runEditingTest();
-</script>
-
-</body>
-</html>
diff --git a/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-005.html b/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-005.html
deleted file mode 100644
index 31524e7..0000000
--- a/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-005.html
+++ /dev/null
@@ -1,40 +0,0 @@
-<html> 
-<head>
-
-<style>
-.editing { 
-    border: 2px solid red; 
-    padding: 12px; 
-    font-size: 24px; 
-}
-</style>
-<script src=../editing.js language="JavaScript" type="text/JavaScript" ></script>
-
-<script>
-
-function editingTest() {
-    for (i = 0; i < 4; i++) {
-        moveSelectionForwardByCharacterCommand();    
-    }
-    deleteCommand();
-}
-
-</script>
-
-<title>Editing Test</title> 
-</head> 
-<body>
-<div contenteditable id="root" class="editing">
-<div id="test">
-One 
-<div>Two<div>Three</div></div>
-Four
-</div>
-</div>
-
-<script>
-runEditingTest();
-</script>
-
-</body>
-</html>
diff --git a/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-006.html b/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-006.html
deleted file mode 100644
index 5d45aa91..0000000
--- a/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-006.html
+++ /dev/null
@@ -1,40 +0,0 @@
-<html> 
-<head>
-
-<style>
-.editing { 
-    border: 2px solid red; 
-    padding: 12px; 
-    font-size: 24px; 
-}
-</style>
-<script src=../editing.js language="JavaScript" type="text/JavaScript" ></script>
-
-<script>
-
-function editingTest() {
-    for (i = 0; i < 4; i++) {
-        moveSelectionForwardByCharacterCommand();    
-    }
-    deleteCommand();
-}
-
-</script>
-
-<title>Editing Test</title> 
-</head> 
-<body>
-<div contenteditable id="root" class="editing">
-<div id="test">
-One 
-<div>Two<div>Three<br></div></div>
-Four
-</div>
-</div>
-
-<script>
-runEditingTest();
-</script>
-
-</body>
-</html>
diff --git a/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-007.html b/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-007.html
deleted file mode 100644
index d475d1a..0000000
--- a/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-007.html
+++ /dev/null
@@ -1,40 +0,0 @@
-<html> 
-<head>
-
-<style>
-.editing { 
-    border: 2px solid red; 
-    padding: 12px; 
-    font-size: 24px; 
-}
-</style>
-<script src=../editing.js language="JavaScript" type="text/JavaScript" ></script>
-
-<script>
-
-function editingTest() {
-    for (i = 0; i < 4; i++) {
-        moveSelectionForwardByCharacterCommand();    
-    }
-    deleteCommand();
-}
-
-</script>
-
-<title>Editing Test</title> 
-</head> 
-<body>
-<div contenteditable id="root" class="editing">
-<div id="test">
-One 
-<div>Two<br><div>Three<br></div></div>
-Four
-</div>
-</div>
-
-<script>
-runEditingTest();
-</script>
-
-</body>
-</html>
diff --git a/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-008.html b/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-008.html
deleted file mode 100644
index 6d936f0..0000000
--- a/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-008.html
+++ /dev/null
@@ -1,38 +0,0 @@
-<html> 
-<head>
-
-<style>
-.editing { 
-    border: 2px solid red; 
-    padding: 12px; 
-    font-size: 24px; 
-}
-</style>
-<script src=../editing.js language="JavaScript" type="text/JavaScript" ></script>
-
-<script>
-
-function editingTest() {
-    for (i = 0; i < 4; i++) {
-        moveSelectionForwardByCharacterCommand();    
-    }
-    deleteCommand();
-}
-
-</script>
-
-<title>Editing Test</title> 
-</head> 
-<body>
-<div contenteditable id="root" class="editing">
-<div id="test">One<div> 
-<div>Two<div>Three</div></div>
-Four
-</div>
-
-<script>
-runEditingTest();
-</script>
-
-</body>
-</html>
diff --git a/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-009.html b/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-009.html
deleted file mode 100644
index ac4141c..0000000
--- a/third_party/WebKit/LayoutTests/editing/deleting/delete-block-merge-contents-009.html
+++ /dev/null
@@ -1,39 +0,0 @@
-<html> 
-<head>
-
-<style>
-.editing { 
-    border: 2px solid red; 
-    padding: 12px; 
-    font-size: 24px; 
-}
-</style>
-<script src=../editing.js language="JavaScript" type="text/JavaScript" ></script>
-
-<script>
-
-function editingTest() {
-    for (i = 0; i < 8; i++)
-        moveSelectionForwardByCharacterCommand();    
-    deleteCommand();
-}
-
-</script>
-
-<title>Editing Test</title> 
-</head> 
-<body>
-<div contenteditable id="root" class="editing">
-<div id="test">
-One 
-<div>Two<br><div>Three<br></div>Four</div>
-Five
-</div>
-</div>
-
-<script>
-runEditingTest();
-</script>
-
-</body>
-</html>
diff --git a/third_party/WebKit/LayoutTests/editing/deleting/delete_block_merge_contents_1.html b/third_party/WebKit/LayoutTests/editing/deleting/delete_block_merge_contents_1.html
new file mode 100644
index 0000000..73827be6
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/editing/deleting/delete_block_merge_contents_1.html
@@ -0,0 +1,131 @@
+<!doctype html>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script src="../assert_selection.js"></script>
+<script>
+    test(() => assert_selection(
+        [
+            '<div contenteditable>',
+                '<div>One<div>|Two</div></div>',
+            '</div>',
+        ].join(''),
+        'delete',
+        [
+            '<div contenteditable>',
+                'One|Two',
+            '</div>',
+        ].join('')),
+        'Removing inner DIVs');
+
+    test(() => assert_selection(
+        [
+            '<div contenteditable>',
+                '<div>One<div>|Two</div>Three</div>',
+            '</div>',
+        ].join(''),
+        'delete',
+        [
+            '<div contenteditable>',
+                'One|TwoThree<br>',
+            '</div>',
+        ].join('')),
+        'Removing DIVs and insert BR');
+
+    test(() => assert_selection(
+        [
+            '<div contenteditable>',
+                '<div>One<div>|Two<br></div>Three</div>',
+            '</div>',
+        ].join(''),
+        'delete',
+        [
+            '<div contenteditable>',
+                '<div>One|Two<br>Three</div>',
+            '</div>',
+        ].join('')),
+        'Replace DIV+BR to BR');
+
+    test(() => assert_selection(
+        [
+            '<div contenteditable>',
+                '<div>One<div>|Two<br>\n</div>Three</div>',
+            '</div>',
+        ].join(''),
+        'delete',
+        [
+            '<div contenteditable>',
+                '<div>One|Two<br>Three</div>',
+            '</div>',
+        ].join('')),
+        'Replace DIV+BR to BR with newline');
+
+    test(() => assert_selection(
+        [
+            '<div contenteditable>',
+                '<div>One<div>|Two<div>Three</div></div>Four</div>',
+            '</div>',
+        ].join(''),
+        'delete',
+        [
+            '<div contenteditable>',
+                'One|Two<div><div>Three</div></div>Four<br>',
+            '</div>',
+        ].join('')),
+        'Keep DIV nesting');
+
+    test(() => assert_selection(
+        [
+            '<div contenteditable>',
+                '<div>One<div>|Two<div>Three<br></div></div>Four</div>',
+            '</div>',
+        ].join(''),
+        'delete',
+        [
+            '<div contenteditable>',
+                'One|Two<div><div>Three<br></div></div>Four<br>',
+            '</div>',
+        ].join('')),
+        'Keep DIV nesting and BR');
+
+    test(() => assert_selection(
+        [
+            '<div contenteditable>',
+                '<div>One<div>|Two<br><div>Three<br></div></div>Four</div>',
+            '</div>',
+        ].join(''),
+        'delete',
+        [
+            '<div contenteditable>',
+                '<div>One|Two<div><div>Three<br></div></div>Four</div>',
+            '</div>',
+        ].join('')),
+        'Replace BR to DIV');
+
+    test(() => assert_selection(
+        [
+            '<div contenteditable>',
+                '<div>One<div>\n|Two<div>Three</div></div>Four</div>',
+            '</div>',
+        ].join(''),
+        'delete',
+        [
+            '<div contenteditable>',
+                'One|Two<div><div>Three</div></div>Four<br>',
+            '</div>',
+        ].join('')),
+        'Keep DIV nesting with newline');
+
+    test(() => assert_selection(
+        [
+            '<div contenteditable>',
+                '<div>One<div>Two<br><div>|Three<br></div>Four</div>Five',
+            '</div>',
+        ].join(''),
+        'delete',
+        [
+            '<div contenteditable>',
+                '<div>One<div>Two|Three<br>Four</div>Five</div>',
+            '</div>',
+        ].join('')),
+        'Merge "Two" and "Three"');
+</script>
diff --git a/third_party/WebKit/LayoutTests/fast/css/modify-cached-detached-sheet-3.html b/third_party/WebKit/LayoutTests/fast/css/modify-cached-detached-sheet-3.html
new file mode 100644
index 0000000..12ab30aed
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/css/modify-cached-detached-sheet-3.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<style>@media{}</style>
+<style>@media{}</style>
+<script>
+    test(() => {
+        var sheet = document.styleSheets[0];
+        sheet.ownerNode.remove();
+        sheet.insertRule("div{}", 0);
+    }, "Inserting a rule in a detached sheet with @media should not cause an assert/crash.");
+</script>
diff --git a/third_party/WebKit/LayoutTests/fast/css/style-for-math-with-class-expected.html b/third_party/WebKit/LayoutTests/fast/css/style-for-math-with-class-expected.html
new file mode 100644
index 0000000..0ae412a
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/css/style-for-math-with-class-expected.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<style>
+    span { background: green }
+</style>
+<span>Text</span>
diff --git a/third_party/WebKit/LayoutTests/fast/css/style-for-math-with-class.html b/third_party/WebKit/LayoutTests/fast/css/style-for-math-with-class.html
new file mode 100644
index 0000000..f06a4d5
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/css/style-for-math-with-class.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<style>
+    math { background: red }
+    math.x { background: green }
+</style>
+<math class="x">Text</math>
diff --git a/third_party/WebKit/LayoutTests/http/tests/fetch/chromium/close-worker-while-requesting.html b/third_party/WebKit/LayoutTests/http/tests/fetch/chromium/close-worker-while-requesting.html
new file mode 100644
index 0000000..f79fc46
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/fetch/chromium/close-worker-while-requesting.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<script src = "/resources/testharness.js"></script>
+<script src = "/resources/testharnessreport.js"></script>
+<script>
+promise_test(() => {
+    const SCRIPT = '/fetch/chromium/resources/close-worker-while-requesting.js';
+    worker = new Worker(SCRIPT);
+    return new Promise(resolve => {
+        worker.onmessage = message => {
+            assert_equals(message.data, 'PASS');
+            resolve();
+          };
+      });
+  });
+</script>
+<p>This test checks that Blink doesn't crash when closing a worker that has
+active fetches.</p>
diff --git a/third_party/WebKit/LayoutTests/http/tests/fetch/chromium/resources/close-worker-while-requesting.js b/third_party/WebKit/LayoutTests/http/tests/fetch/chromium/resources/close-worker-while-requesting.js
new file mode 100644
index 0000000..14bbf2c
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/fetch/chromium/resources/close-worker-while-requesting.js
@@ -0,0 +1,7 @@
+fetch('/fetch/slow-failure.cgi?id=1').then(res => {
+    fetch('/fetch/slow-failure.cgi?id=2');
+    postMessage('PASS');
+    self.close();
+  }).catch(e => {
+    postMessage('FAIL: ' + e);
+  });
diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-001-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-001-expected.png
deleted file mode 100644
index c61dbbb..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-001-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-001-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-001-expected.txt
deleted file mode 100644
index 18b96fb..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-001-expected.txt
+++ /dev/null
@@ -1,18 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x56 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x28
-          LayoutText {#text} at (0,0) size 82x27
-            text run at (0,0) width 82: "OneTwo"
-          LayoutText {#text} at (0,0) size 0x0
-caret: position 4 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-002-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-002-expected.png
deleted file mode 100644
index cb2c92d..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-002-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-002-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-002-expected.txt
deleted file mode 100644
index 4abb3849..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-002-expected.txt
+++ /dev/null
@@ -1,20 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x84 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x56
-          LayoutText {#text} at (0,0) size 82x27
-            text run at (0,0) width 82: "OneTwo"
-          LayoutBR {BR} at (81,21) size 1x0
-          LayoutText {#text} at (0,28) size 56x27
-            text run at (0,28) width 56: "Three"
-caret: position 4 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-003-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-003-expected.png
deleted file mode 100644
index cb2c92d..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-003-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-003-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-003-expected.txt
deleted file mode 100644
index 4abb3849..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-003-expected.txt
+++ /dev/null
@@ -1,20 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x84 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x56
-          LayoutText {#text} at (0,0) size 82x27
-            text run at (0,0) width 82: "OneTwo"
-          LayoutBR {BR} at (81,21) size 1x0
-          LayoutText {#text} at (0,28) size 56x27
-            text run at (0,28) width 56: "Three"
-caret: position 4 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-004-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-004-expected.png
deleted file mode 100644
index cb2c92d..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-004-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-004-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-004-expected.txt
deleted file mode 100644
index 4abb3849..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-004-expected.txt
+++ /dev/null
@@ -1,20 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x84 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x56
-          LayoutText {#text} at (0,0) size 82x27
-            text run at (0,0) width 82: "OneTwo"
-          LayoutBR {BR} at (81,21) size 1x0
-          LayoutText {#text} at (0,28) size 56x27
-            text run at (0,28) width 56: "Three"
-caret: position 4 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-005-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-005-expected.png
deleted file mode 100644
index 7631eb475..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-005-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-005-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-005-expected.txt
deleted file mode 100644
index 94b6b7a9..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-005-expected.txt
+++ /dev/null
@@ -1,25 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x112 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x84
-          LayoutBlockFlow (anonymous) at (0,0) size 756x28
-            LayoutText {#text} at (0,0) size 82x27
-              text run at (0,0) width 82: "OneTwo"
-          LayoutBlockFlow {DIV} at (0,28) size 756x28
-            LayoutBlockFlow {DIV} at (0,0) size 756x28
-              LayoutText {#text} at (0,0) size 56x27
-                text run at (0,0) width 56: "Three"
-          LayoutBlockFlow (anonymous) at (0,56) size 756x28
-            LayoutText {#text} at (0,0) size 45x27
-              text run at (0,0) width 45: "Four"
-caret: position 4 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-006-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-006-expected.png
deleted file mode 100644
index 7631eb475..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-006-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-006-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-006-expected.txt
deleted file mode 100644
index 9349ea9..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-006-expected.txt
+++ /dev/null
@@ -1,26 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x112 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x84
-          LayoutBlockFlow (anonymous) at (0,0) size 756x28
-            LayoutText {#text} at (0,0) size 82x27
-              text run at (0,0) width 82: "OneTwo"
-          LayoutBlockFlow {DIV} at (0,28) size 756x28
-            LayoutBlockFlow {DIV} at (0,0) size 756x28
-              LayoutText {#text} at (0,0) size 56x27
-                text run at (0,0) width 56: "Three"
-              LayoutBR {BR} at (56,21) size 0x0
-          LayoutBlockFlow (anonymous) at (0,56) size 756x28
-            LayoutText {#text} at (0,0) size 45x27
-              text run at (0,0) width 45: "Four"
-caret: position 4 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-007-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-007-expected.png
deleted file mode 100644
index 7631eb475..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-007-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-007-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-007-expected.txt
deleted file mode 100644
index 9349ea9..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-007-expected.txt
+++ /dev/null
@@ -1,26 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x112 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x84
-          LayoutBlockFlow (anonymous) at (0,0) size 756x28
-            LayoutText {#text} at (0,0) size 82x27
-              text run at (0,0) width 82: "OneTwo"
-          LayoutBlockFlow {DIV} at (0,28) size 756x28
-            LayoutBlockFlow {DIV} at (0,0) size 756x28
-              LayoutText {#text} at (0,0) size 56x27
-                text run at (0,0) width 56: "Three"
-              LayoutBR {BR} at (56,21) size 0x0
-          LayoutBlockFlow (anonymous) at (0,56) size 756x28
-            LayoutText {#text} at (0,0) size 45x27
-              text run at (0,0) width 45: "Four"
-caret: position 4 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-008-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-008-expected.png
deleted file mode 100644
index 7631eb475..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-008-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-008-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-008-expected.txt
deleted file mode 100644
index 5499bc6..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-008-expected.txt
+++ /dev/null
@@ -1,26 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x112 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x84
-          LayoutBlockFlow (anonymous) at (0,0) size 756x28
-            LayoutText {#text} at (0,0) size 82x27
-              text run at (0,0) width 82: "OneTwo"
-          LayoutBlockFlow {DIV} at (0,28) size 756x56
-            LayoutBlockFlow {DIV} at (0,0) size 756x28
-              LayoutBlockFlow {DIV} at (0,0) size 756x28
-                LayoutText {#text} at (0,0) size 56x27
-                  text run at (0,0) width 56: "Three"
-            LayoutBlockFlow (anonymous) at (0,28) size 756x28
-              LayoutText {#text} at (0,0) size 45x27
-                text run at (0,0) width 45: "Four"
-caret: position 3 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-009-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-009-expected.png
deleted file mode 100644
index 7fd3d03f..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-009-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-009-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-009-expected.txt
deleted file mode 100644
index 719efc6..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/deleting/delete-block-merge-contents-009-expected.txt
+++ /dev/null
@@ -1,31 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x140 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x112
-          LayoutBlockFlow (anonymous) at (0,0) size 756x28
-            LayoutText {#text} at (0,0) size 40x27
-              text run at (0,0) width 40: "One"
-          LayoutBlockFlow {DIV} at (0,28) size 756x56
-            LayoutText {#text} at (0,0) size 98x27
-              text run at (0,0) width 98: "TwoThree"
-            LayoutBR {BR} at (97,21) size 1x0
-            LayoutText {#text} at (0,28) size 45x27
-              text run at (0,28) width 45: "Four"
-          LayoutBlockFlow (anonymous) at (0,84) size 756x28
-            LayoutText {#text} at (0,0) size 42x27
-              text run at (0,0) width 42: "Five"
-caret: position 3 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/selection-after-remove-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/selection-after-remove-expected.txt
index 1a2c15c..22d5cae 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/selection-after-remove-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/selection-after-remove-expected.txt
@@ -46,14 +46,6 @@
       "reason": "layoutObject removal"
     },
     {
-      "object": "LayoutBlockFlow HTML",
-      "reason": "selection"
-    },
-    {
-      "object": "LayoutBlockFlow BODY",
-      "reason": "selection"
-    },
-    {
       "object": "LayoutBlockFlow DIV id='test'",
       "reason": "forced by layout"
     },
diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-001-expected.png b/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-001-expected.png
deleted file mode 100644
index 177356e..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-001-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-001-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-001-expected.txt
deleted file mode 100644
index e74a6ac1..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-001-expected.txt
+++ /dev/null
@@ -1,18 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x56 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x28
-          LayoutText {#text} at (0,0) size 83x28
-            text run at (0,0) width 83: "OneTwo"
-          LayoutText {#text} at (0,0) size 0x0
-caret: position 4 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-002-expected.png b/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-002-expected.png
deleted file mode 100644
index daa957b7..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-002-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-002-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-002-expected.txt
deleted file mode 100644
index 2ce95a4..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-002-expected.txt
+++ /dev/null
@@ -1,20 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x84 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x56
-          LayoutText {#text} at (0,0) size 83x28
-            text run at (0,0) width 83: "OneTwo"
-          LayoutBR {BR} at (82,22) size 1x0
-          LayoutText {#text} at (0,28) size 56x28
-            text run at (0,28) width 56: "Three"
-caret: position 4 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-003-expected.png b/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-003-expected.png
deleted file mode 100644
index daa957b7..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-003-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-003-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-003-expected.txt
deleted file mode 100644
index 2ce95a4..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-003-expected.txt
+++ /dev/null
@@ -1,20 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x84 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x56
-          LayoutText {#text} at (0,0) size 83x28
-            text run at (0,0) width 83: "OneTwo"
-          LayoutBR {BR} at (82,22) size 1x0
-          LayoutText {#text} at (0,28) size 56x28
-            text run at (0,28) width 56: "Three"
-caret: position 4 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-004-expected.png b/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-004-expected.png
deleted file mode 100644
index daa957b7..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-004-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-004-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-004-expected.txt
deleted file mode 100644
index 2ce95a4..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-004-expected.txt
+++ /dev/null
@@ -1,20 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x84 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x56
-          LayoutText {#text} at (0,0) size 83x28
-            text run at (0,0) width 83: "OneTwo"
-          LayoutBR {BR} at (82,22) size 1x0
-          LayoutText {#text} at (0,28) size 56x28
-            text run at (0,28) width 56: "Three"
-caret: position 4 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-005-expected.png b/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-005-expected.png
deleted file mode 100644
index 113e21b..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-005-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-005-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-005-expected.txt
deleted file mode 100644
index 15f3c9b..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-005-expected.txt
+++ /dev/null
@@ -1,25 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x112 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x84
-          LayoutBlockFlow (anonymous) at (0,0) size 756x28
-            LayoutText {#text} at (0,0) size 83x28
-              text run at (0,0) width 83: "OneTwo"
-          LayoutBlockFlow {DIV} at (0,28) size 756x28
-            LayoutBlockFlow {DIV} at (0,0) size 756x28
-              LayoutText {#text} at (0,0) size 56x28
-                text run at (0,0) width 56: "Three"
-          LayoutBlockFlow (anonymous) at (0,56) size 756x28
-            LayoutText {#text} at (0,0) size 46x28
-              text run at (0,0) width 46: "Four"
-caret: position 4 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-006-expected.png b/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-006-expected.png
deleted file mode 100644
index 113e21b..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-006-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-006-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-006-expected.txt
deleted file mode 100644
index 5bcd2294..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-006-expected.txt
+++ /dev/null
@@ -1,26 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x112 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x84
-          LayoutBlockFlow (anonymous) at (0,0) size 756x28
-            LayoutText {#text} at (0,0) size 83x28
-              text run at (0,0) width 83: "OneTwo"
-          LayoutBlockFlow {DIV} at (0,28) size 756x28
-            LayoutBlockFlow {DIV} at (0,0) size 756x28
-              LayoutText {#text} at (0,0) size 56x28
-                text run at (0,0) width 56: "Three"
-              LayoutBR {BR} at (55,22) size 1x0
-          LayoutBlockFlow (anonymous) at (0,56) size 756x28
-            LayoutText {#text} at (0,0) size 46x28
-              text run at (0,0) width 46: "Four"
-caret: position 4 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-007-expected.png b/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-007-expected.png
deleted file mode 100644
index 113e21b..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-007-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-007-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-007-expected.txt
deleted file mode 100644
index 5bcd2294..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-007-expected.txt
+++ /dev/null
@@ -1,26 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x112 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x84
-          LayoutBlockFlow (anonymous) at (0,0) size 756x28
-            LayoutText {#text} at (0,0) size 83x28
-              text run at (0,0) width 83: "OneTwo"
-          LayoutBlockFlow {DIV} at (0,28) size 756x28
-            LayoutBlockFlow {DIV} at (0,0) size 756x28
-              LayoutText {#text} at (0,0) size 56x28
-                text run at (0,0) width 56: "Three"
-              LayoutBR {BR} at (55,22) size 1x0
-          LayoutBlockFlow (anonymous) at (0,56) size 756x28
-            LayoutText {#text} at (0,0) size 46x28
-              text run at (0,0) width 46: "Four"
-caret: position 4 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-008-expected.png b/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-008-expected.png
deleted file mode 100644
index 113e21b..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-008-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-008-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-008-expected.txt
deleted file mode 100644
index 0be2d34..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-008-expected.txt
+++ /dev/null
@@ -1,26 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x112 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x84
-          LayoutBlockFlow (anonymous) at (0,0) size 756x28
-            LayoutText {#text} at (0,0) size 83x28
-              text run at (0,0) width 83: "OneTwo"
-          LayoutBlockFlow {DIV} at (0,28) size 756x56
-            LayoutBlockFlow {DIV} at (0,0) size 756x28
-              LayoutBlockFlow {DIV} at (0,0) size 756x28
-                LayoutText {#text} at (0,0) size 56x28
-                  text run at (0,0) width 56: "Three"
-            LayoutBlockFlow (anonymous) at (0,28) size 756x28
-              LayoutText {#text} at (0,0) size 46x28
-                text run at (0,0) width 46: "Four"
-caret: position 3 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-009-expected.png b/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-009-expected.png
deleted file mode 100644
index f5b0d3f..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-009-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-009-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-009-expected.txt
deleted file mode 100644
index ab89b873..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/deleting/delete-block-merge-contents-009-expected.txt
+++ /dev/null
@@ -1,31 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x140 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x112
-          LayoutBlockFlow (anonymous) at (0,0) size 756x28
-            LayoutText {#text} at (0,0) size 40x28
-              text run at (0,0) width 40: "One"
-          LayoutBlockFlow {DIV} at (0,28) size 756x56
-            LayoutText {#text} at (0,0) size 99x28
-              text run at (0,0) width 99: "TwoThree"
-            LayoutBR {BR} at (98,22) size 1x0
-            LayoutText {#text} at (0,28) size 46x28
-              text run at (0,28) width 46: "Four"
-          LayoutBlockFlow (anonymous) at (0,84) size 756x28
-            LayoutText {#text} at (0,0) size 43x28
-              text run at (0,0) width 43: "Five"
-caret: position 3 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/selection-after-remove-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/selection-after-remove-expected.txt
index f94d60f..8f3228d 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/selection-after-remove-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/selection-after-remove-expected.txt
@@ -46,14 +46,6 @@
       "reason": "layoutObject removal"
     },
     {
-      "object": "LayoutBlockFlow HTML",
-      "reason": "selection"
-    },
-    {
-      "object": "LayoutBlockFlow BODY",
-      "reason": "selection"
-    },
-    {
       "object": "LayoutBlockFlow DIV id='test'",
       "reason": "forced by layout"
     },
diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-001-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-001-expected.png
deleted file mode 100644
index ce6c54f..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-001-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-001-expected.txt b/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-001-expected.txt
deleted file mode 100644
index 55cf370..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-001-expected.txt
+++ /dev/null
@@ -1,18 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x55 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x27
-          LayoutText {#text} at (0,0) size 83x26
-            text run at (0,0) width 83: "OneTwo"
-          LayoutText {#text} at (0,0) size 0x0
-caret: position 4 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-002-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-002-expected.png
deleted file mode 100644
index f538f86..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-002-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-002-expected.txt b/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-002-expected.txt
deleted file mode 100644
index 28166b1..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-002-expected.txt
+++ /dev/null
@@ -1,20 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x82 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x54
-          LayoutText {#text} at (0,0) size 83x26
-            text run at (0,0) width 83: "OneTwo"
-          LayoutBR {BR} at (82,21) size 1x0
-          LayoutText {#text} at (0,27) size 56x26
-            text run at (0,27) width 56: "Three"
-caret: position 4 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-003-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-003-expected.png
deleted file mode 100644
index f538f86..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-003-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-003-expected.txt b/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-003-expected.txt
deleted file mode 100644
index 28166b1..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-003-expected.txt
+++ /dev/null
@@ -1,20 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x82 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x54
-          LayoutText {#text} at (0,0) size 83x26
-            text run at (0,0) width 83: "OneTwo"
-          LayoutBR {BR} at (82,21) size 1x0
-          LayoutText {#text} at (0,27) size 56x26
-            text run at (0,27) width 56: "Three"
-caret: position 4 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-004-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-004-expected.png
deleted file mode 100644
index f538f86..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-004-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-004-expected.txt b/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-004-expected.txt
deleted file mode 100644
index 28166b1..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-004-expected.txt
+++ /dev/null
@@ -1,20 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x82 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x54
-          LayoutText {#text} at (0,0) size 83x26
-            text run at (0,0) width 83: "OneTwo"
-          LayoutBR {BR} at (82,21) size 1x0
-          LayoutText {#text} at (0,27) size 56x26
-            text run at (0,27) width 56: "Three"
-caret: position 4 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-005-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-005-expected.png
deleted file mode 100644
index cdfb666..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-005-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-005-expected.txt b/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-005-expected.txt
deleted file mode 100644
index c11c1ba..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-005-expected.txt
+++ /dev/null
@@ -1,25 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x109 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x81
-          LayoutBlockFlow (anonymous) at (0,0) size 756x27
-            LayoutText {#text} at (0,0) size 83x26
-              text run at (0,0) width 83: "OneTwo"
-          LayoutBlockFlow {DIV} at (0,27) size 756x27
-            LayoutBlockFlow {DIV} at (0,0) size 756x27
-              LayoutText {#text} at (0,0) size 56x26
-                text run at (0,0) width 56: "Three"
-          LayoutBlockFlow (anonymous) at (0,54) size 756x27
-            LayoutText {#text} at (0,0) size 46x26
-              text run at (0,0) width 46: "Four"
-caret: position 4 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-006-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-006-expected.png
deleted file mode 100644
index cdfb666..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-006-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-006-expected.txt b/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-006-expected.txt
deleted file mode 100644
index 557d5518..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-006-expected.txt
+++ /dev/null
@@ -1,26 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x109 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x81
-          LayoutBlockFlow (anonymous) at (0,0) size 756x27
-            LayoutText {#text} at (0,0) size 83x26
-              text run at (0,0) width 83: "OneTwo"
-          LayoutBlockFlow {DIV} at (0,27) size 756x27
-            LayoutBlockFlow {DIV} at (0,0) size 756x27
-              LayoutText {#text} at (0,0) size 56x26
-                text run at (0,0) width 56: "Three"
-              LayoutBR {BR} at (55,21) size 1x0
-          LayoutBlockFlow (anonymous) at (0,54) size 756x27
-            LayoutText {#text} at (0,0) size 46x26
-              text run at (0,0) width 46: "Four"
-caret: position 4 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-007-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-007-expected.png
deleted file mode 100644
index cdfb666..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-007-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-007-expected.txt b/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-007-expected.txt
deleted file mode 100644
index 557d5518..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-007-expected.txt
+++ /dev/null
@@ -1,26 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x109 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x81
-          LayoutBlockFlow (anonymous) at (0,0) size 756x27
-            LayoutText {#text} at (0,0) size 83x26
-              text run at (0,0) width 83: "OneTwo"
-          LayoutBlockFlow {DIV} at (0,27) size 756x27
-            LayoutBlockFlow {DIV} at (0,0) size 756x27
-              LayoutText {#text} at (0,0) size 56x26
-                text run at (0,0) width 56: "Three"
-              LayoutBR {BR} at (55,21) size 1x0
-          LayoutBlockFlow (anonymous) at (0,54) size 756x27
-            LayoutText {#text} at (0,0) size 46x26
-              text run at (0,0) width 46: "Four"
-caret: position 4 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-008-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-008-expected.png
deleted file mode 100644
index cdfb666..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-008-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-008-expected.txt b/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-008-expected.txt
deleted file mode 100644
index 099bd0df..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-008-expected.txt
+++ /dev/null
@@ -1,26 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x109 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x81
-          LayoutBlockFlow (anonymous) at (0,0) size 756x27
-            LayoutText {#text} at (0,0) size 83x26
-              text run at (0,0) width 83: "OneTwo"
-          LayoutBlockFlow {DIV} at (0,27) size 756x54
-            LayoutBlockFlow {DIV} at (0,0) size 756x27
-              LayoutBlockFlow {DIV} at (0,0) size 756x27
-                LayoutText {#text} at (0,0) size 56x26
-                  text run at (0,0) width 56: "Three"
-            LayoutBlockFlow (anonymous) at (0,27) size 756x27
-              LayoutText {#text} at (0,0) size 46x26
-                text run at (0,0) width 46: "Four"
-caret: position 3 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-009-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-009-expected.png
deleted file mode 100644
index 4b568d4c..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-009-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-009-expected.txt b/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-009-expected.txt
deleted file mode 100644
index 8440e92..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/deleting/delete-block-merge-contents-009-expected.txt
+++ /dev/null
@@ -1,31 +0,0 @@
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChangeSelection:WebViewDidChangeSelectionNotification
-EDITING DELEGATE: webViewDidChange:WebViewDidChangeNotification
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {DIV} at (0,0) size 784x136 [border: (2px solid #FF0000)]
-        LayoutBlockFlow {DIV} at (14,14) size 756x108
-          LayoutBlockFlow (anonymous) at (0,0) size 756x27
-            LayoutText {#text} at (0,0) size 40x26
-              text run at (0,0) width 40: "One"
-          LayoutBlockFlow {DIV} at (0,27) size 756x54
-            LayoutText {#text} at (0,0) size 99x26
-              text run at (0,0) width 99: "TwoThree"
-            LayoutBR {BR} at (98,21) size 1x0
-            LayoutText {#text} at (0,27) size 46x26
-              text run at (0,27) width 46: "Four"
-          LayoutBlockFlow (anonymous) at (0,81) size 756x27
-            LayoutText {#text} at (0,0) size 43x26
-              text run at (0,0) width 43: "Five"
-caret: position 3 of child 0 {#text} of child 1 {DIV} of child 1 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/selection-after-remove-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/repaint/selection-after-remove-expected.txt
index 0373e95a..0c5823ac 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/selection-after-remove-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/repaint/selection-after-remove-expected.txt
@@ -46,14 +46,6 @@
       "reason": "layoutObject removal"
     },
     {
-      "object": "LayoutBlockFlow HTML",
-      "reason": "selection"
-    },
-    {
-      "object": "LayoutBlockFlow BODY",
-      "reason": "selection"
-    },
-    {
       "object": "LayoutBlockFlow DIV id='test'",
       "reason": "forced by layout"
     },
diff --git a/third_party/WebKit/LayoutTests/webshare/share-arity.html b/third_party/WebKit/LayoutTests/webshare/share-arity.html
index 7ba23f1a..6a8af68 100644
--- a/third_party/WebKit/LayoutTests/webshare/share-arity.html
+++ b/third_party/WebKit/LayoutTests/webshare/share-arity.html
@@ -10,12 +10,13 @@
 }, '0 arguments (promise rejection)');
 
 share_test((t, mock) => {
-  return promise_rejects(t, new TypeError(), navigator.share('the title'));
-}, '1 argument (promise rejection)');
+  mock.pushShareResult('the title', 'the message', null);
+  return navigator.share({title: 'the title', text: 'the message', unused: 'unexpected field'});
+}, 'extra ShareData field (extra field ignored)');
 
 share_test((t, mock) => {
   mock.pushShareResult('the title', 'the message', null);
-  return navigator.share('the title', 'the message', 'more than required');
-}, '3 arguments (extra argument ignored)');
+  return navigator.share({title: 'the title', text: 'the message'}, 'more than required');
+}, '2 arguments (extra argument ignored)');
 
 </script>
diff --git a/third_party/WebKit/LayoutTests/webshare/share-error.html b/third_party/WebKit/LayoutTests/webshare/share-error.html
index edade47..267f0e4 100644
--- a/third_party/WebKit/LayoutTests/webshare/share-error.html
+++ b/third_party/WebKit/LayoutTests/webshare/share-error.html
@@ -9,7 +9,7 @@
   mock.pushShareResult('the title', 'the message', 'error from browser');
   return promise_rejects(
       t, new DOMException('error from browser', 'AbortError'),
-      navigator.share('the title', 'the message'));
+      navigator.share({title: 'the title', text: 'the message'}));
 }, 'share with browser-side error');
 
 </script>
diff --git a/third_party/WebKit/LayoutTests/webshare/share-success.html b/third_party/WebKit/LayoutTests/webshare/share-success.html
index aa29c72..770b349f 100644
--- a/third_party/WebKit/LayoutTests/webshare/share-success.html
+++ b/third_party/WebKit/LayoutTests/webshare/share-success.html
@@ -7,7 +7,13 @@
 
 share_test((t, mock) => {
   mock.pushShareResult('the title', 'the message', null);
-  return navigator.share('the title', 'the message');
+  return navigator.share({title: 'the title', text: 'the message',
+                          url: 'the URL'});
 }, 'successful share');
 
+share_test((t, mock) => {
+  mock.pushShareResult('', '', null);
+  return navigator.share({});
+}, 'successful share with empty ShareData');
+
 </script>
diff --git a/third_party/WebKit/LayoutTests/webshare/share-types.html b/third_party/WebKit/LayoutTests/webshare/share-types.html
index fb593e0..8c49cb15 100644
--- a/third_party/WebKit/LayoutTests/webshare/share-types.html
+++ b/third_party/WebKit/LayoutTests/webshare/share-types.html
@@ -7,7 +7,7 @@
 
 share_test((t, mock) => {
   mock.pushShareResult('384957', '[object Object]', null);
-  return navigator.share(384957, {});
+  return navigator.share({title: 384957, text: {}});
 }, 'share of types other than string (expect implicitly converted to string)');
 
 </script>
diff --git a/third_party/WebKit/PerformanceTests/DOM/remove_child_with_selection.html b/third_party/WebKit/PerformanceTests/DOM/remove_child_with_selection.html
new file mode 100644
index 0000000..06a94415
--- /dev/null
+++ b/third_party/WebKit/PerformanceTests/DOM/remove_child_with_selection.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<script src="../resources/runner.js"></script>
+<div id="target">target</div>
+<div id="sample" style="display: none"></div>
+<script>
+var selection = window.getSelection();
+selection.selectAllChildren(document.getElementById('target'));
+var sample = document.getElementById('sample');
+for (var index = 0; index < 1000; ++index) {
+    var span = document.createElement('span');
+    span.textContent = `item ${index}\n`;
+    sample.appendChild(span);
+}
+PerfTestRunner.measureTime({
+    description: 'Measures performance of removeChild() with selection.',
+
+    run: function() {
+        var copy = sample.cloneNode(true);
+        while (sample.firstChild)
+            sample.removeChild(sample.firstChild);
+        while (copy.firstChild)
+            sample.appendChild(copy.firstChild);
+    },
+});
+</script>
diff --git a/third_party/WebKit/Source/core/animation/CompositorAnimations.cpp b/third_party/WebKit/Source/core/animation/CompositorAnimations.cpp
index 776a6d4..b679ca8 100644
--- a/third_party/WebKit/Source/core/animation/CompositorAnimations.cpp
+++ b/third_party/WebKit/Source/core/animation/CompositorAnimations.cpp
@@ -438,12 +438,12 @@
         return;
     }
 
-    switch (timingFunction->type()) {
-    case TimingFunction::kLinearFunction:
+    switch (timingFunction->getType()) {
+    case TimingFunction::Type::LINEAR:
         curve.addLinearKeyframe(keyframe);
         break;
 
-    case TimingFunction::kCubicBezierFunction: {
+    case TimingFunction::Type::CUBIC_BEZIER: {
         const CubicBezierTimingFunction& cubic = toCubicBezierTimingFunction(*timingFunction);
         if (cubic.getEaseType() == CubicBezierTimingFunction::EaseType::CUSTOM)
             curve.addCubicBezierKeyframe(keyframe, cubic.x1(), cubic.y1(), cubic.x2(), cubic.y2());
@@ -452,7 +452,7 @@
         break;
     }
 
-    case TimingFunction::kStepsFunction: {
+    case TimingFunction::Type::STEPS: {
         const StepsTimingFunction& steps = toStepsTimingFunction(*timingFunction);
         curve.addStepsKeyframe(keyframe, steps.numberOfSteps(), steps.getStepPosition());
         break;
@@ -471,12 +471,12 @@
         return;
     }
 
-    switch (timingFunction->type()) {
-    case TimingFunction::kLinearFunction:
+    switch (timingFunction->getType()) {
+    case TimingFunction::Type::LINEAR:
         curve.setLinearTimingFunction();
         break;
 
-    case TimingFunction::kCubicBezierFunction: {
+    case TimingFunction::Type::CUBIC_BEZIER: {
         const CubicBezierTimingFunction& cubic = toCubicBezierTimingFunction(*timingFunction);
         if (cubic.getEaseType() == CubicBezierTimingFunction::EaseType::CUSTOM)
             curve.setCubicBezierTimingFunction(cubic.x1(), cubic.y1(), cubic.x2(), cubic.y2());
@@ -485,7 +485,7 @@
         break;
     }
 
-    case TimingFunction::kStepsFunction: {
+    case TimingFunction::Type::STEPS: {
         const StepsTimingFunction& steps = toStepsTimingFunction(*timingFunction);
         curve.setStepsTimingFunction(steps.numberOfSteps(), steps.getStepPosition());
         break;
diff --git a/third_party/WebKit/Source/core/core.gypi b/third_party/WebKit/Source/core/core.gypi
index c704acf..337e42c 100644
--- a/third_party/WebKit/Source/core/core.gypi
+++ b/third_party/WebKit/Source/core/core.gypi
@@ -1952,6 +1952,7 @@
             'loader/TextTrackLoader.h',
             'loader/ThreadableLoader.cpp',
             'loader/ThreadableLoaderClient.h',
+            'loader/ThreadableLoaderClientWrapper.h',
             'loader/WorkerThreadableLoader.cpp',
             'loader/WorkerThreadableLoader.h',
             'loader/appcache/ApplicationCache.cpp',
diff --git a/third_party/WebKit/Source/core/css/CSSStyleSheet.cpp b/third_party/WebKit/Source/core/css/CSSStyleSheet.cpp
index 8e4937e..b3c917b 100644
--- a/third_party/WebKit/Source/core/css/CSSStyleSheet.cpp
+++ b/third_party/WebKit/Source/core/css/CSSStyleSheet.cpp
@@ -68,7 +68,7 @@
     Member<CSSStyleSheet> m_styleSheet;
 };
 
-#if ENABLE(ASSERT)
+#if DCHECK_IS_ON()
 static bool isAcceptableCSSStyleSheetParent(Node* parentNode)
 {
     // Only these nodes can be parents of StyleSheets, and they need to call
@@ -95,7 +95,7 @@
 
 CSSStyleSheet* CSSStyleSheet::createInline(StyleSheetContents* sheet, Node* ownerNode, const TextPosition& startPosition)
 {
-    ASSERT(sheet);
+    DCHECK(sheet);
     return new CSSStyleSheet(sheet, ownerNode, true, startPosition);
 }
 
@@ -127,7 +127,9 @@
     , m_startPosition(startPosition)
     , m_loadCompleted(false)
 {
-    ASSERT(isAcceptableCSSStyleSheetParent(ownerNode));
+#if DCHECK_IS_ON()
+    DCHECK(isAcceptableCSSStyleSheetParent(ownerNode));
+#endif
     m_contents->registerClient(this);
 }
 
@@ -135,15 +137,6 @@
 {
 }
 
-#if ENABLE(ASSERT)
-
-static bool isStyleElement(const Node* node)
-{
-    return node && (isHTMLStyleElement(node) || isSVGStyleElement(node));
-}
-
-#endif // ENABLE(ASSERT)
-
 void CSSStyleSheet::willMutateRules()
 {
     // If we are the only client it is safe to mutate.
@@ -153,8 +146,7 @@
         return;
     }
     // Only cacheable stylesheets should have multiple clients.
-    ASSERT((isStyleElement(ownerNode()) && m_contents->isCacheableForStyleElement())
-        || m_contents->isCacheableForResource());
+    DCHECK(m_contents->isCacheableForStyleElement() || m_contents->isCacheableForResource());
 
     // Copy-on-write.
     m_contents->unregisterClient(this);
@@ -169,8 +161,8 @@
 
 void CSSStyleSheet::didMutateRules()
 {
-    ASSERT(m_contents->isMutable());
-    ASSERT(m_contents->clientSize() <= 1);
+    DCHECK(m_contents->isMutable());
+    DCHECK_LE(m_contents->clientSize(), 1u);
 
     didMutate(PartialRuleUpdate);
 }
@@ -226,7 +218,7 @@
 
     if (m_childRuleCSSOMWrappers.isEmpty())
         m_childRuleCSSOMWrappers.grow(ruleCount);
-    ASSERT(m_childRuleCSSOMWrappers.size() == ruleCount);
+    DCHECK_EQ(m_childRuleCSSOMWrappers.size(), ruleCount);
 
     Member<CSSRule>& cssRule = m_childRuleCSSOMWrappers[index];
     if (!cssRule)
@@ -266,7 +258,7 @@
 
 unsigned CSSStyleSheet::insertRule(const String& ruleString, unsigned index, ExceptionState& exceptionState)
 {
-    ASSERT(m_childRuleCSSOMWrappers.isEmpty() || m_childRuleCSSOMWrappers.size() == m_contents->ruleCount());
+    DCHECK(m_childRuleCSSOMWrappers.isEmpty() || m_childRuleCSSOMWrappers.size() == m_contents->ruleCount());
 
     if (index > length()) {
         exceptionState.throwDOMException(IndexSizeError, "The index provided (" + String::number(index) + ") is larger than the maximum index (" + String::number(length()) + ").");
@@ -303,7 +295,7 @@
 
 void CSSStyleSheet::deleteRule(unsigned index, ExceptionState& exceptionState)
 {
-    ASSERT(m_childRuleCSSOMWrappers.isEmpty() || m_childRuleCSSOMWrappers.size() == m_contents->ruleCount());
+    DCHECK(m_childRuleCSSOMWrappers.isEmpty() || m_childRuleCSSOMWrappers.size() == m_contents->ruleCount());
 
     if (index >= length()) {
         exceptionState.throwDOMException(IndexSizeError, "The index provided (" + String::number(index) + ") is larger than the maximum index (" + String::number(length() - 1) + ").");
@@ -399,7 +391,7 @@
 
 bool CSSStyleSheet::sheetLoaded()
 {
-    ASSERT(m_ownerNode);
+    DCHECK(m_ownerNode);
     setLoadCompleted(m_ownerNode->sheetLoaded());
     return m_loadCompleted;
 }
diff --git a/third_party/WebKit/Source/core/css/ComputedStyleCSSValueMapping.cpp b/third_party/WebKit/Source/core/css/ComputedStyleCSSValueMapping.cpp
index 735bca6..a780f4296 100644
--- a/third_party/WebKit/Source/core/css/ComputedStyleCSSValueMapping.cpp
+++ b/third_party/WebKit/Source/core/css/ComputedStyleCSSValueMapping.cpp
@@ -1062,8 +1062,8 @@
 
 static CSSValue* createTimingFunctionValue(const TimingFunction* timingFunction)
 {
-    switch (timingFunction->type()) {
-    case TimingFunction::kCubicBezierFunction:
+    switch (timingFunction->getType()) {
+    case TimingFunction::Type::CUBIC_BEZIER:
         {
             const CubicBezierTimingFunction* bezierTimingFunction = toCubicBezierTimingFunction(timingFunction);
             if (bezierTimingFunction->getEaseType() != CubicBezierTimingFunction::EaseType::CUSTOM) {
@@ -1090,7 +1090,7 @@
             return CSSCubicBezierTimingFunctionValue::create(bezierTimingFunction->x1(), bezierTimingFunction->y1(), bezierTimingFunction->x2(), bezierTimingFunction->y2());
         }
 
-    case TimingFunction::kStepsFunction:
+    case TimingFunction::Type::STEPS:
         {
             const StepsTimingFunction* stepsTimingFunction = toStepsTimingFunction(timingFunction);
             StepsTimingFunction::StepPosition position = stepsTimingFunction->getStepPosition();
diff --git a/third_party/WebKit/Source/core/dom/Node.cpp b/third_party/WebKit/Source/core/dom/Node.cpp
index 49dbf9b..8887dc3 100644
--- a/third_party/WebKit/Source/core/dom/Node.cpp
+++ b/third_party/WebKit/Source/core/dom/Node.cpp
@@ -29,6 +29,7 @@
 #include "bindings/core/v8/Microtask.h"
 #include "bindings/core/v8/V8DOMWrapper.h"
 #include "core/HTMLNames.h"
+#include "core/MathMLNames.h"
 #include "core/css/CSSSelector.h"
 #include "core/css/resolver/StyleResolver.h"
 #include "core/dom/AXObjectCache.h"
@@ -946,6 +947,19 @@
     return parent ? parent->canStartSelection() : true;
 }
 
+// StyledElements allow inline style (style="border: 1px"), presentational attributes (ex. color),
+// class names (ex. class="foo bar") and other non-basic styling features. They also control
+// if this element can participate in style sharing.
+//
+// FIXME: The only things that ever go through StyleResolver that aren't StyledElements are
+// PseudoElements and VTTElements. It's possible we can just eliminate all the checks
+// since those elements will never have class names, inline style, or other things that
+// this apparently guards against.
+bool Node::isStyledElement() const
+{
+    return isHTMLElement() || isSVGElement() || (isElementNode() && toElement(this)->namespaceURI() == MathMLNames::mathmlNamespaceURI);
+}
+
 bool Node::canParticipateInFlatTree() const
 {
     return !isShadowRoot() && !isSlotOrActiveInsertionPoint();
diff --git a/third_party/WebKit/Source/core/dom/Node.h b/third_party/WebKit/Source/core/dom/Node.h
index 2d03e74..ec0f9f4b 100644
--- a/third_party/WebKit/Source/core/dom/Node.h
+++ b/third_party/WebKit/Source/core/dom/Node.h
@@ -281,15 +281,7 @@
     virtual bool isCharacterDataNode() const { return false; }
     virtual bool isFrameOwnerElement() const { return false; }
 
-    // StyledElements allow inline style (style="border: 1px"), presentational attributes (ex. color),
-    // class names (ex. class="foo bar") and other non-basic styling features. They and also control
-    // if this element can participate in style sharing.
-    //
-    // FIXME: The only things that ever go through StyleResolver that aren't StyledElements are
-    // PseudoElements and VTTElements. It's possible we can just eliminate all the checks
-    // since those elements will never have class names, inline style, or other things that
-    // this apparently guards against.
-    bool isStyledElement() const { return isHTMLElement() || isSVGElement(); }
+    bool isStyledElement() const;
 
     bool isDocumentNode() const;
     bool isTreeScope() const;
diff --git a/third_party/WebKit/Source/core/dom/custom/CEReactionsScope.cpp b/third_party/WebKit/Source/core/dom/custom/CEReactionsScope.cpp
index dec7331d..05e2200 100644
--- a/third_party/WebKit/Source/core/dom/custom/CEReactionsScope.cpp
+++ b/third_party/WebKit/Source/core/dom/custom/CEReactionsScope.cpp
@@ -7,7 +7,6 @@
 #include "core/dom/Document.h"
 #include "core/dom/Element.h"
 #include "core/dom/custom/CustomElementReactionStack.h"
-#include "core/frame/FrameHost.h"
 
 namespace blink {
 
@@ -17,19 +16,16 @@
     Element* element,
     CustomElementReaction* reaction)
 {
-    if (!m_frameHost.get()) {
-        m_frameHost = element->document().frameHost();
-        m_frameHost->customElementReactionStack().push();
-    } else {
-        DCHECK_EQ(m_frameHost, element->document().frameHost());
+    if (!m_workToDo) {
+        m_workToDo = true;
+        CustomElementReactionStack::current().push();
     }
-    m_frameHost->customElementReactionStack().enqueueToCurrentQueue(
-        element, reaction);
+    CustomElementReactionStack::current().enqueueToCurrentQueue(element, reaction);
 }
 
 void CEReactionsScope::invokeReactions()
 {
-    m_frameHost->customElementReactionStack().popInvokingReactions();
+    CustomElementReactionStack::current().popInvokingReactions();
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/dom/custom/CEReactionsScope.h b/third_party/WebKit/Source/core/dom/custom/CEReactionsScope.h
index 5a09358..4156a453 100644
--- a/third_party/WebKit/Source/core/dom/custom/CEReactionsScope.h
+++ b/third_party/WebKit/Source/core/dom/custom/CEReactionsScope.h
@@ -15,7 +15,6 @@
 
 class CustomElementReaction;
 class Element;
-class FrameHost;
 
 // https://html.spec.whatwg.org/multipage/scripting.html#cereactions
 class CORE_EXPORT CEReactionsScope final {
@@ -29,13 +28,14 @@
 
     CEReactionsScope()
         : m_prev(s_topOfStack)
+        , m_workToDo(false)
     {
         s_topOfStack = this;
     }
 
     ~CEReactionsScope()
     {
-        if (m_frameHost.get())
+        if (m_workToDo)
             invokeReactions();
         s_topOfStack = s_topOfStack->m_prev;
     }
@@ -48,7 +48,7 @@
     void invokeReactions();
 
     CEReactionsScope* m_prev;
-    Member<FrameHost> m_frameHost;
+    bool m_workToDo;
 };
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/dom/custom/CustomElement.cpp b/third_party/WebKit/Source/core/dom/custom/CustomElement.cpp
index 267fc32..4fa8a29 100644
--- a/third_party/WebKit/Source/core/dom/custom/CustomElement.cpp
+++ b/third_party/WebKit/Source/core/dom/custom/CustomElement.cpp
@@ -12,7 +12,6 @@
 #include "core/dom/custom/CustomElementsRegistry.h"
 #include "core/dom/custom/V0CustomElement.h"
 #include "core/dom/custom/V0CustomElementRegistrationContext.h"
-#include "core/frame/FrameHost.h"
 #include "core/frame/LocalDOMWindow.h"
 #include "core/html/HTMLElement.h"
 #include "core/html/HTMLUnknownElement.h"
@@ -197,8 +196,7 @@
 
     // If the custom element reactions stack is empty, then
     // Add element to the backup element queue.
-    element->document().frameHost()->customElementReactionStack()
-        .enqueueToBackupQueue(element, reaction);
+    CustomElementReactionStack::current().enqueueToBackupQueue(element, reaction);
 }
 
 void CustomElement::enqueueConnectedCallback(Element* element)
diff --git a/third_party/WebKit/Source/core/dom/custom/CustomElementReactionStack.cpp b/third_party/WebKit/Source/core/dom/custom/CustomElementReactionStack.cpp
index e05f34bf..231b9d1b 100644
--- a/third_party/WebKit/Source/core/dom/custom/CustomElementReactionStack.cpp
+++ b/third_party/WebKit/Source/core/dom/custom/CustomElementReactionStack.cpp
@@ -12,6 +12,16 @@
 
 namespace blink {
 
+namespace {
+
+CustomElementReactionStack& customElementReactionStack()
+{
+    DEFINE_STATIC_LOCAL(CustomElementReactionStack, customElementReactionStack, (new CustomElementReactionStack));
+    return customElementReactionStack;
+}
+
+} // namespace
+
 // TODO(dominicc): Consider using linked heap structures, avoiding
 // finalizers, to make short-lived entries fast.
 
@@ -103,4 +113,9 @@
     m_backupQueue->clear();
 }
 
+CustomElementReactionStack& CustomElementReactionStack::current()
+{
+    return customElementReactionStack();
+}
+
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/dom/custom/CustomElementReactionStack.h b/third_party/WebKit/Source/core/dom/custom/CustomElementReactionStack.h
index e245601..e68637a0 100644
--- a/third_party/WebKit/Source/core/dom/custom/CustomElementReactionStack.h
+++ b/third_party/WebKit/Source/core/dom/custom/CustomElementReactionStack.h
@@ -29,6 +29,8 @@
     void enqueueToCurrentQueue(Element*, CustomElementReaction*);
     void enqueueToBackupQueue(Element*, CustomElementReaction*);
 
+    static CustomElementReactionStack& current();
+
 private:
     using ElementReactionQueueMap =
         HeapHashMap<Member<Element>, Member<CustomElementReactionQueue>>;
diff --git a/third_party/WebKit/Source/core/editing/FrameSelection.cpp b/third_party/WebKit/Source/core/editing/FrameSelection.cpp
index 8c7f0a8..e8f1728 100644
--- a/third_party/WebKit/Source/core/editing/FrameSelection.cpp
+++ b/third_party/WebKit/Source/core/editing/FrameSelection.cpp
@@ -419,15 +419,12 @@
     m_frameCaret->nodeWillBeRemoved(node);
 }
 
-static bool intersectsNode(const VisibleSelection& selection, Node* node)
+static SelectionState selectionStateOf(const Node& node)
 {
-    if (selection.isNone())
-        return false;
-    Position start = selection.start().parentAnchoredEquivalent();
-    Position end = selection.end().parentAnchoredEquivalent();
-    TrackExceptionState exceptionState;
-    // TODO(yosin) We should avoid to use |Range::intersectsNode()|.
-    return Range::intersectsNode(node, start, end, exceptionState) && !exceptionState.hadException();
+    const LayoutObject* layoutObject = node.layoutObject();
+    if (!layoutObject)
+        return SelectionNone;
+    return layoutObject->getSelectionState();
 }
 
 void FrameSelection::respondToNodeModification(Node& node, bool baseRemoved, bool extentRemoved, bool startRemoved, bool endRemoved)
@@ -464,11 +461,11 @@
             m_selectionEditor->setWithoutValidation(selection().start(), selection().end());
         else
             m_selectionEditor->setWithoutValidation(selection().end(), selection().start());
-    } else if (intersectsNode(selection(), &node)) {
-        // If we did nothing here, when this node's layoutObject was destroyed, the rect that it
-        // occupied would be invalidated, but, selection gaps that change as a result of
-        // the removal wouldn't be invalidated.
-        // FIXME: Don't do so much unnecessary invalidation.
+    } else if (selectionStateOf(node) != SelectionNone) {
+        // When node to be removed is part of selection, we invalidate
+        // selection to paint again.
+        // TODO(yosin): We should paint changed area only rather than whole
+        // selected range.
         clearLayoutTreeSelection = true;
     }
 
diff --git a/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp b/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp
index 0c89d47..0fa676f 100644
--- a/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp
+++ b/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp
@@ -337,7 +337,7 @@
 
 void SpellChecker::markMisspellingsAndBadGrammar(const VisibleSelection &movingSelection)
 {
-    markMisspellingsAndBadGrammar(movingSelection, isContinuousSpellCheckingEnabled(), movingSelection);
+    markMisspellingsAndBadGrammar(movingSelection, movingSelection);
 }
 
 void SpellChecker::markMisspellingsAfterLineBreak(const VisibleSelection& wordSelection)
@@ -349,48 +349,30 @@
         return;
     }
 
-    TextCheckingTypeMask textCheckingOptions = TextCheckingTypeGrammar;
-
-    if (isContinuousSpellCheckingEnabled())
-        textCheckingOptions |= TextCheckingTypeSpelling;
+    if (!isContinuousSpellCheckingEnabled())
+        return;
 
     VisibleSelection wholeParagraph(
         startOfParagraph(wordSelection.visibleStart()),
         endOfParagraph(wordSelection.visibleEnd()));
 
-    markAllMisspellingsAndBadGrammarInRanges(
-        textCheckingOptions, wordSelection.toNormalizedEphemeralRange(),
-        wholeParagraph.toNormalizedEphemeralRange());
+    markAllMisspellingsAndBadGrammarInRanges(wordSelection.toNormalizedEphemeralRange(), wholeParagraph.toNormalizedEphemeralRange());
 }
 
 void SpellChecker::markMisspellingsAfterTypingToWord(const VisiblePosition &wordStart, const VisibleSelection& selectionAfterTyping)
 {
+    if (!isContinuousSpellCheckingEnabled())
+        return;
+
     TRACE_EVENT0("blink", "SpellChecker::markMisspellingsAfterTypingToWord");
 
     if (unifiedTextCheckerEnabled()) {
-        TextCheckingTypeMask textCheckingOptions = 0;
-
-        if (isContinuousSpellCheckingEnabled())
-            textCheckingOptions |= TextCheckingTypeSpelling;
-
-        if (!(textCheckingOptions & TextCheckingTypeSpelling))
-            return;
-
-        textCheckingOptions |= TextCheckingTypeGrammar;
-
         VisibleSelection adjacentWords = VisibleSelection(startOfWord(wordStart, LeftWordIfOnBoundary), endOfWord(wordStart, RightWordIfOnBoundary));
-        if (textCheckingOptions & TextCheckingTypeGrammar) {
-            VisibleSelection selectedSentence = VisibleSelection(startOfSentence(wordStart), endOfSentence(wordStart));
-            markAllMisspellingsAndBadGrammarInRanges(textCheckingOptions, adjacentWords.toNormalizedEphemeralRange(), selectedSentence.toNormalizedEphemeralRange());
-        } else {
-            markAllMisspellingsAndBadGrammarInRanges(textCheckingOptions, adjacentWords.toNormalizedEphemeralRange(), adjacentWords.toNormalizedEphemeralRange());
-        }
+        VisibleSelection selectedSentence = VisibleSelection(startOfSentence(wordStart), endOfSentence(wordStart));
+        markAllMisspellingsAndBadGrammarInRanges(adjacentWords.toNormalizedEphemeralRange(), selectedSentence.toNormalizedEphemeralRange());
         return;
     }
 
-    if (!isContinuousSpellCheckingEnabled())
-        return;
-
     // Check spelling of one word
     bool result = markMisspellings(VisibleSelection(startOfWord(wordStart, LeftWordIfOnBoundary), endOfWord(wordStart, RightWordIfOnBoundary)));
 
@@ -475,14 +457,12 @@
     markMisspellingsOrBadGrammar(selection, false);
 }
 
-void SpellChecker::markAllMisspellingsAndBadGrammarInRanges(TextCheckingTypeMask textCheckingOptions, const EphemeralRange& spellingRange, const EphemeralRange& grammarRange)
+void SpellChecker::markAllMisspellingsAndBadGrammarInRanges(const EphemeralRange& spellingRange, const EphemeralRange& grammarRange)
 {
     DCHECK(unifiedTextCheckerEnabled());
 
-    bool shouldMarkGrammar = textCheckingOptions & TextCheckingTypeGrammar;
-
     // This function is called with selections already expanded to word boundaries.
-    if (spellingRange.isNull() || (shouldMarkGrammar && grammarRange.isNull()))
+    if (spellingRange.isNull() || grammarRange.isNull())
         return;
 
     // If we're not in an editable node, bail.
@@ -493,8 +473,8 @@
     if (!isSpellCheckingEnabledFor(editableNode))
         return;
 
-    TextCheckingParagraph fullParagraphToCheck(shouldMarkGrammar ? grammarRange : spellingRange);
-    chunkAndMarkAllMisspellingsAndBadGrammar(textCheckingOptions, fullParagraphToCheck);
+    TextCheckingParagraph fullParagraphToCheck(grammarRange);
+    chunkAndMarkAllMisspellingsAndBadGrammar(fullParagraphToCheck);
 }
 
 static EphemeralRange expandEndToSentenceBoundary(const EphemeralRange& range)
@@ -522,10 +502,10 @@
         return;
     EphemeralRange paragraphRange(Position::firstPositionInNode(node), Position::lastPositionInNode(node));
     TextCheckingParagraph textToCheck(insertedRange, paragraphRange);
-    chunkAndMarkAllMisspellingsAndBadGrammar(resolveTextCheckingTypeMask(TextCheckingTypeSpelling | TextCheckingTypeGrammar), textToCheck);
+    chunkAndMarkAllMisspellingsAndBadGrammar(textToCheck);
 }
 
-void SpellChecker::chunkAndMarkAllMisspellingsAndBadGrammar(TextCheckingTypeMask textCheckingOptions, const TextCheckingParagraph& fullParagraphToCheck)
+void SpellChecker::chunkAndMarkAllMisspellingsAndBadGrammar(const TextCheckingParagraph& fullParagraphToCheck)
 {
     if (fullParagraphToCheck.isEmpty())
         return;
@@ -537,7 +517,7 @@
     // Check the full paragraph instead if the paragraph is short, which saves
     // the cost on sentence boundary finding.
     if (fullParagraphToCheck.rangeLength() <= kChunkSize) {
-        SpellCheckRequest* request = SpellCheckRequest::create(resolveTextCheckingTypeMask(textCheckingOptions), TextCheckingProcessBatch, paragraphRange, paragraphRange, 0);
+        SpellCheckRequest* request = SpellCheckRequest::create(TextCheckingTypeSpelling | TextCheckingTypeGrammar, TextCheckingProcessBatch, paragraphRange, paragraphRange, 0);
         if (request)
             m_spellCheckRequester->requestCheckingFor(request);
         return;
@@ -548,7 +528,7 @@
         EphemeralRange chunkRange = checkRangeIterator.calculateCharacterSubrange(0, kChunkSize);
         EphemeralRange checkRange = requestNum ? expandEndToSentenceBoundary(chunkRange) : expandRangeToSentenceBoundary(chunkRange);
 
-        SpellCheckRequest* request = SpellCheckRequest::create(resolveTextCheckingTypeMask(textCheckingOptions), TextCheckingProcessBatch, checkRange, paragraphRange, requestNum);
+        SpellCheckRequest* request = SpellCheckRequest::create(TextCheckingTypeSpelling | TextCheckingTypeGrammar, TextCheckingProcessBatch, checkRange, paragraphRange, requestNum);
         if (request)
             m_spellCheckRequester->requestCheckingFor(request);
 
@@ -666,22 +646,19 @@
     }
 }
 
-void SpellChecker::markMisspellingsAndBadGrammar(const VisibleSelection& spellingSelection, bool markGrammar, const VisibleSelection& grammarSelection)
+void SpellChecker::markMisspellingsAndBadGrammar(const VisibleSelection& spellingSelection, const VisibleSelection& grammarSelection)
 {
     if (unifiedTextCheckerEnabled()) {
         if (!isContinuousSpellCheckingEnabled())
             return;
 
         // markMisspellingsAndBadGrammar() is triggered by selection change, in which case we check spelling and grammar, but don't autocorrect misspellings.
-        TextCheckingTypeMask textCheckingOptions = TextCheckingTypeSpelling;
-        if (markGrammar)
-            textCheckingOptions |= TextCheckingTypeGrammar;
-        markAllMisspellingsAndBadGrammarInRanges(textCheckingOptions, spellingSelection.toNormalizedEphemeralRange(), grammarSelection.toNormalizedEphemeralRange());
+        markAllMisspellingsAndBadGrammarInRanges(spellingSelection.toNormalizedEphemeralRange(), grammarSelection.toNormalizedEphemeralRange());
         return;
     }
 
     markMisspellings(spellingSelection);
-    if (markGrammar)
+    if (isContinuousSpellCheckingEnabled())
         markBadGrammar(grammarSelection);
 }
 
@@ -888,10 +865,10 @@
         return;
     if (isContinuousSpellCheckingEnabled()) {
         VisibleSelection selectedSentence = VisibleSelection(startOfSentence(oldStart), endOfSentence(oldStart));
-        markMisspellingsAndBadGrammar(oldAdjacentWords, true, selectedSentence);
+        markMisspellingsAndBadGrammar(oldAdjacentWords, selectedSentence);
         return;
     }
-    markMisspellingsAndBadGrammar(oldAdjacentWords, false, oldAdjacentWords);
+    markMisspellingsAndBadGrammar(oldAdjacentWords, oldAdjacentWords);
 }
 
 static Node* findFirstMarkable(Node* node)
@@ -935,20 +912,6 @@
     return selectionStartHasMarkerFor(DocumentMarker::Spelling, from, length);
 }
 
-TextCheckingTypeMask SpellChecker::resolveTextCheckingTypeMask(TextCheckingTypeMask textCheckingOptions)
-{
-    bool shouldMarkSpelling = textCheckingOptions & TextCheckingTypeSpelling;
-    bool shouldMarkGrammar = textCheckingOptions & TextCheckingTypeGrammar;
-
-    TextCheckingTypeMask checkingTypes = 0;
-    if (shouldMarkSpelling)
-        checkingTypes |= TextCheckingTypeSpelling;
-    if (shouldMarkGrammar)
-        checkingTypes |= TextCheckingTypeGrammar;
-
-    return checkingTypes;
-}
-
 void SpellChecker::removeMarkers(const VisibleSelection& selection, DocumentMarker::MarkerTypes markerTypes)
 {
     const EphemeralRange range = selection.toNormalizedEphemeralRange();
diff --git a/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.h b/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.h
index a02d78c..e9cfa44 100644
--- a/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.h
+++ b/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.h
@@ -63,9 +63,9 @@
     void markMisspellingsAfterTypingToWord(const VisiblePosition &wordStart, const VisibleSelection& selectionAfterTyping);
     bool markMisspellings(const VisibleSelection&);
     void markBadGrammar(const VisibleSelection&);
-    void markMisspellingsAndBadGrammar(const VisibleSelection& spellingSelection, bool markGrammar, const VisibleSelection& grammarSelection);
+    void markMisspellingsAndBadGrammar(const VisibleSelection& spellingSelection, const VisibleSelection& grammarSelection);
     void markAndReplaceFor(SpellCheckRequest*, const Vector<TextCheckingResult>&);
-    void markAllMisspellingsAndBadGrammarInRanges(TextCheckingTypeMask, const EphemeralRange& spellingRange, const EphemeralRange& grammarRange);
+    void markAllMisspellingsAndBadGrammarInRanges(const EphemeralRange& spellingRange, const EphemeralRange& grammarRange);
     void advanceToNextMisspelling(bool startBeforeSelection = false);
     void showSpellingGuessPanel();
     void didBeginEditing(Element*);
@@ -107,12 +107,11 @@
     }
 
     bool markMisspellingsOrBadGrammar(const VisibleSelection&, bool checkSpelling);
-    TextCheckingTypeMask resolveTextCheckingTypeMask(TextCheckingTypeMask);
 
     void removeMarkers(const VisibleSelection&, DocumentMarker::MarkerTypes);
     bool unifiedTextCheckerEnabled() const;
 
-    void chunkAndMarkAllMisspellingsAndBadGrammar(TextCheckingTypeMask textCheckingOptions, const TextCheckingParagraph& fullParagraphToCheck);
+    void chunkAndMarkAllMisspellingsAndBadGrammar(const TextCheckingParagraph& fullParagraphToCheck);
 
     Member<LocalFrame> m_frame;
     const Member<SpellCheckRequester> m_spellCheckRequester;
diff --git a/third_party/WebKit/Source/core/fileapi/FileReaderLoader.h b/third_party/WebKit/Source/core/fileapi/FileReaderLoader.h
index be30c0d..dedf9c2f 100644
--- a/third_party/WebKit/Source/core/fileapi/FileReaderLoader.h
+++ b/third_party/WebKit/Source/core/fileapi/FileReaderLoader.h
@@ -34,7 +34,6 @@
 #include "core/CoreExport.h"
 #include "core/fileapi/FileError.h"
 #include "core/loader/ThreadableLoaderClient.h"
-#include "platform/heap/Handle.h"
 #include "platform/weborigin/KURL.h"
 #include "wtf/Forward.h"
 #include "wtf/PtrUtil.h"
@@ -124,7 +123,7 @@
 
     KURL m_urlForReading;
     bool m_urlForReadingIsStream;
-    Persistent<ThreadableLoader> m_loader;
+    std::unique_ptr<ThreadableLoader> m_loader;
 
     std::unique_ptr<ArrayBufferBuilder> m_rawData;
     bool m_isRawDataConverted;
diff --git a/third_party/WebKit/Source/core/frame/FrameHost.cpp b/third_party/WebKit/Source/core/frame/FrameHost.cpp
index f1b5c4e..90dc46e6 100644
--- a/third_party/WebKit/Source/core/frame/FrameHost.cpp
+++ b/third_party/WebKit/Source/core/frame/FrameHost.cpp
@@ -30,7 +30,6 @@
 
 #include "core/frame/FrameHost.h"
 
-#include "core/dom/custom/CustomElementReactionStack.h"
 #include "core/frame/EventHandlerRegistry.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/PageScaleConstraints.h"
@@ -60,7 +59,6 @@
         m_page->chromeClient()))
     , m_eventHandlerRegistry(new EventHandlerRegistry(*this))
     , m_consoleMessageStorage(new ConsoleMessageStorage())
-    , m_customElementReactionStack(new CustomElementReactionStack())
     , m_subframeCount(0)
 {
 }
@@ -185,16 +183,6 @@
     return *m_consoleMessageStorage;
 }
 
-CustomElementReactionStack& FrameHost::customElementReactionStack()
-{
-    return *m_customElementReactionStack;
-}
-
-const CustomElementReactionStack& FrameHost::customElementReactionStack() const
-{
-    return *m_customElementReactionStack;
-}
-
 DEFINE_TRACE(FrameHost)
 {
     visitor->trace(m_page);
@@ -203,7 +191,6 @@
     visitor->trace(m_overscrollController);
     visitor->trace(m_eventHandlerRegistry);
     visitor->trace(m_consoleMessageStorage);
-    visitor->trace(m_customElementReactionStack);
 }
 
 #if ENABLE(ASSERT)
diff --git a/third_party/WebKit/Source/core/frame/FrameHost.h b/third_party/WebKit/Source/core/frame/FrameHost.h
index 1a44fcc..300f204 100644
--- a/third_party/WebKit/Source/core/frame/FrameHost.h
+++ b/third_party/WebKit/Source/core/frame/FrameHost.h
@@ -42,7 +42,6 @@
 
 class ChromeClient;
 class ConsoleMessageStorage;
-class CustomElementReactionStack;
 class Deprecation;
 class EventHandlerRegistry;
 class OverscrollController;
@@ -117,9 +116,6 @@
     ConsoleMessageStorage& consoleMessageStorage();
     const ConsoleMessageStorage& consoleMessageStorage() const;
 
-    CustomElementReactionStack& customElementReactionStack();
-    const CustomElementReactionStack& customElementReactionStack() const;
-
     DECLARE_TRACE();
 
     // Don't allow more than a certain number of frames in a page.
@@ -144,7 +140,6 @@
     const Member<OverscrollController> m_overscrollController;
     const Member<EventHandlerRegistry> m_eventHandlerRegistry;
     const Member<ConsoleMessageStorage> m_consoleMessageStorage;
-    const Member<CustomElementReactionStack> m_customElementReactionStack;
 
     AtomicString m_overrideEncoding;
     int m_subframeCount;
diff --git a/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp b/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp
index f3d3de83..6e6be67b 100644
--- a/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp
@@ -238,9 +238,8 @@
             return;
         }
 
-        // TODO(horo): Call NavigationHintSender::handleEvent() when
-        // SpeculativeLaunchServiceWorker feature is enabled.
-        // ensureNavigationHintSender()->handleEvent(event);
+        if (RuntimeEnabledFeatures::speculativeLaunchServiceWorkerEnabled())
+            ensureNavigationHintSender()->handleEvent(event);
 
         if (isLinkClick(event) && isLiveLink()) {
             handleClick(event);
diff --git a/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp b/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
index 70543b2..1b504ec 100644
--- a/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
@@ -126,12 +126,14 @@
 
 void DocumentThreadableLoader::loadResourceSynchronously(Document& document, const ResourceRequest& request, ThreadableLoaderClient& client, const ThreadableLoaderOptions& options, const ResourceLoaderOptions& resourceLoaderOptions)
 {
-    (new DocumentThreadableLoader(document, &client, LoadSynchronously, options, resourceLoaderOptions))->start(request);
+    // The loader will be deleted as soon as this function exits.
+    std::unique_ptr<DocumentThreadableLoader> loader = wrapUnique(new DocumentThreadableLoader(document, &client, LoadSynchronously, options, resourceLoaderOptions));
+    loader->start(request);
 }
 
-DocumentThreadableLoader* DocumentThreadableLoader::create(Document& document, ThreadableLoaderClient* client, const ThreadableLoaderOptions& options, const ResourceLoaderOptions& resourceLoaderOptions)
+std::unique_ptr<DocumentThreadableLoader> DocumentThreadableLoader::create(Document& document, ThreadableLoaderClient* client, const ThreadableLoaderOptions& options, const ResourceLoaderOptions& resourceLoaderOptions)
 {
-    return new DocumentThreadableLoader(document, client, LoadAsynchronously, options, resourceLoaderOptions);
+    return wrapUnique(new DocumentThreadableLoader(document, client, LoadAsynchronously, options, resourceLoaderOptions));
 }
 
 DocumentThreadableLoader::DocumentThreadableLoader(Document& document, ThreadableLoaderClient* client, BlockingBehavior blockingBehavior, const ThreadableLoaderOptions& options, const ResourceLoaderOptions& resourceLoaderOptions)
@@ -170,6 +172,7 @@
         ThreadableLoaderClient* client = m_client;
         clear();
         client->didFail(ResourceError(errorDomainBlinkInternal, 0, request.url().getString(), "Cross origin requests are not supported."));
+        // |this| may be dead here.
         return;
     }
 
@@ -250,22 +253,26 @@
             m_fallbackRequestForServiceWorker.setSkipServiceWorker(WebURLRequest::SkipServiceWorker::Controlling);
         }
         loadRequest(newRequest, m_resourceLoaderOptions);
+        // |this| may be dead here.
         return;
     }
 
     dispatchInitialRequest(newRequest);
+    // |this| may be dead here in async mode.
 }
 
 void DocumentThreadableLoader::dispatchInitialRequest(const ResourceRequest& request)
 {
     if (!request.isExternalRequest() && (m_sameOriginRequest || m_options.crossOriginRequestPolicy == AllowCrossOriginRequests)) {
         loadRequest(request, m_resourceLoaderOptions);
+        // |this| may be dead here in async mode.
         return;
     }
 
     ASSERT(m_options.crossOriginRequestPolicy == UseAccessControl || request.isExternalRequest());
 
     makeCrossOriginAccessRequest(request);
+    // |this| may be dead here in async mode.
 }
 
 void DocumentThreadableLoader::makeCrossOriginAccessRequest(const ResourceRequest& request)
@@ -283,6 +290,7 @@
         ThreadableLoaderClient* client = m_client;
         clear();
         client->didFailAccessControlCheck(ResourceError(errorDomainBlinkInternal, 0, request.url().getString(), "Cross origin requests are only supported for protocol schemes: " + SchemeRegistry::listOfCORSEnabledURLSchemes() + "."));
+        // |this| may be dead here in async mode.
         return;
     }
 
@@ -291,6 +299,7 @@
         ThreadableLoaderClient* client = m_client;
         clear();
         client->didFailAccessControlCheck(ResourceError(errorDomainBlinkInternal, 0, request.url().getString(), "Requests to internal network resources are not allowed from non-secure contexts (see https://goo.gl/Y0ZkNV). This is an experimental restriction which is part of 'https://mikewest.github.io/cors-rfc1918/'."));
+        // |this| may be dead here in async mode.
         return;
     }
 
@@ -310,6 +319,7 @@
             crossOriginRequest.setHTTPReferrer(SecurityPolicy::generateReferrer(m_referrerAfterRedirect.referrerPolicy, crossOriginRequest.url(), m_referrerAfterRedirect.referrer));
         }
         loadRequest(crossOriginRequest, crossOriginOptions);
+        // |this| may be dead here in async mode.
     } else {
         m_crossOriginNonSimpleRequest = true;
         // Do not set the Origin header for preflight requests.
@@ -328,12 +338,14 @@
         bool canSkipPreflight = CrossOriginPreflightResultCache::shared().canSkipPreflight(getSecurityOrigin()->toString(), m_actualRequest.url(), effectiveAllowCredentials(), m_actualRequest.httpMethod(), m_actualRequest.httpHeaderFields());
         if (canSkipPreflight && !shouldForcePreflight) {
             loadActualRequest();
+            // |this| may be dead here in async mode.
         } else {
             ResourceRequest preflightRequest = createAccessControlPreflightRequest(m_actualRequest, getSecurityOrigin());
             // Create a ResourceLoaderOptions for preflight.
             ResourceLoaderOptions preflightOptions = m_actualOptions;
             preflightOptions.allowCredentials = DoNotAllowStoredCredentials;
             loadRequest(preflightRequest, preflightOptions);
+            // |this| may be dead here in async mode.
         }
     }
 }
@@ -341,7 +353,7 @@
 DocumentThreadableLoader::~DocumentThreadableLoader()
 {
     CHECK(!m_client);
-    DCHECK(!resource());
+    DCHECK(!m_resource);
 }
 
 void DocumentThreadableLoader::overrideTimeout(unsigned long timeoutMilliseconds)
@@ -373,6 +385,7 @@
 void DocumentThreadableLoader::cancel()
 {
     cancelWithError(ResourceError());
+    // |this| may be dead here.
 }
 
 void DocumentThreadableLoader::cancelWithError(const ResourceError& error)
@@ -393,6 +406,7 @@
     ThreadableLoaderClient* client = m_client;
     clear();
     client->didFail(errorForCallback);
+    // |this| may be dead here in async mode.
 }
 
 void DocumentThreadableLoader::setDefersLoading(bool value)
@@ -425,6 +439,7 @@
         reportResponseReceived(resource->identifier(), redirectResponse);
 
         handlePreflightFailure(redirectResponse.url().getString(), "Response for preflight is invalid (redirect)");
+        // |this| may be dead here.
 
         request = ResourceRequest();
 
@@ -467,6 +482,7 @@
         ThreadableLoaderClient* client = m_client;
         clear();
         client->didFailRedirectCheck();
+        // |this| may be dead here.
 
         request = ResourceRequest();
 
@@ -484,7 +500,10 @@
         ThreadableLoaderClient* client = m_client;
         clear();
         client->didFailRedirectCheck();
+        // |this| may be dead here.
+
         request = ResourceRequest();
+
         return;
     }
 
@@ -513,7 +532,10 @@
         ThreadableLoaderClient* client = m_client;
         clear();
         client->didFailAccessControlCheck(ResourceError(errorDomainBlinkInternal, 0, redirectResponse.url().getString(), accessControlErrorDescription));
+        // |this| may be dead here.
+
         request = ResourceRequest();
+
         return;
     }
 
@@ -559,6 +581,7 @@
     ThreadableLoaderClient* client = m_client;
     clear();
     client->didFailRedirectCheck();
+    // |this| may be dead here
 }
 
 void DocumentThreadableLoader::dataSent(Resource* resource, unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
@@ -568,6 +591,7 @@
     ASSERT(m_async);
 
     m_client->didSendData(bytesSent, totalBytesToBeSent);
+    // |this| may be dead here.
 }
 
 void DocumentThreadableLoader::dataDownloaded(Resource* resource, int dataLength)
@@ -578,6 +602,7 @@
     ASSERT(m_async);
 
     m_client->didDownloadData(dataLength);
+    // |this| may be dead here.
 }
 
 void DocumentThreadableLoader::didReceiveResourceTiming(Resource* resource, const ResourceTimingInfo& info)
@@ -587,6 +612,7 @@
     ASSERT(m_async);
 
     m_client->didReceiveResourceTiming(info);
+    // |this| may be dead here.
 }
 
 void DocumentThreadableLoader::responseReceived(Resource* resource, const ResourceResponse& response, std::unique_ptr<WebDataConsumerHandle> handle)
@@ -598,6 +624,7 @@
         m_isUsingDataConsumerHandle = true;
 
     handleResponse(resource->identifier(), response, std::move(handle));
+    // |this| may be dead here.
 }
 
 void DocumentThreadableLoader::handlePreflightResponse(const ResourceResponse& response)
@@ -606,16 +633,19 @@
 
     if (!passesAccessControlCheck(response, effectiveAllowCredentials(), getSecurityOrigin(), accessControlErrorDescription, m_requestContext)) {
         handlePreflightFailure(response.url().getString(), "Response to preflight request doesn't pass access control check: " + accessControlErrorDescription);
+        // |this| may be dead here in async mode.
         return;
     }
 
     if (!passesPreflightStatusCheck(response, accessControlErrorDescription)) {
         handlePreflightFailure(response.url().getString(), accessControlErrorDescription);
+        // |this| may be dead here in async mode.
         return;
     }
 
     if (m_actualRequest.isExternalRequest() && !passesExternalPreflightCheck(response, accessControlErrorDescription)) {
         handlePreflightFailure(response.url().getString(), accessControlErrorDescription);
+        // |this| may be dead here in async mode.
         return;
     }
 
@@ -624,6 +654,7 @@
         || !preflightResult->allowsCrossOriginMethod(m_actualRequest.httpMethod(), accessControlErrorDescription)
         || !preflightResult->allowsCrossOriginHeaders(m_actualRequest.httpHeaderFields(), accessControlErrorDescription)) {
         handlePreflightFailure(response.url().getString(), accessControlErrorDescription);
+        // |this| may be dead here in async mode.
         return;
     }
 
@@ -651,6 +682,7 @@
     if (!m_actualRequest.isNull()) {
         reportResponseReceived(identifier, response);
         handlePreflightResponse(response);
+        // |this| may be dead here in async mode.
         return;
     }
 
@@ -663,6 +695,7 @@
             ASSERT(!m_fallbackRequestForServiceWorker.isNull());
             reportResponseReceived(identifier, response);
             loadFallbackRequestForServiceWorker();
+            // |this| may be dead here in async mode.
             return;
         }
         m_fallbackRequestForServiceWorker = ResourceRequest();
@@ -690,6 +723,7 @@
             ThreadableLoaderClient* client = m_client;
             clear();
             client->didFailAccessControlCheck(ResourceError(errorDomainBlinkInternal, 0, response.url().getString(), accessControlErrorDescription));
+            // |this| may be dead here.
             return;
         }
     }
@@ -702,6 +736,7 @@
     if (!m_actualRequest.isNull())
         return;
     m_client->didReceiveCachedMetadata(data, size);
+    // |this| may be dead here.
 }
 
 void DocumentThreadableLoader::dataReceived(Resource* resource, const char* data, size_t dataLength)
@@ -715,6 +750,7 @@
     // TODO(junov): Fix the ThreadableLoader ecosystem to use size_t.
     // Until then, we use safeCast to trap potential overflows.
     handleReceivedData(data, safeCast<unsigned>(dataLength));
+    // |this| may be dead here.
 }
 
 void DocumentThreadableLoader::handleReceivedData(const char* data, size_t dataLength)
@@ -728,6 +764,7 @@
     ASSERT(m_fallbackRequestForServiceWorker.isNull());
 
     m_client->didReceiveData(data, dataLength);
+    // |this| may be dead here in async mode.
 }
 
 void DocumentThreadableLoader::notifyFinished(Resource* resource)
@@ -738,8 +775,10 @@
 
     if (resource->errorOccurred()) {
         handleError(resource->resourceError());
+        // |this| may be dead here.
     } else {
         handleSuccessfulFinish(resource->identifier(), resource->loadFinishTime());
+        // |this| may be dead here.
     }
 }
 
@@ -754,15 +793,17 @@
         ASSERT(!m_sameOriginRequest);
         ASSERT(m_options.crossOriginRequestPolicy == UseAccessControl);
         loadActualRequest();
+        // |this| may be dead here in async mode.
         return;
     }
 
     ThreadableLoaderClient* client = m_client;
     // Protect the resource in |didFinishLoading| in order not to release the
     // downloaded file.
-    Persistent<Resource> protect = resource();
+    Persistent<Resource> resource = m_resource;
     clear();
     client->didFinishLoading(identifier, finishTime);
+    // |this| may be dead here in async mode.
 }
 
 void DocumentThreadableLoader::didTimeout(TimerBase* timer)
@@ -775,6 +816,7 @@
     ResourceError error("net", timeoutError, resource()->url(), String());
     error.setIsTimeout(true);
     cancelWithError(error);
+    // |this| may be dead here.
 }
 
 void DocumentThreadableLoader::loadFallbackRequestForServiceWorker()
@@ -783,6 +825,7 @@
     ResourceRequest fallbackRequest(m_fallbackRequestForServiceWorker);
     m_fallbackRequestForServiceWorker = ResourceRequest();
     dispatchInitialRequest(fallbackRequest);
+    // |this| may be dead here in async mode.
 }
 
 void DocumentThreadableLoader::loadActualRequest()
@@ -803,6 +846,7 @@
     actualRequest.setSkipServiceWorker(WebURLRequest::SkipServiceWorker::All);
 
     loadRequest(actualRequest, actualOptions);
+    // |this| may be dead here in async mode.
 }
 
 void DocumentThreadableLoader::handlePreflightFailure(const String& url, const String& errorDescription)
@@ -815,6 +859,7 @@
     ThreadableLoaderClient* client = m_client;
     clear();
     client->didFailAccessControlCheck(error);
+    // |this| may be dead here in async mode.
 }
 
 void DocumentThreadableLoader::handleError(const ResourceError& error)
@@ -827,6 +872,7 @@
     ThreadableLoaderClient* client = m_client;
     clear();
     client->didFail(copiedError);
+    // |this| may be dead here.
 }
 
 void DocumentThreadableLoader::loadRequest(const ResourceRequest& request, ResourceLoaderOptions resourceLoaderOptions)
@@ -862,6 +908,7 @@
             setResource(RawResource::fetch(newRequest, document().fetcher()));
 
         // setResource() might call notifyFinished() synchronously, and thus
+        // clear() might be called and |this| may be dead here.
         if (!self)
             return;
 
@@ -875,6 +922,7 @@
             if (!client)
                 return;
             client->didFail(ResourceError(errorDomainBlinkInternal, 0, requestURL.getString(), "Failed to start loading."));
+            // |this| may be dead here.
             return;
         }
 
@@ -969,11 +1017,4 @@
     return *m_document;
 }
 
-DEFINE_TRACE(DocumentThreadableLoader)
-{
-    visitor->trace(m_document);
-    ThreadableLoader::trace(visitor);
-    ResourceOwner<RawResource>::trace(visitor);
-}
-
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.h b/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.h
index 79e8336d..1cb373d 100644
--- a/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.h
+++ b/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.h
@@ -54,11 +54,11 @@
 class SecurityOrigin;
 class ThreadableLoaderClient;
 
-class CORE_EXPORT DocumentThreadableLoader final : public ThreadableLoader, private ResourceOwner<RawResource> {
-    USING_GARBAGE_COLLECTED_MIXIN(DocumentThreadableLoader);
+class CORE_EXPORT DocumentThreadableLoader final : public ThreadableLoader, private RawResourceClient {
+    USING_FAST_MALLOC(DocumentThreadableLoader);
     public:
         static void loadResourceSynchronously(Document&, const ResourceRequest&, ThreadableLoaderClient&, const ThreadableLoaderOptions&, const ResourceLoaderOptions&);
-        static DocumentThreadableLoader* create(Document&, ThreadableLoaderClient*, const ThreadableLoaderOptions&, const ResourceLoaderOptions&);
+        static std::unique_ptr<DocumentThreadableLoader> create(Document&, ThreadableLoaderClient*, const ThreadableLoaderOptions&, const ResourceLoaderOptions&);
         ~DocumentThreadableLoader() override;
 
         void start(const ResourceRequest&) override;
@@ -69,8 +69,6 @@
         void cancel() override;
         void setDefersLoading(bool);
 
-        DECLARE_TRACE();
-
     private:
         enum BlockingBehavior {
             LoadSynchronously,
@@ -151,11 +149,34 @@
         // returns allowCredentials value of m_resourceLoaderOptions.
         StoredCredentials effectiveAllowCredentials() const;
 
+        // TODO(oilpan): DocumentThreadableLoader used to be a ResourceOwner,
+        // but ResourceOwner was moved onto the oilpan heap before
+        // DocumentThreadableLoader was ready. When DocumentThreadableLoader
+        // moves onto the oilpan heap, make it a ResourceOwner again and remove
+        // this re-implementation of ResourceOwner.
+        RawResource* resource() const { return m_resource.get(); }
+        void clearResource() { setResource(nullptr); }
+        void setResource(RawResource* newResource)
+        {
+            if (newResource == m_resource)
+                return;
+
+            if (RawResource* oldResource = m_resource.release())
+                oldResource->removeClient(this);
+
+            if (newResource) {
+                m_resource = newResource;
+                m_resource->addClient(this);
+            }
+        }
+        Persistent<RawResource> m_resource;
+        // End of ResourceOwner re-implementation, see above.
+
         SecurityOrigin* getSecurityOrigin() const;
         Document& document() const;
 
         ThreadableLoaderClient* m_client;
-        Member<Document> m_document;
+        WeakPersistent<Document> m_document;
 
         const ThreadableLoaderOptions m_options;
         // Some items may be overridden by m_forceDoNotAllowStoredCredentials
diff --git a/third_party/WebKit/Source/core/loader/MockThreadableLoader.h b/third_party/WebKit/Source/core/loader/MockThreadableLoader.h
index 99a81061..47691965 100644
--- a/third_party/WebKit/Source/core/loader/MockThreadableLoader.h
+++ b/third_party/WebKit/Source/core/loader/MockThreadableLoader.h
@@ -14,7 +14,7 @@
 
 class MockThreadableLoader : public ThreadableLoader {
 public:
-    static MockThreadableLoader* create() { return new testing::StrictMock<MockThreadableLoader>; }
+    static std::unique_ptr<MockThreadableLoader> create() { return wrapUnique(new testing::StrictMock<MockThreadableLoader>); }
 
     MOCK_METHOD1(start, void(const ResourceRequest&));
     MOCK_METHOD1(overrideTimeout, void(unsigned long));
diff --git a/third_party/WebKit/Source/core/loader/ThreadableLoader.cpp b/third_party/WebKit/Source/core/loader/ThreadableLoader.cpp
index 11d2d47..16f78451 100644
--- a/third_party/WebKit/Source/core/loader/ThreadableLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/ThreadableLoader.cpp
@@ -33,12 +33,15 @@
 #include "core/dom/Document.h"
 #include "core/dom/ExecutionContext.h"
 #include "core/loader/DocumentThreadableLoader.h"
+#include "core/loader/ThreadableLoaderClientWrapper.h"
 #include "core/loader/WorkerThreadableLoader.h"
 #include "core/workers/WorkerGlobalScope.h"
+#include "core/workers/WorkerThread.h"
+#include <memory>
 
 namespace blink {
 
-ThreadableLoader* ThreadableLoader::create(ExecutionContext& context, ThreadableLoaderClient* client, const ThreadableLoaderOptions& options, const ResourceLoaderOptions& resourceLoaderOptions)
+std::unique_ptr<ThreadableLoader> ThreadableLoader::create(ExecutionContext& context, ThreadableLoaderClient* client, const ThreadableLoaderOptions& options, const ResourceLoaderOptions& resourceLoaderOptions)
 {
     ASSERT(client);
 
diff --git a/third_party/WebKit/Source/core/loader/ThreadableLoader.h b/third_party/WebKit/Source/core/loader/ThreadableLoader.h
index 9a1be36..4d26431 100644
--- a/third_party/WebKit/Source/core/loader/ThreadableLoader.h
+++ b/third_party/WebKit/Source/core/loader/ThreadableLoader.h
@@ -34,7 +34,6 @@
 #include "core/CoreExport.h"
 #include "core/fetch/ResourceLoaderOptions.h"
 #include "platform/CrossThreadCopier.h"
-#include "platform/heap/Handle.h"
 #include "wtf/Allocator.h"
 #include "wtf/Noncopyable.h"
 #include <memory>
@@ -127,7 +126,7 @@
 // - ResourceLoaderOptions argument will be passed to the FetchRequest
 //   that this ThreadableLoader creates. It can be altered e.g. when
 //   redirect happens.
-class CORE_EXPORT ThreadableLoader : public GarbageCollectedFinalized<ThreadableLoader> {
+class CORE_EXPORT ThreadableLoader {
     WTF_MAKE_NONCOPYABLE(ThreadableLoader);
 public:
     // ThreadableLoaderClient methods may not destroy the ThreadableLoader
@@ -168,7 +167,7 @@
     // - may call cancel()
     // - can destroy the ThreadableLoader instance in them (by clearing
     //   std::unique_ptr<ThreadableLoader>).
-    static ThreadableLoader* create(ExecutionContext&, ThreadableLoaderClient*, const ThreadableLoaderOptions&, const ResourceLoaderOptions&);
+    static std::unique_ptr<ThreadableLoader> create(ExecutionContext&, ThreadableLoaderClient*, const ThreadableLoaderOptions&, const ResourceLoaderOptions&);
 
     // The methods on the ThreadableLoaderClient passed on create() call
     // may be called synchronous to start() call.
@@ -185,8 +184,6 @@
 
     virtual ~ThreadableLoader() { }
 
-    DEFINE_INLINE_VIRTUAL_TRACE() {}
-
 protected:
     ThreadableLoader() { }
 };
diff --git a/third_party/WebKit/Source/core/loader/ThreadableLoaderClientWrapper.h b/third_party/WebKit/Source/core/loader/ThreadableLoaderClientWrapper.h
new file mode 100644
index 0000000..c78779b
--- /dev/null
+++ b/third_party/WebKit/Source/core/loader/ThreadableLoaderClientWrapper.h
@@ -0,0 +1,158 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ThreadableLoaderClientWrapper_h
+#define ThreadableLoaderClientWrapper_h
+
+#include "core/loader/ThreadableLoaderClient.h"
+#include "core/timing/WorkerGlobalScopePerformance.h"
+#include "core/workers/WorkerGlobalScope.h"
+#include "platform/heap/Handle.h"
+#include "platform/network/ResourceResponse.h"
+#include "platform/network/ResourceTimingInfo.h"
+#include "wtf/Threading.h"
+#include "wtf/Vector.h"
+#include <memory>
+
+namespace blink {
+
+class ThreadableLoaderClientWrapper final : public GarbageCollected<ThreadableLoaderClientWrapper> {
+public:
+    ThreadableLoaderClientWrapper(WorkerGlobalScope& workerGlobalScope, ThreadableLoaderClient* client)
+        : m_workerGlobalScope(workerGlobalScope)
+        , m_client(client)
+    {
+    }
+
+    void clearClient()
+    {
+        m_done = true;
+        m_client = nullptr;
+    }
+
+    bool done() const { return m_done; }
+
+    void didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
+    {
+        if (m_client)
+            m_client->didSendData(bytesSent, totalBytesToBeSent);
+    }
+
+    void didReceiveResponse(unsigned long identifier, std::unique_ptr<CrossThreadResourceResponseData> responseData, std::unique_ptr<WebDataConsumerHandle> handle)
+    {
+        ResourceResponse response(responseData.get());
+
+        if (m_client)
+            m_client->didReceiveResponse(identifier, response, std::move(handle));
+    }
+
+    void didReceiveData(std::unique_ptr<Vector<char>> data)
+    {
+        RELEASE_ASSERT(data->size() <= std::numeric_limits<unsigned>::max());
+
+        if (m_client)
+            m_client->didReceiveData(data->data(), data->size());
+    }
+
+    void didReceiveCachedMetadata(std::unique_ptr<Vector<char>> data)
+    {
+        if (m_client)
+            m_client->didReceiveCachedMetadata(data->data(), data->size());
+    }
+
+    void didFinishLoading(unsigned long identifier, double finishTime)
+    {
+        m_done = true;
+        if (m_client) {
+            ThreadableLoaderClient* client = m_client;
+            m_client = nullptr;
+            client->didFinishLoading(identifier, finishTime);
+        }
+    }
+
+    void didFail(const ResourceError& error)
+    {
+        m_done = true;
+        if (m_client) {
+            ThreadableLoaderClient* client = m_client;
+            m_client = nullptr;
+            client->didFail(error);
+        }
+    }
+
+    void didFailAccessControlCheck(const ResourceError& error)
+    {
+        m_done = true;
+        if (m_client) {
+            ThreadableLoaderClient* client = m_client;
+            m_client = nullptr;
+            client->didFailAccessControlCheck(error);
+        }
+    }
+
+    void didFailRedirectCheck()
+    {
+        m_done = true;
+        if (m_client) {
+            ThreadableLoaderClient* client = m_client;
+            m_client = nullptr;
+            client->didFailRedirectCheck();
+        }
+    }
+
+    void didDownloadData(int dataLength)
+    {
+        if (m_client)
+            m_client->didDownloadData(dataLength);
+    }
+
+    void didReceiveResourceTiming(std::unique_ptr<CrossThreadResourceTimingInfoData> timingData)
+    {
+        std::unique_ptr<ResourceTimingInfo> info(ResourceTimingInfo::adopt(std::move(timingData)));
+        if (m_client) {
+            WorkerGlobalScopePerformance::performance(*m_workerGlobalScope)->addResourceTiming(*info);
+            m_client->didReceiveResourceTiming(*info);
+        }
+    }
+
+    DEFINE_INLINE_TRACE()
+    {
+        visitor->trace(m_workerGlobalScope);
+    }
+
+private:
+    Member<WorkerGlobalScope> m_workerGlobalScope;
+    ThreadableLoaderClient* m_client = nullptr;
+    bool m_done = false;
+};
+
+} // namespace blink
+
+#endif // ThreadableLoaderClientWrapper_h
diff --git a/third_party/WebKit/Source/core/loader/ThreadableLoaderTest.cpp b/third_party/WebKit/Source/core/loader/ThreadableLoaderTest.cpp
index 668a004..d9e53d2 100644
--- a/third_party/WebKit/Source/core/loader/ThreadableLoaderTest.cpp
+++ b/third_party/WebKit/Source/core/loader/ThreadableLoaderTest.cpp
@@ -157,7 +157,7 @@
 
     std::unique_ptr<DummyPageHolder> m_dummyPageHolder;
     Checkpoint m_checkpoint;
-    Persistent<DocumentThreadableLoader> m_loader;
+    std::unique_ptr<DocumentThreadableLoader> m_loader;
 };
 
 class WorkerThreadableLoaderTestHelper : public ThreadableLoaderTestHelper, public WorkerLoaderProxyProvider {
@@ -213,7 +213,7 @@
     {
         ASSERT(m_workerThread);
         ASSERT(m_workerThread->isCurrentThread());
-        m_loader = nullptr;
+        m_loader.reset();
     }
 
     Checkpoint& checkpoint() override
@@ -336,7 +336,7 @@
     std::unique_ptr<DummyPageHolder> m_dummyPageHolder;
     Checkpoint m_checkpoint;
     // |m_loader| must be touched only from the worker thread only.
-    CrossThreadPersistent<ThreadableLoader> m_loader;
+    std::unique_ptr<ThreadableLoader> m_loader;
 };
 
 class ThreadableLoaderTest : public ::testing::TestWithParam<ThreadableLoaderToTest> {
diff --git a/third_party/WebKit/Source/core/loader/WorkerThreadableLoader.cpp b/third_party/WebKit/Source/core/loader/WorkerThreadableLoader.cpp
index a64cf35..19f24037 100644
--- a/third_party/WebKit/Source/core/loader/WorkerThreadableLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/WorkerThreadableLoader.cpp
@@ -208,42 +208,74 @@
     const ResourceLoaderOptions& resourceLoaderOptions,
     BlockingBehavior blockingBehavior)
     : m_workerGlobalScope(&workerGlobalScope)
-    , m_workerLoaderProxy(workerGlobalScope.thread()->workerLoaderProxy())
-    , m_client(client)
-    , m_threadableLoaderOptions(options)
-    , m_resourceLoaderOptions(resourceLoaderOptions)
-    , m_blockingBehavior(blockingBehavior)
+    , m_workerClientWrapper(new ThreadableLoaderClientWrapper(workerGlobalScope, client))
+    , m_bridge(new Bridge(m_workerClientWrapper, workerGlobalScope.thread()->workerLoaderProxy(), options, resourceLoaderOptions, blockingBehavior))
 {
-    DCHECK(client);
 }
 
 void WorkerThreadableLoader::loadResourceSynchronously(WorkerGlobalScope& workerGlobalScope, const ResourceRequest& request, ThreadableLoaderClient& client, const ThreadableLoaderOptions& options, const ResourceLoaderOptions& resourceLoaderOptions)
 {
-    (new WorkerThreadableLoader(workerGlobalScope, &client, options, resourceLoaderOptions, LoadSynchronously))->start(request);
+    std::unique_ptr<WorkerThreadableLoader> loader = wrapUnique(new WorkerThreadableLoader(workerGlobalScope, &client, options, resourceLoaderOptions, LoadSynchronously));
+    loader->start(request);
 }
 
 WorkerThreadableLoader::~WorkerThreadableLoader()
 {
-    DCHECK(!m_mainThreadLoaderHolder);
-    DCHECK(!m_client);
+    DCHECK(m_workerClientWrapper->done());
+    m_bridge->destroy();
 }
 
-void WorkerThreadableLoader::start(const ResourceRequest& originalRequest)
+void WorkerThreadableLoader::start(const ResourceRequest& request)
 {
-    ResourceRequest request(originalRequest);
-    if (!request.didSetHTTPReferrer())
-        request.setHTTPReferrer(SecurityPolicy::generateReferrer(m_workerGlobalScope->getReferrerPolicy(), request.url(), m_workerGlobalScope->outgoingReferrer()));
+    ResourceRequest requestToPass(request);
+    if (!requestToPass.didSetHTTPReferrer())
+        requestToPass.setHTTPReferrer(SecurityPolicy::generateReferrer(m_workerGlobalScope->getReferrerPolicy(), request.url(), m_workerGlobalScope->outgoingReferrer()));
+    m_bridge->start(requestToPass, *m_workerGlobalScope);
+}
 
+void WorkerThreadableLoader::overrideTimeout(unsigned long timeoutMilliseconds)
+{
+    m_bridge->overrideTimeout(timeoutMilliseconds);
+}
+
+void WorkerThreadableLoader::cancel()
+{
+    m_bridge->cancel();
+}
+
+WorkerThreadableLoader::Bridge::Bridge(
+    ThreadableLoaderClientWrapper* clientWrapper,
+    PassRefPtr<WorkerLoaderProxy> loaderProxy,
+    const ThreadableLoaderOptions& threadableLoaderOptions,
+    const ResourceLoaderOptions& resourceLoaderOptions,
+    BlockingBehavior blockingBehavior)
+    : m_clientWrapper(clientWrapper)
+    , m_loaderProxy(loaderProxy)
+    , m_threadableLoaderOptions(threadableLoaderOptions)
+    , m_resourceLoaderOptions(resourceLoaderOptions)
+    , m_blockingBehavior(blockingBehavior)
+{
+    DCHECK(!isMainThread());
+}
+
+WorkerThreadableLoader::Bridge::~Bridge()
+{
+    DCHECK(!isMainThread());
+    DCHECK(!m_peer);
+}
+
+void WorkerThreadableLoader::Bridge::start(const ResourceRequest& request, const WorkerGlobalScope& workerGlobalScope)
+{
     DCHECK(!isMainThread());
     RefPtr<WaitableEventWithTasks> eventWithTasks;
     if (m_blockingBehavior == LoadSynchronously)
         eventWithTasks = WaitableEventWithTasks::create();
 
-    m_workerLoaderProxy->postTaskToLoader(BLINK_FROM_HERE, createCrossThreadTask(
-        &MainThreadLoaderHolder::createAndStart,
+    m_loaderProxy->postTaskToLoader(BLINK_FROM_HERE, createCrossThreadTask(
+        &Peer::createAndStart,
         wrapCrossThreadPersistent(this),
-        m_workerLoaderProxy,
-        wrapCrossThreadPersistent(m_workerGlobalScope->thread()->getWorkerThreadLifecycleContext()),
+        m_loaderProxy,
+        wrapCrossThreadPersistent(workerGlobalScope.thread()->getWorkerThreadLifecycleContext()),
         request,
         m_threadableLoaderOptions,
         m_resourceLoaderOptions,
@@ -275,152 +307,67 @@
     }
 }
 
-void WorkerThreadableLoader::overrideTimeout(unsigned long timeoutMilliseconds)
+void WorkerThreadableLoader::Bridge::overrideTimeout(unsigned long timeoutMilliseconds)
 {
     DCHECK(!isMainThread());
-    if (!m_mainThreadLoaderHolder)
+    if (!m_peer)
         return;
-    m_workerLoaderProxy->postTaskToLoader(BLINK_FROM_HERE, createCrossThreadTask(&MainThreadLoaderHolder::overrideTimeout, m_mainThreadLoaderHolder, timeoutMilliseconds));
+    m_loaderProxy->postTaskToLoader(BLINK_FROM_HERE, createCrossThreadTask(&Peer::overrideTimeout, m_peer, timeoutMilliseconds));
 }
 
-void WorkerThreadableLoader::cancel()
+void WorkerThreadableLoader::Bridge::cancel()
 {
     DCHECK(!isMainThread());
-    if (m_mainThreadLoaderHolder) {
-        m_workerLoaderProxy->postTaskToLoader(BLINK_FROM_HERE, createCrossThreadTask(&MainThreadLoaderHolder::cancel, m_mainThreadLoaderHolder));
-        m_mainThreadLoaderHolder = nullptr;
-    }
+    cancelPeer();
 
-    if (!m_client)
+    if (m_clientWrapper->done())
         return;
-
     // If the client hasn't reached a termination state, then transition it
     // by sending a cancellation error.
     // Note: no more client callbacks will be done after this method -- the
     // clearClient() call ensures that.
     ResourceError error(String(), 0, String(), String());
     error.setIsCancellation(true);
-    didFail(error);
-    DCHECK(!m_client);
+    m_clientWrapper->didFail(error);
+    m_clientWrapper->clearClient();
 }
 
-void WorkerThreadableLoader::didStart(MainThreadLoaderHolder* mainThreadLoaderHolder)
+void WorkerThreadableLoader::Bridge::destroy()
 {
     DCHECK(!isMainThread());
-    DCHECK(!m_mainThreadLoaderHolder);
-    DCHECK(mainThreadLoaderHolder);
-    if (!m_client) {
+    cancelPeer();
+    m_clientWrapper->clearClient();
+}
+
+void WorkerThreadableLoader::Bridge::didStart(Peer* peer)
+{
+    DCHECK(!isMainThread());
+    DCHECK(!m_peer);
+    DCHECK(peer);
+    if (m_clientWrapper->done()) {
         // The loading is already cancelled.
         return;
     }
 
-    m_mainThreadLoaderHolder = mainThreadLoaderHolder;
+    m_peer = peer;
 }
 
-void WorkerThreadableLoader::didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
+DEFINE_TRACE(WorkerThreadableLoader::Bridge)
+{
+    visitor->trace(m_clientWrapper);
+}
+
+void WorkerThreadableLoader::Bridge::cancelPeer()
 {
     DCHECK(!isMainThread());
-    if (!m_client)
+    if (!m_peer)
         return;
-    m_client->didSendData(bytesSent, totalBytesToBeSent);
+    m_loaderProxy->postTaskToLoader(BLINK_FROM_HERE, createCrossThreadTask(&Peer::cancel, m_peer));
+    m_peer = nullptr;
 }
 
-void WorkerThreadableLoader::didReceiveResponse(unsigned long identifier, std::unique_ptr<CrossThreadResourceResponseData> responseData, std::unique_ptr<WebDataConsumerHandle> handle)
-{
-    DCHECK(!isMainThread());
-    if (!m_client)
-        return;
-    ResourceResponse response(responseData.get());
-    m_client->didReceiveResponse(identifier, response, std::move(handle));
-}
-
-void WorkerThreadableLoader::didReceiveData(std::unique_ptr<Vector<char>> data)
-{
-    DCHECK(!isMainThread());
-    CHECK_LE(data->size(), std::numeric_limits<unsigned>::max());
-    if (!m_client)
-        return;
-    m_client->didReceiveData(data->data(), data->size());
-}
-
-void WorkerThreadableLoader::didReceiveCachedMetadata(std::unique_ptr<Vector<char>> data)
-{
-    DCHECK(!isMainThread());
-    if (!m_client)
-        return;
-    m_client->didReceiveCachedMetadata(data->data(), data->size());
-}
-
-void WorkerThreadableLoader::didFinishLoading(unsigned long identifier, double finishTime)
-{
-    DCHECK(!isMainThread());
-    if (!m_client)
-        return;
-    auto* client = m_client;
-    m_client = nullptr;
-    m_mainThreadLoaderHolder = nullptr;
-    client->didFinishLoading(identifier, finishTime);
-}
-
-void WorkerThreadableLoader::didFail(const ResourceError& error)
-{
-    DCHECK(!isMainThread());
-    if (!m_client)
-        return;
-    auto* client = m_client;
-    m_client = nullptr;
-    m_mainThreadLoaderHolder = nullptr;
-    client->didFail(error);
-}
-
-void WorkerThreadableLoader::didFailAccessControlCheck(const ResourceError& error)
-{
-    DCHECK(!isMainThread());
-    if (!m_client)
-        return;
-    auto* client = m_client;
-    m_client = nullptr;
-    m_mainThreadLoaderHolder = nullptr;
-    client->didFailAccessControlCheck(error);
-}
-
-void WorkerThreadableLoader::didFailRedirectCheck()
-{
-    DCHECK(!isMainThread());
-    if (!m_client)
-        return;
-    auto* client = m_client;
-    m_client = nullptr;
-    m_mainThreadLoaderHolder = nullptr;
-    client->didFailRedirectCheck();
-}
-
-void WorkerThreadableLoader::didDownloadData(int dataLength)
-{
-    DCHECK(!isMainThread());
-    if (!m_client)
-        return;
-    m_client->didDownloadData(dataLength);
-}
-
-void WorkerThreadableLoader::didReceiveResourceTiming(std::unique_ptr<CrossThreadResourceTimingInfoData> timingData)
-{
-    DCHECK(!isMainThread());
-    if (!m_client)
-        return;
-    std::unique_ptr<ResourceTimingInfo> info(ResourceTimingInfo::adopt(std::move(timingData)));
-    WorkerGlobalScopePerformance::performance(*m_workerGlobalScope)->addResourceTiming(*info);
-    m_client->didReceiveResourceTiming(*info);
-}
-
-DEFINE_TRACE(WorkerThreadableLoader)
-{
-    visitor->trace(m_workerGlobalScope);
-    ThreadableLoader::trace(visitor);
-}
-
-void WorkerThreadableLoader::MainThreadLoaderHolder::createAndStart(
-    WorkerThreadableLoader* workerLoader,
+void WorkerThreadableLoader::Peer::createAndStart(
+    Bridge* bridge,
     PassRefPtr<WorkerLoaderProxy> passLoaderProxy,
     WorkerThreadLifecycleContext* workerThreadLifecycleContext,
     std::unique_ptr<CrossThreadResourceRequestData> request,
@@ -437,25 +384,25 @@
     else
         forwarder = new AsyncTaskForwarder(loaderProxy);
 
-    MainThreadLoaderHolder* mainThreadLoaderHolder = new MainThreadLoaderHolder(forwarder, workerThreadLifecycleContext);
-    if (mainThreadLoaderHolder->wasContextDestroyedBeforeObserverCreation()) {
+    Peer* peer = new Peer(forwarder, workerThreadLifecycleContext);
+    if (peer->wasContextDestroyedBeforeObserverCreation()) {
         // The thread is already terminating.
         forwarder->abort();
-        mainThreadLoaderHolder->m_forwarder = nullptr;
+        peer->m_forwarder = nullptr;
         return;
     }
-    mainThreadLoaderHolder->m_workerLoader = workerLoader;
-    mainThreadLoaderHolder->start(*toDocument(executionContext), std::move(request), options, resourceLoaderOptions);
-    forwarder->forwardTask(BLINK_FROM_HERE, createCrossThreadTask(&WorkerThreadableLoader::didStart, wrapCrossThreadPersistent(workerLoader), wrapCrossThreadPersistent(mainThreadLoaderHolder)));
+    peer->m_clientWrapper = bridge->clientWrapper();
+    peer->start(*toDocument(executionContext), std::move(request), options, resourceLoaderOptions);
+    forwarder->forwardTask(BLINK_FROM_HERE, createCrossThreadTask(&Bridge::didStart, wrapCrossThreadPersistent(bridge), wrapCrossThreadPersistent(peer)));
 }
 
-WorkerThreadableLoader::MainThreadLoaderHolder::~MainThreadLoaderHolder()
+WorkerThreadableLoader::Peer::~Peer()
 {
     DCHECK(isMainThread());
-    DCHECK(!m_workerLoader);
+    DCHECK(!m_mainThreadLoader);
 }
 
-void WorkerThreadableLoader::MainThreadLoaderHolder::overrideTimeout(unsigned long timeoutMilliseconds)
+void WorkerThreadableLoader::Peer::overrideTimeout(unsigned long timeoutMilliseconds)
 {
     DCHECK(isMainThread());
     if (!m_mainThreadLoader)
@@ -463,7 +410,7 @@
     m_mainThreadLoader->overrideTimeout(timeoutMilliseconds);
 }
 
-void WorkerThreadableLoader::MainThreadLoaderHolder::cancel()
+void WorkerThreadableLoader::Peer::cancel()
 {
     DCHECK(isMainThread());
     if (!m_mainThreadLoader)
@@ -472,126 +419,125 @@
     m_mainThreadLoader = nullptr;
 }
 
-void WorkerThreadableLoader::MainThreadLoaderHolder::didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
+void WorkerThreadableLoader::Peer::didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
 {
     DCHECK(isMainThread());
-    CrossThreadPersistent<WorkerThreadableLoader> workerLoader = m_workerLoader.get();
-    if (!workerLoader || !m_forwarder)
+    CrossThreadPersistent<ThreadableLoaderClientWrapper> clientWrapper = m_clientWrapper.get();
+    if (!clientWrapper || !m_forwarder)
         return;
-    m_forwarder->forwardTask(BLINK_FROM_HERE, createCrossThreadTask(&WorkerThreadableLoader::didSendData, workerLoader, bytesSent, totalBytesToBeSent));
+    m_forwarder->forwardTask(BLINK_FROM_HERE, createCrossThreadTask(&ThreadableLoaderClientWrapper::didSendData, clientWrapper, bytesSent, totalBytesToBeSent));
 }
 
-void WorkerThreadableLoader::MainThreadLoaderHolder::didReceiveResponse(unsigned long identifier, const ResourceResponse& response, std::unique_ptr<WebDataConsumerHandle> handle)
+void WorkerThreadableLoader::Peer::didReceiveResponse(unsigned long identifier, const ResourceResponse& response, std::unique_ptr<WebDataConsumerHandle> handle)
 {
     DCHECK(isMainThread());
-    CrossThreadPersistent<WorkerThreadableLoader> workerLoader = m_workerLoader.get();
-    if (!workerLoader || !m_forwarder)
+    CrossThreadPersistent<ThreadableLoaderClientWrapper> clientWrapper = m_clientWrapper.get();
+    if (!clientWrapper || !m_forwarder)
         return;
-    m_forwarder->forwardTask(BLINK_FROM_HERE, createCrossThreadTask(&WorkerThreadableLoader::didReceiveResponse, workerLoader, identifier, response, passed(std::move(handle))));
+    m_forwarder->forwardTask(BLINK_FROM_HERE, createCrossThreadTask(&ThreadableLoaderClientWrapper::didReceiveResponse, clientWrapper, identifier, response, passed(std::move(handle))));
 }
 
-void WorkerThreadableLoader::MainThreadLoaderHolder::didReceiveData(const char* data, unsigned dataLength)
+void WorkerThreadableLoader::Peer::didReceiveData(const char* data, unsigned dataLength)
 {
     DCHECK(isMainThread());
-    CrossThreadPersistent<WorkerThreadableLoader> workerLoader = m_workerLoader.get();
-    if (!workerLoader || !m_forwarder)
+    CrossThreadPersistent<ThreadableLoaderClientWrapper> clientWrapper = m_clientWrapper.get();
+    if (!clientWrapper || !m_forwarder)
         return;
-    m_forwarder->forwardTask(BLINK_FROM_HERE, createCrossThreadTask(&WorkerThreadableLoader::didReceiveData, workerLoader, passed(createVectorFromMemoryRegion(data, dataLength))));
+    m_forwarder->forwardTask(BLINK_FROM_HERE, createCrossThreadTask(&ThreadableLoaderClientWrapper::didReceiveData, clientWrapper, passed(createVectorFromMemoryRegion(data, dataLength))));
 }
 
-void WorkerThreadableLoader::MainThreadLoaderHolder::didDownloadData(int dataLength)
+void WorkerThreadableLoader::Peer::didDownloadData(int dataLength)
 {
     DCHECK(isMainThread());
-    CrossThreadPersistent<WorkerThreadableLoader> workerLoader = m_workerLoader.get();
-    if (!workerLoader || !m_forwarder)
+    CrossThreadPersistent<ThreadableLoaderClientWrapper> clientWrapper = m_clientWrapper.get();
+    if (!clientWrapper || !m_forwarder)
         return;
-    m_forwarder->forwardTask(BLINK_FROM_HERE, createCrossThreadTask(&WorkerThreadableLoader::didDownloadData, workerLoader, dataLength));
+    m_forwarder->forwardTask(BLINK_FROM_HERE, createCrossThreadTask(&ThreadableLoaderClientWrapper::didDownloadData, clientWrapper, dataLength));
 }
 
-void WorkerThreadableLoader::MainThreadLoaderHolder::didReceiveCachedMetadata(const char* data, int dataLength)
+void WorkerThreadableLoader::Peer::didReceiveCachedMetadata(const char* data, int dataLength)
 {
     DCHECK(isMainThread());
-    CrossThreadPersistent<WorkerThreadableLoader> workerLoader = m_workerLoader.get();
-    if (!workerLoader || !m_forwarder)
+    CrossThreadPersistent<ThreadableLoaderClientWrapper> clientWrapper = m_clientWrapper.get();
+    if (!clientWrapper || !m_forwarder)
         return;
-    m_forwarder->forwardTask(BLINK_FROM_HERE, createCrossThreadTask(&WorkerThreadableLoader::didReceiveCachedMetadata, workerLoader, passed(createVectorFromMemoryRegion(data, dataLength))));
+    m_forwarder->forwardTask(BLINK_FROM_HERE, createCrossThreadTask(&ThreadableLoaderClientWrapper::didReceiveCachedMetadata, clientWrapper, passed(createVectorFromMemoryRegion(data, dataLength))));
 }
 
-void WorkerThreadableLoader::MainThreadLoaderHolder::didFinishLoading(unsigned long identifier, double finishTime)
+void WorkerThreadableLoader::Peer::didFinishLoading(unsigned long identifier, double finishTime)
 {
     DCHECK(isMainThread());
-    CrossThreadPersistent<WorkerThreadableLoader> workerLoader = m_workerLoader.get();
-    if (!workerLoader || !m_forwarder)
+    CrossThreadPersistent<ThreadableLoaderClientWrapper> clientWrapper = m_clientWrapper.get();
+    if (!clientWrapper || !m_forwarder)
         return;
-    m_forwarder->forwardTaskWithDoneSignal(BLINK_FROM_HERE, createCrossThreadTask(&WorkerThreadableLoader::didFinishLoading, workerLoader, identifier, finishTime));
+    m_forwarder->forwardTaskWithDoneSignal(BLINK_FROM_HERE, createCrossThreadTask(&ThreadableLoaderClientWrapper::didFinishLoading, clientWrapper, identifier, finishTime));
     m_forwarder = nullptr;
 }
 
-void WorkerThreadableLoader::MainThreadLoaderHolder::didFail(const ResourceError& error)
+void WorkerThreadableLoader::Peer::didFail(const ResourceError& error)
 {
     DCHECK(isMainThread());
-    CrossThreadPersistent<WorkerThreadableLoader> workerLoader = m_workerLoader.get();
-    if (!workerLoader || !m_forwarder)
+    CrossThreadPersistent<ThreadableLoaderClientWrapper> clientWrapper = m_clientWrapper.get();
+    if (!clientWrapper || !m_forwarder)
         return;
-    m_forwarder->forwardTaskWithDoneSignal(BLINK_FROM_HERE, createCrossThreadTask(&WorkerThreadableLoader::didFail, workerLoader, error));
+    m_forwarder->forwardTaskWithDoneSignal(BLINK_FROM_HERE, createCrossThreadTask(&ThreadableLoaderClientWrapper::didFail, clientWrapper, error));
     m_forwarder = nullptr;
 }
 
-void WorkerThreadableLoader::MainThreadLoaderHolder::didFailAccessControlCheck(const ResourceError& error)
+void WorkerThreadableLoader::Peer::didFailAccessControlCheck(const ResourceError& error)
 {
     DCHECK(isMainThread());
-    CrossThreadPersistent<WorkerThreadableLoader> workerLoader = m_workerLoader.get();
-    if (!workerLoader || !m_forwarder)
+    CrossThreadPersistent<ThreadableLoaderClientWrapper> clientWrapper = m_clientWrapper.get();
+    if (!clientWrapper || !m_forwarder)
         return;
-    m_forwarder->forwardTaskWithDoneSignal(BLINK_FROM_HERE, createCrossThreadTask(&WorkerThreadableLoader::didFailAccessControlCheck, workerLoader, error));
+    m_forwarder->forwardTaskWithDoneSignal(BLINK_FROM_HERE, createCrossThreadTask(&ThreadableLoaderClientWrapper::didFailAccessControlCheck, clientWrapper, error));
     m_forwarder = nullptr;
 }
 
-void WorkerThreadableLoader::MainThreadLoaderHolder::didFailRedirectCheck()
+void WorkerThreadableLoader::Peer::didFailRedirectCheck()
 {
     DCHECK(isMainThread());
-    CrossThreadPersistent<WorkerThreadableLoader> workerLoader = m_workerLoader.get();
-    if (!workerLoader || !m_forwarder)
+    CrossThreadPersistent<ThreadableLoaderClientWrapper> clientWrapper = m_clientWrapper.get();
+    if (!clientWrapper || !m_forwarder)
         return;
-    m_forwarder->forwardTaskWithDoneSignal(BLINK_FROM_HERE, createCrossThreadTask(&WorkerThreadableLoader::didFailRedirectCheck, workerLoader));
+    m_forwarder->forwardTaskWithDoneSignal(BLINK_FROM_HERE, createCrossThreadTask(&ThreadableLoaderClientWrapper::didFailRedirectCheck, clientWrapper));
     m_forwarder = nullptr;
 }
 
-void WorkerThreadableLoader::MainThreadLoaderHolder::didReceiveResourceTiming(const ResourceTimingInfo& info)
+void WorkerThreadableLoader::Peer::didReceiveResourceTiming(const ResourceTimingInfo& info)
 {
     DCHECK(isMainThread());
-    CrossThreadPersistent<WorkerThreadableLoader> workerLoader = m_workerLoader.get();
-    if (!workerLoader || !m_forwarder)
+    CrossThreadPersistent<ThreadableLoaderClientWrapper> clientWrapper = m_clientWrapper.get();
+    if (!clientWrapper || !m_forwarder)
         return;
-    m_forwarder->forwardTask(BLINK_FROM_HERE, createCrossThreadTask(&WorkerThreadableLoader::didReceiveResourceTiming, workerLoader, info));
+    m_forwarder->forwardTask(BLINK_FROM_HERE, createCrossThreadTask(&ThreadableLoaderClientWrapper::didReceiveResourceTiming, clientWrapper, info));
 }
 
-void WorkerThreadableLoader::MainThreadLoaderHolder::contextDestroyed()
+void WorkerThreadableLoader::Peer::contextDestroyed()
 {
     DCHECK(isMainThread());
     if (m_forwarder) {
         m_forwarder->abort();
         m_forwarder = nullptr;
     }
-    m_workerLoader = nullptr;
+    m_clientWrapper = nullptr;
     cancel();
 }
 
-DEFINE_TRACE(WorkerThreadableLoader::MainThreadLoaderHolder)
+DEFINE_TRACE(WorkerThreadableLoader::Peer)
 {
     visitor->trace(m_forwarder);
-    visitor->trace(m_mainThreadLoader);
     WorkerThreadLifecycleObserver::trace(visitor);
 }
 
-WorkerThreadableLoader::MainThreadLoaderHolder::MainThreadLoaderHolder(TaskForwarder* forwarder, WorkerThreadLifecycleContext* context)
+WorkerThreadableLoader::Peer::Peer(TaskForwarder* forwarder, WorkerThreadLifecycleContext* context)
     : WorkerThreadLifecycleObserver(context)
     , m_forwarder(forwarder)
 {
     DCHECK(isMainThread());
 }
 
-void WorkerThreadableLoader::MainThreadLoaderHolder::start(
+void WorkerThreadableLoader::Peer::start(
     Document& document,
     std::unique_ptr<CrossThreadResourceRequestData> request,
     const ThreadableLoaderOptions& options,
diff --git a/third_party/WebKit/Source/core/loader/WorkerThreadableLoader.h b/third_party/WebKit/Source/core/loader/WorkerThreadableLoader.h
index bcd683ee..700ec9a 100644
--- a/third_party/WebKit/Source/core/loader/WorkerThreadableLoader.h
+++ b/third_party/WebKit/Source/core/loader/WorkerThreadableLoader.h
@@ -34,12 +34,14 @@
 #include "core/dom/ExecutionContextTask.h"
 #include "core/loader/ThreadableLoader.h"
 #include "core/loader/ThreadableLoaderClient.h"
+#include "core/loader/ThreadableLoaderClientWrapper.h"
 #include "core/workers/WorkerThread.h"
 #include "core/workers/WorkerThreadLifecycleObserver.h"
 #include "platform/WaitableEvent.h"
 #include "platform/heap/Handle.h"
 #include "public/platform/WebTraceLocation.h"
 #include "wtf/PassRefPtr.h"
+#include "wtf/PtrUtil.h"
 #include "wtf/RefPtr.h"
 #include "wtf/Threading.h"
 #include "wtf/Vector.h"
@@ -54,50 +56,25 @@
 class WorkerGlobalScope;
 class WorkerLoaderProxy;
 struct CrossThreadResourceRequestData;
-struct CrossThreadResourceTimingInfoData;
 
-// A WorkerThreadableLoader is a ThreadableLoader implementation intended to
-// be used in a WebWorker thread. Because Blink's ResourceFetcher and
-// ResourceLoader work only in the main thread, a WorkerThreadableLoader holds
-// a ThreadableLoader in the main thread and delegates tasks asynchronously
-// to the loader.
-//
-// CTP: CrossThreadPersistent
-// CTWP: CrossThreadWeakPersistent
-//
-// ----------------------------------------------------------------
-//                 +------------------------+
-//       raw ptr   | ThreadableLoaderClient |
-//      +--------> | worker thread          |
-//      |          +------------------------+
-//      |
-// +----+------------------+    CTP  +------------------------+
-// + WorkerThreadableLoader|<--------+ MainThreadLoaderHolder |
-// | worker thread         +-------->| main thread            |
-// +-----------------------+   CTWP  +----------------------+-+
-//                                                          |
-//                                 +------------------+     | Member
-//                                 | ThreadableLoader | <---+
-//                                 |      main thread |
-//                                 +------------------+
-//
+// TODO(yhirano): Draw a diagram to illustrate the class relationship.
+// TODO(yhirano): Rename inner classes so that readers can see in which thread
+// they are living easily.
 class WorkerThreadableLoader final : public ThreadableLoader {
+    USING_FAST_MALLOC(WorkerThreadableLoader);
 public:
     static void loadResourceSynchronously(WorkerGlobalScope&, const ResourceRequest&, ThreadableLoaderClient&, const ThreadableLoaderOptions&, const ResourceLoaderOptions&);
-    static WorkerThreadableLoader* create(WorkerGlobalScope& workerGlobalScope, ThreadableLoaderClient* client, const ThreadableLoaderOptions& options, const ResourceLoaderOptions& resourceLoaderOptions)
+    static std::unique_ptr<WorkerThreadableLoader> create(WorkerGlobalScope& workerGlobalScope, ThreadableLoaderClient* client, const ThreadableLoaderOptions& options, const ResourceLoaderOptions& resourceLoaderOptions)
     {
-        return new WorkerThreadableLoader(workerGlobalScope, client, options, resourceLoaderOptions, LoadAsynchronously);
+        return wrapUnique(new WorkerThreadableLoader(workerGlobalScope, client, options, resourceLoaderOptions, LoadAsynchronously));
     }
 
     ~WorkerThreadableLoader() override;
 
-    // ThreadableLoader functions
     void start(const ResourceRequest&) override;
     void overrideTimeout(unsigned long timeout) override;
     void cancel() override;
 
-    DECLARE_TRACE();
-
 private:
     enum BlockingBehavior {
         LoadSynchronously,
@@ -119,15 +96,47 @@
     class WaitableEventWithTasks;
     class SyncTaskForwarder;
 
-    // An instance of this class lives in the main thread. It is a
-    // ThreadableLoaderClient for a DocumentThreadableLoader and forward
-    // notifications to the associated WorkerThreadableLoader living in the
-    // worker thread.
-    class MainThreadLoaderHolder final : public GarbageCollectedFinalized<MainThreadLoaderHolder>, public ThreadableLoaderClient, public WorkerThreadLifecycleObserver {
-        USING_GARBAGE_COLLECTED_MIXIN(MainThreadLoaderHolder);
+    class Peer;
+    // A Bridge instance lives in the worker thread and requests the associated
+    // Peer (which lives in the main thread) to process loading tasks.
+    class Bridge final : public GarbageCollectedFinalized<Bridge> {
+    public:
+        Bridge(ThreadableLoaderClientWrapper*, PassRefPtr<WorkerLoaderProxy>, const ThreadableLoaderOptions&, const ResourceLoaderOptions&, BlockingBehavior);
+        ~Bridge();
+
+        void start(const ResourceRequest&, const WorkerGlobalScope&);
+        void overrideTimeout(unsigned long timeoutMilliseconds);
+        void cancel();
+        void destroy();
+
+        void didStart(Peer*);
+
+        // This getter function is thread safe.
+        ThreadableLoaderClientWrapper* clientWrapper() { return m_clientWrapper.get(); }
+
+        DECLARE_VIRTUAL_TRACE();
+
+    private:
+        void cancelPeer();
+
+        const Member<ThreadableLoaderClientWrapper> m_clientWrapper;
+        const RefPtr<WorkerLoaderProxy> m_loaderProxy;
+        const ThreadableLoaderOptions m_threadableLoaderOptions;
+        const ResourceLoaderOptions m_resourceLoaderOptions;
+        const BlockingBehavior m_blockingBehavior;
+
+        // |*m_peer| lives in the main thread.
+        CrossThreadPersistent<Peer> m_peer;
+    };
+
+    // A Peer instance lives in the main thread. It is a ThreadableLoaderClient
+    // for a DocumentThreadableLoader and forward notifications to the
+    // ThreadableLoaderClientWrapper which lives in the worker thread.
+    class Peer final : public GarbageCollectedFinalized<Peer>, public ThreadableLoaderClient, public WorkerThreadLifecycleObserver {
+        USING_GARBAGE_COLLECTED_MIXIN(Peer);
     public:
         static void createAndStart(
-            WorkerThreadableLoader*,
+            Bridge*,
             PassRefPtr<WorkerLoaderProxy>,
             WorkerThreadLifecycleContext*,
             std::unique_ptr<CrossThreadResourceRequestData>,
@@ -135,7 +144,7 @@
             const ResourceLoaderOptions&,
             PassRefPtr<WaitableEventWithTasks>,
             ExecutionContext*);
-        ~MainThreadLoaderHolder() override;
+        ~Peer() override;
 
         void overrideTimeout(unsigned long timeoutMillisecond);
         void cancel();
@@ -156,40 +165,21 @@
         DECLARE_TRACE();
 
     private:
-        MainThreadLoaderHolder(TaskForwarder*, WorkerThreadLifecycleContext*);
+        Peer(TaskForwarder*, WorkerThreadLifecycleContext*);
         void start(Document&, std::unique_ptr<CrossThreadResourceRequestData>, const ThreadableLoaderOptions&, const ResourceLoaderOptions&);
 
         Member<TaskForwarder> m_forwarder;
-        Member<ThreadableLoader> m_mainThreadLoader;
+        std::unique_ptr<ThreadableLoader> m_mainThreadLoader;
 
-        // |*m_workerLoader| lives in the worker thread.
-        CrossThreadWeakPersistent<WorkerThreadableLoader> m_workerLoader;
+        // |*m_clientWrapper| lives in the worker thread.
+        CrossThreadWeakPersistent<ThreadableLoaderClientWrapper> m_clientWrapper;
     };
 
     WorkerThreadableLoader(WorkerGlobalScope&, ThreadableLoaderClient*, const ThreadableLoaderOptions&, const ResourceLoaderOptions&, BlockingBehavior);
-    void didStart(MainThreadLoaderHolder*);
 
-    void didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
-    void didReceiveResponse(unsigned long identifier, std::unique_ptr<CrossThreadResourceResponseData>, std::unique_ptr<WebDataConsumerHandle>);
-    void didReceiveData(std::unique_ptr<Vector<char>> data);
-    void didReceiveCachedMetadata(std::unique_ptr<Vector<char>> data);
-    void didFinishLoading(unsigned long identifier, double finishTime);
-    void didFail(const ResourceError&);
-    void didFailAccessControlCheck(const ResourceError&);
-    void didFailRedirectCheck();
-    void didDownloadData(int dataLength);
-    void didReceiveResourceTiming(std::unique_ptr<CrossThreadResourceTimingInfoData>);
-
-    Member<WorkerGlobalScope> m_workerGlobalScope;
-    RefPtr<WorkerLoaderProxy> m_workerLoaderProxy;
-    ThreadableLoaderClient* m_client;
-
-    ThreadableLoaderOptions m_threadableLoaderOptions;
-    ResourceLoaderOptions m_resourceLoaderOptions;
-    BlockingBehavior m_blockingBehavior;
-
-    // |*m_mainThreadLoaderHolder| lives in the main thread.
-    CrossThreadPersistent<MainThreadLoaderHolder> m_mainThreadLoaderHolder;
+    Persistent<WorkerGlobalScope> m_workerGlobalScope;
+    const Persistent<ThreadableLoaderClientWrapper> m_workerClientWrapper;
+    const Persistent<Bridge> m_bridge;
 };
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/page/EventSource.cpp b/third_party/WebKit/Source/core/page/EventSource.cpp
index 1cbd5d48..7a5b32e2 100644
--- a/third_party/WebKit/Source/core/page/EventSource.cpp
+++ b/third_party/WebKit/Source/core/page/EventSource.cpp
@@ -360,7 +360,6 @@
 DEFINE_TRACE(EventSource)
 {
     visitor->trace(m_parser);
-    visitor->trace(m_loader);
     EventTargetWithInlineData::trace(visitor);
     ActiveDOMObject::trace(visitor);
     EventSourceParser::Client::trace(visitor);
diff --git a/third_party/WebKit/Source/core/page/EventSource.h b/third_party/WebKit/Source/core/page/EventSource.h
index 0e6336e..24c1598 100644
--- a/third_party/WebKit/Source/core/page/EventSource.h
+++ b/third_party/WebKit/Source/core/page/EventSource.h
@@ -122,7 +122,7 @@
     State m_state;
 
     Member<EventSourceParser> m_parser;
-    Member<ThreadableLoader> m_loader;
+    std::unique_ptr<ThreadableLoader> m_loader;
     Timer<EventSource> m_connectTimer;
 
     unsigned long long m_reconnectDelay;
diff --git a/third_party/WebKit/Source/core/workers/WorkerScriptLoader.h b/third_party/WebKit/Source/core/workers/WorkerScriptLoader.h
index 59fe7583..58131ad 100644
--- a/third_party/WebKit/Source/core/workers/WorkerScriptLoader.h
+++ b/third_party/WebKit/Source/core/workers/WorkerScriptLoader.h
@@ -114,7 +114,7 @@
     std::unique_ptr<WTF::Closure> m_responseCallback;
     std::unique_ptr<WTF::Closure> m_finishedCallback;
 
-    Persistent<ThreadableLoader> m_threadableLoader;
+    std::unique_ptr<ThreadableLoader> m_threadableLoader;
     String m_responseEncoding;
     std::unique_ptr<TextResourceDecoder> m_decoder;
     StringBuilder m_script;
diff --git a/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp b/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp
index 00ec92b10..ce55746 100644
--- a/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp
+++ b/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp
@@ -1020,7 +1020,7 @@
     // If, window.onload contains open() and send(), m_loader will be set to
     // non 0 value. So, we cannot continue the outer open(). In such case,
     // just abort the outer open() by returning false.
-    ThreadableLoader* loader = m_loader.release();
+    std::unique_ptr<ThreadableLoader> loader = std::move(m_loader);
     loader->cancel();
 
     // If abort() called internalAbort() and a nested open() ended up
@@ -1703,7 +1703,6 @@
 {
     visitor->trace(m_responseBlob);
     visitor->trace(m_responseLegacyStream);
-    visitor->trace(m_loader);
     visitor->trace(m_responseDocument);
     visitor->trace(m_responseDocumentParser);
     visitor->trace(m_responseArrayBuffer);
diff --git a/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.h b/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.h
index 5614333c..526d9283b 100644
--- a/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.h
+++ b/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.h
@@ -265,7 +265,7 @@
     Member<Blob> m_responseBlob;
     Member<Stream> m_responseLegacyStream;
 
-    Member<ThreadableLoader> m_loader;
+    std::unique_ptr<ThreadableLoader> m_loader;
     State m_state;
 
     ResourceResponse m_response;
diff --git a/third_party/WebKit/Source/modules/fetch/BodyStreamBufferTest.cpp b/third_party/WebKit/Source/modules/fetch/BodyStreamBufferTest.cpp
index a7db03f..83ed30b 100644
--- a/third_party/WebKit/Source/modules/fetch/BodyStreamBufferTest.cpp
+++ b/third_party/WebKit/Source/modules/fetch/BodyStreamBufferTest.cpp
@@ -34,7 +34,7 @@
 
 class FakeLoaderFactory : public FetchBlobDataConsumerHandle::LoaderFactory {
 public:
-    ThreadableLoader* create(ExecutionContext&, ThreadableLoaderClient*, const ThreadableLoaderOptions&, const ResourceLoaderOptions&) override
+    std::unique_ptr<ThreadableLoader> create(ExecutionContext&, ThreadableLoaderClient*, const ThreadableLoaderOptions&, const ResourceLoaderOptions&) override
     {
         ASSERT_NOT_REACHED();
         return nullptr;
diff --git a/third_party/WebKit/Source/modules/fetch/FetchBlobDataConsumerHandle.cpp b/third_party/WebKit/Source/modules/fetch/FetchBlobDataConsumerHandle.cpp
index 11474211..5db39ff 100644
--- a/third_party/WebKit/Source/modules/fetch/FetchBlobDataConsumerHandle.cpp
+++ b/third_party/WebKit/Source/modules/fetch/FetchBlobDataConsumerHandle.cpp
@@ -76,7 +76,7 @@
             m_updater->update(createUnexpectedErrorDataConsumerHandle());
         if (m_loader) {
             m_loader->cancel();
-            m_loader = nullptr;
+            m_loader.reset();
         }
     }
 
@@ -103,7 +103,7 @@
     }
 
 private:
-    ThreadableLoader* createLoader(ExecutionContext* executionContext, ThreadableLoaderClient* client) const
+    std::unique_ptr<ThreadableLoader> createLoader(ExecutionContext* executionContext, ThreadableLoaderClient* client) const
     {
         ThreadableLoaderOptions options;
         options.preflightPolicy = ConsiderPreflight;
@@ -134,14 +134,14 @@
 
     void didFinishLoading(unsigned long, double) override
     {
-        m_loader = nullptr;
+        m_loader.reset();
     }
 
     void didFail(const ResourceError&) override
     {
         if (!m_receivedResponse)
             m_updater->update(createUnexpectedErrorDataConsumerHandle());
-        m_loader = nullptr;
+        m_loader.reset();
     }
 
     void didFailRedirectCheck() override
@@ -154,14 +154,14 @@
 
     RefPtr<BlobDataHandle> m_blobDataHandle;
     Persistent<FetchBlobDataConsumerHandle::LoaderFactory> m_loaderFactory;
-    Persistent<ThreadableLoader> m_loader;
+    std::unique_ptr<ThreadableLoader> m_loader;
 
     bool m_receivedResponse;
 };
 
 class DefaultLoaderFactory final : public FetchBlobDataConsumerHandle::LoaderFactory {
 public:
-    ThreadableLoader* create(
+    std::unique_ptr<ThreadableLoader> create(
         ExecutionContext& executionContext,
         ThreadableLoaderClient* client,
         const ThreadableLoaderOptions& options,
diff --git a/third_party/WebKit/Source/modules/fetch/FetchBlobDataConsumerHandle.h b/third_party/WebKit/Source/modules/fetch/FetchBlobDataConsumerHandle.h
index e7c867b7..d484f78 100644
--- a/third_party/WebKit/Source/modules/fetch/FetchBlobDataConsumerHandle.h
+++ b/third_party/WebKit/Source/modules/fetch/FetchBlobDataConsumerHandle.h
@@ -25,7 +25,7 @@
 public:
     class MODULES_EXPORT LoaderFactory : public GarbageCollectedFinalized<LoaderFactory> {
     public:
-        virtual ThreadableLoader* create(ExecutionContext&, ThreadableLoaderClient*, const ThreadableLoaderOptions&, const ResourceLoaderOptions&) = 0;
+        virtual std::unique_ptr<ThreadableLoader> create(ExecutionContext&, ThreadableLoaderClient*, const ThreadableLoaderOptions&, const ResourceLoaderOptions&) = 0;
         virtual ~LoaderFactory() { }
         DEFINE_INLINE_VIRTUAL_TRACE() { }
     };
diff --git a/third_party/WebKit/Source/modules/fetch/FetchBlobDataConsumerHandleTest.cpp b/third_party/WebKit/Source/modules/fetch/FetchBlobDataConsumerHandleTest.cpp
index b49316ca..50c03d4 100644
--- a/third_party/WebKit/Source/modules/fetch/FetchBlobDataConsumerHandleTest.cpp
+++ b/third_party/WebKit/Source/modules/fetch/FetchBlobDataConsumerHandleTest.cpp
@@ -53,7 +53,12 @@
 
 class MockLoaderFactory : public FetchBlobDataConsumerHandle::LoaderFactory {
 public:
-    MOCK_METHOD4(create, ThreadableLoader*(ExecutionContext&, ThreadableLoaderClient*, const ThreadableLoaderOptions&, const ResourceLoaderOptions&));
+    std::unique_ptr<ThreadableLoader> create(ExecutionContext& executionContext, ThreadableLoaderClient* client, const ThreadableLoaderOptions& threadableLoaderOptions, const ResourceLoaderOptions& resourceLoaderOptions) override
+    {
+        return wrapUnique(createInternal(executionContext, client, threadableLoaderOptions, resourceLoaderOptions));
+    }
+
+    MOCK_METHOD4(createInternal, ThreadableLoader*(ExecutionContext&, ThreadableLoaderClient*, const ThreadableLoaderOptions&, const ResourceLoaderOptions&));
 };
 
 PassRefPtr<BlobDataHandle> createBlobDataHandle(const char* s)
@@ -95,17 +100,18 @@
     ThreadableLoaderOptions options;
     ResourceLoaderOptions resourceLoaderOptions;
 
-    Persistent<MockThreadableLoader> loader = MockThreadableLoader::create();
+    std::unique_ptr<MockThreadableLoader> loader = MockThreadableLoader::create();
+    MockThreadableLoader* loaderPtr = loader.get();
 
     InSequence s;
     EXPECT_CALL(checkpoint, Call(1));
-    EXPECT_CALL(*factory, create(Ref(document()), _, _, _)).WillOnce(DoAll(
+    EXPECT_CALL(*factory, createInternal(Ref(document()), _, _, _)).WillOnce(DoAll(
         SaveArg<2>(&options),
         SaveArg<3>(&resourceLoaderOptions),
-        Return(loader.get())));
-    EXPECT_CALL(*loader, start(_)).WillOnce(SaveArg<0>(&request));
+        Return(loader.release())));
+    EXPECT_CALL(*loaderPtr, start(_)).WillOnce(SaveArg<0>(&request));
     EXPECT_CALL(checkpoint, Call(2));
-    EXPECT_CALL(*loader, cancel());
+    EXPECT_CALL(*loaderPtr, cancel());
 
     RefPtr<BlobDataHandle> blobDataHandle = createBlobDataHandle("Once upon a time");
     std::unique_ptr<WebDataConsumerHandle> handle
@@ -139,14 +145,15 @@
     auto factory = new StrictMock<MockLoaderFactory>;
     Checkpoint checkpoint;
 
-    Persistent<MockThreadableLoader> loader = MockThreadableLoader::create();
+    std::unique_ptr<MockThreadableLoader> loader = MockThreadableLoader::create();
+    MockThreadableLoader* loaderPtr = loader.get();
 
     InSequence s;
     EXPECT_CALL(checkpoint, Call(1));
-    EXPECT_CALL(*factory, create(Ref(document()), _, _, _)).WillOnce(Return(loader.get()));
-    EXPECT_CALL(*loader, start(_));
+    EXPECT_CALL(*factory, createInternal(Ref(document()), _, _, _)).WillOnce(Return(loader.release()));
+    EXPECT_CALL(*loaderPtr, start(_));
     EXPECT_CALL(checkpoint, Call(2));
-    EXPECT_CALL(*loader, cancel());
+    EXPECT_CALL(*loaderPtr, cancel());
     EXPECT_CALL(checkpoint, Call(3));
 
     RefPtr<BlobDataHandle> blobDataHandle = createBlobDataHandle("Once upon a time");
@@ -168,15 +175,16 @@
     auto factory = new StrictMock<MockLoaderFactory>;
     Checkpoint checkpoint;
 
-    Persistent<MockThreadableLoader> loader = MockThreadableLoader::create();
+    std::unique_ptr<MockThreadableLoader> loader = MockThreadableLoader::create();
+    MockThreadableLoader* loaderPtr = loader.get();
 
     InSequence s;
     EXPECT_CALL(checkpoint, Call(1));
-    EXPECT_CALL(*factory, create(Ref(document()), _, _, _)).WillOnce(Return(loader.get()));
-    EXPECT_CALL(*loader, start(_));
+    EXPECT_CALL(*factory, createInternal(Ref(document()), _, _, _)).WillOnce(Return(loader.release()));
+    EXPECT_CALL(*loaderPtr, start(_));
     EXPECT_CALL(checkpoint, Call(2));
     EXPECT_CALL(checkpoint, Call(3));
-    EXPECT_CALL(*loader, cancel());
+    EXPECT_CALL(*loaderPtr, cancel());
     EXPECT_CALL(checkpoint, Call(4));
 
     RefPtr<BlobDataHandle> blobDataHandle = createBlobDataHandle("Once upon a time");
@@ -202,15 +210,16 @@
     auto factory = new StrictMock<MockLoaderFactory>;
     Checkpoint checkpoint;
 
-    Persistent<MockThreadableLoader> loader = MockThreadableLoader::create();
+    std::unique_ptr<MockThreadableLoader> loader = MockThreadableLoader::create();
+    MockThreadableLoader* loaderPtr = loader.get();
     ThreadableLoaderClient* client = nullptr;
 
     InSequence s;
     EXPECT_CALL(checkpoint, Call(1));
-    EXPECT_CALL(*factory, create(Ref(document()), _, _, _)).WillOnce(DoAll(SaveArg<1>(&client), Return(loader.get())));
-    EXPECT_CALL(*loader, start(_));
+    EXPECT_CALL(*factory, createInternal(Ref(document()), _, _, _)).WillOnce(DoAll(SaveArg<1>(&client), Return(loader.release())));
+    EXPECT_CALL(*loaderPtr, start(_));
     EXPECT_CALL(checkpoint, Call(2));
-    EXPECT_CALL(*loader, cancel());
+    EXPECT_CALL(*loaderPtr, cancel());
 
     RefPtr<BlobDataHandle> blobDataHandle = createBlobDataHandle("Once upon a time");
     std::unique_ptr<WebDataConsumerHandle> handle
@@ -240,15 +249,16 @@
     auto factory = new StrictMock<MockLoaderFactory>;
     Checkpoint checkpoint;
 
-    Persistent<MockThreadableLoader> loader = MockThreadableLoader::create();
+    std::unique_ptr<MockThreadableLoader> loader = MockThreadableLoader::create();
+    MockThreadableLoader* loaderPtr = loader.get();
     ThreadableLoaderClient* client = nullptr;
 
     InSequence s;
     EXPECT_CALL(checkpoint, Call(1));
-    EXPECT_CALL(*factory, create(Ref(document()), _, _, _)).WillOnce(DoAll(SaveArg<1>(&client), Return(loader.get())));
-    EXPECT_CALL(*loader, start(_));
+    EXPECT_CALL(*factory, createInternal(Ref(document()), _, _, _)).WillOnce(DoAll(SaveArg<1>(&client), Return(loader.release())));
+    EXPECT_CALL(*loaderPtr, start(_));
     EXPECT_CALL(checkpoint, Call(2));
-    EXPECT_CALL(*loader, cancel());
+    EXPECT_CALL(*loaderPtr, cancel());
 
     RefPtr<BlobDataHandle> blobDataHandle = createBlobDataHandle("Once upon a time");
     std::unique_ptr<WebDataConsumerHandle> handle
@@ -278,13 +288,14 @@
     auto factory = new StrictMock<MockLoaderFactory>;
     Checkpoint checkpoint;
 
-    Persistent<MockThreadableLoader> loader = MockThreadableLoader::create();
+    std::unique_ptr<MockThreadableLoader> loader = MockThreadableLoader::create();
+    MockThreadableLoader* loaderPtr = loader.get();
     ThreadableLoaderClient* client = nullptr;
 
     InSequence s;
     EXPECT_CALL(checkpoint, Call(1));
-    EXPECT_CALL(*factory, create(Ref(document()), _, _, _)).WillOnce(DoAll(SaveArg<1>(&client), Return(loader.get())));
-    EXPECT_CALL(*loader, start(_));
+    EXPECT_CALL(*factory, createInternal(Ref(document()), _, _, _)).WillOnce(DoAll(SaveArg<1>(&client), Return(loader.release())));
+    EXPECT_CALL(*loaderPtr, start(_));
     EXPECT_CALL(checkpoint, Call(2));
 
     RefPtr<BlobDataHandle> blobDataHandle = createBlobDataHandle("Once upon a time");
@@ -307,15 +318,16 @@
     auto factory = new StrictMock<MockLoaderFactory>;
     Checkpoint checkpoint;
 
-    Persistent<MockThreadableLoader> loader = MockThreadableLoader::create();
+    std::unique_ptr<MockThreadableLoader> loader = MockThreadableLoader::create();
+    MockThreadableLoader* loaderPtr = loader.get();
     ThreadableLoaderClient* client = nullptr;
 
     InSequence s;
     EXPECT_CALL(checkpoint, Call(1));
-    EXPECT_CALL(*factory, create(Ref(document()), _, _, _)).WillOnce(DoAll(SaveArg<1>(&client), Return(loader.get())));
-    EXPECT_CALL(*loader, start(_));
+    EXPECT_CALL(*factory, createInternal(Ref(document()), _, _, _)).WillOnce(DoAll(SaveArg<1>(&client), Return(loader.release())));
+    EXPECT_CALL(*loaderPtr, start(_));
     EXPECT_CALL(checkpoint, Call(2));
-    EXPECT_CALL(*loader, cancel());
+    EXPECT_CALL(*loaderPtr, cancel());
 
     RefPtr<BlobDataHandle> blobDataHandle = createBlobDataHandle("Once upon a time");
     std::unique_ptr<WebDataConsumerHandle> handle
diff --git a/third_party/WebKit/Source/modules/fetch/FetchFormDataConsumerHandleTest.cpp b/third_party/WebKit/Source/modules/fetch/FetchFormDataConsumerHandleTest.cpp
index ae801dc..f45c7443 100644
--- a/third_party/WebKit/Source/modules/fetch/FetchFormDataConsumerHandleTest.cpp
+++ b/third_party/WebKit/Source/modules/fetch/FetchFormDataConsumerHandleTest.cpp
@@ -52,14 +52,14 @@
     explicit LoaderFactory(std::unique_ptr<WebDataConsumerHandle> handle)
         : m_client(nullptr)
         , m_handle(std::move(handle)) {}
-    ThreadableLoader* create(ExecutionContext&, ThreadableLoaderClient* client, const ThreadableLoaderOptions&, const ResourceLoaderOptions&) override
+    std::unique_ptr<ThreadableLoader> create(ExecutionContext&, ThreadableLoaderClient* client, const ThreadableLoaderOptions&, const ResourceLoaderOptions&) override
     {
         m_client = client;
 
-        MockThreadableLoader* loader = MockThreadableLoader::create();
+        std::unique_ptr<MockThreadableLoader> loader = MockThreadableLoader::create();
         EXPECT_CALL(*loader, start(_)).WillOnce(InvokeWithoutArgs(this, &LoaderFactory::handleDidReceiveResponse));
         EXPECT_CALL(*loader, cancel()).Times(1);
-        return loader;
+        return std::move(loader);
     }
 
 private:
diff --git a/third_party/WebKit/Source/modules/fetch/FetchManager.cpp b/third_party/WebKit/Source/modules/fetch/FetchManager.cpp
index f8773e7..a697e11 100644
--- a/third_party/WebKit/Source/modules/fetch/FetchManager.cpp
+++ b/third_party/WebKit/Source/modules/fetch/FetchManager.cpp
@@ -169,7 +169,7 @@
     Member<FetchManager> m_fetchManager;
     Member<ScriptPromiseResolver> m_resolver;
     Member<FetchRequestData> m_request;
-    Member<ThreadableLoader> m_loader;
+    std::unique_ptr<ThreadableLoader> m_loader;
     bool m_failed;
     bool m_finished;
     int m_responseHttpStatusCode;
@@ -204,7 +204,6 @@
     visitor->trace(m_fetchManager);
     visitor->trace(m_resolver);
     visitor->trace(m_request);
-    visitor->trace(m_loader);
     visitor->trace(m_integrityVerifier);
     visitor->trace(m_executionContext);
 }
@@ -525,7 +524,7 @@
     m_fetchManager = nullptr;
     if (m_loader) {
         m_loader->cancel();
-        m_loader = nullptr;
+        m_loader.reset();
     }
     m_executionContext = nullptr;
 }
@@ -685,11 +684,11 @@
     if (m_failed || m_finished)
         return;
     m_failed = true;
+    if (m_executionContext->activeDOMObjectsAreStopped())
+        return;
     if (!message.isEmpty())
         m_executionContext->addConsoleMessage(ConsoleMessage::create(JSMessageSource, ErrorMessageLevel, message));
     if (m_resolver) {
-        if (!m_resolver->getExecutionContext() || m_resolver->getExecutionContext()->activeDOMObjectsAreStopped())
-            return;
         ScriptState* state = m_resolver->getScriptState();
         ScriptState::Scope scope(state);
         m_resolver->reject(V8ThrowException::createTypeError(state->isolate(), "Failed to fetch"));
diff --git a/third_party/WebKit/Source/modules/modules.gypi b/third_party/WebKit/Source/modules/modules.gypi
index 8c66aa3..03252ec1 100644
--- a/third_party/WebKit/Source/modules/modules.gypi
+++ b/third_party/WebKit/Source/modules/modules.gypi
@@ -555,6 +555,7 @@
       'webmidi/MIDIConnectionEventInit.idl',
       'webmidi/MIDIMessageEventInit.idl',
       'webmidi/MIDIOptions.idl',
+      'webshare/ShareData.idl',
       'websockets/CloseEventInit.idl',
       'webusb/USBConnectionEventInit.idl',
       'webusb/USBControlTransferParameters.idl',
@@ -769,6 +770,8 @@
       '<(blink_modules_output_dir)/webmidi/MIDIMessageEventInit.cpp',
       '<(blink_modules_output_dir)/webmidi/MIDIOptions.cpp',
       '<(blink_modules_output_dir)/webmidi/MIDIOptions.h',
+      '<(blink_modules_output_dir)/webshare/ShareData.cpp',
+      '<(blink_modules_output_dir)/webshare/ShareData.h',
       '<(blink_modules_output_dir)/websockets/CloseEventInit.cpp',
       '<(blink_modules_output_dir)/websockets/CloseEventInit.h',
       '<(blink_modules_output_dir)/webusb/USBConnectionEventInit.cpp',
diff --git a/third_party/WebKit/Source/modules/notifications/NotificationImageLoader.cpp b/third_party/WebKit/Source/modules/notifications/NotificationImageLoader.cpp
index 530aee3..298931c6 100644
--- a/third_party/WebKit/Source/modules/notifications/NotificationImageLoader.cpp
+++ b/third_party/WebKit/Source/modules/notifications/NotificationImageLoader.cpp
@@ -65,7 +65,11 @@
     m_stopped = true;
     if (m_threadableLoader) {
         m_threadableLoader->cancel();
-        m_threadableLoader = nullptr;
+        // WorkerThreadableLoader keeps a Persistent<WorkerGlobalScope> to the
+        // ExecutionContext it received in |create|. Kill it to prevent
+        // reference cycles involving a mix of GC and non-GC types that fail to
+        // clear in ThreadState::cleanup.
+        m_threadableLoader.reset();
     }
 }
 
diff --git a/third_party/WebKit/Source/modules/notifications/NotificationImageLoader.h b/third_party/WebKit/Source/modules/notifications/NotificationImageLoader.h
index 59f48804..363b4fb 100644
--- a/third_party/WebKit/Source/modules/notifications/NotificationImageLoader.h
+++ b/third_party/WebKit/Source/modules/notifications/NotificationImageLoader.h
@@ -46,10 +46,7 @@
     void didFail(const ResourceError&) override;
     void didFailRedirectCheck() override;
 
-    DEFINE_INLINE_TRACE()
-    {
-        visitor->trace(m_threadableLoader);
-    }
+    DEFINE_INLINE_TRACE() {}
 
 private:
     void runCallbackWithEmptyBitmap();
@@ -58,7 +55,7 @@
     double m_startTime;
     RefPtr<SharedBuffer> m_data;
     std::unique_ptr<ImageCallback> m_imageCallback;
-    Member<ThreadableLoader> m_threadableLoader;
+    std::unique_ptr<ThreadableLoader> m_threadableLoader;
 };
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/modules/webshare/NavigatorShare.cpp b/third_party/WebKit/Source/modules/webshare/NavigatorShare.cpp
index 7f192c7..6e4bba14 100644
--- a/third_party/WebKit/Source/modules/webshare/NavigatorShare.cpp
+++ b/third_party/WebKit/Source/modules/webshare/NavigatorShare.cpp
@@ -9,6 +9,7 @@
 #include "core/dom/ExceptionCode.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Navigator.h"
+#include "modules/webshare/ShareData.h"
 #include "platform/mojo/MojoHelper.h"
 #include "public/platform/InterfaceProvider.h"
 #include "public/platform/Platform.h"
@@ -78,7 +79,7 @@
     return "NavigatorShare";
 }
 
-ScriptPromise NavigatorShare::share(ScriptState* scriptState, const String& title, const String& text)
+ScriptPromise NavigatorShare::share(ScriptState* scriptState, const ShareData& shareData)
 {
     if (!m_service) {
         Document* doc = toDocument(scriptState->getExecutionContext());
@@ -94,14 +95,15 @@
     m_clients.add(client);
     ScriptPromise promise = resolver->promise();
 
-    m_service->Share(title, text, convertToBaseCallback(WTF::bind(&ShareClientImpl::callback, wrapPersistent(client))));
+    // TODO(sammc): Use shareData.url().
+    m_service->Share(shareData.hasTitle() ? shareData.title() : emptyString(), shareData.hasText() ? shareData.text() : emptyString(), convertToBaseCallback(WTF::bind(&ShareClientImpl::callback, wrapPersistent(client))));
 
     return promise;
 }
 
-ScriptPromise NavigatorShare::share(ScriptState* scriptState, Navigator& navigator, const String& title, const String& text)
+ScriptPromise NavigatorShare::share(ScriptState* scriptState, Navigator& navigator, const ShareData& shareData)
 {
-    return from(navigator).share(scriptState, title, text);
+    return from(navigator).share(scriptState, shareData);
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/modules/webshare/NavigatorShare.h b/third_party/WebKit/Source/modules/webshare/NavigatorShare.h
index f85a121..5e4578ff 100644
--- a/third_party/WebKit/Source/modules/webshare/NavigatorShare.h
+++ b/third_party/WebKit/Source/modules/webshare/NavigatorShare.h
@@ -18,6 +18,7 @@
 namespace blink {
 
 class Navigator;
+class ShareData;
 
 class NavigatorShare final : public GarbageCollectedFinalized<NavigatorShare>, public Supplement<Navigator> {
     USING_GARBAGE_COLLECTED_MIXIN(NavigatorShare);
@@ -29,8 +30,8 @@
     static NavigatorShare& from(Navigator&);
 
     // Navigator partial interface
-    ScriptPromise share(ScriptState*, const String& title, const String& text);
-    static ScriptPromise share(ScriptState*, Navigator&, const String& title, const String& text);
+    ScriptPromise share(ScriptState*, const ShareData&);
+    static ScriptPromise share(ScriptState*, Navigator&, const ShareData&);
 
     DECLARE_TRACE();
 
diff --git a/third_party/WebKit/Source/modules/webshare/NavigatorShare.idl b/third_party/WebKit/Source/modules/webshare/NavigatorShare.idl
index 5408d3eb9..3fc019b 100644
--- a/third_party/WebKit/Source/modules/webshare/NavigatorShare.idl
+++ b/third_party/WebKit/Source/modules/webshare/NavigatorShare.idl
@@ -7,12 +7,5 @@
 [
   RuntimeEnabled=WebShare,
 ] partial interface Navigator {
-  // TODO(mgiuca): Take a ShareData object, not just these two fields (see
-  // spec).
-  [CallWith=ScriptState] Promise<void> share (
-    DOMString title,
-    DOMString text
-  );
-
-  // TODO(mgiuca): Add canShare method (see spec).
+  [CallWith=ScriptState] Promise<void> share(ShareData data);
 };
diff --git a/third_party/WebKit/Source/modules/webshare/ShareData.idl b/third_party/WebKit/Source/modules/webshare/ShareData.idl
new file mode 100644
index 0000000..9bb123cc
--- /dev/null
+++ b/third_party/WebKit/Source/modules/webshare/ShareData.idl
@@ -0,0 +1,11 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// https://github.com/WICG/web-share/blob/master/docs/interface.md
+
+dictionary ShareData {
+  DOMString? title;
+  DOMString? text;
+  DOMString? url;
+};
diff --git a/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in b/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in
index 583ded6..a40997d 100644
--- a/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in
+++ b/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in
@@ -206,6 +206,7 @@
 // be shipped would be enabled. Instead, remove the flag from the shipping
 // interface.
 ExperimentalStream status=experimental
+SpeculativeLaunchServiceWorker
 StorageEstimate status=experimental
 Suborigins status=test
 // Many websites disable mouse support when touch APIs are available.  We'd
diff --git a/third_party/WebKit/Source/platform/animation/TimingFunction.cpp b/third_party/WebKit/Source/platform/animation/TimingFunction.cpp
index de8bf89..ccc55ffe 100644
--- a/third_party/WebKit/Source/platform/animation/TimingFunction.cpp
+++ b/third_party/WebKit/Source/platform/animation/TimingFunction.cpp
@@ -162,12 +162,12 @@
 // Equals operators
 bool operator==(const LinearTimingFunction& lhs, const TimingFunction& rhs)
 {
-    return rhs.type() == TimingFunction::kLinearFunction;
+    return rhs.getType() == TimingFunction::Type::LINEAR;
 }
 
 bool operator==(const CubicBezierTimingFunction& lhs, const TimingFunction& rhs)
 {
-    if (rhs.type() != TimingFunction::kCubicBezierFunction)
+    if (rhs.getType() != TimingFunction::Type::CUBIC_BEZIER)
         return false;
 
     const CubicBezierTimingFunction& ctf = toCubicBezierTimingFunction(rhs);
@@ -179,7 +179,7 @@
 
 bool operator==(const StepsTimingFunction& lhs, const TimingFunction& rhs)
 {
-    if (rhs.type() != TimingFunction::kStepsFunction)
+    if (rhs.getType() != TimingFunction::Type::STEPS)
         return false;
 
     const StepsTimingFunction& stf = toStepsTimingFunction(rhs);
@@ -190,16 +190,16 @@
 // non-generic operator== otherwise it will end up calling itself.
 bool operator==(const TimingFunction& lhs, const TimingFunction& rhs)
 {
-    switch (lhs.type()) {
-    case TimingFunction::kLinearFunction: {
+    switch (lhs.getType()) {
+    case TimingFunction::Type::LINEAR: {
         const LinearTimingFunction& linear = toLinearTimingFunction(lhs);
         return (linear == rhs);
     }
-    case TimingFunction::kCubicBezierFunction: {
+    case TimingFunction::Type::CUBIC_BEZIER: {
         const CubicBezierTimingFunction& cubic = toCubicBezierTimingFunction(lhs);
         return (cubic == rhs);
     }
-    case TimingFunction::kStepsFunction: {
+    case TimingFunction::Type::STEPS: {
         const StepsTimingFunction& step = toStepsTimingFunction(lhs);
         return (step == rhs);
     }
diff --git a/third_party/WebKit/Source/platform/animation/TimingFunction.h b/third_party/WebKit/Source/platform/animation/TimingFunction.h
index fb84a1d..9da8afde 100644
--- a/third_party/WebKit/Source/platform/animation/TimingFunction.h
+++ b/third_party/WebKit/Source/platform/animation/TimingFunction.h
@@ -40,14 +40,11 @@
 
 class PLATFORM_EXPORT TimingFunction : public RefCounted<TimingFunction> {
 public:
-
-    enum FunctionType {
-        kLinearFunction, kCubicBezierFunction, kStepsFunction
-    };
+    using Type = cc::TimingFunction::Type;
 
     virtual ~TimingFunction() { }
 
-    FunctionType type() const { return m_type; }
+    Type getType() const { return m_type; }
 
     virtual String toString() const = 0;
 
@@ -60,13 +57,13 @@
     virtual void range(double* minValue, double* maxValue) const = 0;
 
 protected:
-    TimingFunction(FunctionType type)
+    TimingFunction(Type type)
         : m_type(type)
     {
     }
 
 private:
-    FunctionType m_type;
+    Type m_type;
 };
 
 class PLATFORM_EXPORT LinearTimingFunction final : public TimingFunction {
@@ -85,7 +82,7 @@
     void range(double* minValue, double* maxValue) const override;
 private:
     LinearTimingFunction()
-        : TimingFunction(kLinearFunction)
+        : TimingFunction(Type::LINEAR)
     {
     }
 };
@@ -137,7 +134,7 @@
 
 private:
     explicit CubicBezierTimingFunction(EaseType easeType, double x1, double y1, double x2, double y2)
-        : TimingFunction(kCubicBezierFunction)
+        : TimingFunction(Type::CUBIC_BEZIER)
         , m_bezier(x1, y1, x2, y2)
         , m_x1(x1)
         , m_y1(y1)
@@ -199,7 +196,7 @@
 
 private:
     StepsTimingFunction(int steps, StepPosition stepPosition)
-        : TimingFunction(kStepsFunction)
+        : TimingFunction(Type::STEPS)
         , m_steps(steps)
         , m_stepPosition(stepPosition)
     {
@@ -216,15 +213,15 @@
 PLATFORM_EXPORT bool operator==(const TimingFunction&, const TimingFunction&);
 PLATFORM_EXPORT bool operator!=(const TimingFunction&, const TimingFunction&);
 
-#define DEFINE_TIMING_FUNCTION_TYPE_CASTS(typeName) \
+#define DEFINE_TIMING_FUNCTION_TYPE_CASTS(typeName, enumName) \
     DEFINE_TYPE_CASTS( \
         typeName##TimingFunction, TimingFunction, value, \
-        value->type() == TimingFunction::k##typeName##Function, \
-        value.type() == TimingFunction::k##typeName##Function)
+        value->getType() == TimingFunction::Type::enumName, \
+        value.getType() == TimingFunction::Type::enumName)
 
-DEFINE_TIMING_FUNCTION_TYPE_CASTS(Linear);
-DEFINE_TIMING_FUNCTION_TYPE_CASTS(CubicBezier);
-DEFINE_TIMING_FUNCTION_TYPE_CASTS(Steps);
+DEFINE_TIMING_FUNCTION_TYPE_CASTS(Linear, LINEAR);
+DEFINE_TIMING_FUNCTION_TYPE_CASTS(CubicBezier, CUBIC_BEZIER);
+DEFINE_TIMING_FUNCTION_TYPE_CASTS(Steps, STEPS);
 
 } // namespace blink
 
diff --git a/third_party/WebKit/Source/web/AssociatedURLLoader.cpp b/third_party/WebKit/Source/web/AssociatedURLLoader.cpp
index 0dfcbad..2e50987 100644
--- a/third_party/WebKit/Source/web/AssociatedURLLoader.cpp
+++ b/third_party/WebKit/Source/web/AssociatedURLLoader.cpp
@@ -404,7 +404,7 @@
 
     if (m_loader) {
         m_loader->cancel();
-        m_loader = nullptr;
+        m_loader.reset();
     }
     m_clientAdapter.reset();
 }
diff --git a/third_party/WebKit/Source/web/AssociatedURLLoader.h b/third_party/WebKit/Source/web/AssociatedURLLoader.h
index e57a2006..06d4717 100644
--- a/third_party/WebKit/Source/web/AssociatedURLLoader.h
+++ b/third_party/WebKit/Source/web/AssociatedURLLoader.h
@@ -84,7 +84,7 @@
     // An adapter which converts the DocumentThreadableLoaderClient method
     // calls into the WebURLLoaderClient method calls.
     std::unique_ptr<ClientAdapter> m_clientAdapter;
-    Persistent<DocumentThreadableLoader> m_loader;
+    std::unique_ptr<DocumentThreadableLoader> m_loader;
 
     // A ContextLifecycleObserver for cancelling |m_loader| when the Document
     // is detached.
diff --git a/third_party/WebKit/Source/web/WebRuntimeFeatures.cpp b/third_party/WebKit/Source/web/WebRuntimeFeatures.cpp
index 881e5b4c..6b3569d4 100644
--- a/third_party/WebKit/Source/web/WebRuntimeFeatures.cpp
+++ b/third_party/WebKit/Source/web/WebRuntimeFeatures.cpp
@@ -230,6 +230,11 @@
     RuntimeEnabledFeatures::setSlimmingPaintV2Enabled(enable);
 }
 
+void WebRuntimeFeatures::enableSpeculativeLaunchServiceWorker(bool enable)
+{
+    RuntimeEnabledFeatures::setSpeculativeLaunchServiceWorkerEnabled(enable);
+}
+
 void WebRuntimeFeatures::enableTouch(bool enable)
 {
     RuntimeEnabledFeatures::setTouchEnabled(enable);
diff --git a/third_party/WebKit/public/web/WebRuntimeFeatures.h b/third_party/WebKit/public/web/WebRuntimeFeatures.h
index 75fc545..2abe67c 100644
--- a/third_party/WebKit/public/web/WebRuntimeFeatures.h
+++ b/third_party/WebKit/public/web/WebRuntimeFeatures.h
@@ -103,6 +103,7 @@
     BLINK_EXPORT static void enableScrollAnchoring(bool);
     BLINK_EXPORT static void enableSharedWorker(bool);
     BLINK_EXPORT static void enableSlimmingPaintV2(bool);
+    BLINK_EXPORT static void enableSpeculativeLaunchServiceWorker(bool);
     BLINK_EXPORT static void enableTouch(bool);
     BLINK_EXPORT static void enableUnsafeES3APIs(bool);
     BLINK_EXPORT static void enableV8IdleTasks(bool);
diff --git a/tools/clang/scripts/update.py b/tools/clang/scripts/update.py
index 520903da..5cdfbae 100755
--- a/tools/clang/scripts/update.py
+++ b/tools/clang/scripts/update.py
@@ -27,7 +27,7 @@
 # Do NOT CHANGE this if you don't know what you're doing -- see
 # https://chromium.googlesource.com/chromium/src/+/master/docs/updating_clang.md
 # Reverting problematic clang rolls is safe, though.
-CLANG_REVISION = '274369'
+CLANG_REVISION = '277962'
 
 use_head_revision = 'LLVM_FORCE_HEAD_REVISION' in os.environ
 if use_head_revision:
@@ -71,7 +71,7 @@
                                 'Linux_x64', 'Release', 'bin')
 BFD_PLUGINS_DIR = os.path.join(BINUTILS_DIR, 'Linux_x64', 'Release',
                                'lib', 'bfd-plugins')
-VERSION = '3.9.0'
+VERSION = '4.0.0'
 ANDROID_NDK_DIR = os.path.join(
     CHROMIUM_DIR, 'third_party', 'android_tools', 'ndk')
 
@@ -854,11 +854,6 @@
       print 'Skipping Clang update (make_clang_dir= was set in GYP_DEFINES).'
       return 0
 
-  if use_head_revision:
-    # TODO(hans): Remove after the next roll.
-    global VERSION
-    VERSION = '4.0.0'
-
   global CLANG_REVISION, PACKAGE_VERSION
   if args.print_revision:
     if use_head_revision or args.llvm_force_head_revision:
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index 7dd4a384..29bd28575 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -82818,6 +82818,7 @@
   <int value="-667517406" label="overscroll-history-navigation"/>
   <int value="-661978438" label="enable-data-reduction-proxy-lo-fi"/>
   <int value="-660160292" label="enable-apps-show-on-first-paint"/>
+  <int value="-650504533" label="enable-speculative-launch-service-worker"/>
   <int value="-649956990" label="enable-harfbuzz-rendertext"/>
   <int value="-641719457" label="disable-compositor-touch-hit-testing"/>
   <int value="-631740127" label="inert-visual-viewport"/>
diff --git a/ui/gfx/geometry/insets.h b/ui/gfx/geometry/insets.h
index 0318aa4..bc5e346 100644
--- a/ui/gfx/geometry/insets.h
+++ b/ui/gfx/geometry/insets.h
@@ -12,6 +12,13 @@
 
 namespace gfx {
 
+// Represents the widths of the four borders or margins of an unspecified
+// rectangle. An Insets stores the thickness of the top, left, bottom and right
+// edges, without storing the actual size and position of the rectangle itself.
+//
+// This can be used to represent a space within a rectangle, by "shrinking" the
+// rectangle by the inset amount on all four sides. Alternatively, it can
+// represent a border that has a different thickness on each side.
 class GFX_EXPORT Insets {
  public:
   constexpr Insets() : top_(0), left_(0), bottom_(0), right_(0) {}
diff --git a/ui/webui/resources/cr_elements/cr_shared_menu/cr_shared_menu.js b/ui/webui/resources/cr_elements/cr_shared_menu/cr_shared_menu.js
index b4f4003..88ca0532 100644
--- a/ui/webui/resources/cr_elements/cr_shared_menu/cr_shared_menu.js
+++ b/ui/webui/resources/cr_elements/cr_shared_menu/cr_shared_menu.js
@@ -127,7 +127,6 @@
       this.$.dropdown.restoreFocusOnClose = false;
     }
     this.menuOpen = false;
-    this.$.dropdown.restoreFocusOnClose = true;
   },
 
   /**
@@ -136,6 +135,12 @@
    * @param {!Object} itemData The contextual item's data.
    */
   openMenu: function(anchor, itemData) {
+    if (this.lastAnchor_ == anchor && this.menuOpen)
+      return;
+
+    if (this.menuOpen)
+      this.closeMenu();
+
     this.itemData = itemData;
     this.lastAnchor_ = anchor;
     this.$.dropdown.restoreFocusOnClose = true;
@@ -196,8 +201,10 @@
    * @private
    */
   menuOpenChanged_: function() {
-    if (!this.menuOpen)
+    if (!this.menuOpen) {
       this.itemData = null;
+      this.lastAnchor_ = null;
+    }
   },
 
   /**