diff --git a/DEPS b/DEPS
index 5cd7626..19502f1a1 100644
--- a/DEPS
+++ b/DEPS
@@ -82,11 +82,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': 'bf74a460814a7912ed3d2e1af000afd2c45cd318',
+  'skia_revision': '485dc868fff73073a40509186e4e33fbcfb0edd2',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': '5e02fa850d27e25cc96a7e708506fd9642b4bcf0',
+  'v8_revision': '3e5f91d2931572b1baeff5f29a5e8bd45cb1c4ef',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -94,19 +94,19 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling ANGLE
   # and whatever else without interference from each other.
-  'angle_revision': '00af463e03efd3bf4449420889a892632915fee4',
+  'angle_revision': 'c3755fc56611eeeed712e5decc3a2f8670fac55a',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling build tools
   # and whatever else without interference from each other.
-  'buildtools_revision': '3748a2a90871fc25b0455790fa5a6699553f5197',
+  'buildtools_revision': '10d701fce52d192005512aa832dc82f9aae72b5d',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling SwiftShader
   # and whatever else without interference from each other.
-  'swiftshader_revision': 'f8cdc74c4b4afca9f1f807d9fda6ea8d530b358e',
+  'swiftshader_revision': '1119ce641315de5b76b71df390444f5810319d19',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling PDFium
   # and whatever else without interference from each other.
-  'pdfium_revision': '14f8897509d9db8739951a90488fb1634a497db5',
+  'pdfium_revision': '4862705090a7469115ae7e3c80143b6f8b6b527a',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling openmax_dl
   # and whatever else without interference from each other.
@@ -142,7 +142,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling catapult
   # and whatever else without interference from each other.
-  'catapult_revision': '7b821dff598416556b5942edbf400216ced4034b',
+  'catapult_revision': 'aaeb23e97cd16d8795cf73dd5d9ed8cd2cd1e00f',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libFuzzer
   # and whatever else without interference from each other.
@@ -158,7 +158,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
-  'feed_revision': '31ad36da1a0f992ca482506ad1ff7f94dd94573b',
+  'feed_revision': '3a782b5dac6c8f2f927613d3f37b8cad72f934b2',
 }
 
 # Only these hosts are allowed for dependencies in this DEPS file.
@@ -436,7 +436,7 @@
   },
 
   'src/third_party/depot_tools':
-    Var('chromium_git') + '/chromium/tools/depot_tools.git' + '@' + '2a5f70cc060a23729058736704e777daf4bbcae7',
+    Var('chromium_git') + '/chromium/tools/depot_tools.git' + '@' + '1118a2193b8f7b77c0e2336fa9528645ae70e804',
 
   'src/third_party/devtools-node-modules':
     Var('chromium_git') + '/external/github.com/ChromeDevTools/devtools-node-modules' + '@' + Var('devtools_node_modules_revision'),
@@ -876,7 +876,7 @@
     Var('chromium_git') + '/external/khronosgroup/webgl.git' + '@' + 'da5abe6e9bae583e4ae73aa553547fcaa637d099',
 
   'src/third_party/webrtc':
-    Var('webrtc_git') + '/src.git' + '@' + '4c9b3c840df3baf5145d73ecb994ba24b87908c7', # commit position 21742
+    Var('webrtc_git') + '/src.git' + '@' + '3ab5c40f72ef640a4decfe16d5787bf7da990473', # commit position 21742
 
   'src/third_party/xdg-utils': {
       'url': Var('chromium_git') + '/chromium/deps/xdg-utils.git' + '@' + 'd80274d5869b17b8c9067a1022e4416ee7ed5e0d',
diff --git a/PRESUBMIT.py b/PRESUBMIT.py
index d3cd196..cbcaff69 100644
--- a/PRESUBMIT.py
+++ b/PRESUBMIT.py
@@ -2768,7 +2768,6 @@
           source_file_filter=lambda x: x.LocalPath().endswith('.grd')))
   results.extend(_CheckSpamLogging(input_api, output_api))
   results.extend(_CheckForAnonymousVariables(input_api, output_api))
-  results.extend(_CheckUniquePtr(input_api, output_api))
   results.extend(_CheckUserActionUpdate(input_api, output_api))
   results.extend(_CheckNoDeprecatedCss(input_api, output_api))
   results.extend(_CheckNoDeprecatedJs(input_api, output_api))
@@ -3168,6 +3167,7 @@
   results.extend(_CheckSyslogUseWarning(input_api, output_api))
   results.extend(_CheckGoogleSupportAnswerUrl(input_api, output_api))
   results.extend(_CheckCrbugLinksHaveHttps(input_api, output_api))
+  results.extend(_CheckUniquePtr(input_api, output_api))
   return results
 
 
diff --git a/WATCHLISTS b/WATCHLISTS
index 3a50e4b6..b7d1f428 100644
--- a/WATCHLISTS
+++ b/WATCHLISTS
@@ -133,6 +133,9 @@
       'filepath': 'chromeos/assistant/'\
                   '|chromeos/services/assistant/'
     },
+    'audio_service': {
+      'filepath': 'services/audio/'
+    },
     'aura': {
       'filepath': 'ui/aura/',
     },
@@ -1702,6 +1705,9 @@
     'ash': ['kalyan.kondapally@intel.com',
             'sadrul@chromium.org'],
     'assistant': ['croissant-eng+reviews@chromium.org'],
+    'audio_service': ['marinaciocea+watch@chromium.org',
+                      'maxmorin+watch@chromium.org',
+                      'olka+watch@chromium.org'],
     'aura': ['kalyan.kondapally@intel.com',
              'sadrul@chromium.org'],
     'aura_compositor': ['danakj+watch@chromium.org',
@@ -1716,7 +1722,8 @@
                  'anthonyvd+autofillwatch@chromium.org'],
     'background_fetch': ['delphick+watch@chromium.org',
                          'peter@chromium.org',
-                         'rayankans+watch@chromium.org'],
+                         'rayankans+watch@chromium.org',
+			 'nator@chromium.org'],
     'background_sync': ['chasej+watch@chromium.org',
                         'iclelland+watch@chromium.org',
                         'peter@chromium.org'],
@@ -1981,6 +1988,7 @@
                      'glider+clang@chromium.org',
                      'hans@chromium.org',
                      'pcc@chromium.org',
+                     'rhalavati@chromium.org',
                      'rnk@chromium.org',
                      'thakis@chromium.org',
                      'thestig@chromium.org',
diff --git a/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromiumAwInit.java b/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromiumAwInit.java
index 325f8eb..6bd1da9 100644
--- a/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromiumAwInit.java
+++ b/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromiumAwInit.java
@@ -42,6 +42,7 @@
 import org.chromium.base.library_loader.LibraryLoader;
 import org.chromium.base.library_loader.LibraryProcessType;
 import org.chromium.base.library_loader.ProcessInitException;
+import org.chromium.base.metrics.RecordHistogram;
 import org.chromium.net.NetworkChangeNotifier;
 
 /**
@@ -171,6 +172,9 @@
 
         mStarted = true;
 
+        RecordHistogram.recordSparseSlowlyHistogram(
+                "Android.WebView.TargetSdkVersion", context.getApplicationInfo().targetSdkVersion);
+
         // Initialize thread-unsafe singletons.
         AwBrowserContext awBrowserContext = getBrowserContextOnUiThread();
         mGeolocationPermissions = new GeolocationPermissionsAdapter(
diff --git a/android_webview/java/src/org/chromium/android_webview/AwContents.java b/android_webview/java/src/org/chromium/android_webview/AwContents.java
index cce83619..3953fce 100644
--- a/android_webview/java/src/org/chromium/android_webview/AwContents.java
+++ b/android_webview/java/src/org/chromium/android_webview/AwContents.java
@@ -1624,7 +1624,7 @@
 
     private static void recordHistoryUrl(@HistoryUrl int value) {
         RecordHistogram.recordEnumeratedHistogram(
-                "WebView.LoadDataWithBaseUrl.HistoryUrl", value, HistoryUrl.COUNT);
+                "Android.WebView.LoadDataWithBaseUrl.HistoryUrl", value, HistoryUrl.COUNT);
     }
 
     /**
diff --git a/base/memory/platform_shared_memory_region_fuchsia.cc b/base/memory/platform_shared_memory_region_fuchsia.cc
index 16b7a93..22a43b0 100644
--- a/base/memory/platform_shared_memory_region_fuchsia.cc
+++ b/base/memory/platform_shared_memory_region_fuchsia.cc
@@ -148,7 +148,7 @@
   }
   ignore_result(old_vmo.release());
 
-  return PlatformSharedMemoryRegion(std::move(vmo), mode, rounded_size,
+  return PlatformSharedMemoryRegion(std::move(vmo), mode, size,
                                     UnguessableToken::Create());
 }
 
diff --git a/base/memory/platform_shared_memory_region_mac.cc b/base/memory/platform_shared_memory_region_mac.cc
index ec30832..a38d0c1 100644
--- a/base/memory/platform_shared_memory_region_mac.cc
+++ b/base/memory/platform_shared_memory_region_mac.cc
@@ -96,15 +96,17 @@
   }
 
   // Make new memory object.
+  memory_object_size_t allocation_size = size_;
   mac::ScopedMachSendRight named_right;
   kern_return_t kr = mach_make_memory_entry_64(
-      mach_task_self(), reinterpret_cast<memory_object_size_t*>(&size_),
+      mach_task_self(), &allocation_size,
       reinterpret_cast<memory_object_offset_t>(temp_addr), VM_PROT_READ,
       named_right.receive(), MACH_PORT_NULL);
   if (kr != KERN_SUCCESS) {
     MACH_DLOG(ERROR, kr) << "mach_make_memory_entry_64";
     return false;
   }
+  DCHECK_GE(allocation_size, size_);
 
   handle_ = std::move(named_right);
   mode_ = Mode::kReadOnly;
@@ -170,8 +172,9 @@
     MACH_DLOG(ERROR, kr) << "mach_make_memory_entry_64";
     return {};
   }
+  DCHECK_GE(vm_size, size);
 
-  return PlatformSharedMemoryRegion(std::move(named_right), mode, vm_size,
+  return PlatformSharedMemoryRegion(std::move(named_right), mode, size,
                                     UnguessableToken::Create());
 }
 
diff --git a/base/memory/platform_shared_memory_region_unittest.cc b/base/memory/platform_shared_memory_region_unittest.cc
index 36d3d5e..f3c3d77 100644
--- a/base/memory/platform_shared_memory_region_unittest.cc
+++ b/base/memory/platform_shared_memory_region_unittest.cc
@@ -31,7 +31,7 @@
     if (!region->MapAt(offset, bytes, &memory, &mapped_size))
       return {};
 
-    return SharedMemoryMapping(memory, mapped_size, region->GetGUID());
+    return SharedMemoryMapping(memory, bytes, mapped_size, region->GetGUID());
   }
 
   void* GetMemory(SharedMemoryMapping* mapping) {
@@ -76,6 +76,21 @@
   EXPECT_FALSE(region2.IsValid());
 }
 
+// Tests that regions consistently report their size as the size requested at
+// creation time even if their allocation size is larger due to platform
+// constraints.
+TEST_F(PlatformSharedMemoryRegionTest, ReportedSizeIsRequestedSize) {
+  constexpr size_t kTestSizes[] = {1, 2, 3, 64, 4096, 1024 * 1024};
+  for (size_t size : kTestSizes) {
+    PlatformSharedMemoryRegion region =
+        PlatformSharedMemoryRegion::CreateWritable(size);
+    EXPECT_EQ(region.GetSize(), size);
+
+    region.ConvertToReadOnly();
+    EXPECT_EQ(region.GetSize(), size);
+  }
+}
+
 // Tests that the platform-specific handle converted to read-only cannot be used
 // to perform a writable mapping with low-level system APIs like mmap().
 TEST_F(PlatformSharedMemoryRegionTest, ReadOnlyHandleIsNotWritable) {
diff --git a/base/memory/platform_shared_memory_region_win.cc b/base/memory/platform_shared_memory_region_win.cc
index caacf526..8e30bcf 100644
--- a/base/memory/platform_shared_memory_region_win.cc
+++ b/base/memory/platform_shared_memory_region_win.cc
@@ -301,7 +301,7 @@
     return {};
   }
 
-  return PlatformSharedMemoryRegion(std::move(scoped_h), mode, rounded_size,
+  return PlatformSharedMemoryRegion(std::move(scoped_h), mode, size,
                                     UnguessableToken::Create());
 }
 
diff --git a/base/memory/read_only_shared_memory_region.cc b/base/memory/read_only_shared_memory_region.cc
index c527fed..f39837a 100644
--- a/base/memory/read_only_shared_memory_region.cc
+++ b/base/memory/read_only_shared_memory_region.cc
@@ -23,7 +23,7 @@
   if (!handle.MapAt(0, handle.GetSize(), &memory_ptr, &mapped_size))
     return {};
 
-  WritableSharedMemoryMapping mapping(memory_ptr, mapped_size,
+  WritableSharedMemoryMapping mapping(memory_ptr, size, mapped_size,
                                       handle.GetGUID());
 #if defined(OS_MACOSX) && !defined(OS_IOS)
   handle.ConvertToReadOnly(memory_ptr);
@@ -77,7 +77,8 @@
   if (!handle_.MapAt(offset, size, &memory, &mapped_size))
     return {};
 
-  return ReadOnlySharedMemoryMapping(memory, mapped_size, handle_.GetGUID());
+  return ReadOnlySharedMemoryMapping(memory, size, mapped_size,
+                                     handle_.GetGUID());
 }
 
 bool ReadOnlySharedMemoryRegion::IsValid() const {
diff --git a/base/memory/shared_memory_mapping.cc b/base/memory/shared_memory_mapping.cc
index b034fc1..005e3fc 100644
--- a/base/memory/shared_memory_mapping.cc
+++ b/base/memory/shared_memory_mapping.cc
@@ -35,7 +35,10 @@
 SharedMemoryMapping::SharedMemoryMapping() = default;
 
 SharedMemoryMapping::SharedMemoryMapping(SharedMemoryMapping&& mapping)
-    : memory_(mapping.memory_), size_(mapping.size_), guid_(mapping.guid_) {
+    : memory_(mapping.memory_),
+      size_(mapping.size_),
+      mapped_size_(mapping.mapped_size_),
+      guid_(mapping.guid_) {
   mapping.memory_ = nullptr;
 }
 
@@ -44,6 +47,7 @@
   Unmap();
   memory_ = mapping.memory_;
   size_ = mapping.size_;
+  mapped_size_ = mapping.mapped_size_;
   guid_ = mapping.guid_;
   mapping.memory_ = nullptr;
   return *this;
@@ -55,8 +59,9 @@
 
 SharedMemoryMapping::SharedMemoryMapping(void* memory,
                                          size_t size,
+                                         size_t mapped_size,
                                          const UnguessableToken& guid)
-    : memory_(memory), size_(size), guid_(guid) {
+    : memory_(memory), size_(size), mapped_size_(mapped_size), guid_(guid) {
   SharedMemoryTracker::GetInstance()->IncrementMemoryUsage(*this);
 }
 
@@ -91,8 +96,9 @@
 ReadOnlySharedMemoryMapping::ReadOnlySharedMemoryMapping(
     void* address,
     size_t size,
+    size_t mapped_size,
     const UnguessableToken& guid)
-    : SharedMemoryMapping(address, size, guid) {}
+    : SharedMemoryMapping(address, size, mapped_size, guid) {}
 
 WritableSharedMemoryMapping::WritableSharedMemoryMapping() = default;
 WritableSharedMemoryMapping::WritableSharedMemoryMapping(
@@ -102,7 +108,8 @@
 WritableSharedMemoryMapping::WritableSharedMemoryMapping(
     void* address,
     size_t size,
+    size_t mapped_size,
     const UnguessableToken& guid)
-    : SharedMemoryMapping(address, size, guid) {}
+    : SharedMemoryMapping(address, size, mapped_size, guid) {}
 
 }  // namespace base
diff --git a/base/memory/shared_memory_mapping.h b/base/memory/shared_memory_mapping.h
index 35b519c..434a5871 100644
--- a/base/memory/shared_memory_mapping.h
+++ b/base/memory/shared_memory_mapping.h
@@ -40,13 +40,22 @@
   // corresponding area of memory.
   bool IsValid() const { return memory_ != nullptr; }
 
-  // Returns the size of the mapping in bytes. This is page-aligned. This is
-  // undefined for invalid instances.
+  // Returns the logical size of the mapping in bytes. This is precisely the
+  // size requested by whoever created the mapping, and it is always less than
+  // or equal to |mapped_size()|. This is undefined for invalid instances.
   size_t size() const {
     DCHECK(IsValid());
     return size_;
   }
 
+  // Returns the actual size of the mapping in bytes. This is always at least
+  // as large as |size()| but may be larger due to platform mapping alignment
+  // constraints. This is undefined for invalid instances.
+  size_t mapped_size() const {
+    DCHECK(IsValid());
+    return mapped_size_;
+  }
+
   // Returns 128-bit GUID of the region this mapping belongs to.
   const UnguessableToken& guid() const {
     DCHECK(IsValid());
@@ -54,7 +63,10 @@
   }
 
  protected:
-  SharedMemoryMapping(void* address, size_t size, const UnguessableToken& guid);
+  SharedMemoryMapping(void* address,
+                      size_t size,
+                      size_t mapped_size,
+                      const UnguessableToken& guid);
   void* raw_memory_ptr() const { return memory_; }
 
  private:
@@ -65,6 +77,7 @@
 
   void* memory_ = nullptr;
   size_t size_ = 0;
+  size_t mapped_size_ = 0;
   UnguessableToken guid_;
 
   DISALLOW_COPY_AND_ASSIGN(SharedMemoryMapping);
@@ -90,6 +103,7 @@
   friend class ReadOnlySharedMemoryRegion;
   ReadOnlySharedMemoryMapping(void* address,
                               size_t size,
+                              size_t mapped_size,
                               const UnguessableToken& guid);
 
   DISALLOW_COPY_AND_ASSIGN(ReadOnlySharedMemoryMapping);
@@ -118,6 +132,7 @@
   friend class UnsafeSharedMemoryRegion;
   WritableSharedMemoryMapping(void* address,
                               size_t size,
+                              size_t mapped_size,
                               const UnguessableToken& guid);
 
   DISALLOW_COPY_AND_ASSIGN(WritableSharedMemoryMapping);
diff --git a/base/memory/shared_memory_region_unittest.cc b/base/memory/shared_memory_region_unittest.cc
index f85a7c3..16b7d4e 100644
--- a/base/memory/shared_memory_region_unittest.cc
+++ b/base/memory/shared_memory_region_unittest.cc
@@ -157,9 +157,13 @@
                 (subtle::PlatformSharedMemoryRegion::kMapMinimumAlignment - 1));
 }
 
+TYPED_TEST(SharedMemoryRegionTest, MapSize) {
+  EXPECT_EQ(this->rw_mapping_.size(), kRegionSize);
+  EXPECT_GE(this->rw_mapping_.mapped_size(), kRegionSize);
+}
+
 TYPED_TEST(SharedMemoryRegionTest, MapGranularity) {
-  EXPECT_GE(this->rw_mapping_.size(), kRegionSize);
-  EXPECT_LT(this->rw_mapping_.size(),
+  EXPECT_LT(this->rw_mapping_.mapped_size(),
             kRegionSize + SysInfo::VMAllocationGranularity());
 }
 
diff --git a/base/memory/shared_memory_tracker.cc b/base/memory/shared_memory_tracker.cc
index e1cf818..8eefb7ea 100644
--- a/base/memory/shared_memory_tracker.cc
+++ b/base/memory/shared_memory_tracker.cc
@@ -57,7 +57,7 @@
   AutoLock hold(usages_lock_);
   DCHECK(usages_.find(mapping.raw_memory_ptr()) == usages_.end());
   usages_.emplace(mapping.raw_memory_ptr(),
-                  UsageInfo(mapping.size(), mapping.guid()));
+                  UsageInfo(mapping.mapped_size(), mapping.guid()));
 }
 
 void SharedMemoryTracker::DecrementMemoryUsage(
diff --git a/base/memory/unsafe_shared_memory_region.cc b/base/memory/unsafe_shared_memory_region.cc
index 2f4b24a..a98866e 100644
--- a/base/memory/unsafe_shared_memory_region.cc
+++ b/base/memory/unsafe_shared_memory_region.cc
@@ -56,7 +56,8 @@
   if (!handle_.MapAt(offset, size, &memory, &mapped_size))
     return {};
 
-  return WritableSharedMemoryMapping(memory, mapped_size, handle_.GetGUID());
+  return WritableSharedMemoryMapping(memory, size, mapped_size,
+                                     handle_.GetGUID());
 }
 
 bool UnsafeSharedMemoryRegion::IsValid() const {
diff --git a/base/memory/writable_shared_memory_region.cc b/base/memory/writable_shared_memory_region.cc
index c334d11..e89328d 100644
--- a/base/memory/writable_shared_memory_region.cc
+++ b/base/memory/writable_shared_memory_region.cc
@@ -64,7 +64,8 @@
   if (!handle_.MapAt(offset, size, &memory, &mapped_size))
     return {};
 
-  return WritableSharedMemoryMapping(memory, mapped_size, handle_.GetGUID());
+  return WritableSharedMemoryMapping(memory, size, mapped_size,
+                                     handle_.GetGUID());
 }
 
 bool WritableSharedMemoryRegion::IsValid() const {
diff --git a/base/threading/thread_local_storage.h b/base/threading/thread_local_storage.h
index 13ec694b..844f4e7 100644
--- a/base/threading/thread_local_storage.h
+++ b/base/threading/thread_local_storage.h
@@ -18,9 +18,9 @@
 #include <pthread.h>
 #endif
 
-namespace profiling {
+namespace heap_profiling {
 class MemlogAllocatorShimInternal;
-}  // namespace profiling
+}  // namespace heap_profiling
 
 namespace base {
 
@@ -156,7 +156,7 @@
   friend class base::SamplingHeapProfiler;
   friend class base::internal::ThreadLocalStorageTestInternal;
   friend class base::trace_event::MallocDumpProvider;
-  friend class profiling::MemlogAllocatorShimInternal;
+  friend class heap_profiling::MemlogAllocatorShimInternal;
   static bool HasBeenDestroyed();
 
   DISALLOW_COPY_AND_ASSIGN(ThreadLocalStorage);
diff --git a/base/trace_event/memory_dump_request_args.cc b/base/trace_event/memory_dump_request_args.cc
index 1862c4e..3cb9cabae 100644
--- a/base/trace_event/memory_dump_request_args.cc
+++ b/base/trace_event/memory_dump_request_args.cc
@@ -45,8 +45,6 @@
       return "background";
     case MemoryDumpLevelOfDetail::LIGHT:
       return "light";
-    case MemoryDumpLevelOfDetail::VM_REGIONS_ONLY_FOR_HEAP_PROFILER:
-      return "vm_regions_only";
     case MemoryDumpLevelOfDetail::DETAILED:
       return "detailed";
   }
@@ -60,8 +58,6 @@
     return MemoryDumpLevelOfDetail::BACKGROUND;
   if (str == "light")
     return MemoryDumpLevelOfDetail::LIGHT;
-  if (str == "vm_regions_only")
-    return MemoryDumpLevelOfDetail::VM_REGIONS_ONLY_FOR_HEAP_PROFILER;
   if (str == "detailed")
     return MemoryDumpLevelOfDetail::DETAILED;
   NOTREACHED();
diff --git a/base/trace_event/memory_dump_request_args.h b/base/trace_event/memory_dump_request_args.h
index a3e9d0c..41bc99bc 100644
--- a/base/trace_event/memory_dump_request_args.h
+++ b/base/trace_event/memory_dump_request_args.h
@@ -53,9 +53,6 @@
   // Few entries, typically a fixed number, per dump.
   LIGHT,
 
-  // Retrieve only memory maps. Used only for the heap profiler.
-  VM_REGIONS_ONLY_FOR_HEAP_PROFILER,
-
   // Unrestricted amount of entries per dump.
   DETAILED,
 
diff --git a/base/trace_event/memory_dump_scheduler.cc b/base/trace_event/memory_dump_scheduler.cc
index 0332af7..8b03f5c9 100644
--- a/base/trace_event/memory_dump_scheduler.cc
+++ b/base/trace_event/memory_dump_scheduler.cc
@@ -50,11 +50,6 @@
   for (const Config::Trigger& trigger : config.triggers) {
     DCHECK_GT(trigger.period_ms, 0u);
     switch (trigger.level_of_detail) {
-      case MemoryDumpLevelOfDetail::VM_REGIONS_ONLY_FOR_HEAP_PROFILER:
-        // There is no use case to request a periodic dump which contains
-        // details that are useful only for the heap-profiler.
-        NOTREACHED();
-        return;
       case MemoryDumpLevelOfDetail::BACKGROUND:
         break;
       case MemoryDumpLevelOfDetail::LIGHT:
diff --git a/build/config/compiler/compiler.gni b/build/config/compiler/compiler.gni
index ddcd327..60f05de 100644
--- a/build/config/compiler/compiler.gni
+++ b/build/config/compiler/compiler.gni
@@ -143,8 +143,11 @@
 
 # Unwinding with CFI table is only possible on static library builds and
 # requried only when frame pointers are not enabled.
-can_unwind_with_cfi_table = is_android && !is_component_build &&
-                            !enable_frame_pointers && current_cpu == "arm"
+# Builds with use_thin_lto use link registers to store offsets, and this is
+# not supported yet.
+can_unwind_with_cfi_table =
+    is_android && !is_component_build && !can_unwind_with_frame_pointers &&
+    current_cpu == "arm" && !use_thin_lto
 
 declare_args() {
   # Whether or not the official builds should be built with full WPO. Enabled by
diff --git a/components/autofill/android/java/res/drawable/autofill_chip_inset.xml b/chrome/android/java/res/drawable/autofill_chip_inset.xml
similarity index 91%
rename from components/autofill/android/java/res/drawable/autofill_chip_inset.xml
rename to chrome/android/java/res/drawable/autofill_chip_inset.xml
index 9a44f7a..2e428cab 100644
--- a/components/autofill/android/java/res/drawable/autofill_chip_inset.xml
+++ b/chrome/android/java/res/drawable/autofill_chip_inset.xml
@@ -9,7 +9,7 @@
     android:insetRight="@dimen/keyboard_accessory_half_padding"
     android:insetTop="@dimen/keyboard_accessory_padding">
     <shape>
-        <solid android:color="#ECEFF1" />
+        <solid android:color="@color/google_grey_200" />
         <corners android:radius="2dp" />
     </shape>
 </inset>
diff --git a/components/autofill/android/java/res/layout/autofill_keyboard_accessory_icon.xml b/chrome/android/java/res/layout/autofill_keyboard_accessory_icon.xml
similarity index 100%
rename from components/autofill/android/java/res/layout/autofill_keyboard_accessory_icon.xml
rename to chrome/android/java/res/layout/autofill_keyboard_accessory_icon.xml
diff --git a/components/autofill/android/java/res/layout/autofill_keyboard_accessory_item.xml b/chrome/android/java/res/layout/autofill_keyboard_accessory_item.xml
similarity index 94%
rename from components/autofill/android/java/res/layout/autofill_keyboard_accessory_item.xml
rename to chrome/android/java/res/layout/autofill_keyboard_accessory_item.xml
index dd508f2..843a35c3 100644
--- a/components/autofill/android/java/res/layout/autofill_keyboard_accessory_item.xml
+++ b/chrome/android/java/res/layout/autofill_keyboard_accessory_item.xml
@@ -22,7 +22,7 @@
         android:paddingEnd="@dimen/keyboard_accessory_half_padding"
         android:paddingStart="@dimen/keyboard_accessory_half_padding"
         android:singleLine="true"
-        android:textColor="#333"
+        android:textColor="@color/google_grey_800"
         android:textSize="@dimen/keyboard_accessory_text_size" />
 
     <TextView
@@ -33,7 +33,7 @@
         android:gravity="center_vertical"
         android:paddingEnd="@dimen/keyboard_accessory_half_padding"
         android:singleLine="true"
-        android:textColor="#646464"
+        android:textColor="@color/google_grey_600"
         android:textSize="@dimen/keyboard_accessory_text_size"
         android:visibility="gone" />
 
diff --git a/chrome/android/java/res/layout/signin_view.xml b/chrome/android/java/res/layout/signin_view.xml
index 098e201e..aea93433 100644
--- a/chrome/android/java/res/layout/signin_view.xml
+++ b/chrome/android/java/res/layout/signin_view.xml
@@ -59,26 +59,29 @@
                     android:layout_width="40dp"
                     android:layout_height="40dp"
                     android:layout_alignParentStart="true"
+                    android:layout_centerVertical="true"
                     android:layout_marginEnd="16dp"
                     android:contentDescription="@null"
                     tools:src="@drawable/logo_avatar_anonymous"/>
                 <TextView
                     android:id="@+id/account_name"
                     android:layout_width="match_parent"
-                    android:layout_height="20dp"
-                    android:layout_toEndOf="@id/account_image"
+                    android:layout_height="wrap_content"
                     android:layout_toStartOf="@id/expand_icon"
+                    android:layout_toEndOf="@id/account_image"
                     android:gravity="center_vertical"
+                    android:minHeight="20dp"
                     android:textAppearance="@style/BlackBodyDefault"
                     tools:text="John Doe"/>
                 <TextView
                     android:id="@+id/account_email"
                     android:layout_width="match_parent"
-                    android:layout_height="20dp"
+                    android:layout_height="wrap_content"
                     android:layout_below="@id/account_name"
-                    android:layout_toEndOf="@id/account_image"
                     android:layout_toStartOf="@id/expand_icon"
+                    android:layout_toEndOf="@id/account_image"
                     android:gravity="center_vertical"
+                    android:minHeight="20dp"
                     android:textAppearance="@style/BlackCaption"
                     tools:text="john.doe@example.com"/>
                 <ImageView
diff --git a/chrome/android/java/res/values/dimens.xml b/chrome/android/java/res/values/dimens.xml
index 01cb745..6c9b45a 100644
--- a/chrome/android/java/res/values/dimens.xml
+++ b/chrome/android/java/res/values/dimens.xml
@@ -122,6 +122,14 @@
     <!-- Overlay panel dimensions -->
     <dimen name="overlay_panel_bar_height">56dp</dimen>
 
+    <!-- Autofill keyboard accessory dimensions -->
+    <dimen name="keyboard_accessory_chip_height">32dp</dimen>
+    <dimen name="keyboard_accessory_half_padding">4dp</dimen>
+    <dimen name="keyboard_accessory_height">48dp</dimen>
+    <dimen name="keyboard_accessory_padding">8dp</dimen>
+    <dimen name="keyboard_accessory_text_size">14sp</dimen>
+    <dimen name="keyboard_accessory_start_animation_translation">100dp</dimen>
+
     <!-- Password generation popup dimensions -->
     <dimen name="password_generation_divider_height">1dp</dimen>
     <dimen name="password_generation_text_size">14sp</dimen>
diff --git a/components/autofill/android/java/src/org/chromium/components/autofill/AutofillKeyboardAccessory.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill/AutofillKeyboardAccessory.java
similarity index 92%
rename from components/autofill/android/java/src/org/chromium/components/autofill/AutofillKeyboardAccessory.java
rename to chrome/android/java/src/org/chromium/chrome/browser/autofill/AutofillKeyboardAccessory.java
index d65f865..6ddf49c 100644
--- a/components/autofill/android/java/src/org/chromium/components/autofill/AutofillKeyboardAccessory.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill/AutofillKeyboardAccessory.java
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-package org.chromium.components.autofill;
+package org.chromium.chrome.browser.autofill;
 
 import android.animation.Animator;
 import android.animation.AnimatorListenerAdapter;
@@ -25,6 +25,9 @@
 import android.widget.TextView;
 
 import org.chromium.base.ApiCompatibilityUtils;
+import org.chromium.chrome.R;
+import org.chromium.components.autofill.AutofillDelegate;
+import org.chromium.components.autofill.AutofillSuggestion;
 import org.chromium.ui.UiUtils;
 import org.chromium.ui.base.WindowAndroid;
 
@@ -34,9 +37,9 @@
  * The Autofill suggestion view that lists relevant suggestions. It sits above the keyboard and
  * below the content area.
  */
-public class AutofillKeyboardAccessory extends LinearLayout
-        implements WindowAndroid.KeyboardVisibilityListener, View.OnClickListener,
-        View.OnLongClickListener {
+public class AutofillKeyboardAccessory
+        extends LinearLayout implements WindowAndroid.KeyboardVisibilityListener,
+                                        View.OnClickListener, View.OnLongClickListener {
     // Time to pause before reversing animation when the first suggestion is a hint.
     private static final long PAUSE_ANIMATION_BEFORE_REVERSE_MILLIS = 1000;
     // Time to fade in views that we temporarily hide when we change container layout.
@@ -79,8 +82,8 @@
         mMaximumSublabelWidthPx = deviceWidthPx / 4;
 
         mWindowAndroid.addKeyboardVisibilityListener(this);
-        int horizontalPaddingPx = getResources().getDimensionPixelSize(
-                R.dimen.keyboard_accessory_half_padding);
+        int horizontalPaddingPx =
+                getResources().getDimensionPixelSize(R.dimen.keyboard_accessory_half_padding);
         setPadding(horizontalPaddingPx, 0, horizontalPaddingPx, 0);
 
         mAnimationDurationMillis = animationDurationMillis;
@@ -116,8 +119,9 @@
 
             View touchTarget;
             if (!suggestion.isFillable() && suggestion.getIconId() != 0) {
-                touchTarget = LayoutInflater.from(getContext()).inflate(
-                        R.layout.autofill_keyboard_accessory_icon, this, false);
+                touchTarget =
+                        LayoutInflater.from(getContext())
+                                .inflate(R.layout.autofill_keyboard_accessory_icon, this, false);
 
                 if (mSeparatorPosition == -1 && !isKeyboardAccessoryHint) mSeparatorPosition = i;
 
@@ -125,16 +129,17 @@
                 Drawable drawable =
                         AppCompatResources.getDrawable(getContext(), suggestion.getIconId());
                 if (isKeyboardAccessoryHint) {
-                    drawable.setColorFilter(ApiCompatibilityUtils.getColor(getResources(),
-                                                    R.color.keyboard_accessory_hint_icon),
+                    drawable.setColorFilter(
+                            ApiCompatibilityUtils.getColor(getResources(), R.color.google_blue_500),
                             PorterDuff.Mode.SRC_IN);
                 } else {
                     icon.setContentDescription(suggestion.getLabel());
                 }
                 icon.setImageDrawable(drawable);
             } else {
-                touchTarget = LayoutInflater.from(getContext()).inflate(
-                        R.layout.autofill_keyboard_accessory_item, this, false);
+                touchTarget =
+                        LayoutInflater.from(getContext())
+                                .inflate(R.layout.autofill_keyboard_accessory_item, this, false);
 
                 TextView label = (TextView) touchTarget.findViewById(
                         R.id.autofill_keyboard_accessory_item_label);
@@ -149,8 +154,7 @@
                 }
 
                 if (suggestion.getIconId() != 0) {
-                    ApiCompatibilityUtils.setCompoundDrawablesRelativeWithIntrinsicBounds(
-                            label,
+                    ApiCompatibilityUtils.setCompoundDrawablesRelativeWithIntrinsicBounds(label,
                             AppCompatResources.getDrawable(getContext(), suggestion.getIconId()),
                             null /* top */, null /* end */, null /* bottom */);
                 }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill/AutofillKeyboardAccessoryBridge.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill/AutofillKeyboardAccessoryBridge.java
index 0fbb0d7..4228f2c 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill/AutofillKeyboardAccessoryBridge.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill/AutofillKeyboardAccessoryBridge.java
@@ -13,7 +13,6 @@
 import org.chromium.chrome.R;
 import org.chromium.chrome.browser.ResourceId;
 import org.chromium.components.autofill.AutofillDelegate;
-import org.chromium.components.autofill.AutofillKeyboardAccessory;
 import org.chromium.components.autofill.AutofillSuggestion;
 import org.chromium.ui.DropdownItem;
 import org.chromium.ui.base.WindowAndroid;
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/payments/ServiceWorkerPaymentApp.java b/chrome/android/java/src/org/chromium/chrome/browser/payments/ServiceWorkerPaymentApp.java
index 40fde8e..1755b45 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/payments/ServiceWorkerPaymentApp.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/payments/ServiceWorkerPaymentApp.java
@@ -328,7 +328,7 @@
                     iframeOrigin, id, new HashSet<>(methodData.values()), total,
                     new HashSet<>(modifiers.values()), callback, mAppName,
                     icon == null ? null : icon.getBitmap(), mSwUri, mScope, mUseCache,
-                    mMethodNames);
+                    mMethodNames.toArray(new String[0])[0]);
         } else {
             ServiceWorkerPaymentAppBridge.invokePaymentApp(mWebContents, mRegistrationId, origin,
                     iframeOrigin, id, new HashSet<>(methodData.values()), total,
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/payments/ServiceWorkerPaymentAppBridge.java b/chrome/android/java/src/org/chromium/chrome/browser/payments/ServiceWorkerPaymentAppBridge.java
index cfb9138..fc895c6 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/payments/ServiceWorkerPaymentAppBridge.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/payments/ServiceWorkerPaymentAppBridge.java
@@ -207,20 +207,19 @@
      * @param swUri            The URI to get the app's service worker js script.
      * @param scope            The scope of the service worker that should be registered.
      * @param useCache         Whether to use cache when registering the service worker.
-     * @param methodNames      Supported method names of the app.
+     * @param method           Supported method name of the app.
      */
     public static void installAndInvokePaymentApp(WebContents webContents, String origin,
             String iframeOrigin, String paymentRequestId, Set<PaymentMethodData> methodData,
             PaymentItem total, Set<PaymentDetailsModifier> modifiers,
             PaymentInstrument.InstrumentDetailsCallback callback, String appName,
-            @Nullable Bitmap icon, URI swUri, URI scope, boolean useCache,
-            Set<String> methodNames) {
+            @Nullable Bitmap icon, URI swUri, URI scope, boolean useCache, String method) {
         ThreadUtils.assertOnUiThread();
 
         nativeInstallAndInvokePaymentApp(webContents, origin, iframeOrigin, paymentRequestId,
                 methodData.toArray(new PaymentMethodData[0]), total,
                 modifiers.toArray(new PaymentDetailsModifier[0]), callback, appName, icon,
-                swUri.toString(), scope.toString(), useCache, methodNames.toArray(new String[0]));
+                swUri.toString(), scope.toString(), useCache, method);
     }
 
     /**
@@ -427,8 +426,7 @@
             String topLevelOrigin, String paymentRequestOrigin, String paymentRequestId,
             PaymentMethodData[] methodData, PaymentItem total, PaymentDetailsModifier[] modifiers,
             PaymentInstrument.InstrumentDetailsCallback callback, String appName,
-            @Nullable Bitmap icon, String swUrl, String scope, boolean useCache,
-            String[] methodNames);
+            @Nullable Bitmap icon, String swUrl, String scope, boolean useCache, String method);
 
     private static native void nativeAbortPaymentApp(
             WebContents webContents, long registrationId, PaymentInstrument.AbortCallback callback);
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/webapps/WebappActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/webapps/WebappActivity.java
index a7518086..2c85df5 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/webapps/WebappActivity.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/webapps/WebappActivity.java
@@ -251,6 +251,10 @@
     }
 
     protected void initializeUI(Bundle savedInstanceState) {
+        // Make display mode available before page load.
+        getActivityTab().getTabWebContentsDelegateAndroid().setDisplayMode(
+                mWebappInfo.displayMode());
+
         // We do not load URL when restoring from saved instance states.
         if (savedInstanceState == null) {
             getActivityTab().loadUrl(
@@ -260,8 +264,6 @@
         }
 
         getActivityTab().addObserver(createTabObserver());
-        getActivityTab().getTabWebContentsDelegateAndroid().setDisplayMode(
-                mWebappInfo.displayMode());
     }
 
     @Override
diff --git a/chrome/android/java_sources.gni b/chrome/android/java_sources.gni
index 09b7b9d..0e863823 100644
--- a/chrome/android/java_sources.gni
+++ b/chrome/android/java_sources.gni
@@ -85,6 +85,7 @@
   "java/src/org/chromium/chrome/browser/appmenu/AppMenuObserver.java",
   "java/src/org/chromium/chrome/browser/appmenu/AppMenuPropertiesDelegate.java",
   "java/src/org/chromium/chrome/browser/autofill/AutofillKeyboardAccessoryBridge.java",
+  "java/src/org/chromium/chrome/browser/autofill/AutofillKeyboardAccessory.java",
   "java/src/org/chromium/chrome/browser/autofill/AutofillLogger.java",
   "java/src/org/chromium/chrome/browser/autofill/AutofillPopupBridge.java",
   "java/src/org/chromium/chrome/browser/autofill/CardUnmaskBridge.java",
diff --git a/chrome/app/chrome_main_delegate.cc b/chrome/app/chrome_main_delegate.cc
index d8bfe5c..38c8864 100644
--- a/chrome/app/chrome_main_delegate.cc
+++ b/chrome/app/chrome_main_delegate.cc
@@ -686,7 +686,7 @@
   // order to allocate storage for a higher slot number. Since malloc is hooked,
   // this causes re-entrancy into the allocator shim, while the TLS object is
   // partially-initialized, which the TLS object is supposed to protect again.
-  profiling::InitTLSSlot();
+  heap_profiling::InitTLSSlot();
 
   return false;
 }
diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
index 0e8da5e..475def0c 100644
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc
@@ -2174,10 +2174,6 @@
      SINGLE_VALUE_TYPE(switches::kTrySupportedChannelLayouts)},
 #endif  // OS_WIN
 #if defined(OS_MACOSX)
-    {"app-info-dialog", flag_descriptions::kAppInfoDialogName,
-     flag_descriptions::kAppInfoDialogDescription, kOsMac,
-     ENABLE_DISABLE_VALUE_TYPE(switches::kEnableAppInfoDialogMac,
-                               switches::kDisableAppInfoDialogMac)},
     {"mac-v2-sandbox", flag_descriptions::kMacV2SandboxName,
      flag_descriptions::kMacV2SandboxDescription, kOsMac,
      FEATURE_VALUE_TYPE(features::kMacV2Sandbox)},
diff --git a/chrome/browser/android/payments/service_worker_payment_app_bridge.cc b/chrome/browser/android/payments/service_worker_payment_app_bridge.cc
index 63ae37d7..62c37eb 100644
--- a/chrome/browser/android/payments/service_worker_payment_app_bridge.cc
+++ b/chrome/browser/android/payments/service_worker_payment_app_bridge.cc
@@ -467,7 +467,7 @@
     const JavaParamRef<jstring>& jsw_js_url,
     const JavaParamRef<jstring>& jsw_scope,
     jboolean juse_cache,
-    const JavaParamRef<jobjectArray>& jmethod_names) {
+    const JavaParamRef<jstring>& jmethod) {
   content::WebContents* web_contents =
       content::WebContents::FromJavaWebContents(jweb_contents);
 
@@ -476,9 +476,6 @@
     icon_bitmap = gfx::CreateSkBitmapFromJavaBitmap(gfx::JavaBitmap(jicon));
   }
 
-  std::vector<std::string> enabled_methods;
-  base::android::AppendJavaStringArrayToStringVector(env, jmethod_names,
-                                                     &enabled_methods);
   content::PaymentAppProvider::GetInstance()->InstallAndInvokePaymentApp(
       web_contents,
       ConvertPaymentRequestEventDataFromJavaToNative(
@@ -486,7 +483,8 @@
           jmethod_data, jtotal, jmodifiers),
       ConvertJavaStringToUTF8(env, japp_name), icon_bitmap,
       ConvertJavaStringToUTF8(env, jsw_js_url),
-      ConvertJavaStringToUTF8(env, jsw_scope), juse_cache, enabled_methods,
+      ConvertJavaStringToUTF8(env, jsw_scope), juse_cache,
+      ConvertJavaStringToUTF8(env, jmethod),
       base::BindOnce(&OnPaymentAppInvoked,
                      ScopedJavaGlobalRef<jobject>(env, jweb_contents),
                      ScopedJavaGlobalRef<jobject>(env, jcallback)));
diff --git a/chrome/browser/android/tab_web_contents_delegate_android.cc b/chrome/browser/android/tab_web_contents_delegate_android.cc
index acd62999..a3b34ef 100644
--- a/chrome/browser/android/tab_web_contents_delegate_android.cc
+++ b/chrome/browser/android/tab_web_contents_delegate_android.cc
@@ -286,6 +286,14 @@
   return app_modal::JavaScriptDialogManager::GetInstance();
 }
 
+void TabWebContentsDelegateAndroid::AdjustPreviewsStateForNavigation(
+    content::WebContents* web_contents,
+    content::PreviewsState* previews_state) {
+  if (GetDisplayMode(web_contents) != blink::kWebDisplayModeBrowser) {
+    *previews_state = content::PREVIEWS_OFF;
+  }
+}
+
 void TabWebContentsDelegateAndroid::RequestMediaAccessPermission(
     content::WebContents* web_contents,
     const content::MediaStreamRequest& request,
diff --git a/chrome/browser/android/tab_web_contents_delegate_android.h b/chrome/browser/android/tab_web_contents_delegate_android.h
index ce1f5c95..0e47c46 100644
--- a/chrome/browser/android/tab_web_contents_delegate_android.h
+++ b/chrome/browser/android/tab_web_contents_delegate_android.h
@@ -56,6 +56,9 @@
                            const gfx::RectF& active_rect) override;
   content::JavaScriptDialogManager* GetJavaScriptDialogManager(
       content::WebContents* source) override;
+  void AdjustPreviewsStateForNavigation(
+      content::WebContents* web_contents,
+      content::PreviewsState* previews_state) override;
   void RequestMediaAccessPermission(
       content::WebContents* web_contents,
       const content::MediaStreamRequest& request,
diff --git a/chrome/browser/android/tab_web_contents_delegate_android_unittest.cc b/chrome/browser/android/tab_web_contents_delegate_android_unittest.cc
new file mode 100644
index 0000000..3b10d06
--- /dev/null
+++ b/chrome/browser/android/tab_web_contents_delegate_android_unittest.cc
@@ -0,0 +1,80 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/android/tab_web_contents_delegate_android.h"
+
+#include "base/android/jni_android.h"
+#include "components/previews/core/previews_experiments.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace {
+
+class TestTabWebContentsDelegateAndroid
+    : public android::TabWebContentsDelegateAndroid {
+ public:
+  explicit TestTabWebContentsDelegateAndroid(blink::WebDisplayMode display_mode)
+      : TabWebContentsDelegateAndroid(base::android::AttachCurrentThread(),
+                                      nullptr) {
+    display_mode_ = display_mode;
+  }
+
+  blink::WebDisplayMode GetDisplayMode(
+      const content::WebContents* web_contents) const override {
+    return display_mode_;
+  }
+
+ private:
+  blink::WebDisplayMode display_mode_ = blink::kWebDisplayModeBrowser;
+};
+
+}  // namespace
+
+namespace android {
+
+TEST(TabWebContentsDelegateAndroidTest,
+     AdjustPreviewsStateForNavigationAllowsPreviews) {
+  TestTabWebContentsDelegateAndroid browser_display_delegate(
+      blink::kWebDisplayModeBrowser);
+  content::PreviewsState noscript_previews_state = content::NOSCRIPT_ON;
+  browser_display_delegate.AdjustPreviewsStateForNavigation(
+      nullptr, &noscript_previews_state);
+  EXPECT_EQ(content::NOSCRIPT_ON, noscript_previews_state);
+  content::PreviewsState lofi_previews_state = content::CLIENT_LOFI_ON;
+  browser_display_delegate.AdjustPreviewsStateForNavigation(
+      nullptr, &lofi_previews_state);
+  EXPECT_EQ(content::CLIENT_LOFI_ON, lofi_previews_state);
+}
+
+TEST(TabWebContentsDelegateAndroidTest,
+     AdjustPreviewsStateForNavigationBlocksPreviews) {
+  TestTabWebContentsDelegateAndroid standalone_display_delegate(
+      blink::kWebDisplayModeStandalone);
+  content::PreviewsState noscript_previews_state = content::NOSCRIPT_ON;
+  standalone_display_delegate.AdjustPreviewsStateForNavigation(
+      nullptr, &noscript_previews_state);
+  EXPECT_EQ(content::PREVIEWS_OFF, noscript_previews_state);
+
+  TestTabWebContentsDelegateAndroid fullscreen_display_delegate(
+      blink::kWebDisplayModeFullscreen);
+  content::PreviewsState lofi_previews_state = content::CLIENT_LOFI_ON;
+  fullscreen_display_delegate.AdjustPreviewsStateForNavigation(
+      nullptr, &lofi_previews_state);
+  EXPECT_EQ(content::PREVIEWS_OFF, lofi_previews_state);
+
+  TestTabWebContentsDelegateAndroid minimal_ui_display_delegate(
+      blink::kWebDisplayModeMinimalUi);
+  content::PreviewsState litepage_previews_state = content::SERVER_LITE_PAGE_ON;
+  minimal_ui_display_delegate.AdjustPreviewsStateForNavigation(
+      nullptr, &litepage_previews_state);
+  EXPECT_EQ(content::PREVIEWS_OFF, litepage_previews_state);
+
+  TestTabWebContentsDelegateAndroid undefined_display_delegate(
+      blink::kWebDisplayModeUndefined);
+  content::PreviewsState server_lofi_previews_state = content::SERVER_LOFI_ON;
+  undefined_display_delegate.AdjustPreviewsStateForNavigation(
+      nullptr, &server_lofi_previews_state);
+  EXPECT_EQ(content::PREVIEWS_OFF, server_lofi_previews_state);
+}
+
+}  // namespace android
diff --git a/chrome/browser/apps/app_browsertest.cc b/chrome/browser/apps/app_browsertest.cc
index 0c9fae0..be1c30f9 100644
--- a/chrome/browser/apps/app_browsertest.cc
+++ b/chrome/browser/apps/app_browsertest.cc
@@ -1399,6 +1399,11 @@
                            "APP_WINDOW_CREATE_CALLBACK");
 }
 
+IN_PROC_BROWSER_TEST_F(PlatformAppBrowserTest, NewWindowWithNonExistingFile) {
+  ASSERT_TRUE(
+      RunPlatformAppTest("platform_apps/new_window_with_non_existing_file"));
+}
+
 IN_PROC_BROWSER_TEST_F(PlatformAppBrowserTest, SandboxedLocalFile) {
   ASSERT_TRUE(RunPlatformAppTest("platform_apps/sandboxed_local_file"));
 }
diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
index b461c92..c02dcda 100644
--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc
@@ -3320,7 +3320,7 @@
       l10n_util::GetStringUTF16(IDS_UTILITY_PROCESS_PRINTING_SERVICE_NAME);
 #endif
 
-  (*services)[profiling::mojom::kServiceName] =
+  (*services)[heap_profiling::mojom::kServiceName] =
       base::ASCIIToUTF16("Profiling Service");
 
 #if BUILDFLAG(ENABLE_EXTENSIONS)
diff --git a/chrome/browser/chrome_content_browser_manifest_overlay.json b/chrome/browser/chrome_content_browser_manifest_overlay.json
index d3e35e18..cd82cd63 100644
--- a/chrome/browser/chrome_content_browser_manifest_overlay.json
+++ b/chrome/browser/chrome_content_browser_manifest_overlay.json
@@ -21,7 +21,7 @@
         ],
         "ime:ime_driver": [],
         "profiling_client": [
-          "profiling::mojom::ProfilingClient"
+          "heap_profiling::mojom::ProfilingClient"
         ]
       },
       "requires": {
diff --git a/chrome/browser/chrome_content_gpu_manifest_overlay.json b/chrome/browser/chrome_content_gpu_manifest_overlay.json
index 23a56204..ad9a70f 100644
--- a/chrome/browser/chrome_content_gpu_manifest_overlay.json
+++ b/chrome/browser/chrome_content_gpu_manifest_overlay.json
@@ -10,7 +10,7 @@
           "arc::mojom::VideoEncodeAccelerator",
           "arc::mojom::VideoEncodeClient",
           "arc::mojom::VideoProtectedBufferAllocator",
-          "profiling::mojom::ProfilingClient"
+          "heap_profiling::mojom::ProfilingClient"
         ]
       }
     }
diff --git a/chrome/browser/chrome_content_renderer_manifest_overlay.json b/chrome/browser/chrome_content_renderer_manifest_overlay.json
index 64fa266..48265a3 100644
--- a/chrome/browser/chrome_content_renderer_manifest_overlay.json
+++ b/chrome/browser/chrome_content_renderer_manifest_overlay.json
@@ -6,7 +6,7 @@
       "provides": {
         "browser": [
           "chrome::mojom::SearchBouncer",
-          "profiling::mojom::ProfilingClient"
+          "heap_profiling::mojom::ProfilingClient"
         ]
       }
     },
diff --git a/chrome/browser/chrome_content_utility_manifest_overlay.json b/chrome/browser/chrome_content_utility_manifest_overlay.json
index c4d3d70..088f746 100644
--- a/chrome/browser/chrome_content_utility_manifest_overlay.json
+++ b/chrome/browser/chrome_content_utility_manifest_overlay.json
@@ -8,7 +8,7 @@
           "chrome::mojom::ProfileImport",
           "chrome::mojom::ShellHandler",
           "payments::mojom::PaymentManifestParser",
-          "profiling::mojom::ProfilingClient",
+          "heap_profiling::mojom::ProfilingClient",
           "proxy_resolver::mojom::ProxyResolverFactory",
           "safe_json::mojom::SafeJsonParser"
         ]
diff --git a/chrome/browser/client_hints/client_hints.cc b/chrome/browser/client_hints/client_hints.cc
index a15cf1a..77e0fb9 100644
--- a/chrome/browser/client_hints/client_hints.cc
+++ b/chrome/browser/client_hints/client_hints.cc
@@ -81,6 +81,10 @@
     content::BrowserContext* context,
     const GURL& url) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+  DCHECK_EQ(blink::kWebEffectiveConnectionTypeMappingCount,
+            net::EFFECTIVE_CONNECTION_TYPE_4G + 1u);
+  DCHECK_EQ(blink::kWebEffectiveConnectionTypeMappingCount,
+            net::EFFECTIVE_CONNECTION_TYPE_LAST);
 
   // Get the client hint headers.
   if (!url.is_valid())
diff --git a/chrome/browser/client_hints/client_hints_browsertest.cc b/chrome/browser/client_hints/client_hints_browsertest.cc
index 4660376..f0e9a46 100644
--- a/chrome/browser/client_hints/client_hints_browsertest.cc
+++ b/chrome/browser/client_hints/client_hints_browsertest.cc
@@ -31,6 +31,7 @@
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/test/embedded_test_server/http_request.h"
 #include "net/test/embedded_test_server/http_response.h"
+#include "third_party/WebKit/public/common/client_hints/client_hints.h"
 
 namespace {
 
@@ -57,14 +58,11 @@
       return false;
 
     request_count_seen_++;
-    if (params->url_request.headers.HasHeader("dpr")) {
-      client_hints_count_seen_++;
-    }
-    if (params->url_request.headers.HasHeader("device-memory")) {
-      client_hints_count_seen_++;
-    }
-    if (params->url_request.headers.HasHeader("viewport-width")) {
-      client_hints_count_seen_++;
+    for (size_t i = 0; i < blink::kClientHintsHeaderMappingCount; ++i) {
+      if (params->url_request.headers.HasHeader(
+              blink::kClientHintsHeaderMapping[i])) {
+        client_hints_count_seen_++;
+      }
     }
     return false;
   }
@@ -256,13 +254,7 @@
         request.GetURL().spec().find(".html") != std::string::npos;
 
     if (is_main_frame_navigation) {
-      // device-memory header is attached to the main frame request.
-      EXPECT_EQ(expect_client_hints_on_main_frame_,
-                base::ContainsKey(request.headers, "device-memory"));
-      EXPECT_EQ(expect_client_hints_on_main_frame_,
-                base::ContainsKey(request.headers, "dpr"));
-      EXPECT_EQ(expect_client_hints_on_main_frame_,
-                base::ContainsKey(request.headers, "viewport-width"));
+      VerifyClientHintsReceived(expect_client_hints_on_main_frame_, request);
       if (expect_client_hints_on_main_frame_) {
         double value = 0.0;
         EXPECT_TRUE(base::StringToDouble(
@@ -287,12 +279,7 @@
     }
 
     if (!is_main_frame_navigation) {
-      EXPECT_EQ(expect_client_hints_on_subresources_,
-                base::ContainsKey(request.headers, "device-memory"));
-      EXPECT_EQ(expect_client_hints_on_subresources_,
-                base::ContainsKey(request.headers, "dpr"));
-      EXPECT_EQ(expect_client_hints_on_subresources_,
-                base::ContainsKey(request.headers, "viewport-width"));
+      VerifyClientHintsReceived(expect_client_hints_on_subresources_, request);
 
       if (expect_client_hints_on_subresources_) {
         double value = 0.0;
@@ -328,14 +315,25 @@
       }
     }
 
-    if (base::ContainsKey(request.headers, "dpr"))
-      count_client_hints_headers_seen_++;
+    for (size_t i = 0; i < blink::kClientHintsHeaderMappingCount; ++i) {
+      if (base::ContainsKey(request.headers,
+                            blink::kClientHintsHeaderMapping[i])) {
+        count_client_hints_headers_seen_++;
+      }
+    }
+  }
 
-    if (base::ContainsKey(request.headers, "device-memory"))
-      count_client_hints_headers_seen_++;
-
-    if (base::ContainsKey(request.headers, "viewport-width"))
-      count_client_hints_headers_seen_++;
+  void VerifyClientHintsReceived(bool expect_client_hints,
+                                 const net::test_server::HttpRequest& request) {
+    for (size_t i = 0; i < blink::kClientHintsHeaderMappingCount; ++i) {
+      // Resource width client hint is only attached on image subresources.
+      if (std::string(blink::kClientHintsHeaderMapping[i]) == "width") {
+        continue;
+      }
+      EXPECT_EQ(expect_client_hints,
+                base::ContainsKey(request.headers,
+                                  blink::kClientHintsHeaderMapping[i]));
+    }
   }
 
   net::EmbeddedTestServer http_server_;
diff --git a/chrome/browser/component_updater/origin_trials_component_installer.cc b/chrome/browser/component_updater/origin_trials_component_installer.cc
index 40c7f6ea..73b8d43 100644
--- a/chrome/browser/component_updater/origin_trials_component_installer.cc
+++ b/chrome/browser/component_updater/origin_trials_component_installer.cc
@@ -49,10 +49,10 @@
     "origin-trials.disabled-tokens.signatures";
 
 // Extension id is llkgjffcdpffmhiakmfcdcblohccpfmo
-const uint8_t kSha256Hash[] = {0xbb, 0xa6, 0x95, 0x52, 0x3f, 0x55, 0xc7, 0x80,
-                               0xac, 0x52, 0x32, 0x1b, 0xe7, 0x22, 0xf5, 0xce,
-                               0x6a, 0xfd, 0x9c, 0x9e, 0xa9, 0x2a, 0x0b, 0x50,
-                               0x60, 0x2b, 0x7f, 0x6c, 0x64, 0x80, 0x09, 0x04};
+const uint8_t kOriginTrialSha2Hash[] = {
+    0xbb, 0xa6, 0x95, 0x52, 0x3f, 0x55, 0xc7, 0x80, 0xac, 0x52, 0x32,
+    0x1b, 0xe7, 0x22, 0xf5, 0xce, 0x6a, 0xfd, 0x9c, 0x9e, 0xa9, 0x2a,
+    0x0b, 0x50, 0x60, 0x2b, 0x7f, 0x6c, 0x64, 0x80, 0x09, 0x04};
 
 }  // namespace
 
@@ -127,7 +127,8 @@
     std::vector<uint8_t>* hash) const {
   if (!hash)
     return;
-  hash->assign(kSha256Hash, kSha256Hash + arraysize(kSha256Hash));
+  hash->assign(kOriginTrialSha2Hash,
+               kOriginTrialSha2Hash + arraysize(kOriginTrialSha2Hash));
 }
 
 std::string OriginTrialsComponentInstallerPolicy::GetName() const {
diff --git a/chrome/browser/component_updater/sw_reporter_installer_win.cc b/chrome/browser/component_updater/sw_reporter_installer_win.cc
index 7ffbb64e..0f83bd1 100644
--- a/chrome/browser/component_updater/sw_reporter_installer_win.cc
+++ b/chrome/browser/component_updater/sw_reporter_installer_win.cc
@@ -68,10 +68,10 @@
 // CRX hash. The extension id is: gkmgaooipdjhmangpemjhigmamcehddo. The hash was
 // generated in Python with something like this:
 // hashlib.sha256().update(open("<file>.crx").read()[16:16+294]).digest().
-const uint8_t kSha256Hash[] = {0x6a, 0xc6, 0x0e, 0xe8, 0xf3, 0x97, 0xc0, 0xd6,
-                               0xf4, 0xc9, 0x78, 0x6c, 0x0c, 0x24, 0x73, 0x3e,
-                               0x05, 0xa5, 0x62, 0x4b, 0x2e, 0xc7, 0xb7, 0x1c,
-                               0x5f, 0xea, 0xf0, 0x88, 0xf6, 0x97, 0x9b, 0xc7};
+const uint8_t kSwReporterSha2Hash[] = {
+    0x6a, 0xc6, 0x0e, 0xe8, 0xf3, 0x97, 0xc0, 0xd6, 0xf4, 0xc9, 0x78,
+    0x6c, 0x0c, 0x24, 0x73, 0x3e, 0x05, 0xa5, 0x62, 0x4b, 0x2e, 0xc7,
+    0xb7, 0x1c, 0x5f, 0xea, 0xf0, 0x88, 0xf6, 0x97, 0x9b, 0xc7};
 
 const base::FilePath::CharType kSwReporterExeName[] =
     FILE_PATH_LITERAL("software_reporter_tool.exe");
@@ -392,7 +392,8 @@
 
 void SwReporterInstallerPolicy::GetHash(std::vector<uint8_t>* hash) const {
   DCHECK(hash);
-  hash->assign(kSha256Hash, kSha256Hash + sizeof(kSha256Hash));
+  hash->assign(kSwReporterSha2Hash,
+               kSwReporterSha2Hash + sizeof(kSwReporterSha2Hash));
 }
 
 std::string SwReporterInstallerPolicy::GetName() const {
diff --git a/chrome/browser/extensions/api/management/chrome_management_api_delegate.cc b/chrome/browser/extensions/api/management/chrome_management_api_delegate.cc
index 8e1ad43..c1701da 100644
--- a/chrome/browser/extensions/api/management/chrome_management_api_delegate.cc
+++ b/chrome/browser/extensions/api/management/chrome_management_api_delegate.cc
@@ -94,20 +94,33 @@
     extension_uninstall_dialog_.reset(
         extensions::ExtensionUninstallDialog::Create(
             details.GetProfile(), details.GetNativeWindowForUI(), this));
-    extensions::UninstallSource source =
-        function->source_context_type() == extensions::Feature::WEBUI_CONTEXT
-            ? extensions::UNINSTALL_SOURCE_CHROME_EXTENSIONS_PAGE
-            : extensions::UNINSTALL_SOURCE_EXTENSION;
+    bool uninstall_from_webstore =
+        function->extension() &&
+        function->extension()->id() == extensions::kWebStoreAppId;
+    extensions::UninstallSource source;
+    extensions::UninstallReason reason;
+    if (uninstall_from_webstore) {
+      source = extensions::UNINSTALL_SOURCE_CHROME_WEBSTORE;
+      reason = extensions::UNINSTALL_REASON_CHROME_WEBSTORE;
+    } else if (function->source_context_type() ==
+               extensions::Feature::WEBUI_CONTEXT) {
+      source = extensions::UNINSTALL_SOURCE_CHROME_EXTENSIONS_PAGE;
+      // TODO: Update this to a new reason; it shouldn't be lumped in with
+      // other uninstalls if it's from the chrome://extensions page.
+      reason = extensions::UNINSTALL_REASON_MANAGEMENT_API;
+    } else {
+      source = extensions::UNINSTALL_SOURCE_EXTENSION;
+      reason = extensions::UNINSTALL_REASON_MANAGEMENT_API;
+    }
     if (show_programmatic_uninstall_ui) {
       extension_uninstall_dialog_->ConfirmUninstallByExtension(
-          target_extension, function->extension(),
-          extensions::UNINSTALL_REASON_MANAGEMENT_API, source);
+          target_extension, function->extension(), reason, source);
     } else {
-      extension_uninstall_dialog_->ConfirmUninstall(
-          target_extension, extensions::UNINSTALL_REASON_MANAGEMENT_API,
-          source);
+      extension_uninstall_dialog_->ConfirmUninstall(target_extension, reason,
+                                                    source);
     }
   }
+
   ~ManagementUninstallFunctionUninstallDialogDelegate() override {}
 
   // ExtensionUninstallDialog::Delegate implementation.
diff --git a/chrome/browser/extensions/api/management/management_api_unittest.cc b/chrome/browser/extensions/api/management/management_api_unittest.cc
index 4ffb76c..d6e125dc 100644
--- a/chrome/browser/extensions/api/management/management_api_unittest.cc
+++ b/chrome/browser/extensions/api/management/management_api_unittest.cc
@@ -1,4 +1,4 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
+/// Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -11,6 +11,7 @@
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/extensions/extension_service_test_base.h"
 #include "chrome/browser/extensions/extension_service_test_with_install.h"
+#include "chrome/browser/extensions/extension_uninstall_dialog.h"
 #include "chrome/browser/extensions/test_extension_system.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/test/base/test_browser_window.h"
@@ -224,6 +225,98 @@
   }
 }
 
+// Tests management.uninstall from Web Store
+TEST_F(ManagementApiUnitTest, ManagementWebStoreUninstall) {
+  scoped_refptr<const Extension> triggering_extension =
+      ExtensionBuilder("Test").SetID(extensions::kWebStoreAppId).Build();
+  scoped_refptr<const Extension> extension = ExtensionBuilder("Test").Build();
+  service()->AddExtension(extension.get());
+  std::string extension_id = extension->id();
+  base::ListValue uninstall_args;
+  uninstall_args.AppendString(extension->id());
+
+  {
+    ScopedTestDialogAutoConfirm auto_confirm(
+        ScopedTestDialogAutoConfirm::CANCEL);
+    ExtensionFunction::ScopedUserGestureForTests scoped_user_gesture;
+
+    scoped_refptr<UIThreadExtensionFunction> function(
+        new ManagementUninstallFunction());
+    function->set_extension(triggering_extension);
+    EXPECT_TRUE(registry()->enabled_extensions().Contains(extension_id));
+    EXPECT_FALSE(RunFunction(function, uninstall_args));
+    // Webstore does not suppress the dialog for uninstalling extensions.
+    EXPECT_TRUE(registry()->enabled_extensions().Contains(extension_id));
+    EXPECT_EQ(ErrorUtils::FormatErrorMessage(constants::kUninstallCanceledError,
+                                             extension_id),
+              function->GetError());
+  }
+
+  {
+    scoped_refptr<UIThreadExtensionFunction> function(
+        new ManagementUninstallFunction());
+    function->set_extension(triggering_extension);
+
+    bool did_show = false;
+    auto callback = base::BindRepeating(
+        [](bool* did_show, extensions::ExtensionUninstallDialog* dialog) {
+          EXPECT_EQ("Remove \"Test\"?", dialog->GetHeadingText());
+          *did_show = true;
+        },
+        &did_show);
+    extensions::ExtensionUninstallDialog::SetOnShownCallbackForTesting(
+        &callback);
+
+    ScopedTestDialogAutoConfirm auto_confirm(
+        ScopedTestDialogAutoConfirm::ACCEPT);
+    ExtensionFunction::ScopedUserGestureForTests scoped_user_gesture;
+    EXPECT_TRUE(RunFunction(function, uninstall_args)) << function->GetError();
+    // The extension should be uninstalled.
+    EXPECT_EQ(nullptr, registry()->GetInstalledExtension(extension_id));
+    EXPECT_TRUE(did_show);
+
+    // Reset the callback.
+    extensions::ExtensionUninstallDialog::SetOnShownCallbackForTesting(nullptr);
+  }
+}
+
+// Tests management.uninstall with programmatic uninstall.
+TEST_F(ManagementApiUnitTest, ManagementProgrammaticUninstall) {
+  scoped_refptr<const Extension> triggering_extension =
+      ExtensionBuilder("Triggering Extension").SetID("123").Build();
+  scoped_refptr<const Extension> extension = ExtensionBuilder("Test").Build();
+  service()->AddExtension(extension.get());
+  std::string extension_id = extension->id();
+  base::ListValue uninstall_args;
+  uninstall_args.AppendString(extension->id());
+  {
+    scoped_refptr<UIThreadExtensionFunction> function(
+        new ManagementUninstallFunction());
+    function->set_extension(triggering_extension);
+
+    bool did_show = false;
+    auto callback = base::BindRepeating(
+        [](bool* did_show, extensions::ExtensionUninstallDialog* dialog) {
+          EXPECT_EQ("\"Triggering Extension\" would like to remove \"Test\".",
+                    dialog->GetHeadingText());
+          *did_show = true;
+        },
+        &did_show);
+    extensions::ExtensionUninstallDialog::SetOnShownCallbackForTesting(
+        &callback);
+
+    ScopedTestDialogAutoConfirm auto_confirm(
+        ScopedTestDialogAutoConfirm::ACCEPT);
+    ExtensionFunction::ScopedUserGestureForTests scoped_user_gesture;
+    EXPECT_TRUE(RunFunction(function, uninstall_args)) << function->GetError();
+    // The extension should be uninstalled.
+    EXPECT_EQ(nullptr, registry()->GetInstalledExtension(extension_id));
+    EXPECT_TRUE(did_show);
+
+    // Reset the callback.
+    extensions::ExtensionUninstallDialog::SetOnShownCallbackForTesting(nullptr);
+  }
+}
 // Tests uninstalling a blacklisted extension via management.uninstall.
 TEST_F(ManagementApiUnitTest, ManagementUninstallBlacklisted) {
   scoped_refptr<const Extension> extension = ExtensionBuilder("Test").Build();
diff --git a/chrome/browser/extensions/api/web_request/web_request_apitest.cc b/chrome/browser/extensions/api/web_request/web_request_apitest.cc
index 8f3d556..1446ca5 100644
--- a/chrome/browser/extensions/api/web_request/web_request_apitest.cc
+++ b/chrome/browser/extensions/api/web_request/web_request_apitest.cc
@@ -45,9 +45,11 @@
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/render_widget_host.h"
+#include "content/public/browser/storage_partition.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/page_type.h"
 #include "content/public/test/browser_test_utils.h"
+#include "content/public/test/simple_url_loader_test_helper.h"
 #include "content/public/test/url_loader_interceptor.h"
 #include "extensions/browser/api/web_request/web_request_api.h"
 #include "extensions/browser/blocked_action_type.h"
@@ -72,6 +74,8 @@
 #include "net/url_request/url_request_filter.h"
 #include "net/url_request/url_request_interceptor.h"
 #include "services/network/public/cpp/features.h"
+#include "services/network/public/cpp/resource_request.h"
+#include "services/network/public/cpp/simple_url_loader.h"
 #include "third_party/WebKit/public/platform/WebInputEvent.h"
 
 #if defined(OS_CHROMEOS)
@@ -908,12 +912,11 @@
 }
 
 // Verify that requests to clientsX.google.com are protected properly.
-// First test requests from a standard renderer and a webui renderer.
-// Then test a request from the browser process.
+// First test requests from a standard renderer and then a request from the
+// browser process.
 IN_PROC_BROWSER_TEST_F(ExtensionWebRequestApiTest,
                        WebRequestClientsGoogleComProtection) {
   ASSERT_TRUE(embedded_test_server()->Start());
-  int port = embedded_test_server()->port();
 
   // Load an extension that registers a listener for webRequest events, and
   // wait until it's initialized.
@@ -923,96 +926,60 @@
   ASSERT_TRUE(extension) << message_;
   EXPECT_TRUE(listener.WaitUntilSatisfied());
 
-  // Perform requests to https://client1.google.com from renderer processes.
+  EXPECT_EQ(0, GetWebRequestCountFromBackgroundPage(extension, profile()));
 
-  struct TestCase {
-    const char* main_frame_url;
-    bool request_to_clients1_google_com_visible;
-  } testcases[] = {
-      {"http://www.example.com", true}, {"chrome://settings", false},
-  };
+  GURL main_frame_url =
+      embedded_test_server()->GetURL("www.example.com", "/simple.html");
+  NavigateParams params(browser(), main_frame_url, ui::PAGE_TRANSITION_TYPED);
+  ui_test_utils::NavigateToURL(&params);
 
-  // Expected number of requests to clients1.google.com observed so far.
-  int expected_requests_observed = 0;
-  EXPECT_EQ(expected_requests_observed,
-            GetWebRequestCountFromBackgroundPage(extension, profile()));
+  EXPECT_EQ(0, GetWebRequestCountFromBackgroundPage(extension, profile()));
 
-  for (const auto& testcase : testcases) {
-    SCOPED_TRACE(testcase.main_frame_url);
+  content::WebContents* web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  ASSERT_TRUE(web_contents);
 
-    GURL url;
-    if (base::StartsWith(testcase.main_frame_url, "chrome://",
-                         base::CompareCase::INSENSITIVE_ASCII)) {
-      url = GURL(testcase.main_frame_url);
-    } else {
-      url = GURL(base::StringPrintf("%s:%d/simple.html",
-                                    testcase.main_frame_url, port));
-    }
+  // Attempt to issue a request to clients1.google.com from the renderer. This
+  // will fail, but should still be visible to the WebRequest API.
+  const char kRequest[] = R"(
+      var xhr = new XMLHttpRequest();
+      xhr.open('GET', 'http://clients1.google.com');
+      xhr.onload = () => {window.domAutomationController.send(true);};
+      xhr.onerror = () => {window.domAutomationController.send(false);};
+      xhr.send();)";
+  bool success = false;
+  EXPECT_TRUE(ExecuteScriptAndExtractBool(web_contents->GetMainFrame(),
+                                          kRequest, &success));
+  // Requests always fail due to cross origin nature.
+  EXPECT_FALSE(success);
 
-    NavigateParams params(browser(), url, ui::PAGE_TRANSITION_TYPED);
-    ui_test_utils::NavigateToURL(&params);
+  EXPECT_EQ(1, GetWebRequestCountFromBackgroundPage(extension, profile()));
 
-    EXPECT_EQ(expected_requests_observed,
-              GetWebRequestCountFromBackgroundPage(extension, profile()));
+  // Now perform a request to client1.google.com from the browser process. This
+  // should *not* be visible to the WebRequest API.
 
-    content::WebContents* web_contents =
-        browser()->tab_strip_model()->GetActiveWebContents();
-    ASSERT_TRUE(web_contents);
+  auto request = std::make_unique<network::ResourceRequest>();
+  request->url =
+      embedded_test_server()->GetURL("clients1.google.com", "/simple.html");
 
-    const char kRequest[] =
-        "var xhr = new XMLHttpRequest();\n"
-        "xhr.open('GET', 'https://clients1.google.com');\n"
-        "xhr.onload = () => {window.domAutomationController.send(true);};\n"
-        "xhr.onerror = () => {window.domAutomationController.send(false);};\n"
-        "xhr.send();\n";
+  auto* url_loader_factory =
+      content::BrowserContext::GetDefaultStoragePartition(profile())
+          ->GetURLLoaderFactoryForBrowserProcess()
+          .get();
+  content::SimpleURLLoaderTestHelper loader_helper;
+  auto loader = network::SimpleURLLoader::Create(std::move(request),
+                                                 TRAFFIC_ANNOTATION_FOR_TESTS);
+  loader->DownloadToStringOfUnboundedSizeUntilCrashAndDie(
+      url_loader_factory, loader_helper.GetCallback());
 
-    bool success = false;
-    EXPECT_TRUE(ExecuteScriptAndExtractBool(web_contents->GetMainFrame(),
-                                            kRequest, &success));
-    // Requests always fail due to cross origin nature.
-    EXPECT_FALSE(success);
+  // Wait for the response to complete.
+  loader_helper.WaitForCallback();
+  EXPECT_TRUE(loader_helper.response_body());
+  EXPECT_EQ(200, loader->ResponseInfo()->headers->response_code());
 
-    if (testcase.request_to_clients1_google_com_visible)
-      ++expected_requests_observed;
-
-    EXPECT_EQ(expected_requests_observed,
-              GetWebRequestCountFromBackgroundPage(extension, profile()));
-  }
-
-  // Perform request to https://client1.google.com from browser process.
-
-  class TestURLFetcherDelegate : public net::URLFetcherDelegate {
-   public:
-    explicit TestURLFetcherDelegate(const base::Closure& quit_loop_func)
-        : quit_loop_func_(quit_loop_func) {}
-    ~TestURLFetcherDelegate() override {}
-
-    void OnURLFetchComplete(const net::URLFetcher* source) override {
-      EXPECT_EQ(net::HTTP_OK, source->GetResponseCode());
-      quit_loop_func_.Run();
-    }
-
-   private:
-    base::Closure quit_loop_func_;
-  };
-  base::RunLoop run_loop;
-  TestURLFetcherDelegate delegate(run_loop.QuitClosure());
-
-  net::URLFetcherImplFactory url_fetcher_impl_factory;
-  net::FakeURLFetcherFactory url_fetcher_factory(&url_fetcher_impl_factory);
-  url_fetcher_factory.SetFakeResponse(GURL("https://client1.google.com"),
-                                      "hello my friend", net::HTTP_OK,
-                                      net::URLRequestStatus::SUCCESS);
-  std::unique_ptr<net::URLFetcher> fetcher =
-      url_fetcher_factory.CreateURLFetcher(
-          1, GURL("https://client1.google.com"), net::URLFetcher::GET,
-          &delegate, TRAFFIC_ANNOTATION_FOR_TESTS);
-  fetcher->Start();
-  run_loop.Run();
-
-  // This request should not be observed by the extension.
-  EXPECT_EQ(expected_requests_observed,
-            GetWebRequestCountFromBackgroundPage(extension, profile()));
+  // We should still have only seen the single render-initiated request from the
+  // first half of the test.
+  EXPECT_EQ(1, GetWebRequestCountFromBackgroundPage(extension, profile()));
 }
 
 // Verify that requests for PAC scripts are protected properly.
diff --git a/chrome/browser/extensions/api/webrtc_logging_private/webrtc_logging_private_apitest.cc b/chrome/browser/extensions/api/webrtc_logging_private/webrtc_logging_private_apitest.cc
index c71299be..2b6e549 100644
--- a/chrome/browser/extensions/api/webrtc_logging_private/webrtc_logging_private_apitest.cc
+++ b/chrome/browser/extensions/api/webrtc_logging_private/webrtc_logging_private_apitest.cc
@@ -96,99 +96,200 @@
     parameters->AppendString(web_contents()->GetURL().GetOrigin().spec());
   }
 
+  // This function implicitly expects the function to succeed (test failure
+  // initiated otherwise).
+  // Returns whether the function that was run returned a value (NOT whether
+  // it had succeeded or failed).
+  // TODO(crbug.com/829419): Return success/failure of the executed function.
   bool RunFunction(UIThreadExtensionFunction* function,
-                   const base::ListValue& parameters,
-                   bool expect_results) {
+                   const base::ListValue& parameters) {
     std::unique_ptr<base::Value> result(utils::RunFunctionAndReturnSingleResult(
         function, ParamsToString(parameters), browser()));
-    if (expect_results) {
-      EXPECT_TRUE(result.get());
-      return result != nullptr;
-    }
-
-    EXPECT_FALSE(result.get());
-    return result == nullptr;
+    return (result != nullptr);
   }
 
-  template<typename Function>
-  bool RunFunction(const base::ListValue& parameters, bool expect_results) {
+  // This function implicitly expects the function to succeed (test failure
+  // initiated otherwise).
+  // Returns whether the function that was run returned a value (NOT whether
+  // it had succeeded or failed).
+  // TODO(crbug.com/829419): Return success/failure of the executed function.
+  template <typename Function>
+  bool RunFunction(const base::ListValue& parameters) {
     scoped_refptr<Function> function(CreateFunction<Function>());
-    return RunFunction(function.get(), parameters, expect_results);
+    return RunFunction(function.get(), parameters);
   }
 
-  template<typename Function>
-  bool RunNoArgsFunction(bool expect_results) {
+  // This function implicitly expects the function to succeed (test failure
+  // initiated otherwise).
+  // Returns whether the function that was run returned a value (NOT whether
+  // it had succeeded or failed).
+  // TODO(crbug.com/829419): Return success/failure of the executed function.
+  template <typename Function>
+  bool RunNoArgsFunction() {
     base::ListValue params;
     AppendTabIdAndUrl(&params);
     scoped_refptr<Function> function(CreateFunction<Function>());
-    return RunFunction(function.get(), params, expect_results);
+    return RunFunction(function.get(), params);
   }
 
+  // This function implicitly expects the function to succeed (test failure
+  // initiated otherwise).
+  // Returns whether the function that was run returned a value, or avoided
+  // returning a value, according to expectation.
+  // TODO(crbug.com/829419): Return success/failure of the executed function.
   bool StartLogging() {
-    return RunNoArgsFunction<WebrtcLoggingPrivateStartFunction>(false);
+    constexpr bool result_expected = false;
+    const bool result_returned =
+        RunNoArgsFunction<WebrtcLoggingPrivateStartFunction>();
+    return (result_expected == result_returned);
   }
 
+  // This function implicitly expects the function to succeed (test failure
+  // initiated otherwise).
+  // Returns whether the function that was run returned a value, or avoided
+  // returning a value, according to expectation.
+  // TODO(crbug.com/829419): Return success/failure of the executed function.
   bool StopLogging() {
-    return RunNoArgsFunction<WebrtcLoggingPrivateStopFunction>(false);
+    constexpr bool result_expected = false;
+    const bool result_returned =
+        RunNoArgsFunction<WebrtcLoggingPrivateStopFunction>();
+    return (result_expected == result_returned);
   }
 
+  // This function implicitly expects the function to succeed (test failure
+  // initiated otherwise).
+  // Returns whether the function that was run returned a value, or avoided
+  // returning a value, according to expectation.
+  // TODO(crbug.com/829419): Return success/failure of the executed function.
   bool DiscardLog() {
-    return RunNoArgsFunction<WebrtcLoggingPrivateDiscardFunction>(false);
+    constexpr bool result_expected = false;
+    const bool result_returned =
+        RunNoArgsFunction<WebrtcLoggingPrivateDiscardFunction>();
+    return (result_expected == result_returned);
   }
 
+  // This function implicitly expects the function to succeed (test failure
+  // initiated otherwise).
+  // Returns whether the function that was run returned a value, or avoided
+  // returning a value, according to expectation.
+  // TODO(crbug.com/829419): Return success/failure of the executed function.
   bool UploadLog() {
-    return RunNoArgsFunction<WebrtcLoggingPrivateUploadFunction>(true);
+    constexpr bool result_expected = true;
+    const bool result_returned =
+        RunNoArgsFunction<WebrtcLoggingPrivateUploadFunction>();
+    return (result_expected == result_returned);
   }
 
+  // This function implicitly expects the function to succeed (test failure
+  // initiated otherwise).
+  // Returns whether the function that was run returned a value, or avoided
+  // returning a value, according to expectation.
+  // TODO(crbug.com/829419): Return success/failure of the executed function.
   bool SetMetaData(const base::ListValue& data) {
-    return RunFunction<WebrtcLoggingPrivateSetMetaDataFunction>(data, false);
+    constexpr bool result_expected = false;
+    const bool result_returned =
+        RunFunction<WebrtcLoggingPrivateSetMetaDataFunction>(data);
+    return (result_expected == result_returned);
   }
 
+  // This function implicitly expects the function to succeed (test failure
+  // initiated otherwise).
+  // Returns whether the function that was run returned a value, or avoided
+  // returning a value, according to expectation.
+  // TODO(crbug.com/829419): Return success/failure of the executed function.
   bool StartRtpDump(bool incoming, bool outgoing) {
     base::ListValue params;
     AppendTabIdAndUrl(&params);
     params.AppendBoolean(incoming);
     params.AppendBoolean(outgoing);
-    return RunFunction<WebrtcLoggingPrivateStartRtpDumpFunction>(params, false);
+    constexpr bool result_expected = false;
+    const bool result_returned =
+        RunFunction<WebrtcLoggingPrivateStartRtpDumpFunction>(params);
+    return (result_expected == result_returned);
   }
 
+  // This function implicitly expects the function to succeed (test failure
+  // initiated otherwise).
+  // Returns whether the function that was run returned a value, or avoided
+  // returning a value, according to expectation.
+  // TODO(crbug.com/829419): Return success/failure of the executed function.
   bool StopRtpDump(bool incoming, bool outgoing) {
     base::ListValue params;
     AppendTabIdAndUrl(&params);
     params.AppendBoolean(incoming);
     params.AppendBoolean(outgoing);
-    return RunFunction<WebrtcLoggingPrivateStopRtpDumpFunction>(params, false);
+    constexpr bool result_expected = false;
+    const bool result_returned =
+        RunFunction<WebrtcLoggingPrivateStopRtpDumpFunction>(params);
+    return (result_expected == result_returned);
   }
 
+  // This function implicitly expects the function to succeed (test failure
+  // initiated otherwise).
+  // Returns whether the function that was run returned a value, or avoided
+  // returning a value, according to expectation.
+  // TODO(crbug.com/829419): Return success/failure of the executed function.
   bool StoreLog(const std::string& log_id) {
     base::ListValue params;
     AppendTabIdAndUrl(&params);
     params.AppendString(log_id);
-    return RunFunction<WebrtcLoggingPrivateStoreFunction>(params, false);
+    constexpr bool result_expected = false;
+    const bool result_returned =
+        RunFunction<WebrtcLoggingPrivateStoreFunction>(params);
+    return (result_expected == result_returned);
   }
 
+  // This function implicitly expects the function to succeed (test failure
+  // initiated otherwise).
+  // Returns whether the function that was run returned a value, or avoided
+  // returning a value, according to expectation.
+  // TODO(crbug.com/829419): Return success/failure of the executed function.
   bool UploadStoredLog(const std::string& log_id) {
     base::ListValue params;
     AppendTabIdAndUrl(&params);
     params.AppendString(log_id);
-    return RunFunction<WebrtcLoggingPrivateUploadStoredFunction>(params, true);
+    constexpr bool result_expected = true;
+    const bool result_returned =
+        RunFunction<WebrtcLoggingPrivateUploadStoredFunction>(params);
+    return (result_expected == result_returned);
   }
 
+  // This function implicitly expects the function to succeed (test failure
+  // initiated otherwise).
+  // Returns whether the function that was run returned a value, or avoided
+  // returning a value, according to expectation.
+  // TODO(crbug.com/829419): Return success/failure of the executed function.
   bool StartAudioDebugRecordings(int seconds) {
     base::ListValue params;
     AppendTabIdAndUrl(&params);
     params.AppendInteger(seconds);
-    return RunFunction<WebrtcLoggingPrivateStartAudioDebugRecordingsFunction>(
-        params, true);
+    constexpr bool result_expected = true;
+    const bool result_returned =
+        RunFunction<WebrtcLoggingPrivateStartAudioDebugRecordingsFunction>(
+            params);
+    return (result_expected == result_returned);
   }
 
+  // This function implicitly expects the function to succeed (test failure
+  // initiated otherwise).
+  // Returns whether the function that was run returned a value, or avoided
+  // returning a value, according to expectation.
+  // TODO(crbug.com/829419): Return success/failure of the executed function.
   bool StopAudioDebugRecordings() {
     base::ListValue params;
     AppendTabIdAndUrl(&params);
-    return RunFunction<WebrtcLoggingPrivateStopAudioDebugRecordingsFunction>(
-        params, true);
+    constexpr bool result_expected = true;
+    const bool result_returned =
+        RunFunction<WebrtcLoggingPrivateStopAudioDebugRecordingsFunction>(
+            params);
+    return (result_expected == result_returned);
   }
 
+  // This function implicitly expects the function to succeed (test failure
+  // initiated otherwise).
+  // Returns whether the function that was run returned a value, or avoided
+  // returning a value, according to expectation.
+  // TODO(crbug.com/829419): Return success/failure of the executed function.
   bool StartEventLogging(const std::string& peerConnectionId,
                          int maxLogSizeBytes,
                          const std::string& metadata) {
@@ -197,8 +298,10 @@
     params.AppendString(peerConnectionId);
     params.AppendInteger(maxLogSizeBytes);
     params.AppendString(metadata);
-    return RunFunction<WebrtcLoggingPrivateStartEventLoggingFunction>(params,
-                                                                      false);
+    constexpr bool result_expected = false;
+    const bool result_returned =
+        RunFunction<WebrtcLoggingPrivateStartEventLoggingFunction>(params);
+    return (result_expected == result_returned);
   }
 
  private:
@@ -464,6 +567,7 @@
   ASSERT_TRUE(StartAudioDebugRecordings(1));
 }
 
+// TODO(crbug.com/827191): Fix this test (see bug for details).
 IN_PROC_BROWSER_TEST_F(WebrtcLoggingPrivateApiTest,
                        StartEventLoggingForKnownPeerConnection) {
   auto* manager = content::WebRtcEventLogger::Get();
@@ -477,16 +581,15 @@
 
   constexpr int max_size_bytes = 1000;
   const std::string metadata = "metadata";
-  // TODO(eladalon): Remove the redundant expectation. https://crbug.com/814402
   EXPECT_TRUE(StartEventLogging(peer_connection_id, max_size_bytes, metadata));
 }
 
+// TODO(crbug.com/827191): Fix this test (see bug for details).
 IN_PROC_BROWSER_TEST_F(WebrtcLoggingPrivateApiTest,
                        StartEventLoggingForUnknownPeerConnection) {
   // Note that manager->PeerConnectionAdded() is not called.
   const std::string peer_connection_id = "id";
   constexpr int max_size_bytes = 1000;
   const std::string metadata = "metadata";
-  // TODO(eladalon): Remove the redundant expectation. https://crbug.com/814402
   EXPECT_TRUE(StartEventLogging(peer_connection_id, max_size_bytes, metadata));
 }
diff --git a/chrome/browser/extensions/extension_uninstall_dialog.cc b/chrome/browser/extensions/extension_uninstall_dialog.cc
index 5647349..1ccb799c 100644
--- a/chrome/browser/extensions/extension_uninstall_dialog.cc
+++ b/chrome/browser/extensions/extension_uninstall_dialog.cc
@@ -55,8 +55,14 @@
   return screen->GetPrimaryDisplay().device_scale_factor();
 }
 
+ExtensionUninstallDialog::OnWillShowCallback* g_on_will_show_callback = nullptr;
 }  // namespace
 
+void ExtensionUninstallDialog::SetOnShownCallbackForTesting(
+    ExtensionUninstallDialog::OnWillShowCallback* callback) {
+  g_on_will_show_callback = callback;
+}
+
 ExtensionUninstallDialog::ExtensionUninstallDialog(
     Profile* profile,
     gfx::NativeWindow parent,
@@ -109,7 +115,6 @@
   // Ignore initial update.
   if (!icon_ || dialog_shown_)
     return;
-
   DCHECK_EQ(icon, icon_.get());
 
   dialog_shown_ = true;
@@ -119,6 +124,9 @@
     return;
   }
 
+  if (g_on_will_show_callback != nullptr)
+    g_on_will_show_callback->Run(this);
+
   switch (ScopedTestDialogAutoConfirm::GetAutoConfirmValue()) {
     case ScopedTestDialogAutoConfirm::NONE:
       Show();
diff --git a/chrome/browser/extensions/extension_uninstall_dialog.h b/chrome/browser/extensions/extension_uninstall_dialog.h
index 292d74c8..71d4167e 100644
--- a/chrome/browser/extensions/extension_uninstall_dialog.h
+++ b/chrome/browser/extensions/extension_uninstall_dialog.h
@@ -28,6 +28,10 @@
       public ChromeAppIconDelegate,
       public ExtensionRegistryObserver {
  public:
+  // Implement this callback to handle checking for the dialog's header message.
+  using OnWillShowCallback =
+      base::RepeatingCallback<void(ExtensionUninstallDialog*)>;
+
   // The type of action the dialog took at close.
   // Do not reorder this enum, as it is used in UMA histograms.
   enum CloseAction {
@@ -91,6 +95,9 @@
   // Called when the dialog is closing to do any book-keeping.
   void OnDialogClosed(CloseAction action);
 
+  // Called from unit test to check callbacks in dialog.
+  static void SetOnShownCallbackForTesting(OnWillShowCallback* callback);
+
  protected:
   // Constructor used by the derived classes.
   ExtensionUninstallDialog(Profile* profile,
diff --git a/chrome/browser/flag_descriptions.cc b/chrome/browser/flag_descriptions.cc
index 491a88f0..356e2bc 100644
--- a/chrome/browser/flag_descriptions.cc
+++ b/chrome/browser/flag_descriptions.cc
@@ -2500,13 +2500,6 @@
 
 #if defined(OS_MACOSX)
 
-const char kAppInfoDialogName[] = "Toolkit-Views App Info Dialog.";
-const char kAppInfoDialogDescription[] =
-    "Makes the Toolkit-Views based App Info dialog accessible from "
-    "chrome://apps or chrome://extensions in place of the native extension "
-    "permissions dialog, or the details link (which is a link to the Web "
-    "Store).";
-
 const char kAppWindowCyclingName[] = "Custom Window Cycling for Chrome Apps.";
 const char kAppWindowCyclingDescription[] =
     "Changes the behavior of Cmd+` when a Chrome App becomes active. When "
diff --git a/chrome/browser/flag_descriptions.h b/chrome/browser/flag_descriptions.h
index 92459be..85336dd 100644
--- a/chrome/browser/flag_descriptions.h
+++ b/chrome/browser/flag_descriptions.h
@@ -1523,9 +1523,6 @@
 
 #if defined(OS_MACOSX)
 
-extern const char kAppInfoDialogName[];
-extern const char kAppInfoDialogDescription[];
-
 extern const char kAppWindowCyclingName[];
 extern const char kAppWindowCyclingDescription[];
 
diff --git a/chrome/browser/media/webrtc/webrtc_rtp_browsertest.cc b/chrome/browser/media/webrtc/webrtc_rtp_browsertest.cc
index 3433016..2cec7b6 100644
--- a/chrome/browser/media/webrtc/webrtc_rtp_browsertest.cc
+++ b/chrome/browser/media/webrtc/webrtc_rtp_browsertest.cc
@@ -397,37 +397,11 @@
                       left_tab_));
 }
 
-// This test is disabled to allow WebRTC change to roll in that adds support
-// for multiple/no streams for a given track in Unified Plan mode. Currently the
-// correct behavior is not tested when the stream switches, and since the WebRTC
-// change adds some (more) correct behavior for this in Plan B mode it breaks.
-// This test will be updated after the roll in to test that the original track
-// gets muted and the original stream is empty after the stream switches.
-// bug: https://bugs.chromium.org/p/webrtc/issues/detail?id=7933
-IN_PROC_BROWSER_TEST_F(WebRtcRtpBrowserTest, DISABLED_TrackSwitchingStream) {
+IN_PROC_BROWSER_TEST_F(WebRtcRtpBrowserTest, TrackSwitchingStream) {
   StartServerAndOpenTabs();
   EXPECT_EQ("ok", ExecuteJavascript("trackSwitchingStream()", left_tab_));
 }
 
-// This test is disabled to allow WebRTC change to roll in that adds support
-// for multiple/no streams for a given track in Unified Plan mode. This
-// test breaks with the update because the SDP is parsed differently to support
-// multiple a=msid lines and for Plan B mode only the first media stream ID is
-// used. Currently this doesn't test the desired behavior, because the SDP
-// parsing uses the last a=msid line, which ends up just testing the stream
-// switching (as tested above already). Once the update is rolled in we can
-// either:
-// A: Remove this test because it only can be done with SDP munging, and it is
-//    not supported with Plan B SDP semantics.
-// B: Test this case for Unified Plan, assuming SDP munging. In this case
-//    according to the w3 WebRTC spec we will not add the new stream.
-// bug: https://bugs.chromium.org/p/webrtc/issues/detail?id=7933
-IN_PROC_BROWSER_TEST_F(WebRtcRtpBrowserTest,
-                       DISABLED_TrackAddedToSecondStream) {
-  StartServerAndOpenTabs();
-  EXPECT_EQ("ok", ExecuteJavascript("trackAddedToSecondStream()", left_tab_));
-}
-
 IN_PROC_BROWSER_TEST_F(WebRtcRtpBrowserTest,
                        RTCRtpSenderReplaceTrackSendsNewVideoTrack) {
   StartServer();
diff --git a/chrome/browser/metrics/chrome_metrics_service_accessor.h b/chrome/browser/metrics/chrome_metrics_service_accessor.h
index d0c5c93..7be5706 100644
--- a/chrome/browser/metrics/chrome_metrics_service_accessor.h
+++ b/chrome/browser/metrics/chrome_metrics_service_accessor.h
@@ -56,7 +56,7 @@
 bool IsOmniboxEnabled(Profile* profile);
 }
 
-namespace profiling {
+namespace heap_profiling {
 class BackgroundProfilingTriggers;
 }
 
@@ -117,7 +117,7 @@
       const OnMetricsReportingCallbackType&);
   friend class options::BrowserOptionsHandler;
   friend bool prerender::IsOmniboxEnabled(Profile* profile);
-  friend class profiling::BackgroundProfilingTriggers;
+  friend class heap_profiling::BackgroundProfilingTriggers;
   friend class settings::MetricsReportingHandler;
   friend class speech::ChromeSpeechRecognitionManagerDelegate;
   friend class system_logs::ChromeInternalLogSource;
diff --git a/chrome/browser/picture_in_picture/picture_in_picture_window_controller.cc b/chrome/browser/picture_in_picture/picture_in_picture_window_controller.cc
index 6aa1aee..1dcc49f 100644
--- a/chrome/browser/picture_in_picture/picture_in_picture_window_controller.cc
+++ b/chrome/browser/picture_in_picture/picture_in_picture_window_controller.cc
@@ -41,7 +41,7 @@
 }
 
 void PictureInPictureWindowController::Close() {
-  if (window_->IsActive())
+  if (window_)
     window_->Close();
 
   surface_id_ = viz::SurfaceId();
diff --git a/chrome/browser/profiles/profile_manager.cc b/chrome/browser/profiles/profile_manager.cc
index 75b9e2e..7675240 100644
--- a/chrome/browser/profiles/profile_manager.cc
+++ b/chrome/browser/profiles/profile_manager.cc
@@ -56,7 +56,6 @@
 #include "chrome/browser/signin/signin_manager_factory.h"
 #include "chrome/browser/signin/signin_util.h"
 #include "chrome/browser/sync/profile_sync_service_factory.h"
-#include "chrome/browser/sync/user_event_service_factory.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_finder.h"
 #include "chrome/browser/ui/browser_list.h"
@@ -1335,21 +1334,6 @@
   // Generates notifications from the above, if experiment is enabled.
   ContentSuggestionsNotifierServiceFactory::GetForProfile(profile);
 #endif
-
-  // TODO(crbug.com/709094, crbug.com/761485): UserEventServiceFactory
-  // initializes asynchronously, but it needs to be ready to receive user
-  // events in order for ConsentAuditor to record consents when the user
-  // signs in, which means that it needs to be initialized early enough in
-  // the Profile lifetime.
-  //
-  // This early initialization can be removed once the linked bugs are fixed
-  // and UserEventService is able to initialize synchronously.
-  //
-  // Note also that this code is technically not necessary, as UserEventService
-  // already happens to be initialized early in practice through other
-  // components that use it, but ConsentAuditor should not depend on that.
-  if (!go_off_the_record)
-    browser_sync::UserEventServiceFactory::GetForProfile(profile);
 }
 
 void ProfileManager::DoFinalInitLogging(Profile* profile) {
diff --git a/chrome/browser/profiling_host/BUILD.gn b/chrome/browser/profiling_host/BUILD.gn
index 7b90c77..b515201 100644
--- a/chrome/browser/profiling_host/BUILD.gn
+++ b/chrome/browser/profiling_host/BUILD.gn
@@ -18,6 +18,7 @@
       "//base",
       "//base/allocator:buildflags",
       "//chrome/test:test_support_ui",
+      "//components/services/heap_profiling/public/cpp",
       "//testing/gmock",
       "//testing/gtest",
     ]
diff --git a/chrome/browser/profiling_host/background_profiling_triggers.cc b/chrome/browser/profiling_host/background_profiling_triggers.cc
index c88f9fbf..60f1a01f 100644
--- a/chrome/browser/profiling_host/background_profiling_triggers.cc
+++ b/chrome/browser/profiling_host/background_profiling_triggers.cc
@@ -15,7 +15,7 @@
 #include "content/public/common/process_type.h"
 #include "services/resource_coordinator/public/cpp/memory_instrumentation/memory_instrumentation.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 namespace {
 // Check memory usage every hour. Trigger slow report if needed.
@@ -177,4 +177,4 @@
   host_->RequestProcessReport("MEMLOG_BACKGROUND_TRIGGER");
 }
 
-}  // namespace profiling
+}  // namespace heap_profiling
diff --git a/chrome/browser/profiling_host/background_profiling_triggers.h b/chrome/browser/profiling_host/background_profiling_triggers.h
index da7213f..12eff538 100644
--- a/chrome/browser/profiling_host/background_profiling_triggers.h
+++ b/chrome/browser/profiling_host/background_profiling_triggers.h
@@ -11,7 +11,7 @@
 #include "base/timer/timer.h"
 #include "services/resource_coordinator/public/cpp/memory_instrumentation/global_memory_dump.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 class ProfilingProcessHost;
 
@@ -70,6 +70,6 @@
   DISALLOW_COPY_AND_ASSIGN(BackgroundProfilingTriggers);
 };
 
-}  // namespace profiling
+}  // namespace heap_profiling
 
 #endif  // CHROME_BROWSER_PROFILING_HOST_BACKGROUND_PROFILING_TRIGGERS_H_
diff --git a/chrome/browser/profiling_host/background_profiling_triggers_unittest.cc b/chrome/browser/profiling_host/background_profiling_triggers_unittest.cc
index fea457f..486505c 100644
--- a/chrome/browser/profiling_host/background_profiling_triggers_unittest.cc
+++ b/chrome/browser/profiling_host/background_profiling_triggers_unittest.cc
@@ -29,7 +29,7 @@
 using OSMemDumpPtr = memory_instrumentation::mojom::OSMemDumpPtr;
 using ProcessType = memory_instrumentation::mojom::ProcessType;
 
-namespace profiling {
+namespace heap_profiling {
 namespace {
 
 constexpr uint32_t kProcessMallocTriggerKb = 2 * 1024 * 1024;  // 2 Gig
@@ -270,4 +270,4 @@
   EXPECT_TRUE(triggers_.IsAllowedToUpload());
 }
 
-}  // namespace profiling
+}  // namespace heap_profiling
diff --git a/chrome/browser/profiling_host/chrome_browser_main_extra_parts_profiling.cc b/chrome/browser/profiling_host/chrome_browser_main_extra_parts_profiling.cc
index efd9216a..4cebdd0 100644
--- a/chrome/browser/profiling_host/chrome_browser_main_extra_parts_profiling.cc
+++ b/chrome/browser/profiling_host/chrome_browser_main_extra_parts_profiling.cc
@@ -7,6 +7,7 @@
 #include "base/command_line.h"
 #include "chrome/browser/profiling_host/profiling_process_host.h"
 #include "chrome/common/chrome_switches.h"
+#include "components/services/heap_profiling/public/cpp/settings.h"
 
 ChromeBrowserMainExtraPartsProfiling::ChromeBrowserMainExtraPartsProfiling() =
     default;
@@ -22,14 +23,12 @@
   // memlog and memory sanitizers are compatible and can run at the same time.
   (void)connection;  // Unused variable.
 #else
-  profiling::ProfilingProcessHost::Mode mode =
-      profiling::ProfilingProcessHost::GetModeForStartup();
-  if (mode != profiling::ProfilingProcessHost::Mode::kNone) {
-    profiling::ProfilingProcessHost::Start(
-        connection, mode,
-        profiling::ProfilingProcessHost::GetStackModeForStartup(),
-        profiling::ProfilingProcessHost::GetShouldSampleForStartup(),
-        profiling::ProfilingProcessHost::GetSamplingRateForStartup());
+  heap_profiling::Mode mode = heap_profiling::GetModeForStartup();
+  if (mode != heap_profiling::Mode::kNone) {
+    heap_profiling::ProfilingProcessHost::Start(
+        connection, mode, heap_profiling::GetStackModeForStartup(),
+        heap_profiling::GetShouldSampleForStartup(),
+        heap_profiling::GetSamplingRateForStartup());
   }
 #endif
 }
diff --git a/chrome/browser/profiling_host/memlog_browsertest.cc b/chrome/browser/profiling_host/memlog_browsertest.cc
index c1c5740..03070c89 100644
--- a/chrome/browser/profiling_host/memlog_browsertest.cc
+++ b/chrome/browser/profiling_host/memlog_browsertest.cc
@@ -16,6 +16,7 @@
 #include "chrome/common/chrome_switches.h"
 #include "chrome/test/base/in_process_browser_test.h"
 #include "chrome/test/base/ui_test_utils.h"
+#include "components/services/heap_profiling/public/cpp/settings.h"
 #include "components/services/heap_profiling/public/cpp/switches.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_process_host.h"
@@ -28,10 +29,10 @@
 // Some builds don't support memlog in which case the tests won't function.
 #if BUILDFLAG(USE_ALLOCATOR_SHIM)
 
-namespace profiling {
+namespace heap_profiling {
 
 struct TestParam {
-  ProfilingProcessHost::Mode mode;
+  Mode mode;
   mojom::StackMode stack_mode;
   bool start_profiling_with_command_line_flag;
   bool should_sample;
@@ -43,10 +44,10 @@
   void SetUpDefaultCommandLine(base::CommandLine* command_line) override {
     InProcessBrowserTest::SetUpDefaultCommandLine(command_line);
     if (GetParam().start_profiling_with_command_line_flag) {
-      if (GetParam().mode == ProfilingProcessHost::Mode::kAllRenderers) {
+      if (GetParam().mode == Mode::kAllRenderers) {
         command_line->AppendSwitchASCII(
             heap_profiling::kMemlog, heap_profiling::kMemlogModeAllRenderers);
-      } else if (GetParam().mode == ProfilingProcessHost::Mode::kAll) {
+      } else if (GetParam().mode == Mode::kAll) {
         command_line->AppendSwitchASCII(heap_profiling::kMemlog,
                                         heap_profiling::kMemlogModeAll);
       } else {
@@ -99,11 +100,11 @@
 
 std::vector<TestParam> GetParams() {
   std::vector<TestParam> params;
-  std::vector<ProfilingProcessHost::Mode> dynamic_start_modes;
-  dynamic_start_modes.push_back(ProfilingProcessHost::Mode::kNone);
-  dynamic_start_modes.push_back(ProfilingProcessHost::Mode::kMinimal);
-  dynamic_start_modes.push_back(ProfilingProcessHost::Mode::kBrowser);
-  dynamic_start_modes.push_back(ProfilingProcessHost::Mode::kGpu);
+  std::vector<Mode> dynamic_start_modes;
+  dynamic_start_modes.push_back(Mode::kNone);
+  dynamic_start_modes.push_back(Mode::kMinimal);
+  dynamic_start_modes.push_back(Mode::kBrowser);
+  dynamic_start_modes.push_back(Mode::kGpu);
 
   std::vector<mojom::StackMode> stack_modes;
   stack_modes.push_back(mojom::StackMode::MIXED);
@@ -121,9 +122,9 @@
   // Non-browser processes must be profiled with a command line flag, since
   // otherwise, profiling will start after the relevant processes have been
   // created, thus that process will be not be profiled.
-  std::vector<ProfilingProcessHost::Mode> command_line_start_modes;
-  command_line_start_modes.push_back(ProfilingProcessHost::Mode::kAll);
-  command_line_start_modes.push_back(ProfilingProcessHost::Mode::kAllRenderers);
+  std::vector<Mode> command_line_start_modes;
+  command_line_start_modes.push_back(Mode::kAll);
+  command_line_start_modes.push_back(Mode::kAllRenderers);
   for (const auto& mode : command_line_start_modes) {
     for (const auto& stack_mode : stack_modes) {
       params.push_back(
@@ -133,20 +134,18 @@
   }
 
   // Test sampling all allocations.
-  params.push_back({ProfilingProcessHost::Mode::kBrowser,
-                    mojom::StackMode::NATIVE_WITH_THREAD_NAMES,
+  params.push_back({Mode::kBrowser, mojom::StackMode::NATIVE_WITH_THREAD_NAMES,
                     false /* start_profiling_with_command_line_flag */,
                     true /* should_sample */, true /* sample_everything*/});
 
   // Test sampling some allocations.
-  params.push_back({ProfilingProcessHost::Mode::kBrowser,
-                    mojom::StackMode::PSEUDO,
+  params.push_back({Mode::kBrowser, mojom::StackMode::PSEUDO,
                     false /* start_profiling_with_command_line_flag */,
                     true /* should_sample */, false /* sample_everything*/});
 
   // Test thread names for native profiling.
-  params.push_back({ProfilingProcessHost::Mode::kBrowser,
-                    mojom::StackMode::NATIVE_WITH_THREAD_NAMES, false});
+  params.push_back(
+      {Mode::kBrowser, mojom::StackMode::NATIVE_WITH_THREAD_NAMES, false});
   return params;
 }
 
@@ -154,6 +153,6 @@
                         MemlogBrowserTest,
                         ::testing::ValuesIn(GetParams()));
 
-}  // namespace profiling
+}  // namespace heap_profiling
 
 #endif  // BUILDFLAG(USE_ALLOCATOR_SHIM)
diff --git a/chrome/browser/profiling_host/profiling_process_host.cc b/chrome/browser/profiling_host/profiling_process_host.cc
index de3fdef..bd42936 100644
--- a/chrome/browser/profiling_host/profiling_process_host.cc
+++ b/chrome/browser/profiling_host/profiling_process_host.cc
@@ -9,17 +9,12 @@
 #include <utility>
 #include <vector>
 
-#include "base/allocator/buildflags.h"
-#include "base/base_switches.h"
 #include "base/callback_helpers.h"
-#include "base/command_line.h"
 #include "base/files/file_util.h"
-#include "base/metrics/field_trial_params.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/numerics/safe_conversions.h"
 #include "base/process/process_iterator.h"
 #include "base/rand_util.h"
-#include "base/strings/string_number_conversions.h"
 #include "base/strings/stringprintf.h"
 #include "base/sys_info.h"
 #include "base/task_scheduler/post_task.h"
@@ -34,6 +29,7 @@
 #include "chrome/common/chrome_content_client.h"
 #include "chrome/common/chrome_switches.h"
 #include "components/services/heap_profiling/public/cpp/sender_pipe.h"
+#include "components/services/heap_profiling/public/cpp/settings.h"
 #include "components/services/heap_profiling/public/cpp/switches.h"
 #include "components/services/heap_profiling/public/mojom/constants.mojom.h"
 #include "components/version_info/version_info.h"
@@ -77,17 +73,7 @@
 
 }  // namespace
 
-namespace profiling {
-
-const base::Feature kOOPHeapProfilingFeature{"OOPHeapProfiling",
-                                             base::FEATURE_DISABLED_BY_DEFAULT};
-const char kOOPHeapProfilingFeatureMode[] = "mode";
-const char kOOPHeapProfilingFeatureStackMode[] = "stack-mode";
-const char kOOPHeapProfilingFeatureSampling[] = "sampling";
-const char kOOPHeapProfilingFeatureSamplingRate[] = "sampling-rate";
-
-const uint32_t kDefaultSamplingRate = 10000;
-const bool kDefaultShouldSample = false;
+namespace heap_profiling {
 
 bool ProfilingProcessHost::has_started_ = false;
 
@@ -244,9 +230,9 @@
 }
 
 void ProfilingProcessHost::AddClientToProfilingService(
-    profiling::mojom::ProfilingClientPtr client,
+    mojom::ProfilingClientPtr client,
     base::ProcessId pid,
-    profiling::mojom::ProcessType process_type) {
+    mojom::ProcessType process_type) {
   DCHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::IO));
 
   SenderPipe::PipePair pipes;
@@ -270,129 +256,6 @@
 }
 
 // static
-ProfilingProcessHost::Mode ProfilingProcessHost::GetModeForStartup() {
-  const base::CommandLine* cmdline = base::CommandLine::ForCurrentProcess();
-#if BUILDFLAG(USE_ALLOCATOR_SHIM)
-  if (cmdline->HasSwitch(heap_profiling::kMemlog) ||
-      base::FeatureList::IsEnabled(kOOPHeapProfilingFeature)) {
-    if (cmdline->HasSwitch(switches::kEnableHeapProfiling)) {
-      // PartitionAlloc doesn't support chained allocation hooks so we can't
-      // run both heap profilers at the same time.
-      LOG(ERROR) << "--" << switches::kEnableHeapProfiling
-                 << " specified with --" << heap_profiling::kMemlog
-                 << "which are not compatible. Memlog will be disabled.";
-      return Mode::kNone;
-    }
-
-    std::string mode;
-    // Respect the commandline switch above the field trial.
-    if (cmdline->HasSwitch(heap_profiling::kMemlog)) {
-      mode = cmdline->GetSwitchValueASCII(heap_profiling::kMemlog);
-    } else {
-      mode = base::GetFieldTrialParamValueByFeature(
-          kOOPHeapProfilingFeature, kOOPHeapProfilingFeatureMode);
-    }
-
-    return ConvertStringToMode(mode);
-  }
-  return Mode::kNone;
-#else
-  LOG_IF(ERROR, cmdline->HasSwitch(heap_profiling::kMemlog))
-      << "--" << heap_profiling::kMemlog
-      << " specified but it will have no effect because the use_allocator_shim "
-      << "is not available in this build.";
-  return Mode::kNone;
-#endif
-}
-
-// static
-ProfilingProcessHost::Mode ProfilingProcessHost::ConvertStringToMode(
-    const std::string& mode) {
-  if (mode == heap_profiling::kMemlogModeAll)
-    return Mode::kAll;
-  if (mode == heap_profiling::kMemlogModeAllRenderers)
-    return Mode::kAllRenderers;
-  if (mode == heap_profiling::kMemlogModeManual)
-    return Mode::kManual;
-  if (mode == heap_profiling::kMemlogModeMinimal)
-    return Mode::kMinimal;
-  if (mode == heap_profiling::kMemlogModeBrowser)
-    return Mode::kBrowser;
-  if (mode == heap_profiling::kMemlogModeGpu)
-    return Mode::kGpu;
-  if (mode == heap_profiling::kMemlogModeRendererSampling)
-    return Mode::kRendererSampling;
-  DLOG(ERROR) << "Unsupported value: \"" << mode << "\" passed to --"
-              << heap_profiling::kMemlog;
-  return Mode::kNone;
-}
-
-// static
-profiling::mojom::StackMode ProfilingProcessHost::GetStackModeForStartup() {
-  const base::CommandLine* cmdline = base::CommandLine::ForCurrentProcess();
-  std::string stack_mode;
-
-  // Respect the commandline switch above the field trial.
-  if (cmdline->HasSwitch(heap_profiling::kMemlogStackMode)) {
-    stack_mode = cmdline->GetSwitchValueASCII(heap_profiling::kMemlogStackMode);
-  } else {
-    stack_mode = base::GetFieldTrialParamValueByFeature(
-        kOOPHeapProfilingFeature, kOOPHeapProfilingFeatureStackMode);
-  }
-
-  return ConvertStringToStackMode(stack_mode);
-}
-
-// static
-mojom::StackMode ProfilingProcessHost::ConvertStringToStackMode(
-    const std::string& input) {
-  if (input == heap_profiling::kMemlogStackModeNative)
-    return profiling::mojom::StackMode::NATIVE_WITHOUT_THREAD_NAMES;
-  if (input == heap_profiling::kMemlogStackModeNativeWithThreadNames)
-    return profiling::mojom::StackMode::NATIVE_WITH_THREAD_NAMES;
-  if (input == heap_profiling::kMemlogStackModePseudo)
-    return profiling::mojom::StackMode::PSEUDO;
-  if (input == heap_profiling::kMemlogStackModeMixed)
-    return profiling::mojom::StackMode::MIXED;
-  DLOG(ERROR) << "Unsupported value: \"" << input << "\" passed to --"
-              << heap_profiling::kMemlogStackMode;
-  return profiling::mojom::StackMode::NATIVE_WITHOUT_THREAD_NAMES;
-}
-
-// static
-bool ProfilingProcessHost::GetShouldSampleForStartup() {
-  const base::CommandLine* cmdline = base::CommandLine::ForCurrentProcess();
-  if (cmdline->HasSwitch(heap_profiling::kMemlogSampling))
-    return true;
-
-  return base::GetFieldTrialParamByFeatureAsBool(
-      kOOPHeapProfilingFeature, kOOPHeapProfilingFeatureSampling,
-      kDefaultShouldSample /* default_value */);
-}
-
-// static
-uint32_t ProfilingProcessHost::GetSamplingRateForStartup() {
-  const base::CommandLine* cmdline = base::CommandLine::ForCurrentProcess();
-  if (cmdline->HasSwitch(heap_profiling::kMemlogSamplingRate)) {
-    std::string rate_as_string =
-        cmdline->GetSwitchValueASCII(heap_profiling::kMemlogSamplingRate);
-    int rate_as_int = 1;
-    if (!base::StringToInt(rate_as_string, &rate_as_int)) {
-      LOG(ERROR) << "Could not parse sampling rate: " << rate_as_string;
-    }
-    if (rate_as_int <= 0) {
-      LOG(ERROR) << "Invalid sampling rate: " << rate_as_string;
-      rate_as_int = 1;
-    }
-    return rate_as_int;
-  }
-
-  return base::GetFieldTrialParamByFeatureAsInt(
-      kOOPHeapProfilingFeature, kOOPHeapProfilingFeatureSamplingRate,
-      kDefaultSamplingRate /* default_value */);
-}
-
-// static
 ProfilingProcessHost* ProfilingProcessHost::Start(
     content::ServiceManagerConnection* connection,
     Mode mode,
@@ -428,7 +291,7 @@
 void ProfilingProcessHost::ConfigureBackgroundProfilingTriggers() {
   // Only enable automatic uploads when the Finch experiment is enabled.
   // Developers can still manually upload via chrome://memory-internals.
-  if (base::FeatureList::IsEnabled(kOOPHeapProfilingFeature))
+  if (IsBackgroundHeapProfilingEnabled())
     background_triggers_.StartTimer();
 }
 
@@ -589,7 +452,7 @@
   DCHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::UI));
 
   if (!has_started_) {
-    profiling::ProfilingProcessHost::Start(
+    ProfilingProcessHost::Start(
         content::ServiceManagerConnection::GetForProcess(), Mode::kManual,
         GetStackModeForStartup(), GetShouldSampleForStartup(),
         GetSamplingRateForStartup());
@@ -645,7 +508,7 @@
   if (pid == base::GetCurrentProcId()) {
     ProfilingClientBinder client(connector_.get());
     AddClientToProfilingService(client.take(), base::Process::Current().Pid(),
-                                profiling::mojom::ProcessType::BROWSER);
+                                mojom::ProcessType::BROWSER);
     return;
   }
 
@@ -685,18 +548,14 @@
 
   // Bind to the memlog service. This will start it if it hasn't started
   // already.
-  connector_->BindInterface(profiling::mojom::kServiceName,
-                            &profiling_service_);
+  connector_->BindInterface(mojom::kServiceName, &profiling_service_);
 
   // Set some state for heap dumps.
-  bool keep_small_allocations =
-      base::CommandLine::ForCurrentProcess()->HasSwitch(
-          heap_profiling::kMemlogKeepSmallAllocations);
-  SetKeepSmallAllocations(keep_small_allocations);
+  SetKeepSmallAllocations(ShouldKeepSmallAllocations());
 
   // Grab a HeapProfiler InterfacePtr and pass that to memory instrumentation.
   memory_instrumentation::mojom::HeapProfilerPtr heap_profiler;
-  connector_->BindInterface(profiling::mojom::kServiceName, &heap_profiler);
+  connector_->BindInterface(mojom::kServiceName, &heap_profiler);
 
   memory_instrumentation::mojom::CoordinatorPtr coordinator;
   connector_->BindInterface(resource_coordinator::mojom::kServiceName,
@@ -708,7 +567,7 @@
           content::ProcessType::PROCESS_TYPE_BROWSER)) {
     ProfilingClientBinder client(connector_.get());
     AddClientToProfilingService(client.take(), base::Process::Current().Pid(),
-                                profiling::mojom::ProcessType::BROWSER);
+                                mojom::ProcessType::BROWSER);
   }
 }
 
@@ -814,10 +673,10 @@
 void ProfilingProcessHost::StartProfilingNonRendererChild(
     const content::ChildProcessData& data) {
   DCHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::UI));
-  profiling::mojom::ProcessType process_type =
+  mojom::ProcessType process_type =
       (data.process_type == content::ProcessType::PROCESS_TYPE_GPU)
-          ? profiling::mojom::ProcessType::GPU
-          : profiling::mojom::ProcessType::OTHER;
+          ? mojom::ProcessType::GPU
+          : mojom::ProcessType::OTHER;
 
   content::BrowserThread::GetTaskRunnerForThread(content::BrowserThread::IO)
       ->PostTask(
@@ -831,7 +690,7 @@
 void ProfilingProcessHost::StartProfilingNonRendererChildOnIOThread(
     int child_process_id,
     base::ProcessId proc_id,
-    profiling::mojom::ProcessType process_type) {
+    mojom::ProcessType process_type) {
   DCHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::IO));
 
   content::BrowserChildProcessHost* host =
@@ -857,7 +716,7 @@
           base::BindOnce(&ProfilingProcessHost::AddClientToProfilingService,
                          base::Unretained(this), client.take(),
                          base::GetProcId(host->GetHandle()),
-                         profiling::mojom::ProcessType::RENDERER));
+                         mojom::ProcessType::RENDERER));
 }
 
 bool ProfilingProcessHost::TakingTraceForUpload() {
@@ -872,4 +731,4 @@
   return ret;
 }
 
-}  // namespace profiling
+}  // namespace heap_profiling
diff --git a/chrome/browser/profiling_host/profiling_process_host.h b/chrome/browser/profiling_host/profiling_process_host.h
index 8ebf8ae..51431b8 100644
--- a/chrome/browser/profiling_host/profiling_process_host.h
+++ b/chrome/browser/profiling_host/profiling_process_host.h
@@ -9,13 +9,11 @@
 #include <string>
 #include <vector>
 
-#include "base/feature_list.h"
 #include "base/macros.h"
 #include "base/memory/singleton.h"
 #include "base/process/process.h"
 #include "build/build_config.h"
 #include "chrome/browser/profiling_host/background_profiling_triggers.h"
-#include "chrome/common/chrome_features.h"
 #include "components/services/heap_profiling/public/cpp/client.h"
 #include "components/services/heap_profiling/public/mojom/heap_profiling_client.mojom.h"
 #include "components/services/heap_profiling/public/mojom/heap_profiling_service.mojom.h"
@@ -34,10 +32,9 @@
 class RenderProcessHost;
 }  // namespace content
 
-namespace profiling {
+namespace heap_profiling {
 
-extern const base::Feature kOOPHeapProfilingFeature;
-extern const char kOOPHeapProfilingFeatureMode[];
+enum class Mode;
 
 // Represents the browser side of the profiling process (//chrome/profiling).
 //
@@ -59,37 +56,6 @@
 class ProfilingProcessHost : public content::BrowserChildProcessObserver,
                              content::NotificationObserver {
  public:
-  // These values are persisted to logs. Entries should not be renumbered and
-  // numeric values should never be reused.
-  enum class Mode {
-    // No profiling enabled.
-    kNone = 0,
-
-    // Only profile the browser and GPU processes.
-    kMinimal = 1,
-
-    // Profile all processes.
-    kAll = 2,
-
-    // Profile only the browser process.
-    kBrowser = 3,
-
-    // Profile only the gpu process.
-    kGpu = 4,
-
-    // Profile a sampled number of renderer processes.
-    kRendererSampling = 5,
-
-    // Profile all renderer processes.
-    kAllRenderers = 6,
-
-    // By default, profile no processes. User may choose to start profiling for
-    // processes via chrome://memory-internals.
-    kManual = 7,
-
-    kCount
-  };
-
   // Returns the mode.
   Mode GetMode() {
     base::AutoLock l(mode_lock_);
@@ -97,13 +63,6 @@
   }
 
   // Returns the mode specified by the command line or via about://flags.
-  static Mode GetModeForStartup();
-  static Mode ConvertStringToMode(const std::string& input);
-  static mojom::StackMode GetStackModeForStartup();
-  static mojom::StackMode ConvertStringToStackMode(const std::string& input);
-
-  static bool GetShouldSampleForStartup();
-  static uint32_t GetSamplingRateForStartup();
 
   bool ShouldProfileNonRendererProcessType(int process_type);
 
@@ -209,9 +168,9 @@
   void DumpProcessFinishedUIThread();
 
   // Sends the end of the data pipe to the profiling service.
-  void AddClientToProfilingService(profiling::mojom::ProfilingClientPtr client,
+  void AddClientToProfilingService(mojom::ProfilingClientPtr client,
                                    base::ProcessId pid,
-                                   profiling::mojom::ProcessType process_type);
+                                   mojom::ProcessType process_type);
 
   void SaveTraceToFileOnBlockingThread(base::FilePath dest,
                                        std::string trace,
@@ -228,7 +187,7 @@
   void StartProfilingNonRendererChildOnIOThread(
       int child_process_id,
       base::ProcessId proc_id,
-      profiling::mojom::ProcessType process_type);
+      mojom::ProcessType process_type);
 
   void StartProfilingRenderer(content::RenderProcessHost* host);
 
@@ -258,7 +217,7 @@
 
   // The stack mode determines the type of information that is stored for each
   // stack.
-  profiling::mojom::StackMode stack_mode_;
+  mojom::StackMode stack_mode_;
 
   bool should_sample_ = false;
   uint32_t sampling_rate_ = 1;
@@ -292,6 +251,6 @@
   DISALLOW_COPY_AND_ASSIGN(ProfilingProcessHost);
 };
 
-}  // namespace profiling
+}  // namespace heap_profiling
 
 #endif  // CHROME_BROWSER_PROFILING_HOST_PROFILING_PROCESS_HOST_H_
diff --git a/chrome/browser/profiling_host/profiling_process_host_unittest.cc b/chrome/browser/profiling_host/profiling_process_host_unittest.cc
index 1345627..f3198e9 100644
--- a/chrome/browser/profiling_host/profiling_process_host_unittest.cc
+++ b/chrome/browser/profiling_host/profiling_process_host_unittest.cc
@@ -10,12 +10,13 @@
 #include "base/test/scoped_feature_list.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/test/base/testing_profile.h"
+#include "components/services/heap_profiling/public/cpp/settings.h"
 #include "components/services/heap_profiling/public/cpp/switches.h"
 #include "content/public/test/mock_render_process_host.h"
 #include "content/public/test/test_browser_thread_bundle.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 TEST(ProfilingProcessHost, ShouldProfileNewRenderer) {
   content::TestBrowserThreadBundle thread_bundle;
@@ -24,10 +25,10 @@
   TestingProfile testing_profile;
   content::MockRenderProcessHost rph(&testing_profile);
 
-  pph.SetMode(ProfilingProcessHost::Mode::kNone);
+  pph.SetMode(Mode::kNone);
   EXPECT_FALSE(pph.ShouldProfileNewRenderer(&rph));
 
-  pph.SetMode(ProfilingProcessHost::Mode::kAll);
+  pph.SetMode(Mode::kAll);
   EXPECT_TRUE(pph.ShouldProfileNewRenderer(&rph));
 
   Profile* incognito_profile = testing_profile.GetOffTheRecordProfile();
@@ -38,158 +39,134 @@
 #if BUILDFLAG(USE_ALLOCATOR_SHIM)
 
 TEST(ProfilingProcessHost, GetModeForStartup_Default) {
-  EXPECT_EQ(ProfilingProcessHost::Mode::kNone,
-            ProfilingProcessHost::GetModeForStartup());
+  EXPECT_EQ(Mode::kNone, GetModeForStartup());
 }
 
 TEST(ProfilingProcessHost, GetModeForStartup_Commandline) {
   {
     base::test::ScopedCommandLine scoped_command_line;
-    base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
-        heap_profiling::kMemlog, "");
-    EXPECT_EQ(ProfilingProcessHost::Mode::kNone,
-              ProfilingProcessHost::GetModeForStartup());
+    base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(kMemlog, "");
+    EXPECT_EQ(Mode::kNone, GetModeForStartup());
+  }
+
+  {
+    base::test::ScopedCommandLine scoped_command_line;
+    base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(kMemlog,
+                                                              "invalid");
+    EXPECT_EQ(Mode::kNone, GetModeForStartup());
+  }
+
+  {
+    base::test::ScopedCommandLine scoped_command_line;
+    base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(kMemlog,
+                                                              kMemlogModeAll);
+    EXPECT_EQ(Mode::kAll, GetModeForStartup());
   }
 
   {
     base::test::ScopedCommandLine scoped_command_line;
     base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
-        heap_profiling::kMemlog, "invalid");
-    EXPECT_EQ(ProfilingProcessHost::Mode::kNone,
-              ProfilingProcessHost::GetModeForStartup());
+        kMemlog, kMemlogModeBrowser);
+    EXPECT_EQ(Mode::kBrowser, GetModeForStartup());
   }
 
   {
     base::test::ScopedCommandLine scoped_command_line;
     base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
-        heap_profiling::kMemlog, heap_profiling::kMemlogModeAll);
-    EXPECT_EQ(ProfilingProcessHost::Mode::kAll,
-              ProfilingProcessHost::GetModeForStartup());
+        kMemlog, kMemlogModeMinimal);
+    EXPECT_EQ(Mode::kMinimal, GetModeForStartup());
+  }
+
+  {
+    base::test::ScopedCommandLine scoped_command_line;
+    base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(kMemlog,
+                                                              kMemlogModeGpu);
+    EXPECT_EQ(Mode::kGpu, GetModeForStartup());
   }
 
   {
     base::test::ScopedCommandLine scoped_command_line;
     base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
-        heap_profiling::kMemlog, heap_profiling::kMemlogModeBrowser);
-    EXPECT_EQ(ProfilingProcessHost::Mode::kBrowser,
-              ProfilingProcessHost::GetModeForStartup());
-  }
-
-  {
-    base::test::ScopedCommandLine scoped_command_line;
-    base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
-        heap_profiling::kMemlog, heap_profiling::kMemlogModeMinimal);
-    EXPECT_EQ(ProfilingProcessHost::Mode::kMinimal,
-              ProfilingProcessHost::GetModeForStartup());
-  }
-
-  {
-    base::test::ScopedCommandLine scoped_command_line;
-    base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
-        heap_profiling::kMemlog, heap_profiling::kMemlogModeGpu);
-    EXPECT_EQ(ProfilingProcessHost::Mode::kGpu,
-              ProfilingProcessHost::GetModeForStartup());
-  }
-
-  {
-    base::test::ScopedCommandLine scoped_command_line;
-    base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
-        heap_profiling::kMemlog, heap_profiling::kMemlogModeRendererSampling);
-    EXPECT_EQ(ProfilingProcessHost::Mode::kRendererSampling,
-              ProfilingProcessHost::GetModeForStartup());
+        kMemlog, kMemlogModeRendererSampling);
+    EXPECT_EQ(Mode::kRendererSampling, GetModeForStartup());
   }
 }
 
 TEST(ProfilingProcessHost, GetModeForStartup_Finch) {
-  EXPECT_EQ(ProfilingProcessHost::Mode::kNone,
-            ProfilingProcessHost::GetModeForStartup());
+  EXPECT_EQ(Mode::kNone, GetModeForStartup());
   std::map<std::string, std::string> parameters;
 
   {
     base::test::ScopedFeatureList scoped_feature_list;
-    parameters[profiling::kOOPHeapProfilingFeatureMode] = "";
+    parameters[kOOPHeapProfilingFeatureMode] = "";
     scoped_feature_list.InitAndEnableFeatureWithParameters(
-        profiling::kOOPHeapProfilingFeature, parameters);
+        kOOPHeapProfilingFeature, parameters);
 
-    EXPECT_EQ(ProfilingProcessHost::Mode::kNone,
-              ProfilingProcessHost::GetModeForStartup());
+    EXPECT_EQ(Mode::kNone, GetModeForStartup());
   }
 
   {
     base::test::ScopedFeatureList scoped_feature_list;
-    parameters[profiling::kOOPHeapProfilingFeatureMode] = "invalid";
+    parameters[kOOPHeapProfilingFeatureMode] = "invalid";
     scoped_feature_list.InitAndEnableFeatureWithParameters(
-        profiling::kOOPHeapProfilingFeature, parameters);
-    EXPECT_EQ(ProfilingProcessHost::Mode::kNone,
-              ProfilingProcessHost::GetModeForStartup());
+        kOOPHeapProfilingFeature, parameters);
+    EXPECT_EQ(Mode::kNone, GetModeForStartup());
   }
 
   {
     base::test::ScopedFeatureList scoped_feature_list;
-    parameters[profiling::kOOPHeapProfilingFeatureMode] =
-        heap_profiling::kMemlogModeAll;
+    parameters[kOOPHeapProfilingFeatureMode] = kMemlogModeAll;
     scoped_feature_list.InitAndEnableFeatureWithParameters(
-        profiling::kOOPHeapProfilingFeature, parameters);
-    EXPECT_EQ(ProfilingProcessHost::Mode::kAll,
-              ProfilingProcessHost::GetModeForStartup());
+        kOOPHeapProfilingFeature, parameters);
+    EXPECT_EQ(Mode::kAll, GetModeForStartup());
   }
 
   {
     base::test::ScopedFeatureList scoped_feature_list;
-    parameters[profiling::kOOPHeapProfilingFeatureMode] =
-        heap_profiling::kMemlogModeBrowser;
+    parameters[kOOPHeapProfilingFeatureMode] = kMemlogModeBrowser;
     scoped_feature_list.InitAndEnableFeatureWithParameters(
-        profiling::kOOPHeapProfilingFeature, parameters);
-    EXPECT_EQ(ProfilingProcessHost::Mode::kBrowser,
-              ProfilingProcessHost::GetModeForStartup());
+        kOOPHeapProfilingFeature, parameters);
+    EXPECT_EQ(Mode::kBrowser, GetModeForStartup());
   }
 
   {
     base::test::ScopedFeatureList scoped_feature_list;
-    parameters[profiling::kOOPHeapProfilingFeatureMode] =
-        heap_profiling::kMemlogModeMinimal;
+    parameters[kOOPHeapProfilingFeatureMode] = kMemlogModeMinimal;
     scoped_feature_list.InitAndEnableFeatureWithParameters(
-        profiling::kOOPHeapProfilingFeature, parameters);
-    EXPECT_EQ(ProfilingProcessHost::Mode::kMinimal,
-              ProfilingProcessHost::GetModeForStartup());
+        kOOPHeapProfilingFeature, parameters);
+    EXPECT_EQ(Mode::kMinimal, GetModeForStartup());
   }
 
   {
     base::test::ScopedFeatureList scoped_feature_list;
-    parameters[profiling::kOOPHeapProfilingFeatureMode] =
-        heap_profiling::kMemlogModeGpu;
+    parameters[kOOPHeapProfilingFeatureMode] = kMemlogModeGpu;
     scoped_feature_list.InitAndEnableFeatureWithParameters(
-        profiling::kOOPHeapProfilingFeature, parameters);
-    EXPECT_EQ(ProfilingProcessHost::Mode::kGpu,
-              ProfilingProcessHost::GetModeForStartup());
+        kOOPHeapProfilingFeature, parameters);
+    EXPECT_EQ(Mode::kGpu, GetModeForStartup());
   }
 
   {
     base::test::ScopedFeatureList scoped_feature_list;
-    parameters[profiling::kOOPHeapProfilingFeatureMode] =
-        heap_profiling::kMemlogModeRendererSampling;
+    parameters[kOOPHeapProfilingFeatureMode] = kMemlogModeRendererSampling;
     scoped_feature_list.InitAndEnableFeatureWithParameters(
-        profiling::kOOPHeapProfilingFeature, parameters);
-    EXPECT_EQ(ProfilingProcessHost::Mode::kRendererSampling,
-              ProfilingProcessHost::GetModeForStartup());
+        kOOPHeapProfilingFeature, parameters);
+    EXPECT_EQ(Mode::kRendererSampling, GetModeForStartup());
   }
 }
 
 // Ensure the commandline overrides any given field trial.
 TEST(ProfilingProcessHost, GetModeForStartup_CommandLinePrecedence) {
   base::test::ScopedCommandLine scoped_command_line;
-  base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
-      heap_profiling::kMemlog, heap_profiling::kMemlogModeAll);
+  base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(kMemlog,
+                                                            kMemlogModeAll);
 
   base::test::ScopedFeatureList scoped_feature_list;
   std::map<std::string, std::string> parameters;
-  parameters[profiling::kOOPHeapProfilingFeatureMode] =
-      heap_profiling::kMemlogModeMinimal;
+  parameters[kOOPHeapProfilingFeatureMode] = kMemlogModeMinimal;
   scoped_feature_list.InitAndEnableFeatureWithParameters(
-      profiling::kOOPHeapProfilingFeature, parameters);
+      kOOPHeapProfilingFeature, parameters);
 
-  EXPECT_EQ(ProfilingProcessHost::Mode::kAll,
-            ProfilingProcessHost::GetModeForStartup());
+  EXPECT_EQ(Mode::kAll, GetModeForStartup());
 }
 
 #else
@@ -197,24 +174,21 @@
 TEST(ProfilingProcessHost, GetModeForStartup_NoModeWithoutShim) {
   {
     base::test::ScopedCommandLine scoped_command_line;
-    base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
-        heap_profiling::kMemlog, heap_profiling::kMemlogModeAll);
-    EXPECT_EQ(ProfilingProcessHost::Mode::kNone,
-              ProfilingProcessHost::GetModeForStartup());
+    base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(kMemlog,
+                                                              kMemlogModeAll);
+    EXPECT_EQ(Mode::kNone, GetModeForStartup());
   }
 
   {
     base::test::ScopedFeatureList scoped_feature_list;
     std::map<std::string, std::string> parameters;
-    parameters[profiling::kOOPHeapProfilingFeatureMode] =
-        heap_profiling::kMemlogModeMinimal;
+    parameters[kOOPHeapProfilingFeatureMode] = kMemlogModeMinimal;
     scoped_feature_list.InitAndEnableFeatureWithParameters(
-        profiling::kOOPHeapProfilingFeature, parameters);
-    EXPECT_EQ(ProfilingProcessHost::Mode::kNone,
-              ProfilingProcessHost::GetModeForStartup());
+        kOOPHeapProfilingFeature, parameters);
+    EXPECT_EQ(Mode::kNone, GetModeForStartup());
   }
 }
 
 #endif
 
-}  // namespace profiling
+}  // namespace heap_profiling
diff --git a/chrome/browser/profiling_host/profiling_test_driver.cc b/chrome/browser/profiling_host/profiling_test_driver.cc
index 673c1ec..64262fd 100644
--- a/chrome/browser/profiling_host/profiling_test_driver.cc
+++ b/chrome/browser/profiling_host/profiling_test_driver.cc
@@ -18,12 +18,13 @@
 #include "base/values.h"
 #include "build/build_config.h"
 #include "components/services/heap_profiling/public/cpp/allocator_shim.h"
+#include "components/services/heap_profiling/public/cpp/settings.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/tracing_controller.h"
 #include "content/public/common/service_manager_connection.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 namespace {
 
@@ -538,7 +539,7 @@
       content::BrowserThread::CurrentlyOn(content::BrowserThread::UI);
 
   // The only thing to test for Mode::kNone is that profiling hasn't started.
-  if (options_.mode == ProfilingProcessHost::Mode::kNone) {
+  if (options_.mode == Mode::kNone) {
     if (ProfilingProcessHost::has_started()) {
       LOG(ERROR) << "Profiling should not have started";
       return false;
@@ -649,11 +650,11 @@
   if (ShouldProfileBrowser()) {
     if (running_on_ui_thread_) {
       run_loop.reset(new base::RunLoop);
-      profiling::SetOnInitAllocatorShimCallbackForTesting(
+      SetOnInitAllocatorShimCallbackForTesting(
           run_loop->QuitClosure(), base::ThreadTaskRunnerHandle::Get());
     } else {
       wait_for_profiling_to_start_ = true;
-      profiling::SetOnInitAllocatorShimCallbackForTesting(
+      SetOnInitAllocatorShimCallbackForTesting(
           base::Bind(&base::WaitableEvent::Signal,
                      base::Unretained(&wait_for_ui_thread_)),
           base::ThreadTaskRunnerHandle::Get());
@@ -736,7 +737,7 @@
                                         base::Unretained(&wait_for_ui_thread_));
   }
 
-  profiling::ProfilingProcessHost::GetInstance()->RequestTraceWithHeapDump(
+  ProfilingProcessHost::GetInstance()->RequestTraceWithHeapDump(
       base::Bind(&ProfilingTestDriver::TraceFinished, base::Unretained(this),
                  std::move(finish_tracing_closure)),
       false /* strip_path_from_mapped_files */);
@@ -756,9 +757,8 @@
   base::Value* heaps_v2 =
       FindArgDump(base::Process::Current().Pid(), dump_json, "heaps_v2");
 
-  if (options_.mode != ProfilingProcessHost::Mode::kAll &&
-      options_.mode != ProfilingProcessHost::Mode::kBrowser &&
-      options_.mode != ProfilingProcessHost::Mode::kMinimal) {
+  if (options_.mode != Mode::kAll && options_.mode != Mode::kBrowser &&
+      options_.mode != Mode::kMinimal) {
     if (heaps_v2) {
       LOG(ERROR) << "There should be no heap dump for the browser.";
       return false;
@@ -881,7 +881,7 @@
     }
   }
 
-  if (options_.mode == ProfilingProcessHost::Mode::kAllRenderers) {
+  if (options_.mode == Mode::kAllRenderers) {
     if (NumProcessesWithName(dump_json, "Renderer", nullptr) == 0) {
       LOG(ERROR) << "There should be at least 1 renderer dump";
       return false;
@@ -897,14 +897,12 @@
 }
 
 bool ProfilingTestDriver::ShouldProfileBrowser() {
-  return options_.mode == ProfilingProcessHost::Mode::kAll ||
-         options_.mode == ProfilingProcessHost::Mode::kBrowser ||
-         options_.mode == ProfilingProcessHost::Mode::kMinimal;
+  return options_.mode == Mode::kAll || options_.mode == Mode::kBrowser ||
+         options_.mode == Mode::kMinimal;
 }
 
 bool ProfilingTestDriver::ShouldProfileRenderer() {
-  return options_.mode == ProfilingProcessHost::Mode::kAll ||
-         options_.mode == ProfilingProcessHost::Mode::kAllRenderers;
+  return options_.mode == Mode::kAll || options_.mode == Mode::kAllRenderers;
 }
 
 bool ProfilingTestDriver::ShouldIncludeNativeThreadNames() {
@@ -938,8 +936,7 @@
           std::move(finished).Run();
         },
         &profiled_pids, run_loop.QuitClosure());
-    profiling::ProfilingProcessHost::GetInstance()->GetProfiledPids(
-        std::move(callback));
+    ProfilingProcessHost::GetInstance()->GetProfiledPids(std::move(callback));
     run_loop.Run();
 
     if (RenderersAreBeingProfiled(profiled_pids))
@@ -950,7 +947,7 @@
 void ProfilingTestDriver::
     WaitForProfilingToStartForAllRenderersUIThreadAndSignal() {
   DCHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::UI));
-  profiling::ProfilingProcessHost::GetInstance()->GetProfiledPids(
+  ProfilingProcessHost::GetInstance()->GetProfiledPids(
       base::BindOnce(&ProfilingTestDriver::
                          WaitForProfilingToStartForAllRenderersUIThreadCallback,
                      base::Unretained(this)));
@@ -966,4 +963,4 @@
   WaitForProfilingToStartForAllRenderersUIThreadAndSignal();
 }
 
-}  // namespace profiling
+}  // namespace heap_profiling
diff --git a/chrome/browser/profiling_host/profiling_test_driver.h b/chrome/browser/profiling_host/profiling_test_driver.h
index 2f3dcbb4..e4f03b1 100644
--- a/chrome/browser/profiling_host/profiling_test_driver.h
+++ b/chrome/browser/profiling_host/profiling_test_driver.h
@@ -17,7 +17,7 @@
 class Value;
 }  // namespace base
 
-namespace profiling {
+namespace heap_profiling {
 
 // This class runs tests for the profiling service, a cross-platform,
 // multi-process component. Chrome on Android does not support browser_tests. It
@@ -41,10 +41,10 @@
  public:
   struct Options {
     // The profiling mode to test.
-    ProfilingProcessHost::Mode mode;
+    Mode mode;
 
     // The stack profiling mode to test.
-    profiling::mojom::StackMode stack_mode;
+    mojom::StackMode stack_mode;
 
     // Whether the caller has already started profiling with the given mode.
     // When false, the test driver is responsible for starting profiling.
@@ -143,6 +143,6 @@
   DISALLOW_COPY_AND_ASSIGN(ProfilingTestDriver);
 };
 
-}  // namespace profiling
+}  // namespace heap_profiling
 
 #endif  // CHROME_BROWSER_PROFILING_HOST_PROFILING_TEST_DRIVER_H_
diff --git a/chrome/browser/profiling_host/test_android_shim.cc b/chrome/browser/profiling_host/test_android_shim.cc
index 19bd366..b975f39 100644
--- a/chrome/browser/profiling_host/test_android_shim.cc
+++ b/chrome/browser/profiling_host/test_android_shim.cc
@@ -7,6 +7,7 @@
 #include "base/android/jni_string.h"
 #include "chrome/browser/profiling_host/profiling_process_host.h"
 #include "chrome/browser/profiling_host/profiling_test_driver.h"
+#include "components/services/heap_profiling/public/cpp/settings.h"
 #include "jni/TestAndroidShim_jni.h"
 
 using base::android::JavaParamRef;
@@ -34,13 +35,12 @@
     const base::android::JavaParamRef<jstring>& stack_mode,
     jboolean should_sample,
     jboolean sample_everything) {
-  profiling::ProfilingTestDriver driver;
-  profiling::ProfilingTestDriver::Options options;
-  options.mode = profiling::ProfilingProcessHost::ConvertStringToMode(
+  heap_profiling::ProfilingTestDriver driver;
+  heap_profiling::ProfilingTestDriver::Options options;
+  options.mode = heap_profiling::ConvertStringToMode(
       base::android::ConvertJavaStringToUTF8(mode));
-  options.stack_mode =
-      profiling::ProfilingProcessHost::ConvertStringToStackMode(
-          base::android::ConvertJavaStringToUTF8(stack_mode));
+  options.stack_mode = heap_profiling::ConvertStringToStackMode(
+      base::android::ConvertJavaStringToUTF8(stack_mode));
   options.profiling_already_started = !dynamically_start_profiling;
   options.should_sample = should_sample;
   options.sample_everything = sample_everything;
diff --git a/chrome/browser/resources/settings/basic_page/basic_page.js b/chrome/browser/resources/settings/basic_page/basic_page.js
index 9e1869e..0278e40 100644
--- a/chrome/browser/resources/settings/basic_page/basic_page.js
+++ b/chrome/browser/resources/settings/basic_page/basic_page.js
@@ -170,34 +170,15 @@
    * sections.
    * @param {string} query The text to search for.
    * @return {!Promise<!settings.SearchResult>} A signal indicating that
-   *     searching finished.
+   * searching finished.
    */
   searchContents: function(query) {
-    const whenSearchDone = [
-      settings.getSearchManager().search(query, assert(this.$$('#basicPage'))),
-    ];
+    const nodes = [assert(this.$$('#basicPage'))];
+    if (this.pageVisibility.advancedSettings !== false)
+      nodes.push(this.$$('#advancedPageTemplate').get());
 
-    if (this.pageVisibility.advancedSettings !== false) {
-      whenSearchDone.push(
-          this.$$('#advancedPageTemplate').get().then(function(advancedPage) {
-            return settings.getSearchManager().search(query, advancedPage);
-          }));
-    }
-
-    return Promise.all(whenSearchDone).then(function(requests) {
-      // Combine the SearchRequests results to a single SearchResult object.
-      return {
-        canceled: requests.some(function(r) {
-          return r.canceled;
-        }),
-        didFindMatches: requests.some(function(r) {
-          return r.didFindMatches();
-        }),
-        // All requests correspond to the same user query, so only need to check
-        // one of them.
-        wasClearSearch: requests[0].isSame(''),
-      };
-    });
+    return Promise.all(nodes).then(
+        nodes => settings.getSearchManager().search(query, nodes));
   },
 
   // <if expr="chromeos">
diff --git a/chrome/browser/resources/settings/downloads_page/downloads_page.html b/chrome/browser/resources/settings/downloads_page/downloads_page.html
index 089b55a..6e293c5 100644
--- a/chrome/browser/resources/settings/downloads_page/downloads_page.html
+++ b/chrome/browser/resources/settings/downloads_page/downloads_page.html
@@ -24,7 +24,7 @@
     <div class="settings-box first two-line">
       <div class="start">
         <div>$i18n{downloadLocation}</div>
-        <div class="secondary" no-search>
+        <div class="secondary">
 <if expr="not chromeos">
           [[prefs.download.default_directory.value]]
 </if>
diff --git a/chrome/browser/resources/settings/search_settings.js b/chrome/browser/resources/settings/search_settings.js
index 71971fa..6fd23591 100644
--- a/chrome/browser/resources/settings/search_settings.js
+++ b/chrome/browser/resources/settings/search_settings.js
@@ -11,6 +11,7 @@
  * @typedef {{
  *   canceled: Boolean,
  *   didFindMatches: Boolean,
+ *   rawQuery: string,
  *   wasClearSearch: Boolean,
  * }}
  */
@@ -49,12 +50,14 @@
    * children's Shadow DOM) and replaces the highlights (yellow rectangle and
    * search bubbles) with the original text node.
    * TODO(dpapad): Consider making this a private method of TopLevelSearchTask.
-   * @param {!Node} node
+   * @param {!Array<!Node>} nodes
    * @private
    */
-  function findAndRemoveHighlights_(node) {
-    cr.search_highlight_utils.findAndRemoveHighlights(node);
-    cr.search_highlight_utils.findAndRemoveBubbles(node);
+  function findAndRemoveHighlights_(nodes) {
+    nodes.forEach(node => {
+      cr.search_highlight_utils.findAndRemoveHighlights(node);
+      cr.search_highlight_utils.findAndRemoveBubbles(node);
+    });
   }
 
   /**
@@ -64,33 +67,36 @@
    * occurred under their subtree.
    *
    * @param {!settings.SearchRequest} request
-   * @param {!Node} root The root of the sub-tree to be searched
+   * @param {!Array<!Node>} roots The roots of the sub-trees to be searched.
+   * @param {!function(!Node): void} addTextObserver
    * @private
    */
-  function findAndHighlightMatches_(request, root) {
+  function findAndHighlightMatches_(request, roots, addTextObserver) {
     let foundMatches = false;
     function doSearch(node) {
       if (node.nodeName == 'TEMPLATE' && node.hasAttribute('route-path') &&
           !node.if && !node.hasAttribute(SKIP_SEARCH_CSS_ATTRIBUTE)) {
-        request.queue_.addRenderTask(new RenderTask(request, node));
-        return;
+        request.queue_.addRenderTask(
+            new RenderTask(request, node, addTextObserver));
+        return false;
       }
 
       if (IGNORED_ELEMENTS.has(node.nodeName))
-        return;
+        return false;
 
       if (node instanceof HTMLElement) {
         const element = /** @type {HTMLElement} */ (node);
         if (element.hasAttribute(SKIP_SEARCH_CSS_ATTRIBUTE) ||
             element.hasAttribute('hidden') || element.style.display == 'none') {
-          return;
+          return false;
         }
       }
 
       if (node.nodeType == Node.TEXT_NODE) {
+        addTextObserver(node);
         const textContent = node.nodeValue.trim();
         if (textContent.length == 0)
-          return;
+          return false;
 
         if (request.regExp.test(textContent)) {
           foundMatches = true;
@@ -106,24 +112,23 @@
           }
         }
         // Returning early since TEXT_NODE nodes never have children.
-        return;
+        return false;
       }
 
-      let child = node.firstChild;
-      while (child !== null) {
-        // Getting a reference to the |nextSibling| before calling doSearch()
-        // because |child| could be removed from the DOM within doSearch().
-        const nextSibling = child.nextSibling;
-        doSearch(child);
-        child = nextSibling;
-      }
-
-      const shadowRoot = node.shadowRoot;
-      if (shadowRoot)
-        doSearch(shadowRoot);
+      return true;
     }
 
-    doSearch(root);
+    const nodes = Array.from(roots);
+    while (nodes.length > 0) {
+      const node = nodes.pop();
+      const continueSearchChildren = doSearch(node);
+      if (continueSearchChildren) {
+        nodes.push(...node.childNodes);
+        if (node.shadowRoot)
+          nodes.push(node.shadowRoot);
+      }
+    }
+
     return foundMatches;
   }
 
@@ -164,14 +169,18 @@
   class Task {
     /**
      * @param {!settings.SearchRequest} request
-     * @param {!Node} node
+     * @param {!Array<!Node>} nodes
+     * @param {!function(!Node): void} addTextObserver
      */
-    constructor(request, node) {
+    constructor(request, nodes, addTextObserver) {
       /** @protected {!settings.SearchRequest} */
       this.request = request;
 
-      /** @protected {!Node} */
-      this.node = node;
+      /** @protected {!Array<!Node>} */
+      this.nodes = nodes;
+
+      /** @protected {!function(!Node): void} */
+      this.addTextObserver = addTextObserver;
     }
 
     /**
@@ -190,29 +199,32 @@
      *
      * @param {!settings.SearchRequest} request
      * @param {!Node} node
+     * @param {!function(!Node): void} addTextObserver
      */
-    constructor(request, node) {
-      super(request, node);
+    constructor(request, node, addTextObserver) {
+      super(request, [node], addTextObserver);
     }
 
     /** @override */
     exec() {
-      const routePath = this.node.getAttribute('route-path');
+      const node = this.nodes[0];
+      const routePath = node.getAttribute('route-path');
       const subpageTemplate =
-          this.node['_content'].querySelector('settings-subpage');
+          node['_content'].querySelector('settings-subpage');
       subpageTemplate.setAttribute('route-path', routePath);
-      assert(!this.node.if);
-      this.node.if = true;
+      assert(!node.if);
+      node.if = true;
 
       return new Promise((resolve, reject) => {
-        const parent = this.node.parentNode;
+        const parent = node.parentNode;
         parent.async(() => {
           const renderedNode =
               parent.querySelector('[route-path="' + routePath + '"]');
           // Register a SearchAndHighlightTask for the part of the DOM that was
           // just rendered.
           this.request.queue_.addSearchAndHighlightTask(
-              new SearchAndHighlightTask(this.request, assert(renderedNode)));
+              new SearchAndHighlightTask(
+                  this.request, assert(renderedNode), this.addTextObserver));
           resolve();
         });
       });
@@ -223,14 +235,16 @@
     /**
      * @param {!settings.SearchRequest} request
      * @param {!Node} node
+     * @param {!function(!Node): void} addTextObserver
      */
-    constructor(request, node) {
-      super(request, node);
+    constructor(request, node, addTextObserver) {
+      super(request, [node], addTextObserver);
     }
 
     /** @override */
     exec() {
-      const foundMatches = findAndHighlightMatches_(this.request, this.node);
+      const foundMatches = findAndHighlightMatches_(
+          this.request, this.nodes, this.addTextObserver);
       this.request.updateMatches(foundMatches);
       return Promise.resolve();
     }
@@ -239,20 +253,21 @@
   class TopLevelSearchTask extends Task {
     /**
      * @param {!settings.SearchRequest} request
-     * @param {!Node} page
+     * @param {!Array<!Node>} pages
      */
-    constructor(request, page) {
-      super(request, page);
+    constructor(request, pages, addTextObserver) {
+      super(request, pages, addTextObserver);
     }
 
     /** @override */
     exec() {
-      findAndRemoveHighlights_(this.node);
+      findAndRemoveHighlights_(this.nodes);
 
       const shouldSearch = this.request.regExp !== null;
       this.setSectionsVisibility_(!shouldSearch);
       if (shouldSearch) {
-        const foundMatches = findAndHighlightMatches_(this.request, this.node);
+        const foundMatches = findAndHighlightMatches_(
+            this.request, this.nodes, this.addTextObserver);
         this.request.updateMatches(foundMatches);
       }
 
@@ -264,10 +279,11 @@
      * @private
      */
     setSectionsVisibility_(visible) {
-      const sections = this.node.querySelectorAll('settings-section');
-
-      for (let i = 0; i < sections.length; i++)
-        sections[i].hiddenBySearch = !visible;
+      this.nodes.forEach(node => {
+        const sections = node.querySelectorAll('settings-section');
+        for (let i = 0; i < sections.length; i++)
+          sections[i].hiddenBySearch = !visible;
+      });
     }
   }
 
@@ -367,14 +383,15 @@
   class SearchRequest {
     /**
      * @param {string} rawQuery
-     * @param {!HTMLElement} root
+     * @param {!Array<!HTMLElement>} roots
+     * @param {!function(!Node): void} addTextObserver
      */
-    constructor(rawQuery, root) {
+    constructor(rawQuery, roots, addTextObserver) {
       /** @private {string} */
       this.rawQuery_ = rawQuery;
 
-      /** @private {!HTMLElement} */
-      this.root_ = root;
+      /** @private {!Array<!HTMLElement>} */
+      this.roots_ = roots;
 
       /** @type {?RegExp} */
       this.regExp = this.generateRegExp_();
@@ -396,6 +413,9 @@
       this.queue_.onEmpty(() => {
         this.resolver.resolve(this);
       });
+
+      /** @private {!function(!Node): void} */
+      this.addTextObserver_ = addTextObserver;
     }
 
     /**
@@ -403,7 +423,7 @@
      */
     start() {
       this.queue_.addTopLevelSearchTask(
-          new TopLevelSearchTask(this, this.root_));
+          new TopLevelSearchTask(this, this.roots_, this.addTextObserver_));
     }
 
     /**
@@ -439,9 +459,14 @@
       this.foundMatches_ = this.foundMatches_ || found;
     }
 
-    /** @return {boolean} Whether any matches were found. */
-    didFindMatches() {
-      return this.foundMatches_;
+    /** @return {!settings.SearchResult} */
+    result() {
+      return /** @type {!settings.SearchResult} */ ({
+        canceled: this.canceled,
+        didFindMatches: this.foundMatches_,
+        rawQuery: this.rawQuery_,
+        wasClearSearch: this.isSame(''),
+      });
     }
   }
 
@@ -449,14 +474,25 @@
   const SANITIZE_REGEX = /[-[\]{}()*+?.,\\^$|#\s]/g;
 
   /** @interface */
+  class SearchManagerObserver {
+    onSearchStart() {}
+
+    /** @param {!settings.SearchResult} searchResult */
+    onSearchComplete(searchResult) {}
+  }
+
+  /** @interface */
   class SearchManager {
     /**
      * @param {string} text The text to search for.
-     * @param {!Node} page
-     * @return {!Promise<!settings.SearchRequest>} A signal indicating that
+     * @param {!Array<!Node>} pages
+     * @return {!Promise<!settings.SearchResult>} A signal indicating that
      *     searching finished.
      */
-    search(text, page) {}
+    search(text, pages) {}
+
+    /** @param {!settings.SearchManagerObserver} observer */
+    registerObserver(observer) {}
   }
 
   /** @implements {SearchManager} */
@@ -467,10 +503,39 @@
 
       /** @private {?string} */
       this.lastSearchedText_ = null;
+
+      /** @private {!Array<!settings.SearchManagerObserver>} */
+      this.observers_ = [];
+
+      /** @private {!Set<!MutationObserver>} */
+      this.textObservers_ = new Set();
+    }
+
+    /**
+     * @param {!function(): void} redoSearch
+     * @return {!function(!Node): void}
+     * @private
+     */
+    getAddTextObserverFunction_(redoSearch) {
+      this.textObservers_.forEach(observer => {
+        observer.disconnect();
+      });
+      this.textObservers_.clear();
+      return node => {
+        const observer = new MutationObserver(mutations => {
+          const oldValue = mutations[0].oldValue.trim();
+          const newValue = mutations[0].target.nodeValue.trim();
+          if (oldValue != newValue)
+            redoSearch();
+        });
+        observer.observe(
+            node, {characterData: true, characterDataOldValue: true});
+        this.textObservers_.add(observer);
+      };
     }
 
     /** @override */
-    search(text, page) {
+    search(text, pages) {
       // Cancel any pending requests if a request with different text is
       // submitted.
       if (text != this.lastSearchedText_) {
@@ -482,15 +547,30 @@
       }
 
       this.lastSearchedText_ = text;
-      const request = new SearchRequest(text, page);
+
+      const addTextObserver = this.getAddTextObserverFunction_(() => {
+        this.search(text, pages);
+      });
+      const request = new SearchRequest(text, pages, addTextObserver);
       this.activeRequests_.add(request);
       request.start();
+      this.observers_.forEach(observer => {
+        observer.onSearchStart.call(observer);
+      });
       return request.resolver.promise.then(() => {
         // Stop tracking requests that finished.
         this.activeRequests_.delete(request);
-        return request;
+        this.observers_.forEach(observer => {
+          observer.onSearchComplete.call(observer, request.result());
+        });
+        return request.result();
       });
     }
+
+    /** @override */
+    registerObserver(observer) {
+      this.observers_.push(observer);
+    }
   }
   cr.addSingletonGetter(SearchManagerImpl);
 
@@ -510,6 +590,7 @@
   return {
     getSearchManager: getSearchManager,
     setSearchManagerForTesting: setSearchManagerForTesting,
+    SearchManagerObserver: SearchManagerObserver,
     SearchRequest: SearchRequest,
   };
 });
diff --git a/chrome/browser/resources/settings/settings_main/settings_main.js b/chrome/browser/resources/settings/settings_main/settings_main.js
index 20fd844..c12ebae2 100644
--- a/chrome/browser/resources/settings/settings_main/settings_main.js
+++ b/chrome/browser/resources/settings/settings_main/settings_main.js
@@ -87,6 +87,7 @@
   attached: function() {
     this.listen(this, 'freeze-scroll', 'onFreezeScroll_');
     this.listen(this, 'lazy-loaded', 'onLazyLoaded_');
+    this.registerSearchManagerObserver_();
   },
 
   /** @private */
@@ -250,42 +251,56 @@
     assertNotReached();
   },
 
+  /** @private */
+  registerSearchManagerObserver_: function() {
+    const observer = /** @type {!settings.SearchManagerObserver} */ ({
+      onSearchStart: () => {
+        // Trigger rendering of the basic and advanced pages and search once
+        // ready.
+        this.inSearchMode_ = true;
+        this.toolbarSpinnerActive = true;
+      },
+      onSearchComplete: searchResult => {
+        if (searchResult.canceled) {
+          // Nothing to do here. A previous search request was canceled
+          // because a new search request was issued with a different query
+          // before the previous completed.
+          return;
+        }
+
+        this.toolbarSpinnerActive = false;
+        this.inSearchMode_ = !searchResult.wasClearSearch;
+        this.showNoResultsFound_ =
+            this.inSearchMode_ && !searchResult.didFindMatches;
+        if (this.showNoResultsFound_ &&
+            settings.getCurrentRoute().isSubpage()) {
+          settings.navigateTo(settings.routes.BASIC);
+          this.searchContents(searchResult.rawQuery);
+          return;
+        }
+        if (this.inSearchMode_) {
+          Polymer.IronA11yAnnouncer.requestAvailability();
+          this.fire('iron-announce', {
+            text: this.showNoResultsFound_ ?
+                loadTimeData.getString('searchNoResults') :
+                loadTimeData.getStringF('searchResults', searchResult.rawQuery)
+          });
+        }
+      },
+    });
+    settings.getSearchManager().registerObserver(observer);
+  },
+
   /**
    * @param {string} query
-   * @return {!Promise} A promise indicating that searching finished.
+   * @return {!Promise<!settings.SearchResult>} A promise indicating that
+   * searching finished.
    */
   searchContents: function(query) {
-    // Trigger rendering of the basic and advanced pages and search once ready.
-    this.inSearchMode_ = true;
-    this.toolbarSpinnerActive = true;
-
     return new Promise((resolve, reject) => {
       setTimeout(() => {
-        const whenSearchDone =
-            assert(this.getPage_(settings.routes.BASIC)).searchContents(query);
-        whenSearchDone.then(result => {
-          resolve();
-          if (result.canceled) {
-            // Nothing to do here. A previous search request was canceled
-            // because a new search request was issued with a different query
-            // before the previous completed.
-            return;
-          }
-
-          this.toolbarSpinnerActive = false;
-          this.inSearchMode_ = !result.wasClearSearch;
-          this.showNoResultsFound_ =
-              this.inSearchMode_ && !result.didFindMatches;
-
-          if (this.inSearchMode_) {
-            Polymer.IronA11yAnnouncer.requestAvailability();
-            this.fire('iron-announce', {
-              text: this.showNoResultsFound_ ?
-                  loadTimeData.getString('searchNoResults') :
-                  loadTimeData.getStringF('searchResults', query)
-            });
-          }
-        });
+        const basicPage = assert(this.getPage_(settings.routes.BASIC));
+        basicPage.searchContents(query).then(resolve);
       }, 0);
     });
   },
diff --git a/chrome/browser/ui/apps/chrome_app_delegate.cc b/chrome/browser/ui/apps/chrome_app_delegate.cc
index f6e065e..da9ddf8 100644
--- a/chrome/browser/ui/apps/chrome_app_delegate.cc
+++ b/chrome/browser/ui/apps/chrome_app_delegate.cc
@@ -80,7 +80,7 @@
   return new_tab_params.target_contents;
 }
 
-void OnCheckIsDefaultBrowserFinished(
+void OpenURLAfterCheckIsDefaultBrowser(
     std::unique_ptr<content::WebContents> source,
     const content::OpenURLParams& params,
     shell_integration::DefaultWebClientState state) {
@@ -142,7 +142,7 @@
     // WebContents by being assigned as its delegate within
     // ChromeAppDelegate::AddNewContents(), but this is the first time
     // NewWindowContentsDelegate actually sees the WebContents. Here ownership
-    // is captured and passed to OnCheckIsDefaultBrowserFinished(), which
+    // is captured and passed to OpenURLAfterCheckIsDefaultBrowser(), which
     // destroys it after the default browser worker completes.
     std::unique_ptr<content::WebContents> source_ptr(source);
     // Object lifetime notes: StartCheckIsDefault() takes lifetime ownership of
@@ -151,7 +151,7 @@
     scoped_refptr<shell_integration::DefaultBrowserWorker>
         check_if_default_browser_worker =
             new shell_integration::DefaultBrowserWorker(
-                base::Bind(&OnCheckIsDefaultBrowserFinished,
+                base::Bind(&OpenURLAfterCheckIsDefaultBrowser,
                            base::Passed(&source_ptr), params));
     check_if_default_browser_worker->StartCheckIsDefault();
   }
diff --git a/chrome/browser/ui/browser.cc b/chrome/browser/ui/browser.cc
index 5e8c671..d9b57765 100644
--- a/chrome/browser/ui/browser.cc
+++ b/chrome/browser/ui/browser.cc
@@ -1404,12 +1404,6 @@
 }
 
 void Browser::UpdatePictureInPictureSurfaceId(viz::SurfaceId surface_id) {
-  if (!surface_id.is_valid()) {
-    if (pip_window_controller_)
-      pip_window_controller_->Close();
-    return;
-  }
-
   if (!pip_window_controller_)
     pip_window_controller_.reset(
         PictureInPictureWindowController::GetOrCreateForWebContents(
@@ -1418,6 +1412,11 @@
   pip_window_controller_->Show();
 }
 
+void Browser::ExitPictureInPicture() {
+  if (pip_window_controller_)
+    pip_window_controller_->Close();
+}
+
 bool Browser::IsMouseLocked() const {
   return exclusive_access_manager_->mouse_lock_controller()->IsMouseLocked();
 }
diff --git a/chrome/browser/ui/browser.h b/chrome/browser/ui/browser.h
index 1e41bbd..459436b 100644
--- a/chrome/browser/ui/browser.h
+++ b/chrome/browser/ui/browser.h
@@ -501,6 +501,7 @@
   void OnDidBlockFramebust(content::WebContents* web_contents,
                            const GURL& url) override;
   void UpdatePictureInPictureSurfaceId(viz::SurfaceId surface_id) override;
+  void ExitPictureInPicture() override;
 
   bool is_type_tabbed() const { return type_ == TYPE_TABBED; }
   bool is_type_popup() const { return type_ == TYPE_POPUP; }
diff --git a/chrome/browser/ui/extensions/hosted_app_browsertest.cc b/chrome/browser/ui/extensions/hosted_app_browsertest.cc
index fea6416b..0910c072 100644
--- a/chrome/browser/ui/extensions/hosted_app_browsertest.cc
+++ b/chrome/browser/ui/extensions/hosted_app_browsertest.cc
@@ -38,7 +38,11 @@
 #include "chrome/browser/ui/toolbar/app_menu_model.h"
 #include "chrome/browser/web_applications/web_app.h"
 #include "chrome/common/chrome_features.h"
+#include "chrome/common/chrome_switches.h"
 #include "chrome/test/base/ui_test_utils.h"
+#include "components/security_interstitials/core/controller_client.h"
+#include "content/public/browser/interstitial_page.h"
+#include "content/public/browser/interstitial_page_delegate.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_process_host.h"
@@ -96,22 +100,43 @@
 const auto kAppTypeValues =
     ::testing::Values(AppType::HOSTED_APP, AppType::BOOKMARK_APP);
 
-void NavigateToURLAndWait(Browser* browser, const GURL& url) {
-  content::TestNavigationObserver observer(
-      browser->tab_strip_model()->GetActiveWebContents(),
-      content::MessageLoopRunner::QuitMode::DEFERRED);
-  NavigateParams params(browser, url, ui::PAGE_TRANSITION_LINK);
-  ui_test_utils::NavigateToURL(&params);
-  observer.Wait();
+// If |proceed_through_interstitial| is true, asserts that a security
+// interstitial is shown, and clicks through it, before returning.
+void NavigateToURLAndWait(Browser* browser,
+                          const GURL& url,
+                          bool proceed_through_interstitial = false) {
+  WebContents* web_contents =
+      browser->tab_strip_model()->GetActiveWebContents();
+  {
+    content::TestNavigationObserver observer(
+        web_contents, content::MessageLoopRunner::QuitMode::DEFERRED);
+    NavigateParams params(browser, url, ui::PAGE_TRANSITION_LINK);
+    ui_test_utils::NavigateToURL(&params);
+    observer.WaitForNavigationFinished();
+  }
+
+  if (!proceed_through_interstitial)
+    return;
+
+  content::InterstitialPage* interstitial = web_contents->GetInterstitialPage();
+  {
+    // Need a second TestNavigationObserver; the above one is spent.
+    content::TestNavigationObserver observer(
+        web_contents, content::MessageLoopRunner::QuitMode::DEFERRED);
+    ASSERT_TRUE(interstitial);
+    interstitial->GetDelegateForTesting()->CommandReceived(
+        base::IntToString(security_interstitials::CMD_PROCEED));
+    observer.Wait();
+  }
 }
 
 // Used by ShouldLocationBarForXXX. Performs a navigation and then checks that
 // the location bar visibility is as expcted.
 void NavigateAndCheckForLocationBar(Browser* browser,
-                                    const std::string& url_string,
-                                    bool expected_visibility) {
-  GURL url(url_string);
-  NavigateToURLAndWait(browser, url);
+                                    const GURL& url,
+                                    bool expected_visibility,
+                                    bool proceed_through_interstitial = false) {
+  NavigateToURLAndWait(browser, url, proceed_through_interstitial);
   EXPECT_EQ(expected_visibility,
       browser->hosted_app_controller()->ShouldShowLocationBar());
 }
@@ -206,7 +231,11 @@
       scoped_feature_list_.InitAndEnableFeature(features::kDesktopPWAWindowing);
     } else {
 #if defined(OS_MACOSX)
-      scoped_feature_list_.InitAndEnableFeature(features::kBookmarkApps);
+      scoped_feature_list_.InitWithFeatures({features::kBookmarkApps},
+                                            {features::kDesktopPWAWindowing});
+#else
+      scoped_feature_list_.InitAndDisableFeature(
+          features::kDesktopPWAWindowing);
 #endif
     }
 
@@ -214,6 +243,15 @@
   }
 
  protected:
+  void SetupAppWithURL(const GURL& app_url) {
+    // TODO(ortuno): Use InstallBookmarkApp instead of loading a manifest,
+    // if |app_type_ == BOOKMARK_APP|.
+    extensions::TestExtensionDir test_app_dir;
+    test_app_dir.WriteManifest(
+        base::StringPrintf(kAppDotComManifest, app_url.spec().c_str()));
+    SetupApp(test_app_dir.UnpackedPath());
+  }
+
   void SetupApp(const std::string& app_folder) {
     SetupApp(test_data_dir_.AppendASCII(app_folder));
   }
@@ -325,6 +363,10 @@
 
   net::EmbeddedTestServer* https_server() { return &https_server_; }
 
+  CertVerifierBrowserTest::CertVerifier* cert_verifier() {
+    return &cert_verifier_;
+  }
+
  private:
   class EmptyAcceleratorProvider : public ui::AcceleratorProvider {
    public:
@@ -454,67 +496,98 @@
 
 // Check that the location bar is shown correctly.
 IN_PROC_BROWSER_TEST_P(HostedAppTest, ShouldShowLocationBar) {
-  SetupApp("https_app");
+  ASSERT_TRUE(https_server()->Start());
+
+  const GURL app_url = https_server()->GetURL("app.com", "/simple.html");
+
+  SetupAppWithURL(app_url);
 
   // Navigate to the app's launch page; the location bar should be hidden.
-  NavigateAndCheckForLocationBar(app_browser_,
-                                 "https://www.example.com/empty.html", false);
+  NavigateAndCheckForLocationBar(app_browser_, app_url, false);
 
   // Navigate to another page on the same origin; the location bar should still
   // hidden.
-  NavigateAndCheckForLocationBar(app_browser_, "https://www.example.com/blah",
-                                 false);
+  NavigateAndCheckForLocationBar(
+      app_browser_, https_server()->GetURL("app.com", "/empty.html"), false);
 
   // Navigate to different origin; the location bar should now be visible.
-  NavigateAndCheckForLocationBar(app_browser_, "https://www.foo.com/blah",
-                                 true);
+  NavigateAndCheckForLocationBar(
+      app_browser_, https_server()->GetURL("foo.com", "/simple.html"), true);
 }
 
-// Check that the location bar is shown correctly for HTTP apps when they
-// navigate to a HTTPS page on the same origin.
-//
-// TODO(mgiuca): Disabled on Windows and macOS for being flaky:
-// https://crbug.com/814400
-#if defined(OS_WIN) || defined(OS_MACOSX)
-#define MAYBE_ShouldShowLocationBarForHTTPApp \
-  DISABLED_ShouldShowLocationBarForHTTPApp
-#else
-#define MAYBE_ShouldShowLocationBarForHTTPApp ShouldShowLocationBarForHTTPApp
-#endif
-IN_PROC_BROWSER_TEST_P(HostedAppTest, MAYBE_ShouldShowLocationBarForHTTPApp) {
-  SetupApp("app");
+IN_PROC_BROWSER_TEST_P(HostedAppTest, ShouldShowLocationBarMixedContent) {
+  ASSERT_TRUE(https_server()->Start());
+
+  const GURL app_url = https_server()->GetURL("app.com", "/");
+
+  SetupAppWithURL(app_url);
+
+  // Navigate to another page on the same origin, but with mixed content; the
+  // location bar should be hidden.
+  // TODO(ortuno): Make the location bar visible.
+  NavigateAndCheckForLocationBar(
+      app_browser_,
+      https_server()->GetURL("app.com",
+                             "/ssl/page_displays_insecure_content.html"),
+      false);
+}
+
+IN_PROC_BROWSER_TEST_P(HostedAppTest,
+                       ShouldShowLocationBarForHTTPAppSameOrigin) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  const GURL app_url =
+      embedded_test_server()->GetURL("app.com", "/simple.html");
+  SetupAppWithURL(app_url);
 
   // Navigate to the app's launch page; the location bar should be visible, even
   // though it exactly matches the site, because it is not secure.
-  NavigateAndCheckForLocationBar(app_browser_,
-                                 "http://www.example.com/empty.html", true);
+  NavigateAndCheckForLocationBar(app_browser_, app_url, true);
+}
+
+IN_PROC_BROWSER_TEST_P(HostedAppTest, ShouldShowLocationBarForHTTPAppHTTPSUrl) {
+  ASSERT_TRUE(https_server()->Start());
+
+  const GURL app_url = https_server()->GetURL("app.com", "/simple.html");
+
+  GURL::Replacements scheme_http;
+  scheme_http.SetSchemeStr("http");
+
+  // Create an app that has the same port and origin as `app_url` but with a
+  // "http" scheme.
+  SetupAppWithURL(app_url.ReplaceComponents(scheme_http));
 
   // Navigate to the https version of the site; the location bar should
   // be hidden, as it is a more secure version of the site.
-  NavigateAndCheckForLocationBar(
-      app_browser_, "https://www.example.com/blah", false);
+  NavigateAndCheckForLocationBar(app_browser_, app_url, false);
 }
 
-// TODO(mgiuca): Disabled on Windows for being flaky: https://crbug.com/815246
-#if defined(OS_WIN)
-#define MAYBE_ShouldShowLocationBarForHTTPSApp \
-  DISABLED_ShouldShowLocationBarForHTTPSApp
-#else
-#define MAYBE_ShouldShowLocationBarForHTTPSApp ShouldShowLocationBarForHTTPSApp
-#endif
-// Check that the location bar is shown correctly for HTTPS apps when they
-// navigate to a HTTP page on the same origin.
-IN_PROC_BROWSER_TEST_P(HostedAppTest, MAYBE_ShouldShowLocationBarForHTTPSApp) {
-  SetupApp("https_app");
+IN_PROC_BROWSER_TEST_P(HostedAppTest,
+                       ShouldShowLocationBarForHTTPSAppSameOrigin) {
+  ASSERT_TRUE(https_server()->Start());
+
+  const GURL app_url = https_server()->GetURL("app.com", "/simple.html");
+  SetupAppWithURL(app_url);
 
   // Navigate to the app's launch page; the location bar should be hidden.
-  NavigateAndCheckForLocationBar(
-      app_browser_, "https://www.example.com/empty.html", false);
+  NavigateAndCheckForLocationBar(app_browser_, app_url, false);
+}
+
+// Check that the location bar is shown correctly for HTTPS apps when they
+// navigate to a HTTP page on the same origin.
+IN_PROC_BROWSER_TEST_P(HostedAppTest, ShouldShowLocationBarForHTTPSAppHTTPUrl) {
+  ASSERT_TRUE(https_server()->Start());
+
+  const GURL app_url = https_server()->GetURL("app.com", "/simple.html");
+  SetupAppWithURL(app_url);
+
+  GURL::Replacements scheme_http;
+  scheme_http.SetSchemeStr("http");
 
   // Navigate to the http version of the site; the location bar should
   // be visible for the https version as it is not secure.
-  NavigateAndCheckForLocationBar(
-      app_browser_, "http://www.example.com/blah", true);
+  NavigateAndCheckForLocationBar(app_browser_,
+                                 app_url.ReplaceComponents(scheme_http), true);
 }
 
 // Check that location bar is not shown for apps hosted within extensions pages.
@@ -555,26 +628,75 @@
 
   // Navigate to the app's launch page; the location bar should not be visible,
   // because extensions pages are secure.
-  NavigateAndCheckForLocationBar(app_browser_, popup_url.spec(), false);
+  NavigateAndCheckForLocationBar(app_browser_, popup_url, false);
 }
 
 // Check that the location bar is shown correctly for apps that specify start
 // URLs without the 'www.' prefix.
 IN_PROC_BROWSER_TEST_P(HostedAppTest, ShouldShowLocationBarForAppWithoutWWW) {
-  SetupApp("https_app_no_www");
+  ASSERT_TRUE(https_server()->Start());
+
+  const GURL app_url = https_server()->GetURL("app.com", "/simple.html");
+  SetupAppWithURL(app_url);
 
   // Navigate to the app's launch page; the location bar should be hidden.
-  NavigateAndCheckForLocationBar(app_browser_, "https://example.com/empty.html",
-                                 false);
+  NavigateAndCheckForLocationBar(app_browser_, app_url, false);
 
-  // Navigate to the app's launch page with the 'www.' prefis; the location bar
+  // Navigate to the app's launch page with the 'www.' prefix; the location bar
   // should be hidden.
-  NavigateAndCheckForLocationBar(app_browser_,
-                                 "https://www.example.com/empty.html", false);
+  NavigateAndCheckForLocationBar(
+      app_browser_, https_server()->GetURL("www.app.com", "/simple.html"),
+      false);
 
   // Navigate to different origin; the location bar should now be visible.
-  NavigateAndCheckForLocationBar(app_browser_, "https://www.foo.com/blah",
-                                 true);
+  NavigateAndCheckForLocationBar(
+      app_browser_, https_server()->GetURL("www.foo.com", "/simple.html"),
+      true);
+}
+
+// Checks that the location bar is shown for an HTTPS app with an invalid
+// certificate, if the user has previously proceeded through the interstitial.
+IN_PROC_BROWSER_TEST_P(HostedAppTest, ShouldShowLocationBarDangerous) {
+  // If DesktopPWAWindowing and CommittedInterstitials are enabled, we will
+  // never load a dangerous app. Opening dangerous apps will always show an
+  // interstitial and proceeding through it will redirect the navigation to a
+  // tab.
+  if (base::FeatureList::IsEnabled(features::kDesktopPWAWindowing) &&
+      base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kCommittedInterstitials)) {
+    return;
+  }
+
+  ASSERT_TRUE(https_server()->Start());
+
+  const GURL app_url = https_server()->GetURL("app.com", "/simple.html");
+  SetupAppWithURL(app_url);
+  cert_verifier()->set_default_result(net::ERR_CERT_DATE_INVALID);
+
+  // When DesktopPWAWindowing is enabled, proceeding through an interstitial
+  // results in the navigation being redirected to a regular tab. So we need
+  // to open the app again.
+  bool proceed_through_interstitial = true;
+  if (base::FeatureList::IsEnabled(features::kDesktopPWAWindowing)) {
+    // Proceed through the interstitial once.
+    NavigateToURLAndWait(app_browser_, app_url,
+                         /*proceed_through_interstitial=*/true);
+    ASSERT_NE(app_browser_, chrome::FindLastActive());
+
+    app_browser_ = LaunchAppBrowser(app_);
+    NavigateToURLAndWait(app_browser_, app_url,
+                         /*proceed_through_interstitial=*/false);
+
+    // There should be no interstitial shown because we previously proceeded
+    // through it.
+    ASSERT_FALSE(app_browser_->tab_strip_model()
+                     ->GetActiveWebContents()
+                     ->GetInterstitialPage());
+    proceed_through_interstitial = false;
+  }
+
+  NavigateAndCheckForLocationBar(app_browser_, app_url, true,
+                                 proceed_through_interstitial);
 }
 
 // Check that a subframe on a regular web page can navigate to a URL that
diff --git a/chrome/browser/ui/passwords/manage_passwords_bubble_model.cc b/chrome/browser/ui/passwords/manage_passwords_bubble_model.cc
index 33a6def..bb44b7d3 100644
--- a/chrome/browser/ui/passwords/manage_passwords_bubble_model.cc
+++ b/chrome/browser/ui/passwords/manage_passwords_bubble_model.cc
@@ -39,12 +39,6 @@
 
 namespace {
 
-Profile* GetProfileFromWebContents(content::WebContents* web_contents) {
-  if (!web_contents)
-    return nullptr;
-  return Profile::FromBrowserContext(web_contents->GetBrowserContext());
-}
-
 void CleanStatisticsForSite(Profile* profile, const GURL& origin) {
   DCHECK(profile);
   password_manager::PasswordStore* password_store =
@@ -456,7 +450,10 @@
 }
 
 Profile* ManagePasswordsBubbleModel::GetProfile() const {
-  return GetProfileFromWebContents(GetWebContents());
+  content::WebContents* web_contents = GetWebContents();
+  if (!web_contents)
+    return nullptr;
+  return Profile::FromBrowserContext(web_contents->GetBrowserContext());
 }
 
 content::WebContents* ManagePasswordsBubbleModel::GetWebContents() const {
diff --git a/chrome/browser/ui/views/apps/app_info_dialog/app_info_dialog_views.cc b/chrome/browser/ui/views/apps/app_info_dialog/app_info_dialog_views.cc
index 551d9e7e..8193e57 100644
--- a/chrome/browser/ui/views/apps/app_info_dialog/app_info_dialog_views.cc
+++ b/chrome/browser/ui/views/apps/app_info_dialog/app_info_dialog_views.cc
@@ -50,24 +50,11 @@
 // list's app_list::kDialogSeparatorColor
 const SkColor kDialogSeparatorColor = SkColorSetRGB(0xD1, 0xD1, 0xD1);
 
-#if defined(OS_MACOSX)
-bool IsAppInfoDialogMacEnabled() {
-  const base::CommandLine* command_line =
-      base::CommandLine::ForCurrentProcess();
-  if (command_line->HasSwitch(switches::kDisableAppInfoDialogMac))
-    return false;
-  if (command_line->HasSwitch(switches::kEnableAppInfoDialogMac))
-    return true;
-  return false;  // Current default.
-}
-#endif
-
 }  // namespace
 
 bool CanShowAppInfoDialog() {
 #if defined(OS_MACOSX)
-  static const bool can_show = IsAppInfoDialogMacEnabled();
-  return can_show;
+  return false;
 #else
   return true;
 #endif
diff --git a/chrome/browser/ui/views/passwords/account_chooser_dialog_view.cc b/chrome/browser/ui/views/passwords/account_chooser_dialog_view.cc
index f017f274..5f054f1 100644
--- a/chrome/browser/ui/views/passwords/account_chooser_dialog_view.cc
+++ b/chrome/browser/ui/views/passwords/account_chooser_dialog_view.cc
@@ -46,12 +46,6 @@
   return result;
 }
 
-Profile* GetProfileFromWebContents(content::WebContents* web_contents) {
-  if (!web_contents)
-    return nullptr;
-  return Profile::FromBrowserContext(web_contents->GetBrowserContext());
-}
-
 // Creates a list view of credentials in |forms|.
 views::ScrollView* CreateCredentialsView(
     const PasswordDialogController::FormsVector& forms,
@@ -192,12 +186,12 @@
 
 void AccountChooserDialogView::InitWindow() {
   SetLayoutManager(std::make_unique<views::FillLayout>());
-  AddChildView(
-      CreateCredentialsView(controller_->GetLocalForms(), this,
-                            content::BrowserContext::GetDefaultStoragePartition(
-                                GetProfileFromWebContents(web_contents_))
-                                ->GetURLLoaderFactoryForBrowserProcess()
-                                .get()));
+  AddChildView(CreateCredentialsView(
+      controller_->GetLocalForms(), this,
+      content::BrowserContext::GetDefaultStoragePartition(
+          Profile::FromBrowserContext(web_contents_->GetBrowserContext()))
+          ->GetURLLoaderFactoryForBrowserProcess()
+          .get()));
 }
 
 #if !defined(OS_MACOSX) || BUILDFLAG(MAC_VIEWS_BROWSER)
diff --git a/chrome/browser/ui/webui/memory_internals_ui.cc b/chrome/browser/ui/webui/memory_internals_ui.cc
index 0259dee..324b480 100644
--- a/chrome/browser/ui/webui/memory_internals_ui.cc
+++ b/chrome/browser/ui/webui/memory_internals_ui.cc
@@ -25,6 +25,7 @@
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/grit/browser_resources.h"
+#include "components/services/heap_profiling/public/cpp/settings.h"
 #include "content/public/browser/browser_child_process_host_iterator.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/child_process_data.h"
@@ -40,7 +41,8 @@
 #include "ui/shell_dialogs/select_file_dialog.h"
 #include "ui/shell_dialogs/select_file_policy.h"
 
-using profiling::ProfilingProcessHost;
+using heap_profiling::Mode;
+using heap_profiling::ProfilingProcessHost;
 
 namespace {
 
@@ -48,30 +50,30 @@
 std::string GetMessageString() {
 #if BUILDFLAG(USE_ALLOCATOR_SHIM)
   switch (ProfilingProcessHost::GetInstance()->GetMode()) {
-    case ProfilingProcessHost::Mode::kAll:
+    case Mode::kAll:
       return std::string("Memory logging is enabled for all processes.");
 
-    case ProfilingProcessHost::Mode::kAllRenderers:
+    case Mode::kAllRenderers:
       return std::string("Memory logging is enabled for all renderers.");
 
-    case ProfilingProcessHost::Mode::kBrowser:
+    case Mode::kBrowser:
       return std::string(
           "Memory logging is enabled for just the browser process.");
 
-    case ProfilingProcessHost::Mode::kGpu:
+    case Mode::kGpu:
       return std::string("Memory logging is enabled for just the gpu process.");
 
-    case ProfilingProcessHost::Mode::kMinimal:
+    case Mode::kMinimal:
       return std::string(
           "Memory logging is enabled for the browser and GPU processes.");
 
-    case ProfilingProcessHost::Mode::kRendererSampling:
+    case Mode::kRendererSampling:
       return std::string(
           "Memory logging is enabled for an automatic sample of renderer "
           "processes. This UI is disabled.");
 
-    case ProfilingProcessHost::Mode::kNone:
-    case ProfilingProcessHost::Mode::kManual:
+    case Mode::kNone:
+    case Mode::kManual:
     default:
       return std::string(
           "Memory logging must be manually enabled for each process via "
diff --git a/chrome/browser/vr/testapp/vr_test_context.cc b/chrome/browser/vr/testapp/vr_test_context.cc
index e32a502..0b76311 100644
--- a/chrome/browser/vr/testapp/vr_test_context.cc
+++ b/chrome/browser/vr/testapp/vr_test_context.cc
@@ -127,22 +127,24 @@
 
   RenderInfo render_info = GetRenderInfo();
 
-  UpdateController(render_info);
-
   // Update the render position of all UI elements (including desktop).
   ui_->scene()->OnBeginFrame(current_time, head_pose_);
   ui_->OnProjMatrixChanged(render_info.left_eye_model.proj_matrix);
 
+  UpdateController(render_info, current_time);
+
+  ui_->scene()->UpdateTextures();
+
+  auto load_progress = (current_time - page_load_start_).InMilliseconds() /
+                       kPageLoadTimeMilliseconds;
+  ui_->SetLoading(load_progress < 1.0f);
+  ui_->SetLoadProgress(std::min(load_progress, 1.0f));
+
   if (web_vr_mode_ && ui_->ShouldRenderWebVr() && webvr_frames_received_) {
     ui_->ui_renderer()->DrawWebVrOverlayForeground(render_info);
   } else {
     ui_->ui_renderer()->Draw(render_info);
   }
-
-  auto load_progress = (current_time - page_load_start_).InMilliseconds() /
-                       kPageLoadTimeMilliseconds;
-  ui_->SetLoading(load_progress < 1.0f);
-  ui_->SetLoadProgress(std::min(load_progress, 1.0f));
 }
 
 void VrTestContext::HandleInput(ui::Event* event) {
@@ -297,10 +299,10 @@
   head_pose_.RotateAboutYAxis(-head_angle_y_degrees_);
 
   last_mouse_point_ = gfx::Point(mouse_event->x(), mouse_event->y());
-  last_controller_model_ = UpdateController(GetRenderInfo());
 }
 
-ControllerModel VrTestContext::UpdateController(const RenderInfo& render_info) {
+ControllerModel VrTestContext::UpdateController(const RenderInfo& render_info,
+                                                base::TimeTicks current_time) {
   // We could map mouse position to controller position, and skip this logic,
   // but it will make targeting elements with a mouse feel strange and not
   // mouse-like. Instead, we make the reticle track the mouse position linearly
@@ -348,9 +350,8 @@
   // Hit testing is done in terms of this synthesized controller model.
   GestureList gesture_list;
   ReticleModel reticle_model;
-  ui_->input_manager()->HandleInput(base::TimeTicks::Now(), render_info,
-                                    controller_model, &reticle_model,
-                                    &gesture_list);
+  ui_->input_manager()->HandleInput(current_time, render_info, controller_model,
+                                    &reticle_model, &gesture_list);
 
   // Now that we have accurate hit information, we use this to construct a
   // controller model for display.
diff --git a/chrome/browser/vr/testapp/vr_test_context.h b/chrome/browser/vr/testapp/vr_test_context.h
index 94ad4cb..bf762d06 100644
--- a/chrome/browser/vr/testapp/vr_test_context.h
+++ b/chrome/browser/vr/testapp/vr_test_context.h
@@ -72,7 +72,8 @@
   RenderInfo GetRenderInfo() const;
   gfx::Transform ProjectionMatrix() const;
   gfx::Transform ViewProjectionMatrix() const;
-  ControllerModel UpdateController(const RenderInfo& render_info);
+  ControllerModel UpdateController(const RenderInfo& render_info,
+                                   base::TimeTicks current_time);
   gfx::Point3F LaserOrigin() const;
   void LoadAssets();
 
@@ -102,8 +103,6 @@
   bool touching_touchpad_ = false;
   base::TimeTicks page_load_start_;
 
-  ControllerModel last_controller_model_;
-
   std::unique_ptr<TextInputDelegate> text_input_delegate_;
   std::unique_ptr<TestKeyboardDelegate> keyboard_delegate_;
 
diff --git a/chrome/common/chrome_content_client.cc b/chrome/common/chrome_content_client.cc
index 92436bde..6244309 100644
--- a/chrome/common/chrome_content_client.cc
+++ b/chrome/common/chrome_content_client.cc
@@ -711,13 +711,13 @@
 
 void ChromeContentClient::OnServiceManagerConnected(
     content::ServiceManagerConnection* connection) {
-  static base::LazyInstance<profiling::Client>::Leaky profiling_client =
+  static base::LazyInstance<heap_profiling::Client>::Leaky profiling_client =
       LAZY_INSTANCE_INITIALIZER;
 
   std::unique_ptr<service_manager::BinderRegistry> registry(
       new service_manager::BinderRegistry);
   registry->AddInterface(
-      base::BindRepeating(&profiling::Client::BindToInterface,
+      base::BindRepeating(&heap_profiling::Client::BindToInterface,
                           base::Unretained(&profiling_client.Get())));
   connection->AddConnectionFilter(
       std::make_unique<content::SimpleConnectionFilter>(std::move(registry)));
diff --git a/chrome/renderer/chrome_content_renderer_client.cc b/chrome/renderer/chrome_content_renderer_client.cc
index a71e3bf..f43782e 100644
--- a/chrome/renderer/chrome_content_renderer_client.cc
+++ b/chrome/renderer/chrome_content_renderer_client.cc
@@ -369,7 +369,7 @@
   printing::SetAgent(GetUserAgent());
 #endif
 
-  profiling::SetGCHeapAllocationHookFunctions(
+  heap_profiling::SetGCHeapAllocationHookFunctions(
       &blink::WebHeap::SetAllocationHook, &blink::WebHeap::SetFreeHook);
 }
 
diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
index f486e52..becd4003 100644
--- a/chrome/test/BUILD.gn
+++ b/chrome/test/BUILD.gn
@@ -2216,6 +2216,7 @@
     "../browser/android/history_report/delta_file_commons_unittest.cc",
     "../browser/android/history_report/usage_reports_buffer_backend_unittest.cc",
     "../browser/android/locale/special_locale_handler_unittest.cc",
+    "../browser/android/tab_web_contents_delegate_android_unittest.cc",
 
     # TODO(newt): move this to test_support_unit?
     "../browser/android/chrome_backup_agent_unittest.cc",
diff --git a/chrome/test/data/extensions/api_test/webrequest_clients_google_com/background.js b/chrome/test/data/extensions/api_test/webrequest_clients_google_com/background.js
index 9419edd..bafc3fd0 100644
--- a/chrome/test/data/extensions/api_test/webrequest_clients_google_com/background.js
+++ b/chrome/test/data/extensions/api_test/webrequest_clients_google_com/background.js
@@ -6,6 +6,6 @@
 
 chrome.webRequest.onBeforeRequest.addListener(function(details) {
   ++window.webRequestCount;
-}, {urls: ['https://clients1.google.com/']});
+}, {urls: ['http://clients1.google.com/']});
 
 chrome.test.sendMessage('ready');
diff --git a/chrome/test/data/extensions/https_app_no_www/manifest.json b/chrome/test/data/extensions/https_app_no_www/manifest.json
deleted file mode 100644
index 3d42c5c..0000000
--- a/chrome/test/data/extensions/https_app_no_www/manifest.json
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  "name": "App Test",
-  "version": "1",
-  "manifest_version": 2,
-  "app": {
-    "launch": {
-      "web_url": "https://example.com/"
-    }
-  }
-}
diff --git a/chrome/test/data/extensions/platform_apps/new_window_with_non_existing_file/manifest.json b/chrome/test/data/extensions/platform_apps/new_window_with_non_existing_file/manifest.json
new file mode 100644
index 0000000..8a49e78b
--- /dev/null
+++ b/chrome/test/data/extensions/platform_apps/new_window_with_non_existing_file/manifest.json
@@ -0,0 +1,10 @@
+{
+  "name": "Platform App Test: Use chrome.app.window.create() with an non existing file.",
+  "manifest_version": 2,
+  "version": "1",
+  "app": {
+    "background": {
+      "scripts": ["test.js"]
+    }
+  }
+}
diff --git a/chrome/test/data/extensions/platform_apps/new_window_with_non_existing_file/test.js b/chrome/test/data/extensions/platform_apps/new_window_with_non_existing_file/test.js
new file mode 100644
index 0000000..ecb95e250
--- /dev/null
+++ b/chrome/test/data/extensions/platform_apps/new_window_with_non_existing_file/test.js
@@ -0,0 +1,12 @@
+// Copyright (c) 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+chrome.app.runtime.onLaunched.addListener(function() {
+  chrome.app.window.create('not_found.html', {}, function (createdWindow) {
+    if (createdWindow)
+      chrome.test.notifyFail();
+    else
+      chrome.test.notifyPass();
+  })
+});
diff --git a/chrome/test/data/webrtc/peerconnection_rtp.js b/chrome/test/data/webrtc/peerconnection_rtp.js
index 2b90098..2260691 100644
--- a/chrome/test/data/webrtc/peerconnection_rtp.js
+++ b/chrome/test/data/webrtc/peerconnection_rtp.js
@@ -344,70 +344,39 @@
 // TODO(hbos): Make this a web platform test instead. https://crbug.com/773472
 function trackSwitchingStream() {
   let pc = new RTCPeerConnection();
-  let track1 = null;
+  let track = null;
   let stream1 = null;
   let stream2 = null;
   pc.setRemoteDescription(createOffer([msid('stream1', 'track1')]));
   pc.ontrack = (e) => {
-    track1 = e.track;
+    track = e.track;
     stream1 = e.streams[0];
-    if (stream1.getTracks()[0] != track1)
-      throw failTest('stream1 does not contain track1.');
+    if (stream1.getTracks()[0] != track)
+      throw failTest('stream1 does not contain track.');
     // This should update the associated set of streams for the existing
-    // receiver for track1.
-    pc.setRemoteDescription(createOffer([msid('stream2', 'track1')]));
+    // receiver for track.
+    pc.setRemoteDescription(createOffer([msid('stream2', 'track')]));
     pc.ontrack = (e) => {
-      let originalTrack1 = track1;
-      track1 = e.track;
+      let originalTrack = track;
+      track = e.track;
       stream2 = e.streams[0];
-      // TODO(hbos): A new track should not be created, track1 should simply
+      // TODO(hbos): A new track should not be created, track should simply
       // move. Fix this and update assertion. https://crbug.com/webrtc/8377
-      if (track1 == originalTrack1)
+      if (track == originalTrack)
         throw failTest('A new track was not created.');
-      // TODO(hbos): stream1 should now be empty and track1 muted. Fix this and
-      // update assertions. https://crbug.com/773523
-      if (stream1.getTracks()[0] != originalTrack1)
-        throw failTest('stream1 does not still contain the original track1.');
-      if (track1.muted)
-        throw failTest('The original track1 has been muted.');
-      if (stream2.getTracks()[0] != track1)
-        throw failTest('stream2 does not contain track1.');
+      if (stream1.getTracks().length != 0)
+        throw failTest('stream1 is not empty.')
+      if (!originalTrack.muted)
+        throw failTest('Original track is not muted.');
+      if (track.muted)
+        throw failTest('New track is muted.');
+      if (stream2.getTracks()[0] != track)
+        throw failTest('stream2 does not contain track.');
       returnToTest('ok');
     };
   };
 }
 
-// TODO(hbos): Make this a web platform test instead. https://crbug.com/773472
-function trackAddedToSecondStream() {
-  let pc = new RTCPeerConnection();
-  let track1 = null;
-  let track2 = null;
-  let stream1 = null;
-  let stream2 = null;
-  pc.ontrack = (e) => {
-    track1 = e.track;
-    stream1 = e.streams[0];
-    if (stream1.getTracks()[0] != track1)
-      throw failTest('stream1 does not contain track1.');
-    pc.ontrack = (e) => {
-      let originalTrack1 = track1;
-      track1 = e.track;
-      stream2 = e.streams[0];
-      // TODO(hbos): A new track should not be created, track1 should be added
-      // to both streams. Fix this and update assertion.
-      // https://crbug.com/webrtc/8377
-      if (track1 == originalTrack1)
-        throw failTest('A new track was not created.');
-      if (stream2.getTracks()[0] != track1)
-        throw failTest('stream2 does not contain track1.');
-      returnToTest('ok');
-    };
-    pc.setRemoteDescription(createOffer([ msid('stream1', 'track1'),
-                                          msid('stream2', 'track1') ]));
-  };
-  pc.setRemoteDescription(createOffer([msid('stream1', 'track1')]));
-}
-
 // TODO(hbos): Add a test that verifies a track that is added to two streams can
 // be removed from just one of them. https://crbug.com/webrtc/8377
 
diff --git a/chrome/test/data/webui/settings/basic_page_browsertest.js b/chrome/test/data/webui/settings/basic_page_browsertest.js
index 2e8155c..75cc5e7b 100644
--- a/chrome/test/data/webui/settings/basic_page_browsertest.js
+++ b/chrome/test/data/webui/settings/basic_page_browsertest.js
@@ -45,8 +45,7 @@
     /** @override */
     search(text, page) {
       if (this.searchRequest_ == null || !this.searchRequest_.isSame(text)) {
-        this.searchRequest_ = new settings.SearchRequest(
-            text, document.createElement('div'));
+        this.searchRequest_ = new settings.SearchRequest(text);
         this.searchRequest_.finished = true;
         this.searchRequest_.updateMatches(false);
 
@@ -66,6 +65,9 @@
       }
       return this.searchRequest_.resolver.promise;
     }
+
+    /** @override */
+    registerObserver(observer) {}
   }
 
   // Register mocha tests.
diff --git a/chrome/test/data/webui/settings/search_settings_test.js b/chrome/test/data/webui/settings/search_settings_test.js
index 6a5fe1e0..9e250f43 100644
--- a/chrome/test/data/webui/settings/search_settings_test.js
+++ b/chrome/test/data/webui/settings/search_settings_test.js
@@ -37,29 +37,32 @@
       const div = document.querySelector('#mydiv');
 
       assertTrue(section.hiddenBySearch);
-      return searchManager.search('settings', section).then(function() {
-        assertFalse(section.hiddenBySearch);
+      return searchManager.search('settings', [section])
+          .then(function() {
+            assertFalse(section.hiddenBySearch);
 
-        const highlightWrapper = div.querySelector('.search-highlight-wrapper');
-        assertTrue(!!highlightWrapper);
+            const highlightWrapper =
+                div.querySelector('.search-highlight-wrapper');
+            assertTrue(!!highlightWrapper);
 
-        const originalContent = highlightWrapper.querySelector(
-            '.search-highlight-original-content');
-        assertTrue(!!originalContent);
-        assertEquals(optionText, originalContent.textContent);
+            const originalContent = highlightWrapper.querySelector(
+                '.search-highlight-original-content');
+            assertTrue(!!originalContent);
+            assertEquals(optionText, originalContent.textContent);
 
-        const searchHits = highlightWrapper.querySelectorAll(
-            '.search-highlight-hit');
-        assertEquals(1, searchHits.length);
-        assertEquals('Settings', searchHits[0].textContent);
+            const searchHits =
+                highlightWrapper.querySelectorAll('.search-highlight-hit');
+            assertEquals(1, searchHits.length);
+            assertEquals('Settings', searchHits[0].textContent);
 
-        // Check that original DOM structure is restored when search
-        // highlights are cleared.
-        return searchManager.search('', section);
-      }).then(function() {
-        assertEquals(0, div.children.length);
-        assertEquals(optionText, div.textContent);
-      });
+            // Check that original DOM structure is restored when search
+            // highlights are cleared.
+            return searchManager.search('', [section]);
+          })
+          .then(function() {
+            assertEquals(0, div.children.length);
+            assertEquals(optionText, div.textContent);
+          });
     });
 
     /**
@@ -81,23 +84,25 @@
       const select = section.querySelector('select');
 
       assertTrue(section.hiddenBySearch);
-      return searchManager.search('settings', section).then(function() {
-        assertFalse(section.hiddenBySearch);
+      return searchManager.search('settings', [section])
+          .then(function() {
+            assertFalse(section.hiddenBySearch);
 
-        const highlightWrapper = select.querySelector(
-            '.search-highlight-wrapper');
-        assertFalse(!!highlightWrapper);
+            const highlightWrapper =
+                select.querySelector('.search-highlight-wrapper');
+            assertFalse(!!highlightWrapper);
 
-        // Check that original DOM structure is present even after search
-        // highlights are cleared.
-        return searchManager.search('', section);
-      }).then(function() {
-        const options = select.querySelectorAll('option');
-        assertEquals(3, options.length);
-        assertEquals('Foo', options[0].textContent);
-        assertEquals('Settings', options[1].textContent);
-        assertEquals('Baz', options[2].textContent);
-      });
+            // Check that original DOM structure is present even after search
+            // highlights are cleared.
+            return searchManager.search('', [section]);
+          })
+          .then(function() {
+            const options = select.querySelectorAll('option');
+            assertEquals(3, options.length);
+            assertEquals('Foo', options[0].textContent);
+            assertEquals('Settings', options[1].textContent);
+            assertEquals('Baz', options[2].textContent);
+          });
     });
 
     test('ignored elements are ignored', function() {
@@ -119,7 +124,7 @@
       const section = document.querySelector('settings-section');
       assertTrue(section.hiddenBySearch);
 
-      return searchManager.search(text, section).then(function() {
+      return searchManager.search(text, [section]).then(function() {
         assertTrue(section.hiddenBySearch);
       });
     });
@@ -141,15 +146,95 @@
       const sections = Array.prototype.slice.call(
           document.querySelectorAll('settings-section'));
 
-      return Promise.all(sections.map(s => searchManager.search('there', s)))
-          .then(function(requests) {
-            assertTrue(requests[0].didFindMatches());
+      return Promise.all(sections.map(s => searchManager.search('there', [s])))
+          .then(function(results) {
+            assertTrue(results[0].didFindMatches);
             assertFalse(sections[0].hiddenBySearch);
-            assertTrue(requests[1].didFindMatches());
+            assertTrue(results[1].didFindMatches);
             assertFalse(sections[1].hiddenBySearch);
-            assertFalse(requests[2].didFindMatches());
+            assertFalse(results[2].didFindMatches);
             assertTrue(sections[2].hiddenBySearch);
           });
     });
+
+    test('search is redone when text is changed', function() {
+      const observer = /** @type {!settings.SearchManagerObserver} */ ((() => {
+        let resolver;
+        return {
+          onSearchStart() {},
+          onSearchComplete(searchResult) {
+            resolver.resolve(searchResult);
+          },
+          waitForSearchComplete(doSearch) {
+            resolver = new PromiseResolver();
+            doSearch();
+            return resolver.promise;
+          }
+        };
+      })());
+      searchManager.registerObserver(observer);
+
+      const originalText = 'FooSettingsFoo';
+
+      document.body.innerHTML = `<settings-section hidden-by-search>
+            <div id="mydiv">${originalText}</div>
+          </settings-section>`;
+
+      const section = document.querySelector('settings-section');
+      const div = document.querySelector('#mydiv');
+      assertTrue(section.hiddenBySearch);
+      return observer
+          .waitForSearchComplete(() => {
+            searchManager.search('settings', [document.body]);
+          })
+          .then(searchResult => {
+            assertFalse(section.hiddenBySearch);
+            const expected = {
+              canceled: false,
+              didFindMatches: true,
+              rawQuery: 'settings',
+              wasClearSearch: false,
+            };
+            assertDeepEquals(expected, searchResult);
+            const highlightWrapper =
+                div.querySelector('.search-highlight-wrapper');
+            assertTrue(!!highlightWrapper);
+            const originalContent = highlightWrapper.querySelector(
+                '.search-highlight-original-content');
+            assertTrue(!!originalContent);
+            return observer.waitForSearchComplete(() => {
+              originalContent.childNodes[0].nodeValue = 'Foo';
+            });
+          })
+          .then(searchResult => {
+            assertTrue(section.hiddenBySearch);
+            const expected = {
+              canceled: false,
+              didFindMatches: false,
+              rawQuery: 'settings',
+              wasClearSearch: false,
+            };
+            assertDeepEquals(expected, searchResult);
+            const highlightWrapper =
+                div.querySelector('.search-highlight-wrapper');
+            assertTrue(!highlightWrapper);
+            return observer.waitForSearchComplete(() => {
+              div.childNodes[0].nodeValue = originalText;
+            });
+          })
+          .then(searchResult => {
+            assertFalse(section.hiddenBySearch);
+            const expected = {
+              canceled: false,
+              didFindMatches: true,
+              rawQuery: 'settings',
+              wasClearSearch: false,
+            };
+            assertDeepEquals(expected, searchResult);
+            const highlightWrapper =
+                div.querySelector('.search-highlight-wrapper');
+            assertTrue(!!highlightWrapper);
+          });
+    });
   });
 });
diff --git a/chrome/test/data/webui/settings/settings_main_test.js b/chrome/test/data/webui/settings/settings_main_test.js
index ae5c707..792a3992 100644
--- a/chrome/test/data/webui/settings/settings_main_test.js
+++ b/chrome/test/data/webui/settings/settings_main_test.js
@@ -22,6 +22,9 @@
 
       /** @private {?settings.SearchRequest} */
       this.searchRequest_ = null;
+
+      /** @private {?settings.SearchManagerObserver} */
+      this.observer_ = null;
     }
 
     /**
@@ -33,6 +36,7 @@
 
     /** @override */
     search(text, page) {
+      this.observer_.onSearchStart();
       this.methodCalled('search', text);
 
       if (this.searchRequest_ == null || !this.searchRequest_.isSame(text)) {
@@ -40,9 +44,15 @@
         this.searchRequest_.finished = true;
         this.searchRequest_.updateMatches(this.matchesFound_);
         this.searchRequest_.resolver.resolve(this.searchRequest_);
+        this.observer_.onSearchComplete(this.searchRequest_.result());
       }
       return this.searchRequest_.resolver.promise;
     }
+
+    /** @override */
+    registerObserver(observer) {
+      this.observer_ = observer;
+    }
   }
 
   let settingsPrefs = null;
diff --git a/chrome/utility/chrome_content_utility_client.cc b/chrome/utility/chrome_content_utility_client.cc
index 7fef4b4..96ad383 100644
--- a/chrome/utility/chrome_content_utility_client.cc
+++ b/chrome/utility/chrome_content_utility_client.cc
@@ -193,8 +193,8 @@
   service_manager::EmbeddedServiceInfo profiling_info;
   profiling_info.task_runner = content::ChildThread::Get()->GetIOTaskRunner();
   profiling_info.factory =
-      base::Bind(&profiling::HeapProfilingService::CreateService);
-  services->emplace(profiling::mojom::kServiceName, profiling_info);
+      base::Bind(&heap_profiling::HeapProfilingService::CreateService);
+  services->emplace(heap_profiling::mojom::kServiceName, profiling_info);
 
 #if !defined(OS_ANDROID)
   service_manager::EmbeddedServiceInfo proxy_resolver_info;
diff --git a/components/autofill/android/BUILD.gn b/components/autofill/android/BUILD.gn
index 4105790..27eaab4 100644
--- a/components/autofill/android/BUILD.gn
+++ b/components/autofill/android/BUILD.gn
@@ -72,7 +72,6 @@
   ]
   java_files = [
     "java/src/org/chromium/components/autofill/AutofillDelegate.java",
-    "java/src/org/chromium/components/autofill/AutofillKeyboardAccessory.java",
     "java/src/org/chromium/components/autofill/AutofillPopup.java",
     "java/src/org/chromium/components/autofill/AutofillSuggestion.java",
   ]
diff --git a/components/autofill/android/java/res/values/colors.xml b/components/autofill/android/java/res/values/colors.xml
index cf4d73bd..416737f2f 100644
--- a/components/autofill/android/java/res/values/colors.xml
+++ b/components/autofill/android/java/res/values/colors.xml
@@ -8,6 +8,4 @@
     <!-- Text colors of warning messages for credit card and password forms. -->
     <color name="http_bad_warning_message_text">#C53929</color>
     <color name="insecure_context_payment_disabled_message_text">#646464</color>
-
-    <color name="keyboard_accessory_hint_icon">#4285F4</color>
 </resources>
diff --git a/components/autofill/android/java/res/values/dimens.xml b/components/autofill/android/java/res/values/dimens.xml
index 0dd6985..a4700f7 100644
--- a/components/autofill/android/java/res/values/dimens.xml
+++ b/components/autofill/android/java/res/values/dimens.xml
@@ -6,18 +6,6 @@
 -->
 <resources>
     <!--
-         Fallback values if the corresponding com.android.internal.R dimensions
-         cannot be retrieved by name.
-         Note: Constants taken directly from Android's core/res/values/config.xml.
-    -->
-    <dimen name="keyboard_accessory_chip_height">32dp</dimen>
-    <dimen name="keyboard_accessory_half_padding">4dp</dimen>
-    <dimen name="keyboard_accessory_height">48dp</dimen>
-    <dimen name="keyboard_accessory_padding">8dp</dimen>
-    <dimen name="keyboard_accessory_text_size">14sp</dimen>
-    <dimen name="keyboard_accessory_start_animation_translation">100dp</dimen>
-
-    <!--
          Larger label and icon sizes for Form-Not-Secure experiment
          (warning messages on credit card and password forms when users
          are on HTTP sites).
diff --git a/components/cronet/cronet_global_state_stubs.cc b/components/cronet/cronet_global_state_stubs.cc
index 12f9dca..1fb5008 100644
--- a/components/cronet/cronet_global_state_stubs.cc
+++ b/components/cronet/cronet_global_state_stubs.cc
@@ -20,10 +20,16 @@
 namespace {
 
 scoped_refptr<base::SingleThreadTaskRunner> InitializeAndCreateTaskRunner() {
+// TODO(https://crbug.com/816705): Chromium Debug bots use component builds,
+// which result in //base and other process-global state being shared between
+// the library and the test suite. Since the Debug build is only used to run
+// the Debug cronet_tests, assume the suite will define things, for now.
+#if defined(NDEBUG)
   // TODO(wez): Remove this once AtExitManager dependencies are gone.
   // This fails cronet_test in component builds, which are not supported.
   // See https://crbug.com/816705.
   ignore_result(new base::AtExitManager);
+#endif  // defined(NDEBUG)
 
   url::Initialize();
 
diff --git a/components/cronet/native/runnables_unittest.cc b/components/cronet/native/runnables_unittest.cc
index 26bde99..4adf124 100644
--- a/components/cronet/native/runnables_unittest.cc
+++ b/components/cronet/native/runnables_unittest.cc
@@ -144,6 +144,7 @@
   base::RunLoop().RunUntilIdle();
   ASSERT_TRUE(callback_called());
   Cronet_Executor_Destroy(executor);
+  Cronet_UrlRequestCallback_Destroy(callback);
 }
 
 // Example of posting application callback to the executor using OneClosure.
@@ -167,6 +168,7 @@
   base::RunLoop().RunUntilIdle();
   ASSERT_TRUE(callback_called());
   Cronet_Executor_Destroy(executor);
+  Cronet_UrlRequestCallback_Destroy(callback);
 }
 
 // Example of posting application callback to the executor and passing
@@ -195,6 +197,7 @@
   base::RunLoop().RunUntilIdle();
   ASSERT_TRUE(callback_called());
   Cronet_Executor_Destroy(executor);
+  Cronet_UrlRequestCallback_Destroy(callback);
 }
 
 }  // namespace
diff --git a/components/cronet/native/test/buffer_test.cc b/components/cronet/native/test/buffer_test.cc
index 85ce107..6f774a6 100644
--- a/components/cronet/native/test/buffer_test.cc
+++ b/components/cronet/native/test/buffer_test.cc
@@ -108,6 +108,7 @@
   EXPECT_EQ(Cronet_Buffer_GetSize(buffer), kTestBufferSize);
   Cronet_Buffer_Destroy(buffer);
   ASSERT_TRUE(on_destroy_called());
+  Cronet_BufferCallback_Destroy(buffer_callback);
 }
 
 // Example of posting application on_destroy to the executor and passing
@@ -129,6 +130,8 @@
   base::RunLoop().RunUntilIdle();
   ASSERT_TRUE(on_destroy_called());
   Cronet_Executor_Destroy(executor);
+  Cronet_BufferCallback_Destroy(buffer_callback);
+  Cronet_Runnable_Destroy(runnable);
 }
 
 }  // namespace
diff --git a/components/cronet/native/test/executors_test.cc b/components/cronet/native/test/executors_test.cc
index 76bf9a27..ba40d08 100644
--- a/components/cronet/native/test/executors_test.cc
+++ b/components/cronet/native/test/executors_test.cc
@@ -73,6 +73,7 @@
   Cronet_Executor_Destroy(executor);
   base::RunLoop().RunUntilIdle();
   ASSERT_TRUE(runnable_called());
+  Cronet_Runnable_Destroy(runnable);
 }
 
 }  // namespace
diff --git a/components/cronet/native/test/url_request_test.cc b/components/cronet/native/test/url_request_test.cc
index dd565b2..ffadef9 100644
--- a/components/cronet/native/test/url_request_test.cc
+++ b/components/cronet/native/test/url_request_test.cc
@@ -120,6 +120,7 @@
   Cronet_EngineParams_enable_check_result_set(engine_params, false);
   EXPECT_EQ(Cronet_RESULT_SUCCESS,
             Cronet_Engine_StartWithParams(engine, engine_params));
+  Cronet_EngineParams_Destroy(engine_params);
 
   Cronet_UrlRequestPtr request = Cronet_UrlRequest_Create();
   Cronet_UrlRequestParamsPtr request_params = Cronet_UrlRequestParams_Create();
diff --git a/components/cronet/native/url_request.cc b/components/cronet/native/url_request.cc
index 9bfdc7c..ca8efcd4 100644
--- a/components/cronet/native/url_request.cc
+++ b/components/cronet/native/url_request.cc
@@ -229,6 +229,16 @@
     return engine_->CheckResult(Cronet_RESULT_NULL_POINTER_EXECUTOR);
 
   VLOG(1) << "New Cronet_UrlRequest: " << url;
+
+  // Tests call InitWithParams() repeatedly on the same Cronet_UrlRequestPtr,
+  // rather than Destroy()ing and creating a new one, so ensure that any prior
+  // |request_| is not leaked (see https://crbug.com/829077).
+  {
+    base::AutoLock lock(lock_);
+    if (request_)
+      request_->Destroy(false);
+  }
+
   request_ = new CronetURLRequest(
       engine_->cronet_url_request_context(),
       std::make_unique<Callback>(url, this, callback, executor), GURL(url),
diff --git a/components/cronet/stale_host_resolver.cc b/components/cronet/stale_host_resolver.cc
index 9f95850..5b5a877 100644
--- a/components/cronet/stale_host_resolver.cc
+++ b/components/cronet/stale_host_resolver.cc
@@ -128,9 +128,7 @@
     RequestImpl* request_;
   };
 
-  bool have_network_request() const {
-    return network_request_.get() != nullptr;
-  }
+  bool have_network_request() const { return network_request_ != nullptr; }
   bool have_stale_data() const {
     return stale_error_ != net::ERR_DNS_CACHE_MISS;
   }
diff --git a/components/cronet/stale_host_resolver_unittest.cc b/components/cronet/stale_host_resolver_unittest.cc
index c7fae00f..af95cc2 100644
--- a/components/cronet/stale_host_resolver_unittest.cc
+++ b/components/cronet/stale_host_resolver_unittest.cc
@@ -122,15 +122,15 @@
     net::HostResolverImpl::ProcTaskParams proc_params(mock_proc_.get(), 1u);
     inner_resolver->set_proc_params_for_test(proc_params);
 
-    stale_resolver_ = base::WrapUnique(
-        new StaleHostResolver(std::move(inner_resolver), options_));
+    stale_resolver_ = std::make_unique<StaleHostResolver>(
+        std::move(inner_resolver), options_);
     resolver_ = stale_resolver_.get();
   }
 
   void DestroyResolver() {
     DCHECK(stale_resolver_);
 
-    stale_resolver_.reset();
+    stale_resolver_ = nullptr;
     resolver_ = nullptr;
   }
 
@@ -241,7 +241,7 @@
     DCHECK(resolver_);
     EXPECT_TRUE(resolve_pending_);
 
-    delete request_.release();
+    request_ = nullptr;
 
     resolve_pending_ = false;
   }
@@ -249,7 +249,7 @@
   void OnResolveComplete(int error) {
     EXPECT_TRUE(resolve_pending_);
 
-    request_.reset();
+    request_ = nullptr;
 
     resolve_error_ = error;
     resolve_pending_ = false;
@@ -381,7 +381,9 @@
 
 // Limited expired time cases are flaky under iOS and MACOS (crbug.com/792173).
 // Disallow other networks cases fail under Fuchsia (crbug.com/816143).
-#if defined(OS_IOS) || defined(OS_FUCHSIA) || defined(OS_MACOSX)
+// TODO(https://crbug.com/829097): Fix memory leaks and re-enable under ASAN.
+#if defined(OS_IOS) || defined(OS_FUCHSIA) || defined(OS_MACOSX) || \
+    defined(ADDRESS_SANITIZER)
 #define MAYBE_StaleUsability DISABLED_StaleUsability
 #else
 #define MAYBE_StaleUsability StaleUsability
@@ -483,6 +485,8 @@
   }
 }
 
+#if !defined(ADDRESS_SANITIZER)
+// TODO(https://crbug.com/829097): Fix memory leaks and re-enable under ASAN.
 TEST_F(StaleHostResolverTest, CreatedByContext) {
   URLRequestContextConfig config(
       // Enable QUIC.
@@ -545,6 +549,7 @@
   EXPECT_EQ(1u, resolve_addresses().size());
   EXPECT_EQ(kCacheAddress, resolve_addresses()[0].ToStringWithoutPort());
 }
+#endif  // !defined(ADDRESS_SANITIZER)
 
 }  // namespace
 
diff --git a/components/offline_pages/content/background_loader/background_loader_contents.cc b/components/offline_pages/content/background_loader/background_loader_contents.cc
index 17f1cdd..6f8f80cc 100644
--- a/components/offline_pages/content/background_loader/background_loader_contents.cc
+++ b/components/offline_pages/content/background_loader/background_loader_contents.cc
@@ -125,6 +125,7 @@
 }
 
 void BackgroundLoaderContents::AdjustPreviewsStateForNavigation(
+    content::WebContents* web_contents,
     content::PreviewsState* previews_state) {
   DCHECK(previews_state);
 
diff --git a/components/offline_pages/content/background_loader/background_loader_contents.h b/components/offline_pages/content/background_loader/background_loader_contents.h
index 20828b438..53863a7 100644
--- a/components/offline_pages/content/background_loader/background_loader_contents.h
+++ b/components/offline_pages/content/background_loader/background_loader_contents.h
@@ -90,6 +90,7 @@
                                   content::MediaStreamType type) override;
 
   void AdjustPreviewsStateForNavigation(
+      content::WebContents* web_contents,
       content::PreviewsState* previews_state) override;
 
  private:
diff --git a/components/offline_pages/content/background_loader/background_loader_contents_unittest.cc b/components/offline_pages/content/background_loader/background_loader_contents_unittest.cc
index 7f45500..645ecd19 100644
--- a/components/offline_pages/content/background_loader/background_loader_contents_unittest.cc
+++ b/components/offline_pages/content/background_loader/background_loader_contents_unittest.cc
@@ -182,28 +182,28 @@
 
   // If the state starts out as off or disabled, it should stay that way.
   previews_state = content::PREVIEWS_OFF;
-  contents()->AdjustPreviewsStateForNavigation(&previews_state);
+  contents()->AdjustPreviewsStateForNavigation(nullptr, &previews_state);
   EXPECT_EQ(previews_state, content::PREVIEWS_OFF);
   previews_state = content::PREVIEWS_NO_TRANSFORM;
-  contents()->AdjustPreviewsStateForNavigation(&previews_state);
+  contents()->AdjustPreviewsStateForNavigation(nullptr, &previews_state);
   EXPECT_EQ(previews_state, content::PREVIEWS_NO_TRANSFORM);
 
   // If the state starts out as a state unfriendly to offlining, we should
   // and out the unfriendly previews.
   previews_state = content::SERVER_LOFI_ON | content::CLIENT_LOFI_ON;
-  contents()->AdjustPreviewsStateForNavigation(&previews_state);
+  contents()->AdjustPreviewsStateForNavigation(nullptr, &previews_state);
   EXPECT_EQ(previews_state, content::SERVER_LOFI_ON);
 
   // If the state starts out as offlining friendly previews, we should preserve
   // them.
   previews_state = content::PARTIAL_CONTENT_SAFE_PREVIEWS;
-  contents()->AdjustPreviewsStateForNavigation(&previews_state);
+  contents()->AdjustPreviewsStateForNavigation(nullptr, &previews_state);
   EXPECT_EQ(previews_state, content::PARTIAL_CONTENT_SAFE_PREVIEWS);
 
   // If there are only offlining unfriendly previews, they should all get turned
   // off.
   previews_state = content::CLIENT_LOFI_ON;
-  contents()->AdjustPreviewsStateForNavigation(&previews_state);
+  contents()->AdjustPreviewsStateForNavigation(nullptr, &previews_state);
   EXPECT_EQ(previews_state, content::PREVIEWS_OFF);
 }
 
diff --git a/components/password_manager/core/browser/form_parsing/ios_form_parser.cc b/components/password_manager/core/browser/form_parsing/ios_form_parser.cc
index e645e05..ff2e1b4 100644
--- a/components/password_manager/core/browser/form_parsing/ios_form_parser.cc
+++ b/components/password_manager/core/browser/form_parsing/ios_form_parser.cc
@@ -307,10 +307,8 @@
 
 }  // namespace
 
-IOSFormParser::IOSFormParser() = default;
-
-std::unique_ptr<PasswordForm> IOSFormParser::Parse(const FormData& form_data,
-                                                   FormParsingMode mode) {
+std::unique_ptr<PasswordForm> ParseFormData(const FormData& form_data,
+                                            FormParsingMode mode) {
   FieldPointersVector fields = GetNonCreditCardFields(form_data.fields);
 
   // Skip forms without password fields.
diff --git a/components/password_manager/core/browser/form_parsing/ios_form_parser.h b/components/password_manager/core/browser/form_parsing/ios_form_parser.h
index d0d7e20..663a366 100644
--- a/components/password_manager/core/browser/form_parsing/ios_form_parser.h
+++ b/components/password_manager/core/browser/form_parsing/ios_form_parser.h
@@ -16,17 +16,12 @@
 
 enum class FormParsingMode { FILLING, SAVING };
 
-class IOSFormParser {
- public:
-  IOSFormParser();
-
-  // Parse DOM information |form_data| to Password Manager form representation
-  // PasswordForm.
-  // Return nullptr when parsing is unsuccessful.
-  std::unique_ptr<autofill::PasswordForm> Parse(
-      const autofill::FormData& form_data,
-      FormParsingMode mode);
-};
+// Parse DOM information |form_data| into Password Manager' form representation
+// PasswordForm.
+// Return nullptr when parsing is unsuccessful.
+std::unique_ptr<autofill::PasswordForm> ParseFormData(
+    const autofill::FormData& form_data,
+    FormParsingMode mode);
 
 }  // namespace password_manager
 
diff --git a/components/password_manager/core/browser/form_parsing/ios_form_parser_unittest.cc b/components/password_manager/core/browser/form_parsing/ios_form_parser_unittest.cc
index ba787ae..2391290 100644
--- a/components/password_manager/core/browser/form_parsing/ios_form_parser_unittest.cc
+++ b/components/password_manager/core/browser/form_parsing/ios_form_parser_unittest.cc
@@ -63,8 +63,6 @@
   IOSFormParserTest() {}
 
  protected:
-  IOSFormParser form_parser_;
-
   void CheckTestData(const std::vector<FormParsingTestCase>& test_cases);
 };
 
@@ -144,7 +142,7 @@
           << test_case.description << ", parsing mode = "
           << (mode == FormParsingMode::FILLING ? "Filling" : "Saving"));
       std::unique_ptr<PasswordForm> parsed_form =
-          form_parser_.Parse(form_data, mode);
+          ParseFormData(form_data, mode);
 
       const ParseResultIndices& expected_indices =
           mode == FormParsingMode::FILLING ? test_case.fill_result
diff --git a/components/payments/content/service_worker_payment_instrument.cc b/components/payments/content/service_worker_payment_instrument.cc
index 4beede0..9d98c00 100644
--- a/components/payments/content/service_worker_payment_instrument.cc
+++ b/components/payments/content/service_worker_payment_instrument.cc
@@ -202,8 +202,7 @@
             : *(installable_web_app_info_->icon),
         installable_web_app_info_->sw_js_url,
         installable_web_app_info_->sw_scope,
-        installable_web_app_info_->sw_use_cache,
-        std::vector<std::string>(1, installable_enabled_method_),
+        installable_web_app_info_->sw_use_cache, installable_enabled_method_,
         base::BindOnce(&ServiceWorkerPaymentInstrument::OnPaymentAppInvoked,
                        weak_ptr_factory_.GetWeakPtr()));
   } else {
diff --git a/components/services/heap_profiling/address.h b/components/services/heap_profiling/address.h
index 4b1b9e4..621dd61c 100644
--- a/components/services/heap_profiling/address.h
+++ b/components/services/heap_profiling/address.h
@@ -12,7 +12,7 @@
 
 #include "base/hash.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 // Wrapper around an address in the instrumented process. This wrapper should
 // be a zero-overhead abstraction around a 64-bit integer (so pass by value)
@@ -47,13 +47,13 @@
   int64_t operator-(Address a) const { return value - a.value; }
 };
 
-}  // namespace profiling
+}  // namespace heap_profiling
 
 namespace std {
 
 template <>
-struct hash<profiling::Address> {
-  typedef profiling::Address argument_type;
+struct hash<heap_profiling::Address> {
+  typedef heap_profiling::Address argument_type;
   typedef uint32_t result_type;
   result_type operator()(argument_type a) const {
     return base::Hash(&a.value, sizeof(int64_t));
diff --git a/components/services/heap_profiling/allocation_event.cc b/components/services/heap_profiling/allocation_event.cc
index a1f283eb..e56449178 100644
--- a/components/services/heap_profiling/allocation_event.cc
+++ b/components/services/heap_profiling/allocation_event.cc
@@ -4,7 +4,7 @@
 
 #include "components/services/heap_profiling/allocation_event.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 AllocationEvent::AllocationEvent(AllocatorType allocator,
                                  Address addr,
@@ -26,4 +26,4 @@
   return map;
 }
 
-}  // namespace profiling
+}  // namespace heap_profiling
diff --git a/components/services/heap_profiling/allocation_event.h b/components/services/heap_profiling/allocation_event.h
index b923d769..3d3726a6 100644
--- a/components/services/heap_profiling/allocation_event.h
+++ b/components/services/heap_profiling/allocation_event.h
@@ -13,7 +13,7 @@
 #include "components/services/heap_profiling/backtrace_storage.h"
 #include "components/services/heap_profiling/public/cpp/stream.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 // This class is copyable and assignable.
 //
@@ -49,7 +49,7 @@
 
   struct HashByAddress {
     size_t operator()(const AllocationEvent& event) const {
-      std::hash<profiling::Address> hasher;
+      std::hash<Address> hasher;
       return hasher(event.address());
     }
   };
@@ -98,6 +98,6 @@
 // in the set with that metadata.
 AllocationCountMap AllocationEventSetToCountMap(const AllocationEventSet& set);
 
-}  // namespace profiling
+}  // namespace heap_profiling
 
 #endif  // COMPONENTS_SERVICES_HEAP_PROFILING_ALLOCATION_EVENT_H_
diff --git a/components/services/heap_profiling/allocation_tracker.cc b/components/services/heap_profiling/allocation_tracker.cc
index b29624a..97bb4ea 100644
--- a/components/services/heap_profiling/allocation_tracker.cc
+++ b/components/services/heap_profiling/allocation_tracker.cc
@@ -9,7 +9,7 @@
 #include "base/threading/thread_task_runner_handle.h"
 #include "components/services/heap_profiling/backtrace_storage.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 AllocationTracker::AllocationTracker(CompleteCallback complete_cb,
                                      BacktraceStorage* backtrace_storage)
@@ -119,4 +119,4 @@
       std::make_pair(std::move(callback_runner), std::move(callback));
 }
 
-}  // namespace profiling
+}  // namespace heap_profiling
diff --git a/components/services/heap_profiling/allocation_tracker.h b/components/services/heap_profiling/allocation_tracker.h
index 26604fd3..a479dbec 100644
--- a/components/services/heap_profiling/allocation_tracker.h
+++ b/components/services/heap_profiling/allocation_tracker.h
@@ -16,7 +16,7 @@
 #include "components/services/heap_profiling/backtrace_storage.h"
 #include "components/services/heap_profiling/receiver.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 // Tracks live allocations in one process. This is an analogue to memory-infra
 // allocation register and needs to be merged/deduped.
@@ -93,6 +93,6 @@
   DISALLOW_COPY_AND_ASSIGN(AllocationTracker);
 };
 
-}  // namespace profiling
+}  // namespace heap_profiling
 
 #endif  // COMPONENTS_SERVICES_HEAP_PROFILING_ALLOCATION_TRACKER_H_
diff --git a/components/services/heap_profiling/backtrace.cc b/components/services/heap_profiling/backtrace.cc
index 6f9e24b..5889b18 100644
--- a/components/services/heap_profiling/backtrace.cc
+++ b/components/services/heap_profiling/backtrace.cc
@@ -11,7 +11,7 @@
 #include "base/hash.h"
 #include "components/services/heap_profiling/backtrace_storage.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 namespace {
 
@@ -45,4 +45,4 @@
   return !operator==(other);
 }
 
-}  // namespace profiling
+}  // namespace heap_profiling
diff --git a/components/services/heap_profiling/backtrace.h b/components/services/heap_profiling/backtrace.h
index 10b8a31..d526423 100644
--- a/components/services/heap_profiling/backtrace.h
+++ b/components/services/heap_profiling/backtrace.h
@@ -11,7 +11,7 @@
 #include "base/macros.h"
 #include "components/services/heap_profiling/address.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 // Holds a move-only stack backtrace and a precomputed hash. This backtrace
 // uses addresses in the instrumented process. This is in contrast to
@@ -60,13 +60,13 @@
   DISALLOW_COPY_AND_ASSIGN(Backtrace);
 };
 
-}  // namespace profiling
+}  // namespace heap_profiling
 
 namespace std {
 
 template <>
-struct hash<profiling::Backtrace> {
-  using argument_type = profiling::Backtrace;
+struct hash<heap_profiling::Backtrace> {
+  using argument_type = heap_profiling::Backtrace;
   using result_type = size_t;
   result_type operator()(const argument_type& s) const {
     return s.fingerprint();
diff --git a/components/services/heap_profiling/backtrace_storage.cc b/components/services/heap_profiling/backtrace_storage.cc
index 789de6ba..a3445823 100644
--- a/components/services/heap_profiling/backtrace_storage.cc
+++ b/components/services/heap_profiling/backtrace_storage.cc
@@ -7,7 +7,7 @@
 #include "base/logging.h"
 #include "components/services/heap_profiling/backtrace.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 namespace {
 constexpr size_t kShardCount = 64;
@@ -132,4 +132,4 @@
 BacktraceStorage::ContainerShard::ContainerShard() = default;
 BacktraceStorage::ContainerShard::~ContainerShard() = default;
 
-}  // namespace profiling
+}  // namespace heap_profiling
diff --git a/components/services/heap_profiling/backtrace_storage.h b/components/services/heap_profiling/backtrace_storage.h
index 540f214a..eec20a4 100644
--- a/components/services/heap_profiling/backtrace_storage.h
+++ b/components/services/heap_profiling/backtrace_storage.h
@@ -13,7 +13,7 @@
 #include "base/synchronization/lock.h"
 #include "components/services/heap_profiling/backtrace.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 // Backtraces are stored effectively as atoms, and this class is the backing
 // store for the atoms. When you insert a backtrace, it will get de-duped with
@@ -102,6 +102,6 @@
   DISALLOW_COPY_AND_ASSIGN(BacktraceStorage);
 };
 
-}  // namespace profiling
+}  // namespace heap_profiling
 
 #endif  // COMPONENTS_SERVICES_HEAP_PROFILING_BACKTRACE_STORAGE_H_
diff --git a/components/services/heap_profiling/backtrace_storage_unittest.cc b/components/services/heap_profiling/backtrace_storage_unittest.cc
index 4ed9828..3983d78 100644
--- a/components/services/heap_profiling/backtrace_storage_unittest.cc
+++ b/components/services/heap_profiling/backtrace_storage_unittest.cc
@@ -8,7 +8,7 @@
 
 #include "testing/gtest/include/gtest/gtest.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 TEST(BacktraceStorage, KeyStability) {
   BacktraceStorage storage;
@@ -31,4 +31,4 @@
   }
 }
 
-}  // namespace profiling
+}  // namespace heap_profiling
diff --git a/components/services/heap_profiling/connection_manager.cc b/components/services/heap_profiling/connection_manager.cc
index 5f90017..b612a424 100644
--- a/components/services/heap_profiling/connection_manager.cc
+++ b/components/services/heap_profiling/connection_manager.cc
@@ -24,7 +24,7 @@
 #include <io.h>
 #endif
 
-namespace profiling {
+namespace heap_profiling {
 
 namespace {
 const size_t kMinSizeThreshold = 16 * 1024;
@@ -213,10 +213,9 @@
 void ConnectionManager::ReportMetrics() {
   base::AutoLock lock(connections_lock_);
   for (auto& pair : connections_) {
-    UMA_HISTOGRAM_ENUMERATION(
-        "OutOfProcessHeapProfiling.ProfiledProcess.Type",
-        pair.second->process_type,
-        static_cast<int>(profiling::mojom::ProcessType::LAST) + 1);
+    UMA_HISTOGRAM_ENUMERATION("OutOfProcessHeapProfiling.ProfiledProcess.Type",
+                              pair.second->process_type,
+                              static_cast<int>(mojom::ProcessType::LAST) + 1);
   }
 }
 
@@ -370,4 +369,4 @@
                      std::move(finished_callback)));
 }
 
-}  // namespace profiling
+}  // namespace heap_profiling
diff --git a/components/services/heap_profiling/connection_manager.h b/components/services/heap_profiling/connection_manager.h
index 33886cd..55db159 100644
--- a/components/services/heap_profiling/connection_manager.h
+++ b/components/services/heap_profiling/connection_manager.h
@@ -30,7 +30,7 @@
 
 }  // namespace base
 
-namespace profiling {
+namespace heap_profiling {
 
 using VmRegions =
     std::unordered_map<base::ProcessId,
@@ -143,6 +143,6 @@
   DISALLOW_COPY_AND_ASSIGN(ConnectionManager);
 };
 
-}  // namespace profiling
+}  // namespace heap_profiling
 
 #endif  // COMPONENTS_SERVICES_HEAP_PROFILING_CONNECTION_MANAGER_H_
diff --git a/components/services/heap_profiling/heap_profiling_manifest.json b/components/services/heap_profiling/heap_profiling_manifest.json
index 014a40dd..40d94cb 100644
--- a/components/services/heap_profiling/heap_profiling_manifest.json
+++ b/components/services/heap_profiling/heap_profiling_manifest.json
@@ -5,7 +5,7 @@
   "interface_provider_specs": {
     "service_manager:connector": {
       "provides": {
-        "profiling": [ "profiling::mojom::ProfilingService" ],
+        "profiling": [ "heap_profiling::mojom::ProfilingService" ],
         "heap_profiler": [ "memory_instrumentation::mojom::HeapProfiler" ]
       },
       "requires": {
diff --git a/components/services/heap_profiling/heap_profiling_service.cc b/components/services/heap_profiling/heap_profiling_service.cc
index c86ecb5..2e69ab1f 100644
--- a/components/services/heap_profiling/heap_profiling_service.cc
+++ b/components/services/heap_profiling/heap_profiling_service.cc
@@ -11,7 +11,7 @@
 #include "services/resource_coordinator/public/mojom/service_constants.mojom.h"
 #include "services/service_manager/public/cpp/service_context.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 HeapProfilingService::HeapProfilingService()
     : binding_(this), heap_profiler_binding_(this), weak_factory_(this) {}
@@ -104,4 +104,4 @@
       std::move(callback), std::move(vm_regions));
 }
 
-}  // namespace profiling
+}  // namespace heap_profiling
diff --git a/components/services/heap_profiling/heap_profiling_service.h b/components/services/heap_profiling/heap_profiling_service.h
index 3d73b661..b468a96 100644
--- a/components/services/heap_profiling/heap_profiling_service.h
+++ b/components/services/heap_profiling/heap_profiling_service.h
@@ -13,7 +13,7 @@
 #include "services/service_manager/public/cpp/binder_registry.h"
 #include "services/service_manager/public/cpp/service.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 // Service implementation for Profiling. This will be called in the profiling
 // process (which is a sandboxed utility process created on demand by the
@@ -81,6 +81,6 @@
   base::WeakPtrFactory<HeapProfilingService> weak_factory_;
 };
 
-}  // namespace profiling
+}  // namespace heap_profiling
 
 #endif  // COMPONENTS_SERVICES_HEAP_PROFILING_HEAP_PROFILING_SERVICE_H_
diff --git a/components/services/heap_profiling/json_exporter.cc b/components/services/heap_profiling/json_exporter.cc
index e80bd2ab0..9a03102 100644
--- a/components/services/heap_profiling/json_exporter.cc
+++ b/components/services/heap_profiling/json_exporter.cc
@@ -15,7 +15,7 @@
 #include "base/strings/stringprintf.h"
 #include "services/resource_coordinator/public/cpp/memory_instrumentation/tracing_observer.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 namespace {
 
@@ -520,4 +520,4 @@
   out << "}\n";
 }
 
-}  // namespace profiling
+}  // namespace heap_profiling
diff --git a/components/services/heap_profiling/json_exporter.h b/components/services/heap_profiling/json_exporter.h
index fb4b700b..2357862d 100644
--- a/components/services/heap_profiling/json_exporter.h
+++ b/components/services/heap_profiling/json_exporter.h
@@ -14,7 +14,7 @@
 #include "components/services/heap_profiling/public/mojom/heap_profiling_service.mojom.h"
 #include "services/resource_coordinator/public/mojom/memory_instrumentation/memory_instrumentation.mojom.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 // Configuration passed to the export functions because they take many
 // arguments. All parameters must be set.
@@ -69,6 +69,6 @@
 void ExportMemoryMapsAndV2StackTraceToJSON(ExportParams* params,
                                            std::ostream& out);
 
-}  // namespace profiling
+}  // namespace heap_profiling
 
 #endif  // COMPONENTS_SERVICES_HEAP_PROFILING_JSON_EXPORTER_H_
diff --git a/components/services/heap_profiling/json_exporter_unittest.cc b/components/services/heap_profiling/json_exporter_unittest.cc
index 1d958ca..6347b86 100644
--- a/components/services/heap_profiling/json_exporter_unittest.cc
+++ b/components/services/heap_profiling/json_exporter_unittest.cc
@@ -17,7 +17,7 @@
 #include "services/resource_coordinator/public/cpp/memory_instrumentation/os_metrics.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 namespace {
 
@@ -591,4 +591,4 @@
   ASSERT_TRUE(found_no_context);
 }
 
-}  // namespace profiling
+}  // namespace heap_profiling
diff --git a/components/services/heap_profiling/public/cpp/BUILD.gn b/components/services/heap_profiling/public/cpp/BUILD.gn
index fdfc2dc..474cf90 100644
--- a/components/services/heap_profiling/public/cpp/BUILD.gn
+++ b/components/services/heap_profiling/public/cpp/BUILD.gn
@@ -11,6 +11,8 @@
     "sender_pipe.h",
     "sender_pipe_posix.cc",
     "sender_pipe_win.cc",
+    "settings.cc",
+    "settings.h",
     "stream.h",
     "switches.cc",
     "switches.h",
diff --git a/components/services/heap_profiling/public/cpp/allocator_shim.cc b/components/services/heap_profiling/public/cpp/allocator_shim.cc
index 4b531c5..0201f3d 100644
--- a/components/services/heap_profiling/public/cpp/allocator_shim.cc
+++ b/components/services/heap_profiling/public/cpp/allocator_shim.cc
@@ -38,7 +38,7 @@
 using base::trace_event::AllocationContextTracker;
 using CaptureMode = base::trace_event::AllocationContextTracker::CaptureMode;
 
-namespace profiling {
+namespace heap_profiling {
 
 namespace {
 
@@ -882,4 +882,4 @@
   *g_on_init_allocator_shim_task_runner_.Pointer() = task_runner;
 }
 
-}  // namespace profiling
+}  // namespace heap_profiling
diff --git a/components/services/heap_profiling/public/cpp/allocator_shim.h b/components/services/heap_profiling/public/cpp/allocator_shim.h
index f88a6c9..0ee3b46c 100644
--- a/components/services/heap_profiling/public/cpp/allocator_shim.h
+++ b/components/services/heap_profiling/public/cpp/allocator_shim.h
@@ -9,7 +9,7 @@
 #include "components/services/heap_profiling/public/cpp/stream.h"
 #include "components/services/heap_profiling/public/mojom/heap_profiling_client.mojom.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 // Initializes the TLS slot globally. This will be called early in Chrome's
 // lifecycle to prevent re-entrancy from occurring while trying to set up the
@@ -61,6 +61,6 @@
     base::OnceClosure callback,
     scoped_refptr<base::TaskRunner> task_runner);
 
-}  // namespace profiling
+}  // namespace heap_profiling
 
 #endif  // COMPONENTS_SERVICES_HEAP_PROFILING_PUBLIC_CPP_ALLOCATOR_SHIM_H_
diff --git a/components/services/heap_profiling/public/cpp/client.cc b/components/services/heap_profiling/public/cpp/client.cc
index 1838f6d..633ba38 100644
--- a/components/services/heap_profiling/public/cpp/client.cc
+++ b/components/services/heap_profiling/public/cpp/client.cc
@@ -13,7 +13,7 @@
 #include "components/services/heap_profiling/public/cpp/stream.h"
 #include "mojo/public/cpp/system/platform_handle.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 namespace {
 const int kTimeoutDurationMs = 10000;
@@ -74,4 +74,4 @@
   AllocatorShimFlushPipe(barrier_id);
 }
 
-}  // namespace profiling
+}  // namespace heap_profiling
diff --git a/components/services/heap_profiling/public/cpp/client.h b/components/services/heap_profiling/public/cpp/client.h
index 1cec56a..f3eb465 100644
--- a/components/services/heap_profiling/public/cpp/client.h
+++ b/components/services/heap_profiling/public/cpp/client.h
@@ -9,7 +9,7 @@
 #include "mojo/public/cpp/bindings/binding_set.h"
 #include "mojo/public/cpp/system/handle.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 class SenderPipe;
 
@@ -26,7 +26,7 @@
   void StartProfiling(mojom::ProfilingParamsPtr params) override;
   void FlushMemlogPipe(uint32_t barrier_id) override;
 
-  void BindToInterface(profiling::mojom::ProfilingClientRequest request);
+  void BindToInterface(mojom::ProfilingClientRequest request);
 
  private:
   // Ideally, this would be a mojo::Binding that would only keep alive one
@@ -42,6 +42,6 @@
   std::unique_ptr<SenderPipe> sender_pipe_;
 };
 
-}  // namespace profiling
+}  // namespace heap_profiling
 
 #endif  // COMPONENTS_SERVICES_HEAP_PROFILING_PUBLIC_CPP_CLIENT_H_
diff --git a/components/services/heap_profiling/public/cpp/sender_pipe.h b/components/services/heap_profiling/public/cpp/sender_pipe.h
index a5b221b..95cd279 100644
--- a/components/services/heap_profiling/public/cpp/sender_pipe.h
+++ b/components/services/heap_profiling/public/cpp/sender_pipe.h
@@ -12,7 +12,7 @@
 #include "base/synchronization/lock.h"
 #include "mojo/edk/embedder/scoped_platform_handle.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 class SenderPipe {
  public:
@@ -66,6 +66,6 @@
   DISALLOW_COPY_AND_ASSIGN(SenderPipe);
 };
 
-}  // namespace profiling
+}  // namespace heap_profiling
 
 #endif  // COMPONENTS_SERVICES_HEAP_PROFILING_PUBLIC_CPP_SENDER_PIPE_H_
diff --git a/components/services/heap_profiling/public/cpp/sender_pipe_posix.cc b/components/services/heap_profiling/public/cpp/sender_pipe_posix.cc
index fbb60dd..2db7f480 100644
--- a/components/services/heap_profiling/public/cpp/sender_pipe_posix.cc
+++ b/components/services/heap_profiling/public/cpp/sender_pipe_posix.cc
@@ -15,7 +15,7 @@
 #include "build/build_config.h"
 #include "components/services/heap_profiling/public/cpp/stream.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 SenderPipe::PipePair::PipePair() {
   // We create a pipe() rather than a socketpair(). On macOS, this causes writes
@@ -105,4 +105,4 @@
   file_.reset();
 }
 
-}  // namespace profiling
+}  // namespace heap_profiling
diff --git a/components/services/heap_profiling/public/cpp/sender_pipe_unittest.cc b/components/services/heap_profiling/public/cpp/sender_pipe_unittest.cc
index d815b5d..edd52158 100644
--- a/components/services/heap_profiling/public/cpp/sender_pipe_unittest.cc
+++ b/components/services/heap_profiling/public/cpp/sender_pipe_unittest.cc
@@ -14,7 +14,7 @@
 #include "mojo/edk/embedder/platform_channel_pair.h"
 #endif
 
-namespace profiling {
+namespace heap_profiling {
 namespace {
 
 using Result = SenderPipe::Result;
@@ -95,4 +95,4 @@
 }
 
 }  // namespace
-}  // namespace profiling
+}  // namespace heap_profiling
diff --git a/components/services/heap_profiling/public/cpp/sender_pipe_win.cc b/components/services/heap_profiling/public/cpp/sender_pipe_win.cc
index 7dfa2862..3776a84 100644
--- a/components/services/heap_profiling/public/cpp/sender_pipe_win.cc
+++ b/components/services/heap_profiling/public/cpp/sender_pipe_win.cc
@@ -10,7 +10,7 @@
 #include "base/strings/utf_string_conversions.h"
 #include "components/services/heap_profiling/public/cpp/stream.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 namespace {
 
@@ -172,4 +172,4 @@
   file_.Close();
 }
 
-}  // namespace profiling
+}  // namespace heap_profiling
diff --git a/components/services/heap_profiling/public/cpp/settings.cc b/components/services/heap_profiling/public/cpp/settings.cc
new file mode 100644
index 0000000..5655d26
--- /dev/null
+++ b/components/services/heap_profiling/public/cpp/settings.cc
@@ -0,0 +1,156 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/services/heap_profiling/public/cpp/settings.h"
+
+#include "base/allocator/buildflags.h"
+#include "base/base_switches.h"
+#include "base/command_line.h"
+#include "base/feature_list.h"
+#include "base/metrics/field_trial_params.h"
+#include "base/strings/string_number_conversions.h"
+#include "components/services/heap_profiling/public/cpp/switches.h"
+
+namespace heap_profiling {
+
+const base::Feature kOOPHeapProfilingFeature{"OOPHeapProfiling",
+                                             base::FEATURE_DISABLED_BY_DEFAULT};
+const char kOOPHeapProfilingFeatureMode[] = "mode";
+
+namespace {
+
+const char kOOPHeapProfilingFeatureStackMode[] = "stack-mode";
+const char kOOPHeapProfilingFeatureSampling[] = "sampling";
+const char kOOPHeapProfilingFeatureSamplingRate[] = "sampling-rate";
+
+const uint32_t kDefaultSamplingRate = 10000;
+const bool kDefaultShouldSample = false;
+
+}  // namespace
+
+Mode GetModeForStartup() {
+  const base::CommandLine* cmdline = base::CommandLine::ForCurrentProcess();
+#if BUILDFLAG(USE_ALLOCATOR_SHIM)
+  if (cmdline->HasSwitch(kMemlog) ||
+      base::FeatureList::IsEnabled(kOOPHeapProfilingFeature)) {
+    if (cmdline->HasSwitch(switches::kEnableHeapProfiling)) {
+      // PartitionAlloc doesn't support chained allocation hooks so we can't
+      // run both heap profilers at the same time.
+      LOG(ERROR) << "--" << switches::kEnableHeapProfiling
+                 << " specified with --" << kMemlog
+                 << "which are not compatible. Memlog will be disabled.";
+      return Mode::kNone;
+    }
+
+    std::string mode;
+    // Respect the commandline switch above the field trial.
+    if (cmdline->HasSwitch(kMemlog)) {
+      mode = cmdline->GetSwitchValueASCII(kMemlog);
+    } else {
+      mode = base::GetFieldTrialParamValueByFeature(
+          kOOPHeapProfilingFeature, kOOPHeapProfilingFeatureMode);
+    }
+
+    return ConvertStringToMode(mode);
+  }
+  return Mode::kNone;
+#else
+  LOG_IF(ERROR, cmdline->HasSwitch(kMemlog))
+      << "--" << kMemlog
+      << " specified but it will have no effect because the use_allocator_shim "
+      << "is not available in this build.";
+  return Mode::kNone;
+#endif
+}
+
+Mode ConvertStringToMode(const std::string& mode) {
+  if (mode == kMemlogModeAll)
+    return Mode::kAll;
+  if (mode == kMemlogModeAllRenderers)
+    return Mode::kAllRenderers;
+  if (mode == kMemlogModeManual)
+    return Mode::kManual;
+  if (mode == kMemlogModeMinimal)
+    return Mode::kMinimal;
+  if (mode == kMemlogModeBrowser)
+    return Mode::kBrowser;
+  if (mode == kMemlogModeGpu)
+    return Mode::kGpu;
+  if (mode == kMemlogModeRendererSampling)
+    return Mode::kRendererSampling;
+  DLOG(ERROR) << "Unsupported value: \"" << mode << "\" passed to --"
+              << kMemlog;
+  return Mode::kNone;
+}
+
+mojom::StackMode GetStackModeForStartup() {
+  const base::CommandLine* cmdline = base::CommandLine::ForCurrentProcess();
+  std::string stack_mode;
+
+  // Respect the commandline switch above the field trial.
+  if (cmdline->HasSwitch(kMemlogStackMode)) {
+    stack_mode = cmdline->GetSwitchValueASCII(kMemlogStackMode);
+  } else {
+    stack_mode = base::GetFieldTrialParamValueByFeature(
+        kOOPHeapProfilingFeature, kOOPHeapProfilingFeatureStackMode);
+  }
+
+  return ConvertStringToStackMode(stack_mode);
+}
+
+mojom::StackMode ConvertStringToStackMode(const std::string& input) {
+  if (input == kMemlogStackModeNative)
+    return mojom::StackMode::NATIVE_WITHOUT_THREAD_NAMES;
+  if (input == kMemlogStackModeNativeWithThreadNames)
+    return mojom::StackMode::NATIVE_WITH_THREAD_NAMES;
+  if (input == kMemlogStackModePseudo)
+    return mojom::StackMode::PSEUDO;
+  if (input == kMemlogStackModeMixed)
+    return mojom::StackMode::MIXED;
+  DLOG(ERROR) << "Unsupported value: \"" << input << "\" passed to --"
+              << kMemlogStackMode;
+  return mojom::StackMode::NATIVE_WITHOUT_THREAD_NAMES;
+}
+
+bool GetShouldSampleForStartup() {
+  const base::CommandLine* cmdline = base::CommandLine::ForCurrentProcess();
+  if (cmdline->HasSwitch(kMemlogSampling))
+    return true;
+
+  return base::GetFieldTrialParamByFeatureAsBool(
+      kOOPHeapProfilingFeature, kOOPHeapProfilingFeatureSampling,
+      kDefaultShouldSample /* default_value */);
+}
+
+uint32_t GetSamplingRateForStartup() {
+  const base::CommandLine* cmdline = base::CommandLine::ForCurrentProcess();
+  if (cmdline->HasSwitch(kMemlogSamplingRate)) {
+    std::string rate_as_string =
+        cmdline->GetSwitchValueASCII(kMemlogSamplingRate);
+    int rate_as_int = 1;
+    if (!base::StringToInt(rate_as_string, &rate_as_int)) {
+      LOG(ERROR) << "Could not parse sampling rate: " << rate_as_string;
+    }
+    if (rate_as_int <= 0) {
+      LOG(ERROR) << "Invalid sampling rate: " << rate_as_string;
+      rate_as_int = 1;
+    }
+    return rate_as_int;
+  }
+
+  return base::GetFieldTrialParamByFeatureAsInt(
+      kOOPHeapProfilingFeature, kOOPHeapProfilingFeatureSamplingRate,
+      kDefaultSamplingRate /* default_value */);
+}
+
+bool IsBackgroundHeapProfilingEnabled() {
+  return base::FeatureList::IsEnabled(kOOPHeapProfilingFeature);
+}
+
+bool ShouldKeepSmallAllocations() {
+  return base::CommandLine::ForCurrentProcess()->HasSwitch(
+      kMemlogKeepSmallAllocations);
+}
+
+}  // namespace heap_profiling
diff --git a/components/services/heap_profiling/public/cpp/settings.h b/components/services/heap_profiling/public/cpp/settings.h
new file mode 100644
index 0000000..e451659
--- /dev/null
+++ b/components/services/heap_profiling/public/cpp/settings.h
@@ -0,0 +1,63 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_SERVICES_HEAP_PROFILING_PUBLIC_CPP_SETTINGS_H_
+#define COMPONENTS_SERVICES_HEAP_PROFILING_PUBLIC_CPP_SETTINGS_H_
+
+#include "base/feature_list.h"
+#include "components/services/heap_profiling/public/mojom/heap_profiling_client.mojom.h"
+
+// These helper functions parse the command line and FeatureList settings to
+// return coherent settings to use for the heap profiler at startup.
+namespace heap_profiling {
+
+// These values are persisted to logs. Entries should not be renumbered and
+// numeric values should never be reused.
+enum class Mode {
+  // No profiling enabled.
+  kNone = 0,
+
+  // Only profile the browser and GPU processes.
+  kMinimal = 1,
+
+  // Profile all processes.
+  kAll = 2,
+
+  // Profile only the browser process.
+  kBrowser = 3,
+
+  // Profile only the gpu process.
+  kGpu = 4,
+
+  // Profile a sampled number of renderer processes.
+  kRendererSampling = 5,
+
+  // Profile all renderer processes.
+  kAllRenderers = 6,
+
+  // By default, profile no processes. User may choose to start profiling for
+  // processes via chrome://memory-internals.
+  kManual = 7,
+
+  kCount
+};
+
+Mode GetModeForStartup();
+Mode ConvertStringToMode(const std::string& input);
+mojom::StackMode GetStackModeForStartup();
+mojom::StackMode ConvertStringToStackMode(const std::string& input);
+
+bool GetShouldSampleForStartup();
+uint32_t GetSamplingRateForStartup();
+
+bool IsBackgroundHeapProfilingEnabled();
+bool ShouldKeepSmallAllocations();
+
+// Exposed for testing.
+extern const base::Feature kOOPHeapProfilingFeature;
+extern const char kOOPHeapProfilingFeatureMode[];
+
+}  // namespace heap_profiling
+
+#endif  // COMPONENTS_SERVICES_HEAP_PROFILING_PUBLIC_CPP_SETTINGS_H_
diff --git a/components/services/heap_profiling/public/cpp/stream.h b/components/services/heap_profiling/public/cpp/stream.h
index f5c76f36..9f40ebdf 100644
--- a/components/services/heap_profiling/public/cpp/stream.h
+++ b/components/services/heap_profiling/public/cpp/stream.h
@@ -12,7 +12,7 @@
 
 #include "build/build_config.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 // These values should be kept in sync with
 // chrome/profiling/stream_fuzzer.dict to ensure efficient fuzzer
@@ -87,6 +87,6 @@
 
 #pragma pack(pop)
 
-}  // namespace profiling
+}  // namespace heap_profiling
 
 #endif  // COMPONENTS_SERVICES_HEAP_PROFILING_PUBLIC_CPP_STREAM_H_
diff --git a/components/services/heap_profiling/public/mojom/constants.mojom b/components/services/heap_profiling/public/mojom/constants.mojom
index bd58c2e3..085a130 100644
--- a/components/services/heap_profiling/public/mojom/constants.mojom
+++ b/components/services/heap_profiling/public/mojom/constants.mojom
@@ -2,6 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-module profiling.mojom;
+module heap_profiling.mojom;
 
 const string kServiceName = "heap_profiling";
diff --git a/components/services/heap_profiling/public/mojom/heap_profiling_client.mojom b/components/services/heap_profiling/public/mojom/heap_profiling_client.mojom
index c3170f8..8b98d691 100644
--- a/components/services/heap_profiling/public/mojom/heap_profiling_client.mojom
+++ b/components/services/heap_profiling/public/mojom/heap_profiling_client.mojom
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-module profiling.mojom;
+module heap_profiling.mojom;
 
 // The data that is recorded for an allocation stack.
 enum StackMode {
diff --git a/components/services/heap_profiling/public/mojom/heap_profiling_service.mojom b/components/services/heap_profiling/public/mojom/heap_profiling_service.mojom
index 882edcc..04ee1f5 100644
--- a/components/services/heap_profiling/public/mojom/heap_profiling_service.mojom
+++ b/components/services/heap_profiling/public/mojom/heap_profiling_service.mojom
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-module profiling.mojom;
+module heap_profiling.mojom;
 
 import "components/services/heap_profiling/public/mojom/heap_profiling_client.mojom";
 import "mojo/public/mojom/base/process_id.mojom";
diff --git a/components/services/heap_profiling/receiver.h b/components/services/heap_profiling/receiver.h
index 6061e98..332d0d90 100644
--- a/components/services/heap_profiling/receiver.h
+++ b/components/services/heap_profiling/receiver.h
@@ -11,7 +11,7 @@
 #include "components/services/heap_profiling/address.h"
 #include "components/services/heap_profiling/public/cpp/stream.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 // A log receiver is a sink for parsed allocation events. See also
 // StreamReceiver which is for the unparsed data blocks.
@@ -30,6 +30,6 @@
   virtual void OnComplete() = 0;
 };
 
-}  // namespace profiling
+}  // namespace heap_profiling
 
 #endif  // COMPONENTS_SERVICES_HEAP_PROFILING_RECEIVER_H_
diff --git a/components/services/heap_profiling/receiver_pipe.cc b/components/services/heap_profiling/receiver_pipe.cc
index d7d9dfc7..1a5f256 100644
--- a/components/services/heap_profiling/receiver_pipe.cc
+++ b/components/services/heap_profiling/receiver_pipe.cc
@@ -8,7 +8,7 @@
 #include "base/task_runner.h"
 #include "components/services/heap_profiling/stream_receiver.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 ReceiverPipeBase::ReceiverPipeBase(mojo::edk::ScopedPlatformHandle handle)
     : handle_(std::move(handle)) {}
@@ -35,4 +35,4 @@
   }
 }
 
-}  // namespace profiling
+}  // namespace heap_profiling
diff --git a/components/services/heap_profiling/receiver_pipe.h b/components/services/heap_profiling/receiver_pipe.h
index c91c21d1..cff4bfa 100644
--- a/components/services/heap_profiling/receiver_pipe.h
+++ b/components/services/heap_profiling/receiver_pipe.h
@@ -13,7 +13,7 @@
 class TaskRunner;
 }
 
-namespace profiling {
+namespace heap_profiling {
 
 class StreamReceiver;
 
@@ -49,7 +49,7 @@
   mojo::edk::ScopedPlatformHandle handle_;
 };
 
-}  // namespace profiling
+}  // namespace heap_profiling
 
 // Define the platform-specific specialization.
 #if defined(OS_WIN)
diff --git a/components/services/heap_profiling/receiver_pipe_posix.cc b/components/services/heap_profiling/receiver_pipe_posix.cc
index 11f84352..d951ae7 100644
--- a/components/services/heap_profiling/receiver_pipe_posix.cc
+++ b/components/services/heap_profiling/receiver_pipe_posix.cc
@@ -15,7 +15,7 @@
 #include "mojo/edk/embedder/platform_channel_utils_posix.h"
 #include "mojo/edk/embedder/platform_handle.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 ReceiverPipe::ReceiverPipe(mojo::edk::ScopedPlatformHandle handle)
     : ReceiverPipeBase(std::move(handle)),
@@ -71,4 +71,4 @@
   NOTREACHED();
 }
 
-}  // namespace profiling
+}  // namespace heap_profiling
diff --git a/components/services/heap_profiling/receiver_pipe_posix.h b/components/services/heap_profiling/receiver_pipe_posix.h
index e9b5b36..e0ac5e7d 100644
--- a/components/services/heap_profiling/receiver_pipe_posix.h
+++ b/components/services/heap_profiling/receiver_pipe_posix.h
@@ -13,7 +13,7 @@
 #include "build/build_config.h"
 #include "components/services/heap_profiling/receiver_pipe.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 class ReceiverPipe : public ReceiverPipeBase,
                      public base::MessageLoopForIO::Watcher {
@@ -36,6 +36,6 @@
   DISALLOW_COPY_AND_ASSIGN(ReceiverPipe);
 };
 
-}  // namespace profiling
+}  // namespace heap_profiling
 
 #endif  // COMPONENTS_SERVICES_HEAP_PROFILING_RECEIVER_PIPE_POSIX_H_
diff --git a/components/services/heap_profiling/receiver_pipe_win.cc b/components/services/heap_profiling/receiver_pipe_win.cc
index 3c27de0..05ff5da 100644
--- a/components/services/heap_profiling/receiver_pipe_win.cc
+++ b/components/services/heap_profiling/receiver_pipe_win.cc
@@ -14,7 +14,7 @@
 #include "components/services/heap_profiling/receiver_pipe.h"
 #include "components/services/heap_profiling/stream_receiver.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 ReceiverPipe::ReceiverPipe(mojo::edk::ScopedPlatformHandle handle)
     : ReceiverPipeBase(std::move(handle)),
@@ -81,4 +81,4 @@
   ReadUntilBlocking();
 }
 
-}  // namespace profiling
+}  // namespace heap_profiling
diff --git a/components/services/heap_profiling/receiver_pipe_win.h b/components/services/heap_profiling/receiver_pipe_win.h
index 75d2aa9..9612c7a 100644
--- a/components/services/heap_profiling/receiver_pipe_win.h
+++ b/components/services/heap_profiling/receiver_pipe_win.h
@@ -16,7 +16,7 @@
 #include "build/build_config.h"
 #include "components/services/heap_profiling/receiver_pipe.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 class ReceiverPipe : public ReceiverPipeBase,
                      public base::MessagePumpForIO::IOHandler {
@@ -48,6 +48,6 @@
   DISALLOW_COPY_AND_ASSIGN(ReceiverPipe);
 };
 
-}  // namespace profiling
+}  // namespace heap_profiling
 
 #endif  // COMPONENTS_SERVICES_HEAP_PROFILING_RECEIVER_PIPE_WIN_H_
diff --git a/components/services/heap_profiling/stream_fuzzer.cc b/components/services/heap_profiling/stream_fuzzer.cc
index d8aa4964..10cb75d 100644
--- a/components/services/heap_profiling/stream_fuzzer.cc
+++ b/components/services/heap_profiling/stream_fuzzer.cc
@@ -7,10 +7,10 @@
 
 #include <utility>
 
-namespace profiling {
+namespace heap_profiling {
 namespace {
 
-class DummyReceiver : public profiling::Receiver {
+class DummyReceiver : public Receiver {
   void OnHeader(const StreamHeader& header) override {}
   void OnAlloc(const AllocPacket& alloc_packet,
                std::vector<Address>&& stack,
@@ -23,13 +23,13 @@
 };
 
 }  // namespace
-}  // namespace profiling
+}  // namespace heap_profiling
 
 // Entry point for LibFuzzer.
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
-  profiling::DummyReceiver receiver;
-  scoped_refptr<profiling::StreamParser> parser(
-      new profiling::StreamParser(&receiver));
+  heap_profiling::DummyReceiver receiver;
+  scoped_refptr<heap_profiling::StreamParser> parser(
+      new heap_profiling::StreamParser(&receiver));
   std::unique_ptr<char[]> stream_data(new char[size]);
   memcpy(stream_data.get(), data, size);
   parser->OnStreamData(std::move(stream_data), size);
diff --git a/components/services/heap_profiling/stream_parser.cc b/components/services/heap_profiling/stream_parser.cc
index d4e63d6..9fc8a427 100644
--- a/components/services/heap_profiling/stream_parser.cc
+++ b/components/services/heap_profiling/stream_parser.cc
@@ -12,7 +12,7 @@
 #include "components/services/heap_profiling/backtrace.h"
 #include "components/services/heap_profiling/public/cpp/stream.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 StreamParser::Block::Block(std::unique_ptr<char[]> d, size_t s)
     : data(std::move(d)), size(s) {}
@@ -240,4 +240,4 @@
   receiver_->OnComplete();
 }
 
-}  // namespace profiling
+}  // namespace heap_profiling
diff --git a/components/services/heap_profiling/stream_parser.h b/components/services/heap_profiling/stream_parser.h
index bd27260..8438b6d 100644
--- a/components/services/heap_profiling/stream_parser.h
+++ b/components/services/heap_profiling/stream_parser.h
@@ -12,7 +12,7 @@
 #include "components/services/heap_profiling/receiver.h"
 #include "components/services/heap_profiling/stream_receiver.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 // Parses a memory stream. Refcounted via StreamReceiver.
 class StreamParser : public StreamReceiver {
@@ -87,6 +87,6 @@
   DISALLOW_COPY_AND_ASSIGN(StreamParser);
 };
 
-}  // namespace profiling
+}  // namespace heap_profiling
 
 #endif  // COMPONENTS_SERVICES_HEAP_PROFILING_STREAM_PARSER_H_
diff --git a/components/services/heap_profiling/stream_parser_unittest.cc b/components/services/heap_profiling/stream_parser_unittest.cc
index 57330c5..e2e7f7d 100644
--- a/components/services/heap_profiling/stream_parser_unittest.cc
+++ b/components/services/heap_profiling/stream_parser_unittest.cc
@@ -6,7 +6,7 @@
 
 #include "testing/gtest/include/gtest/gtest.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 namespace {
 
@@ -269,4 +269,4 @@
   EXPECT_EQ(kDummyText, receiver.last_raw_string());
 }
 
-}  // namespace profiling
+}  // namespace heap_profiling
diff --git a/components/services/heap_profiling/stream_receiver.h b/components/services/heap_profiling/stream_receiver.h
index c1d0e1fe..4c511eb 100644
--- a/components/services/heap_profiling/stream_receiver.h
+++ b/components/services/heap_profiling/stream_receiver.h
@@ -10,7 +10,7 @@
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 
-namespace profiling {
+namespace heap_profiling {
 
 // A stream receiver is a sink for unparsed bytes. See also LogReceiver.
 class StreamReceiver : public base::RefCountedThreadSafe<StreamReceiver> {
@@ -30,6 +30,6 @@
   virtual ~StreamReceiver() {}
 };
 
-}  // namespace profiling
+}  // namespace heap_profiling
 
 #endif  // COMPONENTS_SERVICES_HEAP_PROFILING_STREAM_RECEIVER_H_
diff --git a/components/test/data/payments/alicepay.com/app1/index.js b/components/test/data/payments/alicepay.com/app1/index.js
index c0b3ecb..6a0abeb 100644
--- a/components/test/data/payments/alicepay.com/app1/index.js
+++ b/components/test/data/payments/alicepay.com/app1/index.js
@@ -54,7 +54,7 @@
               }
 
               registration.paymentManager.instruments
-                  .set('123456', {name: 'Alice Pay', enabledMethods: [method]})
+                  .set('123456', {name: 'Alice Pay', method: method})
                   .then(() => {
                     output(
                         'instruments.set()',
diff --git a/components/test/data/payments/alicepay.com/app2/index.js b/components/test/data/payments/alicepay.com/app2/index.js
index c0b3ecb..6a0abeb 100644
--- a/components/test/data/payments/alicepay.com/app2/index.js
+++ b/components/test/data/payments/alicepay.com/app2/index.js
@@ -54,7 +54,7 @@
               }
 
               registration.paymentManager.instruments
-                  .set('123456', {name: 'Alice Pay', enabledMethods: [method]})
+                  .set('123456', {name: 'Alice Pay', method: method})
                   .then(() => {
                     output(
                         'instruments.set()',
diff --git a/components/test/data/payments/bobpay.com/app1/index.js b/components/test/data/payments/bobpay.com/app1/index.js
index 10af3f9..2e28ee2 100644
--- a/components/test/data/payments/bobpay.com/app1/index.js
+++ b/components/test/data/payments/bobpay.com/app1/index.js
@@ -54,7 +54,7 @@
               }
 
               registration.paymentManager.instruments
-                  .set('123456', {name: 'Bob Pay', enabledMethods: [method]})
+                  .set('123456', {name: 'Bob Pay', method: method})
                   .then(() => {
                     output(
                         'instruments.set()',
diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
index ab2fb1e..ed7bcab 100644
--- a/content/browser/BUILD.gn
+++ b/content/browser/BUILD.gn
@@ -1555,6 +1555,10 @@
     "shared_worker/shared_worker_host.h",
     "shared_worker/shared_worker_instance.cc",
     "shared_worker/shared_worker_instance.h",
+    "shared_worker/shared_worker_script_loader.cc",
+    "shared_worker/shared_worker_script_loader.h",
+    "shared_worker/shared_worker_script_loader_factory.cc",
+    "shared_worker/shared_worker_script_loader_factory.h",
     "shared_worker/shared_worker_service_impl.cc",
     "shared_worker/shared_worker_service_impl.h",
     "site_instance_impl.cc",
diff --git a/content/browser/devtools/protocol/network_handler.cc b/content/browser/devtools/protocol/network_handler.cc
index b7aa6a2..9ec8fc85 100644
--- a/content/browser/devtools/protocol/network_handler.cc
+++ b/content/browser/devtools/protocol/network_handler.cc
@@ -44,6 +44,7 @@
 #include "content/public/common/content_switches.h"
 #include "net/base/net_errors.h"
 #include "net/base/upload_bytes_element_reader.h"
+#include "net/cert/ct_policy_status.h"
 #include "net/cert/ct_sct_to_string.h"
 #include "net/cookies/canonical_cookie.h"
 #include "net/cookies/cookie_store.h"
@@ -79,6 +80,26 @@
 const char kDevToolsEmulateNetworkConditionsClientId[] =
     "X-DevTools-Emulate-Network-Conditions-Client-Id";
 
+Network::CertificateTransparencyCompliance SerializeCTPolicyCompliance(
+    net::ct::CTPolicyCompliance ct_compliance) {
+  switch (ct_compliance) {
+    case net::ct::CTPolicyCompliance::CT_POLICY_COMPLIES_VIA_SCTS:
+      return Network::CertificateTransparencyComplianceEnum::Compliant;
+    case net::ct::CTPolicyCompliance::CT_POLICY_NOT_ENOUGH_SCTS:
+    case net::ct::CTPolicyCompliance::CT_POLICY_NOT_DIVERSE_SCTS:
+      return Network::CertificateTransparencyComplianceEnum::NotCompliant;
+    case net::ct::CTPolicyCompliance::CT_POLICY_BUILD_NOT_TIMELY:
+    case net::ct::CTPolicyCompliance::
+        CT_POLICY_COMPLIANCE_DETAILS_NOT_AVAILABLE:
+      return Network::CertificateTransparencyComplianceEnum::Unknown;
+    case net::ct::CTPolicyCompliance::CT_POLICY_MAX:
+      NOTREACHED();
+      return Network::CertificateTransparencyComplianceEnum::Unknown;
+  }
+  NOTREACHED();
+  return Network::CertificateTransparencyComplianceEnum::Unknown;
+}
+
 std::unique_ptr<Network::Cookie> BuildCookie(
     const net::CanonicalCookie& cookie) {
   std::unique_ptr<Network::Cookie> devtools_cookie =
@@ -1302,6 +1323,8 @@
           .SetCertificateId(0)  // Keep this in protocol for compatability.
           .SetSignedCertificateTimestampList(
               std::move(signed_certificate_timestamp_list))
+          .SetCertificateTransparencyCompliance(
+              SerializeCTPolicyCompliance(ssl_info.ct_policy_compliance))
           .Build();
 
   if (ssl_info.key_exchange_group != 0) {
@@ -1312,6 +1335,7 @@
   }
   if (mac)
     security_details->SetMac(mac);
+
   return security_details;
 }
 
diff --git a/content/browser/frame_host/navigation_handle_impl.cc b/content/browser/frame_host/navigation_handle_impl.cc
index 86ab4d4..da32c71b 100644
--- a/content/browser/frame_host/navigation_handle_impl.cc
+++ b/content/browser/frame_host/navigation_handle_impl.cc
@@ -57,6 +57,9 @@
   *to_update = result;
 }
 
+// TODO(csharrison,nasko): This macro is incorrect for subframe navigations,
+// which will only have subframe-specific transition types. This means that all
+// subframes currently are tagged as NewNavigations.
 #define LOG_NAVIGATION_TIMING_HISTOGRAM(histogram, transition, value,      \
                                         max_time)                          \
   do {                                                                     \
diff --git a/content/browser/frame_host/navigation_handle_impl_browsertest.cc b/content/browser/frame_host/navigation_handle_impl_browsertest.cc
index d64f754..fd7650c8 100644
--- a/content/browser/frame_host/navigation_handle_impl_browsertest.cc
+++ b/content/browser/frame_host/navigation_handle_impl_browsertest.cc
@@ -6,6 +6,7 @@
 #include "base/files/scoped_temp_dir.h"
 #include "base/memory/weak_ptr.h"
 #include "base/strings/stringprintf.h"
+#include "base/test/histogram_tester.h"
 #include "content/browser/frame_host/debug_urls.h"
 #include "content/browser/frame_host/navigation_handle_impl.h"
 #include "content/browser/frame_host/navigation_request.h"
@@ -24,6 +25,7 @@
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/navigation_handle_observer.h"
+#include "content/public/test/test_frame_navigation_observer.h"
 #include "content/public/test/test_navigation_observer.h"
 #include "content/public/test/test_utils.h"
 #include "content/shell/browser/shell.h"
@@ -1988,6 +1990,162 @@
   }
 }
 
+IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, StartToCommitMetrics) {
+  enum class FrameType {
+    kMain,
+    kSub,
+  };
+  enum class ProcessType {
+    kCross,
+    kSame,
+  };
+  enum class TransitionType {
+    kNew,
+    kReload,
+    kBackForward,
+  };
+
+  // Uses the provided ProcessType, FrameType, and TransitionType expected for
+  // this navigation to generate all combinations of Navigation.StartToCommit
+  // metrics.
+  auto check_navigation = [](const base::HistogramTester& histograms,
+                             ProcessType process_type, FrameType frame_type,
+                             TransitionType transition_type) {
+    const std::map<FrameType, std::string> kFrameSuffixes = {
+        {FrameType::kMain, ".MainFrame"}, {FrameType::kSub, ".Subframe"}};
+    const std::map<ProcessType, std::string> kProcessSuffixes = {
+        {ProcessType::kCross, ".CrossProcess"},
+        {ProcessType::kSame, ".SameProcess"}};
+    const std::map<TransitionType, std::string> kTransitionSuffixes = {
+        {TransitionType::kNew, ".NewNavigation"},
+        {TransitionType::kReload, ".Reload"},
+        {TransitionType::kBackForward, ".BackForward"},
+    };
+
+    // Add the suffix to all existing histogram names, and append the results to
+    // |names|.
+    std::vector<std::string> names{"Navigation.StartToCommit"};
+    auto add_suffix = [&names](std::string suffix) {
+      size_t original_size = names.size();
+      for (size_t i = 0; i < original_size; i++) {
+        names.push_back(names[i] + suffix);
+      }
+    };
+    add_suffix(kProcessSuffixes.at(process_type));
+    add_suffix(kFrameSuffixes.at(frame_type));
+    add_suffix(kTransitionSuffixes.at(transition_type));
+
+    // Check that all generated histogram names are logged exactly once.
+    for (const auto& name : names) {
+      histograms.ExpectTotalCount(name, 1);
+    }
+
+    // Check that no additional histograms with the StartToCommit prefix were
+    // logged.
+    base::HistogramTester::CountsMap counts =
+        histograms.GetTotalCountsForPrefix("Navigation.StartToCommit");
+    int32_t total_counts = 0;
+    for (const auto& it : counts) {
+      total_counts += it.second;
+    }
+    EXPECT_EQ(static_cast<int32_t>(names.size()), total_counts);
+  };
+
+  // Main frame tests.
+  IsolateAllSitesForTesting(base::CommandLine::ForCurrentProcess());
+  NavigateToURL(shell(), embedded_test_server()->GetURL("/hello.html"));
+  {
+    base::HistogramTester histograms;
+    GURL url(embedded_test_server()->GetURL("/title1.html"));
+    NavigateToURL(shell(), url);
+    check_navigation(histograms, ProcessType::kSame, FrameType::kMain,
+                     TransitionType::kNew);
+  }
+  {
+    base::HistogramTester histograms;
+    GURL url(embedded_test_server()->GetURL("b.com", "/title1.html"));
+    NavigateToURL(shell(), url);
+    check_navigation(histograms, ProcessType::kCross, FrameType::kMain,
+                     TransitionType::kNew);
+  }
+  {
+    base::HistogramTester histograms;
+    ReloadBlockUntilNavigationsComplete(shell(), 1);
+    check_navigation(histograms, ProcessType::kSame, FrameType::kMain,
+                     TransitionType::kReload);
+  }
+  {
+    base::HistogramTester histograms;
+    TestNavigationObserver nav_observer(shell()->web_contents());
+    shell()->GoBackOrForward(-1);
+    nav_observer.Wait();
+    check_navigation(histograms, ProcessType::kCross, FrameType::kMain,
+                     TransitionType::kBackForward);
+  }
+  {
+    base::HistogramTester histograms;
+    TestNavigationObserver nav_observer(shell()->web_contents());
+    shell()->GoBackOrForward(-1);
+    nav_observer.Wait();
+    check_navigation(histograms, ProcessType::kSame, FrameType::kMain,
+                     TransitionType::kBackForward);
+  }
+  {
+    base::HistogramTester histograms;
+    NavigateToURL(shell(), GURL(url::kAboutBlankURL));
+    check_navigation(histograms, ProcessType::kSame, FrameType::kMain,
+                     TransitionType::kNew);
+  }
+
+  // Subframe tests. All of these tests just navigate a frame within
+  // page_with_iframe.html.
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("/page_with_iframe.html")));
+  FrameTreeNode* first_child =
+      static_cast<WebContentsImpl*>(shell()->web_contents())
+          ->GetFrameTree()
+          ->root()
+          ->child_at(0);
+  {
+    base::HistogramTester histograms;
+    EXPECT_TRUE(NavigateToURLFromRenderer(
+        first_child, embedded_test_server()->GetURL("c.com", "/title1.html")));
+    check_navigation(histograms, ProcessType::kCross, FrameType::kSub,
+                     TransitionType::kNew);
+  }
+  {
+    base::HistogramTester histograms;
+    TestFrameNavigationObserver nav_observer(first_child);
+    EXPECT_TRUE(ExecuteScript(first_child, "location.reload();"));
+    nav_observer.Wait();
+    // location.reload triggers the PAGE_TRANSITION_AUTO_SUBFRAME which
+    // corresponds to NewNavigation.
+    check_navigation(histograms, ProcessType::kSame, FrameType::kSub,
+                     TransitionType::kNew);
+  }
+  {
+    base::HistogramTester histograms;
+    shell()->GoBackOrForward(-1);
+    EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+    // History back triggers the PAGE_TRANSITION_AUTO_SUBFRAME which corresponds
+    // to NewNavigation.
+    check_navigation(histograms, ProcessType::kCross, FrameType::kSub,
+                     TransitionType::kNew);
+  }
+  EXPECT_TRUE(NavigateToURLFromRenderer(
+      first_child, embedded_test_server()->GetURL("/simple_links.html")));
+  {
+    base::HistogramTester histograms;
+    TestFrameNavigationObserver nav_observer(first_child);
+    EXPECT_TRUE(ExecuteScript(first_child, "clickSameSiteLink();"));
+    nav_observer.Wait();
+    // Link clicking will trigger PAGE_TRANSITION_MANUAL_SUBFRAME which
+    // corresponds to NewNavigation.
+    check_navigation(histograms, ProcessType::kSame, FrameType::kSub,
+                     TransitionType::kNew);
+  }
+}
+
 IN_PROC_BROWSER_TEST_F(NavigationHandleImplDownloadBrowserTest, IsDownload) {
   GURL url(embedded_test_server()->GetURL("/download-test1.lib"));
   NavigationHandleObserver observer(shell()->web_contents(), url);
diff --git a/content/browser/frame_host/render_frame_host_delegate.h b/content/browser/frame_host/render_frame_host_delegate.h
index c40d510..6a40d29 100644
--- a/content/browser/frame_host/render_frame_host_delegate.h
+++ b/content/browser/frame_host/render_frame_host_delegate.h
@@ -361,6 +361,10 @@
   // of the video to be in Picture-in-Picture mode.
   virtual void UpdatePictureInPictureSurfaceId(viz::SurfaceId surface_id) {}
 
+  // Updates the Picture-in-Picture controller with a signal that
+  // Picture-in-Picture mode has ended.
+  virtual void ExitPictureInPicture() {}
+
  protected:
   virtual ~RenderFrameHostDelegate() {}
 };
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index 737b1871..f640a18 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -2390,6 +2390,11 @@
     delegate_->UpdatePictureInPictureSurfaceId(surface_id);
 }
 
+void RenderFrameHostImpl::OnExitPictureInPicture() {
+  if (delegate_)
+    delegate_->ExitPictureInPicture();
+}
+
 void RenderFrameHostImpl::OnDidBlockFramebust(const GURL& url) {
   delegate_->OnDidBlockFramebust(url);
 }
diff --git a/content/browser/frame_host/render_frame_host_impl.h b/content/browser/frame_host/render_frame_host_impl.h
index 8d156df..e85d9cb5 100644
--- a/content/browser/frame_host/render_frame_host_impl.h
+++ b/content/browser/frame_host/render_frame_host_impl.h
@@ -916,6 +916,7 @@
   void FrameSizeChanged(const gfx::Size& frame_size) override;
   void OnUpdatePictureInPictureSurfaceId(
       const viz::SurfaceId& surface_id) override;
+  void OnExitPictureInPicture() override;
 
   // Registers Mojo interfaces that this frame host makes available.
   void RegisterMojoInterfaces();
diff --git a/content/browser/payments/payment_app.proto b/content/browser/payments/payment_app.proto
index 3a35743..35848b1d 100644
--- a/content/browser/payments/payment_app.proto
+++ b/content/browser/payments/payment_app.proto
@@ -28,7 +28,7 @@
   optional int64 registration_id = 1;
   optional string instrument_key = 2;
   optional string name = 3;
-  repeated string enabled_methods = 4;
+  optional string method = 4;
   optional string stringified_capabilities = 5;
   repeated StoredPaymentInstrumentImageObject icons = 6;
   optional string decoded_instrument_icon = 7;
diff --git a/content/browser/payments/payment_app_database.cc b/content/browser/payments/payment_app_database.cc
index cf490d3..9dfa6f1 100644
--- a/content/browser/payments/payment_app_database.cc
+++ b/content/browser/payments/payment_app_database.cc
@@ -80,8 +80,7 @@
     }
     instrument->icons.emplace_back(icon);
   }
-  for (const auto& method : instrument_proto.enabled_methods())
-    instrument->enabled_methods.push_back(method);
+  instrument->method = instrument_proto.method();
   instrument->stringified_capabilities =
       instrument_proto.stringified_capabilities();
 
@@ -431,7 +430,7 @@
     const std::string& instrument_key,
     const std::string& name,
     const std::string& icon,
-    const std::vector<std::string>& enabled_methods,
+    const std::string& method,
     SetPaymentAppInfoCallback callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
@@ -439,14 +438,14 @@
       registration_id,
       base::BindOnce(&PaymentAppDatabase::DidFindRegistrationToSetPaymentApp,
                      weak_ptr_factory_.GetWeakPtr(), instrument_key, name, icon,
-                     enabled_methods, std::move(callback)));
+                     method, std::move(callback)));
 }
 
 void PaymentAppDatabase::DidFindRegistrationToSetPaymentApp(
     const std::string& instrument_key,
     const std::string& name,
     const std::string& icon,
-    const std::vector<std::string>& enabled_methods,
+    const std::string& method,
     SetPaymentAppInfoCallback callback,
     ServiceWorkerStatusCode status,
     scoped_refptr<ServiceWorkerRegistration> registration) {
@@ -472,16 +471,15 @@
       {{CreatePaymentAppKey(registration->pattern().spec()),
         serialized_payment_app}},
       base::Bind(&PaymentAppDatabase::DidWritePaymentAppForSetPaymentApp,
-                 weak_ptr_factory_.GetWeakPtr(), instrument_key,
-                 enabled_methods, base::Passed(std::move(callback)),
-                 std::move(registration)));
+                 weak_ptr_factory_.GetWeakPtr(), instrument_key, method,
+                 base::Passed(std::move(callback)), std::move(registration)));
 
   return;
 }
 
 void PaymentAppDatabase::DidWritePaymentAppForSetPaymentApp(
     const std::string& instrument_key,
-    const std::vector<std::string>& enabled_methods,
+    const std::string& method,
     SetPaymentAppInfoCallback callback,
     scoped_refptr<ServiceWorkerRegistration> registration,
     ServiceWorkerStatusCode status) {
@@ -495,9 +493,7 @@
   StoredPaymentInstrumentProto instrument_proto;
   instrument_proto.set_registration_id(registration->id());
   instrument_proto.set_instrument_key(instrument_key);
-  for (const auto& method : enabled_methods) {
-    instrument_proto.add_enabled_methods(method);
-  }
+  instrument_proto.set_method(method);
 
   std::string serialized_instrument;
   bool success = instrument_proto.SerializeToString(&serialized_instrument);
@@ -582,10 +578,7 @@
     if (!base::ContainsKey(apps, id))
       continue;
 
-    for (const auto& method : instrument_proto.enabled_methods()) {
-      apps[id]->enabled_methods.push_back(method);
-    }
-
+    apps[id]->enabled_methods.emplace_back(instrument_proto.method());
     apps[id]->capabilities.emplace_back(StoredCapabilities());
     for (const auto& network : instrument_proto.supported_card_networks()) {
       apps[id]->capabilities.back().supported_card_networks.emplace_back(
@@ -773,9 +766,7 @@
   instrument_proto.set_decoded_instrument_icon(decoded_instrument_icon);
   instrument_proto.set_instrument_key(instrument_key);
   instrument_proto.set_name(instrument->name);
-  for (const auto& method : instrument->enabled_methods) {
-    instrument_proto.add_enabled_methods(method);
-  }
+  instrument_proto.set_method(instrument->method);
   for (const auto& icon : instrument->icons) {
     StoredPaymentInstrumentImageObject* image_object_proto =
         instrument_proto.add_icons();
diff --git a/content/browser/payments/payment_app_database.h b/content/browser/payments/payment_app_database.h
index c77965ea..c3e6dbd 100644
--- a/content/browser/payments/payment_app_database.h
+++ b/content/browser/payments/payment_app_database.h
@@ -82,7 +82,7 @@
       const std::string& instrument_key,
       const std::string& name,
       const std::string& icon,
-      const std::vector<std::string>& enabled_methods,
+      const std::string& method,
       SetPaymentAppInfoCallback callback);
 
  private:
@@ -210,13 +210,13 @@
       const std::string& instrument_key,
       const std::string& name,
       const std::string& icon,
-      const std::vector<std::string>& enabled_methods,
+      const std::string& method,
       SetPaymentAppInfoCallback callback,
       ServiceWorkerStatusCode status,
       scoped_refptr<ServiceWorkerRegistration> registration);
   void DidWritePaymentAppForSetPaymentApp(
       const std::string& instrument_key,
-      const std::vector<std::string>& enabled_methods,
+      const std::string& method,
       SetPaymentAppInfoCallback callback,
       scoped_refptr<ServiceWorkerRegistration> registration,
       ServiceWorkerStatusCode status);
diff --git a/content/browser/payments/payment_app_installer.cc b/content/browser/payments/payment_app_installer.cc
index 8c324f58..6a6e31b 100644
--- a/content/browser/payments/payment_app_installer.cc
+++ b/content/browser/payments/payment_app_installer.cc
@@ -32,12 +32,13 @@
                       const GURL& sw_url,
                       const GURL& scope,
                       bool use_cache,
-                      const std::vector<std::string>& enabled_methods,
+                      const std::string& method,
                       PaymentAppInstaller::InstallPaymentAppCallback callback)
       : app_name_(app_name),
         app_icon_(app_icon),
         sw_url_(sw_url),
         scope_(scope),
+        method_(method),
         callback_(std::move(callback)) {
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
@@ -45,9 +46,6 @@
     // installation early.
     Observe(web_contents);
 
-    std::copy(enabled_methods.begin(), enabled_methods.end(),
-              std::back_inserter(enabled_methods_));
-
     content::BrowserContext* browser_context =
         web_contents->GetBrowserContext();
     ServiceWorkerContextWrapper* service_worker_context =
@@ -137,7 +135,7 @@
         BrowserThread::IO, FROM_HERE,
         base::BindOnce(&SelfDeleteInstaller::SetPaymentAppInfoOnIO, this,
                        payment_app_context, registration_id_, scope_.spec(),
-                       app_name_, app_icon_, enabled_methods_));
+                       app_name_, app_icon_, method_));
   }
 
   void SetPaymentAppInfoOnIO(
@@ -146,12 +144,12 @@
       const std::string& instrument_key,
       const std::string& name,
       const std::string& app_icon,
-      const std::vector<std::string>& enabled_methods) {
+      const std::string& method) {
     DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
     payment_app_context->payment_app_database()
         ->SetPaymentAppInfoForRegisteredServiceWorker(
-            registration_id, instrument_key, name, app_icon, enabled_methods,
+            registration_id, instrument_key, name, app_icon, method,
             base::BindOnce(&SelfDeleteInstaller::OnSetPaymentAppInfo, this));
   }
 
@@ -192,7 +190,7 @@
   std::string app_icon_;
   GURL sw_url_;
   GURL scope_;
-  std::vector<std::string> enabled_methods_;
+  std::string method_;
   PaymentAppInstaller::InstallPaymentAppCallback callback_;
 
   int64_t registration_id_ = -1;  // Take -1 as an invalid registration Id.
@@ -204,19 +202,18 @@
 }  // namespace.
 
 // Static
-void PaymentAppInstaller::Install(
-    WebContents* web_contents,
-    const std::string& app_name,
-    const std::string& app_icon,
-    const GURL& sw_url,
-    const GURL& scope,
-    bool use_cache,
-    const std::vector<std::string>& enabled_methods,
-    InstallPaymentAppCallback callback) {
+void PaymentAppInstaller::Install(WebContents* web_contents,
+                                  const std::string& app_name,
+                                  const std::string& app_icon,
+                                  const GURL& sw_url,
+                                  const GURL& scope,
+                                  bool use_cache,
+                                  const std::string& method,
+                                  InstallPaymentAppCallback callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   new SelfDeleteInstaller(web_contents, app_name, app_icon, sw_url, scope,
-                          use_cache, enabled_methods, std::move(callback));
+                          use_cache, method, std::move(callback));
 }
 
-}  // namespace content
\ No newline at end of file
+}  // namespace content
diff --git a/content/browser/payments/payment_app_installer.h b/content/browser/payments/payment_app_installer.h
index 2487b4c..67e9e5b 100644
--- a/content/browser/payments/payment_app_installer.h
+++ b/content/browser/payments/payment_app_installer.h
@@ -39,7 +39,7 @@
                       const GURL& sw_url,
                       const GURL& scope,
                       bool use_cache,
-                      const std::vector<std::string>& enabled_methods,
+                      const std::string& method,
                       InstallPaymentAppCallback callback);
 
  private:
@@ -48,4 +48,4 @@
 
 }  // namespace content.
 
-#endif  // CONTENT_BROWSER_PAYMENTS_PAYMENT_APP_INSTALLER_H_
\ No newline at end of file
+#endif  // CONTENT_BROWSER_PAYMENTS_PAYMENT_APP_INSTALLER_H_
diff --git a/content/browser/payments/payment_app_provider_impl.cc b/content/browser/payments/payment_app_provider_impl.cc
index f0c4b55c..0aa16327 100644
--- a/content/browser/payments/payment_app_provider_impl.cc
+++ b/content/browser/payments/payment_app_provider_impl.cc
@@ -410,7 +410,7 @@
     const std::string& sw_js_url,
     const std::string& sw_scope,
     bool sw_use_cache,
-    const std::vector<std::string>& enabled_methods,
+    const std::string& method,
     InvokePaymentAppCallback callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
@@ -418,7 +418,7 @@
   GURL url = GURL(sw_js_url);
   DCHECK(base::IsStringUTF8(sw_scope));
   GURL scope = GURL(sw_scope);
-  if (!url.is_valid() || !scope.is_valid() || enabled_methods.size() == 0) {
+  if (!url.is_valid() || !scope.is_valid() || method.empty()) {
     BrowserThread::PostTask(
         BrowserThread::UI, FROM_HERE,
         base::BindOnce(std::move(callback),
@@ -438,7 +438,7 @@
 
   PaymentAppInstaller::Install(
       web_contents, app_name, string_encoded_icon, url, scope, sw_use_cache,
-      enabled_methods,
+      method,
       base::BindOnce(&OnInstallPaymentApp, std::move(event_data),
                      std::move(callback)));
 }
diff --git a/content/browser/payments/payment_app_provider_impl.h b/content/browser/payments/payment_app_provider_impl.h
index 3a7eeef..09cd78f 100644
--- a/content/browser/payments/payment_app_provider_impl.h
+++ b/content/browser/payments/payment_app_provider_impl.h
@@ -33,7 +33,7 @@
       const std::string& sw_js_url,
       const std::string& sw_scope,
       bool sw_use_cache,
-      const std::vector<std::string>& enabled_methods,
+      const std::string& method,
       InvokePaymentAppCallback callback) override;
   void CanMakePayment(BrowserContext* browser_context,
                       int64_t registration_id,
diff --git a/content/browser/payments/payment_app_provider_impl_unittest.cc b/content/browser/payments/payment_app_provider_impl_unittest.cc
index 6cd52ccc..6e89a22 100644
--- a/content/browser/payments/payment_app_provider_impl_unittest.cc
+++ b/content/browser/payments/payment_app_provider_impl_unittest.cc
@@ -211,17 +211,17 @@
 
   PaymentHandlerStatus status;
   PaymentInstrumentPtr instrument_1 = PaymentInstrument::New();
-  instrument_1->enabled_methods.push_back("hellopay");
+  instrument_1->method = "hellopay";
   SetPaymentInstrument(manager1, "test_key1", std::move(instrument_1),
                        base::BindOnce(&SetPaymentInstrumentCallback, &status));
 
   PaymentInstrumentPtr instrument_2 = PaymentInstrument::New();
-  instrument_2->enabled_methods.push_back("hellopay");
+  instrument_2->method = "hellopay";
   SetPaymentInstrument(manager2, "test_key2", std::move(instrument_2),
                        base::BindOnce(&SetPaymentInstrumentCallback, &status));
 
   PaymentInstrumentPtr instrument_3 = PaymentInstrument::New();
-  instrument_3->enabled_methods.push_back("bobpay");
+  instrument_3->method = "bobpay";
   SetPaymentInstrument(manager2, "test_key3", std::move(instrument_3),
                        base::BindOnce(&SetPaymentInstrumentCallback, &status));
 
@@ -244,17 +244,17 @@
 
   PaymentHandlerStatus status;
   PaymentInstrumentPtr instrument_1 = PaymentInstrument::New();
-  instrument_1->enabled_methods.push_back("hellopay");
+  instrument_1->method = "hellopay";
   SetPaymentInstrument(manager1, "test_key1", std::move(instrument_1),
                        base::BindOnce(&SetPaymentInstrumentCallback, &status));
 
   PaymentInstrumentPtr instrument_2 = PaymentInstrument::New();
-  instrument_2->enabled_methods.push_back("hellopay");
+  instrument_2->method = "hellopay";
   SetPaymentInstrument(manager2, "test_key2", std::move(instrument_2),
                        base::BindOnce(&SetPaymentInstrumentCallback, &status));
 
   PaymentInstrumentPtr instrument_3 = PaymentInstrument::New();
-  instrument_3->enabled_methods.push_back("bobpay");
+  instrument_3->method = "bobpay";
   SetPaymentInstrument(manager2, "test_key3", std::move(instrument_3),
                        base::BindOnce(&SetPaymentInstrumentCallback, &status));
 
diff --git a/content/browser/payments/payment_manager_unittest.cc b/content/browser/payments/payment_manager_unittest.cc
index 94eec8b..5ca9bfc 100644
--- a/content/browser/payments/payment_manager_unittest.cc
+++ b/content/browser/payments/payment_manager_unittest.cc
@@ -126,8 +126,8 @@
 TEST_F(PaymentManagerTest, SetAndGetPaymentInstrument) {
   PaymentHandlerStatus write_status = PaymentHandlerStatus::NOT_FOUND;
   PaymentInstrumentPtr write_details = PaymentInstrument::New();
-  write_details->name = "Visa ending ****4756",
-  write_details->enabled_methods.push_back("visa");
+  write_details->name = "Visa ending ****4756";
+  write_details->method = "visa";
   write_details->stringified_capabilities = "{}";
   SetPaymentInstrument("test_key", std::move(write_details), &write_status);
   // Write the first instrument of a web payment app will return
@@ -141,8 +141,7 @@
   GetPaymentInstrument("test_key", &read_details, &read_status);
   ASSERT_EQ(PaymentHandlerStatus::SUCCESS, read_status);
   EXPECT_EQ("Visa ending ****4756", read_details->name);
-  ASSERT_EQ(1U, read_details->enabled_methods.size());
-  EXPECT_EQ("visa", read_details->enabled_methods[0]);
+  EXPECT_EQ("visa", read_details->method);
   EXPECT_EQ("{}", read_details->stringified_capabilities);
 }
 
@@ -156,8 +155,8 @@
 TEST_F(PaymentManagerTest, DeletePaymentInstrument) {
   PaymentHandlerStatus write_status = PaymentHandlerStatus::NOT_FOUND;
   PaymentInstrumentPtr write_details = PaymentInstrument::New();
-  write_details->name = "Visa ending ****4756",
-  write_details->enabled_methods.push_back("visa");
+  write_details->name = "Visa ending ****4756";
+  write_details->method = "visa";
   write_details->stringified_capabilities = "{}";
   SetPaymentInstrument("test_key", std::move(write_details), &write_status);
   // Write the first instrument of a web payment app will return
@@ -183,8 +182,8 @@
 TEST_F(PaymentManagerTest, HasPaymentInstrument) {
   PaymentHandlerStatus write_status = PaymentHandlerStatus::NOT_FOUND;
   PaymentInstrumentPtr write_details = PaymentInstrument::New();
-  write_details->name = "Visa ending ****4756",
-  write_details->enabled_methods.push_back("visa");
+  write_details->name = "Visa ending ****4756";
+  write_details->method = "visa";
   write_details->stringified_capabilities = "{}";
   SetPaymentInstrument("test_key", std::move(write_details), &write_status);
   // Write the first instrument of a web payment app will return
diff --git a/content/browser/service_worker/embedded_worker_instance_unittest.cc b/content/browser/service_worker/embedded_worker_instance_unittest.cc
index 08df5bf..99a1419a 100644
--- a/content/browser/service_worker/embedded_worker_instance_unittest.cc
+++ b/content/browser/service_worker/embedded_worker_instance_unittest.cc
@@ -96,6 +96,7 @@
       mojom::ServiceWorkerContainerHostRequest request) override {
     NOTIMPLEMENTED();
   }
+  void Ping(PingCallback callback) override { NOTIMPLEMENTED(); }
 
   mojom::ServiceWorkerContainerAssociatedPtr client_;
   mojo::AssociatedBinding<mojom::ServiceWorkerContainerHost> binding_;
diff --git a/content/browser/service_worker/service_worker_context_core.cc b/content/browser/service_worker/service_worker_context_core.cc
index 48dbd46..b7d836ea 100644
--- a/content/browser/service_worker/service_worker_context_core.cc
+++ b/content/browser/service_worker/service_worker_context_core.cc
@@ -89,7 +89,10 @@
 bool IsSameOriginClientProviderHost(const GURL& origin,
                                     ServiceWorkerProviderHost* host) {
   return host->IsProviderForClient() &&
-         host->document_url().GetOrigin() == origin;
+         host->document_url().GetOrigin() == origin &&
+         // Don't expose "reserved" clients (clients that are not yet execution
+         // ready) to the Clients API.
+         host->is_execution_ready();
 }
 
 bool IsSameOriginWindowProviderHost(const GURL& origin,
@@ -366,6 +369,7 @@
 ServiceWorkerProviderHost* ServiceWorkerContextCore::GetProviderHost(
     int process_id,
     int provider_id) {
+  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
   ProviderMap* map = GetProviderMapForProcess(process_id);
   if (!map)
     return nullptr;
diff --git a/content/browser/service_worker/service_worker_context_core.h b/content/browser/service_worker/service_worker_context_core.h
index 30125374..afe7fbb 100644
--- a/content/browser/service_worker/service_worker_context_core.h
+++ b/content/browser/service_worker/service_worker_context_core.h
@@ -176,9 +176,10 @@
   void RemoveAllProviderHostsForProcess(int process_id);
   std::unique_ptr<ProviderHostIterator> GetProviderHostIterator();
 
-  // Returns a ProviderHost iterator for all ServiceWorker clients for
-  // the |origin|.  This only returns ProviderHosts that are of CONTROLLEE
-  // and belong to the |origin|.
+  // Returns a ProviderHost iterator for all service worker clients for the
+  // |origin|. This only returns clients that are execution ready (i.e., for
+  // windows, the navigation has been committed and for workers, the final
+  // response after redirects has been delivered).
   std::unique_ptr<ProviderHostIterator> GetClientProviderHostIterator(
       const GURL& origin);
 
diff --git a/content/browser/service_worker/service_worker_context_wrapper.cc b/content/browser/service_worker/service_worker_context_wrapper.cc
index 50c16a7..a0072ef 100644
--- a/content/browser/service_worker/service_worker_context_wrapper.cc
+++ b/content/browser/service_worker/service_worker_context_wrapper.cc
@@ -817,6 +817,16 @@
   core_observer_list_->RemoveObserver(observer);
 }
 
+base::WeakPtr<ServiceWorkerProviderHost>
+ServiceWorkerContextWrapper::PreCreateHostForSharedWorker(
+    int process_id,
+    mojom::ServiceWorkerProviderInfoForSharedWorkerPtr* out_provider_info) {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+
+  return ServiceWorkerProviderHost::PreCreateForSharedWorker(
+      context()->AsWeakPtr(), process_id, out_provider_info);
+}
+
 ServiceWorkerContextWrapper::~ServiceWorkerContextWrapper() {
   // Explicitly remove this object as an observer to avoid use-after-frees in
   // tests where this object is not guaranteed to outlive the
diff --git a/content/browser/service_worker/service_worker_context_wrapper.h b/content/browser/service_worker/service_worker_context_wrapper.h
index 86a637e..96ec90d 100644
--- a/content/browser/service_worker/service_worker_context_wrapper.h
+++ b/content/browser/service_worker/service_worker_context_wrapper.h
@@ -254,6 +254,17 @@
 
   bool is_incognito() const { return is_incognito_; }
 
+  // S13nServiceWorker:
+  // Used for starting a shared worker. Returns a provider host for the shared
+  // worker and fills |out_provider_info| with info to send to the renderer to
+  // connect to the host. The host stays alive as long as this info stays alive
+  // (namely, as long as |out_provider_info->host_ptr_info| stays alive).
+  //
+  // Must be called on the IO thread.
+  base::WeakPtr<ServiceWorkerProviderHost> PreCreateHostForSharedWorker(
+      int process_id,
+      mojom::ServiceWorkerProviderInfoForSharedWorkerPtr* out_provider_info);
+
  private:
   friend class BackgroundSyncManagerTest;
   friend class base::RefCountedThreadSafe<ServiceWorkerContextWrapper>;
diff --git a/content/browser/service_worker/service_worker_controllee_request_handler.cc b/content/browser/service_worker/service_worker_controllee_request_handler.cc
index 6460145..a7016c20 100644
--- a/content/browser/service_worker/service_worker_controllee_request_handler.cc
+++ b/content/browser/service_worker/service_worker_controllee_request_handler.cc
@@ -288,7 +288,7 @@
   // in redirect case, unassociate it now.
   provider_host_->DisassociateRegistration();
 
-  // Also prevent a registrater job for establishing an association to a new
+  // Also prevent a register job from establishing an association to a new
   // registration while we're finding an existing registration.
   provider_host_->SetAllowAssociation(false);
 
@@ -355,9 +355,8 @@
     return;
   }
 
-  // Initiate activation of a waiting version.
-  // Usually a register job initiates activation but that
-  // doesn't happen if the browser exits prior to activation
+  // Initiate activation of a waiting version. Usually a register job initiates
+  // activation but that doesn't happen if the browser exits prior to activation
   // having occurred. This check handles that case.
   if (registration->waiting_version())
     registration->ActivateWaitingVersionWhenReady();
diff --git a/content/browser/service_worker/service_worker_navigation_loader.cc b/content/browser/service_worker/service_worker_navigation_loader.cc
index 05d22b2..241e860 100644
--- a/content/browser/service_worker/service_worker_navigation_loader.cc
+++ b/content/browser/service_worker/service_worker_navigation_loader.cc
@@ -83,12 +83,7 @@
       weak_factory_(this) {
   DCHECK(ServiceWorkerUtils::IsMainResourceType(
       static_cast<ResourceType>(resource_request.resource_type)));
-  DCHECK_EQ(network::mojom::FetchRequestMode::kNavigate,
-            resource_request_.fetch_request_mode);
-  DCHECK_EQ(network::mojom::FetchCredentialsMode::kInclude,
-            resource_request_.fetch_credentials_mode);
-  DCHECK_EQ(network::mojom::FetchRedirectMode::kManual,
-            resource_request_.fetch_redirect_mode);
+
   response_head_.load_timing.request_start = base::TimeTicks::Now();
   response_head_.load_timing.request_start_time = base::Time::Now();
 }
@@ -264,8 +259,8 @@
     return;
   }
 
-  // Creates a new HttpResponseInfo using the the ServiceWorker script's
-  // HttpResponseInfo to show HTTPS padlock.
+  // Get SSLInfo from the ServiceWorker script's HttpResponseInfo to show HTTPS
+  // padlock.
   // TODO(horo): When we support mixed-content (HTTP) no-cors requests from a
   // ServiceWorker, we have to check the security level of the responses.
   const net::HttpResponseInfo* main_script_http_info =
diff --git a/content/browser/service_worker/service_worker_navigation_loader.h b/content/browser/service_worker/service_worker_navigation_loader.h
index 3312538..280865f0 100644
--- a/content/browser/service_worker/service_worker_navigation_loader.h
+++ b/content/browser/service_worker/service_worker_navigation_loader.h
@@ -30,17 +30,18 @@
 class ServiceWorkerVersion;
 
 // S13nServiceWorker:
-// ServiceWorkerNavigationLoader is the URLLoader used for navigation requests
-// that (potentially) go through a service worker. This loader is only used for
-// the main resource request; once the navigation is committed, the page loads
+// ServiceWorkerNavigationLoader is the URLLoader used for main resource
+// requests (i.e., navigation and shared worker requests) that (potentially) go
+// through a service worker. This loader is only used for the main resource
+// request; once the response is delivered, the resulting client loads
 // subresources via ServiceWorkerSubresourceLoader.
 //
 // This class works similarly to ServiceWorkerURLRequestJob but with
 // network::mojom::URLLoader instead of URLRequest.
 //
 // This class is owned by the job wrapper until it is bound to a URLLoader
-// request. After it is bound |this| is kept alive until the Mojo connection
-// to this URLLoader is dropped.
+// request. After it is bound |this| is kept alive until the Mojo connection to
+// this URLLoader is dropped.
 class CONTENT_EXPORT ServiceWorkerNavigationLoader
     : public network::mojom::URLLoader {
  public:
@@ -48,9 +49,9 @@
   using ResponseType = ServiceWorkerResponseType;
 
   // Created by ServiceWorkerControlleeRequestHandler::MaybeCreateLoader
-  // when starting to load a page for navigation.
+  // when starting to load a main resource.
   //
-  // This job typically works in the following order:
+  // For the navigation case, this job typically works in the following order:
   // 1. One of the FallbackTo* or ForwardTo* methods are called via
   //    URLJobWrapper by ServiceWorkerControlleeRequestHandler, which
   //    determines how the request should be served (e.g. should fallback
@@ -71,6 +72,9 @@
   //    NavigationURLLoaderNetworkService (for resource loading for navigation).
   //    This forwards the blob/stream data pipe to the NavigationURLLoader if
   //    the response body was sent as a blob/stream.
+  //
+  // Loads for shared workers work similarly, except SharedWorkerScriptLoader
+  // is used instead of NavigationURLLoaderNetworkService.
   ServiceWorkerNavigationLoader(
       NavigationLoaderInterceptor::LoaderCallback loader_callback,
       Delegate* delegate,
diff --git a/content/browser/service_worker/service_worker_new_script_loader.cc b/content/browser/service_worker/service_worker_new_script_loader.cc
index cc820508..a4f5e46a 100644
--- a/content/browser/service_worker/service_worker_new_script_loader.cc
+++ b/content/browser/service_worker/service_worker_new_script_loader.cc
@@ -387,8 +387,8 @@
   // next time.
   uint32_t bytes_written = std::min<uint32_t>(kReadBufferSize, bytes_available);
 
-  auto buffer = base::MakeRefCounted<network::MojoToNetIOBuffer>(
-      pending_buffer.get(), bytes_written);
+  auto buffer =
+      base::MakeRefCounted<net::WrappedIOBuffer>(pending_buffer->buffer());
   MojoResult result = client_producer_->WriteData(
       buffer->data(), &bytes_written, MOJO_WRITE_DATA_FLAG_NONE);
   switch (result) {
diff --git a/content/browser/service_worker/service_worker_provider_host.cc b/content/browser/service_worker/service_worker_provider_host.cc
index 79c58d9..eac256a 100644
--- a/content/browser/service_worker/service_worker_provider_host.cc
+++ b/content/browser/service_worker/service_worker_provider_host.cc
@@ -114,10 +114,10 @@
   TRACE_EVENT0("ServiceWorker",
                "ServiceWorkerProviderHost::RemoveProviderHost");
   if (!context || !context->GetProviderHost(process_id, provider_id)) {
-    // In some cancellation of navigation cases, it is possible for the
-    // pre-created host, whose |provider_id| is assigned by the browser process,
-    // to have been destroyed before being claimed by the renderer. The provider
-    // is then destroyed in the renderer, and no matching host will be found.
+    // In some cases, it is possible for the Mojo endpoint of a pre-created
+    // host to be destroyed before being claimed by the renderer and
+    // becoming owned by ServiceWorkerContextCore. The owner of the host is
+    // responsible for deleting the host, so just return here.
     return;
   }
   context->RemoveProviderHost(process_id, provider_id);
@@ -180,13 +180,43 @@
 }
 
 // static
+base::WeakPtr<ServiceWorkerProviderHost>
+ServiceWorkerProviderHost::PreCreateForSharedWorker(
+    base::WeakPtr<ServiceWorkerContextCore> context,
+    int process_id,
+    mojom::ServiceWorkerProviderInfoForSharedWorkerPtr* out_provider_info) {
+  auto host = base::WrapUnique(new ServiceWorkerProviderHost(
+      ChildProcessHost::kInvalidUniqueID,
+      ServiceWorkerProviderHostInfo(
+          NextBrowserProvidedProviderId(), MSG_ROUTING_NONE,
+          blink::mojom::ServiceWorkerProviderType::kForSharedWorker,
+          true /* is_parent_frame_secure */),
+      context, nullptr));
+  host->dispatcher_host_ = context->GetDispatcherHost(process_id)->AsWeakPtr();
+  host->render_process_id_ = process_id;
+
+  (*out_provider_info)->provider_id = host->provider_id();
+  (*out_provider_info)->client_request = mojo::MakeRequest(&host->container_);
+  host->binding_.Bind(
+      mojo::MakeRequest(&((*out_provider_info)->host_ptr_info)));
+  host->binding_.set_connection_error_handler(base::BindOnce(
+      &RemoveProviderHost, context, process_id, host->provider_id()));
+
+  auto weak_ptr = host->AsWeakPtr();
+  context->AddProviderHost(std::move(host));
+  return weak_ptr;
+}
+
+// static
 std::unique_ptr<ServiceWorkerProviderHost> ServiceWorkerProviderHost::Create(
     int process_id,
     ServiceWorkerProviderHostInfo info,
     base::WeakPtr<ServiceWorkerContextCore> context,
     base::WeakPtr<ServiceWorkerDispatcherHost> dispatcher_host) {
-  return base::WrapUnique(new ServiceWorkerProviderHost(
+  auto host = base::WrapUnique(new ServiceWorkerProviderHost(
       process_id, std::move(info), context, dispatcher_host));
+  host->is_execution_ready_ = true;
+  return host;
 }
 
 ServiceWorkerProviderHost::ServiceWorkerProviderHost(
@@ -587,6 +617,8 @@
   DCHECK_EQ(info_.provider_id, info.provider_id);
   DCHECK_NE(MSG_ROUTING_NONE, info.route_id);
 
+  is_execution_ready_ = true;
+
   // Connect with the mojom::ServiceWorkerContainer on the renderer.
   DCHECK(!container_.is_bound());
   DCHECK(!binding_.is_bound());
@@ -671,6 +703,12 @@
   return provider_info;
 }
 
+void ServiceWorkerProviderHost::CompleteSharedWorkerPreparation() {
+  DCHECK_EQ(blink::mojom::ServiceWorkerProviderType::kForSharedWorker,
+            provider_type());
+  is_execution_ready_ = true;
+}
+
 void ServiceWorkerProviderHost::SendServiceWorkerStateChangedMessage(
     int worker_handle_id,
     blink::mojom::ServiceWorkerState state) {
@@ -1048,6 +1086,10 @@
                                           std::move(container_host_request));
 }
 
+void ServiceWorkerProviderHost::Ping(PingCallback callback) {
+  std::move(callback).Run();
+}
+
 bool ServiceWorkerProviderHost::IsValidRegisterMessage(
     const GURL& script_url,
     const blink::mojom::ServiceWorkerRegistrationOptions& options,
diff --git a/content/browser/service_worker/service_worker_provider_host.h b/content/browser/service_worker/service_worker_provider_host.h
index 846bd70e..7b5c095 100644
--- a/content/browser/service_worker/service_worker_provider_host.h
+++ b/content/browser/service_worker/service_worker_provider_host.h
@@ -122,6 +122,16 @@
   static std::unique_ptr<ServiceWorkerProviderHost> PreCreateForController(
       base::WeakPtr<ServiceWorkerContextCore> context);
 
+  // S13nServiceWorker:
+  // Used for starting a shared worker. Returns a provider host for the shared
+  // worker and fills |out_provider_info| with info to send to the renderer to
+  // connect to the host. The host stays alive as long as this info stays alive
+  // (namely, as long as |out_provider_info->host_ptr_info| stays alive).
+  static base::WeakPtr<ServiceWorkerProviderHost> PreCreateForSharedWorker(
+      base::WeakPtr<ServiceWorkerContextCore> context,
+      int process_id,
+      mojom::ServiceWorkerProviderInfoForSharedWorkerPtr* out_provider_info);
+
   // Used to create a ServiceWorkerProviderHost when the renderer-side provider
   // is created. This ProviderHost will be created for the process specified by
   // |process_id|.
@@ -346,6 +356,10 @@
       int process_id,
       scoped_refptr<ServiceWorkerVersion> hosted_version);
 
+  // Called when the shared worker main script resource has finished loading.
+  // After this is called, is_execution_ready() returns true.
+  void CompleteSharedWorkerPreparation();
+
   // Sends event messages to the renderer. Events for the worker are queued up
   // until the worker thread id is known via SetReadyToSendMessagesToWorker().
   void SendServiceWorkerStateChangedMessage(
@@ -380,6 +394,8 @@
   // cache.
   void NotifyControllerLost();
 
+  bool is_execution_ready() const { return is_execution_ready_; }
+
  private:
   friend class LinkHeaderServiceWorkerTest;
   friend class ServiceWorkerProviderHostTest;
@@ -463,6 +479,7 @@
       mojom::ControllerServiceWorkerPurpose purpose) override;
   void CloneForWorker(
       mojom::ServiceWorkerContainerHostRequest container_host_request) override;
+  void Ping(PingCallback callback) override;
 
   // Callback for ServiceWorkerContextCore::RegisterServiceWorker().
   void RegistrationComplete(RegisterCallback callback,
@@ -620,6 +637,11 @@
   mojo::Binding<service_manager::mojom::InterfaceProvider>
       interface_provider_binding_;
 
+  // For service worker clients. True if the main resource for this host has
+  // finished loading. When false, the document URL may still change due to
+  // redirects.
+  bool is_execution_ready_ = false;
+
   DISALLOW_COPY_AND_ASSIGN(ServiceWorkerProviderHost);
 };
 
diff --git a/content/browser/service_worker/service_worker_provider_host_unittest.cc b/content/browser/service_worker/service_worker_provider_host_unittest.cc
index 38e10296..7ebe19b 100644
--- a/content/browser/service_worker/service_worker_provider_host_unittest.cc
+++ b/content/browser/service_worker/service_worker_provider_host_unittest.cc
@@ -226,6 +226,17 @@
 
   void OnMojoError(const std::string& error) { bad_messages_.push_back(error); }
 
+  bool CanFindClientProviderHost(ServiceWorkerProviderHost* host) {
+    for (std::unique_ptr<ServiceWorkerContextCore::ProviderHostIterator> it =
+             context_->GetClientProviderHostIterator(
+                 host->document_url().GetOrigin());
+         !it->IsAtEnd(); it->Advance()) {
+      if (host == it->GetProviderHost())
+        return true;
+    }
+    return false;
+  }
+
   std::vector<std::string> bad_messages_;
   TestBrowserThreadBundle thread_bundle_;
   std::unique_ptr<EmbeddedWorkerTestHelper> helper_;
@@ -799,4 +810,46 @@
   EXPECT_EQ(1u, bad_messages_.size());
 }
 
+// Test that a "reserved" (i.e., not execution ready) shared worker client is
+// not included when iterating over client provider hosts. If it were, it'd be
+// undesirably exposed via the Clients API.
+TEST_F(ServiceWorkerProviderHostTest,
+       ReservedClientsAreNotExposedToClientsAPI) {
+  {
+    auto provider_info = mojom::ServiceWorkerProviderInfoForSharedWorker::New();
+    base::WeakPtr<ServiceWorkerProviderHost> host =
+        ServiceWorkerProviderHost::PreCreateForSharedWorker(
+            context_->AsWeakPtr(), helper_->mock_render_process_id(),
+            &provider_info);
+    const GURL url("https://www.example.com/shared_worker.js");
+    host->SetTopmostFrameUrl(url);
+    EXPECT_FALSE(CanFindClientProviderHost(host.get()));
+    host->CompleteSharedWorkerPreparation();
+    EXPECT_TRUE(CanFindClientProviderHost(host.get()));
+  }
+
+  {
+    std::unique_ptr<ServiceWorkerProviderHost> host =
+        ServiceWorkerProviderHost::PreCreateNavigationHost(
+            helper_->context()->AsWeakPtr(), true,
+            base::RepeatingCallback<WebContents*(void)>());
+    ServiceWorkerProviderHostInfo info(
+        host->provider_id(), 1 /* route_id */,
+        blink::mojom::ServiceWorkerProviderType::kForWindow,
+        true /* is_parent_frame_secure */);
+    ServiceWorkerRemoteProviderEndpoint remote_endpoint;
+    remote_endpoint.BindWithProviderHostInfo(&info);
+    host->SetDocumentUrl(GURL("https://www.example.com/page"));
+    EXPECT_FALSE(CanFindClientProviderHost(host.get()));
+
+    host->CompleteNavigationInitialized(
+        helper_->mock_render_process_id(), std::move(info),
+        helper_->GetDispatcherHostForProcess(helper_->mock_render_process_id())
+            ->AsWeakPtr());
+    auto* host_rawptr = host.get();
+    context_->AddProviderHost(std::move(host));
+    EXPECT_TRUE(CanFindClientProviderHost(host_rawptr));
+  }
+}
+
 }  // namespace content
diff --git a/content/browser/service_worker/service_worker_register_job.cc b/content/browser/service_worker/service_worker_register_job.cc
index e0e3e21c..c9ec7d0 100644
--- a/content/browser/service_worker/service_worker_register_job.cc
+++ b/content/browser/service_worker/service_worker_register_job.cc
@@ -586,15 +586,19 @@
 void ServiceWorkerRegisterJob::AddRegistrationToMatchingProviderHosts(
     ServiceWorkerRegistration* registration) {
   DCHECK(registration);
+  // TODO(falken): This should just use GetClientProviderHostIterator as
+  // we only need same-origin clients.
   for (std::unique_ptr<ServiceWorkerContextCore::ProviderHostIterator> it =
            context_->GetProviderHostIterator();
        !it->IsAtEnd(); it->Advance()) {
     ServiceWorkerProviderHost* host = it->GetProviderHost();
-    if (host->IsHostToRunningServiceWorker())
+    if (host->IsHostToRunningServiceWorker() || !host->is_execution_ready()) {
       continue;
+    }
     if (!ServiceWorkerUtils::ScopeMatches(registration->pattern(),
-                                          host->document_url()))
+                                          host->document_url())) {
       continue;
+    }
     host->AddMatchingRegistration(registration);
   }
 }
diff --git a/content/browser/service_worker/service_worker_registration.cc b/content/browser/service_worker/service_worker_registration.cc
index 6dedd7bc..5594ab6 100644
--- a/content/browser/service_worker/service_worker_registration.cc
+++ b/content/browser/service_worker/service_worker_registration.cc
@@ -218,12 +218,16 @@
   DCHECK(context_);
   DCHECK(active_version());
 
+  // TODO(falken): This should just use GetClientProviderHostIterator as
+  // we only need same-origin clients.
   for (std::unique_ptr<ServiceWorkerContextCore::ProviderHostIterator> it =
            context_->GetProviderHostIterator();
        !it->IsAtEnd(); it->Advance()) {
     ServiceWorkerProviderHost* host = it->GetProviderHost();
     if (host->IsHostToRunningServiceWorker())
       continue;
+    if (!host->is_execution_ready())
+      continue;
     if (host->controller() == active_version())
       continue;
     if (!host->IsContextSecureForServiceWorker())
diff --git a/content/browser/service_worker/service_worker_request_handler.cc b/content/browser/service_worker/service_worker_request_handler.cc
index bb16c71..2ca37e9 100644
--- a/content/browser/service_worker/service_worker_request_handler.cc
+++ b/content/browser/service_worker/service_worker_request_handler.cc
@@ -194,6 +194,34 @@
 }
 
 // static
+std::unique_ptr<NavigationLoaderInterceptor>
+ServiceWorkerRequestHandler::InitializeForSharedWorker(
+    const network::ResourceRequest& resource_request,
+    base::WeakPtr<ServiceWorkerProviderHost> host) {
+  DCHECK(ServiceWorkerUtils::IsServicificationEnabled());
+
+  // Create the handler even for insecure HTTP since it's used in the
+  // case of redirect to HTTPS.
+  if (!resource_request.url.SchemeIsHTTPOrHTTPS() &&
+      !OriginCanAccessServiceWorkers(resource_request.url)) {
+    return nullptr;
+  }
+
+  std::unique_ptr<ServiceWorkerRequestHandler> handler(
+      host->CreateRequestHandler(
+          resource_request.fetch_request_mode,
+          resource_request.fetch_credentials_mode,
+          resource_request.fetch_redirect_mode,
+          resource_request.fetch_integrity, resource_request.keepalive,
+          RESOURCE_TYPE_SHARED_WORKER, REQUEST_CONTEXT_TYPE_SHARED_WORKER,
+          resource_request.fetch_frame_type,
+          nullptr /* blob_storage_context: unused in S13n */,
+          resource_request.request_body, resource_request.skip_service_worker));
+
+  return base::WrapUnique<NavigationLoaderInterceptor>(handler.release());
+}
+
+// static
 void ServiceWorkerRequestHandler::InitializeHandler(
     net::URLRequest* request,
     ServiceWorkerContextWrapper* context_wrapper,
diff --git a/content/browser/service_worker/service_worker_request_handler.h b/content/browser/service_worker/service_worker_request_handler.h
index b483853..da73b702 100644
--- a/content/browser/service_worker/service_worker_request_handler.h
+++ b/content/browser/service_worker/service_worker_request_handler.h
@@ -83,6 +83,10 @@
       scoped_refptr<network::ResourceRequestBody> body,
       const base::Callback<WebContents*(void)>& web_contents_getter);
 
+  static std::unique_ptr<NavigationLoaderInterceptor> InitializeForSharedWorker(
+      const network::ResourceRequest& resource_request,
+      base::WeakPtr<ServiceWorkerProviderHost> host);
+
   // Attaches a newly created handler if the given |request| needs to
   // be handled by ServiceWorker.
   // TODO(kinuko): While utilizing UserData to attach data to URLRequest
diff --git a/content/browser/shared_worker/shared_worker_host.cc b/content/browser/shared_worker/shared_worker_host.cc
index 12d52395..3acaa43 100644
--- a/content/browser/shared_worker/shared_worker_host.cc
+++ b/content/browser/shared_worker/shared_worker_host.cc
@@ -78,7 +78,12 @@
 void SharedWorkerHost::Start(
     mojom::SharedWorkerFactoryPtr factory,
     bool pause_on_start,
-    const base::UnguessableToken& devtools_worker_token) {
+    const base::UnguessableToken& devtools_worker_token,
+    mojom::ServiceWorkerProviderInfoForSharedWorkerPtr
+        service_worker_provider_info,
+    network::mojom::URLLoaderFactoryAssociatedPtrInfo script_loader_factory) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
   blink::mojom::WorkerContentSettingsProxyPtr content_settings;
   content_settings_ = std::make_unique<SharedWorkerContentSettingsProxyImpl>(
       instance_->url(), this, mojo::MakeRequest(&content_settings));
@@ -96,10 +101,12 @@
       instance_->content_security_policy_type(),
       instance_->creation_address_space()));
 
-  factory->CreateSharedWorker(
+  factory_ = std::move(factory);
+  factory_->CreateSharedWorker(
       std::move(info), pause_on_start, devtools_worker_token,
-      std::move(content_settings), std::move(host), mojo::MakeRequest(&worker_),
-      std::move(interface_provider));
+      std::move(content_settings), std::move(service_worker_provider_info),
+      std::move(script_loader_factory), std::move(host),
+      mojo::MakeRequest(&worker_), std::move(interface_provider));
 
   // Monitor the lifetime of the worker.
   worker_.set_connection_error_handler(base::BindOnce(
diff --git a/content/browser/shared_worker/shared_worker_host.h b/content/browser/shared_worker/shared_worker_host.h
index 3a85dd3..7ec1443 100644
--- a/content/browser/shared_worker/shared_worker_host.h
+++ b/content/browser/shared_worker/shared_worker_host.h
@@ -16,11 +16,13 @@
 #include "base/strings/string16.h"
 #include "base/time/time.h"
 #include "base/unguessable_token.h"
+#include "content/common/service_worker/service_worker_provider.mojom.h"
 #include "content/common/shared_worker/shared_worker.mojom.h"
 #include "content/common/shared_worker/shared_worker_client.mojom.h"
 #include "content/common/shared_worker/shared_worker_factory.mojom.h"
 #include "content/common/shared_worker/shared_worker_host.mojom.h"
 #include "mojo/public/cpp/bindings/binding.h"
+#include "services/network/public/mojom/url_loader_factory.mojom.h"
 #include "services/service_manager/public/mojom/interface_provider.mojom.h"
 #include "third_party/WebKit/public/web/devtools_agent.mojom.h"
 
@@ -31,7 +33,6 @@
 }
 
 namespace content {
-
 class SharedWorkerContentSettingsProxyImpl;
 class SharedWorkerInstance;
 class SharedWorkerServiceImpl;
@@ -49,9 +50,24 @@
   ~SharedWorkerHost() override;
 
   // Starts the SharedWorker in the renderer process.
-  void Start(mojom::SharedWorkerFactoryPtr factory,
-             bool pause_on_start,
-             const base::UnguessableToken& devtools_worker_token);
+  //
+  // S13nServiceWorker:
+  // |service_worker_provider_info| is sent to the renderer process and contains
+  // information about its ServiceWorkerProviderHost, the browser-side host for
+  // supporting the shared worker as a service worker client.
+  //
+  // S13nServiceWorker:
+  // |script_loader_factory| is sent to the renderer process and is to be used
+  // to request the shared worker's script. Currently it's only non-null when
+  // S13nServiceWorker is enabled, to allow service worker machinery to observe
+  // the request, but other web platform features may also use it someday.
+  void Start(
+      mojom::SharedWorkerFactoryPtr factory,
+      bool pause_on_start,
+      const base::UnguessableToken& devtools_worker_token,
+      mojom::ServiceWorkerProviderInfoForSharedWorkerPtr
+          service_worker_provider_info,
+      network::mojom::URLLoaderFactoryAssociatedPtrInfo script_loader_factory);
 
   void AllowFileSystem(const GURL& url,
                        base::OnceCallback<void(bool)> callback);
@@ -109,6 +125,7 @@
                     mojo::ScopedMessagePipeHandle interface_pipe) override;
 
   mojo::Binding<mojom::SharedWorkerHost> binding_;
+  // |service_| owns |this|.
   SharedWorkerServiceImpl* service_;
   std::unique_ptr<SharedWorkerInstance> instance_;
   ClientList clients_;
@@ -126,6 +143,12 @@
 
   std::unique_ptr<SharedWorkerContentSettingsProxyImpl> content_settings_;
 
+  // This is kept alive during the lifetime of the shared worker, since it's
+  // associated with Mojo interfaces (ServiceWorkerContainer and
+  // URLLoaderFactory) that are needed to stay alive while the worker is
+  // starting or running.
+  mojom::SharedWorkerFactoryPtr factory_;
+
   mojo::Binding<service_manager::mojom::InterfaceProvider>
       interface_provider_binding_;
 
diff --git a/content/browser/shared_worker/shared_worker_script_loader.cc b/content/browser/shared_worker/shared_worker_script_loader.cc
new file mode 100644
index 0000000..ff39e06
--- /dev/null
+++ b/content/browser/shared_worker/shared_worker_script_loader.cc
@@ -0,0 +1,203 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/shared_worker/shared_worker_script_loader.h"
+
+#include "content/browser/loader/navigation_loader_interceptor.h"
+#include "content/browser/service_worker/service_worker_provider_host.h"
+#include "content/browser/url_loader_factory_getter.h"
+#include "content/common/service_worker/service_worker_utils.h"
+#include "content/public/browser/resource_context.h"
+#include "net/url_request/redirect_util.h"
+
+namespace content {
+
+SharedWorkerScriptLoader::SharedWorkerScriptLoader(
+    int32_t routing_id,
+    int32_t request_id,
+    uint32_t options,
+    const network::ResourceRequest& resource_request,
+    network::mojom::URLLoaderClientPtr client,
+    base::WeakPtr<ServiceWorkerProviderHost> service_worker_provider_host,
+    ResourceContext* resource_context,
+    scoped_refptr<URLLoaderFactoryGetter> loader_factory_getter,
+    const net::MutableNetworkTrafficAnnotationTag& traffic_annotation)
+    : routing_id_(routing_id),
+      request_id_(request_id),
+      options_(options),
+      resource_request_(resource_request),
+      client_(std::move(client)),
+      service_worker_provider_host_(service_worker_provider_host),
+      resource_context_(resource_context),
+      loader_factory_getter_(std::move(loader_factory_getter)),
+      traffic_annotation_(traffic_annotation),
+      url_loader_client_binding_(this),
+      weak_factory_(this) {
+  DCHECK(ServiceWorkerUtils::IsServicificationEnabled());
+
+  if (service_worker_provider_host_) {
+    service_worker_interceptor_ =
+        ServiceWorkerRequestHandler::InitializeForSharedWorker(
+            resource_request_, service_worker_provider_host_);
+  }
+
+  Start();
+}
+
+SharedWorkerScriptLoader::~SharedWorkerScriptLoader() = default;
+
+void SharedWorkerScriptLoader::Start() {
+  if (service_worker_interceptor_) {
+    service_worker_interceptor_->MaybeCreateLoader(
+        resource_request_, resource_context_,
+        base::BindOnce(&SharedWorkerScriptLoader::MaybeStartLoader,
+                       weak_factory_.GetWeakPtr(),
+                       service_worker_interceptor_.get()));
+    return;
+  }
+
+  LoadFromNetwork();
+}
+
+void SharedWorkerScriptLoader::MaybeStartLoader(
+    NavigationLoaderInterceptor* interceptor,
+    SingleRequestURLLoaderFactory::RequestHandler single_request_handler) {
+  if (single_request_handler) {
+    // The interceptor elected to handle the request. Use it.
+    network::mojom::URLLoaderClientPtr client;
+    url_loader_client_binding_.Bind(mojo::MakeRequest(&client));
+    url_loader_factory_ = base::MakeRefCounted<SingleRequestURLLoaderFactory>(
+        std::move(single_request_handler));
+    url_loader_factory_->CreateLoaderAndStart(
+        mojo::MakeRequest(&url_loader_), routing_id_, request_id_, options_,
+        resource_request_, std::move(client), traffic_annotation_);
+    // We continue in URLLoaderClient calls.
+    return;
+  }
+
+  // TODO(falken): Support blob urls.
+
+  LoadFromNetwork();
+}
+
+void SharedWorkerScriptLoader::LoadFromNetwork() {
+  network::mojom::URLLoaderClientPtr client;
+  url_loader_client_binding_.Bind(mojo::MakeRequest(&client));
+  url_loader_factory_ = loader_factory_getter_->GetNetworkFactory();
+  url_loader_factory_->CreateLoaderAndStart(
+      mojo::MakeRequest(&url_loader_), routing_id_, request_id_, options_,
+      resource_request_, std::move(client), traffic_annotation_);
+  // We continue in URLLoaderClient calls.
+}
+
+// URLLoader -------------------------------------------------------------------
+// When this class gets a FollowRedirect IPC from the renderer, it restarts with
+// the new URL.
+
+void SharedWorkerScriptLoader::FollowRedirect() {
+  DCHECK(redirect_info_);
+
+  // |should_clear_upload| is unused because there is no body anyway.
+  DCHECK(!resource_request_.request_body);
+  bool should_clear_upload = false;
+  net::RedirectUtil::UpdateHttpRequest(
+      resource_request_.url, resource_request_.method, *redirect_info_,
+      &resource_request_.headers, &should_clear_upload);
+
+  resource_request_.url = redirect_info_->new_url;
+  resource_request_.method = redirect_info_->new_method;
+  resource_request_.site_for_cookies = redirect_info_->new_site_for_cookies;
+  resource_request_.referrer = GURL(redirect_info_->new_referrer);
+  resource_request_.referrer_policy = redirect_info_->new_referrer_policy;
+
+  // Restart the request.
+  url_loader_client_binding_.Unbind();
+  redirect_info_.reset();
+  Start();
+}
+
+void SharedWorkerScriptLoader::ProceedWithResponse() {
+  // Only for navigations.
+  NOTREACHED();
+}
+
+// Below we make a small effort to support the other URLLoader functions by
+// forwarding to the current |url_loader_| if any, but don't bother queuing
+// state or propagating state to a new URLLoader upon redirect.
+void SharedWorkerScriptLoader::SetPriority(net::RequestPriority priority,
+                                           int32_t intra_priority_value) {
+  if (url_loader_)
+    url_loader_->SetPriority(priority, intra_priority_value);
+}
+
+void SharedWorkerScriptLoader::PauseReadingBodyFromNet() {
+  if (url_loader_)
+    url_loader_->PauseReadingBodyFromNet();
+}
+
+void SharedWorkerScriptLoader::ResumeReadingBodyFromNet() {
+  if (url_loader_)
+    url_loader_->ResumeReadingBodyFromNet();
+}
+
+// URLLoaderClient ----------------------------------------------------------
+// This class forwards any client messages to the outer client in the renderer.
+// Additionally, on redirects it saves the redirect info so if the renderer
+// calls FollowRedirect(), it can do so.
+
+void SharedWorkerScriptLoader::OnReceiveResponse(
+    const network::ResourceResponseHead& response_head,
+    network::mojom::DownloadedTempFilePtr downloaded_file) {
+  client_->OnReceiveResponse(response_head, std::move(downloaded_file));
+}
+
+void SharedWorkerScriptLoader::OnReceiveRedirect(
+    const net::RedirectInfo& redirect_info,
+    const network::ResourceResponseHead& response_head) {
+  if (--redirect_limit_ == 0) {
+    client_->OnComplete(
+        network::URLLoaderCompletionStatus(net::ERR_TOO_MANY_REDIRECTS));
+    return;
+  }
+
+  redirect_info_ = redirect_info;
+  client_->OnReceiveRedirect(redirect_info, response_head);
+}
+
+void SharedWorkerScriptLoader::OnDataDownloaded(int64_t data_len,
+                                                int64_t encoded_data_len) {
+  client_->OnDataDownloaded(data_len, encoded_data_len);
+}
+
+void SharedWorkerScriptLoader::OnUploadProgress(
+    int64_t current_position,
+    int64_t total_size,
+    OnUploadProgressCallback ack_callback) {
+  client_->OnUploadProgress(current_position, total_size,
+                            std::move(ack_callback));
+}
+
+void SharedWorkerScriptLoader::OnReceiveCachedMetadata(
+    const std::vector<uint8_t>& data) {
+  client_->OnReceiveCachedMetadata(data);
+}
+
+void SharedWorkerScriptLoader::OnTransferSizeUpdated(
+    int32_t transfer_size_diff) {
+  client_->OnTransferSizeUpdated(transfer_size_diff);
+}
+
+void SharedWorkerScriptLoader::OnStartLoadingResponseBody(
+    mojo::ScopedDataPipeConsumerHandle consumer) {
+  client_->OnStartLoadingResponseBody(std::move(consumer));
+}
+
+void SharedWorkerScriptLoader::OnComplete(
+    const network::URLLoaderCompletionStatus& status) {
+  if (status.error_code == net::OK)
+    service_worker_provider_host_->CompleteSharedWorkerPreparation();
+  client_->OnComplete(status);
+}
+
+}  // namespace content
diff --git a/content/browser/shared_worker/shared_worker_script_loader.h b/content/browser/shared_worker/shared_worker_script_loader.h
new file mode 100644
index 0000000..7e61d8c
--- /dev/null
+++ b/content/browser/shared_worker/shared_worker_script_loader.h
@@ -0,0 +1,106 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_SHARED_WORKER_SHARED_WORKER_SCRIPT_LOADER_H_
+#define CONTENT_BROWSER_SHARED_WORKER_SHARED_WORKER_SCRIPT_LOADER_H_
+
+#include "base/macros.h"
+#include "content/common/single_request_url_loader_factory.h"
+#include "mojo/public/cpp/bindings/binding.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
+#include "services/network/public/cpp/resource_request.h"
+#include "services/network/public/mojom/url_loader.mojom.h"
+
+namespace content {
+class NavigationLoaderInterceptor;
+class ResourceContext;
+class ServiceWorkerProviderHost;
+class URLLoaderFactoryGetter;
+
+// The URLLoader for loading a shared worker script. Only used for the main
+// script request.
+//
+// This acts much like NavigationURLLoaderNetworkService. It allows a
+// NavigationLoaderInterceptor to intercept the request with its own loader, and
+// goes to the network loader otherwise. Once a loader is started, this class
+// acts as the URLLoaderClient for it, forwarding messages to the outer client.
+// On redirects, it starts over with the new request URL, possibly starting a
+// new loader and becoming the client of that.
+//
+// Lives on the IO thread.
+class SharedWorkerScriptLoader : public network::mojom::URLLoader,
+                                 public network::mojom::URLLoaderClient {
+ public:
+  SharedWorkerScriptLoader(
+      int32_t routing_id,
+      int32_t request_id,
+      uint32_t options,
+      const network::ResourceRequest& resource_request,
+      network::mojom::URLLoaderClientPtr client,
+      base::WeakPtr<ServiceWorkerProviderHost> service_worker_provider_host,
+      ResourceContext* resource_context,
+      scoped_refptr<URLLoaderFactoryGetter> loader_factory_getter,
+      const net::MutableNetworkTrafficAnnotationTag& traffic_annotation);
+  ~SharedWorkerScriptLoader() override;
+
+  // network::mojom::URLLoader:
+  void FollowRedirect() override;
+  void ProceedWithResponse() override;
+  void SetPriority(net::RequestPriority priority,
+                   int32_t intra_priority_value) override;
+  void PauseReadingBodyFromNet() override;
+  void ResumeReadingBodyFromNet() override;
+
+  // network::mojom::URLLoaderClient:
+  void OnReceiveResponse(
+      const network::ResourceResponseHead& response_head,
+      network::mojom::DownloadedTempFilePtr downloaded_file) override;
+  void OnReceiveRedirect(
+      const net::RedirectInfo& redirect_info,
+      const network::ResourceResponseHead& response_head) override;
+  void OnDataDownloaded(int64_t data_len, int64_t encoded_data_len) override;
+  void OnUploadProgress(int64_t current_position,
+                        int64_t total_size,
+                        OnUploadProgressCallback ack_callback) override;
+  void OnReceiveCachedMetadata(const std::vector<uint8_t>& data) override;
+  void OnTransferSizeUpdated(int32_t transfer_size_diff) override;
+  void OnStartLoadingResponseBody(
+      mojo::ScopedDataPipeConsumerHandle body) override;
+  void OnComplete(const network::URLLoaderCompletionStatus& status) override;
+
+ private:
+  void Start();
+  void MaybeStartLoader(
+      NavigationLoaderInterceptor* interceptor,
+      SingleRequestURLLoaderFactory::RequestHandler single_request_handler);
+  void LoadFromNetwork();
+
+  // TODO(falken): Add other interceptors like in
+  // NavigationURLLoaderNetworkService.
+  std::unique_ptr<NavigationLoaderInterceptor> service_worker_interceptor_;
+
+  const int32_t routing_id_;
+  const int32_t request_id_;
+  const uint32_t options_;
+  network::ResourceRequest resource_request_;
+  network::mojom::URLLoaderClientPtr client_;
+  base::WeakPtr<ServiceWorkerProviderHost> service_worker_provider_host_;
+  ResourceContext* resource_context_;
+  scoped_refptr<URLLoaderFactoryGetter> loader_factory_getter_;
+  net::MutableNetworkTrafficAnnotationTag traffic_annotation_;
+
+  base::Optional<net::RedirectInfo> redirect_info_;
+  int redirect_limit_ = net::URLRequest::kMaxRedirects;
+
+  network::mojom::URLLoaderPtr url_loader_;
+  mojo::Binding<network::mojom::URLLoaderClient> url_loader_client_binding_;
+  scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory_;
+
+  base::WeakPtrFactory<SharedWorkerScriptLoader> weak_factory_;
+
+  DISALLOW_COPY_AND_ASSIGN(SharedWorkerScriptLoader);
+};
+
+}  // namespace content
+#endif  // CONTENT_BROWSER_SHARED_WORKER_SHARED_WORKER_SCRIPT_LOADER_H_
diff --git a/content/browser/shared_worker/shared_worker_script_loader_factory.cc b/content/browser/shared_worker/shared_worker_script_loader_factory.cc
new file mode 100644
index 0000000..aee3017
--- /dev/null
+++ b/content/browser/shared_worker/shared_worker_script_loader_factory.cc
@@ -0,0 +1,69 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/shared_worker/shared_worker_script_loader_factory.h"
+
+#include <memory>
+#include "content/browser/service_worker/service_worker_context_core.h"
+#include "content/browser/service_worker/service_worker_context_wrapper.h"
+#include "content/browser/service_worker/service_worker_provider_host.h"
+#include "content/browser/service_worker/service_worker_version.h"
+#include "content/browser/shared_worker/shared_worker_script_loader.h"
+#include "content/browser/url_loader_factory_getter.h"
+#include "content/common/service_worker/service_worker_utils.h"
+#include "mojo/public/cpp/bindings/strong_binding.h"
+#include "services/network/public/cpp/resource_response.h"
+#include "third_party/WebKit/public/mojom/service_worker/service_worker_provider_type.mojom.h"
+
+namespace content {
+
+SharedWorkerScriptLoaderFactory::SharedWorkerScriptLoaderFactory(
+    ServiceWorkerContextWrapper* context,
+    base::WeakPtr<ServiceWorkerProviderHost> service_worker_provider_host,
+    ResourceContext* resource_context,
+    scoped_refptr<URLLoaderFactoryGetter> loader_factory_getter)
+    : service_worker_provider_host_(service_worker_provider_host),
+      resource_context_(resource_context),
+      loader_factory_getter_(loader_factory_getter) {
+  DCHECK(ServiceWorkerUtils::IsServicificationEnabled());
+  DCHECK_EQ(service_worker_provider_host_->provider_type(),
+            blink::mojom::ServiceWorkerProviderType::kForSharedWorker);
+}
+
+SharedWorkerScriptLoaderFactory::~SharedWorkerScriptLoaderFactory() {}
+
+void SharedWorkerScriptLoaderFactory::CreateLoaderAndStart(
+    network::mojom::URLLoaderRequest request,
+    int32_t routing_id,
+    int32_t request_id,
+    uint32_t options,
+    const network::ResourceRequest& resource_request,
+    network::mojom::URLLoaderClientPtr client,
+    const net::MutableNetworkTrafficAnnotationTag& traffic_annotation) {
+  // Handle only the main script (RESOURCE_TYPE_SHARED_WORKER). Import scripts
+  // should go to the network loader or controller.
+  if (resource_request.resource_type != RESOURCE_TYPE_SHARED_WORKER) {
+    mojo::ReportBadMessage(
+        "SharedWorkerScriptLoaderFactory should only get requests for shared "
+        "worker scripts");
+    return;
+  }
+
+  // Create a SharedWorkerScriptLoader to load the script.
+  mojo::MakeStrongBinding(
+      std::make_unique<SharedWorkerScriptLoader>(
+          routing_id, request_id, options, resource_request, std::move(client),
+          service_worker_provider_host_, resource_context_,
+          loader_factory_getter_, traffic_annotation),
+      std::move(request));
+}
+
+void SharedWorkerScriptLoaderFactory::Clone(
+    network::mojom::URLLoaderFactoryRequest request) {
+  // This method is required to support synchronous requests, which shared
+  // worker script requests are not.
+  NOTIMPLEMENTED();
+}
+
+}  // namespace content
diff --git a/content/browser/shared_worker/shared_worker_script_loader_factory.h b/content/browser/shared_worker/shared_worker_script_loader_factory.h
new file mode 100644
index 0000000..7e0e4c5c
--- /dev/null
+++ b/content/browser/shared_worker/shared_worker_script_loader_factory.h
@@ -0,0 +1,59 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_SHARED_WORKER_SHARED_WORKER_SCRIPT_LOADER_FACTORY_H_
+#define CONTENT_BROWSER_SHARED_WORKER_SHARED_WORKER_SCRIPT_LOADER_FACTORY_H_
+
+#include "base/macros.h"
+#include "services/network/public/mojom/url_loader_factory.mojom.h"
+
+namespace content {
+
+class ServiceWorkerContextWrapper;
+class ServiceWorkerProviderHost;
+class URLLoaderFactoryGetter;
+class ResourceContext;
+
+// S13nServiceWorker:
+// Created per one running shared worker for loading its script.
+//
+// Shared worker script loads require special logic because they are similiar to
+// navigations from the point of view of web platform features like service
+// worker.
+//
+// This creates a SharedWorkerScriptLoader to load the script, which follows
+// redirects and sets the controller service worker on the shared worker if
+// needed.
+class SharedWorkerScriptLoaderFactory
+    : public network::mojom::URLLoaderFactory {
+ public:
+  SharedWorkerScriptLoaderFactory(
+      ServiceWorkerContextWrapper* context,
+      base::WeakPtr<ServiceWorkerProviderHost> provider_host,
+      ResourceContext* resource_context,
+      scoped_refptr<URLLoaderFactoryGetter> loader_factory_getter);
+  ~SharedWorkerScriptLoaderFactory() override;
+
+  // network::mojom::URLLoaderFactory:
+  void CreateLoaderAndStart(network::mojom::URLLoaderRequest request,
+                            int32_t routing_id,
+                            int32_t request_id,
+                            uint32_t options,
+                            const network::ResourceRequest& resource_request,
+                            network::mojom::URLLoaderClientPtr client,
+                            const net::MutableNetworkTrafficAnnotationTag&
+                                traffic_annotation) override;
+  void Clone(network::mojom::URLLoaderFactoryRequest request) override;
+
+ private:
+  base::WeakPtr<ServiceWorkerProviderHost> service_worker_provider_host_;
+  ResourceContext* resource_context_ = nullptr;
+  scoped_refptr<URLLoaderFactoryGetter> loader_factory_getter_;
+
+  DISALLOW_COPY_AND_ASSIGN(SharedWorkerScriptLoaderFactory);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_SHARED_WORKER_SHARED_WORKER_SCRIPT_LOADER_FACTORY_H_
diff --git a/content/browser/shared_worker/shared_worker_service_impl.cc b/content/browser/shared_worker/shared_worker_service_impl.cc
index 6f34a7b..6c2ed4d 100644
--- a/content/browser/shared_worker/shared_worker_service_impl.cc
+++ b/content/browser/shared_worker/shared_worker_service_impl.cc
@@ -16,7 +16,11 @@
 #include "content/browser/devtools/shared_worker_devtools_manager.h"
 #include "content/browser/shared_worker/shared_worker_host.h"
 #include "content/browser/shared_worker/shared_worker_instance.h"
+#include "content/browser/shared_worker/shared_worker_script_loader_factory.h"
+#include "content/browser/storage_partition_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
+#include "content/common/service_worker/service_worker_provider.mojom.h"
+#include "content/common/service_worker/service_worker_utils.h"
 #include "content/common/shared_worker/shared_worker_client.mojom.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
@@ -24,6 +28,7 @@
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/common/bind_interface_helpers.h"
+#include "mojo/public/cpp/bindings/strong_associated_binding.h"
 #include "third_party/WebKit/public/common/message_port/message_port_channel.h"
 #include "url/origin.h"
 
@@ -35,9 +40,38 @@
          host->IsKeepAliveRefCountDisabled();
 }
 
+void CreateScriptLoaderOnIO(
+    scoped_refptr<URLLoaderFactoryGetter> loader_factory_getter,
+    scoped_refptr<ServiceWorkerContextWrapper> context,
+    int process_id,
+    base::OnceCallback<void(mojom::ServiceWorkerProviderInfoForSharedWorkerPtr,
+                            network::mojom::URLLoaderFactoryAssociatedPtrInfo)>
+        callback) {
+  // Set up for service worker.
+  auto provider_info = mojom::ServiceWorkerProviderInfoForSharedWorker::New();
+  base::WeakPtr<ServiceWorkerProviderHost> host =
+      context->PreCreateHostForSharedWorker(process_id, &provider_info);
+
+  // Create the SharedWorkerScriptLoaderFactory.
+  network::mojom::URLLoaderFactoryAssociatedPtrInfo script_loader_factory;
+  mojo::MakeStrongAssociatedBinding(
+      std::make_unique<SharedWorkerScriptLoaderFactory>(
+          context.get(), host->AsWeakPtr(), context->resource_context(),
+          std::move(loader_factory_getter)),
+      mojo::MakeRequest(&script_loader_factory));
+
+  BrowserThread::PostTask(
+      BrowserThread::UI, FROM_HERE,
+      base::BindOnce(std::move(callback), std::move(provider_info),
+                     std::move(script_loader_factory)));
+}
+
 }  // namespace
 
-SharedWorkerServiceImpl::SharedWorkerServiceImpl() {}
+SharedWorkerServiceImpl::SharedWorkerServiceImpl(
+    scoped_refptr<ServiceWorkerContextWrapper> service_worker_context)
+    : service_worker_context_(std::move(service_worker_context)),
+      weak_factory_(this) {}
 
 SharedWorkerServiceImpl::~SharedWorkerServiceImpl() {}
 
@@ -128,8 +162,26 @@
     DestroyHost(host);
   }
 
+  // Bounce to the IO thread to setup service worker support in case the request
+  // for the worker script will need to be intercepted by service workers.
+  // TODO(falken): Move service worker to the UI thread.
+  if (ServiceWorkerUtils::IsServicificationEnabled()) {
+    BrowserThread::PostTask(
+        BrowserThread::IO, FROM_HERE,
+        base::BindOnce(&CreateScriptLoaderOnIO,
+                       service_worker_context_->storage_partition()
+                           ->url_loader_factory_getter(),
+                       service_worker_context_, process_id,
+                       base::BindOnce(&SharedWorkerServiceImpl::CreateWorker,
+                                      weak_factory_.GetWeakPtr(),
+                                      std::move(instance), std::move(client),
+                                      process_id, frame_id, message_port)));
+    return;
+  }
+
   CreateWorker(std::move(instance), std::move(client), process_id, frame_id,
-               message_port);
+               message_port, nullptr /*  service_worker_provider_info */,
+               {} /* script_loader_factory */);
 }
 
 void SharedWorkerServiceImpl::DestroyHost(SharedWorkerHost* host) {
@@ -151,9 +203,12 @@
     mojom::SharedWorkerClientPtr client,
     int process_id,
     int frame_id,
-    const blink::MessagePortChannel& message_port) {
-  // Re-use the process that requested the shared worker.
-  int worker_process_id = process_id;
+    const blink::MessagePortChannel& message_port,
+    mojom::ServiceWorkerProviderInfoForSharedWorkerPtr
+        service_worker_provider_info,
+    network::mojom::URLLoaderFactoryAssociatedPtrInfo
+        script_loader_factory_info) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   RenderProcessHost* process_host = RenderProcessHost::FromID(process_id);
   // If the requesting process is shutting down, then just drop this request on
@@ -164,9 +219,8 @@
   // Keep the renderer process alive that will be hosting the shared worker.
   process_host->IncrementKeepAliveRefCount(
       RenderProcessHost::KeepAliveClientType::kSharedWorker);
-
-  auto host = std::make_unique<SharedWorkerHost>(this, std::move(instance),
-                                                 worker_process_id);
+  auto host =
+      std::make_unique<SharedWorkerHost>(this, std::move(instance), process_id);
 
   bool pause_on_start;
   base::UnguessableToken devtools_worker_token;
@@ -178,7 +232,9 @@
   mojom::SharedWorkerFactoryPtr factory;
   BindInterface(process_host, &factory);
 
-  host->Start(std::move(factory), pause_on_start, devtools_worker_token);
+  host->Start(std::move(factory), pause_on_start, devtools_worker_token,
+              std::move(service_worker_provider_info),
+              std::move(script_loader_factory_info));
   host->AddClient(std::move(client), process_id, frame_id, message_port);
 
   worker_hosts_.insert(std::move(host));
diff --git a/content/browser/shared_worker/shared_worker_service_impl.h b/content/browser/shared_worker/shared_worker_service_impl.h
index 86cd0e8e..c4075f8 100644
--- a/content/browser/shared_worker/shared_worker_service_impl.h
+++ b/content/browser/shared_worker/shared_worker_service_impl.h
@@ -14,23 +14,26 @@
 #include "base/containers/unique_ptr_adapters.h"
 #include "base/macros.h"
 #include "base/memory/singleton.h"
+#include "content/browser/service_worker/service_worker_context_wrapper.h"
 #include "content/browser/shared_worker/shared_worker_host.h"
+#include "content/common/service_worker/service_worker_provider.mojom.h"
 #include "content/common/shared_worker/shared_worker_connector.mojom.h"
 #include "content/common/shared_worker/shared_worker_factory.mojom.h"
 #include "content/public/browser/shared_worker_service.h"
+#include "services/network/public/mojom/url_loader_factory.mojom.h"
 
 namespace blink {
 class MessagePortChannel;
 }
 
 namespace content {
-
 class SharedWorkerInstance;
 class SharedWorkerHost;
 
 class CONTENT_EXPORT SharedWorkerServiceImpl : public SharedWorkerService {
  public:
-  SharedWorkerServiceImpl();
+  explicit SharedWorkerServiceImpl(
+      scoped_refptr<ServiceWorkerContextWrapper> service_worker_context);
   ~SharedWorkerServiceImpl() override;
 
   // SharedWorkerService implementation.
@@ -58,7 +61,11 @@
                     mojom::SharedWorkerClientPtr client,
                     int process_id,
                     int frame_id,
-                    const blink::MessagePortChannel& message_port);
+                    const blink::MessagePortChannel& message_port,
+                    mojom::ServiceWorkerProviderInfoForSharedWorkerPtr
+                        service_worker_provider_info,
+                    network::mojom::URLLoaderFactoryAssociatedPtrInfo
+                        script_loader_factory_info);
 
   // Returns nullptr if there is no such host.
   SharedWorkerHost* FindSharedWorkerHost(int process_id, int route_id);
@@ -69,6 +76,10 @@
       worker_hosts_;
   base::OnceClosure terminate_all_workers_callback_;
 
+  scoped_refptr<ServiceWorkerContextWrapper> service_worker_context_;
+
+  base::WeakPtrFactory<SharedWorkerServiceImpl> weak_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(SharedWorkerServiceImpl);
 };
 
diff --git a/content/browser/shared_worker/shared_worker_service_impl_unittest.cc b/content/browser/shared_worker/shared_worker_service_impl_unittest.cc
index ff4f9225..475d740 100644
--- a/content/browser/shared_worker/shared_worker_service_impl_unittest.cc
+++ b/content/browser/shared_worker/shared_worker_service_impl_unittest.cc
@@ -193,6 +193,10 @@
       bool pause_on_start,
       const base::UnguessableToken& devtools_worker_token,
       blink::mojom::WorkerContentSettingsProxyPtr content_settings,
+      mojom::ServiceWorkerProviderInfoForSharedWorkerPtr
+          service_worker_provider_info,
+      network::mojom::URLLoaderFactoryAssociatedPtrInfo
+          script_loader_factory_ptr_info,
       mojom::SharedWorkerHostPtr host,
       mojom::SharedWorkerRequest request,
       service_manager::mojom::InterfaceProviderPtr interface_provider)
diff --git a/content/browser/storage_partition_impl.cc b/content/browser/storage_partition_impl.cc
index ff32e2cb..688f8de 100644
--- a/content/browser/storage_partition_impl.cc
+++ b/content/browser/storage_partition_impl.cc
@@ -633,8 +633,8 @@
   partition->service_worker_context_ = new ServiceWorkerContextWrapper(context);
   partition->service_worker_context_->set_storage_partition(partition.get());
 
-  partition->shared_worker_service_ =
-      std::make_unique<SharedWorkerServiceImpl>();
+  partition->shared_worker_service_ = std::make_unique<SharedWorkerServiceImpl>(
+      partition->service_worker_context_);
 
   partition->appcache_service_ =
       new ChromeAppCacheService(quota_manager_proxy.get());
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index 3d744549b..8b3a24b 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -3320,7 +3320,7 @@
 void WebContentsImpl::AdjustPreviewsStateForNavigation(
     PreviewsState* previews_state) {
   if (delegate_)
-    delegate_->AdjustPreviewsStateForNavigation(previews_state);
+    delegate_->AdjustPreviewsStateForNavigation(this, previews_state);
 }
 
 InterstitialPageImpl* WebContentsImpl::GetInterstitialPage() const {
@@ -4141,6 +4141,11 @@
     delegate_->UpdatePictureInPictureSurfaceId(surface_id);
 }
 
+void WebContentsImpl::ExitPictureInPicture() {
+  if (delegate_)
+    delegate_->ExitPictureInPicture();
+}
+
 #if defined(OS_ANDROID)
 base::android::ScopedJavaLocalRef<jobject>
 WebContentsImpl::GetJavaRenderFrameHostDelegate() {
diff --git a/content/browser/web_contents/web_contents_impl.h b/content/browser/web_contents/web_contents_impl.h
index 3e8fa75..5af6e69 100644
--- a/content/browser/web_contents/web_contents_impl.h
+++ b/content/browser/web_contents/web_contents_impl.h
@@ -577,6 +577,7 @@
   void ResourceLoadComplete(
       mojom::ResourceLoadInfoPtr resource_load_information) override;
   void UpdatePictureInPictureSurfaceId(viz::SurfaceId surface_id) override;
+  void ExitPictureInPicture() override;
 
   // RenderViewHostDelegate ----------------------------------------------------
   RenderViewHostDelegateView* GetDelegateView() override;
diff --git a/content/common/frame.mojom b/content/common/frame.mojom
index c0e2147..72335d0 100644
--- a/content/common/frame.mojom
+++ b/content/common/frame.mojom
@@ -331,4 +331,7 @@
   // Sent by the renderer to update Picture-in-Picture with SurfaceId information
   // to be used to show content in the Picture-in-Picture window.
   OnUpdatePictureInPictureSurfaceId(viz.mojom.SurfaceId surface_id);
+
+  // Sent by the renderer to signal that Picture-in-Picture mode has ended.
+  OnExitPictureInPicture();
 };
diff --git a/content/common/service_worker/service_worker_container.mojom b/content/common/service_worker/service_worker_container.mojom
index 86739ba0..ac3de2c3 100644
--- a/content/common/service_worker/service_worker_container.mojom
+++ b/content/common/service_worker/service_worker_container.mojom
@@ -78,6 +78,11 @@
   // Clones the Mojo end point to the ServiceWorker container host. This is
   // used to communicate with the host from dedicated and shared workers.
   CloneForWorker(ServiceWorkerContainerHost& container_host_for_worker);
+
+  // Does nothing but calls the callback. Useful for pumping the message pipe
+  // for this interface and associated interfaces: when the callback is called,
+  // you know all incoming messages up to the Ping() call have been received.
+  Ping() => ();
 };
 
 // mojom::ServiceWorkerContainer is a renderer-side interface.
diff --git a/content/common/service_worker/service_worker_provider.mojom b/content/common/service_worker/service_worker_provider.mojom
index 3b3e306e..5207e66 100644
--- a/content/common/service_worker/service_worker_provider.mojom
+++ b/content/common/service_worker/service_worker_provider.mojom
@@ -15,6 +15,16 @@
 // and browser.
 const string kNavigation_ServiceWorkerSpec = "navigation:service_worker";
 
+// S13nServiceWorker:
+// Sent from the browser process to the renderer. Contains parameteres for the
+// constructor of ServiceWorkerNetworkProvider used for starting a shared
+// worker.
+struct ServiceWorkerProviderInfoForSharedWorker {
+  int32 provider_id;
+  associated ServiceWorkerContainerHost host_ptr_info;
+  associated ServiceWorkerContainer& client_request;
+};
+
 // Sent from the browser process to the renderer. Contains parameters for the
 // constructor of ServiceWorkerNetworkProvider used for starting a service
 // worker.
@@ -27,7 +37,7 @@
   associated ServiceWorkerContainerHost host_ptr_info;
   associated ServiceWorkerContainer& client_request;
 
-  // For servicified service worker only.
+  // S13nServiceWorker:
   // The loader to use for loading the worker's main script and
   // importScripts().
   associated network.mojom.URLLoaderFactory? script_loader_factory_ptr_info;
diff --git a/content/common/service_worker/service_worker_provider_host_info.h b/content/common/service_worker/service_worker_provider_host_info.h
index 8092866..14a6d59 100644
--- a/content/common/service_worker/service_worker_provider_host_info.h
+++ b/content/common/service_worker/service_worker_provider_host_info.h
@@ -56,14 +56,14 @@
 
   // Mojo endpoint to send a message from the renderer to the browser. This
   // will be associated with ServiceWorkerDisptacherHost. |host_request| should
-  // be valid when ServiceWorkerProviderHostInfo is passed to any Mojo methods.
+  // be valid when ServiceWorkerProviderHostInfo is passed to any Mojo method.
   // After used to create the ServiceWorkerProviderHost, this will be invalid.
   mojom::ServiceWorkerContainerHostAssociatedRequest host_request;
 
   // Mojo endpoint to send a message from the browser to the renderer. This
-  // will be associated with ServiceWorkerDisptacherHost. |client_ptr_info|
+  // will be associated with ServiceWorkerDispatcherHost. |client_ptr_info|
   // should be valid when ServiceWorkerProviderHostInfo is passed to any Mojo
-  // methods.
+  // method.
   // After used to create the ServiceWorkerProviderHost, this will be invalid.
   mojom::ServiceWorkerContainerAssociatedPtrInfo client_ptr_info;
 
diff --git a/content/common/shared_worker/shared_worker_factory.mojom b/content/common/shared_worker/shared_worker_factory.mojom
index d322351..9f127de 100644
--- a/content/common/shared_worker/shared_worker_factory.mojom
+++ b/content/common/shared_worker/shared_worker_factory.mojom
@@ -4,10 +4,12 @@
 
 module content.mojom;
 
+import "content/common/service_worker/service_worker_provider.mojom";
 import "content/common/shared_worker/shared_worker.mojom";
 import "content/common/shared_worker/shared_worker_host.mojom";
 import "content/common/shared_worker/shared_worker_info.mojom";
 import "mojo/public/mojom/base/unguessable_token.mojom";
+import "services/network/public/mojom/url_loader_factory.mojom";
 import "services/service_manager/public/mojom/interface_provider.mojom";
 import "third_party/WebKit/public/web/worker_content_settings_proxy.mojom";
 
@@ -29,6 +31,28 @@
       bool pause_on_start,
       mojo_base.mojom.UnguessableToken devtools_worker_token,
       blink.mojom.WorkerContentSettingsProxy content_settings,
+
+      // S13nServiceWorker:
+      // The info about the host in the browser process that provides support
+      // for this shared worker to be a service worker client. Null when
+      // S13nServiceWorker is disabled.
+      ServiceWorkerProviderInfoForSharedWorker? service_worker_provider_info,
+
+      // S13nServiceWorker:
+      // The URLLoaderFactory to use to request the shared worker's script
+      // (just the main script resource; importScripts() should go through the
+      // usual loader or the controller service worker if appropriate).
+      //
+      // Null when S13nServiceWorker is disabled.
+      //
+      // It doesn't really need to be associated, but a similar associated
+      // interface ptr is sent for service worker startup, so making this
+      // associated too simplifies code on the renderer, as
+      // ServiceWorkerNetworkProvider::script_loader_factory_ can be an
+      // associated interface ptr used for both service worker and shared
+      // worker execution contexts.
+      associated network.mojom.URLLoaderFactory? script_loader_factory_ptr_info,
+
       SharedWorkerHost host,
       SharedWorker& shared_worker,
       service_manager.mojom.InterfaceProvider interface_provider);
diff --git a/content/public/browser/payment_app_provider.h b/content/public/browser/payment_app_provider.h
index e286def..edca807 100644
--- a/content/public/browser/payment_app_provider.h
+++ b/content/public/browser/payment_app_provider.h
@@ -57,7 +57,7 @@
       const std::string& sw_js_url,
       const std::string& sw_scope,
       bool sw_use_cache,
-      const std::vector<std::string>& enabled_methods,
+      const std::string& method,
       InvokePaymentAppCallback callback) = 0;
   virtual void CanMakePayment(
       BrowserContext* browser_context,
diff --git a/content/public/browser/web_contents_delegate.cc b/content/public/browser/web_contents_delegate.cc
index f27d9be..d4d8d7b 100644
--- a/content/public/browser/web_contents_delegate.cc
+++ b/content/public/browser/web_contents_delegate.cc
@@ -272,4 +272,6 @@
 void WebContentsDelegate::UpdatePictureInPictureSurfaceId(
     viz::SurfaceId surface_id) {}
 
+void WebContentsDelegate::ExitPictureInPicture() {}
+
 }  // namespace content
diff --git a/content/public/browser/web_contents_delegate.h b/content/public/browser/web_contents_delegate.h
index e78e4fa..28b92923 100644
--- a/content/public/browser/web_contents_delegate.h
+++ b/content/public/browser/web_contents_delegate.h
@@ -556,8 +556,9 @@
   virtual bool DoBrowserControlsShrinkBlinkSize() const;
 
   // Give WebContentsDelegates the opportunity to adjust the previews state.
-  virtual void AdjustPreviewsStateForNavigation(PreviewsState* previews_state) {
-  }
+  virtual void AdjustPreviewsStateForNavigation(
+      content::WebContents* web_contents,
+      PreviewsState* previews_state) {}
 
   // Requests to print an out-of-process subframe for the specified WebContents.
   // |rect| is the rectangular area where its content resides in its parent
@@ -575,6 +576,10 @@
   // of the video to be in Picture-in-Picture mode.
   virtual void UpdatePictureInPictureSurfaceId(viz::SurfaceId surface_id);
 
+  // Updates the Picture-in-Picture controller with a signal that
+  // Picture-in-Picture mode has ended.
+  virtual void ExitPictureInPicture();
+
  protected:
   virtual ~WebContentsDelegate();
 
diff --git a/content/public/common/content_features.cc b/content/public/common/content_features.cc
index 9586e29..4ca00df3 100644
--- a/content/public/common/content_features.cc
+++ b/content/public/common/content_features.cc
@@ -299,10 +299,6 @@
 const base::Feature kRenderingPipelineThrottling{
     "RenderingPipelineThrottling", base::FEATURE_ENABLED_BY_DEFAULT};
 
-// Collect renderer peak memory usage during page loads.
-const base::Feature kReportRendererPeakMemoryStats{
-    "ReportRendererPeakMemoryStats", base::FEATURE_DISABLED_BY_DEFAULT};
-
 // When loading CSS from a 'file:' URL, require a CSS-like file extension.
 const base::Feature kRequireCSSExtensionForFile{
     "RequireCSSExtensionForFile", base::FEATURE_ENABLED_BY_DEFAULT};
diff --git a/content/public/common/content_features.h b/content/public/common/content_features.h
index a2f5681..8c78ef47 100644
--- a/content/public/common/content_features.h
+++ b/content/public/common/content_features.h
@@ -73,7 +73,6 @@
 CONTENT_EXPORT extern const base::Feature kPWAFullCodeCache;
 CONTENT_EXPORT extern const base::Feature kRasterInducingScroll;
 CONTENT_EXPORT extern const base::Feature kRenderingPipelineThrottling;
-CONTENT_EXPORT extern const base::Feature kReportRendererPeakMemoryStats;
 CONTENT_EXPORT extern const base::Feature kRequireCSSExtensionForFile;
 CONTENT_EXPORT extern const base::Feature kResourceLoadScheduler;
 CONTENT_EXPORT extern const base::Feature kRootLayerScrolling;
diff --git a/content/renderer/effective_connection_type_helper.cc b/content/renderer/effective_connection_type_helper.cc
index 23086c6..e9c3563 100644
--- a/content/renderer/effective_connection_type_helper.cc
+++ b/content/renderer/effective_connection_type_helper.cc
@@ -4,6 +4,8 @@
 
 #include "content/renderer/effective_connection_type_helper.h"
 
+#include "third_party/WebKit/public/common/client_hints/client_hints.h"
+
 namespace content {
 
 #define STATIC_ASSERT_ENUM(a, b)                            \
@@ -25,6 +27,17 @@
 
 #undef STATIC_ASSERT_ENUM
 
+static_assert(net::EFFECTIVE_CONNECTION_TYPE_4G + 1 ==
+                  net::EFFECTIVE_CONNECTION_TYPE_LAST,
+              "When adding a new effective connection type, "
+              "WebEffectiveConnectionType.h should be updated too");
+
+static_assert(static_cast<int>(blink::WebEffectiveConnectionType::kType4G) +
+                      1 ==
+                  net::EFFECTIVE_CONNECTION_TYPE_LAST,
+              "When adding a new effective connection type, "
+              "WebEffectiveConnectionType.h should be updated too");
+
 blink::WebEffectiveConnectionType
 EffectiveConnectionTypeToWebEffectiveConnectionType(
     net::EffectiveConnectionType net_type) {
diff --git a/content/renderer/loader/resource_dispatcher.cc b/content/renderer/loader/resource_dispatcher.cc
index a249964e..de09f0e 100644
--- a/content/renderer/loader/resource_dispatcher.cc
+++ b/content/renderer/loader/resource_dispatcher.cc
@@ -34,6 +34,7 @@
 #include "content/renderer/loader/sync_load_response.h"
 #include "content/renderer/loader/url_loader_client_impl.h"
 #include "content/renderer/render_frame_impl.h"
+#include "content/renderer/render_thread_impl.h"
 #include "net/base/load_flags.h"
 #include "net/base/net_errors.h"
 #include "net/base/request_priority.h"
diff --git a/content/renderer/media/audio_output_ipc_factory.cc b/content/renderer/media/audio_output_ipc_factory.cc
index ad9862b3..875a232 100644
--- a/content/renderer/media/audio_output_ipc_factory.cc
+++ b/content/renderer/media/audio_output_ipc_factory.cc
@@ -39,7 +39,8 @@
     // Unretained is safe due to the contract at the top of the header file.
     return std::make_unique<MojoAudioOutputIPC>(
         base::BindRepeating(&AudioOutputIPCFactory::GetRemoteFactory,
-                            base::Unretained(this), frame_id));
+                            base::Unretained(this), frame_id),
+        io_task_runner_);
   }
   return audio_message_filter_->CreateAudioOutputIPC(frame_id);
 }
diff --git a/content/renderer/media/media_factory.cc b/content/renderer/media/media_factory.cc
index 3ec1d89d..9fc5f65 100644
--- a/content/renderer/media/media_factory.cc
+++ b/content/renderer/media/media_factory.cc
@@ -306,7 +306,9 @@
           use_surface_layer_for_video,
           base::BindRepeating(
               &RenderFrameImpl::OnPictureInPictureSurfaceIdUpdated,
-              base::Unretained(render_frame_))));
+              base::Unretained(render_frame_)),
+          base::BindRepeating(&RenderFrameImpl::OnExitPictureInPicture,
+                              base::Unretained(render_frame_))));
 
   std::unique_ptr<media::VideoFrameCompositor> vfc =
       std::make_unique<media::VideoFrameCompositor>(
diff --git a/content/renderer/media/mojo_audio_output_ipc.cc b/content/renderer/media/mojo_audio_output_ipc.cc
index d6a0d6d..b5a56ae2 100644
--- a/content/renderer/media/mojo_audio_output_ipc.cc
+++ b/content/renderer/media/mojo_audio_output_ipc.cc
@@ -6,7 +6,6 @@
 
 #include <utility>
 
-#include "base/threading/sequenced_task_runner_handle.h"
 #include "media/audio/audio_device_description.h"
 #include "mojo/public/cpp/bindings/callback_helpers.h"
 #include "mojo/public/cpp/system/platform_handle.h"
@@ -21,12 +20,13 @@
 
 }  // namespace
 
-MojoAudioOutputIPC::MojoAudioOutputIPC(FactoryAccessorCB factory_accessor)
+MojoAudioOutputIPC::MojoAudioOutputIPC(
+    FactoryAccessorCB factory_accessor,
+    scoped_refptr<base::SingleThreadTaskRunner> io_task_runner)
     : factory_accessor_(std::move(factory_accessor)),
       binding_(this),
-      weak_factory_(this) {
-  DETACH_FROM_THREAD(thread_checker_);
-}
+      io_task_runner_(std::move(io_task_runner)),
+      weak_factory_(this) {}
 
 MojoAudioOutputIPC::~MojoAudioOutputIPC() {
   DCHECK(!AuthorizationRequested() && !StreamCreationRequested())
@@ -41,7 +41,7 @@
     int session_id,
     const std::string& device_id,
     const url::Origin& security_origin) {
-  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  DCHECK(io_task_runner_->RunsTasksInCurrentSequence());
   DCHECK(delegate);
   DCHECK(!delegate_);
   DCHECK(!AuthorizationRequested());
@@ -63,7 +63,7 @@
 
 void MojoAudioOutputIPC::CreateStream(media::AudioOutputIPCDelegate* delegate,
                                       const media::AudioParameters& params) {
-  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  DCHECK(io_task_runner_->RunsTasksInCurrentSequence());
   DCHECK(delegate);
   DCHECK(!StreamCreationRequested());
   if (!AuthorizationRequested()) {
@@ -94,19 +94,19 @@
 }
 
 void MojoAudioOutputIPC::PlayStream() {
-  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  DCHECK(io_task_runner_->RunsTasksInCurrentSequence());
   DCHECK(stream_.is_bound());
   stream_->Play();
 }
 
 void MojoAudioOutputIPC::PauseStream() {
-  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  DCHECK(io_task_runner_->RunsTasksInCurrentSequence());
   DCHECK(stream_.is_bound());
   stream_->Pause();
 }
 
 void MojoAudioOutputIPC::CloseStream() {
-  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  DCHECK(io_task_runner_->RunsTasksInCurrentSequence());
   stream_provider_.reset();
   stream_.reset();
   binding_.Close();
@@ -117,13 +117,13 @@
 }
 
 void MojoAudioOutputIPC::SetVolume(double volume) {
-  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  DCHECK(io_task_runner_->RunsTasksInCurrentSequence());
   DCHECK(stream_.is_bound());
   stream_->SetVolume(volume);
 }
 
 void MojoAudioOutputIPC::OnError() {
-  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  DCHECK(io_task_runner_->RunsTasksInCurrentSequence());
   DCHECK(delegate_);
   delegate_->OnError();
 }
@@ -138,7 +138,7 @@
 
 media::mojom::AudioOutputStreamProviderRequest
 MojoAudioOutputIPC::MakeProviderRequest() {
-  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  DCHECK(io_task_runner_->RunsTasksInCurrentSequence());
   DCHECK(!AuthorizationRequested());
   media::mojom::AudioOutputStreamProviderRequest request =
       mojo::MakeRequest(&stream_provider_);
@@ -161,7 +161,7 @@
     int session_id,
     const std::string& device_id,
     AuthorizationCB callback) {
-  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  DCHECK(io_task_runner_->RunsTasksInCurrentSequence());
   auto* factory = factory_accessor_.Run();
   if (!factory) {
     LOG(ERROR) << "MojoAudioOutputIPC failed to acquire factory";
@@ -172,7 +172,7 @@
     // when the factory is destroyed before reply, i.e. calling
     // OnDeviceAuthorized with ERROR_INTERNAL in the normal case.
     // The AudioOutputIPCDelegate will call CloseStream as necessary.
-    base::SequencedTaskRunnerHandle::Get()->PostTask(
+    io_task_runner_->PostTask(
         FROM_HERE,
         base::BindOnce([](AuthorizationCB cb) {}, std::move(callback)));
     return;
@@ -188,14 +188,14 @@
     media::OutputDeviceStatus status,
     const media::AudioParameters& params,
     const std::string& device_id) const {
-  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  DCHECK(io_task_runner_->RunsTasksInCurrentSequence());
   DCHECK(delegate_);
   delegate_->OnDeviceAuthorized(status, params, device_id);
 }
 
 void MojoAudioOutputIPC::StreamCreated(
     media::mojom::AudioDataPipePtr data_pipe) {
-  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  DCHECK(io_task_runner_->RunsTasksInCurrentSequence());
   DCHECK(delegate_);
 
   base::PlatformFile socket_handle;
diff --git a/content/renderer/media/mojo_audio_output_ipc.h b/content/renderer/media/mojo_audio_output_ipc.h
index 7d15855b..96c5cf6 100644
--- a/content/renderer/media/mojo_audio_output_ipc.h
+++ b/content/renderer/media/mojo_audio_output_ipc.h
@@ -10,7 +10,6 @@
 #include "base/callback_helpers.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
-#include "base/threading/thread_checker.h"
 #include "content/common/content_export.h"
 #include "content/common/media/renderer_audio_output_stream_factory.mojom.h"
 #include "media/audio/audio_output_ipc.h"
@@ -31,7 +30,9 @@
 
   // |factory_accessor| is required to provide a
   // RendererAudioOutputStreamFactory* if IPC is possible.
-  explicit MojoAudioOutputIPC(FactoryAccessorCB factory_accessor);
+  MojoAudioOutputIPC(
+      FactoryAccessorCB factory_accessor,
+      scoped_refptr<base::SingleThreadTaskRunner> io_task_runner);
 
   ~MojoAudioOutputIPC() override;
 
@@ -73,12 +74,11 @@
 
   const FactoryAccessorCB factory_accessor_;
 
-  THREAD_CHECKER(thread_checker_);
-
   mojo::Binding<media::mojom::AudioOutputStreamClient> binding_;
   media::mojom::AudioOutputStreamProviderPtr stream_provider_;
   media::mojom::AudioOutputStreamPtr stream_;
   media::AudioOutputIPCDelegate* delegate_ = nullptr;
+  scoped_refptr<base::SingleThreadTaskRunner> io_task_runner_;
 
   // To make sure we don't send an "authorization completed" callback for a
   // stream after it's closed, we use this weak factory.
diff --git a/content/renderer/media/mojo_audio_output_ipc_unittest.cc b/content/renderer/media/mojo_audio_output_ipc_unittest.cc
index 431a881..8eabf9a9 100644
--- a/content/renderer/media/mojo_audio_output_ipc_unittest.cc
+++ b/content/renderer/media/mojo_audio_output_ipc_unittest.cc
@@ -19,6 +19,7 @@
 #include "mojo/public/cpp/system/platform_handle.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/WebKit/public/platform/scheduler/test/renderer_scheduler_test_support.h"
 #include "url/origin.h"
 
 using testing::_;
@@ -205,7 +206,9 @@
   StrictMock<MockDelegate> delegate;
 
   std::unique_ptr<media::AudioOutputIPC> ipc =
-      std::make_unique<MojoAudioOutputIPC>(NullAccessor());
+      std::make_unique<MojoAudioOutputIPC>(
+          NullAccessor(),
+          blink::scheduler::GetSingleThreadTaskRunnerForTesting());
 
   ipc->RequestDeviceAuthorization(&delegate, kSessionId, kDeviceId, Origin());
 
@@ -224,7 +227,9 @@
   StrictMock<MockDelegate> delegate;
 
   std::unique_ptr<media::AudioOutputIPC> ipc =
-      std::make_unique<MojoAudioOutputIPC>(NullAccessor());
+      std::make_unique<MojoAudioOutputIPC>(
+          NullAccessor(),
+          blink::scheduler::GetSingleThreadTaskRunnerForTesting());
 
   ipc->CreateStream(&delegate, Params());
 
@@ -240,7 +245,9 @@
   StrictMock<MockDelegate> delegate;
 
   const std::unique_ptr<media::AudioOutputIPC> ipc =
-      std::make_unique<MojoAudioOutputIPC>(stream_factory.GetAccessor());
+      std::make_unique<MojoAudioOutputIPC>(
+          stream_factory.GetAccessor(),
+          blink::scheduler::GetSingleThreadTaskRunnerForTesting());
   stream_factory.PrepareProviderForAuthorization(
       kSessionId, kDeviceId, std::make_unique<TestStreamProvider>(nullptr));
 
@@ -262,7 +269,9 @@
   StrictMock<MockDelegate> delegate;
 
   const std::unique_ptr<media::AudioOutputIPC> ipc =
-      std::make_unique<MojoAudioOutputIPC>(stream_factory.GetAccessor());
+      std::make_unique<MojoAudioOutputIPC>(
+          stream_factory.GetAccessor(),
+          blink::scheduler::GetSingleThreadTaskRunnerForTesting());
   stream_factory.PrepareProviderForAuthorization(
       kSessionId, kDeviceId, std::make_unique<TestStreamProvider>(&stream));
 
@@ -286,7 +295,9 @@
   StrictMock<MockStream> stream;
   StrictMock<MockDelegate> delegate;
   const std::unique_ptr<media::AudioOutputIPC> ipc =
-      std::make_unique<MojoAudioOutputIPC>(stream_factory.GetAccessor());
+      std::make_unique<MojoAudioOutputIPC>(
+          stream_factory.GetAccessor(),
+          blink::scheduler::GetSingleThreadTaskRunnerForTesting());
 
   // Note: This call implicitly EXPECTs that authorization is requested,
   // and constructing the TestStreamProvider with a |&stream| EXPECTs that the
@@ -312,7 +323,9 @@
   StrictMock<MockDelegate> delegate;
 
   const std::unique_ptr<media::AudioOutputIPC> ipc =
-      std::make_unique<MojoAudioOutputIPC>(stream_factory.GetAccessor());
+      std::make_unique<MojoAudioOutputIPC>(
+          stream_factory.GetAccessor(),
+          blink::scheduler::GetSingleThreadTaskRunnerForTesting());
 
   for (int i = 0; i < 5; ++i) {
     stream_factory.PrepareProviderForAuthorization(
@@ -341,7 +354,9 @@
   StrictMock<MockDelegate> delegate;
 
   const std::unique_ptr<media::AudioOutputIPC> ipc =
-      std::make_unique<MojoAudioOutputIPC>(stream_factory.GetAccessor());
+      std::make_unique<MojoAudioOutputIPC>(
+          stream_factory.GetAccessor(),
+          blink::scheduler::GetSingleThreadTaskRunnerForTesting());
 
   stream_factory.PrepareProviderForAuthorization(
       kSessionId, kDeviceId, std::make_unique<TestStreamProvider>(nullptr));
@@ -391,7 +406,9 @@
   StrictMock<MockDelegate> delegate;
 
   std::unique_ptr<media::AudioOutputIPC> ipc =
-      std::make_unique<MojoAudioOutputIPC>(stream_factory.GetAccessor());
+      std::make_unique<MojoAudioOutputIPC>(
+          stream_factory.GetAccessor(),
+          blink::scheduler::GetSingleThreadTaskRunnerForTesting());
   stream_factory.RefuseNextRequest(kSessionId, kDeviceId);
 
   ipc->RequestDeviceAuthorization(&delegate, kSessionId, kDeviceId, Origin());
@@ -420,7 +437,9 @@
   StrictMock<MockDelegate> delegate;
 
   std::unique_ptr<media::AudioOutputIPC> ipc =
-      std::make_unique<MojoAudioOutputIPC>(stream_factory.GetAccessor());
+      std::make_unique<MojoAudioOutputIPC>(
+          stream_factory.GetAccessor(),
+          blink::scheduler::GetSingleThreadTaskRunnerForTesting());
 
   ipc->RequestDeviceAuthorization(&delegate, kSessionId, kDeviceId, Origin());
 
@@ -450,7 +469,9 @@
   StrictMock<MockDelegate> delegate;
 
   const std::unique_ptr<media::AudioOutputIPC> ipc =
-      std::make_unique<MojoAudioOutputIPC>(stream_factory.GetAccessor());
+      std::make_unique<MojoAudioOutputIPC>(
+          stream_factory.GetAccessor(),
+          blink::scheduler::GetSingleThreadTaskRunnerForTesting());
 
   ipc->RequestDeviceAuthorization(&delegate, kSessionId, kDeviceId, Origin());
 
@@ -475,7 +496,9 @@
       kSessionId, kDeviceId, std::make_unique<TestStreamProvider>(nullptr));
 
   std::unique_ptr<media::AudioOutputIPC> ipc =
-      std::make_unique<MojoAudioOutputIPC>(stream_factory.GetAccessor());
+      std::make_unique<MojoAudioOutputIPC>(
+          stream_factory.GetAccessor(),
+          blink::scheduler::GetSingleThreadTaskRunnerForTesting());
 
   ipc->RequestDeviceAuthorization(&delegate, kSessionId, kDeviceId, Origin());
   EXPECT_DCHECK_DEATH(ipc.reset());
@@ -495,7 +518,9 @@
       std::make_unique<TestStreamProvider>(&stream));
 
   std::unique_ptr<media::AudioOutputIPC> ipc =
-      std::make_unique<MojoAudioOutputIPC>(stream_factory.GetAccessor());
+      std::make_unique<MojoAudioOutputIPC>(
+          stream_factory.GetAccessor(),
+          blink::scheduler::GetSingleThreadTaskRunnerForTesting());
 
   ipc->CreateStream(&delegate, Params());
   EXPECT_DCHECK_DEATH(ipc.reset());
@@ -511,7 +536,9 @@
   StrictMock<MockDelegate> delegate;
 
   const std::unique_ptr<media::AudioOutputIPC> ipc =
-      std::make_unique<MojoAudioOutputIPC>(stream_factory.GetAccessor());
+      std::make_unique<MojoAudioOutputIPC>(
+          stream_factory.GetAccessor(),
+          blink::scheduler::GetSingleThreadTaskRunnerForTesting());
   stream_factory.PrepareProviderForAuthorization(
       kSessionId, kDeviceId, std::make_unique<TestStreamProvider>(&stream));
 
@@ -537,7 +564,9 @@
   StrictMock<MockDelegate> delegate;
 
   const std::unique_ptr<media::AudioOutputIPC> ipc =
-      std::make_unique<MojoAudioOutputIPC>(stream_factory.GetAccessor());
+      std::make_unique<MojoAudioOutputIPC>(
+          stream_factory.GetAccessor(),
+          blink::scheduler::GetSingleThreadTaskRunnerForTesting());
   stream_factory.PrepareProviderForAuthorization(
       kSessionId, kDeviceId, std::make_unique<TestStreamProvider>(&stream));
 
@@ -563,7 +592,9 @@
   StrictMock<MockDelegate> delegate;
 
   const std::unique_ptr<media::AudioOutputIPC> ipc =
-      std::make_unique<MojoAudioOutputIPC>(stream_factory.GetAccessor());
+      std::make_unique<MojoAudioOutputIPC>(
+          stream_factory.GetAccessor(),
+          blink::scheduler::GetSingleThreadTaskRunnerForTesting());
   stream_factory.PrepareProviderForAuthorization(
       kSessionId, kDeviceId, std::make_unique<TestStreamProvider>(&stream));
 
diff --git a/content/renderer/media/stream/apply_constraints_processor.cc b/content/renderer/media/stream/apply_constraints_processor.cc
index 119608f..2752583 100644
--- a/content/renderer/media/stream/apply_constraints_processor.cc
+++ b/content/renderer/media/stream/apply_constraints_processor.cc
@@ -40,8 +40,10 @@
 }  // namespace
 
 ApplyConstraintsProcessor::ApplyConstraintsProcessor(
-    MediaDevicesDispatcherCallback media_devices_dispatcher_cb)
+    MediaDevicesDispatcherCallback media_devices_dispatcher_cb,
+    scoped_refptr<base::SingleThreadTaskRunner> task_runner)
     : media_devices_dispatcher_cb_(std::move(media_devices_dispatcher_cb)),
+      task_runner_(std::move(task_runner)),
       weak_factory_(this) {}
 
 ApplyConstraintsProcessor::~ApplyConstraintsProcessor() {
@@ -308,7 +310,7 @@
 }
 
 void ApplyConstraintsProcessor::ApplyConstraintsSucceeded() {
-  base::SequencedTaskRunnerHandle::Get()->PostTask(
+  task_runner_->PostTask(
       FROM_HERE,
       base::BindOnce(&ApplyConstraintsProcessor::CleanupRequest,
                      weak_factory_.GetWeakPtr(),
@@ -318,7 +320,7 @@
 void ApplyConstraintsProcessor::ApplyConstraintsFailed(
     const char* failed_constraint_name) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  base::SequencedTaskRunnerHandle::Get()->PostTask(
+  task_runner_->PostTask(
       FROM_HERE,
       base::BindOnce(
           &ApplyConstraintsProcessor::CleanupRequest,
@@ -332,7 +334,7 @@
 void ApplyConstraintsProcessor::CannotApplyConstraints(
     const blink::WebString& message) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  base::SequencedTaskRunnerHandle::Get()->PostTask(
+  task_runner_->PostTask(
       FROM_HERE, base::BindOnce(&ApplyConstraintsProcessor::CleanupRequest,
                                 weak_factory_.GetWeakPtr(),
                                 base::BindOnce(&RequestFailed, current_request_,
diff --git a/content/renderer/media/stream/apply_constraints_processor.h b/content/renderer/media/stream/apply_constraints_processor.h
index 66ddd1f..2acc4e1e 100644
--- a/content/renderer/media/stream/apply_constraints_processor.h
+++ b/content/renderer/media/stream/apply_constraints_processor.h
@@ -34,7 +34,8 @@
   using MediaDevicesDispatcherCallback = base::RepeatingCallback<
       const blink::mojom::MediaDevicesDispatcherHostPtr&()>;
   ApplyConstraintsProcessor(
-      MediaDevicesDispatcherCallback media_devices_dispatcher_cb);
+      MediaDevicesDispatcherCallback media_devices_dispatcher_cb,
+      scoped_refptr<base::SingleThreadTaskRunner> task_runner);
   ~ApplyConstraintsProcessor();
 
   // Starts processing of |request|. When processing of |request| is complete,
@@ -84,6 +85,8 @@
   MediaDevicesDispatcherCallback media_devices_dispatcher_cb_;
   SEQUENCE_CHECKER(sequence_checker_);
 
+  const scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
+
   base::WeakPtrFactory<ApplyConstraintsProcessor> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(ApplyConstraintsProcessor);
diff --git a/content/renderer/media/stream/user_media_client_impl.cc b/content/renderer/media/stream/user_media_client_impl.cc
index 36a782a..dc99a1b2 100644
--- a/content/renderer/media/stream/user_media_client_impl.cc
+++ b/content/renderer/media/stream/user_media_client_impl.cc
@@ -87,12 +87,14 @@
 
 UserMediaClientImpl::UserMediaClientImpl(
     RenderFrameImpl* render_frame,
-    std::unique_ptr<UserMediaProcessor> user_media_processor)
+    std::unique_ptr<UserMediaProcessor> user_media_processor,
+    scoped_refptr<base::SingleThreadTaskRunner> task_runner)
     : RenderFrameObserver(render_frame),
       user_media_processor_(std::move(user_media_processor)),
       apply_constraints_processor_(new ApplyConstraintsProcessor(
           base::BindRepeating(&UserMediaClientImpl::GetMediaDevicesDispatcher,
-                              base::Unretained(this)))),
+                              base::Unretained(this)),
+          std::move(task_runner))),
       weak_factory_(this) {}
 
 // base::Unretained(this) is safe here because |this| owns
@@ -100,7 +102,8 @@
 UserMediaClientImpl::UserMediaClientImpl(
     RenderFrameImpl* render_frame,
     PeerConnectionDependencyFactory* dependency_factory,
-    std::unique_ptr<MediaStreamDeviceObserver> media_stream_device_observer)
+    std::unique_ptr<MediaStreamDeviceObserver> media_stream_device_observer,
+    scoped_refptr<base::SingleThreadTaskRunner> task_runner)
     : UserMediaClientImpl(
           render_frame,
           std::make_unique<UserMediaProcessor>(
@@ -109,7 +112,8 @@
               std::move(media_stream_device_observer),
               base::BindRepeating(
                   &UserMediaClientImpl::GetMediaDevicesDispatcher,
-                  base::Unretained(this)))) {}
+                  base::Unretained(this))),
+          std::move(task_runner)) {}
 
 UserMediaClientImpl::~UserMediaClientImpl() {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
diff --git a/content/renderer/media/stream/user_media_client_impl.h b/content/renderer/media/stream/user_media_client_impl.h
index 717caee6..d6bef90 100644
--- a/content/renderer/media/stream/user_media_client_impl.h
+++ b/content/renderer/media/stream/user_media_client_impl.h
@@ -40,9 +40,11 @@
   UserMediaClientImpl(
       RenderFrameImpl* render_frame,
       PeerConnectionDependencyFactory* dependency_factory,
-      std::unique_ptr<MediaStreamDeviceObserver> media_stream_device_observer);
+      std::unique_ptr<MediaStreamDeviceObserver> media_stream_device_observer,
+      scoped_refptr<base::SingleThreadTaskRunner> task_runner);
   UserMediaClientImpl(RenderFrameImpl* render_frame,
-                      std::unique_ptr<UserMediaProcessor> user_media_processor);
+                      std::unique_ptr<UserMediaProcessor> user_media_processor,
+                      scoped_refptr<base::SingleThreadTaskRunner> task_runner);
   ~UserMediaClientImpl() override;
 
   MediaStreamDeviceObserver* media_stream_device_observer() const {
diff --git a/content/renderer/media/stream/user_media_client_impl_unittest.cc b/content/renderer/media/stream/user_media_client_impl_unittest.cc
index 0146761..659c56d 100644
--- a/content/renderer/media/stream/user_media_client_impl_unittest.cc
+++ b/content/renderer/media/stream/user_media_client_impl_unittest.cc
@@ -394,7 +394,10 @@
  public:
   UserMediaClientImplUnderTest(UserMediaProcessor* user_media_processor,
                                RequestState* state)
-      : UserMediaClientImpl(nullptr, base::WrapUnique(user_media_processor)),
+      : UserMediaClientImpl(
+            nullptr,
+            base::WrapUnique(user_media_processor),
+            blink::scheduler::GetSingleThreadTaskRunnerForTesting()),
         state_(state) {}
 
   void RequestUserMediaForTest(
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 0329d4c..95dda00 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -4,7 +4,6 @@
 
 #include "content/renderer/render_frame_impl.h"
 
-#include <string.h>
 #include <algorithm>
 #include <map>
 #include <string>
@@ -823,7 +822,6 @@
       scoped_refptr<base::SingleThreadTaskRunner> task_runner) override {
     // This should not be called if the frame is detached.
     DCHECK(frame_);
-    frame_->UpdatePeakMemoryStats();
 
     mojom::KeepAliveHandlePtr keep_alive_handle;
     if (request.GetKeepalive()) {
@@ -1368,9 +1366,6 @@
     // Manages its own lifetime.
     new ManifestChangeNotifier(this);
   }
-
-  memset(&peak_memory_metrics_, 0,
-         sizeof(RenderThreadImpl::RendererMemoryMetrics));
 }
 
 mojom::FrameHost* RenderFrameImpl::GetFrameHost() {
@@ -4566,7 +4561,6 @@
   Send(new FrameHostMsg_DidFinishLoad(routing_id_,
                                       document_loader->GetRequest().Url()));
 
-  ReportPeakMemoryStats();
   if (!RenderThreadImpl::current())
     return;
   RenderThreadImpl::RendererMemoryMetrics memory_metrics;
@@ -6852,7 +6846,8 @@
   DCHECK(!web_user_media_client_);
   web_user_media_client_ = new UserMediaClientImpl(
       this, RenderThreadImpl::current()->GetPeerConnectionDependencyFactory(),
-      std::make_unique<MediaStreamDeviceObserver>(this));
+      std::make_unique<MediaStreamDeviceObserver>(this),
+      GetTaskRunner(blink::TaskType::kInternalMedia));
 #endif
 }
 
@@ -7360,6 +7355,10 @@
   GetFrameHost()->OnUpdatePictureInPictureSurfaceId(surface_id);
 }
 
+void RenderFrameImpl::OnExitPictureInPicture() {
+  GetFrameHost()->OnExitPictureInPicture();
+}
+
 void RenderFrameImpl::SetAccessibilityModeForTest(ui::AXMode new_mode) {
   OnSetAccessibilityMode(new_mode);
 }
@@ -7504,51 +7503,6 @@
 #endif
 }
 
-void RenderFrameImpl::UpdatePeakMemoryStats() {
-  if (!base::FeatureList::IsEnabled(features::kReportRendererPeakMemoryStats))
-    return;
-
-  RenderThreadImpl::RendererMemoryMetrics memory_metrics;
-  if (!RenderThreadImpl::current()->GetRendererMemoryMetrics(&memory_metrics))
-    return;
-  peak_memory_metrics_.partition_alloc_kb =
-      std::max(peak_memory_metrics_.partition_alloc_kb,
-               memory_metrics.partition_alloc_kb);
-  peak_memory_metrics_.blink_gc_kb =
-      std::max(peak_memory_metrics_.blink_gc_kb, memory_metrics.blink_gc_kb);
-  peak_memory_metrics_.malloc_mb =
-      std::max(peak_memory_metrics_.malloc_mb, memory_metrics.malloc_mb);
-  peak_memory_metrics_.discardable_kb = std::max(
-      peak_memory_metrics_.discardable_kb, memory_metrics.discardable_kb);
-  peak_memory_metrics_.v8_main_thread_isolate_mb =
-      std::max(peak_memory_metrics_.v8_main_thread_isolate_mb,
-               memory_metrics.v8_main_thread_isolate_mb);
-  peak_memory_metrics_.total_allocated_mb =
-      std::max(peak_memory_metrics_.total_allocated_mb,
-               memory_metrics.total_allocated_mb);
-  peak_memory_metrics_.non_discardable_total_allocated_mb =
-      std::max(peak_memory_metrics_.non_discardable_total_allocated_mb,
-               memory_metrics.non_discardable_total_allocated_mb);
-  peak_memory_metrics_.total_allocated_per_render_view_mb =
-      std::max(peak_memory_metrics_.total_allocated_per_render_view_mb,
-               memory_metrics.total_allocated_per_render_view_mb);
-}
-
-void RenderFrameImpl::ReportPeakMemoryStats() {
-  if (!base::FeatureList::IsEnabled(features::kReportRendererPeakMemoryStats))
-    return;
-
-  RecordSuffixedRendererMemoryMetrics(peak_memory_metrics_, ".PeakDuringLoad");
-  if (!IsMainFrame())
-    return;
-  RecordSuffixedRendererMemoryMetrics(peak_memory_metrics_,
-                                      ".MainFrame.PeakDuringLoad");
-  if (!IsControlledByServiceWorker())
-    return;
-  RecordSuffixedRendererMemoryMetrics(
-      peak_memory_metrics_, ".ServiceWorkerControlledMainFrame.PeakDuringLoad");
-}
-
 bool RenderFrameImpl::ConsumeGestureOnNavigation() const {
   return is_main_frame_ &&
          base::FeatureList::IsEnabled(kConsumeGestureOnNavigation);
diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
index c2e7898..d70eee1 100644
--- a/content/renderer/render_frame_impl.h
+++ b/content/renderer/render_frame_impl.h
@@ -53,7 +53,6 @@
 #include "content/renderer/input/input_target_client_impl.h"
 #include "content/renderer/loader/child_url_loader_factory_bundle.h"
 #include "content/renderer/media/media_factory.h"
-#include "content/renderer/render_thread_impl.h"
 #include "content/renderer/renderer_webcookiejar_impl.h"
 #include "ipc/ipc_message.h"
 #include "ipc/ipc_platform_file.h"
@@ -880,6 +879,9 @@
   // Send SurfaceId information to FrameHost to use for Picture-in-Picture.
   void OnPictureInPictureSurfaceIdUpdated(const viz::SurfaceId& surface_id);
 
+  // Send signal that Picture-in-Picture mode has ended.
+  void OnExitPictureInPicture();
+
  protected:
   explicit RenderFrameImpl(CreateParams params);
 
@@ -1269,8 +1271,6 @@
 
   void SendUpdateFaviconURL(blink::WebIconURL::Type icon_types_mask);
 
-  void UpdatePeakMemoryStats();
-  void ReportPeakMemoryStats();
   void BindWidget(mojom::WidgetRequest request);
 
   void ShowDeferredContextMenu(const ContextMenuParams& params);
@@ -1667,8 +1667,6 @@
 
   InputTargetClientImpl input_target_client_impl_;
 
-  RenderThreadImpl::RendererMemoryMetrics peak_memory_metrics_;
-
   // Used for devtools instrumentation and trace-ability. This token is
   // used to tag calls and requests in order to attribute them to the context
   // frame.
diff --git a/content/renderer/render_widget.cc b/content/renderer/render_widget.cc
index e4cedaf..7f48e58 100644
--- a/content/renderer/render_widget.cc
+++ b/content/renderer/render_widget.cc
@@ -81,8 +81,8 @@
 #include "third_party/WebKit/public/platform/WebRuntimeFeatures.h"
 #include "third_party/WebKit/public/platform/WebSize.h"
 #include "third_party/WebKit/public/platform/WebString.h"
-#include "third_party/WebKit/public/platform/scheduler/render_widget_scheduling_state.h"
 #include "third_party/WebKit/public/platform/scheduler/web_main_thread_scheduler.h"
+#include "third_party/WebKit/public/platform/scheduler/web_render_widget_scheduling_state.h"
 #include "third_party/WebKit/public/web/WebAutofillClient.h"
 #include "third_party/WebKit/public/web/WebDeviceEmulationParams.h"
 #include "third_party/WebKit/public/web/WebFrameWidget.h"
diff --git a/content/renderer/render_widget.h b/content/renderer/render_widget.h
index 19740fc6..6205dee 100644
--- a/content/renderer/render_widget.h
+++ b/content/renderer/render_widget.h
@@ -74,7 +74,7 @@
 
 namespace blink {
 namespace scheduler {
-class RenderWidgetSchedulingState;
+class WebRenderWidgetSchedulingState;
 }
 struct WebDeviceEmulationParams;
 class WebDragData;
@@ -857,7 +857,7 @@
   bool has_host_context_menu_location_;
   gfx::Point host_context_menu_location_;
 
-  std::unique_ptr<blink::scheduler::RenderWidgetSchedulingState>
+  std::unique_ptr<blink::scheduler::WebRenderWidgetSchedulingState>
       render_widget_scheduling_state_;
 
   // Mouse Lock dispatcher attached to this view.
diff --git a/content/renderer/render_widget_browsertest.cc b/content/renderer/render_widget_browsertest.cc
index ec774a6..9a5c9b87 100644
--- a/content/renderer/render_widget_browsertest.cc
+++ b/content/renderer/render_widget_browsertest.cc
@@ -9,6 +9,7 @@
 #include "content/public/renderer/render_frame_visitor.h"
 #include "content/public/test/render_view_test.h"
 #include "content/renderer/render_frame_proxy.h"
+#include "content/renderer/render_thread_impl.h"
 #include "content/renderer/render_view_impl.h"
 #include "content/renderer/render_widget.h"
 #include "third_party/WebKit/public/web/WebFrameWidget.h"
diff --git a/content/renderer/service_worker/service_worker_context_client.cc b/content/renderer/service_worker/service_worker_context_client.cc
index 8af66ed..8f4c96c 100644
--- a/content/renderer/service_worker/service_worker_context_client.cc
+++ b/content/renderer/service_worker/service_worker_context_client.cc
@@ -115,7 +115,7 @@
   }
 
   std::unique_ptr<blink::WebURLLoader> CreateURLLoader(
-      const blink::WebURLRequest& request,
+      const WebURLRequest& request,
       scoped_refptr<base::SingleThreadTaskRunner> task_runner) override {
     RenderThreadImpl* render_thread = RenderThreadImpl::current();
     if (render_thread && provider_->script_loader_factory() &&
diff --git a/content/renderer/service_worker/service_worker_network_provider.cc b/content/renderer/service_worker/service_worker_network_provider.cc
index a0440ea..baeecd04 100644
--- a/content/renderer/service_worker/service_worker_network_provider.cc
+++ b/content/renderer/service_worker/service_worker_network_provider.cc
@@ -9,12 +9,13 @@
 #include "content/common/service_worker/service_worker_messages.h"
 #include "content/common/service_worker/service_worker_provider_host_info.h"
 #include "content/common/service_worker/service_worker_utils.h"
+#include "content/common/wrapper_shared_url_loader_factory.h"
 #include "content/public/common/browser_side_navigation_policy.h"
 #include "content/public/common/weak_wrapper_shared_url_loader_factory.h"
 #include "content/renderer/loader/request_extra_data.h"
 #include "content/renderer/render_thread_impl.h"
+#include "content/renderer/renderer_blink_platform_impl.h"
 #include "content/renderer/service_worker/service_worker_dispatcher.h"
-#include "content/renderer/service_worker/service_worker_provider_context.h"
 #include "ipc/ipc_sync_channel.h"
 #include "mojo/public/cpp/bindings/associated_group.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
@@ -99,32 +100,26 @@
       return nullptr;
 
     // S13nServiceWorker:
-    // We only install our own URLLoader if Servicification is
-    // enabled.
+    // We only install our own URLLoader if Servicification is enabled.
     if (!ServiceWorkerUtils::IsServicificationEnabled())
       return nullptr;
 
-    // S13nServiceWorker:
-    // We need SubresourceLoaderFactory populated in order to
-    // create our own URLLoader for subresource loading.
+    // We need SubresourceLoaderFactory populated in order to create our own
+    // URLLoader for subresource loading.
     if (!provider_->context() ||
         !provider_->context()->GetSubresourceLoaderFactory())
       return nullptr;
 
-    // S13nServiceWorker:
-    // If it's not for HTTP or HTTPS no need to intercept the
-    // request.
+    // If it's not for HTTP or HTTPS, no need to intercept the request.
     if (!GURL(request.Url()).SchemeIsHTTPOrHTTPS())
       return nullptr;
 
-    // S13nServiceWorker:
-    // If GetSkipServiceWorker() returns true, no need to intercept the request.
+    // If GetSkipServiceWorker() returns true, do not intercept the request.
     if (request.GetSkipServiceWorker())
       return nullptr;
 
-    // S13nServiceWorker:
-    // Create our own SubresourceLoader to route the request
-    // to the controller ServiceWorker.
+    // Create our own SubresourceLoader to route the request to the controller
+    // ServiceWorker.
     // TODO(crbug.com/796425): Temporarily wrap the raw mojom::URLLoaderFactory
     // pointer into SharedURLLoaderFactory.
     return std::make_unique<WebURLLoaderImpl>(
@@ -197,15 +192,25 @@
 
 // static
 std::unique_ptr<ServiceWorkerNetworkProvider>
-ServiceWorkerNetworkProvider::CreateForSharedWorker() {
-  // TODO(kinuko): Provide SharedURLLoaderFactory associated with the
-  // SharedWorker.
+ServiceWorkerNetworkProvider::CreateForSharedWorker(
+    mojom::ServiceWorkerProviderInfoForSharedWorkerPtr info,
+    network::mojom::URLLoaderFactoryAssociatedPtrInfo
+        script_loader_factory_info,
+    scoped_refptr<network::SharedURLLoaderFactory> default_loader_factory) {
+  // S13nServiceWorker: |info| holds info about the precreated provider host.
+  if (info) {
+    DCHECK(ServiceWorkerUtils::IsServicificationEnabled());
+    return base::WrapUnique(new ServiceWorkerNetworkProvider(
+        std::move(info), std::move(script_loader_factory_info),
+        std::move(default_loader_factory)));
+  }
+
   return base::WrapUnique(new ServiceWorkerNetworkProvider(
       MSG_ROUTING_NONE,
       blink::mojom::ServiceWorkerProviderType::kForSharedWorker,
       GetNextProviderId(), true /* is_parent_frame_secure */,
       nullptr /* controller_service_worker */,
-      nullptr /* default_loader_factory*/));
+      std::move(default_loader_factory)));
 }
 
 // static
@@ -288,6 +293,22 @@
   }
 }
 
+// Constructor for precreated shared worker.
+ServiceWorkerNetworkProvider::ServiceWorkerNetworkProvider(
+    mojom::ServiceWorkerProviderInfoForSharedWorkerPtr info,
+    network::mojom::URLLoaderFactoryAssociatedPtrInfo
+        script_loader_factory_info,
+    scoped_refptr<network::SharedURLLoaderFactory> default_loader_factory) {
+  ServiceWorkerDispatcher::GetOrCreateThreadSpecificInstance();
+  context_ = base::MakeRefCounted<ServiceWorkerProviderContext>(
+      info->provider_id,
+      blink::mojom::ServiceWorkerProviderType::kForSharedWorker,
+      std::move(info->client_request), std::move(info->host_ptr_info),
+      nullptr /* controller */, std::move(default_loader_factory));
+  if (script_loader_factory_info.is_valid())
+    script_loader_factory_.Bind(std::move(script_loader_factory_info));
+}
+
 // Constructor for service worker execution contexts.
 ServiceWorkerNetworkProvider::ServiceWorkerNetworkProvider(
     mojom::ServiceWorkerProviderInfoForStartWorkerPtr info) {
diff --git a/content/renderer/service_worker/service_worker_network_provider.h b/content/renderer/service_worker/service_worker_network_provider.h
index 67d2d5ebc..aae3bd4 100644
--- a/content/renderer/service_worker/service_worker_network_provider.h
+++ b/content/renderer/service_worker/service_worker_network_provider.h
@@ -18,6 +18,7 @@
 #include "content/common/service_worker/controller_service_worker.mojom.h"
 #include "content/common/service_worker/service_worker.mojom.h"
 #include "content/common/service_worker/service_worker_provider.mojom.h"
+#include "content/renderer/service_worker/service_worker_provider_context.h"
 #include "third_party/WebKit/public/mojom/service_worker/service_worker_provider_type.mojom.h"
 
 namespace blink {
@@ -77,9 +78,11 @@
 
   // Creates a ServiceWorkerNetworkProvider for a shared worker (as a
   // non-document service worker client).
-  // TODO(kinuko): This should also take SharedURLLoaderFactory associated
-  // with the SharedWorker.
-  static std::unique_ptr<ServiceWorkerNetworkProvider> CreateForSharedWorker();
+  static std::unique_ptr<ServiceWorkerNetworkProvider> CreateForSharedWorker(
+      mojom::ServiceWorkerProviderInfoForSharedWorkerPtr info,
+      network::mojom::URLLoaderFactoryAssociatedPtrInfo
+          script_loader_factory_info,
+      scoped_refptr<network::SharedURLLoaderFactory> default_loader_factory);
 
   // Creates a ServiceWorkerNetworkProvider for a "controller" (i.e.
   // a service worker execution context).
@@ -122,12 +125,21 @@
       mojom::ControllerServiceWorkerInfoPtr controller_info,
       scoped_refptr<network::SharedURLLoaderFactory> default_loader_factory);
 
+  ServiceWorkerNetworkProvider(
+      mojom::ServiceWorkerProviderInfoForSharedWorkerPtr info,
+      network::mojom::URLLoaderFactoryAssociatedPtrInfo
+          script_loader_factory_info,
+      scoped_refptr<network::SharedURLLoaderFactory> default_loader_factory);
+
   // This is for controllers, used in CreateForController.
   explicit ServiceWorkerNetworkProvider(
       mojom::ServiceWorkerProviderInfoForStartWorkerPtr info);
 
   scoped_refptr<ServiceWorkerProviderContext> context_;
   mojom::ServiceWorkerDispatcherHostAssociatedPtr dispatcher_host_;
+
+  // The URL loader factory for loading worker scripts, used for service workers
+  // and shared workers.
   network::mojom::URLLoaderFactoryAssociatedPtr script_loader_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(ServiceWorkerNetworkProvider);
diff --git a/content/renderer/service_worker/service_worker_provider_context.cc b/content/renderer/service_worker/service_worker_provider_context.cc
index 42a9a4fa..5fe17fb 100644
--- a/content/renderer/service_worker/service_worker_provider_context.cc
+++ b/content/renderer/service_worker/service_worker_provider_context.cc
@@ -281,6 +281,12 @@
     state_for_client_->controller_connector->OnContainerHostConnectionClosed();
 }
 
+void ServiceWorkerProviderContext::PingContainerHost(
+    base::OnceClosure callback) {
+  DCHECK(main_thread_task_runner_->RunsTasksInCurrentSequence());
+  container_host_->Ping(std::move(callback));
+}
+
 void ServiceWorkerProviderContext::UnregisterWorkerFetchContext(
     mojom::ServiceWorkerWorkerClient* client) {
   DCHECK(main_thread_task_runner_->RunsTasksInCurrentSequence());
@@ -420,9 +426,7 @@
   // Expected that it is called only for clients.
   DCHECK(state_for_client_);
   // |state_for_client_->default_loader_factory| could be null
-  // for SharedWorker case (which is not supported by S13nServiceWorker
-  // yet, https://crbug.com/796819) and in unit tests, return early in such
-  // cases too.
+  // in unit tests.
   return (ServiceWorkerUtils::IsServicificationEnabled() &&
           state_for_client_->default_loader_factory);
 }
diff --git a/content/renderer/service_worker/service_worker_provider_context.h b/content/renderer/service_worker/service_worker_provider_context.h
index 0548ad8..eefb01d 100644
--- a/content/renderer/service_worker/service_worker_provider_context.h
+++ b/content/renderer/service_worker/service_worker_provider_context.h
@@ -179,6 +179,10 @@
   // see comments of |container_host_|.
   mojom::ServiceWorkerContainerHost* container_host() const;
 
+  // Pings the container host and calls |callback| once a pong arrived. Useful
+  // for waiting for all messages the host sent thus far to arrive.
+  void PingContainerHost(base::OnceClosure callback);
+
  private:
   friend class base::DeleteHelper<ServiceWorkerProviderContext>;
   friend class base::RefCountedThreadSafe<ServiceWorkerProviderContext,
diff --git a/content/renderer/service_worker/service_worker_subresource_loader.cc b/content/renderer/service_worker/service_worker_subresource_loader.cc
index 53309d8b..3500e12a 100644
--- a/content/renderer/service_worker/service_worker_subresource_loader.cc
+++ b/content/renderer/service_worker/service_worker_subresource_loader.cc
@@ -15,7 +15,6 @@
 #include "content/renderer/service_worker/controller_service_worker_connector.h"
 #include "mojo/public/cpp/bindings/binding.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
-#include "net/url_request/redirect_info.h"
 #include "net/url_request/redirect_util.h"
 #include "net/url_request/url_request.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
@@ -190,8 +189,9 @@
   response_head_.load_timing.request_start = base::TimeTicks::Now();
   response_head_.load_timing.request_start_time = base::Time::Now();
   // base::Unretained() is safe since |url_loader_binding_| is owned by |this|.
-  url_loader_binding_.set_connection_error_handler(base::BindOnce(
-      &ServiceWorkerSubresourceLoader::DeleteSoon, base::Unretained(this)));
+  url_loader_binding_.set_connection_error_handler(
+      base::BindOnce(&ServiceWorkerSubresourceLoader::OnConnectionError,
+                     base::Unretained(this)));
   StartRequest(resource_request);
 }
 
@@ -199,8 +199,8 @@
   SettleInflightFetchRequestIfNeeded();
 };
 
-void ServiceWorkerSubresourceLoader::DeleteSoon() {
-  base::ThreadTaskRunnerHandle::Get()->DeleteSoon(FROM_HERE, this);
+void ServiceWorkerSubresourceLoader::OnConnectionError() {
+  delete this;
 }
 
 void ServiceWorkerSubresourceLoader::StartRequest(
@@ -246,7 +246,7 @@
           url_loader_binding_.Unbind(), routing_id_, request_id_, options_,
           resource_request_, std::move(url_loader_client_),
           traffic_annotation_);
-      DeleteSoon();
+      delete this;
       return;
     }
     DCHECK_EQ(ControllerServiceWorkerConnector::State::kNoContainerHost,
@@ -403,7 +403,7 @@
       traffic_annotation_);
   // Per spec, redirects after this point are not intercepted by the service
   // worker again (https://crbug.com/517364). So this loader is done.
-  DeleteSoon();
+  delete this;
 }
 
 void ServiceWorkerSubresourceLoader::StartResponse(
diff --git a/content/renderer/service_worker/service_worker_subresource_loader.h b/content/renderer/service_worker/service_worker_subresource_loader.h
index 464b233..359ffc7b 100644
--- a/content/renderer/service_worker/service_worker_subresource_loader.h
+++ b/content/renderer/service_worker/service_worker_subresource_loader.h
@@ -61,7 +61,7 @@
  private:
   class StreamWaiter;
 
-  void DeleteSoon();
+  void OnConnectionError();
 
   void StartRequest(const network::ResourceRequest& resource_request);
   void DispatchFetchEvent();
diff --git a/content/renderer/service_worker/service_worker_subresource_loader_unittest.cc b/content/renderer/service_worker/service_worker_subresource_loader_unittest.cc
index 28507ca..0c04458d 100644
--- a/content/renderer/service_worker/service_worker_subresource_loader_unittest.cc
+++ b/content/renderer/service_worker/service_worker_subresource_loader_unittest.cc
@@ -314,6 +314,7 @@
       mojom::ServiceWorkerContainerHostRequest request) override {
     NOTIMPLEMENTED();
   }
+  void Ping(PingCallback callback) override { NOTIMPLEMENTED(); }
 
   int get_controller_service_worker_count_ = 0;
   FakeControllerServiceWorker* fake_controller_;
diff --git a/content/renderer/shared_worker/embedded_shared_worker_stub.cc b/content/renderer/shared_worker/embedded_shared_worker_stub.cc
index 75b6a2a..1b7268d 100644
--- a/content/renderer/shared_worker/embedded_shared_worker_stub.cc
+++ b/content/renderer/shared_worker/embedded_shared_worker_stub.cc
@@ -16,6 +16,7 @@
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/origin_util.h"
+#include "content/public/common/weak_wrapper_shared_url_loader_factory.h"
 #include "content/public/renderer/content_renderer_client.h"
 #include "content/renderer/appcache/appcache_dispatcher.h"
 #include "content/renderer/appcache/web_application_cache_host_impl.h"
@@ -115,8 +116,55 @@
 
   ServiceWorkerNetworkProvider* provider() { return provider_.get(); }
 
-  // TODO(kinuko): Implement CreateURLLoader with provider_->context()->
-  // subresource_loader if Servicification is enabled.
+  std::unique_ptr<blink::WebURLLoader> CreateURLLoader(
+      const blink::WebURLRequest& request,
+      scoped_refptr<base::SingleThreadTaskRunner> task_runner) override {
+    // S13nServiceWorker:
+    // We only install our own URLLoader if Servicification is enabled.
+    if (!ServiceWorkerUtils::IsServicificationEnabled())
+      return nullptr;
+
+    RenderThreadImpl* render_thread = RenderThreadImpl::current();
+    // RenderThreadImpl is nullptr in some tests.
+    if (!render_thread) {
+      return nullptr;
+    }
+    // If the request is for the main script, use the script_loader_factory.
+    if (provider_->script_loader_factory() &&
+        request.GetRequestContext() ==
+            blink::WebURLRequest::kRequestContextSharedWorker) {
+      // TODO(crbug.com/796425): Temporarily wrap the raw
+      // mojom::URLLoaderFactory pointer into SharedURLLoaderFactory.
+      return std::make_unique<WebURLLoaderImpl>(
+          render_thread->resource_dispatcher(), std::move(task_runner),
+          base::MakeRefCounted<WeakWrapperSharedURLLoaderFactory>(
+              provider_->script_loader_factory()));
+    }
+
+    // Otherwise, it's an importScript. Use the subresource loader factory.
+    if (!provider_->context() ||
+        !provider_->context()->GetSubresourceLoaderFactory()) {
+      return nullptr;
+    }
+
+    // If it's not for HTTP or HTTPS, no need to intercept the request.
+    if (!GURL(request.Url()).SchemeIsHTTPOrHTTPS())
+      return nullptr;
+
+    // If GetSkipServiceWorker() returns true, do not intercept the request.
+    if (request.GetSkipServiceWorker())
+      return nullptr;
+
+    // Create our own SubresourceLoader to route the request
+    // to the controller ServiceWorker.
+    // TODO(crbug.com/796425): Temporarily wrap the raw mojom::URLLoaderFactory
+    // pointer into SharedURLLoaderFactory.
+    return std::make_unique<WebURLLoaderImpl>(
+        RenderThreadImpl::current()->resource_dispatcher(),
+        std::move(task_runner),
+        base::MakeRefCounted<WeakWrapperSharedURLLoaderFactory>(
+            provider_->context()->GetSubresourceLoaderFactory()));
+  }
 
  private:
   std::unique_ptr<ServiceWorkerNetworkProvider> provider_;
@@ -130,6 +178,10 @@
     bool pause_on_start,
     const base::UnguessableToken& devtools_worker_token,
     blink::mojom::WorkerContentSettingsProxyPtr content_settings,
+    mojom::ServiceWorkerProviderInfoForSharedWorkerPtr
+        service_worker_provider_info,
+    network::mojom::URLLoaderFactoryAssociatedPtrInfo
+        script_loader_factory_info,
     mojom::SharedWorkerHostPtr host,
     mojom::SharedWorkerRequest request,
     service_manager::mojom::InterfaceProviderPtr interface_provider)
@@ -143,6 +195,10 @@
     // is attached or explicit resume notification is received.
     impl_->PauseWorkerContextOnStart();
   }
+
+  service_worker_provider_info_ = std::move(service_worker_provider_info);
+  script_loader_factory_info_ = std::move(script_loader_factory_info);
+
   impl_->StartWorkerContext(
       url_, blink::WebString::FromUTF8(name_),
       blink::WebString::FromUTF8(info->content_security_policy),
@@ -218,16 +274,35 @@
 
 std::unique_ptr<blink::WebServiceWorkerNetworkProvider>
 EmbeddedSharedWorkerStub::CreateServiceWorkerNetworkProvider() {
-  // Create a content::ServiceWorkerNetworkProvider for this data source so
-  // we can observe its requests.
-  std::unique_ptr<ServiceWorkerNetworkProvider> provider(
-      ServiceWorkerNetworkProvider::CreateForSharedWorker());
+  scoped_refptr<network::SharedURLLoaderFactory> direct_network_loader_factory;
+  // current() may be null in tests.
+  if (RenderThreadImpl* render_thread = RenderThreadImpl::current()) {
+    direct_network_loader_factory =
+        base::MakeRefCounted<PossiblyAssociatedWrapperSharedURLLoaderFactory>(
+            render_thread->blink_platform_impl()
+                ->CreateNetworkURLLoaderFactory());
+  }
 
-  // Blink is responsible for deleting the returned object.
+  std::unique_ptr<ServiceWorkerNetworkProvider> provider =
+      ServiceWorkerNetworkProvider::CreateForSharedWorker(
+          std::move(service_worker_provider_info_),
+          std::move(script_loader_factory_info_),
+          std::move(direct_network_loader_factory));
   return std::make_unique<WebServiceWorkerNetworkProviderForSharedWorker>(
       std::move(provider), IsOriginSecure(url_));
 }
 
+void EmbeddedSharedWorkerStub::WaitForServiceWorkerControllerInfo(
+    blink::WebServiceWorkerNetworkProvider* web_network_provider,
+    base::OnceClosure callback) {
+  ServiceWorkerProviderContext* context =
+      static_cast<WebServiceWorkerNetworkProviderForSharedWorker*>(
+          web_network_provider)
+          ->provider()
+          ->context();
+  context->PingContainerHost(std::move(callback));
+}
+
 std::unique_ptr<blink::WebWorkerFetchContext>
 EmbeddedSharedWorkerStub::CreateWorkerFetchContext(
     blink::WebServiceWorkerNetworkProvider* web_network_provider) {
diff --git a/content/renderer/shared_worker/embedded_shared_worker_stub.h b/content/renderer/shared_worker/embedded_shared_worker_stub.h
index 98fc3c7..c9da843 100644
--- a/content/renderer/shared_worker/embedded_shared_worker_stub.h
+++ b/content/renderer/shared_worker/embedded_shared_worker_stub.h
@@ -11,12 +11,14 @@
 #include "base/macros.h"
 #include "base/unguessable_token.h"
 #include "content/child/scoped_child_process_reference.h"
+#include "content/common/service_worker/service_worker_provider.mojom.h"
 #include "content/common/shared_worker/shared_worker.mojom.h"
 #include "content/common/shared_worker/shared_worker_host.mojom.h"
 #include "content/common/shared_worker/shared_worker_info.mojom.h"
 #include "content/renderer/child_message_filter.h"
 #include "ipc/ipc_listener.h"
 #include "mojo/public/cpp/bindings/binding.h"
+#include "services/network/public/mojom/url_loader_factory.mojom.h"
 #include "services/service_manager/public/mojom/interface_provider.mojom.h"
 #include "third_party/WebKit/public/platform/WebContentSecurityPolicy.h"
 #include "third_party/WebKit/public/platform/WebContentSettingsClient.h"
@@ -57,6 +59,10 @@
       bool pause_on_start,
       const base::UnguessableToken& devtools_worker_token,
       blink::mojom::WorkerContentSettingsProxyPtr content_settings,
+      mojom::ServiceWorkerProviderInfoForSharedWorkerPtr
+          service_worker_provider_info,
+      network::mojom::URLLoaderFactoryAssociatedPtrInfo
+          script_loader_factory_info,
       mojom::SharedWorkerHostPtr host,
       mojom::SharedWorkerRequest request,
       service_manager::mojom::InterfaceProviderPtr interface_provider);
@@ -77,6 +83,9 @@
   CreateServiceWorkerNetworkProvider() override;
   std::unique_ptr<blink::WebWorkerFetchContext> CreateWorkerFetchContext(
       blink::WebServiceWorkerNetworkProvider*) override;
+  void WaitForServiceWorkerControllerInfo(
+      blink::WebServiceWorkerNetworkProvider* web_network_provider,
+      base::OnceClosure callback) override;
 
  private:
   // WebSharedWorker will own |channel|.
@@ -104,6 +113,14 @@
   ScopedChildProcessReference process_ref_;
   WebApplicationCacheHostImpl* app_cache_host_ = nullptr;  // Not owned.
 
+  // S13nServiceWorker: The info needed to connect to the
+  // ServiceWorkerProviderHost on the browser.
+  mojom::ServiceWorkerProviderInfoForSharedWorkerPtr
+      service_worker_provider_info_;
+  // NetworkService: The URLLoaderFactory used for loading the shared worker
+  // script.
+  network::mojom::URLLoaderFactoryAssociatedPtrInfo script_loader_factory_info_;
+
   DISALLOW_COPY_AND_ASSIGN(EmbeddedSharedWorkerStub);
 };
 
diff --git a/content/renderer/shared_worker/shared_worker_factory_impl.cc b/content/renderer/shared_worker/shared_worker_factory_impl.cc
index 2fa3f66..3fe8d6c 100644
--- a/content/renderer/shared_worker/shared_worker_factory_impl.cc
+++ b/content/renderer/shared_worker/shared_worker_factory_impl.cc
@@ -24,14 +24,19 @@
     bool pause_on_start,
     const base::UnguessableToken& devtools_worker_token,
     blink::mojom::WorkerContentSettingsProxyPtr content_settings,
+    mojom::ServiceWorkerProviderInfoForSharedWorkerPtr
+        service_worker_provider_info,
+    network::mojom::URLLoaderFactoryAssociatedPtrInfo
+        script_loader_factory_ptr_info,
     mojom::SharedWorkerHostPtr host,
     mojom::SharedWorkerRequest request,
     service_manager::mojom::InterfaceProviderPtr interface_provider) {
   // Bound to the lifetime of the underlying blink::WebSharedWorker instance.
   new EmbeddedSharedWorkerStub(
       std::move(info), pause_on_start, devtools_worker_token,
-      std::move(content_settings), std::move(host), std::move(request),
-      std::move(interface_provider));
+      std::move(content_settings), std::move(service_worker_provider_info),
+      std::move(script_loader_factory_ptr_info), std::move(host),
+      std::move(request), std::move(interface_provider));
 }
 
 }  // namespace content
diff --git a/content/renderer/shared_worker/shared_worker_factory_impl.h b/content/renderer/shared_worker/shared_worker_factory_impl.h
index 880fb96a..0fc2cfdf 100644
--- a/content/renderer/shared_worker/shared_worker_factory_impl.h
+++ b/content/renderer/shared_worker/shared_worker_factory_impl.h
@@ -6,7 +6,9 @@
 #define CONTENT_RENDERER_SHARED_WORKER_SHARED_WORKER_FACTORY_IMPL_H_
 
 #include "base/macros.h"
+#include "content/common/service_worker/service_worker_provider.mojom.h"
 #include "content/common/shared_worker/shared_worker_factory.mojom.h"
+#include "services/network/public/mojom/url_loader_factory.mojom.h"
 
 namespace content {
 
@@ -23,6 +25,10 @@
       bool pause_on_start,
       const base::UnguessableToken& devtools_worker_token,
       blink::mojom::WorkerContentSettingsProxyPtr content_settings,
+      mojom::ServiceWorkerProviderInfoForSharedWorkerPtr
+          service_worker_provider_info,
+      network::mojom::URLLoaderFactoryAssociatedPtrInfo
+          script_loader_factory_ptr_info,
       mojom::SharedWorkerHostPtr host,
       mojom::SharedWorkerRequest request,
       service_manager::mojom::InterfaceProviderPtr interface_provider) override;
diff --git a/content/test/data/payments/payment_app_invocation.html b/content/test/data/payments/payment_app_invocation.html
index 08d3e45f..ef003e7 100644
--- a/content/test/data/payments/payment_app_invocation.html
+++ b/content/test/data/payments/payment_app_invocation.html
@@ -17,7 +17,7 @@
         'basic-card-payment-app-id',
         {
           name: 'Visa ****',
-          enabledMethods: ['basic-card'],
+          method: 'basic-card',
           icons: [
             {
               'src': 'icon-1x.png',
@@ -42,7 +42,7 @@
         'bobpay-payment-app-id',
         {
           name: 'Bob Pay',
-          enabledMethods: ['https://bobpay.com'],
+          method: 'https://bobpay.com',
           icons: [
             {
               'src': 'icon-1x.png',
diff --git a/content/test/gpu/gpu_tests/webgl2_conformance_expectations.py b/content/test/gpu/gpu_tests/webgl2_conformance_expectations.py
index 8b626be..1318836 100644
--- a/content/test/gpu/gpu_tests/webgl2_conformance_expectations.py
+++ b/content/test/gpu/gpu_tests/webgl2_conformance_expectations.py
@@ -60,7 +60,6 @@
         ['nvidia'], bug=772651)
 
     # All platforms.
-    self.Flaky('conformance2/query/occlusion-query.html', bug=603168)
     self.Fail('conformance2/glsl3/tricky-loop-conditions.html', bug=483282)
     self.Fail('conformance2/glsl3/array-length-side-effects.html',
         bug=2142) # angle bug ID
diff --git a/content/test/renderer_audio_output_stream_factory_context_impl_unittest.cc b/content/test/renderer_audio_output_stream_factory_context_impl_unittest.cc
index 8d85992..51bee293 100644
--- a/content/test/renderer_audio_output_stream_factory_context_impl_unittest.cc
+++ b/content/test/renderer_audio_output_stream_factory_context_impl_unittest.cc
@@ -252,12 +252,13 @@
   // Wait for factory_ptr to be set.
   SyncWith(renderer_ipc_task_runner);
 
-  auto renderer_side_ipc =
-      std::make_unique<MojoAudioOutputIPC>(base::BindRepeating(
+  auto renderer_side_ipc = std::make_unique<MojoAudioOutputIPC>(
+      base::BindRepeating(
           [](mojom::RendererAudioOutputStreamFactory* factory_ptr) {
             return factory_ptr;
           },
-          factory_ptr));
+          factory_ptr),
+      renderer_ipc_task_runner);
 
   auto device = base::MakeRefCounted<media::AudioOutputDevice>(
       std::move(renderer_side_ipc), renderer_ipc_task_runner, kNoSessionId, "",
diff --git a/content/test/test_render_frame.cc b/content/test/test_render_frame.cc
index 2644a43..92d386c7 100644
--- a/content/test/test_render_frame.cc
+++ b/content/test/test_render_frame.cc
@@ -112,6 +112,8 @@
   void OnUpdatePictureInPictureSurfaceId(
       const viz::SurfaceId& surface_id) override {}
 
+  void OnExitPictureInPicture() override {}
+
  private:
   std::unique_ptr<FrameHostMsg_DidCommitProvisionalLoad_Params>
       last_commit_params_;
diff --git a/device/fido/u2f_parsing_utils.cc b/device/fido/u2f_parsing_utils.cc
index 9370d559e..c0213abd 100644
--- a/device/fido/u2f_parsing_utils.cc
+++ b/device/fido/u2f_parsing_utils.cc
@@ -9,6 +9,16 @@
 namespace device {
 namespace u2f_parsing_utils {
 
+namespace {
+
+constexpr bool AreSpansDisjoint(base::span<const uint8_t> lhs,
+                                base::span<const uint8_t> rhs) {
+  return lhs.data() + lhs.size() <= rhs.data() ||  // [lhs)...[rhs)
+         rhs.data() + rhs.size() <= lhs.data();    // [rhs)...[lhs)
+}
+
+}  // namespace
+
 const uint32_t kU2fResponseKeyHandleLengthPos = 66u;
 const uint32_t kU2fResponseKeyHandleStartPos = 67u;
 const char kEs256[] = "ES256";
@@ -25,6 +35,7 @@
 }
 
 void Append(std::vector<uint8_t>* target, base::span<const uint8_t> in_values) {
+  CHECK(AreSpansDisjoint(*target, in_values));
   target->insert(target->end(), in_values.begin(), in_values.end());
 }
 
diff --git a/device/fido/u2f_parsing_utils_unittest.cc b/device/fido/u2f_parsing_utils_unittest.cc
index 4965feb..0e3c895 100644
--- a/device/fido/u2f_parsing_utils_unittest.cc
+++ b/device/fido/u2f_parsing_utils_unittest.cc
@@ -53,6 +53,17 @@
   EXPECT_THAT(target, ::testing::ElementsAreArray(kOneTwoThree));
 }
 
+TEST(U2fParsingUtils, AppendSelfCrashes) {
+  std::vector<uint8_t> target(std::begin(kOneTwoThree), std::end(kOneTwoThree));
+  auto span = base::make_span(target);
+
+  // Tests the case where |in_values| overlap with the beginning of |*target|.
+  EXPECT_DEATH_IF_SUPPORTED(Append(&target, span.first(1)), "Check failed");
+
+  // Tests the case where |in_values| overlap with the end of |*target|.
+  EXPECT_DEATH_IF_SUPPORTED(Append(&target, span.last(1)), "Check failed");
+}
+
 // ExtractSpan and ExtractSuffixSpan are implicitly tested as they used by
 // the Extract and ExtractSuffix implementations.
 
diff --git a/docs/network_traffic_annotations.md b/docs/network_traffic_annotations.md
index d682db7..427eb18e 100644
--- a/docs/network_traffic_annotations.md
+++ b/docs/network_traffic_annotations.md
@@ -13,8 +13,8 @@
 * What is the intent behind each network request?
 * What user data is sent in the request, and where does it go?
 
-Besides these requirements, the following information helps Enterprise admins
-and help desk:
+Besides these requirements, the following information helps users, admins, and
+help desk:
 * How can a network communication be stopped or controlled?
 * What are the traces of the communication on the client?
 
@@ -60,17 +60,19 @@
 them together, or a device location is requested by different components, and
 just one network request is made to fetch it. In these cases, the merge point
 can ensure that all received requests are properly annotated and just pass one
-of them to the downstream step.
+of them to the downstream step. It can also pass a local annotation stating that
+it is a merged request on behalf of other requests of type X, which were ensured
+to all have annotations.
 This decision is driven from the fact that we do not need to transmit the
 annotation metadata in runtime and enforced annotation arguments are just to
 ensure that the request is annotated somewhere upstream.
 
 
 ## Coverage
-Network traffic annotations are currently enforced on all url requests in
-Windows and Linux, and are expanding to sockets and native API functions in
-2017,Q4 - 2018,Q1.
-Currently there is no plan to expand the task to other platforms.
+Network traffic annotations are currently enforced on all url requests and
+socket writes, except for the code which is not compiled on Windows or Linux.
+This effort may expand to ChromeOS in future and currently there is no plan to
+expand it to other platforms.
 
 
 ## Network Traffic Annotation Tag
@@ -97,7 +99,7 @@
   network request’s content and reason.
    * `sender`: What component triggers the request. The components should be
      human readable and don’t need to reflect the components/ directory. Avoid
-     abbreviations.
+     abbreviations, and use a common value for all annotations in one component.
    * `description`: Plaintext description of the network request in language
      that is understandable by admins (ideally also users). Please avoid
      acronyms and describe the feature and the    feature's value proposition as
@@ -284,31 +286,38 @@
 * Unique ids are unique, through history (even if an annotation gets deprecated,
   its unique id cannot be reused to keep the stats sound).
 
-To do these tests, traffic_annotation_auditor binary runs over the whole
-repository and using a clang tool, checks if all above items are correct.
-Running the `traffic_annotation_auditor` requires exiting a compiled build
-directory and can be done with the following syntax.
-`tools/traffic_annotation/bin/[linux64/windows32/mac]/traffic_annotation_auditor
+### Presubmit tests
+To perform tests prior to submit, one can use traffic_annotation_auditor binary.
+It runs over the whole repository and using a clang tool, checks if all above
+items are correct.
+Running the `traffic_annotation_auditor` requires having a COMPLETE compiled
+build directory and can be done with the following syntax.
+`tools/traffic_annotation/bin/[linux64/win32]/traffic_annotation_auditor
  --build-path=[out/Default]`
-If you are running the auditor on Windows, please refer to extra instructions in
-`tools/traffic_annotation/auditor/README.md`.
 The latest executable of `traffic_annotation_auditor` for supported platforms
 can be found in `tools/traffic_annotation/bin/[platform]`.
 As this test is slow, it is not a mandatory step of the presubmit checks on
-clients, and one can run it manually. The test is done on trybots as a commit
-queue step.
+clients, and one can run it manually.
+
+### Waterfall tests
+Two commit queue trybots test traffic annotations on changed files using the
+scripts in `tools/traffic_annotation/scripts`. To run these tests faster and to
+avoid spamming the commit queue if an unforeseen error has happed in downstream
+scripts or tools, they are run in error resilient mode, only on changed files,
+and using heuristics to decide which files to process.
+An FYI bot runs more detailed tests on the whole repository and with different
+switches, to make sure that the heuristics that trybot tests use and the limited
+scope of tests have not neglected any issues.
 
 
 ## Annotations Review
 
-Network traffic annotations require review by privacy, enterprise, and legal
-teams. To shorten the process of review, only privacy review is a blocking step
-and review by the other two teams will be done after code submission.
-Privacy reviews are enforced through keeping a summary of annotations in
-`tools/traffic_annotation/summary/annotations.xml`, which is owned by privacy
-team. Once a new annotation is added, one is updated, or deleted, this file
+Network traffic annotations require review before landing in code and this is
+enforced through keeping a summary of annotations in
+`tools/traffic_annotation/summary/annotations.xml`.
+Once a new annotation is added, one is updated, or deleted, this file
 should also be updated. To update the file automatically, one can run
-`traffic_annotation_auditor` as specified in above step. But if it is not
+`traffic_annotation_auditor` as specified in presubmit tests. But if it is not
 possible to do so (e.g., if you are changing the code from an unsupported
 platform or you don’t have a compiled build directory), the code can be
 submitted to the trybot and the test on trybot will tell you the required
diff --git a/extensions/browser/api/management/management_api.cc b/extensions/browser/api/management/management_api.cc
index f8373eb6..9c9fa6c 100644
--- a/extensions/browser/api/management/management_api.cc
+++ b/extensions/browser/api/management/management_api.cc
@@ -547,7 +547,9 @@
   if (show_confirm_dialog) {
     // We show the programmatic uninstall ui for extensions uninstalling
     // other extensions.
-    bool show_programmatic_uninstall_ui = !self_uninstall && extension();
+    bool show_programmatic_uninstall_ui =
+        !self_uninstall && extension() &&
+        extension()->id() != extensions::kWebStoreAppId;
     AddRef();  // Balanced in OnExtensionUninstallDialogClosed.
     // TODO(devlin): A method called "UninstallFunctionDelegate" does not in
     // any way imply that this actually creates a dialog and runs it.
diff --git a/extensions/browser/api/web_request/web_request_permissions.cc b/extensions/browser/api/web_request/web_request_permissions.cc
index 320cd7e..95e9f121 100644
--- a/extensions/browser/api/web_request/web_request_permissions.cc
+++ b/extensions/browser/api/web_request/web_request_permissions.cc
@@ -78,13 +78,40 @@
   return access;
 }
 
+bool IsWebUIAllowedToMakeNetworkRequests(const url::Origin& origin) {
+  // Whitelist to work around exceptional cases. This is only used to elide a
+  // DCHECK.
+  return origin.host() == "print";
+}
+
 }  // namespace
 
 // Returns true if the URL is sensitive and requests to this URL must not be
 // modified/canceled by extensions, e.g. because it is targeted to the webstore
 // to check for updates, extension blacklisting, etc.
 bool IsSensitiveURL(const GURL& url,
-                    bool is_request_from_browser_or_webui_renderer) {
+                    base::Optional<url::Origin> initiator,
+                    bool is_request_from_browser,
+                    bool is_request_from_webui_renderer) {
+  const bool is_request_from_sensitive_source =
+      is_request_from_browser || is_request_from_webui_renderer;
+
+  const bool is_network_request =
+      url.SchemeIsHTTPOrHTTPS() || url.SchemeIsWSOrWSS();
+  if (is_network_request && is_request_from_webui_renderer) {
+    // WebUI renderers should never be making network requests, but we may make
+    // some exceptions for now. See https://crbug.com/829412 for details.
+    //
+    // The DCHECK helps avoid proliferation of such behavior. In any case, we
+    // treat the requests as sensitive to ensure that the Web Request API
+    // doesn't see them.
+    DCHECK(initiator.has_value());
+    DCHECK(IsWebUIAllowedToMakeNetworkRequests(*initiator))
+        << "Unsupported network request from " << initiator->GetURL().spec()
+        << " for " << url.spec();
+    return true;
+  }
+
   // TODO(battre) Merge this, CanExtensionAccessURL and
   // PermissionsData::CanAccessPage into one function.
   bool sensitive_chrome_url = false;
@@ -103,7 +130,7 @@
     // These URLs are only protected for requests from the browser and webui
     // renderers, not for requests from common renderers, because
     // clients*.google.com are also used by websites.
-    if (is_request_from_browser_or_webui_renderer) {
+    if (is_request_from_sensitive_source) {
       base::StringPiece::size_type pos = host.rfind(kClient);
       if (pos != base::StringPiece::npos) {
         bool match = true;
@@ -132,7 +159,7 @@
                                              base::CompareCase::SENSITIVE));
   }
 
-  if (is_request_from_browser_or_webui_renderer) {
+  if (is_request_from_sensitive_source) {
     sensitive_chrome_url =
         sensitive_chrome_url ||
         extensions::ExtensionsAPIClient::Get()->ShouldHideBrowserNetworkRequest(
@@ -185,8 +212,8 @@
             request.render_process_id);
   }
 
-  return IsSensitiveURL(request.url, is_request_from_browser ||
-                                         is_request_from_webui_renderer) ||
+  return IsSensitiveURL(request.url, request.initiator, is_request_from_browser,
+                        is_request_from_webui_renderer) ||
          !HasWebRequestScheme(request.url);
 }
 
diff --git a/extensions/browser/api/web_request/web_request_permissions.h b/extensions/browser/api/web_request/web_request_permissions.h
index 7283a430..4a3c6fde 100644
--- a/extensions/browser/api/web_request/web_request_permissions.h
+++ b/extensions/browser/api/web_request/web_request_permissions.h
@@ -22,7 +22,9 @@
 
 // Exposed for unit testing.
 bool IsSensitiveURL(const GURL& url,
-                    bool is_request_from_browser_or_webui_renderer);
+                    base::Optional<url::Origin> initiator,
+                    bool is_request_from_browser,
+                    bool is_request_from_webui_renderer);
 
 // This class is used to test whether extensions may modify web requests.
 class WebRequestPermissions {
diff --git a/extensions/browser/api/web_request/web_request_permissions_unittest.cc b/extensions/browser/api/web_request/web_request_permissions_unittest.cc
index 1bb7db6b..f3afe687b 100644
--- a/extensions/browser/api/web_request/web_request_permissions_unittest.cc
+++ b/extensions/browser/api/web_request/web_request_permissions_unittest.cc
@@ -58,12 +58,16 @@
     GURL url(test.url);
     EXPECT_TRUE(url.is_valid()) << test.url;
     EXPECT_EQ(test.is_sensitive_if_request_from_common_renderer,
-              IsSensitiveURL(
-                  url, false /* is_request_from_browser_or_webui_renderer */))
+              IsSensitiveURL(url, url::Origin::Create(url),
+                             false /* is_request_from_browser */,
+                             false /* is_request_from_web_ui_renderer */))
         << test.url;
-    EXPECT_EQ(test.is_sensitive_if_request_from_browser_or_webui_renderer,
-              IsSensitiveURL(
-                  url, true /* is_request_from_browser_or_webui_renderer */))
+
+    const bool supported_in_webui_renderers = !url.SchemeIsHTTPOrHTTPS();
+    EXPECT_EQ(
+        test.is_sensitive_if_request_from_browser_or_webui_renderer,
+        IsSensitiveURL(url, base::nullopt, true /* is_request_from_browser */,
+                       supported_in_webui_renderers))
         << test.url;
   }
 }
diff --git a/extensions/browser/uninstall_reason.h b/extensions/browser/uninstall_reason.h
index fa2486a..17bb97b 100644
--- a/extensions/browser/uninstall_reason.h
+++ b/extensions/browser/uninstall_reason.h
@@ -28,11 +28,14 @@
   UNINSTALL_REASON_COMPONENT_REMOVED,
   UNINSTALL_REASON_MIGRATED,  // Migrated to component extensions
 
+  UNINSTALL_REASON_CHROME_WEBSTORE,
+
   UNINSTALL_REASON_MAX,  // Should always be the last value
 };
 
-// The source of an uninstall. Do *NOT* adjust the order of these, as they are
-// used in UMA.
+// The source of an uninstall. Do *NOT* reorder or delete any of the named
+// values, as they are used in UMA. Put all new values above
+// NUM_UNINSTALL_SOURCES.
 enum UninstallSource {
   UNINSTALL_SOURCE_FOR_TESTING,
   UNINSTALL_SOURCE_TOOLBAR_CONTEXT_MENU,
@@ -43,6 +46,7 @@
   UNINSTALL_SOURCE_CHROME_APPS_PAGE,
   UNINSTALL_SOURCE_CHROME_EXTENSIONS_PAGE,
   UNINSTALL_SOURCE_EXTENSION,
+  UNINSTALL_SOURCE_CHROME_WEBSTORE,
   NUM_UNINSTALL_SOURCES,
 };
 
diff --git a/ios/chrome/browser/browser_state/chrome_browser_state_manager_impl.cc b/ios/chrome/browser/browser_state/chrome_browser_state_manager_impl.cc
index 007fc3a..cf20f4d 100644
--- a/ios/chrome/browser/browser_state/chrome_browser_state_manager_impl.cc
+++ b/ios/chrome/browser/browser_state/chrome_browser_state_manager_impl.cc
@@ -40,7 +40,6 @@
 #include "ios/chrome/browser/signin/gaia_cookie_manager_service_factory.h"
 #include "ios/chrome/browser/signin/signin_manager_factory.h"
 #include "ios/chrome/browser/sync/ios_chrome_profile_sync_service_factory.h"
-#include "ios/chrome/browser/sync/ios_user_event_service_factory.h"
 
 namespace {
 
@@ -224,10 +223,6 @@
       ->SetupInvalidationsOnProfileLoad(invalidation_service);
   ios::AccountReconcilorFactory::GetForBrowserState(browser_state);
   DesktopPromotionSyncServiceFactory::GetForBrowserState(browser_state);
-  // TODO(crbug.com/709094), TODO(crbug.com/761485): Remove this following line
-  // when UserEventService will be initialized synchronously. Until then, the
-  // service has to be created as early as possible.
-  IOSUserEventServiceFactory::GetForBrowserState(browser_state);
 }
 
 void ChromeBrowserStateManagerImpl::AddBrowserStateToCache(
diff --git a/ios/chrome/browser/passwords/password_controller.mm b/ios/chrome/browser/passwords/password_controller.mm
index b840e949..37d3b95 100644
--- a/ios/chrome/browser/passwords/password_controller.mm
+++ b/ios/chrome/browser/passwords/password_controller.mm
@@ -272,8 +272,6 @@
 
   AccountSelectFillData fillData_;
 
-  password_manager::IOSFormParser formParser_;
-
   // The WebState this instance is observing. Will be null after
   // -webStateDestroyed: has been called.
   web::WebState* webState_;
@@ -545,7 +543,7 @@
 
   for (const auto& formData : formsData) {
     std::unique_ptr<PasswordForm> form =
-        formParser_.Parse(formData, password_manager::FormParsingMode::FILLING);
+        ParseFormData(formData, password_manager::FormParsingMode::FILLING);
     if (form)
       forms->push_back(*form);
   }
@@ -582,7 +580,7 @@
     }
 
     std::unique_ptr<PasswordForm> form =
-        formParser_.Parse(formData, password_manager::FormParsingMode::SAVING);
+        ParseFormData(formData, password_manager::FormParsingMode::SAVING);
     if (!form) {
       completionHandler(NO, PasswordForm());
       return;
@@ -862,7 +860,7 @@
   }
 
   std::unique_ptr<PasswordForm> form =
-      formParser_.Parse(formData, password_manager::FormParsingMode::SAVING);
+      ParseFormData(formData, password_manager::FormParsingMode::SAVING);
   if (!form)
     return NO;
 
diff --git a/ios/chrome/browser/ui/download/download_manager_coordinator.mm b/ios/chrome/browser/ui/download/download_manager_coordinator.mm
index 1e7bef6..4938b58 100644
--- a/ios/chrome/browser/ui/download/download_manager_coordinator.mm
+++ b/ios/chrome/browser/ui/download/download_manager_coordinator.mm
@@ -271,6 +271,10 @@
 
 #pragma mark - ContainedPresenterDelegate
 
+- (void)containedPresenterDidPresent:(id<ContainedPresenter>)presenter {
+  DCHECK(presenter == self.presenter);
+}
+
 - (void)containedPresenterDidDismiss:(id<ContainedPresenter>)presenter {
   DCHECK(presenter == self.presenter);
 }
diff --git a/ios/chrome/browser/ui/history_popup/tab_history_legacy_coordinator.mm b/ios/chrome/browser/ui/history_popup/tab_history_legacy_coordinator.mm
index 4371cf7..29be17492 100644
--- a/ios/chrome/browser/ui/history_popup/tab_history_legacy_coordinator.mm
+++ b/ios/chrome/browser/ui/history_popup/tab_history_legacy_coordinator.mm
@@ -71,12 +71,6 @@
   CGPoint origin = CGPointZero;
   origin = [self popupOriginForNamedGuide:kBackButtonGuide];
 
-  if (IsUIRefreshPhase1Enabled() && origin.y > 200) {
-    // TODO(crbug.com/804772): Remove this workaround once the new navigation
-    // menu popup can be presented from the bottom back/forward arrows.
-    origin.y -= 100;
-  }
-
   [self.tabHistoryUIUpdater
       updateUIForTabHistoryPresentationFrom:ToolbarButtonTypeBack];
   [self presentTabHistoryPopupWithItems:backwardItems origin:origin];
diff --git a/ios/chrome/browser/ui/popup_menu/BUILD.gn b/ios/chrome/browser/ui/popup_menu/BUILD.gn
index 4a14b4c..a845188 100644
--- a/ios/chrome/browser/ui/popup_menu/BUILD.gn
+++ b/ios/chrome/browser/ui/popup_menu/BUILD.gn
@@ -13,8 +13,10 @@
   deps = [
     ":popup_menu_ui",
     "//base",
+    "//components/feature_engagement/public",
     "//ios/chrome/app/strings",
     "//ios/chrome/browser/browser_state",
+    "//ios/chrome/browser/feature_engagement",
     "//ios/chrome/browser/find_in_page",
     "//ios/chrome/browser/reading_list",
     "//ios/chrome/browser/ui",
@@ -22,6 +24,7 @@
     "//ios/chrome/browser/ui/commands",
     "//ios/chrome/browser/ui/coordinators:chrome_coordinators",
     "//ios/chrome/browser/ui/popup_menu/cells",
+    "//ios/chrome/browser/ui/presenters",
     "//ios/chrome/browser/ui/reading_list",
     "//ios/chrome/browser/ui/tools_menu/public",
     "//ios/chrome/browser/ui/util",
@@ -98,6 +101,7 @@
     ":popup_menu_ui",
     "//base",
     "//base/test:test_support",
+    "//components/feature_engagement/test:test_support",
     "//components/reading_list/core",
     "//ios/chrome/browser/browser_state:test_support",
     "//ios/chrome/browser/ui/toolbar/test",
@@ -108,6 +112,7 @@
     "//ios/web",
     "//ios/web/public/test",
     "//ios/web/public/test/fakes",
+    "//testing/gmock",
     "//testing/gtest",
     "//third_party/ocmock",
   ]
diff --git a/ios/chrome/browser/ui/popup_menu/cells/popup_menu_navigation_item.h b/ios/chrome/browser/ui/popup_menu/cells/popup_menu_navigation_item.h
index 29ccff5..78a349d91 100644
--- a/ios/chrome/browser/ui/popup_menu/cells/popup_menu_navigation_item.h
+++ b/ios/chrome/browser/ui/popup_menu/cells/popup_menu_navigation_item.h
@@ -10,10 +10,18 @@
 
 // Item used to display an item for a navigation menu.
 @interface PopupMenuNavigationItem : TableViewItem<PopupMenuItem>
+// Title of the navigation item.
+@property(nonatomic, copy) NSString* title;
+// Favicon to be displayed. Set to nil to display the default favicon.
+@property(nonatomic, strong) UIImage* favicon;
 @end
 
 // Associated cell for a PopupMenuNavigationItem.
 @interface PopupMenuNavigationCell : UITableViewCell
+
+- (void)setTitle:(NSString*)title;
+- (void)setFavicon:(UIImage*)favicon;
+
 @end
 
 #endif  // IOS_CHROME_BROWSER_UI_POPUP_MENU_CELLS_POPUP_MENU_NAVIGATION_ITEM_H_
diff --git a/ios/chrome/browser/ui/popup_menu/cells/popup_menu_navigation_item.mm b/ios/chrome/browser/ui/popup_menu/cells/popup_menu_navigation_item.mm
index 4e1daf2f3..f34167e 100644
--- a/ios/chrome/browser/ui/popup_menu/cells/popup_menu_navigation_item.mm
+++ b/ios/chrome/browser/ui/popup_menu/cells/popup_menu_navigation_item.mm
@@ -5,14 +5,27 @@
 #import "ios/chrome/browser/ui/popup_menu/cells/popup_menu_navigation_item.h"
 
 #include "base/logging.h"
+#import "ios/chrome/browser/ui/table_view/chrome_table_view_styler.h"
+#import "ios/chrome/browser/ui/util/constraints_ui_util.h"
 
 #if !defined(__has_feature) || !__has_feature(objc_arc)
 #error "This file requires ARC support."
 #endif
 
+namespace {
+const CGFloat kImageLength = 16;
+const CGFloat kCellHeight = 44;
+const CGFloat kImageTextMargin = 11;
+const CGFloat kMargin = 15;
+const CGFloat kVerticalMargin = 8;
+const CGFloat kMaxHeight = 100;
+}  // namespace
+
 @implementation PopupMenuNavigationItem
 
 @synthesize actionIdentifier = _actionIdentifier;
+@synthesize favicon = _favicon;
+@synthesize title = _title;
 
 - (instancetype)initWithType:(NSInteger)type {
   self = [super initWithType:type];
@@ -22,15 +35,96 @@
   return self;
 }
 
+- (void)configureCell:(PopupMenuNavigationCell*)cell
+           withStyler:(ChromeTableViewStyler*)styler {
+  [super configureCell:cell withStyler:styler];
+  [cell setFavicon:self.favicon];
+  [cell setTitle:self.title];
+}
+
 #pragma mark - PopupMenuItem
 
 - (CGSize)cellSizeForWidth:(CGFloat)width {
-  // TODO(crbug.com/804779): implement this.
-  NOTREACHED();
-  return CGSizeZero;
+  // TODO(crbug.com/828357): This should be done at the table view level.
+  static PopupMenuNavigationCell* cell;
+  static dispatch_once_t onceToken;
+  dispatch_once(&onceToken, ^{
+    cell = [[PopupMenuNavigationCell alloc] init];
+  });
+
+  [self configureCell:cell withStyler:[[ChromeTableViewStyler alloc] init]];
+  cell.frame = CGRectMake(0, 0, width, kMaxHeight);
+  [cell setNeedsLayout];
+  [cell layoutIfNeeded];
+  return [cell systemLayoutSizeFittingSize:CGSizeMake(width, kMaxHeight)];
 }
 
 @end
 
+#pragma mark - PopupMenuNavigationCell
+
+@interface PopupMenuNavigationCell ()
+@property(nonatomic, strong) UILabel* titleLabel;
+@property(nonatomic, strong) UIImageView* faviconView;
+@end
+
 @implementation PopupMenuNavigationCell
+
+@synthesize faviconView = _faviconView;
+@synthesize titleLabel = _titleLabel;
+
+- (instancetype)initWithStyle:(UITableViewCellStyle)style
+              reuseIdentifier:(NSString*)reuseIdentifier {
+  self = [super initWithStyle:style reuseIdentifier:reuseIdentifier];
+  if (self) {
+    _titleLabel = [[UILabel alloc] init];
+    _titleLabel.translatesAutoresizingMaskIntoConstraints = NO;
+    _titleLabel.font = [UIFont preferredFontForTextStyle:UIFontTextStyleBody];
+
+    _faviconView = [[UIImageView alloc] init];
+    _faviconView.translatesAutoresizingMaskIntoConstraints = NO;
+
+    [self.contentView addSubview:_titleLabel];
+    [self.contentView addSubview:_faviconView];
+
+    ApplyVisualConstraintsWithMetrics(
+        @[
+          @"H:|-(margin)-[image(imageSize)]-(textImage)-[text]-(margin)-|",
+          @"V:[image(imageSize)]",
+          @"V:|-(verticalMargin)-[text]-(verticalMargin)-|"
+        ],
+        @{@"image" : _faviconView, @"text" : _titleLabel}, @{
+          @"margin" : @(kMargin),
+          @"imageSize" : @(kImageLength),
+          @"textImage" : @(kImageTextMargin),
+          @"verticalMargin" : @(kVerticalMargin),
+        });
+
+    [self.contentView.heightAnchor
+        constraintGreaterThanOrEqualToConstant:kCellHeight]
+        .active = YES;
+    [_faviconView.centerYAnchor
+        constraintEqualToAnchor:self.contentView.centerYAnchor]
+        .active = YES;
+  }
+  return self;
+}
+
+- (void)setTitle:(NSString*)title {
+  self.titleLabel.text = title;
+}
+
+- (void)setFavicon:(UIImage*)favicon {
+  if (favicon) {
+    self.faviconView.image = favicon;
+  } else {
+    self.faviconView.image = [UIImage imageNamed:@"default_favicon"];
+  }
+}
+
+- (void)prepareForReuse {
+  [super prepareForReuse];
+  [self setFavicon:nil];
+}
+
 @end
diff --git a/ios/chrome/browser/ui/popup_menu/cells/popup_menu_tools_item.h b/ios/chrome/browser/ui/popup_menu/cells/popup_menu_tools_item.h
index 51ce8a2..4674bfc 100644
--- a/ios/chrome/browser/ui/popup_menu/cells/popup_menu_tools_item.h
+++ b/ios/chrome/browser/ui/popup_menu/cells/popup_menu_tools_item.h
@@ -17,9 +17,10 @@
 @property(nonatomic, strong) UIImage* image;
 // Whether the cell associated with this item should be enabled.
 @property(nonatomic, assign) BOOL enabled;
-// Number to be displayed in the badge.
+// Number to be displayed in the badge. If 0, the badge is hidden.
 @property(nonatomic, assign) NSInteger badgeNumber;
-// Text to be displayed in the badge. Set to nil to hide the badge.
+// Text to be displayed in the badge. Set to nil to hide the badge. The text
+// badge is only displayed if the numbered badge is hidden.
 @property(nonatomic, copy) NSString* badgeText;
 
 @end
diff --git a/ios/chrome/browser/ui/popup_menu/cells/popup_menu_tools_item.mm b/ios/chrome/browser/ui/popup_menu/cells/popup_menu_tools_item.mm
index 220bb3c..ccf0a90 100644
--- a/ios/chrome/browser/ui/popup_menu/cells/popup_menu_tools_item.mm
+++ b/ios/chrome/browser/ui/popup_menu/cells/popup_menu_tools_item.mm
@@ -26,6 +26,7 @@
 const CGFloat kMargin = 15;
 const CGFloat kTopMargin = 8;
 const CGFloat kTopMarginBadge = 14;
+const CGFloat kMaxHeight = 100;
 }  // namespace
 
 @implementation PopupMenuToolsItem
@@ -67,10 +68,10 @@
   });
 
   [self configureCell:cell withStyler:[[ChromeTableViewStyler alloc] init]];
-  cell.frame = CGRectMake(0, 0, width, 0);
+  cell.frame = CGRectMake(0, 0, width, kMaxHeight);
   [cell setNeedsLayout];
   [cell layoutIfNeeded];
-  return [cell systemLayoutSizeFittingSize:UILayoutFittingCompressedSize];
+  return [cell systemLayoutSizeFittingSize:CGSizeMake(width, kMaxHeight)];
 }
 
 @end
diff --git a/ios/chrome/browser/ui/popup_menu/popup_menu_coordinator.mm b/ios/chrome/browser/ui/popup_menu/popup_menu_coordinator.mm
index 551f92b..7ffb6e00 100644
--- a/ios/chrome/browser/ui/popup_menu/popup_menu_coordinator.mm
+++ b/ios/chrome/browser/ui/popup_menu/popup_menu_coordinator.mm
@@ -5,9 +5,11 @@
 #import "ios/chrome/browser/ui/popup_menu/popup_menu_coordinator.h"
 
 #include "base/logging.h"
+#include "base/metrics/histogram_macros.h"
 #include "base/metrics/user_metrics.h"
 #include "base/metrics/user_metrics_action.h"
 #include "ios/chrome/browser/browser_state/chrome_browser_state.h"
+#include "ios/chrome/browser/feature_engagement/tracker_factory.h"
 #include "ios/chrome/browser/reading_list/reading_list_model_factory.h"
 #import "ios/chrome/browser/ui/commands/browser_commands.h"
 #import "ios/chrome/browser/ui/commands/command_dispatcher.h"
@@ -15,6 +17,7 @@
 #import "ios/chrome/browser/ui/popup_menu/popup_menu_mediator.h"
 #import "ios/chrome/browser/ui/popup_menu/popup_menu_presenter.h"
 #import "ios/chrome/browser/ui/popup_menu/popup_menu_table_view_controller.h"
+#import "ios/chrome/browser/ui/presenters/contained_presenter_delegate.h"
 #import "ios/chrome/browser/ui/util/layout_guide_names.h"
 
 #if !defined(__has_feature) || !__has_feature(objc_arc)
@@ -30,12 +33,15 @@
 }
 }  // namespace
 
-@interface PopupMenuCoordinator ()<PopupMenuCommands>
+@interface PopupMenuCoordinator ()<ContainedPresenterDelegate,
+                                   PopupMenuCommands>
 
 // Presenter for the popup menu, managing the animations.
 @property(nonatomic, strong) PopupMenuPresenter* presenter;
 // Mediator for the popup menu.
 @property(nonatomic, strong) PopupMenuMediator* mediator;
+// Time when the presentation of the popup menu is requested.
+@property(nonatomic, assign) NSTimeInterval requestStartTime;
 
 @end
 
@@ -44,6 +50,7 @@
 @synthesize dispatcher = _dispatcher;
 @synthesize mediator = _mediator;
 @synthesize presenter = _presenter;
+@synthesize requestStartTime = _requestStartTime;
 @synthesize webStateList = _webStateList;
 
 #pragma mark - ChromeCoordinator
@@ -75,82 +82,32 @@
 - (void)showNavigationHistoryBackPopupMenu {
   base::RecordAction(
       base::UserMetricsAction("MobileToolbarShowTabHistoryMenu"));
-  UIViewController* viewController = [[UIViewController alloc] init];
-  UILabel* label = [[UILabel alloc] init];
-  label.text = @"Back";
-  viewController.view = label;
-  // TODO(crbug.com/804779): Use the Navigation menu instead of a label.
-  [self presentPopupForContent:viewController
-                        ofType:PopupMenuTypeNavigationBackward
-                fromNamedGuide:kBackButtonGuide];
+  [self presentPopupOfType:PopupMenuTypeNavigationBackward
+            fromNamedGuide:kBackButtonGuide];
 }
 
 - (void)showNavigationHistoryForwardPopupMenu {
   base::RecordAction(
       base::UserMetricsAction("MobileToolbarShowTabHistoryMenu"));
-  UIViewController* viewController = [[UIViewController alloc] init];
-  UILabel* label = [[UILabel alloc] init];
-  label.text = @"Forward";
-  viewController.view = label;
-  // TODO(crbug.com/804779): Use the Navigation menu instead of a label.
-  [self presentPopupForContent:viewController
-                        ofType:PopupMenuTypeNavigationForward
-                fromNamedGuide:kForwardButtonGuide];
+  [self presentPopupOfType:PopupMenuTypeNavigationForward
+            fromNamedGuide:kForwardButtonGuide];
 }
 
 - (void)showToolsMenuPopup {
-  PopupMenuTableViewController* tableViewController =
-      [[PopupMenuTableViewController alloc]
-          initWithStyle:UITableViewStyleGrouped];
-  tableViewController.dispatcher =
-      static_cast<id<ApplicationCommands, BrowserCommands>>(self.dispatcher);
-  tableViewController.baseViewController = self.baseViewController;
-
-  self.mediator = [[PopupMenuMediator alloc]
-          initWithType:PopupMenuTypeToolsMenu
-           isIncognito:self.browserState->IsOffTheRecord()
-      readingListModel:ReadingListModelFactory::GetForBrowserState(
-                           self.browserState)];
-  self.mediator.webStateList = self.webStateList;
-  self.mediator.popupMenu = tableViewController;
-  self.mediator.dispatcher = static_cast<id<BrowserCommands>>(self.dispatcher);
-
-  [self presentPopupForContent:tableViewController
-                        ofType:PopupMenuTypeToolsMenu
-                fromNamedGuide:kToolsMenuGuide];
+  // The metric is registered at the toolbar level.
+  [self presentPopupOfType:PopupMenuTypeToolsMenu
+            fromNamedGuide:kToolsMenuGuide];
 }
 
 - (void)showTabGridButtonPopup {
   base::RecordAction(base::UserMetricsAction("MobileToolbarShowTabGridMenu"));
-  PopupMenuTableViewController* tableViewController =
-      [[PopupMenuTableViewController alloc] init];
-  tableViewController.dispatcher =
-      static_cast<id<ApplicationCommands, BrowserCommands>>(self.dispatcher);
-  tableViewController.baseViewController = self.baseViewController;
-
-  self.mediator = [[PopupMenuMediator alloc]
-          initWithType:PopupMenuTypeTabGrid
-           isIncognito:self.browserState->IsOffTheRecord()
-      readingListModel:ReadingListModelFactory::GetForBrowserState(
-                           self.browserState)];
-  self.mediator.webStateList = self.webStateList;
-  self.mediator.popupMenu = tableViewController;
-
-  [self presentPopupForContent:tableViewController
-                        ofType:PopupMenuTypeTabGrid
-                fromNamedGuide:kTabSwitcherGuide];
+  [self presentPopupOfType:PopupMenuTypeTabGrid
+            fromNamedGuide:kTabSwitcherGuide];
 }
 
 - (void)searchButtonPopup {
   base::RecordAction(base::UserMetricsAction("MobileToolbarShowSearchMenu"));
-  UIViewController* viewController = [[UIViewController alloc] init];
-  UILabel* label = [[UILabel alloc] init];
-  label.text = @"Search";
-  viewController.view = label;
-  // TODO(crbug.com/821560): Use the search menu instead of a label.
-  [self presentPopupForContent:viewController
-                        ofType:PopupMenuTypeSearch
-                fromNamedGuide:nil];
+  [self presentPopupOfType:PopupMenuTypeSearch fromNamedGuide:nil];
 }
 
 - (void)dismissPopupMenu {
@@ -160,6 +117,24 @@
   self.mediator = nil;
 }
 
+#pragma mark - ContainedPresenterDelegate
+
+- (void)containedPresenterDidPresent:(id<ContainedPresenter>)presenter {
+  DCHECK(presenter == self.presenter);
+  if (self.requestStartTime != 0) {
+    base::TimeDelta elapsed = base::TimeDelta::FromSecondsD(
+        [NSDate timeIntervalSinceReferenceDate] - self.requestStartTime);
+    UMA_HISTOGRAM_TIMES("Toolbar.ShowToolsMenuResponsiveness", elapsed);
+    // Reset the start time to ensure that whatever happens, we only record
+    // this once.
+    self.requestStartTime = 0;
+  }
+}
+
+- (void)containedPresenterDidDismiss:(id<ContainedPresenter>)presenter {
+  DCHECK(presenter == self.presenter);
+}
+
 #pragma mark - Notification callback
 
 - (void)applicationDidEnterBackground:(NSNotification*)note {
@@ -168,22 +143,42 @@
 
 #pragma mark - Private
 
-// Presents the |content| of type |type| with an animation starting from
+// Presents a popup menu of type |type| with an animation starting from
 // |guideName|.
-- (void)presentPopupForContent:(UIViewController*)content
-                        ofType:(PopupMenuType)type
-                fromNamedGuide:(GuideName*)guideName {
+- (void)presentPopupOfType:(PopupMenuType)type
+            fromNamedGuide:(GuideName*)guideName {
   DCHECK(!self.presenter);
   id<BrowserCommands> callableDispatcher =
       static_cast<id<BrowserCommands>>(self.dispatcher);
   [callableDispatcher
       prepareForPopupMenuPresentation:CommandTypeFromPopupType(type)];
 
+  self.requestStartTime = [NSDate timeIntervalSinceReferenceDate];
+
+  PopupMenuTableViewController* tableViewController =
+      [[PopupMenuTableViewController alloc]
+          initWithStyle:UITableViewStyleGrouped];
+  tableViewController.dispatcher =
+      static_cast<id<ApplicationCommands, BrowserCommands>>(self.dispatcher);
+  tableViewController.baseViewController = self.baseViewController;
+
+  self.mediator = [[PopupMenuMediator alloc]
+          initWithType:type
+           isIncognito:self.browserState->IsOffTheRecord()
+      readingListModel:ReadingListModelFactory::GetForBrowserState(
+                           self.browserState)];
+  self.mediator.engagementTracker =
+      feature_engagement::TrackerFactory::GetForBrowserState(self.browserState);
+  self.mediator.webStateList = self.webStateList;
+  self.mediator.popupMenu = tableViewController;
+  self.mediator.dispatcher = static_cast<id<BrowserCommands>>(self.dispatcher);
+
   self.presenter = [[PopupMenuPresenter alloc] init];
   self.presenter.baseViewController = self.baseViewController;
   self.presenter.commandHandler = self;
-  self.presenter.presentedViewController = content;
+  self.presenter.presentedViewController = tableViewController;
   self.presenter.guideName = guideName;
+  self.presenter.delegate = self;
 
   [self.presenter prepareForPresentation];
   [self.presenter presentAnimated:YES];
diff --git a/ios/chrome/browser/ui/popup_menu/popup_menu_mediator.h b/ios/chrome/browser/ui/popup_menu/popup_menu_mediator.h
index 891de58..195fe27 100644
--- a/ios/chrome/browser/ui/popup_menu/popup_menu_mediator.h
+++ b/ios/chrome/browser/ui/popup_menu/popup_menu_mediator.h
@@ -7,6 +7,9 @@
 
 #import <UIKit/UIKit.h>
 
+namespace feature_engagement {
+class Tracker;
+}
 @protocol BrowserCommands;
 @class PopupMenuTableViewController;
 class ReadingListModel;
@@ -38,6 +41,10 @@
 @property(nonatomic, strong) PopupMenuTableViewController* popupMenu;
 // Dispatcher.
 @property(nonatomic, weak) id<BrowserCommands> dispatcher;
+// Records events for the use of in-product help. The mediator does not take
+// ownership of tracker. Tracker must not be destroyed during lifetime of the
+// object.
+@property(nonatomic, assign) feature_engagement::Tracker* engagementTracker;
 
 // Disconnect the mediator.
 - (void)disconnect;
diff --git a/ios/chrome/browser/ui/popup_menu/popup_menu_mediator.mm b/ios/chrome/browser/ui/popup_menu/popup_menu_mediator.mm
index 7245bb2..602ddd51 100644
--- a/ios/chrome/browser/ui/popup_menu/popup_menu_mediator.mm
+++ b/ios/chrome/browser/ui/popup_menu/popup_menu_mediator.mm
@@ -5,11 +5,14 @@
 #import "ios/chrome/browser/ui/popup_menu/popup_menu_mediator.h"
 
 #include "base/strings/sys_string_conversions.h"
+#include "components/feature_engagement/public/feature_constants.h"
+#include "components/feature_engagement/public/tracker.h"
 #import "ios/chrome/browser/find_in_page/find_tab_helper.h"
 #import "ios/chrome/browser/ui/activity_services/canonical_url_retriever.h"
 #import "ios/chrome/browser/ui/commands/browser_commands.h"
 #import "ios/chrome/browser/ui/commands/reading_list_add_command.h"
 #import "ios/chrome/browser/ui/popup_menu/cells/popup_menu_item.h"
+#import "ios/chrome/browser/ui/popup_menu/cells/popup_menu_navigation_item.h"
 #import "ios/chrome/browser/ui/popup_menu/cells/popup_menu_tools_item.h"
 #import "ios/chrome/browser/ui/popup_menu/popup_menu_table_view_controller.h"
 #import "ios/chrome/browser/ui/reading_list/reading_list_menu_notification_delegate.h"
@@ -21,13 +24,16 @@
 #include "ios/chrome/grit/ios_strings.h"
 #include "ios/public/provider/chrome/browser/chrome_browser_provider.h"
 #import "ios/public/provider/chrome/browser/user_feedback/user_feedback_provider.h"
+#include "ios/web/public/favicon_status.h"
 #import "ios/web/public/navigation_item.h"
 #import "ios/web/public/navigation_manager.h"
+#include "ios/web/public/navigation_manager.h"
 #include "ios/web/public/user_agent.h"
 #include "ios/web/public/web_client.h"
 #include "ios/web/public/web_state/web_state.h"
 #import "ios/web/public/web_state/web_state_observer_bridge.h"
 #include "ui/base/l10n/l10n_util.h"
+#include "ui/gfx/image/image.h"
 
 #if !defined(__has_feature) || !__has_feature(objc_arc)
 #error "This file requires ARC support."
@@ -93,6 +99,7 @@
 @synthesize isIncognito = _isIncognito;
 @synthesize popupMenu = _popupMenu;
 @synthesize dispatcher = _dispatcher;
+@synthesize engagementTracker = _engagementTracker;
 @synthesize readingListMenuNotifier = _readingListMenuNotifier;
 @synthesize type = _type;
 @synthesize webState = _webState;
@@ -133,6 +140,16 @@
     _webStateObserver.reset();
     _webState = nullptr;
   }
+
+  if (_engagementTracker &&
+      _engagementTracker->ShouldTriggerHelpUI(
+          feature_engagement::kIPHBadgedReadingListFeature)) {
+    _engagementTracker->Dismissed(
+        feature_engagement::kIPHBadgedReadingListFeature);
+    _engagementTracker = nullptr;
+  }
+
+  _readingListMenuNotifier = nil;
 }
 
 #pragma mark - CRWWebStateObserver
@@ -243,6 +260,18 @@
   }
 }
 
+- (void)setEngagementTracker:(feature_engagement::Tracker*)engagementTracker {
+  _engagementTracker = engagementTracker;
+
+  if (self.popupMenu && self.readingList && engagementTracker &&
+      self.engagementTracker->ShouldTriggerHelpUI(
+          feature_engagement::kIPHBadgedReadingListFeature)) {
+    self.readingList.badgeText = l10n_util::GetNSStringWithFixup(
+        IDS_IOS_READING_LIST_CELL_NEW_FEATURE_BADGE);
+    [self.popupMenu reconfigureCellsForItems:@[ self.readingList ]];
+  }
+}
+
 - (NSArray<NSArray<TableViewItem<PopupMenuItem>*>*>*)items {
   if (!_items) {
     switch (self.type) {
@@ -250,8 +279,10 @@
         [self createToolsMenuItems];
         break;
       case PopupMenuTypeNavigationForward:
+        [self createNavigationItemsForType:PopupMenuTypeNavigationForward];
         break;
       case PopupMenuTypeNavigationBackward:
+        [self createNavigationItemsForType:PopupMenuTypeNavigationBackward];
         break;
       case PopupMenuTypeTabGrid:
         [self createTabGridMenuItems];
@@ -365,6 +396,34 @@
 
 #pragma mark - Item creation (Private)
 
+- (void)createNavigationItemsForType:(PopupMenuType)type {
+  DCHECK(type == PopupMenuTypeNavigationForward ||
+         type == PopupMenuTypeNavigationBackward);
+  if (!self.webState)
+    return;
+
+  web::NavigationManager* navigationManager =
+      self.webState->GetNavigationManager();
+  std::vector<web::NavigationItem*> navigationItems;
+  if (type == PopupMenuTypeNavigationForward) {
+    navigationItems = navigationManager->GetForwardItems();
+  } else {
+    navigationItems = navigationManager->GetBackwardItems();
+  }
+  NSMutableArray* items = [NSMutableArray array];
+  for (web::NavigationItem* navigationItem : navigationItems) {
+    PopupMenuNavigationItem* item =
+        [[PopupMenuNavigationItem alloc] initWithType:kItemTypeEnumZero];
+    item.title = base::SysUTF16ToNSString(navigationItem->GetTitleForDisplay());
+    const gfx::Image& image = navigationItem->GetFavicon().image;
+    if (!image.IsEmpty())
+      item.favicon = image.ToUIImage();
+    [items addObject:item];
+  }
+
+  self.items = @[ items ];
+}
+
 // Creates the menu items for the tab grid menu.
 - (void)createTabGridMenuItems {
   NSMutableArray* items = [NSMutableArray arrayWithArray:[self itemsForNewTab]];
@@ -481,6 +540,13 @@
       @"popup_menu_reading_list", kToolsMenuReadingListId);
   self.readingList.badgeNumber =
       [self.readingListMenuNotifier readingListUnreadCount];
+  if (self.engagementTracker &&
+      self.engagementTracker->ShouldTriggerHelpUI(
+          feature_engagement::kIPHBadgedReadingListFeature)) {
+    self.readingList.badgeText = l10n_util::GetNSStringWithFixup(
+        IDS_IOS_READING_LIST_CELL_NEW_FEATURE_BADGE);
+  }
+
   // TODO(crbug.com/828367): Once the "unseen items effect" is defined,
   // implement it.
 
diff --git a/ios/chrome/browser/ui/popup_menu/popup_menu_mediator_unittest.mm b/ios/chrome/browser/ui/popup_menu/popup_menu_mediator_unittest.mm
index bd2d398e..15cb114 100644
--- a/ios/chrome/browser/ui/popup_menu/popup_menu_mediator_unittest.mm
+++ b/ios/chrome/browser/ui/popup_menu/popup_menu_mediator_unittest.mm
@@ -4,6 +4,7 @@
 
 #import "ios/chrome/browser/ui/popup_menu/popup_menu_mediator.h"
 #include "base/time/default_clock.h"
+#include "components/feature_engagement/test/mock_tracker.h"
 #include "components/reading_list/core/reading_list_model_impl.h"
 #import "ios/chrome/browser/ui/popup_menu/popup_menu_table_view_controller.h"
 #import "ios/chrome/browser/ui/toolbar/test/toolbar_test_navigation_manager.h"
@@ -17,6 +18,7 @@
 #import "ios/web/public/test/fakes/test_web_state.h"
 #include "ios/web/public/test/test_web_thread_bundle.h"
 #import "ios/web/public/web_state/web_state_observer_bridge.h"
+#include "testing/gmock/include/gmock/gmock.h"
 #include "testing/platform_test.h"
 #import "third_party/ocmock/OCMock/OCMock.h"
 #include "third_party/ocmock/gtest_support.h"
@@ -45,7 +47,7 @@
         [[PopupMenuMediator alloc] initWithType:PopupMenuTypeToolsMenu
                                     isIncognito:YES
                                readingListModel:reading_list_model_.get()];
-    mediator_non_incognito_ =
+    mediator_ =
         [[PopupMenuMediator alloc] initWithType:PopupMenuTypeToolsMenu
                                     isIncognito:NO
                                readingListModel:reading_list_model_.get()];
@@ -61,7 +63,7 @@
   // observers when web_state_list_ gets dealloc.
   ~PopupMenuMediatorTest() override {
     [mediator_incognito_ disconnect];
-    [mediator_non_incognito_ disconnect];
+    [mediator_ disconnect];
   }
 
  protected:
@@ -96,7 +98,7 @@
   void SetUpActiveWebState() { web_state_list_->ActivateWebStateAt(0); }
 
   PopupMenuMediator* mediator_incognito_;
-  PopupMenuMediator* mediator_non_incognito_;
+  PopupMenuMediator* mediator_;
   std::unique_ptr<ReadingListModelImpl> reading_list_model_;
   ToolbarTestWebState* web_state_;
   ToolbarTestNavigationManager* navigation_manager_;
@@ -106,3 +108,16 @@
   // Mock refusing all calls except -setPopupMenuItems:.
   id popup_menu_strict_;
 };
+
+// Tests that the feature engagement tracker get notified when the mediator is
+// disconnected and the tracker wants the notification badge displayed.
+TEST_F(PopupMenuMediatorTest, TestFeatureEngagementDisconnect) {
+  feature_engagement::test::MockTracker tracker;
+  EXPECT_CALL(tracker, ShouldTriggerHelpUI(testing::_))
+      .WillRepeatedly(testing::Return(true));
+  mediator_.popupMenu = popup_menu_;
+  mediator_.engagementTracker = &tracker;
+
+  EXPECT_CALL(tracker, Dismissed(testing::_));
+  [mediator_ disconnect];
+}
diff --git a/ios/chrome/browser/ui/popup_menu/popup_menu_presenter.mm b/ios/chrome/browser/ui/popup_menu/popup_menu_presenter.mm
index 41d4db6..0cd8077d 100644
--- a/ios/chrome/browser/ui/popup_menu/popup_menu_presenter.mm
+++ b/ios/chrome/browser/ui/popup_menu/popup_menu_presenter.mm
@@ -133,7 +133,9 @@
     self.popupViewController.contentContainer.transform =
         CGAffineTransformIdentity;
   }
-      withCompletion:nil];
+      withCompletion:^(BOOL finished) {
+        [self.delegate containedPresenterDidPresent:self];
+      }];
 }
 
 - (void)dismissAnimated:(BOOL)animated {
diff --git a/ios/chrome/browser/ui/presenters/contained_presenter_delegate.h b/ios/chrome/browser/ui/presenters/contained_presenter_delegate.h
index c6effe2..edf5a15 100644
--- a/ios/chrome/browser/ui/presenters/contained_presenter_delegate.h
+++ b/ios/chrome/browser/ui/presenters/contained_presenter_delegate.h
@@ -13,6 +13,8 @@
 // and which is informed about dismissal events.
 @protocol ContainedPresenterDelegate
 
+- (void)containedPresenterDidPresent:(id<ContainedPresenter>)presenter;
+
 // Tells the delegate that |presenter| has finished dismissing.
 - (void)containedPresenterDidDismiss:(id<ContainedPresenter>)presenter;
 
diff --git a/ios/chrome/browser/ui/presenters/vertical_animation_container.mm b/ios/chrome/browser/ui/presenters/vertical_animation_container.mm
index 28be182..6006638 100644
--- a/ios/chrome/browser/ui/presenters/vertical_animation_container.mm
+++ b/ios/chrome/browser/ui/presenters/vertical_animation_container.mm
@@ -81,14 +81,23 @@
   if (self.presentedConstraints[0].active)
     return;
 
-  [UIView animateWithDuration:animated ? kAnimationDuration : 0.0
-                   animations:^{
-                     [NSLayoutConstraint
-                         deactivateConstraints:self.dismissedConstraints];
-                     [NSLayoutConstraint
-                         activateConstraints:self.presentedConstraints];
-                     [self.baseViewController.view layoutIfNeeded];
-                   }];
+  auto animations = ^{
+    [NSLayoutConstraint deactivateConstraints:self.dismissedConstraints];
+    [NSLayoutConstraint activateConstraints:self.presentedConstraints];
+    [self.baseViewController.view layoutIfNeeded];
+  };
+  auto completion = ^(BOOL finished) {
+    [self.delegate containedPresenterDidPresent:self];
+  };
+
+  if (animated) {
+    [UIView animateWithDuration:kAnimationDuration
+                     animations:animations
+                     completion:completion];
+  } else {
+    animations();
+    completion(YES);
+  }
 }
 
 - (void)dismissAnimated:(BOOL)animated {
@@ -100,12 +109,12 @@
   if (self.dismissedConstraints[0].active)
     return;
 
-  void (^animations)() = ^{
+  auto animations = ^{
     [NSLayoutConstraint deactivateConstraints:self.presentedConstraints];
     [NSLayoutConstraint activateConstraints:self.dismissedConstraints];
     [self.baseViewController.view layoutIfNeeded];
   };
-  void (^completion)(BOOL) = ^(BOOL finished) {
+  auto completion = ^(BOOL finished) {
     [self cleanUpAfterDismissal];
     [self.delegate containedPresenterDidDismiss:self];
   };
diff --git a/ios/chrome/browser/ui/presenters/vertical_animation_container_unittest.mm b/ios/chrome/browser/ui/presenters/vertical_animation_container_unittest.mm
index 69243e6..04900179 100644
--- a/ios/chrome/browser/ui/presenters/vertical_animation_container_unittest.mm
+++ b/ios/chrome/browser/ui/presenters/vertical_animation_container_unittest.mm
@@ -13,14 +13,21 @@
 #error "This file requires ARC support."
 #endif
 
-// Test delegate helper; the delegate callback sets the |dismissed| property.
+// Test delegate helper; the delegate callback sets the |presented| and
+// |dismissed| property.
 @interface TestContainedPresenterDelegate : NSObject<ContainedPresenterDelegate>
+@property(nonatomic) BOOL presented;
 @property(nonatomic) BOOL dismissed;
 @end
 
 @implementation TestContainedPresenterDelegate
+@synthesize presented = _presented;
 @synthesize dismissed = _dismissed;
 
+- (void)containedPresenterDidPresent:(id<ContainedPresenter>)presenter {
+  self.presented = YES;
+}
+
 - (void)containedPresenterDidDismiss:(id<ContainedPresenter>)presenter {
   self.dismissed = YES;
 }
@@ -65,6 +72,9 @@
   EXPECT_EQ(base_view_width, CGRectGetWidth(presented_.view.bounds));
   EXPECT_EQ(presented_.view.frame.origin.x, 0);
   EXPECT_GE(presented_.view.frame.origin.y, base_.view.bounds.size.height);
+
+  // The presentation did not finish yet.
+  EXPECT_FALSE(delegate_.presented);
 }
 
 TEST_F(VerticalAnimationContainerTest, TestPresentation) {
@@ -76,6 +86,7 @@
   EXPECT_TRUE(CGRectContainsRect(base_.view.bounds, presented_.view.frame));
   EXPECT_EQ(CGRectGetMaxY(base_.view.bounds),
             CGRectGetMaxY(presented_.view.frame));
+  EXPECT_TRUE(delegate_.presented);
   // The delegate method should not be called here.
   EXPECT_FALSE(delegate_.dismissed);
 }
diff --git a/ios/chrome/browser/ui/toolbar/adaptive/adaptive_toolbar_view_controller.mm b/ios/chrome/browser/ui/toolbar/adaptive/adaptive_toolbar_view_controller.mm
index 4b07c33..92b37ced 100644
--- a/ios/chrome/browser/ui/toolbar/adaptive/adaptive_toolbar_view_controller.mm
+++ b/ios/chrome/browser/ui/toolbar/adaptive/adaptive_toolbar_view_controller.mm
@@ -262,18 +262,10 @@
     return;
 
   if (gesture.view == self.view.backButton) {
-    if (base::FeatureList::IsEnabled(kNewToolsMenu)) {
-      [self.dispatcher showNavigationHistoryBackPopupMenu];
-    } else {
-      [self.dispatcher showTabHistoryPopupForBackwardHistory];
-    }
+    [self.dispatcher showNavigationHistoryBackPopupMenu];
   } else if (gesture.view == self.view.forwardButton ||
              gesture.view == self.view.forwardButtonTrailingPosition) {
-    if (base::FeatureList::IsEnabled(kNewToolsMenu)) {
-      [self.dispatcher showNavigationHistoryForwardPopupMenu];
-    } else {
-      [self.dispatcher showTabHistoryPopupForForwardHistory];
-    }
+    [self.dispatcher showNavigationHistoryForwardPopupMenu];
   } else if (gesture.view == self.view.tabGridButton) {
     [self.dispatcher showTabGridButtonPopup];
   }
diff --git a/ios/chrome/browser/ui/translate/language_selection_coordinator.mm b/ios/chrome/browser/ui/translate/language_selection_coordinator.mm
index 657cd51..491fac7 100644
--- a/ios/chrome/browser/ui/translate/language_selection_coordinator.mm
+++ b/ios/chrome/browser/ui/translate/language_selection_coordinator.mm
@@ -125,6 +125,10 @@
 
 #pragma mark - ContainedPresenterDelegate
 
+- (void)containedPresenterDidPresent:(id<ContainedPresenter>)presenter {
+  DCHECK(presenter == self.presenter);
+}
+
 - (void)containedPresenterDidDismiss:(id<ContainedPresenter>)presenter {
   DCHECK(presenter == self.presenter);
   [self stop];
diff --git a/media/audio/audio_input_controller.cc b/media/audio/audio_input_controller.cc
index 09ddc479..1de2298 100644
--- a/media/audio/audio_input_controller.cc
+++ b/media/audio/audio_input_controller.cc
@@ -209,6 +209,8 @@
   DCHECK(sync_writer);
   DCHECK(event_handler);
 
+  // TODO(https://crbug.com/803102): remove check after switching to input
+  // stream factory.
   if (!params.IsValid() || (params.channels() > kMaxInputChannels))
     return nullptr;
 
@@ -231,13 +233,10 @@
 
   // Create and open a new audio input stream from the existing
   // audio-device thread. Use the provided audio-input device.
-  if (!controller->task_runner_->PostTask(
-          FROM_HERE, base::BindOnce(&AudioInputController::DoCreate, controller,
-                                    base::Unretained(audio_manager), params,
-                                    device_id, enable_agc))) {
-    controller = nullptr;
-  }
-
+  controller->task_runner_->PostTask(
+      FROM_HERE, base::BindOnce(&AudioInputController::DoCreate, controller,
+                                base::Unretained(audio_manager), params,
+                                device_id, enable_agc));
   return controller;
 }
 
@@ -271,13 +270,9 @@
     return controller;
   }
 
-  if (!controller->task_runner_->PostTask(
-          FROM_HERE,
-          base::BindOnce(&AudioInputController::DoCreateForStream, controller,
-                         stream, false /*enable_agc*/))) {
-    controller = nullptr;
-  }
-
+  controller->task_runner_->PostTask(
+      FROM_HERE, base::BindOnce(&AudioInputController::DoCreateForStream,
+                                controller, stream, false /*enable_agc*/));
   return controller;
 }
 
diff --git a/media/blink/webmediaplayer_impl.cc b/media/blink/webmediaplayer_impl.cc
index 4405bb7..309b9e2 100644
--- a/media/blink/webmediaplayer_impl.cc
+++ b/media/blink/webmediaplayer_impl.cc
@@ -236,7 +236,8 @@
       request_routing_token_cb_(params->request_routing_token_cb()),
       overlay_routing_token_(OverlayInfo::RoutingToken()),
       media_metrics_provider_(params->take_metrics_provider()),
-      pip_surface_info_cb_(params->pip_surface_info_cb()) {
+      pip_surface_info_cb_(params->pip_surface_info_cb()),
+      exit_pip_cb_(params->exit_pip_cb()) {
   DVLOG(1) << __func__;
   DCHECK(!adjust_allocated_memory_cb_.is_null());
   DCHECK(renderer_factory_selector_);
@@ -318,7 +319,7 @@
   client_->MediaRemotingStopped(
       blink::WebLocalizedString::kMediaRemotingStopNoText);
 
-  client_->PictureInPictureStopped();
+  ExitPictureInPicture();
 
   if (!surface_layer_for_video_enabled_ && video_weblayer_) {
     static_cast<cc::VideoLayer*>(video_weblayer_->layer())->StopUsingProvider();
@@ -790,6 +791,7 @@
 }
 
 void WebMediaPlayerImpl::ExitPictureInPicture() {
+  LOG(ERROR) << "WebMediaPlayerImpl::ExitPictureInPicture";
   // TODO(apacible): Handle ending PiP from a user gesture. This currently
   // handles ending Picture-in-Picture mode from the source.
   // https://crbug.com/823172.
@@ -799,10 +801,8 @@
   if (!pip_surface_id_.is_valid())
     return;
 
-  // Clears the Picture-in-Picture viz::SurfaceId. The default SurfaceId is not
-  // considered valid as both its FrameSinkId and LocalSurfaceId do not have
-  // have valid values.
-  pip_surface_info_cb_.Run(viz::SurfaceId());
+  // Signals that Picture-in-Picture has ended.
+  exit_pip_cb_.Run();
 
   // Updates the MediaWebContentsObserver with |delegate_id_| to clear the
   // tracked media player that is in Picture-in-Picture mode.
diff --git a/media/blink/webmediaplayer_impl.h b/media/blink/webmediaplayer_impl.h
index 7c85f49..df6744aa 100644
--- a/media/blink/webmediaplayer_impl.h
+++ b/media/blink/webmediaplayer_impl.h
@@ -903,6 +903,9 @@
   // Callback to pass updated information about the current surface info.
   WebMediaPlayerParams::PipSurfaceInfoCB pip_surface_info_cb_;
 
+  // Callback to signal Picture-in-Picture mode has ended.
+  WebMediaPlayerParams::ExitPipCB exit_pip_cb_;
+
   DISALLOW_COPY_AND_ASSIGN(WebMediaPlayerImpl);
 };
 
diff --git a/media/blink/webmediaplayer_impl_unittest.cc b/media/blink/webmediaplayer_impl_unittest.cc
index 722e9de..12e69f63 100644
--- a/media/blink/webmediaplayer_impl_unittest.cc
+++ b/media/blink/webmediaplayer_impl_unittest.cc
@@ -318,7 +318,8 @@
                    base::Unretained(this)),
         viz::TestContextProvider::Create(),
         base::FeatureList::IsEnabled(media::kUseSurfaceLayerForVideo),
-        base::BindRepeating(pip_surface_info_cb_.Get()));
+        base::BindRepeating(pip_surface_info_cb_.Get()),
+        base::BindRepeating(exit_pip_cb_.Get()));
 
     auto compositor = std::make_unique<StrictMock<MockVideoFrameCompositor>>(
         params->video_frame_compositor_task_runner());
@@ -333,7 +334,6 @@
   ~WebMediaPlayerImplTest() override {
     EXPECT_CALL(client_, SetWebLayer(nullptr));
     EXPECT_CALL(client_, MediaRemotingStopped(_));
-    EXPECT_CALL(client_, PictureInPictureStopped());
     // Destruct WebMediaPlayerImpl and pump the message loop to ensure that
     // objects passed to the message loop for destruction are released.
     //
@@ -551,6 +551,8 @@
   base::MockCallback<WebMediaPlayerParams::PipSurfaceInfoCB>
       pip_surface_info_cb_;
 
+  base::MockCallback<WebMediaPlayerParams::ExitPipCB> exit_pip_cb_;
+
  private:
   DISALLOW_COPY_AND_ASSIGN(WebMediaPlayerImplTest);
 };
@@ -1143,10 +1145,9 @@
   testing::Mock::VerifyAndClearExpectations(&client_);
 
   // Upon exiting Picture-in-Picture mode, functions to cleanup are expected to
-  // be called.
-  EXPECT_CALL(pip_surface_info_cb_, Run(viz::SurfaceId()));
+  // be called. ~WMPI calls ExitPictureInPicture().
+  EXPECT_CALL(exit_pip_cb_, Run());
   EXPECT_CALL(delegate_, DidPictureInPictureModeEnd(delegate_.player_id()));
-  wmpi_->ExitPictureInPicture();
 }
 
 class WebMediaPlayerImplBackgroundBehaviorTest
diff --git a/media/blink/webmediaplayer_params.cc b/media/blink/webmediaplayer_params.cc
index b1c7a46..8c289832 100644
--- a/media/blink/webmediaplayer_params.cc
+++ b/media/blink/webmediaplayer_params.cc
@@ -33,7 +33,8 @@
         blink::WebSurfaceLayerBridgeObserver*)> create_bridge_callback,
     scoped_refptr<viz::ContextProvider> context_provider,
     bool use_surface_layer_for_video,
-    const PipSurfaceInfoCB& pip_surface_info_cb)
+    const PipSurfaceInfoCB& pip_surface_info_cb,
+    const ExitPipCB& exit_pip_cb)
     : defer_load_cb_(defer_load_cb),
       audio_renderer_sink_(audio_renderer_sink),
       media_log_(std::move(media_log)),
@@ -56,7 +57,8 @@
       create_bridge_callback_(create_bridge_callback),
       context_provider_(std::move(context_provider)),
       use_surface_layer_for_video_(use_surface_layer_for_video),
-      pip_surface_info_cb_(pip_surface_info_cb) {}
+      pip_surface_info_cb_(pip_surface_info_cb),
+      exit_pip_cb_(exit_pip_cb) {}
 
 WebMediaPlayerParams::~WebMediaPlayerParams() = default;
 
diff --git a/media/blink/webmediaplayer_params.h b/media/blink/webmediaplayer_params.h
index b8dee91..502b8701 100644
--- a/media/blink/webmediaplayer_params.h
+++ b/media/blink/webmediaplayer_params.h
@@ -55,6 +55,9 @@
   using PipSurfaceInfoCB =
       base::RepeatingCallback<void(const viz::SurfaceId& surface_id)>;
 
+  // Callback to exit Picture-in-Picture.
+  using ExitPipCB = base::RepeatingCallback<void()>;
+
   // Callback to obtain the media ContextProvider.
   // Requires being called on the media thread.
   // The argument callback is also called on the media thread as a reply.
@@ -93,7 +96,8 @@
           blink::WebSurfaceLayerBridgeObserver*)> bridge_callback,
       scoped_refptr<viz::ContextProvider> context_provider,
       bool use_surface_layer_for_video,
-      const PipSurfaceInfoCB& surface_info_cb);
+      const PipSurfaceInfoCB& surface_info_cb,
+      const ExitPipCB& exit_pip_cb);
 
   ~WebMediaPlayerParams();
 
@@ -180,6 +184,8 @@
     return pip_surface_info_cb_;
   }
 
+  const ExitPipCB exit_pip_cb() const { return exit_pip_cb_; }
+
  private:
   DeferLoadCB defer_load_cb_;
   scoped_refptr<SwitchableAudioRendererSink> audio_renderer_sink_;
@@ -206,6 +212,7 @@
   scoped_refptr<viz::ContextProvider> context_provider_;
   bool use_surface_layer_for_video_;
   PipSurfaceInfoCB pip_surface_info_cb_;
+  ExitPipCB exit_pip_cb_;
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(WebMediaPlayerParams);
 };
diff --git a/media/cdm/cdm_adapter.cc b/media/cdm/cdm_adapter.cc
index d4ed741..866f37d8 100644
--- a/media/cdm/cdm_adapter.cc
+++ b/media/cdm/cdm_adapter.cc
@@ -878,6 +878,12 @@
 
   scoped_refptr<VideoFrame> decoded_frame =
       video_frame->TransformToVideoFrame(natural_size_);
+  if (!decoded_frame) {
+    DLOG(ERROR) << __func__ << ": TransformToVideoFrame failed.";
+    video_decode_cb.Run(Decryptor::kError, nullptr);
+    return;
+  }
+
   video_decode_cb.Run(Decryptor::kSuccess, decoded_frame);
 }
 
diff --git a/media/filters/decrypting_video_decoder.cc b/media/filters/decrypting_video_decoder.cc
index fb9da30a..2721421f 100644
--- a/media/filters/decrypting_video_decoder.cc
+++ b/media/filters/decrypting_video_decoder.cc
@@ -294,6 +294,8 @@
   }
 
   DCHECK_EQ(status, Decryptor::kSuccess);
+  CHECK(frame);
+
   // Frame returned with kSuccess should not be an end-of-stream frame.
   DCHECK(!frame->metadata()->IsTrue(VideoFrameMetadata::END_OF_STREAM));
 
diff --git a/media/mojo/common/mojo_shared_buffer_video_frame.cc b/media/mojo/common/mojo_shared_buffer_video_frame.cc
index 1772059..9698d29 100644
--- a/media/mojo/common/mojo_shared_buffer_video_frame.cc
+++ b/media/mojo/common/mojo_shared_buffer_video_frame.cc
@@ -36,8 +36,10 @@
   const size_t allocation_size = VideoFrame::AllocationSize(format, coded_size);
   mojo::ScopedSharedBufferHandle handle =
       mojo::SharedBufferHandle::Create(allocation_size);
-  if (!handle.is_valid())
+  if (!handle.is_valid()) {
+    DLOG(ERROR) << __func__ << " Unable to allocate memory.";
     return nullptr;
+  }
 
   // Create and initialize the frame. As this is I420 format, the U and V
   // planes have samples for each 2x2 block. The memory is laid out as follows:
@@ -125,8 +127,11 @@
       new MojoSharedBufferVideoFrame(format, coded_size, visible_rect,
                                      natural_size, std::move(handle), data_size,
                                      timestamp));
-  if (!frame->Init(y_stride, u_stride, v_stride, y_offset, u_offset, v_offset))
+  if (!frame->Init(y_stride, u_stride, v_stride, y_offset, u_offset,
+                   v_offset)) {
+    DLOG(ERROR) << __func__ << " MojoSharedBufferVideoFrame::Init failed.";
     return nullptr;
+  }
 
   return frame;
 }
diff --git a/media/mojo/interfaces/video_frame_struct_traits.cc b/media/mojo/interfaces/video_frame_struct_traits.cc
index b6285b2..3317174 100644
--- a/media/mojo/interfaces/video_frame_struct_traits.cc
+++ b/media/mojo/interfaces/video_frame_struct_traits.cc
@@ -140,6 +140,9 @@
     return false;
   }
 
+  if (!frame)
+    return false;
+
   std::unique_ptr<base::DictionaryValue> metadata;
   if (!input.ReadMetadata(&metadata))
     return false;
diff --git a/media/mojo/services/BUILD.gn b/media/mojo/services/BUILD.gn
index 08261df..cae65b3 100644
--- a/media/mojo/services/BUILD.gn
+++ b/media/mojo/services/BUILD.gn
@@ -12,6 +12,7 @@
 component("services") {
   output_name = "media_mojo_services"
   sources = [
+    "deferred_destroy_strong_binding_set.h",
     "gpu_mojo_media_client.cc",
     "gpu_mojo_media_client.h",
     "interface_factory_impl.cc",
@@ -156,6 +157,7 @@
   testonly = true
 
   sources = [
+    "deferred_destroy_strong_binding_set_unittest.cc",
     "media_metrics_provider_unittest.cc",
     "mojo_audio_input_stream_unittest.cc",
     "mojo_audio_output_stream_provider_unittest.cc",
@@ -173,6 +175,7 @@
     "//media:test_support",
     "//media/mojo:test_support",
     "//mojo/edk",
+    "//mojo/public/interfaces/bindings/tests:test_interfaces",
     "//services/metrics/public/cpp:ukm_builders",
     "//testing/gmock",
     "//testing/gtest",
diff --git a/media/mojo/services/cdm_service.cc b/media/mojo/services/cdm_service.cc
index e70b74b..f9c20ca 100644
--- a/media/mojo/services/cdm_service.cc
+++ b/media/mojo/services/cdm_service.cc
@@ -58,7 +58,25 @@
   DISALLOW_COPY_AND_ASSIGN(DelayedReleaseServiceContextRef);
 };
 
-class CdmFactoryImpl : public mojom::CdmFactory {
+// Implementation of mojom::CdmFactory that creates and hosts MojoCdmServices
+// which then host CDMs created by the media::CdmFactory provided by the
+// CdmService::Client.
+//
+// Lifetime Note:
+// 1. CdmFactoryImpl instances are owned by a DeferredDestroyStrongBindingSet
+//    directly, which is owned by CdmService.
+// 2. Note that CdmFactoryImpl also holds a ServiceContextRef to the CdmService.
+// 3. CdmFactoryImpl is destroyed in any of the following two cases:
+//   - CdmService is destroyed. Because of (2) this should not happen except for
+//     during browser shutdown, when the ServiceContext could be destroyed
+//     directly which will then destroy CdmService, ignoring any outstanding
+//     ServiceContextRefs.
+//   - mojo::CdmFactory connection error happens, AND CdmFactoryImpl doesn't own
+//     any CDMs (|cdm_bindings_| is empty). This is to prevent destroying the
+//     CDMs too early (e.g. during page navigation) which could cause errors
+//     (session closed) on the client side. See https://crbug.com/821171 for
+//     details.
+class CdmFactoryImpl : public DeferredDestroy<mojom::CdmFactory> {
  public:
   CdmFactoryImpl(
       CdmService::Client* client,
@@ -69,6 +87,12 @@
         connection_ref_(std::make_unique<DelayedReleaseServiceContextRef>(
             std::move(connection_ref))) {
     DVLOG(1) << __func__;
+
+    // base::Unretained is safe because |cdm_bindings_| is owned by |this|. If
+    // |this| is destructed, |cdm_bindings_| will be destructed as well and the
+    // error handler should never be called.
+    cdm_bindings_.set_connection_error_handler(base::BindRepeating(
+        &CdmFactoryImpl::OnBindingConnectionError, base::Unretained(this)));
   }
 
   ~CdmFactoryImpl() final { DVLOG(1) << __func__; }
@@ -87,6 +111,14 @@
         std::move(request));
   }
 
+  // DeferredDestroy<mojom::CdmFactory> implemenation.
+  void OnDestroyPending(base::OnceClosure destroy_cb) final {
+    destroy_cb_ = std::move(destroy_cb);
+    if (cdm_bindings_.empty())
+      std::move(destroy_cb_).Run();
+    // else the callback will be called when |cdm_bindings_| become empty.
+  }
+
  private:
   media::CdmFactory* GetCdmFactory() {
     if (!cdm_factory_) {
@@ -96,6 +128,11 @@
     return cdm_factory_.get();
   }
 
+  void OnBindingConnectionError() {
+    if (destroy_cb_ && cdm_bindings_.empty())
+      std::move(destroy_cb_).Run();
+  }
+
   // Must be declared before the bindings below because the bound objects might
   // take a raw pointer of |cdm_service_context_| and assume it's always
   // available.
@@ -106,6 +143,7 @@
   mojo::StrongBindingSet<mojom::ContentDecryptionModule> cdm_bindings_;
   std::unique_ptr<DelayedReleaseServiceContextRef> connection_ref_;
   std::unique_ptr<media::CdmFactory> cdm_factory_;
+  base::OnceClosure destroy_cb_;
 
   DISALLOW_COPY_AND_ASSIGN(CdmFactoryImpl);
 };
diff --git a/media/mojo/services/cdm_service.h b/media/mojo/services/cdm_service.h
index d309aab..407f8329 100644
--- a/media/mojo/services/cdm_service.h
+++ b/media/mojo/services/cdm_service.h
@@ -11,9 +11,9 @@
 #include "media/media_buildflags.h"
 #include "media/mojo/interfaces/cdm_service.mojom.h"
 #include "media/mojo/interfaces/content_decryption_module.mojom.h"
+#include "media/mojo/services/deferred_destroy_strong_binding_set.h"
 #include "media/mojo/services/media_mojo_export.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
-#include "mojo/public/cpp/bindings/strong_binding_set.h"
 #include "services/service_manager/public/cpp/binder_registry.h"
 #include "services/service_manager/public/cpp/service.h"
 #include "services/service_manager/public/cpp/service_context_ref.h"
@@ -53,6 +53,14 @@
   explicit CdmService(std::unique_ptr<Client> client);
   ~CdmService() final;
 
+  size_t BoundCdmFactorySizeForTesting() const {
+    return cdm_factory_bindings_.size();
+  }
+
+  size_t UnboundCdmFactorySizeForTesting() const {
+    return cdm_factory_bindings_.unbound_size();
+  }
+
  private:
   // service_manager::Service implementation.
   void OnStart() final;
@@ -70,7 +78,6 @@
 #else
   void LoadCdm(const base::FilePath& cdm_path) final;
 #endif  // defined(OS_MACOSX)
-
   void CreateCdmFactory(
       mojom::CdmFactoryRequest request,
       service_manager::mojom::InterfaceProviderPtr host_interfaces) final;
@@ -78,7 +85,7 @@
   std::unique_ptr<service_manager::ServiceContextRefFactory> ref_factory_;
   std::unique_ptr<Client> client_;
   std::unique_ptr<CdmFactory> cdm_factory_;
-  mojo::StrongBindingSet<mojom::CdmFactory> cdm_factory_bindings_;
+  DeferredDestroyStrongBindingSet<mojom::CdmFactory> cdm_factory_bindings_;
   service_manager::BinderRegistry registry_;
   mojo::BindingSet<mojom::CdmService> bindings_;
 };
diff --git a/media/mojo/services/cdm_service_unittest.cc b/media/mojo/services/cdm_service_unittest.cc
index 4f1faeeb6..43c3a09 100644
--- a/media/mojo/services/cdm_service_unittest.cc
+++ b/media/mojo/services/cdm_service_unittest.cc
@@ -82,9 +82,13 @@
 
     auto mock_cdm_service_client = std::make_unique<MockCdmServiceClient>();
     mock_cdm_service_client_ = mock_cdm_service_client.get();
+
+    auto cdm_service =
+        std::make_unique<CdmService>(std::move(mock_cdm_service_client));
+    cdm_service_ = cdm_service.get();
+
     service_context_ = std::make_unique<service_manager::ServiceContext>(
-        std::make_unique<CdmService>(std::move(mock_cdm_service_client)),
-        std::move(request));
+        std::move(cdm_service), std::move(request));
   }
 
   void DestroyService() { service_context_.reset(); }
@@ -93,6 +97,8 @@
     return mock_cdm_service_client_;
   }
 
+  CdmService* cdm_service() { return cdm_service_; }
+
  private:
   void Create(service_manager::mojom::ServiceFactoryRequest request) {
     service_factory_bindings_.AddBinding(this, std::move(request));
@@ -102,7 +108,8 @@
   mojo::BindingSet<service_manager::mojom::ServiceFactory>
       service_factory_bindings_;
   std::unique_ptr<service_manager::ServiceContext> service_context_;
-  MockCdmServiceClient* mock_cdm_service_client_;
+  CdmService* cdm_service_ = nullptr;
+  MockCdmServiceClient* mock_cdm_service_client_ = nullptr;
 };
 
 }  // namespace
@@ -119,18 +126,19 @@
   void SetUp() override {
     ServiceTest::SetUp();
 
-    connector()->BindInterface(media::mojom::kCdmServiceName, &cdm_service_);
+    connector()->BindInterface(media::mojom::kCdmServiceName,
+                               &cdm_service_ptr_);
 
     service_manager::mojom::InterfaceProviderPtr interfaces;
     auto provider = std::make_unique<MediaInterfaceProvider>(
         mojo::MakeRequest(&interfaces));
 
-    ASSERT_FALSE(cdm_factory_);
-    cdm_service_->CreateCdmFactory(mojo::MakeRequest(&cdm_factory_),
-                                   std::move(interfaces));
-    cdm_service_.FlushForTesting();
-    ASSERT_TRUE(cdm_factory_);
-    cdm_factory_.set_connection_error_handler(base::BindRepeating(
+    ASSERT_FALSE(cdm_factory_ptr_);
+    cdm_service_ptr_->CreateCdmFactory(mojo::MakeRequest(&cdm_factory_ptr_),
+                                       std::move(interfaces));
+    cdm_service_ptr_.FlushForTesting();
+    ASSERT_TRUE(cdm_factory_ptr_);
+    cdm_factory_ptr_.set_connection_error_handler(base::BindRepeating(
         &CdmServiceTest::CdmFactoryConnectionClosed, base::Unretained(this)));
   }
 
@@ -145,15 +153,15 @@
 
   void InitializeCdm(const std::string& key_system, bool expected_result) {
     base::RunLoop run_loop;
-    cdm_factory_->CreateCdm(key_system, mojo::MakeRequest(&cdm_));
-    cdm_.set_connection_error_handler(base::BindRepeating(
+    cdm_factory_ptr_->CreateCdm(key_system, mojo::MakeRequest(&cdm_ptr_));
+    cdm_ptr_.set_connection_error_handler(base::BindRepeating(
         &CdmServiceTest::CdmConnectionClosed, base::Unretained(this)));
     EXPECT_CALL(*this, OnCdmInitializedInternal(expected_result))
         .WillOnce(InvokeWithoutArgs(&run_loop, &base::RunLoop::Quit));
-    cdm_->Initialize(key_system, url::Origin::Create(GURL(kSecurityOrigin)),
-                     CdmConfig(),
-                     base::BindRepeating(&CdmServiceTest::OnCdmInitialized,
-                                         base::Unretained(this)));
+    cdm_ptr_->Initialize(key_system, url::Origin::Create(GURL(kSecurityOrigin)),
+                         CdmConfig(),
+                         base::BindRepeating(&CdmServiceTest::OnCdmInitialized,
+                                             base::Unretained(this)));
     run_loop.Run();
   }
 
@@ -163,9 +171,9 @@
     return service_test_client;
   }
 
-  mojom::CdmServicePtr cdm_service_;
-  mojom::CdmFactoryPtr cdm_factory_;
-  mojom::ContentDecryptionModulePtr cdm_;
+  mojom::CdmServicePtr cdm_service_ptr_;
+  mojom::CdmFactoryPtr cdm_factory_ptr_;
+  mojom::ContentDecryptionModulePtr cdm_ptr_;
   ServiceTestClient* service_test_client_;
 
  private:
@@ -182,12 +190,12 @@
 
 #if defined(OS_MACOSX)
   // Token provider will not be used since the path is a dummy path.
-  cdm_service_->LoadCdm(cdm_path, nullptr);
+  cdm_service_ptr_->LoadCdm(cdm_path, nullptr);
 #else
-  cdm_service_->LoadCdm(cdm_path);
+  cdm_service_ptr_->LoadCdm(cdm_path);
 #endif
 
-  cdm_service_.FlushForTesting();
+  cdm_service_ptr_.FlushForTesting();
 }
 
 TEST_F(CdmServiceTest, InitializeCdm_Success) {
@@ -200,19 +208,28 @@
 
 TEST_F(CdmServiceTest, DestroyAndRecreateCdm) {
   InitializeCdm(kClearKeyKeySystem, true);
-  cdm_.reset();
+  cdm_ptr_.reset();
   InitializeCdm(kClearKeyKeySystem, true);
 }
 
-// CdmFactory connection error will destroy all CDMs.
+// CdmFactory connection error will NOT destroy CDMs. Instead, it will only be
+// destroyed after |cdm_| is reset.
 TEST_F(CdmServiceTest, DestroyCdmFactory) {
-  InitializeCdm(kClearKeyKeySystem, true);
+  auto* service = service_test_client_->cdm_service();
 
-  base::RunLoop run_loop;
-  EXPECT_CALL(*this, CdmConnectionClosed())
-      .WillOnce(Invoke(&run_loop, &base::RunLoop::Quit));
-  cdm_factory_.reset();
-  run_loop.Run();
+  InitializeCdm(kClearKeyKeySystem, true);
+  EXPECT_EQ(service->BoundCdmFactorySizeForTesting(), 1u);
+  EXPECT_EQ(service->UnboundCdmFactorySizeForTesting(), 0u);
+
+  cdm_factory_ptr_.reset();
+  base::RunLoop().RunUntilIdle();
+  EXPECT_EQ(service->BoundCdmFactorySizeForTesting(), 0u);
+  EXPECT_EQ(service->UnboundCdmFactorySizeForTesting(), 1u);
+
+  cdm_ptr_.reset();
+  base::RunLoop().RunUntilIdle();
+  EXPECT_EQ(service->BoundCdmFactorySizeForTesting(), 0u);
+  EXPECT_EQ(service->UnboundCdmFactorySizeForTesting(), 0u);
 }
 
 // Destroy service will destroy the CdmFactory and all CDMs.
diff --git a/media/mojo/services/deferred_destroy_strong_binding_set.h b/media/mojo/services/deferred_destroy_strong_binding_set.h
new file mode 100644
index 0000000..6c46af9
--- /dev/null
+++ b/media/mojo/services/deferred_destroy_strong_binding_set.h
@@ -0,0 +1,137 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MEDIA_MOJO_SERVICES_DEFERRED_DESTROY_STRONG_BINDING_SET_H_
+#define MEDIA_MOJO_SERVICES_DEFERRED_DESTROY_STRONG_BINDING_SET_H_
+
+#include <stdint.h>
+
+#include <map>
+#include <memory>
+
+#include "base/macros.h"
+#include "base/memory/ptr_util.h"
+#include "base/memory/weak_ptr.h"
+#include "media/base/bind_to_current_loop.h"
+#include "mojo/public/cpp/bindings/strong_binding_set.h"
+
+namespace media {
+
+// A class that can be deferred destroyed by its owner. For example, when used
+// in DeferredDestroyStrongBindingSet.
+template <typename Interface>
+class DeferredDestroy : public Interface {
+ public:
+  // Runs the |destroy_cb| to notify that it's okay to destroy |this|. The
+  // callback can be called synchronously. |this| will always be destroyed
+  // asynchronously after running |destroy_cb| to avoid reentrance issues.
+  virtual void OnDestroyPending(base::OnceClosure destroy_cb) = 0;
+};
+
+// Similar to mojo::StrongBindingSet, but provide a way to defer the destruction
+// of the interface implementation:
+// - When connection error happended on a binding, the binding is immediately
+// destroyed and removed from the set. The interface implementation will be
+// destroyed when the DestroyCallback is called.
+// - When the DeferredDestroyStrongBindingSet is destructed, all outstanding
+// bindings and interface implementations in the set are destroyed immediately
+// without any deferral.
+template <typename Interface>
+class DeferredDestroyStrongBindingSet {
+ public:
+  // Converts a delete callback to a deleter. If the callback is null or has
+  // been cancelled, callback bound with invalidated weak pointer, the pointer
+  // will be deleted with "delete" immediately.
+  class Deleter {
+   public:
+    using DeleteCallback =
+        base::RepeatingCallback<void(std::unique_ptr<Interface>)>;
+
+    Deleter() = default;
+    explicit Deleter(DeleteCallback delete_cb)
+        : delete_cb_(std::move(delete_cb)) {}
+
+    void operator()(Interface* p) {
+      // Immediately wrap |p| into a unique_ptr to avoid any potential leak.
+      auto ptr = base::WrapUnique<Interface>(p);
+
+      // Can be cancelled during DeferredDestroyStrongBindingSet destruction.
+      if (delete_cb_ && !delete_cb_.IsCancelled())
+        delete_cb_.Run(std::move(ptr));
+      else
+        ptr.reset();
+    }
+
+   private:
+    DeleteCallback delete_cb_;
+  };
+
+  DeferredDestroyStrongBindingSet() : weak_factory_(this) {}
+
+  void AddBinding(std::unique_ptr<DeferredDestroy<Interface>> impl,
+                  mojo::InterfaceRequest<Interface> request) {
+    // Wrap the pointer into a unique_ptr with a deleter.
+    Deleter deleter(
+        base::BindRepeating(&DeferredDestroyStrongBindingSet::OnBindingRemoved,
+                            weak_factory_.GetWeakPtr()));
+    std::unique_ptr<Interface, Deleter> impl_with_deleter(impl.release(),
+                                                          deleter);
+
+    bindings_.AddBinding(std::move(impl_with_deleter), std::move(request));
+  }
+
+  // TODO(xhwang): Add RemoveBinding() if needed.
+
+  void CloseAllBindings() {
+    weak_factory_.InvalidateWeakPtrs();
+    bindings_.CloseAllBindings();
+    unbound_impls_.clear();
+  }
+
+  bool empty() const { return bindings_.empty(); }
+
+  size_t size() const { return bindings_.size(); }
+
+  size_t unbound_size() const { return unbound_impls_.size(); }
+
+ private:
+  void OnBindingRemoved(std::unique_ptr<Interface> ptr) {
+    DVLOG(1) << __func__;
+
+    id_++;
+
+    // The cast is safe since AddBinding() takes DeferredDestroy<Interface>.
+    auto* impl_ptr = static_cast<DeferredDestroy<Interface>*>(ptr.get());
+
+    // Put the |ptr| in the map before calling OnDestroyPending() because the
+    // callback could be called synchronously.
+    unbound_impls_[id_] = std::move(ptr);
+
+    // Use BindToCurrentLoop() to force post the destroy callback. This is
+    // needed because the callback may be called directly in the same stack
+    // where the implemenation is being destroyed.
+    impl_ptr->OnDestroyPending(BindToCurrentLoop(
+        base::BindOnce(&DeferredDestroyStrongBindingSet::OnDestroyable,
+                       weak_factory_.GetWeakPtr(), id_)));
+  }
+
+  void OnDestroyable(int id) {
+    DVLOG(1) << __func__;
+    unbound_impls_.erase(id);
+  }
+
+  uint32_t id_ = 0;
+  std::map<uint32_t, std::unique_ptr<Interface>> unbound_impls_;
+  mojo::StrongBindingSet<Interface, void, Deleter> bindings_;
+
+  // Note: This should remain the last member so it'll be destroyed and
+  // invalidate its weak pointers before any other members are destroyed.
+  base::WeakPtrFactory<DeferredDestroyStrongBindingSet> weak_factory_;
+
+  DISALLOW_COPY_AND_ASSIGN(DeferredDestroyStrongBindingSet);
+};
+
+}  // namespace media
+
+#endif  // MEDIA_MOJO_SERVICES_DEFERRED_DESTROY_STRONG_BINDING_SET_H_
diff --git a/media/mojo/services/deferred_destroy_strong_binding_set_unittest.cc b/media/mojo/services/deferred_destroy_strong_binding_set_unittest.cc
new file mode 100644
index 0000000..a749ac3
--- /dev/null
+++ b/media/mojo/services/deferred_destroy_strong_binding_set_unittest.cc
@@ -0,0 +1,142 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <memory>
+#include <utility>
+
+#include "base/run_loop.h"
+#include "base/test/scoped_task_environment.h"
+#include "media/mojo/services/deferred_destroy_strong_binding_set.h"
+#include "mojo/public/interfaces/bindings/tests/ping_service.mojom.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace media {
+namespace {
+
+using PingService = mojo::test::PingService;
+using PingServicePtr = mojo::test::PingServicePtr;
+
+class DeferredDestroyPingImpl : public DeferredDestroy<PingService> {
+ public:
+  DeferredDestroyPingImpl() { ++instance_count; }
+  ~DeferredDestroyPingImpl() override { --instance_count; }
+
+  // DeferredDestroy<PingService> implementation.
+  void Ping(const PingCallback& callback) override {}
+  void OnDestroyPending(base::OnceClosure destroy_cb) override {
+    destroy_cb_ = std::move(destroy_cb);
+    if (can_destroy_)
+      std::move(destroy_cb_).Run();
+  }
+
+  void set_can_destroy() {
+    can_destroy_ = true;
+    if (destroy_cb_)
+      std::move(destroy_cb_).Run();
+  }
+
+  static int instance_count;
+
+ private:
+  bool can_destroy_ = false;
+  base::OnceClosure destroy_cb_;
+};
+int DeferredDestroyPingImpl::instance_count = 0;
+
+DeferredDestroyPingImpl* AddDeferredDestroyBinding(
+    DeferredDestroyStrongBindingSet<PingService>* bindings,
+    PingServicePtr* ptr) {
+  auto impl = std::make_unique<DeferredDestroyPingImpl>();
+  DeferredDestroyPingImpl* impl_ptr = impl.get();
+  bindings->AddBinding(std::move(impl), mojo::MakeRequest(ptr));
+  return impl_ptr;
+}
+
+class DeferredDestroyStrongBindingSetTest : public testing::Test {
+ public:
+  DeferredDestroyStrongBindingSetTest() = default;
+  ~DeferredDestroyStrongBindingSetTest() override = default;
+
+ protected:
+  base::test::ScopedTaskEnvironment task_environment_;
+};
+
+TEST_F(DeferredDestroyStrongBindingSetTest, Destructor) {
+  PingServicePtr ping[2];
+  auto bindings =
+      std::make_unique<DeferredDestroyStrongBindingSet<PingService>>();
+
+  for (int i = 0; i < 2; ++i)
+    AddDeferredDestroyBinding(bindings.get(), ping + i);
+  EXPECT_EQ(2, DeferredDestroyPingImpl::instance_count);
+
+  bindings.reset();
+  EXPECT_EQ(0, DeferredDestroyPingImpl::instance_count);
+}
+
+TEST_F(DeferredDestroyStrongBindingSetTest, ConnectionError) {
+  PingServicePtr ping[4];
+  DeferredDestroyPingImpl* impl[4];
+  auto bindings =
+      std::make_unique<DeferredDestroyStrongBindingSet<PingService>>();
+
+  for (int i = 0; i < 4; ++i)
+    impl[i] = AddDeferredDestroyBinding(bindings.get(), ping + i);
+  EXPECT_EQ(4, DeferredDestroyPingImpl::instance_count);
+
+  // Destroy deferred after connection error until set_can_destroy()..
+  ping[0].reset();
+  base::RunLoop().RunUntilIdle();
+  EXPECT_EQ(4, DeferredDestroyPingImpl::instance_count);
+  impl[0]->set_can_destroy();
+  base::RunLoop().RunUntilIdle();
+  EXPECT_EQ(3, DeferredDestroyPingImpl::instance_count);
+
+  // Destroyed immediately after connection error if set_can_destroy() in
+  // advance.
+  impl[1]->set_can_destroy();
+  ping[1].reset();
+  base::RunLoop().RunUntilIdle();
+  EXPECT_EQ(2, DeferredDestroyPingImpl::instance_count);
+
+  // Deferred after connection until binding set destruction.
+  ping[2].reset();
+  base::RunLoop().RunUntilIdle();
+  EXPECT_EQ(2, DeferredDestroyPingImpl::instance_count);
+
+  // Destructing the binding set will destruct all impls, including deferred
+  // destroy impls.
+  bindings.reset();
+  EXPECT_EQ(0, DeferredDestroyPingImpl::instance_count);
+}
+
+TEST_F(DeferredDestroyStrongBindingSetTest, CloseAllBindings) {
+  PingServicePtr ping[3];
+  DeferredDestroyPingImpl* impl[3];
+  DeferredDestroyStrongBindingSet<PingService> bindings;
+
+  for (int i = 0; i < 2; ++i)
+    impl[i] = AddDeferredDestroyBinding(&bindings, ping + i);
+  EXPECT_EQ(2, DeferredDestroyPingImpl::instance_count);
+  EXPECT_FALSE(bindings.empty());
+
+  bindings.CloseAllBindings();
+  EXPECT_EQ(0, DeferredDestroyPingImpl::instance_count);
+  EXPECT_TRUE(bindings.empty());
+
+  // After CloseAllBindings, new added bindings can still be deferred destroyed.
+  impl[2] = AddDeferredDestroyBinding(&bindings, ping + 2);
+  EXPECT_EQ(1, DeferredDestroyPingImpl::instance_count);
+
+  ping[2].reset();
+  base::RunLoop().RunUntilIdle();
+  EXPECT_EQ(1, DeferredDestroyPingImpl::instance_count);
+
+  impl[2]->set_can_destroy();
+  base::RunLoop().RunUntilIdle();
+  EXPECT_EQ(0, DeferredDestroyPingImpl::instance_count);
+}
+
+}  // namespace
+}  // namespace media
diff --git a/media/mojo/services/media_service_unittest.cc b/media/mojo/services/media_service_unittest.cc
index 76bcbfb..3685165 100644
--- a/media/mojo/services/media_service_unittest.cc
+++ b/media/mojo/services/media_service_unittest.cc
@@ -32,18 +32,19 @@
 #include "url/gurl.h"
 #include "url/origin.h"
 
-using testing::Exactly;
 using testing::Invoke;
 using testing::InvokeWithoutArgs;
+using testing::NiceMock;
 using testing::StrictMock;
 
 namespace media {
 namespace {
 
-#if BUILDFLAG(ENABLE_MOJO_CDM)
+#if BUILDFLAG(ENABLE_MOJO_CDM) && !defined(OS_ANDROID)
 const char kClearKeyKeySystem[] = "org.w3.clearkey";
 const char kInvalidKeySystem[] = "invalid.key.system";
 #endif
+
 const char kSecurityOrigin[] = "http://foo.com";
 
 class MockRendererClient : public mojom::RendererClient {
@@ -110,7 +111,6 @@
     interface_factory_->CreateCdm(key_system, mojo::MakeRequest(&cdm_));
 
     EXPECT_CALL(*this, OnCdmInitializedInternal(expected_result, cdm_id))
-        .Times(Exactly(1))
         .WillOnce(InvokeWithoutArgs(run_loop_.get(), &base::RunLoop::Quit));
     cdm_->Initialize(key_system, url::Origin::Create(GURL(kSecurityOrigin)),
                      CdmConfig(),
@@ -136,7 +136,6 @@
     renderer_client_binding_.Bind(mojo::MakeRequest(&client_ptr_info));
 
     EXPECT_CALL(*this, OnRendererInitialized(expected_result))
-        .Times(Exactly(1))
         .WillOnce(InvokeWithoutArgs(run_loop_.get(), &base::RunLoop::Quit));
     std::vector<mojom::DemuxerStreamPtrInfo> streams;
     streams.push_back(std::move(video_stream_proxy_info));
@@ -155,7 +154,7 @@
   mojom::ContentDecryptionModulePtr cdm_;
   mojom::RendererPtr renderer_;
 
-  StrictMock<MockRendererClient> renderer_client_;
+  NiceMock<MockRendererClient> renderer_client_;
   mojo::AssociatedBinding<mojom::RendererClient> renderer_client_binding_;
 
   StrictMock<MockDemuxerStream> video_stream_;
@@ -170,7 +169,8 @@
 // Note: base::RunLoop::RunUntilIdle() does not work well in these tests because
 // even when the loop is idle, we may still have pending events in the pipe.
 
-#if BUILDFLAG(ENABLE_MOJO_CDM)
+// TODO(crbug.com/829233): Enable these tests on Android.
+#if BUILDFLAG(ENABLE_MOJO_CDM) && !defined(OS_ANDROID)
 TEST_F(MediaServiceTest, InitializeCdm_Success) {
   InitializeCdm(kClearKeyKeySystem, true, 1);
   run_loop_->Run();
@@ -180,25 +180,13 @@
   InitializeCdm(kInvalidKeySystem, false, 0);
   run_loop_->Run();
 }
-#endif  // BUILDFLAG(ENABLE_MOJO_CDM)
+#endif  // BUILDFLAG(ENABLE_MOJO_CDM) && !defined(OS_ANDROID)
 
 #if BUILDFLAG(ENABLE_MOJO_RENDERER)
-// Sometimes fails on Linux. http://crbug.com/594977
-#if defined(OS_LINUX)
-#define MAYBE_InitializeRenderer_Success DISABLED_InitializeRenderer_Success
-#else
-#define MAYBE_InitializeRenderer_Success InitializeRenderer_Success
-#endif
-
-TEST_F(MediaServiceTest, MAYBE_InitializeRenderer_Success) {
+TEST_F(MediaServiceTest, InitializeRenderer) {
   InitializeRenderer(TestVideoConfig::Normal(), true);
   run_loop_->Run();
 }
-
-TEST_F(MediaServiceTest, InitializeRenderer_InvalidConfig) {
-  InitializeRenderer(TestVideoConfig::Invalid(), false);
-  run_loop_->Run();
-}
 #endif  // BUILDFLAG(ENABLE_MOJO_RENDERER)
 
 TEST_F(MediaServiceTest, Lifetime) {
@@ -217,7 +205,6 @@
   // Disconnecting InterfaceFactory service should terminate the app, which will
   // close the connection.
   EXPECT_CALL(*this, ConnectionClosed())
-      .Times(Exactly(1))
       .WillOnce(Invoke(run_loop_.get(), &base::RunLoop::Quit));
   interface_factory_.reset();
 
diff --git a/media/mojo/services/mojo_cdm_allocator.cc b/media/mojo/services/mojo_cdm_allocator.cc
index 00727c0..a98504a 100644
--- a/media/mojo/services/mojo_cdm_allocator.cc
+++ b/media/mojo/services/mojo_cdm_allocator.cc
@@ -148,6 +148,13 @@
             PlaneOffset(kYPlane), PlaneOffset(kUPlane), PlaneOffset(kVPlane),
             Stride(kYPlane), Stride(kUPlane), Stride(kVPlane),
             base::TimeDelta::FromMicroseconds(Timestamp()));
+
+    // If |frame| is not created something is wrong with the video frame data
+    // returned by the CDM. Catch it here rather than returning a null frame
+    // to the renderer.
+    // TODO(crbug.com/829443). Monitor crashes to see if this happens.
+    CHECK(frame);
+
     frame->SetMojoSharedBufferDoneCB(mojo_shared_buffer_done_cb_);
     return frame;
   }
diff --git a/mojo/public/cpp/bindings/strong_binding_set.h b/mojo/public/cpp/bindings/strong_binding_set.h
index f6bcd52..3f855f4 100644
--- a/mojo/public/cpp/bindings/strong_binding_set.h
+++ b/mojo/public/cpp/bindings/strong_binding_set.h
@@ -15,11 +15,13 @@
 // set, and the interface implementation is deleted. When the StrongBindingSet
 // is destructed, all outstanding bindings in the set are destroyed and all the
 // bound interface implementations are automatically deleted.
-template <typename Interface, typename ContextType = void>
-using StrongBindingSet =
-    BindingSetBase<Interface,
-                   Binding<Interface, UniquePtrImplRefTraits<Interface>>,
-                   ContextType>;
+template <typename Interface,
+          typename ContextType = void,
+          typename Deleter = std::default_delete<Interface>>
+using StrongBindingSet = BindingSetBase<
+    Interface,
+    Binding<Interface, UniquePtrImplRefTraits<Interface, Deleter>>,
+    ContextType>;
 
 }  // namespace mojo
 
diff --git a/mojo/public/cpp/bindings/unique_ptr_impl_ref_traits.h b/mojo/public/cpp/bindings/unique_ptr_impl_ref_traits.h
index f1ac097..ca7fe93 100644
--- a/mojo/public/cpp/bindings/unique_ptr_impl_ref_traits.h
+++ b/mojo/public/cpp/bindings/unique_ptr_impl_ref_traits.h
@@ -9,9 +9,9 @@
 
 // Traits for a binding's implementation reference type.
 // This corresponds to a unique_ptr reference type.
-template <typename Interface>
+template <typename Interface, typename Deleter = std::default_delete<Interface>>
 struct UniquePtrImplRefTraits {
-  using PointerType = std::unique_ptr<Interface>;
+  using PointerType = std::unique_ptr<Interface, Deleter>;
 
   static bool IsNull(const PointerType& ptr) { return !ptr; }
   static Interface* GetRawPointer(PointerType* ptr) { return ptr->get(); }
diff --git a/net/cookies/cookie_monster.cc b/net/cookies/cookie_monster.cc
index ee28f640..e7a6f32b 100644
--- a/net/cookies/cookie_monster.cc
+++ b/net/cookies/cookie_monster.cc
@@ -810,8 +810,14 @@
   uint32_t result = 0u;
   for (CookieMapItPair its = cookies_.equal_range(GetKey(cookie.Domain()));
        its.first != its.second; ++its.first) {
-    // The creation date acts as the unique index...
-    if (its.first->second->CreationDate() == cookie.CreationDate()) {
+    const std::unique_ptr<CanonicalCookie>& candidate = its.first->second;
+    // Historically, this has refused modification if the cookie has changed
+    // value in between the CanonicalCookie object was returned by a getter
+    // and when this ran.  The later parts of the conditional (everything but
+    // the equivalence check) attempt to preserve this behavior.
+    if (candidate->IsEquivalent(cookie) &&
+        candidate->CreationDate() == cookie.CreationDate() &&
+        candidate->Value() == cookie.Value()) {
       InternalDeleteCookie(its.first, true, DELETE_COOKIE_EXPLICIT);
       result = 1u;
       break;
diff --git a/net/cookies/cookie_monster_unittest.cc b/net/cookies/cookie_monster_unittest.cc
index bc8a350..291278f 100644
--- a/net/cookies/cookie_monster_unittest.cc
+++ b/net/cookies/cookie_monster_unittest.cc
@@ -19,6 +19,7 @@
 #include "base/metrics/histogram_samples.h"
 #include "base/run_loop.h"
 #include "base/single_thread_task_runner.h"
+#include "base/strings/strcat.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_piece.h"
 #include "base/strings/string_split.h"
@@ -3107,6 +3108,47 @@
   }
 }
 
+TEST_F(CookieMonsterTest, DeleteDuplicateCTime) {
+  const char* const kNames[] = {"A", "B", "C"};
+  const size_t kNum = arraysize(kNames);
+
+  // Tests that DeleteCanonicalCookie properly distinguishes different cookies
+  // (e.g. different name or path) with identical ctime on same domain.
+  // This gets tested a few times with different deletion target, to make sure
+  // that the implementation doesn't just happen to pick the right one because
+  // of implementation details.
+  for (size_t run = 0; run < kNum; ++run) {
+    CookieMonster cm(nullptr);
+    Time now = Time::Now();
+    GURL url("http://www.example.com");
+
+    for (size_t i = 0; i < kNum; ++i) {
+      std::string cookie_string =
+          base::StrCat({kNames[i], "=", base::NumberToString(i)});
+      EXPECT_TRUE(SetCookieWithCreationTime(&cm, url, cookie_string, now));
+    }
+
+    // Delete the run'th cookie.
+    CookieList all_cookies =
+        GetAllCookiesForURLWithOptions(&cm, url, CookieOptions());
+    ASSERT_EQ(all_cookies.size(), kNum);
+    for (size_t i = 0; i < kNum; ++i) {
+      const CanonicalCookie& cookie = all_cookies[i];
+      if (cookie.Name() == kNames[run]) {
+        EXPECT_TRUE(DeleteCanonicalCookie(&cm, cookie));
+      }
+    }
+
+    // Check that the right cookie got removed.
+    all_cookies = GetAllCookiesForURLWithOptions(&cm, url, CookieOptions());
+    ASSERT_EQ(all_cookies.size(), kNum - 1);
+    for (size_t i = 0; i < kNum - 1; ++i) {
+      const CanonicalCookie& cookie = all_cookies[i];
+      EXPECT_NE(cookie.Name(), kNames[run]);
+    }
+  }
+}
+
 class CookieMonsterNotificationTest : public CookieMonsterTest {
  public:
   CookieMonsterNotificationTest()
diff --git a/net/http/http_network_transaction.cc b/net/http/http_network_transaction.cc
index 299fe75..9d96d1a8 100644
--- a/net/http/http_network_transaction.cc
+++ b/net/http/http_network_transaction.cc
@@ -15,6 +15,7 @@
 #include "base/compiler_specific.h"
 #include "base/format_macros.h"
 #include "base/metrics/field_trial.h"
+#include "base/metrics/histogram_functions.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/sparse_histogram.h"
 #include "base/stl_util.h"
@@ -112,7 +113,8 @@
       websocket_handshake_stream_base_create_helper_(NULL),
       net_error_details_(),
       retry_attempts_(0),
-      num_restarts_(0) {}
+      num_restarts_(0),
+      ssl_version_interference_error_(OK) {}
 
 HttpNetworkTransaction::~HttpNetworkTransaction() {
   if (stream_.get()) {
@@ -844,6 +846,9 @@
 }
 
 int HttpNetworkTransaction::DoCreateStreamComplete(int result) {
+  // Version interference probes should not result in success.
+  DCHECK(!server_ssl_config_.version_interference_probe || result != OK);
+
   // If |result| is ERR_HTTPS_PROXY_TUNNEL_RESPONSE, then
   // DoCreateStreamComplete is being called from OnHttpsProxyTunnelResponse,
   // which resets the stream request first. Therefore, we have to grab the
@@ -865,6 +870,41 @@
     return HandleHttp11Required(result);
   }
 
+  // Perform a TLS 1.3 version interference probe on various connection
+  // errors. The retry will never produce a successful connection but may map
+  // errors to ERR_SSL_VERSION_INTERFERENCE, which signals a probable
+  // version-interfering middlebox.
+  if (IsSecureRequest() && !HasExceededMaxRetries() &&
+      server_ssl_config_.version_max == SSL_PROTOCOL_VERSION_TLS1_3 &&
+      !server_ssl_config_.version_interference_probe) {
+    if (result == ERR_CONNECTION_CLOSED || result == ERR_SSL_PROTOCOL_ERROR ||
+        result == ERR_SSL_VERSION_OR_CIPHER_MISMATCH ||
+        result == ERR_CONNECTION_RESET ||
+        result == ERR_SSL_BAD_RECORD_MAC_ALERT) {
+      // Report the error code for each time a version interference probe is
+      // triggered.
+      base::UmaHistogramSparse("Net.SSLVersionInterferenceProbeTrigger",
+                               std::abs(result));
+      net_log_.AddEventWithNetErrorCode(
+          NetLogEventType::SSL_VERSION_INTERFERENCE_PROBE, result);
+
+      retry_attempts_++;
+      server_ssl_config_.version_interference_probe = true;
+      server_ssl_config_.version_max = SSL_PROTOCOL_VERSION_TLS1_2;
+      ssl_version_interference_error_ = result;
+      ResetConnectionAndRequestForResend();
+      return OK;
+    }
+  }
+
+  if (result == ERR_SSL_VERSION_INTERFERENCE) {
+    // Record the error code version interference was detected at.
+    DCHECK(server_ssl_config_.version_interference_probe);
+    DCHECK_NE(OK, ssl_version_interference_error_);
+    base::UmaHistogramSparse("Net.SSLVersionInterferenceError",
+                             std::abs(ssl_version_interference_error_));
+  }
+
   // Handle possible client certificate errors that may have occurred if the
   // stream used SSL for one or more of the layers.
   result = HandleSSLClientAuthError(result);
diff --git a/net/http/http_network_transaction.h b/net/http/http_network_transaction.h
index f80aedfa..f2ba2ff 100644
--- a/net/http/http_network_transaction.h
+++ b/net/http/http_network_transaction.h
@@ -336,6 +336,13 @@
   // SSLClientAuthCache, rather than provided externally by the caller.
   bool server_ssl_client_cert_was_cached_;
 
+  // SSL configuration used for the server and proxy, respectively. Note
+  // |server_ssl_config_| may be updated from the HttpStreamFactory, which will
+  // be applied on retry.
+  //
+  // TODO(davidben): Mutating it is weird and relies on HttpStreamFactory
+  // modifications being idempotent. Address this as part of other work to make
+  // sense of SSLConfig (related to https://crbug.com/488043).
   SSLConfig server_ssl_config_;
   SSLConfig proxy_ssl_config_;
 
@@ -415,6 +422,10 @@
   // Number of times the transaction was restarted via a RestartWith* call.
   size_t num_restarts_;
 
+  // The net::Error which triggered a TLS 1.3 version interference probe, or OK
+  // if none was triggered.
+  int ssl_version_interference_error_;
+
   DISALLOW_COPY_AND_ASSIGN(HttpNetworkTransaction);
 };
 
diff --git a/net/http/http_network_transaction_unittest.cc b/net/http/http_network_transaction_unittest.cc
index 960990d..f86255e 100644
--- a/net/http/http_network_transaction_unittest.cc
+++ b/net/http/http_network_transaction_unittest.cc
@@ -90,7 +90,6 @@
 #include "net/ssl/default_channel_id_store.h"
 #include "net/ssl/ssl_cert_request_info.h"
 #include "net/ssl/ssl_config_service.h"
-#include "net/ssl/ssl_config_service_defaults.h"
 #include "net/ssl/ssl_info.h"
 #include "net/ssl/ssl_private_key.h"
 #include "net/test/cert_test_util.h"
@@ -273,6 +272,18 @@
   }
 };
 
+class TestSSLConfigService : public SSLConfigService {
+ public:
+  explicit TestSSLConfigService(const SSLConfig& config) : config_(config) {}
+
+  void GetSSLConfig(SSLConfig* config) override { *config = config_; }
+
+ private:
+  ~TestSSLConfigService() override = default;
+
+  SSLConfig config_;
+};
+
 }  // namespace
 
 class HttpNetworkTransactionTest : public PlatformTest {
@@ -687,6 +698,16 @@
   EXPECT_EQ(kNtlmAuthScheme, auth_challenge->scheme);
   return true;
 }
+
+bool CheckNTLMProxyAuth(const AuthChallengeInfo* auth_challenge) {
+  if (!auth_challenge)
+    return false;
+  EXPECT_TRUE(auth_challenge->is_proxy);
+  EXPECT_EQ("http://server", auth_challenge->challenger.Serialize());
+  EXPECT_EQ(std::string(), auth_challenge->realm);
+  EXPECT_EQ(kNtlmAuthScheme, auth_challenge->scheme);
+  return true;
+}
 #endif  // defined(NTLM_PORTABLE)
 
 }  // namespace
@@ -6868,6 +6889,163 @@
   EXPECT_TRUE(data1.AllReadDataConsumed());
   EXPECT_TRUE(data1.AllWriteDataConsumed());
 }
+
+// Test that, if we have an NTLM proxy and the origin resets the connection, we
+// do no retry forever checking for TLS version interference. This is a
+// regression test for https://crbug.com/823387.
+TEST_F(HttpNetworkTransactionTest, NTLMProxyTLSHandshakeReset) {
+  // The NTLM test data expects the proxy to be named 'server'. The origin is
+  // https://origin/.
+  session_deps_.proxy_resolution_service =
+      ProxyResolutionService::CreateFixedFromPacResult(
+          "PROXY server", TRAFFIC_ANNOTATION_FOR_TESTS);
+
+  SSLConfig config;
+  config.version_max = SSL_PROTOCOL_VERSION_TLS1_3;
+  session_deps_.ssl_config_service =
+      base::MakeRefCounted<TestSSLConfigService>(config);
+
+  HttpRequestInfo request;
+  request.method = "GET";
+  request.url = GURL("https://origin/");
+  request.traffic_annotation =
+      net::MutableNetworkTrafficAnnotationTag(TRAFFIC_ANNOTATION_FOR_TESTS);
+
+  // Ensure load is not disrupted by flags which suppress behaviour specific
+  // to other auth schemes.
+  request.load_flags = LOAD_DO_NOT_USE_EMBEDDED_IDENTITY;
+
+  HttpAuthHandlerNTLM::ScopedProcSetter proc_setter(
+      MockGetMSTime, MockGenerateRandom, MockGetHostName);
+  std::unique_ptr<HttpNetworkSession> session(CreateSession(&session_deps_));
+
+  // Generate the NTLM messages based on known test data.
+  std::string negotiate_msg;
+  std::string challenge_msg;
+  std::string authenticate_msg;
+  base::Base64Encode(
+      base::StringPiece(
+          reinterpret_cast<const char*>(ntlm::test::kExpectedNegotiateMsg),
+          arraysize(ntlm::test::kExpectedNegotiateMsg)),
+      &negotiate_msg);
+  base::Base64Encode(
+      base::StringPiece(
+          reinterpret_cast<const char*>(ntlm::test::kChallengeMsgFromSpecV2),
+          arraysize(ntlm::test::kChallengeMsgFromSpecV2)),
+      &challenge_msg);
+  base::Base64Encode(
+      base::StringPiece(
+          reinterpret_cast<const char*>(
+              ntlm::test::kExpectedAuthenticateMsgEmptyChannelBindingsV2),
+          arraysize(
+              ntlm::test::kExpectedAuthenticateMsgEmptyChannelBindingsV2)),
+      &authenticate_msg);
+
+  MockWrite data_writes[] = {
+      // The initial CONNECT request.
+      MockWrite("CONNECT origin:443 HTTP/1.1\r\n"
+                "Host: origin:443\r\n"
+                "Proxy-Connection: keep-alive\r\n\r\n"),
+
+      // After restarting with an identity.
+      MockWrite("CONNECT origin:443 HTTP/1.1\r\n"
+                "Host: origin:443\r\n"
+                "Proxy-Connection: keep-alive\r\n"
+                "Proxy-Authorization: NTLM "),
+      MockWrite(negotiate_msg.c_str()),
+      // End headers.
+      MockWrite("\r\n\r\n"),
+
+      // The second restart.
+      MockWrite("CONNECT origin:443 HTTP/1.1\r\n"
+                "Host: origin:443\r\n"
+                "Proxy-Connection: keep-alive\r\n"
+                "Proxy-Authorization: NTLM "),
+      MockWrite(authenticate_msg.c_str()),
+      // End headers.
+      MockWrite("\r\n\r\n"),
+  };
+
+  MockRead data_reads[] = {
+      // The initial NTLM response.
+      MockRead("HTTP/1.1 407 Access Denied\r\n"
+               "Content-Length: 0\r\n"
+               "Proxy-Authenticate: NTLM\r\n\r\n"),
+
+      // The NTLM challenge message.
+      MockRead("HTTP/1.1 407 Access Denied\r\n"
+               "Content-Length: 0\r\n"
+               "Proxy-Authenticate: NTLM "),
+      MockRead(challenge_msg.c_str()),
+      // End headers.
+      MockRead("\r\n\r\n"),
+
+      // Finally the tunnel is established.
+      MockRead("HTTP/1.1 200 Connected\r\n\r\n"),
+  };
+
+  StaticSocketDataProvider data(data_reads, arraysize(data_reads), data_writes,
+                                arraysize(data_writes));
+  SSLSocketDataProvider data_ssl(ASYNC, ERR_CONNECTION_RESET);
+  StaticSocketDataProvider data2(data_reads, arraysize(data_reads), data_writes,
+                                 arraysize(data_writes));
+  SSLSocketDataProvider data_ssl2(ASYNC, ERR_CONNECTION_RESET);
+  session_deps_.socket_factory->AddSocketDataProvider(&data);
+  session_deps_.socket_factory->AddSSLSocketDataProvider(&data_ssl);
+  session_deps_.socket_factory->AddSocketDataProvider(&data2);
+  session_deps_.socket_factory->AddSSLSocketDataProvider(&data_ssl2);
+
+  // Start the transaction. The proxy responds with an NTLM authentication
+  // request.
+  TestCompletionCallback callback;
+  HttpNetworkTransaction trans(DEFAULT_PRIORITY, session.get());
+  int rv = callback.GetResult(
+      trans.Start(&request, callback.callback(), NetLogWithSource()));
+
+  EXPECT_THAT(rv, IsOk());
+  EXPECT_FALSE(trans.IsReadyToRestartForAuth());
+  const HttpResponseInfo* response = trans.GetResponseInfo();
+  ASSERT_TRUE(response);
+  EXPECT_TRUE(CheckNTLMProxyAuth(response->auth_challenge.get()));
+
+  // Configure credentials. The proxy responds with the challenge message.
+  rv = callback.GetResult(trans.RestartWithAuth(
+      AuthCredentials(ntlm::test::kDomainUserCombined, ntlm::test::kPassword),
+      callback.callback()));
+  EXPECT_THAT(rv, IsOk());
+  EXPECT_TRUE(trans.IsReadyToRestartForAuth());
+  response = trans.GetResponseInfo();
+  ASSERT_TRUE(response);
+  EXPECT_FALSE(response->auth_challenge);
+
+  // Restart once more. The tunnel will be established and the the SSL handshake
+  // will reset. The TLS 1.3 version interference probe will then kick in and
+  // restart the process. The proxy responds with another NTLM authentiation
+  // request, but we don't need to provide credentials as the cached ones work/
+  rv = callback.GetResult(
+      trans.RestartWithAuth(AuthCredentials(), callback.callback()));
+  EXPECT_THAT(rv, IsOk());
+  EXPECT_TRUE(trans.IsReadyToRestartForAuth());
+  response = trans.GetResponseInfo();
+  ASSERT_TRUE(response);
+  EXPECT_FALSE(response->auth_challenge);
+
+  // The proxy responds with the NTLM challenge message.
+  rv = callback.GetResult(
+      trans.RestartWithAuth(AuthCredentials(), callback.callback()));
+  EXPECT_THAT(rv, IsOk());
+  EXPECT_TRUE(trans.IsReadyToRestartForAuth());
+  response = trans.GetResponseInfo();
+  ASSERT_TRUE(response);
+  EXPECT_FALSE(response->auth_challenge);
+
+  // Send the NTLM authenticate message. The tunnel is established and the
+  // handshake resets again. We should not retry again.
+  rv = callback.GetResult(
+      trans.RestartWithAuth(AuthCredentials(), callback.callback()));
+  EXPECT_THAT(rv, IsError(ERR_CONNECTION_RESET));
+}
+
 #endif  // NTLM_PORTABLE
 
 // Test reading a server response which has only headers, and no body.
diff --git a/net/socket/client_socket_pool_manager.cc b/net/socket/client_socket_pool_manager.cc
index 8895aa8..7c7adb0 100644
--- a/net/socket/client_socket_pool_manager.cc
+++ b/net/socket/client_socket_pool_manager.cc
@@ -117,7 +117,11 @@
     connection_group = "ftp/" + connection_group;
   }
   if (using_ssl) {
-    connection_group = "ssl/" + connection_group;
+    std::string prefix = "ssl/";
+    if (ssl_config_for_origin.version_interference_probe) {
+      prefix += "version-interference-probe/";
+    }
+    connection_group = prefix + connection_group;
   }
 
   ClientSocketPool::RespectLimits respect_limits =
diff --git a/net/socket/ssl_client_socket.cc b/net/socket/ssl_client_socket.cc
index a4d8742..3fe46eb 100644
--- a/net/socket/ssl_client_socket.cc
+++ b/net/socket/ssl_client_socket.cc
@@ -36,10 +36,6 @@
          IsCertificateError(error);
 }
 
-SSLErrorDetails SSLClientSocket::GetConnectErrorDetails() const {
-  return SSLErrorDetails::kOther;
-}
-
 // static
 std::vector<uint8_t> SSLClientSocket::SerializeNextProtos(
     const NextProtoVector& next_protos) {
diff --git a/net/socket/ssl_client_socket.h b/net/socket/ssl_client_socket.h
index dd3d401d..8835ded 100644
--- a/net/socket/ssl_client_socket.h
+++ b/net/socket/ssl_client_socket.h
@@ -65,32 +65,6 @@
   std::string ssl_session_cache_shard;
 };
 
-// Details on a failed operation. This enum is used to diagnose causes of TLS
-// version interference by buggy middleboxes. The values are histogramed so they
-// must not be changed.
-enum class SSLErrorDetails {
-  kOther = 0,
-  // The failure was due to ERR_CONNECTION_CLOSED. BlueCoat has a bug with this
-  // failure mode. https://crbug.com/694593.
-  kConnectionClosed = 1,
-  // The failure was due to ERR_CONNECTION_RESET.
-  kConnectionReset = 2,
-  // The failure was due to receiving an access_denied alert. Fortinet has a
-  // bug with this failure mode. https://crbug.com/676969.
-  kAccessDeniedAlert = 3,
-  // The failure was due to receiving a bad_record_mac alert.
-  kBadRecordMACAlert = 4,
-  // The failure was due to receiving an unencrypted application_data record
-  // during the handshake. Watchguard has a bug with this failure
-  // mode. https://crbug.com/733223.
-  kApplicationDataInsteadOfHandshake = 5,
-  // The failure was due to failing to negotiate a version or cipher suite.
-  kVersionOrCipherMismatch = 6,
-  // The failure was due to some other protocol error.
-  kProtocolError = 7,
-  kLastValue = kProtocolError,
-};
-
 // A client socket that uses SSL as the transport layer.
 //
 // NOTE: The SSL handshake occurs within the Connect method after a TCP
@@ -139,10 +113,6 @@
   // establishing the connection (or NULL if no channel ID was used).
   virtual crypto::ECPrivateKey* GetChannelIDKey() const = 0;
 
-  // Returns details for a failed Connect() operation. This method is used to
-  // track causes of TLS version interference by buggy middleboxes.
-  virtual SSLErrorDetails GetConnectErrorDetails() const;
-
  protected:
   void set_signed_cert_timestamps_received(
       bool signed_cert_timestamps_received) {
diff --git a/net/socket/ssl_client_socket_impl.cc b/net/socket/ssl_client_socket_impl.cc
index 9fee5da..0d11dc27 100644
--- a/net/socket/ssl_client_socket_impl.cc
+++ b/net/socket/ssl_client_socket_impl.cc
@@ -455,7 +455,6 @@
       policy_enforcer_(context.ct_policy_enforcer),
       pkp_bypassed_(false),
       is_fatal_cert_error_(false),
-      connect_error_details_(SSLErrorDetails::kOther),
       net_log_(transport_->socket()->NetLog()),
       weak_factory_(this) {
   CHECK(cert_verifier_);
@@ -544,10 +543,6 @@
   return channel_id_key_.get();
 }
 
-SSLErrorDetails SSLClientSocketImpl::GetConnectErrorDetails() const {
-  return connect_error_details_;
-}
-
 int SSLClientSocketImpl::ExportKeyingMaterial(const base::StringPiece& label,
                                               bool has_context,
                                               const base::StringPiece& context,
@@ -1048,38 +1043,6 @@
       return ERR_IO_PENDING;
     }
 
-    switch (net_error) {
-      case ERR_CONNECTION_CLOSED:
-        connect_error_details_ = SSLErrorDetails::kConnectionClosed;
-        break;
-      case ERR_CONNECTION_RESET:
-        connect_error_details_ = SSLErrorDetails::kConnectionReset;
-        break;
-      case ERR_SSL_PROTOCOL_ERROR: {
-        int lib = ERR_GET_LIB(error_info.error_code);
-        int reason = ERR_GET_REASON(error_info.error_code);
-        if (lib == ERR_LIB_SSL && reason == SSL_R_TLSV1_ALERT_ACCESS_DENIED) {
-          connect_error_details_ = SSLErrorDetails::kAccessDeniedAlert;
-        } else if (lib == ERR_LIB_SSL &&
-                   reason == SSL_R_APPLICATION_DATA_INSTEAD_OF_HANDSHAKE) {
-          connect_error_details_ =
-              SSLErrorDetails::kApplicationDataInsteadOfHandshake;
-        } else {
-          connect_error_details_ = SSLErrorDetails::kProtocolError;
-        }
-        break;
-      }
-      case ERR_SSL_BAD_RECORD_MAC_ALERT:
-        connect_error_details_ = SSLErrorDetails::kBadRecordMACAlert;
-        break;
-      case ERR_SSL_VERSION_OR_CIPHER_MISMATCH:
-        connect_error_details_ = SSLErrorDetails::kVersionOrCipherMismatch;
-        break;
-      default:
-        connect_error_details_ = SSLErrorDetails::kOther;
-        break;
-    }
-
     LOG(ERROR) << "handshake failed; returned " << rv << ", SSL error code "
                << ssl_error << ", net_error " << net_error;
     net_log_.AddEvent(
diff --git a/net/socket/ssl_client_socket_impl.h b/net/socket/ssl_client_socket_impl.h
index 12ccd437..8e084e9e 100644
--- a/net/socket/ssl_client_socket_impl.h
+++ b/net/socket/ssl_client_socket_impl.h
@@ -89,7 +89,6 @@
                                  TokenBindingType tb_type,
                                  std::vector<uint8_t>* out) override;
   crypto::ECPrivateKey* GetChannelIDKey() const override;
-  SSLErrorDetails GetConnectErrorDetails() const override;
 
   // SSLSocket implementation.
   int ExportKeyingMaterial(const base::StringPiece& label,
@@ -350,8 +349,6 @@
   // and false otherwise.
   bool is_fatal_cert_error_;
 
-  SSLErrorDetails connect_error_details_;
-
   NetLogWithSource net_log_;
   base::WeakPtrFactory<SSLClientSocketImpl> weak_factory_;
 
diff --git a/net/socket/ssl_client_socket_pool.cc b/net/socket/ssl_client_socket_pool.cc
index 69a00ca..2e6b009 100644
--- a/net/socket/ssl_client_socket_pool.cc
+++ b/net/socket/ssl_client_socket_pool.cc
@@ -133,10 +133,7 @@
                            ? "pm/" + context.ssl_session_cache_shard
                            : context.ssl_session_cache_shard))),
       callback_(
-          base::Bind(&SSLConnectJob::OnIOComplete, base::Unretained(this))),
-      version_interference_probe_(false),
-      version_interference_error_(OK),
-      version_interference_details_(SSLErrorDetails::kOther) {}
+          base::Bind(&SSLConnectJob::OnIOComplete, base::Unretained(this))) {}
 
 SSLConnectJob::~SSLConnectJob() = default;
 
@@ -325,22 +322,13 @@
 
   connect_timing_.ssl_start = base::TimeTicks::Now();
 
-  SSLConfig ssl_config = params_->ssl_config();
-  if (version_interference_probe_) {
-    DCHECK_EQ(SSL_PROTOCOL_VERSION_TLS1_3, ssl_config.version_max);
-    ssl_config.version_max = SSL_PROTOCOL_VERSION_TLS1_2;
-    ssl_config.version_interference_probe = true;
-  }
   ssl_socket_ = client_socket_factory_->CreateSSLClientSocket(
-      std::move(transport_socket_handle_), params_->host_and_port(), ssl_config,
-      context_);
+      std::move(transport_socket_handle_), params_->host_and_port(),
+      params_->ssl_config(), context_);
   return ssl_socket_->Connect(callback_);
 }
 
 int SSLConnectJob::DoSSLConnectComplete(int result) {
-  // Version interference probes should not result in success.
-  DCHECK(!version_interference_probe_ || result != OK);
-
   connect_timing_.ssl_end = base::TimeTicks::Now();
 
   if (result != OK && !server_address_.address().empty()) {
@@ -348,33 +336,6 @@
     server_address_ = IPEndPoint();
   }
 
-  // Perform a TLS 1.3 version interference probe on various connection
-  // errors. The retry will never produce a successful connection but may map
-  // errors to ERR_SSL_VERSION_INTERFERENCE, which signals a probable
-  // version-interfering middlebox.
-  if (params_->ssl_config().version_max == SSL_PROTOCOL_VERSION_TLS1_3 &&
-      !version_interference_probe_) {
-    if (result == ERR_CONNECTION_CLOSED || result == ERR_SSL_PROTOCOL_ERROR ||
-        result == ERR_SSL_VERSION_OR_CIPHER_MISMATCH ||
-        result == ERR_CONNECTION_RESET ||
-        result == ERR_SSL_BAD_RECORD_MAC_ALERT) {
-      // Report the error code for each time a version interference probe is
-      // triggered.
-      base::UmaHistogramSparse("Net.SSLVersionInterferenceProbeTrigger",
-                               std::abs(result));
-      net_log().AddEventWithNetErrorCode(
-          NetLogEventType::SSL_VERSION_INTERFERENCE_PROBE, result);
-      SSLErrorDetails details = ssl_socket_->GetConnectErrorDetails();
-
-      ResetStateForRetry();
-      version_interference_probe_ = true;
-      version_interference_error_ = result;
-      version_interference_details_ = details;
-      next_state_ = GetInitialState(params_->GetConnectionType());
-      return OK;
-    }
-  }
-
   const std::string& host = params_->host_and_port().host();
   bool tls13_supported = IsTLS13ExperimentHost(host);
 
@@ -435,24 +396,13 @@
     }
   }
 
-  base::UmaHistogramSparse("Net.SSL_Connection_Error", std::abs(result));
-
-  if (tls13_supported) {
-    base::UmaHistogramSparse("Net.SSL_Connection_Error_TLS13Experiment",
-                             std::abs(result));
-  }
-
-  if (result == ERR_SSL_VERSION_INTERFERENCE) {
-    // Record the error code version interference was detected at.
-    DCHECK(version_interference_probe_);
-    DCHECK_NE(OK, version_interference_error_);
-    base::UmaHistogramSparse("Net.SSLVersionInterferenceError",
-                             std::abs(version_interference_error_));
+  // Don't double-count the version interference probes.
+  if (!params_->ssl_config().version_interference_probe) {
+    base::UmaHistogramSparse("Net.SSL_Connection_Error", std::abs(result));
 
     if (tls13_supported) {
-      UMA_HISTOGRAM_ENUMERATION(
-          "Net.SSLVersionInterferenceDetails_TLS13Experiment",
-          version_interference_details_, SSLErrorDetails::kLastValue);
+      base::UmaHistogramSparse("Net.SSL_Connection_Error_TLS13Experiment",
+                               std::abs(result));
     }
   }
 
@@ -486,13 +436,6 @@
   return DoLoop(OK);
 }
 
-void SSLConnectJob::ResetStateForRetry() {
-  transport_socket_handle_.reset();
-  ssl_socket_.reset();
-  error_response_info_ = HttpResponseInfo();
-  server_address_ = IPEndPoint();
-}
-
 SSLClientSocketPool::SSLConnectJobFactory::SSLConnectJobFactory(
     TransportClientSocketPool* transport_pool,
     SOCKSClientSocketPool* socks_pool,
diff --git a/net/socket/ssl_client_socket_pool.h b/net/socket/ssl_client_socket_pool.h
index 1ec3d32..777b6b7 100644
--- a/net/socket/ssl_client_socket_pool.h
+++ b/net/socket/ssl_client_socket_pool.h
@@ -149,8 +149,6 @@
   // Otherwise, it returns a net error code.
   int ConnectInternal() override;
 
-  void ResetStateForRetry();
-
   scoped_refptr<SSLSocketParams> params_;
   TransportClientSocketPool* const transport_pool_;
   SOCKSClientSocketPool* const socks_pool_;
@@ -172,16 +170,6 @@
   // through an HTTPS CONNECT request or a SOCKS proxy).
   IPEndPoint server_address_;
 
-  bool version_interference_probe_;
-
-  // The error which triggered a TLS 1.3 version interference probe, or OK if
-  // none was triggered.
-  int version_interference_error_;
-
-  // Details for the error which triggered a TLS 1.3 interference probe, or
-  // kOther if not applicable.
-  SSLErrorDetails version_interference_details_;
-
   DISALLOW_COPY_AND_ASSIGN(SSLConnectJob);
 };
 
diff --git a/services/audio/BUILD.gn b/services/audio/BUILD.gn
index 99d88b3e..df732bf 100644
--- a/services/audio/BUILD.gn
+++ b/services/audio/BUILD.gn
@@ -37,6 +37,8 @@
     "group_member.h",
     "in_process_audio_manager_accessor.cc",
     "in_process_audio_manager_accessor.h",
+    "input_stream.cc",
+    "input_stream.h",
     "output_controller.cc",
     "output_controller.h",
     "output_stream.cc",
@@ -69,6 +71,7 @@
   sources = [
     "debug_recording_unittest.cc",
     "group_coordinator_unittest.cc",
+    "input_stream_unittest.cc",
     "output_controller_unittest.cc",
     "output_stream_unittest.cc",
     "sync_reader_unittest.cc",
diff --git a/services/audio/input_stream.cc b/services/audio/input_stream.cc
new file mode 100644
index 0000000..4403f22
--- /dev/null
+++ b/services/audio/input_stream.cc
@@ -0,0 +1,179 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "services/audio/input_stream.h"
+
+#include <string>
+#include <utility>
+
+#include "media/audio/audio_input_sync_writer.h"
+#include "media/audio/audio_manager.h"
+#include "media/base/audio_parameters.h"
+#include "media/base/user_input_monitor.h"
+#include "mojo/public/cpp/system/buffer.h"
+#include "mojo/public/cpp/system/handle.h"
+#include "mojo/public/cpp/system/platform_handle.h"
+
+namespace audio {
+
+namespace {
+const int kMaxInputChannels = 3;
+}
+
+InputStream::InputStream(CreatedCallback created_callback,
+                         DeleteCallback delete_callback,
+                         media::mojom::AudioInputStreamRequest request,
+                         media::mojom::AudioInputStreamClientPtr client,
+                         media::mojom::AudioLogPtr log,
+                         media::AudioManager* audio_manager,
+                         media::UserInputMonitor* user_input_monitor,
+                         const media::AudioParameters& params,
+                         const std::string& device_id,
+                         uint32_t shared_memory_count,
+                         bool enable_agc)
+    : binding_(this, std::move(request)),
+      client_(std::move(client)),
+      log_(media::mojom::ThreadSafeAudioLogPtr::Create(std::move(log))),
+      created_callback_(std::move(created_callback)),
+      delete_callback_(std::move(delete_callback)),
+      foreign_socket_(),
+      writer_(media::AudioInputSyncWriter::Create(
+          base::BindRepeating(&media::mojom::AudioLog::OnLogMessage,
+                              base::Unretained(log_->get())),
+          shared_memory_count,
+          params,
+          &foreign_socket_)),
+      weak_factory_(this) {
+  DCHECK(audio_manager);
+  DCHECK(binding_.is_bound());
+  DCHECK(client_.is_bound());
+  DCHECK(created_callback_);
+  DCHECK(delete_callback_);
+
+  // |this| owns these objects, so unretained is safe.
+  base::RepeatingClosure error_handler =
+      base::BindRepeating(&InputStream::OnStreamError, base::Unretained(this));
+  binding_.set_connection_error_handler(error_handler);
+  client_.set_connection_error_handler(error_handler);
+  log_->get()->OnCreated(params, device_id);
+
+  // Only MONO, STEREO and STEREO_AND_KEYBOARD_MIC channel layouts are expected,
+  // see AudioManagerBase::MakeAudioInputStream().
+  if (!params.IsValid() || (params.channels() > kMaxInputChannels)) {
+    OnStreamError();
+    return;
+  }
+
+  if (!writer_) {
+    OnStreamError();
+    return;
+  }
+
+  controller_ = media::AudioInputController::Create(
+      audio_manager, this, writer_.get(), user_input_monitor, params, device_id,
+      enable_agc);
+}
+
+InputStream::~InputStream() {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(owning_sequence_);
+
+  log_->get()->OnClosed();
+
+  if (created_callback_) {
+    // Didn't manage to create the stream. Call the callback anyways as mandated
+    // by mojo.
+    std::move(created_callback_).Run(nullptr, false);
+  }
+
+  if (!controller_) {
+    // Didn't initialize properly, nothing to clean up.
+    return;
+  }
+
+  // TODO(https://crbug.com/803102): remove AudioInputController::Close() after
+  // content/ streams are removed, destructor should suffice.
+  controller_->Close(base::OnceClosure());
+}
+
+void InputStream::Record() {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(owning_sequence_);
+  DCHECK(controller_);
+  controller_->Record();
+  log_->get()->OnStarted();
+}
+
+void InputStream::SetVolume(double volume) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(owning_sequence_);
+  DCHECK(controller_);
+
+  if (volume < 0 || volume > 1) {
+    mojo::ReportBadMessage("Invalid volume");
+    OnStreamError();
+    return;
+  }
+
+  controller_->SetVolume(volume);
+  log_->get()->OnSetVolume(volume);
+}
+
+void InputStream::OnCreated(bool initially_muted) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(owning_sequence_);
+
+  const base::SharedMemory* memory = writer_->shared_memory();
+
+  base::SharedMemoryHandle foreign_memory_handle = memory->GetReadOnlyHandle();
+  if (!base::SharedMemory::IsHandleValid(foreign_memory_handle)) {
+    OnStreamError();
+    return;
+  }
+
+  mojo::ScopedSharedBufferHandle buffer_handle = mojo::WrapSharedMemoryHandle(
+      foreign_memory_handle, memory->requested_size(),
+      mojo::UnwrappedSharedMemoryHandleProtection::kReadOnly);
+
+  mojo::ScopedHandle socket_handle =
+      mojo::WrapPlatformFile(foreign_socket_.Release());
+
+  DCHECK(buffer_handle.is_valid());
+  DCHECK(socket_handle.is_valid());
+
+  std::move(created_callback_)
+      .Run({base::in_place, std::move(buffer_handle), std::move(socket_handle)},
+           initially_muted);
+}
+
+void InputStream::OnError(media::AudioInputController::ErrorCode error_code) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(owning_sequence_);
+  client_->OnError();
+  log_->get()->OnError();
+  OnStreamError();
+}
+
+void InputStream::OnLog(base::StringPiece message) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(owning_sequence_);
+  log_->get()->OnLogMessage(message.as_string());
+}
+
+void InputStream::OnMuted(bool is_muted) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(owning_sequence_);
+  client_->OnMutedStateChanged(is_muted);
+}
+
+void InputStream::OnStreamError() {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(owning_sequence_);
+
+  // Defer callback so we're not destructed while in the constructor.
+  base::SequencedTaskRunnerHandle::Get()->PostTask(
+      FROM_HERE,
+      base::BindOnce(&InputStream::CallDeleter, weak_factory_.GetWeakPtr()));
+  binding_.Close();
+}
+
+void InputStream::CallDeleter() {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(owning_sequence_);
+
+  std::move(delete_callback_).Run(this);
+}
+
+}  // namespace audio
diff --git a/services/audio/input_stream.h b/services/audio/input_stream.h
new file mode 100644
index 0000000..f536b4b
--- /dev/null
+++ b/services/audio/input_stream.h
@@ -0,0 +1,87 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef SERVICES_AUDIO_INPUT_STREAM_H_
+#define SERVICES_AUDIO_INPUT_STREAM_H_
+
+#include <memory>
+#include <string>
+
+#include "base/memory/scoped_refptr.h"
+#include "base/sync_socket.h"
+#include "media/audio/audio_input_controller.h"
+#include "media/mojo/interfaces/audio_data_pipe.mojom.h"
+#include "media/mojo/interfaces/audio_input_stream.mojom.h"
+#include "media/mojo/interfaces/audio_logging.mojom.h"
+#include "mojo/public/cpp/bindings/binding.h"
+
+namespace media {
+
+class AudioInputSyncWriter;
+class AudioManager;
+class AudioParameters;
+class UserInputMonitor;
+
+}  // namespace media
+
+namespace audio {
+
+class InputStream final : public media::mojom::AudioInputStream,
+                          public media::AudioInputController::EventHandler {
+ public:
+  using CreatedCallback =
+      base::OnceCallback<void(media::mojom::AudioDataPipePtr, bool)>;
+  using DeleteCallback = base::OnceCallback<void(InputStream*)>;
+
+  InputStream(CreatedCallback created_callback,
+              DeleteCallback delete_callback,
+              media::mojom::AudioInputStreamRequest request,
+              media::mojom::AudioInputStreamClientPtr client,
+              media::mojom::AudioLogPtr log,
+              media::AudioManager* manager,
+              media::UserInputMonitor* user_input_monitor,
+              const media::AudioParameters& params,
+              const std::string& device_id,
+              uint32_t shared_memory_count,
+              bool enable_agc);
+  ~InputStream() override;
+
+  // media::mojom::AudioInputStream implementation.
+  void Record() override;
+  void SetVolume(double volume) override;
+
+  // media::AudioInputController::EventHandler implementation.
+  void OnCreated(bool initially_muted) override;
+  void OnError(media::AudioInputController::ErrorCode error_code) override;
+  void OnLog(base::StringPiece) override;
+  void OnMuted(bool is_muted) override;
+
+ private:
+  void OnStreamError();
+  void CallDeleter();
+
+  mojo::Binding<media::mojom::AudioInputStream> binding_;
+  media::mojom::AudioInputStreamClientPtr client_;
+  const scoped_refptr<media::mojom::ThreadSafeAudioLogPtr> log_;
+
+  // Notify stream client on creation.
+  CreatedCallback created_callback_;
+
+  // Notify stream factory (audio service) on destruction.
+  DeleteCallback delete_callback_;
+
+  base::CancelableSyncSocket foreign_socket_;
+  const std::unique_ptr<media::AudioInputSyncWriter> writer_;
+  scoped_refptr<media::AudioInputController> controller_;
+
+  SEQUENCE_CHECKER(owning_sequence_);
+
+  base::WeakPtrFactory<InputStream> weak_factory_;
+
+  DISALLOW_COPY_AND_ASSIGN(InputStream);
+};
+
+}  // namespace audio
+
+#endif  // SERVICES_AUDIO_INPUT_STREAM_H_
diff --git a/services/audio/input_stream_unittest.cc b/services/audio/input_stream_unittest.cc
new file mode 100644
index 0000000..ce23cb1
--- /dev/null
+++ b/services/audio/input_stream_unittest.cc
@@ -0,0 +1,366 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "services/audio/input_stream.h"
+
+#include <memory>
+#include <string>
+#include <utility>
+
+#include "base/test/scoped_task_environment.h"
+#include "media/audio/audio_io.h"
+#include "media/audio/mock_audio_manager.h"
+#include "media/audio/test_audio_thread.h"
+#include "media/base/user_input_monitor.h"
+#include "mojo/edk/embedder/embedder.h"
+#include "mojo/public/cpp/bindings/associated_binding.h"
+#include "services/audio/test/mock_log.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+using testing::NiceMock;
+using testing::NotNull;
+using testing::Return;
+using testing::StrictMock;
+using testing::_;
+
+namespace audio {
+
+namespace {
+
+const uint32_t kDefaultSharedMemoryCount = 10;
+const bool kDoEnableAGC = true;
+const bool kDoNotEnableAGC = false;
+const bool kValidStream = true;
+const bool kInvalidStream = false;
+const char* kDefaultDeviceId = "default";
+
+class MockStreamClient : public media::mojom::AudioInputStreamClient {
+ public:
+  MockStreamClient() : binding_(this) {}
+
+  media::mojom::AudioInputStreamClientPtr MakePtr() {
+    media::mojom::AudioInputStreamClientPtr ptr;
+    binding_.Bind(mojo::MakeRequest(&ptr));
+    binding_.set_connection_error_handler(base::BindOnce(
+        &MockStreamClient::BindingConnectionError, base::Unretained(this)));
+    return ptr;
+  }
+
+  void CloseBinding() { binding_.Close(); }
+
+  MOCK_METHOD0(OnError, void());
+  MOCK_METHOD1(OnMutedStateChanged, void(bool));
+  MOCK_METHOD0(BindingConnectionError, void());
+
+ private:
+  mojo::Binding<media::mojom::AudioInputStreamClient> binding_;
+
+  DISALLOW_COPY_AND_ASSIGN(MockStreamClient);
+};
+
+class MockUserInputMonitor : public media::UserInputMonitor {
+ public:
+  MockUserInputMonitor() {}
+
+  size_t GetKeyPressCount() const override { return 0; }
+
+  MOCK_METHOD0(StartKeyboardMonitoring, void());
+  MOCK_METHOD0(StopKeyboardMonitoring, void());
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(MockUserInputMonitor);
+};
+
+class MockStream : public media::AudioInputStream {
+ public:
+  MockStream() {}
+
+  double GetMaxVolume() override { return 1; }
+
+  MOCK_METHOD0(Open, bool());
+  MOCK_METHOD1(Start, void(AudioInputCallback*));
+  MOCK_METHOD0(Stop, void());
+  MOCK_METHOD0(Close, void());
+  MOCK_METHOD1(SetVolume, void(double));
+  MOCK_METHOD0(GetVolume, double());
+  MOCK_METHOD1(SetAutomaticGainControl, bool(bool));
+  MOCK_METHOD0(GetAutomaticGainControl, bool());
+  MOCK_METHOD0(IsMuted, bool());
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(MockStream);
+};
+
+}  // namespace
+
+class AudioServiceInputStreamTest : public testing::Test {
+ public:
+  AudioServiceInputStreamTest()
+      : audio_manager_(std::make_unique<media::TestAudioThread>(false)) {}
+
+  ~AudioServiceInputStreamTest() { audio_manager_.Shutdown(); }
+
+  void SetUp() override {
+    mojo::edk::SetDefaultProcessErrorCallback(
+        base::BindRepeating(&AudioServiceInputStreamTest::BadMessageCallback,
+                            base::Unretained(this)));
+  }
+
+  void TearDown() override {
+    mojo::edk::SetDefaultProcessErrorCallback(
+        mojo::edk::ProcessErrorCallback());
+  }
+
+  std::unique_ptr<InputStream> CreateStream(
+      media::mojom::AudioInputStreamRequest request,
+      bool enable_agc) {
+    return std::make_unique<InputStream>(
+        base::BindOnce(&AudioServiceInputStreamTest::OnCreated,
+                       base::Unretained(this)),
+        base::BindOnce(&AudioServiceInputStreamTest::DeleteCallback,
+                       base::Unretained(this)),
+        std::move(request), client_.MakePtr(), log_.MakePtr(), &audio_manager_,
+        &user_input_monitor_, media::AudioParameters::UnavailableDeviceParams(),
+        kDefaultDeviceId, kDefaultSharedMemoryCount, enable_agc);
+  }
+
+  media::MockAudioManager& audio_manager() { return audio_manager_; }
+
+  MockStreamClient& client() { return client_; }
+
+  MockLog& log() { return log_; }
+
+  void OnCreated(media::mojom::AudioDataPipePtr ptr, bool initially_muted) {
+    CreatedCallback(!!ptr);
+  }
+
+  MOCK_METHOD1(CreatedCallback, void(bool /*valid*/));
+  MOCK_METHOD1(DeleteCallback, void(InputStream*));
+  MOCK_METHOD1(BadMessageCallback, void(const std::string&));
+
+ private:
+  base::test::ScopedTaskEnvironment scoped_task_env_;
+  media::MockAudioManager audio_manager_;
+  StrictMock<MockStreamClient> client_;
+  NiceMock<MockLog> log_;
+  NiceMock<MockUserInputMonitor> user_input_monitor_;
+
+  DISALLOW_COPY_AND_ASSIGN(AudioServiceInputStreamTest);
+};
+
+TEST_F(AudioServiceInputStreamTest, ConstructDestruct) {
+  NiceMock<MockStream> mock_stream;
+  audio_manager().SetMakeInputStreamCB(base::BindRepeating(
+      [](media::AudioInputStream* stream, const media::AudioParameters& params,
+         const std::string& device_id) { return stream; },
+      &mock_stream));
+
+  EXPECT_CALL(mock_stream, Open()).WillOnce(Return(true));
+  EXPECT_CALL(log(), OnCreated(_, _));
+  EXPECT_CALL(*this, CreatedCallback(kValidStream));
+  media::mojom::AudioInputStreamPtr stream_ptr;
+  std::unique_ptr<InputStream> stream =
+      CreateStream(mojo::MakeRequest(&stream_ptr), kDoNotEnableAGC);
+  base::RunLoop().RunUntilIdle();
+
+  EXPECT_CALL(mock_stream, Close());
+  EXPECT_CALL(log(), OnClosed());
+  EXPECT_CALL(client(), BindingConnectionError());
+  stream.reset();
+  base::RunLoop().RunUntilIdle();
+}
+
+TEST_F(AudioServiceInputStreamTest,
+       ConstructStreamAndCloseClientBinding_DestructsStream) {
+  NiceMock<MockStream> mock_stream;
+  audio_manager().SetMakeInputStreamCB(base::BindRepeating(
+      [](media::AudioInputStream* stream, const media::AudioParameters& params,
+         const std::string& device_id) { return stream; },
+      &mock_stream));
+
+  EXPECT_CALL(mock_stream, Open()).WillOnce(Return(true));
+  EXPECT_CALL(log(), OnCreated(_, _));
+  EXPECT_CALL(*this, CreatedCallback(kValidStream));
+  media::mojom::AudioInputStreamPtr stream_ptr;
+  std::unique_ptr<InputStream> stream =
+      CreateStream(mojo::MakeRequest(&stream_ptr), kDoNotEnableAGC);
+  base::RunLoop().RunUntilIdle();
+
+  EXPECT_CALL(mock_stream, Close());
+  EXPECT_CALL(log(), OnClosed());
+  EXPECT_CALL(*this, DeleteCallback(stream.get()));
+  client().CloseBinding();
+  base::RunLoop().RunUntilIdle();
+}
+
+TEST_F(AudioServiceInputStreamTest,
+       ConstructStreamAndResetStreamPtr_DestructsStream) {
+  NiceMock<MockStream> mock_stream;
+  audio_manager().SetMakeInputStreamCB(base::BindRepeating(
+      [](media::AudioInputStream* stream, const media::AudioParameters& params,
+         const std::string& device_id) { return stream; },
+      &mock_stream));
+
+  EXPECT_CALL(mock_stream, Open()).WillOnce(Return(true));
+  EXPECT_CALL(log(), OnCreated(_, _));
+  EXPECT_CALL(*this, CreatedCallback(kValidStream));
+
+  media::mojom::AudioInputStreamPtr stream_ptr;
+  std::unique_ptr<InputStream> stream =
+      CreateStream(mojo::MakeRequest(&stream_ptr), kDoNotEnableAGC);
+  base::RunLoop().RunUntilIdle();
+
+  EXPECT_CALL(mock_stream, Close());
+  EXPECT_CALL(log(), OnClosed());
+  EXPECT_CALL(client(), BindingConnectionError());
+  EXPECT_CALL(*this, DeleteCallback(stream.get()));
+  stream_ptr.reset();
+  base::RunLoop().RunUntilIdle();
+}
+
+TEST_F(AudioServiceInputStreamTest, Record) {
+  NiceMock<MockStream> mock_stream;
+  audio_manager().SetMakeInputStreamCB(base::BindRepeating(
+      [](media::AudioInputStream* stream, const media::AudioParameters& params,
+         const std::string& device_id) { return stream; },
+      &mock_stream));
+
+  EXPECT_CALL(mock_stream, Open()).WillOnce(Return(true));
+  EXPECT_CALL(log(), OnCreated(_, _));
+  EXPECT_CALL(*this, CreatedCallback(kValidStream));
+  media::mojom::AudioInputStreamPtr stream_ptr;
+  std::unique_ptr<InputStream> stream =
+      CreateStream(mojo::MakeRequest(&stream_ptr), kDoNotEnableAGC);
+  base::RunLoop().RunUntilIdle();
+
+  EXPECT_CALL(mock_stream, Start(NotNull()));
+  EXPECT_CALL(log(), OnStarted());
+  stream_ptr->Record();
+  base::RunLoop().RunUntilIdle();
+
+  EXPECT_CALL(mock_stream, Stop());
+  EXPECT_CALL(mock_stream, Close());
+  EXPECT_CALL(log(), OnClosed());
+  EXPECT_CALL(client(), BindingConnectionError());
+  stream.reset();
+  base::RunLoop().RunUntilIdle();
+}
+
+TEST_F(AudioServiceInputStreamTest, SetVolume) {
+  NiceMock<MockStream> mock_stream;
+  audio_manager().SetMakeInputStreamCB(base::BindRepeating(
+      [](media::AudioInputStream* stream, const media::AudioParameters& params,
+         const std::string& device_id) { return stream; },
+      &mock_stream));
+
+  EXPECT_CALL(mock_stream, Open()).WillOnce(Return(true));
+  EXPECT_CALL(log(), OnCreated(_, _));
+  EXPECT_CALL(*this, CreatedCallback(kValidStream));
+  media::mojom::AudioInputStreamPtr stream_ptr;
+  std::unique_ptr<InputStream> stream =
+      CreateStream(mojo::MakeRequest(&stream_ptr), kDoNotEnableAGC);
+  base::RunLoop().RunUntilIdle();
+
+  const double new_volume = 0.618;
+  EXPECT_CALL(mock_stream, SetVolume(new_volume));
+  EXPECT_CALL(log(), OnSetVolume(new_volume));
+  stream_ptr->SetVolume(new_volume);
+  base::RunLoop().RunUntilIdle();
+
+  EXPECT_CALL(mock_stream, Close());
+  EXPECT_CALL(log(), OnClosed());
+  EXPECT_CALL(client(), BindingConnectionError());
+  stream.reset();
+  base::RunLoop().RunUntilIdle();
+}
+
+TEST_F(AudioServiceInputStreamTest, SetNegativeVolume_BadMessage) {
+  NiceMock<MockStream> mock_stream;
+  audio_manager().SetMakeInputStreamCB(base::BindRepeating(
+      [](media::AudioInputStream* stream, const media::AudioParameters& params,
+         const std::string& device_id) { return stream; },
+      &mock_stream));
+
+  EXPECT_CALL(mock_stream, Open()).WillOnce(Return(true));
+  EXPECT_CALL(log(), OnCreated(_, _));
+  EXPECT_CALL(*this, CreatedCallback(kValidStream));
+  media::mojom::AudioInputStreamPtr stream_ptr;
+  std::unique_ptr<InputStream> stream =
+      CreateStream(mojo::MakeRequest(&stream_ptr), kDoNotEnableAGC);
+  base::RunLoop().RunUntilIdle();
+
+  EXPECT_CALL(*this, BadMessageCallback(_));
+  EXPECT_CALL(*this, DeleteCallback(stream.get()));
+  EXPECT_CALL(mock_stream, Close());
+  EXPECT_CALL(log(), OnClosed());
+  EXPECT_CALL(client(), BindingConnectionError());
+  stream_ptr->SetVolume(-0.618);
+  base::RunLoop().RunUntilIdle();
+}
+
+TEST_F(AudioServiceInputStreamTest, SetVolumeGreaterThanOne_BadMessage) {
+  NiceMock<MockStream> mock_stream;
+  audio_manager().SetMakeInputStreamCB(base::BindRepeating(
+      [](media::AudioInputStream* stream, const media::AudioParameters& params,
+         const std::string& device_id) { return stream; },
+      &mock_stream));
+
+  EXPECT_CALL(mock_stream, Open()).WillOnce(Return(true));
+  EXPECT_CALL(log(), OnCreated(_, _));
+  EXPECT_CALL(*this, CreatedCallback(kValidStream));
+  media::mojom::AudioInputStreamPtr stream_ptr;
+  std::unique_ptr<InputStream> stream =
+      CreateStream(mojo::MakeRequest(&stream_ptr), kDoNotEnableAGC);
+  base::RunLoop().RunUntilIdle();
+
+  EXPECT_CALL(*this, BadMessageCallback(_));
+  EXPECT_CALL(mock_stream, Close());
+  EXPECT_CALL(*this, DeleteCallback(stream.get()));
+  EXPECT_CALL(log(), OnClosed());
+  EXPECT_CALL(client(), BindingConnectionError());
+  stream_ptr->SetVolume(1.618);
+  base::RunLoop().RunUntilIdle();
+}
+
+TEST_F(AudioServiceInputStreamTest, CreateStreamWithAGCEnable_PropagateAGC) {
+  NiceMock<MockStream> mock_stream;
+  audio_manager().SetMakeInputStreamCB(base::BindRepeating(
+      [](media::AudioInputStream* stream, const media::AudioParameters& params,
+         const std::string& device_id) { return stream; },
+      &mock_stream));
+
+  EXPECT_CALL(mock_stream, Open()).WillOnce(Return(true));
+  EXPECT_CALL(mock_stream, SetAutomaticGainControl(kDoEnableAGC));
+  EXPECT_CALL(log(), OnCreated(_, _));
+  EXPECT_CALL(*this, CreatedCallback(kValidStream));
+  media::mojom::AudioInputStreamPtr stream_ptr;
+  std::unique_ptr<InputStream> stream =
+      CreateStream(mojo::MakeRequest(&stream_ptr), kDoEnableAGC);
+  base::RunLoop().RunUntilIdle();
+
+  EXPECT_CALL(log(), OnClosed());
+  EXPECT_CALL(mock_stream, Close());
+  EXPECT_CALL(client(), BindingConnectionError());
+  stream.reset();
+  base::RunLoop().RunUntilIdle();
+}
+
+TEST_F(AudioServiceInputStreamTest,
+       ConstructWithStreamCreationFailure_SignalsError) {
+  // By default, MockAudioManager fails to create a stream.
+
+  media::mojom::AudioInputStreamPtr stream_ptr;
+  std::unique_ptr<InputStream> stream =
+      CreateStream(mojo::MakeRequest(&stream_ptr), kDoNotEnableAGC);
+
+  EXPECT_CALL(*this, CreatedCallback(kInvalidStream));
+  EXPECT_CALL(log(), OnError());
+  EXPECT_CALL(client(), OnError());
+  EXPECT_CALL(client(), BindingConnectionError());
+  EXPECT_CALL(*this, DeleteCallback(stream.get()));
+  base::RunLoop().RunUntilIdle();
+}
+
+}  // namespace audio
diff --git a/services/audio/output_stream.h b/services/audio/output_stream.h
index a61ddc7..286e10d 100644
--- a/services/audio/output_stream.h
+++ b/services/audio/output_stream.h
@@ -81,7 +81,7 @@
   mojo::Binding<AudioOutputStream> binding_;
   media::mojom::AudioOutputStreamClientPtr client_;
   media::mojom::AudioOutputStreamObserverAssociatedPtr observer_;
-  scoped_refptr<media::mojom::ThreadSafeAudioLogPtr> log_;
+  const scoped_refptr<media::mojom::ThreadSafeAudioLogPtr> log_;
 
   SyncReader reader_;
   OutputController controller_;
diff --git a/services/audio/output_stream_unittest.cc b/services/audio/output_stream_unittest.cc
index 41feae2..7bbc814 100644
--- a/services/audio/output_stream_unittest.cc
+++ b/services/audio/output_stream_unittest.cc
@@ -31,6 +31,12 @@
 
 namespace audio {
 
+namespace {
+
+// Aliases for use with MockCreatedCallback::Created().
+const bool successfully_ = true;
+const bool unsuccessfully_ = false;
+
 class MockStream : public media::AudioOutputStream {
  public:
   MockStream() {}
@@ -98,13 +104,6 @@
   DISALLOW_COPY_AND_ASSIGN(MockObserver);
 };
 
-// Aliases for use with MockCreatedCallback::Created().
-
-namespace {
-const bool successfully_ = true;
-const bool unsuccessfully_ = false;
-}  // namespace
-
 class MockCreatedCallback {
  public:
   MockCreatedCallback() {}
@@ -122,6 +121,8 @@
   DISALLOW_COPY_AND_ASSIGN(MockCreatedCallback);
 };
 
+}  // namespace
+
 // Instantiates various classes that we're going to want in most test cases.
 class TestEnvironment {
  public:
@@ -133,7 +134,11 @@
     mojo::edk::SetDefaultProcessErrorCallback(bad_message_callback_.Get());
   }
 
-  ~TestEnvironment() { audio_manager_.Shutdown(); }
+  ~TestEnvironment() {
+    audio_manager_.Shutdown();
+    mojo::edk::SetDefaultProcessErrorCallback(
+        mojo::edk::ProcessErrorCallback());
+  }
 
   using MockDeleteCallback = base::MockCallback<OutputStream::DeleteCallback>;
   using MockBadMessageCallback =
@@ -178,7 +183,7 @@
   DISALLOW_COPY_AND_ASSIGN(TestEnvironment);
 };
 
-TEST(OutputStreamTest, ConstructDestruct) {
+TEST(AudioServiceOutputStreamTest, ConstructDestruct) {
   TestEnvironment env;
   MockStream mock_stream;
   EXPECT_CALL(env.created_callback(), Created(successfully_));
@@ -204,7 +209,8 @@
   base::RunLoop().RunUntilIdle();
 }
 
-TEST(OutputStreamTest, ConstructStreamAndDestructObserver_DestructsStream) {
+TEST(AudioServiceOutputStreamTest,
+     ConstructStreamAndDestructObserver_DestructsStream) {
   TestEnvironment env;
   MockStream mock_stream;
   env.audio_manager().SetMakeOutputStreamCB(base::BindRepeating(
@@ -231,7 +237,8 @@
   Mock::VerifyAndClear(&env.client());
 }
 
-TEST(OutputStreamTest, ConstructStreamAndDestructClient_DestructsStream) {
+TEST(AudioServiceOutputStreamTest,
+     ConstructStreamAndDestructClient_DestructsStream) {
   TestEnvironment env;
   MockStream mock_stream;
   env.audio_manager().SetMakeOutputStreamCB(base::BindRepeating(
@@ -258,7 +265,8 @@
   Mock::VerifyAndClear(&env.observer());
 }
 
-TEST(OutputStreamTest, ConstructStreamAndReleaseStreamPtr_DestructsStream) {
+TEST(AudioServiceOutputStreamTest,
+     ConstructStreamAndReleaseStreamPtr_DestructsStream) {
   TestEnvironment env;
   MockStream mock_stream;
   env.audio_manager().SetMakeOutputStreamCB(base::BindRepeating(
@@ -287,7 +295,7 @@
   Mock::VerifyAndClear(&env.observer());
 }
 
-TEST(OutputStreamTest, Play_Plays) {
+TEST(AudioServiceOutputStreamTest, Play_Plays) {
   TestEnvironment env;
   MockStream mock_stream;
   EXPECT_CALL(env.created_callback(), Created(successfully_));
@@ -325,7 +333,7 @@
   base::RunLoop().RunUntilIdle();
 }
 
-TEST(OutputStreamTest, PlayAndPause_PlaysAndStops) {
+TEST(AudioServiceOutputStreamTest, PlayAndPause_PlaysAndStops) {
   TestEnvironment env;
   MockStream mock_stream;
   EXPECT_CALL(env.created_callback(), Created(successfully_));
@@ -368,7 +376,7 @@
   base::RunLoop().RunUntilIdle();
 }
 
-TEST(OutputStreamTest, SetVolume_SetsVolume) {
+TEST(AudioServiceOutputStreamTest, SetVolume_SetsVolume) {
   double new_volume = 0.618;
   TestEnvironment env;
   MockStream mock_stream;
@@ -399,7 +407,7 @@
   base::RunLoop().RunUntilIdle();
 }
 
-TEST(OutputStreamTest, SetNegativeVolume_BadMessage) {
+TEST(AudioServiceOutputStreamTest, SetNegativeVolume_BadMessage) {
   TestEnvironment env;
   MockStream mock_stream;
   EXPECT_CALL(env.created_callback(), Created(successfully_));
@@ -424,7 +432,7 @@
   base::RunLoop().RunUntilIdle();
 }
 
-TEST(OutputStreamTest, SetVolumeGreaterThanOne_BadMessage) {
+TEST(AudioServiceOutputStreamTest, SetVolumeGreaterThanOne_BadMessage) {
   TestEnvironment env;
   MockStream mock_stream;
   EXPECT_CALL(env.created_callback(), Created(successfully_));
@@ -449,7 +457,8 @@
   base::RunLoop().RunUntilIdle();
 }
 
-TEST(OutputStreamTest, ConstructWithStreamCreationFailure_SignalsError) {
+TEST(AudioServiceOutputStreamTest,
+     ConstructWithStreamCreationFailure_SignalsError) {
   TestEnvironment env;
 
   // By default, the MockAudioManager fails to create a stream.
@@ -466,7 +475,7 @@
   Mock::VerifyAndClear(&env.observer());
 }
 
-TEST(OutputStreamTest,
+TEST(AudioServiceOutputStreamTest,
      ConstructWithStreamCreationFailureAndDestructBeforeErrorFires_NoCrash) {
   // The main purpose of this test is to make sure that that delete callback
   // call is deferred, and that it is canceled in case of destruction.
diff --git a/services/network/cors/preflight_controller.cc b/services/network/cors/preflight_controller.cc
index 466d9f4..4978e413c 100644
--- a/services/network/cors/preflight_controller.cc
+++ b/services/network/cors/preflight_controller.cc
@@ -6,9 +6,13 @@
 
 #include <algorithm>
 
+#include "base/bind.h"
 #include "base/strings/string_util.h"
 #include "net/http/http_request_headers.h"
 #include "services/network/public/cpp/cors/cors.h"
+#include "services/network/public/cpp/cors/cors_error_status.h"
+#include "services/network/public/cpp/resource_request.h"
+#include "services/network/public/cpp/simple_url_loader.h"
 #include "url/gurl.h"
 
 namespace network {
@@ -17,6 +21,15 @@
 
 namespace {
 
+base::Optional<std::string> GetHeaderString(
+    const scoped_refptr<net::HttpResponseHeaders>& headers,
+    const std::string& header_name) {
+  std::string header_value;
+  if (!headers->GetNormalizedHeader(header_name, &header_value))
+    return base::nullopt;
+  return header_value;
+}
+
 // Algorithm step 3 of the CORS-preflight fetch,
 // https://fetch.spec.whatwg.org/#cors-preflight-fetch-0, that requires
 //  - CORS-safelisted request-headers excluded
@@ -46,10 +59,7 @@
   return base::JoinString(filtered_headers, ",");
 }
 
-}  // namespace
-
-// static
-std::unique_ptr<ResourceRequest> PreflightController::CreatePreflightRequest(
+std::unique_ptr<ResourceRequest> CreatePreflightRequest(
     const ResourceRequest& request) {
   DCHECK(!request.url.has_username());
   DCHECK(!request.url.has_password());
@@ -96,6 +106,166 @@
   return preflight_request;
 }
 
+}  // namespace
+
+class PreflightController::PreflightLoader final {
+ public:
+  PreflightLoader(PreflightController* controller,
+                  CompletionCallback completion_callback,
+                  const ResourceRequest& request,
+                  const net::NetworkTrafficAnnotationTag& annotation_tag)
+      : controller_(controller),
+        completion_callback_(std::move(completion_callback)),
+        origin_(*request.request_initiator),
+        url_(request.url),
+        credentials_mode_(request.fetch_credentials_mode) {
+    loader_ = SimpleURLLoader::Create(CreatePreflightRequest(request),
+                                      annotation_tag);
+  }
+
+  void Request(mojom::URLLoaderFactory* loader_factory) {
+    DCHECK(loader_);
+
+    loader_->SetOnRedirectCallback(base::BindRepeating(
+        &PreflightLoader::HandleRedirect, base::Unretained(this)));
+    loader_->SetOnResponseStartedCallback(base::BindRepeating(
+        &PreflightLoader::HandleResponseHeader, base::Unretained(this)));
+    loader_->DownloadToString(
+        loader_factory,
+        base::BindOnce(&PreflightLoader::HandleResponseBody,
+                       base::Unretained(this)),
+        0);
+  }
+
+ private:
+  void HandleRedirect(const net::RedirectInfo& redirect_info,
+                      const network::ResourceResponseHead& response_head) {
+    // Preflight should not allow any redirect.
+    FinalizeLoader();
+
+    // TODO(toyoshim): Define kDisallowedPreflightRedirect in a separate patch.
+    std::move(completion_callback_)
+        .Run(CORSErrorStatus(mojom::CORSError::kPreflightInvalidStatus));
+
+    RemoveFromController();
+    // |this| is deleted here.
+  }
+
+  void HandleResponseHeader(const GURL& final_url,
+                            const ResourceResponseHead& head) {
+    FinalizeLoader();
+
+    base::Optional<mojom::CORSError> error =
+        CheckPreflight(head.headers->response_code());
+
+    if (!error) {
+      // TODO(toyoshim): Reflect --allow-file-access-from-files flag.
+      error = CheckAccess(
+          final_url, head.headers->response_code(),
+          GetHeaderString(head.headers,
+                          cors::header_names::kAccessControlAllowOrigin),
+          GetHeaderString(head.headers,
+                          cors::header_names::kAccessControlAllowCredentials),
+          credentials_mode_, origin_, false /* allow_file_origin */);
+    }
+
+    // TODO(toyoshim): Add remaining checks before or after the following check.
+    // See DocumentThreadableLoader::HandlePreflightResponse() and
+    // CORS::EnsurePreflightResultAndCacheOnSuccess() in Blink.
+
+    if (!error) {
+      result_ = PreflightResult::Create(
+          credentials_mode_,
+          GetHeaderString(head.headers,
+                          header_names::kAccessControlAllowMethods),
+          GetHeaderString(head.headers,
+                          header_names::kAccessControlAllowHeaders),
+          GetHeaderString(head.headers, header_names::kAccessControlMaxAge),
+          &error);
+    }
+
+    if (!error) {
+      DCHECK(result_);
+      controller_->AppendToCache(origin_, url_, std::move(result_));
+      std::move(completion_callback_).Run(base::nullopt);
+    } else {
+      std::move(completion_callback_).Run(CORSErrorStatus(*error));
+    }
+    RemoveFromController();
+    // |this| is deleted here.
+  }
+
+  void HandleResponseBody(std::unique_ptr<std::string> response_body) {
+    NOTREACHED();
+  }
+
+  void FinalizeLoader() {
+    DCHECK(loader_);
+    loader_.reset();
+  }
+
+  // Removes |this| instance from |controller_|. Once the method returns, |this|
+  // is already removed.
+  void RemoveFromController() { controller_->RemoveLoader(this); }
+
+  // PreflightController owns all PreflightLoader instances, and should outlive.
+  PreflightController* const controller_;
+
+  std::unique_ptr<SimpleURLLoader> loader_;
+  PreflightController::CompletionCallback completion_callback_;
+
+  const url::Origin origin_;
+  const GURL url_;
+  const mojom::FetchCredentialsMode credentials_mode_;
+
+  std::unique_ptr<PreflightResult> result_;
+
+  DISALLOW_COPY_AND_ASSIGN(PreflightLoader);
+};
+
+// static
+std::unique_ptr<ResourceRequest>
+PreflightController::CreatePreflightRequestForTesting(
+    const ResourceRequest& request) {
+  return CreatePreflightRequest(request);
+}
+
+PreflightController::PreflightController() = default;
+
+PreflightController::~PreflightController() = default;
+
+void PreflightController::PerformPreflightCheck(
+    CompletionCallback callback,
+    const ResourceRequest& request,
+    const net::NetworkTrafficAnnotationTag& annotation_tag,
+    mojom::URLLoaderFactory* loader_factory) {
+  DCHECK(request.request_initiator);
+
+  if (cache_.CheckIfRequestCanSkipPreflight(
+          request.request_initiator->Serialize(), request.url,
+          request.fetch_credentials_mode, request.method, request.headers)) {
+    std::move(callback).Run(base::nullopt);
+    return;
+  }
+
+  auto emplaced_pair = loaders_.emplace(std::make_unique<PreflightLoader>(
+      this, std::move(callback), request, annotation_tag));
+  (*emplaced_pair.first)->Request(loader_factory);
+}
+
+void PreflightController::RemoveLoader(PreflightLoader* loader) {
+  auto it = loaders_.find(loader);
+  DCHECK(it != loaders_.end());
+  loaders_.erase(it);
+}
+
+void PreflightController::AppendToCache(
+    const url::Origin& origin,
+    const GURL& url,
+    std::unique_ptr<PreflightResult> result) {
+  cache_.AppendEntry(origin.Serialize(), url, std::move(result));
+}
+
 }  // namespace cors
 
 }  // namespace network
diff --git a/services/network/cors/preflight_controller.h b/services/network/cors/preflight_controller.h
index 40f4809..7d2bbd7 100644
--- a/services/network/cors/preflight_controller.h
+++ b/services/network/cors/preflight_controller.h
@@ -6,9 +6,21 @@
 #define SERVICES_NETWORK_CORS_PREFLIGHT_CONTROLLER_H_
 
 #include <memory>
+#include <string>
 
+#include "base/callback.h"
 #include "base/component_export.h"
+#include "base/containers/unique_ptr_adapters.h"
+#include "base/macros.h"
+#include "base/optional.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
+#include "services/network/public/cpp/cors/cors_error_status.h"
+#include "services/network/public/cpp/cors/preflight_cache.h"
+#include "services/network/public/cpp/cors/preflight_result.h"
 #include "services/network/public/cpp/resource_request.h"
+#include "services/network/public/mojom/fetch_api.mojom.h"
+#include "services/network/public/mojom/url_loader_factory.mojom.h"
+#include "url/gurl.h"
 
 namespace network {
 
@@ -18,18 +30,40 @@
 // its result, and owning a CORS-preflight cache.
 // TODO(toyoshim): Features explained above not fully implemented yet.
 // See also https://crbug.com/803766 to check a design doc.
-class COMPONENT_EXPORT(NETWORK_SERVICE) PreflightController {
+class COMPONENT_EXPORT(NETWORK_SERVICE) PreflightController final {
  public:
+  using CompletionCallback =
+      base::OnceCallback<void(base::Optional<CORSErrorStatus>)>;
   // Creates a CORS-preflight ResourceRequest for a specified |request| for a
   // URL that is originally requested.
-  // Note: This function is exposed for testing only purpose, and production
-  // code outside this class should not call this function directly.
-  static std::unique_ptr<ResourceRequest> CreatePreflightRequest(
+  static std::unique_ptr<ResourceRequest> CreatePreflightRequestForTesting(
       const ResourceRequest& request);
 
-  // TODO(toyoshim): Implements an asynchronous interface to consult about
-  // CORS-preflight check, that manages a preflight cache, and may make a
-  // preflight request internally.
+  PreflightController();
+  ~PreflightController();
+
+  // Determines if a CORS-preflight request is needed, and checks the cache, or
+  // makes a preflight request if it is needed. A result will be notified
+  // synchronously or asynchronously.
+  void PerformPreflightCheck(
+      CompletionCallback callback,
+      const ResourceRequest& resource_request,
+      const net::NetworkTrafficAnnotationTag& traffic_annotation,
+      mojom::URLLoaderFactory* loader_factory);
+
+ private:
+  class PreflightLoader;
+
+  void RemoveLoader(PreflightLoader* loader);
+  void AppendToCache(const url::Origin& origin,
+                     const GURL& url,
+                     std::unique_ptr<PreflightResult> result);
+
+  PreflightCache cache_;
+  std::set<std::unique_ptr<PreflightLoader>, base::UniquePtrComparator>
+      loaders_;
+
+  DISALLOW_COPY_AND_ASSIGN(PreflightController);
 };
 
 }  // namespace cors
diff --git a/services/network/cors/preflight_controller_unittest.cc b/services/network/cors/preflight_controller_unittest.cc
index 2b58d21..9d945fef 100644
--- a/services/network/cors/preflight_controller_unittest.cc
+++ b/services/network/cors/preflight_controller_unittest.cc
@@ -4,8 +4,20 @@
 
 #include "services/network/cors/preflight_controller.h"
 
+#include <memory>
+
+#include "base/run_loop.h"
+#include "base/test/scoped_task_environment.h"
 #include "net/http/http_request_headers.h"
+#include "net/test/embedded_test_server/embedded_test_server.h"
+#include "net/test/embedded_test_server/http_request.h"
+#include "net/test/embedded_test_server/http_response.h"
+#include "net/test/embedded_test_server/request_handler_util.h"
+#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "services/network/network_service.h"
 #include "services/network/public/cpp/cors/cors.h"
+#include "services/network/public/mojom/network_service.mojom.h"
+#include "services/network/public/mojom/url_loader_factory.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/origin.h"
 
@@ -21,11 +33,12 @@
   request.headers.SetHeader("Orange", "Orange");
   request.headers.SetHeader("Apple", "Red");
   request.headers.SetHeader("Kiwifruit", "Green");
-  request.headers.SetHeader("Content-Type", "application/octet-stream");
+  request.headers.SetHeader(net::HttpRequestHeaders::kContentType,
+                            "application/octet-stream");
   request.headers.SetHeader("Strawberry", "Red");
 
   std::unique_ptr<ResourceRequest> preflight =
-      PreflightController::CreatePreflightRequest(request);
+      PreflightController::CreatePreflightRequestForTesting(request);
 
   std::string header;
   EXPECT_TRUE(
@@ -41,12 +54,13 @@
   ResourceRequest request;
   request.request_initiator = url::Origin();
   request.headers.SetHeader("Accept", "everything");
-  request.headers.SetHeader("Accept-Language", "everything");
+  request.headers.SetHeader(net::HttpRequestHeaders::kAcceptLanguage,
+                            "everything");
   request.headers.SetHeader("Content-Language", "everything");
   request.headers.SetHeader("Save-Data", "on");
 
   std::unique_ptr<ResourceRequest> preflight =
-      PreflightController::CreatePreflightRequest(request);
+      PreflightController::CreatePreflightRequestForTesting(request);
 
   // Do not emit empty-valued headers; an empty list of non-"CORS safelisted"
   // request headers should cause "Access-Control-Request-Headers:" to be
@@ -60,10 +74,11 @@
      ExcludeSimpleContentTypeHeader) {
   ResourceRequest request;
   request.request_initiator = url::Origin();
-  request.headers.SetHeader("Content-Type", "text/plain");
+  request.headers.SetHeader(net::HttpRequestHeaders::kContentType,
+                            "text/plain");
 
   std::unique_ptr<ResourceRequest> preflight =
-      PreflightController::CreatePreflightRequest(request);
+      PreflightController::CreatePreflightRequestForTesting(request);
 
   // Empty list also; see comment in test above.
   std::string header;
@@ -77,7 +92,7 @@
   request.headers.SetHeader("X-Custom-Header", "foobar");
 
   std::unique_ptr<ResourceRequest> preflight =
-      PreflightController::CreatePreflightRequest(request);
+      PreflightController::CreatePreflightRequestForTesting(request);
 
   std::string header;
   EXPECT_TRUE(preflight->headers.GetHeader(
@@ -89,10 +104,11 @@
      IncludeNonSimpleContentTypeHeader) {
   ResourceRequest request;
   request.request_initiator = url::Origin();
-  request.headers.SetHeader("Content-Type", "application/octet-stream");
+  request.headers.SetHeader(net::HttpRequestHeaders::kContentType,
+                            "application/octet-stream");
 
   std::unique_ptr<ResourceRequest> preflight =
-      PreflightController::CreatePreflightRequest(request);
+      PreflightController::CreatePreflightRequestForTesting(request);
 
   std::string header;
   EXPECT_TRUE(preflight->headers.GetHeader(
@@ -106,13 +122,127 @@
   request.headers.SetHeader("referer", "https://www.google.com/");
 
   std::unique_ptr<ResourceRequest> preflight =
-      PreflightController::CreatePreflightRequest(request);
+      PreflightController::CreatePreflightRequestForTesting(request);
 
   std::string header;
   EXPECT_FALSE(preflight->headers.GetHeader(
       cors::header_names::kAccessControlRequestHeaders, &header));
 }
 
+class PreflightControllerTest : public testing::Test {
+ public:
+  PreflightControllerTest()
+      : scoped_task_environment_(
+            base::test::ScopedTaskEnvironment::MainThreadType::IO) {
+    mojom::NetworkServicePtr network_service_ptr;
+    mojom::NetworkServiceRequest network_service_request =
+        mojo::MakeRequest(&network_service_ptr);
+    network_service_ = NetworkService::Create(
+        std::move(network_service_request), nullptr /* net_log */);
+
+    network_service_ptr->CreateNetworkContext(
+        mojo::MakeRequest(&network_context_ptr_),
+        mojom::NetworkContextParams::New());
+
+    network_context_ptr_->CreateURLLoaderFactory(
+        mojo::MakeRequest(&url_loader_factory_ptr_), 0 /* process_id */);
+  }
+
+ protected:
+  void HandleRequestCompletion(base::Optional<CORSErrorStatus> status) {
+    status_ = status;
+    run_loop_->Quit();
+  }
+
+  GURL GetURL(const std::string& path) { return test_server_.GetURL(path); }
+
+  void PerformPreflightCheck(const ResourceRequest& request) {
+    DCHECK(preflight_controller_);
+    run_loop_ = std::make_unique<base::RunLoop>();
+    preflight_controller_->PerformPreflightCheck(
+        base::BindOnce(&PreflightControllerTest::HandleRequestCompletion,
+                       base::Unretained(this)),
+        request, TRAFFIC_ANNOTATION_FOR_TESTS, url_loader_factory_ptr_.get());
+    run_loop_->Run();
+  }
+
+  base::Optional<CORSErrorStatus> status() { return status_; }
+  base::Optional<CORSErrorStatus> success() { return base::nullopt; }
+  size_t access_count() { return access_count_; }
+
+ private:
+  void SetUp() override {
+    preflight_controller_ = std::make_unique<PreflightController>();
+
+    test_server_.RegisterRequestHandler(base::BindRepeating(
+        &PreflightControllerTest::ServePreflight, base::Unretained(this)));
+
+    EXPECT_TRUE(test_server_.Start());
+  }
+
+  std::unique_ptr<net::test_server::HttpResponse> ServePreflight(
+      const net::test_server::HttpRequest& request) {
+    access_count_++;
+    std::unique_ptr<net::test_server::BasicHttpResponse> response;
+    if (request.method != net::test_server::METHOD_OPTIONS)
+      return response;
+
+    response = std::make_unique<net::test_server::BasicHttpResponse>();
+    if (net::test_server::ShouldHandle(request, "/404")) {
+      response->set_code(net::HTTP_NOT_FOUND);
+    } else if (net::test_server::ShouldHandle(request, "/allow")) {
+      response->set_code(net::HTTP_OK);
+      url::Origin origin = url::Origin::Create(test_server_.base_url());
+      response->AddCustomHeader(cors::header_names::kAccessControlAllowOrigin,
+                                origin.Serialize());
+      response->AddCustomHeader(header_names::kAccessControlAllowMethods,
+                                "GET, OPTIONS");
+      response->AddCustomHeader(header_names::kAccessControlMaxAge, "1000");
+      response->AddCustomHeader(net::HttpRequestHeaders::kCacheControl,
+                                "no-store");
+    }
+    return response;
+  }
+
+  base::test::ScopedTaskEnvironment scoped_task_environment_;
+  std::unique_ptr<base::RunLoop> run_loop_;
+
+  std::unique_ptr<mojom::NetworkService> network_service_;
+  mojom::NetworkContextPtr network_context_ptr_;
+  mojom::URLLoaderFactoryPtr url_loader_factory_ptr_;
+
+  net::test_server::EmbeddedTestServer test_server_;
+  size_t access_count_ = 0;
+
+  std::unique_ptr<PreflightController> preflight_controller_;
+  base::Optional<CORSErrorStatus> status_;
+};
+
+TEST_F(PreflightControllerTest, CheckInvalidRequest) {
+  ResourceRequest request;
+  request.url = GetURL("/404");
+  request.request_initiator = url::Origin::Create(request.url);
+
+  PerformPreflightCheck(request);
+  ASSERT_TRUE(status());
+  EXPECT_EQ(mojom::CORSError::kPreflightInvalidStatus, status()->cors_error);
+  EXPECT_EQ(1u, access_count());
+}
+
+TEST_F(PreflightControllerTest, CheckValidRequest) {
+  ResourceRequest request;
+  request.url = GetURL("/allow");
+  request.request_initiator = url::Origin::Create(request.url);
+
+  PerformPreflightCheck(request);
+  ASSERT_FALSE(status());
+  EXPECT_EQ(1u, access_count());
+
+  PerformPreflightCheck(request);
+  ASSERT_FALSE(status());
+  EXPECT_EQ(1u, access_count());  // Should be from the preflight cache.
+}
+
 }  // namespace
 
 }  // namespace cors
diff --git a/services/network/public/cpp/cors/cors.cc b/services/network/public/cpp/cors/cors.cc
index d1c607eb..6dfd3af 100644
--- a/services/network/public/cpp/cors/cors.cc
+++ b/services/network/public/cpp/cors/cors.cc
@@ -63,7 +63,10 @@
 
 const char kAccessControlAllowCredentials[] =
     "Access-Control-Allow-Credentials";
+const char kAccessControlAllowHeaders[] = "Access-Control-Allow-Headers";
+const char kAccessControlAllowMethods[] = "Access-Control-Allow-Methods";
 const char kAccessControlAllowOrigin[] = "Access-Control-Allow-Origin";
+const char kAccessControlMaxAge[] = "Access-Control-Max-Age";
 const char kAccessControlRequestExternal[] = "Access-Control-Request-External";
 const char kAccessControlRequestHeaders[] = "Access-Control-Request-Headers";
 const char kAccessControlRequestMethod[] = "Access-Control-Request-Method";
diff --git a/services/network/public/cpp/cors/cors.h b/services/network/public/cpp/cors/cors.h
index c4a58fb..4ca51758 100644
--- a/services/network/public/cpp/cors/cors.h
+++ b/services/network/public/cpp/cors/cors.h
@@ -26,8 +26,14 @@
 COMPONENT_EXPORT(NETWORK_CPP)
 extern const char kAccessControlAllowCredentials[];
 COMPONENT_EXPORT(NETWORK_CPP)
+extern const char kAccessControlAllowHeaders[];
+COMPONENT_EXPORT(NETWORK_CPP)
+extern const char kAccessControlAllowMethods[];
+COMPONENT_EXPORT(NETWORK_CPP)
 extern const char kAccessControlAllowOrigin[];
 COMPONENT_EXPORT(NETWORK_CPP)
+extern const char kAccessControlMaxAge[];
+COMPONENT_EXPORT(NETWORK_CPP)
 extern const char kAccessControlRequestExternal[];
 COMPONENT_EXPORT(NETWORK_CPP)
 extern const char kAccessControlRequestHeaders[];
diff --git a/services/network/public/mojom/cors.mojom b/services/network/public/mojom/cors.mojom
index d1bc1b1..e3730ecf 100644
--- a/services/network/public/mojom/cors.mojom
+++ b/services/network/public/mojom/cors.mojom
@@ -23,7 +23,9 @@
   kDisallowCredentialsNotSetToTrue,
 
   // Preflight
+  // Failed to check HTTP response ok status in CORS-preflight response.
   kPreflightInvalidStatus,
+
   // "Access-Control-Allow-External:"
   // ( https://wicg.github.io/cors-rfc1918/#headers ) specific error
   // conditions:
diff --git a/services/resource_coordinator/memory_instrumentation/coordinator_impl_unittest.cc b/services/resource_coordinator/memory_instrumentation/coordinator_impl_unittest.cc
index 365417e..70f8284 100644
--- a/services/resource_coordinator/memory_instrumentation/coordinator_impl_unittest.cc
+++ b/services/resource_coordinator/memory_instrumentation/coordinator_impl_unittest.cc
@@ -168,7 +168,7 @@
             }));
 
     ON_CALL(*this, RequestOSMemoryDump(_, _, _))
-        .WillByDefault(Invoke([](bool want_mmaps,
+        .WillByDefault(Invoke([](mojom::MemoryMapOption,
                                  const std::vector<base::ProcessId> pids,
                                  const RequestOSMemoryDumpCallback& callback) {
           std::unordered_map<base::ProcessId, mojom::RawOSMemDumpPtr> results;
@@ -183,7 +183,7 @@
                     const RequestChromeMemoryDumpCallback& callback));
 
   MOCK_METHOD3(RequestOSMemoryDump,
-               void(bool want_mmaps,
+               void(mojom::MemoryMapOption option,
                     const std::vector<base::ProcessId>& args,
                     const RequestOSMemoryDumpCallback& callback));
 
@@ -324,7 +324,7 @@
 
   EXPECT_CALL(client_process, RequestOSMemoryDump(_, _, _))
       .WillOnce(Invoke(
-          [](bool want_mmaps, const std::vector<base::ProcessId>& pids,
+          [](mojom::MemoryMapOption, const std::vector<base::ProcessId>& pids,
              const MockClientProcess::RequestOSMemoryDumpCallback& callback) {
             std::unordered_map<base::ProcessId, mojom::RawOSMemDumpPtr> results;
             callback.Run(true, std::move(results));
@@ -391,7 +391,7 @@
               RequestOSMemoryDump(
                   _, AllOf(Contains(kBrowserPid), Contains(kRendererPid)), _))
       .WillOnce(Invoke(
-          [](bool want_mmaps, const std::vector<base::ProcessId>& pids,
+          [](mojom::MemoryMapOption, const std::vector<base::ProcessId>& pids,
              const MockClientProcess::RequestOSMemoryDumpCallback& callback) {
             std::unordered_map<base::ProcessId, mojom::RawOSMemDumpPtr> results;
             results[kBrowserPid] = FillRawOSDump(kBrowserPid);
@@ -402,7 +402,7 @@
 #else
   EXPECT_CALL(browser_client, RequestOSMemoryDump(_, Contains(0), _))
       .WillOnce(Invoke(
-          [](bool want_mmaps, const std::vector<base::ProcessId>& pids,
+          [](mojom::MemoryMapOption, const std::vector<base::ProcessId>& pids,
              const MockClientProcess::RequestOSMemoryDumpCallback& callback) {
             std::unordered_map<base::ProcessId, mojom::RawOSMemDumpPtr> results;
             results[0] = FillRawOSDump(kBrowserPid);
@@ -410,7 +410,7 @@
           }));
   EXPECT_CALL(renderer_client, RequestOSMemoryDump(_, Contains(0), _))
       .WillOnce(Invoke(
-          [](bool want_mmaps, const std::vector<base::ProcessId>& pids,
+          [](mojom::MemoryMapOption, const std::vector<base::ProcessId>& pids,
              const MockClientProcess::RequestOSMemoryDumpCallback& callback) {
             std::unordered_map<base::ProcessId, mojom::RawOSMemDumpPtr> results;
             results[0] = FillRawOSDump(kRendererPid);
@@ -570,7 +570,7 @@
   EXPECT_CALL(browser_client,
               RequestOSMemoryDump(_, AllOf(Contains(1), Contains(2)), _))
       .WillOnce(Invoke(
-          [](bool want_mmaps, const std::vector<base::ProcessId>& pids,
+          [](mojom::MemoryMapOption, const std::vector<base::ProcessId>& pids,
              const MockClientProcess::RequestOSMemoryDumpCallback& callback) {
             std::unordered_map<base::ProcessId, mojom::RawOSMemDumpPtr> results;
             results[1] = mojom::RawOSMemDump::New();
@@ -587,7 +587,7 @@
 #else
   EXPECT_CALL(browser_client, RequestOSMemoryDump(_, Contains(0), _))
       .WillOnce(Invoke(
-          [](bool want_mmaps, const std::vector<base::ProcessId>& pids,
+          [](mojom::MemoryMapOption, const std::vector<base::ProcessId>& pids,
              const MockClientProcess::RequestOSMemoryDumpCallback& callback) {
             std::unordered_map<base::ProcessId, mojom::RawOSMemDumpPtr> results;
             results[0] = mojom::RawOSMemDump::New();
@@ -598,7 +598,7 @@
           }));
   EXPECT_CALL(renderer_client, RequestOSMemoryDump(_, Contains(0), _))
       .WillOnce(Invoke(
-          [](bool want_mmaps, const std::vector<base::ProcessId>& pids,
+          [](mojom::MemoryMapOption, const std::vector<base::ProcessId>& pids,
              const MockClientProcess::RequestOSMemoryDumpCallback& callback) {
             std::unordered_map<base::ProcessId, mojom::RawOSMemDumpPtr> results;
             results[0] = mojom::RawOSMemDump::New();
@@ -652,12 +652,11 @@
 // On Linux, all memory dumps come from the browser client. On all other
 // platforms, they are expected to come from each individual client.
 #if defined(OS_LINUX)
-  EXPECT_CALL(
-      browser_client,
-      RequestOSMemoryDump(
-          true, AllOf(Contains(kBrowserPid), Contains(kRendererPid)), _))
+  EXPECT_CALL(browser_client,
+              RequestOSMemoryDump(
+                  _, AllOf(Contains(kBrowserPid), Contains(kRendererPid)), _))
       .WillOnce(Invoke(
-          [](bool want_mmaps, const std::vector<base::ProcessId>& pids,
+          [](mojom::MemoryMapOption, const std::vector<base::ProcessId>& pids,
              const MockClientProcess::RequestOSMemoryDumpCallback& callback) {
             std::unordered_map<base::ProcessId, mojom::RawOSMemDumpPtr> results;
             results[kBrowserPid] = FillRawOSDump(kBrowserPid);
@@ -668,7 +667,7 @@
 #else
   EXPECT_CALL(browser_client, RequestOSMemoryDump(_, Contains(0), _))
       .WillOnce(Invoke(
-          [](bool want_mmaps, const std::vector<base::ProcessId>& pids,
+          [](mojom::MemoryMapOption, const std::vector<base::ProcessId>& pids,
              const MockClientProcess::RequestOSMemoryDumpCallback& callback) {
             std::unordered_map<base::ProcessId, mojom::RawOSMemDumpPtr> results;
             results[0] = FillRawOSDump(kBrowserPid);
@@ -676,7 +675,7 @@
           }));
   EXPECT_CALL(renderer_client, RequestOSMemoryDump(_, Contains(0), _))
       .WillOnce(Invoke(
-          [](bool want_mmaps, const std::vector<base::ProcessId>& pids,
+          [](mojom::MemoryMapOption, const std::vector<base::ProcessId>& pids,
              const MockClientProcess::RequestOSMemoryDumpCallback& callback) {
             std::unordered_map<base::ProcessId, mojom::RawOSMemDumpPtr> results;
             results[0] = FillRawOSDump(kRendererPid);
@@ -819,21 +818,21 @@
 #if defined(OS_LINUX)
   EXPECT_CALL(client_process_1, RequestOSMemoryDump(_, _, _))
       .WillOnce(Invoke(
-          [](bool want_mmaps, const std::vector<base::ProcessId>& pids,
+          [](mojom::MemoryMapOption, const std::vector<base::ProcessId>& pids,
              const MockClientProcess::RequestOSMemoryDumpCallback& callback) {
             std::unordered_map<base::ProcessId, mojom::RawOSMemDumpPtr> results;
             results[kBrowserPid] = FillRawOSDump(kBrowserPid);
             callback.Run(true, std::move(results));
           }))
       .WillOnce(Invoke(
-          [](bool want_mmaps, const std::vector<base::ProcessId>& pids,
+          [](mojom::MemoryMapOption, const std::vector<base::ProcessId>& pids,
              const MockClientProcess::RequestOSMemoryDumpCallback& callback) {
             std::unordered_map<base::ProcessId, mojom::RawOSMemDumpPtr> results;
             results[kRendererPid] = FillRawOSDump(kRendererPid);
             callback.Run(true, std::move(results));
           }))
       .WillOnce(Invoke(
-          [](bool want_mmaps, const std::vector<base::ProcessId>& pids,
+          [](mojom::MemoryMapOption, const std::vector<base::ProcessId>& pids,
              const MockClientProcess::RequestOSMemoryDumpCallback& callback) {
             std::unordered_map<base::ProcessId, mojom::RawOSMemDumpPtr> results;
             results[kGpuPid] = FillRawOSDump(kGpuPid);
@@ -842,7 +841,7 @@
 #else
   EXPECT_CALL(client_process_1, RequestOSMemoryDump(_, Contains(0), _))
       .WillOnce(Invoke(
-          [](bool want_mmaps, const std::vector<base::ProcessId>& pids,
+          [](mojom::MemoryMapOption, const std::vector<base::ProcessId>& pids,
              const MockClientProcess::RequestOSMemoryDumpCallback& callback) {
             std::unordered_map<base::ProcessId, mojom::RawOSMemDumpPtr> results;
             results[0] = FillRawOSDump(kBrowserPid);
@@ -850,7 +849,7 @@
           }));
   EXPECT_CALL(client_process_2, RequestOSMemoryDump(_, Contains(0), _))
       .WillOnce(Invoke(
-          [](bool want_mmaps, const std::vector<base::ProcessId>& pids,
+          [](mojom::MemoryMapOption, const std::vector<base::ProcessId>& pids,
              const MockClientProcess::RequestOSMemoryDumpCallback& callback) {
             std::unordered_map<base::ProcessId, mojom::RawOSMemDumpPtr> results;
             results[0] = FillRawOSDump(kRendererPid);
@@ -858,7 +857,7 @@
           }));
   EXPECT_CALL(client_process_3, RequestOSMemoryDump(_, Contains(0), _))
       .WillOnce(Invoke(
-          [](bool want_mmaps, const std::vector<base::ProcessId>& pids,
+          [](mojom::MemoryMapOption, const std::vector<base::ProcessId>& pids,
              const MockClientProcess::RequestOSMemoryDumpCallback& callback) {
             std::unordered_map<base::ProcessId, mojom::RawOSMemDumpPtr> results;
             results[0] = FillRawOSDump(kGpuPid);
diff --git a/services/resource_coordinator/memory_instrumentation/queued_request.h b/services/resource_coordinator/memory_instrumentation/queued_request.h
index 155c839..2924146e 100644
--- a/services/resource_coordinator/memory_instrumentation/queued_request.h
+++ b/services/resource_coordinator/memory_instrumentation/queued_request.h
@@ -74,18 +74,11 @@
 
   base::trace_event::MemoryDumpRequestArgs GetRequestArgs();
 
-  bool wants_mmaps() const {
-    return args.level_of_detail == base::trace_event::MemoryDumpLevelOfDetail::
-                                       VM_REGIONS_ONLY_FOR_HEAP_PROFILER ||
-           args.level_of_detail ==
-               base::trace_event::MemoryDumpLevelOfDetail::DETAILED;
-  }
-
-  // We always want to return chrome dumps, with exception of the special
-  // case below for the heap profiler, which cares only about mmaps.
-  bool wants_chrome_dumps() const {
-    return args.level_of_detail != base::trace_event::MemoryDumpLevelOfDetail::
-                                       VM_REGIONS_ONLY_FOR_HEAP_PROFILER;
+  mojom::MemoryMapOption memory_map_option() const {
+    return args.level_of_detail ==
+                   base::trace_event::MemoryDumpLevelOfDetail::DETAILED
+               ? mojom::MemoryMapOption::FULL
+               : mojom::MemoryMapOption::NONE;
   }
 
   bool should_return_summaries() const {
diff --git a/services/resource_coordinator/memory_instrumentation/queued_request_dispatcher.cc b/services/resource_coordinator/memory_instrumentation/queued_request_dispatcher.cc
index 9fc11d7..3d98799 100644
--- a/services/resource_coordinator/memory_instrumentation/queued_request_dispatcher.cc
+++ b/services/resource_coordinator/memory_instrumentation/queued_request_dispatcher.cc
@@ -187,10 +187,6 @@
   DCHECK(!request->dump_in_progress);
   request->dump_in_progress = true;
 
-  // A request must be either !VM_REGIONS_ONLY or, in the special case of the
-  // heap profiler, must be of DETAILED type.
-  DCHECK(request->wants_chrome_dumps() || request->wants_mmaps());
-
   request->start_time = base::Time::Now();
 
   TRACE_EVENT_NESTABLE_ASYNC_BEGIN2(
@@ -228,17 +224,16 @@
     // OSMemoryDump until the Chrome memory dump is finished. See
     // https://bugs.chromium.org/p/chromium/issues/detail?id=812346#c16 for more
     // details.
-    if (request->wants_chrome_dumps()) {
-      request->pending_responses.insert({client, ResponseType::kChromeDump});
-      client->RequestChromeMemoryDump(request->GetRequestArgs(),
-                                      base::Bind(chrome_callback, client));
-    }
+    request->pending_responses.insert({client, ResponseType::kChromeDump});
+    client->RequestChromeMemoryDump(request->GetRequestArgs(),
+                                    base::Bind(chrome_callback, client));
 
 // On most platforms each process can dump data about their own process
 // so ask each process to do so Linux is special see below.
 #if !defined(OS_LINUX)
     request->pending_responses.insert({client, ResponseType::kOSDump});
-    client->RequestOSMemoryDump(request->wants_mmaps(), {base::kNullProcessId},
+    client->RequestOSMemoryDump(request->memory_map_option(),
+                                {base::kNullProcessId},
                                 base::Bind(os_callback, client));
 #endif  // !defined(OS_LINUX)
 
@@ -269,7 +264,8 @@
   if (browser_client && pids.size() > 0) {
     request->pending_responses.insert({browser_client, ResponseType::kOSDump});
     const auto callback = base::Bind(os_callback, browser_client);
-    browser_client->RequestOSMemoryDump(request->wants_mmaps(), pids, callback);
+    browser_client->RequestOSMemoryDump(request->memory_map_option(), pids,
+                                        callback);
   }
 #endif  // defined(OS_LINUX)
 
@@ -309,8 +305,8 @@
   request->pending_responses.insert(browser_client);
   request->responses[browser_client].process_id = browser_client_pid;
   const auto callback = base::Bind(os_callback, browser_client);
-  browser_client->RequestOSMemoryDump(true /* wants_mmaps */, desired_pids,
-                                      callback);
+  browser_client->RequestOSMemoryDump(mojom::MemoryMapOption::MODULES,
+                                      desired_pids, callback);
 #else
   for (const auto& client_info : clients) {
     if (std::find(desired_pids.begin(), desired_pids.end(), client_info.pid) !=
@@ -318,7 +314,7 @@
       mojom::ClientProcess* client = client_info.client;
       request->pending_responses.insert(client);
       request->responses[client].process_id = client_info.pid;
-      client->RequestOSMemoryDump(true /* wants_mmaps */,
+      client->RequestOSMemoryDump(mojom::MemoryMapOption::MODULES,
                                   {base::kNullProcessId},
                                   base::Bind(os_callback, client));
     }
@@ -500,10 +496,10 @@
     }
 
     // Ignore incomplete results (can happen if the client crashes/disconnects).
-    const bool valid = raw_os_dump &&
-                       (!request->wants_chrome_dumps() || raw_chrome_dump) &&
-                       (!request->wants_mmaps() ||
-                        (raw_os_dump && !raw_os_dump->memory_maps.empty()));
+    const bool valid =
+        raw_os_dump && raw_chrome_dump &&
+        (request->memory_map_option() == mojom::MemoryMapOption::NONE ||
+         (raw_os_dump && !raw_os_dump->memory_maps.empty()));
 
     if (!valid)
       continue;
diff --git a/services/resource_coordinator/public/cpp/memory_instrumentation/client_process_impl.cc b/services/resource_coordinator/public/cpp/memory_instrumentation/client_process_impl.cc
index 58cdbd5..c81e7d7 100644
--- a/services/resource_coordinator/public/cpp/memory_instrumentation/client_process_impl.cc
+++ b/services/resource_coordinator/public/cpp/memory_instrumentation/client_process_impl.cc
@@ -136,11 +136,11 @@
 }
 
 void ClientProcessImpl::RequestOSMemoryDump(
-    bool want_mmaps,
+    mojom::MemoryMapOption mmap_option,
     const std::vector<base::ProcessId>& pids,
     const RequestOSMemoryDumpCallback& callback) {
   OSMemoryDumpArgs args;
-  args.want_mmaps = want_mmaps;
+  args.mmap_option = mmap_option;
   args.pids = pids;
   args.callback = callback;
 
@@ -166,8 +166,10 @@
     mojom::RawOSMemDumpPtr result = mojom::RawOSMemDump::New();
     result->platform_private_footprint = mojom::PlatformPrivateFootprint::New();
     bool success = OSMetrics::FillOSMemoryDump(pid, result.get());
-    if (args.want_mmaps)
-      success = success && OSMetrics::FillProcessMemoryMaps(pid, result.get());
+    if (args.mmap_option != mojom::MemoryMapOption::NONE) {
+      success = success && OSMetrics::FillProcessMemoryMaps(
+                               pid, args.mmap_option, result.get());
+    }
     if (success)
       results[pid] = std::move(result);
     global_success = global_success && success;
diff --git a/services/resource_coordinator/public/cpp/memory_instrumentation/client_process_impl.h b/services/resource_coordinator/public/cpp/memory_instrumentation/client_process_impl.h
index 55c92035..149ce9a 100644
--- a/services/resource_coordinator/public/cpp/memory_instrumentation/client_process_impl.h
+++ b/services/resource_coordinator/public/cpp/memory_instrumentation/client_process_impl.h
@@ -79,7 +79,7 @@
 
   // mojom::ClientProcess implementation. The Coordinator calls this.
   void RequestOSMemoryDump(
-      bool wants_mmaps,
+      mojom::MemoryMapOption mmap_option,
       const std::vector<base::ProcessId>& ids,
       const RequestOSMemoryDumpCallback& callback) override;
 
@@ -87,7 +87,7 @@
     OSMemoryDumpArgs();
     OSMemoryDumpArgs(const OSMemoryDumpArgs&);
     ~OSMemoryDumpArgs();
-    bool want_mmaps = false;
+    mojom::MemoryMapOption mmap_option;
     std::vector<base::ProcessId> pids;
     RequestOSMemoryDumpCallback callback;
   };
diff --git a/services/resource_coordinator/public/cpp/memory_instrumentation/os_metrics.cc b/services/resource_coordinator/public/cpp/memory_instrumentation/os_metrics.cc
index 6c42a86..d4d8290 100644
--- a/services/resource_coordinator/public/cpp/memory_instrumentation/os_metrics.cc
+++ b/services/resource_coordinator/public/cpp/memory_instrumentation/os_metrics.cc
@@ -4,16 +4,32 @@
 
 #include "services/resource_coordinator/public/cpp/memory_instrumentation/os_metrics.h"
 
+#include "build/build_config.h"
+
 namespace memory_instrumentation {
 
 // static
 bool OSMetrics::FillProcessMemoryMaps(base::ProcessId pid,
+                                      mojom::MemoryMapOption mmap_option,
                                       mojom::RawOSMemDump* dump) {
-  auto maps = GetProcessMemoryMaps(pid);
-  if (maps.empty())
+  DCHECK_NE(mmap_option, mojom::MemoryMapOption::NONE);
+
+  std::vector<mojom::VmRegionPtr> results;
+
+#if defined(OS_MACOSX)
+  // TODO: Consider implementing this optimization for other platforms as well,
+  // if performance becomes an issue. https://crbug.com/826913.
+  if (mmap_option == mojom::MemoryMapOption::MODULES)
+    results = GetProcessModules(pid);
+#endif
+
+  if (results.empty())
+    results = GetProcessMemoryMaps(pid);
+
+  if (results.empty())
     return false;
 
-  dump->memory_maps = std::move(maps);
+  dump->memory_maps = std::move(results);
 
   return true;
 }
diff --git a/services/resource_coordinator/public/cpp/memory_instrumentation/os_metrics.h b/services/resource_coordinator/public/cpp/memory_instrumentation/os_metrics.h
index 358de0ea..7eaec00 100644
--- a/services/resource_coordinator/public/cpp/memory_instrumentation/os_metrics.h
+++ b/services/resource_coordinator/public/cpp/memory_instrumentation/os_metrics.h
@@ -11,7 +11,7 @@
 #include "services/resource_coordinator/public/cpp/resource_coordinator_export.h"
 #include "services/resource_coordinator/public/mojom/memory_instrumentation/memory_instrumentation.mojom.h"
 
-namespace profiling {
+namespace heap_profiling {
 FORWARD_DECLARE_TEST(ProfilingJsonExporterTest, MemoryMaps);
 };
 
@@ -20,15 +20,22 @@
 class SERVICES_RESOURCE_COORDINATOR_PUBLIC_CPP_EXPORT OSMetrics {
  public:
   static bool FillOSMemoryDump(base::ProcessId pid, mojom::RawOSMemDump* dump);
-  static bool FillProcessMemoryMaps(base::ProcessId, mojom::RawOSMemDump*);
+  static bool FillProcessMemoryMaps(base::ProcessId,
+                                    mojom::MemoryMapOption,
+                                    mojom::RawOSMemDump*);
 
  private:
   FRIEND_TEST_ALL_PREFIXES(OSMetricsTest, ParseProcSmaps);
   FRIEND_TEST_ALL_PREFIXES(OSMetricsTest, TestWinModuleReading);
   FRIEND_TEST_ALL_PREFIXES(OSMetricsTest, TestMachOReading);
-  FRIEND_TEST_ALL_PREFIXES(profiling::ProfilingJsonExporterTest, MemoryMaps);
+  FRIEND_TEST_ALL_PREFIXES(heap_profiling::ProfilingJsonExporterTest,
+                           MemoryMaps);
   static std::vector<mojom::VmRegionPtr> GetProcessMemoryMaps(base::ProcessId);
 
+#if defined(OS_MACOSX)
+  static std::vector<mojom::VmRegionPtr> GetProcessModules(base::ProcessId);
+#endif
+
 #if defined(OS_LINUX) || defined(OS_ANDROID)
   static void SetProcSmapsForTesting(FILE*);
 #endif  // defined(OS_LINUX)
diff --git a/services/resource_coordinator/public/cpp/memory_instrumentation/os_metrics_mac.cc b/services/resource_coordinator/public/cpp/memory_instrumentation/os_metrics_mac.cc
index 1788bd85..b211123 100644
--- a/services/resource_coordinator/public/cpp/memory_instrumentation/os_metrics_mac.cc
+++ b/services/resource_coordinator/public/cpp/memory_instrumentation/os_metrics_mac.cc
@@ -255,4 +255,19 @@
   return maps;
 }
 
+std::vector<mojom::VmRegionPtr> OSMetrics::GetProcessModules(
+    base::ProcessId pid) {
+  std::vector<mojom::VmRegionPtr> maps;
+
+  std::vector<VMRegion> dyld_regions;
+  if (!GetDyldRegions(&dyld_regions))
+    return maps;
+
+  for (VMRegion& region : dyld_regions) {
+    maps.push_back(VMRegion::New(region));
+  }
+
+  return maps;
+}
+
 }  // namespace memory_instrumentation
diff --git a/services/resource_coordinator/public/cpp/memory_instrumentation/os_metrics_unittest.cc b/services/resource_coordinator/public/cpp/memory_instrumentation/os_metrics_unittest.cc
index 8d6af8e..20a58202 100644
--- a/services/resource_coordinator/public/cpp/memory_instrumentation/os_metrics_unittest.cc
+++ b/services/resource_coordinator/public/cpp/memory_instrumentation/os_metrics_unittest.cc
@@ -251,8 +251,9 @@
 #endif  // defined(OS_WIN)
 
 #if defined(OS_MACOSX)
-TEST(OSMetricsTest, TestMachOReading) {
-  auto maps = OSMetrics::GetProcessMemoryMaps(base::kNullProcessId);
+namespace {
+
+void CheckMachORegions(const std::vector<mojom::VmRegionPtr>& maps) {
   uint32_t size = 100;
   char full_path[size];
   int result = _NSGetExecutablePath(full_path, &size);
@@ -280,6 +281,15 @@
   EXPECT_TRUE(found_components_unittests);
   EXPECT_TRUE(found_appkit);
 }
+
+}  // namespace
+
+TEST(OSMetricsTest, TestMachOReading) {
+  auto maps = OSMetrics::GetProcessMemoryMaps(base::kNullProcessId);
+  CheckMachORegions(maps);
+  maps = OSMetrics::GetProcessModules(base::kNullProcessId);
+  CheckMachORegions(maps);
+}
 #endif  // defined(OS_MACOSX)
 
 }  // namespace memory_instrumentation
diff --git a/services/resource_coordinator/public/mojom/memory_instrumentation/memory_instrumentation.mojom b/services/resource_coordinator/public/mojom/memory_instrumentation/memory_instrumentation.mojom
index c457f6c..d55e050 100644
--- a/services/resource_coordinator/public/mojom/memory_instrumentation/memory_instrumentation.mojom
+++ b/services/resource_coordinator/public/mojom/memory_instrumentation/memory_instrumentation.mojom
@@ -38,6 +38,19 @@
   NATIVE_STACK
 };
 
+enum MemoryMapOption {
+  // Do not fetch any information about mapped regions in the virtual address
+  // space.
+  NONE,
+
+  // Only fetch information on code modules, e.g. Chrome Binary, system
+  // libraries.
+  MODULES,
+
+  // Fetch information for every single mapped region.
+  FULL
+};
+
 // These structs are internal only (only for the communication between
 // the service and the ClientProcess library).
 // See corresponding types in //base/trace_event for comments.
@@ -213,7 +226,7 @@
   // On Linux we call this once on the browser process ClientProcess passing
   // the pids for all processes.
   // See crbug.com/461788
-  RequestOSMemoryDump(bool want_mmaps, array<mojo_base.mojom.ProcessId> pids) =>
+  RequestOSMemoryDump(MemoryMapOption option, array<mojo_base.mojom.ProcessId> pids) =>
       (bool success, map<mojo_base.mojom.ProcessId, RawOSMemDump> dumps);
 };
 
diff --git a/services/service_manager/sandbox/mac/cdm.sb b/services/service_manager/sandbox/mac/cdm.sb
index d22fe31..a7ba200 100644
--- a/services/service_manager/sandbox/mac/cdm.sb
+++ b/services/service_manager/sandbox/mac/cdm.sb
@@ -10,3 +10,6 @@
 ; Allow to read framework and CDM resources files for CDM host verification
 (define bundle-version-path "BUNDLE_VERSION_PATH")
 (allow file-read* (subpath (param bundle-version-path)))
+
+; mach IPC
+(allow mach-lookup (global-name "com.apple.windowserver.active"))
diff --git a/testing/buildbot/chromium.clang.json b/testing/buildbot/chromium.clang.json
index a04fced..08744ff 100644
--- a/testing/buildbot/chromium.clang.json
+++ b/testing/buildbot/chromium.clang.json
@@ -116,6 +116,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -493,6 +505,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -852,6 +876,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -1148,6 +1184,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -1437,6 +1485,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -1739,6 +1799,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -2071,6 +2143,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -2403,6 +2487,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -2735,6 +2831,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -3067,6 +3175,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -3399,6 +3519,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -3731,6 +3863,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -4063,6 +4207,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -4395,6 +4551,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -4727,6 +4895,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -8135,6 +8315,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -8484,6 +8676,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -8767,6 +8971,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -9104,6 +9320,18 @@
         "swarming": {
           "can_use_on_swarming_builders": false
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": false
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": false
+        },
         "test": "crypto_unittests"
       },
       {
@@ -9442,6 +9670,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -9772,6 +10012,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -10119,6 +10371,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -10412,6 +10676,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -10744,6 +11020,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -11076,6 +11364,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -11408,6 +11708,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -11740,6 +12052,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -12072,6 +12396,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -12404,6 +12740,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -12736,6 +13084,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -13068,6 +13428,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -13400,6 +13772,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -13719,6 +14103,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -14138,6 +14534,28 @@
             }
           ]
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true,
+          "dimension_sets": [
+            {
+              "os": "Windows-10"
+            }
+          ]
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true,
+          "dimension_sets": [
+            {
+              "os": "Windows-10"
+            }
+          ]
+        },
         "test": "crypto_unittests"
       },
       {
diff --git a/testing/buildbot/chromium.fyi.json b/testing/buildbot/chromium.fyi.json
index a430dfe..6c0bf79 100644
--- a/testing/buildbot/chromium.fyi.json
+++ b/testing/buildbot/chromium.fyi.json
@@ -438,6 +438,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -815,6 +827,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -1226,6 +1250,18 @@
         "swarming": {
           "can_use_on_swarming_builders": false
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": false
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": false
+        },
         "test": "crypto_unittests"
       },
       {
@@ -1622,6 +1658,18 @@
         "swarming": {
           "can_use_on_swarming_builders": false
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": false
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": false
+        },
         "test": "crypto_unittests"
       },
       {
@@ -1960,6 +2008,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -2377,6 +2437,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -2793,6 +2865,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -3089,6 +3173,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -3378,6 +3474,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -4646,6 +4754,28 @@
             }
           ]
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true,
+          "dimension_sets": [
+            {
+              "os": "Ubuntu-16.04"
+            }
+          ]
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true,
+          "dimension_sets": [
+            {
+              "os": "Ubuntu-16.04"
+            }
+          ]
+        },
         "test": "crypto_unittests"
       },
       {
@@ -6763,6 +6893,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -7156,6 +7298,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -7497,6 +7651,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -8046,6 +8212,18 @@
         "swarming": {
           "can_use_on_swarming_builders": false
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": false
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": false
+        },
         "test": "crypto_unittests"
       },
       {
@@ -8473,6 +8651,18 @@
         "swarming": {
           "can_use_on_swarming_builders": false
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": false
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": false
+        },
         "test": "crypto_unittests"
       },
       {
@@ -9159,6 +9349,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
diff --git a/testing/buildbot/chromium.linux.json b/testing/buildbot/chromium.linux.json
index c0207e0..1119b85 100644
--- a/testing/buildbot/chromium.linux.json
+++ b/testing/buildbot/chromium.linux.json
@@ -859,6 +859,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -1657,6 +1669,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -2302,6 +2326,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
diff --git a/testing/buildbot/chromium.mac.json b/testing/buildbot/chromium.mac.json
index 3ad26a7..52818eb 100644
--- a/testing/buildbot/chromium.mac.json
+++ b/testing/buildbot/chromium.mac.json
@@ -133,6 +133,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -594,6 +606,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -1031,6 +1055,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -1493,6 +1529,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -1943,6 +1991,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
diff --git a/testing/buildbot/chromium.memory.json b/testing/buildbot/chromium.memory.json
index 536f51a..e0d45599 100644
--- a/testing/buildbot/chromium.memory.json
+++ b/testing/buildbot/chromium.memory.json
@@ -731,6 +731,26 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "args": [
+          "--test-launcher-batch-limit=1",
+          "--test-launcher-print-test-stdio=always"
+        ],
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "args": [
+          "--test-launcher-batch-limit=1",
+          "--test-launcher-print-test-stdio=always"
+        ],
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -1197,6 +1217,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -2855,6 +2887,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
diff --git a/testing/buildbot/chromium.win.json b/testing/buildbot/chromium.win.json
index 566df5c..179fe183 100644
--- a/testing/buildbot/chromium.win.json
+++ b/testing/buildbot/chromium.win.json
@@ -65,18 +65,6 @@
         "test": "browser_tests"
       },
       {
-        "args": [
-          "--enable-features=VizDisplayCompositor",
-          "--test-launcher-filter-file=../../testing/buildbot/filters/viz.browser_tests.filter"
-        ],
-        "name": "viz_browser_tests",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "shards": 10
-        },
-        "test": "browser_tests"
-      },
-      {
         "swarming": {
           "can_use_on_swarming_builders": true
         },
@@ -193,6 +181,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -673,18 +673,6 @@
         "test": "browser_tests"
       },
       {
-        "args": [
-          "--enable-features=VizDisplayCompositor",
-          "--test-launcher-filter-file=../../testing/buildbot/filters/viz.browser_tests.filter"
-        ],
-        "name": "viz_browser_tests",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "shards": 10
-        },
-        "test": "browser_tests"
-      },
-      {
         "swarming": {
           "can_use_on_swarming_builders": true
         },
@@ -801,6 +789,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -1330,6 +1330,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -1874,18 +1886,6 @@
         "test": "browser_tests"
       },
       {
-        "args": [
-          "--enable-features=VizDisplayCompositor",
-          "--test-launcher-filter-file=../../testing/buildbot/filters/viz.browser_tests.filter"
-        ],
-        "name": "viz_browser_tests",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "shards": 10
-        },
-        "test": "browser_tests"
-      },
-      {
         "swarming": {
           "can_use_on_swarming_builders": true
         },
@@ -2002,6 +2002,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
@@ -2496,18 +2508,6 @@
         "test": "browser_tests"
       },
       {
-        "args": [
-          "--enable-features=VizDisplayCompositor",
-          "--test-launcher-filter-file=../../testing/buildbot/filters/viz.browser_tests.filter"
-        ],
-        "name": "viz_browser_tests",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "shards": 10
-        },
-        "test": "browser_tests"
-      },
-      {
         "swarming": {
           "can_use_on_swarming_builders": true
         },
@@ -2619,6 +2619,18 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "cronet_tests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "cronet_unittests"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "crypto_unittests"
       },
       {
diff --git a/testing/buildbot/filters/mojo.fyi.network_browser_tests.filter b/testing/buildbot/filters/mojo.fyi.network_browser_tests.filter
index 649ee9ef..b72693c 100644
--- a/testing/buildbot/filters/mojo.fyi.network_browser_tests.filter
+++ b/testing/buildbot/filters/mojo.fyi.network_browser_tests.filter
@@ -181,7 +181,6 @@
 # http://crbug.com/721414
 # TODO(rockot): add support for webRequest API.
 -ExtensionWebRequestApiTest.WebRequestBlocking
--ExtensionWebRequestApiTest.WebRequestClientsGoogleComProtection
 -ExtensionWebRequestApiTest.WebRequestDeclarative2
 -ExtensionWebRequestApiTest.WebRequestDiceHeaderProtection
 -ExtensionWebRequestApiTest.WebRequestTypes
diff --git a/testing/buildbot/test_suite_exceptions.pyl b/testing/buildbot/test_suite_exceptions.pyl
index 0622a79..94394e2 100644
--- a/testing/buildbot/test_suite_exceptions.pyl
+++ b/testing/buildbot/test_suite_exceptions.pyl
@@ -3368,6 +3368,15 @@
       'Linux ASan LSan Tests (1)',
     ],
   },
+  'viz_browser_tests': {
+    'remove_from': [
+      # Currently too flaky on Windows.
+      'Win 7 Tests x64 (1)',
+      'Win10 Tests x64',
+      'Win7 Tests (1)',
+      'Win7 Tests (dbg)(1)',
+    ],
+  },
   'viz_unittests': {
     'remove_from': [
       # On chromium.android, unclear why these aren't run on all bots.
diff --git a/testing/buildbot/test_suites.pyl b/testing/buildbot/test_suites.pyl
index 2a0a61d..1b6f3a5e 100644
--- a/testing/buildbot/test_suites.pyl
+++ b/testing/buildbot/test_suites.pyl
@@ -1352,6 +1352,8 @@
 
   'non_android_and_cast_and_chromeos_chromium_gtests': {
     'blink_platform_unittests': {},
+    'cronet_tests': {},
+    'cronet_unittests': {},
   },
 
   'non_android_and_cast_and_chromeos_and_clang_and_mac_fyi_chromium_gtests': {
diff --git a/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG b/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG
index c156d0e3..915bd060a 100644
--- a/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG
+++ b/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG
@@ -47,9 +47,9 @@
 crbug.com/626703 external/wpt/css/css-writing-modes/sizing-orthog-vlr-in-htb-004.xht [ Pass ]
 
 # New failures are appended below by the script.
-crbug.com/714962 accessibility/adjacent-continuations-cause-assertion-failure.html [ Crash Failure ]
+crbug.com/714962 accessibility/adjacent-continuations-cause-assertion-failure.html [ Crash ]
 crbug.com/591099 accessibility/aom-computed-string-properties.html [ Crash ]
-crbug.com/591099 accessibility/aom-relation-list-properties.html [ Crash Failure ]
+crbug.com/591099 accessibility/aom-relation-list-properties.html [ Crash ]
 crbug.com/591099 accessibility/aria-disabled.html [ Crash ]
 crbug.com/591099 accessibility/aria-hidden-children-not-in-text-from-content.html [ Crash ]
 crbug.com/591099 accessibility/aria-label.html [ Crash ]
@@ -63,13 +63,13 @@
 crbug.com/714962 accessibility/aria-tables.html [ Failure ]
 crbug.com/591099 accessibility/aria-tree.html [ Crash ]
 crbug.com/714962 accessibility/background-color.html [ Failure ]
-crbug.com/714962 accessibility/bounds-calc.html [ Crash Failure ]
+crbug.com/714962 accessibility/bounds-calc.html [ Crash ]
 crbug.com/591099 accessibility/canvas-accessibilitynodeobject.html [ Crash ]
 crbug.com/591099 accessibility/canvas-fallback-content-2.html [ Timeout ]
 crbug.com/591099 accessibility/canvas-fallback-content-labels.html [ Crash ]
 crbug.com/591099 accessibility/clickable.html [ Crash ]
 crbug.com/591099 accessibility/computed-name.html [ Timeout ]
-crbug.com/591099 accessibility/computed-role.html [ Timeout ]
+crbug.com/591099 accessibility/computed-role.html [ Pass Timeout ]
 crbug.com/591099 accessibility/computed-text-with-height-0.html [ Crash ]
 crbug.com/714962 accessibility/css-first-letter-children.html [ Failure ]
 crbug.com/591099 accessibility/css-generated-content.html [ Failure ]
@@ -77,12 +77,13 @@
 crbug.com/591099 accessibility/disabled-controls.html [ Failure ]
 crbug.com/714962 accessibility/div-within-anchors-causes-crash.html [ Failure ]
 crbug.com/714962 accessibility/dl-role.html [ Failure ]
-crbug.com/591099 accessibility/element-role-mapping-focusable.html [ Crash Failure ]
-crbug.com/591099 accessibility/element-role-mapping-normal.html [ Crash Failure ]
+crbug.com/591099 accessibility/element-role-mapping-focusable.html [ Crash ]
+crbug.com/591099 accessibility/element-role-mapping-normal.html [ Crash ]
 crbug.com/714962 accessibility/first-letter-text-transform-causes-crash.html [ Failure ]
 crbug.com/591099 accessibility/focusable-div.html [ Failure ]
+crbug.com/591099 accessibility/focusable-span.html [ Failure ]
 crbug.com/591099 accessibility/idref-newlines.html [ Crash ]
-crbug.com/714962 accessibility/in-page-link-target.html [ Crash Failure ]
+crbug.com/714962 accessibility/in-page-link-target.html [ Crash ]
 crbug.com/591099 accessibility/inline-text-bidi-bounds-for-range.html [ Failure ]
 crbug.com/714962 accessibility/inline-text-bounds-for-range-br.html [ Failure ]
 crbug.com/591099 accessibility/inline-text-bounds-for-range.html [ Failure ]
@@ -98,7 +99,7 @@
 crbug.com/591099 accessibility/name-calc-aria-hidden.html [ Crash ]
 crbug.com/591099 accessibility/name-calc-aria-owns.html [ Failure ]
 crbug.com/591099 accessibility/name-calc-img.html [ Failure ]
-crbug.com/714962 accessibility/name-calc-inputs.html [ Crash Failure ]
+crbug.com/714962 accessibility/name-calc-inputs.html [ Crash ]
 crbug.com/591099 accessibility/name-calc-native-markup-buttons.html [ Crash ]
 crbug.com/591099 accessibility/name-calc-native-markup-input-buttons.html [ Crash ]
 crbug.com/591099 accessibility/presentation-owned-elements.html [ Failure ]
@@ -122,7 +123,7 @@
 crbug.com/591099 animations/interpolation/webkit-clip-path-interpolation.html [ Pass Timeout ]
 crbug.com/591099 animations/rotate-transform-equivalent.html [ Failure ]
 crbug.com/591099 animations/svg/animated-filter-svg-element.html [ Pass Timeout ]
-crbug.com/591099 animations/timing/timing-model.html [ Timeout ]
+crbug.com/591099 animations/timing/timing-model.html [ Pass Timeout ]
 crbug.com/714962 compositing/background-color/view-blending-base-background.html [ Failure ]
 crbug.com/591099 compositing/draws-content/canvas-background-layer.html [ Failure ]
 crbug.com/591099 compositing/draws-content/webgl-background-layer.html [ Failure ]
@@ -130,8 +131,6 @@
 crbug.com/591099 compositing/geometry/clipping-foreground.html [ Failure ]
 crbug.com/591099 compositing/geometry/foreground-layer.html [ Failure ]
 crbug.com/591099 compositing/geometry/repaint-foreground-layer.html [ Failure ]
-crbug.com/591099 compositing/geometry/root-layer-update.html [ Failure ]
-crbug.com/591099 compositing/geometry/transfrom-origin-on-zero-size-layer.html [ Failure ]
 crbug.com/591099 compositing/geometry/video-opacity-overlay.html [ Failure ]
 crbug.com/714962 compositing/gestures/gesture-tapHighlight-2-overflow-div-scrolled-inner.html [ Failure ]
 crbug.com/714962 compositing/gestures/gesture-tapHighlight-on-promoted-overflow-div-scrolled.html [ Failure ]
@@ -144,10 +143,6 @@
 crbug.com/591099 compositing/overflow/scrolling-content-clip-to-viewport.html [ Failure ]
 crbug.com/591099 compositing/overflow/universal-accelerated-overflow-scroll.html [ Pass Timeout ]
 crbug.com/591099 compositing/overflow/update-widget-positions-on-nested-frames-and-scrollers.html [ Failure ]
-crbug.com/591099 compositing/reflections/compositing-change-inside-reflection.html [ Failure ]
-crbug.com/591099 compositing/reflections/reflection-positioning.html [ Failure ]
-crbug.com/591099 compositing/reflections/reflection-positioning2.html [ Failure ]
-crbug.com/591099 compositing/reflections/transform-inside-reflection.html [ Failure ]
 crbug.com/591099 compositing/rtl/rtl-and-writing-mode-scrolling.html [ Failure ]
 crbug.com/591099 compositing/squashing/add-remove-squashed-layers.html [ Failure ]
 crbug.com/591099 compositing/squashing/selection-repaint-with-gaps.html [ Failure ]
@@ -155,87 +150,19 @@
 crbug.com/591099 crypto/subtle/hmac/cloneKey.html [ Timeout ]
 crbug.com/591099 crypto/subtle/pbkdf2/cloneKey.html [ Timeout ]
 crbug.com/591099 crypto/subtle/rsassa-pkcs1-v1_5/cloneKey.html [ Timeout ]
-crbug.com/591099 css1/basic/containment.html [ Failure ]
-crbug.com/591099 css1/basic/contextual_selectors.html [ Failure ]
-crbug.com/591099 css1/basic/id_as_selector.html [ Failure ]
-crbug.com/591099 css1/box_properties/border_bottom.html [ Failure ]
-crbug.com/591099 css1/box_properties/border_left.html [ Failure ]
-crbug.com/591099 css1/box_properties/border_right_inline.html [ Failure ]
-crbug.com/591099 css1/box_properties/border_style.html [ Failure ]
-crbug.com/591099 css1/box_properties/border_style_inline.html [ Failure ]
-crbug.com/591099 css1/box_properties/border_top.html [ Failure ]
-crbug.com/591099 css1/box_properties/clear_float.html [ Failure ]
-crbug.com/591099 css1/box_properties/float_elements_in_series.html [ Failure ]
 crbug.com/591099 css1/box_properties/float_on_text_elements.html [ Failure ]
-crbug.com/591099 css1/box_properties/margin_left.html [ Failure ]
-crbug.com/591099 css1/box_properties/margin_right.html [ Failure ]
-crbug.com/591099 css1/box_properties/padding_left.html [ Failure ]
-crbug.com/591099 css1/box_properties/padding_right.html [ Failure ]
-crbug.com/591099 css1/cascade/cascade_order.html [ Failure ]
-crbug.com/591099 css1/classification/display.html [ Failure ]
-crbug.com/591099 css1/classification/list_style.html [ Failure ]
 crbug.com/591099 css1/classification/list_style_image.html [ Failure ]
-crbug.com/591099 css1/classification/list_style_position.html [ Failure ]
-crbug.com/591099 css1/classification/list_style_type.html [ Failure ]
-crbug.com/591099 css1/color_and_background/background_attachment.html [ Failure ]
-crbug.com/591099 css1/formatting_model/canvas.html [ Failure ]
-crbug.com/591099 css1/formatting_model/height_of_lines.html [ Failure ]
-crbug.com/591099 css1/formatting_model/inline_elements.html [ Failure ]
-crbug.com/591099 css1/pseudo/anchor.html [ Failure ]
-crbug.com/591099 css1/text_properties/text_transform.html [ Failure ]
-crbug.com/591099 css1/units/urls.html [ Failure ]
-crbug.com/591099 css2.1/20110323/c543-txt-decor-000.html [ Failure ]
 crbug.com/591099 css2.1/20110323/margin-applies-to-008.htm [ Failure ]
-crbug.com/591099 css2.1/20110323/margin-applies-to-010.htm [ Failure ]
 crbug.com/714962 css2.1/20110323/overflow-applies-to-012.htm [ Failure ]
 crbug.com/591099 css2.1/20110323/table-caption-margins-001.htm [ Failure ]
-crbug.com/591099 css2.1/20110323/table-height-algorithm-023.htm [ Failure ]
-crbug.com/591099 css2.1/20110323/table-height-algorithm-024.htm [ Failure ]
-crbug.com/591099 css2.1/t0402-c71-fwd-parsing-02-f.html [ Failure ]
-crbug.com/591099 css2.1/t0505-c16-descendant-01-e.html [ Failure ]
-crbug.com/591099 css2.1/t050803-c14-classes-00-e.html [ Failure ]
-crbug.com/591099 css2.1/t0509-c15-ids-01-e.html [ Failure ]
 crbug.com/591099 css2.1/t0510-c25-pseudo-elmnt-00-c.html [ Failure ]
-crbug.com/591099 css2.1/t051103-dom-hover-01-c-io.html [ Failure ]
-crbug.com/591099 css2.1/t051103-dom-hover-02-c-io.html [ Failure ]
-crbug.com/591099 css2.1/t0805-c5516-brdr-c-00-a.html [ Failure ]
-crbug.com/591099 css2.1/t0805-c5516-ibrdr-c-00-a.html [ Failure ]
-crbug.com/591099 css2.1/t0805-c5517-brdr-s-00-c.html [ Failure ]
-crbug.com/591099 css2.1/t0805-c5517-ibrdr-s-00-a.html [ Failure ]
-crbug.com/591099 css2.1/t0805-c5518-brdr-t-01-e.html [ Failure ]
-crbug.com/591099 css2.1/t0805-c5519-brdr-r-02-e.html [ Failure ]
-crbug.com/591099 css2.1/t0805-c5520-brdr-b-01-e.html [ Failure ]
-crbug.com/591099 css2.1/t0805-c5521-brdr-l-02-e.html [ Failure ]
-crbug.com/591099 css2.1/t0805-c5522-brdr-00-b.html [ Failure ]
-crbug.com/591099 css2.1/t0905-c414-flt-02-c.html [ Failure ]
-crbug.com/591099 css2.1/t0905-c414-flt-03-c.html [ Failure ]
-crbug.com/591099 css2.1/t0905-c414-flt-04-c.html [ Failure ]
 crbug.com/591099 css2.1/t0905-c414-flt-wrap-01-d-g.html [ Failure ]
-crbug.com/591099 css2.1/t0905-c5525-fltcont-00-d-g.html [ Failure ]
-crbug.com/591099 css2.1/t0905-c5525-fltwidth-00-c-g.html [ Failure ]
-crbug.com/591099 css2.1/t0905-c5525-fltwrap-00-b.html [ Failure ]
-crbug.com/591099 css2.1/t090501-c414-flt-ln-00-d.html [ Failure ]
-crbug.com/591099 css2.1/t090501-c414-flt-ln-02-d.html [ Failure ]
-crbug.com/591099 css2.1/t090501-c414-flt-ln-03-d.html [ Failure ]
 crbug.com/591099 css2.1/t100801-c544-valgn-00-a-ag.html [ Failure ]
 crbug.com/591099 css2.1/t100801-c544-valgn-03-d-agi.html [ Failure ]
 crbug.com/591099 css2.1/t1202-counter-04-b.html [ Failure ]
-crbug.com/591099 css2.1/t1202-counter-08-b.html [ Failure ]
 crbug.com/591099 css2.1/t1202-counter-09-b.html [ Failure ]
-crbug.com/591099 css2.1/t1202-counter-13-b.html [ Failure ]
-crbug.com/591099 css2.1/t1202-counter-14-b.html [ Failure ]
 crbug.com/591099 css2.1/t1202-counters-04-b.html [ Failure ]
-crbug.com/591099 css2.1/t1202-counters-08-b.html [ Failure ]
-crbug.com/591099 css2.1/t1202-counters-13-b.html [ Failure ]
-crbug.com/591099 css2.1/t1202-counters-14-b.html [ Failure ]
-crbug.com/591099 css2.1/t1204-order-01-d.html [ Failure ]
-crbug.com/591099 css2.1/t120401-scope-00-b.html [ Failure ]
-crbug.com/591099 css2.1/t1205-c563-list-type-00-b.html [ Failure ]
 crbug.com/591099 css2.1/t1205-c564-list-img-00-b-g.html [ Failure ]
-crbug.com/591099 css2.1/t1402-c45-bg-canvas-00-b.html [ Failure ]
-crbug.com/591099 css2.1/t140201-c535-bg-fixd-00-b-g.html [ Failure ]
-crbug.com/591099 css2.1/t140201-c537-bgfxps-00-c-ag.html [ Failure ]
-crbug.com/591099 css2.1/t1602-c546-txt-align-00-b.html [ Failure ]
 crbug.com/591099 css3/blending/background-blend-mode-overlapping-accelerated-elements.html [ Failure ]
 crbug.com/591099 css3/filters/composited-layer-child-bounds-after-composited-to-sw-shadow-change.html [ Failure ]
 crbug.com/591099 css3/filters/effect-reference-hidpi-hw.html [ Timeout ]
@@ -257,97 +184,36 @@
 crbug.com/591099 css3/flexbox/position-absolute-child-with-contenteditable.html [ Failure ]
 crbug.com/591099 css3/flexbox/scrollbars-auto.html [ Failure ]
 crbug.com/591099 css3/flexbox/scrollbars.html [ Failure ]
-crbug.com/591099 css3/masking/clip-path-inset-corners.html [ Failure ]
 crbug.com/714962 css3/masking/clip-path-reference-box-inline.html [ Failure ]
-crbug.com/591099 css3/selectors3/html/css3-modsel-1.html [ Failure ]
-crbug.com/591099 css3/selectors3/html/css3-modsel-13.html [ Failure ]
-crbug.com/591099 css3/selectors3/html/css3-modsel-15.html [ Failure ]
 crbug.com/591099 css3/selectors3/html/css3-modsel-167.html [ Failure ]
 crbug.com/591099 css3/selectors3/html/css3-modsel-167a.html [ Failure ]
-crbug.com/591099 css3/selectors3/html/css3-modsel-22.html [ Failure ]
-crbug.com/591099 css3/selectors3/html/css3-modsel-28.html [ Failure ]
-crbug.com/591099 css3/selectors3/html/css3-modsel-28b.html [ Failure ]
-crbug.com/591099 css3/selectors3/html/css3-modsel-29.html [ Failure ]
-crbug.com/591099 css3/selectors3/html/css3-modsel-29b.html [ Failure ]
 crbug.com/591099 css3/selectors3/html/css3-modsel-38.html [ Failure ]
-crbug.com/591099 css3/selectors3/html/css3-modsel-3a.html [ Failure ]
-crbug.com/591099 css3/selectors3/html/css3-modsel-41.html [ Failure ]
-crbug.com/591099 css3/selectors3/html/css3-modsel-41a.html [ Failure ]
-crbug.com/591099 css3/selectors3/html/css3-modsel-73.html [ Failure ]
-crbug.com/591099 css3/selectors3/html/css3-modsel-73b.html [ Failure ]
-crbug.com/591099 css3/selectors3/html/css3-modsel-74.html [ Failure ]
-crbug.com/591099 css3/selectors3/html/css3-modsel-74b.html [ Failure ]
-crbug.com/591099 css3/selectors3/xhtml/css3-modsel-1.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xhtml/css3-modsel-13.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xhtml/css3-modsel-15.xml [ Failure ]
 crbug.com/591099 css3/selectors3/xhtml/css3-modsel-167.xml [ Failure ]
 crbug.com/591099 css3/selectors3/xhtml/css3-modsel-167a.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xhtml/css3-modsel-22.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xhtml/css3-modsel-28.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xhtml/css3-modsel-28b.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xhtml/css3-modsel-29.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xhtml/css3-modsel-29b.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xhtml/css3-modsel-3.xml [ Failure ]
 crbug.com/591099 css3/selectors3/xhtml/css3-modsel-38.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xhtml/css3-modsel-3a.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xhtml/css3-modsel-41.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xhtml/css3-modsel-41a.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xhtml/css3-modsel-73.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xhtml/css3-modsel-73b.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xhtml/css3-modsel-74.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xhtml/css3-modsel-74b.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xml/css3-modsel-1.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xml/css3-modsel-13.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xml/css3-modsel-15.xml [ Failure ]
 crbug.com/591099 css3/selectors3/xml/css3-modsel-167.xml [ Failure ]
 crbug.com/591099 css3/selectors3/xml/css3-modsel-167a.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xml/css3-modsel-22.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xml/css3-modsel-28.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xml/css3-modsel-28b.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xml/css3-modsel-29.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xml/css3-modsel-29b.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xml/css3-modsel-3.xml [ Failure ]
 crbug.com/591099 css3/selectors3/xml/css3-modsel-38.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xml/css3-modsel-3a.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xml/css3-modsel-41.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xml/css3-modsel-41a.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xml/css3-modsel-73.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xml/css3-modsel-73b.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xml/css3-modsel-74.xml [ Failure ]
-crbug.com/591099 css3/selectors3/xml/css3-modsel-74b.xml [ Failure ]
 crbug.com/591099 editing/assert_selection.html [ Failure ]
 crbug.com/591099 editing/caret/caret-color-014.html [ Failure ]
 crbug.com/591099 editing/caret/caret-color-015.html [ Failure ]
-crbug.com/591099 editing/deleting/4922367.html [ Failure ]
-crbug.com/591099 editing/deleting/5272440.html [ Failure Pass ]
-crbug.com/591099 editing/deleting/5369009.html [ Failure ]
 crbug.com/591099 editing/deleting/merge-whitespace-pre.html [ Failure Pass ]
-crbug.com/591099 editing/deleting/transpose-empty.html [ Failure Pass ]
-crbug.com/591099 editing/deleting/type-delete-after-quote.html [ Failure Pass ]
 crbug.com/591099 editing/execCommand/5138441.html [ Failure Pass ]
 crbug.com/591099 editing/execCommand/5569741.html [ Failure Pass ]
 crbug.com/591099 editing/execCommand/align-in-span.html [ Failure Pass ]
 crbug.com/591099 editing/execCommand/findString.html [ Failure ]
 crbug.com/591099 editing/execCommand/format-block-multiple-paragraphs-in-pre.html [ Failure ]
 crbug.com/591099 editing/execCommand/format-block-multiple-paragraphs.html [ Failure ]
-crbug.com/591099 editing/execCommand/query-format-block.html [ Pass Timeout ]
-crbug.com/591099 editing/input/linux_rtl_composition_underline.html [ Failure ]
+crbug.com/591099 editing/execCommand/query-format-block.html [ Timeout ]
 crbug.com/591099 editing/inserting/4875189-1.html [ Failure Pass ]
 crbug.com/591099 editing/inserting/4959067.html [ Failure Pass ]
-crbug.com/591099 editing/inserting/5549929-2.html [ Failure ]
 crbug.com/591099 editing/inserting/editable-inline-element.html [ Failure Pass ]
-crbug.com/591099 editing/pasteboard/4631972.html [ Failure ]
-crbug.com/591099 editing/pasteboard/4806874.html [ Failure ]
-crbug.com/591099 editing/pasteboard/4947130.html [ Failure ]
-crbug.com/591099 editing/pasteboard/5134759.html [ Failure ]
 crbug.com/714962 editing/pasteboard/copy-element-with-conflicting-background-color-from-rule.html [ Failure ]
 crbug.com/714962 editing/pasteboard/copy-paste-pre-line-content.html [ Failure ]
 crbug.com/591099 editing/pasteboard/copy-paste-white-space.html [ Failure ]
 crbug.com/591099 editing/pasteboard/drag-image-to-contenteditable-in-iframe.html [ Failure ]
 crbug.com/591099 editing/pasteboard/drag-list-item.html [ Failure ]
-crbug.com/591099 editing/pasteboard/drag-selected-image-to-contenteditable.html [ Failure ]
 crbug.com/591099 editing/pasteboard/innerText-inline-table.html [ Failure ]
-crbug.com/591099 editing/pasteboard/input-field-1.html [ Failure ]
 crbug.com/591099 editing/pasteboard/merge-start-blockquote.html [ Failure ]
 crbug.com/591099 editing/pasteboard/merge-start-list.html [ Failure ]
 crbug.com/591099 editing/pasteboard/paste-noscript.html [ Failure ]
@@ -358,28 +224,19 @@
 crbug.com/591099 editing/selection/5232159.html [ Failure ]
 crbug.com/591099 editing/selection/5354455-2.html [ Failure ]
 crbug.com/591099 editing/selection/caret-at-bidi-boundary.html [ Failure ]
-crbug.com/591099 editing/selection/caret-ltr-2-left.html [ Failure ]
-crbug.com/591099 editing/selection/caret-ltr-2.html [ Failure ]
-crbug.com/591099 editing/selection/caret-rtl-2-left.html [ Failure ]
-crbug.com/591099 editing/selection/caret-rtl-2.html [ Failure ]
-crbug.com/591099 editing/selection/caret-rtl-right.html [ Failure ]
-crbug.com/591099 editing/selection/caret-rtl.html [ Failure ]
 crbug.com/591099 editing/selection/continuations-with-move-caret-to-boundary.html [ Failure ]
 crbug.com/591099 editing/selection/continuations-without-move-caret-to-boundary.html [ Failure ]
-crbug.com/591099 editing/selection/designmode-no-caret.html [ Failure ]
 crbug.com/591099 editing/selection/dont-select-text-overflow-ellipsis-when-wrapping-ltr-mixed.html [ Failure ]
 crbug.com/591099 editing/selection/dont-select-text-overflow-ellipsis-when-wrapping-rtl-mixed.html [ Failure ]
 crbug.com/591099 editing/selection/dont-select-text-overflow-ellipsis-when-wrapping-rtl.html [ Failure ]
 crbug.com/591099 editing/selection/dont-select-text-overflow-ellipsis-when-wrapping.html [ Failure ]
 crbug.com/591099 editing/selection/doubleclick-beside-cr-span.html [ Failure ]
 crbug.com/591099 editing/selection/drag-in-iframe.html [ Failure ]
-crbug.com/591099 editing/selection/drag-to-contenteditable-iframe.html [ Failure ]
 crbug.com/591099 editing/selection/extend-inside-transforms-backward.html [ Failure ]
 crbug.com/591099 editing/selection/extend-inside-transforms-forward.html [ Failure ]
 crbug.com/591099 editing/selection/extend-selection-bidi.html [ Failure ]
 crbug.com/591099 editing/selection/focus-body.html [ Failure Pass ]
 crbug.com/591099 editing/selection/home-end.html [ Timeout ]
-crbug.com/591099 editing/selection/leave-requested-block.html [ Failure ]
 crbug.com/591099 editing/selection/line-wrap-2.html [ Failure ]
 crbug.com/591099 editing/selection/linux_selection_color.html [ Failure ]
 crbug.com/591099 editing/selection/mixed-editability-10.html [ Failure ]
@@ -389,12 +246,11 @@
 crbug.com/714962 editing/selection/modify_move/move-forward-after-line-break.html [ Failure ]
 crbug.com/591099 editing/selection/move-3875618-fix.html [ Failure ]
 crbug.com/591099 editing/selection/move-3875641-fix.html [ Failure ]
-crbug.com/591099 editing/selection/move-left-right.html [ Pass Timeout ]
+crbug.com/591099 editing/selection/move-left-right.html [ Timeout ]
 crbug.com/714962 editing/selection/offset-from-point-complex-scripts.html [ Failure ]
 crbug.com/714962 editing/selection/offset-from-point.html [ Failure ]
 crbug.com/591099 editing/selection/paint-hyphen.html [ Failure ]
 crbug.com/591099 editing/selection/paragraph-granularity.html [ Failure ]
-crbug.com/591099 editing/selection/previous-line-position.html [ Failure ]
 crbug.com/591099 editing/selection/programmatic-selection-on-mac-is-directionless.html [ Timeout ]
 crbug.com/591099 editing/selection/select-bidi-run.html [ Failure ]
 crbug.com/591099 editing/selection/select-text-overflow-ellipsis-mixed-in-ltr-2.html [ Failure ]
@@ -402,22 +258,11 @@
 crbug.com/591099 editing/selection/select-text-overflow-ellipsis-mixed-in-rtl-2.html [ Failure ]
 crbug.com/591099 editing/selection/select-text-overflow-ellipsis-mixed-in-rtl.html [ Failure ]
 crbug.com/591099 editing/selection/select-text-overflow-ellipsis.html [ Failure ]
-crbug.com/591099 editing/selection/selectNode.html [ Failure ]
-crbug.com/591099 editing/selection/selectNodeContents.html [ Failure ]
 crbug.com/591099 editing/selection/selection-button-text.html [ Failure ]
 crbug.com/591099 editing/selection/shift-click.html [ Failure ]
 crbug.com/591099 editing/selection/transformed-selection-rects.html [ Failure ]
 crbug.com/591099 editing/selection/word-granularity.html [ Failure ]
 crbug.com/591099 editing/text-iterator/findString.html [ Timeout ]
-crbug.com/591099 editing/unsupported-content/list-delete-001.html [ Failure ]
-crbug.com/591099 editing/unsupported-content/list-delete-003.html [ Failure ]
-crbug.com/591099 editing/unsupported-content/list-type-after.html [ Failure ]
-crbug.com/591099 editing/unsupported-content/list-type-before.html [ Failure ]
-crbug.com/591099 editing/unsupported-content/table-delete-001.html [ Failure ]
-crbug.com/591099 editing/unsupported-content/table-delete-002.html [ Failure ]
-crbug.com/591099 editing/unsupported-content/table-delete-003.html [ Failure ]
-crbug.com/591099 editing/unsupported-content/table-type-after.html [ Failure ]
-crbug.com/591099 editing/unsupported-content/table-type-before.html [ Failure ]
 crbug.com/591099 external/wpt/2dcontext/drawing-images-to-the-canvas/drawimage_html_image_11.html [ Pass ]
 crbug.com/591099 external/wpt/WebCryptoAPI/derive_bits_keys/hkdf.https.worker.html [ Timeout ]
 crbug.com/591099 external/wpt/WebCryptoAPI/derive_bits_keys/test_hkdf.https.html [ Timeout ]
@@ -496,11 +341,7 @@
 crbug.com/591099 external/wpt/css/css-position/position-sticky-writing-modes.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-pseudo/first-letter-002.html [ Pass ]
 crbug.com/591099 external/wpt/css/css-pseudo/first-letter-003.html [ Pass ]
-crbug.com/591099 external/wpt/css/css-rhythm/line-height-step-basic-001.html [ Failure ]
-crbug.com/591099 external/wpt/css/css-rhythm/line-height-step-boundary-001.html [ Failure ]
-crbug.com/591099 external/wpt/css/css-rhythm/line-height-step-dynamic-001.html [ Failure ]
-crbug.com/591099 external/wpt/css/css-rhythm/line-height-step-valign-001.html [ Failure ]
-crbug.com/591099 external/wpt/css/css-rhythm/line-height-step-writing-mode-vrl-001.html [ Failure ]
+crbug.com/591099 external/wpt/css/css-rhythm/ [ Skip ]
 crbug.com/591099 external/wpt/css/css-scroll-anchoring/clipped-scrollers-skipped.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-scroll-anchoring/opt-out.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-scroll-anchoring/position-change-heuristic.html [ Failure ]
@@ -862,7 +703,7 @@
 crbug.com/591099 external/wpt/dom/ranges/Range-mutations-dataChange.html [ Timeout ]
 crbug.com/591099 external/wpt/dom/ranges/Range-set.html [ Timeout ]
 crbug.com/591099 external/wpt/dom/ranges/Range-surroundContents.html [ Timeout ]
-crbug.com/591099 external/wpt/domxpath/xml_xpath_runner.html [ Pass Timeout ]
+crbug.com/591099 external/wpt/domxpath/xml_xpath_runner.html [ Timeout ]
 crbug.com/591099 external/wpt/editing/run/backcolor.html [ Pass Timeout ]
 crbug.com/591099 external/wpt/editing/run/bold.html [ Timeout ]
 crbug.com/591099 external/wpt/editing/run/fontname.html [ Timeout ]
@@ -984,7 +825,7 @@
 crbug.com/591099 external/wpt/encoding/legacy-mb-tchinese/big5/big5-encode-href-errors-misc.html [ Timeout ]
 crbug.com/591099 external/wpt/encoding/legacy-mb-tchinese/big5/big5-encode-href.html [ Timeout ]
 crbug.com/591099 external/wpt/encoding/textdecoder-fatal-single-byte.html [ Timeout ]
-crbug.com/591099 external/wpt/geolocation-API/PositionOptions.https.html [ Failure ]
+crbug.com/591099 external/wpt/geolocation-API/PositionOptions.https.html [ Failure Pass ]
 crbug.com/591099 external/wpt/html-media-capture/capture_audio_cancel-manual.html [ Failure ]
 crbug.com/591099 external/wpt/html-media-capture/capture_image_cancel-manual.html [ Failure ]
 crbug.com/591099 external/wpt/html-media-capture/capture_video_cancel-manual.html [ Failure ]
@@ -1038,7 +879,7 @@
 crbug.com/591099 external/wpt/selection/addRange-16.html [ Timeout ]
 crbug.com/591099 external/wpt/selection/addRange-24.html [ Pass Timeout ]
 crbug.com/591099 external/wpt/selection/addRange-28.html [ Timeout ]
-crbug.com/591099 external/wpt/selection/addRange-32.html [ Pass Timeout ]
+crbug.com/591099 external/wpt/selection/addRange-32.html [ Timeout ]
 crbug.com/591099 external/wpt/selection/addRange-36.html [ Timeout ]
 crbug.com/591099 external/wpt/selection/collapse-00.html [ Timeout ]
 crbug.com/591099 external/wpt/selection/collapse-15.html [ Timeout ]
@@ -1050,7 +891,7 @@
 crbug.com/591099 external/wpt/shadow-dom/DocumentOrShadowRoot-prototype-elementFromPoint.html [ Failure ]
 crbug.com/591099 external/wpt/svg/interfaces.html [ Timeout ]
 crbug.com/591099 external/wpt/svg/linking/reftests/href-filter-element.html [ Failure ]
-crbug.com/591099 external/wpt/url/url-setters.html [ Pass Timeout ]
+crbug.com/591099 external/wpt/url/url-setters.html [ Timeout ]
 crbug.com/591099 external/wpt/wasm/wasm_local_iframe_test.html [ Failure ]
 crbug.com/591099 external/wpt/webaudio/idlharness.https.html [ Timeout ]
 crbug.com/591099 external/wpt/webmessaging/broadcastchannel/sandbox.html [ Failure ]
@@ -1079,37 +920,24 @@
 crbug.com/591099 external/wpt/workers/Worker_terminate_event_queue.htm [ Timeout ]
 crbug.com/591099 external/wpt/xhr/send-authentication-prompt-2-manual.htm [ Failure ]
 crbug.com/591099 fast/animation/scroll-animations/scrolltimeline-currenttime.html [ Failure ]
-crbug.com/591099 fast/backgrounds/animated-gif-as-background-rounded.html [ Failure ]
-crbug.com/591099 fast/backgrounds/animated-gif-as-background.html [ Failure ]
 crbug.com/591099 fast/backgrounds/background-clip-text.html [ Failure ]
-crbug.com/591099 fast/backgrounds/background-inherit-color-bug.html [ Failure ]
 crbug.com/591099 fast/backgrounds/background-leakage-transforms.html [ Failure ]
-crbug.com/591099 fast/backgrounds/background-origin-root-element.html [ Failure ]
 crbug.com/591099 fast/backgrounds/border-radius-split-background-image.html [ Failure ]
 crbug.com/591099 fast/backgrounds/border-radius-split-background.html [ Failure ]
 crbug.com/591099 fast/backgrounds/quirks-mode-line-box-backgrounds.html [ Failure ]
-crbug.com/591099 fast/backgrounds/repeat/noRepeatCorrectClip.html [ Failure ]
 crbug.com/591099 fast/backgrounds/selection-background-color-of-image-list-style.html [ Failure ]
 crbug.com/591099 fast/backgrounds/selection-background-color-of-list-style.html [ Failure ]
 crbug.com/591099 fast/backgrounds/size/backgroundSize16.html [ Failure ]
 crbug.com/591099 fast/backgrounds/size/contain-and-cover.html [ Failure ]
-crbug.com/591099 fast/block/basic/015.html [ Failure ]
-crbug.com/591099 fast/block/basic/016.html [ Failure ]
-crbug.com/591099 fast/block/basic/020.html [ Failure ]
 crbug.com/591099 fast/block/basic/quirk-percent-height-table-cell.html [ Failure ]
-crbug.com/591099 fast/block/basic/truncation-rtl.html [ Failure ]
 crbug.com/591099 fast/block/block-width-recalc-with-relative-height.html [ Failure ]
 crbug.com/591099 fast/block/float-avoids-padding-inline-ancestors.html [ Crash ]
 crbug.com/810335 fast/block/float/003.html [ Failure ]
-crbug.com/591099 fast/block/float/014.html [ Failure ]
-crbug.com/591099 fast/block/float/centered-float-avoidance-complexity.html [ Failure ]
-crbug.com/591099 fast/block/float/editable-text-overlapping-float.html [ Failure ]
 crbug.com/591099 fast/block/float/element-clears-float-without-clearance.html [ Failure ]
 crbug.com/591099 fast/block/float/float-in-float-hit-testing.html [ Failure Pass ]
 crbug.com/591099 fast/block/float/float-in-float-painting.html [ Failure ]
 crbug.com/591099 fast/block/float/floats-offset-image-strict-line-height.html [ Failure ]
 crbug.com/591099 fast/block/float/floats-offset-inline-block-strict-line-height.html [ Failure ]
-crbug.com/591099 fast/block/float/independent-align-positioning.html [ Failure ]
 crbug.com/591099 fast/block/float/negative-margin-on-element-avoiding-floats-with-margin-on-parent.html [ Failure ]
 crbug.com/591099 fast/block/float/negative-margin-on-element-avoiding-floats.html [ Failure ]
 crbug.com/591099 fast/block/float/nopaint-after-layer-destruction.html [ Failure ]
@@ -1122,10 +950,6 @@
 crbug.com/591099 fast/block/margin-collapse/webkit-margin-collapse-separate-position.html [ Failure ]
 crbug.com/591099 fast/block/margin-collapse/webkit-margin-collapse-siblings.html [ Failure ]
 crbug.com/591099 fast/block/over-constrained-auto-margin.html [ Failure ]
-crbug.com/591099 fast/block/positioning/absolute-in-inline-rtl-2.html [ Failure ]
-crbug.com/591099 fast/block/positioning/absolute-in-inline-rtl-3.html [ Failure ]
-crbug.com/591099 fast/block/positioning/absolute-in-inline-rtl.html [ Failure ]
-crbug.com/591099 fast/block/positioning/absolute-in-inline-short-rtl.html [ Failure ]
 crbug.com/591099 fast/block/positioning/abspos-auto-left-and-width-change-parent-margin-left.html [ Crash ]
 crbug.com/591099 fast/block/positioning/auto/vertical-rl/007.html [ Failure ]
 crbug.com/591099 fast/block/positioning/child-of-fixed-pos-after-movement.html [ Crash ]
@@ -1142,14 +966,8 @@
 crbug.com/714962 fast/borders/border-inner-bleed.html [ Failure ]
 crbug.com/714962 fast/borders/border-radius-inline-flow.html [ Failure ]
 crbug.com/591099 fast/borders/border-radius-mask-canvas-all.html [ Failure ]
-crbug.com/591099 fast/borders/border-radius-mask-canvas-border.html [ Failure ]
-crbug.com/591099 fast/borders/border-radius-mask-canvas-padding.html [ Failure ]
 crbug.com/591099 fast/borders/border-radius-mask-canvas-with-mask.html [ Failure ]
 crbug.com/591099 fast/borders/border-radius-mask-canvas-with-shadow.html [ Failure ]
-crbug.com/591099 fast/borders/border-radius-mask-canvas.html [ Failure ]
-crbug.com/591099 fast/borders/border-radius-mask-video-ratio.html [ Failure ]
-crbug.com/591099 fast/borders/border-radius-mask-video-shadow.html [ Failure ]
-crbug.com/591099 fast/borders/border-radius-mask-video.html [ Failure ]
 crbug.com/714962 fast/borders/border-radius-percent.html [ Failure ]
 crbug.com/714962 fast/borders/border-radius-split-inline.html [ Failure ]
 crbug.com/714962 fast/borders/border-styles-split.html [ Failure ]
@@ -1172,7 +990,6 @@
 crbug.com/591099 fast/borders/inline-mask-overlay-image-outset.html [ Failure ]
 crbug.com/591099 fast/borders/inline-mask-overlay-image.html [ Failure ]
 crbug.com/591099 fast/borders/outline-alpha-inline.html [ Failure ]
-crbug.com/591099 fast/borders/rtl-border-02.html [ Failure ]
 crbug.com/714962 fast/borders/table-borders.html [ Failure ]
 crbug.com/591099 fast/box-decoration-break/box-decoration-break-rendering.html [ Failure ]
 crbug.com/591099 fast/box-shadow/basic-shadows.html [ Failure ]
@@ -1180,29 +997,15 @@
 crbug.com/591099 fast/box-shadow/inset-subpixel.html [ Failure ]
 crbug.com/591099 fast/box-shadow/inset.html [ Failure ]
 crbug.com/591099 fast/box-sizing/replaced.html [ Failure Pass ]
-crbug.com/591099 fast/canvas/image-object-in-canvas.html [ Failure ]
-crbug.com/591099 fast/canvas/patternfill-repeat.html [ Failure ]
 crbug.com/591099 fast/clip/overflow-border-radius-combinations.html [ Failure Pass ]
 crbug.com/591099 fast/clip/overflow-border-radius-composited-parent.html [ Failure Pass ]
 crbug.com/591099 fast/clip/overflow-border-radius-composited.html [ Failure Pass ]
-crbug.com/591099 fast/clip/overflow-border-radius-fixed-position.html [ Failure ]
 crbug.com/591099 fast/clip/overflow-border-radius-transformed.html [ Failure ]
-crbug.com/591099 fast/css-generated-content/009.html [ Failure ]
-crbug.com/591099 fast/css-generated-content/012.html [ Failure ]
-crbug.com/591099 fast/css-generated-content/013.html [ Failure ]
 crbug.com/591099 fast/css-generated-content/015.html [ Failure ]
 crbug.com/805301 fast/css-generated-content/crash-selection-editing-removes-pseudo.html [ Failure ]
 crbug.com/591099 fast/css-generated-content/first-letter-next-sibling-crash.html [ Crash ]
 crbug.com/591099 fast/css-generated-content/float-first-letter-siblings-convert-to-inline.html [ Crash ]
 crbug.com/714962 fast/css-generated-content/hover-inline.html [ Failure ]
-crbug.com/591099 fast/css-generated-content/table-before-after-child-add.html [ Failure ]
-crbug.com/591099 fast/css-generated-content/table-cell-before-after-child-add.html [ Failure ]
-crbug.com/591099 fast/css-generated-content/table-row-before-after-child-add.html [ Failure ]
-crbug.com/591099 fast/css-generated-content/table-row-group-to-inline.html [ Failure ]
-crbug.com/591099 fast/css-generated-content/table-row-group-with-before.html [ Failure ]
-crbug.com/591099 fast/css-generated-content/table-row-with-before.html [ Failure ]
-crbug.com/591099 fast/css-generated-content/table-table-before-after-child-add.html [ Failure ]
-crbug.com/591099 fast/css-generated-content/table-with-before.html [ Failure ]
 crbug.com/591099 fast/css-grid-layout/auto-content-resolution-columns.html [ Failure ]
 crbug.com/591099 fast/css-grid-layout/breadth-size-resolution-grid.html [ Failure ]
 crbug.com/591099 fast/css-grid-layout/calc-resolution-grid-item.html [ Failure ]
@@ -1290,7 +1093,7 @@
 crbug.com/591099 fast/css-grid-layout/minmax-min-content-column-resolution-rows.html [ Failure ]
 crbug.com/591099 fast/css-grid-layout/minmax-spanning-resolution-columns.html [ Failure ]
 crbug.com/591099 fast/css-grid-layout/minmax-spanning-resolution-rows.html [ Failure ]
-crbug.com/591099 fast/css-grid-layout/named-grid-line-get-set.html [ Pass Timeout ]
+crbug.com/591099 fast/css-grid-layout/named-grid-line-get-set.html [ Timeout ]
 crbug.com/591099 fast/css-grid-layout/named-grid-lines-with-named-grid-areas-dynamic-get-set.html [ Failure ]
 crbug.com/591099 fast/css-grid-layout/named-grid-lines-with-named-grid-areas-resolution.html [ Failure ]
 crbug.com/591099 fast/css-grid-layout/percent-grid-item-in-percent-grid-track-in-percent-grid.html [ Failure ]
@@ -1315,32 +1118,19 @@
 crbug.com/591099 fast/css-intrinsic-dimensions/indefinite-percent-minmax-content-inlinesize-contribution-nonreplaced-blocks.html [ Failure ]
 crbug.com/591099 fast/css-intrinsic-dimensions/resize-inside-percent-width-overflow-hidden.html [ Failure ]
 crbug.com/807708 fast/css-intrinsic-dimensions/width-avoid-floats.html [ Failure ]
-crbug.com/591099 fast/css/001.html [ Failure ]
-crbug.com/591099 fast/css/004.html [ Failure ]
-crbug.com/591099 fast/css/005.html [ Failure ]
 crbug.com/591099 fast/css/007.html [ Failure ]
-crbug.com/591099 fast/css/ZeroOpacityLayers.html [ Failure ]
-crbug.com/591099 fast/css/ZeroOpacityLayers2.html [ Failure ]
 crbug.com/591099 fast/css/abs-pos-child-inside-rel-pos-inline-001.html [ Failure ]
 crbug.com/591099 fast/css/abs-pos-child-inside-rel-pos-inline-offset-001.html [ Failure ]
 crbug.com/591099 fast/css/absolute-child-with-percent-height-inside-relative-parent.html [ Failure ]
 crbug.com/591099 fast/css/absolute-inline-alignment-2.html [ Pass ]
 crbug.com/714962 fast/css/absolute-inline-alignment.html [ Failure ]
 crbug.com/591099 fast/css/background-image-with-baseurl.html [ Failure Pass ]
-crbug.com/591099 fast/css/background-shorthand-invalid-url.html [ Failure ]
-crbug.com/591099 fast/css/bidi-override-in-anonymous-block.html [ Failure ]
 crbug.com/591099 fast/css/case-transform.html [ Failure ]
-crbug.com/591099 fast/css/clip-zooming.html [ Failure ]
-crbug.com/591099 fast/css/color-correction.html [ Failure ]
 crbug.com/591099 fast/css/containment/size-and-layout-containment.html [ Failure ]
 crbug.com/591099 fast/css/content-counter-010.htm [ Failure ]
 crbug.com/591099 fast/css/css-properties-position-relative-as-parent-fixed.html [ Failure ]
-crbug.com/591099 fast/css/css1_forward_compatible_parsing.html [ Failure ]
-crbug.com/591099 fast/css/css3-modsel-22.html [ Failure ]
-crbug.com/591099 fast/css/css3-space-in-nth-and-lang.html [ Failure ]
 crbug.com/591099 fast/css/first-child-pseudo-class.html [ Failure ]
 crbug.com/714962 fast/css/first-letter-before-hit-test.html [ Failure ]
-crbug.com/591099 fast/css/first-letter-detach.html [ Failure ]
 crbug.com/714962 fast/css/first-letter-hit-test.html [ Failure ]
 crbug.com/714962 fast/css/first-letter-hover-hit-test.html [ Failure ]
 crbug.com/714962 fast/css/first-line-change-color-direct.html [ Failure ]
@@ -1350,30 +1140,19 @@
 crbug.com/591099 fast/css/first-line-text-decoration.html [ Failure ]
 crbug.com/591099 fast/css/first-of-type-pseudo-class.html [ Failure ]
 crbug.com/591099 fast/css/focus-ring-continuations.html [ Failure ]
-crbug.com/591099 fast/css/focus-ring-detached.html [ Failure ]
 crbug.com/714962 fast/css/focus-ring-recursive-continuations.html [ Failure ]
 crbug.com/714962 fast/css/focus-ring-recursive-inlines.html [ Failure ]
-crbug.com/591099 fast/css/font-face-opentype.html [ Failure ]
-crbug.com/591099 fast/css/font_property_normal.html [ Failure ]
 crbug.com/591099 fast/css/getComputedStyle/computed-style-percentage-top-with-position-inline.html [ Failure ]
 crbug.com/591099 fast/css/getComputedStyle/getComputedStyle-margin-auto.html [ Failure ]
 crbug.com/591099 fast/css/getComputedStyle/getComputedStyle-margin-percentage.html [ Failure ]
 crbug.com/591099 fast/css/getComputedStyle/getComputedStyle-resolved-values.html [ Timeout ]
 crbug.com/714962 fast/css/hover-pseudo-element-quirks.html [ Failure ]
-crbug.com/591099 fast/css/ignore-empty-focus-ring-rects.html [ Failure ]
-crbug.com/591099 fast/css/image-orientation/image-orientation-default.html [ Failure ]
-crbug.com/591099 fast/css/image-orientation/image-orientation-from-image-composited-dynamic.html [ Failure ]
-crbug.com/591099 fast/css/image-orientation/image-orientation-from-image-composited.html [ Failure ]
-crbug.com/591099 fast/css/image-orientation/image-orientation-from-image.html [ Failure ]
 crbug.com/591099 fast/css/import_with_baseurl.html [ Failure Pass ]
 crbug.com/591099 fast/css/large-numbers.html [ Timeout ]
 crbug.com/591099 fast/css/last-child-pseudo-class.html [ Failure ]
 crbug.com/591099 fast/css/last-of-type-pseudo-class.html [ Failure ]
-crbug.com/591099 fast/css/list-outline.html [ Failure ]
 crbug.com/591099 fast/css/margin-top-bottom-dynamic.html [ Failure ]
 crbug.com/591099 fast/css/negative-text-indent-in-inline-block.html [ Failure ]
-crbug.com/591099 fast/css/non-empty-span.html [ Failure ]
-crbug.com/591099 fast/css/nth-child-dynamic.html [ Failure ]
 crbug.com/591099 fast/css/only-child-pseudo-class.html [ Failure ]
 crbug.com/591099 fast/css/only-of-type-pseudo-class.html [ Failure ]
 crbug.com/591099 fast/css/outline-auto-empty-rects.html [ Failure ]
@@ -1382,32 +1161,17 @@
 crbug.com/591099 fast/css/overflow-rtl-border-after.html [ Failure ]
 crbug.com/591099 fast/css/percent-min-width-img-src-change.html [ Failure ]
 crbug.com/591099 fast/css/percent-width-img-src-change.html [ Failure ]
-crbug.com/591099 fast/css/relative-positioned-block-nested-with-inline-parent-dynamic.html [ Failure ]
-crbug.com/591099 fast/css/relative-positioned-block-nested-with-inline-parent-multiple-descendant-blocks-dynamic.html [ Failure ]
-crbug.com/591099 fast/css/relative-positioned-block-with-inline-ancestor-and-parent-dynamic.html [ Failure ]
-crbug.com/591099 fast/css/relative-positioned-block-with-inline-ancestor-dynamic.html [ Failure ]
-crbug.com/591099 fast/css/relative-positioned-block-with-inline-ancestor.html [ Failure ]
-crbug.com/591099 fast/css/relative-positioned-block-with-inline-parent-dynamic.html [ Failure ]
 crbug.com/591099 fast/css/resize-corner-tracking.html [ Failure ]
-crbug.com/591099 fast/css/selector-set-attribute.html [ Failure ]
 crbug.com/591099 fast/css/sticky/sticky-top-overflow-scroll-by-fragment.html [ Failure ]
-crbug.com/591099 fast/css/text-align.html [ Failure ]
-crbug.com/591099 fast/css/text-overflow-ellipsis-bidi.html [ Failure ]
-crbug.com/591099 fast/css/text-overflow-ellipsis-block-with-border-and-padding.html [ Failure ]
-crbug.com/591099 fast/css/text-overflow-ellipsis-strict.html [ Failure ]
 crbug.com/591099 fast/css/text-overflow-ellipsis-text-align-center.html [ Failure ]
 crbug.com/591099 fast/css/text-overflow-ellipsis-text-align-justify.html [ Failure ]
 crbug.com/591099 fast/css/text-overflow-ellipsis-text-align-left.html [ Failure ]
 crbug.com/591099 fast/css/text-overflow-ellipsis-text-align-right.html [ Failure ]
 crbug.com/714962 fast/css/text-overflow-ellipsis-vertical-hittest.html [ Failure ]
 crbug.com/591099 fast/css/text-overflow-ellipsis-vertical-select.html [ Failure ]
-crbug.com/591099 fast/css/text-overflow-ellipsis.html [ Failure ]
-crbug.com/591099 fast/css/text-rendering.html [ Failure ]
-crbug.com/591099 fast/css/textCapitalizeEdgeCases.html [ Failure ]
 crbug.com/591099 fast/css/vertical-align-lengths.html [ Failure ]
 crbug.com/591099 fast/css/word-space-extra.html [ Failure ]
 crbug.com/591099 fast/css3-text/css3-text-decoration/text-decoration-skip-ink.html [ Failure ]
-crbug.com/591099 fast/css3-text/css3-text-decoration/text-underline-position/text-underline-position-all.html [ Failure ]
 crbug.com/591099 fast/css3-text/css3-text-decoration/text-underline-position/text-underline-position-auto.html [ Failure Pass ]
 crbug.com/591099 fast/css3-text/css3-text-decoration/text-underline-position/text-underline-position-cjk.html [ Failure ]
 crbug.com/714962 fast/css3-text/css3-text-decoration/text-underline-position/text-underline-position-subscript.html [ Failure ]
@@ -1420,8 +1184,6 @@
 crbug.com/591099 fast/css3-text/css3-text-justify/text-justify-distribute.html [ Failure ]
 crbug.com/591099 fast/deprecated-flexbox/004.html [ Failure ]
 crbug.com/591099 fast/deprecated-flexbox/009-horizontal.html [ Failure ]
-crbug.com/591099 fast/deprecated-flexbox/023.html [ Failure ]
-crbug.com/591099 fast/deprecated-flexbox/024.html [ Failure ]
 crbug.com/591099 fast/deprecated-flexbox/flexing-overflow-scroll-item.html [ Failure ]
 crbug.com/591099 fast/deprecated-flexbox/relpos-flex-item-with-percent-height-abspos-child.html [ Failure ]
 crbug.com/591099 fast/deprecated-flexbox/relpos-flex-item-with-percent-height-abspos-descendant.html [ Failure ]
@@ -1433,15 +1195,11 @@
 crbug.com/714962 fast/dom/Element/client-rect-list-argument.html [ Failure ]
 crbug.com/591099 fast/dom/Element/getBoundingClientRect.html [ Failure ]
 crbug.com/714962 fast/dom/Element/getClientRects.html [ Failure ]
-crbug.com/591099 fast/dom/HTMLMeterElement/meter-boundary-values.html [ Failure ]
-crbug.com/591099 fast/dom/HTMLMeterElement/meter-optimums.html [ Failure ]
-crbug.com/591099 fast/dom/HTMLObjectElement/vspace-hspace-as-number.html [ Failure ]
-crbug.com/591099 fast/dom/HTMLProgressElement/progress-bar-value-pseudo-element.html [ Failure ]
+crbug.com/591099 fast/dom/HTMLAreaElement/area-download.html [ Failure ]
 crbug.com/714962 fast/dom/Range/getBoundingClientRect-linebreak-character.html [ Failure ]
 crbug.com/591099 fast/dom/Window/property-access-on-cached-window-after-frame-navigated.html [ Timeout ]
 crbug.com/591099 fast/dom/Window/window-lookup-precedence.html [ Timeout ]
 crbug.com/591099 fast/dom/Window/window-postmessage-clone-deep-array.html [ Failure ]
-crbug.com/591099 fast/dom/clone-node-dynamic-style.html [ Failure ]
 crbug.com/591099 fast/dom/domstring-attribute-reflection.html [ Timeout ]
 crbug.com/591099 fast/dom/element-attribute-js-null.html [ Timeout ]
 crbug.com/714962 fast/dom/elementFromPoint-relative-to-viewport.html [ Failure ]
@@ -1457,15 +1215,11 @@
 crbug.com/714962 fast/dom/shadow/scrollbar.html [ Crash ]
 crbug.com/591099 fast/dom/shadow/selections-in-shadow.html [ Timeout ]
 crbug.com/591099 fast/dom/wrapper-classes.html [ Timeout ]
-crbug.com/591099 fast/dynamic/011.html [ Failure ]
 crbug.com/591099 fast/dynamic/first-letter-after-list-marker.html [ Failure ]
-crbug.com/591099 fast/dynamic/outerHTML-doc.html [ Failure ]
-crbug.com/591099 fast/dynamic/outerHTML-img.html [ Failure ]
 crbug.com/591099 fast/dynamic/selection-highlight-adjust.html [ Failure ]
 crbug.com/591099 fast/dynamic/text-combine.html [ Failure ]
 crbug.com/591099 fast/encoding/utf-16-big-endian.html [ Failure ]
 crbug.com/591099 fast/encoding/utf-16-little-endian.html [ Failure ]
-crbug.com/591099 fast/encoding/xmacroman-encoding-test.html [ Failure ]
 crbug.com/714962 fast/events/drag-in-frames.html [ Failure ]
 crbug.com/714962 fast/events/event-on-culled_inline.html [ Failure ]
 crbug.com/591099 fast/events/keyboardevent-getModifierState.html [ Timeout ]
@@ -1475,12 +1229,11 @@
 crbug.com/591099 fast/events/mouse-relative-position.html [ Failure ]
 crbug.com/591099 fast/events/mouseevent-getModifierState.html [ Timeout ]
 crbug.com/591099 fast/events/onclick-list-marker.html [ Failure ]
-crbug.com/591099 fast/events/pointer-events-2.html [ Failure ]
 crbug.com/591099 fast/events/pointerevents/mouse-pointer-capture-transition-events.html [ Timeout ]
 crbug.com/591099 fast/events/pointerevents/mouse-pointer-capture.html [ Timeout ]
 crbug.com/591099 fast/events/pointerevents/mouse-pointer-event-properties.html [ Timeout ]
 crbug.com/591099 fast/events/pointerevents/mouse-pointer-preventdefault.html [ Timeout ]
-crbug.com/591099 fast/events/pointerevents/multi-pointer-preventdefault.html [ Pass Timeout ]
+crbug.com/591099 fast/events/pointerevents/multi-pointer-preventdefault.html [ Timeout ]
 crbug.com/591099 fast/events/pointerevents/touch-capture-in-iframe.html [ Timeout ]
 crbug.com/591099 fast/events/pointerevents/touch-capture.html [ Timeout ]
 crbug.com/591099 fast/events/select-element.html [ Timeout ]
@@ -1489,51 +1242,28 @@
 crbug.com/591099 fast/events/touch/compositor-touch-hit-rects.html [ Failure ]
 crbug.com/591099 fast/events/wheel/mainthread-touchpad-fling-latching.html [ Pass ]
 crbug.com/591099 fast/events/wheel/wheel-scroll-latching-on-scrollbar.html [ Pass ]
-crbug.com/591099 fast/forms/001.html [ Failure ]
-crbug.com/591099 fast/forms/006.html [ Failure ]
-crbug.com/591099 fast/forms/calendar-picker/calendar-picker-key-operations.html [ Pass Timeout ]
+crbug.com/591099 fast/forms/calendar-picker/calendar-picker-key-operations.html [ Timeout ]
 crbug.com/714962 fast/forms/calendar-picker/calendar-picker-mouse-operations.html [ Failure ]
 crbug.com/591099 fast/forms/calendar-picker/month-picker-key-operations.html [ Timeout ]
 crbug.com/714962 fast/forms/calendar-picker/month-picker-mouse-operations.html [ Failure ]
 crbug.com/591099 fast/forms/calendar-picker/week-picker-key-operations.html [ Timeout ]
 crbug.com/714962 fast/forms/calendar-picker/week-picker-mouse-operations.html [ Failure ]
-crbug.com/591099 fast/forms/color/input-appearance-color.html [ Failure ]
 crbug.com/591099 fast/forms/control-clip-overflow.html [ Failure ]
-crbug.com/591099 fast/forms/date/date-appearance-basic.html [ Failure ]
-crbug.com/591099 fast/forms/date/date-appearance-pseudo-elements.html [ Failure ]
-crbug.com/591099 fast/forms/datetimelocal/datetimelocal-appearance-basic.html [ Failure ]
 crbug.com/591099 fast/forms/fieldset/fieldset-with-float.html [ Failure ]
-crbug.com/591099 fast/forms/form-element-geometry.html [ Failure ]
 crbug.com/591099 fast/forms/form-hides-table.html [ Failure ]
-crbug.com/591099 fast/forms/image/image-alt-text.html [ Failure ]
 crbug.com/714962 fast/forms/label/continous-click-on-label.html [ Failure ]
 crbug.com/591099 fast/forms/long-text-in-input.html [ Crash Failure ]
-crbug.com/591099 fast/forms/month/month-appearance-basic.html [ Failure ]
-crbug.com/591099 fast/forms/month/month-appearance-pseudo-elements.html [ Failure ]
-crbug.com/591099 fast/forms/plaintext-mode-2.html [ Failure ]
-crbug.com/591099 fast/forms/select-popup/popup-menu-appearance-zoom.html [ Failure ]
 crbug.com/591099 fast/forms/select/select-initial-position.html [ Failure ]
-crbug.com/591099 fast/forms/select/select-multiple-rtl.html [ Failure ]
 crbug.com/591099 fast/forms/select/select-style.html [ Failure ]
-crbug.com/591099 fast/forms/select/select-writing-direction-natural.html [ Failure ]
 crbug.com/591099 fast/forms/selection-direction.html [ Timeout ]
 crbug.com/591099 fast/forms/suggestion-picker/date-suggestion-picker-appearance-zoom125.html [ Failure ]
 crbug.com/591099 fast/forms/suggestion-picker/date-suggestion-picker-appearance-zoom200.html [ Failure ]
 crbug.com/591099 fast/forms/text-control-intrinsic-widths.html [ Timeout ]
-crbug.com/591099 fast/forms/textarea/basic-textareas-quirks.html [ Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-align.html [ Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-metrics.html [ Timeout ]
 crbug.com/591099 fast/forms/time-multiple-fields/time-multiple-fields-stepup-stepdown-from-renderer.html [ Timeout ]
-crbug.com/591099 fast/forms/time/time-appearance-basic.html [ Failure ]
-crbug.com/591099 fast/forms/time/time-appearance-pseudo-elements.html [ Failure ]
-crbug.com/591099 fast/forms/validation-bubble-appearance-rtl-ui.html [ Failure ]
-crbug.com/591099 fast/forms/week/week-appearance-basic.html [ Failure ]
-crbug.com/591099 fast/forms/week/week-appearance-pseudo-elements.html [ Failure ]
 crbug.com/591099 fast/frames/iframe-with-frameborder.html [ Failure ]
-crbug.com/591099 fast/gradients/generated-gradients.html [ Failure ]
 crbug.com/591099 fast/gradients/list-item-gradient.html [ Failure ]
-crbug.com/591099 fast/gradients/radial-centered.html [ Failure ]
-crbug.com/591099 fast/gradients/simple-gradients.html [ Failure ]
 crbug.com/591099 fast/gradients/unprefixed-list-item-gradient.html [ Failure ]
 crbug.com/591099 fast/hidpi/image-set-list-style-image.html [ Failure ]
 crbug.com/591099 fast/hidpi/image-set-shape-outside.html [ Failure ]
@@ -1543,13 +1273,10 @@
 crbug.com/591099 fast/inline-block/contenteditable-baseline.html [ Failure ]
 crbug.com/714962 fast/inline-block/tricky-baseline.html [ Failure ]
 crbug.com/591099 fast/inline-block/vertical-align-top-and-bottom-2.html [ Failure ]
-crbug.com/591099 fast/inline/absolute-positioned-inline-in-centred-block.html [ Failure ]
 crbug.com/591099 fast/inline/bpm-inline-ancestors.html [ Failure ]
 crbug.com/714962 fast/inline/continuation-outlines-with-layers-2.html [ Failure ]
 crbug.com/591099 fast/inline/continuation-outlines-with-layers.html [ Failure ]
 crbug.com/591099 fast/inline/continuation-outlines.html [ Failure ]
-crbug.com/591099 fast/inline/emptyInlinesWithinLists.html [ Failure ]
-crbug.com/591099 fast/inline/inline-borders-with-bidi-override.html [ Failure ]
 crbug.com/591099 fast/inline/inline-box-background-long-image.html [ Failure ]
 crbug.com/591099 fast/inline/inline-box-background-repeat-x.html [ Failure ]
 crbug.com/591099 fast/inline/inline-box-background-repeat-y.html [ Failure ]
@@ -1559,53 +1286,34 @@
 crbug.com/591099 fast/inline/inline-with-empty-inline-children.html [ Failure ]
 crbug.com/591099 fast/inline/justify-emphasis-inline-box.html [ Failure ]
 crbug.com/591099 fast/inline/nested-text-descendants.html [ Failure ]
-crbug.com/591099 fast/inline/nested-top-alignment.html [ Failure ]
 crbug.com/591099 fast/inline/outline-continuations.html [ Failure ]
 crbug.com/714962 fast/inline/outline-offset.html [ Failure ]
 crbug.com/591099 fast/inline/styledEmptyInlinesWithBRs.html [ Failure ]
-crbug.com/591099 fast/invalid/010.html [ Failure ]
 crbug.com/591099 fast/js/dfg-arguments-alias-activation.html [ Timeout ]
 crbug.com/591099 fast/js/dfg-byte-array-put.html [ Timeout ]
 crbug.com/591099 fast/js/document-all-triggers-masquerades-watchpoint.html [ Timeout ]
-crbug.com/591099 fast/layers/opacity-transforms.html [ Failure ]
-crbug.com/591099 fast/layers/scroll-rect-to-visible.html [ Failure ]
 crbug.com/591099 fast/layout/scroll-anchoring/fullscreen-crash.html [ Crash ]
 crbug.com/591099 fast/lists/001-vertical.html [ Failure ]
 crbug.com/591099 fast/lists/001.html [ Failure ]
 crbug.com/591099 fast/lists/002-vertical.html [ Failure ]
-crbug.com/591099 fast/lists/002.html [ Failure ]
 crbug.com/591099 fast/lists/003-vertical.html [ Failure ]
 crbug.com/591099 fast/lists/003.html [ Failure ]
 crbug.com/591099 fast/lists/004.html [ Failure ]
-crbug.com/591099 fast/lists/005-vertical.html [ Failure ]
-crbug.com/591099 fast/lists/005.html [ Failure ]
 crbug.com/591099 fast/lists/007-vertical.html [ Failure ]
-crbug.com/591099 fast/lists/007.html [ Failure ]
-crbug.com/591099 fast/lists/008-vertical.html [ Failure ]
-crbug.com/591099 fast/lists/008.html [ Failure ]
-crbug.com/591099 fast/lists/009-vertical.html [ Failure ]
-crbug.com/591099 fast/lists/big-list-marker.html [ Failure ]
 crbug.com/591099 fast/lists/calc-width-with-space.html [ Failure ]
 crbug.com/591099 fast/lists/drag-into-marker.html [ Failure ]
-crbug.com/591099 fast/lists/dynamic-marker-crash.html [ Failure ]
 crbug.com/591099 fast/lists/inline-before-content-after-list-marker.html [ Failure ]
-crbug.com/591099 fast/lists/inlineBoxWrapperNullCheck.html [ Failure ]
 crbug.com/591099 fast/lists/list-color-change-no-layout.html [ Failure ]
 crbug.com/591099 fast/lists/list-item-line-height.html [ Failure ]
 crbug.com/591099 fast/lists/list-marker-before-content-table.html [ Failure ]
 crbug.com/591099 fast/lists/marker-before-empty-inline.html [ Failure ]
-crbug.com/591099 fast/lists/marker-image-error.html [ Failure ]
 crbug.com/826267 fast/lists/markers-in-selection.html [ Failure ]
-crbug.com/591099 fast/lists/ol-display-types.html [ Failure ]
-crbug.com/591099 fast/lists/ordered-list-with-no-ol-tag.html [ Failure ]
-crbug.com/591099 fast/lists/scrolled-marker-paint.html [ Failure ]
 crbug.com/591099 fast/masking/clip-path-selection.html [ Failure ]
 crbug.com/591099 fast/media/mq-display-mode-fullscreen.html [ Crash ]
 crbug.com/824918 fast/multicol/balance-floats.html [ Failure ]
 crbug.com/824918 fast/multicol/break-before-first-line-in-first-child.html [ Failure ]
 crbug.com/824918 fast/multicol/caret-range-anonymous-block-rtl.html [ Failure ]
 crbug.com/824918 fast/multicol/caret-range-anonymous-block.html [ Failure ]
-crbug.com/591099 fast/multicol/composited-inner-multicol.html [ Failure ]
 crbug.com/824918 fast/multicol/dynamic/change-spanner-display.html [ Failure ]
 crbug.com/824918 fast/multicol/flipped-blocks-hit-test.html [ Failure ]
 crbug.com/824918 fast/multicol/hit-test-above-or-below.html [ Failure ]
@@ -1638,7 +1346,6 @@
 crbug.com/714962 fast/overflow/overflow-text-hit-testing.html [ Failure ]
 crbug.com/591099 fast/overflow/overflow-update-transform.html [ Failure ]
 crbug.com/591099 fast/overflow/overflow-with-local-background-attachment.html [ Failure ]
-crbug.com/591099 fast/overflow/overflow-x-y.html [ Failure ]
 crbug.com/591099 fast/overflow/recompute-overflow-of-layout-root-container.html [ Failure ]
 crbug.com/824918 fast/pagination/div-y-vertical-rl-ltr.html [ Failure ]
 crbug.com/824918 fast/pagination/div-y-vertical-rl-rtl.html [ Failure ]
@@ -1652,16 +1359,12 @@
 crbug.com/591099 fast/parser/001.html [ Failure ]
 crbug.com/591099 fast/parser/entities-in-html.html [ Failure ]
 crbug.com/591099 fast/parser/entities-in-xhtml.xhtml [ Failure ]
-crbug.com/591099 fast/parser/xhtml-alternate-entities.xml [ Failure ]
-crbug.com/591099 fast/reflections/opacity-reflection-transform.html [ Failure ]
-crbug.com/591099 fast/reflections/reflection-overflow-hidden.html [ Failure ]
 crbug.com/591099 fast/replaced/absolute-position-percentage-height.html [ Failure ]
 crbug.com/591099 fast/replaced/border-radius-clip.html [ Failure ]
 crbug.com/591099 fast/replaced/computed-image-width-with-percent-height-and-fixed-ancestor-vertical-lr.html [ Failure ]
 crbug.com/591099 fast/replaced/percent-height-in-anonymous-block.html [ Failure ]
 crbug.com/591099 fast/replaced/preferred-widths.html [ Failure ]
 crbug.com/591099 fast/replaced/replaced-element-with-percentage-height-anonymous-block-parent.html [ Failure ]
-crbug.com/591099 fast/replaced/selection-rect-in-table-cell.html [ Failure ]
 crbug.com/591099 fast/replaced/table-percent-height.html [ Failure ]
 crbug.com/591099 fast/replaced/table-percent-width.html [ Failure ]
 crbug.com/591099 fast/replaced/table-replaced-element.html [ Failure ]
@@ -1706,9 +1409,6 @@
 crbug.com/591099 fast/scrolling/scrollable-area-frame-overflow-hidden.html [ Failure ]
 crbug.com/591099 fast/scrolling/scrollbar-tickmarks-hittest.html [ Pass ]
 crbug.com/591099 fast/selectors/038.html [ Failure ]
-crbug.com/591099 fast/selectors/040.html [ Failure ]
-crbug.com/591099 fast/selectors/041.html [ Failure ]
-crbug.com/591099 fast/selectors/166.html [ Failure ]
 crbug.com/591099 fast/selectors/167.html [ Failure ]
 crbug.com/591099 fast/selectors/167a.html [ Failure ]
 crbug.com/591099 fast/shapes/shape-outside-floats/shape-outside-big-box-border-radius-001.html [ Failure ]
@@ -1780,62 +1480,12 @@
 crbug.com/591099 fast/sub-pixel/computedstylemargin.html [ Failure ]
 crbug.com/591099 fast/sub-pixel/inline-block-with-padding.html [ Failure ]
 crbug.com/591099 fast/sub-pixel/sub-pixel-border-2.html [ Failure ]
-crbug.com/591099 fast/table/018.html [ Failure ]
 crbug.com/591099 fast/table/032.html [ Failure ]
-crbug.com/591099 fast/table/040-vertical.html [ Failure ]
-crbug.com/591099 fast/table/040.html [ Failure ]
-crbug.com/591099 fast/table/backgr_border-table-cell-collapsed-border.html [ Failure ]
-crbug.com/591099 fast/table/backgr_border-table-cell.html [ Failure ]
-crbug.com/591099 fast/table/backgr_border-table-collapsed-border.html [ Failure ]
-crbug.com/591099 fast/table/backgr_border-table-column-collapsed-border.html [ Failure ]
-crbug.com/591099 fast/table/backgr_border-table-column-group-collapsed-border.html [ Failure ]
-crbug.com/591099 fast/table/backgr_border-table-column-group.html [ Failure ]
-crbug.com/591099 fast/table/backgr_border-table-column.html [ Failure ]
-crbug.com/591099 fast/table/backgr_border-table-quirks-collapsed-border.html [ Failure ]
-crbug.com/591099 fast/table/backgr_border-table-quirks.html [ Failure ]
-crbug.com/591099 fast/table/backgr_border-table-row-collapsed-border.html [ Failure ]
-crbug.com/591099 fast/table/backgr_border-table-row-group-collapsed-border.html [ Failure ]
-crbug.com/591099 fast/table/backgr_border-table-row-group.html [ Failure ]
-crbug.com/591099 fast/table/backgr_border-table-row.html [ Failure ]
-crbug.com/591099 fast/table/backgr_border-table.html [ Failure ]
-crbug.com/591099 fast/table/backgr_layers-hide-collapsed-border.html [ Failure ]
-crbug.com/591099 fast/table/backgr_layers-hide.html [ Failure ]
-crbug.com/591099 fast/table/backgr_layers-opacity-collapsed-border.html [ Failure ]
-crbug.com/591099 fast/table/backgr_layers-opacity.html [ Failure ]
-crbug.com/591099 fast/table/backgr_layers-show-collapsed-border.html [ Failure ]
-crbug.com/591099 fast/table/backgr_layers-show.html [ Failure ]
-crbug.com/591099 fast/table/backgr_position-table-cell-collapsed-border.html [ Failure ]
-crbug.com/591099 fast/table/backgr_position-table-cell.html [ Failure ]
-crbug.com/591099 fast/table/backgr_position-table-collapsed-border.html [ Failure ]
-crbug.com/591099 fast/table/backgr_position-table-column-collapsed-border.html [ Failure ]
-crbug.com/591099 fast/table/backgr_position-table-column-group-collapsed-border.html [ Failure ]
-crbug.com/591099 fast/table/backgr_position-table-column-group.html [ Failure ]
-crbug.com/591099 fast/table/backgr_position-table-column.html [ Failure ]
-crbug.com/591099 fast/table/backgr_position-table-row-collapsed-border.html [ Failure ]
-crbug.com/591099 fast/table/backgr_position-table-row-group-collapsed-border.html [ Failure ]
-crbug.com/591099 fast/table/backgr_position-table-row-group.html [ Failure ]
-crbug.com/591099 fast/table/backgr_position-table-row.html [ Failure ]
-crbug.com/591099 fast/table/backgr_position-table.html [ Failure ]
-crbug.com/591099 fast/table/backgr_simple-table-cell-collapsed-border.html [ Failure ]
-crbug.com/591099 fast/table/backgr_simple-table-cell.html [ Failure ]
-crbug.com/591099 fast/table/backgr_simple-table-collapsed-border.html [ Failure ]
-crbug.com/591099 fast/table/backgr_simple-table-column-collapsed-border.html [ Failure ]
-crbug.com/591099 fast/table/backgr_simple-table-column-group-collapsed-border.html [ Failure ]
-crbug.com/591099 fast/table/backgr_simple-table-column-group.html [ Failure ]
-crbug.com/591099 fast/table/backgr_simple-table-column.html [ Failure ]
-crbug.com/591099 fast/table/backgr_simple-table-row-collapsed-border.html [ Failure ]
-crbug.com/591099 fast/table/backgr_simple-table-row-group-collapsed-border.html [ Failure ]
-crbug.com/591099 fast/table/backgr_simple-table-row-group.html [ Failure ]
-crbug.com/591099 fast/table/backgr_simple-table-row.html [ Failure ]
-crbug.com/591099 fast/table/backgr_simple-table.html [ Failure ]
 crbug.com/591099 fast/table/background-gradient-border-collapsed.html [ Failure ]
 crbug.com/591099 fast/table/border-collapsing/003-vertical.html [ Failure ]
 crbug.com/591099 fast/table/border-collapsing/004-vertical.html [ Failure ]
-crbug.com/591099 fast/table/border-collapsing/004.html [ Failure ]
 crbug.com/591099 fast/table/border-collapsing/border-collapsing-head-foot-vertical.html [ Failure ]
 crbug.com/591099 fast/table/border-collapsing/composited-cell-collapsed-border.html [ Failure ]
-crbug.com/591099 fast/table/border-collapsing/rtl-border-collapsing-vertical.html [ Failure ]
-crbug.com/591099 fast/table/border-collapsing/rtl-border-collapsing.html [ Failure ]
 crbug.com/591099 fast/table/column-in-inline.html [ Failure ]
 crbug.com/591099 fast/table/dynamic-descendant-percentage-height.html [ Failure ]
 crbug.com/591099 fast/table/empty-table-percent-height.html [ Failure ]
@@ -1856,8 +1506,6 @@
 crbug.com/591099 fast/table/percent-height-replaced-content-in-cell.html [ Failure ]
 crbug.com/591099 fast/table/percent-widths-stretch-vertical.html [ Failure ]
 crbug.com/591099 fast/table/split-table-section-before-anonymous-block-2.html [ Failure ]
-crbug.com/591099 fast/table/split-table-section-before-anonymous-block-3.html [ Failure ]
-crbug.com/591099 fast/table/split-table-section-before-anonymous-block-4.html [ Failure ]
 crbug.com/591099 fast/table/table-display-types-vertical.html [ Failure ]
 crbug.com/591099 fast/table/unbreakable-images-quirk.html [ Failure ]
 crbug.com/591099 fast/table/vertical-align-baseline-readjust.html [ Failure ]
@@ -1920,19 +1568,11 @@
 crbug.com/591099 fast/text-autosizing/wide-block.html [ Failure ]
 crbug.com/591099 fast/text-autosizing/wide-child.html [ Failure ]
 crbug.com/591099 fast/text-autosizing/wide-in-narrow-overflow-scroll.html [ Failure ]
-crbug.com/591099 fast/text/atomic-inline-before-ellipsis.html [ Failure ]
-crbug.com/591099 fast/text/basic/007.html [ Failure ]
-crbug.com/591099 fast/text/basic/009.html [ Failure ]
-crbug.com/591099 fast/text/basic/013.html [ Failure ]
-crbug.com/591099 fast/text/basic/015.html [ Failure ]
 crbug.com/591099 fast/text/break-word-with-floats.html [ Failure ]
-crbug.com/591099 fast/text/capitalize-boundaries.html [ Failure ]
-crbug.com/591099 fast/text/color-emoji.html [ Failure ]
 crbug.com/591099 fast/text/complex-text-opacity.html [ Failure ]
 crbug.com/591099 fast/text/container-align-with-inlines.html [ Failure ]
 crbug.com/591099 fast/text/decorations-transformed.html [ Failure ]
 crbug.com/591099 fast/text/decorations-with-text-combine.html [ Failure ]
-crbug.com/591099 fast/text/ellipsis-at-edge-of-ltr-text-in-rtl-flow.html [ Failure ]
 crbug.com/591099 fast/text/ellipsis-at-edge-of-rtl-text-in-ltr-flow.html [ Failure ]
 crbug.com/591099 fast/text/ellipsis-in-absolute-block.html [ Failure ]
 crbug.com/714962 fast/text/ellipsis-in-justified-text.html [ Failure ]
@@ -1957,38 +1597,16 @@
 crbug.com/591099 fast/text/emphasis-complex.html [ Failure ]
 crbug.com/591099 fast/text/emphasis-ellipsis-complextext.html [ Failure ]
 crbug.com/591099 fast/text/emphasis-overlap.html [ Failure ]
-crbug.com/591099 fast/text/fake-italic.html [ Failure ]
-crbug.com/591099 fast/text/fallback-for-custom-font.html [ Failure ]
 crbug.com/591099 fast/text/find-kana.html [ Timeout ]
-crbug.com/591099 fast/text/font-features/caps-native-synthesis.html [ Failure ]
-crbug.com/591099 fast/text/font-stretch-variant.html [ Failure ]
 crbug.com/591099 fast/text/hide-atomic-inlines-after-ellipsis.html [ Failure ]
-crbug.com/591099 fast/text/international/bidi-CS-after-AN.html [ Failure ]
-crbug.com/591099 fast/text/international/bidi-LDB-2-CSS.html [ Failure ]
-crbug.com/591099 fast/text/international/bidi-LDB-2-HTML.html [ Failure ]
-crbug.com/591099 fast/text/international/bidi-LDB-2-formatting-characters.html [ Failure ]
-crbug.com/591099 fast/text/international/bidi-ignored-for-first-child-inline.html [ Failure ]
-crbug.com/591099 fast/text/international/bidi-innertext.html [ Failure ]
-crbug.com/591099 fast/text/international/bidi-linebreak-001.html [ Failure ]
 crbug.com/591099 fast/text/international/bidi-linebreak-002.html [ Failure ]
 crbug.com/591099 fast/text/international/bidi-linebreak-003.html [ Failure ]
-crbug.com/591099 fast/text/international/bidi-listbox-atsui.html [ Failure ]
-crbug.com/591099 fast/text/international/bidi-mirror-he-ar.html [ Failure ]
-crbug.com/591099 fast/text/international/bidi-neutral-directionality-paragraph-start.html [ Failure ]
 crbug.com/714962 fast/text/international/hindi-whitespace.html [ Failure ]
-crbug.com/591099 fast/text/international/plane2.html [ Failure ]
 crbug.com/591099 fast/text/international/rtl-white-space-pre-wrap.html [ Failure ]
 crbug.com/796943 fast/text/international/shape-across-elements-simple.html [ Pass ]
 crbug.com/591099 fast/text/international/text-combine-image-test.html [ Failure ]
-crbug.com/591099 fast/text/international/thai-baht-space.html [ Failure ]
-crbug.com/591099 fast/text/international/unicode-bidi-plaintext.html [ Failure ]
-crbug.com/591099 fast/text/international/wrap-CJK-001.html [ Failure ]
 crbug.com/591099 fast/text/international/zerowidthjoiner.html [ Failure ]
-crbug.com/591099 fast/text/justify-ideograph-complex.html [ Failure ]
-crbug.com/591099 fast/text/justify-ideograph-simple.html [ Failure ]
-crbug.com/591099 fast/text/justify-ideograph-vertical.html [ Failure ]
 crbug.com/591099 fast/text/large-text-composed-char.html [ Timeout ]
-crbug.com/591099 fast/text/orientation-sideways.html [ Failure ]
 crbug.com/591099 fast/text/place-ellipsis-in-inline-block-adjacent-float-2.html [ Failure ]
 crbug.com/591099 fast/text/place-ellipsis-in-inline-block-adjacent-float.html [ Failure ]
 crbug.com/591099 fast/text/place-ellipsis-in-inline-blocks-2.html [ Failure ]
@@ -2021,23 +1639,15 @@
 crbug.com/591099 fast/text/selection/selection-rect-rounding.html [ Failure ]
 crbug.com/591099 fast/text/selection/selection-with-inline-padding.html [ Failure ]
 crbug.com/714962 fast/text/selection/shaping-selection-rect.html [ Failure ]
-crbug.com/591099 fast/text/shaping/same-script-different-lang.html [ Failure ]
-crbug.com/591099 fast/text/stroking-decorations.html [ Failure ]
-crbug.com/591099 fast/text/sub-pixel/text-scaling-pixel.html [ Failure ]
-crbug.com/591099 fast/text/text-letter-spacing.html [ Failure ]
-crbug.com/591099 fast/text/trailing-white-space-2.html [ Failure ]
-crbug.com/591099 fast/text/trailing-white-space.html [ Failure ]
 crbug.com/714962 fast/text/transform-text-first-line-capitalize.html [ Failure ]
 crbug.com/714962 fast/text/transform-text-first-line-lowercase.html [ Failure ]
 crbug.com/714962 fast/text/transform-text-first-line.html [ Failure ]
 crbug.com/714962 fast/text/unicode-fallback-font.html [ Failure ]
 crbug.com/591099 fast/text/whitespace/018.html [ Failure ]
-crbug.com/591099 fast/text/whitespace/028.html [ Failure ]
 crbug.com/591099 fast/text/whitespace/inline-whitespace-wrapping-3.html [ Failure ]
 crbug.com/591099 fast/text/whitespace/inline-whitespace-wrapping-4.html [ Failure ]
 crbug.com/591099 fast/text/whitespace/inline-whitespace-wrapping-5.html [ Failure ]
 crbug.com/591099 fast/text/whitespace/normal-after-nowrap-breaking.html [ Failure ]
-crbug.com/591099 fast/text/word-space.html [ Failure ]
 crbug.com/591099 fast/text/zero-width-characters-complex-script.html [ Failure ]
 crbug.com/591099 fast/text/zero-width-characters.html [ Failure ]
 crbug.com/591099 fast/writing-mode/Kusa-Makura-background-canvas.html [ Failure ]
@@ -2075,7 +1685,6 @@
 crbug.com/591099 fast/writing-mode/vertical-baseline-alignment.html [ Failure ]
 crbug.com/591099 fast/writing-mode/vertical-font-fallback.html [ Failure ]
 crbug.com/591099 fast/writing-mode/vertical-lr-replaced-selection.html [ Failure ]
-crbug.com/591099 fast/xsl/xslt-extra-content-at-end.xml [ Failure ]
 crbug.com/591099 fonts/monospace.html [ Failure ]
 crbug.com/591099 fonts/sans-serif.html [ Failure ]
 crbug.com/591099 fonts/serif.html [ Failure ]
@@ -2084,7 +1693,7 @@
 crbug.com/591099 fullscreen/full-screen-element-stack.html [ Crash ]
 crbug.com/591099 fullscreen/full-screen-iframe-not-allowed.html [ Failure ]
 crbug.com/591099 fullscreen/full-screen-remove-ancestor-after.html [ Crash Pass ]
-crbug.com/591099 fullscreen/full-screen-ruleset-crash.html [ Crash ]
+crbug.com/591099 fullscreen/full-screen-ruleset-crash.html [ Crash Pass ]
 crbug.com/591099 fullscreen/full-screen-twice-newapi.html [ Crash ]
 crbug.com/591099 fullscreen/full-screen-with-css-reference-filter.html [ Crash ]
 crbug.com/591099 fullscreen/full-screen-with-flex-item.html [ Crash ]
@@ -2120,7 +1729,7 @@
 crbug.com/591099 http/tests/devtools/editor/text-editor-ctrl-d-1.js [ Timeout ]
 crbug.com/591099 http/tests/devtools/editor/text-editor-ctrl-d-2.js [ Timeout ]
 crbug.com/591099 http/tests/devtools/editor/text-editor-enter-behaviour.js [ Pass Timeout ]
-crbug.com/714962 http/tests/devtools/editor/text-editor-formatter.js [ Pass Timeout ]
+crbug.com/714962 http/tests/devtools/editor/text-editor-formatter.js [ Timeout ]
 crbug.com/591099 http/tests/devtools/editor/text-editor-indent-autodetection.js [ Pass Timeout ]
 crbug.com/591099 http/tests/devtools/editor/text-editor-reveal-line.js [ Pass Timeout ]
 crbug.com/591099 http/tests/devtools/editor/text-editor-word-jumps.js [ Pass ]
@@ -2159,7 +1768,7 @@
 crbug.com/591099 http/tests/security/contentSecurityPolicy/source-list-parsing-04.html [ Failure ]
 crbug.com/591099 http/tests/security/cors-rfc1918/addressspace-document-appcache.https.html [ Crash Failure ]
 crbug.com/591099 http/tests/security/cors-rfc1918/addressspace-document-csp-appcache.https.html [ Crash Failure Pass ]
-crbug.com/591099 http/tests/security/setDomainRelaxationForbiddenForURLScheme.html [ Crash ]
+crbug.com/591099 http/tests/security/setDomainRelaxationForbiddenForURLScheme.html [ Crash Pass ]
 crbug.com/591099 http/tests/security/shape-image-cors-allow-origin.html [ Failure ]
 crbug.com/591099 http/tests/security/shape-image-cors-data-url.html [ Failure ]
 crbug.com/591099 http/tests/security/shape-image-cors-same-origin.html [ Failure ]
@@ -2182,9 +1791,9 @@
 crbug.com/591099 images/exif-orientation-image-document.html [ Failure ]
 crbug.com/591099 images/exif-orientation.html [ Failure ]
 crbug.com/591099 images/percent-height-image.html [ Failure ]
-crbug.com/591099 inspector-protocol/accessibility/accessibility-ignoredNodes.js [ Crash Timeout ]
+crbug.com/591099 inspector-protocol/accessibility/accessibility-ignoredNodes.js [ Crash ]
 crbug.com/714962 inspector-protocol/accessibility/accessibility-ignoredNodesModal.js [ Failure ]
-crbug.com/591099 inspector-protocol/accessibility/accessibility-nameSources-img-figure.js [ Timeout ]
+crbug.com/591099 inspector-protocol/accessibility/accessibility-nameSources-img-figure.js [ Pass Timeout ]
 crbug.com/591099 inspector-protocol/accessibility/accessibility-nameSources-input-buttons.js [ Timeout ]
 crbug.com/591099 inspector-protocol/accessibility/accessibility-nameSources-input.js [ Timeout ]
 crbug.com/591099 inspector-protocol/accessibility/accessibility-nameSources-labelledby.js [ Timeout ]
@@ -2770,7 +2379,6 @@
 crbug.com/591099 virtual/gpu-rasterization/images/color-profile-image-shape.html [ Failure ]
 crbug.com/591099 virtual/gpu-rasterization/images/color-profile-layer-filter.html [ Timeout ]
 crbug.com/591099 virtual/gpu-rasterization/images/color-profile-layer.html [ Failure ]
-crbug.com/591099 virtual/gpu-rasterization/images/color-profile-mask-image-svg.html [ Pass Timeout ]
 crbug.com/591099 virtual/gpu-rasterization/images/color-profile-reflection.html [ Failure ]
 crbug.com/591099 virtual/gpu-rasterization/images/cross-fade-overflow-position.html [ Pass Timeout ]
 crbug.com/591099 virtual/gpu-rasterization/images/exif-orientation-image-document.html [ Failure ]
@@ -2793,9 +2401,10 @@
 crbug.com/714962 virtual/incremental-shadow-dom/shadow-dom/focus-navigation-with-delegatesFocus.html [ Timeout ]
 crbug.com/591099 virtual/layout_ng/ [ Skip ]
 crbug.com/824918 virtual/layout_ng_experimental/ [ Skip ]
-crbug.com/591099 virtual/modern-media-controls/media/controls/modern/doubletap-to-jump-forwards-too-short.html [ Failure ]
+crbug.com/591099 virtual/modern-media-controls/media/controls/modern/doubletap-to-jump-forwards-too-short.html [ Failure Pass ]
 crbug.com/714962 virtual/mouseevent_fractional/fast/events/drag-in-frames.html [ Failure ]
 crbug.com/714962 virtual/mouseevent_fractional/fast/events/event-on-culled_inline.html [ Failure ]
+crbug.com/591099 virtual/mouseevent_fractional/fast/events/hr-timestamp/input-events.html [ Failure ]
 crbug.com/591099 virtual/mouseevent_fractional/fast/events/keyboardevent-getModifierState.html [ Timeout ]
 crbug.com/714962 virtual/mouseevent_fractional/fast/events/middleClickAutoscroll-latching.html [ Pass Timeout ]
 crbug.com/714962 virtual/mouseevent_fractional/fast/events/mouse-down-on-pseudo-element-remove-crash.html [ Failure ]
@@ -2803,6 +2412,7 @@
 crbug.com/591099 virtual/mouseevent_fractional/fast/events/mouse-relative-position.html [ Failure ]
 crbug.com/591099 virtual/mouseevent_fractional/fast/events/mouseevent-getModifierState.html [ Timeout ]
 crbug.com/591099 virtual/mouseevent_fractional/fast/events/onclick-list-marker.html [ Failure ]
+crbug.com/591099 virtual/mouseevent_fractional/fast/events/overflow-scroll-fake-mouse-move.html [ Timeout ]
 crbug.com/591099 virtual/mouseevent_fractional/fast/events/pointer-events-2.html [ Failure ]
 crbug.com/591099 virtual/mouseevent_fractional/fast/events/pointerevents/mouse-pointer-capture-transition-events.html [ Timeout ]
 crbug.com/591099 virtual/mouseevent_fractional/fast/events/pointerevents/mouse-pointer-capture.html [ Timeout ]
@@ -2842,4 +2452,3 @@
 crbug.com/591099 webexposed/global-interface-listing-dedicated-worker.html [ Timeout ]
 crbug.com/591099 webexposed/global-interface-listing-shared-worker.html [ Timeout ]
 crbug.com/591099 webexposed/global-interface-listing.html [ Timeout ]
-crbug.com/591099 xr/webGLCanvasContext_set_device_lost_context.html [ Crash Pass ]
diff --git a/third_party/WebKit/LayoutTests/FlagExpectations/enable-features=NetworkService b/third_party/WebKit/LayoutTests/FlagExpectations/enable-features=NetworkService
index 0c8d28d..4eb70d1 100644
--- a/third_party/WebKit/LayoutTests/FlagExpectations/enable-features=NetworkService
+++ b/third_party/WebKit/LayoutTests/FlagExpectations/enable-features=NetworkService
@@ -11,15 +11,12 @@
 Bug(none) external/wpt/css/css-fonts/font-display/font-display.html [ Failure Timeout ]
 Bug(none) external/wpt/html/browsers/offline/appcache/workers/appcache-worker.html [ Timeout ]
 crbug.com/829417 external/wpt/html/browsers/offline/appcache/workers/appcache-worker.https.html [ Timeout ]
-Bug(none) external/wpt/service-workers/service-worker/claim-shared-worker-fetch.https.html [ Failure ]
 Bug(none) external/wpt/service-workers/service-worker/clients-get-client-types.https.html [ Failure ]
 crbug.com/807271 external/wpt/service-workers/service-worker/fetch-canvas-tainting-video-cache.https.html [ Failure ]
 Bug(none) external/wpt/service-workers/service-worker/fetch-header-visibility.https.html [ Pass Failure Crash ]
 Bug(none) external/wpt/service-workers/service-worker/fetch-request-xhr-sync-on-worker.https.html [ Timeout ]
 crbug.com/771118 external/wpt/service-workers/service-worker/mime-sniffing.https.html [ Failure ]
 Bug(none) external/wpt/service-workers/service-worker/registration-updateviacache.https.html [ Failure Timeout ]
-Bug(none) external/wpt/service-workers/service-worker/shared-worker-controlled.https.html [ Timeout ]
-Bug(none) external/wpt/service-workers/service-worker/worker-interception.https.html [ Pass Crash Failure ]
 Bug(none) external/wpt/service-workers/service-worker/navigation-preload/broken-chunked-encoding.https.html [ Failure ]
 Bug(none) external/wpt/service-workers/service-worker/ready.https.html [ Pass Crash Failure ]
 Bug(none) http/tests/appcache/top-frame-3.html [ Pass Timeout ]
diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index 4b46ed0..c7c1a81 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations
@@ -88,6 +88,8 @@
 
 crbug.com/784956 fast/history/frameset-repeated-name.html [ Pass Failure ]
 
+crbug.com/829740 [ Win7 Debug ] fast/history/history-back-twice-with-subframes-assert.html [ Pass Timeout ]
+
 ########## Genuinely flaky ##########
 crbug.com/624233 virtual/gpu-rasterization/images/color-profile-background-clip-text.html [ Pass Failure ]
 
@@ -1165,6 +1167,8 @@
 crbug.com/591099 virtual/layout_ng_experimental/printing/thead-under-multicol.html [ Failure ]
 crbug.com/824918 virtual/layout_ng_experimental/printing/width-overflow.html [ Failure ]
 
+crbug.com/829804 [ Mac ] virtual/layout_ng_experimental/printing/webgl-oversized-printing.html [ Pass Timeout ]
+
 # ====== LayoutNG-only failures until here ======
 
 # ====== IncrementalShadowDOM-only failures from here ======
@@ -2916,7 +2920,6 @@
 
 # Crashes with DCHECK enabled, but not on normal Release builds.
 crbug.com/809935 external/wpt/css/css-fonts/variations/font-style-interpolation.html [ Timeout ]
-crbug.com/809956 external/wpt/css/css-fonts/variations/font-weight-lighter-bolder.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-ui/text-overflow-011.html [ Failure Crash Pass ]
 crbug.com/626703 external/wpt/workers/opaque-origin.html [ Failure Crash Timeout ]
 crbug.com/626703 external/wpt/html/rendering/non-replaced-elements/margin-collapsing-quirks/multicol-quirks-mode.html [ Pass Crash ]
@@ -4034,3 +4037,6 @@
 crbug.com/826936 external/wpt/webauthn/getcredential-extensions.https.html [ Pass Timeout ]
 crbug.com/826936 external/wpt/webauthn/getcredential-passing.https.html [ Pass Timeout ]
 crbug.com/826936 external/wpt/webauthn/getcredential-timeout.https.html [ Pass Timeout ]
+
+# Flaky on all platforms
+crbug.com/829761 external/wpt/cookie-store/cookieStore_special_names.tentative.https.html [ Pass Failure ]
diff --git a/third_party/WebKit/LayoutTests/editing/inserting/5418891.html b/third_party/WebKit/LayoutTests/editing/inserting/5418891.html
index 008af89..9c084db 100644
--- a/third_party/WebKit/LayoutTests/editing/inserting/5418891.html
+++ b/third_party/WebKit/LayoutTests/editing/inserting/5418891.html
@@ -1,22 +1,24 @@
-<style>
-blockquote {
-    color: blue;
-    border-left: 2px solid blue;
-    padding-left: 5px;
-    margin: 0px;
-}
-</style>
-<p>This tests for a crash when attempting to break a blockquote at the end of its content.  The caret should be in the first of two empty paragraphs between two pieces of quoted content.</p>
-<div contenteditable="true">
-<blockquote type="cite"><div id="dv">foo</div></blockquote>
-<br>
-<blockquote type="cite"><div>bar</div></blockquote>
-</div>
-
+<!doctype HTML>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script src="../assert_selection.js"></script>
 <script>
-dv = document.getElementById("dv");
-text = dv.firstChild;
-s = window.getSelection();
-s.collapse(text, 3);
-document.execCommand("InsertNewlineInQuotedContent");
+// This tests for a crash when attempting to break a blockquote at the end of
+// its content.
+selection_test(
+  [
+    '<div contenteditable>',
+      '<blockquote type="cite"><div>foo|</div></blockquote><br>',
+      '<blockquote type="cite"><div>bar</div></blockquote>',
+    '</div>',
+  ],
+  'InsertNewlineInQuotedContent',
+  [
+    '<div contenteditable>',
+      '<blockquote type="cite"><div>foo</div></blockquote>|<br>',
+      '<br>',
+      '<blockquote type="cite"><div>bar</div></blockquote>',
+    '</div>',
+  ],
+  'Break BLOCKQUOTE at the end of its content');
 </script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-attachment.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-attachment.html
new file mode 100644
index 0000000..77adf0df
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-attachment.html
@@ -0,0 +1,22 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>'background-attachment' property</title>
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#dom-stylepropertymap-get">
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#dom-stylepropertymap-set">
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#property-stle-value-normalization">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../../resources/testhelper.js"></script>
+<script src="resources/testsuite.js"></script>
+<body>
+<div id="log"></div>
+<script>
+'use strict';
+
+runListValuedPropertyTests('background-attachment', [
+  { syntax: 'scroll' },
+  { syntax: 'fixed' },
+  { syntax: 'local' },
+]);
+
+</script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-blend-mode.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-blend-mode.html
new file mode 100644
index 0000000..92082e2f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-blend-mode.html
@@ -0,0 +1,35 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>'background-blend-mode' property</title>
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#dom-stylepropertymap-get">
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#dom-stylepropertymap-set">
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#property-stle-value-normalization">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../../resources/testhelper.js"></script>
+<script src="resources/testsuite.js"></script>
+<body>
+<div id="log"></div>
+<script>
+'use strict';
+
+runListValuedPropertyTests('background-blend-mode', [
+  { syntax: 'normal' },
+  { syntax: 'multiply' },
+  { syntax: 'screen' },
+  { syntax: 'overlay' },
+  { syntax: 'darken' },
+  { syntax: 'lighten' },
+  { syntax: 'color-dodge' },
+  { syntax: 'color-burn' },
+  { syntax: 'hard-light' },
+  { syntax: 'soft-light' },
+  { syntax: 'difference' },
+  { syntax: 'exclusion' },
+  { syntax: 'hue' },
+  { syntax: 'saturation' },
+  { syntax: 'color' },
+  { syntax: 'luminosity' },
+]);
+
+</script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-clip.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-clip.html
new file mode 100644
index 0000000..46d16a6
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-clip.html
@@ -0,0 +1,22 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>'background-clip' property</title>
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#dom-stylepropertymap-get">
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#dom-stylepropertymap-set">
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#property-stle-value-normalization">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../../resources/testhelper.js"></script>
+<script src="resources/testsuite.js"></script>
+<body>
+<div id="log"></div>
+<script>
+'use strict';
+
+runListValuedPropertyTests('background-clip', [
+  { syntax: 'border-box' },
+  { syntax: 'padding-box' },
+  { syntax: 'content-box' },
+]);
+
+</script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-origin.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-origin.html
new file mode 100644
index 0000000..511b5dc
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-origin.html
@@ -0,0 +1,22 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>'background-origin' property</title>
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#dom-stylepropertymap-get">
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#dom-stylepropertymap-set">
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#property-stle-value-normalization">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../../resources/testhelper.js"></script>
+<script src="resources/testsuite.js"></script>
+<body>
+<div id="log"></div>
+<script>
+'use strict';
+
+runListValuedPropertyTests('background-origin', [
+  { syntax: 'border-box' },
+  { syntax: 'padding-box' },
+  { syntax: 'content-box' },
+]);
+
+</script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-position-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-position-expected.txt
new file mode 100644
index 0000000..d04a5a6c
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-position-expected.txt
@@ -0,0 +1,13 @@
+This is a testharness.js-based test.
+FAIL Can set 'background-position' to CSS-wide keywords assert_equals: expected "CSSKeywordValue" but got "CSSStyleValue"
+FAIL Can set 'background-position' to var() references assert_equals: expected "CSSUnparsedValue" but got "CSSStyleValue"
+FAIL Can set 'background-position' to a position Failed to execute 'set' on 'StylePropertyMap': Invalid type for property
+PASS Setting 'background-position' to a length throws TypeError
+PASS Setting 'background-position' to a percent throws TypeError
+PASS Setting 'background-position' to a time throws TypeError
+PASS Setting 'background-position' to a flexible length throws TypeError
+PASS Setting 'background-position' to a number throws TypeError
+PASS Setting 'background-position' to a URL throws TypeError
+PASS Setting 'background-position' to a transform throws TypeError
+Harness: the test ran to completion.
+
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-position.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-position.html
new file mode 100644
index 0000000..8e5b09b1
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-position.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>'background-position' property</title>
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#dom-stylepropertymap-get">
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#dom-stylepropertymap-set">
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#property-stle-value-normalization">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../../resources/testhelper.js"></script>
+<script src="resources/testsuite.js"></script>
+<body>
+<div id="log"></div>
+<script>
+'use strict';
+
+runPropertyTests('background-position', [
+  { syntax: '<position>' },
+]);
+
+</script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-repeat-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-repeat-expected.txt
new file mode 100644
index 0000000..4130b70b0
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-repeat-expected.txt
@@ -0,0 +1,20 @@
+This is a testharness.js-based test.
+FAIL Can set 'background-position' to CSS-wide keywords assert_equals: expected "CSSKeywordValue" but got "CSSStyleValue"
+FAIL Can set 'background-position' to var() references assert_equals: expected "CSSUnparsedValue" but got "CSSStyleValue"
+FAIL Can set 'background-position' to the 'repeat-x' keyword Failed to execute 'set' on 'StylePropertyMap': Invalid type for property
+FAIL Can set 'background-position' to the 'repeat-y' keyword Failed to execute 'set' on 'StylePropertyMap': Invalid type for property
+FAIL Can set 'background-position' to the 'repeat' keyword Failed to execute 'set' on 'StylePropertyMap': Invalid type for property
+FAIL Can set 'background-position' to the 'space' keyword Failed to execute 'set' on 'StylePropertyMap': Invalid type for property
+FAIL Can set 'background-position' to the 'round' keyword Failed to execute 'set' on 'StylePropertyMap': Invalid type for property
+FAIL Can set 'background-position' to the 'no-repeat' keyword Failed to execute 'set' on 'StylePropertyMap': Invalid type for property
+PASS Setting 'background-position' to a length throws TypeError
+PASS Setting 'background-position' to a percent throws TypeError
+PASS Setting 'background-position' to a time throws TypeError
+PASS Setting 'background-position' to a flexible length throws TypeError
+PASS Setting 'background-position' to a number throws TypeError
+PASS Setting 'background-position' to a position throws TypeError
+PASS Setting 'background-position' to a URL throws TypeError
+PASS Setting 'background-position' to a transform throws TypeError
+FAIL 'background-position' does not supported 'space repeat' assert_not_equals: Unsupported value must not be null got disallowed value null
+Harness: the test ran to completion.
+
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-repeat.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-repeat.html
new file mode 100644
index 0000000..bc50169
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-repeat.html
@@ -0,0 +1,29 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>'background-repeat' property</title>
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#dom-stylepropertymap-get">
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#dom-stylepropertymap-set">
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#property-stle-value-normalization">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../../resources/testhelper.js"></script>
+<script src="resources/testsuite.js"></script>
+<body>
+<div id="log"></div>
+<script>
+'use strict';
+
+runListValuedPropertyTests('background-position', [
+  { syntax: 'repeat-x' },
+  { syntax: 'repeat-y' },
+  { syntax: 'repeat' },
+  { syntax: 'space' },
+  { syntax: 'round' },
+  { syntax: 'no-repeat' },
+]);
+
+runUnsupportedPropertyTests('background-position', [
+  'space repeat'
+]);
+
+</script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-size.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-size.html
new file mode 100644
index 0000000..7de0c44
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/background-size.html
@@ -0,0 +1,28 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>'background-size' property</title>
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#dom-stylepropertymap-get">
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#dom-stylepropertymap-set">
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#property-stle-value-normalization">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../../resources/testhelper.js"></script>
+<script src="resources/testsuite.js"></script>
+<body>
+<div id="log"></div>
+<script>
+'use strict';
+
+runListValuedPropertyTests('background-size', [
+  { syntax: '<length>' },
+  { syntax: '<percentage>' },
+  { syntax: 'auto' },
+  { syntax: 'cover' },
+  { syntax: 'contain' },
+]);
+
+runUnsupportedPropertyTests('background-size', [
+  '200px 100px'
+]);
+
+</script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/border-image-outset.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/border-image-outset.html
new file mode 100644
index 0000000..46da4e3
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/border-image-outset.html
@@ -0,0 +1,33 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>'border-image-outset' property</title>
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#dom-stylepropertymap-get">
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#dom-stylepropertymap-set">
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#property-stle-value-normalization">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../../resources/testhelper.js"></script>
+<script src="resources/testsuite.js"></script>
+<body>
+<div id="log"></div>
+<script>
+'use strict';
+
+runPropertyTests('border-image-outset', [
+  // Computed value is always four values, which are not supported in
+  // Typed OM level 1.
+  {
+    syntax: '<length>',
+    computed: (_, result) => assert_is_unsupported(result)
+  },
+  {
+    syntax: '<number>',
+    computed: (_, result) => assert_is_unsupported(result)
+  },
+]);
+
+runUnsupportedPropertyTests('border-image-outset', [
+  '1 1.2', '30px 2 45px', '7px 12px 14px 5px'
+]);
+
+</script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/border-image-repeat.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/border-image-repeat.html
new file mode 100644
index 0000000..885a9479
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/border-image-repeat.html
@@ -0,0 +1,41 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>'border-image-repeat' property</title>
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#dom-stylepropertymap-get">
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#dom-stylepropertymap-set">
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#property-stle-value-normalization">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../../resources/testhelper.js"></script>
+<script src="resources/testsuite.js"></script>
+<body>
+<div id="log"></div>
+<script>
+'use strict';
+
+runPropertyTests('border-image-repeat', [
+  // Computed value is always a pair of values, which are not supported in
+  // Typed OM level 1.
+  {
+    syntax: 'stretch',
+    computed: (_, result) => assert_is_unsupported(result)
+  },
+  {
+    syntax: 'repeat',
+    computed: (_, result) => assert_is_unsupported(result)
+  },
+  {
+    syntax: 'round',
+    computed: (_, result) => assert_is_unsupported(result)
+  },
+  {
+    syntax: 'space',
+    computed: (_, result) => assert_is_unsupported(result)
+  },
+]);
+
+runUnsupportedPropertyTests('border-image-repeat', [
+  'stretch repeat', 'round space'
+]);
+
+</script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/border-image-slice.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/border-image-slice.html
new file mode 100644
index 0000000..2649446
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/border-image-slice.html
@@ -0,0 +1,33 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>'border-image-slice' property</title>
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#dom-stylepropertymap-get">
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#dom-stylepropertymap-set">
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#property-stle-value-normalization">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../../resources/testhelper.js"></script>
+<script src="resources/testsuite.js"></script>
+<body>
+<div id="log"></div>
+<script>
+'use strict';
+
+runPropertyTests('border-image-slice', [
+  // Computed value is always four values, which are not supported in
+  // Typed OM level 1.
+  {
+    syntax: '<number>',
+    computed: (_, result) => assert_is_unsupported(result)
+  },
+  {
+    syntax: '<percentage>',
+    computed: (_, result) => assert_is_unsupported(result)
+  },
+]);
+
+runUnsupportedPropertyTests('border-image-slice', [
+  '30 fill', '30 40 50', '30 40 50 60 fill'
+]);
+
+</script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/border-image-width.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/border-image-width.html
new file mode 100644
index 0000000..7520a98
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/border-image-width.html
@@ -0,0 +1,41 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>'border-image-width' property</title>
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#dom-stylepropertymap-get">
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#dom-stylepropertymap-set">
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#property-stle-value-normalization">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../../resources/testhelper.js"></script>
+<script src="resources/testsuite.js"></script>
+<body>
+<div id="log"></div>
+<script>
+'use strict';
+
+runPropertyTests('border-image-width', [
+  // Computed value is always four values, which are not supported in
+  // Typed OM level 1.
+  {
+    syntax: '<length>',
+    computed: (_, result) => assert_is_unsupported(result)
+  },
+  {
+    syntax: '<percentage>',
+    computed: (_, result) => assert_is_unsupported(result)
+  },
+  {
+    syntax: '<number>',
+    computed: (_, result) => assert_is_unsupported(result)
+  },
+  {
+    syntax: 'auto',
+    computed: (_, result) => assert_is_unsupported(result)
+  },
+]);
+
+runUnsupportedPropertyTests('border-image-width', [
+  '2em 3em', '5% 15% 10%', '5% 2em 10% auto'
+]);
+
+</script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/border-radius-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/border-radius-expected.txt
new file mode 100644
index 0000000..8192f88
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/border-radius-expected.txt
@@ -0,0 +1,47 @@
+This is a testharness.js-based test.
+PASS Can set 'border-top-left-radius' to CSS-wide keywords
+PASS Can set 'border-top-left-radius' to var() references
+FAIL Can set 'border-top-left-radius' to a length assert_equals: expected "[object CSSStyleValue]" but got "[object CSSUnitValue]"
+FAIL Can set 'border-top-left-radius' to a percent assert_equals: expected "[object CSSStyleValue]" but got "[object CSSUnitValue]"
+PASS Setting 'border-top-left-radius' to a time throws TypeError
+PASS Setting 'border-top-left-radius' to a flexible length throws TypeError
+PASS Setting 'border-top-left-radius' to a number throws TypeError
+PASS Setting 'border-top-left-radius' to a position throws TypeError
+PASS Setting 'border-top-left-radius' to a URL throws TypeError
+PASS Setting 'border-top-left-radius' to a transform throws TypeError
+PASS Can set 'border-top-right-radius' to CSS-wide keywords
+PASS Can set 'border-top-right-radius' to var() references
+FAIL Can set 'border-top-right-radius' to a length assert_equals: expected "[object CSSStyleValue]" but got "[object CSSUnitValue]"
+FAIL Can set 'border-top-right-radius' to a percent assert_equals: expected "[object CSSStyleValue]" but got "[object CSSUnitValue]"
+PASS Setting 'border-top-right-radius' to a time throws TypeError
+PASS Setting 'border-top-right-radius' to a flexible length throws TypeError
+PASS Setting 'border-top-right-radius' to a number throws TypeError
+PASS Setting 'border-top-right-radius' to a position throws TypeError
+PASS Setting 'border-top-right-radius' to a URL throws TypeError
+PASS Setting 'border-top-right-radius' to a transform throws TypeError
+PASS Can set 'border-bottom-left-radius' to CSS-wide keywords
+PASS Can set 'border-bottom-left-radius' to var() references
+FAIL Can set 'border-bottom-left-radius' to a length assert_equals: expected "[object CSSStyleValue]" but got "[object CSSUnitValue]"
+FAIL Can set 'border-bottom-left-radius' to a percent assert_equals: expected "[object CSSStyleValue]" but got "[object CSSUnitValue]"
+PASS Setting 'border-bottom-left-radius' to a time throws TypeError
+PASS Setting 'border-bottom-left-radius' to a flexible length throws TypeError
+PASS Setting 'border-bottom-left-radius' to a number throws TypeError
+PASS Setting 'border-bottom-left-radius' to a position throws TypeError
+PASS Setting 'border-bottom-left-radius' to a URL throws TypeError
+PASS Setting 'border-bottom-left-radius' to a transform throws TypeError
+PASS Can set 'border-bottom-right-radius' to CSS-wide keywords
+PASS Can set 'border-bottom-right-radius' to var() references
+FAIL Can set 'border-bottom-right-radius' to a length assert_equals: expected "[object CSSStyleValue]" but got "[object CSSUnitValue]"
+FAIL Can set 'border-bottom-right-radius' to a percent assert_equals: expected "[object CSSStyleValue]" but got "[object CSSUnitValue]"
+PASS Setting 'border-bottom-right-radius' to a time throws TypeError
+PASS Setting 'border-bottom-right-radius' to a flexible length throws TypeError
+PASS Setting 'border-bottom-right-radius' to a number throws TypeError
+PASS Setting 'border-bottom-right-radius' to a position throws TypeError
+PASS Setting 'border-bottom-right-radius' to a URL throws TypeError
+PASS Setting 'border-bottom-right-radius' to a transform throws TypeError
+PASS 'border-radius' does not supported '30px'
+PASS 'border-radius' does not supported '25% 10%'
+PASS 'border-radius' does not supported '10% / 50%'
+PASS 'border-radius' does not supported '50% 20% / 10% 40%'
+Harness: the test ran to completion.
+
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/border-radius.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/border-radius.html
new file mode 100644
index 0000000..1d7b359
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/border-radius.html
@@ -0,0 +1,36 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>border radius properties</title>
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#dom-stylepropertymap-get">
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#dom-stylepropertymap-set">
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#property-stle-value-normalization">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../../resources/testhelper.js"></script>
+<script src="resources/testsuite.js"></script>
+<body>
+<div id="log"></div>
+<script>
+'use strict';
+
+for (const suffix of ['top-left', 'top-right', 'bottom-left', 'bottom-right']) {
+  // Computed value is always a pair of values, which are not supported in
+  // Typed OM level 1.
+  runPropertyTests('border-' + suffix + '-radius', [
+    {
+      syntax: '<length>',
+      computed: (_, result) => assert_is_unsupported(result)
+    },
+    {
+      syntax: '<percentage>',
+      computed: (_, result) => assert_is_unsupported(result)
+    },
+  ]);
+}
+
+// shorthand
+runUnsupportedPropertyTests('border-radius', [
+  '30px', '25% 10%', '10% / 50%', '50% 20% / 10% 40%'
+]);
+
+</script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/resources/testsuite.js b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/resources/testsuite.js
index 51ef7c4..68ab45a 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/resources/testsuite.js
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/the-stylepropertymap/properties/resources/testsuite.js
@@ -16,6 +16,10 @@
     assert_style_value_equals(result, input);
 }
 
+function assert_is_unsupported(result) {
+  assert_class_string(result, 'CSSStyleValue');
+}
+
 const gCssWideKeywordsExamples = [
   {
     description: 'initial keyword',
diff --git a/third_party/WebKit/LayoutTests/external/wpt/web-nfc/nfc_insecure_context.html b/third_party/WebKit/LayoutTests/external/wpt/web-nfc/nfc_insecure_context.html
index 9745fc2..e2a92f9 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/web-nfc/nfc_insecure_context.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/web-nfc/nfc_insecure_context.html
@@ -6,34 +6,19 @@
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <script src="resources/nfc_help.js"></script>
-
 <h2>Note</h2>
 <ol>
   <li>
     Run test is an insecure context, e.g. http://example.com/
   </li>
 </ol>
-
-<div id="log"></div>
-
 <script>
 
 "use strict";
 
-promise_test(t => {
-  return promise_rejects(t, 'SecurityError', navigator.nfc.push(test_text_data));
-}, "nfc.push should fail with SecurityError in an insecure context.");
-
-promise_test(t => {
-  return promise_rejects(t, 'SecurityError', navigator.nfc.cancelPush());
-}, "nfc.cancelPush should fail with SecurityError in an insecure context.");
-
-promise_test(t => {
-  return promise_rejects(t, 'SecurityError', navigator.nfc.watch(noop));
-}, "nfc.watch should fail with SecurityError in an insecure context.");
-
-promise_test(t => {
-  return promise_rejects(t, 'SecurityError', navigator.nfc.cancelWatch());
-}, "nfc.cancelWatch should fail with SecurityError in an insecure context.");
+test(t => {
+  assert_false(isSecureContext);
+  assert_false('nfc' in navigator);
+}, 'navigator.nfc requires a secure context');
 
 </script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/webrtc/RTCPeerConnection-track-stats.https.html b/third_party/WebKit/LayoutTests/external/wpt/webrtc/RTCPeerConnection-track-stats.https.html
index d3873b1..2fa8d817 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/webrtc/RTCPeerConnection-track-stats.https.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/webrtc/RTCPeerConnection-track-stats.https.html
@@ -483,13 +483,14 @@
     let senderReport = await sender.getStats();
     let trackReport = await caller.getStats(sender.track);
 
+    // Verify the same stats objects are returned but don't compare each
+    // individual metric because timestamps and counters could have gone up
+    // between the two getStats() calls.
     senderReport.forEach(senderReportStat => {
-      let trackReportStat = trackReport.get(senderReportStat.id);
-      assert_object_equals(trackReportStat, senderReportStat);
+      assert_true(trackReport.has(senderReportStat.id));
     });
     trackReport.forEach(trackReportStat => {
-      let senderReportStat = senderReport.get(trackReportStat.id);
-      assert_object_equals(senderReportStat, trackReportStat);
+      assert_true(senderReport.has(trackReportStat.id));
     });
   }, 'RTCPeerConnection.getStats(sendingTrack) is the same as ' +
      'RTCRtpSender.getStats()');
@@ -508,13 +509,14 @@
     let receiverReport = await receiver.getStats();
     let trackReport = await caller.getStats(receiver.track);
 
+    // Verify the same stats objects are returned but don't compare each
+    // individual metric because timestamps and counters could have gone up
+    // between the two getStats() calls.
     receiverReport.forEach(receiverReportStat => {
-      let trackReportStat = trackReport.get(receiverReportStat.id);
-      assert_object_equals(trackReportStat, receiverReportStat);
+      assert_true(trackReport.has(receiverReportStat.id));
     });
     trackReport.forEach(trackReportStat => {
-      let receiverReportStat = receiverReport.get(trackReportStat.id);
-      assert_object_equals(receiverReportStat, trackReportStat);
+      assert_true(receiverReport.has(trackReportStat.id));
     });
   }, 'RTCPeerConnection.getStats(receivingTrack) is the same as ' +
      'RTCRtpReceiver.getStats()');
diff --git a/third_party/WebKit/LayoutTests/fast/dom/Window/property-access-on-cached-window-after-frame-navigated-expected.txt b/third_party/WebKit/LayoutTests/fast/dom/Window/property-access-on-cached-window-after-frame-navigated-expected.txt
index fa4600c..36691d6 100644
--- a/third_party/WebKit/LayoutTests/fast/dom/Window/property-access-on-cached-window-after-frame-navigated-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/dom/Window/property-access-on-cached-window-after-frame-navigated-expected.txt
@@ -100,6 +100,7 @@
 PASS oldChildWindow.onended is newChildWindow.onended
 PASS oldChildWindow.onerror is newChildWindow.onerror
 PASS oldChildWindow.onfocus is newChildWindow.onfocus
+PASS oldChildWindow.onformdata is newChildWindow.onformdata
 PASS oldChildWindow.onfreeze is newChildWindow.onfreeze
 PASS oldChildWindow.ongotpointercapture is newChildWindow.ongotpointercapture
 PASS oldChildWindow.onhashchange is newChildWindow.onhashchange
diff --git a/third_party/WebKit/LayoutTests/fast/dom/Window/property-access-on-cached-window-after-frame-removed-and-gced-expected.txt b/third_party/WebKit/LayoutTests/fast/dom/Window/property-access-on-cached-window-after-frame-removed-and-gced-expected.txt
index 83142da..014a2518 100644
--- a/third_party/WebKit/LayoutTests/fast/dom/Window/property-access-on-cached-window-after-frame-removed-and-gced-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/dom/Window/property-access-on-cached-window-after-frame-removed-and-gced-expected.txt
@@ -68,6 +68,7 @@
 PASS childWindow.onended is null
 PASS childWindow.onerror is null
 PASS childWindow.onfocus is null
+PASS childWindow.onformdata is null
 PASS childWindow.onfreeze is null
 PASS childWindow.ongotpointercapture is null
 PASS childWindow.onhashchange is null
diff --git a/third_party/WebKit/LayoutTests/fast/dom/Window/property-access-on-cached-window-after-frame-removed-expected.txt b/third_party/WebKit/LayoutTests/fast/dom/Window/property-access-on-cached-window-after-frame-removed-expected.txt
index 516952e..4d4a025 100644
--- a/third_party/WebKit/LayoutTests/fast/dom/Window/property-access-on-cached-window-after-frame-removed-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/dom/Window/property-access-on-cached-window-after-frame-removed-expected.txt
@@ -68,6 +68,7 @@
 PASS childWindow.onended is null
 PASS childWindow.onerror is null
 PASS childWindow.onfocus is null
+PASS childWindow.onformdata is null
 PASS childWindow.onfreeze is null
 PASS childWindow.ongotpointercapture is null
 PASS childWindow.onhashchange is null
diff --git a/third_party/WebKit/LayoutTests/fast/forms/formdata-event/formdata-event.html b/third_party/WebKit/LayoutTests/fast/forms/formdata-event/formdata-event.html
new file mode 100644
index 0000000..b3cc90e7
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/forms/formdata-event/formdata-event.html
@@ -0,0 +1,138 @@
+<!DOCTYPE html>
+<body>
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+<div id="container"></div>
+<iframe name="t"></iframe>
+<script>
+let container = document.querySelector('#container');
+
+function populateForm(opt_contentHtml) {
+  if (!opt_contentHtml)
+    opt_contentHtml = '';
+  container.innerHTML = `<form action="about:blank" target="t">${opt_contentHtml}</form>`;
+  return container.firstChild;
+}
+
+test(() => {
+  let didCallHandler = false;
+  let form = populateForm('<input type=submit>');
+  form.addEventListener('formdata', (e) => {
+    didCallHandler = true;
+  });
+  document.querySelector('input[type=submit]').click();
+  assert_true(didCallHandler);
+}, 'Register a "formdata" event handler via addEventListener().');
+
+test(() => {
+  let didCallHandler = false;
+  let form = populateForm();
+  form.onformdata = (e) => {
+    didCallHandler = true;
+  };
+  form.submit();
+  assert_true(didCallHandler);
+}, 'Register a "formdata" event handler via onformdata IDL attribute.');
+
+let didCallAttributeHandler = false;
+test(() => {
+  let form = populateForm();
+  form.setAttribute('onformdata', 'didCallAttributeHandler = true;');
+  new FormData(form);
+  assert_true(didCallAttributeHandler);
+}, 'Register a "formdata" event handler via onformdata content attribute.');
+
+test(() => {
+  let didCallHandler = false;
+  let wasCancelable = true;
+  let form = populateForm();
+  document.addEventListener('formdata', (e) => {
+    didCallHandler = true;
+    wasCancelable = e.cancelable;
+  });
+  new FormData(form);
+  assert_true(didCallHandler);
+  assert_false(wasCancelable);
+}, '"formdata" event bubbles, and is not cancelable.');
+
+test(() => {
+  let didCallHandler = false;
+  let form = populateForm();
+  container.innerHTML = '<div></div>';
+  let orphanRoot = container.firstChild;
+  orphanRoot.appendChild(form);
+  orphanRoot.remove();
+  orphanRoot.addEventListener('formdata', (e) => {
+    didCallHandler = true;
+  });
+  new FormData(form);
+  assert_true(didCallHandler);
+}, '"formdata" event bubbles in an orphan tree.');
+
+test(() => {
+  let wasFormDataEmpty1 = false;
+  let wasFormDataEmpty2 = true;
+  let form = populateForm('<input name=n1 value=v1>');
+  form.addEventListener('formdata', (e) => {
+    wasFormDataEmpty1 = e.formData.entries().next().done;
+    e.formData.append('h1', 'vh1');
+    e.formData.append('h2', 'vh2');
+  });
+  form.addEventListener('formdata', (e) => {
+    if (e.formData.get('h1') == 'vh1' && e.formData.get('h2') == 'vh2')
+      wasFormDataEmpty2 = false;
+  });
+  form.submit();
+  assert_true(wasFormDataEmpty1);
+  assert_false(wasFormDataEmpty2);
+}, '"formData" IDL attribute should be empty in the first event handler, ' +
+       'and the second handler can read entries set by the first handler.');
+
+test(() => {
+  let form = populateForm('<input name=n1 value=v1>');
+  form.addEventListener('formdata', (e) => {
+    e.formData.append('h1', 'vh1');
+  });
+  let formData = new FormData(form);
+  assert_equals(formData.get('h1'), 'vh1');
+  assert_equals(formData.get('n1'), 'v1');
+}, 'Newly created FormData contains entries added to "formData" IDL attribute of FormDataEvent.');
+
+let t1 = async_test('Entries added to "formData" IDL attribute should be submitted.');
+t1.step(() => {
+  let form = populateForm('<input name=n1 value=v1>');
+  form.addEventListener('formdata', (e) => {
+    e.formData.append('h1', 'vh1');
+  });
+  let iframe = document.querySelector('iframe');
+  iframe.onload = t1.step_func_done(() => {
+    assert_true(iframe.contentWindow.location.search.indexOf('h1=vh1&n1=v1') != -1);
+  });
+  container.firstChild.submit();
+});
+
+let t2 = async_test('Form submission is aborted if "formData" event handler disconnects the form.');
+t2.step(() => {
+  let form = document.createElement('form');
+  document.body.appendChild(form);
+  form.action = 'about:blank';
+  form.target = 'iframe2';
+  form.onformdata = (e) => { e.target.remove(); };
+  form.innerHTML = '<input name=n1 value=v1>';
+  let iframe = document.createElement('iframe');
+  iframe.setAttribute('name', 'iframe2');
+  let wasLoaded = false;
+  document.body.appendChild(iframe);
+  // Request to load "about:blank", and immediately submit the form to
+  // the same frame. If the form submission is aborted, the first request
+  // will be completed.
+  iframe.onload = t2.step_func_done(() => {
+    wasLoaded = true;
+    assert_true(iframe.contentWindow.location.search.indexOf('n1=v1') == -1);
+  });
+  iframe.src = 'about:blank';
+  assert_false(wasLoaded, 'Make sure the first loading is ongoing.');
+  form.submit();
+});
+</script>
+</body>
diff --git a/third_party/WebKit/LayoutTests/fast/mediastream/MediaStreamTrack-clone.html b/third_party/WebKit/LayoutTests/fast/mediastream/MediaStreamTrack-clone.html
index 373f0fd..e4c0b54b 100644
--- a/third_party/WebKit/LayoutTests/fast/mediastream/MediaStreamTrack-clone.html
+++ b/third_party/WebKit/LayoutTests/fast/mediastream/MediaStreamTrack-clone.html
@@ -32,6 +32,18 @@
                     "Tracks enabled status should not be linked.");
 }, "Clones of disabled MediaStreamTracks are still disabled.");
 
+test(t => {
+  track = createTrack();
+  assert_equals(track.readyState, "live");
+  cloned_track1 = track.clone();
+  assert_equals(cloned_track1.readyState, "live");
+  track.stop();
+  assert_equals(track.readyState, "ended");
+  cloned_track2 = track.clone();
+  assert_equals(cloned_track2.readyState, "ended");
+  assert_equals(cloned_track1.readyState, "live");
+}, "Cloned MediaStreamTracks have same states");
+
 promise_test(function() {
   return navigator.mediaDevices.getUserMedia({audio: { echoCancellation: true }})
     .then(function(s) {
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/geometry/root-layer-update-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/geometry/root-layer-update-expected.png
new file mode 100644
index 0000000..88e94de
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/geometry/root-layer-update-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/geometry/transfrom-origin-on-zero-size-layer-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/geometry/transfrom-origin-on-zero-size-layer-expected.png
new file mode 100644
index 0000000..5056bc9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/geometry/transfrom-origin-on-zero-size-layer-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/geometry/transfrom-origin-on-zero-size-layer-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/geometry/transfrom-origin-on-zero-size-layer-expected.txt
new file mode 100644
index 0000000..56dd5b0
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/geometry/transfrom-origin-on-zero-size-layer-expected.txt
@@ -0,0 +1,19 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x600
+    LayoutNGBlockFlow {BODY} at (0,0) size 800x584
+      LayoutNGBlockFlow {P} at (0,0) size 800x20
+        LayoutText {#text} at (0,0) size 31x19
+          text run at (0,0) width 31: "Bug "
+        LayoutInline {A} at (0,0) size 40x19 [color=#0000EE]
+          LayoutText {#text} at (31,0) size 40x19
+            text run at (31,0) width 40: "29495"
+        LayoutText {#text} at (71,0) size 323x19
+          text run at (71,0) width 323: ". You should see one green box below, with no red."
+layer at (10,60) size 50x50
+  LayoutNGBlockFlow (positioned) {DIV} at (10,60) size 50x50 [bgcolor=#FF0000]
+layer at (10,10) size 0x0
+  LayoutNGBlockFlow (positioned) {DIV} at (10,10) size 0x0
+layer at (10,10) size 100x100
+  LayoutNGBlockFlow (positioned) {DIV} at (0,0) size 100x100 [bgcolor=#008000]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/compositing-change-inside-reflection-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/compositing-change-inside-reflection-expected.png
new file mode 100644
index 0000000..368357d8
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/compositing-change-inside-reflection-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/compositing-change-inside-reflection-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/compositing-change-inside-reflection-expected.txt
new file mode 100644
index 0000000..ce0b8c20
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/compositing-change-inside-reflection-expected.txt
@@ -0,0 +1,16 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x52
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x52
+    LayoutNGBlockFlow {BODY} at (8,16) size 784x20
+      LayoutNGBlockFlow {P} at (0,0) size 784x20
+        LayoutText {#text} at (0,0) size 569x19
+          text run at (0,0) width 569: "Test dynamically created compositing layer inside reflection. You should see no red below."
+layer at (8,52) size 784x0
+  LayoutNGBlockFlow (relative positioned) {DIV} at (0,36) size 784x0
+layer at (19,183) size 100x100
+  LayoutNGBlockFlow (positioned) {DIV} at (11,131) size 100x100 [bgcolor=#FF0000]
+layer at (8,52) size 120x120
+  LayoutNGBlockFlow (positioned) {DIV} at (0,0) size 120x120 [border: (1px solid #000000)]
+layer at (19,63) size 100x100
+  LayoutNGBlockFlow {DIV} at (11,11) size 100x100 [bgcolor=#008000]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/reflection-positioning-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/reflection-positioning-expected.png
new file mode 100644
index 0000000..68240366
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/reflection-positioning-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/reflection-positioning-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/reflection-positioning-expected.txt
index 78d0842..71c7bee2 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/reflection-positioning-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/reflection-positioning-expected.txt
@@ -4,8 +4,8 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x52
     LayoutNGBlockFlow {BODY} at (8,16) size 784x20
       LayoutNGBlockFlow {P} at (0,0) size 784x20
-        LayoutText {#text} at (0,0) size 503x19
-          text run at (0,0) width 503: "Position of reflected layer should update correctly. You should see no red below."
+        LayoutText {#text} at (0,0) size 504x19
+          text run at (0,0) width 504: "Position of reflected layer should update correctly. You should see no red below."
 layer at (20,50) size 150x120
   LayoutNGBlockFlow (positioned) {DIV} at (20,50) size 150x120
 layer at (46,185) size 100x100
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/reflection-positioning2-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/reflection-positioning2-expected.png
new file mode 100644
index 0000000..5776b528
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/reflection-positioning2-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/reflection-positioning2-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/reflection-positioning2-expected.txt
index ff6f45d..3f29f7b 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/reflection-positioning2-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/reflection-positioning2-expected.txt
@@ -4,8 +4,8 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x52
     LayoutNGBlockFlow {BODY} at (8,16) size 784x20
       LayoutNGBlockFlow {P} at (0,0) size 784x20
-        LayoutText {#text} at (0,0) size 503x19
-          text run at (0,0) width 503: "Position of reflected layer should update correctly. You should see no red below."
+        LayoutText {#text} at (0,0) size 504x19
+          text run at (0,0) width 504: "Position of reflected layer should update correctly. You should see no red below."
 layer at (50,50) size 150x120
   LayoutNGBlockFlow (positioned) {DIV} at (50,50) size 150x120
 layer at (76,185) size 100x100
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/transform-inside-reflection-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/transform-inside-reflection-expected.png
new file mode 100644
index 0000000..047acb0
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/transform-inside-reflection-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/transform-inside-reflection-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/transform-inside-reflection-expected.txt
new file mode 100644
index 0000000..1070393
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/compositing/reflections/transform-inside-reflection-expected.txt
@@ -0,0 +1,15 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x328
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x328
+    LayoutNGBlockFlow {BODY} at (8,16) size 784x292
+      LayoutNGBlockFlow {P} at (0,0) size 784x40
+        LayoutText {#text} at (0,0) size 781x39
+          text run at (0,0) width 781: "Transform inside nested reflections should be applied correctly. You should see four rotated green boxes, as mirror images of"
+          text run at (0,20) width 68: "each other."
+layer at (28,76) size 122x232
+  LayoutNGBlockFlow {DIV} at (20,60) size 122x232 [border: (1px solid #000000)]
+layer at (39,87) size 102x102
+  LayoutNGBlockFlow {DIV} at (11,11) size 102x102 [border: (1px solid #000000)]
+layer at (50,98) size 80x80
+  LayoutNGBlockFlow {DIV} at (11,11) size 80x80 [bgcolor=#008000]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/basic/containment-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/basic/containment-expected.png
index a4f9f275..d714d9e 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/basic/containment-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/basic/containment-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/basic/containment-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/basic/containment-expected.txt
index 81719cc..e67579cb 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/basic/containment-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/basic/containment-expected.txt
@@ -126,9 +126,9 @@
         LayoutTableSection {TBODY} at (1,1) size 767x412
           LayoutTableRow {TR} at (0,0) size 767x28
             LayoutNGTableCell {TD} at (0,0) size 767x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutInline {STRONG} at (0,0) size 159x19
-                LayoutText {#text} at (4,4) size 159x19
-                  text run at (4,4) width 159: "TABLE Testing Section"
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,4) size 161x19
+                  text run at (4,4) width 161: "TABLE Testing Section"
           LayoutTableRow {TR} at (0,28) size 767x384
             LayoutNGTableCell {TD} at (0,206) size 12x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (4,182) size 4x19
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/basic/contextual_selectors-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/basic/contextual_selectors-expected.png
index a9bcb54..0c39691 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/basic/contextual_selectors-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/basic/contextual_selectors-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/basic/contextual_selectors-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/basic/contextual_selectors-expected.txt
index ed82803..db64808 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/basic/contextual_selectors-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/basic/contextual_selectors-expected.txt
@@ -21,11 +21,11 @@
       LayoutNGBlockFlow {P} at (0,167) size 784x20 [color=#000080]
         LayoutText {#text} at (0,0) size 559x19
           text run at (0,0) width 559: "This sentence should be normal for its section, except for the last word, which should be "
-        LayoutInline {EM} at (0,0) size 36x19 [color=#008000]
-          LayoutText {#text} at (559,0) size 36x19
-            text run at (559,0) width 36: "green"
-        LayoutText {#text} at (595,0) size 4x19
-          text run at (595,0) width 4: "."
+        LayoutInline {EM} at (0,0) size 35x19 [color=#008000]
+          LayoutText {#text} at (559,0) size 35x19
+            text run at (559,0) width 35: "green"
+        LayoutText {#text} at (594,0) size 4x19
+          text run at (594,0) width 4: "."
       LayoutNGBlockFlow {UL} at (0,203) size 784x40
         LayoutNGListItem {LI} at (40,0) size 744x40
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
@@ -48,9 +48,9 @@
         LayoutTableSection {TBODY} at (1,1) size 720x163
           LayoutTableRow {TR} at (0,0) size 720x28
             LayoutNGTableCell {TD} at (0,0) size 720x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutInline {STRONG} at (0,0) size 159x19
-                LayoutText {#text} at (4,4) size 159x19
-                  text run at (4,4) width 159: "TABLE Testing Section"
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,4) size 161x19
+                  text run at (4,4) width 161: "TABLE Testing Section"
           LayoutTableRow {TR} at (0,28) size 720x135
             LayoutNGTableCell {TD} at (0,81) size 12x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (4,57) size 4x19
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/basic/id_as_selector-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/basic/id_as_selector-expected.png
index 99c0c22..0fed49d2 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/basic/id_as_selector-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/basic/id_as_selector-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/basic/id_as_selector-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/basic/id_as_selector-expected.txt
index 96c8543..c67e82a 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/basic/id_as_selector-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/basic/id_as_selector-expected.txt
@@ -56,9 +56,9 @@
         LayoutTableSection {TBODY} at (1,1) size 420x241
           LayoutTableRow {TR} at (0,0) size 420x28
             LayoutNGTableCell {TD} at (0,0) size 420x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutInline {STRONG} at (0,0) size 159x19
-                LayoutText {#text} at (4,4) size 159x19
-                  text run at (4,4) width 159: "TABLE Testing Section"
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,4) size 161x19
+                  text run at (4,4) width 161: "TABLE Testing Section"
           LayoutTableRow {TR} at (0,28) size 420x213
             LayoutNGTableCell {TD} at (0,120) size 12x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (4,96) size 4x19
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_bottom-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_bottom-expected.png
index bc10b0c..67d3342 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_bottom-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_bottom-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_bottom-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_bottom-expected.txt
index ea3a73d9..21fb203 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_bottom-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_bottom-expected.txt
@@ -21,17 +21,17 @@
           text run at (0,0) width 731: "Note that all table cells on this page should have a two-pixel solid green border along their bottom sides. This border"
           text run at (0,20) width 365: "applies only to the cells, not the rows which contain them."
       LayoutNGBlockFlow {P} at (0,187) size 769x30 [border: none (10px double #800080) none]
-        LayoutText {#text} at (0,0) size 438x19
-          text run at (0,0) width 438: "This paragraph should have a purple, double, 10-pixel bottom border."
+        LayoutText {#text} at (0,0) size 437x19
+          text run at (0,0) width 437: "This paragraph should have a purple, double, 10-pixel bottom border."
       LayoutNGBlockFlow {P} at (0,233) size 769x21 [border: none (1px solid #800080) none]
-        LayoutText {#text} at (0,0) size 355x19
-          text run at (0,0) width 355: "This paragraph should have a thin purple bottom border."
+        LayoutText {#text} at (0,0) size 354x19
+          text run at (0,0) width 354: "This paragraph should have a thin purple bottom border."
       LayoutTable {TABLE} at (0,270) size 769x118 [border: (1px outset #808080)]
         LayoutTableSection {TBODY} at (1,1) size 767x116
           LayoutTableRow {TR} at (0,5) size 767x45
             LayoutNGTableCell {TD} at (5,5) size 757x45 [border: (1px inset #808080) (2px solid #008000) (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutText {#text} at (2,2) size 736x39
-                text run at (2,2) width 736: "Every cell in this table should have a 2-pixel solid green bottom border. This is also true of the table-testing section in"
+              LayoutText {#text} at (2,2) size 735x39
+                text run at (2,2) width 735: "Every cell in this table should have a 2-pixel solid green bottom border. This is also true of the table-testing section in"
                 text run at (2,22) width 198: "the second half of the test page."
           LayoutTableRow {TR} at (0,55) size 767x56
             LayoutNGTableCell {TD} at (5,70) size 192x25 [border: (1px inset #808080) (2px solid #008000) (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
@@ -96,9 +96,9 @@
         LayoutTableSection {TBODY} at (1,1) size 767x476
           LayoutTableRow {TR} at (0,0) size 767x29
             LayoutNGTableCell {TD} at (0,0) size 767x29 [bgcolor=#C0C0C0] [border: (1px inset #808080) (2px solid #008000) (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutInline {STRONG} at (0,0) size 159x19
-                LayoutText {#text} at (4,4) size 159x19
-                  text run at (4,4) width 159: "TABLE Testing Section"
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,4) size 161x19
+                  text run at (4,4) width 161: "TABLE Testing Section"
           LayoutTableRow {TR} at (0,29) size 767x447
             LayoutNGTableCell {TD} at (0,238) size 12x29 [bgcolor=#C0C0C0] [border: (1px inset #808080) (2px solid #008000) (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (4,213) size 4x19
@@ -109,24 +109,24 @@
                   text run at (0,0) width 731: "Note that all table cells on this page should have a two-pixel solid green border along their bottom sides. This border"
                   text run at (0,20) width 365: "applies only to the cells, not the rows which contain them."
               LayoutNGBlockFlow {P} at (4,60) size 747x30 [border: none (10px double #800080) none]
-                LayoutText {#text} at (0,0) size 438x19
-                  text run at (0,0) width 438: "This paragraph should have a purple, double, 10-pixel bottom border."
+                LayoutText {#text} at (0,0) size 437x19
+                  text run at (0,0) width 437: "This paragraph should have a purple, double, 10-pixel bottom border."
               LayoutNGBlockFlow {P} at (4,106) size 747x21 [border: none (1px solid #800080) none]
-                LayoutText {#text} at (0,0) size 355x19
-                  text run at (0,0) width 355: "This paragraph should have a thin purple bottom border."
+                LayoutText {#text} at (0,0) size 354x19
+                  text run at (0,0) width 354: "This paragraph should have a thin purple bottom border."
               LayoutTable {TABLE} at (4,143) size 747x118 [border: (1px outset #808080)]
                 LayoutTableSection {TBODY} at (1,1) size 745x116
                   LayoutTableRow {TR} at (0,5) size 745x45
                     LayoutNGTableCell {TD} at (5,5) size 735x45 [border: (1px inset #808080) (2px solid #008000) (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-                      LayoutText {#text} at (2,2) size 720x39
-                        text run at (2,2) width 720: "Every cell in this table should have a 2-pixel solid green bottom border. This is also true of the table-testing section"
+                      LayoutText {#text} at (2,2) size 719x39
+                        text run at (2,2) width 719: "Every cell in this table should have a 2-pixel solid green bottom border. This is also true of the table-testing section"
                         text run at (2,22) width 214: "in the second half of the test page."
                   LayoutTableRow {TR} at (0,55) size 745x56
-                    LayoutNGTableCell {TD} at (5,70) size 186x25 [border: (1px inset #808080) (2px solid #008000) (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
+                    LayoutNGTableCell {TD} at (5,70) size 187x25 [border: (1px inset #808080) (2px solid #008000) (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
                       LayoutText {#text} at (2,17) size 53x19
                         text run at (2,17) width 53: "Cell one"
-                    LayoutNGTableCell {TD} at (196,55) size 544x56 [border: (1px inset #808080) (2px solid #008000) (1px inset #808080)] [r=1 c=1 rs=1 cs=1]
-                      LayoutNGBlockFlow (anonymous) at (2,2) size 540x20
+                    LayoutNGTableCell {TD} at (197,55) size 543x56 [border: (1px inset #808080) (2px solid #008000) (1px inset #808080)] [r=1 c=1 rs=1 cs=1]
+                      LayoutNGBlockFlow (anonymous) at (2,2) size 539x20
                         LayoutText {#text} at (0,0) size 54x19
                           text run at (0,0) width 54: "Cell two"
                       LayoutTable {TABLE} at (2,22) size 161x31 [border: (1px outset #808080)]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_left-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_left-expected.png
index 20fa03e1..4410745a 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_left-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_left-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_left-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_left-expected.txt
index c8e7dd5..79e489b 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_left-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_left-expected.txt
@@ -27,17 +27,17 @@
           text run at (0,0) width 707: "Note that all table cells on this page should have a two-pixel solid green border along their left sides. This border"
           text run at (0,20) width 365: "applies only to the cells, not the rows which contain them."
       LayoutNGBlockFlow {P} at (20,235) size 749x20 [border: none (10px double #800080)]
-        LayoutText {#text} at (10,0) size 414x19
-          text run at (10,0) width 414: "This paragraph should have a purple, double, 10-pixel left border."
+        LayoutText {#text} at (10,0) size 413x19
+          text run at (10,0) width 413: "This paragraph should have a purple, double, 10-pixel left border."
       LayoutNGBlockFlow {P} at (20,271) size 749x20 [border: none (1px solid #800080)]
-        LayoutText {#text} at (1,0) size 331x19
-          text run at (1,0) width 331: "This paragraph should have a thin purple left border."
+        LayoutText {#text} at (1,0) size 330x19
+          text run at (1,0) width 330: "This paragraph should have a thin purple left border."
       LayoutTable {TABLE} at (0,307) size 769x115 [border: (1px outset #808080)]
         LayoutTableSection {TBODY} at (1,1) size 767x113
           LayoutTableRow {TR} at (0,5) size 767x44
             LayoutNGTableCell {TD} at (5,5) size 757x44 [border: (1px inset #808080) (2px solid #008000)] [r=0 c=0 rs=1 cs=2]
-              LayoutText {#text} at (3,2) size 735x39
-                text run at (3,2) width 735: "Every cell in this table should have a 2-pixel solid green left border. This is also true of the table-testing section in the"
+              LayoutText {#text} at (3,2) size 734x39
+                text run at (3,2) width 734: "Every cell in this table should have a 2-pixel solid green left border. This is also true of the table-testing section in the"
                 text run at (3,22) width 175: "second half of the test page."
           LayoutTableRow {TR} at (0,54) size 767x54
             LayoutNGTableCell {TD} at (5,69) size 193x24 [border: (1px inset #808080) (2px solid #008000)] [r=1 c=0 rs=1 cs=1]
@@ -98,9 +98,9 @@
         LayoutTableSection {TBODY} at (1,1) size 767x471
           LayoutTableRow {TR} at (0,0) size 767x28
             LayoutNGTableCell {TD} at (0,0) size 767x28 [bgcolor=#C0C0C0] [border: (1px inset #808080) (2px solid #008000)] [r=0 c=0 rs=1 cs=2]
-              LayoutInline {STRONG} at (0,0) size 159x19
-                LayoutText {#text} at (5,4) size 159x19
-                  text run at (5,4) width 159: "TABLE Testing Section"
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (5,4) size 161x19
+                  text run at (5,4) width 161: "TABLE Testing Section"
           LayoutTableRow {TR} at (0,28) size 767x443
             LayoutNGTableCell {TD} at (0,235) size 13x28 [bgcolor=#C0C0C0] [border: (1px inset #808080) (2px solid #008000)] [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (5,211) size 4x19
@@ -111,17 +111,17 @@
                   text run at (0,0) width 707: "Note that all table cells on this page should have a two-pixel solid green border along their left sides. This border"
                   text run at (0,20) width 365: "applies only to the cells, not the rows which contain them."
               LayoutNGBlockFlow {P} at (25,60) size 725x20 [border: none (10px double #800080)]
-                LayoutText {#text} at (10,0) size 414x19
-                  text run at (10,0) width 414: "This paragraph should have a purple, double, 10-pixel left border."
+                LayoutText {#text} at (10,0) size 413x19
+                  text run at (10,0) width 413: "This paragraph should have a purple, double, 10-pixel left border."
               LayoutNGBlockFlow {P} at (25,96) size 725x20 [border: none (1px solid #800080)]
-                LayoutText {#text} at (1,0) size 331x19
-                  text run at (1,0) width 331: "This paragraph should have a thin purple left border."
+                LayoutText {#text} at (1,0) size 330x19
+                  text run at (1,0) width 330: "This paragraph should have a thin purple left border."
               LayoutTable {TABLE} at (5,132) size 745x115 [border: (1px outset #808080)]
                 LayoutTableSection {TBODY} at (1,1) size 743x113
                   LayoutTableRow {TR} at (0,5) size 743x44
                     LayoutNGTableCell {TD} at (5,5) size 733x44 [border: (1px inset #808080) (2px solid #008000)] [r=0 c=0 rs=1 cs=2]
-                      LayoutText {#text} at (3,2) size 712x39
-                        text run at (3,2) width 712: "Every cell in this table should have a 2-pixel solid green left border. This is also true of the table-testing section in"
+                      LayoutText {#text} at (3,2) size 711x39
+                        text run at (3,2) width 711: "Every cell in this table should have a 2-pixel solid green left border. This is also true of the table-testing section in"
                         text run at (3,22) width 198: "the second half of the test page."
                   LayoutTableRow {TR} at (0,54) size 743x54
                     LayoutNGTableCell {TD} at (5,69) size 187x24 [border: (1px inset #808080) (2px solid #008000)] [r=1 c=0 rs=1 cs=1]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_right_inline-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_right_inline-expected.png
index 45584cb..83cb6add 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_right_inline-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_right_inline-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_right_inline-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_right_inline-expected.txt
index 3d3c52a9..b68fafb1 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_right_inline-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_right_inline-expected.txt
@@ -27,17 +27,17 @@
           text run at (0,0) width 716: "Note that all table cells on this page should have a two-pixel solid green border along their right sides. This border"
           text run at (0,20) width 365: "applies only to the cells, not the rows which contain them."
       LayoutNGBlockFlow {P} at (0,235) size 749x20 [border: none (10px double #800080) none]
-        LayoutText {#text} at (0,0) size 423x19
-          text run at (0,0) width 423: "This paragraph should have a purple, double, 10-pixel right border."
+        LayoutText {#text} at (0,0) size 422x19
+          text run at (0,0) width 422: "This paragraph should have a purple, double, 10-pixel right border."
       LayoutNGBlockFlow {P} at (0,271) size 749x20 [border: none (1px solid #800080) none]
-        LayoutText {#text} at (0,0) size 340x19
-          text run at (0,0) width 340: "This paragraph should have a thin purple right border."
+        LayoutText {#text} at (0,0) size 339x19
+          text run at (0,0) width 339: "This paragraph should have a thin purple right border."
       LayoutTable {TABLE} at (0,307) size 769x115 [border: (1px outset #808080)]
         LayoutTableSection {TBODY} at (1,1) size 767x113
           LayoutTableRow {TR} at (0,5) size 767x44
             LayoutNGTableCell {TD} at (5,5) size 757x44 [border: (1px inset #808080) (2px solid #008000) (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutText {#text} at (2,2) size 744x39
-                text run at (2,2) width 744: "Every cell in this table should have a 2-pixel solid green right border. This is also true of the table-testing section in the"
+              LayoutText {#text} at (2,2) size 743x39
+                text run at (2,2) width 743: "Every cell in this table should have a 2-pixel solid green right border. This is also true of the table-testing section in the"
                 text run at (2,22) width 175: "second half of the test page."
           LayoutTableRow {TR} at (0,54) size 767x54
             LayoutNGTableCell {TD} at (5,69) size 193x24 [border: (1px inset #808080) (2px solid #008000) (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
@@ -94,14 +94,14 @@
             text run at (0,0) width 700: "Each list item in this 'parent' list should have a medium-width border along its right side, in each of three colors."
             text run at (0,20) width 704: "The first item's border should travel the entire height the nested list (to end near the baseline of the line \"...nested"
             text run at (0,40) width 707: "within the list item.\"), even though the nested list does not have any border styles set. The borders should line up"
-            text run at (0,60) width 619: "together at the right edge of the document's body, as each list element has a default width of 100%."
+            text run at (0,60) width 620: "together at the right edge of the document's body, as each list element has a default width of 100%."
       LayoutTable {TABLE} at (0,634) size 769x513 [border: (1px outset #808080)]
         LayoutTableSection {TBODY} at (1,1) size 767x511
           LayoutTableRow {TR} at (0,0) size 767x28
             LayoutNGTableCell {TD} at (0,0) size 767x28 [bgcolor=#C0C0C0] [border: (1px inset #808080) (2px solid #008000) (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutInline {STRONG} at (0,0) size 159x19
-                LayoutText {#text} at (4,4) size 159x19
-                  text run at (4,4) width 159: "TABLE Testing Section"
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,4) size 161x19
+                  text run at (4,4) width 161: "TABLE Testing Section"
           LayoutTableRow {TR} at (0,28) size 767x483
             LayoutNGTableCell {TD} at (0,255) size 13x28 [bgcolor=#C0C0C0] [border: (1px inset #808080) (2px solid #008000) (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (4,231) size 4x19
@@ -112,24 +112,24 @@
                   text run at (0,0) width 716: "Note that all table cells on this page should have a two-pixel solid green border along their right sides. This border"
                   text run at (0,20) width 365: "applies only to the cells, not the rows which contain them."
               LayoutNGBlockFlow {P} at (4,60) size 725x20 [border: none (10px double #800080) none]
-                LayoutText {#text} at (0,0) size 423x19
-                  text run at (0,0) width 423: "This paragraph should have a purple, double, 10-pixel right border."
+                LayoutText {#text} at (0,0) size 422x19
+                  text run at (0,0) width 422: "This paragraph should have a purple, double, 10-pixel right border."
               LayoutNGBlockFlow {P} at (4,96) size 725x20 [border: none (1px solid #800080) none]
-                LayoutText {#text} at (0,0) size 340x19
-                  text run at (0,0) width 340: "This paragraph should have a thin purple right border."
+                LayoutText {#text} at (0,0) size 339x19
+                  text run at (0,0) width 339: "This paragraph should have a thin purple right border."
               LayoutTable {TABLE} at (4,132) size 745x115 [border: (1px outset #808080)]
                 LayoutTableSection {TBODY} at (1,1) size 743x113
                   LayoutTableRow {TR} at (0,5) size 743x44
                     LayoutNGTableCell {TD} at (5,5) size 733x44 [border: (1px inset #808080) (2px solid #008000) (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-                      LayoutText {#text} at (2,2) size 721x39
-                        text run at (2,2) width 721: "Every cell in this table should have a 2-pixel solid green right border. This is also true of the table-testing section in"
+                      LayoutText {#text} at (2,2) size 720x39
+                        text run at (2,2) width 720: "Every cell in this table should have a 2-pixel solid green right border. This is also true of the table-testing section in"
                         text run at (2,22) width 198: "the second half of the test page."
                   LayoutTableRow {TR} at (0,54) size 743x54
-                    LayoutNGTableCell {TD} at (5,69) size 186x24 [border: (1px inset #808080) (2px solid #008000) (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
+                    LayoutNGTableCell {TD} at (5,69) size 187x24 [border: (1px inset #808080) (2px solid #008000) (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
                       LayoutText {#text} at (2,17) size 53x19
                         text run at (2,17) width 53: "Cell one"
-                    LayoutNGTableCell {TD} at (196,54) size 542x54 [border: (1px inset #808080) (2px solid #008000) (1px inset #808080)] [r=1 c=1 rs=1 cs=1]
-                      LayoutNGBlockFlow (anonymous) at (2,2) size 537x20
+                    LayoutNGTableCell {TD} at (197,54) size 541x54 [border: (1px inset #808080) (2px solid #008000) (1px inset #808080)] [r=1 c=1 rs=1 cs=1]
+                      LayoutNGBlockFlow (anonymous) at (2,2) size 536x20
                         LayoutText {#text} at (0,0) size 54x19
                           text run at (0,0) width 54: "Cell two"
                       LayoutTable {TABLE} at (2,22) size 162x30 [border: (1px outset #808080)]
@@ -179,7 +179,7 @@
                     text run at (0,0) width 700: "Each list item in this 'parent' list should have a medium-width border along its right side, in each of three colors."
                     text run at (0,20) width 641: "The first item's border should travel the entire height the nested list (to end near the baseline of the line"
                     text run at (0,40) width 677: "\"...nested within the list item.\"), even though the nested list does not have any border styles set. The borders"
-                    text run at (0,60) width 667: "should line up together at the right edge of the document's body, as each list element has a default width of"
+                    text run at (0,60) width 668: "should line up together at the right edge of the document's body, as each list element has a default width of"
                     text run at (0,80) width 41: "100%."
 layer at (8,169) size 769x2 clip at (0,0) size 0x0
   LayoutNGBlockFlow {HR} at (0,161) size 769x2 [border: (1px inset #EEEEEE)]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_style-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_style-expected.png
index 3ab5eaf5..3083a5c 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_style-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_style-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_style-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_style-expected.txt
index a13ea714..c527ed5 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_style-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_style-expected.txt
@@ -61,8 +61,8 @@
           text run at (5,5) width 744: "This paragraph should have thick double top and bottom borders, and thick grooved side borders. The color of all four"
           text run at (5,25) width 204: "sides should be based on purple."
       LayoutNGBlockFlow {P} at (0,693) size 769x50 [border: (5px double #800080) (5px groove #800080) (5px ridge #800080) (5px inset #800080)]
-        LayoutText {#text} at (5,5) size 727x39
-          text run at (5,5) width 727: "This paragraph should have, in clockwise order from the top, a double, grooved, ridged, and inset thick border. The"
+        LayoutText {#text} at (5,5) size 726x39
+          text run at (5,5) width 726: "This paragraph should have, in clockwise order from the top, a double, grooved, ridged, and inset thick border. The"
           text run at (5,25) width 306: "color of all four sides should be based on purple."
       LayoutNGBlockFlow {P} at (0,759) size 769x20
         LayoutText {#text} at (0,0) size 278x19
@@ -71,9 +71,9 @@
         LayoutTableSection {TBODY} at (1,1) size 767x556
           LayoutTableRow {TR} at (0,0) size 767x28
             LayoutNGTableCell {TD} at (0,0) size 767x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutInline {STRONG} at (0,0) size 159x19
-                LayoutText {#text} at (4,4) size 159x19
-                  text run at (4,4) width 159: "TABLE Testing Section"
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,4) size 161x19
+                  text run at (4,4) width 161: "TABLE Testing Section"
           LayoutTableRow {TR} at (0,28) size 767x528
             LayoutNGTableCell {TD} at (0,278) size 12x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (4,254) size 4x19
@@ -108,8 +108,8 @@
                   text run at (5,5) width 714: "This paragraph should have thick double top and bottom borders, and thick grooved side borders. The color of all"
                   text run at (5,25) width 234: "four sides should be based on purple."
               LayoutNGBlockFlow {P} at (4,438) size 747x50 [border: (5px double #800080) (5px groove #800080) (5px ridge #800080) (5px inset #800080)]
-                LayoutText {#text} at (5,5) size 727x39
-                  text run at (5,5) width 727: "This paragraph should have, in clockwise order from the top, a double, grooved, ridged, and inset thick border. The"
+                LayoutText {#text} at (5,5) size 726x39
+                  text run at (5,5) width 726: "This paragraph should have, in clockwise order from the top, a double, grooved, ridged, and inset thick border. The"
                   text run at (5,25) width 306: "color of all four sides should be based on purple."
               LayoutNGBlockFlow {P} at (4,504) size 747x20
                 LayoutText {#text} at (0,0) size 278x19
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_style_inline-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_style_inline-expected.png
index ceb0db6..3bc537c 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_style_inline-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_style_inline-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_style_inline-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_style_inline-expected.txt
index d8916931..ab28127 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_style_inline-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_style_inline-expected.txt
@@ -15,51 +15,51 @@
           text run at (0,32) width 568: ".three {border-style: none; border-color: purple; border-width: thick;}"
           text run at (568,32) width 0: " "
       LayoutNGBlockFlow {P} at (0,115) size 784x60 [bgcolor=#C0C0C0]
-        LayoutText {#text} at (0,0) size 664x19
-          text run at (0,0) width 664: "This is an unstyled element, save for the background color, and it contains inline elements with classes of "
+        LayoutText {#text} at (0,0) size 663x19
+          text run at (0,0) width 663: "This is an unstyled element, save for the background color, and it contains inline elements with classes of "
         LayoutInline {SPAN} at (0,0) size 67x29 [border: (5px dashed #000000)]
-          LayoutText {#text} at (669,0) size 57x19
-            text run at (669,0) width 57: "class one"
-        LayoutText {#text} at (731,0) size 778x39
-          text run at (731,0) width 47: ", which"
+          LayoutText {#text} at (668,0) size 57x19
+            text run at (668,0) width 57: "class one"
+        LayoutText {#text} at (730,0) size 777x39
+          text run at (730,0) width 47: ", which"
           text run at (0,20) width 263: "will result in a dashed thick black border; "
         LayoutInline {SPAN} at (0,0) size 68x29 [border: (5px groove #FF0000)]
           LayoutText {#text} at (268,20) size 58x19
             text run at (268,20) width 58: "class two"
-        LayoutText {#text} at (331,20) size 373x19
-          text run at (331,20) width 373: ", which should result in a grooved thick purple border, and "
+        LayoutText {#text} at (331,20) size 372x19
+          text run at (331,20) width 372: ", which should result in a grooved thick purple border, and "
         LayoutInline {SPAN} at (0,0) size 65x19
-          LayoutText {#text} at (704,20) size 65x19
-            text run at (704,20) width 65: "class three"
-        LayoutText {#text} at (769,20) size 773x39
-          text run at (769,20) width 4: ","
+          LayoutText {#text} at (703,20) size 65x19
+            text run at (703,20) width 65: "class three"
+        LayoutText {#text} at (768,20) size 772x39
+          text run at (768,20) width 4: ","
           text run at (0,40) width 679: "which should result in no border at all. The line-height of the parent element should not change, on any line."
       LayoutTable {TABLE} at (0,191) size 784x98 [border: (1px outset #808080)]
         LayoutTableSection {TBODY} at (1,1) size 782x96
           LayoutTableRow {TR} at (0,0) size 782x28
             LayoutNGTableCell {TD} at (0,0) size 782x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutInline {STRONG} at (0,0) size 159x19
-                LayoutText {#text} at (4,4) size 159x19
-                  text run at (4,4) width 159: "TABLE Testing Section"
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,4) size 161x19
+                  text run at (4,4) width 161: "TABLE Testing Section"
           LayoutTableRow {TR} at (0,28) size 782x68
             LayoutNGTableCell {TD} at (0,48) size 12x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (4,24) size 4x19
                 text run at (4,24) width 4: " "
             LayoutNGTableCell {TD} at (12,28) size 770x68 [border: (1px inset #808080)] [r=1 c=1 rs=1 cs=1]
               LayoutNGBlockFlow {P} at (4,4) size 762x60 [bgcolor=#C0C0C0]
-                LayoutText {#text} at (0,0) size 664x19
-                  text run at (0,0) width 664: "This is an unstyled element, save for the background color, and it contains inline elements with classes of "
+                LayoutText {#text} at (0,0) size 663x19
+                  text run at (0,0) width 663: "This is an unstyled element, save for the background color, and it contains inline elements with classes of "
                 LayoutInline {SPAN} at (0,0) size 67x29 [border: (5px dashed #000000)]
-                  LayoutText {#text} at (669,0) size 57x19
-                    text run at (669,0) width 57: "class one"
-                LayoutText {#text} at (731,0) size 735x39
-                  text run at (731,0) width 4: ","
+                  LayoutText {#text} at (668,0) size 57x19
+                    text run at (668,0) width 57: "class one"
+                LayoutText {#text} at (730,0) size 734x39
+                  text run at (730,0) width 4: ","
                   text run at (0,20) width 306: "which will result in a dashed thick black border; "
                 LayoutInline {SPAN} at (0,0) size 68x29 [border: (5px groove #FF0000)]
                   LayoutText {#text} at (311,20) size 58x19
                     text run at (311,20) width 58: "class two"
-                LayoutText {#text} at (374,20) size 369x19
-                  text run at (374,20) width 369: ", which should result in a grooved thick purple border, and"
+                LayoutText {#text} at (374,20) size 368x19
+                  text run at (374,20) width 368: ", which should result in a grooved thick purple border, and"
                 LayoutInline {SPAN} at (0,0) size 65x19
                   LayoutText {#text} at (0,40) size 65x19
                     text run at (0,40) width 65: "class three"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_top-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_top-expected.png
index 1b71206c..3c01522 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_top-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_top-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_top-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_top-expected.txt
index 9e25801..bf22de6 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_top-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/border_top-expected.txt
@@ -21,17 +21,17 @@
           text run at (0,0) width 755: "Note that all table cells on this page should have a two-pixel solid green border along their top sides. This border applies"
           text run at (0,20) width 317: "only to the cells, not the rows which contain them."
       LayoutNGBlockFlow {P} at (0,187) size 769x30 [border: (10px double #800080) none]
-        LayoutText {#text} at (0,10) size 414x19
-          text run at (0,10) width 414: "This paragraph should have a purple, double, 10-pixel top border."
+        LayoutText {#text} at (0,10) size 413x19
+          text run at (0,10) width 413: "This paragraph should have a purple, double, 10-pixel top border."
       LayoutNGBlockFlow {P} at (0,233) size 769x21 [border: (1px solid #800080) none]
-        LayoutText {#text} at (0,1) size 331x19
-          text run at (0,1) width 331: "This paragraph should have a thin purple top border."
+        LayoutText {#text} at (0,1) size 330x19
+          text run at (0,1) width 330: "This paragraph should have a thin purple top border."
       LayoutTable {TABLE} at (0,270) size 769x118 [border: (1px outset #808080)]
         LayoutTableSection {TBODY} at (1,1) size 767x116
           LayoutTableRow {TR} at (0,5) size 767x45
             LayoutNGTableCell {TD} at (5,5) size 757x45 [border: (2px solid #008000) (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutText {#text} at (2,3) size 735x39
-                text run at (2,3) width 735: "Every cell in this table should have a 2-pixel solid green top border. This is also true of the table-testing section in the"
+              LayoutText {#text} at (2,3) size 734x39
+                text run at (2,3) width 734: "Every cell in this table should have a 2-pixel solid green top border. This is also true of the table-testing section in the"
                 text run at (2,23) width 175: "second half of the test page."
           LayoutTableRow {TR} at (0,55) size 767x56
             LayoutNGTableCell {TD} at (5,70) size 192x25 [border: (2px solid #008000) (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
@@ -90,9 +90,9 @@
         LayoutTableSection {TBODY} at (1,1) size 767x456
           LayoutTableRow {TR} at (0,0) size 767x29
             LayoutNGTableCell {TD} at (0,0) size 767x29 [bgcolor=#C0C0C0] [border: (2px solid #008000) (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutInline {STRONG} at (0,0) size 159x19
-                LayoutText {#text} at (4,5) size 159x19
-                  text run at (4,5) width 159: "TABLE Testing Section"
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,5) size 161x19
+                  text run at (4,5) width 161: "TABLE Testing Section"
           LayoutTableRow {TR} at (0,29) size 767x427
             LayoutNGTableCell {TD} at (0,228) size 12x29 [bgcolor=#C0C0C0] [border: (2px solid #008000) (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (4,204) size 4x19
@@ -103,17 +103,17 @@
                   text run at (0,0) width 707: "Note that all table cells on this page should have a two-pixel solid green border along their top sides. This border"
                   text run at (0,20) width 365: "applies only to the cells, not the rows which contain them."
               LayoutNGBlockFlow {P} at (4,61) size 747x30 [border: (10px double #800080) none]
-                LayoutText {#text} at (0,10) size 414x19
-                  text run at (0,10) width 414: "This paragraph should have a purple, double, 10-pixel top border."
+                LayoutText {#text} at (0,10) size 413x19
+                  text run at (0,10) width 413: "This paragraph should have a purple, double, 10-pixel top border."
               LayoutNGBlockFlow {P} at (4,107) size 747x21 [border: (1px solid #800080) none]
-                LayoutText {#text} at (0,1) size 331x19
-                  text run at (0,1) width 331: "This paragraph should have a thin purple top border."
+                LayoutText {#text} at (0,1) size 330x19
+                  text run at (0,1) width 330: "This paragraph should have a thin purple top border."
               LayoutTable {TABLE} at (4,144) size 747x118 [border: (1px outset #808080)]
                 LayoutTableSection {TBODY} at (1,1) size 745x116
                   LayoutTableRow {TR} at (0,5) size 745x45
                     LayoutNGTableCell {TD} at (5,5) size 735x45 [border: (2px solid #008000) (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-                      LayoutText {#text} at (2,3) size 712x39
-                        text run at (2,3) width 712: "Every cell in this table should have a 2-pixel solid green top border. This is also true of the table-testing section in"
+                      LayoutText {#text} at (2,3) size 711x39
+                        text run at (2,3) width 711: "Every cell in this table should have a 2-pixel solid green top border. This is also true of the table-testing section in"
                         text run at (2,23) width 198: "the second half of the test page."
                   LayoutTableRow {TR} at (0,55) size 745x56
                     LayoutNGTableCell {TD} at (5,70) size 187x25 [border: (2px solid #008000) (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/clear_float-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/clear_float-expected.png
index 9c0fd53..98543a7e 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/clear_float-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/clear_float-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/clear_float-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/clear_float-expected.txt
index 4061711..8c63726f 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/clear_float-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/clear_float-expected.txt
@@ -84,8 +84,8 @@
               text run at (0,0) width 87: "0.5em margin"
       LayoutNGBlockFlow {DIV} at (224,200) size 528x235.88 [bgcolor=#FFFF00]
         LayoutNGBlockFlow {H1} at (8,29.44) size 512x37
-          LayoutText {#text} at (0,0) size 275x36
-            text run at (0,0) width 275: "The 'clear' property"
+          LayoutText {#text} at (0,0) size 274x36
+            text run at (0,0) width 274: "The 'clear' property"
         LayoutNGBlockFlow {P} at (8,87.88) size 512x100
           LayoutText {#text} at (0,0) size 512x99
             text run at (0,0) width 512: "This page has two floating \"menus\" on the side; one has a green background,"
@@ -101,9 +101,9 @@
         LayoutTableSection {TBODY} at (1,1) size 590x372
           LayoutTableRow {TR} at (0,0) size 590x28
             LayoutNGTableCell {TD} at (0,0) size 590x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutInline {STRONG} at (0,0) size 159x19
-                LayoutText {#text} at (4,4) size 159x19
-                  text run at (4,4) width 159: "TABLE Testing Section"
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,4) size 161x19
+                  text run at (4,4) width 161: "TABLE Testing Section"
           LayoutTableRow {TR} at (0,28) size 590x344
             LayoutNGTableCell {TD} at (0,186) size 12x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (4,162) size 4x19
@@ -169,8 +169,8 @@
                       text run at (0,0) width 87: "0.5em margin"
               LayoutNGBlockFlow {DIV} at (228,4) size 314x335.88 [bgcolor=#FFFF00]
                 LayoutNGBlockFlow {H1} at (8,29.44) size 298x37
-                  LayoutText {#text} at (0,0) size 275x36
-                    text run at (0,0) width 275: "The 'clear' property"
+                  LayoutText {#text} at (0,0) size 274x36
+                    text run at (0,0) width 274: "The 'clear' property"
                 LayoutNGBlockFlow {P} at (8,87.88) size 298x180
                   LayoutText {#text} at (0,0) size 298x179
                     text run at (0,0) width 298: "This page has two floating \"menus\" on the"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/float_elements_in_series-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/float_elements_in_series-expected.png
new file mode 100644
index 0000000..918c197
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/float_elements_in_series-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/float_elements_in_series-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/float_elements_in_series-expected.txt
new file mode 100644
index 0000000..2383a45
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/float_elements_in_series-expected.txt
@@ -0,0 +1,242 @@
+layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 730
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 785x730 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
+  LayoutNGBlockFlow {HTML} at (0,0) size 785x730
+    LayoutNGBlockFlow {BODY} at (8,8) size 769x702 [bgcolor=#CCCCCC]
+      LayoutNGBlockFlow {P} at (0,0) size 769x20
+        LayoutText {#text} at (0,0) size 355x19
+          text run at (0,0) width 355: "The style declarations which apply to the text below are:"
+      LayoutNGBlockFlow {PRE} at (0,33) size 769x208
+        LayoutText {#text} at (0,0) size 512x192
+          text run at (0,0) width 392: "P { margin: 0; padding: 0; text-align:  justify;}"
+          text run at (392,0) width 0: " "
+          text run at (0,16) width 0: " "
+          text run at (0,32) width 336: "DIV.yellow, DIV.blue, DIV.red, DIV.green {"
+          text run at (336,32) width 0: " "
+          text run at (0,48) width 336: " width: 60px; padding: 20px; margin: 10px;"
+          text run at (336,48) width 0: " "
+          text run at (0,64) width 472: " border: 20px solid black; float: left; text-align: center;"
+          text run at (472,64) width 0: " "
+          text run at (0,80) width 360: " font-family: \"Times New Roman\",Times,serif;}"
+          text run at (360,80) width 0: " "
+          text run at (0,96) width 512: "DIV.yellow {margin-left: 0px; background: yellow; color: black;}"
+          text run at (512,96) width 0: " "
+          text run at (0,112) width 336: "DIV.blue {background: blue; color: white;}"
+          text run at (336,112) width 0: " "
+          text run at (0,128) width 320: "DIV.red {background: red; color: black;}"
+          text run at (320,128) width 0: " "
+          text run at (0,144) width 352: "DIV.green {background: green; color: white;}"
+          text run at (352,144) width 0: " "
+          text run at (0,160) width 192: "DIV.below {clear: both;}"
+          text run at (192,160) width 0: " "
+          text run at (0,176) width 200: "TABLE {margin: 20px 0px;}"
+          text run at (200,176) width 0: " "
+          text run at (0,192) width 0: " "
+      LayoutNGBlockFlow {P} at (0,264) size 769x40
+        LayoutText {#text} at (0,0) size 769x39
+          text run at (0,0) width 769: "The four floating DIV elements below should appear next to each other horizontally. The table at the bottom of this page"
+          text run at (0,20) width 622: "indicates how the DIV elements should be laid out horizontally. They should align with each other."
+      LayoutNGBlockFlow (floating) {DIV} at (0,314) size 140x100 [bgcolor=#FFFF00] [border: (20px solid #000000)]
+        LayoutNGBlockFlow {P} at (40,40) size 60x20
+          LayoutText {#text} at (0,0) size 45x19
+            text run at (0,0) width 45: "Yellow"
+      LayoutNGBlockFlow (floating) {DIV} at (160,314) size 140x100 [color=#FFFFFF] [bgcolor=#0000FF] [border: (20px solid #000000)]
+        LayoutNGBlockFlow {P} at (40,40) size 60x20
+          LayoutText {#text} at (0,0) size 30x19
+            text run at (0,0) width 30: "Blue"
+      LayoutNGBlockFlow (floating) {DIV} at (320,314) size 140x100 [bgcolor=#FF0000] [border: (20px solid #000000)]
+        LayoutNGBlockFlow {P} at (40,40) size 60x20
+          LayoutText {#text} at (0,0) size 26x19
+            text run at (0,0) width 26: "Red"
+      LayoutNGBlockFlow (floating) {DIV} at (480,314) size 140x100 [color=#FFFFFF] [bgcolor=#008000] [border: (20px solid #000000)]
+        LayoutNGBlockFlow {P} at (40,40) size 60x20
+          LayoutText {#text} at (0,0) size 39x19
+            text run at (0,0) width 39: "Green"
+      LayoutNGBlockFlow {DIV} at (0,424) size 769x20
+        LayoutTable {TABLE} at (0,0) size 620x20
+          LayoutTableSection {TBODY} at (0,0) size 620x20
+            LayoutTableRow {TR} at (0,0) size 620x20
+              LayoutNGTableCell {TD} at (0,9) size 20x1 [bgcolor=#000000] [r=0 c=0 rs=1 cs=1]
+                LayoutNGBlockFlow {IMG} at (0,0) size 20x1
+              LayoutNGTableCell {TD} at (20,9) size 100x1 [bgcolor=#FFFF00] [r=0 c=1 rs=1 cs=1]
+                LayoutNGBlockFlow {IMG} at (0,0) size 100x1
+              LayoutNGTableCell {TD} at (120,10) size 20x0 [bgcolor=#000000] [r=0 c=2 rs=1 cs=1]
+              LayoutNGTableCell {TD} at (140,9) size 20x1 [bgcolor=#FFFFFF] [r=0 c=3 rs=1 cs=1]
+                LayoutNGBlockFlow {IMG} at (0,0) size 20x1
+              LayoutNGTableCell {TD} at (160,9) size 20x1 [bgcolor=#000000] [r=0 c=4 rs=1 cs=1]
+                LayoutNGBlockFlow {IMG} at (0,0) size 20x1
+              LayoutNGTableCell {TD} at (180,9) size 100x1 [bgcolor=#0000FF] [r=0 c=5 rs=1 cs=1]
+                LayoutNGBlockFlow {IMG} at (0,0) size 100x1
+              LayoutNGTableCell {TD} at (280,9) size 20x1 [bgcolor=#000000] [r=0 c=6 rs=1 cs=1]
+                LayoutNGBlockFlow {IMG} at (0,0) size 20x1
+              LayoutNGTableCell {TD} at (300,9) size 20x1 [bgcolor=#FFFFFF] [r=0 c=7 rs=1 cs=1]
+                LayoutNGBlockFlow {IMG} at (0,0) size 20x1
+              LayoutNGTableCell {TD} at (320,9) size 20x1 [bgcolor=#000000] [r=0 c=8 rs=1 cs=1]
+                LayoutNGBlockFlow {IMG} at (0,0) size 20x1
+              LayoutNGTableCell {TD} at (340,9) size 100x1 [bgcolor=#FF0000] [r=0 c=9 rs=1 cs=1]
+                LayoutNGBlockFlow {IMG} at (0,0) size 100x1
+              LayoutNGTableCell {TD} at (440,0) size 20x20 [bgcolor=#000000] [r=0 c=10 rs=1 cs=1]
+                LayoutNGBlockFlow {IMG} at (0,14) size 20x1
+                LayoutText {#text} at (20,0) size 4x19
+                  text run at (20,0) width 4: ";"
+              LayoutNGTableCell {TD} at (460,9) size 20x1 [bgcolor=#FFFFFF] [r=0 c=11 rs=1 cs=1]
+                LayoutNGBlockFlow {IMG} at (0,0) size 20x1
+              LayoutNGTableCell {TD} at (480,9) size 20x1 [bgcolor=#000000] [r=0 c=12 rs=1 cs=1]
+                LayoutNGBlockFlow {IMG} at (0,0) size 20x1
+              LayoutNGTableCell {TD} at (500,9) size 100x1 [bgcolor=#008000] [r=0 c=13 rs=1 cs=1]
+                LayoutNGBlockFlow {IMG} at (0,0) size 100x1
+              LayoutNGTableCell {TD} at (600,9) size 20x1 [bgcolor=#000000] [r=0 c=14 rs=1 cs=1]
+                LayoutNGBlockFlow {IMG} at (0,0) size 20x1
+      LayoutTable {TABLE} at (0,464) size 769x238 [border: (1px outset #808080)]
+        LayoutTableSection {TBODY} at (1,1) size 767x236
+          LayoutTableRow {TR} at (0,0) size 767x28
+            LayoutNGTableCell {TD} at (0,0) size 767x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,4) size 161x19
+                  text run at (4,4) width 161: "TABLE Testing Section"
+          LayoutTableRow {TR} at (0,28) size 767x208
+            LayoutNGTableCell {TD} at (0,118) size 12x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
+              LayoutText {#text} at (4,94) size 4x19
+                text run at (4,94) width 4: " "
+            LayoutNGTableCell {TD} at (12,28) size 755x208 [border: (1px inset #808080)] [r=1 c=1 rs=1 cs=1]
+              LayoutNGBlockFlow {P} at (4,4) size 747x40
+                LayoutText {#text} at (0,0) size 747x39
+                  text run at (0,0) width 747: "The four floating DIV elements below should appear next to each other horizontally. The table at the bottom of this"
+                  text run at (0,20) width 656: "page indicates how the DIV elements should be laid out horizontally. They should align with each other."
+              LayoutNGBlockFlow (floating) {DIV} at (4,54) size 140x100 [bgcolor=#FFFF00] [border: (20px solid #000000)]
+                LayoutNGBlockFlow {P} at (40,40) size 60x20
+                  LayoutText {#text} at (0,0) size 45x19
+                    text run at (0,0) width 45: "Yellow"
+              LayoutNGBlockFlow (floating) {DIV} at (164,54) size 140x100 [color=#FFFFFF] [bgcolor=#0000FF] [border: (20px solid #000000)]
+                LayoutNGBlockFlow {P} at (40,40) size 60x20
+                  LayoutText {#text} at (0,0) size 30x19
+                    text run at (0,0) width 30: "Blue"
+              LayoutNGBlockFlow (floating) {DIV} at (324,54) size 140x100 [bgcolor=#FF0000] [border: (20px solid #000000)]
+                LayoutNGBlockFlow {P} at (40,40) size 60x20
+                  LayoutText {#text} at (0,0) size 26x19
+                    text run at (0,0) width 26: "Red"
+              LayoutNGBlockFlow (floating) {DIV} at (484,54) size 140x100 [color=#FFFFFF] [bgcolor=#008000] [border: (20px solid #000000)]
+                LayoutNGBlockFlow {P} at (40,40) size 60x20
+                  LayoutText {#text} at (0,0) size 39x19
+                    text run at (0,0) width 39: "Green"
+              LayoutNGBlockFlow {DIV} at (4,164) size 747x20
+                LayoutTable {TABLE} at (0,0) size 620x20
+                  LayoutTableSection {TBODY} at (0,0) size 620x20
+                    LayoutTableRow {TR} at (0,0) size 620x20
+                      LayoutNGTableCell {TD} at (0,9) size 20x1 [bgcolor=#000000] [r=0 c=0 rs=1 cs=1]
+                        LayoutNGBlockFlow {IMG} at (0,0) size 20x1
+                      LayoutNGTableCell {TD} at (20,9) size 100x1 [bgcolor=#FFFF00] [r=0 c=1 rs=1 cs=1]
+                        LayoutNGBlockFlow {IMG} at (0,0) size 100x1
+                      LayoutNGTableCell {TD} at (120,10) size 20x0 [bgcolor=#000000] [r=0 c=2 rs=1 cs=1]
+                      LayoutNGTableCell {TD} at (140,9) size 20x1 [bgcolor=#FFFFFF] [r=0 c=3 rs=1 cs=1]
+                        LayoutNGBlockFlow {IMG} at (0,0) size 20x1
+                      LayoutNGTableCell {TD} at (160,9) size 20x1 [bgcolor=#000000] [r=0 c=4 rs=1 cs=1]
+                        LayoutNGBlockFlow {IMG} at (0,0) size 20x1
+                      LayoutNGTableCell {TD} at (180,9) size 100x1 [bgcolor=#0000FF] [r=0 c=5 rs=1 cs=1]
+                        LayoutNGBlockFlow {IMG} at (0,0) size 100x1
+                      LayoutNGTableCell {TD} at (280,9) size 20x1 [bgcolor=#000000] [r=0 c=6 rs=1 cs=1]
+                        LayoutNGBlockFlow {IMG} at (0,0) size 20x1
+                      LayoutNGTableCell {TD} at (300,9) size 20x1 [bgcolor=#FFFFFF] [r=0 c=7 rs=1 cs=1]
+                        LayoutNGBlockFlow {IMG} at (0,0) size 20x1
+                      LayoutNGTableCell {TD} at (320,9) size 20x1 [bgcolor=#000000] [r=0 c=8 rs=1 cs=1]
+                        LayoutNGBlockFlow {IMG} at (0,0) size 20x1
+                      LayoutNGTableCell {TD} at (340,9) size 100x1 [bgcolor=#FF0000] [r=0 c=9 rs=1 cs=1]
+                        LayoutNGBlockFlow {IMG} at (0,0) size 100x1
+                      LayoutNGTableCell {TD} at (440,0) size 20x20 [bgcolor=#000000] [r=0 c=10 rs=1 cs=1]
+                        LayoutNGBlockFlow {IMG} at (0,14) size 20x1
+                        LayoutText {#text} at (20,0) size 4x19
+                          text run at (20,0) width 4: ";"
+                      LayoutNGTableCell {TD} at (460,9) size 20x1 [bgcolor=#FFFFFF] [r=0 c=11 rs=1 cs=1]
+                        LayoutNGBlockFlow {IMG} at (0,0) size 20x1
+                      LayoutNGTableCell {TD} at (480,9) size 20x1 [bgcolor=#000000] [r=0 c=12 rs=1 cs=1]
+                        LayoutNGBlockFlow {IMG} at (0,0) size 20x1
+                      LayoutNGTableCell {TD} at (500,9) size 100x1 [bgcolor=#008000] [r=0 c=13 rs=1 cs=1]
+                        LayoutNGBlockFlow {IMG} at (0,0) size 100x1
+                      LayoutNGTableCell {TD} at (600,9) size 20x1 [bgcolor=#000000] [r=0 c=14 rs=1 cs=1]
+                        LayoutNGBlockFlow {IMG} at (0,0) size 20x1
+layer at (8,262) size 769x2 clip at (0,0) size 0x0
+  LayoutNGBlockFlow {HR} at (0,254) size 769x2 [border: (1px inset #EEEEEE)]
+layer at (8,441) size 20x1
+  LayoutNGBlockFlow {SPAN} at (0,0) size 20x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (28,441) size 100x1
+  LayoutNGBlockFlow {SPAN} at (0,0) size 100x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (148,441) size 20x1
+  LayoutNGBlockFlow {SPAN} at (0,0) size 20x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (168,441) size 20x1
+  LayoutNGBlockFlow {SPAN} at (0,0) size 20x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (188,441) size 100x1
+  LayoutNGBlockFlow {SPAN} at (0,0) size 100x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (288,441) size 20x1
+  LayoutNGBlockFlow {SPAN} at (0,0) size 20x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (308,441) size 20x1
+  LayoutNGBlockFlow {SPAN} at (0,0) size 20x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (328,441) size 20x1
+  LayoutNGBlockFlow {SPAN} at (0,0) size 20x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (348,441) size 100x1
+  LayoutNGBlockFlow {SPAN} at (0,0) size 100x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (448,446) size 20x1
+  LayoutNGBlockFlow {SPAN} at (0,0) size 20x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (468,441) size 20x1
+  LayoutNGBlockFlow {SPAN} at (0,0) size 20x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (488,441) size 20x1
+  LayoutNGBlockFlow {SPAN} at (0,0) size 20x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (508,441) size 100x1
+  LayoutNGBlockFlow {SPAN} at (0,0) size 100x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (608,441) size 20x1
+  LayoutNGBlockFlow {SPAN} at (0,0) size 20x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (25,674) size 20x1 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0
+  LayoutNGBlockFlow {SPAN} at (0,0) size 20x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (45,674) size 100x1 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0
+  LayoutNGBlockFlow {SPAN} at (0,0) size 100x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (165,674) size 20x1 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0
+  LayoutNGBlockFlow {SPAN} at (0,0) size 20x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (185,674) size 20x1 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0
+  LayoutNGBlockFlow {SPAN} at (0,0) size 20x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (205,674) size 100x1 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0
+  LayoutNGBlockFlow {SPAN} at (0,0) size 100x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (305,674) size 20x1 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0
+  LayoutNGBlockFlow {SPAN} at (0,0) size 20x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (325,674) size 20x1 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0
+  LayoutNGBlockFlow {SPAN} at (0,0) size 20x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (345,674) size 20x1 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0
+  LayoutNGBlockFlow {SPAN} at (0,0) size 20x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (365,674) size 100x1 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0
+  LayoutNGBlockFlow {SPAN} at (0,0) size 100x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (465,679) size 20x1 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0
+  LayoutNGBlockFlow {SPAN} at (0,0) size 20x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (485,674) size 20x1 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0
+  LayoutNGBlockFlow {SPAN} at (0,0) size 20x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (505,674) size 20x1 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0
+  LayoutNGBlockFlow {SPAN} at (0,0) size 20x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (525,674) size 100x1 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0
+  LayoutNGBlockFlow {SPAN} at (0,0) size 100x1
+    LayoutInline {SPAN} at (0,0) size 0x0
+layer at (625,674) size 20x1 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0
+  LayoutNGBlockFlow {SPAN} at (0,0) size 20x1
+    LayoutInline {SPAN} at (0,0) size 0x0
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/margin_left-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/margin_left-expected.png
index f23df24..1df8e0f 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/margin_left-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/margin_left-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/margin_left-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/margin_left-expected.txt
index 16d09bb..6e782ffa 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/margin_left-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/margin_left-expected.txt
@@ -41,14 +41,14 @@
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
             LayoutText (anonymous) at (0,0) size 10x19
               text run at (0,0) width 10: "\x{2022} "
-          LayoutText {#text} at (0,0) size 684x19
-            text run at (0,0) width 684: "The left margin on this unordered list has been set to 25 pixels, and its background color has been set to gray."
+          LayoutText {#text} at (0,0) size 685x19
+            text run at (0,0) width 685: "The left margin on this unordered list has been set to 25 pixels, and its background color has been set to gray."
         LayoutNGListItem {LI} at (65,20) size 679x60 [bgcolor=#FFFFFF]
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
             LayoutText (anonymous) at (0,0) size 10x19
               text run at (0,0) width 10: "\x{2022} "
           LayoutText {#text} at (0,0) size 668x59
-            text run at (0,0) width 656: "Another list item might not be such a bad idea, either, considering that such things do need to be double-"
+            text run at (0,0) width 655: "Another list item might not be such a bad idea, either, considering that such things do need to be double-"
             text run at (0,20) width 668: "checked. This list item has its left margin also set to 25 pixels, which should combine with the list's margin"
             text run at (0,40) width 479: "to make 50 pixels of margin, and its background color has been set to white."
         LayoutNGListItem {LI} at (40,80) size 704x20
@@ -61,17 +61,17 @@
         LayoutText {#text} at (0,0) size 203x19
           text run at (0,0) width 203: "This element has a class of zero."
       LayoutNGBlockFlow {P} at (-10,515) size 779x60 [bgcolor=#00FFFF]
-        LayoutText {#text} at (0,0) size 778x59
+        LayoutText {#text} at (0,0) size 777x59
           text run at (0,0) width 758: "This paragraph has a left margin of -10px, which should cause it to be wider than it might otherwise be, and it has a light"
-          text run at (0,20) width 778: "blue background. In all other respects, however, the element should be normal. No styles have been applied to it besides the"
-          text run at (0,40) width 294: "negative left margin and the background color."
+          text run at (0,20) width 777: "blue background. In all other respects, however, the element should be normal. No styles have been applied to it besides the"
+          text run at (0,40) width 293: "negative left margin and the background color."
       LayoutTable {TABLE} at (0,591) size 769x470 [border: (1px outset #808080)]
         LayoutTableSection {TBODY} at (1,1) size 767x468
           LayoutTableRow {TR} at (0,0) size 767x28
             LayoutNGTableCell {TD} at (0,0) size 767x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutInline {STRONG} at (0,0) size 159x19
-                LayoutText {#text} at (4,4) size 159x19
-                  text run at (4,4) width 159: "TABLE Testing Section"
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,4) size 161x19
+                  text run at (4,4) width 161: "TABLE Testing Section"
           LayoutTableRow {TR} at (0,28) size 767x440
             LayoutNGTableCell {TD} at (0,234) size 12x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (4,210) size 4x19
@@ -100,13 +100,13 @@
                       text run at (0,0) width 10: "\x{2022} "
                   LayoutText {#text} at (0,0) size 650x39
                     text run at (0,0) width 650: "The left margin on this unordered list has been set to 25 pixels, and its background color has been set to"
-                    text run at (0,20) width 30: "gray."
+                    text run at (0,20) width 31: "gray."
                 LayoutNGListItem {LI} at (65,40) size 657x60 [bgcolor=#FFFFFF]
                   LayoutNGListMarker (anonymous) at (-18,0) size 10x20
                     LayoutText (anonymous) at (0,0) size 10x19
                       text run at (0,0) width 10: "\x{2022} "
-                  LayoutText {#text} at (0,0) size 656x59
-                    text run at (0,0) width 656: "Another list item might not be such a bad idea, either, considering that such things do need to be double-"
+                  LayoutText {#text} at (0,0) size 655x59
+                    text run at (0,0) width 655: "Another list item might not be such a bad idea, either, considering that such things do need to be double-"
                     text run at (0,20) width 620: "checked. This list item has its left margin also set to 25 pixels, which should combine with the list's"
                     text run at (0,40) width 527: "margin to make 50 pixels of margin, and its background color has been set to white."
                 LayoutNGListItem {LI} at (40,100) size 682x20
@@ -119,9 +119,9 @@
                 LayoutText {#text} at (0,0) size 203x19
                   text run at (0,0) width 203: "This element has a class of zero."
               LayoutNGBlockFlow {P} at (-6,376) size 757x60 [bgcolor=#00FFFF]
-                LayoutText {#text} at (0,0) size 737x59
+                LayoutText {#text} at (0,0) size 736x59
                   text run at (0,0) width 726: "This paragraph has a left margin of -10px, which should cause it to be wider than it might otherwise be, and it has a"
-                  text run at (0,20) width 737: "light blue background. In all other respects, however, the element should be normal. No styles have been applied to it"
-                  text run at (0,40) width 367: "besides the negative left margin and the background color."
+                  text run at (0,20) width 736: "light blue background. In all other respects, however, the element should be normal. No styles have been applied to it"
+                  text run at (0,40) width 366: "besides the negative left margin and the background color."
 layer at (8,153) size 769x2 clip at (0,0) size 0x0
   LayoutNGBlockFlow {HR} at (0,145) size 769x2 [border: (1px inset #EEEEEE)]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/margin_right-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/margin_right-expected.png
index 4b141e9..e7525a4 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/margin_right-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/margin_right-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/margin_right-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/margin_right-expected.txt
index 03be348..d5135027 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/margin_right-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/margin_right-expected.txt
@@ -41,14 +41,14 @@
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
             LayoutText (anonymous) at (0,0) size 10x19
               text run at (0,0) width 10: "\x{2022} "
-          LayoutText {#text} at (21,0) size 698x19
-            text run at (21,0) width 698: "The right margin on this unordered list has been set to 25 pixels, and the background color has been set to gray."
+          LayoutText {#text} at (20,0) size 699x19
+            text run at (20,0) width 699: "The right margin on this unordered list has been set to 25 pixels, and the background color has been set to gray."
         LayoutNGListItem {LI} at (40,20) size 694x60 [bgcolor=#FFFFFF]
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
             LayoutText (anonymous) at (0,0) size 10x19
               text run at (0,0) width 10: "\x{2022} "
-          LayoutText {#text} at (38,0) size 693x59
-            text run at (38,0) width 656: "Another list item might not be such a bad idea, either, considering that such things do need to be double-"
+          LayoutText {#text} at (39,0) size 693x59
+            text run at (39,0) width 655: "Another list item might not be such a bad idea, either, considering that such things do need to be double-"
             text run at (1,20) width 693: "checked. This list item has its right margin also set to 25 pixels, which should combine with the list's margin to"
             text run at (230,40) width 464: "make 50 pixels of margin, and its background-color has been set to white."
         LayoutNGListItem {LI} at (40,80) size 719x20
@@ -61,17 +61,17 @@
         LayoutText {#text} at (581,0) size 203x19
           text run at (581,0) width 203: "This element has a class of zero."
       LayoutNGBlockFlow {P} at (0,515) size 794x60 [bgcolor=#00FFFF]
-        LayoutText {#text} at (0,0) size 778x59
+        LayoutText {#text} at (0,0) size 777x59
           text run at (0,0) width 767: "This paragraph has a right margin of -10px, which should cause it to be wider than it might otherwise be, and it has a light"
-          text run at (0,20) width 778: "blue background. In all other respects, however, the element should be normal. No styles have been applied to it besides the"
-          text run at (0,40) width 303: "negative right margin and the background color."
+          text run at (0,20) width 777: "blue background. In all other respects, however, the element should be normal. No styles have been applied to it besides the"
+          text run at (0,40) width 302: "negative right margin and the background color."
       LayoutTable {TABLE} at (0,591) size 784x470 [border: (1px outset #808080)]
         LayoutTableSection {TBODY} at (1,1) size 782x468
           LayoutTableRow {TR} at (0,0) size 782x28
             LayoutNGTableCell {TD} at (0,0) size 782x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutInline {STRONG} at (0,0) size 159x19
-                LayoutText {#text} at (4,4) size 159x19
-                  text run at (4,4) width 159: "TABLE Testing Section"
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,4) size 161x19
+                  text run at (4,4) width 161: "TABLE Testing Section"
           LayoutTableRow {TR} at (0,28) size 782x440
             LayoutNGTableCell {TD} at (0,234) size 12x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (4,210) size 4x19
@@ -100,13 +100,13 @@
                       text run at (0,0) width 10: "\x{2022} "
                   LayoutText {#text} at (33,0) size 664x39
                     text run at (33,0) width 664: "The right margin on this unordered list has been set to 25 pixels, and the background color has been set to"
-                    text run at (667,20) width 30: "gray."
+                    text run at (666,20) width 31: "gray."
                 LayoutNGListItem {LI} at (40,40) size 672x60 [bgcolor=#FFFFFF]
                   LayoutNGListMarker (anonymous) at (-18,0) size 10x20
                     LayoutText (anonymous) at (0,0) size 10x19
                       text run at (0,0) width 10: "\x{2022} "
-                  LayoutText {#text} at (16,0) size 656x59
-                    text run at (16,0) width 656: "Another list item might not be such a bad idea, either, considering that such things do need to be double-"
+                  LayoutText {#text} at (17,0) size 655x59
+                    text run at (17,0) width 655: "Another list item might not be such a bad idea, either, considering that such things do need to be double-"
                     text run at (43,20) width 629: "checked. This list item has its right margin also set to 25 pixels, which should combine with the list's"
                     text run at (144,40) width 528: "margin to make 50 pixels of margin, and its background-color has been set to white."
                 LayoutNGListItem {LI} at (40,100) size 697x20
@@ -121,7 +121,7 @@
               LayoutNGBlockFlow {P} at (4,376) size 772x60 [bgcolor=#00FFFF]
                 LayoutText {#text} at (0,0) size 767x59
                   text run at (0,0) width 767: "This paragraph has a right margin of -10px, which should cause it to be wider than it might otherwise be, and it has a light"
-                  text run at (0,20) width 755: "blue background. In all other respects, however, the element should be normal. No styles have been applied to it besides"
-                  text run at (0,40) width 326: "the negative right margin and the background color."
+                  text run at (0,20) width 754: "blue background. In all other respects, however, the element should be normal. No styles have been applied to it besides"
+                  text run at (0,40) width 325: "the negative right margin and the background color."
 layer at (8,153) size 784x2 clip at (0,0) size 0x0
   LayoutNGBlockFlow {HR} at (0,145) size 784x2 [border: (1px inset #EEEEEE)]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/padding_left-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/padding_left-expected.png
index 43b5edba..3f025e7 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/padding_left-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/padding_left-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/padding_left-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/padding_left-expected.txt
index 1bc4337..96cd45bf 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/padding_left-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/padding_left-expected.txt
@@ -51,8 +51,8 @@
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
             LayoutText (anonymous) at (0,0) size 10x19
               text run at (0,0) width 10: "\x{2022} "
-          LayoutText {#text} at (25,0) size 712x59
-            text run at (25,0) width 712: "Another list item might not be such a bad idea, either, considering that such things do need to be double-checked."
+          LayoutText {#text} at (25,0) size 711x59
+            text run at (25,0) width 711: "Another list item might not be such a bad idea, either, considering that such things do need to be double-checked."
             text run at (25,20) width 696: "This list item has its left padding also set to 25 pixels, which should combine with the list's padding to make 50"
             text run at (25,40) width 106: "pixels of margin."
       LayoutNGBlockFlow {P} at (0,539) size 769x40 [bgcolor=#00FFFF]
@@ -63,9 +63,9 @@
         LayoutTableSection {TBODY} at (1,1) size 767x452
           LayoutTableRow {TR} at (0,0) size 767x28
             LayoutNGTableCell {TD} at (0,0) size 767x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutInline {STRONG} at (0,0) size 159x19
-                LayoutText {#text} at (4,4) size 159x19
-                  text run at (4,4) width 159: "TABLE Testing Section"
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,4) size 161x19
+                  text run at (4,4) width 161: "TABLE Testing Section"
           LayoutTableRow {TR} at (0,28) size 767x424
             LayoutNGTableCell {TD} at (0,226) size 12x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (4,202) size 4x19
@@ -103,7 +103,7 @@
                     LayoutText (anonymous) at (0,0) size 10x19
                       text run at (0,0) width 10: "\x{2022} "
                   LayoutText {#text} at (25,0) size 682x59
-                    text run at (25,0) width 656: "Another list item might not be such a bad idea, either, considering that such things do need to be double-"
+                    text run at (25,0) width 655: "Another list item might not be such a bad idea, either, considering that such things do need to be double-"
                     text run at (25,20) width 682: "checked. This list item has its left padding also set to 25 pixels, which should combine with the list's padding"
                     text run at (25,40) width 180: "to make 50 pixels of margin."
               LayoutNGBlockFlow {P} at (4,380) size 747x40 [bgcolor=#00FFFF]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/padding_right-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/padding_right-expected.png
index 2c5cc2de..aed98ee 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/padding_right-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/padding_right-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/padding_right-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/padding_right-expected.txt
index 264bada..373c2b6e 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/padding_right-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/box_properties/padding_right-expected.txt
@@ -67,9 +67,9 @@
         LayoutTableSection {TBODY} at (1,1) size 767x552
           LayoutTableRow {TR} at (0,0) size 767x28
             LayoutNGTableCell {TD} at (0,0) size 767x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutInline {STRONG} at (0,0) size 159x19
-                LayoutText {#text} at (4,4) size 159x19
-                  text run at (4,4) width 159: "TABLE Testing Section"
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,4) size 161x19
+                  text run at (4,4) width 161: "TABLE Testing Section"
           LayoutTableRow {TR} at (0,28) size 767x524
             LayoutNGTableCell {TD} at (0,276) size 12x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (4,252) size 4x19
@@ -113,7 +113,7 @@
                       text run at (0,0) width 10: "\x{2022} "
                   LayoutText {#text} at (23,0) size 634x39
                     text run at (23,0) width 634: "This list item has a right padding of 25 pixels, which will appear to the left of the gray padding of the"
-                    text run at (578,20) width 79: "UL element."
+                    text run at (579,20) width 78: "UL element."
               LayoutNGBlockFlow {P} at (4,460) size 747x60 [bgcolor=#00FFFF]
                 LayoutText {#text} at (69,0) size 733x59
                   text run at (69,0) width 678: "This element should have no right padding, since negative padding values are not allowed. Both the content"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/cascade/cascade_order-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/cascade/cascade_order-expected.png
index e3ec0d5..2fa896f 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/cascade/cascade_order-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/cascade/cascade_order-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/cascade/cascade_order-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/cascade/cascade_order-expected.txt
index 973fea3..4adb251 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/cascade/cascade_order-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/cascade/cascade_order-expected.txt
@@ -48,8 +48,8 @@
               LayoutNGListMarker (anonymous) at (-18,0) size 10x20
                 LayoutText (anonymous) at (0,0) size 10x19
                   text run at (0,0) width 10: "\x{25E6} "
-              LayoutText {#text} at (0,0) size 188x19
-                text run at (0,0) width 188: "This list item should be gray..."
+              LayoutText {#text} at (0,0) size 189x19
+                text run at (0,0) width 189: "This list item should be gray..."
             LayoutNGListItem {LI} at (40,20) size 689x20 [color=#808080]
               LayoutNGListMarker (anonymous) at (-18,0) size 10x20
                 LayoutText (anonymous) at (0,0) size 10x19
@@ -81,8 +81,8 @@
           LayoutText {#text} at (0,0) size 96x19
             text run at (0,0) width 96: "...and this blue."
       LayoutNGBlockFlow {P} at (0,419) size 769x20 [color=#0000FF]
-        LayoutText {#text} at (0,0) size 279x19
-          text run at (0,0) width 279: "This sentence should be blue (STYLE attr.)."
+        LayoutText {#text} at (0,0) size 278x19
+          text run at (0,0) width 278: "This sentence should be blue (STYLE attr.)."
       LayoutNGBlockFlow {P} at (0,455) size 769x20 [color=#800080]
         LayoutText {#text} at (0,0) size 204x19
           text run at (0,0) width 204: "This sentence should be purple ["
@@ -98,9 +98,9 @@
         LayoutTableSection {TBODY} at (1,1) size 703x304
           LayoutTableRow {TR} at (0,0) size 703x28
             LayoutNGTableCell {TD} at (0,0) size 703x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutInline {STRONG} at (0,0) size 159x19
-                LayoutText {#text} at (4,4) size 159x19
-                  text run at (4,4) width 159: "TABLE Testing Section"
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,4) size 161x19
+                  text run at (4,4) width 161: "TABLE Testing Section"
           LayoutTableRow {TR} at (0,28) size 703x276
             LayoutNGTableCell {TD} at (0,152) size 12x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (4,128) size 4x19
@@ -125,8 +125,8 @@
                       LayoutNGListMarker (anonymous) at (-18,0) size 10x20
                         LayoutText (anonymous) at (0,0) size 10x19
                           text run at (0,0) width 10: "\x{25E6} "
-                      LayoutText {#text} at (0,0) size 188x19
-                        text run at (0,0) width 188: "This list item should be gray..."
+                      LayoutText {#text} at (0,0) size 189x19
+                        text run at (0,0) width 189: "This list item should be gray..."
                     LayoutNGListItem {LI} at (40,20) size 603x20 [color=#808080]
                       LayoutNGListMarker (anonymous) at (-18,0) size 10x20
                         LayoutText (anonymous) at (0,0) size 10x19
@@ -158,8 +158,8 @@
                   LayoutText {#text} at (0,0) size 96x19
                     text run at (0,0) width 96: "...and this blue."
               LayoutNGBlockFlow {P} at (4,180) size 683x20 [color=#0000FF]
-                LayoutText {#text} at (0,0) size 279x19
-                  text run at (0,0) width 279: "This sentence should be blue (STYLE attr.)."
+                LayoutText {#text} at (0,0) size 278x19
+                  text run at (0,0) width 278: "This sentence should be blue (STYLE attr.)."
               LayoutNGBlockFlow {P} at (4,216) size 683x20 [color=#800080]
                 LayoutText {#text} at (0,0) size 204x19
                   text run at (0,0) width 204: "This sentence should be purple ["
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/display-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/display-expected.png
index 3a28484..93b2bb0 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/display-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/display-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/display-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/display-expected.txt
index deb64ad..ee068a3 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/display-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/display-expected.txt
@@ -25,10 +25,10 @@
         LayoutInline {P} at (0,0) size 448x19
           LayoutText {#text} at (0,0) size 448x19
             text run at (0,0) width 448: "This sentence should be part of an inline element, as are the next three. "
-        LayoutInline {P} at (0,0) size 766x59
-          LayoutText {#text} at (448,0) size 766x59
+        LayoutInline {P} at (0,0) size 765x59
+          LayoutText {#text} at (448,0) size 765x59
             text run at (448,0) width 274: "This sentence and the next two are part of a"
-            text run at (0,20) width 766: "second inline element. They should therefore appear, along with the sentence above, to be all one paragraph which is four"
+            text run at (0,20) width 765: "second inline element. They should therefore appear, along with the sentence above, to be all one paragraph which is four"
             text run at (0,40) width 350: "sentences long. If this is not the case, then the keyword "
           LayoutInline {CODE} at (0,0) size 48x16
             LayoutText {#text} at (350,43) size 48x16
@@ -46,9 +46,9 @@
         LayoutInline {CODE} at (0,0) size 120x16
           LayoutText {#text} at (18,23) size 120x16
             text run at (18,23) width 120: "list-style-type"
-        LayoutText {#text} at (138,20) size 720x39
-          text run at (138,20) width 582: " is supported, there will be a square for the item marker). A 3em left margin has been applied"
-          text run at (0,40) width 376: "in order to ensure that there is space for the list-item marker."
+        LayoutText {#text} at (138,20) size 719x39
+          text run at (138,20) width 581: " is supported, there will be a square for the item marker). A 3em left margin has been applied"
+          text run at (0,40) width 375: "in order to ensure that there is space for the list-item marker."
       LayoutNGBlockFlow {P} at (0,335) size 769x20
         LayoutText {#text} at (0,0) size 456x19
           text run at (0,0) width 456: "The next paragraph should be invisible (if it's visible, you'll see red text)."
@@ -69,9 +69,9 @@
         LayoutTableSection {TBODY} at (1,1) size 767x356
           LayoutTableRow {TR} at (0,0) size 767x28
             LayoutNGTableCell {TD} at (0,0) size 767x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutInline {STRONG} at (0,0) size 159x19
-                LayoutText {#text} at (4,4) size 159x19
-                  text run at (4,4) width 159: "TABLE Testing Section"
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,4) size 161x19
+                  text run at (4,4) width 161: "TABLE Testing Section"
           LayoutTableRow {TR} at (0,28) size 767x328
             LayoutNGTableCell {TD} at (0,178) size 12x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (4,154) size 4x19
@@ -84,10 +84,10 @@
                 LayoutInline {P} at (0,0) size 448x19
                   LayoutText {#text} at (0,0) size 448x19
                     text run at (0,0) width 448: "This sentence should be part of an inline element, as are the next three. "
-                LayoutInline {P} at (0,0) size 736x59
-                  LayoutText {#text} at (448,0) size 736x59
+                LayoutInline {P} at (0,0) size 735x59
+                  LayoutText {#text} at (448,0) size 735x59
                     text run at (448,0) width 274: "This sentence and the next two are part of a"
-                    text run at (0,20) width 736: "second inline element. They should therefore appear, along with the sentence above, to be all one paragraph which is"
+                    text run at (0,20) width 735: "second inline element. They should therefore appear, along with the sentence above, to be all one paragraph which is"
                     text run at (0,40) width 380: "four sentences long. If this is not the case, then the keyword "
                   LayoutInline {CODE} at (0,0) size 48x16
                     LayoutText {#text} at (380,43) size 48x16
@@ -105,9 +105,9 @@
                 LayoutInline {CODE} at (0,0) size 120x16
                   LayoutText {#text} at (55,23) size 120x16
                     text run at (55,23) width 120: "list-style-type"
-                LayoutText {#text} at (175,20) size 673x39
-                  text run at (175,20) width 498: " is supported, there will be a square for the item marker). A 3em left margin has"
-                  text run at (0,40) width 460: "been applied in order to ensure that there is space for the list-item marker."
+                LayoutText {#text} at (175,20) size 672x39
+                  text run at (175,20) width 497: " is supported, there will be a square for the item marker). A 3em left margin has"
+                  text run at (0,40) width 459: "been applied in order to ensure that there is space for the list-item marker."
               LayoutNGBlockFlow {P} at (4,192) size 747x20
                 LayoutText {#text} at (0,0) size 456x19
                   text run at (0,0) width 456: "The next paragraph should be invisible (if it's visible, you'll see red text)."
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/list_style-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/list_style-expected.png
new file mode 100644
index 0000000..2058658c
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/list_style-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/list_style-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/list_style-expected.txt
new file mode 100644
index 0000000..414c6a9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/list_style-expected.txt
@@ -0,0 +1,58 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x600
+    LayoutNGBlockFlow {BODY} at (8,8) size 784x584 [bgcolor=#CCCCCC]
+      LayoutNGBlockFlow {P} at (0,0) size 784x20
+        LayoutText {#text} at (0,0) size 355x19
+          text run at (0,0) width 355: "The style declarations which apply to the text below are:"
+      LayoutNGBlockFlow {PRE} at (0,36) size 784x32
+        LayoutText {#text} at (0,0) size 496x32
+          text run at (0,0) width 304: ".one {list-style: upper-alpha inside;}"
+          text run at (304,0) width 0: " "
+          text run at (0,16) width 496: ".two {list-style: url(../resources/oransqr.gif) disc outside;}"
+          text run at (496,16) width 0: " "
+      LayoutNGBlockFlow {UL} at (0,99) size 784x40
+        LayoutNGListItem {LI} at (40,0) size 744x40
+          LayoutInline (anonymous) at (0,0) size 20x19
+            LayoutText (anonymous) at (0,0) size 20x19
+              text run at (0,0) width 20: "A. "
+          LayoutText {#text} at (20,0) size 730x39
+            text run at (20,0) width 710: "The text in this item should not behave as expected; that is, it should line up with the capital-A on the left margin,"
+            text run at (0,20) width 286: "leaving no blank space beneath the capital-A."
+      LayoutNGBlockFlow {UL} at (0,155) size 784x40
+        LayoutNGListItem {LI} at (40,0) size 744x40
+          LayoutNGListMarker (anonymous) at (-22,0) size 15x15
+            LayoutImage (anonymous) at (0,0) size 15x15
+          LayoutText {#text} at (0,0) size 735x39
+            text run at (0,0) width 735: "The text in this item have an orange square for its bullet; failing that, a disc. Also, the bullet should be outside the text"
+            text run at (0,20) width 256: "block, as the list has been set to 'outside'."
+      LayoutTable {TABLE} at (0,211) size 784x150 [border: (1px outset #808080)]
+        LayoutTableSection {TBODY} at (1,1) size 782x148
+          LayoutTableRow {TR} at (0,0) size 782x28
+            LayoutNGTableCell {TD} at (0,0) size 782x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,4) size 161x19
+                  text run at (4,4) width 161: "TABLE Testing Section"
+          LayoutTableRow {TR} at (0,28) size 782x120
+            LayoutNGTableCell {TD} at (0,74) size 12x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
+              LayoutText {#text} at (4,50) size 4x19
+                text run at (4,50) width 4: " "
+            LayoutNGTableCell {TD} at (12,28) size 770x120 [border: (1px inset #808080)] [r=1 c=1 rs=1 cs=1]
+              LayoutNGBlockFlow {UL} at (4,4) size 762x40
+                LayoutNGListItem {LI} at (40,0) size 722x40
+                  LayoutInline (anonymous) at (0,0) size 20x19
+                    LayoutText (anonymous) at (0,0) size 20x19
+                      text run at (0,0) width 20: "A. "
+                  LayoutText {#text} at (20,0) size 678x39
+                    text run at (20,0) width 658: "The text in this item should not behave as expected; that is, it should line up with the capital-A on the left"
+                    text run at (0,20) width 338: "margin, leaving no blank space beneath the capital-A."
+              LayoutNGBlockFlow {UL} at (4,60) size 762x40
+                LayoutNGListItem {LI} at (40,0) size 722x40
+                  LayoutNGListMarker (anonymous) at (-22,0) size 15x15
+                    LayoutImage (anonymous) at (0,0) size 15x15
+                  LayoutText {#text} at (0,0) size 708x39
+                    text run at (0,0) width 708: "The text in this item have an orange square for its bullet; failing that, a disc. Also, the bullet should be outside the"
+                    text run at (0,20) width 283: "text block, as the list has been set to 'outside'."
+layer at (8,89) size 784x2 clip at (0,0) size 0x0
+  LayoutNGBlockFlow {HR} at (0,81) size 784x2 [border: (1px inset #EEEEEE)]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/list_style_position-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/list_style_position-expected.png
index 10487b6b..5a4210f0 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/list_style_position-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/list_style_position-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/list_style_position-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/list_style_position-expected.txt
index 52948f9..7752a734 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/list_style_position-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/list_style_position-expected.txt
@@ -33,9 +33,9 @@
         LayoutTableSection {TBODY} at (1,1) size 782x148
           LayoutTableRow {TR} at (0,0) size 782x28
             LayoutNGTableCell {TD} at (0,0) size 782x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutInline {STRONG} at (0,0) size 159x19
-                LayoutText {#text} at (4,4) size 159x19
-                  text run at (4,4) width 159: "TABLE Testing Section"
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,4) size 161x19
+                  text run at (4,4) width 161: "TABLE Testing Section"
           LayoutTableRow {TR} at (0,28) size 782x120
             LayoutNGTableCell {TD} at (0,74) size 12x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (4,50) size 4x19
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/list_style_type-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/list_style_type-expected.png
index 5a5a3558..96c75fa 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/list_style_type-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/list_style_type-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/list_style_type-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/list_style_type-expected.txt
index fb9467d..b593f4b 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/list_style_type-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/classification/list_style_type-expected.txt
@@ -193,9 +193,9 @@
         LayoutTableSection {TBODY} at (1,1) size 336x720
           LayoutTableRow {TR} at (0,0) size 336x28
             LayoutNGTableCell {TD} at (0,0) size 336x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutInline {STRONG} at (0,0) size 159x19
-                LayoutText {#text} at (4,4) size 159x19
-                  text run at (4,4) width 159: "TABLE Testing Section"
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,4) size 161x19
+                  text run at (4,4) width 161: "TABLE Testing Section"
           LayoutTableRow {TR} at (0,28) size 336x692
             LayoutNGTableCell {TD} at (0,360) size 12x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (4,336) size 4x19
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/color_and_background/background_attachment-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/color_and_background/background_attachment-expected.png
index b4bb998..2a6ad93 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/color_and_background/background_attachment-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/color_and_background/background_attachment-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/color_and_background/background_attachment-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/color_and_background/background_attachment-expected.txt
index ca7ac321..a1ac7b3 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/color_and_background/background_attachment-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/color_and_background/background_attachment-expected.txt
@@ -17,10 +17,10 @@
           text run at (0,20) width 776: "NOT scroll with the document. It should, instead, appear to be a fixed pattern past which the content scrolls, even when the"
           text run at (0,40) width 779: "end of the page is reached. In addition, the default Test Suite background should NOT appear, as it's been overridden by the"
           text run at (0,60) width 775: "styles shown above. I'll have to add a lot of extra text to the page in order to make all this something we can actually check."
-          text run at (0,80) width 225: "Don't worry, I'll think of something."
+          text run at (0,80) width 226: "Don't worry, I'll think of something."
       LayoutNGBlockFlow {P} at (0,215) size 784x20
-        LayoutText {#text} at (0,0) size 507x19
-          text run at (0,0) width 507: "In fact, why not the relevant section from the CSS1 specification? A capital idea."
+        LayoutText {#text} at (0,0) size 506x19
+          text run at (0,0) width 506: "In fact, why not the relevant section from the CSS1 specification? A capital idea."
       LayoutNGBlockFlow {H4} at (0,284.27) size 784x20
         LayoutInline {A} at (0,0) size 220x19
           LayoutText {#text} at (0,0) size 220x19
@@ -51,12 +51,12 @@
         LayoutText {#text} at (62,60) size 20x19
           text run at (62,60) width 20: " no"
         LayoutBR {BR} at (82,60) size 0x0
-        LayoutInline {EM} at (0,0) size 121x19
-          LayoutText {#text} at (0,80) size 121x19
-            text run at (0,80) width 121: "Percentage values:"
-        LayoutText {#text} at (121,80) size 32x19
-          text run at (121,80) width 32: " N/A"
-        LayoutBR {BR} at (153,80) size 0x0
+        LayoutInline {EM} at (0,0) size 120x19
+          LayoutText {#text} at (0,80) size 120x19
+            text run at (0,80) width 120: "Percentage values:"
+        LayoutText {#text} at (120,80) size 32x19
+          text run at (120,80) width 32: " N/A"
+        LayoutBR {BR} at (152,80) size 0x0
       LayoutNGBlockFlow {P} at (0,441.53) size 784x40
         LayoutText {#text} at (0,0) size 782x39
           text run at (0,0) width 782: "If a background image is specified, the value of 'background-attachment' determines if it is fixed with regard to the canvas or"
@@ -74,20 +74,20 @@
           text run at (0,64) width 24: "  }"
           text run at (24,64) width 0: " "
       LayoutNGBlockFlow {P} at (0,593.53) size 784x60
-        LayoutInline {EM} at (0,0) size 72x19
-          LayoutText {#text} at (0,0) size 72x19
-            text run at (0,0) width 72: "CSS1 core:"
-        LayoutText {#text} at (72,0) size 767x59
-          text run at (72,0) width 669: " UAs may treat 'fixed' as 'scroll'. However, it is recommended they interpret 'fixed' correctly, at least on the"
-          text run at (0,20) width 767: "HTML and BODY elements, since there is no way for an author to provide an image only for those browsers that support"
+        LayoutInline {EM} at (0,0) size 71x19
+          LayoutText {#text} at (0,0) size 71x19
+            text run at (0,0) width 71: "CSS1 core:"
+        LayoutText {#text} at (71,0) size 765x59
+          text run at (71,0) width 669: " UAs may treat 'fixed' as 'scroll'. However, it is recommended they interpret 'fixed' correctly, at least on the"
+          text run at (0,20) width 765: "HTML and BODY elements, since there is no way for an author to provide an image only for those browsers that support"
           text run at (0,40) width 42: "'fixed'."
       LayoutTable {TABLE} at (0,669.53) size 784x593 [border: (1px outset #808080)]
         LayoutTableSection {TBODY} at (1,1) size 782x591
           LayoutTableRow {TR} at (0,0) size 782x28
             LayoutNGTableCell {TD} at (0,0) size 782x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutInline {STRONG} at (0,0) size 159x19
-                LayoutText {#text} at (4,4) size 159x19
-                  text run at (4,4) width 159: "TABLE Testing Section"
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,4) size 161x19
+                  text run at (4,4) width 161: "TABLE Testing Section"
           LayoutTableRow {TR} at (0,28) size 782x563
             LayoutNGTableCell {TD} at (0,295) size 12x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (4,271) size 4x19
@@ -99,10 +99,10 @@
                   text run at (0,20) width 747: "does NOT scroll with the document. It should, instead, appear to be a fixed pattern past which the content scrolls, even"
                   text run at (0,40) width 726: "when the end of the page is reached. In addition, the default Test Suite background should NOT appear, as it's been"
                   text run at (0,60) width 743: "overridden by the styles shown above. I'll have to add a lot of extra text to the page in order to make all this something"
-                  text run at (0,80) width 372: "we can actually check. Don't worry, I'll think of something."
+                  text run at (0,80) width 373: "we can actually check. Don't worry, I'll think of something."
               LayoutNGBlockFlow {P} at (4,120) size 762x20
-                LayoutText {#text} at (0,0) size 507x19
-                  text run at (0,0) width 507: "In fact, why not the relevant section from the CSS1 specification? A capital idea."
+                LayoutText {#text} at (0,0) size 506x19
+                  text run at (0,0) width 506: "In fact, why not the relevant section from the CSS1 specification? A capital idea."
               LayoutNGBlockFlow {H4} at (4,189.27) size 762x20
                 LayoutInline {A} at (0,0) size 220x19
                   LayoutText {#text} at (0,0) size 220x19
@@ -133,12 +133,12 @@
                 LayoutText {#text} at (62,60) size 20x19
                   text run at (62,60) width 20: " no"
                 LayoutBR {BR} at (82,60) size 0x0
-                LayoutInline {EM} at (0,0) size 121x19
-                  LayoutText {#text} at (0,80) size 121x19
-                    text run at (0,80) width 121: "Percentage values:"
-                LayoutText {#text} at (121,80) size 32x19
-                  text run at (121,80) width 32: " N/A"
-                LayoutBR {BR} at (153,80) size 0x0
+                LayoutInline {EM} at (0,0) size 120x19
+                  LayoutText {#text} at (0,80) size 120x19
+                    text run at (0,80) width 120: "Percentage values:"
+                LayoutText {#text} at (120,80) size 32x19
+                  text run at (120,80) width 32: " N/A"
+                LayoutBR {BR} at (152,80) size 0x0
               LayoutNGBlockFlow {P} at (4,346.53) size 762x40
                 LayoutText {#text} at (0,0) size 718x39
                   text run at (0,0) width 718: "If a background image is specified, the value of 'background-attachment' determines if it is fixed with regard to the"
@@ -156,12 +156,12 @@
                   text run at (0,64) width 24: "  }"
                   text run at (24,64) width 0: " "
               LayoutNGBlockFlow {P} at (4,498.53) size 762x60
-                LayoutInline {EM} at (0,0) size 72x19
-                  LayoutText {#text} at (0,0) size 72x19
-                    text run at (0,0) width 72: "CSS1 core:"
-                LayoutText {#text} at (72,0) size 741x59
-                  text run at (72,0) width 669: " UAs may treat 'fixed' as 'scroll'. However, it is recommended they interpret 'fixed' correctly, at least on the"
-                  text run at (0,20) width 716: "HTML and BODY elements, since there is no way for an author to provide an image only for those browsers that"
+                LayoutInline {EM} at (0,0) size 71x19
+                  LayoutText {#text} at (0,0) size 71x19
+                    text run at (0,0) width 71: "CSS1 core:"
+                LayoutText {#text} at (71,0) size 740x59
+                  text run at (71,0) width 669: " UAs may treat 'fixed' as 'scroll'. However, it is recommended they interpret 'fixed' correctly, at least on the"
+                  text run at (0,20) width 714: "HTML and BODY elements, since there is no way for an author to provide an image only for those browsers that"
                   text run at (0,40) width 93: "support 'fixed'."
 layer at (8,89) size 784x2 clip at (0,0) size 0x0
   LayoutNGBlockFlow {HR} at (0,81) size 784x2 [border: (1px inset #EEEEEE)]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/formatting_model/canvas-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/formatting_model/canvas-expected.png
new file mode 100644
index 0000000..2da2548
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/formatting_model/canvas-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/formatting_model/canvas-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/formatting_model/canvas-expected.txt
index 2f357012..7925cf10 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/formatting_model/canvas-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/formatting_model/canvas-expected.txt
@@ -13,26 +13,26 @@
           text run at (0,16) width 552: "BODY {background-color: green; background-image: none; margin: 25px;}"
           text run at (552,16) width 0: " "
       LayoutNGBlockFlow {P} at (0,99) size 750x60
-        LayoutText {#text} at (0,0) size 737x59
+        LayoutText {#text} at (0,0) size 735x59
           text run at (0,0) width 695: "The body of this document should have a green background. It also has a margin of 25 pixels, so the light blue"
-          text run at (0,20) width 737: "background set for the HTML element should surround the BODY. If the BODY content is significantly shorter than"
+          text run at (0,20) width 735: "background set for the HTML element should surround the BODY. If the BODY content is significantly shorter than"
           text run at (0,40) width 519: "the browser's window height, then the bottom border may be larger than 25 pixels."
       LayoutTable {TABLE} at (0,175) size 750x98 [border: (1px outset #808080)]
         LayoutTableSection {TBODY} at (1,1) size 748x96
           LayoutTableRow {TR} at (0,0) size 748x28
             LayoutNGTableCell {TD} at (0,0) size 748x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutInline {STRONG} at (0,0) size 159x19
-                LayoutText {#text} at (4,4) size 159x19
-                  text run at (4,4) width 159: "TABLE Testing Section"
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,4) size 161x19
+                  text run at (4,4) width 161: "TABLE Testing Section"
           LayoutTableRow {TR} at (0,28) size 748x68
             LayoutNGTableCell {TD} at (0,48) size 12x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (4,24) size 4x19
                 text run at (4,24) width 4: " "
             LayoutNGTableCell {TD} at (12,28) size 736x68 [border: (1px inset #808080)] [r=1 c=1 rs=1 cs=1]
               LayoutNGBlockFlow {P} at (4,4) size 728x60
-                LayoutText {#text} at (0,0) size 706x59
+                LayoutText {#text} at (0,0) size 704x59
                   text run at (0,0) width 695: "The body of this document should have a green background. It also has a margin of 25 pixels, so the light blue"
-                  text run at (0,20) width 706: "background set for the HTML element should surround the BODY. If the BODY content is significantly shorter"
+                  text run at (0,20) width 704: "background set for the HTML element should surround the BODY. If the BODY content is significantly shorter"
                   text run at (0,40) width 550: "than the browser's window height, then the bottom border may be larger than 25 pixels."
 layer at (25,106) size 750x2 clip at (0,0) size 0x0
   LayoutNGBlockFlow {HR} at (0,81) size 750x2 [border: (1px inset #EEEEEE)]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/formatting_model/height_of_lines-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/formatting_model/height_of_lines-expected.png
new file mode 100644
index 0000000..df0ed70
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/formatting_model/height_of_lines-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/formatting_model/height_of_lines-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/formatting_model/height_of_lines-expected.txt
index 6aa2677..bbf5e5f3 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/formatting_model/height_of_lines-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/formatting_model/height_of_lines-expected.txt
@@ -44,7 +44,7 @@
       LayoutNGBlockFlow {P} at (0,353) size 769x464
         LayoutText {#text} at (0,2) size 767x238
           text run at (0,2) width 767: "This paragraph should have a font size of 14px and a line height of 20px. This means that the lines of text within it should be separated"
-          text run at (0,22) width 749: "by six pixels, three of which are part of the line-box of each line. Any images within the paragraph should increase the height of the"
+          text run at (0,22) width 748: "by six pixels, three of which are part of the line-box of each line. Any images within the paragraph should increase the height of the"
           text run at (0,224) width 296: "line-box so that they fit within the line box, such as "
         LayoutImage {IMG} at (296,40) size 200x200
         LayoutText {#text} at (496,224) size 28x16
@@ -55,19 +55,19 @@
           text run at (0,426) width 744: "is additional text to make sure that there is enough room left below the image so that this line does not hit the image that is text-top"
           text run at (0,446) width 45: "aligned."
       LayoutNGBlockFlow {P} at (0,831) size 769x484
-        LayoutText {#text} at (0,2) size 767x198
+        LayoutText {#text} at (0,2) size 769x198
           text run at (0,2) width 767: "This paragraph should have a font size of 14px and a line height of 20px. This means that the lines of text within it should be separated"
-          text run at (0,22) width 731: "by six pixels. Any images within the paragraph should increase the height of the line-box so that they fit, including their padding"
-          text run at (0,184) width 396: "(5px), border (10px) and margins (15px) within the line box, such as "
-        LayoutImage {IMG} at (411,55) size 130x130 [border: (10px solid #000000)]
-        LayoutText {#text} at (556,184) size 28x16
-          text run at (556,184) width 28: " and "
-        LayoutImage {IMG} at (599,199) size 130x130 [border: (10px solid #000000)]
-        LayoutText {#text} at (744,184) size 759x257
-          text run at (744,184) width 4: "."
-          text run at (0,346) width 755: "This is additional text to make sure that there is enough room left below the image so that this line does not hit the image that is text-"
-          text run at (0,366) width 754: "top aligned. It is the outer edge of the margin that should be text-bottom and text-top aligned in this paragraph, so for the first image"
-          text run at (0,386) width 759: "the bottom border of the image should begin 15px above the bottom of the text, and for the second image the top border should begin"
+          text run at (0,22) width 769: "by six pixels. Any images within the paragraph should increase the height of the line-box so that they fit, including their padding (5px),"
+          text run at (0,184) width 357: "border (10px) and margins (15px) within the line box, such as "
+        LayoutImage {IMG} at (372,55) size 130x130 [border: (10px solid #000000)]
+        LayoutText {#text} at (517,184) size 28x16
+          text run at (517,184) width 28: " and "
+        LayoutImage {IMG} at (560,199) size 130x130 [border: (10px solid #000000)]
+        LayoutText {#text} at (705,184) size 753x257
+          text run at (705,184) width 46: ". This is"
+          text run at (0,346) width 731: "additional text to make sure that there is enough room left below the image so that this line does not hit the image that is text-top"
+          text run at (0,366) width 753: "aligned. It is the outer edge of the margin that should be text-bottom and text-top aligned in this paragraph, so for the first image the"
+          text run at (0,386) width 738: "bottom border of the image should begin 15px above the bottom of the text, and for the second image the top border should begin"
           text run at (0,424) width 175: "15px below the top of the text "
         LayoutImage {IMG} at (165,394) size 80x80 [border: (10px solid #000000)]
         LayoutText {#text} at (235,424) size 755x58
@@ -77,18 +77,18 @@
         LayoutTableSection {TBODY} at (1,1) size 767x998
           LayoutTableRow {TR} at (0,0) size 767x28
             LayoutNGTableCell {TD} at (0,0) size 767x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutInline {STRONG} at (0,0) size 159x19
-                LayoutText {#text} at (4,4) size 159x19
-                  text run at (4,4) width 159: "TABLE Testing Section"
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,4) size 161x19
+                  text run at (4,4) width 161: "TABLE Testing Section"
           LayoutTableRow {TR} at (0,28) size 767x970
             LayoutNGTableCell {TD} at (0,499) size 12x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (4,475) size 4x19
                 text run at (4,475) width 4: " "
             LayoutNGTableCell {TD} at (12,28) size 755x970 [border: (1px inset #808080)] [r=1 c=1 rs=1 cs=1]
               LayoutNGBlockFlow {P} at (4,4) size 747x464
-                LayoutText {#text} at (0,2) size 729x238
+                LayoutText {#text} at (0,2) size 728x238
                   text run at (0,2) width 711: "This paragraph should have a font size of 14px and a line height of 20px. This means that the lines of text within it should be"
-                  text run at (0,22) width 729: "separated by six pixels, three of which are part of the line-box of each line. Any images within the paragraph should increase the"
+                  text run at (0,22) width 728: "separated by six pixels, three of which are part of the line-box of each line. Any images within the paragraph should increase the"
                   text run at (0,224) width 372: "height of the line-box so that they fit within the line box, such as "
                 LayoutImage {IMG} at (372,40) size 200x200
                 LayoutText {#text} at (572,224) size 24x16
@@ -98,9 +98,9 @@
                   text run at (200,244) width 541: ". This is additional text to make sure that there is enough room left below the image so that this"
                   text run at (0,446) width 285: "line does not hit the image that is text-top aligned."
               LayoutNGBlockFlow {P} at (4,482) size 747x484
-                LayoutText {#text} at (0,2) size 738x198
+                LayoutText {#text} at (0,2) size 737x198
                   text run at (0,2) width 711: "This paragraph should have a font size of 14px and a line height of 20px. This means that the lines of text within it should be"
-                  text run at (0,22) width 738: "separated by six pixels. Any images within the paragraph should increase the height of the line-box so that they fit, including their"
+                  text run at (0,22) width 737: "separated by six pixels. Any images within the paragraph should increase the height of the line-box so that they fit, including their"
                   text run at (0,184) width 445: "padding (5px), border (10px) and margins (15px) within the line box, such as "
                 LayoutImage {IMG} at (460,55) size 130x130 [border: (10px solid #000000)]
                 LayoutText {#text} at (605,184) size 24x16
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/formatting_model/inline_elements-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/formatting_model/inline_elements-expected.png
index 94bd80f..7e6605af 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/formatting_model/inline_elements-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/formatting_model/inline_elements-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/formatting_model/inline_elements-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/formatting_model/inline_elements-expected.txt
index 4c5ffe9..fd78307 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/formatting_model/inline_elements-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/formatting_model/inline_elements-expected.txt
@@ -28,8 +28,8 @@
           LayoutText {#text} at (239,6) size 762x147
             text run at (239,6) width 523: "very long span in it, and the span has a 10px red border separated from the span by"
             text run at (0,38) width 727: "2pt, and a margin of 30pt. The padding and border should be present on all sides of the span (although vertical lines"
-            text run at (0,70) width 747: "should appear only at the beginning and the end of the whole span, not on each line). The padding, border, and margin"
-            text run at (0,102) width 754: "should all be noticeable at the beginning and end of the span. However, the line height should not be changed by any of"
+            text run at (0,70) width 746: "should appear only at the beginning and the end of the whole span, not on each line). The padding, border, and margin"
+            text run at (0,102) width 753: "should all be noticeable at the beginning and end of the span. However, the line height should not be changed by any of"
             text run at (0,134) width 585: "them, so the margin should be unnoticeable and the border should overlap text on other lines."
         LayoutText {#text} at (637,134) size 762x51
           text run at (637,134) width 125: " The line spacing in"
@@ -49,9 +49,9 @@
         LayoutTableSection {TBODY} at (1,1) size 767x308
           LayoutTableRow {TR} at (0,0) size 767x28
             LayoutNGTableCell {TD} at (0,0) size 767x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutInline {STRONG} at (0,0) size 159x19
-                LayoutText {#text} at (4,4) size 159x19
-                  text run at (4,4) width 159: "TABLE Testing Section"
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,4) size 161x19
+                  text run at (4,4) width 161: "TABLE Testing Section"
           LayoutTableRow {TR} at (0,28) size 767x280
             LayoutNGTableCell {TD} at (0,154) size 12x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (4,130) size 4x19
@@ -64,8 +64,8 @@
                   LayoutText {#text} at (239,6) size 747x147
                     text run at (239,6) width 503: "very long span in it, and the span has a 10px red border separated from the span"
                     text run at (0,38) width 747: "by 2pt, and a margin of 30pt. The padding and border should be present on all sides of the span (although vertical lines"
-                    text run at (0,70) width 747: "should appear only at the beginning and the end of the whole span, not on each line). The padding, border, and margin"
-                    text run at (0,102) width 737: "should all be noticeable at the beginning and end of the span. However, the line height should not be changed by any"
+                    text run at (0,70) width 746: "should appear only at the beginning and the end of the whole span, not on each line). The padding, border, and margin"
+                    text run at (0,102) width 736: "should all be noticeable at the beginning and end of the span. However, the line height should not be changed by any"
                     text run at (0,134) width 602: "of them, so the margin should be unnoticeable and the border should overlap text on other lines."
                 LayoutText {#text} at (654,134) size 711x51
                   text run at (654,134) width 57: " The line"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/pseudo/anchor-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/pseudo/anchor-expected.png
index 674002bd..9d07930 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/pseudo/anchor-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/pseudo/anchor-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/pseudo/anchor-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/pseudo/anchor-expected.txt
index 99086a6ac..b9d7ad9 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/pseudo/anchor-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/pseudo/anchor-expected.txt
@@ -35,25 +35,25 @@
               LayoutNGListMarker (anonymous) at (-18,0) size 10x20
                 LayoutText (anonymous) at (0,0) size 10x19
                   text run at (0,0) width 10: "\x{25E6} "
-              LayoutInline {A} at (0,0) size 108x19 [color=#800080]
-                LayoutText {#text} at (0,0) size 108x19
-                  text run at (0,0) width 108: "W3C Web server"
+              LayoutInline {A} at (0,0) size 109x19 [color=#800080]
+                LayoutText {#text} at (0,0) size 109x19
+                  text run at (0,0) width 109: "W3C Web server"
               LayoutText {#text} at (0,0) size 0x0
             LayoutNGListItem {LI} at (40,20) size 689x20
               LayoutNGListMarker (anonymous) at (-18,0) size 10x20
                 LayoutText (anonymous) at (0,0) size 10x19
                   text run at (0,0) width 10: "\x{25E6} "
-              LayoutInline {A} at (0,0) size 110x19 [color=#800080]
-                LayoutText {#text} at (0,0) size 110x19
-                  text run at (0,0) width 110: "NIST Web server"
+              LayoutInline {A} at (0,0) size 111x19 [color=#800080]
+                LayoutText {#text} at (0,0) size 111x19
+                  text run at (0,0) width 111: "NIST Web server"
               LayoutText {#text} at (0,0) size 0x0
             LayoutNGListItem {LI} at (40,40) size 689x20
               LayoutNGListMarker (anonymous) at (-18,0) size 10x20
                 LayoutText (anonymous) at (0,0) size 10x19
                   text run at (0,0) width 10: "\x{25E6} "
-              LayoutInline {A} at (0,0) size 123x19 [color=#800080]
-                LayoutText {#text} at (0,0) size 123x19
-                  text run at (0,0) width 123: "CWRU Web server"
+              LayoutInline {A} at (0,0) size 124x19 [color=#800080]
+                LayoutText {#text} at (0,0) size 124x19
+                  text run at (0,0) width 124: "CWRU Web server"
               LayoutText {#text} at (0,0) size 0x0
             LayoutNGListItem {LI} at (40,60) size 689x20
               LayoutNGListMarker (anonymous) at (-18,0) size 10x20
@@ -84,9 +84,9 @@
               LayoutNGListMarker (anonymous) at (-18,0) size 10x20
                 LayoutText (anonymous) at (0,0) size 10x19
                   text run at (0,0) width 10: "\x{25E6} "
-              LayoutInline {A} at (0,0) size 123x19 [color=#006600]
-                LayoutText {#text} at (0,0) size 123x19
-                  text run at (0,0) width 123: "CWRU Web server"
+              LayoutInline {A} at (0,0) size 124x19 [color=#006600]
+                LayoutText {#text} at (0,0) size 124x19
+                  text run at (0,0) width 124: "CWRU Web server"
               LayoutText {#text} at (0,0) size 0x0
       LayoutNGBlockFlow {P} at (0,375) size 769x40
         LayoutText {#text} at (0,0) size 120x19
@@ -94,16 +94,16 @@
         LayoutInline {A} at (0,0) size 43x19 [color=#008000]
           LayoutText {#text} at (120,0) size 43x19
             text run at (120,0) width 43: "anchor"
-        LayoutText {#text} at (163,0) size 732x39
-          text run at (163,0) width 569: "\" should be green, NOT purple, since it's part of an anchor. It's a named anchor, and styles"
-          text run at (0,20) width 675: "declared for the A tag are applied to them under CSS1. It also should NOT turn orange when clicked upon."
+        LayoutText {#text} at (163,0) size 730x39
+          text run at (163,0) width 567: "\" should be green, NOT purple, since it's part of an anchor. It's a named anchor, and styles"
+          text run at (0,20) width 674: "declared for the A tag are applied to them under CSS1. It also should NOT turn orange when clicked upon."
       LayoutTable {TABLE} at (0,431) size 769x290 [border: (1px outset #808080)]
         LayoutTableSection {TBODY} at (1,1) size 767x288
           LayoutTableRow {TR} at (0,0) size 767x28
             LayoutNGTableCell {TD} at (0,0) size 767x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutInline {STRONG} at (0,0) size 159x19
-                LayoutText {#text} at (4,4) size 159x19
-                  text run at (4,4) width 159: "TABLE Testing Section"
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,4) size 161x19
+                  text run at (4,4) width 161: "TABLE Testing Section"
           LayoutTableRow {TR} at (0,28) size 767x260
             LayoutNGTableCell {TD} at (0,144) size 12x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (4,120) size 4x19
@@ -125,25 +125,25 @@
                       LayoutNGListMarker (anonymous) at (-18,0) size 10x20
                         LayoutText (anonymous) at (0,0) size 10x19
                           text run at (0,0) width 10: "\x{25E6} "
-                      LayoutInline {A} at (0,0) size 108x19 [color=#800080]
-                        LayoutText {#text} at (0,0) size 108x19
-                          text run at (0,0) width 108: "W3C Web server"
+                      LayoutInline {A} at (0,0) size 109x19 [color=#800080]
+                        LayoutText {#text} at (0,0) size 109x19
+                          text run at (0,0) width 109: "W3C Web server"
                       LayoutText {#text} at (0,0) size 0x0
                     LayoutNGListItem {LI} at (40,20) size 667x20
                       LayoutNGListMarker (anonymous) at (-18,0) size 10x20
                         LayoutText (anonymous) at (0,0) size 10x19
                           text run at (0,0) width 10: "\x{25E6} "
-                      LayoutInline {A} at (0,0) size 110x19 [color=#800080]
-                        LayoutText {#text} at (0,0) size 110x19
-                          text run at (0,0) width 110: "NIST Web server"
+                      LayoutInline {A} at (0,0) size 111x19 [color=#800080]
+                        LayoutText {#text} at (0,0) size 111x19
+                          text run at (0,0) width 111: "NIST Web server"
                       LayoutText {#text} at (0,0) size 0x0
                     LayoutNGListItem {LI} at (40,40) size 667x20
                       LayoutNGListMarker (anonymous) at (-18,0) size 10x20
                         LayoutText (anonymous) at (0,0) size 10x19
                           text run at (0,0) width 10: "\x{25E6} "
-                      LayoutInline {A} at (0,0) size 123x19 [color=#800080]
-                        LayoutText {#text} at (0,0) size 123x19
-                          text run at (0,0) width 123: "CWRU Web server"
+                      LayoutInline {A} at (0,0) size 124x19 [color=#800080]
+                        LayoutText {#text} at (0,0) size 124x19
+                          text run at (0,0) width 124: "CWRU Web server"
                       LayoutText {#text} at (0,0) size 0x0
                     LayoutNGListItem {LI} at (40,60) size 667x20
                       LayoutNGListMarker (anonymous) at (-18,0) size 10x20
@@ -174,9 +174,9 @@
                       LayoutNGListMarker (anonymous) at (-18,0) size 10x20
                         LayoutText (anonymous) at (0,0) size 10x19
                           text run at (0,0) width 10: "\x{25E6} "
-                      LayoutInline {A} at (0,0) size 123x19 [color=#006600]
-                        LayoutText {#text} at (0,0) size 123x19
-                          text run at (0,0) width 123: "CWRU Web server"
+                      LayoutInline {A} at (0,0) size 124x19 [color=#006600]
+                        LayoutText {#text} at (0,0) size 124x19
+                          text run at (0,0) width 124: "CWRU Web server"
                       LayoutText {#text} at (0,0) size 0x0
               LayoutNGBlockFlow {P} at (4,216) size 747x40
                 LayoutText {#text} at (0,0) size 120x19
@@ -184,8 +184,8 @@
                 LayoutInline {A} at (0,0) size 43x19 [color=#008000]
                   LayoutText {#text} at (120,0) size 43x19
                     text run at (120,0) width 43: "anchor"
-                LayoutText {#text} at (163,0) size 732x39
-                  text run at (163,0) width 569: "\" should be green, NOT purple, since it's part of an anchor. It's a named anchor, and styles"
-                  text run at (0,20) width 675: "declared for the A tag are applied to them under CSS1. It also should NOT turn orange when clicked upon."
+                LayoutText {#text} at (163,0) size 730x39
+                  text run at (163,0) width 567: "\" should be green, NOT purple, since it's part of an anchor. It's a named anchor, and styles"
+                  text run at (0,20) width 674: "declared for the A tag are applied to them under CSS1. It also should NOT turn orange when clicked upon."
 layer at (8,153) size 769x2 clip at (0,0) size 0x0
   LayoutNGBlockFlow {HR} at (0,145) size 769x2 [border: (1px inset #EEEEEE)]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/text_properties/text_transform-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/text_properties/text_transform-expected.png
index 5070d95..919c3c95 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/text_properties/text_transform-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/text_properties/text_transform-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/units/urls-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/units/urls-expected.png
new file mode 100644
index 0000000..409cf06
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/units/urls-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/units/urls-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/units/urls-expected.txt
index 270ea9c2..4bd1311b 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/units/urls-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css1/units/urls-expected.txt
@@ -21,20 +21,20 @@
       LayoutNGBlockFlow {P} at (0,167) size 784x60 [bgcolor=#FFFFFF]
         LayoutText {#text} at (0,0) size 779x59
           text run at (0,0) width 779: "This paragraph should have a white background, but NO image should appear in the background. If an image, in this case a"
-          text run at (0,20) width 756: "red square-- or, indeed, any red at all-- is seen there, then the browser has incorrectly interpreted a URL in relation to the"
+          text run at (0,20) width 754: "red square-- or, indeed, any red at all-- is seen there, then the browser has incorrectly interpreted a URL in relation to the"
           text run at (0,40) width 274: "document's URL, not the stylesheet's URL."
       LayoutNGBlockFlow {P} at (0,243) size 784x60 [bgcolor=#FFFFFF]
         LayoutText {#text} at (0,0) size 779x59
           text run at (0,0) width 779: "This paragraph should have a white background, but NO image should appear in the background. If an image, in this case a"
-          text run at (0,20) width 756: "red square-- or, indeed, any red at all-- is seen there, then the browser has incorrectly interpreted a URL in relation to the"
+          text run at (0,20) width 754: "red square-- or, indeed, any red at all-- is seen there, then the browser has incorrectly interpreted a URL in relation to the"
           text run at (0,40) width 274: "document's URL, not the stylesheet's URL."
       LayoutTable {TABLE} at (0,319) size 784x210 [border: (1px outset #808080)]
         LayoutTableSection {TBODY} at (1,1) size 782x208
           LayoutTableRow {TR} at (0,0) size 782x28
             LayoutNGTableCell {TD} at (0,0) size 782x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=0 c=0 rs=1 cs=2]
-              LayoutInline {STRONG} at (0,0) size 159x19
-                LayoutText {#text} at (4,4) size 159x19
-                  text run at (4,4) width 159: "TABLE Testing Section"
+              LayoutInline {STRONG} at (0,0) size 161x19
+                LayoutText {#text} at (4,4) size 161x19
+                  text run at (4,4) width 161: "TABLE Testing Section"
           LayoutTableRow {TR} at (0,28) size 782x180
             LayoutNGTableCell {TD} at (0,104) size 12x28 [bgcolor=#C0C0C0] [border: (1px inset #808080)] [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (4,80) size 4x19
@@ -44,14 +44,14 @@
                 LayoutText {#text} at (0,0) size 386x19
                   text run at (0,0) width 386: "This page should have a green grid pattern as its background."
               LayoutNGBlockFlow {P} at (4,40) size 762x60 [bgcolor=#FFFFFF]
-                LayoutText {#text} at (0,0) size 759x59
+                LayoutText {#text} at (0,0) size 757x59
                   text run at (0,0) width 737: "This paragraph should have a white background, but NO image should appear in the background. If an image, in this"
-                  text run at (0,20) width 759: "case a red square-- or, indeed, any red at all-- is seen there, then the browser has incorrectly interpreted a URL in relation"
+                  text run at (0,20) width 757: "case a red square-- or, indeed, any red at all-- is seen there, then the browser has incorrectly interpreted a URL in relation"
                   text run at (0,40) width 313: "to the document's URL, not the stylesheet's URL."
               LayoutNGBlockFlow {P} at (4,116) size 762x60 [bgcolor=#FFFFFF]
-                LayoutText {#text} at (0,0) size 759x59
+                LayoutText {#text} at (0,0) size 757x59
                   text run at (0,0) width 737: "This paragraph should have a white background, but NO image should appear in the background. If an image, in this"
-                  text run at (0,20) width 759: "case a red square-- or, indeed, any red at all-- is seen there, then the browser has incorrectly interpreted a URL in relation"
+                  text run at (0,20) width 757: "case a red square-- or, indeed, any red at all-- is seen there, then the browser has incorrectly interpreted a URL in relation"
                   text run at (0,40) width 313: "to the document's URL, not the stylesheet's URL."
 layer at (8,121) size 784x2 clip at (0,0) size 0x0
   LayoutNGBlockFlow {HR} at (0,113) size 784x2 [border: (1px inset #EEEEEE)]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/c543-txt-decor-000-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/c543-txt-decor-000-expected.png
index 53e598a..61720af6 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/c543-txt-decor-000-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/c543-txt-decor-000-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/c543-txt-decor-000-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/c543-txt-decor-000-expected.txt
index 5eb33aa..bc962fe0c 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/c543-txt-decor-000-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/c543-txt-decor-000-expected.txt
@@ -13,8 +13,8 @@
         LayoutText {#text} at (0,0) size 232x19
           text run at (0,0) width 232: "This sentence should be stricken out."
       LayoutNGBlockFlow {P} at (0,108) size 784x20 [color=#000080]
-        LayoutText {#text} at (0,0) size 369x19
-          text run at (0,0) width 369: "This sentence should be blinking (if the UA supports that)."
+        LayoutText {#text} at (0,0) size 368x19
+          text run at (0,0) width 368: "This sentence should be blinking (if the UA supports that)."
       LayoutNGBlockFlow {P} at (0,144) size 784x20 [color=#000080]
         LayoutText {#text} at (0,0) size 227x19
           text run at (0,0) width 227: "The sentence should be underlined. "
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/margin-applies-to-010-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/margin-applies-to-010-expected.png
index 2f6dfa7..9b5e46d 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/margin-applies-to-010-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/margin-applies-to-010-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/margin-applies-to-010-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/margin-applies-to-010-expected.txt
index 5e898e9..caac23d 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/margin-applies-to-010-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/margin-applies-to-010-expected.txt
@@ -4,8 +4,8 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x72
     LayoutNGBlockFlow {BODY} at (8,16) size 784x40
       LayoutNGBlockFlow {P} at (0,0) size 784x40
-        LayoutText {#text} at (0,0) size 777x39
-          text run at (0,0) width 777: "Test passes if there is space between the blue and orange lines below and there is a marker bullet on the left-hand side of the"
+        LayoutText {#text} at (0,0) size 778x39
+          text run at (0,0) width 778: "Test passes if there is space between the blue and orange lines below and there is a marker bullet on the left-hand side of the"
           text run at (0,20) width 75: "orange box."
 layer at (8,72) size 340x340
   LayoutNGBlockFlow (positioned) {DIV} at (8,72) size 340x340 [border: (10px solid #0000FF)]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/table-height-algorithm-023-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/table-height-algorithm-023-expected.png
index 14ae186f..4181452 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/table-height-algorithm-023-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/table-height-algorithm-023-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/table-height-algorithm-023-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/table-height-algorithm-023-expected.txt
index 640a5de7..7225c87 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/table-height-algorithm-023-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/table-height-algorithm-023-expected.txt
@@ -4,20 +4,20 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x160
     LayoutNGBlockFlow {BODY} at (8,16) size 784x136
       LayoutNGBlockFlow {P} at (0,0) size 784x20
-        LayoutText {#text} at (0,0) size 386x19
-          text run at (0,0) width 386: "Test passes if the bottom of the \"Filler Text\" below is aligned."
-      LayoutTable {TABLE} at (0,36) size 354x100
-        LayoutTableSection {TBODY} at (0,0) size 354x100
-          LayoutTableRow {TR} at (0,2) size 354x96
-            LayoutNGTableCell {TD} at (2,27) size 59x18 [r=0 c=0 rs=1 cs=1]
-              LayoutNGBlockFlow {DIV} at (1,1) size 57x16
+        LayoutText {#text} at (0,0) size 388x19
+          text run at (0,0) width 388: "Test passes if the bottom of the \"Filler Text\" below is aligned."
+      LayoutTable {TABLE} at (0,36) size 352x100
+        LayoutTableSection {TBODY} at (0,0) size 352x100
+          LayoutTableRow {TR} at (0,2) size 352x96
+            LayoutNGTableCell {TD} at (2,27) size 58x18 [r=0 c=0 rs=1 cs=1]
+              LayoutNGBlockFlow {DIV} at (1,1) size 56x16
                 LayoutText {#text} at (0,0) size 56x15
                   text run at (0,0) width 56: "Filler Text"
-            LayoutNGTableCell {TD} at (63,15) size 118x34 [r=0 c=1 rs=1 cs=1]
+            LayoutNGTableCell {TD} at (62,15) size 118x34 [r=0 c=1 rs=1 cs=1]
               LayoutNGBlockFlow {DIV} at (1,1) size 116x32
                 LayoutText {#text} at (0,0) size 116x31
                   text run at (0,0) width 116: "Filler Text"
-            LayoutNGTableCell {TD} at (183,2) size 169x50 [r=0 c=2 rs=1 cs=1]
-              LayoutNGBlockFlow {DIV} at (1,1) size 167x48
-                LayoutText {#text} at (0,1) size 166x46
-                  text run at (0,1) width 166: "Filler Text"
+            LayoutNGTableCell {TD} at (182,2) size 168x50 [r=0 c=2 rs=1 cs=1]
+              LayoutNGBlockFlow {DIV} at (1,1) size 166x48
+                LayoutText {#text} at (0,1) size 165x46
+                  text run at (0,1) width 165: "Filler Text"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/table-height-algorithm-024-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/table-height-algorithm-024-expected.png
index 14ae186f..4181452 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/table-height-algorithm-024-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/table-height-algorithm-024-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/table-height-algorithm-024-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/table-height-algorithm-024-expected.txt
index 640a5de7..7225c87 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/table-height-algorithm-024-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/20110323/table-height-algorithm-024-expected.txt
@@ -4,20 +4,20 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x160
     LayoutNGBlockFlow {BODY} at (8,16) size 784x136
       LayoutNGBlockFlow {P} at (0,0) size 784x20
-        LayoutText {#text} at (0,0) size 386x19
-          text run at (0,0) width 386: "Test passes if the bottom of the \"Filler Text\" below is aligned."
-      LayoutTable {TABLE} at (0,36) size 354x100
-        LayoutTableSection {TBODY} at (0,0) size 354x100
-          LayoutTableRow {TR} at (0,2) size 354x96
-            LayoutNGTableCell {TD} at (2,27) size 59x18 [r=0 c=0 rs=1 cs=1]
-              LayoutNGBlockFlow {DIV} at (1,1) size 57x16
+        LayoutText {#text} at (0,0) size 388x19
+          text run at (0,0) width 388: "Test passes if the bottom of the \"Filler Text\" below is aligned."
+      LayoutTable {TABLE} at (0,36) size 352x100
+        LayoutTableSection {TBODY} at (0,0) size 352x100
+          LayoutTableRow {TR} at (0,2) size 352x96
+            LayoutNGTableCell {TD} at (2,27) size 58x18 [r=0 c=0 rs=1 cs=1]
+              LayoutNGBlockFlow {DIV} at (1,1) size 56x16
                 LayoutText {#text} at (0,0) size 56x15
                   text run at (0,0) width 56: "Filler Text"
-            LayoutNGTableCell {TD} at (63,15) size 118x34 [r=0 c=1 rs=1 cs=1]
+            LayoutNGTableCell {TD} at (62,15) size 118x34 [r=0 c=1 rs=1 cs=1]
               LayoutNGBlockFlow {DIV} at (1,1) size 116x32
                 LayoutText {#text} at (0,0) size 116x31
                   text run at (0,0) width 116: "Filler Text"
-            LayoutNGTableCell {TD} at (183,2) size 169x50 [r=0 c=2 rs=1 cs=1]
-              LayoutNGBlockFlow {DIV} at (1,1) size 167x48
-                LayoutText {#text} at (0,1) size 166x46
-                  text run at (0,1) width 166: "Filler Text"
+            LayoutNGTableCell {TD} at (182,2) size 168x50 [r=0 c=2 rs=1 cs=1]
+              LayoutNGBlockFlow {DIV} at (1,1) size 166x48
+                LayoutText {#text} at (0,1) size 165x46
+                  text run at (0,1) width 165: "Filler Text"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0402-c71-fwd-parsing-02-f-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0402-c71-fwd-parsing-02-f-expected.png
index 34f44e0..e12cb65 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0402-c71-fwd-parsing-02-f-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0402-c71-fwd-parsing-02-f-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0402-c71-fwd-parsing-02-f-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0402-c71-fwd-parsing-02-f-expected.txt
index 7e39c708..931917c 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0402-c71-fwd-parsing-02-f-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0402-c71-fwd-parsing-02-f-expected.txt
@@ -42,8 +42,8 @@
             text run at (0,0) width 163: "This line should be green."
         LayoutText {#text} at (0,0) size 0x0
       LayoutNGBlockFlow {ADDRESS} at (0,324) size 784x20
-        LayoutText {#text} at (0,0) size 163x19
-          text run at (0,0) width 163: "This line should be green."
+        LayoutText {#text} at (0,0) size 162x19
+          text run at (0,0) width 162: "This line should be green."
       LayoutNGBlockFlow {P} at (0,360) size 784x20
         LayoutInline {SPAN} at (0,0) size 163x19
           LayoutText {#text} at (0,0) size 163x19
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0505-c16-descendant-01-e-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0505-c16-descendant-01-e-expected.png
index 3cebffc..6b35222 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0505-c16-descendant-01-e-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0505-c16-descendant-01-e-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t050803-c14-classes-00-e-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t050803-c14-classes-00-e-expected.png
index afe589f7..0e89fac 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t050803-c14-classes-00-e-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t050803-c14-classes-00-e-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0509-c15-ids-01-e-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0509-c15-ids-01-e-expected.png
index 891b473..2c31271 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0509-c15-ids-01-e-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0509-c15-ids-01-e-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t051103-dom-hover-01-c-io-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t051103-dom-hover-01-c-io-expected.png
new file mode 100644
index 0000000..6ca3dad
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t051103-dom-hover-01-c-io-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t051103-dom-hover-01-c-io-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t051103-dom-hover-01-c-io-expected.txt
index 447ad40..9b11420 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t051103-dom-hover-01-c-io-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t051103-dom-hover-01-c-io-expected.txt
@@ -4,8 +4,8 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x56
     LayoutNGBlockFlow {BODY} at (8,8) size 784x40
       LayoutNGBlockFlow {DIV} at (0,0) size 784x20
-        LayoutText {#text} at (0,0) size 496x19
-          text run at (0,0) width 496: "Hover this text, then wait till it disappears. At that point there should be no red."
+        LayoutText {#text} at (0,0) size 495x19
+          text run at (0,0) width 495: "Hover this text, then wait till it disappears. At that point there should be no red."
       LayoutNGBlockFlow {DIV} at (0,20) size 784x20 [color=#FF0000]
         LayoutText {#text} at (0,0) size 164x19
           text run at (0,0) width 164: "This should end up green."
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t051103-dom-hover-02-c-io-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t051103-dom-hover-02-c-io-expected.png
new file mode 100644
index 0000000..5f10140
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t051103-dom-hover-02-c-io-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t051103-dom-hover-02-c-io-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t051103-dom-hover-02-c-io-expected.txt
index 2a9afdf6..c0a9ec7 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t051103-dom-hover-02-c-io-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t051103-dom-hover-02-c-io-expected.txt
@@ -8,9 +8,9 @@
           LayoutText {#text} at (0,0) size 170x19
             text run at (0,0) width 170: "Dummy text. Dummy text."
         LayoutNGBlockFlow {DIV} at (0,20) size 784x20
-          LayoutInline {SPAN} at (0,0) size 496x19
-            LayoutText {#text} at (0,0) size 496x19
-              text run at (0,0) width 496: "Hover this text, then wait till it disappears. At that point there should be no red."
+          LayoutInline {SPAN} at (0,0) size 495x19
+            LayoutText {#text} at (0,0) size 495x19
+              text run at (0,0) width 495: "Hover this text, then wait till it disappears. At that point there should be no red."
           LayoutText {#text} at (0,0) size 0x0
       LayoutNGBlockFlow {DIV} at (0,40) size 784x20 [color=#008000]
         LayoutText {#text} at (0,0) size 170x19
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5516-brdr-c-00-a-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5516-brdr-c-00-a-expected.png
new file mode 100644
index 0000000..b83d15b
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5516-brdr-c-00-a-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5516-brdr-c-00-a-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5516-brdr-c-00-a-expected.txt
index 98eb1dc1..c980dab 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5516-brdr-c-00-a-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5516-brdr-c-00-a-expected.txt
@@ -4,11 +4,11 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x200
     LayoutNGBlockFlow {BODY} at (8,16) size 784x168
       LayoutNGBlockFlow {P} at (0,0) size 784x26 [border: (3px solid #008000)]
-        LayoutText {#text} at (3,3) size 235x19
-          text run at (3,3) width 235: "This box should have a green border."
+        LayoutText {#text} at (3,3) size 234x19
+          text run at (3,3) width 234: "This box should have a green border."
       LayoutNGBlockFlow {P} at (0,42) size 784x26 [border: (3px solid #008000)]
-        LayoutText {#text} at (3,3) size 300x19
-          text run at (3,3) width 300: "This box should have an identical green border."
+        LayoutText {#text} at (3,3) size 299x19
+          text run at (3,3) width 299: "This box should have an identical green border."
       LayoutNGBlockFlow {P} at (0,84) size 784x84 [border: (32px solid #800080) (32px solid #008000) (32px solid #0000FF) (32px solid #FFFF00)]
         LayoutText {#text} at (32,32) size 530x19
           text run at (32,32) width 530: "Clockwise from top, the borders should be: PURPLE, GREEN, BLUE, YELLOW."
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5516-ibrdr-c-00-a-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5516-ibrdr-c-00-a-expected.png
new file mode 100644
index 0000000..69010ae3
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5516-ibrdr-c-00-a-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5516-ibrdr-c-00-a-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5516-ibrdr-c-00-a-expected.txt
index 48baa5d..318c1de 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5516-ibrdr-c-00-a-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5516-ibrdr-c-00-a-expected.txt
@@ -4,14 +4,14 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x252
     LayoutNGBlockFlow {BODY} at (8,48) size 784x156
       LayoutNGBlockFlow {P} at (48,0) size 688x20
-        LayoutInline {SPAN} at (0,0) size 241x25 [border: (3px solid #008000)]
-          LayoutText {#text} at (3,0) size 235x19
-            text run at (3,0) width 235: "This box should have a green border."
+        LayoutInline {SPAN} at (0,0) size 240x25 [border: (3px solid #008000)]
+          LayoutText {#text} at (3,0) size 234x19
+            text run at (3,0) width 234: "This box should have a green border."
         LayoutText {#text} at (0,0) size 0x0
       LayoutNGBlockFlow {P} at (48,68) size 688x20
-        LayoutInline {SPAN} at (0,0) size 241x25 [border: (3px solid #008000)]
-          LayoutText {#text} at (3,0) size 235x19
-            text run at (3,0) width 235: "This box should have a green border."
+        LayoutInline {SPAN} at (0,0) size 240x25 [border: (3px solid #008000)]
+          LayoutText {#text} at (3,0) size 234x19
+            text run at (3,0) width 234: "This box should have a green border."
         LayoutText {#text} at (0,0) size 0x0
       LayoutNGBlockFlow {P} at (48,136) size 688x20
         LayoutInline {SPAN} at (0,0) size 594x83 [border: (32px solid #800080) (32px solid #008000) (32px solid #0000FF) (32px solid #FFFF00)]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5517-brdr-s-00-c-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5517-brdr-s-00-c-expected.png
index f10eecc..51c7d8d 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5517-brdr-s-00-c-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5517-brdr-s-00-c-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5517-ibrdr-s-00-a-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5517-ibrdr-s-00-a-expected.png
index 0ad7fb5a..9e9a036 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5517-ibrdr-s-00-a-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5517-ibrdr-s-00-a-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5517-ibrdr-s-00-a-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5517-ibrdr-s-00-a-expected.txt
index c994ed88..ea90e344 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5517-ibrdr-s-00-a-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5517-ibrdr-s-00-a-expected.txt
@@ -17,7 +17,7 @@
             text run at (5,0) width 134: "Orange and grooved."
         LayoutText {#text} at (0,0) size 0x0
       LayoutNGBlockFlow {P} at (0,108) size 784x20
-        LayoutInline {SPAN} at (0,0) size 69x19
-          LayoutText {#text} at (0,0) size 69x19
-            text run at (0,0) width 69: "No border."
+        LayoutInline {SPAN} at (0,0) size 68x19
+          LayoutText {#text} at (0,0) size 68x19
+            text run at (0,0) width 68: "No border."
         LayoutText {#text} at (0,0) size 0x0
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5518-brdr-t-01-e-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5518-brdr-t-01-e-expected.png
index 0c60fe5d..f0a84b9e 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5518-brdr-t-01-e-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5518-brdr-t-01-e-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5519-brdr-r-02-e-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5519-brdr-r-02-e-expected.png
index 19ee336f..92ca380 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5519-brdr-r-02-e-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5519-brdr-r-02-e-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5519-brdr-r-02-e-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5519-brdr-r-02-e-expected.txt
index 2020d0a..3723b6ba 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5519-brdr-r-02-e-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5519-brdr-r-02-e-expected.txt
@@ -4,8 +4,8 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x368
     LayoutNGBlockFlow {BODY} at (8,16) size 784x336 [color=#0000FF]
       LayoutNGBlockFlow {P} at (0,0) size 784x20
-        LayoutText {#text} at (0,0) size 746x19
-          text run at (0,0) width 746: "There should be a solid line to the right of the text below, having three segments each of a different colour as indicated."
+        LayoutText {#text} at (0,0) size 747x19
+          text run at (0,0) width 747: "There should be a solid line to the right of the text below, having three segments each of a different colour as indicated."
       LayoutNGBlockFlow {UL} at (0,36) size 588x300
         LayoutNGListItem {LI} at (40,0) size 548x80 [border: none (3px solid #FFA500) none]
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
@@ -53,4 +53,4 @@
             text run at (0,120) width 513: "yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow"
             text run at (0,140) width 513: "yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow"
             text run at (0,160) width 513: "yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow"
-            text run at (0,180) width 280: "yellow yellow yellow yellow yellow yellow."
+            text run at (0,180) width 281: "yellow yellow yellow yellow yellow yellow."
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5520-brdr-b-01-e-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5520-brdr-b-01-e-expected.png
index 4c2497f..c292d0a 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5520-brdr-b-01-e-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5520-brdr-b-01-e-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5521-brdr-l-02-e-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5521-brdr-l-02-e-expected.png
index 1771ec4..7b5c823 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5521-brdr-l-02-e-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5521-brdr-l-02-e-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5521-brdr-l-02-e-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5521-brdr-l-02-e-expected.txt
index bacaa1885..c2dd465 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5521-brdr-l-02-e-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5521-brdr-l-02-e-expected.txt
@@ -4,8 +4,8 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x308
     LayoutNGBlockFlow {BODY} at (8,16) size 784x276 [color=#0000FF]
       LayoutNGBlockFlow {P} at (0,0) size 784x20
-        LayoutText {#text} at (0,0) size 737x19
-          text run at (0,0) width 737: "There should be a solid line to the left of the text below, having three segments each of a different colour as indicated."
+        LayoutText {#text} at (0,0) size 738x19
+          text run at (0,0) width 738: "There should be a solid line to the left of the text below, having three segments each of a different colour as indicated."
       LayoutNGBlockFlow {UL} at (0,36) size 784x240
         LayoutNGListItem {LI} at (40,0) size 744x80 [border: none (3px solid #FFA500)]
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
@@ -43,11 +43,11 @@
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
             LayoutText (anonymous) at (0,0) size 10x19
               text run at (0,0) width 10: "\x{2022} "
-          LayoutText {#text} at (3,0) size 703x139
+          LayoutText {#text} at (3,0) size 704x139
             text run at (3,0) width 703: "Yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow"
             text run at (3,20) width 701: "yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow"
             text run at (3,40) width 701: "yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow"
             text run at (3,60) width 701: "yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow"
             text run at (3,80) width 701: "yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow"
             text run at (3,100) width 701: "yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow"
-            text run at (3,120) width 703: "yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow."
+            text run at (3,120) width 704: "yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow yellow."
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5522-brdr-00-b-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5522-brdr-00-b-expected.png
index 3958d58d..8e4c5306 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5522-brdr-00-b-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0805-c5522-brdr-00-b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c414-flt-02-c-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c414-flt-02-c-expected.png
index ffd4192..064c42bc 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c414-flt-02-c-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c414-flt-02-c-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c414-flt-02-c-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c414-flt-02-c-expected.txt
index 8235092..5eab49b 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c414-flt-02-c-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c414-flt-02-c-expected.txt
@@ -9,20 +9,20 @@
           text run at (0,20) width 479: "labelled \"B\" should be in the second; arrows indicate the correct alignment.)"
       LayoutNGBlockFlow {DIV} at (16,56) size 320x0
         LayoutNGBlockFlow (floating) {P} at (4,4) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
-          LayoutText {#text} at (7,7) size 40x19
-            text run at (7,7) width 40: "\x{21E6} A 1"
+          LayoutText {#text} at (7,7) size 39x19
+            text run at (7,7) width 39: "\x{21E6} A 1"
         LayoutNGBlockFlow (floating) {P} at (138,4) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
           LayoutText {#text} at (7,7) size 40x19
             text run at (7,7) width 40: "\x{21E6} B 2"
         LayoutNGBlockFlow (floating) {P} at (4,46) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
-          LayoutText {#text} at (7,7) size 40x19
-            text run at (7,7) width 40: "\x{21E6} A 3"
+          LayoutText {#text} at (7,7) size 39x19
+            text run at (7,7) width 39: "\x{21E6} A 3"
         LayoutNGBlockFlow (floating) {P} at (190,46) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
           LayoutText {#text} at (79,7) size 40x19
             text run at (79,7) width 40: "B 4 \x{21E8}"
         LayoutNGBlockFlow (floating) {P} at (4,88) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
-          LayoutText {#text} at (7,7) size 40x19
-            text run at (7,7) width 40: "\x{21E6} A 5"
+          LayoutText {#text} at (7,7) size 39x19
+            text run at (7,7) width 39: "\x{21E6} A 5"
         LayoutNGBlockFlow (floating) {P} at (190,88) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
           LayoutText {#text} at (79,7) size 40x19
             text run at (79,7) width 40: "B 6 \x{21E8}"
@@ -30,11 +30,11 @@
           LayoutText {#text} at (79,7) size 40x19
             text run at (79,7) width 40: "B 8 \x{21E8}"
         LayoutNGBlockFlow (floating) {P} at (4,130) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
-          LayoutText {#text} at (7,7) size 40x19
-            text run at (7,7) width 40: "\x{21E6} A 7"
+          LayoutText {#text} at (7,7) size 39x19
+            text run at (7,7) width 39: "\x{21E6} A 7"
         LayoutNGBlockFlow (floating) {P} at (4,172) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
-          LayoutText {#text} at (7,7) size 40x19
-            text run at (7,7) width 40: "\x{21E6} A 9"
+          LayoutText {#text} at (7,7) size 39x19
+            text run at (7,7) width 39: "\x{21E6} A 9"
         LayoutNGBlockFlow (floating) {P} at (138,172) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
           LayoutText {#text} at (7,7) size 48x19
             text run at (7,7) width 48: "\x{21E6} B 10"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c414-flt-03-c-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c414-flt-03-c-expected.png
index 5688d81c..2f44aa74 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c414-flt-03-c-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c414-flt-03-c-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c414-flt-03-c-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c414-flt-03-c-expected.txt
index 8d93086..13655cd 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c414-flt-03-c-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c414-flt-03-c-expected.txt
@@ -12,23 +12,23 @@
           LayoutText {#text} at (79,7) size 40x19
             text run at (79,7) width 40: "B 2 \x{21E8}"
         LayoutNGBlockFlow (floating) {P} at (56,4) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
-          LayoutText {#text} at (78,7) size 41x19
-            text run at (78,7) width 41: "A 1 \x{21E8}"
+          LayoutText {#text} at (79,7) size 40x19
+            text run at (79,7) width 40: "A 1 \x{21E8}"
         LayoutNGBlockFlow (floating) {P} at (190,46) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
           LayoutText {#text} at (79,7) size 40x19
             text run at (79,7) width 40: "B 4 \x{21E8}"
         LayoutNGBlockFlow (floating) {P} at (4,46) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
-          LayoutText {#text} at (7,7) size 40x19
-            text run at (7,7) width 40: "\x{21E6} A 3"
+          LayoutText {#text} at (7,7) size 39x19
+            text run at (7,7) width 39: "\x{21E6} A 3"
         LayoutNGBlockFlow (floating) {P} at (190,88) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
           LayoutText {#text} at (79,7) size 40x19
             text run at (79,7) width 40: "B 6 \x{21E8}"
         LayoutNGBlockFlow (floating) {P} at (4,88) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
-          LayoutText {#text} at (7,7) size 40x19
-            text run at (7,7) width 40: "\x{21E6} A 5"
+          LayoutText {#text} at (7,7) size 39x19
+            text run at (7,7) width 39: "\x{21E6} A 5"
         LayoutNGBlockFlow (floating) {P} at (4,130) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
-          LayoutText {#text} at (7,7) size 40x19
-            text run at (7,7) width 40: "\x{21E6} A 7"
+          LayoutText {#text} at (7,7) size 39x19
+            text run at (7,7) width 39: "\x{21E6} A 7"
         LayoutNGBlockFlow (floating) {P} at (190,130) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
           LayoutText {#text} at (79,7) size 40x19
             text run at (79,7) width 40: "B 8 \x{21E8}"
@@ -36,5 +36,5 @@
           LayoutText {#text} at (71,7) size 48x19
             text run at (71,7) width 48: "B 10 \x{21E8}"
         LayoutNGBlockFlow (floating) {P} at (56,172) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
-          LayoutText {#text} at (78,7) size 41x19
-            text run at (78,7) width 41: "A 9 \x{21E8}"
+          LayoutText {#text} at (79,7) size 40x19
+            text run at (79,7) width 40: "A 9 \x{21E8}"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c414-flt-04-c-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c414-flt-04-c-expected.png
index 6177543..53c6a602 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c414-flt-04-c-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c414-flt-04-c-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c414-flt-04-c-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c414-flt-04-c-expected.txt
index a0cd1353..f72f370 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c414-flt-04-c-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c414-flt-04-c-expected.txt
@@ -9,44 +9,44 @@
           text run at (0,20) width 479: "labelled \"B\" should be in the second; arrows indicate the correct alignment.)"
       LayoutNGBlockFlow {DIV} at (16,56) size 320x0
         LayoutNGBlockFlow (floating) {P} at (4,4) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
-          LayoutText {#text} at (7,7) size 40x19
-            text run at (7,7) width 40: "\x{21E6} A 1"
+          LayoutText {#text} at (7,7) size 39x19
+            text run at (7,7) width 39: "\x{21E6} A 1"
         LayoutNGBlockFlow (floating) {P} at (138,4) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
           LayoutText {#text} at (7,7) size 40x19
             text run at (7,7) width 40: "\x{21E6} B 2"
         LayoutNGBlockFlow (floating) {P} at (4,46) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
-          LayoutText {#text} at (7,7) size 40x19
-            text run at (7,7) width 40: "\x{21E6} A 3"
+          LayoutText {#text} at (7,7) size 39x19
+            text run at (7,7) width 39: "\x{21E6} A 3"
         LayoutNGBlockFlow (floating) {P} at (190,46) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
           LayoutText {#text} at (79,7) size 40x19
             text run at (79,7) width 40: "B 4 \x{21E8}"
         LayoutNGBlockFlow (floating) {P} at (4,88) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
-          LayoutText {#text} at (7,7) size 40x19
-            text run at (7,7) width 40: "\x{21E6} A 5"
+          LayoutText {#text} at (7,7) size 39x19
+            text run at (7,7) width 39: "\x{21E6} A 5"
         LayoutNGBlockFlow (floating) {P} at (190,88) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
           LayoutText {#text} at (79,7) size 40x19
             text run at (79,7) width 40: "B 6 \x{21E8}"
         LayoutNGBlockFlow (floating) {P} at (4,130) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
-          LayoutText {#text} at (7,7) size 40x19
-            text run at (7,7) width 40: "\x{21E6} A 7"
+          LayoutText {#text} at (7,7) size 39x19
+            text run at (7,7) width 39: "\x{21E6} A 7"
         LayoutNGBlockFlow (floating) {P} at (138,130) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
           LayoutText {#text} at (7,7) size 40x19
             text run at (7,7) width 40: "\x{21E6} B 8"
         LayoutNGBlockFlow (floating) {P} at (4,172) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
-          LayoutText {#text} at (7,7) size 40x19
-            text run at (7,7) width 40: "\x{21E6} A 9"
+          LayoutText {#text} at (7,7) size 39x19
+            text run at (7,7) width 39: "\x{21E6} A 9"
         LayoutNGBlockFlow (floating) {P} at (190,172) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
           LayoutText {#text} at (71,7) size 48x19
             text run at (71,7) width 48: "B 10 \x{21E8}"
         LayoutNGBlockFlow (floating) {P} at (4,214) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
-          LayoutText {#text} at (7,7) size 48x19
-            text run at (7,7) width 48: "\x{21E6} A 11"
+          LayoutText {#text} at (7,7) size 46x19
+            text run at (7,7) width 46: "\x{21E6} A 11"
         LayoutNGBlockFlow (floating) {P} at (190,214) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
           LayoutText {#text} at (71,7) size 48x19
             text run at (71,7) width 48: "B 12 \x{21E8}"
         LayoutNGBlockFlow (floating) {P} at (4,256) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
-          LayoutText {#text} at (7,7) size 48x19
-            text run at (7,7) width 48: "\x{21E6} A 13"
+          LayoutText {#text} at (7,7) size 47x19
+            text run at (7,7) width 47: "\x{21E6} A 13"
         LayoutNGBlockFlow (floating) {P} at (138,256) size 126x34 [color=#FFFFFF] [bgcolor=#000080] [border: (3px solid #0000FF)]
           LayoutText {#text} at (7,7) size 48x19
             text run at (7,7) width 48: "\x{21E6} B 14"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c5525-fltcont-00-d-g-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c5525-fltcont-00-d-g-expected.png
index d880082..c87455b 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c5525-fltcont-00-d-g-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c5525-fltcont-00-d-g-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c5525-fltcont-00-d-g-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c5525-fltcont-00-d-g-expected.txt
index 79a7a52..711a73c 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c5525-fltcont-00-d-g-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c5525-fltcont-00-d-g-expected.txt
@@ -16,8 +16,8 @@
             text run at (0,0) width 277: "Inside this blue block on the right there"
             text run at (0,20) width 163: "should be a teal box. \x{21E8} "
           LayoutInline {SPAN} at (0,0) size 588x259 [color=#000080]
-            LayoutText {#text} at (163,20) size 588x259
-              text run at (163,20) width 114: "FAIL FAIL FAIL"
+            LayoutText {#text} at (162,20) size 588x259
+              text run at (162,20) width 115: "FAIL FAIL FAIL"
               text run at (0,40) width 277: "FAIL FAIL FAIL FAIL FAIL FAIL FAIL"
               text run at (0,60) width 277: "FAIL FAIL FAIL FAIL FAIL FAIL FAIL"
               text run at (0,80) width 588: "FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL"
@@ -29,5 +29,5 @@
               text run at (0,200) width 588: "FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL"
               text run at (0,220) width 588: "FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL"
               text run at (0,240) width 588: "FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL FAIL"
-              text run at (0,260) width 148: "FAIL FAIL FAIL FAIL"
+              text run at (0,260) width 149: "FAIL FAIL FAIL FAIL"
           LayoutText {#text} at (0,0) size 0x0
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c5525-fltwidth-00-c-g-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c5525-fltwidth-00-c-g-expected.png
index 3b08fbf3..be2cead4 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c5525-fltwidth-00-c-g-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c5525-fltwidth-00-c-g-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c5525-fltwidth-00-c-g-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c5525-fltwidth-00-c-g-expected.txt
index 7f5db35..99a1497a 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c5525-fltwidth-00-c-g-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c5525-fltwidth-00-c-g-expected.txt
@@ -4,8 +4,8 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 785x837
     LayoutNGBlockFlow {BODY} at (8,32) size 769x773
       LayoutNGBlockFlow {P} at (32,0) size 705x113 [color=#000080]
-        LayoutText {#text} at (0,2) size 673x110
-          text run at (0,2) width 673: "\x{21E9} The following blue box should be exactly half the"
+        LayoutText {#text} at (0,2) size 672x110
+          text run at (0,2) width 672: "\x{21E9} The following blue box should be exactly half the"
           text run at (0,39) width 641: "width of the viewport, on the left of the 50% ruler"
           text run at (0,76) width 74: "mark."
       LayoutNGBlockFlow (floating) {DIV} at (0,145) size 384.50x380 [color=#FFFFFF] [bgcolor=#0000FF]
@@ -28,7 +28,7 @@
           text run at (0,300) width 385: "float text ignore this float text ignore this float text"
           text run at (0,320) width 385: "ignore this float text ignore this float text ignore this"
           text run at (0,340) width 385: "float text ignore this float text ignore this float text"
-          text run at (0,360) width 255: "ignore this float text ignore this float"
+          text run at (0,360) width 257: "ignore this float text ignore this float"
       LayoutNGBlockFlow {DIV} at (0,145) size 769x520 [color=#C0C0C0]
         LayoutText {#text} at (384,0) size 769x519
           text run at (384,0) width 385: "this is some dummy text this is some dummy text this is"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c5525-fltwrap-00-b-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c5525-fltwrap-00-b-expected.png
new file mode 100644
index 0000000..b9c7ee70
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c5525-fltwrap-00-b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c5525-fltwrap-00-b-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c5525-fltwrap-00-b-expected.txt
new file mode 100644
index 0000000..3c0464b2
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t0905-c5525-fltwrap-00-b-expected.txt
@@ -0,0 +1,28 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x303
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x303
+    LayoutNGBlockFlow {BODY} at (8,8) size 784x287
+      LayoutNGBlockFlow (floating) {DIV} at (0,0) size 196x286 [color=#FFFFFF] [bgcolor=#000080]
+        LayoutNGBlockFlow {P} at (0,0) size 196x286
+          LayoutText {#text} at (0,2) size 185x283
+            text run at (0,2) width 136: "\x{21E6} This"
+            text run at (0,59) width 166: "blue box"
+            text run at (0,116) width 185: "should be"
+            text run at (0,173) width 118: "on the"
+            text run at (0,230) width 75: "left."
+      LayoutNGBlockFlow (floating) {DIV} at (588,0) size 196x286 [color=#FFFFFF] [bgcolor=#008080]
+        LayoutNGBlockFlow {P} at (0,0) size 196x286
+          LayoutText {#text} at (0,1) size 185x284
+            text run at (0,1) width 165: "This teal"
+            text run at (0,58) width 72: "box"
+            text run at (0,115) width 185: "should be"
+            text run at (0,172) width 118: "on the"
+            text run at (0,230) width 154: "right. \x{21E8}"
+      LayoutNGBlockFlow {P} at (0,0) size 784x287
+        LayoutText {#text} at (196,1) size 365x285
+          text run at (196,1) width 365: "This text should be"
+          text run at (196,58) width 335: "in between a blue"
+          text run at (196,116) width 317: "box on the \x{21E6}left"
+          text run at (196,173) width 326: "and a teal box on"
+          text run at (196,231) width 212: "the right\x{21E8}."
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t090501-c414-flt-ln-00-d-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t090501-c414-flt-ln-00-d-expected.png
index 7878170..990a4d5 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t090501-c414-flt-ln-00-d-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t090501-c414-flt-ln-00-d-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t090501-c414-flt-ln-00-d-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t090501-c414-flt-ln-00-d-expected.txt
index 78f6851..8909252 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t090501-c414-flt-ln-00-d-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t090501-c414-flt-ln-00-d-expected.txt
@@ -9,18 +9,18 @@
           text run at (0,20) width 778: "enough room for the big box to fit on the small box's line after the small box, in which case the big box should be level with"
           text run at (0,40) width 248: "the bottom of the respective small box)."
       LayoutNGBlockFlow {DIV} at (16,76) size 752x382 [color=#C0C0C0] [border: (5px solid #800080)]
-        LayoutText {#text} at (171,21) size 474x19
-          text run at (171,21) width 474: "dummy text dummy text dummy text dummy text dummy text dummy text "
+        LayoutText {#text} at (171,21) size 473x19
+          text run at (171,21) width 473: "dummy text dummy text dummy text dummy text dummy text dummy text "
         LayoutInline {SPAN} at (0,0) size 17x25 [color=#FFFFFF] [bgcolor=#008080] [border: (3px solid #00FFFF)]
-          LayoutText {#text} at (648,21) size 11x19
-            text run at (648,21) width 11: "A"
-        LayoutText {#text} at (662,21) size 4x19
-          text run at (662,21) width 4: " "
+          LayoutText {#text} at (647,21) size 11x19
+            text run at (647,21) width 11: "A"
+        LayoutText {#text} at (661,21) size 4x19
+          text run at (661,21) width 4: " "
         LayoutNGBlockFlow (floating) {P} at (21,21) size 150x58 [color=#FFFFFF] [bgcolor=#008080] [border: (3px solid #00FFFF)]
           LayoutText {#text} at (19,19) size 48x19
             text run at (19,19) width 48: "AAAA"
-        LayoutText {#text} at (666,21) size 543x39
-          text run at (666,21) width 48: "dummy"
+        LayoutText {#text} at (665,21) size 542x39
+          text run at (665,21) width 48: "dummy"
           text run at (171,41) width 422: "text dummy text dummy text dummy text dummy text dummy text "
         LayoutInline {SPAN} at (0,0) size 17x25 [color=#FFFFFF] [bgcolor=#800080] [border: (3px solid #FF00FF)]
           LayoutText {#text} at (596,41) size 11x19
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t090501-c414-flt-ln-02-d-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t090501-c414-flt-ln-02-d-expected.png
index 04c6a42..32072ed4 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t090501-c414-flt-ln-02-d-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t090501-c414-flt-ln-02-d-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t090501-c414-flt-ln-02-d-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t090501-c414-flt-ln-02-d-expected.txt
index 821129c..e5b374e7 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t090501-c414-flt-ln-02-d-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t090501-c414-flt-ln-02-d-expected.txt
@@ -9,18 +9,18 @@
           text run at (0,20) width 778: "enough room for the big box to fit on the small box's line after the small box, in which case the big box should be as high as"
           text run at (0,40) width 191: "possible below the small box)."
       LayoutNGBlockFlow {DIV} at (16,76) size 752x442 [color=#C0C0C0] [border: (5px solid #800080)]
-        LayoutText {#text} at (21,21) size 553x19
-          text run at (21,21) width 553: "dummy text dummy text dummy text dummy text dummy text dummy text dummy text "
+        LayoutText {#text} at (21,21) size 552x19
+          text run at (21,21) width 552: "dummy text dummy text dummy text dummy text dummy text dummy text dummy text "
         LayoutInline {SPAN} at (0,0) size 17x25 [color=#FFFFFF] [bgcolor=#008080] [border: (3px solid #00FFFF)]
-          LayoutText {#text} at (577,21) size 11x19
-            text run at (577,21) width 11: "A"
-        LayoutText {#text} at (591,21) size 4x19
-          text run at (591,21) width 4: " "
+          LayoutText {#text} at (576,21) size 11x19
+            text run at (576,21) width 11: "A"
+        LayoutText {#text} at (590,21) size 4x19
+          text run at (590,21) width 4: " "
         LayoutNGBlockFlow (floating) {P} at (21,41) size 150x58 [color=#FFFFFF] [bgcolor=#008080] [border: (3px solid #00FFFF)]
           LayoutText {#text} at (19,19) size 48x19
             text run at (19,19) width 48: "AAAA"
-        LayoutText {#text} at (595,21) size 551x39
-          text run at (595,21) width 127: "dummy text dummy"
+        LayoutText {#text} at (594,21) size 550x39
+          text run at (594,21) width 127: "dummy text dummy"
           text run at (171,41) width 343: "text dummy text dummy text dummy text dummy text "
         LayoutInline {SPAN} at (0,0) size 17x25 [color=#FFFFFF] [bgcolor=#800080] [border: (3px solid #FF00FF)]
           LayoutText {#text} at (517,41) size 11x19
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t090501-c414-flt-ln-03-d-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t090501-c414-flt-ln-03-d-expected.png
index fca53b1f..597e527c 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t090501-c414-flt-ln-03-d-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t090501-c414-flt-ln-03-d-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t090501-c414-flt-ln-03-d-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t090501-c414-flt-ln-03-d-expected.txt
index bbf5bdb..0e4c6e14 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t090501-c414-flt-ln-03-d-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t090501-c414-flt-ln-03-d-expected.txt
@@ -9,26 +9,26 @@
           text run at (0,20) width 778: "enough room for the big box to fit on the small box's line after the small box, in which case the big box should be as high as"
           text run at (0,40) width 191: "possible below the small box)."
       LayoutNGBlockFlow {DIV} at (16,76) size 752x362 [color=#C0C0C0] [border: (5px solid #800080)]
-        LayoutText {#text} at (171,21) size 316x19
-          text run at (171,21) width 316: "dummy text dummy text dummy text dummy text "
+        LayoutText {#text} at (171,21) size 315x19
+          text run at (171,21) width 315: "dummy text dummy text dummy text dummy text "
         LayoutInline {SPAN} at (0,0) size 17x25 [color=#FFFFFF] [bgcolor=#008080] [border: (3px solid #00FFFF)]
-          LayoutText {#text} at (490,21) size 11x19
-            text run at (490,21) width 11: "A"
-        LayoutText {#text} at (504,21) size 4x19
-          text run at (504,21) width 4: " "
+          LayoutText {#text} at (489,21) size 11x19
+            text run at (489,21) width 11: "A"
+        LayoutText {#text} at (503,21) size 4x19
+          text run at (503,21) width 4: " "
         LayoutNGBlockFlow (floating) {P} at (21,21) size 150x58 [color=#FFFFFF] [bgcolor=#008080] [border: (3px solid #00FFFF)]
           LayoutText {#text} at (19,19) size 48x19
             text run at (19,19) width 48: "AAAA"
         LayoutInline {SPAN} at (0,0) size 17x25 [color=#FFFFFF] [bgcolor=#800080] [border: (3px solid #FF00FF)]
-          LayoutText {#text} at (511,21) size 11x19
-            text run at (511,21) width 11: "B"
-        LayoutText {#text} at (525,21) size 4x19
-          text run at (525,21) width 4: " "
+          LayoutText {#text} at (510,21) size 11x19
+            text run at (510,21) width 11: "B"
+        LayoutText {#text} at (524,21) size 4x19
+          text run at (524,21) width 4: " "
         LayoutNGBlockFlow (floating) {P} at (581,21) size 150x58 [color=#FFFFFF] [bgcolor=#800080] [border: (3px solid #FF00FF)]
           LayoutText {#text} at (19,19) size 44x19
             text run at (19,19) width 44: "BBBB"
-        LayoutText {#text} at (529,21) size 707x319
-          text run at (529,21) width 48: "dummy"
+        LayoutText {#text} at (528,21) size 707x319
+          text run at (528,21) width 48: "dummy"
           text run at (171,41) width 391: "text dummy text dummy text dummy text dummy text dummy"
           text run at (171,61) width 391: "text dummy text dummy text dummy text dummy text dummy"
           text run at (21,81) width 707: "text dummy text dummy text dummy text dummy text dummy text dummy text dummy text dummy text dummy"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counter-08-b-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counter-08-b-expected.png
new file mode 100644
index 0000000..ed4a3578
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counter-08-b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counter-08-b-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counter-08-b-expected.txt
index 6b8aab30..e18a7848 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counter-08-b-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counter-08-b-expected.txt
@@ -85,41 +85,41 @@
               text run at (241,0) width 39: "XLIX"
         LayoutText {#text} at (280,0) size 4x19
           text run at (280,0) width 4: " "
-        LayoutInline {SPAN} at (0,0) size 10x19
-          LayoutInline {<pseudo:before>} at (0,0) size 10x19
-            LayoutCounter (anonymous) at (284,0) size 10x19
-              text run at (284,0) width 10: "L"
-        LayoutText {#text} at (294,0) size 4x19
-          text run at (294,0) width 4: " "
+        LayoutInline {SPAN} at (0,0) size 9x19
+          LayoutInline {<pseudo:before>} at (0,0) size 9x19
+            LayoutCounter (anonymous) at (284,0) size 9x19
+              text run at (284,0) width 9: "L"
+        LayoutText {#text} at (293,0) size 4x19
+          text run at (293,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 96x19
           LayoutInline {<pseudo:before>} at (0,0) size 96x19
-            LayoutCounter (anonymous) at (298,0) size 96x19
-              text run at (298,0) width 96: "CCCLXXXIX"
-        LayoutText {#text} at (394,0) size 4x19
-          text run at (394,0) width 4: " "
+            LayoutCounter (anonymous) at (297,0) size 96x19
+              text run at (297,0) width 96: "CCCLXXXIX"
+        LayoutText {#text} at (393,0) size 4x19
+          text run at (393,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 56x19
           LayoutInline {<pseudo:before>} at (0,0) size 56x19
-            LayoutCounter (anonymous) at (398,0) size 56x19
-              text run at (398,0) width 56: "CCCXC"
-        LayoutText {#text} at (454,0) size 4x19
-          text run at (454,0) width 4: " "
+            LayoutCounter (anonymous) at (397,0) size 56x19
+              text run at (397,0) width 56: "CCCXC"
+        LayoutText {#text} at (453,0) size 4x19
+          text run at (453,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 128x19
           LayoutInline {<pseudo:before>} at (0,0) size 128x19
-            LayoutCounter (anonymous) at (458,0) size 128x19
-              text run at (458,0) width 128: "MMMCDLXXXIX"
-        LayoutText {#text} at (586,0) size 4x19
-          text run at (586,0) width 4: " "
+            LayoutCounter (anonymous) at (457,0) size 128x19
+              text run at (457,0) width 128: "MMMCDLXXXIX"
+        LayoutText {#text} at (585,0) size 4x19
+          text run at (585,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 88x19
           LayoutInline {<pseudo:before>} at (0,0) size 88x19
-            LayoutCounter (anonymous) at (590,0) size 88x19
-              text run at (590,0) width 88: "MMMCDXC"
-        LayoutText {#text} at (678,0) size 4x19
-          text run at (678,0) width 4: " "
+            LayoutCounter (anonymous) at (589,0) size 88x19
+              text run at (589,0) width 88: "MMMCDXC"
+        LayoutText {#text} at (677,0) size 4x19
+          text run at (677,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 93x19
           LayoutInline {<pseudo:before>} at (0,0) size 93x19
-            LayoutCounter (anonymous) at (682,0) size 93x19
-              text run at (682,0) width 93: "MMMCDXCI"
+            LayoutCounter (anonymous) at (681,0) size 93x19
+              text run at (681,0) width 93: "MMMCDXCI"
         LayoutText {#text} at (0,0) size 0x0
       LayoutNGBlockFlow {DIV} at (0,56) size 784x20
-        LayoutText {#text} at (0,0) size 775x19
-          text run at (0,0) width 775: "I II III IV V VI VII VIII IX X XI XII XLIX L CCCLXXXIX CCCXC MMMCDLXXXIX MMMCDXC MMMCDXCI"
+        LayoutText {#text} at (0,0) size 774x19
+          text run at (0,0) width 774: "I II III IV V VI VII VIII IX X XI XII XLIX L CCCLXXXIX CCCXC MMMCDLXXXIX MMMCDXC MMMCDXCI"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counter-13-b-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counter-13-b-expected.png
new file mode 100644
index 0000000..6820560
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counter-13-b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counter-13-b-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counter-13-b-expected.txt
index f5dd16fd..6d2ccc67 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counter-13-b-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counter-13-b-expected.txt
@@ -7,77 +7,77 @@
         LayoutText {#text} at (0,0) size 292x19
           text run at (0,0) width 292: "The following two lines should look the same:"
       LayoutNGBlockFlow {DIV} at (0,36) size 784x20
-        LayoutInline {SPAN} at (0,0) size 12x19
-          LayoutInline {<pseudo:before>} at (0,0) size 12x19
-            LayoutCounter (anonymous) at (0,0) size 12x19
-              text run at (0,0) width 12: "A"
-        LayoutText {#text} at (12,0) size 4x19
-          text run at (12,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 11x19
           LayoutInline {<pseudo:before>} at (0,0) size 11x19
-            LayoutCounter (anonymous) at (16,0) size 11x19
-              text run at (16,0) width 11: "B"
-        LayoutText {#text} at (27,0) size 4x19
-          text run at (27,0) width 4: " "
+            LayoutCounter (anonymous) at (0,0) size 11x19
+              text run at (0,0) width 11: "A"
+        LayoutText {#text} at (11,0) size 4x19
+          text run at (11,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 11x19
           LayoutInline {<pseudo:before>} at (0,0) size 11x19
-            LayoutCounter (anonymous) at (31,0) size 11x19
-              text run at (31,0) width 11: "C"
-        LayoutText {#text} at (42,0) size 4x19
-          text run at (42,0) width 4: " "
+            LayoutCounter (anonymous) at (15,0) size 11x19
+              text run at (15,0) width 11: "B"
+        LayoutText {#text} at (26,0) size 4x19
+          text run at (26,0) width 4: " "
+        LayoutInline {SPAN} at (0,0) size 11x19
+          LayoutInline {<pseudo:before>} at (0,0) size 11x19
+            LayoutCounter (anonymous) at (30,0) size 11x19
+              text run at (30,0) width 11: "C"
+        LayoutText {#text} at (41,0) size 4x19
+          text run at (41,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 12x19
           LayoutInline {<pseudo:before>} at (0,0) size 12x19
-            LayoutCounter (anonymous) at (46,0) size 12x19
-              text run at (46,0) width 12: "D"
-        LayoutText {#text} at (58,0) size 4x19
-          text run at (58,0) width 4: " "
+            LayoutCounter (anonymous) at (45,0) size 12x19
+              text run at (45,0) width 12: "D"
+        LayoutText {#text} at (57,0) size 4x19
+          text run at (57,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 10x19
           LayoutInline {<pseudo:before>} at (0,0) size 10x19
-            LayoutCounter (anonymous) at (62,0) size 10x19
-              text run at (62,0) width 10: "E"
-        LayoutText {#text} at (72,0) size 4x19
-          text run at (72,0) width 4: " "
+            LayoutCounter (anonymous) at (61,0) size 10x19
+              text run at (61,0) width 10: "E"
+        LayoutText {#text} at (71,0) size 4x19
+          text run at (71,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 9x19
           LayoutInline {<pseudo:before>} at (0,0) size 9x19
-            LayoutCounter (anonymous) at (76,0) size 9x19
-              text run at (76,0) width 9: "F"
-        LayoutText {#text} at (85,0) size 4x19
-          text run at (85,0) width 4: " "
+            LayoutCounter (anonymous) at (75,0) size 9x19
+              text run at (75,0) width 9: "F"
+        LayoutText {#text} at (84,0) size 4x19
+          text run at (84,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 12x19
           LayoutInline {<pseudo:before>} at (0,0) size 12x19
-            LayoutCounter (anonymous) at (89,0) size 12x19
-              text run at (89,0) width 12: "G"
-        LayoutText {#text} at (101,0) size 4x19
-          text run at (101,0) width 4: " "
+            LayoutCounter (anonymous) at (88,0) size 12x19
+              text run at (88,0) width 12: "G"
+        LayoutText {#text} at (100,0) size 4x19
+          text run at (100,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 12x19
           LayoutInline {<pseudo:before>} at (0,0) size 12x19
-            LayoutCounter (anonymous) at (105,0) size 12x19
-              text run at (105,0) width 12: "H"
-        LayoutText {#text} at (117,0) size 4x19
-          text run at (117,0) width 4: " "
+            LayoutCounter (anonymous) at (104,0) size 12x19
+              text run at (104,0) width 12: "H"
+        LayoutText {#text} at (116,0) size 4x19
+          text run at (116,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 5x19
           LayoutInline {<pseudo:before>} at (0,0) size 5x19
-            LayoutCounter (anonymous) at (121,0) size 5x19
-              text run at (121,0) width 5: "I"
-        LayoutText {#text} at (126,0) size 4x19
-          text run at (126,0) width 4: " "
+            LayoutCounter (anonymous) at (120,0) size 5x19
+              text run at (120,0) width 5: "I"
+        LayoutText {#text} at (125,0) size 4x19
+          text run at (125,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 6x19
           LayoutInline {<pseudo:before>} at (0,0) size 6x19
-            LayoutCounter (anonymous) at (130,0) size 6x19
-              text run at (130,0) width 6: "J"
-        LayoutText {#text} at (136,0) size 4x19
-          text run at (136,0) width 4: " "
+            LayoutCounter (anonymous) at (129,0) size 6x19
+              text run at (129,0) width 6: "J"
+        LayoutText {#text} at (135,0) size 4x19
+          text run at (135,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 12x19
           LayoutInline {<pseudo:before>} at (0,0) size 12x19
-            LayoutCounter (anonymous) at (140,0) size 12x19
-              text run at (140,0) width 12: "K"
-        LayoutText {#text} at (152,0) size 4x19
-          text run at (152,0) width 4: " "
+            LayoutCounter (anonymous) at (139,0) size 12x19
+              text run at (139,0) width 12: "K"
+        LayoutText {#text} at (151,0) size 4x19
+          text run at (151,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 10x19
           LayoutInline {<pseudo:before>} at (0,0) size 10x19
-            LayoutCounter (anonymous) at (156,0) size 10x19
-              text run at (156,0) width 10: "L"
+            LayoutCounter (anonymous) at (155,0) size 10x19
+              text run at (155,0) width 10: "L"
         LayoutText {#text} at (0,0) size 0x0
       LayoutNGBlockFlow {DIV} at (0,56) size 784x20
-        LayoutText {#text} at (0,0) size 166x19
-          text run at (0,0) width 166: "A B C D E F G H I J K L"
+        LayoutText {#text} at (0,0) size 165x19
+          text run at (0,0) width 165: "A B C D E F G H I J K L"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counter-14-b-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counter-14-b-expected.png
new file mode 100644
index 0000000..6820560
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counter-14-b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counter-14-b-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counter-14-b-expected.txt
index f5dd16fd..6d2ccc67 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counter-14-b-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counter-14-b-expected.txt
@@ -7,77 +7,77 @@
         LayoutText {#text} at (0,0) size 292x19
           text run at (0,0) width 292: "The following two lines should look the same:"
       LayoutNGBlockFlow {DIV} at (0,36) size 784x20
-        LayoutInline {SPAN} at (0,0) size 12x19
-          LayoutInline {<pseudo:before>} at (0,0) size 12x19
-            LayoutCounter (anonymous) at (0,0) size 12x19
-              text run at (0,0) width 12: "A"
-        LayoutText {#text} at (12,0) size 4x19
-          text run at (12,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 11x19
           LayoutInline {<pseudo:before>} at (0,0) size 11x19
-            LayoutCounter (anonymous) at (16,0) size 11x19
-              text run at (16,0) width 11: "B"
-        LayoutText {#text} at (27,0) size 4x19
-          text run at (27,0) width 4: " "
+            LayoutCounter (anonymous) at (0,0) size 11x19
+              text run at (0,0) width 11: "A"
+        LayoutText {#text} at (11,0) size 4x19
+          text run at (11,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 11x19
           LayoutInline {<pseudo:before>} at (0,0) size 11x19
-            LayoutCounter (anonymous) at (31,0) size 11x19
-              text run at (31,0) width 11: "C"
-        LayoutText {#text} at (42,0) size 4x19
-          text run at (42,0) width 4: " "
+            LayoutCounter (anonymous) at (15,0) size 11x19
+              text run at (15,0) width 11: "B"
+        LayoutText {#text} at (26,0) size 4x19
+          text run at (26,0) width 4: " "
+        LayoutInline {SPAN} at (0,0) size 11x19
+          LayoutInline {<pseudo:before>} at (0,0) size 11x19
+            LayoutCounter (anonymous) at (30,0) size 11x19
+              text run at (30,0) width 11: "C"
+        LayoutText {#text} at (41,0) size 4x19
+          text run at (41,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 12x19
           LayoutInline {<pseudo:before>} at (0,0) size 12x19
-            LayoutCounter (anonymous) at (46,0) size 12x19
-              text run at (46,0) width 12: "D"
-        LayoutText {#text} at (58,0) size 4x19
-          text run at (58,0) width 4: " "
+            LayoutCounter (anonymous) at (45,0) size 12x19
+              text run at (45,0) width 12: "D"
+        LayoutText {#text} at (57,0) size 4x19
+          text run at (57,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 10x19
           LayoutInline {<pseudo:before>} at (0,0) size 10x19
-            LayoutCounter (anonymous) at (62,0) size 10x19
-              text run at (62,0) width 10: "E"
-        LayoutText {#text} at (72,0) size 4x19
-          text run at (72,0) width 4: " "
+            LayoutCounter (anonymous) at (61,0) size 10x19
+              text run at (61,0) width 10: "E"
+        LayoutText {#text} at (71,0) size 4x19
+          text run at (71,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 9x19
           LayoutInline {<pseudo:before>} at (0,0) size 9x19
-            LayoutCounter (anonymous) at (76,0) size 9x19
-              text run at (76,0) width 9: "F"
-        LayoutText {#text} at (85,0) size 4x19
-          text run at (85,0) width 4: " "
+            LayoutCounter (anonymous) at (75,0) size 9x19
+              text run at (75,0) width 9: "F"
+        LayoutText {#text} at (84,0) size 4x19
+          text run at (84,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 12x19
           LayoutInline {<pseudo:before>} at (0,0) size 12x19
-            LayoutCounter (anonymous) at (89,0) size 12x19
-              text run at (89,0) width 12: "G"
-        LayoutText {#text} at (101,0) size 4x19
-          text run at (101,0) width 4: " "
+            LayoutCounter (anonymous) at (88,0) size 12x19
+              text run at (88,0) width 12: "G"
+        LayoutText {#text} at (100,0) size 4x19
+          text run at (100,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 12x19
           LayoutInline {<pseudo:before>} at (0,0) size 12x19
-            LayoutCounter (anonymous) at (105,0) size 12x19
-              text run at (105,0) width 12: "H"
-        LayoutText {#text} at (117,0) size 4x19
-          text run at (117,0) width 4: " "
+            LayoutCounter (anonymous) at (104,0) size 12x19
+              text run at (104,0) width 12: "H"
+        LayoutText {#text} at (116,0) size 4x19
+          text run at (116,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 5x19
           LayoutInline {<pseudo:before>} at (0,0) size 5x19
-            LayoutCounter (anonymous) at (121,0) size 5x19
-              text run at (121,0) width 5: "I"
-        LayoutText {#text} at (126,0) size 4x19
-          text run at (126,0) width 4: " "
+            LayoutCounter (anonymous) at (120,0) size 5x19
+              text run at (120,0) width 5: "I"
+        LayoutText {#text} at (125,0) size 4x19
+          text run at (125,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 6x19
           LayoutInline {<pseudo:before>} at (0,0) size 6x19
-            LayoutCounter (anonymous) at (130,0) size 6x19
-              text run at (130,0) width 6: "J"
-        LayoutText {#text} at (136,0) size 4x19
-          text run at (136,0) width 4: " "
+            LayoutCounter (anonymous) at (129,0) size 6x19
+              text run at (129,0) width 6: "J"
+        LayoutText {#text} at (135,0) size 4x19
+          text run at (135,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 12x19
           LayoutInline {<pseudo:before>} at (0,0) size 12x19
-            LayoutCounter (anonymous) at (140,0) size 12x19
-              text run at (140,0) width 12: "K"
-        LayoutText {#text} at (152,0) size 4x19
-          text run at (152,0) width 4: " "
+            LayoutCounter (anonymous) at (139,0) size 12x19
+              text run at (139,0) width 12: "K"
+        LayoutText {#text} at (151,0) size 4x19
+          text run at (151,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 10x19
           LayoutInline {<pseudo:before>} at (0,0) size 10x19
-            LayoutCounter (anonymous) at (156,0) size 10x19
-              text run at (156,0) width 10: "L"
+            LayoutCounter (anonymous) at (155,0) size 10x19
+              text run at (155,0) width 10: "L"
         LayoutText {#text} at (0,0) size 0x0
       LayoutNGBlockFlow {DIV} at (0,56) size 784x20
-        LayoutText {#text} at (0,0) size 166x19
-          text run at (0,0) width 166: "A B C D E F G H I J K L"
+        LayoutText {#text} at (0,0) size 165x19
+          text run at (0,0) width 165: "A B C D E F G H I J K L"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counters-08-b-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counters-08-b-expected.png
new file mode 100644
index 0000000..908334c
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counters-08-b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counters-08-b-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counters-08-b-expected.txt
index aba317f..9668672 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counters-08-b-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counters-08-b-expected.txt
@@ -1,4 +1,4 @@
-layer at (0,0) size 800x600 scrollWidth 954
+layer at (0,0) size 800x600 scrollWidth 953
   LayoutView at (0,0) size 800x600
 layer at (0,0) size 800x100
   LayoutNGBlockFlow {HTML} at (0,0) size 800x100
@@ -85,41 +85,41 @@
               text run at (349,0) width 48: "I.XLIX"
         LayoutText {#text} at (397,0) size 4x19
           text run at (397,0) width 4: " "
-        LayoutInline {SPAN} at (0,0) size 19x19
-          LayoutInline {<pseudo:before>} at (0,0) size 19x19
-            LayoutCounter (anonymous) at (401,0) size 19x19
-              text run at (401,0) width 19: "I.L"
-        LayoutText {#text} at (420,0) size 4x19
-          text run at (420,0) width 4: " "
+        LayoutInline {SPAN} at (0,0) size 18x19
+          LayoutInline {<pseudo:before>} at (0,0) size 18x19
+            LayoutCounter (anonymous) at (401,0) size 18x19
+              text run at (401,0) width 18: "I.L"
+        LayoutText {#text} at (419,0) size 4x19
+          text run at (419,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 105x19
           LayoutInline {<pseudo:before>} at (0,0) size 105x19
-            LayoutCounter (anonymous) at (424,0) size 105x19
-              text run at (424,0) width 105: "I.CCCLXXXIX"
-        LayoutText {#text} at (529,0) size 4x19
-          text run at (529,0) width 4: " "
+            LayoutCounter (anonymous) at (423,0) size 105x19
+              text run at (423,0) width 105: "I.CCCLXXXIX"
+        LayoutText {#text} at (528,0) size 4x19
+          text run at (528,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 65x19
           LayoutInline {<pseudo:before>} at (0,0) size 65x19
-            LayoutCounter (anonymous) at (533,0) size 65x19
-              text run at (533,0) width 65: "I.CCCXC"
-        LayoutText {#text} at (598,0) size 4x19
-          text run at (598,0) width 4: " "
+            LayoutCounter (anonymous) at (532,0) size 65x19
+              text run at (532,0) width 65: "I.CCCXC"
+        LayoutText {#text} at (597,0) size 4x19
+          text run at (597,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 137x19
           LayoutInline {<pseudo:before>} at (0,0) size 137x19
-            LayoutCounter (anonymous) at (602,0) size 137x19
-              text run at (602,0) width 137: "I.MMMCDLXXXIX"
-        LayoutText {#text} at (739,0) size 4x19
-          text run at (739,0) width 4: " "
+            LayoutCounter (anonymous) at (601,0) size 137x19
+              text run at (601,0) width 137: "I.MMMCDLXXXIX"
+        LayoutText {#text} at (738,0) size 4x19
+          text run at (738,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 97x19
           LayoutInline {<pseudo:before>} at (0,0) size 97x19
-            LayoutCounter (anonymous) at (743,0) size 97x19
-              text run at (743,0) width 97: "I.MMMCDXC"
-        LayoutText {#text} at (840,0) size 4x19
-          text run at (840,0) width 4: " "
+            LayoutCounter (anonymous) at (742,0) size 97x19
+              text run at (742,0) width 97: "I.MMMCDXC"
+        LayoutText {#text} at (839,0) size 4x19
+          text run at (839,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 102x19
           LayoutInline {<pseudo:before>} at (0,0) size 102x19
-            LayoutCounter (anonymous) at (844,0) size 102x19
-              text run at (844,0) width 102: "I.MMMCDXCI"
+            LayoutCounter (anonymous) at (843,0) size 102x19
+              text run at (843,0) width 102: "I.MMMCDXCI"
         LayoutText {#text} at (0,0) size 0x0
       LayoutNGBlockFlow {DIV} at (0,56) size 784x20
-        LayoutText {#text} at (0,0) size 946x19
-          text run at (0,0) width 946: "I.I I.II I.III I.IV I.V I.VI I.VII I.VIII I.IX I.X I.XI I.XII I.XLIX I.L I.CCCLXXXIX I.CCCXC I.MMMCDLXXXIX I.MMMCDXC I.MMMCDXCI"
+        LayoutText {#text} at (0,0) size 945x19
+          text run at (0,0) width 945: "I.I I.II I.III I.IV I.V I.VI I.VII I.VIII I.IX I.X I.XI I.XII I.XLIX I.L I.CCCLXXXIX I.CCCXC I.MMMCDLXXXIX I.MMMCDXC I.MMMCDXCI"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counters-13-b-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counters-13-b-expected.png
index 5b8fa6b..8302c3e7 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counters-13-b-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counters-13-b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counters-13-b-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counters-13-b-expected.txt
index dc95e2b..fe075f7 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counters-13-b-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counters-13-b-expected.txt
@@ -7,77 +7,77 @@
         LayoutText {#text} at (0,0) size 292x19
           text run at (0,0) width 292: "The following two lines should look the same:"
       LayoutNGBlockFlow {DIV} at (0,36) size 784x20
-        LayoutInline {SPAN} at (0,0) size 28x19
-          LayoutInline {<pseudo:before>} at (0,0) size 28x19
-            LayoutCounter (anonymous) at (0,0) size 28x19
-              text run at (0,0) width 28: "A.A"
-        LayoutText {#text} at (28,0) size 3x19
-          text run at (28,0) width 3: " "
         LayoutInline {SPAN} at (0,0) size 27x19
           LayoutInline {<pseudo:before>} at (0,0) size 27x19
-            LayoutCounter (anonymous) at (31,0) size 27x19
-              text run at (31,0) width 27: "A.B"
-        LayoutText {#text} at (58,0) size 4x19
-          text run at (58,0) width 4: " "
+            LayoutCounter (anonymous) at (0,0) size 27x19
+              text run at (0,0) width 27: "A.A"
+        LayoutText {#text} at (27,0) size 3x19
+          text run at (27,0) width 3: " "
         LayoutInline {SPAN} at (0,0) size 27x19
           LayoutInline {<pseudo:before>} at (0,0) size 27x19
-            LayoutCounter (anonymous) at (62,0) size 27x19
-              text run at (62,0) width 27: "A.C"
-        LayoutText {#text} at (89,0) size 4x19
-          text run at (89,0) width 4: " "
+            LayoutCounter (anonymous) at (30,0) size 27x19
+              text run at (30,0) width 27: "A.B"
+        LayoutText {#text} at (57,0) size 3x19
+          text run at (57,0) width 3: " "
+        LayoutInline {SPAN} at (0,0) size 27x19
+          LayoutInline {<pseudo:before>} at (0,0) size 27x19
+            LayoutCounter (anonymous) at (60,0) size 27x19
+              text run at (60,0) width 27: "A.C"
+        LayoutText {#text} at (87,0) size 3x19
+          text run at (87,0) width 3: " "
         LayoutInline {SPAN} at (0,0) size 28x19
           LayoutInline {<pseudo:before>} at (0,0) size 28x19
-            LayoutCounter (anonymous) at (93,0) size 28x19
-              text run at (93,0) width 28: "A.D"
-        LayoutText {#text} at (121,0) size 4x19
-          text run at (121,0) width 4: " "
+            LayoutCounter (anonymous) at (90,0) size 28x19
+              text run at (90,0) width 28: "A.D"
+        LayoutText {#text} at (118,0) size 3x19
+          text run at (118,0) width 3: " "
         LayoutInline {SPAN} at (0,0) size 26x19
           LayoutInline {<pseudo:before>} at (0,0) size 26x19
-            LayoutCounter (anonymous) at (125,0) size 26x19
-              text run at (125,0) width 26: "A.E"
-        LayoutText {#text} at (151,0) size 4x19
-          text run at (151,0) width 4: " "
+            LayoutCounter (anonymous) at (121,0) size 26x19
+              text run at (121,0) width 26: "A.E"
+        LayoutText {#text} at (147,0) size 3x19
+          text run at (147,0) width 3: " "
         LayoutInline {SPAN} at (0,0) size 25x19
           LayoutInline {<pseudo:before>} at (0,0) size 25x19
-            LayoutCounter (anonymous) at (155,0) size 25x19
-              text run at (155,0) width 25: "A.F"
-        LayoutText {#text} at (180,0) size 4x19
-          text run at (180,0) width 4: " "
+            LayoutCounter (anonymous) at (150,0) size 25x19
+              text run at (150,0) width 25: "A.F"
+        LayoutText {#text} at (175,0) size 3x19
+          text run at (175,0) width 3: " "
         LayoutInline {SPAN} at (0,0) size 28x19
           LayoutInline {<pseudo:before>} at (0,0) size 28x19
-            LayoutCounter (anonymous) at (184,0) size 28x19
-              text run at (184,0) width 28: "A.G"
-        LayoutText {#text} at (212,0) size 4x19
-          text run at (212,0) width 4: " "
+            LayoutCounter (anonymous) at (178,0) size 28x19
+              text run at (178,0) width 28: "A.G"
+        LayoutText {#text} at (206,0) size 3x19
+          text run at (206,0) width 3: " "
         LayoutInline {SPAN} at (0,0) size 28x19
           LayoutInline {<pseudo:before>} at (0,0) size 28x19
-            LayoutCounter (anonymous) at (216,0) size 28x19
-              text run at (216,0) width 28: "A.H"
-        LayoutText {#text} at (244,0) size 4x19
-          text run at (244,0) width 4: " "
+            LayoutCounter (anonymous) at (209,0) size 28x19
+              text run at (209,0) width 28: "A.H"
+        LayoutText {#text} at (237,0) size 3x19
+          text run at (237,0) width 3: " "
         LayoutInline {SPAN} at (0,0) size 21x19
           LayoutInline {<pseudo:before>} at (0,0) size 21x19
-            LayoutCounter (anonymous) at (248,0) size 21x19
-              text run at (248,0) width 21: "A.I"
-        LayoutText {#text} at (269,0) size 4x19
-          text run at (269,0) width 4: " "
+            LayoutCounter (anonymous) at (240,0) size 21x19
+              text run at (240,0) width 21: "A.I"
+        LayoutText {#text} at (261,0) size 3x19
+          text run at (261,0) width 3: " "
         LayoutInline {SPAN} at (0,0) size 22x19
           LayoutInline {<pseudo:before>} at (0,0) size 22x19
-            LayoutCounter (anonymous) at (273,0) size 22x19
-              text run at (273,0) width 22: "A.J"
-        LayoutText {#text} at (295,0) size 4x19
-          text run at (295,0) width 4: " "
+            LayoutCounter (anonymous) at (264,0) size 22x19
+              text run at (264,0) width 22: "A.J"
+        LayoutText {#text} at (286,0) size 3x19
+          text run at (286,0) width 3: " "
         LayoutInline {SPAN} at (0,0) size 28x19
           LayoutInline {<pseudo:before>} at (0,0) size 28x19
-            LayoutCounter (anonymous) at (299,0) size 28x19
-              text run at (299,0) width 28: "A.K"
-        LayoutText {#text} at (327,0) size 4x19
-          text run at (327,0) width 4: " "
+            LayoutCounter (anonymous) at (289,0) size 28x19
+              text run at (289,0) width 28: "A.K"
+        LayoutText {#text} at (317,0) size 3x19
+          text run at (317,0) width 3: " "
         LayoutInline {SPAN} at (0,0) size 26x19
           LayoutInline {<pseudo:before>} at (0,0) size 26x19
-            LayoutCounter (anonymous) at (331,0) size 26x19
-              text run at (331,0) width 26: "A.L"
+            LayoutCounter (anonymous) at (320,0) size 26x19
+              text run at (320,0) width 26: "A.L"
         LayoutText {#text} at (0,0) size 0x0
       LayoutNGBlockFlow {DIV} at (0,56) size 784x20
-        LayoutText {#text} at (0,0) size 357x19
-          text run at (0,0) width 357: "A.A A.B A.C A.D A.E A.F A.G A.H A.I A.J A.K A.L"
+        LayoutText {#text} at (0,0) size 346x19
+          text run at (0,0) width 346: "A.A A.B A.C A.D A.E A.F A.G A.H A.I A.J A.K A.L"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counters-14-b-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counters-14-b-expected.png
index 5b8fa6b..8302c3e7 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counters-14-b-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counters-14-b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counters-14-b-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counters-14-b-expected.txt
index dc95e2b..fe075f7 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counters-14-b-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1202-counters-14-b-expected.txt
@@ -7,77 +7,77 @@
         LayoutText {#text} at (0,0) size 292x19
           text run at (0,0) width 292: "The following two lines should look the same:"
       LayoutNGBlockFlow {DIV} at (0,36) size 784x20
-        LayoutInline {SPAN} at (0,0) size 28x19
-          LayoutInline {<pseudo:before>} at (0,0) size 28x19
-            LayoutCounter (anonymous) at (0,0) size 28x19
-              text run at (0,0) width 28: "A.A"
-        LayoutText {#text} at (28,0) size 3x19
-          text run at (28,0) width 3: " "
         LayoutInline {SPAN} at (0,0) size 27x19
           LayoutInline {<pseudo:before>} at (0,0) size 27x19
-            LayoutCounter (anonymous) at (31,0) size 27x19
-              text run at (31,0) width 27: "A.B"
-        LayoutText {#text} at (58,0) size 4x19
-          text run at (58,0) width 4: " "
+            LayoutCounter (anonymous) at (0,0) size 27x19
+              text run at (0,0) width 27: "A.A"
+        LayoutText {#text} at (27,0) size 3x19
+          text run at (27,0) width 3: " "
         LayoutInline {SPAN} at (0,0) size 27x19
           LayoutInline {<pseudo:before>} at (0,0) size 27x19
-            LayoutCounter (anonymous) at (62,0) size 27x19
-              text run at (62,0) width 27: "A.C"
-        LayoutText {#text} at (89,0) size 4x19
-          text run at (89,0) width 4: " "
+            LayoutCounter (anonymous) at (30,0) size 27x19
+              text run at (30,0) width 27: "A.B"
+        LayoutText {#text} at (57,0) size 3x19
+          text run at (57,0) width 3: " "
+        LayoutInline {SPAN} at (0,0) size 27x19
+          LayoutInline {<pseudo:before>} at (0,0) size 27x19
+            LayoutCounter (anonymous) at (60,0) size 27x19
+              text run at (60,0) width 27: "A.C"
+        LayoutText {#text} at (87,0) size 3x19
+          text run at (87,0) width 3: " "
         LayoutInline {SPAN} at (0,0) size 28x19
           LayoutInline {<pseudo:before>} at (0,0) size 28x19
-            LayoutCounter (anonymous) at (93,0) size 28x19
-              text run at (93,0) width 28: "A.D"
-        LayoutText {#text} at (121,0) size 4x19
-          text run at (121,0) width 4: " "
+            LayoutCounter (anonymous) at (90,0) size 28x19
+              text run at (90,0) width 28: "A.D"
+        LayoutText {#text} at (118,0) size 3x19
+          text run at (118,0) width 3: " "
         LayoutInline {SPAN} at (0,0) size 26x19
           LayoutInline {<pseudo:before>} at (0,0) size 26x19
-            LayoutCounter (anonymous) at (125,0) size 26x19
-              text run at (125,0) width 26: "A.E"
-        LayoutText {#text} at (151,0) size 4x19
-          text run at (151,0) width 4: " "
+            LayoutCounter (anonymous) at (121,0) size 26x19
+              text run at (121,0) width 26: "A.E"
+        LayoutText {#text} at (147,0) size 3x19
+          text run at (147,0) width 3: " "
         LayoutInline {SPAN} at (0,0) size 25x19
           LayoutInline {<pseudo:before>} at (0,0) size 25x19
-            LayoutCounter (anonymous) at (155,0) size 25x19
-              text run at (155,0) width 25: "A.F"
-        LayoutText {#text} at (180,0) size 4x19
-          text run at (180,0) width 4: " "
+            LayoutCounter (anonymous) at (150,0) size 25x19
+              text run at (150,0) width 25: "A.F"
+        LayoutText {#text} at (175,0) size 3x19
+          text run at (175,0) width 3: " "
         LayoutInline {SPAN} at (0,0) size 28x19
           LayoutInline {<pseudo:before>} at (0,0) size 28x19
-            LayoutCounter (anonymous) at (184,0) size 28x19
-              text run at (184,0) width 28: "A.G"
-        LayoutText {#text} at (212,0) size 4x19
-          text run at (212,0) width 4: " "
+            LayoutCounter (anonymous) at (178,0) size 28x19
+              text run at (178,0) width 28: "A.G"
+        LayoutText {#text} at (206,0) size 3x19
+          text run at (206,0) width 3: " "
         LayoutInline {SPAN} at (0,0) size 28x19
           LayoutInline {<pseudo:before>} at (0,0) size 28x19
-            LayoutCounter (anonymous) at (216,0) size 28x19
-              text run at (216,0) width 28: "A.H"
-        LayoutText {#text} at (244,0) size 4x19
-          text run at (244,0) width 4: " "
+            LayoutCounter (anonymous) at (209,0) size 28x19
+              text run at (209,0) width 28: "A.H"
+        LayoutText {#text} at (237,0) size 3x19
+          text run at (237,0) width 3: " "
         LayoutInline {SPAN} at (0,0) size 21x19
           LayoutInline {<pseudo:before>} at (0,0) size 21x19
-            LayoutCounter (anonymous) at (248,0) size 21x19
-              text run at (248,0) width 21: "A.I"
-        LayoutText {#text} at (269,0) size 4x19
-          text run at (269,0) width 4: " "
+            LayoutCounter (anonymous) at (240,0) size 21x19
+              text run at (240,0) width 21: "A.I"
+        LayoutText {#text} at (261,0) size 3x19
+          text run at (261,0) width 3: " "
         LayoutInline {SPAN} at (0,0) size 22x19
           LayoutInline {<pseudo:before>} at (0,0) size 22x19
-            LayoutCounter (anonymous) at (273,0) size 22x19
-              text run at (273,0) width 22: "A.J"
-        LayoutText {#text} at (295,0) size 4x19
-          text run at (295,0) width 4: " "
+            LayoutCounter (anonymous) at (264,0) size 22x19
+              text run at (264,0) width 22: "A.J"
+        LayoutText {#text} at (286,0) size 3x19
+          text run at (286,0) width 3: " "
         LayoutInline {SPAN} at (0,0) size 28x19
           LayoutInline {<pseudo:before>} at (0,0) size 28x19
-            LayoutCounter (anonymous) at (299,0) size 28x19
-              text run at (299,0) width 28: "A.K"
-        LayoutText {#text} at (327,0) size 4x19
-          text run at (327,0) width 4: " "
+            LayoutCounter (anonymous) at (289,0) size 28x19
+              text run at (289,0) width 28: "A.K"
+        LayoutText {#text} at (317,0) size 3x19
+          text run at (317,0) width 3: " "
         LayoutInline {SPAN} at (0,0) size 26x19
           LayoutInline {<pseudo:before>} at (0,0) size 26x19
-            LayoutCounter (anonymous) at (331,0) size 26x19
-              text run at (331,0) width 26: "A.L"
+            LayoutCounter (anonymous) at (320,0) size 26x19
+              text run at (320,0) width 26: "A.L"
         LayoutText {#text} at (0,0) size 0x0
       LayoutNGBlockFlow {DIV} at (0,56) size 784x20
-        LayoutText {#text} at (0,0) size 357x19
-          text run at (0,0) width 357: "A.A A.B A.C A.D A.E A.F A.G A.H A.I A.J A.K A.L"
+        LayoutText {#text} at (0,0) size 346x19
+          text run at (0,0) width 346: "A.A A.B A.C A.D A.E A.F A.G A.H A.I A.J A.K A.L"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1204-order-01-d-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1204-order-01-d-expected.png
new file mode 100644
index 0000000..04748ee
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1204-order-01-d-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1204-order-01-d-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1204-order-01-d-expected.txt
index 4469976..f756f5f 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1204-order-01-d-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1204-order-01-d-expected.txt
@@ -8,11 +8,11 @@
           text run at (0,0) width 726: "You should see nine boxes below, each just containing a unique multiple of eleven, from 11 to 99, and nothing else."
       LayoutNGBlockFlow {UL} at (0,36) size 784x131
         LayoutNGBlockFlow {LI} at (0,0) size 50x22 [border: (1px solid #000000)]
-          LayoutInline {<pseudo:before>} at (0,0) size 8x19
-            LayoutCounter (anonymous) at (1,1) size 8x19
-              text run at (1,1) width 8: "1"
-          LayoutText {#text} at (9,1) size 8x19
-            text run at (9,1) width 8: "1"
+          LayoutInline {<pseudo:before>} at (0,0) size 7x19
+            LayoutCounter (anonymous) at (1,1) size 7x19
+              text run at (1,1) width 7: "1"
+          LayoutText {#text} at (8,1) size 8x19
+            text run at (8,1) width 8: "1"
         LayoutNGBlockFlow (floating) {LI} at (0,22) size 50x22 [border: (1px solid #000000)]
           LayoutInline {<pseudo:before>} at (0,0) size 8x19
             LayoutCounter (anonymous) at (1,1) size 8x19
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t120401-scope-00-b-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t120401-scope-00-b-expected.png
index ac647fb7..ff2c3a2 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t120401-scope-00-b-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t120401-scope-00-b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t120401-scope-00-b-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t120401-scope-00-b-expected.txt
index 9c24686..c8fc5b3 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t120401-scope-00-b-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t120401-scope-00-b-expected.txt
@@ -7,7 +7,7 @@
         LayoutText {#text} at (0,0) size 227x19
           text run at (0,0) width 227: "The next 2 lines should be identical:"
       LayoutNGBlockFlow {DIV} at (0,36) size 784x20
-        LayoutInline {SPAN} at (0,0) size 39x19
+        LayoutInline {SPAN} at (0,0) size 38x19
           LayoutInline {<pseudo:before>} at (0,0) size 8x19
             LayoutCounter (anonymous) at (0,0) size 8x19
               text run at (0,0) width 8: "1"
@@ -19,43 +19,43 @@
               LayoutInline {<pseudo:before>} at (0,0) size 8x19
                 LayoutCounter (anonymous) at (16,0) size 8x19
                   text run at (16,0) width 8: "2"
-          LayoutInline {SPAN} at (0,0) size 8x19
-            LayoutInline {<pseudo:before>} at (0,0) size 8x19
-              LayoutCounter (anonymous) at (24,0) size 8x19
-                text run at (24,0) width 8: "1"
+          LayoutInline {SPAN} at (0,0) size 7x19
+            LayoutInline {<pseudo:before>} at (0,0) size 7x19
+              LayoutCounter (anonymous) at (24,0) size 7x19
+                text run at (24,0) width 7: "1"
           LayoutInline {<pseudo:after>} at (0,0) size 7x19
-            LayoutCounter (anonymous) at (32,0) size 7x19
-              text run at (32,0) width 7: "1"
+            LayoutCounter (anonymous) at (31,0) size 7x19
+              text run at (31,0) width 7: "1"
         LayoutInline {SPAN} at (0,0) size 8x19
           LayoutInline {<pseudo:before>} at (0,0) size 8x19
-            LayoutCounter (anonymous) at (39,0) size 8x19
-              text run at (39,0) width 8: "1"
-        LayoutText {#text} at (47,0) size 4x19
-          text run at (47,0) width 4: " "
+            LayoutCounter (anonymous) at (38,0) size 8x19
+              text run at (38,0) width 8: "1"
+        LayoutText {#text} at (46,0) size 4x19
+          text run at (46,0) width 4: " "
         LayoutInline {SPAN} at (0,0) size 40x19
           LayoutInline {<pseudo:before>} at (0,0) size 8x19
-            LayoutCounter (anonymous) at (51,0) size 8x19
-              text run at (51,0) width 8: "1"
+            LayoutCounter (anonymous) at (50,0) size 8x19
+              text run at (50,0) width 8: "1"
           LayoutInline {SPAN} at (0,0) size 16x19
             LayoutInline {<pseudo:before>} at (0,0) size 8x19
-              LayoutCounter (anonymous) at (59,0) size 8x19
-                text run at (59,0) width 8: "3"
+              LayoutCounter (anonymous) at (58,0) size 8x19
+                text run at (58,0) width 8: "3"
             LayoutInline {SPAN} at (0,0) size 8x19
               LayoutInline {<pseudo:before>} at (0,0) size 8x19
-                LayoutCounter (anonymous) at (67,0) size 8x19
-                  text run at (67,0) width 8: "3"
+                LayoutCounter (anonymous) at (66,0) size 8x19
+                  text run at (66,0) width 8: "3"
           LayoutInline {SPAN} at (0,0) size 8x19
             LayoutInline {<pseudo:before>} at (0,0) size 8x19
-              LayoutCounter (anonymous) at (75,0) size 8x19
-                text run at (75,0) width 8: "3"
+              LayoutCounter (anonymous) at (74,0) size 8x19
+                text run at (74,0) width 8: "3"
           LayoutInline {<pseudo:after>} at (0,0) size 8x19
-            LayoutCounter (anonymous) at (83,0) size 8x19
-              text run at (83,0) width 8: "3"
+            LayoutCounter (anonymous) at (82,0) size 8x19
+              text run at (82,0) width 8: "3"
         LayoutInline {SPAN} at (0,0) size 8x19
           LayoutInline {<pseudo:before>} at (0,0) size 8x19
-            LayoutCounter (anonymous) at (91,0) size 8x19
-              text run at (91,0) width 8: "1"
+            LayoutCounter (anonymous) at (90,0) size 8x19
+              text run at (90,0) width 8: "1"
         LayoutText {#text} at (0,0) size 0x0
       LayoutNGBlockFlow {DIV} at (0,56) size 784x20
-        LayoutText {#text} at (0,0) size 99x19
-          text run at (0,0) width 99: "122111 133331"
+        LayoutText {#text} at (0,0) size 98x19
+          text run at (0,0) width 98: "122111 133331"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1205-c563-list-type-00-b-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1205-c563-list-type-00-b-expected.png
index 49907ce8..8855c2a 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1205-c563-list-type-00-b-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1205-c563-list-type-00-b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1402-c45-bg-canvas-00-b-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1402-c45-bg-canvas-00-b-expected.png
new file mode 100644
index 0000000..e7e8dd1
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1402-c45-bg-canvas-00-b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1402-c45-bg-canvas-00-b-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1402-c45-bg-canvas-00-b-expected.txt
index a3fd2c1..84b45e0 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1402-c45-bg-canvas-00-b-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1402-c45-bg-canvas-00-b-expected.txt
@@ -4,5 +4,5 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x70
     LayoutNGBlockFlow {BODY} at (25,25) size 750x20 [color=#FFFFFF] [bgcolor=#000080]
       LayoutNGBlockFlow {P} at (0,0) size 750x20
-        LayoutText {#text} at (0,0) size 665x19
-          text run at (0,0) width 665: "This paragraph should be in a blue block near the top of the page. Around it on all sides should be purple."
+        LayoutText {#text} at (0,0) size 664x19
+          text run at (0,0) width 664: "This paragraph should be in a blue block near the top of the page. Around it on all sides should be purple."
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t140201-c535-bg-fixd-00-b-g-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t140201-c535-bg-fixd-00-b-g-expected.png
index 7f93cb0..19ea0b3 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t140201-c535-bg-fixd-00-b-g-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t140201-c535-bg-fixd-00-b-g-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t140201-c535-bg-fixd-00-b-g-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t140201-c535-bg-fixd-00-b-g-expected.txt
index 8698fc7..e368056 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t140201-c535-bg-fixd-00-b-g-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t140201-c535-bg-fixd-00-b-g-expected.txt
@@ -13,8 +13,8 @@
         LayoutText {#text} at (0,0) size 83x19
           text run at (0,0) width 83: "Dummy text."
       LayoutNGBlockFlow {P} at (0,76) size 769x20
-        LayoutText {#text} at (0,0) size 616x19
-          text run at (0,0) width 616: "Scroll this document. A line of blue should remain stuck at the top of the viewport the whole time."
+        LayoutText {#text} at (0,0) size 615x19
+          text run at (0,0) width 615: "Scroll this document. A line of blue should remain stuck at the top of the viewport the whole time."
       LayoutNGBlockFlow {DIV} at (0,112) size 769x20 [color=#C0C0C0]
         LayoutText {#text} at (0,0) size 83x19
           text run at (0,0) width 83: "Dummy text."
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t140201-c537-bgfxps-00-c-ag-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t140201-c537-bgfxps-00-c-ag-expected.png
index 642218bb..588c8b36 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t140201-c537-bgfxps-00-c-ag-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t140201-c537-bgfxps-00-c-ag-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t140201-c537-bgfxps-00-c-ag-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t140201-c537-bgfxps-00-c-ag-expected.txt
index 33fae872..fb0856b7 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t140201-c537-bgfxps-00-c-ag-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t140201-c537-bgfxps-00-c-ag-expected.txt
@@ -13,9 +13,9 @@
         LayoutText {#text} at (0,0) size 83x19
           text run at (0,0) width 83: "Dummy text."
       LayoutNGBlockFlow {P} at (0,108) size 769x40
-        LayoutText {#text} at (0,0) size 763x39
-          text run at (0,0) width 763: "Scroll this document. A line of blue should remain stuck at the top of the viewport the whole time, and there should be no"
-          text run at (0,20) width 201: "red below, just a block of green."
+        LayoutText {#text} at (0,0) size 762x39
+          text run at (0,0) width 762: "Scroll this document. A line of blue should remain stuck at the top of the viewport the whole time, and there should be no"
+          text run at (0,20) width 202: "red below, just a block of green."
       LayoutNGBlockFlow {DIV} at (30,164) size 165x75 [color=#008000] [bgcolor=#008000]
         LayoutText {#text} at (0,0) size 165x75
           text run at (0,0) width 165: "          X"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1602-c546-txt-align-00-b-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1602-c546-txt-align-00-b-expected.png
index 5a9c1b8..ff68956 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1602-c546-txt-align-00-b-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css2.1/t1602-c546-txt-align-00-b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/masking/clip-path-inset-corners-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/masking/clip-path-inset-corners-expected.png
new file mode 100644
index 0000000..8c6d829
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/masking/clip-path-inset-corners-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/masking/clip-path-inset-corners-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/masking/clip-path-inset-corners-expected.txt
index 5f70264f..8aa9bcd 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/masking/clip-path-inset-corners-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/masking/clip-path-inset-corners-expected.txt
@@ -4,8 +4,8 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x270
     LayoutNGBlockFlow {BODY} at (8,16) size 784x246
       LayoutNGBlockFlow {P} at (0,0) size 784x20
-        LayoutText {#text} at (0,0) size 573x19
-          text run at (0,0) width 573: "You should see 4 green squares each with one rounded corner. You should not see any red."
+        LayoutText {#text} at (0,0) size 571x19
+          text run at (0,0) width 571: "You should see 4 green squares each with one rounded corner. You should not see any red."
       LayoutNGBlockFlow (anonymous) at (0,36) size 784x210
         LayoutNGBlockFlow {DIV} at (0,0) size 100x100 [bgcolor=#FF0000]
         LayoutText {#text} at (100,85) size 4x19
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-1-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-1-expected.png
index 77a71898..41dab6a5 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-1-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-1-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-13-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-13-expected.png
index da8a1bf..9cef667 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-13-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-13-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-13-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-13-expected.txt
index d2a649b9..0593dbd 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-13-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-13-expected.txt
@@ -20,7 +20,7 @@
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
             LayoutText (anonymous) at (0,0) size 10x19
               text run at (0,0) width 10: "\x{2022} "
-          LayoutInline {SPAN} at (0,0) size 595x19
-            LayoutText {#text} at (0,0) size 595x19
-              text run at (0,0) width 595: "This list item should have green background because the inner SPAN does not match SPAN.t3"
+          LayoutInline {SPAN} at (0,0) size 597x19
+            LayoutText {#text} at (0,0) size 597x19
+              text run at (0,0) width 597: "This list item should have green background because the inner SPAN does not match SPAN.t3"
           LayoutText {#text} at (0,0) size 0x0
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-15-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-15-expected.png
index 2f2974f..1e098e4 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-15-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-15-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-15-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-15-expected.txt
index b6b3f3f..3bb3a83 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-15-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-15-expected.txt
@@ -20,6 +20,6 @@
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
             LayoutText (anonymous) at (0,0) size 10x19
               text run at (0,0) width 10: "\x{2022} "
-          LayoutInline {SPAN} at (0,0) size 588x19
-            LayoutText {#text} at (0,0) size 588x19
-              text run at (0,0) width 588: "This list item should have a green background. because the inner SPAN does not match \"#t4\""
+          LayoutInline {SPAN} at (0,0) size 589x19
+            LayoutText {#text} at (0,0) size 589x19
+              text run at (0,0) width 589: "This list item should have a green background. because the inner SPAN does not match \"#t4\""
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-22-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-22-expected.png
index 24223e0..c76420e 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-22-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-22-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-22-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-22-expected.txt
index fd81bb7..741085e 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-22-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-22-expected.txt
@@ -14,8 +14,8 @@
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
             LayoutText (anonymous) at (0,0) size 10x19
               text run at (0,0) width 10: "\x{2022} "
-          LayoutText {#text} at (0,0) size 481x19
-            text run at (0,0) width 481: "This list item should be green because its language is British English (Wales)"
+          LayoutText {#text} at (0,0) size 482x19
+            text run at (0,0) width 482: "This list item should be green because its language is British English (Wales)"
       LayoutNGBlockFlow {OL} at (0,56) size 784x40
         LayoutNGListItem {LI} at (40,0) size 744x20
           LayoutNGListMarker (anonymous) at (-16,0) size 16x20
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-28-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-28-expected.png
index 77fb2224..f972aa0 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-28-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-28-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-28b-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-28b-expected.png
index 43c31a18..1b3abf6 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-28b-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-28b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-29-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-29-expected.png
index 3ca67a7..4b85f0f3 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-29-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-29-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-29b-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-29b-expected.png
index da5dfe2..4db853c5 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-29b-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-29b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-3a-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-3a-expected.png
index c85baa3..c85f533 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-3a-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-3a-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-41-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-41-expected.png
new file mode 100644
index 0000000..cd7d97f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-41-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-41-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-41-expected.txt
index 31d0ba0..3884251 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-41-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-41-expected.txt
@@ -4,9 +4,9 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x72
     LayoutNGBlockFlow {BODY} at (8,16) size 784x40
       LayoutNGBlockFlow {P} at (0,0) size 784x40
-        LayoutInline {<pseudo:before>} at (0,0) size 182x19 [bgcolor=#00FF00]
-          LayoutTextFragment (anonymous) at (0,0) size 182x19
-            text run at (0,0) width 182: "GENERATED CONTENT "
-        LayoutText {#text} at (182,0) size 734x39
-          text run at (182,0) width 552: "You should see before this paragraph the words GENERATED CONTENT over green"
+        LayoutInline {<pseudo:before>} at (0,0) size 181x19 [bgcolor=#00FF00]
+          LayoutTextFragment (anonymous) at (0,0) size 181x19
+            text run at (0,0) width 181: "GENERATED CONTENT "
+        LayoutText {#text} at (181,0) size 733x39
+          text run at (181,0) width 552: "You should see before this paragraph the words GENERATED CONTENT over green"
           text run at (0,20) width 75: "background"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-41a-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-41a-expected.png
new file mode 100644
index 0000000..cd7d97f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-41a-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-41a-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-41a-expected.txt
index 31d0ba0..3884251 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-41a-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-41a-expected.txt
@@ -4,9 +4,9 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x72
     LayoutNGBlockFlow {BODY} at (8,16) size 784x40
       LayoutNGBlockFlow {P} at (0,0) size 784x40
-        LayoutInline {<pseudo:before>} at (0,0) size 182x19 [bgcolor=#00FF00]
-          LayoutTextFragment (anonymous) at (0,0) size 182x19
-            text run at (0,0) width 182: "GENERATED CONTENT "
-        LayoutText {#text} at (182,0) size 734x39
-          text run at (182,0) width 552: "You should see before this paragraph the words GENERATED CONTENT over green"
+        LayoutInline {<pseudo:before>} at (0,0) size 181x19 [bgcolor=#00FF00]
+          LayoutTextFragment (anonymous) at (0,0) size 181x19
+            text run at (0,0) width 181: "GENERATED CONTENT "
+        LayoutText {#text} at (181,0) size 733x39
+          text run at (181,0) width 552: "You should see before this paragraph the words GENERATED CONTENT over green"
           text run at (0,20) width 75: "background"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-73-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-73-expected.png
index f73a865..ece2e91 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-73-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-73-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-73b-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-73b-expected.png
index f73a865..ece2e91 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-73b-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-73b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-74-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-74-expected.png
index f305ca25..22676b5 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-74-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-74-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-74b-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-74b-expected.png
index f305ca25..22676b5 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-74b-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/html/css3-modsel-74b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-1-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-1-expected.png
index 77a71898..41dab6a5 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-1-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-1-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-13-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-13-expected.png
index da8a1bf..9cef667 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-13-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-13-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-13-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-13-expected.txt
index 559b26e..0b54be10 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-13-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-13-expected.txt
@@ -20,7 +20,7 @@
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
             LayoutText (anonymous) at (0,0) size 10x19
               text run at (0,0) width 10: "\x{2022} "
-          LayoutInline {span} at (0,0) size 595x19
-            LayoutText {#text} at (0,0) size 595x19
-              text run at (0,0) width 595: "This list item should have green background because the inner SPAN does not match SPAN.t3"
+          LayoutInline {span} at (0,0) size 597x19
+            LayoutText {#text} at (0,0) size 597x19
+              text run at (0,0) width 597: "This list item should have green background because the inner SPAN does not match SPAN.t3"
           LayoutText {#text} at (0,0) size 0x0
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-15-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-15-expected.png
index 2f2974f..1e098e4 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-15-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-15-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-15-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-15-expected.txt
index 90c73b8..f95a6d52 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-15-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-15-expected.txt
@@ -20,6 +20,6 @@
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
             LayoutText (anonymous) at (0,0) size 10x19
               text run at (0,0) width 10: "\x{2022} "
-          LayoutInline {span} at (0,0) size 588x19
-            LayoutText {#text} at (0,0) size 588x19
-              text run at (0,0) width 588: "This list item should have a green background. because the inner SPAN does not match \"#t4\""
+          LayoutInline {span} at (0,0) size 589x19
+            LayoutText {#text} at (0,0) size 589x19
+              text run at (0,0) width 589: "This list item should have a green background. because the inner SPAN does not match \"#t4\""
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-22-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-22-expected.png
index 24223e0..c76420e 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-22-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-22-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-22-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-22-expected.txt
index 64404b8b..5c5bed5 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-22-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-22-expected.txt
@@ -14,8 +14,8 @@
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
             LayoutText (anonymous) at (0,0) size 10x19
               text run at (0,0) width 10: "\x{2022} "
-          LayoutText {#text} at (0,0) size 481x19
-            text run at (0,0) width 481: "This list item should be green because its language is British English (Wales)"
+          LayoutText {#text} at (0,0) size 482x19
+            text run at (0,0) width 482: "This list item should be green because its language is British English (Wales)"
       LayoutNGBlockFlow {ol} at (0,56) size 784x40
         LayoutNGListItem {li} at (40,0) size 744x20
           LayoutNGListMarker (anonymous) at (-16,0) size 16x20
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-28-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-28-expected.png
index 77fb2224..f972aa0 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-28-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-28-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-28b-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-28b-expected.png
index 43c31a18..1b3abf6 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-28b-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-28b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-29-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-29-expected.png
index 3ca67a7..4b85f0f3 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-29-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-29-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-29b-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-29b-expected.png
index da5dfe2..4db853c5 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-29b-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-29b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-3-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-3-expected.png
index 90de159..235f0a0 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-3-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-3-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-3-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-3-expected.txt
index 0886daa..cd33dce 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-3-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-3-expected.txt
@@ -16,7 +16,7 @@
           LayoutText {#text} at (0,0) size 167x19
             text run at (0,0) width 167: "This item should be green."
       LayoutNGBlockFlow (anonymous) at (0,72) size 784x20
-        LayoutInline {foo} at (0,0) size 451x19
-          LayoutText {#text} at (0,0) size 451x19
-            text run at (0,0) width 451: "And this element, part of a non-HTML namespace, should be green too"
+        LayoutInline {foo} at (0,0) size 450x19
+          LayoutText {#text} at (0,0) size 450x19
+            text run at (0,0) width 450: "And this element, part of a non-HTML namespace, should be green too"
         LayoutText {#text} at (0,0) size 0x0
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-3a-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-3a-expected.png
index c85baa3..c85f533 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-3a-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-3a-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-41-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-41-expected.png
new file mode 100644
index 0000000..cd7d97f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-41-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-41-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-41-expected.txt
index 794c9a4..6d6945d 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-41-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-41-expected.txt
@@ -4,9 +4,9 @@
   LayoutNGBlockFlow {html} at (0,0) size 800x72
     LayoutNGBlockFlow {body} at (8,16) size 784x40
       LayoutNGBlockFlow {p} at (0,0) size 784x40
-        LayoutInline {<pseudo:before>} at (0,0) size 182x19 [bgcolor=#00FF00]
-          LayoutTextFragment (anonymous) at (0,0) size 182x19
-            text run at (0,0) width 182: "GENERATED CONTENT "
-        LayoutText {#text} at (182,0) size 734x39
-          text run at (182,0) width 552: "You should see before this paragraph the words GENERATED CONTENT over green"
+        LayoutInline {<pseudo:before>} at (0,0) size 181x19 [bgcolor=#00FF00]
+          LayoutTextFragment (anonymous) at (0,0) size 181x19
+            text run at (0,0) width 181: "GENERATED CONTENT "
+        LayoutText {#text} at (181,0) size 733x39
+          text run at (181,0) width 552: "You should see before this paragraph the words GENERATED CONTENT over green"
           text run at (0,20) width 75: "background"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-41a-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-41a-expected.png
new file mode 100644
index 0000000..cd7d97f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-41a-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-41a-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-41a-expected.txt
index 794c9a4..6d6945d 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-41a-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-41a-expected.txt
@@ -4,9 +4,9 @@
   LayoutNGBlockFlow {html} at (0,0) size 800x72
     LayoutNGBlockFlow {body} at (8,16) size 784x40
       LayoutNGBlockFlow {p} at (0,0) size 784x40
-        LayoutInline {<pseudo:before>} at (0,0) size 182x19 [bgcolor=#00FF00]
-          LayoutTextFragment (anonymous) at (0,0) size 182x19
-            text run at (0,0) width 182: "GENERATED CONTENT "
-        LayoutText {#text} at (182,0) size 734x39
-          text run at (182,0) width 552: "You should see before this paragraph the words GENERATED CONTENT over green"
+        LayoutInline {<pseudo:before>} at (0,0) size 181x19 [bgcolor=#00FF00]
+          LayoutTextFragment (anonymous) at (0,0) size 181x19
+            text run at (0,0) width 181: "GENERATED CONTENT "
+        LayoutText {#text} at (181,0) size 733x39
+          text run at (181,0) width 552: "You should see before this paragraph the words GENERATED CONTENT over green"
           text run at (0,20) width 75: "background"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-73-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-73-expected.png
index f73a865..ece2e91 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-73-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-73-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-73b-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-73b-expected.png
index f73a865..ece2e91 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-73b-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-73b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-74-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-74-expected.png
index f305ca25..22676b5 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-74-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-74-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-74b-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-74b-expected.png
index f305ca25..22676b5 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-74b-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xhtml/css3-modsel-74b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-1-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-1-expected.png
index 9ac0ac62..fb27f33 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-1-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-1-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-13-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-13-expected.png
index 9c15e53..96b30a80 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-13-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-13-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-13-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-13-expected.txt
index e2be4f0..b1f2d08 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-13-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-13-expected.txt
@@ -19,7 +19,7 @@
         LayoutNGListMarker (anonymous) at (-18,0) size 10x20
           LayoutText (anonymous) at (0,0) size 10x19
             text run at (0,0) width 10: "\x{2022} "
-        LayoutInline {span} at (0,0) size 595x19
-          LayoutText {#text} at (0,0) size 595x19
-            text run at (0,0) width 595: "This list item should have green background because the inner SPAN does not match SPAN.t3"
+        LayoutInline {span} at (0,0) size 597x19
+          LayoutText {#text} at (0,0) size 597x19
+            text run at (0,0) width 597: "This list item should have green background because the inner SPAN does not match SPAN.t3"
         LayoutText {#text} at (0,0) size 0x0
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-15-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-15-expected.png
index d0f320e..d7917e5 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-15-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-15-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-15-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-15-expected.txt
index 2b1ef339..186fb5a 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-15-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-15-expected.txt
@@ -19,6 +19,6 @@
         LayoutNGListMarker (anonymous) at (-18,0) size 10x20
           LayoutText (anonymous) at (0,0) size 10x19
             text run at (0,0) width 10: "\x{2022} "
-        LayoutInline {span} at (0,0) size 588x19
-          LayoutText {#text} at (0,0) size 588x19
-            text run at (0,0) width 588: "This list item should have a green background. because the inner SPAN does not match \"#t4\""
+        LayoutInline {span} at (0,0) size 589x19
+          LayoutText {#text} at (0,0) size 589x19
+            text run at (0,0) width 589: "This list item should have a green background. because the inner SPAN does not match \"#t4\""
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-22-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-22-expected.png
index 817e01b..b9d73267 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-22-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-22-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-22-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-22-expected.txt
index 7d1cecbf..ab9fe9a0 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-22-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-22-expected.txt
@@ -13,8 +13,8 @@
         LayoutNGListMarker (anonymous) at (-18,0) size 10x20
           LayoutText (anonymous) at (0,0) size 10x19
             text run at (0,0) width 10: "\x{2022} "
-        LayoutText {#text} at (0,0) size 481x19
-          text run at (0,0) width 481: "This list item should be green because its language is British English (Wales)"
+        LayoutText {#text} at (0,0) size 482x19
+          text run at (0,0) width 482: "This list item should be green because its language is British English (Wales)"
     LayoutNGBlockFlow {ol} at (0,72) size 800x40
       LayoutNGListItem {li} at (40,0) size 760x20
         LayoutNGListMarker (anonymous) at (-16,0) size 16x20
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-28-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-28-expected.png
index 94ac761c..454a8ac 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-28-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-28-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-28b-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-28b-expected.png
index bc34180..6bf65f1b 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-28b-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-28b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-29-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-29-expected.png
index dba4eb9..80353136 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-29-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-29-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-29b-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-29b-expected.png
index 2d3ea848..7d4064e 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-29b-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-29b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-3-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-3-expected.png
index f01686fd..fce40e7 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-3-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-3-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-3-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-3-expected.txt
index 9833e73a..f562f15 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-3-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-3-expected.txt
@@ -15,7 +15,7 @@
         LayoutText {#text} at (0,0) size 167x19
           text run at (0,0) width 167: "This item should be green."
     LayoutNGBlockFlow (anonymous) at (0,88) size 800x20
-      LayoutInline {foo} at (0,0) size 451x19
-        LayoutText {#text} at (0,0) size 451x19
-          text run at (0,0) width 451: "And this element, part of a non-HTML namespace, should be green too"
+      LayoutInline {foo} at (0,0) size 450x19
+        LayoutText {#text} at (0,0) size 450x19
+          text run at (0,0) width 450: "And this element, part of a non-HTML namespace, should be green too"
       LayoutText {#text} at (0,0) size 0x0
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-3a-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-3a-expected.png
index 73a0f963..de0f3e6 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-3a-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-3a-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-41-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-41-expected.png
new file mode 100644
index 0000000..e666379
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-41-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-41-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-41-expected.txt
index 553a20d3..49a1f7b 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-41-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-41-expected.txt
@@ -3,9 +3,9 @@
 layer at (0,0) size 800x72
   LayoutNGBlockFlow {test} at (0,0) size 800x72
     LayoutNGBlockFlow {p} at (0,16) size 800x40
-      LayoutInline {<pseudo:before>} at (0,0) size 182x19 [bgcolor=#00FF00]
-        LayoutTextFragment (anonymous) at (0,0) size 182x19
-          text run at (0,0) width 182: "GENERATED CONTENT "
-      LayoutText {#text} at (182,0) size 734x39
-        text run at (182,0) width 552: "You should see before this paragraph the words GENERATED CONTENT over green"
+      LayoutInline {<pseudo:before>} at (0,0) size 181x19 [bgcolor=#00FF00]
+        LayoutTextFragment (anonymous) at (0,0) size 181x19
+          text run at (0,0) width 181: "GENERATED CONTENT "
+      LayoutText {#text} at (181,0) size 733x39
+        text run at (181,0) width 552: "You should see before this paragraph the words GENERATED CONTENT over green"
         text run at (0,20) width 75: "background"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-41a-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-41a-expected.png
new file mode 100644
index 0000000..e666379
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-41a-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-41a-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-41a-expected.txt
index 553a20d3..49a1f7b 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-41a-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-41a-expected.txt
@@ -3,9 +3,9 @@
 layer at (0,0) size 800x72
   LayoutNGBlockFlow {test} at (0,0) size 800x72
     LayoutNGBlockFlow {p} at (0,16) size 800x40
-      LayoutInline {<pseudo:before>} at (0,0) size 182x19 [bgcolor=#00FF00]
-        LayoutTextFragment (anonymous) at (0,0) size 182x19
-          text run at (0,0) width 182: "GENERATED CONTENT "
-      LayoutText {#text} at (182,0) size 734x39
-        text run at (182,0) width 552: "You should see before this paragraph the words GENERATED CONTENT over green"
+      LayoutInline {<pseudo:before>} at (0,0) size 181x19 [bgcolor=#00FF00]
+        LayoutTextFragment (anonymous) at (0,0) size 181x19
+          text run at (0,0) width 181: "GENERATED CONTENT "
+      LayoutText {#text} at (181,0) size 733x39
+        text run at (181,0) width 552: "You should see before this paragraph the words GENERATED CONTENT over green"
         text run at (0,20) width 75: "background"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-73-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-73-expected.png
index ba7f20a..c9d9d41 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-73-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-73-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-73b-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-73b-expected.png
index ba7f20a..c9d9d41 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-73b-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-73b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-74-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-74-expected.png
index 30667fc1..45fd2cb 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-74-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-74-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-74b-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-74b-expected.png
index 30667fc1..45fd2cb 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-74b-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/css3/selectors3/xml/css3-modsel-74b-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/deleting/4922367-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/deleting/4922367-expected.png
new file mode 100644
index 0000000..12c37dd6
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/deleting/4922367-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/deleting/5369009-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/deleting/5369009-expected.png
new file mode 100644
index 0000000..2d337d68
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/deleting/5369009-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/deleting/5369009-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/deleting/5369009-expected.txt
new file mode 100644
index 0000000..80a26eb
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/deleting/5369009-expected.txt
@@ -0,0 +1,22 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x600
+    LayoutNGBlockFlow {BODY} at (8,8) size 784x584
+      LayoutNGBlockFlow {P} at (0,0) size 784x40
+        LayoutText {#text} at (0,0) size 783x39
+          text run at (0,0) width 783: "This tests for a hang on delete where a style rule would cause style spans in content moved after the delete to be displayed as"
+          text run at (0,20) width 183: "blocks. You should see Hello"
+        LayoutInline {B} at (0,0) size 43x19
+          LayoutText {#text} at (183,20) size 43x19
+            text run at (183,20) width 43: "World"
+        LayoutText {#text} at (226,20) size 46x19
+          text run at (226,20) width 46: " below."
+      LayoutBlockFlow {DIV} at (0,56) size 784x20
+        LayoutBlockFlow {DIV} at (0,0) size 784x20
+          LayoutText {#text} at (0,0) size 35x19
+            text run at (0,0) width 35: "Hello"
+          LayoutInline {SPAN} at (0,0) size 43x19
+            LayoutText {#text} at (35,0) size 43x19
+              text run at (35,0) width 43: "World"
+caret: position 5 of child 0 {#text} of child 1 {DIV} of child 2 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/input/linux_rtl_composition_underline-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/input/linux_rtl_composition_underline-expected.png
new file mode 100644
index 0000000..6fdf08b
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/input/linux_rtl_composition_underline-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/input/linux_rtl_composition_underline-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/input/linux_rtl_composition_underline-expected.txt
new file mode 100644
index 0000000..9b4ace7
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/input/linux_rtl_composition_underline-expected.txt
@@ -0,0 +1,15 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x600
+    LayoutNGBlockFlow {BODY} at (8,8) size 784x576
+      LayoutNGBlockFlow {P} at (0,0) size 784x20
+        LayoutText {#text} at (0,0) size 695x19
+          text run at (0,0) width 695: "This tests that composition underline is painted correctly for RTL text on Linuxby typing hello world in arabic."
+      LayoutNGBlockFlow {FORM} at (0,36) size 784x22
+        LayoutTextControl {INPUT} at (0,0) size 181x22 [bgcolor=#FFFFFF] [border: (2px inset #EEEEEE)]
+layer at (10,47) size 177x16
+  LayoutBlockFlow {DIV} at (2,3) size 177x16
+    LayoutText {#text} at (106,0) size 71x16
+      text run at (106,0) width 71 RTL: "\x{645}\x{631}\x{62D}\x{628}\x{627} \x{64A}\x{627} \x{639}\x{627}\x{644}\x{645}"
+caret: position 13 of child 0 {#text} of child 0 {DIV} of {#document-fragment} of child 0 {INPUT} of child 3 {FORM} of body
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/inserting/5418891-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/inserting/5418891-expected.txt
deleted file mode 100644
index 7aec1989..0000000
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/inserting/5418891-expected.txt
+++ /dev/null
@@ -1,22 +0,0 @@
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutNGBlockFlow {HTML} at (0,0) size 800x600
-    LayoutNGBlockFlow {BODY} at (8,8) size 784x584
-      LayoutNGBlockFlow {P} at (0,0) size 784x40
-        LayoutText {#text} at (0,0) size 772x39
-          text run at (0,0) width 772: "This tests for a crash when attempting to break a blockquote at the end of its content. The caret should be in the first of two"
-          text run at (0,20) width 358: "empty paragraphs between two pieces of quoted content."
-      LayoutBlockFlow {DIV} at (0,56) size 784x80
-        LayoutBlockFlow {BLOCKQUOTE} at (0,0) size 784x20 [color=#0000FF] [border: none (2px solid #0000FF)]
-          LayoutBlockFlow {DIV} at (7,0) size 777x20
-            LayoutText {#text} at (0,0) size 21x19
-              text run at (0,0) width 21: "foo"
-        LayoutNGBlockFlow (anonymous) at (0,20) size 769x40
-          LayoutBR {BR} at (0,0) size 0x19
-          LayoutBR {BR} at (0,20) size 0x19
-        LayoutBlockFlow {BLOCKQUOTE} at (0,60) size 784x20 [color=#0000FF] [border: none (2px solid #0000FF)]
-          LayoutBlockFlow {DIV} at (7,0) size 777x20
-            LayoutText {#text} at (0,0) size 20x19
-              text run at (0,0) width 20: "bar"
-caret: position 0 of child 2 {BR} of child 2 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/inserting/5549929-2-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/inserting/5549929-2-expected.png
new file mode 100644
index 0000000..04ba5e8e
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/inserting/5549929-2-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/inserting/5549929-2-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/inserting/5549929-2-expected.txt
index 895e21a3..1a9a1a2a9 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/inserting/5549929-2-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/inserting/5549929-2-expected.txt
@@ -4,8 +4,8 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x600
     LayoutNGBlockFlow {BODY} at (8,8) size 784x584
       LayoutNGBlockFlow {P} at (0,0) size 784x40
-        LayoutText {#text} at (0,0) size 733x39
-          text run at (0,0) width 733: "This tests to make sure that a br isn't inserted into a tab span during an InsertLineBreak operation. You can test for its"
+        LayoutText {#text} at (0,0) size 732x39
+          text run at (0,0) width 732: "This tests to make sure that a br isn't inserted into a tab span during an InsertLineBreak operation. You can test for its"
           text run at (0,20) width 432: "existence with the DOM inspector or you can look at the render tree."
       LayoutBlockFlow {DIV} at (0,56) size 784x40
         LayoutBlockFlow {DIV} at (0,0) size 784x40
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/4631972-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/4631972-expected.png
new file mode 100644
index 0000000..56121b6
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/4631972-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/4631972-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/4631972-expected.txt
index d24f7bfc..28e0b2a 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/4631972-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/4631972-expected.txt
@@ -9,7 +9,7 @@
       LayoutNGBlockFlow {P} at (0,0) size 784x40
         LayoutText {#text} at (0,0) size 638x39
           text run at (0,0) width 638: "This tests pasting a fragment containing an <iframe> after a <div>. This used to fail on an assertion in"
-          text run at (0,20) width 632: "moveParagraphContentsToNewBlockIfNecessary. You should see 'foo' and then an <iframe> below."
+          text run at (0,20) width 634: "moveParagraphContentsToNewBlockIfNecessary. You should see 'foo' and then an <iframe> below."
       LayoutBlockFlow {DIV} at (0,56) size 784x72
         LayoutBlockFlow {DIV} at (0,0) size 784x20
           LayoutText {#text} at (0,0) size 21x19
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/4806874-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/4806874-expected.png
new file mode 100644
index 0000000..4c12c9d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/4806874-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/4806874-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/4806874-expected.txt
index 372dbfe..dee9ec95 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/4806874-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/4806874-expected.txt
@@ -4,8 +4,8 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x600
     LayoutNGBlockFlow {BODY} at (8,8) size 784x584
       LayoutNGBlockFlow {P} at (0,0) size 784x20
-        LayoutText {#text} at (0,0) size 543x19
-          text run at (0,0) width 543: "This tests for an infinite loop on Paste. You should see 'Hello: ' and then an input field."
+        LayoutText {#text} at (0,0) size 542x19
+          text run at (0,0) width 542: "This tests for an infinite loop on Paste. You should see 'Hello: ' and then an input field."
       LayoutBlockFlow {DIV} at (0,36) size 784x22
         LayoutText {#text} at (0,1) size 35x19
           text run at (0,1) width 35: "Hello"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/4947130-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/4947130-expected.png
new file mode 100644
index 0000000..8446875
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/4947130-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/4947130-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/4947130-expected.txt
index 2548098..ba47e3db 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/4947130-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/4947130-expected.txt
@@ -4,8 +4,8 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x600
     LayoutNGBlockFlow {BODY} at (8,8) size 784x584
       LayoutNGBlockFlow {P} at (0,0) size 784x40
-        LayoutText {#text} at (0,0) size 778x39
-          text run at (0,0) width 778: "This tests to see if dragging an image is a move drag by default (it should be). You should only see one picture and it should"
+        LayoutText {#text} at (0,0) size 777x39
+          text run at (0,0) width 777: "This tests to see if dragging an image is a move drag by default (it should be). You should only see one picture and it should"
           text run at (0,20) width 200: "be somewhere near the middle. "
         LayoutInline {B} at (0,0) size 492x19
           LayoutText {#text} at (200,20) size 492x19
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/5134759-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/5134759-expected.png
new file mode 100644
index 0000000..5c78549c
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/5134759-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/5134759-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/5134759-expected.txt
index 46e796c..3b2c1019 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/5134759-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/5134759-expected.txt
@@ -4,19 +4,19 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x600
     LayoutNGBlockFlow {BODY} at (8,8) size 784x584
       LayoutNGBlockFlow {P} at (0,0) size 784x20
-        LayoutText {#text} at (0,0) size 646x19
-          text run at (0,0) width 646: "This tests for a hang when pasting underlined content at the end of a paragraph. You should see 'Hello "
-        LayoutInline {U} at (0,0) size 43x19
-          LayoutText {#text} at (646,0) size 43x19
-            text run at (646,0) width 43: "World!"
-        LayoutText {#text} at (689,0) size 48x19
-          text run at (689,0) width 48: "' below."
+        LayoutText {#text} at (0,0) size 645x19
+          text run at (0,0) width 645: "This tests for a hang when pasting underlined content at the end of a paragraph. You should see 'Hello "
+        LayoutInline {U} at (0,0) size 44x19
+          LayoutText {#text} at (645,0) size 44x19
+            text run at (645,0) width 44: "World!"
+        LayoutText {#text} at (689,0) size 49x19
+          text run at (689,0) width 49: "' below."
       LayoutBlockFlow {DIV} at (0,36) size 784x20
         LayoutBlockFlow {DIV} at (0,0) size 784x20
           LayoutText {#text} at (0,0) size 39x19
             text run at (0,0) width 39: "Hello "
-          LayoutInline {SPAN} at (0,0) size 43x19
-            LayoutText {#text} at (39,0) size 43x19
-              text run at (39,0) width 43: "World!"
+          LayoutInline {SPAN} at (0,0) size 44x19
+            LayoutText {#text} at (39,0) size 44x19
+              text run at (39,0) width 44: "World!"
         LayoutNGBlockFlow (anonymous) at (0,20) size 784x0
 caret: position 6 of child 0 {#text} of child 1 {SPAN} of child 0 {DIV} of child 2 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/drag-selected-image-to-contenteditable-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/drag-selected-image-to-contenteditable-expected.png
index bcb70143..e69089c8 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/drag-selected-image-to-contenteditable-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/drag-selected-image-to-contenteditable-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/input-field-1-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/input-field-1-expected.png
index d3f4fcb1..547a8ac 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/input-field-1-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/pasteboard/input-field-1-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-ltr-2-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-ltr-2-expected.png
new file mode 100644
index 0000000..8713e46
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-ltr-2-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-ltr-2-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-ltr-2-expected.txt
index 5dc79b7e..5e07df5 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-ltr-2-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-ltr-2-expected.txt
@@ -6,12 +6,12 @@
       LayoutNGBlockFlow {P} at (0,0) size 784x40
         LayoutText {#text} at (0,0) size 754x39
           text run at (0,0) width 754: "This tests that clicking in a contenteditable div will set the caret in the right position for LTR text in a RTL block. To test"
-          text run at (0,20) width 463: "manually, click the right of the text. The caret should be on the right edge."
-      LayoutBlockFlow {DIV} at (0,56) size 202x45 [border: (1px solid #000000)]
-        LayoutText {#text} at (119,11) size 72x22
-          text run at (119,11) width 72: "WebKit2"
+          text run at (0,20) width 464: "manually, click the right of the text. The caret should be on the right edge."
+      LayoutBlockFlow {DIV} at (0,56) size 205.59x45 [border: (1px solid #000000)]
+        LayoutText {#text} at (122,11) size 73x22
+          text run at (122,11) width 73: "WebKit2"
       LayoutNGBlockFlow (anonymous) at (0,101) size 784x20
-        LayoutText {#text} at (0,0) size 37x19
-          text run at (0,0) width 37: "PASS"
-        LayoutBR {BR} at (37,0) size 0x0
+        LayoutText {#text} at (0,0) size 38x19
+          text run at (0,0) width 38: "PASS"
+        LayoutBR {BR} at (38,0) size 0x0
 caret: position 0 of child 0 {#text} of child 3 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-ltr-2-left-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-ltr-2-left-expected.png
new file mode 100644
index 0000000..e65fcbe
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-ltr-2-left-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-ltr-2-left-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-ltr-2-left-expected.txt
index 80764235..7f2a52e1 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-ltr-2-left-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-ltr-2-left-expected.txt
@@ -6,12 +6,12 @@
       LayoutNGBlockFlow {P} at (0,0) size 784x40
         LayoutText {#text} at (0,0) size 754x39
           text run at (0,0) width 754: "This tests that clicking in a contenteditable div will set the caret in the right position for LTR text in a RTL block. To test"
-          text run at (0,20) width 445: "manually, click the left of the text. The caret should be on the left edge."
-      LayoutBlockFlow {DIV} at (0,56) size 202x45 [border: (1px solid #000000)]
-        LayoutText {#text} at (119,11) size 72x22
-          text run at (119,11) width 72: "WebKit2"
+          text run at (0,20) width 446: "manually, click the left of the text. The caret should be on the left edge."
+      LayoutBlockFlow {DIV} at (0,56) size 205.59x45 [border: (1px solid #000000)]
+        LayoutText {#text} at (122,11) size 73x22
+          text run at (122,11) width 73: "WebKit2"
       LayoutNGBlockFlow (anonymous) at (0,101) size 784x20
-        LayoutText {#text} at (0,0) size 37x19
-          text run at (0,0) width 37: "PASS"
-        LayoutBR {BR} at (37,0) size 0x0
+        LayoutText {#text} at (0,0) size 38x19
+          text run at (0,0) width 38: "PASS"
+        LayoutBR {BR} at (38,0) size 0x0
 caret: position 7 of child 0 {#text} of child 3 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-2-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-2-expected.png
new file mode 100644
index 0000000..492db2d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-2-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-2-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-2-expected.txt
index 8f4ce0f..e3f46ba0 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-2-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-2-expected.txt
@@ -4,14 +4,14 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x145
     LayoutNGBlockFlow {BODY} at (8,16) size 784x121
       LayoutNGBlockFlow {P} at (0,0) size 784x40
-        LayoutText {#text} at (0,0) size 756x39
-          text run at (0,0) width 756: "This tests that clicking in a contenteditable div will set the caret in the right position for RTL text in a RTL block. To test"
-          text run at (0,20) width 463: "manually, click the right of the text. The caret should be on the right edge."
-      LayoutBlockFlow {DIV} at (0,56) size 202x45 [border: (1px solid #000000)]
-        LayoutText {#text} at (11,11) size 58x22
-          text run at (11,11) width 58 RTL: "\x{5E9}\x{5D3}\x{5D4} \x{5D1}\x{5D5}\x{5E8}"
+        LayoutText {#text} at (0,0) size 753x39
+          text run at (0,0) width 753: "This tests that clicking in a contenteditable div will set the caret in the right position for RTL text in a RTL block. To test"
+          text run at (0,20) width 464: "manually, click the right of the text. The caret should be on the right edge."
+      LayoutBlockFlow {DIV} at (0,56) size 205.59x45 [border: (1px solid #000000)]
+        LayoutText {#text} at (11,11) size 66x22
+          text run at (11,11) width 66 RTL: "\x{5E9}\x{5D3}\x{5D4} \x{5D1}\x{5D5}\x{5E8}"
       LayoutNGBlockFlow (anonymous) at (0,101) size 784x20
-        LayoutText {#text} at (0,0) size 37x19
-          text run at (0,0) width 37: "PASS"
-        LayoutBR {BR} at (37,0) size 0x0
+        LayoutText {#text} at (0,0) size 38x19
+          text run at (0,0) width 38: "PASS"
+        LayoutBR {BR} at (38,0) size 0x0
 caret: position 7 of child 0 {#text} of child 3 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-2-left-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-2-left-expected.png
new file mode 100644
index 0000000..5972eb9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-2-left-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-2-left-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-2-left-expected.txt
index 8f4ea66..6409841 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-2-left-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-2-left-expected.txt
@@ -6,12 +6,12 @@
       LayoutNGBlockFlow {P} at (0,0) size 784x40
         LayoutText {#text} at (0,0) size 754x39
           text run at (0,0) width 754: "This tests that clicking in a contenteditable div will set the caret in the right position for RTL text in a LTR block. To test"
-          text run at (0,20) width 445: "manually, click the left of the text. The caret should be on the left edge."
-      LayoutBlockFlow {DIV} at (0,56) size 202x45 [border: (1px solid #000000)]
-        LayoutText {#text} at (11,11) size 58x22
-          text run at (11,11) width 58 RTL: "\x{5E9}\x{5D3}\x{5D4} \x{5D1}\x{5D5}\x{5E8}"
+          text run at (0,20) width 446: "manually, click the left of the text. The caret should be on the left edge."
+      LayoutBlockFlow {DIV} at (0,56) size 205.59x45 [border: (1px solid #000000)]
+        LayoutText {#text} at (11,11) size 66x22
+          text run at (11,11) width 66 RTL: "\x{5E9}\x{5D3}\x{5D4} \x{5D1}\x{5D5}\x{5E8}"
       LayoutNGBlockFlow (anonymous) at (0,101) size 784x20
-        LayoutText {#text} at (0,0) size 37x19
-          text run at (0,0) width 37: "PASS"
-        LayoutBR {BR} at (37,0) size 0x0
+        LayoutText {#text} at (0,0) size 38x19
+          text run at (0,0) width 38: "PASS"
+        LayoutBR {BR} at (38,0) size 0x0
 caret: position 0 of child 0 {#text} of child 3 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-expected.png
new file mode 100644
index 0000000..89ff8e81
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-expected.txt
index ac15c054..64c4c475 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-expected.txt
@@ -4,14 +4,14 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x145
     LayoutNGBlockFlow {BODY} at (8,16) size 784x121
       LayoutNGBlockFlow {P} at (0,0) size 784x40
-        LayoutText {#text} at (0,0) size 756x39
-          text run at (0,0) width 756: "This tests that clicking in a contenteditable div will set the caret in the right position for RTL text in a RTL block. To test"
-          text run at (0,20) width 445: "manually, click the left of the text. The caret should be on the left edge."
-      LayoutBlockFlow {DIV} at (0,56) size 202x45 [border: (1px solid #000000)]
-        LayoutText {#text} at (133,11) size 58x22
-          text run at (133,11) width 58 RTL: "\x{5E9}\x{5D3}\x{5D4} \x{5D1}\x{5D5}\x{5E8}"
+        LayoutText {#text} at (0,0) size 753x39
+          text run at (0,0) width 753: "This tests that clicking in a contenteditable div will set the caret in the right position for RTL text in a RTL block. To test"
+          text run at (0,20) width 446: "manually, click the left of the text. The caret should be on the left edge."
+      LayoutBlockFlow {DIV} at (0,56) size 205.59x45 [border: (1px solid #000000)]
+        LayoutText {#text} at (128,11) size 67x22
+          text run at (128,11) width 67 RTL: "\x{5E9}\x{5D3}\x{5D4} \x{5D1}\x{5D5}\x{5E8}"
       LayoutNGBlockFlow (anonymous) at (0,101) size 784x20
-        LayoutText {#text} at (0,0) size 37x19
-          text run at (0,0) width 37: "PASS"
-        LayoutBR {BR} at (37,0) size 0x0
+        LayoutText {#text} at (0,0) size 38x19
+          text run at (0,0) width 38: "PASS"
+        LayoutBR {BR} at (38,0) size 0x0
 caret: position 7 of child 0 {#text} of child 3 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-right-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-right-expected.png
new file mode 100644
index 0000000..fd50a78
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-right-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-right-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-right-expected.txt
index f468043..9e14fe1 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-right-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/caret-rtl-right-expected.txt
@@ -4,14 +4,14 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x145
     LayoutNGBlockFlow {BODY} at (8,16) size 784x121
       LayoutNGBlockFlow {P} at (0,0) size 784x40
-        LayoutText {#text} at (0,0) size 756x39
-          text run at (0,0) width 756: "This tests that clicking in a contenteditable div will set the caret in the right position for RTL text in a RTL block. To test"
-          text run at (0,20) width 463: "manually, click the right of the text. The caret should be on the right edge."
-      LayoutBlockFlow {DIV} at (0,56) size 202x45 [border: (1px solid #000000)]
-        LayoutText {#text} at (133,11) size 58x22
-          text run at (133,11) width 58 RTL: "\x{5E9}\x{5D3}\x{5D4} \x{5D1}\x{5D5}\x{5E8}"
+        LayoutText {#text} at (0,0) size 753x39
+          text run at (0,0) width 753: "This tests that clicking in a contenteditable div will set the caret in the right position for RTL text in a RTL block. To test"
+          text run at (0,20) width 464: "manually, click the right of the text. The caret should be on the right edge."
+      LayoutBlockFlow {DIV} at (0,56) size 205.59x45 [border: (1px solid #000000)]
+        LayoutText {#text} at (128,11) size 67x22
+          text run at (128,11) width 67 RTL: "\x{5E9}\x{5D3}\x{5D4} \x{5D1}\x{5D5}\x{5E8}"
       LayoutNGBlockFlow (anonymous) at (0,101) size 784x20
-        LayoutText {#text} at (0,0) size 37x19
-          text run at (0,0) width 37: "PASS"
-        LayoutBR {BR} at (37,0) size 0x0
+        LayoutText {#text} at (0,0) size 38x19
+          text run at (0,0) width 38: "PASS"
+        LayoutBR {BR} at (38,0) size 0x0
 caret: position 0 of child 0 {#text} of child 3 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/designmode-no-caret-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/designmode-no-caret-expected.png
index 973eec7..d58473e 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/designmode-no-caret-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/designmode-no-caret-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/designmode-no-caret-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/designmode-no-caret-expected.txt
index dc60799..6f5d69a5 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/designmode-no-caret-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/designmode-no-caret-expected.txt
@@ -6,10 +6,10 @@
       LayoutNGBlockFlow (anonymous) at (0,0) size 769x60
         LayoutText {#text} at (0,0) size 759x59
           text run at (0,0) width 759: "This tests to see that a caret is placed inside an editable document that is entirely editable even when no caret is requested"
-          text run at (0,20) width 116: "programmatically. "
-          text run at (116,20) width 185: "We do this as a convenience. "
-          text run at (301,20) width 418: "Right now, we only do this convenience when a document's frame"
-          text run at (0,40) width 435: "becomes first responder or when a document's window becomes key."
+          text run at (0,20) width 117: "programmatically. "
+          text run at (117,20) width 186: "We do this as a convenience. "
+          text run at (303,20) width 419: "Right now, we only do this convenience when a document's frame"
+          text run at (0,40) width 436: "becomes first responder or when a document's window becomes key."
       LayoutBlockFlow {PRE} at (0,73) size 784x32
         LayoutText {#text} at (0,0) size 296x32
           text run at (0,0) width 296: "Test Failed - there should be a caret"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/drag-to-contenteditable-iframe-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/drag-to-contenteditable-iframe-expected.png
index 8f938b98..f579247 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/drag-to-contenteditable-iframe-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/drag-to-contenteditable-iframe-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/leave-requested-block-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/leave-requested-block-expected.png
index 395f7a26..e1ee8427 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/leave-requested-block-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/leave-requested-block-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/leave-requested-block-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/leave-requested-block-expected.txt
index 67a0b56..61771cb 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/leave-requested-block-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/leave-requested-block-expected.txt
@@ -6,13 +6,13 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x600
     LayoutNGBlockFlow {BODY} at (8,8) size 784x576
       LayoutNGBlockFlow {P} at (0,0) size 784x20
-        LayoutText {#text} at (0,0) size 125x19
-          text run at (0,0) width 125: "Test case for fix for "
+        LayoutText {#text} at (0,0) size 126x19
+          text run at (0,0) width 126: "Test case for fix for "
         LayoutInline {A} at (0,0) size 343x19 [color=#0000EE]
-          LayoutText {#text} at (125,0) size 343x19
-            text run at (125,0) width 343: "http://bugzilla.opendarwin.org/show_bug.cgi?id=5354"
-        LayoutText {#text} at (468,0) size 4x19
-          text run at (468,0) width 4: "."
+          LayoutText {#text} at (126,0) size 343x19
+            text run at (126,0) width 343: "http://bugzilla.opendarwin.org/show_bug.cgi?id=5354"
+        LayoutText {#text} at (469,0) size 4x19
+          text run at (469,0) width 4: "."
       LayoutNGBlockFlow {P} at (0,36) size 784x40
         LayoutText {#text} at (0,0) size 771x39
           text run at (0,0) width 771: "Changes were made to VisiblePosition's so that init() will not leave the block containing the requested position unless there"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/previous-line-position-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/previous-line-position-expected.png
index b5e8ab27..ded36d45 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/previous-line-position-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/previous-line-position-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/previous-line-position-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/previous-line-position-expected.txt
index b22e1710..567a2ce 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/previous-line-position-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/previous-line-position-expected.txt
@@ -11,8 +11,8 @@
         LayoutInline {A} at (0,0) size 149x19 [color=#0000EE]
           LayoutText {#text} at (241,0) size 149x19
             text run at (241,0) width 149: "rdar://problem/4033202"
-        LayoutText {#text} at (390,0) size 296x19
-          text run at (390,0) width 296: ". A bug to remove the workaround was filed as"
+        LayoutText {#text} at (390,0) size 295x19
+          text run at (390,0) width 295: ". A bug to remove the workaround was filed as"
         LayoutInline {A} at (0,0) size 149x19 [color=#0000EE]
           LayoutText {#text} at (0,20) size 149x19
             text run at (0,20) width 149: "rdar://problem/4040763"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/selectNode-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/selectNode-expected.png
index b6605bb..36643e4 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/selectNode-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/selectNode-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/selectNode-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/selectNode-expected.txt
index f266487c..53b41ec 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/selectNode-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/selectNode-expected.txt
@@ -4,8 +4,8 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x600
     LayoutNGBlockFlow {BODY} at (8,8) size 784x576
       LayoutNGBlockFlow {P} at (0,0) size 784x20
-        LayoutText {#text} at (0,0) size 337x19
-          text run at (0,0) width 337: "This tests Range.selectNode() of a text node and a br."
+        LayoutText {#text} at (0,0) size 336x19
+          text run at (0,0) width 336: "This tests Range.selectNode() of a text node and a br."
       LayoutNGBlockFlow {DIV} at (0,36) size 784x20
         LayoutText {#text} at (0,0) size 23x19
           text run at (0,0) width 23: "one"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/selectNodeContents-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/selectNodeContents-expected.png
index bdfa362..b5048a8b 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/selectNodeContents-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/selectNodeContents-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/selectNodeContents-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/selectNodeContents-expected.txt
index 8fffa8b..a5d5f15c 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/selectNodeContents-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/selection/selectNodeContents-expected.txt
@@ -4,8 +4,8 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x600
     LayoutNGBlockFlow {BODY} at (8,8) size 784x576
       LayoutNGBlockFlow {P} at (0,0) size 784x20
-        LayoutText {#text} at (0,0) size 393x19
-          text run at (0,0) width 393: "This tests Range.selectNodeContents() of a text node and a br."
+        LayoutText {#text} at (0,0) size 392x19
+          text run at (0,0) width 392: "This tests Range.selectNodeContents() of a text node and a br."
       LayoutNGBlockFlow {DIV} at (0,36) size 784x20
         LayoutText {#text} at (0,0) size 23x19
           text run at (0,0) width 23: "one"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-delete-001-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-delete-001-expected.png
new file mode 100644
index 0000000..30cca95
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-delete-001-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-delete-001-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-delete-001-expected.txt
index 747f393..99fc31b 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-delete-001-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-delete-001-expected.txt
@@ -21,9 +21,9 @@
           LayoutText {#text} at (0,0) size 59x26
             text run at (0,0) width 59: "Tests:"
           LayoutBR {BR} at (59,0) size 0x0
-          LayoutText {#text} at (0,27) size 658x20
-            text run at (0,27) width 658: "Our ability to \"edit around\" content the HTML editing code does not yet handle very well."
-          LayoutBR {BR} at (658,27) size 0x0
+          LayoutText {#text} at (0,27) size 657x20
+            text run at (0,27) width 657: "Our ability to \"edit around\" content the HTML editing code does not yet handle very well."
+          LayoutBR {BR} at (657,27) size 0x0
           LayoutInline {I} at (0,0) size 99x20
             LayoutText {#text} at (0,48) size 99x20
               text run at (0,48) width 99: "For this test: "
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-delete-003-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-delete-003-expected.png
new file mode 100644
index 0000000..38479d4c
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-delete-003-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-delete-003-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-delete-003-expected.txt
index 1f9a549..791636c9 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-delete-003-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-delete-003-expected.txt
@@ -21,9 +21,9 @@
           LayoutText {#text} at (0,0) size 59x26
             text run at (0,0) width 59: "Tests:"
           LayoutBR {BR} at (59,0) size 0x0
-          LayoutText {#text} at (0,27) size 658x20
-            text run at (0,27) width 658: "Our ability to \"edit around\" content the HTML editing code does not yet handle very well."
-          LayoutBR {BR} at (658,27) size 0x0
+          LayoutText {#text} at (0,27) size 657x20
+            text run at (0,27) width 657: "Our ability to \"edit around\" content the HTML editing code does not yet handle very well."
+          LayoutBR {BR} at (657,27) size 0x0
           LayoutInline {I} at (0,0) size 99x20
             LayoutText {#text} at (0,48) size 99x20
               text run at (0,48) width 99: "For this test: "
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-type-after-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-type-after-expected.png
index 14b15fa1..b721fcf3 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-type-after-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-type-after-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-type-after-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-type-after-expected.txt
index 9b4bb3a..063f365 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-type-after-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-type-after-expected.txt
@@ -18,14 +18,14 @@
           LayoutText {#text} at (0,0) size 59x26
             text run at (0,0) width 59: "Tests:"
           LayoutBR {BR} at (59,0) size 0x0
-          LayoutText {#text} at (0,27) size 658x20
-            text run at (0,27) width 658: "Our ability to \"edit around\" content the HTML editing code does not yet handle very well."
-          LayoutBR {BR} at (658,27) size 0x0
+          LayoutText {#text} at (0,27) size 657x20
+            text run at (0,27) width 657: "Our ability to \"edit around\" content the HTML editing code does not yet handle very well."
+          LayoutBR {BR} at (657,27) size 0x0
           LayoutInline {I} at (0,0) size 99x20
             LayoutText {#text} at (0,48) size 99x20
               text run at (0,48) width 99: "For this test: "
-          LayoutText {#text} at (99,48) size 221x20
-            text run at (99,48) width 221: "Test typing at the end of a list."
+          LayoutText {#text} at (99,48) size 222x20
+            text run at (99,48) width 222: "Test typing at the end of a list."
         LayoutNGBlockFlow (anonymous) at (20,89) size 744x21
           LayoutBR {BR} at (0,0) size 0x0
         LayoutNGBlockFlow {DIV} at (20,110) size 744x90
@@ -39,8 +39,8 @@
           LayoutInline {I} at (0,0) size 99x20
             LayoutText {#text} at (0,69) size 99x20
               text run at (0,69) width 99: "For this test: "
-          LayoutText {#text} at (99,69) size 422x20
-            text run at (99,69) width 422: "Typed text should appear after (on the line below) the list."
+          LayoutText {#text} at (99,69) size 423x20
+            text run at (99,69) width 423: "Typed text should appear after (on the line below) the list."
       LayoutNGBlockFlow {DIV} at (0,230) size 784x136 [border: (2px solid #008000)]
         LayoutNGBlockFlow {UL} at (2,26) size 780x84
           LayoutNGListItem {LI} at (40,0) size 740x28
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-type-before-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-type-before-expected.png
index 9271e87..ce6a21d 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-type-before-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-type-before-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-type-before-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-type-before-expected.txt
index c23dc43..251563d 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-type-before-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/list-type-before-expected.txt
@@ -15,14 +15,14 @@
           LayoutText {#text} at (0,0) size 59x26
             text run at (0,0) width 59: "Tests:"
           LayoutBR {BR} at (59,0) size 0x0
-          LayoutText {#text} at (0,27) size 658x20
-            text run at (0,27) width 658: "Our ability to \"edit around\" content the HTML editing code does not yet handle very well."
-          LayoutBR {BR} at (658,27) size 0x0
+          LayoutText {#text} at (0,27) size 657x20
+            text run at (0,27) width 657: "Our ability to \"edit around\" content the HTML editing code does not yet handle very well."
+          LayoutBR {BR} at (657,27) size 0x0
           LayoutInline {I} at (0,0) size 99x20
             LayoutText {#text} at (0,48) size 99x20
               text run at (0,48) width 99: "For this test: "
-          LayoutText {#text} at (99,48) size 226x20
-            text run at (99,48) width 226: "Test typing at the start of a list."
+          LayoutText {#text} at (99,48) size 227x20
+            text run at (99,48) width 227: "Test typing at the start of a list."
         LayoutNGBlockFlow (anonymous) at (20,89) size 744x21
           LayoutBR {BR} at (0,0) size 0x0
         LayoutNGBlockFlow {DIV} at (20,110) size 744x90
@@ -36,8 +36,8 @@
           LayoutInline {I} at (0,0) size 99x20
             LayoutText {#text} at (0,69) size 99x20
               text run at (0,69) width 99: "For this test: "
-          LayoutText {#text} at (99,69) size 413x20
-            text run at (99,69) width 413: "Typed text should appear at the start of the first list item."
+          LayoutText {#text} at (99,69) size 414x20
+            text run at (99,69) width 414: "Typed text should appear at the start of the first list item."
       LayoutNGBlockFlow {DIV} at (0,230) size 784x136 [border: (2px solid #008000)]
         LayoutNGBlockFlow {UL} at (2,26) size 780x84
           LayoutNGListItem {LI} at (40,0) size 740x28
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-delete-001-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-delete-001-expected.png
new file mode 100644
index 0000000..1d794ed
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-delete-001-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-delete-001-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-delete-001-expected.txt
index c1094792..7d07b3a 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-delete-001-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-delete-001-expected.txt
@@ -30,9 +30,9 @@
           LayoutText {#text} at (0,0) size 59x26
             text run at (0,0) width 59: "Tests:"
           LayoutBR {BR} at (59,0) size 0x0
-          LayoutText {#text} at (0,27) size 658x20
-            text run at (0,27) width 658: "Our ability to \"edit around\" content the HTML editing code does not yet handle very well."
-          LayoutBR {BR} at (658,27) size 0x0
+          LayoutText {#text} at (0,27) size 657x20
+            text run at (0,27) width 657: "Our ability to \"edit around\" content the HTML editing code does not yet handle very well."
+          LayoutBR {BR} at (657,27) size 0x0
           LayoutInline {I} at (0,0) size 99x20
             LayoutText {#text} at (0,48) size 99x20
               text run at (0,48) width 99: "For this test: "
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-delete-002-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-delete-002-expected.png
new file mode 100644
index 0000000..1aa6a67
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-delete-002-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-delete-002-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-delete-002-expected.txt
index 96e3614e..cd673a0 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-delete-002-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-delete-002-expected.txt
@@ -27,9 +27,9 @@
           LayoutText {#text} at (0,0) size 59x26
             text run at (0,0) width 59: "Tests:"
           LayoutBR {BR} at (59,0) size 0x0
-          LayoutText {#text} at (0,27) size 658x20
-            text run at (0,27) width 658: "Our ability to \"edit around\" content the HTML editing code does not yet handle very well."
-          LayoutBR {BR} at (658,27) size 0x0
+          LayoutText {#text} at (0,27) size 657x20
+            text run at (0,27) width 657: "Our ability to \"edit around\" content the HTML editing code does not yet handle very well."
+          LayoutBR {BR} at (657,27) size 0x0
           LayoutInline {I} at (0,0) size 99x20
             LayoutText {#text} at (0,48) size 99x20
               text run at (0,48) width 99: "For this test: "
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-delete-003-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-delete-003-expected.png
new file mode 100644
index 0000000..2b22f73
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-delete-003-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-delete-003-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-delete-003-expected.txt
index ad239fa..720b4a9 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-delete-003-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-delete-003-expected.txt
@@ -21,9 +21,9 @@
           LayoutText {#text} at (0,0) size 59x26
             text run at (0,0) width 59: "Tests:"
           LayoutBR {BR} at (59,0) size 0x0
-          LayoutText {#text} at (0,27) size 658x20
-            text run at (0,27) width 658: "Our ability to \"edit around\" content the HTML editing code does not yet handle very well."
-          LayoutBR {BR} at (658,27) size 0x0
+          LayoutText {#text} at (0,27) size 657x20
+            text run at (0,27) width 657: "Our ability to \"edit around\" content the HTML editing code does not yet handle very well."
+          LayoutBR {BR} at (657,27) size 0x0
           LayoutInline {I} at (0,0) size 99x20
             LayoutText {#text} at (0,48) size 99x20
               text run at (0,48) width 99: "For this test: "
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-type-after-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-type-after-expected.png
new file mode 100644
index 0000000..132214ed
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-type-after-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-type-after-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-type-after-expected.txt
index 005c018..08d58374 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-type-after-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-type-after-expected.txt
@@ -25,14 +25,14 @@
           LayoutText {#text} at (0,0) size 59x26
             text run at (0,0) width 59: "Tests:"
           LayoutBR {BR} at (59,0) size 0x0
-          LayoutText {#text} at (0,27) size 658x20
-            text run at (0,27) width 658: "Our ability to \"edit around\" content the HTML editing code does not yet handle very well."
-          LayoutBR {BR} at (658,27) size 0x0
+          LayoutText {#text} at (0,27) size 657x20
+            text run at (0,27) width 657: "Our ability to \"edit around\" content the HTML editing code does not yet handle very well."
+          LayoutBR {BR} at (657,27) size 0x0
           LayoutInline {I} at (0,0) size 99x20
             LayoutText {#text} at (0,48) size 99x20
               text run at (0,48) width 99: "For this test: "
-          LayoutText {#text} at (99,48) size 176x20
-            text run at (99,48) width 176: "Test typing after a table."
+          LayoutText {#text} at (99,48) size 177x20
+            text run at (99,48) width 177: "Test typing after a table."
         LayoutNGBlockFlow (anonymous) at (20,89) size 744x21
           LayoutBR {BR} at (0,0) size 0x0
         LayoutNGBlockFlow {DIV} at (20,110) size 744x90
@@ -46,8 +46,8 @@
           LayoutInline {I} at (0,0) size 99x20
             LayoutText {#text} at (0,69) size 99x20
               text run at (0,69) width 99: "For this test: "
-          LayoutText {#text} at (99,69) size 435x20
-            text run at (99,69) width 435: "Typed text should appear after (on the line below) the table."
+          LayoutText {#text} at (99,69) size 436x20
+            text run at (99,69) width 436: "Typed text should appear after (on the line below) the table."
       LayoutNGBlockFlow {DIV} at (0,230) size 784x114 [border: (2px solid #008000)]
         LayoutTable {TABLE} at (2,2) size 46x82 [border: (1px outset #808080)]
           LayoutTableSection {TBODY} at (1,1) size 44x80
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-type-before-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-type-before-expected.png
new file mode 100644
index 0000000..16775c6d6
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-type-before-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-type-before-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-type-before-expected.txt
index 7f9e63363..158c364 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-type-before-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/editing/unsupported-content/table-type-before-expected.txt
@@ -15,14 +15,14 @@
           LayoutText {#text} at (0,0) size 59x26
             text run at (0,0) width 59: "Tests:"
           LayoutBR {BR} at (59,0) size 0x0
-          LayoutText {#text} at (0,27) size 658x20
-            text run at (0,27) width 658: "Our ability to \"edit around\" content the HTML editing code does not yet handle very well."
-          LayoutBR {BR} at (658,27) size 0x0
+          LayoutText {#text} at (0,27) size 657x20
+            text run at (0,27) width 657: "Our ability to \"edit around\" content the HTML editing code does not yet handle very well."
+          LayoutBR {BR} at (657,27) size 0x0
           LayoutInline {I} at (0,0) size 99x20
             LayoutText {#text} at (0,48) size 99x20
               text run at (0,48) width 99: "For this test: "
-          LayoutText {#text} at (99,48) size 189x20
-            text run at (99,48) width 189: "Test typing before a table."
+          LayoutText {#text} at (99,48) size 190x20
+            text run at (99,48) width 190: "Test typing before a table."
         LayoutNGBlockFlow (anonymous) at (20,89) size 744x21
           LayoutBR {BR} at (0,0) size 0x0
         LayoutNGBlockFlow {DIV} at (20,110) size 744x90
@@ -36,8 +36,8 @@
           LayoutInline {I} at (0,0) size 99x20
             LayoutText {#text} at (0,69) size 99x20
               text run at (0,69) width 99: "For this test: "
-          LayoutText {#text} at (99,69) size 447x20
-            text run at (99,69) width 447: "Typed text should appear before (on the line above) the table."
+          LayoutText {#text} at (99,69) size 448x20
+            text run at (99,69) width 448: "Typed text should appear before (on the line above) the table."
       LayoutNGBlockFlow {DIV} at (0,230) size 784x114 [border: (2px solid #008000)]
         LayoutNGBlockFlow (anonymous) at (2,2) size 780x28
           LayoutText {#text} at (0,0) size 36x27
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/animated-gif-as-background-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/animated-gif-as-background-expected.png
index 3c3d5db..1925bc5 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/animated-gif-as-background-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/animated-gif-as-background-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/animated-gif-as-background-rounded-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/animated-gif-as-background-rounded-expected.png
index 8a0b183..f35183a 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/animated-gif-as-background-rounded-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/animated-gif-as-background-rounded-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/background-inherit-color-bug-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/background-inherit-color-bug-expected.png
index 791d401..674dabd 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/background-inherit-color-bug-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/background-inherit-color-bug-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/background-inherit-color-bug-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/background-inherit-color-bug-expected.txt
index 283edb1..e922f1b 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/background-inherit-color-bug-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/background-inherit-color-bug-expected.txt
@@ -50,26 +50,26 @@
           LayoutText {#text} at (0,0) size 219x19
             text run at (0,0) width 219: "This DIV has a green background."
         LayoutNGBlockFlow {H1} at (61.52,45.44) size 500.14x156 [border: (4px solid #008000)]
-          LayoutText {#text} at (4,4) size 445x147
-            text run at (4,4) width 441: "This header should have a green"
-            text run at (4,41) width 418: "background (not pink) but the"
-            text run at (4,78) width 445: "inline style rule is ignored on the"
-            text run at (4,115) width 258: "Affected Browsers."
+          LayoutText {#text} at (4,4) size 444x147
+            text run at (4,4) width 439: "This header should have a green"
+            text run at (4,41) width 417: "background (not pink) but the"
+            text run at (4,78) width 444: "inline style rule is ignored on the"
+            text run at (4,115) width 257: "Affected Browsers."
         LayoutNGBlockFlow (anonymous) at (4,231.44) size 615.19x20
           LayoutText {#text} at (0,0) size 157x19
             text run at (0,0) width 157: "The DIV continues here."
         LayoutNGBlockFlow {H1} at (61.52,272.88) size 500.14x156 [border: (4px solid #008000)]
-          LayoutText {#text} at (4,4) size 449x147
-            text run at (4,4) width 441: "This header should have a green"
-            text run at (4,41) width 418: "background (not pink) but the"
-            text run at (4,78) width 449: "!important rule is ignored on the"
-            text run at (4,115) width 258: "Affected Browsers."
+          LayoutText {#text} at (4,4) size 448x147
+            text run at (4,4) width 439: "This header should have a green"
+            text run at (4,41) width 417: "background (not pink) but the"
+            text run at (4,78) width 448: "!important rule is ignored on the"
+            text run at (4,115) width 257: "Affected Browsers."
         LayoutNGBlockFlow (anonymous) at (4,458.88) size 615.19x20
           LayoutText {#text} at (0,0) size 157x19
             text run at (0,0) width 157: "The DIV continues here."
         LayoutNGBlockFlow {H1} at (61.52,500.31) size 500.14x82 [color=#FF0000] [bgcolor=#FFC0CB] [border: (4px solid #FF0000)]
-          LayoutText {#text} at (4,4) size 485x73
-            text run at (4,4) width 485: "This header has a pink background"
+          LayoutText {#text} at (4,4) size 483x73
+            text run at (4,4) width 483: "This header has a pink background"
             text run at (4,41) width 219: "and that's good."
 layer at (85,80) size 615x2 clip at (0,0) size 0x0
   LayoutNGBlockFlow {HR} at (4,72) size 615.19x2 [border: (1px inset #EEEEEE)]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/background-origin-root-element-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/background-origin-root-element-expected.png
new file mode 100644
index 0000000..f9cc03c
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/background-origin-root-element-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/background-origin-root-element-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/background-origin-root-element-expected.txt
new file mode 100644
index 0000000..600fb8f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/background-origin-root-element-expected.txt
@@ -0,0 +1,10 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (16,16) size 768x248
+  LayoutNGBlockFlow {HTML} at (16,16) size 768x248 [color=#FFFF00] [border: (3px solid #0000FF)]
+    LayoutNGBlockFlow {BODY} at (35,35) size 698x178 [color=#000000] [bgcolor=#FFFFFF] [border: (3px solid #000000)]
+      LayoutNGBlockFlow {P} at (19,19) size 660x140
+        LayoutText {#text} at (0,0) size 649x59
+          text run at (0,0) width 649: "The HTML box, the one with a blue border should be fully filled with lime green. The BODY box, the"
+          text run at (0,20) width 645: "one with black border, should also be fully filled with lime green. The lime green color should not spill"
+          text run at (0,40) width 171: "out outside the blue border."
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/repeat/noRepeatCorrectClip-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/repeat/noRepeatCorrectClip-expected.png
index 3580f278..6135b4a 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/repeat/noRepeatCorrectClip-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/backgrounds/repeat/noRepeatCorrectClip-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/basic/015-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/basic/015-expected.png
index 1adbc7c..0452cc05 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/basic/015-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/basic/015-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/basic/016-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/basic/016-expected.png
new file mode 100644
index 0000000..0c0a5d9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/basic/016-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/basic/020-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/basic/020-expected.png
new file mode 100644
index 0000000..e255f14
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/basic/020-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/basic/truncation-rtl-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/basic/truncation-rtl-expected.png
index f9fe174..46a9787 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/basic/truncation-rtl-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/basic/truncation-rtl-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/float/014-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/float/014-expected.png
index d7da708..0860ea3 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/float/014-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/float/014-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/float/centered-float-avoidance-complexity-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/float/centered-float-avoidance-complexity-expected.png
index d81342c..7c1a0ab 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/float/centered-float-avoidance-complexity-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/float/centered-float-avoidance-complexity-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/float/editable-text-overlapping-float-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/float/editable-text-overlapping-float-expected.png
index 34dda8c..882233f 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/float/editable-text-overlapping-float-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/float/editable-text-overlapping-float-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/float/independent-align-positioning-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/float/independent-align-positioning-expected.png
new file mode 100644
index 0000000..9248128
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/float/independent-align-positioning-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/positioning/absolute-in-inline-rtl-2-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/positioning/absolute-in-inline-rtl-2-expected.png
new file mode 100644
index 0000000..eefce50
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/positioning/absolute-in-inline-rtl-2-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/positioning/absolute-in-inline-rtl-3-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/positioning/absolute-in-inline-rtl-3-expected.png
new file mode 100644
index 0000000..f8a43920
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/positioning/absolute-in-inline-rtl-3-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/positioning/absolute-in-inline-rtl-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/positioning/absolute-in-inline-rtl-expected.png
new file mode 100644
index 0000000..5f1cfb08
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/positioning/absolute-in-inline-rtl-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/positioning/absolute-in-inline-short-rtl-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/positioning/absolute-in-inline-short-rtl-expected.png
new file mode 100644
index 0000000..9106712
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/block/positioning/absolute-in-inline-short-rtl-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/border-radius-mask-canvas-border-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/border-radius-mask-canvas-border-expected.png
index 38e9b30..2d01296 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/border-radius-mask-canvas-border-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/border-radius-mask-canvas-border-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/border-radius-mask-canvas-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/border-radius-mask-canvas-expected.png
index 669c25f..4d9ec562 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/border-radius-mask-canvas-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/border-radius-mask-canvas-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/border-radius-mask-canvas-padding-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/border-radius-mask-canvas-padding-expected.png
index b2e15ca6..98355e2 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/border-radius-mask-canvas-padding-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/border-radius-mask-canvas-padding-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/border-radius-mask-video-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/border-radius-mask-video-expected.png
index 990bd0b0..947fdd4 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/border-radius-mask-video-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/border-radius-mask-video-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/border-radius-mask-video-ratio-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/border-radius-mask-video-ratio-expected.png
index 2bbb587..10a5d02f 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/border-radius-mask-video-ratio-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/border-radius-mask-video-ratio-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/border-radius-mask-video-shadow-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/border-radius-mask-video-shadow-expected.png
index 5a9c62e..be7e2b7 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/border-radius-mask-video-shadow-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/border-radius-mask-video-shadow-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/rtl-border-02-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/rtl-border-02-expected.png
new file mode 100644
index 0000000..ffd94a5
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/borders/rtl-border-02-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/canvas/image-object-in-canvas-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/canvas/image-object-in-canvas-expected.png
new file mode 100644
index 0000000..464735a0
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/canvas/image-object-in-canvas-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/canvas/patternfill-repeat-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/canvas/patternfill-repeat-expected.png
new file mode 100644
index 0000000..f1a008b
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/canvas/patternfill-repeat-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/canvas/patternfill-repeat-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/canvas/patternfill-repeat-expected.txt
new file mode 100644
index 0000000..50f4ffbe
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/canvas/patternfill-repeat-expected.txt
@@ -0,0 +1,14 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x469
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x469
+    LayoutNGBlockFlow {BODY} at (8,16) size 784x437
+      LayoutNGBlockFlow {P} at (0,0) size 784x80
+        LayoutText {#text} at (0,0) size 771x79
+          text run at (0,0) width 750: "There should be one big square below containing four squares. Top left square should be filled with 3 rows of 2 and bit"
+          text run at (0,20) width 771: "Apple images. Top right square should be 2 and a bit rows with one Apple image column along the left edge of the square."
+          text run at (0,40) width 763: "Bottom left square should be one row with three Apple images along the top of the square. Bottom right square should be"
+          text run at (0,60) width 218: "one Apple image in top left corner."
+      LayoutNGBlockFlow {P} at (0,96) size 784x341
+layer at (8,112) size 336x336
+  LayoutHTMLCanvas {CANVAS} at (0,0) size 336x336 [border: (3px solid #000000)]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/clip/overflow-border-radius-fixed-position-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/clip/overflow-border-radius-fixed-position-expected.png
new file mode 100644
index 0000000..0853f89
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/clip/overflow-border-radius-fixed-position-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/009-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/009-expected.png
index d7d80e6..064dfd3 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/009-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/009-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/009-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/009-expected.txt
index 0a8e365..799199e 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/009-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/009-expected.txt
@@ -19,12 +19,12 @@
           LayoutText {#text} at (0,0) size 373x19
             text run at (0,0) width 373: "All of this text should be green. The bullet should be black."
       LayoutNGBlockFlow {DIV} at (0,72) size 784x57 [color=#FF0000]
-        LayoutInline {SPAN} at (0,0) size 429x55 [color=#008000]
+        LayoutInline {SPAN} at (0,0) size 428x55 [color=#008000]
           LayoutInline {<pseudo:first-letter>} at (0,0) size 35x55
             LayoutTextFragment (anonymous) at (0,1) size 35x55
               text run at (0,1) width 35: "A"
-          LayoutTextFragment {#text} at (35,29) size 394x19
-            text run at (35,29) width 394: "ll of this text should be green, including the big \"A\" first-letter."
+          LayoutTextFragment {#text} at (35,29) size 393x19
+            text run at (35,29) width 393: "ll of this text should be green, including the big \"A\" first-letter."
       LayoutNGBlockFlow {P} at (0,145) size 784x0
       LayoutNGBlockFlow {DIV} at (0,145) size 784x20
         LayoutNGBlockFlow {DIV} at (0,0) size 163x20 [color=#FF0000]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/012-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/012-expected.png
index 8dbf4b6..7410181 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/012-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/012-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/012-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/012-expected.txt
index 9c7e314..ead25552 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/012-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/012-expected.txt
@@ -4,24 +4,24 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x600
     LayoutNGBlockFlow {BODY} at (8,8) size 784x568
       LayoutNGBlockFlow {H1} at (0,0) size 784x57
-        LayoutText {#text} at (0,1) size 774x55
-          text run at (0,1) width 774: "Inheritance bug for floated first-letter"
+        LayoutText {#text} at (0,1) size 773x55
+          text run at (0,1) width 773: "Inheritance bug for floated first-letter"
       LayoutNGBlockFlow {P} at (0,89.16) size 784x172 [bgcolor=#EEEEEE] [border: (1px solid #000000)]
         LayoutInline {<pseudo:first-letter>} at (0,0) size 54x86 [color=#008000] [border: (1px dashed #008000)]
           LayoutTextFragment (anonymous) at (2,2) size 52x84
             text run at (2,2) width 52: "H"
-        LayoutTextFragment {#text} at (55,48) size 782x122
+        LayoutTextFragment {#text} at (55,48) size 780x122
           text run at (55,48) width 726: "ere is the first paragraph. Here the CSS :first-line rule sets the text to"
           text run at (1,87) width 773: "a green, sans-serif font. Then, the CSS :first-letter rule sets the font size to 3em,"
-          text run at (1,115) width 782: "and makes the text bold. And here's some more text to pad out the paragraph and"
-          text run at (1,143) width 682: "make things look nice (or, at least, to illustrate the problem correctly)."
+          text run at (1,115) width 742: "and makes the text bold. And here's some more text to pad out the paragraph"
+          text run at (1,143) width 722: "and make things look nice (or, at least, to illustrate the problem correctly)."
       LayoutNGBlockFlow {P} at (0,285.16) size 784x142 [bgcolor=#EEEEEE] [border: (1px solid #000000)]
         LayoutNGBlockFlow (floating) {<pseudo:first-letter>} at (1,1) size 54x88 [color=#008000] [border: (1px dashed #008000)]
           LayoutTextFragment (anonymous) at (1,2) size 52x84
             text run at (1,2) width 52: "H"
         LayoutTextFragment {#text} at (55,1) size 768x139
           text run at (55,1) width 714: "ere is the second paragraph. This is just like the first except that the"
-          text run at (55,29) width 680: "rule p.floated:first-letter floats the first letter to the left. However, this"
+          text run at (55,29) width 679: "rule p.floated:first-letter floats the first letter to the left. However, this"
           text run at (55,57) width 683: "floated element should still inherit the font properties (green and sans-"
-          text run at (55,85) width 702: "serif) from the first-line: selector. It does not -- instead, the font is black,"
-          text run at (1,113) width 540: "and uses the serif font. .... And here's some more text ...."
+          text run at (55,85) width 703: "serif) from the first-line: selector. It does not -- instead, the font is black,"
+          text run at (1,113) width 541: "and uses the serif font. .... And here's some more text ...."
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/013-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/013-expected.png
new file mode 100644
index 0000000..188f2c57
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/013-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/013-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/013-expected.txt
new file mode 100644
index 0000000..a1c2ff7
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/013-expected.txt
@@ -0,0 +1,41 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x600
+    LayoutNGBlockFlow {BODY} at (8,8) size 784x584
+      LayoutNGBlockFlow {H1} at (0,0) size 784x37
+        LayoutInline {<pseudo:before>} at (0,0) size 206x36
+          LayoutTextFragment (anonymous) at (0,0) size 206x36
+            text run at (0,0) width 206: "First Chapter: "
+        LayoutText {#text} at (206,0) size 104x36
+          text run at (206,0) width 104: "TEST 1"
+      LayoutNGBlockFlow (anonymous) at (0,58.44) size 784x20
+        LayoutText {#text} at (0,0) size 239x19
+          text run at (0,0) width 239: "Should read: \"First Chapter: TEST 1\""
+      LayoutNGBlockFlow {H2} at (0,98.34) size 784x27
+        LayoutInline {<pseudo:before>} at (0,0) size 99x26
+          LayoutTextFragment (anonymous) at (0,0) size 99x26
+            text run at (0,0) width 99: "Chapter: "
+        LayoutText {#text} at (99,0) size 79x26
+          text run at (99,0) width 79: "TEST 2"
+      LayoutNGBlockFlow (anonymous) at (0,145.25) size 784x20
+        LayoutText {#text} at (0,0) size 207x19
+          text run at (0,0) width 207: "Should read: \"Chapter: TEST 2\""
+      LayoutNGBlockFlow {H3} at (0,183.97) size 784x23
+        LayoutInline {<pseudo:before>} at (0,0) size 118x22
+          LayoutTextFragment (anonymous) at (0,0) size 118x22
+            text run at (0,0) width 118: "Chapter One: "
+        LayoutText {#text} at (118,0) size 65x22
+          text run at (118,0) width 65: "TEST 3"
+      LayoutNGBlockFlow (anonymous) at (0,225.69) size 784x20
+        LayoutText {#text} at (0,0) size 238x19
+          text run at (0,0) width 238: "Should read: \"Chapter One: TEST 3\""
+      LayoutNGBlockFlow {H4} at (0,266.95) size 784x20
+        LayoutInline {<pseudo:before>} at (0,0) size 66x19
+          LayoutTextFragment (anonymous) at (0,0) size 66x19
+            text run at (0,0) width 66: "Chapter: "
+        LayoutText {#text} at (66,0) size 54x19
+          text run at (66,0) width 54: "TEST 4"
+      LayoutNGBlockFlow (anonymous) at (0,308.22) size 784x20
+        LayoutText {#text} at (0,0) size 207x19
+          text run at (0,0) width 207: "Should read: \"Chapter: TEST 4\""
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-before-after-child-add-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-before-after-child-add-expected.png
index 57b1bbd8..9637be6 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-before-after-child-add-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-before-after-child-add-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-cell-before-after-child-add-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-cell-before-after-child-add-expected.png
index cb6bec338..86a738ae 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-cell-before-after-child-add-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-cell-before-after-child-add-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-row-before-after-child-add-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-row-before-after-child-add-expected.png
index 57b1bbd8..9637be6 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-row-before-after-child-add-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-row-before-after-child-add-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-row-group-to-inline-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-row-group-to-inline-expected.png
index a4d9871..9b90f639 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-row-group-to-inline-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-row-group-to-inline-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-row-group-with-before-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-row-group-with-before-expected.png
index ed5813f..0c95cd5 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-row-group-with-before-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-row-group-with-before-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-row-with-before-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-row-with-before-expected.png
index ed5813f..0c95cd5 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-row-with-before-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-row-with-before-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-table-before-after-child-add-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-table-before-after-child-add-expected.png
index 57b1bbd8..9637be6 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-table-before-after-child-add-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-table-before-after-child-add-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-with-before-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-with-before-expected.png
index ed5813f..0c95cd5 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-with-before-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css-generated-content/table-with-before-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/001-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/001-expected.png
index fa95bb0..619926b 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/001-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/001-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/004-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/004-expected.png
new file mode 100644
index 0000000..ee59b22
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/004-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/004-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/004-expected.txt
index 063fa051..c31d27e 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/004-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/004-expected.txt
@@ -4,20 +4,20 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x283.88
     LayoutNGBlockFlow {BODY} at (8,21.44) size 784x246.44
       LayoutNGBlockFlow {H1} at (0,0) size 784x37
-        LayoutText {#text} at (0,0) size 421x36
-          text run at (0,0) width 421: "Shorthand border properties 2"
+        LayoutText {#text} at (0,0) size 419x36
+          text run at (0,0) width 419: "Shorthand border properties 2"
       LayoutNGBlockFlow {P} at (0,58.44) size 784x20
-        LayoutText {#text} at (0,0) size 499x19
-          text run at (0,0) width 499: "This test was written to test a point I mentioned to Tantek \x{C7}elik on 2000-07-13."
+        LayoutText {#text} at (0,0) size 500x19
+          text run at (0,0) width 500: "This test was written to test a point I mentioned to Tantek \x{C7}elik on 2000-07-13."
       LayoutNGBlockFlow {P} at (0,94.44) size 784x26 [color=#008000] [border: (3px solid #008000)]
-        LayoutText {#text} at (3,3) size 274x19
-          text run at (3,3) width 274: "This paragraph should have a green border."
+        LayoutText {#text} at (3,3) size 273x19
+          text run at (3,3) width 273: "This paragraph should have a green border."
       LayoutNGBlockFlow {P} at (0,136.44) size 784x26 [color=#008000] [border: (3px solid #008000)]
-        LayoutText {#text} at (3,3) size 274x19
-          text run at (3,3) width 274: "This paragraph should have a green border."
+        LayoutText {#text} at (3,3) size 273x19
+          text run at (3,3) width 273: "This paragraph should have a green border."
       LayoutNGBlockFlow {P} at (0,178.44) size 784x26 [color=#008000] [border: (3px solid #008000)]
-        LayoutText {#text} at (3,3) size 274x19
-          text run at (3,3) width 274: "This paragraph should have a green border."
+        LayoutText {#text} at (3,3) size 273x19
+          text run at (3,3) width 273: "This paragraph should have a green border."
       LayoutNGBlockFlow {P} at (0,220.44) size 784x26 [color=#008000] [border: (3px solid #008000)]
-        LayoutText {#text} at (3,3) size 274x19
-          text run at (3,3) width 274: "This paragraph should have a green border."
+        LayoutText {#text} at (3,3) size 273x19
+          text run at (3,3) width 273: "This paragraph should have a green border."
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/005-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/005-expected.png
new file mode 100644
index 0000000..a312ed19
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/005-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/005-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/005-expected.txt
index 73711b8..5fe1d7f 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/005-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/005-expected.txt
@@ -4,71 +4,71 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x769.88
     LayoutNGBlockFlow {BODY} at (8,21.44) size 784x732.44
       LayoutNGBlockFlow {H1} at (0,0) size 784x37
-        LayoutText {#text} at (0,0) size 378x36
-          text run at (0,0) width 378: "Shorthand border property"
+        LayoutText {#text} at (0,0) size 376x36
+          text run at (0,0) width 376: "Shorthand border property"
       LayoutNGBlockFlow {P} at (0,58.44) size 784x26 [color=#008000] [bgcolor=#FFFFFF] [border: (3px solid #008000)]
-        LayoutText {#text} at (3,3) size 363x19
-          text run at (3,3) width 363: "This paragraph should have a medium solid green border."
+        LayoutText {#text} at (3,3) size 362x19
+          text run at (3,3) width 362: "This paragraph should have a medium solid green border."
       LayoutNGBlockFlow {P} at (0,100.44) size 784x26 [color=#008000] [bgcolor=#FFFFFF] [border: (3px solid #008000)]
-        LayoutText {#text} at (3,3) size 363x19
-          text run at (3,3) width 363: "This paragraph should have a medium solid green border."
+        LayoutText {#text} at (3,3) size 362x19
+          text run at (3,3) width 362: "This paragraph should have a medium solid green border."
       LayoutNGBlockFlow {P} at (0,142.44) size 784x20 [bgcolor=#FFFFFF]
-        LayoutText {#text} at (0,0) size 259x19
-          text run at (0,0) width 259: "This paragraph should not have a border."
+        LayoutText {#text} at (0,0) size 258x19
+          text run at (0,0) width 258: "This paragraph should not have a border."
       LayoutNGBlockFlow {P} at (0,178.44) size 784x26 [bgcolor=#FFFFFF] [border: (3px solid #000000)]
         LayoutText {#text} at (3,3) size 279x19
           text run at (3,3) width 279: "This paragraph should have a medium solid "
         LayoutInline {EM} at (0,0) size 34x19
           LayoutText {#text} at (282,3) size 34x19
             text run at (282,3) width 34: "black"
-        LayoutText {#text} at (316,3) size 49x19
-          text run at (316,3) width 49: " border."
+        LayoutText {#text} at (316,3) size 48x19
+          text run at (316,3) width 48: " border."
       LayoutNGBlockFlow {P} at (0,220.44) size 784x20 [bgcolor=#FFFFFF]
-        LayoutText {#text} at (0,0) size 259x19
-          text run at (0,0) width 259: "This paragraph should not have a border."
+        LayoutText {#text} at (0,0) size 258x19
+          text run at (0,0) width 258: "This paragraph should not have a border."
       LayoutNGBlockFlow {P} at (0,256.44) size 784x20 [bgcolor=#FFFFFF]
-        LayoutText {#text} at (0,0) size 259x19
-          text run at (0,0) width 259: "This paragraph should not have a border."
+        LayoutText {#text} at (0,0) size 258x19
+          text run at (0,0) width 258: "This paragraph should not have a border."
       LayoutNGBlockFlow {P} at (0,292.44) size 784x26 [bgcolor=#FFFFFF] [border: (3px solid #000000)]
         LayoutText {#text} at (3,3) size 279x19
           text run at (3,3) width 279: "This paragraph should have a medium solid "
         LayoutInline {EM} at (0,0) size 34x19
           LayoutText {#text} at (282,3) size 34x19
             text run at (282,3) width 34: "black"
-        LayoutText {#text} at (316,3) size 49x19
-          text run at (316,3) width 49: " border."
+        LayoutText {#text} at (316,3) size 48x19
+          text run at (316,3) width 48: " border."
       LayoutNGBlockFlow {P} at (0,334.44) size 784x26 [bgcolor=#FFFFFF] [border: (3px solid #000000)]
         LayoutText {#text} at (3,3) size 279x19
           text run at (3,3) width 279: "This paragraph should have a medium solid "
         LayoutInline {EM} at (0,0) size 34x19
           LayoutText {#text} at (282,3) size 34x19
             text run at (282,3) width 34: "black"
-        LayoutText {#text} at (316,3) size 49x19
-          text run at (316,3) width 49: " border."
+        LayoutText {#text} at (316,3) size 48x19
+          text run at (316,3) width 48: " border."
       LayoutNGBlockFlow {P} at (0,376.44) size 784x26 [bgcolor=#FFFFFF] [border: (3px solid #008000)]
-        LayoutText {#text} at (3,3) size 363x19
-          text run at (3,3) width 363: "This paragraph should have a medium solid green border."
+        LayoutText {#text} at (3,3) size 362x19
+          text run at (3,3) width 362: "This paragraph should have a medium solid green border."
       LayoutNGBlockFlow {P} at (0,418.44) size 784x26 [bgcolor=#FFFFFF] [border: (3px solid #008000)]
-        LayoutText {#text} at (3,3) size 363x19
-          text run at (3,3) width 363: "This paragraph should have a medium solid green border."
+        LayoutText {#text} at (3,3) size 362x19
+          text run at (3,3) width 362: "This paragraph should have a medium solid green border."
       LayoutNGBlockFlow {P} at (0,460.44) size 784x20 [bgcolor=#FFFFFF]
-        LayoutText {#text} at (0,0) size 259x19
-          text run at (0,0) width 259: "This paragraph should not have a border."
+        LayoutText {#text} at (0,0) size 258x19
+          text run at (0,0) width 258: "This paragraph should not have a border."
       LayoutNGBlockFlow {P} at (0,496.44) size 784x26 [bgcolor=#FFFFFF] [border: (3px solid #008000)]
-        LayoutText {#text} at (3,3) size 363x19
-          text run at (3,3) width 363: "This paragraph should have a medium solid green border."
+        LayoutText {#text} at (3,3) size 362x19
+          text run at (3,3) width 362: "This paragraph should have a medium solid green border."
       LayoutNGBlockFlow {P} at (0,538.44) size 784x26 [bgcolor=#FFFFFF] [border: (3px solid #008000)]
-        LayoutText {#text} at (3,3) size 363x19
-          text run at (3,3) width 363: "This paragraph should have a medium solid green border."
+        LayoutText {#text} at (3,3) size 362x19
+          text run at (3,3) width 362: "This paragraph should have a medium solid green border."
       LayoutNGBlockFlow {P} at (0,580.44) size 784x26 [bgcolor=#FFFFFF] [border: (3px solid #008000)]
-        LayoutText {#text} at (3,3) size 363x19
-          text run at (3,3) width 363: "This paragraph should have a medium solid green border."
+        LayoutText {#text} at (3,3) size 362x19
+          text run at (3,3) width 362: "This paragraph should have a medium solid green border."
       LayoutNGBlockFlow {P} at (0,622.44) size 784x26 [bgcolor=#FFFFFF] [border: (3px solid #008000)]
-        LayoutText {#text} at (3,3) size 363x19
-          text run at (3,3) width 363: "This paragraph should have a medium solid green border."
+        LayoutText {#text} at (3,3) size 362x19
+          text run at (3,3) width 362: "This paragraph should have a medium solid green border."
       LayoutNGBlockFlow {P} at (0,664.44) size 784x26 [bgcolor=#FFFFFF] [border: (3px solid #008000)]
-        LayoutText {#text} at (3,3) size 363x19
-          text run at (3,3) width 363: "This paragraph should have a medium solid green border."
+        LayoutText {#text} at (3,3) size 362x19
+          text run at (3,3) width 362: "This paragraph should have a medium solid green border."
       LayoutNGBlockFlow {P} at (0,706.44) size 784x26 [bgcolor=#FFFFFF] [border: (3px solid #008000)]
-        LayoutText {#text} at (3,3) size 363x19
-          text run at (3,3) width 363: "This paragraph should have a medium solid green border."
+        LayoutText {#text} at (3,3) size 362x19
+          text run at (3,3) width 362: "This paragraph should have a medium solid green border."
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/ZeroOpacityLayers-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/ZeroOpacityLayers-expected.png
new file mode 100644
index 0000000..f86c321
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/ZeroOpacityLayers-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/ZeroOpacityLayers-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/ZeroOpacityLayers-expected.txt
new file mode 100644
index 0000000..69c6c377
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/ZeroOpacityLayers-expected.txt
@@ -0,0 +1,26 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x600
+    LayoutNGBlockFlow {BODY} at (8,8) size 784x584
+layer at (10,10) size 200x200
+  LayoutNGBlockFlow (positioned) {DIV} at (10,10) size 200x200 [bgcolor=#0000FF]
+layer at (20,20) size 180x180
+  LayoutNGBlockFlow (positioned) {DIV} at (10,10) size 180x180 [bgcolor=#00FF00]
+layer at (30,30) size 160x160 transparent
+  LayoutNGBlockFlow (positioned) {DIV} at (10,10) size 160x160 [bgcolor=#FF0000]
+    LayoutText {#text} at (0,0) size 150x19
+      text run at (0,0) width 150: "Should not see this text."
+layer at (40,40) size 140x140
+  LayoutNGBlockFlow (positioned) {DIV} at (10,10) size 140x140 [bgcolor=#FFFFFF]
+    LayoutText {#text} at (0,0) size 119x39
+      text run at (0,0) width 119: "Should not see this"
+      text run at (0,20) width 27: "text."
+layer at (100,100) size 200x200 transparent
+  LayoutNGBlockFlow (positioned) {DIV} at (80,80) size 200x200 [bgcolor=#FFFF00]
+layer at (10,316) size 790x60
+  LayoutNGBlockFlow (positioned) {P} at (10,316) size 790x60
+    LayoutText {#text} at (0,0) size 787x59
+      text run at (0,0) width 787: "Below are four boxes all within each other, and a box overlaping other boxes. The 3rd inner box is red, and has an opacity of"
+      text run at (0,20) width 770: "zero, and the box within it is black and has an opacity of 1. As the third box has opacity zero, the inner black is not visible."
+      text run at (0,40) width 623: "The yellow block has opacity of 0.5, and is as the same level in the DOM tree as the 3rd inner box."
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/ZeroOpacityLayers2-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/ZeroOpacityLayers2-expected.png
new file mode 100644
index 0000000..e91ca80
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/ZeroOpacityLayers2-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/ZeroOpacityLayers2-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/ZeroOpacityLayers2-expected.txt
new file mode 100644
index 0000000..0db180a
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/ZeroOpacityLayers2-expected.txt
@@ -0,0 +1,26 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x600
+    LayoutNGBlockFlow {BODY} at (8,8) size 784x584
+layer at (10,10) size 200x200
+  LayoutNGBlockFlow (positioned) {DIV} at (10,10) size 200x200 [bgcolor=#0000FF]
+layer at (20,20) size 180x180
+  LayoutNGBlockFlow (positioned) {DIV} at (10,10) size 180x180 [bgcolor=#00FF00]
+layer at (30,30) size 160x160 transparent
+  LayoutNGBlockFlow (positioned) {DIV} at (10,10) size 160x160 [bgcolor=#FF0000]
+    LayoutText {#text} at (0,0) size 150x19
+      text run at (0,0) width 150: "Should not see this text."
+layer at (40,40) size 140x140 transparent
+  LayoutNGBlockFlow (positioned) {DIV} at (10,10) size 140x140 [bgcolor=#FFFFFF]
+    LayoutText {#text} at (0,0) size 119x39
+      text run at (0,0) width 119: "Should not see this"
+      text run at (0,20) width 27: "text."
+layer at (100,100) size 200x200 transparent
+  LayoutNGBlockFlow (positioned) {DIV} at (80,80) size 200x200 [bgcolor=#FFFF00]
+layer at (10,316) size 790x60
+  LayoutNGBlockFlow (positioned) {P} at (10,316) size 790x60
+    LayoutText {#text} at (0,0) size 787x59
+      text run at (0,0) width 787: "Below are four boxes all within each other, and a box overlaping other boxes. The 3rd inner box is red, and has an opacity of"
+      text run at (0,20) width 782: "zero, and the box within it is black and has an opacity of 0.5. As the third box has opacity zero, the inner black is not visible."
+      text run at (0,40) width 623: "The yellow block has opacity of 0.5, and is as the same level in the DOM tree as the 3rd inner box."
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/background-shorthand-invalid-url-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/background-shorthand-invalid-url-expected.png
index 177a0396..bc279fa 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/background-shorthand-invalid-url-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/background-shorthand-invalid-url-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/background-shorthand-invalid-url-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/background-shorthand-invalid-url-expected.txt
index f5737ee9..769257d 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/background-shorthand-invalid-url-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/background-shorthand-invalid-url-expected.txt
@@ -4,8 +4,8 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x186.88
     LayoutNGBlockFlow {BODY} at (8,21.44) size 784x149.44
       LayoutNGBlockFlow {H1} at (0,0) size 784x37
-        LayoutText {#text} at (0,0) size 572x36
-          text run at (0,0) width 572: "The background image should not repeat."
+        LayoutText {#text} at (0,0) size 570x36
+          text run at (0,0) width 570: "The background image should not repeat."
       LayoutNGBlockFlow {DIV} at (0,58.44) size 784x91
         LayoutNGBlockFlow {UL} at (0,0) size 784x91
           LayoutNGListItem {LI} at (40,0) size 744x91 [border: (1px solid #FF0000)]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/bidi-override-in-anonymous-block-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/bidi-override-in-anonymous-block-expected.png
index e37652d..96b94666 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/bidi-override-in-anonymous-block-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/bidi-override-in-anonymous-block-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/bidi-override-in-anonymous-block-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/bidi-override-in-anonymous-block-expected.txt
index 5840198f..ade8302a 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/bidi-override-in-anonymous-block-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/bidi-override-in-anonymous-block-expected.txt
@@ -1,161 +1,161 @@
-layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 1295
+layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 1296
   LayoutView at (0,0) size 800x600
-layer at (0,0) size 785x1295 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
-  LayoutNGBlockFlow {HTML} at (0,0) size 785x1294.86
-    LayoutNGBlockFlow {BODY} at (8,16) size 769x1270.86
+layer at (0,0) size 785x1296 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
+  LayoutNGBlockFlow {HTML} at (0,0) size 785x1296.03
+    LayoutNGBlockFlow {BODY} at (8,16) size 769x1272.03
       LayoutNGBlockFlow {P} at (0,0) size 769x20
-        LayoutText {#text} at (0,0) size 160x19
-          text run at (0,0) width 160: "div, span, nested div/span"
+        LayoutText {#text} at (0,0) size 161x19
+          text run at (0,0) width 161: "div, span, nested div/span"
       LayoutNGBlockFlow {P} at (0,36) size 769x20
         LayoutText {#text} at (0,0) size 64x19
           text run at (0,0) width 64: "Single div"
-      LayoutNGBlockFlow {DIV} at (1.39,72) size 766.22x22.78 [border: (1.39px solid #000000)]
+      LayoutNGBlockFlow {DIV} at (1.47,72) size 766.06x22.94 [border: (1.47px solid #000000)]
         LayoutText {#text} at (742,1) size 23x20
           text run at (742,1) width 23: "abc"
-      LayoutNGBlockFlow {P} at (0,110.78) size 769x20
+      LayoutNGBlockFlow {P} at (0,110.94) size 769x20
         LayoutText {#text} at (0,0) size 410x19
           text run at (0,0) width 410: "The following 2 lines should be identical, ignorning whitespaces:"
-      LayoutNGBlockFlow {DIV} at (1.39,146.78) size 766.22x42.78 [border: (1.39px solid #000000)]
-        LayoutNGBlockFlow (anonymous) at (1.39,1.39) size 763.44x20
+      LayoutNGBlockFlow {DIV} at (1.47,146.94) size 766.06x42.94 [border: (1.47px solid #000000)]
+        LayoutNGBlockFlow (anonymous) at (1.47,1.47) size 763.13x20
           LayoutText {#text} at (741,0) size 23x19
             text run at (741,0) width 23: "abc"
-        LayoutNGBlockFlow {DIV} at (1.39,21.39) size 763.44x20
+        LayoutNGBlockFlow {DIV} at (1.47,21.47) size 763.13x20
           LayoutText {#text} at (741,0) size 23x19
             text run at (741,0) width 23: "cba"
-      LayoutNGBlockFlow {P} at (0,205.56) size 769x20
+      LayoutNGBlockFlow {P} at (0,205.88) size 769x20
         LayoutText {#text} at (0,0) size 417x19
           text run at (0,0) width 417: "The following 2 textes should be identical, ignorning whitespaces:"
-      LayoutNGBlockFlow {DIV} at (1.39,241.56) size 766.22x22.78 [border: (1.39px solid #000000)]
+      LayoutNGBlockFlow {DIV} at (1.47,241.88) size 766.06x22.94 [border: (1.47px solid #000000)]
         LayoutText {#text} at (738,1) size 27x20
           text run at (738,1) width 27: "abc "
         LayoutInline {SPAN} at (0,0) size 23x20
           LayoutText {#text} at (716,1) size 23x20
             text run at (716,1) width 23: "abc"
-      LayoutNGBlockFlow {P} at (0,280.34) size 769x20
+      LayoutNGBlockFlow {P} at (0,280.81) size 769x20
         LayoutText {#text} at (0,0) size 410x19
           text run at (0,0) width 410: "The following 2 lines should be identical, ignorning whitespaces:"
-      LayoutNGBlockFlow {DIV} at (1.39,316.34) size 766.22x42.78 [border: (1.39px solid #000000)]
-        LayoutNGBlockFlow {DIV} at (1.39,1.39) size 763.44x20
+      LayoutNGBlockFlow {DIV} at (1.47,316.81) size 766.06x42.94 [border: (1.47px solid #000000)]
+        LayoutNGBlockFlow {DIV} at (1.47,1.47) size 763.13x20
           LayoutText {#text} at (741,0) size 23x19
             text run at (741,0) width 23: "cba"
-        LayoutNGBlockFlow (anonymous) at (1.39,21.39) size 763.44x20
+        LayoutNGBlockFlow (anonymous) at (1.47,21.47) size 763.13x20
           LayoutText {#text} at (741,0) size 23x19
             text run at (741,0) width 23: "abc"
-      LayoutNGBlockFlow {P} at (0,375.13) size 769x20
+      LayoutNGBlockFlow {P} at (0,375.75) size 769x20
         LayoutText {#text} at (0,0) size 417x19
           text run at (0,0) width 417: "The following 2 textes should be identical, ignorning whitespaces:"
-      LayoutNGBlockFlow {DIV} at (1.39,411.13) size 766.22x22.78 [border: (1.39px solid #000000)]
+      LayoutNGBlockFlow {DIV} at (1.47,411.75) size 766.06x22.94 [border: (1.47px solid #000000)]
         LayoutInline {SPAN} at (0,0) size 27x20
           LayoutText {#text} at (738,1) size 27x20
             text run at (738,1) width 27: "abc "
         LayoutText {#text} at (716,1) size 23x20
           text run at (716,1) width 23: "abc"
-      LayoutNGBlockFlow {P} at (0,449.91) size 769x20
+      LayoutNGBlockFlow {P} at (0,450.69) size 769x20
         LayoutText {#text} at (0,0) size 73x19
           text run at (0,0) width 73: "Single span"
-      LayoutNGBlockFlow (anonymous) at (0,485.91) size 769x20
-        LayoutInline {SPAN} at (0,0) size 26x23 [border: (1.39px solid #000000)]
+      LayoutNGBlockFlow (anonymous) at (0,486.69) size 769x20
+        LayoutInline {SPAN} at (0,0) size 26x23 [border: (1.47px solid #000000)]
           LayoutText {#text} at (2,0) size 23x19
             text run at (2,0) width 23: "abc"
         LayoutText {#text} at (0,0) size 0x0
-      LayoutNGBlockFlow {P} at (0,521.91) size 769x20
+      LayoutNGBlockFlow {P} at (0,522.69) size 769x20
         LayoutText {#text} at (0,0) size 417x19
           text run at (0,0) width 417: "The following 2 textes should be identical, ignorning whitespaces:"
-      LayoutNGBlockFlow (anonymous) at (0,557.91) size 769x20
-        LayoutInline {SPAN} at (0,0) size 52x23 [border: (1.39px solid #000000)]
+      LayoutNGBlockFlow (anonymous) at (0,558.69) size 769x20
+        LayoutInline {SPAN} at (0,0) size 52x23 [border: (1.47px solid #000000)]
           LayoutText {#text} at (24,0) size 27x19
             text run at (24,0) width 27: "abc "
           LayoutInline {SPAN} at (0,0) size 23x19
             LayoutText {#text} at (2,0) size 23x19
               text run at (2,0) width 23: "abc"
         LayoutText {#text} at (0,0) size 0x0
-      LayoutNGBlockFlow {P} at (0,593.91) size 769x20
+      LayoutNGBlockFlow {P} at (0,594.69) size 769x20
         LayoutText {#text} at (0,0) size 417x19
           text run at (0,0) width 417: "The following 2 textes should be identical, ignorning whitespaces:"
-      LayoutNGBlockFlow (anonymous) at (0,629.91) size 769x20
-        LayoutInline {SPAN} at (0,0) size 52x23 [border: (1.39px solid #000000)]
+      LayoutNGBlockFlow (anonymous) at (0,630.69) size 769x20
+        LayoutInline {SPAN} at (0,0) size 52x23 [border: (1.47px solid #000000)]
           LayoutInline {SPAN} at (0,0) size 27x19
             LayoutText {#text} at (24,0) size 27x19
               text run at (24,0) width 27: "abc "
           LayoutText {#text} at (2,0) size 23x19
             text run at (2,0) width 23: "abc"
         LayoutText {#text} at (0,0) size 0x0
-      LayoutNGBlockFlow {P} at (0,665.91) size 769x20
+      LayoutNGBlockFlow {P} at (0,666.69) size 769x20
         LayoutText {#text} at (0,0) size 417x19
           text run at (0,0) width 417: "The following 2 textes should be identical, ignorning whitespaces:"
-      LayoutNGBlockFlow (anonymous) at (0,701.91) size 769x20
-        LayoutInline {SPAN} at (0,0) size 24x23 [border: (1.39px solid #000000)]
+      LayoutNGBlockFlow (anonymous) at (0,702.69) size 769x20
+        LayoutInline {SPAN} at (0,0) size 24x23 [border: (1.47px solid #000000)]
           LayoutText {#text} at (0,0) size 22x19
             text run at (0,0) width 22: "abc"
-      LayoutNGBlockFlow (anonymous) at (0,721.91) size 769x20
+      LayoutNGBlockFlow (anonymous) at (0,722.69) size 769x20
         LayoutNGBlockFlow {DIV} at (0,0) size 769x20
           LayoutText {#text} at (747,0) size 22x19
             text run at (747,0) width 22: "cba"
-      LayoutNGBlockFlow (anonymous) at (0,741.91) size 769x20
-        LayoutInline {SPAN} at (0,0) size 2x23 [border: (1.39px solid #000000)]
+      LayoutNGBlockFlow (anonymous) at (0,742.69) size 769x20
+        LayoutInline {SPAN} at (0,0) size 2x23 [border: (1.47px solid #000000)]
         LayoutText {#text} at (0,0) size 0x0
-      LayoutNGBlockFlow {P} at (0,777.91) size 769x20
+      LayoutNGBlockFlow {P} at (0,778.69) size 769x20
         LayoutText {#text} at (0,0) size 417x19
           text run at (0,0) width 417: "The following 2 textes should be identical, ignorning whitespaces:"
-      LayoutNGBlockFlow (anonymous) at (0,813.91) size 769x20
-        LayoutInline {SPAN} at (0,0) size 2x23 [border: (1.39px solid #000000)]
-      LayoutNGBlockFlow (anonymous) at (0,833.91) size 769x20
+      LayoutNGBlockFlow (anonymous) at (0,814.69) size 769x20
+        LayoutInline {SPAN} at (0,0) size 2x23 [border: (1.47px solid #000000)]
+      LayoutNGBlockFlow (anonymous) at (0,834.69) size 769x20
         LayoutNGBlockFlow {DIV} at (0,0) size 769x20
           LayoutText {#text} at (747,0) size 22x19
             text run at (747,0) width 22: "cba"
-      LayoutNGBlockFlow (anonymous) at (0,853.91) size 769x20
-        LayoutInline {SPAN} at (0,0) size 24x23 [border: (1.39px solid #000000)]
+      LayoutNGBlockFlow (anonymous) at (0,854.69) size 769x20
+        LayoutInline {SPAN} at (0,0) size 24x23 [border: (1.47px solid #000000)]
           LayoutText {#text} at (2,0) size 23x19
             text run at (2,0) width 23: "abc"
         LayoutText {#text} at (0,0) size 0x0
-      LayoutNGBlockFlow {P} at (0,889.91) size 769x20
+      LayoutNGBlockFlow {P} at (0,890.69) size 769x20
         LayoutText {#text} at (0,0) size 29x19
           text run at (0,0) width 29: "ruby"
-      LayoutNGBlockFlow {DIV} at (0,925.91) size 769x22.78 [border: (1.39px solid #000000)]
+      LayoutNGBlockFlow {DIV} at (0,926.69) size 769x22.94 [border: (1.47px solid #000000)]
         LayoutRuby (inline) {RUBY} at (0,0) size 23x21
-          LayoutRubyRun (anonymous) at (165.47,1.39) size 22x20
+          LayoutRubyRun (anonymous) at (166.56,1.47) size 22x20
             LayoutRubyText {RT} at (0,-12) size 22x12
               LayoutText {#text} at (5,0) size 12x12
                 text run at (5,0) width 12: "def"
             LayoutRubyBase (anonymous) at (0,0) size 22x20
               LayoutText {#text} at (0,0) size 22x19
                 text run at (0,0) width 22 RTL override: "abc"
-        LayoutText {#text} at (160,1) size 5x20
-          text run at (160,1) width 5: " "
+        LayoutText {#text} at (161,1) size 5x20
+          text run at (161,1) width 5: " "
         LayoutRuby (inline) {RUBY} at (0,0) size 23x21
-          LayoutRubyRun (anonymous) at (136.69,1.39) size 22x20
+          LayoutRubyRun (anonymous) at (137.63,1.47) size 22x20
             LayoutRubyText {RT} at (0,-12) size 22x12
               LayoutText {#text} at (5,0) size 12x12
                 text run at (5,0) width 12 RTL override: "def"
             LayoutRubyBase (anonymous) at (0,0) size 22x20
               LayoutText {#text} at (0,0) size 22x19
                 text run at (0,0) width 22 RTL override: "abc"
-        LayoutText {#text} at (131,1) size 5x20
-          text run at (131,1) width 5: " "
+        LayoutText {#text} at (132,1) size 5x20
+          text run at (132,1) width 5: " "
         LayoutRuby (inline) {RUBY} at (0,0) size 23x21
-          LayoutRubyRun (anonymous) at (107.91,1.39) size 22x20
+          LayoutRubyRun (anonymous) at (108.69,1.47) size 22x20
             LayoutRubyBase (anonymous) at (0,0) size 22x20
               LayoutText {#text} at (0,0) size 22x19
                 text run at (0,0) width 22 RTL override: "abc"
-        LayoutText {#text} at (102,1) size 5x20
-          text run at (102,1) width 5: " "
+        LayoutText {#text} at (103,1) size 5x20
+          text run at (103,1) width 5: " "
         LayoutRuby (inline) {RUBY} at (0,0) size 13x20
-          LayoutRubyRun (anonymous) at (89.13,18.39) size 12x0
+          LayoutRubyRun (anonymous) at (89.75,18.47) size 12x0
             LayoutRubyText {RT} at (0,-12) size 12x12
               LayoutText {#text} at (0,0) size 12x12
                 text run at (0,0) width 12: "def"
-        LayoutText {#text} at (83,1) size 5x20
-          text run at (83,1) width 5: " "
+        LayoutText {#text} at (84,1) size 5x20
+          text run at (84,1) width 5: " "
         LayoutRuby (inline) {RUBY} at (0,0) size 23x21
-          LayoutRubyRun (anonymous) at (60.34,1.39) size 22x20
+          LayoutRubyRun (anonymous) at (60.81,1.47) size 22x20
             LayoutRubyBase (anonymous) at (0,0) size 22x20
               LayoutInline {RB} at (0,0) size 22x19
                 LayoutText {#text} at (0,0) size 22x19
                   text run at (0,0) width 22 RTL override: "abc"
-        LayoutText {#text} at (54,1) size 5x20
-          text run at (54,1) width 5: " "
+        LayoutText {#text} at (55,1) size 5x20
+          text run at (55,1) width 5: " "
         LayoutRuby (inline) {RUBY} at (0,0) size 23x21
-          LayoutRubyRun (anonymous) at (31.56,1.39) size 22x20
+          LayoutRubyRun (anonymous) at (31.88,1.47) size 22x20
             LayoutRubyText {RT} at (0,-12) size 22x12
               LayoutText {#text} at (5,0) size 12x12
                 text run at (5,0) width 12: "def"
@@ -166,7 +166,7 @@
         LayoutText {#text} at (26,1) size 5x20
           text run at (26,1) width 5: " "
         LayoutRuby (inline) {RUBY} at (0,0) size 23x21
-          LayoutRubyRun (anonymous) at (2.78,1.39) size 22x20
+          LayoutRubyRun (anonymous) at (2.94,1.47) size 22x20
             LayoutRubyText {RT} at (0,-12) size 22x12
               LayoutText {#text} at (5,0) size 12x12
                 text run at (5,0) width 12: "def"
@@ -175,52 +175,52 @@
                 LayoutText {#text} at (0,0) size 22x19
                   text run at (0,0) width 22 RTL override: "abc"
         LayoutText {#text} at (0,0) size 0x0
-      LayoutNGBlockFlow {P} at (0,964.69) size 769x20
+      LayoutNGBlockFlow {P} at (0,965.63) size 769x20
         LayoutText {#text} at (0,0) size 417x19
           text run at (0,0) width 417: "The following 2 tables should be identical, ignorning whitespaces:"
-      LayoutTable {TABLE} at (1.39,1000.69) size 82x72 [border: (1px solid #808080)]
-        LayoutBlockFlow {CAPTION} at (0,0) size 82x20
-          LayoutText {#text} at (0,0) size 82x19
-            text run at (0,0) width 82: "NormalTable"
-        LayoutTableSection {TBODY} at (1,21) size 80x50
-          LayoutTableRow {TR} at (0,2) size 80x22
-            LayoutNGTableCell {TD} at (43,2) size 35x22 [r=0 c=0 rs=1 cs=1]
-              LayoutText {#text} at (12,1) size 22x19
-                text run at (12,1) width 22: "abc"
+      LayoutTable {TABLE} at (1.47,1001.63) size 83x72 [border: (1px solid #808080)]
+        LayoutBlockFlow {CAPTION} at (0,0) size 83x20
+          LayoutText {#text} at (0,0) size 83x19
+            text run at (0,0) width 83: "NormalTable"
+        LayoutTableSection {TBODY} at (1,21) size 81x50
+          LayoutTableRow {TR} at (0,2) size 81x22
+            LayoutNGTableCell {TD} at (43,2) size 36x22 [r=0 c=0 rs=1 cs=1]
+              LayoutText {#text} at (13,1) size 22x19
+                text run at (13,1) width 22: "abc"
             LayoutNGTableCell {TD} at (2,2) size 39x22 [r=0 c=1 rs=1 cs=1]
               LayoutText {#text} at (18,1) size 20x19
                 text run at (18,1) width 20: "def"
-          LayoutTableRow {TR} at (0,26) size 80x22
-            LayoutNGTableCell {TD} at (43,26) size 35x22 [r=1 c=0 rs=1 cs=1]
-              LayoutText {#text} at (18,1) size 16x19
-                text run at (18,1) width 16: "hij"
+          LayoutTableRow {TR} at (0,26) size 81x22
+            LayoutNGTableCell {TD} at (43,26) size 36x22 [r=1 c=0 rs=1 cs=1]
+              LayoutText {#text} at (19,1) size 16x19
+                text run at (19,1) width 16: "hij"
             LayoutNGTableCell {TD} at (2,26) size 39x22 [r=1 c=1 rs=1 cs=1]
               LayoutText {#text} at (14,1) size 24x19
                 text run at (14,1) width 24: "opq"
-      LayoutTable {DIV} at (1.39,1074.08) size 143x62 [border: (1px solid #000000)]
-        LayoutBlockFlow {DIV} at (0,0) size 143x20
-          LayoutText {#text} at (0,0) size 143x19
-            text run at (0,0) width 143: "AnonymousTableRow"
-        LayoutTableSection (anonymous) at (1,21) size 141x40
-          LayoutTableRow {DIV} at (0,0) size 141x20
-            LayoutNGTableCell {DIV} at (74,0) size 67x20 [r=0 c=0 rs=1 cs=1]
+      LayoutTable {DIV} at (1.47,1075.09) size 144x62 [border: (1px solid #000000)]
+        LayoutBlockFlow {DIV} at (0,0) size 144x20
+          LayoutText {#text} at (0,0) size 144x19
+            text run at (0,0) width 144: "AnonymousTableRow"
+        LayoutTableSection (anonymous) at (1,21) size 142x40
+          LayoutTableRow {DIV} at (0,0) size 142x20
+            LayoutNGTableCell {DIV} at (75,0) size 67x20 [r=0 c=0 rs=1 cs=1]
               LayoutText {#text} at (45,0) size 22x19
                 text run at (45,0) width 22: "abc"
-            LayoutNGTableCell {DIV} at (0,0) size 74x20 [r=0 c=1 rs=1 cs=1]
-              LayoutText {#text} at (54,0) size 20x19
-                text run at (54,0) width 20: "def"
-          LayoutTableRow {DIV} at (0,20) size 141x20
-            LayoutNGTableCell {DIV} at (74,20) size 67x20 [r=1 c=0 rs=1 cs=1]
+            LayoutNGTableCell {DIV} at (0,0) size 75x20 [r=0 c=1 rs=1 cs=1]
+              LayoutText {#text} at (55,0) size 20x19
+                text run at (55,0) width 20: "def"
+          LayoutTableRow {DIV} at (0,20) size 142x20
+            LayoutNGTableCell {DIV} at (75,20) size 67x20 [r=1 c=0 rs=1 cs=1]
               LayoutText {#text} at (51,0) size 16x19
                 text run at (51,0) width 16: "hij"
-            LayoutNGTableCell {DIV} at (0,20) size 74x20 [r=1 c=1 rs=1 cs=1]
-              LayoutText {#text} at (50,0) size 24x19
-                text run at (50,0) width 24: "opq"
-      LayoutNGBlockFlow {P} at (0,1152.08) size 769x20
-        LayoutText {#text} at (0,0) size 511x19
-          text run at (0,0) width 511: "Anonymous TABLE, TABLE_ROW, TABLE_ROW_GROUP, TABLE_CELL"
-      LayoutNGBlockFlow {DIV} at (0,1188.08) size 769x82.78 [border: (1.39px solid #000000)]
-        LayoutTable (anonymous) at (1.39,1.39) size 24x80
+            LayoutNGTableCell {DIV} at (0,20) size 75x20 [r=1 c=1 rs=1 cs=1]
+              LayoutText {#text} at (51,0) size 24x19
+                text run at (51,0) width 24: "opq"
+      LayoutNGBlockFlow {P} at (0,1153.09) size 769x20
+        LayoutText {#text} at (0,0) size 516x19
+          text run at (0,0) width 516: "Anonymous TABLE, TABLE_ROW, TABLE_ROW_GROUP, TABLE_CELL"
+      LayoutNGBlockFlow {DIV} at (0,1189.09) size 769x82.94 [border: (1.47px solid #000000)]
+        LayoutTable (anonymous) at (1.47,1.47) size 24x80
           LayoutTableSection (anonymous) at (0,20) size 24x40
             LayoutTableRow {DIV} at (0,0) size 24x20
               LayoutTableCell (anonymous) at (0,0) size 24x20 [r=0 c=0 rs=1 cs=1]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/clip-zooming-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/clip-zooming-expected.png
index 577d59c..49012928 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/clip-zooming-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/clip-zooming-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/color-correction-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/color-correction-expected.png
new file mode 100644
index 0000000..3ce2aaf
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/color-correction-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/color-correction-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/color-correction-expected.txt
index b86da63..ccca9e2 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/color-correction-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/color-correction-expected.txt
@@ -4,10 +4,10 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x600
     LayoutNGBlockFlow {BODY} at (8,8) size 784x584
       LayoutNGBlockFlow {P} at (0,0) size 784x100
-        LayoutText {#text} at (0,0) size 769x99
+        LayoutText {#text} at (0,0) size 768x99
           text run at (0,0) width 763: "This test demonstrates -webkit-color-correction. Below are 3 images with 20 pixel borders. The images are all the same --"
           text run at (0,20) width 755: "purple with an sRGB color profile. The border is the same CSS color for all three images. The first image has no special"
-          text run at (0,40) width 769: "CSS. The second has -webkit-color-correction set to default, so it matches the first image. And the third has -webkit-color-"
+          text run at (0,40) width 768: "CSS. The second has -webkit-color-correction set to default, so it matches the first image. And the third has -webkit-color-"
           text run at (0,60) width 759: "correction set to sRGB. This color-corrects the purple border from the sRGB color space, and the result is that the border"
           text run at (0,80) width 134: "and the image match."
       LayoutNGBlockFlow (anonymous) at (0,116) size 784x145
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/css1_forward_compatible_parsing-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/css1_forward_compatible_parsing-expected.png
new file mode 100644
index 0000000..f808795
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/css1_forward_compatible_parsing-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/css1_forward_compatible_parsing-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/css1_forward_compatible_parsing-expected.txt
index 9f006bfc..2506f49 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/css1_forward_compatible_parsing-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/css1_forward_compatible_parsing-expected.txt
@@ -5,14 +5,14 @@
     LayoutNGBlockFlow {BODY} at (8,16) size 784x395.42
       LayoutNGBlockFlow {DIV} at (0,0) size 784x40 [color=#008000] [bgcolor=#FFFFFF]
         LayoutNGBlockFlow {P} at (0,0) size 784x40
-          LayoutText {#text} at (0,0) size 773x39
-            text run at (0,0) width 773: "First sentence: this text should be green. The markup code is invalid according to W3C HTML validator and the CSS code"
-            text run at (0,20) width 273: "is invalid according to W3C CSS validator."
+          LayoutText {#text} at (0,0) size 772x39
+            text run at (0,0) width 772: "First sentence: this text should be green. The markup code is invalid according to W3C HTML validator and the CSS code"
+            text run at (0,20) width 272: "is invalid according to W3C CSS validator."
       LayoutNGBlockFlow {DIV} at (0,56) size 784x40 [color=#008000] [bgcolor=#FFFFFF]
         LayoutNGBlockFlow {P} at (0,0) size 784x40 [color=#FF0000]
           LayoutText {#text} at (0,0) size 776x39
             text run at (0,0) width 776: "Second sentence: this text should be green according to CSS 1 but it should be red according to CSS 2.1. The markup code"
-            text run at (0,20) width 753: "is also invalid according to W3C HTML validator but the CSS code is perfectly valid according to W3C CSS validator."
+            text run at (0,20) width 751: "is also invalid according to W3C HTML validator but the CSS code is perfectly valid according to W3C CSS validator."
       LayoutNGBlockFlow {H3} at (0,114.72) size 784x46 [color=#008000] [bgcolor=#FFFFFF]
         LayoutText {#text} at (0,0) size 767x45
           text run at (0,0) width 767: "Third sentence: this text should be green. The markup code is valid according to W3C HTML"
@@ -20,13 +20,13 @@
       LayoutNGBlockFlow {H4} at (0,181.98) size 784x60 [color=#FF0000] [bgcolor=#FFFFFF]
         LayoutText {#text} at (0,0) size 776x59
           text run at (0,0) width 776: "Fourth sentence: this text should be green according to CSS 1 (class name can not start with a dash in CSS 1) but it"
-          text run at (0,20) width 773: "should be red according to CSS 2.1 and the markup code is valid according to W3C HTML validator and the CSS"
-          text run at (0,40) width 374: "code is perfectly valid according to W3C CSS validator."
+          text run at (0,20) width 772: "should be red according to CSS 2.1 and the markup code is valid according to W3C HTML validator and the CSS"
+          text run at (0,40) width 375: "code is perfectly valid according to W3C CSS validator."
       LayoutNGBlockFlow {H5} at (0,268.70) size 784x80 [color=#800080] [bgcolor=#FFFFFF]
         LayoutText {#text} at (0,0) size 775x79
           text run at (0,0) width 761: "Fifth sentence: this text should be green according to CSS 1 (class name can not start with a dash in CSS 1) but it"
           text run at (0,20) width 775: "should be purple according to latest CSS 2.1 WD (class name can not start with a dash unless immediately followed"
-          text run at (0,40) width 771: "by [_A-Za-z] character in CSS 2.1) and the markup code is valid according to W3C HTML validator and the CSS"
+          text run at (0,40) width 770: "by [_A-Za-z] character in CSS 2.1) and the markup code is valid according to W3C HTML validator and the CSS"
           text run at (0,60) width 402: "code is perfectly valid according to the W3C CSS validator!"
       LayoutNGBlockFlow {P} at (0,375.42) size 784x20
         LayoutText {#text} at (0,0) size 27x19
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/css3-modsel-22-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/css3-modsel-22-expected.png
index 24223e0..c76420e 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/css3-modsel-22-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/css3-modsel-22-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/css3-modsel-22-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/css3-modsel-22-expected.txt
index fd81bb7..741085e 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/css3-modsel-22-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/css3-modsel-22-expected.txt
@@ -14,8 +14,8 @@
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
             LayoutText (anonymous) at (0,0) size 10x19
               text run at (0,0) width 10: "\x{2022} "
-          LayoutText {#text} at (0,0) size 481x19
-            text run at (0,0) width 481: "This list item should be green because its language is British English (Wales)"
+          LayoutText {#text} at (0,0) size 482x19
+            text run at (0,0) width 482: "This list item should be green because its language is British English (Wales)"
       LayoutNGBlockFlow {OL} at (0,56) size 784x40
         LayoutNGListItem {LI} at (40,0) size 744x20
           LayoutNGListMarker (anonymous) at (-16,0) size 16x20
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/css3-space-in-nth-and-lang-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/css3-space-in-nth-and-lang-expected.png
new file mode 100644
index 0000000..59d97e8
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/css3-space-in-nth-and-lang-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/css3-space-in-nth-and-lang-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/css3-space-in-nth-and-lang-expected.txt
index 321b2b4..a6b7d4fb 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/css3-space-in-nth-and-lang-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/css3-space-in-nth-and-lang-expected.txt
@@ -4,8 +4,8 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x600
     LayoutNGBlockFlow {BODY} at (8,8) size 784x584
       LayoutNGBlockFlow {DIV} at (0,0) size 784x20 [color=#008000] [bgcolor=#FFFF00]
-        LayoutText {#text} at (0,0) size 108x19
-          text run at (0,0) width 108: "Green on Yellow"
+        LayoutText {#text} at (0,0) size 107x19
+          text run at (0,0) width 107: "Green on Yellow"
       LayoutNGBlockFlow {DIV} at (0,20) size 784x20 [color=#0000FF] [bgcolor=#C0C0C0]
         LayoutText {#text} at (0,0) size 91x19
           text run at (0,0) width 91: "Blue on Silver"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/first-letter-detach-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/first-letter-detach-expected.png
index d73f523f..c197950 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/first-letter-detach-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/first-letter-detach-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/first-letter-detach-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/first-letter-detach-expected.txt
index 1b74ed0b..bf5c4aef 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/first-letter-detach-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/first-letter-detach-expected.txt
@@ -4,42 +4,42 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x600
     LayoutNGBlockFlow {BODY} at (8,8) size 784x576
       LayoutNGBlockFlow {P} at (0,0) size 784x40
-        LayoutText {#text} at (0,0) size 51x19
-          text run at (0,0) width 51: "Test for "
-        LayoutInline {I} at (0,0) size 724x39
-          LayoutInline {A} at (0,0) size 348x19 [color=#0000EE]
-            LayoutText {#text} at (51,0) size 348x19
-              text run at (51,0) width 348: "http://bugzilla.opendarwin.org/show_bug.cgi?id=3560"
-          LayoutText {#text} at (399,0) size 724x39
-            text run at (399,0) width 325: " page with use of first-letter crashes reproducibly in"
-            text run at (0,20) width 187: "LayoutObject::renderArena()"
-        LayoutText {#text} at (187,20) size 4x19
-          text run at (187,20) width 4: "."
+        LayoutText {#text} at (0,0) size 52x19
+          text run at (0,0) width 52: "Test for "
+        LayoutInline {I} at (0,0) size 722x39
+          LayoutInline {A} at (0,0) size 347x19 [color=#0000EE]
+            LayoutText {#text} at (52,0) size 347x19
+              text run at (52,0) width 347: "http://bugzilla.opendarwin.org/show_bug.cgi?id=3560"
+          LayoutText {#text} at (399,0) size 722x39
+            text run at (399,0) width 323: " page with use of first-letter crashes reproducibly in"
+            text run at (0,20) width 185: "LayoutObject::renderArena()"
+        LayoutText {#text} at (185,20) size 4x19
+          text run at (185,20) width 4: "."
       LayoutNGBlockFlow {P} at (0,56) size 784x20
         LayoutText {#text} at (0,0) size 231x19
           text run at (0,0) width 231: "The next three lines should all read \x{201C}"
         LayoutInline {SPAN} at (0,0) size 8x19 [color=#0000FF]
           LayoutText {#text} at (231,0) size 8x19
             text run at (231,0) width 8: "P"
-        LayoutText {#text} at (239,0) size 206x19
-          text run at (239,0) width 206: "ASS\x{201D}, with nothing before the P."
+        LayoutText {#text} at (239,0) size 207x19
+          text run at (239,0) width 207: "ASS\x{201D}, with nothing before the P."
       LayoutNGBlockFlow {P} at (0,110) size 784x20
         LayoutInline {<pseudo:first-letter>} at (0,0) size 8x19 [color=#0000FF]
           LayoutTextFragment (anonymous) at (0,0) size 8x19
             text run at (0,0) width 8: "P"
-        LayoutTextFragment {#text} at (8,0) size 29x19
-          text run at (8,0) width 29: "ASS"
+        LayoutTextFragment {#text} at (8,0) size 30x19
+          text run at (8,0) width 30: "ASS"
       LayoutNGBlockFlow {P} at (0,146) size 784x20
         LayoutInline {<pseudo:first-letter>} at (0,0) size 8x19 [color=#0000FF]
           LayoutTextFragment (anonymous) at (0,0) size 8x19
             text run at (0,0) width 8: "P"
-        LayoutTextFragment {#text} at (8,0) size 29x19
-          text run at (8,0) width 29: "ASS"
+        LayoutTextFragment {#text} at (8,0) size 30x19
+          text run at (8,0) width 30: "ASS"
       LayoutNGBlockFlow {P} at (0,182) size 784x20
         LayoutInline {<pseudo:first-letter>} at (0,0) size 8x19 [color=#0000FF]
           LayoutTextFragment (anonymous) at (0,0) size 8x19
             text run at (0,0) width 8: "P"
-        LayoutTextFragment {#text} at (8,0) size 29x19
-          text run at (8,0) width 29: "ASS"
+        LayoutTextFragment {#text} at (8,0) size 30x19
+          text run at (8,0) width 30: "ASS"
 layer at (8,100) size 784x2 clip at (0,0) size 0x0
   LayoutNGBlockFlow {HR} at (0,92) size 784x2 [border: (1px inset #EEEEEE)]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/focus-ring-detached-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/focus-ring-detached-expected.png
index cfa604b..5d68d50 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/focus-ring-detached-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/focus-ring-detached-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/font-face-opentype-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/font-face-opentype-expected.png
new file mode 100644
index 0000000..5e276f98
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/font-face-opentype-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/font-face-opentype-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/font-face-opentype-expected.txt
new file mode 100644
index 0000000..75871d9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/font-face-opentype-expected.txt
@@ -0,0 +1,39 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x600
+    LayoutNGBlockFlow {BODY} at (8,8) size 784x584
+      LayoutNGBlockFlow {P} at (0,0) size 784x40
+        LayoutText {#text} at (0,0) size 52x19
+          text run at (0,0) width 52: "Test for "
+        LayoutInline {I} at (0,0) size 743x39
+          LayoutInline {A} at (0,0) size 306x19 [color=#0000EE]
+            LayoutText {#text} at (52,0) size 306x19
+              text run at (52,0) width 306: "https://bugs.webkit.org/show_bug.cgi?id=34735"
+          LayoutText {#text} at (358,0) size 743x39
+            text run at (358,0) width 385: " [Chromium] OpenType font with CFF glyphs is not handled"
+            text run at (0,20) width 160: "correctly on Windows XP"
+        LayoutText {#text} at (160,20) size 4x19
+          text run at (160,20) width 4: "."
+      LayoutNGBlockFlow {P} at (0,56) size 784x40
+        LayoutText {#text} at (0,0) size 768x39
+          text run at (0,0) width 768: "Check if glyphs in Ahem.otf can be rendered correctly. If the test passes, you should see dozens of black square characters"
+          text run at (0,20) width 43: "below:"
+      LayoutNGBlockFlow (anonymous) at (0,112) size 784x32
+        LayoutInline {SPAN} at (0,0) size 736x16
+          LayoutText {#text} at (0,0) size 736x16
+            text run at (0,0) width 736: "!\"#$%&()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNO"
+        LayoutText {#text} at (0,0) size 0x0
+        LayoutInline {SPAN} at (0,0) size 736x16
+          LayoutText {#text} at (0,16) size 736x16
+            text run at (0,16) width 736: "PQRSTUVWXYZ[\\]^_`abcdefghijklmnoqrstuvwxyz{|}~"
+        LayoutText {#text} at (0,0) size 0x0
+      LayoutNGBlockFlow {P} at (0,160) size 784x40
+        LayoutText {#text} at (0,0) size 743x39
+          text run at (0,0) width 743: "Check if glyphs not in Ahem.otf can be rendered using a fallback font. If the test passes, you should see a single-quote"
+          text run at (0,20) width 104: "character below:"
+      LayoutNGBlockFlow (anonymous) at (0,216) size 784x20
+        LayoutInline {SPAN} at (0,0) size 3x16
+          LayoutText {#text} at (0,2) size 3x16
+            text run at (0,2) width 3: "'"
+        LayoutText {#text} at (0,0) size 0x0
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/font_property_normal-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/font_property_normal-expected.png
index f6dcf16..6b50cf7 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/font_property_normal-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/font_property_normal-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/font_property_normal-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/font_property_normal-expected.txt
index da3d485..aaddd48 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/font_property_normal-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/font_property_normal-expected.txt
@@ -13,8 +13,8 @@
         LayoutText {#text} at (0,0) size 292x36
           text run at (0,0) width 292: "24pt italic Arial = 24pt"
       LayoutNGBlockFlow {P} at (0,190) size 784x20
-        LayoutText {#text} at (0,0) size 185x19
-          text run at (0,0) width 185: "24pt italic 'Arial' = 24pt Arial"
+        LayoutText {#text} at (0,0) size 184x19
+          text run at (0,0) width 184: "24pt italic 'Arial' = 24pt Arial"
       LayoutNGBlockFlow {P} at (0,226) size 784x20
         LayoutText {#text} at (0,0) size 105x19
           text run at (0,0) width 105: "italic 24pt = fails"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/ignore-empty-focus-ring-rects-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/ignore-empty-focus-ring-rects-expected.png
new file mode 100644
index 0000000..6e730b7
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/ignore-empty-focus-ring-rects-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/image-orientation/image-orientation-default-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/image-orientation/image-orientation-default-expected.png
index d98648d9..6d7b6cc2 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/image-orientation/image-orientation-default-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/image-orientation/image-orientation-default-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/image-orientation/image-orientation-from-image-composited-dynamic-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/image-orientation/image-orientation-from-image-composited-dynamic-expected.png
index 4429b51..78daf70 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/image-orientation/image-orientation-from-image-composited-dynamic-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/image-orientation/image-orientation-from-image-composited-dynamic-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/image-orientation/image-orientation-from-image-composited-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/image-orientation/image-orientation-from-image-composited-expected.png
index 4429b51..78daf70 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/image-orientation/image-orientation-from-image-composited-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/image-orientation/image-orientation-from-image-composited-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/image-orientation/image-orientation-from-image-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/image-orientation/image-orientation-from-image-expected.png
index b5dbe8f..3c010cf 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/image-orientation/image-orientation-from-image-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/image-orientation/image-orientation-from-image-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/list-outline-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/list-outline-expected.png
new file mode 100644
index 0000000..6d6574f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/list-outline-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/list-outline-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/list-outline-expected.txt
index 3e56b54a..abf35a47 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/list-outline-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/list-outline-expected.txt
@@ -8,5 +8,5 @@
           LayoutNGListMarker (anonymous) at (-16,16) size 16x20
             LayoutText (anonymous) at (0,0) size 16x19
               text run at (0,0) width 16: "1. "
-          LayoutText {#text} at (16,16) size 582x19
-            text run at (16,16) width 582: "A single outline should only appear over the list element, and not over internal text elements."
+          LayoutText {#text} at (16,16) size 581x19
+            text run at (16,16) width 581: "A single outline should only appear over the list element, and not over internal text elements."
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/non-empty-span-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/non-empty-span-expected.png
new file mode 100644
index 0000000..7a036cf
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/non-empty-span-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/non-empty-span-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/non-empty-span-expected.txt
new file mode 100644
index 0000000..151d00d3
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/non-empty-span-expected.txt
@@ -0,0 +1,35 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x374
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x374
+    LayoutNGBlockFlow {BODY} at (8,8) size 784x358
+      LayoutNGBlockFlow {DIV} at (0,0) size 784x20
+        LayoutText {#text} at (0,0) size 119x19
+          text run at (0,0) width 119: "Before empty span"
+      LayoutNGBlockFlow (anonymous) at (0,20) size 784x100
+        LayoutInline {SPAN} at (0,0) size 0x0
+        LayoutText {#text} at (0,40) size 12x19
+          text run at (0,40) width 12: "X"
+      LayoutNGBlockFlow {DIV} at (0,120) size 784x20
+        LayoutText {#text} at (0,0) size 109x19
+          text run at (0,0) width 109: "After empty span"
+      LayoutNGBlockFlow {DIV} at (0,140) size 784x20
+        LayoutText {#text} at (0,0) size 119x19
+          text run at (0,0) width 119: "Before empty span"
+      LayoutNGBlockFlow (anonymous) at (0,160) size 784x118
+        LayoutInline {SPAN} at (0,0) size 0x0
+        LayoutText {#text} at (0,77) size 12x19
+          text run at (0,77) width 12: "X"
+      LayoutNGBlockFlow {DIV} at (0,278) size 784x20
+        LayoutText {#text} at (0,0) size 109x19
+          text run at (0,0) width 109: "After empty span"
+      LayoutNGBlockFlow {DIV} at (0,298) size 784x20
+        LayoutText {#text} at (0,0) size 119x19
+          text run at (0,0) width 119: "Before empty span"
+      LayoutNGBlockFlow (anonymous) at (0,318) size 784x20
+        LayoutInline {SPAN} at (0,0) size 0x0
+        LayoutText {#text} at (0,0) size 12x19
+          text run at (0,0) width 12: "X"
+      LayoutNGBlockFlow {DIV} at (0,338) size 784x20
+        LayoutText {#text} at (0,0) size 109x19
+          text run at (0,0) width 109: "After empty span"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/nth-child-dynamic-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/nth-child-dynamic-expected.png
new file mode 100644
index 0000000..ce86a8c9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/nth-child-dynamic-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/nth-child-dynamic-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/nth-child-dynamic-expected.txt
index 189a4897..912ee27 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/nth-child-dynamic-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/nth-child-dynamic-expected.txt
@@ -4,16 +4,16 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x600
     LayoutNGBlockFlow {BODY} at (8,8) size 784x582
       LayoutNGBlockFlow {P} at (0,0) size 784x20
-        LayoutText {#text} at (0,0) size 322x19
-          text run at (0,0) width 322: "Test :nth-child() when dynamically adding siblings."
+        LayoutText {#text} at (0,0) size 323x19
+          text run at (0,0) width 323: "Test :nth-child() when dynamically adding siblings."
       LayoutNGBlockFlow {P} at (0,36) size 784x20
         LayoutInline {A} at (0,0) size 305x19 [color=#0000EE]
           LayoutText {#text} at (0,0) size 305x19
             text run at (0,0) width 305: "https://bugs.webkit.org/show_bug.cgi?id=26362"
       LayoutNGBlockFlow {DIV} at (10,72) size 764x232 [border: (1px solid #000000)]
         LayoutNGBlockFlow {P} at (11,6) size 747x20 [color=#FF0000]
-          LayoutText {#text} at (0,0) size 60x19
-            text run at (0,0) width 60: "P red text"
+          LayoutText {#text} at (0,0) size 59x19
+            text run at (0,0) width 59: "P red text"
         LayoutNGBlockFlow {DIV} at (6,26) size 752x20
           LayoutText {#text} at (0,0) size 29x19
             text run at (0,0) width 29: "DIV"
@@ -30,8 +30,8 @@
           LayoutText {#text} at (0,0) size 29x19
             text run at (0,0) width 29: "DIV"
         LayoutNGBlockFlow {P} at (11,126) size 747x20 [color=#FF0000]
-          LayoutText {#text} at (0,0) size 60x19
-            text run at (0,0) width 60: "P red text"
+          LayoutText {#text} at (0,0) size 59x19
+            text run at (0,0) width 59: "P red text"
         LayoutNGBlockFlow {DIV} at (6,146) size 752x20
           LayoutText {#text} at (0,0) size 29x19
             text run at (0,0) width 29: "DIV"
@@ -45,39 +45,39 @@
           LayoutText {#text} at (0,0) size 9x19
             text run at (0,0) width 9: "P"
       LayoutNGBlockFlow {DIV} at (10,314) size 764x252 [border: (1px solid #000000)]
-        LayoutText {#text} at (6,6) size 260x19
-          text run at (6,6) width 260: "child 0: PASS: found color rgb(255, 0, 0)"
-        LayoutBR {BR} at (266,6) size 0x0
-        LayoutText {#text} at (6,26) size 244x19
-          text run at (6,26) width 244: "child 1: PASS: found color rgb(0, 0, 0)"
-        LayoutBR {BR} at (250,26) size 0x0
-        LayoutText {#text} at (6,46) size 244x19
-          text run at (6,46) width 244: "child 2: PASS: found color rgb(0, 0, 0)"
-        LayoutBR {BR} at (250,46) size 0x0
-        LayoutText {#text} at (6,66) size 260x19
-          text run at (6,66) width 260: "child 3: PASS: found color rgb(255, 0, 0)"
-        LayoutBR {BR} at (266,66) size 0x0
-        LayoutText {#text} at (6,86) size 244x19
-          text run at (6,86) width 244: "child 4: PASS: found color rgb(0, 0, 0)"
-        LayoutBR {BR} at (250,86) size 0x0
-        LayoutText {#text} at (6,106) size 244x19
-          text run at (6,106) width 244: "child 5: PASS: found color rgb(0, 0, 0)"
-        LayoutBR {BR} at (250,106) size 0x0
-        LayoutText {#text} at (6,126) size 260x19
-          text run at (6,126) width 260: "child 6: PASS: found color rgb(255, 0, 0)"
-        LayoutBR {BR} at (266,126) size 0x0
-        LayoutText {#text} at (6,146) size 244x19
-          text run at (6,146) width 244: "child 7: PASS: found color rgb(0, 0, 0)"
-        LayoutBR {BR} at (250,146) size 0x0
-        LayoutText {#text} at (6,166) size 244x19
-          text run at (6,166) width 244: "child 8: PASS: found color rgb(0, 0, 0)"
-        LayoutBR {BR} at (250,166) size 0x0
-        LayoutText {#text} at (6,186) size 260x19
-          text run at (6,186) width 260: "child 9: PASS: found color rgb(255, 0, 0)"
-        LayoutBR {BR} at (266,186) size 0x0
-        LayoutText {#text} at (6,206) size 252x19
-          text run at (6,206) width 252: "child 10: PASS: found color rgb(0, 0, 0)"
-        LayoutBR {BR} at (258,206) size 0x0
-        LayoutText {#text} at (6,226) size 281x19
-          text run at (6,226) width 281: "div 1: PASS: found color rgb(153, 153, 255)"
-        LayoutBR {BR} at (287,226) size 0x0
+        LayoutText {#text} at (6,6) size 261x19
+          text run at (6,6) width 261: "child 0: PASS: found color rgb(255, 0, 0)"
+        LayoutBR {BR} at (267,6) size 0x0
+        LayoutText {#text} at (6,26) size 245x19
+          text run at (6,26) width 245: "child 1: PASS: found color rgb(0, 0, 0)"
+        LayoutBR {BR} at (251,26) size 0x0
+        LayoutText {#text} at (6,46) size 245x19
+          text run at (6,46) width 245: "child 2: PASS: found color rgb(0, 0, 0)"
+        LayoutBR {BR} at (251,46) size 0x0
+        LayoutText {#text} at (6,66) size 261x19
+          text run at (6,66) width 261: "child 3: PASS: found color rgb(255, 0, 0)"
+        LayoutBR {BR} at (267,66) size 0x0
+        LayoutText {#text} at (6,86) size 245x19
+          text run at (6,86) width 245: "child 4: PASS: found color rgb(0, 0, 0)"
+        LayoutBR {BR} at (251,86) size 0x0
+        LayoutText {#text} at (6,106) size 245x19
+          text run at (6,106) width 245: "child 5: PASS: found color rgb(0, 0, 0)"
+        LayoutBR {BR} at (251,106) size 0x0
+        LayoutText {#text} at (6,126) size 261x19
+          text run at (6,126) width 261: "child 6: PASS: found color rgb(255, 0, 0)"
+        LayoutBR {BR} at (267,126) size 0x0
+        LayoutText {#text} at (6,146) size 245x19
+          text run at (6,146) width 245: "child 7: PASS: found color rgb(0, 0, 0)"
+        LayoutBR {BR} at (251,146) size 0x0
+        LayoutText {#text} at (6,166) size 245x19
+          text run at (6,166) width 245: "child 8: PASS: found color rgb(0, 0, 0)"
+        LayoutBR {BR} at (251,166) size 0x0
+        LayoutText {#text} at (6,186) size 261x19
+          text run at (6,186) width 261: "child 9: PASS: found color rgb(255, 0, 0)"
+        LayoutBR {BR} at (267,186) size 0x0
+        LayoutText {#text} at (6,206) size 253x19
+          text run at (6,206) width 253: "child 10: PASS: found color rgb(0, 0, 0)"
+        LayoutBR {BR} at (259,206) size 0x0
+        LayoutText {#text} at (6,226) size 282x19
+          text run at (6,226) width 282: "div 1: PASS: found color rgb(153, 153, 255)"
+        LayoutBR {BR} at (288,226) size 0x0
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/relative-positioned-block-nested-with-inline-parent-dynamic-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/relative-positioned-block-nested-with-inline-parent-dynamic-expected.png
index acd01f2..0081dec0 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/relative-positioned-block-nested-with-inline-parent-dynamic-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/relative-positioned-block-nested-with-inline-parent-dynamic-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/relative-positioned-block-nested-with-inline-parent-multiple-descendant-blocks-dynamic-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/relative-positioned-block-nested-with-inline-parent-multiple-descendant-blocks-dynamic-expected.png
index 08f4d4f..de9b516 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/relative-positioned-block-nested-with-inline-parent-multiple-descendant-blocks-dynamic-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/relative-positioned-block-nested-with-inline-parent-multiple-descendant-blocks-dynamic-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/relative-positioned-block-with-inline-ancestor-and-parent-dynamic-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/relative-positioned-block-with-inline-ancestor-and-parent-dynamic-expected.png
index 1e3af47..f350f1a 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/relative-positioned-block-with-inline-ancestor-and-parent-dynamic-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/relative-positioned-block-with-inline-ancestor-and-parent-dynamic-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/relative-positioned-block-with-inline-ancestor-dynamic-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/relative-positioned-block-with-inline-ancestor-dynamic-expected.png
index 1e3af47..f350f1a 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/relative-positioned-block-with-inline-ancestor-dynamic-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/relative-positioned-block-with-inline-ancestor-dynamic-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/relative-positioned-block-with-inline-ancestor-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/relative-positioned-block-with-inline-ancestor-expected.png
index 1e3af47..f350f1a 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/relative-positioned-block-with-inline-ancestor-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/relative-positioned-block-with-inline-ancestor-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/relative-positioned-block-with-inline-parent-dynamic-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/relative-positioned-block-with-inline-parent-dynamic-expected.png
index 1e3af47..f350f1a 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/relative-positioned-block-with-inline-parent-dynamic-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/relative-positioned-block-with-inline-parent-dynamic-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/selector-set-attribute-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/selector-set-attribute-expected.png
index 0d9ac58b..80103fa 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/selector-set-attribute-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/selector-set-attribute-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/selector-set-attribute-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/selector-set-attribute-expected.txt
index 0b5e0dc..f5fcf75 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/selector-set-attribute-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/selector-set-attribute-expected.txt
@@ -4,8 +4,8 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x600
     LayoutNGBlockFlow {BODY} at (8,8) size 784x576
       LayoutNGBlockFlow {H1} at (0,0) size 784x37
-        LayoutText {#text} at (0,0) size 251x36
-          text run at (0,0) width 251: "setAttribute() Test"
+        LayoutText {#text} at (0,0) size 250x36
+          text run at (0,0) width 250: "setAttribute() Test"
       LayoutNGBlockFlow {P} at (0,58.44) size 784x20 [color=#008000]
         LayoutText {#text} at (0,0) size 468x19
           text run at (0,0) width 468: "This element's Class attribute is set using setAttribute(). It should be green."
@@ -13,11 +13,11 @@
         LayoutText {#text} at (0,0) size 451x19
           text run at (0,0) width 451: "This element's ID attribute is set using setAttribute(). It should be green."
       LayoutNGBlockFlow {P} at (0,130.44) size 784x20 [color=#008000]
-        LayoutText {#text} at (0,0) size 463x19
-          text run at (0,0) width 463: "This element's Title attribute is set using setAttribute(). It should be green."
+        LayoutText {#text} at (0,0) size 462x19
+          text run at (0,0) width 462: "This element's Title attribute is set using setAttribute(). It should be green."
       LayoutNGBlockFlow {P} at (0,166.44) size 784x20 [color=#008000]
-        LayoutText {#text} at (0,0) size 392x19
-          text run at (0,0) width 392: "This element's Title attribute is hard-coded. It should be green."
+        LayoutText {#text} at (0,0) size 391x19
+          text run at (0,0) width 391: "This element's Title attribute is hard-coded. It should be green."
       LayoutNGBlockFlow {P} at (0,202.44) size 784x20 [color=#008000]
         LayoutText {#text} at (0,0) size 467x19
           text run at (0,0) width 467: "This element's Lang attribute is set using setAttribute(). It should be green."
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-align-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-align-expected.png
new file mode 100644
index 0000000..66f03a3
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-align-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-align-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-align-expected.txt
index ee6c459..15126be 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-align-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-align-expected.txt
@@ -7,52 +7,52 @@
         LayoutText {#text} at (0,0) size 78x19
           text run at (0,0) width 78: "Simple case"
       LayoutNGBlockFlow {P} at (0,36) size 784x20
-        LayoutText {#text} at (0,0) size 62x19
-          text run at (0,0) width 62: "LTR Start"
+        LayoutText {#text} at (0,0) size 63x19
+          text run at (0,0) width 63: "LTR Start"
       LayoutNGBlockFlow {P} at (0,72) size 784x20
-        LayoutText {#text} at (725,0) size 59x19
-          text run at (725,0) width 59: "LTR End"
+        LayoutText {#text} at (724,0) size 60x19
+          text run at (724,0) width 60: "LTR End"
       LayoutNGBlockFlow {P} at (0,108) size 784x20
-        LayoutText {#text} at (720,0) size 64x19
-          text run at (720,0) width 64: "RTL Start"
+        LayoutText {#text} at (722,0) size 62x19
+          text run at (722,0) width 62: "RTL Start"
       LayoutNGBlockFlow {P} at (0,144) size 784x20
-        LayoutText {#text} at (0,0) size 61x19
-          text run at (0,0) width 61: "RTL End"
+        LayoutText {#text} at (0,0) size 59x19
+          text run at (0,0) width 59: "RTL End"
       LayoutNGBlockFlow {H1} at (0,180) size 784x20
         LayoutText {#text} at (0,0) size 95x19
           text run at (0,0) width 95: "Inherited case"
       LayoutNGBlockFlow {DIV} at (0,216) size 784x20
         LayoutNGBlockFlow {P} at (0,0) size 784x20
-          LayoutText {#text} at (0,0) size 62x19
-            text run at (0,0) width 62: "LTR Start"
+          LayoutText {#text} at (0,0) size 63x19
+            text run at (0,0) width 63: "LTR Start"
       LayoutNGBlockFlow {DIV} at (0,252) size 784x20
         LayoutNGBlockFlow {P} at (0,0) size 784x20
-          LayoutText {#text} at (725,0) size 59x19
-            text run at (725,0) width 59: "LTR End"
+          LayoutText {#text} at (724,0) size 60x19
+            text run at (724,0) width 60: "LTR End"
       LayoutNGBlockFlow {DIV} at (0,288) size 784x20
         LayoutNGBlockFlow {P} at (0,0) size 784x20
-          LayoutText {#text} at (720,0) size 64x19
-            text run at (720,0) width 64: "RTL Start"
+          LayoutText {#text} at (722,0) size 62x19
+            text run at (722,0) width 62: "RTL Start"
       LayoutNGBlockFlow {DIV} at (0,324) size 784x20
         LayoutNGBlockFlow {P} at (0,0) size 784x20
-          LayoutText {#text} at (0,0) size 61x19
-            text run at (0,0) width 61: "RTL End"
+          LayoutText {#text} at (0,0) size 59x19
+            text run at (0,0) width 59: "RTL End"
       LayoutNGBlockFlow {H1} at (0,360) size 784x20
-        LayoutText {#text} at (0,0) size 415x19
-          text run at (0,0) width 415: "Inherited case where parent block has opposite directionality."
+        LayoutText {#text} at (0,0) size 414x19
+          text run at (0,0) width 414: "Inherited case where parent block has opposite directionality."
       LayoutNGBlockFlow {DIV} at (0,396) size 784x20
         LayoutNGBlockFlow {P} at (0,0) size 784x20
-          LayoutText {#text} at (0,0) size 62x19
-            text run at (0,0) width 62: "LTR Start"
+          LayoutText {#text} at (0,0) size 63x19
+            text run at (0,0) width 63: "LTR Start"
       LayoutNGBlockFlow {DIV} at (0,432) size 784x20
         LayoutNGBlockFlow {P} at (0,0) size 784x20
-          LayoutText {#text} at (725,0) size 59x19
-            text run at (725,0) width 59: "LTR End"
+          LayoutText {#text} at (724,0) size 60x19
+            text run at (724,0) width 60: "LTR End"
       LayoutNGBlockFlow {DIV} at (0,468) size 784x20
         LayoutNGBlockFlow {P} at (0,0) size 784x20
-          LayoutText {#text} at (720,0) size 64x19
-            text run at (720,0) width 64: "RTL Start"
+          LayoutText {#text} at (722,0) size 62x19
+            text run at (722,0) width 62: "RTL Start"
       LayoutNGBlockFlow {DIV} at (0,504) size 784x20
         LayoutNGBlockFlow {P} at (0,0) size 784x20
-          LayoutText {#text} at (0,0) size 61x19
-            text run at (0,0) width 61: "RTL End"
+          LayoutText {#text} at (0,0) size 59x19
+            text run at (0,0) width 59: "RTL End"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-overflow-ellipsis-bidi-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-overflow-ellipsis-bidi-expected.png
index 1420281..cd04b26 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-overflow-ellipsis-bidi-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-overflow-ellipsis-bidi-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-overflow-ellipsis-bidi-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-overflow-ellipsis-bidi-expected.txt
index 5cc64d1c..11450319 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-overflow-ellipsis-bidi-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-overflow-ellipsis-bidi-expected.txt
@@ -7,47 +7,47 @@
         LayoutText {#text} at (0,0) size 565x19
           text run at (0,0) width 565: "Each consecutive pair of lines should look exactly the same apart from the trailing ellipsis."
         LayoutBR {BR} at (565,0) size 0x0
-        LayoutText {#text} at (0,20) size 535x19
-          text run at (0,20) width 535: "The ellipsis should appear on the left for the RTL case and on the right for LTR case."
-        LayoutBR {BR} at (535,20) size 0x0
+        LayoutText {#text} at (0,20) size 534x19
+          text run at (0,20) width 534: "The ellipsis should appear on the left for the RTL case and on the right for LTR case."
+        LayoutBR {BR} at (534,20) size 0x0
         LayoutBR {BR} at (0,40) size 0x0
-        LayoutText {#text} at (0,60) size 62x19
-          text run at (0,60) width 62: "RTL text:"
+        LayoutText {#text} at (0,60) size 60x19
+          text run at (0,60) width 60: "RTL text:"
       LayoutNGBlockFlow (anonymous) at (0,120) size 784x40
         LayoutBR {BR} at (0,0) size 0x0
-        LayoutText {#text} at (0,20) size 60x19
-          text run at (0,20) width 60: "LTR Text"
+        LayoutText {#text} at (0,20) size 62x19
+          text run at (0,20) width 62: "LTR Text"
 layer at (8,88) size 207x20
   LayoutNGBlockFlow {DIV} at (0,80) size 207x20
-    LayoutText {#text} at (-98,0) size 305x19
-      text run at (-98,0) width 4: " \x{202C}"
-      text run at (-94,0) width 218: " \x{5D8}\x{5E7}\x{5E1}\x{5D8} \x{5E2}\x{5D1}\x{5E8}\x{5D9} \x{5DC}\x{5D3}\x{5D5}\x{5D2}\x{5DE}\x{5D0} \x{5D8}\x{5E7}\x{5E1}\x{5D8} \x{5E2}\x{5D1}\x{5E8}\x{5D9} \x{5DC}\x{5D3}\x{5D5}\x{5D2}\x{5DE}\x{5D0}"
-      text run at (124,0) width 79: "English Text"
+    LayoutText {#text} at (-125,0) size 332x19
+      text run at (-125,0) width 4: " \x{202C}"
+      text run at (-121,0) width 244: " \x{5D8}\x{5E7}\x{5E1}\x{5D8} \x{5E2}\x{5D1}\x{5E8}\x{5D9} \x{5DC}\x{5D3}\x{5D5}\x{5D2}\x{5DE}\x{5D0} \x{5D8}\x{5E7}\x{5E1}\x{5D8} \x{5E2}\x{5D1}\x{5E8}\x{5D9} \x{5DC}\x{5D3}\x{5D5}\x{5D2}\x{5DE}\x{5D0}"
+      text run at (123,0) width 80: "English Text"
       text run at (203,0) width 4: "\x{202B} "
 layer at (8,108) size 207x20
   LayoutNGBlockFlow {DIV} at (0,100) size 207x20
-    LayoutText {#text} at (7,0) size 200x19
-      text run at (7,0) width 16: "\x{2026}"
-      text run at (23,0) width 101: " \x{5D8}\x{5E7}\x{5E1}\x{5D8} \x{5E2}\x{5D1}\x{5E8}\x{5D9} \x{5DC}\x{5D3}\x{5D5}\x{5D2}\x{5DE}"
-      text run at (124,0) width 79: "English Text"
+    LayoutText {#text} at (4,0) size 203x19
+      text run at (4,0) width 16: "\x{2026}"
+      text run at (20,0) width 103: " \x{5D8}\x{5E7}\x{5E1}\x{5D8} \x{5E2}\x{5D1}\x{5E8}\x{5D9} \x{5DC}\x{5D3}\x{5D5}\x{5D2}"
+      text run at (123,0) width 80: "English Text"
       text run at (203,0) width 4: "\x{202B} "
 layer at (8,168) size 207x20
   LayoutNGBlockFlow {DIV} at (0,160) size 207x20
-    LayoutText {#text} at (0,0) size 228x19
-      text run at (0,0) width 27: "\x{5DE}\x{5D9}\x{5DC}\x{5D4}"
-      text run at (27,0) width 41: " word "
-      text run at (68,0) width 32: "\x{5D0}\x{5D7}\x{5E8}\x{5EA}"
-      text run at (100,0) width 55: " another "
-      text run at (155,0) width 22: "\x{5D5}\x{5E2}\x{5D5}\x{5D3}"
-      text run at (177,0) width 27: " yet "
-      text run at (204,0) width 24: "\x{5D0}\x{5D7}\x{5EA}"
+    LayoutText {#text} at (0,0) size 243x19
+      text run at (0,0) width 29: "\x{5DE}\x{5D9}\x{5DC}\x{5D4}"
+      text run at (29,0) width 41: " word "
+      text run at (70,0) width 37: "\x{5D0}\x{5D7}\x{5E8}\x{5EA}"
+      text run at (107,0) width 55: " another "
+      text run at (162,0) width 25: "\x{5D5}\x{5E2}\x{5D5}\x{5D3}"
+      text run at (187,0) width 27: " yet "
+      text run at (214,0) width 29: "\x{5D0}\x{5D7}\x{5EA}"
 layer at (8,188) size 207x20
   LayoutNGBlockFlow {DIV} at (0,180) size 207x20
-    LayoutText {#text} at (0,0) size 205x19
-      text run at (0,0) width 27: "\x{5DE}\x{5D9}\x{5DC}\x{5D4}"
-      text run at (27,0) width 41: " word "
-      text run at (68,0) width 32: "\x{5D0}\x{5D7}\x{5E8}\x{5EA}"
-      text run at (100,0) width 55: " another "
-      text run at (155,0) width 22: "\x{5D5}\x{5E2}\x{5D5}\x{5D3}"
-      text run at (177,0) width 12: " y"
-      text run at (189,0) width 16: "\x{2026}"
+    LayoutText {#text} at (0,0) size 207x19
+      text run at (0,0) width 29: "\x{5DE}\x{5D9}\x{5DC}\x{5D4}"
+      text run at (29,0) width 41: " word "
+      text run at (70,0) width 37: "\x{5D0}\x{5D7}\x{5E8}\x{5EA}"
+      text run at (107,0) width 55: " another "
+      text run at (162,0) width 25: "\x{5D5}\x{5E2}\x{5D5}\x{5D3}"
+      text run at (187,0) width 4: " "
+      text run at (191,0) width 16: "\x{2026}"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-overflow-ellipsis-block-with-border-and-padding-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-overflow-ellipsis-block-with-border-and-padding-expected.png
index 9934e9b3..cf5d34c 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-overflow-ellipsis-block-with-border-and-padding-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-overflow-ellipsis-block-with-border-and-padding-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-overflow-ellipsis-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-overflow-ellipsis-expected.png
new file mode 100644
index 0000000..7ef0b43
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-overflow-ellipsis-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-overflow-ellipsis-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-overflow-ellipsis-expected.txt
new file mode 100644
index 0000000..0266027d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-overflow-ellipsis-expected.txt
@@ -0,0 +1,116 @@
+layer at (0,0) size 800x600 scrollHeight 770
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x770 backgroundClip at (0,0) size 800x600 clip at (0,0) size 800x600
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x770
+    LayoutNGBlockFlow {BODY} at (8,8) size 784x742
+      LayoutNGBlockFlow (anonymous) at (0,0) size 784x100
+        LayoutText {#text} at (0,0) size 557x19
+          text run at (0,0) width 557: "This tests checks that the text-overflow:ellipsis property is handled correctly for bidi text."
+        LayoutBR {BR} at (557,0) size 0x0
+        LayoutBR {BR} at (0,20) size 0x0
+        LayoutText {#text} at (0,40) size 737x19
+          text run at (0,40) width 737: "Pass if the ellipsis do not overlap the text and the underlines for the links are placed under the text and not the ellipsis."
+        LayoutBR {BR} at (737,40) size 0x0
+        LayoutBR {BR} at (0,60) size 0x0
+        LayoutText {#text} at (0,80) size 34x19
+          text run at (0,80) width 34: "RTL:"
+      LayoutNGBlockFlow (anonymous) at (0,142) size 784x20
+        LayoutText {#text} at (0,0) size 93x19
+          text run at (0,0) width 93: "RTL Override:"
+      LayoutNGBlockFlow (anonymous) at (0,204) size 784x20
+        LayoutText {#text} at (0,0) size 61x19
+          text run at (0,0) width 61: "RTL link:"
+      LayoutNGBlockFlow (anonymous) at (0,266) size 784x20
+        LayoutText {#text} at (0,0) size 132x19
+          text run at (0,0) width 132: "RTL with ltr content:"
+      LayoutNGBlockFlow (anonymous) at (0,328) size 784x20
+        LayoutText {#text} at (0,0) size 160x19
+          text run at (0,0) width 160: "RTL link with ltr content:"
+      LayoutNGBlockFlow (anonymous) at (0,390) size 784x20
+        LayoutText {#text} at (0,0) size 62x19
+          text run at (0,0) width 62: "LTR link:"
+      LayoutNGBlockFlow (anonymous) at (0,452) size 784x20
+        LayoutText {#text} at (0,0) size 34x19
+          text run at (0,0) width 34: "LTR:"
+      LayoutNGBlockFlow (anonymous) at (0,514) size 784x20
+        LayoutText {#text} at (0,0) size 133x19
+          text run at (0,0) width 133: "LTR with rtl content:"
+      LayoutNGBlockFlow (anonymous) at (0,576) size 784x20
+        LayoutText {#text} at (0,0) size 177x19
+          text run at (0,0) width 177: "LTR with forced rtl content:"
+      LayoutNGBlockFlow (anonymous) at (0,638) size 784x20
+        LayoutText {#text} at (0,0) size 161x19
+          text run at (0,0) width 161: "LTR link with rtl content:"
+      LayoutNGBlockFlow (anonymous) at (0,700) size 784x20
+        LayoutText {#text} at (0,0) size 205x19
+          text run at (0,0) width 205: "LTR link with forced rtl content:"
+layer at (8,108) size 182x22 clip at (9,109) size 180x20
+  LayoutNGBlockFlow {DIV} at (0,100) size 182x22 [border: (1px solid #000000)]
+    LayoutText {#text} at (3,1) size 178x19
+      text run at (3,1) width 16: "\x{2026}"
+      text run at (19,1) width 162: "\x{5DB}\x{5E9}\x{5D4}\x{5D8}\x{5E7}\x{5E1}\x{5D8} \x{5E2}\x{5E8}\x{5D5}\x{5DA} \x{5DE}\x{5D3}\x{5D9} \x{5E0}\x{5E8}\x{5E6}\x{5D4} "
+layer at (8,170) size 182x22 clip at (9,171) size 180x20
+  LayoutNGBlockFlow {DIV} at (0,162) size 182x22 [border: (1px solid #000000)]
+    LayoutText {#text} at (3,1) size 178x19
+      text run at (3,1) width 16: "\x{2026}"
+      text run at (19,1) width 162: "Lorem ipsum dolor sit am"
+layer at (8,232) size 182x22 clip at (9,233) size 180x20
+  LayoutNGBlockFlow {DIV} at (0,224) size 182x22 [border: (1px solid #000000)]
+    LayoutInline {A} at (0,0) size 178x19 [color=#0000EE]
+      LayoutText {#text} at (3,1) size 178x19
+        text run at (3,1) width 16: "\x{2026}"
+        text run at (19,1) width 162: "Lorem ipsum dolor sit am"
+    LayoutText {#text} at (0,0) size 0x0
+layer at (8,294) size 182x22 clip at (9,295) size 180x20
+  LayoutNGBlockFlow {DIV} at (0,286) size 182x22 [border: (1px solid #000000)]
+    LayoutText {#text} at (3,1) size 178x19
+      text run at (3,1) width 16: "\x{2026}"
+      text run at (19,1) width 162: "Lorem ipsum dolor sit am"
+layer at (8,356) size 182x22 clip at (9,357) size 180x20
+  LayoutNGBlockFlow {DIV} at (0,348) size 182x22 [border: (1px solid #000000)]
+    LayoutInline {A} at (0,0) size 178x19 [color=#0000EE]
+      LayoutText {#text} at (3,1) size 178x19
+        text run at (3,1) width 16: "\x{2026}"
+        text run at (19,1) width 162: "Lorem ipsum dolor sit am"
+    LayoutText {#text} at (0,0) size 0x0
+layer at (8,418) size 182x22 clip at (9,419) size 180x20
+  LayoutNGBlockFlow {DIV} at (0,410) size 182x22 [border: (1px solid #000000)]
+    LayoutInline {A} at (0,0) size 178x19 [color=#0000EE]
+      LayoutText {#text} at (1,1) size 178x19
+        text run at (1,1) width 162: "Lorem ipsum dolor sit am"
+        text run at (163,1) width 16: "\x{2026}"
+    LayoutText {#text} at (0,0) size 0x0
+layer at (8,480) size 182x22 clip at (9,481) size 180x20
+  LayoutNGBlockFlow {DIV} at (0,472) size 182x22 [border: (1px solid #000000)]
+    LayoutText {#text} at (1,1) size 178x19
+      text run at (1,1) width 162: "Lorem ipsum dolor sit am"
+      text run at (163,1) width 16: "\x{2026}"
+layer at (8,542) size 182x22 clip at (9,543) size 180x20
+  LayoutNGBlockFlow {DIV} at (0,534) size 182x22 [border: (1px solid #000000)]
+    LayoutText {#text} at (1,1) size 178x19
+      text run at (1,1) width 162: "\x{5DB}\x{5E9}\x{5D4}\x{5D8}\x{5E7}\x{5E1}\x{5D8} \x{5E2}\x{5E8}\x{5D5}\x{5DA} \x{5DE}\x{5D3}\x{5D9} \x{5E0}\x{5E8}\x{5E6}\x{5D4} "
+      text run at (163,1) width 16: "\x{2026}"
+layer at (8,604) size 182x22 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0
+  LayoutNGBlockFlow {DIV} at (0,596) size 182x22 [border: (1px solid #000000)]
+    LayoutInline {SPAN} at (0,0) size 178x19
+      LayoutText {#text} at (1,1) size 178x19
+        text run at (1,1) width 162: "Lorem ipsum dolor sit am"
+        text run at (163,1) width 16: "\x{2026}"
+    LayoutText {#text} at (0,0) size 0x0
+layer at (8,666) size 182x22 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0
+  LayoutNGBlockFlow {DIV} at (0,658) size 182x22 [border: (1px solid #000000)]
+    LayoutInline {A} at (0,0) size 178x19 [color=#0000EE]
+      LayoutText {#text} at (1,1) size 178x19
+        text run at (1,1) width 162: "\x{5DB}\x{5E9}\x{5D4}\x{5D8}\x{5E7}\x{5E1}\x{5D8} \x{5E2}\x{5E8}\x{5D5}\x{5DA} \x{5DE}\x{5D3}\x{5D9} \x{5E0}\x{5E8}\x{5E6}\x{5D4} "
+        text run at (163,1) width 16: "\x{2026}"
+    LayoutText {#text} at (0,0) size 0x0
+layer at (8,728) size 182x22 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0
+  LayoutNGBlockFlow {DIV} at (0,720) size 182x22 [border: (1px solid #000000)]
+    LayoutInline {A} at (0,0) size 178x19 [color=#0000EE]
+      LayoutText {#text} at (0,0) size 0x0
+      LayoutInline {SPAN} at (0,0) size 178x19
+        LayoutText {#text} at (1,1) size 178x19
+          text run at (1,1) width 162: "Lorem ipsum dolor sit am"
+          text run at (163,1) width 16: "\x{2026}"
+      LayoutText {#text} at (0,0) size 0x0
+    LayoutText {#text} at (0,0) size 0x0
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-overflow-ellipsis-strict-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-overflow-ellipsis-strict-expected.png
new file mode 100644
index 0000000..7ef0b43
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-overflow-ellipsis-strict-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-overflow-ellipsis-strict-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-overflow-ellipsis-strict-expected.txt
new file mode 100644
index 0000000..0266027d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-overflow-ellipsis-strict-expected.txt
@@ -0,0 +1,116 @@
+layer at (0,0) size 800x600 scrollHeight 770
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x770 backgroundClip at (0,0) size 800x600 clip at (0,0) size 800x600
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x770
+    LayoutNGBlockFlow {BODY} at (8,8) size 784x742
+      LayoutNGBlockFlow (anonymous) at (0,0) size 784x100
+        LayoutText {#text} at (0,0) size 557x19
+          text run at (0,0) width 557: "This tests checks that the text-overflow:ellipsis property is handled correctly for bidi text."
+        LayoutBR {BR} at (557,0) size 0x0
+        LayoutBR {BR} at (0,20) size 0x0
+        LayoutText {#text} at (0,40) size 737x19
+          text run at (0,40) width 737: "Pass if the ellipsis do not overlap the text and the underlines for the links are placed under the text and not the ellipsis."
+        LayoutBR {BR} at (737,40) size 0x0
+        LayoutBR {BR} at (0,60) size 0x0
+        LayoutText {#text} at (0,80) size 34x19
+          text run at (0,80) width 34: "RTL:"
+      LayoutNGBlockFlow (anonymous) at (0,142) size 784x20
+        LayoutText {#text} at (0,0) size 93x19
+          text run at (0,0) width 93: "RTL Override:"
+      LayoutNGBlockFlow (anonymous) at (0,204) size 784x20
+        LayoutText {#text} at (0,0) size 61x19
+          text run at (0,0) width 61: "RTL link:"
+      LayoutNGBlockFlow (anonymous) at (0,266) size 784x20
+        LayoutText {#text} at (0,0) size 132x19
+          text run at (0,0) width 132: "RTL with ltr content:"
+      LayoutNGBlockFlow (anonymous) at (0,328) size 784x20
+        LayoutText {#text} at (0,0) size 160x19
+          text run at (0,0) width 160: "RTL link with ltr content:"
+      LayoutNGBlockFlow (anonymous) at (0,390) size 784x20
+        LayoutText {#text} at (0,0) size 62x19
+          text run at (0,0) width 62: "LTR link:"
+      LayoutNGBlockFlow (anonymous) at (0,452) size 784x20
+        LayoutText {#text} at (0,0) size 34x19
+          text run at (0,0) width 34: "LTR:"
+      LayoutNGBlockFlow (anonymous) at (0,514) size 784x20
+        LayoutText {#text} at (0,0) size 133x19
+          text run at (0,0) width 133: "LTR with rtl content:"
+      LayoutNGBlockFlow (anonymous) at (0,576) size 784x20
+        LayoutText {#text} at (0,0) size 177x19
+          text run at (0,0) width 177: "LTR with forced rtl content:"
+      LayoutNGBlockFlow (anonymous) at (0,638) size 784x20
+        LayoutText {#text} at (0,0) size 161x19
+          text run at (0,0) width 161: "LTR link with rtl content:"
+      LayoutNGBlockFlow (anonymous) at (0,700) size 784x20
+        LayoutText {#text} at (0,0) size 205x19
+          text run at (0,0) width 205: "LTR link with forced rtl content:"
+layer at (8,108) size 182x22 clip at (9,109) size 180x20
+  LayoutNGBlockFlow {DIV} at (0,100) size 182x22 [border: (1px solid #000000)]
+    LayoutText {#text} at (3,1) size 178x19
+      text run at (3,1) width 16: "\x{2026}"
+      text run at (19,1) width 162: "\x{5DB}\x{5E9}\x{5D4}\x{5D8}\x{5E7}\x{5E1}\x{5D8} \x{5E2}\x{5E8}\x{5D5}\x{5DA} \x{5DE}\x{5D3}\x{5D9} \x{5E0}\x{5E8}\x{5E6}\x{5D4} "
+layer at (8,170) size 182x22 clip at (9,171) size 180x20
+  LayoutNGBlockFlow {DIV} at (0,162) size 182x22 [border: (1px solid #000000)]
+    LayoutText {#text} at (3,1) size 178x19
+      text run at (3,1) width 16: "\x{2026}"
+      text run at (19,1) width 162: "Lorem ipsum dolor sit am"
+layer at (8,232) size 182x22 clip at (9,233) size 180x20
+  LayoutNGBlockFlow {DIV} at (0,224) size 182x22 [border: (1px solid #000000)]
+    LayoutInline {A} at (0,0) size 178x19 [color=#0000EE]
+      LayoutText {#text} at (3,1) size 178x19
+        text run at (3,1) width 16: "\x{2026}"
+        text run at (19,1) width 162: "Lorem ipsum dolor sit am"
+    LayoutText {#text} at (0,0) size 0x0
+layer at (8,294) size 182x22 clip at (9,295) size 180x20
+  LayoutNGBlockFlow {DIV} at (0,286) size 182x22 [border: (1px solid #000000)]
+    LayoutText {#text} at (3,1) size 178x19
+      text run at (3,1) width 16: "\x{2026}"
+      text run at (19,1) width 162: "Lorem ipsum dolor sit am"
+layer at (8,356) size 182x22 clip at (9,357) size 180x20
+  LayoutNGBlockFlow {DIV} at (0,348) size 182x22 [border: (1px solid #000000)]
+    LayoutInline {A} at (0,0) size 178x19 [color=#0000EE]
+      LayoutText {#text} at (3,1) size 178x19
+        text run at (3,1) width 16: "\x{2026}"
+        text run at (19,1) width 162: "Lorem ipsum dolor sit am"
+    LayoutText {#text} at (0,0) size 0x0
+layer at (8,418) size 182x22 clip at (9,419) size 180x20
+  LayoutNGBlockFlow {DIV} at (0,410) size 182x22 [border: (1px solid #000000)]
+    LayoutInline {A} at (0,0) size 178x19 [color=#0000EE]
+      LayoutText {#text} at (1,1) size 178x19
+        text run at (1,1) width 162: "Lorem ipsum dolor sit am"
+        text run at (163,1) width 16: "\x{2026}"
+    LayoutText {#text} at (0,0) size 0x0
+layer at (8,480) size 182x22 clip at (9,481) size 180x20
+  LayoutNGBlockFlow {DIV} at (0,472) size 182x22 [border: (1px solid #000000)]
+    LayoutText {#text} at (1,1) size 178x19
+      text run at (1,1) width 162: "Lorem ipsum dolor sit am"
+      text run at (163,1) width 16: "\x{2026}"
+layer at (8,542) size 182x22 clip at (9,543) size 180x20
+  LayoutNGBlockFlow {DIV} at (0,534) size 182x22 [border: (1px solid #000000)]
+    LayoutText {#text} at (1,1) size 178x19
+      text run at (1,1) width 162: "\x{5DB}\x{5E9}\x{5D4}\x{5D8}\x{5E7}\x{5E1}\x{5D8} \x{5E2}\x{5E8}\x{5D5}\x{5DA} \x{5DE}\x{5D3}\x{5D9} \x{5E0}\x{5E8}\x{5E6}\x{5D4} "
+      text run at (163,1) width 16: "\x{2026}"
+layer at (8,604) size 182x22 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0
+  LayoutNGBlockFlow {DIV} at (0,596) size 182x22 [border: (1px solid #000000)]
+    LayoutInline {SPAN} at (0,0) size 178x19
+      LayoutText {#text} at (1,1) size 178x19
+        text run at (1,1) width 162: "Lorem ipsum dolor sit am"
+        text run at (163,1) width 16: "\x{2026}"
+    LayoutText {#text} at (0,0) size 0x0
+layer at (8,666) size 182x22 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0
+  LayoutNGBlockFlow {DIV} at (0,658) size 182x22 [border: (1px solid #000000)]
+    LayoutInline {A} at (0,0) size 178x19 [color=#0000EE]
+      LayoutText {#text} at (1,1) size 178x19
+        text run at (1,1) width 162: "\x{5DB}\x{5E9}\x{5D4}\x{5D8}\x{5E7}\x{5E1}\x{5D8} \x{5E2}\x{5E8}\x{5D5}\x{5DA} \x{5DE}\x{5D3}\x{5D9} \x{5E0}\x{5E8}\x{5E6}\x{5D4} "
+        text run at (163,1) width 16: "\x{2026}"
+    LayoutText {#text} at (0,0) size 0x0
+layer at (8,728) size 182x22 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0
+  LayoutNGBlockFlow {DIV} at (0,720) size 182x22 [border: (1px solid #000000)]
+    LayoutInline {A} at (0,0) size 178x19 [color=#0000EE]
+      LayoutText {#text} at (0,0) size 0x0
+      LayoutInline {SPAN} at (0,0) size 178x19
+        LayoutText {#text} at (1,1) size 178x19
+          text run at (1,1) width 162: "Lorem ipsum dolor sit am"
+          text run at (163,1) width 16: "\x{2026}"
+      LayoutText {#text} at (0,0) size 0x0
+    LayoutText {#text} at (0,0) size 0x0
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-rendering-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-rendering-expected.png
index ffbcd4d3..a23df74 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-rendering-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/text-rendering-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/textCapitalizeEdgeCases-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/textCapitalizeEdgeCases-expected.png
index 0e2cab7..38b4ce6 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/textCapitalizeEdgeCases-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/textCapitalizeEdgeCases-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/textCapitalizeEdgeCases-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/textCapitalizeEdgeCases-expected.txt
index b8da859..370bf52 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/textCapitalizeEdgeCases-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css/textCapitalizeEdgeCases-expected.txt
@@ -4,10 +4,10 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x600
     LayoutNGBlockFlow {BODY} at (8,8) size 784x572
       LayoutNGBlockFlow {P} at (0,0) size 784x60
-        LayoutText {#text} at (0,0) size 776x59
-          text run at (0,0) width 775: "This file tests capitalisation with all sorts of odd things. There is some RTL text, some text with an inlined-div placed inside"
-          text run at (0,20) width 776: "a word, an image between words as well as a div between words. Each word below should be capitalised, and there should"
-          text run at (0,40) width 232: "be no capitals n the middle of words."
+        LayoutText {#text} at (0,0) size 784x59
+          text run at (0,0) width 784: "This file tests capitalisation with all sorts of odd things. There is some RTL text, some text with an inlined-div placed inside a"
+          text run at (0,20) width 784: "word, an image between words as well as a div between words. Each word below should be capitalised, and there should be"
+          text run at (0,40) width 213: "no capitals n the middle of words."
       LayoutNGBlockFlow {DIV} at (20,80) size 744x120 [border: (5px solid #FF0000)]
         LayoutNGBlockFlow {DIV} at (25,25) size 694x20
           LayoutText {#text} at (664,0) size 30x19
@@ -21,11 +21,11 @@
           LayoutNGBlockFlow (anonymous) at (0,0) size 694x30
             LayoutText {#text} at (0,10) size 29x19
               text run at (0,10) width 29: "A W"
-            LayoutInline {DIV} at (0,0) size 12x19
-              LayoutText {#text} at (29,10) size 12x19
-                text run at (29,10) width 12: "or"
-            LayoutText {#text} at (41,10) size 43x19
-              text run at (41,10) width 43: "d With"
+            LayoutInline {DIV} at (0,0) size 13x19
+              LayoutText {#text} at (29,10) size 13x19
+                text run at (29,10) width 13: "or"
+            LayoutText {#text} at (42,10) size 42x19
+              text run at (42,10) width 42: "d With"
             LayoutImage {IMG} at (84,0) size 25x25
             LayoutText {#text} at (109,10) size 63x19
               text run at (109,10) width 63: "An Image"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css3-text/css3-text-decoration/text-underline-position/text-underline-position-all-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css3-text/css3-text-decoration/text-underline-position/text-underline-position-all-expected.png
new file mode 100644
index 0000000..22472646
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/css3-text/css3-text-decoration/text-underline-position/text-underline-position-all-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/deprecated-flexbox/023-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/deprecated-flexbox/023-expected.png
new file mode 100644
index 0000000..424b33c
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/deprecated-flexbox/023-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/deprecated-flexbox/024-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/deprecated-flexbox/024-expected.png
new file mode 100644
index 0000000..424b33c
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/deprecated-flexbox/024-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/HTMLMeterElement/meter-boundary-values-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/HTMLMeterElement/meter-boundary-values-expected.png
index e27f0808..76bccaa6 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/HTMLMeterElement/meter-boundary-values-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/HTMLMeterElement/meter-boundary-values-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/HTMLMeterElement/meter-boundary-values-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/HTMLMeterElement/meter-boundary-values-expected.txt
index 07d13c71..72f6b57c 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/HTMLMeterElement/meter-boundary-values-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/HTMLMeterElement/meter-boundary-values-expected.txt
@@ -4,15 +4,15 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x600
     LayoutNGBlockFlow {BODY} at (8,8) size 784x576
       LayoutNGBlockFlow {H1} at (0,0) size 784x37
-        LayoutText {#text} at (0,0) size 359x36
-          text run at (0,0) width 359: "Meters with border values"
+        LayoutText {#text} at (0,0) size 358x36
+          text run at (0,0) width 358: "Meters with border values"
       LayoutNGBlockFlow {UL} at (0,58.44) size 784x300
         LayoutNGListItem {LI} at (40,0) size 744x20
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
             LayoutText (anonymous) at (0,0) size 10x19
               text run at (0,0) width 10: "\x{2022} "
-          LayoutText {#text} at (0,0) size 164x19
-            text run at (0,0) width 164: "min,low,optimal,high,max"
+          LayoutText {#text} at (0,0) size 165x19
+            text run at (0,0) width 165: "min,low,optimal,high,max"
         LayoutNGListItem {LI} at (40,20) size 744x20
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
             LayoutText (anonymous) at (0,0) size 10x19
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/HTMLMeterElement/meter-optimums-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/HTMLMeterElement/meter-optimums-expected.png
index 4facfbf..aeaded5 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/HTMLMeterElement/meter-optimums-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/HTMLMeterElement/meter-optimums-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/HTMLObjectElement/vspace-hspace-as-number-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/HTMLObjectElement/vspace-hspace-as-number-expected.png
new file mode 100644
index 0000000..c1cf764
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/HTMLObjectElement/vspace-hspace-as-number-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/HTMLObjectElement/vspace-hspace-as-number-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/HTMLObjectElement/vspace-hspace-as-number-expected.txt
new file mode 100644
index 0000000..a9420db
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/HTMLObjectElement/vspace-hspace-as-number-expected.txt
@@ -0,0 +1,16 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x600
+    LayoutNGBlockFlow {BODY} at (8,8) size 784x584
+      LayoutNGBlockFlow {P} at (0,0) size 784x40
+        LayoutText {#text} at (0,0) size 782x39
+          text run at (0,0) width 782: "This test makes sure that HTMLObjectElement.vspace and HTMLObjectElement.hspace are exposed as numbers instead of"
+          text run at (0,20) width 717: "strings, per the DOM Level 2 HTML spec: http://www.w3.org/TR/DOM-Level-2-HTML/html.html#ID-9893177"
+      LayoutNGBlockFlow (anonymous) at (0,56) size 784x170
+        LayoutText {#text} at (0,0) size 0x0
+      LayoutNGBlockFlow {DIV} at (0,226) size 784x20
+        LayoutText {#text} at (0,0) size 76x19
+          text run at (0,0) width 76: "SUCCESS!"
+layer at (28,74) size 300x150
+  LayoutEmbeddedObject {OBJECT} at (20,10) size 300x150
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/HTMLProgressElement/progress-bar-value-pseudo-element-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/HTMLProgressElement/progress-bar-value-pseudo-element-expected.png
index fb3a2b5f..0213979 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/HTMLProgressElement/progress-bar-value-pseudo-element-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/HTMLProgressElement/progress-bar-value-pseudo-element-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/clone-node-dynamic-style-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/clone-node-dynamic-style-expected.png
index 46dcc873..16e6fcd 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/clone-node-dynamic-style-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dom/clone-node-dynamic-style-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dynamic/011-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dynamic/011-expected.png
new file mode 100644
index 0000000..bf3fc2dc
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dynamic/011-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dynamic/011-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dynamic/011-expected.txt
index d9030963..a349759 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dynamic/011-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dynamic/011-expected.txt
@@ -4,10 +4,10 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x600
     LayoutNGBlockFlow {BODY} at (8,8) size 784x584
       LayoutNGBlockFlow (anonymous) at (0,0) size 784x40
-        LayoutInline {SPAN} at (0,0) size 779x39
-          LayoutInline {SPAN} at (0,0) size 779x39
-            LayoutText {#text} at (0,0) size 779x39
-              text run at (0,0) width 779: "Bug #3810389. Make sure we don't crash manipulating blocks inside inlines. You should see the numbers 1 and 2 vertically"
+        LayoutInline {SPAN} at (0,0) size 778x39
+          LayoutInline {SPAN} at (0,0) size 778x39
+            LayoutText {#text} at (0,0) size 778x39
+              text run at (0,0) width 778: "Bug #3810389. Make sure we don't crash manipulating blocks inside inlines. You should see the numbers 1 and 2 vertically"
               text run at (0,20) width 147: "stacked below this line."
       LayoutNGBlockFlow (anonymous) at (0,40) size 784x20
         LayoutNGBlockFlow {DIV} at (0,0) size 784x20
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dynamic/outerHTML-doc-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dynamic/outerHTML-doc-expected.png
new file mode 100644
index 0000000..8946d2d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dynamic/outerHTML-doc-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dynamic/outerHTML-doc-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dynamic/outerHTML-doc-expected.txt
index 4f5a47f7..8ed3d59 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dynamic/outerHTML-doc-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dynamic/outerHTML-doc-expected.txt
@@ -6,12 +6,12 @@
       LayoutNGBlockFlow {P} at (0,0) size 784x20
         LayoutText {#text} at (0,0) size 47x19
           text run at (0,0) width 47: "test for "
-        LayoutInline {A} at (0,0) size 56x19 [color=#0000EE]
-          LayoutText {#text} at (47,0) size 56x19
-            text run at (47,0) width 56: "4110775"
-        LayoutText {#text} at (103,0) size 473x19
-          text run at (103,0) width 473: " Crash will occur when double-clicking outerHTML link on W3 DOM test"
+        LayoutInline {A} at (0,0) size 55x19 [color=#0000EE]
+          LayoutText {#text} at (47,0) size 55x19
+            text run at (47,0) width 55: "4110775"
+        LayoutText {#text} at (102,0) size 472x19
+          text run at (102,0) width 472: " Crash will occur when double-clicking outerHTML link on W3 DOM test"
       LayoutNGBlockFlow {P} at (0,36) size 784x0
       LayoutNGBlockFlow {DIV} at (0,36) size 784x20
-        LayoutText {#text} at (0,0) size 584x19
-          text run at (0,0) width 584: "This test passed. We don't support outerHTML on the document object. Neither does WinIE."
+        LayoutText {#text} at (0,0) size 583x19
+          text run at (0,0) width 583: "This test passed. We don't support outerHTML on the document object. Neither does WinIE."
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dynamic/outerHTML-img-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dynamic/outerHTML-img-expected.png
new file mode 100644
index 0000000..2c754aa
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dynamic/outerHTML-img-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dynamic/outerHTML-img-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dynamic/outerHTML-img-expected.txt
new file mode 100644
index 0000000..9229a64
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/dynamic/outerHTML-img-expected.txt
@@ -0,0 +1,19 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x600
+    LayoutNGBlockFlow {BODY} at (8,8) size 784x584
+      LayoutNGBlockFlow {P} at (0,0) size 784x20
+        LayoutText {#text} at (0,0) size 47x19
+          text run at (0,0) width 47: "test for "
+        LayoutInline {A} at (0,0) size 56x19 [color=#0000EE]
+          LayoutText {#text} at (47,0) size 56x19
+            text run at (47,0) width 56: "4065447"
+        LayoutText {#text} at (103,0) size 256x19
+          text run at (103,0) width 256: " (support outerHTML on IMG elements)"
+      LayoutNGBlockFlow {P} at (0,36) size 784x20
+        LayoutText {#text} at (0,0) size 503x19
+          text run at (0,0) width 503: "If the test fails, you'll see a Mozilla logo; if it succeeds, you'll see an Apple logo."
+      LayoutNGBlockFlow (anonymous) at (0,72) size 784x64
+        LayoutImage {IMG} at (0,0) size 52x64
+        LayoutText {#text} at (0,0) size 0x0
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/encoding/xmacroman-encoding-test-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/encoding/xmacroman-encoding-test-expected.png
new file mode 100644
index 0000000..4d72b90
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/encoding/xmacroman-encoding-test-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/encoding/xmacroman-encoding-test-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/encoding/xmacroman-encoding-test-expected.txt
index 4256b474..17873bba 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/encoding/xmacroman-encoding-test-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/encoding/xmacroman-encoding-test-expected.txt
@@ -4,8 +4,8 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x600
     LayoutNGBlockFlow {BODY} at (8,8) size 784x584
       LayoutNGBlockFlow {P} at (0,0) size 784x20
-        LayoutText {#text} at (0,0) size 761x19
-          text run at (0,0) width 761: "This tests the use of xmacroman as content type. You should not see any \"garbage\" characters if xmacroman is supported"
+        LayoutText {#text} at (0,0) size 760x19
+          text run at (0,0) width 760: "This tests the use of xmacroman as content type. You should not see any \"garbage\" characters if xmacroman is supported"
       LayoutNGBlockFlow (anonymous) at (0,36) size 784x60
         LayoutText {#text} at (0,0) size 82x19
           text run at (0,0) width 82: "apostrophe: \x{2019}"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/events/pointer-events-2-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/events/pointer-events-2-expected.png
index d26363c..4572884 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/events/pointer-events-2-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/events/pointer-events-2-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/events/pointer-events-2-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/events/pointer-events-2-expected.txt
index b138d3f..31b0b24 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/events/pointer-events-2-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/events/pointer-events-2-expected.txt
@@ -10,7 +10,7 @@
         LayoutText {#text} at (0,0) size 777x79
           text run at (0,0) width 777: "This test is expected to be run from within DumpRenderTree. If running manually, click on the elements in the first column,"
           text run at (0,20) width 766: "making sure the actual result (3rd column) matches the expected result (2nd column). Repeat for click target (4th column),"
-          text run at (0,40) width 776: "expected result (5th column) and actual result (6th column). Note: You should click on a yellow inline element if one exists,"
+          text run at (0,40) width 775: "expected result (5th column) and actual result (6th column). Note: You should click on a yellow inline element if one exists,"
           text run at (0,60) width 198: "otherwise anywhere in the box."
 layer at (10,140) size 300x100
   LayoutNGBlockFlow (positioned) {DIV} at (10,140) size 300x100
@@ -130,12 +130,12 @@
   LayoutImage (positioned) {IMG} at (0,0) size 80x80
 layer at (440,240) size 80x80
   LayoutNGBlockFlow (positioned) {DIV} at (100,0) size 80x80
-    LayoutText {#text} at (0,0) size 24x19
-      text run at (0,0) width 24: "p11"
+    LayoutText {#text} at (0,0) size 23x19
+      text run at (0,0) width 23: "p11"
 layer at (540,240) size 80x80
   LayoutNGBlockFlow (positioned) {DIV} at (200,0) size 80x80
-    LayoutText {#text} at (0,0) size 24x19
-      text run at (0,0) width 24: "p11"
+    LayoutText {#text} at (0,0) size 23x19
+      text run at (0,0) width 23: "p11"
 layer at (340,340) size 300x100
   LayoutNGBlockFlow (positioned) {DIV} at (340,340) size 300x100
 layer at (340,340) size 80x80
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/001-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/001-expected.png
index 1041b1a..185869a5 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/001-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/001-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/001-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/001-expected.txt
index b1bf6658..227622a 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/001-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/001-expected.txt
@@ -4,8 +4,8 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x600
     LayoutNGBlockFlow {BODY} at (8,8) size 784x576
       LayoutNGBlockFlow {H1} at (0,0) size 784x37
-        LayoutText {#text} at (0,0) size 231x36
-          text run at (0,0) width 231: "Min-Width Tests"
+        LayoutText {#text} at (0,0) size 229x36
+          text run at (0,0) width 229: "Min-Width Tests"
       LayoutTable {TABLE} at (0,58.44) size 784x86 [border: (2px outset #808080)]
         LayoutTableSection {TBODY} at (2,2) size 780x82
           LayoutTableRow {TR} at (0,0) size 780x82
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/006-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/006-expected.png
new file mode 100644
index 0000000..fd38b88
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/006-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/006-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/006-expected.txt
index 8c57d40..ea51d64 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/006-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/006-expected.txt
@@ -5,9 +5,9 @@
     LayoutNGBlockFlow {BODY} at (8,8) size 784x584
       LayoutNGBlockFlow {DIV} at (0,0) size 784x75.59 [border: (5px solid #000000)]
         LayoutFieldset {FIELDSET} at (7,5) size 770x65.59 [border: (10px groove #FF0000)]
-          LayoutNGBlockFlow {LEGEND} at (42,0) size 121x20
-            LayoutText {#text} at (2,0) size 117x19
-              text run at (2,0) width 117: "Test without forms"
+          LayoutNGBlockFlow {LEGEND} at (42,0) size 122x20
+            LayoutText {#text} at (2,0) size 118x19
+              text run at (2,0) width 118: "Test without forms"
           LayoutNGBlockFlow {DIV} at (22,25.59) size 726x20
-            LayoutText {#text} at (0,0) size 276x19
-              text run at (0,0) width 276: "A DIV inside a fieldset, not related to forms"
+            LayoutText {#text} at (0,0) size 275x19
+              text run at (0,0) width 275: "A DIV inside a fieldset, not related to forms"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/color/input-appearance-color-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/color/input-appearance-color-expected.png
index 4c14dfa..0adc7f9 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/color/input-appearance-color-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/color/input-appearance-color-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/color/input-appearance-color-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/color/input-appearance-color-expected.txt
index 880b677..22fc8b4 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/color/input-appearance-color-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/color/input-appearance-color-expected.txt
@@ -4,8 +4,8 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x600
     LayoutNGBlockFlow {BODY} at (8,8) size 784x584
       LayoutNGBlockFlow {H3} at (0,0) size 784x23
-        LayoutText {#text} at (0,0) size 162x22
-          text run at (0,0) width 162: "Default Appearance"
+        LayoutText {#text} at (0,0) size 163x22
+          text run at (0,0) width 163: "Default Appearance"
       LayoutNGBlockFlow (anonymous) at (0,41.72) size 784x43
         LayoutText {#text} at (0,0) size 284x19
           text run at (0,0) width 284: "List color controls have different appearance."
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/date/date-appearance-basic-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/date/date-appearance-basic-expected.png
index bba729ed..6d63f340 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/date/date-appearance-basic-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/date/date-appearance-basic-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/date/date-appearance-pseudo-elements-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/date/date-appearance-pseudo-elements-expected.png
index 574a8d6..18274348 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/date/date-appearance-pseudo-elements-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/date/date-appearance-pseudo-elements-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/datetimelocal/datetimelocal-appearance-basic-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/datetimelocal/datetimelocal-appearance-basic-expected.png
index f0c9180..106371f4 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/datetimelocal/datetimelocal-appearance-basic-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/datetimelocal/datetimelocal-appearance-basic-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/form-element-geometry-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/form-element-geometry-expected.png
index 903031fc..c28f5e93 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/form-element-geometry-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/form-element-geometry-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/form-element-geometry-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/form-element-geometry-expected.txt
index 3bdc8722..41349ec 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/form-element-geometry-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/form-element-geometry-expected.txt
@@ -4,8 +4,8 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x652.88
     LayoutNGBlockFlow {BODY} at (8,8) size 784x636.88
       LayoutNGBlockFlow {H1} at (0,0) size 784x37
-        LayoutText {#text} at (0,0) size 419x36
-          text run at (0,0) width 419: "Form Element Geometry Tests"
+        LayoutText {#text} at (0,0) size 418x36
+          text run at (0,0) width 418: "Form Element Geometry Tests"
       LayoutNGBlockFlow {P} at (0,58.44) size 784x20
         LayoutText {#text} at (0,0) size 540x19
           text run at (0,0) width 540: "These tests help us tune the widget classes in KWQ to have all the right fudge factors."
@@ -101,8 +101,8 @@
             LayoutNGTableCell {TD} at (403,2) size 185x42 [r=0 c=3 rs=1 cs=1]
               LayoutNGBlockFlow {DIV} at (1,1) size 183x40 [border: (2px solid #0000FF)]
       LayoutNGBlockFlow {H2} at (0,341.16) size 784x27
-        LayoutText {#text} at (0,0) size 198x26
-          text run at (0,0) width 198: "Baseline Alignment"
+        LayoutText {#text} at (0,0) size 199x26
+          text run at (0,0) width 199: "Baseline Alignment"
       LayoutNGBlockFlow {DIV} at (0,388.06) size 784x28
         LayoutInline {FONT} at (0,0) size 205x27
           LayoutText {#text} at (0,0) size 43x27
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/image/image-alt-text-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/image/image-alt-text-expected.png
new file mode 100644
index 0000000..55e4aa7
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/image/image-alt-text-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/image/image-alt-text-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/image/image-alt-text-expected.txt
index 36bc0bd..df680bb 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/image/image-alt-text-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/image/image-alt-text-expected.txt
@@ -4,8 +4,8 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x600
     LayoutNGBlockFlow {BODY} at (8,8) size 784x576
       LayoutNGBlockFlow (anonymous) at (0,0) size 784x40
-        LayoutText {#text} at (0,0) size 746x39
-          text run at (0,0) width 746: "This tests whether alt text is shown for image-type form input elements with no src attribute. You should see \"Success\""
+        LayoutText {#text} at (0,0) size 745x39
+          text run at (0,0) width 745: "This tests whether alt text is shown for image-type form input elements with no src attribute. You should see \"Success\""
           text run at (0,20) width 225: "twice, followed by a blue rectangle."
       LayoutNGBlockFlow {P} at (0,56) size 784x0
       LayoutNGBlockFlow {FORM} at (0,56) size 784x93
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/month/month-appearance-basic-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/month/month-appearance-basic-expected.png
index 0b737f8..4e457a08 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/month/month-appearance-basic-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/month/month-appearance-basic-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/month/month-appearance-pseudo-elements-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/month/month-appearance-pseudo-elements-expected.png
index c0e6610..364b2084 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/month/month-appearance-pseudo-elements-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/month/month-appearance-pseudo-elements-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/plaintext-mode-2-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/plaintext-mode-2-expected.png
new file mode 100644
index 0000000..7ea7d682
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/plaintext-mode-2-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/plaintext-mode-2-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/plaintext-mode-2-expected.txt
index 51e13e79..fa1a7ac1 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/plaintext-mode-2-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/plaintext-mode-2-expected.txt
@@ -21,8 +21,8 @@
         LayoutInline {A} at (0,0) size 24x19 [color=#0000EE]
           LayoutText {#text} at (133,0) size 24x19
             text run at (133,0) width 24: "link"
-        LayoutText {#text} at (157,0) size 403x19
-          text run at (157,0) width 403: " will be pasted into the textfield. All richness should be stripped."
+        LayoutText {#text} at (157,0) size 402x19
+          text run at (157,0) width 402: " will be pasted into the textfield. All richness should be stripped."
       LayoutNGBlockFlow {OL} at (0,58) size 784x40
         LayoutNGListItem {LI} at (40,0) size 744x20
           LayoutNGListMarker (anonymous) at (-16,0) size 16x20
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/select-popup/popup-menu-appearance-zoom-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/select-popup/popup-menu-appearance-zoom-expected.png
new file mode 100644
index 0000000..265da8e
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/select-popup/popup-menu-appearance-zoom-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/select/select-multiple-rtl-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/select/select-multiple-rtl-expected.png
new file mode 100644
index 0000000..36a2e88
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/select/select-multiple-rtl-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/select/select-multiple-rtl-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/select/select-multiple-rtl-expected.txt
new file mode 100644
index 0000000..4fd3f00f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/select/select-multiple-rtl-expected.txt
@@ -0,0 +1,29 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x141
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x141
+    LayoutNGBlockFlow {BODY} at (8,8) size 784x125
+      LayoutNGBlockFlow (anonymous) at (0,0) size 784x20
+        LayoutInline {SPAN} at (0,0) size 630x19
+          LayoutText {#text} at (0,0) size 630x19
+            text run at (0,0) width 630: "Test for crbug.com/335285: On OS Mac, Options of a multiple select are shifted right in RTL mode."
+        LayoutText {#text} at (0,0) size 0x0
+      LayoutNGBlockFlow {DIV} at (0,20) size 784x105
+        LayoutText {#text} at (0,0) size 0x0
+layer at (592,28) size 200x104 clip at (608,29) size 183x102
+  LayoutListBox {SELECT} at (584,0) size 200x104 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+    LayoutBlockFlow {OPTION} at (16,1) size 183x17
+      LayoutText {#text} at (144,0) size 37x16
+        text run at (144,0) width 37: "Test 1"
+    LayoutBlockFlow {OPTION} at (16,18) size 183x17
+      LayoutText {#text} at (144,0) size 37x16
+        text run at (144,0) width 37: "Test 2"
+    LayoutBlockFlow {OPTION} at (16,35) size 183x17
+      LayoutText {#text} at (144,0) size 37x16
+        text run at (144,0) width 37: "Test 3"
+    LayoutBlockFlow {OPTION} at (16,52) size 183x17
+      LayoutText {#text} at (144,0) size 37x16
+        text run at (144,0) width 37: "Test 4"
+    LayoutBlockFlow {OPTION} at (16,69) size 183x17
+      LayoutText {#text} at (144,0) size 37x16
+        text run at (144,0) width 37: "Test 5"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/select/select-writing-direction-natural-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/select/select-writing-direction-natural-expected.png
index 6de0c3f..f3227fa 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/select/select-writing-direction-natural-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/select/select-writing-direction-natural-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/select/select-writing-direction-natural-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/select/select-writing-direction-natural-expected.txt
index 70030b6b9..e1b5fe2 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/select/select-writing-direction-natural-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/select/select-writing-direction-natural-expected.txt
@@ -4,22 +4,22 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 800x600
     LayoutNGBlockFlow {BODY} at (8,8) size 784x584
       LayoutNGBlockFlow {P} at (0,0) size 784x40
-        LayoutText {#text} at (0,0) size 51x19
-          text run at (0,0) width 51: "Test for "
+        LayoutText {#text} at (0,0) size 52x19
+          text run at (0,0) width 52: "Test for "
         LayoutInline {I} at (0,0) size 708x39
-          LayoutInline {A} at (0,0) size 301x19 [color=#0000EE]
-            LayoutText {#text} at (51,0) size 301x19
-              text run at (51,0) width 301: "http://bugs.webkit.org/show_bug.cgi?id=13775"
+          LayoutInline {A} at (0,0) size 300x19 [color=#0000EE]
+            LayoutText {#text} at (52,0) size 300x19
+              text run at (52,0) width 300: "http://bugs.webkit.org/show_bug.cgi?id=13775"
           LayoutText {#text} at (352,0) size 708x39
             text run at (352,0) width 356: " REGRESSION: Popup button text should use \"natural\""
-            text run at (0,20) width 324: "directionality to match the items in the popup menu"
-        LayoutText {#text} at (324,20) size 4x19
-          text run at (324,20) width 4: "."
+            text run at (0,20) width 323: "directionality to match the items in the popup menu"
+        LayoutText {#text} at (323,20) size 4x19
+          text run at (323,20) width 4: "."
       LayoutNGBlockFlow {P} at (0,56) size 784x20
-        LayoutText {#text} at (0,0) size 658x19
+        LayoutText {#text} at (0,0) size 660x19
           text run at (0,0) width 505: "In all of the popup buttons below, the letter A should be on the left and the letter "
-          text run at (505,0) width 8: "\x{5D0}"
-          text run at (513,0) width 145: " should be on the right."
+          text run at (505,0) width 10: "\x{5D0}"
+          text run at (515,0) width 145: " should be on the right."
       LayoutNGBlockFlow {DIV} at (0,92) size 784x40
         LayoutNGBlockFlow {DIV} at (0,0) size 784x20
           LayoutMenuList {SELECT} at (0,0) size 70x20 [bgcolor=#C0C0C0] [border: (1px solid #A9A9A9)]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/textarea/basic-textareas-quirks-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/textarea/basic-textareas-quirks-expected.png
new file mode 100644
index 0000000..198ee61d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/textarea/basic-textareas-quirks-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/textarea/basic-textareas-quirks-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/textarea/basic-textareas-quirks-expected.txt
index 557488af..38ff728 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/textarea/basic-textareas-quirks-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/textarea/basic-textareas-quirks-expected.txt
@@ -8,226 +8,226 @@
           LayoutText {#text} at (0,-1) size 181x16
             text run at (0,-1) width 181: "Plain textarea with little content"
         LayoutNGBlockFlow {DIV} at (1,15) size 352x40 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,24) size 14x16
-            text run at (1,24) width 14: "A "
-          LayoutText {#text} at (194,24) size 13x16
-            text run at (194,24) width 13: " B"
+          LayoutText {#text} at (1,24) size 13x16
+            text run at (1,24) width 13: "A "
+          LayoutText {#text} at (193,24) size 13x16
+            text run at (193,24) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,55) size 350x14
           LayoutText {#text} at (0,-1) size 77x16
             text run at (0,-1) width 77: "Plain textarea"
         LayoutNGBlockFlow {DIV} at (1,69) size 352x40 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,24) size 14x16
-            text run at (1,24) width 14: "A "
-          LayoutText {#text} at (194,24) size 13x16
-            text run at (194,24) width 13: " B"
+          LayoutText {#text} at (1,24) size 13x16
+            text run at (1,24) width 13: "A "
+          LayoutText {#text} at (193,24) size 13x16
+            text run at (193,24) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,109) size 350x14
           LayoutText {#text} at (0,-1) size 97x16
             text run at (0,-1) width 97: "Disabled textarea"
         LayoutNGBlockFlow {DIV} at (1,123) size 352x40 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,24) size 14x16
-            text run at (1,24) width 14: "A "
-          LayoutText {#text} at (194,24) size 13x16
-            text run at (194,24) width 13: " B"
+          LayoutText {#text} at (1,24) size 13x16
+            text run at (1,24) width 13: "A "
+          LayoutText {#text} at (193,24) size 13x16
+            text run at (193,24) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,163) size 350x14
           LayoutText {#text} at (0,-1) size 123x16
             text run at (0,-1) width 123: "style=\"padding:10px\""
         LayoutNGBlockFlow {DIV} at (1,177) size 352x58 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,42) size 14x16
-            text run at (1,42) width 14: "A "
-          LayoutText {#text} at (212,42) size 13x16
-            text run at (212,42) width 13: " B"
+          LayoutText {#text} at (1,42) size 13x16
+            text run at (1,42) width 13: "A "
+          LayoutText {#text} at (211,42) size 13x16
+            text run at (211,42) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,235) size 350x14
           LayoutText {#text} at (0,-1) size 116x16
             text run at (0,-1) width 116: "style=\"padding:0px\""
         LayoutNGBlockFlow {DIV} at (1,249) size 352x38 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,22) size 14x16
-            text run at (1,22) width 14: "A "
-          LayoutText {#text} at (192,22) size 13x16
-            text run at (192,22) width 13: " B"
+          LayoutText {#text} at (1,22) size 13x16
+            text run at (1,22) width 13: "A "
+          LayoutText {#text} at (191,22) size 13x16
+            text run at (191,22) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,287) size 350x14
           LayoutText {#text} at (0,-1) size 118x16
             text run at (0,-1) width 118: "style=\"margin:10px\""
         LayoutNGBlockFlow {DIV} at (1,301) size 352x60 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,44) size 14x16
-            text run at (1,44) width 14: "A "
-          LayoutText {#text} at (214,44) size 13x16
-            text run at (214,44) width 13: " B"
+          LayoutText {#text} at (1,44) size 13x16
+            text run at (1,44) width 13: "A "
+          LayoutText {#text} at (213,44) size 13x16
+            text run at (213,44) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,361) size 350x14
           LayoutText {#text} at (0,-1) size 111x16
             text run at (0,-1) width 111: "style=\"margin:0px\""
         LayoutNGBlockFlow {DIV} at (1,375) size 352x40 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,24) size 14x16
-            text run at (1,24) width 14: "A "
-          LayoutText {#text} at (194,24) size 13x16
-            text run at (194,24) width 13: " B"
+          LayoutText {#text} at (1,24) size 13x16
+            text run at (1,24) width 13: "A "
+          LayoutText {#text} at (193,24) size 13x16
+            text run at (193,24) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,415) size 350x14
           LayoutText {#text} at (0,-1) size 37x16
             text run at (0,-1) width 37: "cols=3"
         LayoutNGBlockFlow {DIV} at (1,429) size 352x40 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,24) size 14x16
-            text run at (1,24) width 14: "A "
-          LayoutText {#text} at (58,24) size 13x16
-            text run at (58,24) width 13: " B"
+          LayoutText {#text} at (1,24) size 13x16
+            text run at (1,24) width 13: "A "
+          LayoutText {#text} at (57,24) size 13x16
+            text run at (57,24) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,469) size 350x14
           LayoutText {#text} at (0,-1) size 42x16
             text run at (0,-1) width 42: "rows=3"
         LayoutNGBlockFlow {DIV} at (1,483) size 352x56 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,40) size 14x16
-            text run at (1,40) width 14: "A "
-          LayoutText {#text} at (194,40) size 13x16
-            text run at (194,40) width 13: " B"
+          LayoutText {#text} at (1,40) size 13x16
+            text run at (1,40) width 13: "A "
+          LayoutText {#text} at (193,40) size 13x16
+            text run at (193,40) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,539) size 350x14
           LayoutText {#text} at (0,-1) size 44x16
             text run at (0,-1) width 44: "cols=10"
         LayoutNGBlockFlow {DIV} at (1,553) size 352x40 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,24) size 14x16
-            text run at (1,24) width 14: "A "
-          LayoutText {#text} at (114,24) size 13x16
-            text run at (114,24) width 13: " B"
+          LayoutText {#text} at (1,24) size 13x16
+            text run at (1,24) width 13: "A "
+          LayoutText {#text} at (113,24) size 13x16
+            text run at (113,24) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,593) size 350x14
           LayoutText {#text} at (0,-1) size 49x16
             text run at (0,-1) width 49: "rows=10"
         LayoutNGBlockFlow {DIV} at (1,607) size 352x168 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,152) size 14x16
-            text run at (1,152) width 14: "A "
-          LayoutText {#text} at (194,152) size 13x16
-            text run at (194,152) width 13: " B"
+          LayoutText {#text} at (1,152) size 13x16
+            text run at (1,152) width 13: "A "
+          LayoutText {#text} at (193,152) size 13x16
+            text run at (193,152) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,775) size 350x14
           LayoutText {#text} at (0,-1) size 83x16
             text run at (0,-1) width 83: "cols=5 rows=4"
         LayoutNGBlockFlow {DIV} at (1,789) size 352x72 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,56) size 14x16
-            text run at (1,56) width 14: "A "
-          LayoutText {#text} at (74,56) size 13x16
-            text run at (74,56) width 13: " B"
+          LayoutText {#text} at (1,56) size 13x16
+            text run at (1,56) width 13: "A "
+          LayoutText {#text} at (73,56) size 13x16
+            text run at (73,56) width 13: " B"
       LayoutNGBlockFlow (floating) {DIV} at (352,0) size 352x1046 [border: (1px solid #FF0000)]
         LayoutNGBlockFlow (anonymous) at (1,1) size 350x14
           LayoutText {#text} at (0,-1) size 110x16
             text run at (0,-1) width 110: "style=\"width:60px\""
         LayoutNGBlockFlow {DIV} at (1,15) size 352x40 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,24) size 14x16
-            text run at (1,24) width 14: "A "
-          LayoutText {#text} at (75,24) size 13x16
-            text run at (75,24) width 13: " B"
+          LayoutText {#text} at (1,24) size 13x16
+            text run at (1,24) width 13: "A "
+          LayoutText {#text} at (74,24) size 13x16
+            text run at (74,24) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,55) size 350x14
           LayoutText {#text} at (0,-1) size 191x16
             text run at (0,-1) width 191: "style=\"width:60px;padding:20px\""
         LayoutNGBlockFlow {DIV} at (1,69) size 352x78 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,62) size 14x16
-            text run at (1,62) width 14: "A "
-          LayoutText {#text} at (75,62) size 13x16
-            text run at (75,62) width 13: " B"
+          LayoutText {#text} at (1,62) size 13x16
+            text run at (1,62) width 13: "A "
+          LayoutText {#text} at (74,62) size 13x16
+            text run at (74,62) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,147) size 350x14
           LayoutText {#text} at (0,-1) size 170x16
             text run at (0,-1) width 170: "style=\"width:60px;padding:0\""
         LayoutNGBlockFlow {DIV} at (1,161) size 352x38 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,22) size 14x16
-            text run at (1,22) width 14: "A "
-          LayoutText {#text} at (75,22) size 13x16
-            text run at (75,22) width 13: " B"
+          LayoutText {#text} at (1,22) size 13x16
+            text run at (1,22) width 13: "A "
+          LayoutText {#text} at (74,22) size 13x16
+            text run at (74,22) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,199) size 350x14
           LayoutText {#text} at (0,-1) size 113x16
             text run at (0,-1) width 113: "style=\"height:60px\""
         LayoutNGBlockFlow {DIV} at (1,213) size 352x64 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,48) size 14x16
-            text run at (1,48) width 14: "A "
-          LayoutText {#text} at (194,48) size 13x16
-            text run at (194,48) width 13: " B"
+          LayoutText {#text} at (1,48) size 13x16
+            text run at (1,48) width 13: "A "
+          LayoutText {#text} at (193,48) size 13x16
+            text run at (193,48) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,277) size 350x14
           LayoutText {#text} at (0,-1) size 181x16
             text run at (0,-1) width 181: "style=\"width:60px;height:60px\""
         LayoutNGBlockFlow {DIV} at (1,291) size 352x64 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,48) size 14x16
-            text run at (1,48) width 14: "A "
-          LayoutText {#text} at (75,48) size 13x16
-            text run at (75,48) width 13: " B"
+          LayoutText {#text} at (1,48) size 13x16
+            text run at (1,48) width 13: "A "
+          LayoutText {#text} at (74,48) size 13x16
+            text run at (74,48) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,355) size 350x14
           LayoutText {#text} at (0,-1) size 139x16
             text run at (0,-1) width 139: "style=\"overflow:hidden\""
         LayoutNGBlockFlow {DIV} at (1,369) size 352x40 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,24) size 14x16
-            text run at (1,24) width 14: "A "
-          LayoutText {#text} at (194,24) size 13x16
-            text run at (194,24) width 13: " B"
+          LayoutText {#text} at (1,24) size 13x16
+            text run at (1,24) width 13: "A "
+          LayoutText {#text} at (193,24) size 13x16
+            text run at (193,24) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,409) size 350x14
           LayoutText {#text} at (0,-1) size 132x16
             text run at (0,-1) width 132: "style=\"overflow:scroll\""
         LayoutNGBlockFlow {DIV} at (1,423) size 352x55 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,39) size 14x16
-            text run at (1,39) width 14: "A "
-          LayoutText {#text} at (194,39) size 13x16
-            text run at (194,39) width 13: " B"
+          LayoutText {#text} at (1,39) size 13x16
+            text run at (1,39) width 13: "A "
+          LayoutText {#text} at (193,39) size 13x16
+            text run at (193,39) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,478) size 350x14
           LayoutText {#text} at (0,-1) size 278x16
             text run at (0,-1) width 278: "style=\"overflow:hidden;width:60px;height:60px\""
         LayoutNGBlockFlow {DIV} at (1,492) size 352x64 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,48) size 14x16
-            text run at (1,48) width 14: "A "
-          LayoutText {#text} at (75,48) size 13x16
-            text run at (75,48) width 13: " B"
+          LayoutText {#text} at (1,48) size 13x16
+            text run at (1,48) width 13: "A "
+          LayoutText {#text} at (74,48) size 13x16
+            text run at (74,48) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,556) size 350x14
           LayoutText {#text} at (0,-1) size 271x16
             text run at (0,-1) width 271: "style=\"overflow:scroll;width:60px;height:60px\""
         LayoutNGBlockFlow {DIV} at (1,570) size 352x64 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,48) size 14x16
-            text run at (1,48) width 14: "A "
-          LayoutText {#text} at (75,48) size 13x16
-            text run at (75,48) width 13: " B"
+          LayoutText {#text} at (1,48) size 13x16
+            text run at (1,48) width 13: "A "
+          LayoutText {#text} at (74,48) size 13x16
+            text run at (74,48) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,634) size 350x14
           LayoutText {#text} at (0,-1) size 222x16
             text run at (0,-1) width 222: "cols=5 style=\"width:60px;height:60px\""
         LayoutNGBlockFlow {DIV} at (1,648) size 352x64 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,48) size 14x16
-            text run at (1,48) width 14: "A "
-          LayoutText {#text} at (75,48) size 13x16
-            text run at (75,48) width 13: " B"
+          LayoutText {#text} at (1,48) size 13x16
+            text run at (1,48) width 13: "A "
+          LayoutText {#text} at (74,48) size 13x16
+            text run at (74,48) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,712) size 350x14
           LayoutText {#text} at (0,-1) size 227x16
             text run at (0,-1) width 227: "rows=4 style=\"width:60px;height:60px\""
         LayoutNGBlockFlow {DIV} at (1,726) size 352x64 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,48) size 14x16
-            text run at (1,48) width 14: "A "
-          LayoutText {#text} at (75,48) size 13x16
-            text run at (75,48) width 13: " B"
+          LayoutText {#text} at (1,48) size 13x16
+            text run at (1,48) width 13: "A "
+          LayoutText {#text} at (74,48) size 13x16
+            text run at (74,48) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,790) size 350x14
           LayoutText {#text} at (0,-1) size 268x16
             text run at (0,-1) width 268: "cols=5 rows=4 style=\"width:60px;height:60px\""
         LayoutNGBlockFlow {DIV} at (1,804) size 352x64 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,48) size 14x16
-            text run at (1,48) width 14: "A "
-          LayoutText {#text} at (75,48) size 13x16
-            text run at (75,48) width 13: " B"
+          LayoutText {#text} at (1,48) size 13x16
+            text run at (1,48) width 13: "A "
+          LayoutText {#text} at (74,48) size 13x16
+            text run at (74,48) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,868) size 350x14
           LayoutText {#text} at (0,-1) size 65x16
             text run at (0,-1) width 65: "wrap=\"off\""
         LayoutNGBlockFlow {DIV} at (1,882) size 352x55 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,39) size 14x16
-            text run at (1,39) width 14: "A "
-          LayoutText {#text} at (194,39) size 13x16
-            text run at (194,39) width 13: " B"
+          LayoutText {#text} at (1,39) size 13x16
+            text run at (1,39) width 13: "A "
+          LayoutText {#text} at (193,39) size 13x16
+            text run at (193,39) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,937) size 350x14
           LayoutText {#text} at (0,-1) size 73x16
             text run at (0,-1) width 73: "wrap=\"hard\""
         LayoutNGBlockFlow {DIV} at (1,951) size 352x40 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,24) size 14x16
-            text run at (1,24) width 14: "A "
-          LayoutText {#text} at (194,24) size 13x16
-            text run at (194,24) width 13: " B"
+          LayoutText {#text} at (1,24) size 13x16
+            text run at (1,24) width 13: "A "
+          LayoutText {#text} at (193,24) size 13x16
+            text run at (193,24) width 13: " B"
         LayoutNGBlockFlow (anonymous) at (1,991) size 350x14
           LayoutText {#text} at (0,-1) size 69x16
             text run at (0,-1) width 69: "wrap=\"soft\""
         LayoutNGBlockFlow {DIV} at (1,1005) size 352x40 [border: (1px solid #FF0000)]
-          LayoutText {#text} at (1,24) size 14x16
-            text run at (1,24) width 14: "A "
-          LayoutText {#text} at (194,24) size 13x16
-            text run at (194,24) width 13: " B"
-layer at (24,24) size 179x36 clip at (25,25) size 177x34
-  LayoutTextControl {TEXTAREA} at (15,1) size 179x36 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+          LayoutText {#text} at (1,24) size 13x16
+            text run at (1,24) width 13: "A "
+          LayoutText {#text} at (193,24) size 13x16
+            text run at (193,24) width 13: " B"
+layer at (23,24) size 179x36 clip at (24,25) size 177x34
+  LayoutTextControl {TEXTAREA} at (14,1) size 179x36 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (3,3) size 175x16
       LayoutText {#text} at (0,0) size 136x16
         text run at (0,0) width 136: "Lorem ipsum dolor"
-layer at (24,78) size 179x36 clip at (25,79) size 162x34 scrollHeight 82
-  LayoutTextControl {TEXTAREA} at (15,1) size 179x36 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (23,78) size 179x36 clip at (24,79) size 162x34 scrollHeight 82
+  LayoutTextControl {TEXTAREA} at (14,1) size 179x36 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (3,3) size 160x80
       LayoutText {#text} at (0,0) size 160x80
         text run at (0,0) width 136: "Lorem ipsum dolor"
@@ -238,8 +238,8 @@
         text run at (0,48) width 160: "abcdefghijklmnopqrst"
         text run at (0,64) width 16: "uv"
         text run at (16,64) width 8: " "
-layer at (24,132) size 179x36 clip at (25,133) size 162x34 scrollHeight 82
-  LayoutTextControl {TEXTAREA} at (15,1) size 179x36 [color=#545454] [bgcolor=#EBEBE4] [border: (1px solid #A9A9A9)]
+layer at (23,132) size 179x36 clip at (24,133) size 162x34 scrollHeight 82
+  LayoutTextControl {TEXTAREA} at (14,1) size 179x36 [color=#545454] [bgcolor=#EBEBE4] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (3,3) size 160x80
       LayoutText {#text} at (0,0) size 160x80
         text run at (0,0) width 136: "Lorem ipsum dolor"
@@ -250,8 +250,8 @@
         text run at (0,48) width 160: "abcdefghijklmnopqrst"
         text run at (0,64) width 16: "uv"
         text run at (16,64) width 8: " "
-layer at (24,186) size 197x54 clip at (25,187) size 180x52 scrollHeight 100
-  LayoutTextControl {TEXTAREA} at (15,1) size 197x54 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (23,186) size 197x54 clip at (24,187) size 180x52 scrollHeight 100
+  LayoutTextControl {TEXTAREA} at (14,1) size 197x54 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (11,11) size 160x80
       LayoutText {#text} at (0,0) size 160x80
         text run at (0,0) width 136: "Lorem ipsum dolor"
@@ -262,8 +262,8 @@
         text run at (0,48) width 160: "abcdefghijklmnopqrst"
         text run at (0,64) width 16: "uv"
         text run at (16,64) width 8: " "
-layer at (24,258) size 177x34 clip at (25,259) size 160x32 scrollHeight 80
-  LayoutTextControl {TEXTAREA} at (15,1) size 177x34 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (23,258) size 177x34 clip at (24,259) size 160x32 scrollHeight 80
+  LayoutTextControl {TEXTAREA} at (14,1) size 177x34 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (1,1) size 160x80
       LayoutText {#text} at (0,0) size 160x80
         text run at (0,0) width 136: "Lorem ipsum dolor"
@@ -274,8 +274,8 @@
         text run at (0,48) width 160: "abcdefghijklmnopqrst"
         text run at (0,64) width 16: "uv"
         text run at (16,64) width 8: " "
-layer at (34,320) size 179x36 clip at (35,321) size 162x34 scrollHeight 82
-  LayoutTextControl {TEXTAREA} at (25,11) size 179x36 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (33,320) size 179x36 clip at (34,321) size 162x34 scrollHeight 82
+  LayoutTextControl {TEXTAREA} at (24,11) size 179x36 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (3,3) size 160x80
       LayoutText {#text} at (0,0) size 160x80
         text run at (0,0) width 136: "Lorem ipsum dolor"
@@ -286,8 +286,8 @@
         text run at (0,48) width 160: "abcdefghijklmnopqrst"
         text run at (0,64) width 16: "uv"
         text run at (16,64) width 8: " "
-layer at (24,384) size 179x36 clip at (25,385) size 162x34 scrollHeight 82
-  LayoutTextControl {TEXTAREA} at (15,1) size 179x36 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (23,384) size 179x36 clip at (24,385) size 162x34 scrollHeight 82
+  LayoutTextControl {TEXTAREA} at (14,1) size 179x36 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (3,3) size 160x80
       LayoutText {#text} at (0,0) size 160x80
         text run at (0,0) width 136: "Lorem ipsum dolor"
@@ -298,8 +298,8 @@
         text run at (0,48) width 160: "abcdefghijklmnopqrst"
         text run at (0,64) width 16: "uv"
         text run at (16,64) width 8: " "
-layer at (24,438) size 43x36 clip at (25,439) size 26x34 scrollHeight 370
-  LayoutTextControl {TEXTAREA} at (15,1) size 43x36 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (23,438) size 43x36 clip at (24,439) size 26x34 scrollHeight 370
+  LayoutTextControl {TEXTAREA} at (14,1) size 43x36 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (3,3) size 24x368
       LayoutText {#text} at (0,0) size 24x368
         text run at (0,0) width 24: "Lor"
@@ -330,8 +330,8 @@
         text run at (0,336) width 24: "stu"
         text run at (0,352) width 8: "v"
         text run at (8,352) width 8: " "
-layer at (24,492) size 179x52 clip at (25,493) size 162x50 scrollHeight 82
-  LayoutTextControl {TEXTAREA} at (15,1) size 179x52 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (23,492) size 179x52 clip at (24,493) size 162x50 scrollHeight 82
+  LayoutTextControl {TEXTAREA} at (14,1) size 179x52 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (3,3) size 160x80
       LayoutText {#text} at (0,0) size 160x80
         text run at (0,0) width 136: "Lorem ipsum dolor"
@@ -342,8 +342,8 @@
         text run at (0,48) width 160: "abcdefghijklmnopqrst"
         text run at (0,64) width 16: "uv"
         text run at (16,64) width 8: " "
-layer at (24,562) size 99x36 clip at (25,563) size 82x34 scrollHeight 146
-  LayoutTextControl {TEXTAREA} at (15,1) size 99x36 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (23,562) size 99x36 clip at (24,563) size 82x34 scrollHeight 146
+  LayoutTextControl {TEXTAREA} at (14,1) size 99x36 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (3,3) size 80x144
       LayoutText {#text} at (0,0) size 80x144
         text run at (0,0) width 40: "Lorem"
@@ -360,8 +360,8 @@
         text run at (0,112) width 80: "klmnopqrst"
         text run at (0,128) width 16: "uv"
         text run at (16,128) width 8: " "
-layer at (24,616) size 179x164 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0
-  LayoutTextControl {TEXTAREA} at (15,1) size 179x164 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (23,616) size 179x164 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0
+  LayoutTextControl {TEXTAREA} at (14,1) size 179x164 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (3,3) size 175x80
       LayoutText {#text} at (0,0) size 168x80
         text run at (0,0) width 136: "Lorem ipsum dolor"
@@ -372,8 +372,8 @@
         text run at (0,48) width 168: "abcdefghijklmnopqrstu"
         text run at (0,64) width 8: "v"
         text run at (8,64) width 8: " "
-layer at (24,798) size 59x68 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0 scrollHeight 226
-  LayoutTextControl {TEXTAREA} at (15,1) size 59x68 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (23,798) size 59x68 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0 scrollHeight 226
+  LayoutTextControl {TEXTAREA} at (14,1) size 59x68 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (3,3) size 40x224
       LayoutText {#text} at (0,0) size 40x224
         text run at (0,0) width 40: "Lorem"
@@ -395,8 +395,8 @@
         text run at (0,192) width 40: "pqrst"
         text run at (0,208) width 16: "uv"
         text run at (16,208) width 8: " "
-layer at (376,24) size 60x36 clip at (377,25) size 43x34 scrollHeight 226
-  LayoutTextControl {TEXTAREA} at (15,1) size 60x36 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (375,24) size 60x36 clip at (376,25) size 43x34 scrollHeight 226
+  LayoutTextControl {TEXTAREA} at (14,1) size 60x36 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (3,3) size 41x224
       LayoutText {#text} at (0,0) size 41x224
         text run at (0,0) width 40: "Lorem"
@@ -418,8 +418,8 @@
         text run at (0,192) width 40: "pqrst"
         text run at (0,208) width 16: "uv"
         text run at (16,208) width 8: " "
-layer at (376,78) size 60x74 clip at (377,79) size 43x72 scrollHeight 1128
-  LayoutTextControl {TEXTAREA} at (15,1) size 60x74 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (375,78) size 60x74 clip at (376,79) size 43x72 scrollHeight 1128
+  LayoutTextControl {TEXTAREA} at (14,1) size 60x74 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (21,21) size 3x1088
       LayoutText {#text} at (0,0) size 8x1088
         text run at (0,0) width 8: "L"
@@ -490,8 +490,8 @@
         text run at (0,1040) width 8: "u"
         text run at (0,1056) width 8: "v"
         text run at (0,1072) width 3: " "
-layer at (376,170) size 60x34 clip at (377,171) size 43x32 scrollHeight 224
-  LayoutTextControl {TEXTAREA} at (15,1) size 60x34 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (375,170) size 60x34 clip at (376,171) size 43x32 scrollHeight 224
+  LayoutTextControl {TEXTAREA} at (14,1) size 60x34 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (1,1) size 43x224
       LayoutText {#text} at (0,0) size 43x224
         text run at (0,0) width 40: "Lorem"
@@ -513,8 +513,8 @@
         text run at (0,192) width 40: "pqrst"
         text run at (0,208) width 16: "uv"
         text run at (16,208) width 8: " "
-layer at (376,222) size 179x60 clip at (377,223) size 162x58 scrollHeight 82
-  LayoutTextControl {TEXTAREA} at (15,1) size 179x60 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (375,222) size 179x60 clip at (376,223) size 162x58 scrollHeight 82
+  LayoutTextControl {TEXTAREA} at (14,1) size 179x60 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (3,3) size 160x80
       LayoutText {#text} at (0,0) size 160x80
         text run at (0,0) width 136: "Lorem ipsum dolor"
@@ -525,8 +525,8 @@
         text run at (0,48) width 160: "abcdefghijklmnopqrst"
         text run at (0,64) width 16: "uv"
         text run at (16,64) width 8: " "
-layer at (376,300) size 60x60 clip at (377,301) size 43x58 scrollHeight 226
-  LayoutTextControl {TEXTAREA} at (15,1) size 60x60 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (375,300) size 60x60 clip at (376,301) size 43x58 scrollHeight 226
+  LayoutTextControl {TEXTAREA} at (14,1) size 60x60 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (3,3) size 41x224
       LayoutText {#text} at (0,0) size 41x224
         text run at (0,0) width 40: "Lorem"
@@ -548,8 +548,8 @@
         text run at (0,192) width 40: "pqrst"
         text run at (0,208) width 16: "uv"
         text run at (16,208) width 8: " "
-layer at (376,378) size 179x36 clip at (377,379) size 177x34 scrollHeight 82
-  LayoutTextControl {TEXTAREA} at (15,1) size 179x36 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (375,378) size 179x36 clip at (376,379) size 177x34 scrollHeight 82
+  LayoutTextControl {TEXTAREA} at (14,1) size 179x36 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (3,3) size 175x80
       LayoutText {#text} at (0,0) size 168x80
         text run at (0,0) width 136: "Lorem ipsum dolor"
@@ -560,8 +560,8 @@
         text run at (0,48) width 168: "abcdefghijklmnopqrstu"
         text run at (0,64) width 8: "v"
         text run at (8,64) width 8: " "
-layer at (376,432) size 179x51 clip at (377,433) size 162x34 scrollHeight 82
-  LayoutTextControl {TEXTAREA} at (15,1) size 179x51 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (375,432) size 179x51 clip at (376,433) size 162x34 scrollHeight 82
+  LayoutTextControl {TEXTAREA} at (14,1) size 179x51 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (3,3) size 160x80
       LayoutText {#text} at (0,0) size 160x80
         text run at (0,0) width 136: "Lorem ipsum dolor"
@@ -572,8 +572,8 @@
         text run at (0,48) width 160: "abcdefghijklmnopqrst"
         text run at (0,64) width 16: "uv"
         text run at (16,64) width 8: " "
-layer at (376,501) size 60x60 clip at (377,502) size 58x58 scrollHeight 178
-  LayoutTextControl {TEXTAREA} at (15,1) size 60x60 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (375,501) size 60x60 clip at (376,502) size 58x58 scrollHeight 178
+  LayoutTextControl {TEXTAREA} at (14,1) size 60x60 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (3,3) size 56x176
       LayoutText {#text} at (0,0) size 56x176
         text run at (0,0) width 40: "Lorem"
@@ -592,8 +592,8 @@
         text run at (0,144) width 56: "opqrstu"
         text run at (0,160) width 8: "v"
         text run at (8,160) width 8: " "
-layer at (376,579) size 60x60 backgroundClip at (376,579) size 60x21 clip at (377,580) size 43x20 scrollHeight 226
-  LayoutTextControl {TEXTAREA} at (15,1) size 60x60 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (375,579) size 60x60 backgroundClip at (375,579) size 60x21 clip at (376,580) size 43x20 scrollHeight 226
+  LayoutTextControl {TEXTAREA} at (14,1) size 60x60 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (3,3) size 41x224
       LayoutText {#text} at (0,0) size 41x224
         text run at (0,0) width 40: "Lorem"
@@ -615,8 +615,8 @@
         text run at (0,192) width 40: "pqrst"
         text run at (0,208) width 16: "uv"
         text run at (16,208) width 8: " "
-layer at (376,657) size 60x60 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0 scrollHeight 226
-  LayoutTextControl {TEXTAREA} at (15,1) size 60x60 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (375,657) size 60x60 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0 scrollHeight 226
+  LayoutTextControl {TEXTAREA} at (14,1) size 60x60 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (3,3) size 41x224
       LayoutText {#text} at (0,0) size 41x224
         text run at (0,0) width 40: "Lorem"
@@ -638,8 +638,8 @@
         text run at (0,192) width 40: "pqrst"
         text run at (0,208) width 16: "uv"
         text run at (16,208) width 8: " "
-layer at (376,735) size 60x60 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0 scrollHeight 226
-  LayoutTextControl {TEXTAREA} at (15,1) size 60x60 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (375,735) size 60x60 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0 scrollHeight 226
+  LayoutTextControl {TEXTAREA} at (14,1) size 60x60 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (3,3) size 41x224
       LayoutText {#text} at (0,0) size 41x224
         text run at (0,0) width 40: "Lorem"
@@ -661,8 +661,8 @@
         text run at (0,192) width 40: "pqrst"
         text run at (0,208) width 16: "uv"
         text run at (16,208) width 8: " "
-layer at (376,813) size 60x60 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0 scrollHeight 226
-  LayoutTextControl {TEXTAREA} at (15,1) size 60x60 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (375,813) size 60x60 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0 scrollHeight 226
+  LayoutTextControl {TEXTAREA} at (14,1) size 60x60 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (3,3) size 41x224
       LayoutText {#text} at (0,0) size 41x224
         text run at (0,0) width 40: "Lorem"
@@ -684,8 +684,8 @@
         text run at (0,192) width 40: "pqrst"
         text run at (0,208) width 16: "uv"
         text run at (16,208) width 8: " "
-layer at (376,891) size 179x51 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0 scrollWidth 290 scrollHeight 258
-  LayoutTextControl {TEXTAREA} at (15,1) size 179x51 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (375,891) size 179x51 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0 scrollWidth 290 scrollHeight 258
+  LayoutTextControl {TEXTAREA} at (14,1) size 179x51 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (3,3) size 160x256
       LayoutText {#text} at (0,0) size 288x240
         text run at (0,0) width 8: " "
@@ -719,8 +719,8 @@
         text run at (0,224) width 288: "This is a text area with wrap=\"soft\""
         text run at (288,224) width 0: " "
       LayoutBR {BR} at (0,240) size 0x16
-layer at (376,960) size 179x36 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0 scrollHeight 482
-  LayoutTextControl {TEXTAREA} at (15,1) size 179x36 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (375,960) size 179x36 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0 scrollHeight 482
+  LayoutTextControl {TEXTAREA} at (14,1) size 179x36 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (3,3) size 160x480
       LayoutText {#text} at (0,0) size 160x464
         text run at (0,0) width 8: " "
@@ -782,8 +782,8 @@
         text run at (0,448) width 128: "with wrap=\"soft\""
         text run at (128,448) width 0: " "
       LayoutBR {BR} at (0,464) size 0x16
-layer at (376,1014) size 179x36 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0 scrollHeight 482
-  LayoutTextControl {TEXTAREA} at (15,1) size 179x36 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
+layer at (375,1014) size 179x36 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0 scrollHeight 482
+  LayoutTextControl {TEXTAREA} at (14,1) size 179x36 [bgcolor=#FFFFFF] [border: (1px solid #A9A9A9)]
     LayoutBlockFlow {DIV} at (3,3) size 160x480
       LayoutText {#text} at (0,0) size 160x464
         text run at (0,0) width 8: " "
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/time/time-appearance-basic-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/time/time-appearance-basic-expected.png
index c5dfbaa..48d7d8e 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/time/time-appearance-basic-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/time/time-appearance-basic-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/time/time-appearance-pseudo-elements-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/time/time-appearance-pseudo-elements-expected.png
index 2baa0db..b86916e 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/time/time-appearance-pseudo-elements-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/time/time-appearance-pseudo-elements-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/validation-bubble-appearance-rtl-ui-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/validation-bubble-appearance-rtl-ui-expected.png
new file mode 100644
index 0000000..d3dd9cfc
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/validation-bubble-appearance-rtl-ui-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/week/week-appearance-basic-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/week/week-appearance-basic-expected.png
index 3603cb0..fd4c3578 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/week/week-appearance-basic-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/week/week-appearance-basic-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/week/week-appearance-pseudo-elements-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/week/week-appearance-pseudo-elements-expected.png
index 323f2d92..ec8ebe4 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/week/week-appearance-pseudo-elements-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/forms/week/week-appearance-pseudo-elements-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/gradients/generated-gradients-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/gradients/generated-gradients-expected.png
new file mode 100644
index 0000000..79e9b32
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/gradients/generated-gradients-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/gradients/generated-gradients-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/gradients/generated-gradients-expected.txt
new file mode 100644
index 0000000..4a7431b
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/gradients/generated-gradients-expected.txt
@@ -0,0 +1,23 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x600
+    LayoutNGBlockFlow {BODY} at (8,8) size 784x584
+      LayoutNGBlockFlow {H1} at (0,0) size 784x37
+        LayoutText {#text} at (0,0) size 353x36
+          text run at (0,0) width 353: "Radial Gradient Example"
+      LayoutNGBlockFlow {DIV} at (0,58.44) size 784x174
+        LayoutNGBlockFlow {<pseudo:before>} at (0,0) size 154x154 [border: (2px solid #000000)]
+          LayoutImage (anonymous) at (2,2) size 150x150
+        LayoutNGBlockFlow (anonymous) at (0,154) size 784x20
+          LayoutText {#text} at (0,0) size 267x19
+            text run at (0,0) width 267: "There's some generated content above me."
+      LayoutNGBlockFlow {H1} at (0,253.88) size 784x37
+        LayoutText {#text} at (0,0) size 353x36
+          text run at (0,0) width 353: "Linear Gradient Example"
+      LayoutNGBlockFlow {DIV} at (0,312.31) size 784x154
+        LayoutNGBlockFlow (anonymous) at (0,0) size 784x20
+          LayoutText {#text} at (0,0) size 268x19
+            text run at (0,0) width 268: "There's some generated content below me."
+        LayoutNGBlockFlow {<pseudo:after>} at (0,20) size 134x134 [border: (2px solid #000000)]
+          LayoutImage (anonymous) at (2,2) size 130x130
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/gradients/radial-centered-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/gradients/radial-centered-expected.png
index 7a527a98..dc88e602 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/gradients/radial-centered-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/gradients/radial-centered-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/gradients/radial-centered-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/gradients/radial-centered-expected.txt
index 86876db..001e098 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/gradients/radial-centered-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/gradients/radial-centered-expected.txt
@@ -7,8 +7,8 @@
         LayoutText {#text} at (0,0) size 633x19
           text run at (0,0) width 633: "The test passes if all four boxes have a radial gradient that's green in the center and black at the edge."
       LayoutNGBlockFlow {H1} at (0,41.44) size 784x37
-        LayoutText {#text} at (0,0) size 724x36
-          text run at (0,0) width 724: "Radial Gradients With One Center, Inner Radius > 0"
+        LayoutText {#text} at (0,0) size 721x36
+          text run at (0,0) width 721: "Radial Gradients With One Center, Inner Radius > 0"
       LayoutNGBlockFlow (anonymous) at (0,99.88) size 784x155
         LayoutNGBlockFlow {DIV} at (0,0) size 150x150
         LayoutText {#text} at (150,135) size 4x19
@@ -16,8 +16,8 @@
         LayoutNGBlockFlow {DIV} at (154,0) size 150x150
         LayoutText {#text} at (0,0) size 0x0
       LayoutNGBlockFlow {H1} at (0,276.31) size 784x37
-        LayoutText {#text} at (0,0) size 642x36
-          text run at (0,0) width 642: "Radial Gradients With One, Inner Radius == 0"
+        LayoutText {#text} at (0,0) size 640x36
+          text run at (0,0) width 640: "Radial Gradients With One, Inner Radius == 0"
       LayoutNGBlockFlow (anonymous) at (0,334.75) size 784x155
         LayoutNGBlockFlow {DIV} at (0,0) size 150x150
         LayoutText {#text} at (150,135) size 4x19
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/gradients/simple-gradients-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/gradients/simple-gradients-expected.png
new file mode 100644
index 0000000..8fc52ec
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/gradients/simple-gradients-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/gradients/simple-gradients-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/gradients/simple-gradients-expected.txt
new file mode 100644
index 0000000..a4c4f447
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/gradients/simple-gradients-expected.txt
@@ -0,0 +1,13 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x600
+    LayoutNGBlockFlow {BODY} at (8,8) size 784x584
+      LayoutNGBlockFlow {H1} at (0,0) size 784x37
+        LayoutText {#text} at (0,0) size 353x36
+          text run at (0,0) width 353: "Radial Gradient Example"
+      LayoutNGBlockFlow {DIV} at (0,58.44) size 154x154 [border: (2px solid #000000)]
+      LayoutNGBlockFlow {H1} at (0,233.88) size 784x37
+        LayoutText {#text} at (0,0) size 353x36
+          text run at (0,0) width 353: "Linear Gradient Example"
+      LayoutNGBlockFlow {DIV} at (0,292.31) size 154x154 [border: (2px solid #000000)]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/inline/absolute-positioned-inline-in-centred-block-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/inline/absolute-positioned-inline-in-centred-block-expected.png
index 0c5fc7e..2f6a7b6e 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/inline/absolute-positioned-inline-in-centred-block-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/inline/absolute-positioned-inline-in-centred-block-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/inline/emptyInlinesWithinLists-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/inline/emptyInlinesWithinLists-expected.png
index 1632d966..e76e5f7 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/inline/emptyInlinesWithinLists-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/inline/emptyInlinesWithinLists-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/inline/inline-borders-with-bidi-override-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/inline/inline-borders-with-bidi-override-expected.png
new file mode 100644
index 0000000..57d9fee
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/inline/inline-borders-with-bidi-override-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/inline/nested-top-alignment-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/inline/nested-top-alignment-expected.png
index 03c1482b..a88af4f 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/inline/nested-top-alignment-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/inline/nested-top-alignment-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/invalid/010-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/invalid/010-expected.png
new file mode 100644
index 0000000..ae21cdd3
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/invalid/010-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/invalid/010-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/invalid/010-expected.txt
new file mode 100644
index 0000000..27affad
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/invalid/010-expected.txt
@@ -0,0 +1,44 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x600
+    LayoutNGBlockFlow {BODY} at (8,8) size 784x584
+      LayoutNGBlockFlow (anonymous) at (0,0) size 784x20
+        LayoutText {#text} at (0,0) size 334x19
+          text run at (0,0) width 334: "The style rule on this page should be totally ignored. "
+        LayoutInline {A} at (0,0) size 80x19
+          LayoutText {#text} at (334,0) size 80x19
+            text run at (334,0) width 80: "here is a link"
+        LayoutText {#text} at (0,0) size 0x0
+      LayoutNGBlockFlow {H1} at (0,41.44) size 784x37
+        LayoutText {#text} at (0,0) size 109x36
+          text run at (0,0) width 109: "heading"
+      LayoutNGBlockFlow (anonymous) at (0,99.88) size 784x100
+        LayoutInline {SPAN} at (0,0) size 31x19
+          LayoutText {#text} at (0,0) size 31x19
+            text run at (0,0) width 31: "issue"
+        LayoutBR {BR} at (31,15) size 0x0
+        LayoutInline {SPAN} at (0,0) size 20x19
+          LayoutText {#text} at (0,20) size 20x19
+            text run at (0,20) width 20: "fail"
+        LayoutBR {BR} at (20,35) size 0x0
+        LayoutInline {A} at (0,0) size 120x19
+          LayoutText {#text} at (0,40) size 120x19
+            text run at (0,40) width 120: "here is another link"
+        LayoutBR {BR} at (120,55) size 0x0
+        LayoutInline {SPAN} at (0,0) size 19x19
+          LayoutText {#text} at (0,60) size 19x19
+            text run at (0,60) width 19: "n/a"
+        LayoutBR {BR} at (19,75) size 0x0
+        LayoutInline {SPAN} at (0,0) size 27x19
+          LayoutText {#text} at (0,80) size 27x19
+            text run at (0,80) width 27: "pass"
+        LayoutBR {BR} at (27,95) size 0x0
+      LayoutNGBlockFlow {H1} at (0,221.31) size 784x37
+        LayoutText {#text} at (0,0) size 223x36
+          text run at (0,0) width 223: "another heading"
+      LayoutNGBlockFlow (anonymous) at (0,279.75) size 784x20
+        LayoutInline {SPAN} at (0,0) size 19x19
+          LayoutText {#text} at (0,0) size 19x19
+            text run at (0,0) width 19: "n/a"
+        LayoutBR {BR} at (19,15) size 0x0
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/layers/opacity-transforms-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/layers/opacity-transforms-expected.png
new file mode 100644
index 0000000..0933ee6
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/layers/opacity-transforms-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/layers/opacity-transforms-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/layers/opacity-transforms-expected.txt
index 92ad37e..501d9a8 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/layers/opacity-transforms-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/layers/opacity-transforms-expected.txt
@@ -8,8 +8,8 @@
           LayoutText {#text} at (0,0) size 305x19
             text run at (0,0) width 305: "https://bugs.webkit.org/show_bug.cgi?id=22026"
       LayoutNGBlockFlow {P} at (0,36) size 784x20
-        LayoutText {#text} at (0,0) size 648x19
-          text run at (0,0) width 648: "Test that elements with transform and opacity on a parent are not clipped. You should see no red below."
+        LayoutText {#text} at (0,0) size 649x19
+          text run at (0,0) width 649: "Test that elements with transform and opacity on a parent are not clipped. You should see no red below."
 layer at (150,200) size 100x100
   LayoutNGBlockFlow (positioned) {DIV} at (150,200) size 100x100 [bgcolor=#FF0000]
 layer at (100,150) size 100x100 transparent
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/layers/scroll-rect-to-visible-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/layers/scroll-rect-to-visible-expected.png
index 69bcd5a..e89472f 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/layers/scroll-rect-to-visible-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/layers/scroll-rect-to-visible-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/layers/scroll-rect-to-visible-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/layers/scroll-rect-to-visible-expected.txt
index 35a73ee6..9db1b9b 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/layers/scroll-rect-to-visible-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/layers/scroll-rect-to-visible-expected.txt
@@ -4,14 +4,14 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 785x664
     LayoutNGBlockFlow {BODY} at (8,8) size 769x636
       LayoutNGBlockFlow {P} at (0,0) size 769x40
-        LayoutText {#text} at (0,0) size 51x19
-          text run at (0,0) width 51: "Test for "
-        LayoutInline {I} at (0,0) size 742x39
-          LayoutInline {A} at (0,0) size 301x19 [color=#0000EE]
-            LayoutText {#text} at (51,0) size 301x19
-              text run at (51,0) width 301: "http://bugs.webkit.org/show_bug.cgi?id=14875"
-          LayoutText {#text} at (352,0) size 742x39
-            text run at (352,0) width 390: " Textarea with nowrap - left/right nav, Up/down nav both hide"
+        LayoutText {#text} at (0,0) size 52x19
+          text run at (0,0) width 52: "Test for "
+        LayoutInline {I} at (0,0) size 743x39
+          LayoutInline {A} at (0,0) size 300x19 [color=#0000EE]
+            LayoutText {#text} at (52,0) size 300x19
+              text run at (52,0) width 300: "http://bugs.webkit.org/show_bug.cgi?id=14875"
+          LayoutText {#text} at (352,0) size 743x39
+            text run at (352,0) width 391: " Textarea with nowrap - left/right nav, Up/down nav both hide"
             text run at (0,20) width 22: "text"
         LayoutText {#text} at (22,20) size 4x19
           text run at (22,20) width 4: "."
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/002-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/002-expected.png
index 848fc52..cc67869 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/002-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/002-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/005-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/005-expected.png
index 1a31813..43a3228 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/005-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/005-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/005-vertical-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/005-vertical-expected.png
index 48616f4..e58fd48 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/005-vertical-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/005-vertical-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/007-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/007-expected.png
index 1140a2c..8591d1e 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/007-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/007-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/008-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/008-expected.png
index b5e9678..760d96bd 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/008-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/008-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/008-vertical-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/008-vertical-expected.png
new file mode 100644
index 0000000..ca9e430
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/008-vertical-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/009-vertical-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/009-vertical-expected.png
new file mode 100644
index 0000000..edf5e95
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/009-vertical-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/big-list-marker-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/big-list-marker-expected.png
index 8eb336d..258e7f6 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/big-list-marker-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/big-list-marker-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/dynamic-marker-crash-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/dynamic-marker-crash-expected.png
index 5a6b6b5..f78ea2b 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/dynamic-marker-crash-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/dynamic-marker-crash-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/inlineBoxWrapperNullCheck-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/inlineBoxWrapperNullCheck-expected.png
index a604489..48a067f 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/inlineBoxWrapperNullCheck-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/inlineBoxWrapperNullCheck-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/marker-image-error-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/marker-image-error-expected.png
index 943211a..21e705c 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/marker-image-error-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/marker-image-error-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/ol-display-types-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/ol-display-types-expected.png
index 4b3e4ca..c491fd8d 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/ol-display-types-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/ol-display-types-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/ordered-list-with-no-ol-tag-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/ordered-list-with-no-ol-tag-expected.png
index 263b982..ac07f77 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/ordered-list-with-no-ol-tag-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/ordered-list-with-no-ol-tag-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/scrolled-marker-paint-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/scrolled-marker-paint-expected.png
index aae8992..7fc7d35 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/scrolled-marker-paint-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/lists/scrolled-marker-paint-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/multicol/composited-inner-multicol-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/multicol/composited-inner-multicol-expected.png
new file mode 100644
index 0000000..b9ebc78
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/multicol/composited-inner-multicol-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/overflow/overflow-x-y-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/overflow/overflow-x-y-expected.png
new file mode 100644
index 0000000..01a9aa9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/overflow/overflow-x-y-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/parser/xhtml-alternate-entities-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/parser/xhtml-alternate-entities-expected.png
new file mode 100644
index 0000000..954d31b
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/parser/xhtml-alternate-entities-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/parser/xhtml-alternate-entities-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/parser/xhtml-alternate-entities-expected.txt
index bf1f58e..f059744a 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/parser/xhtml-alternate-entities-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/parser/xhtml-alternate-entities-expected.txt
@@ -17,8 +17,8 @@
       LayoutInline {h1} at (0,0) size 0x0
         LayoutText {#text} at (0,0) size 0x0
       LayoutText {#text} at (0,0) size 0x0
-      LayoutInline {p} at (0,0) size 487x19
-        LayoutInline {font} at (0,0) size 487x19
-          LayoutText {#text} at (0,0) size 487x19
-            text run at (0,0) width 487: "This should be the only line on this page. You should see a parse error above."
+      LayoutInline {p} at (0,0) size 486x19
+        LayoutInline {font} at (0,0) size 486x19
+          LayoutText {#text} at (0,0) size 486x19
+            text run at (0,0) width 486: "This should be the only line on this page. You should see a parse error above."
       LayoutText {#text} at (0,0) size 0x0
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/reflections/opacity-reflection-transform-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/reflections/opacity-reflection-transform-expected.png
new file mode 100644
index 0000000..637be0e
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/reflections/opacity-reflection-transform-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/reflections/opacity-reflection-transform-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/reflections/opacity-reflection-transform-expected.txt
new file mode 100644
index 0000000..45b9983
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/reflections/opacity-reflection-transform-expected.txt
@@ -0,0 +1,13 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x600
+    LayoutNGBlockFlow {BODY} at (8,8) size 784x572
+      LayoutNGBlockFlow {P} at (0,0) size 784x40
+        LayoutText {#text} at (0,0) size 751x39
+          text run at (0,0) width 751: "Test that opacity doesn't cause clipping of transformed, reflected content. You should see a rotated green box and its full"
+          text run at (0,20) width 63: "reflection."
+layer at (108,68) size 102x102 transparent
+  LayoutNGBlockFlow {DIV} at (100,60) size 102x102 [border: (1px solid #000000)]
+layer at (109,69) size 200x100
+  LayoutNGBlockFlow {DIV} at (1,1) size 200x100 [bgcolor=#008000]
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/reflections/reflection-overflow-hidden-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/reflections/reflection-overflow-hidden-expected.png
new file mode 100644
index 0000000..e6d9b0a
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/reflections/reflection-overflow-hidden-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/reflections/reflection-overflow-hidden-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/reflections/reflection-overflow-hidden-expected.txt
index f75f37c..325940f 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/reflections/reflection-overflow-hidden-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/reflections/reflection-overflow-hidden-expected.txt
@@ -14,15 +14,15 @@
             text run at (0,0) width 305: "https://bugs.webkit.org/show_bug.cgi?id=22570"
         LayoutText {#text} at (305,0) size 693x39
           text run at (305,0) width 388: ". Test for reflection painting on overflow:hidden element. You"
-          text run at (0,20) width 186: "should not see any red below."
+          text run at (0,20) width 187: "should not see any red below."
 layer at (50,100) size 400x200
   LayoutNGBlockFlow (positioned) {DIV} at (50,100) size 400x200
 layer at (50,100) size 400x200
   LayoutNGBlockFlow (relative positioned) {DIV} at (0,0) size 400x200
 layer at (50,100) size 400x50
   LayoutNGBlockFlow (positioned) {DIV} at (0,0) size 400x50 [bgcolor=#008000]
-    LayoutText {#text} at (0,0) size 24x19
-      text run at (0,0) width 24: "Top"
+    LayoutText {#text} at (0,0) size 25x19
+      text run at (0,0) width 25: "Top"
 layer at (50,250) size 400x50
   LayoutNGBlockFlow (positioned) {DIV} at (0,150) size 400x50 [bgcolor=#008000]
     LayoutText {#text} at (0,0) size 47x19
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/replaced/selection-rect-in-table-cell-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/replaced/selection-rect-in-table-cell-expected.png
new file mode 100644
index 0000000..1508fb0
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/replaced/selection-rect-in-table-cell-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/selectors/040-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/selectors/040-expected.png
new file mode 100644
index 0000000..a907c3df
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/selectors/040-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/selectors/040-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/selectors/040-expected.txt
new file mode 100644
index 0000000..eb54031
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/selectors/040-expected.txt
@@ -0,0 +1,9 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x72
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x72
+    LayoutNGBlockFlow {BODY} at (8,16) size 784x40
+      LayoutNGBlockFlow {P} at (0,0) size 784x40
+        LayoutText {#text} at (0,0) size 753x39
+          text run at (0,0) width 753: "Any textual selection in this long paragraph should have green background. Any textual selection in this long paragraph"
+          text run at (0,20) width 677: "should have green background. Any textual selection in this long paragraph should have green background."
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/selectors/041-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/selectors/041-expected.png
new file mode 100644
index 0000000..cd7d97f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/selectors/041-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/selectors/041-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/selectors/041-expected.txt
new file mode 100644
index 0000000..3884251
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/selectors/041-expected.txt
@@ -0,0 +1,12 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x72
+  LayoutNGBlockFlow {HTML} at (0,0) size 800x72
+    LayoutNGBlockFlow {BODY} at (8,16) size 784x40
+      LayoutNGBlockFlow {P} at (0,0) size 784x40
+        LayoutInline {<pseudo:before>} at (0,0) size 181x19 [bgcolor=#00FF00]
+          LayoutTextFragment (anonymous) at (0,0) size 181x19
+            text run at (0,0) width 181: "GENERATED CONTENT "
+        LayoutText {#text} at (181,0) size 733x39
+          text run at (181,0) width 552: "You should see before this paragraph the words GENERATED CONTENT over green"
+          text run at (0,20) width 75: "background"
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/selectors/166-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/selectors/166-expected.png
index dec9576..0d8d89f1 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/selectors/166-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/selectors/166-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/selectors/166-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/selectors/166-expected.txt
index fc81e869..14eed491 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/selectors/166-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/selectors/166-expected.txt
@@ -4,14 +4,14 @@
   LayoutNGBlockFlow {HTML} at (0,0) size 785x3661.50
     LayoutNGBlockFlow {BODY} at (8,21.44) size 769x3624.06
       LayoutNGBlockFlow {H1} at (0,0) size 769x37
-        LayoutText {#text} at (0,0) size 244x36
-          text run at (0,0) width 244: "HTML Test Index"
+        LayoutText {#text} at (0,0) size 243x36
+          text run at (0,0) width 243: "HTML Test Index"
       LayoutNGBlockFlow {P} at (0,58.44) size 769x20
-        LayoutText {#text} at (0,0) size 310x19
-          text run at (0,0) width 310: "The HTML tests are available in several variants."
+        LayoutText {#text} at (0,0) size 309x19
+          text run at (0,0) width 309: "The HTML tests are available in several variants."
       LayoutNGBlockFlow {H2} at (0,98.34) size 769x27
-        LayoutText {#text} at (0,0) size 277x26
-          text run at (0,0) width 277: "Tests With Navigation Aids"
+        LayoutText {#text} at (0,0) size 278x26
+          text run at (0,0) width 278: "Tests With Navigation Aids"
       LayoutNGBlockFlow {P} at (0,145.25) size 769x40
         LayoutText {#text} at (0,0) size 769x39
           text run at (0,0) width 769: "Each category of test is available using several different harnesses. The name of the harness describes how the test markup"
@@ -31,45 +31,45 @@
               text run at (29,0) width 94: "Self Contained"
           LayoutText {#text} at (123,0) size 8x19
             text run at (123,0) width 8: ", "
-          LayoutInline {A} at (0,0) size 120x19 [color=#0000EE]
-            LayoutText {#text} at (131,0) size 120x19
-              text run at (131,0) width 120: "XHTML <iframe>"
-          LayoutText {#text} at (251,0) size 8x19
-            text run at (251,0) width 8: ", "
-          LayoutInline {A} at (0,0) size 118x19 [color=#0000EE]
-            LayoutText {#text} at (259,0) size 118x19
-              text run at (259,0) width 118: "XHTML <object>"
-          LayoutText {#text} at (377,0) size 8x19
-            text run at (377,0) width 8: ", "
-          LayoutInline {A} at (0,0) size 116x19 [color=#0000EE]
-            LayoutText {#text} at (385,0) size 116x19
-              text run at (385,0) width 116: "XHTML <frame>"
-          LayoutText {#text} at (501,0) size 8x19
-            text run at (501,0) width 8: ", "
-          LayoutInline {A} at (0,0) size 108x19 [color=#0000EE]
-            LayoutText {#text} at (509,0) size 108x19
-              text run at (509,0) width 108: "HTML <iframe>"
-          LayoutText {#text} at (617,0) size 8x19
-            text run at (617,0) width 8: ", "
-          LayoutInline {A} at (0,0) size 671x39 [color=#0000EE]
-            LayoutText {#text} at (625,0) size 671x39
-              text run at (625,0) width 46: "HTML"
+          LayoutInline {A} at (0,0) size 119x19 [color=#0000EE]
+            LayoutText {#text} at (131,0) size 119x19
+              text run at (131,0) width 119: "XHTML <iframe>"
+          LayoutText {#text} at (250,0) size 8x19
+            text run at (250,0) width 8: ", "
+          LayoutInline {A} at (0,0) size 117x19 [color=#0000EE]
+            LayoutText {#text} at (258,0) size 117x19
+              text run at (258,0) width 117: "XHTML <object>"
+          LayoutText {#text} at (375,0) size 8x19
+            text run at (375,0) width 8: ", "
+          LayoutInline {A} at (0,0) size 115x19 [color=#0000EE]
+            LayoutText {#text} at (383,0) size 115x19
+              text run at (383,0) width 115: "XHTML <frame>"
+          LayoutText {#text} at (498,0) size 8x19
+            text run at (498,0) width 8: ", "
+          LayoutInline {A} at (0,0) size 107x19 [color=#0000EE]
+            LayoutText {#text} at (506,0) size 107x19
+              text run at (506,0) width 107: "HTML <iframe>"
+          LayoutText {#text} at (613,0) size 8x19
+            text run at (613,0) width 8: ", "
+          LayoutInline {A} at (0,0) size 667x39 [color=#0000EE]
+            LayoutText {#text} at (621,0) size 667x39
+              text run at (621,0) width 46: "HTML"
               text run at (0,20) width 56: "<object>"
           LayoutText {#text} at (56,20) size 8x19
             text run at (56,20) width 8: ", "
-          LayoutInline {A} at (0,0) size 104x19 [color=#0000EE]
-            LayoutText {#text} at (64,20) size 104x19
-              text run at (64,20) width 104: "HTML <frame>"
-          LayoutText {#text} at (168,20) size 8x19
-            text run at (168,20) width 8: ", "
+          LayoutInline {A} at (0,0) size 103x19 [color=#0000EE]
+            LayoutText {#text} at (64,20) size 103x19
+              text run at (64,20) width 103: "HTML <frame>"
+          LayoutText {#text} at (167,20) size 8x19
+            text run at (167,20) width 8: ", "
           LayoutInline {A} at (0,0) size 88x19 [color=#0000EE]
-            LayoutText {#text} at (176,20) size 88x19
-              text run at (176,20) width 88: "XLink embed"
-          LayoutText {#text} at (264,20) size 8x19
-            text run at (264,20) width 8: ", "
+            LayoutText {#text} at (175,20) size 88x19
+              text run at (175,20) width 88: "XLink embed"
+          LayoutText {#text} at (263,20) size 8x19
+            text run at (263,20) width 8: ", "
           LayoutInline {A} at (0,0) size 83x19 [color=#0000EE]
-            LayoutText {#text} at (272,20) size 83x19
-              text run at (272,20) width 83: "TNG Format"
+            LayoutText {#text} at (271,20) size 83x19
+              text run at (271,20) width 83: "TNG Format"
         LayoutNGListItem {LI} at (40,40) size 729x40
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
             LayoutText (anonymous) at (0,0) size 10x19
@@ -84,45 +84,45 @@
               text run at (40,0) width 94: "Self Contained"
           LayoutText {#text} at (134,0) size 8x19
             text run at (134,0) width 8: ", "
-          LayoutInline {A} at (0,0) size 120x19 [color=#0000EE]
-            LayoutText {#text} at (142,0) size 120x19
-              text run at (142,0) width 120: "XHTML <iframe>"
-          LayoutText {#text} at (262,0) size 8x19
-            text run at (262,0) width 8: ", "
-          LayoutInline {A} at (0,0) size 118x19 [color=#0000EE]
-            LayoutText {#text} at (270,0) size 118x19
-              text run at (270,0) width 118: "XHTML <object>"
-          LayoutText {#text} at (388,0) size 8x19
-            text run at (388,0) width 8: ", "
-          LayoutInline {A} at (0,0) size 116x19 [color=#0000EE]
-            LayoutText {#text} at (396,0) size 116x19
-              text run at (396,0) width 116: "XHTML <frame>"
-          LayoutText {#text} at (512,0) size 8x19
-            text run at (512,0) width 8: ", "
-          LayoutInline {A} at (0,0) size 108x19 [color=#0000EE]
-            LayoutText {#text} at (520,0) size 108x19
-              text run at (520,0) width 108: "HTML <iframe>"
-          LayoutText {#text} at (628,0) size 8x19
-            text run at (628,0) width 8: ", "
-          LayoutInline {A} at (0,0) size 682x39 [color=#0000EE]
-            LayoutText {#text} at (636,0) size 682x39
-              text run at (636,0) width 46: "HTML"
+          LayoutInline {A} at (0,0) size 119x19 [color=#0000EE]
+            LayoutText {#text} at (142,0) size 119x19
+              text run at (142,0) width 119: "XHTML <iframe>"
+          LayoutText {#text} at (261,0) size 8x19
+            text run at (261,0) width 8: ", "
+          LayoutInline {A} at (0,0) size 117x19 [color=#0000EE]
+            LayoutText {#text} at (269,0) size 117x19
+              text run at (269,0) width 117: "XHTML <object>"
+          LayoutText {#text} at (386,0) size 8x19
+            text run at (386,0) width 8: ", "
+          LayoutInline {A} at (0,0) size 115x19 [color=#0000EE]
+            LayoutText {#text} at (394,0) size 115x19
+              text run at (394,0) width 115: "XHTML <frame>"
+          LayoutText {#text} at (509,0) size 8x19
+            text run at (509,0) width 8: ", "
+          LayoutInline {A} at (0,0) size 107x19 [color=#0000EE]
+            LayoutText {#text} at (517,0) size 107x19
+              text run at (517,0) width 107: "HTML <iframe>"
+          LayoutText {#text} at (624,0) size 8x19
+            text run at (624,0) width 8: ", "
+          LayoutInline {A} at (0,0) size 678x39 [color=#0000EE]
+            LayoutText {#text} at (632,0) size 678x39
+              text run at (632,0) width 46: "HTML"
               text run at (0,20) width 56: "<object>"
           LayoutText {#text} at (56,20) size 8x19
             text run at (56,20) width 8: ", "
-          LayoutInline {A} at (0,0) size 104x19 [color=#0000EE]
-            LayoutText {#text} at (64,20) size 104x19
-              text run at (64,20) width 104: "HTML <frame>"
-          LayoutText {#text} at (168,20) size 8x19
-            text run at (168,20) width 8: ", "
+          LayoutInline {A} at (0,0) size 103x19 [color=#0000EE]
+            LayoutText {#text} at (64,20) size 103x19
+              text run at (64,20) width 103: "HTML <frame>"
+          LayoutText {#text} at (167,20) size 8x19
+            text run at (167,20) width 8: ", "
           LayoutInline {A} at (0,0) size 88x19 [color=#0000EE]
-            LayoutText {#text} at (176,20) size 88x19
-              text run at (176,20) width 88: "XLink embed"
-          LayoutText {#text} at (264,20) size 8x19
-            text run at (264,20) width 8: ", "
+            LayoutText {#text} at (175,20) size 88x19
+              text run at (175,20) width 88: "XLink embed"
+          LayoutText {#text} at (263,20) size 8x19
+            text run at (263,20) width 8: ", "
           LayoutInline {A} at (0,0) size 83x19 [color=#0000EE]
-            LayoutText {#text} at (272,20) size 83x19
-              text run at (272,20) width 83: "TNG Format"
+            LayoutText {#text} at (271,20) size 83x19
+              text run at (271,20) width 83: "TNG Format"
         LayoutNGListItem {LI} at (40,80) size 729x40
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
             LayoutText (anonymous) at (0,0) size 10x19
@@ -137,44 +137,44 @@
               text run at (98,0) width 94: "Self Contained"
           LayoutText {#text} at (192,0) size 8x19
             text run at (192,0) width 8: ", "
-          LayoutInline {A} at (0,0) size 120x19 [color=#0000EE]
-            LayoutText {#text} at (200,0) size 120x19
-              text run at (200,0) width 120: "XHTML <iframe>"
-          LayoutText {#text} at (320,0) size 8x19
-            text run at (320,0) width 8: ", "
-          LayoutInline {A} at (0,0) size 118x19 [color=#0000EE]
-            LayoutText {#text} at (328,0) size 118x19
-              text run at (328,0) width 118: "XHTML <object>"
-          LayoutText {#text} at (446,0) size 8x19
-            text run at (446,0) width 8: ", "
-          LayoutInline {A} at (0,0) size 116x19 [color=#0000EE]
-            LayoutText {#text} at (454,0) size 116x19
-              text run at (454,0) width 116: "XHTML <frame>"
-          LayoutText {#text} at (570,0) size 8x19
-            text run at (570,0) width 8: ", "
-          LayoutInline {A} at (0,0) size 108x19 [color=#0000EE]
-            LayoutText {#text} at (578,0) size 108x19
-              text run at (578,0) width 108: "HTML <iframe>"
-          LayoutText {#text} at (686,0) size 4x19
-            text run at (686,0) width 4: ","
-          LayoutInline {A} at (0,0) size 106x19 [color=#0000EE]
-            LayoutText {#text} at (0,20) size 106x19
-              text run at (0,20) width 106: "HTML <object>"
-          LayoutText {#text} at (106,20) size 8x19
-            text run at (106,20) width 8: ", "
-          LayoutInline {A} at (0,0) size 104x19 [color=#0000EE]
-            LayoutText {#text} at (114,20) size 104x19
-              text run at (114,20) width 104: "HTML <frame>"
-          LayoutText {#text} at (218,20) size 8x19
-            text run at (218,20) width 8: ", "
+          LayoutInline {A} at (0,0) size 119x19 [color=#0000EE]
+            LayoutText {#text} at (200,0) size 119x19
+              text run at (200,0) width 119: "XHTML <iframe>"
+          LayoutText {#text} at (319,0) size 8x19
+            text run at (319,0) width 8: ", "
+          LayoutInline {A} at (0,0) size 117x19 [color=#0000EE]
+            LayoutText {#text} at (327,0) size 117x19
+              text run at (327,0) width 117: "XHTML <object>"
+          LayoutText {#text} at (444,0) size 8x19
+            text run at (444,0) width 8: ", "
+          LayoutInline {A} at (0,0) size 115x19 [color=#0000EE]
+            LayoutText {#text} at (452,0) size 115x19
+              text run at (452,0) width 115: "XHTML <frame>"
+          LayoutText {#text} at (567,0) size 8x19
+            text run at (567,0) width 8: ", "
+          LayoutInline {A} at (0,0) size 107x19 [color=#0000EE]
+            LayoutText {#text} at (575,0) size 107x19
+              text run at (575,0) width 107: "HTML <iframe>"
+          LayoutText {#text} at (682,0) size 4x19
+            text run at (682,0) width 4: ","
+          LayoutInline {A} at (0,0) size 105x19 [color=#0000EE]
+            LayoutText {#text} at (0,20) size 105x19
+              text run at (0,20) width 105: "HTML <object>"
+          LayoutText {#text} at (105,20) size 8x19
+            text run at (105,20) width 8: ", "
+          LayoutInline {A} at (0,0) size 103x19 [color=#0000EE]
+            LayoutText {#text} at (113,20) size 103x19
+              text run at (113,20) width 103: "HTML <frame>"
+          LayoutText {#text} at (216,20) size 8x19
+            text run at (216,20) width 8: ", "
           LayoutInline {A} at (0,0) size 88x19 [color=#0000EE]
-            LayoutText {#text} at (226,20) size 88x19
-              text run at (226,20) width 88: "XLink embed"
-          LayoutText {#text} at (314,20) size 8x19
-            text run at (314,20) width 8: ", "
+            LayoutText {#text} at (224,20) size 88x19
+              text run at (224,20) width 88: "XLink embed"
+          LayoutText {#text} at (312,20) size 8x19
+            text run at (312,20) width 8: ", "
           LayoutInline {A} at (0,0) size 83x19 [color=#0000EE]
-            LayoutText {#text} at (322,20) size 83x19
-              text run at (322,20) width 83: "TNG Format"
+            LayoutText {#text} at (320,20) size 83x19
+              text run at (320,20) width 83: "TNG Format"
         LayoutNGListItem {LI} at (40,120) size 729x40
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
             LayoutText (anonymous) at (0,0) size 10x19
@@ -189,45 +189,45 @@
               text run at (73,0) width 94: "Self Contained"
           LayoutText {#text} at (167,0) size 8x19
             text run at (167,0) width 8: ", "
-          LayoutInline {A} at (0,0) size 120x19 [color=#0000EE]
-            LayoutText {#text} at (175,0) size 120x19
-              text run at (175,0) width 120: "XHTML <iframe>"
-          LayoutText {#text} at (295,0) size 8x19
-            text run at (295,0) width 8: ", "
-          LayoutInline {A} at (0,0) size 118x19 [color=#0000EE]
-            LayoutText {#text} at (303,0) size 118x19
-              text run at (303,0) width 118: "XHTML <object>"
-          LayoutText {#text} at (421,0) size 8x19
-            text run at (421,0) width 8: ", "
-          LayoutInline {A} at (0,0) size 116x19 [color=#0000EE]
-            LayoutText {#text} at (429,0) size 116x19
-              text run at (429,0) width 116: "XHTML <frame>"
-          LayoutText {#text} at (545,0) size 8x19
-            text run at (545,0) width 8: ", "
-          LayoutInline {A} at (0,0) size 108x19 [color=#0000EE]
-            LayoutText {#text} at (553,0) size 108x19
-              text run at (553,0) width 108: "HTML <iframe>"
-          LayoutText {#text} at (661,0) size 8x19
-            text run at (661,0) width 8: ", "
-          LayoutInline {A} at (0,0) size 715x39 [color=#0000EE]
-            LayoutText {#text} at (669,0) size 715x39
-              text run at (669,0) width 46: "HTML"
+          LayoutInline {A} at (0,0) size 119x19 [color=#0000EE]
+            LayoutText {#text} at (175,0) size 119x19
+              text run at (175,0) width 119: "XHTML <iframe>"
+          LayoutText {#text} at (294,0) size 8x19
+            text run at (294,0) width 8: ", "
+          LayoutInline {A} at (0,0) size 117x19 [color=#0000EE]
+            LayoutText {#text} at (302,0) size 117x19
+              text run at (302,0) width 117: "XHTML <object>"
+          LayoutText {#text} at (419,0) size 8x19
+            text run at (419,0) width 8: ", "
+          LayoutInline {A} at (0,0) size 115x19 [color=#0000EE]
+            LayoutText {#text} at (427,0) size 115x19
+              text run at (427,0) width 115: "XHTML <frame>"
+          LayoutText {#text} at (542,0) size 8x19
+            text run at (542,0) width 8: ", "
+          LayoutInline {A} at (0,0) size 107x19 [color=#0000EE]
+            LayoutText {#text} at (550,0) size 107x19
+              text run at (550,0) width 107: "HTML <iframe>"
+          LayoutText {#text} at (657,0) size 8x19
+            text run at (657,0) width 8: ", "
+          LayoutInline {A} at (0,0) size 711x39 [color=#0000EE]
+            LayoutText {#text} at (665,0) size 711x39
+              text run at (665,0) width 46: "HTML"
               text run at (0,20) width 56: "<object>"
           LayoutText {#text} at (56,20) size 8x19
             text run at (56,20) width 8: ", "
-          LayoutInline {A} at (0,0) size 104x19 [color=#0000EE]
-            LayoutText {#text} at (64,20) size 104x19
-              text run at (64,20) width 104: "HTML <frame>"
-          LayoutText {#text} at (168,20) size 8x19
-            text run at (168,20) width 8: ", "
+          LayoutInline {A} at (0,0) size 103x19 [color=#0000EE]
+            LayoutText {#text} at (64,20) size 103x19
+              text run at (64,20) width 103: "HTML <frame>"
+          LayoutText {#text} at (167,20) size 8x19
+            text run at (167,20) width 8: ", "
           LayoutInline {A} at (0,0) size 88x19 [color=#0000EE]
-            LayoutText {#text} at (176,20) size 88x19
-              text run at (176,20) width 88: "XLink embed"
-          LayoutText {#text} at (264,20) size 8x19
-            text run at (264,20) width 8: ", "
+            LayoutText {#text} at (175,20) size 88x19
+              text run at (175,20) width 88: "XLink embed"
+          LayoutText {#text} at (263,20) size 8x19
+            text run at (263,20) width 8: ", "
           LayoutInline {A} at (0,0) size 83x19 [color=#0000EE]
-            LayoutText {#text} at (272,20) size 83x19
-              text run at (272,20) width 83: "TNG Format"
+            LayoutText {#text} at (271,20) size 83x19
+              text run at (271,20) width 83: "TNG Format"
         LayoutNGListItem {LI} at (40,160) size 729x40
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
             LayoutText (anonymous) at (0,0) size 10x19
@@ -242,45 +242,45 @@
               text run at (62,0) width 94: "Self Contained"
           LayoutText {#text} at (156,0) size 8x19
             text run at (156,0) width 8: ", "
-          LayoutInline {A} at (0,0) size 120x19 [color=#0000EE]
-            LayoutText {#text} at (164,0) size 120x19
-              text run at (164,0) width 120: "XHTML <iframe>"
-          LayoutText {#text} at (284,0) size 8x19
-            text run at (284,0) width 8: ", "
-          LayoutInline {A} at (0,0) size 118x19 [color=#0000EE]
-            LayoutText {#text} at (292,0) size 118x19
-              text run at (292,0) width 118: "XHTML <object>"
-          LayoutText {#text} at (410,0) size 8x19
-            text run at (410,0) width 8: ", "
-          LayoutInline {A} at (0,0) size 116x19 [color=#0000EE]
-            LayoutText {#text} at (418,0) size 116x19
-              text run at (418,0) width 116: "XHTML <frame>"
-          LayoutText {#text} at (534,0) size 8x19
-            text run at (534,0) width 8: ", "
-          LayoutInline {A} at (0,0) size 108x19 [color=#0000EE]
-            LayoutText {#text} at (542,0) size 108x19
-              text run at (542,0) width 108: "HTML <iframe>"
-          LayoutText {#text} at (650,0) size 8x19
-            text run at (650,0) width 8: ", "
-          LayoutInline {A} at (0,0) size 704x39 [color=#0000EE]
-            LayoutText {#text} at (658,0) size 704x39
-              text run at (658,0) width 46: "HTML"
+          LayoutInline {A} at (0,0) size 119x19 [color=#0000EE]
+            LayoutText {#text} at (164,0) size 119x19
+              text run at (164,0) width 119: "XHTML <iframe>"
+          LayoutText {#text} at (283,0) size 8x19
+            text run at (283,0) width 8: ", "
+          LayoutInline {A} at (0,0) size 117x19 [color=#0000EE]
+            LayoutText {#text} at (291,0) size 117x19
+              text run at (291,0) width 117: "XHTML <object>"
+          LayoutText {#text} at (408,0) size 8x19
+            text run at (408,0) width 8: ", "
+          LayoutInline {A} at (0,0) size 115x19 [color=#0000EE]
+            LayoutText {#text} at (416,0) size 115x19
+              text run at (416,0) width 115: "XHTML <frame>"
+          LayoutText {#text} at (531,0) size 8x19
+            text run at (531,0) width 8: ", "
+          LayoutInline {A} at (0,0) size 107x19 [color=#0000EE]
+            LayoutText {#text} at (539,0) size 107x19
+              text run at (539,0) width 107: "HTML <iframe>"
+          LayoutText {#text} at (646,0) size 8x19
+            text run at (646,0) width 8: ", "
+          LayoutInline {A} at (0,0) size 700x39 [color=#0000EE]
+            LayoutText {#text} at (654,0) size 700x39
+              text run at (654,0) width 46: "HTML"
               text run at (0,20) width 56: "<object>"
           LayoutText {#text} at (56,20) size 8x19
             text run at (56,20) width 8: ", "
-          LayoutInline {A} at (0,0) size 104x19 [color=#0000EE]
-            LayoutText {#text} at (64,20) size 104x19
-              text run at (64,20) width 104: "HTML <frame>"
-          LayoutText {#text} at (168,20) size 8x19
-            text run at (168,20) width 8: ", "
+          LayoutInline {A} at (0,0) size 103x19 [color=#0000EE]
+            LayoutText {#text} at (64,20) size 103x19
+              text run at (64,20) width 103: "HTML <frame>"
+          LayoutText {#text} at (167,20) size 8x19
+            text run at (167,20) width 8: ", "
           LayoutInline {A} at (0,0) size 88x19 [color=#0000EE]
-            LayoutText {#text} at (176,20) size 88x19
-              text run at (176,20) width 88: "XLink embed"
-          LayoutText {#text} at (264,20) size 8x19
-            text run at (264,20) width 8: ", "
+            LayoutText {#text} at (175,20) size 88x19
+              text run at (175,20) width 88: "XLink embed"
+          LayoutText {#text} at (263,20) size 8x19
+            text run at (263,20) width 8: ", "
           LayoutInline {A} at (0,0) size 83x19 [color=#0000EE]
-            LayoutText {#text} at (272,20) size 83x19
-              text run at (272,20) width 83: "TNG Format"
+            LayoutText {#text} at (271,20) size 83x19
+              text run at (271,20) width 83: "TNG Format"
       LayoutNGBlockFlow {H2} at (0,421.16) size 769x27
         LayoutText {#text} at (0,0) size 172x26
           text run at (0,0) width 172: "Unadorned Tests"
@@ -298,11 +298,11 @@
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
             LayoutText (anonymous) at (0,0) size 10x19
               text run at (0,0) width 10: "\x{2022} "
-          LayoutInline {A} at (0,0) size 142x19 [color=#0000EE]
-            LayoutText {#text} at (0,0) size 142x19
-              text run at (0,0) width 142: "Type element selectors"
-          LayoutText {#text} at (142,0) size 30x19
-            text run at (142,0) width 30: " (#2)"
+          LayoutInline {A} at (0,0) size 143x19 [color=#0000EE]
+            LayoutText {#text} at (0,0) size 143x19
+              text run at (0,0) width 143: "Type element selectors"
+          LayoutText {#text} at (143,0) size 30x19
+            text run at (143,0) width 30: " (#2)"
         LayoutNGListItem {LI} at (40,40) size 729x20
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
             LayoutText (anonymous) at (0,0) size 10x19
@@ -382,8 +382,8 @@
           LayoutInline {A} at (0,0) size 295x19 [color=#0000EE]
             LayoutText {#text} at (0,0) size 295x19
               text run at (0,0) width 295: "Substring matching attribute selector (contains)"
-          LayoutText {#text} at (295,0) size 38x19
-            text run at (295,0) width 38: " (#11)"
+          LayoutText {#text} at (295,0) size 37x19
+            text run at (295,0) width 37: " (#11)"
         LayoutNGListItem {LI} at (40,220) size 729x20
           LayoutNGListMarker (anonymous) at (-18,0) size 10x20
             LayoutText (anonymous) at (0,0) size 10x19
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/018-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/018-expected.png
index fe18aca..3a5ddf1 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/018-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/018-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/040-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/040-expected.png
index ec9ddac..3dd152f 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/040-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/040-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/040-vertical-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/040-vertical-expected.png
index e235fe3..964eedfa 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/040-vertical-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/040-vertical-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-cell-collapsed-border-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-cell-collapsed-border-expected.png
index d428d50..d3f7721 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-cell-collapsed-border-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-cell-collapsed-border-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-cell-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-cell-expected.png
index 3d3c30e3..03899b3c 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-cell-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-cell-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-collapsed-border-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-collapsed-border-expected.png
index 3ca5a41..b97ddd85 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-collapsed-border-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-collapsed-border-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-column-collapsed-border-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-column-collapsed-border-expected.png
index d1ae9496..4366b323 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-column-collapsed-border-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-column-collapsed-border-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-column-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-column-expected.png
index df33faa..334fa44 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-column-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-column-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-column-group-collapsed-border-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-column-group-collapsed-border-expected.png
index fa08f35..47b0223 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-column-group-collapsed-border-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-column-group-collapsed-border-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-column-group-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-column-group-expected.png
index 2ae1f990..a960881 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-column-group-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-column-group-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-expected.png
index 7cd9282..c5271a95 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-quirks-collapsed-border-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-quirks-collapsed-border-expected.png
index aa3c3c1..3bbac58 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-quirks-collapsed-border-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-quirks-collapsed-border-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-quirks-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-quirks-expected.png
index eb401e16..8517430 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-quirks-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-quirks-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-row-collapsed-border-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-row-collapsed-border-expected.png
index 2edc6c29..01b0ca9 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-row-collapsed-border-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-row-collapsed-border-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-row-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-row-expected.png
index d319672f5..938d712 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-row-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-row-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-row-group-collapsed-border-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-row-group-collapsed-border-expected.png
index ec2d414..2533a493 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-row-group-collapsed-border-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-row-group-collapsed-border-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-row-group-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-row-group-expected.png
index 5ca05a3..0a5033b 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-row-group-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_border-table-row-group-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_layers-hide-collapsed-border-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_layers-hide-collapsed-border-expected.png
index da11bc0..0c62cd7 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_layers-hide-collapsed-border-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_layers-hide-collapsed-border-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_layers-hide-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_layers-hide-expected.png
index b1ab6be..b883d693 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_layers-hide-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_layers-hide-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_layers-opacity-collapsed-border-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_layers-opacity-collapsed-border-expected.png
index 0a84067..da46468 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_layers-opacity-collapsed-border-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_layers-opacity-collapsed-border-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_layers-opacity-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_layers-opacity-expected.png
index 0a84067..da46468 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_layers-opacity-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_layers-opacity-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_layers-show-collapsed-border-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_layers-show-collapsed-border-expected.png
index 01b7a43..fa1268f 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_layers-show-collapsed-border-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_layers-show-collapsed-border-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_layers-show-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_layers-show-expected.png
index 33f7e915..344b80f0 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_layers-show-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_layers-show-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-cell-collapsed-border-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-cell-collapsed-border-expected.png
index fab7648..c0c2cf4 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-cell-collapsed-border-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-cell-collapsed-border-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-cell-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-cell-expected.png
index 6f9f87c..2fd86a6 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-cell-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-cell-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-collapsed-border-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-collapsed-border-expected.png
index ba93873..88e0ff6 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-collapsed-border-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-collapsed-border-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-column-collapsed-border-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-column-collapsed-border-expected.png
index 0ee4973..3e58af85 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-column-collapsed-border-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-column-collapsed-border-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-column-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-column-expected.png
index 2e89e72..eb2d11a 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-column-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-column-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-column-group-collapsed-border-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-column-group-collapsed-border-expected.png
index 3484288..002523f5b 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-column-group-collapsed-border-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-column-group-collapsed-border-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-column-group-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-column-group-expected.png
index 0c45768..696527cb 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-column-group-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-column-group-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-expected.png
index 0f5760c..df80a77 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-row-collapsed-border-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-row-collapsed-border-expected.png
index 5795046..8dab848 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-row-collapsed-border-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-row-collapsed-border-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-row-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-row-expected.png
index 9b3e480..70a1d8f 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-row-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-row-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-row-group-collapsed-border-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-row-group-collapsed-border-expected.png
index de2577f..9456c1ce2 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-row-group-collapsed-border-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-row-group-collapsed-border-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-row-group-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-row-group-expected.png
index a606d97f..9b71428 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-row-group-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_position-table-row-group-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-cell-collapsed-border-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-cell-collapsed-border-expected.png
index 6bd048e4..34e7f00a 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-cell-collapsed-border-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-cell-collapsed-border-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-cell-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-cell-expected.png
index 5d535fb..33c25c2 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-cell-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-cell-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-collapsed-border-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-collapsed-border-expected.png
index 42c672f..6ad2717 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-collapsed-border-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-collapsed-border-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-column-collapsed-border-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-column-collapsed-border-expected.png
index 3c84252..dd98cb6 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-column-collapsed-border-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-column-collapsed-border-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-column-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-column-expected.png
index 6fa5f997..1b2ac4e 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-column-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-column-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-column-group-collapsed-border-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-column-group-collapsed-border-expected.png
index 73c7b56..c07615146 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-column-group-collapsed-border-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-column-group-collapsed-border-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-column-group-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-column-group-expected.png
index dbafb5ca..ff7e21e 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-column-group-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-column-group-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-expected.png
index 2582f37..e2a5679 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-row-collapsed-border-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-row-collapsed-border-expected.png
index 38f6d2a..f4b956c 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-row-collapsed-border-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-row-collapsed-border-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-row-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-row-expected.png
index 12813bf..26d07b9 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-row-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-row-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-row-group-collapsed-border-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-row-group-collapsed-border-expected.png
index da90308..48c13d49 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-row-group-collapsed-border-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-row-group-collapsed-border-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-row-group-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-row-group-expected.png
index d489e199..1cf8b1c 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-row-group-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/backgr_simple-table-row-group-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/border-collapsing/004-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/border-collapsing/004-expected.png
new file mode 100644
index 0000000..65b48aee
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/border-collapsing/004-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/border-collapsing/rtl-border-collapsing-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/border-collapsing/rtl-border-collapsing-expected.png
new file mode 100644
index 0000000..5217860
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/border-collapsing/rtl-border-collapsing-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/border-collapsing/rtl-border-collapsing-vertical-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/border-collapsing/rtl-border-collapsing-vertical-expected.png
new file mode 100644
index 0000000..b1c8608
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/border-collapsing/rtl-border-collapsing-vertical-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/split-table-section-before-anonymous-block-3-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/split-table-section-before-anonymous-block-3-expected.png
index 48a9a29..e8495f43 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/split-table-section-before-anonymous-block-3-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/split-table-section-before-anonymous-block-3-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/split-table-section-before-anonymous-block-4-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/split-table-section-before-anonymous-block-4-expected.png
index 65173ee..8a47830 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/split-table-section-before-anonymous-block-4-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/table/split-table-section-before-anonymous-block-4-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/atomic-inline-before-ellipsis-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/atomic-inline-before-ellipsis-expected.png
new file mode 100644
index 0000000..7b89e1f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/atomic-inline-before-ellipsis-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/basic/007-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/basic/007-expected.png
new file mode 100644
index 0000000..4cf62d0
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/basic/007-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/basic/009-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/basic/009-expected.png
index 5936b5b..9fec56a4 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/basic/009-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/basic/009-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/basic/013-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/basic/013-expected.png
new file mode 100644
index 0000000..ae024db
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/basic/013-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/basic/015-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/basic/015-expected.png
index be87955..6b5efbc1 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/basic/015-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/basic/015-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/capitalize-boundaries-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/capitalize-boundaries-expected.png
index aa2ab107..9ad5491 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/capitalize-boundaries-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/capitalize-boundaries-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/color-emoji-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/color-emoji-expected.png
index 6693c97..393c0cf2 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/color-emoji-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/color-emoji-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/ellipsis-at-edge-of-ltr-text-in-rtl-flow-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/ellipsis-at-edge-of-ltr-text-in-rtl-flow-expected.png
index 4deb838..02340d3 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/ellipsis-at-edge-of-ltr-text-in-rtl-flow-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/ellipsis-at-edge-of-ltr-text-in-rtl-flow-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/fake-italic-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/fake-italic-expected.png
new file mode 100644
index 0000000..63c976aa
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/fake-italic-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/fallback-for-custom-font-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/fallback-for-custom-font-expected.png
new file mode 100644
index 0000000..f50c4f2
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/fallback-for-custom-font-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/font-features/caps-native-synthesis-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/font-features/caps-native-synthesis-expected.png
index 88dc3ed7..c5bb4f7 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/font-features/caps-native-synthesis-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/font-features/caps-native-synthesis-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/font-stretch-variant-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/font-stretch-variant-expected.png
index 9ccd73b..362d8566 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/font-stretch-variant-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/font-stretch-variant-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-CS-after-AN-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-CS-after-AN-expected.png
new file mode 100644
index 0000000..31355e17
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-CS-after-AN-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-LDB-2-CSS-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-LDB-2-CSS-expected.png
index 61c08a5e..93086592 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-LDB-2-CSS-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-LDB-2-CSS-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-LDB-2-HTML-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-LDB-2-HTML-expected.png
index cf54d44..d5d36be 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-LDB-2-HTML-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-LDB-2-HTML-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-LDB-2-formatting-characters-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-LDB-2-formatting-characters-expected.png
index 18da868..841f7fa 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-LDB-2-formatting-characters-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-LDB-2-formatting-characters-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-ignored-for-first-child-inline-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-ignored-for-first-child-inline-expected.png
index 1c02e705..047333c6 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-ignored-for-first-child-inline-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-ignored-for-first-child-inline-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-innertext-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-innertext-expected.png
new file mode 100644
index 0000000..8a0799f0
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-innertext-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-linebreak-001-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-linebreak-001-expected.png
new file mode 100644
index 0000000..5b65a44
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-linebreak-001-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-listbox-atsui-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-listbox-atsui-expected.png
new file mode 100644
index 0000000..5feba07
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-listbox-atsui-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-mirror-he-ar-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-mirror-he-ar-expected.png
new file mode 100644
index 0000000..16a0606d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-mirror-he-ar-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-neutral-directionality-paragraph-start-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-neutral-directionality-paragraph-start-expected.png
new file mode 100644
index 0000000..34c88ac8
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/bidi-neutral-directionality-paragraph-start-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/plane2-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/plane2-expected.png
index b38ceae7..38e49b93 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/plane2-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/plane2-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/thai-baht-space-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/thai-baht-space-expected.png
index 139d446..d08959e0 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/thai-baht-space-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/thai-baht-space-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/unicode-bidi-plaintext-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/unicode-bidi-plaintext-expected.png
new file mode 100644
index 0000000..8b1552f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/unicode-bidi-plaintext-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/wrap-CJK-001-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/wrap-CJK-001-expected.png
index 5eb4da5..d3aec8a 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/wrap-CJK-001-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/international/wrap-CJK-001-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/justify-ideograph-complex-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/justify-ideograph-complex-expected.png
index 9bcb87a..7813dbe7 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/justify-ideograph-complex-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/justify-ideograph-complex-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/justify-ideograph-simple-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/justify-ideograph-simple-expected.png
index 9bcb87a..7813dbe7 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/justify-ideograph-simple-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/justify-ideograph-simple-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/justify-ideograph-vertical-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/justify-ideograph-vertical-expected.png
index 0ec58ce4..217747a 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/justify-ideograph-vertical-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/justify-ideograph-vertical-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/orientation-sideways-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/orientation-sideways-expected.png
index 6b9f9f9..b3b3150 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/orientation-sideways-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/orientation-sideways-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/shaping/same-script-different-lang-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/shaping/same-script-different-lang-expected.png
index 8635c83..4a01bb1 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/shaping/same-script-different-lang-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/shaping/same-script-different-lang-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/stroking-decorations-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/stroking-decorations-expected.png
index c6d9f9a..5c2b906 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/stroking-decorations-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/stroking-decorations-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/sub-pixel/text-scaling-pixel-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/sub-pixel/text-scaling-pixel-expected.png
index 3929f057..4979ed0c 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/sub-pixel/text-scaling-pixel-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/sub-pixel/text-scaling-pixel-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/text-letter-spacing-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/text-letter-spacing-expected.png
new file mode 100644
index 0000000..13d0b16d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/text-letter-spacing-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/trailing-white-space-2-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/trailing-white-space-2-expected.png
index b392835..398f3d61 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/trailing-white-space-2-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/trailing-white-space-2-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/trailing-white-space-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/trailing-white-space-expected.png
index 66d5b49..1892d08 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/trailing-white-space-expected.png
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/trailing-white-space-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/whitespace/028-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/whitespace/028-expected.png
new file mode 100644
index 0000000..aad3b2c
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/whitespace/028-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/word-space-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/word-space-expected.png
new file mode 100644
index 0000000..d7ccf0f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/text/word-space-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/xsl/xslt-extra-content-at-end-expected.png b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/xsl/xslt-extra-content-at-end-expected.png
new file mode 100644
index 0000000..c1ef326
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/xsl/xslt-extra-content-at-end-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/xsl/xslt-extra-content-at-end-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/xsl/xslt-extra-content-at-end-expected.txt
new file mode 100644
index 0000000..77c834f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-blink-features=LayoutNG/fast/xsl/xslt-extra-content-at-end-expected.txt
@@ -0,0 +1,23 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x264
+  LayoutNGBlockFlow {html} at (0,0) size 800x263.88
+    LayoutNGBlockFlow {parsererror} at (16,16) size 768x195.88 [bgcolor=#FFDDDD] [border: (2px solid #CC7777)]
+      LayoutNGBlockFlow {h3} at (18,20.72) size 732x23
+        LayoutText {#text} at (0,0) size 324x22
+          text run at (0,0) width 324: "This page contains the following errors:"
+      LayoutNGBlockFlow {div} at (18,62.44) size 732x15
+        LayoutText {#text} at (0,0) size 497x15
+          text run at (0,0) width 497: "error on line 1 at column 107: Extra content at the end of the document"
+          text run at (497,0) width 0: " "
+      LayoutNGBlockFlow {h3} at (18,96.16) size 732x23
+        LayoutText {#text} at (0,0) size 427x22
+          text run at (0,0) width 427: "Below is a rendering of the page up to the first error."
+      LayoutNGBlockFlow {p} at (18,137.88) size 732x40
+        LayoutText {#text} at (0,0) size 730x39
+          text run at (0,0) width 730: "This document was created as the result of an XSL transformation. The line and column numbers given are from the"
+          text run at (0,20) width 117: "transformed result."
+    LayoutNGBlockFlow {body} at (8,227.88) size 784x20
+      LayoutNGBlockFlow {p} at (0,0) size 784x20
+        LayoutText {#text} at (0,0) size 225x19
+          text run at (0,0) width 225: "You should see error text above this"
diff --git a/third_party/WebKit/LayoutTests/http/tests/devtools/security/origin-view-ct-compliance-expected.txt b/third_party/WebKit/LayoutTests/http/tests/devtools/security/origin-view-ct-compliance-expected.txt
new file mode 100644
index 0000000..af134f2d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/devtools/security/origin-view-ct-compliance-expected.txt
@@ -0,0 +1,166 @@
+Tests that the panel includes Certificate Transparency compliance status
+
+Panel on origin view:
+<DIV class=widget vbox security-origin-view insertion-point-main >
+    <STYLE type=text/css >
+    </STYLE>
+    <STYLE type=text/css >
+    </STYLE>
+    <DIV class=title-section >
+        <DIV class=title-section-header >
+Origin
+        </DIV>
+        <DIV class=origin-display >
+            <SPAN class=security-property security-property-secure >
+            </SPAN>
+            <SPAN is=url-text >
+                <SPAN class=url-scheme-secure >
+https
+                </SPAN>
+                <SPAN class=url-scheme-separator >
+://
+                </SPAN>
+                <SPAN >
+foo.test
+                </SPAN>
+            </SPAN>
+        </DIV>
+        <DIV class=view-network-button >
+            <BUTTON is=text-button type=button class=origin-button >
+View requests in Network Panel
+                <#document-fragment >
+                    <STYLE type=text/css >
+                    </STYLE>
+                    <STYLE type=text/css >
+                    </STYLE>
+                    <STYLE type=text/css >
+                    </STYLE>
+                    <CONTENT >
+                    </CONTENT>
+                </#document-fragment>
+            </BUTTON>
+        </DIV>
+    </DIV>
+    <DIV class=origin-view-section >
+        <DIV class=origin-view-section-title >
+Connection
+        </DIV>
+        <TABLE class=details-table >
+            <DIV class=details-table-row >
+                <DIV >
+Protocol
+                </DIV>
+                <DIV >
+TLS 1.2
+                </DIV>
+            </DIV>
+            <DIV class=details-table-row >
+                <DIV >
+Key exchange
+                </DIV>
+                <DIV >
+Key_Exchange
+                </DIV>
+            </DIV>
+            <DIV class=details-table-row >
+                <DIV >
+Cipher
+                </DIV>
+                <DIV >
+Cypher with Mac
+                </DIV>
+            </DIV>
+        </TABLE>
+    </DIV>
+    <DIV class=origin-view-section >
+        <DIV class=origin-view-section-title >
+Certificate
+        </DIV>
+        <TABLE class=details-table >
+            <DIV class=details-table-row >
+                <DIV >
+Subject
+                </DIV>
+                <DIV >
+foo.test
+                </DIV>
+            </DIV>
+            <DIV class=details-table-row >
+                <DIV >
+SAN
+                </DIV>
+                <DIV >
+                    <DIV >
+                        <SPAN class=san-entry >
+foo.test
+                        </SPAN>
+                        <SPAN class=san-entry >
+*.test
+                        </SPAN>
+                    </DIV>
+                </DIV>
+            </DIV>
+            <DIV class=details-table-row >
+                <DIV >
+Valid from
+                </DIV>
+                <DIV >
+Mon, 20 Mar 2017 08:53:20 GMT
+                </DIV>
+            </DIV>
+            <DIV class=details-table-row >
+                <DIV >
+Valid until
+                </DIV>
+                <DIV >
+Wed, 18 May 2033 03:33:20 GMT
+                </DIV>
+            </DIV>
+            <DIV class=details-table-row >
+                <DIV >
+Issuer
+                </DIV>
+                <DIV >
+Super CA
+                </DIV>
+            </DIV>
+            <DIV class=details-table-row >
+                <DIV >
+                </DIV>
+                <DIV >
+                    <BUTTON is=text-button type=button class=origin-button >
+Open full certificate details
+                        <#document-fragment >
+                            <STYLE type=text/css >
+                            </STYLE>
+                            <STYLE type=text/css >
+                            </STYLE>
+                            <STYLE type=text/css >
+                            </STYLE>
+                            <CONTENT >
+                            </CONTENT>
+                        </#document-fragment>
+                    </BUTTON>
+                </DIV>
+            </DIV>
+        </TABLE>
+    </DIV>
+    <DIV class=origin-view-section >
+        <DIV class=origin-view-section-title >
+Certificate Transparency
+        </DIV>
+        <TABLE class=details-table sct-summary >
+        </TABLE>
+        <DIV class=sct-details hidden >
+        </DIV>
+        <DIV class=origin-view-section-notes >
+This request complies with Chrome's Certificate Transparency policy.
+        </DIV>
+    </DIV>
+    <DIV class=origin-view-section origin-view-notes >
+        <DIV >
+The security details above are from the first inspected response.
+        </DIV>
+    </DIV>
+</DIV>
+
diff --git a/third_party/WebKit/LayoutTests/http/tests/devtools/security/origin-view-ct-compliance.js b/third_party/WebKit/LayoutTests/http/tests/devtools/security/origin-view-ct-compliance.js
new file mode 100644
index 0000000..6e61a22
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/devtools/security/origin-view-ct-compliance.js
@@ -0,0 +1,36 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(async function() {
+  TestRunner.addResult(
+      `Tests that the panel includes Certificate Transparency compliance status\n`);
+  await TestRunner.loadModule('security_test_runner');
+  await TestRunner.showPanel('security');
+
+  var request1 = new SDK.NetworkRequest(0, 'https://foo.test/', 'https://foo.test', 0, 0, null);
+  request1.setSecurityState(Protocol.Security.SecurityState.Secure);
+  let securityDetails = {};
+  securityDetails.protocol = 'TLS 1.2';
+  securityDetails.keyExchange = 'Key_Exchange';
+  securityDetails.keyExchangeGroup = '';
+  securityDetails.cipher = 'Cypher';
+  securityDetails.mac = 'Mac';
+  securityDetails.subjectName = 'foo.test';
+  securityDetails.sanList = ['foo.test', '*.test'];
+  securityDetails.issuer = 'Super CA';
+  securityDetails.validFrom = 1490000000;
+  securityDetails.validTo = 2000000000;
+  securityDetails.CertificateId = 0;
+  securityDetails.signedCertificateTimestampList = [];
+  securityDetails.certificateTransparencyCompliance = Protocol.Network.CertificateTransparencyCompliance.Compliant;
+  request1.setSecurityDetails(securityDetails);
+  SecurityTestRunner.dispatchRequestFinished(request1);
+
+  Security.SecurityPanel._instance()._sidebarTree._elementsByOrigin.get('https://foo.test').select();
+
+  TestRunner.addResult('Panel on origin view:');
+  TestRunner.dumpDeepInnerHTML(Security.SecurityPanel._instance()._visibleView.contentElement);
+
+  TestRunner.completeTest();
+})();
diff --git a/third_party/WebKit/LayoutTests/http/tests/devtools/security/security-details-updated-with-security-state.js b/third_party/WebKit/LayoutTests/http/tests/devtools/security/security-details-updated-with-security-state.js
index a6c7be2..9cadf97 100644
--- a/third_party/WebKit/LayoutTests/http/tests/devtools/security/security-details-updated-with-security-state.js
+++ b/third_party/WebKit/LayoutTests/http/tests/devtools/security/security-details-updated-with-security-state.js
@@ -33,6 +33,7 @@
   securityDetails.validTo = 2000000000;
   securityDetails.CertificateId = 0;
   securityDetails.signedCertificateTimestampList = [];
+  securityDetails.certificateTransparencyCompliance = Protocol.Network.CertificateTransparencyCompliance.Unknown;
   request3.setSecurityDetails(securityDetails);
   SecurityTestRunner.dispatchRequestFinished(request3);
 
diff --git a/third_party/WebKit/LayoutTests/http/tests/devtools/tracing/buffer-usage.js b/third_party/WebKit/LayoutTests/http/tests/devtools/tracing/buffer-usage.js
index 7499491..99c57c7 100644
--- a/third_party/WebKit/LayoutTests/http/tests/devtools/tracing/buffer-usage.js
+++ b/third_party/WebKit/LayoutTests/http/tests/devtools/tracing/buffer-usage.js
@@ -8,42 +8,41 @@
   await TestRunner.loadModule('performance_test_runner');
   await TestRunner.showPanel('timeline');
 
-  TestTimelineControllerClient = function() {
-    this._hadLoadingProgress = false;
-  };
+  class TestTimelineControllerClient {
+    constructor() {
+      this._hadLoadingProgress = false;
+    }
 
-  TestTimelineControllerClient.prototype = {
-    recordingProgress: function() {
+    recordingProgress() {
       if (!controller)
         return;
       TestRunner.addResult('TimelineControllerClient.recordingProgress');
       controller.stopRecording();
       controller = null;
-    },
+    }
 
-    loadingStarted: function() {
+    loadingStarted() {
       TestRunner.addResult('TimelineControllerClient.loadingStarted');
-    },
+    }
 
-    loadingProgress: function() {
+    loadingProgress() {
       if (this._hadLoadingProgress)
         return;
       this._hadLoadingProgress = true;
       TestRunner.addResult('TimelineControllerClient.loadingProgress');
-    },
+    }
 
-    processingStarted: function() {
+    processingStarted() {
       TestRunner.addResult('TimelineControllerClient.processingStarted');
-    },
+    }
 
-    loadingComplete: function() {
+    loadingComplete() {
       TestRunner.addResult('TimelineControllerClient.loadingComplete');
       TestRunner.completeTest();
     }
   };
-  var performanceModel = new Timeline.PerformanceModel();
-  var controller =
-      new Timeline.TimelineController(TestRunner.tracingManager, performanceModel, new TestTimelineControllerClient());
+
+  let controller = new Timeline.TimelineController(SDK.targetManager.mainTarget(), new TestTimelineControllerClient());
   controller.startRecording({}, []).then(() => {
     TestRunner.addResult('TimelineControllerClient.recordingStarted');
   });
diff --git a/third_party/WebKit/LayoutTests/http/tests/devtools/tracing/trace-event-self-time.js b/third_party/WebKit/LayoutTests/http/tests/devtools/tracing/trace-event-self-time.js
index cdafe59..8804f403 100644
--- a/third_party/WebKit/LayoutTests/http/tests/devtools/tracing/trace-event-self-time.js
+++ b/third_party/WebKit/LayoutTests/http/tests/devtools/tracing/trace-event-self-time.js
@@ -236,11 +236,11 @@
     samples: [2, 2, 3, 3, 3, 4, 4, 2, 2]
   };
 
-  var timelineController = PerformanceTestRunner.timelineController();
+  var timelineController = PerformanceTestRunner.createTimelineController();
   timelineController._addCpuProfile(SDK.targetManager.mainTarget().id(), cpuProfile);
   timelineController.traceEventsCollected(rawTraceEvents);
   timelineController._finalizeTrace();
-  var events = timelineController._performanceModel.timelineModel().inspectedTargetEvents();
+  var events = UI.panels.timeline._performanceModel.timelineModel().inspectedTargetEvents();
   events.forEach(
       e => TestRunner.addResult(
           `${e.name}: ${e.startTime} ${(e.selfTime || 0).toFixed(2)}/${(e.duration || 0).toFixed(2)}`));
diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/page/page-navigatedWithinDocument-expected.txt b/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/page/page-navigatedWithinDocument-expected.txt
new file mode 100644
index 0000000..41e6e6a6
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/page/page-navigatedWithinDocument-expected.txt
@@ -0,0 +1,50 @@
+Tests that Page.navigateWithinDocument is issued for history API and anchor navigation.
+-- Test Page.navigate() to anchor URL --
+{
+    method : Page.navigatedWithinDocument
+    params : {
+        frameId : <string>
+        url : http://127.0.0.1:8000/inspector-protocol/resources/inspector-protocol-page.html#foo
+    }
+}
+-- Test Page.navigate() to another anchor URL --
+{
+    method : Page.navigatedWithinDocument
+    params : {
+        frameId : <string>
+        url : http://127.0.0.1:8000/inspector-protocol/resources/inspector-protocol-page.html#bar
+    }
+}
+-- Test history.pushState() --
+{
+    method : Page.navigatedWithinDocument
+    params : {
+        frameId : <string>
+        url : http://127.0.0.1:8000/inspector-protocol/resources/wow.html
+    }
+}
+-- Test history.replaceState() --
+{
+    method : Page.navigatedWithinDocument
+    params : {
+        frameId : <string>
+        url : http://127.0.0.1:8000/replaced.html
+    }
+}
+-- Test history.back() --
+{
+    method : Page.navigatedWithinDocument
+    params : {
+        frameId : <string>
+        url : http://127.0.0.1:8000/inspector-protocol/resources/inspector-protocol-page.html#bar
+    }
+}
+-- Test history.forward() --
+{
+    method : Page.navigatedWithinDocument
+    params : {
+        frameId : <string>
+        url : http://127.0.0.1:8000/replaced.html
+    }
+}
+
diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/page/page-navigatedWithinDocument.js b/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/page/page-navigatedWithinDocument.js
new file mode 100644
index 0000000..6aecf55
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/page/page-navigatedWithinDocument.js
@@ -0,0 +1,33 @@
+(async function(testRunner) {
+  var {page, session, dp} = await testRunner.startBlank(
+      `Tests that Page.navigateWithinDocument is issued for history API and anchor navigation.`);
+
+  await dp.Page.enable();
+  await dp.Runtime.enable();
+
+  testRunner.log('-- Test Page.navigate() to anchor URL --');
+  await dp.Page.navigate({url: testRunner.url('../resources/inspector-protocol-page.html#foo')});
+  testRunner.log(await dp.Page.onceNavigatedWithinDocument());
+
+  testRunner.log('-- Test Page.navigate() to another anchor URL --');
+  await dp.Page.navigate({url: testRunner.url('../resources/inspector-protocol-page.html#bar')});
+  testRunner.log(await dp.Page.onceNavigatedWithinDocument());
+
+  testRunner.log('-- Test history.pushState() --');
+  dp.Runtime.evaluate({ expression: `history.pushState({}, '', 'wow.html')`});
+  testRunner.log(await dp.Page.onceNavigatedWithinDocument());
+
+  testRunner.log('-- Test history.replaceState() --');
+  dp.Runtime.evaluate({ expression: `history.replaceState({}, '', '/replaced.html')`});
+  testRunner.log(await dp.Page.onceNavigatedWithinDocument());
+
+  testRunner.log('-- Test history.back() --');
+  dp.Runtime.evaluate({ expression: `history.back()`});
+  testRunner.log(await dp.Page.onceNavigatedWithinDocument());
+
+  testRunner.log('-- Test history.forward() --');
+  dp.Runtime.evaluate({ expression: `history.forward()`});
+  testRunner.log(await dp.Page.onceNavigatedWithinDocument());
+
+  testRunner.completeTest();
+})
diff --git a/third_party/WebKit/LayoutTests/http/tests/payments/payment-instruments.html b/third_party/WebKit/LayoutTests/http/tests/payments/payment-instruments.html
index 2a5f13d..7ceccbda 100644
--- a/third_party/WebKit/LayoutTests/http/tests/payments/payment-instruments.html
+++ b/third_party/WebKit/LayoutTests/http/tests/payments/payment-instruments.html
@@ -40,7 +40,7 @@
                     'purpose': 'any badge'
                   }
                 ],
-                enabledMethods: ['basic-card'],
+                method: 'basic-card',
                 capabilities: {
                   supportedNetworks: ['visa'],
                   supportedTypes: ['credit']
@@ -53,7 +53,7 @@
         })
       .then(stored_instrument => {
           assert_equals(stored_instrument.name, 'Visa ending ****4756');
-          assert_array_equals(stored_instrument.enabledMethods, ['basic-card']);
+          assert_equals(stored_instrument.method, 'basic-card');
           assert_equals(stored_instrument.icons.length, 2);
           assert_object_equals(stored_instrument.icons[0], {
               src: location.origin + '/payments/resources/icon-1x.png',
@@ -112,7 +112,7 @@
               'test_key',
               {
                 name: 'Visa ending ****4756',
-                enabledMethods: ['basic-card'],
+                method: 'basic-card',
                 capabilities: {
                   supportedNetworks: ['visa'],
                   supportedTypes: ['credit']
@@ -152,7 +152,7 @@
               'test_key',
               {
                 name: 'Visa ending ****4756',
-                enabledMethods: ['basic-card'],
+                method: 'basic-card',
                 capabilities: {
                   supportedNetworks: ['visa'],
                   supportedTypes: ['credit']
@@ -193,7 +193,7 @@
               'test_key1',
               {
                 name: 'Visa ending ****4756',
-                enabledMethods: ['basic-card'],
+                method: 'basic-card',
                 capabilities: {
                   supportedNetworks: ['visa'],
                   supportedTypes: ['credit']
@@ -203,7 +203,7 @@
               'test_key2',
               {
                 name: "My Bob Pay Account: john@example.com",
-                enabledMethods: ["https://bobpay.com/"]
+                method: "https://bobpay.com/"
               })
           ];
           return Promise.all(instruments);
@@ -238,7 +238,7 @@
               'test_key1',
               {
                 name: 'Visa ending ****4756',
-                enabledMethods: ['basic-card'],
+                method: 'basic-card',
                 capabilities: {
                   supportedNetworks: ['visa'],
                   supportedTypes: ['credit']
@@ -248,7 +248,7 @@
               'test_key2',
               {
                 name: "My Bob Pay Account: john@example.com",
-                enabledMethods: ["https://bobpay.com/"]
+                method: "https://bobpay.com/"
               })
           ];
           return Promise.all(instruments);
@@ -303,7 +303,7 @@
                     'purpose': 'any badge'
                   }
                 ],
-                enabledMethods: ['basic-card'],
+                method: 'basic-card',
                 capabilities: {
                   supportedNetworks: ['visa'],
                   supportedTypes: ['credit']
diff --git a/third_party/WebKit/LayoutTests/media/picture-in-picture/controls/picture-in-picture-video-with-audio-only-button.html b/third_party/WebKit/LayoutTests/media/picture-in-picture/controls/picture-in-picture-video-with-audio-only-button.html
new file mode 100644
index 0000000..fd98f032
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/media/picture-in-picture/controls/picture-in-picture-video-with-audio-only-button.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<title>media controls picture in picture button for a video element with only audio</title>
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+<script src="../../media-file.js"></script>
+<script src="../../media-controls.js"></script>
+<script src="../utils.js"></script>
+<body>
+<script>
+async_test(t => {
+    enablePictureInPictureForTest(t);
+
+    var video = document.createElement('video');
+    video.setAttribute('controls', '');
+    video.src = '../../content/test.wav';
+    document.body.appendChild(video);
+
+    video.onloadeddata = t.step_func_done(function() {
+        assertPictureInPictureButtonNotVisible(video);
+    });
+
+    video.onloadedmetadata = t.step_func(function() {
+        assertPictureInPictureButtonNotVisible(video);
+    });
+});
+</script>
+</body>
\ No newline at end of file
diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/5418891-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/5418891-expected.png
deleted file mode 100644
index 83bba44..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/5418891-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/5418891-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/5418891-expected.txt
deleted file mode 100644
index a4a64c1..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/5418891-expected.txt
+++ /dev/null
@@ -1,23 +0,0 @@
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {P} at (0,0) size 784x40
-        LayoutText {#text} at (0,0) size 772x39
-          text run at (0,0) width 536: "This tests for a crash when attempting to break a blockquote at the end of its content. "
-          text run at (536,0) width 236: "The caret should be in the first of two"
-          text run at (0,20) width 358: "empty paragraphs between two pieces of quoted content."
-      LayoutBlockFlow {DIV} at (0,56) size 784x80
-        LayoutBlockFlow {BLOCKQUOTE} at (0,0) size 784x20 [color=#0000FF] [border: none (2px solid #0000FF)]
-          LayoutBlockFlow {DIV} at (7,0) size 777x20
-            LayoutText {#text} at (0,0) size 21x19
-              text run at (0,0) width 21: "foo"
-        LayoutBlockFlow (anonymous) at (0,20) size 784x40
-          LayoutBR {BR} at (0,0) size 0x19
-          LayoutBR {BR} at (0,20) size 0x19
-        LayoutBlockFlow {BLOCKQUOTE} at (0,60) size 784x20 [color=#0000FF] [border: none (2px solid #0000FF)]
-          LayoutBlockFlow {DIV} at (7,0) size 777x20
-            LayoutText {#text} at (0,0) size 20x19
-              text run at (0,0) width 20: "bar"
-caret: position 0 of child 2 {BR} of child 2 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/inserting/5418891-expected.png b/third_party/WebKit/LayoutTests/platform/mac/editing/inserting/5418891-expected.png
deleted file mode 100644
index f8d1e0cc..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/inserting/5418891-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/inserting/5418891-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/editing/inserting/5418891-expected.txt
deleted file mode 100644
index 023b7f4..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/inserting/5418891-expected.txt
+++ /dev/null
@@ -1,23 +0,0 @@
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {P} at (0,0) size 784x36
-        LayoutText {#text} at (0,0) size 760x36
-          text run at (0,0) width 548: "This tests for a crash when attempting to break a blockquote at the end of its content. "
-          text run at (547,0) width 213: "The caret should be in the first of"
-          text run at (0,18) width 392: "two empty paragraphs between two pieces of quoted content."
-      LayoutBlockFlow {DIV} at (0,52) size 784x72
-        LayoutBlockFlow {BLOCKQUOTE} at (0,0) size 784x18 [color=#0000FF] [border: none (2px solid #0000FF)]
-          LayoutBlockFlow {DIV} at (7,0) size 777x18
-            LayoutText {#text} at (0,0) size 22x18
-              text run at (0,0) width 22: "foo"
-        LayoutBlockFlow (anonymous) at (0,18) size 784x36
-          LayoutBR {BR} at (0,0) size 0x18
-          LayoutBR {BR} at (0,18) size 0x18
-        LayoutBlockFlow {BLOCKQUOTE} at (0,54) size 784x18 [color=#0000FF] [border: none (2px solid #0000FF)]
-          LayoutBlockFlow {DIV} at (7,0) size 777x18
-            LayoutText {#text} at (0,0) size 21x18
-              text run at (0,0) width 21: "bar"
-caret: position 0 of child 2 {BR} of child 2 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/5418891-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/inserting/5418891-expected.png
deleted file mode 100644
index e8a621b..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/5418891-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/5418891-expected.txt b/third_party/WebKit/LayoutTests/platform/win/editing/inserting/5418891-expected.txt
deleted file mode 100644
index 1e90385..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/5418891-expected.txt
+++ /dev/null
@@ -1,23 +0,0 @@
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {P} at (0,0) size 784x40
-        LayoutText {#text} at (0,0) size 781x39
-          text run at (0,0) width 516: "This tests for a crash when attempting to break a blockquote at the end of its content. "
-          text run at (516,0) width 265: "The caret should be in the first of two empty"
-          text run at (0,20) width 305: "paragraphs between two pieces of quoted content."
-      LayoutBlockFlow {DIV} at (0,56) size 784x80
-        LayoutBlockFlow {BLOCKQUOTE} at (0,0) size 784x20 [color=#0000FF] [border: none (2px solid #0000FF)]
-          LayoutBlockFlow {DIV} at (7,0) size 777x20
-            LayoutText {#text} at (0,0) size 20x19
-              text run at (0,0) width 20: "foo"
-        LayoutBlockFlow (anonymous) at (0,20) size 784x40
-          LayoutBR {BR} at (0,0) size 0x19
-          LayoutBR {BR} at (0,20) size 0x19
-        LayoutBlockFlow {BLOCKQUOTE} at (0,60) size 784x20 [color=#0000FF] [border: none (2px solid #0000FF)]
-          LayoutBlockFlow {DIV} at (7,0) size 777x20
-            LayoutText {#text} at (0,0) size 20x19
-              text run at (0,0) width 20: "bar"
-caret: position 0 of child 2 {BR} of child 2 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/svg/text/select-text-vertical.html b/third_party/WebKit/LayoutTests/svg/text/select-text-vertical.html
new file mode 100644
index 0000000..0265f20
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/svg/text/select-text-vertical.html
@@ -0,0 +1,55 @@
+<!DOCTYPE html>
+<title>Selection of vertical text</title>
+<script src="../../resources/ahem.js"></script>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<style>body { margin: 0; }</style>
+<svg width="300" height="300">
+  <text id="text1" x="20" y="20" writing-mode="vertical-lr"
+        font-family="Ahem" font-size="20">MMMMM MMMMMMMM</text>
+</svg>
+<script>
+function selectText(start, end) {
+  let startPoint = { x: 10 + 10, y: 20 + start * 20 + 8 };
+  let endPoint = { x: 10 + 10, y: 20 + (end + 1) * 20 - 8 };
+
+  assert_exists(window, 'chrome');
+  assert_exists(window.chrome, 'gpuBenchmarking');
+  return new Promise(function(resolve, reject) {
+    chrome.gpuBenchmarking.pointerActionSequence(
+      [{
+        source: 'mouse',
+        actions: [
+          { name: 'pointerMove', x: startPoint.x, y: startPoint.y },
+          { name: 'pointerDown', x: startPoint.x, y: startPoint.y, button: 'left' },
+          { name: 'pointerMove', x: endPoint.x, y: endPoint.y },
+          { name: 'pointerUp', button: 'left' }
+        ]
+      }], resolve);
+  });
+}
+
+promise_test(function() {
+  return selectText(0, 0).then(() => {
+    var range = window.getSelection().getRangeAt(0);
+    assert_equals(range.startOffset, 0);
+    assert_equals(range.endOffset, 1);
+  });
+}, document.title+', start of text');
+
+promise_test(function() {
+  return selectText(4, 7).then(() => {
+    var range = window.getSelection().getRangeAt(0);
+    assert_equals(range.startOffset, 4);
+    assert_equals(range.endOffset, 8);
+  });
+}, document.title+', middle of text');
+
+promise_test(function() {
+  return selectText(13, 13).then(() => {
+    var range = window.getSelection().getRangeAt(0);
+    assert_equals(range.startOffset, 13);
+    assert_equals(range.endOffset, 14);
+  });
+}, document.title+', end of text');
+</script>
diff --git a/third_party/WebKit/LayoutTests/webexposed/element-instance-property-listing-expected.txt b/third_party/WebKit/LayoutTests/webexposed/element-instance-property-listing-expected.txt
index 373cb61f..81b9e3ba 100644
--- a/third_party/WebKit/LayoutTests/webexposed/element-instance-property-listing-expected.txt
+++ b/third_party/WebKit/LayoutTests/webexposed/element-instance-property-listing-expected.txt
@@ -147,6 +147,7 @@
     property onended
     property onerror
     property onfocus
+    property onformdata
     property onfullscreenchange
     property onfullscreenerror
     property ongotpointercapture
@@ -1250,6 +1251,7 @@
     property onended
     property onerror
     property onfocus
+    property onformdata
     property onfullscreenchange
     property onfullscreenerror
     property ongotpointercapture
diff --git a/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt b/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt
index 645099f..bce2a68f 100644
--- a/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt
+++ b/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt
@@ -1516,6 +1516,7 @@
     getter onended
     getter onerror
     getter onfocus
+    getter onformdata
     getter onfullscreenchange
     getter onfullscreenerror
     getter ongotpointercapture
@@ -1702,6 +1703,7 @@
     setter onended
     setter onerror
     setter onfocus
+    setter onformdata
     setter onfullscreenchange
     setter onfullscreenerror
     setter ongotpointercapture
@@ -2081,6 +2083,10 @@
     method keys
     method set
     method values
+interface FormDataEvent : Event
+    attribute @@toStringTag
+    getter formData
+    method constructor
 interface GainNode : AudioNode
     attribute @@toStringTag
     getter gain
@@ -2457,6 +2463,7 @@
     getter onended
     getter onerror
     getter onfocus
+    getter onformdata
     getter ongotpointercapture
     getter oninput
     getter oninvalid
@@ -2552,6 +2559,7 @@
     setter onended
     setter onerror
     setter onfocus
+    setter onformdata
     setter ongotpointercapture
     setter oninput
     setter oninvalid
@@ -5684,6 +5692,7 @@
     getter onended
     getter onerror
     getter onfocus
+    getter onformdata
     getter ongotpointercapture
     getter oninput
     getter oninvalid
@@ -5766,6 +5775,7 @@
     setter onended
     setter onerror
     setter onfocus
+    setter onformdata
     setter ongotpointercapture
     setter oninput
     setter oninvalid
@@ -9325,6 +9335,7 @@
     getter onended
     getter onerror
     getter onfocus
+    getter onformdata
     getter onfreeze
     getter ongotpointercapture
     getter onhashchange
@@ -9510,6 +9521,7 @@
     setter onended
     setter onerror
     setter onfocus
+    setter onformdata
     setter onfreeze
     setter ongotpointercapture
     setter onhashchange
diff --git a/third_party/WebKit/Source/bindings/idl.gni b/third_party/WebKit/Source/bindings/idl.gni
deleted file mode 100644
index 98aa2cf..0000000
--- a/third_party/WebKit/Source/bindings/idl.gni
+++ /dev/null
@@ -1,23 +0,0 @@
-# Copyright 2014 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-import("//third_party/WebKit/Source/bindings/bindings.gni")
-
-# Global constructors
-# FIXME: Split into core vs. modules http://crbug.com/358074
-generated_global_constructors_idl_files = [
-  "$blink_output_dir/WindowConstructors.idl",
-  "$blink_output_dir/SharedWorkerGlobalScopeConstructors.idl",
-  "$blink_output_dir/DedicatedWorkerGlobalScopeConstructors.idl",
-  "$blink_output_dir/ServiceWorkerGlobalScopeConstructors.idl",
-  "$blink_output_dir/PaintWorkletGlobalScopeConstructors.idl",
-]
-
-generated_global_constructors_header_files = [
-  "$blink_output_dir/WindowConstructors.h",
-  "$blink_output_dir/SharedWorkerGlobalScopeConstructors.h",
-  "$blink_output_dir/DedicatedWorkerGlobalScopeConstructors.h",
-  "$blink_output_dir/ServiceWorkerGlobalScopeConstructors.h",
-  "$blink_output_dir/PaintWorkletGlobalScopeConstructors.h",
-]
diff --git a/third_party/WebKit/Source/core/css/CSSProperties.json5 b/third_party/WebKit/Source/core/css/CSSProperties.json5
index 1ba72c0..beeae42 100644
--- a/third_party/WebKit/Source/core/css/CSSProperties.json5
+++ b/third_party/WebKit/Source/core/css/CSSProperties.json5
@@ -774,16 +774,29 @@
       name: "background-attachment",
       property_methods: ["ParseSingleValue", "CSSValueFromComputedStyleInternal"],
       custom_apply_functions_all: true,
+      keywords: ["scroll", "fixed", "local"],
+      typedom_types: ["Keyword"],
+      separator: " "
     },
     {
       name: "background-blend-mode",
       property_methods: ["ParseSingleValue", "CSSValueFromComputedStyleInternal"],
       custom_apply_functions_all: true,
+      keywords: [
+        "normal", "multiply", "screen", "overlay", "darken", "lighten",
+        "color-dodge", "color-burn", "hard-light", "soft-light", "difference",
+        "exclusion", "hue", "saturation", "color", "luminosity"
+      ],
+      typedom_types: ["Keyword"],
+      separator: " "
     },
     {
       name: "background-clip",
       property_methods: ["ParseSingleValue", "CSSValueFromComputedStyleInternal"],
       custom_apply_functions_all: true,
+      keywords: ["border-box", "padding-box", "content-box"],
+      typedom_types: ["Keyword"],
+      separator: " "
     },
     {
       name: "background-color",
@@ -812,6 +825,9 @@
       name: "background-origin",
       property_methods: ["ParseSingleValue", "CSSValueFromComputedStyleInternal"],
       custom_apply_functions_all: true,
+      keywords: ["border-box", "padding-box", "content-box"],
+      typedom_types: ["Keyword"],
+      separator: " "
     },
     {
       name: "background-position-x",
@@ -838,6 +854,9 @@
       property_methods: ["ParseSingleValue", "CSSValueFromComputedStyleInternal"],
       interpolable: true,
       custom_apply_functions_all: true,
+      keywords: ["auto", "cover", "contain"],
+      typedom_types: ["Keyword", "Length", "Percentage"],
+      separator: " "
     },
     {
       name: "baseline-shift",
@@ -871,6 +890,7 @@
       default_value: "LengthSize(Length(0, kFixed), Length(0, kFixed))",
       type_name: "LengthSize",
       converter: "ConvertRadius",
+      typedom_types: ["Length", "Percentage"],
     },
     {
       name: "border-bottom-right-radius",
@@ -882,6 +902,7 @@
       default_value: "LengthSize(Length(0, kFixed), Length(0, kFixed))",
       type_name: "LengthSize",
       converter: "ConvertRadius",
+      typedom_types: ["Length", "Percentage"],
     },
     {
       name: "border-bottom-style",
@@ -925,17 +946,21 @@
       property_methods: ["ParseSingleValue", "CSSValueFromComputedStyleInternal"],
       interpolable: true,
       custom_apply_functions_all: true,
+      typedom_types: ["Length", "Number"]
     },
     {
       name: "border-image-repeat",
       property_methods: ["ParseSingleValue", "CSSValueFromComputedStyleInternal"],
       custom_apply_functions_all: true,
+      keywords: ["stretch", "repeat", "round", "space"],
+      typedom_types: ["Keyword"]
     },
     {
       name: "border-image-slice",
       property_methods: ["ParseSingleValue", "CSSValueFromComputedStyleInternal"],
       interpolable: true,
       custom_apply_functions_all: true,
+      typedom_types: ["Number", "Percentage"],
     },
     {
       name: "border-image-source",
@@ -950,6 +975,8 @@
       property_methods: ["ParseSingleValue", "CSSValueFromComputedStyleInternal"],
       interpolable: true,
       custom_apply_functions_all: true,
+      keywords: ["auto"],
+      typedom_types: ["Keyword", "Length", "Percentage", "Number"],
     },
     {
       name: "border-left-color",
@@ -1057,6 +1084,7 @@
       default_value: "LengthSize(Length(0, kFixed), Length(0, kFixed))",
       type_name: "LengthSize",
       converter: "ConvertRadius",
+      typedom_types: ["Length", "Percentage"],
     },
     {
       name: "border-top-right-radius",
@@ -1068,6 +1096,7 @@
       default_value: "LengthSize(Length(0, kFixed), Length(0, kFixed))",
       type_name: "LengthSize",
       converter: "ConvertRadius",
+      typedom_types: ["Length", "Percentage"],
     },
     {
       name: "border-top-style",
diff --git a/third_party/WebKit/Source/core/css/CSSValuePair.h b/third_party/WebKit/Source/core/css/CSSValuePair.h
index d06756d..cfdf198 100644
--- a/third_party/WebKit/Source/core/css/CSSValuePair.h
+++ b/third_party/WebKit/Source/core/css/CSSValuePair.h
@@ -40,6 +40,10 @@
   const CSSValue& First() const { return *first_; }
   const CSSValue& Second() const { return *second_; }
 
+  bool KeepIdenticalValues() const {
+    return identical_values_policy_ == kKeepIdenticalValues;
+  };
+
   String CustomCSSText() const {
     String first = first_->CssText();
     String second = second_->CssText();
diff --git a/third_party/WebKit/Source/core/css/cssom/StylePropertyMap.cpp b/third_party/WebKit/Source/core/css/cssom/StylePropertyMap.cpp
index 6a63cb6..945ae5b 100644
--- a/third_party/WebKit/Source/core/css/cssom/StylePropertyMap.cpp
+++ b/third_party/WebKit/Source/core/css/cssom/StylePropertyMap.cpp
@@ -7,6 +7,7 @@
 #include "bindings/core/v8/ExceptionState.h"
 #include "core/css/CSSIdentifierValue.h"
 #include "core/css/CSSValueList.h"
+#include "core/css/CSSValuePair.h"
 #include "core/css/cssom/CSSOMTypes.h"
 #include "core/css/cssom/CSSStyleValue.h"
 #include "core/css/cssom/StyleValueFactory.h"
@@ -53,6 +54,19 @@
   // TODO(https://crbug.com/545324): Move this into a method on
   // CSSProperty when there are more of these cases.
   switch (property_id) {
+    case CSSPropertyBorderBottomLeftRadius:
+    case CSSPropertyBorderBottomRightRadius:
+    case CSSPropertyBorderTopLeftRadius:
+    case CSSPropertyBorderTopRightRadius: {
+      // level 1 only accept single <length-percentages>, but border-radius-*
+      // expects pairs.
+      const auto* value = style_value.ToCSSValue();
+      if (value->IsPrimitiveValue()) {
+        return CSSValuePair::Create(value, value,
+                                    CSSValuePair::kDropIdenticalValues);
+      }
+      break;
+    }
     case CSSPropertyGridAutoFlow: {
       // level 1 only accepts single keywords
       const auto* value = style_value.ToCSSValue();
diff --git a/third_party/WebKit/Source/core/css/cssom/StyleValueFactory.cpp b/third_party/WebKit/Source/core/css/cssom/StyleValueFactory.cpp
index fca7c45..cf0d899 100644
--- a/third_party/WebKit/Source/core/css/cssom/StyleValueFactory.cpp
+++ b/third_party/WebKit/Source/core/css/cssom/StyleValueFactory.cpp
@@ -8,6 +8,7 @@
 #include "core/css/CSSIdentifierValue.h"
 #include "core/css/CSSImageValue.h"
 #include "core/css/CSSValue.h"
+#include "core/css/CSSValuePair.h"
 #include "core/css/CSSVariableReferenceValue.h"
 #include "core/css/cssom/CSSKeywordValue.h"
 #include "core/css/cssom/CSSNumericValue.h"
@@ -45,6 +46,19 @@
   // FIXME: We should enforce/document what the possible CSSValue structures
   // are for each property.
   switch (property_id) {
+    case CSSPropertyBorderBottomLeftRadius:
+    case CSSPropertyBorderBottomRightRadius:
+    case CSSPropertyBorderTopLeftRadius:
+    case CSSPropertyBorderTopRightRadius: {
+      // border-radius-* are always stored as pairs, but when both values are
+      // the same, we should reify as a single value.
+      if (const CSSValuePair* pair = ToCSSValuePairOrNull(value)) {
+        if (pair->First() == pair->Second() && !pair->KeepIdenticalValues()) {
+          return CreateStyleValue(pair->First());
+        }
+      }
+      return nullptr;
+    }
     case CSSPropertyCaretColor:
       // caret-color also supports 'auto'
       if (value.IsIdentifierValue() &&
diff --git a/third_party/WebKit/Source/core/editing/InlineBoxPosition.cpp b/third_party/WebKit/Source/core/editing/InlineBoxPosition.cpp
index 43b82b02..f20216d 100644
--- a/third_party/WebKit/Source/core/editing/InlineBoxPosition.cpp
+++ b/third_party/WebKit/Source/core/editing/InlineBoxPosition.cpp
@@ -93,6 +93,15 @@
   return prev_box->BidiLevel() > inline_box->BidiLevel();
 }
 
+// TODO(editing-dev): This function is almost identical to
+// |IsStartOfDifferentDirection|. Try to unify them.
+bool IsEndOfDifferentDirection(const InlineBox* inline_box) {
+  const InlineBox* const next_box = inline_box->NextLeafChild();
+  if (!next_box)
+    return true;
+  return next_box->BidiLevel() >= inline_box->BidiLevel();
+}
+
 template <typename Strategy>
 PositionTemplate<Strategy> DownstreamIgnoringEditingBoundaries(
     PositionTemplate<Strategy> position) {
@@ -119,11 +128,10 @@
     InlineBox* inline_box,
     int caret_offset) {
   if (caret_offset == inline_box->CaretRightmostOffset()) {
-    InlineBox* const next_box = inline_box->NextLeafChild();
-    if (!next_box || next_box->BidiLevel() >= inline_box->BidiLevel())
+    if (IsEndOfDifferentDirection(inline_box))
       return InlineBoxPosition(inline_box, caret_offset);
 
-    const unsigned level = next_box->BidiLevel();
+    const unsigned level = inline_box->NextLeafChild()->BidiLevel();
     InlineBox* const prev_box =
         InlineBoxTraversal::FindLeftBidiRun(*inline_box, level);
 
@@ -157,6 +165,9 @@
     InlineBox* inline_box,
     int caret_offset,
     UnicodeBidi unicode_bidi) {
+  DCHECK(caret_offset == inline_box->CaretLeftmostOffset() ||
+         caret_offset == inline_box->CaretRightmostOffset());
+
   const TextDirection primary_direction =
       inline_box->Root().Block().Style()->Direction();
   if (inline_box->Direction() == primary_direction)
diff --git a/third_party/WebKit/Source/core/exported/WebSharedWorkerImpl.cpp b/third_party/WebKit/Source/core/exported/WebSharedWorkerImpl.cpp
index 18bb386..a67c60e 100644
--- a/third_party/WebKit/Source/core/exported/WebSharedWorkerImpl.cpp
+++ b/third_party/WebKit/Source/core/exported/WebSharedWorkerImpl.cpp
@@ -76,7 +76,8 @@
 WebSharedWorkerImpl::WebSharedWorkerImpl(WebSharedWorkerClient* client)
     : worker_inspector_proxy_(WorkerInspectorProxy::Create()),
       client_(client),
-      creation_address_space_(mojom::IPAddressSpace::kPublic) {
+      creation_address_space_(mojom::IPAddressSpace::kPublic),
+      weak_ptr_factory_(this) {
   DCHECK(IsMainThread());
 }
 
@@ -255,6 +256,29 @@
     return;
   }
 
+  // S13nServiceWorker: The browser process is expected to send a
+  // SetController IPC before sending the script response, but there is no
+  // guarantee of the ordering as the messages arrive on different message
+  // pipes. Wait for the SetController IPC to be received before starting the
+  // worker; otherwise fetches from the worker might not go through the
+  // appropriate controller.
+  //
+  // (For non-S13nServiceWorker, we don't need to do this step as the controller
+  // service worker isn't used directly by the renderer, but to minimize code
+  // differences between the flags just do it anyway.)
+  client_->WaitForServiceWorkerControllerInfo(
+      shadow_page_->DocumentLoader()->GetServiceWorkerNetworkProvider(),
+      WTF::Bind(&WebSharedWorkerImpl::ContinueOnScriptLoaderFinished,
+                weak_ptr_factory_.GetWeakPtr()));
+}
+
+void WebSharedWorkerImpl::ContinueOnScriptLoaderFinished() {
+  DCHECK(IsMainThread());
+  DCHECK(main_script_loader_);
+  DCHECK(!main_script_loader_->Failed());
+  if (asked_to_terminate_)
+    return;
+
   // FIXME: this document's origin is pristine and without any extra privileges
   // (e.g. GrantUniversalAccess) that can be overriden in regular documents
   // via WebPreference by embedders. (crbug.com/254993)
diff --git a/third_party/WebKit/Source/core/exported/WebSharedWorkerImpl.h b/third_party/WebKit/Source/core/exported/WebSharedWorkerImpl.h
index 3a0c9eb..838483f 100644
--- a/third_party/WebKit/Source/core/exported/WebSharedWorkerImpl.h
+++ b/third_party/WebKit/Source/core/exported/WebSharedWorkerImpl.h
@@ -36,6 +36,7 @@
 #include <memory>
 
 #include "base/memory/scoped_refptr.h"
+#include "base/memory/weak_ptr.h"
 #include "core/CoreExport.h"
 #include "core/exported/WorkerShadowPage.h"
 #include "core/workers/SharedWorkerReportingProxy.h"
@@ -110,6 +111,7 @@
 
   void DidReceiveScriptLoaderResponse();
   void OnScriptLoaderFinished();
+  void ContinueOnScriptLoaderFinished();
 
   void ConnectTaskOnWorkerThread(MessagePortChannel);
 
@@ -142,6 +144,8 @@
 
   service_manager::mojom::blink::InterfaceProviderPtrInfo
       pending_interface_provider_;
+
+  base::WeakPtrFactory<WebSharedWorkerImpl> weak_ptr_factory_;
 };
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/core/html/forms/FormData.cpp b/third_party/WebKit/Source/core/html/forms/FormData.cpp
index 20070a6..b9e5bc4 100644
--- a/third_party/WebKit/Source/core/html/forms/FormData.cpp
+++ b/third_party/WebKit/Source/core/html/forms/FormData.cpp
@@ -34,7 +34,6 @@
 #include "core/fileapi/Blob.h"
 #include "core/fileapi/File.h"
 #include "core/frame/UseCounter.h"
-#include "core/html/forms/FormDataEvent.h"
 #include "core/html/forms/HTMLFormElement.h"
 #include "platform/bindings/ScriptState.h"
 #include "platform/network/FormDataEncoder.h"
@@ -84,18 +83,8 @@
 FormData::FormData(const WTF::TextEncoding& encoding) : encoding_(encoding) {}
 
 FormData::FormData(HTMLFormElement* form) : encoding_(UTF8Encoding()) {
-  if (!form)
-    return;
-
-  // TODO(tkent): Share the following code with FormSubmission::Create().
-  if (RuntimeEnabledFeatures::FormDataEventEnabled())
-    form->DispatchEvent(FormDataEvent::Create(*this));
-
-  for (unsigned i = 0; i < form->ListedElements().size(); ++i) {
-    ListedElement* element = form->ListedElements()[i];
-    if (!ToHTMLElement(element)->IsDisabledFormControl())
-      element->AppendToFormData(*this);
-  }
+  if (form)
+    form->ConstructFormDataSet(nullptr, *this);
 }
 
 void FormData::Trace(blink::Visitor* visitor) {
diff --git a/third_party/WebKit/Source/core/html/forms/FormData.h b/third_party/WebKit/Source/core/html/forms/FormData.h
index 7e2cd6a..d439200 100644
--- a/third_party/WebKit/Source/core/html/forms/FormData.h
+++ b/third_party/WebKit/Source/core/html/forms/FormData.h
@@ -86,6 +86,11 @@
   void append(const String& name, Blob*, const String& filename = String());
   String Decode(const CString& data) const;
 
+  // This flag is true if this FormData is created with a <form>, and its
+  // associated elements contain a non-empty password field.
+  bool ContainsPasswordData() const { return contains_password_data_; }
+  void SetContainsPasswordData(bool flag) { contains_password_data_ = flag; }
+
   scoped_refptr<EncodedFormData> EncodeFormData(
       EncodedFormData::EncodingType = EncodedFormData::kFormURLEncoded);
   scoped_refptr<EncodedFormData> EncodeMultiPartFormData();
@@ -100,6 +105,7 @@
   WTF::TextEncoding encoding_;
   // Entry pointers in m_entries never be nullptr.
   HeapVector<Member<const Entry>> entries_;
+  bool contains_password_data_ = false;
 };
 
 // Represents entry, which is a pair of a name and a value.
diff --git a/third_party/WebKit/Source/core/html/forms/HTMLFormElement.cpp b/third_party/WebKit/Source/core/html/forms/HTMLFormElement.cpp
index 00c2c03..e45d89a 100644
--- a/third_party/WebKit/Source/core/html/forms/HTMLFormElement.cpp
+++ b/third_party/WebKit/Source/core/html/forms/HTMLFormElement.cpp
@@ -47,10 +47,13 @@
 #include "core/html/HTMLImageElement.h"
 #include "core/html/HTMLObjectElement.h"
 #include "core/html/forms/FormController.h"
+#include "core/html/forms/FormData.h"
+#include "core/html/forms/FormDataEvent.h"
 #include "core/html/forms/HTMLFormControlsCollection.h"
 #include "core/html/forms/HTMLInputElement.h"
 #include "core/html/forms/RadioNodeList.h"
 #include "core/html_names.h"
+#include "core/input_type_names.h"
 #include "core/inspector/ConsoleMessage.h"
 #include "core/layout/LayoutObject.h"
 #include "core/loader/FormSubmission.h"
@@ -432,6 +435,31 @@
   }
 }
 
+void HTMLFormElement::ConstructFormDataSet(
+    HTMLFormControlElement* submit_button,
+    FormData& form_data) {
+  // TODO(tkent): We might move the event dispatching later than the
+  // ListedElements iteration.
+  if (RuntimeEnabledFeatures::FormDataEventEnabled())
+    DispatchEvent(FormDataEvent::Create(form_data));
+
+  if (submit_button)
+    submit_button->SetActivatedSubmit(true);
+  for (ListedElement* control : ListedElements()) {
+    DCHECK(control);
+    HTMLElement& element = ToHTMLElement(*control);
+    if (!element.IsDisabledFormControl())
+      control->AppendToFormData(form_data);
+    if (auto* input = ToHTMLInputElementOrNull(element)) {
+      if (input->type() == InputTypeNames::password &&
+          !input->value().IsEmpty())
+        form_data.SetContainsPasswordData(true);
+    }
+  }
+  if (submit_button)
+    submit_button->SetActivatedSubmit(false);
+}
+
 void HTMLFormElement::ScheduleFormSubmission(FormSubmission* submission) {
   DCHECK(submission->Method() == FormSubmission::kPostMethod ||
          submission->Method() == FormSubmission::kGetMethod);
diff --git a/third_party/WebKit/Source/core/html/forms/HTMLFormElement.h b/third_party/WebKit/Source/core/html/forms/HTMLFormElement.h
index 4c19c286..6b27462f 100644
--- a/third_party/WebKit/Source/core/html/forms/HTMLFormElement.h
+++ b/third_party/WebKit/Source/core/html/forms/HTMLFormElement.h
@@ -107,6 +107,11 @@
   void AnonymousNamedGetter(const AtomicString& name, RadioNodeListOrElement&);
   void InvalidateDefaultButtonStyle() const;
 
+  // 'construct the form data set'
+  // https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#constructing-the-form-data-set
+  void ConstructFormDataSet(HTMLFormControlElement* submit_button,
+                            FormData& form_data);
+
  private:
   explicit HTMLFormElement(Document&);
 
diff --git a/third_party/WebKit/Source/core/inspector/InspectorNetworkAgent.cpp b/third_party/WebKit/Source/core/inspector/InspectorNetworkAgent.cpp
index cb0bd9c..ac5e66f 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorNetworkAgent.cpp
+++ b/third_party/WebKit/Source/core/inspector/InspectorNetworkAgent.cpp
@@ -149,6 +149,23 @@
   return false;
 }
 
+protocol::Network::CertificateTransparencyCompliance
+SerializeCTPolicyCompliance(
+    ResourceResponse::CTPolicyCompliance ct_compliance) {
+  switch (ct_compliance) {
+    case ResourceResponse::kCTPolicyComplianceDetailsNotAvailable:
+      return protocol::Network::CertificateTransparencyComplianceEnum::Unknown;
+    case ResourceResponse::kCTPolicyComplies:
+      return protocol::Network::CertificateTransparencyComplianceEnum::
+          Compliant;
+    case ResourceResponse::kCTPolicyDoesNotComply:
+      return protocol::Network::CertificateTransparencyComplianceEnum::
+          NotCompliant;
+  }
+  NOTREACHED();
+  return protocol::Network::CertificateTransparencyComplianceEnum::Unknown;
+}
+
 static std::unique_ptr<protocol::Network::Headers> BuildObjectForHeaders(
     const HTTPHeaderMap& headers) {
   std::unique_ptr<protocol::DictionaryValue> headers_object =
@@ -644,6 +661,8 @@
             .setCertificateId(0)  // Keep this in protocol for compatability.
             .setSignedCertificateTimestampList(
                 std::move(signed_certificate_timestamp_list))
+            .setCertificateTransparencyCompliance(
+                SerializeCTPolicyCompliance(response.GetCTPolicyCompliance()))
             .build();
     if (response_security_details->key_exchange_group.length() > 0)
       security_details->setKeyExchangeGroup(
diff --git a/third_party/WebKit/Source/core/inspector/InspectorPageAgent.cpp b/third_party/WebKit/Source/core/inspector/InspectorPageAgent.cpp
index 8d0d795..3fa7a4e00 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorPageAgent.cpp
+++ b/third_party/WebKit/Source/core/inspector/InspectorPageAgent.cpp
@@ -775,6 +775,14 @@
   return Response::OK();
 }
 
+void InspectorPageAgent::DidNavigateWithinDocument(LocalFrame* frame) {
+  Document* document = frame->GetDocument();
+  if (document) {
+    return GetFrontend()->navigatedWithinDocument(
+        IdentifiersFactory::FrameId(frame), document->Url());
+  }
+}
+
 void InspectorPageAgent::DidClearDocumentOfWindowObject(LocalFrame* frame) {
   if (!GetFrontend())
     return;
diff --git a/third_party/WebKit/Source/core/inspector/InspectorPageAgent.h b/third_party/WebKit/Source/core/inspector/InspectorPageAgent.h
index 4de8468..04d3f4c 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorPageAgent.h
+++ b/third_party/WebKit/Source/core/inspector/InspectorPageAgent.h
@@ -154,6 +154,7 @@
 
   // InspectorInstrumentation API
   void DidClearDocumentOfWindowObject(LocalFrame*);
+  void DidNavigateWithinDocument(LocalFrame*);
   void DomContentLoadedEventFired(LocalFrame*);
   void LoadEventFired(LocalFrame*);
   void WillCommitLoad(LocalFrame*, DocumentLoader*);
diff --git a/third_party/WebKit/Source/core/inspector/browser_protocol.json b/third_party/WebKit/Source/core/inspector/browser_protocol.json
index abcc7e6..7fbfa3d 100644
--- a/third_party/WebKit/Source/core/inspector/browser_protocol.json
+++ b/third_party/WebKit/Source/core/inspector/browser_protocol.json
@@ -7508,10 +7508,25 @@
                             "items": {
                                 "$ref": "SignedCertificateTimestamp"
                             }
+                        },
+                        {
+                            "name": "certificateTransparencyCompliance",
+                            "description": "Whether the request complied with Certificate Transparency policy",
+                            "$ref": "CertificateTransparencyCompliance"
                         }
                     ]
                 },
                 {
+                    "id": "CertificateTransparencyCompliance",
+                    "description": "Whether the request complied with Certificate Transparency policy.",
+                    "type": "string",
+                    "enum": [
+                        "unknown",
+                        "not-compliant",
+                        "compliant"
+                    ]
+                },
+                {
                     "id": "BlockedReason",
                     "description": "The reason why request was blocked.",
                     "type": "string",
@@ -10870,6 +10885,23 @@
                     ]
                 },
                 {
+                    "name": "navigatedWithinDocument",
+                    "description": "Fired when same-document navigation happens, e.g. due to history API usage or anchor navigation.",
+                    "experimental": true,
+                    "parameters": [
+                        {
+                            "name": "frameId",
+                            "description": "Id of the frame.",
+                            "$ref": "FrameId"
+                        },
+                        {
+                            "name": "url",
+                            "description": "Frame's new url.",
+                            "type": "string"
+                        }
+                    ]
+                },
+                {
                     "name": "screencastFrame",
                     "description": "Compressed image data requested by the `startScreencast`.",
                     "experimental": true,
diff --git a/third_party/WebKit/Source/core/inspector/browser_protocol.pdl b/third_party/WebKit/Source/core/inspector/browser_protocol.pdl
index 5eb117b..621387512 100644
--- a/third_party/WebKit/Source/core/inspector/browser_protocol.pdl
+++ b/third_party/WebKit/Source/core/inspector/browser_protocol.pdl
@@ -3435,6 +3435,15 @@
       TimeSinceEpoch validTo
       # List of signed certificate timestamps (SCTs).
       array of SignedCertificateTimestamp signedCertificateTimestampList
+      # Whether the request complied with Certificate Transparency policy
+      CertificateTransparencyCompliance certificateTransparencyCompliance
+
+  # Whether the request complied with Certificate Transparency policy.
+  type CertificateTransparencyCompliance extends string
+    enum
+      unknown
+      not-compliant
+      compliant
 
   # The reason why request was blocked.
   type BlockedReason extends string
@@ -4990,6 +4999,14 @@
     parameters
       Network.MonotonicTime timestamp
 
+  # Fired when same-document navigation happens, e.g. due to history API usage or anchor navigation.
+  experimental event navigatedWithinDocument
+    parameters
+      # Id of the frame.
+      FrameId frameId
+      # Frame's new url.
+      string url
+
   # Compressed image data requested by the `startScreencast`.
   experimental event screencastFrame
     parameters
diff --git a/third_party/WebKit/Source/core/layout/svg/LayoutSVGInlineText.cpp b/third_party/WebKit/Source/core/layout/svg/LayoutSVGInlineText.cpp
index c6cd85d..f9de536 100644
--- a/third_party/WebKit/Source/core/layout/svg/LayoutSVGInlineText.cpp
+++ b/third_party/WebKit/Source/core/layout/svg/LayoutSVGInlineText.cpp
@@ -173,7 +173,7 @@
   absolute_point.MoveBy(containing_block->Location());
 
   float closest_distance = std::numeric_limits<float>::max();
-  float closest_distance_position = 0;
+  float position_in_fragment = 0;
   const SVGTextFragment* closest_distance_fragment = nullptr;
   SVGInlineTextBox* closest_distance_box = nullptr;
 
@@ -193,7 +193,13 @@
         closest_distance = distance;
         closest_distance_box = text_box;
         closest_distance_fragment = &fragment;
-        closest_distance_position = fragment_rect.X();
+        // TODO(fs): This only works (reasonably) well for text with trivial
+        // transformations. For improved fidelity in the other cases we ought
+        // to apply the inverse transformation for the fragment and then map
+        // against the (untransformed) fragment rect.
+        position_in_fragment = fragment.is_vertical
+                                   ? absolute_point.Y() - fragment_rect.Y()
+                                   : absolute_point.X() - fragment_rect.X();
       }
     }
   }
@@ -202,8 +208,7 @@
     return CreatePositionWithAffinity(0);
 
   int offset = closest_distance_box->OffsetForPositionInFragment(
-      *closest_distance_fragment,
-      absolute_point.X() - closest_distance_position);
+      *closest_distance_fragment, position_in_fragment);
   return CreatePositionWithAffinity(offset + closest_distance_box->Start(),
                                     offset > 0
                                         ? TextAffinity::kUpstreamIfPossible
diff --git a/third_party/WebKit/Source/core/loader/DocumentLoader.cpp b/third_party/WebKit/Source/core/loader/DocumentLoader.cpp
index 52719a7..aa9591d 100644
--- a/third_party/WebKit/Source/core/loader/DocumentLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/DocumentLoader.cpp
@@ -338,6 +338,7 @@
       frame_->IsLocalRoot());
   GetLocalFrameClient().DispatchDidNavigateWithinPage(
       history_item_.Get(), commit_type, initiating_document);
+  probe::didNavigateWithinDocument(frame_);
 }
 
 const KURL& DocumentLoader::UrlForHistory() const {
diff --git a/third_party/WebKit/Source/core/loader/FormSubmission.cpp b/third_party/WebKit/Source/core/loader/FormSubmission.cpp
index be426fe..3ab266474 100644
--- a/third_party/WebKit/Source/core/loader/FormSubmission.cpp
+++ b/third_party/WebKit/Source/core/loader/FormSubmission.cpp
@@ -34,13 +34,10 @@
 #include "core/dom/events/Event.h"
 #include "core/frame/UseCounter.h"
 #include "core/html/forms/FormData.h"
-#include "core/html/forms/FormDataEvent.h"
 #include "core/html/forms/HTMLFormControlElement.h"
 #include "core/html/forms/HTMLFormElement.h"
-#include "core/html/forms/HTMLInputElement.h"
 #include "core/html/parser/HTMLParserIdioms.h"
 #include "core/html_names.h"
-#include "core/input_type_names.h"
 #include "core/loader/FrameLoadRequest.h"
 #include "core/loader/FrameLoader.h"
 #include "platform/heap/Handle.h"
@@ -226,29 +223,7 @@
                 copied_attributes.AcceptCharset(), document.Encoding());
   FormData* dom_form_data =
       FormData::Create(data_encoding.EncodingForFormSubmission());
-
-  // TODO(tkent): We might move the event dispatching later than the
-  // ListedElements iteration.
-  if (RuntimeEnabledFeatures::FormDataEventEnabled())
-    form->DispatchEvent(FormDataEvent::Create(*dom_form_data));
-
-  if (submit_button)
-    submit_button->SetActivatedSubmit(true);
-  bool contains_password_data = false;
-  for (unsigned i = 0; i < form->ListedElements().size(); ++i) {
-    ListedElement* control = form->ListedElements()[i];
-    DCHECK(control);
-    HTMLElement& element = ToHTMLElement(*control);
-    if (!element.IsDisabledFormControl())
-      control->AppendToFormData(*dom_form_data);
-    if (auto* input = ToHTMLInputElementOrNull(element)) {
-      if (input->type() == InputTypeNames::password &&
-          !input->value().IsEmpty())
-        contains_password_data = true;
-    }
-  }
-  if (submit_button)
-    submit_button->SetActivatedSubmit(false);
+  form->ConstructFormDataSet(submit_button, *dom_form_data);
 
   scoped_refptr<EncodedFormData> form_data;
   String boundary;
@@ -269,7 +244,7 @@
   }
 
   form_data->SetIdentifier(GenerateFormDataIdentifier());
-  form_data->SetContainsPasswordData(contains_password_data);
+  form_data->SetContainsPasswordData(dom_form_data->ContainsPasswordData());
   AtomicString target_or_base_target = copied_attributes.Target().IsEmpty()
                                            ? document.BaseTarget()
                                            : copied_attributes.Target();
diff --git a/third_party/WebKit/Source/core/probe/CoreProbes.json5 b/third_party/WebKit/Source/core/probe/CoreProbes.json5
index 91a8737..914746a 100644
--- a/third_party/WebKit/Source/core/probe/CoreProbes.json5
+++ b/third_party/WebKit/Source/core/probe/CoreProbes.json5
@@ -146,6 +146,7 @@
       probes: [
         "didChangeViewport",
         "didClearDocumentOfWindowObject",
+        "didNavigateWithinDocument",
         "willCommitLoad",
         "didResizeMainFrame",
         "didRunJavaScriptDialog",
diff --git a/third_party/WebKit/Source/core/probe/CoreProbes.pidl b/third_party/WebKit/Source/core/probe/CoreProbes.pidl
index db1804e..8baaed8 100644
--- a/third_party/WebKit/Source/core/probe/CoreProbes.pidl
+++ b/third_party/WebKit/Source/core/probe/CoreProbes.pidl
@@ -123,6 +123,7 @@
   void frameDetachedFromParent([Keep] LocalFrame*);
   void willCommitLoad([Keep] LocalFrame*, DocumentLoader*);
   void didCommitLoad([Keep] LocalFrame*, DocumentLoader*);
+  void didNavigateWithinDocument([Keep] LocalFrame*);
   void frameDocumentUpdated([Keep] LocalFrame*);
   void frameOwnerContentUpdated([Keep] LocalFrame*, HTMLFrameOwnerElement*);
   void frameStartedLoading([Keep] LocalFrame*, FrameLoadType);
diff --git a/third_party/WebKit/Source/devtools/front_end/performance_test_runner/TimelineTestRunner.js b/third_party/WebKit/Source/devtools/front_end/performance_test_runner/TimelineTestRunner.js
index b3a0ad6..ee79361 100644
--- a/third_party/WebKit/Source/devtools/front_end/performance_test_runner/TimelineTestRunner.js
+++ b/third_party/WebKit/Source/devtools/front_end/performance_test_runner/TimelineTestRunner.js
@@ -89,7 +89,7 @@
     categories += ',' + additionalCategories;
 
   const timelinePanel = UI.panels.timeline;
-  const timelineController = PerformanceTestRunner.timelineController();
+  const timelineController = PerformanceTestRunner.createTimelineController();
   timelinePanel._timelineController = timelineController;
   timelineController._startRecordingWithCategories(categories, enableJSSampling).then(tracingStarted);
 
@@ -126,10 +126,10 @@
   return performanceModel;
 };
 
-PerformanceTestRunner.timelineController = function() {
-  const performanceModel = new Timeline.PerformanceModel();
-  UI.panels.timeline._pendingPerformanceModel = performanceModel;
-  return new Timeline.TimelineController(TestRunner.tracingManager, performanceModel, UI.panels.timeline);
+PerformanceTestRunner.createTimelineController = function() {
+  const controller = new Timeline.TimelineController(SDK.targetManager.mainTarget(), UI.panels.timeline);
+  controller._tracingManager = TestRunner.tracingManager;
+  return controller;
 };
 
 PerformanceTestRunner.runWhenTimelineIsReady = function(callback) {
diff --git a/third_party/WebKit/Source/devtools/front_end/sdk/ResourceTreeModel.js b/third_party/WebKit/Source/devtools/front_end/sdk/ResourceTreeModel.js
index 26b821f..55dd099d 100644
--- a/third_party/WebKit/Source/devtools/front_end/sdk/ResourceTreeModel.js
+++ b/third_party/WebKit/Source/devtools/front_end/sdk/ResourceTreeModel.js
@@ -867,6 +867,14 @@
 
   /**
    * @override
+   * @param {!Protocol.Page.FrameId} frameId
+   * @param {string} url
+   */
+  navigatedWithinDocument(frameId, url) {
+  }
+
+  /**
+   * @override
    */
   frameResized() {
     this._resourceTreeModel.dispatchEventToListeners(SDK.ResourceTreeModel.Events.FrameResized, null);
diff --git a/third_party/WebKit/Source/devtools/front_end/sdk/ScreenCaptureModel.js b/third_party/WebKit/Source/devtools/front_end/sdk/ScreenCaptureModel.js
index c04f63f..be05514 100644
--- a/third_party/WebKit/Source/devtools/front_end/sdk/ScreenCaptureModel.js
+++ b/third_party/WebKit/Source/devtools/front_end/sdk/ScreenCaptureModel.js
@@ -114,6 +114,14 @@
   /**
    * @override
    * @param {!Protocol.Page.FrameId} frameId
+   * @param {string} url
+   */
+  navigatedWithinDocument(frameId, url) {
+  }
+
+  /**
+   * @override
+   * @param {!Protocol.Page.FrameId} frameId
    * @param {!Protocol.Page.FrameId} parentFrameId
    */
   frameAttached(frameId, parentFrameId) {
diff --git a/third_party/WebKit/Source/devtools/front_end/security/SecurityPanel.js b/third_party/WebKit/Source/devtools/front_end/security/SecurityPanel.js
index f02b4a1..44f890f 100644
--- a/third_party/WebKit/Source/devtools/front_end/security/SecurityPanel.js
+++ b/third_party/WebKit/Source/devtools/front_end/security/SecurityPanel.js
@@ -229,6 +229,7 @@
       if (securityDetails)
         originState.securityDetails = securityDetails;
 
+      originState.loadedFromCache = request.cached();
 
       this._origins.set(origin, originState);
 
@@ -372,10 +373,11 @@
 
 /**
  * @typedef {Object}
- * @property {!Protocol.Security.SecurityState} securityState - Current security state of the origin.
- * @property {?Protocol.Network.SecurityDetails} securityDetails - Security details of the origin, if available.
- * @property {?Promise<>} certificateDetailsPromise - Certificate details of the origin.
- * @property {?Security.SecurityOriginView} originView - Current SecurityOriginView corresponding to origin.
+ * @property {!Protocol.Security.SecurityState} securityState
+ * @property {?Protocol.Network.SecurityDetails} securityDetails
+ * @property {?Promise<>} certificateDetailsPromise
+ * @property {?bool} loadedFromCache
+ * @property {?Security.SecurityOriginView} originView
  */
 Security.SecurityPanel.OriginState;
 
@@ -819,8 +821,10 @@
       const certificateSection = this.element.createChild('div', 'origin-view-section');
       certificateSection.createChild('div', 'origin-view-section-title').textContent = Common.UIString('Certificate');
 
+      const sctListLength = originState.securityDetails.signedCertificateTimestampList.length;
+      const ctCompliance = originState.securityDetails.certificateTransparencyCompliance;
       let sctSection;
-      if (originState.securityDetails.signedCertificateTimestampList.length) {
+      if (sctListLength || ctCompliance !== Protocol.Network.CertificateTransparencyCompliance.Unknown) {
         // Create the Certificate Transparency section outside the callback, so that it appears in the right place.
         sctSection = this.element.createChild('div', 'origin-view-section');
         sctSection.createChild('div', 'origin-view-section-title').textContent =
@@ -851,7 +855,7 @@
       const sctSummaryTable = new Security.SecurityDetailsTable();
       sctSummaryTable.element().classList.add('sct-summary');
       sctSection.appendChild(sctSummaryTable.element());
-      for (let i = 0; i < originState.securityDetails.signedCertificateTimestampList.length; i++) {
+      for (let i = 0; i < sctListLength; i++) {
         const sct = originState.securityDetails.signedCertificateTimestampList[i];
         sctSummaryTable.addRow(
             Common.UIString('SCT'), sct.logDescription + ' (' + sct.origin + ', ' + sct.status + ')');
@@ -860,7 +864,7 @@
       // Show detailed SCT(s) of Certificate Transparency.
       const sctTableWrapper = sctSection.createChild('div', 'sct-details');
       sctTableWrapper.classList.add('hidden');
-      for (let i = 0; i < originState.securityDetails.signedCertificateTimestampList.length; i++) {
+      for (let i = 0; i < sctListLength; i++) {
         const sctTable = new Security.SecurityDetailsTable();
         sctTableWrapper.appendChild(sctTable.element());
         const sct = originState.securityDetails.signedCertificateTimestampList[i];
@@ -875,21 +879,40 @@
       }
 
       // Add link to toggle between displaying of the summary of the SCT(s) and the detailed SCT(s).
-      const toggleSctsDetailsLink = sctSection.createChild('div', 'link');
-      toggleSctsDetailsLink.classList.add('sct-toggle');
-      toggleSctsDetailsLink.textContent = Common.UIString('Show full details');
-      function toggleSctDetailsDisplay() {
-        const isDetailsShown = !sctTableWrapper.classList.contains('hidden');
-        if (isDetailsShown)
-          toggleSctsDetailsLink.textContent = Common.UIString('Show full details');
-        else
-          toggleSctsDetailsLink.textContent = Common.UIString('Hide full details');
-        sctSummaryTable.element().classList.toggle('hidden');
-        sctTableWrapper.classList.toggle('hidden');
+      if (sctListLength) {
+        const toggleSctsDetailsLink = sctSection.createChild('div', 'link');
+        toggleSctsDetailsLink.classList.add('sct-toggle');
+        toggleSctsDetailsLink.textContent = Common.UIString('Show full details');
+        function toggleSctDetailsDisplay() {
+          const isDetailsShown = !sctTableWrapper.classList.contains('hidden');
+          if (isDetailsShown)
+            toggleSctsDetailsLink.textContent = Common.UIString('Show full details');
+          else
+            toggleSctsDetailsLink.textContent = Common.UIString('Hide full details');
+          sctSummaryTable.element().classList.toggle('hidden');
+          sctTableWrapper.classList.toggle('hidden');
+        }
+        toggleSctsDetailsLink.addEventListener('click', toggleSctDetailsDisplay, false);
       }
-      toggleSctsDetailsLink.addEventListener('click', toggleSctDetailsDisplay, false);
+
+      switch (ctCompliance) {
+        case Protocol.Network.CertificateTransparencyCompliance.Compliant:
+          sctSection.createChild('div', 'origin-view-section-notes').textContent =
+              Common.UIString('This request complies with Chrome\'s Certificate Transparency policy.');
+          break;
+        case Protocol.Network.CertificateTransparencyCompliance.NotCompliant:
+          sctSection.createChild('div', 'origin-view-section-notes').textContent =
+              Common.UIString('This request does not comply with Chrome\'s Certificate Transparency policy.');
+          break;
+        case Protocol.Network.CertificateTransparencyCompliance.Unknown:
+          break;
+      }
 
       const noteSection = this.element.createChild('div', 'origin-view-section origin-view-notes');
+      if (originState.loadedFromCache) {
+        noteSection.createChild('div').textContent =
+            Common.UIString('This response was loaded from cache. Some security details might be missing.');
+      }
       noteSection.createChild('div').textContent =
           Common.UIString('The security details above are from the first inspected response.');
     } else if (originState.securityState !== Protocol.Security.SecurityState.Unknown) {
diff --git a/third_party/WebKit/Source/devtools/front_end/security/originView.css b/third_party/WebKit/Source/devtools/front_end/security/originView.css
index 8f33025..299e100 100644
--- a/third_party/WebKit/Source/devtools/front_end/security/originView.css
+++ b/third_party/WebKit/Source/devtools/front_end/security/originView.css
@@ -32,6 +32,11 @@
     color: #8c8c8c;
 }
 
+.origin-view-section-notes {
+    margin-top: 6px;
+    color: #8c8c8c;
+}
+
 .security-origin-view .origin-display {
     font-size: 12px;
     padding-left: 38px;
diff --git a/third_party/WebKit/Source/devtools/front_end/timeline/TimelineController.js b/third_party/WebKit/Source/devtools/front_end/timeline/TimelineController.js
index 6b46dac..7a01424 100644
--- a/third_party/WebKit/Source/devtools/front_end/timeline/TimelineController.js
+++ b/third_party/WebKit/Source/devtools/front_end/timeline/TimelineController.js
@@ -9,20 +9,18 @@
  */
 Timeline.TimelineController = class {
   /**
-   * @param {!SDK.TracingManager} tracingManager
-   * @param {!Timeline.PerformanceModel} performanceModel
+   * @param {!SDK.Target} target
    * @param {!Timeline.TimelineController.Client} client
    */
-  constructor(tracingManager, performanceModel, client) {
-    this._tracingManager = tracingManager;
-    this._performanceModel = performanceModel;
+  constructor(target, client) {
+    this._tracingManager = target.model(SDK.TracingManager);
+    this._performanceModel = new Timeline.PerformanceModel();
+    this._performanceModel.setMainTarget(target);
     this._client = client;
 
     const backingStorage = new Bindings.TempFileBackingStorage();
     this._tracingModel = new SDK.TracingModel(backingStorage);
 
-    this._performanceModel.setMainTarget(tracingManager.target());
-
     /** @type {!Array<!Timeline.ExtensionTracingSession>} */
     this._extensionSessions = [];
     SDK.targetManager.observeModels(SDK.CPUProfilerModel, this);
@@ -86,7 +84,10 @@
     return startPromise;
   }
 
-  stopRecording() {
+  /**
+   * @return {!Promise<!Timeline.PerformanceModel>}
+   */
+  async stopRecording() {
     const tracingStoppedPromises = [];
     tracingStoppedPromises.push(new Promise(resolve => this._tracingCompleteCallback = resolve));
     tracingStoppedPromises.push(this._stopProfilingOnAllModels());
@@ -97,12 +98,12 @@
 
     const extensionCompletionPromises = this._extensionSessions.map(session => session.stop());
     if (extensionCompletionPromises.length) {
-      let timerId;
-      const timeoutPromise = new Promise(fulfill => timerId = setTimeout(fulfill, 5000));
       tracingStoppedPromises.push(
-          Promise.race([Promise.all(extensionCompletionPromises).then(() => clearTimeout(timerId)), timeoutPromise]));
+          Promise.race([Promise.all(extensionCompletionPromises), new Promise(r => setTimeout(r, 5000))]));
     }
-    Promise.all(tracingStoppedPromises).then(() => this._allSourcesFinished());
+    await Promise.all(tracingStoppedPromises);
+    this._allSourcesFinished();
+    return this._performanceModel;
   }
 
   /**
diff --git a/third_party/WebKit/Source/devtools/front_end/timeline/TimelineLoader.js b/third_party/WebKit/Source/devtools/front_end/timeline/TimelineLoader.js
index 6bb573a..fb7920ab 100644
--- a/third_party/WebKit/Source/devtools/front_end/timeline/TimelineLoader.js
+++ b/third_party/WebKit/Source/devtools/front_end/timeline/TimelineLoader.js
@@ -55,17 +55,15 @@
 
     setTimeout(async () => {
       const eventsPerChunk = 5000;
-      const yieldEventLoopToPaint = () => new Promise(res => setTimeout(res, 0));
-
       client.loadingStarted();
       for (let i = 0; i < events.length; i += eventsPerChunk) {
         const chunk = events.slice(i, i + eventsPerChunk);
         loader._tracingModel.addEvents(chunk);
         client.loadingProgress((i + chunk.length) / events.length);
-        await yieldEventLoopToPaint();
+        await new Promise(r => setTimeout(r));  // Yield event loop to paint.
       }
       loader.close();
-    }, 0);
+    });
 
     return loader;
   }
diff --git a/third_party/WebKit/Source/devtools/front_end/timeline/TimelinePanel.js b/third_party/WebKit/Source/devtools/front_end/timeline/TimelinePanel.js
index b0a521ff..3ad001e 100644
--- a/third_party/WebKit/Source/devtools/front_end/timeline/TimelinePanel.js
+++ b/third_party/WebKit/Source/devtools/front_end/timeline/TimelinePanel.js
@@ -64,8 +64,6 @@
 
     /** @type {?Timeline.PerformanceModel} */
     this._performanceModel = null;
-    /** @type {?Timeline.PerformanceModel} */
-    this._pendingPerformanceModel = null;
 
     this._viewModeSetting =
         Common.settings.createSetting('timelineViewMode', Timeline.TimelinePanel.ViewMode.FlameChart);
@@ -331,7 +329,10 @@
   _prepareToLoadTimeline() {
     console.assert(this._state === Timeline.TimelinePanel.State.Idle);
     this._setState(Timeline.TimelinePanel.State.Loading);
-    this._pendingPerformanceModel = new Timeline.PerformanceModel();
+    if (this._performanceModel) {
+      this._performanceModel.dispose();
+      this._performanceModel = null;
+    }
   }
 
   _createFileSelector() {
@@ -479,11 +480,7 @@
   /**
    * @return {!Promise}
    */
-  _startRecording() {
-    const tracingManagers = SDK.targetManager.models(SDK.TracingManager);
-    if (!tracingManagers.length)
-      return Promise.resolve();
-
+  async _startRecording() {
     console.assert(!this._statusPane, 'Status pane is already opened.');
     this._setState(Timeline.TimelinePanel.State.StartPending);
     this._showRecordingStarted();
@@ -497,24 +494,24 @@
       captureFilmStrip: this._showScreenshotsSetting.get()
     };
 
-    this._pendingPerformanceModel = new Timeline.PerformanceModel();
-    this._controller = new Timeline.TimelineController(tracingManagers[0], this._pendingPerformanceModel, this);
+    const mainTarget = /** @type {!SDK.Target} */ (SDK.targetManager.mainTarget());
+    this._controller = new Timeline.TimelineController(mainTarget, this);
     this._setUIControlsEnabled(false);
     this._hideLandingPage();
-    return this._controller.startRecording(recordingOptions, enabledTraceProviders)
-        .then(() => this._recordingStarted());
+    await this._controller.startRecording(recordingOptions, enabledTraceProviders);
+    this._recordingStarted();
   }
 
-  _stopRecording() {
+  async _stopRecording() {
     if (this._statusPane) {
       this._statusPane.finish();
       this._statusPane.updateStatus(Common.UIString('Stopping timeline\u2026'));
       this._statusPane.updateProgressBar(Common.UIString('Received'), 0);
     }
     this._setState(Timeline.TimelinePanel.State.StopPending);
-    this._controller.stopRecording();
-    this._controller = null;
+    this._performanceModel = await this._controller.stopRecording();
     this._setUIControlsEnabled(true);
+    this._controller = null;
   }
 
   _onSuspendStateChanged() {
@@ -720,22 +717,21 @@
   loadingComplete(tracingModel) {
     delete this._loader;
     this._setState(Timeline.TimelinePanel.State.Idle);
-    const performanceModel = this._pendingPerformanceModel;
-    this._pendingPerformanceModel = null;
 
     if (this._statusPane)
       this._statusPane.hide();
     delete this._statusPane;
 
     if (!tracingModel) {
-      performanceModel.dispose();
       this._clear();
       return;
     }
 
-    performanceModel.setTracingModel(tracingModel);
-    this._setModel(performanceModel);
-    this._historyManager.addRecording(performanceModel);
+    if (!this._performanceModel)
+      this._performanceModel = new Timeline.PerformanceModel();
+    this._performanceModel.setTracingModel(tracingModel);
+    this._setModel(this._performanceModel);
+    this._historyManager.addRecording(this._performanceModel);
   }
 
   _showRecordingStarted() {
@@ -772,23 +768,18 @@
   /**
    * @param {!Common.Event} event
    */
-  _loadEventFired(event) {
+  async _loadEventFired(event) {
     if (this._state !== Timeline.TimelinePanel.State.Recording || !this._recordingPageReload ||
         this._controller.mainTarget() !== event.data.resourceTreeModel.target())
       return;
-    setTimeout(stopRecordingOnReload.bind(this, this._controller), this._millisecondsToRecordAfterLoadEvent);
+    const controller = this._controller;
+    await new Promise(r => setTimeout(r, this._millisecondsToRecordAfterLoadEvent));
 
-    /**
-     * @param {!Timeline.TimelineController} controller
-     * @this {Timeline.TimelinePanel}
-     */
-    function stopRecordingOnReload(controller) {
-      // Check if we're still in the same recording session.
-      if (controller !== this._controller)
-        return;
-      this._recordingPageReload = false;
-      this._stopRecording();
-    }
+    // Check if we're still in the same recording session.
+    if (controller !== this._controller)
+      return;
+    this._recordingPageReload = false;
+    this._stopRecording();
   }
 
   /**
diff --git a/third_party/WebKit/Source/modules/accessibility/AXMediaControls.cpp b/third_party/WebKit/Source/modules/accessibility/AXMediaControls.cpp
index b4cc821..7641b66 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXMediaControls.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXMediaControls.cpp
@@ -82,7 +82,6 @@
     case kMediaVolumeSlider:
     case kMediaVolumeSliderThumb:
     case kMediaExitFullscreenButton:
-    case kMediaOverlayPlayButton:
     case kMediaCastOffButton:
     case kMediaCastOnButton:
     case kMediaOverlayCastOffButton:
@@ -121,7 +120,6 @@
     case kMediaMuteButton:
       return QueryString(WebLocalizedString::kAXMediaMuteButton);
     case kMediaPlayButton:
-    case kMediaOverlayPlayButton:
       return QueryString(WebLocalizedString::kAXMediaPlayButton);
     case kMediaUnMuteButton:
       return QueryString(WebLocalizedString::kAXMediaUnMuteButton);
@@ -177,7 +175,6 @@
     case kMediaMuteButton:
       return QueryString(WebLocalizedString::kAXMediaMuteButtonHelp);
     case kMediaPlayButton:
-    case kMediaOverlayPlayButton:
       return QueryString(WebLocalizedString::kAXMediaPlayButtonHelp);
     case kMediaUnMuteButton:
       return QueryString(WebLocalizedString::kAXMediaUnMuteButtonHelp);
@@ -242,7 +239,6 @@
     case kMediaPauseButton:
     case kMediaShowClosedCaptionsButton:
     case kMediaHideClosedCaptionsButton:
-    case kMediaOverlayPlayButton:
     case kMediaOverlayCastOffButton:
     case kMediaOverlayCastOnButton:
     case kMediaOverflowButton:
diff --git a/third_party/WebKit/Source/modules/media_controls/MediaControlsImpl.cpp b/third_party/WebKit/Source/modules/media_controls/MediaControlsImpl.cpp
index 2a52ebaf..d840592 100644
--- a/third_party/WebKit/Source/modules/media_controls/MediaControlsImpl.cpp
+++ b/third_party/WebKit/Source/modules/media_controls/MediaControlsImpl.cpp
@@ -534,9 +534,7 @@
       volume_slider_->SetIsWanted(false);
   }
 
-  // TODO(apacible): Enable for modern controls when SVG is added.
-  if (RuntimeEnabledFeatures::PictureInPictureEnabled() && !IsModern() &&
-      MediaElement().IsHTMLVideoElement()) {
+  if (RuntimeEnabledFeatures::PictureInPictureEnabled()) {
     picture_in_picture_button_ =
         new MediaControlPictureInPictureButtonElement(*this);
     picture_in_picture_button_->SetIsWanted(
@@ -579,8 +577,7 @@
   overflow_list_->AppendChild(
       toggle_closed_captions_button_->CreateOverflowElement(
           new MediaControlToggleClosedCaptionsButtonElement(*this)));
-  if (RuntimeEnabledFeatures::PictureInPictureEnabled() && !IsModern() &&
-      MediaElement().IsHTMLVideoElement()) {
+  if (RuntimeEnabledFeatures::PictureInPictureEnabled()) {
     overflow_list_->AppendChild(
         picture_in_picture_button_->CreateOverflowElement(
             new MediaControlPictureInPictureButtonElement(*this)));
@@ -1848,6 +1845,11 @@
   return *download_button_;
 }
 
+const MediaControlOverflowMenuButtonElement& MediaControlsImpl::OverflowButton()
+    const {
+  return *overflow_menu_;
+}
+
 void MediaControlsImpl::DidDismissDownloadInProductHelp() {
   StartHideMediaControlsIfNecessary();
 }
diff --git a/third_party/WebKit/Source/modules/media_controls/MediaControlsImpl.h b/third_party/WebKit/Source/modules/media_controls/MediaControlsImpl.h
index 4834c24..f3b2703a 100644
--- a/third_party/WebKit/Source/modules/media_controls/MediaControlsImpl.h
+++ b/third_party/WebKit/Source/modules/media_controls/MediaControlsImpl.h
@@ -140,6 +140,7 @@
 
   // Methods used for Download In-product help.
   const MediaControlDownloadButtonElement& DownloadButton() const;
+  const MediaControlOverflowMenuButtonElement& OverflowButton() const;
   void DidDismissDownloadInProductHelp();
   MediaDownloadInProductHelpManager* DownloadInProductHelp();
 
diff --git a/third_party/WebKit/Source/modules/media_controls/MediaDownloadInProductHelpManager.cpp b/third_party/WebKit/Source/modules/media_controls/MediaDownloadInProductHelpManager.cpp
index 43fd8db..c35186ed 100644
--- a/third_party/WebKit/Source/modules/media_controls/MediaDownloadInProductHelpManager.cpp
+++ b/third_party/WebKit/Source/modules/media_controls/MediaDownloadInProductHelpManager.cpp
@@ -7,6 +7,7 @@
 #include "core/frame/LocalFrameClient.h"
 #include "modules/media_controls/MediaControlsImpl.h"
 #include "modules/media_controls/elements/MediaControlDownloadButtonElement.h"
+#include "modules/media_controls/elements/MediaControlOverflowMenuButtonElement.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 
 namespace blink {
@@ -66,7 +67,9 @@
 
   // If the button is not in the viewport, don't show the in-product-help.
   IntRect button_rect =
-      controls_->DownloadButton().VisibleBoundsInVisualViewport();
+      controls_->IsModern()
+          ? controls_->OverflowButton().VisibleBoundsInVisualViewport()
+          : controls_->DownloadButton().VisibleBoundsInVisualViewport();
   if (button_rect.IsEmpty())
     return;
 
diff --git a/third_party/WebKit/Source/modules/media_controls/elements/MediaControlDownloadButtonElement.cpp b/third_party/WebKit/Source/modules/media_controls/elements/MediaControlDownloadButtonElement.cpp
index f7d348c5..0d689b1 100644
--- a/third_party/WebKit/Source/modules/media_controls/elements/MediaControlDownloadButtonElement.cpp
+++ b/third_party/WebKit/Source/modules/media_controls/elements/MediaControlDownloadButtonElement.cpp
@@ -26,7 +26,7 @@
   SetIsWanted(false);
 }
 
-bool MediaControlDownloadButtonElement::ShouldDisplayDownloadButton() {
+bool MediaControlDownloadButtonElement::ShouldDisplayDownloadButton() const {
   if (!MediaElement().SupportsSave())
     return false;
 
@@ -62,7 +62,8 @@
 void MediaControlDownloadButtonElement::UpdateShownState() {
   MediaControlInputElement::UpdateShownState();
 
-  if (GetMediaControls().DownloadInProductHelp()) {
+  if (!MediaControlsImpl::IsModern() &&
+      GetMediaControls().DownloadInProductHelp()) {
     GetMediaControls().DownloadInProductHelp()->SetDownloadButtonVisibility(
         IsWanted() && DoesFit());
   }
diff --git a/third_party/WebKit/Source/modules/media_controls/elements/MediaControlDownloadButtonElement.h b/third_party/WebKit/Source/modules/media_controls/elements/MediaControlDownloadButtonElement.h
index 4c086713..07d0da5d 100644
--- a/third_party/WebKit/Source/modules/media_controls/elements/MediaControlDownloadButtonElement.h
+++ b/third_party/WebKit/Source/modules/media_controls/elements/MediaControlDownloadButtonElement.h
@@ -20,7 +20,7 @@
 
   // Returns true if the download button should be shown. We should
   // show the button for only non-MSE, non-EME, and non-MediaStream content.
-  bool ShouldDisplayDownloadButton();
+  bool ShouldDisplayDownloadButton() const;
 
   // MediaControlInputElement overrides.
   // TODO(mlamouri): add WillRespondToMouseClickEvents
diff --git a/third_party/WebKit/Source/modules/media_controls/elements/MediaControlElementType.h b/third_party/WebKit/Source/modules/media_controls/elements/MediaControlElementType.h
index f4ff4a3..485b817 100644
--- a/third_party/WebKit/Source/modules/media_controls/elements/MediaControlElementType.h
+++ b/third_party/WebKit/Source/modules/media_controls/elements/MediaControlElementType.h
@@ -28,7 +28,6 @@
   kMediaVolumeSlider,
   kMediaVolumeSliderThumb,
   kMediaExitFullscreenButton,
-  kMediaOverlayPlayButton,
   kMediaCastOffButton,
   kMediaCastOnButton,
   kMediaOverlayCastOffButton,
diff --git a/third_party/WebKit/Source/modules/media_controls/elements/MediaControlOverflowMenuButtonElement.cpp b/third_party/WebKit/Source/modules/media_controls/elements/MediaControlOverflowMenuButtonElement.cpp
index 7da7b78..32ee2fe 100644
--- a/third_party/WebKit/Source/modules/media_controls/elements/MediaControlOverflowMenuButtonElement.cpp
+++ b/third_party/WebKit/Source/modules/media_controls/elements/MediaControlOverflowMenuButtonElement.cpp
@@ -7,6 +7,8 @@
 #include "core/dom/events/Event.h"
 #include "core/input_type_names.h"
 #include "modules/media_controls/MediaControlsImpl.h"
+#include "modules/media_controls/MediaDownloadInProductHelpManager.h"
+#include "modules/media_controls/elements/MediaControlDownloadButtonElement.h"
 #include "public/platform/Platform.h"
 
 namespace blink {
@@ -28,6 +30,17 @@
   return "OverflowButton";
 }
 
+void MediaControlOverflowMenuButtonElement::UpdateShownState() {
+  MediaControlInputElement::UpdateShownState();
+
+  if (MediaControlsImpl::IsModern() &&
+      GetMediaControls().DownloadInProductHelp()) {
+    GetMediaControls().DownloadInProductHelp()->SetDownloadButtonVisibility(
+        IsWanted() && DoesFit() &&
+        GetMediaControls().DownloadButton().ShouldDisplayDownloadButton());
+  }
+}
+
 void MediaControlOverflowMenuButtonElement::DefaultEventHandler(Event* event) {
   if (event->type() == EventTypeNames::click) {
     if (GetMediaControls().OverflowMenuVisible()) {
diff --git a/third_party/WebKit/Source/modules/media_controls/elements/MediaControlOverflowMenuButtonElement.h b/third_party/WebKit/Source/modules/media_controls/elements/MediaControlOverflowMenuButtonElement.h
index 02a41d1..79ee8e8b 100644
--- a/third_party/WebKit/Source/modules/media_controls/elements/MediaControlOverflowMenuButtonElement.h
+++ b/third_party/WebKit/Source/modules/media_controls/elements/MediaControlOverflowMenuButtonElement.h
@@ -24,6 +24,7 @@
 
  protected:
   const char* GetNameForHistograms() const override;
+  void UpdateShownState() final;
 
  private:
   void DefaultEventHandler(Event*) override;
diff --git a/third_party/WebKit/Source/modules/media_controls/elements/MediaControlOverlayPlayButtonElement.cpp b/third_party/WebKit/Source/modules/media_controls/elements/MediaControlOverlayPlayButtonElement.cpp
index f7b6e61f..8d8f609f 100644
--- a/third_party/WebKit/Source/modules/media_controls/elements/MediaControlOverlayPlayButtonElement.cpp
+++ b/third_party/WebKit/Source/modules/media_controls/elements/MediaControlOverlayPlayButtonElement.cpp
@@ -114,7 +114,7 @@
 //   This contains the inner circle with the actual play/pause icon.
 MediaControlOverlayPlayButtonElement::MediaControlOverlayPlayButtonElement(
     MediaControlsImpl& media_controls)
-    : MediaControlInputElement(media_controls, kMediaOverlayPlayButton),
+    : MediaControlInputElement(media_controls, kMediaPlayButton),
       tap_timer_(GetDocument().GetTaskRunner(TaskType::kMediaElementEvent),
                  this,
                  &MediaControlOverlayPlayButtonElement::TapTimerFired),
@@ -135,6 +135,10 @@
 void MediaControlOverlayPlayButtonElement::UpdateDisplayType() {
   SetIsWanted(MediaElement().ShouldShowControls() &&
               (MediaControlsImpl::IsModern() || MediaElement().paused()));
+  if (MediaControlsImpl::IsModern()) {
+    SetDisplayType(MediaElement().paused() ? kMediaPlayButton
+                                           : kMediaPauseButton);
+  }
   MediaControlInputElement::UpdateDisplayType();
 }
 
diff --git a/third_party/WebKit/Source/modules/media_controls/resources/ic_picture_in_picture.svg b/third_party/WebKit/Source/modules/media_controls/resources/ic_picture_in_picture.svg
new file mode 100644
index 0000000..7e3ee33
--- /dev/null
+++ b/third_party/WebKit/Source/modules/media_controls/resources/ic_picture_in_picture.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="24px" height="24px" viewBox="0 0 24 24" fill="#000000">
+    <path d="M19 11h-8v6h8v-6zm4 8V4.98C23 3.88 22.1 3 21 3H3c-1.1 0-2 .88-2 1.98V19c0 1.1.9 2 2 2h18c1.1 0 2-.9 2-2zm-2 .02H3V4.97h18v14.05z"/>
+    <path fill="none" d="M0 0h24v24H0V0z"/>
+</svg>
diff --git a/third_party/WebKit/Source/modules/media_controls/resources/modernMediaControls.css b/third_party/WebKit/Source/modules/media_controls/resources/modernMediaControls.css
index edb754a..e8cdd56 100644
--- a/third_party/WebKit/Source/modules/media_controls/resources/modernMediaControls.css
+++ b/third_party/WebKit/Source/modules/media_controls/resources/modernMediaControls.css
@@ -146,7 +146,8 @@
 audio::-internal-media-controls-overflow-button,
 video::-webkit-media-controls-toggle-closed-captions-button,
 audio::-internal-media-controls-download-button,
-video::-internal-media-controls-download-button {
+video::-internal-media-controls-download-button,
+video::-internal-media-controls-picture-in-picture-button {
   -webkit-appearance: -internal-media-control;
   background-size: 24px;
   background-repeat: no-repeat;
@@ -232,6 +233,12 @@
 audio::-internal-media-controls-overflow-button {
   background-image: -webkit-image-set(url(ic_menu.svg) 1x);
 }
+
+video::-internal-media-controls-picture-in-picture-button {
+  background-image: -webkit-image-set(
+    url(ic_picture_in_picture.svg) 1x);
+}
+
 video::-webkit-media-controls:not(.audio-only) [pseudo="-webkit-media-controls-panel"] [pseudo="-internal-media-controls-overflow-button"] {
   background-image: -webkit-image-set(url(ic_menu_white.svg) 1x);
 }
diff --git a/third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.cpp b/third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.cpp
index be88b0ee..9120b29 100644
--- a/third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.cpp
+++ b/third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.cpp
@@ -140,10 +140,18 @@
 
 MediaStreamTrack::MediaStreamTrack(ExecutionContext* context,
                                    MediaStreamComponent* component)
+    : MediaStreamTrack(context,
+                       component,
+                       component->Source()->GetReadyState(),
+                       false /* stopped */) {}
+
+MediaStreamTrack::MediaStreamTrack(ExecutionContext* context,
+                                   MediaStreamComponent* component,
+                                   MediaStreamSource::ReadyState ready_state,
+                                   bool stopped)
     : ContextLifecycleObserver(context),
-      ready_state_(component->Source()->GetReadyState()),
-      is_iterating_registered_media_streams_(false),
-      stopped_(false),
+      ready_state_(ready_state),
+      stopped_(stopped),
       component_(component) {
   component_->Source()->AddObserver(this);
 
@@ -291,11 +299,10 @@
 }
 
 MediaStreamTrack* MediaStreamTrack::clone(ScriptState* script_state) {
-  // TODO(pbos): Make sure m_readyState and m_stopped carries over on cloned
-  // tracks.
   MediaStreamComponent* cloned_component = Component()->Clone();
-  MediaStreamTrack* cloned_track = MediaStreamTrack::Create(
-      ExecutionContext::From(script_state), cloned_component);
+  MediaStreamTrack* cloned_track =
+      new MediaStreamTrack(ExecutionContext::From(script_state),
+                           cloned_component, ready_state_, stopped_);
   MediaStreamCenter::Instance().DidCloneMediaStreamTrack(Component(),
                                                          cloned_component);
   return cloned_track;
diff --git a/third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.h b/third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.h
index 52ba749f..82449c1 100644
--- a/third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.h
+++ b/third_party/WebKit/Source/modules/mediastream/MediaStreamTrack.h
@@ -113,6 +113,10 @@
   friend class CanvasCaptureMediaStreamTrack;
 
   MediaStreamTrack(ExecutionContext*, MediaStreamComponent*);
+  MediaStreamTrack(ExecutionContext*,
+                   MediaStreamComponent*,
+                   MediaStreamSource::ReadyState,
+                   bool stopped);
 
   // MediaStreamSourceObserver
   void SourceChangedState() override;
@@ -123,7 +127,7 @@
 
   MediaStreamSource::ReadyState ready_state_;
   HeapHashSet<Member<MediaStream>> registered_media_streams_;
-  bool is_iterating_registered_media_streams_;
+  bool is_iterating_registered_media_streams_ = false;
   bool stopped_;
   Member<MediaStreamComponent> component_;
   Member<ImageCapture> image_capture_;
diff --git a/third_party/WebKit/Source/modules/nfc/NFC.cpp b/third_party/WebKit/Source/modules/nfc/NFC.cpp
index 1a54c5c..7ce0639 100644
--- a/third_party/WebKit/Source/modules/nfc/NFC.cpp
+++ b/third_party/WebKit/Source/modules/nfc/NFC.cpp
@@ -866,10 +866,6 @@
 
 bool NFC::IsSupportedInContext(ExecutionContext* context,
                                String& error_message) {
-  if (!context->IsSecureContext(error_message)) {
-    return false;
-  }
-
   // https://w3c.github.io/web-nfc/#security-policies
   // WebNFC API must be only accessible from top level browsing context.
   if (!ToDocument(context)->domWindow()->GetFrame() ||
diff --git a/third_party/WebKit/Source/modules/nfc/NFC.idl b/third_party/WebKit/Source/modules/nfc/NFC.idl
index 8b1dd1a..0fdca17 100644
--- a/third_party/WebKit/Source/modules/nfc/NFC.idl
+++ b/third_party/WebKit/Source/modules/nfc/NFC.idl
@@ -7,7 +7,8 @@
 typedef (DOMString or ArrayBuffer or NFCMessage) NFCPushMessage;
 
 [
-  RuntimeEnabled=WebNFC
+  RuntimeEnabled=WebNFC,
+  SecureContext
 ] interface NFC {
     [CallWith=ScriptState, MeasureAs=WebNFCPush] Promise<void> push (NFCPushMessage message, optional NFCPushOptions options);
     [CallWith=ScriptState, MeasureAs=WebNFCCancelPush] Promise<void> cancelPush (optional NFCPushTarget target = "any");
diff --git a/third_party/WebKit/Source/modules/nfc/NavigatorNFC.idl b/third_party/WebKit/Source/modules/nfc/NavigatorNFC.idl
index 8fb0fb1b..7384c47 100644
--- a/third_party/WebKit/Source/modules/nfc/NavigatorNFC.idl
+++ b/third_party/WebKit/Source/modules/nfc/NavigatorNFC.idl
@@ -8,5 +8,5 @@
     ImplementedAs=NavigatorNFC,
     RuntimeEnabled=WebNFC
 ] partial interface Navigator {
-    readonly attribute NFC nfc;
+    [SecureContext, SameObject] readonly attribute NFC nfc;
 };
diff --git a/third_party/WebKit/Source/modules/payments/PaymentInstrument.idl b/third_party/WebKit/Source/modules/payments/PaymentInstrument.idl
index ad09a3376..5fca259 100644
--- a/third_party/WebKit/Source/modules/payments/PaymentInstrument.idl
+++ b/third_party/WebKit/Source/modules/payments/PaymentInstrument.idl
@@ -7,6 +7,6 @@
 dictionary PaymentInstrument {
     required DOMString name;
     sequence<ImageObject> icons;
-    sequence<DOMString> enabledMethods;
+    DOMString method;
     object capabilities;
 };
diff --git a/third_party/WebKit/Source/modules/payments/PaymentInstruments.cpp b/third_party/WebKit/Source/modules/payments/PaymentInstruments.cpp
index d1a8ed7..065c563 100644
--- a/third_party/WebKit/Source/modules/payments/PaymentInstruments.cpp
+++ b/third_party/WebKit/Source/modules/payments/PaymentInstruments.cpp
@@ -249,9 +249,8 @@
     }
   }
 
-  if (details.hasEnabledMethods()) {
-    instrument->enabled_methods = details.enabledMethods();
-  }
+  instrument->method =
+      details.hasMethod() ? details.method() : WTF::g_empty_string;
 
   if (details.hasCapabilities()) {
     v8::Local<v8::String> value;
@@ -264,7 +263,7 @@
       return;
     }
     instrument->stringified_capabilities = ToCoreString(value);
-    if (instrument->enabled_methods.Contains("basic-card")) {
+    if (instrument->method == "basic-card") {
       ExceptionState exception_state(resolver->GetScriptState()->GetIsolate(),
                                      ExceptionState::kSetterContext,
                                      "PaymentInstruments", "set");
@@ -326,13 +325,7 @@
     icons.emplace_back(image_object);
   }
   instrument.setIcons(icons);
-
-  Vector<String> enabled_methods;
-  for (const auto& method : stored_instrument->enabled_methods) {
-    enabled_methods.push_back(method);
-  }
-
-  instrument.setEnabledMethods(enabled_methods);
+  instrument.setMethod(stored_instrument->method);
   if (!stored_instrument->stringified_capabilities.IsEmpty()) {
     ExceptionState exception_state(resolver->GetScriptState()->GetIsolate(),
                                    ExceptionState::kGetterContext,
diff --git a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
index 42cb3ee..afd5cac 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
@@ -3593,6 +3593,7 @@
 
   ContextGL()->ClearBufferiv(buffer, drawbuffer,
                              value.View()->DataMaybeShared() + src_offset);
+  UpdateBuffersToAutoClear(kClearBufferiv, buffer, drawbuffer);
 }
 
 void WebGL2RenderingContextBase::clearBufferiv(GLenum buffer,
@@ -3607,6 +3608,7 @@
                                                    drawing_buffer_.get());
 
   ContextGL()->ClearBufferiv(buffer, drawbuffer, value.data() + src_offset);
+  UpdateBuffersToAutoClear(kClearBufferiv, buffer, drawbuffer);
 }
 
 void WebGL2RenderingContextBase::clearBufferuiv(
@@ -3624,6 +3626,7 @@
 
   ContextGL()->ClearBufferuiv(buffer, drawbuffer,
                               value.View()->DataMaybeShared() + src_offset);
+  UpdateBuffersToAutoClear(kClearBufferuiv, buffer, drawbuffer);
 }
 
 void WebGL2RenderingContextBase::clearBufferuiv(GLenum buffer,
@@ -3638,6 +3641,7 @@
                                                    drawing_buffer_.get());
 
   ContextGL()->ClearBufferuiv(buffer, drawbuffer, value.data() + src_offset);
+  UpdateBuffersToAutoClear(kClearBufferuiv, buffer, drawbuffer);
 }
 
 void WebGL2RenderingContextBase::clearBufferfv(
@@ -3661,11 +3665,12 @@
 
   ContextGL()->ClearBufferfv(buffer, drawbuffer,
                              value.View()->DataMaybeShared() + src_offset);
-  // The other clearBuffer entry points will currently generate an
-  // error if they're called against the default back buffer. If
-  // support for extended canvas color spaces is added, this call
-  // might need to be added to the other versions.
+  // clearBufferiv and clearBufferuiv will currently generate an error
+  // if they're called against the default back buffer. If support for
+  // extended canvas color spaces is added, this call might need to be
+  // added to the other versions.
   MarkContextChanged(kCanvasChanged);
+  UpdateBuffersToAutoClear(kClearBufferfv, buffer, drawbuffer);
 }
 
 void WebGL2RenderingContextBase::clearBufferfv(GLenum buffer,
@@ -3686,11 +3691,12 @@
                                                    drawing_buffer_.get());
 
   ContextGL()->ClearBufferfv(buffer, drawbuffer, value.data() + src_offset);
-  // The other clearBuffer entry points will currently generate an
-  // error if they're called against the default back buffer. If
-  // support for extended canvas color spaces is added, this call
-  // might need to be added to the other versions.
+  // clearBufferiv and clearBufferuiv will currently generate an error
+  // if they're called against the default back buffer. If support for
+  // extended canvas color spaces is added, this call might need to be
+  // added to the other versions.
   MarkContextChanged(kCanvasChanged);
+  UpdateBuffersToAutoClear(kClearBufferfv, buffer, drawbuffer);
 }
 
 void WebGL2RenderingContextBase::clearBufferfi(GLenum buffer,
@@ -3701,6 +3707,81 @@
     return;
 
   ContextGL()->ClearBufferfi(buffer, drawbuffer, depth, stencil);
+  // This might have been used to clear the depth and stencil buffers
+  // of the default back buffer.
+  MarkContextChanged(kCanvasChanged);
+  UpdateBuffersToAutoClear(kClearBufferfi, buffer, drawbuffer);
+}
+
+void WebGL2RenderingContextBase::UpdateBuffersToAutoClear(
+    WebGL2RenderingContextBase::ClearBufferCaller caller,
+    GLenum buffer,
+    GLint drawbuffer) {
+  // This method makes sure that we don't auto-clear any buffers which the
+  // user has manually cleared using the new ES 3.0 clearBuffer* APIs.
+
+  // If the user has a framebuffer bound, don't update the auto-clear
+  // state of the built-in back buffer.
+  if (framebuffer_binding_)
+    return;
+
+  // If the scissor test is on, assume that we can't short-circuit
+  // these clears.
+  if (scissor_enabled_)
+    return;
+
+  // The default back buffer only has one color attachment.
+  if (drawbuffer != 0)
+    return;
+
+  // If the call to the driver generated an error, don't claim that
+  // we've auto-cleared these buffers. The early returns below are for
+  // cases where errors will be produced.
+
+  // The default back buffer is currently always RGB(A)8, which
+  // restricts the variants which can legally be used to clear the
+  // color buffer. TODO(crbug.com/829632): this needs to be
+  // generalized.
+  switch (caller) {
+    case kClearBufferiv:
+      if (buffer != GL_STENCIL)
+        return;
+      break;
+    case kClearBufferfv:
+      if (buffer != GL_COLOR && buffer != GL_DEPTH)
+        return;
+      break;
+    case kClearBufferuiv:
+      return;
+    case kClearBufferfi:
+      if (buffer != GL_DEPTH_STENCIL)
+        return;
+      break;
+  }
+
+  GLbitfield buffers_to_clear = 0;
+
+  // Turn it into a bitfield and mask it off.
+  switch (buffer) {
+    case GL_COLOR:
+      buffers_to_clear = GL_COLOR_BUFFER_BIT;
+      break;
+    case GL_DEPTH:
+      buffers_to_clear = GL_DEPTH_BUFFER_BIT;
+      break;
+    case GL_STENCIL:
+      buffers_to_clear = GL_STENCIL_BUFFER_BIT;
+      break;
+    case GL_DEPTH_STENCIL:
+      buffers_to_clear = GL_DEPTH_BUFFER_BIT | GL_STENCIL_BUFFER_BIT;
+      break;
+    default:
+      // Illegal value.
+      return;
+  }
+
+  GetDrawingBuffer()->SetBuffersToAutoClear(
+      GetDrawingBuffer()->GetBuffersToAutoClear() & (~buffers_to_clear));
 }
 
 WebGLQuery* WebGL2RenderingContextBase::createQuery() {
diff --git a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.h b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.h
index 2d2bbf65..dc2ee52 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.h
+++ b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.h
@@ -1046,6 +1046,16 @@
 
   IntRect GetTextureSourceSubRectangle(GLsizei width, GLsizei height);
 
+  enum ClearBufferCaller {
+    kClearBufferiv,
+    kClearBufferuiv,
+    kClearBufferfv,
+    kClearBufferfi
+  };
+  void UpdateBuffersToAutoClear(ClearBufferCaller caller,
+                                GLenum buffer,
+                                GLint drawbuffer);
+
   /* WebGLRenderingContextBase overrides */
   unsigned GetMaxWebGLLocationLength() const override { return 1024; };
   bool ValidateCapability(const char* function_name, GLenum) override;
diff --git a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
index af9edab..c404e86 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
@@ -1360,8 +1360,10 @@
   if (isContextLost())
     return kSkipped;
 
-  if (!GetDrawingBuffer()->BufferClearNeeded() ||
-      (mask && framebuffer_binding_))
+  GLbitfield buffers_needing_clearing =
+      GetDrawingBuffer()->GetBuffersToAutoClear();
+
+  if (buffers_needing_clearing == 0 || (mask && framebuffer_binding_))
     return kSkipped;
 
   Optional<WebGLContextAttributes> context_attributes;
@@ -1407,14 +1409,17 @@
   ContextGL()->ColorMask(
       true, true, true,
       !GetDrawingBuffer()->DefaultBufferRequiresAlphaChannelToBePreserved());
-  GetDrawingBuffer()->ClearFramebuffers(clear_mask);
+  // If the WebGL 2.0 clearBuffer APIs already have been used to
+  // selectively clear some of the buffers, don't destroy those
+  // results.
+  GetDrawingBuffer()->ClearFramebuffers(clear_mask & buffers_needing_clearing);
 
   // Call the DrawingBufferClient method to restore scissor test, mask, and
   // clear values, because we dirtied them above.
   DrawingBufferClientRestoreScissorTest();
   DrawingBufferClientRestoreMaskAndClearValues();
 
-  GetDrawingBuffer()->SetBufferClearNeeded(false);
+  GetDrawingBuffer()->SetBuffersToAutoClear(0);
 
   return combined_clear ? kCombinedClear : kJustClear;
 }
@@ -1461,7 +1466,7 @@
 
 void WebGLRenderingContextBase::MarkLayerComposited() {
   if (!isContextLost())
-    GetDrawingBuffer()->SetBufferClearNeeded(true);
+    GetDrawingBuffer()->ResetBuffersToAutoClear();
 }
 
 void WebGLRenderingContextBase::SetIsHidden(bool hidden) {
diff --git a/third_party/WebKit/Source/platform/fonts/FontDescription.cpp b/third_party/WebKit/Source/platform/fonts/FontDescription.cpp
index d760d78..be07dec 100644
--- a/third_party/WebKit/Source/platform/fonts/FontDescription.cpp
+++ b/third_party/WebKit/Source/platform/fonts/FontDescription.cpp
@@ -113,30 +113,38 @@
            *variation_settings_ == *other.variation_settings_));
 }
 
+// Compute a 'lighter' weight per
+// https://drafts.csswg.org/css-fonts-4/#font-weight-prop
 FontSelectionValue FontDescription::LighterWeight(FontSelectionValue weight) {
-  // TODO(fs): Adjust to match table in
-  // https://drafts.csswg.org/css-fonts-4/#font-weight-prop
-  if (weight < FontSelectionValue(501))
+  DCHECK(weight >= FontSelectionValue(1) && weight <= FontSelectionValue(1000));
+  // [1, 100) => No change
+  if (weight < FontSelectionValue(100))
+    return weight;
+  // [100, 550) => 100
+  if (weight < FontSelectionValue(550))
     return FontSelectionValue(100);
-  if (weight < FontSelectionValue(701))
+  // [550, 750) => 400
+  if (weight < FontSelectionValue(750))
     return FontSelectionValue(400);
-  if (weight <= FontSelectionValue(1000))
-    return FontSelectionValue(700);
-  NOTREACHED();
-  return NormalWeightValue();
+  // [750, 1000] => 700
+  return FontSelectionValue(700);
 }
 
+// Compute a 'bolder' weight per
+// https://drafts.csswg.org/css-fonts-4/#font-weight-prop
 FontSelectionValue FontDescription::BolderWeight(FontSelectionValue weight) {
-  // TODO(fs): Adjust to match table in
-  // https://drafts.csswg.org/css-fonts-4/#font-weight-prop
-  if (weight < FontSelectionValue(301))
+  DCHECK(weight >= FontSelectionValue(1) && weight <= FontSelectionValue(1000));
+  // [1, 350) => 400
+  if (weight < FontSelectionValue(350))
     return FontSelectionValue(400);
-  if (weight < FontSelectionValue(501))
+  // [350, 550) => 700
+  if (weight < FontSelectionValue(550))
     return FontSelectionValue(700);
-  if (weight <= FontSelectionValue(1000))
+  // [550, 900) => 900
+  if (weight < FontSelectionValue(900))
     return FontSelectionValue(900);
-  NOTREACHED();
-  return NormalWeightValue();
+  // [900, 1000] => No change
+  return weight;
 }
 
 FontDescription::Size FontDescription::LargerSize(const Size& size) {
diff --git a/third_party/WebKit/Source/platform/graphics/gpu/DrawingBuffer.cpp b/third_party/WebKit/Source/platform/graphics/gpu/DrawingBuffer.cpp
index 6b4521a..72e4c00 100644
--- a/third_party/WebKit/Source/platform/graphics/gpu/DrawingBuffer.cpp
+++ b/third_party/WebKit/Source/platform/graphics/gpu/DrawingBuffer.cpp
@@ -203,18 +203,27 @@
   return false;
 }
 
-bool DrawingBuffer::BufferClearNeeded() const {
-  return buffer_clear_needed_;
+void DrawingBuffer::ResetBuffersToAutoClear() {
+  GLuint buffers = GL_COLOR_BUFFER_BIT;
+  if (want_depth_)
+    buffers |= GL_DEPTH_BUFFER_BIT;
+  if (want_stencil_)
+    buffers |= GL_STENCIL_BUFFER_BIT;
+  SetBuffersToAutoClear(buffers);
 }
 
-void DrawingBuffer::SetBufferClearNeeded(bool flag) {
+void DrawingBuffer::SetBuffersToAutoClear(GLbitfield buffers) {
   if (preserve_drawing_buffer_ == kDiscard) {
-    buffer_clear_needed_ = flag;
+    buffers_to_auto_clear_ = buffers;
   } else {
-    DCHECK(!buffer_clear_needed_);
+    DCHECK_EQ(0u, buffers_to_auto_clear_);
   }
 }
 
+GLbitfield DrawingBuffer::GetBuffersToAutoClear() const {
+  return buffers_to_auto_clear_;
+}
+
 gpu::gles2::GLES2Interface* DrawingBuffer::ContextGL() {
   return gl_;
 }
@@ -360,9 +369,7 @@
                         WTF::Passed(std::move(registered)));
   *out_release_callback = viz::SingleReleaseCallback::Create(std::move(func));
 
-  if (preserve_drawing_buffer_ == kDiscard) {
-    SetBufferClearNeeded(true);
-  }
+  ResetBuffersToAutoClear();
 }
 
 void DrawingBuffer::FinishPrepareTransferableResourceGpu(
@@ -457,7 +464,7 @@
   front_color_buffer_ = color_buffer_for_mailbox;
 
   contents_changed_ = false;
-  SetBufferClearNeeded(true);
+  ResetBuffersToAutoClear();
 }
 
 void DrawingBuffer::MailboxReleasedGpu(scoped_refptr<ColorBuffer> color_buffer,
diff --git a/third_party/WebKit/Source/platform/graphics/gpu/DrawingBuffer.h b/third_party/WebKit/Source/platform/graphics/gpu/DrawingBuffer.h
index 1eda98c8..2475c7d 100644
--- a/third_party/WebKit/Source/platform/graphics/gpu/DrawingBuffer.h
+++ b/third_party/WebKit/Source/platform/graphics/gpu/DrawingBuffer.h
@@ -170,8 +170,14 @@
   // Returns false if the contents had previously been marked as changed and
   // have not yet been resolved.
   bool MarkContentsChanged();
-  void SetBufferClearNeeded(bool);
-  bool BufferClearNeeded() const;
+
+  // Maintenance of auto-clearing of color/depth/stencil buffers. The
+  // Reset method is present to keep calling code simpler, so it
+  // doesn't have to know which buffers were allocated.
+  void ResetBuffersToAutoClear();
+  void SetBuffersToAutoClear(GLbitfield bitmask);
+  GLbitfield GetBuffersToAutoClear() const;
+
   void SetIsHidden(bool);
   void SetFilterQuality(SkFilterQuality);
 
@@ -520,7 +526,11 @@
   // True if resolveIfNeeded() has been called since the last time
   // markContentsChanged() had been called.
   bool contents_change_resolved_ = false;
-  bool buffer_clear_needed_ = false;
+
+  // A bitmask of GL buffer bits (GL_COLOR_BUFFER_BIT,
+  // GL_DEPTH_BUFFER_BIT, GL_STENCIL_BUFFER_BIT) which need to be
+  // auto-cleared.
+  GLbitfield buffers_to_auto_clear_ = 0;
 
   // Whether the client wants a depth or stencil buffer.
   const bool want_depth_;
diff --git a/third_party/WebKit/Source/platform/network/NetworkStateNotifier.cpp b/third_party/WebKit/Source/platform/network/NetworkStateNotifier.cpp
index 5e8f6761..bba938b 100644
--- a/third_party/WebKit/Source/platform/network/NetworkStateNotifier.cpp
+++ b/third_party/WebKit/Source/platform/network/NetworkStateNotifier.cpp
@@ -35,6 +35,7 @@
 #include "platform/wtf/StdLibExtras.h"
 #include "platform/wtf/Threading.h"
 #include "platform/wtf/text/StringHash.h"
+#include "third_party/WebKit/public/common/client_hints/client_hints.h"
 
 namespace blink {
 
@@ -374,20 +375,8 @@
 // static
 String NetworkStateNotifier::EffectiveConnectionTypeToString(
     WebEffectiveConnectionType type) {
-  switch (type) {
-    case WebEffectiveConnectionType::kTypeUnknown:
-    case WebEffectiveConnectionType::kTypeOffline:
-    case WebEffectiveConnectionType::kType4G:
-      return "4g";
-    case WebEffectiveConnectionType::kTypeSlow2G:
-      return "slow-2g";
-    case WebEffectiveConnectionType::kType2G:
-      return "2g";
-    case WebEffectiveConnectionType::kType3G:
-      return "3g";
-  }
-  NOTREACHED();
-  return "4g";
+  DCHECK_GT(kWebEffectiveConnectionTypeMappingCount, static_cast<size_t>(type));
+  return kWebEffectiveConnectionTypeMapping[static_cast<int>(type)];
 }
 
 double NetworkStateNotifier::GetRandomMultiplier(const String& host) const {
diff --git a/third_party/WebKit/Source/platform/runtime_enabled_features.json5 b/third_party/WebKit/Source/platform/runtime_enabled_features.json5
index 10824965..9126b1c 100644
--- a/third_party/WebKit/Source/platform/runtime_enabled_features.json5
+++ b/third_party/WebKit/Source/platform/runtime_enabled_features.json5
@@ -493,6 +493,7 @@
     },
     {
       name: "FormDataEvent",
+      status: "experimental",
     },
     {
       name: "FractionalMouseEvent",
diff --git a/third_party/WebKit/Source/platform/scheduler/BUILD.gn b/third_party/WebKit/Source/platform/scheduler/BUILD.gn
index b111a63..8c54a5b4 100644
--- a/third_party/WebKit/Source/platform/scheduler/BUILD.gn
+++ b/third_party/WebKit/Source/platform/scheduler/BUILD.gn
@@ -96,8 +96,8 @@
     "main_thread/main_thread_scheduler.h",
     "main_thread/page_scheduler_impl.cc",
     "main_thread/page_scheduler_impl.h",
-    "main_thread/render_widget_scheduling_state.cc",
     "main_thread/web_main_thread_scheduler.cc",
+    "main_thread/web_render_widget_scheduling_state.cc",
     "public/frame_scheduler.h",
     "public/non_main_thread_scheduler.h",
     "public/page_scheduler.h",
diff --git a/third_party/WebKit/Source/platform/scheduler/base/task_queue.h b/third_party/WebKit/Source/platform/scheduler/base/task_queue.h
index 2ec862b..b04404b 100644
--- a/third_party/WebKit/Source/platform/scheduler/base/task_queue.h
+++ b/third_party/WebKit/Source/platform/scheduler/base/task_queue.h
@@ -21,7 +21,7 @@
 namespace trace_event {
 class BlameContext;
 }
-}
+}  // namespace base
 
 namespace blink {
 namespace scheduler {
@@ -80,11 +80,15 @@
     // private queues which perform control operations.
     kControlPriority,
 
-    // The selector will prioritize high over normal and low and normal over
-    // low. However it will ensure neither of the lower priority queues can be
-    // completely starved by higher priority tasks. All three of these queues
-    // will always take priority over and can starve the best effort queue.
+    // The selector will prioritize highest over high, normal and low; and
+    // high over normal and low; and normal over low. However it will ensure
+    // neither of the lower priority queues can be completely starved by higher
+    // priority tasks. All three of these queues will always take priority over
+    // and can starve the best effort queue.
+    kHighestPriority,
+
     kHighPriority,
+
     // Queues with normal priority are the default.
     kNormalPriority,
     kLowPriority,
diff --git a/third_party/WebKit/Source/platform/scheduler/base/task_queue_impl.cc b/third_party/WebKit/Source/platform/scheduler/base/task_queue_impl.cc
index b4af0de..2baf2a1d 100644
--- a/third_party/WebKit/Source/platform/scheduler/base/task_queue_impl.cc
+++ b/third_party/WebKit/Source/platform/scheduler/base/task_queue_impl.cc
@@ -22,6 +22,8 @@
   switch (priority) {
     case kControlPriority:
       return "control";
+    case kHighestPriority:
+      return "highest";
     case kHighPriority:
       return "high";
     case kNormalPriority:
@@ -251,7 +253,8 @@
 }
 
 void TaskQueueImpl::PushOntoDelayedIncomingQueueFromMainThread(
-    Task pending_task, base::TimeTicks now) {
+    Task pending_task,
+    base::TimeTicks now) {
   main_thread_only().task_queue_manager->DidQueueTask(pending_task);
   main_thread_only().delayed_incoming_queue.push(std::move(pending_task));
 
diff --git a/third_party/WebKit/Source/platform/scheduler/base/task_queue_selector.cc b/third_party/WebKit/Source/platform/scheduler/base/task_queue_selector.cc
index 2aa36d7d..2233ca9 100644
--- a/third_party/WebKit/Source/platform/scheduler/base/task_queue_selector.cc
+++ b/third_party/WebKit/Source/platform/scheduler/base/task_queue_selector.cc
@@ -16,6 +16,7 @@
 TaskQueueSelector::TaskQueueSelector()
     : prioritizing_selector_(this, "enabled"),
       immediate_starvation_count_(0),
+      high_priority_starvation_score_(0),
       normal_priority_starvation_score_(0),
       low_priority_starvation_score_(0),
       task_queue_selector_observer_(nullptr) {}
@@ -198,6 +199,7 @@
                                out_work_queue)) {
     return true;
   }
+
   // Select from the normal priority queue if we are starving it.
   if (max_priority > TaskQueue::kNormalPriority &&
       task_queue_selector_->normal_priority_starvation_score_ >=
@@ -207,8 +209,19 @@
                                out_work_queue)) {
     return true;
   }
+
+  // Select from the high priority queue if we are starving it.
+  if (max_priority > TaskQueue::kHighPriority &&
+      task_queue_selector_->high_priority_starvation_score_ >=
+          kMaxHighPriorityStarvationScore &&
+      ChooseOldestWithPriority(TaskQueue::kHighPriority,
+                               out_chose_delayed_over_immediate,
+                               out_work_queue)) {
+    return true;
+  }
+
   // Otherwise choose in priority order.
-  for (TaskQueue::QueuePriority priority = TaskQueue::kHighPriority;
+  for (TaskQueue::QueuePriority priority = TaskQueue::kHighestPriority;
        priority < max_priority; priority = NextPriority(priority)) {
     if (ChooseOldestWithPriority(priority, out_chose_delayed_over_immediate,
                                  out_work_queue)) {
@@ -257,11 +270,20 @@
   switch (priority) {
     case TaskQueue::kControlPriority:
       break;
-    case TaskQueue::kHighPriority:
+    case TaskQueue::kHighestPriority:
       low_priority_starvation_score_ +=
           kSmallScoreIncrementForLowPriorityStarvation;
       normal_priority_starvation_score_ +=
           kSmallScoreIncrementForNormalPriorityStarvation;
+      high_priority_starvation_score_ +=
+          kSmallScoreIncrementForHighPriorityStarvation;
+      break;
+    case TaskQueue::kHighPriority:
+      low_priority_starvation_score_ +=
+          kLargeScoreIncrementForLowPriorityStarvation;
+      normal_priority_starvation_score_ +=
+          kLargeScoreIncrementForNormalPriorityStarvation;
+      high_priority_starvation_score_ = 0;
       break;
     case TaskQueue::kNormalPriority:
       low_priority_starvation_score_ +=
@@ -271,6 +293,7 @@
     case TaskQueue::kLowPriority:
     case TaskQueue::kBestEffortPriority:
       low_priority_starvation_score_ = 0;
+      high_priority_starvation_score_ = 0;
       normal_priority_starvation_score_ = 0;
       break;
     default:
@@ -286,6 +309,8 @@
 void TaskQueueSelector::AsValueInto(
     base::trace_event::TracedValue* state) const {
   DCHECK(main_thread_checker_.CalledOnValidThread());
+  state->SetInteger("high_priority_starvation_score",
+                    high_priority_starvation_score_);
   state->SetInteger("normal_priority_starvation_score",
                     normal_priority_starvation_score_);
   state->SetInteger("low_priority_starvation_score",
diff --git a/third_party/WebKit/Source/platform/scheduler/base/task_queue_selector.h b/third_party/WebKit/Source/platform/scheduler/base/task_queue_selector.h
index c19bca3..ca332b2 100644
--- a/third_party/WebKit/Source/platform/scheduler/base/task_queue_selector.h
+++ b/third_party/WebKit/Source/platform/scheduler/base/task_queue_selector.h
@@ -158,28 +158,46 @@
   void DidSelectQueueWithPriority(TaskQueue::QueuePriority priority,
                                   bool chose_delayed_over_immediate);
 
+  // Maximum score to accumulate before high priority tasks are run even in
+  // the presence of highest priority tasks.
+  static const size_t kMaxHighPriorityStarvationScore = 3;
+
+  // Increment to be applied to the high priority starvation score when a task
+  // should have only a small effect on the score. E.g. A number of highest
+  // priority tasks must run before the high priority queue is considered
+  // starved.
+  static const size_t kSmallScoreIncrementForHighPriorityStarvation = 1;
+
   // Maximum score to accumulate before normal priority tasks are run even in
-  // the presence of high priority tasks.
+  // the presence of higher priority tasks i.e. highest and high priority tasks.
   static const size_t kMaxNormalPriorityStarvationScore = 5;
 
   // Increment to be applied to the normal priority starvation score when a task
-  // should have only a small effect on the score. E.g. A number of high
+  // should have a large effect on the score. E.g Only a few high priority
+  // priority tasks must run before the normal priority queue is considered
+  // starved.
+  static const size_t kLargeScoreIncrementForNormalPriorityStarvation = 2;
+
+  // Increment to be applied to the normal priority starvation score when a task
+  // should have only a small effect on the score. E.g. A number of highest
   // priority tasks must run before the normal priority queue is considered
   // starved.
   static const size_t kSmallScoreIncrementForNormalPriorityStarvation = 1;
 
   // Maximum score to accumulate before low priority tasks are run even in the
-  // presence of high or normal priority tasks.
+  // presence of highest, high, or normal priority tasks.
   static const size_t kMaxLowPriorityStarvationScore = 25;
 
   // Increment to be applied to the low priority starvation score when a task
-  // should have a large effect on the score. E.g. Only a few normal priority
-  // tasks must run before the low priority queue is considered starved.
+  // should have a large effect on the score. E.g. Only a few normal/high
+  // priority tasks must run before the low priority queue is considered
+  // starved.
   static const size_t kLargeScoreIncrementForLowPriorityStarvation = 5;
 
   // Increment to be applied to the low priority starvation score when a task
-  // should have only a small effect on the score. E.g. A lot of high priority
-  // tasks must run before the low priority queue is considered starved.
+  // should have only a small effect on the score. E.g. A lot of highest
+  // priority tasks must run before the low priority queue is considered
+  // starved.
   static const size_t kSmallScoreIncrementForLowPriorityStarvation = 1;
 
   // Maximum number of delayed tasks tasks which can be run while there's a
@@ -191,6 +209,7 @@
 
   PrioritizingSelector prioritizing_selector_;
   size_t immediate_starvation_count_;
+  size_t high_priority_starvation_score_;
   size_t normal_priority_starvation_score_;
   size_t low_priority_starvation_score_;
 
diff --git a/third_party/WebKit/Source/platform/scheduler/base/task_queue_selector_unittest.cc b/third_party/WebKit/Source/platform/scheduler/base/task_queue_selector_unittest.cc
index f10780b..7567b4f 100644
--- a/third_party/WebKit/Source/platform/scheduler/base/task_queue_selector_unittest.cc
+++ b/third_party/WebKit/Source/platform/scheduler/base/task_queue_selector_unittest.cc
@@ -40,9 +40,9 @@
 
 class TaskQueueSelectorForTest : public TaskQueueSelector {
  public:
-  using TaskQueueSelector::SetImmediateStarvationCountForTest;
-  using TaskQueueSelector::PrioritizingSelector;
   using TaskQueueSelector::prioritizing_selector_for_test;
+  using TaskQueueSelector::PrioritizingSelector;
+  using TaskQueueSelector::SetImmediateStarvationCountForTest;
 };
 
 class TaskQueueSelectorTest : public testing::Test {
@@ -147,11 +147,22 @@
   EXPECT_THAT(PopTasks(), testing::ElementsAre(4, 3, 2, 1, 0));
 }
 
+TEST_F(TaskQueueSelectorTest, TestHighestPriority) {
+  size_t queue_order[] = {0, 1, 2, 3, 4};
+  PushTasks(queue_order, 5);
+  selector_.SetQueuePriority(task_queues_[2].get(),
+                             TaskQueue::kHighestPriority);
+  EXPECT_THAT(PopTasks(), ::testing::ElementsAre(2, 0, 1, 3, 4));
+}
+
 TEST_F(TaskQueueSelectorTest, TestHighPriority) {
   size_t queue_order[] = {0, 1, 2, 3, 4};
   PushTasks(queue_order, 5);
-  selector_.SetQueuePriority(task_queues_[2].get(), TaskQueue::kHighPriority);
-  EXPECT_THAT(PopTasks(), testing::ElementsAre(2, 0, 1, 3, 4));
+  selector_.SetQueuePriority(task_queues_[2].get(),
+                             TaskQueue::kHighestPriority);
+  selector_.SetQueuePriority(task_queues_[1].get(), TaskQueue::kHighPriority);
+  selector_.SetQueuePriority(task_queues_[0].get(), TaskQueue::kLowPriority);
+  EXPECT_THAT(PopTasks(), ::testing::ElementsAre(2, 1, 3, 4, 0));
 }
 
 TEST_F(TaskQueueSelectorTest, TestLowPriority) {
@@ -167,8 +178,9 @@
   selector_.SetQueuePriority(task_queues_[0].get(),
                              TaskQueue::kBestEffortPriority);
   selector_.SetQueuePriority(task_queues_[2].get(), TaskQueue::kLowPriority);
-  selector_.SetQueuePriority(task_queues_[3].get(), TaskQueue::kHighPriority);
-  EXPECT_THAT(PopTasks(), testing::ElementsAre(3, 1, 4, 2, 0));
+  selector_.SetQueuePriority(task_queues_[3].get(),
+                             TaskQueue::kHighestPriority);
+  EXPECT_THAT(PopTasks(), ::testing::ElementsAre(3, 1, 4, 2, 0));
 }
 
 TEST_F(TaskQueueSelectorTest, TestControlPriority) {
@@ -177,9 +189,10 @@
   selector_.SetQueuePriority(task_queues_[4].get(),
                              TaskQueue::kControlPriority);
   EXPECT_EQ(TaskQueue::kControlPriority, task_queues_[4]->GetQueuePriority());
-  selector_.SetQueuePriority(task_queues_[2].get(), TaskQueue::kHighPriority);
-  EXPECT_EQ(TaskQueue::kHighPriority, task_queues_[2]->GetQueuePriority());
-  EXPECT_THAT(PopTasks(), testing::ElementsAre(4, 2, 0, 1, 3));
+  selector_.SetQueuePriority(task_queues_[2].get(),
+                             TaskQueue::kHighestPriority);
+  EXPECT_EQ(TaskQueue::kHighestPriority, task_queues_[2]->GetQueuePriority());
+  EXPECT_THAT(PopTasks(), ::testing::ElementsAre(4, 2, 0, 1, 3));
 }
 
 TEST_F(TaskQueueSelectorTest, TestObserverWithEnabledQueue) {
@@ -194,7 +207,8 @@
 
 TEST_F(TaskQueueSelectorTest,
        TestObserverWithSetQueuePriorityAndQueueAlreadyEnabled) {
-  selector_.SetQueuePriority(task_queues_[1].get(), TaskQueue::kHighPriority);
+  selector_.SetQueuePriority(task_queues_[1].get(),
+                             TaskQueue::kHighestPriority);
   MockObserver mock_observer;
   selector_.SetTaskQueueSelectorObserver(&mock_observer);
   EXPECT_CALL(mock_observer, OnTaskQueueEnabled(_)).Times(0);
@@ -232,7 +246,8 @@
   EXPECT_TRUE(task_queues_[2]->immediate_work_queue()->Empty());
 
   task_queues_[2]->SetQueueEnabledForTest(false);
-  selector_.SetQueuePriority(task_queues_[2].get(), TaskQueue::kHighPriority);
+  selector_.SetQueuePriority(task_queues_[2].get(),
+                             TaskQueue::kHighestPriority);
 
   size_t queue_order[] = {0, 1, 2, 3, 4};
   PushTasks(queue_order, 5);
@@ -241,8 +256,8 @@
   EXPECT_FALSE(task_queues_[2]->immediate_work_queue()->Empty());
   task_queues_[2]->SetQueueEnabledForTest(true);
 
-  EXPECT_EQ(TaskQueue::kHighPriority, task_queues_[2]->GetQueuePriority());
-  EXPECT_THAT(PopTasks(), testing::ElementsAre(2, 0, 1, 3, 4));
+  EXPECT_EQ(TaskQueue::kHighestPriority, task_queues_[2]->GetQueuePriority());
+  EXPECT_THAT(PopTasks(), ::testing::ElementsAre(2, 0, 1, 3, 4));
 }
 
 TEST_F(TaskQueueSelectorTest, TestEmptyQueues) {
@@ -275,7 +290,8 @@
   PushTasks(queue_order, 4);
   selector_.SetQueuePriority(task_queues_[3].get(),
                              TaskQueue::kControlPriority);
-  selector_.SetQueuePriority(task_queues_[2].get(), TaskQueue::kHighPriority);
+  selector_.SetQueuePriority(task_queues_[2].get(),
+                             TaskQueue::kHighestPriority);
   selector_.SetQueuePriority(task_queues_[1].get(),
                              TaskQueue::kBestEffortPriority);
   for (int i = 0; i < 100; i++) {
@@ -286,12 +302,33 @@
   }
 }
 
-TEST_F(TaskQueueSelectorTest, TestHighPriorityDoesNotStarveNormal) {
+TEST_F(TaskQueueSelectorTest, TestHighestPriorityDoesNotStarveHigh) {
+  size_t queue_order[] = {0, 1};
+  PushTasks(queue_order, 2);
+  selector_.SetQueuePriority(task_queues_[0].get(),
+                             TaskQueue::kHighestPriority);
+  selector_.SetQueuePriority(task_queues_[1].get(), TaskQueue::kHighPriority);
+
+  size_t counts[] = {0, 0};
+  for (int i = 0; i < 100; i++) {
+    WorkQueue* chosen_work_queue = nullptr;
+    ASSERT_TRUE(selector_.SelectWorkQueueToService(&chosen_work_queue));
+    size_t chosen_queue_index =
+        queue_to_index_map_.find(chosen_work_queue->task_queue())->second;
+    counts[chosen_queue_index]++;
+    // Don't remove task from queue to simulate all queues still being full.
+  }
+  EXPECT_GT(counts[1], 0ul);        // Check highest doesn't starve high.
+  EXPECT_GT(counts[0], counts[1]);  // Check highest gets more chance to run.
+}
+
+TEST_F(TaskQueueSelectorTest, TestHighestPriorityDoesNotStarveHighOrNormal) {
   size_t queue_order[] = {0, 1, 2};
   PushTasks(queue_order, 3);
-  selector_.SetQueuePriority(task_queues_[2].get(), TaskQueue::kHighPriority);
-  selector_.SetQueuePriority(task_queues_[1].get(),
-                             TaskQueue::kBestEffortPriority);
+  selector_.SetQueuePriority(task_queues_[0].get(),
+                             TaskQueue::kHighestPriority);
+  selector_.SetQueuePriority(task_queues_[1].get(), TaskQueue::kHighPriority);
+
   size_t counts[] = {0, 0, 0};
   for (int i = 0; i < 100; i++) {
     WorkQueue* chosen_work_queue = nullptr;
@@ -301,16 +338,78 @@
     counts[chosen_queue_index]++;
     // Don't remove task from queue to simulate all queues still being full.
   }
-  EXPECT_GT(counts[0], 0ul);        // Check high doesn't starve normal.
-  EXPECT_GT(counts[2], counts[0]);  // Check high gets more chance to run.
-  EXPECT_EQ(0ul, counts[1]);        // Check best effort is starved.
+
+  // Check highest runs more frequently then high.
+  EXPECT_GT(counts[0], counts[1]);
+
+  // Check high runs at least as frequently as normal.
+  EXPECT_GE(counts[1], counts[2]);
+
+  // Check normal isn't starved.
+  EXPECT_GT(counts[2], 0ul);
+}
+
+TEST_F(TaskQueueSelectorTest,
+       TestHighestPriorityDoesNotStarveHighOrNormalOrLow) {
+  size_t queue_order[] = {0, 1, 2, 3};
+  PushTasks(queue_order, 4);
+  selector_.SetQueuePriority(task_queues_[0].get(),
+                             TaskQueue::kHighestPriority);
+  selector_.SetQueuePriority(task_queues_[1].get(), TaskQueue::kHighPriority);
+  selector_.SetQueuePriority(task_queues_[3].get(), TaskQueue::kLowPriority);
+
+  size_t counts[] = {0, 0, 0, 0};
+  for (int i = 0; i < 100; i++) {
+    WorkQueue* chosen_work_queue = nullptr;
+    ASSERT_TRUE(selector_.SelectWorkQueueToService(&chosen_work_queue));
+    size_t chosen_queue_index =
+        queue_to_index_map_.find(chosen_work_queue->task_queue())->second;
+    counts[chosen_queue_index]++;
+    // Don't remove task from queue to simulate all queues still being full.
+  }
+
+  // Check highest runs more frequently then high.
+  EXPECT_GT(counts[0], counts[1]);
+
+  // Check high runs at least as frequently as normal.
+  EXPECT_GE(counts[1], counts[2]);
+
+  // Check normal runs more frequently than low.
+  EXPECT_GT(counts[2], counts[3]);
+
+  // Check low isn't starved.
+  EXPECT_GT(counts[3], 0ul);
+}
+
+TEST_F(TaskQueueSelectorTest, TestHighPriorityDoesNotStarveNormal) {
+  size_t queue_order[] = {0, 1};
+  PushTasks(queue_order, 2);
+
+  selector_.SetQueuePriority(task_queues_[0].get(), TaskQueue::kHighPriority);
+
+  size_t counts[] = {0, 0, 0, 0};
+  for (int i = 0; i < 100; i++) {
+    WorkQueue* chosen_work_queue = nullptr;
+    ASSERT_TRUE(selector_.SelectWorkQueueToService(&chosen_work_queue));
+    size_t chosen_queue_index =
+        queue_to_index_map_.find(chosen_work_queue->task_queue())->second;
+    counts[chosen_queue_index]++;
+    // Don't remove task from queue to simulate all queues still being full.
+  }
+
+  // Check high runs more frequently then normal.
+  EXPECT_GT(counts[0], counts[1]);
+
+  // Check low isn't starved.
+  EXPECT_GT(counts[1], 0ul);
 }
 
 TEST_F(TaskQueueSelectorTest, TestHighPriorityDoesNotStarveNormalOrLow) {
   size_t queue_order[] = {0, 1, 2};
   PushTasks(queue_order, 3);
-  selector_.SetQueuePriority(task_queues_[2].get(), TaskQueue::kHighPriority);
-  selector_.SetQueuePriority(task_queues_[1].get(), TaskQueue::kLowPriority);
+  selector_.SetQueuePriority(task_queues_[0].get(), TaskQueue::kHighPriority);
+  selector_.SetQueuePriority(task_queues_[2].get(), TaskQueue::kLowPriority);
+
   size_t counts[] = {0, 0, 0};
   for (int i = 0; i < 100; i++) {
     WorkQueue* chosen_work_queue = nullptr;
@@ -320,10 +419,15 @@
     counts[chosen_queue_index]++;
     // Don't remove task from queue to simulate all queues still being full.
   }
-  EXPECT_GT(counts[0], 0ul);        // Check high doesn't starve normal.
-  EXPECT_GT(counts[2], counts[0]);  // Check high gets more chance to run.
-  EXPECT_GT(counts[1], 0ul);        // Check low isn't starved.
-  EXPECT_GT(counts[0], counts[1]);  // Check normal gets more chance to run.
+
+  // Check high runs more frequently than normal.
+  EXPECT_GT(counts[0], counts[1]);
+
+  // Check normal runs more frequently than low.
+  EXPECT_GT(counts[1], counts[2]);
+
+  // Check low isn't starved.
+  EXPECT_GT(counts[2], 0ul);
 }
 
 TEST_F(TaskQueueSelectorTest, TestNormalPriorityDoesNotStarveLow) {
@@ -352,18 +456,41 @@
   selector_.SetQueuePriority(task_queues_[0].get(),
                              TaskQueue::kBestEffortPriority);
   EXPECT_EQ(TaskQueue::kNormalPriority, task_queues_[1]->GetQueuePriority());
+
+  // Check that normal priority tasks starve best effort.
   WorkQueue* chosen_work_queue = nullptr;
   for (int i = 0; i < 100; i++) {
     ASSERT_TRUE(selector_.SelectWorkQueueToService(&chosen_work_queue));
     EXPECT_EQ(task_queues_[1].get(), chosen_work_queue->task_queue());
     // Don't remove task from queue to simulate all queues still being full.
   }
+
+  // Check that highest priority tasks starve best effort.
+  selector_.SetQueuePriority(task_queues_[1].get(),
+                             TaskQueue::kHighestPriority);
+  for (int i = 0; i < 100; i++) {
+    ASSERT_TRUE(selector_.SelectWorkQueueToService(&chosen_work_queue));
+    EXPECT_EQ(task_queues_[1].get(), chosen_work_queue->task_queue());
+    // Don't remove task from queue to simulate all queues still being full.
+  }
+
+  // Check that high priority tasks starve best effort.
   selector_.SetQueuePriority(task_queues_[1].get(), TaskQueue::kHighPriority);
   for (int i = 0; i < 100; i++) {
     ASSERT_TRUE(selector_.SelectWorkQueueToService(&chosen_work_queue));
     EXPECT_EQ(task_queues_[1].get(), chosen_work_queue->task_queue());
     // Don't remove task from queue to simulate all queues still being full.
   }
+
+  // Check that low priority tasks starve best effort.
+  selector_.SetQueuePriority(task_queues_[1].get(), TaskQueue::kLowPriority);
+  for (int i = 0; i < 100; i++) {
+    ASSERT_TRUE(selector_.SelectWorkQueueToService(&chosen_work_queue));
+    EXPECT_EQ(task_queues_[1].get(), chosen_work_queue->task_queue());
+    // Don't remove task from queue to simulate all queues still being full.
+  }
+
+  // Check that control priority tasks starve best effort.
   selector_.SetQueuePriority(task_queues_[1].get(),
                              TaskQueue::kControlPriority);
   for (int i = 0; i < 100; i++) {
diff --git a/third_party/WebKit/Source/platform/scheduler/main_thread/main_thread_scheduler.cc b/third_party/WebKit/Source/platform/scheduler/main_thread/main_thread_scheduler.cc
index 5119f6e..27b61542 100644
--- a/third_party/WebKit/Source/platform/scheduler/main_thread/main_thread_scheduler.cc
+++ b/third_party/WebKit/Source/platform/scheduler/main_thread/main_thread_scheduler.cc
@@ -728,7 +728,7 @@
                           .SetCanBeThrottled(true));
 }
 
-std::unique_ptr<RenderWidgetSchedulingState>
+std::unique_ptr<WebRenderWidgetSchedulingState>
 RendererSchedulerImpl::NewRenderWidgetSchedulingState() {
   return render_widget_scheduler_signals_.NewRenderWidgetSchedulingState();
 }
@@ -1428,7 +1428,7 @@
         new_policy.rail_mode() = v8::PERFORMANCE_RESPONSE;
         expensive_task_policy = ExpensiveTaskPolicy::kBlock;
         new_policy.compositor_queue_policy().priority =
-            TaskQueue::kHighPriority;
+            TaskQueue::kHighestPriority;
       } else {
         // What we really want to do is priorize loading tasks, but that doesn't
         // seem to be safe. Instead we do that by proxy by deprioritizing
@@ -1440,7 +1440,7 @@
 
     case UseCase::kSynchronizedGesture:
       new_policy.compositor_queue_policy().priority =
-          main_thread_compositing_is_fast ? TaskQueue::kHighPriority
+          main_thread_compositing_is_fast ? TaskQueue::kHighestPriority
                                           : TaskQueue::kNormalPriority;
       if (touchstart_expected_soon) {
         new_policy.rail_mode() = v8::PERFORMANCE_RESPONSE;
@@ -1456,7 +1456,7 @@
       // block expensive tasks because we don't know whether they were integral
       // to the page's functionality or not.
       new_policy.compositor_queue_policy().priority =
-          main_thread_compositing_is_fast ? TaskQueue::kHighPriority
+          main_thread_compositing_is_fast ? TaskQueue::kHighestPriority
                                           : TaskQueue::kNormalPriority;
       break;
 
@@ -1465,7 +1465,8 @@
       // by the main thread. Since we know the established gesture type, we can
       // be a little more aggressive about prioritizing compositing and input
       // handling over other tasks.
-      new_policy.compositor_queue_policy().priority = TaskQueue::kHighPriority;
+      new_policy.compositor_queue_policy().priority =
+          TaskQueue::kHighestPriority;
       if (touchstart_expected_soon) {
         new_policy.rail_mode() = v8::PERFORMANCE_RESPONSE;
         expensive_task_policy = ExpensiveTaskPolicy::kBlock;
@@ -1476,7 +1477,8 @@
 
     case UseCase::kTouchstart:
       new_policy.rail_mode() = v8::PERFORMANCE_RESPONSE;
-      new_policy.compositor_queue_policy().priority = TaskQueue::kHighPriority;
+      new_policy.compositor_queue_policy().priority =
+          TaskQueue::kHighestPriority;
       new_policy.loading_queue_policy().is_blocked = true;
       new_policy.timer_queue_policy().is_blocked = true;
       // NOTE this is a nop due to the above.
@@ -2163,7 +2165,7 @@
 
 TaskQueue::QueuePriority RendererSchedulerImpl::TaskQueuePolicy::GetPriority(
     MainThreadTaskQueue* task_queue) const {
-  return task_queue->UsedForImportantTasks() ? TaskQueue::kHighPriority
+  return task_queue->UsedForImportantTasks() ? TaskQueue::kHighestPriority
                                              : priority;
 }
 
diff --git a/third_party/WebKit/Source/platform/scheduler/main_thread/main_thread_scheduler.h b/third_party/WebKit/Source/platform/scheduler/main_thread/main_thread_scheduler.h
index b20cf4de..56ce888 100644
--- a/third_party/WebKit/Source/platform/scheduler/main_thread/main_thread_scheduler.h
+++ b/third_party/WebKit/Source/platform/scheduler/main_thread/main_thread_scheduler.h
@@ -49,9 +49,9 @@
 class RendererSchedulerImplTest;
 FORWARD_DECLARE_TEST(RendererSchedulerImplTest, Tracing);
 }  // namespace renderer_scheduler_impl_unittest
-class RenderWidgetSchedulingState;
 class PageSchedulerImpl;
 class TaskQueueThrottler;
+class WebRenderWidgetSchedulingState;
 
 // TODO(yutak): Rename this class to MainThreadScheduler.
 class PLATFORM_EXPORT RendererSchedulerImpl
@@ -98,8 +98,8 @@
   std::unique_ptr<WebThread> CreateMainThread() override;
   scoped_refptr<SingleThreadIdleTaskRunner> IdleTaskRunner() override;
   scoped_refptr<base::SingleThreadTaskRunner> IPCTaskRunner() override;
-  std::unique_ptr<RenderWidgetSchedulingState> NewRenderWidgetSchedulingState()
-      override;
+  std::unique_ptr<WebRenderWidgetSchedulingState>
+  NewRenderWidgetSchedulingState() override;
   void WillBeginFrame(const viz::BeginFrameArgs& args) override;
   void BeginFrameNotExpectedSoon() override;
   void BeginMainFrameNotExpectedUntil(base::TimeTicks time) override;
@@ -297,7 +297,7 @@
   }
 
  private:
-  friend class RenderWidgetSchedulingState;
+  friend class WebRenderWidgetSchedulingState;
   friend class RendererMetricsHelper;
 
   friend class RendererMetricsHelperTest;
diff --git a/third_party/WebKit/Source/platform/scheduler/main_thread/main_thread_scheduler_unittest.cc b/third_party/WebKit/Source/platform/scheduler/main_thread/main_thread_scheduler_unittest.cc
index 5fc2bfb3..316751f45 100644
--- a/third_party/WebKit/Source/platform/scheduler/main_thread/main_thread_scheduler_unittest.cc
+++ b/third_party/WebKit/Source/platform/scheduler/main_thread/main_thread_scheduler_unittest.cc
@@ -3534,7 +3534,7 @@
     EXPECT_EQ(UseCase::kMainThreadGesture, CurrentUseCase()) << "i = " << i;
   }
 
-  EXPECT_EQ(TaskQueue::kHighPriority,
+  EXPECT_EQ(TaskQueue::kHighestPriority,
             scheduler_->CompositorTaskQueue()->GetQueuePriority());
   EXPECT_EQ(279u, run_order.size());
 }
diff --git a/third_party/WebKit/Source/platform/scheduler/main_thread/render_widget_scheduling_state.cc b/third_party/WebKit/Source/platform/scheduler/main_thread/web_render_widget_scheduling_state.cc
similarity index 81%
rename from third_party/WebKit/Source/platform/scheduler/main_thread/render_widget_scheduling_state.cc
rename to third_party/WebKit/Source/platform/scheduler/main_thread/web_render_widget_scheduling_state.cc
index fc573b09..4dfee7d 100644
--- a/third_party/WebKit/Source/platform/scheduler/main_thread/render_widget_scheduling_state.cc
+++ b/third_party/WebKit/Source/platform/scheduler/main_thread/web_render_widget_scheduling_state.cc
@@ -2,14 +2,14 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "public/platform/scheduler/render_widget_scheduling_state.h"
+#include "public/platform/scheduler/web_render_widget_scheduling_state.h"
 
 #include "platform/scheduler/renderer/render_widget_signals.h"
 
 namespace blink {
 namespace scheduler {
 
-RenderWidgetSchedulingState::RenderWidgetSchedulingState(
+WebRenderWidgetSchedulingState::WebRenderWidgetSchedulingState(
     RenderWidgetSignals* render_widget_scheduling_signals)
     : render_widget_signals_(render_widget_scheduling_signals),
       hidden_(false),
@@ -17,7 +17,7 @@
   render_widget_signals_->IncNumVisibleRenderWidgets();
 }
 
-RenderWidgetSchedulingState::~RenderWidgetSchedulingState() {
+WebRenderWidgetSchedulingState::~WebRenderWidgetSchedulingState() {
   if (hidden_)
     return;
 
@@ -28,7 +28,7 @@
   }
 }
 
-void RenderWidgetSchedulingState::SetHidden(bool hidden) {
+void WebRenderWidgetSchedulingState::SetHidden(bool hidden) {
   if (hidden_ == hidden)
     return;
 
@@ -47,7 +47,8 @@
   }
 }
 
-void RenderWidgetSchedulingState::SetHasTouchHandler(bool has_touch_handler) {
+void WebRenderWidgetSchedulingState::SetHasTouchHandler(
+    bool has_touch_handler) {
   if (has_touch_handler_ == has_touch_handler)
     return;
 
diff --git a/third_party/WebKit/Source/platform/scheduler/renderer/main_thread_scheduler_helper.cc b/third_party/WebKit/Source/platform/scheduler/renderer/main_thread_scheduler_helper.cc
index cd22631..b418209 100644
--- a/third_party/WebKit/Source/platform/scheduler/renderer/main_thread_scheduler_helper.cc
+++ b/third_party/WebKit/Source/platform/scheduler/renderer/main_thread_scheduler_helper.cc
@@ -56,7 +56,7 @@
       task_queue_manager_->CreateTaskQueue<MainThreadTaskQueue>(
           params.spec, params, renderer_scheduler_);
   if (params.used_for_important_tasks)
-    task_queue->SetQueuePriority(TaskQueue::QueuePriority::kHighPriority);
+    task_queue->SetQueuePriority(TaskQueue::QueuePriority::kHighestPriority);
   return task_queue;
 }
 
diff --git a/third_party/WebKit/Source/platform/scheduler/renderer/render_widget_signals.cc b/third_party/WebKit/Source/platform/scheduler/renderer/render_widget_signals.cc
index e064113..46f1707 100644
--- a/third_party/WebKit/Source/platform/scheduler/renderer/render_widget_signals.cc
+++ b/third_party/WebKit/Source/platform/scheduler/renderer/render_widget_signals.cc
@@ -6,7 +6,7 @@
 
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
-#include "public/platform/scheduler/render_widget_scheduling_state.h"
+#include "public/platform/scheduler/web_render_widget_scheduling_state.h"
 
 namespace blink {
 namespace scheduler {
@@ -16,9 +16,9 @@
       num_visible_render_widgets_(0),
       num_visible_render_widgets_with_touch_handlers_(0) {}
 
-std::unique_ptr<RenderWidgetSchedulingState>
+std::unique_ptr<WebRenderWidgetSchedulingState>
 RenderWidgetSignals::NewRenderWidgetSchedulingState() {
-  return base::WrapUnique(new RenderWidgetSchedulingState(this));
+  return base::WrapUnique(new WebRenderWidgetSchedulingState(this));
 }
 
 void RenderWidgetSignals::IncNumVisibleRenderWidgets() {
diff --git a/third_party/WebKit/Source/platform/scheduler/renderer/render_widget_signals.h b/third_party/WebKit/Source/platform/scheduler/renderer/render_widget_signals.h
index e1c8a75..4347187 100644
--- a/third_party/WebKit/Source/platform/scheduler/renderer/render_widget_signals.h
+++ b/third_party/WebKit/Source/platform/scheduler/renderer/render_widget_signals.h
@@ -14,7 +14,7 @@
 namespace blink {
 namespace scheduler {
 
-class RenderWidgetSchedulingState;
+class WebRenderWidgetSchedulingState;
 
 class PLATFORM_EXPORT RenderWidgetSignals {
  public:
@@ -37,12 +37,13 @@
 
   explicit RenderWidgetSignals(Observer* observer);
 
-  std::unique_ptr<RenderWidgetSchedulingState> NewRenderWidgetSchedulingState();
+  std::unique_ptr<WebRenderWidgetSchedulingState>
+  NewRenderWidgetSchedulingState();
 
   void AsValueInto(base::trace_event::TracedValue* state) const;
 
  private:
-  friend class RenderWidgetSchedulingState;
+  friend class WebRenderWidgetSchedulingState;
 
   void IncNumVisibleRenderWidgets();
   void DecNumVisibleRenderWidgets();
diff --git a/third_party/WebKit/Source/platform/scheduler/renderer/render_widget_signals_unittest.cc b/third_party/WebKit/Source/platform/scheduler/renderer/render_widget_signals_unittest.cc
index b73a854..0bd3048 100644
--- a/third_party/WebKit/Source/platform/scheduler/renderer/render_widget_signals_unittest.cc
+++ b/third_party/WebKit/Source/platform/scheduler/renderer/render_widget_signals_unittest.cc
@@ -5,7 +5,7 @@
 #include "platform/scheduler/renderer/render_widget_signals.h"
 
 #include "base/macros.h"
-#include "public/platform/scheduler/render_widget_scheduling_state.h"
+#include "public/platform/scheduler/web_render_widget_scheduling_state.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -57,7 +57,7 @@
 
 TEST_F(RenderWidgetSignalsTest, RenderWidgetSchedulingStateLifeCycle) {
   EXPECT_CALL(*mock_observer_, SetAllRenderWidgetsHidden(false)).Times(1);
-  std::unique_ptr<RenderWidgetSchedulingState> widget1_state =
+  std::unique_ptr<WebRenderWidgetSchedulingState> widget1_state =
       render_widget_signals_->NewRenderWidgetSchedulingState();
   Mock::VerifyAndClearExpectations(mock_observer_.get());
 
@@ -66,7 +66,7 @@
 
 TEST_F(RenderWidgetSignalsTest, RenderWidget_Hidden) {
   IgnoreWidgetCreationCallbacks();
-  std::unique_ptr<RenderWidgetSchedulingState> widget1_state =
+  std::unique_ptr<WebRenderWidgetSchedulingState> widget1_state =
       render_widget_signals_->NewRenderWidgetSchedulingState();
   Mock::VerifyAndClearExpectations(mock_observer_.get());
 
@@ -79,7 +79,7 @@
 
 TEST_F(RenderWidgetSignalsTest, RenderWidget_HiddenThreeTimesShownOnce) {
   IgnoreWidgetCreationCallbacks();
-  std::unique_ptr<RenderWidgetSchedulingState> widget1_state =
+  std::unique_ptr<WebRenderWidgetSchedulingState> widget1_state =
       render_widget_signals_->NewRenderWidgetSchedulingState();
   Mock::VerifyAndClearExpectations(mock_observer_.get());
 
@@ -98,11 +98,11 @@
 
 TEST_F(RenderWidgetSignalsTest, MultipleRenderWidgetsBecomeHiddenThenVisible) {
   IgnoreWidgetCreationCallbacks();
-  std::unique_ptr<RenderWidgetSchedulingState> widget1_state =
+  std::unique_ptr<WebRenderWidgetSchedulingState> widget1_state =
       render_widget_signals_->NewRenderWidgetSchedulingState();
-  std::unique_ptr<RenderWidgetSchedulingState> widget2_state =
+  std::unique_ptr<WebRenderWidgetSchedulingState> widget2_state =
       render_widget_signals_->NewRenderWidgetSchedulingState();
-  std::unique_ptr<RenderWidgetSchedulingState> widget3_state =
+  std::unique_ptr<WebRenderWidgetSchedulingState> widget3_state =
       render_widget_signals_->NewRenderWidgetSchedulingState();
   Mock::VerifyAndClearExpectations(mock_observer_.get());
 
@@ -134,7 +134,7 @@
 TEST_F(RenderWidgetSignalsTest, TouchHandlerAddedAndRemoved_VisibleWidget) {
   IgnoreWidgetCreationCallbacks();
 
-  std::unique_ptr<RenderWidgetSchedulingState> widget_state =
+  std::unique_ptr<WebRenderWidgetSchedulingState> widget_state =
       render_widget_signals_->NewRenderWidgetSchedulingState();
   Mock::VerifyAndClearExpectations(mock_observer_.get());
 
@@ -155,7 +155,7 @@
        TouchHandlerAddedThriceAndRemovedOnce_VisibleWidget) {
   IgnoreWidgetCreationCallbacks();
 
-  std::unique_ptr<RenderWidgetSchedulingState> widget_state =
+  std::unique_ptr<WebRenderWidgetSchedulingState> widget_state =
       render_widget_signals_->NewRenderWidgetSchedulingState();
   Mock::VerifyAndClearExpectations(mock_observer_.get());
 
@@ -177,7 +177,7 @@
 TEST_F(RenderWidgetSignalsTest, TouchHandlerAddedAndRemoved_HiddenWidget) {
   IgnoreWidgetCreationCallbacks();
 
-  std::unique_ptr<RenderWidgetSchedulingState> widget_state =
+  std::unique_ptr<WebRenderWidgetSchedulingState> widget_state =
       render_widget_signals_->NewRenderWidgetSchedulingState();
   EXPECT_CALL(*mock_observer_, SetAllRenderWidgetsHidden(true)).Times(1);
   widget_state->SetHidden(true);
@@ -196,11 +196,11 @@
        MultipleTouchHandlerAddedAndRemoved_VisibleWidgets) {
   IgnoreWidgetCreationCallbacks();
 
-  std::unique_ptr<RenderWidgetSchedulingState> widget1_state =
+  std::unique_ptr<WebRenderWidgetSchedulingState> widget1_state =
       render_widget_signals_->NewRenderWidgetSchedulingState();
-  std::unique_ptr<RenderWidgetSchedulingState> widget2_state =
+  std::unique_ptr<WebRenderWidgetSchedulingState> widget2_state =
       render_widget_signals_->NewRenderWidgetSchedulingState();
-  std::unique_ptr<RenderWidgetSchedulingState> widget3_state =
+  std::unique_ptr<WebRenderWidgetSchedulingState> widget3_state =
       render_widget_signals_->NewRenderWidgetSchedulingState();
   Mock::VerifyAndClearExpectations(mock_observer_.get());
 
@@ -235,7 +235,7 @@
        TouchHandlerAddedThenWigetDeleted_VisibleWidget) {
   IgnoreWidgetCreationCallbacks();
 
-  std::unique_ptr<RenderWidgetSchedulingState> widget_state =
+  std::unique_ptr<WebRenderWidgetSchedulingState> widget_state =
       render_widget_signals_->NewRenderWidgetSchedulingState();
   Mock::VerifyAndClearExpectations(mock_observer_.get());
 
@@ -253,7 +253,7 @@
        TouchHandlerAddedThenWigetDeleted_HiddenWidget) {
   IgnoreWidgetCreationCallbacks();
 
-  std::unique_ptr<RenderWidgetSchedulingState> widget_state =
+  std::unique_ptr<WebRenderWidgetSchedulingState> widget_state =
       render_widget_signals_->NewRenderWidgetSchedulingState();
   EXPECT_CALL(*mock_observer_, SetAllRenderWidgetsHidden(true)).Times(1);
   widget_state->SetHidden(true);
diff --git a/third_party/WebKit/Source/platform/scheduler/test/fake_renderer_scheduler.cc b/third_party/WebKit/Source/platform/scheduler/test/fake_renderer_scheduler.cc
index 72ced3e..e5c9072 100644
--- a/third_party/WebKit/Source/platform/scheduler/test/fake_renderer_scheduler.cc
+++ b/third_party/WebKit/Source/platform/scheduler/test/fake_renderer_scheduler.cc
@@ -46,7 +46,7 @@
   return nullptr;
 }
 
-std::unique_ptr<RenderWidgetSchedulingState>
+std::unique_ptr<WebRenderWidgetSchedulingState>
 FakeRendererScheduler::NewRenderWidgetSchedulingState() {
   return nullptr;
 }
diff --git a/third_party/WebKit/common/client_hints/client_hints.cc b/third_party/WebKit/common/client_hints/client_hints.cc
index 7b658201..32c3286e 100644
--- a/third_party/WebKit/common/client_hints/client_hints.cc
+++ b/third_party/WebKit/common/client_hints/client_hints.cc
@@ -14,4 +14,12 @@
 const size_t kClientHintsHeaderMappingCount =
     arraysize(kClientHintsHeaderMapping);
 
+const char* const kWebEffectiveConnectionTypeMapping[] = {
+    "4g" /* Unknown */, "4g" /* Offline */, "slow-2g" /* Slow 2G */,
+    "2g" /* 2G */,      "3g" /* 3G */,      "4g" /* 4G */
+};
+
+const size_t kWebEffectiveConnectionTypeMappingCount =
+    arraysize(kWebEffectiveConnectionTypeMapping);
+
 }  // namespace blink
diff --git a/third_party/WebKit/public/BUILD.gn b/third_party/WebKit/public/BUILD.gn
index eb9a01c..f69382c 100644
--- a/third_party/WebKit/public/BUILD.gn
+++ b/third_party/WebKit/public/BUILD.gn
@@ -441,10 +441,10 @@
     "platform/modules/webmidi/WebMIDIAccessor.h",
     "platform/modules/webmidi/WebMIDIAccessorClient.h",
     "platform/scheduler/child/webthread_base.h",
-    "platform/scheduler/render_widget_scheduling_state.h",
     "platform/scheduler/renderer_process_type.h",
     "platform/scheduler/single_thread_idle_task_runner.h",
     "platform/scheduler/web_main_thread_scheduler.h",
+    "platform/scheduler/web_render_widget_scheduling_state.h",
     "platform/scheduler/web_thread_scheduler.h",
     "web/WebAXEnums.h",
     "web/WebAXObject.h",
diff --git a/third_party/WebKit/public/common/client_hints/client_hints.h b/third_party/WebKit/public/common/client_hints/client_hints.h
index f0437d8..5dbc5ff 100644
--- a/third_party/WebKit/public/common/client_hints/client_hints.h
+++ b/third_party/WebKit/public/common/client_hints/client_hints.h
@@ -18,6 +18,17 @@
 
 BLINK_COMMON_EXPORT extern const size_t kClientHintsHeaderMappingCount;
 
+// Mapping from WebEffectiveConnectionType to the header value. This value is
+// sent to the origins and is returned by the JavaScript API. The ordering
+// should match the ordering in //net/nqe/effective_connection_type.h and
+// public/platform/WebEffectiveConnectionType.h.
+// This array should be updated if either of the enums in
+// effective_connection_type.h or WebEffectiveConnectionType.h are updated.
+BLINK_COMMON_EXPORT extern const char* const
+    kWebEffectiveConnectionTypeMapping[];
+
+BLINK_COMMON_EXPORT extern const size_t kWebEffectiveConnectionTypeMappingCount;
+
 }  // namespace blink
 
 #endif  // THIRD_PARTY_WEBKIT_PUBLIC_COMMON_CLIENT_HINTS_CLIENT_HINTS_H_
diff --git a/third_party/WebKit/public/platform/modules/payments/payment_app.mojom b/third_party/WebKit/public/platform/modules/payments/payment_app.mojom
index aee2fc6..38ac724 100644
--- a/third_party/WebKit/public/platform/modules/payments/payment_app.mojom
+++ b/third_party/WebKit/public/platform/modules/payments/payment_app.mojom
@@ -25,7 +25,7 @@
 struct PaymentInstrument {
   string name;
   array<blink.mojom.ManifestIcon> icons;
-  array<string> enabled_methods;
+  string method;
   string stringified_capabilities;
 
   // Parsed basic-card specific capabilities.
diff --git a/third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerNetworkProvider.h b/third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerNetworkProvider.h
index 88b9711..5220c91 100644
--- a/third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerNetworkProvider.h
+++ b/third_party/WebKit/public/platform/modules/serviceworker/WebServiceWorkerNetworkProvider.h
@@ -71,10 +71,9 @@
   // associated with the WebDocumentLoader.
   virtual int64_t ControllerServiceWorkerID() { return -1; }
 
+  // S13nServiceWorker:
   // Returns a URLLoader for the associated context. May return nullptr
   // if this doesn't provide a ServiceWorker specific URLLoader.
-  // Currently this returns non-null only for a controller worker case
-  // and only if servicification is enabled.
   virtual std::unique_ptr<WebURLLoader> CreateURLLoader(
       const WebURLRequest& request,
       scoped_refptr<base::SingleThreadTaskRunner> task_runner) {
diff --git a/third_party/WebKit/public/platform/scheduler/render_widget_scheduling_state.h b/third_party/WebKit/public/platform/scheduler/render_widget_scheduling_state.h
deleted file mode 100644
index a9ea8a0..0000000
--- a/third_party/WebKit/public/platform/scheduler/render_widget_scheduling_state.h
+++ /dev/null
@@ -1,37 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef THIRD_PARTY_WEBKIT_PUBLIC_PLATFORM_SCHEDULER_RENDER_WIDGET_SCHEDULING_STATE_H_
-#define THIRD_PARTY_WEBKIT_PUBLIC_PLATFORM_SCHEDULER_RENDER_WIDGET_SCHEDULING_STATE_H_
-
-#include "public/platform/WebCommon.h"
-
-namespace blink {
-namespace scheduler {
-
-class RenderWidgetSignals;
-
-// TODO(yutak): Does this class need to have "Web" prefix?
-class BLINK_PLATFORM_EXPORT RenderWidgetSchedulingState {
- public:
-  void SetHidden(bool hidden);
-  void SetHasTouchHandler(bool has_touch_handler);
-
-  ~RenderWidgetSchedulingState();
-
- private:
-  friend class RenderWidgetSignals;
-
-  explicit RenderWidgetSchedulingState(
-      RenderWidgetSignals* render_widget_scheduling_signals);
-
-  RenderWidgetSignals* render_widget_signals_;  // NOT OWNED
-  bool hidden_;
-  bool has_touch_handler_;
-};
-
-}  // namespace scheduler
-}  // namespace blink
-
-#endif  // THIRD_PARTY_WEBKIT_PUBLIC_PLATFORM_SCHEDULER_RENDER_WIDGET_SCHEDULING_STATE_H_
diff --git a/third_party/WebKit/public/platform/scheduler/test/fake_renderer_scheduler.h b/third_party/WebKit/public/platform/scheduler/test/fake_renderer_scheduler.h
index d8b75fd..3f058fd1 100644
--- a/third_party/WebKit/public/platform/scheduler/test/fake_renderer_scheduler.h
+++ b/third_party/WebKit/public/platform/scheduler/test/fake_renderer_scheduler.h
@@ -26,8 +26,8 @@
   scoped_refptr<base::SingleThreadTaskRunner> InputTaskRunner() override;
   scoped_refptr<SingleThreadIdleTaskRunner> IdleTaskRunner() override;
   scoped_refptr<base::SingleThreadTaskRunner> IPCTaskRunner() override;
-  std::unique_ptr<RenderWidgetSchedulingState> NewRenderWidgetSchedulingState()
-      override;
+  std::unique_ptr<WebRenderWidgetSchedulingState>
+  NewRenderWidgetSchedulingState() override;
   void WillBeginFrame(const viz::BeginFrameArgs& args) override;
   void BeginFrameNotExpectedSoon() override;
   void BeginMainFrameNotExpectedUntil(base::TimeTicks time) override;
diff --git a/third_party/WebKit/public/platform/scheduler/test/mock_renderer_scheduler.h b/third_party/WebKit/public/platform/scheduler/test/mock_renderer_scheduler.h
index b49fe28..25d0de1 100644
--- a/third_party/WebKit/public/platform/scheduler/test/mock_renderer_scheduler.h
+++ b/third_party/WebKit/public/platform/scheduler/test/mock_renderer_scheduler.h
@@ -34,7 +34,7 @@
                scoped_refptr<blink::scheduler::SingleThreadIdleTaskRunner>());
   MOCK_METHOD0(IPCTaskRunner, scoped_refptr<base::SingleThreadTaskRunner>());
   MOCK_METHOD0(NewRenderWidgetSchedulingState,
-               std::unique_ptr<RenderWidgetSchedulingState>());
+               std::unique_ptr<WebRenderWidgetSchedulingState>());
   MOCK_METHOD1(WillBeginFrame, void(const viz::BeginFrameArgs&));
   MOCK_METHOD0(BeginFrameNotExpectedSoon, void());
   MOCK_METHOD1(BeginMainFrameNotExpectedUntil, void(base::TimeTicks));
diff --git a/third_party/WebKit/public/platform/scheduler/web_main_thread_scheduler.h b/third_party/WebKit/public/platform/scheduler/web_main_thread_scheduler.h
index 3d142487..b334a8d 100644
--- a/third_party/WebKit/public/platform/scheduler/web_main_thread_scheduler.h
+++ b/third_party/WebKit/public/platform/scheduler/web_main_thread_scheduler.h
@@ -17,8 +17,8 @@
 #include "public/platform/WebCommon.h"
 #include "public/platform/WebInputEventResult.h"
 #include "public/platform/WebScopedVirtualTimePauser.h"
-#include "public/platform/scheduler/render_widget_scheduling_state.h"
 #include "public/platform/scheduler/single_thread_idle_task_runner.h"
+#include "public/platform/scheduler/web_render_widget_scheduling_state.h"
 #include "public/platform/scheduler/web_thread_scheduler.h"
 #include "v8/include/v8.h"
 
@@ -41,7 +41,7 @@
 namespace scheduler {
 
 enum class RendererProcessType;
-class RenderWidgetSchedulingState;
+class WebRenderWidgetSchedulingState;
 
 class BLINK_PLATFORM_EXPORT WebMainThreadScheduler : public WebThreadScheduler {
  public:
@@ -69,9 +69,9 @@
   // Creates a WebThread implementation for the renderer main thread.
   virtual std::unique_ptr<WebThread> CreateMainThread() = 0;
 
-  // Returns a new RenderWidgetSchedulingState.  The signals from this will be
-  // used to make scheduling decisions.
-  virtual std::unique_ptr<RenderWidgetSchedulingState>
+  // Returns a new WebRenderWidgetSchedulingState.  The signals from this will
+  // be used to make scheduling decisions.
+  virtual std::unique_ptr<WebRenderWidgetSchedulingState>
   NewRenderWidgetSchedulingState() = 0;
 
   // Called to notify about the start of an extended period where no frames
diff --git a/third_party/WebKit/public/platform/scheduler/web_render_widget_scheduling_state.h b/third_party/WebKit/public/platform/scheduler/web_render_widget_scheduling_state.h
new file mode 100644
index 0000000..3fa1319
--- /dev/null
+++ b/third_party/WebKit/public/platform/scheduler/web_render_widget_scheduling_state.h
@@ -0,0 +1,36 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_WEBKIT_PUBLIC_PLATFORM_SCHEDULER_WEB_RENDER_WIDGET_SCHEDULING_STATE_H_
+#define THIRD_PARTY_WEBKIT_PUBLIC_PLATFORM_SCHEDULER_WEB_RENDER_WIDGET_SCHEDULING_STATE_H_
+
+#include "public/platform/WebCommon.h"
+
+namespace blink {
+namespace scheduler {
+
+class RenderWidgetSignals;
+
+class BLINK_PLATFORM_EXPORT WebRenderWidgetSchedulingState {
+ public:
+  void SetHidden(bool hidden);
+  void SetHasTouchHandler(bool has_touch_handler);
+
+  ~WebRenderWidgetSchedulingState();
+
+ private:
+  friend class RenderWidgetSignals;
+
+  explicit WebRenderWidgetSchedulingState(
+      RenderWidgetSignals* render_widget_scheduling_signals);
+
+  RenderWidgetSignals* render_widget_signals_;  // NOT OWNED
+  bool hidden_;
+  bool has_touch_handler_;
+};
+
+}  // namespace scheduler
+}  // namespace blink
+
+#endif  // THIRD_PARTY_WEBKIT_PUBLIC_PLATFORM_SCHEDULER_WEB_RENDER_WIDGET_SCHEDULING_STATE_H_
diff --git a/third_party/WebKit/public/web/WebSharedWorkerClient.h b/third_party/WebKit/public/web/WebSharedWorkerClient.h
index 89f4559..ce3d9b0e 100644
--- a/third_party/WebKit/public/web/WebSharedWorkerClient.h
+++ b/third_party/WebKit/public/web/WebSharedWorkerClient.h
@@ -47,8 +47,7 @@
 // the Worker object, unless noted.
 //
 // An instance of this class must outlive WebSharedWorker (i.e. must be kept
-// alive until WorkerScriptLoadFailed() or WorkerContextDestroyed() is
-// called).
+// alive until WorkerScriptLoadFailed() or WorkerContextDestroyed() is called).
 class WebSharedWorkerClient {
  public:
   virtual void CountFeature(mojom::WebFeature) = 0;
@@ -68,16 +67,30 @@
   virtual std::unique_ptr<WebApplicationCacheHost> CreateApplicationCacheHost(
       WebApplicationCacheHostClient*) = 0;
 
-  // Called on the main thread during initialization.
+  // Called on the main thread during initialization, before requesting the main
+  // script resource. Creates the ServiceWorkerNetworkProvider which is used for
+  // script loading (i.e., the main script and importScripts). Other requests
+  // (e.g., fetch and XHR) go through WebWorkerFetchContext.
   virtual std::unique_ptr<WebServiceWorkerNetworkProvider>
   CreateServiceWorkerNetworkProvider() = 0;
 
-  // Returns a new WebWorkerFetchContext for the shared worker. Ownership of the
-  // returned object is transferred to the caller.
+  // Called on the main thread during initialization, after the main script
+  // resource finished loading. Creates a new WebWorkerFetchContext for the
+  // shared worker. This is passed to the worker thread and used for non-script
+  // loading requests from the shared worker (e.g., fetch and XHR). Requests for
+  // script loading (i.e., the main script and importScripts) go through
+  // WebServiceWorkerNetworkProvider.
   virtual std::unique_ptr<WebWorkerFetchContext> CreateWorkerFetchContext(
-      WebServiceWorkerNetworkProvider*) {
-    return nullptr;
-  }
+      WebServiceWorkerNetworkProvider*) = 0;
+
+  // Called on the main thread during initialization. The browser process is
+  // expected to send a SetController IPC before sending the script response if
+  // appropriate, but there is no ordering guarantee of the messages on the
+  // renderer. This waits for the SetController IPC to be received if it was
+  // sent.
+  virtual void WaitForServiceWorkerControllerInfo(
+      blink::WebServiceWorkerNetworkProvider* web_network_provider,
+      base::OnceClosure callback) = 0;
 };
 
 }  // namespace blink
diff --git a/third_party/feed/README.chromium b/third_party/feed/README.chromium
index a63bf1a..6d49dc3f 100644
--- a/third_party/feed/README.chromium
+++ b/third_party/feed/README.chromium
@@ -2,7 +2,7 @@
 Short name: feed
 URL: https://chromium.googlesource.com/feed
 Version: 0
-Revision: 31ad36da1a0f992ca482506ad1ff7f94dd94573b
+Revision: 3a782b5dac6c8f2f927613d3f37b8cad72f934b2
 License: Apache 2.0
 License File: LICENSE
 Security Critical: yes
diff --git a/third_party/feed/java_sources.gni b/third_party/feed/java_sources.gni
index b7b9ca5..c0ef630 100644
--- a/third_party/feed/java_sources.gni
+++ b/third_party/feed/java_sources.gni
@@ -45,6 +45,7 @@
   "src/src/main/java/com/google/android/libraries/feed/common/Dumpable.java",
   "src/src/main/java/com/google/android/libraries/feed/common/Dumper.java",
   "src/src/main/java/com/google/android/libraries/feed/common/Logger.java",
+  "src/src/main/java/com/google/android/libraries/feed/common/Result.java",
   "src/src/main/java/com/google/android/libraries/feed/common/SettableSupplier.java",
   "src/src/main/java/com/google/android/libraries/feed/common/SimpleSettableFuture.java",
   "src/src/main/java/com/google/android/libraries/feed/common/Supplier.java",
@@ -70,6 +71,7 @@
   "src/src/main/java/com/google/android/libraries/feed/feedprotocoladapter/FeedProtocolAdapter.java",
   "src/src/main/java/com/google/android/libraries/feed/feedrequestmanager/FeedRequestManager.java",
   "src/src/main/java/com/google/android/libraries/feed/feedsessionmanager/FeedSessionManager.java",
+  "src/src/main/java/com/google/android/libraries/feed/feedsessionmanager/internal/ContentCache.java",
   "src/src/main/java/com/google/android/libraries/feed/feedsessionmanager/internal/HeadSessionImpl.java",
   "src/src/main/java/com/google/android/libraries/feed/feedsessionmanager/internal/InitializableSession.java",
   "src/src/main/java/com/google/android/libraries/feed/feedsessionmanager/internal/Session.java",
@@ -83,7 +85,7 @@
   "src/src/main/java/com/google/android/libraries/feed/host/action/ActionApi.java",
   "src/src/main/java/com/google/android/libraries/feed/host/action/StreamActionApi.java",
   "src/src/main/java/com/google/android/libraries/feed/host/common/ProtoExtensionProvider.java",
-  "src/src/main/java/com/google/android/libraries/feed/host/config/ConfigManager.java",
+  "src/src/main/java/com/google/android/libraries/feed/host/config/Configuration.java",
   "src/src/main/java/com/google/android/libraries/feed/host/imageloader/ImageLoaderApi.java",
   "src/src/main/java/com/google/android/libraries/feed/host/logging/LoggingApi.java",
   "src/src/main/java/com/google/android/libraries/feed/host/network/HttpRequest.java",
@@ -105,6 +107,7 @@
   "src/src/main/java/com/google/android/libraries/feed/hostimpl/storage/InMemoryContentStorage.java",
   "src/src/main/java/com/google/android/libraries/feed/hostimpl/storage/InMemoryJournalStorage.java",
   "src/src/main/java/com/google/android/libraries/feed/hostimpl/storage/PersistentContentStorage.java",
+  "src/src/main/java/com/google/android/libraries/feed/hostimpl/storage/PersistentJournalStorage.java",
   "src/src/main/java/com/google/android/libraries/feed/hostimpl/stream/DefaultCardConfiguration.java",
   "src/src/main/java/com/google/android/libraries/feed/hostimpl/stream/DefaultStreamConfiguration.java",
   "src/src/main/java/com/google/android/libraries/feed/mocknetworkclient/MockServerNetworkClient.java",
@@ -139,6 +142,6 @@
   "src/src/main/java/com/google/android/libraries/feed/piet/host/AssetProvider.java",
   "src/src/main/java/com/google/android/libraries/feed/piet/host/CustomElementProvider.java",
   "src/src/main/java/com/google/android/libraries/feed/piet/ui/RoundedCornerColorDrawable.java",
-  "src/src/main/java/com/google/android/libraries/feed/piet/util/Producer.java",
-  "src/src/main/java/com/google/android/libraries/feed/piet/util/Producers.java",
+  "src/src/main/java/com/google/android/libraries/feed/piet/ui/RoundedCornerImageView.java",
+  "src/src/main/java/com/google/android/libraries/feed/piet/ui/RoundedCornerViewHelper.java",
 ]
diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
index d2d2a8c..d7c1e28b3 100644
--- a/tools/metrics/histograms/enums.xml
+++ b/tools/metrics/histograms/enums.xml
@@ -602,6 +602,21 @@
   <int value="8" label="User navigated backward in the tab's history"/>
 </enum>
 
+<enum name="AndroidApiLevel">
+  <int value="16" label="JELLY_BEAN"/>
+  <int value="17" label="JELLY_BEAN_MR1"/>
+  <int value="18" label="JELLY_BEAN_MR2"/>
+  <int value="19" label="KITKAT"/>
+  <int value="20" label="KITKAT_WATCH"/>
+  <int value="21" label="LOLLIPOP"/>
+  <int value="22" label="LILLIPOP_MR1"/>
+  <int value="23" label="M"/>
+  <int value="24" label="N"/>
+  <int value="25" label="N_MR1"/>
+  <int value="26" label="O"/>
+  <int value="27" label="O_MR1"/>
+</enum>
+
 <enum name="AndroidArmFpu">
   <int value="0" label="No NEON support"/>
   <int value="1" label="NEON support"/>
@@ -42318,6 +42333,9 @@
 </enum>
 
 <enum name="SSLVersionInterferenceDetails">
+  <obsolete>
+    Removed April 2018.
+  </obsolete>
   <int value="0" label="Other"/>
   <int value="1" label="Connection closed"/>
   <int value="2" label="Connection reset"/>
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index 506c8c3..ec65cce 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -1868,6 +1868,23 @@
   <summary>The number of bytes written for the tab metadata file.</summary>
 </histogram>
 
+<histogram name="Android.WebView.LoadDataWithBaseUrl.HistoryUrl"
+    enum="HistoryUrlType">
+  <owner>jamwalla@chromium.org</owner>
+  <summary>
+    Records whether the historyUrl parameter to loadDataWithBaseUrl is empty/
+    null, the same as the baseUrl parameter, or different from baseUrl.
+  </summary>
+</histogram>
+
+<histogram name="Android.WebView.TargetSdkVersion" enum="AndroidApiLevel">
+  <owner>changwan@chromium.org</owner>
+  <summary>
+    The version of the target SDK of the app WebView is running in. This is
+    recorded at WebView creation.
+  </summary>
+</histogram>
+
 <histogram name="AndroidTabCloseUndo.Toast"
     enum="AndroidTabCloseUndoToastEvent">
   <owner>dtrainor@chromium.org</owner>
@@ -50570,6 +50587,9 @@
 
 <histogram name="Net.SSLVersionInterferenceDetails_TLS13Experiment"
     enum="SSLVersionInterferenceDetails">
+  <obsolete>
+    Removed April 2018.
+  </obsolete>
   <owner>davidben@chromium.org</owner>
   <owner>svaldez@chromium.org</owner>
   <summary>
@@ -104858,6 +104878,10 @@
 </histogram>
 
 <histogram name="WebView.LoadDataWithBaseUrl.HistoryUrl" enum="HistoryUrlType">
+  <obsolete>
+    Obsolete 04/04/2018 as it has been replaced by
+    Android.WebView.LoadDataWithBaseUrl.HistoryUrl.
+  </obsolete>
   <owner>jamwalla@chromium.org</owner>
   <summary>
     Records whether the historyUrl parameter to loadDataWithBaseUrl is empty/
@@ -114539,15 +114563,27 @@
   <suffix name="AfterBackgrounded.15min"
       label="Recorded 15 minutes after backgrounded."/>
   <suffix name="PeakDuringLoad"
-      label="Polled each time CreateURLLoader is called, and the maximum
-             value is recorded when DidFinishLoad is called."/>
+      label="Polled each time CreateURLLoader is called, and the maximum value
+             is recorded when DidFinishLoad is called.">
+    <obsolete>
+      Deprecated as of 04/2018. No longer recorded.
+    </obsolete>
+  </suffix>
   <suffix name="MainFrame.PeakDuringLoad"
       label="In the main frame, polled each time CreateURLLoader is called,
-             and the maximum value is recorded when DidFinishLoad is called."/>
+             and the maximum value is recorded when DidFinishLoad is called.">
+    <obsolete>
+      Deprecated as of 04/2018. No longer recorded.
+    </obsolete>
+  </suffix>
   <suffix name="ServiceWorkerControlledMainFrame.PeakDuringLoad"
-      label="In the main frame which is controlled by a service worker,
-             polled each time CreateURLLoader is called, and the maximum
-             value is recorded when DidFinishLoad is called."/>
+      label="In the main frame which is controlled by a service worker, polled
+             each time CreateURLLoader is called, and the maximum value is
+             recorded when DidFinishLoad is called.">
+    <obsolete>
+      Deprecated as of 04/2018. No longer recorded.
+    </obsolete>
+  </suffix>
   <affected-histogram name="Memory.Experimental.Renderer.BlinkGC"/>
   <affected-histogram name="Memory.Experimental.Renderer.Discardable"/>
   <affected-histogram name="Memory.Experimental.Renderer.Malloc"/>
diff --git a/tools/perf/benchmark.csv b/tools/perf/benchmark.csv
index d5a3825..ca641580 100644
--- a/tools/perf/benchmark.csv
+++ b/tools/perf/benchmark.csv
@@ -72,7 +72,7 @@
 smoothness.tough_animation_cases,alancutter@chromium.org,
 smoothness.tough_canvas_cases,junov@chromium.org,
 smoothness.tough_filters_cases,senorblanco@chromium.org,
-smoothness.tough_image_decode_cases,,
+smoothness.tough_image_decode_cases,"vmiura@chromium.org, sadrul@chromium.org",
 smoothness.tough_path_rendering_cases,senorblanco@chromium.org,
 smoothness.tough_pinch_zoom_cases,bokan@chromium.org,
 smoothness.tough_scrolling_cases,reveman@chromium.org,
@@ -91,10 +91,10 @@
 system_health.memory_mobile,perezju@chromium.org,
 system_health.webview_startup,"perezju@chromium.org, torne@chromium.org",
 tab_switching.typical_25,vovoy@chromium.org,OS>Performance
-thread_times.key_hit_test_cases,,
+thread_times.key_hit_test_cases,"vmiura@chromium.org, sadrul@chromium.org",
 thread_times.key_idle_power_cases,skyostil@chromium.org,
 thread_times.key_mobile_sites_smooth,vmiura@chromium.org,
-thread_times.key_noop_cases,,
+thread_times.key_noop_cases,"vmiura@chromium.org, sadrul@chromium.org",
 thread_times.key_silk_cases,vmiura@chromium.org,
 thread_times.simple_mobile_sites,vmiura@chromium.org,
 thread_times.tough_compositor_cases,vmiura@chromium.org,
diff --git a/tools/perf/benchmarks/smoothness.py b/tools/perf/benchmarks/smoothness.py
index 6f64046d..34acaed 100644
--- a/tools/perf/benchmarks/smoothness.py
+++ b/tools/perf/benchmarks/smoothness.py
@@ -330,6 +330,7 @@
     return 'smoothness.gpu_rasterization.tough_scrolling_cases'
 
 
+@benchmark.Owner(emails=['vmiura@chromium.org', 'sadrul@chromium.org'])
 class SmoothnessToughImageDecodeCases(_Smoothness):
   page_set = page_sets.ToughImageDecodeCasesPageSet
 
diff --git a/tools/perf/benchmarks/thread_times.py b/tools/perf/benchmarks/thread_times.py
index 69d00b5..7b05868 100644
--- a/tools/perf/benchmarks/thread_times.py
+++ b/tools/perf/benchmarks/thread_times.py
@@ -46,7 +46,7 @@
   def Name(cls):
     return 'thread_times.key_silk_cases'
 
-
+@benchmark.Owner(emails=['vmiura@chromium.org', 'sadrul@chromium.org'])
 class ThreadTimesKeyHitTestCases(_ThreadTimes):
   """Measure timeline metrics while performing smoothness action on key hit
   testing cases."""
@@ -121,6 +121,7 @@
     return 'per_frame' not in name and 'mean_frame' not in name
 
 
+@benchmark.Owner(emails=['vmiura@chromium.org', 'sadrul@chromium.org'])
 class ThreadTimesKeyNoOpCases(_ThreadTimes):
   """Measures timeline metrics for common interactions and behaviors that should
   have minimal cost. The metrics are per-second rather than per-frame."""
diff --git a/tools/perf/core/perf_data_generator.py b/tools/perf/core/perf_data_generator.py
index 613b336..92ffd046 100755
--- a/tools/perf/core/perf_data_generator.py
+++ b/tools/perf/core/perf_data_generator.py
@@ -989,31 +989,16 @@
   _verify_benchmark_owners(benchmark_metadata)
 
 
-UNOWNED_BENCHMARK_FILE = os.path.abspath(
-    os.path.join(os.path.dirname(__file__), '..', 'unowned_benchmarks.txt'))
-
 # Verify that all benchmarks have owners except those on the whitelist.
 def _verify_benchmark_owners(benchmark_metadata):
   unowned_benchmarks = set()
-
   for benchmark_name in benchmark_metadata:
     if benchmark_metadata[benchmark_name].emails == None:
       unowned_benchmarks.add(benchmark_name)
 
-  # Read in the list of benchmarks that do not have owners.
-  # This list will eventually be empty (BUG=575762)
-  with open(UNOWNED_BENCHMARK_FILE) as f:
-    known_unowned_benchmarks = set(f.read().splitlines())
-
-  error_messages = []
-  for test in unowned_benchmarks - known_unowned_benchmarks:
-    error_messages.append('Benchmarks must have owners; Add owner to ' + test)
-  for test in known_unowned_benchmarks - unowned_benchmarks:
-    error_messages.append('Remove ' + test +
-        ' from %s' % UNOWNED_BENCHMARK_FILE)
-
-  assert unowned_benchmarks == known_unowned_benchmarks, (
-      'Please fix the following errors:\n'+ '\n'.join(error_messages))
+  assert not unowned_benchmarks, (
+      'All benchmarks must have owners. Please add owners for the following '
+      'benchmarks:\n%s' % '\n'.join(unowned_benchmarks))
 
 
 def update_benchmark_csv(file_path):
diff --git a/tools/perf/core/perf_data_generator_unittest.py b/tools/perf/core/perf_data_generator_unittest.py
index 18b1b2e..a2ce381 100644
--- a/tools/perf/core/perf_data_generator_unittest.py
+++ b/tools/perf/core/perf_data_generator_unittest.py
@@ -35,7 +35,7 @@
     }
     benchmarks = {
         'benchmark_name_1': BenchmarkMetadata('foo@bar.com', None, False),
-        'benchmark_name_2': BenchmarkMetadata(None, None, False),
+        'benchmark_name_2': BenchmarkMetadata('darth@deathstar', None, False),
         'benchmark_name_3': BenchmarkMetadata('neo@matrix.org', None, False)
     }
 
diff --git a/tools/perf/expectations.config b/tools/perf/expectations.config
index 2433c2b1..a3e2682 100644
--- a/tools/perf/expectations.config
+++ b/tools/perf/expectations.config
@@ -409,6 +409,7 @@
 crbug.com/664318 [ Android ] v8.runtime_stats.top_25/* [ Skip ]
 crbug.com/664318 [ Win ] v8.runtime_stats.top_25/* [ Skip ]
 crbug.com/829504 [ Linux ] v8.runtime_stats.top_25/https://www.google.de/search?q=v8 [ Skip ]
+crbug.com/829161 [ Mac ] v8.runtime_stats.top_25/https://www.google.de/search?q=v8 [ Skip ]
 
 # Benchmark: wasm
 [ Android_One ] wasm/WasmSpaceBuggy [ Skip ]
diff --git a/tools/perf/unowned_benchmarks.txt b/tools/perf/unowned_benchmarks.txt
deleted file mode 100644
index 1dd0cbe5..0000000
--- a/tools/perf/unowned_benchmarks.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-smoothness.tough_image_decode_cases
-thread_times.key_hit_test_cases
-thread_times.key_noop_cases
diff --git a/tools/traffic_annotation/README.md b/tools/traffic_annotation/README.md
index 15f4da1..1b2b431c 100644
--- a/tools/traffic_annotation/README.md
+++ b/tools/traffic_annotation/README.md
@@ -1,101 +1,48 @@
-# Running the traffic annotation checkers
+# Network Traffic Annotations
+Network traffic annotations provide transparency and auditability for the data
+that Chrome sends to the network. For an introduction, please see
+`docs/network_traffic_annotations.md`.
+This folder provides tools to ensure that every operation in the code base that
+requires annotation, is annotated, and annotations are sound and complete.
 
-The traffic annotation checkers ensure that every operation in the
-code base that talks to the network is properly annotated in the
-source code, so that we can produce reports of what Chromium talks to
-over the network and why.
-Please see `docs/network_traffic_annotations.md` for an introduction to network
-traffic annotations.
+# Traffic Annotation Auditor
+This is the main executable for all the tests. It runs Traffic Annotation
+Extractor clang tool to check the repository, extract annotations, and perform
+required tests and maintanance. See more details in
+`tools/traffic_annotation/auditor/README.md`.
 
-To run the checkers, you need a populated build directory, and then
-you do:
+# Traffic Annotation Extractor
+Traffic Annotation Auditor uses this clang tool (located in
+`tools\clang\traffic_annotation_extractor`) to parse the code and extract
+required data for testing and maintanance.
 
-```
-$ python tools/annotation_checker/presubmit_checks.py --build-path out/Default
-```
+# Building the Checkers
+We do not want every developer to have to build clang tool and auditor, and so
+we store pre-built binaries in a Google Cloud Storage bucket and retrieve them
+via gclient hooks. The binaries are in `tools/traffic_annotation/bin/[platform]`
+folder. To roll new versions of the binaries, please see
+`tools/traffic_annotation/bin/README.md`.
 
-## Building the annotation checker.
+# Automatic Annotation Tests
+Network traffic annotations are tested in commit queue using
+`tools/traffic_annotation/scripts/check_annotations.py`. This test is currently
+run on Linux and Windows trybots, but may expand in future to other platfroms.
+To perform this test fast enough for a trybot and to avoid spamming the commit
+queue if an unexpected general failure happens (see next item), trybot tests are
+run in error resilient mode and only on the changed files. A more complete test
+runs on an FYI bot using
+`tools/traffic_annotation/scripts/traffic_annotation_auditor_tests.py` and
+alerts if tests are not running as expected.
 
-The annotation checkers are built as Clang tools. We do not want every
-developer to have to build clang, and so we store pre-built binaries
-in a Google Cloud Storage bucket and retrieve them via gclient hooks.
+# Emergency Brake
+In the event that clang changes something that requires the tool to be rebuilt
+(or for some other reason the tests don't work correctly), please disable the
+trybot test by setting the `TEST_IS_ENABLED` flag to False in
+`tools/traffic_annotation/scripts/check_annotations.py`, and file a bug and cc
+the people listed in OWNERS; they'll be on the hook to rebuild and re-enable the
+test.
 
-To roll new versions of the binaries, assuming you have write access
-to the chromium-tools-traffic_annotation bucket, run:
-
-# On Linux:
-```bash
-git new-branch roll_traffic_annotation_tools
-python tools/clang/scripts/update.py --bootstrap --force-local-build \
-    --without-android --extra-tools traffic_annotation_extractor
-cp third_party/llvm-build/Release+Asserts/bin/traffic_annotation_extractor \
-    tools/traffic_annotation/bin/linux64/
-
-# These GN flags produce an optimized, stripped binary that has no dependency
-# on glib.
-gn gen --args='is_official_build=true use_ozone=true' out/Default
-
-ninja -C out/Default traffic_annotation_auditor
-cp -p out/Default/traffic_annotation_auditor \
-    tools/traffic_annotation/bin/linux64
-
-strip tools/traffic_annotation/bin/linux64/traffic_annotation_{auditor,extractor}
-
-third_party/depot_tools/upload_to_google_storage.py \
-    -b chromium-tools-traffic_annotation \
-    tools/traffic_annotation/bin/linux64/traffic_annotation_{auditor,extractor}
-sed -i '/^CLANG_REVISION =/d' tools/traffic_annotation/README.md
-sed -i '/^LASTCHANGE=/d' tools/traffic_annotation/README.md
-grep '^CLANG_REVISION =' tools/clang/scripts/update.py >> tools/traffic_annotation/README.md
-cat build/util/LASTCHANGE >> tools/traffic_annotation/README.md
-git commit -a -m 'Roll traffic_annotation checkers'
-git cl upload
-
-```
-
-# On Windows:
-```bash
-git new-branch roll_traffic_annotation_tools
-python tools/clang/scripts/update.py --bootstrap --force-local-build ^
-    --without-android --extra-tools traffic_annotation_extractor
-cp third_party/llvm-build/Release+Asserts/bin/traffic_annotation_extractor.exe ^
-    tools/traffic_annotation/bin/win32/
-
-# These GN flags produce an optimized, stripped binary that has no dependency
-# on glib.
-gn gen --args="is_official_build=true" out/Default
-
-ninja -C out/Default traffic_annotation_auditor
-cp -p out/Default/traffic_annotation_auditor.exe ^
-    tools/traffic_annotation/bin/win32
-
-python third_party/depot_tools/upload_to_google_storage.py ^
-    -b chromium-tools-traffic_annotation ^
-    tools/traffic_annotation/bin/win32/traffic_annotation_auditor.exe
-python third_party/depot_tools/upload_to_google_storage.py ^
-    -b chromium-tools-traffic_annotation ^
-    tools/traffic_annotation/bin/win32/traffic_annotation_extractor.exe
-sed -i "/^CLANG_REVISION =/d" tools/traffic_annotation/README.md
-sed -i "/^LASTCHANGE=/d" tools/traffic_annotation/README.md
-grep "^CLANG_REVISION =" tools/clang/scripts/update.py >> tools/traffic_annotation/README.md
-cat build/util/LASTCHANGE >> tools/traffic_annotation/README.md
-dos2unix tools/traffic_annotation/README.md
-git commit -a -m 'Roll traffic_annotation checkers'
-git cl upload
-
-```
-
-and land the resulting CL.
-
-The following two lines will be updated by the above script, and the modified
-README should be committed along with the updated .sha1 checksums.
-
-In the event that clang changes something that requires this tool to be
-rebuilt (or for some other reason the tests don't work correctly), please
-disable this test by setting the `TEST_IS_ENABLED` flag to False in
-//tools/traffic_annotation/scripts_check_annotation.py, and file a bug
-and cc the people listed in OWNERS; they'll be on the hook to rebuild and
-re-enable the test.
-
-CLANG_REVISION = '328716'
-LASTCHANGE=71d65441b6c5409be898a817066b60d063380aa9-refs/heads/master@{#547990}
+# Annotations Summary
+`tools/traffic_annotation/summary/annotations.xml` keeps an up to date summary
+of all annotations in the repository. This file is automatically updated by
+Traffic Annotation Auditor.
diff --git a/tools/traffic_annotation/auditor/BUILD.gn b/tools/traffic_annotation/auditor/BUILD.gn
index c2a22d03..200ebb0 100644
--- a/tools/traffic_annotation/auditor/BUILD.gn
+++ b/tools/traffic_annotation/auditor/BUILD.gn
@@ -61,6 +61,7 @@
   ]
   data = [
     "safe_list.txt",
+    "traffic_annotation_extractor_switches.txt",
   ]
 
   public_deps = [
diff --git a/tools/traffic_annotation/auditor/README.md b/tools/traffic_annotation/auditor/README.md
index 2110005..8655c83 100644
--- a/tools/traffic_annotation/auditor/README.md
+++ b/tools/traffic_annotation/auditor/README.md
@@ -1,13 +1,15 @@
 # Network Traffic Annotation Auditor
-This executable runs the clang tool for extraction of Network Traffic
-Annotations from chromium source code and collects and summarizes its outputs.
+This binary runs the clang tool for extraction of Network Traffic Annotations
+from chromium source code, collects and summarizes its outputs, and performs
+tests and maintanance.
 Please see `docs/network_traffic_annotations.md` for an introduction to network
 traffic annotations.
 
 ## Usage
-`traffic_annotation_auditor [OPTION]... [path_filter]...`
+`traffic_annotation_auditor [OPTIONS]... [path_filter]...`
 
-Extracts network traffic annotations from source files. If path filter(s) are
+Extracts network traffic annotations from source files, tests them, and updates
+`tools/traffic_annotation/summary/annotations.xml`. If path filter(s) are
 specified, only those directories of the source will be analyzed.
 Run `traffic_annotation_auditor --help` for options.
 
@@ -15,8 +17,27 @@
   `traffic_annotation_auditor --build-dir=out/Debug`
 
 The binaries of this file and the clang tool are checked out into
-`tools/traffic_annotation/bin/[platform]`. This is only done for Linux platform
-now and will be extended to other platforms later.
+`tools/traffic_annotation/bin/[platform]`. This is only done for Linux and
+Windows platforms now and will be extended to other platforms later.
 
 ## Running
-Before running, you need to build the COMPLETE chromium.
+Before running, you need to build the COMPLETE chromium and pass the build path
+to the executable.
+
+## Safe List
+If there are files, paths, or specific functions that need to be exempted from
+all or some tests, they can be added to the `safe_list.txt`. The file is comma
+separated, specifying the safe lists based on
+`AuditorException::ExceptionType` in
+`tools/traffic_annotation/auditor/traffic_annotation_auditor.h`.
+Use * as wildcard for zero or more characters when specifying file paths.
+
+Here are the exception types:
+* `all`: Files and paths in this category are excempted from all tests.
+* `missing`: Files and paths in this category can use the
+  MISSING_TRAFFIC_ANNOTATION tag.
+* `direct_assignment`: The functions in this category can assign a value
+  directly to a MutableNetworkTrafficAnnotationTag. This is controlled to
+  avoid assigning arbitrary values to mutable annotations. The format of the
+  entries should be `full_function_name@file_path`. For example:
+  `download::ProtoConversions::EntryFromProto@components/download/internal/background_service/proto_conversions.cc`
\ No newline at end of file
diff --git a/tools/traffic_annotation/auditor/safe_list.txt b/tools/traffic_annotation/auditor/safe_list.txt
index cd4c10ef..6916716 100644
--- a/tools/traffic_annotation/auditor/safe_list.txt
+++ b/tools/traffic_annotation/auditor/safe_list.txt
@@ -1,8 +1,5 @@
 # This is a comma separated file, specifying the safe list for network traffic
-# anntotation auditor. Refer to AuditorException::ExceptionType in
-# 'tools/traffic_annotation/auditor/traffic_annotation_auditor.h' for types of
-# exceptions.
-# Use * as wildcard for zero or more characters.
+# anntotation auditor. Please refer to README.md for more details.
 all,tools/*
 missing,net/url_request/url_fetcher.cc
 missing,net/url_request/url_request_context.cc
diff --git a/tools/traffic_annotation/auditor/traffic_annotation_auditor.cc b/tools/traffic_annotation/auditor/traffic_annotation_auditor.cc
index fc09c0b7..0c6410b 100644
--- a/tools/traffic_annotation/auditor/traffic_annotation_auditor.cc
+++ b/tools/traffic_annotation/auditor/traffic_annotation_auditor.cc
@@ -115,8 +115,10 @@
   DCHECK(!build_path.empty());
   DCHECK(!clang_tool_path.empty());
 
+  base::FilePath switches_file =
+      base::MakeAbsoluteFilePath(source_path_.Append(kClangToolSwitchesPath));
   std::string file_content;
-  if (base::ReadFileToString(kClangToolSwitchesPath, &file_content)) {
+  if (base::ReadFileToString(switches_file, &file_content)) {
     clang_tool_switches_ = base::SplitString(
         file_content, "\n", base::TRIM_WHITESPACE, base::SPLIT_WANT_NONEMPTY);
   } else {
@@ -259,7 +261,13 @@
   // to the running script and the files in the safe list will be later removed
   // from the results.
   if (!filter_files_based_on_heuristics || use_compile_commands) {
-    *file_paths = path_filters;
+    // If no path filter is specified, return current location. The clang tool
+    // will be run from the repository 'src' folder and hence this will point to
+    // repository root.
+    if (path_filters.empty())
+      file_paths->push_back("./");
+    else
+      *file_paths = path_filters;
     return;
   }
 
diff --git a/tools/traffic_annotation/bin/README.md b/tools/traffic_annotation/bin/README.md
new file mode 100644
index 0000000..6532c8a
--- /dev/null
+++ b/tools/traffic_annotation/bin/README.md
@@ -0,0 +1,76 @@
+## Building the annotation checker.
+We do not want every developer to have to build clang, and so we store pre-built
+binaries in a Google Cloud Storage bucket and retrieve them via gclient hooks.
+
+To roll new versions of the binaries, assuming you have write access
+to the chromium-tools-traffic_annotation bucket, run:
+
+# On Linux:
+```bash
+git new-branch roll_traffic_annotation_tools
+python tools/clang/scripts/update.py --bootstrap --force-local-build \
+    --without-android --extra-tools traffic_annotation_extractor
+cp third_party/llvm-build/Release+Asserts/bin/traffic_annotation_extractor \
+    tools/traffic_annotation/bin/linux64/
+
+# These GN flags produce an optimized, stripped binary that has no dependency
+# on glib.
+gn gen --args='is_official_build=true use_ozone=true' out/Default
+
+ninja -C out/Default traffic_annotation_auditor
+cp -p out/Default/traffic_annotation_auditor \
+    tools/traffic_annotation/bin/linux64
+
+strip tools/traffic_annotation/bin/linux64/traffic_annotation_{auditor,extractor}
+
+third_party/depot_tools/upload_to_google_storage.py \
+    -b chromium-tools-traffic_annotation \
+    tools/traffic_annotation/bin/linux64/traffic_annotation_{auditor,extractor}
+sed -i '/^CLANG_REVISION =/d' tools/traffic_annotation/bin/README.md
+sed -i '/^LASTCHANGE=/d' tools/traffic_annotation/bin/README.md
+grep '^CLANG_REVISION =' tools/clang/scripts/update.py >> tools/traffic_annotation/bin/README.md
+cat build/util/LASTCHANGE >> tools/traffic_annotation/bin/README.md
+git commit -a -m 'Roll traffic_annotation checkers'
+git cl upload
+
+```
+
+# On Windows:
+```bash
+git new-branch roll_traffic_annotation_tools
+python tools/clang/scripts/update.py --bootstrap --force-local-build ^
+    --without-android --extra-tools traffic_annotation_extractor
+cp third_party/llvm-build/Release+Asserts/bin/traffic_annotation_extractor.exe ^
+    tools/traffic_annotation/bin/win32/
+
+# These GN flags produce an optimized, stripped binary that has no dependency
+# on glib.
+gn gen --args="is_official_build=true" out/Default
+
+ninja -C out/Default traffic_annotation_auditor
+cp -p out/Default/traffic_annotation_auditor.exe ^
+    tools/traffic_annotation/bin/win32
+
+python third_party/depot_tools/upload_to_google_storage.py ^
+    -b chromium-tools-traffic_annotation ^
+    tools/traffic_annotation/bin/win32/traffic_annotation_auditor.exe
+python third_party/depot_tools/upload_to_google_storage.py ^
+    -b chromium-tools-traffic_annotation ^
+    tools/traffic_annotation/bin/win32/traffic_annotation_extractor.exe
+sed -i "/^CLANG_REVISION =/d" tools/traffic_annotation/bin/README.md
+sed -i "/^LASTCHANGE=/d" tools/traffic_annotation/bin/README.md
+grep "^CLANG_REVISION =" tools/clang/scripts/update.py >> ^
+    tools/traffic_annotation/bin/README.md
+cat build/util/LASTCHANGE >> tools/traffic_annotation/bin/README.md
+dos2unix tools/traffic_annotation/bin/README.md
+git commit -a -m 'Roll traffic_annotation checkers'
+git cl upload
+
+```
+
+and land the resulting CL.
+
+The following two lines will be updated by the above script, and the modified
+README should be committed along with the updated .sha1 checksums.
+
+LASTCHANGE=1b08944149719c77799148b275de114f3a9e0bc1-refs/heads/master@{#548701}
diff --git a/tools/traffic_annotation/bin/linux64/traffic_annotation_auditor.sha1 b/tools/traffic_annotation/bin/linux64/traffic_annotation_auditor.sha1
index d8e369e..8075333 100644
--- a/tools/traffic_annotation/bin/linux64/traffic_annotation_auditor.sha1
+++ b/tools/traffic_annotation/bin/linux64/traffic_annotation_auditor.sha1
@@ -1 +1 @@
-f0cb9572c4457607bf510bbb8e73ca7112110991
\ No newline at end of file
+6a56dcc2fc9b5a93926f853605e118de3e71a98f
\ No newline at end of file
diff --git a/tools/traffic_annotation/bin/win32/traffic_annotation_auditor.exe.sha1 b/tools/traffic_annotation/bin/win32/traffic_annotation_auditor.exe.sha1
index 09c8eabe..5320209 100644
--- a/tools/traffic_annotation/bin/win32/traffic_annotation_auditor.exe.sha1
+++ b/tools/traffic_annotation/bin/win32/traffic_annotation_auditor.exe.sha1
@@ -1 +1 @@
-dd8213fb7861df8f388b5929aa796f24fe9b64a3
\ No newline at end of file
+3e449720dfd7a23747f7320a57db3451fb751c56
\ No newline at end of file
diff --git a/tools/traffic_annotation/scripts/README.md b/tools/traffic_annotation/scripts/README.md
index 8a4b9fa9..09bb41f 100644
--- a/tools/traffic_annotation/scripts/README.md
+++ b/tools/traffic_annotation/scripts/README.md
@@ -1,5 +1,5 @@
 # Traffic Annotation Scripts
-This file describes the scripts in `tools/traffic_annotation/scripts`
+This file describes the scripts in `tools/traffic_annotation/scripts`.
 
 
 # check_annotations.py
diff --git a/tools/traffic_annotation/summary/README.md b/tools/traffic_annotation/summary/README.md
index eb4edb53..8cd46e9 100644
--- a/tools/traffic_annotation/summary/README.md
+++ b/tools/traffic_annotation/summary/README.md
@@ -5,20 +5,30 @@
 
 # Content Description
 `annotations.xml` includes the summary of all network traffic annotations in
-Chromium repository. The content includes complete annotations and the merged
-partial and completing (and branched completing) annotations.
-For each annotation, unique id, hash code of unique id, hash code of the
-content, and the list of OSes using this annotation is presented. If annotation
-is a reserved one, instead of content hash code, a `reserved` attribute is
-included.
-Once an annotation is removed from the repository, a `deprecated` attribute is
-added to its item in this file, with value equal to the deprecation date.
-These items can be manually or automatically pruned after sufficient time.
+Chromium repository.
+The following items are stored for each annotation :
+* `id`: Unique ID of the annotation.
+* `hash_code`: Hash code of the unique id of the annotation. These values are
+     used in the binary as annotation tags.
+* `type`: Type of the annotation (complete, partial, ...). Uses enum values
+    of `AnnotationInstance` in `tools/traffic_annotation/auditor/instance.h`.
+* `content_hash_code`: Hash code of the annotation content. This value is stored
+    to check when an annotation is modified.
+* `os_list`: List of all platforms on which this annotation exists.
+    Currently only including `linux` and `windows`.
+* `file_path`: The file path of the annotation.
+* `reserved`: Reserverd annotations (like annotation for test files) have this
+    attribute. If annotation is a reserverd one, it does not have
+  `content_hash_code` and `file_path` attributes.
+* `deprecated`: Once an annotation is removed from the repository, this
+    attribute is added to its item with value equal to the deprecation date, and
+    `os_list` and `file_path` attributes are removed.
+    These items can be manually or automatically pruned after sufficient time.
+    Unique id of deprecated annotations cannot be reused.
 
 # How to Generate/Update.
 Run `traffic_annotation_auditor` to check for annotations correctness and
-automatic update. After each modification of`annotations.xml`, auditor calls
-`tools/traffic_annotation/scripts/annotations_xml_downstream_updater.py` to
-update all users of this file.
+automatic update. There are also trybots on Linux and Windows to run the tests
+and suggest required updates.
 The latest executable of `traffic_annotation_auditor` for supported platforms
 can be found in `tools/traffic_annotation/bin/[platform]`.
diff --git a/ui/events/event.cc b/ui/events/event.cc
index e79e74d..d8c1fb3 100644
--- a/ui/events/event.cc
+++ b/ui/events/event.cc
@@ -1405,7 +1405,8 @@
       x_offset_ordinal_(0.0f),
       y_offset_ordinal_(0.0f),
       finger_count_(0),
-      momentum_phase_(EventMomentumPhase::NONE) {
+      momentum_phase_(EventMomentumPhase::NONE),
+      scroll_event_phase_(ScrollEventPhase::kNone) {
   if (type() == ET_SCROLL) {
     GetScrollOffsets(native_event, &x_offset_, &y_offset_, &x_offset_ordinal_,
                      &y_offset_ordinal_, &finger_count_, &momentum_phase_);
diff --git a/ui/events/event.h b/ui/events/event.h
index 02ed775..80984010 100644
--- a/ui/events/event.h
+++ b/ui/events/event.h
@@ -993,16 +993,15 @@
  public:
   explicit ScrollEvent(const PlatformEvent& native_event);
   template <class T>
-  ScrollEvent(const ScrollEvent& model,
-              T* source,
-              T* target)
+  ScrollEvent(const ScrollEvent& model, T* source, T* target)
       : MouseEvent(model, source, target),
         x_offset_(model.x_offset_),
         y_offset_(model.y_offset_),
         x_offset_ordinal_(model.x_offset_ordinal_),
         y_offset_ordinal_(model.y_offset_ordinal_),
-        finger_count_(model.finger_count_){
-  }
+        finger_count_(model.finger_count_),
+        momentum_phase_(model.momentum_phase_),
+        scroll_event_phase_(model.scroll_event_phase_) {}
 
   ScrollEvent(EventType type,
               const gfx::Point& location,
@@ -1044,10 +1043,10 @@
 
   // For non-fling events, provides momentum information (e.g. for the case
   // where the device provides continuous event updates during a fling).
-  EventMomentumPhase momentum_phase_;
+  EventMomentumPhase momentum_phase_ = EventMomentumPhase::NONE;
 
   // Provides phase information if device can provide.
-  ScrollEventPhase scroll_event_phase_;
+  ScrollEventPhase scroll_event_phase_ = ScrollEventPhase::kNone;
 };
 
 class EVENTS_EXPORT GestureEvent : public LocatedEvent {
diff --git a/ui/file_manager/integration_tests/file_manager/background.js b/ui/file_manager/integration_tests/file_manager/background.js
index 44e6ede..3b75750 100644
--- a/ui/file_manager/integration_tests/file_manager/background.js
+++ b/ui/file_manager/integration_tests/file_manager/background.js
@@ -48,7 +48,7 @@
   return testPromiseAndApps(
       promise,
       [remoteCall, galleryApp, audioPlayerApp, videoPlayerApp]);
-};
+}
 
 /**
  * Executes a sequence of test steps.
diff --git a/ui/file_manager/integration_tests/file_manager/keyboard_operations.js b/ui/file_manager/integration_tests/file_manager/keyboard_operations.js
index d5b8dd7..3e745a9 100644
--- a/ui/file_manager/integration_tests/file_manager/keyboard_operations.js
+++ b/ui/file_manager/integration_tests/file_manager/keyboard_operations.js
@@ -32,7 +32,7 @@
  */
 function getTreeItems(windowId) {
   return remoteCall.callRemoteTestUtil('getTreeItems', windowId, []);
-};
+}
 
 /**
  * Waits until the directory item appears.
@@ -112,7 +112,7 @@
       checkIfNoErrorsOccured(this.next);
     }
   ]);
-};
+}
 
 /**
  * Tests deleting a file and and waits until the file lists changes.
@@ -328,7 +328,7 @@
                         expectedEntryRows,
                         {ignoreLastModifiedTime: true});
   });
-};
+}
 
 testcase.keyboardCopyDownloads = function() {
   keyboardCopy(RootPath.DOWNLOADS);
diff --git a/ui/file_manager/integration_tests/file_manager/quick_view.js b/ui/file_manager/integration_tests/file_manager/quick_view.js
index ffb6a18d..03379617 100644
--- a/ui/file_manager/integration_tests/file_manager/quick_view.js
+++ b/ui/file_manager/integration_tests/file_manager/quick_view.js
@@ -29,7 +29,7 @@
               if (results.length === 0 ||
                   results[0].styles.display === 'none') {
                 return pending('Quick View is not opened yet.');
-              };
+              }
               return results;
             });
       }).then(this.next);
@@ -61,7 +61,7 @@
             .then(function(results) {
               if (results.length > 0 && results[0].styles.display !== 'none') {
                 return pending('Quick View is not closed yet.');
-              };
+              }
               return;
             });
       }).then(this.next);
diff --git a/ui/file_manager/integration_tests/file_manager/share_dialog.js b/ui/file_manager/integration_tests/file_manager/share_dialog.js
index 44d1249a..6b8ec74 100644
--- a/ui/file_manager/integration_tests/file_manager/share_dialog.js
+++ b/ui/file_manager/integration_tests/file_manager/share_dialog.js
@@ -101,7 +101,7 @@
       checkIfNoErrorsOccured(this.next);
     }
   ]);
-};
+}
 
 /**
  * Tests sharing a file on Drive
diff --git a/ui/file_manager/integration_tests/test_util.js b/ui/file_manager/integration_tests/test_util.js
index 3b02841..1f700deb 100644
--- a/ui/file_manager/integration_tests/test_util.js
+++ b/ui/file_manager/integration_tests/test_util.js
@@ -54,7 +54,7 @@
   }), function(error) {
     chrome.test.fail(error.stack || error);
   });
-};
+}
 
 /**
  * Interval milliseconds between checks of repeatUntil.
@@ -93,7 +93,7 @@
   var pendingMarker = Object.create(pending.prototype);
   pendingMarker.message = formattedMessage;
   return pendingMarker;
-};
+}
 
 /**
  * Waits until the checkFunction returns a value but a pending marker.
@@ -119,7 +119,7 @@
     });
   };
   return step();
-};
+}
 
 /**
  * Adds the givin entries to the target volume(s).
@@ -147,7 +147,7 @@
                        opt_callback.bind(null, false));
   }
   return resultPromise;
-};
+}
 
 /**
  * @enum {string}
@@ -209,7 +209,7 @@
   this.sizeText = sizeText;
   this.typeText = typeText;
   Object.freeze(this);
-};
+}
 
 TestEntryInfo.getExpectedRows = function(entries) {
   return entries.map(function(entry) { return entry.getExpectedRow(); });
diff --git a/ui/ozone/platform/x11/ozone_platform_x11.cc b/ui/ozone/platform/x11/ozone_platform_x11.cc
index 476f69f..4f0e938d6 100644
--- a/ui/ozone/platform/x11/ozone_platform_x11.cc
+++ b/ui/ozone/platform/x11/ozone_platform_x11.cc
@@ -108,15 +108,18 @@
  private:
   // Performs initialization steps need by both UI and GPU.
   void InitializeCommon(const InitParams& params) {
-    // TODO(kylechar): Add DCHECK we only enter InitializeCommon() twice for
-    // single process mode.
     if (common_initialized_)
       return;
 
-    // Always initialze in multi-thread mode, since this is used only during
+    // Always initialize in multi-thread mode, since this is used only during
     // development.
     XInitThreads();
 
+    // If XOpenDisplay() failed there is nothing we can do. Crash here instead
+    // of crashing later. If you are crashing here, make sure there is an X
+    // server running and $DISPLAY is set.
+    CHECK(gfx::GetXDisplay()) << "Missing X server or $DISPLAY";
+
     ui::SetDefaultX11ErrorHandlers();
 
     common_initialized_ = true;
diff --git a/ui/strings/ui_strings.grd b/ui/strings/ui_strings.grd
index 504f0b7..29ebbdc 100644
--- a/ui/strings/ui_strings.grd
+++ b/ui/strings/ui_strings.grd
@@ -500,9 +500,16 @@
           Select &amp;All
         </message>
       </if>
-      <message name="IDS_CONTENT_CONTEXT_EMOJI" desc="The context menu item to display the OS-provided emoji picker.">
-        Emoji
-      </message>
+      <if expr="not is_macosx">
+        <message name="IDS_CONTENT_CONTEXT_EMOJI" desc="The context menu item to display the OS-provided emoji picker.">
+          Emoji
+        </message>
+      </if>
+      <if expr="is_macosx">
+        <message name="IDS_CONTENT_CONTEXT_EMOJI" desc="The context menu item to display the OS-provided emoji picker.">
+          Emoji &amp;&amp; Symbols
+        </message>
+      </if>
 
       <!-- Generic terms -->
       <message name="IDS_APP_OK" desc="Used for Ok on buttons">