diff --git a/DEPS b/DEPS
index e4ba30e..b3d1703 100644
--- a/DEPS
+++ b/DEPS
@@ -44,7 +44,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': 'b42fea0f3d1f07669a4e71cff88fc0b2bc449669',
+  'v8_revision': '80db203bd13fee72940bd1d64a40378c6f61cb86',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
diff --git a/PRESUBMIT.py b/PRESUBMIT.py
index e56d4b3..96f8de21 100644
--- a/PRESUBMIT.py
+++ b/PRESUBMIT.py
@@ -185,6 +185,7 @@
       ),
       True,
       (
+        r"^base[\\\/]memory[\\\/]shared_memory_posix\.cc$",
         r"^base[\\\/]process[\\\/]process_linux\.cc$",
         r"^base[\\\/]process[\\\/]process_metrics_linux\.cc$",
         r"^chrome[\\\/]browser[\\\/]chromeos[\\\/]boot_times_recorder\.cc$",
diff --git a/android_webview/browser/aw_cookie_access_policy.h b/android_webview/browser/aw_cookie_access_policy.h
index 6590d41..b712ec3 100644
--- a/android_webview/browser/aw_cookie_access_policy.h
+++ b/android_webview/browser/aw_cookie_access_policy.h
@@ -65,7 +65,7 @@
                       const net::CookieOptions& options);
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<AwCookieAccessPolicy>;
+  friend struct base::LazyInstanceTraitsBase<AwCookieAccessPolicy>;
 
   AwCookieAccessPolicy();
   ~AwCookieAccessPolicy();
diff --git a/android_webview/browser/deferred_gpu_command_service.cc b/android_webview/browser/deferred_gpu_command_service.cc
index 648c3c3..9cfd2ded7 100644
--- a/android_webview/browser/deferred_gpu_command_service.cc
+++ b/android_webview/browser/deferred_gpu_command_service.cc
@@ -24,12 +24,13 @@
 namespace android_webview {
 
 namespace {
-base::LazyInstance<scoped_refptr<DeferredGpuCommandService> >
+base::LazyInstance<scoped_refptr<DeferredGpuCommandService>>::DestructorAtExit
     g_service = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
-base::LazyInstance<base::ThreadLocalBoolean> ScopedAllowGL::allow_gl;
+base::LazyInstance<base::ThreadLocalBoolean>::DestructorAtExit
+    ScopedAllowGL::allow_gl;
 
 // static
 bool ScopedAllowGL::IsAllowed() {
diff --git a/android_webview/browser/deferred_gpu_command_service.h b/android_webview/browser/deferred_gpu_command_service.h
index 8a0ef8c..ed27efc4 100644
--- a/android_webview/browser/deferred_gpu_command_service.h
+++ b/android_webview/browser/deferred_gpu_command_service.h
@@ -32,7 +32,8 @@
   static bool IsAllowed();
 
  private:
-  static base::LazyInstance<base::ThreadLocalBoolean> allow_gl;
+  static base::LazyInstance<base::ThreadLocalBoolean>::DestructorAtExit
+      allow_gl;
 
   DISALLOW_COPY_AND_ASSIGN(ScopedAllowGL);
 };
diff --git a/android_webview/browser/gl_view_renderer_manager.h b/android_webview/browser/gl_view_renderer_manager.h
index 697c828..785f3bef 100644
--- a/android_webview/browser/gl_view_renderer_manager.h
+++ b/android_webview/browser/gl_view_renderer_manager.h
@@ -41,7 +41,7 @@
   RendererType GetMostRecentlyDrawn() const;
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<GLViewRendererManager>;
+  friend struct base::LazyInstanceTraitsBase<GLViewRendererManager>;
 
   GLViewRendererManager();
   ~GLViewRendererManager();
diff --git a/android_webview/browser/net/token_binding_manager.h b/android_webview/browser/net/token_binding_manager.h
index 57b0eef..5a2fd20a 100644
--- a/android_webview/browser/net/token_binding_manager.h
+++ b/android_webview/browser/net/token_binding_manager.h
@@ -56,7 +56,7 @@
   void DeleteAllKeys(DeletionCompleteCallback callback);
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<TokenBindingManager>;
+  friend struct base::LazyInstanceTraitsBase<TokenBindingManager>;
 
   TokenBindingManager();
   ~TokenBindingManager() {}
diff --git a/android_webview/browser/render_thread_manager.cc b/android_webview/browser/render_thread_manager.cc
index c8ee759..9070cc9 100644
--- a/android_webview/browser/render_thread_manager.cc
+++ b/android_webview/browser/render_thread_manager.cc
@@ -88,7 +88,7 @@
 
 namespace {
 
-base::LazyInstance<internal::RequestInvokeGLTracker>
+base::LazyInstance<internal::RequestInvokeGLTracker>::DestructorAtExit
     g_request_invoke_gl_tracker = LAZY_INSTANCE_INITIALIZER;
 }
 
diff --git a/android_webview/browser/renderer_host/aw_resource_dispatcher_host_delegate.cc b/android_webview/browser/renderer_host/aw_resource_dispatcher_host_delegate.cc
index a342220a4..8a3c1c3 100644
--- a/android_webview/browser/renderer_host/aw_resource_dispatcher_host_delegate.cc
+++ b/android_webview/browser/renderer_host/aw_resource_dispatcher_host_delegate.cc
@@ -43,8 +43,9 @@
 
 namespace {
 
-base::LazyInstance<android_webview::AwResourceDispatcherHostDelegate>
-    g_webview_resource_dispatcher_host_delegate = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<android_webview::AwResourceDispatcherHostDelegate>::
+    DestructorAtExit g_webview_resource_dispatcher_host_delegate =
+        LAZY_INSTANCE_INITIALIZER;
 
 void SetCacheControlFlag(
     net::URLRequest* request, int flag) {
diff --git a/android_webview/browser/renderer_host/aw_resource_dispatcher_host_delegate.h b/android_webview/browser/renderer_host/aw_resource_dispatcher_host_delegate.h
index 228df89a..4ff41775 100644
--- a/android_webview/browser/renderer_host/aw_resource_dispatcher_host_delegate.h
+++ b/android_webview/browser/renderer_host/aw_resource_dispatcher_host_delegate.h
@@ -68,8 +68,7 @@
                                  IoThreadClientThrottle* pending_throttle);
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<
-      AwResourceDispatcherHostDelegate>;
+  friend struct base::LazyInstanceTraitsBase<AwResourceDispatcherHostDelegate>;
   AwResourceDispatcherHostDelegate();
   ~AwResourceDispatcherHostDelegate() override;
 
diff --git a/android_webview/browser/scoped_app_gl_state_restore.cc b/android_webview/browser/scoped_app_gl_state_restore.cc
index 9b35faf0..27f3eb4c 100644
--- a/android_webview/browser/scoped_app_gl_state_restore.cc
+++ b/android_webview/browser/scoped_app_gl_state_restore.cc
@@ -35,7 +35,7 @@
   DISALLOW_COPY_AND_ASSIGN(AppContextSurface);
 };
 
-base::LazyInstance<AppContextSurface> g_app_context_surface =
+base::LazyInstance<AppContextSurface>::DestructorAtExit g_app_context_surface =
     LAZY_INSTANCE_INITIALIZER;
 
 // Make the global g_app_context_surface current so that the gl_binding is not
diff --git a/android_webview/lib/main/aw_main_delegate.cc b/android_webview/lib/main/aw_main_delegate.cc
index eba92c4..b356d27 100644
--- a/android_webview/lib/main/aw_main_delegate.cc
+++ b/android_webview/lib/main/aw_main_delegate.cc
@@ -55,8 +55,8 @@
 
 // TODO(boliu): Remove this global Allow once the underlying issues are
 // resolved - http://crbug.com/240453. See AwMainDelegate::RunProcess below.
-base::LazyInstance<std::unique_ptr<ScopedAllowWaitForLegacyWebViewApi>>
-    g_allow_wait_in_ui_thread = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<std::unique_ptr<ScopedAllowWaitForLegacyWebViewApi>>::
+    DestructorAtExit g_allow_wait_in_ui_thread = LAZY_INSTANCE_INITIALIZER;
 }
 
 AwMainDelegate::AwMainDelegate() {
diff --git a/android_webview/native/aw_contents_io_thread_client_impl.cc b/android_webview/native/aw_contents_io_thread_client_impl.cc
index 225de649..e1bc3490 100644
--- a/android_webview/native/aw_contents_io_thread_client_impl.cc
+++ b/android_webview/native/aw_contents_io_thread_client_impl.cc
@@ -70,17 +70,16 @@
   void Erase(pair<int, int> rfh_id);
 
  private:
-  static LazyInstance<RfhToIoThreadClientMap> g_instance_;
   base::Lock map_lock_;
   RenderFrameHostToIoThreadClientType rfh_to_io_thread_client_;
 };
 
 // static
-LazyInstance<RfhToIoThreadClientMap> RfhToIoThreadClientMap::g_instance_ =
+LazyInstance<RfhToIoThreadClientMap>::DestructorAtExit g_instance_ =
     LAZY_INSTANCE_INITIALIZER;
 
 // static
-LazyInstance<JavaObjectWeakGlobalRef> g_sw_instance_ =
+LazyInstance<JavaObjectWeakGlobalRef>::DestructorAtExit g_sw_instance_ =
     LAZY_INSTANCE_INITIALIZER;
 
 // static
diff --git a/android_webview/native/aw_metrics_service_client_impl.h b/android_webview/native/aw_metrics_service_client_impl.h
index ab44b83a..b32f2cf 100644
--- a/android_webview/native/aw_metrics_service_client_impl.h
+++ b/android_webview/native/aw_metrics_service_client_impl.h
@@ -27,7 +27,7 @@
 // asynchronous; even after Initialize has returned, some methods may not be
 // ready to use (see below).
 class AwMetricsServiceClientImpl : public AwMetricsServiceClient {
-  friend struct base::DefaultLazyInstanceTraits<AwMetricsServiceClientImpl>;
+  friend struct base::LazyInstanceTraitsBase<AwMetricsServiceClientImpl>;
 
  public:
   void Initialize(PrefService* pref_service,
diff --git a/android_webview/native/cookie_manager.cc b/android_webview/native/cookie_manager.cc
index aa8d646f..c361ec8d 100644
--- a/android_webview/native/cookie_manager.cc
+++ b/android_webview/native/cookie_manager.cc
@@ -181,7 +181,7 @@
   void SetAcceptFileSchemeCookies(bool accept);
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<CookieManager>;
+  friend struct base::LazyInstanceTraitsBase<CookieManager>;
 
   CookieManager();
   ~CookieManager();
diff --git a/base/BUILD.gn b/base/BUILD.gn
index 59b3207..b2545749 100644
--- a/base/BUILD.gn
+++ b/base/BUILD.gn
@@ -1587,6 +1587,13 @@
     sources += [ "power_monitor/power_monitor_device_source_posix.cc" ]
   }
 
+  if (is_posix && !is_mac && !is_nacl) {
+    sources += [
+      "memory/shared_memory_tracker.cc",
+      "memory/shared_memory_tracker.h",
+    ]
+  }
+
   if (!use_glib) {
     sources -= [
       "message_loop/message_pump_glib.cc",
diff --git a/base/android/jni_android.cc b/base/android/jni_android.cc
index 4a88d339..56dc5c2 100644
--- a/base/android/jni_android.cc
+++ b/base/android/jni_android.cc
@@ -25,7 +25,7 @@
     base::android::ALL_JNI_REGISTRATION;
 
 JavaVM* g_jvm = NULL;
-base::LazyInstance<base::android::ScopedJavaGlobalRef<jobject> >::Leaky
+base::LazyInstance<base::android::ScopedJavaGlobalRef<jobject>>::Leaky
     g_class_loader = LAZY_INSTANCE_INITIALIZER;
 jmethodID g_class_loader_load_class_method_id = 0;
 
diff --git a/base/callback_internal.cc b/base/callback_internal.cc
index 4afd567f..4330e9c 100644
--- a/base/callback_internal.cc
+++ b/base/callback_internal.cc
@@ -54,6 +54,16 @@
   return *this;
 }
 
+CallbackBase<CopyMode::MoveOnly>::CallbackBase(
+    CallbackBase<CopyMode::Copyable>&& c)
+    : bind_state_(std::move(c.bind_state_)) {}
+
+CallbackBase<CopyMode::MoveOnly>& CallbackBase<CopyMode::MoveOnly>::operator=(
+    CallbackBase<CopyMode::Copyable>&& c) {
+  bind_state_ = std::move(c.bind_state_);
+  return *this;
+}
+
 void CallbackBase<CopyMode::MoveOnly>::Reset() {
   // NULL the bind_state_ last, since it may be holding the last ref to whatever
   // object owns us, and we may be deleted after that.
diff --git a/base/callback_internal.h b/base/callback_internal.h
index f7501f9..d6dcfeb 100644
--- a/base/callback_internal.h
+++ b/base/callback_internal.h
@@ -82,6 +82,9 @@
   explicit CallbackBase(const CallbackBase<CopyMode::Copyable>& c);
   CallbackBase& operator=(const CallbackBase<CopyMode::Copyable>& c);
 
+  explicit CallbackBase(CallbackBase<CopyMode::Copyable>&& c);
+  CallbackBase& operator=(CallbackBase<CopyMode::Copyable>&& c);
+
   // Returns true if Callback is null (doesn't refer to anything).
   bool is_null() const { return bind_state_.get() == NULL; }
   explicit operator bool() const { return !is_null(); }
diff --git a/base/files/file_path_watcher_linux.cc b/base/files/file_path_watcher_linux.cc
index 9589e9b..1dc833d 100644
--- a/base/files/file_path_watcher_linux.cc
+++ b/base/files/file_path_watcher_linux.cc
@@ -63,7 +63,7 @@
   void OnInotifyEvent(const inotify_event* event);
 
  private:
-  friend struct DefaultLazyInstanceTraits<InotifyReader>;
+  friend struct LazyInstanceTraitsBase<InotifyReader>;
 
   typedef std::set<FilePathWatcherImpl*> WatcherSet;
 
diff --git a/base/i18n/number_formatting.cc b/base/i18n/number_formatting.cc
index b510833..0365f2c 100644
--- a/base/i18n/number_formatting.cc
+++ b/base/i18n/number_formatting.cc
@@ -42,9 +42,9 @@
   std::unique_ptr<icu::NumberFormat> number_format;
 };
 
-LazyInstance<NumberFormatWrapper> g_number_format_int =
+LazyInstance<NumberFormatWrapper>::DestructorAtExit g_number_format_int =
     LAZY_INSTANCE_INITIALIZER;
-LazyInstance<NumberFormatWrapper> g_number_format_float =
+LazyInstance<NumberFormatWrapper>::DestructorAtExit g_number_format_float =
     LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
diff --git a/base/lazy_instance.h b/base/lazy_instance.h
index 1183806..070e436 100644
--- a/base/lazy_instance.h
+++ b/base/lazy_instance.h
@@ -24,11 +24,11 @@
 // requires that Type be a complete type so we can determine the size.
 //
 // Example usage:
-//   static LazyInstance<MyClass> my_instance = LAZY_INSTANCE_INITIALIZER;
+//   static LazyInstance<MyClass>::Leaky inst = LAZY_INSTANCE_INITIALIZER;
 //   void SomeMethod() {
-//     my_instance.Get().SomeMethod();  // MyClass::SomeMethod()
+//     inst.Get().SomeMethod();  // MyClass::SomeMethod()
 //
-//     MyClass* ptr = my_instance.Pointer();
+//     MyClass* ptr = inst.Pointer();
 //     ptr->DoDoDo();  // MyClass::DoDoDo
 //   }
 
@@ -53,22 +53,15 @@
 namespace base {
 
 template <typename Type>
-struct DefaultLazyInstanceTraits {
-  static const bool kRegisterOnExit = true;
-#if DCHECK_IS_ON()
-  static const bool kAllowedToAccessOnNonjoinableThread = false;
-#endif
-
+struct LazyInstanceTraitsBase {
   static Type* New(void* instance) {
-    DCHECK_EQ(reinterpret_cast<uintptr_t>(instance) & (ALIGNOF(Type) - 1), 0u)
-        << ": Bad boy, the buffer passed to placement new is not aligned!\n"
-        "This may break some stuff like SSE-based optimizations assuming the "
-        "<Type> objects are word aligned.";
+    DCHECK_EQ(reinterpret_cast<uintptr_t>(instance) & (ALIGNOF(Type) - 1), 0u);
     // Use placement new to initialize our instance in our preallocated space.
     // The parenthesis is very important here to force POD type initialization.
     return new (instance) Type();
   }
-  static void Delete(Type* instance) {
+
+  static void CallDestructor(Type* instance) {
     // Explicitly call the destructor.
     instance->~Type();
   }
@@ -78,6 +71,25 @@
 // can implement the more complicated pieces out of line in the .cc file.
 namespace internal {
 
+// This traits class causes destruction the contained Type at process exit via
+// AtExitManager. This is probably generally not what you want. Instead, prefer
+// Leaky below.
+template <typename Type>
+struct DestructorAtExitLazyInstanceTraits {
+  static const bool kRegisterOnExit = true;
+#if DCHECK_IS_ON()
+  static const bool kAllowedToAccessOnNonjoinableThread = false;
+#endif
+
+  static Type* New(void* instance) {
+    return LazyInstanceTraitsBase<Type>::New(instance);
+  }
+
+  static void Delete(Type* instance) {
+    LazyInstanceTraitsBase<Type>::CallDestructor(instance);
+  }
+};
+
 // Use LazyInstance<T>::Leaky for a less-verbose call-site typedef; e.g.:
 // base::LazyInstance<T>::Leaky my_leaky_lazy_instance;
 // instead of:
@@ -95,12 +107,15 @@
 
   static Type* New(void* instance) {
     ANNOTATE_SCOPED_MEMORY_LEAK;
-    return DefaultLazyInstanceTraits<Type>::New(instance);
+    return LazyInstanceTraitsBase<Type>::New(instance);
   }
   static void Delete(Type* instance) {
   }
 };
 
+template <typename Type>
+struct ErrorMustSelectLazyOrDestructorAtExitForLazyInstance {};
+
 // Our AtomicWord doubles as a spinlock, where a value of
 // kLazyInstanceStateCreating means the spinlock is being held for creation.
 static const subtle::AtomicWord kLazyInstanceStateCreating = 1;
@@ -119,7 +134,10 @@
 
 }  // namespace internal
 
-template <typename Type, typename Traits = DefaultLazyInstanceTraits<Type> >
+template <
+    typename Type,
+    typename Traits =
+        internal::ErrorMustSelectLazyOrDestructorAtExitForLazyInstance<Type>>
 class LazyInstance {
  public:
   // Do not define a destructor, as doing so makes LazyInstance a
@@ -131,7 +149,9 @@
 
   // Convenience typedef to avoid having to repeat Type for leaky lazy
   // instances.
-  typedef LazyInstance<Type, internal::LeakyLazyInstanceTraits<Type> > Leaky;
+  typedef LazyInstance<Type, internal::LeakyLazyInstanceTraits<Type>> Leaky;
+  typedef LazyInstance<Type, internal::DestructorAtExitLazyInstanceTraits<Type>>
+      DestructorAtExit;
 
   Type& Get() {
     return *Pointer();
diff --git a/base/lazy_instance_unittest.cc b/base/lazy_instance_unittest.cc
index 8947b129..0aa46594 100644
--- a/base/lazy_instance_unittest.cc
+++ b/base/lazy_instance_unittest.cc
@@ -45,7 +45,8 @@
 
 class SlowDelegate : public base::DelegateSimpleThread::Delegate {
  public:
-  explicit SlowDelegate(base::LazyInstance<SlowConstructor>* lazy)
+  explicit SlowDelegate(
+      base::LazyInstance<SlowConstructor>::DestructorAtExit* lazy)
       : lazy_(lazy) {}
 
   void Run() override {
@@ -54,13 +55,13 @@
   }
 
  private:
-  base::LazyInstance<SlowConstructor>* lazy_;
+  base::LazyInstance<SlowConstructor>::DestructorAtExit* lazy_;
 };
 
 }  // namespace
 
-static base::LazyInstance<ConstructAndDestructLogger> lazy_logger =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<ConstructAndDestructLogger>::DestructorAtExit
+    lazy_logger = LAZY_INSTANCE_INITIALIZER;
 
 TEST(LazyInstanceTest, Basic) {
   {
@@ -81,7 +82,7 @@
   EXPECT_EQ(4, destructed_seq_.GetNext());
 }
 
-static base::LazyInstance<SlowConstructor> lazy_slow =
+static base::LazyInstance<SlowConstructor>::DestructorAtExit lazy_slow =
     LAZY_INSTANCE_INITIALIZER;
 
 TEST(LazyInstanceTest, ConstructorThreadSafety) {
@@ -126,7 +127,8 @@
   bool deleted1 = false;
   {
     base::ShadowingAtExitManager shadow;
-    static base::LazyInstance<DeleteLogger> test = LAZY_INSTANCE_INITIALIZER;
+    static base::LazyInstance<DeleteLogger>::DestructorAtExit test =
+        LAZY_INSTANCE_INITIALIZER;
     test.Get().SetDeletedPtr(&deleted1);
   }
   EXPECT_TRUE(deleted1);
@@ -164,9 +166,12 @@
   // Create some static instances with increasing sizes and alignment
   // requirements. By ordering this way, the linker will need to do some work to
   // ensure proper alignment of the static data.
-  static LazyInstance<AlignedData<4> > align4 = LAZY_INSTANCE_INITIALIZER;
-  static LazyInstance<AlignedData<32> > align32 = LAZY_INSTANCE_INITIALIZER;
-  static LazyInstance<AlignedData<4096> > align4096 = LAZY_INSTANCE_INITIALIZER;
+  static LazyInstance<AlignedData<4>>::DestructorAtExit align4 =
+      LAZY_INSTANCE_INITIALIZER;
+  static LazyInstance<AlignedData<32>>::DestructorAtExit align32 =
+      LAZY_INSTANCE_INITIALIZER;
+  static LazyInstance<AlignedData<4096>>::DestructorAtExit align4096 =
+      LAZY_INSTANCE_INITIALIZER;
 
   EXPECT_ALIGNED(align4.Pointer(), 4);
   EXPECT_ALIGNED(align32.Pointer(), 32);
diff --git a/base/memory/ref_counted.h b/base/memory/ref_counted.h
index ff46e6d6..9c9aea1 100644
--- a/base/memory/ref_counted.h
+++ b/base/memory/ref_counted.h
@@ -7,6 +7,7 @@
 
 #include <stddef.h>
 
+#include <algorithm>
 #include <cassert>
 #include <iosfwd>
 #include <type_traits>
@@ -354,15 +355,7 @@
     return *this;
   }
 
-  void swap(T** pp) {
-    T* p = ptr_;
-    ptr_ = *pp;
-    *pp = p;
-  }
-
-  void swap(scoped_refptr<T>& r) {
-    swap(&r.ptr_);
-  }
+  void swap(scoped_refptr<T>& r) { std::swap(ptr_, r.ptr_); }
 
   explicit operator bool() const { return ptr_ != nullptr; }
 
diff --git a/base/memory/shared_memory.h b/base/memory/shared_memory.h
index 3c68e90a..4b66cc6e 100644
--- a/base/memory/shared_memory.h
+++ b/base/memory/shared_memory.h
@@ -255,9 +255,24 @@
     return ShareToProcessCommon(process, new_handle, true, SHARE_CURRENT_MODE);
   }
 
+#if defined(OS_POSIX) && (!defined(OS_MACOSX) || defined(OS_IOS)) && \
+    !defined(OS_NACL)
+  using UniqueId = std::pair<dev_t, ino_t>;
+
+  struct UniqueIdHash {
+    size_t operator()(const UniqueId& id) const {
+      return HashInts(id.first, id.second);
+    }
+  };
+
+  // Returns a unique ID for this shared memory's handle. Note this function may
+  // access file system and be slow.
+  bool GetUniqueId(UniqueId* id) const;
+#endif
+
  private:
 #if defined(OS_POSIX) && !defined(OS_NACL) && !defined(OS_ANDROID) && \
-    !(defined(OS_MACOSX) && !defined(OS_IOS))
+    (!defined(OS_MACOSX) || defined(OS_IOS))
   bool FilePathForMemoryName(const std::string& mem_name, FilePath* path);
 #endif
 
@@ -301,6 +316,7 @@
 
   DISALLOW_COPY_AND_ASSIGN(SharedMemory);
 };
+
 }  // namespace base
 
 #endif  // BASE_MEMORY_SHARED_MEMORY_H_
diff --git a/base/memory/shared_memory_posix.cc b/base/memory/shared_memory_posix.cc
index 3a18faa..bf29e9f 100644
--- a/base/memory/shared_memory_posix.cc
+++ b/base/memory/shared_memory_posix.cc
@@ -15,12 +15,14 @@
 #include "base/files/scoped_file.h"
 #include "base/logging.h"
 #include "base/memory/shared_memory_helper.h"
+#include "base/memory/shared_memory_tracker.h"
 #include "base/posix/eintr_wrapper.h"
 #include "base/posix/safe_strerror.h"
 #include "base/process/process_metrics.h"
 #include "base/scoped_generic.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/threading/thread_restrictions.h"
+#include "base/trace_event/trace_event.h"
 #include "build/build_config.h"
 
 #if defined(OS_ANDROID)
@@ -283,8 +285,10 @@
   bool mmap_succeeded = memory_ != (void*)-1 && memory_ != NULL;
   if (mmap_succeeded) {
     mapped_size_ = bytes;
-    DCHECK_EQ(0U, reinterpret_cast<uintptr_t>(memory_) &
-        (SharedMemory::MAP_MINIMUM_ALIGNMENT - 1));
+    DCHECK_EQ(0U,
+              reinterpret_cast<uintptr_t>(memory_) &
+                  (SharedMemory::MAP_MINIMUM_ALIGNMENT - 1));
+    SharedMemoryTracker::GetInstance()->IncrementMemoryUsage(*this);
   } else {
     memory_ = NULL;
   }
@@ -297,6 +301,7 @@
     return false;
 
   munmap(memory_, mapped_size_);
+  SharedMemoryTracker::GetInstance()->DecrementMemoryUsage(*this);
   memory_ = NULL;
   mapped_size_ = 0;
   return true;
@@ -390,4 +395,22 @@
   return true;
 }
 
+bool SharedMemory::GetUniqueId(SharedMemory::UniqueId* id) const {
+  // This function is called just after mmap. fstat is a system call that might
+  // cause I/O. It's safe to call fstat here because mmap for shared memory is
+  // called in two cases:
+  // 1) To handle file-mapped memory
+  // 2) To handle annonymous shared memory
+  // In 1), I/O is already permitted. In 2), the backend is on page cache and
+  // fstat doesn't cause I/O access to the disk. See the discussion at
+  // crbug.com/604726#c41.
+  base::ThreadRestrictions::ScopedAllowIO allow_io;
+  struct stat file_stat;
+  if (HANDLE_EINTR(::fstat(static_cast<int>(handle().fd), &file_stat)) != 0)
+    return false;
+  id->first = file_stat.st_dev;
+  id->second = file_stat.st_ino;
+  return true;
+}
+
 }  // namespace base
diff --git a/base/memory/shared_memory_tracker.cc b/base/memory/shared_memory_tracker.cc
new file mode 100644
index 0000000..8613f595
--- /dev/null
+++ b/base/memory/shared_memory_tracker.cc
@@ -0,0 +1,92 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/memory/shared_memory_tracker.h"
+
+#include "base/memory/shared_memory.h"
+#include "base/strings/stringprintf.h"
+#include "base/trace_event/memory_dump_manager.h"
+#include "base/trace_event/process_memory_dump.h"
+
+namespace base {
+
+SharedMemoryTracker::Usage::Usage() = default;
+
+SharedMemoryTracker::Usage::Usage(const Usage& rhs) = default;
+
+SharedMemoryTracker::Usage::~Usage() = default;
+
+// static
+SharedMemoryTracker* SharedMemoryTracker::GetInstance() {
+  static SharedMemoryTracker* instance = new SharedMemoryTracker;
+  return instance;
+}
+
+void SharedMemoryTracker::IncrementMemoryUsage(
+    const SharedMemory& shared_memory) {
+  Usage usage;
+  // |shared_memory|'s unique ID must be generated here and it'd be too late at
+  // OnMemoryDump. An ID is generated with a SharedMemoryHandle, but the handle
+  // might already be closed at that time. Now IncrementMemoryUsage is called
+  // just after mmap and the handle must live then. See the discussion at
+  // crbug.com/604726#c30.
+  SharedMemory::UniqueId id;
+  if (!shared_memory.GetUniqueId(&id))
+    return;
+  usage.unique_id = id;
+  usage.size = shared_memory.mapped_size();
+  AutoLock hold(usages_lock_);
+  usages_[&shared_memory] = usage;
+}
+
+void SharedMemoryTracker::DecrementMemoryUsage(
+    const SharedMemory& shared_memory) {
+  AutoLock hold(usages_lock_);
+  usages_.erase(&shared_memory);
+}
+
+bool SharedMemoryTracker::OnMemoryDump(const trace_event::MemoryDumpArgs& args,
+                                       trace_event::ProcessMemoryDump* pmd) {
+  std::unordered_map<SharedMemory::UniqueId, size_t, SharedMemory::UniqueIdHash>
+      sizes;
+  {
+    AutoLock hold(usages_lock_);
+    for (const auto& usage : usages_)
+      sizes[usage.second.unique_id] += usage.second.size;
+  }
+  for (auto& size : sizes) {
+    const SharedMemory::UniqueId& id = size.first;
+    std::string dump_name = StringPrintf("%s/%lld.%lld", "shared_memory",
+                                         static_cast<long long>(id.first),
+                                         static_cast<long long>(id.second));
+    auto guid = trace_event::MemoryAllocatorDumpGuid(dump_name);
+    trace_event::MemoryAllocatorDump* local_dump =
+        pmd->CreateAllocatorDump(dump_name);
+    // TODO(hajimehoshi): The size is not resident size but virtual size so far.
+    // Fix this to record resident size.
+    local_dump->AddScalar(trace_event::MemoryAllocatorDump::kNameSize,
+                          trace_event::MemoryAllocatorDump::kUnitsBytes,
+                          size.second);
+    trace_event::MemoryAllocatorDump* global_dump =
+        pmd->CreateSharedGlobalAllocatorDump(guid);
+    global_dump->AddScalar(trace_event::MemoryAllocatorDump::kNameSize,
+                           trace_event::MemoryAllocatorDump::kUnitsBytes,
+                           size.second);
+    // TOOD(hajimehoshi): Detect which the shared memory comes from browser,
+    // renderer or GPU process.
+    // TODO(hajimehoshi): Shared memory reported by GPU and discardable is
+    // currently double-counted. Add ownership edges to avoid this.
+    pmd->AddOwnershipEdge(local_dump->guid(), global_dump->guid());
+  }
+  return true;
+}
+
+SharedMemoryTracker::SharedMemoryTracker() {
+  trace_event::MemoryDumpManager::GetInstance()->RegisterDumpProvider(
+      this, "SharedMemoryTracker", nullptr);
+}
+
+SharedMemoryTracker::~SharedMemoryTracker() = default;
+
+}  // namespace
diff --git a/base/memory/shared_memory_tracker.h b/base/memory/shared_memory_tracker.h
new file mode 100644
index 0000000..fe1a3dd3
--- /dev/null
+++ b/base/memory/shared_memory_tracker.h
@@ -0,0 +1,56 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef BASE_MEMORY_SHARED_MEMORY_TRACKER_H_
+#define BASE_MEMORY_SHARED_MEMORY_TRACKER_H_
+
+#include "base/memory/shared_memory.h"
+#include "base/synchronization/lock.h"
+#include "base/trace_event/memory_dump_provider.h"
+
+namespace base {
+
+namespace trace_event {
+class ProcessMemoryDump;
+}
+
+// SharedMemoryTracker tracks shared memory usage.
+class BASE_EXPORT SharedMemoryTracker
+    : public base::trace_event::MemoryDumpProvider {
+ public:
+  // Returns a singleton instance.
+  static SharedMemoryTracker* GetInstance();
+
+  // Records shared memory usage on mapping.
+  void IncrementMemoryUsage(const SharedMemory& shared_memory);
+
+  // Records shared memory usage on unmapping.
+  void DecrementMemoryUsage(const SharedMemory& shared_memory);
+
+ private:
+  struct Usage {
+    Usage();
+    Usage(const Usage& rhs);
+    ~Usage();
+    SharedMemory::UniqueId unique_id;
+    size_t size;
+  };
+
+  SharedMemoryTracker();
+  ~SharedMemoryTracker() override;
+
+  // base::trace_event::MemoryDumpProvider implementation.
+  bool OnMemoryDump(const base::trace_event::MemoryDumpArgs& args,
+                    base::trace_event::ProcessMemoryDump* pmd) override;
+
+  // Used to lock when |usages_| is modified or read.
+  Lock usages_lock_;
+  std::unordered_map<const SharedMemory*, Usage> usages_;
+
+  DISALLOW_COPY_AND_ASSIGN(SharedMemoryTracker);
+};
+
+}  // namespace base
+
+#endif  // BASE_MEMORY_SHARED_MEMORY_TRACKER_H_
diff --git a/base/metrics/statistics_recorder.h b/base/metrics/statistics_recorder.h
index 193bad79..40c4bd0 100644
--- a/base/metrics/statistics_recorder.h
+++ b/base/metrics/statistics_recorder.h
@@ -217,7 +217,7 @@
   // |bucket_ranges_|.
   typedef std::map<uint32_t, std::list<const BucketRanges*>*> RangesMap;
 
-  friend struct DefaultLazyInstanceTraits<StatisticsRecorder>;
+  friend struct LazyInstanceTraitsBase<StatisticsRecorder>;
   friend class StatisticsRecorderTest;
 
   // Imports histograms from global persistent memory. The global lock must
diff --git a/base/metrics/user_metrics.cc b/base/metrics/user_metrics.cc
index 169a063..65ac918 100644
--- a/base/metrics/user_metrics.cc
+++ b/base/metrics/user_metrics.cc
@@ -17,10 +17,10 @@
 namespace base {
 namespace {
 
-LazyInstance<std::vector<ActionCallback>> g_callbacks =
+LazyInstance<std::vector<ActionCallback>>::DestructorAtExit g_callbacks =
     LAZY_INSTANCE_INITIALIZER;
-LazyInstance<scoped_refptr<SingleThreadTaskRunner>> g_task_runner =
-    LAZY_INSTANCE_INITIALIZER;
+LazyInstance<scoped_refptr<SingleThreadTaskRunner>>::DestructorAtExit
+    g_task_runner = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/base/process/process_linux.cc b/base/process/process_linux.cc
index 2973ef3..bcba9b5 100644
--- a/base/process/process_linux.cc
+++ b/base/process/process_linux.cc
@@ -62,7 +62,8 @@
   }
 };
 
-base::LazyInstance<CGroups> g_cgroups = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<CGroups>::DestructorAtExit g_cgroups =
+    LAZY_INSTANCE_INITIALIZER;
 #else
 const int kBackgroundPriority = 5;
 #endif  // defined(OS_CHROMEOS)
@@ -90,8 +91,8 @@
     return true;
 #endif  // defined(OS_CHROMEOS)
 
-  static LazyInstance<CheckForNicePermission> check_for_nice_permission =
-      LAZY_INSTANCE_INITIALIZER;
+  static LazyInstance<CheckForNicePermission>::DestructorAtExit
+      check_for_nice_permission = LAZY_INSTANCE_INITIALIZER;
   return check_for_nice_permission.Get().can_reraise_priority;
 }
 
diff --git a/base/test/launcher/test_launcher.cc b/base/test/launcher/test_launcher.cc
index 1c945d3..b2340ca 100644
--- a/base/test/launcher/test_launcher.cc
+++ b/base/test/launcher/test_launcher.cc
@@ -97,12 +97,14 @@
 
 // Set of live launch test processes with corresponding lock (it is allowed
 // for callers to launch processes on different threads).
-LazyInstance<std::map<ProcessHandle, CommandLine> > g_live_processes
-    = LAZY_INSTANCE_INITIALIZER;
-LazyInstance<Lock> g_live_processes_lock = LAZY_INSTANCE_INITIALIZER;
+LazyInstance<std::map<ProcessHandle, CommandLine>>::DestructorAtExit
+    g_live_processes = LAZY_INSTANCE_INITIALIZER;
+LazyInstance<Lock>::DestructorAtExit g_live_processes_lock =
+    LAZY_INSTANCE_INITIALIZER;
 
 // Performance trace generator.
-LazyInstance<TestLauncherTracer> g_tracer = LAZY_INSTANCE_INITIALIZER;
+LazyInstance<TestLauncherTracer>::DestructorAtExit g_tracer =
+    LAZY_INSTANCE_INITIALIZER;
 
 #if defined(OS_POSIX)
 // Self-pipe that makes it possible to do complex shutdown handling
diff --git a/base/win/message_window.cc b/base/win/message_window.cc
index 26b64a5..155047e4 100644
--- a/base/win/message_window.cc
+++ b/base/win/message_window.cc
@@ -32,8 +32,8 @@
   DISALLOW_COPY_AND_ASSIGN(WindowClass);
 };
 
-static LazyInstance<MessageWindow::WindowClass> g_window_class =
-    LAZY_INSTANCE_INITIALIZER;
+static LazyInstance<MessageWindow::WindowClass>::DestructorAtExit
+    g_window_class = LAZY_INSTANCE_INITIALIZER;
 
 MessageWindow::WindowClass::WindowClass()
     : atom_(0), instance_(CURRENT_MODULE()) {
diff --git a/cc/layers/empty_content_layer_client.cc b/cc/layers/empty_content_layer_client.cc
index 3e1ef40..f2d2b81 100644
--- a/cc/layers/empty_content_layer_client.cc
+++ b/cc/layers/empty_content_layer_client.cc
@@ -10,8 +10,8 @@
 namespace cc {
 
 namespace {
-base::LazyInstance<EmptyContentLayerClient> g_empty_content_layer_client =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<EmptyContentLayerClient>::DestructorAtExit
+    g_empty_content_layer_client = LAZY_INSTANCE_INITIALIZER;
 }
 
 // static
diff --git a/cc/layers/empty_content_layer_client.h b/cc/layers/empty_content_layer_client.h
index 0d831b6..451b363a 100644
--- a/cc/layers/empty_content_layer_client.h
+++ b/cc/layers/empty_content_layer_client.h
@@ -35,7 +35,7 @@
   size_t GetApproximateUnsharedMemoryUsage() const override;
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<EmptyContentLayerClient>;
+  friend struct base::LazyInstanceTraitsBase<EmptyContentLayerClient>;
 
   EmptyContentLayerClient();
   ~EmptyContentLayerClient() override;
diff --git a/cc/test/fake_tile_manager.cc b/cc/test/fake_tile_manager.cc
index 81c936f..ac728a2 100644
--- a/cc/test/fake_tile_manager.cc
+++ b/cc/test/fake_tile_manager.cc
@@ -22,11 +22,11 @@
 
 namespace {
 
-base::LazyInstance<SynchronousTaskGraphRunner> g_synchronous_task_graph_runner =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<SynchronousTaskGraphRunner>::DestructorAtExit
+    g_synchronous_task_graph_runner = LAZY_INSTANCE_INITIALIZER;
 
-base::LazyInstance<FakeRasterBufferProviderImpl> g_fake_raster_buffer_provider =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<FakeRasterBufferProviderImpl>::DestructorAtExit
+    g_fake_raster_buffer_provider = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/DeferredStartupHandler.java b/chrome/android/java/src/org/chromium/chrome/browser/DeferredStartupHandler.java
index 71d5da9..f5d0b02 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/DeferredStartupHandler.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/DeferredStartupHandler.java
@@ -123,12 +123,10 @@
 
     private void recordDeferredStartupStats() {
         RecordHistogram.recordLongTimesHistogram(
-                "UMA.Debug.EnableCrashUpload.DeferredStartUpDuration",
-                mDeferredStartupDuration,
+                "UMA.Debug.EnableCrashUpload.DeferredStartUpDuration", mDeferredStartupDuration,
                 TimeUnit.MILLISECONDS);
         RecordHistogram.recordLongTimesHistogram(
-                "UMA.Debug.EnableCrashUpload.DeferredStartUpMaxTaskDuration",
-                mMaxTaskDuration,
+                "UMA.Debug.EnableCrashUpload.DeferredStartUpMaxTaskDuration", mMaxTaskDuration,
                 TimeUnit.MILLISECONDS);
         RecordHistogram.recordLongTimesHistogram(
                 "UMA.Debug.EnableCrashUpload.DeferredStartUpCompleteTime",
@@ -162,8 +160,7 @@
         mDeferredStartupInitializedForApp = true;
         ThreadUtils.assertOnUiThread();
 
-        RecordHistogram.recordLongTimesHistogram(
-                "UMA.Debug.EnableCrashUpload.DeferredStartUptime2",
+        RecordHistogram.recordLongTimesHistogram("UMA.Debug.EnableCrashUpload.DeferredStartUptime2",
                 SystemClock.uptimeMillis() - UmaUtils.getForegroundStartTime(),
                 TimeUnit.MILLISECONDS);
 
@@ -297,8 +294,7 @@
 
                 RecordHistogram.recordLongTimesHistogram(
                         "UMA.Debug.EnableCrashUpload.DeferredStartUpAsyncTaskDuration",
-                        SystemClock.uptimeMillis() - mAsyncTaskStartTime,
-                        TimeUnit.MILLISECONDS);
+                        SystemClock.uptimeMillis() - mAsyncTaskStartTime, TimeUnit.MILLISECONDS);
             }
         }.executeOnExecutor(AsyncTask.THREAD_POOL_EXECUTOR);
     }
@@ -321,8 +317,7 @@
     @WorkerThread
     private void removeSnapshotDatabase() {
         synchronized (SNAPSHOT_DATABASE_LOCK) {
-            SharedPreferences prefs =
-                    ContextUtils.getAppSharedPreferences();
+            SharedPreferences prefs = ContextUtils.getAppSharedPreferences();
             if (!prefs.getBoolean(SNAPSHOT_DATABASE_REMOVED, false)) {
                 mAppContext.deleteDatabase(SNAPSHOT_DATABASE_NAME);
                 prefs.edit().putBoolean(SNAPSHOT_DATABASE_REMOVED, true).apply();
@@ -360,8 +355,8 @@
     }
 
     /**
-    * @return Whether deferred startup has been completed.
-    */
+     * @return Whether deferred startup has been completed.
+     */
     @VisibleForTesting
     public boolean isDeferredStartupCompleteForApp() {
         return mDeferredStartupCompletedForApp;
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/crash/LogcatExtractionCallable.java b/chrome/android/java/src/org/chromium/chrome/browser/crash/LogcatExtractionCallable.java
index b5bcc7f6..fbd821a 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/crash/LogcatExtractionCallable.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/crash/LogcatExtractionCallable.java
@@ -44,7 +44,6 @@
  * along with the intent provided here.
  */
 public class LogcatExtractionCallable implements Callable<Boolean> {
-
     private static final String TAG = "LogcatExtraction";
     private static final long HALF_SECOND = 500;
 
@@ -55,8 +54,7 @@
     @VisibleForTesting
     protected static final String URL_ELISION = "HTTP://WEBADDRESS.ELIDED";
 
-    private static final String GOOD_IRI_CHAR =
-            "a-zA-Z0-9\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF";
+    private static final String GOOD_IRI_CHAR = "a-zA-Z0-9\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF";
 
     private static final Pattern IP_ADDRESS = Pattern.compile(
             "((25[0-5]|2[0-4][0-9]|[0-1][0-9]{2}|[1-9][0-9]|[1-9])\\.(25[0-5]|2[0-4]"
@@ -65,27 +63,25 @@
             + "|[1-9][0-9]|[0-9]))");
 
     private static final String IRI =
-            "[" + GOOD_IRI_CHAR + "]([" + GOOD_IRI_CHAR + "\\-]{0,61}["
-            + GOOD_IRI_CHAR + "]){0,1}";
+            "[" + GOOD_IRI_CHAR + "]([" + GOOD_IRI_CHAR + "\\-]{0,61}[" + GOOD_IRI_CHAR + "]){0,1}";
 
-    private static final String GOOD_GTLD_CHAR =
-            "a-zA-Z\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF";
+    private static final String GOOD_GTLD_CHAR = "a-zA-Z\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF";
     private static final String GTLD = "[" + GOOD_GTLD_CHAR + "]{2,63}";
     private static final String HOST_NAME = "(" + IRI + "\\.)+" + GTLD;
 
     private static final Pattern DOMAIN_NAME =
             Pattern.compile("(" + HOST_NAME + "|" + IP_ADDRESS + ")");
 
-    private static final Pattern WEB_URL = Pattern.compile(
-            "(?:\\b|^)((?:(http|https|Http|Https|rtsp|Rtsp):"
-            + "\\/\\/(?:(?:[a-zA-Z0-9\\$\\-\\_\\.\\+\\!\\*\\'\\(\\)"
-            + "\\,\\;\\?\\&\\=]|(?:\\%[a-fA-F0-9]{2})){1,64}(?:\\:(?:[a-zA-Z0-9\\$\\-\\_"
-            + "\\.\\+\\!\\*\\'\\(\\)\\,\\;\\?\\&\\=]|(?:\\%[a-fA-F0-9]{2})){1,25})?\\@)?)?"
-            + "(?:" + DOMAIN_NAME + ")"
-            + "(?:\\:\\d{1,5})?)"
-            + "(\\/(?:(?:[" + GOOD_IRI_CHAR + "\\;\\/\\?\\:\\@\\&\\=\\#\\~"
-            + "\\-\\.\\+\\!\\*\\'\\(\\)\\,\\_])|(?:\\%[a-fA-F0-9]{2}))*)?"
-            + "(?:\\b|$)");
+    private static final Pattern WEB_URL =
+            Pattern.compile("(?:\\b|^)((?:(http|https|Http|Https|rtsp|Rtsp):"
+                    + "\\/\\/(?:(?:[a-zA-Z0-9\\$\\-\\_\\.\\+\\!\\*\\'\\(\\)"
+                    + "\\,\\;\\?\\&\\=]|(?:\\%[a-fA-F0-9]{2})){1,64}(?:\\:(?:[a-zA-Z0-9\\$\\-\\_"
+                    + "\\.\\+\\!\\*\\'\\(\\)\\,\\;\\?\\&\\=]|(?:\\%[a-fA-F0-9]{2})){1,25})?\\@)?)?"
+                    + "(?:" + DOMAIN_NAME + ")"
+                    + "(?:\\:\\d{1,5})?)"
+                    + "(\\/(?:(?:[" + GOOD_IRI_CHAR + "\\;\\/\\?\\:\\@\\&\\=\\#\\~"
+                    + "\\-\\.\\+\\!\\*\\'\\(\\)\\,\\_])|(?:\\%[a-fA-F0-9]{2}))*)?"
+                    + "(?:\\b|$)");
 
     @VisibleForTesting
     protected static final String BEGIN_MICRODUMP = "-----BEGIN BREAKPAD MICRODUMP-----";
@@ -104,35 +100,30 @@
     private static final String LOGCAT_EXTENSION = ".logcat";
 
     @VisibleForTesting
-    protected static final String CONSOLE_ELISION =
-            "[ELIDED:CONSOLE(0)] ELIDED CONSOLE MESSAGE";
+    protected static final String CONSOLE_ELISION = "[ELIDED:CONSOLE(0)] ELIDED CONSOLE MESSAGE";
 
     private static final Pattern MAC_ADDRESS =
             Pattern.compile("([0-9a-fA-F]{2}[-:]+){5}[0-9a-fA-F]{2}");
 
-    private static final Pattern CONSOLE_MSG =
-            Pattern.compile("\\[\\w*:CONSOLE.*\\].*");
+    private static final Pattern CONSOLE_MSG = Pattern.compile("\\[\\w*:CONSOLE.*\\].*");
 
     private static final Pattern MINIDUMP_EXTENSION = Pattern.compile("\\.dmp");
 
-    private static final String[] CHROME_NAMESPACE = new String[] {
-            "org.chromium.", "com.google."
-    };
+    private static final String[] CHROME_NAMESPACE = new String[] {"org.chromium.", "com.google."};
 
-    private static final String[] SYSTEM_NAMESPACE = new String[] {
-            "android.accessibilityservice", "android.accounts", "android.animation",
-            "android.annotation", "android.app", "android.appwidget", "android.bluetooth",
-            "android.content", "android.database", "android.databinding", "android.drm",
-            "android.gesture", "android.graphics", "android.hardware",
-            "android.inputmethodservice", "android.location", "android.media", "android.mtp",
-            "android.net", "android.nfc", "android.opengl", "android.os", "android.preference",
-            "android.print", "android.printservice", "android.provider", "android.renderscript",
-            "android.sax", "android.security", "android.service", "android.speech",
-            "android.support", "android.system", "android.telecom", "android.telephony",
-            "android.test", "android.text", "android.transition", "android.util", "android.view",
-            "android.webkit", "android.widget", "com.android.", "dalvik.", "java.", "javax.",
-            "org.apache.", "org.json.", "org.w3c.dom.", "org.xml.", "org.xmlpull."
-    };
+    private static final String[] SYSTEM_NAMESPACE = new String[] {"android.accessibilityservice",
+            "android.accounts", "android.animation", "android.annotation", "android.app",
+            "android.appwidget", "android.bluetooth", "android.content", "android.database",
+            "android.databinding", "android.drm", "android.gesture", "android.graphics",
+            "android.hardware", "android.inputmethodservice", "android.location", "android.media",
+            "android.mtp", "android.net", "android.nfc", "android.opengl", "android.os",
+            "android.preference", "android.print", "android.printservice", "android.provider",
+            "android.renderscript", "android.sax", "android.security", "android.service",
+            "android.speech", "android.support", "android.system", "android.telecom",
+            "android.telephony", "android.test", "android.text", "android.transition",
+            "android.util", "android.view", "android.webkit", "android.widget", "com.android.",
+            "dalvik.", "java.", "javax.", "org.apache.", "org.json.", "org.w3c.dom.", "org.xml.",
+            "org.xmlpull."};
 
     private final Context mContext;
     private final String[] mMinidumpFilenames;
@@ -175,8 +166,8 @@
         }
     }
 
-    private void processMinidump(File logcatFile, String name,
-            CrashFileManager manager, boolean isLast) throws IOException {
+    private void processMinidump(File logcatFile, String name, CrashFileManager manager,
+            boolean isLast) throws IOException {
         String toPath = MINIDUMP_EXTENSION.matcher(name).replaceAll(LOGCAT_EXTENSION);
         File toFile = manager.createNewTempFile(toPath);
 
@@ -186,20 +177,19 @@
         Intent intent = null;
         if (isLast) {
             move(logcatFile, toFile);
-            intent = MinidumpPreparationService.createMinidumpPreparationIntent(mContext,
-                    manager.getCrashFile(name), toFile, mRedirectIntent);
+            intent = MinidumpPreparationService.createMinidumpPreparationIntent(
+                    mContext, manager.getCrashFile(name), toFile, mRedirectIntent);
         } else {
             copy(logcatFile, toFile);
-            intent = MinidumpPreparationService.createMinidumpPreparationIntent(mContext,
-                    manager.getCrashFile(name), toFile, null);
+            intent = MinidumpPreparationService.createMinidumpPreparationIntent(
+                    mContext, manager.getCrashFile(name), toFile, null);
         }
         mContext.startService(intent);
     }
 
     private File getElidedLogcat() throws IOException, InterruptedException {
         List<String> rawLogcat = getLogcat();
-        List<String> elidedLogcat =
-                Collections.unmodifiableList(processLogcat(rawLogcat));
+        List<String> elidedLogcat = Collections.unmodifiableList(processLogcat(rawLogcat));
         return writeLogcat(elidedLogcat);
     }
 
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/crash/MinidumpDirectoryObserver.java b/chrome/android/java/src/org/chromium/chrome/browser/crash/MinidumpDirectoryObserver.java
index e26f853..5a389f7 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/crash/MinidumpDirectoryObserver.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/crash/MinidumpDirectoryObserver.java
@@ -20,13 +20,12 @@
  * The FileObserver to monitor the minidump directory.
  */
 public class MinidumpDirectoryObserver extends FileObserver {
-
     private static final String TAG = "MinidumpDirObserver";
 
     public MinidumpDirectoryObserver() {
         // The file observer detects MOVED_TO for child processes.
-        super(new File(PathUtils.getCacheDirectory(),
-                CrashFileManager.CRASH_DUMP_DIR).toString(), FileObserver.MOVED_TO);
+        super(new File(PathUtils.getCacheDirectory(), CrashFileManager.CRASH_DUMP_DIR).toString(),
+                FileObserver.MOVED_TO);
     }
 
     /**
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/crash/MinidumpPreparationCallable.java b/chrome/android/java/src/org/chromium/chrome/browser/crash/MinidumpPreparationCallable.java
index 6008a80..4529ff2 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/crash/MinidumpPreparationCallable.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/crash/MinidumpPreparationCallable.java
@@ -31,14 +31,12 @@
  * This class will append a logcat file to a minidump file for upload.
  */
 public class MinidumpPreparationCallable implements Callable<Boolean> {
-
     private static final String TAG = "DumpPrepCallable";
 
     private static final String LOGCAT_CONTENT_DISPOSITION =
             "Content-Disposition: form-data; name=\"logcat\"; filename=\"logcat\"";
 
-    private static final String LOGCAT_CONTENT_TYPE =
-            "Content-Type: text/plain";
+    private static final String LOGCAT_CONTENT_TYPE = "Content-Type: text/plain";
 
     private final File mLogcatFile;
     private final File mMinidumpFile;
@@ -47,10 +45,7 @@
     private final CrashFileManager mFileManager;
 
     public MinidumpPreparationCallable(
-            Context context,
-            File miniDumpFile,
-            File logcatFile,
-            Intent redirectIntent) {
+            Context context, File miniDumpFile, File logcatFile, Intent redirectIntent) {
         mContext = context;
         mLogcatFile = logcatFile;
         mMinidumpFile = miniDumpFile;
@@ -115,8 +110,8 @@
      * @param targetFile File to which data should be appended.
      * @throws IOException when standard IO errors occur.
      */
-    private static void appendMinidump(
-            File processMinidumpFile, File targetFile) throws IOException {
+    private static void appendMinidump(File processMinidumpFile, File targetFile)
+            throws IOException {
         BufferedInputStream bIn = null;
         BufferedOutputStream bOut = null;
         try {
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/crash/MinidumpPreparationService.java b/chrome/android/java/src/org/chromium/chrome/browser/crash/MinidumpPreparationService.java
index f476a16..6a14b23 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/crash/MinidumpPreparationService.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/crash/MinidumpPreparationService.java
@@ -25,10 +25,7 @@
     private static final String REDIRECT_INTENT_KEY = "redirect_intent";
 
     public static Intent createMinidumpPreparationIntent(
-            Context context,
-            File minidumpFile,
-            File logcatFile,
-            Intent redirectIntent) {
+            Context context, File minidumpFile, File logcatFile, Intent redirectIntent) {
         Intent intent = new Intent(context, MinidumpPreparationService.class);
         if (minidumpFile != null) {
             intent.putExtra(MINIDUMP_FILE_KEY, minidumpFile.getName());
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/crash/MinidumpUploadService.java b/chrome/android/java/src/org/chromium/chrome/browser/crash/MinidumpUploadService.java
index 914c9ff..07c1fe2 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/crash/MinidumpUploadService.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/crash/MinidumpUploadService.java
@@ -93,8 +93,8 @@
             onHandleIntent(redirectAction);
             return;
         }
-        context.startService(LogcatExtractionService.createLogcatExtractionTask(
-                context, dumps, redirectAction));
+        context.startService(
+                LogcatExtractionService.createLogcatExtractionTask(context, dumps, redirectAction));
     }
 
     @Override
@@ -138,15 +138,11 @@
         for (String type : TYPES) {
             for (int success = pref.getCrashSuccessUploadCount(type); success > 0; success--) {
                 RecordHistogram.recordEnumeratedHistogram(
-                        HISTOGRAM_NAME_PREFIX + type,
-                        SUCCESS,
-                        HISTOGRAM_MAX);
+                        HISTOGRAM_NAME_PREFIX + type, SUCCESS, HISTOGRAM_MAX);
             }
             for (int fail = pref.getCrashFailureUploadCount(type); fail > 0; fail--) {
                 RecordHistogram.recordEnumeratedHistogram(
-                        HISTOGRAM_NAME_PREFIX + type,
-                        FAILURE,
-                        HISTOGRAM_MAX);
+                        HISTOGRAM_NAME_PREFIX + type, FAILURE, HISTOGRAM_MAX);
             }
 
             pref.setCrashSuccessUploadCount(type, 0);
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/crash/LogcatExtractionCallableTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/crash/LogcatExtractionCallableTest.java
index 0ea34ad..9de5188 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/crash/LogcatExtractionCallableTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/crash/LogcatExtractionCallableTest.java
@@ -62,15 +62,15 @@
             }
         };
 
-        LogcatExtractionCallable callable = new LogcatExtractionCallable(
-                testContext, dumps, testIntent) {
-            @Override
-            protected List<String> getLogcat() throws IOException, InterruptedException {
-                    List<String> result = new ArrayList<String>();
-                    result.add(logContent);
-                    return result;
-            }
-        };
+        LogcatExtractionCallable callable =
+                new LogcatExtractionCallable(testContext, dumps, testIntent) {
+                    @Override
+                    protected List<String> getLogcat() throws IOException, InterruptedException {
+                        List<String> result = new ArrayList<String>();
+                        result.add(logContent);
+                        return result;
+                    }
+                };
 
         callable.call();
 
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/crash/MinidumpUploadServiceTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/crash/MinidumpUploadServiceTest.java
index 05f52e9..3ee6c8a 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/crash/MinidumpUploadServiceTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/crash/MinidumpUploadServiceTest.java
@@ -36,7 +36,6 @@
  * Testcase for {@link MinidumpUploadService}.
  */
 public class MinidumpUploadServiceTest extends CrashTestCase {
-
     private static final int CHECK_INTERVAL_MS = 250;
     private static final int MAX_TIMEOUT_MS = 20000;
     private static final String BOUNDARY = "TESTBOUNDARY";
@@ -55,10 +54,10 @@
                         intentToCheck.getStringExtra(MinidumpUploadService.FILE_TO_UPLOAD_KEY);
                 assertEquals("Minidump path should be the absolute path",
                         minidumpFile.getAbsolutePath(), filePath);
-                assertEquals("Should only call service once", 1,
-                        numServiceStarts.incrementAndGet());
-                assertEquals("Action should be correct",
-                        MinidumpUploadService.ACTION_UPLOAD, intentToCheck.getAction());
+                assertEquals(
+                        "Should only call service once", 1, numServiceStarts.incrementAndGet());
+                assertEquals("Action should be correct", MinidumpUploadService.ACTION_UPLOAD,
+                        intentToCheck.getAction());
                 return new ComponentName(getPackageName(), MinidumpUploadService.class.getName());
             }
 
@@ -144,9 +143,9 @@
         // Setup prerequisites.
         final AtomicInteger numServiceStarts = new AtomicInteger(0);
         final File[] minidumpFiles = {
-            new File(mCrashDir, "chromium_renderer-111.dmp1"),
-            new File(mCrashDir, "chromium_renderer-222.dmp2"),
-            new File(mCrashDir, "chromium_renderer-333.dmp3"),
+                new File(mCrashDir, "chromium_renderer-111.dmp1"),
+                new File(mCrashDir, "chromium_renderer-222.dmp2"),
+                new File(mCrashDir, "chromium_renderer-333.dmp3"),
         };
         MinidumpPreparationContext context = new MinidumpPreparationContext(
                 getInstrumentation().getTargetContext()) {
@@ -159,8 +158,8 @@
                         minidumpFiles[numServiceStarts.intValue()].getAbsolutePath(), filePath);
                 assertTrue("Should not call service more than number of files",
                         numServiceStarts.incrementAndGet() <= minidumpFiles.length);
-                assertEquals("Action should be correct",
-                        MinidumpUploadService.ACTION_UPLOAD, intentToCheck.getAction());
+                assertEquals("Action should be correct", MinidumpUploadService.ACTION_UPLOAD,
+                        intentToCheck.getAction());
                 return new ComponentName(getPackageName(), MinidumpUploadService.class.getName());
             }
 
@@ -192,9 +191,7 @@
         List<CountedMinidumpUploadCallable> callables =
                 new ArrayList<CountedMinidumpUploadCallable>();
         callables.add(new CountedMinidumpUploadCallable(
-                "chromium_renderer-111.dmp1",
-                MinidumpUploadCallable.UPLOAD_SUCCESS,
-                false));
+                "chromium_renderer-111.dmp1", MinidumpUploadCallable.UPLOAD_SUCCESS, false));
         runUploadCrashTest(callables);
     }
 
@@ -206,9 +203,8 @@
                 new ArrayList<CountedMinidumpUploadCallable>();
         for (int i = 0; i < MinidumpUploadService.MAX_TRIES_ALLOWED; i++) {
             callables.add(new CountedMinidumpUploadCallable(
-                    "chromium_renderer-111.dmp1" + (i > 0 ? ".try" + i : "") ,
-                    MinidumpUploadCallable.UPLOAD_FAILURE,
-                    true));
+                    "chromium_renderer-111.dmp1" + (i > 0 ? ".try" + i : ""),
+                    MinidumpUploadCallable.UPLOAD_FAILURE, true));
         }
         runUploadCrashTest(callables);
     }
@@ -219,13 +215,9 @@
         List<CountedMinidumpUploadCallable> callables =
                 new ArrayList<CountedMinidumpUploadCallable>();
         callables.add(new CountedMinidumpUploadCallable(
-                "chromium_renderer-111.dmp1",
-                MinidumpUploadCallable.UPLOAD_FAILURE,
-                true));
+                "chromium_renderer-111.dmp1", MinidumpUploadCallable.UPLOAD_FAILURE, true));
         callables.add(new CountedMinidumpUploadCallable(
-                "chromium_renderer-111.dmp1.try1",
-                MinidumpUploadCallable.UPLOAD_SUCCESS,
-                true));
+                "chromium_renderer-111.dmp1.try1", MinidumpUploadCallable.UPLOAD_SUCCESS, true));
         runUploadCrashTest(callables);
     }
 
@@ -235,9 +227,7 @@
         List<CountedMinidumpUploadCallable> callables =
                 new ArrayList<CountedMinidumpUploadCallable>();
         callables.add(new CountedMinidumpUploadCallable(
-                "chromium_renderer-111.dmp1",
-                MinidumpUploadCallable.UPLOAD_FAILURE,
-                false));
+                "chromium_renderer-111.dmp1", MinidumpUploadCallable.UPLOAD_FAILURE, false));
         runUploadCrashTest(callables);
     }
 
@@ -345,8 +335,7 @@
         // Run test.
         Intent uploadIntent =
                 MinidumpUploadService.createUploadIntent(context, minidumpFile, logfile);
-        uploadIntent.putExtra(
-                MinidumpUploadService.FINISHED_LOGCAT_EXTRACTION_KEY, true);
+        uploadIntent.putExtra(MinidumpUploadService.FINISHED_LOGCAT_EXTRACTION_KEY, true);
         service.onCreate();
         service.onHandleIntent(uploadIntent);
 
@@ -362,7 +351,8 @@
                         }
                         return true;
                     }
-                }, MAX_TIMEOUT_MS, CHECK_INTERVAL_MS);
+                },
+                MAX_TIMEOUT_MS, CHECK_INTERVAL_MS);
     }
 
     /**
@@ -553,8 +543,7 @@
     public void testGetCrashType1() throws IOException {
         final File minidumpFile = new File(mCrashDir, "chromium_renderer-123.dmp");
         setUpMinidumpFile(minidumpFile, BOUNDARY, "browser");
-        assertEquals(BROWSER,
-                MinidumpUploadService.getCrashType(minidumpFile.getAbsolutePath()));
+        assertEquals(BROWSER, MinidumpUploadService.getCrashType(minidumpFile.getAbsolutePath()));
     }
 
     @SmallTest
@@ -562,8 +551,7 @@
     public void testGetCrashType2() throws IOException {
         final File minidumpFile = new File(mCrashDir, "chromium_renderer-123.dmp");
         setUpMinidumpFile(minidumpFile, BOUNDARY, "renderer");
-        assertEquals(RENDERER,
-                MinidumpUploadService.getCrashType(minidumpFile.getAbsolutePath()));
+        assertEquals(RENDERER, MinidumpUploadService.getCrashType(minidumpFile.getAbsolutePath()));
     }
 
     @SmallTest
@@ -571,8 +559,7 @@
     public void testGetCrashType3() throws IOException {
         final File minidumpFile = new File(mCrashDir, "chromium_renderer-123.dmp");
         setUpMinidumpFile(minidumpFile, BOUNDARY, "gpu-process");
-        assertEquals(GPU,
-                MinidumpUploadService.getCrashType(minidumpFile.getAbsolutePath()));
+        assertEquals(GPU, MinidumpUploadService.getCrashType(minidumpFile.getAbsolutePath()));
     }
 
     @SmallTest
@@ -580,8 +567,7 @@
     public void testGetCrashType4() throws IOException {
         final File minidumpFile = new File(mCrashDir, "chromium_renderer-123.dmp");
         setUpMinidumpFile(minidumpFile, BOUNDARY, "weird test type");
-        assertEquals(OTHER,
-                MinidumpUploadService.getCrashType(minidumpFile.getAbsolutePath()));
+        assertEquals(OTHER, MinidumpUploadService.getCrashType(minidumpFile.getAbsolutePath()));
     }
 
     private class MinidumpPreparationContext extends AdvancedMockContext {
@@ -622,8 +608,7 @@
          * @param networkChange Should trigger a network change after this callable is finished.
          *     This essentially triggers a retry if result is set to fail.
          */
-        private CountedMinidumpUploadCallable(
-                String fileName, int result, boolean networkChange) {
+        private CountedMinidumpUploadCallable(String fileName, int result, boolean networkChange) {
             super(new File(fileName), null, null, null);
             this.mResult = result;
             this.mTriggerNetworkChange = networkChange;
diff --git a/chrome/android/junit/src/org/chromium/chrome/browser/crash/LogcatExtractionCallableUnitTest.java b/chrome/android/junit/src/org/chromium/chrome/browser/crash/LogcatExtractionCallableUnitTest.java
index 2263308..c816e83 100644
--- a/chrome/android/junit/src/org/chromium/chrome/browser/crash/LogcatExtractionCallableUnitTest.java
+++ b/chrome/android/junit/src/org/chromium/chrome/browser/crash/LogcatExtractionCallableUnitTest.java
@@ -132,8 +132,8 @@
 
     @Test
     public void testLogcatWithoutBeginOrEnd_smallLogcat() {
-        final List<String> original = Arrays.asList("Line 1", "Line 2", "Line 3", "Line 4",
-                "Line 5");
+        final List<String> original =
+                Arrays.asList("Line 1", "Line 2", "Line 3", "Line 4", "Line 5");
         assertLogcatLists(original, original);
     }
 
@@ -155,8 +155,8 @@
 
     @Test
     public void testLogcatWithBegin() {
-        final List<String> original = Arrays.asList("Line 1", "Line 2", BEGIN_MICRODUMP, "a",
-                "b", "c", "d", "e");
+        final List<String> original =
+                Arrays.asList("Line 1", "Line 2", BEGIN_MICRODUMP, "a", "b", "c", "d", "e");
         final List<String> expected = Arrays.asList("Line 1", "Line 2", SNIPPED_MICRODUMP);
         assertLogcatLists(expected, original);
     }
@@ -169,8 +169,8 @@
 
     @Test
     public void testLogcatWithBeginAndEnd_smallLogcat() {
-        final List<String> original = Arrays.asList("Line 1", "Line 2", BEGIN_MICRODUMP, "a", "b",
-                "c", "d", "e", END_MICRODUMP);
+        final List<String> original = Arrays.asList(
+                "Line 1", "Line 2", BEGIN_MICRODUMP, "a", "b", "c", "d", "e", END_MICRODUMP);
         final List<String> expected = Arrays.asList("Line 1", "Line 2", SNIPPED_MICRODUMP);
         assertLogcatLists(expected, original);
     }
@@ -195,8 +195,8 @@
 
     @Test
     public void testLogcatWithEndAndBegin_smallLogcat() {
-        final List<String> original = Arrays.asList(END_MICRODUMP, "Line 1", "Line 2",
-                BEGIN_MICRODUMP, "a", "b", "c", "d", "e");
+        final List<String> original = Arrays.asList(
+                END_MICRODUMP, "Line 1", "Line 2", BEGIN_MICRODUMP, "a", "b", "c", "d", "e");
         final List<String> expected =
                 Arrays.asList(END_MICRODUMP, "Line 1", "Line 2", SNIPPED_MICRODUMP);
         assertLogcatLists(expected, original);
diff --git a/chrome/app/chrome_main_delegate.cc b/chrome/app/chrome_main_delegate.cc
index 316523b0..8991b14d 100644
--- a/chrome/app/chrome_main_delegate.cc
+++ b/chrome/app/chrome_main_delegate.cc
@@ -150,17 +150,17 @@
 #if !defined(CHROME_MULTIPLE_DLL_BROWSER)
 #include "chrome/child/pdf_child_init.h"
 
-base::LazyInstance<ChromeContentGpuClient> g_chrome_content_gpu_client =
-    LAZY_INSTANCE_INITIALIZER;
-base::LazyInstance<ChromeContentRendererClient>
+base::LazyInstance<ChromeContentGpuClient>::DestructorAtExit
+    g_chrome_content_gpu_client = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<ChromeContentRendererClient>::DestructorAtExit
     g_chrome_content_renderer_client = LAZY_INSTANCE_INITIALIZER;
-base::LazyInstance<ChromeContentUtilityClient>
+base::LazyInstance<ChromeContentUtilityClient>::DestructorAtExit
     g_chrome_content_utility_client = LAZY_INSTANCE_INITIALIZER;
 #endif
 
 #if !defined(CHROME_MULTIPLE_DLL_CHILD)
-base::LazyInstance<ChromeContentBrowserClient> g_chrome_content_browser_client =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<ChromeContentBrowserClient>::DestructorAtExit
+    g_chrome_content_browser_client = LAZY_INSTANCE_INITIALIZER;
 #endif
 
 #if defined(OS_POSIX)
diff --git a/chrome/browser/android/background_sync_launcher_android.cc b/chrome/browser/android/background_sync_launcher_android.cc
index bac2de6..c31cac94 100644
--- a/chrome/browser/android/background_sync_launcher_android.cc
+++ b/chrome/browser/android/background_sync_launcher_android.cc
@@ -11,8 +11,8 @@
 using content::BrowserThread;
 
 namespace {
-base::LazyInstance<BackgroundSyncLauncherAndroid> g_background_sync_launcher =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<BackgroundSyncLauncherAndroid>::DestructorAtExit
+    g_background_sync_launcher = LAZY_INSTANCE_INITIALIZER;
 
 // Disables the Play Services version check for testing on Chromium build bots.
 // TODO(iclelland): Remove this once the bots have their play services package
diff --git a/chrome/browser/android/background_sync_launcher_android.h b/chrome/browser/android/background_sync_launcher_android.h
index 2ce1522b..be547a8 100644
--- a/chrome/browser/android/background_sync_launcher_android.h
+++ b/chrome/browser/android/background_sync_launcher_android.h
@@ -31,7 +31,7 @@
   static void SetPlayServicesVersionCheckDisabledForTests(bool disabled);
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<BackgroundSyncLauncherAndroid>;
+  friend struct base::LazyInstanceTraitsBase<BackgroundSyncLauncherAndroid>;
 
   // Constructor and destructor marked private to enforce singleton
   BackgroundSyncLauncherAndroid();
diff --git a/chrome/browser/android/bookmarks/partner_bookmarks_shim.cc b/chrome/browser/android/bookmarks/partner_bookmarks_shim.cc
index 6ef0c2d..6b5a706 100644
--- a/chrome/browser/android/bookmarks/partner_bookmarks_shim.cc
+++ b/chrome/browser/android/bookmarks/partner_bookmarks_shim.cc
@@ -35,8 +35,8 @@
     : loaded(false) {}
 };
 
-base::LazyInstance<PartnerModelKeeper> g_partner_model_keeper =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<PartnerModelKeeper>::DestructorAtExit
+    g_partner_model_keeper = LAZY_INSTANCE_INITIALIZER;
 
 const void* const kPartnerBookmarksShimUserDataKey =
     &kPartnerBookmarksShimUserDataKey;
diff --git a/chrome/browser/android/download/download_controller.cc b/chrome/browser/android/download/download_controller.cc
index 2d604ab..ce839db9 100644
--- a/chrome/browser/android/download/download_controller.cc
+++ b/chrome/browser/android/download/download_controller.cc
@@ -45,7 +45,7 @@
 
 namespace {
 // Guards download_controller_
-base::LazyInstance<base::Lock> g_download_controller_lock_;
+base::LazyInstance<base::Lock>::DestructorAtExit g_download_controller_lock_;
 
 WebContents* GetWebContents(int render_process_id, int render_view_id) {
   content::RenderViewHost* render_view_host =
diff --git a/chrome/browser/android/ntp/ntp_snippets_launcher.cc b/chrome/browser/android/ntp/ntp_snippets_launcher.cc
index 1fb4d9e..778f91f 100644
--- a/chrome/browser/android/ntp/ntp_snippets_launcher.cc
+++ b/chrome/browser/android/ntp/ntp_snippets_launcher.cc
@@ -12,7 +12,7 @@
 
 namespace {
 
-base::LazyInstance<NTPSnippetsLauncher> g_snippets_launcher =
+base::LazyInstance<NTPSnippetsLauncher>::DestructorAtExit g_snippets_launcher =
     LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
diff --git a/chrome/browser/android/ntp/ntp_snippets_launcher.h b/chrome/browser/android/ntp/ntp_snippets_launcher.h
index bd163a08..a043e5a 100644
--- a/chrome/browser/android/ntp/ntp_snippets_launcher.h
+++ b/chrome/browser/android/ntp/ntp_snippets_launcher.h
@@ -25,7 +25,7 @@
   bool Unschedule() override;
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<NTPSnippetsLauncher>;
+  friend struct base::LazyInstanceTraitsBase<NTPSnippetsLauncher>;
 
   // Constructor and destructor marked private to enforce singleton.
   NTPSnippetsLauncher();
diff --git a/chrome/browser/android/webapps/single_tab_mode_tab_helper.cc b/chrome/browser/android/webapps/single_tab_mode_tab_helper.cc
index 31435ed..85f4755 100644
--- a/chrome/browser/android/webapps/single_tab_mode_tab_helper.cc
+++ b/chrome/browser/android/webapps/single_tab_mode_tab_helper.cc
@@ -17,7 +17,8 @@
 
 typedef std::pair<int32_t, int32_t> RenderFrameHostID;
 typedef std::set<RenderFrameHostID> SingleTabIDSet;
-base::LazyInstance<SingleTabIDSet> g_blocked_ids = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<SingleTabIDSet>::DestructorAtExit g_blocked_ids =
+    LAZY_INSTANCE_INITIALIZER;
 
 void AddPairOnIOThread(int32_t process_id, int32_t frame_routing_id) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
diff --git a/chrome/browser/autofill/validation_rules_storage_factory.cc b/chrome/browser/autofill/validation_rules_storage_factory.cc
index 21d68512..8265c58 100644
--- a/chrome/browser/autofill/validation_rules_storage_factory.cc
+++ b/chrome/browser/autofill/validation_rules_storage_factory.cc
@@ -19,8 +19,8 @@
 
 // static
 std::unique_ptr<Storage> ValidationRulesStorageFactory::CreateStorage() {
-  static base::LazyInstance<ValidationRulesStorageFactory> instance =
-      LAZY_INSTANCE_INITIALIZER;
+  static base::LazyInstance<ValidationRulesStorageFactory>::DestructorAtExit
+      instance = LAZY_INSTANCE_INITIALIZER;
   return std::unique_ptr<Storage>(
       new ChromeStorageImpl(instance.Get().json_pref_store_.get()));
 }
diff --git a/chrome/browser/autofill/validation_rules_storage_factory.h b/chrome/browser/autofill/validation_rules_storage_factory.h
index bf924bd..3a95d6c 100644
--- a/chrome/browser/autofill/validation_rules_storage_factory.h
+++ b/chrome/browser/autofill/validation_rules_storage_factory.h
@@ -27,7 +27,7 @@
   static std::unique_ptr<::i18n::addressinput::Storage> CreateStorage();
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<ValidationRulesStorageFactory>;
+  friend struct base::LazyInstanceTraitsBase<ValidationRulesStorageFactory>;
 
   ValidationRulesStorageFactory();
   ~ValidationRulesStorageFactory();
diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
index 99dede7d..aa0fee8 100644
--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc
@@ -425,7 +425,8 @@
 
 // Cached version of the locale so we can return the locale on the I/O
 // thread.
-base::LazyInstance<std::string> g_io_thread_application_locale;
+base::LazyInstance<std::string>::DestructorAtExit
+    g_io_thread_application_locale = LAZY_INSTANCE_INITIALIZER;
 
 const storage::QuotaSettings* g_default_quota_settings;
 
diff --git a/chrome/browser/chromeos/app_mode/kiosk_app_manager.cc b/chrome/browser/chromeos/app_mode/kiosk_app_manager.cc
index fde4eed4..2c11928e 100644
--- a/chrome/browser/chromeos/app_mode/kiosk_app_manager.cc
+++ b/chrome/browser/chromeos/app_mode/kiosk_app_manager.cc
@@ -170,7 +170,8 @@
 const char KioskAppManager::kCrxUnpackDir[] = "kiosk_unpack";
 
 // static
-static base::LazyInstance<KioskAppManager> instance = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<KioskAppManager>::DestructorAtExit instance =
+    LAZY_INSTANCE_INITIALIZER;
 KioskAppManager* KioskAppManager::Get() {
   return instance.Pointer();
 }
diff --git a/chrome/browser/chromeos/app_mode/kiosk_app_manager.h b/chrome/browser/chromeos/app_mode/kiosk_app_manager.h
index f057d11..7d7bbdf 100644
--- a/chrome/browser/chromeos/app_mode/kiosk_app_manager.h
+++ b/chrome/browser/chromeos/app_mode/kiosk_app_manager.h
@@ -251,7 +251,7 @@
   }
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<KioskAppManager>;
+  friend struct base::LazyInstanceTraitsBase<KioskAppManager>;
   friend std::default_delete<KioskAppManager>;
   friend class KioskAppManagerTest;
   friend class KioskTest;
diff --git a/chrome/browser/chromeos/arc/intent_helper/arc_external_protocol_dialog.cc b/chrome/browser/chromeos/arc/intent_helper/arc_external_protocol_dialog.cc
index bb134cf..bb0a465 100644
--- a/chrome/browser/chromeos/arc/intent_helper/arc_external_protocol_dialog.cc
+++ b/chrome/browser/chromeos/arc/intent_helper/arc_external_protocol_dialog.cc
@@ -35,7 +35,8 @@
 
 // TODO(yusukes|djacobo): Find a better way to detect a request loop and remove
 // the global variables.
-base::LazyInstance<GURL> g_last_url = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<GURL>::DestructorAtExit g_last_url =
+    LAZY_INSTANCE_INITIALIZER;
 ui::PageTransition g_last_page_transition;
 
 // Shows the Chrome OS' original external protocol dialog as a fallback.
diff --git a/chrome/browser/chromeos/boot_times_recorder.cc b/chrome/browser/chromeos/boot_times_recorder.cc
index 0d5cd76..55a826d 100644
--- a/chrome/browser/chromeos/boot_times_recorder.cc
+++ b/chrome/browser/chromeos/boot_times_recorder.cc
@@ -137,8 +137,8 @@
 // Name of file collecting logout times.
 static const char kLogoutTimes[] = "logout-times";
 
-static base::LazyInstance<BootTimesRecorder> g_boot_times_recorder =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<BootTimesRecorder>::DestructorAtExit
+    g_boot_times_recorder = LAZY_INSTANCE_INITIALIZER;
 
 // static
 BootTimesRecorder::Stats BootTimesRecorder::Stats::GetCurrentStats() {
diff --git a/chrome/browser/chromeos/extensions/gfx_utils.cc b/chrome/browser/chromeos/extensions/gfx_utils.cc
index e02f9e4a..7683dc4 100644
--- a/chrome/browser/chromeos/extensions/gfx_utils.cc
+++ b/chrome/browser/chromeos/extensions/gfx_utils.cc
@@ -135,7 +135,7 @@
   DISALLOW_COPY_AND_ASSIGN(AppDualBadgeMap);
 };
 
-base::LazyInstance<AppDualBadgeMap> g_dual_badge_map =
+base::LazyInstance<AppDualBadgeMap>::DestructorAtExit g_dual_badge_map =
     LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
diff --git a/chrome/browser/chromeos/extensions/input_method_api.cc b/chrome/browser/chromeos/extensions/input_method_api.cc
index 610a0ca713..305449f7 100644
--- a/chrome/browser/chromeos/extensions/input_method_api.cc
+++ b/chrome/browser/chromeos/extensions/input_method_api.cc
@@ -367,8 +367,9 @@
   }
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<InputMethodAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<InputMethodAPI>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<InputMethodAPI>*
diff --git a/chrome/browser/chromeos/extensions/media_player_api.cc b/chrome/browser/chromeos/extensions/media_player_api.cc
index 86d297b..c60fb83 100644
--- a/chrome/browser/chromeos/extensions/media_player_api.cc
+++ b/chrome/browser/chromeos/extensions/media_player_api.cc
@@ -28,8 +28,9 @@
   return media_player_event_router_.get();
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<MediaPlayerAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<MediaPlayerAPI>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<MediaPlayerAPI>*
diff --git a/chrome/browser/chromeos/extensions/wallpaper_api.cc b/chrome/browser/chromeos/extensions/wallpaper_api.cc
index b780682..06b598a 100644
--- a/chrome/browser/chromeos/extensions/wallpaper_api.cc
+++ b/chrome/browser/chromeos/extensions/wallpaper_api.cc
@@ -92,7 +92,7 @@
   FetchCallback callback_;
 };
 
-base::LazyInstance<WallpaperFetcher> g_wallpaper_fetcher =
+base::LazyInstance<WallpaperFetcher>::DestructorAtExit g_wallpaper_fetcher =
     LAZY_INSTANCE_INITIALIZER;
 
 // Gets the |User| for a given |BrowserContext|. The function will only return
diff --git a/chrome/browser/chromeos/login/signin/merge_session_throttling_utils.cc b/chrome/browser/chromeos/login/signin/merge_session_throttling_utils.cc
index edab4bd..49e51f4 100644
--- a/chrome/browser/chromeos/login/signin/merge_session_throttling_utils.cc
+++ b/chrome/browser/chromeos/login/signin/merge_session_throttling_utils.cc
@@ -41,14 +41,15 @@
   static ProfileSet* Get();
 
  private:
-  friend struct ::base::DefaultLazyInstanceTraits<ProfileSet>;
+  friend struct ::base::LazyInstanceTraitsBase<ProfileSet>;
 
   DISALLOW_COPY_AND_ASSIGN(ProfileSet);
 };
 
 // Set of all of profiles for which restore session is in progress.
 // This static member is accessible only form UI thread.
-base::LazyInstance<ProfileSet> g_blocked_profiles = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<ProfileSet>::DestructorAtExit g_blocked_profiles =
+    LAZY_INSTANCE_INITIALIZER;
 
 ProfileSet* ProfileSet::Get() {
   return g_blocked_profiles.Pointer();
diff --git a/chrome/browser/chromeos/login/ui/login_web_dialog.cc b/chrome/browser/chromeos/login/ui/login_web_dialog.cc
index 2effa63e..fe8506b 100644
--- a/chrome/browser/chromeos/login/ui/login_web_dialog.cc
+++ b/chrome/browser/chromeos/login/ui/login_web_dialog.cc
@@ -33,8 +33,8 @@
 const double kMinimumWidthRatio = 0.25;
 const double kMinimumHeightRatio = 0.25;
 
-base::LazyInstance<std::deque<WebContents*>> g_web_contents_stack =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<std::deque<WebContents*>>::DestructorAtExit
+    g_web_contents_stack = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/chrome/browser/chromeos/printer_detector/printer_detector_factory.cc b/chrome/browser/chromeos/printer_detector/printer_detector_factory.cc
index 40eb084..01a7b7d 100644
--- a/chrome/browser/chromeos/printer_detector/printer_detector_factory.cc
+++ b/chrome/browser/chromeos/printer_detector/printer_detector_factory.cc
@@ -15,7 +15,7 @@
 
 namespace {
 
-static base::LazyInstance<PrinterDetectorFactory> g_factory =
+static base::LazyInstance<PrinterDetectorFactory>::DestructorAtExit g_factory =
     LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
diff --git a/chrome/browser/chromeos/printer_detector/printer_detector_factory.h b/chrome/browser/chromeos/printer_detector/printer_detector_factory.h
index 08a309784..252cba9d1 100644
--- a/chrome/browser/chromeos/printer_detector/printer_detector_factory.h
+++ b/chrome/browser/chromeos/printer_detector/printer_detector_factory.h
@@ -25,7 +25,7 @@
   PrinterDetector* Get(content::BrowserContext* context);
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<PrinterDetectorFactory>;
+  friend struct base::LazyInstanceTraitsBase<PrinterDetectorFactory>;
   PrinterDetectorFactory();
   ~PrinterDetectorFactory() override;
 
diff --git a/chrome/browser/chromeos/printing/cups_print_job_manager_factory.cc b/chrome/browser/chromeos/printing/cups_print_job_manager_factory.cc
index 6a8ce57..46b0ab9 100644
--- a/chrome/browser/chromeos/printing/cups_print_job_manager_factory.cc
+++ b/chrome/browser/chromeos/printing/cups_print_job_manager_factory.cc
@@ -13,7 +13,7 @@
 namespace chromeos {
 namespace {
 
-static base::LazyInstance<CupsPrintJobManagerFactory>
+static base::LazyInstance<CupsPrintJobManagerFactory>::DestructorAtExit
     g_cups_print_job_manager_factory = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
diff --git a/chrome/browser/chromeos/printing/cups_print_job_manager_factory.h b/chrome/browser/chromeos/printing/cups_print_job_manager_factory.h
index 25ae25a..62a6e58c 100644
--- a/chrome/browser/chromeos/printing/cups_print_job_manager_factory.h
+++ b/chrome/browser/chromeos/printing/cups_print_job_manager_factory.h
@@ -27,7 +27,7 @@
       content::BrowserContext* context) const override;
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<CupsPrintJobManagerFactory>;
+  friend struct base::LazyInstanceTraitsBase<CupsPrintJobManagerFactory>;
 
   CupsPrintJobManagerFactory();
   ~CupsPrintJobManagerFactory() override;
diff --git a/chrome/browser/chromeos/printing/printers_manager_factory.cc b/chrome/browser/chromeos/printing/printers_manager_factory.cc
index 13e2ec4..ca2162f 100644
--- a/chrome/browser/chromeos/printing/printers_manager_factory.cc
+++ b/chrome/browser/chromeos/printing/printers_manager_factory.cc
@@ -21,8 +21,8 @@
 
 namespace {
 
-base::LazyInstance<PrintersManagerFactory> g_printers_manager =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<PrintersManagerFactory>::DestructorAtExit
+    g_printers_manager = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/chrome/browser/chromeos/printing/printers_manager_factory.h b/chrome/browser/chromeos/printing/printers_manager_factory.h
index fab4b339..0991677 100644
--- a/chrome/browser/chromeos/printing/printers_manager_factory.h
+++ b/chrome/browser/chromeos/printing/printers_manager_factory.h
@@ -28,7 +28,7 @@
       content::BrowserContext* context) const override;
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<PrintersManagerFactory>;
+  friend struct base::LazyInstanceTraitsBase<PrintersManagerFactory>;
 
   PrintersManagerFactory();
   ~PrintersManagerFactory() override;
diff --git a/chrome/browser/devtools/device/usb/android_usb_device.cc b/chrome/browser/devtools/device/usb/android_usb_device.cc
index 6ccee19e..d071f43 100644
--- a/chrome/browser/devtools/device/usb/android_usb_device.cc
+++ b/chrome/browser/devtools/device/usb/android_usb_device.cc
@@ -59,7 +59,7 @@
 typedef std::set<scoped_refptr<UsbDevice> > UsbDeviceSet;
 
 // Stores android wrappers around claimed usb devices on caller thread.
-base::LazyInstance<std::vector<AndroidUsbDevice*> >::Leaky g_devices =
+base::LazyInstance<std::vector<AndroidUsbDevice*>>::Leaky g_devices =
     LAZY_INSTANCE_INITIALIZER;
 
 bool IsAndroidInterface(const UsbInterfaceDescriptor& interface) {
diff --git a/chrome/browser/download/download_prefs.cc b/chrome/browser/download/download_prefs.cc
index d7fe28e..57e2ca7 100644
--- a/chrome/browser/download/download_prefs.cc
+++ b/chrome/browser/download/download_prefs.cc
@@ -81,7 +81,7 @@
   const base::FilePath& path() const { return path_; }
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<DefaultDownloadDirectory>;
+  friend struct base::LazyInstanceTraitsBase<DefaultDownloadDirectory>;
 
   DefaultDownloadDirectory() {
     if (!PathService::Get(chrome::DIR_DEFAULT_DOWNLOADS, &path_)) {
@@ -101,7 +101,7 @@
   DISALLOW_COPY_AND_ASSIGN(DefaultDownloadDirectory);
 };
 
-base::LazyInstance<DefaultDownloadDirectory>
+base::LazyInstance<DefaultDownloadDirectory>::DestructorAtExit
     g_default_download_directory = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
diff --git a/chrome/browser/extensions/activity_log/activity_log.cc b/chrome/browser/extensions/activity_log/activity_log.cc
index 74cfad3..cd612042 100644
--- a/chrome/browser/extensions/activity_log/activity_log.cc
+++ b/chrome/browser/extensions/activity_log/activity_log.cc
@@ -387,7 +387,7 @@
   DISALLOW_COPY_AND_ASSIGN(ActivityLogState);
 };
 
-base::LazyInstance<ActivityLogState> g_activity_log_state =
+base::LazyInstance<ActivityLogState>::DestructorAtExit g_activity_log_state =
     LAZY_INSTANCE_INITIALIZER;
 
 // Returns the ActivityLog associated with the given |browser_context| after
@@ -533,8 +533,9 @@
 
 // SET THINGS UP. --------------------------------------------------------------
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<ActivityLog> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<ActivityLog>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 BrowserContextKeyedAPIFactory<ActivityLog>* ActivityLog::GetFactoryInstance() {
   return g_factory.Pointer();
diff --git a/chrome/browser/extensions/api/activity_log_private/activity_log_private_api.cc b/chrome/browser/extensions/api/activity_log_private/activity_log_private_api.cc
index 2da6ff0..cfe4292d2 100644
--- a/chrome/browser/extensions/api/activity_log_private/activity_log_private_api.cc
+++ b/chrome/browser/extensions/api/activity_log_private/activity_log_private_api.cc
@@ -32,8 +32,9 @@
 using activity_log_private::ExtensionActivity;
 using activity_log_private::Filter;
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<ActivityLogAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<ActivityLogAPI>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<ActivityLogAPI>*
diff --git a/chrome/browser/extensions/api/autotest_private/autotest_private_api.cc b/chrome/browser/extensions/api/autotest_private/autotest_private_api.cc
index 3583b20..bb489e1 100644
--- a/chrome/browser/extensions/api/autotest_private/autotest_private_api.cc
+++ b/chrome/browser/extensions/api/autotest_private/autotest_private_api.cc
@@ -378,8 +378,8 @@
   return RespondNow(OneArgument(std::move(values)));
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<AutotestPrivateAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<BrowserContextKeyedAPIFactory<AutotestPrivateAPI>>::
+    DestructorAtExit g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<AutotestPrivateAPI>*
diff --git a/chrome/browser/extensions/api/bookmark_manager_private/bookmark_manager_private_api.cc b/chrome/browser/extensions/api/bookmark_manager_private/bookmark_manager_private_api.cc
index 0b5be4644..94cd27a9 100644
--- a/chrome/browser/extensions/api/bookmark_manager_private/bookmark_manager_private_api.cc
+++ b/chrome/browser/extensions/api/bookmark_manager_private/bookmark_manager_private_api.cc
@@ -269,8 +269,8 @@
 }
 
 static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<BookmarkManagerPrivateAPI> > g_factory =
-    LAZY_INSTANCE_INITIALIZER;
+    BrowserContextKeyedAPIFactory<BookmarkManagerPrivateAPI>>::DestructorAtExit
+    g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<BookmarkManagerPrivateAPI>*
diff --git a/chrome/browser/extensions/api/bookmarks/bookmarks_api.cc b/chrome/browser/extensions/api/bookmarks/bookmarks_api.cc
index a9e78ad..63b27c87 100644
--- a/chrome/browser/extensions/api/bookmarks/bookmarks_api.cc
+++ b/chrome/browser/extensions/api/bookmarks/bookmarks_api.cc
@@ -403,8 +403,9 @@
   EventRouter::Get(browser_context_)->UnregisterObserver(this);
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<BookmarksAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<BookmarksAPI>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<BookmarksAPI>*
diff --git a/chrome/browser/extensions/api/braille_display_private/braille_display_private_api.cc b/chrome/browser/extensions/api/braille_display_private/braille_display_private_api.cc
index efa0629..ca8e251 100644
--- a/chrome/browser/extensions/api/braille_display_private/braille_display_private_api.cc
+++ b/chrome/browser/extensions/api/braille_display_private/braille_display_private_api.cc
@@ -54,8 +54,8 @@
 }
 
 static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<BrailleDisplayPrivateAPI> > g_factory =
-    LAZY_INSTANCE_INITIALIZER;
+    BrowserContextKeyedAPIFactory<BrailleDisplayPrivateAPI>>::DestructorAtExit
+    g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<BrailleDisplayPrivateAPI>*
diff --git a/chrome/browser/extensions/api/commands/command_service.cc b/chrome/browser/extensions/api/commands/command_service.cc
index dc0c704..5b43144 100644
--- a/chrome/browser/extensions/api/commands/command_service.cc
+++ b/chrome/browser/extensions/api/commands/command_service.cc
@@ -141,8 +141,9 @@
 CommandService::~CommandService() {
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<CommandService> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<CommandService>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<CommandService>*
diff --git a/chrome/browser/extensions/api/content_settings/content_settings_service.cc b/chrome/browser/extensions/api/content_settings/content_settings_service.cc
index 4a7e415..83169fc 100644
--- a/chrome/browser/extensions/api/content_settings/content_settings_service.cc
+++ b/chrome/browser/extensions/api/content_settings/content_settings_service.cc
@@ -27,8 +27,8 @@
 BrowserContextKeyedAPIFactory<ContentSettingsService>*
 ContentSettingsService::GetFactoryInstance() {
   static base::LazyInstance<
-      BrowserContextKeyedAPIFactory<ContentSettingsService> > factory =
-      LAZY_INSTANCE_INITIALIZER;
+      BrowserContextKeyedAPIFactory<ContentSettingsService>>::DestructorAtExit
+      factory = LAZY_INSTANCE_INITIALIZER;
   return factory.Pointer();
 }
 
diff --git a/chrome/browser/extensions/api/cookies/cookies_api.cc b/chrome/browser/extensions/api/cookies/cookies_api.cc
index 38e7d96..4939ff2 100644
--- a/chrome/browser/extensions/api/cookies/cookies_api.cc
+++ b/chrome/browser/extensions/api/cookies/cookies_api.cc
@@ -579,8 +579,9 @@
   EventRouter::Get(browser_context_)->UnregisterObserver(this);
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<CookiesAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<CookiesAPI>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<CookiesAPI>* CookiesAPI::GetFactoryInstance() {
diff --git a/chrome/browser/extensions/api/developer_private/developer_private_api.cc b/chrome/browser/extensions/api/developer_private/developer_private_api.cc
index 242f8eeb..69d31bc8 100644
--- a/chrome/browser/extensions/api/developer_private/developer_private_api.cc
+++ b/chrome/browser/extensions/api/developer_private/developer_private_api.cc
@@ -188,8 +188,8 @@
 namespace PackDirectory = api::developer_private::PackDirectory;
 namespace Reload = api::developer_private::Reload;
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<DeveloperPrivateAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<BrowserContextKeyedAPIFactory<DeveloperPrivateAPI>>::
+    DestructorAtExit g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<DeveloperPrivateAPI>*
diff --git a/chrome/browser/extensions/api/downloads/downloads_api.cc b/chrome/browser/extensions/api/downloads/downloads_api.cc
index 8561193..177fbdc 100644
--- a/chrome/browser/extensions/api/downloads/downloads_api.cc
+++ b/chrome/browser/extensions/api/downloads/downloads_api.cc
@@ -476,8 +476,8 @@
     DownloadQuery* query) {
   // TODO(benjhayden): Consider switching from LazyInstance to explicit string
   // comparisons.
-  static base::LazyInstance<SortTypeMap> sorter_types =
-    LAZY_INSTANCE_INITIALIZER;
+  static base::LazyInstance<SortTypeMap>::DestructorAtExit sorter_types =
+      LAZY_INSTANCE_INITIALIZER;
   if (sorter_types.Get().empty())
     InitSortTypeMap(sorter_types.Pointer());
 
@@ -509,8 +509,8 @@
     DownloadQuery::DownloadVector* results) {
   // TODO(benjhayden): Consider switching from LazyInstance to explicit string
   // comparisons.
-  static base::LazyInstance<FilterTypeMap> filter_types =
-    LAZY_INSTANCE_INITIALIZER;
+  static base::LazyInstance<FilterTypeMap>::DestructorAtExit filter_types =
+      LAZY_INSTANCE_INITIALIZER;
   if (filter_types.Get().empty())
     InitFilterTypeMap(filter_types.Pointer());
 
diff --git a/chrome/browser/extensions/api/easy_unlock_private/easy_unlock_private_api.cc b/chrome/browser/extensions/api/easy_unlock_private/easy_unlock_private_api.cc
index 840f60d3..1ca33d3 100644
--- a/chrome/browser/extensions/api/easy_unlock_private/easy_unlock_private_api.cc
+++ b/chrome/browser/extensions/api/easy_unlock_private/easy_unlock_private_api.cc
@@ -68,8 +68,8 @@
 
 namespace {
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<EasyUnlockPrivateAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<BrowserContextKeyedAPIFactory<EasyUnlockPrivateAPI>>::
+    DestructorAtExit g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // Utility method for getting the API's crypto delegate.
 EasyUnlockPrivateCryptoDelegate* GetCryptoDelegate(
diff --git a/chrome/browser/extensions/api/easy_unlock_private/easy_unlock_private_connection.cc b/chrome/browser/extensions/api/easy_unlock_private/easy_unlock_private_connection.cc
index 88fe91b..f5cb2fd 100644
--- a/chrome/browser/extensions/api/easy_unlock_private/easy_unlock_private_connection.cc
+++ b/chrome/browser/extensions/api/easy_unlock_private/easy_unlock_private_connection.cc
@@ -10,8 +10,8 @@
 namespace extensions {
 
 static base::LazyInstance<BrowserContextKeyedAPIFactory<
-    ApiResourceManager<EasyUnlockPrivateConnection>>> g_factory =
-    LAZY_INSTANCE_INITIALIZER;
+    ApiResourceManager<EasyUnlockPrivateConnection>>>::DestructorAtExit
+    g_factory = LAZY_INSTANCE_INITIALIZER;
 
 template <>
 BrowserContextKeyedAPIFactory<ApiResourceManager<EasyUnlockPrivateConnection>>*
diff --git a/chrome/browser/extensions/api/extension_action/extension_action_api.cc b/chrome/browser/extensions/api/extension_action/extension_action_api.cc
index 38cf69ee..a85d9c5 100644
--- a/chrome/browser/extensions/api/extension_action/extension_action_api.cc
+++ b/chrome/browser/extensions/api/extension_action/extension_action_api.cc
@@ -91,8 +91,8 @@
 // ExtensionActionAPI
 //
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<ExtensionActionAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<BrowserContextKeyedAPIFactory<ExtensionActionAPI>>::
+    DestructorAtExit g_factory = LAZY_INSTANCE_INITIALIZER;
 
 ExtensionActionAPI::ExtensionActionAPI(content::BrowserContext* context)
     : browser_context_(context),
diff --git a/chrome/browser/extensions/api/feedback_private/feedback_private_api.cc b/chrome/browser/extensions/api/feedback_private/feedback_private_api.cc
index e94081c..7a1fe55 100644
--- a/chrome/browser/extensions/api/feedback_private/feedback_private_api.cc
+++ b/chrome/browser/extensions/api/feedback_private/feedback_private_api.cc
@@ -77,8 +77,8 @@
 using SystemInformationList =
     std::vector<api::feedback_private::SystemInformation>;
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<FeedbackPrivateAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<BrowserContextKeyedAPIFactory<FeedbackPrivateAPI>>::
+    DestructorAtExit g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<FeedbackPrivateAPI>*
diff --git a/chrome/browser/extensions/api/font_settings/font_settings_api.cc b/chrome/browser/extensions/api/font_settings/font_settings_api.cc
index 0348527..b417664 100644
--- a/chrome/browser/extensions/api/font_settings/font_settings_api.cc
+++ b/chrome/browser/extensions/api/font_settings/font_settings_api.cc
@@ -201,8 +201,8 @@
 FontSettingsAPI::~FontSettingsAPI() {
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<FontSettingsAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<BrowserContextKeyedAPIFactory<FontSettingsAPI>>::
+    DestructorAtExit g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<FontSettingsAPI>*
diff --git a/chrome/browser/extensions/api/history/history_api.cc b/chrome/browser/extensions/api/history/history_api.cc
index e940c709..a10c6f6 100644
--- a/chrome/browser/extensions/api/history/history_api.cc
+++ b/chrome/browser/extensions/api/history/history_api.cc
@@ -196,8 +196,9 @@
   EventRouter::Get(browser_context_)->UnregisterObserver(this);
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<HistoryAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<HistoryAPI>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<HistoryAPI>* HistoryAPI::GetFactoryInstance() {
diff --git a/chrome/browser/extensions/api/hotword_private/hotword_private_api.cc b/chrome/browser/extensions/api/hotword_private/hotword_private_api.cc
index 61aac818..0481d280 100644
--- a/chrome/browser/extensions/api/hotword_private/hotword_private_api.cc
+++ b/chrome/browser/extensions/api/hotword_private/hotword_private_api.cc
@@ -45,8 +45,8 @@
     api::hotword_private::OnEnabledChanged;
 
 static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<HotwordPrivateEventService> > g_factory =
-    LAZY_INSTANCE_INITIALIZER;
+    BrowserContextKeyedAPIFactory<HotwordPrivateEventService>>::DestructorAtExit
+    g_factory = LAZY_INSTANCE_INITIALIZER;
 
 HotwordPrivateEventService::HotwordPrivateEventService(
     content::BrowserContext* context)
diff --git a/chrome/browser/extensions/api/identity/identity_api.cc b/chrome/browser/extensions/api/identity/identity_api.cc
index 7de43ede..8578493 100644
--- a/chrome/browser/extensions/api/identity/identity_api.cc
+++ b/chrome/browser/extensions/api/identity/identity_api.cc
@@ -184,8 +184,9 @@
   account_tracker_.Shutdown();
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<IdentityAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<IdentityAPI>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<IdentityAPI>* IdentityAPI::GetFactoryInstance() {
diff --git a/chrome/browser/extensions/api/image_writer_private/operation.cc b/chrome/browser/extensions/api/image_writer_private/operation.cc
index f06a7cc7..735915b 100644
--- a/chrome/browser/extensions/api/image_writer_private/operation.cc
+++ b/chrome/browser/extensions/api/image_writer_private/operation.cc
@@ -24,8 +24,8 @@
 const int kMD5BufferSize = 1024;
 
 #if !defined(OS_CHROMEOS)
-static base::LazyInstance<scoped_refptr<ImageWriterUtilityClient> >
-    g_utility_client = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<scoped_refptr<ImageWriterUtilityClient>>::
+    DestructorAtExit g_utility_client = LAZY_INSTANCE_INITIALIZER;
 #endif
 
 Operation::Operation(base::WeakPtr<OperationManager> manager,
diff --git a/chrome/browser/extensions/api/image_writer_private/operation_manager.cc b/chrome/browser/extensions/api/image_writer_private/operation_manager.cc
index aaa05ff0..036ce23 100644
--- a/chrome/browser/extensions/api/image_writer_private/operation_manager.cc
+++ b/chrome/browser/extensions/api/image_writer_private/operation_manager.cc
@@ -277,8 +277,8 @@
   return BrowserContextKeyedAPIFactory<OperationManager>::Get(context);
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<OperationManager> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<BrowserContextKeyedAPIFactory<OperationManager>>::
+    DestructorAtExit g_factory = LAZY_INSTANCE_INITIALIZER;
 
 BrowserContextKeyedAPIFactory<OperationManager>*
 OperationManager::GetFactoryInstance() {
diff --git a/chrome/browser/extensions/api/image_writer_private/removable_storage_provider.cc b/chrome/browser/extensions/api/image_writer_private/removable_storage_provider.cc
index 42b40f7f..6ad662c 100644
--- a/chrome/browser/extensions/api/image_writer_private/removable_storage_provider.cc
+++ b/chrome/browser/extensions/api/image_writer_private/removable_storage_provider.cc
@@ -10,7 +10,8 @@
 namespace extensions {
 
 // A device list to be returned when testing.
-static base::LazyInstance<scoped_refptr<StorageDeviceList> > g_test_device_list;
+static base::LazyInstance<scoped_refptr<StorageDeviceList>>::DestructorAtExit
+    g_test_device_list = LAZY_INSTANCE_INITIALIZER;
 
 // TODO(haven): Udev code may be duplicated in the Chrome codebase.
 // https://code.google.com/p/chromium/issues/detail?id=284898
diff --git a/chrome/browser/extensions/api/input_ime/input_ime_api.cc b/chrome/browser/extensions/api/input_ime/input_ime_api.cc
index 0a78eb6..712584d 100644
--- a/chrome/browser/extensions/api/input_ime/input_ime_api.cc
+++ b/chrome/browser/extensions/api/input_ime/input_ime_api.cc
@@ -421,8 +421,9 @@
   registrar_.RemoveAll();
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<InputImeAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<InputImeAPI>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<InputImeAPI>* InputImeAPI::GetFactoryInstance() {
diff --git a/chrome/browser/extensions/api/launcher_page/launcher_page_api.cc b/chrome/browser/extensions/api/launcher_page/launcher_page_api.cc
index 4510827..2c68152 100644
--- a/chrome/browser/extensions/api/launcher_page/launcher_page_api.cc
+++ b/chrome/browser/extensions/api/launcher_page/launcher_page_api.cc
@@ -15,8 +15,8 @@
 
 namespace extensions {
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<LauncherPageAPI>>
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<BrowserContextKeyedAPIFactory<LauncherPageAPI>>::
+    DestructorAtExit g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<LauncherPageAPI>*
diff --git a/chrome/browser/extensions/api/log_private/log_private_api_chromeos.cc b/chrome/browser/extensions/api/log_private/log_private_api_chromeos.cc
index 7ede50f..1a12db9 100644
--- a/chrome/browser/extensions/api/log_private/log_private_api_chromeos.cc
+++ b/chrome/browser/extensions/api/log_private/log_private_api_chromeos.cc
@@ -206,8 +206,9 @@
                  base::Unretained(this), owner_extension_id, file_path));
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<LogPrivateAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<LogPrivateAPI>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<LogPrivateAPI>*
diff --git a/chrome/browser/extensions/api/mdns/mdns_api.cc b/chrome/browser/extensions/api/mdns/mdns_api.cc
index 93613c74..7af397a 100644
--- a/chrome/browser/extensions/api/mdns/mdns_api.cc
+++ b/chrome/browser/extensions/api/mdns/mdns_api.cc
@@ -54,7 +54,8 @@
   return BrowserContextKeyedAPIFactory<MDnsAPI>::Get(context);
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<MDnsAPI> > g_factory =
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<MDnsAPI>>::DestructorAtExit g_factory =
     LAZY_INSTANCE_INITIALIZER;
 
 // static
diff --git a/chrome/browser/extensions/api/media_galleries/media_galleries_api.cc b/chrome/browser/extensions/api/media_galleries/media_galleries_api.cc
index 1b9765f2..8955c29 100644
--- a/chrome/browser/extensions/api/media_galleries/media_galleries_api.cc
+++ b/chrome/browser/extensions/api/media_galleries/media_galleries_api.cc
@@ -316,8 +316,8 @@
 }
 
 static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<MediaGalleriesEventRouter> > g_factory =
-    LAZY_INSTANCE_INITIALIZER;
+    BrowserContextKeyedAPIFactory<MediaGalleriesEventRouter>>::DestructorAtExit
+    g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<MediaGalleriesEventRouter>*
diff --git a/chrome/browser/extensions/api/messaging/incognito_connectability.cc b/chrome/browser/extensions/api/messaging/incognito_connectability.cc
index f361ab58..39818de0 100644
--- a/chrome/browser/extensions/api/messaging/incognito_connectability.cc
+++ b/chrome/browser/extensions/api/messaging/incognito_connectability.cc
@@ -290,8 +290,8 @@
 }
 
 static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<IncognitoConnectability> > g_factory =
-    LAZY_INSTANCE_INITIALIZER;
+    BrowserContextKeyedAPIFactory<IncognitoConnectability>>::DestructorAtExit
+    g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<IncognitoConnectability>*
diff --git a/chrome/browser/extensions/api/messaging/message_service.cc b/chrome/browser/extensions/api/messaging/message_service.cc
index 154fb99..0242a93 100644
--- a/chrome/browser/extensions/api/messaging/message_service.cc
+++ b/chrome/browser/extensions/api/messaging/message_service.cc
@@ -199,8 +199,9 @@
   channels_.clear();
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<MessageService> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<MessageService>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<MessageService>*
diff --git a/chrome/browser/extensions/api/omnibox/omnibox_api.cc b/chrome/browser/extensions/api/omnibox/omnibox_api.cc
index 69c9e10..dab6aa3b 100644
--- a/chrome/browser/extensions/api/omnibox/omnibox_api.cc
+++ b/chrome/browser/extensions/api/omnibox/omnibox_api.cc
@@ -194,8 +194,9 @@
 OmniboxAPI::~OmniboxAPI() {
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<OmniboxAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<OmniboxAPI>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<OmniboxAPI>* OmniboxAPI::GetFactoryInstance() {
diff --git a/chrome/browser/extensions/api/preference/chrome_direct_setting_api.cc b/chrome/browser/extensions/api/preference/chrome_direct_setting_api.cc
index 36e86c6..26a2c9fa 100644
--- a/chrome/browser/extensions/api/preference/chrome_direct_setting_api.cc
+++ b/chrome/browser/extensions/api/preference/chrome_direct_setting_api.cc
@@ -76,12 +76,12 @@
   DISALLOW_COPY_AND_ASSIGN(PreferenceWhitelist);
 };
 
-base::LazyInstance<PreferenceWhitelist> preference_whitelist =
+base::LazyInstance<PreferenceWhitelist>::DestructorAtExit preference_whitelist =
     LAZY_INSTANCE_INITIALIZER;
 
 static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<ChromeDirectSettingAPI> > g_factory =
-    LAZY_INSTANCE_INITIALIZER;
+    BrowserContextKeyedAPIFactory<ChromeDirectSettingAPI>>::DestructorAtExit
+    g_factory = LAZY_INSTANCE_INITIALIZER;
 
 ChromeDirectSettingAPI::ChromeDirectSettingAPI(content::BrowserContext* context)
     : profile_(Profile::FromBrowserContext(context)) {
diff --git a/chrome/browser/extensions/api/preference/preference_api.cc b/chrome/browser/extensions/api/preference/preference_api.cc
index 5e7b591..c2fda14 100644
--- a/chrome/browser/extensions/api/preference/preference_api.cc
+++ b/chrome/browser/extensions/api/preference/preference_api.cc
@@ -517,8 +517,9 @@
   content_settings_store()->RemoveObserver(this);
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<PreferenceAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<PreferenceAPI>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<PreferenceAPI>*
diff --git a/chrome/browser/extensions/api/processes/processes_api.cc b/chrome/browser/extensions/api/processes/processes_api.cc
index 1a928f5..ae43c84 100644
--- a/chrome/browser/extensions/api/processes/processes_api.cc
+++ b/chrome/browser/extensions/api/processes/processes_api.cc
@@ -37,8 +37,8 @@
 
 namespace {
 
-base::LazyInstance<BrowserContextKeyedAPIFactory<ProcessesAPI>>
-    g_processes_api_factory = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<BrowserContextKeyedAPIFactory<ProcessesAPI>>::
+    DestructorAtExit g_processes_api_factory = LAZY_INSTANCE_INITIALIZER;
 
 int64_t GetRefreshTypesFlagOnlyEssentialData() {
   // This is the only non-optional data in the Process as defined by the API in
diff --git a/chrome/browser/extensions/api/runtime/chrome_runtime_api_delegate.cc b/chrome/browser/extensions/api/runtime/chrome_runtime_api_delegate.cc
index 54395bd..2070b6a 100644
--- a/chrome/browser/extensions/api/runtime/chrome_runtime_api_delegate.cc
+++ b/chrome/browser/extensions/api/runtime/chrome_runtime_api_delegate.cc
@@ -78,7 +78,8 @@
 // We use a LazyInstance since one of the the policy values references an
 // extern symbol, which would cause a static initializer to be generated if we
 // just declared the policy struct as a static variable.
-base::LazyInstance<BackoffPolicy> g_backoff_policy = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<BackoffPolicy>::DestructorAtExit g_backoff_policy =
+    LAZY_INSTANCE_INITIALIZER;
 
 BackoffPolicy::BackoffPolicy() {
   policy_ = {
diff --git a/chrome/browser/extensions/api/screenlock_private/screenlock_private_api.cc b/chrome/browser/extensions/api/screenlock_private/screenlock_private_api.cc
index ea965b0..dfe4f1b 100644
--- a/chrome/browser/extensions/api/screenlock_private/screenlock_private_api.cc
+++ b/chrome/browser/extensions/api/screenlock_private/screenlock_private_api.cc
@@ -146,8 +146,8 @@
   EventRouter::Get(browser_context_)->BroadcastEvent(std::move(event));
 }
 
-static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<ScreenlockPrivateEventRouter>> g_factory =
+static base::LazyInstance<BrowserContextKeyedAPIFactory<
+    ScreenlockPrivateEventRouter>>::DestructorAtExit g_factory =
     LAZY_INSTANCE_INITIALIZER;
 
 // static
diff --git a/chrome/browser/extensions/api/sessions/sessions_api.cc b/chrome/browser/extensions/api/sessions/sessions_api.cc
index 8d2cbdad..5694539 100644
--- a/chrome/browser/extensions/api/sessions/sessions_api.cc
+++ b/chrome/browser/extensions/api/sessions/sessions_api.cc
@@ -596,8 +596,9 @@
   EventRouter::Get(browser_context_)->UnregisterObserver(this);
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<SessionsAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<SessionsAPI>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 BrowserContextKeyedAPIFactory<SessionsAPI>*
 SessionsAPI::GetFactoryInstance() {
diff --git a/chrome/browser/extensions/api/settings_overrides/settings_overrides_api.cc b/chrome/browser/extensions/api/settings_overrides/settings_overrides_api.cc
index 609163e..6f607b1a 100644
--- a/chrome/browser/extensions/api/settings_overrides/settings_overrides_api.cc
+++ b/chrome/browser/extensions/api/settings_overrides/settings_overrides_api.cc
@@ -31,8 +31,8 @@
 
 namespace {
 
-base::LazyInstance<BrowserContextKeyedAPIFactory<SettingsOverridesAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<BrowserContextKeyedAPIFactory<SettingsOverridesAPI>>::
+    DestructorAtExit g_factory = LAZY_INSTANCE_INITIALIZER;
 
 const char kManyStartupPagesWarning[] = "* specifies more than 1 startup URL. "
     "All but the first will be ignored.";
diff --git a/chrome/browser/extensions/api/signed_in_devices/signed_in_devices_manager.cc b/chrome/browser/extensions/api/signed_in_devices/signed_in_devices_manager.cc
index ab3864f..49e4abd86 100644
--- a/chrome/browser/extensions/api/signed_in_devices/signed_in_devices_manager.cc
+++ b/chrome/browser/extensions/api/signed_in_devices/signed_in_devices_manager.cc
@@ -87,8 +87,8 @@
 }
 
 static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<SignedInDevicesManager> > g_factory =
-    LAZY_INSTANCE_INITIALIZER;
+    BrowserContextKeyedAPIFactory<SignedInDevicesManager>>::DestructorAtExit
+    g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<SignedInDevicesManager>*
diff --git a/chrome/browser/extensions/api/spellcheck/spellcheck_api.cc b/chrome/browser/extensions/api/spellcheck/spellcheck_api.cc
index 56e4d65..517086ec 100644
--- a/chrome/browser/extensions/api/spellcheck/spellcheck_api.cc
+++ b/chrome/browser/extensions/api/spellcheck/spellcheck_api.cc
@@ -46,8 +46,9 @@
 SpellcheckAPI::~SpellcheckAPI() {
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<SpellcheckAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<SpellcheckAPI>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<SpellcheckAPI>*
diff --git a/chrome/browser/extensions/api/streams_private/streams_private_api.cc b/chrome/browser/extensions/api/streams_private/streams_private_api.cc
index 21c333a6..4e20405 100644
--- a/chrome/browser/extensions/api/streams_private/streams_private_api.cc
+++ b/chrome/browser/extensions/api/streams_private/streams_private_api.cc
@@ -181,8 +181,8 @@
   Respond(NoArguments());
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<StreamsPrivateAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<BrowserContextKeyedAPIFactory<StreamsPrivateAPI>>::
+    DestructorAtExit g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<StreamsPrivateAPI>*
diff --git a/chrome/browser/extensions/api/sync_file_system/extension_sync_event_observer.cc b/chrome/browser/extensions/api/sync_file_system/extension_sync_event_observer.cc
index ba11685..0fa12eb 100644
--- a/chrome/browser/extensions/api/sync_file_system/extension_sync_event_observer.cc
+++ b/chrome/browser/extensions/api/sync_file_system/extension_sync_event_observer.cc
@@ -27,8 +27,8 @@
 namespace extensions {
 
 static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<ExtensionSyncEventObserver> > g_factory =
-    LAZY_INSTANCE_INITIALIZER;
+    BrowserContextKeyedAPIFactory<ExtensionSyncEventObserver>>::DestructorAtExit
+    g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<ExtensionSyncEventObserver>*
diff --git a/chrome/browser/extensions/api/tab_capture/tab_capture_registry.cc b/chrome/browser/extensions/api/tab_capture/tab_capture_registry.cc
index a42bf6c3..c72f121 100644
--- a/chrome/browser/extensions/api/tab_capture/tab_capture_registry.cc
+++ b/chrome/browser/extensions/api/tab_capture/tab_capture_registry.cc
@@ -258,8 +258,8 @@
   return BrowserContextKeyedAPIFactory<TabCaptureRegistry>::Get(context);
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<TabCaptureRegistry> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<BrowserContextKeyedAPIFactory<TabCaptureRegistry>>::
+    DestructorAtExit g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<TabCaptureRegistry>*
diff --git a/chrome/browser/extensions/api/tabs/tabs_windows_api.cc b/chrome/browser/extensions/api/tabs/tabs_windows_api.cc
index a0efbbf..da01aea1 100644
--- a/chrome/browser/extensions/api/tabs/tabs_windows_api.cc
+++ b/chrome/browser/extensions/api/tabs/tabs_windows_api.cc
@@ -68,8 +68,9 @@
   EventRouter::Get(browser_context_)->UnregisterObserver(this);
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<TabsWindowsAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<TabsWindowsAPI>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 BrowserContextKeyedAPIFactory<TabsWindowsAPI>*
 TabsWindowsAPI::GetFactoryInstance() {
diff --git a/chrome/browser/extensions/api/web_navigation/web_navigation_api.cc b/chrome/browser/extensions/api/web_navigation/web_navigation_api.cc
index b89b19a..b903c5da 100644
--- a/chrome/browser/extensions/api/web_navigation/web_navigation_api.cc
+++ b/chrome/browser/extensions/api/web_navigation/web_navigation_api.cc
@@ -44,7 +44,7 @@
 
 typedef std::map<content::WebContents*, WebNavigationTabObserver*>
     TabObserverMap;
-static base::LazyInstance<TabObserverMap> g_tab_observer =
+static base::LazyInstance<TabObserverMap>::DestructorAtExit g_tab_observer =
     LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
@@ -573,8 +573,8 @@
   EventRouter::Get(browser_context_)->UnregisterObserver(this);
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<WebNavigationAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<BrowserContextKeyedAPIFactory<WebNavigationAPI>>::
+    DestructorAtExit g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<WebNavigationAPI>*
diff --git a/chrome/browser/extensions/api/webrtc_audio_private/webrtc_audio_private_api.cc b/chrome/browser/extensions/api/webrtc_audio_private/webrtc_audio_private_api.cc
index edc852f..baf803d0 100644
--- a/chrome/browser/extensions/api/webrtc_audio_private/webrtc_audio_private_api.cc
+++ b/chrome/browser/extensions/api/webrtc_audio_private/webrtc_audio_private_api.cc
@@ -36,8 +36,8 @@
 
 using api::webrtc_audio_private::RequestInfo;
 
-static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<WebrtcAudioPrivateEventService> > g_factory =
+static base::LazyInstance<BrowserContextKeyedAPIFactory<
+    WebrtcAudioPrivateEventService>>::DestructorAtExit g_factory =
     LAZY_INSTANCE_INITIALIZER;
 
 WebrtcAudioPrivateEventService::WebrtcAudioPrivateEventService(
diff --git a/chrome/browser/extensions/api/webstore_private/webstore_private_api.cc b/chrome/browser/extensions/api/webstore_private/webstore_private_api.cc
index 9f33b68..3dd47353 100644
--- a/chrome/browser/extensions/api/webstore_private/webstore_private_api.cc
+++ b/chrome/browser/extensions/api/webstore_private/webstore_private_api.cc
@@ -122,8 +122,8 @@
   return api::webstore_private::RESULT_NONE;
 }
 
-static base::LazyInstance<PendingApprovals> g_pending_approvals =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<PendingApprovals>::DestructorAtExit
+    g_pending_approvals = LAZY_INSTANCE_INITIALIZER;
 
 // A preference set by the web store to indicate login information for
 // purchased apps.
diff --git a/chrome/browser/extensions/blacklist.cc b/chrome/browser/extensions/blacklist.cc
index 52378ef2..048ed01 100644
--- a/chrome/browser/extensions/blacklist.cc
+++ b/chrome/browser/extensions/blacklist.cc
@@ -58,8 +58,8 @@
   scoped_refptr<SafeBrowsingDatabaseManager> instance_;
 };
 
-static base::LazyInstance<LazySafeBrowsingDatabaseManager> g_database_manager =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<LazySafeBrowsingDatabaseManager>::DestructorAtExit
+    g_database_manager = LAZY_INSTANCE_INITIALIZER;
 
 // Implementation of SafeBrowsingDatabaseManager::Client, the class which is
 // called back from safebrowsing queries.
diff --git a/chrome/browser/extensions/chrome_extension_host_delegate.cc b/chrome/browser/extensions/chrome_extension_host_delegate.cc
index baebf108..6eec597 100644
--- a/chrome/browser/extensions/chrome_extension_host_delegate.cc
+++ b/chrome/browser/extensions/chrome_extension_host_delegate.cc
@@ -33,7 +33,8 @@
   }
   std::unique_ptr<ExtensionHostQueue> queue;
 };
-base::LazyInstance<QueueWrapper> g_queue = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<QueueWrapper>::DestructorAtExit g_queue =
+    LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/chrome/browser/extensions/chrome_extensions_browser_client.h b/chrome/browser/extensions/chrome_extensions_browser_client.h
index e54f28bc..c6b03fef 100644
--- a/chrome/browser/extensions/chrome_extensions_browser_client.h
+++ b/chrome/browser/extensions/chrome_extensions_browser_client.h
@@ -126,7 +126,7 @@
   KioskDelegate* GetKioskDelegate() override;
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<ChromeExtensionsBrowserClient>;
+  friend struct base::LazyInstanceTraitsBase<ChromeExtensionsBrowserClient>;
 
   // Support for ProcessManager.
   std::unique_ptr<ChromeProcessManagerDelegate> process_manager_delegate_;
diff --git a/chrome/browser/extensions/content_verifier_browsertest.cc b/chrome/browser/extensions/content_verifier_browsertest.cc
index 0f36164..f7168b23 100644
--- a/chrome/browser/extensions/content_verifier_browsertest.cc
+++ b/chrome/browser/extensions/content_verifier_browsertest.cc
@@ -22,6 +22,7 @@
 #include "chrome/common/chrome_switches.h"
 #include "components/policy/core/browser/browser_policy_connector.h"
 #include "components/policy/core/common/mock_configuration_policy_provider.h"
+#include "content/public/common/browser_side_navigation_policy.h"
 #include "content/public/test/test_utils.h"
 #include "extensions/browser/content_verifier.h"
 #include "extensions/browser/content_verify_job.h"
@@ -37,6 +38,10 @@
 #include "extensions/browser/updater/manifest_fetch_data.h"
 #include "extensions/common/extension_urls.h"
 
+#if defined(OS_WIN)
+#include "base/win/windows_version.h"
+#endif
+
 namespace extensions {
 
 namespace {
@@ -500,6 +505,13 @@
 };
 
 IN_PROC_BROWSER_TEST_F(ContentVerifierTest, FailOnRead) {
+#if defined(OS_WIN)
+  if (content::IsBrowserSideNavigationEnabled() &&
+      base::win::GetVersion() >= base::win::VERSION_WIN10) {
+    // http://crbug.com/699437
+    return;
+  }
+#endif
   EXPECT_EQ(0, delegate_.bytes_read_failed());
   delegate_.fail_next_read();
   OpenPageAndWaitForUnload();
@@ -507,6 +519,13 @@
 }
 
 IN_PROC_BROWSER_TEST_F(ContentVerifierTest, FailOnDone) {
+#if defined(OS_WIN)
+  if (content::IsBrowserSideNavigationEnabled() &&
+      base::win::GetVersion() >= base::win::VERSION_WIN10) {
+    // http://crbug.com/699437
+    return;
+  }
+#endif
   EXPECT_EQ(0, delegate_.done_reading_failed());
   delegate_.fail_next_done();
   OpenPageAndWaitForUnload();
diff --git a/chrome/browser/extensions/extension_commands_global_registry.cc b/chrome/browser/extensions/extension_commands_global_registry.cc
index f43caa1d..f0b0f72 100644
--- a/chrome/browser/extensions/extension_commands_global_registry.cc
+++ b/chrome/browser/extensions/extension_commands_global_registry.cc
@@ -35,8 +35,8 @@
   }
 }
 
-static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<ExtensionCommandsGlobalRegistry> > g_factory =
+static base::LazyInstance<BrowserContextKeyedAPIFactory<
+    ExtensionCommandsGlobalRegistry>>::DestructorAtExit g_factory =
     LAZY_INSTANCE_INITIALIZER;
 
 // static
diff --git a/chrome/browser/extensions/extension_gcm_app_handler.cc b/chrome/browser/extensions/extension_gcm_app_handler.cc
index 75ebade5..c1dd9a2 100644
--- a/chrome/browser/extensions/extension_gcm_app_handler.cc
+++ b/chrome/browser/extensions/extension_gcm_app_handler.cc
@@ -29,8 +29,8 @@
 
 const char kDummyAppId[] = "extension.guard.dummy.id";
 
-base::LazyInstance<BrowserContextKeyedAPIFactory<ExtensionGCMAppHandler> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<BrowserContextKeyedAPIFactory<ExtensionGCMAppHandler>>::
+    DestructorAtExit g_factory = LAZY_INSTANCE_INITIALIZER;
 
 bool IsGCMPermissionEnabled(const Extension* extension) {
   return extension->permissions_data()->HasAPIPermission(APIPermission::kGcm);
diff --git a/chrome/browser/extensions/extension_install_error_menu_item_id_provider.cc b/chrome/browser/extensions/extension_install_error_menu_item_id_provider.cc
index 97b1182..6b19597b 100644
--- a/chrome/browser/extensions/extension_install_error_menu_item_id_provider.cc
+++ b/chrome/browser/extensions/extension_install_error_menu_item_id_provider.cc
@@ -13,9 +13,10 @@
 
 namespace {
 
-base::LazyInstance<std::bitset<
-    IDC_EXTENSION_INSTALL_ERROR_LAST - IDC_EXTENSION_INSTALL_ERROR_FIRST + 1>>
-    menu_command_ids = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<std::bitset<IDC_EXTENSION_INSTALL_ERROR_LAST -
+                               IDC_EXTENSION_INSTALL_ERROR_FIRST +
+                               1>>::DestructorAtExit menu_command_ids =
+    LAZY_INSTANCE_INITIALIZER;
 
 // Get an available menu ID.
 int GetMenuCommandID() {
diff --git a/chrome/browser/extensions/extension_message_bubble_controller.cc b/chrome/browser/extensions/extension_message_bubble_controller.cc
index 5a609f80..0d56e48 100644
--- a/chrome/browser/extensions/extension_message_bubble_controller.cc
+++ b/chrome/browser/extensions/extension_message_bubble_controller.cc
@@ -33,7 +33,7 @@
 bool g_should_ignore_learn_more_for_testing = false;
 
 using ProfileSetMap = std::map<std::string, std::set<Profile*>>;
-base::LazyInstance<ProfileSetMap> g_shown_for_profiles =
+base::LazyInstance<ProfileSetMap>::DestructorAtExit g_shown_for_profiles =
     LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
diff --git a/chrome/browser/extensions/extension_web_ui_override_registrar.cc b/chrome/browser/extensions/extension_web_ui_override_registrar.cc
index 9d9d9700..ca8f86f1 100644
--- a/chrome/browser/extensions/extension_web_ui_override_registrar.cc
+++ b/chrome/browser/extensions/extension_web_ui_override_registrar.cc
@@ -62,8 +62,8 @@
       Profile::FromBrowserContext(context));
 }
 
-static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<ExtensionWebUIOverrideRegistrar> > g_factory =
+static base::LazyInstance<BrowserContextKeyedAPIFactory<
+    ExtensionWebUIOverrideRegistrar>>::DestructorAtExit g_factory =
     LAZY_INSTANCE_INITIALIZER;
 
 // static
diff --git a/chrome/browser/extensions/install_signer.cc b/chrome/browser/extensions/install_signer.cc
index bc584ad..065a544 100644
--- a/chrome/browser/extensions/install_signer.cc
+++ b/chrome/browser/extensions/install_signer.cc
@@ -306,11 +306,11 @@
 
 static int g_request_count = 0;
 
-base::LazyInstance<base::TimeTicks> g_last_request_time =
+base::LazyInstance<base::TimeTicks>::DestructorAtExit g_last_request_time =
     LAZY_INSTANCE_INITIALIZER;
 
-base::LazyInstance<base::ThreadChecker> g_single_thread_checker =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<base::ThreadChecker>::DestructorAtExit
+    g_single_thread_checker = LAZY_INSTANCE_INITIALIZER;
 
 void LogRequestStartHistograms() {
   // Make sure we only ever call this from one thread, so that we don't have to
diff --git a/chrome/browser/extensions/plugin_manager.cc b/chrome/browser/extensions/plugin_manager.cc
index 57cd72a4..0b9d50e 100644
--- a/chrome/browser/extensions/plugin_manager.cc
+++ b/chrome/browser/extensions/plugin_manager.cc
@@ -36,8 +36,9 @@
 PluginManager::~PluginManager() {
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<PluginManager> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<PluginManager>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<PluginManager>*
diff --git a/chrome/browser/extensions/signin/gaia_auth_extension_loader.cc b/chrome/browser/extensions/signin/gaia_auth_extension_loader.cc
index e78282b..e50af38 100644
--- a/chrome/browser/extensions/signin/gaia_auth_extension_loader.cc
+++ b/chrome/browser/extensions/signin/gaia_auth_extension_loader.cc
@@ -108,8 +108,8 @@
 }
 
 static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<GaiaAuthExtensionLoader> > g_factory =
-    LAZY_INSTANCE_INITIALIZER;
+    BrowserContextKeyedAPIFactory<GaiaAuthExtensionLoader>>::DestructorAtExit
+    g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<GaiaAuthExtensionLoader>*
diff --git a/chrome/browser/feedback/feedback_profile_observer.h b/chrome/browser/feedback/feedback_profile_observer.h
index 0b174ac..6f88388 100644
--- a/chrome/browser/feedback/feedback_profile_observer.h
+++ b/chrome/browser/feedback/feedback_profile_observer.h
@@ -26,7 +26,7 @@
   static void Initialize();
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<FeedbackProfileObserver>;
+  friend struct base::LazyInstanceTraitsBase<FeedbackProfileObserver>;
 
   FeedbackProfileObserver();
   ~FeedbackProfileObserver() override;
diff --git a/chrome/browser/first_run/first_run.cc b/chrome/browser/first_run/first_run.cc
index 522b4d7..06cbc5c 100644
--- a/chrome/browser/first_run/first_run.cc
+++ b/chrome/browser/first_run/first_run.cc
@@ -439,8 +439,8 @@
   delete this;
 }
 
-static base::LazyInstance<base::FilePath> master_prefs_path_for_testing
-    = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<base::FilePath>::DestructorAtExit
+    master_prefs_path_for_testing = LAZY_INSTANCE_INITIALIZER;
 
 // Loads master preferences from the master preference file into the installer
 // master preferences. Returns the pointer to installer::MasterPreferences
diff --git a/chrome/browser/internal_auth.cc b/chrome/browser/internal_auth.cc
index 42da3ff..8165e64 100644
--- a/chrome/browser/internal_auth.cc
+++ b/chrome/browser/internal_auth.cc
@@ -324,8 +324,8 @@
 
 namespace {
 
-static base::LazyInstance<chrome::InternalAuthVerificationService>
-    g_verification_service = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<chrome::InternalAuthVerificationService>::
+    DestructorAtExit g_verification_service = LAZY_INSTANCE_INITIALIZER;
 static base::LazyInstance<base::Lock>::Leaky
     g_verification_service_lock = LAZY_INSTANCE_INITIALIZER;
 
@@ -432,8 +432,8 @@
 
 namespace {
 
-static base::LazyInstance<chrome::InternalAuthGenerationService>
-    g_generation_service = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<chrome::InternalAuthGenerationService>::
+    DestructorAtExit g_generation_service = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/chrome/browser/media/router/media_router_factory.cc b/chrome/browser/media/router/media_router_factory.cc
index 9e1e0ab..5f2420d 100644
--- a/chrome/browser/media/router/media_router_factory.cc
+++ b/chrome/browser/media/router/media_router_factory.cc
@@ -23,7 +23,7 @@
 
 namespace {
 
-base::LazyInstance<MediaRouterFactory> service_factory =
+base::LazyInstance<MediaRouterFactory>::DestructorAtExit service_factory =
     LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
diff --git a/chrome/browser/media/router/media_router_factory.h b/chrome/browser/media/router/media_router_factory.h
index 95c93c2..3b67aa2a 100644
--- a/chrome/browser/media/router/media_router_factory.h
+++ b/chrome/browser/media/router/media_router_factory.h
@@ -32,7 +32,7 @@
   void BrowserContextShutdown(content::BrowserContext* context) override;
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<MediaRouterFactory>;
+  friend struct base::LazyInstanceTraitsBase<MediaRouterFactory>;
   FRIEND_TEST_ALL_PREFIXES(MediaRouterFactoryTest,
                            IncognitoBrowserContextShutdown);
 
diff --git a/chrome/browser/media/router/offscreen_presentation_manager_factory.cc b/chrome/browser/media/router/offscreen_presentation_manager_factory.cc
index 5965e25..3dda0733 100644
--- a/chrome/browser/media/router/offscreen_presentation_manager_factory.cc
+++ b/chrome/browser/media/router/offscreen_presentation_manager_factory.cc
@@ -16,8 +16,8 @@
 
 namespace {
 
-base::LazyInstance<OffscreenPresentationManagerFactory> service_factory =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<OffscreenPresentationManagerFactory>::DestructorAtExit
+    service_factory = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/chrome/browser/media/router/offscreen_presentation_manager_factory.h b/chrome/browser/media/router/offscreen_presentation_manager_factory.h
index 96232db..97a3eea 100644
--- a/chrome/browser/media/router/offscreen_presentation_manager_factory.h
+++ b/chrome/browser/media/router/offscreen_presentation_manager_factory.h
@@ -35,7 +35,7 @@
   static OffscreenPresentationManagerFactory* GetInstanceForTest();
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<
+  friend struct base::LazyInstanceTraitsBase<
       OffscreenPresentationManagerFactory>;
 
   OffscreenPresentationManagerFactory();
diff --git a/chrome/browser/media/webrtc/webrtc_browsertest_base.cc b/chrome/browser/media/webrtc/webrtc_browsertest_base.cc
index 5ddf0ad..df30b68 100644
--- a/chrome/browser/media/webrtc/webrtc_browsertest_base.cc
+++ b/chrome/browser/media/webrtc/webrtc_browsertest_base.cc
@@ -67,8 +67,8 @@
 
 namespace {
 
-base::LazyInstance<bool> hit_javascript_errors_ =
-      LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<bool>::DestructorAtExit hit_javascript_errors_ =
+    LAZY_INSTANCE_INITIALIZER;
 
 // Intercepts all log messages. We always attach this handler but only look at
 // the results if the test requests so. Note that this will only work if the
diff --git a/chrome/browser/media_galleries/chromeos/mtp_device_task_helper_map_service.cc b/chrome/browser/media_galleries/chromeos/mtp_device_task_helper_map_service.cc
index 416948e..ee0d2c7f 100644
--- a/chrome/browser/media_galleries/chromeos/mtp_device_task_helper_map_service.cc
+++ b/chrome/browser/media_galleries/chromeos/mtp_device_task_helper_map_service.cc
@@ -11,7 +11,7 @@
 
 namespace {
 
-base::LazyInstance<MTPDeviceTaskHelperMapService>
+base::LazyInstance<MTPDeviceTaskHelperMapService>::DestructorAtExit
     g_mtp_device_task_helper_map_service = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
diff --git a/chrome/browser/media_galleries/chromeos/mtp_device_task_helper_map_service.h b/chrome/browser/media_galleries/chromeos/mtp_device_task_helper_map_service.h
index c8dc5a5..b0957b0 100644
--- a/chrome/browser/media_galleries/chromeos/mtp_device_task_helper_map_service.h
+++ b/chrome/browser/media_galleries/chromeos/mtp_device_task_helper_map_service.h
@@ -38,7 +38,7 @@
                                            const bool read_only);
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<MTPDeviceTaskHelperMapService>;
+  friend struct base::LazyInstanceTraitsBase<MTPDeviceTaskHelperMapService>;
 
   // A key to be used in TaskHelperMap.
   typedef std::string MTPDeviceTaskHelperKey;
diff --git a/chrome/browser/media_galleries/fileapi/mtp_device_map_service.cc b/chrome/browser/media_galleries/fileapi/mtp_device_map_service.cc
index b22022e..ceca4c10 100644
--- a/chrome/browser/media_galleries/fileapi/mtp_device_map_service.cc
+++ b/chrome/browser/media_galleries/fileapi/mtp_device_map_service.cc
@@ -14,8 +14,8 @@
 
 namespace {
 
-base::LazyInstance<MTPDeviceMapService> g_mtp_device_map_service =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<MTPDeviceMapService>::DestructorAtExit
+    g_mtp_device_map_service = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/chrome/browser/media_galleries/fileapi/mtp_device_map_service.h b/chrome/browser/media_galleries/fileapi/mtp_device_map_service.h
index 4e0657d..0c685d2 100644
--- a/chrome/browser/media_galleries/fileapi/mtp_device_map_service.h
+++ b/chrome/browser/media_galleries/fileapi/mtp_device_map_service.h
@@ -40,7 +40,7 @@
   void RevokeMTPFileSystem(const std::string& filesystem_id);
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<MTPDeviceMapService>;
+  friend struct base::LazyInstanceTraitsBase<MTPDeviceMapService>;
 
   // Adds the MTP device delegate to the map service. |device_location|
   // specifies the mount location of the MTP device.
diff --git a/chrome/browser/media_galleries/fileapi/supported_audio_video_checker.cc b/chrome/browser/media_galleries/fileapi/supported_audio_video_checker.cc
index 2dc8a51..6e3634b 100644
--- a/chrome/browser/media_galleries/fileapi/supported_audio_video_checker.cc
+++ b/chrome/browser/media_galleries/fileapi/supported_audio_video_checker.cc
@@ -37,7 +37,7 @@
             base::FilePath::kExtensionSeparator + extensions[i]);
       }
     }
-  };
+  }
 
   bool HasSupportedAudioVideoExtension(const base::FilePath& file) {
     return base::ContainsKey(audio_video_extensions_, file.Extension());
@@ -49,8 +49,8 @@
   DISALLOW_COPY_AND_ASSIGN(SupportedAudioVideoExtensions);
 };
 
-base::LazyInstance<SupportedAudioVideoExtensions> g_audio_video_extensions =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<SupportedAudioVideoExtensions>::DestructorAtExit
+    g_audio_video_extensions = LAZY_INSTANCE_INITIALIZER;
 
 base::File OpenOnFileThread(const base::FilePath& path) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::FILE);
diff --git a/chrome/browser/media_galleries/imported_media_gallery_registry.h b/chrome/browser/media_galleries/imported_media_gallery_registry.h
index 325cbf0..b75c0dd 100644
--- a/chrome/browser/media_galleries/imported_media_gallery_registry.h
+++ b/chrome/browser/media_galleries/imported_media_gallery_registry.h
@@ -55,7 +55,7 @@
 #endif  // defined(OS_WIN) || defined(OS_MACOSX)
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<ImportedMediaGalleryRegistry>;
+  friend struct base::LazyInstanceTraitsBase<ImportedMediaGalleryRegistry>;
   friend class itunes::ITunesDataProviderTest;
   friend class picasa::PicasaDataProviderTest;
 
diff --git a/chrome/browser/media_galleries/win/portable_device_map_service.cc b/chrome/browser/media_galleries/win/portable_device_map_service.cc
index 6bbf45ba..a2012ffc 100644
--- a/chrome/browser/media_galleries/win/portable_device_map_service.cc
+++ b/chrome/browser/media_galleries/win/portable_device_map_service.cc
@@ -11,8 +11,8 @@
 
 namespace {
 
-base::LazyInstance<PortableDeviceMapService> g_portable_device_map_service =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<PortableDeviceMapService>::DestructorAtExit
+    g_portable_device_map_service = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/chrome/browser/media_galleries/win/portable_device_map_service.h b/chrome/browser/media_galleries/win/portable_device_map_service.h
index 0a7c44f..9ed6a1a 100644
--- a/chrome/browser/media_galleries/win/portable_device_map_service.h
+++ b/chrome/browser/media_galleries/win/portable_device_map_service.h
@@ -48,7 +48,7 @@
   IPortableDevice* GetPortableDevice(const base::string16& device_location);
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<PortableDeviceMapService>;
+  friend struct base::LazyInstanceTraitsBase<PortableDeviceMapService>;
 
   struct PortableDeviceInfo {
     PortableDeviceInfo();  // Necessary for STL.
diff --git a/chrome/browser/net/sth_distributor_provider.cc b/chrome/browser/net/sth_distributor_provider.cc
index 97a109e..ae09fbe 100644
--- a/chrome/browser/net/sth_distributor_provider.cc
+++ b/chrome/browser/net/sth_distributor_provider.cc
@@ -10,7 +10,7 @@
 namespace chrome_browser_net {
 
 namespace {
-base::LazyInstance<std::unique_ptr<net::ct::STHDistributor>>
+base::LazyInstance<std::unique_ptr<net::ct::STHDistributor>>::DestructorAtExit
     global_sth_distributor = LAZY_INSTANCE_INITIALIZER;
 }  // namespace
 
diff --git a/chrome/browser/performance_monitor/performance_monitor.cc b/chrome/browser/performance_monitor/performance_monitor.cc
index 6c26e4a9..d360c68 100644
--- a/chrome/browser/performance_monitor/performance_monitor.cc
+++ b/chrome/browser/performance_monitor/performance_monitor.cc
@@ -35,7 +35,8 @@
 // collections.
 const int kGatherIntervalInSeconds = 120;
 
-base::LazyInstance<PerformanceMonitor> g_monitor = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<PerformanceMonitor>::DestructorAtExit g_monitor =
+    LAZY_INSTANCE_INITIALIZER;
 
 void GatherMetricsForRenderProcess(content::RenderProcessHost* host,
                                    ProcessMetricsMetadata* data) {
diff --git a/chrome/browser/performance_monitor/performance_monitor.h b/chrome/browser/performance_monitor/performance_monitor.h
index 2c09b93f..2ac6c37 100644
--- a/chrome/browser/performance_monitor/performance_monitor.h
+++ b/chrome/browser/performance_monitor/performance_monitor.h
@@ -32,7 +32,7 @@
   void StartGatherCycle();
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<PerformanceMonitor>;
+  friend struct base::LazyInstanceTraitsBase<PerformanceMonitor>;
 
   using MetricsMap =
       std::map<base::ProcessHandle, std::unique_ptr<ProcessMetricsHistory>>;
diff --git a/chrome/browser/previews/previews_service_factory.cc b/chrome/browser/previews/previews_service_factory.cc
index 791aa5a19..7f37f82c 100644
--- a/chrome/browser/previews/previews_service_factory.cc
+++ b/chrome/browser/previews/previews_service_factory.cc
@@ -11,8 +11,8 @@
 
 namespace {
 
-base::LazyInstance<PreviewsServiceFactory> g_previews_factory =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<PreviewsServiceFactory>::DestructorAtExit
+    g_previews_factory = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/chrome/browser/previews/previews_service_factory.h b/chrome/browser/previews/previews_service_factory.h
index 48828a6..b57b5df 100644
--- a/chrome/browser/previews/previews_service_factory.h
+++ b/chrome/browser/previews/previews_service_factory.h
@@ -27,7 +27,7 @@
   static PreviewsServiceFactory* GetInstance();
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<PreviewsServiceFactory>;
+  friend struct base::LazyInstanceTraitsBase<PreviewsServiceFactory>;
 
   PreviewsServiceFactory();
   ~PreviewsServiceFactory() override;
diff --git a/chrome/browser/printing/print_view_manager.cc b/chrome/browser/printing/print_view_manager.cc
index ea49f9b..5f6053ac 100644
--- a/chrome/browser/printing/print_view_manager.cc
+++ b/chrome/browser/printing/print_view_manager.cc
@@ -31,8 +31,9 @@
 
 // Keeps track of pending scripted print preview closures.
 // No locking, only access on the UI thread.
-base::LazyInstance<std::map<content::RenderProcessHost*, base::Closure>>
-    g_scripted_print_preview_closure_map = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<std::map<content::RenderProcessHost*, base::Closure>>::
+    DestructorAtExit g_scripted_print_preview_closure_map =
+        LAZY_INSTANCE_INITIALIZER;
 
 void EnableInternalPDFPluginForContents(int render_process_id,
                                         int render_frame_id) {
diff --git a/chrome/browser/resources/chromeos/login/oobe_screen_network.js b/chrome/browser/resources/chromeos/login/oobe_screen_network.js
index 9291982e..b5f2ebe 100644
--- a/chrome/browser/resources/chromeos/login/oobe_screen_network.js
+++ b/chrome/browser/resources/chromeos/login/oobe_screen_network.js
@@ -72,6 +72,8 @@
       this.context.addObserver(
           CONTEXT_KEY_INPUT_METHOD,
           function(inputMethodId) {
+            $('oobe-welcome-md').setSelectedKeyboard(inputMethodId);
+
             option = $('keyboard-select').querySelector(
                 'option[value="' + inputMethodId + '"]');
             if (option)
diff --git a/chrome/browser/resources/chromeos/login/oobe_welcome.js b/chrome/browser/resources/chromeos/login/oobe_welcome.js
index 68a45a1..0c69451 100644
--- a/chrome/browser/resources/chromeos/login/oobe_welcome.js
+++ b/chrome/browser/resources/chromeos/login/oobe_welcome.js
@@ -404,6 +404,24 @@
     this.currentLanguage = Oobe.getSelectedTitle(this.languages);
   },
 
+  setSelectedKeyboard: function(keyboard_id) {
+    var found = false;
+    for (var i = 0; i < this.keyboards.length; ++i) {
+      if (this.keyboards[i].value != keyboard_id) {
+        this.keyboards[i].selected = false;
+        continue;
+      }
+      this.keyboards[i].selected = true;
+      found = true;
+    }
+    if (!found)
+      return;
+
+    // Force i18n-dropdown to refresh.
+    this.keyboards = this.keyboards.slice();
+    this.onKeyboardsChanged_();
+  },
+
   onKeyboardsChanged_: function() {
     this.currentKeyboard = Oobe.getSelectedTitle(this.keyboards);
   },
diff --git a/chrome/browser/resources/local_ntp/most_visited_util.js b/chrome/browser/resources/local_ntp/most_visited_util.js
index 5620d5f..d7dc58d8 100644
--- a/chrome/browser/resources/local_ntp/most_visited_util.js
+++ b/chrome/browser/resources/local_ntp/most_visited_util.js
@@ -7,10 +7,24 @@
  * @fileoverview Utilities for rendering most visited thumbnails and titles.
  */
 
+// Don't remove; see crbug.com/678778.
 // <include src="instant_iframe_validation.js">
 
 
 /**
+  * The different types of events that are logged from the NTP. The multi-iframe
+  * version of the NTP does *not* actually log any statistics anymore; this is
+  * only required as a workaround for crbug.com/698675.
+  * Note: Keep in sync with common/ntp_logging_events.h
+  * @enum {number}
+  * @const
+  */
+var NTP_LOGGING_EVENT_TYPE = {
+  NTP_ALL_TILES_RECEIVED: 12,
+};
+
+
+/**
  * The origin of this request.
  * @const {string}
  */
@@ -212,6 +226,11 @@
     };
   } else {
     var apiHandle = chrome.embeddedSearch.newTabPage;
+    // Note: This does not actually result in any logging; it's a workaround for
+    // crbug.com/698675. It effectively sets the "instant support" state of the
+    // tab to true, which makes later calls to fetch the most visited items
+    // succeed.
+    apiHandle.logEvent(NTP_LOGGING_EVENT_TYPE.NTP_ALL_TILES_RECEIVED);
     data = apiHandle.getMostVisitedItemData(params.rid);
     if (!data)
       return;
diff --git a/chrome/browser/resources_util.cc b/chrome/browser/resources_util.cc
index e2ef783..7dd7f4b 100644
--- a/chrome/browser/resources_util.cc
+++ b/chrome/browser/resources_util.cc
@@ -54,7 +54,8 @@
   StringIntMap id_map_;
 };
 
-static base::LazyInstance<ThemeMap> g_theme_ids = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<ThemeMap>::DestructorAtExit g_theme_ids =
+    LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/chrome/browser/safe_browsing/safe_browsing_blocking_page.cc b/chrome/browser/safe_browsing/safe_browsing_blocking_page.cc
index 2b9c9b0..06d026c4 100644
--- a/chrome/browser/safe_browsing/safe_browsing_blocking_page.cc
+++ b/chrome/browser/safe_browsing/safe_browsing_blocking_page.cc
@@ -79,7 +79,7 @@
   }
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<
+  friend struct base::LazyInstanceTraitsBase<
       SafeBrowsingBlockingPageFactoryImpl>;
 
   SafeBrowsingBlockingPageFactoryImpl() { }
@@ -87,7 +87,7 @@
   DISALLOW_COPY_AND_ASSIGN(SafeBrowsingBlockingPageFactoryImpl);
 };
 
-static base::LazyInstance<SafeBrowsingBlockingPageFactoryImpl>
+static base::LazyInstance<SafeBrowsingBlockingPageFactoryImpl>::DestructorAtExit
     g_safe_browsing_blocking_page_factory_impl = LAZY_INSTANCE_INITIALIZER;
 
 // static
diff --git a/chrome/browser/safe_browsing/safe_browsing_service.cc b/chrome/browser/safe_browsing/safe_browsing_service.cc
index bdb079d9..230d62ec 100644
--- a/chrome/browser/safe_browsing/safe_browsing_service.cc
+++ b/chrome/browser/safe_browsing/safe_browsing_service.cc
@@ -262,7 +262,7 @@
   }
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<SafeBrowsingServiceFactoryImpl>;
+  friend struct base::LazyInstanceTraitsBase<SafeBrowsingServiceFactoryImpl>;
 
   SafeBrowsingServiceFactoryImpl() { }
 
diff --git a/chrome/browser/safe_browsing/threat_details.cc b/chrome/browser/safe_browsing/threat_details.cc
index 2c5d919a..6549a63 100644
--- a/chrome/browser/safe_browsing/threat_details.cc
+++ b/chrome/browser/safe_browsing/threat_details.cc
@@ -48,11 +48,12 @@
 // A set of HTTPS headers that are allowed to be collected. Contains both
 // request and response headers. All entries in this list should be lower-case
 // to support case-insensitive comparison.
-struct WhitelistedHttpsHeadersTraits :
-    base::DefaultLazyInstanceTraits<StringSet> {
+struct WhitelistedHttpsHeadersTraits
+    : base::internal::DestructorAtExitLazyInstanceTraits<StringSet> {
   static StringSet* New(void* instance) {
-    StringSet* headers = base::DefaultLazyInstanceTraits<StringSet>::New(
-        instance);
+    StringSet* headers =
+        base::internal::DestructorAtExitLazyInstanceTraits<StringSet>::New(
+            instance);
     headers->insert({"google-creative-id", "google-lineitem-id", "referer",
         "content-type", "content-length", "date", "server", "cache-control",
         "pragma", "expires"});
@@ -144,14 +145,14 @@
   }
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<ThreatDetailsFactoryImpl>;
+  friend struct base::LazyInstanceTraitsBase<ThreatDetailsFactoryImpl>;
 
   ThreatDetailsFactoryImpl() {}
 
   DISALLOW_COPY_AND_ASSIGN(ThreatDetailsFactoryImpl);
 };
 
-static base::LazyInstance<ThreatDetailsFactoryImpl>
+static base::LazyInstance<ThreatDetailsFactoryImpl>::DestructorAtExit
     g_threat_details_factory_impl = LAZY_INSTANCE_INITIALIZER;
 
 // Create a ThreatDetails for the given tab.
diff --git a/chrome/browser/shell_integration_win.cc b/chrome/browser/shell_integration_win.cc
index bb6f9fc8..f49f0fd 100644
--- a/chrome/browser/shell_integration_win.cc
+++ b/chrome/browser/shell_integration_win.cc
@@ -47,6 +47,7 @@
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/shell_handler_win.mojom.h"
 #include "chrome/grit/generated_resources.h"
+#include "chrome/install_static/install_util.h"
 #include "chrome/installer/setup/setup_util.h"
 #include "chrome/installer/util/browser_distribution.h"
 #include "chrome/installer/util/create_reg_key_work_item.h"
@@ -106,8 +107,7 @@
 
 base::string16 GetAppListAppName() {
   static const base::char16 kAppListAppNameSuffix[] = L"AppList";
-  BrowserDistribution* dist = BrowserDistribution::GetDistribution();
-  base::string16 app_name(dist->GetBaseAppId());
+  base::string16 app_name(install_static::GetBaseAppId());
   app_name.append(kAppListAppNameSuffix);
   return app_name;
 }
@@ -147,8 +147,7 @@
   } else if (command_line.HasSwitch(switches::kShowAppList)) {
     app_name = GetAppListAppName();
   } else {
-    BrowserDistribution* dist = BrowserDistribution::GetDistribution();
-    app_name = ShellUtil::GetBrowserModelId(dist, is_per_user_install);
+    app_name = ShellUtil::GetBrowserModelId(is_per_user_install);
   }
   DCHECK(!app_name.empty());
 
@@ -730,9 +729,8 @@
 
 base::string16 GetChromiumModelIdForProfile(
     const base::FilePath& profile_path) {
-  BrowserDistribution* dist = BrowserDistribution::GetDistribution();
   return GetAppModelIdForProfile(
-      ShellUtil::GetBrowserModelId(dist, InstallUtil::IsPerUserInstall()),
+      ShellUtil::GetBrowserModelId(InstallUtil::IsPerUserInstall()),
       profile_path);
 }
 
@@ -833,9 +831,8 @@
     // Clear dual_mode property from any shortcuts that previously had it (it
     // was only ever installed on shortcuts with the
     // |default_chromium_model_id|).
-    BrowserDistribution* dist = BrowserDistribution::GetDistribution();
     base::string16 default_chromium_model_id(
-        ShellUtil::GetBrowserModelId(dist, is_per_user_install));
+        ShellUtil::GetBrowserModelId(is_per_user_install));
     if (expected_app_id == default_chromium_model_id) {
       propvariant.Reset();
       if (property_store->GetValue(PKEY_AppUserModel_IsDualMode,
diff --git a/chrome/browser/shell_integration_win_unittest.cc b/chrome/browser/shell_integration_win_unittest.cc
index 4b1060e..7276263 100644
--- a/chrome/browser/shell_integration_win_unittest.cc
+++ b/chrome/browser/shell_integration_win_unittest.cc
@@ -21,7 +21,7 @@
 #include "chrome/browser/web_applications/web_app.h"
 #include "chrome/common/chrome_constants.h"
 #include "chrome/common/chrome_paths_internal.h"
-#include "chrome/installer/util/browser_distribution.h"
+#include "chrome/install_static/install_util.h"
 #include "chrome/installer/util/install_util.h"
 #include "chrome/installer/util/shell_util.h"
 #include "chrome/installer/util/util_constants.h"
@@ -50,9 +50,7 @@
     // This doesn't need to actually have a base name of "chrome.exe".
     base::CreateTemporaryFileInDir(temp_dir_.GetPath(), &chrome_exe_);
 
-    chrome_app_id_ =
-        ShellUtil::GetBrowserModelId(BrowserDistribution::GetDistribution(),
-                                     true);
+    chrome_app_id_ = ShellUtil::GetBrowserModelId(true);
 
     base::FilePath default_user_data_dir;
     chrome::GetDefaultUserDataDirectory(&default_user_data_dir);
@@ -294,8 +292,7 @@
 }
 
 TEST(ShellIntegrationWinTest, GetAppModelIdForProfileTest) {
-  const base::string16 base_app_id(
-      BrowserDistribution::GetDistribution()->GetBaseAppId());
+  const base::string16 base_app_id(install_static::GetBaseAppId());
 
   // Empty profile path should get chrome::kBrowserAppID
   base::FilePath empty_path;
diff --git a/chrome/browser/speech/extension_api/tts_extension_api.cc b/chrome/browser/speech/extension_api/tts_extension_api.cc
index 567a253..26160e97 100644
--- a/chrome/browser/speech/extension_api/tts_extension_api.cc
+++ b/chrome/browser/speech/extension_api/tts_extension_api.cc
@@ -367,7 +367,8 @@
 TtsAPI::~TtsAPI() {
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<TtsAPI> > g_factory =
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<TtsAPI>>::DestructorAtExit g_factory =
     LAZY_INSTANCE_INITIALIZER;
 
 BrowserContextKeyedAPIFactory<TtsAPI>* TtsAPI::GetFactoryInstance() {
diff --git a/chrome/browser/sync_file_system/logger.cc b/chrome/browser/sync_file_system/logger.cc
index 89b39e1..6d6d980 100644
--- a/chrome/browser/sync_file_system/logger.cc
+++ b/chrome/browser/sync_file_system/logger.cc
@@ -14,7 +14,7 @@
 namespace util {
 namespace {
 
-static base::LazyInstance<drive::EventLogger> g_logger =
+static base::LazyInstance<drive::EventLogger>::DestructorAtExit g_logger =
     LAZY_INSTANCE_INITIALIZER;
 
 const char* LogSeverityToString(logging::LogSeverity level) {
diff --git a/chrome/browser/task_manager/sampling/task_manager_impl.cc b/chrome/browser/task_manager/sampling/task_manager_impl.cc
index 846ee2a..afd1ca1 100644
--- a/chrome/browser/task_manager/sampling/task_manager_impl.cc
+++ b/chrome/browser/task_manager/sampling/task_manager_impl.cc
@@ -39,8 +39,8 @@
       blocking_pool->GetSequenceToken());
 }
 
-base::LazyInstance<TaskManagerImpl> lazy_task_manager_instance =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<TaskManagerImpl>::DestructorAtExit
+    lazy_task_manager_instance = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/chrome/browser/task_manager/sampling/task_manager_impl.h b/chrome/browser/task_manager/sampling/task_manager_impl.h
index 982bebc..5f9ec31 100644
--- a/chrome/browser/task_manager/sampling/task_manager_impl.h
+++ b/chrome/browser/task_manager/sampling/task_manager_impl.h
@@ -106,7 +106,7 @@
   static void OnMultipleBytesReadUI(std::vector<BytesReadParam>* params);
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<TaskManagerImpl>;
+  friend struct base::LazyInstanceTraitsBase<TaskManagerImpl>;
 
   TaskManagerImpl();
 
diff --git a/chrome/browser/ui/app_list/arc/arc_app_icon.cc b/chrome/browser/ui/app_list/arc/arc_app_icon.cc
index 7a96143..f888755 100644
--- a/chrome/browser/ui/app_list/arc/arc_app_icon.cc
+++ b/chrome/browser/ui/app_list/arc/arc_app_icon.cc
@@ -107,14 +107,15 @@
 
   // A map from a pair of a resource ID and size in DIP to an image. This
   // is a cache to avoid resizing IDR icons in GetImageForScale every time.
-  static base::LazyInstance<std::map<std::pair<int, int>, gfx::ImageSkia>>
-      default_icons_cache_;
+  static base::LazyInstance<std::map<std::pair<int, int>, gfx::ImageSkia>>::
+      DestructorAtExit default_icons_cache_;
 
   DISALLOW_COPY_AND_ASSIGN(Source);
 };
 
-base::LazyInstance<std::map<std::pair<int, int>, gfx::ImageSkia>>
-    ArcAppIcon::Source::default_icons_cache_ = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<std::map<std::pair<int, int>, gfx::ImageSkia>>::
+    DestructorAtExit ArcAppIcon::Source::default_icons_cache_ =
+        LAZY_INSTANCE_INITIALIZER;
 
 ArcAppIcon::Source::Source(const base::WeakPtr<ArcAppIcon>& host,
                            int resource_size_in_dip)
diff --git a/chrome/browser/ui/extensions/extension_message_bubble_factory.cc b/chrome/browser/ui/extensions/extension_message_bubble_factory.cc
index 384fcae6..39ee156 100644
--- a/chrome/browser/ui/extensions/extension_message_bubble_factory.cc
+++ b/chrome/browser/ui/extensions/extension_message_bubble_factory.cc
@@ -29,7 +29,7 @@
 // A map of all profiles evaluated, so we can tell if it's the initial check.
 // TODO(devlin): It would be nice to coalesce all the "profiles evaluated" maps
 // that are in the different bubble controllers.
-base::LazyInstance<std::set<Profile*> > g_profiles_evaluated =
+base::LazyInstance<std::set<Profile*>>::DestructorAtExit g_profiles_evaluated =
     LAZY_INSTANCE_INITIALIZER;
 
 // This is used to turn on override whether bubbles are enabled or disabled for
diff --git a/chrome/browser/ui/startup/startup_browser_creator.cc b/chrome/browser/ui/startup/startup_browser_creator.cc
index 10b6bbc..0efc97a3 100644
--- a/chrome/browser/ui/startup/startup_browser_creator.cc
+++ b/chrome/browser/ui/startup/startup_browser_creator.cc
@@ -248,8 +248,8 @@
   DISALLOW_COPY_AND_ASSIGN(ProfileLaunchObserver);
 };
 
-base::LazyInstance<ProfileLaunchObserver> profile_launch_observer =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<ProfileLaunchObserver>::DestructorAtExit
+    profile_launch_observer = LAZY_INSTANCE_INITIALIZER;
 
 // Dumps the current set of the browser process's histograms to |output_file|.
 // The file is overwritten if it exists. This function should only be called in
diff --git a/chrome/browser/ui/views/harmony/harmony_layout_delegate.cc b/chrome/browser/ui/views/harmony/harmony_layout_delegate.cc
index 7dd09f9..dafc261 100644
--- a/chrome/browser/ui/views/harmony/harmony_layout_delegate.cc
+++ b/chrome/browser/ui/views/harmony/harmony_layout_delegate.cc
@@ -7,8 +7,8 @@
 #include "base/lazy_instance.h"
 #include "base/logging.h"
 
-static base::LazyInstance<HarmonyLayoutDelegate> harmony_layout_delegate_ =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<HarmonyLayoutDelegate>::DestructorAtExit
+    harmony_layout_delegate_ = LAZY_INSTANCE_INITIALIZER;
 
 // static
 HarmonyLayoutDelegate* HarmonyLayoutDelegate::Get() {
diff --git a/chrome/browser/ui/views/harmony/layout_delegate.cc b/chrome/browser/ui/views/harmony/layout_delegate.cc
index b73ff113..4ecca84 100644
--- a/chrome/browser/ui/views/harmony/layout_delegate.cc
+++ b/chrome/browser/ui/views/harmony/layout_delegate.cc
@@ -10,7 +10,7 @@
 #include "ui/base/material_design/material_design_controller.h"
 #include "ui/views/layout/layout_constants.h"
 
-static base::LazyInstance<LayoutDelegate> layout_delegate_ =
+static base::LazyInstance<LayoutDelegate>::DestructorAtExit layout_delegate_ =
     LAZY_INSTANCE_INITIALIZER;
 
 // static
diff --git a/chrome/browser/ui/views/omnibox/omnibox_popup_contents_view.cc b/chrome/browser/ui/views/omnibox/omnibox_popup_contents_view.cc
index 8d41cdd..1d487dd4 100644
--- a/chrome/browser/ui/views/omnibox/omnibox_popup_contents_view.cc
+++ b/chrome/browser/ui/views/omnibox/omnibox_popup_contents_view.cc
@@ -34,8 +34,10 @@
 
 // Cache the shadow images so that potentially expensive shadow drawing isn't
 // repeated.
-base::LazyInstance<gfx::ImageSkia> g_top_shadow = LAZY_INSTANCE_INITIALIZER;
-base::LazyInstance<gfx::ImageSkia> g_bottom_shadow = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<gfx::ImageSkia>::DestructorAtExit g_top_shadow =
+    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<gfx::ImageSkia>::DestructorAtExit g_bottom_shadow =
+    LAZY_INSTANCE_INITIALIZER;
 
 const int kPopupVerticalPadding = 4;
 
diff --git a/chrome/browser/ui/webui/print_preview/print_preview_handler.cc b/chrome/browser/ui/webui/print_preview/print_preview_handler.cc
index 862ade1055..f22ec21 100644
--- a/chrome/browser/ui/webui/print_preview/print_preview_handler.cc
+++ b/chrome/browser/ui/webui/print_preview/print_preview_handler.cc
@@ -436,8 +436,8 @@
   }
 }
 
-base::LazyInstance<printing::StickySettings> g_sticky_settings =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<printing::StickySettings>::DestructorAtExit
+    g_sticky_settings = LAZY_INSTANCE_INITIALIZER;
 
 printing::StickySettings* GetStickySettings() {
   return g_sticky_settings.Pointer();
diff --git a/chrome/browser/ui/webui/print_preview/print_preview_ui.cc b/chrome/browser/ui/webui/print_preview/print_preview_ui.cc
index 3a42194e..3df34d9d 100644
--- a/chrome/browser/ui/webui/print_preview/print_preview_ui.cc
+++ b/chrome/browser/ui/webui/print_preview/print_preview_ui.cc
@@ -107,13 +107,13 @@
 };
 
 // Written to on the UI thread, read from any thread.
-base::LazyInstance<PrintPreviewRequestIdMapWithLock>
+base::LazyInstance<PrintPreviewRequestIdMapWithLock>::DestructorAtExit
     g_print_preview_request_id_map = LAZY_INSTANCE_INITIALIZER;
 
 // PrintPreviewUI IDMap used to avoid exposing raw pointer addresses to WebUI.
 // Only accessed on the UI thread.
-base::LazyInstance<IDMap<PrintPreviewUI*>> g_print_preview_ui_id_map =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<IDMap<PrintPreviewUI*>>::DestructorAtExit
+    g_print_preview_ui_id_map = LAZY_INSTANCE_INITIALIZER;
 
 // PrintPreviewUI serves data for chrome://print requests.
 //
diff --git a/chrome/browser/update_client/chrome_update_query_params_delegate.cc b/chrome/browser/update_client/chrome_update_query_params_delegate.cc
index 74bfee0..0475535 100644
--- a/chrome/browser/update_client/chrome_update_query_params_delegate.cc
+++ b/chrome/browser/update_client/chrome_update_query_params_delegate.cc
@@ -12,8 +12,8 @@
 
 namespace {
 
-base::LazyInstance<ChromeUpdateQueryParamsDelegate> g_delegate =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<ChromeUpdateQueryParamsDelegate>::DestructorAtExit
+    g_delegate = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/chrome/browser/usb/usb_blocklist.h b/chrome/browser/usb/usb_blocklist.h
index 4a444f95..bc5a9159 100644
--- a/chrome/browser/usb/usb_blocklist.h
+++ b/chrome/browser/usb/usb_blocklist.h
@@ -66,7 +66,7 @@
 
  private:
   // friend LazyInstance to permit access to private constructor.
-  friend base::DefaultLazyInstanceTraits<UsbBlocklist>;
+  friend base::LazyInstanceTraitsBase<UsbBlocklist>;
 
   UsbBlocklist();
 
diff --git a/chrome/common/chrome_paths.cc b/chrome/common/chrome_paths.cc
index d33af32..0506aa8e 100644
--- a/chrome/common/chrome_paths.cc
+++ b/chrome/common/chrome_paths.cc
@@ -72,7 +72,7 @@
     "/run/imageloader/PepperFlashPlayer/libpepflashplayer.so");
 #endif  // defined(OS_CHROMEOS)
 
-static base::LazyInstance<base::FilePath>
+static base::LazyInstance<base::FilePath>::DestructorAtExit
     g_invalid_specified_user_data_dir = LAZY_INSTANCE_INITIALIZER;
 
 // Gets the path for internal plugins.
diff --git a/chrome/common/extensions/chrome_extensions_client.cc b/chrome/common/extensions/chrome_extensions_client.cc
index 7388b95e..ec7f902 100644
--- a/chrome/common/extensions/chrome_extensions_client.cc
+++ b/chrome/common/extensions/chrome_extensions_client.cc
@@ -94,7 +94,7 @@
 
 }  // namespace
 
-static base::LazyInstance<ChromeExtensionsClient> g_client =
+static base::LazyInstance<ChromeExtensionsClient>::DestructorAtExit g_client =
     LAZY_INSTANCE_INITIALIZER;
 
 ChromeExtensionsClient::ChromeExtensionsClient() {}
diff --git a/chrome/common/extensions/chrome_extensions_client.h b/chrome/common/extensions/chrome_extensions_client.h
index 0610aee2..ff3195b 100644
--- a/chrome/common/extensions/chrome_extensions_client.h
+++ b/chrome/common/extensions/chrome_extensions_client.h
@@ -72,7 +72,7 @@
   mutable GURL webstore_base_url_;
   mutable GURL webstore_update_url_;
 
-  friend struct base::DefaultLazyInstanceTraits<ChromeExtensionsClient>;
+  friend struct base::LazyInstanceTraitsBase<ChromeExtensionsClient>;
 
   DISALLOW_COPY_AND_ASSIGN(ChromeExtensionsClient);
 };
diff --git a/chrome/common/extensions/chrome_manifest_url_handlers.cc b/chrome/common/extensions/chrome_manifest_url_handlers.cc
index 96246f53..cb6a0e9 100644
--- a/chrome/common/extensions/chrome_manifest_url_handlers.cc
+++ b/chrome/common/extensions/chrome_manifest_url_handlers.cc
@@ -51,8 +51,8 @@
 URLOverrides::~URLOverrides() {
 }
 
-static base::LazyInstance<URLOverrides::URLOverrideMap> g_empty_url_overrides =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<URLOverrides::URLOverrideMap>::DestructorAtExit
+    g_empty_url_overrides = LAZY_INSTANCE_INITIALIZER;
 
 // static
 const URLOverrides::URLOverrideMap& URLOverrides::GetChromeURLOverrides(
diff --git a/chrome/common/extensions/manifest_handlers/app_icon_color_info.cc b/chrome/common/extensions/manifest_handlers/app_icon_color_info.cc
index a03a5db21..5d87013 100644
--- a/chrome/common/extensions/manifest_handlers/app_icon_color_info.cc
+++ b/chrome/common/extensions/manifest_handlers/app_icon_color_info.cc
@@ -20,8 +20,8 @@
 
 namespace {
 
-static base::LazyInstance<AppIconColorInfo> g_empty_app_icon_color_info =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<AppIconColorInfo>::DestructorAtExit
+    g_empty_app_icon_color_info = LAZY_INSTANCE_INITIALIZER;
 
 const AppIconColorInfo& GetInfo(const Extension* extension) {
   AppIconColorInfo* info = static_cast<AppIconColorInfo*>(
diff --git a/chrome/common/extensions/manifest_handlers/app_launch_info.cc b/chrome/common/extensions/manifest_handlers/app_launch_info.cc
index 8f1316f8..6506824 100644
--- a/chrome/common/extensions/manifest_handlers/app_launch_info.cc
+++ b/chrome/common/extensions/manifest_handlers/app_launch_info.cc
@@ -51,8 +51,8 @@
   return true;
 }
 
-static base::LazyInstance<AppLaunchInfo> g_empty_app_launch_info =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<AppLaunchInfo>::DestructorAtExit
+    g_empty_app_launch_info = LAZY_INSTANCE_INITIALIZER;
 
 const AppLaunchInfo& GetAppLaunchInfo(const Extension* extension) {
   AppLaunchInfo* info = static_cast<AppLaunchInfo*>(
diff --git a/chrome/common/extensions/manifest_handlers/content_scripts_handler.cc b/chrome/common/extensions/manifest_handlers/content_scripts_handler.cc
index affae04..048cfc6 100644
--- a/chrome/common/extensions/manifest_handlers/content_scripts_handler.cc
+++ b/chrome/common/extensions/manifest_handlers/content_scripts_handler.cc
@@ -330,8 +330,8 @@
   UserScriptList user_script_list;
 };
 
-static base::LazyInstance<EmptyUserScriptList> g_empty_script_list =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<EmptyUserScriptList>::DestructorAtExit
+    g_empty_script_list = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/chrome/common/extensions/manifest_handlers/linked_app_icons.cc b/chrome/common/extensions/manifest_handlers/linked_app_icons.cc
index 5fcc5a7..744a2d16 100644
--- a/chrome/common/extensions/manifest_handlers/linked_app_icons.cc
+++ b/chrome/common/extensions/manifest_handlers/linked_app_icons.cc
@@ -19,8 +19,8 @@
 
 namespace {
 
-static base::LazyInstance<LinkedAppIcons> g_empty_linked_app_icons =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<LinkedAppIcons>::DestructorAtExit
+    g_empty_linked_app_icons = LAZY_INSTANCE_INITIALIZER;
 
 const LinkedAppIcons& GetInfo(const Extension* extension) {
   LinkedAppIcons* info = static_cast<LinkedAppIcons*>(
diff --git a/chrome/common/search/ntp_logging_events.h b/chrome/common/search/ntp_logging_events.h
index 5bf86af..ecfe613 100644
--- a/chrome/common/search/ntp_logging_events.h
+++ b/chrome/common/search/ntp_logging_events.h
@@ -29,8 +29,9 @@
   // The data for all NTP tiles (title, URL, etc, but not the thumbnail image)
   // has been received by the most visited iframe. In contrast to
   // NTP_ALL_TILES_LOADED, this is recorded before the actual DOM elements have
-  // loaded (in particular the thumbnail images). Logged only by the
-  // single-iframe version of the NTP.
+  // loaded (in particular the thumbnail images). Logged by the single-iframe
+  // version of the NTP, and also by the multi-iframe version, but only as a
+  // workaround for crbug.com/698675.
   NTP_ALL_TILES_RECEIVED = 12,
 
   NTP_EVENT_TYPE_LAST = NTP_ALL_TILES_RECEIVED
diff --git a/chrome/install_static/chromium_install_modes.cc b/chrome/install_static/chromium_install_modes.cc
index 87700b3f..997aa4b 100644
--- a/chrome/install_static/chromium_install_modes.cc
+++ b/chrome/install_static/chromium_install_modes.cc
@@ -32,6 +32,7 @@
         L"",  // Empty install_suffix for the primary install mode.
         L"",  // No logo suffix for the primary install mode.
         L"",  // Empty app_guid since no integraion with Google Update.
+        L"Chromium",  // A distinct base_app_id.
         L"",  // Empty default channel name as above.
         ChannelStrategy::UNSUPPORTED,
         true,  // Supports system-level installs.
diff --git a/chrome/install_static/google_chrome_install_modes.cc b/chrome/install_static/google_chrome_install_modes.cc
index 833a670..a4906845 100644
--- a/chrome/install_static/google_chrome_install_modes.cc
+++ b/chrome/install_static/google_chrome_install_modes.cc
@@ -32,6 +32,7 @@
         L"",  // Empty install_suffix for the primary install mode.
         L"",  // No logo suffix for the primary install mode.
         L"{8A69D345-D564-463c-AFF1-A69D9E530F96}",
+        L"Chrome",  // A distinct base_app_id.
         L"",  // The empty string means "stable".
         ChannelStrategy::ADDITIONAL_PARAMETERS,
         true,  // Supports system-level installs.
@@ -46,6 +47,7 @@
         L" SxS",
         L"Canary",
         L"{4ea16ac7-fd5a-47c3-875b-dbf4a2008c20}",
+        L"ChromeCanary",  // A distinct base_app_id.
         L"canary",
         ChannelStrategy::FIXED,
         false,  // Does not support system-level installs.
diff --git a/chrome/install_static/install_constants.h b/chrome/install_static/install_constants.h
index 802bf0c5..b5e4a86 100644
--- a/chrome/install_static/install_constants.h
+++ b/chrome/install_static/install_constants.h
@@ -59,6 +59,15 @@
   // empty string if the brand does not integrate with Google Update.
   const wchar_t* app_guid;
 
+  // The unsuffixed portion of the AppUserModelId. The AppUserModelId is used to
+  // group an app's windows together on the Windows taskbar along with its
+  // corresponding shortcuts; see
+  // https://msdn.microsoft.com/library/windows/desktop/dd378459.aspx for more
+  // information. Use ShellUtil::GetBrowserModelId to get the suffixed value --
+  // it is almost never correct to use the unsuffixed (base) portion of this id
+  // directly.
+  const wchar_t* base_app_id;
+
   // The default name for this mode's update channel.
   const wchar_t* default_channel_name;
 
diff --git a/chrome/install_static/install_details.h b/chrome/install_static/install_details.h
index c434804d..4d32ad4 100644
--- a/chrome/install_static/install_details.h
+++ b/chrome/install_static/install_details.h
@@ -95,6 +95,15 @@
   // empty string if this brand does not integrate with Google Update.
   const wchar_t* app_guid() const { return payload_->mode->app_guid; }
 
+  // Returns the unsuffixed portion of the AppUserModelId. The AppUserModelId is
+  // used to group an app's windows together on the Windows taskbar along with
+  // its corresponding shortcuts; see
+  // https://msdn.microsoft.com/library/windows/desktop/dd378459.aspx for more
+  // information. Use ShellUtil::GetBrowserModelId to get the suffixed value --
+  // it is almost never correct to use the unsuffixed (base) portion of this id
+  // directly.
+  const wchar_t* base_app_id() const { return payload_->mode->base_app_id; }
+
   // True if the mode supports installation at system-level.
   bool supports_system_level() const {
     return payload_->mode->supports_system_level;
diff --git a/chrome/install_static/install_util.cc b/chrome/install_static/install_util.cc
index 71f1ea8..9ff2bcd 100644
--- a/chrome/install_static/install_util.cc
+++ b/chrome/install_static/install_util.cc
@@ -320,6 +320,10 @@
   return InstallDetails::Get().app_guid();
 }
 
+const wchar_t* GetBaseAppId() {
+  return InstallDetails::Get().base_app_id();
+}
+
 bool GetCollectStatsConsent() {
   bool enabled = true;
 
diff --git a/chrome/install_static/install_util.h b/chrome/install_static/install_util.h
index b6f4081..a66554e5 100644
--- a/chrome/install_static/install_util.h
+++ b/chrome/install_static/install_util.h
@@ -71,6 +71,15 @@
 // a simple convenience wrapper around InstallDetails.
 const wchar_t* GetAppGuid();
 
+// Returns the unsuffixed portion of the AppUserModelId. The AppUserModelId is
+// used to group an app's windows together on the Windows taskbar along with its
+// corresponding shortcuts; see
+// https://msdn.microsoft.com/library/windows/desktop/dd378459.aspx for more
+// information. Use ShellUtil::GetBrowserModelId to get the suffixed value -- it
+// is almost never correct to use the unsuffixed (base) portion of this id
+// directly.
+const wchar_t* GetBaseAppId();
+
 // Returns true if usage stats collecting is enabled for this user for the
 // current executable.
 bool GetCollectStatsConsent();
diff --git a/chrome/install_static/install_util_unittest.cc b/chrome/install_static/install_util_unittest.cc
index fd7e9ec..324786a 100644
--- a/chrome/install_static/install_util_unittest.cc
+++ b/chrome/install_static/install_util_unittest.cc
@@ -392,7 +392,7 @@
   }
 
 #if defined(GOOGLE_CHROME_BUILD)
-  // The app guids for the brand's install modes; parallel to kInstalLModes.
+  // The app guids for the brand's install modes; parallel to kInstallModes.
   static constexpr const wchar_t* kAppGuids[] = {
       L"{8A69D345-D564-463c-AFF1-A69D9E530F96}",  // Google Chrome.
       L"{4EA16AC7-FD5A-47C3-875B-DBF4A2008C20}",  // Google Chrome SxS (Canary).
@@ -405,6 +405,23 @@
 #endif
 }
 
+TEST_P(InstallStaticUtilTest, GetBaseAppId) {
+#if defined(GOOGLE_CHROME_BUILD)
+  // The base app ids for the brand's install modes; parallel to kInstallModes.
+  static constexpr const wchar_t* kBaseAppIds[] = {
+      L"Chrome", L"ChromeCanary",
+  };
+#else
+  // The base app ids for the brand's install modes; parallel to kInstallModes.
+  static constexpr const wchar_t* kBaseAppIds[] = {
+      L"Chromium",
+  };
+#endif
+  static_assert(arraysize(kBaseAppIds) == NUM_INSTALL_MODES,
+                "kBaseAppIds out of date.");
+  EXPECT_THAT(GetBaseAppId(), StrCaseEq(kBaseAppIds[std::get<0>(GetParam())]));
+}
+
 TEST_P(InstallStaticUtilTest, UsageStatsAbsent) {
   EXPECT_FALSE(GetCollectStatsConsent());
 }
diff --git a/chrome/installer/setup/uninstall.cc b/chrome/installer/setup/uninstall.cc
index 604a1d3..d012207 100644
--- a/chrome/installer/setup/uninstall.cc
+++ b/chrome/installer/setup/uninstall.cc
@@ -651,7 +651,8 @@
   reg_app_id.push_back(base::FilePath::kSeparators[0]);
   // Append the requested suffix manually here (as ShellUtil::GetBrowserModelId
   // would otherwise try to figure out the currently installed suffix).
-  reg_app_id.append(dist->GetBaseAppId() + browser_entry_suffix);
+  DCHECK_EQ(BrowserDistribution::GetDistribution(), dist);
+  reg_app_id.append(install_static::GetBaseAppId() + browser_entry_suffix);
   InstallUtil::DeleteRegistryKey(root, reg_app_id, WorkItem::kWow64Default);
 
   // Delete all Start Menu Internet registrations that refer to this Chrome.
diff --git a/chrome/installer/util/browser_distribution.cc b/chrome/installer/util/browser_distribution.cc
index d9b8f65..d5ed7b2 100644
--- a/chrome/installer/util/browser_distribution.cc
+++ b/chrome/installer/util/browser_distribution.cc
@@ -144,10 +144,6 @@
   }
 }
 
-base::string16 BrowserDistribution::GetBaseAppId() {
-  return L"Chromium";
-}
-
 base::string16 BrowserDistribution::GetBrowserProgIdPrefix() {
   // This used to be "ChromiumHTML", but was forced to become "ChromiumHTM"
   // because of http://crbug.com/153349.  See the declaration of this function
diff --git a/chrome/installer/util/browser_distribution.h b/chrome/installer/util/browser_distribution.h
index e877e12..f3e0ce7e 100644
--- a/chrome/installer/util/browser_distribution.h
+++ b/chrome/installer/util/browser_distribution.h
@@ -80,12 +80,6 @@
   virtual base::string16 GetStartMenuShortcutSubfolder(
       Subfolder subfolder_type);
 
-  // Returns the unsuffixed appid of this program.
-  // The AppUserModelId is a property of Windows programs.
-  // IMPORTANT: This should only be called by ShellUtil::GetAppId as the appid
-  // should be suffixed in all scenarios.
-  virtual base::string16 GetBaseAppId();
-
   // Returns the Browser ProgId prefix (e.g. ChromeHTML, ChromiumHTM, etc...).
   // The full id is of the form |prefix|.|suffix| and is limited to a maximum
   // length of 39 characters including null-terminator.  See
diff --git a/chrome/installer/util/chrome_browser_operations.cc b/chrome/installer/util/chrome_browser_operations.cc
index 44bd2ec..32f66f5 100644
--- a/chrome/installer/util/chrome_browser_operations.cc
+++ b/chrome/installer/util/chrome_browser_operations.cc
@@ -38,8 +38,9 @@
     properties->set_icon(target_exe, dist->GetIconIndex());
 
   if (!properties->has_app_id()) {
+    DCHECK_EQ(BrowserDistribution::GetDistribution(), dist);
     properties->set_app_id(
-        ShellUtil::GetBrowserModelId(dist, InstallUtil::IsPerUserInstall()));
+        ShellUtil::GetBrowserModelId(InstallUtil::IsPerUserInstall()));
   }
 
   if (!properties->has_description())
diff --git a/chrome/installer/util/google_chrome_distribution.cc b/chrome/installer/util/google_chrome_distribution.cc
index 3134ba7..11d2af1 100644
--- a/chrome/installer/util/google_chrome_distribution.cc
+++ b/chrome/installer/util/google_chrome_distribution.cc
@@ -41,7 +41,6 @@
 namespace {
 
 const wchar_t kChromeGuid[] = L"{8A69D345-D564-463c-AFF1-A69D9E530F96}";
-const wchar_t kBrowserAppId[] = L"Chrome";
 const wchar_t kBrowserProgIdPrefix[] = L"ChromeHTML";
 const wchar_t kBrowserProgIdDesc[] = L"Chrome HTML Document";
 const wchar_t kCommandExecuteImplUuid[] =
@@ -166,10 +165,6 @@
   return icon_resources::kApplicationIndex;
 }
 
-base::string16 GoogleChromeDistribution::GetBaseAppId() {
-  return kBrowserAppId;
-}
-
 base::string16 GoogleChromeDistribution::GetBrowserProgIdPrefix() {
   return kBrowserProgIdPrefix;
 }
diff --git a/chrome/installer/util/google_chrome_distribution.h b/chrome/installer/util/google_chrome_distribution.h
index 3763ee1e..b84a6e59 100644
--- a/chrome/installer/util/google_chrome_distribution.h
+++ b/chrome/installer/util/google_chrome_distribution.h
@@ -45,8 +45,6 @@
 
   base::string16 GetBaseAppName() override;
 
-  base::string16 GetBaseAppId() override;
-
   base::string16 GetBrowserProgIdPrefix() override;
 
   base::string16 GetBrowserProgIdDesc() override;
diff --git a/chrome/installer/util/google_chrome_distribution_dummy.cc b/chrome/installer/util/google_chrome_distribution_dummy.cc
index 356784f..3e6eab3 100644
--- a/chrome/installer/util/google_chrome_distribution_dummy.cc
+++ b/chrome/installer/util/google_chrome_distribution_dummy.cc
@@ -52,10 +52,6 @@
   return 0;
 }
 
-base::string16 GoogleChromeDistribution::GetBaseAppId() {
-  return base::string16();
-}
-
 base::string16 GoogleChromeDistribution::GetBrowserProgIdPrefix() {
   return base::string16();
 }
diff --git a/chrome/installer/util/google_chrome_sxs_distribution.cc b/chrome/installer/util/google_chrome_sxs_distribution.cc
index 2646e6e..4a2186fc 100644
--- a/chrome/installer/util/google_chrome_sxs_distribution.cc
+++ b/chrome/installer/util/google_chrome_sxs_distribution.cc
@@ -15,7 +15,6 @@
 namespace {
 
 const wchar_t kChromeSxSGuid[] = L"{4ea16ac7-fd5a-47c3-875b-dbf4a2008c20}";
-const wchar_t kBrowserAppId[] = L"ChromeCanary";
 const wchar_t kBrowserProgIdPrefix[] = L"ChromeSSHTM";
 const wchar_t kBrowserProgIdDesc[] = L"Chrome Canary HTML Document";
 const wchar_t kCommandExecuteImplUuid[] =
@@ -47,10 +46,6 @@
   }
 }
 
-base::string16 GoogleChromeSxSDistribution::GetBaseAppId() {
-  return kBrowserAppId;
-}
-
 base::string16 GoogleChromeSxSDistribution::GetBrowserProgIdPrefix() {
   return kBrowserProgIdPrefix;
 }
diff --git a/chrome/installer/util/google_chrome_sxs_distribution.h b/chrome/installer/util/google_chrome_sxs_distribution.h
index 55ca0745..ea98696 100644
--- a/chrome/installer/util/google_chrome_sxs_distribution.h
+++ b/chrome/installer/util/google_chrome_sxs_distribution.h
@@ -24,7 +24,6 @@
   int GetIconIndex() override;
   base::string16 GetStartMenuShortcutSubfolder(
       Subfolder subfolder_type) override;
-  base::string16 GetBaseAppId() override;
   base::string16 GetBrowserProgIdPrefix() override;
   base::string16 GetBrowserProgIdDesc() override;
   base::string16 GetUninstallRegPath() override;
diff --git a/chrome/installer/util/master_preferences.cc b/chrome/installer/util/master_preferences.cc
index c48a4f4..fa01417 100644
--- a/chrome/installer/util/master_preferences.cc
+++ b/chrome/installer/util/master_preferences.cc
@@ -25,8 +25,8 @@
 
 const char kFirstRunTabs[] = "first_run_tabs";
 
-base::LazyInstance<installer::MasterPreferences> g_master_preferences =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<installer::MasterPreferences>::DestructorAtExit
+    g_master_preferences = LAZY_INSTANCE_INITIALIZER;
 
 bool GetURLFromValue(const base::Value* in_value, std::string* out_value) {
   return in_value && out_value && in_value->GetAsString(out_value);
diff --git a/chrome/installer/util/shell_util.cc b/chrome/installer/util/shell_util.cc
index e6023f9..335d1c2 100644
--- a/chrome/installer/util/shell_util.cc
+++ b/chrome/installer/util/shell_util.cc
@@ -46,6 +46,7 @@
 #include "base/win/windows_version.h"
 #include "chrome/common/chrome_constants.h"
 #include "chrome/common/chrome_switches.h"
+#include "chrome/install_static/install_util.h"
 #include "chrome/installer/util/beacons.h"
 #include "chrome/installer/util/browser_distribution.h"
 #include "chrome/installer/util/install_util.h"
@@ -360,8 +361,9 @@
   app_info.command_line = ShellUtil::GetChromeShellOpenCmd(chrome_exe);
   // For user-level installs: entries for the app id will be in HKCU; thus we
   // do not need a suffix on those entries.
+  DCHECK_EQ(BrowserDistribution::GetDistribution(), dist);
   app_info.app_id =
-      ShellUtil::GetBrowserModelId(dist, InstallUtil::IsPerUserInstall());
+      ShellUtil::GetBrowserModelId(InstallUtil::IsPerUserInstall());
 
   // TODO(grt): http://crbug.com/75152 Write a reference to a localized
   // resource for name, description, and company.
@@ -1000,7 +1002,7 @@
 
 // Cleans up an old verb (run) we used to register in
 // <root>\Software\Classes\Chrome<.suffix>\.exe\shell\run on Windows 8.
-void RemoveRunVerbOnWindows8(BrowserDistribution* dist) {
+void RemoveRunVerbOnWindows8() {
   if (base::win::GetVersion() >= base::win::VERSION_WIN8) {
     bool is_per_user_install = InstallUtil::IsPerUserInstall();
     HKEY root_key = DetermineRegistrationRoot(is_per_user_install);
@@ -1008,8 +1010,7 @@
     // remove the key from the registry.
     base::string16 run_verb_key(ShellUtil::kRegClasses);
     run_verb_key.push_back(base::FilePath::kSeparators[0]);
-    run_verb_key.append(ShellUtil::GetBrowserModelId(
-        dist, is_per_user_install));
+    run_verb_key.append(ShellUtil::GetBrowserModelId(is_per_user_install));
     run_verb_key.append(ShellUtil::kRegExePath);
     run_verb_key.append(ShellUtil::kRegShellPath);
     run_verb_key.push_back(base::FilePath::kSeparators[0]);
@@ -1130,9 +1131,7 @@
 
 // (Windows 8+) Finds and stores an app shortcuts folder path in *|path|.
 // Returns true on success.
-bool GetAppShortcutsFolder(BrowserDistribution* dist,
-                           ShellUtil::ShellChange level,
-                           base::FilePath *path) {
+bool GetAppShortcutsFolder(ShellUtil::ShellChange level, base::FilePath* path) {
   DCHECK(path);
   DCHECK_GE(base::win::GetVersion(), base::win::VERSION_WIN8);
 
@@ -1143,7 +1142,7 @@
   }
 
   folder = folder.Append(
-      ShellUtil::GetBrowserModelId(dist, level == ShellUtil::CURRENT_USER));
+      ShellUtil::GetBrowserModelId(level == ShellUtil::CURRENT_USER));
   if (!base::DirectoryExists(folder)) {
     VLOG(1) << "No start screen shortcuts.";
     return false;
@@ -1442,6 +1441,7 @@
                                 ShellChange level,
                                 base::FilePath* path) {
   DCHECK(path);
+  DCHECK_EQ(BrowserDistribution::GetDistribution(), dist);
   int dir_key = -1;
   base::string16 folder_to_append;
   switch (location) {
@@ -1475,7 +1475,7 @@
       break;
     case SHORTCUT_LOCATION_APP_SHORTCUTS:
       // TODO(huangs): Move GetAppShortcutsFolder() logic into base_paths_win.
-      return GetAppShortcutsFolder(dist, level, path);
+      return GetAppShortcutsFolder(level, path);
 
     default:
       NOTREACHED();
@@ -1706,9 +1706,8 @@
   return app_name;
 }
 
-base::string16 ShellUtil::GetBrowserModelId(BrowserDistribution* dist,
-                                            bool is_per_user_install) {
-  base::string16 app_id(dist->GetBaseAppId());
+base::string16 ShellUtil::GetBrowserModelId(bool is_per_user_install) {
+  base::string16 app_id(install_static::GetBaseAppId());
   base::string16 suffix;
 
   // TODO(robertshield): Temporary hack to make the kRegisterChromeBrowserSuffix
@@ -2052,6 +2051,7 @@
                                       const base::FilePath& chrome_exe,
                                       const base::string16& unique_suffix,
                                       bool elevate_if_not_admin) {
+  DCHECK_EQ(BrowserDistribution::GetDistribution(), dist);
   if (dist->GetDefaultBrowserControlPolicy() ==
       BrowserDistribution::DEFAULT_BROWSER_UNSUPPORTED) {
     return false;
@@ -2070,7 +2070,7 @@
     return false;
   }
 
-  RemoveRunVerbOnWindows8(dist);
+  RemoveRunVerbOnWindows8();
 
   bool user_level = InstallUtil::IsPerUserInstall();
   HKEY root = DetermineRegistrationRoot(user_level);
diff --git a/chrome/installer/util/shell_util.h b/chrome/installer/util/shell_util.h
index a07526a1..f1ff503 100644
--- a/chrome/installer/util/shell_util.h
+++ b/chrome/installer/util/shell_util.h
@@ -389,12 +389,11 @@
   static base::string16 GetApplicationName(BrowserDistribution* dist,
                                            const base::FilePath& chrome_exe);
 
-  // Returns the AppUserModelId for |dist|. This identifier is unconditionally
-  // suffixed with a unique id for this user on user-level installs (in contrast
-  // to other registration entries which are suffixed as described in
+  // Returns the AppUserModelId. This identifier is unconditionally suffixed
+  // with a unique id for this user on user-level installs (in contrast to other
+  // registration entries which are suffixed as described in
   // GetCurrentInstallationSuffix() above).
-  static base::string16 GetBrowserModelId(BrowserDistribution* dist,
-                                          bool is_per_user_install);
+  static base::string16 GetBrowserModelId(bool is_per_user_install);
 
   // Returns an AppUserModelId composed of each member of |components| separated
   // by dots.
diff --git a/chrome/installer/util/shell_util_unittest.cc b/chrome/installer/util/shell_util_unittest.cc
index 9294208..1697463 100644
--- a/chrome/installer/util/shell_util_unittest.cc
+++ b/chrome/installer/util/shell_util_unittest.cc
@@ -27,6 +27,7 @@
 #include "base/win/registry.h"
 #include "base/win/shortcut.h"
 #include "base/win/windows_version.h"
+#include "chrome/install_static/install_util.h"
 #include "chrome/installer/util/browser_distribution.h"
 #include "chrome/installer/util/product.h"
 #include "chrome/installer/util/util_constants.h"
@@ -181,7 +182,7 @@
       expected_properties.set_app_id(properties.app_id);
     } else {
       // Tests are always seen as user-level installs in ShellUtil.
-      expected_properties.set_app_id(ShellUtil::GetBrowserModelId(dist, true));
+      expected_properties.set_app_id(ShellUtil::GetBrowserModelId(true));
     }
 
     base::win::ValidateShortcut(expected_path, expected_properties);
@@ -938,16 +939,15 @@
 
 TEST(ShellUtilTest, BuildAppModelIdBasic) {
   std::vector<base::string16> components;
-  BrowserDistribution* dist = BrowserDistribution::GetDistribution();
-  const base::string16 base_app_id(dist->GetBaseAppId());
+  const base::string16 base_app_id(install_static::GetBaseAppId());
   components.push_back(base_app_id);
   ASSERT_EQ(base_app_id, ShellUtil::BuildAppModelId(components));
 }
 
 TEST(ShellUtilTest, BuildAppModelIdManySmall) {
   std::vector<base::string16> components;
-  BrowserDistribution* dist = BrowserDistribution::GetDistribution();
-  const base::string16 suffixed_app_id(dist->GetBaseAppId().append(L".gab"));
+  const base::string16 suffixed_app_id(install_static::GetBaseAppId() +
+                                       base::string16(L".gab"));
   components.push_back(suffixed_app_id);
   components.push_back(L"Default");
   components.push_back(L"Test");
diff --git a/chrome/renderer/autofill/password_generation_agent_browsertest.cc b/chrome/renderer/autofill/password_generation_agent_browsertest.cc
index 4f47109..4b2a2da 100644
--- a/chrome/renderer/autofill/password_generation_agent_browsertest.cc
+++ b/chrome/renderer/autofill/password_generation_agent_browsertest.cc
@@ -16,6 +16,7 @@
 #include "chrome/renderer/autofill/password_generation_test_utils.h"
 #include "chrome/test/base/chrome_render_view_test.h"
 #include "components/autofill/content/renderer/autofill_agent.h"
+#include "components/autofill/content/renderer/form_autofill_util.h"
 #include "components/autofill/content/renderer/test_password_generation_agent.h"
 #include "components/autofill/core/common/form_data.h"
 #include "components/autofill/core/common/password_generation_util.h"
@@ -723,4 +724,47 @@
                                    base::string16());
 }
 
+TEST_F(PasswordGenerationAgentTest, ConfirmationFieldVoteFromServer) {
+  LoadHTMLWithUserGesture(kPasswordChangeFormHTML);
+  SetNotBlacklistedMessage(password_generation_, kPasswordChangeFormHTML);
+
+  WebDocument document = GetMainFrame()->document();
+  blink::WebVector<blink::WebFormElement> web_forms;
+  document.forms(web_forms);
+  autofill::FormData form_data;
+  WebFormElementToFormData(web_forms[0], blink::WebFormControlElement(),
+                           nullptr, form_util::EXTRACT_NONE, &form_data,
+                           nullptr /* FormFieldData */);
+
+  std::vector<autofill::PasswordFormGenerationData> forms;
+  autofill::PasswordFormGenerationData generation_data(
+      CalculateFormSignature(form_data),
+      CalculateFieldSignatureForField(form_data.fields[1]));
+  generation_data.confirmation_field_signature.emplace(
+      CalculateFieldSignatureForField(form_data.fields[3]));
+  forms.push_back(generation_data);
+  password_generation_->FoundFormsEligibleForGeneration(forms);
+
+  WebElement element =
+      document.getElementById(WebString::fromUTF16(form_data.fields[1].name));
+  ASSERT_FALSE(element.isNull());
+  WebInputElement generation_element = element.to<WebInputElement>();
+  element =
+      document.getElementById(WebString::fromUTF16(form_data.fields[2].name));
+  ASSERT_FALSE(element.isNull());
+  WebInputElement ignored_password_element = element.to<WebInputElement>();
+  element =
+      document.getElementById(WebString::fromUTF16(form_data.fields[3].name));
+  ASSERT_FALSE(element.isNull());
+  WebInputElement confirmation_password_element = element.to<WebInputElement>();
+
+  base::string16 password = base::ASCIIToUTF16("random_password");
+  password_generation_->GeneratedPasswordAccepted(password);
+  EXPECT_EQ(password, generation_element.value().utf16());
+  // Check that the generated password was copied according to the server's
+  // response.
+  EXPECT_EQ(base::string16(), ignored_password_element.value().utf16());
+  EXPECT_EQ(password, confirmation_password_element.value().utf16());
+}
+
 }  // namespace autofill
diff --git a/chrome/renderer/media/cast_session_delegate.cc b/chrome/renderer/media/cast_session_delegate.cc
index 1216f2a..3b9f8eb 100644
--- a/chrome/renderer/media/cast_session_delegate.cc
+++ b/chrome/renderer/media/cast_session_delegate.cc
@@ -34,7 +34,7 @@
 using media::cast::CastSender;
 using media::cast::FrameSenderConfig;
 
-static base::LazyInstance<CastThreads> g_cast_threads =
+static base::LazyInstance<CastThreads>::DestructorAtExit g_cast_threads =
     LAZY_INSTANCE_INITIALIZER;
 
 CastSessionDelegateBase::CastSessionDelegateBase()
diff --git a/chrome/renderer/media/cast_threads.h b/chrome/renderer/media/cast_threads.h
index 63e2c85..ff9fd44 100644
--- a/chrome/renderer/media/cast_threads.h
+++ b/chrome/renderer/media/cast_threads.h
@@ -23,7 +23,7 @@
   scoped_refptr<base::SingleThreadTaskRunner> GetVideoEncodeTaskRunner();
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<CastThreads>;
+  friend struct base::LazyInstanceTraitsBase<CastThreads>;
 
   CastThreads();
 
diff --git a/chrome/renderer/pepper/pepper_flash_renderer_host.cc b/chrome/renderer/pepper/pepper_flash_renderer_host.cc
index 4a8e170..c1879ef 100644
--- a/chrome/renderer/pepper/pepper_flash_renderer_host.cc
+++ b/chrome/renderer/pepper/pepper_flash_renderer_host.cc
@@ -100,8 +100,8 @@
   FLASH_NAVIGATE_USAGE_ENUM_COUNT
 };
 
-static base::LazyInstance<std::map<std::string, FlashNavigateUsage> >
-    g_rejected_headers = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<std::map<std::string, FlashNavigateUsage>>::
+    DestructorAtExit g_rejected_headers = LAZY_INSTANCE_INITIALIZER;
 
 bool IsSimpleHeader(const std::string& lower_case_header_name,
                     const std::string& header_value) {
diff --git a/chrome/renderer/safe_browsing/phishing_classifier_delegate.cc b/chrome/renderer/safe_browsing/phishing_classifier_delegate.cc
index 704ff2e..258b878 100644
--- a/chrome/renderer/safe_browsing/phishing_classifier_delegate.cc
+++ b/chrome/renderer/safe_browsing/phishing_classifier_delegate.cc
@@ -39,11 +39,11 @@
 }
 
 typedef std::set<PhishingClassifierDelegate*> PhishingClassifierDelegates;
-static base::LazyInstance<PhishingClassifierDelegates>
+static base::LazyInstance<PhishingClassifierDelegates>::DestructorAtExit
     g_delegates = LAZY_INSTANCE_INITIALIZER;
 
-static base::LazyInstance<std::unique_ptr<const safe_browsing::Scorer>>
-    g_phishing_scorer = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<std::unique_ptr<const safe_browsing::Scorer>>::
+    DestructorAtExit g_phishing_scorer = LAZY_INSTANCE_INITIALIZER;
 
 // static
 PhishingClassifierFilter* PhishingClassifierFilter::Create() {
diff --git a/chrome/service/cloud_print/cloud_print_token_store.cc b/chrome/service/cloud_print/cloud_print_token_store.cc
index 1fb39b0..dd34e4f5 100644
--- a/chrome/service/cloud_print/cloud_print_token_store.cc
+++ b/chrome/service/cloud_print/cloud_print_token_store.cc
@@ -11,8 +11,9 @@
 
 // Keep the global CloudPrintTokenStore in a TLS slot so it is impossible to
 // incorrectly from the wrong thread.
-static base::LazyInstance<base::ThreadLocalPointer<CloudPrintTokenStore> >
-    lazy_tls = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    base::ThreadLocalPointer<CloudPrintTokenStore>>::DestructorAtExit lazy_tls =
+    LAZY_INSTANCE_INITIALIZER;
 
 CloudPrintTokenStore* CloudPrintTokenStore::current() {
   return lazy_tls.Pointer()->Get();
diff --git a/chrome/test/base/web_ui_browser_test.cc b/chrome/test/base/web_ui_browser_test.cc
index fd4e69d5..01486f6 100644
--- a/chrome/test/base/web_ui_browser_test.cc
+++ b/chrome/test/base/web_ui_browser_test.cc
@@ -50,7 +50,7 @@
 
 namespace {
 
-base::LazyInstance<std::vector<std::string> > error_messages_ =
+base::LazyInstance<std::vector<std::string>>::DestructorAtExit error_messages_ =
     LAZY_INSTANCE_INITIALIZER;
 
 // Intercepts all log messages.
@@ -365,7 +365,7 @@
   DISALLOW_COPY_AND_ASSIGN(MockWebUIProvider);
 };
 
-base::LazyInstance<MockWebUIProvider> mock_provider_ =
+base::LazyInstance<MockWebUIProvider>::DestructorAtExit mock_provider_ =
     LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
diff --git a/chrome/test/chromedriver/server/chromedriver_server.cc b/chrome/test/chromedriver/server/chromedriver_server.cc
index b89a1dc..d0ad7498 100644
--- a/chrome/test/chromedriver/server/chromedriver_server.cc
+++ b/chrome/test/chromedriver/server/chromedriver_server.cc
@@ -171,7 +171,7 @@
                                        send_response_func)));
 }
 
-base::LazyInstance<base::ThreadLocalPointer<HttpServer> >
+base::LazyInstance<base::ThreadLocalPointer<HttpServer>>::DestructorAtExit
     lazy_tls_server = LAZY_INSTANCE_INITIALIZER;
 
 void StopServerOnIOThread() {
diff --git a/chrome/test/chromedriver/session.cc b/chrome/test/chromedriver/session.cc
index 90dad58..2d4db3f 100644
--- a/chrome/test/chromedriver/session.cc
+++ b/chrome/test/chromedriver/session.cc
@@ -17,7 +17,7 @@
 
 namespace {
 
-base::LazyInstance<base::ThreadLocalPointer<Session> >
+base::LazyInstance<base::ThreadLocalPointer<Session>>::DestructorAtExit
     lazy_tls_session = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
diff --git a/chrome/test/logging/win/test_log_collector.cc b/chrome/test/logging/win/test_log_collector.cc
index 6df07384..ba564b7 100644
--- a/chrome/test/logging/win/test_log_collector.cc
+++ b/chrome/test/logging/win/test_log_collector.cc
@@ -149,7 +149,7 @@
   DISALLOW_COPY_AND_ASSIGN(TestLogCollector);
 };
 
-base::LazyInstance<TestLogCollector> g_test_log_collector =
+base::LazyInstance<TestLogCollector>::DestructorAtExit g_test_log_collector =
     LAZY_INSTANCE_INITIALIZER;
 
 // TestLogCollector::EventListener implementation
diff --git a/chromecast/base/chromecast_config_android.cc b/chromecast/base/chromecast_config_android.cc
index 8067664..c9a39167 100644
--- a/chromecast/base/chromecast_config_android.cc
+++ b/chromecast/base/chromecast_config_android.cc
@@ -15,7 +15,7 @@
 namespace android {
 
 namespace {
-base::LazyInstance<ChromecastConfigAndroid> g_instance =
+base::LazyInstance<ChromecastConfigAndroid>::DestructorAtExit g_instance =
     LAZY_INSTANCE_INITIALIZER;
 }  // namespace
 
diff --git a/chromecast/base/chromecast_config_android.h b/chromecast/base/chromecast_config_android.h
index 1d9082f..88c35365d 100644
--- a/chromecast/base/chromecast_config_android.h
+++ b/chromecast/base/chromecast_config_android.h
@@ -32,7 +32,7 @@
   }
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<ChromecastConfigAndroid>;
+  friend struct base::LazyInstanceTraitsBase<ChromecastConfigAndroid>;
 
   ChromecastConfigAndroid();
   ~ChromecastConfigAndroid();
diff --git a/chromecast/base/metrics/grouped_histogram.cc b/chromecast/base/metrics/grouped_histogram.cc
index 1101a799..4211dc4f 100644
--- a/chromecast/base/metrics/grouped_histogram.cc
+++ b/chromecast/base/metrics/grouped_histogram.cc
@@ -29,7 +29,7 @@
   std::string app_name;
 };
 
-base::LazyInstance<CurrentAppNameWithLock> g_current_app =
+base::LazyInstance<CurrentAppNameWithLock>::DestructorAtExit g_current_app =
     LAZY_INSTANCE_INITIALIZER;
 
 std::string GetAppName() {
diff --git a/chromecast/common/media/cast_media_client.h b/chromecast/common/media/cast_media_client.h
index e6fa9ab..a53acb35 100644
--- a/chromecast/common/media/cast_media_client.h
+++ b/chromecast/common/media/cast_media_client.h
@@ -35,7 +35,7 @@
                               int level) override;
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<CastMediaClient>;
+  friend struct base::LazyInstanceTraitsBase<CastMediaClient>;
 
   CastMediaClient(::media::MediaClient* content_media_client,
                   SupportedCodecProfileLevelsMemo* supported_profiles);
diff --git a/chromecast/crash/app_state_tracker.cc b/chromecast/crash/app_state_tracker.cc
index b563ece..8910723 100644
--- a/chromecast/crash/app_state_tracker.cc
+++ b/chromecast/crash/app_state_tracker.cc
@@ -15,7 +15,8 @@
   std::string last_launched_app;
 };
 
-base::LazyInstance<CurrentAppState> g_app_state = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<CurrentAppState>::DestructorAtExit g_app_state =
+    LAZY_INSTANCE_INITIALIZER;
 
 CurrentAppState* GetAppState() {
   return g_app_state.Pointer();
diff --git a/chromecast/graphics/cast_vsync_settings.cc b/chromecast/graphics/cast_vsync_settings.cc
index dd908a5..dda4870 100644
--- a/chromecast/graphics/cast_vsync_settings.cc
+++ b/chromecast/graphics/cast_vsync_settings.cc
@@ -6,7 +6,8 @@
 
 namespace chromecast {
 namespace {
-base::LazyInstance<CastVSyncSettings> g_instance = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<CastVSyncSettings>::DestructorAtExit g_instance =
+    LAZY_INSTANCE_INITIALIZER;
 }  // namespace
 
 // static
diff --git a/chromecast/graphics/cast_vsync_settings.h b/chromecast/graphics/cast_vsync_settings.h
index 791fd0f..48211ac7 100644
--- a/chromecast/graphics/cast_vsync_settings.h
+++ b/chromecast/graphics/cast_vsync_settings.h
@@ -32,7 +32,7 @@
   void RemoveObserver(Observer* observer);
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<CastVSyncSettings>;
+  friend struct base::LazyInstanceTraitsBase<CastVSyncSettings>;
 
   CastVSyncSettings();
   ~CastVSyncSettings();
diff --git a/chromecast/media/cma/backend/alsa/stream_mixer_alsa.cc b/chromecast/media/cma/backend/alsa/stream_mixer_alsa.cc
index 88753f1..e8a9558 100644
--- a/chromecast/media/cma/backend/alsa/stream_mixer_alsa.cc
+++ b/chromecast/media/cma/backend/alsa/stream_mixer_alsa.cc
@@ -185,7 +185,7 @@
   DISALLOW_COPY_AND_ASSIGN(StreamMixerAlsaInstance);
 };
 
-base::LazyInstance<StreamMixerAlsaInstance> g_mixer_instance =
+base::LazyInstance<StreamMixerAlsaInstance>::DestructorAtExit g_mixer_instance =
     LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
diff --git a/chromeos/login_event_recorder.cc b/chromeos/login_event_recorder.cc
index c3d67d6..92a7d9f 100644
--- a/chromeos/login_event_recorder.cc
+++ b/chromeos/login_event_recorder.cc
@@ -10,8 +10,8 @@
 
 namespace chromeos {
 
-static base::LazyInstance<LoginEventRecorder> g_login_event_recorder =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<LoginEventRecorder>::DestructorAtExit
+    g_login_event_recorder = LAZY_INSTANCE_INITIALIZER;
 
 LoginEventRecorder::LoginEventRecorder() : delegate_(NULL) {
 }
diff --git a/chromeos/process_proxy/process_proxy_registry.cc b/chromeos/process_proxy/process_proxy_registry.cc
index 5bacfc5..2bd82df 100644
--- a/chromeos/process_proxy/process_proxy_registry.cc
+++ b/chromeos/process_proxy/process_proxy_registry.cc
@@ -26,8 +26,8 @@
   }
 }
 
-static base::LazyInstance<ProcessProxyRegistry> g_process_proxy_registry =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<ProcessProxyRegistry>::DestructorAtExit
+    g_process_proxy_registry = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/chromeos/process_proxy/process_proxy_registry.h b/chromeos/process_proxy/process_proxy_registry.h
index 093e0fd5..428a61c 100644
--- a/chromeos/process_proxy/process_proxy_registry.h
+++ b/chromeos/process_proxy/process_proxy_registry.h
@@ -58,7 +58,7 @@
   void ShutDown();
 
  private:
-  friend struct ::base::DefaultLazyInstanceTraits<ProcessProxyRegistry>;
+  friend struct ::base::LazyInstanceTraitsBase<ProcessProxyRegistry>;
 
   ProcessProxyRegistry();
   ~ProcessProxyRegistry();
diff --git a/components/autofill/content/common/autofill_types.mojom b/components/autofill/content/common/autofill_types.mojom
index 0ff43e1..8a11644 100644
--- a/components/autofill/content/common/autofill_types.mojom
+++ b/components/autofill/content/common/autofill_types.mojom
@@ -146,6 +146,8 @@
 struct PasswordFormGenerationData {
   uint64 form_signature;
   uint32 field_signature;
+  bool has_confirmation_field;
+  uint32 confirmation_field_signature;
 };
 
 // autofill::PasswordForm
diff --git a/components/autofill/content/common/autofill_types_struct_traits.cc b/components/autofill/content/common/autofill_types_struct_traits.cc
index 1b3d8ab6..055646e5 100644
--- a/components/autofill/content/common/autofill_types_struct_traits.cc
+++ b/components/autofill/content/common/autofill_types_struct_traits.cc
@@ -474,6 +474,12 @@
          PasswordFormGenerationData* out) {
   out->form_signature = data.form_signature();
   out->field_signature = data.field_signature();
+  if (data.has_confirmation_field()) {
+    out->confirmation_field_signature.emplace(
+        data.confirmation_field_signature());
+  } else {
+    DCHECK(!out->confirmation_field_signature);
+  }
   return true;
 }
 
diff --git a/components/autofill/content/common/autofill_types_struct_traits.h b/components/autofill/content/common/autofill_types_struct_traits.h
index f5156bb8..cbe687a 100644
--- a/components/autofill/content/common/autofill_types_struct_traits.h
+++ b/components/autofill/content/common/autofill_types_struct_traits.h
@@ -372,6 +372,16 @@
     return r.field_signature;
   }
 
+  static bool has_confirmation_field(
+      const autofill::PasswordFormGenerationData& r) {
+    return r.confirmation_field_signature.has_value();
+  }
+
+  static uint32_t confirmation_field_signature(
+      const autofill::PasswordFormGenerationData& r) {
+    return r.confirmation_field_signature.value_or(0);
+  }
+
   static bool Read(autofill::mojom::PasswordFormGenerationDataDataView data,
                    autofill::PasswordFormGenerationData* out);
 };
diff --git a/components/autofill/content/common/autofill_types_struct_traits_unittest.cc b/components/autofill/content/common/autofill_types_struct_traits_unittest.cc
index f4ab58b..59f9bc4 100644
--- a/components/autofill/content/common/autofill_types_struct_traits_unittest.cc
+++ b/components/autofill/content/common/autofill_types_struct_traits_unittest.cc
@@ -201,6 +201,10 @@
     const PasswordFormGenerationData& actual) {
   EXPECT_EQ(expected.form_signature, actual.form_signature);
   EXPECT_EQ(expected.field_signature, actual.field_signature);
+  ASSERT_EQ(expected.confirmation_field_signature.has_value(),
+            actual.confirmation_field_signature.has_value());
+  EXPECT_EQ(expected.confirmation_field_signature.value(),
+            actual.confirmation_field_signature.value());
 }
 
 }  // namespace
@@ -407,7 +411,10 @@
   FormSignature form_signature = CalculateFormSignature(form);
   FieldSignature field_signature =
       CalculateFieldSignatureForField(form.fields[0]);
-  PasswordFormGenerationData input{form_signature, field_signature};
+  FieldSignature confirmation_field_signature =
+      CalculateFieldSignatureForField(form.fields[1]);
+  PasswordFormGenerationData input(form_signature, field_signature);
+  input.confirmation_field_signature.emplace(confirmation_field_signature);
 
   base::RunLoop loop;
   mojom::TypeTraitsTestPtr proxy = GetTypeTraitsTestProxy();
diff --git a/components/autofill/content/renderer/password_form_conversion_utils.cc b/components/autofill/content/renderer/password_form_conversion_utils.cc
index b92ff5f..20c9ca7 100644
--- a/components/autofill/content/renderer/password_form_conversion_utils.cc
+++ b/components/autofill/content/renderer/password_form_conversion_utils.cc
@@ -105,7 +105,7 @@
 }
 
 struct LoginAndSignupLazyInstanceTraits
-    : public base::DefaultLazyInstanceTraits<re2::RE2> {
+    : public base::internal::DestructorAtExitLazyInstanceTraits<re2::RE2> {
   static re2::RE2* New(void* instance) {
     return CreateMatcher(instance, kLoginAndSignupRegex);
   }
@@ -308,7 +308,7 @@
     "passwords(?:-[a-z-]+\\.corp)?\\.google\\.com";
 
 struct PasswordSiteUrlLazyInstanceTraits
-    : public base::DefaultLazyInstanceTraits<re2::RE2> {
+    : public base::internal::DestructorAtExitLazyInstanceTraits<re2::RE2> {
   static re2::RE2* New(void* instance) {
     return CreateMatcher(instance, kPasswordSiteUrlRegex);
   }
diff --git a/components/autofill/content/renderer/password_generation_agent.cc b/components/autofill/content/renderer/password_generation_agent.cc
index ebca6d4..d31e213f 100644
--- a/components/autofill/content/renderer/password_generation_agent.cc
+++ b/components/autofill/content/renderer/password_generation_agent.cc
@@ -75,21 +75,30 @@
 // than 2 elements.
 std::vector<blink::WebInputElement> FindPasswordElementsForGeneration(
     const std::vector<blink::WebInputElement>& all_password_elements,
-    const FieldSignature field_signature) {
-  auto iter = std::find_if(
-      all_password_elements.begin(), all_password_elements.end(),
-      [&field_signature](const blink::WebInputElement& input) {
-        FieldSignature signature = CalculateFieldSignatureByNameAndType(
-            input.nameForAutofill().utf16(), input.formControlType().utf8());
-        return signature == field_signature;
-      });
-  std::vector<blink::WebInputElement> passwords;
+    const PasswordFormGenerationData& generation_data) {
+  auto generation_field_iter = all_password_elements.end();
+  auto confirmation_field_iter = all_password_elements.end();
+  for (auto iter = all_password_elements.begin();
+       iter != all_password_elements.end(); ++iter) {
+    const blink::WebInputElement& input = *iter;
+    FieldSignature signature = CalculateFieldSignatureByNameAndType(
+        input.nameForAutofill().utf16(), input.formControlType().utf8());
+    if (signature == generation_data.field_signature)
+      generation_field_iter = iter;
+    else if (generation_data.confirmation_field_signature &&
+             signature == *generation_data.confirmation_field_signature)
+      confirmation_field_iter = iter;
+  }
 
-  // We copy not more than 2 fields because occasionally there are forms where
-  // the security question answers are put in password fields and we don't want
-  // to fill those.
-  for (; iter != all_password_elements.end() && passwords.size() < 2; ++iter)
-    passwords.push_back(*iter);
+  std::vector<blink::WebInputElement> passwords;
+  if (generation_field_iter != all_password_elements.end()) {
+    passwords.push_back(*generation_field_iter);
+
+    if (confirmation_field_iter == all_password_elements.end())
+      confirmation_field_iter = generation_field_iter + 1;
+    if (confirmation_field_iter != all_password_elements.end())
+      passwords.push_back(*confirmation_field_iter);
+  }
   return passwords;
 }
 
@@ -404,10 +413,10 @@
 
     VLOG(2) << "Password generation eligible form found";
     std::vector<blink::WebInputElement> password_elements =
-        generation_data ? FindPasswordElementsForGeneration(
-                              possible_form_data.password_elements,
-                              generation_data->field_signature)
-                        : possible_form_data.password_elements;
+        generation_data
+            ? FindPasswordElementsForGeneration(
+                  possible_form_data.password_elements, *generation_data)
+            : possible_form_data.password_elements;
     if (password_elements.empty()) {
       // It might be if JavaScript changes field names.
       VLOG(2) << "Fields for generation are not found";
@@ -565,9 +574,11 @@
   GetAccountCreationPasswordFields(control_elements, &password_elements);
   password_elements = FindPasswordElementsForGeneration(
       password_elements,
-      CalculateFieldSignatureByNameAndType(
-          last_focused_password_element_.nameForAutofill().utf16(),
-          last_focused_password_element_.formControlType().utf8()));
+      PasswordFormGenerationData(
+          0, /* form_signature */
+          CalculateFieldSignatureByNameAndType(
+              last_focused_password_element_.nameForAutofill().utf16(),
+              last_focused_password_element_.formControlType().utf8())));
   generation_form_data_.reset(new AccountCreationFormData(
       make_linked_ptr(password_form.release()), password_elements));
   is_manually_triggered_ = true;
diff --git a/components/autofill/core/browser/country_names.cc b/components/autofill/core/browser/country_names.cc
index bbf1fb6c..2f9a022 100644
--- a/components/autofill/core/browser/country_names.cc
+++ b/components/autofill/core/browser/country_names.cc
@@ -24,7 +24,7 @@
 
 // A copy of the application locale string, which should be ready for
 // CountryName's construction.
-static base::LazyInstance<std::string> g_application_locale =
+static base::LazyInstance<std::string>::DestructorAtExit g_application_locale =
     LAZY_INSTANCE_INITIALIZER;
 
 // Returns the ICU sort key corresponding to |str| for the given |collator|.
diff --git a/components/autofill/core/common/BUILD.gn b/components/autofill/core/common/BUILD.gn
index f7a34bb..f3b320f 100644
--- a/components/autofill/core/common/BUILD.gn
+++ b/components/autofill/core/common/BUILD.gn
@@ -33,6 +33,7 @@
     "password_form_field_prediction_map.h",
     "password_form_fill_data.cc",
     "password_form_fill_data.h",
+    "password_form_generation_data.cc",
     "password_form_generation_data.h",
     "password_generation_util.cc",
     "password_generation_util.h",
diff --git a/components/autofill/core/common/autofill_clock.cc b/components/autofill/core/common/autofill_clock.cc
index 8702403..20d70c9 100644
--- a/components/autofill/core/common/autofill_clock.cc
+++ b/components/autofill/core/common/autofill_clock.cc
@@ -13,7 +13,7 @@
 
 namespace {
 
-static base::LazyInstance<AutofillClock> g_autofill_clock =
+static base::LazyInstance<AutofillClock>::DestructorAtExit g_autofill_clock =
     LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
diff --git a/components/autofill/core/common/autofill_clock.h b/components/autofill/core/common/autofill_clock.h
index 45a9912..b94ff27 100644
--- a/components/autofill/core/common/autofill_clock.h
+++ b/components/autofill/core/common/autofill_clock.h
@@ -26,7 +26,7 @@
 
  private:
   friend class TestAutofillClock;
-  friend struct base::DefaultLazyInstanceTraits<AutofillClock>;
+  friend struct base::LazyInstanceTraitsBase<AutofillClock>;
 
   // Resets a normal clock.
   static void SetClock();
diff --git a/components/autofill/core/common/password_form_generation_data.cc b/components/autofill/core/common/password_form_generation_data.cc
new file mode 100644
index 0000000..521eabc
--- /dev/null
+++ b/components/autofill/core/common/password_form_generation_data.cc
@@ -0,0 +1,21 @@
+// Copyright (c) 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/autofill/core/common/password_form_generation_data.h"
+
+namespace autofill {
+
+PasswordFormGenerationData::PasswordFormGenerationData() = default;
+
+PasswordFormGenerationData::PasswordFormGenerationData(
+    FormSignature form_signature,
+    FieldSignature field_signature)
+    : form_signature(form_signature), field_signature(field_signature) {}
+
+PasswordFormGenerationData::PasswordFormGenerationData(
+    const PasswordFormGenerationData& other) = default;
+
+PasswordFormGenerationData::~PasswordFormGenerationData() = default;
+
+}  // namespace autofill
diff --git a/components/autofill/core/common/password_form_generation_data.h b/components/autofill/core/common/password_form_generation_data.h
index d010d9a..f14d2953 100644
--- a/components/autofill/core/common/password_form_generation_data.h
+++ b/components/autofill/core/common/password_form_generation_data.h
@@ -7,6 +7,7 @@
 
 #include <stdint.h>
 
+#include "base/optional.h"
 #include "base/strings/string16.h"
 #include "components/autofill/core/common/form_field_data.h"
 #include "components/autofill/core/common/signatures_util.h"
@@ -17,6 +18,12 @@
 // Structure used for sending information from browser to renderer about on
 // which fields password should be generated.
 struct PasswordFormGenerationData {
+  PasswordFormGenerationData();
+  PasswordFormGenerationData(FormSignature form_signature,
+                             FieldSignature field_signature);
+  PasswordFormGenerationData(const PasswordFormGenerationData& other);
+  ~PasswordFormGenerationData();
+
   // The unique signature of form where password should be generated
   // (see components/autofill/core/browser/form_structure.h).
   FormSignature form_signature;
@@ -24,6 +31,10 @@
   // The unique signature of field where password should be generated
   // (see components/autofill/core/browser/autofill_field.h).
   FieldSignature field_signature;
+
+  // The unique signature of the confirmation field where the generated password
+  // should be copied to.
+  base::Optional<FieldSignature> confirmation_field_signature;
 };
 
 }  // namespace autofill
diff --git a/components/content_settings/core/browser/content_settings_registry.cc b/components/content_settings/core/browser/content_settings_registry.cc
index a2d547c..b782ec6 100644
--- a/components/content_settings/core/browser/content_settings_registry.cc
+++ b/components/content_settings/core/browser/content_settings_registry.cc
@@ -20,7 +20,7 @@
 
 namespace {
 
-base::LazyInstance<ContentSettingsRegistry> g_instance =
+base::LazyInstance<ContentSettingsRegistry>::DestructorAtExit g_instance =
     LAZY_INSTANCE_INITIALIZER;
 
 // TODO(raymes): These overloaded functions make the registration code clearer.
diff --git a/components/content_settings/core/browser/content_settings_registry.h b/components/content_settings/core/browser/content_settings_registry.h
index 84b4b51..14675088 100644
--- a/components/content_settings/core/browser/content_settings_registry.h
+++ b/components/content_settings/core/browser/content_settings_registry.h
@@ -46,7 +46,7 @@
 
  private:
   friend class ContentSettingsRegistryTest;
-  friend struct base::DefaultLazyInstanceTraits<ContentSettingsRegistry>;
+  friend struct base::LazyInstanceTraitsBase<ContentSettingsRegistry>;
 
   ContentSettingsRegistry();
   ContentSettingsRegistry(WebsiteSettingsRegistry* website_settings_registry);
diff --git a/components/content_settings/core/browser/website_settings_registry.cc b/components/content_settings/core/browser/website_settings_registry.cc
index 019037c2..966d496 100644
--- a/components/content_settings/core/browser/website_settings_registry.cc
+++ b/components/content_settings/core/browser/website_settings_registry.cc
@@ -12,8 +12,8 @@
 
 namespace {
 
-base::LazyInstance<content_settings::WebsiteSettingsRegistry> g_instance =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<content_settings::WebsiteSettingsRegistry>::DestructorAtExit
+    g_instance = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/components/content_settings/core/browser/website_settings_registry.h b/components/content_settings/core/browser/website_settings_registry.h
index 1f4ec47..ebfc93f 100644
--- a/components/content_settings/core/browser/website_settings_registry.h
+++ b/components/content_settings/core/browser/website_settings_registry.h
@@ -80,7 +80,7 @@
  private:
   friend class ContentSettingsRegistryTest;
   friend class WebsiteSettingsRegistryTest;
-  friend struct base::DefaultLazyInstanceTraits<WebsiteSettingsRegistry>;
+  friend struct base::LazyInstanceTraitsBase<WebsiteSettingsRegistry>;
 
   WebsiteSettingsRegistry();
   ~WebsiteSettingsRegistry();
diff --git a/components/cookie_config/cookie_store_util.cc b/components/cookie_config/cookie_store_util.cc
index 7c1b44b..c1aa494 100644
--- a/components/cookie_config/cookie_store_util.cc
+++ b/components/cookie_config/cookie_store_util.cc
@@ -55,8 +55,8 @@
 
 // Using a LazyInstance is safe here because this class is stateless and
 // requires 0 initialization.
-base::LazyInstance<CookieOSCryptoDelegate> g_cookie_crypto_delegate =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<CookieOSCryptoDelegate>::DestructorAtExit
+    g_cookie_crypto_delegate = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/components/crash/content/app/breakpad_linux.cc b/components/crash/content/app/breakpad_linux.cc
index 722ce16d..0a82cdb 100644
--- a/components/crash/content/app/breakpad_linux.cc
+++ b/components/crash/content/app/breakpad_linux.cc
@@ -143,7 +143,7 @@
 void SetMinidumpSanitizationFields(MinidumpDescriptor* minidump_descriptor,
                                    const SanitizationInfo& sanitization_info);
 
-base::LazyInstance<MicrodumpInfo> g_microdump_info =
+base::LazyInstance<MicrodumpInfo>::DestructorAtExit g_microdump_info =
     LAZY_INSTANCE_INITIALIZER;
 
 #endif
diff --git a/components/crash/content/browser/crash_dump_observer_android.cc b/components/crash/content/browser/crash_dump_observer_android.cc
index bc5449f45..72189b1 100644
--- a/components/crash/content/browser/crash_dump_observer_android.cc
+++ b/components/crash/content/browser/crash_dump_observer_android.cc
@@ -21,7 +21,8 @@
 namespace breakpad {
 
 namespace {
-base::LazyInstance<CrashDumpObserver> g_instance = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<CrashDumpObserver>::DestructorAtExit g_instance =
+    LAZY_INSTANCE_INITIALIZER;
 }
 
 // static
diff --git a/components/crash/content/browser/crash_dump_observer_android.h b/components/crash/content/browser/crash_dump_observer_android.h
index fbff476..3f049f3 100644
--- a/components/crash/content/browser/crash_dump_observer_android.h
+++ b/components/crash/content/browser/crash_dump_observer_android.h
@@ -70,7 +70,7 @@
                                   content::FileDescriptorInfo* mappings);
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<CrashDumpObserver>;
+  friend struct base::LazyInstanceTraitsBase<CrashDumpObserver>;
 
   CrashDumpObserver();
   ~CrashDumpObserver() override;
diff --git a/components/cronet/histogram_manager.h b/components/cronet/histogram_manager.h
index bf09b518..faee103 100644
--- a/components/cronet/histogram_manager.h
+++ b/components/cronet/histogram_manager.h
@@ -37,7 +37,7 @@
   static HistogramManager* GetInstance();
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<HistogramManager>;
+  friend struct base::LazyInstanceTraitsBase<HistogramManager>;
 
   // base::HistogramFlattener:
   void RecordDelta(const base::HistogramBase& histogram,
diff --git a/components/favicon/content/content_favicon_driver.cc b/components/favicon/content/content_favicon_driver.cc
index cf9bba4..d6bbcac 100644
--- a/components/favicon/content/content_favicon_driver.cc
+++ b/components/favicon/content/content_favicon_driver.cc
@@ -109,11 +109,6 @@
 int ContentFaviconDriver::DownloadImage(const GURL& url,
                                         int max_image_size,
                                         ImageDownloadCallback callback) {
-  if (WasUnableToDownloadFavicon(url)) {
-    DVLOG(1) << "Skip Failed FavIcon: " << url;
-    return 0;
-  }
-
   bool bypass_cache = (bypass_cache_page_url_ == GetActiveURL());
   bypass_cache_page_url_ = GURL();
 
diff --git a/components/favicon/content/content_favicon_driver_unittest.cc b/components/favicon/content/content_favicon_driver_unittest.cc
index 73769c5f..5439aee 100644
--- a/components/favicon/content/content_favicon_driver_unittest.cc
+++ b/components/favicon/content/content_favicon_driver_unittest.cc
@@ -72,50 +72,18 @@
   testing::NiceMock<MockFaviconService> favicon_service_;
 };
 
-// Test that UnableToDownloadFavicon() is not called as a result of a favicon
-// download with 200 status.
-TEST_F(ContentFaviconDriverTest, ShouldNotCallUnableToDownloadFaviconFor200) {
-  EXPECT_CALL(favicon_service_, UnableToDownloadFavicon(kIconURL)).Times(0);
+// Test that a download is initiated when there isn't a favicon in the database
+// for either the page URL or the icon URL.
+TEST_F(ContentFaviconDriverTest, ShouldCauseImageDownload) {
   // Mimic a page load.
   TestFetchFaviconForPage(
       kPageURL,
       {content::FaviconURL(kIconURL, content::FaviconURL::FAVICON,
                            kEmptyIconSizes)});
-  // Completing the download should not cause a call to
-  // UnableToDownloadFavicon().
   EXPECT_TRUE(web_contents_tester()->TestDidDownloadImage(
       kIconURL, 200, kEmptyIcons, kEmptyIconSizes));
 }
 
-// Test that UnableToDownloadFavicon() is called as a result of a favicon
-// download with 404 status.
-TEST_F(ContentFaviconDriverTest, ShouldCallUnableToDownloadFaviconFor404) {
-  EXPECT_CALL(favicon_service_, UnableToDownloadFavicon(kIconURL));
-  // Mimic a page load.
-  TestFetchFaviconForPage(
-      kPageURL,
-      {content::FaviconURL(kIconURL, content::FaviconURL::FAVICON,
-                           kEmptyIconSizes)});
-  // Mimic the completion of an image download.
-  EXPECT_TRUE(web_contents_tester()->TestDidDownloadImage(
-      kIconURL, 404, kEmptyIcons, kEmptyIconSizes));
-}
-
-// Test that UnableToDownloadFavicon() is not called as a result of a favicon
-// download with 503 status.
-TEST_F(ContentFaviconDriverTest, ShouldNotCallUnableToDownloadFaviconFor503) {
-  EXPECT_CALL(favicon_service_, UnableToDownloadFavicon(kIconURL)).Times(0);
-  // Mimic a page load.
-  TestFetchFaviconForPage(
-      kPageURL,
-      {content::FaviconURL(kIconURL, content::FaviconURL::FAVICON,
-                           kEmptyIconSizes)});
-  // Completing the download should not cause a call to
-  // UnableToDownloadFavicon().
-  EXPECT_TRUE(web_contents_tester()->TestDidDownloadImage(
-      kIconURL, 503, kEmptyIcons, kEmptyIconSizes));
-}
-
 // Test that Favicon is not requested repeatedly during the same session if
 // the favicon is known to be unavailable (e.g. due to HTTP 404 status).
 TEST_F(ContentFaviconDriverTest, ShouldNotRequestRepeatedlyIfUnavailable) {
@@ -130,6 +98,22 @@
   EXPECT_FALSE(web_contents_tester()->HasPendingDownloadImage(kIconURL));
 }
 
+TEST_F(ContentFaviconDriverTest, ShouldDownloadSecondIfFirstUnavailable) {
+  const GURL kOtherIconURL = GURL("http://www.google.com/other-favicon.ico");
+  ON_CALL(favicon_service_, WasUnableToDownloadFavicon(kIconURL))
+      .WillByDefault(Return(true));
+  // Mimic a page load.
+  TestFetchFaviconForPage(
+      kPageURL,
+      {content::FaviconURL(kIconURL, content::FaviconURL::FAVICON,
+                           kEmptyIconSizes),
+       content::FaviconURL(kOtherIconURL, content::FaviconURL::FAVICON,
+                           kEmptyIconSizes)});
+  // Verify a  download request is pending for the second image.
+  EXPECT_FALSE(web_contents_tester()->HasPendingDownloadImage(kIconURL));
+  EXPECT_TRUE(web_contents_tester()->HasPendingDownloadImage(kOtherIconURL));
+}
+
 // Test that ContentFaviconDriver ignores updated favicon URLs if there is no
 // last committed entry. This occurs when script is injected in about:blank.
 // See crbug.com/520759 for more details
diff --git a/components/favicon/core/favicon_driver_impl.cc b/components/favicon/core/favicon_driver_impl.cc
index 453c96b..61e5b08 100644
--- a/components/favicon/core/favicon_driver_impl.cc
+++ b/components/favicon/core/favicon_driver_impl.cc
@@ -83,10 +83,6 @@
   return false;
 }
 
-bool FaviconDriverImpl::WasUnableToDownloadFavicon(const GURL& url) {
-  return favicon_service_ && favicon_service_->WasUnableToDownloadFavicon(url);
-}
-
 void FaviconDriverImpl::SetFaviconOutOfDateForPage(const GURL& url,
                                                    bool force_reload) {
   if (favicon_service_) {
diff --git a/components/favicon/core/favicon_driver_impl.h b/components/favicon/core/favicon_driver_impl.h
index 7d33c3ef..19086367 100644
--- a/components/favicon/core/favicon_driver_impl.h
+++ b/components/favicon/core/favicon_driver_impl.h
@@ -53,9 +53,6 @@
                     bookmarks::BookmarkModel* bookmark_model);
   ~FaviconDriverImpl() override;
 
-  // Returns whether downloading favicon for |url| previously failed.
-  bool WasUnableToDownloadFavicon(const GURL& url);
-
   // Informs FaviconService that the favicon for |url| is out of date. If
   // |force_reload| is true, then discard information about favicon download
   // failures.
diff --git a/components/favicon/core/favicon_handler.cc b/components/favicon/core/favicon_handler.cc
index adbb5df..9c65799 100644
--- a/components/favicon/core/favicon_handler.cc
+++ b/components/favicon/core/favicon_handler.cc
@@ -661,6 +661,15 @@
 void FaviconHandler::ScheduleDownload(const GURL& image_url,
                                       favicon_base::IconType icon_type) {
   DCHECK(image_url.is_valid());
+  if (service_ && service_->WasUnableToDownloadFavicon(image_url)) {
+    DVLOG(1) << "Skip Failed FavIcon: " << image_url;
+    // Registration in download_requests_ is needed to prevent
+    // OnDidDownloadFavicon() from returning early.
+    download_requests_[0] = DownloadRequest(image_url, icon_type);
+    OnDidDownloadFavicon(0, 0, image_url, std::vector<SkBitmap>(),
+                         std::vector<gfx::Size>());
+    return;
+  }
   // A max bitmap size is specified to avoid receiving huge bitmaps in
   // OnDidDownloadFavicon(). See FaviconDriver::StartDownload()
   // for more details about the max bitmap size.
@@ -673,6 +682,8 @@
   DCHECK(download_requests_.find(download_id) == download_requests_.end());
   download_requests_[download_id] = DownloadRequest(image_url, icon_type);
 
+  // TODO(mastiz): Remove the download_id == 0 handling because it's not used
+  // in production code, only tests.
   if (download_id == 0) {
     // If DownloadFavicon() did not start a download, it returns a download id
     // of 0. We still need to call OnDidDownloadFavicon() because the method is
diff --git a/components/favicon/ios/web_favicon_driver.mm b/components/favicon/ios/web_favicon_driver.mm
index 9e1b7e3d..47011b0 100644
--- a/components/favicon/ios/web_favicon_driver.mm
+++ b/components/favicon/ios/web_favicon_driver.mm
@@ -70,11 +70,6 @@
 int WebFaviconDriver::DownloadImage(const GURL& url,
                                     int max_image_size,
                                     ImageDownloadCallback callback) {
-  if (WasUnableToDownloadFavicon(url)) {
-    DVLOG(1) << "Skip Failed FavIcon: " << url;
-    return 0;
-  }
-
   static int downloaded_image_count = 0;
   int local_download_id = ++downloaded_image_count;
 
diff --git a/components/guest_view/browser/guest_view_base.cc b/components/guest_view/browser/guest_view_base.cc
index a3e89fef..8b90763 100644
--- a/components/guest_view/browser/guest_view_base.cc
+++ b/components/guest_view/browser/guest_view_base.cc
@@ -39,8 +39,8 @@
 namespace {
 
 using WebContentsGuestViewMap = std::map<const WebContents*, GuestViewBase*>;
-static base::LazyInstance<WebContentsGuestViewMap> webcontents_guestview_map =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<WebContentsGuestViewMap>::DestructorAtExit
+    webcontents_guestview_map = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/components/guest_view/renderer/guest_view_container.cc b/components/guest_view/renderer/guest_view_container.cc
index 890fb36..cc01a13 100644
--- a/components/guest_view/renderer/guest_view_container.cc
+++ b/components/guest_view/renderer/guest_view_container.cc
@@ -18,8 +18,8 @@
 namespace {
 
 using GuestViewContainerMap = std::map<int, guest_view::GuestViewContainer*>;
-static base::LazyInstance<GuestViewContainerMap> g_guest_view_container_map =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<GuestViewContainerMap>::DestructorAtExit
+    g_guest_view_container_map = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/components/metrics/leak_detector/leak_detector.h b/components/metrics/leak_detector/leak_detector.h
index de5d40f..fb20899 100644
--- a/components/metrics/leak_detector/leak_detector.h
+++ b/components/metrics/leak_detector/leak_detector.h
@@ -23,7 +23,7 @@
 
 namespace base {
 template <typename T>
-struct DefaultLazyInstanceTraits;
+struct LazyInstanceTraitsBase;
 }
 
 namespace metrics {
@@ -86,7 +86,7 @@
   void RemoveObserver(Observer* observer);
 
  private:
-  friend base::DefaultLazyInstanceTraits<LeakDetector>;
+  friend base::LazyInstanceTraitsBase<LeakDetector>;
   FRIEND_TEST_ALL_PREFIXES(LeakDetectorTest, NotifyObservers);
 
   // Keep these private, as this class is meant to be initialized only through
diff --git a/components/mime_util/mime_util.cc b/components/mime_util/mime_util.cc
index 5f4cf3ff..5539c83c 100644
--- a/components/mime_util/mime_util.cc
+++ b/components/mime_util/mime_util.cc
@@ -112,7 +112,7 @@
   bool IsSupportedMimeType(const std::string& mime_type) const;
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<MimeUtil>;
+  friend struct base::LazyInstanceTraitsBase<MimeUtil>;
 
   using MimeTypes = base::hash_set<std::string>;
 
diff --git a/components/minidump_uploader/android/java/src/org/chromium/components/minidump_uploader/CrashFileManager.java b/components/minidump_uploader/android/java/src/org/chromium/components/minidump_uploader/CrashFileManager.java
index f0013517..660c8ecc 100644
--- a/components/minidump_uploader/android/java/src/org/chromium/components/minidump_uploader/CrashFileManager.java
+++ b/components/minidump_uploader/android/java/src/org/chromium/components/minidump_uploader/CrashFileManager.java
@@ -45,8 +45,7 @@
     @VisibleForTesting
     public static final String CRASH_DUMP_LOGFILE = "uploads.log";
 
-    private static final Pattern MINIDUMP_FIRST_TRY_PATTERN =
-            Pattern.compile("\\.dmp([0-9]*)$\\z");
+    private static final Pattern MINIDUMP_FIRST_TRY_PATTERN = Pattern.compile("\\.dmp([0-9]*)$\\z");
 
     private static final Pattern MINIDUMP_MIME_FIRST_TRY_PATTERN =
             Pattern.compile("\\.dmp([0-9]+)$\\z");
@@ -102,7 +101,7 @@
      * @return Comparator for prioritizing the more recently modified file
      */
     @VisibleForTesting
-    protected static final Comparator<File> sFileComparator =  new Comparator<File>() {
+    protected static final Comparator<File> sFileComparator = new Comparator<File>() {
         @Override
         public int compare(File lhs, File rhs) {
             if (lhs.lastModified() == rhs.lastModified()) {
@@ -265,8 +264,7 @@
         if (cacheDir == null) {
             throw new NullPointerException("Specified context cannot be null.");
         } else if (!cacheDir.isDirectory()) {
-            throw new IllegalArgumentException(cacheDir.getAbsolutePath()
-                    + " is not a directory.");
+            throw new IllegalArgumentException(cacheDir.getAbsolutePath() + " is not a directory.");
         }
         mCacheDir = cacheDir;
     }
@@ -404,8 +402,7 @@
             if (f.delete()) {
                 f = new File(getCrashDirectory(), name);
             } else {
-                Log.w(TAG, "Unable to delete previous logfile"
-                        + f.getAbsolutePath());
+                Log.w(TAG, "Unable to delete previous logfile" + f.getAbsolutePath());
             }
         }
         return f;
@@ -495,8 +492,7 @@
      * @return The new minidump file copied with the contents of the File Descriptor, or null if the
      *         copying failed.
      */
-    public File copyMinidumpFromFD(FileDescriptor fd, File tmpDir, int uid)
-            throws IOException {
+    public File copyMinidumpFromFD(FileDescriptor fd, File tmpDir, int uid) throws IOException {
         File crashDirectory = getCrashDirectory();
         if (!crashDirectory.isDirectory() && !crashDirectory.mkdir()) {
             throw new RuntimeException("Couldn't create " + crashDirectory.getAbsolutePath());
@@ -547,7 +543,6 @@
             } catch (IOException e) {
                 Log.w(TAG, "Couldn't close minidump input stream ", e);
             }
-
         }
         File minidumpFile = new File(crashDirectory, createUniqueMinidumpNameForUid(uid));
         if (tmpFile.renameTo(minidumpFile)) {
diff --git a/components/minidump_uploader/android/java/src/org/chromium/components/minidump_uploader/MinidumpUploadCallable.java b/components/minidump_uploader/android/java/src/org/chromium/components/minidump_uploader/MinidumpUploadCallable.java
index 44a966b..5eec37dbd 100644
--- a/components/minidump_uploader/android/java/src/org/chromium/components/minidump_uploader/MinidumpUploadCallable.java
+++ b/components/minidump_uploader/android/java/src/org/chromium/components/minidump_uploader/MinidumpUploadCallable.java
@@ -200,8 +200,7 @@
         } else {
             // Log the results of the upload. Note that periodic upload failures aren't bad
             // because we will need to throttle uploads in the future anyway.
-            String msg = String.format(Locale.US,
-                    "Failed to upload %s with code: %d (%s).",
+            String msg = String.format(Locale.US, "Failed to upload %s with code: %d (%s).",
                     mFileToUpload.getName(), responseCode, connection.getResponseMessage());
             Log.i(TAG, msg);
 
@@ -295,8 +294,8 @@
      * @param outStream the stream to write to
      * @throws IOException
      */
-    private static void streamCopy(InputStream inStream,
-                                   OutputStream outStream) throws IOException {
+    private static void streamCopy(InputStream inStream, OutputStream outStream)
+            throws IOException {
         byte[] temp = new byte[4096];
         int bytesRead = inStream.read(temp);
         while (bytesRead >= 0) {
@@ -311,9 +310,9 @@
     private void removeOutdatedPrefs(SharedPreferences sharedPreferences) {
         SharedPreferences.Editor editor = sharedPreferences.edit();
         editor.remove(PREF_DAY_UPLOAD_COUNT)
-              .remove(PREF_LAST_UPLOAD_DAY)
-              .remove(PREF_LAST_UPLOAD_WEEK)
-              .remove(PREF_WEEK_UPLOAD_SIZE)
-              .apply();
+                .remove(PREF_LAST_UPLOAD_DAY)
+                .remove(PREF_LAST_UPLOAD_WEEK)
+                .remove(PREF_WEEK_UPLOAD_SIZE)
+                .apply();
     }
 }
diff --git a/components/minidump_uploader/android/java/src/org/chromium/components/minidump_uploader/util/HttpURLConnectionFactoryImpl.java b/components/minidump_uploader/android/java/src/org/chromium/components/minidump_uploader/util/HttpURLConnectionFactoryImpl.java
index 3e8cb07..9ea0b09 100644
--- a/components/minidump_uploader/android/java/src/org/chromium/components/minidump_uploader/util/HttpURLConnectionFactoryImpl.java
+++ b/components/minidump_uploader/android/java/src/org/chromium/components/minidump_uploader/util/HttpURLConnectionFactoryImpl.java
@@ -12,7 +12,6 @@
  * Default implementation of HttpURLConnectionFactory.
  */
 public class HttpURLConnectionFactoryImpl implements HttpURLConnectionFactory {
-
     @Override
     public HttpURLConnection createHttpURLConnection(String url) {
         try {
diff --git a/components/nacl/renderer/ppb_nacl_private_impl.cc b/components/nacl/renderer/ppb_nacl_private_impl.cc
index 5a1dcdbb..7cbb9c6d 100644
--- a/components/nacl/renderer/ppb_nacl_private_impl.cc
+++ b/components/nacl/renderer/ppb_nacl_private_impl.cc
@@ -84,8 +84,8 @@
 // The base URL for resources used by the PNaCl translator processes.
 const char* kPNaClTranslatorBaseUrl = "chrome://pnacl-translator/";
 
-base::LazyInstance<scoped_refptr<PnaclTranslationResourceHost> >
-    g_pnacl_resource_host = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<scoped_refptr<PnaclTranslationResourceHost>>::
+    DestructorAtExit g_pnacl_resource_host = LAZY_INSTANCE_INITIALIZER;
 
 bool InitializePnaclResourceHost() {
   // Must run on the main thread.
@@ -150,7 +150,8 @@
 
 typedef std::unordered_map<PP_Instance, std::unique_ptr<NaClPluginInstance>>
     InstanceMap;
-base::LazyInstance<InstanceMap> g_instance_map = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<InstanceMap>::DestructorAtExit g_instance_map =
+    LAZY_INSTANCE_INITIALIZER;
 
 NaClPluginInstance* GetNaClPluginInstance(PP_Instance instance) {
   InstanceMap& map = g_instance_map.Get();
diff --git a/components/os_crypt/key_storage_linux.cc b/components/os_crypt/key_storage_linux.cc
index b54fe0d..c8b1832 100644
--- a/components/os_crypt/key_storage_linux.cc
+++ b/components/os_crypt/key_storage_linux.cc
@@ -39,7 +39,8 @@
   scoped_refptr<base::SingleThreadTaskRunner> main_thread_runner;
 };
 
-base::LazyInstance<Configuration> g_config = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<Configuration>::DestructorAtExit g_config =
+    LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/components/password_manager/core/browser/password_generation_manager.cc b/components/password_manager/core/browser/password_generation_manager.cc
index d97054a..2e6f35f 100644
--- a/components/password_manager/core/browser/password_generation_manager.cc
+++ b/components/password_manager/core/browser/password_generation_manager.cc
@@ -4,6 +4,7 @@
 
 #include "components/password_manager/core/browser/password_generation_manager.h"
 
+#include "base/optional.h"
 #include "components/autofill/core/browser/autofill_field.h"
 #include "components/autofill/core/browser/field_types.h"
 #include "components/autofill/core/browser/form_structure.h"
@@ -12,6 +13,11 @@
 #include "components/password_manager/core/browser/password_manager_client.h"
 #include "components/password_manager/core/browser/password_manager_driver.h"
 
+using autofill::AutofillField;
+using autofill::FieldSignature;
+using autofill::FormSignature;
+using autofill::FormStructure;
+
 namespace password_manager {
 
 PasswordGenerationManager::PasswordGenerationManager(
@@ -31,17 +37,27 @@
   std::vector<autofill::PasswordFormGenerationData>
       forms_eligible_for_generation;
   for (auto form_it = forms.begin(); form_it != forms.end(); ++form_it) {
-    autofill::FormStructure* form = *form_it;
+    FormStructure* form = *form_it;
+    AutofillField* generation_field = nullptr;
+    AutofillField* confirmation_field = nullptr;
     for (auto field_it = form->begin(); field_it != form->end(); ++field_it) {
-      autofill::AutofillField* field = field_it->get();
+      AutofillField* field = field_it->get();
       if (field->server_type() == autofill::ACCOUNT_CREATION_PASSWORD ||
           field->server_type() == autofill::NEW_PASSWORD) {
-        forms_eligible_for_generation.push_back(
-            autofill::PasswordFormGenerationData{form->form_signature(),
-                                                 field->GetFieldSignature()});
-        break;
+        generation_field = field;
+      } else if (field->server_type() == autofill::CONFIRMATION_PASSWORD) {
+        confirmation_field = field;
       }
     }
+    if (generation_field) {
+      autofill::PasswordFormGenerationData data(
+          form->form_signature(), generation_field->GetFieldSignature());
+      if (confirmation_field != nullptr) {
+        data.confirmation_field_signature.emplace(
+            confirmation_field->GetFieldSignature());
+      }
+      forms_eligible_for_generation.push_back(data);
+    }
   }
   if (!forms_eligible_for_generation.empty())
     driver_->FormsEligibleForGenerationFound(forms_eligible_for_generation);
diff --git a/components/password_manager/core/browser/password_generation_manager_unittest.cc b/components/password_manager/core/browser/password_generation_manager_unittest.cc
index f5fe0637..57ed658 100644
--- a/components/password_manager/core/browser/password_generation_manager_unittest.cc
+++ b/components/password_manager/core/browser/password_generation_manager_unittest.cc
@@ -201,13 +201,15 @@
   account_creation_form.fields.push_back(password);
   autofill::FormFieldData confirm_password;
   confirm_password.label = ASCIIToUTF16("confirm_password");
-  confirm_password.name = ASCIIToUTF16("password");
+  confirm_password.name = ASCIIToUTF16("confirm_password");
   confirm_password.form_control_type = "password";
   account_creation_form.fields.push_back(confirm_password);
   autofill::FormSignature account_creation_form_signature =
       autofill::CalculateFormSignature(account_creation_form);
   autofill::FieldSignature account_creation_field_signature =
       autofill::CalculateFieldSignatureForField(password);
+  autofill::FieldSignature confirmation_field_signature =
+      autofill::CalculateFieldSignatureForField(confirm_password);
   autofill::FormStructure form2(account_creation_form);
   forms.push_back(&form2);
 
@@ -231,6 +233,7 @@
   // PASSWORD = 75
   // ACCOUNT_CREATION_PASSWORD = 76
   // NEW_PASSWORD = 88
+  // CONFIRMATION_PASSWORD = 95
   autofill::AutofillQueryResponseContents response;
   response.add_field()->set_autofill_type(9);
   response.add_field()->set_autofill_type(75);
@@ -238,7 +241,7 @@
   response.add_field()->set_autofill_type(76);
   response.add_field()->set_autofill_type(75);
   response.add_field()->set_autofill_type(88);
-  response.add_field()->set_autofill_type(88);
+  response.add_field()->set_autofill_type(95);
 
   std::string response_string;
   ASSERT_TRUE(response.SerializeToString(&response_string));
@@ -252,6 +255,9 @@
   EXPECT_EQ(
       account_creation_field_signature,
       GetTestDriver()->GetFoundEligibleForGenerationForms()[0].field_signature);
+  EXPECT_FALSE(GetTestDriver()
+                   ->GetFoundEligibleForGenerationForms()[0]
+                   .confirmation_field_signature.has_value());
 
   EXPECT_EQ(
       change_password_form_signature,
@@ -259,6 +265,13 @@
   EXPECT_EQ(
       change_password_field_signature,
       GetTestDriver()->GetFoundEligibleForGenerationForms()[1].field_signature);
+  ASSERT_TRUE(GetTestDriver()
+                  ->GetFoundEligibleForGenerationForms()[1]
+                  .confirmation_field_signature.has_value());
+  EXPECT_EQ(confirmation_field_signature,
+            GetTestDriver()
+                ->GetFoundEligibleForGenerationForms()[1]
+                .confirmation_field_signature.value());
 }
 
 TEST_F(PasswordGenerationManagerTest, UpdatePasswordSyncStateIncognito) {
diff --git a/components/policy/core/common/policy_loader_win.cc b/components/policy/core/common/policy_loader_win.cc
index b240c79..d86ae5d 100644
--- a/components/policy/core/common/policy_loader_win.cc
+++ b/components/policy/core/common/policy_loader_win.cc
@@ -213,7 +213,7 @@
 };
 
 // Global Wow64Function instance used by ScopedDisableWow64Redirection below.
-static base::LazyInstance<Wow64Functions> g_wow_64_functions =
+static base::LazyInstance<Wow64Functions>::DestructorAtExit g_wow_64_functions =
     LAZY_INSTANCE_INITIALIZER;
 
 // Scoper that switches off Wow64 File System Redirection during its lifetime.
@@ -266,8 +266,8 @@
 };
 
 // The default windows GPO list provider used for PolicyLoaderWin.
-static base::LazyInstance<WinGPOListProvider> g_win_gpo_list_provider =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<WinGPOListProvider>::DestructorAtExit
+    g_win_gpo_list_provider = LAZY_INSTANCE_INITIALIZER;
 
 // Parses |gpo_dict| according to |schema| and writes the resulting policy
 // settings to |policy| for the given |scope| and |level|.
diff --git a/components/precache/core/precache_fetcher.cc b/components/precache/core/precache_fetcher.cc
index c6ee3914..eb9b1f2 100644
--- a/components/precache/core/precache_fetcher.cc
+++ b/components/precache/core/precache_fetcher.cc
@@ -315,8 +315,40 @@
 
 void PrecacheFetcher::Fetcher::LoadFromCache() {
   fetch_stage_ = FetchStage::CACHE;
-  cache_url_fetcher_ =
-      net::URLFetcher::Create(url_, net::URLFetcher::GET, this);
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("wifi_prefetch_from_cache", R"(
+        semantics {
+          sender: "Wifi Prefetch"
+          description:
+            "Speeds up mobile web page loads by downloading some common static "
+            "assets (such as JS and CSS) for sites that the user browses "
+            "frequently, in advance of the browser needing them. Only applies "
+            "to users with tab sync enabled."
+          trigger:
+            "Background service that runs when the device is plugged into "
+            "power, on unmetered wifi, and Chromium is not in the foreground."
+          data:
+            "Local cache fetches; no data is sent over the network."
+          destination: OTHER
+        }
+        policy {
+          cookies_allowed: false
+          setting:
+            "Users can disable this feature by several settings: Disabling tab "
+            "sync via unchecking 'Open tabs' in Chromium settings under "
+            "'Advanced sync settings'; Disabling predicting required downloads "
+            "via unchecking 'Use a prediction service to load pages more "
+            "quickly' in Chromium settings under Privacy; Enabling 'Data "
+            "Saver' in Chromium settings on Android."
+          policy {
+            NetworkPredictionOptions {
+              policy_options {mode: MANDATORY}
+              NetworkPredictionOptions: 2
+            }
+          }
+        })");
+  cache_url_fetcher_ = net::URLFetcher::Create(url_, net::URLFetcher::GET, this,
+                                               traffic_annotation);
   data_use_measurement::DataUseUserData::AttachToFetcher(
       cache_url_fetcher_.get(),
       data_use_measurement::DataUseUserData::PRECACHE);
@@ -331,8 +363,80 @@
 
 void PrecacheFetcher::Fetcher::LoadFromNetwork() {
   fetch_stage_ = FetchStage::NETWORK;
-  network_url_fetcher_ =
-      net::URLFetcher::Create(url_, net::URLFetcher::GET, this);
+  if (is_resource_request_) {
+    net::NetworkTrafficAnnotationTag traffic_annotation =
+        net::DefineNetworkTrafficAnnotation(
+            "wifi_prefetch_resource_from_network", R"(
+            semantics {
+              sender: "Wifi Prefetch"
+              description:
+                "Speeds up mobile web page loads by downloading common static "
+                "assets (such as JS and CSS) for sites that the user browses "
+                "frequently, in advance of the browser needing them. Only "
+                "applies to users with tab sync enabled."
+              trigger:
+                "Background service that runs when the device is plugged into "
+                "power, on unmetered wifi, and Chromium is not in the "
+                "foreground."
+              data: "Link to the requested resrouce."
+              destination: WEBSITE
+            }
+            policy {
+              cookies_allowed: false
+              setting:
+                "Users can disable this feature by several settings: Disabling "
+                "tab sync via unchecking 'Open tabs' in Chromium settings "
+                "under 'Advanced sync settings'; Disabling predicting required "
+                "downloads via unchecking 'Use a prediction service to load "
+                "pages more quickly' in Chromium settings under Privacy; "
+                "Enabling 'Data Saver' in Chromium settings on Android."
+              policy {
+                NetworkPredictionOptions {
+                  policy_options {mode: MANDATORY}
+                  NetworkPredictionOptions: 2
+                }
+              }
+            })");
+    network_url_fetcher_ = net::URLFetcher::Create(url_, net::URLFetcher::GET,
+                                                   this, traffic_annotation);
+  } else {
+    net::NetworkTrafficAnnotationTag traffic_annotation =
+        net::DefineNetworkTrafficAnnotation("wifi_prefetch_sites_from_network",
+                                            R"(
+          semantics {
+            sender: "Wifi Prefetch"
+            description:
+              "Speeds up mobile web page loads by downloading common static "
+              "assets (such as JS and CSS) for sites that the user browses "
+              "frequently, in advance of the browser needing them. The first "
+              "step is to download the list of common static assets from "
+              "Google. Only applies to users with tab sync enabled."
+            trigger:
+              "Background service that runs when the device is plugged into "
+              "power, on unmetered wifi, and Chromium is not in the foreground."
+            data: "A list of the top hosts that the user visits."
+            destination: GOOGLE_OWNED_SERVICE
+          }
+          policy {
+            cookies_allowed: false
+            setting:
+              "Users can disable this feature by several settings: Disabling "
+              "tab sync via unchecking 'Open tabs' in Chromium settings under "
+              "'Advanced sync settings'; Disabling predicting required "
+              "downloads via unchecking 'Use a prediction service to load "
+              "pages more quickly' in Chromium settings under Privacy; "
+              "Enabling 'Data Saver' in Chromium settings on Android."
+            policy {
+              NetworkPredictionOptions {
+                policy_options {mode: MANDATORY}
+                NetworkPredictionOptions: 2
+              }
+            }
+          })");
+    network_url_fetcher_ = net::URLFetcher::Create(url_, net::URLFetcher::GET,
+                                                   this, traffic_annotation);
+  }
+
   data_use_measurement::DataUseUserData::AttachToFetcher(
       network_url_fetcher_.get(),
       data_use_measurement::DataUseUserData::PRECACHE);
diff --git a/components/proximity_auth/logging/logging_unittest.cc b/components/proximity_auth/logging/logging_unittest.cc
index 9efc5d7..406c50df 100644
--- a/components/proximity_auth/logging/logging_unittest.cc
+++ b/components/proximity_auth/logging/logging_unittest.cc
@@ -22,7 +22,7 @@
 
 // Called for every log message added to the standard logging system. The new
 // log is saved in |g_standard_logs| and consumed so it does not flood stdout.
-base::LazyInstance<std::vector<std::string>> g_standard_logs =
+base::LazyInstance<std::vector<std::string>>::DestructorAtExit g_standard_logs =
     LAZY_INSTANCE_INITIALIZER;
 bool HandleStandardLogMessage(int severity,
                               const char* file,
diff --git a/components/proximity_auth/screenlock_bridge.cc b/components/proximity_auth/screenlock_bridge.cc
index 0663dda..e5ca4f2 100644
--- a/components/proximity_auth/screenlock_bridge.cc
+++ b/components/proximity_auth/screenlock_bridge.cc
@@ -16,8 +16,8 @@
 namespace proximity_auth {
 namespace {
 
-base::LazyInstance<ScreenlockBridge> g_screenlock_bridge_instance =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<ScreenlockBridge>::DestructorAtExit
+    g_screenlock_bridge_instance = LAZY_INSTANCE_INITIALIZER;
 
 // Ids for the icons that are supported by lock screen and signin screen
 // account picker as user pod custom icons.
diff --git a/components/proximity_auth/screenlock_bridge.h b/components/proximity_auth/screenlock_bridge.h
index 3fabff6..4554609 100644
--- a/components/proximity_auth/screenlock_bridge.h
+++ b/components/proximity_auth/screenlock_bridge.h
@@ -171,7 +171,7 @@
   const AccountId& focused_account_id() const { return focused_account_id_; }
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<ScreenlockBridge>;
+  friend struct base::LazyInstanceTraitsBase<ScreenlockBridge>;
   friend std::default_delete<ScreenlockBridge>;
 
   ScreenlockBridge();
diff --git a/components/ssl_errors/error_classification.cc b/components/ssl_errors/error_classification.cc
index 572b5729..2ce6dbbd 100644
--- a/components/ssl_errors/error_classification.cc
+++ b/components/ssl_errors/error_classification.cc
@@ -114,7 +114,8 @@
 }
 
 // The time to use when doing build time operations in browser tests.
-base::LazyInstance<base::Time> g_testing_build_time = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<base::Time>::DestructorAtExit g_testing_build_time =
+    LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/components/sync/model_impl/model_type_store_backend.cc b/components/sync/model_impl/model_type_store_backend.cc
index ec474d2..afc6fe8 100644
--- a/components/sync/model_impl/model_type_store_backend.cc
+++ b/components/sync/model_impl/model_type_store_backend.cc
@@ -32,7 +32,7 @@
     "Sync.ModelTypeStoreInitResult";
 
 // static
-base::LazyInstance<ModelTypeStoreBackend::BackendMap>
+base::LazyInstance<ModelTypeStoreBackend::BackendMap>::DestructorAtExit
     ModelTypeStoreBackend::backend_map_ = LAZY_INSTANCE_INITIALIZER;
 
 namespace {
diff --git a/components/sync/model_impl/model_type_store_backend.h b/components/sync/model_impl/model_type_store_backend.h
index d7887bc..b185977b 100644
--- a/components/sync/model_impl/model_type_store_backend.h
+++ b/components/sync/model_impl/model_type_store_backend.h
@@ -151,7 +151,7 @@
   // GetOrCreateBackend will return scoped_refptr of backend. backend_map_
   // doesn't take reference to backend, therefore doesn't block backend
   // destruction.
-  static base::LazyInstance<BackendMap> backend_map_;
+  static base::LazyInstance<BackendMap>::DestructorAtExit backend_map_;
 
   // Macro wrapped mutex to guard against concurrent calls in debug builds.
   DFAKE_MUTEX(push_pop_);
diff --git a/components/url_matcher/url_matcher_factory.cc b/components/url_matcher/url_matcher_factory.cc
index 5793f68..0a30497 100644
--- a/components/url_matcher/url_matcher_factory.cc
+++ b/components/url_matcher/url_matcher_factory.cc
@@ -98,7 +98,7 @@
   DISALLOW_COPY_AND_ASSIGN(URLMatcherConditionFactoryMethods);
 };
 
-static base::LazyInstance<URLMatcherConditionFactoryMethods>
+static base::LazyInstance<URLMatcherConditionFactoryMethods>::DestructorAtExit
     g_url_matcher_condition_factory_methods = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
diff --git a/content/app/android/child_process_service_impl.cc b/content/app/android/child_process_service_impl.cc
index ee268ad..192d3b8 100644
--- a/content/app/android/child_process_service_impl.cc
+++ b/content/app/android/child_process_service_impl.cc
@@ -94,7 +94,7 @@
   }
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<ChildProcessSurfaceManager>;
+  friend struct base::LazyInstanceTraitsBase<ChildProcessSurfaceManager>;
   // The instance of org.chromium.content.app.ChildProcessServiceImpl.
   base::android::ScopedJavaGlobalRef<jobject> service_impl_;
 
diff --git a/content/app/android/content_main.cc b/content/app/android/content_main.cc
index 1c82788b..d6a1eec 100644
--- a/content/app/android/content_main.cc
+++ b/content/app/android/content_main.cc
@@ -23,11 +23,11 @@
 namespace content {
 
 namespace {
-LazyInstance<std::unique_ptr<ContentMainRunner>> g_content_runner =
-    LAZY_INSTANCE_INITIALIZER;
+LazyInstance<std::unique_ptr<ContentMainRunner>>::DestructorAtExit
+    g_content_runner = LAZY_INSTANCE_INITIALIZER;
 
-LazyInstance<std::unique_ptr<ContentMainDelegate>> g_content_main_delegate =
-    LAZY_INSTANCE_INITIALIZER;
+LazyInstance<std::unique_ptr<ContentMainDelegate>>::DestructorAtExit
+    g_content_main_delegate = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/content/app/content_main_runner.cc b/content/app/content_main_runner.cc
index c2839221..aab03f3 100644
--- a/content/app/content_main_runner.cc
+++ b/content/app/content_main_runner.cc
@@ -226,16 +226,16 @@
 }  // namespace
 
 #if !defined(CHROME_MULTIPLE_DLL_CHILD)
-base::LazyInstance<ContentBrowserClient>
+base::LazyInstance<ContentBrowserClient>::DestructorAtExit
     g_empty_content_browser_client = LAZY_INSTANCE_INITIALIZER;
 #endif  //  !CHROME_MULTIPLE_DLL_CHILD
 
 #if !defined(CHROME_MULTIPLE_DLL_BROWSER)
-base::LazyInstance<ContentGpuClient>
+base::LazyInstance<ContentGpuClient>::DestructorAtExit
     g_empty_content_gpu_client = LAZY_INSTANCE_INITIALIZER;
-base::LazyInstance<ContentRendererClient>
+base::LazyInstance<ContentRendererClient>::DestructorAtExit
     g_empty_content_renderer_client = LAZY_INSTANCE_INITIALIZER;
-base::LazyInstance<ContentUtilityClient>
+base::LazyInstance<ContentUtilityClient>::DestructorAtExit
     g_empty_content_utility_client = LAZY_INSTANCE_INITIALIZER;
 #endif  // !CHROME_MULTIPLE_DLL_BROWSER
 
diff --git a/content/browser/accessibility/browser_accessibility.cc b/content/browser/accessibility/browser_accessibility.cc
index 22518632..4f5fc90 100644
--- a/content/browser/accessibility/browser_accessibility.cc
+++ b/content/browser/accessibility/browser_accessibility.cc
@@ -25,8 +25,8 @@
 
 // Map from unique_id to BrowserAccessibility
 using UniqueIDMap = base::hash_map<int32_t, BrowserAccessibility*>;
-base::LazyInstance<UniqueIDMap> g_unique_id_map = LAZY_INSTANCE_INITIALIZER;
-
+base::LazyInstance<UniqueIDMap>::DestructorAtExit g_unique_id_map =
+    LAZY_INSTANCE_INITIALIZER;
 }
 
 #if !defined(PLATFORM_HAS_NATIVE_ACCESSIBILITY_IMPL)
diff --git a/content/browser/accessibility/browser_accessibility_manager.cc b/content/browser/accessibility/browser_accessibility_manager.cc
index 971e831..144d5c13 100644
--- a/content/browser/accessibility/browser_accessibility_manager.cc
+++ b/content/browser/accessibility/browser_accessibility_manager.cc
@@ -42,11 +42,12 @@
 // Map from AXTreeID to BrowserAccessibilityManager
 using AXTreeIDMap = base::hash_map<ui::AXTreeIDRegistry::AXTreeID,
                                    BrowserAccessibilityManager*>;
-base::LazyInstance<AXTreeIDMap> g_ax_tree_id_map = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<AXTreeIDMap>::DestructorAtExit g_ax_tree_id_map =
+    LAZY_INSTANCE_INITIALIZER;
 
 // A function to call when focus changes, for testing only.
-base::LazyInstance<base::Closure> g_focus_change_callback_for_testing =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<base::Closure>::DestructorAtExit
+    g_focus_change_callback_for_testing = LAZY_INSTANCE_INITIALIZER;
 
 ui::AXTreeUpdate MakeAXTreeUpdate(
     const ui::AXNodeData& node1,
diff --git a/content/browser/accessibility/browser_accessibility_manager_android.cc b/content/browser/accessibility/browser_accessibility_manager_android.cc
index 1c405791..dd398a4e 100644
--- a/content/browser/accessibility/browser_accessibility_manager_android.cc
+++ b/content/browser/accessibility/browser_accessibility_manager_android.cc
@@ -30,9 +30,9 @@
 
 using SearchKeyToPredicateMap =
     base::hash_map<base::string16, AccessibilityMatchPredicate>;
-base::LazyInstance<SearchKeyToPredicateMap> g_search_key_to_predicate_map =
-    LAZY_INSTANCE_INITIALIZER;
-base::LazyInstance<base::string16> g_all_search_keys =
+base::LazyInstance<SearchKeyToPredicateMap>::DestructorAtExit
+    g_search_key_to_predicate_map = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<base::string16>::DestructorAtExit g_all_search_keys =
     LAZY_INSTANCE_INITIALIZER;
 
 bool SectionPredicate(
diff --git a/content/browser/android/content_view_statics.cc b/content/browser/android/content_view_statics.cc
index b0f43af..1110b75d 100644
--- a/content/browser/android/content_view_statics.cc
+++ b/content/browser/android/content_view_statics.cc
@@ -92,8 +92,8 @@
   std::vector<int /* RenderProcessHost id */> suspended_processes_;
 };
 
-base::LazyInstance<SuspendedProcessWatcher> g_suspended_processes_watcher =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<SuspendedProcessWatcher>::DestructorAtExit
+    g_suspended_processes_watcher = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/content/browser/android/java/java_bridge_thread.cc b/content/browser/android/java/java_bridge_thread.cc
index 4c8b24ed..b0b39d31 100644
--- a/content/browser/android/java/java_bridge_thread.cc
+++ b/content/browser/android/java/java_bridge_thread.cc
@@ -18,7 +18,7 @@
 
 namespace {
 
-base::LazyInstance<JavaBridgeThread> g_background_thread =
+base::LazyInstance<JavaBridgeThread>::DestructorAtExit g_background_thread =
     LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
diff --git a/content/browser/android/java/jni_helper.cc b/content/browser/android/java/jni_helper.cc
index 09026e7..f9cd640 100644
--- a/content/browser/android/java/jni_helper.cc
+++ b/content/browser/android/java/jni_helper.cc
@@ -44,7 +44,8 @@
 const base::subtle::AtomicWord kLocked = 1;
 base::subtle::AtomicWord g_method_id_map_lock = kUnlocked;
 
-base::LazyInstance<MethodIDMap> g_method_id_map = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<MethodIDMap>::DestructorAtExit g_method_id_map =
+    LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/content/browser/appcache/appcache_navigation_handle_core.cc b/content/browser/appcache/appcache_navigation_handle_core.cc
index 8cfdaa4..83a6ccf 100644
--- a/content/browser/appcache/appcache_navigation_handle_core.cc
+++ b/content/browser/appcache/appcache_navigation_handle_core.cc
@@ -21,7 +21,8 @@
 // Accessed on the IO thread only.
 using AppCacheHandleMap =
     std::map <int, content::AppCacheNavigationHandleCore*>;
-base::LazyInstance<AppCacheHandleMap> g_appcache_handle_map;
+base::LazyInstance<AppCacheHandleMap>::DestructorAtExit g_appcache_handle_map =
+    LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/content/browser/bluetooth/bluetooth_blocklist.h b/content/browser/bluetooth/bluetooth_blocklist.h
index 78e3b8a..71807e41c 100644
--- a/content/browser/bluetooth/bluetooth_blocklist.h
+++ b/content/browser/bluetooth/bluetooth_blocklist.h
@@ -85,7 +85,7 @@
 
  private:
   // friend LazyInstance to permit access to private constructor.
-  friend base::DefaultLazyInstanceTraits<BluetoothBlocklist>;
+  friend base::LazyInstanceTraitsBase<BluetoothBlocklist>;
 
   BluetoothBlocklist();
 
diff --git a/content/browser/browser_child_process_host_impl.cc b/content/browser/browser_child_process_host_impl.cc
index 71bf559..f226027 100644
--- a/content/browser/browser_child_process_host_impl.cc
+++ b/content/browser/browser_child_process_host_impl.cc
@@ -58,11 +58,12 @@
 namespace content {
 namespace {
 
-static base::LazyInstance<BrowserChildProcessHostImpl::BrowserChildProcessList>
+static base::LazyInstance<
+    BrowserChildProcessHostImpl::BrowserChildProcessList>::DestructorAtExit
     g_child_process_list = LAZY_INSTANCE_INITIALIZER;
 
-base::LazyInstance<base::ObserverList<BrowserChildProcessObserver>>
-    g_observers = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<base::ObserverList<BrowserChildProcessObserver>>::
+    DestructorAtExit g_observers = LAZY_INSTANCE_INITIALIZER;
 
 void NotifyProcessLaunchedAndConnected(const ChildProcessData& data) {
   for (auto& observer : g_observers.Get())
diff --git a/content/browser/browser_context.cc b/content/browser/browser_context.cc
index 45534c35..b9ccb06 100644
--- a/content/browser/browser_context.cc
+++ b/content/browser/browser_context.cc
@@ -54,7 +54,7 @@
 
 namespace {
 
-base::LazyInstance<std::map<std::string, BrowserContext*>>
+base::LazyInstance<std::map<std::string, BrowserContext*>>::DestructorAtExit
     g_user_id_to_context = LAZY_INSTANCE_INITIALIZER;
 
 class ServiceUserIdHolder : public base::SupportsUserData::Data {
diff --git a/content/browser/frame_host/frame_tree_node.cc b/content/browser/frame_host/frame_tree_node.cc
index 655c4609..78bbf40 100644
--- a/content/browser/frame_host/frame_tree_node.cc
+++ b/content/browser/frame_host/frame_tree_node.cc
@@ -32,8 +32,8 @@
 // FrameTreeNodes.
 typedef base::hash_map<int, FrameTreeNode*> FrameTreeNodeIdMap;
 
-base::LazyInstance<FrameTreeNodeIdMap> g_frame_tree_node_id_map =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<FrameTreeNodeIdMap>::DestructorAtExit
+    g_frame_tree_node_id_map = LAZY_INSTANCE_INITIALIZER;
 
 // These values indicate the loading progress status. The minimum progress
 // value matches what Blink's ProgressTracker has traditionally used for a
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index 88cf70c..64c719c 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -149,7 +149,7 @@
 typedef std::pair<int32_t, int32_t> RenderFrameHostID;
 typedef base::hash_map<RenderFrameHostID, RenderFrameHostImpl*>
     RoutingIDFrameMap;
-base::LazyInstance<RoutingIDFrameMap> g_routing_id_frame_map =
+base::LazyInstance<RoutingIDFrameMap>::DestructorAtExit g_routing_id_frame_map =
     LAZY_INSTANCE_INITIALIZER;
 
 // Translate a WebKit text direction into a base::i18n one.
diff --git a/content/browser/frame_host/render_frame_proxy_host.cc b/content/browser/frame_host/render_frame_proxy_host.cc
index 42cdb39..1107e77f 100644
--- a/content/browser/frame_host/render_frame_proxy_host.cc
+++ b/content/browser/frame_host/render_frame_proxy_host.cc
@@ -30,9 +30,8 @@
 typedef std::pair<int32_t, int32_t> RenderFrameProxyHostID;
 typedef base::hash_map<RenderFrameProxyHostID, RenderFrameProxyHost*>
     RoutingIDFrameProxyMap;
-base::LazyInstance<RoutingIDFrameProxyMap> g_routing_id_frame_proxy_map =
-  LAZY_INSTANCE_INITIALIZER;
-
+base::LazyInstance<RoutingIDFrameProxyMap>::DestructorAtExit
+    g_routing_id_frame_proxy_map = LAZY_INSTANCE_INITIALIZER;
 }
 
 // static
diff --git a/content/browser/gpu/gpu_process_host_ui_shim.cc b/content/browser/gpu/gpu_process_host_ui_shim.cc
index a662106..ceab9a2 100644
--- a/content/browser/gpu/gpu_process_host_ui_shim.cc
+++ b/content/browser/gpu/gpu_process_host_ui_shim.cc
@@ -40,8 +40,8 @@
 #undef DestroyAll
 #endif
 
-base::LazyInstance<IDMap<GpuProcessHostUIShim*>> g_hosts_by_id =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<IDMap<GpuProcessHostUIShim*>>::DestructorAtExit
+    g_hosts_by_id = LAZY_INSTANCE_INITIALIZER;
 
 void StopGpuProcessOnIO(int host_id) {
   GpuProcessHost* host = GpuProcessHost::FromID(host_id);
diff --git a/content/browser/indexed_db/indexed_db_class_factory.h b/content/browser/indexed_db/indexed_db_class_factory.h
index 6f216e6..3c218f0 100644
--- a/content/browser/indexed_db/indexed_db_class_factory.h
+++ b/content/browser/indexed_db/indexed_db_class_factory.h
@@ -63,7 +63,7 @@
  protected:
   IndexedDBClassFactory() {}
   virtual ~IndexedDBClassFactory() {}
-  friend struct base::DefaultLazyInstanceTraits<IndexedDBClassFactory>;
+  friend struct base::LazyInstanceTraitsBase<IndexedDBClassFactory>;
 };
 
 }  // namespace content
diff --git a/content/browser/indexed_db/leveldb/leveldb_env.h b/content/browser/indexed_db/leveldb/leveldb_env.h
index ac606ed..9debbaf 100644
--- a/content/browser/indexed_db/leveldb/leveldb_env.h
+++ b/content/browser/indexed_db/leveldb/leveldb_env.h
@@ -16,7 +16,7 @@
   LevelDBEnv();
 
  public:
-  friend struct base::DefaultLazyInstanceTraits<LevelDBEnv>;
+  friend struct base::LazyInstanceTraitsBase<LevelDBEnv>;
 
   CONTENT_EXPORT static LevelDBEnv* Get();
 };
diff --git a/content/browser/notification_service_impl.cc b/content/browser/notification_service_impl.cc
index b732ca7..de21769 100644
--- a/content/browser/notification_service_impl.cc
+++ b/content/browser/notification_service_impl.cc
@@ -13,8 +13,8 @@
 
 namespace {
 
-base::LazyInstance<base::ThreadLocalPointer<NotificationServiceImpl> >
-    lazy_tls_ptr = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<base::ThreadLocalPointer<NotificationServiceImpl>>::
+    DestructorAtExit lazy_tls_ptr = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/content/browser/renderer_host/browser_compositor_view_mac.mm b/content/browser/renderer_host/browser_compositor_view_mac.mm
index e4c25e73..4971cac 100644
--- a/content/browser/renderer_host/browser_compositor_view_mac.mm
+++ b/content/browser/renderer_host/browser_compositor_view_mac.mm
@@ -33,8 +33,8 @@
 uint32_t g_browser_compositor_count = 0;
 
 // A spare RecyclableCompositorMac kept around for recycling.
-base::LazyInstance<std::deque<std::unique_ptr<RecyclableCompositorMac>>>
-    g_spare_recyclable_compositors;
+base::LazyInstance<std::deque<std::unique_ptr<RecyclableCompositorMac>>>::
+    DestructorAtExit g_spare_recyclable_compositors;
 
 void ReleaseSpareCompositors() {
   // Allow at most one spare recyclable compositor.
diff --git a/content/browser/renderer_host/compositor_impl_android.cc b/content/browser/renderer_host/compositor_impl_android.cc
index 132e085..49692ad 100644
--- a/content/browser/renderer_host/compositor_impl_android.cc
+++ b/content/browser/renderer_host/compositor_impl_android.cc
@@ -104,8 +104,8 @@
 #endif
 };
 
-base::LazyInstance<CompositorDependencies> g_compositor_dependencies =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<CompositorDependencies>::DestructorAtExit
+    g_compositor_dependencies = LAZY_INSTANCE_INITIALIZER;
 
 const unsigned int kMaxDisplaySwapBuffers = 1U;
 
diff --git a/content/browser/renderer_host/render_widget_helper.cc b/content/browser/renderer_host/render_widget_helper.cc
index ddc2e13..6cca1d74 100644
--- a/content/browser/renderer_host/render_widget_helper.cc
+++ b/content/browser/renderer_host/render_widget_helper.cc
@@ -21,7 +21,7 @@
 namespace {
 
 typedef std::map<int, RenderWidgetHelper*> WidgetHelperMap;
-base::LazyInstance<WidgetHelperMap> g_widget_helpers =
+base::LazyInstance<WidgetHelperMap>::DestructorAtExit g_widget_helpers =
     LAZY_INSTANCE_INITIALIZER;
 
 void AddWidgetHelper(int render_process_id,
diff --git a/content/browser/renderer_host/render_widget_host_impl.cc b/content/browser/renderer_host/render_widget_host_impl.cc
index 4afec65e..013d439 100644
--- a/content/browser/renderer_host/render_widget_host_impl.cc
+++ b/content/browser/renderer_host/render_widget_host_impl.cc
@@ -127,8 +127,8 @@
 using RenderWidgetHostID = std::pair<int32_t, int32_t>;
 using RoutingIDWidgetMap =
     base::hash_map<RenderWidgetHostID, RenderWidgetHostImpl*>;
-base::LazyInstance<RoutingIDWidgetMap> g_routing_id_widget_map =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<RoutingIDWidgetMap>::DestructorAtExit
+    g_routing_id_widget_map = LAZY_INSTANCE_INITIALIZER;
 
 // Implements the RenderWidgetHostIterator interface. It keeps a list of
 // RenderWidgetHosts, and makes sure it returns a live RenderWidgetHost at each
diff --git a/content/browser/service_worker/service_worker_context_wrapper.cc b/content/browser/service_worker/service_worker_context_wrapper.cc
index 69ffa22..9f3c72b8 100644
--- a/content/browser/service_worker/service_worker_context_wrapper.cc
+++ b/content/browser/service_worker/service_worker_context_wrapper.cc
@@ -43,7 +43,7 @@
 namespace {
 
 typedef std::set<std::string> HeaderNameSet;
-base::LazyInstance<HeaderNameSet> g_excluded_header_name_set =
+base::LazyInstance<HeaderNameSet>::DestructorAtExit g_excluded_header_name_set =
     LAZY_INSTANCE_INITIALIZER;
 
 void RunSoon(const base::Closure& closure) {
diff --git a/content/browser/tracing/background_tracing_manager_impl.h b/content/browser/tracing/background_tracing_manager_impl.h
index a6947f8..637c70d 100644
--- a/content/browser/tracing/background_tracing_manager_impl.h
+++ b/content/browser/tracing/background_tracing_manager_impl.h
@@ -107,7 +107,7 @@
   base::Closure tracing_enabled_callback_for_testing_;
   base::Closure rule_triggered_callback_for_testing_;
 
-  friend struct base::DefaultLazyInstanceTraits<BackgroundTracingManagerImpl>;
+  friend struct base::LazyInstanceTraitsBase<BackgroundTracingManagerImpl>;
 
   DISALLOW_COPY_AND_ASSIGN(BackgroundTracingManagerImpl);
 };
diff --git a/content/browser/tracing/tracing_controller_impl.h b/content/browser/tracing/tracing_controller_impl.h
index 0c7b8ea7..9d18406 100644
--- a/content/browser/tracing/tracing_controller_impl.h
+++ b/content/browser/tracing/tracing_controller_impl.h
@@ -103,7 +103,7 @@
   void RemoveTraceMessageFilterObserver(TraceMessageFilterObserver* observer);
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<TracingControllerImpl>;
+  friend struct base::LazyInstanceTraitsBase<TracingControllerImpl>;
   friend class TraceMessageFilter;
 
   // The arguments and callback for an queued global memory dump request.
diff --git a/content/browser/web_contents/web_contents_android.cc b/content/browser/web_contents/web_contents_android.cc
index a93fad88..a61609a5 100644
--- a/content/browser/web_contents/web_contents_android.cc
+++ b/content/browser/web_contents/web_contents_android.cc
@@ -60,7 +60,7 @@
 
 // Track all WebContentsAndroid objects here so that we don't deserialize a
 // destroyed WebContents object.
-base::LazyInstance<base::hash_set<WebContentsAndroid*> >::Leaky
+base::LazyInstance<base::hash_set<WebContentsAndroid*>>::Leaky
     g_allocated_web_contents_androids = LAZY_INSTANCE_INITIALIZER;
 
 void JavaScriptResultCallback(const ScopedJavaGlobalRef<jobject>& callback,
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index 74342493..cf3ec721 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -176,8 +176,8 @@
 const char kWebContentsAndroidKey[] = "web_contents_android";
 #endif  // OS_ANDROID
 
-base::LazyInstance<std::vector<WebContentsImpl::CreatedCallback> >
-g_created_callbacks = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<std::vector<WebContentsImpl::CreatedCallback>>::
+    DestructorAtExit g_created_callbacks = LAZY_INSTANCE_INITIALIZER;
 
 void NotifyCacheOnIO(
     scoped_refptr<net::URLRequestContextGetter> request_context,
diff --git a/content/browser/webrtc/webrtc_internals.h b/content/browser/webrtc/webrtc_internals.h
index f2cde8a7..cc5324f 100644
--- a/content/browser/webrtc/webrtc_internals.h
+++ b/content/browser/webrtc/webrtc_internals.h
@@ -123,7 +123,7 @@
   ~WebRTCInternals() override;
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<WebRTCInternals>;
+  friend struct base::LazyInstanceTraitsBase<WebRTCInternals>;
   FRIEND_TEST_ALL_PREFIXES(WebRtcAudioDebugRecordingsBrowserTest,
                            CallWithAudioDebugRecordings);
   FRIEND_TEST_ALL_PREFIXES(WebRtcAudioDebugRecordingsBrowserTest,
diff --git a/content/browser/webui/web_ui_controller_factory_registry.cc b/content/browser/webui/web_ui_controller_factory_registry.cc
index 240c4db..b151e32 100644
--- a/content/browser/webui/web_ui_controller_factory_registry.cc
+++ b/content/browser/webui/web_ui_controller_factory_registry.cc
@@ -13,8 +13,8 @@
 
 namespace content {
 
-base::LazyInstance<std::vector<WebUIControllerFactory*> > g_factories =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<std::vector<WebUIControllerFactory*>>::DestructorAtExit
+    g_factories = LAZY_INSTANCE_INITIALIZER;
 
 void WebUIControllerFactory::RegisterFactory(WebUIControllerFactory* factory) {
   g_factories.Pointer()->push_back(factory);
diff --git a/content/child/blob_storage/blob_transport_controller.h b/content/child/blob_storage/blob_transport_controller.h
index a3065ec..43a8606 100644
--- a/content/child/blob_storage/blob_transport_controller.h
+++ b/content/child/blob_storage/blob_transport_controller.h
@@ -26,7 +26,7 @@
 
 namespace base {
 template <typename T>
-struct DefaultLazyInstanceTraits;
+struct LazyInstanceTraitsBase;
 class SingleThreadTaskRunner;
 class TaskRunner;
 }
@@ -100,7 +100,7 @@
   void CancelAllBlobTransfers();
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<BlobTransportController>;
+  friend struct base::LazyInstanceTraitsBase<BlobTransportController>;
   friend class BlobTransportControllerTest;
   FRIEND_TEST_ALL_PREFIXES(BlobTransportControllerTest, Descriptions);
   FRIEND_TEST_ALL_PREFIXES(BlobTransportControllerTest, Responses);
diff --git a/content/child/child_process.cc b/content/child/child_process.cc
index 49aa72c..6d713f4 100644
--- a/content/child/child_process.cc
+++ b/content/child/child_process.cc
@@ -31,9 +31,8 @@
 namespace content {
 
 namespace {
-
-base::LazyInstance<base::ThreadLocalPointer<ChildProcess> > g_lazy_tls =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<base::ThreadLocalPointer<ChildProcess>>::DestructorAtExit
+    g_lazy_tls = LAZY_INSTANCE_INITIALIZER;
 }
 
 ChildProcess::ChildProcess(
diff --git a/content/child/child_thread_impl.cc b/content/child/child_thread_impl.cc
index 0e42540..071b20f0 100644
--- a/content/child/child_thread_impl.cc
+++ b/content/child/child_thread_impl.cc
@@ -85,8 +85,8 @@
 // How long to wait for a connection to the browser process before giving up.
 const int kConnectionTimeoutS = 15;
 
-base::LazyInstance<base::ThreadLocalPointer<ChildThreadImpl> > g_lazy_tls =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<base::ThreadLocalPointer<ChildThreadImpl>>::DestructorAtExit
+    g_lazy_tls = LAZY_INSTANCE_INITIALIZER;
 
 // This isn't needed on Windows because there the sandbox's job object
 // terminates child processes automatically. For unsandboxed processes (i.e.
@@ -226,7 +226,8 @@
   closure_.Run();
 }
 
-base::LazyInstance<QuitClosure> g_quit_closure = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<QuitClosure>::DestructorAtExit g_quit_closure =
+    LAZY_INSTANCE_INITIALIZER;
 #endif
 
 void InitializeMojoIPCChannel() {
diff --git a/content/child/fileapi/webfilesystem_impl.cc b/content/child/fileapi/webfilesystem_impl.cc
index 2773728..730d4243 100644
--- a/content/child/fileapi/webfilesystem_impl.cc
+++ b/content/child/fileapi/webfilesystem_impl.cc
@@ -83,7 +83,7 @@
 
 typedef WebFileSystemImpl::WaitableCallbackResults WaitableCallbackResults;
 
-base::LazyInstance<base::ThreadLocalPointer<WebFileSystemImpl> >::Leaky
+base::LazyInstance<base::ThreadLocalPointer<WebFileSystemImpl>>::Leaky
     g_webfilesystem_tls = LAZY_INSTANCE_INITIALIZER;
 
 void DidReceiveSnapshotFile(int request_id) {
diff --git a/content/child/indexed_db/indexed_db_dispatcher.cc b/content/child/indexed_db/indexed_db_dispatcher.cc
index 59c63aa..a920c10f 100644
--- a/content/child/indexed_db/indexed_db_dispatcher.cc
+++ b/content/child/indexed_db/indexed_db_dispatcher.cc
@@ -20,7 +20,7 @@
 using base::ThreadLocalPointer;
 
 namespace content {
-static base::LazyInstance<ThreadLocalPointer<IndexedDBDispatcher> >::Leaky
+static base::LazyInstance<ThreadLocalPointer<IndexedDBDispatcher>>::Leaky
     g_idb_dispatcher_tls = LAZY_INSTANCE_INITIALIZER;
 
 namespace {
diff --git a/content/child/quota_dispatcher.cc b/content/child/quota_dispatcher.cc
index 1b70cb7..5e1950a 100644
--- a/content/child/quota_dispatcher.cc
+++ b/content/child/quota_dispatcher.cc
@@ -27,7 +27,7 @@
 
 namespace content {
 
-static base::LazyInstance<base::ThreadLocalPointer<QuotaDispatcher> >::Leaky
+static base::LazyInstance<base::ThreadLocalPointer<QuotaDispatcher>>::Leaky
     g_quota_dispatcher_tls = LAZY_INSTANCE_INITIALIZER;
 
 namespace {
diff --git a/content/child/worker_thread_registry.cc b/content/child/worker_thread_registry.cc
index f3d6fc5b..cba1075 100644
--- a/content/child/worker_thread_registry.cc
+++ b/content/child/worker_thread_registry.cc
@@ -26,8 +26,8 @@
     base::ThreadLocalPointer<WorkerThreadObservers>;
 
 // Stores a WorkerThreadObservers instance per thread.
-base::LazyInstance<ThreadLocalWorkerThreadObservers> g_observers_tls =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<ThreadLocalWorkerThreadObservers>::DestructorAtExit
+    g_observers_tls = LAZY_INSTANCE_INITIALIZER;
 
 // A task-runner that refuses to run any tasks.
 class DoNothingTaskRunner : public base::TaskRunner {
diff --git a/content/common/host_shared_bitmap_manager.cc b/content/common/host_shared_bitmap_manager.cc
index 51f4fc79..f424ac3 100644
--- a/content/common/host_shared_bitmap_manager.cc
+++ b/content/common/host_shared_bitmap_manager.cc
@@ -57,8 +57,8 @@
 
 }  // namespace
 
-base::LazyInstance<HostSharedBitmapManager> g_shared_memory_manager =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<HostSharedBitmapManager>::DestructorAtExit
+    g_shared_memory_manager = LAZY_INSTANCE_INITIALIZER;
 
 HostSharedBitmapManagerClient::HostSharedBitmapManagerClient(
     HostSharedBitmapManager* manager)
diff --git a/content/common/media/cdm_host_files.cc b/content/common/media/cdm_host_files.cc
index 637891e8..1310403e 100644
--- a/content/common/media/cdm_host_files.cc
+++ b/content/common/media/cdm_host_files.cc
@@ -98,8 +98,8 @@
 
 // A global instance used on platforms where we have to open the files in the
 // Zygote process.
-base::LazyInstance<std::unique_ptr<CdmHostFiles>> g_cdm_host_files =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<std::unique_ptr<CdmHostFiles>>::DestructorAtExit
+    g_cdm_host_files = LAZY_INSTANCE_INITIALIZER;
 #endif
 
 }  // namespace
diff --git a/content/common/plugin_list.cc b/content/common/plugin_list.cc
index 9d650aa..76a44b4 100644
--- a/content/common/plugin_list.cc
+++ b/content/common/plugin_list.cc
@@ -24,7 +24,8 @@
 
 namespace {
 
-base::LazyInstance<PluginList> g_singleton = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<PluginList>::DestructorAtExit g_singleton =
+    LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/content/common/plugin_list.h b/content/common/plugin_list.h
index e96fca34..0504985 100644
--- a/content/common/plugin_list.h
+++ b/content/common/plugin_list.h
@@ -132,7 +132,7 @@
   };
 
   friend class PluginListTest;
-  friend struct base::DefaultLazyInstanceTraits<PluginList>;
+  friend struct base::LazyInstanceTraitsBase<PluginList>;
 
   PluginList();
 
diff --git a/content/gpu/gpu_child_thread.cc b/content/gpu/gpu_child_thread.cc
index 4d8a952..70e6190 100644
--- a/content/gpu/gpu_child_thread.cc
+++ b/content/gpu/gpu_child_thread.cc
@@ -57,7 +57,7 @@
 namespace content {
 namespace {
 
-static base::LazyInstance<scoped_refptr<ThreadSafeSender> >
+static base::LazyInstance<scoped_refptr<ThreadSafeSender>>::DestructorAtExit
     g_thread_safe_sender = LAZY_INSTANCE_INITIALIZER;
 
 bool GpuProcessLogMessageHandler(int severity,
diff --git a/content/gpu/gpu_main.cc b/content/gpu/gpu_main.cc
index 74fe460..31fcf7e 100644
--- a/content/gpu/gpu_main.cc
+++ b/content/gpu/gpu_main.cc
@@ -104,8 +104,8 @@
 bool StartSandboxWindows(const sandbox::SandboxInterfaceInfo*);
 #endif
 
-base::LazyInstance<GpuChildThread::DeferredMessages> deferred_messages =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<GpuChildThread::DeferredMessages>::DestructorAtExit
+    deferred_messages = LAZY_INSTANCE_INITIALIZER;
 
 bool GpuProcessLogMessageHandler(int severity,
                                  const char* file, int line,
diff --git a/content/public/renderer/render_frame_observer_tracker.h b/content/public/renderer/render_frame_observer_tracker.h
index 563a5c2..90dfb17 100644
--- a/content/public/renderer/render_frame_observer_tracker.h
+++ b/content/public/renderer/render_frame_observer_tracker.h
@@ -53,17 +53,17 @@
  private:
   const RenderFrame* render_frame_;
 
-  static base::LazyInstance<
-      std::map<const RenderFrame*, RenderFrameObserverTracker<T>*>>
-      render_frame_map_;
+  static typename base::LazyInstance<
+      std::map<const RenderFrame*, RenderFrameObserverTracker<T>*>>::
+      DestructorAtExit render_frame_map_;
 
   DISALLOW_COPY_AND_ASSIGN(RenderFrameObserverTracker<T>);
 };
 
 template <class T>
-base::LazyInstance<std::map<const RenderFrame*,
-                            RenderFrameObserverTracker<T>*>>
-    RenderFrameObserverTracker<T>::render_frame_map_ =
+typename base::LazyInstance<
+    std::map<const RenderFrame*, RenderFrameObserverTracker<T>*>>::
+    DestructorAtExit RenderFrameObserverTracker<T>::render_frame_map_ =
         LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace content
diff --git a/content/public/renderer/render_thread.cc b/content/public/renderer/render_thread.cc
index ef04a50..4cc2c50f 100644
--- a/content/public/renderer/render_thread.cc
+++ b/content/public/renderer/render_thread.cc
@@ -11,7 +11,8 @@
 
 // Keep the global RenderThread in a TLS slot so it is impossible to access
 // incorrectly from the wrong thread.
-static base::LazyInstance<base::ThreadLocalPointer<RenderThread> > lazy_tls =
+static base::LazyInstance<
+    base::ThreadLocalPointer<RenderThread>>::DestructorAtExit lazy_tls =
     LAZY_INSTANCE_INITIALIZER;
 
 RenderThread* RenderThread::Get() {
diff --git a/content/public/renderer/render_view_observer_tracker.h b/content/public/renderer/render_view_observer_tracker.h
index a05ed94..a5eaefc7 100644
--- a/content/public/renderer/render_view_observer_tracker.h
+++ b/content/public/renderer/render_view_observer_tracker.h
@@ -53,16 +53,18 @@
  private:
   const RenderView* render_view_;
 
-  static base::LazyInstance<
-      std::map<const RenderView*, RenderViewObserverTracker<T>*>>
-      render_view_map_;
+  static typename base::LazyInstance<
+      std::map<const RenderView*, RenderViewObserverTracker<T>*>>::
+      DestructorAtExit render_view_map_;
 
   DISALLOW_COPY_AND_ASSIGN(RenderViewObserverTracker<T>);
 };
 
 template <class T>
-base::LazyInstance<std::map<const RenderView*, RenderViewObserverTracker<T>*>>
-    RenderViewObserverTracker<T>::render_view_map_ = LAZY_INSTANCE_INITIALIZER;
+typename base::LazyInstance<
+    std::map<const RenderView*, RenderViewObserverTracker<T>*>>::
+    DestructorAtExit RenderViewObserverTracker<T>::render_view_map_ =
+        LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace content
 
diff --git a/content/public/test/browser_side_navigation_test_utils.cc b/content/public/test/browser_side_navigation_test_utils.cc
index 58058b6a..c1dfb4e 100644
--- a/content/public/test/browser_side_navigation_test_utils.cc
+++ b/content/public/test/browser_side_navigation_test_utils.cc
@@ -42,8 +42,8 @@
   DISALLOW_COPY_AND_ASSIGN(BrowserSideNavigationTestUtils);
 };
 
-base::LazyInstance<std::unique_ptr<BrowserSideNavigationTestUtils>>
-    browser_side_navigation_test_utils;
+base::LazyInstance<std::unique_ptr<BrowserSideNavigationTestUtils>>::
+    DestructorAtExit browser_side_navigation_test_utils;
 
 }  // namespace
 
diff --git a/content/public/test/nested_message_pump_android.cc b/content/public/test/nested_message_pump_android.cc
index 1158c19..8e0b8df 100644
--- a/content/public/test/nested_message_pump_android.cc
+++ b/content/public/test/nested_message_pump_android.cc
@@ -15,8 +15,8 @@
 
 namespace {
 
-base::LazyInstance<base::android::ScopedJavaGlobalRef<jobject> >
-    g_message_handler_obj = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<base::android::ScopedJavaGlobalRef<jobject>>::
+    DestructorAtExit g_message_handler_obj = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/content/public/utility/utility_thread.cc b/content/public/utility/utility_thread.cc
index 87bd71e..c75c258 100644
--- a/content/public/utility/utility_thread.cc
+++ b/content/public/utility/utility_thread.cc
@@ -11,7 +11,7 @@
 
 // Keep the global UtilityThread in a TLS slot so it is impossible to access
 // incorrectly from the wrong thread.
-static base::LazyInstance<base::ThreadLocalPointer<UtilityThread> >::Leaky
+static base::LazyInstance<base::ThreadLocalPointer<UtilityThread>>::Leaky
     lazy_tls = LAZY_INSTANCE_INITIALIZER;
 
 UtilityThread* UtilityThread::Get() {
diff --git a/content/renderer/browser_plugin/browser_plugin.cc b/content/renderer/browser_plugin/browser_plugin.cc
index b6ad4ae..1380398d 100644
--- a/content/renderer/browser_plugin/browser_plugin.cc
+++ b/content/renderer/browser_plugin/browser_plugin.cc
@@ -50,8 +50,8 @@
 namespace {
 using PluginContainerMap =
     std::map<blink::WebPluginContainer*, content::BrowserPlugin*>;
-static base::LazyInstance<PluginContainerMap> g_plugin_container_map =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<PluginContainerMap>::DestructorAtExit
+    g_plugin_container_map = LAZY_INSTANCE_INITIALIZER;
 }  // namespace
 
 namespace content {
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 36109332..8e044057 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -351,11 +351,12 @@
 const int kExtraCharsBeforeAndAfterSelection = 100;
 
 typedef std::map<int, RenderFrameImpl*> RoutingIDFrameMap;
-static base::LazyInstance<RoutingIDFrameMap> g_routing_id_frame_map =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<RoutingIDFrameMap>::DestructorAtExit
+    g_routing_id_frame_map = LAZY_INSTANCE_INITIALIZER;
 
 typedef std::map<blink::WebFrame*, RenderFrameImpl*> FrameMap;
-base::LazyInstance<FrameMap> g_frame_map = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<FrameMap>::DestructorAtExit g_frame_map =
+    LAZY_INSTANCE_INITIALIZER;
 
 int64_t ExtractPostId(const WebHistoryItem& item) {
   if (item.isNull() || item.httpBody().isNull())
diff --git a/content/renderer/render_frame_proxy.cc b/content/renderer/render_frame_proxy.cc
index 0315b29..006858b6 100644
--- a/content/renderer/render_frame_proxy.cc
+++ b/content/renderer/render_frame_proxy.cc
@@ -43,12 +43,13 @@
 
 // Facilitates lookup of RenderFrameProxy by routing_id.
 typedef std::map<int, RenderFrameProxy*> RoutingIDProxyMap;
-static base::LazyInstance<RoutingIDProxyMap> g_routing_id_proxy_map =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<RoutingIDProxyMap>::DestructorAtExit
+    g_routing_id_proxy_map = LAZY_INSTANCE_INITIALIZER;
 
 // Facilitates lookup of RenderFrameProxy by WebFrame.
 typedef std::map<blink::WebFrame*, RenderFrameProxy*> FrameMap;
-base::LazyInstance<FrameMap> g_frame_map = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<FrameMap>::DestructorAtExit g_frame_map =
+    LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/content/renderer/render_thread_impl.cc b/content/renderer/render_thread_impl.cc
index d4f655d7..c1ef49e8 100644
--- a/content/renderer/render_thread_impl.cc
+++ b/content/renderer/render_thread_impl.cc
@@ -255,7 +255,7 @@
 
 // Keep the global RenderThreadImpl in a TLS slot so it is impossible to access
 // incorrectly from the wrong thread.
-base::LazyInstance<base::ThreadLocalPointer<RenderThreadImpl> >
+base::LazyInstance<base::ThreadLocalPointer<RenderThreadImpl>>::DestructorAtExit
     lazy_tls = LAZY_INSTANCE_INITIALIZER;
 
 // v8::MemoryPressureLevel should correspond to base::MemoryPressureListener.
diff --git a/content/renderer/render_view_impl.cc b/content/renderer/render_view_impl.cc
index 09fd4bb6..85683eab 100644
--- a/content/renderer/render_view_impl.cc
+++ b/content/renderer/render_view_impl.cc
@@ -264,10 +264,11 @@
 //-----------------------------------------------------------------------------
 
 typedef std::map<blink::WebView*, RenderViewImpl*> ViewMap;
-static base::LazyInstance<ViewMap> g_view_map = LAZY_INSTANCE_INITIALIZER;
-typedef std::map<int32_t, RenderViewImpl*> RoutingIDViewMap;
-static base::LazyInstance<RoutingIDViewMap> g_routing_id_view_map =
+static base::LazyInstance<ViewMap>::DestructorAtExit g_view_map =
     LAZY_INSTANCE_INITIALIZER;
+typedef std::map<int32_t, RenderViewImpl*> RoutingIDViewMap;
+static base::LazyInstance<RoutingIDViewMap>::DestructorAtExit
+    g_routing_id_view_map = LAZY_INSTANCE_INITIALIZER;
 
 // Time, in seconds, we delay before sending content state changes (such as form
 // state and scroll position) to the browser. We delay sending changes to avoid
diff --git a/content/renderer/renderer_main.cc b/content/renderer/renderer_main.cc
index 9420a2c8..e6e77c5 100644
--- a/content/renderer/renderer_main.cc
+++ b/content/renderer/renderer_main.cc
@@ -76,8 +76,8 @@
 }
 
 #if defined(USE_OZONE)
-base::LazyInstance<std::unique_ptr<ui::ClientNativePixmapFactory>>
-    g_pixmap_factory = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<std::unique_ptr<ui::ClientNativePixmapFactory>>::
+    DestructorAtExit g_pixmap_factory = LAZY_INSTANCE_INITIALIZER;
 #endif
 
 }  // namespace
diff --git a/content/shell/android/shell_manager.cc b/content/shell/android/shell_manager.cc
index 33742b2..c3346fb 100644
--- a/content/shell/android/shell_manager.cc
+++ b/content/shell/android/shell_manager.cc
@@ -27,7 +27,8 @@
   base::android::ScopedJavaGlobalRef<jobject> j_shell_manager;
 };
 
-base::LazyInstance<GlobalState> g_global_state = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<GlobalState>::DestructorAtExit g_global_state =
+    LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/content/utility/in_process_utility_thread.cc b/content/utility/in_process_utility_thread.cc
index 8417c599..0a39045 100644
--- a/content/utility/in_process_utility_thread.cc
+++ b/content/utility/in_process_utility_thread.cc
@@ -15,7 +15,8 @@
 
 // We want to ensure there's only one utility thread running at a time, as there
 // are many globals used in the utility process.
-static base::LazyInstance<base::Lock> g_one_utility_thread_lock;
+static base::LazyInstance<base::Lock>::DestructorAtExit
+    g_one_utility_thread_lock;
 
 InProcessUtilityThread::InProcessUtilityThread(
     const InProcessChildThreadParams& params)
diff --git a/crypto/nss_util.cc b/crypto/nss_util.cc
index 35865679..5ed2fa06 100644
--- a/crypto/nss_util.cc
+++ b/crypto/nss_util.cc
@@ -172,7 +172,7 @@
 // singleton.
 class NSPRInitSingleton {
  private:
-  friend struct base::DefaultLazyInstanceTraits<NSPRInitSingleton>;
+  friend struct base::LazyInstanceTraitsBase<NSPRInitSingleton>;
 
   NSPRInitSingleton() {
     PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0);
@@ -657,7 +657,7 @@
   }
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<NSSInitSingleton>;
+  friend struct base::LazyInstanceTraitsBase<NSSInitSingleton>;
 
   NSSInitSingleton()
       : tpm_token_enabled_for_nss_(false),
diff --git a/device/bluetooth/bluetooth_adapter_factory.cc b/device/bluetooth/bluetooth_adapter_factory.cc
index e542638a..ed64ecd 100644
--- a/device/bluetooth/bluetooth_adapter_factory.cc
+++ b/device/bluetooth/bluetooth_adapter_factory.cc
@@ -25,7 +25,7 @@
 // if nobody is using it, so use a WeakPtr and create the object when needed.
 // Since Google C++ Style (and clang's static analyzer) forbids us having
 // exit-time destructors, we use a leaky lazy instance for it.
-base::LazyInstance<base::WeakPtr<BluetoothAdapter> >::Leaky default_adapter =
+base::LazyInstance<base::WeakPtr<BluetoothAdapter>>::Leaky default_adapter =
     LAZY_INSTANCE_INITIALIZER;
 
 #if defined(OS_WIN) || defined(OS_LINUX) || defined(OS_CHROMEOS)
@@ -35,7 +35,7 @@
 // List of adapter callbacks to be called once the adapter is initialized.
 // Since Google C++ Style (and clang's static analyzer) forbids us having
 // exit-time destructors we use a lazy instance for it.
-base::LazyInstance<AdapterCallbackList> adapter_callbacks =
+base::LazyInstance<AdapterCallbackList>::DestructorAtExit adapter_callbacks =
     LAZY_INSTANCE_INITIALIZER;
 
 void RunAdapterCallbacks() {
diff --git a/device/bluetooth/bluetooth_adapter_factory_wrapper.h b/device/bluetooth/bluetooth_adapter_factory_wrapper.h
index 097b150..e7fd70e 100644
--- a/device/bluetooth/bluetooth_adapter_factory_wrapper.h
+++ b/device/bluetooth/bluetooth_adapter_factory_wrapper.h
@@ -56,7 +56,7 @@
 
  private:
   // friend LazyInstance to permit access to private constructor.
-  friend base::DefaultLazyInstanceTraits<BluetoothAdapterFactoryWrapper>;
+  friend base::LazyInstanceTraitsBase<BluetoothAdapterFactoryWrapper>;
 
   BluetoothAdapterFactoryWrapper();
 
diff --git a/device/bluetooth/bluetooth_socket_thread.cc b/device/bluetooth/bluetooth_socket_thread.cc
index ca2dfa4..3788916c 100644
--- a/device/bluetooth/bluetooth_socket_thread.cc
+++ b/device/bluetooth/bluetooth_socket_thread.cc
@@ -10,8 +10,8 @@
 
 namespace device {
 
-base::LazyInstance<scoped_refptr<BluetoothSocketThread> > g_instance =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<scoped_refptr<BluetoothSocketThread>>::DestructorAtExit
+    g_instance = LAZY_INSTANCE_INITIALIZER;
 
 // static
 scoped_refptr<BluetoothSocketThread> BluetoothSocketThread::Get() {
diff --git a/docs/windows_build_instructions.md b/docs/windows_build_instructions.md
index beadbba..f13f63d1 100644
--- a/docs/windows_build_instructions.md
+++ b/docs/windows_build_instructions.md
@@ -38,7 +38,8 @@
 as undefined or redefined macros.
 
 Install the Windows SDK 10, and choose Debugging Tools For Windows when you
-install this in order to get windbg.
+install this in order to get windbg and cdb. The latter is required for the
+build to succeed as some tests use it for symbolizing crash dumps.
 
 ## Install `depot_tools`
 
diff --git a/extensions/browser/api/alarms/alarm_manager.cc b/extensions/browser/api/alarms/alarm_manager.cc
index 7b4cc11e..0b05f4a 100644
--- a/extensions/browser/api/alarms/alarm_manager.cc
+++ b/extensions/browser/api/alarms/alarm_manager.cc
@@ -227,8 +227,9 @@
   clock_.reset(clock);
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<AlarmManager>>
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<AlarmManager>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<AlarmManager>*
diff --git a/extensions/browser/api/audio/audio_api.cc b/extensions/browser/api/audio/audio_api.cc
index 55f14239..c81921c 100644
--- a/extensions/browser/api/audio/audio_api.cc
+++ b/extensions/browser/api/audio/audio_api.cc
@@ -47,7 +47,8 @@
 
 }  // namespace
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<AudioAPI> > g_factory =
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<AudioAPI>>::DestructorAtExit g_factory =
     LAZY_INSTANCE_INITIALIZER;
 
 // static
diff --git a/extensions/browser/api/bluetooth/bluetooth_api.cc b/extensions/browser/api/bluetooth/bluetooth_api.cc
index 35fc145..453ff77 100644
--- a/extensions/browser/api/bluetooth/bluetooth_api.cc
+++ b/extensions/browser/api/bluetooth/bluetooth_api.cc
@@ -45,8 +45,9 @@
 
 namespace extensions {
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<BluetoothAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<BluetoothAPI>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<BluetoothAPI>*
diff --git a/extensions/browser/api/bluetooth/bluetooth_private_api.cc b/extensions/browser/api/bluetooth/bluetooth_private_api.cc
index 86fc88c..ac1da95 100644
--- a/extensions/browser/api/bluetooth/bluetooth_private_api.cc
+++ b/extensions/browser/api/bluetooth/bluetooth_private_api.cc
@@ -25,8 +25,8 @@
 
 namespace extensions {
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<BluetoothPrivateAPI>>
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<BrowserContextKeyedAPIFactory<BluetoothPrivateAPI>>::
+    DestructorAtExit g_factory = LAZY_INSTANCE_INITIALIZER;
 
 namespace {
 
diff --git a/extensions/browser/api/bluetooth_low_energy/bluetooth_api_advertisement.cc b/extensions/browser/api/bluetooth_low_energy/bluetooth_api_advertisement.cc
index 3f3dcdf..d8de603 100644
--- a/extensions/browser/api/bluetooth_low_energy/bluetooth_api_advertisement.cc
+++ b/extensions/browser/api/bluetooth_low_energy/bluetooth_api_advertisement.cc
@@ -12,7 +12,7 @@
 
 // static
 static base::LazyInstance<BrowserContextKeyedAPIFactory<
-    ApiResourceManager<BluetoothApiAdvertisement>>>
+    ApiResourceManager<BluetoothApiAdvertisement>>>::DestructorAtExit
     g_server_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
diff --git a/extensions/browser/api/bluetooth_low_energy/bluetooth_low_energy_api.cc b/extensions/browser/api/bluetooth_low_energy/bluetooth_low_energy_api.cc
index db956ab7..8c271d8 100644
--- a/extensions/browser/api/bluetooth_low_energy/bluetooth_low_energy_api.cc
+++ b/extensions/browser/api/bluetooth_low_energy/bluetooth_low_energy_api.cc
@@ -340,7 +340,8 @@
 
 }  // namespace
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<BluetoothLowEnergyAPI>>
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<BluetoothLowEnergyAPI>>::DestructorAtExit
     g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
diff --git a/extensions/browser/api/bluetooth_low_energy/bluetooth_low_energy_connection.cc b/extensions/browser/api/bluetooth_low_energy/bluetooth_low_energy_connection.cc
index 3365ad8..22ac907 100644
--- a/extensions/browser/api/bluetooth_low_energy/bluetooth_low_energy_connection.cc
+++ b/extensions/browser/api/bluetooth_low_energy/bluetooth_low_energy_connection.cc
@@ -9,7 +9,7 @@
 namespace extensions {
 
 static base::LazyInstance<BrowserContextKeyedAPIFactory<
-    ApiResourceManager<BluetoothLowEnergyConnection>>>
+    ApiResourceManager<BluetoothLowEnergyConnection>>>::DestructorAtExit
     g_factory = LAZY_INSTANCE_INITIALIZER;
 
 template <>
diff --git a/extensions/browser/api/bluetooth_low_energy/bluetooth_low_energy_notify_session.cc b/extensions/browser/api/bluetooth_low_energy/bluetooth_low_energy_notify_session.cc
index 0d351a3..34fc1ea 100644
--- a/extensions/browser/api/bluetooth_low_energy/bluetooth_low_energy_notify_session.cc
+++ b/extensions/browser/api/bluetooth_low_energy/bluetooth_low_energy_notify_session.cc
@@ -9,7 +9,7 @@
 namespace extensions {
 
 static base::LazyInstance<BrowserContextKeyedAPIFactory<
-    ApiResourceManager<BluetoothLowEnergyNotifySession>>>
+    ApiResourceManager<BluetoothLowEnergyNotifySession>>>::DestructorAtExit
     g_factory = LAZY_INSTANCE_INITIALIZER;
 
 template <>
diff --git a/extensions/browser/api/bluetooth_socket/bluetooth_api_socket.cc b/extensions/browser/api/bluetooth_socket/bluetooth_api_socket.cc
index c1a400463..d2deddf0 100644
--- a/extensions/browser/api/bluetooth_socket/bluetooth_api_socket.cc
+++ b/extensions/browser/api/bluetooth_socket/bluetooth_api_socket.cc
@@ -18,8 +18,8 @@
 namespace extensions {
 
 // static
-static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<ApiResourceManager<BluetoothApiSocket> > >
+static base::LazyInstance<BrowserContextKeyedAPIFactory<
+    ApiResourceManager<BluetoothApiSocket>>>::DestructorAtExit
     g_server_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
diff --git a/extensions/browser/api/bluetooth_socket/bluetooth_socket_event_dispatcher.cc b/extensions/browser/api/bluetooth_socket/bluetooth_socket_event_dispatcher.cc
index 145a2888..60098748 100644
--- a/extensions/browser/api/bluetooth_socket/bluetooth_socket_event_dispatcher.cc
+++ b/extensions/browser/api/bluetooth_socket/bluetooth_socket_event_dispatcher.cc
@@ -60,8 +60,8 @@
 
 using content::BrowserThread;
 
-static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<BluetoothSocketEventDispatcher> > g_factory =
+static base::LazyInstance<BrowserContextKeyedAPIFactory<
+    BluetoothSocketEventDispatcher>>::DestructorAtExit g_factory =
     LAZY_INSTANCE_INITIALIZER;
 
 // static
diff --git a/extensions/browser/api/cast_channel/cast_channel_api.cc b/extensions/browser/api/cast_channel/cast_channel_api.cc
index fe16cf2f..7f64f24 100644
--- a/extensions/browser/api/cast_channel/cast_channel_api.cc
+++ b/extensions/browser/api/cast_channel/cast_channel_api.cc
@@ -131,8 +131,9 @@
   }
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<CastChannelAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<CastChannelAPI>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<CastChannelAPI>*
diff --git a/extensions/browser/api/cast_channel/cast_socket.cc b/extensions/browser/api/cast_channel/cast_socket.cc
index 921579e..1c2b956 100644
--- a/extensions/browser/api/cast_channel/cast_socket.cc
+++ b/extensions/browser/api/cast_channel/cast_socket.cc
@@ -57,8 +57,8 @@
 
 namespace extensions {
 static base::LazyInstance<BrowserContextKeyedAPIFactory<
-    ApiResourceManager<api::cast_channel::CastSocket>>> g_factory =
-    LAZY_INSTANCE_INITIALIZER;
+    ApiResourceManager<api::cast_channel::CastSocket>>>::DestructorAtExit
+    g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
 template <>
diff --git a/extensions/browser/api/clipboard/clipboard_api.cc b/extensions/browser/api/clipboard/clipboard_api.cc
index 7af9272..ef7373b8 100644
--- a/extensions/browser/api/clipboard/clipboard_api.cc
+++ b/extensions/browser/api/clipboard/clipboard_api.cc
@@ -17,8 +17,9 @@
 
 namespace clipboard = api::clipboard;
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<ClipboardAPI>>
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<ClipboardAPI>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<ClipboardAPI>*
diff --git a/extensions/browser/api/declarative/rules_registry_service.cc b/extensions/browser/api/declarative/rules_registry_service.cc
index 3d8e5ba..37162a7 100644
--- a/extensions/browser/api/declarative/rules_registry_service.cc
+++ b/extensions/browser/api/declarative/rules_registry_service.cc
@@ -133,8 +133,8 @@
                  scoped_refptr<WebRequestRulesRegistry>(NULL)));
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<RulesRegistryService> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<BrowserContextKeyedAPIFactory<RulesRegistryService>>::
+    DestructorAtExit g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<RulesRegistryService>*
diff --git a/extensions/browser/api/hid/hid_connection_resource.cc b/extensions/browser/api/hid/hid_connection_resource.cc
index d77073c35..2fa6c34 100644
--- a/extensions/browser/api/hid/hid_connection_resource.cc
+++ b/extensions/browser/api/hid/hid_connection_resource.cc
@@ -13,9 +13,9 @@
 
 namespace extensions {
 
-static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<ApiResourceManager<HidConnectionResource> > >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<BrowserContextKeyedAPIFactory<
+    ApiResourceManager<HidConnectionResource>>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 template <>
diff --git a/extensions/browser/api/hid/hid_device_manager.cc b/extensions/browser/api/hid/hid_device_manager.cc
index 93ce98b..02f04e5b 100644
--- a/extensions/browser/api/hid/hid_device_manager.cc
+++ b/extensions/browser/api/hid/hid_device_manager.cc
@@ -112,8 +112,8 @@
 // static
 BrowserContextKeyedAPIFactory<HidDeviceManager>*
 HidDeviceManager::GetFactoryInstance() {
-  static base::LazyInstance<BrowserContextKeyedAPIFactory<HidDeviceManager> >
-      factory = LAZY_INSTANCE_INITIALIZER;
+  static base::LazyInstance<BrowserContextKeyedAPIFactory<HidDeviceManager>>::
+      DestructorAtExit factory = LAZY_INSTANCE_INITIALIZER;
   return &factory.Get();
 }
 
diff --git a/extensions/browser/api/management/management_api.cc b/extensions/browser/api/management/management_api.cc
index d170d844..c723341f 100644
--- a/extensions/browser/api/management/management_api.cc
+++ b/extensions/browser/api/management/management_api.cc
@@ -857,8 +857,9 @@
   EventRouter::Get(browser_context_)->UnregisterObserver(this);
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<ManagementAPI>>
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<ManagementAPI>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<ManagementAPI>*
diff --git a/extensions/browser/api/power/power_api.cc b/extensions/browser/api/power/power_api.cc
index b2642df..5468932 100644
--- a/extensions/browser/api/power/power_api.cc
+++ b/extensions/browser/api/power/power_api.cc
@@ -31,8 +31,8 @@
   return device::PowerSaveBlocker::kPowerSaveBlockPreventDisplaySleep;
 }
 
-base::LazyInstance<BrowserContextKeyedAPIFactory<PowerAPI>> g_factory =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<BrowserContextKeyedAPIFactory<PowerAPI>>::DestructorAtExit
+    g_factory = LAZY_INSTANCE_INITIALIZER;
 
 std::unique_ptr<device::PowerSaveBlocker> CreatePowerSaveBlocker(
     device::PowerSaveBlocker::PowerSaveBlockerType type,
diff --git a/extensions/browser/api/printer_provider/printer_provider_api_factory.cc b/extensions/browser/api/printer_provider/printer_provider_api_factory.cc
index 05d6736..9a99feb 100644
--- a/extensions/browser/api/printer_provider/printer_provider_api_factory.cc
+++ b/extensions/browser/api/printer_provider/printer_provider_api_factory.cc
@@ -12,7 +12,8 @@
 
 namespace {
 
-static base::LazyInstance<extensions::PrinterProviderAPIFactory> g_api_factory =
+static base::LazyInstance<
+    extensions::PrinterProviderAPIFactory>::DestructorAtExit g_api_factory =
     LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
diff --git a/extensions/browser/api/printer_provider/printer_provider_api_factory.h b/extensions/browser/api/printer_provider/printer_provider_api_factory.h
index b238322..128bc0b9 100644
--- a/extensions/browser/api/printer_provider/printer_provider_api_factory.h
+++ b/extensions/browser/api/printer_provider/printer_provider_api_factory.h
@@ -29,7 +29,7 @@
   PrinterProviderAPI* GetForBrowserContext(content::BrowserContext* context);
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<PrinterProviderAPIFactory>;
+  friend struct base::LazyInstanceTraitsBase<PrinterProviderAPIFactory>;
 
   PrinterProviderAPIFactory();
   ~PrinterProviderAPIFactory() override;
diff --git a/extensions/browser/api/printer_provider_internal/printer_provider_internal_api.cc b/extensions/browser/api/printer_provider_internal/printer_provider_internal_api.cc
index ff7eee7..60e7260e 100644
--- a/extensions/browser/api/printer_provider_internal/printer_provider_internal_api.cc
+++ b/extensions/browser/api/printer_provider_internal/printer_provider_internal_api.cc
@@ -35,8 +35,8 @@
 namespace {
 
 static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<PrinterProviderInternalAPI>> g_api_factory =
-    LAZY_INSTANCE_INITIALIZER;
+    BrowserContextKeyedAPIFactory<PrinterProviderInternalAPI>>::DestructorAtExit
+    g_api_factory = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/extensions/browser/api/runtime/runtime_api.cc b/extensions/browser/api/runtime/runtime_api.cc
index bb4a1f7..6fa8494f 100644
--- a/extensions/browser/api/runtime/runtime_api.cc
+++ b/extensions/browser/api/runtime/runtime_api.cc
@@ -170,8 +170,9 @@
 
 ///////////////////////////////////////////////////////////////////////////////
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<RuntimeAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<RuntimeAPI>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<RuntimeAPI>* RuntimeAPI::GetFactoryInstance() {
diff --git a/extensions/browser/api/serial/serial_connection.cc b/extensions/browser/api/serial/serial_connection.cc
index adf1e4a..f6a5eb1 100644
--- a/extensions/browser/api/serial/serial_connection.cc
+++ b/extensions/browser/api/serial/serial_connection.cc
@@ -146,9 +146,9 @@
 
 }  // namespace
 
-static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<ApiResourceManager<SerialConnection> > >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<BrowserContextKeyedAPIFactory<
+    ApiResourceManager<SerialConnection>>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 template <>
diff --git a/extensions/browser/api/serial/serial_event_dispatcher.cc b/extensions/browser/api/serial/serial_event_dispatcher.cc
index 31fb191d..1d0e288 100644
--- a/extensions/browser/api/serial/serial_event_dispatcher.cc
+++ b/extensions/browser/api/serial/serial_event_dispatcher.cc
@@ -30,7 +30,8 @@
 
 }  // namespace
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<SerialEventDispatcher> >
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<SerialEventDispatcher>>::DestructorAtExit
     g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
diff --git a/extensions/browser/api/socket/socket.cc b/extensions/browser/api/socket/socket.cc
index 77de301..1143a8c 100644
--- a/extensions/browser/api/socket/socket.cc
+++ b/extensions/browser/api/socket/socket.cc
@@ -19,8 +19,8 @@
 const char kSocketTypeNotSupported[] = "Socket type does not support this API";
 
 static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<ApiResourceManager<Socket> > > g_factory =
-    LAZY_INSTANCE_INITIALIZER;
+    BrowserContextKeyedAPIFactory<ApiResourceManager<Socket>>>::DestructorAtExit
+    g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
 template <>
diff --git a/extensions/browser/api/socket/tcp_socket.cc b/extensions/browser/api/socket/tcp_socket.cc
index 8feed60c..4b31116 100644
--- a/extensions/browser/api/socket/tcp_socket.cc
+++ b/extensions/browser/api/socket/tcp_socket.cc
@@ -23,9 +23,9 @@
     "Cannot call both connect and listen on the same socket.";
 const char kSocketListenError[] = "Could not listen on the specified port.";
 
-static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<ApiResourceManager<ResumableTCPSocket> > >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<BrowserContextKeyedAPIFactory<
+    ApiResourceManager<ResumableTCPSocket>>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 template <>
@@ -35,8 +35,8 @@
 }
 
 static base::LazyInstance<BrowserContextKeyedAPIFactory<
-    ApiResourceManager<ResumableTCPServerSocket> > > g_server_factory =
-    LAZY_INSTANCE_INITIALIZER;
+    ApiResourceManager<ResumableTCPServerSocket>>>::DestructorAtExit
+    g_server_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
 template <>
diff --git a/extensions/browser/api/socket/udp_socket.cc b/extensions/browser/api/socket/udp_socket.cc
index 30dbf602..90aefe7 100644
--- a/extensions/browser/api/socket/udp_socket.cc
+++ b/extensions/browser/api/socket/udp_socket.cc
@@ -18,9 +18,9 @@
 
 namespace extensions {
 
-static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<ApiResourceManager<ResumableUDPSocket> > >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<BrowserContextKeyedAPIFactory<
+    ApiResourceManager<ResumableUDPSocket>>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 template <>
diff --git a/extensions/browser/api/sockets_tcp/tcp_socket_event_dispatcher.cc b/extensions/browser/api/sockets_tcp/tcp_socket_event_dispatcher.cc
index 9196dfb..2483a7fd 100644
--- a/extensions/browser/api/sockets_tcp/tcp_socket_event_dispatcher.cc
+++ b/extensions/browser/api/sockets_tcp/tcp_socket_event_dispatcher.cc
@@ -23,8 +23,8 @@
 using content::BrowserThread;
 
 static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<TCPSocketEventDispatcher> > g_factory =
-    LAZY_INSTANCE_INITIALIZER;
+    BrowserContextKeyedAPIFactory<TCPSocketEventDispatcher>>::DestructorAtExit
+    g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<TCPSocketEventDispatcher>*
diff --git a/extensions/browser/api/sockets_tcp_server/tcp_server_socket_event_dispatcher.cc b/extensions/browser/api/sockets_tcp_server/tcp_server_socket_event_dispatcher.cc
index a8d8ade..4854e8b7 100644
--- a/extensions/browser/api/sockets_tcp_server/tcp_server_socket_event_dispatcher.cc
+++ b/extensions/browser/api/sockets_tcp_server/tcp_server_socket_event_dispatcher.cc
@@ -17,8 +17,8 @@
 
 using content::BrowserThread;
 
-static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<TCPServerSocketEventDispatcher> > g_factory =
+static base::LazyInstance<BrowserContextKeyedAPIFactory<
+    TCPServerSocketEventDispatcher>>::DestructorAtExit g_factory =
     LAZY_INSTANCE_INITIALIZER;
 
 // static
diff --git a/extensions/browser/api/sockets_udp/udp_socket_event_dispatcher.cc b/extensions/browser/api/sockets_udp/udp_socket_event_dispatcher.cc
index 0ae4dbc..825b2b26 100644
--- a/extensions/browser/api/sockets_udp/udp_socket_event_dispatcher.cc
+++ b/extensions/browser/api/sockets_udp/udp_socket_event_dispatcher.cc
@@ -18,8 +18,8 @@
 using content::BrowserThread;
 
 static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<UDPSocketEventDispatcher> > g_factory =
-    LAZY_INSTANCE_INITIALIZER;
+    BrowserContextKeyedAPIFactory<UDPSocketEventDispatcher>>::DestructorAtExit
+    g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<UDPSocketEventDispatcher>*
diff --git a/extensions/browser/api/storage/storage_frontend.cc b/extensions/browser/api/storage/storage_frontend.cc
index c27ea67d..45772da 100644
--- a/extensions/browser/api/storage/storage_frontend.cc
+++ b/extensions/browser/api/storage/storage_frontend.cc
@@ -31,8 +31,8 @@
 
 namespace {
 
-base::LazyInstance<BrowserContextKeyedAPIFactory<StorageFrontend> > g_factory =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<BrowserContextKeyedAPIFactory<StorageFrontend>>::
+    DestructorAtExit g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // Settings change Observer which forwards changes on to the extension
 // processes for |context| and its incognito partner if it exists.
diff --git a/extensions/browser/api/system_cpu/cpu_info_provider.cc b/extensions/browser/api/system_cpu/cpu_info_provider.cc
index ac85834..e926aaa 100644
--- a/extensions/browser/api/system_cpu/cpu_info_provider.cc
+++ b/extensions/browser/api/system_cpu/cpu_info_provider.cc
@@ -11,8 +11,8 @@
 using api::system_cpu::CpuInfo;
 
 // Static member intialization.
-base::LazyInstance<scoped_refptr<CpuInfoProvider> > CpuInfoProvider::provider_ =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<scoped_refptr<CpuInfoProvider>>::DestructorAtExit
+    CpuInfoProvider::provider_ = LAZY_INSTANCE_INITIALIZER;
 
 CpuInfoProvider::CpuInfoProvider() {
 }
diff --git a/extensions/browser/api/system_cpu/cpu_info_provider.h b/extensions/browser/api/system_cpu/cpu_info_provider.h
index 617d26e..26e35d8d 100644
--- a/extensions/browser/api/system_cpu/cpu_info_provider.h
+++ b/extensions/browser/api/system_cpu/cpu_info_provider.h
@@ -50,7 +50,8 @@
   // is true.
   api::system_cpu::CpuInfo info_;
 
-  static base::LazyInstance<scoped_refptr<CpuInfoProvider> > provider_;
+  static base::LazyInstance<scoped_refptr<CpuInfoProvider>>::DestructorAtExit
+      provider_;
   base::CPU cpu_;
 
   DISALLOW_COPY_AND_ASSIGN(CpuInfoProvider);
diff --git a/extensions/browser/api/system_info/system_info_api.cc b/extensions/browser/api/system_info/system_info_api.cc
index 1634391..bec8c337 100644
--- a/extensions/browser/api/system_info/system_info_api.cc
+++ b/extensions/browser/api/system_info/system_info_api.cc
@@ -224,8 +224,9 @@
 
 }  // namespace
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<SystemInfoAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<SystemInfoAPI>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<SystemInfoAPI>*
diff --git a/extensions/browser/api/system_memory/memory_info_provider.cc b/extensions/browser/api/system_memory/memory_info_provider.cc
index 7d97dde3..c9537bb6 100644
--- a/extensions/browser/api/system_memory/memory_info_provider.cc
+++ b/extensions/browser/api/system_memory/memory_info_provider.cc
@@ -11,7 +11,7 @@
 using api::system_memory::MemoryInfo;
 
 // Static member intialization.
-base::LazyInstance<scoped_refptr<MemoryInfoProvider> >
+base::LazyInstance<scoped_refptr<MemoryInfoProvider>>::DestructorAtExit
     MemoryInfoProvider::provider_ = LAZY_INSTANCE_INITIALIZER;
 
 MemoryInfoProvider::MemoryInfoProvider() {
diff --git a/extensions/browser/api/system_memory/memory_info_provider.h b/extensions/browser/api/system_memory/memory_info_provider.h
index a461b84..7ea30696 100644
--- a/extensions/browser/api/system_memory/memory_info_provider.h
+++ b/extensions/browser/api/system_memory/memory_info_provider.h
@@ -38,7 +38,8 @@
   // is true.
   api::system_memory::MemoryInfo info_;
 
-  static base::LazyInstance<scoped_refptr<MemoryInfoProvider> > provider_;
+  static base::LazyInstance<scoped_refptr<MemoryInfoProvider>>::DestructorAtExit
+      provider_;
 
   DISALLOW_COPY_AND_ASSIGN(MemoryInfoProvider);
 };
diff --git a/extensions/browser/api/system_storage/storage_info_provider.cc b/extensions/browser/api/system_storage/storage_info_provider.cc
index 7943b89..0d0fd144 100644
--- a/extensions/browser/api/system_storage/storage_info_provider.cc
+++ b/extensions/browser/api/system_storage/storage_info_provider.cc
@@ -38,7 +38,7 @@
 }  // namespace systeminfo
 
 // Static member intialization.
-base::LazyInstance<scoped_refptr<StorageInfoProvider> >
+base::LazyInstance<scoped_refptr<StorageInfoProvider>>::DestructorAtExit
     StorageInfoProvider::provider_ = LAZY_INSTANCE_INITIALIZER;
 
 StorageInfoProvider::StorageInfoProvider() {
diff --git a/extensions/browser/api/system_storage/storage_info_provider.h b/extensions/browser/api/system_storage/storage_info_provider.h
index 9a6a47b..a6d6d78 100644
--- a/extensions/browser/api/system_storage/storage_info_provider.h
+++ b/extensions/browser/api/system_storage/storage_info_provider.h
@@ -73,7 +73,8 @@
   // the blocking pool, including fixed and removable devices.
   bool QueryInfo() override;
 
-  static base::LazyInstance<scoped_refptr<StorageInfoProvider> > provider_;
+  static base::LazyInstance<
+      scoped_refptr<StorageInfoProvider>>::DestructorAtExit provider_;
 
   DISALLOW_COPY_AND_ASSIGN(StorageInfoProvider);
 };
diff --git a/extensions/browser/api/usb/usb_device_resource.cc b/extensions/browser/api/usb/usb_device_resource.cc
index d984867..93f0021 100644
--- a/extensions/browser/api/usb/usb_device_resource.cc
+++ b/extensions/browser/api/usb/usb_device_resource.cc
@@ -21,9 +21,9 @@
 
 namespace extensions {
 
-static base::LazyInstance<
-    BrowserContextKeyedAPIFactory<ApiResourceManager<UsbDeviceResource> > >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<BrowserContextKeyedAPIFactory<
+    ApiResourceManager<UsbDeviceResource>>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 template <>
diff --git a/extensions/browser/api/virtual_keyboard_private/virtual_keyboard_private_api.cc b/extensions/browser/api/virtual_keyboard_private/virtual_keyboard_private_api.cc
index 9b14cd6..5096c166d 100644
--- a/extensions/browser/api/virtual_keyboard_private/virtual_keyboard_private_api.cc
+++ b/extensions/browser/api/virtual_keyboard_private/virtual_keyboard_private_api.cc
@@ -150,8 +150,8 @@
 VirtualKeyboardAPI::~VirtualKeyboardAPI() {
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<VirtualKeyboardAPI>>
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<BrowserContextKeyedAPIFactory<VirtualKeyboardAPI>>::
+    DestructorAtExit g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<VirtualKeyboardAPI>*
diff --git a/extensions/browser/api/web_request/web_request_api.cc b/extensions/browser/api/web_request/web_request_api.cc
index ac36bf627..60e8572 100644
--- a/extensions/browser/api/web_request/web_request_api.cc
+++ b/extensions/browser/api/web_request/web_request_api.cc
@@ -399,8 +399,9 @@
   EventRouter::Get(browser_context_)->UnregisterObserver(this);
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<WebRequestAPI> >
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<
+    BrowserContextKeyedAPIFactory<WebRequestAPI>>::DestructorAtExit g_factory =
+    LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<WebRequestAPI>*
diff --git a/extensions/browser/api/webcam_private/webcam_private_api_chromeos.cc b/extensions/browser/api/webcam_private/webcam_private_api_chromeos.cc
index fc4ad9e..7e768073e 100644
--- a/extensions/browser/api/webcam_private/webcam_private_api_chromeos.cc
+++ b/extensions/browser/api/webcam_private/webcam_private_api_chromeos.cc
@@ -422,8 +422,8 @@
     SetError(kResetWebcamError);
 }
 
-static base::LazyInstance<BrowserContextKeyedAPIFactory<WebcamPrivateAPI>>
-    g_factory = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<BrowserContextKeyedAPIFactory<WebcamPrivateAPI>>::
+    DestructorAtExit g_factory = LAZY_INSTANCE_INITIALIZER;
 
 // static
 BrowserContextKeyedAPIFactory<WebcamPrivateAPI>*
diff --git a/extensions/browser/browser_context_keyed_api_factory.h b/extensions/browser/browser_context_keyed_api_factory.h
index 47a19a0..1316c088 100644
--- a/extensions/browser/browser_context_keyed_api_factory.h
+++ b/extensions/browser/browser_context_keyed_api_factory.h
@@ -56,8 +56,8 @@
   //   };
   //
   // In the cc file, provide the implementation, e.g.:
-  //   static base::LazyInstance<BrowserContextKeyedAPIFactory<HistoryAPI> >
-  //   g_factory = LAZY_INSTANCE_INITIALIZER;
+  //   static base::LazyInstance<BrowserContextKeyedAPIFactory<HistoryAPI>>::
+  //      DestructorAtExit g_factory = LAZY_INSTANCE_INITIALIZER;
   //
   //   // static
   //   BrowserContextKeyedAPIFactory<HistoryAPI>*
diff --git a/extensions/browser/error_map.cc b/extensions/browser/error_map.cc
index 767f8dcb..df5ec4d 100644
--- a/extensions/browser/error_map.cc
+++ b/extensions/browser/error_map.cc
@@ -17,7 +17,8 @@
 // The maximum number of errors to be stored per extension.
 const size_t kMaxErrorsPerExtension = 100;
 
-base::LazyInstance<ErrorList> g_empty_error_list = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<ErrorList>::DestructorAtExit g_empty_error_list =
+    LAZY_INSTANCE_INITIALIZER;
 
 // An incrementing counter for the next error id. Overflowing this is very
 // unlikely, since the number of errors per extension is capped at 100.
diff --git a/extensions/browser/extension_api_frame_id_map.h b/extensions/browser/extension_api_frame_id_map.h
index bd63316..6b3329d5 100644
--- a/extensions/browser/extension_api_frame_id_map.h
+++ b/extensions/browser/extension_api_frame_id_map.h
@@ -141,7 +141,7 @@
                             content::RenderFrameHost* rfh);
 
  protected:
-  friend struct base::DefaultLazyInstanceTraits<ExtensionApiFrameIdMap>;
+  friend struct base::LazyInstanceTraitsBase<ExtensionApiFrameIdMap>;
 
   // A set of identifiers that uniquely identifies a RenderFrame.
   struct RenderFrameIdKey {
diff --git a/extensions/browser/extension_function_dispatcher.cc b/extensions/browser/extension_function_dispatcher.cc
index 3d7dff54..97befcd8 100644
--- a/extensions/browser/extension_function_dispatcher.cc
+++ b/extensions/browser/extension_function_dispatcher.cc
@@ -76,7 +76,8 @@
   Static() : api(ExtensionAPI::CreateWithDefaultConfiguration()) {}
   std::unique_ptr<ExtensionAPI> api;
 };
-base::LazyInstance<Static> g_global_io_data = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<Static>::DestructorAtExit g_global_io_data =
+    LAZY_INSTANCE_INITIALIZER;
 
 void CommonResponseCallback(IPC::Sender* ipc_sender,
                             int routing_id,
diff --git a/extensions/browser/guest_view/app_view/app_view_guest.cc b/extensions/browser/guest_view/app_view/app_view_guest.cc
index be13b200..d153e31 100644
--- a/extensions/browser/guest_view/app_view/app_view_guest.cc
+++ b/extensions/browser/guest_view/app_view/app_view_guest.cc
@@ -54,8 +54,8 @@
 };
 
 using PendingResponseMap = std::map<int, std::unique_ptr<ResponseInfo>>;
-static base::LazyInstance<PendingResponseMap> pending_response_map =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<PendingResponseMap>::DestructorAtExit
+    pending_response_map = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/extensions/browser/guest_view/guest_view_events.cc b/extensions/browser/guest_view/guest_view_events.cc
index 8e8c739..ae83448 100644
--- a/extensions/browser/guest_view/guest_view_events.cc
+++ b/extensions/browser/guest_view/guest_view_events.cc
@@ -98,7 +98,8 @@
   DISALLOW_COPY_AND_ASSIGN(EventMap);
 };
 
-base::LazyInstance<EventMap> g_event_map = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<EventMap>::DestructorAtExit g_event_map =
+    LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/extensions/browser/guest_view/web_view/web_view_guest.cc b/extensions/browser/guest_view/web_view/web_view_guest.cc
index ca5a9b91..6a966d4b 100644
--- a/extensions/browser/guest_view/web_view/web_view_guest.cc
+++ b/extensions/browser/guest_view/web_view/web_view_guest.cc
@@ -212,8 +212,8 @@
 
 using WebViewKey = std::pair<int, int>;
 using WebViewKeyToIDMap = std::map<WebViewKey, int>;
-static base::LazyInstance<WebViewKeyToIDMap> web_view_key_to_id_map =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<WebViewKeyToIDMap>::DestructorAtExit
+    web_view_key_to_id_map = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/extensions/common/feature_switch.cc b/extensions/common/feature_switch.cc
index 6567ba9..10863b27 100644
--- a/extensions/common/feature_switch.cc
+++ b/extensions/common/feature_switch.cc
@@ -73,7 +73,7 @@
   FeatureSwitch native_crx_bindings;
 };
 
-base::LazyInstance<CommonSwitches> g_common_switches =
+base::LazyInstance<CommonSwitches>::DestructorAtExit g_common_switches =
     LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
diff --git a/extensions/common/manifest_handler.cc b/extensions/common/manifest_handler.cc
index 537bb9a..24ab931e 100644
--- a/extensions/common/manifest_handler.cc
+++ b/extensions/common/manifest_handler.cc
@@ -18,8 +18,8 @@
 
 namespace {
 
-static base::LazyInstance<ManifestHandlerRegistry> g_registry =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<ManifestHandlerRegistry>::DestructorAtExit
+    g_registry = LAZY_INSTANCE_INITIALIZER;
 static ManifestHandlerRegistry* g_registry_override = NULL;
 
 ManifestHandlerRegistry* GetRegistry() {
diff --git a/extensions/common/manifest_handler.h b/extensions/common/manifest_handler.h
index 4c7da31..d1cf464 100644
--- a/extensions/common/manifest_handler.h
+++ b/extensions/common/manifest_handler.h
@@ -123,7 +123,7 @@
  private:
   friend class ManifestHandler;
   friend class ScopedTestingManifestHandlerRegistry;
-  friend struct base::DefaultLazyInstanceTraits<ManifestHandlerRegistry>;
+  friend struct base::LazyInstanceTraitsBase<ManifestHandlerRegistry>;
 
   ManifestHandlerRegistry();
   ~ManifestHandlerRegistry();
diff --git a/extensions/common/manifest_handlers/background_info.cc b/extensions/common/manifest_handlers/background_info.cc
index 0466dcd..eb891275 100644
--- a/extensions/common/manifest_handlers/background_info.cc
+++ b/extensions/common/manifest_handlers/background_info.cc
@@ -37,8 +37,8 @@
 
 const char kBackground[] = "background";
 
-static base::LazyInstance<BackgroundInfo> g_empty_background_info =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<BackgroundInfo>::DestructorAtExit
+    g_empty_background_info = LAZY_INSTANCE_INITIALIZER;
 
 const BackgroundInfo& GetBackgroundInfo(const Extension* extension) {
   BackgroundInfo* info = static_cast<BackgroundInfo*>(
diff --git a/extensions/common/manifest_handlers/content_capabilities_handler.cc b/extensions/common/manifest_handlers/content_capabilities_handler.cc
index c994dea3..03d84d5 100644
--- a/extensions/common/manifest_handlers/content_capabilities_handler.cc
+++ b/extensions/common/manifest_handlers/content_capabilities_handler.cc
@@ -32,8 +32,8 @@
 ContentCapabilitiesInfo::~ContentCapabilitiesInfo() {
 }
 
-static base::LazyInstance<ContentCapabilitiesInfo>
-g_empty_content_capabilities_info = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<ContentCapabilitiesInfo>::DestructorAtExit
+    g_empty_content_capabilities_info = LAZY_INSTANCE_INITIALIZER;
 
 // static
 const ContentCapabilitiesInfo& ContentCapabilitiesInfo::Get(
diff --git a/extensions/common/manifest_handlers/icons_handler.cc b/extensions/common/manifest_handlers/icons_handler.cc
index 90cdbddb..2825ae9 100644
--- a/extensions/common/manifest_handlers/icons_handler.cc
+++ b/extensions/common/manifest_handlers/icons_handler.cc
@@ -23,7 +23,7 @@
 
 namespace keys = manifest_keys;
 
-static base::LazyInstance<ExtensionIconSet> g_empty_icon_set =
+static base::LazyInstance<ExtensionIconSet>::DestructorAtExit g_empty_icon_set =
     LAZY_INSTANCE_INITIALIZER;
 
 // static
diff --git a/extensions/common/manifest_handlers/oauth2_manifest_handler.cc b/extensions/common/manifest_handlers/oauth2_manifest_handler.cc
index 2e99bf2..c6b77666 100644
--- a/extensions/common/manifest_handlers/oauth2_manifest_handler.cc
+++ b/extensions/common/manifest_handlers/oauth2_manifest_handler.cc
@@ -31,7 +31,7 @@
 OAuth2Info::OAuth2Info() : auto_approve(false) {}
 OAuth2Info::~OAuth2Info() {}
 
-static base::LazyInstance<OAuth2Info> g_empty_oauth2_info =
+static base::LazyInstance<OAuth2Info>::DestructorAtExit g_empty_oauth2_info =
     LAZY_INSTANCE_INITIALIZER;
 
 // static
diff --git a/extensions/common/manifest_handlers/sandboxed_page_info.cc b/extensions/common/manifest_handlers/sandboxed_page_info.cc
index 11d97dc7..73b23a6 100644
--- a/extensions/common/manifest_handlers/sandboxed_page_info.cc
+++ b/extensions/common/manifest_handlers/sandboxed_page_info.cc
@@ -28,8 +28,8 @@
     "sandbox allow-scripts allow-forms allow-popups allow-modals; "
     "script-src 'self' 'unsafe-inline' 'unsafe-eval'; child-src 'self';";
 
-static base::LazyInstance<SandboxedPageInfo> g_empty_sandboxed_info =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<SandboxedPageInfo>::DestructorAtExit
+    g_empty_sandboxed_info = LAZY_INSTANCE_INITIALIZER;
 
 const SandboxedPageInfo& GetSandboxedPageInfo(const Extension* extension) {
   SandboxedPageInfo* info = static_cast<SandboxedPageInfo*>(
diff --git a/extensions/common/manifest_handlers/shared_module_info.cc b/extensions/common/manifest_handlers/shared_module_info.cc
index 90280e85..73f25d5 100644
--- a/extensions/common/manifest_handlers/shared_module_info.cc
+++ b/extensions/common/manifest_handlers/shared_module_info.cc
@@ -32,8 +32,8 @@
 
 const char kSharedModule[] = "shared_module";
 
-static base::LazyInstance<SharedModuleInfo> g_empty_shared_module_info =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<SharedModuleInfo>::DestructorAtExit
+    g_empty_shared_module_info = LAZY_INSTANCE_INITIALIZER;
 
 const SharedModuleInfo& GetSharedModuleInfo(const Extension* extension) {
   SharedModuleInfo* info = static_cast<SharedModuleInfo*>(
diff --git a/extensions/common/message_bundle.cc b/extensions/common/message_bundle.cc
index 3fa75c0c..f75472b 100644
--- a/extensions/common/message_bundle.cc
+++ b/extensions/common/message_bundle.cc
@@ -318,8 +318,8 @@
   ExtensionToL10nMessagesMap messages_map;
 };
 
-static base::LazyInstance<ExtensionToMessagesMap> g_extension_to_messages_map =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<ExtensionToMessagesMap>::DestructorAtExit
+    g_extension_to_messages_map = LAZY_INSTANCE_INITIALIZER;
 
 ExtensionToMessagesMap::ExtensionToMessagesMap() {}
 
diff --git a/extensions/common/permissions/permissions_info.h b/extensions/common/permissions/permissions_info.h
index 7834594..197f549c 100644
--- a/extensions/common/permissions/permissions_info.h
+++ b/extensions/common/permissions/permissions_info.h
@@ -56,7 +56,7 @@
   size_t get_permission_count() const { return permission_count_; }
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<PermissionsInfo>;
+  friend struct base::LazyInstanceTraitsBase<PermissionsInfo>;
 
   PermissionsInfo();
 
diff --git a/extensions/renderer/dispatcher.cc b/extensions/renderer/dispatcher.cc
index b78e7977..63e872a 100644
--- a/extensions/renderer/dispatcher.cc
+++ b/extensions/renderer/dispatcher.cc
@@ -217,8 +217,8 @@
   }
 }
 
-base::LazyInstance<WorkerScriptContextSet> g_worker_script_context_set =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<WorkerScriptContextSet>::DestructorAtExit
+    g_worker_script_context_set = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/extensions/renderer/event_bindings.cc b/extensions/renderer/event_bindings.cc
index e65d824..5e8d41a 100644
--- a/extensions/renderer/event_bindings.cc
+++ b/extensions/renderer/event_bindings.cc
@@ -36,7 +36,7 @@
 typedef std::map<std::string, int> EventListenerCounts;
 
 // A map of extension IDs to listener counts for that extension.
-base::LazyInstance<std::map<std::string, EventListenerCounts>>
+base::LazyInstance<std::map<std::string, EventListenerCounts>>::DestructorAtExit
     g_listener_counts = LAZY_INSTANCE_INITIALIZER;
 
 // A map of (extension ID, event name) pairs to the filtered listener counts
@@ -46,10 +46,11 @@
 using FilteredEventListenerKey = std::pair<std::string, std::string>;
 using FilteredEventListenerCounts =
     std::map<FilteredEventListenerKey, std::unique_ptr<ValueCounter>>;
-base::LazyInstance<FilteredEventListenerCounts> g_filtered_listener_counts =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<FilteredEventListenerCounts>::DestructorAtExit
+    g_filtered_listener_counts = LAZY_INSTANCE_INITIALIZER;
 
-base::LazyInstance<EventFilter> g_event_filter = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<EventFilter>::DestructorAtExit g_event_filter =
+    LAZY_INSTANCE_INITIALIZER;
 
 // Gets a unique string key identifier for a ScriptContext.
 // TODO(kalman): Just use pointer equality...?
diff --git a/extensions/renderer/extension_frame_helper.cc b/extensions/renderer/extension_frame_helper.cc
index 3985bd6..7114145 100644
--- a/extensions/renderer/extension_frame_helper.cc
+++ b/extensions/renderer/extension_frame_helper.cc
@@ -27,8 +27,8 @@
 
 namespace {
 
-base::LazyInstance<std::set<const ExtensionFrameHelper*>> g_frame_helpers =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<std::set<const ExtensionFrameHelper*>>::DestructorAtExit
+    g_frame_helpers = LAZY_INSTANCE_INITIALIZER;
 
 // Returns true if the render frame corresponding with |frame_helper| matches
 // the given criteria.
diff --git a/extensions/renderer/guest_view/guest_view_internal_custom_bindings.cc b/extensions/renderer/guest_view/guest_view_internal_custom_bindings.cc
index 77bc51f..d9a09ffe 100644
--- a/extensions/renderer/guest_view/guest_view_internal_custom_bindings.cc
+++ b/extensions/renderer/guest_view/guest_view_internal_custom_bindings.cc
@@ -39,7 +39,8 @@
 // GuestViewInternalCustomBindings::RegisterView(), and accessed via
 // GuestViewInternalCustomBindings::GetViewFromID().
 using ViewMap = std::map<int, v8::Global<v8::Object>*>;
-static base::LazyInstance<ViewMap> weak_view_map = LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<ViewMap>::DestructorAtExit weak_view_map =
+    LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/extensions/renderer/guest_view/mime_handler_view/mime_handler_view_container.cc b/extensions/renderer/guest_view/mime_handler_view/mime_handler_view_container.cc
index bb13920f..b05e9f5f 100644
--- a/extensions/renderer/guest_view/mime_handler_view/mime_handler_view_container.cc
+++ b/extensions/renderer/guest_view/mime_handler_view/mime_handler_view_container.cc
@@ -98,8 +98,9 @@
 // Maps from content::RenderFrame to the set of MimeHandlerViewContainers within
 // it.
 base::LazyInstance<
-    std::map<content::RenderFrame*, std::set<MimeHandlerViewContainer*>>>
-    g_mime_handler_view_container_map = LAZY_INSTANCE_INITIALIZER;
+    std::map<content::RenderFrame*, std::set<MimeHandlerViewContainer*>>>::
+    DestructorAtExit g_mime_handler_view_container_map =
+        LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/extensions/renderer/messaging_bindings.cc b/extensions/renderer/messaging_bindings.cc
index cea52c94..78b72e35 100644
--- a/extensions/renderer/messaging_bindings.cc
+++ b/extensions/renderer/messaging_bindings.cc
@@ -54,8 +54,8 @@
 namespace {
 
 // A global map between ScriptContext and MessagingBindings.
-base::LazyInstance<std::map<ScriptContext*, MessagingBindings*>>
-    g_messaging_map = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<std::map<ScriptContext*, MessagingBindings*>>::
+    DestructorAtExit g_messaging_map = LAZY_INSTANCE_INITIALIZER;
 
 void HasMessagePort(const PortId& port_id,
                     bool* has_port,
diff --git a/extensions/renderer/renderer_extension_registry.cc b/extensions/renderer/renderer_extension_registry.cc
index ddc3a1b..4fb14dd 100644
--- a/extensions/renderer/renderer_extension_registry.cc
+++ b/extensions/renderer/renderer_extension_registry.cc
@@ -12,8 +12,8 @@
 
 namespace {
 
-base::LazyInstance<RendererExtensionRegistry> g_renderer_extension_registry =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<RendererExtensionRegistry>::DestructorAtExit
+    g_renderer_extension_registry = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/extensions/renderer/script_injection.cc b/extensions/renderer/script_injection.cc
index 121def1..9713d16 100644
--- a/extensions/renderer/script_injection.cc
+++ b/extensions/renderer/script_injection.cc
@@ -33,7 +33,7 @@
 namespace {
 
 using IsolatedWorldMap = std::map<std::string, int>;
-base::LazyInstance<IsolatedWorldMap> g_isolated_worlds =
+base::LazyInstance<IsolatedWorldMap>::DestructorAtExit g_isolated_worlds =
     LAZY_INSTANCE_INITIALIZER;
 
 const int64_t kInvalidRequestId = -1;
diff --git a/extensions/renderer/user_script_injector.cc b/extensions/renderer/user_script_injector.cc
index e43f461a..549b621 100644
--- a/extensions/renderer/user_script_injector.cc
+++ b/extensions/renderer/user_script_injector.cc
@@ -51,7 +51,7 @@
 // After removed by the webview, the user scipt will also be removed
 // from the render. Therefore, there won't be any query from the same
 // |script_id| and |routing_id| pair.
-base::LazyInstance<RoutingInfoMap> g_routing_info_map =
+base::LazyInstance<RoutingInfoMap>::DestructorAtExit g_routing_info_map =
     LAZY_INSTANCE_INITIALIZER;
 
 // Greasemonkey API source that is injected with the scripts.
diff --git a/extensions/renderer/wake_event_page.cc b/extensions/renderer/wake_event_page.cc
index f17a4e87..2118929 100644
--- a/extensions/renderer/wake_event_page.cc
+++ b/extensions/renderer/wake_event_page.cc
@@ -29,7 +29,8 @@
 
 namespace {
 
-base::LazyInstance<WakeEventPage> g_instance = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<WakeEventPage>::DestructorAtExit g_instance =
+    LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/extensions/renderer/worker_thread_dispatcher.cc b/extensions/renderer/worker_thread_dispatcher.cc
index 0d5bb419..2e2b9c4 100644
--- a/extensions/renderer/worker_thread_dispatcher.cc
+++ b/extensions/renderer/worker_thread_dispatcher.cc
@@ -20,10 +20,10 @@
 
 namespace {
 
-base::LazyInstance<WorkerThreadDispatcher> g_instance =
+base::LazyInstance<WorkerThreadDispatcher>::DestructorAtExit g_instance =
     LAZY_INSTANCE_INITIALIZER;
-base::LazyInstance<base::ThreadLocalPointer<extensions::ServiceWorkerData>>
-    g_data_tls = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<base::ThreadLocalPointer<extensions::ServiceWorkerData>>::
+    DestructorAtExit g_data_tls = LAZY_INSTANCE_INITIALIZER;
 
 void OnResponseOnWorkerThread(int request_id,
                               bool succeeded,
diff --git a/extensions/shell/browser/api/identity/identity_api.cc b/extensions/shell/browser/api/identity/identity_api.cc
index c1eccfd..a2b25b3a 100644
--- a/extensions/shell/browser/api/identity/identity_api.cc
+++ b/extensions/shell/browser/api/identity/identity_api.cc
@@ -42,8 +42,9 @@
 
 // static
 BrowserContextKeyedAPIFactory<IdentityAPI>* IdentityAPI::GetFactoryInstance() {
-  static base::LazyInstance<BrowserContextKeyedAPIFactory<IdentityAPI>>
-      factory = LAZY_INSTANCE_INITIALIZER;
+  static base::LazyInstance<
+      BrowserContextKeyedAPIFactory<IdentityAPI>>::DestructorAtExit factory =
+      LAZY_INSTANCE_INITIALIZER;
   return factory.Pointer();
 }
 
diff --git a/extensions/shell/browser/shell_extension_host_delegate.cc b/extensions/shell/browser/shell_extension_host_delegate.cc
index 51c7334..1656b23 100644
--- a/extensions/shell/browser/shell_extension_host_delegate.cc
+++ b/extensions/shell/browser/shell_extension_host_delegate.cc
@@ -63,7 +63,7 @@
   return true;
 }
 
-static base::LazyInstance<SerialExtensionHostQueue> g_queue =
+static base::LazyInstance<SerialExtensionHostQueue>::DestructorAtExit g_queue =
     LAZY_INSTANCE_INITIALIZER;
 
 ExtensionHostQueue* ShellExtensionHostDelegate::GetExtensionHostQueue() const {
diff --git a/extensions/shell/common/shell_extensions_client.cc b/extensions/shell/common/shell_extensions_client.cc
index 210d6cf..cbe52a6 100644
--- a/extensions/shell/common/shell_extensions_client.cc
+++ b/extensions/shell/common/shell_extensions_client.cc
@@ -64,7 +64,7 @@
   DISALLOW_COPY_AND_ASSIGN(ShellPermissionMessageProvider);
 };
 
-base::LazyInstance<ShellPermissionMessageProvider>
+base::LazyInstance<ShellPermissionMessageProvider>::DestructorAtExit
     g_permission_message_provider = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
diff --git a/gin/public/v8_platform.h b/gin/public/v8_platform.h
index 6506ce4..2eee1dd 100644
--- a/gin/public/v8_platform.h
+++ b/gin/public/v8_platform.h
@@ -55,7 +55,7 @@
   void RemoveTraceStateObserver(v8::Platform::TraceStateObserver*) override;
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<V8Platform>;
+  friend struct base::LazyInstanceTraitsBase<V8Platform>;
 
   V8Platform();
   ~V8Platform() override;
diff --git a/google_apis/google_api_keys.cc b/google_apis/google_api_keys.cc
index f107fd8f..06a53e2 100644
--- a/google_apis/google_api_keys.cc
+++ b/google_apis/google_api_keys.cc
@@ -289,7 +289,7 @@
   std::string client_secrets_[CLIENT_NUM_ITEMS];
 };
 
-static base::LazyInstance<APIKeyCache> g_api_key_cache =
+static base::LazyInstance<APIKeyCache>::DestructorAtExit g_api_key_cache =
     LAZY_INSTANCE_INITIALIZER;
 
 bool HasKeysConfigured() {
diff --git a/gpu/command_buffer/service/mailbox_manager_sync.cc b/gpu/command_buffer/service/mailbox_manager_sync.cc
index dd9e673..a9110de 100644
--- a/gpu/command_buffer/service/mailbox_manager_sync.cc
+++ b/gpu/command_buffer/service/mailbox_manager_sync.cc
@@ -25,14 +25,15 @@
 
 namespace {
 
-base::LazyInstance<base::Lock> g_lock = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<base::Lock>::DestructorAtExit g_lock =
+    LAZY_INSTANCE_INITIALIZER;
 
 #if !defined(OS_MACOSX)
 typedef std::map<SyncToken, std::unique_ptr<gl::GLFence>> SyncTokenToFenceMap;
-base::LazyInstance<SyncTokenToFenceMap> g_sync_point_to_fence =
-    LAZY_INSTANCE_INITIALIZER;
-base::LazyInstance<std::queue<SyncTokenToFenceMap::iterator>> g_sync_points =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<SyncTokenToFenceMap>::DestructorAtExit
+    g_sync_point_to_fence = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<std::queue<SyncTokenToFenceMap::iterator>>::DestructorAtExit
+    g_sync_points = LAZY_INSTANCE_INITIALIZER;
 #endif
 
 void CreateFenceLocked(const SyncToken& sync_token) {
@@ -77,8 +78,8 @@
 
 }  // anonymous namespace
 
-base::LazyInstance<MailboxManagerSync::TextureGroup::MailboxToGroupMap>
-    MailboxManagerSync::TextureGroup::mailbox_to_group_ =
+base::LazyInstance<MailboxManagerSync::TextureGroup::MailboxToGroupMap>::
+    DestructorAtExit MailboxManagerSync::TextureGroup::mailbox_to_group_ =
         LAZY_INSTANCE_INITIALIZER;
 
 // static
diff --git a/gpu/command_buffer/service/mailbox_manager_sync.h b/gpu/command_buffer/service/mailbox_manager_sync.h
index f7e6290..ba0c05e 100644
--- a/gpu/command_buffer/service/mailbox_manager_sync.h
+++ b/gpu/command_buffer/service/mailbox_manager_sync.h
@@ -72,7 +72,8 @@
 
     typedef std::map<Mailbox, scoped_refptr<TextureGroup>>
         MailboxToGroupMap;
-    static base::LazyInstance<MailboxToGroupMap> mailbox_to_group_;
+    static base::LazyInstance<MailboxToGroupMap>::DestructorAtExit
+        mailbox_to_group_;
   };
 
   struct TextureGroupRef {
diff --git a/gpu/command_buffer/service/shader_translator.cc b/gpu/command_buffer/service/shader_translator.cc
index d5067b5..3d3012d 100644
--- a/gpu/command_buffer/service/shader_translator.cc
+++ b/gpu/command_buffer/service/shader_translator.cc
@@ -36,8 +36,8 @@
   }
 };
 
-base::LazyInstance<ShaderTranslatorInitializer> g_translator_initializer =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<ShaderTranslatorInitializer>::DestructorAtExit
+    g_translator_initializer = LAZY_INSTANCE_INITIALIZER;
 
 void GetAttributes(ShHandle compiler, AttributeMap* var_map) {
   if (!var_map)
diff --git a/gpu/ipc/in_process_command_buffer.cc b/gpu/ipc/in_process_command_buffer.cc
index ec3464e..7db6617 100644
--- a/gpu/ipc/in_process_command_buffer.cc
+++ b/gpu/ipc/in_process_command_buffer.cc
@@ -96,8 +96,8 @@
   scoped_refptr<InProcessCommandBuffer::Service> gpu_thread_service_;
 };
 
-base::LazyInstance<GpuInProcessThreadHolder> g_default_service =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<GpuInProcessThreadHolder>::DestructorAtExit
+    g_default_service = LAZY_INSTANCE_INITIALIZER;
 
 class ScopedEvent {
  public:
diff --git a/ios/chrome/browser/update_client/ios_chrome_update_query_params_delegate.cc b/ios/chrome/browser/update_client/ios_chrome_update_query_params_delegate.cc
index 127deec6..45616c3 100644
--- a/ios/chrome/browser/update_client/ios_chrome_update_query_params_delegate.cc
+++ b/ios/chrome/browser/update_client/ios_chrome_update_query_params_delegate.cc
@@ -12,8 +12,8 @@
 
 namespace {
 
-base::LazyInstance<IOSChromeUpdateQueryParamsDelegate> g_delegate =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<IOSChromeUpdateQueryParamsDelegate>::DestructorAtExit
+    g_delegate = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/ios/web/webui/web_ui_ios_controller_factory_registry.cc b/ios/web/webui/web_ui_ios_controller_factory_registry.cc
index 14c553ce..d48a8ecd 100644
--- a/ios/web/webui/web_ui_ios_controller_factory_registry.cc
+++ b/ios/web/webui/web_ui_ios_controller_factory_registry.cc
@@ -14,8 +14,8 @@
 
 namespace web {
 
-base::LazyInstance<std::vector<WebUIIOSControllerFactory*>> g_factories =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<std::vector<WebUIIOSControllerFactory*>>::DestructorAtExit
+    g_factories = LAZY_INSTANCE_INITIALIZER;
 
 void WebUIIOSControllerFactory::RegisterFactory(
     WebUIIOSControllerFactory* factory) {
diff --git a/ipc/ipc_sync_channel.cc b/ipc/ipc_sync_channel.cc
index f92d1ed..840c89d9 100644
--- a/ipc/ipc_sync_channel.cc
+++ b/ipc/ipc_sync_channel.cc
@@ -214,8 +214,8 @@
   }
 
   // Holds a pointer to the per-thread ReceivedSyncMsgQueue object.
-  static base::LazyInstance<base::ThreadLocalPointer<ReceivedSyncMsgQueue> >
-      lazy_tls_ptr_;
+  static base::LazyInstance<base::ThreadLocalPointer<ReceivedSyncMsgQueue>>::
+      DestructorAtExit lazy_tls_ptr_;
 
   // Called on the ipc thread to check if we can unblock any current Send()
   // calls based on a queued reply.
@@ -312,7 +312,8 @@
   std::unique_ptr<mojo::SyncHandleWatcher> sync_dispatch_watcher_;
 };
 
-base::LazyInstance<base::ThreadLocalPointer<SyncChannel::ReceivedSyncMsgQueue> >
+base::LazyInstance<base::ThreadLocalPointer<
+    SyncChannel::ReceivedSyncMsgQueue>>::DestructorAtExit
     SyncChannel::ReceivedSyncMsgQueue::lazy_tls_ptr_ =
         LAZY_INSTANCE_INITIALIZER;
 
diff --git a/jingle/glue/thread_wrapper.cc b/jingle/glue/thread_wrapper.cc
index 5d5d07a..9ea45ba 100644
--- a/jingle/glue/thread_wrapper.cc
+++ b/jingle/glue/thread_wrapper.cc
@@ -31,8 +31,8 @@
   base::WaitableEvent done_event;
 };
 
-base::LazyInstance<base::ThreadLocalPointer<JingleThreadWrapper> >
-    g_jingle_thread_wrapper = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<base::ThreadLocalPointer<JingleThreadWrapper>>::
+    DestructorAtExit g_jingle_thread_wrapper = LAZY_INSTANCE_INITIALIZER;
 
 // static
 void JingleThreadWrapper::EnsureForCurrentMessageLoop() {
diff --git a/media/filters/ffmpeg_audio_decoder.cc b/media/filters/ffmpeg_audio_decoder.cc
index e3560ff..06233eaa 100644
--- a/media/filters/ffmpeg_audio_decoder.cc
+++ b/media/filters/ffmpeg_audio_decoder.cc
@@ -45,8 +45,8 @@
 // Called by FFmpeg's allocation routine to free a buffer. |opaque| is the
 // AudioBuffer allocated, so unref it.
 static void ReleaseAudioBufferImpl(void* opaque, uint8_t* data) {
-  scoped_refptr<AudioBuffer> buffer;
-  buffer.swap(reinterpret_cast<AudioBuffer**>(&opaque));
+  if (opaque)
+    static_cast<AudioBuffer*>(opaque)->Release();
 }
 
 // Called by FFmpeg's allocation routine to allocate a buffer. Uses
@@ -124,8 +124,8 @@
 
   // Now create an AVBufferRef for the data just allocated. It will own the
   // reference to the AudioBuffer object.
-  void* opaque = NULL;
-  buffer.swap(reinterpret_cast<AudioBuffer**>(&opaque));
+  AudioBuffer* opaque = buffer.get();
+  opaque->AddRef();
   frame->buf[0] = av_buffer_create(
       frame->data[0], buffer_size_in_bytes, ReleaseAudioBufferImpl, opaque, 0);
   return 0;
diff --git a/media/filters/ffmpeg_video_decoder.cc b/media/filters/ffmpeg_video_decoder.cc
index 189c16e..606968b 100644
--- a/media/filters/ffmpeg_video_decoder.cc
+++ b/media/filters/ffmpeg_video_decoder.cc
@@ -102,8 +102,8 @@
 }
 
 static void ReleaseVideoBufferImpl(void* opaque, uint8_t* data) {
-  scoped_refptr<VideoFrame> video_frame;
-  video_frame.swap(reinterpret_cast<VideoFrame**>(&opaque));
+  if (opaque)
+    static_cast<VideoFrame*>(opaque)->Release();
 }
 
 // static
@@ -206,8 +206,8 @@
 
   // Now create an AVBufferRef for the data just allocated. It will own the
   // reference to the VideoFrame object.
-  void* opaque = NULL;
-  video_frame.swap(reinterpret_cast<VideoFrame**>(&opaque));
+  VideoFrame* opaque = video_frame.get();
+  opaque->AddRef();
   frame->buf[0] =
       av_buffer_create(frame->data[0],
                        VideoFrame::AllocationSize(format, coded_size),
diff --git a/mojo/public/cpp/bindings/lib/message.cc b/mojo/public/cpp/bindings/lib/message.cc
index 68337d1..e5f3808 100644
--- a/mojo/public/cpp/bindings/lib/message.cc
+++ b/mojo/public/cpp/bindings/lib/message.cc
@@ -23,11 +23,11 @@
 
 namespace {
 
-base::LazyInstance<base::ThreadLocalPointer<internal::MessageDispatchContext>>
-    g_tls_message_dispatch_context = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<base::ThreadLocalPointer<internal::MessageDispatchContext>>::
+    DestructorAtExit g_tls_message_dispatch_context = LAZY_INSTANCE_INITIALIZER;
 
-base::LazyInstance<base::ThreadLocalPointer<SyncMessageResponseContext>>
-    g_tls_sync_response_context = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<base::ThreadLocalPointer<SyncMessageResponseContext>>::
+    DestructorAtExit g_tls_sync_response_context = LAZY_INSTANCE_INITIALIZER;
 
 void DoNotifyBadMessage(Message message, const std::string& error) {
   message.NotifyBadMessage(error);
diff --git a/mojo/public/cpp/bindings/lib/sync_call_restrictions.cc b/mojo/public/cpp/bindings/lib/sync_call_restrictions.cc
index e24f9ea..585a8f0 100644
--- a/mojo/public/cpp/bindings/lib/sync_call_restrictions.cc
+++ b/mojo/public/cpp/bindings/lib/sync_call_restrictions.cc
@@ -38,7 +38,7 @@
   size_t scoped_allow_count_ = 0;
 };
 
-base::LazyInstance<base::ThreadLocalPointer<SyncCallSettings>>
+base::LazyInstance<base::ThreadLocalPointer<SyncCallSettings>>::DestructorAtExit
     g_sync_call_settings = LAZY_INSTANCE_INITIALIZER;
 
 // static
diff --git a/net/base/mime_util.cc b/net/base/mime_util.cc
index 4e94fa5..93aff23a 100644
--- a/net/base/mime_util.cc
+++ b/net/base/mime_util.cc
@@ -48,7 +48,7 @@
   bool IsValidTopLevelMimeType(const std::string& type_string) const;
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<MimeUtil>;
+  friend struct base::LazyInstanceTraitsBase<MimeUtil>;
 
   MimeUtil();
 
diff --git a/net/base/network_activity_monitor.h b/net/base/network_activity_monitor.h
index 7f3dbed..6f17c21 100644
--- a/net/base/network_activity_monitor.h
+++ b/net/base/network_activity_monitor.h
@@ -51,7 +51,7 @@
 
   NetworkActivityMonitor();
   ~NetworkActivityMonitor();
-  friend struct base::DefaultLazyInstanceTraits<NetworkActivityMonitor>;
+  friend struct base::LazyInstanceTraitsBase<NetworkActivityMonitor>;
 
   // Protects all the following members.
   mutable base::Lock lock_;
diff --git a/net/cert/cert_verify_proc_mac.cc b/net/cert/cert_verify_proc_mac.cc
index 234d959..60621d6b 100644
--- a/net/cert/cert_verify_proc_mac.cc
+++ b/net/cert/cert_verify_proc_mac.cc
@@ -616,7 +616,7 @@
   }
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<OSXKnownRootHelper>;
+  friend struct base::LazyInstanceTraitsBase<OSXKnownRootHelper>;
 
   OSXKnownRootHelper() {
     CFArrayRef cert_array = NULL;
diff --git a/net/cert/cert_verify_proc_win.cc b/net/cert/cert_verify_proc_win.cc
index a4e3941..ef334da 100644
--- a/net/cert/cert_verify_proc_win.cc
+++ b/net/cert/cert_verify_proc_win.cc
@@ -662,7 +662,7 @@
   void SetCRLSet(CRLSet* crl_set) { thread_local_crlset.Set(crl_set); }
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<RevocationInjector>;
+  friend struct base::LazyInstanceTraitsBase<RevocationInjector>;
 
   RevocationInjector() {
     const CRYPT_OID_FUNC_ENTRY kInterceptFunction[] = {
diff --git a/net/cert/ev_root_ca_metadata.h b/net/cert/ev_root_ca_metadata.h
index e99cdd1f..c803bee 100644
--- a/net/cert/ev_root_ca_metadata.h
+++ b/net/cert/ev_root_ca_metadata.h
@@ -22,7 +22,7 @@
 
 namespace base {
 template <typename T>
-struct DefaultLazyInstanceTraits;
+struct LazyInstanceTraitsBase;
 }  // namespace base
 
 namespace net {
@@ -66,7 +66,7 @@
   bool RemoveEVCA(const SHA1HashValue& fingerprint);
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<EVRootCAMetadata>;
+  friend struct base::LazyInstanceTraitsBase<EVRootCAMetadata>;
 
   EVRootCAMetadata();
   ~EVRootCAMetadata();
diff --git a/net/cert/test_root_certs.h b/net/cert/test_root_certs.h
index 48dbc3e..6fa22c1 100644
--- a/net/cert/test_root_certs.h
+++ b/net/cert/test_root_certs.h
@@ -94,7 +94,7 @@
 #endif
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<TestRootCerts>;
+  friend struct base::LazyInstanceTraitsBase<TestRootCerts>;
 
   TestRootCerts();
   ~TestRootCerts();
diff --git a/net/cert/test_root_certs_win.cc b/net/cert/test_root_certs_win.cc
index 8535725..e13f173 100644
--- a/net/cert/test_root_certs_win.cc
+++ b/net/cert/test_root_certs_win.cc
@@ -41,7 +41,7 @@
   HCRYPTOIDFUNCADDR original_handle;
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<CryptoAPIInjector>;
+  friend struct base::LazyInstanceTraitsBase<CryptoAPIInjector>;
 
   CryptoAPIInjector()
       : original_function(NULL),
diff --git a/net/cert/x509_certificate.cc b/net/cert/x509_certificate.cc
index 782f4a4c..377cb7e 100644
--- a/net/cert/x509_certificate.cc
+++ b/net/cert/x509_certificate.cc
@@ -102,7 +102,7 @@
   // Obtain an instance of X509CertificateCache via a LazyInstance.
   X509CertificateCache() {}
   ~X509CertificateCache() {}
-  friend struct base::DefaultLazyInstanceTraits<X509CertificateCache>;
+  friend struct base::LazyInstanceTraitsBase<X509CertificateCache>;
 
   // You must acquire this lock before using any private data of this object
   // You must not block while holding this lock.
diff --git a/net/cert_net/nss_ocsp.cc b/net/cert_net/nss_ocsp.cc
index d2e250e..19fb32d 100644
--- a/net/cert_net/nss_ocsp.cc
+++ b/net/cert_net/nss_ocsp.cc
@@ -106,7 +106,7 @@
   }
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<OCSPIOLoop>;
+  friend struct base::LazyInstanceTraitsBase<OCSPIOLoop>;
 
   OCSPIOLoop();
 
@@ -164,7 +164,7 @@
 
 class OCSPNSSInitialization {
  private:
-  friend struct base::DefaultLazyInstanceTraits<OCSPNSSInitialization>;
+  friend struct base::LazyInstanceTraitsBase<OCSPNSSInitialization>;
 
   OCSPNSSInitialization();
   // This class is only instantiated as a leaky LazyInstance, so its destructor
diff --git a/net/disk_cache/blockfile/file_win.cc b/net/disk_cache/blockfile/file_win.cc
index f38595d..219df2a 100644
--- a/net/disk_cache/blockfile/file_win.cc
+++ b/net/disk_cache/blockfile/file_win.cc
@@ -39,8 +39,8 @@
                      DWORD error) override;
 };
 
-static base::LazyInstance<CompletionHandler> g_completion_handler =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<CompletionHandler>::DestructorAtExit
+    g_completion_handler = LAZY_INSTANCE_INITIALIZER;
 
 void CompletionHandler::OnIOCompleted(
     base::MessageLoopForIO::IOContext* context,
diff --git a/net/dns/dns_reloader.cc b/net/dns/dns_reloader.cc
index 74534e6b..5e9165e 100644
--- a/net/dns/dns_reloader.cc
+++ b/net/dns/dns_reloader.cc
@@ -92,7 +92,7 @@
 
   base::Lock lock_;  // Protects resolver_generation_.
   int resolver_generation_;
-  friend struct base::DefaultLazyInstanceTraits<DnsReloader>;
+  friend struct base::LazyInstanceTraitsBase<DnsReloader>;
 
   // We use thread local storage to identify which ReloadState to interact with.
   static base::ThreadLocalStorage::StaticSlot tls_index_;
diff --git a/net/ssl/client_key_store.h b/net/ssl/client_key_store.h
index b9f182b3..e1afa1d 100644
--- a/net/ssl/client_key_store.h
+++ b/net/ssl/client_key_store.h
@@ -58,7 +58,7 @@
       const X509Certificate& certificate);
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<ClientKeyStore>;
+  friend struct base::LazyInstanceTraitsBase<ClientKeyStore>;
 
   ClientKeyStore();
   ~ClientKeyStore();
diff --git a/net/url_request/url_fetcher_core.cc b/net/url_request/url_fetcher_core.cc
index 146edf7..98edef6 100644
--- a/net/url_request/url_fetcher_core.cc
+++ b/net/url_request/url_fetcher_core.cc
@@ -68,7 +68,7 @@
 // URLFetcherCore -------------------------------------------------------------
 
 // static
-base::LazyInstance<URLFetcherCore::Registry>
+base::LazyInstance<URLFetcherCore::Registry>::DestructorAtExit
     URLFetcherCore::g_registry = LAZY_INSTANCE_INITIALIZER;
 
 URLFetcherCore::URLFetcherCore(URLFetcher* fetcher,
diff --git a/net/url_request/url_fetcher_core.h b/net/url_request/url_fetcher_core.h
index 570c0f8..db0e8a11 100644
--- a/net/url_request/url_fetcher_core.h
+++ b/net/url_request/url_fetcher_core.h
@@ -346,7 +346,7 @@
   // Total expected bytes to receive (-1 if it cannot be determined).
   int64_t total_response_bytes_;
 
-  static base::LazyInstance<Registry> g_registry;
+  static base::LazyInstance<Registry>::DestructorAtExit g_registry;
 
   DISALLOW_COPY_AND_ASSIGN(URLFetcherCore);
 };
diff --git a/ppapi/proxy/interface_list.cc b/ppapi/proxy/interface_list.cc
index 07483d8..4984753 100644
--- a/ppapi/proxy/interface_list.cc
+++ b/ppapi/proxy/interface_list.cc
@@ -168,7 +168,8 @@
   return new ProxyClass(dispatcher);
 }
 
-base::LazyInstance<PpapiPermissions> g_process_global_permissions;
+base::LazyInstance<PpapiPermissions>::DestructorAtExit
+    g_process_global_permissions;
 
 }  // namespace
 
diff --git a/ppapi/shared_impl/ppapi_globals.cc b/ppapi/shared_impl/ppapi_globals.cc
index b016c9c..1d6d78f 100644
--- a/ppapi/shared_impl/ppapi_globals.cc
+++ b/ppapi/shared_impl/ppapi_globals.cc
@@ -15,7 +15,7 @@
 namespace {
 // Thread-local globals for testing. See SetPpapiGlobalsOnThreadForTest for more
 // information.
-base::LazyInstance<base::ThreadLocalPointer<PpapiGlobals> >::Leaky
+base::LazyInstance<base::ThreadLocalPointer<PpapiGlobals>>::Leaky
     tls_ppapi_globals_for_test = LAZY_INSTANCE_INITIALIZER;
 }  // namespace
 
diff --git a/printing/print_settings.cc b/printing/print_settings.cc
index a234cd9..c35863dc 100644
--- a/printing/print_settings.cc
+++ b/printing/print_settings.cc
@@ -12,7 +12,7 @@
 
 namespace printing {
 
-base::LazyInstance<std::string> g_user_agent;
+base::LazyInstance<std::string>::DestructorAtExit g_user_agent;
 
 void SetAgent(const std::string& user_agent) {
   g_user_agent.Get() = user_agent;
diff --git a/printing/printed_document.cc b/printing/printed_document.cc
index 047d2db..bd62ff2 100644
--- a/printing/printed_document.cc
+++ b/printing/printed_document.cc
@@ -37,7 +37,7 @@
 
 namespace {
 
-base::LazyInstance<base::FilePath> g_debug_dump_info =
+base::LazyInstance<base::FilePath>::DestructorAtExit g_debug_dump_info =
     LAZY_INSTANCE_INITIALIZER;
 
 void DebugDumpPageTask(const base::string16& doc_name,
diff --git a/remoting/host/audio_capturer_linux.cc b/remoting/host/audio_capturer_linux.cc
index bce9b6a..9c42720 100644
--- a/remoting/host/audio_capturer_linux.cc
+++ b/remoting/host/audio_capturer_linux.cc
@@ -18,7 +18,7 @@
 
 namespace {
 
-base::LazyInstance<scoped_refptr<AudioPipeReader> >::Leaky
+base::LazyInstance<scoped_refptr<AudioPipeReader>>::Leaky
     g_pulseaudio_pipe_sink_reader = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
diff --git a/remoting/host/security_key/security_key_ipc_constants.cc b/remoting/host/security_key/security_key_ipc_constants.cc
index 424ca2b..4ef5f4f 100644
--- a/remoting/host/security_key/security_key_ipc_constants.cc
+++ b/remoting/host/security_key/security_key_ipc_constants.cc
@@ -14,7 +14,7 @@
 #endif  // defined(OS_POSIX)
 
 namespace {
-base::LazyInstance<mojo::edk::NamedPlatformHandle>
+base::LazyInstance<mojo::edk::NamedPlatformHandle>::DestructorAtExit
     g_security_key_ipc_channel_name = LAZY_INSTANCE_INITIALIZER;
 
 constexpr char kSecurityKeyIpcChannelName[] = "security_key_ipc_channel";
diff --git a/remoting/host/win/chromoting_module.cc b/remoting/host/win/chromoting_module.cc
index 1f64d68c..75c6e9d 100644
--- a/remoting/host/win/chromoting_module.cc
+++ b/remoting/host/win/chromoting_module.cc
@@ -20,8 +20,8 @@
 namespace {
 
 // Holds a reference to the task runner used by the module.
-base::LazyInstance<scoped_refptr<AutoThreadTaskRunner> > g_module_task_runner =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<scoped_refptr<AutoThreadTaskRunner>>::DestructorAtExit
+    g_module_task_runner = LAZY_INSTANCE_INITIALIZER;
 
 // Lowers the process integrity level such that it does not exceed |max_level|.
 // |max_level| is expected to be one of SECURITY_MANDATORY_XXX constants.
diff --git a/remoting/host/win/rdp_client_window.cc b/remoting/host/win/rdp_client_window.cc
index 53cb776..5bcd61d 100644
--- a/remoting/host/win/rdp_client_window.cc
+++ b/remoting/host/win/rdp_client_window.cc
@@ -60,8 +60,8 @@
 };
 
 // Points to a per-thread instance of the window activation hook handle.
-base::LazyInstance<base::ThreadLocalPointer<RdpClientWindow::WindowHook> >
-    g_window_hook = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<base::ThreadLocalPointer<RdpClientWindow::WindowHook>>::
+    DestructorAtExit g_window_hook = LAZY_INSTANCE_INITIALIZER;
 
 // Finds a child window with the class name matching |class_name|. Unlike
 // FindWindowEx() this function walks the tree of windows recursively. The walk
diff --git a/services/catalog/catalog.cc b/services/catalog/catalog.cc
index bdd5581..bdcb40af 100644
--- a/services/catalog/catalog.cc
+++ b/services/catalog/catalog.cc
@@ -37,8 +37,8 @@
 const char kCatalogServiceExecutableKey[] = "executable";
 const char kCatalogServiceManifestKey[] = "manifest";
 
-base::LazyInstance<std::unique_ptr<base::Value>> g_default_static_manifest =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<std::unique_ptr<base::Value>>::DestructorAtExit
+    g_default_static_manifest = LAZY_INSTANCE_INITIALIZER;
 
 void LoadCatalogManifestIntoCache(const base::Value* root, EntryCache* cache) {
   DCHECK(root);
diff --git a/services/file/user_id_map.cc b/services/file/user_id_map.cc
index 1a6068b..36b9681 100644
--- a/services/file/user_id_map.cc
+++ b/services/file/user_id_map.cc
@@ -11,7 +11,7 @@
 namespace file {
 
 namespace {
-base::LazyInstance<std::map<std::string, base::FilePath>>
+base::LazyInstance<std::map<std::string, base::FilePath>>::DestructorAtExit
     g_user_id_to_data_dir = LAZY_INSTANCE_INITIALIZER;
 }  // namespace
 
diff --git a/services/resource_coordinator/memory/coordinator/coordinator_impl.h b/services/resource_coordinator/memory/coordinator/coordinator_impl.h
index 80ce6ae..7a8e1dcd 100644
--- a/services/resource_coordinator/memory/coordinator/coordinator_impl.h
+++ b/services/resource_coordinator/memory/coordinator/coordinator_impl.h
@@ -29,7 +29,7 @@
 
  private:
   friend class CoordinatorImplTest;  // For testing
-  friend struct base::DefaultLazyInstanceTraits<CoordinatorImpl>;
+  friend struct base::LazyInstanceTraitsBase<CoordinatorImpl>;
 
   struct QueuedMemoryDumpRequest {
     QueuedMemoryDumpRequest(const base::trace_event::MemoryDumpRequestArgs args,
diff --git a/storage/browser/blob/shareable_file_reference.cc b/storage/browser/blob/shareable_file_reference.cc
index c8672f7..b1ccc378c 100644
--- a/storage/browser/blob/shareable_file_reference.cc
+++ b/storage/browser/blob/shareable_file_reference.cc
@@ -55,7 +55,8 @@
   DISALLOW_COPY_AND_ASSIGN(ShareableFileMap);
 };
 
-base::LazyInstance<ShareableFileMap> g_file_map = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<ShareableFileMap>::DestructorAtExit g_file_map =
+    LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/storage/browser/fileapi/isolated_context.h b/storage/browser/fileapi/isolated_context.h
index 1f1c1d91..713b105 100644
--- a/storage/browser/fileapi/isolated_context.h
+++ b/storage/browser/fileapi/isolated_context.h
@@ -161,7 +161,7 @@
   base::FilePath CreateVirtualRootPath(const std::string& filesystem_id) const;
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<IsolatedContext>;
+  friend struct base::LazyInstanceTraitsBase<IsolatedContext>;
 
   // Represents each file system instance (defined in the .cc).
   class Instance;
diff --git a/testing/buildbot/chromium.mac.json b/testing/buildbot/chromium.mac.json
index 7308e06..110220c 100644
--- a/testing/buildbot/chromium.mac.json
+++ b/testing/buildbot/chromium.mac.json
@@ -550,22 +550,6 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
-        "test": "extensions_browsertests"
-      },
-      {
-        "args": [
-          "--enable-browser-side-navigation"
-        ],
-        "name": "browser_side_navigation_extensions_browsertests",
-        "swarming": {
-          "can_use_on_swarming_builders": true
-        },
-        "test": "extensions_browsertests"
-      },
-      {
-        "swarming": {
-          "can_use_on_swarming_builders": true
-        },
         "test": "extensions_unittests"
       },
       {
diff --git a/testing/buildbot/chromium.win.json b/testing/buildbot/chromium.win.json
index 0457126..b7b99c8 100644
--- a/testing/buildbot/chromium.win.json
+++ b/testing/buildbot/chromium.win.json
@@ -766,22 +766,6 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
-        "test": "interactive_ui_tests"
-      },
-      {
-        "args": [
-          "--enable-browser-side-navigation"
-        ],
-        "name": "browser_side_navigation_interactive_ui_tests",
-        "swarming": {
-          "can_use_on_swarming_builders": true
-        },
-        "test": "interactive_ui_tests"
-      },
-      {
-        "swarming": {
-          "can_use_on_swarming_builders": true
-        },
         "test": "ipc_tests"
       },
       {
diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/garbage-collection-ran-during-error.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/garbage-collection-ran-during-error.js
index 6632e30..b30d785 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/garbage-collection-ran-during-error.js
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/garbage-collection-ran-during-error.js
@@ -13,7 +13,8 @@
           getCharacteristics()|
           getCharacteristics('measurement_interval')[UUID]]),
         new DOMException(
-          'GATT Server disconnected while retrieving characteristics.',
+          'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+          '(Re)connect first with `device.gatt.connect`.',
           'NetworkError'));
       // Disconnect called to clear attributeInstanceMap and allow the
       // object to get garbage collected.
diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/garbage-collection-ran-during-success.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/garbage-collection-ran-during-success.js
index 4205bb07..46e7b63f 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/garbage-collection-ran-during-success.js
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/garbage-collection-ran-during-success.js
@@ -13,7 +13,8 @@
           getCharacteristics()|
           getCharacteristics('measurement_interval')[UUID]]),
         new DOMException(
-          'GATT Server disconnected while retrieving characteristics.',
+          'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+          '(Re)connect first with `device.gatt.connect`.',
           'NetworkError'));
       // Disconnect called to clear attributeInstanceMap and allow the
       // object to get garbage collected.
diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/device-disconnects-before.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/device-disconnects-before.html
index fdbbd887..61f8e12 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/device-disconnects-before.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/device-disconnects-before.html
@@ -20,7 +20,8 @@
         .then(() => assert_promise_rejects_with_message(
           heart_rate_service.getCharacteristic('heart_rate_measurement'),
           new DOMException(
-            'GATT Server is disconnected. Cannot retrieve characteristics.',
+            'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+            '(Re)connect first with `device.gatt.connect`.',
             'NetworkError')));
     });
 }, 'Device disconnects before getCharacteristic. Reject with NetworkError');
diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/device-disconnects-during.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/device-disconnects-during.html
index c2776b9..c31f0ab 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/device-disconnects-during.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/device-disconnects-during.html
@@ -21,7 +21,8 @@
           return assert_promise_rejects_with_message(
             heart_rate_service.getCharacteristic('heart_rate_measurement'),
             new DOMException(
-              'GATT Server disconnected while retrieving characteristics.',
+              'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+              '(Re)connect first with `device.gatt.connect`.',
               'NetworkError'));
         });
     });
diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/disconnect-called-before.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/disconnect-called-before.html
index 154d0fe..79fd8eb 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/disconnect-called-before.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/disconnect-called-before.html
@@ -16,7 +16,8 @@
           return assert_promise_rejects_with_message(
             heart_rate_service.getCharacteristic('heart_rate_measurement'),
             new DOMException(
-              'GATT Server is disconnected. Cannot retrieve characteristics.',
+              'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+              '(Re)connect first with `device.gatt.connect`.',
               'NetworkError'));
         });
     });
diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/disconnect-called-during.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/disconnect-called-during.html
index 454402fc..0399d0ef 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/disconnect-called-during.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/disconnect-called-during.html
@@ -15,7 +15,8 @@
           let promise = assert_promise_rejects_with_message(
             heart_rate_service.getCharacteristic('heart_rate_measurement'),
             new DOMException(
-              'GATT Server disconnected while retrieving characteristics.',
+              'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+              '(Re)connect first with `device.gatt.connect`.',
               'NetworkError'));
           gattServer.disconnect();
           return promise;
diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-garbage-collection-ran-during-error.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-garbage-collection-ran-during-error.html
index cc4a965..e46582a 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-garbage-collection-ran-during-error.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-garbage-collection-ran-during-error.html
@@ -16,7 +16,8 @@
       promise = assert_promise_rejects_with_message(
         service.getCharacteristic('measurement_interval'),
         new DOMException(
-          'GATT Server disconnected while retrieving characteristics.',
+          'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+          '(Re)connect first with `device.gatt.connect`.',
           'NetworkError'));
       // Disconnect called to clear attributeInstanceMap and allow the
       // object to get garbage collected.
diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-garbage-collection-ran-during-success.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-garbage-collection-ran-during-success.html
index e1164cd..053cafb9 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-garbage-collection-ran-during-success.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-garbage-collection-ran-during-success.html
@@ -16,7 +16,8 @@
       promise = assert_promise_rejects_with_message(
         service.getCharacteristic('measurement_interval'),
         new DOMException(
-          'GATT Server disconnected while retrieving characteristics.',
+          'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+          '(Re)connect first with `device.gatt.connect`.',
           'NetworkError'));
       // Disconnect called to clear attributeInstanceMap and allow the
       // object to get garbage collected.
diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/reconnect-during.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/reconnect-during.html
index 285bac5..5a357a22 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/reconnect-during.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/reconnect-during.html
@@ -15,7 +15,8 @@
           let promise = assert_promise_rejects_with_message(
             service.getCharacteristic('heart_rate_measurement'),
             new DOMException(
-              'GATT Server disconnected while retrieving characteristics.',
+              'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+              '(Re)connect first with `device.gatt.connect`.',
               'NetworkError'));
           gattServer.disconnect();
           return gattServer.connect().then(() => promise);
diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-before-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-before-with-uuid.html
index 4da8cb4..bb8925bb 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-before-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-before-with-uuid.html
@@ -20,7 +20,8 @@
        .then(() => assert_promise_rejects_with_message(
          heart_rate_service.getCharacteristics('heart_rate_measurement'),
          new DOMException(
-           'GATT Server is disconnected. Cannot retrieve characteristics.',
+           'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+           '(Re)connect first with `device.gatt.connect`.',
            'NetworkError')));
     });
 }, 'Device disconnects before getCharacteristics. Reject with NetworkError');
diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-before.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-before.html
index 74b08225..e5725ee8 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-before.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-before.html
@@ -20,7 +20,8 @@
         .then(() => assert_promise_rejects_with_message(
           heart_rate_service.getCharacteristics(),
           new DOMException(
-            'GATT Server is disconnected. Cannot retrieve characteristics.',
+            'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+            '(Re)connect first with `device.gatt.connect`.',
             'NetworkError')));
     });
 }, 'Device disconnects before getCharacteristics. Reject with NetworkError');
diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-during-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-during-with-uuid.html
index 4333c3b..f54cc3e 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-during-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-during-with-uuid.html
@@ -21,7 +21,8 @@
           return assert_promise_rejects_with_message(
             heart_rate_service.getCharacteristics('heart_rate_measurement'),
             new DOMException(
-              'GATT Server disconnected while retrieving characteristics.',
+              'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+              '(Re)connect first with `device.gatt.connect`.',
               'NetworkError'));
         });
     });
diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-during.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-during.html
index 8b877bd3..40b74d9bb 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-during.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-during.html
@@ -21,7 +21,8 @@
           return assert_promise_rejects_with_message(
             heart_rate_service.getCharacteristics(),
             new DOMException(
-              'GATT Server disconnected while retrieving characteristics.',
+              'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+              '(Re)connect first with `device.gatt.connect`.',
               'NetworkError'));
         });
     });
diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-before-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-before-with-uuid.html
index 869d486d..cffa248 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-before-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-before-with-uuid.html
@@ -16,7 +16,8 @@
           return assert_promise_rejects_with_message(
             heart_rate_service.getCharacteristics('heart_rate_measurement'),
             new DOMException(
-              'GATT Server is disconnected. Cannot retrieve characteristics.',
+              'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+              '(Re)connect first with `device.gatt.connect`.',
               'NetworkError'));
         });
     });
diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-before.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-before.html
index dc82293..f635fc3 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-before.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-before.html
@@ -16,7 +16,8 @@
           return assert_promise_rejects_with_message(
             heart_rate_service.getCharacteristics(),
             new DOMException(
-              'GATT Server is disconnected. Cannot retrieve characteristics.',
+              'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+              '(Re)connect first with `device.gatt.connect`.',
               'NetworkError'));
         });
     });
diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-during-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-during-with-uuid.html
index fc6acff..8e8da3a 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-during-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-during-with-uuid.html
@@ -15,7 +15,8 @@
           let promise = assert_promise_rejects_with_message(
             heart_rate_service.getCharacteristics('heart_rate_measurement'),
             new DOMException(
-              'GATT Server disconnected while retrieving characteristics.',
+              'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+              '(Re)connect first with `device.gatt.connect`.',
               'NetworkError'));
           gattServer.disconnect();
           return promise;
diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-during.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-during.html
index dbb551f60..4cda3b1 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-during.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-during.html
@@ -15,7 +15,8 @@
           let promise = assert_promise_rejects_with_message(
             heart_rate_service.getCharacteristics(),
             new DOMException(
-              'GATT Server disconnected while retrieving characteristics.',
+              'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+              '(Re)connect first with `device.gatt.connect`.',
               'NetworkError'));
           gattServer.disconnect();
           return promise;
diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-error-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-error-with-uuid.html
index 8622d25..65532abf1 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-error-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-error-with-uuid.html
@@ -16,7 +16,8 @@
       promise = assert_promise_rejects_with_message(
         service.getCharacteristics('measurement_interval'),
         new DOMException(
-          'GATT Server disconnected while retrieving characteristics.',
+          'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+          '(Re)connect first with `device.gatt.connect`.',
           'NetworkError'));
       // Disconnect called to clear attributeInstanceMap and allow the
       // object to get garbage collected.
diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-error.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-error.html
index ff88cc1..2c4b349 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-error.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-error.html
@@ -16,7 +16,8 @@
       promise = assert_promise_rejects_with_message(
         service.getCharacteristics(),
         new DOMException(
-          'GATT Server disconnected while retrieving characteristics.',
+          'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+          '(Re)connect first with `device.gatt.connect`.',
           'NetworkError'));
       // Disconnect called to clear attributeInstanceMap and allow the
       // object to get garbage collected.
diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success-with-uuid.html
index 6e0a85c..eebfa73 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success-with-uuid.html
@@ -16,7 +16,8 @@
       promise = assert_promise_rejects_with_message(
         service.getCharacteristics('measurement_interval'),
         new DOMException(
-          'GATT Server disconnected while retrieving characteristics.',
+          'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+          '(Re)connect first with `device.gatt.connect`.',
           'NetworkError'));
       // Disconnect called to clear attributeInstanceMap and allow the
       // object to get garbage collected.
diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success.html
index 58310668..bbe0183 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-success.html
@@ -16,7 +16,8 @@
       promise = assert_promise_rejects_with_message(
         service.getCharacteristics(),
         new DOMException(
-          'GATT Server disconnected while retrieving characteristics.',
+          'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+          '(Re)connect first with `device.gatt.connect`.',
           'NetworkError'));
       // Disconnect called to clear attributeInstanceMap and allow the
       // object to get garbage collected.
diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/reconnect-during-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/reconnect-during-with-uuid.html
index 1504a5486..07086af 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/reconnect-during-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/reconnect-during-with-uuid.html
@@ -15,7 +15,8 @@
           let promise = assert_promise_rejects_with_message(
             service.getCharacteristics('heart_rate_measurement'),
             new DOMException(
-              'GATT Server disconnected while retrieving characteristics.',
+              'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+              '(Re)connect first with `device.gatt.connect`.',
               'NetworkError'));
           gattServer.disconnect();
           return gattServer.connect().then(() => promise);
diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/reconnect-during.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/reconnect-during.html
index e7591b4..1afecaa 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/reconnect-during.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/reconnect-during.html
@@ -15,7 +15,8 @@
           let promise = assert_promise_rejects_with_message(
             service.getCharacteristics(),
             new DOMException(
-              'GATT Server disconnected while retrieving characteristics.',
+              'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+              '(Re)connect first with `device.gatt.connect`.',
               'NetworkError'));
           gattServer.disconnect();
           return gattServer.connect().then(() => promise);
diff --git a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/foreign-fetch-cors.https-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/foreign-fetch-cors.https-expected.txt
deleted file mode 100644
index 00325dc..0000000
--- a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/foreign-fetch-cors.https-expected.txt
+++ /dev/null
@@ -1,19 +0,0 @@
-This is a testharness.js-based test.
-FAIL Same origin fetch without CORS headers, not exposed promise_test: Unhandled rejection with value: "failure:TypeError: Failed to register a ServiceWorker: ServiceWorker script evaluation failed"
-FAIL Same origin fetch without CORS headers, only origin exposed promise_test: Unhandled rejection with value: "failure:TypeError: Failed to register a ServiceWorker: ServiceWorker script evaluation failed"
-FAIL Same origin fetch without CORS headers, headers and origin exposed promise_test: Unhandled rejection with value: "failure:TypeError: Failed to register a ServiceWorker: ServiceWorker script evaluation failed"
-FAIL Same origin fetch without CORS headers, exposed to wrong origin promise_test: Unhandled rejection with value: "failure:TypeError: Failed to register a ServiceWorker: ServiceWorker script evaluation failed"
-FAIL Same origin fetch with CORS headers, not exposed promise_test: Unhandled rejection with value: "failure:TypeError: Failed to register a ServiceWorker: ServiceWorker script evaluation failed"
-FAIL Same origin fetch with CORS headers, only origin exposed promise_test: Unhandled rejection with value: "failure:TypeError: Failed to register a ServiceWorker: ServiceWorker script evaluation failed"
-FAIL Same origin fetch with CORS headers, headers and origin exposed promise_test: Unhandled rejection with value: "failure:TypeError: Failed to register a ServiceWorker: ServiceWorker script evaluation failed"
-FAIL Same origin fetch with CORS headers, exposed to wrong origin promise_test: Unhandled rejection with value: "failure:TypeError: Failed to register a ServiceWorker: ServiceWorker script evaluation failed"
-FAIL Cross origin fetch without CORS headers, not exposed promise_test: Unhandled rejection with value: "failure:TypeError: Failed to register a ServiceWorker: ServiceWorker script evaluation failed"
-FAIL Cross origin fetch with ACEHeaders header, not exposed promise_test: Unhandled rejection with value: "failure:TypeError: Failed to register a ServiceWorker: ServiceWorker script evaluation failed"
-FAIL Cross origin fetch with ACEHeaders header, only origin exposed promise_test: Unhandled rejection with value: "failure:TypeError: Failed to register a ServiceWorker: ServiceWorker script evaluation failed"
-FAIL Cross origin fetch with ACEHeaders header, headers and origin exposed promise_test: Unhandled rejection with value: "failure:TypeError: Failed to register a ServiceWorker: ServiceWorker script evaluation failed"
-FAIL Cross origin fetch with ACEHeaders header, exposed to wrong origin promise_test: Unhandled rejection with value: "failure:TypeError: Failed to register a ServiceWorker: ServiceWorker script evaluation failed"
-FAIL Cross origin fetch without ACEHeaders header, not exposed promise_test: Unhandled rejection with value: "failure:TypeError: Failed to register a ServiceWorker: ServiceWorker script evaluation failed"
-FAIL Cross origin fetch without ACEHeaders header, only origin exposed promise_test: Unhandled rejection with value: "failure:TypeError: Failed to register a ServiceWorker: ServiceWorker script evaluation failed"
-FAIL Cross origin fetch without ACEHeaders header, headers and origin exposed promise_test: Unhandled rejection with value: "failure:TypeError: Failed to register a ServiceWorker: ServiceWorker script evaluation failed"
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/foreign-fetch-workers.https-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/foreign-fetch-workers.https-expected.txt
deleted file mode 100644
index e3b0557f..0000000
--- a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/foreign-fetch-workers.https-expected.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-CONSOLE ERROR: Fetch API cannot load https://www2.web-platform.test:8444/service-workers/service-worker/resources/simple.txt?basic_dedicated_insecure. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://www2.web-platform.test:8001' is therefore not allowed access. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
-This is a testharness.js-based test.
-FAIL Foreign fetch can intercept fetches made from a service worker assert_unreached: unregister and register should not fail: Failed to register a ServiceWorker: ServiceWorker script evaluation failed Reached unreachable code
-PASS Foreign fetch can intercept fetches made from a dedicated worker 
-PASS Foreign fetch can intercept fetches made from a shared worker 
-PASS Fetches from an insecure dedicated worker aren't intercepted. 
-PASS Fetches from an insecure shared worker aren't intercepted. 
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/resources/foreign-fetch-cors-worker.js b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/resources/foreign-fetch-cors-worker.js
index 36c7b9d..b19d074 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/resources/foreign-fetch-cors-worker.js
+++ b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/resources/foreign-fetch-cors-worker.js
@@ -1,4 +1,4 @@
-importScripts('get-host-info.sub.js');
+importScripts('/common/get-host-info.sub.js');
 var host_info = get_host_info();
 
 self.addEventListener('install', function(event) {
diff --git a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/resources/foreign-fetch-helper-worker.js b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/resources/foreign-fetch-helper-worker.js
index 7a852cb..ce596044 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/resources/foreign-fetch-helper-worker.js
+++ b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/resources/foreign-fetch-helper-worker.js
@@ -1,4 +1,4 @@
-importScripts('get-host-info.sub.js');
+importScripts('/common/get-host-info.sub.js');
 const host_info = get_host_info();
 
 self.onfetch = e => {
diff --git a/third_party/WebKit/LayoutTests/fast/spatial-navigation/snav-div-in-anchor-and-img-crash.html b/third_party/WebKit/LayoutTests/fast/spatial-navigation/snav-div-in-anchor-and-img-crash.html
new file mode 100644
index 0000000..a4bd02d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/spatial-navigation/snav-div-in-anchor-and-img-crash.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<span><a href="#" id="start"><div></div></a></span>
+<img style="display:block;">
+
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script>
+    test(() => {
+        assert_true(!!window.testRunner);
+        testRunner.overridePreference("WebKitTabToLinksPreferenceKey", 1);
+        testRunner.overridePreference("WebKitSpatialNavigationEnabled", 1);
+        document.getElementById("start").focus();
+        eventSender.keyDown("ArrowDown");
+    }, "No crash or assertion failure");
+</script>
diff --git a/third_party/WebKit/LayoutTests/fast/text/flexbox-selection-expected.html b/third_party/WebKit/LayoutTests/fast/text/flexbox-selection-expected.html
deleted file mode 100644
index de3012b..0000000
--- a/third_party/WebKit/LayoutTests/fast/text/flexbox-selection-expected.html
+++ /dev/null
@@ -1,18 +0,0 @@
-<!DOCTYPE html>
-<div style="background-color: #ddd; font-size: 24pt">
-  <div style="width: 100px; display: inline-block">
-    <span id="a">aaaa</span><br>
-    <span id="b">bbbb</span>
-  </div><div style="width: 100px; display: inline-block">
-    <span id="c">cccc</span><br>
-    <span id="d">dddd</span>
-  </div>
-</div>
-<script>
-
-var b = document.querySelector('#b'),
-    d = document.querySelector('#d');
-getSelection().setBaseAndExtent(b.firstChild, 0, d.firstChild, 2);
-focus();
-
-</script>
diff --git a/third_party/WebKit/LayoutTests/fast/text/flexbox-selection-nested-expected.html b/third_party/WebKit/LayoutTests/fast/text/flexbox-selection-nested-expected.html
deleted file mode 100644
index 3d33f7ea..0000000
--- a/third_party/WebKit/LayoutTests/fast/text/flexbox-selection-nested-expected.html
+++ /dev/null
@@ -1,33 +0,0 @@
-<!DOCTYPE html>
-<style>
-#root {
-  background-color: #ddd;
-  font-size: 24pt;
-  position: relative;
-  width: 200px;
-}
-span {
-  display: inline-block;
-  width: 100px;
-}
-</style>
-
-This test verifies that a selection spanning nested flexbox boundaries
-is drawn correctly.
-
-<div id="root">
-  <div>
-    <span id="start">aaa</span><span>bbb</span>
-  </div>
-  <div>
-    <span>ccc</span><span id="end">ddd</span>
-  </div>
-</div>
-<script>
-
-var start = document.querySelector('#start'),
-    end = document.querySelector('#end');
-getSelection().setBaseAndExtent(start.firstChild, 1, end.firstChild, 2);
-focus();
-
-</script>
diff --git a/third_party/WebKit/LayoutTests/paint/selection/text-selection-inline-block-expected.png b/third_party/WebKit/LayoutTests/paint/selection/text-selection-inline-block-expected.png
new file mode 100644
index 0000000..942d8663
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/paint/selection/text-selection-inline-block-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/paint/selection/text-selection-inline-block-expected.txt b/third_party/WebKit/LayoutTests/paint/selection/text-selection-inline-block-expected.txt
new file mode 100644
index 0000000..717b491
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/paint/selection/text-selection-inline-block-expected.txt
@@ -0,0 +1,13 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x73
+  LayoutBlockFlow {HTML} at (0,0) size 800x73
+    LayoutBlockFlow {BODY} at (8,8) size 784x57
+      LayoutBlockFlow {DIV} at (0,0) size 24x57
+        LayoutText {#text} at (0,1) size 24x55
+          text run at (0,1) width 24: "x"
+      LayoutText {#text} at (24,1) size 24x55
+        text run at (24,1) width 24: "y"
+      LayoutText {#text} at (0,0) size 0x0
+selection start: position 0 of child 0 {#text} of child 0 {DIV} of body
+selection end:   position 1 of child 1 {#text} of body
diff --git a/third_party/WebKit/LayoutTests/paint/selection/text-selection-inline-block-rtl-expected.png b/third_party/WebKit/LayoutTests/paint/selection/text-selection-inline-block-rtl-expected.png
new file mode 100644
index 0000000..bc14159b
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/paint/selection/text-selection-inline-block-rtl-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/paint/selection/text-selection-inline-block-rtl-expected.txt b/third_party/WebKit/LayoutTests/paint/selection/text-selection-inline-block-rtl-expected.txt
new file mode 100644
index 0000000..cc337a7
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/paint/selection/text-selection-inline-block-rtl-expected.txt
@@ -0,0 +1,13 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x73
+  LayoutBlockFlow {HTML} at (0,0) size 800x73
+    LayoutBlockFlow {BODY} at (8,8) size 784x57
+      LayoutBlockFlow {DIV} at (0,0) size 784x57
+        LayoutBlockFlow {DIV} at (760,0) size 24x57
+          LayoutText {#text} at (0,1) size 24x55
+            text run at (0,1) width 24 RTL override: "x"
+        LayoutText {#text} at (736,1) size 24x55
+          text run at (736,1) width 24 RTL override: "y"
+selection start: position 0 of child 0 {#text} of child 1 {DIV} of child 0 {DIV} of body
+selection end:   position 1 of child 2 {#text} of child 0 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/paint/selection/text-selection-inline-block-rtl.html b/third_party/WebKit/LayoutTests/paint/selection/text-selection-inline-block-rtl.html
new file mode 100644
index 0000000..40f9d3a2
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/paint/selection/text-selection-inline-block-rtl.html
@@ -0,0 +1,19 @@
+<!doctype html>
+<script src="../../resources/run-after-layout-and-paint.js"></script>
+<style>
+body {
+  font-size: 48px;
+}
+.rtl {
+  direction: rtl;
+  unicode-bidi: bidi-override;
+}
+</style>
+<div class="rtl">
+  <div class="rtl" style="display:inline-block">x</div>y
+</div>
+<script>
+runAfterLayoutAndPaint(function() {
+  document.execCommand("SelectAll", false);
+}, true);
+</script>
diff --git a/third_party/WebKit/LayoutTests/paint/selection/text-selection-inline-block.html b/third_party/WebKit/LayoutTests/paint/selection/text-selection-inline-block.html
new file mode 100644
index 0000000..867d3be
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/paint/selection/text-selection-inline-block.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<script src="../../resources/run-after-layout-and-paint.js"></script>
+<style>
+body {
+  font-size: 48px;
+}
+</style>
+<div style="display:inline-block">x</div>y
+<script>
+runAfterLayoutAndPaint(function() {
+  document.execCommand("SelectAll", false);
+}, true);
+</script>
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/text/flexbox-selection-expected.png b/third_party/WebKit/LayoutTests/platform/linux/fast/text/flexbox-selection-expected.png
new file mode 100644
index 0000000..365625ad
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/text/flexbox-selection-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/text/flexbox-selection-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/fast/text/flexbox-selection-expected.txt
new file mode 100644
index 0000000..a7f3203
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/text/flexbox-selection-expected.txt
@@ -0,0 +1,26 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x90
+  LayoutBlockFlow {HTML} at (0,0) size 800x90
+    LayoutBlockFlow {BODY} at (8,8) size 784x74
+      LayoutFlexibleBox {DIV} at (0,0) size 784x74 [bgcolor=#DDDDDD]
+        LayoutBlockFlow {DIV} at (0,0) size 100x74
+          LayoutInline {SPAN} at (0,0) size 56x36
+            LayoutText {#text} at (0,0) size 56x36
+              text run at (0,0) width 56: "aaaa"
+          LayoutBR {BR} at (56,0) size 0x36
+          LayoutInline {SPAN} at (0,0) size 64x36
+            LayoutText {#text} at (0,37) size 64x36
+              text run at (0,37) width 64: "bbbb"
+          LayoutText {#text} at (0,0) size 0x0
+        LayoutBlockFlow {DIV} at (100,0) size 100x74
+          LayoutInline {SPAN} at (0,0) size 56x36
+            LayoutText {#text} at (0,0) size 56x36
+              text run at (0,0) width 56: "cccc"
+          LayoutBR {BR} at (56,0) size 0x36
+          LayoutInline {SPAN} at (0,0) size 64x36
+            LayoutText {#text} at (0,37) size 64x36
+              text run at (0,37) width 64: "dddd"
+          LayoutText {#text} at (0,0) size 0x0
+selection start: position 0 of child 0 {#text} of child 4 {SPAN} of child 1 {DIV} of child 0 {DIV} of body
+selection end:   position 2 of child 0 {#text} of child 4 {SPAN} of child 3 {DIV} of child 0 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/text/flexbox-selection-nested-expected.png b/third_party/WebKit/LayoutTests/platform/linux/fast/text/flexbox-selection-nested-expected.png
new file mode 100644
index 0000000..ac2cd06
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/text/flexbox-selection-nested-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/text/flexbox-selection-nested-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/fast/text/flexbox-selection-nested-expected.txt
new file mode 100644
index 0000000..4a68f776
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/text/flexbox-selection-nested-expected.txt
@@ -0,0 +1,28 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x110
+  LayoutBlockFlow {HTML} at (0,0) size 800x110
+    LayoutBlockFlow {BODY} at (8,8) size 784x94
+      LayoutBlockFlow (anonymous) at (0,0) size 784x20
+        LayoutText {#text} at (0,0) size 550x19
+          text run at (0,0) width 550: "This test verifies that a selection spanning nested flexbox boundaries is drawn correctly."
+layer at (8,28) size 200x74
+  LayoutBlockFlow (relative positioned) {DIV} at (0,20) size 200x74 [bgcolor=#DDDDDD]
+    LayoutFlexibleBox {DIV} at (0,0) size 200x37
+      LayoutBlockFlow {SPAN} at (0,0) size 100x37
+        LayoutText {#text} at (0,0) size 42x36
+          text run at (0,0) width 42: "aaa"
+      LayoutFlexibleBox {DIV} at (100,0) size 100x37
+        LayoutBlockFlow {SPAN} at (0,0) size 100x37
+          LayoutText {#text} at (0,0) size 48x36
+            text run at (0,0) width 48: "bbb"
+    LayoutFlexibleBox {DIV} at (0,37) size 200x37
+      LayoutBlockFlow {SPAN} at (0,0) size 100x37
+        LayoutText {#text} at (0,0) size 42x36
+          text run at (0,0) width 42: "ccc"
+      LayoutFlexibleBox {DIV} at (100,0) size 100x37
+        LayoutBlockFlow {SPAN} at (0,0) size 100x37
+          LayoutText {#text} at (0,0) size 48x36
+            text run at (0,0) width 48: "ddd"
+selection start: position 1 of child 0 {#text} of child 1 {SPAN} of child 1 {DIV} of child 1 {DIV} of body
+selection end:   position 2 of child 0 {#text} of child 0 {SPAN} of child 3 {DIV} of child 3 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/linux/paint/selection/text-selection-inline-block-expected.png b/third_party/WebKit/LayoutTests/platform/linux/paint/selection/text-selection-inline-block-expected.png
new file mode 100644
index 0000000..942d8663
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/linux/paint/selection/text-selection-inline-block-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/paint/selection/text-selection-inline-block-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/paint/selection/text-selection-inline-block-expected.txt
new file mode 100644
index 0000000..717b491
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/linux/paint/selection/text-selection-inline-block-expected.txt
@@ -0,0 +1,13 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x73
+  LayoutBlockFlow {HTML} at (0,0) size 800x73
+    LayoutBlockFlow {BODY} at (8,8) size 784x57
+      LayoutBlockFlow {DIV} at (0,0) size 24x57
+        LayoutText {#text} at (0,1) size 24x55
+          text run at (0,1) width 24: "x"
+      LayoutText {#text} at (24,1) size 24x55
+        text run at (24,1) width 24: "y"
+      LayoutText {#text} at (0,0) size 0x0
+selection start: position 0 of child 0 {#text} of child 0 {DIV} of body
+selection end:   position 1 of child 1 {#text} of body
diff --git a/third_party/WebKit/LayoutTests/platform/linux/paint/selection/text-selection-inline-block-rtl-expected.png b/third_party/WebKit/LayoutTests/platform/linux/paint/selection/text-selection-inline-block-rtl-expected.png
new file mode 100644
index 0000000..bc14159b
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/linux/paint/selection/text-selection-inline-block-rtl-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/paint/selection/text-selection-inline-block-rtl-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/paint/selection/text-selection-inline-block-rtl-expected.txt
new file mode 100644
index 0000000..cc337a7
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/linux/paint/selection/text-selection-inline-block-rtl-expected.txt
@@ -0,0 +1,13 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x73
+  LayoutBlockFlow {HTML} at (0,0) size 800x73
+    LayoutBlockFlow {BODY} at (8,8) size 784x57
+      LayoutBlockFlow {DIV} at (0,0) size 784x57
+        LayoutBlockFlow {DIV} at (760,0) size 24x57
+          LayoutText {#text} at (0,1) size 24x55
+            text run at (0,1) width 24 RTL override: "x"
+        LayoutText {#text} at (736,1) size 24x55
+          text run at (736,1) width 24 RTL override: "y"
+selection start: position 0 of child 0 {#text} of child 1 {DIV} of child 0 {DIV} of body
+selection end:   position 1 of child 2 {#text} of child 0 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/text/flexbox-selection-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/text/flexbox-selection-expected.png
new file mode 100644
index 0000000..879d484f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/text/flexbox-selection-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/text/flexbox-selection-nested-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/text/flexbox-selection-nested-expected.png
new file mode 100644
index 0000000..f8d5d48
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/text/flexbox-selection-nested-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.11/fast/text/flexbox-selection-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/fast/text/flexbox-selection-expected.png
new file mode 100644
index 0000000..30bd61f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/fast/text/flexbox-selection-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.11/fast/text/flexbox-selection-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/fast/text/flexbox-selection-expected.txt
new file mode 100644
index 0000000..ecef6e9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/fast/text/flexbox-selection-expected.txt
@@ -0,0 +1,26 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x90
+  LayoutBlockFlow {HTML} at (0,0) size 800x90
+    LayoutBlockFlow {BODY} at (8,8) size 784x74
+      LayoutFlexibleBox {DIV} at (0,0) size 784x74 [bgcolor=#DDDDDD]
+        LayoutBlockFlow {DIV} at (0,0) size 100x74
+          LayoutInline {SPAN} at (0,0) size 57x37
+            LayoutText {#text} at (0,0) size 57x37
+              text run at (0,0) width 57: "aaaa"
+          LayoutBR {BR} at (56,0) size 1x37
+          LayoutInline {SPAN} at (0,0) size 64x37
+            LayoutText {#text} at (0,37) size 64x37
+              text run at (0,37) width 64: "bbbb"
+          LayoutText {#text} at (0,0) size 0x0
+        LayoutBlockFlow {DIV} at (100,0) size 100x74
+          LayoutInline {SPAN} at (0,0) size 57x37
+            LayoutText {#text} at (0,0) size 57x37
+              text run at (0,0) width 57: "cccc"
+          LayoutBR {BR} at (56,0) size 1x37
+          LayoutInline {SPAN} at (0,0) size 64x37
+            LayoutText {#text} at (0,37) size 64x37
+              text run at (0,37) width 64: "dddd"
+          LayoutText {#text} at (0,0) size 0x0
+selection start: position 0 of child 0 {#text} of child 4 {SPAN} of child 1 {DIV} of child 0 {DIV} of body
+selection end:   position 2 of child 0 {#text} of child 4 {SPAN} of child 3 {DIV} of child 0 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.11/fast/text/flexbox-selection-nested-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/fast/text/flexbox-selection-nested-expected.png
new file mode 100644
index 0000000..5103b0c
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/fast/text/flexbox-selection-nested-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.11/fast/text/flexbox-selection-nested-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/fast/text/flexbox-selection-nested-expected.txt
new file mode 100644
index 0000000..c5b92f0
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/fast/text/flexbox-selection-nested-expected.txt
@@ -0,0 +1,28 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x108
+  LayoutBlockFlow {HTML} at (0,0) size 800x108
+    LayoutBlockFlow {BODY} at (8,8) size 784x92
+      LayoutBlockFlow (anonymous) at (0,0) size 784x18
+        LayoutText {#text} at (0,0) size 562x18
+          text run at (0,0) width 562: "This test verifies that a selection spanning nested flexbox boundaries is drawn correctly."
+layer at (8,26) size 200x74
+  LayoutBlockFlow (relative positioned) {DIV} at (0,18) size 200x74 [bgcolor=#DDDDDD]
+    LayoutFlexibleBox {DIV} at (0,0) size 200x37
+      LayoutBlockFlow {SPAN} at (0,0) size 100x37
+        LayoutText {#text} at (0,0) size 43x37
+          text run at (0,0) width 43: "aaa"
+      LayoutFlexibleBox {DIV} at (100,0) size 100x37
+        LayoutBlockFlow {SPAN} at (0,0) size 100x37
+          LayoutText {#text} at (0,0) size 48x37
+            text run at (0,0) width 48: "bbb"
+    LayoutFlexibleBox {DIV} at (0,37) size 200x37
+      LayoutBlockFlow {SPAN} at (0,0) size 100x37
+        LayoutText {#text} at (0,0) size 43x37
+          text run at (0,0) width 43: "ccc"
+      LayoutFlexibleBox {DIV} at (100,0) size 100x37
+        LayoutBlockFlow {SPAN} at (0,0) size 100x37
+          LayoutText {#text} at (0,0) size 48x37
+            text run at (0,0) width 48: "ddd"
+selection start: position 1 of child 0 {#text} of child 1 {SPAN} of child 1 {DIV} of child 1 {DIV} of body
+selection end:   position 2 of child 0 {#text} of child 0 {SPAN} of child 3 {DIV} of child 3 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.11/paint/selection/text-selection-inline-block-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/paint/selection/text-selection-inline-block-expected.png
new file mode 100644
index 0000000..d89a157
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/paint/selection/text-selection-inline-block-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.11/paint/selection/text-selection-inline-block-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/paint/selection/text-selection-inline-block-expected.txt
new file mode 100644
index 0000000..ac955b91
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/paint/selection/text-selection-inline-block-expected.txt
@@ -0,0 +1,13 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x71
+  LayoutBlockFlow {HTML} at (0,0) size 800x71
+    LayoutBlockFlow {BODY} at (8,8) size 784x55
+      LayoutBlockFlow {DIV} at (0,0) size 24x55
+        LayoutText {#text} at (0,0) size 24x55
+          text run at (0,0) width 24: "x"
+      LayoutText {#text} at (24,0) size 24x55
+        text run at (24,0) width 24: "y"
+      LayoutText {#text} at (0,0) size 0x0
+selection start: position 0 of child 0 {#text} of child 0 {DIV} of body
+selection end:   position 1 of child 1 {#text} of body
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.11/paint/selection/text-selection-inline-block-rtl-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/paint/selection/text-selection-inline-block-rtl-expected.png
new file mode 100644
index 0000000..b4ce93ab
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/paint/selection/text-selection-inline-block-rtl-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.11/paint/selection/text-selection-inline-block-rtl-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/paint/selection/text-selection-inline-block-rtl-expected.txt
new file mode 100644
index 0000000..1e15aa9b
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/paint/selection/text-selection-inline-block-rtl-expected.txt
@@ -0,0 +1,13 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x71
+  LayoutBlockFlow {HTML} at (0,0) size 800x71
+    LayoutBlockFlow {BODY} at (8,8) size 784x55
+      LayoutBlockFlow {DIV} at (0,0) size 784x55
+        LayoutBlockFlow {DIV} at (760,0) size 24x55
+          LayoutText {#text} at (0,0) size 24x55
+            text run at (0,0) width 24 RTL override: "x"
+        LayoutText {#text} at (736,0) size 24x55
+          text run at (736,0) width 24 RTL override: "y"
+selection start: position 0 of child 0 {#text} of child 1 {DIV} of child 0 {DIV} of body
+selection end:   position 1 of child 2 {#text} of child 0 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/text/flexbox-selection-nested-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/text/flexbox-selection-nested-expected.png
new file mode 100644
index 0000000..8ab06664
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/text/flexbox-selection-nested-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-retina/fast/text/flexbox-selection-expected.png b/third_party/WebKit/LayoutTests/platform/mac-retina/fast/text/flexbox-selection-expected.png
new file mode 100644
index 0000000..30bd61f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac-retina/fast/text/flexbox-selection-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-retina/fast/text/flexbox-selection-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-retina/fast/text/flexbox-selection-expected.txt
new file mode 100644
index 0000000..ecef6e9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac-retina/fast/text/flexbox-selection-expected.txt
@@ -0,0 +1,26 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x90
+  LayoutBlockFlow {HTML} at (0,0) size 800x90
+    LayoutBlockFlow {BODY} at (8,8) size 784x74
+      LayoutFlexibleBox {DIV} at (0,0) size 784x74 [bgcolor=#DDDDDD]
+        LayoutBlockFlow {DIV} at (0,0) size 100x74
+          LayoutInline {SPAN} at (0,0) size 57x37
+            LayoutText {#text} at (0,0) size 57x37
+              text run at (0,0) width 57: "aaaa"
+          LayoutBR {BR} at (56,0) size 1x37
+          LayoutInline {SPAN} at (0,0) size 64x37
+            LayoutText {#text} at (0,37) size 64x37
+              text run at (0,37) width 64: "bbbb"
+          LayoutText {#text} at (0,0) size 0x0
+        LayoutBlockFlow {DIV} at (100,0) size 100x74
+          LayoutInline {SPAN} at (0,0) size 57x37
+            LayoutText {#text} at (0,0) size 57x37
+              text run at (0,0) width 57: "cccc"
+          LayoutBR {BR} at (56,0) size 1x37
+          LayoutInline {SPAN} at (0,0) size 64x37
+            LayoutText {#text} at (0,37) size 64x37
+              text run at (0,37) width 64: "dddd"
+          LayoutText {#text} at (0,0) size 0x0
+selection start: position 0 of child 0 {#text} of child 4 {SPAN} of child 1 {DIV} of child 0 {DIV} of body
+selection end:   position 2 of child 0 {#text} of child 4 {SPAN} of child 3 {DIV} of child 0 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/mac-retina/fast/text/flexbox-selection-nested-expected.png b/third_party/WebKit/LayoutTests/platform/mac-retina/fast/text/flexbox-selection-nested-expected.png
new file mode 100644
index 0000000..5103b0c
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac-retina/fast/text/flexbox-selection-nested-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-retina/fast/text/flexbox-selection-nested-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-retina/fast/text/flexbox-selection-nested-expected.txt
new file mode 100644
index 0000000..c5b92f0
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac-retina/fast/text/flexbox-selection-nested-expected.txt
@@ -0,0 +1,28 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x108
+  LayoutBlockFlow {HTML} at (0,0) size 800x108
+    LayoutBlockFlow {BODY} at (8,8) size 784x92
+      LayoutBlockFlow (anonymous) at (0,0) size 784x18
+        LayoutText {#text} at (0,0) size 562x18
+          text run at (0,0) width 562: "This test verifies that a selection spanning nested flexbox boundaries is drawn correctly."
+layer at (8,26) size 200x74
+  LayoutBlockFlow (relative positioned) {DIV} at (0,18) size 200x74 [bgcolor=#DDDDDD]
+    LayoutFlexibleBox {DIV} at (0,0) size 200x37
+      LayoutBlockFlow {SPAN} at (0,0) size 100x37
+        LayoutText {#text} at (0,0) size 43x37
+          text run at (0,0) width 43: "aaa"
+      LayoutFlexibleBox {DIV} at (100,0) size 100x37
+        LayoutBlockFlow {SPAN} at (0,0) size 100x37
+          LayoutText {#text} at (0,0) size 48x37
+            text run at (0,0) width 48: "bbb"
+    LayoutFlexibleBox {DIV} at (0,37) size 200x37
+      LayoutBlockFlow {SPAN} at (0,0) size 100x37
+        LayoutText {#text} at (0,0) size 43x37
+          text run at (0,0) width 43: "ccc"
+      LayoutFlexibleBox {DIV} at (100,0) size 100x37
+        LayoutBlockFlow {SPAN} at (0,0) size 100x37
+          LayoutText {#text} at (0,0) size 48x37
+            text run at (0,0) width 48: "ddd"
+selection start: position 1 of child 0 {#text} of child 1 {SPAN} of child 1 {DIV} of child 1 {DIV} of body
+selection end:   position 2 of child 0 {#text} of child 0 {SPAN} of child 3 {DIV} of child 3 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/mac-retina/paint/selection/text-selection-inline-block-expected.png b/third_party/WebKit/LayoutTests/platform/mac-retina/paint/selection/text-selection-inline-block-expected.png
new file mode 100644
index 0000000..d89a157
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac-retina/paint/selection/text-selection-inline-block-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-retina/paint/selection/text-selection-inline-block-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-retina/paint/selection/text-selection-inline-block-expected.txt
new file mode 100644
index 0000000..ac955b91
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac-retina/paint/selection/text-selection-inline-block-expected.txt
@@ -0,0 +1,13 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x71
+  LayoutBlockFlow {HTML} at (0,0) size 800x71
+    LayoutBlockFlow {BODY} at (8,8) size 784x55
+      LayoutBlockFlow {DIV} at (0,0) size 24x55
+        LayoutText {#text} at (0,0) size 24x55
+          text run at (0,0) width 24: "x"
+      LayoutText {#text} at (24,0) size 24x55
+        text run at (24,0) width 24: "y"
+      LayoutText {#text} at (0,0) size 0x0
+selection start: position 0 of child 0 {#text} of child 0 {DIV} of body
+selection end:   position 1 of child 1 {#text} of body
diff --git a/third_party/WebKit/LayoutTests/platform/mac-retina/paint/selection/text-selection-inline-block-rtl-expected.png b/third_party/WebKit/LayoutTests/platform/mac-retina/paint/selection/text-selection-inline-block-rtl-expected.png
new file mode 100644
index 0000000..b4ce93ab
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac-retina/paint/selection/text-selection-inline-block-rtl-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-retina/paint/selection/text-selection-inline-block-rtl-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-retina/paint/selection/text-selection-inline-block-rtl-expected.txt
new file mode 100644
index 0000000..1e15aa9b
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac-retina/paint/selection/text-selection-inline-block-rtl-expected.txt
@@ -0,0 +1,13 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x71
+  LayoutBlockFlow {HTML} at (0,0) size 800x71
+    LayoutBlockFlow {BODY} at (8,8) size 784x55
+      LayoutBlockFlow {DIV} at (0,0) size 784x55
+        LayoutBlockFlow {DIV} at (760,0) size 24x55
+          LayoutText {#text} at (0,0) size 24x55
+            text run at (0,0) width 24 RTL override: "x"
+        LayoutText {#text} at (736,0) size 24x55
+          text run at (736,0) width 24 RTL override: "y"
+selection start: position 0 of child 0 {#text} of child 1 {DIV} of child 0 {DIV} of body
+selection end:   position 1 of child 2 {#text} of child 0 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/text/flexbox-selection-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/text/flexbox-selection-expected.png
new file mode 100644
index 0000000..7a618e01
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/text/flexbox-selection-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/text/flexbox-selection-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/text/flexbox-selection-expected.txt
new file mode 100644
index 0000000..16e083c0
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/text/flexbox-selection-expected.txt
@@ -0,0 +1,26 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x90
+  LayoutBlockFlow {HTML} at (0,0) size 800x90
+    LayoutBlockFlow {BODY} at (8,8) size 784x74
+      LayoutFlexibleBox {DIV} at (0,0) size 784x74 [bgcolor=#DDDDDD]
+        LayoutBlockFlow {DIV} at (0,0) size 100x74
+          LayoutInline {SPAN} at (0,0) size 57x36
+            LayoutText {#text} at (0,0) size 57x36
+              text run at (0,0) width 57: "aaaa"
+          LayoutBR {BR} at (56,0) size 1x36
+          LayoutInline {SPAN} at (0,0) size 64x36
+            LayoutText {#text} at (0,37) size 64x36
+              text run at (0,37) width 64: "bbbb"
+          LayoutText {#text} at (0,0) size 0x0
+        LayoutBlockFlow {DIV} at (100,0) size 100x74
+          LayoutInline {SPAN} at (0,0) size 57x36
+            LayoutText {#text} at (0,0) size 57x36
+              text run at (0,0) width 57: "cccc"
+          LayoutBR {BR} at (56,0) size 1x36
+          LayoutInline {SPAN} at (0,0) size 64x36
+            LayoutText {#text} at (0,37) size 64x36
+              text run at (0,37) width 64: "dddd"
+          LayoutText {#text} at (0,0) size 0x0
+selection start: position 0 of child 0 {#text} of child 4 {SPAN} of child 1 {DIV} of child 0 {DIV} of body
+selection end:   position 2 of child 0 {#text} of child 4 {SPAN} of child 3 {DIV} of child 0 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/text/flexbox-selection-nested-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/text/flexbox-selection-nested-expected.png
new file mode 100644
index 0000000..87fb887
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/text/flexbox-selection-nested-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/text/flexbox-selection-nested-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/text/flexbox-selection-nested-expected.txt
new file mode 100644
index 0000000..b9953047
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/text/flexbox-selection-nested-expected.txt
@@ -0,0 +1,28 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x108
+  LayoutBlockFlow {HTML} at (0,0) size 800x108
+    LayoutBlockFlow {BODY} at (8,8) size 784x92
+      LayoutBlockFlow (anonymous) at (0,0) size 784x18
+        LayoutText {#text} at (0,0) size 563x17
+          text run at (0,0) width 563: "This test verifies that a selection spanning nested flexbox boundaries is drawn correctly."
+layer at (8,26) size 200x74
+  LayoutBlockFlow (relative positioned) {DIV} at (0,18) size 200x74 [bgcolor=#DDDDDD]
+    LayoutFlexibleBox {DIV} at (0,0) size 200x37
+      LayoutBlockFlow {SPAN} at (0,0) size 100x37
+        LayoutText {#text} at (0,0) size 43x36
+          text run at (0,0) width 43: "aaa"
+      LayoutFlexibleBox {DIV} at (100,0) size 100x37
+        LayoutBlockFlow {SPAN} at (0,0) size 100x37
+          LayoutText {#text} at (0,0) size 48x36
+            text run at (0,0) width 48: "bbb"
+    LayoutFlexibleBox {DIV} at (0,37) size 200x37
+      LayoutBlockFlow {SPAN} at (0,0) size 100x37
+        LayoutText {#text} at (0,0) size 43x36
+          text run at (0,0) width 43: "ccc"
+      LayoutFlexibleBox {DIV} at (100,0) size 100x37
+        LayoutBlockFlow {SPAN} at (0,0) size 100x37
+          LayoutText {#text} at (0,0) size 48x36
+            text run at (0,0) width 48: "ddd"
+selection start: position 1 of child 0 {#text} of child 1 {SPAN} of child 1 {DIV} of child 1 {DIV} of body
+selection end:   position 2 of child 0 {#text} of child 0 {SPAN} of child 3 {DIV} of child 3 {DIV} of child 1 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/win/paint/selection/text-selection-inline-block-expected.png b/third_party/WebKit/LayoutTests/platform/win/paint/selection/text-selection-inline-block-expected.png
new file mode 100644
index 0000000..9b4955a7
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win/paint/selection/text-selection-inline-block-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/paint/selection/text-selection-inline-block-expected.txt b/third_party/WebKit/LayoutTests/platform/win/paint/selection/text-selection-inline-block-expected.txt
new file mode 100644
index 0000000..39be168
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win/paint/selection/text-selection-inline-block-expected.txt
@@ -0,0 +1,13 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x71
+  LayoutBlockFlow {HTML} at (0,0) size 800x71
+    LayoutBlockFlow {BODY} at (8,8) size 784x55
+      LayoutBlockFlow {DIV} at (0,0) size 24x55
+        LayoutText {#text} at (0,1) size 24x53
+          text run at (0,1) width 24: "x"
+      LayoutText {#text} at (24,1) size 24x53
+        text run at (24,1) width 24: "y"
+      LayoutText {#text} at (0,0) size 0x0
+selection start: position 0 of child 0 {#text} of child 0 {DIV} of body
+selection end:   position 1 of child 1 {#text} of body
diff --git a/third_party/WebKit/LayoutTests/platform/win/paint/selection/text-selection-inline-block-rtl-expected.png b/third_party/WebKit/LayoutTests/platform/win/paint/selection/text-selection-inline-block-rtl-expected.png
new file mode 100644
index 0000000..1d78b731
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win/paint/selection/text-selection-inline-block-rtl-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/paint/selection/text-selection-inline-block-rtl-expected.txt b/third_party/WebKit/LayoutTests/platform/win/paint/selection/text-selection-inline-block-rtl-expected.txt
new file mode 100644
index 0000000..51be2f7d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win/paint/selection/text-selection-inline-block-rtl-expected.txt
@@ -0,0 +1,13 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x71
+  LayoutBlockFlow {HTML} at (0,0) size 800x71
+    LayoutBlockFlow {BODY} at (8,8) size 784x55
+      LayoutBlockFlow {DIV} at (0,0) size 784x55
+        LayoutBlockFlow {DIV} at (760,0) size 24x55
+          LayoutText {#text} at (0,1) size 24x53
+            text run at (0,1) width 24 RTL override: "x"
+        LayoutText {#text} at (736,1) size 24x53
+          text run at (736,1) width 24 RTL override: "y"
+selection start: position 0 of child 0 {#text} of child 1 {DIV} of child 0 {DIV} of body
+selection end:   position 1 of child 2 {#text} of child 0 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/win7/fast/text/flexbox-selection-expected.png b/third_party/WebKit/LayoutTests/platform/win7/fast/text/flexbox-selection-expected.png
new file mode 100644
index 0000000..1bec1cf
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win7/fast/text/flexbox-selection-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win7/fast/text/flexbox-selection-nested-expected.png b/third_party/WebKit/LayoutTests/platform/win7/fast/text/flexbox-selection-nested-expected.png
new file mode 100644
index 0000000..d6796b5
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win7/fast/text/flexbox-selection-nested-expected.png
Binary files differ
diff --git a/third_party/WebKit/Source/BUILD.gn b/third_party/WebKit/Source/BUILD.gn
index db6cfdd..27315aa 100644
--- a/third_party/WebKit/Source/BUILD.gn
+++ b/third_party/WebKit/Source/BUILD.gn
@@ -77,6 +77,11 @@
 
 config("config") {
   include_dirs = [
+    # crbug.com/691465: Temporary solution to fix an issue related to MSVC-
+    # specific #include search order. This essentially lets
+    # #include "wtf/Foo.h" actually include "platform/wtf/Foo.h". This is okay
+    # because these files are equivalent if both exist.
+    "platform",
     ".",
     "..",
     "$root_gen_dir/blink",
diff --git a/third_party/WebKit/Source/bindings/core/v8/LocalWindowProxy.cpp b/third_party/WebKit/Source/bindings/core/v8/LocalWindowProxy.cpp
index 831e871..efad7d6 100644
--- a/third_party/WebKit/Source/bindings/core/v8/LocalWindowProxy.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/LocalWindowProxy.cpp
@@ -37,6 +37,7 @@
 #include "bindings/core/v8/V8Binding.h"
 #include "bindings/core/v8/V8DOMActivityLogger.h"
 #include "bindings/core/v8/V8DOMWrapper.h"
+#include "bindings/core/v8/V8GCForContextDispose.h"
 #include "bindings/core/v8/V8HTMLDocument.h"
 #include "bindings/core/v8/V8HiddenValue.h"
 #include "bindings/core/v8/V8Initializer.h"
@@ -77,7 +78,32 @@
                                                        m_world->worldId());
   MainThreadDebugger::instance()->contextWillBeDestroyed(m_scriptState.get());
 
-  WindowProxy::disposeContext(behavior);
+  if (behavior == DetachGlobal) {
+    v8::Local<v8::Context> context = m_scriptState->context();
+    // Clean up state on the global proxy, which will be reused.
+    if (!m_globalProxy.isEmpty()) {
+      // TODO(yukishiino): This DCHECK failed on Canary (M57) and Dev (M56).
+      // We need to figure out why m_globalProxy != context->Global().
+      DCHECK(m_globalProxy == context->Global());
+      DCHECK_EQ(toScriptWrappable(context->Global()),
+                toScriptWrappable(
+                    context->Global()->GetPrototype().As<v8::Object>()));
+      m_globalProxy.get().SetWrapperClassId(0);
+    }
+    V8DOMWrapper::clearNativeInfo(isolate(), context->Global());
+    m_scriptState->detachGlobalObject();
+  }
+
+  m_scriptState->disposePerContextData();
+
+  // It's likely that disposing the context has created a lot of
+  // garbage. Notify V8 about this so it'll have a chance of cleaning
+  // it up when idle.
+  V8GCForContextDispose::instance().notifyContextDisposed(
+      frame()->isMainFrame());
+
+  DCHECK(m_lifecycle == Lifecycle::ContextInitialized);
+  m_lifecycle = Lifecycle::ContextDetached;
 }
 
 void LocalWindowProxy::initialize() {
diff --git a/third_party/WebKit/Source/bindings/core/v8/RemoteWindowProxy.cpp b/third_party/WebKit/Source/bindings/core/v8/RemoteWindowProxy.cpp
index 78aef15..f394834 100644
--- a/third_party/WebKit/Source/bindings/core/v8/RemoteWindowProxy.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/RemoteWindowProxy.cpp
@@ -28,51 +28,22 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "bindings/core/v8/WindowProxy.h"
+#include "bindings/core/v8/RemoteWindowProxy.h"
 
 #include <algorithm>
 #include <utility>
 
-#include "bindings/core/v8/ConditionalFeatures.h"
 #include "bindings/core/v8/DOMWrapperWorld.h"
-#include "bindings/core/v8/ScriptController.h"
-#include "bindings/core/v8/ToV8.h"
-#include "bindings/core/v8/V8Binding.h"
-#include "bindings/core/v8/V8DOMActivityLogger.h"
 #include "bindings/core/v8/V8DOMWrapper.h"
-#include "bindings/core/v8/V8Document.h"
 #include "bindings/core/v8/V8GCForContextDispose.h"
-#include "bindings/core/v8/V8HTMLCollection.h"
-#include "bindings/core/v8/V8HTMLDocument.h"
-#include "bindings/core/v8/V8HiddenValue.h"
 #include "bindings/core/v8/V8Initializer.h"
-#include "bindings/core/v8/V8ObjectConstructor.h"
-#include "bindings/core/v8/V8PagePopupControllerBinding.h"
-#include "bindings/core/v8/V8PrivateProperty.h"
 #include "bindings/core/v8/V8Window.h"
-#include "core/frame/LocalFrame.h"
-#include "core/frame/LocalFrameClient.h"
-#include "core/frame/csp/ContentSecurityPolicy.h"
-#include "core/html/DocumentNameCollection.h"
-#include "core/html/HTMLCollection.h"
-#include "core/html/HTMLIFrameElement.h"
-#include "core/inspector/InspectorInstrumentation.h"
-#include "core/inspector/MainThreadDebugger.h"
-#include "core/loader/DocumentLoader.h"
-#include "core/loader/FrameLoader.h"
-#include "core/origin_trials/OriginTrialContext.h"
 #include "platform/Histogram.h"
-#include "platform/RuntimeEnabledFeatures.h"
 #include "platform/ScriptForbiddenScope.h"
 #include "platform/heap/Handle.h"
 #include "platform/instrumentation/tracing/TraceEvent.h"
-#include "platform/weborigin/SecurityOrigin.h"
-#include "public/platform/Platform.h"
-#include "v8/include/v8-debug.h"
 #include "v8/include/v8.h"
 #include "wtf/Assertions.h"
-#include "wtf/StringExtras.h"
-#include "wtf/text/CString.h"
 
 namespace blink {
 
@@ -85,7 +56,32 @@
   if (m_lifecycle != Lifecycle::ContextInitialized)
     return;
 
-  WindowProxy::disposeContext(behavior);
+  if (behavior == DetachGlobal) {
+    v8::Local<v8::Context> context = m_scriptState->context();
+    // Clean up state on the global proxy, which will be reused.
+    if (!m_globalProxy.isEmpty()) {
+      // TODO(yukishiino): This DCHECK failed on Canary (M57) and Dev (M56).
+      // We need to figure out why m_globalProxy != context->Global().
+      DCHECK(m_globalProxy == context->Global());
+      DCHECK_EQ(toScriptWrappable(context->Global()),
+                toScriptWrappable(
+                    context->Global()->GetPrototype().As<v8::Object>()));
+      m_globalProxy.get().SetWrapperClassId(0);
+    }
+    V8DOMWrapper::clearNativeInfo(isolate(), context->Global());
+    m_scriptState->detachGlobalObject();
+  }
+
+  m_scriptState->disposePerContextData();
+
+  // It's likely that disposing the context has created a lot of
+  // garbage. Notify V8 about this so it'll have a chance of cleaning
+  // it up when idle.
+  V8GCForContextDispose::instance().notifyContextDisposed(
+      frame()->isMainFrame());
+
+  DCHECK(m_lifecycle == Lifecycle::ContextInitialized);
+  m_lifecycle = Lifecycle::ContextDetached;
 }
 
 void RemoteWindowProxy::initialize() {
diff --git a/third_party/WebKit/Source/bindings/core/v8/RemoteWindowProxy.h b/third_party/WebKit/Source/bindings/core/v8/RemoteWindowProxy.h
index 4754024..b2acc97 100644
--- a/third_party/WebKit/Source/bindings/core/v8/RemoteWindowProxy.h
+++ b/third_party/WebKit/Source/bindings/core/v8/RemoteWindowProxy.h
@@ -32,6 +32,7 @@
 #define RemoteWindowProxy_h
 
 #include "bindings/core/v8/DOMWrapperWorld.h"
+#include "bindings/core/v8/WindowProxy.h"
 #include "core/frame/RemoteFrame.h"
 #include "v8/include/v8.h"
 
diff --git a/third_party/WebKit/Source/bindings/core/v8/V8DOMConfiguration.cpp b/third_party/WebKit/Source/bindings/core/v8/V8DOMConfiguration.cpp
index 127ce2d..51531b9d 100644
--- a/third_party/WebKit/Source/bindings/core/v8/V8DOMConfiguration.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/V8DOMConfiguration.cpp
@@ -400,6 +400,8 @@
         v8::FunctionTemplate::New(isolate, callback, v8::Local<v8::Value>(),
                                   signature, method.length);
     functionTemplate->RemovePrototype();
+    if (method.accessCheckConfiguration == V8DOMConfiguration::CheckAccess)
+      functionTemplate->SetAcceptAnyReceiver(false);
     v8::Local<v8::Function> function =
         functionTemplate->GetFunction(isolate->GetCurrentContext())
             .ToLocalChecked();
diff --git a/third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp b/third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp
index ef50df9..d582360 100644
--- a/third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp
@@ -61,37 +61,6 @@
       m_world(std::move(world)),
       m_lifecycle(Lifecycle::ContextUninitialized) {}
 
-void WindowProxy::disposeContext(GlobalDetachmentBehavior behavior) {
-  DCHECK(m_lifecycle == Lifecycle::ContextInitialized);
-
-  if (behavior == DetachGlobal) {
-    v8::Local<v8::Context> context = m_scriptState->context();
-    // Clean up state on the global proxy, which will be reused.
-    if (!m_globalProxy.isEmpty()) {
-      // TODO(yukishiino): This DCHECK failed on Canary (M57) and Dev (M56).
-      // We need to figure out why m_globalProxy != context->Global().
-      DCHECK(m_globalProxy == context->Global());
-      DCHECK_EQ(toScriptWrappable(context->Global()),
-                toScriptWrappable(
-                    context->Global()->GetPrototype().As<v8::Object>()));
-      m_globalProxy.get().SetWrapperClassId(0);
-    }
-    V8DOMWrapper::clearNativeInfo(m_isolate, context->Global());
-    m_scriptState->detachGlobalObject();
-  }
-
-  m_scriptState->disposePerContextData();
-
-  // It's likely that disposing the context has created a lot of
-  // garbage. Notify V8 about this so it'll have a chance of cleaning
-  // it up when idle.
-  V8GCForContextDispose::instance().notifyContextDisposed(
-      m_frame->isMainFrame());
-
-  DCHECK(m_lifecycle == Lifecycle::ContextInitialized);
-  m_lifecycle = Lifecycle::ContextDetached;
-}
-
 void WindowProxy::clearForClose() {
   disposeContext(DoNotDetachGlobal);
 }
diff --git a/third_party/WebKit/Source/bindings/core/v8/WindowProxy.h b/third_party/WebKit/Source/bindings/core/v8/WindowProxy.h
index 6276d71..393faea 100644
--- a/third_party/WebKit/Source/bindings/core/v8/WindowProxy.h
+++ b/third_party/WebKit/Source/bindings/core/v8/WindowProxy.h
@@ -162,7 +162,7 @@
   virtual void initialize() = 0;
 
   enum GlobalDetachmentBehavior { DoNotDetachGlobal, DetachGlobal };
-  virtual void disposeContext(GlobalDetachmentBehavior);
+  virtual void disposeContext(GlobalDetachmentBehavior) = 0;
 
   v8::Isolate* isolate() const { return m_isolate; }
   Frame* frame() const { return m_frame.get(); }
diff --git a/third_party/WebKit/Source/core/dom/DOMArrayBuffer.cpp b/third_party/WebKit/Source/core/dom/DOMArrayBuffer.cpp
index 67e9324c..9a5aabf 100644
--- a/third_party/WebKit/Source/core/dom/DOMArrayBuffer.cpp
+++ b/third_party/WebKit/Source/core/dom/DOMArrayBuffer.cpp
@@ -5,9 +5,20 @@
 #include "core/dom/DOMArrayBuffer.h"
 
 #include "bindings/core/v8/DOMDataStore.h"
+#include "wtf/RefPtr.h"
 
 namespace blink {
 
+DOMArrayBuffer* DOMArrayBuffer::createUninitializedOrNull(
+    unsigned numElements,
+    unsigned elementByteSize) {
+  RefPtr<ArrayBuffer> buffer =
+      WTF::ArrayBuffer::createUninitializedOrNull(numElements, elementByteSize);
+  if (!buffer)
+    return nullptr;
+  return create(std::move(buffer));
+}
+
 v8::Local<v8::Object> DOMArrayBuffer::wrap(
     v8::Isolate* isolate,
     v8::Local<v8::Object> creationContext) {
diff --git a/third_party/WebKit/Source/core/dom/DOMArrayBuffer.h b/third_party/WebKit/Source/core/dom/DOMArrayBuffer.h
index 6bfee91..5ce8c46 100644
--- a/third_party/WebKit/Source/core/dom/DOMArrayBuffer.h
+++ b/third_party/WebKit/Source/core/dom/DOMArrayBuffer.h
@@ -31,11 +31,8 @@
 
   // Only for use by XMLHttpRequest::responseArrayBuffer and
   // Internals::serializeObject.
-  static DOMArrayBuffer* createUninitialized(unsigned numElements,
-                                             unsigned elementByteSize) {
-    return create(
-        WTF::ArrayBuffer::createUninitialized(numElements, elementByteSize));
-  }
+  static DOMArrayBuffer* createUninitializedOrNull(unsigned numElements,
+                                                   unsigned elementByteSize);
 
   DOMArrayBuffer* slice(int begin, int end) const {
     return create(buffer()->slice(begin, end));
diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index 44f1382..fc9c4b2 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -372,7 +372,7 @@
   LayoutObject* layoutObject = focusedElement.layoutObject();
   if (!layoutObject || !layoutObject->isLayoutPart())
     return 0;
-  return toLayoutPart(layoutObject)->widget();
+  return toLayoutPart(layoutObject)->frameViewBase();
 }
 
 static bool acceptsEditingFocus(const Element& element) {
diff --git a/third_party/WebKit/Source/core/editing/Editor.cpp b/third_party/WebKit/Source/core/editing/Editor.cpp
index ce1da9e..e4e310ba 100644
--- a/third_party/WebKit/Source/core/editing/Editor.cpp
+++ b/third_party/WebKit/Source/core/editing/Editor.cpp
@@ -283,12 +283,20 @@
 // copy/paste (like divs, or a document body).
 
 bool Editor::canDHTMLCut() {
-  return !frame().selection().isInPasswordField() &&
+  // TODO(editing-dev): The use of updateStyleAndLayoutIgnorePendingStylesheets
+  // needs to be audited.  See http://crbug.com/590369 for more details.
+  frame().document()->updateStyleAndLayoutIgnorePendingStylesheets();
+  return !isInPasswordField(
+             frame().selection().computeVisibleSelectionInDOMTree().start()) &&
          !dispatchCPPEvent(EventTypeNames::beforecut, DataTransferNumb);
 }
 
 bool Editor::canDHTMLCopy() {
-  return !frame().selection().isInPasswordField() &&
+  // TODO(editing-dev): The use of updateStyleAndLayoutIgnorePendingStylesheets
+  // needs to be audited.  See http://crbug.com/590369 for more details.
+  frame().document()->updateStyleAndLayoutIgnorePendingStylesheets();
+  return !isInPasswordField(
+             frame().selection().computeVisibleSelectionInDOMTree().start()) &&
          !dispatchCPPEvent(EventTypeNames::beforecopy, DataTransferNumb);
 }
 
@@ -317,7 +325,8 @@
     return true;
   FrameSelection& selection = frame().selection();
   return selection.computeVisibleSelectionInDOMTreeDeprecated().isRange() &&
-         !selection.isInPasswordField();
+         !isInPasswordField(
+             frame().selection().computeVisibleSelectionInDOMTree().start());
 }
 
 bool Editor::canPaste() const {
@@ -442,14 +451,22 @@
 }
 
 bool Editor::tryDHTMLCopy() {
-  if (frame().selection().isInPasswordField())
+  // TODO(editing-dev): The use of updateStyleAndLayoutIgnorePendingStylesheets
+  // needs to be audited.  See http://crbug.com/590369 for more details.
+  frame().document()->updateStyleAndLayoutIgnorePendingStylesheets();
+  if (isInPasswordField(
+          frame().selection().computeVisibleSelectionInDOMTree().start()))
     return false;
 
   return !dispatchCPPEvent(EventTypeNames::copy, DataTransferWritable);
 }
 
 bool Editor::tryDHTMLCut() {
-  if (frame().selection().isInPasswordField())
+  // TODO(editing-dev): The use of updateStyleAndLayoutIgnorePendingStylesheets
+  // needs to be audited.  See http://crbug.com/590369 for more details.
+  frame().document()->updateStyleAndLayoutIgnorePendingStylesheets();
+  if (isInPasswordField(
+          frame().selection().computeVisibleSelectionInDOMTree().start()))
     return false;
 
   return !dispatchCPPEvent(EventTypeNames::cut, DataTransferWritable);
diff --git a/third_party/WebKit/Source/core/editing/FrameSelection.cpp b/third_party/WebKit/Source/core/editing/FrameSelection.cpp
index 8f14f4f..03148bbd 100644
--- a/third_party/WebKit/Source/core/editing/FrameSelection.cpp
+++ b/third_party/WebKit/Source/core/editing/FrameSelection.cpp
@@ -670,13 +670,6 @@
   return m_selectionEditor->firstRange();
 }
 
-bool FrameSelection::isInPasswordField() const {
-  // TODO(editing-dev): The use of updateStyleAndLayoutIgnorePendingStylesheets
-  // needs to be audited.  See http://crbug.com/590369 for more details.
-  document().updateStyleAndLayoutIgnorePendingStylesheets();
-  return blink::isInPasswordField(computeVisibleSelectionInDOMTree().start());
-}
-
 void FrameSelection::notifyAccessibilityForSelectionChange() {
   if (selectionInDOMTree().isNone())
     return;
@@ -805,7 +798,7 @@
   LayoutObject* layoutObject = n->layoutObject();
   if (!layoutObject || !layoutObject->isLayoutPart())
     return false;
-  FrameViewBase* frameViewBase = toLayoutPart(layoutObject)->widget();
+  FrameViewBase* frameViewBase = toLayoutPart(layoutObject)->frameViewBase();
   return frameViewBase && frameViewBase->isFrameView();
 }
 
diff --git a/third_party/WebKit/Source/core/editing/FrameSelection.h b/third_party/WebKit/Source/core/editing/FrameSelection.h
index da7db323..9a7c7711 100644
--- a/third_party/WebKit/Source/core/editing/FrameSelection.h
+++ b/third_party/WebKit/Source/core/editing/FrameSelection.h
@@ -178,7 +178,6 @@
   void didChangeFocus();
 
   const SelectionInDOMTree& selectionInDOMTree() const;
-  bool isInPasswordField() const;
   bool isDirectional() const { return selectionInDOMTree().isDirectional(); }
 
   // If this FrameSelection has a logical range which is still valid, this
diff --git a/third_party/WebKit/Source/core/frame/FrameView.cpp b/third_party/WebKit/Source/core/frame/FrameView.cpp
index 9ac33a51..5101980 100644
--- a/third_party/WebKit/Source/core/frame/FrameView.cpp
+++ b/third_party/WebKit/Source/core/frame/FrameView.cpp
@@ -490,7 +490,7 @@
   bool usesWindowInactiveSelector =
       m_frame->document()->styleEngine().usesWindowInactiveSelector();
 
-  const ChildrenWidgetSet* viewChildren = children();
+  const ChildrenSet* viewChildren = children();
   for (const Member<FrameViewBase>& child : *viewChildren) {
     FrameViewBase* frameViewBase = child.get();
     if (frameViewBase->isFrameView()) {
@@ -1476,7 +1476,7 @@
     if (layoutViewItem().isNull())
       break;
 
-    if (FrameViewBase* frameViewBase = part->widget()) {
+    if (FrameViewBase* frameViewBase = part->frameViewBase()) {
       if (frameViewBase->isFrameView()) {
         FrameView* frameView = toFrameView(frameViewBase);
         bool didNeedLayout = frameView->needsLayout();
@@ -3310,7 +3310,7 @@
   // TODO(leviw): This currently runs the entire lifecycle on plugin WebViews.
   // We should have a way to only run these other Documents to the same
   // lifecycle stage as this frame.
-  const ChildrenWidgetSet* viewChildren = children();
+  const ChildrenSet* viewChildren = children();
   for (const Member<FrameViewBase>& child : *viewChildren) {
     if ((*child).isPluginContainer())
       toPluginView(child.get())->updateAllLifecyclePhases();
diff --git a/third_party/WebKit/Source/core/frame/FrameView.h b/third_party/WebKit/Source/core/frame/FrameView.h
index 8972b3d5..43e3643 100644
--- a/third_party/WebKit/Source/core/frame/FrameView.h
+++ b/third_party/WebKit/Source/core/frame/FrameView.h
@@ -458,13 +458,13 @@
   // and repaints to the host window in the window's coordinate space.
   HostWindow* getHostWindow() const;
 
-  typedef HeapHashSet<Member<FrameViewBase>> ChildrenWidgetSet;
+  typedef HeapHashSet<Member<FrameViewBase>> ChildrenSet;
 
   // Functions for child manipulation and inspection.
   void setParent(FrameViewBase*) override;
   void removeChild(FrameViewBase*);
   void addChild(FrameViewBase*);
-  const ChildrenWidgetSet* children() const { return &m_children; }
+  const ChildrenSet* children() const { return &m_children; }
 
   // If the scroll view does not use a native widget, then it will have
   // cross-platform Scrollbars. These functions can be used to obtain those
@@ -1130,7 +1130,7 @@
   bool m_horizontalScrollbarLock;
   bool m_verticalScrollbarLock;
 
-  ChildrenWidgetSet m_children;
+  ChildrenSet m_children;
 
   ScrollOffset m_pendingScrollDelta;
   ScrollOffset m_scrollOffset;
diff --git a/third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp b/third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp
index bfbb296012..139cff4 100644
--- a/third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp
@@ -159,7 +159,7 @@
 void HTMLPlugInElement::removeAllEventListeners() {
   HTMLFrameOwnerElement::removeAllEventListeners();
   if (LayoutPart* layoutObject = existingLayoutPart()) {
-    if (FrameViewBase* frameViewBase = layoutObject->widget())
+    if (FrameViewBase* frameViewBase = layoutObject->frameViewBase())
       frameViewBase->eventListenersRemoved();
   }
 }
@@ -341,7 +341,7 @@
 
 FrameViewBase* HTMLPlugInElement::pluginWidget() const {
   if (LayoutPart* layoutPart = layoutPartForJSBindings())
-    return layoutPart->widget();
+    return layoutPart->frameViewBase();
   return nullptr;
 }
 
@@ -394,7 +394,7 @@
             .showsUnavailablePluginIndicator())
       return;
   }
-  FrameViewBase* frameViewBase = toLayoutPart(r)->widget();
+  FrameViewBase* frameViewBase = toLayoutPart(r)->frameViewBase();
   if (!frameViewBase)
     return;
   frameViewBase->handleEvent(event);
diff --git a/third_party/WebKit/Source/core/html/PluginDocument.cpp b/third_party/WebKit/Source/core/html/PluginDocument.cpp
index 3e4ee1e..f928cbe 100644
--- a/third_party/WebKit/Source/core/html/PluginDocument.cpp
+++ b/third_party/WebKit/Source/core/html/PluginDocument.cpp
@@ -183,7 +183,7 @@
   if (m_pluginNode && m_pluginNode->layoutObject()) {
     CHECK(m_pluginNode->layoutObject()->isEmbeddedObject());
     FrameViewBase* frameViewBase =
-        toLayoutEmbeddedObject(m_pluginNode->layoutObject())->widget();
+        toLayoutEmbeddedObject(m_pluginNode->layoutObject())->frameViewBase();
     if (!frameViewBase || !frameViewBase->isPluginContainer())
       return nullptr;
     return frameViewBase;
diff --git a/third_party/WebKit/Source/core/input/EventHandler.cpp b/third_party/WebKit/Source/core/input/EventHandler.cpp
index 082ed28a..87a3a8de 100644
--- a/third_party/WebKit/Source/core/input/EventHandler.cpp
+++ b/third_party/WebKit/Source/core/input/EventHandler.cpp
@@ -319,7 +319,7 @@
   if (!layoutObject || !layoutObject->isLayoutPart())
     return nullptr;
 
-  FrameViewBase* frameViewBase = toLayoutPart(layoutObject)->widget();
+  FrameViewBase* frameViewBase = toLayoutPart(layoutObject)->frameViewBase();
   if (!frameViewBase || !frameViewBase->isFrameView())
     return nullptr;
 
diff --git a/third_party/WebKit/Source/core/input/MouseEventManager.cpp b/third_party/WebKit/Source/core/input/MouseEventManager.cpp
index d33f5a8..3672b0f 100644
--- a/third_party/WebKit/Source/core/input/MouseEventManager.cpp
+++ b/third_party/WebKit/Source/core/input/MouseEventManager.cpp
@@ -9,6 +9,7 @@
 #include "core/dom/Element.h"
 #include "core/dom/ElementTraversal.h"
 #include "core/dom/TaskRunnerHelper.h"
+#include "core/editing/EditingUtilities.h"
 #include "core/editing/FrameSelection.h"
 #include "core/editing/SelectionController.h"
 #include "core/events/DragEvent.h"
@@ -847,10 +848,17 @@
   // reset. Hence, need to check if this particular drag operation can
   // continue even if dispatchEvent() indicates no (direct) cancellation.
   // Do that by checking if m_dragSrc is still set.
-  m_mouseDownMayStartDrag =
-      dispatchDragSrcEvent(EventTypeNames::dragstart, m_mouseDown) ==
+  m_mouseDownMayStartDrag = false;
+  if (dispatchDragSrcEvent(EventTypeNames::dragstart, m_mouseDown) ==
           WebInputEventResult::NotHandled &&
-      !m_frame->selection().isInPasswordField() && dragState().m_dragSrc;
+      dragState().m_dragSrc) {
+    // TODO(editing-dev): The use of
+    // updateStyleAndLayoutIgnorePendingStylesheets needs to be audited.  See
+    // http://crbug.com/590369 for more details.
+    m_frame->document()->updateStyleAndLayoutIgnorePendingStylesheets();
+    m_mouseDownMayStartDrag = !isInPasswordField(
+        m_frame->selection().computeVisibleSelectionInDOMTree().start());
+  }
 
   // Invalidate clipboard here against anymore pasteboard writing for security.
   // The drag image can still be changed as we drag, but not the pasteboard
diff --git a/third_party/WebKit/Source/core/input/ScrollManager.cpp b/third_party/WebKit/Source/core/input/ScrollManager.cpp
index 5ddbc2d..3e6d463 100644
--- a/third_party/WebKit/Source/core/input/ScrollManager.cpp
+++ b/third_party/WebKit/Source/core/input/ScrollManager.cpp
@@ -361,7 +361,7 @@
       !layoutObject->isLayoutPart())
     return WebInputEventResult::NotHandled;
 
-  FrameViewBase* frameViewBase = toLayoutPart(layoutObject)->widget();
+  FrameViewBase* frameViewBase = toLayoutPart(layoutObject)->frameViewBase();
 
   if (!frameViewBase || !frameViewBase->isFrameView())
     return WebInputEventResult::NotHandled;
diff --git a/third_party/WebKit/Source/core/inspector/InspectorLayerTreeAgent.cpp b/third_party/WebKit/Source/core/inspector/InspectorLayerTreeAgent.cpp
index 075d570..1f0b3e9 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorLayerTreeAgent.cpp
+++ b/third_party/WebKit/Source/core/inspector/InspectorLayerTreeAgent.cpp
@@ -261,7 +261,7 @@
   if (!root->layoutObject().isLayoutIFrame())
     return;
   FrameView* childFrameView =
-      toFrameView(toLayoutPart(root->layoutObject()).widget());
+      toFrameView(toLayoutPart(root->layoutObject()).frameViewBase());
   LayoutViewItem childLayoutViewItem = childFrameView->layoutViewItem();
   if (!childLayoutViewItem.isNull()) {
     if (PaintLayerCompositor* childCompositor =
diff --git a/third_party/WebKit/Source/core/layout/LayoutEmbeddedObject.cpp b/third_party/WebKit/Source/core/layout/LayoutEmbeddedObject.cpp
index 4fca252..c5b3b315 100644
--- a/third_party/WebKit/Source/core/layout/LayoutEmbeddedObject.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutEmbeddedObject.cpp
@@ -135,7 +135,7 @@
 
   updateLayerTransformAfterLayout();
 
-  FrameViewBase* frameViewBase = this->widget();
+  FrameViewBase* frameViewBase = this->frameViewBase();
   if (!frameViewBase && frameView())
     frameView()->addPartToUpdate(*this);
 
@@ -154,9 +154,9 @@
 }
 
 LayoutReplaced* LayoutEmbeddedObject::embeddedReplacedContent() const {
-  if (!node() || !widget() || !widget()->isFrameView())
+  if (!node() || !frameViewBase() || !frameViewBase()->isFrameView())
     return nullptr;
-  return toFrameView(widget())->embeddedReplacedContent();
+  return toFrameView(frameViewBase())->embeddedReplacedContent();
 }
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/core/layout/LayoutInline.cpp b/third_party/WebKit/Source/core/layout/LayoutInline.cpp
index 0ca9f0c..6992af87 100644
--- a/third_party/WebKit/Source/core/layout/LayoutInline.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutInline.cpp
@@ -1140,11 +1140,17 @@
   for (LayoutBlock* currBlock = containingBlock();
        currBlock && currBlock->isAnonymousBlock();
        currBlock = toLayoutBlock(currBlock->nextSibling())) {
+    bool walkChildrenOnly = !currBlock->childrenInline();
     for (LayoutObject* curr = currBlock->firstChild(); curr;
          curr = curr->nextSibling()) {
       LayoutRect rect(curr->localVisualRect());
       context(FloatRect(rect));
-      if (curr == endContinuation) {
+      if (walkChildrenOnly)
+        continue;
+      for (LayoutObject* walker = curr; walker;
+           walker = walker->nextInPreOrder(curr)) {
+        if (walker != endContinuation)
+          continue;
         LayoutRect rect(enclosingIntRect(floatResult));
         mapToVisualRectInAncestorSpace(view(), rect);
         return rect;
diff --git a/third_party/WebKit/Source/core/layout/LayoutPart.cpp b/third_party/WebKit/Source/core/layout/LayoutPart.cpp
index 374855c..4fb8052 100644
--- a/third_party/WebKit/Source/core/layout/LayoutPart.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutPart.cpp
@@ -88,7 +88,7 @@
   ASSERT(m_refCount <= 0);
 }
 
-FrameViewBase* LayoutPart::widget() const {
+FrameViewBase* LayoutPart::frameViewBase() const {
   // Plugin FrameViewBases are stored in their DOM node.
   Element* element = toElement(node());
 
@@ -110,8 +110,8 @@
   // a plugin LayoutObject and the plugin has a layer, then we need a layer.
   // Second, if this is a LayoutObject with a contentDocument and that document
   // needs a layer, then we need a layer.
-  if (widget() && widget()->isPluginView() &&
-      toPluginView(widget())->platformLayer())
+  if (frameViewBase() && frameViewBase()->isPluginView() &&
+      toPluginView(frameViewBase())->platformLayer())
     return true;
 
   if (!node() || !node()->isFrameOwnerElement())
@@ -157,21 +157,21 @@
                              const HitTestLocation& locationInContainer,
                              const LayoutPoint& accumulatedOffset,
                              HitTestAction action) {
-  if (!widget() || !widget()->isFrameView() ||
+  if (!frameViewBase() || !frameViewBase()->isFrameView() ||
       !result.hitTestRequest().allowsChildFrameContent())
     return nodeAtPointOverWidget(result, locationInContainer, accumulatedOffset,
                                  action);
 
   // A hit test can never hit an off-screen element; only off-screen iframes are
   // throttled; therefore, hit tests can skip descending into throttled iframes.
-  if (toFrameView(widget())->shouldThrottleRendering())
+  if (toFrameView(frameViewBase())->shouldThrottleRendering())
     return nodeAtPointOverWidget(result, locationInContainer, accumulatedOffset,
                                  action);
 
   ASSERT(document().lifecycle().state() >= DocumentLifecycle::CompositingClean);
 
   if (action == HitTestForeground) {
-    FrameView* childFrameView = toFrameView(widget());
+    FrameView* childFrameView = toFrameView(frameViewBase());
     LayoutViewItem childRootItem = childFrameView->layoutViewItem();
 
     if (visibleToHitTestRequest(result.hitTestRequest()) &&
@@ -234,7 +234,7 @@
 void LayoutPart::styleDidChange(StyleDifference diff,
                                 const ComputedStyle* oldStyle) {
   LayoutReplaced::styleDidChange(diff, oldStyle);
-  FrameViewBase* frameViewBase = this->widget();
+  FrameViewBase* frameViewBase = this->frameViewBase();
 
   if (!frameViewBase)
     return;
@@ -268,7 +268,7 @@
 
 CursorDirective LayoutPart::getCursor(const LayoutPoint& point,
                                       Cursor& cursor) const {
-  if (widget() && widget()->isPluginView()) {
+  if (frameViewBase() && frameViewBase()->isPluginView()) {
     // A plugin is responsible for setting the cursor when the pointer is over
     // it.
     return DoNotSetCursor;
@@ -287,7 +287,7 @@
 }
 
 void LayoutPart::updateOnWidgetChange() {
-  FrameViewBase* frameViewBase = this->widget();
+  FrameViewBase* frameViewBase = this->frameViewBase();
   if (!frameViewBase)
     return;
 
@@ -308,7 +308,7 @@
 }
 
 void LayoutPart::updateGeometry() {
-  FrameViewBase* frameViewBase = this->widget();
+  FrameViewBase* frameViewBase = this->frameViewBase();
   if (!frameViewBase ||
       !node())  // Check the node in case destroy() has been called.
     return;
@@ -341,7 +341,7 @@
 }
 
 void LayoutPart::updateGeometryInternal() {
-  FrameViewBase* frameViewBase = this->widget();
+  FrameViewBase* frameViewBase = this->frameViewBase();
   DCHECK(frameViewBase);
 
   // Ignore transform here, as we only care about the sub-pixel accumulation.
@@ -373,8 +373,9 @@
 
 void LayoutPart::invalidatePaintOfSubtreesIfNeeded(
     const PaintInvalidationState& paintInvalidationState) {
-  if (widget() && widget()->isFrameView() && !isThrottledFrameView()) {
-    FrameView* childFrameView = toFrameView(widget());
+  if (frameViewBase() && frameViewBase()->isFrameView() &&
+      !isThrottledFrameView()) {
+    FrameView* childFrameView = toFrameView(frameViewBase());
     // |childFrameView| is in another document, which could be
     // missing its LayoutView. TODO(jchaffraix): Ideally we should
     // not need this code.
@@ -391,9 +392,9 @@
 }
 
 bool LayoutPart::isThrottledFrameView() const {
-  if (!widget() || !widget()->isFrameView())
+  if (!frameViewBase() || !frameViewBase()->isFrameView())
     return false;
-  const FrameView* frameView = toFrameView(widget());
+  const FrameView* frameView = toFrameView(frameViewBase());
   return frameView->shouldThrottleRendering();
 }
 
diff --git a/third_party/WebKit/Source/core/layout/LayoutPart.h b/third_party/WebKit/Source/core/layout/LayoutPart.h
index 42ae6cf..83b49cb 100644
--- a/third_party/WebKit/Source/core/layout/LayoutPart.h
+++ b/third_party/WebKit/Source/core/layout/LayoutPart.h
@@ -48,7 +48,7 @@
   void ref() { ++m_refCount; }
   void deref();
 
-  FrameViewBase* widget() const;
+  FrameViewBase* frameViewBase() const;
 
   LayoutRect replacedContentRect() const final;
 
diff --git a/third_party/WebKit/Source/core/layout/LayoutTreeAsText.cpp b/third_party/WebKit/Source/core/layout/LayoutTreeAsText.cpp
index 0ccaf12..1b08be02 100644
--- a/third_party/WebKit/Source/core/layout/LayoutTreeAsText.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutTreeAsText.cpp
@@ -526,7 +526,7 @@
   }
 
   if (o.isLayoutPart()) {
-    FrameViewBase* frameViewBase = toLayoutPart(o).widget();
+    FrameViewBase* frameViewBase = toLayoutPart(o).frameViewBase();
     if (frameViewBase && frameViewBase->isFrameView()) {
       FrameView* view = toFrameView(frameViewBase);
       LayoutViewItem rootItem = view->layoutViewItem();
diff --git a/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp b/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp
index 2b11d48..3e727a9f 100644
--- a/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp
+++ b/third_party/WebKit/Source/core/layout/compositing/CompositedLayerMapping.cpp
@@ -151,7 +151,8 @@
 static WebLayer* platformLayerForPlugin(LayoutObject& layoutObject) {
   if (!layoutObject.isEmbeddedObject())
     return nullptr;
-  FrameViewBase* frameViewBase = toLayoutEmbeddedObject(layoutObject).widget();
+  FrameViewBase* frameViewBase =
+      toLayoutEmbeddedObject(layoutObject).frameViewBase();
   if (!frameViewBase || !frameViewBase->isPluginView())
     return nullptr;
   return toPluginView(frameViewBase)->platformLayer();
diff --git a/third_party/WebKit/Source/core/layout/line/InlineTextBox.cpp b/third_party/WebKit/Source/core/layout/line/InlineTextBox.cpp
index ebd781d4..425b875f 100644
--- a/third_party/WebKit/Source/core/layout/line/InlineTextBox.cpp
+++ b/third_party/WebKit/Source/core/layout/line/InlineTextBox.cpp
@@ -188,16 +188,39 @@
 
 bool InlineTextBox::hasWrappedSelectionNewline() const {
   DCHECK(!getLineLayoutItem().needsLayout());
+
   SelectionState state = getSelectionState();
-  return (state == SelectionStart || state == SelectionInside)
-         // Checking last leaf child can be slow, so we make sure to do this
-         // only after the other simple conditionals.
-         && (root().lastLeafChild() == this)
-         // It's possible to have mixed LTR/RTL on a single line, and we only
-         // want to paint a newline when we're the last leaf child and we make
-         // sure there isn't a differently-directioned box following us.
-         && ((!isLeftToRightDirection() && root().firstSelectedBox() == this) ||
-             (isLeftToRightDirection() && root().lastSelectedBox() == this));
+  if (state != SelectionStart && state != SelectionInside)
+    return false;
+
+  // Checking last leaf child can be slow, so we make sure to do this
+  // only after checking selection state.
+  if (root().lastLeafChild() != this)
+    return false;
+
+  // It's possible to have mixed LTR/RTL on a single line, and we only
+  // want to paint a newline when we're the last leaf child and we make
+  // sure there isn't a differently-directioned box following us.
+  bool isLTR = isLeftToRightDirection();
+  if ((!isLTR && root().firstSelectedBox() != this) ||
+      (isLTR && root().lastSelectedBox() != this))
+    return false;
+
+  // If we're the last inline text box in containing block, our containing block
+  // is inline, and the selection continues into that block, then rely on the
+  // next inline text box (if any) to paint a wrapped new line as needed.
+  if (nextTextBox())
+    return true;
+  auto rootBlock = root().block();
+  if (rootBlock.isInline() && rootBlock.getSelectionState() != SelectionEnd &&
+      rootBlock.getSelectionState() != SelectionBoth &&
+      rootBlock.inlineBoxWrapper() &&
+      ((isLTR && rootBlock.inlineBoxWrapper()->nextOnLine()) ||
+       (!isLTR && rootBlock.inlineBoxWrapper()->prevOnLine()))) {
+    return false;
+  }
+
+  return true;
 }
 
 float InlineTextBox::newlineSpaceWidth() const {
diff --git a/third_party/WebKit/Source/core/layout/ng/ng_inline_node_test.cc b/third_party/WebKit/Source/core/layout/ng/ng_inline_node_test.cc
index 7976c0b..4a11633 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_inline_node_test.cc
+++ b/third_party/WebKit/Source/core/layout/ng/ng_inline_node_test.cc
@@ -30,11 +30,11 @@
   String& Text() { return text_content_; }
   Vector<NGLayoutInlineItem>& Items() { return items_; }
 
-  void Append(const String& text, const ComputedStyle* style = nullptr) {
+  void Append(const String& text,
+              const ComputedStyle* style = nullptr,
+              LayoutObject* layout_object = nullptr) {
     unsigned start = text_content_.length();
     text_content_.append(text);
-    // Pass non-null LayoutObject to indicate this is a text from LayoutText.
-    LayoutObject* layout_object = reinterpret_cast<LayoutObject*>(1);
     items_.push_back(
         NGLayoutInlineItem(start, start + text.length(), style, layout_object));
   }
@@ -67,13 +67,14 @@
     style_->font().update(nullptr);
   }
 
-  void setAhemToStyle() {
+  void UseLayoutObjectAndAhem() {
     // Get Ahem from document. Loading "Ahem.woff" using |createTestFont| fails
     // on linux_chromium_asan_rel_ng.
     loadAhem();
     setBodyInnerHTML("<div id=t style='font:10px Ahem'></div>");
-    LayoutObject* layout_object = getLayoutObjectByElementId("t");
-    style_->setFont(layout_object->style()->font());
+    layout_object_ = getLayoutObjectByElementId("t");
+    DCHECK(layout_object_);
+    style_ = layout_object_->style();
   }
 
   void CreateLine(NGInlineNode* node,
@@ -96,7 +97,8 @@
     }
   }
 
-  RefPtr<ComputedStyle> style_;
+  RefPtr<const ComputedStyle> style_;
+  LayoutObject* layout_object_ = nullptr;
 };
 
 #define TEST_ITEM_OFFSET_DIR(item, start, end, direction) \
@@ -163,23 +165,25 @@
   TEST_ITEM_OFFSET_DIR(items[3], 10u, 11u, TextDirection::kLtr);
 }
 
-static NGInlineNodeForTest* CreateBidiIsolateNode(const ComputedStyle* style) {
+static NGInlineNodeForTest* CreateBidiIsolateNode(const ComputedStyle* style,
+                                                  LayoutObject* layout_object) {
   NGInlineNodeForTest* node = new NGInlineNodeForTest(style);
-  node->Append("Hello ", style);
+  node->Append("Hello ", style, layout_object);
   node->Append(rightToLeftIsolateCharacter);
-  node->Append(u"\u05E2\u05D1\u05E8\u05D9\u05EA ", style);
+  node->Append(u"\u05E2\u05D1\u05E8\u05D9\u05EA ", style, layout_object);
   node->Append(leftToRightIsolateCharacter);
-  node->Append("A", style);
+  node->Append("A", style, layout_object);
   node->Append(popDirectionalIsolateCharacter);
-  node->Append(u"\u05E2\u05D1\u05E8\u05D9\u05EA", style);
+  node->Append(u"\u05E2\u05D1\u05E8\u05D9\u05EA", style, layout_object);
   node->Append(popDirectionalIsolateCharacter);
-  node->Append(" World", style);
+  node->Append(" World", style, layout_object);
   node->SegmentText();
   return node;
 }
 
 TEST_F(NGInlineNodeTest, SegmentBidiIsolate) {
-  NGInlineNodeForTest* node = CreateBidiIsolateNode(style_.get());
+  NGInlineNodeForTest* node =
+      CreateBidiIsolateNode(style_.get(), layout_object_);
   Vector<NGLayoutInlineItem>& items = node->Items();
   ASSERT_EQ(9u, items.size());
   TEST_ITEM_OFFSET_DIR(items[0], 0u, 6u, TextDirection::kLtr);
@@ -202,10 +206,12 @@
   EXPECT_EQ(dir, node->Items()[fragment->ItemIndex()].Direction())
 
 TEST_F(NGInlineNodeTest, CreateLineBidiIsolate) {
+  UseLayoutObjectAndAhem();
   RefPtr<ComputedStyle> style = ComputedStyle::create();
   style->setLineHeight(Length(1, Fixed));
   style->font().update(nullptr);
-  NGInlineNodeForTest* node = CreateBidiIsolateNode(style.get());
+  NGInlineNodeForTest* node =
+      CreateBidiIsolateNode(style.get(), layout_object_);
   Vector<RefPtr<const NGPhysicalTextFragment>> fragments;
   CreateLine(node, &fragments);
   ASSERT_EQ(5u, fragments.size());
@@ -217,9 +223,9 @@
 }
 
 TEST_F(NGInlineNodeTest, MinMaxContentSize) {
-  setAhemToStyle();
+  UseLayoutObjectAndAhem();
   NGInlineNodeForTest* node = new NGInlineNodeForTest(style_.get());
-  node->Append("AB CDE", style_.get());
+  node->Append("AB CDE", style_.get(), layout_object_);
   node->ShapeText();
   MinMaxContentSize sizes = node->ComputeMinMaxContentSize();
   // TODO(kojii): min_content should be 20, but is 30 until NGLineBuilder
@@ -229,10 +235,10 @@
 }
 
 TEST_F(NGInlineNodeTest, MinMaxContentSizeElementBoundary) {
-  setAhemToStyle();
+  UseLayoutObjectAndAhem();
   NGInlineNodeForTest* node = new NGInlineNodeForTest(style_.get());
-  node->Append("A B", style_.get());
-  node->Append("C D", style_.get());
+  node->Append("A B", style_.get(), layout_object_);
+  node->Append("C D", style_.get(), layout_object_);
   node->ShapeText();
   MinMaxContentSize sizes = node->ComputeMinMaxContentSize();
   // |min_content| should be the width of "BC" because there is an element
diff --git a/third_party/WebKit/Source/core/layout/ng/ng_layout_opportunity_iterator.cc b/third_party/WebKit/Source/core/layout/ng/ng_layout_opportunity_iterator.cc
index ac293061..f95d51d 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_layout_opportunity_iterator.cc
+++ b/third_party/WebKit/Source/core/layout/ng/ng_layout_opportunity_iterator.cc
@@ -7,10 +7,41 @@
 #include "core/layout/ng/ng_constraint_space.h"
 #include "core/layout/ng/ng_exclusion.h"
 #include "wtf/NonCopyingSort.h"
+#include "wtf/text/StringBuilder.h"
 
 namespace blink {
 namespace {
 
+void AppendNodeToString(const NGLayoutOpportunityTreeNode* node,
+                        StringBuilder* string_builder,
+                        unsigned indent = 0) {
+  DCHECK(string_builder);
+  if (!node) {
+    string_builder->append("'null'\n");
+    return;
+  }
+
+  string_builder->append(node->ToString());
+  string_builder->append("\n");
+
+  StringBuilder indent_builder;
+  for (unsigned i = 0; i < indent; i++)
+    indent_builder.append("\t");
+
+  if (!node->exclusion)
+    return;
+
+  string_builder->append(indent_builder.toString());
+  string_builder->append("Left:\t");
+  AppendNodeToString(node->left, string_builder, indent + 2);
+  string_builder->append(indent_builder.toString());
+  string_builder->append("Right:\t");
+  AppendNodeToString(node->right, string_builder, indent + 2);
+  string_builder->append(indent_builder.toString());
+  string_builder->append("Bottom:\t");
+  AppendNodeToString(node->bottom, string_builder, indent + 2);
+}
+
 // Collects all opportunities from leaves of Layout Opportunity spatial tree.
 void CollectAllOpportunities(const NGLayoutOpportunityTreeNode* node,
                              NGLayoutOpportunities& opportunities) {
@@ -276,4 +307,13 @@
   return NGLayoutOpportunity(*opportunity);
 }
 
+#ifndef NDEBUG
+void NGLayoutOpportunityIterator::ShowLayoutOpportunityTree() const {
+  StringBuilder string_builder;
+  string_builder.append("\n.:: LayoutOpportunity Tree ::.\n\nRoot Node: ");
+  AppendNodeToString(opportunity_tree_root_.get(), &string_builder);
+  fprintf(stderr, "%s\n", string_builder.toString().utf8().data());
+}
+#endif
+
 }  // namespace blink
diff --git a/third_party/WebKit/Source/core/layout/ng/ng_layout_opportunity_iterator.h b/third_party/WebKit/Source/core/layout/ng/ng_layout_opportunity_iterator.h
index 0e7c0046..9ecf8bd4 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_layout_opportunity_iterator.h
+++ b/third_party/WebKit/Source/core/layout/ng/ng_layout_opportunity_iterator.h
@@ -38,6 +38,11 @@
   // TODO(chrome-layout-team): Refactor with using C++ <iterator> library.
   const NGLayoutOpportunity Next();
 
+#ifndef NDEBUG
+  // Prints Layout Opportunity tree for debug purposes.
+  void ShowLayoutOpportunityTree() const;
+#endif
+
  private:
   // Mutable Getters.
   NGLayoutOpportunityTreeNode* MutableOpportunityTreeRoot() {
diff --git a/third_party/WebKit/Source/core/layout/ng/ng_layout_opportunity_tree_node.cc b/third_party/WebKit/Source/core/layout/ng/ng_layout_opportunity_tree_node.cc
index aa211bf..49b04cd 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_layout_opportunity_tree_node.cc
+++ b/third_party/WebKit/Source/core/layout/ng/ng_layout_opportunity_tree_node.cc
@@ -20,6 +20,13 @@
       exclusion_edge(exclusion_edge),
       exclusion(nullptr) {}
 
+String NGLayoutOpportunityTreeNode::ToString() const {
+  return String::format(
+      "Opportunity: '%s' Exclusion: '%s'",
+      opportunity.ToString().ascii().data(),
+      exclusion ? exclusion->ToString().ascii().data() : "null");
+}
+
 DEFINE_TRACE(NGLayoutOpportunityTreeNode) {
   visitor->trace(left);
   visitor->trace(bottom);
diff --git a/third_party/WebKit/Source/core/layout/ng/ng_layout_opportunity_tree_node.h b/third_party/WebKit/Source/core/layout/ng/ng_layout_opportunity_tree_node.h
index 6e2c913..ea12337 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_layout_opportunity_tree_node.h
+++ b/third_party/WebKit/Source/core/layout/ng/ng_layout_opportunity_tree_node.h
@@ -48,8 +48,20 @@
   // The node is a leaf if it doesn't have an exclusion that splits it apart.
   bool IsLeafNode() const { return !exclusion; }
 
+  String ToString() const;
+
   DECLARE_TRACE();
 };
 
+inline std::ostream& operator<<(std::ostream& stream,
+                                const NGLayoutOpportunityTreeNode& value) {
+  return stream << value.ToString();
+}
+
+inline std::ostream& operator<<(std::ostream& out,
+                                const NGLayoutOpportunityTreeNode* value) {
+  return out << (value ? value->ToString() : "(null)");
+}
+
 }  // namespace blink
 #endif  // NGLayoutOpportunityTreeNode_h
diff --git a/third_party/WebKit/Source/core/mojo/MojoHandle.cpp b/third_party/WebKit/Source/core/mojo/MojoHandle.cpp
index d244105..b48b61f 100644
--- a/third_party/WebKit/Source/core/mojo/MojoHandle.cpp
+++ b/third_party/WebKit/Source/core/mojo/MojoHandle.cpp
@@ -79,7 +79,9 @@
     return;
   }
 
-  DOMArrayBuffer* buffer = DOMArrayBuffer::createUninitialized(numBytes, 1);
+  DOMArrayBuffer* buffer =
+      DOMArrayBuffer::createUninitializedOrNull(numBytes, 1);
+  CHECK(buffer);
   Vector<::MojoHandle, kHandleVectorInlineCapacity> rawHandles(numHandles);
   result = MojoReadMessage(m_handle->value(), buffer->data(), &numBytes,
                            rawHandles.data(), &numHandles, flags);
diff --git a/third_party/WebKit/Source/core/page/scrolling/ScrollingCoordinator.cpp b/third_party/WebKit/Source/core/page/scrolling/ScrollingCoordinator.cpp
index 55967dce..3bdffba 100644
--- a/third_party/WebKit/Source/core/page/scrolling/ScrollingCoordinator.cpp
+++ b/third_party/WebKit/Source/core/page/scrolling/ScrollingCoordinator.cpp
@@ -1005,7 +1005,7 @@
     }
   }
 
-  if (const FrameView::ChildrenWidgetSet* children = frameView->children()) {
+  if (const FrameView::ChildrenSet* children = frameView->children()) {
     for (const Member<FrameViewBase>& child : *children) {
       if (!(*child).isPluginView())
         continue;
diff --git a/third_party/WebKit/Source/core/paint/EmbeddedObjectPaintInvalidator.cpp b/third_party/WebKit/Source/core/paint/EmbeddedObjectPaintInvalidator.cpp
index fadf49ee..4aa26d62 100644
--- a/third_party/WebKit/Source/core/paint/EmbeddedObjectPaintInvalidator.cpp
+++ b/third_party/WebKit/Source/core/paint/EmbeddedObjectPaintInvalidator.cpp
@@ -16,7 +16,7 @@
       BoxPaintInvalidator(m_embeddedObject, m_context)
           .invalidatePaintIfNeeded();
 
-  FrameViewBase* frameViewBase = m_embeddedObject.widget();
+  FrameViewBase* frameViewBase = m_embeddedObject.frameViewBase();
   if (frameViewBase && frameViewBase->isPluginView())
     toPluginView(frameViewBase)->invalidatePaintIfNeeded();
 
diff --git a/third_party/WebKit/Source/core/paint/PaintPropertyTreePrinter.cpp b/third_party/WebKit/Source/core/paint/PaintPropertyTreePrinter.cpp
index 1bf97ca1..ce04a74 100644
--- a/third_party/WebKit/Source/core/paint/PaintPropertyTreePrinter.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintPropertyTreePrinter.cpp
@@ -493,10 +493,9 @@
     for (const LayoutObject* child = object.slowFirstChild(); child;
          child = child->nextSibling())
       writeLayoutObjectNode(*child);
-    if (object.isLayoutPart() && toLayoutPart(object).widget() &&
-        toLayoutPart(object).widget()->isFrameView()) {
-      FrameView* frameView =
-          static_cast<FrameView*>(toLayoutPart(object).widget());
+    if (object.isLayoutPart() && toLayoutPart(object).frameViewBase() &&
+        toLayoutPart(object).frameViewBase()->isFrameView()) {
+      FrameView* frameView = toFrameView(toLayoutPart(object).frameViewBase());
       writeFrameViewNode(*frameView, &object);
     }
   }
diff --git a/third_party/WebKit/Source/core/paint/PartPainter.cpp b/third_party/WebKit/Source/core/paint/PartPainter.cpp
index 9f31767..15736e97 100644
--- a/third_party/WebKit/Source/core/paint/PartPainter.cpp
+++ b/third_party/WebKit/Source/core/paint/PartPainter.cpp
@@ -69,10 +69,10 @@
   if (paintInfo.phase != PaintPhaseForeground)
     return;
 
-  if (m_layoutPart.widget()) {
+  if (m_layoutPart.frameViewBase()) {
     // TODO(schenney) crbug.com/93805 Speculative release assert to verify that
-    // the crashes we see in widget painting are due to a destroyed LayoutPart
-    // object.
+    // the crashes we see in FrameViewBase painting are due to a destroyed
+    // LayoutPart object.
     CHECK(m_layoutPart.node());
     Optional<RoundedInnerRectClipper> clipper;
     if (m_layoutPart.style()->hasBorderRadius()) {
@@ -95,7 +95,7 @@
     m_layoutPart.paintContents(paintInfo, paintOffset);
   }
 
-  // Paint a partially transparent wash over selected widgets.
+  // Paint a partially transparent wash over selected FrameViewBases.
   if (isSelected() && !paintInfo.isPrinting() &&
       !LayoutObjectDrawingRecorder::useCachedDrawingIfPossible(
           paintInfo.context, m_layoutPart, paintInfo.phase)) {
@@ -118,23 +118,23 @@
                                 const LayoutPoint& paintOffset) {
   LayoutPoint adjustedPaintOffset = paintOffset + m_layoutPart.location();
 
-  FrameViewBase* frameViewBase = m_layoutPart.widget();
+  FrameViewBase* frameViewBase = m_layoutPart.frameViewBase();
   CHECK(frameViewBase);
 
   IntPoint paintLocation(roundedIntPoint(
       adjustedPaintOffset + m_layoutPart.replacedContentRect().location()));
 
   // FrameViewBases don't support painting with a paint offset, but instead
-  // offset themselves using the frame rect location. To paint widgets at our
-  // desired location, we need to apply paint offset as a transform, with the
-  // frame rect neutralized.
-  IntSize widgetPaintOffset =
+  // offset themselves using the frame rect location. To paint FrameViewBases at
+  // our desired location, we need to apply paint offset as a transform, with
+  // the frame rect neutralized.
+  IntSize frameViewBasePaintOffset =
       paintLocation - frameViewBase->frameRect().location();
   TransformRecorder transform(
       paintInfo.context, m_layoutPart,
-      AffineTransform::translation(widgetPaintOffset.width(),
-                                   widgetPaintOffset.height()));
-  CullRect adjustedCullRect(paintInfo.cullRect(), -widgetPaintOffset);
+      AffineTransform::translation(frameViewBasePaintOffset.width(),
+                                   frameViewBasePaintOffset.height()));
+  CullRect adjustedCullRect(paintInfo.cullRect(), -frameViewBasePaintOffset);
   frameViewBase->paint(paintInfo.context, adjustedCullRect);
 }
 
diff --git a/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp b/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp
index 2cbbf447..de39a5d4 100644
--- a/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp
+++ b/third_party/WebKit/Source/core/paint/PrePaintTreeWalk.cpp
@@ -264,7 +264,7 @@
 
   if (object.isLayoutPart()) {
     const LayoutPart& layoutPart = toLayoutPart(object);
-    FrameViewBase* frameViewBase = layoutPart.widget();
+    FrameViewBase* frameViewBase = layoutPart.frameViewBase();
     if (frameViewBase && frameViewBase->isFrameView()) {
       context.treeBuilderContext.current.paintOffset +=
           layoutPart.replacedContentRect().location() -
diff --git a/third_party/WebKit/Source/core/testing/Internals.cpp b/third_party/WebKit/Source/core/testing/Internals.cpp
index b4e4df40..5b4494a 100644
--- a/third_party/WebKit/Source/core/testing/Internals.cpp
+++ b/third_party/WebKit/Source/core/testing/Internals.cpp
@@ -2644,10 +2644,12 @@
 DOMArrayBuffer* Internals::serializeObject(
     PassRefPtr<SerializedScriptValue> value) const {
   String stringValue = value->toWireString();
-  DOMArrayBuffer* buffer =
-      DOMArrayBuffer::createUninitialized(stringValue.length(), sizeof(UChar));
-  stringValue.copyTo(static_cast<UChar*>(buffer->data()), 0,
-                     stringValue.length());
+  DOMArrayBuffer* buffer = DOMArrayBuffer::createUninitializedOrNull(
+      stringValue.length(), sizeof(UChar));
+  if (buffer) {
+    stringValue.copyTo(static_cast<UChar*>(buffer->data()), 0,
+                       stringValue.length());
+  }
   return buffer;
 }
 
diff --git a/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp b/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp
index c74d9e94..e0b0b64b 100644
--- a/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp
+++ b/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp
@@ -251,7 +251,8 @@
       m_sameOriginRequest(true),
       m_downloadingToFile(false),
       m_responseTextOverflow(false),
-      m_sendFlag(false) {}
+      m_sendFlag(false),
+      m_responseArrayBufferFailure(false) {}
 
 XMLHttpRequest::~XMLHttpRequest() {}
 
@@ -386,14 +387,23 @@
   if (m_error || m_state != kDone)
     return nullptr;
 
-  if (!m_responseArrayBuffer) {
+  if (!m_responseArrayBuffer && !m_responseArrayBufferFailure) {
     if (m_binaryResponseBuilder && m_binaryResponseBuilder->size()) {
-      DOMArrayBuffer* buffer = DOMArrayBuffer::createUninitialized(
+      DOMArrayBuffer* buffer = DOMArrayBuffer::createUninitializedOrNull(
           m_binaryResponseBuilder->size(), 1);
-      m_binaryResponseBuilder->getAsBytes(
-          buffer->data(), static_cast<size_t>(buffer->byteLength()));
-      m_responseArrayBuffer = buffer;
+      if (buffer) {
+        m_binaryResponseBuilder->getAsBytes(
+            buffer->data(), static_cast<size_t>(buffer->byteLength()));
+        m_responseArrayBuffer = buffer;
+      }
+      // https://xhr.spec.whatwg.org/#arraybuffer-response allows clearing
+      // of the 'received bytes' payload when the response buffer allocation
+      // fails.
       m_binaryResponseBuilder.clear();
+      // Mark allocation as failed; subsequent calls to the accessor must
+      // continue to report |null|.
+      //
+      m_responseArrayBufferFailure = !buffer;
     } else {
       m_responseArrayBuffer = DOMArrayBuffer::create(nullptr, 0);
     }
@@ -1194,6 +1204,7 @@
   // this only when we clear the response holder variables above.
   m_binaryResponseBuilder.clear();
   m_responseArrayBuffer.clear();
+  m_responseArrayBufferFailure = false;
 }
 
 void XMLHttpRequest::clearRequest() {
diff --git a/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.h b/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.h
index 95bcb2f..41ea869f 100644
--- a/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.h
+++ b/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.h
@@ -355,6 +355,7 @@
   bool m_downloadingToFile;
   bool m_responseTextOverflow;
   bool m_sendFlag;
+  bool m_responseArrayBufferFailure;
 };
 
 std::ostream& operator<<(std::ostream&, const XMLHttpRequest*);
diff --git a/third_party/WebKit/Source/modules/bluetooth/BluetoothError.cpp b/third_party/WebKit/Source/modules/bluetooth/BluetoothError.cpp
index bae9bb8c..1b15a0118 100644
--- a/third_party/WebKit/Source/modules/bluetooth/BluetoothError.cpp
+++ b/third_party/WebKit/Source/modules/bluetooth/BluetoothError.cpp
@@ -9,6 +9,32 @@
 
 namespace blink {
 
+namespace {
+
+const char kGATTServerNotConnectedBase[] =
+    "GATT Server is disconnected. "
+    "Cannot %s. (Re)connect first with `device.gatt.connect`.";
+
+}  // namespace
+
+// static
+DOMException* BluetoothError::createNotConnectedException(
+    BluetoothOperation operation) {
+  const char* operationString = nullptr;
+  switch (operation) {
+    case BluetoothOperation::ServicesRetrieval:
+      operationString = "retrieve services";
+      break;
+    case BluetoothOperation::CharacteristicsRetrieval:
+      operationString = "retrieve characteristics";
+      break;
+  }
+
+  return DOMException::create(
+      NetworkError,
+      String::format(kGATTServerNotConnectedBase, operationString));
+}
+
 // static
 DOMException* BluetoothError::createDOMException(
     BluetoothErrorCode error,
@@ -98,13 +124,6 @@
                 "GATT Server is disconnected. Cannot perform GATT operations.");
       MAP_ERROR(GATT_SERVER_DISCONNECTED, NetworkError,
                 "GATT Server disconnected while performing a GATT operation.");
-      MAP_ERROR(GATT_SERVER_DISCONNECTED_WHILE_RETRIEVING_CHARACTERISTICS,
-                NetworkError,
-                "GATT Server disconnected while retrieving characteristics.");
-      MAP_ERROR(
-          GATT_SERVER_NOT_CONNECTED_CANNOT_RETRIEVE_CHARACTERISTICS,
-          NetworkError,
-          "GATT Server is disconnected. Cannot retrieve characteristics.");
 
       // NotFoundErrors:
       MAP_ERROR(WEB_BLUETOOTH_NOT_SUPPORTED, NotFoundError,
diff --git a/third_party/WebKit/Source/modules/bluetooth/BluetoothError.h b/third_party/WebKit/Source/modules/bluetooth/BluetoothError.h
index 8e98950..9ebdd142 100644
--- a/third_party/WebKit/Source/modules/bluetooth/BluetoothError.h
+++ b/third_party/WebKit/Source/modules/bluetooth/BluetoothError.h
@@ -11,6 +11,13 @@
 
 namespace blink {
 
+// Used when generating DOMExceptions specific to each operation.
+// TODO(crbug.com/684445): Add DescriptorsRetrieval and GATTOperation.
+enum class BluetoothOperation {
+  ServicesRetrieval,
+  CharacteristicsRetrieval,
+};
+
 // These error codes requires detailed error messages.
 enum class BluetoothErrorCode {
   InvalidService,
@@ -29,6 +36,7 @@
   STATIC_ONLY(BluetoothError);
 
  public:
+  static DOMException* createNotConnectedException(BluetoothOperation);
   static DOMException* createDOMException(BluetoothErrorCode,
                                           const String& detailedMessage);
 
diff --git a/third_party/WebKit/Source/modules/bluetooth/BluetoothRemoteGATTServer.cpp b/third_party/WebKit/Source/modules/bluetooth/BluetoothRemoteGATTServer.cpp
index aae000e..b2f37308 100644
--- a/third_party/WebKit/Source/modules/bluetooth/BluetoothRemoteGATTServer.cpp
+++ b/third_party/WebKit/Source/modules/bluetooth/BluetoothRemoteGATTServer.cpp
@@ -19,14 +19,6 @@
 
 namespace blink {
 
-namespace {
-
-const char kGATTServerNotConnected[] =
-    "GATT Server is disconnected. Cannot retrieve services. (Re)connect first "
-    "with `device.gatt.connect`.";
-
-}  // namespace
-
 BluetoothRemoteGATTServer::BluetoothRemoteGATTServer(BluetoothDevice* device)
     : m_device(device), m_connected(false) {}
 
@@ -107,8 +99,8 @@
 
   // If the device is disconnected, reject.
   if (!RemoveFromActiveAlgorithms(resolver)) {
-    resolver->reject(
-        DOMException::create(NetworkError, kGATTServerNotConnected));
+    resolver->reject(BluetoothError::createNotConnectedException(
+        BluetoothOperation::ServicesRetrieval));
     return;
   }
 
@@ -182,8 +174,8 @@
     String servicesUUID) {
   if (!m_connected) {
     return ScriptPromise::rejectWithDOMException(
-        scriptState,
-        DOMException::create(NetworkError, kGATTServerNotConnected));
+        scriptState, BluetoothError::createNotConnectedException(
+                         BluetoothOperation::ServicesRetrieval));
   }
 
   ScriptPromiseResolver* resolver = ScriptPromiseResolver::create(scriptState);
diff --git a/third_party/WebKit/Source/modules/bluetooth/BluetoothRemoteGATTService.cpp b/third_party/WebKit/Source/modules/bluetooth/BluetoothRemoteGATTService.cpp
index 26228951..31837a08 100644
--- a/third_party/WebKit/Source/modules/bluetooth/BluetoothRemoteGATTService.cpp
+++ b/third_party/WebKit/Source/modules/bluetooth/BluetoothRemoteGATTService.cpp
@@ -48,9 +48,8 @@
 
   // If the device is disconnected, reject.
   if (!m_device->gatt()->RemoveFromActiveAlgorithms(resolver)) {
-    resolver->reject(BluetoothError::createDOMException(
-        mojom::blink::WebBluetoothResult::
-            GATT_SERVER_DISCONNECTED_WHILE_RETRIEVING_CHARACTERISTICS));
+    resolver->reject(BluetoothError::createNotConnectedException(
+        BluetoothOperation::CharacteristicsRetrieval));
     return;
   }
 
@@ -127,10 +126,8 @@
     const String& characteristicsUUID) {
   if (!m_device->gatt()->connected()) {
     return ScriptPromise::rejectWithDOMException(
-        scriptState,
-        BluetoothError::createDOMException(
-            mojom::blink::WebBluetoothResult::
-                GATT_SERVER_NOT_CONNECTED_CANNOT_RETRIEVE_CHARACTERISTICS));
+        scriptState, BluetoothError::createNotConnectedException(
+                         BluetoothOperation::CharacteristicsRetrieval));
   }
 
   if (!m_device->isValidService(m_service->instance_id)) {
diff --git a/third_party/WebKit/Source/modules/plugins/PluginOcclusionSupport.cpp b/third_party/WebKit/Source/modules/plugins/PluginOcclusionSupport.cpp
index d5724ec..52499c50 100644
--- a/third_party/WebKit/Source/modules/plugins/PluginOcclusionSupport.cpp
+++ b/third_party/WebKit/Source/modules/plugins/PluginOcclusionSupport.cpp
@@ -153,7 +153,7 @@
 // page. In a nutshell, iframe elements should occlude plugins when
 // they occur higher in the stacking order.
 void getPluginOcclusions(Element* element,
-                         FrameViewBase* parentFrameViewBase,
+                         FrameViewBase* parent,
                          const IntRect& frameRect,
                          Vector<IntRect>& occlusions) {
   LayoutObject* pluginNode = element->layoutObject();
@@ -164,14 +164,14 @@
   Vector<const LayoutObject*> iframeZstack;
   getObjectStack(pluginNode, &pluginZstack);
 
-  if (!parentFrameViewBase->isFrameView())
+  if (!parent->isFrameView())
     return;
 
-  FrameView* parentFrameView = toFrameView(parentFrameViewBase);
+  FrameView* parentFrameView = toFrameView(parent);
 
   // Occlusions by iframes.
-  const FrameView::ChildrenWidgetSet* children = parentFrameView->children();
-  for (FrameView::ChildrenWidgetSet::const_iterator it = children->begin();
+  const FrameView::ChildrenSet* children = parentFrameView->children();
+  for (FrameView::ChildrenSet::const_iterator it = children->begin();
        it != children->end(); ++it) {
     // We only care about FrameView's because iframes show up as FrameViews.
     if (!(*it)->isFrameView())
diff --git a/third_party/WebKit/Source/modules/plugins/PluginOcclusionSupport.h b/third_party/WebKit/Source/modules/plugins/PluginOcclusionSupport.h
index f94fe8d..e026995b 100644
--- a/third_party/WebKit/Source/modules/plugins/PluginOcclusionSupport.h
+++ b/third_party/WebKit/Source/modules/plugins/PluginOcclusionSupport.h
@@ -29,7 +29,7 @@
 class IntRect;
 
 MODULES_EXPORT void getPluginOcclusions(Element*,
-                                        FrameViewBase* parentWidget,
+                                        FrameViewBase* parent,
                                         const IntRect& frameRect,
                                         Vector<IntRect>& occlusions);
 
diff --git a/third_party/WebKit/Source/platform/wtf/BUILD.gn b/third_party/WebKit/Source/platform/wtf/BUILD.gn
new file mode 100644
index 0000000..6873bdb
--- /dev/null
+++ b/third_party/WebKit/Source/platform/wtf/BUILD.gn
@@ -0,0 +1,126 @@
+# Copyright 2017 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# The below is a temporary setup during the WTF migration project:
+# https://groups.google.com/a/chromium.org/d/msg/blink-dev/tLdAZCTlcAA/bYXVT8gYCAAJ
+#
+# We are moving wtf/ files to platform/wtf/ incrementally, thus, conceptually,
+# the "wtf" target in wtf/BUILD.gn is being split into two, in a way that
+# only wtf/ can refer the contents in platform/wtf/.
+#
+# To achieve this, we introduce a new target "platform_wtf" here, and configure
+# it so the source files are compiled in the same way as the original "wtf"
+# target. This gn file should only be used from wtf/BUILD.gn, and this
+# restriction is enforced by the visibility rule below (but it's okay to
+# #include a header in this directory from core/ or modules/).
+#
+# The following configurations are mostly copied from wtf/BUILD.gn, so we
+# can build the source files in the same way.
+#
+# When we finish moving all the files, "platform_wtf" target will take over
+# the role of "wtf".
+#
+# TODO(yutak): Set up platform_wtf_unittests in the similar manner.
+
+assert(!is_ios)
+
+import("//third_party/WebKit/Source/config.gni")
+
+visibility = [ "//third_party/WebKit/Source/wtf/*" ]
+
+config("wtf_config") {
+  if (is_win) {
+    defines = [
+      "__STD_C",
+      "_CRT_SECURE_NO_DEPRECATE",
+      "_SCL_SECURE_NO_DEPRECATE",
+    ]
+    include_dirs = [ "os-win32" ]
+
+    cflags = [
+      # Don't complain about calling specific versions of templatized
+      # functions (e.g. in RefPtrHashMap.h).
+      "/wd4344",
+
+      # dtoa, icu, etc. like doing assignment within conditional.
+      "/wd4706",
+    ]
+
+    if (is_component_build) {
+      # Chromium windows multi-dll build enables C++ exceptions and this causes
+      # wtf to generate 4291 warning due to operator new/delete
+      # implementations. Disable the warning for chromium windows multi-dll
+      # build.
+      cflags += [ "/wd4291" ]
+    }
+  }
+}
+
+component("platform_wtf") {
+  sources = [
+    "CryptographicallyRandomNumber.cpp",
+    "CryptographicallyRandomNumber.h",
+    "WTFExport.h",
+  ]
+
+  configs += [
+    "//third_party/WebKit/Source:config",
+    "//third_party/WebKit/Source:non_test_config",
+    "//third_party/WebKit/Source:blink_pch",
+  ]
+
+  defines = [ "WTF_IMPLEMENTATION=1" ]
+
+  public_configs = [
+    ":wtf_config",
+
+    # TODO(jschuh): crbug.com/167187 fix size_t to int truncations.
+    "//build/config/compiler:no_size_t_to_int_warning",
+    "//third_party/WebKit/Source:features",
+  ]
+
+  public_deps = [
+    "//base",
+    "//third_party/icu",
+  ]
+
+  # Rules changing the |sources| list are temporarily commented out, until
+  # those files are actually moved to here.
+
+  if (is_win) {
+    # sources -= [ "ThreadingPthreads.cpp" ]
+
+    cflags = [ "/wd4068" ]  # Unknown pragma.
+  } else {
+    # Non-Windows.
+    # sources -= [
+    #   "ThreadSpecificWin.cpp",
+    #   "ThreadingWin.cpp",
+    # ]
+  }
+
+  if (is_android) {
+    libs = [ "log" ]
+  }
+  if (is_linux) {
+    libs = [ "dl" ]
+  }
+
+  if (is_mac) {
+    libs = [
+      "CoreFoundation.framework",
+      "Foundation.framework",
+    ]
+  } else {
+    # sources -= [
+    #   "text/AtomicStringCF.cpp",
+    #   "text/StringImplCF.cpp",
+    # ]
+  }
+
+  if (remove_webcore_debug_symbols) {
+    configs -= [ "//build/config/compiler:default_symbols" ]
+    configs += [ "//build/config/compiler:no_symbols" ]
+  }
+}
diff --git a/third_party/WebKit/Source/wtf/CryptographicallyRandomNumber.cpp b/third_party/WebKit/Source/platform/wtf/CryptographicallyRandomNumber.cpp
similarity index 100%
rename from third_party/WebKit/Source/wtf/CryptographicallyRandomNumber.cpp
rename to third_party/WebKit/Source/platform/wtf/CryptographicallyRandomNumber.cpp
diff --git a/third_party/WebKit/Source/platform/wtf/CryptographicallyRandomNumber.h b/third_party/WebKit/Source/platform/wtf/CryptographicallyRandomNumber.h
new file mode 100644
index 0000000..51fbf47
--- /dev/null
+++ b/third_party/WebKit/Source/platform/wtf/CryptographicallyRandomNumber.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2008 Torch Mobile Inc. All rights reserved.
+ * (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WTF_CryptographicallyRandomNumber_h
+#define WTF_CryptographicallyRandomNumber_h
+
+#include "wtf/WTFExport.h"
+#include <cstddef>
+#include <stdint.h>
+
+namespace WTF {
+
+WTF_EXPORT void setAlwaysZeroRandomSourceForTesting();
+
+// These functions are threadsafe.
+WTF_EXPORT uint32_t cryptographicallyRandomNumber();
+WTF_EXPORT void cryptographicallyRandomValues(void* buffer, size_t length);
+}
+
+using WTF::cryptographicallyRandomNumber;
+using WTF::cryptographicallyRandomValues;
+
+#endif
diff --git a/third_party/WebKit/Source/platform/wtf/WTFExport.h b/third_party/WebKit/Source/platform/wtf/WTFExport.h
new file mode 100644
index 0000000..ba1005f
--- /dev/null
+++ b/third_party/WebKit/Source/platform/wtf/WTFExport.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2013 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WTFExport_h
+#define WTFExport_h
+
+#if !defined(WTF_IMPLEMENTATION)
+#define WTF_IMPLEMENTATION 0
+#endif
+
+#if defined(COMPONENT_BUILD)
+#if defined(WIN32)
+#if WTF_IMPLEMENTATION
+#define WTF_EXPORT __declspec(dllexport)
+#else
+#define WTF_EXPORT __declspec(dllimport)
+#endif
+#else  // defined(WIN32)
+#define WTF_EXPORT __attribute__((visibility("default")))
+#endif
+#else  // defined(COMPONENT_BUILD)
+#define WTF_EXPORT
+#endif
+
+#endif  // WTFExport_h
diff --git a/third_party/WebKit/Source/web/ChromeClientImpl.cpp b/third_party/WebKit/Source/web/ChromeClientImpl.cpp
index a5721cf..bd57f5d 100644
--- a/third_party/WebKit/Source/web/ChromeClientImpl.cpp
+++ b/third_party/WebKit/Source/web/ChromeClientImpl.cpp
@@ -640,7 +640,7 @@
                 isHTMLEmbedElement(*result.innerNode()))) {
       LayoutObject* object = result.innerNode()->layoutObject();
       if (object && object->isLayoutPart()) {
-        FrameViewBase* frameViewBase = toLayoutPart(object)->widget();
+        FrameViewBase* frameViewBase = toLayoutPart(object)->frameViewBase();
         if (frameViewBase && frameViewBase->isPluginContainer()) {
           WebPluginContainerImpl* plugin =
               toWebPluginContainerImpl(frameViewBase);
diff --git a/third_party/WebKit/Source/web/ContextMenuClientImpl.cpp b/third_party/WebKit/Source/web/ContextMenuClientImpl.cpp
index 81c14acd..1cf04868 100644
--- a/third_party/WebKit/Source/web/ContextMenuClientImpl.cpp
+++ b/third_party/WebKit/Source/web/ContextMenuClientImpl.cpp
@@ -250,7 +250,7 @@
              isHTMLEmbedElement(*r.innerNode())) {
     LayoutObject* object = r.innerNode()->layoutObject();
     if (object && object->isLayoutPart()) {
-      FrameViewBase* frameViewBase = toLayoutPart(object)->widget();
+      FrameViewBase* frameViewBase = toLayoutPart(object)->frameViewBase();
       if (frameViewBase && frameViewBase->isPluginContainer()) {
         data.mediaType = WebContextMenuData::MediaTypePlugin;
         WebPluginContainerImpl* plugin =
diff --git a/third_party/WebKit/Source/web/WebNode.cpp b/third_party/WebKit/Source/web/WebNode.cpp
index c866548..c9f1b44 100644
--- a/third_party/WebKit/Source/web/WebNode.cpp
+++ b/third_party/WebKit/Source/web/WebNode.cpp
@@ -186,7 +186,7 @@
 
   LayoutObject* object = node->layoutObject();
   if (object && object->isLayoutPart()) {
-    FrameViewBase* frameViewBase = toLayoutPart(object)->widget();
+    FrameViewBase* frameViewBase = toLayoutPart(object)->frameViewBase();
     if (frameViewBase && frameViewBase->isPluginContainer())
       return toWebPluginContainerImpl(frameViewBase);
   }
diff --git a/third_party/WebKit/Source/web/WebViewImpl.cpp b/third_party/WebKit/Source/web/WebViewImpl.cpp
index 38a07e4..f934dd0b 100644
--- a/third_party/WebKit/Source/web/WebViewImpl.cpp
+++ b/third_party/WebKit/Source/web/WebViewImpl.cpp
@@ -1158,7 +1158,7 @@
           // If the plugin supports keyboard focus then we should not send a tab
           // keypress event.
           FrameViewBase* frameViewBase =
-              toLayoutPart(element->layoutObject())->widget();
+              toLayoutPart(element->layoutObject())->frameViewBase();
           if (frameViewBase && frameViewBase->isPluginContainer()) {
             WebPluginContainerImpl* plugin =
                 toWebPluginContainerImpl(frameViewBase);
@@ -3346,7 +3346,7 @@
 
   LayoutObject* object = node->layoutObject();
   if (object && object->isLayoutPart()) {
-    FrameViewBase* frameViewWidget = toLayoutPart(object)->widget();
+    FrameViewBase* frameViewWidget = toLayoutPart(object)->frameViewBase();
     if (frameViewWidget && frameViewWidget->isPluginContainer()) {
       WebPluginContainerImpl* plugin =
           toWebPluginContainerImpl(frameViewWidget);
diff --git a/third_party/WebKit/Source/web/tests/ScrollingCoordinatorTest.cpp b/third_party/WebKit/Source/web/tests/ScrollingCoordinatorTest.cpp
index 32cae1d..253107f 100644
--- a/third_party/WebKit/Source/web/tests/ScrollingCoordinatorTest.cpp
+++ b/third_party/WebKit/Source/web/tests/ScrollingCoordinatorTest.cpp
@@ -665,10 +665,10 @@
 
   LayoutPart* layoutPart = toLayoutPart(layoutObject);
   ASSERT_TRUE(layoutPart);
-  ASSERT_TRUE(layoutPart->widget());
-  ASSERT_TRUE(layoutPart->widget()->isFrameView());
+  ASSERT_TRUE(layoutPart->frameViewBase());
+  ASSERT_TRUE(layoutPart->frameViewBase()->isFrameView());
 
-  FrameView* innerFrameView = toFrameView(layoutPart->widget());
+  FrameView* innerFrameView = toFrameView(layoutPart->frameViewBase());
   LayoutViewItem innerLayoutViewItem = innerFrameView->layoutViewItem();
   ASSERT_FALSE(innerLayoutViewItem.isNull());
 
@@ -716,10 +716,10 @@
 
   LayoutPart* layoutPart = toLayoutPart(layoutObject);
   ASSERT_TRUE(layoutPart);
-  ASSERT_TRUE(layoutPart->widget());
-  ASSERT_TRUE(layoutPart->widget()->isFrameView());
+  ASSERT_TRUE(layoutPart->frameViewBase());
+  ASSERT_TRUE(layoutPart->frameViewBase()->isFrameView());
 
-  FrameView* innerFrameView = toFrameView(layoutPart->widget());
+  FrameView* innerFrameView = toFrameView(layoutPart->frameViewBase());
   LayoutViewItem innerLayoutViewItem = innerFrameView->layoutViewItem();
   ASSERT_FALSE(innerLayoutViewItem.isNull());
 
@@ -893,10 +893,10 @@
 
   LayoutPart* layoutPart = toLayoutPart(layoutObject);
   ASSERT_TRUE(layoutPart);
-  ASSERT_TRUE(layoutPart->widget());
-  ASSERT_TRUE(layoutPart->widget()->isFrameView());
+  ASSERT_TRUE(layoutPart->frameViewBase());
+  ASSERT_TRUE(layoutPart->frameViewBase()->isFrameView());
 
-  FrameView* innerFrameView = toFrameView(layoutPart->widget());
+  FrameView* innerFrameView = toFrameView(layoutPart->frameViewBase());
   LayoutViewItem innerLayoutViewItem = innerFrameView->layoutViewItem();
   ASSERT_FALSE(innerLayoutViewItem.isNull());
 
diff --git a/third_party/WebKit/Source/wtf/BUILD.gn b/third_party/WebKit/Source/wtf/BUILD.gn
index eed1c31..44973f2 100644
--- a/third_party/WebKit/Source/wtf/BUILD.gn
+++ b/third_party/WebKit/Source/wtf/BUILD.gn
@@ -13,31 +13,7 @@
 ]
 
 config("wtf_config") {
-  if (is_win) {
-    defines = [
-      "__STD_C",
-      "_CRT_SECURE_NO_DEPRECATE",
-      "_SCL_SECURE_NO_DEPRECATE",
-    ]
-    include_dirs = [ "os-win32" ]
-
-    cflags = [
-      # Don't complain about calling specific versions of templatized
-      # functions (e.g. in RefPtrHashMap.h).
-      "/wd4344",
-
-      # dtoa, icu, etc. like doing assignment within conditional.
-      "/wd4706",
-    ]
-
-    if (is_component_build) {
-      # Chromium windows multi-dll build enables C++ exceptions and this causes
-      # wtf to generate 4291 warning due to operator new/delete
-      # implementations. Disable the warning for chromium windows multi-dll
-      # build.
-      cflags += [ "/wd4291" ]
-    }
-  }
+  configs = [ "//third_party/WebKit/Source/platform/wtf:wtf_config" ]
 }
 
 component("wtf") {
@@ -62,7 +38,6 @@
     "Compiler.h",
     "ConditionalDestructor.h",
     "ContainerAnnotations.h",
-    "CryptographicallyRandomNumber.cpp",
     "CryptographicallyRandomNumber.h",
     "CurrentTime.cpp",
     "CurrentTime.h",
@@ -258,6 +233,7 @@
 
   public_deps = [
     "//base",
+    "//third_party/WebKit/Source/platform/wtf:platform_wtf",
     "//third_party/icu",
   ]
 
diff --git a/third_party/WebKit/Source/wtf/CryptographicallyRandomNumber.h b/third_party/WebKit/Source/wtf/CryptographicallyRandomNumber.h
index 51fbf47..8a0eab3 100644
--- a/third_party/WebKit/Source/wtf/CryptographicallyRandomNumber.h
+++ b/third_party/WebKit/Source/wtf/CryptographicallyRandomNumber.h
@@ -1,46 +1,9 @@
-/*
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved.
- * (http://www.torchmobile.com/)
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
 
-#ifndef WTF_CryptographicallyRandomNumber_h
-#define WTF_CryptographicallyRandomNumber_h
+#include "platform/wtf/CryptographicallyRandomNumber.h"
 
-#include "wtf/WTFExport.h"
-#include <cstddef>
-#include <stdint.h>
-
-namespace WTF {
-
-WTF_EXPORT void setAlwaysZeroRandomSourceForTesting();
-
-// These functions are threadsafe.
-WTF_EXPORT uint32_t cryptographicallyRandomNumber();
-WTF_EXPORT void cryptographicallyRandomValues(void* buffer, size_t length);
-}
-
-using WTF::cryptographicallyRandomNumber;
-using WTF::cryptographicallyRandomValues;
-
-#endif
+// The contents of this header was moved to platform/wtf as part of
+// WTF migration project. See the following post for details:
+// https://groups.google.com/a/chromium.org/d/msg/blink-dev/tLdAZCTlcAA/bYXVT8gYCAAJ
diff --git a/third_party/WebKit/Source/wtf/WTFExport.h b/third_party/WebKit/Source/wtf/WTFExport.h
index ba1005f..9e313a571 100644
--- a/third_party/WebKit/Source/wtf/WTFExport.h
+++ b/third_party/WebKit/Source/wtf/WTFExport.h
@@ -1,52 +1,9 @@
-/*
- * Copyright (C) 2013 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
 
-#ifndef WTFExport_h
-#define WTFExport_h
+#include "platform/wtf/WTFExport.h"
 
-#if !defined(WTF_IMPLEMENTATION)
-#define WTF_IMPLEMENTATION 0
-#endif
-
-#if defined(COMPONENT_BUILD)
-#if defined(WIN32)
-#if WTF_IMPLEMENTATION
-#define WTF_EXPORT __declspec(dllexport)
-#else
-#define WTF_EXPORT __declspec(dllimport)
-#endif
-#else  // defined(WIN32)
-#define WTF_EXPORT __attribute__((visibility("default")))
-#endif
-#else  // defined(COMPONENT_BUILD)
-#define WTF_EXPORT
-#endif
-
-#endif  // WTFExport_h
+// The contents of this header was moved to platform/wtf as part of
+// WTF migration project. See the following post for details:
+// https://groups.google.com/a/chromium.org/d/msg/blink-dev/tLdAZCTlcAA/bYXVT8gYCAAJ
diff --git a/third_party/WebKit/Source/wtf/typed_arrays/ArrayBuffer.h b/third_party/WebKit/Source/wtf/typed_arrays/ArrayBuffer.h
index d9011cf..971526c 100644
--- a/third_party/WebKit/Source/wtf/typed_arrays/ArrayBuffer.h
+++ b/third_party/WebKit/Source/wtf/typed_arrays/ArrayBuffer.h
@@ -50,9 +50,8 @@
   static inline PassRefPtr<ArrayBuffer> createOrNull(unsigned numElements,
                                                      unsigned elementByteSize);
 
-  // Only for use by XMLHttpRequest::responseArrayBuffer and
-  // Internals::serializeObject (through DOMArrayBuffer::createUninitialized).
-  static inline PassRefPtr<ArrayBuffer> createUninitialized(
+  // Only for use by DOMArrayBuffer::createUninitializedOrNull().
+  static inline PassRefPtr<ArrayBuffer> createUninitializedOrNull(
       unsigned numElements,
       unsigned elementByteSize);
 
@@ -154,11 +153,11 @@
                       ArrayBufferContents::ZeroInitialize);
 }
 
-PassRefPtr<ArrayBuffer> ArrayBuffer::createUninitialized(
+PassRefPtr<ArrayBuffer> ArrayBuffer::createUninitializedOrNull(
     unsigned numElements,
     unsigned elementByteSize) {
-  return create(numElements, elementByteSize,
-                ArrayBufferContents::DontInitialize);
+  return createOrNull(numElements, elementByteSize,
+                      ArrayBufferContents::DontInitialize);
 }
 
 PassRefPtr<ArrayBuffer> ArrayBuffer::create(
diff --git a/third_party/WebKit/public/platform/modules/bluetooth/web_bluetooth.mojom b/third_party/WebKit/public/platform/modules/bluetooth/web_bluetooth.mojom
index ddd5fd7..166857533 100644
--- a/third_party/WebKit/public/platform/modules/bluetooth/web_bluetooth.mojom
+++ b/third_party/WebKit/public/platform/modules/bluetooth/web_bluetooth.mojom
@@ -72,8 +72,6 @@
   GATT_OPERATION_IN_PROGRESS,
   GATT_SERVER_DISCONNECTED,
   GATT_SERVER_NOT_CONNECTED,
-  GATT_SERVER_DISCONNECTED_WHILE_RETRIEVING_CHARACTERISTICS,
-  GATT_SERVER_NOT_CONNECTED_CANNOT_RETRIEVE_CHARACTERISTICS,
   UNTRANSLATED_CONNECT_ERROR_CODE,
   // NotFoundError:
   NO_BLUETOOTH_ADAPTER,
diff --git a/third_party/libaddressinput/chromium/string_compare.cc b/third_party/libaddressinput/chromium/string_compare.cc
index 46057565..c3704b2 100644
--- a/third_party/libaddressinput/chromium/string_compare.cc
+++ b/third_party/libaddressinput/chromium/string_compare.cc
@@ -41,7 +41,7 @@
   DISALLOW_COPY_AND_ASSIGN(IcuStringComparer);
 };
 
-static base::LazyInstance<IcuStringComparer> g_comparer =
+static base::LazyInstance<IcuStringComparer>::DestructorAtExit g_comparer =
     LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
diff --git a/tools/json_schema_compiler/cpp_bundle_generator.py b/tools/json_schema_compiler/cpp_bundle_generator.py
index 88e0f36..bb7f041 100644
--- a/tools/json_schema_compiler/cpp_bundle_generator.py
+++ b/tools/json_schema_compiler/cpp_bundle_generator.py
@@ -360,7 +360,7 @@
     c.Append('std::map<std::string, const char*> schemas;')
     c.Eblock('};')
     c.Append()
-    c.Append('base::LazyInstance<Static> g_lazy_instance;')
+    c.Append('base::LazyInstance<Static>::DestructorAtExit g_lazy_instance;')
     c.Append()
     c.Append('}  // namespace')
     c.Append()
diff --git a/ui/accelerated_widget_mac/accelerated_widget_mac.mm b/ui/accelerated_widget_mac/accelerated_widget_mac.mm
index 14f119e..2c9dd43 100644
--- a/ui/accelerated_widget_mac/accelerated_widget_mac.mm
+++ b/ui/accelerated_widget_mac/accelerated_widget_mac.mm
@@ -27,8 +27,7 @@
 
 typedef std::map<gfx::AcceleratedWidget,AcceleratedWidgetMac*>
     WidgetToHelperMap;
-base::LazyInstance<WidgetToHelperMap> g_widget_to_helper_map;
-
+base::LazyInstance<WidgetToHelperMap>::DestructorAtExit g_widget_to_helper_map;
 
 }  // namespace
 
diff --git a/ui/accelerated_widget_mac/display_link_mac.cc b/ui/accelerated_widget_mac/display_link_mac.cc
index a6bf7f1..a1d5b730 100644
--- a/ui/accelerated_widget_mac/display_link_mac.cc
+++ b/ui/accelerated_widget_mac/display_link_mac.cc
@@ -214,7 +214,7 @@
 }
 
 // static
-base::LazyInstance<DisplayLinkMac::DisplayMap>
+base::LazyInstance<DisplayLinkMac::DisplayMap>::DestructorAtExit
     DisplayLinkMac::display_map_ = LAZY_INSTANCE_INITIALIZER;
 
 }  // ui
diff --git a/ui/accelerated_widget_mac/display_link_mac.h b/ui/accelerated_widget_mac/display_link_mac.h
index c376c70..2b8bde1d 100644
--- a/ui/accelerated_widget_mac/display_link_mac.h
+++ b/ui/accelerated_widget_mac/display_link_mac.h
@@ -90,7 +90,7 @@
   // Each display link instance consumes a non-negligible number of cycles, so
   // make all display links on the same screen share the same object.
   typedef std::map<CGDirectDisplayID, DisplayLinkMac*> DisplayMap;
-  static base::LazyInstance<DisplayMap> display_map_;
+  static base::LazyInstance<DisplayMap>::DestructorAtExit display_map_;
 };
 
 }  // ui
diff --git a/ui/accelerated_widget_mac/window_resize_helper_mac.h b/ui/accelerated_widget_mac/window_resize_helper_mac.h
index a83034f..e58276662 100644
--- a/ui/accelerated_widget_mac/window_resize_helper_mac.h
+++ b/ui/accelerated_widget_mac/window_resize_helper_mac.h
@@ -66,7 +66,7 @@
   bool WaitForSingleTaskToRun(const base::TimeDelta& max_delay);
 
  private:
-  friend struct base::DefaultLazyInstanceTraits<WindowResizeHelperMac>;
+  friend struct base::LazyInstanceTraitsBase<WindowResizeHelperMac>;
   WindowResizeHelperMac();
   ~WindowResizeHelperMac();
 
diff --git a/ui/accessibility/platform/ax_platform_node.cc b/ui/accessibility/platform/ax_platform_node.cc
index adfcc1e..dc275a7 100644
--- a/ui/accessibility/platform/ax_platform_node.cc
+++ b/ui/accessibility/platform/ax_platform_node.cc
@@ -16,9 +16,8 @@
 
 using UniqueIdMap = base::hash_map<int32_t, AXPlatformNode*>;
 // Map from each AXPlatformNode's unique id to its instance.
-base::LazyInstance<UniqueIdMap> g_unique_id_map =
+base::LazyInstance<UniqueIdMap>::DestructorAtExit g_unique_id_map =
     LAZY_INSTANCE_INITIALIZER;
-
 }
 
 #if !defined(PLATFORM_HAS_AX_PLATFORM_NODE_IMPL)
diff --git a/ui/accessibility/platform/ax_platform_node_win.cc b/ui/accessibility/platform/ax_platform_node_win.cc
index 428222e..d811182f 100644
--- a/ui/accessibility/platform/ax_platform_node_win.cc
+++ b/ui/accessibility/platform/ax_platform_node_win.cc
@@ -83,11 +83,12 @@
 typedef base::hash_set<AXPlatformNodeWin*> AXPlatformNodeWinSet;
 // Set of all AXPlatformNodeWin objects that were the target of an
 // alert event.
-base::LazyInstance<AXPlatformNodeWinSet> g_alert_targets =
+base::LazyInstance<AXPlatformNodeWinSet>::DestructorAtExit g_alert_targets =
     LAZY_INSTANCE_INITIALIZER;
 
-base::LazyInstance<base::ObserverList<IAccessible2UsageObserver>>
-    g_iaccessible2_usage_observer_list = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<base::ObserverList<IAccessible2UsageObserver>>::
+    DestructorAtExit g_iaccessible2_usage_observer_list =
+        LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/ui/aura/env.cc b/ui/aura/env.cc
index e9ec9d79..c422716 100644
--- a/ui/aura/env.cc
+++ b/ui/aura/env.cc
@@ -30,7 +30,7 @@
 namespace {
 
 // Env is thread local so that aura may be used on multiple threads.
-base::LazyInstance<base::ThreadLocalPointer<Env> >::Leaky lazy_tls_ptr =
+base::LazyInstance<base::ThreadLocalPointer<Env>>::Leaky lazy_tls_ptr =
     LAZY_INSTANCE_INITIALIZER;
 
 // Returns true if running inside of mus. Checks for mojo specific flag.
diff --git a/ui/base/clipboard/clipboard.cc b/ui/base/clipboard/clipboard.cc
index cf06e2f6..9ab641c 100644
--- a/ui/base/clipboard/clipboard.cc
+++ b/ui/base/clipboard/clipboard.cc
@@ -17,10 +17,10 @@
 
 namespace ui {
 
-base::LazyInstance<Clipboard::AllowedThreadsVector>
+base::LazyInstance<Clipboard::AllowedThreadsVector>::DestructorAtExit
     Clipboard::allowed_threads_ = LAZY_INSTANCE_INITIALIZER;
-base::LazyInstance<Clipboard::ClipboardMap> Clipboard::clipboard_map_ =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<Clipboard::ClipboardMap>::DestructorAtExit
+    Clipboard::clipboard_map_ = LAZY_INSTANCE_INITIALIZER;
 base::LazyInstance<base::Lock>::Leaky Clipboard::clipboard_map_lock_ =
     LAZY_INSTANCE_INITIALIZER;
 
diff --git a/ui/base/clipboard/clipboard.h b/ui/base/clipboard/clipboard.h
index ff7c04a..e25f892 100644
--- a/ui/base/clipboard/clipboard.h
+++ b/ui/base/clipboard/clipboard.h
@@ -334,12 +334,13 @@
   // is done (in the unit test case), but a user (like content) can set which
   // threads are allowed to call this method.
   typedef std::vector<base::PlatformThreadId> AllowedThreadsVector;
-  static base::LazyInstance<AllowedThreadsVector> allowed_threads_;
+  static base::LazyInstance<AllowedThreadsVector>::DestructorAtExit
+      allowed_threads_;
 
   // Mapping from threads to clipboard objects.
   typedef std::map<base::PlatformThreadId, std::unique_ptr<Clipboard>>
       ClipboardMap;
-  static base::LazyInstance<ClipboardMap> clipboard_map_;
+  static base::LazyInstance<ClipboardMap>::DestructorAtExit clipboard_map_;
 
   // Mutex that controls access to |g_clipboard_map|.
   static base::LazyInstance<base::Lock>::Leaky clipboard_map_lock_;
diff --git a/ui/base/cursor/cursor_loader_win.cc b/ui/base/cursor/cursor_loader_win.cc
index 7c8d18f7..430cf7ec 100644
--- a/ui/base/cursor/cursor_loader_win.cc
+++ b/ui/base/cursor/cursor_loader_win.cc
@@ -13,7 +13,8 @@
 
 namespace {
 
-base::LazyInstance<base::string16> g_cursor_resource_module_name;
+base::LazyInstance<base::string16>::DestructorAtExit
+    g_cursor_resource_module_name;
 
 const wchar_t* GetCursorId(gfx::NativeCursor native_cursor) {
   switch (native_cursor.native_type()) {
diff --git a/ui/base/l10n/formatter.h b/ui/base/l10n/formatter.h
index 44b1ddc..4f63fc39 100644
--- a/ui/base/l10n/formatter.h
+++ b/ui/base/l10n/formatter.h
@@ -106,7 +106,8 @@
 
 // Windows compilation requires full definition of FormatterContainer before
 // LazyInstance<FormatterContainter> may be declared.
-extern UI_BASE_EXPORT base::LazyInstance<FormatterContainer> g_container;
+extern UI_BASE_EXPORT base::LazyInstance<FormatterContainer>::DestructorAtExit
+    g_container;
 
 // For use in unit tests only.
 extern UI_BASE_EXPORT bool formatter_force_fallback;
diff --git a/ui/base/l10n/l10n_util.cc b/ui/base/l10n/l10n_util.cc
index 440ab1a..47e5711 100644
--- a/ui/base/l10n/l10n_util.cc
+++ b/ui/base/l10n/l10n_util.cc
@@ -277,11 +277,12 @@
 }
 
 struct AvailableLocalesTraits
-    : base::DefaultLazyInstanceTraits<std::vector<std::string> > {
+    : base::internal::DestructorAtExitLazyInstanceTraits<
+          std::vector<std::string>> {
   static std::vector<std::string>* New(void* instance) {
     std::vector<std::string>* locales =
-        base::DefaultLazyInstanceTraits<std::vector<std::string> >::New(
-            instance);
+        base::internal::DestructorAtExitLazyInstanceTraits<
+            std::vector<std::string>>::New(instance);
     int num_locales = uloc_countAvailable();
     for (int i = 0; i < num_locales; ++i) {
       std::string locale_name = uloc_getAvailable(i);
diff --git a/ui/base/l10n/l10n_util_mac.mm b/ui/base/l10n/l10n_util_mac.mm
index 6f122d5..79730e5 100644
--- a/ui/base/l10n/l10n_util_mac.mm
+++ b/ui/base/l10n/l10n_util_mac.mm
@@ -13,7 +13,8 @@
 
 namespace {
 
-base::LazyInstance<std::string> g_overridden_locale = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<std::string>::DestructorAtExit g_overridden_locale =
+    LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/ui/base/l10n/l10n_util_win.cc b/ui/base/l10n/l10n_util_win.cc
index ee3ca95..01bbacc6 100644
--- a/ui/base/l10n/l10n_util_win.cc
+++ b/ui/base/l10n/l10n_util_win.cc
@@ -76,8 +76,8 @@
   DISALLOW_COPY_AND_ASSIGN(OverrideLocaleHolder);
 };
 
-base::LazyInstance<OverrideLocaleHolder> override_locale_holder =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<OverrideLocaleHolder>::DestructorAtExit
+    override_locale_holder = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/ui/base/l10n/time_format.cc b/ui/base/l10n/time_format.cc
index 1f03599..8be7f4e 100644
--- a/ui/base/l10n/time_format.cc
+++ b/ui/base/l10n/time_format.cc
@@ -22,8 +22,8 @@
 
 namespace ui {
 
-UI_BASE_EXPORT base::LazyInstance<FormatterContainer> g_container =
-    LAZY_INSTANCE_INITIALIZER;
+UI_BASE_EXPORT base::LazyInstance<FormatterContainer>::DestructorAtExit
+    g_container = LAZY_INSTANCE_INITIALIZER;
 
 // static
 base::string16 TimeFormat::Simple(TimeFormat::Format format,
diff --git a/ui/events/keycodes/platform_key_map_win.cc b/ui/events/keycodes/platform_key_map_win.cc
index 32b544e3..529b799 100644
--- a/ui/events/keycodes/platform_key_map_win.cc
+++ b/ui/events/keycodes/platform_key_map_win.cc
@@ -262,7 +262,8 @@
 }
 
 struct PlatformKeyMapInstanceTlsTraits
-    : public base::DefaultLazyInstanceTraits<base::ThreadLocalStorage::Slot> {
+    : public base::internal::DestructorAtExitLazyInstanceTraits<
+          base::ThreadLocalStorage::Slot> {
   static base::ThreadLocalStorage::Slot* New(void* instance) {
     // Use placement new to initialize our instance in our preallocated space.
     // TODO(chongz): Use std::default_delete instead of providing own function.
diff --git a/ui/gfx/font_list.cc b/ui/gfx/font_list.cc
index 4ff43ecc..118f10e3 100644
--- a/ui/gfx/font_list.cc
+++ b/ui/gfx/font_list.cc
@@ -19,7 +19,7 @@
     LAZY_INSTANCE_INITIALIZER;
 
 // The default instance of gfx::FontListImpl.
-base::LazyInstance<scoped_refptr<gfx::FontListImpl> >::Leaky g_default_impl =
+base::LazyInstance<scoped_refptr<gfx::FontListImpl>>::Leaky g_default_impl =
     LAZY_INSTANCE_INITIALIZER;
 bool g_default_impl_initialized = false;
 
diff --git a/ui/gfx/icc_profile.cc b/ui/gfx/icc_profile.cc
index 9390da6..de11f29 100644
--- a/ui/gfx/icc_profile.cc
+++ b/ui/gfx/icc_profile.cc
@@ -38,7 +38,8 @@
   base::MRUCache<uint64_t, ICCProfile> id_to_icc_profile_mru;
   base::Lock lock;
 };
-static base::LazyInstance<Cache> g_cache;
+static base::LazyInstance<Cache>::DestructorAtExit g_cache =
+    LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/ui/gfx/icc_profile_win.cc b/ui/gfx/icc_profile_win.cc
index 7e1b0ca0..c4ac9d96 100644
--- a/ui/gfx/icc_profile_win.cc
+++ b/ui/gfx/icc_profile_win.cc
@@ -33,10 +33,10 @@
   profile->assign(profile_data.data(), profile_data.data() + length);
 }
 
-base::LazyInstance<base::Lock> g_best_monitor_color_space_lock =
-    LAZY_INSTANCE_INITIALIZER;
-base::LazyInstance<gfx::ICCProfile> g_best_monitor_color_space =
-    LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<base::Lock>::DestructorAtExit
+    g_best_monitor_color_space_lock = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<gfx::ICCProfile>::DestructorAtExit
+    g_best_monitor_color_space = LAZY_INSTANCE_INITIALIZER;
 bool g_has_initialized_best_monitor_color_space = false;
 
 }  // namespace
diff --git a/ui/gfx/paint_vector_icon.cc b/ui/gfx/paint_vector_icon.cc
index 2f5c762..90feddf4 100644
--- a/ui/gfx/paint_vector_icon.cc
+++ b/ui/gfx/paint_vector_icon.cc
@@ -480,7 +480,7 @@
   DISALLOW_COPY_AND_ASSIGN(VectorIconCache);
 };
 
-static base::LazyInstance<VectorIconCache> g_icon_cache =
+static base::LazyInstance<VectorIconCache>::DestructorAtExit g_icon_cache =
     LAZY_INSTANCE_INITIALIZER;
 
 class VectorIconCacheLegacy {
@@ -527,8 +527,8 @@
   DISALLOW_COPY_AND_ASSIGN(VectorIconCacheLegacy);
 };
 
-static base::LazyInstance<VectorIconCacheLegacy> g_icon_cache_legacy =
-    LAZY_INSTANCE_INITIALIZER;
+static base::LazyInstance<VectorIconCacheLegacy>::DestructorAtExit
+    g_icon_cache_legacy = LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/ui/gfx/shadow_util.cc b/ui/gfx/shadow_util.cc
index 32e67e6..d58a5df 100644
--- a/ui/gfx/shadow_util.cc
+++ b/ui/gfx/shadow_util.cc
@@ -74,7 +74,8 @@
 
 // Map from elevation/corner radius pair to a cached shadow.
 using ShadowDetailsMap = std::map<std::pair<int, int>, ShadowDetails>;
-base::LazyInstance<ShadowDetailsMap> g_shadow_cache = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<ShadowDetailsMap>::DestructorAtExit g_shadow_cache =
+    LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/ui/gl/gl_context.cc b/ui/gl/gl_context.cc
index 56591dc..4e380e2 100644
--- a/ui/gl/gl_context.cc
+++ b/ui/gl/gl_context.cc
@@ -25,10 +25,10 @@
 namespace gl {
 
 namespace {
-base::LazyInstance<base::ThreadLocalPointer<GLContext> >::Leaky
+base::LazyInstance<base::ThreadLocalPointer<GLContext>>::Leaky
     current_context_ = LAZY_INSTANCE_INITIALIZER;
 
-base::LazyInstance<base::ThreadLocalPointer<GLContext> >::Leaky
+base::LazyInstance<base::ThreadLocalPointer<GLContext>>::Leaky
     current_real_context_ = LAZY_INSTANCE_INITIALIZER;
 }  // namespace
 
diff --git a/ui/gl/gl_surface.cc b/ui/gl/gl_surface.cc
index c0ac7f0..59939c7 100644
--- a/ui/gl/gl_surface.cc
+++ b/ui/gl/gl_surface.cc
@@ -22,7 +22,7 @@
 namespace gl {
 
 namespace {
-base::LazyInstance<base::ThreadLocalPointer<GLSurface> >::Leaky
+base::LazyInstance<base::ThreadLocalPointer<GLSurface>>::Leaky
     current_surface_ = LAZY_INSTANCE_INITIALIZER;
 }  // namespace
 
diff --git a/ui/keyboard/content/keyboard_content_util.cc b/ui/keyboard/content/keyboard_content_util.cc
index c5813b61..aec8659 100644
--- a/ui/keyboard/content/keyboard_content_util.cc
+++ b/ui/keyboard/content/keyboard_content_util.cc
@@ -13,7 +13,8 @@
 namespace keyboard {
 namespace {
 
-base::LazyInstance<GURL> g_override_content_url = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<GURL>::DestructorAtExit g_override_content_url =
+    LAZY_INSTANCE_INITIALIZER;
 
 }  // namespace
 
diff --git a/ui/keyboard/keyboard_util.cc b/ui/keyboard/keyboard_util.cc
index b9bb9e00..8c3a8db9 100644
--- a/ui/keyboard/keyboard_util.cc
+++ b/ui/keyboard/keyboard_util.cc
@@ -43,7 +43,7 @@
   CHECK(!details.dispatcher_destroyed);
 }
 
-base::LazyInstance<base::Time> g_keyboard_load_time_start =
+base::LazyInstance<base::Time>::DestructorAtExit g_keyboard_load_time_start =
     LAZY_INSTANCE_INITIALIZER;
 
 bool g_accessibility_keyboard_enabled = false;
diff --git a/ui/ozone/platform/cast/overlay_manager_cast.cc b/ui/ozone/platform/cast/overlay_manager_cast.cc
index 228217e..72b0ba8 100644
--- a/ui/ozone/platform/cast/overlay_manager_cast.cc
+++ b/ui/ozone/platform/cast/overlay_manager_cast.cc
@@ -12,8 +12,8 @@
 namespace ui {
 namespace {
 
-base::LazyInstance<OverlayManagerCast::OverlayCompositedCallback>
-    g_overlay_composited_callback = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<OverlayManagerCast::OverlayCompositedCallback>::
+    DestructorAtExit g_overlay_composited_callback = LAZY_INSTANCE_INITIALIZER;
 
 // Translates a gfx::OverlayTransform into a VideoPlane::Transform.
 // Could be just a lookup table once we have unit tests for this code
diff --git a/ui/views/examples/examples_main.cc b/ui/views/examples/examples_main.cc
index 55e11c1..80ef2dd 100644
--- a/ui/views/examples/examples_main.cc
+++ b/ui/views/examples/examples_main.cc
@@ -46,7 +46,7 @@
 #include "ui/gfx/x/x11_connection.h"  // nogncheck
 #endif
 
-base::LazyInstance<base::TestDiscardableMemoryAllocator>
+base::LazyInstance<base::TestDiscardableMemoryAllocator>::DestructorAtExit
     g_discardable_memory_allocator = LAZY_INSTANCE_INITIALIZER;
 
 int main(int argc, char** argv) {
diff --git a/ui/views/win/hwnd_message_handler.cc b/ui/views/win/hwnd_message_handler.cc
index 810b9cb..83ace0405 100644
--- a/ui/views/win/hwnd_message_handler.cc
+++ b/ui/views/win/hwnd_message_handler.cc
@@ -311,8 +311,9 @@
 };
 
 // static HWNDMessageHandler member initialization.
-base::LazyInstance<HWNDMessageHandler::FullscreenWindowMonitorMap>
-    HWNDMessageHandler::fullscreen_monitor_map_ = LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<HWNDMessageHandler::FullscreenWindowMonitorMap>::
+    DestructorAtExit HWNDMessageHandler::fullscreen_monitor_map_ =
+        LAZY_INSTANCE_INITIALIZER;
 
 ////////////////////////////////////////////////////////////////////////////////
 // HWNDMessageHandler, public:
diff --git a/ui/views/win/hwnd_message_handler.h b/ui/views/win/hwnd_message_handler.h
index 2230e23a..e0a804c 100644
--- a/ui/views/win/hwnd_message_handler.h
+++ b/ui/views/win/hwnd_message_handler.h
@@ -701,7 +701,8 @@
   // to keep a raw pointer to the HWNDMessageHandler instance as we track the
   // window destruction and ensure that the map is cleaned up.
   using FullscreenWindowMonitorMap = std::map<HMONITOR, HWNDMessageHandler*>;
-  static base::LazyInstance<FullscreenWindowMonitorMap> fullscreen_monitor_map_;
+  static base::LazyInstance<FullscreenWindowMonitorMap>::DestructorAtExit
+      fullscreen_monitor_map_;
 
   // The WeakPtrFactories below must occur last in the class definition so they
   // get destroyed last.