diff --git a/DEPS b/DEPS
index 621492a..3207e8b3 100644
--- a/DEPS
+++ b/DEPS

@@ -40,11 +40,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': 'f86d37be5b539e8b318d4449713e13f2cfc94da8',
+  'skia_revision': '6ecc911070add386dc9ffeb8b131d21035672fb6',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': '6f0ca10e3fb536d902700a1ef92d6e45ce91b47c',
+  'v8_revision': '326a8fdf23e2ba9faf35a5e200ffb50f847a06d9',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -72,7 +72,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling BoringSSL
   # and whatever else without interference from each other.
-  'boringssl_revision': 'c07635f8699e99b6af06e401beccd934f6bce53b',
+  'boringssl_revision': '24e5886c0edfc409c8083d10f9f1120111efd6f5',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling google-toolbox-for-mac
   # and whatever else without interference from each other.
@@ -205,7 +205,7 @@
     Var('chromium_git') + '/external/selenium/py.git' + '@' + '5fd78261a75fe08d27ca4835fb6c5ce4b42275bd',
 
   'src/third_party/libvpx/source/libvpx':
-    Var('chromium_git') + '/webm/libvpx.git' + '@' +  '4f9d852759ceca15c16f9ffed96c08d4b427f40b',
+    Var('chromium_git') + '/webm/libvpx.git' + '@' +  '8d391a111a4830f946f6fe8b0cf51be8661224d9',
 
   'src/third_party/ffmpeg':
     Var('chromium_git') + '/chromium/third_party/ffmpeg.git' + '@' + '06ac9ea361fa8d48916b83783bb7f36872388cc2',

diff --git a/ash/BUILD.gn b/ash/BUILD.gn
index 7f0422635..bf39a8e 100644
--- a/ash/BUILD.gn
+++ b/ash/BUILD.gn

@@ -220,6 +220,8 @@
     "login/ui/lock_window.h",
     "login/ui/login_password_view.cc",
     "login/ui/login_password_view.h",
+    "login/ui/login_pin_view.cc",
+    "login/ui/login_pin_view.h",
     "login_status.h",
     "magnifier/magnification_controller.cc",
     "magnifier/magnification_controller.h",
@@ -1178,6 +1180,7 @@
     "login/mock_lock_screen_client.cc",
     "login/mock_lock_screen_client.h",
     "login/ui/login_password_view_test.cc",
+    "login/ui/login_pin_view_unittest.cc",
     "login/ui/login_test_base.cc",
     "login/ui/login_test_base.h",
     "metrics/desktop_task_switch_metric_recorder_unittest.cc",

diff --git a/ash/ash_switches.cc b/ash/ash_switches.cc
index 30fc6c4..3db6f13 100644
--- a/ash/ash_switches.cc
+++ b/ash/ash_switches.cc

@@ -30,6 +30,9 @@
 // Enable keyboard shortcuts used by developers only.
 const char kAshDeveloperShortcuts[] = "ash-dev-shortcuts";
 
+// Disable the Night Light feature.
+const char kAshDisableNightLight[] = "ash-disable-night-light";
+
 // Disable the Touch Exploration Mode. Touch Exploration Mode will no longer be
 // turned on automatically when spoken feedback is enabled when this flag is
 // set.
@@ -40,9 +43,6 @@
 const char kAshEnableMagnifierKeyScroller[] =
     "ash-enable-magnifier-key-scroller";
 
-// Enables the NightLight feature.
-const char kAshEnableNightLight[] = "ash-enable-night-light";
-
 // Enables the palette on every display, instead of only the internal one.
 const char kAshEnablePaletteOnAllDisplays[] =
     "ash-enable-palette-on-all-displays";

diff --git a/ash/ash_switches.h b/ash/ash_switches.h
index 5aecb7b5..e3e7337 100644
--- a/ash/ash_switches.h
+++ b/ash/ash_switches.h

@@ -20,10 +20,10 @@
 ASH_EXPORT extern const char kAshCopyHostBackgroundAtBoot[];
 ASH_EXPORT extern const char kAshDebugShortcuts[];
 ASH_EXPORT extern const char kAshDeveloperShortcuts[];
+ASH_EXPORT extern const char kAshDisableNightLight[];
 ASH_EXPORT extern const char kAshDisableSmoothScreenRotation[];
 ASH_EXPORT extern const char kAshDisableTouchExplorationMode[];
 ASH_EXPORT extern const char kAshEnableMagnifierKeyScroller[];
-ASH_EXPORT extern const char kAshEnableNightLight[];
 ASH_EXPORT extern const char kAshEnablePaletteOnAllDisplays[];
 ASH_EXPORT extern const char kAshEnableScaleSettingsTray[];
 ASH_EXPORT extern const char kAshEnableTouchView[];

diff --git a/ash/display/display_color_manager_chromeos.cc b/ash/display/display_color_manager_chromeos.cc
index 074043f..02a7f5c 100644
--- a/ash/display/display_color_manager_chromeos.cc
+++ b/ash/display/display_color_manager_chromeos.cc

@@ -11,8 +11,10 @@
 #include "base/bind.h"
 #include "base/files/file_util.h"
 #include "base/logging.h"
+#include "base/sequenced_task_runner.h"
 #include "base/task_runner_util.h"
-#include "base/threading/sequenced_worker_pool.h"
+#include "base/task_scheduler/post_task.h"
+#include "base/threading/thread_restrictions.h"
 #include "components/quirks/quirks_manager.h"
 #include "third_party/qcms/src/qcms.h"
 #include "ui/display/display.h"
@@ -24,12 +26,15 @@
 
 namespace {
 
+// Runs on a background thread because it does file IO.
 std::unique_ptr<DisplayColorManager::ColorCalibrationData> ParseDisplayProfile(
     const base::FilePath& path,
     bool has_color_correction_matrix) {
   VLOG(1) << "Trying ICC file " << path.value()
           << " has_color_correction_matrix: "
           << (has_color_correction_matrix ? "true" : "false");
+  base::ThreadRestrictions::AssertIOAllowed();
+  // Reads from a file.
   qcms_profile* display_profile = qcms_profile_from_path(path.value().c_str());
   if (!display_profile) {
     LOG(WARNING) << "Unable to load ICC file: " << path.value();
@@ -150,10 +155,11 @@
 }  // namespace
 
 DisplayColorManager::DisplayColorManager(
-    display::DisplayConfigurator* configurator,
-    base::SequencedWorkerPool* blocking_pool)
+    display::DisplayConfigurator* configurator)
     : configurator_(configurator),
-      blocking_pool_(blocking_pool),
+      sequenced_task_runner_(base::CreateSequencedTaskRunnerWithTraits(
+          {base::MayBlock(), base::TaskPriority::USER_VISIBLE,
+           base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN})),
       weak_ptr_factory_(this) {
   configurator_->AddObserver(this);
 }
@@ -192,7 +198,7 @@
 
 void DisplayColorManager::LoadCalibrationForDisplay(
     const display::DisplaySnapshot* display) {
-  DCHECK(thread_checker_.CalledOnValidThread());
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   if (display->display_id() == display::kInvalidDisplayId) {
     LOG(WARNING) << "Trying to load calibration data for invalid display id";
     return;
@@ -219,7 +225,7 @@
     display::DisplayConnectionType type,
     const base::FilePath& path,
     bool file_downloaded) {
-  DCHECK(thread_checker_.CalledOnValidThread());
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   std::string product_string = quirks::IdToHexString(product_id);
   if (path.empty()) {
     VLOG(1) << "No ICC file found with product id: " << product_string
@@ -239,7 +245,7 @@
           << " with product id: " << product_string;
 
   base::PostTaskAndReplyWithResult(
-      blocking_pool_, FROM_HERE,
+      sequenced_task_runner_.get(), FROM_HERE,
       base::Bind(&ParseDisplayProfile, path, has_color_correction_matrix),
       base::Bind(&DisplayColorManager::UpdateCalibrationData,
                  weak_ptr_factory_.GetWeakPtr(), display_id, product_id));
@@ -249,7 +255,7 @@
     int64_t display_id,
     int64_t product_id,
     std::unique_ptr<ColorCalibrationData> data) {
-  DCHECK(thread_checker_.CalledOnValidThread());
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   if (data) {
     calibration_map_[product_id] = std::move(data);
     ApplyDisplayColorCalibration(display_id, product_id);

diff --git a/ash/display/display_color_manager_chromeos.h b/ash/display/display_color_manager_chromeos.h
index c87c727..60c217a 100644
--- a/ash/display/display_color_manager_chromeos.h
+++ b/ash/display/display_color_manager_chromeos.h

@@ -15,12 +15,12 @@
 #include "base/files/file_path.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
-#include "base/threading/thread_checker.h"
+#include "base/sequence_checker.h"
 #include "ui/display/manager/chromeos/display_configurator.h"
 #include "ui/display/types/display_constants.h"
 
 namespace base {
-class SequencedWorkerPool;
+class SequencedTaskRunner;
 }
 
 namespace display {
@@ -35,8 +35,7 @@
 class ASH_EXPORT DisplayColorManager
     : public display::DisplayConfigurator::Observer {
  public:
-  DisplayColorManager(display::DisplayConfigurator* configurator,
-                      base::SequencedWorkerPool* blocking_pool);
+  explicit DisplayColorManager(display::DisplayConfigurator* configurator);
   ~DisplayColorManager() override;
 
   // display::DisplayConfigurator::Observer
@@ -69,13 +68,15 @@
       std::unique_ptr<ColorCalibrationData> data);
 
  private:
+  friend class DisplayColorManagerTest;
+
   void ApplyDisplayColorCalibration(int64_t display_id, int64_t product_id);
   void LoadCalibrationForDisplay(const display::DisplaySnapshot* display);
 
   display::DisplayConfigurator* configurator_;
   std::map<int64_t, std::unique_ptr<ColorCalibrationData>> calibration_map_;
-  base::ThreadChecker thread_checker_;
-  base::SequencedWorkerPool* blocking_pool_;
+  SEQUENCE_CHECKER(sequence_checker_);
+  scoped_refptr<base::SequencedTaskRunner> sequenced_task_runner_;
 
   // Factory for callbacks.
   base::WeakPtrFactory<DisplayColorManager> weak_ptr_factory_;

diff --git a/ash/display/display_color_manager_chromeos_unittest.cc b/ash/display/display_color_manager_chromeos_unittest.cc
index a5ef152..dc62624 100644
--- a/ash/display/display_color_manager_chromeos_unittest.cc
+++ b/ash/display/display_color_manager_chromeos_unittest.cc

@@ -5,12 +5,13 @@
 #include "ash/display/display_color_manager_chromeos.h"
 
 #include "base/files/file_util.h"
+#include "base/memory/ptr_util.h"
 #include "base/memory/scoped_vector.h"
-#include "base/message_loop/message_loop.h"
 #include "base/path_service.h"
 #include "base/run_loop.h"
 #include "base/strings/pattern.h"
 #include "base/test/scoped_path_override.h"
+#include "base/test/scoped_task_environment.h"
 #include "base/test/sequenced_worker_pool_owner.h"
 #include "chromeos/chromeos_paths.h"
 #include "components/quirks/quirks_manager.h"
@@ -33,9 +34,9 @@
 
 class DisplayColorManagerForTest : public DisplayColorManager {
  public:
-  DisplayColorManagerForTest(display::DisplayConfigurator* configurator,
-                             base::SequencedWorkerPool* blocking_pool)
-      : DisplayColorManager(configurator, blocking_pool) {}
+  explicit DisplayColorManagerForTest(
+      display::DisplayConfigurator* configurator)
+      : DisplayColorManager(configurator) {}
 
   void SetOnFinishedForTest(base::Closure on_finished_for_test) {
     on_finished_for_test_ = on_finished_for_test;
@@ -113,8 +114,8 @@
         std::unique_ptr<display::NativeDisplayDelegate>(
             native_display_delegate_));
 
-    color_manager_.reset(new DisplayColorManagerForTest(
-        &configurator_, pool_owner_->pool().get()));
+    color_manager_ =
+        base::MakeUnique<DisplayColorManagerForTest>(&configurator_);
 
     EXPECT_TRUE(PathService::Get(base::DIR_SOURCE_ROOT, &color_path_));
 
@@ -145,6 +146,8 @@
   ~DisplayColorManagerTest() override {}
 
  protected:
+  base::test::ScopedTaskEnvironment scoped_task_environment_;
+  std::unique_ptr<base::SequencedWorkerPoolOwner> pool_owner_;
   std::unique_ptr<base::ScopedPathOverride> path_override_;
   base::FilePath color_path_;
   std::unique_ptr<display::test::ActionLogger> log_;
@@ -154,9 +157,6 @@
       native_display_delegate_;  // not owned
   std::unique_ptr<DisplayColorManagerForTest> color_manager_;
 
-  base::MessageLoopForUI ui_message_loop_;
-  std::unique_ptr<base::SequencedWorkerPoolOwner> pool_owner_;
-
  private:
   DISALLOW_COPY_AND_ASSIGN(DisplayColorManagerTest);
 };

diff --git a/ash/login/ui/login_password_view.cc b/ash/login/ui/login_password_view.cc
index 35326c8..7b37497 100644
--- a/ash/login/ui/login_password_view.cc
+++ b/ash/login/ui/login_password_view.cc

@@ -7,7 +7,10 @@
 #include "ash/resources/vector_icons/vector_icons.h"
 #include "ash/system/tray/size_range_layout.h"
 #include "ash/system/user/button_from_view.h"
+#include "base/strings/string_number_conversions.h"
 #include "base/strings/utf_string_conversions.h"
+#include "ui/events/event_constants.h"
+#include "ui/events/keycodes/dom/dom_code.h"
 #include "ui/gfx/paint_vector_icon.h"
 #include "ui/views/border.h"
 #include "ui/views/controls/image_view.h"
@@ -99,6 +102,24 @@
 
 LoginPasswordView::~LoginPasswordView() = default;
 
+void LoginPasswordView::AppendNumber(int value) {
+  textfield_->SetText(textfield_->text() + base::IntToString16(value));
+}
+
+void LoginPasswordView::Backspace() {
+  // Instead of just adjusting textfield_ text directly, fire a backspace key
+  // event as this handles the various edge cases (ie, selected text).
+
+  // views::Textfield::OnKeyPressed is private, so we call it via views::View.
+  auto* view = static_cast<views::View*>(textfield_);
+  view->OnKeyPressed(ui::KeyEvent(ui::ET_KEY_PRESSED, ui::VKEY_BACK,
+                                  ui::DomCode::BACKSPACE, ui::EF_NONE));
+  view->OnKeyPressed(ui::KeyEvent(ui::ET_KEY_RELEASED, ui::VKEY_BACK,
+                                  ui::DomCode::BACKSPACE, ui::EF_NONE));
+}
+
+void LoginPasswordView::Submit() {}
+
 const char* LoginPasswordView::GetClassName() const {
   return kLoginPasswordViewName;
 }

diff --git a/ash/login/ui/login_password_view.h b/ash/login/ui/login_password_view.h
index 6f0d5ed7..772014b 100644
--- a/ash/login/ui/login_password_view.h
+++ b/ash/login/ui/login_password_view.h

@@ -48,6 +48,15 @@
   explicit LoginPasswordView(const OnPasswordSubmit& on_submit);
   ~LoginPasswordView() override;
 
+  // Add the given numeric value to the textfield.
+  void AppendNumber(int value);
+
+  // Erase the last entered value.
+  void Backspace();
+
+  // Dispatch a submit event.
+  void Submit();
+
   // views::View:
   const char* GetClassName() const override;
   gfx::Size CalculatePreferredSize() const override;

diff --git a/ash/login/ui/login_pin_view.cc b/ash/login/ui/login_pin_view.cc
new file mode 100644
index 0000000..9e214d3
--- /dev/null
+++ b/ash/login/ui/login_pin_view.cc

@@ -0,0 +1,160 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ash/login/ui/login_pin_view.h"
+
+#include "base/callback.h"
+#include "base/strings/utf_string_conversions.h"
+#include "ui/views/controls/button/label_button.h"
+#include "ui/views/layout/box_layout.h"
+
+namespace ash {
+namespace {
+
+const char* kPinLabels[] = {
+    "+",      // 0
+    " ABC",   // 1
+    " DEF",   // 2
+    " GHI",   // 3
+    " JKL",   // 4
+    " MNO",   // 5
+    " PQRS",  // 6
+    " TUV",   // 7
+    " WXYZ",  // 8
+    " MNO",   // 9
+};
+
+const char* kLoginPinViewClassName = "LoginPinView";
+
+// View ids. Useful for the test api.
+const int kBackspaceButtonId = -1;
+
+base::string16 GetButtonLabelForNumber(int value) {
+  DCHECK(value >= 0 && value < int{arraysize(kPinLabels)});
+  return base::ASCIIToUTF16(std::to_string(value) + kPinLabels[value]);
+}
+
+// Returns the view id for the given pin number.
+int GetViewIdForPinNumber(int number) {
+  // 0 is a valid pin number but it is also the default view id. Shift all ids
+  // over so 0 can be found.
+  return number + 1;
+}
+
+// TODO(jdufault): Get pin button visuals to spec.
+class PinButton : public views::LabelButton, public views::ButtonListener {
+ public:
+  PinButton(const base::string16& label, const base::Closure& on_press)
+      : views::LabelButton(this, label), on_press_(on_press) {
+    SetFocusBehavior(FocusBehavior::ALWAYS);
+
+    SetEnabledTextColors(SK_ColorWHITE);
+    SetPreferredSize(
+        gfx::Size(LoginPinView::kButtonSizeDp, LoginPinView::kButtonSizeDp));
+  }
+
+  PinButton(int value, const LoginPinView::OnPinKey& on_key)
+      : PinButton(GetButtonLabelForNumber(value), base::Bind(on_key, value)) {
+    set_id(GetViewIdForPinNumber(value));
+  }
+  ~PinButton() override = default;
+
+  // views::ButtonListener:
+  void ButtonPressed(Button* sender, const ui::Event& event) override {
+    DCHECK(sender == this);
+
+    if (on_press_)
+      on_press_.Run();
+  }
+
+ private:
+  base::Closure on_press_;
+
+  DISALLOW_COPY_AND_ASSIGN(PinButton);
+};
+
+}  // namespace
+
+// static
+const int LoginPinView::kButtonSeparatorSizeDp = 30;
+// static
+const int LoginPinView::kButtonSizeDp = 48;
+
+LoginPinView::TestApi::TestApi(LoginPinView* view) : view_(view) {}
+
+LoginPinView::TestApi::~TestApi() = default;
+
+views::View* LoginPinView::TestApi::GetButton(int number) const {
+  return view_->GetViewByID(GetViewIdForPinNumber(number));
+}
+
+views::View* LoginPinView::TestApi::GetBackspaceButton() const {
+  return view_->GetViewByID(kBackspaceButtonId);
+}
+
+LoginPinView::LoginPinView(const OnPinKey& on_key,
+                           const OnPinBackspace& on_backspace)
+    : on_key_(on_key), on_backspace_(on_backspace) {
+  DCHECK(on_key_);
+  DCHECK(on_backspace_);
+
+  // Builds and returns a new view which contains a row of the PIN keyboard.
+  auto build_and_add_row = [this]() {
+    auto* row = new views::View();
+    row->SetLayoutManager(new views::BoxLayout(
+        views::BoxLayout::kHorizontal, gfx::Insets(), kButtonSeparatorSizeDp));
+    AddChildView(row);
+    return row;
+  };
+
+  SetLayoutManager(new views::BoxLayout(views::BoxLayout::kVertical,
+                                        gfx::Insets(), kButtonSeparatorSizeDp));
+
+  // 1-2-3
+  auto* row = build_and_add_row();
+  row->AddChildView(new PinButton(1, on_key_));
+  row->AddChildView(new PinButton(2, on_key_));
+  row->AddChildView(new PinButton(3, on_key_));
+
+  // 4-5-6
+  row = build_and_add_row();
+  row->AddChildView(new PinButton(4, on_key_));
+  row->AddChildView(new PinButton(5, on_key_));
+  row->AddChildView(new PinButton(6, on_key_));
+
+  // 7-8-9
+  row = build_and_add_row();
+  row->AddChildView(new PinButton(7, on_key_));
+  row->AddChildView(new PinButton(8, on_key_));
+  row->AddChildView(new PinButton(9, on_key_));
+
+  // 0-backspace
+  row = build_and_add_row();
+  auto* spacer = new views::View();
+  spacer->SetPreferredSize(gfx::Size(kButtonSizeDp, kButtonSizeDp));
+  row->AddChildView(spacer);
+  row->AddChildView(new PinButton(0, on_key_));
+  auto* backspace = new PinButton(base::ASCIIToUTF16("x"), on_backspace_);
+  backspace->set_id(kBackspaceButtonId);
+  row->AddChildView(backspace);
+}
+
+LoginPinView::~LoginPinView() = default;
+
+const char* LoginPinView::GetClassName() const {
+  return kLoginPinViewClassName;
+}
+
+bool LoginPinView::OnKeyPressed(const ui::KeyEvent& event) {
+  // TODO: figure out what to do here.
+  if (event.key_code() == ui::KeyboardCode::VKEY_RETURN) {
+    // TODO: Real pin.
+    // on_submit_.Run(base::ASCIIToUTF16("1111"));
+    return true;
+  }
+
+  return false;
+}
+
+}  // namespace ash
\ No newline at end of file

diff --git a/ash/login/ui/login_pin_view.h b/ash/login/ui/login_pin_view.h
new file mode 100644
index 0000000..4c8c3d20
--- /dev/null
+++ b/ash/login/ui/login_pin_view.h

@@ -0,0 +1,79 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef ASH_LOGIN_UI_LOGIN_PIN_VIEW_H_
+#define ASH_LOGIN_UI_LOGIN_PIN_VIEW_H_
+
+#include "ash/ash_export.h"
+#include "base/callback.h"
+#include "base/macros.h"
+#include "ui/views/view.h"
+
+namespace ash {
+
+// Implements a PIN keyboard. The class emits high-level events that can be used
+// by the embedder. The PIN keyboard, while displaying letters, only emits
+// numbers.
+//
+// The UI looks a little like this:
+//    _______    _______    _______
+//   |   1   |  |   2   |  |   3   |
+//   |       |  | A B C |  | D E F |
+//    -------    -------    -------
+//    _______    _______    _______
+//   |   1   |  |   2   |  |   3   |
+//   | G H I |  | J K L |  | M N O |
+//    -------    -------    -------
+//    _______    _______    _______
+//   |   1   |  |   2   |  |   3   |
+//   |P Q R S|  | T U V |  |W X Y Z|
+//    -------    -------    -------
+//               _______    _______
+//              |   0   |  |  <-   |
+//              |   +   |  |       |
+//               -------    -------
+//
+class ASH_EXPORT LoginPinView : public views::View {
+ public:
+  // Spacing between each pin button.
+  static const int kButtonSeparatorSizeDp;
+  // Size of each button.
+  static const int kButtonSizeDp;
+
+  class ASH_EXPORT TestApi {
+   public:
+    explicit TestApi(LoginPinView* view);
+    ~TestApi();
+
+    views::View* GetButton(int number) const;
+    views::View* GetBackspaceButton() const;
+
+   private:
+    LoginPinView* const view_;
+  };
+
+  using OnPinKey = base::RepeatingCallback<void(int value)>;
+  using OnPinBackspace = base::RepeatingClosure;
+
+  // |on_key| is called whenever the user taps one of the pin buttons.
+  // |on_backspace| is called when the user wants to erase the most recently
+  // tapped key. Neither callback can be null.
+  explicit LoginPinView(const OnPinKey& on_key,
+                        const OnPinBackspace& on_backspace);
+  ~LoginPinView() override;
+
+  // views::View:
+  const char* GetClassName() const override;
+  bool OnKeyPressed(const ui::KeyEvent& event) override;
+
+ private:
+  OnPinKey on_key_;
+  OnPinBackspace on_backspace_;
+
+  DISALLOW_COPY_AND_ASSIGN(LoginPinView);
+};
+
+}  // namespace ash
+
+#endif  // ASH_LOGIN_UI_LOGIN_PIN_VIEW_H_

diff --git a/ash/login/ui/login_pin_view_unittest.cc b/ash/login/ui/login_pin_view_unittest.cc
new file mode 100644
index 0000000..2c17d29
--- /dev/null
+++ b/ash/login/ui/login_pin_view_unittest.cc

@@ -0,0 +1,118 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ash/login/ui/login_password_view.h"
+
+#include "ash/login/ui/login_pin_view.h"
+#include "ash/login/ui/login_test_base.h"
+#include "ui/events/test/event_generator.h"
+
+namespace ash {
+
+namespace {
+
+class LoginPinViewTest : public LoginTestBase {
+ protected:
+  LoginPinViewTest() = default;
+  ~LoginPinViewTest() override = default;
+
+  // LoginScreenTest:
+  void SetUp() override {
+    LoginTestBase::SetUp();
+
+    view_ = new LoginPinView(
+        base::Bind(&LoginPinViewTest::OnPinKey, base::Unretained(this)),
+        base::Bind(&LoginPinViewTest::OnPinBackspace, base::Unretained(this)));
+
+    ShowWidgetWithContent(view_);
+  }
+
+  // Called when a password is submitted.
+  void OnPinKey(int value) { value_ = value; }
+  void OnPinBackspace() { backspace_ = true; }
+
+  LoginPinView* view_ = nullptr;  // Owned by test widget view hierarchy.
+  base::Optional<int> value_;
+  bool backspace_ = false;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(LoginPinViewTest);
+};
+
+}  // namespace
+
+// Verifies that PIN submit works with 'Enter'.
+TEST_F(LoginPinViewTest, ButtonsFireEvents) {
+  ui::test::EventGenerator& generator = GetEventGenerator();
+  LoginPinView::TestApi test_api(view_);
+
+  // Verify pin button events are emitted with the correct value.
+  for (int i = 0; i <= 9; ++i) {
+    test_api.GetButton(i)->RequestFocus();
+    generator.PressKey(ui::KeyboardCode::VKEY_RETURN, ui::EF_NONE);
+    EXPECT_TRUE(value_.has_value());
+    EXPECT_EQ(*value_, i);
+    value_.reset();
+  }
+
+  // Verify backspace events are emitted.
+  EXPECT_FALSE(backspace_);
+  test_api.GetBackspaceButton()->RequestFocus();
+  generator.PressKey(ui::KeyboardCode::VKEY_RETURN, ui::EF_NONE);
+  EXPECT_TRUE(backspace_);
+}
+
+// Validates buttons have the correct spacing.
+TEST_F(LoginPinViewTest, ButtonSpacingAndSize) {
+  LoginPinView::TestApi test_api(view_);
+
+  // Validate pin button size.
+  for (int i = 0; i <= 9; ++i) {
+    DCHECK_EQ(test_api.GetButton(i)->size().width(),
+              LoginPinView::kButtonSizeDp);
+    DCHECK_EQ(test_api.GetButton(i)->size().height(),
+              LoginPinView::kButtonSizeDp);
+  }
+
+  // Validate backspace button size.
+  DCHECK_EQ(test_api.GetBackspaceButton()->size().width(),
+            LoginPinView::kButtonSizeDp);
+  DCHECK_EQ(test_api.GetBackspaceButton()->size().height(),
+            LoginPinView::kButtonSizeDp);
+
+  // Record all the x/y coordinates of the buttons.
+  std::set<int> seen_x;
+  std::set<int> seen_y;
+  for (int i = 0; i <= 9; ++i) {
+    gfx::Rect screen_bounds = test_api.GetButton(i)->GetBoundsInScreen();
+    seen_x.insert(screen_bounds.x());
+    seen_y.insert(screen_bounds.y());
+  }
+  seen_x.insert(test_api.GetBackspaceButton()->GetBoundsInScreen().x());
+  seen_y.insert(test_api.GetBackspaceButton()->GetBoundsInScreen().y());
+
+  // Sort the coordinates so we can easily check the distance between them.
+  std::vector<int> sorted_x(seen_x.begin(), seen_x.end());
+  std::vector<int> sorted_y(seen_y.begin(), seen_y.end());
+  std::sort(sorted_x.begin(), sorted_x.end());
+  std::sort(sorted_y.begin(), sorted_y.end());
+
+  // Validate each x or y coordinate has the correct distance between it and the
+  // next one. This is correct because we have already validated button size.
+  EXPECT_EQ(3u, sorted_x.size());
+  for (size_t i = 0; i < sorted_x.size() - 1; ++i) {
+    EXPECT_EQ(sorted_x[i] + LoginPinView::kButtonSizeDp +
+                  LoginPinView::kButtonSeparatorSizeDp,
+              sorted_x[i + 1]);
+  }
+
+  EXPECT_EQ(4u, sorted_y.size());
+  for (size_t i = 0; i < sorted_y.size() - 1; ++i) {
+    EXPECT_EQ(sorted_y[i] + LoginPinView::kButtonSizeDp +
+                  LoginPinView::kButtonSeparatorSizeDp,
+              sorted_y[i + 1]);
+  }
+}
+
+}  // namespace ash
\ No newline at end of file

diff --git a/ash/mus/window_manager.cc b/ash/mus/window_manager.cc
index c2f1501..f05fd39 100644
--- a/ash/mus/window_manager.cc
+++ b/ash/mus/window_manager.cc

@@ -34,7 +34,6 @@
 #include "ash/wm/container_finder.h"
 #include "ash/wm/window_state.h"
 #include "base/memory/ptr_util.h"
-#include "base/threading/sequenced_worker_pool.h"
 #include "services/service_manager/public/cpp/connector.h"
 #include "services/ui/common/accelerator_util.h"
 #include "services/ui/common/types.h"
@@ -111,14 +110,12 @@
 
 void WindowManager::Init(
     std::unique_ptr<aura::WindowTreeClient> window_tree_client,
-    const scoped_refptr<base::SequencedWorkerPool>& blocking_pool,
     std::unique_ptr<ShellDelegate> shell_delegate) {
   // Only create InputDeviceClient in MASH mode. For MUS mode WindowManager is
   // created by chrome, which creates InputDeviceClient.
   if (config_ == Config::MASH)
     input_device_client_ = base::MakeUnique<ui::InputDeviceClient>();
 
-  blocking_pool_ = blocking_pool;
   DCHECK(window_manager_client_);
   DCHECK(!window_tree_client_);
   window_tree_client_ = std::move(window_tree_client);
@@ -233,7 +230,6 @@
                                          : new ShellDelegateMus(connector_);
   init_params.primary_window_tree_host = window_tree_host.release();
   init_params.shell_port = shell_port;
-  init_params.blocking_pool = blocking_pool_.get();
   Shell::CreateInstance(init_params);
 }
 

diff --git a/ash/mus/window_manager.h b/ash/mus/window_manager.h
index ab1c560..2c3c5b3 100644
--- a/ash/mus/window_manager.h
+++ b/ash/mus/window_manager.h

@@ -17,17 +17,12 @@
 #include "ash/shell_delegate.h"
 #include "base/callback_forward.h"
 #include "base/macros.h"
-#include "base/memory/ref_counted.h"
 #include "services/ui/common/types.h"
 #include "services/ui/public/interfaces/display/display_controller.mojom.h"
 #include "services/ui/public/interfaces/window_manager.mojom.h"
 #include "ui/aura/mus/window_manager_delegate.h"
 #include "ui/aura/mus/window_tree_client_delegate.h"
 
-namespace base {
-class SequencedWorkerPool;
-}
-
 namespace display {
 class Display;
 }
@@ -78,7 +73,6 @@
   ~WindowManager() override;
 
   void Init(std::unique_ptr<aura::WindowTreeClient> window_tree_client,
-            const scoped_refptr<base::SequencedWorkerPool>& blocking_pool,
             std::unique_ptr<ash::ShellDelegate> shell_delegate = nullptr);
 
   // Sets the callback that is run once the connection to mus is lost. If not
@@ -231,8 +225,6 @@
   std::map<uint16_t, AcceleratorHandler*> accelerator_handlers_;
   uint16_t next_accelerator_namespace_id_ = 0u;
 
-  scoped_refptr<base::SequencedWorkerPool> blocking_pool_;
-
   // The ShellDelegate to install. This may be null, in which case
   // ShellDelegateMus is used.
   std::unique_ptr<ShellDelegate> shell_delegate_;

diff --git a/ash/mus/window_manager_application.cc b/ash/mus/window_manager_application.cc
index b2148bf..5ab8e75 100644
--- a/ash/mus/window_manager_application.cc
+++ b/ash/mus/window_manager_application.cc

@@ -55,15 +55,6 @@
   // OnWillDestroyRootWindowController() is called (if it hasn't been already).
   window_manager_.reset();
 
-  if (blocking_pool_) {
-    // Like BrowserThreadImpl, the goal is to make it impossible for ash to
-    // 'infinite loop' during shutdown, but to reasonably expect that all
-    // BLOCKING_SHUTDOWN tasks queued during shutdown get run. There's nothing
-    // particularly scientific about the number chosen.
-    const int kMaxNewShutdownBlockingTasks = 1000;
-    blocking_pool_->Shutdown(kMaxNewShutdownBlockingTasks);
-  }
-
   statistics_provider_.reset();
   ShutdownComponents();
 }
@@ -74,7 +65,6 @@
 
 void WindowManagerApplication::InitWindowManager(
     std::unique_ptr<aura::WindowTreeClient> window_tree_client,
-    const scoped_refptr<base::SequencedWorkerPool>& blocking_pool,
     bool init_network_handler) {
   // Tests may have already set the WindowTreeClient.
   if (!aura::Env::GetInstance()->HasWindowTreeClient())
@@ -89,7 +79,7 @@
   statistics_provider_->SetMachineStatistic("initial_locale", "en-US");
   statistics_provider_->SetMachineStatistic("keyboard_layout", "");
 
-  window_manager_->Init(std::move(window_tree_client), blocking_pool,
+  window_manager_->Init(std::move(window_tree_client),
                         std::move(shell_delegate_));
 }
 
@@ -155,13 +145,8 @@
   window_tree_client->ConnectAsWindowManager(
       automatically_create_display_roots);
 
-  const size_t kMaxNumberThreads = 3u;  // Matches that of content.
-  const char kThreadNamePrefix[] = "MashBlocking";
-  blocking_pool_ = new base::SequencedWorkerPool(
-      kMaxNumberThreads, kThreadNamePrefix, base::TaskPriority::USER_VISIBLE);
   const bool init_network_handler = true;
-  InitWindowManager(std::move(window_tree_client), blocking_pool_,
-                    init_network_handler);
+  InitWindowManager(std::move(window_tree_client), init_network_handler);
 }
 
 void WindowManagerApplication::OnBindInterface(

diff --git a/ash/mus/window_manager_application.h b/ash/mus/window_manager_application.h
index c9f45656..ca8a6b7 100644
--- a/ash/mus/window_manager_application.h
+++ b/ash/mus/window_manager_application.h

@@ -14,7 +14,6 @@
 #include "ash/public/interfaces/wallpaper.mojom.h"
 #include "ash/shell_delegate.h"
 #include "base/macros.h"
-#include "base/memory/ref_counted.h"
 #include "mojo/public/cpp/bindings/binding.h"
 #include "services/service_manager/public/cpp/binder_registry.h"
 #include "services/service_manager/public/cpp/service.h"
@@ -24,10 +23,6 @@
 class WindowTreeClient;
 }
 
-namespace base {
-class SequencedWorkerPool;
-}
-
 namespace chromeos {
 namespace system {
 class ScopedFakeStatisticsProvider;
@@ -74,7 +69,6 @@
   // If |init_network_handler| is true, chromeos::NetworkHandler is initialized.
   void InitWindowManager(
       std::unique_ptr<aura::WindowTreeClient> window_tree_client,
-      const scoped_refptr<base::SequencedWorkerPool>& blocking_pool,
       bool init_network_handler);
 
   // Initializes lower-level OS-specific components (e.g. D-Bus services).
@@ -93,9 +87,6 @@
 
   std::unique_ptr<WindowManager> window_manager_;
 
-  // A blocking pool used by the WindowManager's shell; not used in tests.
-  scoped_refptr<base::SequencedWorkerPool> blocking_pool_;
-
   std::unique_ptr<NetworkConnectDelegateMus> network_connect_delegate_;
   std::unique_ptr<chromeos::system::ScopedFakeStatisticsProvider>
       statistics_provider_;

diff --git a/ash/shell.cc b/ash/shell.cc
index f12e6f4..fdc5bff 100644
--- a/ash/shell.cc
+++ b/ash/shell.cc

@@ -816,8 +816,6 @@
         base::MakeUnique<NightLightController>(session_controller_.get());
   }
 
-  blocking_pool_ = init_params.blocking_pool;
-
   wallpaper_delegate_ = shell_delegate_->CreateWallpaperDelegate();
 
   // Can be null in tests.
@@ -918,8 +916,8 @@
             : 0);
     display_initialized = true;
   }
-  display_color_manager_.reset(new DisplayColorManager(
-      display_configurator_.get(), init_params.blocking_pool));
+  display_color_manager_ =
+      base::MakeUnique<DisplayColorManager>(display_configurator_.get());
 
   if (!display_initialized)
     display_manager_->InitDefaultDisplay();

diff --git a/ash/shell.h b/ash/shell.h
index 08bb804c..749e17e 100644
--- a/ash/shell.h
+++ b/ash/shell.h

@@ -39,10 +39,6 @@
 class WindowTreeClient;
 }
 
-namespace base {
-class SequencedWorkerPool;
-}
-
 namespace chromeos {
 class AudioA11yController;
 }
@@ -833,8 +829,6 @@
 
   base::ObserverList<ShellObserver> shell_observers_;
 
-  scoped_refptr<base::SequencedWorkerPool> blocking_pool_;
-
   DISALLOW_COPY_AND_ASSIGN(Shell);
 };
 

diff --git a/ash/shell/content/client/shell_browser_main_parts.cc b/ash/shell/content/client/shell_browser_main_parts.cc
index e3ec2f4..fae6a9f 100644
--- a/ash/shell/content/client/shell_browser_main_parts.cc
+++ b/ash/shell/content/client/shell_browser_main_parts.cc

@@ -24,7 +24,6 @@
 #include "base/threading/thread_restrictions.h"
 #include "chromeos/audio/cras_audio_handler.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
-#include "content/public/browser/browser_thread.h"
 #include "content/public/browser/context_factory.h"
 #include "content/public/common/content_switches.h"
 #include "content/shell/browser/shell_browser_context.h"
@@ -130,7 +129,6 @@
   init_params.delegate = delegate_;
   init_params.context_factory = content::GetContextFactory();
   init_params.context_factory_private = content::GetContextFactoryPrivate();
-  init_params.blocking_pool = content::BrowserThread::GetBlockingPool();
   ash::Shell::CreateInstance(init_params);
 
   // Initialize session controller client and create fake user sessions. The

diff --git a/ash/shell_init_params.h b/ash/shell_init_params.h
index 1495d29..e69834c 100644
--- a/ash/shell_init_params.h
+++ b/ash/shell_init_params.h

@@ -11,10 +11,6 @@
 class WindowTreeHostMus;
 }
 
-namespace base {
-class SequencedWorkerPool;
-}
-
 namespace ui {
 class ContextFactory;
 class ContextFactoryPrivate;
@@ -36,7 +32,6 @@
   ShellDelegate* delegate = nullptr;
   ui::ContextFactory* context_factory = nullptr;
   ui::ContextFactoryPrivate* context_factory_private = nullptr;
-  base::SequencedWorkerPool* blocking_pool = nullptr;
 };
 
 }  // namespace ash

diff --git a/ash/system/night_light/night_light_controller.cc b/ash/system/night_light/night_light_controller.cc
index e5f68eaa..e84b5ce 100644
--- a/ash/system/night_light/night_light_controller.cc
+++ b/ash/system/night_light/night_light_controller.cc

@@ -110,8 +110,8 @@
 
 // static
 bool NightLightController::IsFeatureEnabled() {
-  return base::CommandLine::ForCurrentProcess()->HasSwitch(
-      ash::switches::kAshEnableNightLight);
+  return !base::CommandLine::ForCurrentProcess()->HasSwitch(
+      ash::switches::kAshDisableNightLight);
 }
 
 // static

diff --git a/ash/system/night_light/night_light_controller_unittest.cc b/ash/system/night_light/night_light_controller_unittest.cc
index 3745641..c3427a1f 100644
--- a/ash/system/night_light/night_light_controller_unittest.cc
+++ b/ash/system/night_light/night_light_controller_unittest.cc

@@ -7,7 +7,6 @@
 #include <cmath>
 #include <limits>
 
-#include "ash/ash_switches.h"
 #include "ash/public/cpp/ash_pref_names.h"
 #include "ash/public/cpp/config.h"
 #include "ash/public/cpp/session_types.h"
@@ -18,7 +17,6 @@
 #include "ash/test/test_shell_delegate.h"
 #include "base/bind.h"
 #include "base/callback_forward.h"
-#include "base/command_line.h"
 #include "base/macros.h"
 #include "components/prefs/testing_pref_service.h"
 #include "ui/compositor/layer.h"
@@ -127,10 +125,6 @@
 
   // ash::test::AshTestBase:
   void SetUp() override {
-    // Explicitly enable the NightLight feature for the tests.
-    base::CommandLine::ForCurrentProcess()->AppendSwitch(
-        ash::switches::kAshEnableNightLight);
-
     test::AshTestBase::SetUp();
     CreateTestUserSessions();
     Shell::RegisterPrefs(user1_pref_service_.registry());

diff --git a/ash/system/night_light/tray_night_light_unittest.cc b/ash/system/night_light/tray_night_light_unittest.cc
index 1491771c..3a8ca56 100644
--- a/ash/system/night_light/tray_night_light_unittest.cc
+++ b/ash/system/night_light/tray_night_light_unittest.cc

@@ -4,7 +4,6 @@
 
 #include "ash/system/night_light/tray_night_light.h"
 
-#include "ash/ash_switches.h"
 #include "ash/public/cpp/config.h"
 #include "ash/shell.h"
 #include "ash/system/night_light/night_light_controller.h"
@@ -12,7 +11,6 @@
 #include "ash/test/ash_test_base.h"
 #include "ash/test/ash_test_helper.h"
 #include "ash/test/test_shell_delegate.h"
-#include "base/command_line.h"
 #include "base/macros.h"
 #include "components/prefs/testing_pref_service.h"
 
@@ -29,10 +27,6 @@
 
   // ash::test::AshTestBase:
   void SetUp() override {
-    // Explicitly enable the NightLight feature for the tests.
-    base::CommandLine::ForCurrentProcess()->AppendSwitch(
-        ash::switches::kAshEnableNightLight);
-
     test::AshTestBase::SetUp();
     GetSessionControllerClient()->Reset();
     GetSessionControllerClient()->AddUserSession(kFakeUserEmail);

diff --git a/ash/system/tiles/tray_tiles_unittest.cc b/ash/system/tiles/tray_tiles_unittest.cc
index 6599f48..50a4920 100644
--- a/ash/system/tiles/tray_tiles_unittest.cc
+++ b/ash/system/tiles/tray_tiles_unittest.cc

@@ -4,14 +4,12 @@
 
 #include "ash/system/tiles/tray_tiles.h"
 
-#include "ash/ash_switches.h"
 #include "ash/system/night_light/night_light_controller.h"
 #include "ash/system/night_light/night_light_toggle_button.h"
 #include "ash/system/tiles/tiles_default_view.h"
 #include "ash/system/tray/system_menu_button.h"
 #include "ash/test/ash_test_base.h"
 #include "ash/test/test_session_controller_client.h"
-#include "base/command_line.h"
 #include "components/user_manager/user_type.h"
 #include "ui/views/view.h"
 
@@ -26,10 +24,6 @@
   ~TrayTilesTest() override {}
 
   void SetUp() override {
-    // Explicitly enable the NightLight feature for the tests.
-    base::CommandLine::ForCurrentProcess()->AppendSwitch(
-        ash::switches::kAshEnableNightLight);
-
     test::NoSessionAshTestBase::SetUp();
     tray_tiles_.reset(new TrayTiles(GetPrimarySystemTray()));
   }

diff --git a/ash/test/ash_test_environment.h b/ash/test/ash_test_environment.h
index 55b03c8..7f5621f 100644
--- a/ash/test/ash_test_environment.h
+++ b/ash/test/ash_test_environment.h

@@ -8,10 +8,6 @@
 #include <memory>
 #include <string>
 
-namespace base {
-class SequencedWorkerPool;
-}
-
 namespace ash {
 namespace test {
 
@@ -40,8 +36,6 @@
   virtual void SetUp() {}
   virtual void TearDown() {}
 
-  virtual base::SequencedWorkerPool* GetBlockingPool() = 0;
-
   virtual std::unique_ptr<AshTestViewsDelegate> CreateViewsDelegate() = 0;
 
  protected:

diff --git a/ash/test/ash_test_environment_content.cc b/ash/test/ash_test_environment_content.cc
index 6b48982..9e484a3a 100644
--- a/ash/test/ash_test_environment_content.cc
+++ b/ash/test/ash_test_environment_content.cc

@@ -7,7 +7,6 @@
 #include "ash/test/ash_test_views_delegate.h"
 #include "ash/test/content/test_shell_content_state.h"
 #include "base/memory/ptr_util.h"
-#include "content/public/browser/browser_thread.h"
 #include "content/public/test/test_browser_thread_bundle.h"
 #include "content/public/test/web_contents_tester.h"
 
@@ -62,10 +61,6 @@
   ShellContentState::DestroyInstance();
 }
 
-base::SequencedWorkerPool* AshTestEnvironmentContent::GetBlockingPool() {
-  return content::BrowserThread::GetBlockingPool();
-}
-
 std::unique_ptr<AshTestViewsDelegate>
 AshTestEnvironmentContent::CreateViewsDelegate() {
   return base::MakeUnique<AshTestViewsDelegateContent>();

diff --git a/ash/test/ash_test_environment_content.h b/ash/test/ash_test_environment_content.h
index 742444e..dc4ff6b6 100644
--- a/ash/test/ash_test_environment_content.h
+++ b/ash/test/ash_test_environment_content.h

@@ -36,7 +36,6 @@
   // AshTestEnvironment:
   void SetUp() override;
   void TearDown() override;
-  base::SequencedWorkerPool* GetBlockingPool() override;
   std::unique_ptr<AshTestViewsDelegate> CreateViewsDelegate() override;
 
  private:

diff --git a/ash/test/ash_test_environment_default.cc b/ash/test/ash_test_environment_default.cc
index 1d2ddb3b..225b6def 100644
--- a/ash/test/ash_test_environment_default.cc
+++ b/ash/test/ash_test_environment_default.cc

@@ -8,8 +8,6 @@
 #include "base/memory/ptr_util.h"
 #include "base/run_loop.h"
 #include "base/test/scoped_task_environment.h"
-#include "base/test/sequenced_worker_pool_owner.h"
-#include "base/threading/sequenced_worker_pool.h"
 
 namespace ash {
 namespace test {
@@ -23,27 +21,15 @@
 
   ~AshTestEnvironmentDefault() override {
     base::RunLoop().RunUntilIdle();
-    blocking_pool_owner_.reset();
-    base::RunLoop().RunUntilIdle();
   }
 
   // AshTestEnvironment:
-  base::SequencedWorkerPool* GetBlockingPool() override {
-    if (!blocking_pool_owner_) {
-      const size_t kMaxNumberThreads = 3u;  // Matches that of content.
-      const char kThreadNamePrefix[] = "AshBlocking";
-      blocking_pool_owner_ = base::MakeUnique<base::SequencedWorkerPoolOwner>(
-          kMaxNumberThreads, kThreadNamePrefix);
-    }
-    return blocking_pool_owner_->pool().get();
-  }
   std::unique_ptr<AshTestViewsDelegate> CreateViewsDelegate() override {
     return base::MakeUnique<AshTestViewsDelegate>();
   }
 
  private:
   base::test::ScopedTaskEnvironment scoped_task_environment_;
-  std::unique_ptr<base::SequencedWorkerPoolOwner> blocking_pool_owner_;
 
   DISALLOW_COPY_AND_ASSIGN(AshTestEnvironmentDefault);
 };

diff --git a/ash/test/ash_test_helper.cc b/ash/test/ash_test_helper.cc
index b5b6f5d..ba4fc787 100644
--- a/ash/test/ash_test_helper.cc
+++ b/ash/test/ash_test_helper.cc

@@ -342,8 +342,7 @@
   // additional tray items) that can make for flaky tests.
   const bool init_network_handler = false;
   window_manager_app_->InitWindowManager(
-      window_tree_client_setup_.OwnWindowTreeClient(),
-      ash_test_environment_->GetBlockingPool(), init_network_handler);
+      window_tree_client_setup_.OwnWindowTreeClient(), init_network_handler);
 
   aura::WindowTreeClient* window_tree_client =
       window_manager_app_->window_manager()->window_tree_client();
@@ -368,7 +367,6 @@
   init_params.delegate = test_shell_delegate_;
   init_params.context_factory = context_factory;
   init_params.context_factory_private = context_factory_private;
-  init_params.blocking_pool = ash_test_environment_->GetBlockingPool();
   Shell::CreateInstance(init_params);
 }
 

diff --git a/base/trace_event/memory_infra_background_whitelist.cc b/base/trace_event/memory_infra_background_whitelist.cc
index a6685f92..576f0a0 100644
--- a/base/trace_event/memory_infra_background_whitelist.cc
+++ b/base/trace_event/memory_infra_background_whitelist.cc

@@ -26,9 +26,11 @@
     "JavaHeap",
     "LevelDB",
     "LeveldbValueStore",
+    "LocalStorage",
     "Malloc",
     "MemoryCache",
     "MojoHandleTable",
+    "MojoLevelDB",
     "PartitionAlloc",
     "ProcessMemoryMetrics",
     "Skia",
@@ -55,11 +57,14 @@
     "discardable",
     "discardable/child_0x?",
     "dom_storage/0x?/cache_size",
+    "dom_storage/localstorage_0x?/cache_size",
+    "dom_storage/localstorage_0x?/leveldb",
     "dom_storage/session_storage_0x?",
     "java_heap",
     "java_heap/allocated_objects",
     "leveldb/index_db/0x?",
     "leveldb/leveldb_proto/0x?",
+    "leveldb/mojo/0x?",
     "leveldb/value_store/Extensions.Database.Open.Settings/0x?",
     "leveldb/value_store/Extensions.Database.Open.Rules/0x?",
     "leveldb/value_store/Extensions.Database.Open.State/0x?",

diff --git a/build/fuchsia/test_runner.py b/build/fuchsia/test_runner.py
index 4d84acf4..168f513 100755
--- a/build/fuchsia/test_runner.py
+++ b/build/fuchsia/test_runner.py

@@ -133,6 +133,11 @@
   autorun_file.write('#!/bin/sh\n')
   autorun_file.write('/system/' + os.path.basename(test_name))
   autorun_file.write(' --test-launcher-retry-limit=0')
+  if int(os.environ.get('CHROME_HEADLESS', 0)) != 0:
+    # When running on bots (without KVM) execution is quite slow. The test
+    # launcher times out a subprocess after 45s which can be too short. Make the
+    # timeout 10x longer.
+    autorun_file.write(' --test-launcher-timeout=450000')
   if test_launcher_filter_file:
     test_launcher_filter_file = os.path.normpath(
             os.path.join(output_directory, test_launcher_filter_file))

diff --git a/build/toolchain/toolchain.gni b/build/toolchain/toolchain.gni
index 70e0fa9..63ecdbd 100644
--- a/build/toolchain/toolchain.gni
+++ b/build/toolchain/toolchain.gni

@@ -16,12 +16,14 @@
   allow_posix_link_time_opt =
       is_clang && target_os == "linux" && !is_chromeos && target_cpu == "x64" &&
       is_official_build
+}
 
-  # If used with allow_posix_link_time_opt, it enables the experimental support
-  # of ThinLTO that links 3x-10x faster but (as of now) does not have all the
-  # important optimizations such us devirtualization implemented. See also
+declare_args() {
+  # If used with allow_posix_link_time_opt, it enables support for ThinLTO,
+  # which links 3x-10x faster than full LTO. See also
   # http://blog.llvm.org/2016/06/thinlto-scalable-and-incremental-lto.html
-  use_thin_lto = false
+  use_thin_lto = allow_posix_link_time_opt && target_os == "linux" &&
+                 !is_chromeos && target_cpu == "x64"
 
   # If this is set to true, or if LLVM_FORCE_HEAD_REVISION is set to 1
   # in the environment, we use the revision in the llvm repo to determine

diff --git a/cc/output/gl_renderer.cc b/cc/output/gl_renderer.cc
index 8e36f02..a1d5a33 100644
--- a/cc/output/gl_renderer.cc
+++ b/cc/output/gl_renderer.cc

@@ -561,6 +561,8 @@
 
   // TODO(enne): Do we need to reinitialize all of this state per frame?
   ReinitializeGLState();
+
+  num_triangles_drawn_ = 0;
 }
 
 void GLRenderer::DoDrawQuad(const DrawQuad* quad,
@@ -1811,6 +1813,7 @@
     SetShaderMatrix(current_frame()->projection_matrix *
                     quad->shared_quad_state->quad_to_target_transform);
     gl_->DrawElements(GL_TRIANGLES, 6, GL_UNSIGNED_SHORT, 0);
+    num_triangles_drawn_ += 2;
   }
 }
 
@@ -2052,6 +2055,7 @@
                   quad->shared_quad_state->quad_to_target_transform);
 
   gl_->DrawElements(GL_TRIANGLES, 6, GL_UNSIGNED_SHORT, 0);
+  num_triangles_drawn_ += 2;
 }
 
 void GLRenderer::DrawYUVVideoQuad(const YUVVideoDrawQuad* quad,
@@ -2318,6 +2322,7 @@
   gl_->DrawElements(GL_TRIANGLES,
                     6 * static_cast<int>(draw_cache_.matrix_data.size()),
                     GL_UNSIGNED_SHORT, 0);
+  num_triangles_drawn_ += 2 * static_cast<int>(draw_cache_.matrix_data.size());
 
   // Draw the border if requested.
   if (gl_composited_texture_quad_border_) {
@@ -2475,6 +2480,9 @@
   ScheduleCALayers();
   ScheduleDCLayers();
   ScheduleOverlays();
+
+  TRACE_COUNTER1(TRACE_DISABLED_BY_DEFAULT("cc.debug.triangles"),
+                 "Triangles Drawn", num_triangles_drawn_);
 }
 
 void GLRenderer::FinishDrawingQuadList() {
@@ -2606,6 +2614,7 @@
 
   gl_->DrawElements(GL_TRIANGLES, 6, GL_UNSIGNED_SHORT,
                     reinterpret_cast<const void*>(0));
+  num_triangles_drawn_ += 2;
 }
 
 void GLRenderer::DrawQuadGeometry(const gfx::Transform& projection_matrix,
@@ -2617,6 +2626,7 @@
   SetShaderMatrix(projection_matrix * quad_rect_matrix);
 
   gl_->DrawElements(GL_TRIANGLES, 6, GL_UNSIGNED_SHORT, 0);
+  num_triangles_drawn_ += 2;
 }
 
 void GLRenderer::SwapBuffers(std::vector<ui::LatencyInfo> latency_info) {

diff --git a/cc/output/gl_renderer.h b/cc/output/gl_renderer.h
index e00b475f..ca853e3 100644
--- a/cc/output/gl_renderer.h
+++ b/cc/output/gl_renderer.h

@@ -364,6 +364,8 @@
   unsigned offscreen_stencil_renderbuffer_id_ = 0;
   gfx::Size offscreen_stencil_renderbuffer_size_;
 
+  unsigned num_triangles_drawn_ = 0;
+
   base::WeakPtrFactory<GLRenderer> weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(GLRenderer);

diff --git a/cc/paint/display_item_list.cc b/cc/paint/display_item_list.cc
index 1e4b6c0..8714fb5 100644
--- a/cc/paint/display_item_list.cc
+++ b/cc/paint/display_item_list.cc

@@ -39,7 +39,10 @@
 
 }  // namespace
 
-DisplayItemList::DisplayItemList() = default;
+DisplayItemList::DisplayItemList() {
+  visual_rects_.reserve(1024);
+  begin_paired_indices_.reserve(32);
+}
 
 DisplayItemList::~DisplayItemList() = default;
 
@@ -50,16 +53,13 @@
     return;
 
   std::vector<size_t> indices = rtree_.Search(canvas_playback_rect);
-  if (!indices.empty()) {
-    paint_op_buffer_.PlaybackRanges(visual_rects_range_starts_, indices, canvas,
-                                    callback);
-  }
+  paint_op_buffer_.Playback(canvas, callback, &indices);
 }
 
 void DisplayItemList::GrowCurrentBeginItemVisualRect(
     const gfx::Rect& visual_rect) {
   if (!begin_paired_indices_.empty())
-    visual_rects_[begin_paired_indices_.back()].Union(visual_rect);
+    visual_rects_[begin_paired_indices_.back().first].Union(visual_rect);
 }
 
 void DisplayItemList::Finalize() {
@@ -74,9 +74,9 @@
   rtree_.Build(visual_rects_);
 
   if (!retain_visual_rects_)
-    // This clears both the vector and the vector's capacity, since
-    // visual_rects won't be used anymore.
-    std::vector<gfx::Rect>().swap(visual_rects_);
+    visual_rects_.clear();
+  visual_rects_.shrink_to_fit();
+  begin_paired_indices_.shrink_to_fit();
 }
 
 size_t DisplayItemList::BytesUsed() const {
@@ -109,15 +109,10 @@
   if (include_items) {
     state->BeginArray("items");
 
-    DCHECK_EQ(visual_rects_.size(), visual_rects_range_starts_.size());
-    for (size_t i = 0; i < visual_rects_range_starts_.size(); ++i) {
-      size_t range_start = visual_rects_range_starts_[i];
+    for (size_t i = 0; i < paint_op_buffer_.size(); ++i) {
       gfx::Rect visual_rect = visual_rects_[i];
 
       state->BeginDictionary();
-      state->SetString("name", "PaintOpBufferRange");
-      state->SetInteger("rangeStart", base::saturated_cast<int>(range_start));
-
       state->BeginArray("visualRect");
       state->AppendInteger(visual_rect.x());
       state->AppendInteger(visual_rect.y());
@@ -125,16 +120,11 @@
       state->AppendInteger(visual_rect.height());
       state->EndArray();
 
-      // The RTree bounds are expanded a bunch so that when we look at the items
-      // in traces we can see if they are having an impact outside the visual
-      // rect which would be wrong.
-      gfx::Rect expanded_rect = rtree_.GetBounds();
-      expanded_rect.Inset(-1000, -1000);
-
       SkPictureRecorder recorder;
       SkCanvas* canvas =
-          recorder.beginRecording(gfx::RectToSkRect(expanded_rect));
-      paint_op_buffer_.PlaybackRanges(visual_rects_range_starts_, {i}, canvas);
+          recorder.beginRecording(gfx::RectToSkRect(rtree_.GetBounds()));
+      std::vector<size_t> indices{i};
+      paint_op_buffer_.Playback(canvas, nullptr, &indices);
       sk_sp<SkPicture> picture = recorder.finishRecordingAsPicture();
 
       std::string b64_picture;
@@ -162,7 +152,6 @@
     PictureDebugUtil::SerializeAsBase64(picture.get(), &b64_picture);
     state->SetString("skp64", b64_picture);
   }
-
   return state;
 }
 
@@ -204,7 +193,6 @@
   image_map_.Reset();
   paint_op_buffer_.Reset();
   visual_rects_.clear();
-  visual_rects_range_starts_.clear();
   begin_paired_indices_.clear();
   current_range_start_ = 0;
   in_paired_begin_count_ = 0;

diff --git a/cc/paint/display_item_list.h b/cc/paint/display_item_list.h
index f74456e..a115c90 100644
--- a/cc/paint/display_item_list.h
+++ b/cc/paint/display_item_list.h

@@ -45,26 +45,28 @@
   PaintOpBuffer* StartPaint() {
     DCHECK(!in_painting_);
     in_painting_ = true;
-    current_range_start_ = paint_op_buffer_.size();
     return &paint_op_buffer_;
   }
 
   void EndPaintOfUnpaired(const gfx::Rect& visual_rect) {
-    if (paint_op_buffer_.size() != current_range_start_) {
-      visual_rects_.push_back(visual_rect);
-      visual_rects_range_starts_.push_back(current_range_start_);
-      GrowCurrentBeginItemVisualRect(visual_rect);
-    }
-
     in_painting_ = false;
+
+    // Empty paint item.
+    if (visual_rects_.size() == paint_op_buffer_.size())
+      return;
+
+    while (visual_rects_.size() < paint_op_buffer_.size())
+      visual_rects_.push_back(visual_rect);
+    GrowCurrentBeginItemVisualRect(visual_rect);
   }
 
   void EndPaintOfPairedBegin(const gfx::Rect& visual_rect = gfx::Rect()) {
-    DCHECK_NE(current_range_start_, paint_op_buffer_.size());
-    size_t visual_rect_index = visual_rects_.size();
-    visual_rects_.push_back(visual_rect);
-    visual_rects_range_starts_.push_back(current_range_start_);
-    begin_paired_indices_.push_back(visual_rect_index);
+    DCHECK_NE(visual_rects_.size(), paint_op_buffer_.size());
+    size_t count = paint_op_buffer_.size() - visual_rects_.size();
+    for (size_t i = 0; i < count; ++i)
+      visual_rects_.push_back(visual_rect);
+    begin_paired_indices_.push_back(
+        std::make_pair(visual_rects_.size() - 1, count));
 
     in_painting_ = false;
     in_paired_begin_count_++;
@@ -74,15 +76,29 @@
     DCHECK_NE(current_range_start_, paint_op_buffer_.size());
     DCHECK(in_paired_begin_count_);
 
-    // Copy the visual rect of the matching kPairStart.
-    size_t last_begin_index = begin_paired_indices_.back();
+    size_t last_begin_index = begin_paired_indices_.back().first;
+    size_t last_begin_count = begin_paired_indices_.back().second;
+    DCHECK_GT(last_begin_count, 0u);
+    DCHECK_GE(last_begin_index, last_begin_count - 1);
+
+    // Copy the visual rect at |last_begin_index| to all indices that constitute
+    // the begin item. Note that because we possibly reallocate the
+    // |visual_rects_| buffer below, we need an actual copy instead of a const
+    // reference which can become dangling.
+    auto visual_rect = visual_rects_[last_begin_index];
+    for (size_t i = last_begin_index - last_begin_count + 1;
+         i < last_begin_index; ++i) {
+      visual_rects_[i] = visual_rect;
+    }
     begin_paired_indices_.pop_back();
-    visual_rects_.push_back(visual_rects_[last_begin_index]);
-    visual_rects_range_starts_.push_back(current_range_start_);
+
+    // Copy the visual rect of the matching begin item to the end item(s).
+    while (visual_rects_.size() < paint_op_buffer_.size())
+      visual_rects_.push_back(visual_rect);
 
     // The block that ended needs to be included in the bounds of the enclosing
     // block.
-    GrowCurrentBeginItemVisualRect(visual_rects_[last_begin_index]);
+    GrowCurrentBeginItemVisualRect(visual_rect);
 
     in_painting_ = false;
     in_paired_begin_count_--;
@@ -93,9 +109,6 @@
 
   int NumSlowPaths() const { return paint_op_buffer_.numSlowPaths(); }
 
-  // This gives the number of visual rect ranges, which is the number of
-  // discrete sets of PaintOps which could be rastered from.
-  size_t size() const { return visual_rects_range_starts_.size(); }
   // This gives the total number of PaintOps.
   size_t op_count() const { return paint_op_buffer_.size(); }
   size_t BytesUsed() const;
@@ -149,17 +162,14 @@
   PaintOpBuffer paint_op_buffer_;
 
   // The visual rects associated with each of the display items in the
-  // display item list. There is one rect per range in
-  // visual_rects_range_starts_. These rects are intentionally kept separate
-  // because they are used to decide which ops to walk for raster.
+  // display item list. These rects are intentionally kept separate because they
+  // are used to decide which ops to walk for raster.
   std::vector<gfx::Rect> visual_rects_;
-  // For each Rect in visual_rects_, this is the start of the range of
-  // PaintOps in the PaintOpBuffer that the Rect describes. The range ends
-  // at the start of the next index in the array.
-  std::vector<size_t> visual_rects_range_starts_;
-  // A stack of indices into the |visual_rects_| for each paired begin range
-  // that hasn't been closed.
-  std::vector<size_t> begin_paired_indices_;
+  // A stack of pairs of indices and counts. The indices are into the
+  // |visual_rects_| for each paired begin range that hasn't been closed. The
+  // counts refer to the number of visual rects in that begin sequence that end
+  // with the index.
+  std::vector<std::pair<size_t, size_t>> begin_paired_indices_;
   // While recording a range of ops, this is the position in the PaintOpBuffer
   // where the recording started.
   size_t current_range_start_ = 0;

diff --git a/cc/paint/display_item_list_unittest.cc b/cc/paint/display_item_list_unittest.cc
index 7d71786d..6250247 100644
--- a/cc/paint/display_item_list_unittest.cc
+++ b/cc/paint/display_item_list_unittest.cc

@@ -115,9 +115,8 @@
     list->StartPaint();
     list->EndPaintOfUnpaired(layer_rect);
   }
-  // No ops, no visual rect.
+  // No ops.
   EXPECT_EQ(0u, list->op_count());
-  EXPECT_EQ(0u, list->size());
 
   {
     PaintOpBuffer* buffer = list->StartPaint();
@@ -127,8 +126,6 @@
   }
   // Two ops.
   EXPECT_EQ(2u, list->op_count());
-  // One visual rect.
-  EXPECT_EQ(1u, list->size());
 }
 
 TEST(DisplayItemListTest, ClipPairedRange) {
@@ -504,22 +501,14 @@
 
       // The items list has 3 things in it since we built 3 visual rects.
       ASSERT_TRUE(params_dict->GetList("items", &list));
-      EXPECT_EQ(3u, list->GetSize());
+      EXPECT_EQ(6u, list->GetSize());
 
-      // This is determined by the number of ops we pushed in each range above.
-      // Ex. we pushed 2 ops in the first range, so the 2nd range starts at 2.
-      size_t range_starts[] = {0, 2, 5};
-
-      for (int i = 0; i < 3; ++i) {
+      for (int i = 0; i < 6; ++i) {
         const base::DictionaryValue* item_dict;
         const base::ListValue* visual_rect_list;
 
         ASSERT_TRUE(list->GetDictionary(i, &item_dict));
 
-        // The first visual rect range starts at the beginning of the buffer.
-        EXPECT_TRUE(item_dict->GetDouble("rangeStart", &d) &&
-                    d == range_starts[i])
-            << d;
         // The SkPicture for each item exists.
         EXPECT_TRUE(
             item_dict->GetString("skp64", static_cast<std::string*>(nullptr)));
@@ -563,7 +552,6 @@
 
 TEST(DisplayItemListTest, SizeEmpty) {
   auto list = make_scoped_refptr(new DisplayItemList);
-  EXPECT_EQ(0u, list->size());
   EXPECT_EQ(0u, list->op_count());
 }
 
@@ -575,7 +563,6 @@
     buffer->push<DrawRectOp>(gfx::RectToSkRect(drawing_bounds), PaintFlags());
     list->EndPaintOfUnpaired(drawing_bounds);
   }
-  EXPECT_EQ(1u, list->size());
   EXPECT_EQ(1u, list->op_count());
 }
 
@@ -594,7 +581,6 @@
     buffer->push<RestoreOp>();
     list->EndPaintOfPairedEnd();
   }
-  EXPECT_EQ(2u, list->size());
   EXPECT_EQ(3u, list->op_count());
 }
 
@@ -610,7 +596,6 @@
     list->EndPaintOfUnpaired(drawing_bounds);
   }
 
-  EXPECT_EQ(1u, list->size());
   EXPECT_EQ(1u, list->op_count());
   EXPECT_RECT_EQ(drawing_bounds, list->VisualRectForTesting(0));
 }
@@ -634,10 +619,10 @@
     list->EndPaintOfPairedEnd();
   }
 
-  EXPECT_EQ(2u, list->size());
   EXPECT_EQ(3u, list->op_count());
   EXPECT_RECT_EQ(gfx::Rect(), list->VisualRectForTesting(0));
   EXPECT_RECT_EQ(gfx::Rect(), list->VisualRectForTesting(1));
+  EXPECT_RECT_EQ(gfx::Rect(), list->VisualRectForTesting(2));
 }
 
 TEST(DisplayItemListTest, AppendVisualRectEmptyBlockContainingEmptyBlock) {
@@ -671,12 +656,12 @@
     list->EndPaintOfPairedEnd();
   }
 
-  EXPECT_EQ(4u, list->size());
   EXPECT_EQ(5u, list->op_count());
   EXPECT_RECT_EQ(gfx::Rect(), list->VisualRectForTesting(0));
   EXPECT_RECT_EQ(gfx::Rect(), list->VisualRectForTesting(1));
   EXPECT_RECT_EQ(gfx::Rect(), list->VisualRectForTesting(2));
   EXPECT_RECT_EQ(gfx::Rect(), list->VisualRectForTesting(3));
+  EXPECT_RECT_EQ(gfx::Rect(), list->VisualRectForTesting(4));
 }
 
 TEST(DisplayItemListTest, AppendVisualRectBlockContainingDrawing) {
@@ -706,11 +691,11 @@
     list->EndPaintOfPairedEnd();
   }
 
-  EXPECT_EQ(3u, list->size());
   EXPECT_EQ(4u, list->op_count());
   EXPECT_RECT_EQ(drawing_bounds, list->VisualRectForTesting(0));
   EXPECT_RECT_EQ(drawing_bounds, list->VisualRectForTesting(1));
   EXPECT_RECT_EQ(drawing_bounds, list->VisualRectForTesting(2));
+  EXPECT_RECT_EQ(drawing_bounds, list->VisualRectForTesting(3));
 }
 
 TEST(DisplayItemListTest, AppendVisualRectBlockContainingEscapedDrawing) {
@@ -740,11 +725,11 @@
     list->EndPaintOfPairedEnd();
   }
 
-  EXPECT_EQ(3u, list->size());
   EXPECT_EQ(4u, list->op_count());
   EXPECT_RECT_EQ(drawing_bounds, list->VisualRectForTesting(0));
   EXPECT_RECT_EQ(drawing_bounds, list->VisualRectForTesting(1));
   EXPECT_RECT_EQ(drawing_bounds, list->VisualRectForTesting(2));
+  EXPECT_RECT_EQ(drawing_bounds, list->VisualRectForTesting(3));
 }
 
 TEST(DisplayItemListTest,
@@ -783,12 +768,12 @@
     list->EndPaintOfPairedEnd();
   }
 
-  EXPECT_EQ(4u, list->size());
   EXPECT_EQ(5u, list->op_count());
   EXPECT_RECT_EQ(drawing_a_bounds, list->VisualRectForTesting(0));
   EXPECT_RECT_EQ(drawing_b_bounds, list->VisualRectForTesting(1));
   EXPECT_RECT_EQ(drawing_b_bounds, list->VisualRectForTesting(2));
   EXPECT_RECT_EQ(drawing_b_bounds, list->VisualRectForTesting(3));
+  EXPECT_RECT_EQ(drawing_b_bounds, list->VisualRectForTesting(4));
 }
 
 TEST(DisplayItemListTest, AppendVisualRectTwoBlocksTwoDrawings) {
@@ -839,16 +824,17 @@
     list->EndPaintOfPairedEnd();
   }
 
-  EXPECT_EQ(6u, list->size());
   EXPECT_EQ(8u, list->op_count());
   gfx::Rect merged_drawing_bounds = gfx::Rect(drawing_a_bounds);
   merged_drawing_bounds.Union(drawing_b_bounds);
   EXPECT_RECT_EQ(merged_drawing_bounds, list->VisualRectForTesting(0));
-  EXPECT_RECT_EQ(drawing_a_bounds, list->VisualRectForTesting(1));
-  EXPECT_RECT_EQ(drawing_b_bounds, list->VisualRectForTesting(2));
+  EXPECT_RECT_EQ(merged_drawing_bounds, list->VisualRectForTesting(1));
+  EXPECT_RECT_EQ(drawing_a_bounds, list->VisualRectForTesting(2));
   EXPECT_RECT_EQ(drawing_b_bounds, list->VisualRectForTesting(3));
   EXPECT_RECT_EQ(drawing_b_bounds, list->VisualRectForTesting(4));
-  EXPECT_RECT_EQ(merged_drawing_bounds, list->VisualRectForTesting(5));
+  EXPECT_RECT_EQ(drawing_b_bounds, list->VisualRectForTesting(5));
+  EXPECT_RECT_EQ(drawing_b_bounds, list->VisualRectForTesting(6));
+  EXPECT_RECT_EQ(merged_drawing_bounds, list->VisualRectForTesting(7));
 }
 
 TEST(DisplayItemListTest,
@@ -901,16 +887,17 @@
     list->EndPaintOfPairedEnd();
   }
 
-  EXPECT_EQ(6u, list->size());
   EXPECT_EQ(8u, list->op_count());
   gfx::Rect merged_drawing_bounds = gfx::Rect(drawing_a_bounds);
   merged_drawing_bounds.Union(drawing_b_bounds);
   EXPECT_RECT_EQ(merged_drawing_bounds, list->VisualRectForTesting(0));
-  EXPECT_RECT_EQ(drawing_a_bounds, list->VisualRectForTesting(1));
-  EXPECT_RECT_EQ(drawing_b_bounds, list->VisualRectForTesting(2));
+  EXPECT_RECT_EQ(merged_drawing_bounds, list->VisualRectForTesting(1));
+  EXPECT_RECT_EQ(drawing_a_bounds, list->VisualRectForTesting(2));
   EXPECT_RECT_EQ(drawing_b_bounds, list->VisualRectForTesting(3));
   EXPECT_RECT_EQ(drawing_b_bounds, list->VisualRectForTesting(4));
-  EXPECT_RECT_EQ(merged_drawing_bounds, list->VisualRectForTesting(5));
+  EXPECT_RECT_EQ(drawing_b_bounds, list->VisualRectForTesting(5));
+  EXPECT_RECT_EQ(drawing_b_bounds, list->VisualRectForTesting(6));
+  EXPECT_RECT_EQ(merged_drawing_bounds, list->VisualRectForTesting(7));
 }
 
 TEST(DisplayItemListTest,
@@ -963,16 +950,17 @@
     list->EndPaintOfPairedEnd();
   }
 
-  EXPECT_EQ(6u, list->size());
   EXPECT_EQ(8u, list->op_count());
   gfx::Rect merged_drawing_bounds = gfx::Rect(drawing_a_bounds);
   merged_drawing_bounds.Union(drawing_b_bounds);
   EXPECT_RECT_EQ(merged_drawing_bounds, list->VisualRectForTesting(0));
-  EXPECT_RECT_EQ(drawing_a_bounds, list->VisualRectForTesting(1));
-  EXPECT_RECT_EQ(drawing_b_bounds, list->VisualRectForTesting(2));
+  EXPECT_RECT_EQ(merged_drawing_bounds, list->VisualRectForTesting(1));
+  EXPECT_RECT_EQ(drawing_a_bounds, list->VisualRectForTesting(2));
   EXPECT_RECT_EQ(drawing_b_bounds, list->VisualRectForTesting(3));
   EXPECT_RECT_EQ(drawing_b_bounds, list->VisualRectForTesting(4));
-  EXPECT_RECT_EQ(merged_drawing_bounds, list->VisualRectForTesting(5));
+  EXPECT_RECT_EQ(drawing_b_bounds, list->VisualRectForTesting(5));
+  EXPECT_RECT_EQ(drawing_b_bounds, list->VisualRectForTesting(6));
+  EXPECT_RECT_EQ(merged_drawing_bounds, list->VisualRectForTesting(7));
 }
 
 TEST(DisplayItemListTest,
@@ -1025,16 +1013,17 @@
     list->EndPaintOfPairedEnd();
   }
 
-  EXPECT_EQ(6u, list->size());
   EXPECT_EQ(8u, list->op_count());
   gfx::Rect merged_drawing_bounds = gfx::Rect(drawing_a_bounds);
   merged_drawing_bounds.Union(drawing_b_bounds);
   EXPECT_RECT_EQ(merged_drawing_bounds, list->VisualRectForTesting(0));
-  EXPECT_RECT_EQ(drawing_a_bounds, list->VisualRectForTesting(1));
-  EXPECT_RECT_EQ(drawing_b_bounds, list->VisualRectForTesting(2));
+  EXPECT_RECT_EQ(merged_drawing_bounds, list->VisualRectForTesting(1));
+  EXPECT_RECT_EQ(drawing_a_bounds, list->VisualRectForTesting(2));
   EXPECT_RECT_EQ(drawing_b_bounds, list->VisualRectForTesting(3));
   EXPECT_RECT_EQ(drawing_b_bounds, list->VisualRectForTesting(4));
-  EXPECT_RECT_EQ(merged_drawing_bounds, list->VisualRectForTesting(5));
+  EXPECT_RECT_EQ(drawing_b_bounds, list->VisualRectForTesting(5));
+  EXPECT_RECT_EQ(drawing_b_bounds, list->VisualRectForTesting(6));
+  EXPECT_RECT_EQ(merged_drawing_bounds, list->VisualRectForTesting(7));
 }
 
 }  // namespace cc

diff --git a/cc/paint/paint_op_buffer.cc b/cc/paint/paint_op_buffer.cc
index 5f08b50..c7daf0a 100644
--- a/cc/paint/paint_op_buffer.cc
+++ b/cc/paint/paint_op_buffer.cc

@@ -334,7 +334,7 @@
                           const SkMatrix& original_ctm) {
   // Don't use drawPicture here, as it adds an implicit clip.
   auto* op = static_cast<const DrawRecordOp*>(base_op);
-  op->record->playback(canvas);
+  op->record->Playback(canvas);
 }
 
 void DrawRectOp::RasterWithFlags(const PaintOpWithFlags* base_op,
@@ -600,57 +600,6 @@
   num_slow_paths_ = 0;
 }
 
-static const PaintOp* NextOp(const std::vector<size_t>& range_starts,
-                             const std::vector<size_t>& range_indices,
-                             base::StackVector<const PaintOp*, 3>* stack_ptr,
-                             PaintOpBuffer::Iterator* iter,
-                             size_t* range_index) {
-  auto& stack = *stack_ptr;
-  if (stack->size()) {
-    const PaintOp* op = stack->front();
-    // Shift paintops forward
-    stack->erase(stack->begin());
-    return op;
-  }
-  if (!*iter)
-    return nullptr;
-
-  const size_t active_range = range_indices[*range_index];
-  DCHECK_GE(iter->op_idx(), range_starts[active_range]);
-
-  // This grabs the PaintOp from the current iterator position, and advances it
-  // to the next position immediately. We'll see we reached the end of the
-  // buffer on the next call to this method.
-  const PaintOp* op = **iter;
-  ++*iter;
-
-  if (active_range + 1 == range_starts.size()) {
-    // In the last possible range, so let the iter go right to the end of the
-    // buffer.
-    return op;
-  }
-
-  const size_t range_end = range_starts[active_range + 1];
-  DCHECK_LE(iter->op_idx(), range_end);
-  if (iter->op_idx() < range_end) {
-    // Still inside the range, so let the iter be.
-    return op;
-  }
-
-  if (*range_index + 1 == range_indices.size()) {
-    // We're now past the last range that we want to iterate.
-    *iter = iter->end();
-    return op;
-  }
-
-  // Move to the next range.
-  ++(*range_index);
-  size_t next_range_start = range_starts[range_indices[*range_index]];
-  while (iter->op_idx() < next_range_start)
-    ++(*iter);
-  return op;
-}
-
 // When |op| is a nested PaintOpBuffer, this returns the PaintOp inside
 // that buffer if the buffer contains a single drawing op, otherwise it
 // returns null. This searches recursively if the PaintOpBuffer contains only
@@ -677,34 +626,13 @@
   return op;
 }
 
-void PaintOpBuffer::playback(SkCanvas* canvas,
-                             SkPicture::AbortCallback* callback) const {
-  static auto* zero = new std::vector<size_t>({0});
-  // Treats the entire PaintOpBuffer as a single range.
-  PlaybackRanges(*zero, *zero, canvas, callback);
-}
-
-void PaintOpBuffer::PlaybackRanges(const std::vector<size_t>& range_starts,
-                                   const std::vector<size_t>& range_indices,
-                                   SkCanvas* canvas,
-                                   SkPicture::AbortCallback* callback) const {
+void PaintOpBuffer::Playback(SkCanvas* canvas,
+                             SkPicture::AbortCallback* callback,
+                             const std::vector<size_t>* indices) const {
   if (!op_count_)
     return;
-
-#if DCHECK_IS_ON()
-  DCHECK(!range_starts.empty());   // Don't call this then.
-  DCHECK(!range_indices.empty());  // Don't call this then.
-  DCHECK_EQ(0u, range_starts[0]);
-  for (size_t i = 1; i < range_starts.size(); ++i) {
-    DCHECK_GT(range_starts[i], range_starts[i - 1]);
-    DCHECK_LT(range_starts[i], op_count_);
-  }
-  DCHECK_LT(range_indices[0], range_starts.size());
-  for (size_t i = 1; i < range_indices.size(); ++i) {
-    DCHECK_GT(range_indices[i], range_indices[i - 1]);
-    DCHECK_LT(range_indices[i], range_starts.size());
-  }
-#endif
+  if (indices && indices->empty())
+    return;
 
   // Prevent PaintOpBuffers from having side effects back into the canvas.
   SkAutoCanvasRestore save_restore(canvas, true);
@@ -718,16 +646,22 @@
 
   // FIFO queue of paint ops that have been peeked at.
   base::StackVector<const PaintOp*, 3> stack;
-
-  // The current offset into range_indices. range_indices[range_index] is the
-  // current offset into range_starts.
-  size_t range_index = 0;
-
-  Iterator iter(this);
-  while (iter.op_idx() < range_starts[range_indices[range_index]])
+  Iterator iter(this, indices);
+  auto next_op = [&stack, &iter]() -> const PaintOp* {
+    if (stack->size()) {
+      const PaintOp* op = stack->front();
+      // Shift paintops forward.
+      stack->erase(stack->begin());
+      return op;
+    }
+    if (!iter)
+      return nullptr;
+    const PaintOp* op = *iter;
     ++iter;
-  while (const PaintOp* op =
-             NextOp(range_starts, range_indices, &stack, &iter, &range_index)) {
+    return op;
+  };
+
+  while (const PaintOp* op = next_op()) {
     // Check if we should abort. This should happen at the start of loop since
     // there are a couple of raster branches below, and we need to ensure that
     // we do this check after every one of them.
@@ -739,8 +673,7 @@
     // TODO(enne): consider making this recursive?
     // TODO(enne): should we avoid this if the SaveLayerAlphaOp has bounds?
     if (op->GetType() == PaintOpType::SaveLayerAlpha) {
-      const PaintOp* second =
-          NextOp(range_starts, range_indices, &stack, &iter, &range_index);
+      const PaintOp* second = next_op();
       const PaintOp* third = nullptr;
       if (second) {
         if (second->GetType() == PaintOpType::Restore) {
@@ -753,8 +686,7 @@
         const PaintOp* draw_op = GetNestedSingleDrawingOp(second);
 
         if (draw_op) {
-          third =
-              NextOp(range_starts, range_indices, &stack, &iter, &range_index);
+          third = next_op();
           if (third && third->GetType() == PaintOpType::Restore) {
             auto* save_op = static_cast<const SaveLayerAlphaOp*>(op);
             draw_op->RasterWithAlpha(canvas, save_op->bounds, save_op->alpha);

diff --git a/cc/paint/paint_op_buffer.h b/cc/paint/paint_op_buffer.h
index abda0c6..465381a 100644
--- a/cc/paint/paint_op_buffer.h
+++ b/cc/paint/paint_op_buffer.h

@@ -766,32 +766,12 @@
 
   void Reset();
 
-  void playback(SkCanvas* canvas,
-                SkPicture::AbortCallback* callback = nullptr) const;
-  // This can be used to play back a subset of the PaintOpBuffer.
-  // The |range_starts| array is an increasing set of positions in the
-  // PaintOpBuffer that break the buffer up into arbitrary consecutive chunks
-  // that together cover the entire buffer. The first value in |range_starts|
-  // must be 0. Each value after defines the end of the previous range
-  // (exclusive) and the beginning of the next range (inclusive). The last value
-  // in the array defines the last range which includes all ops to the end of
-  // the buffer. For example, given a PaintOpBuffer with the following ops:
-  // { A, B, C, D, E, F, G, H, I }
-  // And a |range_starts| with the following values:
-  // { 0, 4, 5 }
-  // This defines the following ranges in PaintOpBuffer:
-  // { A, B, C, D }, { E }, { F, G, H, I }.
-  // The |range_indices| is an increasing set of indices into the |range_starts|
-  // array. This defines the set of ranges that will be played back.
-  // Given the above example, if range_indices contains:
-  // { 1, 2 }
-  // Then the 1th and 2th (starting from base 0) ranges as defined in
-  // |range_starts| would be played back, which would be:
-  // { E, F, G, H, I }.
-  void PlaybackRanges(const std::vector<size_t>& range_starts,
-                      const std::vector<size_t>& range_indices,
-                      SkCanvas* canvas,
-                      SkPicture::AbortCallback* callback = nullptr) const;
+  // Replays the paint op buffer into the canvas. If |indices| is specified, it
+  // contains indices in an increasing order and only the indices specified in
+  // the vector will be replayed.
+  void Playback(SkCanvas* canvas,
+                SkPicture::AbortCallback* callback = nullptr,
+                const std::vector<size_t>* indices = nullptr) const;
 
   // Returns the size of the paint op buffer. That is, the number of ops
   // contained in it.
@@ -873,12 +853,22 @@
 
   class Iterator {
    public:
-    explicit Iterator(const PaintOpBuffer* buffer)
-        : buffer_(buffer), ptr_(buffer_->data_.get()) {}
+    explicit Iterator(const PaintOpBuffer* buffer,
+                      const std::vector<size_t>* indices = nullptr)
+        : buffer_(buffer), ptr_(buffer_->data_.get()), indices_(indices) {
+      if (indices) {
+        if (indices->empty()) {
+          *this = end();
+          return;
+        }
+        target_idx_ = (*indices)[0];
+      }
+      ++(*this);
+    }
 
     PaintOp* operator->() const { return reinterpret_cast<PaintOp*>(ptr_); }
     PaintOp* operator*() const { return operator->(); }
-    Iterator begin() { return Iterator(buffer_, buffer_->data_.get(), 0); }
+    Iterator begin() { return Iterator(buffer_, indices_); }
     Iterator end() {
       return Iterator(buffer_, buffer_->data_.get() + buffer_->used_,
                       buffer_->size());
@@ -889,11 +879,27 @@
       return other.op_idx_ != op_idx_;
     }
     Iterator& operator++() {
-      PaintOp* op = **this;
-      uint32_t type = op->type;
-      CHECK_LE(type, static_cast<uint32_t>(PaintOpType::LastPaintOpType));
-      ptr_ += op->skip;
-      op_idx_++;
+      if (target_idx_ == std::numeric_limits<size_t>::max()) {
+        *this = end();
+        return *this;
+      }
+
+      while (*this && target_idx_ != op_idx_) {
+        PaintOp* op = **this;
+        uint32_t type = op->type;
+        CHECK_LE(type, static_cast<uint32_t>(PaintOpType::LastPaintOpType));
+        ptr_ += op->skip;
+        op_idx_++;
+      }
+
+      if (indices_) {
+        if (++indices_index_ >= indices_->size())
+          target_idx_ = std::numeric_limits<size_t>::max();
+        else
+          target_idx_ = (*indices_)[indices_index_];
+      } else {
+        ++target_idx_;
+      }
       return *this;
     }
     operator bool() const { return op_idx_ < buffer_->size(); }
@@ -905,7 +911,10 @@
 
     const PaintOpBuffer* buffer_ = nullptr;
     char* ptr_ = nullptr;
+    const std::vector<size_t>* indices_ = nullptr;
     size_t op_idx_ = 0;
+    size_t target_idx_ = 0;
+    size_t indices_index_ = 0;
   };
 
  private:

diff --git a/cc/paint/paint_op_buffer_unittest.cc b/cc/paint/paint_op_buffer_unittest.cc
index 1e6e18cb..5d9c122 100644
--- a/cc/paint/paint_op_buffer_unittest.cc
+++ b/cc/paint/paint_op_buffer_unittest.cc

@@ -15,6 +15,13 @@
 using testing::Mock;
 
 namespace cc {
+namespace {
+void Playback(PaintOpBuffer* buffer,
+              SkCanvas* canvas,
+              const std::vector<size_t>& indices) {
+  buffer->Playback(canvas, nullptr, &indices);
+}
+}  // namespace
 
 TEST(PaintOpBufferTest, Empty) {
   PaintOpBuffer buffer;
@@ -251,7 +258,7 @@
   buffer.push<RestoreOp>();
 
   SaveCountingCanvas canvas;
-  buffer.playback(&canvas);
+  buffer.Playback(&canvas);
 
   EXPECT_EQ(0, canvas.save_count_);
   EXPECT_EQ(0, canvas.restore_count_);
@@ -282,7 +289,7 @@
   buffer.push<RestoreOp>();
 
   SaveCountingCanvas canvas;
-  buffer.playback(&canvas);
+  buffer.Playback(&canvas);
 
   EXPECT_EQ(1, canvas.save_count_);
   EXPECT_EQ(1, canvas.restore_count_);
@@ -309,7 +316,7 @@
   buffer.push<RestoreOp>();
 
   SaveCountingCanvas canvas;
-  buffer.playback(&canvas);
+  buffer.Playback(&canvas);
 
   EXPECT_EQ(1, canvas.save_count_);
   EXPECT_EQ(1, canvas.restore_count_);
@@ -329,7 +336,7 @@
   buffer.push<RestoreOp>();
 
   SaveCountingCanvas canvas;
-  buffer.playback(&canvas);
+  buffer.Playback(&canvas);
 
   EXPECT_EQ(1, canvas.save_count_);
   EXPECT_EQ(1, canvas.restore_count_);
@@ -356,7 +363,7 @@
   buffer.push<RestoreOp>();
 
   SaveCountingCanvas canvas;
-  buffer.playback(&canvas);
+  buffer.Playback(&canvas);
 
   EXPECT_EQ(0, canvas.save_count_);
   EXPECT_EQ(0, canvas.restore_count_);
@@ -384,7 +391,7 @@
   buffer.push<RestoreOp>();
 
   SaveCountingCanvas canvas;
-  buffer.playback(&canvas);
+  buffer.Playback(&canvas);
 
   EXPECT_EQ(1, canvas.save_count_);
   EXPECT_EQ(1, canvas.restore_count_);
@@ -483,7 +490,7 @@
   EXPECT_EQ(4, buffer2->numSlowPaths());
 }
 
-TEST(PaintOpBufferTest, ContiguousRanges) {
+TEST(PaintOpBufferTest, ContiguousIndices) {
   PaintOpBuffer buffer;
   MockCanvas canvas;
 
@@ -493,20 +500,17 @@
   buffer.push<DrawColorOp>(3u, SkBlendMode::kClear);
   buffer.push<DrawColorOp>(4u, SkBlendMode::kClear);
 
-  // Ranges are {0, 1}, {2}, {3, 4}.
-  std::vector<size_t> ranges = {0, 2, 3};
-
-  // Plays all 3 ranges.
+  // Plays all items.
   testing::Sequence s;
   EXPECT_CALL(canvas, OnDrawPaintWithColor(0u)).InSequence(s);
   EXPECT_CALL(canvas, OnDrawPaintWithColor(1u)).InSequence(s);
   EXPECT_CALL(canvas, OnDrawPaintWithColor(2u)).InSequence(s);
   EXPECT_CALL(canvas, OnDrawPaintWithColor(3u)).InSequence(s);
   EXPECT_CALL(canvas, OnDrawPaintWithColor(4u)).InSequence(s);
-  buffer.PlaybackRanges(ranges, {0, 1, 2}, &canvas);
+  Playback(&buffer, &canvas, {0, 1, 2, 3, 4});
 }
 
-TEST(PaintOpBufferTest, NonContiguousRanges) {
+TEST(PaintOpBufferTest, NonContiguousIndices) {
   PaintOpBuffer buffer;
   MockCanvas canvas;
 
@@ -516,19 +520,16 @@
   buffer.push<DrawColorOp>(3u, SkBlendMode::kClear);
   buffer.push<DrawColorOp>(4u, SkBlendMode::kClear);
 
-  // Ranges are {0, 1}, {2}, {3, 4}.
-  std::vector<size_t> ranges = {0, 2, 3};
-
-  // Plays first and third ranges.
+  // Plays 0, 1, 3, 4 indices.
   testing::Sequence s;
   EXPECT_CALL(canvas, OnDrawPaintWithColor(0u)).InSequence(s);
   EXPECT_CALL(canvas, OnDrawPaintWithColor(1u)).InSequence(s);
   EXPECT_CALL(canvas, OnDrawPaintWithColor(3u)).InSequence(s);
   EXPECT_CALL(canvas, OnDrawPaintWithColor(4u)).InSequence(s);
-  buffer.PlaybackRanges(ranges, {0, 2}, &canvas);
+  Playback(&buffer, &canvas, {0, 1, 3, 4});
 }
 
-TEST(PaintOpBufferTest, FirstRange) {
+TEST(PaintOpBufferTest, FirstTwoIndices) {
   PaintOpBuffer buffer;
   MockCanvas canvas;
 
@@ -538,17 +539,14 @@
   buffer.push<DrawColorOp>(3u, SkBlendMode::kClear);
   buffer.push<DrawColorOp>(4u, SkBlendMode::kClear);
 
-  // Ranges are {0, 1}, {2}, {3, 4}.
-  std::vector<size_t> ranges = {0, 2, 3};
-
-  // Plays first range.
+  // Plays first two indices.
   testing::Sequence s;
   EXPECT_CALL(canvas, OnDrawPaintWithColor(0u)).InSequence(s);
   EXPECT_CALL(canvas, OnDrawPaintWithColor(1u)).InSequence(s);
-  buffer.PlaybackRanges(ranges, {0}, &canvas);
+  Playback(&buffer, &canvas, {0, 1});
 }
 
-TEST(PaintOpBufferTest, MiddleRange) {
+TEST(PaintOpBufferTest, MiddleIndex) {
   PaintOpBuffer buffer;
   MockCanvas canvas;
 
@@ -558,16 +556,13 @@
   buffer.push<DrawColorOp>(3u, SkBlendMode::kClear);
   buffer.push<DrawColorOp>(4u, SkBlendMode::kClear);
 
-  // Ranges are {0, 1}, {2}, {3, 4}.
-  std::vector<size_t> ranges = {0, 2, 3};
-
-  // Plays second range.
+  // Plays index 2.
   testing::Sequence s;
   EXPECT_CALL(canvas, OnDrawPaintWithColor(2u)).InSequence(s);
-  buffer.PlaybackRanges(ranges, {1}, &canvas);
+  Playback(&buffer, &canvas, {2});
 }
 
-TEST(PaintOpBufferTest, LastRange) {
+TEST(PaintOpBufferTest, LastTwoElements) {
   PaintOpBuffer buffer;
   MockCanvas canvas;
 
@@ -577,17 +572,14 @@
   buffer.push<DrawColorOp>(3u, SkBlendMode::kClear);
   buffer.push<DrawColorOp>(4u, SkBlendMode::kClear);
 
-  // Ranges are {0, 1}, {2}, {3, 4}.
-  std::vector<size_t> ranges = {0, 2, 3};
-
-  // Plays third range.
+  // Plays last two elements.
   testing::Sequence s;
   EXPECT_CALL(canvas, OnDrawPaintWithColor(3u)).InSequence(s);
   EXPECT_CALL(canvas, OnDrawPaintWithColor(4u)).InSequence(s);
-  buffer.PlaybackRanges(ranges, {2}, &canvas);
+  Playback(&buffer, &canvas, {3, 4});
 }
 
-TEST(PaintOpBufferTest, ContiguousRangeWithSaveLayerAlphaRestore) {
+TEST(PaintOpBufferTest, ContiguousIndicesWithSaveLayerAlphaRestore) {
   PaintOpBuffer buffer;
   MockCanvas canvas;
 
@@ -600,67 +592,20 @@
   buffer.push<DrawColorOp>(3u, SkBlendMode::kClear);
   buffer.push<DrawColorOp>(4u, SkBlendMode::kClear);
 
-  {
-    // Ranges are {0, 1, save, restore}, {2}, {3, 4}.
-    std::vector<size_t> ranges = {0, 4, 5};
+  // Items are {0, 1, save, restore, 2, 3, 4}.
 
-    testing::Sequence s;
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(0u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(1u)).InSequence(s);
-    // The empty SaveLayerAlpha/Restore is dropped.
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(2u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(3u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(4u)).InSequence(s);
-    buffer.PlaybackRanges(ranges, {0, 1, 2}, &canvas);
-  }
+  testing::Sequence s;
+  EXPECT_CALL(canvas, OnDrawPaintWithColor(0u)).InSequence(s);
+  EXPECT_CALL(canvas, OnDrawPaintWithColor(1u)).InSequence(s);
+  // The empty SaveLayerAlpha/Restore is dropped.
+  EXPECT_CALL(canvas, OnDrawPaintWithColor(2u)).InSequence(s);
+  EXPECT_CALL(canvas, OnDrawPaintWithColor(3u)).InSequence(s);
+  EXPECT_CALL(canvas, OnDrawPaintWithColor(4u)).InSequence(s);
+  Playback(&buffer, &canvas, {0, 1, 2, 3, 4, 5, 6});
   Mock::VerifyAndClearExpectations(&canvas);
-
-  {
-    // Ranges are {0, 1}, {save, restore}, {2}, {3, 4}.
-    std::vector<size_t> ranges = {0, 2, 4, 5};
-
-    testing::Sequence s;
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(0u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(1u)).InSequence(s);
-    // The empty SaveLayerAlpha/Restore is dropped.
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(2u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(3u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(4u)).InSequence(s);
-    buffer.PlaybackRanges(ranges, {0, 1, 2, 3}, &canvas);
-  }
-  Mock::VerifyAndClearExpectations(&canvas);
-
-  {
-    // Ranges are {0, 1}, {save, restore, 2}, {3, 4}.
-    std::vector<size_t> ranges = {0, 2, 5};
-
-    testing::Sequence s;
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(0u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(1u)).InSequence(s);
-    // The empty SaveLayerAlpha/Restore is dropped.
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(2u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(3u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(4u)).InSequence(s);
-    buffer.PlaybackRanges(ranges, {0, 1, 2}, &canvas);
-  }
-  Mock::VerifyAndClearExpectations(&canvas);
-
-  {
-    // Ranges are {0, 1, save}, {restore, 2}, {3, 4}.
-    std::vector<size_t> ranges = {0, 3, 5};
-
-    testing::Sequence s;
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(0u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(1u)).InSequence(s);
-    // The empty SaveLayerAlpha/Restore is dropped.
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(2u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(3u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(4u)).InSequence(s);
-    buffer.PlaybackRanges(ranges, {0, 1, 2}, &canvas);
-  }
 }
 
-TEST(PaintOpBufferTest, NonContiguousRangeWithSaveLayerAlphaRestore) {
+TEST(PaintOpBufferTest, NonContiguousIndicesWithSaveLayerAlphaRestore) {
   PaintOpBuffer buffer;
   MockCanvas canvas;
 
@@ -673,10 +618,9 @@
   buffer.push<RestoreOp>();
   buffer.push<DrawColorOp>(4u, SkBlendMode::kClear);
 
-  // Ranges are {0, 1, save}, {2, 3}, {restore, 4}.
-  std::vector<size_t> ranges = {0, 3, 5};
+  // Items are {0, 1, save, 2, 3, restore, 4}.
 
-  // Plays back all ranges.
+  // Plays back all indices.
   {
     testing::Sequence s;
     EXPECT_CALL(canvas, OnDrawPaintWithColor(0u)).InSequence(s);
@@ -689,53 +633,23 @@
     EXPECT_CALL(canvas, OnDrawPaintWithColor(3u)).InSequence(s);
     EXPECT_CALL(canvas, willRestore()).InSequence(s);
     EXPECT_CALL(canvas, OnDrawPaintWithColor(4u)).InSequence(s);
-    buffer.PlaybackRanges(ranges, {0, 1, 2}, &canvas);
+    Playback(&buffer, &canvas, {0, 1, 2, 3, 4, 5, 6});
   }
   Mock::VerifyAndClearExpectations(&canvas);
 
-  // Skips the middle range.
+  // Skips the middle indices.
   {
     testing::Sequence s;
     EXPECT_CALL(canvas, OnDrawPaintWithColor(0u)).InSequence(s);
     EXPECT_CALL(canvas, OnDrawPaintWithColor(1u)).InSequence(s);
     // The now-empty SaveLayerAlpha/Restore is dropped
     EXPECT_CALL(canvas, OnDrawPaintWithColor(4u)).InSequence(s);
-    buffer.PlaybackRanges(ranges, {0, 2}, &canvas);
-  }
-
-  // Repeat with ranges that contain just the save and restore, as
-  // {0, 1}, {save}, {2, 3}, {restore}, {4}.
-  ranges = {0, 2, 3, 5, 6};
-
-  // Plays back all ranges.
-  {
-    testing::Sequence s;
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(0u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(1u)).InSequence(s);
-    // The SaveLayerAlpha/Restore is not dropped if we draw the middle
-    // range, as we need them to represent the two draws inside the layer
-    // correctly.
-    EXPECT_CALL(canvas, OnSaveLayer()).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(2u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(3u)).InSequence(s);
-    EXPECT_CALL(canvas, willRestore()).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(4u)).InSequence(s);
-    buffer.PlaybackRanges(ranges, {0, 1, 2, 3, 4}, &canvas);
+    Playback(&buffer, &canvas, {0, 1, 2, 5, 6});
   }
   Mock::VerifyAndClearExpectations(&canvas);
-
-  // Skips the middle range.
-  {
-    testing::Sequence s;
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(0u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(1u)).InSequence(s);
-    // The now-empty SaveLayerAlpha/Restore is dropped
-    EXPECT_CALL(canvas, OnDrawPaintWithColor(4u)).InSequence(s);
-    buffer.PlaybackRanges(ranges, {0, 1, 3, 4}, &canvas);
-  }
 }
 
-TEST(PaintOpBufferTest, ContiguousRangeWithSaveLayerAlphaDrawRestore) {
+TEST(PaintOpBufferTest, ContiguousIndicesWithSaveLayerAlphaDrawRestore) {
   PaintOpBuffer buffer;
   MockCanvas canvas;
 
@@ -754,72 +668,21 @@
   add_draw_rect(&buffer, 3u);
   add_draw_rect(&buffer, 4u);
 
-  {
-    // Ranges are {0, 1, save, 2, restore}, {3, 4}.
-    std::vector<size_t> ranges = {0, 5};
+  // Items are {0, 1, save, 2, restore, 3, 4}.
 
-    testing::Sequence s;
-    EXPECT_CALL(canvas, OnDrawRectWithColor(0u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawRectWithColor(1u)).InSequence(s);
-    // The empty SaveLayerAlpha/Restore is dropped, the containing
-    // operation can be drawn with alpha.
-    EXPECT_CALL(canvas, OnDrawRectWithColor(2u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawRectWithColor(3u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawRectWithColor(4u)).InSequence(s);
-    buffer.PlaybackRanges(ranges, {0, 1}, &canvas);
-  }
-  Mock::VerifyAndClearExpectations(&canvas);
-
-  {
-    // Ranges are {0, 1, save, 2}, {restore}, {3, 4}.
-    std::vector<size_t> ranges = {0, 4, 5};
-
-    testing::Sequence s;
-    EXPECT_CALL(canvas, OnDrawRectWithColor(0u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawRectWithColor(1u)).InSequence(s);
-    // The empty SaveLayerAlpha/Restore is dropped, the containing
-    // operation can be drawn with alpha.
-    EXPECT_CALL(canvas, OnDrawRectWithColor(2u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawRectWithColor(3u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawRectWithColor(4u)).InSequence(s);
-    buffer.PlaybackRanges(ranges, {0, 1, 2}, &canvas);
-  }
-  Mock::VerifyAndClearExpectations(&canvas);
-
-  {
-    // Ranges are {0, 1, save}, {2, restore}, {3, 4}.
-    std::vector<size_t> ranges = {0, 3, 5};
-
-    testing::Sequence s;
-    EXPECT_CALL(canvas, OnDrawRectWithColor(0u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawRectWithColor(1u)).InSequence(s);
-    // The empty SaveLayerAlpha/Restore is dropped, the containing
-    // operation can be drawn with alpha.
-    EXPECT_CALL(canvas, OnDrawRectWithColor(2u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawRectWithColor(3u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawRectWithColor(4u)).InSequence(s);
-    buffer.PlaybackRanges(ranges, {0, 1, 2}, &canvas);
-  }
-  Mock::VerifyAndClearExpectations(&canvas);
-
-  {
-    // Ranges are {0, 1, save}, {2}, {restore}, {3, 4}.
-    std::vector<size_t> ranges = {0, 3, 4, 5};
-
-    testing::Sequence s;
-    EXPECT_CALL(canvas, OnDrawRectWithColor(0u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawRectWithColor(1u)).InSequence(s);
-    // The empty SaveLayerAlpha/Restore is dropped, the containing
-    // operation can be drawn with alpha.
-    EXPECT_CALL(canvas, OnDrawRectWithColor(2u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawRectWithColor(3u)).InSequence(s);
-    EXPECT_CALL(canvas, OnDrawRectWithColor(4u)).InSequence(s);
-    buffer.PlaybackRanges(ranges, {0, 1, 2, 3}, &canvas);
-  }
+  testing::Sequence s;
+  EXPECT_CALL(canvas, OnDrawRectWithColor(0u)).InSequence(s);
+  EXPECT_CALL(canvas, OnDrawRectWithColor(1u)).InSequence(s);
+  // The empty SaveLayerAlpha/Restore is dropped, the containing
+  // operation can be drawn with alpha.
+  EXPECT_CALL(canvas, OnDrawRectWithColor(2u)).InSequence(s);
+  EXPECT_CALL(canvas, OnDrawRectWithColor(3u)).InSequence(s);
+  EXPECT_CALL(canvas, OnDrawRectWithColor(4u)).InSequence(s);
+  Playback(&buffer, &canvas, {0, 1, 2, 3, 4, 5, 6});
   Mock::VerifyAndClearExpectations(&canvas);
 }
 
-TEST(PaintOpBufferTest, NonContiguousRangeWithSaveLayerAlphaDrawRestore) {
+TEST(PaintOpBufferTest, NonContiguousIndicesWithSaveLayerAlphaDrawRestore) {
   PaintOpBuffer buffer;
   MockCanvas canvas;
 
@@ -838,8 +701,7 @@
   add_draw_rect(&buffer, 4u);
   buffer.push<RestoreOp>();
 
-  // Ranges are {0, 1, save}, {2, 3}, {4, restore}.
-  std::vector<size_t> ranges = {0, 3, 5};
+  // Items are are {0, 1, save, 2, 3, 4, restore}.
 
   // If the middle range is played, then the SaveLayerAlpha/Restore
   // can't be dropped.
@@ -852,7 +714,7 @@
     EXPECT_CALL(canvas, OnDrawRectWithColor(3u)).InSequence(s);
     EXPECT_CALL(canvas, OnDrawRectWithColor(4u)).InSequence(s);
     EXPECT_CALL(canvas, willRestore()).InSequence(s);
-    buffer.PlaybackRanges(ranges, {0, 1, 2}, &canvas);
+    Playback(&buffer, &canvas, {0, 1, 2, 3, 4, 5, 6});
   }
   Mock::VerifyAndClearExpectations(&canvas);
 
@@ -863,13 +725,10 @@
     EXPECT_CALL(canvas, OnDrawRectWithColor(0u)).InSequence(s);
     EXPECT_CALL(canvas, OnDrawRectWithColor(1u)).InSequence(s);
     EXPECT_CALL(canvas, OnDrawRectWithColor(4u)).InSequence(s);
-    buffer.PlaybackRanges(ranges, {0, 2}, &canvas);
+    Playback(&buffer, &canvas, {0, 1, 2, 5, 6});
   }
   Mock::VerifyAndClearExpectations(&canvas);
 
-  // Ranges are {0, 1, save, 2}, {3, 4}, {restore}.
-  ranges = {0, 4, 6};
-
   // If the middle range is not played, then the SaveLayerAlpha/Restore
   // can be dropped.
   {
@@ -877,7 +736,7 @@
     EXPECT_CALL(canvas, OnDrawRectWithColor(0u)).InSequence(s);
     EXPECT_CALL(canvas, OnDrawRectWithColor(1u)).InSequence(s);
     EXPECT_CALL(canvas, OnDrawRectWithColor(2u)).InSequence(s);
-    buffer.PlaybackRanges(ranges, {0, 2}, &canvas);
+    Playback(&buffer, &canvas, {0, 1, 2, 3, 6});
   }
 }
 
@@ -907,7 +766,7 @@
     EXPECT_CALL(canvas, OnDrawRectWithColor(1u)).InSequence(s);
     EXPECT_CALL(canvas, willRestore()).InSequence(s);
     EXPECT_CALL(canvas, OnDrawRectWithColor(2u)).InSequence(s);
-    buffer.PlaybackRanges({0}, {0}, &canvas);
+    buffer.Playback(&canvas);
   }
 }
 
@@ -941,7 +800,7 @@
   EXPECT_CALL(canvas, willRestore()).InSequence(s);
   // We will restore back to the original save count regardless with 2 restores.
   EXPECT_CALL(canvas, willRestore()).InSequence(s);
-  buffer.PlaybackRanges({0}, {0}, &canvas);
+  buffer.Playback(&canvas);
 }
 
 }  // namespace cc

diff --git a/cc/paint/paint_record.cc b/cc/paint/paint_record.cc
index 2483006..9593bbb 100644
--- a/cc/paint/paint_record.cc
+++ b/cc/paint/paint_record.cc

@@ -12,7 +12,7 @@
 sk_sp<SkPicture> ToSkPicture(sk_sp<PaintRecord> record, const SkRect& bounds) {
   SkPictureRecorder recorder;
   SkCanvas* canvas = recorder.beginRecording(bounds);
-  record->playback(canvas);
+  record->Playback(canvas);
   return recorder.finishRecordingAsPicture();
 }
 
@@ -20,7 +20,7 @@
                                    const SkRect& bounds) {
   SkPictureRecorder recorder;
   SkCanvas* canvas = recorder.beginRecording(bounds);
-  record->playback(canvas);
+  record->Playback(canvas);
   return recorder.finishRecordingAsPicture();
 }
 

diff --git a/cc/paint/skia_paint_canvas.cc b/cc/paint/skia_paint_canvas.cc
index 65a86c9a..10a2fe4 100644
--- a/cc/paint/skia_paint_canvas.cc
+++ b/cc/paint/skia_paint_canvas.cc

@@ -256,7 +256,7 @@
 }
 
 void SkiaPaintCanvas::drawPicture(sk_sp<const PaintRecord> record) {
-  record->playback(canvas_);
+  record->Playback(canvas_);
 }
 
 bool SkiaPaintCanvas::isClipEmpty() const {

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
index 0805317..8492faaa 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java

@@ -1083,8 +1083,8 @@
                 // If the bottom sheet new tab UI is showing and the tab open type is not
                 // already OPEN_NEW_TAB or OPEN_NEW_INCOGNITO_TAB, set the open type so that a real
                 // new tab will be created and added to the appropriate model.
-                if (getBottomSheet().isShowingNewTab() && tabOpenType != TabOpenType.OPEN_NEW_TAB
-                        && tabOpenType != TabOpenType.OPEN_NEW_INCOGNITO_TAB) {
+                if (getBottomSheet().isShowingNewTab()
+                        && tabOpenType == TabOpenType.CLOBBER_CURRENT_TAB) {
                     tabOpenType = mTabModelSelectorImpl.isIncognitoSelected()
                             ? TabOpenType.OPEN_NEW_INCOGNITO_TAB
                             : TabOpenType.OPEN_NEW_TAB;
@@ -1093,10 +1093,17 @@
                 // Either a new tab is opening, a tab is being clobbered, or a tab is being
                 // brought to the front. In all scenarios, the bottom sheet should be closed.
                 // If a new tab is being created from a launcher shortcut, close the panel without
-                // animation because the panel will be re-opened immediately.
+                // animation because the panel will be re-opened immediately. If a tab is being
+                // brought to the front, this indicates the user is coming back to Chrome through
+                // external means (e.g. homescreen shortcut, media notification) and animating the
+                // sheet closing is extraneous.
+                boolean animateSheetClose = !fromLauncherShortcut
+                        && (tabOpenType == TabOpenType.CLOBBER_CURRENT_TAB
+                                   || tabOpenType == TabOpenType.OPEN_NEW_TAB
+                                   || tabOpenType == TabOpenType.OPEN_NEW_INCOGNITO_TAB);
                 getBottomSheet().getBottomSheetMetrics().setSheetCloseReason(
                         BottomSheetMetrics.CLOSED_BY_NAVIGATION);
-                getBottomSheet().setSheetState(BottomSheet.SHEET_STATE_PEEK, !fromLauncherShortcut);
+                getBottomSheet().setSheetState(BottomSheet.SHEET_STATE_PEEK, animateSheetClose);
             }
 
             // We send this intent so that we can enter WebVr presentation mode if needed. This
@@ -1144,6 +1151,12 @@
                     } else {
                         TabModelUtils.setIndex(tabModel, tabIndex);
                     }
+
+                    if (tabModel.getCount() > 0 && mUIInitialized
+                            && mLayoutManager.overviewVisible()) {
+                        mLayoutManager.hideOverview(true);
+                    }
+
                     logMobileReceivedExternalIntent(externalAppId, intent);
                     break;
                 case CLOBBER_CURRENT_TAB:

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/payments/ui/PaymentRequestUI.java b/chrome/android/java/src/org/chromium/chrome/browser/payments/ui/PaymentRequestUI.java
index 1848ed9..8ff4cd7 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/payments/ui/PaymentRequestUI.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/payments/ui/PaymentRequestUI.java

@@ -561,10 +561,6 @@
                     new LinearLayout.LayoutParams(
                             LayoutParams.MATCH_PARENT, LayoutParams.WRAP_CONTENT));
             mSectionSeparators.add(new SectionSeparator(mPaymentContainerLayout));
-            mPaymentContainerLayout.addView(mShippingOptionSection,
-                    new LinearLayout.LayoutParams(
-                            LayoutParams.MATCH_PARENT, LayoutParams.WRAP_CONTENT));
-            mSectionSeparators.add(new SectionSeparator(mPaymentContainerLayout));
         }
         mPaymentContainerLayout.addView(mPaymentMethodSection, new LinearLayout.LayoutParams(
                 LayoutParams.MATCH_PARENT, LayoutParams.WRAP_CONTENT));
@@ -663,6 +659,7 @@
         } else if (whichSection == TYPE_SHIPPING_OPTIONS) {
             mShippingOptionsSectionInformation = section;
             mShippingOptionSection.update(section);
+            showShippingOptionSectionIfNecessary();
         } else if (whichSection == TYPE_CONTACT_DETAILS) {
             mContactDetailsSectionInformation = section;
             mContactDetailsSection.update(section);
@@ -680,6 +677,25 @@
         if (isFinishingEditItem) notifyReadyForInput();
     }
 
+    // Only show shipping option section once there are shipping options.
+    private void showShippingOptionSectionIfNecessary() {
+        if (!mRequestShipping || mShippingOptionsSectionInformation.isEmpty()
+                || mPaymentContainerLayout.indexOfChild(mShippingOptionSection) != -1) {
+            return;
+        }
+
+        // Shipping option section is added below shipping address section.
+        int addressSectionIndex = mPaymentContainerLayout.indexOfChild(mShippingAddressSection);
+        SectionSeparator sectionSeparator =
+                new SectionSeparator(mPaymentContainerLayout, addressSectionIndex + 1);
+        mSectionSeparators.add(sectionSeparator);
+        if (mIsExpandedToFullHeight) sectionSeparator.expand();
+        mPaymentContainerLayout.addView(mShippingOptionSection, addressSectionIndex + 2,
+                new LinearLayout.LayoutParams(
+                        LayoutParams.MATCH_PARENT, LayoutParams.WRAP_CONTENT));
+        mPaymentContainerLayout.requestLayout();
+    }
+
     @Override
     public void onPaymentOptionChanged(final PaymentRequestSection section, PaymentOption option) {
         @SelectionResult int result = SELECTION_RESULT_NONE;

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/widget/bottomsheet/BottomSheetNewTabController.java b/chrome/android/java/src/org/chromium/chrome/browser/widget/bottomsheet/BottomSheetNewTabController.java
index daf49b60..72fb015 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/widget/bottomsheet/BottomSheetNewTabController.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/widget/bottomsheet/BottomSheetNewTabController.java

@@ -94,7 +94,7 @@
         // may get called while the sheet is open. In that case, we should finish showing the new
         // tab UI.
         if (!mBottomSheet.isSheetOpen()) {
-            mBottomSheet.setSheetState(mTabModelSelector.getTotalTabCount() == 0
+            mBottomSheet.setSheetState(mTabModelSelector.getCurrentModel().getCount() == 0
                             ? BottomSheet.SHEET_STATE_FULL
                             : BottomSheet.SHEET_STATE_HALF,
                     true);
@@ -175,6 +175,11 @@
             mTabModelSelector.selectModel(false);
         }
 
+        if (mIsShowingNormalToolbar && mLayoutManager.overviewVisible()) {
+            mIsShowingNormalToolbar = false;
+            mToolbar.showTabSwitcherToolbar();
+        }
+
         onNewTabUiHidden();
     }
 

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/widget/bottomsheet/BottomSheetNewTabControllerTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/widget/bottomsheet/BottomSheetNewTabControllerTest.java
index 010cc1a5..8d816c2e 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/widget/bottomsheet/BottomSheetNewTabControllerTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/widget/bottomsheet/BottomSheetNewTabControllerTest.java

@@ -124,9 +124,9 @@
         // Select "New incognito tab" from the menu.
         MenuUtils.invokeCustomMenuActionSync(InstrumentationRegistry.getInstrumentation(),
                 mActivity, R.id.new_incognito_tab_menu_id);
-        // The sheet should be opened at half height over the tab switcher and the tab count should
+        // The sheet should be opened at full height over the tab switcher and the tab count should
         // remain unchanged. The incognito model should now be selected.
-        validateState(false, BottomSheet.SHEET_STATE_HALF);
+        validateState(false, BottomSheet.SHEET_STATE_FULL);
         assertEquals(1, mActivity.getTabModelSelector().getTotalTabCount());
         assertTrue(
                 "Overview mode should be showing", mActivity.getLayoutManager().overviewVisible());

diff --git a/chrome/android/javatests/src/org/chromium/chrome/test/crash/IntentionalCrashTest.java b/chrome/android/javatests/src/org/chromium/chrome/test/crash/IntentionalCrashTest.java
index 3988cb0..52066717 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/test/crash/IntentionalCrashTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/test/crash/IntentionalCrashTest.java

@@ -25,7 +25,7 @@
 public class IntentionalCrashTest {
     @Rule
     public ChromeActivityTestRule<ChromeActivity> mActivityTestRule =
-            new ChromeActivityTestRule(ChromeActivity.class);
+            new ChromeActivityTestRule<>(ChromeActivity.class);
 
     @DisabledTest
     @Test

diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
index aa43d547..b376a1c 100644
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc

@@ -100,6 +100,7 @@
 #include "ui/compositor/compositor_switches.h"
 #include "ui/display/display_switches.h"
 #include "ui/events/event_switches.h"
+#include "ui/gfx/color_space_switches.h"
 #include "ui/gfx/switches.h"
 #include "ui/gl/gl_features.h"
 #include "ui/gl/gl_switches.h"
@@ -1396,9 +1397,9 @@
          proximity_auth::switches::kEnableBluetoothLowEnergyDiscovery)},
 #endif  // OS_CHROMEOS
 #if defined(USE_ASH)
-    {"ash-enable-night-light", flag_descriptions::kEnableNightLightName,
-     flag_descriptions::kEnableNightLightDescription, kOsAll,
-     SINGLE_VALUE_TYPE(ash::switches::kAshEnableNightLight)},
+    {"ash-disable-night-light", flag_descriptions::kDisableNightLightName,
+     flag_descriptions::kDisableNightLightDescription, kOsAll,
+     SINGLE_DISABLE_VALUE_TYPE(ash::switches::kAshDisableNightLight)},
     {"show-touch-hud", flag_descriptions::kShowTouchHudName,
      flag_descriptions::kShowTouchHudDescription, kOsAll,
      SINGLE_VALUE_TYPE(ash::switches::kAshTouchHud)},

diff --git a/chrome/browser/android/vr_shell/BUILD.gn b/chrome/browser/android/vr_shell/BUILD.gn
index 532837a..59855ed 100644
--- a/chrome/browser/android/vr_shell/BUILD.gn
+++ b/chrome/browser/android/vr_shell/BUILD.gn

@@ -200,6 +200,7 @@
   sources = [
     "fps_meter_unittest.cc",
     "gltf_parser_unittest.cc",
+    "run_all_unittests.cc",
     "test/paths.cc",
     "test/paths.h",
     "textures/close_button_texture_unittest.cc",
@@ -212,8 +213,8 @@
 
   deps = [
     ":vr_common",
-    "//base/test:run_all_unittests",
     "//base/test:test_support",
+    "//components:components_tests_pak",
     "//components/security_state/core",
     "//skia",
     "//testing/gmock",
@@ -223,10 +224,12 @@
     "//ui/gl",
   ]
 
+  if (is_android) {
+    deps += [ "//ui/android:ui_java" ]
+  }
+
   data = [
-    "test/data/sample_inline.gltf",
-    "test/data/sample_external.gltf",
-    "test/data/sample.bin",
-    "test/data/sample.glb",
+    "test/data/",
+    "$root_out_dir/components_tests_resources.pak",
   ]
 }

diff --git a/chrome/browser/android/vr_shell/run_all_unittests.cc b/chrome/browser/android/vr_shell/run_all_unittests.cc
new file mode 100644
index 0000000..7c615de
--- /dev/null
+++ b/chrome/browser/android/vr_shell/run_all_unittests.cc

@@ -0,0 +1,52 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/bind.h"
+#include "base/files/file_util.h"
+#include "base/path_service.h"
+#include "base/test/launcher/unit_test_launcher.h"
+#include "base/test/test_suite.h"
+#include "ui/base/resource/resource_bundle.h"
+#include "ui/base/ui_base_paths.h"
+
+namespace {
+
+class VrCommonTestSuite : public base::TestSuite {
+ public:
+  VrCommonTestSuite(int argc, char** argv) : base::TestSuite(argc, argv) {}
+
+ protected:
+  void Initialize() override {
+    base::TestSuite::Initialize();
+
+    ui::RegisterPathProvider();
+
+    base::FilePath pak_path;
+#if defined(OS_ANDROID)
+    PathService::Get(ui::DIR_RESOURCE_PAKS_ANDROID, &pak_path);
+#else
+    PathService::Get(base::DIR_MODULE, &pak_path);
+#endif
+    ui::ResourceBundle::InitSharedInstanceWithPakPath(
+        pak_path.AppendASCII("components_tests_resources.pak"));
+  }
+
+  void Shutdown() override {
+    ui::ResourceBundle::CleanupSharedInstance();
+    base::TestSuite::Shutdown();
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(VrCommonTestSuite);
+};
+
+}  // namespace
+
+int main(int argc, char** argv) {
+  VrCommonTestSuite test_suite(argc, argv);
+
+  return base::LaunchUnitTests(
+      argc, argv,
+      base::Bind(&VrCommonTestSuite::Run, base::Unretained(&test_suite)));
+}

diff --git a/chrome/browser/android/vr_shell/vr_controller.cc b/chrome/browser/android/vr_shell/vr_controller.cc
index a628cb4..dbd5ea2 100644
--- a/chrome/browser/android/vr_shell/vr_controller.cc
+++ b/chrome/browser/android/vr_shell/vr_controller.cc

@@ -10,7 +10,6 @@
 
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
-#include "base/time/time.h"
 #include "cc/base/math_util.h"
 #include "chrome/browser/android/vr_shell/elbow_model.h"
 #include "third_party/WebKit/public/platform/WebGestureEvent.h"
@@ -49,6 +48,8 @@
 // Distance from the center of the controller to start rendering the laser.
 constexpr float kLaserStartDisplacement = 0.045;
 
+constexpr int microsPerNano = 1000;
+
 void ClampTouchpadPosition(gfx::Vector2dF* position) {
   position->set_x(cc::MathUtil::ClampToRange(position->x(), 0.0f, 1.0f));
   position->set_y(cc::MathUtil::ClampToRange(position->y(), 0.0f, 1.0f));
@@ -141,6 +142,21 @@
   return controller_state_->GetTouchPos().y;
 }
 
+base::TimeTicks VrController::GetLastOrientationTimestamp() const {
+  return base::TimeTicks::FromInternalValue(
+      controller_state_->GetLastOrientationTimestamp() / microsPerNano);
+}
+
+base::TimeTicks VrController::GetLastTouchTimestamp() const {
+  return base::TimeTicks::FromInternalValue(
+      controller_state_->GetLastTouchTimestamp() / microsPerNano);
+}
+
+base::TimeTicks VrController::GetLastButtonTimestamp() const {
+  return base::TimeTicks::FromInternalValue(
+      controller_state_->GetLastButtonTimestamp() / microsPerNano);
+}
+
 gfx::Quaternion VrController::Orientation() const {
   const gvr::Quatf& orientation = controller_state_->GetOrientation();
   return gfx::Quaternion(orientation.qx, orientation.qy, orientation.qz,
@@ -290,7 +306,7 @@
 
 void VrController::UpdateGestureFromTouchInfo(blink::WebGestureEvent* gesture) {
   gesture->SetTimeStampSeconds(
-      (base::TimeTicks::Now() - base::TimeTicks()).InSecondsF());
+      (GetLastTouchTimestamp() - base::TimeTicks()).InSecondsF());
   switch (state_) {
     // User has not put finger on touch pad.
     case WAITING:

diff --git a/chrome/browser/android/vr_shell/vr_controller.h b/chrome/browser/android/vr_shell/vr_controller.h
index de6d03b7..8bcc6c18 100644
--- a/chrome/browser/android/vr_shell/vr_controller.h
+++ b/chrome/browser/android/vr_shell/vr_controller.h

@@ -9,6 +9,7 @@
 #include <vector>
 
 #include "base/macros.h"
+#include "base/time/time.h"
 #include "chrome/browser/android/vr_shell/vr_controller_model.h"
 #include "device/vr/android/gvr/gvr_gamepad_data_provider.h"
 #include "third_party/gvr-android-sdk/src/libraries/headers/vr/gvr/capi/include/gvr_types.h"
@@ -80,6 +81,10 @@
 
   bool IsConnected();
 
+  base::TimeTicks GetLastOrientationTimestamp() const;
+  base::TimeTicks GetLastTouchTimestamp() const;
+  base::TimeTicks GetLastButtonTimestamp() const;
+
  private:
   enum GestureDetectorState {
     WAITING,   // waiting for user to touch down

diff --git a/chrome/browser/android/vr_shell/vr_shell_gl.cc b/chrome/browser/android/vr_shell/vr_shell_gl.cc
index 6d63fbbf..579941f5 100644
--- a/chrome/browser/android/vr_shell/vr_shell_gl.cc
+++ b/chrome/browser/android/vr_shell/vr_shell_gl.cc

@@ -30,7 +30,6 @@
 #include "device/vr/android/gvr/gvr_device.h"
 #include "device/vr/android/gvr/gvr_gamepad_data_provider.h"
 #include "third_party/WebKit/public/platform/WebGestureEvent.h"
-#include "third_party/WebKit/public/platform/WebInputEvent.h"
 #include "third_party/WebKit/public/platform/WebMouseEvent.h"
 #include "ui/gl/android/scoped_java_surface.h"
 #include "ui/gl/android/surface_texture.h"
@@ -172,24 +171,6 @@
   return result;
 }
 
-std::unique_ptr<blink::WebMouseEvent> MakeMouseEvent(
-    blink::WebInputEvent::Type type,
-    double timestamp,
-    const gfx::Point& location,
-    bool down) {
-  blink::WebInputEvent::Modifiers modifiers =
-      down ? blink::WebInputEvent::kLeftButtonDown
-           : blink::WebInputEvent::kNoModifiers;
-  std::unique_ptr<blink::WebMouseEvent> mouse_event(
-      new blink::WebMouseEvent(type, modifiers, timestamp));
-  mouse_event->pointer_type = blink::WebPointerProperties::PointerType::kMouse;
-  mouse_event->button = blink::WebPointerProperties::Button::kLeft;
-  mouse_event->SetPositionInWidget(location.x(), location.y());
-  mouse_event->click_count = 1;
-
-  return mouse_event;
-}
-
 void TransformToGvrMat(const gfx::Transform& in, gvr::Mat4f* out) {
   for (int i = 0; i < 4; ++i) {
     for (int j = 0; j < 4; ++j) {
@@ -643,9 +624,9 @@
   if (touch_pending_ ||
       controller_->ButtonUpHappened(gvr::kControllerButtonClick)) {
     touch_pending_ = false;
-    std::unique_ptr<blink::WebGestureEvent> gesture(new blink::WebGestureEvent(
+    auto gesture = base::MakeUnique<blink::WebGestureEvent>(
         blink::WebInputEvent::kGestureTapDown,
-        blink::WebInputEvent::kNoModifiers, NowSeconds()));
+        blink::WebInputEvent::kNoModifiers, NowSeconds());
     gesture->source_device = blink::kWebGestureDeviceTouchpad;
     gesture->x = 0;
     gesture->y = 0;
@@ -728,8 +709,8 @@
   if (!hover_target_ || (target == hover_target_))
     return;
   if (hover_target_->fill() == Fill::CONTENT) {
-    SendGestureToContent(MakeMouseEvent(blink::WebInputEvent::kMouseLeave,
-                                        NowSeconds(), gfx::Point(), in_click_));
+    SendGestureToContent(
+        MakeMouseEvent(blink::WebInputEvent::kMouseLeave, gfx::Point()));
   } else {
     hover_target_->OnHoverLeave();
   }
@@ -742,9 +723,8 @@
   if (!target || target == hover_target_)
     return false;
   if (target->fill() == Fill::CONTENT) {
-    SendGestureToContent(MakeMouseEvent(blink::WebInputEvent::kMouseEnter,
-                                        NowSeconds(), local_point_pixels,
-                                        in_click_));
+    SendGestureToContent(
+        MakeMouseEvent(blink::WebInputEvent::kMouseEnter, local_point_pixels));
   } else {
     target->OnHoverEnter(target_point);
   }
@@ -763,9 +743,8 @@
     // disable mouse moves, only delivering a down and up event.
     if (in_click_)
       return;
-    SendGestureToContent(MakeMouseEvent(blink::WebInputEvent::kMouseMove,
-                                        NowSeconds(), local_point_pixels,
-                                        in_click_));
+    SendGestureToContent(
+        MakeMouseEvent(blink::WebInputEvent::kMouseMove, local_point_pixels));
   } else {
     hover_target_->OnMove(target_point);
   }
@@ -783,9 +762,8 @@
   if (!target)
     return;
   if (target->fill() == Fill::CONTENT) {
-    SendGestureToContent(MakeMouseEvent(blink::WebInputEvent::kMouseDown,
-                                        NowSeconds(), local_point_pixels,
-                                        in_click_));
+    SendGestureToContent(
+        MakeMouseEvent(blink::WebInputEvent::kMouseDown, local_point_pixels));
   } else {
     target->OnButtonDown(target_point);
   }
@@ -805,9 +783,8 @@
   DCHECK(input_locked_element_ == target);
   input_locked_element_ = nullptr;
   if (target->fill() == Fill::CONTENT) {
-    SendGestureToContent(MakeMouseEvent(blink::WebInputEvent::kMouseUp,
-                                        NowSeconds(), local_point_pixels,
-                                        in_click_));
+    SendGestureToContent(
+        MakeMouseEvent(blink::WebInputEvent::kMouseUp, local_point_pixels));
   } else {
     target->OnButtonUp(target_point);
   }
@@ -836,6 +813,39 @@
   }
 }
 
+std::unique_ptr<blink::WebMouseEvent> VrShellGl::MakeMouseEvent(
+    blink::WebInputEvent::Type type,
+    const gfx::Point& location) {
+  blink::WebInputEvent::Modifiers modifiers =
+      in_click_ ? blink::WebInputEvent::kLeftButtonDown
+                : blink::WebInputEvent::kNoModifiers;
+  base::TimeTicks timestamp;
+  switch (type) {
+    case blink::WebInputEvent::kMouseUp:
+    case blink::WebInputEvent::kMouseDown:
+      timestamp = controller_->GetLastButtonTimestamp();
+      break;
+    case blink::WebInputEvent::kMouseMove:
+    case blink::WebInputEvent::kMouseEnter:
+    case blink::WebInputEvent::kMouseLeave:
+      timestamp = controller_->GetLastOrientationTimestamp();
+      break;
+    default:
+      NOTREACHED();
+  }
+
+  auto mouse_event = base::MakeUnique<blink::WebMouseEvent>(
+      type, modifiers, (timestamp - base::TimeTicks()).InSecondsF());
+  mouse_event->pointer_type = blink::WebPointerProperties::PointerType::kMouse;
+  mouse_event->button = blink::WebPointerProperties::Button::kLeft;
+  mouse_event->SetPositionInWidget(location.x(), location.y());
+  // TODO(mthiesse): Should we support double-clicks for input? What should the
+  // timeout be?
+  mouse_event->click_count = 1;
+
+  return mouse_event;
+}
+
 void VrShellGl::SendImmediateExitRequestIfNecessary() {
   gvr::ControllerButton buttons[] = {
       gvr::kControllerButtonClick, gvr::kControllerButtonApp,

diff --git a/chrome/browser/android/vr_shell/vr_shell_gl.h b/chrome/browser/android/vr_shell/vr_shell_gl.h
index c41f27a..7b07d5d 100644
--- a/chrome/browser/android/vr_shell/vr_shell_gl.h
+++ b/chrome/browser/android/vr_shell/vr_shell_gl.h

@@ -19,6 +19,7 @@
 #include "chrome/browser/android/vr_shell/vr_controller_model.h"
 #include "device/vr/vr_service.mojom.h"
 #include "mojo/public/cpp/bindings/binding.h"
+#include "third_party/WebKit/public/platform/WebInputEvent.h"
 #include "third_party/gvr-android-sdk/src/libraries/headers/vr/gvr/capi/include/gvr.h"
 #include "third_party/gvr-android-sdk/src/libraries/headers/vr/gvr/capi/include/gvr_types.h"
 #include "ui/gfx/geometry/quaternion.h"
@@ -26,7 +27,7 @@
 #include "ui/gfx/native_widget_types.h"
 
 namespace blink {
-class WebInputEvent;
+class WebMouseEvent;
 }
 
 namespace gl {
@@ -158,6 +159,9 @@
   void SendTap(UiElement* target,
                const gfx::PointF& target_point,
                const gfx::Point& local_point_pixels);
+  std::unique_ptr<blink::WebMouseEvent> MakeMouseEvent(
+      blink::WebInputEvent::Type type,
+      const gfx::Point& location);
   void SendImmediateExitRequestIfNecessary();
   void GetVisualTargetElement(const gfx::Vector3dF& controller_direction,
                               gfx::Vector3dF& eye_to_target,

diff --git a/chrome/browser/captive_portal/captive_portal_browsertest.cc b/chrome/browser/captive_portal/captive_portal_browsertest.cc
index 904c60d..c73f5897 100644
--- a/chrome/browser/captive_portal/captive_portal_browsertest.cc
+++ b/chrome/browser/captive_portal/captive_portal_browsertest.cc

@@ -19,7 +19,6 @@
 #include "base/path_service.h"
 #include "base/sequence_checker.h"
 #include "base/strings/utf_string_conversions.h"
-#include "base/task_scheduler/post_task.h"
 #include "base/values.h"
 #include "build/build_config.h"
 #include "chrome/browser/captive_portal/captive_portal_service.h"
@@ -485,8 +484,6 @@
     net::NetworkDelegate* network_delegate) const {
   EXPECT_TRUE(BrowserThread::CurrentlyOn(BrowserThread::IO));
 
-  const base::TaskTraits kTraits = {base::MayBlock()};
-
   // The PathService is threadsafe.
   base::FilePath root_http;
   PathService::Get(chrome::DIR_TEST_DATA, &root_http);
@@ -499,8 +496,7 @@
     // actually requested.
     return new URLRequestMockHTTPJob(
         request, network_delegate,
-        root_http.Append(FILE_PATH_LITERAL("title2.html")),
-        base::CreateTaskRunnerWithTraits(kTraits));
+        root_http.Append(FILE_PATH_LITERAL("title2.html")));
   } else if (request->url() == kMockHttpsQuickTimeoutUrl) {
     if (behind_captive_portal_)
       return new URLRequestFailedJob(
@@ -509,8 +505,7 @@
     // actually requested.
     return new URLRequestMockHTTPJob(
         request, network_delegate,
-        root_http.Append(FILE_PATH_LITERAL("title2.html")),
-        base::CreateTaskRunnerWithTraits(kTraits));
+        root_http.Append(FILE_PATH_LITERAL("title2.html")));
   } else {
     // The URL should be the captive portal test URL.
     EXPECT_TRUE(request->url() == kMockCaptivePortalTestUrl ||
@@ -522,20 +517,17 @@
       if (request->url() == kMockCaptivePortal511Url) {
         return new URLRequestMockHTTPJob(
             request, network_delegate,
-            root_http.Append(FILE_PATH_LITERAL("captive_portal/page511.html")),
-            base::CreateTaskRunnerWithTraits(kTraits));
+            root_http.Append(FILE_PATH_LITERAL("captive_portal/page511.html")));
       }
       return new URLRequestMockHTTPJob(
           request, network_delegate,
-          root_http.Append(FILE_PATH_LITERAL("captive_portal/login.html")),
-          base::CreateTaskRunnerWithTraits(kTraits));
+          root_http.Append(FILE_PATH_LITERAL("captive_portal/login.html")));
     }
 
     // After logging in to the portal, the test URLs return a 204 response.
     return new URLRequestMockHTTPJob(
         request, network_delegate,
-        root_http.Append(FILE_PATH_LITERAL("captive_portal/page204.html")),
-        base::CreateTaskRunnerWithTraits(kTraits));
+        root_http.Append(FILE_PATH_LITERAL("captive_portal/page204.html")));
   }
 }
 

diff --git a/chrome/browser/chromeos/chrome_browser_main_chromeos.cc b/chrome/browser/chromeos/chrome_browser_main_chromeos.cc
index 136cc7c..42fd5682 100644
--- a/chrome/browser/chromeos/chrome_browser_main_chromeos.cc
+++ b/chrome/browser/chromeos/chrome_browser_main_chromeos.cc

@@ -990,8 +990,8 @@
   // fetch of the initial CrosSettings DeviceRebootOnShutdown policy.
   shutdown_policy_forwarder_ = base::MakeUnique<ShutdownPolicyForwarder>();
 
-  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
-          ash::switches::kAshEnableNightLight)) {
+  if (!base::CommandLine::ForCurrentProcess()->HasSwitch(
+          ash::switches::kAshDisableNightLight)) {
     night_light_client_ = base::MakeUnique<NightLightClient>(
         g_browser_process->system_request_context());
     night_light_client_->Start();

diff --git a/chrome/browser/chromeos/login/chrome_restart_request.cc b/chrome/browser/chromeos/login/chrome_restart_request.cc
index 56bba14..c0254c90 100644
--- a/chrome/browser/chromeos/login/chrome_restart_request.cc
+++ b/chrome/browser/chromeos/login/chrome_restart_request.cc

@@ -49,7 +49,7 @@
 #include "ui/compositor/compositor_switches.h"
 #include "ui/display/display_switches.h"
 #include "ui/events/event_switches.h"
-#include "ui/gfx/switches.h"
+#include "ui/gfx/color_space_switches.h"
 #include "ui/gl/gl_switches.h"
 #include "ui/ozone/public/ozone_switches.h"
 #include "ui/wm/core/wm_core_switches.h"

diff --git a/chrome/browser/chromeos/login/screens/user_selection_screen.cc b/chrome/browser/chromeos/login/screens/user_selection_screen.cc
index 8e0c8c5..8116cb60 100644
--- a/chrome/browser/chromeos/login/screens/user_selection_screen.cc
+++ b/chrome/browser/chromeos/login/screens/user_selection_screen.cc

@@ -337,7 +337,10 @@
       default:
         behavior = multi_profile_user_controller->GetCachedValue(user_id);
     }
-    user_dict->SetString(kKeyMultiProfilesPolicy, behavior);
+    MultiProfileUserController::MultiProfileUserBehavior user_behavior =
+        MultiProfileUserController::UserBehaviorStringToEnum(behavior);
+    user_dict->SetInteger(kKeyMultiProfilesPolicy,
+                          static_cast<int>(user_behavior));
   } else {
     user_dict->SetBoolean(kKeyMultiProfilesAllowed, true);
   }

diff --git a/chrome/browser/chromeos/login/session/chrome_session_manager.cc b/chrome/browser/chromeos/login/session/chrome_session_manager.cc
index d0421356..9e59723 100644
--- a/chrome/browser/chromeos/login/session/chrome_session_manager.cc
+++ b/chrome/browser/chromeos/login/session/chrome_session_manager.cc

@@ -87,7 +87,7 @@
 // 2. Chrome is restarted for Guest session.
 // 3. Chrome is started in browser_tests skipping the login flow.
 // 4. Chrome is started on dev machine i.e. not on Chrome OS device w/o
-//    login flow. In that case --login-user=[user_manager::kStubUser] is
+//    login flow. In that case --login-user=[user_manager::kStubUserEmail] is
 //    added. See PreEarlyInitialization().
 void StartUserSession(Profile* user_profile, const std::string& login_user_id) {
   base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();

diff --git a/chrome/browser/chromeos/login/users/chrome_user_manager_util.cc b/chrome/browser/chromeos/login/users/chrome_user_manager_util.cc
index c0c3697..cec7e9c 100644
--- a/chrome/browser/chromeos/login/users/chrome_user_manager_util.cc
+++ b/chrome/browser/chromeos/login/users/chrome_user_manager_util.cc

@@ -14,7 +14,7 @@
 bool GetPlatformKnownUserId(const std::string& user_email,
                             const std::string& gaia_id,
                             AccountId* out_account_id) {
-  if (user_email == user_manager::kStubUser) {
+  if (user_email == user_manager::kStubUserEmail) {
     *out_account_id = user_manager::StubAccountId();
     return true;
   }

diff --git a/chrome/browser/chromeos/login/users/multi_profile_user_controller.cc b/chrome/browser/chromeos/login/users/multi_profile_user_controller.cc
index 09b79b9..787e73e 100644
--- a/chrome/browser/chromeos/login/users/multi_profile_user_controller.cc
+++ b/chrome/browser/chromeos/login/users/multi_profile_user_controller.cc

@@ -127,6 +127,20 @@
   return ALLOWED;
 }
 
+// static
+MultiProfileUserController::MultiProfileUserBehavior
+MultiProfileUserController::UserBehaviorStringToEnum(
+    const std::string& behavior) {
+  if (behavior == kBehaviorPrimaryOnly)
+    return MultiProfileUserBehavior::kPrimaryOnly;
+  if (behavior == kBehaviorNotAllowed)
+    return MultiProfileUserBehavior::kNotAllowed;
+  if (behavior == kBehaviorOwnerPrimaryOnly)
+    return MultiProfileUserBehavior::kOwnerPrimaryOnly;
+
+  return MultiProfileUserBehavior::kUnrestriced;
+}
+
 bool MultiProfileUserController::IsUserAllowedInSession(
     const std::string& user_email,
     MultiProfileUserController::UserAllowedInSessionReason* reason) const {

diff --git a/chrome/browser/chromeos/login/users/multi_profile_user_controller.h b/chrome/browser/chromeos/login/users/multi_profile_user_controller.h
index 5baf14ff..c397d56 100644
--- a/chrome/browser/chromeos/login/users/multi_profile_user_controller.h
+++ b/chrome/browser/chromeos/login/users/multi_profile_user_controller.h

@@ -55,6 +55,15 @@
     NOT_ALLOWED_POLICY_FORBIDS
   };
 
+  // Supported user behavior values. Keep in sync with the enum in
+  // md_user_pod_row.js and user_pod_row.js
+  enum class MultiProfileUserBehavior {
+    kUnrestriced,
+    kPrimaryOnly,
+    kNotAllowed,
+    kOwnerPrimaryOnly
+  };
+
   MultiProfileUserController(MultiProfileUserControllerDelegate* delegate,
                              PrefService* local_state);
   ~MultiProfileUserController();
@@ -70,6 +79,10 @@
   // NOT_ALLOWED_PRIMARY_USER_POLICY_FORBIDS)
   static UserAllowedInSessionReason GetPrimaryUserPolicy();
 
+  // Returns the user behavior in MultiProfileUserBehavior enum.
+  static MultiProfileUserBehavior UserBehaviorStringToEnum(
+      const std::string& behavior);
+
   // Returns true if user allowed to be in the current session. If |reason| not
   // null stores UserAllowedInSessionReason enum that describes actual reason.
   bool IsUserAllowedInSession(const std::string& user_email,

diff --git a/chrome/browser/devtools/devtools_sanity_browsertest.cc b/chrome/browser/devtools/devtools_sanity_browsertest.cc
index d32ac168..f4ace421 100644
--- a/chrome/browser/devtools/devtools_sanity_browsertest.cc
+++ b/chrome/browser/devtools/devtools_sanity_browsertest.cc

@@ -22,7 +22,6 @@
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
-#include "base/task_scheduler/post_task.h"
 #include "base/test/test_timeouts.h"
 #include "base/threading/thread_restrictions.h"
 #include "base/threading/thread_task_runner_handle.h"
@@ -195,13 +194,7 @@
   PushTimesMockURLRequestJob(net::URLRequest* request,
                              net::NetworkDelegate* network_delegate,
                              base::FilePath file_path)
-      : net::URLRequestMockHTTPJob(
-            request,
-            network_delegate,
-            file_path,
-            base::CreateTaskRunnerWithTraits(
-                {base::MayBlock(), base::TaskPriority::BACKGROUND,
-                 base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN})) {}
+      : net::URLRequestMockHTTPJob(request, network_delegate, file_path) {}
 
   void Start() override {
     load_timing_info_.socket_reused = true;

diff --git a/chrome/browser/flag_descriptions.cc b/chrome/browser/flag_descriptions.cc
index c9876e02..12c367a 100644
--- a/chrome/browser/flag_descriptions.cc
+++ b/chrome/browser/flag_descriptions.cc

@@ -1055,11 +1055,6 @@
     "flag. The trace may include personally identifiable information (PII) "
     "such as the titles and URLs of websites you visit.";
 
-const char kEnableNightLightName[] = "Enable Night Light";
-const char kEnableNightLightDescription[] =
-    "Enable the Night Light feature to control the color temperature of the "
-    "screen.";
-
 const char kEnablePictureInPictureName[] = "Enable picture in picture.";
 
 const char kEnablePictureInPictureDescription[] =
@@ -1081,6 +1076,11 @@
     "With this flag on, desktop share picker window will not let the user "
     "choose whether to share audio.";
 
+const char kDisableNightLightName[] = "Disable Night Light";
+const char kDisableNightLightDescription[] =
+    "Disable the Night Light feature which controls the color temperature of "
+    "the screen.";
+
 const char kDisableTabForDesktopShareName[] =
     "Disable Desktop Share with tab source";
 

diff --git a/chrome/browser/flag_descriptions.h b/chrome/browser/flag_descriptions.h
index 06fac16..5bf504af 100644
--- a/chrome/browser/flag_descriptions.h
+++ b/chrome/browser/flag_descriptions.h

@@ -139,6 +139,9 @@
 extern const char kDisableAudioForDesktopShareName[];
 extern const char kDisableAudioForDesktopShareDescription[];
 
+extern const char kDisableNightLightName[];
+extern const char kDisableNightLightDescription[];
+
 extern const char kDisableTabForDesktopShareName[];
 extern const char kDisableTabForDesktopShareDescription[];
 
@@ -236,9 +239,6 @@
 extern const char kEnableNavigationTracingName[];
 extern const char kEnableNavigationTracingDescription[];
 
-extern const char kEnableNightLightName[];
-extern const char kEnableNightLightDescription[];
-
 extern const char kEnablePictureInPictureName[];
 extern const char kEnablePictureInPictureDescription[];
 

diff --git a/chrome/browser/loader/chrome_resource_dispatcher_host_delegate_browsertest.cc b/chrome/browser/loader/chrome_resource_dispatcher_host_delegate_browsertest.cc
index 33601bb..afd87c1 100644
--- a/chrome/browser/loader/chrome_resource_dispatcher_host_delegate_browsertest.cc
+++ b/chrome/browser/loader/chrome_resource_dispatcher_host_delegate_browsertest.cc

@@ -21,7 +21,6 @@
 #include "base/run_loop.h"
 #include "base/stl_util.h"
 #include "base/strings/string_util.h"
-#include "base/task_scheduler/post_task.h"
 #include "base/test/scoped_command_line.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/download/download_browsertest.h"
@@ -348,12 +347,8 @@
   MirrorMockURLRequestJob(net::URLRequest* request,
                           net::NetworkDelegate* network_delegate,
                           const base::FilePath& file_path,
-                          const scoped_refptr<base::TaskRunner>& task_runner,
                           ReportResponseHeadersOnUI report_on_ui)
-      : net::URLRequestMockHTTPJob(request,
-                                   network_delegate,
-                                   file_path,
-                                   task_runner),
+      : net::URLRequestMockHTTPJob(request, network_delegate, file_path),
         report_on_ui_(report_on_ui) {}
 
   void Start() override {
@@ -390,9 +385,6 @@
       net::NetworkDelegate* network_delegate) const override {
     return new MirrorMockURLRequestJob(
         request, network_delegate, root_http_,
-        base::CreateTaskRunnerWithTraits(
-            {base::MayBlock(), base::TaskPriority::BACKGROUND,
-             base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN}),
         report_on_ui_);
   }
 

diff --git a/chrome/browser/net/dns_probe_browsertest.cc b/chrome/browser/net/dns_probe_browsertest.cc
index dfbdd3f..615102b 100644
--- a/chrome/browser/net/dns_probe_browsertest.cc
+++ b/chrome/browser/net/dns_probe_browsertest.cc

@@ -9,7 +9,6 @@
 #include "base/message_loop/message_loop.h"
 #include "base/path_service.h"
 #include "base/run_loop.h"
-#include "base/task_scheduler/post_task.h"
 #include "base/threading/thread_restrictions.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/io_thread.h"
@@ -181,13 +180,7 @@
       const base::FilePath& file_path,
       bool should_delay,
       const DestructionCallback& destruction_callback)
-      : URLRequestMockHTTPJob(
-            request,
-            network_delegate,
-            file_path,
-            base::CreateTaskRunnerWithTraits(
-                {base::MayBlock(), base::TaskPriority::BACKGROUND,
-                 base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN})),
+      : URLRequestMockHTTPJob(request, network_delegate, file_path),
         should_delay_(should_delay),
         start_delayed_(false),
         destruction_callback_(destruction_callback) {}

diff --git a/chrome/browser/net/errorpage_browsertest.cc b/chrome/browser/net/errorpage_browsertest.cc
index f896e0e..2c0174e 100644
--- a/chrome/browser/net/errorpage_browsertest.cc
+++ b/chrome/browser/net/errorpage_browsertest.cc

@@ -17,8 +17,6 @@
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/synchronization/lock.h"
-#include "base/task_scheduler/post_task.h"
-#include "base/threading/sequenced_worker_pool.h"
 #include "base/threading/thread_restrictions.h"
 #include "base/values.h"
 #include "build/build_config.h"
@@ -260,10 +258,7 @@
     PathService::Get(chrome::DIR_TEST_DATA, &root_http);
     return new net::URLRequestMockHTTPJob(
         request, network_delegate,
-        root_http.AppendASCII("mock-link-doctor.json"),
-        base::CreateTaskRunnerWithTraits(
-            {base::MayBlock(), base::TaskPriority::BACKGROUND,
-             base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN}));
+        root_http.AppendASCII("mock-link-doctor.json"));
   }
 
   void WaitForRequests(int requests_to_wait_for) {
@@ -325,8 +320,7 @@
   net::URLRequestFilter::GetInstance()->AddHostnameInterceptor(
       search_url.scheme(), search_url.host(),
       net::URLRequestMockHTTPJob::CreateInterceptorForSingleFile(
-          root_http.AppendASCII("title3.html"),
-          BrowserThread::GetBlockingPool()));
+          root_http.AppendASCII("title3.html")));
 }
 
 class ErrorPageTest : public InProcessBrowserTest {

diff --git a/chrome/browser/net/url_request_mock_util.cc b/chrome/browser/net/url_request_mock_util.cc
index c870b91..c8252d0 100644
--- a/chrome/browser/net/url_request_mock_util.cc
+++ b/chrome/browser/net/url_request_mock_util.cc

@@ -7,7 +7,6 @@
 #include <string>
 
 #include "base/path_service.h"
-#include "base/threading/sequenced_worker_pool.h"
 #include "base/threading/thread_restrictions.h"
 #include "chrome/common/chrome_paths.h"
 #include "content/public/browser/browser_thread.h"
@@ -38,8 +37,7 @@
 
     base::FilePath root_http;
     PathService::Get(chrome::DIR_TEST_DATA, &root_http);
-    net::URLRequestMockHTTPJob::AddUrlHandlers(
-        root_http, BrowserThread::GetBlockingPool());
+    net::URLRequestMockHTTPJob::AddUrlHandlers(root_http);
   } else {
     // Revert to the default handlers.
     net::URLRequestFilter::GetInstance()->ClearHandlers();

diff --git a/chrome/browser/policy/cloud/cloud_policy_browsertest.cc b/chrome/browser/policy/cloud/cloud_policy_browsertest.cc
index 65247d7b..b99f4160 100644
--- a/chrome/browser/policy/cloud/cloud_policy_browsertest.cc
+++ b/chrome/browser/policy/cloud/cloud_policy_browsertest.cc

@@ -101,7 +101,7 @@
 
 const char* GetTestUser() {
 #if defined(OS_CHROMEOS)
-  return user_manager::kStubUser;
+  return user_manager::kStubUserEmail;
 #else
   return "user@example.com";
 #endif

diff --git a/chrome/browser/policy/cloud/test_request_interceptor.cc b/chrome/browser/policy/cloud/test_request_interceptor.cc
index 1682c34f..59a6efc 100644
--- a/chrome/browser/policy/cloud/test_request_interceptor.cc
+++ b/chrome/browser/policy/cloud/test_request_interceptor.cc

@@ -15,7 +15,6 @@
 #include "base/macros.h"
 #include "base/run_loop.h"
 #include "base/sequenced_task_runner.h"
-#include "base/task_scheduler/post_task.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "net/base/net_errors.h"
 #include "net/base/upload_bytes_element_reader.h"
@@ -62,11 +61,7 @@
 net::URLRequestJob* FileJobCallback(const base::FilePath& file_path,
                                     net::URLRequest* request,
                                     net::NetworkDelegate* network_delegate) {
-  return new net::URLRequestMockHTTPJob(
-      request, network_delegate, file_path,
-      base::CreateTaskRunnerWithTraits(
-          {base::MayBlock(), base::TaskPriority::BACKGROUND,
-           base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN}));
+  return new net::URLRequestMockHTTPJob(request, network_delegate, file_path);
 }
 
 // Parses the upload data in |request| into |request_msg|, and validates the

diff --git a/chrome/browser/policy/policy_browsertest.cc b/chrome/browser/policy/policy_browsertest.cc
index 6465b20..a96dd32 100644
--- a/chrome/browser/policy/policy_browsertest.cc
+++ b/chrome/browser/policy/policy_browsertest.cc

@@ -35,7 +35,6 @@
 #include "base/strings/utf_string_conversions.h"
 #include "base/test/scoped_feature_list.h"
 #include "base/test/test_file_util.h"
-#include "base/threading/sequenced_worker_pool.h"
 #include "base/threading/thread_restrictions.h"
 #include "base/time/time.h"
 #include "base/values.h"
@@ -307,9 +306,8 @@
   for (size_t i = 0; i < size; ++i) {
     const GURL url(urls[i]);
     EXPECT_TRUE(url.is_valid());
-    filter->AddUrlInterceptor(url,
-                              URLRequestMockHTTPJob::CreateInterceptor(
-                                  base_path, BrowserThread::GetBlockingPool()));
+    filter->AddUrlInterceptor(
+        url, URLRequestMockHTTPJob::CreateInterceptor(base_path));
   }
 }
 
@@ -495,7 +493,7 @@
   // Updates of the URLBlacklist are done on IO, after building the blacklist
   // on the blocking pool, which is initiated from IO.
   content::RunAllPendingInMessageLoop(BrowserThread::IO);
-  BrowserThread::GetBlockingPool()->FlushForTesting();
+  content::RunAllBlockingPoolTasksUntilIdle();
   content::RunAllPendingInMessageLoop(BrowserThread::IO);
 }
 
@@ -658,8 +656,7 @@
     PathService::Get(content::DIR_TEST_DATA, &root_http);
     BrowserThread::PostTaskAndReply(
         BrowserThread::IO, FROM_HERE,
-        base::BindOnce(URLRequestMockHTTPJob::AddUrlHandlers, root_http,
-                       make_scoped_refptr(BrowserThread::GetBlockingPool())),
+        base::BindOnce(URLRequestMockHTTPJob::AddUrlHandlers, root_http),
         base::MessageLoop::current()->QuitWhenIdleClosure());
     content::RunMessageLoop();
   }

diff --git a/chrome/browser/prerender/prerender_test_utils.cc b/chrome/browser/prerender/prerender_test_utils.cc
index 05979120..fb07027 100644
--- a/chrome/browser/prerender/prerender_test_utils.cc
+++ b/chrome/browser/prerender/prerender_test_utils.cc

@@ -15,8 +15,6 @@
 #include "base/memory/ptr_util.h"
 #include "base/run_loop.h"
 #include "base/strings/utf_string_conversions.h"
-#include "base/task_scheduler/post_task.h"
-#include "base/threading/sequenced_worker_pool.h"
 #include "chrome/browser/loader/chrome_resource_dispatcher_host_delegate.h"
 #include "chrome/browser/prerender/prerender_manager.h"
 #include "chrome/browser/prerender/prerender_manager_factory.h"
@@ -57,13 +55,7 @@
   MockHTTPJob(net::URLRequest* request,
               net::NetworkDelegate* delegate,
               const base::FilePath& file)
-      : net::URLRequestMockHTTPJob(
-            request,
-            delegate,
-            file,
-            base::CreateTaskRunnerWithTraits(
-                {base::MayBlock(), base::TaskPriority::BACKGROUND,
-                 base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN})) {}
+      : net::URLRequestMockHTTPJob(request, delegate, file) {}
 
   void set_start_callback(const base::Closure& start_callback) {
     start_callback_ = start_callback;
@@ -194,11 +186,7 @@
         callback_.Run(request);
       return new HangingURLRequestJob(request, network_delegate);
     }
-    return new net::URLRequestMockHTTPJob(
-        request, network_delegate, file_,
-        base::CreateTaskRunnerWithTraits(
-            {base::MayBlock(), base::TaskPriority::BACKGROUND,
-             base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN}));
+    return new net::URLRequestMockHTTPJob(request, network_delegate, file_);
   }
 
  private:
@@ -817,8 +805,7 @@
 void CreateMockInterceptorOnIO(const GURL& url, const base::FilePath& file) {
   CHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::IO));
   net::URLRequestFilter::GetInstance()->AddUrlInterceptor(
-      url, net::URLRequestMockHTTPJob::CreateInterceptorForSingleFile(
-               file, content::BrowserThread::GetBlockingPool()));
+      url, net::URLRequestMockHTTPJob::CreateInterceptorForSingleFile(file));
 }
 
 void CreateHangingFirstRequestInterceptor(

diff --git a/chrome/browser/resources/device_log_ui/device_log_ui.html b/chrome/browser/resources/device_log_ui/device_log_ui.html
index 30a1073..50963fe 100644
--- a/chrome/browser/resources/device_log_ui/device_log_ui.html
+++ b/chrome/browser/resources/device_log_ui/device_log_ui.html

@@ -9,7 +9,7 @@
   <script src="chrome://device-log/strings.js"></script>
   <script src="chrome://device-log/device_log_ui.js"></script>
 </head>
-<body style="fontFamily:$i18n{fontfamily};fontSize:$i18n{fontsize};">
+<body style="font-family: $i18n{fontfamily}; font-size: $i18n{fontsize};">
   <div id="header">
     <p>$i18n{autoRefreshText}</p>
   </div>

diff --git a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_fetcher_win.cc b/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_fetcher_win.cc
index eb0b309..2d20c82 100644
--- a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_fetcher_win.cc
+++ b/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_fetcher_win.cc

@@ -18,6 +18,7 @@
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/memory/ref_counted.h"
+#include "base/sequenced_task_runner.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/task_runner_util.h"
 #include "base/task_scheduler/post_task.h"
@@ -26,7 +27,6 @@
 #include "chrome/common/channel_info.h"
 #include "components/data_use_measurement/core/data_use_user_data.h"
 #include "components/version_info/version_info.h"
-#include "content/public/browser/browser_thread.h"
 #include "net/base/load_flags.h"
 #include "net/http/http_request_headers.h"
 #include "net/http/http_status_code.h"
@@ -90,7 +90,7 @@
 
   // We will take ownership of the scoped temp directory once we know that the
   // fetch has succeeded. Must be deleted on a sequence where IO is allowed.
-  std::unique_ptr<base::ScopedTempDir, content::BrowserThread::DeleteOnIOThread>
+  std::unique_ptr<base::ScopedTempDir, base::OnTaskRunnerDeleter>
       scoped_temp_dir_;
   base::FilePath temp_file_;
 
@@ -107,7 +107,8 @@
       blocking_task_runner_(base::CreateSequencedTaskRunnerWithTraits(
           {base::MayBlock(), base::TaskPriority::BACKGROUND,
            base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN})),
-      scoped_temp_dir_(new base::ScopedTempDir()) {
+      scoped_temp_dir_(new base::ScopedTempDir(),
+                       base::OnTaskRunnerDeleter(blocking_task_runner_)) {
   base::PostTaskAndReplyWithResult(
       blocking_task_runner_.get(), FROM_HERE,
       base::Bind(&ChromeCleanerFetcher::CreateTemporaryDirectory,

diff --git a/chrome/browser/ssl/security_state_tab_helper_browser_tests.cc b/chrome/browser/ssl/security_state_tab_helper_browser_tests.cc
index cf5a8ac..34fc79dd 100644
--- a/chrome/browser/ssl/security_state_tab_helper_browser_tests.cc
+++ b/chrome/browser/ssl/security_state_tab_helper_browser_tests.cc

@@ -10,7 +10,6 @@
 #include "base/strings/string_split.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/test/scoped_command_line.h"
-#include "base/threading/sequenced_worker_pool.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/profiles/profile_window.h"
@@ -2007,12 +2006,8 @@
   URLRequestObsoleteTLSJob(net::URLRequest* request,
                            net::NetworkDelegate* network_delegate,
                            const base::FilePath& file_path,
-                           scoped_refptr<net::X509Certificate> cert,
-                           scoped_refptr<base::TaskRunner> task_runner)
-      : net::URLRequestMockHTTPJob(request,
-                                   network_delegate,
-                                   file_path,
-                                   task_runner),
+                           scoped_refptr<net::X509Certificate> cert)
+      : net::URLRequestMockHTTPJob(request, network_delegate, file_path),
         cert_(std::move(cert)) {}
 
   void GetResponseInfo(net::HttpResponseInfo* info) override {
@@ -2039,10 +2034,8 @@
  public:
   URLRequestNonsecureInterceptor(
       const base::FilePath& base_path,
-      scoped_refptr<base::SequencedWorkerPool> worker_pool,
       scoped_refptr<net::X509Certificate> cert)
       : base_path_(base_path),
-        worker_pool_(std::move(worker_pool)),
         cert_(std::move(cert)) {}
 
   ~URLRequestNonsecureInterceptor() override {}
@@ -2051,15 +2044,12 @@
   net::URLRequestJob* MaybeInterceptRequest(
       net::URLRequest* request,
       net::NetworkDelegate* network_delegate) const override {
-    return new URLRequestObsoleteTLSJob(
-        request, network_delegate, base_path_, cert_,
-        worker_pool_->GetTaskRunnerWithShutdownBehavior(
-            base::SequencedWorkerPool::SKIP_ON_SHUTDOWN));
+    return new URLRequestObsoleteTLSJob(request, network_delegate, base_path_,
+                                        cert_);
   }
 
  private:
   const base::FilePath base_path_;
-  const scoped_refptr<base::SequencedWorkerPool> worker_pool_;
   const scoped_refptr<net::X509Certificate> cert_;
 
   DISALLOW_COPY_AND_ASSIGN(URLRequestNonsecureInterceptor);
@@ -2068,15 +2058,13 @@
 // Installs a handler to serve HTTPS requests to
 // |kMockNonsecureHostname| with connections that have obsolete TLS
 // settings.
-void AddNonsecureUrlHandler(
-    const base::FilePath& base_path,
-    scoped_refptr<net::X509Certificate> cert,
-    scoped_refptr<base::SequencedWorkerPool> worker_pool) {
+void AddNonsecureUrlHandler(const base::FilePath& base_path,
+                            scoped_refptr<net::X509Certificate> cert) {
   net::URLRequestFilter* filter = net::URLRequestFilter::GetInstance();
   filter->AddHostnameInterceptor(
       "https", kMockNonsecureHostname,
       std::unique_ptr<net::URLRequestInterceptor>(
-          new URLRequestNonsecureInterceptor(base_path, worker_pool, cert)));
+          new URLRequestNonsecureInterceptor(base_path, cert)));
 }
 
 class BrowserTestNonsecureURLRequest : public InProcessBrowserTest {
@@ -2095,9 +2083,7 @@
     serve_file = serve_file.Append(FILE_PATH_LITERAL("title1.html"));
     content::BrowserThread::PostTask(
         content::BrowserThread::IO, FROM_HERE,
-        base::Bind(
-            &AddNonsecureUrlHandler, serve_file, cert_,
-            make_scoped_refptr(content::BrowserThread::GetBlockingPool())));
+        base::Bind(&AddNonsecureUrlHandler, serve_file, cert_));
   }
 
  private:

diff --git a/chrome/browser/ui/BUILD.gn b/chrome/browser/ui/BUILD.gn
index 02d890b..d8b19e3 100644
--- a/chrome/browser/ui/BUILD.gn
+++ b/chrome/browser/ui/BUILD.gn

@@ -2375,6 +2375,8 @@
       "cocoa/accelerator_utils_cocoa.mm",
       "cocoa/accelerators_cocoa.h",
       "cocoa/accelerators_cocoa.mm",
+      "cocoa/animated_icon.h",
+      "cocoa/animated_icon.mm",
       "cocoa/applescript/apple_event_util.h",
       "cocoa/applescript/apple_event_util.mm",
       "cocoa/applescript/bookmark_folder_applescript.h",

diff --git a/chrome/browser/ui/ash/ash_init.cc b/chrome/browser/ui/ash/ash_init.cc
index e99e43e..bd91d7db 100644
--- a/chrome/browser/ui/ash/ash_init.cc
+++ b/chrome/browser/ui/ash/ash_init.cc

@@ -36,7 +36,6 @@
 #include "chromeos/accelerometer/accelerometer_reader.h"
 #include "chromeos/chromeos_switches.h"
 #include "chromeos/login/login_state.h"
-#include "content/public/browser/browser_thread.h"
 #include "content/public/browser/context_factory.h"
 #include "content/public/common/service_manager_connection.h"
 #include "ui/aura/env.h"
@@ -56,7 +55,6 @@
   shell_init_params.context_factory = content::GetContextFactory();
   shell_init_params.context_factory_private =
       content::GetContextFactoryPrivate();
-  shell_init_params.blocking_pool = content::BrowserThread::GetBlockingPool();
 
   ash::Shell::CreateInstance(shell_init_params);
 }
@@ -81,7 +79,6 @@
       automatically_create_display_roots);
   aura::Env::GetInstance()->SetWindowTreeClient(window_tree_client.get());
   window_manager->Init(std::move(window_tree_client),
-                       content::BrowserThread::GetBlockingPool(),
                        base::MakeUnique<ChromeShellDelegate>());
   CHECK(window_manager->WaitForInitialDisplays());
   return window_manager;

diff --git a/chrome/browser/ui/cocoa/animated_icon.h b/chrome/browser/ui/cocoa/animated_icon.h
new file mode 100644
index 0000000..b932785e
--- /dev/null
+++ b/chrome/browser/ui/cocoa/animated_icon.h

@@ -0,0 +1,59 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_UI_COCOA_ANIMATED_ICON_H_
+#define CHROME_BROWSER_UI_COCOA_ANIMATED_ICON_H_
+
+#import <Cocoa/Cocoa.h>
+
+#include <memory>
+
+#include "base/macros.h"
+#include "base/time/time.h"
+#include "ui/gfx/animation/animation_delegate.h"
+#include "ui/gfx/vector_icon_types.h"
+
+namespace gfx {
+
+class LinearAnimation;
+
+}  // namespace gfx
+
+// This class hosts a vector icon that defines transitions. It can be in the
+// start steady state, the end steady state, or transitioning in between.
+class AnimatedIcon : public gfx::AnimationDelegate {
+ public:
+  AnimatedIcon(const gfx::VectorIcon& icon, NSView* host_view);
+  ~AnimatedIcon() override;
+
+  void set_color(SkColor color) { color_ = color; }
+
+  // Animates the icon.
+  void Animate();
+
+  // Paints the icon on the current drawing context, centered in |frame|.
+  // Requires a NSGraphicsContext to be present.
+  void PaintIcon(NSRect frame);
+
+  // gfx::AnimationDelegate:
+  void AnimationEnded(const gfx::Animation* animation) override;
+  void AnimationProgressed(const gfx::Animation* animation) override;
+
+ private:
+  const gfx::VectorIcon& icon_;
+
+  // The NSView object that's displaying the icon.
+  NSView* const host_view_;
+
+  // The length of the animation.
+  const base::TimeDelta duration_;
+
+  std::unique_ptr<gfx::LinearAnimation> animation_;
+
+  SkColor color_;
+
+  DISALLOW_COPY_AND_ASSIGN(AnimatedIcon);
+};
+
+#endif  // CHROME_BROWSER_UI_COCOA_ANIMATED_ICON_H_

diff --git a/chrome/browser/ui/cocoa/animated_icon.mm b/chrome/browser/ui/cocoa/animated_icon.mm
new file mode 100644
index 0000000..af45966
--- /dev/null
+++ b/chrome/browser/ui/cocoa/animated_icon.mm

@@ -0,0 +1,43 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/ui/cocoa/animated_icon.h"
+
+#include "base/memory/ptr_util.h"
+#include "ui/gfx/animation/linear_animation.h"
+#include "ui/gfx/canvas_skia_paint.h"
+#include "ui/gfx/paint_vector_icon.h"
+
+AnimatedIcon::AnimatedIcon(const gfx::VectorIcon& icon, NSView* host_view)
+    : icon_(icon),
+      host_view_(host_view),
+      duration_(gfx::GetDurationOfAnimation(icon)),
+      animation_(base::MakeUnique<gfx::LinearAnimation>(this)) {
+  animation_->SetDuration(duration_.InMilliseconds());
+}
+
+AnimatedIcon::~AnimatedIcon() {}
+
+void AnimatedIcon::Animate() {
+  animation_->Start();
+}
+
+void AnimatedIcon::PaintIcon(NSRect frame) {
+  gfx::CanvasSkiaPaint canvas(frame, false);
+  canvas.set_composite_alpha(true);
+
+  int size = GetDefaultSizeOfVectorIcon(icon_);
+  canvas.Translate(
+      gfx::Vector2d((NSWidth(frame) - size) / 2, (NSHeight(frame) - size) / 2));
+  base::TimeDelta elapsed = animation_->GetCurrentValue() * duration_;
+  gfx::PaintVectorIcon(&canvas, icon_, color_, elapsed);
+
+  canvas.Restore();
+}
+
+void AnimatedIcon::AnimationEnded(const gfx::Animation* animation) {}
+
+void AnimatedIcon::AnimationProgressed(const gfx::Animation* animation) {
+  [host_view_ setNeedsDisplay:YES];
+}

diff --git a/chrome/browser/ui/cocoa/app_menu/app_menu_controller.mm b/chrome/browser/ui/cocoa/app_menu/app_menu_controller.mm
index c333a96..e5f135a 100644
--- a/chrome/browser/ui/cocoa/app_menu/app_menu_controller.mm
+++ b/chrome/browser/ui/cocoa/app_menu/app_menu_controller.mm

@@ -30,6 +30,7 @@
 #import "chrome/browser/ui/cocoa/extensions/browser_actions_container_view.h"
 #import "chrome/browser/ui/cocoa/extensions/browser_actions_controller.h"
 #import "chrome/browser/ui/cocoa/l10n_util.h"
+#import "chrome/browser/ui/cocoa/toolbar/app_toolbar_button.h"
 #import "chrome/browser/ui/cocoa/toolbar/toolbar_controller.h"
 #include "chrome/browser/ui/toolbar/app_menu_model.h"
 #include "chrome/browser/ui/toolbar/recent_tabs_sub_menu_model.h"
@@ -372,6 +373,13 @@
   [[buttonViewController_ zoomFullScreen] setImage:icon];
 
   menuOpenTime_ = base::TimeTicks::Now();
+
+  BrowserWindowController* bwc = [BrowserWindowController
+      browserWindowControllerForWindow:browser_->window()->GetNativeWindow()];
+
+  AppToolbarButton* appMenuButton =
+      static_cast<AppToolbarButton*>([[bwc toolbarController] appMenuButton]);
+  [appMenuButton animateIfPossible];
 }
 
 - (void)menuDidClose:(NSMenu*)menu {

diff --git a/chrome/browser/ui/cocoa/browser_window_controller.mm b/chrome/browser/ui/cocoa/browser_window_controller.mm
index 0970603..710ff90 100644
--- a/chrome/browser/ui/cocoa/browser_window_controller.mm
+++ b/chrome/browser/ui/cocoa/browser_window_controller.mm

@@ -78,6 +78,7 @@
 #import "chrome/browser/ui/cocoa/tabs/tab_strip_controller.h"
 #import "chrome/browser/ui/cocoa/tabs/tab_strip_view.h"
 #import "chrome/browser/ui/cocoa/tabs/tab_view.h"
+#import "chrome/browser/ui/cocoa/toolbar/app_toolbar_button.h"
 #import "chrome/browser/ui/cocoa/toolbar/toolbar_controller.h"
 #include "chrome/browser/ui/cocoa/translate/translate_bubble_bridge_views.h"
 #import "chrome/browser/ui/cocoa/translate/translate_bubble_controller.h"
@@ -1527,6 +1528,12 @@
 - (void)onTabInsertedInForeground:(BOOL)inForeground {
   if ([self isInAnyFullscreenMode] && !inForeground)
     [[self fullscreenToolbarController] revealToolbarForTabStripChanges];
+
+  if (inForeground) {
+    AppToolbarButton* appMenuButton =
+        static_cast<AppToolbarButton*>([toolbarController_ appMenuButton]);
+    [appMenuButton animateIfPossible];
+  }
 }
 
 - (void)userChangedTheme {

diff --git a/chrome/browser/ui/cocoa/toolbar/app_toolbar_button.h b/chrome/browser/ui/cocoa/toolbar/app_toolbar_button.h
index bc4ef68..8b9daa61 100644
--- a/chrome/browser/ui/cocoa/toolbar/app_toolbar_button.h
+++ b/chrome/browser/ui/cocoa/toolbar/app_toolbar_button.h

@@ -12,17 +12,24 @@
 #import "chrome/browser/ui/cocoa/menu_button.h"
 #include "chrome/browser/ui/toolbar/app_menu_icon_controller.h"
 
+class AnimatedIcon;
+
 // Button for the app toolbar button.
 @interface AppToolbarButton : MenuButton {
  @private
   AppMenuIconController::Severity severity_;
   AppMenuIconController::IconType type_;
+
+  // Used for animating and drawing the icon.
+  std::unique_ptr<AnimatedIcon> animatedIcon_;
 }
 
 - (void)setSeverity:(AppMenuIconController::Severity)severity
            iconType:(AppMenuIconController::IconType)iconType
       shouldAnimate:(BOOL)shouldAnimate;
 
+- (void)animateIfPossible;
+
 @end
 
 #endif  // CHROME_BROWSER_UI_COCOA_TOOLBAR_APP_TOOLBAR_BUTTON_H_

diff --git a/chrome/browser/ui/cocoa/toolbar/app_toolbar_button.mm b/chrome/browser/ui/cocoa/toolbar/app_toolbar_button.mm
index 14396d5..2027435 100644
--- a/chrome/browser/ui/cocoa/toolbar/app_toolbar_button.mm
+++ b/chrome/browser/ui/cocoa/toolbar/app_toolbar_button.mm

@@ -4,10 +4,15 @@
 
 #import "chrome/browser/ui/cocoa/toolbar/app_toolbar_button.h"
 
+#include "base/command_line.h"
 #include "base/macros.h"
 #include "chrome/app/vector_icons/vector_icons.h"
+#import "chrome/browser/themes/theme_properties.h"
+#include "chrome/browser/themes/theme_service.h"
+#include "chrome/browser/ui/cocoa/animated_icon.h"
 #import "chrome/browser/ui/cocoa/themed_window.h"
 #import "chrome/browser/ui/cocoa/view_id_util.h"
+#include "chrome/common/chrome_switches.h"
 #include "chrome/grit/chromium_strings.h"
 #include "ui/base/l10n/l10n_util_mac.h"
 #include "ui/base/material_design/material_design_controller.h"
@@ -16,6 +21,9 @@
 
 @interface AppToolbarButton ()
 - (void)commonInit;
+- (void)updateAnimatedIconColor;
+- (SkColor)vectorIconBaseColor:(BOOL)themeIsDark;
+- (void)updateAnimatedIconColor;
 @end
 
 @implementation AppToolbarButton
@@ -23,14 +31,42 @@
 - (instancetype)initWithFrame:(NSRect)frame {
   if ((self = [super initWithFrame:frame])) {
     [self commonInit];
+
+    base::CommandLine* commandLine = base::CommandLine::ForCurrentProcess();
+    if (commandLine->HasSwitch(switches::kEnableNewAppMenuIcon)) {
+      animatedIcon_.reset(new AnimatedIcon(kBrowserToolsAnimatedIcon, self));
+      [self updateAnimatedIconColor];
+
+      NSNotificationCenter* center = [NSNotificationCenter defaultCenter];
+      [center addObserver:self
+                 selector:@selector(themeDidChangeNotification:)
+                     name:kBrowserThemeDidChangeNotification
+                   object:nil];
+    }
   }
   return self;
 }
 
+- (void)dealloc {
+  [[NSNotificationCenter defaultCenter] removeObserver:self];
+  [super dealloc];
+}
+
 - (void)awakeFromNib {
   [self commonInit];
 }
 
+- (void)viewDidMoveToWindow {
+  [self updateAnimatedIconColor];
+}
+
+- (void)drawRect:(NSRect)frame {
+  [super drawRect:frame];
+
+  if (animatedIcon_)
+    animatedIcon_->PaintIcon(frame);
+}
+
 - (void)commonInit {
   view_id_util::SetID(self, VIEW_ID_APP_MENU);
   severity_ = AppMenuIconController::Severity::NONE;
@@ -38,7 +74,30 @@
   [self setToolTip:l10n_util::GetNSString(IDS_APPMENU_TOOLTIP)];
 }
 
+- (SkColor)vectorIconBaseColor:(BOOL)themeIsDark {
+  const ui::ThemeProvider* provider = [[self window] themeProvider];
+  return themeIsDark ? SK_ColorWHITE
+                     : (provider && provider->ShouldIncreaseContrast()
+                            ? SK_ColorBLACK
+                            : gfx::kChromeIconGrey);
+}
+
+- (void)updateAnimatedIconColor {
+  if (!animatedIcon_)
+    return;
+
+  const ui::ThemeProvider* provider = [[self window] themeProvider];
+  BOOL themeIsDark = [[self window] hasDarkTheme];
+  SkColor color = provider && provider->UsingSystemTheme()
+                      ? [self vectorIconColor:themeIsDark]
+                      : [self vectorIconBaseColor:themeIsDark];
+  animatedIcon_->set_color(color);
+}
+
 - (const gfx::VectorIcon*)vectorIcon {
+  if (animatedIcon_)
+    return nullptr;
+
   switch (type_) {
     case AppMenuIconController::IconType::NONE:
       DCHECK_EQ(severity_, AppMenuIconController::Severity::NONE);
@@ -54,13 +113,9 @@
 }
 
 - (SkColor)vectorIconColor:(BOOL)themeIsDark {
-  const ui::ThemeProvider* provider = [[self window] themeProvider];
   switch (severity_) {
     case AppMenuIconController::Severity::NONE:
-      return themeIsDark ? SK_ColorWHITE
-                         : (provider && provider->ShouldIncreaseContrast()
-                                ? SK_ColorBLACK
-                                : gfx::kChromeIconGrey);
+      return [self vectorIconBaseColor:themeIsDark];
       break;
 
     case AppMenuIconController::Severity::LOW:
@@ -86,9 +141,24 @@
   if (severity != severity_ || type != type_) {
     severity_ = severity;
     type_ = type;
-    // Update the button state images with the new severity color or icon type.
+
+    if (animatedIcon_) {
+      [self updateAnimatedIconColor];
+      animatedIcon_->Animate();
+    }
+    // Update the button state images with the new severity color or icon
+    // type.
     [self resetButtonStateImages];
   }
 }
 
+- (void)themeDidChangeNotification:(NSNotification*)aNotification {
+  [self updateAnimatedIconColor];
+}
+
+- (void)animateIfPossible {
+  if (animatedIcon_ && severity_ != AppMenuIconController::Severity::NONE)
+    animatedIcon_->Animate();
+}
+
 @end

diff --git a/chrome/browser/ui/libgtkui/gtk_ui.cc b/chrome/browser/ui/libgtkui/gtk_ui.cc
index eb8eb01..d8ce7ba 100644
--- a/chrome/browser/ui/libgtkui/gtk_ui.cc
+++ b/chrome/browser/ui/libgtkui/gtk_ui.cc

@@ -312,52 +312,15 @@
   return params;
 }
 
-float GtkDpiToScaleFactor(int dpi) {
-  // GTK multiplies the DPI by 1024 before storing it.
-  return dpi / (1024 * kDefaultDPI);
-}
-
-gint GetGdkScreenSettingInt(const char* setting_name) {
-  GValue value = G_VALUE_INIT;
-  g_value_init(&value, G_TYPE_INT);
-  if (!gdk_screen_get_setting(gdk_screen_get_default(), setting_name, &value))
-    return -1;
-  return g_value_get_int(&value);
-}
-
-float GetScaleFromGdkScreenSettings() {
-  gint window_scale = GetGdkScreenSettingInt("gdk-window-scaling-factor");
-  if (window_scale <= 0)
-    return -1;
-  gint font_dpi = GetGdkScreenSettingInt("gdk-unscaled-dpi");
-  if (font_dpi <= 0)
-    return -1;
-  return window_scale * GtkDpiToScaleFactor(font_dpi);
-}
-
-float GetScaleFromXftDPI() {
-  GtkSettings* gtk_settings = gtk_settings_get_default();
-  CHECK(gtk_settings);
-  gint gtk_dpi = -1;
-  g_object_get(gtk_settings, "gtk-xft-dpi", &gtk_dpi, nullptr);
-  if (gtk_dpi <= 0)
-    return -1;
-  return GtkDpiToScaleFactor(gtk_dpi);
-}
-
 float GetRawDeviceScaleFactor() {
   if (display::Display::HasForceDeviceScaleFactor())
     return display::Display::GetForcedDeviceScaleFactor();
 
-  float scale = GetScaleFromGdkScreenSettings();
-  if (scale > 0)
-    return scale;
-
-  scale = GetScaleFromXftDPI();
-  if (scale > 0)
-    return scale;
-
-  return 1;
+  GdkScreen* screen = gdk_screen_get_default();
+  gint scale = gdk_screen_get_monitor_scale_factor(
+      screen, gdk_screen_get_primary_monitor(screen));
+  gdouble resolution = gdk_screen_get_resolution(screen);
+  return resolution <= 0 ? scale : resolution * scale / kDefaultDPI;
 }
 
 views::LinuxUI::NonClientMiddleClickAction GetDefaultMiddleClickAction() {

diff --git a/chrome/browser/ui/libgtkui/print_dialog_gtk.cc b/chrome/browser/ui/libgtkui/print_dialog_gtk.cc
index 8ac31ac..9a79bce 100644
--- a/chrome/browser/ui/libgtkui/print_dialog_gtk.cc
+++ b/chrome/browser/ui/libgtkui/print_dialog_gtk.cc

@@ -17,6 +17,7 @@
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/strings/utf_string_conversions.h"
+#include "base/task_scheduler/post_task.h"
 #include "base/values.h"
 #include "chrome/browser/ui/libgtkui/gtk_util.h"
 #include "chrome/browser/ui/libgtkui/printing_gtk_util.h"
@@ -530,9 +531,12 @@
     LOG(ERROR) << "Printing failed: " << error->message;
   if (print_job)
     g_object_unref(print_job);
-  BrowserThread::PostTask(BrowserThread::FILE, FROM_HERE,
-                          base::BindOnce(base::IgnoreResult(&base::DeleteFile),
-                                         path_to_pdf_, false));
+
+  base::PostTaskWithTraits(FROM_HERE,
+                           {base::MayBlock(), base::TaskPriority::BACKGROUND,
+                            base::TaskShutdownBehavior::BLOCK_SHUTDOWN},
+                           base::BindOnce(base::IgnoreResult(&base::DeleteFile),
+                                          path_to_pdf_, false));
   // Printing finished. Matches AddRef() in PrintDocument();
   Release();
 }

diff --git a/chrome/browser/ui/libgtkui/select_file_dialog_impl_kde.cc b/chrome/browser/ui/libgtkui/select_file_dialog_impl_kde.cc
index 53e4230..f609b4b 100644
--- a/chrome/browser/ui/libgtkui/select_file_dialog_impl_kde.cc
+++ b/chrome/browser/ui/libgtkui/select_file_dialog_impl_kde.cc

@@ -21,6 +21,8 @@
 #include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
+#include "base/task_scheduler/post_task.h"
+#include "base/task_scheduler/task_traits.h"
 #include "base/threading/thread_restrictions.h"
 #include "chrome/browser/ui/libgtkui/select_file_dialog_impl.h"
 #include "content/public/browser/browser_thread.h"
@@ -173,6 +175,9 @@
   // dialogs. This should only be accessed on the UI thread.
   std::set<XID> parents_;
 
+  // A task runner for blocking pipe reads.
+  scoped_refptr<base::SequencedTaskRunner> pipe_task_runner_;
+
   DISALLOW_COPY_AND_ASSIGN(SelectFileDialogImplKDE);
 };
 
@@ -203,7 +208,10 @@
     ui::SelectFilePolicy* policy,
     base::nix::DesktopEnvironment desktop)
     : SelectFileDialogImpl(listener, policy),
-      desktop_(desktop) {
+      desktop_(desktop),
+      pipe_task_runner_(base::CreateSequencedTaskRunnerWithTraits(
+          {base::MayBlock(), base::TaskPriority::USER_BLOCKING,
+           base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN})) {
   DCHECK(desktop_ == base::nix::DESKTOP_ENVIRONMENT_KDE3 ||
          desktop_ == base::nix::DESKTOP_ENVIRONMENT_KDE4 ||
          desktop_ == base::nix::DESKTOP_ENVIRONMENT_KDE5);
@@ -278,7 +286,7 @@
 }
 
 std::string SelectFileDialogImplKDE::GetMimeTypeFilterString() {
-  DCHECK_CURRENTLY_ON(BrowserThread::FILE);
+  DCHECK(pipe_task_runner_->RunsTasksInCurrentSequence());
   std::string filter_string;
   // We need a filter set because the same mime type can appear multiple times.
   std::set<std::string> filter_set;
@@ -306,7 +314,7 @@
 
 std::unique_ptr<SelectFileDialogImplKDE::KDialogOutputParams>
 SelectFileDialogImplKDE::CallKDialogOutput(const KDialogParams& params) {
-  DCHECK_CURRENTLY_ON(BrowserThread::FILE);
+  DCHECK(pipe_task_runner_->RunsTasksInCurrentSequence());
   base::CommandLine::StringVector cmd_vector;
   cmd_vector.push_back(kKdialogBinary);
   base::CommandLine command_line(cmd_vector);
@@ -396,61 +404,62 @@
   int title_message_id = (type == SELECT_UPLOAD_FOLDER)
       ? IDS_SELECT_UPLOAD_FOLDER_DIALOG_TITLE
       : IDS_SELECT_FOLDER_DIALOG_TITLE;
-  BrowserThread::PostTaskAndReplyWithResult(
-      BrowserThread::FILE, FROM_HERE,
-      base::Bind(
+  base::PostTaskAndReplyWithResult(
+      pipe_task_runner_.get(), FROM_HERE,
+      base::BindOnce(
           &SelectFileDialogImplKDE::CallKDialogOutput, this,
           KDialogParams(
               "--getexistingdirectory", GetTitle(title, title_message_id),
               default_path.empty() ? *last_opened_path_ : default_path, parent,
               false, false)),
-      base::Bind(&SelectFileDialogImplKDE::OnSelectSingleFolderDialogResponse,
-                 this, parent, params));
+      base::BindOnce(
+          &SelectFileDialogImplKDE::OnSelectSingleFolderDialogResponse, this,
+          parent, params));
 }
 
 void SelectFileDialogImplKDE::CreateFileOpenDialog(
     const std::string& title, const base::FilePath& default_path,
     XID parent, void* params) {
-  BrowserThread::PostTaskAndReplyWithResult(
-      BrowserThread::FILE, FROM_HERE,
-      base::Bind(
+  base::PostTaskAndReplyWithResult(
+      pipe_task_runner_.get(), FROM_HERE,
+      base::BindOnce(
           &SelectFileDialogImplKDE::CallKDialogOutput, this,
           KDialogParams(
               "--getopenfilename", GetTitle(title, IDS_OPEN_FILE_DIALOG_TITLE),
               default_path.empty() ? *last_opened_path_ : default_path, parent,
               true, false)),
-      base::Bind(&SelectFileDialogImplKDE::OnSelectSingleFileDialogResponse,
-                 this, parent, params));
+      base::BindOnce(&SelectFileDialogImplKDE::OnSelectSingleFileDialogResponse,
+                     this, parent, params));
 }
 
 void SelectFileDialogImplKDE::CreateMultiFileOpenDialog(
     const std::string& title, const base::FilePath& default_path,
     XID parent, void* params) {
-  BrowserThread::PostTaskAndReplyWithResult(
-      BrowserThread::FILE, FROM_HERE,
-      base::Bind(
+  base::PostTaskAndReplyWithResult(
+      pipe_task_runner_.get(), FROM_HERE,
+      base::BindOnce(
           &SelectFileDialogImplKDE::CallKDialogOutput, this,
           KDialogParams(
               "--getopenfilename", GetTitle(title, IDS_OPEN_FILES_DIALOG_TITLE),
               default_path.empty() ? *last_opened_path_ : default_path, parent,
               true, true)),
-      base::Bind(&SelectFileDialogImplKDE::OnSelectMultiFileDialogResponse,
-                 this, parent, params));
+      base::BindOnce(&SelectFileDialogImplKDE::OnSelectMultiFileDialogResponse,
+                     this, parent, params));
 }
 
 void SelectFileDialogImplKDE::CreateSaveAsDialog(
     const std::string& title, const base::FilePath& default_path,
     XID parent, void* params) {
-  BrowserThread::PostTaskAndReplyWithResult(
-      BrowserThread::FILE, FROM_HERE,
-      base::Bind(
+  base::PostTaskAndReplyWithResult(
+      pipe_task_runner_.get(), FROM_HERE,
+      base::BindOnce(
           &SelectFileDialogImplKDE::CallKDialogOutput, this,
           KDialogParams("--getsavefilename",
                         GetTitle(title, IDS_SAVE_AS_DIALOG_TITLE),
                         default_path.empty() ? *last_saved_path_ : default_path,
                         parent, true, false)),
-      base::Bind(&SelectFileDialogImplKDE::OnSelectSingleFileDialogResponse,
-                 this, parent, params));
+      base::BindOnce(&SelectFileDialogImplKDE::OnSelectSingleFileDialogResponse,
+                     this, parent, params));
 }
 
 void SelectFileDialogImplKDE::SelectSingleFileHelper(

diff --git a/chrome/browser/ui/search/new_tab_page_interceptor_browsertest.cc b/chrome/browser/ui/search/new_tab_page_interceptor_browsertest.cc
index dba9d0be..3a895d9 100644
--- a/chrome/browser/ui/search/new_tab_page_interceptor_browsertest.cc
+++ b/chrome/browser/ui/search/new_tab_page_interceptor_browsertest.cc

@@ -5,7 +5,6 @@
 #include "base/files/file_path.h"
 #include "base/memory/ptr_util.h"
 #include "base/strings/utf_string_conversions.h"
-#include "base/threading/sequenced_worker_pool.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/search/search.h"
 #include "chrome/browser/search_engines/template_url_service_factory.h"
@@ -26,15 +25,6 @@
 
 using content::BrowserThread;
 
-namespace {
-
-void SetUrlRequestMock(const base::FilePath& path) {
-  net::URLRequestMockHTTPJob::AddUrlHandlers(path,
-                                             BrowserThread::GetBlockingPool());
-}
-
-}  // namespace
-
 class NewTabPageInterceptorTest : public InProcessBrowserTest {
  public:
   NewTabPageInterceptorTest() {}
@@ -42,8 +32,9 @@
   void SetUpOnMainThread() override {
     base::FilePath path =
         ui_test_utils::GetTestFilePath(base::FilePath(), base::FilePath());
-    BrowserThread::PostTask(BrowserThread::IO, FROM_HERE,
-                            base::BindOnce(&SetUrlRequestMock, path));
+    BrowserThread::PostTask(
+        BrowserThread::IO, FROM_HERE,
+        base::BindOnce(&net::URLRequestMockHTTPJob::AddUrlHandlers, path));
   }
 
   void ChangeDefaultSearchProvider(const char* new_tab_path) {

diff --git a/chrome/browser/ui/views/payments/payment_request_completion_status_metrics_browsertest.cc b/chrome/browser/ui/views/payments/payment_request_completion_status_metrics_browsertest.cc
index a72b89e..08ad90c8 100644
--- a/chrome/browser/ui/views/payments/payment_request_completion_status_metrics_browsertest.cc
+++ b/chrome/browser/ui/views/payments/payment_request_completion_status_metrics_browsertest.cc

@@ -51,6 +51,14 @@
   PayWithCreditCardAndWait(base::ASCIIToUTF16("123"));
 
   // Make sure the metrics are logged correctly.
+  histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Initiated",
+                                      1, 1);
+  histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Shown", 1,
+                                      1);
+  histogram_tester.ExpectUniqueSample(
+      "PaymentRequest.CheckoutFunnel.PayClicked", 1, 1);
+  histogram_tester.ExpectUniqueSample(
+      "PaymentRequest.CheckoutFunnel.ReceivedInstrumentDetails", 1, 1);
   histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Completed",
                                       1, 1);
 }
@@ -71,6 +79,10 @@
   WaitForObservedEvent();
 
   // Make sure the metrics are logged correctly.
+  histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Initiated",
+                                      1, 1);
+  histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Shown", 1,
+                                      1);
   histogram_tester.ExpectUniqueSample(
       "PaymentRequest.CheckoutFunnel.Aborted",
       JourneyLogger::ABORT_REASON_MERCHANT_NAVIGATION, 1);
@@ -94,6 +106,10 @@
   WaitForObservedEvent();
 
   // Make sure the metrics are logged correctly.
+  histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Initiated",
+                                      1, 1);
+  histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Shown", 1,
+                                      1);
   histogram_tester.ExpectUniqueSample(
       "PaymentRequest.CheckoutFunnel.Aborted",
       JourneyLogger::ABORT_REASON_MERCHANT_NAVIGATION, 1);
@@ -118,6 +134,10 @@
   WaitForObservedEvent();
 
   // Make sure the metrics are logged correctly.
+  histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Initiated",
+                                      1, 1);
+  histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Shown", 1,
+                                      1);
   histogram_tester.ExpectUniqueSample(
       "PaymentRequest.CheckoutFunnel.Aborted",
       JourneyLogger::ABORT_REASON_ABORTED_BY_MERCHANT, 1);
@@ -136,6 +156,10 @@
   NavigateTo("/payment_request_email_test.html");
 
   // Make sure the metrics are logged correctly.
+  histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Initiated",
+                                      1, 1);
+  histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Shown", 1,
+                                      1);
   histogram_tester.ExpectUniqueSample(
       "PaymentRequest.CheckoutFunnel.Aborted",
       JourneyLogger::ABORT_REASON_USER_NAVIGATION, 1);
@@ -154,6 +178,10 @@
   ClickOnCancel();
 
   // Make sure the metrics are logged correctly.
+  histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Initiated",
+                                      1, 1);
+  histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Shown", 1,
+                                      1);
   histogram_tester.ExpectUniqueSample(
       "PaymentRequest.CheckoutFunnel.Aborted",
       JourneyLogger::ABORT_REASON_ABORTED_BY_USER, 1);
@@ -174,6 +202,10 @@
   WaitForObservedEvent();
 
   // Make sure the metrics are logged correctly.
+  histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Initiated",
+                                      1, 1);
+  histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Shown", 1,
+                                      1);
   histogram_tester.ExpectUniqueSample(
       "PaymentRequest.CheckoutFunnel.Aborted",
       JourneyLogger::ABORT_REASON_ABORTED_BY_USER, 1);
@@ -194,6 +226,10 @@
   WaitForObservedEvent();
 
   // Make sure the metrics are logged correctly.
+  histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Initiated",
+                                      1, 1);
+  histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Shown", 1,
+                                      1);
   histogram_tester.ExpectUniqueSample(
       "PaymentRequest.CheckoutFunnel.Aborted",
       JourneyLogger::ABORT_REASON_USER_NAVIGATION, 1);

diff --git a/chrome/browser/ui/views/payments/payment_request_journey_logger_browsertest.cc b/chrome/browser/ui/views/payments/payment_request_journey_logger_browsertest.cc
index a6cf5d2..b017fc6 100644
--- a/chrome/browser/ui/views/payments/payment_request_journey_logger_browsertest.cc
+++ b/chrome/browser/ui/views/payments/payment_request_journey_logger_browsertest.cc

@@ -44,6 +44,14 @@
   ResetEventObserver(DialogEvent::DIALOG_CLOSED);
   PayWithCreditCardAndWait(base::ASCIIToUTF16("123"));
 
+  histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Initiated",
+                                      1, 1);
+  histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Shown", 1,
+                                      1);
+  histogram_tester.ExpectUniqueSample(
+      "PaymentRequest.CheckoutFunnel.PayClicked", 1, 1);
+  histogram_tester.ExpectUniqueSample(
+      "PaymentRequest.CheckoutFunnel.ReceivedInstrumentDetails", 1, 1);
   // Expect a credit card as the selected payment instrument in the metrics.
   histogram_tester.ExpectBucketCount(
       "PaymentRequest.SelectedPaymentMethod",
@@ -72,6 +80,8 @@
   ASSERT_TRUE(content::ExecuteScript(web_contents, click_buy_button_js));
   WaitForObservedEvent();
 
+  histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Initiated",
+                                      1, 1);
   histogram_tester.ExpectBucketCount(
       "PaymentRequest.CheckoutFunnel.NoShow",
       JourneyLogger::NOT_SHOWN_REASON_NO_SUPPORTED_PAYMENT_METHOD, 1);
@@ -117,7 +127,15 @@
       histogram_tester.GetAllSamples("PaymentRequest.CheckoutFunnel.NoShow")
           .empty());
 
-  // Expect that the completion was logged correctly.
+  // Expect that other metrics were logged correctly.
+  histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Initiated",
+                                      1, 1);
+  histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Shown", 1,
+                                      1);
+  histogram_tester.ExpectUniqueSample(
+      "PaymentRequest.CheckoutFunnel.PayClicked", 1, 1);
+  histogram_tester.ExpectUniqueSample(
+      "PaymentRequest.CheckoutFunnel.ReceivedInstrumentDetails", 1, 1);
   histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Completed",
                                       1, 1);
 }
@@ -152,6 +170,15 @@
   // Complete the original Payment Request.
   PayWithCreditCardAndWait(base::ASCIIToUTF16("123"), first_dialog_view);
 
+  histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Initiated",
+                                      1, 2);
+  histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Shown", 1,
+                                      1);
+  histogram_tester.ExpectUniqueSample(
+      "PaymentRequest.CheckoutFunnel.PayClicked", 1, 1);
+  histogram_tester.ExpectUniqueSample(
+      "PaymentRequest.CheckoutFunnel.ReceivedInstrumentDetails", 1, 1);
+
   // The metrics should show that the original Payment Request should be
   // completed and the second one should not have been shown.
   histogram_tester.ExpectUniqueSample("PaymentRequest.CheckoutFunnel.Completed",

diff --git a/chrome/browser/win/jumplist.cc b/chrome/browser/win/jumplist.cc
index 35f07fcb..bbca0370 100644
--- a/chrome/browser/win/jumplist.cc
+++ b/chrome/browser/win/jumplist.cc

@@ -431,7 +431,8 @@
     link->set_title(!url.title.empty() ? url.title : url_string_wide);
     link->set_url(url_string);
     most_visited_pages_.push_back(link);
-    icon_urls_.emplace_back(std::move(url_string), std::move(link));
+    if (most_visited_icons_.find(url_string) == most_visited_icons_.end())
+      icon_urls_.emplace_back(std::move(url_string), std::move(link));
   }
 
   most_visited_should_update_ = true;
@@ -459,7 +460,8 @@
   link->set_title(current_navigation.title());
   link->set_url(url);
   recently_closed_pages_.push_back(link);
-  icon_urls_.emplace_back(std::move(url), std::move(link));
+  if (recently_closed_icons_.find(url) == recently_closed_icons_.end())
+    icon_urls_.emplace_back(std::move(url), std::move(link));
 
   return true;
 }

diff --git a/chrome/test/base/ash_test_environment_chrome.cc b/chrome/test/base/ash_test_environment_chrome.cc
index fa5899f5..1e94c07 100644
--- a/chrome/test/base/ash_test_environment_chrome.cc
+++ b/chrome/test/base/ash_test_environment_chrome.cc

@@ -6,18 +6,12 @@
 
 #include "ash/test/ash_test_views_delegate.h"
 #include "base/memory/ptr_util.h"
-#include "base/message_loop/message_loop.h"
-#include "content/public/browser/browser_thread.h"
 #include "ui/views/views_delegate.h"
 
 AshTestEnvironmentChrome::AshTestEnvironmentChrome() {}
 
 AshTestEnvironmentChrome::~AshTestEnvironmentChrome() {}
 
-base::SequencedWorkerPool* AshTestEnvironmentChrome::GetBlockingPool() {
-  return content::BrowserThread::GetBlockingPool();
-}
-
 std::unique_ptr<ash::test::AshTestViewsDelegate>
 AshTestEnvironmentChrome::CreateViewsDelegate() {
   return base::MakeUnique<ash::test::AshTestViewsDelegate>();

diff --git a/chrome/test/base/ash_test_environment_chrome.h b/chrome/test/base/ash_test_environment_chrome.h
index 38199fc..5388d6d 100644
--- a/chrome/test/base/ash_test_environment_chrome.h
+++ b/chrome/test/base/ash_test_environment_chrome.h

@@ -14,7 +14,6 @@
   ~AshTestEnvironmentChrome() override;
 
   // AshTestEnvironment:
-  base::SequencedWorkerPool* GetBlockingPool() override;
   std::unique_ptr<ash::test::AshTestViewsDelegate> CreateViewsDelegate()
       override;
 

diff --git a/chrome/test/base/view_event_test_platform_part_chromeos.cc b/chrome/test/base/view_event_test_platform_part_chromeos.cc
index c68efb61..99e485f 100644
--- a/chrome/test/base/view_event_test_platform_part_chromeos.cc
+++ b/chrome/test/base/view_event_test_platform_part_chromeos.cc

@@ -16,7 +16,6 @@
 #include "chromeos/audio/cras_audio_handler.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "chromeos/network/network_handler.h"
-#include "content/public/browser/browser_thread.h"
 #include "device/bluetooth/dbus/bluez_dbus_manager.h"
 #include "ui/aura/env.h"
 #include "ui/aura/window_tree_host.h"
@@ -66,7 +65,6 @@
   init_params.delegate = shell_delegate;
   init_params.context_factory = context_factory;
   init_params.context_factory_private = context_factory_private;
-  init_params.blocking_pool = content::BrowserThread::GetBlockingPool();
   base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
       switches::kHostWindowBounds, "0+0-1280x800");
   ash::Shell::CreateInstance(init_params);

diff --git a/chrome/test/data/payments/.eslintrc.js b/chrome/test/data/payments/.eslintrc.js
new file mode 100644
index 0000000..ae5ba4a
--- /dev/null
+++ b/chrome/test/data/payments/.eslintrc.js

@@ -0,0 +1,97 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module.exports = {
+  'env': {
+    'browser': true,
+    'es6': true,
+  },
+  'rules': {
+    'no-restricted-properties': 0,
+    'no-irregular-whitespace': 2,
+    'no-unexpected-multiline': 2,
+    'valid-jsdoc': [2, {
+      requireParamDescription: true,
+      requireReturnDescription: true,
+      requireReturn: false,
+      prefer: {
+        returns: 'return',
+      },
+    }],
+    'curly': [2, 'multi-line'],
+    'guard-for-in': 2,
+    'no-caller': 2,
+    'no-extend-native': 2,
+    'no-extra-bind': 2,
+    'no-invalid-this': 2,
+    'no-multi-spaces': 2,
+    'no-multi-str': 2,
+    'no-new-wrappers': 2,
+    'no-throw-literal': 2,
+    'no-with': 2,
+    'no-unused-vars': [2, {
+      args: 'none',
+    }],
+    'array-bracket-spacing': [2, 'never'],
+    'brace-style': 2,
+    'camelcase': [2, {
+      properties: 'never',
+    }],
+    'comma-dangle': [2, 'always-multiline'],
+    'comma-spacing': 2,
+    'comma-style': 2,
+    'computed-property-spacing': 2,
+    'eol-last': 2,
+    'func-call-spacing': 2,
+    'key-spacing': 2,
+    'keyword-spacing': 2,
+    'linebreak-style': 2,
+    'max-len': [2, {
+      code: 80,
+      tabWidth: 2,
+      ignoreUrls: true,
+    }],
+    'new-cap': 2,
+    'no-array-constructor': 2,
+    'no-mixed-spaces-and-tabs': 2,
+    'no-multiple-empty-lines': [2, {
+      max: 2,
+    }],
+    'no-new-object': 2,
+    'no-trailing-spaces': 2,
+    'object-curly-spacing': 2,
+    'one-var': [2, {
+      var: 'never',
+      let: 'never',
+      const: 'never',
+    }],
+    'padded-blocks': [2, 'never'],
+    'quote-props': [2, 'consistent'],
+    'quotes': [2, 'single', {
+      allowTemplateLiterals: true,
+    }],
+    'require-jsdoc': [2, {
+      require: {
+        FunctionDeclaration: true,
+        MethodDefinition: true,
+        ClassDeclaration: true,
+      },
+    }],
+    'semi-spacing': 2,
+    'semi': 2,
+    'space-before-blocks': 2,
+    'space-before-function-paren': [2, 'never'],
+    'spaced-comment': [2, 'always'],
+    'arrow-parens': [2, 'always'],
+    'constructor-super': 2,
+    'generator-star-spacing': [2, 'after'],
+    'no-new-symbol': 2,
+    'no-this-before-super': 2,
+    'no-var': 2,
+    'prefer-rest-params': 2,
+    'prefer-spread': 2,
+    'rest-spread-spacing': 2,
+    'yield-star-spacing': [2, 'after'],
+  },
+};

diff --git a/chrome/test/data/payments/PRESUBMIT.py b/chrome/test/data/payments/PRESUBMIT.py
new file mode 100644
index 0000000..8eae247
--- /dev/null
+++ b/chrome/test/data/payments/PRESUBMIT.py

@@ -0,0 +1,22 @@
+# Copyright 2017 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+def _CommonChecks(input_api, output_api):
+  results = []
+  try:
+    import sys
+    old_sys_path = sys.path
+    cwd = input_api.PresubmitLocalPath()
+    sys.path += [input_api.os_path.join(cwd, '..', '..', '..', '..', 'tools')]
+    import web_dev_style.presubmit_support
+    results = web_dev_style.presubmit_support.CheckStyle(input_api, output_api)
+  finally:
+    sys.path = old_sys_path
+  return results
+
+def CheckChangeOnUpload(input_api, output_api):
+  return _CommonChecks(input_api, output_api)
+
+def CheckChangeOnCommit(input_api, output_api):
+  return _CommonChecks(input_api, output_api)

diff --git a/chrome/test/data/payments/metrics.js b/chrome/test/data/payments/metrics.js
index b280f15..0edaa6a 100644
--- a/chrome/test/data/payments/metrics.js
+++ b/chrome/test/data/payments/metrics.js

@@ -6,47 +6,68 @@
 
 /* global PaymentRequest:false */
 
-var request;
+let request;
 
 /**
  * Launches the PaymentRequest UI that accepts credit cards.
  */
-function ccBuy() {  // eslint-disable-line no-unused-vars
+function ccBuy() { // eslint-disable-line no-unused-vars
   try {
-    var details = {
-      total: {label: 'Total', amount: {currency: 'USD', value: '5.00'}},
+    let details = {
+      total: {
+        label: 'Total',
+        amount: {
+          currency: 'USD',
+          value: '5.00',
+        },
+      },
       shippingOptions: [{
         id: 'freeShippingOption',
         label: 'Free global shipping',
-        amount: {currency: 'USD', value: '0'},
-        selected: true
-      }]
+        amount: {
+          currency: 'USD',
+          value: '0',
+        },
+        selected: true,
+      }],
     };
     request = new PaymentRequest(
-        [{supportedMethods: ['visa']}], {
-          total: {label: 'Total', amount: {currency: 'USD', value: '5.00'}},
-          shippingOptions: [{
-            id: 'freeShippingOption',
-            label: 'Free global shipping',
-            amount: {currency: 'USD', value: '0'},
-            selected: true
-          }]
+      [{
+        supportedMethods: ['visa'],
+      }], {
+        total: {
+          label: 'Total',
+          amount: {
+            currency: 'USD',
+            value: '5.00',
+          },
         },
-        {requestShipping: true});
+        shippingOptions: [{
+          id: 'freeShippingOption',
+          label: 'Free global shipping',
+          amount: {
+            currency: 'USD',
+            value: '0',
+          },
+          selected: true,
+        }],
+      }, {
+        requestShipping: true,
+      });
     request.show()
-        .then(function(resp) {
-          return resp.complete('success')
-        }).then(function() {
-          print(JSON.stringify(resp, undefined, 2));
-        }).catch(function(error) {
-          print(error);
-        });
+      .then(function(resp) {
+        return resp.complete('success');
+      }).then(function() {
+        print(JSON.stringify(resp, undefined, 2));
+      }).catch(function(error) {
+        print(error);
+      });
     request.addEventListener('shippingaddresschange', function(e) {
       e.updateWith(new Promise(function(resolve) {
         // No changes in price based on shipping address change.
         resolve(details);
       }));
-    })
+    });
   } catch (error) {
     print(error.message);
   }
@@ -55,27 +76,39 @@
 /**
  * Launches the PaymentRequest UI which accepts only Android Pay.
  */
-function androidPayBuy() {  // eslint-disable-line no-unused-vars
+function androidPayBuy() { // eslint-disable-line no-unused-vars
   try {
     request = new PaymentRequest(
-        [{supportedMethods: ['https://android.com/pay']}], {
-          total: {label: 'Total', amount: {currency: 'USD', value: '5.00'}},
-          shippingOptions: [{
-            id: 'freeShippingOption',
-            label: 'Free global shipping',
-            amount: {currency: 'USD', value: '0'},
-            selected: true
-          }]
+      [{
+        supportedMethods: ['https://android.com/pay'],
+      }], {
+        total: {
+          label: 'Total',
+          amount: {
+            currency: 'USD',
+            value: '5.00',
+          },
         },
-        {requestShipping: true});
+        shippingOptions: [{
+          id: 'freeShippingOption',
+          label: 'Free global shipping',
+          amount: {
+            currency: 'USD',
+            value: '0',
+          },
+          selected: true,
+        }],
+      }, {
+        requestShipping: true,
+      });
     request.show()
-        .then(function(resp) {
-          return resp.complete('success');
-        }).then(function() {
-          print(JSON.stringify(resp, undefined, 2));
-        }).catch(function(error) {
-          print(error);
-        });
+      .then(function(resp) {
+        return resp.complete('success');
+      }).then(function() {
+        print(JSON.stringify(resp, undefined, 2));
+      }).catch(function(error) {
+        print(error);
+      });
   } catch (error) {
     print(error.message);
   }
@@ -85,20 +118,28 @@
  * Launches the PaymentRequest UI which accepts only Android Pay and does not
  * require any other information.
  */
-function androidPaySkipUiBuy() {  // eslint-disable-line no-unused-vars
+function androidPaySkipUiBuy() { // eslint-disable-line no-unused-vars
   try {
     request = new PaymentRequest(
-        [{supportedMethods: ['https://android.com/pay']}], {
-          total: {label: 'Total', amount: {currency: 'USD', value: '5.00'}},
-        });
+      [{
+        supportedMethods: ['https://android.com/pay'],
+      }], {
+        total: {
+          label: 'Total',
+          amount: {
+            currency: 'USD',
+            value: '5.00',
+          },
+        },
+      });
     request.show()
-        .then(function(resp) {
-          return resp.complete('success');
-        }).then(function() {
-          print(JSON.stringify(resp, undefined, 2));
-        }).catch(function(error) {
-          print(error);
-        });
+      .then(function(resp) {
+        return resp.complete('success');
+      }).then(function() {
+        print(JSON.stringify(resp, undefined, 2));
+      }).catch(function(error) {
+        print(error);
+      });
   } catch (error) {
     print(error.message);
   }
@@ -108,27 +149,39 @@
  * Launches the PaymentRequest UI which accepts only an unsupported payment
  * method.
  */
-function noSupported() {  // eslint-disable-line no-unused-vars
+function noSupported() { // eslint-disable-line no-unused-vars
   try {
     request = new PaymentRequest(
-        [{supportedMethods: ['https://randompay.com']}], {
-          total: {label: 'Total', amount: {currency: 'USD', value: '5.00'}},
-          shippingOptions: [{
-            id: 'freeShippingOption',
-            label: 'Free global shipping',
-            amount: {currency: 'USD', value: '0'},
-            selected: true
-          }]
+      [{
+        supportedMethods: ['https://randompay.com'],
+      }], {
+        total: {
+          label: 'Total',
+          amount: {
+            currency: 'USD',
+            value: '5.00',
+          },
         },
-        {requestShipping: true});
+        shippingOptions: [{
+          id: 'freeShippingOption',
+          label: 'Free global shipping',
+          amount: {
+            currency: 'USD',
+            value: '0',
+          },
+          selected: true,
+        }],
+      }, {
+        requestShipping: true,
+      });
     request.show()
-        .then(function(resp) {
-          return resp.complete('success');
-        }).then(function() {
-          print(JSON.stringify(resp, undefined, 2));
-        }).catch(function(error) {
-          print(error);
-        });
+      .then(function(resp) {
+        return resp.complete('success');
+      }).then(function() {
+        print(JSON.stringify(resp, undefined, 2));
+      }).catch(function(error) {
+        print(error);
+      });
   } catch (error) {
     print(error.message);
   }
@@ -137,7 +190,7 @@
 /**
  * Aborts the current PaymentRequest.
  */
-function abort() {  // eslint-disable-line no-unused-vars
+function abort() { // eslint-disable-line no-unused-vars
   try {
     request.abort().then(function() {
       print('Aborted');
@@ -147,4 +200,4 @@
   } catch (error) {
     print(error.message);
   }
-}
\ No newline at end of file
+}

diff --git a/chrome/test/data/payments/util.js b/chrome/test/data/payments/util.js
index 4284c7c..d7fe08c7 100644
--- a/chrome/test/data/payments/util.js
+++ b/chrome/test/data/payments/util.js

@@ -8,6 +8,6 @@
  * Prints the message.
  * @param {String} msg - The message to print.
  */
-function print(msg) {  // eslint-disable-line no-unused-vars
+function print(msg) { // eslint-disable-line no-unused-vars
   document.getElementById('result').innerHTML = msg;
 }

diff --git a/chrome/test/data/webui/settings/device_page_tests.js b/chrome/test/data/webui/settings/device_page_tests.js
index 227fcfe..f02d8d0 100644
--- a/chrome/test/data/webui/settings/device_page_tests.js
+++ b/chrome/test/data/webui/settings/device_page_tests.js

@@ -85,11 +85,31 @@
     return {
       ash: {
         night_light: {
+          enabled: {
+            key: 'ash.night_light.enabled',
+            type: chrome.settingsPrivate.PrefType.BOOLEAN,
+            value: false,
+          },
+          color_temperature: {
+            key: 'ash.night_light.color_temperature',
+            type: chrome.settingsPrivate.PrefType.NUMBER,
+            value: 0,
+          },
           schedule_type: {
             key: 'ash.night_light.schedule_type',
             type: chrome.settingsPrivate.PrefType.NUMBER,
             value: 0,
           },
+          custom_start_time: {
+            key: 'ash.night_light.custom_start_time',
+            type: chrome.settingsPrivate.PrefType.NUMBER,
+            value: 0,
+          },
+          custom_end_time: {
+            key: 'ash.night_light.custom_end_time',
+            type: chrome.settingsPrivate.PrefType.NUMBER,
+            value: 0,
+          },
         },
       },
       settings: {

diff --git a/chromecast/BUILD.gn b/chromecast/BUILD.gn
index e2b9e487..02f7185 100644
--- a/chromecast/BUILD.gn
+++ b/chromecast/BUILD.gn

@@ -211,6 +211,17 @@
       # No way to display URL's on audio only cast devices.
       gtest_excludes += [ "NavigationEntryTest.NavigationEntryURLs" ]
     }
+    if (enable_assistant && !is_cast_desktop_build) {
+      # Temporarily disable InvalidUUID and DefaultConstructor on assistant
+      # device builds. Cause of failure is unclear, but it's highly likely it's
+      # related to them being DEATH tests. These were passing until the
+      # is_official_build flag was enabled. These tests are considered
+      # non-critical in this context. (b/62469368)
+      gtest_excludes += [
+        "BluetoothBlocklistTest.InvalidUUID",
+        "WebBluetoothDeviceIdTest.DefaultConstructor",
+      ]
+    }
   }
   filters += [ content_unittests_filter ]
 

diff --git a/chromecast/browser/cast_browser_main_parts.cc b/chromecast/browser/cast_browser_main_parts.cc
index 2df4b27..cd8783e 100644
--- a/chromecast/browser/cast_browser_main_parts.cc
+++ b/chromecast/browser/cast_browser_main_parts.cc

@@ -236,6 +236,7 @@
     {switches::kDisableGpu, ""},
 #if defined(OS_ANDROID)
     {switches::kDisableGLDrawingForTests, ""},
+    {switches::kDisableGpuVsync, ""},
     {switches::kSkipGpuDataLoading, ""},
     {switches::kDisableGpuCompositing, ""},
 #endif  // defined(OS_ANDROID)

diff --git a/components/chrome_cleaner/public/constants/constants.h b/components/chrome_cleaner/public/constants/constants.h
index ad1b8af2..01f9bfc 100644
--- a/components/chrome_cleaner/public/constants/constants.h
+++ b/components/chrome_cleaner/public/constants/constants.h

@@ -119,10 +119,6 @@
   // user (UI handled by Chrome) and logs will only be uploaded if the user
   // opted into Extended Safe Browsing Reporting v2.
   kCleanup = 2,
-  // The cleaner will run in post-reboot validation mode. No UI will be shown
-  // to the user and logs will only be uploaded if the user opted into Extended
-  // Safe Browsing Reporting v2.
-  kPostRebootValidation = 3,
 
   // Auxiliary enumerator for range checking.
   kNumValues,

diff --git a/components/filesystem/directory_impl.cc b/components/filesystem/directory_impl.cc
index 0248c359..1209f6ec 100644
--- a/components/filesystem/directory_impl.cc
+++ b/components/filesystem/directory_impl.cc

@@ -251,6 +251,9 @@
 }
 
 void DirectoryImpl::Flush(FlushCallback callback) {
+// On Windows no need to sync directories. Their metadata will be updated when
+// files are created, without an explicit sync.
+#if !defined(OS_WIN)
   base::File file(directory_path_,
                   base::File::FLAG_OPEN | base::File::FLAG_READ);
   if (!file.IsValid()) {
@@ -262,7 +265,7 @@
     std::move(callback).Run(mojom::FileError::FAILED);
     return;
   }
-
+#endif
   std::move(callback).Run(mojom::FileError::OK);
 }
 

diff --git a/components/flags_ui/resources/apple_flags.html b/components/flags_ui/resources/apple_flags.html
index 3760509..54fd5adf 100644
--- a/components/flags_ui/resources/apple_flags.html
+++ b/components/flags_ui/resources/apple_flags.html

@@ -14,7 +14,7 @@
 <script src="chrome://ui-alternatives/flags.js"></script>
 <script src="chrome://ui-alternatives/strings.js"></script>
 </head>
-<body style="fontFamily:$i18n{fontfamily};fontSize:$i18n{fontsize}">
+<body style="font-family: $i18n{fontfamily}; font-size: $i18n{fontsize}">
 <div id="body-container" style="visibility:hidden">
   <div id="flagsTemplate">
     <div id="container" class="vbox-container">

diff --git a/components/leveldb/env_mojo.cc b/components/leveldb/env_mojo.cc
index ecfc47b5..862431cd 100644
--- a/components/leveldb/env_mojo.cc
+++ b/components/leveldb/env_mojo.cc

@@ -218,6 +218,10 @@
 
   leveldb::Status SyncParent() {
     FileError error = thread_->SyncDirectory(dir_, parent_dir_);
+    if (error != FileError::OK) {
+      uma_logger_->RecordOSError(leveldb_env::kSyncParent,
+                                 static_cast<base::File::Error>(error));
+    }
     return error == FileError::OK
                ? Status::OK()
                : Status::IOError(filename_,

diff --git a/components/neterror/resources/neterror.html b/components/neterror/resources/neterror.html
index 4c652ae..9797a377 100644
--- a/components/neterror/resources/neterror.html
+++ b/components/neterror/resources/neterror.html

@@ -12,7 +12,7 @@
   <script src="neterror.js"></script>
   <script src="offline.js"></script>
 </head>
-<body id="t" style="fontFamily:$i18n{fontfamily};fontSize:$i18n{fontsize}">
+<body id="t" style="font-family: $i18n{fontfamily}; font-size: $i18n{fontsize}">
   <div id="main-frame-error" class="interstitial-wrapper">
     <div id="main-content">
       <div class="icon"

diff --git a/components/payments/content/payment_request.cc b/components/payments/content/payment_request.cc
index a61af2f..a4717e2 100644
--- a/components/payments/content/payment_request.cc
+++ b/components/payments/content/payment_request.cc

@@ -140,6 +140,7 @@
   }
 
   journey_logger_.SetShowCalled();
+  journey_logger_.SetEventOccurred(JourneyLogger::EVENT_SHOWN);
   journey_logger_.SetRequestedInformation(
       spec_->request_shipping(), spec_->request_payer_email(),
       spec_->request_payer_phone(), spec_->request_payer_name());
@@ -229,6 +230,8 @@
 
 void PaymentRequest::OnPaymentResponseAvailable(
     mojom::PaymentResponsePtr response) {
+  journey_logger_.SetEventOccurred(
+      JourneyLogger::EVENT_RECEIVED_INSTRUMENT_DETAILS);
   client_->OnPaymentResponse(std::move(response));
 }
 
@@ -284,6 +287,7 @@
 }
 
 void PaymentRequest::Pay() {
+  journey_logger_.SetEventOccurred(JourneyLogger::EVENT_PAY_CLICKED);
   journey_logger_.SetSelectedPaymentMethod(
       JourneyLogger::SELECTED_PAYMENT_METHOD_CREDIT_CARD);
   state_->GeneratePaymentResponse();

diff --git a/components/spellcheck/browser/android/java/src/org/chromium/components/spellcheck/SpellCheckerSessionBridge.java b/components/spellcheck/browser/android/java/src/org/chromium/components/spellcheck/SpellCheckerSessionBridge.java
index b2ce329..25728da 100644
--- a/components/spellcheck/browser/android/java/src/org/chromium/components/spellcheck/SpellCheckerSessionBridge.java
+++ b/components/spellcheck/browser/android/java/src/org/chromium/components/spellcheck/SpellCheckerSessionBridge.java

@@ -125,7 +125,12 @@
                     SuggestionsInfo info = result.getSuggestionsInfoAt(i);
                     ArrayList<String> suggestions_for_word = new ArrayList<String>();
                     for (int j = 0; j < info.getSuggestionsCount(); ++j) {
-                        suggestions_for_word.add(info.getSuggestionAt(j));
+                        String suggestion = info.getSuggestionAt(j);
+                        // Remove zero-length space from end of suggestion, if any
+                        if (suggestion.charAt(suggestion.length() - 1) == 0x200b) {
+                            suggestion = suggestion.substring(0, suggestion.length() - 1);
+                        }
+                        suggestions_for_word.add(suggestion);
                     }
                     suggestions.add(
                             suggestions_for_word.toArray(new String[suggestions_for_word.size()]));

diff --git a/components/user_manager/fake_user_manager.cc b/components/user_manager/fake_user_manager.cc
index 80799cc3..c046e77 100644
--- a/components/user_manager/fake_user_manager.cc
+++ b/components/user_manager/fake_user_manager.cc

@@ -298,7 +298,7 @@
 bool FakeUserManager::GetPlatformKnownUserId(const std::string& user_email,
                                              const std::string& gaia_id,
                                              AccountId* out_account_id) const {
-  if (user_email == kStubUser) {
+  if (user_email == kStubUserEmail) {
     *out_account_id = StubAccountId();
     return true;
   }

diff --git a/components/user_manager/user_names.cc b/components/user_manager/user_names.cc
index b873a3da..5342a5e 100644
--- a/components/user_manager/user_names.cc
+++ b/components/user_manager/user_names.cc

@@ -34,27 +34,25 @@
  private:
   friend struct base::DefaultSingletonTraits<FixedAccountManager>;
 
-  FixedAccountManager();
+  FixedAccountManager() = default;
 
-  const AccountId stub_account_id_;
-  const AccountId signin_account_id_;
-  const AccountId guest_account_id_;
-  const AccountId demo_account_id_;
+  const AccountId stub_account_id_ =
+      AccountId::FromUserEmailGaiaId(user_manager::kStubUserEmail,
+                                     user_manager::kStubUserId);
+  const AccountId signin_account_id_ = AccountId::FromUserEmail(kSignInUser);
+  const AccountId guest_account_id_ =
+      AccountId::FromUserEmail(user_manager::kGuestUserName);
+  const AccountId demo_account_id_ = AccountId::FromUserEmail(kDemoUserName);
 
   DISALLOW_COPY_AND_ASSIGN(FixedAccountManager);
 };
 
-FixedAccountManager::FixedAccountManager()
-    : stub_account_id_(AccountId::FromUserEmail(user_manager::kStubUser)),
-      signin_account_id_(AccountId::FromUserEmail(kSignInUser)),
-      guest_account_id_(AccountId::FromUserEmail(user_manager::kGuestUserName)),
-      demo_account_id_(AccountId::FromUserEmail(kDemoUserName)) {}
-
 }  // namespace
 
 namespace user_manager {
 
-const char kStubUser[] = "stub-user@example.com";
+const char kStubUserEmail[] = "stub-user@example.com";
+const char kStubUserId[] = "1234567890123456789012";
 
 // Should match cros constant in platform/libchromeos/chromeos/cryptohome.h
 const char kGuestUserName[] = "$guest";

diff --git a/components/user_manager/user_names.h b/components/user_manager/user_names.h
index a3c9476..d56880a83 100644
--- a/components/user_manager/user_names.h
+++ b/components/user_manager/user_names.h

@@ -13,9 +13,11 @@
 
 namespace user_manager {
 
-// Username for stub login for tests only.
-// It is also used for Chrome for ChromeOS linux dev build.
-USER_MANAGER_EXPORT extern const char kStubUser[];
+// Stub user name. For tests and CrOS on Linux dev build only.
+USER_MANAGER_EXPORT extern const char kStubUserEmail[];
+
+// Stub user id. For tests and CrOS on Linux dev build only.
+USER_MANAGER_EXPORT extern const char kStubUserId[];
 
 // Magic e-mail addresses are bad. They exist here because some code already
 // depends on them and it is hard to figure out what. Any user types added in

diff --git a/components/web_contents_delegate_android/web_contents_delegate_android.cc b/components/web_contents_delegate_android/web_contents_delegate_android.cc
index 66f729c..12e077c5 100644
--- a/components/web_contents_delegate_android/web_contents_delegate_android.cc
+++ b/components/web_contents_delegate_android/web_contents_delegate_android.cc

@@ -110,6 +110,7 @@
   load_params.should_replace_current_entry =
       params.should_replace_current_entry;
   load_params.is_renderer_initiated = params.is_renderer_initiated;
+  load_params.has_user_gesture = params.user_gesture;
 
   if (params.uses_post) {
     load_params.load_type = content::NavigationController::LOAD_TYPE_HTTP_POST;

diff --git a/content/browser/DEPS b/content/browser/DEPS
index f33d518..5aafa562 100644
--- a/content/browser/DEPS
+++ b/content/browser/DEPS

@@ -86,6 +86,7 @@
   "+third_party/WebKit/public/platform/WebSecurityStyle.h",
   "+third_party/WebKit/public/platform/WebTouchEvent.h",
   "+third_party/WebKit/public/platform/WebTextInputType.h",
+  "+third_party/WebKit/public/platform/mac/WebScrollbarTheme.h",
   "+third_party/WebKit/public/platform/mime_registry.mojom.h",
   "+third_party/WebKit/public/platform/modules/background_sync/background_sync.mojom.h",
   "+third_party/WebKit/public/platform/modules/bluetooth/web_bluetooth.mojom.h",
@@ -136,7 +137,6 @@
   "+third_party/WebKit/public/web/WebSharedWorkerCreationErrors.h",
   "+third_party/WebKit/public/web/WebTextDirection.h",
   "+third_party/WebKit/public/web/WebTreeScopeType.h",
-  "+third_party/WebKit/public/web/mac/WebScrollbarTheme.h",
 
   # DO NOT ADD ANY CHROME OR COMPONENTS INCLUDES HERE!!!
   # See https://sites.google.com/a/chromium.org/dev/developers/content-module

diff --git a/content/browser/devtools/devtools_agent_host_impl.h b/content/browser/devtools/devtools_agent_host_impl.h
index 774c925..6b2a785 100644
--- a/content/browser/devtools/devtools_agent_host_impl.h
+++ b/content/browser/devtools/devtools_agent_host_impl.h

@@ -91,7 +91,7 @@
   explicit DevToolsMessageChunkProcessor(const SendMessageCallback& callback);
   ~DevToolsMessageChunkProcessor();
 
-  std::string state_cookie() const { return state_cookie_; }
+  const std::string& state_cookie() const { return state_cookie_; }
   void set_state_cookie(const std::string& cookie) { state_cookie_ = cookie; }
   int last_call_id() const { return last_call_id_; }
   bool ProcessChunkedMessageFromAgent(const DevToolsMessageChunk& chunk);

diff --git a/content/browser/devtools/devtools_io_context.cc b/content/browser/devtools/devtools_io_context.cc
index 2b18f03..719ef426 100644
--- a/content/browser/devtools/devtools_io_context.cc
+++ b/content/browser/devtools/devtools_io_context.cc

@@ -6,9 +6,12 @@
 
 #include "base/files/file.h"
 #include "base/files/file_util.h"
+#include "base/sequenced_task_runner.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
+#include "base/task_scheduler/post_task.h"
 #include "base/third_party/icu/icu_utf.h"
+#include "base/threading/thread_restrictions.h"
 #include "content/public/browser/browser_thread.h"
 
 namespace content {
@@ -19,18 +22,20 @@
 
 using Stream = DevToolsIOContext::Stream;
 
-Stream::Stream()
-    : base::RefCountedDeleteOnSequence<Stream>(
-          BrowserThread::GetTaskRunnerForThread(BrowserThread::FILE)),
+Stream::Stream(base::SequencedTaskRunner* task_runner)
+    : base::RefCountedDeleteOnSequence<Stream>(task_runner),
       handle_(base::UintToString(++s_last_stream_handle)),
+      task_runner_(task_runner),
       had_errors_(false),
       last_read_pos_(0) {}
 
 Stream::~Stream() {
-  DCHECK_CURRENTLY_ON(BrowserThread::FILE);
+  DCHECK(task_runner_->RunsTasksInCurrentSequence());
 }
 
-bool Stream::InitOnFileThreadIfNeeded() {
+bool Stream::InitOnFileSequenceIfNeeded() {
+  DCHECK(task_runner_->RunsTasksInCurrentSequence());
+  base::ThreadRestrictions::AssertIOAllowed();
   if (had_errors_)
     return false;
   if (file_.IsValid())
@@ -56,22 +61,23 @@
 }
 
 void Stream::Read(off_t position, size_t max_size, ReadCallback callback) {
-  BrowserThread::PostTask(BrowserThread::FILE, FROM_HERE,
-      base::Bind(&Stream::ReadOnFileThread, this, position, max_size,
-                 callback));
+  task_runner_->PostTask(
+      FROM_HERE, base::BindOnce(&Stream::ReadOnFileSequence, this, position,
+                                max_size, std::move(callback)));
 }
 
 void Stream::Append(std::unique_ptr<std::string> data) {
-  BrowserThread::PostTask(BrowserThread::FILE, FROM_HERE,
-                          base::Bind(&Stream::AppendOnFileThread, this,
-                                     base::Passed(std::move(data))));
+  task_runner_->PostTask(
+      FROM_HERE,
+      base::BindOnce(&Stream::AppendOnFileSequence, this, std::move(data)));
 }
 
-void Stream::ReadOnFileThread(off_t position, size_t max_size,
-                              ReadCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::FILE);
+void Stream::ReadOnFileSequence(off_t position,
+                                size_t max_size,
+                                ReadCallback callback) {
+  DCHECK(task_runner_->RunsTasksInCurrentSequence());
   Status status = StatusFailure;
-  scoped_refptr<base::RefCountedString> data;
+  std::unique_ptr<std::string> data;
 
   if (file_.IsValid()) {
     std::string buffer;
@@ -92,33 +98,37 @@
       } else {
         buffer.resize(size_got);
       }
-      data = base::RefCountedString::TakeString(&buffer);
+      data.reset(new std::string(std::move(buffer)));
       status = size_got ? StatusSuccess : StatusEOF;
       last_read_pos_ = position + size_got;
     }
   }
-  BrowserThread::PostTask(BrowserThread::UI, FROM_HERE,
-                          base::Bind(callback, data, status));
+  BrowserThread::PostTask(
+      BrowserThread::UI, FROM_HERE,
+      base::BindOnce(std::move(callback), std::move(data), status));
 }
 
-void Stream::AppendOnFileThread(std::unique_ptr<std::string> data) {
-  DCHECK_CURRENTLY_ON(BrowserThread::FILE);
-  if (!InitOnFileThreadIfNeeded())
+void Stream::AppendOnFileSequence(std::unique_ptr<std::string> data) {
+  if (!InitOnFileSequenceIfNeeded())
     return;
-  int size_written = file_.WriteAtCurrentPos(data->data(), data->size());
-  if (size_written != static_cast<int>(data->size())) {
+  int size_written = file_.WriteAtCurrentPos(&*data->begin(), data->length());
+  if (size_written != static_cast<int>(data->length())) {
     LOG(ERROR) << "Failed to write temporary file";
     had_errors_ = true;
     file_.Close();
   }
 }
 
-DevToolsIOContext::DevToolsIOContext() {}
+DevToolsIOContext::DevToolsIOContext() = default;
 
-DevToolsIOContext::~DevToolsIOContext() {}
+DevToolsIOContext::~DevToolsIOContext() = default;
 
 scoped_refptr<Stream> DevToolsIOContext::CreateTempFileBackedStream() {
-  scoped_refptr<Stream> result = new Stream();
+  if (!task_runner_) {
+    task_runner_ = base::CreateSequencedTaskRunnerWithTraits(
+        {base::MayBlock(), base::TaskPriority::BACKGROUND});
+  }
+  scoped_refptr<Stream> result = new Stream(task_runner_.get());
   bool inserted =
       streams_.insert(std::make_pair(result->handle(), result)).second;
   DCHECK(inserted);

diff --git a/content/browser/devtools/devtools_io_context.h b/content/browser/devtools/devtools_io_context.h
index 2bacfb2..67f9113 100644
--- a/content/browser/devtools/devtools_io_context.h
+++ b/content/browser/devtools/devtools_io_context.h

@@ -14,6 +14,9 @@
 #include "base/memory/ref_counted_delete_on_sequence.h"
 #include "base/memory/ref_counted_memory.h"
 
+namespace base {
+class SequencedTaskRunner;
+}
 namespace content {
 
 class DevToolsIOContext {
@@ -26,26 +29,27 @@
       StatusFailure
     };
 
-    using ReadCallback = base::Callback<
-        void(const scoped_refptr<base::RefCountedString>& data, int status)>;
+    using ReadCallback =
+        base::OnceCallback<void(std::unique_ptr<std::string> data, int status)>;
 
     void Read(off_t position, size_t max_size, ReadCallback callback);
     void Append(std::unique_ptr<std::string> data);
     const std::string& handle() const { return handle_; }
 
    private:
-    Stream();
+    explicit Stream(base::SequencedTaskRunner* task_runner);
     ~Stream();
     friend class DevToolsIOContext;
     friend class base::RefCountedDeleteOnSequence<Stream>;
     friend class base::DeleteHelper<Stream>;
 
-    void ReadOnFileThread(off_t pos, size_t max_size, ReadCallback callback);
-    void AppendOnFileThread(std::unique_ptr<std::string> data);
-    bool InitOnFileThreadIfNeeded();
+    void ReadOnFileSequence(off_t pos, size_t max_size, ReadCallback callback);
+    void AppendOnFileSequence(std::unique_ptr<std::string> data);
+    bool InitOnFileSequenceIfNeeded();
 
     const std::string handle_;
     base::File file_;
+    scoped_refptr<base::SequencedTaskRunner> task_runner_;
     bool had_errors_;
     off_t last_read_pos_;
   };
@@ -61,6 +65,7 @@
  private:
   using StreamsMap = std::map<std::string, scoped_refptr<Stream>>;
   StreamsMap streams_;
+  scoped_refptr<base::SequencedTaskRunner> task_runner_;
 };
 
 }  // namespace content

diff --git a/content/browser/devtools/devtools_session.cc b/content/browser/devtools/devtools_session.cc
index f9dcb58..528fa56 100644
--- a/content/browser/devtools/devtools_session.cc
+++ b/content/browser/devtools/devtools_session.cc

@@ -20,6 +20,8 @@
       session_id_(session_id),
       host_(nullptr),
       dispatcher_(new protocol::UberDispatcher(this)),
+      chunk_processor_(base::Bind(&DevToolsSession::SendMessageToClient,
+                                  base::Unretained(this))),
       weak_factory_(this) {}
 
 DevToolsSession::~DevToolsSession() {
@@ -46,11 +48,21 @@
   dispatcher_->setFallThroughForNotFound(value);
 }
 
-void DevToolsSession::sendResponse(
+void DevToolsSession::SendMessageToClient(int session_id,
+                                          const std::string& message) {
+  if (session_id != session_id_)
+    return;
+  int id = chunk_processor_.last_call_id();
+  waiting_for_response_messages_.erase(id);
+  client_->DispatchProtocolMessage(agent_host_, message);
+  // |this| may be deleted at this point.
+}
+
+void DevToolsSession::SendResponse(
     std::unique_ptr<base::DictionaryValue> response) {
   std::string json;
   base::JSONWriter::Write(*response.get(), &json);
-  agent_host_->SendMessageToClient(session_id_, json);
+  client_->DispatchProtocolMessage(agent_host_, json);
 }
 
 protocol::Response::Status DevToolsSession::Dispatch(
@@ -67,11 +79,11 @@
     std::unique_ptr<base::DictionaryValue> response(
         delegate->HandleCommand(agent_host_, dict_value));
     if (response) {
-      sendResponse(std::move(response));
+      SendResponse(std::move(response));
       return protocol::Response::kSuccess;
     }
     if (delegate->HandleAsyncCommand(agent_host_, dict_value,
-                                     base::Bind(&DevToolsSession::sendResponse,
+                                     base::Bind(&DevToolsSession::SendResponse,
                                                 weak_factory_.GetWeakPtr()))) {
       return protocol::Response::kAsync;
     }
@@ -81,15 +93,19 @@
                                call_id, method);
 }
 
+bool DevToolsSession::ReceiveMessageChunk(const DevToolsMessageChunk& chunk) {
+  return chunk_processor_.ProcessChunkedMessageFromAgent(chunk);
+}
+
 void DevToolsSession::sendProtocolResponse(
     int call_id,
     std::unique_ptr<protocol::Serializable> message) {
-  agent_host_->SendMessageToClient(session_id_, message->serialize());
+  client_->DispatchProtocolMessage(agent_host_, message->serialize());
 }
 
 void DevToolsSession::sendProtocolNotification(
     std::unique_ptr<protocol::Serializable> message) {
-  agent_host_->SendMessageToClient(session_id_, message->serialize());
+  client_->DispatchProtocolMessage(agent_host_, message->serialize());
 }
 
 void DevToolsSession::flushProtocolNotifications() {

diff --git a/content/browser/devtools/devtools_session.h b/content/browser/devtools/devtools_session.h
index 24909914..88d91d2 100644
--- a/content/browser/devtools/devtools_session.h
+++ b/content/browser/devtools/devtools_session.h

@@ -5,6 +5,8 @@
 #ifndef CONTENT_BROWSER_DEVTOOLS_DEVTOOLS_SESSION_H_
 #define CONTENT_BROWSER_DEVTOOLS_DEVTOOLS_SESSION_H_
 
+#include <map>
+
 #include "base/containers/flat_map.h"
 #include "base/memory/weak_ptr.h"
 #include "base/values.h"
@@ -29,10 +31,19 @@
   void SetRenderFrameHost(RenderFrameHostImpl* host);
   void SetFallThroughForNotFound(bool value);
 
+  struct Message {
+    std::string method;
+    std::string message;
+  };
+  using MessageByCallId = std::map<int, Message>;
+  MessageByCallId& waiting_messages() { return waiting_for_response_messages_; }
+  const std::string& state_cookie() { return chunk_processor_.state_cookie(); }
+
   protocol::Response::Status Dispatch(
       const std::string& message,
       int* call_id,
       std::string* method);
+  bool ReceiveMessageChunk(const DevToolsMessageChunk& chunk);
 
   // Only used by DevToolsAgentHostImpl.
   DevToolsAgentHostClient* client() const { return client_; }
@@ -53,7 +64,9 @@
   }
 
  private:
-  void sendResponse(std::unique_ptr<base::DictionaryValue> response);
+  void SendMessageToClient(int session_id, const std::string& message);
+  void SendResponse(std::unique_ptr<base::DictionaryValue> response);
+
   // protocol::FrontendChannel implementation.
   void sendProtocolResponse(
       int call_id,
@@ -69,6 +82,10 @@
       handlers_;
   RenderFrameHostImpl* host_;
   std::unique_ptr<protocol::UberDispatcher> dispatcher_;
+  // Chunk processor's state cookie always corresponds to a state before
+  // any of the waiting for response messages have been handled.
+  DevToolsMessageChunkProcessor chunk_processor_;
+  MessageByCallId waiting_for_response_messages_;
 
   base::WeakPtrFactory<DevToolsSession> weak_factory_;
 };

diff --git a/content/browser/devtools/protocol/io_handler.cc b/content/browser/devtools/protocol/io_handler.cc
index 2b6a76d4..ec0d49c 100644
--- a/content/browser/devtools/protocol/io_handler.cc
+++ b/content/browser/devtools/protocol/io_handler.cc

@@ -43,22 +43,21 @@
     callback->sendFailure(Response::InvalidParams("Invalid stream handle"));
     return;
   }
-  stream->Read(offset.fromMaybe(-1),
-               max_size.fromMaybe(kDefaultChunkSize),
-               base::Bind(&IOHandler::ReadComplete,
-                          weak_factory_.GetWeakPtr(),
-                          base::Passed(std::move(callback))));
+  stream->Read(
+      offset.fromMaybe(-1), max_size.fromMaybe(kDefaultChunkSize),
+      base::BindOnce(&IOHandler::ReadComplete, weak_factory_.GetWeakPtr(),
+                     base::Passed(std::move(callback))));
 }
 
 void IOHandler::ReadComplete(std::unique_ptr<ReadCallback> callback,
-                             const scoped_refptr<base::RefCountedString>& data,
+                             std::unique_ptr<std::string> data,
                              int status) {
   if (status == DevToolsIOContext::Stream::StatusFailure) {
     callback->sendFailure(Response::Error("Read failed"));
     return;
   }
   bool eof = status == DevToolsIOContext::Stream::StatusEOF;
-  callback->sendSuccess(data->data(), eof);
+  callback->sendSuccess(std::move(*data), eof);
 }
 
 Response IOHandler::Close(const std::string& handle) {

diff --git a/content/browser/devtools/protocol/io_handler.h b/content/browser/devtools/protocol/io_handler.h
index 7ac6f80..0429769 100644
--- a/content/browser/devtools/protocol/io_handler.h
+++ b/content/browser/devtools/protocol/io_handler.h

@@ -10,10 +10,6 @@
 #include "content/browser/devtools/protocol/devtools_domain_handler.h"
 #include "content/browser/devtools/protocol/io.h"
 
-namespace base {
-class RefCountedString;
-}
-
 namespace content {
 class DevToolsIOContext;
 
@@ -37,7 +33,8 @@
 
  private:
   void ReadComplete(std::unique_ptr<ReadCallback> callback,
-      const scoped_refptr<base::RefCountedString>& data, int status);
+                    std::unique_ptr<std::string> data,
+                    int status);
 
   std::unique_ptr<IO::Frontend> frontend_;
   DevToolsIOContext* io_context_;

diff --git a/content/browser/devtools/render_frame_devtools_agent_host.cc b/content/browser/devtools/render_frame_devtools_agent_host.cc
index 3c29c49..ea73ad73 100644
--- a/content/browser/devtools/render_frame_devtools_agent_host.cc
+++ b/content/browser/devtools/render_frame_devtools_agent_host.cc

@@ -195,7 +195,7 @@
     const std::string& message) {
   host_->Send(new DevToolsAgentMsg_DispatchOnInspectorBackend(
       host_->GetRoutingID(), session_id, call_id, method, message));
-  sent_messages_[call_id] = { session_id, method, message };
+  sent_messages_[call_id] = {session_id, call_id, method, message};
 }
 
 void RenderFrameDevToolsAgentHost::FrameHostHolder::InspectElement(
@@ -401,9 +401,6 @@
       frame_trace_recorder_(nullptr),
       handlers_frame_host_(nullptr),
       current_frame_crashed_(false),
-      chunk_processor_(
-          base::Bind(&RenderFrameDevToolsAgentHost::SendMessageFromProcessor,
-                     base::Unretained(this))),
       frame_tree_node_(frame_tree_node) {
   if (IsBrowserSideNavigationEnabled()) {
     frame_host_ = frame_tree_node->current_frame_host();
@@ -545,14 +542,14 @@
 
   if (IsBrowserSideNavigationEnabled()) {
     if (!navigation_handles_.empty()) {
-      suspended_messages_[call_id] = {session_id, method, message};
+      suspended_messages_.push_back({session_id, call_id, method, message});
       return true;
     }
     if (frame_host_) {
       frame_host_->Send(new DevToolsAgentMsg_DispatchOnInspectorBackend(
           frame_host_->GetRoutingID(), session_id, call_id, method, message));
     }
-    waiting_for_response_messages_[call_id] = {session_id, method, message};
+    session->waiting_messages()[call_id] = {method, message};
   } else {
     if (current_)
       current_->DispatchProtocolMessage(session_id, call_id, method, message);
@@ -596,9 +593,7 @@
   GetWakeLock()->CancelWakeLock();
 #endif
   frame_trace_recorder_.reset();
-  waiting_for_response_messages_.clear();
   suspended_messages_.clear();
-  chunk_processor_.Reset();
   if (IsBrowserSideNavigationEnabled())
     RevokePolicy(frame_host_);
 }
@@ -659,16 +654,17 @@
     UpdateFrameHost(handle->GetRenderFrameHost());
   DCHECK(CheckConsistency());
   if (navigation_handles_.empty()) {
-    if (session() && frame_host_) {
-      for (const auto& pair : suspended_messages_) {
-        const Message& message = pair.second;
-        frame_host_->Send(new DevToolsAgentMsg_DispatchOnInspectorBackend(
-            frame_host_->GetRoutingID(), message.session_id, pair.first,
-            message.method, message.message));
+    if (session()) {
+      for (const Message& message : suspended_messages_) {
+        if (frame_host_) {
+          frame_host_->Send(new DevToolsAgentMsg_DispatchOnInspectorBackend(
+              frame_host_->GetRoutingID(), message.session_id, message.call_id,
+              message.method, message.message));
+        }
+        session()->waiting_messages()[message.call_id] = {message.method,
+                                                          message.message};
       }
     }
-    waiting_for_response_messages_.insert(suspended_messages_.begin(),
-                                          suspended_messages_.end());
     suspended_messages_.clear();
   }
   if (handle->HasCommitted()) {
@@ -710,26 +706,18 @@
   if (!session() || !frame_host_)
     return;
   int session_id = session()->session_id();
-  frame_host_->Send(new DevToolsAgentMsg_Reattach(
-      frame_host_->GetRoutingID(), GetId(), session_id,
-      chunk_processor_.state_cookie()));
-  for (const auto& pair : waiting_for_response_messages_) {
-    const Message& message = pair.second;
+  frame_host_->Send(new DevToolsAgentMsg_Reattach(frame_host_->GetRoutingID(),
+                                                  GetId(), session_id,
+                                                  session()->state_cookie()));
+  for (const auto& pair : session()->waiting_messages()) {
+    int call_id = pair.first;
+    const DevToolsSession::Message& message = pair.second;
     frame_host_->Send(new DevToolsAgentMsg_DispatchOnInspectorBackend(
-        frame_host_->GetRoutingID(), message.session_id, pair.first,
-        message.method, message.message));
+        frame_host_->GetRoutingID(), session_id, call_id, message.method,
+        message.message));
   }
 }
 
-void RenderFrameDevToolsAgentHost::SendMessageFromProcessor(
-    int session_id,
-    const std::string& message) {
-  int id = chunk_processor_.last_call_id();
-  waiting_for_response_messages_.erase(id);
-  SendMessageToClient(session_id, message);
-  // |this| may be deleted at this point.
-}
-
 void RenderFrameDevToolsAgentHost::GrantPolicy(RenderFrameHostImpl* host) {
   if (!host)
     return;
@@ -1267,7 +1255,7 @@
   bool success = true;
   if (IsBrowserSideNavigationEnabled()) {
     if (sender == frame_host_)
-      success = chunk_processor_.ProcessChunkedMessageFromAgent(message);
+      success = session()->ReceiveMessageChunk(message);
   } else {
     if (current_ && current_->host() == sender)
       success = current_->ProcessChunkedMessageFromAgent(message);

diff --git a/content/browser/devtools/render_frame_devtools_agent_host.h b/content/browser/devtools/render_frame_devtools_agent_host.h
index 675990f5..f63a57d 100644
--- a/content/browser/devtools/render_frame_devtools_agent_host.h
+++ b/content/browser/devtools/render_frame_devtools_agent_host.h

@@ -7,9 +7,9 @@
 
 #include <map>
 #include <memory>
-#include <unordered_set>
 
 #include "base/compiler_specific.h"
+#include "base/containers/flat_set.h"
 #include "base/macros.h"
 #include "build/build_config.h"
 #include "content/browser/devtools/devtools_agent_host_impl.h"
@@ -171,22 +171,18 @@
 
   // The active host we are talking to.
   RenderFrameHostImpl* frame_host_ = nullptr;
+  base::flat_set<NavigationHandleImpl*> navigation_handles_;
+  bool render_frame_alive_ = false;
+
+  // These messages were queued after suspending, not sent to the agent,
+  // and will be sent after resuming.
   struct Message {
     int session_id;
+    int call_id;
     std::string method;
     std::string message;
   };
-  // Chunk processor's state cookie always corresponds to a state before
-  // any of the suspended or waiting for response messages have been handled.
-  DevToolsMessageChunkProcessor chunk_processor_;
-  std::unordered_set<NavigationHandleImpl*> navigation_handles_;
-  bool render_frame_alive_ = false;
-  // These messages were sent before suspending, but their result have not been
-  // received yet, and state cookie has not been updated.
-  std::map<int, Message> waiting_for_response_messages_;
-  // These messages were queued after suspending, not sent to the agent,
-  // and will be sent after resuming.
-  std::map<int, Message> suspended_messages_;
+  std::vector<Message> suspended_messages_;
 
   // The FrameTreeNode associated with this agent.
   FrameTreeNode* frame_tree_node_;

diff --git a/content/browser/devtools/worker_devtools_agent_host.cc b/content/browser/devtools/worker_devtools_agent_host.cc
index c545a571..bf2b0437 100644
--- a/content/browser/devtools/worker_devtools_agent_host.cc
+++ b/content/browser/devtools/worker_devtools_agent_host.cc

@@ -65,6 +65,7 @@
   if (RenderProcessHost* host = RenderProcessHost::FromID(worker_id_.first)) {
     host->Send(new DevToolsAgentMsg_DispatchOnInspectorBackend(
         worker_id_.second, session->session_id(), call_id, method, message));
+    session->waiting_messages()[call_id] = {method, message};
   }
   return true;
 }
@@ -102,9 +103,16 @@
     state_ = WORKER_INSPECTED;
     AttachToWorker();
     if (RenderProcessHost* host = RenderProcessHost::FromID(worker_id_.first)) {
-      host->Send(new DevToolsAgentMsg_Reattach(
-          worker_id_.second, GetId(), session()->session_id(),
-          chunk_processor_.state_cookie()));
+      host->Send(new DevToolsAgentMsg_Reattach(worker_id_.second, GetId(),
+                                               session()->session_id(),
+                                               session()->state_cookie()));
+      for (const auto& pair : session()->waiting_messages()) {
+        int call_id = pair.first;
+        const DevToolsSession::Message& message = pair.second;
+        host->Send(new DevToolsAgentMsg_DispatchOnInspectorBackend(
+            worker_id_.second, session()->session_id(), call_id, message.method,
+            message.message));
+      }
     }
     OnAttachedStateChanged(true);
   } else if (state_ == WORKER_PAUSED_FOR_DEBUG_ON_START) {
@@ -137,8 +145,6 @@
 
 WorkerDevToolsAgentHost::WorkerDevToolsAgentHost(WorkerId worker_id)
     : DevToolsAgentHostImpl(base::GenerateGUID()),
-      chunk_processor_(base::Bind(&WorkerDevToolsAgentHost::SendMessageToClient,
-                                  base::Unretained(this))),
       state_(WORKER_UNINSPECTED),
       worker_id_(worker_id) {
   WorkerCreated();
@@ -169,8 +175,7 @@
     const DevToolsMessageChunk& message) {
   if (!IsAttached())
     return;
-
-  chunk_processor_.ProcessChunkedMessageFromAgent(message);
+  session()->ReceiveMessageChunk(message);
 }
 
 }  // namespace content

diff --git a/content/browser/devtools/worker_devtools_agent_host.h b/content/browser/devtools/worker_devtools_agent_host.h
index 4c6192e..b77176a 100644
--- a/content/browser/devtools/worker_devtools_agent_host.h
+++ b/content/browser/devtools/worker_devtools_agent_host.h

@@ -65,7 +65,6 @@
   void WorkerCreated();
   void OnDispatchOnInspectorFrontend(const DevToolsMessageChunk& message);
 
-  DevToolsMessageChunkProcessor chunk_processor_;
   WorkerState state_;
   WorkerId worker_id_;
   DISALLOW_COPY_AND_ASSIGN(WorkerDevToolsAgentHost);

diff --git a/content/browser/download/download_browsertest.cc b/content/browser/download/download_browsertest.cc
index c85b7d5..5c470de 100644
--- a/content/browser/download/download_browsertest.cc
+++ b/content/browser/download/download_browsertest.cc

@@ -582,9 +582,7 @@
     base::FilePath mock_base(GetTestFilePath("download", ""));
     BrowserThread::PostTask(
         BrowserThread::IO, FROM_HERE,
-        base::Bind(
-            &net::URLRequestMockHTTPJob::AddUrlHandlers, mock_base,
-            make_scoped_refptr(content::BrowserThread::GetBlockingPool())));
+        base::Bind(&net::URLRequestMockHTTPJob::AddUrlHandlers, mock_base));
     ASSERT_TRUE(embedded_test_server()->Start());
     const std::string real_host =
         embedded_test_server()->host_port_pair().host();

diff --git a/content/browser/download/drag_download_file_browsertest.cc b/content/browser/download/drag_download_file_browsertest.cc
index 6753598..f6190ff1 100644
--- a/content/browser/download/drag_download_file_browsertest.cc
+++ b/content/browser/download/drag_download_file_browsertest.cc

@@ -7,7 +7,6 @@
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/message_loop/message_loop.h"
-#include "base/threading/sequenced_worker_pool.h"
 #include "content/browser/download/download_file_factory.h"
 #include "content/browser/download/download_file_impl.h"
 #include "content/browser/download/download_item_impl.h"
@@ -77,9 +76,7 @@
     base::FilePath mock_base(GetTestFilePath("download", ""));
     BrowserThread::PostTask(
         BrowserThread::IO, FROM_HERE,
-        base::Bind(
-            &net::URLRequestMockHTTPJob::AddUrlHandlers, mock_base,
-            make_scoped_refptr(content::BrowserThread::GetBlockingPool())));
+        base::Bind(&net::URLRequestMockHTTPJob::AddUrlHandlers, mock_base));
   }
 
   const base::FilePath& downloads_directory() const {

diff --git a/content/browser/download/save_package.cc b/content/browser/download/save_package.cc
index c299f67..4c587480 100644
--- a/content/browser/download/save_package.cc
+++ b/content/browser/download/save_package.cc

@@ -320,6 +320,10 @@
 
 void SavePackage::OnMHTMLGenerated(int64_t size) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  if (!download_)
+    return;
+
+  CHECK_EQ(download_->GetState(), DownloadItem::IN_PROGRESS);
   if (size <= 0) {
     Cancel(false);
     return;
@@ -704,6 +708,7 @@
 
   if (download_) {
     if (save_type_ != SAVE_PAGE_TYPE_AS_MHTML) {
+      CHECK_EQ(download_->GetState(), DownloadItem::IN_PROGRESS);
       download_->DestinationUpdate(
           all_save_items_count_, CurrentSpeed(),
           std::vector<DownloadItem::ReceivedSlice>());
@@ -735,6 +740,7 @@
   // Inform the DownloadItem to update UI.
   // We use the received bytes as number of saved files.
   if (download_) {
+    CHECK_EQ(download_->GetState(), DownloadItem::IN_PROGRESS);
     download_->DestinationUpdate(
         completed_count(), CurrentSpeed(),
         std::vector<DownloadItem::ReceivedSlice>());
@@ -1461,7 +1467,6 @@
 void SavePackage::FinalizeDownloadEntry() {
   DCHECK(download_);
   DCHECK(download_manager_);
-
   download_manager_->OnSavePackageSuccessfullyFinished(download_);
   download_ = nullptr;
   download_manager_ = nullptr;

diff --git a/content/browser/download/save_package_browsertest.cc b/content/browser/download/save_package_browsertest.cc
index 8f578664..ac393bbb 100644
--- a/content/browser/download/save_package_browsertest.cc
+++ b/content/browser/download/save_package_browsertest.cc

@@ -21,6 +21,66 @@
 
 const char kTestFile[] = "/simple_page.html";
 
+class TestShellDownloadManagerDelegate : public ShellDownloadManagerDelegate {
+ public:
+  explicit TestShellDownloadManagerDelegate(SavePageType save_page_type)
+      : save_page_type_(save_page_type) {}
+
+  void ChooseSavePath(WebContents* web_contents,
+                      const base::FilePath& suggested_path,
+                      const base::FilePath::StringType& default_extension,
+                      bool can_save_as_complete,
+                      const SavePackagePathPickedCallback& callback) override {
+    callback.Run(suggested_path, save_page_type_,
+                 SavePackageDownloadCreatedCallback());
+  }
+
+  void GetSaveDir(BrowserContext* context,
+                  base::FilePath* website_save_dir,
+                  base::FilePath* download_save_dir,
+                  bool* skip_dir_check) override {
+    *website_save_dir = download_dir_;
+    *download_save_dir = download_dir_;
+    *skip_dir_check = false;
+  }
+
+  bool ShouldCompleteDownload(DownloadItem* download,
+                              const base::Closure& closure) override {
+    return true;
+  }
+
+  base::FilePath download_dir_;
+  SavePageType save_page_type_;
+};
+
+class DownloadicidalObserver : public DownloadManager::Observer {
+ public:
+  explicit DownloadicidalObserver(bool remove_download)
+      : remove_download_(remove_download) {}
+  void OnDownloadCreated(DownloadManager* manager,
+                         DownloadItem* item) override {
+    base::SequencedTaskRunnerHandle::Get()->PostTask(
+        FROM_HERE, base::Bind(
+                       [](bool remove_download, const base::Closure& closure,
+                          DownloadItem* item) {
+                         remove_download ? item->Remove() : item->Cancel(true);
+                         closure.Run();
+                       },
+                       remove_download_, quit_closure_, item));
+  }
+  base::Closure quit_closure_;
+  bool remove_download_;
+};
+
+class SavePackageCompletionWaiter : public DownloadManager::Observer {
+ public:
+  void OnSavePackageSuccessfullyFinished(DownloadManager* m,
+                                         DownloadItem* d) override {
+    quit_closure_.Run();
+  }
+  base::Closure quit_closure_;
+};
+
 class SavePackageBrowserTest : public ContentBrowserTest {
  protected:
   void SetUp() override {
@@ -36,6 +96,53 @@
     *dir = save_dir_.GetPath().AppendASCII(prefix + "_files");
   }
 
+  // Start a SavePackage download and then cancels it. If |remove_download| is
+  // true, the download item will be removed while page is being saved.
+  // Otherwise, the download item will be canceled.
+  void RunAndCancelSavePackageDownload(SavePageType save_page_type,
+                                       bool remove_download) {
+    ASSERT_TRUE(embedded_test_server()->Start());
+    GURL url = embedded_test_server()->GetURL("/page_with_iframe.html");
+    NavigateToURL(shell(), url);
+    auto* download_manager =
+        static_cast<DownloadManagerImpl*>(BrowserContext::GetDownloadManager(
+            shell()->web_contents()->GetBrowserContext()));
+    auto delegate =
+        base::MakeUnique<TestShellDownloadManagerDelegate>(save_page_type);
+    delegate->download_dir_ = save_dir_.GetPath();
+    auto* old_delegate = download_manager->GetDelegate();
+    download_manager->SetDelegate(delegate.get());
+
+    {
+      base::RunLoop run_loop;
+      DownloadicidalObserver download_item_killer(false);
+      download_manager->AddObserver(&download_item_killer);
+      download_item_killer.quit_closure_ = run_loop.QuitClosure();
+
+      scoped_refptr<SavePackage> save_package(
+          new SavePackage(shell()->web_contents()));
+      save_package->GetSaveInfo();
+      run_loop.Run();
+      download_manager->RemoveObserver(&download_item_killer);
+      EXPECT_TRUE(save_package->canceled());
+    }
+
+    // Run a second download to completion so that any pending tasks will get
+    // flushed out. If the previous SavePackage operation didn't cleanup after
+    // itself, then there could be stray tasks that invoke the now defunct
+    // download item.
+    {
+      base::RunLoop run_loop;
+      SavePackageCompletionWaiter completion_waiter;
+      completion_waiter.quit_closure_ = run_loop.QuitClosure();
+      download_manager->AddObserver(&completion_waiter);
+      shell()->web_contents()->OnSavePage();
+      run_loop.Run();
+      download_manager->RemoveObserver(&completion_waiter);
+    }
+    download_manager->SetDelegate(old_delegate);
+  }
+
   // Temporary directory we will save pages to.
   base::ScopedTempDir save_dir_;
 };
@@ -68,98 +175,11 @@
 }
 
 IN_PROC_BROWSER_TEST_F(SavePackageBrowserTest, DownloadItemDestroyed) {
-  class TestShellDownloadManagerDelegate : public ShellDownloadManagerDelegate {
-   public:
-    void ChooseSavePath(
-        WebContents* web_contents,
-        const base::FilePath& suggested_path,
-        const base::FilePath::StringType& default_extension,
-        bool can_save_as_complete,
-        const SavePackagePathPickedCallback& callback) override {
-      callback.Run(suggested_path, SAVE_PAGE_TYPE_AS_COMPLETE_HTML,
-                   SavePackageDownloadCreatedCallback());
-    }
+  RunAndCancelSavePackageDownload(SAVE_PAGE_TYPE_AS_COMPLETE_HTML, true);
+}
 
-    void GetSaveDir(BrowserContext* context,
-                    base::FilePath* website_save_dir,
-                    base::FilePath* download_save_dir,
-                    bool* skip_dir_check) override {
-      *website_save_dir = download_dir_;
-      *download_save_dir = download_dir_;
-      *skip_dir_check = false;
-    }
-
-    bool ShouldCompleteDownload(DownloadItem* download,
-                                const base::Closure& closure) override {
-      return true;
-    }
-
-    base::FilePath download_dir_;
-  };
-
-  class DownloadicidalObserver : public DownloadManager::Observer {
-   public:
-    void OnDownloadCreated(DownloadManager* manager,
-                           DownloadItem* item) override {
-      base::SequencedTaskRunnerHandle::Get()->PostTask(
-          FROM_HERE, base::Bind(
-                         [](const base::Closure& closure, DownloadItem* item) {
-                           item->Remove();
-                           closure.Run();
-                         },
-                         quit_closure_, item));
-    }
-    base::Closure quit_closure_;
-  };
-
-  ASSERT_TRUE(embedded_test_server()->Start());
-  GURL url = embedded_test_server()->GetURL("/page_with_iframe.html");
-  NavigateToURL(shell(), url);
-  auto* download_manager =
-      static_cast<DownloadManagerImpl*>(BrowserContext::GetDownloadManager(
-          shell()->web_contents()->GetBrowserContext()));
-  auto delegate = base::MakeUnique<TestShellDownloadManagerDelegate>();
-  delegate->download_dir_ = save_dir_.GetPath();
-  auto* old_delegate = download_manager->GetDelegate();
-  download_manager->SetDelegate(delegate.get());
-
-  {
-    base::RunLoop run_loop;
-    DownloadicidalObserver download_item_killer;
-    download_manager->AddObserver(&download_item_killer);
-    download_item_killer.quit_closure_ = run_loop.QuitClosure();
-
-    scoped_refptr<SavePackage> save_package(
-        new SavePackage(shell()->web_contents()));
-    save_package->GetSaveInfo();
-    run_loop.Run();
-    download_manager->RemoveObserver(&download_item_killer);
-    EXPECT_TRUE(save_package->canceled());
-  }
-
-  class SavePackageCompletionWaiter : public DownloadManager::Observer {
-   public:
-    void OnSavePackageSuccessfullyFinished(DownloadManager* m,
-                                           DownloadItem* d) override {
-      quit_closure_.Run();
-    }
-    base::Closure quit_closure_;
-  };
-
-  // Run a second download to completion so that any pending tasks will get
-  // flushed out. If the previous SavePackage operation didn't cleanup after
-  // itself, then there could be stray tasks that invoke the now defunct
-  // download item.
-  {
-    base::RunLoop run_loop;
-    SavePackageCompletionWaiter completion_waiter;
-    completion_waiter.quit_closure_ = run_loop.QuitClosure();
-    download_manager->AddObserver(&completion_waiter);
-    shell()->web_contents()->OnSavePage();
-    run_loop.Run();
-    download_manager->RemoveObserver(&completion_waiter);
-  }
-  download_manager->SetDelegate(old_delegate);
+IN_PROC_BROWSER_TEST_F(SavePackageBrowserTest, DownloadItemCanceled) {
+  RunAndCancelSavePackageDownload(SAVE_PAGE_TYPE_AS_MHTML, false);
 }
 
 }  // namespace content

diff --git a/content/browser/frame_host/interstitial_page_impl.cc b/content/browser/frame_host/interstitial_page_impl.cc
index a4f63821..d41d52b 100644
--- a/content/browser/frame_host/interstitial_page_impl.cc
+++ b/content/browser/frame_host/interstitial_page_impl.cc

@@ -540,6 +540,11 @@
   return base::EmptyString();
 }
 
+bool InterstitialPageImpl::ShowingInterstitialPage() const {
+  // An interstitial page never shows a second interstitial.
+  return false;
+}
+
 RendererPreferences InterstitialPageImpl::GetRendererPrefs(
     BrowserContext* browser_context) const {
   delegate_->OverrideRendererPrefs(&renderer_preferences_);

diff --git a/content/browser/frame_host/interstitial_page_impl.h b/content/browser/frame_host/interstitial_page_impl.h
index 71c33a0e..2fd048a 100644
--- a/content/browser/frame_host/interstitial_page_impl.h
+++ b/content/browser/frame_host/interstitial_page_impl.h

@@ -98,6 +98,7 @@
   // NavigatorDelegate implementation.
   WebContents* OpenURL(const OpenURLParams& params) override;
   const std::string& GetUserAgentOverride() const override;
+  bool ShowingInterstitialPage() const override;
 
  protected:
   // NotificationObserver method:

diff --git a/content/browser/frame_host/interstitial_page_impl_browsertest.cc b/content/browser/frame_host/interstitial_page_impl_browsertest.cc
index 5d3baee..c8e9148 100644
--- a/content/browser/frame_host/interstitial_page_impl_browsertest.cc
+++ b/content/browser/frame_host/interstitial_page_impl_browsertest.cc

@@ -14,8 +14,10 @@
 #include "content/public/browser/browser_message_filter.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/interstitial_page_delegate.h"
+#include "content/public/common/browser_side_navigation_policy.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
+#include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_utils.h"
 #include "content/shell/browser/shell.h"
 #include "ipc/message_filter.h"
@@ -313,4 +315,50 @@
   TearDownInterstitialPage();
 }
 
+// Ensure that we don't show the underlying RenderWidgetHostView if a subframe
+// commits in the original page while an interstitial is showing.
+// See https://crbug.com/729105.
+IN_PROC_BROWSER_TEST_F(InterstitialPageImplTest, UnderlyingSubframeCommit) {
+  // This test doesn't apply in PlzNavigate, since the subframe does not
+  // succesfully commit in that mode.
+  // TODO(creis, clamy): Determine if this is a bug that should be fixed.
+  if (IsBrowserSideNavigationEnabled())
+    return;
+
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  // Load an initial page and inject an iframe that won't commit yet.
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  GURL main_url(embedded_test_server()->GetURL("/title1.html"));
+  GURL slow_url(embedded_test_server()->GetURL("/title2.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
+  TestNavigationManager subframe_delayer(web_contents, slow_url);
+  {
+    std::string script =
+        "var iframe = document.createElement('iframe');"
+        "iframe.src = '" +
+        slow_url.spec() +
+        "';"
+        "document.body.appendChild(iframe);";
+    EXPECT_TRUE(ExecuteScript(web_contents->GetMainFrame(), script));
+  }
+  EXPECT_TRUE(subframe_delayer.WaitForRequestStart());
+
+  // Show an interstitial. The underlying RenderWidgetHostView should not be
+  // showing.
+  SetUpInterstitialPage();
+  EXPECT_FALSE(web_contents->GetMainFrame()->GetView()->IsShowing());
+  EXPECT_TRUE(web_contents->GetMainFrame()->GetRenderWidgetHost()->is_hidden());
+
+  // Allow the subframe to commit.
+  subframe_delayer.WaitForNavigationFinished();
+
+  // The underlying RenderWidgetHostView should still not be showing.
+  EXPECT_FALSE(web_contents->GetMainFrame()->GetView()->IsShowing());
+  EXPECT_TRUE(web_contents->GetMainFrame()->GetRenderWidgetHost()->is_hidden());
+
+  TearDownInterstitialPage();
+}
+
 }  // namespace content

diff --git a/content/browser/frame_host/navigator_delegate.h b/content/browser/frame_host/navigator_delegate.h
index 408a06ab..93a3e437 100644
--- a/content/browser/frame_host/navigator_delegate.h
+++ b/content/browser/frame_host/navigator_delegate.h

@@ -127,6 +127,10 @@
   // embedder and |nullptr| is returned.
   virtual std::unique_ptr<NavigationUIData> GetNavigationUIData(
       NavigationHandle* navigation_handle);
+
+  // Whether the delegate is displaying an interstitial page over the current
+  // page.
+  virtual bool ShowingInterstitialPage() const = 0;
 };
 
 }  // namspace content

diff --git a/content/browser/frame_host/navigator_impl.cc b/content/browser/frame_host/navigator_impl.cc
index 22a40a6..8268976 100644
--- a/content/browser/frame_host/navigator_impl.cc
+++ b/content/browser/frame_host/navigator_impl.cc

@@ -263,9 +263,7 @@
     // in the previous tab type. If you navigate somewhere that activates the
     // tab with the interstitial again, you'll see a flash before the new load
     // commits of the interstitial page.
-    FrameTreeNode* root =
-        render_frame_host->frame_tree_node()->frame_tree()->root();
-    if (root->render_manager()->interstitial_page() != NULL) {
+    if (delegate_ && delegate_->ShowingInterstitialPage()) {
       LOG(WARNING) << "Discarding message during interstitial.";
       return;
     }

diff --git a/content/browser/frame_host/render_frame_host_manager.cc b/content/browser/frame_host/render_frame_host_manager.cc
index 8dfa783..8da3cb7c 100644
--- a/content/browser/frame_host/render_frame_host_manager.cc
+++ b/content/browser/frame_host/render_frame_host_manager.cc

@@ -61,7 +61,6 @@
       delegate_(delegate),
       render_frame_delegate_(render_frame_delegate),
       render_widget_delegate_(render_widget_delegate),
-      interstitial_page_(nullptr),
       weak_factory_(this) {
   DCHECK(frame_tree_node_);
 }
@@ -133,8 +132,8 @@
 }
 
 RenderWidgetHostView* RenderFrameHostManager::GetRenderWidgetHostView() const {
-  if (interstitial_page_)
-    return interstitial_page_->GetView();
+  if (delegate_->GetInterstitialForRenderManager())
+    return delegate_->GetInterstitialForRenderManager()->GetView();
   if (render_frame_host_)
     return render_frame_host_->GetView();
   return nullptr;
@@ -1424,7 +1423,7 @@
   // SiteInstances if you type in a cross-site URL.  This means we have to
   // compare the entry's URL to the last committed entry's URL.
   NavigationEntry* current_entry = controller.GetLastCommittedEntry();
-  if (interstitial_page_) {
+  if (delegate_->GetInterstitialForRenderManager()) {
     // The interstitial is currently the last committed entry, but we want to
     // compare against the last non-interstitial entry.
     current_entry = controller.GetEntryAtOffset(-1);
@@ -2825,13 +2824,13 @@
 }
 
 void RenderFrameHostManager::EnsureRenderFrameHostVisibilityConsistent() {
-  if (render_frame_host_->GetView() &&
-      render_frame_host_->render_view_host()->GetWidget()->is_hidden() !=
-          delegate_->IsHidden()) {
+  RenderWidgetHostView* view = GetRenderWidgetHostView();
+  if (view && static_cast<RenderWidgetHostImpl*>(view->GetRenderWidgetHost())
+                      ->is_hidden() != delegate_->IsHidden()) {
     if (delegate_->IsHidden()) {
-      render_frame_host_->GetView()->Hide();
+      view->Hide();
     } else {
-      render_frame_host_->GetView()->Show();
+      view->Show();
     }
   }
 }

diff --git a/content/browser/frame_host/render_frame_host_manager.h b/content/browser/frame_host/render_frame_host_manager.h
index 24810ed1..da2d654 100644
--- a/content/browser/frame_host/render_frame_host_manager.h
+++ b/content/browser/frame_host/render_frame_host_manager.h

@@ -156,6 +156,10 @@
     virtual NavigationEntry*
         GetLastCommittedNavigationEntryForRenderManager() = 0;
 
+    // Returns the interstitial page showing in the delegate, or null if there
+    // is none.
+    virtual InterstitialPageImpl* GetInterstitialForRenderManager() = 0;
+
     // Returns true if the location bar should be focused by default rather than
     // the page contents. The view calls this function when the tab is focused
     // to see what it should do.
@@ -344,25 +348,6 @@
   // SiteInstance.
   void CreateProxiesForChildFrame(FrameTreeNode* child);
 
-  // Sets the passed passed interstitial as the currently showing interstitial.
-  // |interstitial_page| should be non NULL (use the remove_interstitial_page
-  // method to unset the interstitial) and no interstitial page should be set
-  // when there is already a non NULL interstitial page set.
-  void set_interstitial_page(InterstitialPageImpl* interstitial_page) {
-    DCHECK(!interstitial_page_ && interstitial_page);
-    interstitial_page_ = interstitial_page;
-  }
-
-  // Unsets the currently showing interstitial.
-  void remove_interstitial_page() {
-    DCHECK(interstitial_page_);
-    interstitial_page_ = NULL;
-  }
-
-  // Returns the currently showing interstitial, NULL if no interstitial is
-  // showing.
-  InterstitialPageImpl* interstitial_page() const { return interstitial_page_; }
-
   // Returns the swapped out RenderViewHost for the given SiteInstance, if any.
   // This method is *deprecated* and GetRenderFrameProxyHost should be used.
   RenderViewHostImpl* GetSwappedOutRenderViewHost(SiteInstance* instance) const;
@@ -800,10 +785,6 @@
   using RFHPendingDeleteList = std::list<std::unique_ptr<RenderFrameHostImpl>>;
   RFHPendingDeleteList pending_delete_hosts_;
 
-  // The intersitial page currently shown if any, not own by this class
-  // (the InterstitialPage is self-owned, it deletes itself when hidden).
-  InterstitialPageImpl* interstitial_page_;
-
   // PlzNavigate
   // Stores a speculative RenderFrameHost which is created early in a navigation
   // so a renderer process can be started in parallel, if needed.

diff --git a/content/browser/gpu/gpu_process_host.cc b/content/browser/gpu/gpu_process_host.cc
index 40fbc05..58e04bd 100644
--- a/content/browser/gpu/gpu_process_host.cc
+++ b/content/browser/gpu/gpu_process_host.cc

@@ -66,6 +66,7 @@
 #include "services/service_manager/public/cpp/interface_provider.h"
 #include "services/service_manager/runner/common/client_util.h"
 #include "ui/display/display_switches.h"
+#include "ui/gfx/color_space_switches.h"
 #include "ui/gfx/switches.h"
 #include "ui/gl/gl_switches.h"
 #include "ui/latency/latency_info.h"

diff --git a/content/browser/indexed_db/indexed_db_backing_store_unittest.cc b/content/browser/indexed_db/indexed_db_backing_store_unittest.cc
index f612670..36a2178 100644
--- a/content/browser/indexed_db/indexed_db_backing_store_unittest.cc
+++ b/content/browser/indexed_db/indexed_db_backing_store_unittest.cc

@@ -252,26 +252,22 @@
         origin, url_request_context_getter_);
 
     // useful keys and values during tests
-    m_value1 = IndexedDBValue("value1", std::vector<IndexedDBBlobInfo>());
-    m_value2 = IndexedDBValue("value2", std::vector<IndexedDBBlobInfo>());
+    value1_ = IndexedDBValue("value1", std::vector<IndexedDBBlobInfo>());
+    value2_ = IndexedDBValue("value2", std::vector<IndexedDBBlobInfo>());
 
-    m_blob_info.push_back(
+    blob_info_.push_back(
         IndexedDBBlobInfo("uuid 3", base::UTF8ToUTF16("blob type"), 1));
-    m_blob_info.push_back(
-        IndexedDBBlobInfo("uuid 4",
-                          base::FilePath(FILE_PATH_LITERAL("path/to/file")),
-                          base::UTF8ToUTF16("file name"),
-                          base::UTF8ToUTF16("file type")));
-    m_blob_info.push_back(
-        IndexedDBBlobInfo("uuid 5",
-                          base::FilePath(),
-                          base::UTF8ToUTF16("file name"),
-                          base::UTF8ToUTF16("file type")));
-    m_value3 = IndexedDBValue("value3", m_blob_info);
+    blob_info_.push_back(IndexedDBBlobInfo(
+        "uuid 4", base::FilePath(FILE_PATH_LITERAL("path/to/file")),
+        base::UTF8ToUTF16("file name"), base::UTF8ToUTF16("file type")));
+    blob_info_.push_back(IndexedDBBlobInfo("uuid 5", base::FilePath(),
+                                           base::UTF8ToUTF16("file name"),
+                                           base::UTF8ToUTF16("file type")));
+    value3_ = IndexedDBValue("value3", blob_info_);
 
-    m_key1 = IndexedDBKey(99, blink::kWebIDBKeyTypeNumber);
-    m_key2 = IndexedDBKey(ASCIIToUTF16("key2"));
-    m_key3 = IndexedDBKey(ASCIIToUTF16("key3"));
+    key1_ = IndexedDBKey(99, blink::kWebIDBKeyTypeNumber);
+    key2_ = IndexedDBKey(ASCIIToUTF16("key2"));
+    key3_ = IndexedDBKey(ASCIIToUTF16("key3"));
   }
 
   void TearDown() override {
@@ -281,10 +277,10 @@
   // This just checks the data that survive getting stored and recalled, e.g.
   // the file path and UUID will change and thus aren't verified.
   bool CheckBlobInfoMatches(const std::vector<IndexedDBBlobInfo>& reads) const {
-    if (m_blob_info.size() != reads.size())
+    if (blob_info_.size() != reads.size())
       return false;
-    for (size_t i = 0; i < m_blob_info.size(); ++i) {
-      const IndexedDBBlobInfo& a = m_blob_info[i];
+    for (size_t i = 0; i < blob_info_.size(); ++i) {
+      const IndexedDBBlobInfo& a = blob_info_[i];
       const IndexedDBBlobInfo& b = reads[i];
       if (a.is_file() != b.is_file())
         return false;
@@ -318,12 +314,12 @@
   }
 
   bool CheckBlobWrites() const {
-    if (backing_store_->writes().size() != m_blob_info.size())
+    if (backing_store_->writes().size() != blob_info_.size())
       return false;
     for (size_t i = 0; i < backing_store_->writes().size(); ++i) {
       const IndexedDBBackingStore::Transaction::WriteDescriptor& desc =
           backing_store_->writes()[i];
-      const IndexedDBBlobInfo& info = m_blob_info[i];
+      const IndexedDBBlobInfo& info = blob_info_[i];
       if (desc.is_file() != info.is_file()) {
         if (!info.is_file() || !info.file_path().empty())
           return false;
@@ -363,13 +359,13 @@
   scoped_refptr<TestableIndexedDBBackingStore> backing_store_;
 
   // Sample keys and values that are consistent.
-  IndexedDBKey m_key1;
-  IndexedDBKey m_key2;
-  IndexedDBKey m_key3;
-  IndexedDBValue m_value1;
-  IndexedDBValue m_value2;
-  IndexedDBValue m_value3;
-  std::vector<IndexedDBBlobInfo> m_blob_info;
+  IndexedDBKey key1_;
+  IndexedDBKey key2_;
+  IndexedDBKey key3_;
+  IndexedDBValue value1_;
+  IndexedDBValue value2_;
+  IndexedDBValue value3_;
+  std::vector<IndexedDBBlobInfo> blob_info_;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(IndexedDBBackingStoreTest);
@@ -407,8 +403,8 @@
     transaction1.Begin();
     std::vector<std::unique_ptr<storage::BlobDataHandle>> handles;
     IndexedDBBackingStore::RecordIdentifier record;
-    leveldb::Status s = backing_store_->PutRecord(
-        &transaction1, 1, 1, m_key1, &m_value1, &handles, &record);
+    leveldb::Status s = backing_store_->PutRecord(&transaction1, 1, 1, key1_,
+                                                  &value1_, &handles, &record);
     EXPECT_TRUE(s.ok());
     scoped_refptr<TestCallback> callback(new TestCallback());
     EXPECT_TRUE(transaction1.CommitPhaseOne(callback).ok());
@@ -422,14 +418,14 @@
     transaction2.Begin();
     IndexedDBValue result_value;
     EXPECT_TRUE(
-        backing_store_->GetRecord(&transaction2, 1, 1, m_key1, &result_value)
+        backing_store_->GetRecord(&transaction2, 1, 1, key1_, &result_value)
             .ok());
     scoped_refptr<TestCallback> callback(new TestCallback());
     EXPECT_TRUE(transaction2.CommitPhaseOne(callback).ok());
     EXPECT_TRUE(callback->called);
     EXPECT_TRUE(callback->succeeded);
     EXPECT_TRUE(transaction2.CommitPhaseTwo().ok());
-    EXPECT_EQ(m_value1.bits, result_value.bits);
+    EXPECT_EQ(value1_.bits, result_value.bits);
   }
 }
 
@@ -439,13 +435,10 @@
     transaction1.Begin();
     std::vector<std::unique_ptr<storage::BlobDataHandle>> handles;
     IndexedDBBackingStore::RecordIdentifier record;
-    EXPECT_TRUE(backing_store_->PutRecord(&transaction1,
-                                          1,
-                                          1,
-                                          m_key3,
-                                          &m_value3,
-                                          &handles,
-                                          &record).ok());
+    EXPECT_TRUE(
+        backing_store_
+            ->PutRecord(&transaction1, 1, 1, key3_, &value3_, &handles, &record)
+            .ok());
     scoped_refptr<TestCallback> callback(new TestCallback());
     EXPECT_TRUE(transaction1.CommitPhaseOne(callback).ok());
     task_runner_->RunUntilIdle();
@@ -460,14 +453,14 @@
     transaction2.Begin();
     IndexedDBValue result_value;
     EXPECT_TRUE(
-        backing_store_->GetRecord(&transaction2, 1, 1, m_key3, &result_value)
+        backing_store_->GetRecord(&transaction2, 1, 1, key3_, &result_value)
             .ok());
     scoped_refptr<TestCallback> callback(new TestCallback());
     EXPECT_TRUE(transaction2.CommitPhaseOne(callback).ok());
     EXPECT_TRUE(callback->called);
     EXPECT_TRUE(callback->succeeded);
     EXPECT_TRUE(transaction2.CommitPhaseTwo().ok());
-    EXPECT_EQ(m_value3.bits, result_value.bits);
+    EXPECT_EQ(value3_.bits, result_value.bits);
     EXPECT_TRUE(CheckBlobInfoMatches(result_value.blob_info));
     EXPECT_TRUE(CheckBlobReadsMatchWrites(result_value.blob_info));
   }
@@ -476,10 +469,9 @@
     IndexedDBBackingStore::Transaction transaction3(backing_store_.get());
     transaction3.Begin();
     IndexedDBValue result_value;
-    EXPECT_TRUE(
-        backing_store_
-            ->DeleteRange(&transaction3, 1, 1, IndexedDBKeyRange(m_key3))
-            .ok());
+    EXPECT_TRUE(backing_store_
+                    ->DeleteRange(&transaction3, 1, 1, IndexedDBKeyRange(key3_))
+                    .ok());
     scoped_refptr<TestCallback> callback(new TestCallback());
     EXPECT_TRUE(transaction3.CommitPhaseOne(callback).ok());
     task_runner_->RunUntilIdle();
@@ -672,8 +664,10 @@
   transaction1.Begin();
   std::vector<std::unique_ptr<storage::BlobDataHandle>> handles1;
   IndexedDBBackingStore::RecordIdentifier record1;
-  EXPECT_TRUE(backing_store_->PutRecord(&transaction1, 1, 1, m_key3, &m_value3,
-                                        &handles1, &record1).ok());
+  EXPECT_TRUE(
+      backing_store_
+          ->PutRecord(&transaction1, 1, 1, key3_, &value3_, &handles1, &record1)
+          .ok());
   scoped_refptr<TestCallback> callback1(new TestCallback());
   EXPECT_TRUE(transaction1.CommitPhaseOne(callback1).ok());
   task_runner_->RunUntilIdle();
@@ -686,8 +680,10 @@
   transaction2.Begin();
   std::vector<std::unique_ptr<storage::BlobDataHandle>> handles2;
   IndexedDBBackingStore::RecordIdentifier record2;
-  EXPECT_TRUE(backing_store_->PutRecord(&transaction2, 1, 1, m_key1, &m_value1,
-                                        &handles2, &record2).ok());
+  EXPECT_TRUE(
+      backing_store_
+          ->PutRecord(&transaction2, 1, 1, key1_, &value1_, &handles2, &record2)
+          .ok());
   scoped_refptr<TestCallback> callback2(new TestCallback());
   EXPECT_TRUE(transaction2.CommitPhaseOne(callback2).ok());
   task_runner_->RunUntilIdle();
@@ -709,13 +705,10 @@
     transaction1.Begin();
     std::vector<std::unique_ptr<storage::BlobDataHandle>> handles;
     IndexedDBBackingStore::RecordIdentifier record;
-    EXPECT_TRUE(backing_store_->PutRecord(&transaction1,
-                                          1,
-                                          1,
-                                          m_key3,
-                                          &m_value3,
-                                          &handles,
-                                          &record).ok());
+    EXPECT_TRUE(
+        backing_store_
+            ->PutRecord(&transaction1, 1, 1, key3_, &value3_, &handles, &record)
+            .ok());
     scoped_refptr<TestCallback> callback(new TestCallback());
     EXPECT_TRUE(transaction1.CommitPhaseOne(callback).ok());
     task_runner_->RunUntilIdle();
@@ -729,16 +722,15 @@
   {
     IndexedDBBackingStore::Transaction transaction2(backing_store_.get());
     transaction2.Begin();
-    EXPECT_TRUE(
-        backing_store_->GetRecord(
-                            &transaction2, 1, 1, m_key3, &read_result_value)
-            .ok());
+    EXPECT_TRUE(backing_store_
+                    ->GetRecord(&transaction2, 1, 1, key3_, &read_result_value)
+                    .ok());
     scoped_refptr<TestCallback> callback(new TestCallback());
     EXPECT_TRUE(transaction2.CommitPhaseOne(callback).ok());
     EXPECT_TRUE(callback->called);
     EXPECT_TRUE(callback->succeeded);
     EXPECT_TRUE(transaction2.CommitPhaseTwo().ok());
-    EXPECT_EQ(m_value3.bits, read_result_value.bits);
+    EXPECT_EQ(value3_.bits, read_result_value.bits);
     EXPECT_TRUE(CheckBlobInfoMatches(read_result_value.blob_info));
     EXPECT_TRUE(CheckBlobReadsMatchWrites(read_result_value.blob_info));
     for (size_t i = 0; i < read_result_value.blob_info.size(); ++i) {
@@ -749,10 +741,9 @@
   {
     IndexedDBBackingStore::Transaction transaction3(backing_store_.get());
     transaction3.Begin();
-    EXPECT_TRUE(
-        backing_store_
-            ->DeleteRange(&transaction3, 1, 1, IndexedDBKeyRange(m_key3))
-            .ok());
+    EXPECT_TRUE(backing_store_
+                    ->DeleteRange(&transaction3, 1, 1, IndexedDBKeyRange(key3_))
+                    .ok());
     scoped_refptr<TestCallback> callback(new TestCallback());
     EXPECT_TRUE(transaction3.CommitPhaseOne(callback).ok());
     task_runner_->RunUntilIdle();
@@ -780,7 +771,7 @@
 
   const int64_t invalid_high_index_id = 1ULL << 37;
 
-  const IndexedDBKey& index_key = m_key2;
+  const IndexedDBKey& index_key = key2_;
   std::string index_key_raw;
   EncodeIDBKey(index_key, &index_key_raw);
   {
@@ -788,13 +779,9 @@
     transaction1.Begin();
     std::vector<std::unique_ptr<storage::BlobDataHandle>> handles;
     IndexedDBBackingStore::RecordIdentifier record;
-    leveldb::Status s = backing_store_->PutRecord(&transaction1,
-                                                  high_database_id,
-                                                  high_object_store_id,
-                                                  m_key1,
-                                                  &m_value1,
-                                                  &handles,
-                                                  &record);
+    leveldb::Status s = backing_store_->PutRecord(
+        &transaction1, high_database_id, high_object_store_id, key1_, &value1_,
+        &handles, &record);
     EXPECT_TRUE(s.ok());
 
     s = backing_store_->PutIndexDataForRecord(&transaction1,
@@ -826,13 +813,11 @@
     IndexedDBBackingStore::Transaction transaction2(backing_store_.get());
     transaction2.Begin();
     IndexedDBValue result_value;
-    leveldb::Status s = backing_store_->GetRecord(&transaction2,
-                                                  high_database_id,
-                                                  high_object_store_id,
-                                                  m_key1,
-                                                  &result_value);
+    leveldb::Status s =
+        backing_store_->GetRecord(&transaction2, high_database_id,
+                                  high_object_store_id, key1_, &result_value);
     EXPECT_TRUE(s.ok());
-    EXPECT_EQ(m_value1.bits, result_value.bits);
+    EXPECT_EQ(value1_.bits, result_value.bits);
 
     std::unique_ptr<IndexedDBKey> new_primary_key;
     s = backing_store_->GetPrimaryKeyViaIndex(&transaction2,
@@ -850,7 +835,7 @@
                                               index_key,
                                               &new_primary_key);
     EXPECT_TRUE(s.ok());
-    EXPECT_TRUE(new_primary_key->Equals(m_key1));
+    EXPECT_TRUE(new_primary_key->Equals(key1_));
 
     scoped_refptr<TestCallback> callback(new TestCallback());
     s = transaction2.CommitPhaseOne(callback);
@@ -878,77 +863,54 @@
 
   std::vector<std::unique_ptr<storage::BlobDataHandle>> handles;
   IndexedDBBackingStore::RecordIdentifier record;
-  leveldb::Status s = backing_store_->PutRecord(&transaction1,
-                                                database_id,
-                                                KeyPrefix::kInvalidId,
-                                                m_key1,
-                                                &m_value1,
-                                                &handles,
-                                                &record);
+  leveldb::Status s = backing_store_->PutRecord(&transaction1, database_id,
+                                                KeyPrefix::kInvalidId, key1_,
+                                                &value1_, &handles, &record);
   EXPECT_FALSE(s.ok());
-  s = backing_store_->PutRecord(
-      &transaction1, database_id, 0, m_key1, &m_value1, &handles, &record);
+  s = backing_store_->PutRecord(&transaction1, database_id, 0, key1_, &value1_,
+                                &handles, &record);
   EXPECT_FALSE(s.ok());
-  s = backing_store_->PutRecord(&transaction1,
-                                KeyPrefix::kInvalidId,
-                                object_store_id,
-                                m_key1,
-                                &m_value1,
-                                &handles,
+  s = backing_store_->PutRecord(&transaction1, KeyPrefix::kInvalidId,
+                                object_store_id, key1_, &value1_, &handles,
                                 &record);
   EXPECT_FALSE(s.ok());
-  s = backing_store_->PutRecord(
-      &transaction1, 0, object_store_id, m_key1, &m_value1, &handles, &record);
+  s = backing_store_->PutRecord(&transaction1, 0, object_store_id, key1_,
+                                &value1_, &handles, &record);
   EXPECT_FALSE(s.ok());
 
-  s = backing_store_->GetRecord(
-      &transaction1, database_id, KeyPrefix::kInvalidId, m_key1, &result_value);
+  s = backing_store_->GetRecord(&transaction1, database_id,
+                                KeyPrefix::kInvalidId, key1_, &result_value);
   EXPECT_FALSE(s.ok());
-  s = backing_store_->GetRecord(
-      &transaction1, database_id, 0, m_key1, &result_value);
-  EXPECT_FALSE(s.ok());
-  s = backing_store_->GetRecord(&transaction1,
-                                KeyPrefix::kInvalidId,
-                                object_store_id,
-                                m_key1,
+  s = backing_store_->GetRecord(&transaction1, database_id, 0, key1_,
                                 &result_value);
   EXPECT_FALSE(s.ok());
-  s = backing_store_->GetRecord(
-      &transaction1, 0, object_store_id, m_key1, &result_value);
+  s = backing_store_->GetRecord(&transaction1, KeyPrefix::kInvalidId,
+                                object_store_id, key1_, &result_value);
+  EXPECT_FALSE(s.ok());
+  s = backing_store_->GetRecord(&transaction1, 0, object_store_id, key1_,
+                                &result_value);
   EXPECT_FALSE(s.ok());
 
   std::unique_ptr<IndexedDBKey> new_primary_key;
-  s = backing_store_->GetPrimaryKeyViaIndex(&transaction1,
-                                            database_id,
-                                            object_store_id,
-                                            KeyPrefix::kInvalidId,
-                                            m_key1,
-                                            &new_primary_key);
-  EXPECT_FALSE(s.ok());
-  s = backing_store_->GetPrimaryKeyViaIndex(&transaction1,
-                                            database_id,
-                                            object_store_id,
-                                            invalid_low_index_id,
-                                            m_key1,
-                                            &new_primary_key);
+  s = backing_store_->GetPrimaryKeyViaIndex(
+      &transaction1, database_id, object_store_id, KeyPrefix::kInvalidId, key1_,
+      &new_primary_key);
   EXPECT_FALSE(s.ok());
   s = backing_store_->GetPrimaryKeyViaIndex(
-      &transaction1, database_id, object_store_id, 0, m_key1, &new_primary_key);
+      &transaction1, database_id, object_store_id, invalid_low_index_id, key1_,
+      &new_primary_key);
+  EXPECT_FALSE(s.ok());
+  s = backing_store_->GetPrimaryKeyViaIndex(
+      &transaction1, database_id, object_store_id, 0, key1_, &new_primary_key);
   EXPECT_FALSE(s.ok());
 
-  s = backing_store_->GetPrimaryKeyViaIndex(&transaction1,
-                                            KeyPrefix::kInvalidId,
-                                            object_store_id,
-                                            index_id,
-                                            m_key1,
-                                            &new_primary_key);
+  s = backing_store_->GetPrimaryKeyViaIndex(
+      &transaction1, KeyPrefix::kInvalidId, object_store_id, index_id, key1_,
+      &new_primary_key);
   EXPECT_FALSE(s.ok());
-  s = backing_store_->GetPrimaryKeyViaIndex(&transaction1,
-                                            database_id,
-                                            KeyPrefix::kInvalidId,
-                                            index_id,
-                                            m_key1,
-                                            &new_primary_key);
+  s = backing_store_->GetPrimaryKeyViaIndex(&transaction1, database_id,
+                                            KeyPrefix::kInvalidId, index_id,
+                                            key1_, &new_primary_key);
   EXPECT_FALSE(s.ok());
 }
 

diff --git a/content/browser/loader/resource_dispatcher_host_browsertest.cc b/content/browser/loader/resource_dispatcher_host_browsertest.cc
index 806df8c..e328092 100644
--- a/content/browser/loader/resource_dispatcher_host_browsertest.cc
+++ b/content/browser/loader/resource_dispatcher_host_browsertest.cc

@@ -17,7 +17,6 @@
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
-#include "base/threading/sequenced_worker_pool.h"
 #include "build/build_config.h"
 #include "content/browser/download/download_manager_impl.h"
 #include "content/browser/loader/resource_dispatcher_host_impl.h"
@@ -62,9 +61,7 @@
     base::FilePath path = GetTestFilePath("", "");
     BrowserThread::PostTask(
         BrowserThread::IO, FROM_HERE,
-        base::Bind(
-            &net::URLRequestMockHTTPJob::AddUrlHandlers, path,
-            make_scoped_refptr(content::BrowserThread::GetBlockingPool())));
+        base::Bind(&net::URLRequestMockHTTPJob::AddUrlHandlers, path));
     BrowserThread::PostTask(
         BrowserThread::IO, FROM_HERE,
         base::Bind(&net::URLRequestFailedJob::AddUrlHandler));

diff --git a/content/browser/loader/url_loader_factory_impl_unittest.cc b/content/browser/loader/url_loader_factory_impl_unittest.cc
index b7aa147..825991714 100644
--- a/content/browser/loader/url_loader_factory_impl_unittest.cc
+++ b/content/browser/loader/url_loader_factory_impl_unittest.cc

@@ -20,7 +20,6 @@
 #include "base/message_loop/message_loop.h"
 #include "base/path_service.h"
 #include "base/run_loop.h"
-#include "base/threading/sequenced_worker_pool.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/loader/mojo_async_resource_handler.h"
 #include "content/browser/loader/navigation_resource_throttle.h"
@@ -153,8 +152,7 @@
   mojom::URLLoaderAssociatedPtr loader;
   base::FilePath root;
   PathService::Get(DIR_TEST_DATA, &root);
-  net::URLRequestMockHTTPJob::AddUrlHandlers(root,
-                                             BrowserThread::GetBlockingPool());
+  net::URLRequestMockHTTPJob::AddUrlHandlers(root);
   ResourceRequest request;
   TestURLLoaderClient client;
   // Assume the file contents is small enough to be stored in the data pipe.
@@ -349,8 +347,7 @@
   mojom::URLLoaderAssociatedPtr loader;
   base::FilePath root;
   PathService::Get(DIR_TEST_DATA, &root);
-  net::URLRequestMockHTTPJob::AddUrlHandlers(root,
-                                             BrowserThread::GetBlockingPool());
+  net::URLRequestMockHTTPJob::AddUrlHandlers(root);
 
   ResourceRequest request;
   TestURLLoaderClient client;
@@ -477,8 +474,7 @@
   mojom::URLLoaderAssociatedPtr loader;
   base::FilePath root;
   PathService::Get(DIR_TEST_DATA, &root);
-  net::URLRequestMockHTTPJob::AddUrlHandlers(root,
-                                             BrowserThread::GetBlockingPool());
+  net::URLRequestMockHTTPJob::AddUrlHandlers(root);
   ResourceRequest request;
   TestURLLoaderClient client;
   // Assume the file contents is small enough to be stored in the data pipe.

diff --git a/content/browser/renderer_host/input/wheel_scroll_latching_browsertest.cc b/content/browser/renderer_host/input/wheel_scroll_latching_browsertest.cc
deleted file mode 100644
index 78dd9fc98..0000000
--- a/content/browser/renderer_host/input/wheel_scroll_latching_browsertest.cc
+++ /dev/null

@@ -1,239 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "base/test/scoped_feature_list.h"
-#include "content/browser/renderer_host/render_widget_host_impl.h"
-#include "content/browser/renderer_host/render_widget_host_input_event_router.h"
-#include "content/browser/web_contents/web_contents_impl.h"
-#include "content/common/input/synthetic_web_input_event_builders.h"
-#include "content/public/common/content_features.h"
-#include "content/public/test/browser_test_utils.h"
-#include "content/public/test/content_browser_test.h"
-#include "content/public/test/content_browser_test_utils.h"
-#include "content/shell/browser/shell.h"
-#include "ui/events/gesture_detection/gesture_configuration.h"
-
-#if defined(OS_ANDROID)
-#include "content/browser/renderer_host/render_widget_host_view_android.h"
-#endif
-
-using blink::WebMouseWheelEvent;
-
-namespace {
-void GiveItSomeTime() {
-  base::RunLoop run_loop;
-  base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
-      FROM_HERE, run_loop.QuitClosure(), base::TimeDelta::FromMilliseconds(10));
-  run_loop.Run();
-}
-
-const char kWheelEventLatchingDataURL[] =
-    "data:text/html;charset=utf-8,"
-    "<!DOCTYPE html>"
-    "<style>"
-    "body {"
-    " height: 10000px;"
-    "}"
-    "#scrollableDiv {"
-    " position: absolute;"
-    " left: 100px;"
-    " top: 200px;"
-    " width: 400px;"
-    " height: 800px;"
-    " overflow: scroll;"
-    " background: red;"
-    "}"
-    "#nestedDiv {"
-    " width: 400px;"
-    " height: 8000px;"
-    " opacity: 0;"
-    "}"
-    "</style>"
-    "<div id='scrollableDiv'>"
-    " <div id='nestedDiv'></div>"
-    "</div>"
-    "<script>"
-    " var scrollableDiv = document.getElementById('scrollableDiv');"
-    " var scrollableDivWheelEventCounter = 0;"
-    " var documentWheelEventCounter = 0;"
-    " scrollableDiv.addEventListener('wheel',"
-    "   function(e) { scrollableDivWheelEventCounter++;"
-    "                 e.stopPropagation(); });"
-    " document.scrollingElement.addEventListener('wheel',"
-    "   function(e) { documentWheelEventCounter++; });"
-    "</script>";
-}  // namespace
-
-namespace content {
-class WheelScrollLatchingBrowserTest : public ContentBrowserTest {
- public:
-  WheelScrollLatchingBrowserTest(bool wheel_scroll_latching_enabled = true)
-      : wheel_scroll_latching_enabled_(wheel_scroll_latching_enabled) {
-    ui::GestureConfiguration::GetInstance()->set_scroll_debounce_interval_in_ms(
-        0);
-
-    if (wheel_scroll_latching_enabled_)
-      EnableWheelScrollLatching();
-    else
-      DisableWheelScrollLatching();
-  }
-  ~WheelScrollLatchingBrowserTest() override {}
-
- protected:
-  RenderWidgetHostImpl* GetWidgetHost() {
-    return RenderWidgetHostImpl::From(
-        web_contents()->GetRenderViewHost()->GetWidget());
-  }
-
-  WebContentsImpl* web_contents() const {
-    return static_cast<WebContentsImpl*>(shell()->web_contents());
-  }
-
-  RenderWidgetHostInputEventRouter* GetRouter() {
-    return web_contents()->GetInputEventRouter();
-  }
-
-  RenderWidgetHostViewBase* GetRootView() {
-    return static_cast<RenderWidgetHostViewBase*>(web_contents()
-                                                      ->GetFrameTree()
-                                                      ->root()
-                                                      ->current_frame_host()
-                                                      ->GetView());
-  }
-
-  float GetPageScaleFactor() {
-    return GetWidgetHost()->last_frame_metadata().page_scale_factor;
-  }
-
-  void LoadURL() {
-    const GURL data_url(kWheelEventLatchingDataURL);
-    NavigateToURL(shell(), data_url);
-
-    RenderWidgetHostImpl* host = GetWidgetHost();
-    host->GetView()->SetSize(gfx::Size(600, 600));
-
-    // The page is loaded in the renderer, wait for a new frame to arrive.
-    while (!host->ScheduleComposite())
-      GiveItSomeTime();
-  }
-  int ExecuteScriptAndExtractInt(const std::string& script) {
-    int value = 0;
-    EXPECT_TRUE(content::ExecuteScriptAndExtractInt(
-        shell(), "domAutomationController.send(" + script + ")", &value));
-    return value;
-  }
-  void EnableWheelScrollLatching() {
-    feature_list_.InitFromCommandLine(
-        features::kTouchpadAndWheelScrollLatching.name, "");
-  }
-  void DisableWheelScrollLatching() {
-    feature_list_.InitFromCommandLine(
-        "", features::kTouchpadAndWheelScrollLatching.name);
-  }
-
-  void WheelEventTargetTest() {
-    LoadURL();
-    EXPECT_EQ(0, ExecuteScriptAndExtractInt("documentWheelEventCounter"));
-    EXPECT_EQ(0, ExecuteScriptAndExtractInt("scrollableDivWheelEventCounter"));
-
-    FrameWatcher frame_watcher(shell()->web_contents());
-    scoped_refptr<InputMsgWatcher> input_msg_watcher(new InputMsgWatcher(
-        GetWidgetHost(), blink::WebInputEvent::kMouseWheel));
-    float scale_factor = GetPageScaleFactor();
-
-    float scrollable_div_top =
-        ExecuteScriptAndExtractInt("scrollableDiv.getBoundingClientRect().top");
-    float x = scale_factor *
-              (ExecuteScriptAndExtractInt(
-                   "scrollableDiv.getBoundingClientRect().left") +
-               ExecuteScriptAndExtractInt(
-                   "scrollableDiv.getBoundingClientRect().right")) /
-              2;
-    float y = scale_factor * 0.5 * scrollable_div_top;
-    float delta_x = 0;
-    float delta_y = -0.5 * scrollable_div_top;
-    blink::WebMouseWheelEvent wheel_event =
-        SyntheticWebMouseWheelEventBuilder::Build(x, y, x, y, delta_x, delta_y,
-                                                  0, true);
-
-    wheel_event.phase = blink::WebMouseWheelEvent::kPhaseBegan;
-    GetRouter()->RouteMouseWheelEvent(GetRootView(), &wheel_event,
-                                      ui::LatencyInfo());
-
-    // Runs until we get the InputMsgAck callback.
-    EXPECT_EQ(INPUT_EVENT_ACK_STATE_NOT_CONSUMED,
-              input_msg_watcher->WaitForAck());
-
-    while (ExecuteScriptAndExtractInt("document.scrollingElement.scrollTop") <
-           -delta_y) {
-      frame_watcher.WaitFrames(1);
-    }
-
-    EXPECT_EQ(0, ExecuteScriptAndExtractInt("scrollableDiv.scrollTop"));
-    EXPECT_EQ(1, ExecuteScriptAndExtractInt("documentWheelEventCounter"));
-    EXPECT_EQ(0, ExecuteScriptAndExtractInt("scrollableDivWheelEventCounter"));
-
-    wheel_event.phase = blink::WebMouseWheelEvent::kPhaseChanged;
-    GetRouter()->RouteMouseWheelEvent(GetRootView(), &wheel_event,
-                                      ui::LatencyInfo());
-
-    // Runs until we get the InputMsgAck callback.
-    EXPECT_EQ(INPUT_EVENT_ACK_STATE_NOT_CONSUMED,
-              input_msg_watcher->WaitForAck());
-
-    if (wheel_scroll_latching_enabled_) {
-      while (ExecuteScriptAndExtractInt("document.scrollingElement.scrollTop") <
-             -2 * delta_y) {
-        frame_watcher.WaitFrames(1);
-      }
-
-      EXPECT_EQ(0, ExecuteScriptAndExtractInt("scrollableDiv.scrollTop"));
-      EXPECT_EQ(2, ExecuteScriptAndExtractInt("documentWheelEventCounter"));
-      EXPECT_EQ(0,
-                ExecuteScriptAndExtractInt("scrollableDivWheelEventCounter"));
-    } else {  // !wheel_scroll_latching_enabled_
-      while (ExecuteScriptAndExtractInt("scrollableDiv.scrollTop") < -delta_y)
-        frame_watcher.WaitFrames(1);
-
-      EXPECT_EQ(1, ExecuteScriptAndExtractInt("documentWheelEventCounter"));
-      EXPECT_EQ(1,
-                ExecuteScriptAndExtractInt("scrollableDivWheelEventCounter"));
-    }
-  }
-
- private:
-  base::test::ScopedFeatureList feature_list_;
-  bool wheel_scroll_latching_enabled_;
-};
-
-class WheelScrollLatchingDisabledBrowserTest
-    : public WheelScrollLatchingBrowserTest {
- public:
-  WheelScrollLatchingDisabledBrowserTest()
-      : WheelScrollLatchingBrowserTest(false) {}
-  ~WheelScrollLatchingDisabledBrowserTest() override {}
-};
-
-// Start scrolling by mouse wheel on the document: the wheel event will be sent
-// to the document's scrolling element, the scrollable div will be under the
-// cursor after applying the scrolling. Continue scrolling by mouse wheel, since
-// wheel scroll latching is enabled the wheel event will be still sent to the
-// document's scrolling element and the document's scrolling element will
-// continue scrolling.
-IN_PROC_BROWSER_TEST_F(WheelScrollLatchingBrowserTest, WheelEventTarget) {
-  WheelEventTargetTest();
-}
-
-// Start scrolling by mouse wheel on the document: the wheel event will be sent
-// to the document's scrolling element, the scrollable div will be under the
-// cursor after applying the scrolloffsets. Continue scrolling by mouse wheel,
-// since wheel scroll latching is disabled the wheel event will be still sent to
-// the scrollable div which is currently under the cursor. The div will start
-// scrolling.
-IN_PROC_BROWSER_TEST_F(WheelScrollLatchingDisabledBrowserTest,
-                       WheelEventTarget) {
-  WheelEventTargetTest();
-}
-
-}  // namespace content
\ No newline at end of file

diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
index bbb68141..2c2d83dc 100644
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc

@@ -202,7 +202,7 @@
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "ui/base/ui_base_switches.h"
 #include "ui/display/display_switches.h"
-#include "ui/gfx/switches.h"
+#include "ui/gfx/color_space_switches.h"
 #include "ui/gl/gl_switches.h"
 #include "ui/gl/gpu_switching_manager.h"
 #include "ui/native_theme/native_theme_features.h"

diff --git a/content/browser/renderer_host/render_view_host_impl.cc b/content/browser/renderer_host/render_view_host_impl.cc
index 7e8adbe..2b9c1d5 100644
--- a/content/browser/renderer_host/render_view_host_impl.cc
+++ b/content/browser/renderer_host/render_view_host_impl.cc

@@ -88,9 +88,9 @@
 #include "ui/display/display_switches.h"
 #include "ui/gfx/animation/animation.h"
 #include "ui/gfx/color_space.h"
+#include "ui/gfx/color_space_switches.h"
 #include "ui/gfx/image/image_skia.h"
 #include "ui/gfx/native_widget_types.h"
-#include "ui/gfx/switches.h"
 #include "ui/native_theme/native_theme_features.h"
 #include "url/url_constants.h"
 

diff --git a/content/browser/renderer_host/render_widget_host_input_event_router.cc b/content/browser/renderer_host/render_widget_host_input_event_router.cc
index c88f7d6..fe73293b 100644
--- a/content/browser/renderer_host/render_widget_host_input_event_router.cc
+++ b/content/browser/renderer_host/render_widget_host_input_event_router.cc

@@ -284,27 +284,7 @@
                        event->PositionInWidget().y),
             target, &transformed_point))
       return;
-  } else if (root_view->wheel_scroll_latching_enabled()) {
-    if (event->phase == blink::WebMouseWheelEvent::kPhaseBegan) {
-      wheel_target_.target = FindEventTarget(
-          root_view,
-          gfx::Point(event->PositionInWidget().x, event->PositionInWidget().y),
-          &transformed_point);
-      wheel_target_.delta =
-          transformed_point -
-          gfx::Point(event->PositionInWidget().x, event->PositionInWidget().y);
-      target = wheel_target_.target;
-    } else {
-      if (wheel_target_.target) {
-        target = wheel_target_.target;
-        transformed_point = gfx::Point(event->PositionInWidget().x,
-                                       event->PositionInWidget().y) +
-                            wheel_target_.delta;
-      }
-    }
-
-  } else {  // !root_view->IsMouseLocked() &&
-            // !root_view->wheel_scroll_latching_enabled()
+  } else {
     target = FindEventTarget(
         root_view,
         gfx::Point(event->PositionInWidget().x, event->PositionInWidget().y),
@@ -316,12 +296,6 @@
 
   event->SetPositionInWidget(transformed_point.x(), transformed_point.y());
   target->ProcessMouseWheelEvent(*event, latency);
-
-  DCHECK(root_view->wheel_scroll_latching_enabled() || !wheel_target_.target);
-  if (event->phase == blink::WebMouseWheelEvent::kPhaseEnded ||
-      event->momentum_phase == blink::WebMouseWheelEvent::kPhaseEnded) {
-    wheel_target_.target = nullptr;
-  }
 }
 
 void RenderWidgetHostInputEventRouter::RouteGestureEvent(

diff --git a/content/browser/renderer_host/render_widget_host_input_event_router.h b/content/browser/renderer_host/render_widget_host_input_event_router.h
index 08bb689..f12ba5ddc 100644
--- a/content/browser/renderer_host/render_widget_host_input_event_router.h
+++ b/content/browser/renderer_host/render_widget_host_input_event_router.h

@@ -164,9 +164,6 @@
   TargetData touchpad_gesture_target_;
   TargetData bubbling_gesture_scroll_target_;
   TargetData first_bubbling_scroll_target_;
-  // Used to target wheel events for the duration of a scroll when wheel scroll
-  // latching is enabled.
-  TargetData wheel_target_;
   // Maintains the same target between mouse down and mouse up.
   TargetData mouse_capture_target_;
 

diff --git a/content/browser/theme_helper_mac.h b/content/browser/theme_helper_mac.h
index be507d95..52da98f1 100644
--- a/content/browser/theme_helper_mac.h
+++ b/content/browser/theme_helper_mac.h

@@ -9,7 +9,7 @@
 #include "base/memory/singleton.h"
 #include "content/public/browser/notification_observer.h"
 #include "content/public/browser/notification_registrar.h"
-#include "third_party/WebKit/public/web/mac/WebScrollbarTheme.h"
+#include "third_party/WebKit/public/platform/mac/WebScrollbarTheme.h"
 
 namespace content {
 

diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index 40429d51..928e5369 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc

@@ -488,6 +488,7 @@
       upload_size_(0),
       upload_position_(0),
       is_resume_pending_(false),
+      interstitial_page_(nullptr),
       has_accessed_initial_document_(false),
       theme_color_(SK_ColorTRANSPARENT),
       last_sent_theme_color_(SK_ColorTRANSPARENT),
@@ -1286,8 +1287,7 @@
 
 bool WebContentsImpl::IsLoading() const {
   return frame_tree_.IsLoading() &&
-         !(ShowingInterstitialPage() &&
-           GetRenderManager()->interstitial_page()->pause_throbber());
+         !(ShowingInterstitialPage() && interstitial_page_->pause_throbber());
 }
 
 bool WebContentsImpl::IsLoadingToDifferentDocument() const {
@@ -1976,9 +1976,7 @@
   // interstitial's widget.
   if (focused_contents->ShowingInterstitialPage()) {
     return static_cast<RenderFrameHostImpl*>(
-               focused_contents->GetRenderManager()
-                   ->interstitial_page()
-                   ->GetMainFrame())
+               focused_contents->interstitial_page_->GetMainFrame())
         ->GetRenderWidgetHost();
   }
 
@@ -2011,9 +2009,7 @@
 
   if (focused_web_contents->ShowingInterstitialPage()) {
     return static_cast<RenderFrameHostImpl*>(
-               focused_web_contents->GetRenderManager()
-                   ->interstitial_page()
-                   ->GetMainFrame())
+               focused_web_contents->interstitial_page_->GetMainFrame())
         ->GetRenderWidgetHost();
   }
 
@@ -2857,8 +2853,8 @@
 
 void WebContentsImpl::AttachInterstitialPage(
     InterstitialPageImpl* interstitial_page) {
-  DCHECK(interstitial_page);
-  GetRenderManager()->set_interstitial_page(interstitial_page);
+  DCHECK(!interstitial_page_ && interstitial_page);
+  interstitial_page_ = interstitial_page;
 
   // Cancel any visible dialogs so that they don't interfere with the
   // interstitial.
@@ -2887,8 +2883,7 @@
 
 void WebContentsImpl::DidProceedOnInterstitial() {
   // The interstitial page should no longer be pausing the throbber.
-  DCHECK(!(ShowingInterstitialPage() &&
-           GetRenderManager()->interstitial_page()->pause_throbber()));
+  DCHECK(!(ShowingInterstitialPage() && interstitial_page_->pause_throbber()));
 
   // Restart the throbber now that the interstitial page no longer pauses it.
   if (ShowingInterstitialPage() && frame_tree_.IsLoading())
@@ -2910,10 +2905,9 @@
   }
 
   bool interstitial_pausing_throbber =
-      ShowingInterstitialPage() &&
-      GetRenderManager()->interstitial_page()->pause_throbber();
+      ShowingInterstitialPage() && interstitial_page_->pause_throbber();
   if (ShowingInterstitialPage())
-    GetRenderManager()->remove_interstitial_page();
+    interstitial_page_ = nullptr;
   for (auto& observer : observers_)
     observer.DidDetachInterstitialPage();
 
@@ -3121,7 +3115,7 @@
 
 void WebContentsImpl::FocusThroughTabTraversal(bool reverse) {
   if (ShowingInterstitialPage()) {
-    GetRenderManager()->interstitial_page()->FocusThroughTabTraversal(reverse);
+    interstitial_page_->FocusThroughTabTraversal(reverse);
     return;
   }
   RenderWidgetHostView* const fullscreen_view =
@@ -3134,11 +3128,11 @@
 }
 
 bool WebContentsImpl::ShowingInterstitialPage() const {
-  return GetRenderManager()->interstitial_page() != NULL;
+  return interstitial_page_ != nullptr;
 }
 
 InterstitialPage* WebContentsImpl::GetInterstitialPage() const {
-  return GetRenderManager()->interstitial_page();
+  return interstitial_page_;
 }
 
 bool WebContentsImpl::IsSavable() {
@@ -4277,8 +4271,7 @@
                                           LoadNotificationDetails* details) {
   // Do not send notifications about loading changes in the FrameTree while the
   // interstitial page is pausing the throbber.
-  if (ShowingInterstitialPage() &&
-      GetRenderManager()->interstitial_page()->pause_throbber() &&
+  if (ShowingInterstitialPage() && interstitial_page_->pause_throbber() &&
       !due_to_interstitial) {
     return;
   }
@@ -5018,8 +5011,7 @@
     GetRenderManager()->GetProxyToOuterDelegate()->SetFocusedFrame();
 
   if (ShowingInterstitialPage()) {
-    static_cast<RenderFrameHostImpl*>(
-        GetRenderManager()->interstitial_page()->GetMainFrame())
+    static_cast<RenderFrameHostImpl*>(interstitial_page_->GetMainFrame())
         ->GetRenderWidgetHost()
         ->SetPageFocus(true);
   } else {
@@ -5228,6 +5220,10 @@
   return controller_.GetLastCommittedEntry();
 }
 
+InterstitialPageImpl* WebContentsImpl::GetInterstitialForRenderManager() {
+  return interstitial_page_;
+}
+
 void WebContentsImpl::CreateRenderWidgetHostViewForRenderManager(
     RenderViewHost* render_view_host) {
   RenderWidgetHostViewBase* rwh_view =

diff --git a/content/browser/web_contents/web_contents_impl.h b/content/browser/web_contents/web_contents_impl.h
index e6fe43f9..d683bb9 100644
--- a/content/browser/web_contents/web_contents_impl.h
+++ b/content/browser/web_contents/web_contents_impl.h

@@ -757,6 +757,7 @@
       RenderViewHost* new_host) override;
   NavigationControllerImpl& GetControllerForRenderManager() override;
   NavigationEntry* GetLastCommittedNavigationEntryForRenderManager() override;
+  InterstitialPageImpl* GetInterstitialForRenderManager() override;
   bool FocusLocationBarByDefault() override;
   void SetFocusToLocationBar(bool select_all) override;
   bool IsHidden() override;
@@ -1363,6 +1364,12 @@
   // See ResumeLoadingCreatedWebContents.
   bool is_resume_pending_;
 
+  // The interstitial page currently shown, if any. Not owned by this class: the
+  // InterstitialPage is self-owned and deletes itself asynchronously when
+  // hidden. Because it may outlive this WebContents, it enters a disabled state
+  // when hidden or preparing for destruction.
+  InterstitialPageImpl* interstitial_page_;
+
   // Data for current page -----------------------------------------------------
 
   // When a title cannot be taken from any entry, this title will be used.

diff --git a/content/common/DEPS b/content/common/DEPS
index 2ecbdeb..74e46d7 100644
--- a/content/common/DEPS
+++ b/content/common/DEPS

@@ -36,6 +36,7 @@
   "+third_party/WebKit/public/platform/WebStorageArea.h",
   "+third_party/WebKit/public/platform/WebTouchEvent.h",
   "+third_party/WebKit/public/platform/linux/WebFallbackFont.h",
+  "+third_party/WebKit/public/platform/mac/WebScrollbarTheme.h",
   "+third_party/WebKit/public/platform/modules/bluetooth/web_bluetooth.mojom.h",
   "+third_party/WebKit/public/platform/modules/device_orientation/WebDeviceMotionData.h",
   "+third_party/WebKit/public/platform/modules/device_orientation/WebDeviceOrientationData.h",
@@ -75,6 +76,5 @@
   "+third_party/WebKit/public/web/WebSharedWorkerCreationErrors.h",
   "+third_party/WebKit/public/web/WebTextDirection.h",
   "+third_party/WebKit/public/web/WebTreeScopeType.h",
-  "+third_party/WebKit/public/web/mac/WebScrollbarTheme.h",
   "+third_party/WebKit/public/web/win/WebFontRendering.h"
 ]

diff --git a/content/common/native_types_mac.typemap b/content/common/native_types_mac.typemap
index d614f04..6a9fef2 100644
--- a/content/common/native_types_mac.typemap
+++ b/content/common/native_types_mac.typemap

@@ -5,7 +5,7 @@
 mojom = "//content/common/native_types.mojom"
 public_headers = [
   "//third_party/WebKit/public/platform/WebScrollbarButtonsPlacement.h",
-  "//third_party/WebKit/public/web/mac/WebScrollbarTheme.h",
+  "//third_party/WebKit/public/platform/mac/WebScrollbarTheme.h",
 ]
 traits_headers = [ "//content/common/view_messages.h" ]
 deps = [

diff --git a/content/common/view_messages.h b/content/common/view_messages.h
index b07a8370..119838d 100644
--- a/content/common/view_messages.h
+++ b/content/common/view_messages.h

@@ -68,7 +68,7 @@
 
 #if defined(OS_MACOSX)
 #include "third_party/WebKit/public/platform/WebScrollbarButtonsPlacement.h"
-#include "third_party/WebKit/public/web/mac/WebScrollbarTheme.h"
+#include "third_party/WebKit/public/platform/mac/WebScrollbarTheme.h"
 #endif
 
 #undef IPC_MESSAGE_EXPORT

diff --git a/content/public/android/java/src/org/chromium/content/browser/accessibility/LollipopWebContentsAccessibility.java b/content/public/android/java/src/org/chromium/content/browser/accessibility/LollipopWebContentsAccessibility.java
index dd71f4c5..75cb232 100644
--- a/content/public/android/java/src/org/chromium/content/browser/accessibility/LollipopWebContentsAccessibility.java
+++ b/content/public/android/java/src/org/chromium/content/browser/accessibility/LollipopWebContentsAccessibility.java

@@ -9,6 +9,7 @@
 import android.content.Context;
 import android.content.Intent;
 import android.content.IntentFilter;
+import android.content.ReceiverCallNotAllowedException;
 import android.os.Build;
 import android.text.SpannableString;
 import android.text.style.LocaleSpan;
@@ -40,13 +41,19 @@
         super(context, containerView, webContents, renderCoordinates, shouldFocusOnPageLoad);
 
         // Cache the system language and set up a listener for when it changes.
-        IntentFilter filter = new IntentFilter(Intent.ACTION_LOCALE_CHANGED);
-        context.registerReceiver(new BroadcastReceiver() {
-            @Override
-            public void onReceive(Context context, Intent intent) {
-                mSystemLanguageTag = Locale.getDefault().toLanguageTag();
-            }
-        }, filter);
+        // TODO(dmazzoni): the try/catch is because this fails in AndroidWebView
+        // sometimes. Is there a different context we can use or is this just not
+        // always possible depending on the app permissions?  http://crbug.com/732933
+        try {
+            IntentFilter filter = new IntentFilter(Intent.ACTION_LOCALE_CHANGED);
+            context.registerReceiver(new BroadcastReceiver() {
+                @Override
+                public void onReceive(Context context, Intent intent) {
+                    mSystemLanguageTag = Locale.getDefault().toLanguageTag();
+                }
+            }, filter);
+        } catch (ReceiverCallNotAllowedException e) {
+        }
         mSystemLanguageTag = Locale.getDefault().toLanguageTag();
     }
 

diff --git a/content/renderer/gpu/render_widget_compositor.cc b/content/renderer/gpu/render_widget_compositor.cc
index 9b8547c..e6fd186 100644
--- a/content/renderer/gpu/render_widget_compositor.cc
+++ b/content/renderer/gpu/render_widget_compositor.cc

@@ -67,6 +67,7 @@
 #include "third_party/WebKit/public/web/WebKit.h"
 #include "third_party/WebKit/public/web/WebSelection.h"
 #include "third_party/skia/include/core/SkImage.h"
+#include "ui/gfx/color_space_switches.h"
 #include "ui/gfx/switches.h"
 #include "ui/gl/gl_switches.h"
 #include "ui/native_theme/native_theme_features.h"

diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index aff4d74..5049df8 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc

@@ -1801,6 +1801,12 @@
   proxy = RenderFrameProxy::CreateProxyToReplaceFrame(
       this, proxy_routing_id, replicated_frame_state.scope);
 
+  // Synchronously run the unload handler before sending the ACK.
+  // TODO(creis): Call dispatchUnloadEvent unconditionally here to support
+  // unload on subframes as well.
+  if (is_main_frame_)
+    frame_->DispatchUnloadEvent();
+
   // Swap out and stop sending any IPC messages that are not ACKs.
   if (is_main_frame_)
     render_view_->SetSwappedOut(true);

diff --git a/content/renderer/render_thread_impl.h b/content/renderer/render_thread_impl.h
index 08b6939..23f3aee7 100644
--- a/content/renderer/render_thread_impl.h
+++ b/content/renderer/render_thread_impl.h

@@ -60,7 +60,7 @@
 #include "ui/gfx/native_widget_types.h"
 
 #if defined(OS_MACOSX)
-#include "third_party/WebKit/public/web/mac/WebScrollbarTheme.h"
+#include "third_party/WebKit/public/platform/mac/WebScrollbarTheme.h"
 #endif
 
 class SkBitmap;

diff --git a/content/renderer/render_view_browsertest.cc b/content/renderer/render_view_browsertest.cc
index e5ca796..6c6c3133 100644
--- a/content/renderer/render_view_browsertest.cc
+++ b/content/renderer/render_view_browsertest.cc

@@ -2206,6 +2206,25 @@
   EXPECT_EQ(gfx::Size(800, 800), size);
 }
 
+TEST_F(RenderViewImplScaleFactorTest, PreferredSizeWithScaleFactor) {
+  DoSetUp();
+  LoadHTML("<body style='margin:0;'><div style='display:inline-block; "
+           "width:400px; height:400px;'/></body>");
+  view()->webview()->MainFrame()->ToWebLocalFrame()->SetCanHaveScrollbars(
+      false);
+  EnablePreferredSizeMode();
+
+  gfx::Size size = GetPreferredSize();
+  EXPECT_EQ(gfx::Size(400, 400), size);
+
+  // The size is in DIP. Changing the scale factor should not change
+  // the preferred size. (Caveat: a page may apply different layout for
+  // high DPI, in which case, the size may differ.)
+  SetDeviceScaleFactor(2.f);
+  size = GetPreferredSize();
+  EXPECT_EQ(gfx::Size(400, 400), size);
+}
+
 // Ensure the RenderViewImpl history list is properly updated when starting a
 // new browser-initiated navigation.
 TEST_F(RenderViewImplTest, HistoryIsProperlyUpdatedOnNavigation) {

diff --git a/content/renderer/render_view_impl.cc b/content/renderer/render_view_impl.cc
index 9aa953a..50d6749 100644
--- a/content/renderer/render_view_impl.cc
+++ b/content/renderer/render_view_impl.cc

@@ -1880,8 +1880,10 @@
   // message.
   if (!send_preferred_size_changes_ || !webview())
     return;
-
-  gfx::Size size = webview()->ContentsPreferredMinimumSize();
+  blink::WebSize tmp_size = webview()->ContentsPreferredMinimumSize();
+  blink::WebRect tmp_rect(0, 0, tmp_size.width, tmp_size.height);
+  ConvertViewportToWindow(&tmp_rect);
+  gfx::Size size(tmp_rect.width, tmp_rect.height);
   if (size == preferred_size_)
     return;
 

diff --git a/content/shell/app/shell_main_delegate.cc b/content/shell/app/shell_main_delegate.cc
index 546b0126a..f496af7 100644
--- a/content/shell/app/shell_main_delegate.cc
+++ b/content/shell/app/shell_main_delegate.cc

@@ -44,7 +44,7 @@
 #include "ui/base/ui_base_paths.h"
 #include "ui/base/ui_base_switches.h"
 #include "ui/display/display_switches.h"
-#include "ui/gfx/switches.h"
+#include "ui/gfx/color_space_switches.h"
 #include "ui/gl/gl_implementation.h"
 #include "ui/gl/gl_switches.h"
 

diff --git a/content/test/BUILD.gn b/content/test/BUILD.gn
index 45bb5a8..45103a4 100644
--- a/content/test/BUILD.gn
+++ b/content/test/BUILD.gn

@@ -692,7 +692,6 @@
     "../browser/renderer_host/input/touch_action_browsertest.cc",
     "../browser/renderer_host/input/touch_input_browsertest.cc",
     "../browser/renderer_host/input/touch_selection_controller_client_aura_browsertest.cc",
-    "../browser/renderer_host/input/wheel_scroll_latching_browsertest.cc",
     "../browser/renderer_host/media/video_capture_browsertest.cc",
     "../browser/renderer_host/render_process_host_browsertest.cc",
     "../browser/renderer_host/render_view_host_browsertest.cc",

diff --git a/content/test/layouttest_support.cc b/content/test/layouttest_support.cc
index bcb6d396..43bf078 100644
--- a/content/test/layouttest_support.cc
+++ b/content/test/layouttest_support.cc

@@ -53,9 +53,9 @@
 #include "third_party/WebKit/public/web/WebHistoryItem.h"
 #include "third_party/WebKit/public/web/WebView.h"
 #include "ui/events/blink/blink_event_util.h"
+#include "ui/gfx/color_space_switches.h"
 #include "ui/gfx/geometry/vector2d.h"
 #include "ui/gfx/icc_profile.h"
-#include "ui/gfx/switches.h"
 #include "ui/gfx/test/icc_profiles.h"
 
 #if defined(OS_MACOSX)

diff --git a/docs/speed/README.md b/docs/speed/README.md
new file mode 100644
index 0000000..7c7ac07c
--- /dev/null
+++ b/docs/speed/README.md

@@ -0,0 +1,33 @@
+# Chrome Speed
+
+## Contact information
+
+  * **Contact**: **speed@chromium.org**
+  * **Escalation**: rschoen@chromium.org (PM), benhenry@chromium.org (TPM),
+    parisa@chromium.org (eng director)
+  * **[File a bug](https://bugs.chromium.org/p/chromium/issues/entry?template=Speed%20Bug)**
+  * **Regression postmortem**: [template](https://docs.google.com/document/d/1fvfhFNOoUL9rB0XAEe1MYefyM_9yriR1IPjdxdm7PaQ/edit?disco=AAAABKdHwCg)
+
+## User Docs
+
+  * [How does Chrome measure performance?](how_does_chrome_measure_performance.md)
+  * [My CL caused a performance regression! What do I do?](addressing_performance_regressions.md)
+  * [I want Chrome to have better performance](help_improve_performance.md)
+  * [Perf sheriffing documentation](perf_regression_sheriffing.md)
+  * [I want to add tests or platforms to the perf waterfall](adding_tests_bots.md)
+  * [I'm looking for more information on the Speed Progam](speed_program.md)
+
+## Core Teams and Work
+
+  * **[Performance tracks](performance_tracks.md)**: Most of the performance
+    work on Chrome is organized into these tracks.
+  * **[Chrome Speed Operations](chrome_speed_operations.md)**: provides the
+    benchmarks, infrastructure, and releasing oversight to track regressions.
+    <!--- TODO: General discussion: chrome-speed-operations mailing list link -->
+    <!--- TODO: Tracking releases and regressions: chrome-speed-releasing mailing list link -->
+    * Benchmark-specific discussion: benchmarking-dev@chromium.org
+    <!--- TODO: Requests for new benchmarks: chrome-benchmarking-request mailing list link -->
+    * Performance dashboard, bisect, try jobs: speed-services-dev@chromium.org
+  * **[Chrome Speed Metrics](https://docs.google.com/document/d/1wBT5fauGf8bqW2Wcg2A5Z-3_ZvgPhE8fbp1Xe6xfGRs/edit#heading=h.8ieoiiwdknwt)**: provides a set of high-quality metrics that represent real-world user experience, and exposes these metrics to both Chrome and Web Developers.
+    * General discussion: progressive-web-metrics@chromium.org
+    * The actual metrics: [tracking](https://docs.google.com/spreadsheets/d/1gY5hkKPp8RNVqmOw1d-bo-f9EXLqtq4wa3Z7Q8Ek9Tk/edit#gid=0)
\ No newline at end of file

diff --git a/docs/speed/addressing_performance_regressions.md b/docs/speed/addressing_performance_regressions.md
new file mode 100644
index 0000000..dd75ce1
--- /dev/null
+++ b/docs/speed/addressing_performance_regressions.md

@@ -0,0 +1,214 @@
+# Addressing Performance Regressions
+
+The bisect bot just picked your CL as the culprit in a performance regression
+and assigned a bug to you! What should you do? Read on...
+
+## About our performance tests
+
+The [chromium.perf waterfall](perf_waterfall.md) is a continuous build which
+runs performance tests on dozens of devices across Windows, Mac, Linux, and
+Android Chrome and WebView. Often, a performance regression only affects a
+certain type of hardware or a certain operating system, which may be different
+than what you tested locally before landing your CL.
+
+Each test has an owner, named in
+[this spreasheet](https://docs.google.com/spreadsheets/d/1xaAo0_SU3iDfGdqDJZX_jRV0QtkufwHUKH3kQKF3YQs/edit#gid=0),
+who you can cc on a performance bug if you have questions.
+
+## Understanding the bisect results
+
+The bisect bot spits out a comment on the bug that looks like this:
+
+```
+=== BISECT JOB RESULTS ===
+Perf regression found with culprit
+
+Suspected Commit
+Author : Your Name
+Commit : 15092e9195954cbc331cd58e344d0895fe03d0cd
+Date : Wed Jun 14 03:09:47 2017
+Subject: Your CL Description.
+
+Bisect Details
+Configuration: mac_pro_perf_bisect
+Benchmark : system_health.common_desktop
+Metric : timeToFirstContentfulPaint_avg/load_search/load_search_taobao
+Change : 15.25% | 1010.02 -> 1164.04
+
+Revision Result N
+chromium@479147 1010.02 +- 1535.41 14 good
+chromium@479209 699.332 +- 1282.01 6 good
+chromium@479240 383.617 +- 917.038 6 good
+chromium@479255 649.186 +- 1896.26 14 good
+chromium@479262 788.828 +- 1897.91 14 good
+chromium@479268 880.727 +- 2235.29 21 good
+chromium@479269 886.511 +- 1150.91 6 good
+chromium@479270 1164.04 +- 979.746 14 bad <--
+
+To Run This Test
+src/tools/perf/run_benchmark -v --browser=release --output-format=chartjson --upload-results --pageset-repeat=1 --also-run-disabled-tests --story-filter=load.search.taobao system_health.common_desktop
+```
+
+There's a lot of information packed in that bug comment! Here's a breakdown:
+
+  * **What regressed exactly?** The comment gives you several details:
+    * **The benchmark that regressed**: Under `Bisect Details`, you can see
+      `Benchmark :`. In this case, the `system_health.common_desktop`
+      benchmark regressed.
+    * **What platform did it regress on?** Under `Configuration`, you can find
+      some details on the bot that regressed. In this example, it is a Mac Pro
+      laptop.
+    * **How do I run that locally?** Follow the instructions under
+      `To Run This Test`. But be aware that if it regressed on Android and
+      you're developing on Windows, you may not be able to reproduce locally.
+      (See Debugging regressions below)
+    * **What is this testing?** Generally the metric
+      (`timeToFirstContentfulPaint_avg`) gives some information. If you're not
+      familiar, you can cc the [benchmark owner](https://docs.google.com/spreadsheets/d/1xaAo0_SU3iDfGdqDJZX_jRV0QtkufwHUKH3kQKF3YQs/edit#gid=0)
+      to ask for help.
+    * **How severe is this regression?** There are different axes on which to
+      answer that question:
+      * **How much did performance regress?** The bisect bot answers this both
+        in relative terms (`Change : 15.25%`) and absolute terms
+        (`1010.02 -> 1164.04`). To understand the absolute terms, you'll need
+        to look at the units on the performance graphs linked in comment #1
+        of the bug (`https://chromeperf.appspot.com/group_report?bug_id=XXX`).
+        In this example, the units are milliseconds; the time to load taobao
+        regressed from ~1.02 second to 1.16 seconds.
+      * **How widespread is the regression?** The graphs linked in comment #1
+        of the bug (`https://chromeperf.appspot.com/group_report?bug_id=XXX`)
+        will give you an idea how widespread the regression is. The `Bot`
+        column shows all the different bots the regression occurred on, and the
+        `Test` column shows the metrics it regressed on. Often, the same metric
+        is gathered on many different web pages. If you see a long list of
+        pages, it's likely that the regression affects most pages; if it's
+        short maybe your regression is an edge case.
+
+## Debugging regressions
+
+  * **How do I run the test locally???** Follow the instructions under
+    `To Run This Test` in the bisect comment. But be aware that regressions
+    are often hardware and/or platform-specific.
+  * **What do I do if I don't have the right hardware to test locally?** If
+    you don't have a local machine that matches the specs of the hardware that
+    regressed, you can run a perf tryjob on the same lab machines that ran the
+    bisect that blamed your CL.
+    [Here are the instructions for perf tryjobs](perf_trybots.md).
+    Drop the `perf_bisect` from the bot name and substitute dashes for
+    underscores to get the trybot name (`mac_pro_perf_bisect` -> `mac_pro`
+    in the example above).
+  * **Can I get a trace?** For most metrics, yes. Here are the steps:
+    1. Click on the `All graphs for this bug` link in comment #1. It should
+       look like this:
+       `https://chromeperf.appspot.com/group_report?bug_id=XXXX`
+    2. Select a bot/test combo that looks like what the bisect bot originally
+       caught. You might want to look through various regressions for a really
+       large increase.
+    3. On the graph, click on the exclamation point icon at the regression, and
+       a tooltip comes up. There is a "trace" link in the tooltip, click it to
+       open a the trace that was recorded during the performance test.
+  * **Wait, what's a trace?** See the
+    [documentation on tracing](https://www.chromium.org/developers/how-tos/trace-event-profiling-tool)
+    to learn how to use traces to debug performance issues.
+  * **Are there debugging tips specific to certain benchmarks?**
+    * **[Memory](https://chromium.googlesource.com/chromium/src/+/master/docs/memory-infra/memory_benchmarks.md)**
+    * **[Android binary size](apk_size_regressions.md)**
+
+## If you don't believe your CL could be the cause
+
+There are some clear reasons to believe the bisect bot made a mistake:
+
+  * Your CL changes a test or some code that isn't compiled on the platform
+    that regressed.
+  * Your CL is completely unrelated to the metric that regressed.
+  * You looked at the numbers the bisect spit out (see example above; the first
+    column is the revision, the second column is the value at that revision,
+    and the third column is the standard deviation), and:
+    * The change attributed to your CL seems well within the noise, or
+    * The change at your CL is an improvement (for example, the metric is bytes
+      of memory used, and the value goes **down** at your CL) or
+    * The change is far smaller that what's reported in the bug summary (for
+      example, the bug says there is a 15% memory regression but the bisect
+      found that your CL increases memory by 0.77%)
+
+Do the following:
+
+  * Add a comment to the bug explaining why you believe your CL is not the
+    cause of the regression.
+  * **Unassign yourself from the bug**. This lets our triage process know that
+    you are not actively working on the bug.
+  * Kick off another bisect. You can do this by:
+    1. Click on the `All graphs for this bug` link in comment #1. It should
+       look like this:
+       `https://chromeperf.appspot.com/group_report?bug_id=XXXX`
+    2. Sign in to the dashboard with your chromium.org account in the upper
+       right corner.
+    3. Select a bot/test combo that looks like what the bisect bot originally
+       caught. You might want to look through various regressions for a really
+       clear increase.
+    4. On the graph, click on the exclamation point icon at the regression, and
+       a tooltip comes up. Click the `Bisect` button on the tooltip.
+
+
+## If you believe the regression is justified
+
+Sometimes you are aware that your CL caused a performance regression, but you
+believe the CL should be landed as-is anyway. Chrome's
+[core principles](https://www.chromium.org/developers/core-principles) state:
+
+> If you make a change that regresses measured performance, you will be required to fix it or revert.
+
+**It is your responsibility to justify the regression.** You must add a comment
+on the bug explaining your justification clearly before WontFix-ing.
+
+Here are some common justification scenarios:
+
+  * **Your change regresses this metric, but is a net positive for performance.**
+    There are a few ways to demonstrate that this is true:
+    * **Use benchmark results.** If your change has a positive impact, there
+      should be clear improvements detected in benchmarks. You can look at all
+      the changes (positive and negative) the perf dashboard detected by
+      entering the commit position of a change into this url:
+      `https://chromeperf.appspot.com/group_report?rev=YOUR_COMMIT_POS_HERE`
+      All of these changes are generally changes found on a CL range, and may
+      not be attributable to your CL. You can bisect any of these to find if
+      your CL caused the improvement, just like you can bisect to find if it
+      caused the regression.
+    * **Use finch trial results.** There are some types of changes that cannot
+      be measured well in benchmarks. If you believe your case falls into this
+      category, you can show that end users are not affected via a finch trial.
+      See the "End-user metrics" section of
+      [How does Chrome measure performance](how_does_chrome_measure_performance.md)
+  * **Your change is a critical correctness or security fix.**
+    It's true that sometimes something was "fast" because it was implemented
+    incorrectly. In this case, a justification should clarify the performance
+    cost we are paying for the fix and why it is worth it. Some things to
+    include:
+    * **What did the benchmark regression cost?** Look at the
+      list of regressions in bug comment 1:
+      `https://chromeperf.appspot.com/group_report?bug_id=XXXX`
+      What is the absolute cost (5MiB RAM? 200ms on page load?)
+      How many pages regressed? How many platforms?
+    * **What do we gain?** It could be something like:
+      * Reduced code complexity
+      * Optimal code or UI correctness
+      * Additional security
+      * Knowledge via an experiment
+      * Marketing - something good for users
+    * **Is there a more performant way to solve the problem?**
+      The [benchmark owner](https://docs.google.com/spreadsheets/d/1xaAo0_SU3iDfGdqDJZX_jRV0QtkufwHUKH3kQKF3YQs/edit#gid=0)
+      can generally give you an idea how much work it would take to make a
+      similarly-sized performance gain. For example, it might take 1.5
+      engineering years to save 3MiB of RAM on Android; could you solve the
+      problem in a way that takes less memory than that in less than 1.5 years?
+  * **This performance metric is incorrect.** Not all tests are perfect. It's
+    possible that your change did not regress performance, and only appears to
+    be a problem because the test is measuring incorrectly. If this is the
+    case, you must explain clearly what the issue with the test is, and why you
+    believe your change is performance neutral. Please include data from traces
+    or other performance tools to clarify your claim.
+
+**In all cases,** make sure to cc the [benchmark owner](https://docs.google.com/spreadsheets/d/1xaAo0_SU3iDfGdqDJZX_jRV0QtkufwHUKH3kQKF3YQs/edit#gid=0)
+when writing a justification and WontFix-ing a bug. If you cannot come to an
+agreement with the benchmark owner, you can escalate to benhenry@chromium.org,
+the owner of speed releasing.
\ No newline at end of file

diff --git a/docs/speed/chrome_speed_operations.md b/docs/speed/chrome_speed_operations.md
new file mode 100644
index 0000000..f9f62d8a
--- /dev/null
+++ b/docs/speed/chrome_speed_operations.md

@@ -0,0 +1,52 @@
+# Chrome Speed Operations
+
+Chrome Speed Operations exists to prevent Chrome from regressing on
+responsiveness, smoothness, memory, power or other key performance metrics.
+We seek to integrate a world-class benchmarking framework and performance
+monitoring tools into Chrome's release process.
+
+TL: sullivan@chromium.org<br>
+TPM: benhenry@chromium.org
+ 
+Speed Operations consists of 3 teams, working in tandem:
+
+## Benchmarks
+The benchmarks team provides:
+  * A set of [releasing-oriented benchmarks](https://docs.google.com/document/d/1BM_6lBrPzpMNMtcyi2NFKGIzmzIQ1oH3OlNG27kDGNU/edit)
+    that measure key user-visible performance metrics in important scenarios.
+    We work closely with Chrome Speed Metrics team on the metrics and with
+    Releasing team on the scenarios.
+  * A set of [opinionated benchmarking frameworks](https://docs.google.com/document/d/1ni2MIeVnlH4bTj4yvEDMVNxgL73PqK_O9_NUm3NW3BA/edit)
+    that make it easy for Chromium developers to add lower-level benchmarks for
+    the areas of Chrome performance important to them.
+  * Automation to run these benchmarks on our continuous build on several dozen
+    real device types, on Windows, Mac, Linux, and Android, with hardware power
+    monitoring.
+
+TL: nednguyen@chromium.org<br>
+Contact: benchmarking-dev@chromium.org
+
+## Services
+The [services](chrome_speed_services.md) team provides:
+  * The [Chrome performance dashboard](https://chromeperf.appspot.com), which
+    stores performance timeseries and related debugging data. The dashboard
+    automatically detects regressions in these timeseries and has integration
+    with Chromium's bug tracker for easy tracking.
+  * Tools for [bisecting regressions](bisects.md) on our continuous build down
+    to an exact culprit CL.
+  * A [performance try job service](perf_trybots.md) which allows chromium
+    developers to run benchmarks on unsubmitted CLs using the same hardware
+    we use in the continuous build.
+
+TL: simonhatch@chromium.org<br>
+Contact: speed-services-dev@chromium.org
+
+## Releasing
+The releasing team provides:
+  * Tracking of all performance regressions seen in user-visible performance
+    both in the wild and in the lab.
+  * A per-milestone report on Chrome's performance.
+  * Recommendations about lab hardware and new test scenarios.
+  * Management of performance sheriff rotations.
+
+TPM: benhenry@chromium.org
\ No newline at end of file

diff --git a/docs/speed/chrome_speed_services.md b/docs/speed/chrome_speed_services.md
new file mode 100644
index 0000000..cf5f0e7
--- /dev/null
+++ b/docs/speed/chrome_speed_services.md

@@ -0,0 +1,52 @@
+# Speed Operations: Services
+
+TL: simonhatch@<br>
+Team: simonhatch@ benjhayden@, dtu@, eakuefner@<br>
+TPM: benhenry@<br>
+Mailing List: speed-services-dev@chromium.org<br>
+**[go/chrome-speed-services](https://goto.google.com/chrome-speed-services)**
+
+## Mission
+The mission of the Chrome Speed Services team is to develop the tools and
+infrastructure necessary for teams to detect, help diagnose, and follow through
+on performance regressions in Chrome. We accomplish this through a set of
+interconnected tools, which process data from the Chrome Benchmarking Team and
+automate the Chrome Speed Releasing workflow:
+ 
+  * The [Chrome Performance Dashboard](https://chromeperf.appspot.com) stores
+    over 4 million performance timeseries, and monitors hundreds of thousands
+    of them for performance regressions. It integrates with Chrome's bug
+    tracker for follow-through.
+  * Most of our automated builds take too long to get performance data on every
+    revision, so we have [bisect bots](bisects.md) to narrow down regressions.
+    These bots also support running performance try jobs on unsubmitted CLs.
+  * Whether a performance test is run locally or in the lab, right now or last
+    year, we want to make it easy to understand and share the results. We
+    develop [data formats](https://github.com/catapult-project/catapult/blob/master/docs/histogram-set-json-format.md)
+    and user interfaces that make it easy to dig deeply into performance
+    regressions.
+ 
+Here is a diagram of how our tooling fits into the chromium performance
+continuous build:
+![Speed Continuous Build](images/speed_services.png)
+
+
+## 2017 Roadmap
+  * **Improve our ability to bisect to root causes**.
+    [Pinpoint](https://docs.google.com/document/d/1FKPRNU2kbPJ15p6XHO0itCjYtfvCpGt2IHblriTX1tg/edit)
+    is a rewrite of the existing bisect system, design to address the
+    shortcomings of a fully automated system running on buildbot. Tighter
+    integration with the dashboard will allow better code sharing, more
+    thorough test coverage, and a greatly improved and interactive user
+    interface.
+  * **Enable deep debugging and better numerics across our products.**
+    We are working to make the dashboard, pinpoint, and telemetry all use our new
+    [HistogramSet](https://github.com/catapult-project/catapult/blob/master/docs/histogram-set-json-format.md)
+    data format, which stores full histograms and statistics about test
+    results, as well as diagnostics with built-in UIs which help users dig in
+    when something's wrong.
+  * **Improve the sheriffing process.** We're working on burning down bugs in
+    the sheriffing workflow, and also adding
+    [milestone-level reports](https://docs.google.com/document/d/1MgTs2TBEHcKqgil_zqy72GlZr_74udyDKznTZixhrrI/edit)
+    that give a high-level overview of how Chrome is performing from release to
+    release, so that we can better focus our performance efforts.

diff --git a/docs/speed/how_does_chrome_measure_performance.md b/docs/speed/how_does_chrome_measure_performance.md
new file mode 100644
index 0000000..6b61984
--- /dev/null
+++ b/docs/speed/how_does_chrome_measure_performance.md

@@ -0,0 +1,63 @@
+# How Chrome Measures Performance
+
+Chrome collects performance data both in the lab, and from end users. There are
+thousands of individual metrics. This is an overview of how to sort through
+them at a high level.
+
+## Tracks and Metrics
+
+At a high level, performance work in Chrome is categorized into **tracks**,
+like loading, memory, and power. Each track has high-level metrics associated
+with it.
+
+  * **[An overview of tracks](performance_tracks.md)**: lists the tracks and key contact points.
+  * **[Speed Launch Metrics](https://docs.google.com/document/d/1Ww487ZskJ-xBmJGwPO-XPz_QcJvw-kSNffm0nPhVpj8/edit):
+    the important high-level metrics we measure for each track.
+
+## Laboratory Metrics
+
+Chrome has multiple performance labs in which benchmarks are run on continuous
+builds to pinpoint performance regressions down to individual changelists.
+
+### The chromium.perf lab
+
+The main lab for performance monitoring is chromium.perf. It continuously tests
+chromium commits and is monitored by the perf sheriff rotation.
+
+  * **[What is the perf waterfall?](perf_waterfall.md)** An overview of the
+    waterfall that runs the continuous build.
+  * **[How telemetry works](https://github.com/catapult-project/catapult/blob/master/telemetry/README.md):
+    An overview of telemetry, our performance testing harness.
+  * **[How perf bisects work](bisects.md): An overview of the bisect bots,
+    which narrow down regressions over a CL range to a specific commit.
+  * **Benchmarks*
+    * **[Benchmark Policy](https://docs.google.com/document/d/1ni2MIeVnlH4bTj4yvEDMVNxgL73PqK_O9_NUm3NW3BA/edit)**:
+      An overview of the benchmark harnesses available in Chrome, and how to
+      find the right place to add a new test case.
+    * **[System health benchmarks](https://docs.google.com/document/d/1BM_6lBrPzpMNMtcyi2NFKGIzmzIQ1oH3OlNG27kDGNU/edit?ts=57e92782)**:
+      The system health benchmarks measure the speed launch metrics on
+      real-world web use scenarios.
+  * **[How to run on perf trybots](perf_trybots.md)**: Have an unsubmitted
+    CL and want to run benchmarks on it? Need to try a variety of hardware and
+    operating systems? Use the perf trybots.
+  * **[How to run telemetry locally](https://github.com/catapult-project/catapult/blob/master/telemetry/docs/run_benchmarks_locally.md)**:
+    Instructions on running telemetry benchmarks on your local machine.
+  * **[List of platforms in the lab](perf_lab_platforms.md)**: Devices,
+    configurations, and OSes the chromium.perf lab tests on.
+
+### Other performance labs
+
+There are several other performance labs for specialized use:
+
+  * **[Lab Spotlight: AV Lab (Googlers only)](http://goto.google.com/av-analysis-service)**:
+    Learn all about audio/video quality testing.
+  * **[Lab Spotlight: Cluster telemetry](https://docs.google.com/document/d/1GhqosQcwsy6F-eBAmFn_ITDF7_Iv_rY9FhCKwAnk9qQ/edit)**:
+    Need to run a performance test over thousands of pages? Check out cluster
+    telemetry!
+
+## End-user metrics
+
+The **[Speed Launch Metrics](https://docs.google.com/document/d/1Ww487ZskJ-xBmJGwPO-XPz_QcJvw-kSNffm0nPhVpj8/edit)**
+doc explains metrics available in UMA for end user performance. If you want to
+test how your change impacts these metrics for end users, you'll probably want
+to **[Run a Finch Trial](http://goto.google.com/finch101)**.
\ No newline at end of file

diff --git a/docs/speed/images/speed_services.png b/docs/speed/images/speed_services.png
new file mode 100644
index 0000000..2a2ff1e
--- /dev/null
+++ b/docs/speed/images/speed_services.png
Binary files differ

diff --git a/docs/webui_explainer.md b/docs/webui_explainer.md
new file mode 100644
index 0000000..bd298d96
--- /dev/null
+++ b/docs/webui_explainer.md

@@ -0,0 +1,676 @@
+<style>
+.note::before {
+  content: 'Note: ';
+  font-variant: small-caps;
+  font-style: italic;
+}
+
+.doc h1 {
+  margin: 0;
+}
+</style>
+
+# WebUI Explainer
+
+[TOC]
+
+<a name="What_is_webui"></a>
+## What is "WebUI"?
+
+"WebUI" is a term used to loosely describe **parts of Chrome's UI
+implemented with web technologies** (i.e. HTML, CSS, JavaScript).
+
+Examples of WebUI in Chromium:
+
+* Settings (chrome://settings)
+* History (chrome://history)
+* Downloads (chrome://downloads)
+
+<div class="note">
+Not all web-based UIs in Chrome have chrome:// URLs.
+</div>
+
+This document explains how WebUI works.
+
+<a name="bindings"></a>
+## What's different from a web page?
+
+WebUIs are granted super powers so that they can manage Chrome itself. For
+example, it'd be very hard to implement the Settings UI without access to many
+different privacy and security sensitive services. Access to these services are
+not granted by default.
+
+Only special URLs are granted WebUI "bindings" via the child security process.
+
+Specifically, these bindings:
+
+* give a renderer access to load [`chrome:`](#chrome_urls) URLS
+  * this is helpful for shared libraries, i.e. `chrome://resources/`
+* allow the browser to execute arbitrary JavaScript in that renderer via
+  [`CallJavascriptFunction()`](#CallJavascriptFunction)
+* allow communicating from the renderer to the browser with
+  [`chrome.send()`](#chrome_send) and friends
+* ignore content settings regarding showing images or executing JavaScript
+
+<a name="chrome_urls"></a>
+## How `chrome:` URLs work
+
+<div class="note">
+A URL is of the format &lt;protocol&gt;://&lt;host&gt;/&lt;path&gt;.
+</div>
+
+A `chrome:` URL loads a file from disk, memory, or can respond dynamically.
+
+Because Chrome UIs generally need access to the browser (not just the current
+tab), much of the C++ that handles requests or takes actions lives in the
+browser process. The browser has many more privileges than a renderer (which is
+sandboxed and doesn't have file access), so access is only granted for certain
+URLs.
+
+### `chrome:` protocol
+
+Chrome recognizes a list of special protocols, which it registers while starting
+up.
+
+Examples:
+
+* chrome-devtools:
+* chrome-extensions:
+* chrome: 
+* file:
+* view-source:
+
+This document mainly cares about the **chrome:** protocol, but others can also
+be granted [WebUI bindings](#bindings) or have special
+properties.
+
+### `chrome:` hosts
+
+After registering the `chrome:` protocol, a set of factories are created. These
+factories contain a list of valid host names. A valid hostname generates a
+controller.
+
+In the case of `chrome:` URLs, these factories are registered early in the
+browser process lifecycle.
+
+```c++
+// ChromeBrowserMainParts::PreMainMessageLoopRunImpl():
+content::WebUIControllerFactory::RegisterFactory(
+   ChromeWebUIControllerFactory::GetInstance());
+```
+
+When a URL is requested, a new renderer is created to load the URL, and a
+corresponding class in the browser is set up to handle messages from the
+renderer to the browser (a `RenderFrameHost`).
+
+The URL of the request is inspected:
+
+```c++
+if (url.SchemeIs("chrome") && url.host_piece() == "donuts")  // chrome://donuts
+  return &NewWebUI<DonutsUI>;
+return nullptr;  // Not a known host; no special access.
+```
+
+and if a factory knows how to handle a host (returns a `WebUIFactoryFunction`),
+the navigation machinery [grants the renderer process WebUI
+bindings](#bindings) via the child security policy.
+
+```c++
+// RenderFrameHostImpl::AllowBindings():
+if (bindings_flags & BINDINGS_POLICY_WEB_UI) {
+	ChildProcessSecurityPolicyImpl::GetInstance()->GrantWebUIBindings(
+			GetProcess()->GetID());
+}
+```
+
+The factory creates a [`WebUIController`](#WebUIController) for a tab.
+Here's an example:
+
+```c++
+// Controller for chrome://donuts.
+class DonutsUI : public content::WebUIController {
+ public:
+  DonutsUI(content::WebUI* web_ui) : content::WebUIController(web_ui) {
+    content::WebUIDataSource* source =
+        content::WebUIDataSource::Create("donuts");  // "donuts" == hostname
+    source->AddString("mmmDonuts", "Mmm, donuts!");  // Translations.
+    source->SetDefaultResource(IDR_DONUTS_HTML);  // Home page.
+    content::WebUIDataSource::Add(source);
+
+    // Handles messages from JavaScript to C++ via chrome.send().
+    web_ui->AddMessageHandler(base::MakeUnique<OvenHandler>());
+  }
+};
+```
+
+If we assume the contents of `IDR_DONUTS_HTML` yields:
+
+```html
+<h1>$i18n{mmmDonuts}</h1>
+```
+
+Visiting `chrome://donuts` should show in something like:
+
+<div style="border: 1px solid black; padding: 10px;">
+<h1>Mmmm, donuts!</h1>
+</div>
+
+Delicious success.
+
+## C++ classes
+
+### WebUI
+
+`WebUI` is a high-level class and pretty much all HTML-based Chrome UIs have
+one. `WebUI` lives in the browser process, and is owned by a `RenderFrameHost`.
+`WebUI`s have a concrete implementation (`WebUIImpl`) in `content/` and are
+created in response to navigation events.
+
+A `WebUI` knows very little about the page it's showing, and it owns a
+[`WebUIController`](#WebUIController) that is set after creation based on the
+hostname of a requested URL.
+
+A `WebUI` *can* handle messages itself, but often defers these duties to
+separate [`WebUIMessageHandler`](#WebUIMessageHandler)s, which are generally
+designed for handling messages on certain topics.
+
+A `WebUI` can be created speculatively, and are generally fairly lightweight.
+Heavier duty stuff like hard initialization logic or accessing services that may
+have side effects are more commonly done in a
+[`WebUIController`](#WebUIController) or
+[`WebUIMessageHandler`s](#WebUIMessageHandler).
+
+`WebUI` are created synchronously on the UI thread in response to a URL request,
+and are re-used where possible between navigations (i.e. refreshing a page).
+Because they run in a separate process and can exist before a corresponding
+renderer process has been created, special care is required to communicate with
+the renderer if reliable message passing is required.
+
+<a name="WebUIController"></a>
+### WebUIController
+
+A `WebUIController` is the brains of the operation, and is responsible for
+application-specific logic, setting up translations and resources, creating
+message handlers, and potentially responding to requests dynamically. In complex
+pages, logic is often split across multiple
+[`WebUIMessageHandler`s](#WebUIMessageHandler) instead of solely in the
+controller for organizational benefits.
+
+A `WebUIController` is owned by a [`WebUI`](#WebUI), and is created and set on
+an existing [`WebUI`](#WebUI) when the correct one is determined via URL
+inspection (i.e. chrome://settings creates a generic [`WebUI`](#WebUI) with a
+settings-specific `WebUIController`).
+
+### WebUIDataSource
+
+<a name="WebUIMessageHandler"></a>
+### WebUIMessageHandler
+
+Because some pages have many messages or share code that sends messages, message
+handling is often split into discrete classes called `WebUIMessageHandler`s.
+These handlers respond to specific invocations from JavaScript.
+
+So, the given C++ code:
+
+```c++
+void OvenHandler::RegisterMessages() {
+  web_ui()->RegisterMessageHandler("bakeDonuts",
+      base::Bind(&OvenHandler::HandleBakeDonuts, base::Unretained(this)));
+}
+
+void OverHandler::HandleBakeDonuts(const base::ListValue* args) {
+  double num_donuts;
+  CHECK(args->GetDouble(0, &num_donuts));  // JavaScript numbers are doubles.
+  GetOven()->BakeDonuts(static_cast<int>(num_donuts));
+}
+```
+
+Can be triggered in JavaScript with this example code:
+
+```js
+$('bakeDonutsButton').onclick = function() {
+  chrome.send('bakeDonuts', [5]);  // bake 5 donuts!
+};
+```
+
+## Browser (C++) &rarr; Renderer (JS)
+
+<a name="AllowJavascript"></a>
+### WebUIMessageHandler::AllowJavascript()
+
+This method determines whether browser &rarr; renderer communication is allowed.
+It is called in response to a signal from JavaScript that the page is ready to
+communicate.
+
+In the JS:
+
+```js
+window.onload = function() {
+  app.initialize();
+  chrome.send('startPilotLight');
+};
+```
+
+In the C++:
+
+```c++
+void OvenHandler::HandleStartPilotLight(cont base::ListValue* /*args*/) {
+  AllowJavascript();
+  // CallJavascriptFunction() and FireWebUIListener() are now safe to do.
+  GetOven()->StartPilotLight();
+}
+```
+
+<div class="note">
+Relying on the <code>'load'</code> event or browser-side navigation callbacks to
+detect page readiness omits <i>application-specific</i> initialization, and a
+custom <code>'initialized'</code> message is often necessary.
+</div>
+
+<a name="CallJavascriptFunction"></a>
+### WebUIMessageHandler::CallJavascriptFunction()
+
+When the browser process needs to tell the renderer/JS of an event or otherwise
+execute code, it can use `CallJavascriptFunction()`.
+
+<div class="note">
+Javascript must be <a href="#AllowJavascript">allowed</a> to use
+<code>CallJavscriptFunction()</code>.
+</div>
+
+```c++
+void OvenHandler::OnPilotLightExtinguished() {
+  CallJavascriptFunction("app.pilotLightExtinguished");
+}
+```
+
+This works by crafting a string to be evaluated in the renderer. Any arguments
+to the call are serialized to JSON and the parameter list is wrapped with
+
+```
+// See WebUI::GetJavascriptCall() for specifics:
+"functionCallName(" + argumentsAsJson + ")"
+```
+
+and sent to the renderer via a `FrameMsg_JavaScriptExecuteRequest` IPC message.
+
+While this works, it implies that:
+
+* a global method must exist to successfully run the Javascript request
+* any method can be called with any parameter (far more access than required in
+  practice)
+
+^ These factors have resulted in less use of `CallJavascriptFunction()` in the
+webui codebase. This functionality can easily be accomplished with the following
+alternatives:
+
+* [`FireWebUIListener()`](#FireWebUIListener) allows easily notifying the page
+  when an event occurs in C++ and is more loosely coupled (nothing blows up if
+  the event dispatch is ignored). JS subscribes to notifications via
+  [`cr.addWebUIListener`](#cr_addWebUIListener).
+* [`ResolveJavascriptCallback`](#ResolveJavascriptCallback) and
+  [`RejectJavascriptCallback`](#RejectJavascriptCallback) are useful
+  when Javascript requires a response to an inquiry about C++-canonical state
+  (i.e. "Is Autofill enabled?", "Is the user incognito?")
+
+<a name="FireWebUIListener"></a>
+### WebUIMessageHandler::FireWebUIListener()
+
+`FireWebUIListener()` is used to notify a registered set of listeners that an
+event has occurred. This is generally used for events that are not guaranteed to
+happen in timely manner, or may be caused to happen by unpredictable events
+(i.e. user actions).
+
+Here's some example to detect a change to Chrome's theme:
+
+```js
+cr.addWebUIListener("theme-changed", refreshThemeStyles);
+```
+
+This Javascript event listener can be triggered in C++ via:
+
+```c++
+void MyHandler::OnThemeChanged() {
+  FireWebUIListener("theme-changed");
+}
+```
+
+Because it's not clear when a user might want to change their theme nor what
+theme they'll choose, this is a good candidate for an event listener.
+
+If you simply need to get a response in Javascript from C++, consider using
+[`cr.sendWithPromise()`](#cr_sendWithPromise) and
+[`ResolveJavascriptCallback`](#ResolveJavascriptCallback).
+
+<a name="OnJavascriptAllowed"></a>
+### WebUIMessageHandler::OnJavascriptAllowed()
+
+`OnJavascriptDisallowed()` is a lifecycle method called in response to
+[`AllowJavascript()`](#AllowJavascript). It is a good place to register
+observers of global services or other callbacks that might call at unpredictable
+times.
+
+For example:
+
+```c++
+class MyHandler : public content::WebUIMessageHandler {
+  MyHandler() {
+    GetGlobalService()->AddObserver(this);  // <-- DON'T DO THIS.
+  }
+  void OnGlobalServiceEvent() {
+    FireWebUIListener("global-thing-happened");
+  }
+};
+```
+
+Because browser-side C++ handlers are created before a renderer is ready, the
+above code may result in calling [`FireWebUIListener`](#FireWebUIListener)
+before the renderer is ready, which may result in dropped updates or
+accidentally running Javascript in a renderer that has navigated to a new URL.
+
+A safer way to set up communication is:
+
+```c++
+class MyHandler : public content::WebUIMessageHandler {
+ public:
+  MyHandler() : observer_(this) {}
+  void OnJavascriptAllowed() override {
+    observer_.Add(GetGlobalService());  // <-- DO THIS.
+  }
+  void OnJavascriptDisallowed() override {
+    observer_.RemoveAll();  // <-- AND THIS.
+  }
+  ScopedObserver<MyHandler, GlobalService> observer_;  // <-- ALSO HANDY.
+```
+when a renderer has been created and the
+document has loaded enough to signal to the C++ that it's ready to respond to
+messages.
+
+<a name="OnJavascriptDisallowed"></a>
+### WebUIMessageHandler::OnJavascriptDisallowed()
+
+`OnJavascriptDisallowed` is a lifecycle method called when it's unclear whether
+it's safe to send JavaScript messsages to the renderer.
+
+There's a number of situations that result in this method being called:
+
+* renderer doesn't exist yet
+* renderer exists but isn't ready
+* renderer is ready but application-specifici JS isn't ready yet
+* tab refresh
+* renderer crash
+
+Though it's possible to programmatically disable Javascript, it's uncommon to
+need to do so.
+
+Because there's no single strategy that works for all cases of a renderer's
+state (i.e. queueing vs dropping messages), these lifecycle methods were
+introduced so a WebUI application can implement these decisions itself.
+
+Often, it makes sense to disconnect from observers in
+`OnJavascriptDisallowed()`:
+
+```c++
+void OvenHandler::OnJavascriptDisallowed() {
+  scoped_oven_observer_.RemoveAll()
+}
+```
+
+Because `OnJavascriptDisallowed()` is not guaranteed to be called before a
+`WebUIMessageHandler`'s destructor, it is often advisable to use some form of
+scoped observer that automatically unsubscribes on destruction but can also
+imperatively unsubscribe in `OnJavascriptDisallowed()`.
+
+<a name="RejectJavascriptCallback"></a>
+### WebUIMessageHandler::RejectJavascriptCallback()
+
+This method is called in response to
+[`cr.sendWithPromise()`](#cr_sendWithPromise) to reject the issued Promise. This
+runs the rejection (second) callback in the [Promise's
+executor](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise)
+and any
+[`catch()`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise/catch)
+callbacks in the chain.
+
+```c++
+void OvenHandler::HandleBakeDonuts(const base::ListValue* args) {
+base::Value* callback_id;
+args->Get(0, &callback_id);
+if (!GetOven()->HasGas()) {
+  RejectJavascriptCallback(callback_id,
+                           base::StringValue("need gas to cook the donuts!"));
+}
+```
+
+This method is basically just a
+[`CallJavascriptFunction()`](#CallJavascriptFunction) wrapper that calls a
+global "cr.webUIResponse" method with a success value of false.
+
+```c++
+// WebUIMessageHandler::RejectJavascriptCallback():
+CallJavascriptFunction("cr.webUIResponse", callback_id, base::Value(false),
+											 response);
+```
+
+See also: [`ResolveJavascriptCallback`](#ResolveJavascriptCallback)
+
+<a name="ResolveJavascriptCallback"></a>
+### WebUIMessageHandler::ResolveJavascriptCallback()
+
+This method is called in response to
+[`cr.sendWithPromise()`](#cr_sendWithPromise) to fulfill an issued Promise,
+often with a value. This results in runnings any fulfillment (first) callbacks
+in the associate Promise executor and any registered
+[`then()`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise/then)
+callbacks.
+
+So, given this JS code:
+
+```js
+cr.sendWithPromise('bakeDonuts').then(function(numDonutsBaked) {
+  shop.donuts += numDonutsBaked;
+});
+```
+
+Some handling C++ might do this:
+
+```c++
+void OvenHandler::HandleBakeDonuts(const base::ListValue* args) {
+  base::Value* callback_id;
+  args->Get(0, &callback_id);
+  double num_donuts_baked = GetOven()->BakeDonuts();
+  ResolveJavascriptCallback(*callback_id, num_donuts_baked);
+}
+```
+
+## Renderer (JS) &rarr; Browser (C++)
+
+<a name="chrome_send"></a>
+### chrome.send()
+
+When the JavaScript `window` object is created, a renderer is checked for [WebUI
+bindings](#bindings).
+
+```c++
+// RenderFrameImpl::DidClearWindowObject():
+if (enabled_bindings_ & BINDINGS_POLICY_WEB_UI)
+  WebUIExtension::Install(frame_);
+```
+
+If the bindings exist, a global `chrome.send()` function is exposed to the
+renderer:
+
+```c++
+// WebUIExtension::Install():
+v8::Local<v8::Object> chrome =
+		GetOrCreateChromeObject(isolate, context->Global());
+chrome->Set(gin::StringToSymbol(isolate, "send"),
+						gin::CreateFunctionTemplate(
+								isolate, base::Bind(&WebUIExtension::Send))->GetFunction());
+```
+
+The `chrome.send()` method takes a message name and argument list.
+
+```js
+chrome.send('messageName', [arg1, arg2, ...]);
+```
+
+The message name and argument list are serialized to JSON and sent via the
+`ViewHostMsg_WebUISend` IPC message from the renderer to the browser.
+
+```c++
+// In the renderer (WebUIExtension::Send()):
+render_view->Send(new ViewHostMsg_WebUISend(render_view->GetRoutingID(),
+																						frame->GetDocument().Url(),
+																						message, *content));
+```
+```c++
+// In the browser (WebUIImpl::OnMessageReceived()):
+IPC_MESSAGE_HANDLER(ViewHostMsg_WebUISend, OnWebUISend)
+```
+
+The browser-side code does a map lookup for the message name and calls the found
+callback with the deserialized arguments:
+
+```c++
+// WebUIImpl::ProcessWebUIMessage():
+message_callbacks_.find(message)->second.Run(&args);
+```
+
+<a name="cr_addWebUIListener">
+### cr.addWebUIListener()
+
+WebUI listeners are a convenient way for C++ to inform JavaScript of events.
+
+Older WebUI code exposed public methods for event notification, similar to how
+responses to [chrome.send()](#chrome_send) used to work. They both
+resulted in global namespace polution, but it was additionally hard to stop
+listening for events in some cases. **cr.addWebUIListener** is preferred in new
+code.
+
+Adding WebUI listeners creates and inserts a unique ID into a map in JavaScript,
+just like [cr.sendWithPromise()](#cr_sendWithPromise).
+
+```js
+// addWebUIListener():
+webUIListenerMap[eventName] = webUIListenerMap[eventName] || {};
+webUIListenerMap[eventName][createUid()] = callback;
+```
+
+The C++ responds to a globally exposed function (`cr.webUIListenerCallback`)
+with an event name and a variable number of arguments.
+
+```c++
+// WebUIMessageHandler:
+template <typename... Values>
+void FireWebUIListener(const std::string& event_name, const Values&... values) {
+  CallJavascriptFunction("cr.webUIListenerCallback", base::Value(event_name),
+                         values...);
+}
+```
+
+C++ handlers call this `FireWebUIListener` method when an event occurs that
+should be communicated to the JavaScript running in a tab.
+
+```c++
+void OvenHandler::OnBakingDonutsFinished(size_t num_donuts) {
+  FireWebUIListener("donuts-baked", base::FundamentalValue(num_donuts));
+}
+```
+
+JavaScript can listen for WebUI events via:
+
+```js
+var donutsReady = 0;
+cr.addWebUIListener('donuts-baked', function(numFreshlyBakedDonuts) {
+  donutsReady += numFreshlyBakedDonuts;
+});
+```
+
+<a name="cr_sendWithPromise"></a>
+### cr.sendWithPromise()
+
+`cr.sendWithPromise()` is a wrapper around `chrome.send()`. It's used when
+triggering a message requires a response:
+
+```js
+chrome.send('getNumberOfDonuts');  // No easy way to get response!
+```
+
+In older WebUI pages, global methods were exposed simply so responses could be
+sent. **This is discouraged** as it pollutes the global namespace and is harder
+to make request specific or do from deeply nested code.
+
+In newer WebUI pages, you see code like this:
+
+```js
+cr.sendWithPromise('getNumberOfDonuts').then(function(numDonuts) {
+  alert('Yay, there are ' + numDonuts + ' delicious donuts left!');
+});
+```
+
+On the C++ side, the message registration is similar to
+[`chrome.send()`](#chrome_send) except that the first argument in the
+message handler's list is a callback ID. That ID is passed to
+`ResolveJavascriptCallback()`, which ends up resolving the `Promise` in
+JavaScript and calling the `then()` function.
+
+```c++
+void DonutHandler::HandleGetNumberOfDonuts(const base::ListValue* args) {
+  base::Value* callback_id;
+  args->Get(0, &callback_id);
+  size_t num_donuts = GetOven()->GetNumberOfDonuts();
+  ResolveJavascriptCallback(*callback_id, base::FundamentalValue(num_donuts));
+}
+```
+
+Under the covers, a map of `Promise`s are kept in JavaScript.
+
+The callback ID is just a namespaced, ever-increasing number. It's used to
+insert a `Promise` into the JS-side map when created.
+
+```js
+// cr.sendWithPromise():
+var id = methodName + '_' + uidCounter++;
+chromeSendResolverMap[id] = new PromiseResolver;
+chrome.send(methodName, [id].concat(args));
+```
+
+The corresponding number is used to look up a `Promise` and reject or resolve it
+when the outcome is known.
+
+```js
+// cr.webUIResponse():
+var resolver = chromeSendResolverMap[id];
+if (success)
+  resolver.resolve(response);
+else
+  resolver.reject(response);
+```
+
+This approach still relies on the C++ calling a globally exposed method, but
+reduces the surface to only a single global (`cr.webUIResponse`) instead of
+many. It also makes per-request responses easier, which is helpful when multiple
+are in flight.
+
+## See also
+
+* WebUI's C++ code follows the [Chromium C++ styleguide](../c++/c++.md).
+* WebUI's HTML/CSS/JS code follows the [Chromium Web
+  Development Style Guide](../styleguide/web/web.md)
+
+
+<script>
+let nameEls = Array.from(document.querySelectorAll('[id], a[name]'));
+let names = nameEls.map(nameEl => nameEl.name || nameEl.id);
+
+let localLinks = Array.from(document.querySelectorAll('a[href^="#"]'));
+let hrefs = localLinks.map(a => a.href.split('#')[1]);
+
+hrefs.forEach(href => {
+  if (names.includes(href))
+    console.info('found: ' + href);
+  else
+    console.error('broken href: ' + href);
+})
+</script>

diff --git a/extensions/common/api/_permission_features.json b/extensions/common/api/_permission_features.json
index 7a2afec..3092c9a 100644
--- a/extensions/common/api/_permission_features.json
+++ b/extensions/common/api/_permission_features.json

@@ -260,7 +260,7 @@
     ]
   },
   "mediaPerceptionPrivate": [{
-    "channel": "dev",
+    "channel": "stable",
     "extension_types": ["platform_app"],
     "session_types": ["kiosk"],
     "platforms": ["chromeos"],

diff --git a/ios/chrome/browser/ui/payments/address_edit_coordinator_unittest.mm b/ios/chrome/browser/ui/payments/address_edit_coordinator_unittest.mm
index 69edcda..f346763 100644
--- a/ios/chrome/browser/ui/payments/address_edit_coordinator_unittest.mm
+++ b/ios/chrome/browser/ui/payments/address_edit_coordinator_unittest.mm

@@ -141,7 +141,7 @@
   EXPECT_EQ(nil, base_view_controller.presentedViewController);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_TRUE([base_view_controller.presentedViewController
       isMemberOfClass:[PaymentRequestEditViewController class]]);
@@ -181,7 +181,7 @@
   EXPECT_EQ(nil, base_view_controller.presentedViewController);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_NE(nil, base_view_controller.presentedViewController);
 
@@ -240,7 +240,7 @@
   EXPECT_EQ(nil, base_view_controller.presentedViewController);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_NE(nil, base_view_controller.presentedViewController);
 
@@ -290,7 +290,7 @@
   EXPECT_EQ(nil, base_view_controller.presentedViewController);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_NE(nil, base_view_controller.presentedViewController);
 

diff --git a/ios/chrome/browser/ui/payments/billing_address_selection_coordinator_unittest.mm b/ios/chrome/browser/ui/payments/billing_address_selection_coordinator_unittest.mm
index 9407c4a..0abd0549 100644
--- a/ios/chrome/browser/ui/payments/billing_address_selection_coordinator_unittest.mm
+++ b/ios/chrome/browser/ui/payments/billing_address_selection_coordinator_unittest.mm

@@ -67,7 +67,7 @@
   EXPECT_EQ(1u, GetNavigationController().viewControllers.count);
 
   [GetCoordinator() start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(2u, GetNavigationController().viewControllers.count);
 
@@ -77,7 +77,7 @@
       isMemberOfClass:[PaymentRequestSelectorViewController class]]);
 
   [GetCoordinator() stop];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(1u, GetNavigationController().viewControllers.count);
 }
@@ -98,7 +98,7 @@
   EXPECT_EQ(1u, GetNavigationController().viewControllers.count);
 
   [GetCoordinator() start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(2u, GetNavigationController().viewControllers.count);
 
@@ -129,7 +129,7 @@
   EXPECT_EQ(1u, GetNavigationController().viewControllers.count);
 
   [GetCoordinator() start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(2u, GetNavigationController().viewControllers.count);
 

diff --git a/ios/chrome/browser/ui/payments/contact_info_edit_coordinator_unittest.mm b/ios/chrome/browser/ui/payments/contact_info_edit_coordinator_unittest.mm
index 76dc1a2..6522712 100644
--- a/ios/chrome/browser/ui/payments/contact_info_edit_coordinator_unittest.mm
+++ b/ios/chrome/browser/ui/payments/contact_info_edit_coordinator_unittest.mm

@@ -132,7 +132,7 @@
   EXPECT_EQ(nil, base_view_controller.presentedViewController);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_TRUE([base_view_controller.presentedViewController
       isMemberOfClass:[PaymentRequestEditViewController class]]);
@@ -172,7 +172,7 @@
   EXPECT_EQ(nil, base_view_controller.presentedViewController);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_NE(nil, base_view_controller.presentedViewController);
 
@@ -231,7 +231,7 @@
   EXPECT_EQ(nil, base_view_controller.presentedViewController);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_NE(nil, base_view_controller.presentedViewController);
 
@@ -281,7 +281,7 @@
   EXPECT_EQ(nil, base_view_controller.presentedViewController);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_NE(nil, base_view_controller.presentedViewController);
 

diff --git a/ios/chrome/browser/ui/payments/contact_info_selection_coordinator_unittest.mm b/ios/chrome/browser/ui/payments/contact_info_selection_coordinator_unittest.mm
index 3f117ca6..fdccc17 100644
--- a/ios/chrome/browser/ui/payments/contact_info_selection_coordinator_unittest.mm
+++ b/ios/chrome/browser/ui/payments/contact_info_selection_coordinator_unittest.mm

@@ -57,7 +57,7 @@
   EXPECT_EQ(1u, navigation_controller.viewControllers.count);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(2u, navigation_controller.viewControllers.count);
 
@@ -67,7 +67,7 @@
       isMemberOfClass:[PaymentRequestSelectorViewController class]]);
 
   [coordinator stop];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(1u, navigation_controller.viewControllers.count);
 }
@@ -97,7 +97,7 @@
   EXPECT_EQ(1u, navigation_controller.viewControllers.count);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(2u, navigation_controller.viewControllers.count);
 
@@ -137,7 +137,7 @@
   EXPECT_EQ(1u, navigation_controller.viewControllers.count);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(2u, navigation_controller.viewControllers.count);
 

diff --git a/ios/chrome/browser/ui/payments/country_selection_coordinator_unittest.mm b/ios/chrome/browser/ui/payments/country_selection_coordinator_unittest.mm
index 646c547..771345a 100644
--- a/ios/chrome/browser/ui/payments/country_selection_coordinator_unittest.mm
+++ b/ios/chrome/browser/ui/payments/country_selection_coordinator_unittest.mm

@@ -27,12 +27,12 @@
   EXPECT_EQ(1u, navigation_controller.viewControllers.count);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(2u, navigation_controller.viewControllers.count);
 
   [coordinator stop];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(1u, navigation_controller.viewControllers.count);
 }

diff --git a/ios/chrome/browser/ui/payments/credit_card_edit_coordinator_unittest.mm b/ios/chrome/browser/ui/payments/credit_card_edit_coordinator_unittest.mm
index 34aafdc..fb0c5ab 100644
--- a/ios/chrome/browser/ui/payments/credit_card_edit_coordinator_unittest.mm
+++ b/ios/chrome/browser/ui/payments/credit_card_edit_coordinator_unittest.mm

@@ -128,7 +128,7 @@
   EXPECT_EQ(nil, base_view_controller.presentedViewController);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_TRUE([base_view_controller.presentedViewController
       isMemberOfClass:[PaymentRequestEditViewController class]]);
@@ -168,7 +168,7 @@
   EXPECT_EQ(nil, base_view_controller.presentedViewController);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_NE(nil, base_view_controller.presentedViewController);
 
@@ -221,7 +221,7 @@
   EXPECT_EQ(nil, base_view_controller.presentedViewController);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_NE(nil, base_view_controller.presentedViewController);
 
@@ -274,7 +274,7 @@
   EXPECT_EQ(nil, base_view_controller.presentedViewController);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_NE(nil, base_view_controller.presentedViewController);
 
@@ -319,7 +319,7 @@
   EXPECT_EQ(nil, base_view_controller.presentedViewController);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_NE(nil, base_view_controller.presentedViewController);
 

diff --git a/ios/chrome/browser/ui/payments/payment_items_display_coordinator_unittest.mm b/ios/chrome/browser/ui/payments/payment_items_display_coordinator_unittest.mm
index ee10378e..71e68a93 100644
--- a/ios/chrome/browser/ui/payments/payment_items_display_coordinator_unittest.mm
+++ b/ios/chrome/browser/ui/payments/payment_items_display_coordinator_unittest.mm

@@ -51,12 +51,12 @@
   EXPECT_EQ(1u, navigation_controller.viewControllers.count);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(2u, navigation_controller.viewControllers.count);
 
   [coordinator stop];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(1u, navigation_controller.viewControllers.count);
 }
@@ -84,7 +84,7 @@
   EXPECT_EQ(1u, navigation_controller.viewControllers.count);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(2u, navigation_controller.viewControllers.count);
 
@@ -120,7 +120,7 @@
   EXPECT_EQ(1u, navigation_controller.viewControllers.count);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(2u, navigation_controller.viewControllers.count);
 

diff --git a/ios/chrome/browser/ui/payments/payment_method_selection_coordinator_unittest.mm b/ios/chrome/browser/ui/payments/payment_method_selection_coordinator_unittest.mm
index 5d4a2ba6..dec60fa1 100644
--- a/ios/chrome/browser/ui/payments/payment_method_selection_coordinator_unittest.mm
+++ b/ios/chrome/browser/ui/payments/payment_method_selection_coordinator_unittest.mm

@@ -59,7 +59,7 @@
   EXPECT_EQ(1u, navigation_controller.viewControllers.count);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(2u, navigation_controller.viewControllers.count);
 
@@ -69,7 +69,7 @@
       isMemberOfClass:[PaymentRequestSelectorViewController class]]);
 
   [coordinator stop];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(1u, navigation_controller.viewControllers.count);
 }
@@ -100,7 +100,7 @@
   EXPECT_EQ(1u, navigation_controller.viewControllers.count);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(2u, navigation_controller.viewControllers.count);
 
@@ -140,7 +140,7 @@
   EXPECT_EQ(1u, navigation_controller.viewControllers.count);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(2u, navigation_controller.viewControllers.count);
 

diff --git a/ios/chrome/browser/ui/payments/payment_request_coordinator_unittest.mm b/ios/chrome/browser/ui/payments/payment_request_coordinator_unittest.mm
index 1b2ce034..7723af8 100644
--- a/ios/chrome/browser/ui/payments/payment_request_coordinator_unittest.mm
+++ b/ios/chrome/browser/ui/payments/payment_request_coordinator_unittest.mm

@@ -112,25 +112,24 @@
   [coordinator setBrowserState:browser_state_.get()];
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1));
-  id presented_view_controller =
-      [coordinator baseViewController].presentedViewController;
-  EXPECT_TRUE([presented_view_controller
+  EXPECT_TRUE([base_view_controller.presentedViewController
       isMemberOfClass:[UINavigationController class]]);
   UINavigationController* navigation_controller =
       base::mac::ObjCCastStrict<UINavigationController>(
-          presented_view_controller);
+          base_view_controller.presentedViewController);
   EXPECT_EQ(1u, navigation_controller.viewControllers.count);
-  id view_controller = navigation_controller.visibleViewController;
-  EXPECT_TRUE(
-      [view_controller isMemberOfClass:[PaymentRequestViewController class]]);
+  EXPECT_TRUE([navigation_controller.visibleViewController
+      isMemberOfClass:[PaymentRequestViewController class]]);
 
   [coordinator stop];
-  // Delay to allow animation to complete.
-  base::test::ios::SpinRunLoopWithMinDelay(base::TimeDelta::FromSecondsD(2));
-
-  EXPECT_EQ(nil, [coordinator baseViewController].presentedViewController);
+  // Wait until the animation completes and the presented view controller is
+  // dismissed.
+  base::test::ios::WaitUntilCondition(^bool() {
+    return !base_view_controller.presentedViewController;
+  });
+  EXPECT_EQ(nil, base_view_controller.presentedViewController);
 }
 
 // Tests that calling the card unmasking delegate method which notifies the
@@ -275,7 +274,7 @@
   [coordinator setBrowserState:browser_state_.get()];
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1));
 
   // Call the controller delegate method.

diff --git a/ios/chrome/browser/ui/payments/payment_request_error_coordinator_unittest.mm b/ios/chrome/browser/ui/payments/payment_request_error_coordinator_unittest.mm
index 9caebeaa..bec1d303 100644
--- a/ios/chrome/browser/ui/payments/payment_request_error_coordinator_unittest.mm
+++ b/ios/chrome/browser/ui/payments/payment_request_error_coordinator_unittest.mm

@@ -28,17 +28,18 @@
           initWithBaseViewController:base_view_controller];
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
-  id presented_view_controller =
-      [coordinator baseViewController].presentedViewController;
-  EXPECT_TRUE([presented_view_controller
+  EXPECT_TRUE([base_view_controller.presentedViewController
       isMemberOfClass:[PaymentRequestErrorViewController class]]);
 
   [coordinator stop];
-  // Delay to allow animation to complete.
-  base::test::ios::SpinRunLoopWithMinDelay(base::TimeDelta::FromSecondsD(2));
-  EXPECT_EQ(nil, [coordinator baseViewController].presentedViewController);
+  // Wait until the animation completes and the presented view controller is
+  // dismissed.
+  base::test::ios::WaitUntilCondition(^bool() {
+    return !base_view_controller.presentedViewController;
+  });
+  EXPECT_EQ(nil, base_view_controller.presentedViewController);
 }
 
 // Tests that calling the view controller delegate method which notifies the
@@ -60,15 +61,13 @@
   [coordinator setDelegate:delegate];
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
 
   // Call the controller delegate method.
-  id presented_view_controller =
-      [coordinator baseViewController].presentedViewController;
   PaymentRequestErrorViewController* view_controller =
       base::mac::ObjCCastStrict<PaymentRequestErrorViewController>(
-          presented_view_controller);
+          base_view_controller.presentedViewController);
   [coordinator paymentRequestErrorViewControllerDidDismiss:view_controller];
 
   EXPECT_OCMOCK_VERIFY(delegate);

diff --git a/ios/chrome/browser/ui/payments/shipping_address_selection_coordinator_unittest.mm b/ios/chrome/browser/ui/payments/shipping_address_selection_coordinator_unittest.mm
index f837750..3eb3d51 100644
--- a/ios/chrome/browser/ui/payments/shipping_address_selection_coordinator_unittest.mm
+++ b/ios/chrome/browser/ui/payments/shipping_address_selection_coordinator_unittest.mm

@@ -58,7 +58,7 @@
   EXPECT_EQ(1u, navigation_controller.viewControllers.count);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(2u, navigation_controller.viewControllers.count);
 
@@ -68,7 +68,7 @@
       isMemberOfClass:[PaymentRequestSelectorViewController class]]);
 
   [coordinator stop];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(1u, navigation_controller.viewControllers.count);
 }
@@ -99,7 +99,7 @@
   EXPECT_EQ(1u, navigation_controller.viewControllers.count);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(2u, navigation_controller.viewControllers.count);
 
@@ -139,7 +139,7 @@
   EXPECT_EQ(1u, navigation_controller.viewControllers.count);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(2u, navigation_controller.viewControllers.count);
 

diff --git a/ios/chrome/browser/ui/payments/shipping_option_selection_coordinator_unittest.mm b/ios/chrome/browser/ui/payments/shipping_option_selection_coordinator_unittest.mm
index e3262ca3..678bccaf 100644
--- a/ios/chrome/browser/ui/payments/shipping_option_selection_coordinator_unittest.mm
+++ b/ios/chrome/browser/ui/payments/shipping_option_selection_coordinator_unittest.mm

@@ -52,7 +52,7 @@
   EXPECT_EQ(1u, navigation_controller.viewControllers.count);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(2u, navigation_controller.viewControllers.count);
 
@@ -62,7 +62,7 @@
       isMemberOfClass:[PaymentRequestSelectorViewController class]]);
 
   [coordinator stop];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(1u, navigation_controller.viewControllers.count);
 }
@@ -93,7 +93,7 @@
   EXPECT_EQ(1u, navigation_controller.viewControllers.count);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(2u, navigation_controller.viewControllers.count);
 
@@ -133,7 +133,7 @@
   EXPECT_EQ(1u, navigation_controller.viewControllers.count);
 
   [coordinator start];
-  // Short delay to allow animation to complete.
+  // Spin the run loop to trigger the animation.
   base::test::ios::SpinRunLoopWithMaxDelay(base::TimeDelta::FromSecondsD(1.0));
   EXPECT_EQ(2u, navigation_controller.viewControllers.count);
 

diff --git a/ios/web_view/internal/cwv_scroll_view_internal.h b/ios/web_view/internal/cwv_scroll_view_internal.h
index 5328719..9ede6b0 100644
--- a/ios/web_view/internal/cwv_scroll_view_internal.h
+++ b/ios/web_view/internal/cwv_scroll_view_internal.h

@@ -5,7 +5,6 @@
 #ifndef IOS_WEB_VIEW_INTERNAL_CWV_SCROLL_VIEW_INTERNAL_H_
 #define IOS_WEB_VIEW_INTERNAL_CWV_SCROLL_VIEW_INTERNAL_H_
 
-#import <ChromeWebView/cwv_export.h>
 #import <Foundation/Foundation.h>
 
 #import "ios/web_view/public/cwv_scroll_view.h"

diff --git a/ios/web_view/public/ChromeWebView.h b/ios/web_view/public/ChromeWebView.h
index c0b07b6..2e28fad2 100644
--- a/ios/web_view/public/ChromeWebView.h
+++ b/ios/web_view/public/ChromeWebView.h

@@ -5,20 +5,24 @@
 #ifndef IOS_WEB_VIEW_PUBLIC_CHROMEWEBVIEW_H_
 #define IOS_WEB_VIEW_PUBLIC_CHROMEWEBVIEW_H_
 
-#import <ChromeWebView/cwv_export.h>
-#import <ChromeWebView/cwv_html_element.h>
-#import <ChromeWebView/cwv_language_detection_result.h>
-#import <ChromeWebView/cwv_navigation_action.h>
-#import <ChromeWebView/cwv_navigation_delegate.h>
-#import <ChromeWebView/cwv_scroll_view.h>
-#import <ChromeWebView/cwv_scroll_view_delegate.h>
-#import <ChromeWebView/cwv_translation_controller.h>
-#import <ChromeWebView/cwv_translation_controller_delegate.h>
-#import <ChromeWebView/cwv_translation_language.h>
-#import <ChromeWebView/cwv_ui_delegate.h>
-#import <ChromeWebView/cwv_user_content_controller.h>
-#import <ChromeWebView/cwv_user_script.h>
-#import <ChromeWebView/cwv_web_view.h>
-#import <ChromeWebView/cwv_web_view_configuration.h>
+// NOTE: Relative imports are used throughout the implementation of
+// ChromeWebView. Framework style imports can't be used because multiple
+// frameworks are built from ios/web_view with different output names.
+
+#import "cwv_export.h"
+#import "cwv_html_element.h"
+#import "cwv_language_detection_result.h"
+#import "cwv_navigation_action.h"
+#import "cwv_navigation_delegate.h"
+#import "cwv_scroll_view.h"
+#import "cwv_scroll_view_delegate.h"
+#import "cwv_translation_controller.h"
+#import "cwv_translation_controller_delegate.h"
+#import "cwv_translation_language.h"
+#import "cwv_ui_delegate.h"
+#import "cwv_user_content_controller.h"
+#import "cwv_user_script.h"
+#import "cwv_web_view.h"
+#import "cwv_web_view_configuration.h"
 
 #endif  // IOS_WEB_VIEW_PUBLIC_CHROMEWEBVIEW_H_

diff --git a/ios/web_view/public/cwv_html_element.h b/ios/web_view/public/cwv_html_element.h
index 05e773d2..e860546 100644
--- a/ios/web_view/public/cwv_html_element.h
+++ b/ios/web_view/public/cwv_html_element.h

@@ -5,9 +5,10 @@
 #ifndef IOS_WEB_VIEW_PUBLIC_CWV_HTML_ELEMENT_H_
 #define IOS_WEB_VIEW_PUBLIC_CWV_HTML_ELEMENT_H_
 
-#import <ChromeWebView/cwv_export.h>
 #import <Foundation/Foundation.h>
 
+#import "cwv_export.h"
+
 // Encapsulates information about HTML element. Used in
 // delegate methods.
 CWV_EXPORT

diff --git a/ios/web_view/public/cwv_language_detection_result.h b/ios/web_view/public/cwv_language_detection_result.h
index 78115c8..a8d0944 100644
--- a/ios/web_view/public/cwv_language_detection_result.h
+++ b/ios/web_view/public/cwv_language_detection_result.h

@@ -5,9 +5,10 @@
 #ifndef IOS_WEB_VIEW_PUBLIC_CWV_LANGUAGE_DETECTION_RESULT_H
 #define IOS_WEB_VIEW_PUBLIC_CWV_LANGUAGE_DETECTION_RESULT_H
 
-#import <ChromeWebView/cwv_export.h>
 #import <Foundation/Foundation.h>
 
+#import "cwv_export.h"
+
 NS_ASSUME_NONNULL_BEGIN
 
 @class CWVTranslationLanguage;

diff --git a/ios/web_view/public/cwv_navigation_action.h b/ios/web_view/public/cwv_navigation_action.h
index 124b0175..a302eb7 100644
--- a/ios/web_view/public/cwv_navigation_action.h
+++ b/ios/web_view/public/cwv_navigation_action.h

@@ -5,9 +5,10 @@
 #ifndef IOS_WEB_VIEW_PUBLIC_CWV_NAVIGATION_ACTION_H_
 #define IOS_WEB_VIEW_PUBLIC_CWV_NAVIGATION_ACTION_H_
 
-#import <ChromeWebView/cwv_export.h>
 #import <Foundation/Foundation.h>
 
+#import "cwv_export.h"
+
 // Encapsulates information about an action which caused a navigation.
 CWV_EXPORT
 @interface CWVNavigationAction : NSObject

diff --git a/ios/web_view/public/cwv_navigation_delegate.h b/ios/web_view/public/cwv_navigation_delegate.h
index 52ca51e48..4561d619 100644
--- a/ios/web_view/public/cwv_navigation_delegate.h
+++ b/ios/web_view/public/cwv_navigation_delegate.h

@@ -5,9 +5,10 @@
 #ifndef IOS_WEB_VIEW_PUBLIC_CWV_NAVIGATION_DELEGATE_H_
 #define IOS_WEB_VIEW_PUBLIC_CWV_NAVIGATION_DELEGATE_H_
 
-#import <ChromeWebView/cwv_export.h>
 #import <Foundation/Foundation.h>
 
+#import "cwv_export.h"
+
 @protocol CRIWVTranslateDelegate;
 @class CWVWebView;
 

diff --git a/ios/web_view/public/cwv_scroll_view.h b/ios/web_view/public/cwv_scroll_view.h
index 66142dd1..ba202a8 100644
--- a/ios/web_view/public/cwv_scroll_view.h
+++ b/ios/web_view/public/cwv_scroll_view.h

@@ -5,11 +5,12 @@
 #ifndef IOS_WEB_VIEW_PUBLIC_CWV_SCROLL_VIEW_H_
 #define IOS_WEB_VIEW_PUBLIC_CWV_SCROLL_VIEW_H_
 
-#import <ChromeWebView/cwv_export.h>
 #import <CoreGraphics/CoreGraphics.h>
 #import <Foundation/Foundation.h>
 #import <UIKit/UIKit.h>
 
+#import "cwv_export.h"
+
 @protocol CWVScrollViewDelegate;
 
 // Scroll view inside the web view. This is not a subclass of UIScrollView

diff --git a/ios/web_view/public/cwv_scroll_view_delegate.h b/ios/web_view/public/cwv_scroll_view_delegate.h
index f9bc5cac..0947a64 100644
--- a/ios/web_view/public/cwv_scroll_view_delegate.h
+++ b/ios/web_view/public/cwv_scroll_view_delegate.h

@@ -7,6 +7,8 @@
 
 #import <CoreGraphics/CoreGraphics.h>
 
+#import "cwv_export.h"
+
 @class CWVScrollView;
 
 // Delegete for CWVScrollView.

diff --git a/ios/web_view/public/cwv_translation_controller.h b/ios/web_view/public/cwv_translation_controller.h
index 598ab0d5..ef216c53 100644
--- a/ios/web_view/public/cwv_translation_controller.h
+++ b/ios/web_view/public/cwv_translation_controller.h

@@ -5,9 +5,10 @@
 #ifndef IOS_WEB_VIEW_PUBLIC_CWV_TRANSLATION_CONTROLLER_H
 #define IOS_WEB_VIEW_PUBLIC_CWV_TRANSLATION_CONTROLLER_H
 
-#import <ChromeWebView/cwv_export.h>
 #import <Foundation/Foundation.h>
 
+#import "cwv_export.h"
+
 NS_ASSUME_NONNULL_BEGIN
 
 @class CWVTranslationLanguage;

diff --git a/ios/web_view/public/cwv_translation_controller_delegate.h b/ios/web_view/public/cwv_translation_controller_delegate.h
index ef09de64..eee7c433 100644
--- a/ios/web_view/public/cwv_translation_controller_delegate.h
+++ b/ios/web_view/public/cwv_translation_controller_delegate.h

@@ -2,9 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#import <ChromeWebView/cwv_export.h>
 #import <Foundation/Foundation.h>
 
+#import "cwv_export.h"
+
 #ifndef IOS_WEB_VIEW_PUBLIC_CWV_TRANSLATION_CONTROLLER_DELEGATE_H
 #define IOS_WEB_VIEW_PUBLIC_CWV_TRANSLATION_CONTROLLER_DELEGATE_H
 

diff --git a/ios/web_view/public/cwv_translation_language.h b/ios/web_view/public/cwv_translation_language.h
index 4138cd5..58808ae1 100644
--- a/ios/web_view/public/cwv_translation_language.h
+++ b/ios/web_view/public/cwv_translation_language.h

@@ -5,9 +5,10 @@
 #ifndef IOS_WEB_VIEW_PUBLIC_CWV_TRANSLATION_LANGUAGE_H
 #define IOS_WEB_VIEW_PUBLIC_CWV_TRANSLATION_LANGUAGE_H
 
-#import <ChromeWebView/cwv_export.h>
 #import <Foundation/Foundation.h>
 
+#import "cwv_export.h"
+
 NS_ASSUME_NONNULL_BEGIN
 
 // Represents a single translatable language.

diff --git a/ios/web_view/public/cwv_translation_policy.h b/ios/web_view/public/cwv_translation_policy.h
index 6cdde9f..0d05069 100644
--- a/ios/web_view/public/cwv_translation_policy.h
+++ b/ios/web_view/public/cwv_translation_policy.h

@@ -5,9 +5,10 @@
 #ifndef IOS_WEB_VIEW_PUBLIC_CWV_TRANSLATION_POLICY_H
 #define IOS_WEB_VIEW_PUBLIC_CWV_TRANSLATION_POLICY_H
 
-#import <ChromeWebView/cwv_export.h>
 #import <Foundation/Foundation.h>
 
+#import "cwv_export.h"
+
 NS_ASSUME_NONNULL_BEGIN
 
 @class CWVTranslationLanguage;

diff --git a/ios/web_view/public/cwv_ui_delegate.h b/ios/web_view/public/cwv_ui_delegate.h
index 7a5f22a..2a94cb6 100644
--- a/ios/web_view/public/cwv_ui_delegate.h
+++ b/ios/web_view/public/cwv_ui_delegate.h

@@ -5,10 +5,11 @@
 #ifndef IOS_WEB_VIEW_PUBLIC_CWV_UI_DELEGATE_H_
 #define IOS_WEB_VIEW_PUBLIC_CWV_UI_DELEGATE_H_
 
-#import <ChromeWebView/cwv_export.h>
 #import <CoreGraphics/CoreGraphics.h>
 #import <UIKit/UIKit.h>
 
+#import "cwv_export.h"
+
 @class CWVHTMLElement;
 @class CWVWebView;
 @class CWVWebViewConfiguration;

diff --git a/ios/web_view/public/cwv_user_content_controller.h b/ios/web_view/public/cwv_user_content_controller.h
index ad25c37e..2003899 100644
--- a/ios/web_view/public/cwv_user_content_controller.h
+++ b/ios/web_view/public/cwv_user_content_controller.h

@@ -5,9 +5,10 @@
 #ifndef IOS_WEB_VIEW_PUBLIC_CWV_USER_CONTENT_CONTROLLER_H_
 #define IOS_WEB_VIEW_PUBLIC_CWV_USER_CONTENT_CONTROLLER_H_
 
-#import <ChromeWebView/cwv_export.h>
 #import <Foundation/Foundation.h>
 
+#import "cwv_export.h"
+
 @class CWVUserScript;
 
 // Allows injecting custom scripts into CWVWebView created with the

diff --git a/ios/web_view/public/cwv_user_script.h b/ios/web_view/public/cwv_user_script.h
index 5ead98c..5b5a574 100644
--- a/ios/web_view/public/cwv_user_script.h
+++ b/ios/web_view/public/cwv_user_script.h

@@ -5,9 +5,10 @@
 #ifndef IOS_WEB_VIEW_PUBLIC_CWV_USER_SCRIPT_H_
 #define IOS_WEB_VIEW_PUBLIC_CWV_USER_SCRIPT_H_
 
-#import <ChromeWebView/cwv_export.h>
 #import <Foundation/Foundation.h>
 
+#import "cwv_export.h"
+
 // User Script to be injected into main frame of CWVWebView after
 // window.document is created, but before other content is loaded (i.e., at the
 // same timing as WKUserScriptInjectionTimeAtDocumentStart).

diff --git a/ios/web_view/public/cwv_web_view.h b/ios/web_view/public/cwv_web_view.h
index 1265614..3fb82c2 100644
--- a/ios/web_view/public/cwv_web_view.h
+++ b/ios/web_view/public/cwv_web_view.h

@@ -4,9 +4,10 @@
 #ifndef IOS_WEB_VIEW_PUBLIC_CWV_WEB_VIEW_H_
 #define IOS_WEB_VIEW_PUBLIC_CWV_WEB_VIEW_H_
 
-#import <ChromeWebView/cwv_export.h>
 #import <UIKit/UIKit.h>
 
+#import "cwv_export.h"
+
 @class CWVScrollView;
 @class CWVTranslationController;
 @class CWVWebViewConfiguration;

diff --git a/ios/web_view/public/cwv_web_view_configuration.h b/ios/web_view/public/cwv_web_view_configuration.h
index f826257..e1de098 100644
--- a/ios/web_view/public/cwv_web_view_configuration.h
+++ b/ios/web_view/public/cwv_web_view_configuration.h

@@ -5,9 +5,10 @@
 #ifndef IOS_WEB_VIEW_PUBLIC_CWV_WEB_VIEW_CONFIGURATION_H_
 #define IOS_WEB_VIEW_PUBLIC_CWV_WEB_VIEW_CONFIGURATION_H_
 
-#import <ChromeWebView/cwv_export.h>
 #import <Foundation/Foundation.h>
 
+#import "cwv_export.h"
+
 @class CWVUserContentController;
 @class CWVWebsiteDataStore;
 

diff --git a/net/test/url_request/url_request_mock_http_job.cc b/net/test/url_request/url_request_mock_http_job.cc
index fb4ec8a..f2fb63b 100644
--- a/net/test/url_request/url_request_mock_http_job.cc
+++ b/net/test/url_request/url_request_mock_http_job.cc

@@ -4,14 +4,13 @@
 
 #include "net/test/url_request/url_request_mock_http_job.h"
 
+#include "base/bind.h"
 #include "base/files/file_util.h"
 #include "base/macros.h"
-#include "base/message_loop/message_loop.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
-#include "base/task_runner_util.h"
-#include "base/threading/sequenced_worker_pool.h"
+#include "base/task_scheduler/post_task.h"
 #include "base/threading/thread_restrictions.h"
 #include "net/base/filename_util.h"
 #include "net/base/net_errors.h"
@@ -34,13 +33,10 @@
   // contents of the file at |base_path|. When |map_all_requests_to_base_path|
   // is false, |base_path| is the file path leading to the root of the directory
   // to use as the root of the HTTP server.
-  MockJobInterceptor(
-      const base::FilePath& base_path,
-      bool map_all_requests_to_base_path,
-      const scoped_refptr<base::SequencedWorkerPool>& worker_pool)
+  MockJobInterceptor(const base::FilePath& base_path,
+                     bool map_all_requests_to_base_path)
       : base_path_(base_path),
-        map_all_requests_to_base_path_(map_all_requests_to_base_path),
-        worker_pool_(worker_pool) {}
+        map_all_requests_to_base_path_(map_all_requests_to_base_path) {}
   ~MockJobInterceptor() override {}
 
   // URLRequestJobFactory::ProtocolHandler implementation
@@ -48,11 +44,8 @@
       URLRequest* request,
       NetworkDelegate* network_delegate) const override {
     return new URLRequestMockHTTPJob(
-        request,
-        network_delegate,
-        map_all_requests_to_base_path_ ? base_path_ : GetOnDiskPath(request),
-        worker_pool_->GetTaskRunnerWithShutdownBehavior(
-            base::SequencedWorkerPool::SKIP_ON_SHUTDOWN));
+        request, network_delegate,
+        map_all_requests_to_base_path_ ? base_path_ : GetOnDiskPath(request));
   }
 
  private:
@@ -70,7 +63,6 @@
 
   const base::FilePath base_path_;
   const bool map_all_requests_to_base_path_;
-  const scoped_refptr<base::SequencedWorkerPool> worker_pool_;
 
   DISALLOW_COPY_AND_ASSIGN(MockJobInterceptor);
 };
@@ -98,15 +90,13 @@
 }  // namespace
 
 // static
-void URLRequestMockHTTPJob::AddUrlHandlers(
-    const base::FilePath& base_path,
-    const scoped_refptr<base::SequencedWorkerPool>& worker_pool) {
+void URLRequestMockHTTPJob::AddUrlHandlers(const base::FilePath& base_path) {
   // Add kMockHostname to URLRequestFilter, for both HTTP and HTTPS.
   URLRequestFilter* filter = URLRequestFilter::GetInstance();
-  filter->AddHostnameInterceptor(
-      "http", kMockHostname, CreateInterceptor(base_path, worker_pool));
+  filter->AddHostnameInterceptor("http", kMockHostname,
+                                 CreateInterceptor(base_path));
   filter->AddHostnameInterceptor("https", kMockHostname,
-                                 CreateInterceptor(base_path, worker_pool));
+                                 CreateInterceptor(base_path));
 }
 
 // static
@@ -121,30 +111,27 @@
 
 // static
 std::unique_ptr<URLRequestInterceptor> URLRequestMockHTTPJob::CreateInterceptor(
-    const base::FilePath& base_path,
-    const scoped_refptr<base::SequencedWorkerPool>& worker_pool) {
+    const base::FilePath& base_path) {
   return std::unique_ptr<URLRequestInterceptor>(
-      new MockJobInterceptor(base_path, false, worker_pool));
+      new MockJobInterceptor(base_path, false));
 }
 
 // static
 std::unique_ptr<URLRequestInterceptor>
 URLRequestMockHTTPJob::CreateInterceptorForSingleFile(
-    const base::FilePath& file,
-    const scoped_refptr<base::SequencedWorkerPool>& worker_pool) {
+    const base::FilePath& file) {
   return std::unique_ptr<URLRequestInterceptor>(
-      new MockJobInterceptor(file, true, worker_pool));
+      new MockJobInterceptor(file, true));
 }
 
-URLRequestMockHTTPJob::URLRequestMockHTTPJob(
-    URLRequest* request,
-    NetworkDelegate* network_delegate,
-    const base::FilePath& file_path,
-    const scoped_refptr<base::TaskRunner>& task_runner)
-    : URLRequestFileJob(request, network_delegate, file_path, task_runner),
-      task_runner_(task_runner),
-      weak_ptr_factory_(this) {
-}
+URLRequestMockHTTPJob::URLRequestMockHTTPJob(URLRequest* request,
+                                             NetworkDelegate* network_delegate,
+                                             const base::FilePath& file_path)
+    : URLRequestFileJob(request,
+                        network_delegate,
+                        file_path,
+                        base::CreateTaskRunnerWithTraits({base::MayBlock()})),
+      weak_ptr_factory_(this) {}
 
 URLRequestMockHTTPJob::~URLRequestMockHTTPJob() {
 }
@@ -169,10 +156,8 @@
 
 // Public virtual version.
 void URLRequestMockHTTPJob::Start() {
-  base::PostTaskAndReplyWithResult(
-      task_runner_.get(),
-      FROM_HERE,
-      base::Bind(&DoFileIO, file_path_),
+  base::PostTaskWithTraitsAndReplyWithResult(
+      FROM_HERE, {base::MayBlock()}, base::Bind(&DoFileIO, file_path_),
       base::Bind(&URLRequestMockHTTPJob::SetHeadersAndStart,
                  weak_ptr_factory_.GetWeakPtr()));
 }

diff --git a/net/test/url_request/url_request_mock_http_job.h b/net/test/url_request/url_request_mock_http_job.h
index 376f64f..f9dc2cf 100644
--- a/net/test/url_request/url_request_mock_http_job.h
+++ b/net/test/url_request/url_request_mock_http_job.h

@@ -13,13 +13,11 @@
 #include <string>
 
 #include "base/macros.h"
-#include "base/memory/ref_counted.h"
 #include "net/url_request/url_request_file_job.h"
 #include "url/gurl.h"
 
 namespace base {
 class FilePath;
-class SequencedWorkerPool;
 }
 
 namespace net {
@@ -30,11 +28,10 @@
 
 class URLRequestMockHTTPJob : public URLRequestFileJob {
  public:
-  // Note that all file IO is done using |worker_pool|.
+  // Note that all file I/O is done using TaskScheduler.
   URLRequestMockHTTPJob(URLRequest* request,
                         NetworkDelegate* network_delegate,
-                        const base::FilePath& file_path,
-                        const scoped_refptr<base::TaskRunner>& task_runner);
+                        const base::FilePath& file_path);
 
   // URLRequestJob overrides.
   void Start() override;
@@ -48,9 +45,7 @@
   void OnReadComplete(net::IOBuffer* buffer, int result) override;
 
   // Adds the testing URLs to the URLRequestFilter, both under HTTP and HTTPS.
-  static void AddUrlHandlers(
-      const base::FilePath& base_path,
-      const scoped_refptr<base::SequencedWorkerPool>& worker_pool);
+  static void AddUrlHandlers(const base::FilePath& base_path);
 
   // Given the path to a file relative to the path passed to AddUrlHandler(),
   // construct a mock URL.
@@ -62,15 +57,13 @@
   // file path leading to the root of the directory to use as the root of the
   // HTTP server.
   static std::unique_ptr<URLRequestInterceptor> CreateInterceptor(
-      const base::FilePath& base_path,
-      const scoped_refptr<base::SequencedWorkerPool>& worker_pool);
+      const base::FilePath& base_path);
 
   // Returns a URLRequestJobFactory::ProtocolHandler that serves
   // URLRequestMockHTTPJob's responding like an HTTP server. It responds to all
   // requests with the contents of |file|.
   static std::unique_ptr<URLRequestInterceptor> CreateInterceptorForSingleFile(
-      const base::FilePath& file,
-      const scoped_refptr<base::SequencedWorkerPool>& worker_pool);
+      const base::FilePath& file);
 
  protected:
   ~URLRequestMockHTTPJob() override;
@@ -81,7 +74,6 @@
 
   std::string raw_headers_;
   int64_t total_received_bytes_ = 0;
-  const scoped_refptr<base::TaskRunner> task_runner_;
 
   base::WeakPtrFactory<URLRequestMockHTTPJob> weak_ptr_factory_;
 

diff --git a/sdch/BUILD.gn b/sdch/BUILD.gn
index 1cab0b3..76bbbd4 100644
--- a/sdch/BUILD.gn
+++ b/sdch/BUILD.gn

@@ -59,7 +59,7 @@
     "//third_party/zlib",
   ]
 
-  if (is_linux || is_android) {
+  if (is_linux || is_android || is_fuchsia) {
     include_dirs = [ "linux" ]
   } else if (is_ios) {
     include_dirs = [ "ios" ]

diff --git a/testing/scripts/run_under_valgrind.py b/testing/scripts/run_under_valgrind.py
deleted file mode 100755
index 789aa55..0000000
--- a/testing/scripts/run_under_valgrind.py
+++ /dev/null

@@ -1,38 +0,0 @@
-#!/usr/bin/env python
-# Copyright 2016 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-import json
-import os
-import sys
-
-
-import common
-
-
-def main_run(args):
-  rc = common.run_runtest(args, [
-      os.path.join(common.SRC_DIR, 'tools', 'valgrind', 'chrome_tests.sh'),
-      '--tool', 'memcheck',
-      '--build-dir', os.path.join(common.SRC_DIR, 'out', args.build_config_fs),
-    ] + args.args)
-
-  json.dump({
-      'valid': True,
-      'failures': ['failed'] if rc else []
-  }, args.output)
-
-  return rc
-
-
-def main_compile_targets(args):
-  json.dump(['$name'], args.output)
-
-
-if __name__ == '__main__':
-  funcs = {
-    'run': main_run,
-    'compile_targets': main_compile_targets,
-  }
-  sys.exit(common.run_script(sys.argv[1:], funcs))

diff --git a/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG b/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG
index 0ac02b2..d5372222 100644
--- a/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG
+++ b/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG

@@ -40,13 +40,8 @@
 crbug.com/591099 accessibility/aria-none-role.html [ Failure ]
 crbug.com/591099 accessibility/aria-option-role.html [ Failure ]
 crbug.com/591099 accessibility/aria-orientation.html [ Failure ]
-crbug.com/591099 accessibility/aria-owns-dynamic-changes.html [ Crash ]
-crbug.com/591099 accessibility/aria-owns-ignores-leafs.html [ Crash Failure ]
-crbug.com/591099 accessibility/aria-owns-sends-notification.html [ Crash ]
-crbug.com/591099 accessibility/aria-owns.html [ Crash ]
 crbug.com/591099 accessibility/aria-presentational-role.html [ Failure ]
 crbug.com/591099 accessibility/aria-readonly.html [ Failure ]
-crbug.com/591099 accessibility/aria-relations-should-ignore-hidden-targets.html [ Crash ]
 crbug.com/591099 accessibility/aria-roles.html [ Crash Failure ]
 crbug.com/591099 accessibility/aria-scrollbar-role.html [ Failure ]
 crbug.com/591099 accessibility/aria-setsize-posinset.html [ Failure ]
@@ -55,7 +50,6 @@
 crbug.com/591099 accessibility/aria-tables.html [ Failure ]
 crbug.com/591099 accessibility/aria-text-role.html [ Failure ]
 crbug.com/591099 accessibility/aria-toggle-button-with-title.html [ Failure ]
-crbug.com/591099 accessibility/aria-tree.html [ Crash ]
 crbug.com/591099 accessibility/aria-used-on-image-maps.html [ Failure ]
 crbug.com/591099 accessibility/bounds-calc.html [ Crash ]
 crbug.com/591099 accessibility/br-element-has-correct-title.html [ Failure ]
@@ -89,7 +83,6 @@
 crbug.com/591099 accessibility/description-calc-aria-describedby.html [ Crash ]
 crbug.com/591099 accessibility/description-calc-inputs.html [ Crash ]
 crbug.com/591099 accessibility/description-calc-native-markup-input-buttons.html [ Crash ]
-crbug.com/591099 accessibility/description-calc-summary.html [ Crash ]
 crbug.com/591099 accessibility/dimensions-include-descendants.html [ Failure ]
 crbug.com/591099 accessibility/disabled-controls-not-focusable.html [ Crash ]
 crbug.com/591099 accessibility/display-inline-block-crash.html [ Failure ]
@@ -99,7 +92,7 @@
 crbug.com/591099 accessibility/dl-role.html [ Failure ]
 crbug.com/591099 accessibility/duplicate-child-nodes.html [ Failure ]
 crbug.com/591099 accessibility/element-role-mapping-focusable.html [ Crash Failure ]
-crbug.com/591099 accessibility/element-role-mapping-normal.html [ Crash Failure ]
+crbug.com/591099 accessibility/element-role-mapping-normal.html [ Crash Failure Timeout ]
 crbug.com/591099 accessibility/ellipsis-text.html [ Failure ]
 crbug.com/591099 accessibility/file-upload-button-with-axpress.html [ Crash Failure ]
 crbug.com/591099 accessibility/first-letter-text-transform-causes-crash.html [ Failure ]
@@ -164,17 +157,14 @@
 crbug.com/591099 accessibility/name-calc-aria-labelledby.html [ Crash ]
 crbug.com/591099 accessibility/name-calc-aria-owns.html [ Crash ]
 crbug.com/591099 accessibility/name-calc-figure.html [ Crash ]
-crbug.com/591099 accessibility/name-calc-group-inside-treeitem.html [ Crash ]
 crbug.com/591099 accessibility/name-calc-img.html [ Crash ]
 crbug.com/591099 accessibility/name-calc-inputs.html [ Crash ]
 crbug.com/591099 accessibility/name-calc-native-markup-buttons.html [ Crash ]
 crbug.com/591099 accessibility/name-calc-native-markup-input-buttons.html [ Crash ]
 crbug.com/591099 accessibility/name-calc-presentational.html [ Crash ]
-crbug.com/591099 accessibility/name-calc-summary.html [ Crash ]
 crbug.com/591099 accessibility/name-calc-svg.html [ Crash ]
 crbug.com/591099 accessibility/name-calc-visibility.html [ Crash ]
 crbug.com/591099 accessibility/nested-layout-crash.html [ Crash Failure ]
-crbug.com/591099 accessibility/nochildren-elements.html [ Crash ]
 crbug.com/591099 accessibility/non-native-image-crash.html [ Failure ]
 crbug.com/591099 accessibility/not-ignore-landmark-roles.html [ Failure ]
 crbug.com/591099 accessibility/notification-listeners.html [ Failure ]
@@ -256,7 +246,6 @@
 crbug.com/591099 animations/composition/caret-color-composition.html [ Crash ]
 crbug.com/591099 animations/composition/stroke-dasharray-composition.html [ Crash ]
 crbug.com/591099 animations/computed-style.html [ Failure ]
-crbug.com/591099 animations/cross-fade-list-style-image.html [ Crash ]
 crbug.com/591099 animations/css-animation-overrides-svg-presentation-attribute-animation.html [ Crash ]
 crbug.com/591099 animations/delay-start-event.html [ Failure ]
 crbug.com/591099 animations/display-change-does-not-terminate-animation.html [ Crash ]
@@ -296,7 +285,6 @@
 crbug.com/591099 animations/interpolation/font-weight-interpolation.html [ Crash ]
 crbug.com/591099 animations/interpolation/height-interpolation.html [ Crash ]
 crbug.com/591099 animations/interpolation/line-height-interpolation.html [ Crash ]
-crbug.com/591099 animations/interpolation/list-style-image-interpolation.html [ Crash ]
 crbug.com/591099 animations/interpolation/margin-interpolation.html [ Crash ]
 crbug.com/591099 animations/interpolation/max-height-interpolation.html [ Crash ]
 crbug.com/591099 animations/interpolation/min-height-interpolation.html [ Crash ]
@@ -545,798 +533,10 @@
 crbug.com/591099 canvas/feimage-with-foreignobject-taint-canvas.html [ Crash ]
 crbug.com/591099 canvas/image-with-foreignobject-taint-canvas-2.html [ Crash ]
 crbug.com/591099 canvas/image-with-foreignobject-taint-canvas.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.canvas.readonly.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.canvas.reference.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.clearRect+fillRect.alpha0.5.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.clearRect+fillRect.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.clearRect.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.clearRect.clip.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.clearRect.globalalpha.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.clearRect.globalcomposite.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.clearRect.negative.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.clearRect.nonfinite.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.clearRect.path.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.clearRect.shadow.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.clearRect.transform.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.clearRect.zero.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.canvas.copy.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.canvas.destination-atop.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.canvas.destination-in.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.canvas.destination-out.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.canvas.destination-over.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.canvas.lighter.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.canvas.source-atop.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.canvas.source-in.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.canvas.source-out.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.canvas.source-over.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.canvas.xor.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.clip.copy.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.clip.destination-atop.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.clip.destination-in.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.clip.destination-out.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.clip.destination-over.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.clip.lighter.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.clip.source-atop.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.clip.source-in.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.clip.source-out.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.clip.source-over.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.clip.xor.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.globalAlpha.canvas.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.globalAlpha.canvaspattern.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.globalAlpha.default.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.globalAlpha.fill.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.globalAlpha.image.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.globalAlpha.imagepattern.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.globalAlpha.invalid.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.globalAlpha.range.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.image.copy.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.image.destination-atop.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.image.destination-in.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.image.destination-out.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.image.destination-over.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.image.lighter.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.image.source-atop.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.image.source-in.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.image.source-out.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.image.source-over.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.image.xor.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.operation.casesensitive.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.operation.clear.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.operation.darker.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.operation.default.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.operation.foobar.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.operation.get.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.operation.highlight.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.operation.nullsuffix.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.operation.over.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.operation.unrecognised.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.solid.copy.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.solid.destination-atop.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.solid.destination-in.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.solid.destination-out.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.solid.destination-over.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.solid.lighter.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.solid.source-atop.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.solid.source-in.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.solid.source-out.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.solid.source-over.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.solid.xor.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.transparent.copy.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.transparent.destination-atop.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.transparent.destination-in.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.transparent.destination-out.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.transparent.destination-over.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.transparent.lighter.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.transparent.source-atop.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.transparent.source-in.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.transparent.source-out.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.transparent.source-over.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.transparent.xor.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.uncovered.fill.copy.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.uncovered.fill.destination-atop.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.uncovered.fill.destination-in.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.uncovered.fill.source-in.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.uncovered.fill.source-out.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.uncovered.image.copy.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.uncovered.image.destination-atop.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.uncovered.image.destination-in.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.uncovered.image.source-in.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.uncovered.image.source-out.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.uncovered.nocontext.copy.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.uncovered.nocontext.destination-atop.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.uncovered.nocontext.destination-in.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.uncovered.nocontext.source-in.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.uncovered.nocontext.source-out.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.uncovered.pattern.copy.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.uncovered.pattern.destination-atop.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.uncovered.pattern.destination-in.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.uncovered.pattern.source-in.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.composite.uncovered.pattern.source-out.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.coordinatespace.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.3arg.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.5arg.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.9arg.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.9arg.destpos.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.9arg.destsize.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.9arg.sourcepos.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.9arg.sourcesize.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.alpha.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.animated.apng.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.animated.gif.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.animated.poster.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.broken.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.canvas.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.clip.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.composite.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.floatsource.html [ Crash ]
 crbug.com/591099 canvas/philip/tests/2d.drawImage.image.incomplete.empty.html [ Crash Pass ]
 crbug.com/591099 canvas/philip/tests/2d.drawImage.image.incomplete.omitted.html [ Crash Pass ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.incomplete.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.negativeSourceHeight.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.negativeSourceHeight2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.negativeSourceHeightAndWidth.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.negativedest.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.negativedir.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.negativesource.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.nonfinite.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.nowrap.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.null.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.outsidesource.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.path.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.self.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.self.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.transform.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.wrongtype.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.zerocanvas.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.drawImage.zerosource.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillRect.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillRect.clip.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillRect.negative.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillRect.nonfinite.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillRect.path.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillRect.shadow.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillRect.transform.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillRect.zero.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.default.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.get.semitransparent.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.get.solid.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.get.transparent.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.invalidstring.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.invalidtype.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.current.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.current.changed.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.current.removed.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.hex3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.hex6.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.hsl-1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.hsl-2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.hsl-3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.hsl-4.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.hsl-5.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.hsl-6.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.hsl-clamp-1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.hsl-clamp-2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.hsl-clamp-3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.hsl-clamp-4.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.hsla-1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.hsla-2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.hsla-clamp-1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.hsla-clamp-2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.hsla-clamp-3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.hsla-clamp-4.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.hsla-clamp-5.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.hsla-clamp-6.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.html4.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.hex1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.hex2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.hex3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.hex5.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.hex6.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.hex7.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.hsl-1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.hsl-2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.hsl-3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.hsl-4.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.hsl-5.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.hsl-6.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.hsla-1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.hsla-2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.name-1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.name-2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.name-3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.name-4.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.rgb-1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.rgb-2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.rgb-3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.rgb-4.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.rgb-5.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.rgb-6.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.rgb-7.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.rgba-1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.rgba-2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.rgba-3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.rgba-4.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.rgba-5.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.rgba-6.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.invalid.rgba-7.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.rgb-clamp-1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.rgb-clamp-2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.rgb-clamp-3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.rgb-clamp-4.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.rgb-clamp-5.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.rgb-eof.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.rgb-num.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.rgb-percent.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.rgba-clamp-1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.rgba-clamp-2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.rgba-eof.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.rgba-num-1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.rgba-num-2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.rgba-percent.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.rgba-solid-1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.rgba-solid-2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.rgba-solid-3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.rgba-solid-4.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.svg-1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.svg-2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.system.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.transparent-1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.fillStyle.parse.transparent-2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.getcontext.exists.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.getcontext.extraargs.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.getcontext.shared.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.getcontext.unique.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.empty.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.interpolate.alpha.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.interpolate.colour.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.interpolate.colouralpha.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.interpolate.multiple.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.interpolate.outside.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.interpolate.overlap.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.interpolate.overlap2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.interpolate.solid.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.interpolate.vertical.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.interpolate.zerosize.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.linear.transform.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.linear.transform.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.linear.transform.3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.object.compare.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.object.crosscanvas.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.object.current.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.object.invalidcolour.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.object.return.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.object.update.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.radial.cone.behind.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.radial.cone.beside.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.radial.cone.bottom.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.radial.cone.cylinder.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.radial.cone.front.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.radial.cone.shape1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.radial.cone.shape2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.radial.cone.top.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.radial.equal.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.radial.inside1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.radial.inside2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.radial.inside3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.radial.negative.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.radial.outside1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.radial.outside2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.radial.outside3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.radial.touch1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.radial.touch2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.radial.touch3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.radial.transform.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.radial.transform.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.gradient.radial.transform.3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.create1.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.create1.initial.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.create1.type.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.create1.zero.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.create2.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.create2.initial.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.create2.large.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.create2.negative.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.create2.round.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.create2.tiny.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.create2.type.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.create2.zero.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.get.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.get.clamp.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.get.length.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.get.nonpremul.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.get.order.alpha.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.get.order.cols.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.get.order.rgb.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.get.order.rows.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.get.range.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.get.source.negative.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.get.source.outside.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.get.source.size.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.get.tiny.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.get.type.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.get.unaffected.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.get.zero.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.object.clamp.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.object.nan.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.object.properties.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.object.readonly.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.object.round.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.object.set.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.object.string.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.object.undefined.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.put.alpha.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.put.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.put.clip.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.put.created.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.put.cross.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.put.dirty.negative.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.put.dirty.outside.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.put.dirty.rect1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.put.dirty.rect2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.put.dirty.zero.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.put.modified.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.put.null.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.put.path.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.put.unaffected.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.put.unchanged.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.imageData.put.wrongtype.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.cap.butt.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.cap.closed.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.cap.invalid.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.cap.open.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.cap.round.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.cap.square.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.cap.valid.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.cross.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.defaults.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.join.bevel.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.join.closed.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.join.invalid.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.join.miter.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.join.open.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.join.parallel.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.join.round.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.join.valid.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.miter.acute.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.miter.exceeded.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.miter.invalid.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.miter.lineedge.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.miter.obtuse.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.miter.rightangle.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.miter.valid.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.miter.within.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.union.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.width.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.width.invalid.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.width.scaledefault.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.width.transformed.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.line.width.valid.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.missingargs.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.angle.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.angle.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.angle.3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.angle.4.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.angle.5.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.angle.6.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.default.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.empty.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.end.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.negative.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.nonempty.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.nonfinite.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.scale.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.scale.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.selfintersect.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.selfintersect.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.shape.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.shape.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.shape.3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.shape.4.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.shape.5.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.twopie.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.twopie.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.twopie.3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.twopie.4.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.zero.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.zero.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arc.zeroradius.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arcTo.coincide.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arcTo.coincide.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arcTo.collinear.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arcTo.collinear.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arcTo.collinear.3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arcTo.ensuresubpath.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arcTo.ensuresubpath.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arcTo.negative.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arcTo.nonfinite.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arcTo.scale.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arcTo.shape.curve1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arcTo.shape.curve2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arcTo.shape.end.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arcTo.shape.start.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arcTo.transformation.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arcTo.zero.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.arcTo.zero.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.beginPath.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.bezierCurveTo.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.bezierCurveTo.ensuresubpath.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.bezierCurveTo.ensuresubpath.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.bezierCurveTo.nonfinite.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.bezierCurveTo.scaled.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.bezierCurveTo.shape.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.clip.basic.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.clip.basic.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.clip.empty.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.clip.intersect.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.clip.unaffected.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.clip.winding.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.clip.winding.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.closePath.empty.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.closePath.newline.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.closePath.nextpoint.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.fill.closed.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.fill.closed.unaffected.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.fill.overlap.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.fill.winding.add.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.fill.winding.subtract.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.fill.winding.subtract.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.fill.winding.subtract.3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.initial.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.isPointInPath.arc.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.isPointInPath.basic.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.isPointInPath.basic.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.isPointInPath.bezier.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.isPointInPath.bigarc.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.isPointInPath.edge.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.isPointInPath.empty.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.isPointInPath.nonfinite.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.isPointInPath.outside.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.isPointInPath.subpath.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.isPointInPath.transform.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.isPointInPath.transform.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.isPointInPath.transform.3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.isPointInPath.unclosed.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.isPointInPath.winding.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.lineTo.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.lineTo.ensuresubpath.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.lineTo.ensuresubpath.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.lineTo.nextpoint.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.lineTo.nonfinite.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.moveTo.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.moveTo.multiple.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.moveTo.newsubpath.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.moveTo.nonfinite.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.quadraticCurveTo.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.quadraticCurveTo.ensuresubpath.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.quadraticCurveTo.ensuresubpath.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.quadraticCurveTo.nonfinite.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.quadraticCurveTo.scaled.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.quadraticCurveTo.shape.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.rect.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.rect.closed.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.rect.end.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.rect.end.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.rect.negative.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.rect.newsubpath.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.rect.nonfinite.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.rect.selfintersect.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.rect.winding.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.rect.zero.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.rect.zero.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.rect.zero.3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.rect.zero.4.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.rect.zero.5.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.rect.zero.6.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.stroke.empty.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.stroke.overlap.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.stroke.prune.arc.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.stroke.prune.closed.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.stroke.prune.corner.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.stroke.prune.curve.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.stroke.prune.line.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.stroke.prune.rect.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.stroke.scale1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.stroke.scale2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.stroke.skew.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.stroke.unaffected.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.stroke.union.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.transformation.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.transformation.changing.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.path.transformation.multiple.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.animated.gif.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.basic.canvas.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.basic.image.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.basic.nocontext.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.basic.type.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.basic.zerocanvas.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.crosscanvas.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.image.broken.html [ Crash ]
 crbug.com/591099 canvas/philip/tests/2d.pattern.image.incomplete.empty.html [ Crash Pass ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.image.incomplete.html [ Crash ]
 crbug.com/591099 canvas/philip/tests/2d.pattern.image.incomplete.omitted.html [ Crash Pass ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.image.null.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.image.string.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.image.undefined.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.modify.canvas1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.modify.canvas2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.modify.image1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.modify.image2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.paint.norepeat.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.paint.norepeat.coord1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.paint.norepeat.coord2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.paint.norepeat.coord3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.paint.norepeat.outside.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.paint.orientation.canvas.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.paint.orientation.image.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.paint.repeat.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.paint.repeat.coord1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.paint.repeat.coord2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.paint.repeat.coord3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.paint.repeat.outside.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.paint.repeatx.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.paint.repeatx.coord1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.paint.repeatx.outside.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.paint.repeaty.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.paint.repeaty.coord1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.paint.repeaty.outside.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.repeat.case.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.repeat.empty.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.repeat.null.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.repeat.nullsuffix.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.repeat.undefined.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.pattern.repeat.unrecognised.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.scaled.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.alpha.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.alpha.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.alpha.3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.alpha.4.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.alpha.5.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.attributes.shadowBlur.initial.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.attributes.shadowBlur.invalid.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.attributes.shadowBlur.valid.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.attributes.shadowColor.initial.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.attributes.shadowColor.invalid.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.attributes.shadowColor.valid.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.attributes.shadowOffset.initial.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.attributes.shadowOffset.invalid.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.attributes.shadowOffset.valid.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.blur.high.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.blur.low.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.canvas.alpha.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.canvas.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.canvas.transparent.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.canvas.transparent.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.clip.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.clip.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.clip.3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.composite.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.composite.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.composite.3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.enable.blur.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.enable.off.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.enable.off.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.enable.x.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.enable.y.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.gradient.alpha.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.gradient.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.gradient.transparent.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.gradient.transparent.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.image.alpha.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.image.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.image.scale.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.image.section.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.image.transparent.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.image.transparent.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.offset.negativeX.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.offset.negativeY.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.offset.positiveX.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.offset.positiveY.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.outside.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.pattern.alpha.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.pattern.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.pattern.transparent.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.pattern.transparent.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.stroke.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.stroke.cap.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.stroke.cap.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.stroke.join.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.stroke.join.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.stroke.join.3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.transform.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.shadow.transform.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.state.saverestore.bitmap.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.state.saverestore.clip.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.state.saverestore.fillStyle.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.state.saverestore.font.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.state.saverestore.globalAlpha.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.state.saverestore.globalCompositeOperation.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.state.saverestore.lineCap.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.state.saverestore.lineJoin.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.state.saverestore.lineWidth.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.state.saverestore.miterLimit.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.state.saverestore.path.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.state.saverestore.shadowBlur.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.state.saverestore.shadowColor.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.state.saverestore.shadowOffsetX.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.state.saverestore.shadowOffsetY.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.state.saverestore.stack.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.state.saverestore.stackdepth.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.state.saverestore.strokeStyle.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.state.saverestore.textAlign.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.state.saverestore.textBaseline.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.state.saverestore.transformation.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.state.saverestore.underflow.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.strokeRect.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.strokeRect.clip.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.strokeRect.globalalpha.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.strokeRect.globalcomposite.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.strokeRect.negative.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.strokeRect.nonfinite.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.strokeRect.path.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.strokeRect.shadow.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.strokeRect.transform.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.strokeRect.zero.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.strokeRect.zero.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.strokeRect.zero.3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.strokeRect.zero.4.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.strokeRect.zero.5.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.strokeStyle.default.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text-custom-font-load-crash.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.align.default.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.align.invalid.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.align.valid.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.baseline.default.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.baseline.invalid.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.baseline.valid.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.align.center.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.align.end.ltr.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.align.end.rtl.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.align.left.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.align.right.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.align.start.ltr.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.align.start.rtl.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.baseline.alphabetic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.baseline.bottom.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.baseline.hanging.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.baseline.ideographic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.baseline.middle.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.baseline.top.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.fill.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.fill.maxWidth.bound.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.fill.maxWidth.fontface.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.fill.maxWidth.large.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.fill.maxWidth.small.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.fill.maxWidth.zero.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.fill.rtl.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.fill.unaffected.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.fontface.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.fontface.notinpage.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.fontface.repeat.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.kern.consistent.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.space.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.space.collapse.end.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.space.collapse.nonspace.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.space.collapse.other.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.space.collapse.space.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.space.collapse.start.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.stroke.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.draw.stroke.unaffected.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.font.default.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.font.parse.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.font.parse.complex.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.font.parse.invalid.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.font.parse.size.percentage.default.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.font.parse.size.percentage.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.font.parse.system.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.font.rem.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.measure.width.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.measure.width.empty.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.text.measure.width.space.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.transformation.order.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.transformation.rotate.direction.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.transformation.rotate.nonfinite.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.transformation.rotate.radians.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.transformation.rotate.wrap.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.transformation.rotate.wrapnegative.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.transformation.rotate.zero.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.transformation.scale.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.transformation.scale.large.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.transformation.scale.multiple.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.transformation.scale.negative.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.transformation.scale.nonfinite.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.transformation.scale.zero.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.transformation.setTransform.multiple.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.transformation.setTransform.nonfinite.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.transformation.setTransform.skewed.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.transformation.transform.identity.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.transformation.transform.multiply.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.transformation.transform.nonfinite.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.transformation.transform.skewed.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.transformation.translate.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.transformation.translate.nonfinite.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/2d.voidreturn.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/context.casesensitive.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/context.emptystring.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/context.unrecognised.badname.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/context.unrecognised.badsuffix.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/context.unrecognised.nullsuffix.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/context.unrecognised.unicode.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/fallback.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/fallback.multiple.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/fallback.nested.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/initial.colour.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/initial.reset.2dstate.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/initial.reset.clip.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/initial.reset.different.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/initial.reset.gradient.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/initial.reset.path.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/initial.reset.pattern.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/initial.reset.same.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/initial.reset.transform.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/security.dataURI.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.default.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.get.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.idl.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.idl.set.zero.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.parse.decimal.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.parse.em.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.parse.empty.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.parse.exp.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.parse.hex.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.parse.junk.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.parse.minus.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.parse.octal.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.parse.onlyspace.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.parse.percent.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.parse.plus.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.parse.space.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.parse.trailingjunk.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.parse.whitespace.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.parse.zero.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.reflect.setcontent.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.reflect.setidl.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.reflect.setidlzero.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.removed.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.set.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.setAttribute.decimal.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.setAttribute.em.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.setAttribute.empty.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.setAttribute.exp.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.setAttribute.hex.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.setAttribute.junk.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.setAttribute.minus.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.setAttribute.octal.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.setAttribute.onlyspace.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.setAttribute.percent.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.setAttribute.plus.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.setAttribute.space.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.setAttribute.trailingjunk.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.setAttribute.whitespace.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.setAttribute.zero.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/size.attributes.style.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/toDataURL.arguments.1.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/toDataURL.arguments.2.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/toDataURL.arguments.3.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/toDataURL.bogustype.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/toDataURL.default.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/toDataURL.jpeg.alpha.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/toDataURL.jpeg.primarycolours.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/toDataURL.jpeg.quality.basic.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/toDataURL.jpeg.quality.notnumber.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/toDataURL.jpeg.quality.outsiderange.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/toDataURL.lowercase.ascii.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/toDataURL.lowercase.unicode.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/toDataURL.nocontext.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/toDataURL.png.complexcolours.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/toDataURL.png.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/toDataURL.png.primarycolours.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/toDataURL.unrecognised.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/toDataURL.zerosize.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/type.exists.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/type.extend.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/type.name.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/type.prototype.html [ Crash ]
-crbug.com/591099 canvas/philip/tests/type.replace.html [ Crash ]
 crbug.com/591099 compositing/3d-corners.html [ Failure ]
 crbug.com/591099 compositing/absolute-inside-out-of-view-fixed.html [ Failure Pass ]
 crbug.com/591099 compositing/animation/busy-indicator.html [ Failure ]
@@ -1367,7 +567,6 @@
 crbug.com/591099 compositing/contents-opaque/layer-opacity.html [ Failure Pass ]
 crbug.com/591099 compositing/contents-opaque/layer-transform.html [ Failure Pass ]
 crbug.com/591099 compositing/contents-opaque/overflow-hidden-child-layers.html [ Failure ]
-crbug.com/591099 compositing/contents-opaque/visibility-hidden.html [ Crash ]
 crbug.com/591099 compositing/culling/clear-fixed-iframe.html [ Failure ]
 crbug.com/591099 compositing/culling/scrolled-within-boxshadow.html [ Failure Pass ]
 crbug.com/591099 compositing/culling/translated-boxshadow.html [ Failure Pass ]
@@ -1574,7 +773,6 @@
 crbug.com/591099 compositing/overflow/content-gains-scrollbars.html [ Failure ]
 crbug.com/591099 compositing/overflow/content-loses-scrollbars.html [ Failure ]
 crbug.com/591099 compositing/overflow/descendant-with-clip-path.html [ Failure Pass ]
-crbug.com/591099 compositing/overflow/do-not-paint-outline-into-composited-scrolling-contents.html [ Crash Failure ]
 crbug.com/591099 compositing/overflow/fixed-position-ancestor-clip.html [ Failure ]
 crbug.com/591099 compositing/overflow/fractional-sized-scrolling-layer.html [ Failure ]
 crbug.com/591099 compositing/overflow/grandchild-composited-with-border-radius-ancestor.html [ Failure ]
@@ -1648,7 +846,6 @@
 crbug.com/591099 compositing/plugins/webplugin-reflection.html [ Failure Pass ]
 crbug.com/591099 compositing/reflections/animation-inside-reflection.html [ Failure ]
 crbug.com/591099 compositing/reflections/backface-hidden-reflection.html [ Failure Pass ]
-crbug.com/591099 compositing/reflections/become-simple-composited-reflection.html [ Crash ]
 crbug.com/591099 compositing/reflections/compositing-change-inside-reflection.html [ Failure ]
 crbug.com/591099 compositing/reflections/deeply-nested-reflections.html [ Failure ]
 crbug.com/591099 compositing/reflections/enable-disable-compositing-reflection.html [ Failure Pass ]
@@ -2045,9 +1242,7 @@
 crbug.com/591099 css2.1/20110323/margin-collapse-012.htm [ Failure ]
 crbug.com/591099 css2.1/20110323/outline-color-001.htm [ Failure Pass ]
 crbug.com/591099 css2.1/20110323/outline-color-applies-to-008.htm [ Failure ]
-crbug.com/591099 css2.1/20110323/outline-color-applies-to-010.htm [ Crash ]
 crbug.com/591099 css2.1/20110323/outline-color-applies-to-014.htm [ Failure Pass ]
-crbug.com/591099 css2.1/20110323/overflow-applies-to-010.htm [ Crash Failure ]
 crbug.com/591099 css2.1/20110323/table-caption-001.htm [ Failure Pass ]
 crbug.com/591099 css2.1/20110323/table-caption-002.htm [ Crash Failure Pass ]
 crbug.com/591099 css2.1/20110323/table-caption-horizontal-alignment-001.htm [ Failure Pass ]
@@ -2541,7 +1736,6 @@
 crbug.com/591099 css3/background/background-color-gradient-alignment.html [ Failure Pass ]
 crbug.com/591099 css3/background/background-large-position-and-size-remains-stable.html [ Failure ]
 crbug.com/591099 css3/background/background-positioning-area-vrl.html [ Failure ]
-crbug.com/591099 css3/bdi-element.html [ Crash ]
 crbug.com/591099 css3/blending/background-blend-mode-crossfade-image-gradient.html [ Failure ]
 crbug.com/591099 css3/blending/background-blend-mode-data-uri-svg-image.html [ Failure Pass ]
 crbug.com/591099 css3/blending/background-blend-mode-default-value.html [ Failure Pass ]
@@ -2613,7 +1807,6 @@
 crbug.com/591099 css3/filters/blur-filter-page-scroll-parents.html [ Failure Pass ]
 crbug.com/591099 css3/filters/blur-filter-page-scroll-self.html [ Failure Pass ]
 crbug.com/591099 css3/filters/blur-filter-page-scroll.html [ Failure Pass ]
-crbug.com/591099 css3/filters/bug419429.html [ Crash ]
 crbug.com/591099 css3/filters/composited-during-animation.html [ Crash ]
 crbug.com/591099 css3/filters/composited-during-transition-layertree.html [ Failure ]
 crbug.com/591099 css3/filters/composited-layer-bounds-after-sw-blur-animation.html [ Failure Pass ]
@@ -2691,7 +1884,6 @@
 crbug.com/591099 css3/flexbox/auto-height-column-with-border-and-padding.html [ Failure ]
 crbug.com/591099 css3/flexbox/auto-margins.html [ Failure ]
 crbug.com/591099 css3/flexbox/box-orient-button.html [ Crash ]
-crbug.com/591099 css3/flexbox/bug527039.html [ Crash ]
 crbug.com/591099 css3/flexbox/bug633212.html [ Crash ]
 crbug.com/591099 css3/flexbox/button.html [ Failure ]
 crbug.com/591099 css3/flexbox/change-flexitem-into-abspos.html [ Failure ]
@@ -2740,7 +1932,6 @@
 crbug.com/591099 css3/flexbox/min-size-auto.html [ Crash ]
 crbug.com/591099 css3/flexbox/multiline-align-self.html [ Failure ]
 crbug.com/591099 css3/flexbox/multiline-reverse-wrap-baseline.html [ Failure ]
-crbug.com/591099 css3/flexbox/multiline-shrink-to-fit.html [ Crash ]
 crbug.com/591099 css3/flexbox/negative-flex-rounding-assert.html [ Failure ]
 crbug.com/591099 css3/flexbox/nested-stretch.html [ Failure ]
 crbug.com/591099 css3/flexbox/overflow-auto-dynamic-changes-abspos.html [ Failure ]
@@ -2785,7 +1976,6 @@
 crbug.com/591099 css3/masking/mask-repeat-space-content.html [ Failure ]
 crbug.com/591099 css3/masking/mask-repeat-space-padding.html [ Failure ]
 crbug.com/591099 css3/motion-path/combine-anchor-transform.html [ Failure Pass ]
-crbug.com/591099 css3/motion-path/offset-anchor-rotation.html [ Crash ]
 crbug.com/591099 css3/motion-path/path-establishes-stacking-context.html [ Failure Pass ]
 crbug.com/591099 css3/parsing-css3-nthchild.html [ Failure ]
 crbug.com/591099 css3/selectors3/html/css3-modsel-1.html [ Crash Failure ]
@@ -3626,10 +2816,8 @@
 crbug.com/591099 dom/domparsing/xmlserializer-attribute-namespace.html [ Failure ]
 crbug.com/591099 dom/domparsing/xmlserializer-attribute-ns-prefix.html [ Failure ]
 crbug.com/591099 dom/domparsing/xmlserializer-attribute-special-namespaces.html [ Failure ]
-crbug.com/591099 dom/domparsing/xmlserializer-doctype.html [ Crash ]
 crbug.com/591099 dom/domparsing/xmlserializer-doctype2.html [ Failure ]
 crbug.com/591099 dom/domparsing/xmlserializer-double-xmlns.html [ Failure ]
-crbug.com/591099 dom/legacy_dom_conformance/html/level1/core/li-type-supported-case-insensitive.html [ Crash ]
 crbug.com/591099 dom/legacy_dom_conformance/html/level2/html/AppletsCollection.html [ Crash ]
 crbug.com/591099 dom/legacy_dom_conformance/html/level2/html/HTMLDocument01.html [ Crash Pass ]
 crbug.com/591099 dom/legacy_dom_conformance/html/level2/html/HTMLDocument02.html [ Crash Pass ]
@@ -4023,11 +3211,9 @@
 crbug.com/591099 dom/legacy_dom_conformance/xhtml/level2/html/HTMLIFrameElement10.xhtml [ Crash Pass ]
 crbug.com/591099 dom/legacy_dom_conformance/xhtml/level2/html/HTMLIFrameElement11.xhtml [ Crash ]
 crbug.com/591099 dom/legacy_dom_conformance/xhtml/level2/html/HTMLImageElement01.xhtml [ Crash ]
-crbug.com/591099 dom/legacy_dom_conformance/xhtml/level2/html/HTMLImageElement02.xhtml [ Crash ]
 crbug.com/591099 dom/legacy_dom_conformance/xhtml/level2/html/HTMLImageElement03.xhtml [ Crash Pass ]
 crbug.com/591099 dom/legacy_dom_conformance/xhtml/level2/html/HTMLImageElement04.xhtml [ Crash Pass ]
 crbug.com/591099 dom/legacy_dom_conformance/xhtml/level2/html/HTMLImageElement05.xhtml [ Crash ]
-crbug.com/591099 dom/legacy_dom_conformance/xhtml/level2/html/HTMLImageElement06.xhtml [ Crash ]
 crbug.com/591099 dom/legacy_dom_conformance/xhtml/level2/html/HTMLImageElement08.xhtml [ Crash Pass ]
 crbug.com/591099 dom/legacy_dom_conformance/xhtml/level2/html/HTMLImageElement09.xhtml [ Crash Pass ]
 crbug.com/591099 dom/legacy_dom_conformance/xhtml/level2/html/HTMLImageElement12.xhtml [ Crash ]
@@ -4089,7 +3275,6 @@
 crbug.com/591099 editing/caret/caret-color.html [ Failure ]
 crbug.com/591099 editing/caret/caret-direction-auto.html [ Crash Failure ]
 crbug.com/591099 editing/caret/caret-height.html [ Failure ]
-crbug.com/591099 editing/caret/caret-is-hidden-when-no-focus.html [ Crash ]
 crbug.com/591099 editing/caret/caret-position.html [ Failure ]
 crbug.com/591099 editing/caret/selection-with-caret-type-progress.html [ Failure ]
 crbug.com/591099 editing/composition-marker-basic.html [ Failure ]
@@ -4111,8 +3296,6 @@
 crbug.com/591099 editing/deleting/5433862-2.html [ Failure ]
 crbug.com/591099 editing/deleting/5483370.html [ Failure ]
 crbug.com/591099 editing/deleting/5729680.html [ Failure ]
-crbug.com/591099 editing/deleting/backspace-merge-into-block.html [ Crash ]
-crbug.com/591099 editing/deleting/backspace-merge-into-list-item.html [ Crash ]
 crbug.com/591099 editing/deleting/delete-3608430-fix.html [ Crash ]
 crbug.com/591099 editing/deleting/delete-3865854-fix.html [ Failure ]
 crbug.com/591099 editing/deleting/delete-all-text-in-text-field-assertion.html [ Crash ]
@@ -4127,7 +3310,6 @@
 crbug.com/591099 editing/deleting/delete-character-002.html [ Crash ]
 crbug.com/591099 editing/deleting/delete-contiguous-ws-001.html [ Crash Failure ]
 crbug.com/591099 editing/deleting/delete-empty-table.html [ Failure ]
-crbug.com/591099 editing/deleting/delete-first-list-item.html [ Crash ]
 crbug.com/591099 editing/deleting/delete-inline-br.html [ Crash ]
 crbug.com/591099 editing/deleting/delete-last-char-in-table.html [ Crash Failure ]
 crbug.com/591099 editing/deleting/delete-leading-ws-001.html [ Failure ]
@@ -4146,7 +3328,6 @@
 crbug.com/591099 editing/deleting/delete-line-015.html [ Failure ]
 crbug.com/591099 editing/deleting/delete-line-016.html [ Failure ]
 crbug.com/591099 editing/deleting/delete-line-017.html [ Failure ]
-crbug.com/591099 editing/deleting/delete-list-items-in-table-cell.html [ Crash ]
 crbug.com/591099 editing/deleting/delete-node-after-DOMNodeRemoved.html [ Failure ]
 crbug.com/591099 editing/deleting/delete-selection-001.html [ Failure ]
 crbug.com/591099 editing/deleting/delete-surrogatepair.html [ Failure ]
@@ -4156,25 +3337,18 @@
 crbug.com/591099 editing/deleting/delete_block_merge_whitespace.html [ Crash ]
 crbug.com/591099 editing/deleting/delete_image.html [ Crash ]
 crbug.com/591099 editing/deleting/delete_line_end_ws.html [ Failure ]
-crbug.com/591099 editing/deleting/delete_list_item.html [ Crash ]
-crbug.com/591099 editing/deleting/delete_select_all.html [ Crash ]
 crbug.com/591099 editing/deleting/delete_trailing_ws.html [ Crash ]
-crbug.com/591099 editing/deleting/delete_with_unfocused_selection.html [ Crash ]
 crbug.com/591099 editing/deleting/delete_ws_fixup.html [ Crash ]
 crbug.com/591099 editing/deleting/forward-delete-key.html [ Failure ]
-crbug.com/591099 editing/deleting/list-item-1.html [ Crash ]
 crbug.com/591099 editing/deleting/merge-at-end-of-document.html [ Failure ]
 crbug.com/591099 editing/deleting/merge-different-styles.html [ Failure ]
 crbug.com/591099 editing/deleting/merge-endOfParagraph.html [ Failure ]
-crbug.com/591099 editing/deleting/merge-list-items-in-same-list.html [ Crash ]
-crbug.com/591099 editing/deleting/merge-lists.html [ Crash ]
 crbug.com/591099 editing/deleting/merge-no-br.html [ Failure ]
 crbug.com/591099 editing/deleting/merge-paragraph-from-address.html [ Failure ]
 crbug.com/591099 editing/deleting/merge-paragraph-from-listing.html [ Failure ]
 crbug.com/591099 editing/deleting/merge-paragraph-into-blockquote.html [ Failure ]
 crbug.com/591099 editing/deleting/merge-paragraph-into-pre.html [ Failure ]
 crbug.com/591099 editing/deleting/merge-whitespace-pre.html [ Failure ]
-crbug.com/591099 editing/deleting/merge_into_empty_block.html [ Crash ]
 crbug.com/591099 editing/deleting/merge_paragraph_into_h1.html [ Crash ]
 crbug.com/591099 editing/deleting/move-nodes-001.html [ Failure ]
 crbug.com/591099 editing/deleting/non-smart-delete.html [ Failure ]
@@ -4199,7 +3373,6 @@
 crbug.com/591099 editing/execCommand/4916583.html [ Crash Failure ]
 crbug.com/591099 editing/execCommand/4917055.html [ Crash Failure ]
 crbug.com/591099 editing/execCommand/4920742-2.html [ Crash Failure ]
-crbug.com/591099 editing/execCommand/4924441.html [ Crash ]
 crbug.com/591099 editing/execCommand/4928635.html [ Crash Failure ]
 crbug.com/591099 editing/execCommand/4976800.html [ Failure ]
 crbug.com/591099 editing/execCommand/5080333-1.html [ Crash ]
@@ -4221,19 +3394,12 @@
 crbug.com/591099 editing/execCommand/5469868.html [ Crash Failure ]
 crbug.com/591099 editing/execCommand/5481523.html [ Failure ]
 crbug.com/591099 editing/execCommand/5483526.html [ Crash Failure ]
-crbug.com/591099 editing/execCommand/5543472-1.html [ Crash ]
-crbug.com/591099 editing/execCommand/5543472-2.html [ Crash ]
-crbug.com/591099 editing/execCommand/5543472-3.html [ Crash ]
 crbug.com/591099 editing/execCommand/5569741.html [ Crash Failure ]
-crbug.com/591099 editing/execCommand/5573879.html [ Crash ]
 crbug.com/591099 editing/execCommand/5575101-1.html [ Crash Failure ]
-crbug.com/591099 editing/execCommand/5575101-2.html [ Crash ]
-crbug.com/591099 editing/execCommand/5575101-3.html [ Crash ]
-crbug.com/591099 editing/execCommand/5685604-1.html [ Crash ]
+crbug.com/591099 editing/execCommand/5575101-2.html [ Crash Failure ]
+crbug.com/591099 editing/execCommand/5575101-3.html [ Crash Failure ]
 crbug.com/591099 editing/execCommand/5700414-1.html [ Failure ]
 crbug.com/591099 editing/execCommand/5700414-2.html [ Failure ]
-crbug.com/591099 editing/execCommand/5763082.html [ Crash ]
-crbug.com/591099 editing/execCommand/5939887.html [ Crash ]
 crbug.com/591099 editing/execCommand/align-in-span.html [ Failure ]
 crbug.com/591099 editing/execCommand/apply-inline-style-to-element-with-no-renderer-crash.html [ Crash ]
 crbug.com/591099 editing/execCommand/apply-style-command-crash.html [ Crash ]
@@ -4248,19 +3414,11 @@
 crbug.com/591099 editing/execCommand/clipboard-access-with-userGesture.html [ Failure ]
 crbug.com/591099 editing/execCommand/clipboard-access.html [ Failure ]
 crbug.com/591099 editing/execCommand/convert-style-elements-to-spans.html [ Failure ]
-crbug.com/591099 editing/execCommand/crash-breaking-blockquote-with-list.html [ Crash ]
-crbug.com/591099 editing/execCommand/crash-indenting-list-item.html [ Crash ]
 crbug.com/591099 editing/execCommand/crash-inserting-list.html [ Crash Pass ]
 crbug.com/591099 editing/execCommand/crash-line-break-after-outdent.html [ Crash ]
 crbug.com/591099 editing/execCommand/crash-object-cloning.html [ Crash ]
-crbug.com/591099 editing/execCommand/crash-on-enter-in-contentEditable-list.html [ Crash ]
-crbug.com/591099 editing/execCommand/crash-replacing-list-by-list.html [ Crash ]
-crbug.com/591099 editing/execCommand/create-list-from-range-selection.html [ Crash ]
-crbug.com/591099 editing/execCommand/create-list-with-hr.html [ Crash ]
-crbug.com/591099 editing/execCommand/createLink.html [ Crash ]
 crbug.com/591099 editing/execCommand/default-paragraph-separator.html [ Failure ]
 crbug.com/591099 editing/execCommand/default-parameters.html [ Failure ]
-crbug.com/591099 editing/execCommand/delete-image-in-anchor.html [ Crash ]
 crbug.com/591099 editing/execCommand/delete-selection-has-style.html [ Failure ]
 crbug.com/591099 editing/execCommand/editing-nontext-node-crash.xhtml [ Crash ]
 crbug.com/591099 editing/execCommand/empty-span-removal.html [ Failure ]
@@ -4275,12 +3433,10 @@
 crbug.com/591099 editing/execCommand/format-block-from-range-selection.html [ Failure ]
 crbug.com/591099 editing/execCommand/format-block-multiple-paragraphs-in-pre.html [ Crash ]
 crbug.com/591099 editing/execCommand/format-block-multiple-paragraphs.html [ Crash ]
-crbug.com/591099 editing/execCommand/format-block-table.html [ Crash ]
 crbug.com/591099 editing/execCommand/format-block-with-trailing-br.html [ Failure ]
 crbug.com/591099 editing/execCommand/format_block/no-visible-content.html [ Failure ]
 crbug.com/591099 editing/execCommand/format_block/unrooted-selection-start-crash.html [ Crash ]
 crbug.com/591099 editing/execCommand/forward-delete-no-scroll.html [ Failure ]
-crbug.com/591099 editing/execCommand/indent-block-in-list.html [ Crash ]
 crbug.com/591099 editing/execCommand/indent-crash-by-top-load-event.html [ Crash ]
 crbug.com/591099 editing/execCommand/indent-div-inside-list.html [ Failure ]
 crbug.com/591099 editing/execCommand/indent-empty-root.html [ Failure ]
@@ -4289,43 +3445,25 @@
 crbug.com/591099 editing/execCommand/indent-images-3.html [ Crash ]
 crbug.com/591099 editing/execCommand/indent-images.html [ Crash ]
 crbug.com/591099 editing/execCommand/indent-inline-box-crash.html [ Crash Pass ]
-crbug.com/591099 editing/execCommand/indent-list-item-with-children.html [ Crash ]
-crbug.com/591099 editing/execCommand/indent-list-item.html [ Crash ]
 crbug.com/591099 editing/execCommand/indent-nested-blockquotes-crash.html [ Crash Pass ]
 crbug.com/591099 editing/execCommand/indent-nested-blockquotes.html [ Failure ]
 crbug.com/591099 editing/execCommand/indent-nested-div.html [ Failure ]
 crbug.com/591099 editing/execCommand/indent-paragraphs.html [ Crash ]
 crbug.com/591099 editing/execCommand/indent-partial-table.html [ Failure ]
-crbug.com/591099 editing/execCommand/indent-pre-list.html [ Crash ]
 crbug.com/591099 editing/execCommand/indent-right-after-table.html [ Failure ]
 crbug.com/591099 editing/execCommand/indent-second-paragraph-in-blockquote.html [ Failure ]
-crbug.com/591099 editing/execCommand/indent-selection.html [ Crash ]
-crbug.com/591099 editing/execCommand/indent-with-first-child-crash.html [ Crash ]
-crbug.com/591099 editing/execCommand/indent/indent_nested_lists.html [ Crash ]
-crbug.com/591099 editing/execCommand/indent/indent_with_style.html [ Crash ]
 crbug.com/591099 editing/execCommand/infinite-recursion-computeRectForRepaint.html [ Crash ]
 crbug.com/591099 editing/execCommand/inline-style-after-indentoutdent.html [ Crash Failure ]
 crbug.com/591099 editing/execCommand/insert-image-changing-visibility-crash.html [ Crash ]
 crbug.com/591099 editing/execCommand/insert-image-on-top-of-directional-text.html [ Failure ]
 crbug.com/591099 editing/execCommand/insert-image-with-selecting-document.html [ Crash ]
 crbug.com/591099 editing/execCommand/insert-line-break-no-scroll.html [ Failure ]
-crbug.com/591099 editing/execCommand/insert-list-and-stitch.html [ Crash ]
-crbug.com/591099 editing/execCommand/insert-list-and-strikethrough.html [ Crash ]
 crbug.com/591099 editing/execCommand/insert-list-br-with-child-crash.html [ Crash ]
 crbug.com/591099 editing/execCommand/insert-list-empty-div.html [ Failure ]
 crbug.com/591099 editing/execCommand/insert-list-in-noneditable-list-parent.html [ Failure ]
-crbug.com/591099 editing/execCommand/insert-list-infinite-loop.html [ Crash ]
-crbug.com/591099 editing/execCommand/insert-list-infinite-loop2.html [ Crash ]
-crbug.com/591099 editing/execCommand/insert-list-into-list-crash.html [ Crash ]
-crbug.com/591099 editing/execCommand/insert-list-items-inside-another-list.html [ Crash ]
-crbug.com/591099 editing/execCommand/insert-list-nested-with-orphaned.html [ Crash ]
-crbug.com/591099 editing/execCommand/insert-list-with-id.html [ Crash ]
-crbug.com/591099 editing/execCommand/insert-list-with-noneditable-content.html [ Crash Failure ]
 crbug.com/591099 editing/execCommand/insert-list-with-progress-crash.html [ Crash ]
-crbug.com/591099 editing/execCommand/insert-list-xml.xhtml [ Crash ]
 crbug.com/591099 editing/execCommand/insert-lists-inside-another-list.html [ Crash Failure ]
 crbug.com/591099 editing/execCommand/insert-ordered-list-crash.html [ Crash ]
-crbug.com/591099 editing/execCommand/insert-ordered-list-crash2.html [ Crash ]
 crbug.com/591099 editing/execCommand/insert-ordered-list.html [ Crash ]
 crbug.com/591099 editing/execCommand/insert-paragraph-into-table.html [ Crash ]
 crbug.com/591099 editing/execCommand/insert-remove-block-list-inside-presentational-inline.html [ Crash Failure ]
@@ -4334,17 +3472,12 @@
 crbug.com/591099 editing/execCommand/insertHTML.html [ Failure ]
 crbug.com/591099 editing/execCommand/insertImage-src.html [ Failure ]
 crbug.com/591099 editing/execCommand/insertImage.html [ Failure ]
-crbug.com/591099 editing/execCommand/insert_list/insert_list_in_link.html [ Crash ]
 crbug.com/591099 editing/execCommand/insert_list/insert_list_in_summary_crash.html [ Crash Pass ]
-crbug.com/591099 editing/execCommand/insert_list/insert_list_ul_li_to_ol.html [ Crash ]
-crbug.com/591099 editing/execCommand/insert_list_at_end_of_paragraph.html [ Crash ]
 crbug.com/591099 editing/execCommand/inserting-ordered-list-crash.html [ Crash ]
 crbug.com/591099 editing/execCommand/italic-crash-by-iframe-load.html [ Crash ]
 crbug.com/591099 editing/execCommand/italicizeByCharacter.html [ Crash Failure ]
 crbug.com/591099 editing/execCommand/justify-right-crash.html [ Crash ]
 crbug.com/591099 editing/execCommand/justify.html [ Failure Timeout ]
-crbug.com/591099 editing/execCommand/list-wrapping-image-crash.html [ Crash ]
-crbug.com/591099 editing/execCommand/listify-output-crash.html [ Crash ]
 crbug.com/591099 editing/execCommand/merge-text-decoration-with-typing-style.html [ Failure ]
 crbug.com/591099 editing/execCommand/modifyForeColorByCharacter.html [ Crash Failure ]
 crbug.com/591099 editing/execCommand/move-selection-back-line-rtl.html [ Failure ]
@@ -4357,7 +3490,6 @@
 crbug.com/591099 editing/execCommand/outdent-multiparagraph-list.html [ Crash Failure ]
 crbug.com/591099 editing/execCommand/outdent-regular-blockquote.html [ Crash Failure ]
 crbug.com/591099 editing/execCommand/outdent-selection.html [ Crash Failure ]
-crbug.com/591099 editing/execCommand/outdent/outdent_nested_lists.html [ Crash ]
 crbug.com/591099 editing/execCommand/overtype-support.html [ Failure ]
 crbug.com/591099 editing/execCommand/paste-1.html [ Crash ]
 crbug.com/591099 editing/execCommand/paste-2.html [ Crash ]
@@ -4367,10 +3499,8 @@
 crbug.com/591099 editing/execCommand/query-format-block.html [ Crash ]
 crbug.com/591099 editing/execCommand/query-text-alignment.html [ Failure Timeout ]
 crbug.com/591099 editing/execCommand/query-text-decoration-with-typing-style.html [ Failure ]
-crbug.com/591099 editing/execCommand/queryCommandState-01.html [ Crash ]
 crbug.com/591099 editing/execCommand/queryCommandState-02.html [ Crash Failure ]
 crbug.com/591099 editing/execCommand/queryCommandState-03.html [ Crash ]
-crbug.com/591099 editing/execCommand/queryCommandState-list.html [ Crash ]
 crbug.com/591099 editing/execCommand/queryCommandValue-unsupported-commands.html [ Failure ]
 crbug.com/591099 editing/execCommand/remove-format-background-color.html [ Failure ]
 crbug.com/591099 editing/execCommand/remove-format-elements.html [ Crash ]
@@ -4378,47 +3508,33 @@
 crbug.com/591099 editing/execCommand/remove-format-image.html [ Crash ]
 crbug.com/591099 editing/execCommand/remove-format-multiple-elements-mac.html [ Failure ]
 crbug.com/591099 editing/execCommand/remove-format-multiple-elements-win.html [ Failure Timeout ]
-crbug.com/591099 editing/execCommand/remove-format-orphaned-list-item.html [ Crash ]
 crbug.com/591099 editing/execCommand/remove-format-textdecoration-in-iframe.html [ Crash ]
-crbug.com/591099 editing/execCommand/remove-list-1.html [ Crash ]
-crbug.com/591099 editing/execCommand/remove-list-from-multi-list-items.html [ Crash ]
 crbug.com/591099 editing/execCommand/remove-list-from-range-selection.html [ Crash Failure ]
-crbug.com/591099 editing/execCommand/remove-list-item-1.html [ Crash ]
-crbug.com/591099 editing/execCommand/remove-list-items.html [ Crash ]
 crbug.com/591099 editing/execCommand/remove_format_and_extract_contents.html [ Failure ]
 crbug.com/591099 editing/execCommand/replace-crossing-mailblockquote-crash.html [ Crash ]
 crbug.com/591099 editing/execCommand/replaceSelectorCommand-crash.html [ Crash ]
 crbug.com/591099 editing/execCommand/selectAll-including-marquee-crash.html [ Crash ]
 crbug.com/591099 editing/execCommand/selection-after-insert-list.html [ Crash Failure ]
-crbug.com/591099 editing/execCommand/selection-after-switch-type-of-listitem.html [ Crash ]
 crbug.com/591099 editing/execCommand/strikethrough-uses-strike-tag.html [ Failure ]
 crbug.com/591099 editing/execCommand/strikethroughSelection.html [ Crash Failure ]
 crbug.com/591099 editing/execCommand/style-with-css.html [ Failure ]
-crbug.com/591099 editing/execCommand/switch-list-type-with-inner-list.html [ Crash ]
-crbug.com/591099 editing/execCommand/switch-list-type-with-orphaned-li.html [ Crash ]
-crbug.com/591099 editing/execCommand/switch-list-type.html [ Crash ]
 crbug.com/591099 editing/execCommand/switch-multiple-list-items-crash.html [ Crash ]
-crbug.com/591099 editing/execCommand/switch-multiple-list-items.html [ Crash ]
 crbug.com/591099 editing/execCommand/toggle-compound-styles.html [ Crash ]
 crbug.com/591099 editing/execCommand/toggle-link-mac.html [ Failure ]
 crbug.com/591099 editing/execCommand/toggle-link-win.html [ Failure ]
-crbug.com/591099 editing/execCommand/toggle-list-uneditable-crash.html [ Crash ]
 crbug.com/591099 editing/execCommand/toggle-style-2.html [ Failure ]
 crbug.com/591099 editing/execCommand/toggle-style-3.html [ Failure ]
 crbug.com/591099 editing/execCommand/toggle-styles.html [ Failure ]
 crbug.com/591099 editing/execCommand/toggle-text-decorations.html [ Failure ]
 crbug.com/591099 editing/execCommand/toggle-unlink-mac.html [ Failure ]
 crbug.com/591099 editing/execCommand/toggle-unlink-win.html [ Failure ]
-crbug.com/591099 editing/execCommand/transpose_with_unfocused_selection.html [ Crash ]
 crbug.com/591099 editing/execCommand/unlink.html [ Crash ]
-crbug.com/591099 editing/execCommand/unlistify-uneditable-parent-crash.html [ Crash ]
 crbug.com/591099 editing/execCommand/use-css.html [ Failure ]
 crbug.com/591099 editing/execCommand/window-open-insert-list-crash.html [ Crash ]
 crbug.com/591099 editing/input/caret-at-the-edge-of-contenteditable.html [ Failure ]
 crbug.com/591099 editing/input/caret-at-the-edge-of-input.html [ Crash Failure ]
 crbug.com/591099 editing/input/caret-read-only-after-editable.html [ Failure ]
 crbug.com/591099 editing/input/change-style-with-key-binding.html [ Failure ]
-crbug.com/591099 editing/input/ctrl-up-down.html [ Crash ]
 crbug.com/591099 editing/input/div-first-child-rule-input.html [ Crash ]
 crbug.com/591099 editing/input/div-first-child-rule-textarea.html [ Crash ]
 crbug.com/591099 editing/input/drag_in_unselectable.html [ Crash ]
@@ -4441,19 +3557,15 @@
 crbug.com/591099 editing/input/reveal-caret-of-transformed-input-scrollable-parent.html [ Crash ]
 crbug.com/591099 editing/input/reveal-caret-of-transformed-multiline-input.html [ Crash Pass ]
 crbug.com/591099 editing/input/reveal-contenteditable-on-input-vertically.html [ Failure Pass ]
-crbug.com/591099 editing/input/reveal-edit-on-input-vertically.html [ Failure ]
 crbug.com/591099 editing/input/reveal-edit-on-paste-vertically.html [ Failure Pass ]
 crbug.com/591099 editing/input/reveal-password.html [ Crash Failure ]
-crbug.com/591099 editing/input/reveal-selection-having-stored-scroll-position.html [ Failure ]
 crbug.com/591099 editing/input/scroll-viewport-page-up-down.html [ Failure ]
-crbug.com/591099 editing/input/scroll-with-tab-to-input-regression.html [ Crash ]
 crbug.com/591099 editing/input/search-field-crash-in-designmode.html [ Failure ]
 crbug.com/591099 editing/input/set-value-on-input-and-delete.html [ Crash Failure ]
 crbug.com/591099 editing/input/set-value-on-input-and-forward-delete.html [ Crash Failure ]
 crbug.com/591099 editing/input/set-value-on-input-and-type-input.html [ Crash Failure ]
 crbug.com/591099 editing/input/set-value-on-input-and-type-textarea.html [ Crash Failure ]
 crbug.com/591099 editing/input/setting-input-value-cancel-ime-composition.html [ Crash ]
-crbug.com/591099 editing/input/style-change-during-input.html [ Failure ]
 crbug.com/591099 editing/input/textarea-white-space-normal-trailing-space.html [ Crash Failure Pass ]
 crbug.com/591099 editing/input/textcontrol-doubleclick-at-end.html [ Crash Failure ]
 crbug.com/591099 editing/inserting/4278698.html [ Failure ]
@@ -4482,7 +3594,6 @@
 crbug.com/591099 editing/inserting/6609479.html [ Failure ]
 crbug.com/591099 editing/inserting/6703873.html [ Failure ]
 crbug.com/591099 editing/inserting/break-blockquote-after-delete.html [ Failure ]
-crbug.com/591099 editing/inserting/break-out-of-nested-lists.html [ Crash ]
 crbug.com/591099 editing/inserting/caret-position.html [ Crash Failure ]
 crbug.com/591099 editing/inserting/delete-insignificant-text-crash.html [ Failure ]
 crbug.com/591099 editing/inserting/editable-inline-element.html [ Failure ]
@@ -4518,7 +3629,6 @@
 crbug.com/591099 editing/inserting/insert-text-into-font.html [ Failure ]
 crbug.com/591099 editing/inserting/insert-text-with-newlines.html [ Crash ]
 crbug.com/591099 editing/inserting/insert-thai-characters-001.html [ Failure ]
-crbug.com/591099 editing/inserting/insert-without-enclosing-block.html [ Crash ]
 crbug.com/591099 editing/inserting/insert-without-inheriting-style.html [ Crash ]
 crbug.com/591099 editing/inserting/insert_after_delete.html [ Failure ]
 crbug.com/591099 editing/inserting/insert_div_with_style.html [ Failure ]
@@ -4539,7 +3649,6 @@
 crbug.com/591099 editing/inserting/return-key-middle-of-span.html [ Failure ]
 crbug.com/591099 editing/inserting/return-with-object-element.html [ Failure Pass ]
 crbug.com/591099 editing/inserting/typing-at-end-of-line.html [ Failure Pass ]
-crbug.com/591099 editing/inserting/typing-tab-designmode-forms.html [ Failure ]
 crbug.com/591099 editing/inserting/typing.html [ Crash ]
 crbug.com/591099 editing/pasteboard/4242293.html [ Failure ]
 crbug.com/591099 editing/pasteboard/4631972.html [ Failure ]
@@ -4563,7 +3672,6 @@
 crbug.com/591099 editing/pasteboard/5780697-2.html [ Failure ]
 crbug.com/591099 editing/pasteboard/6018653.html [ Failure ]
 crbug.com/591099 editing/pasteboard/7955.html [ Failure ]
-crbug.com/591099 editing/pasteboard/avoid-copying-body-with-background.html [ Crash ]
 crbug.com/591099 editing/pasteboard/bad-placeholder.html [ Failure ]
 crbug.com/591099 editing/pasteboard/block-wrappers-necessary.html [ Failure ]
 crbug.com/591099 editing/pasteboard/can-read-in-copy-and-cut-events.html [ Failure ]
@@ -4578,7 +3686,6 @@
 crbug.com/591099 editing/pasteboard/copy-in-password-field.html [ Crash Failure ]
 crbug.com/591099 editing/pasteboard/copy-null-characters.html [ Crash ]
 crbug.com/591099 editing/pasteboard/copy-paste-bidi.html [ Crash Failure ]
-crbug.com/591099 editing/pasteboard/copy-paste-first-line-in-textarea.html [ Crash Failure ]
 crbug.com/591099 editing/pasteboard/copy-paste-float.html [ Crash Failure ]
 crbug.com/591099 editing/pasteboard/copy-paste-pre-line-content.html [ Failure ]
 crbug.com/591099 editing/pasteboard/copy-paste-ruby-text-with-block.html [ Crash ]
@@ -4630,7 +3737,6 @@
 crbug.com/591099 editing/pasteboard/input-with-display-none-div.html [ Crash Failure ]
 crbug.com/591099 editing/pasteboard/input-with-visibility-hidden.html [ Crash Failure ]
 crbug.com/591099 editing/pasteboard/insert-font-weight.html [ Failure ]
-crbug.com/591099 editing/pasteboard/insert-font-weight2.html [ Crash ]
 crbug.com/591099 editing/pasteboard/merge-start-blockquote.html [ Failure ]
 crbug.com/591099 editing/pasteboard/merge-start-list.html [ Failure ]
 crbug.com/591099 editing/pasteboard/mixed_editability.html [ Crash ]
@@ -4652,7 +3758,6 @@
 crbug.com/591099 editing/pasteboard/paste-line-endings-003.html [ Failure ]
 crbug.com/591099 editing/pasteboard/paste-line-endings-004.html [ Failure ]
 crbug.com/591099 editing/pasteboard/paste-line-endings-005.html [ Failure ]
-crbug.com/591099 editing/pasteboard/paste-list-001.html [ Crash ]
 crbug.com/591099 editing/pasteboard/paste-list-002.html [ Crash Failure ]
 crbug.com/591099 editing/pasteboard/paste-list-003.html [ Crash Failure ]
 crbug.com/591099 editing/pasteboard/paste-list-004.html [ Crash Failure ]
@@ -4664,9 +3769,6 @@
 crbug.com/591099 editing/pasteboard/paste-plaintext-nowrap.html [ Crash Failure ]
 crbug.com/591099 editing/pasteboard/paste-plaintext-user-select-none.html [ Crash Failure ]
 crbug.com/591099 editing/pasteboard/paste-pre-001.html [ Crash Failure Pass ]
-crbug.com/591099 editing/pasteboard/paste-pre-002.html [ Crash ]
-crbug.com/591099 editing/pasteboard/paste-removing-iframe.html [ Timeout ]
-crbug.com/591099 editing/pasteboard/paste-text-012.html [ Crash ]
 crbug.com/591099 editing/pasteboard/paste-text-016.html [ Failure ]
 crbug.com/591099 editing/pasteboard/paste-text-at-tabspan-003.html [ Failure ]
 crbug.com/591099 editing/pasteboard/paste-text-events.html [ Crash Failure ]
@@ -4689,7 +3791,6 @@
 crbug.com/591099 editing/pasteboard/smart-drag-drop.html [ Failure ]
 crbug.com/591099 editing/pasteboard/smart-paste-003-trailing-whitespace.html [ Crash Failure ]
 crbug.com/591099 editing/pasteboard/smart-paste-008.html [ Failure ]
-crbug.com/591099 editing/pasteboard/smart-paste-in-text-control.html [ Crash Pass ]
 crbug.com/591099 editing/pasteboard/smart_paste.html [ Failure ]
 crbug.com/591099 editing/pasteboard/styled-element-markup.html [ Failure ]
 crbug.com/591099 editing/pasteboard/subframe-dragndrop-1.html [ Crash ]
@@ -4708,7 +3809,6 @@
 crbug.com/591099 editing/selection/5136696.html [ Crash Pass ]
 crbug.com/591099 editing/selection/5195166-1.html [ Crash Failure ]
 crbug.com/591099 editing/selection/5195166-2.html [ Failure ]
-crbug.com/591099 editing/selection/5209984.html [ Crash ]
 crbug.com/591099 editing/selection/5213963.html [ Crash Failure ]
 crbug.com/591099 editing/selection/5232159.html [ Failure ]
 crbug.com/591099 editing/selection/5241148.html [ Failure ]
@@ -4723,8 +3823,6 @@
 crbug.com/591099 editing/selection/anchor-focus2.html [ Crash Failure ]
 crbug.com/591099 editing/selection/anchor-focus3.html [ Crash Failure ]
 crbug.com/591099 editing/selection/applystyle-to-inline-in-block.html [ Failure ]
-crbug.com/591099 editing/selection/arrow_key_with_unfocused_selection.html [ Crash ]
-crbug.com/591099 editing/selection/block-cursor-overtype-mode-end-of-line.html [ Failure ]
 crbug.com/591099 editing/selection/block-cursor-overtype-mode-rtl.html [ Failure ]
 crbug.com/591099 editing/selection/block-cursor-overtype-mode.html [ Failure ]
 crbug.com/591099 editing/selection/caret-after-keypress.html [ Failure ]
@@ -4756,8 +3854,6 @@
 crbug.com/591099 editing/selection/click-in-focusable-link-should-not-clear-selection.html [ Failure ]
 crbug.com/591099 editing/selection/click-in-margins-inside-editable-div.html [ Failure ]
 crbug.com/591099 editing/selection/click-in-padding-with-multiple-line-boxes.html [ Failure ]
-crbug.com/591099 editing/selection/click-on-anonymous-content-crash.html [ Crash ]
-crbug.com/591099 editing/selection/click-on-block-image.html [ Crash ]
 crbug.com/591099 editing/selection/click-outside-editable-div.html [ Failure ]
 crbug.com/591099 editing/selection/click-start-of-line.html [ Failure ]
 crbug.com/591099 editing/selection/collapse-null.html [ Failure ]
@@ -4767,7 +3863,6 @@
 crbug.com/591099 editing/selection/collapseto_in_text_fields.html [ Crash ]
 crbug.com/591099 editing/selection/commit-pending-selection-crash.html [ Crash ]
 crbug.com/591099 editing/selection/contains-boundaries.html [ Failure ]
-crbug.com/591099 editing/selection/containsNode.html [ Crash ]
 crbug.com/591099 editing/selection/contenteditable-click-inside.html [ Failure ]
 crbug.com/591099 editing/selection/context-menu-on-text.html [ Failure ]
 crbug.com/591099 editing/selection/context-menu-text-selection.html [ Failure ]
@@ -4776,7 +3871,6 @@
 crbug.com/591099 editing/selection/css-pseudo-element-hang.html [ Failure ]
 crbug.com/591099 editing/selection/css-pseudo-element.html [ Failure ]
 crbug.com/591099 editing/selection/delete-word-granularity-text-control.html [ Crash Failure ]
-crbug.com/591099 editing/selection/deleteFromDocument-crash.html [ Crash Failure ]
 crbug.com/591099 editing/selection/deleteFromDocument-scoped-dispatch-event-crash.html [ Crash ]
 crbug.com/591099 editing/selection/deletefromdocument-shadow-leak.html [ Crash ]
 crbug.com/591099 editing/selection/designmode-no-caret.html [ Failure ]
@@ -4806,7 +3900,6 @@
 crbug.com/591099 editing/selection/dump-as-markup.html [ Crash ]
 crbug.com/591099 editing/selection/editable-div-clear-on-keydown.html [ Failure ]
 crbug.com/591099 editing/selection/editable-links.html [ Failure ]
-crbug.com/591099 editing/selection/empty-cell-right-click.html [ Crash ]
 crbug.com/591099 editing/selection/expanding-selections.html [ Failure ]
 crbug.com/591099 editing/selection/expanding-selections2.html [ Failure ]
 crbug.com/591099 editing/selection/extend-after-mouse-selection.html [ Failure ]
@@ -4823,7 +3916,6 @@
 crbug.com/591099 editing/selection/extend-selection-home-end.html [ Timeout ]
 crbug.com/591099 editing/selection/extend-selection-word.html [ Timeout ]
 crbug.com/591099 editing/selection/extend-to-trailing-spaces.html [ Failure ]
-crbug.com/591099 editing/selection/extend.html [ Crash ]
 crbug.com/591099 editing/selection/extend/go-out-of-readonly-textarea.html [ Crash Pass ]
 crbug.com/591099 editing/selection/find-in-text-control.html [ Crash Failure ]
 crbug.com/591099 editing/selection/first-letter-selection-crash.html [ Crash ]
@@ -4841,7 +3933,6 @@
 crbug.com/591099 editing/selection/iframe-select-animation.html [ Crash ]
 crbug.com/591099 editing/selection/inactive-selection.html [ Crash Failure ]
 crbug.com/591099 editing/selection/inline-closest-leaf-child.html [ Failure ]
-crbug.com/591099 editing/selection/insert-list-over-uneditable-in-contenteditable.html [ Crash ]
 crbug.com/591099 editing/selection/internal-caret-rect.html [ Failure ]
 crbug.com/591099 editing/selection/keep-selection-after-set-focus.html [ Failure ]
 crbug.com/591099 editing/selection/keydown-without-selection-crash.html [ Crash ]
@@ -4850,7 +3941,6 @@
 crbug.com/591099 editing/selection/line-wrap-1.html [ Failure ]
 crbug.com/591099 editing/selection/line-wrap-2.html [ Failure ]
 crbug.com/591099 editing/selection/linux_selection_color.html [ Failure ]
-crbug.com/591099 editing/selection/mark_with_unfocused_selection.html [ Crash ]
 crbug.com/591099 editing/selection/mixed-editability-1.html [ Failure ]
 crbug.com/591099 editing/selection/mixed-editability-10.html [ Crash Failure ]
 crbug.com/591099 editing/selection/mixed-editability-11.html [ Failure ]
@@ -4866,9 +3956,7 @@
 crbug.com/591099 editing/selection/modify-by-lineboundary-in-inline-editable-contexts.html [ Failure ]
 crbug.com/591099 editing/selection/modify-up-on-rtl-wrapping-text.html [ Failure ]
 crbug.com/591099 editing/selection/modify_extend/extend_by_character.html [ Crash ]
-crbug.com/591099 editing/selection/modify_extend/extend_by_word_002.html [ Crash ]
 crbug.com/591099 editing/selection/modify_extend/extend_selection_enclosing_block.html [ Crash ]
-crbug.com/591099 editing/selection/modify_extend/extend_with_unfocused_selection.html [ Crash ]
 crbug.com/591099 editing/selection/modify_move/move-by-character-001.html [ Failure ]
 crbug.com/591099 editing/selection/modify_move/move-by-character-002.html [ Crash ]
 crbug.com/591099 editing/selection/modify_move/move-by-character-003.html [ Failure Pass ]
@@ -4895,7 +3983,6 @@
 crbug.com/591099 editing/selection/mouse/click-user-select-all-textarea.html [ Crash ]
 crbug.com/591099 editing/selection/mouse/drag-user-select-all-contenteditable.html [ Failure ]
 crbug.com/591099 editing/selection/mouse/drag-user-select-all-textarea.html [ Crash ]
-crbug.com/591099 editing/selection/mouse/mouse_down_to_focus.html [ Crash ]
 crbug.com/591099 editing/selection/move-3875618-fix.html [ Failure ]
 crbug.com/591099 editing/selection/move-3875641-fix.html [ Failure ]
 crbug.com/591099 editing/selection/move-backwords-by-word-001.html [ Failure ]
@@ -4921,7 +4008,6 @@
 crbug.com/591099 editing/selection/programmatic-selection-on-mac-is-directionless.html [ Crash Timeout ]
 crbug.com/591099 editing/selection/range-between-block-and-inline.html [ Failure ]
 crbug.com/591099 editing/selection/rangeCount.html [ Failure ]
-crbug.com/591099 editing/selection/readonly-disabled-hittest.html [ Crash Pass ]
 crbug.com/591099 editing/selection/readonly-disabled-text-selection.html [ Crash Failure ]
 crbug.com/591099 editing/selection/regional-indicators.html [ Failure ]
 crbug.com/591099 editing/selection/removeAllRanges.html [ Failure ]
@@ -4964,7 +4050,6 @@
 crbug.com/591099 editing/selection/select_all/select_all_readonly_textarea.html [ Crash ]
 crbug.com/591099 editing/selection/select_all/select_all_textarea.html [ Crash ]
 crbug.com/591099 editing/selection/select_all/select_all_user_select_none.html [ Failure ]
-crbug.com/591099 editing/selection/select_all/select_all_with_unfocused_selection.html [ Crash ]
 crbug.com/591099 editing/selection/selection-3748164-fix.html [ Failure ]
 crbug.com/591099 editing/selection/selection-actions.html [ Failure ]
 crbug.com/591099 editing/selection/selection-background.html [ Failure ]
@@ -4993,7 +4078,6 @@
 crbug.com/591099 editing/selection/triple-click-in-pre.html [ Failure ]
 crbug.com/591099 editing/selection/undo-crash.html [ Crash ]
 crbug.com/591099 editing/selection/user-select-all-parsing.html [ Failure ]
-crbug.com/591099 editing/selection/user-select-none-in-editable.html [ Crash ]
 crbug.com/591099 editing/selection/user-select/user-select-all.html [ Crash ]
 crbug.com/591099 editing/selection/vertical-lr-ltr-extend-line-backward-br.html [ Failure Pass ]
 crbug.com/591099 editing/selection/vertical-lr-ltr-extend-line-forward-br.html [ Failure Pass ]
@@ -5031,10 +4115,7 @@
 crbug.com/591099 editing/spelling/cold_mode_type_idle.html [ Failure ]
 crbug.com/591099 editing/spelling/context_click_on_selected_misspelling.html [ Timeout ]
 crbug.com/591099 editing/spelling/context_click_select_misspelling.html [ Crash Failure ]
-crbug.com/591099 editing/spelling/copy-paste-crash.html [ Failure ]
 crbug.com/591099 editing/spelling/grammar-paste.html [ Failure ]
-crbug.com/591099 editing/spelling/mark-empty-crash.html [ Crash ]
-crbug.com/591099 editing/spelling/marker_preservation_with_focus_change.html [ Failure ]
 crbug.com/591099 editing/spelling/mixed_paste.html [ Failure ]
 crbug.com/591099 editing/spelling/no_marker_in_blurred_input.html [ Crash ]
 crbug.com/591099 editing/spelling/spellcheck-async-mutation.html [ Failure ]
@@ -5049,8 +4130,7 @@
 crbug.com/591099 editing/spelling/spellcheck-queue.html [ Failure ]
 crbug.com/591099 editing/spelling/spellcheck-remove-markers.html [ Crash ]
 crbug.com/591099 editing/spelling/spellcheck-sequencenum.html [ Crash ]
-crbug.com/591099 editing/spelling/spellcheck_test.html [ Failure ]
-crbug.com/591099 editing/spelling/spelling-attribute-change.html [ Failure ]
+crbug.com/591099 editing/spelling/spellcheck_test.html [ Crash Failure ]
 crbug.com/591099 editing/spelling/spelling-backward.html [ Failure ]
 crbug.com/591099 editing/spelling/spelling-changed-text.html [ Failure ]
 crbug.com/591099 editing/spelling/spelling-huge-text.html [ Timeout ]
@@ -5070,9 +4150,6 @@
 crbug.com/591099 editing/style/block-style-001.html [ Failure ]
 crbug.com/591099 editing/style/block-style-002.html [ Failure ]
 crbug.com/591099 editing/style/block-style-003.html [ Failure ]
-crbug.com/591099 editing/style/block-style-004.html [ Crash ]
-crbug.com/591099 editing/style/block-style-005.html [ Crash ]
-crbug.com/591099 editing/style/block-style-006.html [ Crash ]
 crbug.com/591099 editing/style/block-styles-007.html [ Failure ]
 crbug.com/591099 editing/style/designmode.html [ Failure ]
 crbug.com/591099 editing/style/fix-range-from-root-editable-crash.html [ Crash ]
@@ -5095,24 +4172,17 @@
 crbug.com/591099 editing/style/push-down-implicit-styles-mac.html [ Failure ]
 crbug.com/591099 editing/style/push-down-inline-styles.html [ Failure ]
 crbug.com/591099 editing/style/query-typing-style.html [ Failure ]
-crbug.com/591099 editing/style/redundant-background-color.html [ Crash ]
 crbug.com/591099 editing/style/remove-nested-inline-styles.html [ Failure ]
 crbug.com/591099 editing/style/remove-underline-across-paragraph-in-bold.html [ Crash Failure ]
 crbug.com/591099 editing/style/remove-underline-across-paragraph.html [ Crash Failure ]
-crbug.com/591099 editing/style/remove-underline-after-paragraph-in-bold.html [ Crash ]
-crbug.com/591099 editing/style/remove-underline-after-paragraph.html [ Crash ]
-crbug.com/591099 editing/style/remove-underline-in-bold.html [ Crash ]
-crbug.com/591099 editing/style/remove-underline.html [ Crash ]
 crbug.com/591099 editing/style/stylewithcss-without-selection.html [ Failure ]
 crbug.com/591099 editing/style/table-selection.html [ Failure ]
 crbug.com/591099 editing/style/temporary-span-crash.html [ Failure ]
 crbug.com/591099 editing/style/text-decoration-state.html [ Failure ]
-crbug.com/591099 editing/style/text-indent.html [ Failure ]
 crbug.com/591099 editing/style/textdecoration-outside-of-rooteditable.html [ Crash Failure ]
 crbug.com/591099 editing/style/textdecoration-outside-of-unsplittable-element.html [ Crash Failure ]
 crbug.com/591099 editing/style/typing_style.html [ Crash ]
 crbug.com/591099 editing/style/unbold-in-bold.html [ Crash ]
-crbug.com/591099 editing/style/underline.html [ Crash ]
 crbug.com/591099 editing/surrounding-text/surrounding-text-detached-no-crash.html [ Failure ]
 crbug.com/591099 editing/surrounding-text/surrounding-text.html [ Crash ]
 crbug.com/591099 editing/text-iterator/basic-iteration-shadowdom.html [ Failure ]
@@ -5125,7 +4195,6 @@
 crbug.com/591099 editing/text-iterator/range-to-from-location-and-length.html [ Failure ]
 crbug.com/591099 editing/text-iterator/selection-to-string-with-auto-fill.html [ Crash ]
 crbug.com/591099 editing/text-iterator/thai-cursor-movement.html [ Crash Failure ]
-crbug.com/591099 editing/undo/4059423-1.html [ Crash ]
 crbug.com/591099 editing/undo/5658727.html [ Failure ]
 crbug.com/591099 editing/undo/5738768.html [ Failure ]
 crbug.com/591099 editing/undo/audio-in-undo-stack-crash.html [ Crash ]
@@ -5137,7 +4206,6 @@
 crbug.com/591099 editing/undo/undo-after-setting-value.html [ Crash Failure ]
 crbug.com/591099 editing/undo/undo-deleteWord.html [ Failure Pass ]
 crbug.com/591099 editing/undo/undo-iframe-location-change.html [ Crash ]
-crbug.com/591099 editing/undo/undo-indent.html [ Crash ]
 crbug.com/591099 editing/undo/undo-set-selection-crash.html [ Failure ]
 crbug.com/591099 editing/undo/undo-smart-delete-reversed-selection.html [ Failure Pass ]
 crbug.com/591099 editing/unsupported-content/list-delete-001.html [ Crash Failure ]
@@ -5158,21 +4226,10 @@
 crbug.com/591099 external/wpt/2dcontext/drawing-paths-to-the-canvas/drawFocusIfNeeded_003.html [ Crash ]
 crbug.com/591099 external/wpt/2dcontext/drawing-paths-to-the-canvas/drawFocusIfNeeded_004.html [ Crash ]
 crbug.com/591099 external/wpt/2dcontext/drawing-paths-to-the-canvas/drawFocusIfNeeded_005.html [ Crash ]
-crbug.com/591099 external/wpt/2dcontext/drawing-rectangles-to-the-canvas/2d.clearRect.basic.html [ Crash ]
-crbug.com/591099 external/wpt/2dcontext/drawing-rectangles-to-the-canvas/2d.clearRect.globalalpha.html [ Crash ]
-crbug.com/591099 external/wpt/2dcontext/drawing-rectangles-to-the-canvas/2d.clearRect.globalcomposite.html [ Crash ]
-crbug.com/591099 external/wpt/2dcontext/drawing-rectangles-to-the-canvas/2d.clearRect.negative.html [ Crash ]
-crbug.com/591099 external/wpt/2dcontext/drawing-rectangles-to-the-canvas/2d.clearRect.transform.html [ Crash ]
-crbug.com/591099 external/wpt/2dcontext/drawing-rectangles-to-the-canvas/2d.strokeRect.globalalpha.html [ Crash ]
-crbug.com/591099 external/wpt/2dcontext/drawing-rectangles-to-the-canvas/2d.strokeRect.globalcomposite.html [ Crash ]
-crbug.com/591099 external/wpt/2dcontext/drawing-rectangles-to-the-canvas/2d.strokeRect.zero.1.html [ Crash ]
-crbug.com/591099 external/wpt/2dcontext/drawing-rectangles-to-the-canvas/2d.strokeRect.zero.2.html [ Crash ]
-crbug.com/591099 external/wpt/2dcontext/drawing-rectangles-to-the-canvas/2d.strokeRect.zero.4.html [ Crash ]
 crbug.com/591099 external/wpt/2dcontext/fill-and-stroke-styles/2d.pattern.image.incomplete.emptysrc.html [ Crash ]
 crbug.com/591099 external/wpt/2dcontext/fill-and-stroke-styles/2d.pattern.image.incomplete.removedsrc.html [ Crash ]
 crbug.com/591099 external/wpt/2dcontext/hit-regions/hitregions-members-exist.html [ Crash ]
 crbug.com/591099 external/wpt/2dcontext/line-styles/setLineDash.html [ Crash ]
-crbug.com/591099 external/wpt/2dcontext/path-objects/2d.path.lineTo.nonfinite.details.html [ Crash ]
 crbug.com/591099 external/wpt/2dcontext/transformations/canvas_transformations_reset_001.html [ Failure Pass ]
 crbug.com/591099 external/wpt/FileAPI/idlharness.html [ Crash ]
 crbug.com/591099 external/wpt/FileAPI/url/blob-url-in-sandboxed-iframe.html [ Crash ]
@@ -5201,11 +4258,8 @@
 crbug.com/591099 external/wpt/XMLHttpRequest/open-url-multi-window-3.htm [ Crash ]
 crbug.com/591099 external/wpt/XMLHttpRequest/open-url-multi-window-4.htm [ Crash ]
 crbug.com/591099 external/wpt/XMLHttpRequest/send-authentication-prompt-2-manual.htm [ Crash Failure ]
-crbug.com/591099 external/wpt/XMLHttpRequest/send-authentication-prompt-manual.htm [ Crash ]
 crbug.com/591099 external/wpt/XMLHttpRequest/xmlhttprequest-sync-block-defer-scripts.html [ Crash ]
 crbug.com/591099 external/wpt/XMLHttpRequest/xmlhttprequest-sync-not-hang-scriptloader.html [ Crash ]
-crbug.com/591099 external/wpt/battery-status/battery-discharging-manual.https.html [ Crash ]
-crbug.com/591099 external/wpt/battery-status/battery-full-manual.https.html [ Crash ]
 crbug.com/591099 external/wpt/content-security-policy/child-src/child-src-about-blank-allowed-by-default.sub.html [ Crash ]
 crbug.com/591099 external/wpt/content-security-policy/child-src/child-src-about-blank-allowed-by-scheme.sub.html [ Crash ]
 crbug.com/591099 external/wpt/content-security-policy/child-src/child-src-allowed.sub.html [ Crash ]
@@ -5257,7 +4311,6 @@
 crbug.com/591099 external/wpt/content-security-policy/svg/svg-policy-with-resource.html [ Crash ]
 crbug.com/591099 external/wpt/cors/remote-origin.htm [ Crash ]
 crbug.com/591099 external/wpt/css/CSS2/abspos/abspos-containing-block-initial-001.xht [ Failure ]
-crbug.com/591099 external/wpt/css/CSS2/abspos/abspos-containing-block-initial-005b.xht [ Crash ]
 crbug.com/591099 external/wpt/css/CSS2/abspos/abspos-containing-block-initial-007.xht [ Failure Pass ]
 crbug.com/591099 external/wpt/css/CSS2/abspos/abspos-containing-block-initial-009a.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/floats-clear/clear-applies-to-001.xht [ Failure ]
@@ -5268,7 +4321,6 @@
 crbug.com/591099 external/wpt/css/CSS2/floats-clear/clear-applies-to-006.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/floats-clear/clear-applies-to-007.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/floats-clear/clear-applies-to-015.xht [ Failure ]
-crbug.com/591099 external/wpt/css/CSS2/floats-clear/float-applies-to-009.xht [ Crash ]
 crbug.com/591099 external/wpt/css/CSS2/floats-clear/float-non-replaced-width-002.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/floats-clear/float-non-replaced-width-004.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/floats-clear/float-replaced-height-001.xht [ Failure ]
@@ -5319,9 +4371,7 @@
 crbug.com/591099 external/wpt/css/CSS2/floats/floats-placement-vertical-001b.xht [ Failure Pass ]
 crbug.com/591099 external/wpt/css/CSS2/floats/floats-placement-vertical-001c.xht [ Failure Pass ]
 crbug.com/591099 external/wpt/css/CSS2/floats/floats-wrap-bfc-001-left-overflow.xht [ Crash Failure ]
-crbug.com/591099 external/wpt/css/CSS2/floats/floats-wrap-bfc-001-right-table.xht [ Crash ]
 crbug.com/591099 external/wpt/css/CSS2/floats/floats-wrap-bfc-002-left-overflow.xht [ Failure ]
-crbug.com/591099 external/wpt/css/CSS2/floats/floats-wrap-bfc-002-left-table.xht [ Crash ]
 crbug.com/591099 external/wpt/css/CSS2/floats/floats-wrap-bfc-003-left-overflow.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/floats/floats-wrap-bfc-003-right-overflow.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/floats/floats-wrap-bfc-004.xht [ Failure ]
@@ -5371,10 +4421,8 @@
 crbug.com/591099 external/wpt/css/CSS2/linebox/line-height-103.xht [ Failure Pass ]
 crbug.com/591099 external/wpt/css/CSS2/linebox/line-height-104.xht [ Failure Pass ]
 crbug.com/591099 external/wpt/css/CSS2/linebox/line-height-129.xht [ Failure Pass ]
-crbug.com/591099 external/wpt/css/CSS2/linebox/line-height-applies-to-003.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/linebox/line-height-bleed-001.xht [ Failure Pass ]
 crbug.com/591099 external/wpt/css/CSS2/linebox/line-height-bleed-002.xht [ Failure Pass ]
-crbug.com/591099 external/wpt/css/CSS2/linebox/vertical-align-092.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/linebox/vertical-align-121.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/linebox/vertical-align-baseline-004a.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/linebox/vertical-align-baseline-005a.xht [ Failure ]
@@ -5394,7 +4442,6 @@
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/block-in-inline-margins-002a.xht [ Failure Pass ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/block-in-inline-margins-002b.xht [ Failure Pass ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/block-in-inline-percents-001.xht [ Failure ]
-crbug.com/591099 external/wpt/css/CSS2/normal-flow/block-in-inline-remove-005.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/block-non-replaced-height-005.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/block-non-replaced-width-007.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/block-replaced-width-006.xht [ Failure ]
@@ -5457,7 +4504,6 @@
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/max-height-024.xht [ Failure Pass ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/max-height-026.xht [ Failure Pass ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/max-height-027.xht [ Failure Pass ]
-crbug.com/591099 external/wpt/css/CSS2/normal-flow/max-height-028.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/max-height-035.xht [ Failure Pass ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/max-height-037.xht [ Failure Pass ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/max-height-038.xht [ Crash Failure Pass ]
@@ -5480,7 +4526,6 @@
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/max-height-percentage-002.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/max-height-percentage-003.xht [ Failure Pass ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/max-width-106.xht [ Failure Pass ]
-crbug.com/591099 external/wpt/css/CSS2/normal-flow/max-width-applies-to-004.xht [ Crash ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/min-height-001.xht [ Failure Pass ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/min-height-002.xht [ Crash Failure Pass ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/min-height-004.xht [ Failure Pass ]
@@ -5503,7 +4548,6 @@
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/min-height-049.xht [ Failure Pass ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/min-height-056.xht [ Failure Pass ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/min-height-057.xht [ Failure Pass ]
-crbug.com/591099 external/wpt/css/CSS2/normal-flow/min-height-058.xht [ Crash ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/min-height-059.xht [ Failure Pass ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/min-height-060.xht [ Failure Pass ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/min-height-067.xht [ Failure Pass ]
@@ -5523,11 +4567,8 @@
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/min-height-102.xht [ Crash Failure Pass ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/min-height-104.xht [ Failure Pass ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/min-height-106.xht [ Failure Pass ]
-crbug.com/591099 external/wpt/css/CSS2/normal-flow/min-width-001.xht [ Crash ]
-crbug.com/591099 external/wpt/css/CSS2/normal-flow/min-width-060.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/root-box-001.xht [ Crash Failure ]
 crbug.com/591099 external/wpt/css/CSS2/normal-flow/table-in-inline-001.xht [ Failure Pass ]
-crbug.com/591099 external/wpt/css/CSS2/normal-flow/width-067.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/positioning/absolute-non-replaced-width-015.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/positioning/absolute-non-replaced-width-019.xht [ Failure Pass ]
 crbug.com/591099 external/wpt/css/CSS2/positioning/absolute-non-replaced-width-020.xht [ Failure Pass ]
@@ -5570,11 +4611,8 @@
 crbug.com/591099 external/wpt/css/CSS2/positioning/abspos-containing-block-001.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/positioning/abspos-containing-block-002.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/positioning/abspos-containing-block-007.xht [ Crash Failure ]
-crbug.com/591099 external/wpt/css/CSS2/positioning/bottom-043.xht [ Crash ]
-crbug.com/591099 external/wpt/css/CSS2/positioning/bottom-076.xht [ Crash ]
 crbug.com/591099 external/wpt/css/CSS2/positioning/left-offset-003.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/positioning/left-offset-percentage-001.xht [ Failure ]
-crbug.com/591099 external/wpt/css/CSS2/positioning/position-relative-010.xht [ Crash ]
 crbug.com/591099 external/wpt/css/CSS2/positioning/position-relative-027.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/positioning/position-relative-028.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/positioning/position-relative-029.xht [ Failure ]
@@ -5583,8 +4621,6 @@
 crbug.com/591099 external/wpt/css/CSS2/positioning/positioning-float-002.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/positioning/relpos-calcs-004.xht [ Failure ]
 crbug.com/591099 external/wpt/css/CSS2/positioning/relpos-calcs-005.xht [ Crash Failure ]
-crbug.com/591099 external/wpt/css/CSS2/positioning/right-077.xht [ Crash ]
-crbug.com/591099 external/wpt/css/CSS2/positioning/right-applies-to-013.xht [ Crash ]
 crbug.com/591099 external/wpt/css/CSS2/positioning/top-019.xht [ Crash Failure Pass ]
 crbug.com/591099 external/wpt/css/CSS2/positioning/top-020.xht [ Crash Failure Pass ]
 crbug.com/591099 external/wpt/css/CSS2/positioning/top-031.xht [ Crash Failure ]
@@ -5607,18 +4643,14 @@
 crbug.com/591099 external/wpt/css/css-display-3/display-contents-dynamic-multicol-001-inline.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-display-3/display-contents-dynamic-multicol-001-none.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-display-3/display-contents-dynamic-table-001-inline.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-display-3/display-contents-dynamic-table-002-inline.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-display-3/display-contents-dynamic-table-002-none.html [ Crash ]
 crbug.com/591099 external/wpt/css/css-display-3/display-contents-multicol-001.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-display-3/display-contents-replaced-001.html [ Crash Pass ]
-crbug.com/591099 external/wpt/css/css-display-3/display-contents-table-002.html [ Crash ]
 crbug.com/591099 external/wpt/css/css-display-3/display-flow-root-001.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-flexbox-1/Flexible-order.html [ Crash Failure Pass ]
 crbug.com/591099 external/wpt/css/css-flexbox-1/css-flexbox-row-reverse-wrap-reverse.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-flexbox-1/css-flexbox-row-reverse-wrap.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-flexbox-1/css-flexbox-row-wrap-reverse.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-flexbox-1/css-flexbox-row-wrap.html [ Failure ]
-crbug.com/591099 external/wpt/css/css-flexbox-1/flex-box-wrap.html [ Crash ]
 crbug.com/591099 external/wpt/css/css-flexbox-1/flex-container-margin.html [ Crash Failure ]
 crbug.com/591099 external/wpt/css/css-flexbox-1/flex-direction-with-element-insert.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-flexbox-1/flex-direction.html [ Failure ]
@@ -5626,7 +4658,6 @@
 crbug.com/591099 external/wpt/css/css-flexbox-1/flex-lines/multi-line-wrap-reverse-row-reverse.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-flexbox-1/flex-lines/multi-line-wrap-with-column-reverse.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-flexbox-1/flex-lines/multi-line-wrap-with-row-reverse.html [ Crash Failure ]
-crbug.com/591099 external/wpt/css/css-flexbox-1/flex-vertical-align-effect.html [ Crash Failure ]
 crbug.com/591099 external/wpt/css/css-flexbox-1/flexbox-flex-direction-column-reverse.htm [ Failure Pass ]
 crbug.com/591099 external/wpt/css/css-flexbox-1/flexbox-flex-direction-column.htm [ Failure Pass ]
 crbug.com/591099 external/wpt/css/css-flexbox-1/flexbox-flex-direction-default.htm [ Failure Pass ]
@@ -5642,7 +4673,6 @@
 crbug.com/591099 external/wpt/css/css-flexbox-1/flexbox_columns-flexitems.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-flexbox-1/flexbox_direction-column-reverse.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-flexbox-1/flexbox_direction-column.html [ Crash Failure ]
-crbug.com/591099 external/wpt/css/css-flexbox-1/flexbox_display.html [ Crash ]
 crbug.com/591099 external/wpt/css/css-flexbox-1/flexbox_fbfc.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-flexbox-1/flexbox_fbfc2.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-flexbox-1/flexbox_first-line.html [ Failure ]
@@ -5867,8 +4897,6 @@
 crbug.com/591099 external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-016.html [ Crash ]
 crbug.com/591099 external/wpt/css/css-grid-1/grid-definition/fr-unit-with-percentage.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-grid-1/grid-definition/fr-unit.html [ Failure ]
-crbug.com/591099 external/wpt/css/css-grid-1/grid-definition/grid-layout-repeat-notation.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-grid-1/grid-items/grid-inline-z-axis-ordering-overlapped-items-005.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-grid-1/grid-items/grid-inline-z-axis-ordering-overlapped-items-006.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-grid-1/grid-items/grid-item-containing-block-001.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-grid-1/grid-items/grid-item-containing-block-002.html [ Failure ]
@@ -5888,10 +4916,8 @@
 crbug.com/591099 external/wpt/css/css-rhythm-1/line-height-step-basic-001.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-rhythm-1/line-height-step-boundary-001.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-rhythm-1/line-height-step-dynamic-001.html [ Failure ]
-crbug.com/591099 external/wpt/css/css-rhythm-1/line-height-step-ruby-001.html [ Crash Failure ]
 crbug.com/591099 external/wpt/css/css-rhythm-1/line-height-step-valign-001.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-rhythm-1/line-height-step-writing-mode-vrl-001.html [ Failure ]
-crbug.com/591099 external/wpt/css/css-rhythm-1/line-height-step-writing-mode-vrl-ruby-001.html [ Crash Pass ]
 crbug.com/591099 external/wpt/css/css-shapes-1/shape-outside/shape-box/shape-outside-box-002.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-shapes-1/shape-outside/shape-box/shape-outside-box-003.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-shapes-1/shape-outside/shape-box/shape-outside-box-004.html [ Failure ]
@@ -5992,9 +5018,6 @@
 crbug.com/591099 external/wpt/css/css-shapes-1/spec-examples/shape-outside-017.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-shapes-1/spec-examples/shape-outside-018.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-shapes-1/spec-examples/shape-outside-019.html [ Failure ]
-crbug.com/591099 external/wpt/css/css-text-3/i18n/css3-text-line-break-jazh-039.html [ Failure ]
-crbug.com/591099 external/wpt/css/css-text-3/i18n/css3-text-line-break-jazh-114.html [ Failure ]
-crbug.com/591099 external/wpt/css/css-text-3/i18n/css3-text-line-break-opclns-102.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-text-3/overflow-wrap/overflow-wrap-001.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-text-3/overflow-wrap/overflow-wrap-002.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-text-3/overflow-wrap/overflow-wrap-break-word-001.html [ Failure ]
@@ -6005,13 +5028,13 @@
 crbug.com/591099 external/wpt/css/css-text-decor-3/text-emphasis-position-above-right-002.xht [ Crash Failure ]
 crbug.com/591099 external/wpt/css/css-text-decor-3/text-emphasis-position-below-left-002.xht [ Crash Failure ]
 crbug.com/591099 external/wpt/css/css-text-decor-3/text-emphasis-position-below-right-002.xht [ Crash Failure ]
-crbug.com/591099 external/wpt/css/css-text-decor-3/text-emphasis-style-002.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-text-decor-3/text-emphasis-style-006.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-text-decor-3/text-emphasis-style-007.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-text-decor-3/text-emphasis-style-008.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-text-decor-3/text-emphasis-style-010.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-text-decor-3/text-emphasis-style-012.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-text-decor-3/text-emphasis-style-021.html [ Crash ]
+crbug.com/591099 external/wpt/css/css-text-decor-3/text-emphasis-style-002.html [ Crash Failure ]
+crbug.com/591099 external/wpt/css/css-text-decor-3/text-emphasis-style-006.html [ Crash Failure ]
+crbug.com/591099 external/wpt/css/css-text-decor-3/text-emphasis-style-007.html [ Crash Failure ]
+crbug.com/591099 external/wpt/css/css-text-decor-3/text-emphasis-style-008.html [ Crash Failure ]
+crbug.com/591099 external/wpt/css/css-text-decor-3/text-emphasis-style-010.html [ Crash Failure ]
+crbug.com/591099 external/wpt/css/css-text-decor-3/text-emphasis-style-012.html [ Crash Failure ]
+crbug.com/591099 external/wpt/css/css-text-decor-3/text-emphasis-style-021.html [ Crash Failure ]
 crbug.com/591099 external/wpt/css/css-text-decor-3/text-emphasis-style-filled-001.xht [ Crash Failure ]
 crbug.com/591099 external/wpt/css/css-text-decor-3/text-emphasis-style-open-001.xht [ Crash Failure ]
 crbug.com/591099 external/wpt/css/css-text-decor-3/text-emphasis-style-shape-001.xht [ Crash Failure ]
@@ -6227,7 +5250,6 @@
 crbug.com/591099 external/wpt/css/css-writing-modes-3/block-flow-direction-vlr-015.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/block-flow-direction-vlr-016.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/block-flow-direction-vlr-020.xht [ Failure ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/block-flow-direction-vlr-022.xht [ Crash Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/block-flow-direction-vlr-023.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/block-flow-direction-vrl-002.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/block-flow-direction-vrl-005.xht [ Failure ]
@@ -6236,7 +5258,6 @@
 crbug.com/591099 external/wpt/css/css-writing-modes-3/block-flow-direction-vrl-012.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/block-flow-direction-vrl-013.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/block-flow-direction-vrl-019.xht [ Failure ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/block-flow-direction-vrl-021.xht [ Crash Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/block-flow-direction-vrl-024.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/block-flow-direction-vrl-026.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/block-override-004.html [ Failure ]
@@ -6317,14 +5338,11 @@
 crbug.com/591099 external/wpt/css/css-writing-modes-3/line-box-direction-vlr-010.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/line-box-direction-vlr-013.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/line-box-direction-vlr-014.xht [ Failure ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/line-box-direction-vlr-020.xht [ Crash Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/line-box-direction-vrl-002.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/line-box-direction-vrl-005.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/line-box-direction-vrl-006.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/line-box-direction-vrl-011.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/line-box-direction-vrl-012.xht [ Failure ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/line-box-direction-vrl-017.xht [ Crash ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/line-box-direction-vrl-019.xht [ Crash Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/margin-collapse-vlr-011.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/margin-collapse-vrl-010.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/margin-vlr-003.xht [ Failure ]
@@ -6342,11 +5360,9 @@
 crbug.com/591099 external/wpt/css/css-writing-modes-3/orthogonal-parent-shrink-to-fit-001g.html [ Crash ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/orthogonal-parent-shrink-to-fit-001h.html [ Crash ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/orthogonal-parent-shrink-to-fit-001i.html [ Failure ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/orthogonal-parent-shrink-to-fit-001j.html [ Crash ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/orthogonal-parent-shrink-to-fit-001k.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/orthogonal-parent-shrink-to-fit-001l.html [ Crash Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/orthogonal-parent-shrink-to-fit-001m.html [ Crash Failure ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/orthogonal-parent-shrink-to-fit-001n.html [ Crash ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/orthogonal-parent-shrink-to-fit-001o.html [ Crash Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/orthogonal-parent-shrink-to-fit-001p.html [ Crash Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/orthogonal-parent-shrink-to-fit-001q.html [ Failure ]
@@ -6426,23 +5442,6 @@
 crbug.com/591099 external/wpt/css/css-writing-modes-3/text-indent-vrl-014.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/text-indent-vrl-016.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/text-orientation-016.xht [ Failure ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/text-orientation-script-001a.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/text-orientation-script-001b.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/text-orientation-script-001c.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/text-orientation-script-001d.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/text-orientation-script-001e.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/text-orientation-script-001f.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/text-orientation-script-001g.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/text-orientation-script-001h.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/text-orientation-script-001i.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/text-orientation-script-001j.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/text-orientation-script-001k.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/text-orientation-script-001l.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/text-orientation-script-001m.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/text-orientation-script-001n.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/text-orientation-script-001o.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/text-orientation-script-001p.html [ Crash ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/text-orientation-script-001q.html [ Crash ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/vertical-alignment-002.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/vertical-alignment-004.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/vertical-alignment-005.xht [ Failure ]
@@ -6464,9 +5463,7 @@
 crbug.com/591099 external/wpt/css/css-writing-modes-3/writing-mode-vertical-rl-002.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/writing-mode-vertical-rl-003.htm [ Failure ]
 crbug.com/591099 external/wpt/css/geometry-1/interfaces.html [ Timeout ]
-crbug.com/591099 external/wpt/css/motion-1/offset-path-string.html [ Crash ]
 crbug.com/591099 external/wpt/css/selectors4/focus-display-none-001.html [ Crash ]
-crbug.com/591099 external/wpt/css/selectors4/focus-within-006.html [ Crash Failure ]
 crbug.com/591099 external/wpt/css/selectors4/focus-within-009.html [ Crash ]
 crbug.com/591099 external/wpt/css/selectors4/focus-within-display-none-001.html [ Crash ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/flexbox/flexbox-align-content-vert-001a.xhtml [ Crash Failure ]
@@ -6507,23 +5504,19 @@
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/flexbox/flexbox-whitespace-handling-001a.xhtml [ Failure ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/flexbox/flexbox-whitespace-handling-001b.xhtml [ Failure ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/flexbox/flexbox-whitespace-handling-002.xhtml [ Failure Pass ]
-crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/variables/variable-declaration-02.html [ Crash ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/variables/variable-declaration-15.html [ Failure Pass ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/variables/variable-declaration-16.html [ Failure Pass ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/variables/variable-declaration-17.html [ Failure Pass ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/variables/variable-declaration-18.html [ Failure Pass ]
-crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/variables/variable-reference-25.html [ Crash ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/writing-modes-3/dynamic-offset-vrl-002.html [ Failure ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/writing-modes-3/dynamic-offset-vrl-rtl-002.html [ Failure ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/writing-modes-3/text-combine-upright-break-inside-001.html [ Failure ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/writing-modes-3/text-combine-upright-compression-001.html [ Crash Failure ]
-crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/writing-modes-3/text-combine-upright-compression-002.html [ Crash ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/writing-modes-3/text-combine-upright-compression-003.html [ Crash Failure ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/writing-modes-3/text-combine-upright-compression-004.html [ Crash Failure ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/writing-modes-3/text-combine-upright-compression-005.html [ Crash Failure Pass ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/writing-modes-3/text-combine-upright-compression-005a.html [ Crash Failure ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/writing-modes-3/text-combine-upright-compression-006.html [ Crash Failure ]
-crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/writing-modes-3/text-combine-upright-compression-006a.html [ Crash ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/writing-modes-3/text-combine-upright-compression-007.html [ Crash Failure Pass ]
 crbug.com/591099 external/wpt/cssom-view/HTMLBody-ScrollArea_quirksmode.html [ Failure ]
 crbug.com/591099 external/wpt/cssom-view/elementFromPoint.html [ Crash ]
@@ -6589,28 +5582,27 @@
 crbug.com/591099 external/wpt/editing/other/restoration.html [ Crash ]
 crbug.com/591099 external/wpt/editing/run/backcolor.html [ Pass Timeout ]
 crbug.com/591099 external/wpt/editing/run/bold.html [ Pass Timeout ]
-crbug.com/591099 external/wpt/editing/run/delete-list-items-in-table-cell.html [ Crash ]
 crbug.com/591099 external/wpt/editing/run/fontname.html [ Pass Timeout ]
 crbug.com/591099 external/wpt/editing/run/fontsize.html [ Pass Timeout ]
 crbug.com/591099 external/wpt/editing/run/forecolor.html [ Pass Timeout ]
 crbug.com/591099 external/wpt/editing/run/formatblock.html [ Crash Failure Timeout ]
 crbug.com/591099 external/wpt/editing/run/forwarddelete.html [ Crash ]
 crbug.com/591099 external/wpt/editing/run/hilitecolor.html [ Pass Timeout ]
-crbug.com/591099 external/wpt/editing/run/indent.html [ Crash ]
+crbug.com/591099 external/wpt/editing/run/indent.html [ Crash Timeout ]
 crbug.com/591099 external/wpt/editing/run/inserthorizontalrule.html [ Crash ]
 crbug.com/591099 external/wpt/editing/run/inserthtml.html [ Crash Failure Timeout ]
 crbug.com/591099 external/wpt/editing/run/insertimage.html [ Crash ]
-crbug.com/591099 external/wpt/editing/run/insertlinebreak.html [ Crash Failure ]
-crbug.com/591099 external/wpt/editing/run/insertorderedlist.html [ Crash ]
+crbug.com/591099 external/wpt/editing/run/insertlinebreak.html [ Crash Failure Timeout ]
+crbug.com/591099 external/wpt/editing/run/insertorderedlist.html [ Crash Timeout ]
 crbug.com/591099 external/wpt/editing/run/insertparagraph.html [ Crash Failure Timeout ]
 crbug.com/591099 external/wpt/editing/run/inserttext.html [ Failure Timeout ]
-crbug.com/591099 external/wpt/editing/run/insertunorderedlist.html [ Crash ]
+crbug.com/591099 external/wpt/editing/run/insertunorderedlist.html [ Crash Timeout ]
 crbug.com/591099 external/wpt/editing/run/italic.html [ Pass Timeout ]
 crbug.com/591099 external/wpt/editing/run/justifyfull.html [ Pass Timeout ]
 crbug.com/591099 external/wpt/editing/run/justifyleft.html [ Pass Timeout ]
 crbug.com/591099 external/wpt/editing/run/justifyright.html [ Pass Timeout ]
 crbug.com/591099 external/wpt/editing/run/multitest.html [ Crash ]
-crbug.com/591099 external/wpt/editing/run/outdent.html [ Crash ]
+crbug.com/591099 external/wpt/editing/run/outdent.html [ Crash Timeout ]
 crbug.com/591099 external/wpt/editing/run/removeformat.html [ Crash ]
 crbug.com/591099 external/wpt/editing/run/strikethrough.html [ Pass Timeout ]
 crbug.com/591099 external/wpt/editing/run/subscript.html [ Pass Timeout ]
@@ -6651,12 +5643,6 @@
 crbug.com/591099 external/wpt/html/browsers/origin/relaxing-the-same-origin-restriction/document_domain_setter.html [ Crash ]
 crbug.com/591099 external/wpt/html/browsers/the-window-object/garbage-collection-and-browsing-contexts/discard_iframe_history_3.html [ Crash ]
 crbug.com/591099 external/wpt/html/browsers/the-window-object/garbage-collection-and-browsing-contexts/discard_iframe_history_4.html [ Crash ]
-crbug.com/591099 external/wpt/html/browsers/the-window-object/the-windowproxy-object/test-window-proxy-locationbar-manual.html [ Crash ]
-crbug.com/591099 external/wpt/html/browsers/the-window-object/the-windowproxy-object/test-window-proxy-menubar-manual.html [ Crash ]
-crbug.com/591099 external/wpt/html/browsers/the-window-object/the-windowproxy-object/test-window-proxy-personalbar-manual.html [ Crash ]
-crbug.com/591099 external/wpt/html/browsers/the-window-object/the-windowproxy-object/test-window-proxy-scrollbars-manual.html [ Crash ]
-crbug.com/591099 external/wpt/html/browsers/the-window-object/the-windowproxy-object/test-window-proxy-statusbar-manual.html [ Crash ]
-crbug.com/591099 external/wpt/html/browsers/the-window-object/the-windowproxy-object/test-window-proxy-toolbar-manual.html [ Crash ]
 crbug.com/591099 external/wpt/html/browsers/the-windowproxy-exotic-object/windowproxy-prototype-setting-cross-origin-domain.sub.html [ Crash ]
 crbug.com/591099 external/wpt/html/browsers/the-windowproxy-exotic-object/windowproxy-prototype-setting-cross-origin.sub.html [ Crash ]
 crbug.com/591099 external/wpt/html/browsers/the-windowproxy-exotic-object/windowproxy-prototype-setting-goes-cross-origin-domain.sub.html [ Crash ]
@@ -6691,8 +5677,6 @@
 crbug.com/591099 external/wpt/html/dom/dynamic-markup-insertion/document-write/iframe_009.html [ Crash ]
 crbug.com/591099 external/wpt/html/dom/dynamic-markup-insertion/document-write/iframe_010.html [ Crash ]
 crbug.com/591099 external/wpt/html/dom/dynamic-markup-insertion/document-write/script_013.html [ Crash ]
-crbug.com/591099 external/wpt/html/dom/elements/global-attributes/classlist-nonstring.html [ Crash ]
-crbug.com/591099 external/wpt/html/dom/elements/global-attributes/dir_auto-contained-bdi-L.html [ Failure ]
 crbug.com/591099 external/wpt/html/dom/elements/global-attributes/dir_auto-contained-textarea-L.html [ Crash Pass ]
 crbug.com/591099 external/wpt/html/dom/elements/global-attributes/dir_auto-contained-textarea-R.html [ Crash Pass ]
 crbug.com/591099 external/wpt/html/dom/elements/global-attributes/dir_auto-input-EN-L.html [ Crash Pass ]
@@ -6714,17 +5698,6 @@
 crbug.com/591099 external/wpt/html/dom/elements/global-attributes/dir_auto-input-script-N-R.html [ Crash Failure Pass ]
 crbug.com/591099 external/wpt/html/dom/elements/global-attributes/dir_auto-input-script-R.html [ Crash Pass ]
 crbug.com/591099 external/wpt/html/dom/elements/global-attributes/dir_auto-textarea-N-EN.html [ Crash Pass ]
-crbug.com/591099 external/wpt/html/dom/elements/global-attributes/dir_auto-textarea-N-between-Rs.html [ Crash Failure ]
-crbug.com/591099 external/wpt/html/dom/elements/global-attributes/dir_auto-textarea-mixed.html [ Crash Failure ]
-crbug.com/591099 external/wpt/html/dom/elements/global-attributes/dir_auto-textarea-script-N-EN.html [ Crash Failure ]
-crbug.com/591099 external/wpt/html/dom/elements/global-attributes/dir_auto-textarea-script-N-between-Rs.html [ Crash Failure ]
-crbug.com/591099 external/wpt/html/dom/elements/global-attributes/dir_auto-textarea-script-mixed.html [ Crash Failure ]
-crbug.com/591099 external/wpt/html/dom/elements/requirements-relating-to-bidirectional-algorithm-formatting-characters/dir-isolation-002c.html [ Failure ]
-crbug.com/591099 external/wpt/html/editing/dnd/events/relatedTarget-attribute-manual.html [ Crash ]
-crbug.com/591099 external/wpt/html/editing/editing-0/spelling-and-grammar-checking/spelling-markers-007.html [ Crash ]
-crbug.com/591099 external/wpt/html/editing/editing-0/spelling-and-grammar-checking/spelling-markers-008.html [ Crash ]
-crbug.com/591099 external/wpt/html/editing/editing-0/spelling-and-grammar-checking/spelling-markers-009.html [ Crash ]
-crbug.com/591099 external/wpt/html/editing/editing-0/spelling-and-grammar-checking/spelling-markers-010.html [ Crash ]
 crbug.com/591099 external/wpt/html/editing/editing-0/spelling-and-grammar-checking/user-interaction-editing-spellcheck.html [ Crash Pass ]
 crbug.com/591099 external/wpt/html/editing/focus/focus-management/focus-event-targets-simple.html [ Crash ]
 crbug.com/591099 external/wpt/html/editing/focus/processing-model/focus-fixup-rule-one-no-dialogs.html [ Crash ]
@@ -6739,37 +5712,8 @@
 crbug.com/591099 external/wpt/html/infrastructure/urls/resolving-urls/query-encoding/utf-8.html [ Crash ]
 crbug.com/591099 external/wpt/html/infrastructure/urls/resolving-urls/query-encoding/windows-1251.html [ Crash ]
 crbug.com/591099 external/wpt/html/infrastructure/urls/resolving-urls/query-encoding/windows-1252.html [ Crash ]
-crbug.com/591099 external/wpt/html/obsolete/requirements-for-implementations/the-marquee-element-0/marquee-loop.html [ Crash ]
-crbug.com/591099 external/wpt/html/obsolete/requirements-for-implementations/the-marquee-element-0/marquee-scrollamount.html [ Crash ]
-crbug.com/591099 external/wpt/html/obsolete/requirements-for-implementations/the-marquee-element-0/marquee-scrolldelay.html [ Crash ]
 crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/flow-content-0/dialog.html [ Failure ]
 crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/flow-content-0/div-align.html [ Failure ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/li-type-supported-xhtml.xhtml [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/li-type-supported.html [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/li-type-unsupported-lower-alpha.html [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/li-type-unsupported-lower-roman.html [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/li-type-unsupported-upper-alpha.html [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/li-type-unsupported-upper-roman.html [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/ol-type-supported-xhtml.xhtml [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/ol-type-supported.html [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/ol-type-unsupported-circle.html [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/ol-type-unsupported-disc.html [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/ol-type-unsupported-invalid.html [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/ol-type-unsupported-lower-alpha.html [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/ol-type-unsupported-lower-roman.html [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/ol-type-unsupported-none.html [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/ol-type-unsupported-round.html [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/ol-type-unsupported-square.html [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/ol-type-unsupported-upper-alpha.html [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/ol-type-unsupported-upper-roman.html [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/ul-type-supported-xhtml.xhtml [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/ul-type-supported.html [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/ul-type-unsupported-decimal.html [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/ul-type-unsupported-invalid.html [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/ul-type-unsupported-lower-alpha.html [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/ul-type-unsupported-lower-roman.html [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/ul-type-unsupported-upper-alpha.html [ Crash ]
-crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/lists/ul-type-unsupported-upper-roman.html [ Crash ]
 crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/tables/table-cell-width-s.html [ Failure ]
 crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/tables/table-cell-width.html [ Failure ]
 crbug.com/591099 external/wpt/html/rendering/non-replaced-elements/the-fieldset-element-0/legend-block-formatting-context.html [ Failure ]
@@ -6800,7 +5744,6 @@
 crbug.com/591099 external/wpt/html/semantics/embedded-content/the-iframe-element/change_parentage.html [ Crash ]
 crbug.com/591099 external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-load-event.html [ Crash ]
 crbug.com/591099 external/wpt/html/semantics/embedded-content/the-iframe-element/iframe-synchronously-discard.html [ Crash ]
-crbug.com/591099 external/wpt/html/semantics/embedded-content/the-iframe-element/iframe_javascript_url_01.htm [ Crash ]
 crbug.com/591099 external/wpt/html/semantics/embedded-content/the-iframe-element/same_origin_parentage.html [ Crash ]
 crbug.com/591099 external/wpt/html/semantics/embedded-content/the-img-element/current-pixel-density/error.html [ Crash ]
 crbug.com/591099 external/wpt/html/semantics/embedded-content/the-img-element/delay-load-event.html [ Crash ]
@@ -6825,8 +5768,6 @@
 crbug.com/591099 external/wpt/html/semantics/forms/constraints/form-validation-validity-tooLong.html [ Crash Pass ]
 crbug.com/591099 external/wpt/html/semantics/forms/constraints/form-validation-validity-tooShort.html [ Crash Pass ]
 crbug.com/591099 external/wpt/html/semantics/forms/constraints/form-validation-validity-typeMismatch.html [ Crash Pass ]
-crbug.com/591099 external/wpt/html/semantics/forms/constraints/form-validation-validity-valid.html [ Crash ]
-crbug.com/591099 external/wpt/html/semantics/forms/constraints/form-validation-validity-valueMissing.html [ Crash ]
 crbug.com/591099 external/wpt/html/semantics/forms/constraints/form-validation-willValidate.html [ Crash ]
 crbug.com/591099 external/wpt/html/semantics/forms/form-control-infrastructure/form.html [ Crash ]
 crbug.com/591099 external/wpt/html/semantics/forms/form-control-infrastructure/form_attribute.html [ Crash ]
@@ -6841,10 +5782,8 @@
 crbug.com/591099 external/wpt/html/semantics/forms/textfieldselection/textfieldselection-setRangeText.html [ Crash Pass ]
 crbug.com/591099 external/wpt/html/semantics/forms/textfieldselection/textfieldselection-setSelectionRange.html [ Crash ]
 crbug.com/591099 external/wpt/html/semantics/forms/the-button-element/button-activate.html [ Crash ]
-crbug.com/591099 external/wpt/html/semantics/forms/the-button-element/button-click-submits.html [ Crash ]
 crbug.com/591099 external/wpt/html/semantics/forms/the-button-element/button-menu-historical.html [ Crash ]
 crbug.com/591099 external/wpt/html/semantics/forms/the-fieldset-element/disabled-001.html [ Crash ]
-crbug.com/591099 external/wpt/html/semantics/forms/the-fieldset-element/disabled-002.xhtml [ Crash ]
 crbug.com/591099 external/wpt/html/semantics/forms/the-form-element/form-action-submission-with-base-url.html [ Crash ]
 crbug.com/591099 external/wpt/html/semantics/forms/the-form-element/form-action-submission.html [ Crash ]
 crbug.com/591099 external/wpt/html/semantics/forms/the-form-element/form-autocomplete.html [ Crash ]
@@ -6871,7 +5810,6 @@
 crbug.com/591099 external/wpt/html/semantics/forms/the-textarea-element/wrap-reflect-1a.html [ Crash Pass ]
 crbug.com/591099 external/wpt/html/semantics/forms/the-textarea-element/wrap-reflect-1b.html [ Crash Pass ]
 crbug.com/591099 external/wpt/html/semantics/grouping-content/the-li-element/grouping-li-reftest-001.html [ Crash Failure Pass ]
-crbug.com/591099 external/wpt/html/semantics/grouping-content/the-li-element/grouping-li-reftest-002.html [ Crash Failure ]
 crbug.com/591099 external/wpt/html/semantics/grouping-content/the-li-element/grouping-li-reftest-display-list-item.html [ Crash Pass ]
 crbug.com/591099 external/wpt/html/semantics/grouping-content/the-li-element/grouping-li-reftest-list-owner-menu.html [ Crash Failure ]
 crbug.com/591099 external/wpt/html/semantics/grouping-content/the-li-element/grouping-li-reftest-list-owner-mixed.html [ Crash Pass ]
@@ -6882,26 +5820,15 @@
 crbug.com/591099 external/wpt/html/semantics/grouping-content/the-li-element/grouping-li-reftest-list-owner-ul.html [ Crash Pass ]
 crbug.com/591099 external/wpt/html/semantics/grouping-content/the-li-element/grouping-li-reftest-not-being-rendered.html [ Crash Pass ]
 crbug.com/591099 external/wpt/html/semantics/grouping-content/the-li-element/grouping-li.html [ Crash ]
-crbug.com/591099 external/wpt/html/semantics/grouping-content/the-ol-element/grouping-ol-rev-reftest-001.html [ Crash Failure ]
-crbug.com/591099 external/wpt/html/semantics/grouping-content/the-ol-element/grouping-ol-start-reftest-001.html [ Crash Failure ]
-crbug.com/591099 external/wpt/html/semantics/grouping-content/the-ol-element/grouping-ol-start-reftest-002.html [ Crash Failure ]
-crbug.com/591099 external/wpt/html/semantics/grouping-content/the-ol-element/grouping-ol-type-reftest-001.html [ Crash Failure ]
-crbug.com/591099 external/wpt/html/semantics/grouping-content/the-ol-element/grouping-ol-type-reftest-002.html [ Crash Failure ]
-crbug.com/591099 external/wpt/html/semantics/grouping-content/the-ol-element/grouping-ol-type-reftest-003.html [ Crash Failure ]
 crbug.com/591099 external/wpt/html/semantics/grouping-content/the-ol-element/grouping-ol.html [ Crash ]
-crbug.com/591099 external/wpt/html/semantics/grouping-content/the-ol-element/ol.start-reflection-1.html [ Crash ]
-crbug.com/591099 external/wpt/html/semantics/grouping-content/the-ol-element/ol.start-reflection-2.html [ Crash ]
 crbug.com/591099 external/wpt/html/semantics/grouping-content/the-ol-element/reversed-1a.html [ Crash Pass ]
 crbug.com/591099 external/wpt/html/semantics/grouping-content/the-ol-element/reversed-1b.html [ Crash Pass ]
 crbug.com/591099 external/wpt/html/semantics/grouping-content/the-ol-element/reversed-1c.html [ Crash Pass ]
 crbug.com/591099 external/wpt/html/semantics/grouping-content/the-ol-element/reversed-1d.html [ Crash Pass ]
 crbug.com/591099 external/wpt/html/semantics/grouping-content/the-ol-element/reversed-1e.html [ Crash Pass ]
 crbug.com/591099 external/wpt/html/semantics/grouping-content/the-ol-element/reversed-2.html [ Crash Pass ]
-crbug.com/591099 external/wpt/html/semantics/interactive-elements/the-details-element/details.html [ Crash ]
-crbug.com/591099 external/wpt/html/semantics/interactive-elements/the-details-element/toggleEvent.html [ Crash ]
 crbug.com/591099 external/wpt/html/semantics/interactive-elements/the-dialog-element/centering.html [ Failure ]
 crbug.com/591099 external/wpt/html/semantics/interactive-elements/the-dialog-element/dialog-showModal.html [ Crash ]
-crbug.com/591099 external/wpt/html/semantics/interactive-elements/the-summary-element/activation-behavior.html [ Crash ]
 crbug.com/591099 external/wpt/html/semantics/links/links-created-by-a-and-area-elements/htmlanchorelement_noopener.html [ Crash ]
 crbug.com/591099 external/wpt/html/semantics/scripting-1/the-script-element/script-noembed-noframes-iframe.xhtml [ Crash ]
 crbug.com/591099 external/wpt/html/semantics/scripting-1/the-script-element/script-not-executed-after-shutdown.html [ Crash ]
@@ -6962,7 +5889,7 @@
 crbug.com/591099 external/wpt/html/webappapis/scripting/processing-model-2/window-onerror-with-cross-frame-event-listeners-2.html [ Crash ]
 crbug.com/591099 external/wpt/html/webappapis/scripting/processing-model-2/window-onerror-with-cross-frame-event-listeners-3.html [ Crash ]
 crbug.com/591099 external/wpt/html/webappapis/scripting/processing-model-2/window-onerror-with-cross-frame-event-listeners-4.html [ Crash ]
-crbug.com/591099 external/wpt/http/basic-auth-cache-test.html [ Crash ]
+crbug.com/591099 external/wpt/http/basic-auth-cache-test.html [ Crash Timeout ]
 crbug.com/591099 external/wpt/innerText/getter.html [ Crash ]
 crbug.com/591099 external/wpt/input-events/input-events-typing-data-manual.html [ Crash ]
 crbug.com/591099 external/wpt/media-source/mediasource-activesourcebuffers.html [ Crash ]
@@ -7036,11 +5963,6 @@
 crbug.com/591099 external/wpt/mixed-content/optionally-blockable/meta-csp/cross-origin-http/img-tag/top-level/no-redirect/opt-in-blocks.https.html [ Crash Pass ]
 crbug.com/591099 external/wpt/mixed-content/optionally-blockable/meta-csp/same-host-http/img-tag/top-level/no-redirect/opt-in-blocks.https.html [ Crash Pass ]
 crbug.com/591099 external/wpt/navigation-timing/nav2_test_frame_removed.html [ Crash ]
-crbug.com/591099 external/wpt/navigation-timing/nav2_test_navigation_type_reload.html [ Crash ]
-crbug.com/591099 external/wpt/navigation-timing/nav2_test_unloadEvents_previous_document_cross_origin.sub.html [ Crash ]
-crbug.com/591099 external/wpt/navigation-timing/nav2_test_unloadEvents_with_cross_origin_redirects.html [ Crash ]
-crbug.com/591099 external/wpt/navigation-timing/nav2_test_unloadEvents_with_previous_document.html [ Crash ]
-crbug.com/591099 external/wpt/navigation-timing/test_navigation_type_reload.html [ Crash ]
 crbug.com/591099 external/wpt/navigation-timing/test_performance_attributes_exist_in_object.html [ Crash ]
 crbug.com/591099 external/wpt/page-visibility/test_child_document.html [ Crash ]
 crbug.com/591099 external/wpt/payment-request/allowpaymentrequest/active-document-cross-origin.https.sub.html [ Crash ]
@@ -7048,33 +5970,18 @@
 crbug.com/591099 external/wpt/payment-request/allowpaymentrequest/basic.https.html [ Crash ]
 crbug.com/591099 external/wpt/payment-request/payment-request-id.https.html [ Crash ]
 crbug.com/591099 external/wpt/payment-request/payment-request-in-iframe.html [ Crash ]
-crbug.com/591099 external/wpt/pointerevents/compat/pointerevent_touch-action_two-finger_interaction-manual.html [ Crash ]
-crbug.com/591099 external/wpt/pointerevents/extension/pointerevent_coalesced_events_attributes-manual.html [ Crash ]
 crbug.com/591099 external/wpt/pointerevents/pointerevent_attributes_hoverable_pointers-manual.html [ Crash Pass Timeout ]
 crbug.com/591099 external/wpt/pointerevents/pointerevent_attributes_nohover_pointers-manual.html [ Crash Pass Timeout ]
-crbug.com/591099 external/wpt/pointerevents/pointerevent_boundary_events_in_capturing-manual.html [ Crash ]
 crbug.com/591099 external/wpt/pointerevents/pointerevent_capture_mouse-manual.html [ Crash Timeout ]
 crbug.com/591099 external/wpt/pointerevents/pointerevent_capture_suppressing_mouse-manual.html [ Crash ]
 crbug.com/591099 external/wpt/pointerevents/pointerevent_change-touch-action-onpointerdown_touch-manual.html [ Pass Timeout ]
 crbug.com/591099 external/wpt/pointerevents/pointerevent_click_during_capture-manual.html [ Crash Timeout ]
 crbug.com/591099 external/wpt/pointerevents/pointerevent_disabled_form_control-manual.html [ Timeout ]
-crbug.com/591099 external/wpt/pointerevents/pointerevent_element_haspointercapture-manual.html [ Crash ]
 crbug.com/591099 external/wpt/pointerevents/pointerevent_lostpointercapture_for_disconnected_node-manual.html [ Crash Timeout ]
 crbug.com/591099 external/wpt/pointerevents/pointerevent_lostpointercapture_is_first-manual.html [ Crash Timeout ]
-crbug.com/591099 external/wpt/pointerevents/pointerevent_pointercancel_touch-manual.html [ Timeout ]
-crbug.com/591099 external/wpt/pointerevents/pointerevent_pointerleave_after_pointercancel_touch-manual.html [ Timeout ]
-crbug.com/591099 external/wpt/pointerevents/pointerevent_pointerleave_descendant_over-manual.html [ Crash ]
 crbug.com/591099 external/wpt/pointerevents/pointerevent_pointerleave_pen-manual.html [ Failure Timeout ]
-crbug.com/591099 external/wpt/pointerevents/pointerevent_pointermove_on_chorded_mouse_button-manual.html [ Crash ]
-crbug.com/591099 external/wpt/pointerevents/pointerevent_pointerout_received_once-manual.html [ Crash ]
-crbug.com/591099 external/wpt/pointerevents/pointerevent_releasepointercapture_onpointercancel_touch-manual.html [ Crash ]
 crbug.com/591099 external/wpt/pointerevents/pointerevent_releasepointercapture_onpointerup_mouse-manual.html [ Crash ]
-crbug.com/591099 external/wpt/pointerevents/pointerevent_sequence_at_implicit_release_on_click-manual.html [ Crash ]
-crbug.com/591099 external/wpt/pointerevents/pointerevent_sequence_at_implicit_release_on_drag-manual.html [ Crash ]
-crbug.com/591099 external/wpt/pointerevents/pointerevent_setpointercapture_inactive_button_mouse-manual.html [ Crash ]
 crbug.com/591099 external/wpt/pointerevents/pointerevent_setpointercapture_relatedtarget-manual.html [ Crash Timeout ]
-crbug.com/591099 external/wpt/pointerevents/pointerevent_suppress_compat_events_on_click-manual.html [ Crash ]
-crbug.com/591099 external/wpt/pointerevents/pointerevent_suppress_compat_events_on_drag_mouse-manual.html [ Crash ]
 crbug.com/591099 external/wpt/pointerevents/pointerevent_touch-action-auto-css_touch-manual.html [ Crash Pass Timeout ]
 crbug.com/591099 external/wpt/pointerevents/pointerevent_touch-action-button-test_touch-manual.html [ Crash Timeout ]
 crbug.com/591099 external/wpt/pointerevents/pointerevent_touch-action-inherit_child-auto-child-none_touch-manual.html [ Crash Timeout ]
@@ -7097,12 +6004,7 @@
 crbug.com/591099 external/wpt/pointerevents/pointerevent_touch-action-span-test_touch-manual.html [ Crash Timeout ]
 crbug.com/591099 external/wpt/pointerevents/pointerevent_touch-action-svg-test_touch-manual.html [ Crash Timeout ]
 crbug.com/591099 external/wpt/pointerevents/pointerevent_touch-action-table-test_touch-manual.html [ Crash Timeout ]
-crbug.com/591099 external/wpt/pointerevents/pointerlock/pointerevent_movementxy-manual.html [ Crash ]
-crbug.com/591099 external/wpt/pointerevents/pointerlock/pointerevent_pointerlock_after_pointercapture-manual.html [ Crash ]
-crbug.com/591099 external/wpt/pointerevents/pointerlock/pointerevent_pointerlock_supercedes_capture-manual.html [ Crash ]
 crbug.com/591099 external/wpt/quirks-mode/blocks-ignore-line-height.html [ Failure ]
-crbug.com/591099 external/wpt/quirks-mode/hashless-hex-color.html [ Timeout ]
-crbug.com/591099 external/wpt/quirks-mode/historical/list-item-bullet-size.html [ Crash ]
 crbug.com/591099 external/wpt/quirks-mode/line-height-calculation.html [ Crash ]
 crbug.com/591099 external/wpt/quirks-mode/table-cell-width-calculation.html [ Crash ]
 crbug.com/591099 external/wpt/referrer-policy/css-integration/external-import-stylesheet.html [ Crash ]
@@ -7844,7 +6746,6 @@
 crbug.com/591099 external/wpt/service-workers/service-worker/navigation-redirect.https.html [ Crash ]
 crbug.com/591099 external/wpt/service-workers/service-worker/ready.https.html [ Crash ]
 crbug.com/591099 external/wpt/service-workers/service-worker/register-closed-window.https.html [ Crash ]
-crbug.com/591099 external/wpt/service-workers/service-worker/register-link-element.https.html [ Timeout ]
 crbug.com/591099 external/wpt/service-workers/service-worker/register-link-header.https.html [ Crash ]
 crbug.com/591099 external/wpt/service-workers/service-worker/register-same-scope-different-script-url.https.html [ Crash ]
 crbug.com/591099 external/wpt/service-workers/service-worker/registration-iframe.https.html [ Crash ]
@@ -7867,13 +6768,10 @@
 crbug.com/591099 external/wpt/uievents/mouse/mouseevent_move_button-manual.html [ Crash Timeout ]
 crbug.com/591099 external/wpt/uievents/order-of-events/focus-events/focus-automated-blink-webkit.html [ Crash ]
 crbug.com/591099 external/wpt/uievents/order-of-events/focus-events/focus-manual.html [ Crash Failure Timeout ]
-crbug.com/591099 external/wpt/uievents/order-of-events/mouse-events/mouseover-out-manual.html [ Crash ]
 crbug.com/591099 external/wpt/url/a-element-xhtml.xhtml [ Pass Timeout ]
 crbug.com/591099 external/wpt/url/a-element.html [ Pass Timeout ]
 crbug.com/591099 external/wpt/url/url-constructor.html [ Pass Timeout ]
 crbug.com/591099 external/wpt/url/url-setters.html [ Pass Timeout ]
-crbug.com/591099 external/wpt/user-timing/measure.html [ Crash ]
-crbug.com/591099 external/wpt/user-timing/measure_navigation_timing.html [ Crash ]
 crbug.com/591099 external/wpt/viewport/viewport-unscaled-scale-iframe.html [ Crash ]
 crbug.com/591099 external/wpt/viewport/viewport-unscaled-scroll-iframe.html [ Crash ]
 crbug.com/591099 external/wpt/viewport/viewport-unscaled-size-iframe.html [ Crash ]
@@ -7908,20 +6806,20 @@
 crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/bidi/bidi_ruby.html [ Crash Failure ]
 crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/evil/9_cues_overlapping_completely.html [ Crash Failure ]
 crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/evil/9_cues_overlapping_completely_all_cues_have_same_timestamp.html [ Crash Failure ]
-crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue/font_properties.html [ Crash ]
-crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue/font_shorthand.html [ Crash ]
-crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/bold_object/bold_font_properties.html [ Crash ]
-crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/bold_object/bold_font_shorthand.html [ Crash ]
-crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/class_object/class_font_properties.html [ Crash ]
-crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/class_object/class_font_shorthand.html [ Crash ]
-crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/font_properties.html [ Crash ]
-crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/font_shorthand.html [ Crash ]
-crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/italic_object/italic_font_properties.html [ Crash ]
-crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/italic_object/italic_font_shorthand.html [ Crash ]
-crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/underline_object/underline_font_properties.html [ Crash ]
-crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/underline_object/underline_font_shorthand.html [ Crash ]
-crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/voice_object/voice_font_properties.html [ Crash ]
-crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/voice_object/voice_font_shorthand.html [ Crash ]
+crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue/font_properties.html [ Crash Failure ]
+crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue/font_shorthand.html [ Crash Failure ]
+crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/bold_object/bold_font_properties.html [ Crash Failure ]
+crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/bold_object/bold_font_shorthand.html [ Crash Failure ]
+crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/class_object/class_font_properties.html [ Crash Failure ]
+crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/class_object/class_font_shorthand.html [ Crash Failure ]
+crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/font_properties.html [ Crash Failure ]
+crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/font_shorthand.html [ Crash Failure ]
+crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/italic_object/italic_font_properties.html [ Crash Failure ]
+crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/italic_object/italic_font_shorthand.html [ Crash Failure ]
+crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/underline_object/underline_font_properties.html [ Crash Failure ]
+crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/underline_object/underline_font_shorthand.html [ Crash Failure ]
+crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/voice_object/voice_font_properties.html [ Crash Failure ]
+crbug.com/591099 external/wpt/webvtt/rendering/cues-with-video/processing-model/selectors/cue_function/voice_object/voice_font_shorthand.html [ Crash Failure ]
 crbug.com/591099 external/wpt/x-frame-options/deny.sub.html [ Crash ]
 crbug.com/591099 external/wpt/x-frame-options/invalid.sub.html [ Crash ]
 crbug.com/591099 external/wpt/x-frame-options/multiple.sub.html [ Crash ]
@@ -8024,7 +6922,6 @@
 crbug.com/591099 fast/block/abspos-child-container-changes-from-relative-to-static.html [ Failure ]
 crbug.com/591099 fast/block/align-inverted-direction.html [ Failure ]
 crbug.com/591099 fast/block/available-width-changes-vertical.html [ Failure ]
-crbug.com/591099 fast/block/basic/003.html [ Crash ]
 crbug.com/591099 fast/block/basic/006.html [ Failure Pass ]
 crbug.com/591099 fast/block/basic/011.html [ Failure ]
 crbug.com/591099 fast/block/basic/013.html [ Failure ]
@@ -8040,7 +6937,6 @@
 crbug.com/591099 fast/block/basic/text-indent-rtl.html [ Failure ]
 crbug.com/591099 fast/block/basic/truncation-rtl.html [ Failure ]
 crbug.com/591099 fast/block/basic/white-space-pre-wraps.html [ Failure ]
-crbug.com/591099 fast/block/block-add-child-crash.html [ Crash ]
 crbug.com/591099 fast/block/block-not-removed-from-parent-lineboxes-crash.html [ Crash ]
 crbug.com/591099 fast/block/block-parent-with-zero-width-child.html [ Failure ]
 crbug.com/591099 fast/block/block-remove-child-delete-line-box-crash.html [ Failure ]
@@ -8094,7 +6990,7 @@
 crbug.com/591099 fast/block/float/avoiding-float-centered.html [ Failure ]
 crbug.com/591099 fast/block/float/block-with-negative-margin-clears-float.html [ Failure ]
 crbug.com/591099 fast/block/float/br-with-clear-2.html [ Failure ]
-crbug.com/591099 fast/block/float/br-with-clear.html [ Failure ]
+crbug.com/591099 fast/block/float/br-with-clear.html [ Failure Pass ]
 crbug.com/591099 fast/block/float/centered-float-avoidance-complexity.html [ Failure ]
 crbug.com/591099 fast/block/float/checkbox-and-radio-avoid-floats.html [ Failure ]
 crbug.com/591099 fast/block/float/clear-element-too-wide-for-containing-block.html [ Failure ]
@@ -8116,7 +7012,6 @@
 crbug.com/591099 fast/block/float/float-inserted-into-clean-line.html [ Failure ]
 crbug.com/591099 fast/block/float/float-list-changed-before-layout-crash.html [ Crash ]
 crbug.com/591099 fast/block/float/float-not-removed-crash2.html [ Crash Pass ]
-crbug.com/591099 fast/block/float/float-not-removed-from-first-letter.html [ Crash ]
 crbug.com/591099 fast/block/float/float-not-removed-from-next-sibling-crash.html [ Failure ]
 crbug.com/591099 fast/block/float/float-not-removed-from-next-sibling.html [ Failure Pass ]
 crbug.com/591099 fast/block/float/float-not-removed-from-next-sibling2.html [ Failure Pass ]
@@ -8170,7 +7065,6 @@
 crbug.com/591099 fast/block/float/overhanging-float-remove-from-absolute-position-block.html [ Failure Pass ]
 crbug.com/591099 fast/block/float/overhanging-float-remove-from-fixed-position-block.html [ Failure ]
 crbug.com/591099 fast/block/float/overhanging-float-remove-from-fixed-position-block2.html [ Failure ]
-crbug.com/591099 fast/block/float/overhanging-tall-block.html [ Failure ]
 crbug.com/591099 fast/block/float/overlapping-floats-paint-hittest-order-1.html [ Failure ]
 crbug.com/591099 fast/block/float/overlapping-floats-paint-hittest-order-2.html [ Failure ]
 crbug.com/591099 fast/block/float/override-property-float.html [ Failure ]
@@ -8234,7 +7128,6 @@
 crbug.com/591099 fast/block/margin-collapse/self-collapsing-block-creates-block-formatting-context.html [ Failure ]
 crbug.com/591099 fast/block/margin-collapse/self-collapsing-block-discards-margin.html [ Failure ]
 crbug.com/591099 fast/block/margin-collapse/self-collapsing-block-getting-layout-set.html [ Crash Pass ]
-crbug.com/591099 fast/block/margin-collapse/self-collapsing-block-with-float-children.html [ Crash ]
 crbug.com/591099 fast/block/margin-collapse/self-collapsing-block-with-float-descendants.html [ Failure ]
 crbug.com/591099 fast/block/margin-collapse/self-collapsing-block-with-overflow-hidden-and-float-child.html [ Failure ]
 crbug.com/591099 fast/block/margin-collapse/self-collapsing-cols-creates-block-formatting-context.html [ Failure ]
@@ -8247,23 +7140,16 @@
 crbug.com/591099 fast/block/marginbox-width-exceeds-container-width.html [ Failure ]
 crbug.com/591099 fast/block/margins-perpendicular-containing-block.html [ Failure ]
 crbug.com/591099 fast/block/marquee-width-shrinks-to-fit-in-fixed-size-container.html [ Crash Failure ]
-crbug.com/591099 fast/block/merge-anonymous-block-remove-child-crash.html [ Crash ]
-crbug.com/591099 fast/block/merge-anonymous-block-remove-child-crash2.html [ Crash ]
 crbug.com/591099 fast/block/min-max-height-percent-height-child.html [ Failure ]
 crbug.com/591099 fast/block/multicol-moves-children-with-nested-floats-2.html [ Failure ]
 crbug.com/591099 fast/block/multicol-moves-children-with-nested-floats.html [ Failure ]
-crbug.com/591099 fast/block/multicol-paint-invalidation-assert.html [ Failure ]
 crbug.com/591099 fast/block/over-constrained-auto-margin.html [ Failure ]
 crbug.com/591099 fast/block/percent-top-parent-respects-min-height.html [ Failure ]
 crbug.com/591099 fast/block/percent-top-respects-max-height.html [ Failure ]
 crbug.com/591099 fast/block/percent-top-respects-min-height.html [ Failure ]
 crbug.com/591099 fast/block/positioned-movement-assert.html [ Failure ]
-crbug.com/591099 fast/block/positioning/019.html [ Crash ]
-crbug.com/591099 fast/block/positioning/026.html [ Crash ]
-crbug.com/591099 fast/block/positioning/037.html [ Crash ]
 crbug.com/591099 fast/block/positioning/047.html [ Failure ]
 crbug.com/591099 fast/block/positioning/051.html [ Failure ]
-crbug.com/591099 fast/block/positioning/052.html [ Crash ]
 crbug.com/591099 fast/block/positioning/055.html [ Failure ]
 crbug.com/591099 fast/block/positioning/056.html [ Failure ]
 crbug.com/591099 fast/block/positioning/058.html [ Crash Failure ]
@@ -8309,7 +7195,6 @@
 crbug.com/591099 fast/block/positioning/auto/vertical-rl/005.html [ Failure ]
 crbug.com/591099 fast/block/positioning/auto/vertical-rl/006.html [ Failure ]
 crbug.com/591099 fast/block/positioning/auto/vertical-rl/007.html [ Failure ]
-crbug.com/591099 fast/block/positioning/border-change-relayout-test.html [ Crash ]
 crbug.com/591099 fast/block/positioning/child-of-absolute-with-auto-height.html [ Failure ]
 crbug.com/591099 fast/block/positioning/child-of-fixed-pos-after-movement.html [ Failure ]
 crbug.com/591099 fast/block/positioning/complex-percentage-height.html [ Crash Failure ]
@@ -8447,7 +7332,6 @@
 crbug.com/591099 fast/borders/border-image-source.html [ Failure ]
 crbug.com/591099 fast/borders/border-image-width-negative.html [ Failure ]
 crbug.com/591099 fast/borders/border-inner-bleed.html [ Failure ]
-crbug.com/591099 fast/borders/border-mixed-alpha2.html [ Crash ]
 crbug.com/591099 fast/borders/border-radius-child.html [ Failure ]
 crbug.com/591099 fast/borders/border-radius-complex-inner-double.html [ Failure ]
 crbug.com/591099 fast/borders/border-radius-complex-inner.html [ Failure ]
@@ -8458,14 +7342,9 @@
 crbug.com/591099 fast/borders/border-radius-huge-assert.html [ Failure ]
 crbug.com/591099 fast/borders/border-radius-inset-outset.html [ Failure ]
 crbug.com/591099 fast/borders/border-radius-mask-canvas-all.html [ Crash Failure ]
-crbug.com/591099 fast/borders/border-radius-mask-canvas-border.html [ Crash Failure ]
-crbug.com/591099 fast/borders/border-radius-mask-canvas-padding.html [ Crash Failure ]
 crbug.com/591099 fast/borders/border-radius-mask-canvas-with-mask.html [ Crash Failure ]
 crbug.com/591099 fast/borders/border-radius-mask-canvas-with-shadow.html [ Crash Failure ]
-crbug.com/591099 fast/borders/border-radius-mask-canvas.html [ Crash Failure ]
-crbug.com/591099 fast/borders/border-radius-mask-video-ratio.html [ Crash Failure ]
 crbug.com/591099 fast/borders/border-radius-mask-video-shadow.html [ Crash Failure ]
-crbug.com/591099 fast/borders/border-radius-mask-video.html [ Crash Failure ]
 crbug.com/591099 fast/borders/border-radius-percent.html [ Failure ]
 crbug.com/591099 fast/borders/border-radius-position.html [ Failure ]
 crbug.com/591099 fast/borders/border-radius-split-inline.html [ Failure ]
@@ -8474,7 +7353,6 @@
 crbug.com/591099 fast/borders/border-styles-split.html [ Failure ]
 crbug.com/591099 fast/borders/border-width-percent.html [ Failure ]
 crbug.com/591099 fast/borders/borderRadiusAllStylesAllCorners.html [ Failure ]
-crbug.com/591099 fast/borders/borderRadiusSolid01.html [ Crash ]
 crbug.com/591099 fast/borders/different-color-borders.html [ Failure ]
 crbug.com/591099 fast/borders/fieldsetBorderRadius.html [ Crash Failure ]
 crbug.com/591099 fast/borders/inline-mask-overlay-image-outset-vertical-rl.html [ Failure ]
@@ -8667,7 +7545,6 @@
 crbug.com/591099 fast/canvas/canvas-textMetrics-width.html [ Failure ]
 crbug.com/591099 fast/canvas/canvas-transforms-during-path.html [ Failure ]
 crbug.com/591099 fast/canvas/canvas-transforms-fillRect-shadow.html [ Crash ]
-crbug.com/591099 fast/canvas/check-stale-putImageData.html [ Crash ]
 crbug.com/591099 fast/canvas/draw-focus-if-needed-invisible-crash.html [ Crash ]
 crbug.com/591099 fast/canvas/draw-focus-if-needed-on-event.html [ Crash ]
 crbug.com/591099 fast/canvas/draw-focus-if-needed-scrolls-horiz.html [ Failure Pass ]
@@ -8757,14 +7634,11 @@
 crbug.com/591099 fast/css-generated-content/bug-106384.html [ Failure ]
 crbug.com/591099 fast/css-generated-content/bug91547.html [ Failure ]
 crbug.com/591099 fast/css-generated-content/crash-selection-editing-removes-pseudo.html [ Crash ]
-crbug.com/591099 fast/css-generated-content/details-before-after-content.html [ Crash ]
+crbug.com/591099 fast/css-generated-content/details-before-after-content.html [ Crash Failure ]
 crbug.com/591099 fast/css-generated-content/drag-state.html [ Failure ]
-crbug.com/591099 fast/css-generated-content/dynamic-apply-after-for-inline.html [ Crash ]
 crbug.com/591099 fast/css-generated-content/empty-content-with-float-crash.html [ Failure ]
-crbug.com/591099 fast/css-generated-content/empty-first-letter-with-columns-crash.html [ Crash ]
 crbug.com/591099 fast/css-generated-content/first-letter-in-nested-before-table.html [ Failure Pass ]
 crbug.com/591099 fast/css-generated-content/first-letter-in-nested-before.html [ Failure ]
-crbug.com/591099 fast/css-generated-content/floating-before-content-with-list-marker-crash.html [ Crash ]
 crbug.com/591099 fast/css-generated-content/hit-test-generated-content.html [ Failure ]
 crbug.com/591099 fast/css-generated-content/hover-style-change.html [ Failure ]
 crbug.com/591099 fast/css-generated-content/inline-display-types.html [ Failure ]
@@ -9062,29 +7936,23 @@
 crbug.com/591099 fast/css-grid-layout/setting-node-properties-to-null-during-layout-should-not-crash.html [ Failure ]
 crbug.com/591099 fast/css-grid-layout/should-not-collapse-anonymous-blocks.html [ Failure ]
 crbug.com/591099 fast/css-grid-layout/tracks-wider-min-track-breadth-crash.html [ Failure ]
-crbug.com/591099 fast/css-intrinsic-dimensions/css-tables.html [ Crash ]
 crbug.com/591099 fast/css-intrinsic-dimensions/fill-available-with-zero-width.html [ Crash Failure ]
 crbug.com/591099 fast/css-intrinsic-dimensions/fillavailable-minmax-content-inlinesize-contribution-nonreplaced-blocks.html [ Crash Failure ]
 crbug.com/591099 fast/css-intrinsic-dimensions/fit-content-container-with-replaced-child.html [ Crash Failure Pass ]
 crbug.com/591099 fast/css-intrinsic-dimensions/fitcontent-minmax-content-inlinesize-contribution-nonreplaced-blocks.html [ Crash Failure ]
 crbug.com/591099 fast/css-intrinsic-dimensions/height-css-tables.html [ Failure ]
 crbug.com/591099 fast/css-intrinsic-dimensions/height-flexbox.html [ Failure Pass ]
-crbug.com/591099 fast/css-intrinsic-dimensions/height-positioned-replaced.html [ Crash ]
 crbug.com/591099 fast/css-intrinsic-dimensions/height-positioned.html [ Crash Failure ]
 crbug.com/591099 fast/css-intrinsic-dimensions/height-property-value.html [ Failure ]
-crbug.com/591099 fast/css-intrinsic-dimensions/height-tables-collapsed.html [ Failure ]
 crbug.com/591099 fast/css-intrinsic-dimensions/height.html [ Failure ]
 crbug.com/591099 fast/css-intrinsic-dimensions/indefinite-percent-minmax-content-inlinesize-contribution-nonreplaced-blocks.html [ Failure ]
-crbug.com/591099 fast/css-intrinsic-dimensions/intrinsic-sized-absolutes.html [ Crash ]
 crbug.com/591099 fast/css-intrinsic-dimensions/intrinsic-sized-blocks.html [ Crash Failure Pass ]
-crbug.com/591099 fast/css-intrinsic-dimensions/intrinsic-sized-replaced-absolutes.html [ Crash ]
 crbug.com/591099 fast/css-intrinsic-dimensions/max-width-constrained.html [ Crash Failure Pass ]
 crbug.com/591099 fast/css-intrinsic-dimensions/max-width-unconstrained.html [ Crash Failure ]
 crbug.com/591099 fast/css-intrinsic-dimensions/maxcontent-minmax-content-inlinesize-contribution-nonreplaced-blocks.html [ Crash Failure Pass ]
 crbug.com/591099 fast/css-intrinsic-dimensions/min-width.html [ Crash Failure ]
 crbug.com/591099 fast/css-intrinsic-dimensions/mincontent-minmax-content-inlinesize-contribution-nonreplaced-blocks.html [ Crash Failure Pass ]
 crbug.com/591099 fast/css-intrinsic-dimensions/resize-inside-percent-width-overflow-hidden.html [ Failure ]
-crbug.com/591099 fast/css-intrinsic-dimensions/tables.html [ Crash ]
 crbug.com/591099 fast/css-intrinsic-dimensions/width-avoid-floats.html [ Crash Failure ]
 crbug.com/591099 fast/css-intrinsic-dimensions/width-property-value.html [ Failure ]
 crbug.com/591099 fast/css-intrinsic-dimensions/width-shrinks-avoid-floats.html [ Crash Failure ]
@@ -9237,10 +8105,8 @@
 crbug.com/591099 fast/css/counters/invalidate-cached-counter-node.html [ Failure ]
 crbug.com/591099 fast/css/counters/nesting.html [ Failure ]
 crbug.com/591099 fast/css/counters/remove-anonymous-block-wrapper-crash.html [ Crash Failure ]
-crbug.com/591099 fast/css/counters/reparent-table-children-with-counters-crash.html [ Crash ]
 crbug.com/591099 fast/css/crash-corner-present.html [ Failure ]
 crbug.com/591099 fast/css/crash-in-attachFirstLetterTextLayoutObjects.html [ Crash ]
-crbug.com/591099 fast/css/crash-inherit-value-font-family.html [ Crash ]
 crbug.com/591099 fast/css/crash-layout-detached-document.html [ Crash ]
 crbug.com/591099 fast/css/create_element_align.xhtml [ Failure ]
 crbug.com/591099 fast/css/css-imports.html [ Failure ]
@@ -9263,7 +8129,6 @@
 crbug.com/591099 fast/css/csstext-of-content-string.html [ Failure ]
 crbug.com/591099 fast/css/cubic-bezier-with-multiple-calcs-crash.html [ Failure ]
 crbug.com/591099 fast/css/cue-serialize.html [ Failure ]
-crbug.com/591099 fast/css/cursor-image-list-item-crash.html [ Crash ]
 crbug.com/591099 fast/css/cursor-parsing-image-set.html [ Failure ]
 crbug.com/591099 fast/css/cursor-parsing-quirks.html [ Failure ]
 crbug.com/591099 fast/css/cursor-parsing.html [ Failure ]
@@ -9298,7 +8163,6 @@
 crbug.com/591099 fast/css/find-next-layer.html [ Failure ]
 crbug.com/591099 fast/css/first-child-pseudo-class.html [ Failure ]
 crbug.com/591099 fast/css/first-letter-block-form-controls-crash.html [ Crash Failure ]
-crbug.com/591099 fast/css/first-letter-capitalized-edit-select-crash.html [ Crash ]
 crbug.com/591099 fast/css/first-letter-capitalized.html [ Failure ]
 crbug.com/591099 fast/css/first-letter-crash-document-disposal.html [ Crash Failure ]
 crbug.com/591099 fast/css/first-letter-detach.html [ Failure ]
@@ -9345,7 +8209,6 @@
 crbug.com/591099 fast/css/font-face-src-parsing.html [ Failure ]
 crbug.com/591099 fast/css/font-face-synthetic-bold-italic-for-locally-installed.html [ Failure ]
 crbug.com/591099 fast/css/font-face-synthetic-bold-italic.html [ Failure ]
-crbug.com/591099 fast/css/font-face-unicode-range-ligatures.html [ Failure ]
 crbug.com/591099 fast/css/font-face-unicode-range-load.html [ Failure ]
 crbug.com/591099 fast/css/font-face-unicode-range-monospace.html [ Failure ]
 crbug.com/591099 fast/css/font-face-unicode-range-overlap-load.html [ Failure ]
@@ -9450,7 +8313,6 @@
 crbug.com/591099 fast/css/hover-active-drag.html [ Failure ]
 crbug.com/591099 fast/css/hover-active-quirks.html [ Failure ]
 crbug.com/591099 fast/css/hover-affects-ancestor.html [ Crash Failure ]
-crbug.com/591099 fast/css/hover-affects-child.html [ Crash ]
 crbug.com/591099 fast/css/hover-after-clicking-embed.html [ Failure ]
 crbug.com/591099 fast/css/hover-after-drag.html [ Failure ]
 crbug.com/591099 fast/css/hover-display-block.html [ Failure ]
@@ -9646,7 +8508,6 @@
 crbug.com/591099 fast/css/nth-child-dynamic.html [ Failure ]
 crbug.com/591099 fast/css/nth-child-implied-step.html [ Failure ]
 crbug.com/591099 fast/css/nth-child-n.html [ Failure ]
-crbug.com/591099 fast/css/nth-child-negative-a-param.html [ Crash ]
 crbug.com/591099 fast/css/nth-child-no-mutations.html [ Failure ]
 crbug.com/591099 fast/css/nth-child-odd-case-insensitive.html [ Failure ]
 crbug.com/591099 fast/css/nth-child-of-pseudo-element-assert.html [ Failure ]
@@ -9693,7 +8554,6 @@
 crbug.com/591099 fast/css/parsing-object-position.html [ Failure ]
 crbug.com/591099 fast/css/parsing-text-rendering.html [ Failure ]
 crbug.com/591099 fast/css/parsing-webkit-font-smoothing.html [ Failure ]
-crbug.com/591099 fast/css/pending-images-crash.html [ Crash ]
 crbug.com/591099 fast/css/pending-stylesheet-repaint.html [ Failure ]
 crbug.com/591099 fast/css/pendingStylesheetFontSize.html [ Failure ]
 crbug.com/591099 fast/css/percent-character-as-value.html [ Failure ]
@@ -9720,7 +8580,6 @@
 crbug.com/591099 fast/css/pseudo-element-backdrop-hit-test.html [ Failure ]
 crbug.com/591099 fast/css/pseudo-element-line-break.html [ Failure ]
 crbug.com/591099 fast/css/pseudo-element-opagedxy-crash.html [ Failure ]
-crbug.com/591099 fast/css/pseudo-element-selector-scrollbar-hover.html [ Failure ]
 crbug.com/591099 fast/css/pseudo-empty-adjacent-dynamic.html [ Failure ]
 crbug.com/591099 fast/css/pseudo-empty-display-none.html [ Failure ]
 crbug.com/591099 fast/css/pseudo-first-line-border-width.html [ Crash Failure ]
@@ -9750,7 +8609,6 @@
 crbug.com/591099 fast/css/pseudo-valid-dynamic.html [ Crash Failure ]
 crbug.com/591099 fast/css/pseudo-valid-unapplied.html [ Failure ]
 crbug.com/591099 fast/css/pseudostyle-anonymous-text.html [ Failure ]
-crbug.com/591099 fast/css/quirks-mode-ignore-list-item.html [ Crash ]
 crbug.com/591099 fast/css/quotes-computedstyle.html [ Failure ]
 crbug.com/591099 fast/css/readonly-pseudoclass-opera-001.html [ Crash Failure ]
 crbug.com/591099 fast/css/readonly-pseudoclass-opera-002.html [ Crash Failure ]
@@ -9759,7 +8617,6 @@
 crbug.com/591099 fast/css/readonly-pseudoclass-opera-005.html [ Crash Failure ]
 crbug.com/591099 fast/css/recalc-inherit-001.html [ Failure ]
 crbug.com/591099 fast/css/recursive-delay-update-scroll.html [ Failure ]
-crbug.com/591099 fast/css/relative-position-replaced-in-table-display-crash.html [ Crash ]
 crbug.com/591099 fast/css/relative-positioned-block-crash.html [ Crash ]
 crbug.com/591099 fast/css/relative-positioned-block-nested-with-inline-parent-dynamic-removed.html [ Failure ]
 crbug.com/591099 fast/css/relative-positioned-block-nested-with-inline-parent-dynamic.html [ Failure ]
@@ -9813,7 +8670,6 @@
 crbug.com/591099 fast/css/shorthands-four-values.html [ Failure ]
 crbug.com/591099 fast/css/sibling-selectors.html [ Failure ]
 crbug.com/591099 fast/css/simple-selector-chain-parsing.html [ Failure Pass ]
-crbug.com/591099 fast/css/small-caps-crash.html [ Crash ]
 crbug.com/591099 fast/css/square-button-appearance.html [ Failure Pass ]
 crbug.com/591099 fast/css/stale-style-selector-crash-1.html [ Failure ]
 crbug.com/591099 fast/css/stale-style-selector-crash-2.html [ Failure ]
@@ -9852,7 +8708,6 @@
 crbug.com/591099 fast/css/table-text-align-strict.html [ Failure Pass ]
 crbug.com/591099 fast/css/target-fragment-match.html [ Failure ]
 crbug.com/591099 fast/css/test-setting-canvas-color.html [ Failure ]
-crbug.com/591099 fast/css/text-align-inherit-webkit-match-parent.html [ Crash ]
 crbug.com/591099 fast/css/text-align-webkit-match-parent.html [ Failure ]
 crbug.com/591099 fast/css/text-align.html [ Failure ]
 crbug.com/591099 fast/css/text-decorations-on-first-line-and-containing-block.html [ Failure ]
@@ -9873,8 +8728,6 @@
 crbug.com/591099 fast/css/text-overflow-ellipsis-vertical-select.html [ Failure ]
 crbug.com/591099 fast/css/text-overflow-ellipsis-vertical.html [ Failure ]
 crbug.com/591099 fast/css/text-overflow-ellipsis.html [ Failure ]
-crbug.com/591099 fast/css/text-overflow-input-focus-placeholder.html [ Failure ]
-crbug.com/591099 fast/css/text-overflow-input-focus-value.html [ Crash Failure ]
 crbug.com/591099 fast/css/text-overflow-input.html [ Crash Failure ]
 crbug.com/591099 fast/css/text-rendering-priority.html [ Failure ]
 crbug.com/591099 fast/css/text-rendering.html [ Failure ]
@@ -9894,7 +8747,6 @@
 crbug.com/591099 fast/css/unused-data-url-fontface.html [ Failure ]
 crbug.com/591099 fast/css/uri-token-parsing.html [ Failure ]
 crbug.com/591099 fast/css/url-with-multi-byte-unicode-escape.html [ Failure ]
-crbug.com/591099 fast/css/usecounter-summary-display-block.html [ Crash ]
 crbug.com/591099 fast/css/variables/matched-properties-cache-is-disabled.html [ Crash ]
 crbug.com/591099 fast/css/vertical-align-baseline-rowspan-003.htm [ Failure ]
 crbug.com/591099 fast/css/vertical-align-baseline-rowspan-004.htm [ Failure ]
@@ -9927,7 +8779,6 @@
 crbug.com/591099 fast/css/zoom-in-length-round-trip.html [ Failure ]
 crbug.com/591099 fast/css/zoom-on-nested-scroll-crash.html [ Failure ]
 crbug.com/591099 fast/css/zoom-property-parsing.html [ Failure ]
-crbug.com/591099 fast/css/zoomed-intrinsic-width.html [ Crash ]
 crbug.com/591099 fast/css3-text/css3-text-align-last/getComputedStyle/getComputedStyle-text-align-last-inherited.html [ Failure ]
 crbug.com/591099 fast/css3-text/css3-text-align-last/getComputedStyle/getComputedStyle-text-align-last.html [ Failure ]
 crbug.com/591099 fast/css3-text/css3-text-align-last/text-align-last.html [ Failure ]
@@ -9944,7 +8795,6 @@
 crbug.com/591099 fast/css3-text/css3-text-decoration/text-underline-position/text-underline-first-line-decoration.html [ Crash Failure ]
 crbug.com/591099 fast/css3-text/css3-text-decoration/text-underline-position/text-underline-position-auto.html [ Failure ]
 crbug.com/591099 fast/css3-text/css3-text-decoration/text-underline-position/text-underline-position-cjk.html [ Crash Failure ]
-crbug.com/591099 fast/css3-text/css3-text-decoration/text-underline-position/text-underline-position-mixed-fonts.html [ Crash ]
 crbug.com/591099 fast/css3-text/css3-text-decoration/text-underline-position/text-underline-position-under-out-of-flow.html [ Failure ]
 crbug.com/591099 fast/css3-text/css3-text-decoration/text-underline-position/text-underline-position-under-vertical.html [ Failure Pass ]
 crbug.com/591099 fast/css3-text/css3-text-decoration/text-underline-position/text-underline-position-under.html [ Failure ]
@@ -10048,7 +8898,6 @@
 crbug.com/591099 fast/dom/Document/createElement-invalid-names.html [ Failure ]
 crbug.com/591099 fast/dom/Document/createElement-valid-names.html [ Failure ]
 crbug.com/591099 fast/dom/Document/createElementNS-namespace-err.html [ Crash Failure ]
-crbug.com/591099 fast/dom/Document/createProcessingInstruction-invalid-target.html [ Crash ]
 crbug.com/591099 fast/dom/Document/designMode-non-html.html [ Failure ]
 crbug.com/591099 fast/dom/Document/doc-open-while-parsing.html [ Failure ]
 crbug.com/591099 fast/dom/Document/document-charset.html [ Failure ]
@@ -10233,7 +9082,6 @@
 crbug.com/591099 fast/dom/HTMLInputElement/cloned-input-checked-state.html [ Failure ]
 crbug.com/591099 fast/dom/HTMLInputElement/duplicate-element-names.html [ Crash Failure ]
 crbug.com/591099 fast/dom/HTMLInputElement/input-checked-reset.html [ Failure ]
-crbug.com/591099 fast/dom/HTMLInputElement/input-hidden-value.html [ Crash ]
 crbug.com/591099 fast/dom/HTMLInputElement/input-image-alt-text.html [ Crash Failure ]
 crbug.com/591099 fast/dom/HTMLInputElement/input-size-attribute.html [ Failure ]
 crbug.com/591099 fast/dom/HTMLInputElement/input-slider-update-styled.html [ Failure ]
@@ -10343,9 +9191,7 @@
 crbug.com/591099 fast/dom/MutationObserver/delivery-order.html [ Failure ]
 crbug.com/591099 fast/dom/MutationObserver/disconnect-cancel-pending.html [ Failure ]
 crbug.com/591099 fast/dom/MutationObserver/document-fragment-insertion.html [ Failure ]
-crbug.com/591099 fast/dom/MutationObserver/end-of-task-delivery.html [ Crash ]
 crbug.com/591099 fast/dom/MutationObserver/filesystem-callback-delivery.html [ Failure ]
-crbug.com/591099 fast/dom/MutationObserver/inline-event-listener.html [ Crash ]
 crbug.com/591099 fast/dom/MutationObserver/mutate-during-delivery.html [ Failure ]
 crbug.com/591099 fast/dom/MutationObserver/mutation-and-deletion-race.html [ Failure ]
 crbug.com/591099 fast/dom/MutationObserver/mutation-observer-constructor.html [ Failure ]
@@ -10489,7 +9335,6 @@
 crbug.com/591099 fast/dom/Window/HTMLBodyElement-window-eventListener-attributes.html [ Failure ]
 crbug.com/591099 fast/dom/Window/HTMLFrameSetElement-window-eventListener-attributes.html [ Failure ]
 crbug.com/591099 fast/dom/Window/Location/set-location-after-close.html [ Failure ]
-crbug.com/591099 fast/dom/Window/anonymous-slot-with-changes.html [ Crash ]
 crbug.com/591099 fast/dom/Window/attr-constructor.html [ Failure ]
 crbug.com/591099 fast/dom/Window/btoa-pnglet.html [ Failure ]
 crbug.com/591099 fast/dom/Window/clear-timeout.html [ Failure ]
@@ -10544,7 +9389,6 @@
 crbug.com/591099 fast/dom/Window/window-constructor-settable.html [ Failure ]
 crbug.com/591099 fast/dom/Window/window-custom-prototype.html [ Failure ]
 crbug.com/591099 fast/dom/Window/window-early-properties-xhr.html [ Failure ]
-crbug.com/591099 fast/dom/Window/window-focus-self.html [ Crash ]
 crbug.com/591099 fast/dom/Window/window-frames-self-referential.html [ Failure ]
 crbug.com/591099 fast/dom/Window/window-function-frame-getter-precedence.html [ Failure ]
 crbug.com/591099 fast/dom/Window/window-function-name-getter-precedence.html [ Failure ]
@@ -10558,7 +9402,6 @@
 crbug.com/591099 fast/dom/Window/window-postmessage-args.html [ Failure ]
 crbug.com/591099 fast/dom/Window/window-postmessage-clone-deep-array.html [ Crash Failure ]
 crbug.com/591099 fast/dom/Window/window-postmessage-clone-frames.html [ Crash Pass ]
-crbug.com/591099 fast/dom/Window/window-postmessage-clone-really-deep-array.html [ Crash ]
 crbug.com/591099 fast/dom/Window/window-postmessage-clone.html [ Crash Pass ]
 crbug.com/591099 fast/dom/Window/window-properties-device-orientation.html [ Failure ]
 crbug.com/591099 fast/dom/Window/window-properties-geolocation.html [ Failure ]
@@ -10720,7 +9563,6 @@
 crbug.com/591099 fast/dom/domListEnumeration.html [ Crash ]
 crbug.com/591099 fast/dom/domstring-attribute-reflection.html [ Timeout ]
 crbug.com/591099 fast/dom/domtimestamp-is-number.html [ Failure ]
-crbug.com/591099 fast/dom/duplicate-ids.html [ Crash ]
 crbug.com/591099 fast/dom/element-attribute-js-null.html [ Timeout ]
 crbug.com/591099 fast/dom/element-bounding-client-rect-relative-to-viewport.html [ Failure ]
 crbug.com/591099 fast/dom/elementFromPoint-relative-to-viewport.html [ Crash ]
@@ -10833,7 +9675,6 @@
 crbug.com/591099 fast/dom/javascript-backslash.html [ Crash Failure ]
 crbug.com/591099 fast/dom/javascript-url-crash-function.html [ Failure ]
 crbug.com/591099 fast/dom/javascript-url-exception-isolation.html [ Failure ]
-crbug.com/591099 fast/dom/left-overflow-in-ltr.html [ Crash Failure ]
 crbug.com/591099 fast/dom/legend-control-character.html [ Failure ]
 crbug.com/591099 fast/dom/legend-display-inline.html [ Failure ]
 crbug.com/591099 fast/dom/length-attribute-mapping.html [ Failure ]
@@ -10912,8 +9753,6 @@
 crbug.com/591099 fast/dom/search-shadow-host-crash.html [ Crash ]
 crbug.com/591099 fast/dom/serialize-attribute.xhtml [ Failure ]
 crbug.com/591099 fast/dom/set-innerHTML.xhtml [ Crash Failure ]
-crbug.com/591099 fast/dom/set-outer-html.html [ Crash Failure ]
-crbug.com/591099 fast/dom/set-outer-text.html [ Crash Failure ]
 crbug.com/591099 fast/dom/setAttribute-using-initial-input-value.html [ Failure ]
 crbug.com/591099 fast/dom/setAttributeNS-empty-namespace.html [ Failure ]
 crbug.com/591099 fast/dom/setAttributeNS-namespace-errors.html [ Failure ]
@@ -10944,7 +9783,6 @@
 crbug.com/591099 fast/dom/shadow/content-reprojection-fallback-crash.html [ Failure ]
 crbug.com/591099 fast/dom/shadow/content-reprojection-recalc.html [ Failure ]
 crbug.com/591099 fast/dom/shadow/content-selector-query.html [ Failure ]
-crbug.com/591099 fast/dom/shadow/cppevent-input-in-shadow.html [ Crash Failure ]
 crbug.com/591099 fast/dom/shadow/custom-pseudo-in-selector-api.html [ Failure ]
 crbug.com/591099 fast/dom/shadow/details-summary-distributed.html [ Crash Pass ]
 crbug.com/591099 fast/dom/shadow/disconnected-distribution-cycle.html [ Failure ]
@@ -10954,7 +9792,6 @@
 crbug.com/591099 fast/dom/shadow/drag-and-drop-in-shadow.html [ Failure ]
 crbug.com/591099 fast/dom/shadow/drag-and-drop-in-user-agent-shadow.html [ Failure ]
 crbug.com/591099 fast/dom/shadow/drag-to-meter-in-shadow-crash.html [ Failure ]
-crbug.com/591099 fast/dom/shadow/drop-event-for-input-in-shadow.html [ Failure ]
 crbug.com/591099 fast/dom/shadow/elements-in-frameless-document.html [ Failure ]
 crbug.com/591099 fast/dom/shadow/event-path-after-deleting-tree-scope-crash.html [ Failure ]
 crbug.com/591099 fast/dom/shadow/event-path-after-iframe-removed.html [ Crash ]
@@ -10993,7 +9830,6 @@
 crbug.com/591099 fast/dom/shadow/iframe-shadow.html [ Failure ]
 crbug.com/591099 fast/dom/shadow/inner-scope-important-wins.html [ Failure ]
 crbug.com/591099 fast/dom/shadow/input-shadow-nochange.html [ Failure ]
-crbug.com/591099 fast/dom/shadow/make-marquee-bold-by-exec-command-crash.html [ Crash ]
 crbug.com/591099 fast/dom/shadow/move-style-scoped-to-another-shadowroot-crash.html [ Failure ]
 crbug.com/591099 fast/dom/shadow/multiple-host-pseudos-in-compound.html [ Failure ]
 crbug.com/591099 fast/dom/shadow/multiple-shadowroot-adopt.html [ Failure ]
@@ -11003,7 +9839,6 @@
 crbug.com/591099 fast/dom/shadow/normalize-progress-element-crash.html [ Crash Failure ]
 crbug.com/591099 fast/dom/shadow/offset-parent-does-not-leak-ua-shadow.html [ Failure ]
 crbug.com/591099 fast/dom/shadow/offsetWidth-host-style-change.html [ Failure ]
-crbug.com/591099 fast/dom/shadow/ol-with-distribution-recalc-crash.html [ Crash ]
 crbug.com/591099 fast/dom/shadow/olderShadowRoot.html [ Failure ]
 crbug.com/591099 fast/dom/shadow/outer-scope-lower-specificity-wins.html [ Failure ]
 crbug.com/591099 fast/dom/shadow/pseudo-host-parameter-matches-shadow-host.html [ Failure ]
@@ -11045,7 +9880,6 @@
 crbug.com/591099 fast/dom/shadow/shadow-root-new.html [ Failure ]
 crbug.com/591099 fast/dom/shadow/shadow-selection-detach-crash.html [ Failure ]
 crbug.com/591099 fast/dom/shadow/shadow-tree-styles-select-host.html [ Crash Failure ]
-crbug.com/591099 fast/dom/shadow/shadow-ul-li.html [ Crash ]
 crbug.com/591099 fast/dom/shadow/shadowdom-dynamic-styling.html [ Failure ]
 crbug.com/591099 fast/dom/shadow/shadowdom-for-textarea-only-shadow.html [ Crash Pass ]
 crbug.com/591099 fast/dom/shadow/shadowdom-for-textarea-with-attribute.html [ Crash Pass ]
@@ -11072,7 +9906,6 @@
 crbug.com/591099 fast/dom/shadow/tree-scope-crash.html [ Crash Failure ]
 crbug.com/591099 fast/dom/shadow/update-text-of-style-in-shadow-dom.html [ Failure ]
 crbug.com/591099 fast/dom/shadow/user-modify-inheritance.html [ Failure ]
-crbug.com/591099 fast/dom/shadow/wheel-event-on-input-in-shadow-dom.html [ Failure ]
 crbug.com/591099 fast/dom/shared-inline-style-after-node-removal.html [ Failure ]
 crbug.com/591099 fast/dom/simultaneouslyRegsiteredTimerFireOrder.html [ Failure ]
 crbug.com/591099 fast/dom/space-to-text.html [ Failure ]
@@ -11172,7 +10005,6 @@
 crbug.com/591099 fast/dynamic/positioned-movement-with-positioned-children.html [ Failure ]
 crbug.com/591099 fast/dynamic/recursive-layout.html [ Failure ]
 crbug.com/591099 fast/dynamic/selection-highlight-adjust.html [ Failure ]
-crbug.com/591099 fast/dynamic/static-to-relative-with-absolute-child.html [ Crash ]
 crbug.com/591099 fast/dynamic/staticY-marking-parents-regression.html [ Failure ]
 crbug.com/591099 fast/dynamic/staticY.html [ Failure Pass ]
 crbug.com/591099 fast/dynamic/subtree-boundary-percent-height.html [ Failure ]
@@ -11248,7 +10080,6 @@
 crbug.com/591099 fast/encoding/parser-tests-90.html [ Crash Failure ]
 crbug.com/591099 fast/encoding/parser-tests.html [ Crash Failure ]
 crbug.com/591099 fast/encoding/percent-escaping.html [ Failure ]
-crbug.com/591099 fast/encoding/preload-encoding.html [ Crash Failure ]
 crbug.com/591099 fast/encoding/pseudo-tags-in-attributes.html [ Failure ]
 crbug.com/591099 fast/encoding/pseudo-xml-2.html [ Failure ]
 crbug.com/591099 fast/encoding/pseudo-xml-3.html [ Failure ]
@@ -11316,7 +10147,6 @@
 crbug.com/591099 fast/events/clear-drag-state.html [ Failure ]
 crbug.com/591099 fast/events/clear-edit-drag-state.html [ Failure ]
 crbug.com/591099 fast/events/click-after-mousedown-cancel.html [ Failure ]
-crbug.com/591099 fast/events/click-anchor-refocus-window.html [ Failure ]
 crbug.com/591099 fast/events/click-focus-anchor.html [ Failure ]
 crbug.com/591099 fast/events/click-focus-svganchor-has-ring.html [ Failure ]
 crbug.com/591099 fast/events/click-over-descendant-elements.html [ Crash ]
@@ -11375,7 +10205,6 @@
 crbug.com/591099 fast/events/dispatch-synthetic-mouseevent.html [ Failure ]
 crbug.com/591099 fast/events/dispatch-to-function-with-handle-event.html [ Failure ]
 crbug.com/591099 fast/events/dispatch-to-handle-event.html [ Failure ]
-crbug.com/591099 fast/events/display-none-on-focus-crash.html [ Crash ]
 crbug.com/591099 fast/events/document-elementFromPoint.html [ Failure Pass ]
 crbug.com/591099 fast/events/dom-character-data-modified-textarea-crash.html [ Crash Pass ]
 crbug.com/591099 fast/events/domactivate-sets-underlying-click-event-as-handled.html [ Crash ]
@@ -11386,7 +10215,6 @@
 crbug.com/591099 fast/events/drag-and-drop-autoscroll-mainframe.html [ Crash Pass Timeout ]
 crbug.com/591099 fast/events/drag-and-drop-autoscroll.html [ Failure ]
 crbug.com/591099 fast/events/drag-and-drop-dataTransfer-types-nocrash.html [ Failure ]
-crbug.com/591099 fast/events/drag-and-drop-event-properties.html [ Crash ]
 crbug.com/591099 fast/events/drag-and-drop-fire-drag-dragover.html [ Failure ]
 crbug.com/591099 fast/events/drag-and-drop-set-drag-data-arguments.html [ Failure ]
 crbug.com/591099 fast/events/drag-and-drop-subframe-dataTransfer.html [ Crash ]
@@ -11396,7 +10224,6 @@
 crbug.com/591099 fast/events/drag-dataTransferItemList.html [ Failure ]
 crbug.com/591099 fast/events/drag-downloadURL.html [ Failure ]
 crbug.com/591099 fast/events/drag-dragend-detaches.html [ Failure ]
-crbug.com/591099 fast/events/drag-file-crash.html [ Crash ]
 crbug.com/591099 fast/events/drag-image-filename.html [ Timeout ]
 crbug.com/591099 fast/events/drag-in-frames.html [ Crash Failure ]
 crbug.com/591099 fast/events/drag-link.html [ Failure ]
@@ -11445,7 +10272,7 @@
 crbug.com/591099 fast/events/fire-scroll-event.html [ Failure ]
 crbug.com/591099 fast/events/flags-unset-on-init-event.html [ Failure ]
 crbug.com/591099 fast/events/focus-change-assertion.html [ Crash ]
-crbug.com/591099 fast/events/focus-change-crash.html [ Failure ]
+crbug.com/591099 fast/events/focus-change-crash.html [ Crash Failure ]
 crbug.com/591099 fast/events/focus-change-crash2.html [ Crash ]
 crbug.com/591099 fast/events/focus-change-no-layout.html [ Failure Pass ]
 crbug.com/591099 fast/events/focus-click-on-non-mouse-focusable-element.html [ Failure ]
@@ -11488,10 +10315,9 @@
 crbug.com/591099 fast/events/inputevents/before-input-order-typing-command.html [ Crash ]
 crbug.com/591099 fast/events/inputevents/before-input-ranges.html [ Crash ]
 crbug.com/591099 fast/events/inputevents/beforeinput-remove-iframe-crash.html [ Crash ]
-crbug.com/591099 fast/events/inputevents/input-event-event-listener.html [ Timeout ]
 crbug.com/591099 fast/events/inputevents/inputevent-cut-paste.html [ Failure ]
 crbug.com/591099 fast/events/inputevents/inputevent-data-keyboard.html [ Failure ]
-crbug.com/591099 fast/events/inputevents/inputevent-drag-drop.html [ Crash ]
+crbug.com/591099 fast/events/inputevents/inputevent-drag-drop.html [ Crash Failure ]
 crbug.com/591099 fast/events/inputevents/inputevent-execcommand.html [ Failure ]
 crbug.com/591099 fast/events/inputevents/inputevent-keyboard.html [ Crash ]
 crbug.com/591099 fast/events/inputevents/inputevent-spellcheck.html [ Crash Pass ]
@@ -11521,7 +10347,6 @@
 crbug.com/591099 fast/events/keydown-remove-frame.html [ Crash ]
 crbug.com/591099 fast/events/keyevent-iframe-removed-crash.html [ Failure ]
 crbug.com/591099 fast/events/keypress-focus-change.html [ Failure ]
-crbug.com/591099 fast/events/keypress-insert-tab.html [ Failure ]
 crbug.com/591099 fast/events/keypress-removed-node.html [ Crash ]
 crbug.com/591099 fast/events/main-world-does-not-override-keystate.html [ Failure ]
 crbug.com/591099 fast/events/max-tabindex-focus.html [ Crash ]
@@ -11573,7 +10398,6 @@
 crbug.com/591099 fast/events/mouse-cursor-no-mousemove.html [ Failure ]
 crbug.com/591099 fast/events/mouse-cursor-style-change-iframe.html [ Failure ]
 crbug.com/591099 fast/events/mouse-double-triple-click-should-not-select-next-node-for-user-select-none.html [ Failure ]
-crbug.com/591099 fast/events/mouse-down-on-pseudo-element-remove-crash.html [ Crash ]
 crbug.com/591099 fast/events/mouse-drag-from-frame-to-other-frame.html [ Crash Failure ]
 crbug.com/591099 fast/events/mouse-drag-from-frame.html [ Crash Failure ]
 crbug.com/591099 fast/events/mouse-event-buttons-attribute.html [ Timeout ]
@@ -11850,7 +10674,6 @@
 crbug.com/591099 fast/events/touch/multi-touch-inside-nested-iframes.html [ Failure ]
 crbug.com/591099 fast/events/touch/multi-touch-partial-sequence.html [ Failure ]
 crbug.com/591099 fast/events/touch/page-scaled-touch-gesture-click.html [ Failure ]
-crbug.com/591099 fast/events/touch/scroll-without-mouse-lacks-mousemove-events.html [ Failure ]
 crbug.com/591099 fast/events/touch/send-oncancel-event.html [ Failure ]
 crbug.com/591099 fast/events/touch/tap-highlight-color.html [ Failure ]
 crbug.com/591099 fast/events/touch/touch-action-range-input-crash.html [ Crash ]
@@ -12014,7 +10837,6 @@
 crbug.com/591099 fast/forms/ValidityState-typeMismatch-email.html [ Failure ]
 crbug.com/591099 fast/forms/ValidityState-typeMismatch-url.html [ Failure ]
 crbug.com/591099 fast/forms/access-key-case-insensitive.html [ Failure ]
-crbug.com/591099 fast/forms/access-key-for-all-elements.html [ Crash ]
 crbug.com/591099 fast/forms/access-key-mutated.html [ Failure ]
 crbug.com/591099 fast/forms/access-key.html [ Crash Failure ]
 crbug.com/591099 fast/forms/activate-and-disabled-elements.html [ Failure ]
@@ -12025,7 +10847,6 @@
 crbug.com/591099 fast/forms/autofocus-input-css-style-change.html [ Failure ]
 crbug.com/591099 fast/forms/autofocus-opera-001.html [ Crash Failure ]
 crbug.com/591099 fast/forms/autofocus-opera-002.html [ Crash Failure ]
-crbug.com/591099 fast/forms/autofocus-opera-003.html [ Crash ]
 crbug.com/591099 fast/forms/autofocus-opera-004.html [ Crash Failure ]
 crbug.com/591099 fast/forms/autofocus-opera-005.html [ Crash Failure ]
 crbug.com/591099 fast/forms/autofocus-opera-006.html [ Crash Failure ]
@@ -12134,7 +10955,6 @@
 crbug.com/591099 fast/forms/cursor-position.html [ Crash Failure ]
 crbug.com/591099 fast/forms/dangling-form-element-crash.html [ Failure ]
 crbug.com/591099 fast/forms/datalist/datalist-child-validation.html [ Failure ]
-crbug.com/591099 fast/forms/datalist/datalist-fallback-content.html [ Failure ]
 crbug.com/591099 fast/forms/datalist/datalist-inside-shadow-dom.html [ Crash Pass ]
 crbug.com/591099 fast/forms/datalist/datalist-nonoption-child.html [ Failure ]
 crbug.com/591099 fast/forms/datalist/input-appearance-range-with-datalist-zoomed.html [ Failure ]
@@ -12218,10 +11038,10 @@
 crbug.com/591099 fast/forms/datetimelocal/input-valueasdate-datetimelocal.html [ Failure ]
 crbug.com/591099 fast/forms/datetimelocal/input-valueasnumber-datetimelocal.html [ Failure ]
 crbug.com/591099 fast/forms/defer-updateFromElement.html [ Crash Failure ]
-crbug.com/591099 fast/forms/delete-text-with-invisible-br.html [ Crash ]
+crbug.com/591099 fast/forms/delete-text-with-invisible-br.html [ Crash Failure ]
 crbug.com/591099 fast/forms/disabled-attr-checkvalidity.html [ Failure ]
 crbug.com/591099 fast/forms/disabled-mousedown-event.html [ Failure ]
-crbug.com/591099 fast/forms/display-none-in-onchange-keyboard.html [ Failure ]
+crbug.com/591099 fast/forms/display-none-in-onchange-keyboard.html [ Crash Failure ]
 crbug.com/591099 fast/forms/document-write-empty.html [ Failure ]
 crbug.com/591099 fast/forms/document-write.html [ Failure ]
 crbug.com/591099 fast/forms/domstring-replace-crash.html [ Failure ]
@@ -12237,7 +11057,7 @@
 crbug.com/591099 fast/forms/enter-clicks-buttons.html [ Crash ]
 crbug.com/591099 fast/forms/fieldset/fieldset-align.html [ Failure ]
 crbug.com/591099 fast/forms/fieldset/fieldset-disable.html [ Crash Pass ]
-crbug.com/591099 fast/forms/fieldset/fieldset-disabled.html [ Crash ]
+crbug.com/591099 fast/forms/fieldset/fieldset-disabled.html [ Crash Failure ]
 crbug.com/591099 fast/forms/fieldset/fieldset-elements.html [ Crash ]
 crbug.com/591099 fast/forms/fieldset/fieldset-form-collection-radionode-list.html [ Crash Failure ]
 crbug.com/591099 fast/forms/fieldset/fieldset-legend-padding-unclipped-fieldset-border.html [ Failure ]
@@ -12254,9 +11074,7 @@
 crbug.com/591099 fast/forms/fieldset/legend-after-margin-with-before-border-horizontal-mode.html [ Failure ]
 crbug.com/591099 fast/forms/fieldset/legend-display-none.html [ Failure ]
 crbug.com/591099 fast/forms/fieldset/legend-form.html [ Failure ]
-crbug.com/591099 fast/forms/fieldset/legend-small-after-margin-before-border-horizontal-mode.html [ Failure ]
 crbug.com/591099 fast/forms/fieldset/validation-in-fieldset.html [ Crash Pass ]
-crbug.com/591099 fast/forms/file/disabling-file-busy-loop.html [ Crash ]
 crbug.com/591099 fast/forms/file/file-appearance-transform-no-effects.html [ Crash Pass ]
 crbug.com/591099 fast/forms/file/file-cloneNode.html [ Crash ]
 crbug.com/591099 fast/forms/file/file-input-capture.html [ Failure ]
@@ -12265,30 +11083,23 @@
 crbug.com/591099 fast/forms/file/file-input-disabled.html [ Crash Failure ]
 crbug.com/591099 fast/forms/file/file-input-empty-validation.html [ Crash Failure ]
 crbug.com/591099 fast/forms/file/file-input-hit-test.html [ Crash Failure ]
-crbug.com/591099 fast/forms/file/file-input-pressed-state.html [ Crash Failure ]
 crbug.com/591099 fast/forms/file/file-input-reset-validation.html [ Crash Failure ]
 crbug.com/591099 fast/forms/file/file-input-reset.html [ Crash Pass ]
-crbug.com/591099 fast/forms/file/file-reset-in-change.html [ Crash Failure ]
 crbug.com/591099 fast/forms/file/file-setrangetext.html [ Crash Failure ]
 crbug.com/591099 fast/forms/file/file-style-inheritance.html [ Crash Failure ]
-crbug.com/591099 fast/forms/file/file-vertical-padding-border.html [ Crash ]
 crbug.com/591099 fast/forms/file/get-file-upload.html [ Crash Failure ]
-crbug.com/591099 fast/forms/file/hidden-input-file.html [ Crash ]
 crbug.com/591099 fast/forms/file/input-file-entries.html [ Crash Failure ]
 crbug.com/591099 fast/forms/file/input-file-label.html [ Crash Failure ]
-crbug.com/591099 fast/forms/file/input-file-not-open-without-gesture.html [ Crash ]
 crbug.com/591099 fast/forms/file/input-file-re-render.html [ Crash ]
 crbug.com/591099 fast/forms/file/input-file-value-with-zoom.html [ Crash Failure ]
 crbug.com/591099 fast/forms/file/input-file-value.html [ Crash Failure ]
 crbug.com/591099 fast/forms/file/input-file-write-files.html [ Crash Failure ]
-crbug.com/591099 fast/forms/file/intrinsic-min-width-overrides-width.html [ Crash Failure ]
 crbug.com/591099 fast/forms/file/recover-file-input-in-unposted-form.html [ Crash Failure ]
 crbug.com/591099 fast/forms/file/selected-files-from-history-state.html [ Crash Failure ]
 crbug.com/591099 fast/forms/file/sibling-of-disabled-file-input.html [ Crash Failure ]
 crbug.com/591099 fast/forms/floating-textfield-relayout.html [ Failure ]
 crbug.com/591099 fast/forms/focus-change-on-keypress.html [ Failure ]
 crbug.com/591099 fast/forms/focus-control-to-page.html [ Crash Failure ]
-crbug.com/591099 fast/forms/focus-on-control-with-zero-size.html [ Failure ]
 crbug.com/591099 fast/forms/focus-selection-input.html [ Crash Failure ]
 crbug.com/591099 fast/forms/focus-selection-textarea.html [ Crash Failure ]
 crbug.com/591099 fast/forms/focus-style-pending.html [ Failure Pass ]
@@ -12355,7 +11166,6 @@
 crbug.com/591099 fast/forms/indeterminate.html [ Failure ]
 crbug.com/591099 fast/forms/input-align.html [ Crash Failure ]
 crbug.com/591099 fast/forms/input-appearance-height.html [ Crash Failure ]
-crbug.com/591099 fast/forms/input-baseline-empty-text.html [ Crash Failure ]
 crbug.com/591099 fast/forms/input-button-sizes.html [ Failure ]
 crbug.com/591099 fast/forms/input-disconnected-during-parse.html [ Failure ]
 crbug.com/591099 fast/forms/input-file-set-value.html [ Crash Failure ]
@@ -12379,7 +11189,6 @@
 crbug.com/591099 fast/forms/input-type-change3.html [ Failure ]
 crbug.com/591099 fast/forms/input-type-text-min-width.html [ Crash Failure ]
 crbug.com/591099 fast/forms/input-user-modify.html [ Failure ]
-crbug.com/591099 fast/forms/input-user-select-none.html [ Crash Failure ]
 crbug.com/591099 fast/forms/input-value-sanitization.html [ Crash Failure ]
 crbug.com/591099 fast/forms/input-value.html [ Failure ]
 crbug.com/591099 fast/forms/input-valueasnumber-unsupported.html [ Crash Failure ]
@@ -12480,12 +11289,10 @@
 crbug.com/591099 fast/forms/month/month-setrangetext.html [ Failure ]
 crbug.com/591099 fast/forms/month/month-stepup-stepdown.html [ Failure ]
 crbug.com/591099 fast/forms/mouseevent_disabled_form_control.html [ Crash ]
-crbug.com/591099 fast/forms/multiple-form-submission-protection-mouse.html [ Crash ]
 crbug.com/591099 fast/forms/multiple-selected-options-innerHTML.html [ Failure ]
 crbug.com/591099 fast/forms/mutation-event-recalc.html [ Failure ]
 crbug.com/591099 fast/forms/negativeLineHeight.html [ Crash Failure ]
 crbug.com/591099 fast/forms/novalidate-attribute.html [ Failure ]
-crbug.com/591099 fast/forms/number/number-appearance-datalist-dynamic.html [ Failure ]
 crbug.com/591099 fast/forms/number/number-appearance-datalist.html [ Failure ]
 crbug.com/591099 fast/forms/number/number-appearance-rtl.html [ Crash Failure ]
 crbug.com/591099 fast/forms/number/number-appearance-spinbutton-disabled-readonly.html [ Crash Failure ]
@@ -12498,11 +11305,7 @@
 crbug.com/591099 fast/forms/number/number-input-changeevent.html [ Crash ]
 crbug.com/591099 fast/forms/number/number-interactive-validation-required.html [ Crash Failure ]
 crbug.com/591099 fast/forms/number/number-keyoperation.html [ Crash Failure ]
-crbug.com/591099 fast/forms/number/number-l10n-input.html [ Failure ]
-crbug.com/591099 fast/forms/number/number-lossless-localization.html [ Failure ]
 crbug.com/591099 fast/forms/number/number-outofrange.html [ Crash ]
-crbug.com/591099 fast/forms/number/number-placeholder-with-unacceptable-value.html [ Failure ]
-crbug.com/591099 fast/forms/number/number-reject-invalid.html [ Failure ]
 crbug.com/591099 fast/forms/number/number-setrangetext.html [ Failure ]
 crbug.com/591099 fast/forms/number/number-size.html [ Failure Timeout ]
 crbug.com/591099 fast/forms/number/number-skip-spaces-in-user-input.html [ Failure ]
@@ -12514,7 +11317,7 @@
 crbug.com/591099 fast/forms/number/number-spinbutton-gets-disabled-or-readonly.html [ Crash Failure ]
 crbug.com/591099 fast/forms/number/number-spinbutton-in-multi-column.html [ Failure ]
 crbug.com/591099 fast/forms/number/number-spinbutton-state.html [ Crash ]
-crbug.com/591099 fast/forms/number/number-stepup-stepdown-from-renderer.html [ Crash Timeout ]
+crbug.com/591099 fast/forms/number/number-stepup-stepdown-from-renderer.html [ Crash Failure Timeout ]
 crbug.com/591099 fast/forms/number/number-stepup-stepdown.html [ Failure ]
 crbug.com/591099 fast/forms/number/number-type-update-by-change-event.html [ Crash Pass ]
 crbug.com/591099 fast/forms/number/number-validation-message.html [ Crash Failure ]
@@ -12527,8 +11330,6 @@
 crbug.com/591099 fast/forms/number/number-wheel-event.html [ Crash ]
 crbug.com/591099 fast/forms/numeric-input-name.html [ Failure ]
 crbug.com/591099 fast/forms/old-names.html [ Failure ]
-crbug.com/591099 fast/forms/onchange-change-type.html [ Failure ]
-crbug.com/591099 fast/forms/onchange-enter-submit.html [ Failure ]
 crbug.com/591099 fast/forms/onchange-setvalueforuser.html [ Crash Pass ]
 crbug.com/591099 fast/forms/onselect-selectall.html [ Crash Pass ]
 crbug.com/591099 fast/forms/onselect-textfield.html [ Failure ]
@@ -12537,7 +11338,6 @@
 crbug.com/591099 fast/forms/page-popup/page-popup-hide-window.html [ Failure ]
 crbug.com/591099 fast/forms/parser-associated-form-removal.html [ Failure ]
 crbug.com/591099 fast/forms/password-doubleclick-selection.html [ Crash Pass ]
-crbug.com/591099 fast/forms/password-placeholder-text-security.html [ Crash Failure ]
 crbug.com/591099 fast/forms/paste-multiline-text-input.html [ Failure ]
 crbug.com/591099 fast/forms/pattern-attribute-001.html [ Crash Failure ]
 crbug.com/591099 fast/forms/pattern-attribute-002.html [ Crash Failure ]
@@ -12628,22 +11428,17 @@
 crbug.com/591099 fast/forms/reset-autofilled.html [ Failure ]
 crbug.com/591099 fast/forms/restore-selection-after-layout.html [ Crash ]
 crbug.com/591099 fast/forms/search/abspos-cancel-button-crash.html [ Crash ]
-crbug.com/591099 fast/forms/search/disabled-search-input.html [ Failure ]
 crbug.com/591099 fast/forms/search/input-search-press-escape-key.html [ Crash Failure ]
-crbug.com/591099 fast/forms/search/intrinsic-search-width-with-decoration-border-padding.html [ Failure ]
 crbug.com/591099 fast/forms/search/search-abs-pos-cancel-button.html [ Crash Failure ]
 crbug.com/591099 fast/forms/search/search-appearance-basic.html [ Crash Failure ]
 crbug.com/591099 fast/forms/search/search-cancel-button-events.html [ Crash ]
 crbug.com/591099 fast/forms/search/search-cancel-button-mouseup.html [ Crash Failure ]
 crbug.com/591099 fast/forms/search/search-cancel-button-style-sharing.html [ Crash Failure ]
 crbug.com/591099 fast/forms/search/search-cancel-in-invisible-elements.html [ Crash Pass ]
-crbug.com/591099 fast/forms/search/search-change-type-onsearch.html [ Timeout ]
-crbug.com/591099 fast/forms/search/search-click-in-placeholder.html [ Failure ]
 crbug.com/591099 fast/forms/search/search-delete-while-cancel-button-clicked.html [ Crash ]
 crbug.com/591099 fast/forms/search/search-disabled-readonly.html [ Crash Failure ]
 crbug.com/591099 fast/forms/search/search-display-none-cancel-button.html [ Crash Failure ]
 crbug.com/591099 fast/forms/search/search-hide-cancel-on-cancel.html [ Crash Failure ]
-crbug.com/591099 fast/forms/search/search-placeholder-value-changed.html [ Failure ]
 crbug.com/591099 fast/forms/search/search-rtl.html [ Crash Failure ]
 crbug.com/591099 fast/forms/search/search-setrangetext-noevents.html [ Crash Pass ]
 crbug.com/591099 fast/forms/search/search-setrangetext.html [ Crash Failure ]
@@ -12670,7 +11465,7 @@
 crbug.com/591099 fast/forms/select-popup/popup-menu-crash-on-style-update.html [ Crash ]
 crbug.com/591099 fast/forms/select-popup/popup-menu-mouse-operations.html [ Failure ]
 crbug.com/591099 fast/forms/select-popup/popup-menu-nested-style.html [ Failure ]
-crbug.com/591099 fast/forms/select-popup/popup-menu-touch-operations.html [ Failure ]
+crbug.com/591099 fast/forms/select-popup/popup-menu-touch-operations.html [ Failure Timeout ]
 crbug.com/591099 fast/forms/select-popup/popup-menu-update-from-element.html [ Failure ]
 crbug.com/591099 fast/forms/select/003.html [ Failure ]
 crbug.com/591099 fast/forms/select/004.html [ Failure ]
@@ -12963,9 +11758,7 @@
 crbug.com/591099 fast/forms/text/input-double-click-selection-gap-bug.html [ Failure ]
 crbug.com/591099 fast/forms/text/input-element-attach-crash.html [ Crash Pass ]
 crbug.com/591099 fast/forms/text/input-field-text-truncated.html [ Crash Failure ]
-crbug.com/591099 fast/forms/text/input-first-letter-edit.html [ Crash Failure ]
 crbug.com/591099 fast/forms/text/input-hit-test-border.html [ Failure ]
-crbug.com/591099 fast/forms/text/input-implicit-length-limit.html [ Crash Timeout ]
 crbug.com/591099 fast/forms/text/input-live-pseudo-selectors.html [ Crash Failure ]
 crbug.com/591099 fast/forms/text/input-maxlength-ime-completed.html [ Failure ]
 crbug.com/591099 fast/forms/text/input-maxlength-ime-preedit.html [ Failure ]
@@ -12975,7 +11768,6 @@
 crbug.com/591099 fast/forms/text/input-placeholder-paint-order.html [ Failure ]
 crbug.com/591099 fast/forms/text/input-placeholder-text-indent.html [ Crash Failure ]
 crbug.com/591099 fast/forms/text/input-placeholder-visibility-1.html [ Failure ]
-crbug.com/591099 fast/forms/text/input-placeholder-visibility-2.html [ Crash Failure ]
 crbug.com/591099 fast/forms/text/input-placeholder-visibility-3.html [ Failure ]
 crbug.com/591099 fast/forms/text/input-readonly-autoscroll.html [ Crash Failure ]
 crbug.com/591099 fast/forms/text/input-readonly-dimmed.html [ Crash Failure ]
@@ -13005,8 +11797,6 @@
 crbug.com/591099 fast/forms/text/placeholder-and-default-value.html [ Crash Pass ]
 crbug.com/591099 fast/forms/text/placeholder-crash-with-scrollbar-corner.html [ Crash ]
 crbug.com/591099 fast/forms/text/placeholder-dom-property.html [ Failure ]
-crbug.com/591099 fast/forms/text/placeholder-pseudo-style.html [ Crash Failure ]
-crbug.com/591099 fast/forms/text/placeholder-set-attribute.html [ Failure ]
 crbug.com/591099 fast/forms/text/placeholder-set-value.html [ Crash Pass ]
 crbug.com/591099 fast/forms/text/placeholder-with-positioned-element.html [ Crash Pass ]
 crbug.com/591099 fast/forms/text/text-appearance-basic.html [ Crash Failure ]
@@ -13015,25 +11805,21 @@
 crbug.com/591099 fast/forms/text/text-change-event-after-updating-default.html [ Crash ]
 crbug.com/591099 fast/forms/text/text-dir-auto-with-placeholder.html [ Crash ]
 crbug.com/591099 fast/forms/text/text-field-setvalue-crash.html [ Failure ]
-crbug.com/591099 fast/forms/text/text-focus-into-view.html [ Crash Failure ]
 crbug.com/591099 fast/forms/text/text-font-height-mismatch.html [ Crash Failure ]
 crbug.com/591099 fast/forms/text/text-height-grow.html [ Crash Pass ]
 crbug.com/591099 fast/forms/text/text-inner-overflow.html [ Failure ]
-crbug.com/591099 fast/forms/text/text-input-event.html [ Failure ]
 crbug.com/591099 fast/forms/text/text-lineheight-centering.html [ Crash Pass ]
 crbug.com/591099 fast/forms/text/text-padding-dynamic-change.html [ Crash Pass ]
 crbug.com/591099 fast/forms/text/text-placeholder-in-flexbox.html [ Failure ]
 crbug.com/591099 fast/forms/text/text-reset-click-delete-text-change-event.html [ Crash Failure ]
 crbug.com/591099 fast/forms/text/text-select-disabled.html [ Crash Failure ]
 crbug.com/591099 fast/forms/text/text-select-invisible.html [ Crash Failure ]
-crbug.com/591099 fast/forms/text/text-select-noscroll.html [ Crash Failure ]
 crbug.com/591099 fast/forms/text/text-selection-after-type-change.html [ Crash ]
 crbug.com/591099 fast/forms/text/text-set-selection-crash.html [ Crash ]
 crbug.com/591099 fast/forms/text/text-update-datalist-while-focused.html [ Failure ]
 crbug.com/591099 fast/forms/text/text-window-lost-focus-change-event.html [ Failure Timeout ]
 crbug.com/591099 fast/forms/text/textfield-focus-out.html [ Crash ]
 crbug.com/591099 fast/forms/text/textfield-focus-ring.html [ Failure ]
-crbug.com/591099 fast/forms/text/textfield-inside-anchor.html [ Failure ]
 crbug.com/591099 fast/forms/text/textfield-outline.html [ Crash Failure ]
 crbug.com/591099 fast/forms/text/textfield-overflow-by-value-update.html [ Crash Failure ]
 crbug.com/591099 fast/forms/text/textfield-overflow.html [ Failure ]
@@ -13058,12 +11844,10 @@
 crbug.com/591099 fast/forms/textarea/textarea-appearance-wrap.html [ Crash Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-arrow-navigation.html [ Crash Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-checkValidity-crash.html [ Failure ]
-crbug.com/591099 fast/forms/textarea/textarea-cloned-text-match.html [ Crash Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-crlf.html [ Crash Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-default-value-leading-newline.html [ Crash Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-dir-auto-with-placeholder.html [ Crash ]
 crbug.com/591099 fast/forms/textarea/textarea-initial-caret-position.html [ Crash Failure ]
-crbug.com/591099 fast/forms/textarea/textarea-inline-block-baseline.html [ Crash Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-input-event.html [ Crash Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-inputmode.html [ Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-linewrap-dynamic.html [ Crash Failure ]
@@ -13075,25 +11859,21 @@
 crbug.com/591099 fast/forms/textarea/textarea-no-scroll-on-blur.html [ Crash Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-node-removed-from-document-crash.html [ Crash ]
 crbug.com/591099 fast/forms/textarea/textarea-nowrap-paste-eol.html [ Crash Failure Pass ]
-crbug.com/591099 fast/forms/textarea/textarea-paste-newline.html [ Crash Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-placeholder-dom-property.html [ Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-placeholder-paint-order-2.html [ Failure Pass ]
 crbug.com/591099 fast/forms/textarea/textarea-placeholder-paint-order.html [ Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-placeholder-pseudo-style.html [ Crash Pass ]
 crbug.com/591099 fast/forms/textarea/textarea-placeholder-relayout-assertion.html [ Crash Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-placeholder-scroll.html [ Crash Pass ]
-crbug.com/591099 fast/forms/textarea/textarea-placeholder-set-attribute.html [ Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-placeholder-set-value.html [ Crash Pass ]
 crbug.com/591099 fast/forms/textarea/textarea-placeholder-visibility-1.html [ Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-placeholder-visibility-2.html [ Crash Failure ]
-crbug.com/591099 fast/forms/textarea/textarea-placeholder-visibility-3.html [ Crash Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-placeholder-wrapping.html [ Crash Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-preline-eol.html [ Crash Pass ]
 crbug.com/591099 fast/forms/textarea/textarea-rows-cols.html [ Crash Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-scroll-height.html [ Crash Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-scrollbar-height.html [ Crash Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-scrollbar.html [ Crash Failure ]
-crbug.com/591099 fast/forms/textarea/textarea-scrolled-endline-caret.html [ Crash Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-scrolled-focus-ring.html [ Crash Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-scrolled-mask.html [ Crash Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-scrolled-type.html [ Crash Failure ]
@@ -13106,8 +11886,6 @@
 crbug.com/591099 fast/forms/textarea/textarea-setvalue-without-renderer.html [ Crash Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-submit-crash.html [ Crash Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-textlength.html [ Crash Failure ]
-crbug.com/591099 fast/forms/textarea/textarea-type-spaces.html [ Failure ]
-crbug.com/591099 fast/forms/textarea/textarea-value-last-eol.html [ Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-width.html [ Crash Failure ]
 crbug.com/591099 fast/forms/textarea/textarea-wrap-attribute.html [ Failure ]
 crbug.com/591099 fast/forms/textfield-change-event.html [ Crash ]
@@ -13226,7 +12004,7 @@
 crbug.com/591099 fast/frames/empty-cols-attribute.html [ Failure ]
 crbug.com/591099 fast/frames/empty-frame-document.html [ Failure ]
 crbug.com/591099 fast/frames/empty-frame-src.html [ Failure ]
-crbug.com/591099 fast/frames/focus-controller-crash-change-event.html [ Timeout ]
+crbug.com/591099 fast/frames/focus-controller-crash-change-event.html [ Crash Timeout ]
 crbug.com/591099 fast/frames/form-submission-early-return-for-sandboxed-iframes.html [ Crash ]
 crbug.com/591099 fast/frames/frame-dimensions-before-parent-layout.html [ Failure ]
 crbug.com/591099 fast/frames/frame-focus-no-focusout-event.html [ Crash ]
@@ -13279,7 +12057,6 @@
 crbug.com/591099 fast/frames/iframe-set-same-location.html [ Failure ]
 crbug.com/591099 fast/frames/iframe-set-same-src.html [ Failure ]
 crbug.com/591099 fast/frames/iframe-text-contents.html [ Failure ]
-crbug.com/591099 fast/frames/iframe-window-focus.html [ Failure ]
 crbug.com/591099 fast/frames/iframe-with-frameborder.html [ Failure ]
 crbug.com/591099 fast/frames/inline-object-inside-frameset.html [ Failure ]
 crbug.com/591099 fast/frames/invalid.html [ Failure ]
@@ -13292,7 +12069,6 @@
 crbug.com/591099 fast/frames/open-then-unload.html [ Failure ]
 crbug.com/591099 fast/frames/open-without-opener-frame-crash.html [ Failure ]
 crbug.com/591099 fast/frames/out-of-document-iframe-has-child-frame.html [ Crash Failure ]
-crbug.com/591099 fast/frames/page-visibility-crash.html [ Crash ]
 crbug.com/591099 fast/frames/paint-iframe-background.html [ Failure ]
 crbug.com/591099 fast/frames/parser-append-subframe-count.html [ Failure ]
 crbug.com/591099 fast/frames/reattach-in-unload.html [ Failure ]
@@ -13410,9 +12186,7 @@
 crbug.com/591099 fast/harness/should-be-now.html [ Failure ]
 crbug.com/591099 fast/harness/user-preferred-language.html [ Crash Failure ]
 crbug.com/591099 fast/hidpi/broken-image-icon-hidpi.html [ Crash Failure ]
-crbug.com/591099 fast/hidpi/broken-image-with-size-hidpi.html [ Crash Failure ]
 crbug.com/591099 fast/hidpi/gradient-with-scaled-ancestor.html [ Failure ]
-crbug.com/591099 fast/hidpi/image-set-list-style-image.html [ Crash ]
 crbug.com/591099 fast/hidpi/image-set-shape-outside.html [ Failure ]
 crbug.com/591099 fast/hidpi/image-srcset-intrinsic-size.html [ Failure Pass ]
 crbug.com/591099 fast/hidpi/image-srcset-invalid-inputs-except-one.html [ Crash Pass ]
@@ -13423,7 +12197,6 @@
 crbug.com/591099 fast/hidpi/image-srcset-png-4.html [ Failure Pass ]
 crbug.com/591099 fast/hidpi/image-srcset-png-canvas.html [ Failure Pass ]
 crbug.com/591099 fast/hidpi/image-srcset-svg.html [ Failure Pass ]
-crbug.com/591099 fast/hidpi/resize-corner-hidpi.html [ Failure ]
 crbug.com/591099 fast/hidpi/scrollbar-appearance-decrease-device-scale-factor.html [ Failure ]
 crbug.com/591099 fast/hidpi/scrollbar-appearance-increase-device-scale-factor.html [ Failure ]
 crbug.com/591099 fast/history/form-submit-in-frame-via-onclick.html [ Timeout ]
@@ -13442,21 +12215,18 @@
 crbug.com/591099 fast/history/redirect-via-iframe.html [ Failure ]
 crbug.com/591099 fast/history/same-document-iframes-changing-fragment.html [ Crash ]
 crbug.com/591099 fast/history/same-document-iframes-changing-pushstate.html [ Crash ]
-crbug.com/591099 fast/history/saves-state-after-frame-nav.html [ Crash Pass ]
 crbug.com/591099 fast/history/scroll-restoration/scroll-restoration-fragment-navigation-crossdoc.html [ Crash ]
 crbug.com/591099 fast/history/scroll-restoration/scroll-restoration-navigation.html [ Crash ]
 crbug.com/591099 fast/history/scroll-restoration/scroll-restoration-push-replace.html [ Failure Pass ]
 crbug.com/591099 fast/history/self-is-visited.html [ Failure ]
 crbug.com/591099 fast/history/sibling-visited-test.html [ Failure ]
 crbug.com/591099 fast/history/state-object-few-arguements-exception.html [ Failure ]
-crbug.com/591099 fast/history/visited-link-hover-text-decoration-color.html [ Failure ]
 crbug.com/591099 fast/history/window-open.html [ Crash Failure ]
 crbug.com/591099 fast/html/adjacent-html-context-element.html [ Failure ]
 crbug.com/591099 fast/html/adopt-parent-frame.html [ Failure ]
 crbug.com/591099 fast/html/clone-range.html [ Failure ]
 crbug.com/591099 fast/html/crash-on-invalid-selection-index.html [ Crash Pass ]
 crbug.com/591099 fast/html/crash-style-first-letter.html [ Failure ]
-crbug.com/591099 fast/html/draggable-controls.html [ Crash ]
 crbug.com/591099 fast/html/draggable.html [ Failure ]
 crbug.com/591099 fast/html/eventhandler-attribute-non-callable.html [ Failure ]
 crbug.com/591099 fast/html/hidden-attr-dom.html [ Failure ]
@@ -13490,7 +12260,7 @@
 crbug.com/591099 fast/html/progress-user-modify.html [ Failure ]
 crbug.com/591099 fast/html/script-allowed-types-languages.html [ Failure ]
 crbug.com/591099 fast/html/select-dropdown-consistent-background-color.html [ Failure Pass ]
-crbug.com/591099 fast/html/set-text-direction.html [ Failure ]
+crbug.com/591099 fast/html/set-text-direction.html [ Crash Failure ]
 crbug.com/591099 fast/html/tab-order.html [ Crash Failure ]
 crbug.com/591099 fast/html/tabindex-nonfocusable.html [ Crash ]
 crbug.com/591099 fast/html/unknown-tag.html [ Crash Failure ]
@@ -13517,7 +12287,6 @@
 crbug.com/591099 fast/inline/br-client-rect.html [ Failure ]
 crbug.com/591099 fast/inline/break-between-nobr.html [ Failure ]
 crbug.com/591099 fast/inline/clean-after-removing-temp-boxes.html [ Failure ]
-crbug.com/591099 fast/inline/collapsing-text-after-list-markers.html [ Crash Failure ]
 crbug.com/591099 fast/inline/continuation-inlines-inserted-in-reverse-after-block.html [ Failure ]
 crbug.com/591099 fast/inline/continuation-outlines-with-layers.html [ Failure ]
 crbug.com/591099 fast/inline/continuation-outlines.html [ Failure ]
@@ -13532,11 +12301,9 @@
 crbug.com/591099 fast/inline/fixed-pos-moves-with-abspos-parent-relative-ancestor.html [ Failure ]
 crbug.com/591099 fast/inline/fixed-pos-moves-with-abspos-parent.html [ Failure ]
 crbug.com/591099 fast/inline/fixed-pos-with-transform-container-moves-with-abspos-parent.html [ Failure ]
-crbug.com/591099 fast/inline/inline-body-crash.html [ Crash ]
 crbug.com/591099 fast/inline/inline-body-with-inline-child.html [ Failure ]
 crbug.com/591099 fast/inline/inline-borders-with-bidi-override.html [ Failure ]
 crbug.com/591099 fast/inline/inline-box-adjust-position-crash.html [ Crash ]
-crbug.com/591099 fast/inline/inline-box-append-child-crash.html [ Crash ]
 crbug.com/591099 fast/inline/inline-box-background-long-image.html [ Failure ]
 crbug.com/591099 fast/inline/inline-box-background-repeat-x.html [ Failure ]
 crbug.com/591099 fast/inline/inline-box-background-repeat-y.html [ Failure ]
@@ -13632,7 +12399,6 @@
 crbug.com/591099 fast/js/array-some.html [ Crash ]
 crbug.com/591099 fast/js/array-sort-exception.html [ Failure ]
 crbug.com/591099 fast/js/assign.html [ Failure ]
-crbug.com/591099 fast/js/bitwise-and-on-undefined.html [ Crash ]
 crbug.com/591099 fast/js/bom-in-file-retains-correct-offset.html [ Failure ]
 crbug.com/591099 fast/js/cached-eval-gc.html [ Failure ]
 crbug.com/591099 fast/js/callback-function-with-handle-event.html [ Failure ]
@@ -13842,7 +12608,6 @@
 crbug.com/591099 fast/js/string-replace-3.html [ Failure ]
 crbug.com/591099 fast/js/string-replace-exception-crash.html [ Failure ]
 crbug.com/591099 fast/js/switch-behaviour.html [ Failure ]
-crbug.com/591099 fast/js/text-field-resize.html [ Failure ]
 crbug.com/591099 fast/js/throw-from-array-sort.html [ Failure ]
 crbug.com/591099 fast/js/toString-and-valueOf-override.html [ Failure Pass Timeout ]
 crbug.com/591099 fast/js/toString-dontEnum.html [ Failure ]
@@ -13906,7 +12671,6 @@
 crbug.com/591099 fast/lists/002.html [ Crash Failure ]
 crbug.com/591099 fast/lists/003-vertical.html [ Crash Failure ]
 crbug.com/591099 fast/lists/003.html [ Crash Failure ]
-crbug.com/591099 fast/lists/004.html [ Crash ]
 crbug.com/591099 fast/lists/005-vertical.html [ Crash Failure ]
 crbug.com/591099 fast/lists/005.html [ Crash Failure ]
 crbug.com/591099 fast/lists/006-vertical.html [ Crash Failure ]
@@ -13921,7 +12685,6 @@
 crbug.com/591099 fast/lists/alpha-list-wrap.html [ Crash Failure ]
 crbug.com/591099 fast/lists/anonymous-items.html [ Crash Failure ]
 crbug.com/591099 fast/lists/big-list-marker.html [ Crash Failure ]
-crbug.com/591099 fast/lists/calc-width-with-space.html [ Crash Failure ]
 crbug.com/591099 fast/lists/css3-counter-styles-052.html [ Crash Failure ]
 crbug.com/591099 fast/lists/css3-counter-styles-053.html [ Crash Failure ]
 crbug.com/591099 fast/lists/css3-counter-styles-054.html [ Crash Failure ]
@@ -13957,7 +12720,6 @@
 crbug.com/591099 fast/lists/css3-counter-styles-088.html [ Crash Failure ]
 crbug.com/591099 fast/lists/css3-counter-styles-089.html [ Crash Failure ]
 crbug.com/591099 fast/lists/decimal-leading-zero.html [ Crash Pass ]
-crbug.com/591099 fast/lists/drag-into-marker.html [ Crash Failure ]
 crbug.com/591099 fast/lists/dynamic-marker-crash.html [ Crash Failure ]
 crbug.com/591099 fast/lists/inline-before-content-after-list-marker.html [ Failure ]
 crbug.com/591099 fast/lists/inlineBoxWrapperNullCheck.html [ Crash Failure ]
@@ -13966,31 +12728,22 @@
 crbug.com/591099 fast/lists/li-minimum-long-value.html [ Crash Pass ]
 crbug.com/591099 fast/lists/li-style-alpha-huge-value-crash.html [ Crash Failure ]
 crbug.com/591099 fast/lists/li-values.html [ Crash Pass ]
-crbug.com/591099 fast/lists/list-color-change-no-layout.html [ Crash ]
-crbug.com/591099 fast/lists/list-item-line-height.html [ Crash Failure ]
-crbug.com/591099 fast/lists/list-item-without-list-reparented-crash.html [ Crash ]
 crbug.com/591099 fast/lists/list-marker-avoid-float.html [ Crash Failure ]
 crbug.com/591099 fast/lists/list-marker-before-content-table.html [ Failure ]
 crbug.com/591099 fast/lists/list-marker-before-float-nested-rtl.html [ Crash Failure ]
 crbug.com/591099 fast/lists/list-marker-before-float-nested.html [ Crash Failure ]
 crbug.com/591099 fast/lists/list-marker-before-float-rtl.html [ Crash Failure ]
 crbug.com/591099 fast/lists/list-marker-before-float.html [ Crash Failure ]
-crbug.com/591099 fast/lists/list-marker-before-overflow-hidden.html [ Crash ]
-crbug.com/591099 fast/lists/list-marker-padding-overflow-hidden-rtl.html [ Crash ]
-crbug.com/591099 fast/lists/list-marker-padding-overflow-hidden.html [ Crash Failure ]
+crbug.com/591099 fast/lists/list-marker-before-overflow-hidden.html [ Crash Failure ]
 crbug.com/591099 fast/lists/list-marker-remove-crash.html [ Crash Pass ]
 crbug.com/591099 fast/lists/list-marker-set-overflow-line-box-crash.html [ Crash Pass ]
-crbug.com/591099 fast/lists/list-marker-text-reverse.html [ Crash ]
 crbug.com/591099 fast/lists/list-marker-with-line-height.html [ Crash Failure ]
 crbug.com/591099 fast/lists/list-style-none-crash.html [ Failure ]
 crbug.com/591099 fast/lists/list-style-position-inside.html [ Crash ]
 crbug.com/591099 fast/lists/list-style-type-dynamic-change.html [ Crash Failure ]
-crbug.com/591099 fast/lists/list-with-autosizing-crash.html [ Crash ]
 crbug.com/591099 fast/lists/marker-before-empty-inline.html [ Crash Failure ]
 crbug.com/591099 fast/lists/marker-image-error.html [ Crash Failure ]
-crbug.com/591099 fast/lists/marker-preferred-margins.html [ Crash ]
 crbug.com/591099 fast/lists/markers-in-selection.html [ Crash Failure ]
-crbug.com/591099 fast/lists/numeric-markers-outside-list.html [ Crash Failure ]
 crbug.com/591099 fast/lists/ol-display-types.html [ Crash Failure ]
 crbug.com/591099 fast/lists/ol-nested-items-dynamic-insert.html [ Crash Failure ]
 crbug.com/591099 fast/lists/ol-nested-items-dynamic-remove.html [ Crash Failure ]
@@ -14005,15 +12758,9 @@
 crbug.com/591099 fast/lists/ol-reversed-simple.html [ Crash Failure ]
 crbug.com/591099 fast/lists/ol-reversed-simple.xhtml [ Crash Failure ]
 crbug.com/591099 fast/lists/ol-start-dynamic.html [ Crash Failure ]
-crbug.com/591099 fast/lists/ol-start-parsing.html [ Crash Failure ]
-crbug.com/591099 fast/lists/ol-start-roman.html [ Crash ]
-crbug.com/591099 fast/lists/olstart.html [ Crash Failure ]
 crbug.com/591099 fast/lists/ordered-list-with-no-ol-tag.html [ Crash Failure ]
-crbug.com/591099 fast/lists/positioned-count-crash.html [ Crash ]
 crbug.com/591099 fast/lists/remove-listmarker-and-make-anonblock-empty-2.html [ Crash ]
 crbug.com/591099 fast/lists/remove-listmarker-and-make-anonblock-empty.html [ Crash Pass ]
-crbug.com/591099 fast/lists/rtl-ordered-list.html [ Crash ]
-crbug.com/591099 fast/lists/scrolled-marker-paint.html [ Crash Failure ]
 crbug.com/591099 fast/lists/w3-css3-list-styles-alphabetic.html [ Crash Failure Timeout ]
 crbug.com/591099 fast/lists/w3-css3-list-styles-deprecated.html [ Failure ]
 crbug.com/591099 fast/lists/w3-css3-list-styles-fallback-style.html [ Crash Failure ]
@@ -14128,7 +12875,6 @@
 crbug.com/591099 fast/mediastream/no-interface-object.html [ Failure ]
 crbug.com/591099 fast/multicol/5-levels-of-nesting-crash.html [ Failure ]
 crbug.com/591099 fast/multicol/abspos-after-break-after.html [ Failure ]
-crbug.com/591099 fast/multicol/anonymous-block-split-crash.html [ Crash ]
 crbug.com/591099 fast/multicol/auto-height-forced-break-complex-margin-collapsing.html [ Failure ]
 crbug.com/591099 fast/multicol/balance-break-inside-avoid.html [ Failure ]
 crbug.com/591099 fast/multicol/balance-breakafter-before-nested-block.html [ Failure ]
@@ -14159,7 +12905,6 @@
 crbug.com/591099 fast/multicol/client-rects-rtl.html [ Failure ]
 crbug.com/591099 fast/multicol/client-rects-sole-empty-block.html [ Failure ]
 crbug.com/591099 fast/multicol/client-rects.html [ Failure ]
-crbug.com/591099 fast/multicol/clone-block-children-inline-mismatch-crash.html [ Crash ]
 crbug.com/591099 fast/multicol/column-break-with-balancing.html [ Failure ]
 crbug.com/591099 fast/multicol/column-count-with-rules.html [ Failure ]
 crbug.com/591099 fast/multicol/column-rules.html [ Failure ]
@@ -14172,7 +12917,6 @@
 crbug.com/591099 fast/multicol/composited-relpos-in-clipped.html [ Failure ]
 crbug.com/591099 fast/multicol/composited-relpos-overlapping-will-change.html [ Failure ]
 crbug.com/591099 fast/multicol/composited-relpos-resize.html [ Failure ]
-crbug.com/591099 fast/multicol/composited-relpos-simple.html [ Crash ]
 crbug.com/591099 fast/multicol/composited-relpos.html [ Failure ]
 crbug.com/591099 fast/multicol/composited-with-child-layer-in-next-column.html [ Failure ]
 crbug.com/591099 fast/multicol/composited-with-overflow-in-next-column.html [ Failure ]
@@ -14187,8 +12931,6 @@
 crbug.com/591099 fast/multicol/dynamic/change-block-with-inline-to-multicol-assert.html [ Failure ]
 crbug.com/591099 fast/multicol/dynamic/change-second-row-height.html [ Failure ]
 crbug.com/591099 fast/multicol/dynamic/change-spanner-display.html [ Crash Failure ]
-crbug.com/591099 fast/multicol/dynamic/change-spanner-parent-display.html [ Crash ]
-crbug.com/591099 fast/multicol/dynamic/former-spanner-in-float-in-continuation-crash.html [ Crash ]
 crbug.com/591099 fast/multicol/dynamic/insert-before-sole-abspos.html [ Failure ]
 crbug.com/591099 fast/multicol/dynamic/insert-block-among-text-in-anonymous-wrapper.html [ Failure ]
 crbug.com/591099 fast/multicol/dynamic/insert-block-before-spanner-before-content.html [ Failure ]
@@ -14210,8 +12952,6 @@
 crbug.com/591099 fast/multicol/dynamic/insert-spanner-pseudo-before.html [ Crash Failure ]
 crbug.com/591099 fast/multicol/dynamic/invalid-spanner-container-becomes-valid.html [ Failure ]
 crbug.com/591099 fast/multicol/dynamic/multicol-with-abspos-svg-with-foreignobject-with-multicol-crash.html [ Failure ]
-crbug.com/591099 fast/multicol/dynamic/relpos-becomes-static-has-abspos.html [ Crash ]
-crbug.com/591099 fast/multicol/dynamic/remove-abspos-next-to-spanner.html [ Crash ]
 crbug.com/591099 fast/multicol/dynamic/remove-content-before-inner-multicol-with-spanner-crash.html [ Failure ]
 crbug.com/591099 fast/multicol/dynamic/remove-content-from-scrollable.html [ Failure ]
 crbug.com/591099 fast/multicol/dynamic/remove-inline-and-spanner-after-spanner-foreignObject.html [ Failure ]
@@ -14231,7 +12971,6 @@
 crbug.com/591099 fast/multicol/event-offset.html [ Failure ]
 crbug.com/591099 fast/multicol/explicit-columns-auto.html [ Failure ]
 crbug.com/591099 fast/multicol/fieldset-as-multicol.html [ Crash Failure ]
-crbug.com/591099 fast/multicol/file-upload-as-multicol.html [ Crash Failure ]
 crbug.com/591099 fast/multicol/first-line-in-block-below-next-column-top.html [ Failure ]
 crbug.com/591099 fast/multicol/first-line-in-block-with-padding-exact-fit.html [ Failure ]
 crbug.com/591099 fast/multicol/first-line-in-block-with-padding.html [ Failure ]
@@ -14262,7 +13001,6 @@
 crbug.com/591099 fast/multicol/float-with-margin-moved-by-child-line-and-unbreakable.html [ Failure ]
 crbug.com/591099 fast/multicol/float-with-margin-moved-by-child-line.html [ Failure ]
 crbug.com/591099 fast/multicol/float-with-margin-moved-unbreakable.html [ Failure ]
-crbug.com/591099 fast/multicol/flowthread-with-floats-destroyed-crash.html [ Crash ]
 crbug.com/591099 fast/multicol/forced-break-after-block-with-spanner.html [ Crash Failure ]
 crbug.com/591099 fast/multicol/forced-break-after-last-block-before-spanner.html [ Failure ]
 crbug.com/591099 fast/multicol/forced-break-before-complex-margin-collapsing.html [ Failure ]
@@ -14276,16 +13014,13 @@
 crbug.com/591099 fast/multicol/hit-test-gap-between-pages.html [ Crash Failure ]
 crbug.com/591099 fast/multicol/image-inside-nested-blocks-with-border.html [ Failure ]
 crbug.com/591099 fast/multicol/image-loaded-before-layout-assert.html [ Failure ]
-crbug.com/591099 fast/multicol/infinite-height-causing-fractional-row-height-crash.html [ Crash ]
 crbug.com/591099 fast/multicol/infinitely-tall-content-in-outer-crash.html [ Failure ]
 crbug.com/591099 fast/multicol/inline-children-crash.html [ Failure ]
 crbug.com/591099 fast/multicol/inner-multicol-moved-into-continuation.html [ Failure ]
 crbug.com/591099 fast/multicol/input-as-multicol.html [ Crash Failure Pass ]
 crbug.com/591099 fast/multicol/input-type-number.html [ Crash Pass ]
-crbug.com/591099 fast/multicol/large-padding-crash.html [ Crash ]
 crbug.com/591099 fast/multicol/layers-split-across-columns.html [ Failure ]
 crbug.com/591099 fast/multicol/line-pushed-down-by-float.html [ Failure ]
-crbug.com/591099 fast/multicol/listbox-as-multicol.html [ Failure ]
 crbug.com/591099 fast/multicol/many-lines-overflow-in-single-row-inner.html [ Failure ]
 crbug.com/591099 fast/multicol/margin-bottom-and-break-after.html [ Failure ]
 crbug.com/591099 fast/multicol/min-height-greater-than-content.html [ Failure ]
@@ -14296,7 +13031,7 @@
 crbug.com/591099 fast/multicol/mixed-positioning-stacking-order.html [ Failure ]
 crbug.com/591099 fast/multicol/multicol-becomes-paged-auto-height.html [ Crash Pass ]
 crbug.com/591099 fast/multicol/multicol-becomes-paged-fixed-height.html [ Crash Pass ]
-crbug.com/591099 fast/multicol/multicol-with-spanner-becomes-paged.html [ Crash ]
+crbug.com/591099 fast/multicol/multicol-with-spanner-becomes-paged.html [ Crash Failure ]
 crbug.com/591099 fast/multicol/negative-margins-crash.html [ Failure ]
 crbug.com/591099 fast/multicol/nested-3-multicols-fixed-height.html [ Failure ]
 crbug.com/591099 fast/multicol/nested-after-composited-layer-crash.html [ Failure ]
@@ -14318,7 +13053,6 @@
 crbug.com/591099 fast/multicol/nested-with-composited-and-multicol-crash.html [ Failure ]
 crbug.com/591099 fast/multicol/nested-with-forced-breaks-in-eariler-rows.html [ Failure ]
 crbug.com/591099 fast/multicol/nested-with-line-taller-than-outer.html [ Failure ]
-crbug.com/591099 fast/multicol/nested-with-spanner-inside-margins-crash.html [ Crash ]
 crbug.com/591099 fast/multicol/newmulticol/balance-images.html [ Failure ]
 crbug.com/591099 fast/multicol/newmulticol/balance-maxheight1.html [ Failure ]
 crbug.com/591099 fast/multicol/newmulticol/balance-maxheight2.html [ Failure ]
@@ -14343,7 +13077,6 @@
 crbug.com/591099 fast/multicol/newmulticol/fixed-height-fill-balance.html [ Failure ]
 crbug.com/591099 fast/multicol/newmulticol/hide-box-vertical-lr.html [ Failure Pass ]
 crbug.com/591099 fast/multicol/newmulticol/hide-box-vertical-rl.html [ Failure Pass ]
-crbug.com/591099 fast/multicol/newmulticol/list-item.html [ Crash Failure ]
 crbug.com/591099 fast/multicol/newmulticol/orphans-and-widows-balance.html [ Failure ]
 crbug.com/591099 fast/multicol/null-lastFloat-in-removeFloatingObjectsBelow.html [ Failure ]
 crbug.com/591099 fast/multicol/one-column-with-break.html [ Failure ]
@@ -14395,15 +13128,10 @@
 crbug.com/591099 fast/multicol/span/button-with-spanner-crash.html [ Failure ]
 crbug.com/591099 fast/multicol/span/change-spanner-margins.html [ Failure ]
 crbug.com/591099 fast/multicol/span/clone-anonymous-block-non-inline-child-crash.html [ Crash Failure ]
-crbug.com/591099 fast/multicol/span/clone-before-after-content-crash.html [ Crash ]
-crbug.com/591099 fast/multicol/span/empty-anonymous-block-split-crash.html [ Crash ]
-crbug.com/591099 fast/multicol/span/empty-block-between-spanners.html [ Crash ]
-crbug.com/591099 fast/multicol/span/empty-block-with-bottom-margin-between-spanners.html [ Crash ]
 crbug.com/591099 fast/multicol/span/fill-after-spanner-exact-fit.html [ Failure ]
 crbug.com/591099 fast/multicol/span/fill-after-spanner-extra-height.html [ Failure ]
 crbug.com/591099 fast/multicol/span/float.html [ Failure ]
 crbug.com/591099 fast/multicol/span/foreignObject.html [ Failure ]
-crbug.com/591099 fast/multicol/span/generated-child-split-flow-crash.html [ Crash ]
 crbug.com/591099 fast/multicol/span/in-nested-multicol-with-hard-breaks.html [ Failure ]
 crbug.com/591099 fast/multicol/span/in-nested-multicol-with-list-item.html [ Failure ]
 crbug.com/591099 fast/multicol/span/in-nested-multicol-with-soft-breaks-inside.html [ Failure ]
@@ -14414,7 +13142,6 @@
 crbug.com/591099 fast/multicol/span/inside-overflow-hidden-crash.html [ Failure ]
 crbug.com/591099 fast/multicol/span/invalid-span-1.html [ Failure ]
 crbug.com/591099 fast/multicol/span/margin-on-multicol.html [ Failure ]
-crbug.com/591099 fast/multicol/span/multicol-with-spanner-becomes-regular-block.html [ Crash ]
 crbug.com/591099 fast/multicol/span/nested-multicol.html [ Failure ]
 crbug.com/591099 fast/multicol/span/offset-properties.html [ Failure ]
 crbug.com/591099 fast/multicol/span/outer-column-break-after-inner-spanner-2.html [ Crash Failure ]
@@ -14435,7 +13162,6 @@
 crbug.com/591099 fast/multicol/span/relpos-in-block.html [ Crash Failure ]
 crbug.com/591099 fast/multicol/span/relpos-spanner-with-abspos-child.html [ Failure ]
 crbug.com/591099 fast/multicol/span/remaining-space-in-last-column.html [ Failure Pass ]
-crbug.com/591099 fast/multicol/span/runin-continuation-crash.html [ Crash ]
 crbug.com/591099 fast/multicol/span/simple-margins.html [ Failure ]
 crbug.com/591099 fast/multicol/span/sole-spanner-inside-div.html [ Failure ]
 crbug.com/591099 fast/multicol/span/sole-svg-spanner-with-foreignObject-crash.html [ Failure ]
@@ -14443,12 +13169,10 @@
 crbug.com/591099 fast/multicol/span/spanner-img.html [ Crash Failure ]
 crbug.com/591099 fast/multicol/span/spanner-in-flexbox-in-multicol-in-flexbox-crash.html [ Failure ]
 crbug.com/591099 fast/multicol/span/spanner-inline-block.html [ Failure ]
-crbug.com/591099 fast/multicol/span/spanner-table.html [ Crash ]
 crbug.com/591099 fast/multicol/span/spanner-with-margin.html [ Crash Failure ]
 crbug.com/591099 fast/multicol/span/summary-split.html [ Failure ]
 crbug.com/591099 fast/multicol/span/two-rows-then-spanner-then-two-rows.html [ Failure ]
 crbug.com/591099 fast/multicol/span/underflow-after-spanner.html [ Crash Failure ]
-crbug.com/591099 fast/multicol/span/update-after-content-before-child-crash.html [ Crash ]
 crbug.com/591099 fast/multicol/span/vertical-lr.html [ Failure ]
 crbug.com/591099 fast/multicol/span/vertical-rl.html [ Failure ]
 crbug.com/591099 fast/multicol/table-caption-and-cells-fixed-width.html [ Failure ]
@@ -14573,7 +13297,6 @@
 crbug.com/591099 fast/overflow/resize-inherit.html [ Failure ]
 crbug.com/591099 fast/overflow/scroll-div-hide-show.html [ Failure ]
 crbug.com/591099 fast/overflow/scroll-html-hidden-body.html [ Failure Pass ]
-crbug.com/591099 fast/overflow/scroll-html-paged-body.html [ Crash ]
 crbug.com/591099 fast/overflow/scroll-nested-positioned-layer-in-overflow.html [ Failure ]
 crbug.com/591099 fast/overflow/scroll-vertical-not-horizontal.html [ Failure ]
 crbug.com/591099 fast/overflow/scrollRevealButton.html [ Failure ]
@@ -14586,7 +13309,6 @@
 crbug.com/591099 fast/overflow/trailing-float-linebox.html [ Failure ]
 crbug.com/591099 fast/overflow/unreachable-overflow-rtl-bug.html [ Failure ]
 crbug.com/591099 fast/pagination/auto-height-with-break.html [ Crash Failure ]
-crbug.com/591099 fast/pagination/auto-height.html [ Crash Pass ]
 crbug.com/591099 fast/pagination/body-make-unpaginated.html [ Failure ]
 crbug.com/591099 fast/pagination/break-in-paged-overflow.html [ Crash Failure ]
 crbug.com/591099 fast/pagination/caret-range-outside-paged-x-rtl-vertical-rl.html [ Crash Failure ]
@@ -14596,7 +13318,6 @@
 crbug.com/591099 fast/pagination/caret-range-outside-paged-y-rtl-vertical-rl.html [ Crash Failure ]
 crbug.com/591099 fast/pagination/caret-range-outside-paged-y-rtl.html [ Crash Failure ]
 crbug.com/591099 fast/pagination/caret-range-outside-paged-y.html [ Crash Failure ]
-crbug.com/591099 fast/pagination/div-make-paginated.html [ Crash ]
 crbug.com/591099 fast/pagination/div-x-horizontal-tb-ltr.html [ Crash Failure ]
 crbug.com/591099 fast/pagination/div-x-horizontal-tb-rtl.html [ Crash Failure ]
 crbug.com/591099 fast/pagination/div-x-vertical-lr-ltr.html [ Crash Failure ]
@@ -14677,7 +13398,6 @@
 crbug.com/591099 fast/parser/inselect-tokenization.html [ Crash ]
 crbug.com/591099 fast/parser/invalid-entity-document-write.html [ Failure ]
 crbug.com/591099 fast/parser/move-during-parsing.html [ Failure ]
-crbug.com/591099 fast/parser/nested-fragment-parser-crash.html [ Crash ]
 crbug.com/591099 fast/parser/nofoo-tags-inside-paragraph.html [ Failure ]
 crbug.com/591099 fast/parser/non-script-endtag-in-textmode.html [ Failure ]
 crbug.com/591099 fast/parser/noscript-with-javascript-disabled.html [ Failure ]
@@ -14843,17 +13563,12 @@
 crbug.com/591099 fast/replaced/vertical-writing-mode-max-logical-width-replaced.html [ Failure ]
 crbug.com/591099 fast/replaced/width100percent-checkbox.html [ Failure ]
 crbug.com/591099 fast/replaced/width100percent-radio.html [ Failure ]
-crbug.com/591099 fast/replaced/width100percent-searchfield.html [ Crash Failure ]
 crbug.com/591099 fast/ruby/add-text-to-block-ruby-with-after-pseudo-crash.html [ Crash Pass ]
 crbug.com/591099 fast/ruby/after-doesnt-crash.html [ Crash Failure ]
 crbug.com/591099 fast/ruby/base-shorter-than-text.html [ Crash Failure ]
-crbug.com/591099 fast/ruby/before-block-doesnt-crash.html [ Crash Failure ]
 crbug.com/591099 fast/ruby/before-doesnt-crash.html [ Crash Failure ]
-crbug.com/591099 fast/ruby/before-table-doesnt-crash.html [ Crash Failure ]
-crbug.com/591099 fast/ruby/float-object-doesnt-crash.html [ Crash Failure ]
 crbug.com/591099 fast/ruby/float-overhang-from-ruby-text.html [ Crash Failure ]
 crbug.com/591099 fast/ruby/floating-ruby-text.html [ Crash Failure ]
-crbug.com/591099 fast/ruby/generated-before-counter-doesnt-crash.html [ Crash Pass ]
 crbug.com/591099 fast/ruby/line-break-ruby.html [ Crash ]
 crbug.com/591099 fast/ruby/list-item-marker-in-block-ruby.html [ Crash Failure ]
 crbug.com/591099 fast/ruby/merge-adjacent-anonymous-blocks-inside-ruby-run.html [ Crash Failure ]
@@ -14876,7 +13591,6 @@
 crbug.com/591099 fast/ruby/ruby-block-style-not-updated.html [ Crash Failure ]
 crbug.com/591099 fast/ruby/ruby-empty-rt.html [ Crash Failure ]
 crbug.com/591099 fast/ruby/ruby-first-letter.html [ Crash Pass ]
-crbug.com/591099 fast/ruby/ruby-illegal-1.html [ Crash ]
 crbug.com/591099 fast/ruby/ruby-illegal-4.html [ Crash Pass ]
 crbug.com/591099 fast/ruby/ruby-illegal-5.html [ Crash Pass ]
 crbug.com/591099 fast/ruby/ruby-illegal-6.html [ Crash Pass ]
@@ -14973,7 +13687,6 @@
 crbug.com/591099 fast/scrolling/html-element-client-rect-excludes-scrollbars.html [ Failure ]
 crbug.com/591099 fast/scrolling/jquery-rtl-scroll-type.html [ Failure Pass ]
 crbug.com/591099 fast/scrolling/keyboard-scroll-page-scale.html [ Failure ]
-crbug.com/591099 fast/scrolling/listbox-wheel-event.html [ Failure ]
 crbug.com/591099 fast/scrolling/non-composited-scrolling-repaint-to-ancestor-backing.html [ Failure Pass ]
 crbug.com/591099 fast/scrolling/overflow-auto-ltr.html [ Failure ]
 crbug.com/591099 fast/scrolling/overflow-scrollability.html [ Failure ]
@@ -14986,13 +13699,8 @@
 crbug.com/591099 fast/scrolling/scroll-to-origin-with-options-no-layout.html [ Failure Pass ]
 crbug.com/591099 fast/scrolling/scrollable-area-dynamic-overflow.html [ Failure Pass ]
 crbug.com/591099 fast/scrolling/scrollable-area-frame-overflow-hidden.html [ Crash Failure ]
-crbug.com/591099 fast/scrolling/scrollable-area-frame-overried-inherited-visibility-hidden.html [ Crash Failure ]
-crbug.com/591099 fast/scrolling/scrollable-area-frame-scrolling-no-overried-inherited-visibility-hidden.html [ Crash Failure ]
 crbug.com/591099 fast/scrolling/scrollable-area-frame-scrolling-no-visibility-hidden-child.html [ Crash Pass ]
-crbug.com/591099 fast/scrolling/scrollable-area-frame-scrolling-no.html [ Crash Failure ]
-crbug.com/591099 fast/scrolling/scrollable-area-frame-scrolling-yes.html [ Crash Failure ]
 crbug.com/591099 fast/scrolling/scrollable-area-frame-visibility-hidden-child.html [ Crash Pass ]
-crbug.com/591099 fast/scrolling/scrollable-area-frame.html [ Crash Failure ]
 crbug.com/591099 fast/scrolling/scrollable-area-overflow-auto-visibility-override.html [ Failure Pass ]
 crbug.com/591099 fast/scrolling/scrollable-area-overflow-auto-visibility-visible.html [ Failure Pass ]
 crbug.com/591099 fast/scrolling/scrollable-area-overflow-auto.html [ Failure Pass ]
@@ -15004,10 +13712,6 @@
 crbug.com/591099 fast/scrolling/scrolling-apis-nan-scroll-position.html [ Failure ]
 crbug.com/591099 fast/scrolling/scrolling-apis-subpixel.html [ Failure ]
 crbug.com/591099 fast/scrolling/set-root-scroller.html [ Failure ]
-crbug.com/591099 fast/selectors/001.html [ Crash ]
-crbug.com/591099 fast/selectors/012.html [ Crash ]
-crbug.com/591099 fast/selectors/013.html [ Crash ]
-crbug.com/591099 fast/selectors/015.html [ Crash ]
 crbug.com/591099 fast/selectors/018.html [ Failure ]
 crbug.com/591099 fast/selectors/018b.html [ Failure ]
 crbug.com/591099 fast/selectors/019.html [ Failure ]
@@ -15089,7 +13793,6 @@
 crbug.com/591099 fast/selectors/element-closest-scope.html [ Failure ]
 crbug.com/591099 fast/selectors/focus-within-iframe.html [ Crash ]
 crbug.com/591099 fast/selectors/focus-within-window-inactive.html [ Crash ]
-crbug.com/591099 fast/selectors/input-with-selection-pseudo-element.html [ Crash Failure ]
 crbug.com/591099 fast/selectors/lang-inheritance.html [ Failure Pass ]
 crbug.com/591099 fast/selectors/lang-inheritance2.html [ Failure Pass ]
 crbug.com/591099 fast/selectors/lang-vs-xml-lang-xhtml.xhtml [ Failure Pass ]
@@ -15239,23 +13942,19 @@
 crbug.com/591099 fast/sub-pixel/float-with-right-margin-zoom.html [ Failure ]
 crbug.com/591099 fast/sub-pixel/inline-block-with-padding.html [ Failure ]
 crbug.com/591099 fast/sub-pixel/repaint-subpixel-layer-in-subpixel-composited-layer.html [ Failure Pass ]
-crbug.com/591099 fast/sub-pixel/replaced-element-baseline.html [ Failure ]
 crbug.com/591099 fast/sub-pixel/selection/selection-rect-in-sub-pixel-table.html [ Failure ]
 crbug.com/591099 fast/sub-pixel/shadows-computed-style.html [ Failure ]
 crbug.com/591099 fast/sub-pixel/should-not-repaint-subpixel-composited-layer.html [ Failure Pass ]
 crbug.com/591099 fast/sub-pixel/size-of-box-with-zoom.html [ Failure ]
 crbug.com/591099 fast/sub-pixel/size-of-span-with-different-positions.html [ Failure ]
-crbug.com/591099 fast/sub-pixel/sub-pixel-accumulates-to-layers.html [ Crash ]
 crbug.com/591099 fast/sub-pixel/sub-pixel-border.html [ Crash ]
 crbug.com/591099 fast/sub-pixel/sub-pixel-precision-on-height-of-replaced-element.html [ Failure ]
 crbug.com/591099 fast/sub-pixel/table-rows-have-stable-height.html [ Failure ]
 crbug.com/591099 fast/sub-pixel/vertical-align-middle-overflow.html [ Failure Pass ]
-crbug.com/591099 fast/table/001.html [ Crash ]
 crbug.com/591099 fast/table/003.html [ Failure ]
 crbug.com/591099 fast/table/007.html [ Failure ]
 crbug.com/591099 fast/table/009.html [ Failure ]
 crbug.com/591099 fast/table/014.html [ Failure Pass ]
-crbug.com/591099 fast/table/018.html [ Crash Failure ]
 crbug.com/591099 fast/table/026.html [ Failure Pass ]
 crbug.com/591099 fast/table/032.html [ Failure ]
 crbug.com/591099 fast/table/034.html [ Failure ]
@@ -15279,10 +13978,6 @@
 crbug.com/591099 fast/table/backgr_border-table-quirks-collapsed-border.html [ Failure ]
 crbug.com/591099 fast/table/backgr_border-table-quirks.html [ Failure ]
 crbug.com/591099 fast/table/backgr_image-crash.html [ Failure ]
-crbug.com/591099 fast/table/backgr_layers-opacity-collapsed-border.html [ Crash Failure ]
-crbug.com/591099 fast/table/backgr_layers-opacity.html [ Crash Failure ]
-crbug.com/591099 fast/table/backgr_layers-show-collapsed-border.html [ Crash Failure ]
-crbug.com/591099 fast/table/backgr_layers-show.html [ Crash Failure ]
 crbug.com/591099 fast/table/bad-replaced-sizing-preferred-logical-widths.html [ Failure ]
 crbug.com/591099 fast/table/baseline-align-rowspan.html [ Failure ]
 crbug.com/591099 fast/table/border-changes.html [ Failure ]
@@ -15317,7 +14012,6 @@
 crbug.com/591099 fast/table/colspan-with-empty-cells-needing-extra-width.html [ Failure ]
 crbug.com/591099 fast/table/column-in-inline.html [ Failure ]
 crbug.com/591099 fast/table/columngroup-inside-columngroup.html [ Failure ]
-crbug.com/591099 fast/table/computeLogicalWidth-table-needsSectionRecalc.html [ Crash ]
 crbug.com/591099 fast/table/containment-crash.html [ Failure ]
 crbug.com/591099 fast/table/containment.html [ Failure ]
 crbug.com/591099 fast/table/convert-inline-anonoymous-wrapper-to-block.html [ Failure Pass ]
@@ -15424,10 +14118,8 @@
 crbug.com/591099 fast/table/table-all-rowspans-height-distribution-in-rows.html [ Failure ]
 crbug.com/591099 fast/table/table-before-child-in-table.html [ Failure Pass ]
 crbug.com/591099 fast/table/table-caption-moved-crash.html [ Crash ]
-crbug.com/591099 fast/table/table-cell-before-child-in-block.html [ Crash ]
 crbug.com/591099 fast/table/table-cell-negative-start-margin-align-center.html [ Failure ]
 crbug.com/591099 fast/table/table-colgroup-present-after-table-row.html [ Failure ]
-crbug.com/591099 fast/table/table-continuation-outline-paint-crash.html [ Crash ]
 crbug.com/591099 fast/table/table-different-overflow-values-2.html [ Failure ]
 crbug.com/591099 fast/table/table-different-overflow-values.html [ Failure ]
 crbug.com/591099 fast/table/table-display-types-vertical.html [ Failure ]
@@ -15452,7 +14144,6 @@
 crbug.com/591099 fast/table/table-toggle-paragraph-padding.html [ Failure ]
 crbug.com/591099 fast/table/table-with-borderattr-null.html [ Failure ]
 crbug.com/591099 fast/table/table-with-borderattr-set-to-null.html [ Failure ]
-crbug.com/591099 fast/table/tbody-background-image-repeat-y.html [ Crash ]
 crbug.com/591099 fast/table/td-bordercolor-attribute.html [ Failure ]
 crbug.com/591099 fast/table/td-display-nowrap.html [ Failure ]
 crbug.com/591099 fast/table/tr-min-content-crash.html [ Failure ]
@@ -15474,7 +14165,7 @@
 crbug.com/591099 fast/text-autosizing/clusters-sufficient-text-except-in-root.html [ Failure ]
 crbug.com/591099 fast/text-autosizing/clusters-sufficient-width.html [ Failure ]
 crbug.com/591099 fast/text-autosizing/constrained-and-overflow-auto-ancestor.html [ Failure ]
-crbug.com/591099 fast/text-autosizing/constrained-and-overflow-paged-x-ancestor.html [ Crash ]
+crbug.com/591099 fast/text-autosizing/constrained-and-overflow-paged-x-ancestor.html [ Crash Failure ]
 crbug.com/591099 fast/text-autosizing/constrained-and-overflow-scroll-ancestor.html [ Failure ]
 crbug.com/591099 fast/text-autosizing/constrained-height-body.html [ Failure ]
 crbug.com/591099 fast/text-autosizing/constrained-then-overflow-ancestors.html [ Failure ]
@@ -15514,13 +14205,9 @@
 crbug.com/591099 fast/text-autosizing/resize-window.html [ Failure ]
 crbug.com/591099 fast/text-autosizing/similar-clusters.html [ Failure ]
 crbug.com/591099 fast/text-autosizing/span-child.html [ Failure ]
-crbug.com/591099 fast/text-autosizing/subtree-layout-crash.html [ Crash ]
-crbug.com/591099 fast/text-autosizing/subtree-relayout-input.html [ Crash Failure ]
 crbug.com/591099 fast/text-autosizing/table-inflation-crash.html [ Crash Failure ]
-crbug.com/591099 fast/text-autosizing/table-simplified-layout-crash.html [ Crash ]
 crbug.com/591099 fast/text-autosizing/tables/nested-table-wrapping.html [ Failure ]
 crbug.com/591099 fast/text-autosizing/tables/nested-tables.html [ Failure ]
-crbug.com/591099 fast/text-autosizing/textarea-fontsize-change.html [ Crash Failure ]
 crbug.com/591099 fast/text-autosizing/unwrappable-blocks.html [ Failure ]
 crbug.com/591099 fast/text-autosizing/unwrappable-inlines.html [ Failure ]
 crbug.com/591099 fast/text-autosizing/various-font-sizes.html [ Failure ]
@@ -15531,7 +14218,6 @@
 crbug.com/591099 fast/text-autosizing/wide-in-narrow-overflow-scroll.html [ Failure ]
 crbug.com/591099 fast/text/align-center-rtl-spill.html [ Failure ]
 crbug.com/591099 fast/text/apply-start-width-after-skipped-text.html [ Failure ]
-crbug.com/591099 fast/text/atsui-bidi-control.html [ Crash ]
 crbug.com/591099 fast/text/atsui-kerning-and-ligatures.html [ Failure ]
 crbug.com/591099 fast/text/atsui-multiple-renderers.html [ Failure ]
 crbug.com/591099 fast/text/atsui-negative-spacing-features.html [ Failure ]
@@ -15550,7 +14236,6 @@
 crbug.com/591099 fast/text/basic/generic-family-reset.html [ Failure ]
 crbug.com/591099 fast/text/bidi-embedding-pop-and-push-same.html [ Failure ]
 crbug.com/591099 fast/text/bidi-explicit-embedding-past-end.html [ Failure Pass ]
-crbug.com/591099 fast/text/bidi-img-alt-text.html [ Crash Failure ]
 crbug.com/591099 fast/text/bidi-isolate-embedding-crash.html [ Failure ]
 crbug.com/591099 fast/text/bidi-isolate-hang-with-neutral.html [ Failure ]
 crbug.com/591099 fast/text/bidi-isolate-nextlinebreak-failure.html [ Failure Pass ]
@@ -15560,9 +14245,6 @@
 crbug.com/591099 fast/text/break-word.html [ Failure ]
 crbug.com/591099 fast/text/capitalize-empty-generated-string.html [ Failure ]
 crbug.com/591099 fast/text/capitalize-preserve-nbsp.html [ Failure ]
-crbug.com/591099 fast/text/caps-lock-indicator-disabled.html [ Failure ]
-crbug.com/591099 fast/text/caps-lock-indicator-enabled-rtl.html [ Failure ]
-crbug.com/591099 fast/text/caps-lock-indicator-enabled.html [ Failure ]
 crbug.com/591099 fast/text/cg-fallback-bolding.html [ Failure ]
 crbug.com/591099 fast/text/chromium-linux-fallback-crash.html [ Failure ]
 crbug.com/591099 fast/text/chromium-linux-fontconfig-renderstyle.html [ Failure ]
@@ -15597,8 +14279,6 @@
 crbug.com/591099 fast/text/ellipsis-rtl-text-in-rtl-flow-underline.html [ Failure ]
 crbug.com/591099 fast/text/ellipsis-rtl-text-in-rtl-flow.html [ Failure ]
 crbug.com/591099 fast/text/ellipsis-stroked.html [ Failure ]
-crbug.com/591099 fast/text/ellipsis-with-list-marker-in-ltr-flow.html [ Crash Failure ]
-crbug.com/591099 fast/text/ellipsis-with-list-marker-in-rtl-flow.html [ Crash Failure ]
 crbug.com/591099 fast/text/emoji-web-font.html [ Failure ]
 crbug.com/591099 fast/text/emphasis-avoid-ruby.html [ Crash Failure ]
 crbug.com/591099 fast/text/emphasis-combined-text.html [ Failure ]
@@ -15660,15 +14340,12 @@
 crbug.com/591099 fast/text/international/complex-character-based-fallback.html [ Failure ]
 crbug.com/591099 fast/text/international/complex-joining-using-gpos.html [ Failure ]
 crbug.com/591099 fast/text/international/danda-space.html [ Failure ]
-crbug.com/591099 fast/text/international/dir-auto-in-textarea-neutral.html [ Crash Failure ]
 crbug.com/591099 fast/text/international/draw-complex-text-from-to.html [ Failure ]
 crbug.com/591099 fast/text/international/float-as-only-child-of-isolate-crash.html [ Failure ]
 crbug.com/591099 fast/text/international/hebrew-vowels.html [ Failure ]
 crbug.com/591099 fast/text/international/hindi-whitespace.html [ Failure ]
-crbug.com/591099 fast/text/international/iso-8859-8-and-isolate.html [ Crash ]
 crbug.com/591099 fast/text/international/iso-8859-8.html [ Failure ]
 crbug.com/591099 fast/text/international/listbox-width-rtl.html [ Crash ]
-crbug.com/591099 fast/text/international/mixed-directionality-selection.html [ Crash Failure ]
 crbug.com/591099 fast/text/international/plane2.html [ Failure ]
 crbug.com/591099 fast/text/international/rtl-caret.html [ Failure ]
 crbug.com/591099 fast/text/international/rtl-negative-letter-spacing.html [ Failure ]
@@ -15684,11 +14361,9 @@
 crbug.com/591099 fast/text/international/unicode-bidi-isolate-nested-crash.html [ Failure ]
 crbug.com/591099 fast/text/international/unicode-bidi-isolate-nested-with-removes-not-adjacent.html [ Crash ]
 crbug.com/591099 fast/text/international/unicode-bidi-isolate-nested-with-removes.html [ Crash ]
-crbug.com/591099 fast/text/international/unicode-bidi-plaintext-in-textarea.html [ Crash Failure ]
 crbug.com/591099 fast/text/international/unicode-bidi-plaintext.html [ Failure ]
 crbug.com/591099 fast/text/international/vertical-text-glyph-test.html [ Failure ]
 crbug.com/591099 fast/text/international/vertical-text-metrics-test.html [ Crash Failure ]
-crbug.com/591099 fast/text/international/wrap-CJK-001.html [ Crash ]
 crbug.com/591099 fast/text/ipa-tone-letters.html [ Failure ]
 crbug.com/591099 fast/text/justified-selection-at-edge.html [ Failure ]
 crbug.com/591099 fast/text/justified-selection.html [ Failure ]
@@ -15776,7 +14451,6 @@
 crbug.com/591099 fast/text/text-combine-shrink-to-fit.html [ Failure ]
 crbug.com/591099 fast/text/text-combine-width-after-style-change.html [ Crash Pass ]
 crbug.com/591099 fast/text/text-container-bounding-rect.html [ Crash Failure ]
-crbug.com/591099 fast/text/text-fragment-first-letter-update-crash.html [ Crash ]
 crbug.com/591099 fast/text/text-iterator-crash.html [ Crash ]
 crbug.com/591099 fast/text/text-large-negative-letter-spacing-with-opacity.html [ Failure ]
 crbug.com/591099 fast/text/text-letter-spacing.html [ Failure ]
@@ -15834,14 +14508,12 @@
 crbug.com/591099 fast/text/whitespace/pre-wrap-spaces-after-newline.html [ Failure ]
 crbug.com/591099 fast/text/whitespace/select-new-line-with-line-break-normal.html [ Failure ]
 crbug.com/591099 fast/text/whitespace/span-in-word-space-causes-overflow.html [ Failure Pass ]
-crbug.com/591099 fast/text/whitespace/tab-character-basics.html [ Crash Failure ]
 crbug.com/591099 fast/text/whitespace/text-align-justify-and-whitespace-pre.html [ Failure Pass ]
-crbug.com/591099 fast/text/whitespace/whitespace-and-margin-wrap-after-list-marker-crash.html [ Crash Failure ]
 crbug.com/591099 fast/text/whitespace/whitespace-in-pre.html [ Failure ]
 crbug.com/591099 fast/text/wide-preformatted.html [ Failure ]
 crbug.com/591099 fast/text/word-break-run-rounding.html [ Failure ]
 crbug.com/591099 fast/text/word-break-soft-hyphen.html [ Failure ]
-crbug.com/591099 fast/text/word-break.html [ Failure ]
+crbug.com/591099 fast/text/word-break.html [ Failure Pass ]
 crbug.com/591099 fast/text/word-space-between-inlines.html [ Failure ]
 crbug.com/591099 fast/text/word-space-monospace.html [ Failure Pass ]
 crbug.com/591099 fast/text/word-space-with-kerning-2.html [ Failure Pass ]
@@ -16013,10 +14685,7 @@
 crbug.com/591099 fast/writing-mode/margin-collapse.html [ Failure ]
 crbug.com/591099 fast/writing-mode/margins.html [ Failure ]
 crbug.com/591099 fast/writing-mode/orthogonal-writing-modes-available-width-absolute-crash.html [ Failure ]
-crbug.com/591099 fast/writing-mode/orthogonal-writing-modes-change-root-inline-crash.html [ Crash ]
 crbug.com/591099 fast/writing-mode/orthogonal-writing-modes-floats-crash-3.html [ Crash ]
-crbug.com/591099 fast/writing-mode/orthogonal-writing-modes-floats-crash.html [ Crash ]
-crbug.com/591099 fast/writing-mode/orthogonal-writing-modes-in-layoutview-with-floats.html [ Crash ]
 crbug.com/591099 fast/writing-mode/orthogonal-writing-modes-scrollbarpart-crash.html [ Failure ]
 crbug.com/591099 fast/writing-mode/percentage-height-orthogonal-writing-modes-quirks.html [ Failure ]
 crbug.com/591099 fast/writing-mode/percentage-height-orthogonal-writing-modes.html [ Failure ]
@@ -16044,7 +14713,6 @@
 crbug.com/591099 fast/xmlhttprequest/xmlhttprequest-detached-mixedcontent-no-crash.html [ Failure ]
 crbug.com/591099 fast/xmlhttprequest/xmlhttprequest-get.xhtml [ Failure ]
 crbug.com/591099 fast/xmlhttprequest/xmlhttprequest-html-response-encoding.html [ Crash Failure ]
-crbug.com/591099 fast/xmlhttprequest/xmlhttprequest-invalid-values.html [ Crash ]
 crbug.com/591099 fast/xmlhttprequest/xmlhttprequest-missing-file-exception.html [ Failure ]
 crbug.com/591099 fast/xmlhttprequest/xmlhttprequest-nonexistent-file.html [ Failure ]
 crbug.com/591099 fast/xmlhttprequest/xmlhttprequest-open-after-iframe-onload-remove-self.html [ Crash ]
@@ -16129,7 +14797,6 @@
 crbug.com/591099 fonts/sans-serif.html [ Failure ]
 crbug.com/591099 fonts/serif.html [ Failure ]
 crbug.com/591099 fragmentation/abspos-after-forced-break.html [ Failure ]
-crbug.com/591099 fragmentation/abspos-table-in-nested-multicol-crash.html [ Crash ]
 crbug.com/591099 fragmentation/auto-scrollbar-shrink-to-fit.html [ Failure ]
 crbug.com/591099 fragmentation/avoid-break-inside-first-child-nested.html [ Failure ]
 crbug.com/591099 fragmentation/avoid-break-inside-first-child.html [ Failure ]
@@ -16180,11 +14847,9 @@
 crbug.com/591099 fragmentation/single-cells-multiple-tables-no-repeating-thead.html [ Failure ]
 crbug.com/591099 fragmentation/single-line-cells-in-multiple-table-sections.html [ Failure ]
 crbug.com/591099 fragmentation/single-line-cells-nested-repeating-thead-3.html [ Failure ]
-crbug.com/591099 fragmentation/single-line-cells-paginated-with-text.html [ Crash ]
 crbug.com/591099 fragmentation/single-line-cells-paginated.html [ Failure ]
 crbug.com/591099 fragmentation/single-line-cells-repeating-thead-starts-middle-of-page-break-after-avoid-2.html [ Failure Pass ]
 crbug.com/591099 fragmentation/single-line-cells-repeating-thead-with-border-spacing-at-top-of-row.html [ Failure ]
-crbug.com/591099 fragmentation/single-line-cells-self-painting-thead-break-inside-on-thead-only.html [ Crash ]
 crbug.com/591099 fragmentation/single-line-cells.html [ Failure ]
 crbug.com/591099 fragmentation/table-disable-fragmentation.html [ Failure ]
 crbug.com/591099 fragmentation/table-in-subpixel-fragmentainer.html [ Failure ]
@@ -16278,7 +14943,6 @@
 crbug.com/591099 hittesting/border-hittest-with-image-fallback.html [ Crash ]
 crbug.com/591099 hittesting/border-hittest.html [ Failure ]
 crbug.com/591099 hittesting/border-radius-hittest.html [ Failure ]
-crbug.com/591099 hittesting/culled-inline-crash.html [ Crash ]
 crbug.com/591099 hittesting/culled-inline.html [ Failure ]
 crbug.com/591099 hittesting/hittest-child-of-inlineblock.html [ Crash ]
 crbug.com/591099 hittesting/hittest-overlapping-floats.html [ Failure ]
@@ -16360,7 +15024,6 @@
 crbug.com/591099 html/details_summary/details-writing-mode-align-left.html [ Crash Failure ]
 crbug.com/591099 html/details_summary/details-writing-mode-align-right.html [ Crash Failure ]
 crbug.com/591099 html/details_summary/details-writing-mode.html [ Crash Failure ]
-crbug.com/591099 html/details_summary/mutation-details-focus.html [ Crash ]
 crbug.com/591099 html/dialog/abspos-dialog-layout.html [ Failure ]
 crbug.com/591099 html/dialog/closed-dialog-does-not-block-mouse-events.html [ Failure ]
 crbug.com/591099 html/dialog/dialog-autofocus-multiple-times.html [ Crash ]
@@ -16411,13 +15074,10 @@
 crbug.com/591099 html/grouping_content/figure-element.html [ Failure ]
 crbug.com/591099 html/grouping_content/listing.html [ Failure ]
 crbug.com/591099 html/grouping_content/main-element.html [ Failure ]
-crbug.com/591099 html/marquee/marquee-direction-attribute-should-be-case-insensitive.html [ Crash ]
 crbug.com/591099 html/marquee/marquee-element.html [ Crash Failure ]
-crbug.com/591099 html/marquee/marquee-scroll.html [ Crash ]
-crbug.com/591099 html/marquee/marquee-scrollamount.html [ Crash ]
+crbug.com/591099 html/marquee/marquee-scroll.html [ Crash Failure ]
+crbug.com/591099 html/marquee/marquee-scrollamount.html [ Crash Failure ]
 crbug.com/591099 html/marquee/marquee-shadow-root-no-access.html [ Crash ]
-crbug.com/591099 html/marquee/marquee-should-not-wrap.html [ Crash ]
-crbug.com/591099 html/marquee/marquee-vspace-hspace.html [ Crash ]
 crbug.com/591099 html/sections/article-element.html [ Failure ]
 crbug.com/591099 html/sections/aside-element.html [ Failure ]
 crbug.com/591099 html/sections/body-quirk-client-size.html [ Failure ]
@@ -16523,16 +15183,6 @@
 crbug.com/591099 http/tests/cache/zero-length-xhr.html [ Failure ]
 crbug.com/591099 http/tests/canvas/canvas-filter-svg-external-multiple.html [ Failure ]
 crbug.com/591099 http/tests/canvas/canvas-filter-svg-external.html [ Failure ]
-crbug.com/591099 http/tests/canvas/philip/tests/security.drawImage.canvas.html [ Crash ]
-crbug.com/591099 http/tests/canvas/philip/tests/security.drawImage.image.html [ Crash ]
-crbug.com/591099 http/tests/canvas/philip/tests/security.pattern.canvas.fillStyle.html [ Crash ]
-crbug.com/591099 http/tests/canvas/philip/tests/security.pattern.canvas.strokeStyle.html [ Crash ]
-crbug.com/591099 http/tests/canvas/philip/tests/security.pattern.canvas.timing.html [ Crash ]
-crbug.com/591099 http/tests/canvas/philip/tests/security.pattern.create.html [ Crash ]
-crbug.com/591099 http/tests/canvas/philip/tests/security.pattern.cross.html [ Crash ]
-crbug.com/591099 http/tests/canvas/philip/tests/security.pattern.image.fillStyle.html [ Crash ]
-crbug.com/591099 http/tests/canvas/philip/tests/security.pattern.image.strokeStyle.html [ Crash ]
-crbug.com/591099 http/tests/canvas/philip/tests/security.reset.html [ Crash ]
 crbug.com/591099 http/tests/canvas/webgl/origin-clean-conformance.html [ Failure ]
 crbug.com/591099 http/tests/cookies/double-quoted-value-with-semi-colon.html [ Failure ]
 crbug.com/591099 http/tests/cookies/http-get-cookie-set-in-js.html [ Failure ]
@@ -17007,8 +15657,6 @@
 crbug.com/591099 http/tests/loading/image-picture-no-download-after-source-removal.html [ Crash ]
 crbug.com/591099 http/tests/loading/nested_bad_objects.php [ Crash ]
 crbug.com/591099 http/tests/loading/preload-css-test.html [ Failure ]
-crbug.com/591099 http/tests/loading/preload-image-sizes-2x.html [ Crash Failure ]
-crbug.com/591099 http/tests/loading/preload-image-sizes.html [ Crash Failure ]
 crbug.com/591099 http/tests/loading/preload-image-srcset-2x.html [ Crash Pass ]
 crbug.com/591099 http/tests/loading/preload-image-srcset-duplicate.html [ Crash Pass ]
 crbug.com/591099 http/tests/loading/preload-image-srcset-reverse-order.html [ Crash Pass ]
@@ -17017,9 +15665,6 @@
 crbug.com/591099 http/tests/loading/preload-image-srcset.html [ Crash Pass ]
 crbug.com/591099 http/tests/loading/preload-img-test.html [ Crash Failure ]
 crbug.com/591099 http/tests/loading/preload-picture-invalid.html [ Crash Failure ]
-crbug.com/591099 http/tests/loading/preload-picture-nested.html [ Crash Failure ]
-crbug.com/591099 http/tests/loading/preload-picture-sizes-2x.html [ Crash Failure ]
-crbug.com/591099 http/tests/loading/preload-picture-sizes.html [ Crash Failure ]
 crbug.com/591099 http/tests/loading/preload-video-poster.html [ Failure Pass ]
 crbug.com/591099 http/tests/loading/redirect-methods.html [ Failure ]
 crbug.com/591099 http/tests/loading/simple-subframe.html [ Failure ]
@@ -17259,10 +15904,8 @@
 crbug.com/591099 http/tests/navigation/history-back-across-form-submission-to-fragment.html [ Failure ]
 crbug.com/591099 http/tests/navigation/image-load-in-subframe-unload-handler.html [ Crash ]
 crbug.com/591099 http/tests/navigation/image-load-in-unload-handler.html [ Crash Pass ]
-crbug.com/591099 http/tests/navigation/javascriptlink-basic.html [ Crash Timeout ]
-crbug.com/591099 http/tests/navigation/javascriptlink-frames.html [ Crash Timeout ]
-crbug.com/591099 http/tests/navigation/javascriptlink-goback.html [ Crash Timeout ]
-crbug.com/591099 http/tests/navigation/javascriptlink-subframeload.html [ Crash Timeout ]
+crbug.com/591099 http/tests/navigation/javascriptlink-basic.html [ Crash Failure Timeout ]
+crbug.com/591099 http/tests/navigation/javascriptlink-goback.html [ Crash Failure Timeout ]
 crbug.com/591099 http/tests/navigation/lockedhistory-iframe.html [ Failure ]
 crbug.com/591099 http/tests/navigation/metaredirect-basic.html [ Crash Failure ]
 crbug.com/591099 http/tests/navigation/metaredirect-frames.html [ Crash Pass ]
@@ -17273,10 +15916,6 @@
 crbug.com/591099 http/tests/navigation/navigation-with-detached-origin-document.html [ Crash Pass ]
 crbug.com/591099 http/tests/navigation/no-referrer-reset.html [ Failure Timeout ]
 crbug.com/591099 http/tests/navigation/onload-navigation-iframe-2.html [ Failure ]
-crbug.com/591099 http/tests/navigation/ping-cookie.html [ Crash Timeout ]
-crbug.com/591099 http/tests/navigation/ping-cross-origin-from-https.html [ Crash Timeout ]
-crbug.com/591099 http/tests/navigation/ping-cross-origin.html [ Crash Timeout ]
-crbug.com/591099 http/tests/navigation/ping-same-origin.html [ Crash Timeout ]
 crbug.com/591099 http/tests/navigation/post-301-response.html [ Crash Pass ]
 crbug.com/591099 http/tests/navigation/post-302-response.html [ Crash Pass ]
 crbug.com/591099 http/tests/navigation/post-303-response.html [ Crash Pass ]
@@ -17287,10 +15926,7 @@
 crbug.com/591099 http/tests/navigation/post-goback-same-url.html [ Crash Failure ]
 crbug.com/591099 http/tests/navigation/post-goback1.html [ Crash Failure ]
 crbug.com/591099 http/tests/navigation/post-goback2.html [ Crash Failure ]
-crbug.com/591099 http/tests/navigation/postredirect-basic.html [ Crash Pass ]
 crbug.com/591099 http/tests/navigation/postredirect-frames-goback1.html [ Crash Failure ]
-crbug.com/591099 http/tests/navigation/postredirect-frames.html [ Crash Pass ]
-crbug.com/591099 http/tests/navigation/postredirect-goback1.html [ Crash Pass ]
 crbug.com/591099 http/tests/navigation/postredirect-goback2.html [ Crash Failure ]
 crbug.com/591099 http/tests/navigation/redirect-load-no-form-restoration.html [ Crash Pass ]
 crbug.com/591099 http/tests/navigation/redirect302-basic.html [ Crash Failure ]
@@ -17326,7 +15962,6 @@
 crbug.com/591099 http/tests/notifications/notification-sandbox-permission.html [ Failure ]
 crbug.com/591099 http/tests/performance-timing/paint-timing/first-contentful-canvas.html [ Crash ]
 crbug.com/591099 http/tests/permissionclient/image-permissions.html [ Failure ]
-crbug.com/591099 http/tests/plugins/cross-frame-object-access.html [ Crash ]
 crbug.com/591099 http/tests/plugins/navigator-plugins-in-cross-origin-frame.html [ Failure Pass ]
 crbug.com/591099 http/tests/pointer-lock/iframe-sandboxed-allow-pointer-lock.html [ Failure ]
 crbug.com/591099 http/tests/pointer-lock/iframe-sandboxed-nested-allow-pointer-lock.html [ Failure ]
@@ -17335,7 +15970,6 @@
 crbug.com/591099 http/tests/pointer-lock/pointerlockelement-different-origin.html [ Failure ]
 crbug.com/591099 http/tests/pointer-lock/pointerlockelement-same-origin.html [ Failure ]
 crbug.com/591099 http/tests/pointer-lock/requestPointerLock-can-not-transfer-between-documents.html [ Failure ]
-crbug.com/591099 http/tests/preload/delaying_onload_link_preload_after_discovery.html [ Failure ]
 crbug.com/591099 http/tests/preload/dynamic_remove_preload_href.html [ Failure Pass ]
 crbug.com/591099 http/tests/preload/dynamic_removing_preload.html [ Failure Pass ]
 crbug.com/591099 http/tests/preload/multiple-meta-csp.html [ Crash ]
@@ -17854,10 +16488,7 @@
 crbug.com/591099 http/tests/uri/escaped-entity.html [ Failure ]
 crbug.com/591099 http/tests/uri/resolve-encoding-relative.html [ Failure ]
 crbug.com/591099 http/tests/uri/utf8-path.html [ Failure ]
-crbug.com/591099 http/tests/w3c/webperf/approved/navigation-timing/html/test_navigation_type_reload.html [ Crash ]
 crbug.com/591099 http/tests/w3c/webperf/approved/navigation-timing/html/test_performance_attributes_exist_in_object.html [ Crash ]
-crbug.com/591099 http/tests/w3c/webperf/submission/Google/resource-timing/html/test_resource_ignore_failures.html [ Crash ]
-crbug.com/591099 http/tests/w3c/webperf/submission/Google/resource-timing/html/test_resource_initiator_types.html [ Crash ]
 crbug.com/591099 http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_cross_origin_redirect.html [ Crash ]
 crbug.com/591099 http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_cross_origin_redirect_chain.html [ Crash ]
 crbug.com/591099 http/tests/w3c/webperf/submission/Intel/resource-timing/test_resource_timing_cross_origin_redirect_chain_allow_timing.html [ Crash ]
@@ -18197,7 +16828,6 @@
 crbug.com/591099 http/tests/xmlhttprequest/simple-cross-origin-denied-events-sync.html [ Failure ]
 crbug.com/591099 http/tests/xmlhttprequest/simple-cross-origin-denied-events.html [ Failure ]
 crbug.com/591099 http/tests/xmlhttprequest/simple-cross-origin-progress-events.html [ Failure ]
-crbug.com/591099 http/tests/xmlhttprequest/small-chunks-response-text.html [ Crash ]
 crbug.com/591099 http/tests/xmlhttprequest/state-after-network-error.html [ Failure ]
 crbug.com/591099 http/tests/xmlhttprequest/status-after-abort.html [ Failure ]
 crbug.com/591099 http/tests/xmlhttprequest/supported-xml-content-types-invalid-1.html [ Failure ]
@@ -18339,7 +16969,6 @@
 crbug.com/591099 ietestcenter/css3/flexbox/flexbox-direction-001.htm [ Failure ]
 crbug.com/591099 ietestcenter/css3/flexbox/flexbox-ordinal-group-001.htm [ Failure ]
 crbug.com/591099 ietestcenter/css3/multicolumn/column-containing-block-003.htm [ Failure ]
-crbug.com/591099 ietestcenter/css3/multicolumn/column-width-applies-to-010.htm [ Crash Failure ]
 crbug.com/591099 ietestcenter/css3/multicolumn/column-width-negative-001.htm [ Failure ]
 crbug.com/591099 ietestcenter/css3/multicolumn/column-width-percentage-001.htm [ Failure ]
 crbug.com/591099 ietestcenter/css3/text/textshadow-002.htm [ Failure ]
@@ -18465,8 +17094,8 @@
 crbug.com/591099 images/png-missing-plte-before-trns-crash.html [ Crash Pass ]
 crbug.com/591099 images/png-suite/test.html [ Crash Failure ]
 crbug.com/591099 images/png_per_row_alpha_decoding.html [ Failure ]
-crbug.com/591099 images/rendering-broken-0px-images-quirk.html [ Crash ]
-crbug.com/591099 images/rendering-broken-0px-images.html [ Crash ]
+crbug.com/591099 images/rendering-broken-0px-images-quirk.html [ Crash Failure ]
+crbug.com/591099 images/rendering-broken-0px-images.html [ Crash Failure ]
 crbug.com/591099 images/rendering-broken-10px-images.html [ Crash Failure ]
 crbug.com/591099 images/rendering-broken-16px-images.html [ Crash Failure ]
 crbug.com/591099 images/rendering-broken-1px-images.html [ Crash Failure ]
@@ -18496,11 +17125,10 @@
 crbug.com/591099 inspector-protocol/accessibility/accessibility-getRelationships.html [ Crash Failure ]
 crbug.com/591099 inspector-protocol/accessibility/accessibility-ignoredNodes.html [ Crash Failure Timeout ]
 crbug.com/591099 inspector-protocol/accessibility/accessibility-nameSources-buttons.html [ Crash ]
-crbug.com/591099 inspector-protocol/accessibility/accessibility-nameSources-img-figure.html [ Crash ]
-crbug.com/591099 inspector-protocol/accessibility/accessibility-nameSources-input-buttons.html [ Crash ]
+crbug.com/591099 inspector-protocol/accessibility/accessibility-nameSources-img-figure.html [ Crash Timeout ]
+crbug.com/591099 inspector-protocol/accessibility/accessibility-nameSources-input-buttons.html [ Crash Timeout ]
 crbug.com/591099 inspector-protocol/accessibility/accessibility-nameSources-input.html [ Crash Timeout ]
 crbug.com/591099 inspector-protocol/accessibility/accessibility-nameSources-labelledby.html [ Crash Timeout ]
-crbug.com/591099 inspector-protocol/accessibility/accessibility-nameSources-summary.html [ Crash ]
 crbug.com/591099 inspector-protocol/accessibility/accessibility-nameSources-visiblity.html [ Crash Timeout ]
 crbug.com/591099 inspector-protocol/cpu-profiler/enable-disable.html [ Failure ]
 crbug.com/591099 inspector-protocol/cpu-profiler/record-cpu-profile.html [ Failure ]
@@ -18523,7 +17151,6 @@
 crbug.com/591099 inspector-protocol/debugger/debugger-step-into-dedicated-worker.html [ Failure ]
 crbug.com/591099 inspector-protocol/debugger/suspend-setTimeout-on-pause-in-dedicated-worker.html [ Failure ]
 crbug.com/591099 inspector-protocol/dom-snapshot/dom-snapshot-getSnapshot.html [ Crash Failure Timeout ]
-crbug.com/591099 inspector-protocol/dom/dom-collect-class-names.html [ Crash ]
 crbug.com/591099 inspector-protocol/dom/dom-getBoxModel.html [ Failure ]
 crbug.com/591099 inspector-protocol/dom/dom-ns-attr-modified.html [ Failure ]
 crbug.com/591099 inspector-protocol/emulation/device-emulation-320-2x.html [ Failure ]
@@ -18555,7 +17182,6 @@
 crbug.com/591099 inspector-protocol/input/dispatchKeyEvent-focus.html [ Failure ]
 crbug.com/591099 inspector-protocol/layers/paint-profiler.html [ Failure ]
 crbug.com/591099 inspector-protocol/layout-fonts/languages-emoji-rare-glyphs.html [ Failure ]
-crbug.com/591099 inspector-protocol/layout-fonts/tifinagh.html [ Crash ]
 crbug.com/591099 inspector-protocol/network/resource-type.html [ Crash Failure ]
 crbug.com/591099 inspector-protocol/network/websocket-initiator.html [ Failure ]
 crbug.com/591099 inspector-protocol/page/get-layout-metrics.html [ Failure ]
@@ -18742,8 +17368,8 @@
 crbug.com/591099 inspector/editor/text-editor-char-to-coordinates.html [ Crash Failure ]
 crbug.com/591099 inspector/editor/text-editor-ctrl-d-1.html [ Crash Failure Timeout ]
 crbug.com/591099 inspector/editor/text-editor-ctrl-d-2.html [ Crash Failure Timeout ]
-crbug.com/591099 inspector/editor/text-editor-enter-behaviour.html [ Crash Timeout ]
-crbug.com/591099 inspector/editor/text-editor-formatter.html [ Crash Timeout ]
+crbug.com/591099 inspector/editor/text-editor-enter-behaviour.html [ Crash Failure Timeout ]
+crbug.com/591099 inspector/editor/text-editor-formatter.html [ Crash Failure Timeout ]
 crbug.com/591099 inspector/editor/text-editor-goto-matching-bracket.html [ Crash Failure ]
 crbug.com/591099 inspector/editor/text-editor-home-button.html [ Crash Failure ]
 crbug.com/591099 inspector/editor/text-editor-indent-autodetection.html [ Crash Failure Timeout ]
@@ -19122,7 +17748,7 @@
 crbug.com/591099 inspector/sources/debugger-async/async-callstack-reload-no-crash.html [ Failure ]
 crbug.com/591099 inspector/sources/debugger-async/async-callstack-scripted-scroll.html [ Failure Timeout ]
 crbug.com/591099 inspector/sources/debugger-async/async-callstack-set-interval.html [ Failure ]
-crbug.com/591099 inspector/sources/debugger-async/async-callstack-web-sql.html [ Failure ]
+crbug.com/591099 inspector/sources/debugger-async/async-callstack-web-sql.html [ Crash Failure ]
 crbug.com/591099 inspector/sources/debugger-async/async-callstack-xhrs.html [ Failure ]
 crbug.com/591099 inspector/sources/debugger-async/async-callstack.html [ Failure ]
 crbug.com/591099 inspector/sources/debugger-breakpoints/breakpoint-manager-listeners-count.html [ Failure ]
@@ -19991,12 +18617,9 @@
 crbug.com/591099 paint/invalidation/button-checkbox-click-method-repaint.html [ Failure ]
 crbug.com/591099 paint/invalidation/button-inner-no-repaint.html [ Failure Pass ]
 crbug.com/591099 paint/invalidation/canvas-composite-repaint-by-all-imagesource.html [ Failure Pass ]
-crbug.com/591099 paint/invalidation/caret-change-paint-offset-keep-visual.html [ Failure ]
 crbug.com/591099 paint/invalidation/caret-color.html [ Crash Pass ]
 crbug.com/591099 paint/invalidation/caret-contenteditable-content-after.html [ Failure ]
-crbug.com/591099 paint/invalidation/caret-invalidation-in-overflow-scroll.html [ Crash Failure ]
 crbug.com/591099 paint/invalidation/caret-outside-block.html [ Failure ]
-crbug.com/591099 paint/invalidation/caret-subpixel.html [ Failure ]
 crbug.com/591099 paint/invalidation/caret-with-composited-scroll.html [ Failure ]
 crbug.com/591099 paint/invalidation/caret-with-transformation.html [ Failure ]
 crbug.com/591099 paint/invalidation/change-transform.html [ Failure Pass ]
@@ -20206,8 +18829,6 @@
 crbug.com/591099 paint/invalidation/invalidate-after-composited-scroll.html [ Failure ]
 crbug.com/591099 paint/invalidation/invalidate-box-shadow-currentColor.html [ Failure ]
 crbug.com/591099 paint/invalidation/invalidate-caret-before-text-node-update.html [ Failure ]
-crbug.com/591099 paint/invalidation/invalidate-caret-in-composited-scrolling-container.html [ Crash Failure ]
-crbug.com/591099 paint/invalidation/invalidate-caret-in-non-composited-scrolling-container.html [ Crash Failure ]
 crbug.com/591099 paint/invalidation/invalidate-descendants-when-receiving-paint-layer.html [ Failure ]
 crbug.com/591099 paint/invalidation/invalidate-invisible-element.html [ Failure Pass ]
 crbug.com/591099 paint/invalidation/invalidate-paint-for-fixed-pos-inside-iframe.html [ Failure ]
@@ -20255,15 +18876,12 @@
 crbug.com/591099 paint/invalidation/line-overflow.html [ Failure ]
 crbug.com/591099 paint/invalidation/lines-with-layout-delta.html [ Failure ]
 crbug.com/591099 paint/invalidation/list-marker-2.html [ Crash Failure ]
-crbug.com/591099 paint/invalidation/list-marker-move.html [ Crash ]
 crbug.com/591099 paint/invalidation/list-marker.html [ Failure ]
-crbug.com/591099 paint/invalidation/local-attachment-background-li-crash.html [ Crash ]
 crbug.com/591099 paint/invalidation/make-children-non-inline.html [ Failure ]
 crbug.com/591099 paint/invalidation/margin.html [ Failure Pass ]
 crbug.com/591099 paint/invalidation/media-audio-no-spurious-repaints.html [ Crash ]
 crbug.com/591099 paint/invalidation/mix-blend-mode-separate-stacking-context.html [ Failure ]
 crbug.com/591099 paint/invalidation/move-caret-in-container-change-paint-offset-keep-visual.html [ Failure Pass ]
-crbug.com/591099 paint/invalidation/multi-layout-one-frame.html [ Crash Failure ]
 crbug.com/591099 paint/invalidation/multi-subsequence-composited.html [ Failure ]
 crbug.com/591099 paint/invalidation/multi-subsequence-scrolled.html [ Failure ]
 crbug.com/591099 paint/invalidation/multicol-as-paint-container.html [ Failure Pass ]
@@ -20512,7 +19130,6 @@
 crbug.com/591099 paint/invalidation/text-shadow-horizontal.html [ Failure ]
 crbug.com/591099 paint/invalidation/text-shadow.html [ Failure ]
 crbug.com/591099 paint/invalidation/textarea-caret.html [ Crash Failure ]
-crbug.com/591099 paint/invalidation/textarea-set-disabled.html [ Failure ]
 crbug.com/591099 paint/invalidation/trailing-floats-root-line-box-overflow.html [ Failure ]
 crbug.com/591099 paint/invalidation/transform-absolute-child.html [ Failure ]
 crbug.com/591099 paint/invalidation/transform-absolute-in-positioned-container.html [ Failure ]
@@ -20545,7 +19162,6 @@
 crbug.com/591099 paint/invalidation/window-resize-positioned-percent-top.html [ Failure Pass ]
 crbug.com/591099 paint/invalidation/window-resize-vertical-writing-mode.html [ Failure ]
 crbug.com/591099 paint/invalidation/window-resize-viewport-percent.html [ Failure Pass ]
-crbug.com/591099 paint/lists/invalidate-list-marker-color.html [ Crash ]
 crbug.com/591099 paint/masks/fieldset-mask.html [ Failure ]
 crbug.com/591099 paint/overflow/interest-rect-change-scroll-down.html [ Failure Pass ]
 crbug.com/591099 paint/overflow/non-composited-fixed-position-descendant.html [ Failure ]
@@ -20727,7 +19343,6 @@
 crbug.com/591099 printing/standards-percentage-heights.html [ Failure Pass ]
 crbug.com/591099 printing/stretch-to-view-height.html [ Failure ]
 crbug.com/591099 printing/subframes-percentage-height.html [ Failure Pass ]
-crbug.com/591099 printing/text-color-adjust.html [ Crash ]
 crbug.com/591099 printing/thead-repeats-at-top-of-each-page-multiple-tables.html [ Failure ]
 crbug.com/591099 printing/thead-repeats-at-top-of-each-page.html [ Failure ]
 crbug.com/591099 printing/viewport-size-dependant-iframe-with-multicol-crash.html [ Failure ]
@@ -20740,8 +19355,6 @@
 crbug.com/591099 scrollbars/basic-scrollbar.html [ Failure ]
 crbug.com/591099 scrollbars/border-box-rect-clips-scrollbars.html [ Failure ]
 crbug.com/591099 scrollbars/custom-scrollbar-appearance-property.html [ Failure Pass ]
-crbug.com/591099 scrollbars/custom-scrollbar-changing-style-relayout-body-scrollablearea.html [ Crash ]
-crbug.com/591099 scrollbars/custom-scrollbar-changing-style-relayout-div-body-scrollablearea.html [ Crash ]
 crbug.com/591099 scrollbars/custom-scrollbar-display.html [ Failure Pass ]
 crbug.com/591099 scrollbars/custom-scrollbar-enable-changes-thickness-with-iframe.html [ Failure Pass ]
 crbug.com/591099 scrollbars/custom-scrollbar-not-inherited-by-iframe.html [ Crash ]
@@ -20753,7 +19366,6 @@
 crbug.com/591099 scrollbars/hidden-scrollbar-prevents-layout.html [ Failure ]
 crbug.com/591099 scrollbars/hidden-scrollbars-invisible.html [ Failure Pass ]
 crbug.com/591099 scrollbars/iframe-scrollbar-becomes-custom.html [ Crash ]
-crbug.com/591099 scrollbars/layout-viewport-scrollbars-hidden.html [ Crash ]
 crbug.com/591099 scrollbars/listbox-scrollbar-combinations.html [ Failure ]
 crbug.com/591099 scrollbars/overlay-scrollbars-within-overflow-scroll.html [ Failure Pass ]
 crbug.com/591099 scrollbars/resize-scales-with-dpi-150.html [ Failure ]
@@ -20766,7 +19378,6 @@
 crbug.com/591099 scrollbars/scrollbar-click-does-not-blur-content.html [ Crash ]
 crbug.com/591099 scrollbars/scrollbar-content-crash.html [ Failure ]
 crbug.com/591099 scrollbars/scrollbar-crash-on-refresh.html [ Failure ]
-crbug.com/591099 scrollbars/scrollbar-large-overflow-rectangle.html [ Crash ]
 crbug.com/591099 scrollbars/scrollbar-miss-mousemove-disabled.html [ Failure ]
 crbug.com/591099 scrollbars/scrollbar-miss-mousemove.html [ Failure ]
 crbug.com/591099 scrollbars/scrollbar-orientation.html [ Failure ]
@@ -20810,7 +19421,6 @@
 crbug.com/591099 shadow-dom/nodetree-labels-node-list.html [ Crash ]
 crbug.com/591099 shadow-dom/nodetree-radio-node-list.html [ Crash ]
 crbug.com/591099 shadow-dom/pointer-lock-in-shadow.html [ Crash ]
-crbug.com/591099 shadow-dom/range-caret-range-from-point-left-of-shadow.html [ Crash ]
 crbug.com/591099 shadow-dom/slotted-pseudo-element-in-v0-tree-crash.html [ Failure ]
 crbug.com/591099 shadow-dom/v0/event-composed-path.html [ Crash ]
 crbug.com/591099 shadow-dom/v0/get-destination-insertion-points-re-distribution.html [ Failure ]
@@ -21075,80 +19685,6 @@
 crbug.com/591099 storage/websql/null-characters.html [ Failure ]
 crbug.com/591099 storage/websql/sql-error-codes.html [ Failure Pass ]
 crbug.com/591099 storage/websql/transaction-removed-context-crash.html [ Crash ]
-crbug.com/591099 svg/W3C-SVG-1.1-SE/coords-dom-04-f.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1-SE/coords-units-03-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1-SE/filters-image-03-f.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1-SE/filters-image-05-f.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1-SE/painting-marker-07-f.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1-SE/pservers-pattern-03-f.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1-SE/struct-use-14-f.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1-SE/styling-css-04-f.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1-SE/types-dom-01-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1-SE/types-dom-02-f.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1-SE/types-dom-03-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/animate-elem-06-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/animate-elem-12-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/animate-elem-15-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/animate-elem-17-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/animate-elem-18-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/animate-elem-19-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/animate-elem-24-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/animate-elem-25-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/animate-elem-26-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/animate-elem-28-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/animate-elem-31-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/animate-elem-39-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/animate-elem-41-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/animate-elem-52-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/animate-elem-61-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/animate-elem-62-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/animate-elem-85-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/color-prof-01-f.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/color-prop-01-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/coords-coord-01-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/coords-coord-02-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/coords-trans-02-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/coords-trans-03-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/coords-viewattr-02-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/coords-viewattr-03-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/extend-namespace-01-f.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/filters-color-01-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/filters-gauss-01-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/filters-offset-01-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/fonts-elem-04-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/linking-a-04-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/linking-a-05-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/masking-intro-01-f.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/masking-path-01-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/metadata-example-01-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/painting-stroke-02-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/painting-stroke-03-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/paths-data-05-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/paths-data-12-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/paths-data-14-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/pservers-grad-19-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/pservers-pattern-01-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/render-elems-02-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/render-elems-08-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/script-handle-01-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/script-handle-02-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/script-handle-04-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/struct-frag-05-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/struct-group-03-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/struct-image-04-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/struct-image-05-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/styling-css-05-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/text-align-01-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/text-align-02-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/text-align-05-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/text-deco-01-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/text-fonts-01-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/text-spacing-01-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/text-text-01-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/text-text-06-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/text-tselect-01-b.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/text-ws-01-t.svg [ Failure ]
-crbug.com/591099 svg/W3C-SVG-1.1/text-ws-02-t.svg [ Failure ]
 crbug.com/591099 svg/animations/accumulate-use-count.html [ Crash ]
 crbug.com/591099 svg/animations/accumulate-values-width-animation.html [ Failure ]
 crbug.com/591099 svg/animations/add-after-load-use-counter.html [ Crash ]
@@ -21394,8 +19930,6 @@
 crbug.com/591099 svg/as-image/svg-non-integer-scaled-image.html [ Failure ]
 crbug.com/591099 svg/as-image/svg-object-intrinsic-size.html [ Failure ]
 crbug.com/591099 svg/as-image/svgview-references-use-counters.html [ Failure ]
-crbug.com/591099 svg/as-list-image/svg-list-image-intrinsic-size-1.html [ Crash ]
-crbug.com/591099 svg/as-list-image/svg-list-image-intrinsic-size-zoom.html [ Crash ]
 crbug.com/591099 svg/as-object/embedded-svg-immediate-offsetWidth-query.html [ Failure ]
 crbug.com/591099 svg/as-object/object-box-sizing-no-width-height.html [ Failure Pass ]
 crbug.com/591099 svg/as-object/svg-embedded-in-html-in-iframe.html [ Failure Pass Timeout ]
@@ -21409,7 +19943,6 @@
 crbug.com/591099 svg/canvas/image-svg-intrinsic-size.html [ Crash ]
 crbug.com/591099 svg/carto.net/frameless-svg-parse-error.html [ Failure ]
 crbug.com/591099 svg/clip-path/clip-path-foreign-object-crash.html [ Crash ]
-crbug.com/591099 svg/clip-path/clip-path-objectBoundingBox.svg [ Crash ]
 crbug.com/591099 svg/css/background-image-svg.html [ Crash Failure Pass ]
 crbug.com/591099 svg/css/baseline-shift-inherit.html [ Crash ]
 crbug.com/591099 svg/css/buffered-rendering.html [ Failure ]
@@ -21423,7 +19956,6 @@
 crbug.com/591099 svg/css/opacity-not-supporting-percentage.html [ Failure ]
 crbug.com/591099 svg/css/parse-length.html [ Failure ]
 crbug.com/591099 svg/css/path-element.html [ Crash ]
-crbug.com/591099 svg/css/path-gradient-stroke-shadow.svg [ Crash ]
 crbug.com/591099 svg/css/path-layout-crash.html [ Failure ]
 crbug.com/591099 svg/css/rect-system-color.xhtml [ Failure ]
 crbug.com/591099 svg/css/scientific-numbers.html [ Failure ]
@@ -21458,7 +19990,6 @@
 crbug.com/591099 svg/custom/elementTimeControl-nan-crash.html [ Failure ]
 crbug.com/591099 svg/custom/embedded-svg-allowed-in-dashboard.xml [ Failure ]
 crbug.com/591099 svg/custom/embedding-external-svgs.xhtml [ Failure Pass ]
-crbug.com/591099 svg/custom/empty-merge.svg [ Crash ]
 crbug.com/591099 svg/custom/events-in-shadow-tree.html [ Crash ]
 crbug.com/591099 svg/custom/external-paintserver-reference.svg [ Failure Pass ]
 crbug.com/591099 svg/custom/filter-css-transform-resolution.html [ Failure Pass ]
@@ -21483,7 +20014,6 @@
 crbug.com/591099 svg/custom/getsvgdocument-null.html [ Failure ]
 crbug.com/591099 svg/custom/getsvgdocument.html [ Failure ]
 crbug.com/591099 svg/custom/global-constructors.html [ Failure ]
-crbug.com/591099 svg/custom/gradient-rgba-stop-color.svg [ Crash ]
 crbug.com/591099 svg/custom/hit-test-path-stroke.svg [ Failure ]
 crbug.com/591099 svg/custom/hit-test-path.svg [ Failure ]
 crbug.com/591099 svg/custom/image-parent-translation.xhtml [ Failure ]
@@ -21493,7 +20023,6 @@
 crbug.com/591099 svg/custom/image-with-attr-change-after-delete-crash.html [ Crash Pass ]
 crbug.com/591099 svg/custom/inline-svg-in-xhtml.xml [ Failure ]
 crbug.com/591099 svg/custom/inline-svg-use-available-width-in-stf.html [ Failure ]
-crbug.com/591099 svg/custom/inline-svg-use-available-width.html [ Failure ]
 crbug.com/591099 svg/custom/invalid-filter-reference-and-opacity-crash.html [ Failure ]
 crbug.com/591099 svg/custom/invalid-length-units.html [ Failure ]
 crbug.com/591099 svg/custom/invisible-text-after-scrolling.xhtml [ Failure ]
@@ -21508,7 +20037,6 @@
 crbug.com/591099 svg/custom/manually-parsed-svg-allowed-in-dashboard.html [ Failure ]
 crbug.com/591099 svg/custom/marker-orient-auto.html [ Failure ]
 crbug.com/591099 svg/custom/missing-xlink.svg [ Failure ]
-crbug.com/591099 svg/custom/mouse-move-on-svg-container-standalone.svg [ Failure ]
 crbug.com/591099 svg/custom/mouse-move-on-svg-container.xhtml [ Timeout ]
 crbug.com/591099 svg/custom/mouse-move-on-svg-root.xhtml [ Timeout ]
 crbug.com/591099 svg/custom/no-fixed-in-svg-assert.html [ Failure ]
@@ -21533,7 +20061,6 @@
 crbug.com/591099 svg/custom/pointer-events-on-svg-with-pointer.xhtml [ Failure ]
 crbug.com/591099 svg/custom/pointer-events-on-svg-without-pointer.xhtml [ Failure ]
 crbug.com/591099 svg/custom/poly-parsing-error.html [ Failure ]
-crbug.com/591099 svg/custom/radialGradient-focal-radius.svg [ Crash ]
 crbug.com/591099 svg/custom/removed-from-animation-crash.html [ Crash ]
 crbug.com/591099 svg/custom/rootmost-svg-xy-attrs.xhtml [ Failure ]
 crbug.com/591099 svg/custom/scroll-to-svg-element-assertion.html [ Failure ]
@@ -21560,14 +20087,11 @@
 crbug.com/591099 svg/custom/text-match-highlight.html [ Failure ]
 crbug.com/591099 svg/custom/text-use-click-crash.xhtml [ Crash ]
 crbug.com/591099 svg/custom/text-zoom.xhtml [ Failure Pass ]
-crbug.com/591099 svg/custom/textPath-path-change2.svg [ Failure ]
 crbug.com/591099 svg/custom/title-assertion.html [ Failure ]
 crbug.com/591099 svg/custom/touch-events.html [ Failure ]
 crbug.com/591099 svg/custom/tref-clone-crash.html [ Crash Pass ]
 crbug.com/591099 svg/custom/tref-with-progress-tag-setpseudo-assert.html [ Failure ]
-crbug.com/591099 svg/custom/use-clipped-transform.svg [ Crash ]
 crbug.com/591099 svg/custom/use-crash-in-non-wellformed-document.svg [ Failure ]
-crbug.com/591099 svg/custom/use-css-events.svg [ Failure ]
 crbug.com/591099 svg/custom/use-event-retargeting.html [ Failure ]
 crbug.com/591099 svg/custom/use-font-face-crash.svg [ Failure ]
 crbug.com/591099 svg/custom/use-href-attr-removal-crash.html [ Failure ]
@@ -21582,10 +20106,7 @@
 crbug.com/591099 svg/custom/use-on-disallowed-foreign-object-5.svg [ Failure Pass ]
 crbug.com/591099 svg/custom/use-on-disallowed-foreign-object-6.svg [ Failure Pass ]
 crbug.com/591099 svg/custom/use-on-non-svg-namespaced-element.svg [ Failure Pass ]
-crbug.com/591099 svg/custom/use-on-symbol.svg [ Crash ]
-crbug.com/591099 svg/custom/use-recalcStyle-crash.svg [ Crash ]
 crbug.com/591099 svg/custom/use-referencing-style-crash.svg [ Failure ]
-crbug.com/591099 svg/custom/use-transfer-width-height-properties-to-svg2.svg [ Crash ]
 crbug.com/591099 svg/custom/viewport-em.svg [ Failure Pass ]
 crbug.com/591099 svg/custom/xhtml-no-svg-renderer.xhtml [ Failure Pass ]
 crbug.com/591099 svg/custom/zoomed-alignment-baseline.html [ Crash ]
@@ -21997,15 +20518,10 @@
 crbug.com/591099 svg/dynamic-updates/SVGUseElement-svgdom-href2-prop.html [ Failure ]
 crbug.com/591099 svg/filters/feBlend-all-modes.html [ Failure Pass ]
 crbug.com/591099 svg/filters/feComponentTransfer-style-crash.xhtml [ Crash ]
-crbug.com/591099 svg/filters/feConvolveFilter-y-bounds.svg [ Crash ]
-crbug.com/591099 svg/filters/feConvolveMatrix-negative-orderX.svg [ Crash ]
 crbug.com/591099 svg/filters/feDisplacementMap-crash-test.xhtml [ Crash ]
-crbug.com/591099 svg/filters/feDropShadow-flood-opacity-2.svg [ Crash ]
-crbug.com/591099 svg/filters/feDropShadow-zero-deviation.svg [ Crash ]
 crbug.com/591099 svg/filters/feLight-non-lighting-parent-crash.html [ Failure ]
 crbug.com/591099 svg/filters/feTurbulence-bad-seeds.html [ Failure ]
 crbug.com/591099 svg/filters/filter-detach-crash.html [ Crash ]
-crbug.com/591099 svg/filters/filter-source-outside-viewport.html [ Crash ]
 crbug.com/591099 svg/filters/reparent-animated-filter-target.html [ Failure ]
 crbug.com/591099 svg/foreignObject/background-render-phase.html [ Failure ]
 crbug.com/591099 svg/foreignObject/body-background.svg [ Failure Pass ]
@@ -22046,7 +20562,6 @@
 crbug.com/591099 svg/hittest/zero-length-round-cap-path.xhtml [ Crash ]
 crbug.com/591099 svg/hittest/zero-length-square-cap-path.xhtml [ Crash ]
 crbug.com/591099 svg/hixie/data-types/002.xhtml [ Failure Pass ]
-crbug.com/591099 svg/hixie/error/006.xml [ Crash ]
 crbug.com/591099 svg/hixie/error/012.xml [ Failure ]
 crbug.com/591099 svg/hixie/error/013.xml [ Failure ]
 crbug.com/591099 svg/hixie/intrinsic/003.html [ Failure Pass ]
@@ -22059,7 +20574,6 @@
 crbug.com/591099 svg/hixie/mixed/009.xml [ Failure Pass ]
 crbug.com/591099 svg/hixie/mixed/010.xml [ Failure Pass ]
 crbug.com/591099 svg/hixie/mixed/011.xml [ Failure ]
-crbug.com/591099 svg/hixie/perf/001.xml [ Crash ]
 crbug.com/591099 svg/hixie/processing-model/003.xml [ Failure Pass ]
 crbug.com/591099 svg/hixie/processing-model/004.xml [ Failure Pass ]
 crbug.com/591099 svg/hixie/rendering-model/003.xhtml [ Failure Pass ]
@@ -22107,8 +20621,6 @@
 crbug.com/591099 svg/text/scaling-font-with-geometric-precision.html [ Failure ]
 crbug.com/591099 svg/text/select-svg-text-with-collapsed-whitespace.html [ Crash ]
 crbug.com/591099 svg/text/select-text-inside-non-static-position.html [ Failure ]
-crbug.com/591099 svg/text/select-textLength-spacing-squeeze-1.svg [ Failure ]
-crbug.com/591099 svg/text/select-textLength-spacing-stretch-2.svg [ Failure ]
 crbug.com/591099 svg/text/selection-background-color.xhtml [ Failure Pass ]
 crbug.com/591099 svg/text/selection-dragging-outside-1.html [ Crash ]
 crbug.com/591099 svg/text/selection-dragging-outside-2.html [ Crash ]
@@ -22121,10 +20633,7 @@
 crbug.com/591099 svg/text/text-bbox-empty.html [ Crash ]
 crbug.com/591099 svg/text/text-bbox-of-empty-after-change.html [ Crash ]
 crbug.com/591099 svg/text/text-getSubStringLength.html [ Crash ]
-crbug.com/591099 svg/text/text-outline-rgba.html [ Crash ]
 crbug.com/591099 svg/text/text-repaint-rects.xhtml [ Failure ]
-crbug.com/591099 svg/text/text-selection-align-04-b.svg [ Failure ]
-crbug.com/591099 svg/text/text-selection-align-06-b.svg [ Failure ]
 crbug.com/591099 svg/text/text-style-recalc-crash.html [ Failure Pass ]
 crbug.com/591099 svg/text/textpath-reference-crash.html [ Crash ]
 crbug.com/591099 svg/text/textquery-collapsed-whitespace.html [ Crash ]
@@ -22135,7 +20644,6 @@
 crbug.com/591099 svg/transforms/svg-css-transforms-clip-path.xhtml [ Failure ]
 crbug.com/591099 svg/transforms/svg-css-transforms.xhtml [ Failure ]
 crbug.com/591099 svg/transforms/text-with-pattern-inside-transformed-html.xhtml [ Failure ]
-crbug.com/591099 svg/transforms/transform-box-view-box.html [ Crash ]
 crbug.com/591099 svg/transforms/transform-boxsize-usecounter-1.html [ Crash ]
 crbug.com/591099 svg/transforms/transform-boxsize-usecounter-2.html [ Crash ]
 crbug.com/591099 svg/transforms/transform-boxsize-usecounter-3.html [ Crash ]
@@ -22194,7 +20702,6 @@
 crbug.com/591099 tables/mozilla/bugs/bug120364.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug126742.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug1271.html [ Failure ]
-crbug.com/591099 tables/mozilla/bugs/bug127267.html [ Crash ]
 crbug.com/591099 tables/mozilla/bugs/bug12908-1.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug1302.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug131020-2.html [ Failure ]
@@ -22208,7 +20715,6 @@
 crbug.com/591099 tables/mozilla/bugs/bug137388-3.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug138725.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug14159-1.html [ Failure ]
-crbug.com/591099 tables/mozilla/bugs/bug1474.html [ Crash ]
 crbug.com/591099 tables/mozilla/bugs/bug149275-1.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug149275-2.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug15247.html [ Failure Pass ]
@@ -22238,7 +20744,7 @@
 crbug.com/591099 tables/mozilla/bugs/bug221784-2.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug23151.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug23235.html [ Crash Failure ]
-crbug.com/591099 tables/mozilla/bugs/bug23299.html [ Failure ]
+crbug.com/591099 tables/mozilla/bugs/bug23299.html [ Failure Pass ]
 crbug.com/591099 tables/mozilla/bugs/bug24200.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug2469.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug2479-1.html [ Crash Failure Pass ]
@@ -22250,7 +20756,6 @@
 crbug.com/591099 tables/mozilla/bugs/bug27038-3.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug2773.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug278385.html [ Failure ]
-crbug.com/591099 tables/mozilla/bugs/bug27993-1.html [ Crash ]
 crbug.com/591099 tables/mozilla/bugs/bug2886-2.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug2886.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug28928.html [ Failure ]
@@ -22275,20 +20780,15 @@
 crbug.com/591099 tables/mozilla/bugs/bug3977.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug4093.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug42187.html [ Failure ]
-crbug.com/591099 tables/mozilla/bugs/bug42443.html [ Crash ]
 crbug.com/591099 tables/mozilla/bugs/bug4284.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug43039.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug43204.html [ Failure ]
-crbug.com/591099 tables/mozilla/bugs/bug4382.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug43854-1.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug43854-2.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug44505.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug44523.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug4527.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug4576.html [ Failure ]
-crbug.com/591099 tables/mozilla/bugs/bug46268-5.html [ Crash ]
-crbug.com/591099 tables/mozilla/bugs/bug46368-1.html [ Crash Failure ]
-crbug.com/591099 tables/mozilla/bugs/bug46368-2.html [ Crash Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug46480-1.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug46480-2.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug46924.html [ Failure ]
@@ -22296,7 +20796,6 @@
 crbug.com/591099 tables/mozilla/bugs/bug48827.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug50695-1.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug50695-2.html [ Failure ]
-crbug.com/591099 tables/mozilla/bugs/bug51037.html [ Crash Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug51140.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug53690-2.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug5538.html [ Failure ]
@@ -22312,7 +20811,6 @@
 crbug.com/591099 tables/mozilla/bugs/bug60992.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug625.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug6304.html [ Failure ]
-crbug.com/591099 tables/mozilla/bugs/bug641-1.html [ Crash ]
 crbug.com/591099 tables/mozilla/bugs/bug641-2.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug647.html [ Failure ]
 crbug.com/591099 tables/mozilla/bugs/bug6674.html [ Failure ]
@@ -22356,7 +20854,6 @@
 crbug.com/591099 tables/mozilla/core/nested1.html [ Failure ]
 crbug.com/591099 tables/mozilla/core/one_row.html [ Failure ]
 crbug.com/591099 tables/mozilla/core/table_heights.html [ Failure ]
-crbug.com/591099 tables/mozilla/dom/tableDom.html [ Crash Failure ]
 crbug.com/591099 tables/mozilla/marvin/col_span.html [ Failure ]
 crbug.com/591099 tables/mozilla/marvin/colgroup_align_center.html [ Failure ]
 crbug.com/591099 tables/mozilla/marvin/colgroup_align_justify.html [ Failure ]
@@ -22371,7 +20868,6 @@
 crbug.com/591099 tables/mozilla/marvin/colgroup_width_px.html [ Failure ]
 crbug.com/591099 tables/mozilla/marvin/table_overflow_hidden_td.html [ Failure Pass ]
 crbug.com/591099 tables/mozilla/marvin/tables_align_center.html [ Failure ]
-crbug.com/591099 tables/mozilla/marvin/tables_align_right.html [ Crash ]
 crbug.com/591099 tables/mozilla/marvin/tables_bgcolor_aqua.html [ Failure ]
 crbug.com/591099 tables/mozilla/marvin/tables_bgcolor_aqua_rgb.html [ Failure ]
 crbug.com/591099 tables/mozilla/marvin/tables_bgcolor_black.html [ Failure ]
@@ -22456,11 +20952,9 @@
 crbug.com/591099 tables/mozilla/marvin/tr_bgcolor_white_rgb.html [ Failure ]
 crbug.com/591099 tables/mozilla/marvin/tr_bgcolor_yellow.html [ Failure ]
 crbug.com/591099 tables/mozilla/marvin/tr_bgcolor_yellow_rgb.html [ Failure ]
-crbug.com/591099 tables/mozilla/marvin/x_table.xml [ Crash Failure ]
 crbug.com/591099 tables/mozilla/marvin/x_table_align_center.xml [ Failure ]
 crbug.com/591099 tables/mozilla/marvin/x_td_nowrap.xml [ Failure ]
 crbug.com/591099 tables/mozilla/marvin/x_th_nowrap.xml [ Crash Failure ]
-crbug.com/591099 tables/mozilla/other/move_row.html [ Crash Failure ]
 crbug.com/591099 tables/mozilla/other/test3.html [ Failure ]
 crbug.com/591099 tables/mozilla/other/test6.html [ Failure ]
 crbug.com/591099 tables/mozilla/other/wa_table_thtd_rowspan.html [ Crash Failure ]
@@ -22505,7 +20999,6 @@
 crbug.com/591099 tables/mozilla_expected_failures/collapsing_borders/bug41262-6.html [ Failure ]
 crbug.com/591099 tables/mozilla_expected_failures/core/captions1.html [ Failure ]
 crbug.com/591099 tables/mozilla_expected_failures/core/captions2.html [ Failure ]
-crbug.com/591099 tables/mozilla_expected_failures/marvin/backgr_fixed-bg.html [ Crash Failure ]
 crbug.com/591099 tables/mozilla_expected_failures/marvin/table_overflow_caption.html [ Failure ]
 crbug.com/591099 tables/mozilla_expected_failures/marvin/table_overflow_caption_bottom.html [ Failure ]
 crbug.com/591099 tables/mozilla_expected_failures/marvin/table_overflow_caption_hidden.html [ Failure ]
@@ -22678,7 +21171,6 @@
 crbug.com/591099 traversal/node-iterator-009.html [ Failure ]
 crbug.com/591099 traversal/node-iterator-prototype.html [ Failure ]
 crbug.com/591099 traversal/size-zero-run.html [ Failure ]
-crbug.com/591099 traversal/stay-within-root.html [ Crash ]
 crbug.com/591099 traversal/tree-walker-003.html [ Failure ]
 crbug.com/591099 traversal/tree-walker-004.html [ Failure ]
 crbug.com/591099 traversal/tree-walker-006.html [ Failure ]
@@ -22749,7 +21241,6 @@
 crbug.com/591099 virtual/disable-spinvalidation/compositing/contents-opaque/layer-opacity.html [ Failure Pass ]
 crbug.com/591099 virtual/disable-spinvalidation/compositing/contents-opaque/layer-transform.html [ Failure Pass ]
 crbug.com/591099 virtual/disable-spinvalidation/compositing/contents-opaque/overflow-hidden-child-layers.html [ Failure ]
-crbug.com/591099 virtual/disable-spinvalidation/compositing/contents-opaque/visibility-hidden.html [ Crash ]
 crbug.com/591099 virtual/disable-spinvalidation/compositing/culling/clear-fixed-iframe.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/compositing/culling/scrolled-within-boxshadow.html [ Failure Pass ]
 crbug.com/591099 virtual/disable-spinvalidation/compositing/culling/translated-boxshadow.html [ Failure Pass ]
@@ -22958,7 +21449,6 @@
 crbug.com/591099 virtual/disable-spinvalidation/compositing/overflow/content-loses-scrollbars.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/compositing/overflow/descendant-with-clip-path.html [ Failure Pass ]
 crbug.com/591099 virtual/disable-spinvalidation/compositing/overflow/do-not-crash-use-after-free-update-widget-positions.html [ Failure Pass ]
-crbug.com/591099 virtual/disable-spinvalidation/compositing/overflow/do-not-paint-outline-into-composited-scrolling-contents.html [ Crash Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/compositing/overflow/fixed-position-ancestor-clip.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/compositing/overflow/fractional-sized-scrolling-layer.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/compositing/overflow/grandchild-composited-with-border-radius-ancestor.html [ Failure ]
@@ -23242,12 +21732,9 @@
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/bugzilla-7235.html [ Crash Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/button-checkbox-click-method-repaint.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/button-inner-no-repaint.html [ Failure Pass ]
-crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/caret-change-paint-offset-keep-visual.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/caret-color.html [ Crash Pass ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/caret-contenteditable-content-after.html [ Failure ]
-crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/caret-invalidation-in-overflow-scroll.html [ Crash Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/caret-outside-block.html [ Failure ]
-crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/caret-subpixel.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/caret-with-composited-scroll.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/caret-with-transformation.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/change-transform.html [ Failure Pass ]
@@ -23457,8 +21944,6 @@
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/invalidate-after-composited-scroll.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/invalidate-box-shadow-currentColor.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/invalidate-caret-before-text-node-update.html [ Failure ]
-crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/invalidate-caret-in-composited-scrolling-container.html [ Crash Failure ]
-crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/invalidate-caret-in-non-composited-scrolling-container.html [ Crash Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/invalidate-descendants-when-receiving-paint-layer.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/invalidate-invisible-element.html [ Failure Pass ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/invalidate-paint-for-fixed-pos-inside-iframe.html [ Failure ]
@@ -23506,15 +21991,12 @@
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/line-overflow.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/lines-with-layout-delta.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/list-marker-2.html [ Crash Failure ]
-crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/list-marker-move.html [ Crash ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/list-marker.html [ Failure ]
-crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/local-attachment-background-li-crash.html [ Crash ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/make-children-non-inline.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/margin.html [ Failure Pass ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/media-audio-no-spurious-repaints.html [ Crash ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/mix-blend-mode-separate-stacking-context.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/move-caret-in-container-change-paint-offset-keep-visual.html [ Failure Pass ]
-crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/multi-layout-one-frame.html [ Crash Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/multi-subsequence-composited.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/multi-subsequence-scrolled.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/multicol-as-paint-container.html [ Failure Pass ]
@@ -23763,7 +22245,6 @@
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/text-shadow-horizontal.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/text-shadow.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/textarea-caret.html [ Crash Failure ]
-crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/textarea-set-disabled.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/trailing-floats-root-line-box-overflow.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/transform-absolute-child.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/transform-absolute-in-positioned-container.html [ Failure ]
@@ -23796,7 +22277,6 @@
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/window-resize-positioned-percent-top.html [ Failure Pass ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/window-resize-vertical-writing-mode.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/invalidation/window-resize-viewport-percent.html [ Failure Pass ]
-crbug.com/591099 virtual/disable-spinvalidation/paint/lists/invalidate-list-marker-color.html [ Crash ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/masks/fieldset-mask.html [ Failure ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/overflow/interest-rect-change-scroll-down.html [ Failure Pass ]
 crbug.com/591099 virtual/disable-spinvalidation/paint/overflow/non-composited-fixed-position-descendant.html [ Failure ]
@@ -23991,7 +22471,6 @@
 crbug.com/591099 virtual/display_list_2d_canvas/fast/canvas/canvas-textMetrics-width.html [ Failure ]
 crbug.com/591099 virtual/display_list_2d_canvas/fast/canvas/canvas-transforms-during-path.html [ Failure ]
 crbug.com/591099 virtual/display_list_2d_canvas/fast/canvas/canvas-transforms-fillRect-shadow.html [ Crash ]
-crbug.com/591099 virtual/display_list_2d_canvas/fast/canvas/check-stale-putImageData.html [ Crash ]
 crbug.com/591099 virtual/display_list_2d_canvas/fast/canvas/draw-focus-if-needed-invisible-crash.html [ Crash ]
 crbug.com/591099 virtual/display_list_2d_canvas/fast/canvas/draw-focus-if-needed-on-event.html [ Crash ]
 crbug.com/591099 virtual/display_list_2d_canvas/fast/canvas/draw-focus-if-needed-scrolls-horiz.html [ Failure Pass ]
@@ -24038,10 +22517,10 @@
 crbug.com/591099 virtual/exotic-color-space/images/2-comp.html [ Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/2-dht.html [ Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/23-55.html [ Failure ]
-crbug.com/591099 virtual/exotic-color-space/images/55.html [ Crash ]
-crbug.com/591099 virtual/exotic-color-space/images/alt-text-wrapping.html [ Crash ]
+crbug.com/591099 virtual/exotic-color-space/images/55.html [ Crash Failure ]
+crbug.com/591099 virtual/exotic-color-space/images/alt-text-wrapping.html [ Crash Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/animated-background-image-crash.html [ Failure ]
-crbug.com/591099 virtual/exotic-color-space/images/bad-png.html [ Crash ]
+crbug.com/591099 virtual/exotic-color-space/images/bad-png.html [ Crash Pass ]
 crbug.com/591099 virtual/exotic-color-space/images/busted-oval-does-not-render.html [ Crash ]
 crbug.com/591099 virtual/exotic-color-space/images/color-jpeg-with-color-profile.html [ Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/color-profile-background-clip-text.html [ Failure ]
@@ -24070,10 +22549,7 @@
 crbug.com/591099 virtual/exotic-color-space/images/color-profile-layer.html [ Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/color-profile-mask-image-svg.html [ Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/color-profile-svg-foreign-object.html [ Failure ]
-crbug.com/591099 virtual/exotic-color-space/images/content-url-broken-image-with-alt-text.html [ Crash ]
 crbug.com/591099 virtual/exotic-color-space/images/content-url-image-with-alt-text-dynamic-2.html [ Crash ]
-crbug.com/591099 virtual/exotic-color-space/images/crash-when-fallback-content-deleted.html [ Crash ]
-crbug.com/591099 virtual/exotic-color-space/images/crash-when-zoom-factor-changes.html [ Crash ]
 crbug.com/591099 virtual/exotic-color-space/images/cross-fade-background-size.html [ Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/cross-fade-blending.html [ Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/cross-fade-invalidation.html [ Failure ]
@@ -24104,17 +22580,17 @@
 crbug.com/591099 virtual/exotic-color-space/images/image-click-scale-restore-zoomed-image.html [ Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/image-css3-content-data.html [ Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/image-document-write-assert.html [ Failure ]
-crbug.com/591099 virtual/exotic-color-space/images/image-empty-data.html [ Crash ]
-crbug.com/591099 virtual/exotic-color-space/images/image-hover-display-alt.html [ Crash ]
-crbug.com/591099 virtual/exotic-color-space/images/image-in-map.html [ Crash ]
+crbug.com/591099 virtual/exotic-color-space/images/image-empty-data.html [ Crash Failure ]
+crbug.com/591099 virtual/exotic-color-space/images/image-hover-display-alt.html [ Crash Failure ]
+crbug.com/591099 virtual/exotic-color-space/images/image-in-map.html [ Crash Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/image-invalid-data.html [ Crash ]
 crbug.com/591099 virtual/exotic-color-space/images/image-load-event-in-fragment.html [ Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/image-map-anchor-children.html [ Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/image-map-multiple-xhtml.xhtml [ Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/image-map-multiple.html [ Failure ]
-crbug.com/591099 virtual/exotic-color-space/images/image-map-zoom-alt-content.html [ Crash ]
+crbug.com/591099 virtual/exotic-color-space/images/image-map-zoom-alt-content.html [ Crash Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/image-map-zoom.html [ Failure ]
-crbug.com/591099 virtual/exotic-color-space/images/image-page-injected-script-crash.html [ Crash ]
+crbug.com/591099 virtual/exotic-color-space/images/image-page-injected-script-crash.html [ Crash Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/image-use-counters.html [ Crash ]
 crbug.com/591099 virtual/exotic-color-space/images/image-zoom-to-25.html [ Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/image-zoom-to-500.html [ Failure ]
@@ -24137,7 +22613,6 @@
 crbug.com/591099 virtual/exotic-color-space/images/jpeg-yuv-image-decoding.html [ Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/jpeg-yuv-progressive-canvas.html [ Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/jpeg-yuv-progressive-image.html [ Failure ]
-crbug.com/591099 virtual/exotic-color-space/images/large-size-image-crash.html [ Crash ]
 crbug.com/591099 virtual/exotic-color-space/images/link-body-content-imageDimensionChanged-crash.html [ Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/load-img-with-empty-src.html [ Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/motion-jpeg-single-frame.html [ Failure ]
@@ -24148,20 +22623,19 @@
 crbug.com/591099 virtual/exotic-color-space/images/percent-height-image.html [ Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/pixel-crack-image-background-webkit-transform-scale.html [ Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/png-extra-row-crash.html [ Failure ]
-crbug.com/591099 virtual/exotic-color-space/images/png-missing-plte-before-trns-crash.html [ Crash ]
 crbug.com/591099 virtual/exotic-color-space/images/png-suite/test.html [ Crash ]
 crbug.com/591099 virtual/exotic-color-space/images/png_per_row_alpha_decoding.html [ Failure ]
-crbug.com/591099 virtual/exotic-color-space/images/rendering-broken-0px-images-quirk.html [ Crash ]
-crbug.com/591099 virtual/exotic-color-space/images/rendering-broken-0px-images.html [ Crash ]
-crbug.com/591099 virtual/exotic-color-space/images/rendering-broken-10px-images.html [ Crash ]
-crbug.com/591099 virtual/exotic-color-space/images/rendering-broken-16px-images.html [ Crash ]
-crbug.com/591099 virtual/exotic-color-space/images/rendering-broken-1px-images.html [ Crash ]
-crbug.com/591099 virtual/exotic-color-space/images/rendering-broken-block-flow-images.html [ Crash ]
-crbug.com/591099 virtual/exotic-color-space/images/rendering-broken-images-empty-alt.html [ Crash ]
-crbug.com/591099 virtual/exotic-color-space/images/rendering-broken-images.html [ Crash ]
+crbug.com/591099 virtual/exotic-color-space/images/rendering-broken-0px-images-quirk.html [ Crash Failure ]
+crbug.com/591099 virtual/exotic-color-space/images/rendering-broken-0px-images.html [ Crash Failure ]
+crbug.com/591099 virtual/exotic-color-space/images/rendering-broken-10px-images.html [ Crash Failure ]
+crbug.com/591099 virtual/exotic-color-space/images/rendering-broken-16px-images.html [ Crash Failure ]
+crbug.com/591099 virtual/exotic-color-space/images/rendering-broken-1px-images.html [ Crash Failure ]
+crbug.com/591099 virtual/exotic-color-space/images/rendering-broken-block-flow-images.html [ Crash Failure ]
+crbug.com/591099 virtual/exotic-color-space/images/rendering-broken-images-empty-alt.html [ Crash Failure ]
+crbug.com/591099 virtual/exotic-color-space/images/rendering-broken-images.html [ Crash Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/script-counter-imageDimensionChanged-crash.html [ Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/sprite-no-bleed.html [ Failure ]
-crbug.com/591099 virtual/exotic-color-space/images/style-access-during-imageChanged-crash.html [ Crash ]
+crbug.com/591099 virtual/exotic-color-space/images/style-access-during-imageChanged-crash.html [ Crash Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/style-access-during-imageChanged-style-freeze.html [ Crash ]
 crbug.com/591099 virtual/exotic-color-space/images/text-content-crash-2.html [ Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/text-content-crash.html [ Failure ]
@@ -24169,7 +22643,6 @@
 crbug.com/591099 virtual/exotic-color-space/images/viewport-in-standalone-image-document.html [ Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/webgl-teximage2d.html [ Crash ]
 crbug.com/591099 virtual/exotic-color-space/images/webp-flip.html [ Failure ]
-crbug.com/591099 virtual/exotic-color-space/images/width-on-broken-data-src.html [ Crash ]
 crbug.com/591099 virtual/exotic-color-space/images/zoomed-img-size.html [ Failure ]
 crbug.com/591099 virtual/exotic-color-space/images/zoomed-offset-size.html [ Crash ]
 crbug.com/591099 virtual/gpu-rasterization/images/12-55.html [ Failure ]
@@ -24289,8 +22762,8 @@
 crbug.com/591099 virtual/gpu-rasterization/images/png-missing-plte-before-trns-crash.html [ Crash Pass ]
 crbug.com/591099 virtual/gpu-rasterization/images/png-suite/test.html [ Crash Failure ]
 crbug.com/591099 virtual/gpu-rasterization/images/png_per_row_alpha_decoding.html [ Failure ]
-crbug.com/591099 virtual/gpu-rasterization/images/rendering-broken-0px-images-quirk.html [ Crash ]
-crbug.com/591099 virtual/gpu-rasterization/images/rendering-broken-0px-images.html [ Crash ]
+crbug.com/591099 virtual/gpu-rasterization/images/rendering-broken-0px-images-quirk.html [ Crash Failure ]
+crbug.com/591099 virtual/gpu-rasterization/images/rendering-broken-0px-images.html [ Crash Failure ]
 crbug.com/591099 virtual/gpu-rasterization/images/rendering-broken-10px-images.html [ Crash Failure ]
 crbug.com/591099 virtual/gpu-rasterization/images/rendering-broken-16px-images.html [ Crash Failure ]
 crbug.com/591099 virtual/gpu-rasterization/images/rendering-broken-1px-images.html [ Crash Failure ]
@@ -24458,7 +22931,6 @@
 crbug.com/591099 virtual/gpu/fast/canvas/canvas-textMetrics-width.html [ Failure ]
 crbug.com/591099 virtual/gpu/fast/canvas/canvas-transforms-during-path.html [ Failure ]
 crbug.com/591099 virtual/gpu/fast/canvas/canvas-transforms-fillRect-shadow.html [ Crash ]
-crbug.com/591099 virtual/gpu/fast/canvas/check-stale-putImageData.html [ Crash ]
 crbug.com/591099 virtual/gpu/fast/canvas/draw-focus-if-needed-invisible-crash.html [ Crash ]
 crbug.com/591099 virtual/gpu/fast/canvas/draw-focus-if-needed-on-event.html [ Crash ]
 crbug.com/591099 virtual/gpu/fast/canvas/draw-focus-if-needed-scrolls-horiz.html [ Failure Pass ]
@@ -24540,9 +23012,6 @@
 crbug.com/591099 virtual/mojo-loading/http/tests/inspector/appcache/appcache-manifest-with-non-existing-file.html [ Pass Timeout ]
 crbug.com/591099 virtual/mojo-loading/http/tests/inspector/appcache/appcache-swap.html [ Pass Timeout ]
 crbug.com/591099 virtual/mojo-loading/http/tests/inspector/bindings/livelocation-main-frame-navigated.html [ Failure ]
-crbug.com/591099 virtual/mojo-loading/http/tests/inspector/cache-storage/cache-names.html [ Timeout ]
-crbug.com/591099 virtual/mojo-loading/http/tests/inspector/network/network-document-initiator.html [ Timeout ]
-crbug.com/591099 virtual/mojo-loading/http/tests/inspector/network/network-fetch.html [ Timeout ]
 crbug.com/591099 virtual/mojo-loading/http/tests/inspector/network/network-filters.html [ Failure Pass ]
 crbug.com/591099 virtual/mojo-loading/http/tests/inspector/network/waterfall-images.html [ Failure Pass ]
 crbug.com/591099 virtual/mojo-loading/http/tests/inspector/persistence/automapping-sourcemap.html [ Failure Pass Timeout ]
@@ -24554,7 +23023,6 @@
 crbug.com/591099 virtual/mojo-loading/http/tests/security/cors-rfc1918/addressspace-document-csp-appcache.html [ Failure Pass Timeout ]
 crbug.com/591099 virtual/mojo-loading/http/tests/security/cross-frame-mouse-source-capabilities.html [ Pass Timeout ]
 crbug.com/591099 virtual/mojo-loading/http/tests/serviceworker/ServiceWorkerGlobalScope/registration-attribute.html [ Failure Pass ]
-crbug.com/591099 virtual/mojo-loading/http/tests/websocket/cookie-document-to-ws.html [ Failure ]
 crbug.com/591099 virtual/mojo-localstorage/external/wpt/webstorage/event_no_duplicates.html [ Crash ]
 crbug.com/591099 virtual/mojo-localstorage/external/wpt/webstorage/storage_setitem.html [ Pass Timeout ]
 crbug.com/591099 virtual/mojo-localstorage/storage/domstorage/localstorage/missing-arguments.html [ Failure ]
@@ -24609,7 +23077,6 @@
 crbug.com/591099 virtual/off-main-thread-fetch/external/wpt/service-workers/service-worker/extendable-event-async-waituntil.https.html [ Crash ]
 crbug.com/591099 virtual/off-main-thread-fetch/external/wpt/service-workers/service-worker/fetch-canvas-tainting.https.html [ Crash ]
 crbug.com/591099 virtual/off-main-thread-fetch/external/wpt/service-workers/service-worker/fetch-cors-xhr.https.html [ Crash ]
-crbug.com/591099 virtual/off-main-thread-fetch/external/wpt/service-workers/service-worker/fetch-csp.https.html [ Crash ]
 crbug.com/591099 virtual/off-main-thread-fetch/external/wpt/service-workers/service-worker/fetch-event-redirect.https.html [ Pass Timeout ]
 crbug.com/591099 virtual/off-main-thread-fetch/external/wpt/service-workers/service-worker/fetch-event.https.html [ Crash ]
 crbug.com/591099 virtual/off-main-thread-fetch/external/wpt/service-workers/service-worker/fetch-frame-resource.https.html [ Crash ]
@@ -24630,11 +23097,9 @@
 crbug.com/591099 virtual/off-main-thread-fetch/external/wpt/service-workers/service-worker/navigation-redirect.https.html [ Crash ]
 crbug.com/591099 virtual/off-main-thread-fetch/external/wpt/service-workers/service-worker/ready.https.html [ Crash ]
 crbug.com/591099 virtual/off-main-thread-fetch/external/wpt/service-workers/service-worker/register-closed-window.https.html [ Crash ]
-crbug.com/591099 virtual/off-main-thread-fetch/external/wpt/service-workers/service-worker/register-link-element.https.html [ Timeout ]
 crbug.com/591099 virtual/off-main-thread-fetch/external/wpt/service-workers/service-worker/register-link-header.https.html [ Crash ]
 crbug.com/591099 virtual/off-main-thread-fetch/external/wpt/service-workers/service-worker/register-same-scope-different-script-url.https.html [ Crash ]
 crbug.com/591099 virtual/off-main-thread-fetch/external/wpt/service-workers/service-worker/registration-iframe.https.html [ Crash ]
-crbug.com/591099 virtual/off-main-thread-fetch/external/wpt/service-workers/service-worker/registration.https.html [ Timeout ]
 crbug.com/591099 virtual/off-main-thread-fetch/external/wpt/service-workers/service-worker/unregister-controller.https.html [ Crash ]
 crbug.com/591099 virtual/off-main-thread-fetch/external/wpt/service-workers/service-worker/unregister-then-register-new-script.https.html [ Crash ]
 crbug.com/591099 virtual/off-main-thread-fetch/external/wpt/service-workers/service-worker/unregister-then-register.https.html [ Crash ]
@@ -24667,7 +23132,7 @@
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/char-encoding-in-hidden-charset-field-with-accept-charset.html [ Failure ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/char-encoding-in-hidden-charset-field-with-get-method.html [ Failure ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/char-encoding-in-hidden-charset-field-with-one-field.html [ Failure ]
-crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/char-encoding-in-text-charset-field-with-value.html [ Crash ]
+crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/char-encoding-in-text-charset-field-with-value.html [ Crash Failure ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/char-encoding-without-charset-field.html [ Failure ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/client-hint-accept-on-subresource.html [ Crash ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/client-hints-accept-iframe.html [ Crash ]
@@ -24691,14 +23156,14 @@
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/embed-image-load-outlives-gc-without-crashing.html [ Crash ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/empty-cookie.html [ Crash Failure ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/empty-file-formdata.html [ Crash Failure ]
-crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/empty-urls.html [ Crash ]
+crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/empty-urls.html [ Crash Failure ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/error404.pl [ Failure ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/extract-http-content-language-against-equiv.php [ Failure ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/extract-http-content-language-malformed.php [ Failure ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/extract-http-content-language-multiple.php [ Failure ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/extract-http-content-language.php [ Failure ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/favicon-as-image.html [ Crash Failure ]
-crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/font-face-in-multiple-segmented-faces.html [ Crash ]
+crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/font-face-in-multiple-segmented-faces.html [ Crash Failure ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/form-action-using-replaceChild.html [ Crash ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/form-post-textplain.html [ Failure ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/frame-access-during-load.html [ Failure ]
@@ -24707,7 +23172,7 @@
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/iframe-reparenting-id-collision.html [ Failure ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/iframe404.html [ Crash ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/image-blocked-src-change.html [ Failure ]
-crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/image-blocked-src-no-change.html [ Crash ]
+crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/image-blocked-src-no-change.html [ Crash Failure ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/image-input-type-outlives-gc-without-crashing.html [ Crash ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/image-load-outlives-gc-without-crashing.html [ Crash ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/image-onerror-no-load-event.html [ Failure ]
@@ -24720,7 +23185,7 @@
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/object-image-error.html [ Crash Failure ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/object-image-load-outlives-gc-without-crashing.html [ Crash ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/onload-remove-iframe-crash-2.html [ Crash ]
-crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/percent-sign-in-form-field-name.html [ Crash ]
+crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/percent-sign-in-form-field-name.html [ Crash Failure ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/plugin-array-detach.html [ Crash ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/refresh-headers.php [ Failure ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/resource-timing-iframe-restored-from-history.html [ Failure ]
@@ -24732,14 +23197,14 @@
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/slow-loading-image-in-pattern.html [ Failure ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/slow-loading-mask.html [ Failure ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/slow-preload-cancel.html [ Crash Failure ]
-crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/submit-get-in-utf16be.html [ Crash ]
-crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/submit-get-in-utf16le.html [ Crash ]
-crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/submit-get-in-utf32be.html [ Crash ]
-crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/submit-get-in-utf32le.html [ Crash ]
-crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/submit-post-in-utf16be.html [ Crash ]
-crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/submit-post-in-utf16le.html [ Crash ]
-crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/submit-post-in-utf32be.html [ Crash ]
-crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/submit-post-in-utf32le.html [ Crash ]
+crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/submit-get-in-utf16be.html [ Crash Failure ]
+crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/submit-get-in-utf16le.html [ Crash Failure ]
+crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/submit-get-in-utf32be.html [ Crash Failure ]
+crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/submit-get-in-utf32le.html [ Crash Failure ]
+crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/submit-post-in-utf16be.html [ Crash Failure ]
+crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/submit-post-in-utf16le.html [ Crash Failure ]
+crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/submit-post-in-utf32be.html [ Crash Failure ]
+crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/submit-post-in-utf32le.html [ Crash Failure ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/svg-image-load-outlives-gc-without-crashing.html [ Crash ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/uncacheable-script-repeated.html [ Crash ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/misc/unloadable-script.html [ Failure ]
@@ -24757,7 +23222,6 @@
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/security/cookies/websocket/third-party-cookie-blocked-on-cross-origin-websocket.html [ Crash ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/security/cookies/websocket/third-party-cookie-blocked-on-same-origin-websocket.html [ Crash ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/serviceworker/ServiceWorkerGlobalScope/registration-attribute.html [ Failure Pass ]
-crbug.com/591099 virtual/off-main-thread-fetch/http/tests/serviceworker/chromium.fetch-csp.html [ Crash ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/serviceworker/chromium/frame-detached-by-navigation.html [ Crash ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/serviceworker/chromium/resolve-after-window-close.html [ Crash Failure ]
 crbug.com/591099 virtual/off-main-thread-fetch/http/tests/serviceworker/chromium/service-worker-gc.html [ Failure ]
@@ -24829,7 +23293,6 @@
 crbug.com/591099 virtual/prefer_compositing_to_lcd_text/compositing/overflow/content-gains-scrollbars.html [ Failure ]
 crbug.com/591099 virtual/prefer_compositing_to_lcd_text/compositing/overflow/content-loses-scrollbars.html [ Failure ]
 crbug.com/591099 virtual/prefer_compositing_to_lcd_text/compositing/overflow/descendant-with-clip-path.html [ Failure Pass ]
-crbug.com/591099 virtual/prefer_compositing_to_lcd_text/compositing/overflow/do-not-paint-outline-into-composited-scrolling-contents.html [ Crash Failure ]
 crbug.com/591099 virtual/prefer_compositing_to_lcd_text/compositing/overflow/fixed-position-ancestor-clip.html [ Failure ]
 crbug.com/591099 virtual/prefer_compositing_to_lcd_text/compositing/overflow/fractional-sized-scrolling-layer.html [ Failure ]
 crbug.com/591099 virtual/prefer_compositing_to_lcd_text/compositing/overflow/grandchild-composited-with-border-radius-ancestor.html [ Failure ]
@@ -24900,8 +23363,6 @@
 crbug.com/591099 virtual/prefer_compositing_to_lcd_text/scrollbars/basic-scrollbar.html [ Failure ]
 crbug.com/591099 virtual/prefer_compositing_to_lcd_text/scrollbars/border-box-rect-clips-scrollbars.html [ Failure ]
 crbug.com/591099 virtual/prefer_compositing_to_lcd_text/scrollbars/custom-scrollbar-appearance-property.html [ Failure ]
-crbug.com/591099 virtual/prefer_compositing_to_lcd_text/scrollbars/custom-scrollbar-changing-style-relayout-body-scrollablearea.html [ Crash ]
-crbug.com/591099 virtual/prefer_compositing_to_lcd_text/scrollbars/custom-scrollbar-changing-style-relayout-div-body-scrollablearea.html [ Crash ]
 crbug.com/591099 virtual/prefer_compositing_to_lcd_text/scrollbars/custom-scrollbar-display.html [ Failure ]
 crbug.com/591099 virtual/prefer_compositing_to_lcd_text/scrollbars/custom-scrollbar-enable-changes-thickness-with-iframe.html [ Failure Pass ]
 crbug.com/591099 virtual/prefer_compositing_to_lcd_text/scrollbars/custom-scrollbar-not-inherited-by-iframe.html [ Crash ]
@@ -24925,7 +23386,6 @@
 crbug.com/591099 virtual/prefer_compositing_to_lcd_text/scrollbars/scrollbar-click-does-not-blur-content.html [ Crash ]
 crbug.com/591099 virtual/prefer_compositing_to_lcd_text/scrollbars/scrollbar-content-crash.html [ Failure ]
 crbug.com/591099 virtual/prefer_compositing_to_lcd_text/scrollbars/scrollbar-crash-on-refresh.html [ Failure ]
-crbug.com/591099 virtual/prefer_compositing_to_lcd_text/scrollbars/scrollbar-large-overflow-rectangle.html [ Crash ]
 crbug.com/591099 virtual/prefer_compositing_to_lcd_text/scrollbars/scrollbar-miss-mousemove-disabled.html [ Failure ]
 crbug.com/591099 virtual/prefer_compositing_to_lcd_text/scrollbars/scrollbar-miss-mousemove.html [ Failure ]
 crbug.com/591099 virtual/prefer_compositing_to_lcd_text/scrollbars/scrollbar-orientation.html [ Failure ]
@@ -24952,7 +23412,6 @@
 crbug.com/591099 virtual/rootlayerscrolls/fast/scrolling/html-element-client-rect-excludes-scrollbars.html [ Failure ]
 crbug.com/591099 virtual/rootlayerscrolls/fast/scrolling/jquery-rtl-scroll-type.html [ Failure Pass ]
 crbug.com/591099 virtual/rootlayerscrolls/fast/scrolling/keyboard-scroll-page-scale.html [ Failure ]
-crbug.com/591099 virtual/rootlayerscrolls/fast/scrolling/listbox-wheel-event.html [ Failure ]
 crbug.com/591099 virtual/rootlayerscrolls/fast/scrolling/non-composited-scrolling-repaint-to-ancestor-backing.html [ Failure Pass ]
 crbug.com/591099 virtual/rootlayerscrolls/fast/scrolling/overflow-auto-ltr.html [ Failure ]
 crbug.com/591099 virtual/rootlayerscrolls/fast/scrolling/overflow-scrollability.html [ Failure ]
@@ -24965,13 +23424,8 @@
 crbug.com/591099 virtual/rootlayerscrolls/fast/scrolling/scroll-to-origin-with-options-no-layout.html [ Failure Pass ]
 crbug.com/591099 virtual/rootlayerscrolls/fast/scrolling/scrollable-area-dynamic-overflow.html [ Failure Pass ]
 crbug.com/591099 virtual/rootlayerscrolls/fast/scrolling/scrollable-area-frame-overflow-hidden.html [ Crash Failure ]
-crbug.com/591099 virtual/rootlayerscrolls/fast/scrolling/scrollable-area-frame-overried-inherited-visibility-hidden.html [ Crash Failure ]
-crbug.com/591099 virtual/rootlayerscrolls/fast/scrolling/scrollable-area-frame-scrolling-no-overried-inherited-visibility-hidden.html [ Crash Failure ]
 crbug.com/591099 virtual/rootlayerscrolls/fast/scrolling/scrollable-area-frame-scrolling-no-visibility-hidden-child.html [ Crash Pass ]
-crbug.com/591099 virtual/rootlayerscrolls/fast/scrolling/scrollable-area-frame-scrolling-no.html [ Crash Failure ]
-crbug.com/591099 virtual/rootlayerscrolls/fast/scrolling/scrollable-area-frame-scrolling-yes.html [ Crash Failure ]
 crbug.com/591099 virtual/rootlayerscrolls/fast/scrolling/scrollable-area-frame-visibility-hidden-child.html [ Crash Pass ]
-crbug.com/591099 virtual/rootlayerscrolls/fast/scrolling/scrollable-area-frame.html [ Crash Failure ]
 crbug.com/591099 virtual/rootlayerscrolls/fast/scrolling/scrollable-area-overflow-auto-visibility-override.html [ Failure Pass ]
 crbug.com/591099 virtual/rootlayerscrolls/fast/scrolling/scrollable-area-overflow-auto-visibility-visible.html [ Failure Pass ]
 crbug.com/591099 virtual/rootlayerscrolls/fast/scrolling/scrollable-area-overflow-auto.html [ Failure Pass ]
@@ -24988,8 +23442,6 @@
 crbug.com/591099 virtual/rootlayerscrolls/scrollbars/basic-scrollbar.html [ Failure ]
 crbug.com/591099 virtual/rootlayerscrolls/scrollbars/border-box-rect-clips-scrollbars.html [ Failure ]
 crbug.com/591099 virtual/rootlayerscrolls/scrollbars/custom-scrollbar-appearance-property.html [ Failure ]
-crbug.com/591099 virtual/rootlayerscrolls/scrollbars/custom-scrollbar-changing-style-relayout-body-scrollablearea.html [ Crash ]
-crbug.com/591099 virtual/rootlayerscrolls/scrollbars/custom-scrollbar-changing-style-relayout-div-body-scrollablearea.html [ Crash ]
 crbug.com/591099 virtual/rootlayerscrolls/scrollbars/custom-scrollbar-display.html [ Failure ]
 crbug.com/591099 virtual/rootlayerscrolls/scrollbars/custom-scrollbar-enable-changes-thickness-with-iframe.html [ Failure Pass ]
 crbug.com/591099 virtual/rootlayerscrolls/scrollbars/custom-scrollbar-not-inherited-by-iframe.html [ Crash ]
@@ -25013,7 +23465,6 @@
 crbug.com/591099 virtual/rootlayerscrolls/scrollbars/scrollbar-click-does-not-blur-content.html [ Crash ]
 crbug.com/591099 virtual/rootlayerscrolls/scrollbars/scrollbar-content-crash.html [ Failure ]
 crbug.com/591099 virtual/rootlayerscrolls/scrollbars/scrollbar-crash-on-refresh.html [ Failure ]
-crbug.com/591099 virtual/rootlayerscrolls/scrollbars/scrollbar-large-overflow-rectangle.html [ Crash ]
 crbug.com/591099 virtual/rootlayerscrolls/scrollbars/scrollbar-miss-mousemove-disabled.html [ Failure ]
 crbug.com/591099 virtual/rootlayerscrolls/scrollbars/scrollbar-miss-mousemove.html [ Failure ]
 crbug.com/591099 virtual/rootlayerscrolls/scrollbars/scrollbar-orientation.html [ Failure ]
@@ -25082,10 +23533,8 @@
 crbug.com/591099 virtual/stable/http/tests/navigation/history-back-across-form-submission-to-fragment.html [ Failure ]
 crbug.com/591099 virtual/stable/http/tests/navigation/image-load-in-subframe-unload-handler.html [ Crash ]
 crbug.com/591099 virtual/stable/http/tests/navigation/image-load-in-unload-handler.html [ Crash Pass ]
-crbug.com/591099 virtual/stable/http/tests/navigation/javascriptlink-basic.html [ Crash Timeout ]
-crbug.com/591099 virtual/stable/http/tests/navigation/javascriptlink-frames.html [ Crash Timeout ]
-crbug.com/591099 virtual/stable/http/tests/navigation/javascriptlink-goback.html [ Crash Timeout ]
-crbug.com/591099 virtual/stable/http/tests/navigation/javascriptlink-subframeload.html [ Crash Timeout ]
+crbug.com/591099 virtual/stable/http/tests/navigation/javascriptlink-basic.html [ Crash Failure Timeout ]
+crbug.com/591099 virtual/stable/http/tests/navigation/javascriptlink-goback.html [ Crash Failure Timeout ]
 crbug.com/591099 virtual/stable/http/tests/navigation/lockedhistory-iframe.html [ Failure ]
 crbug.com/591099 virtual/stable/http/tests/navigation/metaredirect-basic.html [ Crash Failure ]
 crbug.com/591099 virtual/stable/http/tests/navigation/metaredirect-frames.html [ Crash Pass ]
@@ -25096,9 +23545,6 @@
 crbug.com/591099 virtual/stable/http/tests/navigation/navigation-with-detached-origin-document.html [ Crash Pass ]
 crbug.com/591099 virtual/stable/http/tests/navigation/no-referrer-reset.html [ Failure Timeout ]
 crbug.com/591099 virtual/stable/http/tests/navigation/onload-navigation-iframe-2.html [ Failure ]
-crbug.com/591099 virtual/stable/http/tests/navigation/ping-cookie.html [ Crash Timeout ]
-crbug.com/591099 virtual/stable/http/tests/navigation/ping-cross-origin-from-https.html [ Crash Timeout ]
-crbug.com/591099 virtual/stable/http/tests/navigation/ping-cross-origin.html [ Crash Timeout ]
 crbug.com/591099 virtual/stable/http/tests/navigation/ping-same-origin.html [ Crash Timeout ]
 crbug.com/591099 virtual/stable/http/tests/navigation/post-301-response.html [ Crash Pass ]
 crbug.com/591099 virtual/stable/http/tests/navigation/post-302-response.html [ Crash Pass ]
@@ -25110,10 +23556,7 @@
 crbug.com/591099 virtual/stable/http/tests/navigation/post-goback-same-url.html [ Crash Failure ]
 crbug.com/591099 virtual/stable/http/tests/navigation/post-goback1.html [ Crash Failure ]
 crbug.com/591099 virtual/stable/http/tests/navigation/post-goback2.html [ Crash Failure ]
-crbug.com/591099 virtual/stable/http/tests/navigation/postredirect-basic.html [ Crash Pass ]
 crbug.com/591099 virtual/stable/http/tests/navigation/postredirect-frames-goback1.html [ Crash Failure ]
-crbug.com/591099 virtual/stable/http/tests/navigation/postredirect-frames.html [ Crash Pass ]
-crbug.com/591099 virtual/stable/http/tests/navigation/postredirect-goback1.html [ Crash Pass ]
 crbug.com/591099 virtual/stable/http/tests/navigation/postredirect-goback2.html [ Crash Failure ]
 crbug.com/591099 virtual/stable/http/tests/navigation/redirect-load-no-form-restoration.html [ Crash Pass ]
 crbug.com/591099 virtual/stable/http/tests/navigation/redirect302-basic.html [ Crash Failure ]
@@ -25182,7 +23625,6 @@
 crbug.com/591099 virtual/threaded/animations/composition/caret-color-composition.html [ Crash ]
 crbug.com/591099 virtual/threaded/animations/composition/stroke-dasharray-composition.html [ Crash ]
 crbug.com/591099 virtual/threaded/animations/computed-style.html [ Failure ]
-crbug.com/591099 virtual/threaded/animations/cross-fade-list-style-image.html [ Crash ]
 crbug.com/591099 virtual/threaded/animations/css-animation-overrides-svg-presentation-attribute-animation.html [ Crash ]
 crbug.com/591099 virtual/threaded/animations/delay-start-event.html [ Failure ]
 crbug.com/591099 virtual/threaded/animations/display-change-does-not-terminate-animation.html [ Crash ]
@@ -25224,7 +23666,6 @@
 crbug.com/591099 virtual/threaded/animations/interpolation/font-weight-interpolation.html [ Crash ]
 crbug.com/591099 virtual/threaded/animations/interpolation/height-interpolation.html [ Crash ]
 crbug.com/591099 virtual/threaded/animations/interpolation/line-height-interpolation.html [ Crash ]
-crbug.com/591099 virtual/threaded/animations/interpolation/list-style-image-interpolation.html [ Crash ]
 crbug.com/591099 virtual/threaded/animations/interpolation/margin-interpolation.html [ Crash ]
 crbug.com/591099 virtual/threaded/animations/interpolation/max-height-interpolation.html [ Crash ]
 crbug.com/591099 virtual/threaded/animations/interpolation/min-height-interpolation.html [ Crash ]
@@ -25638,7 +24079,6 @@
 crbug.com/591099 virtual/threaded/printing/standards-percentage-heights.html [ Failure Pass ]
 crbug.com/591099 virtual/threaded/printing/stretch-to-view-height.html [ Failure ]
 crbug.com/591099 virtual/threaded/printing/subframes-percentage-height.html [ Failure Pass ]
-crbug.com/591099 virtual/threaded/printing/text-color-adjust.html [ Crash ]
 crbug.com/591099 virtual/threaded/printing/thead-repeats-at-top-of-each-page-multiple-tables.html [ Failure ]
 crbug.com/591099 virtual/threaded/printing/thead-repeats-at-top-of-each-page.html [ Failure ]
 crbug.com/591099 virtual/threaded/printing/viewport-size-dependant-iframe-with-multicol-crash.html [ Failure ]
@@ -25668,7 +24108,7 @@
 crbug.com/591099 virtual/threaded/transitions/transition-end-event-destroy-iframe.html [ Crash ]
 crbug.com/591099 virtual/threaded/transitions/transition-end-event-destroy-renderer.html [ Failure ]
 crbug.com/591099 virtual/threaded/transitions/transition-end-event-left.html [ Failure ]
-crbug.com/591099 virtual/threaded/transitions/transition-end-event-multiple-01.html [ Failure ]
+crbug.com/591099 virtual/threaded/transitions/transition-end-event-multiple-01.html [ Failure Timeout ]
 crbug.com/591099 virtual/threaded/transitions/transition-end-event-multiple-02.html [ Failure ]
 crbug.com/591099 virtual/threaded/transitions/transition-end-event-multiple-03.html [ Failure ]
 crbug.com/591099 virtual/threaded/transitions/transition-end-event-nested.html [ Failure ]
@@ -25761,3 +24201,53 @@
 crbug.com/591099 webmidi/send-messages.html [ Failure ]
 crbug.com/591099 webmidi/send-system-messages.html [ Failure ]
 crbug.com/591099 xmlviewer/extensions-api.html [ Failure ]
+crbug.com/591099 css3/blending/svg-blend-luminosity.html [ Failure ]
+crbug.com/591099 css3/blending/svg-blend-color.html [ Failure ]
+crbug.com/591099 css3/blending/svg-blend-hue.html [ Failure ]
+crbug.com/591099 css3/blending/svg-blend-saturation.html [ Failure ]
+crbug.com/591099 fast/forms/fieldset/legend-after-margin-horizontal-writing-mode.html [ Failure ]
+crbug.com/591099 fast/forms/fieldset/legend-after-margin-vertical-writing-mode.html [ Failure ]
+crbug.com/591099 fast/forms/number/number-losing-renderer-on-click.html [ Crash ]
+crbug.com/591099 fast/forms/text/textfield-onchange-deletion.html [ Crash ]
+crbug.com/591099 fast/forms/select-popup/popup-menu-appearance-transform.html [ Failure ]
+crbug.com/591099 fast/forms/select-popup/popup-menu-appearance-minimum-font.html [ Failure ]
+crbug.com/591099 fast/forms/select-popup/popup-menu-appearance-texttransform.html [ Failure ]
+crbug.com/591099 fast/forms/select-popup/popup-menu-appearance-single-option.html [ Failure ]
+crbug.com/591099 fast/forms/select-popup/popup-menu-key-operations.html [ Failure ]
+crbug.com/591099 fast/forms/select-popup/popup-menu-appearance.html [ Failure ]
+crbug.com/591099 fast/multicol/paged-becomes-multicol-with-spanner.html [ Failure ]
+crbug.com/591099 fast/events/onbeforeunload-focused-iframe.html [ Failure ]
+crbug.com/591099 external/wpt/css/css-writing-modes-3/overconstrained-rel-pos-rtl-left-right-vrl-008.xht [ Failure ]
+crbug.com/591099 external/wpt/css/css-writing-modes-3/overconstrained-rel-pos-rtl-top-bottom-vrl-006.xht [ Failure ]
+crbug.com/591099 external/wpt/css/css-writing-modes-3/overconstrained-rel-pos-rtl-left-right-vlr-009.xht [ Failure ]
+crbug.com/591099 external/wpt/css/css-writing-modes-3/overconstrained-rel-pos-rtl-top-bottom-vlr-007.xht [ Failure ]
+crbug.com/591099 external/wpt/css/css-writing-modes-3/overconstrained-rel-pos-ltr-top-bottom-vrl-002.xht [ Failure ]
+crbug.com/591099 external/wpt/css/css-writing-modes-3/overconstrained-rel-pos-ltr-top-bottom-vlr-003.xht [ Failure ]
+crbug.com/591099 external/wpt/css/css-display-3/display-contents-dynamic-list-001-none.html [ Failure ]
+crbug.com/591099 external/wpt/css/css-display-3/display-contents-list-001.html [ Failure ]
+crbug.com/591099 external/wpt/css/css-display-3/display-contents-dynamic-list-001-inline.html [ Failure ]
+crbug.com/591099 external/wpt/html/browsers/origin/relaxing-the-same-origin-restriction/document_domain_setter_srcdoc.html [ Crash ]
+crbug.com/591099 external/wpt/html/browsers/origin/relaxing-the-same-origin-restriction/document_domain_setter_null.tentative.html [ Crash ]
+crbug.com/591099 inspector/sources/debugger/live-edit.html [ Failure ]
+crbug.com/591099 inspector/sources/debugger-frameworks/frameworks-dom-xhr-event-breakpoints.html [ Crash Timeout ]
+crbug.com/591099 virtual/exotic-color-space/images/color-profile-munsell-srgb-to-srgb.html [ Failure ]
+crbug.com/591099 virtual/exotic-color-space/images/color-profile-munsell-adobe-to-srgb.html [ Failure ]
+crbug.com/591099 virtual/layout_ng/fast/block/float/002.html [ Failure ]
+crbug.com/591099 virtual/layout_ng/fast/block/float/017.html [ Failure ]
+crbug.com/591099 virtual/layout_ng/fast/block/float/formatting-context-changes.html [ Failure ]
+crbug.com/591099 virtual/layout_ng/fast/block/float/rubybase-children-made-inline-crash.html [ Failure ]
+crbug.com/591099 http/tests/csspaint/border-color.html [ Failure ]
+crbug.com/591099 fast/ruby/generated-before-counter-doesnt-crash.html [ Failure ]
+crbug.com/591099 fast/pagination/auto-height.html [ Failure ]
+crbug.com/591099 fast/history/saves-state-after-frame-nav.html [ Failure ]
+crbug.com/591099 paint/tables/stacking-context-row-background-clipped-with-offset.html [ Failure ]
+crbug.com/591099 external/wpt/css/css-rhythm-1/line-height-step-writing-mode-vrl-ruby-001.html [ Failure ]
+crbug.com/591099 editing/pasteboard/smart-paste-in-text-control.html [ Failure ]
+crbug.com/591099 editing/selection/readonly-disabled-hittest.html [ Failure ]
+crbug.com/591099 virtual/disable-spinvalidation/paint/tables/stacking-context-row-background-clipped-with-offset.html [ Failure ]
+crbug.com/591099 virtual/stable/http/tests/navigation/postredirect-frames.html [ Failure ]
+crbug.com/591099 virtual/stable/http/tests/navigation/postredirect-basic.html [ Failure ]
+crbug.com/591099 virtual/stable/http/tests/navigation/postredirect-goback1.html [ Failure ]
+crbug.com/591099 http/tests/navigation/postredirect-frames.html [ Failure ]
+crbug.com/591099 http/tests/navigation/postredirect-basic.html [ Failure ]
+crbug.com/591099 http/tests/navigation/postredirect-goback1.html [ Failure ]

diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index 4512fec7..f3d0f35 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations

@@ -315,6 +315,9 @@
 crbug.com/704961 [ Mac ] virtual/layout_ng/external/wpt/css/CSS2/positioning/position-applies-to-014.xht [ Failure ]
 crbug.com/704961 [ Mac ] virtual/layout_ng/external/wpt/css/CSS2/positioning/position-applies-to-015.xht [ Failure ]
 
+### virtual/layout_ng Mac textarea.
+crbug.com/635619 [ Mac ] virtual/layout_ng/fast/block/float/overhanging-tall-block.html [ Failure ]
+
 ### virtual/layout_ng Mac 1px glyph difference.
 crbug.com/635619 [ Mac ] virtual/layout_ng/fast/block/basic/015.html [ Failure ]
 
@@ -599,7 +602,7 @@
 crbug.com/635619 virtual/layout_ng/fast/block/basic/white-space-pre-wraps.html [ Failure ]
 
 ### virtual/layout_ng/fast/block/float
-crbug.com/635619 virtual/layout_ng/fast/block/float/002.html [ Crash ]
+crbug.com/635619 virtual/layout_ng/fast/block/float/002.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/003.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/008.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/010.html [ Failure ]
@@ -608,7 +611,7 @@
 crbug.com/635619 virtual/layout_ng/fast/block/float/014.html [ Failure Crash ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/015.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/016.html [ Failure ]
-crbug.com/635619 virtual/layout_ng/fast/block/float/017.html [ Crash ]
+crbug.com/635619 virtual/layout_ng/fast/block/float/017.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/018.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/019.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/020.html [ Failure ]
@@ -640,7 +643,6 @@
 crbug.com/635619 virtual/layout_ng/fast/block/float/avoiding-float-centered.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/block-with-negative-margin-clears-float.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/br-with-clear-2.html [ Failure ]
-crbug.com/635619 virtual/layout_ng/fast/block/float/br-with-clear.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/centered-float-avoidance-complexity.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/checkbox-and-radio-avoid-floats.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/clear-element-too-wide-for-containing-block.html [ Failure ]
@@ -661,7 +663,6 @@
 crbug.com/635619 virtual/layout_ng/fast/block/float/float-in-float-painting.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/float-inserted-into-clean-line.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/float-list-changed-before-layout-crash.html [ Crash ]
-crbug.com/635619 virtual/layout_ng/fast/block/float/float-not-removed-from-first-letter.html [ Crash ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/float-not-removed-from-next-sibling-crash.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/float-not-removed-from-next-sibling3.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/float-not-removed-from-next-sibling5.html [ Failure ]
@@ -689,7 +690,7 @@
 crbug.com/635619 virtual/layout_ng/fast/block/float/floats-wrap-inside-inline-003.htm [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/floats-wrap-inside-inline-004.htm [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/floats-wrap-inside-inline-007.html [ Failure ]
-crbug.com/635619 virtual/layout_ng/fast/block/float/formatting-context-changes.html [ Crash ]
+crbug.com/635619 virtual/layout_ng/fast/block/float/formatting-context-changes.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/independent-align-positioning.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/intruding-float-add-in-sibling-block-on-static-position.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/intruding-float-add-in-sibling-block-on-static-position2.html [ Failure ]
@@ -710,13 +711,12 @@
 crbug.com/635619 virtual/layout_ng/fast/block/float/overhanging-float-container-add-compositing.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/overhanging-float-remove-from-fixed-position-block.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/overhanging-float-remove-from-fixed-position-block2.html [ Failure ]
-crbug.com/635619 virtual/layout_ng/fast/block/float/overhanging-tall-block.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/overlapping-floats-paint-hittest-order-1.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/overlapping-floats-paint-hittest-order-2.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/override-property-float.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/relative-painted-twice.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/remove-line-above-float-above-line-crash.html [ Failure ]
-crbug.com/635619 virtual/layout_ng/fast/block/float/rubybase-children-made-inline-crash.html [ Crash ]
+crbug.com/635619 virtual/layout_ng/fast/block/float/rubybase-children-made-inline-crash.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/rubybase-children-moved-crash-2.html [ Failure Crash ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/rubybase-children-moved-crash.html [ Crash ]
 crbug.com/635619 virtual/layout_ng/fast/block/float/shrink-to-avoid-float-complexity.html [ Failure ]
@@ -760,8 +760,6 @@
 crbug.com/635619 virtual/layout_ng/fast/block/margin-collapse/empty-clear-blocks.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/margin-collapse/line-beside-float-complex-margin-collapsing.html [ Failure Crash ]
 crbug.com/635619 virtual/layout_ng/fast/block/margin-collapse/self-collapsing-block-creates-block-formatting-context.html [ Failure ]
-crbug.com/635619 virtual/layout_ng/fast/block/margin-collapse/self-collapsing-block-getting-layout-set.html [ Crash ]
-crbug.com/635619 virtual/layout_ng/fast/block/margin-collapse/self-collapsing-block-with-float-children.html [ Crash ]
 crbug.com/635619 virtual/layout_ng/fast/block/margin-collapse/self-collapsing-block-with-float-descendants.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/margin-collapse/self-collapsing-block-with-overflow-hidden-and-float-child.html [ Failure ]
 crbug.com/635619 virtual/layout_ng/fast/block/margin-collapse/self-collapsing-cols-creates-block-formatting-context.html [ Failure ]
@@ -776,6 +774,9 @@
 crbug.com/724701 virtual/layout_ng/overflow/overflow-basic-004.html [ Failure ]
 crbug.com/728378 virtual/layout_ng/overflow/overflow-bug-chrome-ng-001.html [ Failure ]
 crbug.com/728378 virtual/layout_ng/overflow/overflow-transform-002.html [ Failure ]
+crbug.com/728378 virtual/layout_ng/overflow/overflow-position-001.html [ Failure ]
+crbug.com/728378 virtual/layout_ng/overflow/overflow-position-002.html [ Failure ]
+crbug.com/728378 virtual/layout_ng/overflow/overflow-position-003.html [ Failure ]
 
 # ====== LayoutNG-only failures until here ======
 

diff --git a/third_party/WebKit/LayoutTests/bluetooth/requestDevice/acceptAllDevices/optional-services-missing.html b/third_party/WebKit/LayoutTests/bluetooth/requestDevice/acceptAllDevices/optional-services-missing.html
index 738e0f0..1aef3568 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/requestDevice/acceptAllDevices/optional-services-missing.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/requestDevice/acceptAllDevices/optional-services-missing.html

@@ -8,7 +8,7 @@
 'use strict';
 promise_test(() => {
   return getHealthThermometerDevice({acceptAllDevices: true})
-    .then(([device]) => assert_promise_rejects_with_message(
+    .then(({device}) => assert_promise_rejects_with_message(
       device.gatt.getPrimaryServices(),
       new DOMException(
         'Origin is not allowed to access any service. ' +

diff --git a/third_party/WebKit/LayoutTests/bluetooth/requestDevice/blocklisted-service-in-optionalServices.html b/third_party/WebKit/LayoutTests/bluetooth/requestDevice/blocklisted-service-in-optionalServices.html
index 1a69b79..2b9fef68 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/requestDevice/blocklisted-service-in-optionalServices.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/requestDevice/blocklisted-service-in-optionalServices.html

@@ -16,7 +16,7 @@
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['human_interface_device']
     })
-    .then(([device, fake_peripheral]) => {
+    .then(({device, fake_peripheral}) => {
       return fake_peripheral
         .setNextGATTConnectionResponse({code: HCI_SUCCESS})
         .then(() => device.gatt.connect())

diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/disconnect-called-before.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/disconnect-called-before.js
index 3945d6f..1c93f99 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/disconnect-called-before.js
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/disconnect-called-before.js

@@ -3,7 +3,7 @@
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['generic_access']})
-    .then(([device]) => {
+    .then(({device}) => {
       device.gatt.disconnect();
       return assert_promise_rejects_with_message(
         device.gatt.CALLS([

diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/disconnect-called-during-error.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/disconnect-called-during-error.js
index f79f856..4dafb7b0 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/disconnect-called-during-error.js
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/disconnect-called-during-error.js

@@ -1,7 +1,7 @@
 'use strict';
 promise_test(() => {
   return getEmptyHealthThermometerDevice()
-    .then(([device]) => {
+    .then(({device}) => {
       let promise = assert_promise_rejects_with_message(
         device.gatt.CALLS([
           getPrimaryService('health_thermometer')|

diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/disconnect-called-during-success.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/disconnect-called-during-success.js
index 1256f567..722a04b 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/disconnect-called-during-success.js
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/disconnect-called-during-success.js

@@ -3,7 +3,7 @@
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['generic_access']})
-    .then(([device]) => {
+    .then(({device}) => {
       let promise = assert_promise_rejects_with_message(
         device.gatt.CALLS([
           getPrimaryService('health_thermometer')|

diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/disconnect-invalidates-objects.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/disconnect-invalidates-objects.js
index deb310d1..3367d92 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/disconnect-invalidates-objects.js
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/disconnect-invalidates-objects.js

@@ -3,7 +3,7 @@
   let promise;
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}]})
-    .then(([device]) => {
+    .then(({device}) => {
       return device.gatt.CALLS([
         getPrimaryService('health_thermometer')|
         getPrimaryServices()|

diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/disconnected-device.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/disconnected-device.js
index 2ae7af2..e1d66cb 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/disconnected-device.js
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/disconnected-device.js

@@ -4,7 +4,7 @@
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['generic_access']
     })
-    .then(([device]) => assert_promise_rejects_with_message(
+    .then(({device}) => assert_promise_rejects_with_message(
       device.gatt.CALLS([
         getPrimaryService('health_thermometer')|
         getPrimaryServices()|

diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/discovery-complete-no-permission-absent-service.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/discovery-complete-no-permission-absent-service.js
index 27f8bba..cba08269 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/discovery-complete-no-permission-absent-service.js
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/discovery-complete-no-permission-absent-service.js

@@ -7,7 +7,7 @@
                                   'SecurityError');
   return getHealthThermometerDeviceWithServicesDiscovered({
       filters: [{services: ['health_thermometer']}]})
-    .then(([device]) => Promise.all([
+    .then(({device}) => Promise.all([
       assert_promise_rejects_with_message(
         device.gatt.CALLS([
           getPrimaryService(glucose.alias)|

diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/discovery-complete-service-not-found.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/discovery-complete-service-not-found.js
index 879b6cd..39f8376 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/discovery-complete-service-not-found.js
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/discovery-complete-service-not-found.js

@@ -3,7 +3,7 @@
   return getHealthThermometerDeviceWithServicesDiscovered({
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['glucose']})
-    .then(([device]) => assert_promise_rejects_with_message(
+    .then(({device}) => assert_promise_rejects_with_message(
       device.gatt.CALLS([
         getPrimaryService('glucose')|
         getPrimaryServices('glucose')[UUID]

diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/garbage-collection-ran-during-error.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/garbage-collection-ran-during-error.js
index 360ee82..7ae3837 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/garbage-collection-ran-during-error.js
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/garbage-collection-ran-during-error.js

@@ -2,7 +2,7 @@
 promise_test(() => {
   let promise;
   return getEmptyHealthThermometerDevice()
-      .then(([device]) => {
+      .then(({device}) => {
         promise = assert_promise_rejects_with_message(
           device.gatt.CALLS([
             getPrimaryService('health_thermometer')|

diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/garbage-collection-ran-during-success.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/garbage-collection-ran-during-success.js
index 18e98f6a..f03a204 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/garbage-collection-ran-during-success.js
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/garbage-collection-ran-during-success.js

@@ -3,7 +3,7 @@
   let promise;
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}]})
-    .then(([device]) => {
+    .then(({device}) => {
       promise = assert_promise_rejects_with_message(
         device.gatt.CALLS([
           getPrimaryService('health_thermometer') |

diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/get-different-service-after-reconnection.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/get-different-service-after-reconnection.js
index 2dcc9ab6..e18bc2aa 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/get-different-service-after-reconnection.js
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/get-different-service-after-reconnection.js

@@ -3,7 +3,7 @@
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['generic_access']})
-    .then(([device]) => {
+    .then(({device}) => {
       let services_first_connection;
       return device.gatt.CALLS([
           getPrimaryService('health_thermometer')|

diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/get-same-object.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/get-same-object.js
index 167e2c7e..10d440f 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/get-same-object.js
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/get-same-object.js

@@ -3,7 +3,7 @@
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['generic_access']})
-    .then(([device]) => Promise.all([
+    .then(({device}) => Promise.all([
       device.gatt.CALLS([
         getPrimaryService('health_thermometer')|
         getPrimaryServices()|

diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/invalid-service-name.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/invalid-service-name.js
index 32544f0..5205b5c 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/invalid-service-name.js
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/invalid-service-name.js

@@ -1,7 +1,7 @@
 'use strict';
 promise_test(() => {
   return getHealthThermometerDevice()
-    .then(([device]) => {
+    .then(({device}) => {
       return assert_promise_rejects_with_message(
         device.gatt.CALLS([
           getPrimaryService('wrong_name')|

diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/no-permission-absent-service.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/no-permission-absent-service.js
index 5be6047..061ff09 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/no-permission-absent-service.js
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/no-permission-absent-service.js

@@ -7,7 +7,7 @@
                                   'SecurityError');
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}]})
-    .then(([device]) => Promise.all([
+    .then(({device}) => Promise.all([
       assert_promise_rejects_with_message(
         device.gatt.CALLS([
           getPrimaryService(glucose.alias)|

diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/no-permission-for-any-service.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/no-permission-for-any-service.js
index e2e95c2e..41286232 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/no-permission-for-any-service.js
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/no-permission-for-any-service.js

@@ -1,7 +1,7 @@
 'use strict';
 promise_test(() => {
   return getHealthThermometerDevice({acceptAllDevices: true})
-    .then(([device]) => assert_promise_rejects_with_message(
+    .then(({device}) => assert_promise_rejects_with_message(
         device.gatt.CALLS([
           getPrimaryService('heart_rate')|
           getPrimaryServices()|

diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/no-permission-present-service.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/no-permission-present-service.js
index f7de4d2..eb9dc48c 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/no-permission-present-service.js
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/no-permission-present-service.js

@@ -7,7 +7,7 @@
                                   'SecurityError');
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}]})
-    .then(([device]) => Promise.all([
+    .then(({device}) => Promise.all([
       assert_promise_rejects_with_message(
         device.gatt.CALLS([
           getPrimaryService(generic_access.alias)|

diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/service-not-found.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/service-not-found.js
index 09c7d916..888aee2 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/service-not-found.js
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/server/service-not-found.js

@@ -3,7 +3,7 @@
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['glucose']})
-    .then(([device]) => assert_promise_rejects_with_message(
+    .then(({device}) => assert_promise_rejects_with_message(
       device.gatt.CALLS([
         getPrimaryService('glucose')|
         getPrimaryServices('glucose')[UUID]

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/blocklisted-characteristics-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/blocklisted-characteristic.js
similarity index 63%
copy from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/blocklisted-characteristics-with-uuid.html
copy to third_party/WebKit/LayoutTests/bluetooth/script-tests/service/blocklisted-characteristic.js
index 799d8d8..34669a5 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/blocklisted-characteristics-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/blocklisted-characteristic.js

@@ -1,18 +1,16 @@
-<!DOCTYPE html>
-<script src="../../../resources/testharness.js"></script>
-<script src="../../../resources/testharnessreport.js"></script>
-<script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
-<script>
 'use strict';
 promise_test(() => {
   return setBluetoothFakeAdapter('BlocklistTestAdapter')
     .then(() => requestDeviceWithKeyDown({
       filters: [{services: ['device_information']}]}))
     .then(device => device.gatt.connect())
-    .then(gattServer => gattServer.getPrimaryService('device_information'))
+    .then(gatt => gatt.getPrimaryService('device_information'))
     .then(service => {
       return assert_promise_rejects_with_message(
-        service.getCharacteristics('serial_number_string'),
+        service.CALLS([
+          getCharacteristic('serial_number_string')|
+          getCharacteristics('serial_number_string')[UUID]
+        ]),
         new DOMException('getCharacteristic(s) called with blocklisted UUID. ' +
                          'https://goo.gl/4NeimX',
                          'SecurityError'),
@@ -20,4 +18,3 @@
     });
 }, 'Serial Number String characteristic is blocklisted. Should reject with ' +
    'SecurityError.');
-</script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/characteristic-not-found.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/characteristic-not-found.js
new file mode 100644
index 0000000..8b7269a
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/characteristic-not-found.js

@@ -0,0 +1,17 @@
+'use strict';
+promise_test(() => {
+  return setBluetoothFakeAdapter('HeartRateAdapter')
+    .then(() => requestDeviceWithKeyDown({
+      filters: [{services: ['heart_rate']}]}))
+    .then(device => device.gatt.connect())
+    .then(gatt => gatt.getPrimaryService('heart_rate'))
+    .then(service => assert_promise_rejects_with_message(
+      service.CALLS([
+        getCharacteristic('battery_level')|
+        getCharacteristics('battery_level')[UUID]
+      ]),
+      new DOMException(
+        'No Characteristics matching UUID ' + battery_level.uuid + ' found ' +
+        'in Service with UUID ' + heart_rate.uuid + '.',
+        'NotFoundError')));
+}, 'Request for absent characteristics with UUID. Reject with NotFoundError.');

diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/device-disconnects-before.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/device-disconnects-before.js
new file mode 100644
index 0000000..b83d2471
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/device-disconnects-before.js

@@ -0,0 +1,26 @@
+'use strict';
+promise_test(() => {
+  return setBluetoothFakeAdapter('DisconnectingHeartRateAdapter')
+    .then(() => requestDeviceWithKeyDown({
+      filters: [{services: ['heart_rate']}],
+      optionalServices: [request_disconnection_service_uuid]
+    }))
+    .then(device => device.gatt.connect())
+    .then(gatt => {
+      let heart_rate_service;
+      return gatt.getPrimaryService('heart_rate')
+        .then(hrs => heart_rate_service = hrs)
+        .then(() => get_request_disconnection(gatt))
+        .then(requestDisconnection => requestDisconnection())
+        .then(() => assert_promise_rejects_with_message(
+          heart_rate_service.CALLS([
+            getCharacteristic('heart_rate_measurement')|
+            getCharacteristics()|
+            getCharacteristics('heart_rate_measurement')[UUID]
+          ]),
+          new DOMException(
+            'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+            '(Re)connect first with `device.gatt.connect`.',
+            'NetworkError')));
+    });
+}, 'Device disconnects before FUNCTION_NAME call. Reject with NetworkError.');

diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/device-disconnects-during.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/device-disconnects-during.js
new file mode 100644
index 0000000..0fe50a5d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/device-disconnects-during.js

@@ -0,0 +1,28 @@
+'use strict';
+promise_test(() => {
+  return setBluetoothFakeAdapter('DisconnectingHeartRateAdapter')
+    .then(() => requestDeviceWithKeyDown({
+      filters: [{services: ['heart_rate']}],
+      optionalServices: [request_disconnection_service_uuid]
+    }))
+    .then(device => device.gatt.connect())
+    .then(gatt => {
+      let heart_rate_service;
+      return gatt.getPrimaryService('heart_rate')
+        .then(hrs => heart_rate_service = hrs)
+        .then(() => get_request_disconnection(gatt))
+        .then(requestDisconnection => {
+          requestDisconnection();
+          return assert_promise_rejects_with_message(
+            heart_rate_service.CALLS([
+              getCharacteristic('heart_rate_measurement')|
+              getCharacteristics()|
+              getCharacteristics('heart_rate_measurement')[UUID]
+            ]),
+            new DOMException(
+              'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+              '(Re)connect first with `device.gatt.connect`.',
+              'NetworkError'));
+        });
+    });
+}, 'Device disconnects during FUNCTION_NAME call. Reject with NetworkError.');

diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/device-goes-out-of-range.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/device-goes-out-of-range.js
new file mode 100644
index 0000000..361d003
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/device-goes-out-of-range.js

@@ -0,0 +1,22 @@
+'use strict';
+promise_test(() => {
+  return setBluetoothFakeAdapter('HeartRateAdapter')
+    .then(() => requestDeviceWithKeyDown({
+      filters: [{services: ['heart_rate']}],
+      optionalServices: ['generic_access']}))
+    .then(device => device.gatt.connect())
+    .then(gatt => gatt.getPrimaryService('generic_access'))
+    .then(service => {
+      return setBluetoothFakeAdapter('EmptyAdapter')
+        .then(() => assert_promise_rejects_with_message(
+          service.CALLS([
+            getCharacteristic('gap.device_name')|
+            getCharacteristics()|
+            getCharacteristics('gap.device_name')[UUID]
+          ]),
+          new DOMException('Bluetooth Device is no longer in range.',
+                           'NetworkError'),
+          'Device went out of range.'));
+    });
+}, 'FUNCTION_NAME called after device goes out of range. Reject with ' +
+   'NetworkError.');

diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/disconnect-called-before.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/disconnect-called-before.js
new file mode 100644
index 0000000..c69428746
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/disconnect-called-before.js

@@ -0,0 +1,23 @@
+'use strict';
+promise_test(() => {
+  return setBluetoothFakeAdapter('HeartRateAdapter')
+    .then(() => requestDeviceWithKeyDown({
+      filters: [{services: ['heart_rate']}]}))
+    .then(device => device.gatt.connect())
+    .then(gatt => {
+      return gatt.getPrimaryService('heart_rate')
+        .then(heart_rate_service => {
+          gatt.disconnect();
+          return assert_promise_rejects_with_message(
+            heart_rate_service.CALLS([
+              getCharacteristic('heart_rate_measurement')|
+              getCharacteristics()|
+              getCharacteristics('heart_rate_measurement')[UUID]
+            ]),
+            new DOMException(
+              'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+              '(Re)connect first with `device.gatt.connect`.',
+              'NetworkError'));
+        });
+    });
+}, 'disconnect() called before FUNCTION_NAME. Reject with NetworkError.');

diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/disconnect-called-during.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/disconnect-called-during.js
new file mode 100644
index 0000000..9a805a5
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/disconnect-called-during.js

@@ -0,0 +1,24 @@
+'use strict';
+promise_test(() => {
+  return setBluetoothFakeAdapter('HeartRateAdapter')
+    .then(() => requestDeviceWithKeyDown({
+      filters: [{services: ['heart_rate']}]}))
+    .then(device => device.gatt.connect())
+    .then(gatt => {
+      return gatt.getPrimaryService('heart_rate')
+        .then(heart_rate_service => {
+          let promise = assert_promise_rejects_with_message(
+            heart_rate_service.CALLS([
+              getCharacteristic('heart_rate_measurement')|
+              getCharacteristics()|
+              getCharacteristics('heart_rate_measurement')[UUID]
+            ]),
+            new DOMException(
+              'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+              '(Re)connect first with `device.gatt.connect`.',
+              'NetworkError'));
+          gatt.disconnect();
+          return promise;
+        });
+    });
+}, 'disconnect() called during FUNCTION_NAME. Reject with NetworkError.');

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/invalid-characteristic-name.html b/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/invalid-characteristic-name.js
similarity index 67%
copy from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/invalid-characteristic-name.html
copy to third_party/WebKit/LayoutTests/bluetooth/script-tests/service/invalid-characteristic-name.js
index fbead68..70866d3 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/invalid-characteristic-name.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/invalid-characteristic-name.js

@@ -1,8 +1,3 @@
-<!DOCTYPE html>
-<script src="../../../resources/testharness.js"></script>
-<script src="../../../resources/testharnessreport.js"></script>
-<script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
-<script>
 'use strict';
 promise_test(() => {
   return setBluetoothFakeAdapter('HeartRateAdapter')
@@ -10,11 +5,15 @@
       filters: [{services: ['heart_rate']}],
       optionalServices: ['generic_access']}))
     .then(device => device.gatt.connect())
-    .then(gattServer => gattServer.getPrimaryService('generic_access'))
+    .then(gatt => gatt.getPrimaryService('generic_access'))
     .then(service => {
       return assert_promise_rejects_with_message(
-        service.getCharacteristic('wrong_name'), new DOMException(
-          'Failed to execute \'getCharacteristic\' on ' +
+        service.CALLS([
+          getCharacteristic('wrong_name')|
+          getCharacteristics('wrong_name')
+        ]),
+        new DOMException(
+          'Failed to execute \'FUNCTION_NAME\' on ' +
           '\'BluetoothRemoteGATTService\': Invalid Characteristic name: ' +
           '\'wrong_name\'. ' +
           'It must be a valid UUID alias (e.g. 0x1234), ' +
@@ -27,4 +26,3 @@
         'Wrong Characteristic name passed.');
     });
 }, 'Wrong Characteristic name. Reject with TypeError.');
-</script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/reconnect-during.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/reconnect-during.js
new file mode 100644
index 0000000..5a773f99
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/reconnect-during.js

@@ -0,0 +1,25 @@
+'use strict';
+promise_test(() => {
+  return setBluetoothFakeAdapter('HeartRateAdapter')
+    .then(() => requestDeviceWithKeyDown({
+      filters: [{services: ['heart_rate']}]}))
+    .then(device => device.gatt.connect())
+    .then(gatt => {
+      return gatt.getPrimaryService('heart_rate')
+        .then(service => {
+          let promise = assert_promise_rejects_with_message(
+            service.CALLS([
+              getCharacteristic('heart_rate_measurement')|
+              getCharacteristics()|
+              getCharacteristics('heart_rate_measurement')[UUID]
+            ]),
+            new DOMException(
+              'GATT Server is disconnected. Cannot retrieve characteristics. ' +
+              '(Re)connect first with `device.gatt.connect`.',
+              'NetworkError'));
+          gatt.disconnect();
+          return gatt.connect().then(() => promise);
+        });
+    });
+}, 'disconnect() and connect() called during FUNCTION_NAME. Reject with ' +
+   'NetworkError.');

diff --git a/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/service-is-removed.js b/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/service-is-removed.js
new file mode 100644
index 0000000..7a76d533
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/bluetooth/script-tests/service/service-is-removed.js

@@ -0,0 +1,21 @@
+'use strict';
+promise_test(() => {
+  return setBluetoothFakeAdapter('HeartRateAdapter')
+    .then(() => requestDeviceWithKeyDown({
+      filters: [{services: ['heart_rate']}],
+      optionalServices: ['generic_access']}))
+    .then(device => device.gatt.connect())
+    .then(gatt => gatt.getPrimaryService('generic_access'))
+    .then(service => {
+      return setBluetoothFakeAdapter('MissingServiceHeartRateAdapter')
+        .then(() => assert_promise_rejects_with_message(
+          service.CALLS([
+            getCharacteristic('gap.device_name')|
+            getCharacteristics()|
+            getCharacteristics('gap.device_name')[UUID]
+          ]),
+          new DOMException('GATT Service no longer exists.',
+                           'InvalidStateError'),
+          'Service got removed.'));
+    });
+}, 'Service is removed before FUNCTION_NAME call. Reject with InvalidStateError.');

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/connect/connection-succeeds.html b/third_party/WebKit/LayoutTests/bluetooth/server/connect/connection-succeeds.html
index a5fb002..78067cb6 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/connect/connection-succeeds.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/connect/connection-succeeds.html

@@ -8,7 +8,7 @@
 'use strict';
 promise_test(() => {
   return getDiscoveredHealthThermometerDevice()
-    .then(([device, fake_peripheral]) => {
+    .then(({device, fake_peripheral}) => {
       return fake_peripheral.setNextGATTConnectionResponse({code: HCI_SUCCESS})
         .then(() => device.gatt.connect())
         .then(gatt => assert_true(gatt.connected));

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/connect/garbage-collection-ran-during-success.html b/third_party/WebKit/LayoutTests/bluetooth/server/connect/garbage-collection-ran-during-success.html
index 60156c1..7b735914 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/connect/garbage-collection-ran-during-success.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/connect/garbage-collection-ran-during-success.html

@@ -8,7 +8,7 @@
 'use strict';
 promise_test(() => {
   return getDiscoveredHealthThermometerDevice()
-    .then(([device, fake_peripheral]) => {
+    .then(({device, fake_peripheral}) => {
       return fake_peripheral.setNextGATTConnectionResponse({code: HCI_SUCCESS})
         .then(() => {
           // Don't return the promise and let |device| go out of scope

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/connect/get-same-gatt-server.html b/third_party/WebKit/LayoutTests/bluetooth/server/connect/get-same-gatt-server.html
index d6d1a42..62f9d0b 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/connect/get-same-gatt-server.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/connect/get-same-gatt-server.html

@@ -8,7 +8,7 @@
 'use strict';
 promise_test(() => {
   return getDiscoveredHealthThermometerDevice()
-    .then(([device, fake_peripheral]) => {
+    .then(({device, fake_peripheral}) => {
       return fake_peripheral
         .setNextGATTConnectionResponse({code: HCI_SUCCESS})
         .then(() => device.gatt.connect())

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/device-same-object.html b/third_party/WebKit/LayoutTests/bluetooth/server/device-same-object.html
index c6f391c..f1aa39cc 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/device-same-object.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/device-same-object.html

@@ -8,7 +8,7 @@
 'use strict';
 promise_test(() => {
   return getDiscoveredHealthThermometerDevice()
-    .then(([device, fake_peripheral]) => {
+    .then(({device, fake_peripheral}) => {
       return fake_peripheral.setNextGATTConnectionResponse({code: HCI_SUCCESS})
         .then(() => device.gatt.connect());
     })

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-disconnect-called-before.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-disconnect-called-before.html
index 36e2de71..86e704f 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-disconnect-called-before.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-disconnect-called-before.html

@@ -11,7 +11,7 @@
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['generic_access']})
-    .then(([device]) => {
+    .then(({device}) => {
       device.gatt.disconnect();
       return assert_promise_rejects_with_message(
         device.gatt.getPrimaryService('health_thermometer'),

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-disconnect-called-during-error.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-disconnect-called-during-error.html
index 4eb61ea1..b4fbe18 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-disconnect-called-during-error.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-disconnect-called-during-error.html

@@ -9,7 +9,7 @@
 'use strict';
 promise_test(() => {
   return getEmptyHealthThermometerDevice()
-    .then(([device]) => {
+    .then(({device}) => {
       let promise = assert_promise_rejects_with_message(
         device.gatt.getPrimaryService('health_thermometer'),
         new DOMException('GATT Server is disconnected. ' +

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-disconnect-called-during-success.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-disconnect-called-during-success.html
index c2bd90f..9adb4ca6 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-disconnect-called-during-success.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-disconnect-called-during-success.html

@@ -11,7 +11,7 @@
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['generic_access']})
-    .then(([device]) => {
+    .then(({device}) => {
       let promise = assert_promise_rejects_with_message(
         device.gatt.getPrimaryService('health_thermometer'),
         new DOMException('GATT Server is disconnected. ' +

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-disconnect-invalidates-objects.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-disconnect-invalidates-objects.html
index 83741ef7..eb20948 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-disconnect-invalidates-objects.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-disconnect-invalidates-objects.html

@@ -11,7 +11,7 @@
   let promise;
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}]})
-    .then(([device]) => {
+    .then(({device}) => {
       return device.gatt.getPrimaryService('health_thermometer')
         // Convert to array if necessary.
         .then(s => {

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-disconnected-device.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-disconnected-device.html
index a7061fa..938b159b 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-disconnected-device.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-disconnected-device.html

@@ -12,7 +12,7 @@
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['generic_access']
     })
-    .then(([device]) => assert_promise_rejects_with_message(
+    .then(({device}) => assert_promise_rejects_with_message(
       device.gatt.getPrimaryService('health_thermometer'),
       new DOMException('GATT Server is disconnected. ' +
                        'Cannot retrieve services. ' +

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-discovery-complete-no-permission-absent-service.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-discovery-complete-no-permission-absent-service.html
index cb05a7a..1659be5 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-discovery-complete-no-permission-absent-service.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-discovery-complete-no-permission-absent-service.html

@@ -15,7 +15,7 @@
                                   'SecurityError');
   return getHealthThermometerDeviceWithServicesDiscovered({
       filters: [{services: ['health_thermometer']}]})
-    .then(([device]) => Promise.all([
+    .then(({device}) => Promise.all([
       assert_promise_rejects_with_message(
         device.gatt.getPrimaryService(glucose.alias), expected),
       assert_promise_rejects_with_message(

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-discovery-complete-service-not-found.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-discovery-complete-service-not-found.html
index f6978485..962c713 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-discovery-complete-service-not-found.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-discovery-complete-service-not-found.html

@@ -11,7 +11,7 @@
   return getHealthThermometerDeviceWithServicesDiscovered({
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['glucose']})
-    .then(([device]) => assert_promise_rejects_with_message(
+    .then(({device}) => assert_promise_rejects_with_message(
       device.gatt.getPrimaryService('glucose'),
       new DOMException(
         'No Services matching UUID ' + glucose.uuid + ' found in Device.',

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-garbage-collection-ran-during-error.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-garbage-collection-ran-during-error.html
index a0c3a56..ae48249 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-garbage-collection-ran-during-error.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-garbage-collection-ran-during-error.html

@@ -10,7 +10,7 @@
 promise_test(() => {
   let promise;
   return getEmptyHealthThermometerDevice()
-      .then(([device]) => {
+      .then(({device}) => {
         promise = assert_promise_rejects_with_message(
           device.gatt.getPrimaryService('health_thermometer'),
           new DOMException(

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-garbage-collection-ran-during-success.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-garbage-collection-ran-during-success.html
index a6429fb1..d275cea 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-garbage-collection-ran-during-success.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-garbage-collection-ran-during-success.html

@@ -11,7 +11,7 @@
   let promise;
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}]})
-    .then(([device]) => {
+    .then(({device}) => {
       promise = assert_promise_rejects_with_message(
         device.gatt.getPrimaryService('health_thermometer'),
         new DOMException(

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-get-different-service-after-reconnection.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-get-different-service-after-reconnection.html
index 92b3a1b8d..69411a5b 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-get-different-service-after-reconnection.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-get-different-service-after-reconnection.html

@@ -11,7 +11,7 @@
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['generic_access']})
-    .then(([device]) => {
+    .then(({device}) => {
       let services_first_connection;
       return device.gatt.getPrimaryService('health_thermometer')
         .then(services => services_first_connection = services)

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-get-same-object.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-get-same-object.html
index 3fc19c6..3783693f2 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-get-same-object.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-get-same-object.html

@@ -11,7 +11,7 @@
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['generic_access']})
-    .then(([device]) => Promise.all([
+    .then(({device}) => Promise.all([
       device.gatt.getPrimaryService('health_thermometer'),
       device.gatt.getPrimaryService('health_thermometer')]))
     .then(([services_first_call, services_second_call]) => {

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-invalid-service-name.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-invalid-service-name.html
index 591757d1..722be1a 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-invalid-service-name.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-invalid-service-name.html

@@ -9,7 +9,7 @@
 'use strict';
 promise_test(() => {
   return getHealthThermometerDevice()
-    .then(([device]) => {
+    .then(({device}) => {
       return assert_promise_rejects_with_message(
         device.gatt.getPrimaryService('wrong_name'),
         new DOMException(

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-no-permission-absent-service.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-no-permission-absent-service.html
index 04fa5a1..88362fe 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-no-permission-absent-service.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-no-permission-absent-service.html

@@ -15,7 +15,7 @@
                                   'SecurityError');
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}]})
-    .then(([device]) => Promise.all([
+    .then(({device}) => Promise.all([
       assert_promise_rejects_with_message(
         device.gatt.getPrimaryService(glucose.alias), expected),
       assert_promise_rejects_with_message(

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-no-permission-for-any-service.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-no-permission-for-any-service.html
index d02d25d..7301f20 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-no-permission-for-any-service.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-no-permission-for-any-service.html

@@ -9,7 +9,7 @@
 'use strict';
 promise_test(() => {
   return getHealthThermometerDevice({acceptAllDevices: true})
-    .then(([device]) => assert_promise_rejects_with_message(
+    .then(({device}) => assert_promise_rejects_with_message(
         device.gatt.getPrimaryService('heart_rate'),
         new DOMException('Origin is not allowed to access any service. Tip: ' +
                          'Add the service UUID to \'optionalServices\' in ' +

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-no-permission-present-service.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-no-permission-present-service.html
index 2a92858..d5e841c 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-no-permission-present-service.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-no-permission-present-service.html

@@ -15,7 +15,7 @@
                                   'SecurityError');
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}]})
-    .then(([device]) => Promise.all([
+    .then(({device}) => Promise.all([
       assert_promise_rejects_with_message(
         device.gatt.getPrimaryService(generic_access.alias), expected),
       assert_promise_rejects_with_message(

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-service-not-found.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-service-not-found.html
index ed44846d..d7290ba 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-service-not-found.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/gen-service-not-found.html

@@ -11,7 +11,7 @@
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['glucose']})
-    .then(([device]) => assert_promise_rejects_with_message(
+    .then(({device}) => assert_promise_rejects_with_message(
       device.gatt.getPrimaryService('glucose'),
       new DOMException(
         'No Services matching UUID ' + glucose.uuid + ' found in Device.',

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/service-found.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/service-found.html
index 69338c2..a544178 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/service-found.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryService/service-found.html

@@ -10,7 +10,7 @@
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['generic_access']})
-    .then(([device]) => {
+    .then(({device}) => {
       return Promise.all([
           device.gatt.getPrimaryService(generic_access.alias),
           device.gatt.getPrimaryService(generic_access.name),

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/blocklisted-services-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/blocklisted-services-with-uuid.html
index 5f72453..39d834d 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/blocklisted-services-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/blocklisted-services-with-uuid.html

@@ -10,7 +10,7 @@
   return getHIDDevice({
       filters: [{services: ['battery_service']}],
       optionalServices: ['human_interface_device']})
-    .then(([device]) => assert_promise_rejects_with_message(
+    .then(({device}) => assert_promise_rejects_with_message(
       device.gatt.getPrimaryServices('human_interface_device'),
       new DOMException('Origin is not allowed to access the service. ' +
                        'Tip: Add the service UUID to \'optionalServices\' ' +

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/blocklisted-services.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/blocklisted-services.html
index ca39ae68..f7d2592a 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/blocklisted-services.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/blocklisted-services.html

@@ -13,7 +13,7 @@
         'generic_access',
         'human_interface_device'
       ]})
-    .then(([device]) => device.gatt.getPrimaryServices())
+    .then(({device}) => device.gatt.getPrimaryServices())
     .then(services => {
       assert_equals(services.length, 2);
       let uuid_set = new Set(services.map(s => s.uuid));

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-called-before-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-called-before-with-uuid.html
index fa7df561..f5354b89 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-called-before-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-called-before-with-uuid.html

@@ -11,7 +11,7 @@
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['generic_access']})
-    .then(([device]) => {
+    .then(({device}) => {
       device.gatt.disconnect();
       return assert_promise_rejects_with_message(
         device.gatt.getPrimaryServices('health_thermometer'),

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-called-before.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-called-before.html
index 2b6213db..2c19bda2 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-called-before.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-called-before.html

@@ -11,7 +11,7 @@
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['generic_access']})
-    .then(([device]) => {
+    .then(({device}) => {
       device.gatt.disconnect();
       return assert_promise_rejects_with_message(
         device.gatt.getPrimaryServices(),

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-called-during-error-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-called-during-error-with-uuid.html
index a29f4a6f..01017a2 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-called-during-error-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-called-during-error-with-uuid.html

@@ -9,7 +9,7 @@
 'use strict';
 promise_test(() => {
   return getEmptyHealthThermometerDevice()
-    .then(([device]) => {
+    .then(({device}) => {
       let promise = assert_promise_rejects_with_message(
         device.gatt.getPrimaryServices('health_thermometer'),
         new DOMException('GATT Server is disconnected. ' +

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-called-during-error.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-called-during-error.html
index aeecb4c..1e11f89 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-called-during-error.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-called-during-error.html

@@ -9,7 +9,7 @@
 'use strict';
 promise_test(() => {
   return getEmptyHealthThermometerDevice()
-    .then(([device]) => {
+    .then(({device}) => {
       let promise = assert_promise_rejects_with_message(
         device.gatt.getPrimaryServices(),
         new DOMException('GATT Server is disconnected. ' +

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-called-during-success-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-called-during-success-with-uuid.html
index 5069b35..a6c7211 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-called-during-success-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-called-during-success-with-uuid.html

@@ -11,7 +11,7 @@
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['generic_access']})
-    .then(([device]) => {
+    .then(({device}) => {
       let promise = assert_promise_rejects_with_message(
         device.gatt.getPrimaryServices('health_thermometer'),
         new DOMException('GATT Server is disconnected. ' +

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-called-during-success.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-called-during-success.html
index 003aa676..523c668 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-called-during-success.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-called-during-success.html

@@ -11,7 +11,7 @@
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['generic_access']})
-    .then(([device]) => {
+    .then(({device}) => {
       let promise = assert_promise_rejects_with_message(
         device.gatt.getPrimaryServices(),
         new DOMException('GATT Server is disconnected. ' +

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-invalidates-objects-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-invalidates-objects-with-uuid.html
index 8450d8e0..26b6589f 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-invalidates-objects-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-invalidates-objects-with-uuid.html

@@ -11,7 +11,7 @@
   let promise;
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}]})
-    .then(([device]) => {
+    .then(({device}) => {
       return device.gatt.getPrimaryServices('health_thermometer')
         // Convert to array if necessary.
         .then(s => {

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-invalidates-objects.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-invalidates-objects.html
index 45a160a..62a1165 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-invalidates-objects.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnect-invalidates-objects.html

@@ -11,7 +11,7 @@
   let promise;
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}]})
-    .then(([device]) => {
+    .then(({device}) => {
       return device.gatt.getPrimaryServices()
         // Convert to array if necessary.
         .then(s => {

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnected-device-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnected-device-with-uuid.html
index 48474bb5..202df7ec 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnected-device-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnected-device-with-uuid.html

@@ -12,7 +12,7 @@
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['generic_access']
     })
-    .then(([device]) => assert_promise_rejects_with_message(
+    .then(({device}) => assert_promise_rejects_with_message(
       device.gatt.getPrimaryServices('health_thermometer'),
       new DOMException('GATT Server is disconnected. ' +
                        'Cannot retrieve services. ' +

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnected-device.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnected-device.html
index 9f7a190c..e327868 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnected-device.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-disconnected-device.html

@@ -12,7 +12,7 @@
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['generic_access']
     })
-    .then(([device]) => assert_promise_rejects_with_message(
+    .then(({device}) => assert_promise_rejects_with_message(
       device.gatt.getPrimaryServices(),
       new DOMException('GATT Server is disconnected. ' +
                        'Cannot retrieve services. ' +

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-discovery-complete-no-permission-absent-service-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-discovery-complete-no-permission-absent-service-with-uuid.html
index 85737f76..2d341428 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-discovery-complete-no-permission-absent-service-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-discovery-complete-no-permission-absent-service-with-uuid.html

@@ -15,7 +15,7 @@
                                   'SecurityError');
   return getHealthThermometerDeviceWithServicesDiscovered({
       filters: [{services: ['health_thermometer']}]})
-    .then(([device]) => Promise.all([
+    .then(({device}) => Promise.all([
       assert_promise_rejects_with_message(
         device.gatt.getPrimaryServices(glucose.alias), expected),
       assert_promise_rejects_with_message(

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-discovery-complete-service-not-found-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-discovery-complete-service-not-found-with-uuid.html
index 0682b61a..84e5bcef 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-discovery-complete-service-not-found-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-discovery-complete-service-not-found-with-uuid.html

@@ -11,7 +11,7 @@
   return getHealthThermometerDeviceWithServicesDiscovered({
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['glucose']})
-    .then(([device]) => assert_promise_rejects_with_message(
+    .then(({device}) => assert_promise_rejects_with_message(
       device.gatt.getPrimaryServices('glucose'),
       new DOMException(
         'No Services matching UUID ' + glucose.uuid + ' found in Device.',

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-garbage-collection-ran-during-error-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-garbage-collection-ran-during-error-with-uuid.html
index d78d076..ae626b2 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-garbage-collection-ran-during-error-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-garbage-collection-ran-during-error-with-uuid.html

@@ -10,7 +10,7 @@
 promise_test(() => {
   let promise;
   return getEmptyHealthThermometerDevice()
-      .then(([device]) => {
+      .then(({device}) => {
         promise = assert_promise_rejects_with_message(
           device.gatt.getPrimaryServices('health_thermometer'),
           new DOMException(

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-garbage-collection-ran-during-error.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-garbage-collection-ran-during-error.html
index 1beb3147..4d50a5c 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-garbage-collection-ran-during-error.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-garbage-collection-ran-during-error.html

@@ -10,7 +10,7 @@
 promise_test(() => {
   let promise;
   return getEmptyHealthThermometerDevice()
-      .then(([device]) => {
+      .then(({device}) => {
         promise = assert_promise_rejects_with_message(
           device.gatt.getPrimaryServices(),
           new DOMException(

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-garbage-collection-ran-during-success-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-garbage-collection-ran-during-success-with-uuid.html
index 23c33e0..58f9f534 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-garbage-collection-ran-during-success-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-garbage-collection-ran-during-success-with-uuid.html

@@ -11,7 +11,7 @@
   let promise;
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}]})
-    .then(([device]) => {
+    .then(({device}) => {
       promise = assert_promise_rejects_with_message(
         device.gatt.getPrimaryServices('health_thermometer'),
         new DOMException(

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-garbage-collection-ran-during-success.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-garbage-collection-ran-during-success.html
index eb9b69ee..05983aa 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-garbage-collection-ran-during-success.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-garbage-collection-ran-during-success.html

@@ -11,7 +11,7 @@
   let promise;
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}]})
-    .then(([device]) => {
+    .then(({device}) => {
       promise = assert_promise_rejects_with_message(
         device.gatt.getPrimaryServices(),
         new DOMException(

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-get-different-service-after-reconnection-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-get-different-service-after-reconnection-with-uuid.html
index cdd6a8f..6bb3339 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-get-different-service-after-reconnection-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-get-different-service-after-reconnection-with-uuid.html

@@ -11,7 +11,7 @@
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['generic_access']})
-    .then(([device]) => {
+    .then(({device}) => {
       let services_first_connection;
       return device.gatt.getPrimaryServices('health_thermometer')
         .then(services => services_first_connection = services)

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-get-different-service-after-reconnection.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-get-different-service-after-reconnection.html
index 1c7d192..230c7485 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-get-different-service-after-reconnection.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-get-different-service-after-reconnection.html

@@ -11,7 +11,7 @@
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['generic_access']})
-    .then(([device]) => {
+    .then(({device}) => {
       let services_first_connection;
       return device.gatt.getPrimaryServices()
         .then(services => services_first_connection = services)

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-get-same-object-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-get-same-object-with-uuid.html
index 0b50d54d..5f56fe0 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-get-same-object-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-get-same-object-with-uuid.html

@@ -11,7 +11,7 @@
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['generic_access']})
-    .then(([device]) => Promise.all([
+    .then(({device}) => Promise.all([
       device.gatt.getPrimaryServices('health_thermometer'),
       device.gatt.getPrimaryServices('health_thermometer')]))
     .then(([services_first_call, services_second_call]) => {

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-get-same-object.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-get-same-object.html
index 242ddf6c..1685f6f 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-get-same-object.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-get-same-object.html

@@ -11,7 +11,7 @@
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['generic_access']})
-    .then(([device]) => Promise.all([
+    .then(({device}) => Promise.all([
       device.gatt.getPrimaryServices(),
       device.gatt.getPrimaryServices()]))
     .then(([services_first_call, services_second_call]) => {

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-invalid-service-name.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-invalid-service-name.html
index f8d010b..ce17288 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-invalid-service-name.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-invalid-service-name.html

@@ -9,7 +9,7 @@
 'use strict';
 promise_test(() => {
   return getHealthThermometerDevice()
-    .then(([device]) => {
+    .then(({device}) => {
       return assert_promise_rejects_with_message(
         device.gatt.getPrimaryServices('wrong_name'),
         new DOMException(

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-no-permission-absent-service-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-no-permission-absent-service-with-uuid.html
index bbebc7a..ce19ff45 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-no-permission-absent-service-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-no-permission-absent-service-with-uuid.html

@@ -15,7 +15,7 @@
                                   'SecurityError');
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}]})
-    .then(([device]) => Promise.all([
+    .then(({device}) => Promise.all([
       assert_promise_rejects_with_message(
         device.gatt.getPrimaryServices(glucose.alias), expected),
       assert_promise_rejects_with_message(

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-no-permission-for-any-service-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-no-permission-for-any-service-with-uuid.html
index c80c983..e6e5be02 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-no-permission-for-any-service-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-no-permission-for-any-service-with-uuid.html

@@ -9,7 +9,7 @@
 'use strict';
 promise_test(() => {
   return getHealthThermometerDevice({acceptAllDevices: true})
-    .then(([device]) => assert_promise_rejects_with_message(
+    .then(({device}) => assert_promise_rejects_with_message(
         device.gatt.getPrimaryServices('heart_rate'),
         new DOMException('Origin is not allowed to access any service. Tip: ' +
                          'Add the service UUID to \'optionalServices\' in ' +

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-no-permission-for-any-service.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-no-permission-for-any-service.html
index c771e477..45306589 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-no-permission-for-any-service.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-no-permission-for-any-service.html

@@ -9,7 +9,7 @@
 'use strict';
 promise_test(() => {
   return getHealthThermometerDevice({acceptAllDevices: true})
-    .then(([device]) => assert_promise_rejects_with_message(
+    .then(({device}) => assert_promise_rejects_with_message(
         device.gatt.getPrimaryServices(),
         new DOMException('Origin is not allowed to access any service. Tip: ' +
                          'Add the service UUID to \'optionalServices\' in ' +

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-no-permission-present-service-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-no-permission-present-service-with-uuid.html
index bd8fd430..622bdaf 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-no-permission-present-service-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-no-permission-present-service-with-uuid.html

@@ -15,7 +15,7 @@
                                   'SecurityError');
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}]})
-    .then(([device]) => Promise.all([
+    .then(({device}) => Promise.all([
       assert_promise_rejects_with_message(
         device.gatt.getPrimaryServices(generic_access.alias), expected),
       assert_promise_rejects_with_message(

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-service-not-found-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-service-not-found-with-uuid.html
index cd9dce1..79c7d89 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-service-not-found-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/gen-service-not-found-with-uuid.html

@@ -11,7 +11,7 @@
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['glucose']})
-    .then(([device]) => assert_promise_rejects_with_message(
+    .then(({device}) => assert_promise_rejects_with_message(
       device.gatt.getPrimaryServices('glucose'),
       new DOMException(
         'No Services matching UUID ' + glucose.uuid + ' found in Device.',

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/services-found-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/services-found-with-uuid.html
index 73409c8..63ac04e 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/services-found-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/services-found-with-uuid.html

@@ -7,9 +7,9 @@
 <script>
 'use strict';
 promise_test(() => {
-  return getHealthThermometerDevice({
+  return getTwoHealthThermometerServicesDevice({
     filters: [{services: ['health_thermometer']}]})
-    .then(([device]) => Promise.all([
+    .then(({device}) => Promise.all([
       device.gatt.getPrimaryServices(health_thermometer.alias),
       device.gatt.getPrimaryServices(health_thermometer.name),
       device.gatt.getPrimaryServices(health_thermometer.uuid)]))

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/services-found.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/services-found.html
index 79706f6..880108c 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/services-found.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/services-found.html

@@ -7,10 +7,10 @@
 <script>
 'use strict';
 promise_test(function() {
-  return getHealthThermometerDevice({
+  return getTwoHealthThermometerServicesDevice({
       filters: [{services: ['health_thermometer']}],
       optionalServices: ['generic_access']})
-    .then(([device]) => device.gatt.getPrimaryServices())
+    .then(({device}) => device.gatt.getPrimaryServices())
     .then(services => {
       // Expect three service instances.
       assert_equals(services.length, 3);

diff --git a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/services-not-found.html b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/services-not-found.html
index 744fda8..f621118 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/services-not-found.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/server/getPrimaryServices/services-not-found.html

@@ -8,7 +8,7 @@
 'use strict';
 promise_test(() => {
   return getEmptyHealthThermometerDevice()
-    .then(([device]) => assert_promise_rejects_with_message(
+    .then(({device}) => assert_promise_rejects_with_message(
       device.gatt.getPrimaryServices(),
       new DOMException('No Services found in device.', 'NotFoundError')));
 }, 'Request for services in a device with no services. Reject with ' +

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/device-same-from-2-services.html b/third_party/WebKit/LayoutTests/bluetooth/service/device-same-from-2-services.html
index be9e995..d1ef99d6 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/device-same-from-2-services.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/device-same-from-2-services.html

@@ -7,9 +7,9 @@
 <script>
 'use strict';
 promise_test(() => {
-  return getHealthThermometerDevice({
+  return getTwoHealthThermometerServicesDevice({
      filters: [{services: ['health_thermometer']}]})
-    .then(([device]) => device.gatt.getPrimaryServices('health_thermometer'))
+    .then(({device}) => device.gatt.getPrimaryServices('health_thermometer'))
     .then(([service1, service2]) => {
       assert_equals(service1.device, service2.device);
     });

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/device-same-object.html b/third_party/WebKit/LayoutTests/bluetooth/service/device-same-object.html
index 1029c3ef..d3f4808 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/device-same-object.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/device-same-object.html

@@ -9,7 +9,7 @@
 promise_test(() => {
   return getHealthThermometerDevice({
       filters: [{services: ['health_thermometer']}]})
-    .then(([device]) => device.gatt.getPrimaryService('health_thermometer'))
+    .then(({device}) => device.gatt.getPrimaryService('health_thermometer'))
     .then(service => {
       assert_equals(service.device, service.device);
     });

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/blocklisted-characteristic.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/blocklisted-characteristic.html
deleted file mode 100644
index 29588f3..0000000
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/blocklisted-characteristic.html
+++ /dev/null

@@ -1,22 +0,0 @@
-<!DOCTYPE html>
-<script src="../../../resources/testharness.js"></script>
-<script src="../../../resources/testharnessreport.js"></script>
-<script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
-<script>
-'use strict';
-promise_test(() => {
-  return setBluetoothFakeAdapter('BlocklistTestAdapter')
-    .then(() => requestDeviceWithKeyDown({
-      filters: [{services: ['device_information']}]}))
-    .then(device => device.gatt.connect())
-    .then(gattServer => gattServer.getPrimaryService('device_information'))
-    .then(service => {
-      return assert_promise_rejects_with_message(
-        service.getCharacteristic('serial_number_string'),
-        new DOMException('getCharacteristic(s) called with blocklisted UUID. ' +
-                         'https://goo.gl/4NeimX',
-                         'SecurityError'),
-        'Serial Number String characteristic is blocklisted.');
-    });
-}, 'Serial Number String characteristic is blocklisted.');
-</script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/characteristic-not-found.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/characteristic-not-found.html
deleted file mode 100644
index dcbf0ab2..0000000
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/characteristic-not-found.html
+++ /dev/null

@@ -1,21 +0,0 @@
-<!DOCTYPE html>
-<script src="../../../resources/testharness.js"></script>
-<script src="../../../resources/testharnessreport.js"></script>
-<script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
-<script>
-'use strict';
-promise_test(() => {
-  return setBluetoothFakeAdapter('HeartRateAdapter')
-    .then(() => requestDeviceWithKeyDown({
-      filters: [{services: ['heart_rate']}],
-      optionalServices: ['generic_access']}))
-    .then(device => device.gatt.connect())
-    .then(gattServer => gattServer.getPrimaryService('generic_access'))
-    .then(service => assert_promise_rejects_with_message(
-      service.getCharacteristic('battery_level'),
-      new DOMException(
-        'No Characteristics matching UUID ' + battery_level.uuid + ' found in Service with UUID ' +
-          generic_access.uuid + '.',
-        'NotFoundError')));
-}, 'Request for absent characteristic. Reject with NotFoundError.');
-</script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/blocklisted-characteristics-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-blocklisted-characteristic.html
similarity index 72%
copy from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/blocklisted-characteristics-with-uuid.html
copy to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-blocklisted-characteristic.html
index 799d8d8..8298f96 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/blocklisted-characteristics-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-blocklisted-characteristic.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -9,10 +12,10 @@
     .then(() => requestDeviceWithKeyDown({
       filters: [{services: ['device_information']}]}))
     .then(device => device.gatt.connect())
-    .then(gattServer => gattServer.getPrimaryService('device_information'))
+    .then(gatt => gatt.getPrimaryService('device_information'))
     .then(service => {
       return assert_promise_rejects_with_message(
-        service.getCharacteristics('serial_number_string'),
+        service.getCharacteristic('serial_number_string'),
         new DOMException('getCharacteristic(s) called with blocklisted UUID. ' +
                          'https://goo.gl/4NeimX',
                          'SecurityError'),
@@ -20,4 +23,5 @@
     });
 }, 'Serial Number String characteristic is blocklisted. Should reject with ' +
    'SecurityError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-characteristic-not-found.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-characteristic-not-found.html
new file mode 100644
index 0000000..2fc5c3e
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-characteristic-not-found.html

@@ -0,0 +1,24 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
+<!DOCTYPE html>
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+<script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
+<script>
+'use strict';
+promise_test(() => {
+  return setBluetoothFakeAdapter('HeartRateAdapter')
+    .then(() => requestDeviceWithKeyDown({
+      filters: [{services: ['heart_rate']}]}))
+    .then(device => device.gatt.connect())
+    .then(gatt => gatt.getPrimaryService('heart_rate'))
+    .then(service => assert_promise_rejects_with_message(
+      service.getCharacteristic('battery_level'),
+      new DOMException(
+        'No Characteristics matching UUID ' + battery_level.uuid + ' found ' +
+        'in Service with UUID ' + heart_rate.uuid + '.',
+        'NotFoundError')));
+}, 'Request for absent characteristics with UUID. Reject with NotFoundError.');
+
+</script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/device-disconnects-before.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-device-disconnects-before.html
similarity index 70%
rename from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/device-disconnects-before.html
rename to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-device-disconnects-before.html
index 61f8e12..552d963c 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/device-disconnects-before.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-device-disconnects-before.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -11,11 +14,11 @@
       optionalServices: [request_disconnection_service_uuid]
     }))
     .then(device => device.gatt.connect())
-    .then(gattServer => {
+    .then(gatt => {
       let heart_rate_service;
-      return gattServer.getPrimaryService('heart_rate')
+      return gatt.getPrimaryService('heart_rate')
         .then(hrs => heart_rate_service = hrs)
-        .then(() => get_request_disconnection(gattServer))
+        .then(() => get_request_disconnection(gatt))
         .then(requestDisconnection => requestDisconnection())
         .then(() => assert_promise_rejects_with_message(
           heart_rate_service.getCharacteristic('heart_rate_measurement'),
@@ -24,5 +27,6 @@
             '(Re)connect first with `device.gatt.connect`.',
             'NetworkError')));
     });
-}, 'Device disconnects before getCharacteristic. Reject with NetworkError');
+}, 'Device disconnects before getCharacteristic call. Reject with NetworkError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/device-disconnects-during.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-device-disconnects-during.html
similarity index 71%
rename from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/device-disconnects-during.html
rename to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-device-disconnects-during.html
index c31f0ab..93d746e 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/device-disconnects-during.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-device-disconnects-during.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -11,11 +14,11 @@
       optionalServices: [request_disconnection_service_uuid]
     }))
     .then(device => device.gatt.connect())
-    .then(gattServer => {
+    .then(gatt => {
       let heart_rate_service;
-      return gattServer.getPrimaryService('heart_rate')
+      return gatt.getPrimaryService('heart_rate')
         .then(hrs => heart_rate_service = hrs)
-        .then(() => get_request_disconnection(gattServer))
+        .then(() => get_request_disconnection(gatt))
         .then(requestDisconnection => {
           requestDisconnection();
           return assert_promise_rejects_with_message(
@@ -26,5 +29,6 @@
               'NetworkError'));
         });
     });
-}, 'Device disconnects during getCharacteristic. Reject with NetworkError.');
+}, 'Device disconnects during getCharacteristic call. Reject with NetworkError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/device-goes-out-of-range.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-device-goes-out-of-range.html
similarity index 66%
rename from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/device-goes-out-of-range.html
rename to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-device-goes-out-of-range.html
index f0650a07f..0f4e55ab 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/device-goes-out-of-range.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-device-goes-out-of-range.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -10,14 +13,16 @@
       filters: [{services: ['heart_rate']}],
       optionalServices: ['generic_access']}))
     .then(device => device.gatt.connect())
-    .then(gattServer => gattServer.getPrimaryService('generic_access'))
+    .then(gatt => gatt.getPrimaryService('generic_access'))
     .then(service => {
       return setBluetoothFakeAdapter('EmptyAdapter')
         .then(() => assert_promise_rejects_with_message(
           service.getCharacteristic('gap.device_name'),
           new DOMException('Bluetooth Device is no longer in range.',
                            'NetworkError'),
-        'Device went out of range.'));
+          'Device went out of range.'));
     });
-}, 'Device goes out of range. Reject with NetworkError.');
+}, 'getCharacteristic called after device goes out of range. Reject with ' +
+   'NetworkError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/disconnect-called-before.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-disconnect-called-before.html
similarity index 75%
rename from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/disconnect-called-before.html
rename to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-disconnect-called-before.html
index 79fd8eb..8d0b806 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/disconnect-called-before.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-disconnect-called-before.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -9,10 +12,10 @@
     .then(() => requestDeviceWithKeyDown({
       filters: [{services: ['heart_rate']}]}))
     .then(device => device.gatt.connect())
-    .then(gattServer => {
-      return gattServer.getPrimaryService('heart_rate')
+    .then(gatt => {
+      return gatt.getPrimaryService('heart_rate')
         .then(heart_rate_service => {
-          gattServer.disconnect();
+          gatt.disconnect();
           return assert_promise_rejects_with_message(
             heart_rate_service.getCharacteristic('heart_rate_measurement'),
             new DOMException(
@@ -22,4 +25,5 @@
         });
     });
 }, 'disconnect() called before getCharacteristic. Reject with NetworkError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/disconnect-called-during.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-disconnect-called-during.html
similarity index 75%
rename from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/disconnect-called-during.html
rename to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-disconnect-called-during.html
index 0399d0ef..7cab30f 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/disconnect-called-during.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-disconnect-called-during.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -9,8 +12,8 @@
     .then(() => requestDeviceWithKeyDown({
       filters: [{services: ['heart_rate']}]}))
     .then(device => device.gatt.connect())
-    .then(gattServer => {
-      return gattServer.getPrimaryService('heart_rate')
+    .then(gatt => {
+      return gatt.getPrimaryService('heart_rate')
         .then(heart_rate_service => {
           let promise = assert_promise_rejects_with_message(
             heart_rate_service.getCharacteristic('heart_rate_measurement'),
@@ -18,9 +21,10 @@
               'GATT Server is disconnected. Cannot retrieve characteristics. ' +
               '(Re)connect first with `device.gatt.connect`.',
               'NetworkError'));
-          gattServer.disconnect();
+          gatt.disconnect();
           return promise;
         });
     });
 }, 'disconnect() called during getCharacteristic. Reject with NetworkError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/invalid-characteristic-name.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-invalid-characteristic-name.html
similarity index 77%
rename from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/invalid-characteristic-name.html
rename to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-invalid-characteristic-name.html
index fbead68..bedf50d 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/invalid-characteristic-name.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-invalid-characteristic-name.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -10,10 +13,11 @@
       filters: [{services: ['heart_rate']}],
       optionalServices: ['generic_access']}))
     .then(device => device.gatt.connect())
-    .then(gattServer => gattServer.getPrimaryService('generic_access'))
+    .then(gatt => gatt.getPrimaryService('generic_access'))
     .then(service => {
       return assert_promise_rejects_with_message(
-        service.getCharacteristic('wrong_name'), new DOMException(
+        service.getCharacteristic('wrong_name'),
+        new DOMException(
           'Failed to execute \'getCharacteristic\' on ' +
           '\'BluetoothRemoteGATTService\': Invalid Characteristic name: ' +
           '\'wrong_name\'. ' +
@@ -27,4 +31,5 @@
         'Wrong Characteristic name passed.');
     });
 }, 'Wrong Characteristic name. Reject with TypeError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/reconnect-during.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-reconnect-during.html
similarity index 72%
rename from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/reconnect-during.html
rename to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-reconnect-during.html
index 5a357a22..e4c22b8 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/reconnect-during.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-reconnect-during.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -9,8 +12,8 @@
     .then(() => requestDeviceWithKeyDown({
       filters: [{services: ['heart_rate']}]}))
     .then(device => device.gatt.connect())
-    .then(gattServer => {
-      return gattServer.getPrimaryService('heart_rate')
+    .then(gatt => {
+      return gatt.getPrimaryService('heart_rate')
         .then(service => {
           let promise = assert_promise_rejects_with_message(
             service.getCharacteristic('heart_rate_measurement'),
@@ -18,10 +21,11 @@
               'GATT Server is disconnected. Cannot retrieve characteristics. ' +
               '(Re)connect first with `device.gatt.connect`.',
               'NetworkError'));
-          gattServer.disconnect();
-          return gattServer.connect().then(() => promise);
+          gatt.disconnect();
+          return gatt.connect().then(() => promise);
         });
     });
 }, 'disconnect() and connect() called during getCharacteristic. Reject with ' +
    'NetworkError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/service-is-removed.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-service-is-removed.html
similarity index 70%
rename from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/service-is-removed.html
rename to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-service-is-removed.html
index 64cad1e..054cc6b 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/service-is-removed.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/gen-service-is-removed.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -10,7 +13,7 @@
       filters: [{services: ['heart_rate']}],
       optionalServices: ['generic_access']}))
     .then(device => device.gatt.connect())
-    .then(gattService => gattService.getPrimaryService('generic_access'))
+    .then(gatt => gatt.getPrimaryService('generic_access'))
     .then(service => {
       return setBluetoothFakeAdapter('MissingServiceHeartRateAdapter')
         .then(() => assert_promise_rejects_with_message(
@@ -19,5 +22,6 @@
                            'InvalidStateError'),
           'Service got removed.'));
     });
-}, 'Service is removed. Reject with InvalidStateError.');
+}, 'Service is removed before getCharacteristic call. Reject with InvalidStateError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/characteristics-not-found-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/characteristics-not-found-with-uuid.html
deleted file mode 100644
index c6f49d7e..0000000
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/characteristics-not-found-with-uuid.html
+++ /dev/null

@@ -1,20 +0,0 @@
-<!DOCTYPE html>
-<script src="../../../resources/testharness.js"></script>
-<script src="../../../resources/testharnessreport.js"></script>
-<script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
-<script>
-'use strict';
-promise_test(() => {
-  let expected = new DOMException(
-    'No Characteristics matching UUID ' + battery_level.uuid + ' found in Service with UUID ' +
-      heart_rate.uuid + '.',
-    'NotFoundError');
-  return setBluetoothFakeAdapter('HeartRateAdapter')
-    .then(() => requestDeviceWithKeyDown({
-      filters: [{services: ['heart_rate']}]}))
-    .then(device => device.gatt.connect())
-    .then(gattServer => gattServer.getPrimaryService('heart_rate'))
-    .then(service => assert_promise_rejects_with_message(
-      service.getCharacteristics('battery_level'), expected));
-}, 'Request for absent characteristics with UUID. Reject with NotFoundError.');
-</script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-before-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-before-with-uuid.html
deleted file mode 100644
index bb8925bb..0000000
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-before-with-uuid.html
+++ /dev/null

@@ -1,28 +0,0 @@
-<!DOCTYPE html>
-<script src="../../../resources/testharness.js"></script>
-<script src="../../../resources/testharnessreport.js"></script>
-<script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
-<script>
-'use strict';
-promise_test(() => {
-  return setBluetoothFakeAdapter('DisconnectingHeartRateAdapter')
-    .then(() => requestDeviceWithKeyDown({
-      filters: [{services: ['heart_rate']}],
-      optionalServices: [request_disconnection_service_uuid]
-    }))
-    .then(device => device.gatt.connect())
-    .then(gattServer => {
-      let heart_rate_service;
-      return gattServer.getPrimaryService('heart_rate')
-       .then(hrs => heart_rate_service = hrs)
-       .then(() => get_request_disconnection(gattServer))
-       .then(requestDisconnection => requestDisconnection())
-       .then(() => assert_promise_rejects_with_message(
-         heart_rate_service.getCharacteristics('heart_rate_measurement'),
-         new DOMException(
-           'GATT Server is disconnected. Cannot retrieve characteristics. ' +
-           '(Re)connect first with `device.gatt.connect`.',
-           'NetworkError')));
-    });
-}, 'Device disconnects before getCharacteristics. Reject with NetworkError');
-</script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-goes-out-of-range-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-goes-out-of-range-with-uuid.html
deleted file mode 100644
index 524a3b4..0000000
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-goes-out-of-range-with-uuid.html
+++ /dev/null

@@ -1,22 +0,0 @@
-<!DOCTYPE html>
-<script src="../../../resources/testharness.js"></script>
-<script src="../../../resources/testharnessreport.js"></script>
-<script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
-<script>
-'use strict';
-promise_test(() => {
-  return setBluetoothFakeAdapter('HeartRateAdapter')
-    .then(() => requestDeviceWithKeyDown({
-      filters: [{services: ['heart_rate']}]}))
-    .then(device => device.gatt.connect())
-    .then(gattServer => gattServer.getPrimaryService('heart_rate'))
-    .then(service => {
-      return setBluetoothFakeAdapter('EmptyAdapter')
-        .then(() => assert_promise_rejects_with_message(
-          service.getCharacteristics('heart_rate_measurement'),
-          new DOMException('Bluetooth Device is no longer in range.',
-                           'NetworkError'),
-          'Device went out of range.'));
-    });
-}, 'Device goes out of range with UUID. Reject with NetworkError.');
-</script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-goes-out-of-range.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-goes-out-of-range.html
deleted file mode 100644
index 810743d1..0000000
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-goes-out-of-range.html
+++ /dev/null

@@ -1,22 +0,0 @@
-<!DOCTYPE html>
-<script src="../../../resources/testharness.js"></script>
-<script src="../../../resources/testharnessreport.js"></script>
-<script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
-<script>
-'use strict';
-promise_test(() => {
-  return setBluetoothFakeAdapter('HeartRateAdapter')
-    .then(() => requestDeviceWithKeyDown({
-      filters: [{services: ['heart_rate']}]}))
-    .then(device => device.gatt.connect())
-    .then(gattServer => gattServer.getPrimaryService('heart_rate'))
-    .then(service => {
-      return setBluetoothFakeAdapter('EmptyAdapter')
-        .then(() => assert_promise_rejects_with_message(
-          service.getCharacteristics(),
-          new DOMException('Bluetooth Device is no longer in range.',
-                           'NetworkError'),
-          'Device went out of range.'));
-    });
-}, 'Device goes out of range. Reject with NetworkError.');
-</script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/blocklisted-characteristics-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-blocklisted-characteristic-with-uuid.html
similarity index 77%
rename from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/blocklisted-characteristics-with-uuid.html
rename to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-blocklisted-characteristic-with-uuid.html
index 799d8d8..dec3ef40 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/blocklisted-characteristics-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-blocklisted-characteristic-with-uuid.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -9,7 +12,7 @@
     .then(() => requestDeviceWithKeyDown({
       filters: [{services: ['device_information']}]}))
     .then(device => device.gatt.connect())
-    .then(gattServer => gattServer.getPrimaryService('device_information'))
+    .then(gatt => gatt.getPrimaryService('device_information'))
     .then(service => {
       return assert_promise_rejects_with_message(
         service.getCharacteristics('serial_number_string'),
@@ -20,4 +23,5 @@
     });
 }, 'Serial Number String characteristic is blocklisted. Should reject with ' +
    'SecurityError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-characteristic-not-found-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-characteristic-not-found-with-uuid.html
new file mode 100644
index 0000000..5519358
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-characteristic-not-found-with-uuid.html

@@ -0,0 +1,24 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
+<!DOCTYPE html>
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+<script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
+<script>
+'use strict';
+promise_test(() => {
+  return setBluetoothFakeAdapter('HeartRateAdapter')
+    .then(() => requestDeviceWithKeyDown({
+      filters: [{services: ['heart_rate']}]}))
+    .then(device => device.gatt.connect())
+    .then(gatt => gatt.getPrimaryService('heart_rate'))
+    .then(service => assert_promise_rejects_with_message(
+      service.getCharacteristics('battery_level'),
+      new DOMException(
+        'No Characteristics matching UUID ' + battery_level.uuid + ' found ' +
+        'in Service with UUID ' + heart_rate.uuid + '.',
+        'NotFoundError')));
+}, 'Request for absent characteristics with UUID. Reject with NotFoundError.');
+
+</script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-before.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-device-disconnects-before-with-uuid.html
similarity index 65%
copy from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-before.html
copy to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-device-disconnects-before-with-uuid.html
index e5725ee8..7ac9238 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-before.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-device-disconnects-before-with-uuid.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -11,18 +14,19 @@
       optionalServices: [request_disconnection_service_uuid]
     }))
     .then(device => device.gatt.connect())
-    .then(gattServer => {
+    .then(gatt => {
       let heart_rate_service;
-      return gattServer.getPrimaryService('heart_rate')
+      return gatt.getPrimaryService('heart_rate')
         .then(hrs => heart_rate_service = hrs)
-        .then(() => get_request_disconnection(gattServer))
+        .then(() => get_request_disconnection(gatt))
         .then(requestDisconnection => requestDisconnection())
         .then(() => assert_promise_rejects_with_message(
-          heart_rate_service.getCharacteristics(),
+          heart_rate_service.getCharacteristics('heart_rate_measurement'),
           new DOMException(
             'GATT Server is disconnected. Cannot retrieve characteristics. ' +
             '(Re)connect first with `device.gatt.connect`.',
             'NetworkError')));
     });
-}, 'Device disconnects before getCharacteristics. Reject with NetworkError');
+}, 'Device disconnects before getCharacteristics call. Reject with NetworkError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-before.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-device-disconnects-before.html
similarity index 70%
rename from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-before.html
rename to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-device-disconnects-before.html
index e5725ee8..bd5ef78 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-before.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-device-disconnects-before.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -11,11 +14,11 @@
       optionalServices: [request_disconnection_service_uuid]
     }))
     .then(device => device.gatt.connect())
-    .then(gattServer => {
+    .then(gatt => {
       let heart_rate_service;
-      return gattServer.getPrimaryService('heart_rate')
+      return gatt.getPrimaryService('heart_rate')
         .then(hrs => heart_rate_service = hrs)
-        .then(() => get_request_disconnection(gattServer))
+        .then(() => get_request_disconnection(gatt))
         .then(requestDisconnection => requestDisconnection())
         .then(() => assert_promise_rejects_with_message(
           heart_rate_service.getCharacteristics(),
@@ -24,5 +27,6 @@
             '(Re)connect first with `device.gatt.connect`.',
             'NetworkError')));
     });
-}, 'Device disconnects before getCharacteristics. Reject with NetworkError');
+}, 'Device disconnects before getCharacteristics call. Reject with NetworkError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-during-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-device-disconnects-during-with-uuid.html
similarity index 71%
rename from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-during-with-uuid.html
rename to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-device-disconnects-during-with-uuid.html
index f54cc3e..fb26653 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-during-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-device-disconnects-during-with-uuid.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -11,11 +14,11 @@
       optionalServices: [request_disconnection_service_uuid]
     }))
     .then(device => device.gatt.connect())
-    .then(gattServer => {
+    .then(gatt => {
       let heart_rate_service;
-      return gattServer.getPrimaryService('heart_rate')
+      return gatt.getPrimaryService('heart_rate')
         .then(hrs => heart_rate_service = hrs)
-        .then(() => get_request_disconnection(gattServer))
+        .then(() => get_request_disconnection(gatt))
         .then(requestDisconnection => {
           requestDisconnection();
           return assert_promise_rejects_with_message(
@@ -26,5 +29,6 @@
               'NetworkError'));
         });
     });
-}, 'Device disconnects during getCharacteristics. Reject with NetworkError.');
+}, 'Device disconnects during getCharacteristics call. Reject with NetworkError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-during.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-device-disconnects-during.html
similarity index 71%
rename from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-during.html
rename to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-device-disconnects-during.html
index 40b74d9bb..d8d2125 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/device-disconnects-during.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-device-disconnects-during.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -11,11 +14,11 @@
       optionalServices: [request_disconnection_service_uuid]
     }))
     .then(device => device.gatt.connect())
-    .then(gattServer => {
+    .then(gatt => {
       let heart_rate_service;
-      return gattServer.getPrimaryService('heart_rate')
+      return gatt.getPrimaryService('heart_rate')
         .then(hrs => heart_rate_service = hrs)
-        .then(() => get_request_disconnection(gattServer))
+        .then(() => get_request_disconnection(gatt))
         .then(requestDisconnection => {
           requestDisconnection();
           return assert_promise_rejects_with_message(
@@ -26,5 +29,6 @@
               'NetworkError'));
         });
     });
-}, 'Device disconnects during getCharacteristics. Reject with NetworkError.');
+}, 'Device disconnects during getCharacteristics call. Reject with NetworkError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/device-goes-out-of-range.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-device-goes-out-of-range-with-uuid.html
similarity index 61%
copy from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/device-goes-out-of-range.html
copy to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-device-goes-out-of-range-with-uuid.html
index f0650a07f..f68a44d18 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/device-goes-out-of-range.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-device-goes-out-of-range-with-uuid.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -10,14 +13,16 @@
       filters: [{services: ['heart_rate']}],
       optionalServices: ['generic_access']}))
     .then(device => device.gatt.connect())
-    .then(gattServer => gattServer.getPrimaryService('generic_access'))
+    .then(gatt => gatt.getPrimaryService('generic_access'))
     .then(service => {
       return setBluetoothFakeAdapter('EmptyAdapter')
         .then(() => assert_promise_rejects_with_message(
-          service.getCharacteristic('gap.device_name'),
+          service.getCharacteristics('gap.device_name'),
           new DOMException('Bluetooth Device is no longer in range.',
                            'NetworkError'),
-        'Device went out of range.'));
+          'Device went out of range.'));
     });
-}, 'Device goes out of range. Reject with NetworkError.');
+}, 'getCharacteristics called after device goes out of range. Reject with ' +
+   'NetworkError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/device-goes-out-of-range.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-device-goes-out-of-range.html
similarity index 62%
copy from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/device-goes-out-of-range.html
copy to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-device-goes-out-of-range.html
index f0650a07f..3d46c24 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/device-goes-out-of-range.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-device-goes-out-of-range.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -10,14 +13,16 @@
       filters: [{services: ['heart_rate']}],
       optionalServices: ['generic_access']}))
     .then(device => device.gatt.connect())
-    .then(gattServer => gattServer.getPrimaryService('generic_access'))
+    .then(gatt => gatt.getPrimaryService('generic_access'))
     .then(service => {
       return setBluetoothFakeAdapter('EmptyAdapter')
         .then(() => assert_promise_rejects_with_message(
-          service.getCharacteristic('gap.device_name'),
+          service.getCharacteristics(),
           new DOMException('Bluetooth Device is no longer in range.',
                            'NetworkError'),
-        'Device went out of range.'));
+          'Device went out of range.'));
     });
-}, 'Device goes out of range. Reject with NetworkError.');
+}, 'getCharacteristics called after device goes out of range. Reject with ' +
+   'NetworkError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-before-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-disconnect-called-before-with-uuid.html
similarity index 75%
rename from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-before-with-uuid.html
rename to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-disconnect-called-before-with-uuid.html
index cffa248..f989ea1 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-before-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-disconnect-called-before-with-uuid.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -9,10 +12,10 @@
     .then(() => requestDeviceWithKeyDown({
       filters: [{services: ['heart_rate']}]}))
     .then(device => device.gatt.connect())
-    .then(gattServer => {
-      return gattServer.getPrimaryService('heart_rate')
+    .then(gatt => {
+      return gatt.getPrimaryService('heart_rate')
         .then(heart_rate_service => {
-          gattServer.disconnect();
+          gatt.disconnect();
           return assert_promise_rejects_with_message(
             heart_rate_service.getCharacteristics('heart_rate_measurement'),
             new DOMException(
@@ -22,4 +25,5 @@
         });
     });
 }, 'disconnect() called before getCharacteristics. Reject with NetworkError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-before.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-disconnect-called-before.html
similarity index 74%
rename from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-before.html
rename to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-disconnect-called-before.html
index f635fc3..00a84496 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-before.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-disconnect-called-before.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -9,10 +12,10 @@
     .then(() => requestDeviceWithKeyDown({
       filters: [{services: ['heart_rate']}]}))
     .then(device => device.gatt.connect())
-    .then(gattServer => {
-      return gattServer.getPrimaryService('heart_rate')
+    .then(gatt => {
+      return gatt.getPrimaryService('heart_rate')
         .then(heart_rate_service => {
-          gattServer.disconnect();
+          gatt.disconnect();
           return assert_promise_rejects_with_message(
             heart_rate_service.getCharacteristics(),
             new DOMException(
@@ -22,4 +25,5 @@
         });
     });
 }, 'disconnect() called before getCharacteristics. Reject with NetworkError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-during-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-disconnect-called-during-with-uuid.html
similarity index 75%
rename from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-during-with-uuid.html
rename to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-disconnect-called-during-with-uuid.html
index 8e8da3a..1f2057c8 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-during-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-disconnect-called-during-with-uuid.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -9,8 +12,8 @@
     .then(() => requestDeviceWithKeyDown({
       filters: [{services: ['heart_rate']}]}))
     .then(device => device.gatt.connect())
-    .then(gattServer => {
-      return gattServer.getPrimaryService('heart_rate')
+    .then(gatt => {
+      return gatt.getPrimaryService('heart_rate')
         .then(heart_rate_service => {
           let promise = assert_promise_rejects_with_message(
             heart_rate_service.getCharacteristics('heart_rate_measurement'),
@@ -18,9 +21,10 @@
               'GATT Server is disconnected. Cannot retrieve characteristics. ' +
               '(Re)connect first with `device.gatt.connect`.',
               'NetworkError'));
-          gattServer.disconnect();
+          gatt.disconnect();
           return promise;
         });
     });
 }, 'disconnect() called during getCharacteristics. Reject with NetworkError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-during.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-disconnect-called-during.html
similarity index 75%
rename from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-during.html
rename to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-disconnect-called-during.html
index 4cda3b1..f54b2c1 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/disconnect-called-during.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-disconnect-called-during.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -9,8 +12,8 @@
     .then(() => requestDeviceWithKeyDown({
       filters: [{services: ['heart_rate']}]}))
     .then(device => device.gatt.connect())
-    .then(gattServer => {
-      return gattServer.getPrimaryService('heart_rate')
+    .then(gatt => {
+      return gatt.getPrimaryService('heart_rate')
         .then(heart_rate_service => {
           let promise = assert_promise_rejects_with_message(
             heart_rate_service.getCharacteristics(),
@@ -18,9 +21,10 @@
               'GATT Server is disconnected. Cannot retrieve characteristics. ' +
               '(Re)connect first with `device.gatt.connect`.',
               'NetworkError'));
-          gattServer.disconnect();
+          gatt.disconnect();
           return promise;
         });
     });
 }, 'disconnect() called during getCharacteristics. Reject with NetworkError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/invalid-characteristic-name.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-invalid-characteristic-name.html
similarity index 74%
rename from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/invalid-characteristic-name.html
rename to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-invalid-characteristic-name.html
index b207c20..3b1c15a1 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/invalid-characteristic-name.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-invalid-characteristic-name.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -10,10 +13,11 @@
       filters: [{services: ['heart_rate']}],
       optionalServices: ['generic_access']}))
     .then(device => device.gatt.connect())
-    .then(gattServer => gattServer.getPrimaryService('generic_access'))
+    .then(gatt => gatt.getPrimaryService('generic_access'))
     .then(service => {
       return assert_promise_rejects_with_message(
-        service.getCharacteristics('wrong_name'), new DOMException(
+        service.getCharacteristics('wrong_name'),
+        new DOMException(
           'Failed to execute \'getCharacteristics\' on ' +
           '\'BluetoothRemoteGATTService\': Invalid Characteristic name: ' +
           '\'wrong_name\'. ' +
@@ -26,5 +30,6 @@
           'TypeError'),
         'Wrong Characteristic name passed.');
     });
-}, 'Invalid Characteristic name. Reject with TypeError.');
+}, 'Wrong Characteristic name. Reject with TypeError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/reconnect-during-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-reconnect-during-with-uuid.html
similarity index 72%
rename from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/reconnect-during-with-uuid.html
rename to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-reconnect-during-with-uuid.html
index 07086af..1a684ac 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/reconnect-during-with-uuid.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-reconnect-during-with-uuid.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -9,8 +12,8 @@
     .then(() => requestDeviceWithKeyDown({
       filters: [{services: ['heart_rate']}]}))
     .then(device => device.gatt.connect())
-    .then(gattServer => {
-      return gattServer.getPrimaryService('heart_rate')
+    .then(gatt => {
+      return gatt.getPrimaryService('heart_rate')
         .then(service => {
           let promise = assert_promise_rejects_with_message(
             service.getCharacteristics('heart_rate_measurement'),
@@ -18,10 +21,11 @@
               'GATT Server is disconnected. Cannot retrieve characteristics. ' +
               '(Re)connect first with `device.gatt.connect`.',
               'NetworkError'));
-          gattServer.disconnect();
-          return gattServer.connect().then(() => promise);
+          gatt.disconnect();
+          return gatt.connect().then(() => promise);
         });
     });
 }, 'disconnect() and connect() called during getCharacteristics. Reject with ' +
    'NetworkError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/reconnect-during.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-reconnect-during.html
similarity index 71%
rename from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/reconnect-during.html
rename to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-reconnect-during.html
index 1afecaa..0018212 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/reconnect-during.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-reconnect-during.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -9,8 +12,8 @@
     .then(() => requestDeviceWithKeyDown({
       filters: [{services: ['heart_rate']}]}))
     .then(device => device.gatt.connect())
-    .then(gattServer => {
-      return gattServer.getPrimaryService('heart_rate')
+    .then(gatt => {
+      return gatt.getPrimaryService('heart_rate')
         .then(service => {
           let promise = assert_promise_rejects_with_message(
             service.getCharacteristics(),
@@ -18,10 +21,11 @@
               'GATT Server is disconnected. Cannot retrieve characteristics. ' +
               '(Re)connect first with `device.gatt.connect`.',
               'NetworkError'));
-          gattServer.disconnect();
-          return gattServer.connect().then(() => promise);
+          gatt.disconnect();
+          return gatt.connect().then(() => promise);
         });
     });
 }, 'disconnect() and connect() called during getCharacteristics. Reject with ' +
    'NetworkError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/service-is-removed.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-service-is-removed-with-uuid.html
similarity index 65%
copy from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/service-is-removed.html
copy to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-service-is-removed-with-uuid.html
index 64cad1e..02164968 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/service-is-removed.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-service-is-removed-with-uuid.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -10,14 +13,15 @@
       filters: [{services: ['heart_rate']}],
       optionalServices: ['generic_access']}))
     .then(device => device.gatt.connect())
-    .then(gattService => gattService.getPrimaryService('generic_access'))
+    .then(gatt => gatt.getPrimaryService('generic_access'))
     .then(service => {
       return setBluetoothFakeAdapter('MissingServiceHeartRateAdapter')
         .then(() => assert_promise_rejects_with_message(
-          service.getCharacteristic('gap.device_name'),
+          service.getCharacteristics('gap.device_name'),
           new DOMException('GATT Service no longer exists.',
                            'InvalidStateError'),
           'Service got removed.'));
     });
-}, 'Service is removed. Reject with InvalidStateError.');
+}, 'Service is removed before getCharacteristics call. Reject with InvalidStateError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/service-is-removed.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-service-is-removed.html
similarity index 66%
copy from third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/service-is-removed.html
copy to third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-service-is-removed.html
index 64cad1e..e2f4567b 100644
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristic/service-is-removed.html
+++ b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/gen-service-is-removed.html

@@ -1,7 +1,10 @@
+<!-- Generated by //third_party/WebKit/LayoutTests/bluetooth/generate.py -->
 <!DOCTYPE html>
 <script src="../../../resources/testharness.js"></script>
 <script src="../../../resources/testharnessreport.js"></script>
 <script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
+<script src="../../../resources/bluetooth/web-bluetooth-test.js"></script>
+<script src="../../../resources/mojo-helpers.js"></script>
 <script>
 'use strict';
 promise_test(() => {
@@ -10,14 +13,15 @@
       filters: [{services: ['heart_rate']}],
       optionalServices: ['generic_access']}))
     .then(device => device.gatt.connect())
-    .then(gattService => gattService.getPrimaryService('generic_access'))
+    .then(gatt => gatt.getPrimaryService('generic_access'))
     .then(service => {
       return setBluetoothFakeAdapter('MissingServiceHeartRateAdapter')
         .then(() => assert_promise_rejects_with_message(
-          service.getCharacteristic('gap.device_name'),
+          service.getCharacteristics(),
           new DOMException('GATT Service no longer exists.',
                            'InvalidStateError'),
           'Service got removed.'));
     });
-}, 'Service is removed. Reject with InvalidStateError.');
+}, 'Service is removed before getCharacteristics call. Reject with InvalidStateError.');
+
 </script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/service-is-removed-with-uuid.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/service-is-removed-with-uuid.html
deleted file mode 100644
index 6d468a7c..0000000
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/service-is-removed-with-uuid.html
+++ /dev/null

@@ -1,22 +0,0 @@
-<!DOCTYPE html>
-<script src="../../../resources/testharness.js"></script>
-<script src="../../../resources/testharnessreport.js"></script>
-<script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
-<script>
-'use strict';
-promise_test(() => {
-  return setBluetoothFakeAdapter('HeartRateAdapter')
-    .then(() => requestDeviceWithKeyDown({
-      filters: [{services: ['heart_rate']}]}))
-    .then(device => device.gatt.connect())
-    .then(gattService => gattService.getPrimaryService('heart_rate'))
-    .then(service => {
-      return setBluetoothFakeAdapter('MissingServiceHeartRateAdapter')
-        .then(() => assert_promise_rejects_with_message(
-          service.getCharacteristics('heart_rate_measurement'),
-          new DOMException('GATT Service no longer exists.',
-                           'InvalidStateError'),
-          'Service got removed.'));
-    });
-}, 'Service is removed. Reject with InvalidStateError.');
-</script>

diff --git a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/service-is-removed.html b/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/service-is-removed.html
deleted file mode 100644
index 314f2ca..0000000
--- a/third_party/WebKit/LayoutTests/bluetooth/service/getCharacteristics/service-is-removed.html
+++ /dev/null

@@ -1,22 +0,0 @@
-<!DOCTYPE html>
-<script src="../../../resources/testharness.js"></script>
-<script src="../../../resources/testharnessreport.js"></script>
-<script src="../../../resources/bluetooth/bluetooth-helpers.js"></script>
-<script>
-'use strict';
-promise_test(() => {
-  return setBluetoothFakeAdapter('HeartRateAdapter')
-    .then(() => requestDeviceWithKeyDown({
-      filters: [{services: ['heart_rate']}]}))
-    .then(device => device.gatt.connect())
-    .then(gattService => gattService.getPrimaryService('heart_rate'))
-    .then(service => {
-      return setBluetoothFakeAdapter('MissingServiceHeartRateAdapter')
-        .then(() => assert_promise_rejects_with_message(
-          service.getCharacteristics(),
-          new DOMException('GATT Service no longer exists.',
-                           'InvalidStateError'),
-          'Service got removed.'));
-    });
-}, 'Service is removed. Reject with InvalidStateError.');
-</script>

diff --git a/third_party/WebKit/LayoutTests/fast/events/wheel/wheelevent-basic.html b/third_party/WebKit/LayoutTests/fast/events/wheel/wheelevent-basic.html
index e4fbfce9..56a3742d 100644
--- a/third_party/WebKit/LayoutTests/fast/events/wheel/wheelevent-basic.html
+++ b/third_party/WebKit/LayoutTests/fast/events/wheel/wheelevent-basic.html

@@ -25,7 +25,7 @@
     testDiv.addEventListener('wheel', wheelHandler);
     if (window.eventSender) {
         eventSender.mouseMoveTo(testDiv.offsetLeft + 5, testDiv.offsetTop + 5);
-        eventSender.mouseScrollBy(-1, -2, false, false, 0, true, 'phaseBegan');
+        eventSender.mouseScrollBy(-1, -2);
         var positive = "deltaX > 0 && deltaY > 0";
         var correct = "deltaX == testDiv.scrollLeft && deltaY == testDiv.scrollTop";
         shouldBecomeEqual(positive + " && " + correct , "true", finishJSTest);

diff --git a/third_party/WebKit/LayoutTests/fast/events/wheel/wheelevent-ctrl.html b/third_party/WebKit/LayoutTests/fast/events/wheel/wheelevent-ctrl.html
index 581c776b..94f1428 100644
--- a/third_party/WebKit/LayoutTests/fast/events/wheel/wheelevent-ctrl.html
+++ b/third_party/WebKit/LayoutTests/fast/events/wheel/wheelevent-ctrl.html

@@ -23,7 +23,7 @@
     debug('With ctrl modifier set and canScroll set to be false');
     wheelEventCount = 0;
     eventSender.mouseMoveTo(testDiv.offsetLeft + 5, testDiv.offsetTop + 5);
-    eventSender.mouseScrollBy(0, scrollAmount, false, true, "ctrlKey", false , "phaseBegan");
+    eventSender.mouseScrollBy(0, scrollAmount, false, true, "ctrlKey", false);
     shouldBe("wheelEventCount", "1");
     shouldEvaluateTo("deltaY", expectedDeltaY);
     shouldBeTrue("ctrlKey");
@@ -32,7 +32,7 @@
     debug('Without ctrl and canScroll set to be default true');
     wheelEventCount = 0;
     eventSender.mouseMoveTo(testDiv.offsetLeft + 5, testDiv.offsetTop + 5);
-    eventSender.mouseScrollBy(0, scrollAmount, false, true, 0, true, "phaseChanged");
+    eventSender.mouseScrollBy(0, scrollAmount, false, true);
     shouldBe("wheelEventCount", "1");
     shouldEvaluateTo("deltaY", expectedDeltaY);
     shouldBeFalse("ctrlKey");
@@ -45,7 +45,7 @@
     debug('With ctrl modifier set and canScroll set to be false');
     wheelEventCount = 0;
     eventSender.mouseMoveTo(testDiv.offsetLeft + 5, testDiv.offsetTop + 5);
-    eventSender.mouseScrollBy(0, scrollAmount, false, true, "ctrlKey", false, "phaseChanged");
+    eventSender.mouseScrollBy(0, scrollAmount, false, true, "ctrlKey", false);
     shouldBe("wheelEventCount", "1");
     shouldEvaluateTo("deltaY", expectedDeltaY);
     shouldBeTrue("ctrlKey");
@@ -54,7 +54,7 @@
     debug('With ctrl modifier set and canScroll set to be true');
     wheelEventCount = 0;
     eventSender.mouseMoveTo(testDiv.offsetLeft + 5, testDiv.offsetTop + 5);
-    eventSender.mouseScrollBy(0, scrollAmount, false, true, "ctrlKey", true, "phaseChanged");
+    eventSender.mouseScrollBy(0, scrollAmount, false, true, "ctrlKey", true);
     shouldBe("wheelEventCount", "1");
     shouldEvaluateTo("deltaY", expectedDeltaY);
     shouldBeTrue("ctrlKey");
@@ -63,7 +63,7 @@
     debug('Now without ctrl and canScroll set to be default true');
     wheelEventCount = 0;
     eventSender.mouseMoveTo(testDiv.offsetLeft + 5, testDiv.offsetTop + 5);
-    eventSender.mouseScrollBy(0, scrollAmount, false, true, 0, true, "phaseChanged");
+    eventSender.mouseScrollBy(0, scrollAmount, false, true);
     shouldBe("wheelEventCount", "1");
     shouldEvaluateTo("deltaY", expectedDeltaY);
     shouldBeFalse("ctrlKey");

diff --git a/third_party/WebKit/LayoutTests/fast/events/wheel/wheelevent-in-scrolling-div.html b/third_party/WebKit/LayoutTests/fast/events/wheel/wheelevent-in-scrolling-div.html
index d5a2cf7..3c091fc 100644
--- a/third_party/WebKit/LayoutTests/fast/events/wheel/wheelevent-in-scrolling-div.html
+++ b/third_party/WebKit/LayoutTests/fast/events/wheel/wheelevent-in-scrolling-div.html

@@ -16,7 +16,7 @@
 
                     // EventSender uses 40px per tick.
                     eventSender.mouseMoveTo(overflowElement.offsetLeft + 5, overflowElement.offsetTop + 5);
-                    eventSender.mouseScrollBy(-2.5, -5, false, true, 0, true, "phaseBegan");
+                    eventSender.mouseScrollBy(-2.5, -5);
                 }
 
                 div = document.getElementById("overflow");

diff --git a/third_party/WebKit/LayoutTests/fast/events/wheel/wheelevent-in-text-node.html b/third_party/WebKit/LayoutTests/fast/events/wheel/wheelevent-in-text-node.html
index a54f5f9..bb8cb39 100644
--- a/third_party/WebKit/LayoutTests/fast/events/wheel/wheelevent-in-text-node.html
+++ b/third_party/WebKit/LayoutTests/fast/events/wheel/wheelevent-in-text-node.html

@@ -9,7 +9,7 @@
             var div = document.querySelector('div');
             if (window.eventSender) {
                 eventSender.mouseMoveTo(div.offsetLeft + 5, div.offsetTop + 5);
-                eventSender.mouseScrollBy(0, 120, false, true, 0, true, "phaseBegan");
+                eventSender.mouseScrollBy(0,120);
             } else {
                 debug("FAIL: This test requires window.eventSender.");
                 finishJSTest();

diff --git a/third_party/WebKit/LayoutTests/fast/events/wheel/wheelevent-mousewheel-interaction.html b/third_party/WebKit/LayoutTests/fast/events/wheel/wheelevent-mousewheel-interaction.html
index 69b8b33..ac46109 100644
--- a/third_party/WebKit/LayoutTests/fast/events/wheel/wheelevent-mousewheel-interaction.html
+++ b/third_party/WebKit/LayoutTests/fast/events/wheel/wheelevent-mousewheel-interaction.html

@@ -10,7 +10,7 @@
     div.addEventListener('mousewheel', mouseWheelHandler);
     if (window.eventSender) {
         eventSender.mouseMoveTo(div.offsetLeft + 5, div.offsetTop + 5);
-        eventSender.mouseScrollBy(10, 20, false, true, 0, true, "phaseBegan");
+        eventSender.mouseScrollBy(10, 20);
         finishJSTest();
     } else {
         debug("FAIL: This test requires window.eventSender.");

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/async-xhr-json-mime-type.html b/third_party/WebKit/LayoutTests/http/tests/inspector/network/async-xhr-json-mime-type.html
index f84e6dbb..c49cc83 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/async-xhr-json-mime-type.html
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/async-xhr-json-mime-type.html

@@ -35,10 +35,9 @@
             reportRequest(request)
             request.requestContent().then(step3);
         }
-        function step3()
+        function step3(content)
         {
-            var request = lastRequest();
-            InspectorTest.addResult("request.content: " + request.content);
+            InspectorTest.addResult("request.content: " + content);
 
             InspectorTest.addConsoleSniffer(step4);
             InspectorTest.evaluateInPage("loadIframe('" + encodedContentType + "')");
@@ -49,10 +48,9 @@
             reportRequest(request);
             request.requestContent().then(step5);
         }
-        function step5()
+        function step5(content)
         {
-            var request = lastRequest();
-            InspectorTest.addResult("request.content: " + request.content);
+            InspectorTest.addResult("request.content: " + content);
 
             callback();
         }

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/cached-resource-destroyed-moved-to-storage.html b/third_party/WebKit/LayoutTests/http/tests/inspector/network/cached-resource-destroyed-moved-to-storage.html
index 7b54cfb3..08de7cc 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/cached-resource-destroyed-moved-to-storage.html
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/cached-resource-destroyed-moved-to-storage.html

@@ -40,13 +40,13 @@
     }
 
     var originalContentLength;
-    function step3()
+    function step3(content)
     {
         InspectorTest.addResult(imageRequest.url());
         InspectorTest.addResult("request.type: " + imageRequest.resourceType());
-        InspectorTest.addResult("request.content.length after requesting content: " + imageRequest.content.length);
-        originalContentLength = imageRequest.content.length;
-        InspectorTest.assertTrue(imageRequest.content.length > 0, "No content before destroying CachedResource.");
+        InspectorTest.addResult("request.content.length after requesting content: " + content.length);
+        originalContentLength = content.length;
+        InspectorTest.assertTrue(content.length > 0, "No content before destroying CachedResource.");
 
         InspectorTest.addResult("Releasing cached resource.");
         // Loading another image to the same image element so that the original image cached resource is released.
@@ -68,15 +68,14 @@
     function step6()
     {
         // Re-request content now that CachedResource should have been destroyed.
-        delete imageRequest._content;
+        delete imageRequest._contentData;
         imageRequest.requestContent().then(step7);
     }
 
-    function step7()
+    function step7(content)
     {
-        InspectorTest.addResult("request.content.length after requesting content: " + imageRequest.content.length);
-        originalContentLength = imageRequest.content.length;
-        InspectorTest.assertTrue(imageRequest.content.length === originalContentLength, "Content changed after cached resource was destroyed");
+        InspectorTest.addResult("request.content.length after requesting content: " + content.length);
+        InspectorTest.assertTrue(content.length === originalContentLength, "Content changed after cached resource was destroyed");
         InspectorTest.completeTest();
     }
 }

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/cached-resource-destroyed-too-big-discarded.html b/third_party/WebKit/LayoutTests/http/tests/inspector/network/cached-resource-destroyed-too-big-discarded.html
index f6946652..609b40b3 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/cached-resource-destroyed-too-big-discarded.html
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/cached-resource-destroyed-too-big-discarded.html

@@ -42,12 +42,12 @@
         imageRequest.requestContent().then(step3);
     }
 
-    function step3()
+    function step3(content)
     {
         InspectorTest.addResult(imageRequest.url());
         InspectorTest.addResult("request.type: " + imageRequest.resourceType());
-        InspectorTest.addResult("request.content.length after requesting content: " + imageRequest.content.length);
-        InspectorTest.assertTrue(imageRequest.content.length > 0, "No content before destroying CachedResource.");
+        InspectorTest.addResult("request.content.length after requesting content: " + content.length);
+        InspectorTest.assertTrue(content.length > 0, "No content before destroying CachedResource.");
 
         InspectorTest.addResult("Releasing cached resource.");
         // Loading another image to the same image element so that the original image cached resource is released.
@@ -71,14 +71,14 @@
     function step6()
     {
         // Re-request content now that CachedResource should have been destroyed.
-        delete imageRequest._content;
+        delete imageRequest._contentData;
         imageRequest.requestContent().then(step7);
     }
 
-    function step7()
+    function step7(content)
     {
-        InspectorTest.addResult("request.content after requesting content: " + imageRequest.content);
-        InspectorTest.assertTrue(!imageRequest.content, "Content available after CachedResource was destroyed.");
+        InspectorTest.addResult("request.content after requesting content: " + content);
+        InspectorTest.assertTrue(!content, "Content available after CachedResource was destroyed.");
         InspectorTest.completeTest();
     }
 }

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/json-preview.html b/third_party/WebKit/LayoutTests/http/tests/inspector/network/json-preview.html
index 5e869df7..412b372d 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/json-preview.html
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/json-preview.html

@@ -10,21 +10,18 @@
         InspectorTest.addResult("Creating a NetworkRequest with type: " + type);
         var request = new SDK.NetworkRequest(SDK.targetManager.mainTarget(), 0, 'http://localhost');
         request.mimeType = type;
-        request._content = '{"number": 42}';
+        request._contentData = Promise.resolve({ error: null, content: '{"number": 42}', encoded: false });
         return request;
     }
 
-    function testPreviewer(request)
+    async function testPreviewer(request)
     {
-        return new Promise(function(done) {
-            var previewView = new Network.RequestPreviewView(request, null);
-
-            previewView._createPreviewView(function(previewer) {
-                InspectorTest.addResult("Its previewer is searchable: " + (previewer && previewer instanceof UI.SearchableView));
-                InspectorTest.addResult("Its previewer is the JSON previewer: " + (previewer && previewer._searchProvider && previewer._searchProvider instanceof Network.JSONView));
-                done();
-            });
-        });
+        var previewView = new Network.RequestPreviewView(request, null);
+        var previewerPromise = InspectorTest.addSnifferPromise(previewView, "_previewViewHandledForTest");
+        previewView.wasShown();
+        var previewer = await previewerPromise;
+        InspectorTest.addResult("Its previewer is searchable: " + (previewer && previewer instanceof UI.SearchableView));
+        InspectorTest.addResult("Its previewer is the JSON previewer: " + (previewer && previewer._searchProvider && previewer._searchProvider instanceof Network.JSONView));
     }
 
     function testType(contentType, callback)

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-cachedresources-with-same-urls.html b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-cachedresources-with-same-urls.html
index cd84aed..e5bbb35 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-cachedresources-with-same-urls.html
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-cachedresources-with-same-urls.html

@@ -30,33 +30,22 @@
     InspectorTest.recordNetwork();
     InspectorTest.evaluateInPage("loadImages()");
 
-    function step2(msg)
+    async function step2(msg)
     {
         // inspector-test.js appears in network panel occasionally in Safari on
         // Mac, so checking two last requests.
         var requests = InspectorTest.networkRequests();
         var request1 = requests[requests.length - 2];
         var request2 = requests[requests.length - 1];
-        request1.requestContent().then(contentLoaded);
-        request2.requestContent().then(contentLoaded);
-    }
 
-    var contentLoadedCount = 0;
-    function contentLoaded()
-    {
-        if (++contentLoadedCount !== 2)
-            return;
-
-        var requests = InspectorTest.networkRequests();
-        var request1 = requests[requests.length - 2];
-        var request2 = requests[requests.length - 1];
+        var request1Content = await request1.requestContent()
+        var request2Content = await request2.requestContent();
 
         InspectorTest.addResult(request1.url());
         InspectorTest.addResult(request2.url());
-        InspectorTest.assertTrue(request1.content !== request2.content);
+        InspectorTest.assertTrue(request1Content !== request2Content);
         InspectorTest.completeTest();
     }
-
 }
 </script>
 </head>

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-choose-preview-view-expected.txt b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-choose-preview-view-expected.txt
index ad135fd4..020f2907 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-choose-preview-view-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-choose-preview-view-expected.txt

@@ -1,47 +1,38 @@
 Tests to make sure the proper view is used for the data that is received in network panel.
 
-
-Running: testSimpleJSON
+Simple JSON
 Creating a NetworkRequest with mimeType: application/json
 Content: [533,3223]
 Its previewer type: SearchableView > widget vbox json-view
-
-Running: testMimeJSON
+MIME JSON
 Creating a NetworkRequest with mimeType: application/vnd.document+json
 Content: {foo0foo: 123}
 Its previewer type: SearchableView > widget vbox json-view
-
-Running: testSimpleXML
+Simple XML
 Creating a NetworkRequest with mimeType: text/xml
 Content: <bar><foo/></bar>
 Its previewer type: SearchableView > widget shadow-xml-view source-code
-
-Running: testXMLMimeButJSON
+XML MIME But JSON
 Creating a NetworkRequest with mimeType: text/xml
 Content: {foo0: 'barr', 'barr': 'fooo'}
 Its previewer type: SearchableView > widget vbox json-view
-
-Running: testXMLWithUnknownMime
+XML With Unknown MIME
 Creating a NetworkRequest with mimeType: text/foobar
 Content: <bar><foo/></bar>
 Its previewer type: SearchableView > widget vbox
-
-Running: testXMLWithError500
+XML With Error 500
 Creating a NetworkRequest with mimeType: text/xml
 Content: <bar><foo/></bar>
 Its previewer type: SearchableView > widget shadow-xml-view source-code
-
-Running: testUnknownMimeTextWithError500
+Unknown MIME Text With Error 500
 Creating a NetworkRequest with mimeType: text/foobar
 Content: Foo Bar
 Its previewer type: SearchableView > widget vbox
-
-Running: testBinaryImageFile
+Binary Image File
 Creating a NetworkRequest with mimeType: image/png
 Content: Bin**NULL**ary File**NULL****NULL**
 Its previewer type: SearchableView > widget vbox
-
-Running: testBinaryBlankImageFile
+Binary Blank Image File
 Creating a NetworkRequest with mimeType: image/png
 Content: 
 Its previewer type: widget vbox empty-view-scroller

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-choose-preview-view.html b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-choose-preview-view.html
index 307641d6..df6ec9c 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-choose-preview-view.html
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-choose-preview-view.html

@@ -3,7 +3,7 @@
 <script src="../inspector-test.js"></script>
 <script src="../network-test.js"></script>
 <script>
-function test()
+async function test()
 {
     function createNetworkRequest(mimeType, content, statusCode)
     {
@@ -11,7 +11,7 @@
         var request = new SDK.NetworkRequest(SDK.targetManager.mainTarget(), 0, 'http://localhost');
         InspectorTest.addResult("Content: " + content.replace(/\0/g, "**NULL**"));
         request.mimeType = mimeType;
-        request._content = content;
+        request._contentData = Promise.resolve({error: null, content: content, encoded: false});
         if (statusCode !== undefined)
             request.statusCode = statusCode;
         return request;
@@ -26,59 +26,43 @@
         return previewer.contentElement.className;
     }
 
-    function testPreviewer(request, callback)
-    {
-        var previewView = new Network.RequestPreviewView(request, new Network.RequestResponseView(request));
-
-        previewView._createPreviewView(function(previewer) {
-            InspectorTest.addResult("Its previewer type: " + getViewName(previewer));
-            callback();
-        });
-    }
-
-    function testType(contentType, content, statusCode, callback)
+    async function testPreviewer(contentType, content, statusCode)
     {
         var request = createNetworkRequest(contentType, content, statusCode);
-        testPreviewer(request, callback);
-    }
-    InspectorTest.runTestSuite([
-        function testSimpleJSON(next)
-        {
-            testType("application/json", "[533,3223]", 200, next);
-        },
-        function testMimeJSON(next)
-        {
-            testType("application/vnd.document+json", "{foo0foo: 123}", 200, next);
-        },
-        function testSimpleXML(next)
-        {
-            testType("text/xml", "<bar><foo/></bar>", 200, next);
-        },
-        function testXMLMimeButJSON(next)
-        {
-            testType("text/xml", "{foo0: 'barr', 'barr': 'fooo'}", 200, next);
-        },
-        function testXMLWithUnknownMime(next)
-        {
-            testType("text/foobar", "<bar><foo/></bar>", 200, next);
-        },
-        function testXMLWithError500(next)
-        {
-            testType("text/xml", "<bar><foo/></bar>", 500, next);
-        },
-        function testUnknownMimeTextWithError500(next)
-        {
-            testType("text/foobar", "Foo Bar", 500, next);
-        },
-        function testBinaryImageFile(next)
-        {
-            testType("image/png", "Bin\0ary\1 File\0\0", 200, next);
-        },
-        function testBinaryBlankImageFile(next)
-        {
-            testType("image/png", "", 200, next);
-        },
-    ]);
+        var previewView = new Network.RequestPreviewView(request, new Network.RequestResponseView(request));
+        var previewerPromise = InspectorTest.addSnifferPromise(previewView, "_previewViewHandledForTest");
+        previewView.wasShown();
+        InspectorTest.addResult("Its previewer type: " + getViewName(await previewerPromise));
+    } 
+
+    InspectorTest.addResult("Simple JSON");
+    await testPreviewer("application/json", "[533,3223]", 200);
+
+    InspectorTest.addResult("MIME JSON");
+    await testPreviewer("application/vnd.document+json", "{foo0foo: 123}", 200);
+
+    InspectorTest.addResult("Simple XML");
+    await testPreviewer("text/xml", "<bar><foo/></bar>", 200);
+
+    InspectorTest.addResult("XML MIME But JSON");
+    await testPreviewer("text/xml", "{foo0: 'barr', 'barr': 'fooo'}", 200);
+
+    InspectorTest.addResult("XML With Unknown MIME");
+    await testPreviewer("text/foobar", "<bar><foo/></bar>", 200);
+
+    InspectorTest.addResult("XML With Error 500");
+    await testPreviewer("text/xml", "<bar><foo/></bar>", 500);
+
+    InspectorTest.addResult("Unknown MIME Text With Error 500");
+    await testPreviewer("text/foobar", "Foo Bar", 500);
+
+    InspectorTest.addResult("Binary Image File");
+    await testPreviewer("image/png", "Bin\0ary\1 File\0\0", 200);
+
+    InspectorTest.addResult("Binary Blank Image File");
+    await testPreviewer("image/png", "", 200);
+
+    InspectorTest.completeTest();
 }
 </script>
 </head>

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-content-replacement-xhr.html b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-content-replacement-xhr.html
index ee4bf4f..afeee38 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-content-replacement-xhr.html
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-content-replacement-xhr.html

@@ -35,9 +35,10 @@
             return callback();
         InspectorTest.addResult(request.url());
 
-        function contentLoaded()
+        async function contentLoaded(content)
         {
-            InspectorTest.addResult("resource.content: " + request.content);
+
+            InspectorTest.addResult("resource.content: " + content);
             callback();
         }
 

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-cyrillic-xhr.html b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-cyrillic-xhr.html
index 090b113..0736fa7 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-cyrillic-xhr.html
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-cyrillic-xhr.html

@@ -11,9 +11,9 @@
             return callback();
         InspectorTest.addResult(request.url());
 
-        function contentLoaded()
+        function contentLoaded(content)
         {
-            InspectorTest.addResult("resource.content: " + request.content);
+            InspectorTest.addResult("resource.content: " + content);
             callback();
         }
 

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-disable-cache-memory.html b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-disable-cache-memory.html
index 2d0477c..23157e0 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-disable-cache-memory.html
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-disable-cache-memory.html

@@ -29,13 +29,7 @@
         function scriptLoaded()
         {
             var request = InspectorTest.networkRequests().pop();
-            request.requestContent().then(contentLoaded);
-        }
-
-        function contentLoaded()
-        {
-            var request = InspectorTest.networkRequests().pop();
-            callback(request.content);
+            request.requestContent().then(callback);
         }
     }
 

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-disable-cache-xhrs.html b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-disable-cache-xhrs.html
index b73e4ae..187ad30 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-disable-cache-xhrs.html
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-disable-cache-xhrs.html

@@ -23,7 +23,7 @@
         InspectorTest.makeSimpleXHR("GET", "resources/resource.php?random=1&cached=1", true, step4);
     }
 
-    function step4(msg)
+    async function step4(msg)
     {
         // inspector-test.js appears in network panel occasionally in Safari on
         // Mac, so checking two last resources.
@@ -31,27 +31,16 @@
         var request1 = requests[requests.length - 3];
         var request2 = requests[requests.length - 2];
         var request3 = requests[requests.length - 1];
-        request1.requestContent().then(contentLoaded);
-        request2.requestContent().then(contentLoaded);
-        request3.requestContent().then(contentLoaded);
-    }
 
-    var contentLoadedCount = 0;
-    function contentLoaded()
-    {
-        if (++contentLoadedCount !== 3)
-            return;
-
-        var requests = InspectorTest.networkRequests();
-        var request1 = requests[requests.length - 3];
-        var request2 = requests[requests.length - 2];
-        var request3 = requests[requests.length - 1];
+        var request1Content = await request1.requestContent();
+        var request2Content = await request2.requestContent();
+        var request3Content = await request3.requestContent();
 
         InspectorTest.addResult(request1.url());
         InspectorTest.addResult(request2.url());
         InspectorTest.addResult(request3.url());
-        InspectorTest.assertTrue(request1.content === request2.content, "First and second resources are equal");
-        InspectorTest.assertTrue(request2.content !== request3.content, "Second and third resources differ");
+        InspectorTest.assertTrue(request1Content === request2Content, "First and second resources are equal");
+        InspectorTest.assertTrue(request2Content !== request3Content, "Second and third resources differ");
         InspectorTest.NetworkAgent.setCacheDisabled(false).then(step5);
     }
 

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-disabling-check-no-memory-leak.html b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-disabling-check-no-memory-leak.html
index c2ae3ca..b22cfb2 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-disabling-check-no-memory-leak.html
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-disabling-check-no-memory-leak.html

@@ -12,10 +12,17 @@
     {
         await InspectorTest.NetworkAgent.disable();
         var request1 = InspectorTest.networkRequests().pop();
-        await request1.requestContent();
-        var request1 = InspectorTest.networkRequests().pop();
-        InspectorTest.addResult("resource.content after disabling network domain: " + request1.content);
-        await InspectorTest.NetworkAgent.enable();
+        request1.requestContent().then(step4);
+    }
+
+    function step4(content)
+    {
+        InspectorTest.addResult("resource.content after disabling network domain: " + content);
+        InspectorTest.NetworkAgent.enable().then(step5);
+    }
+
+    function step5()
+    {
         InspectorTest.completeTest();
     }
 }

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-empty-xhr.html b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-empty-xhr.html
index cf735ed..b002244 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-empty-xhr.html
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-empty-xhr.html

@@ -11,9 +11,9 @@
             return callback();
         InspectorTest.addResult(request.url());
 
-        function contentLoaded()
+        function contentLoaded(content)
         {
-            InspectorTest.addResult("resource.content: " + request.content);
+            InspectorTest.addResult("resource.content: " + content);
             callback();
         }
 

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-eventsource-expected.txt b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-eventsource-expected.txt
index 0996e0dd..7c7af33 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-eventsource-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-eventsource-expected.txt

@@ -3,7 +3,6 @@
 [page] got event: hello
 http://127.0.0.1:8000/inspector/network/resources/event-stream.asis
 resource.type: eventsource
-resource.content before requesting content: undefined
 resource.content after requesting content: data: hello
 
 

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-eventsource.html b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-eventsource.html
index cf513ec0..9e2d7979 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-eventsource.html
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-eventsource.html

@@ -29,21 +29,15 @@
     InspectorTest.recordNetwork();
     InspectorTest.callFunctionInPageAsync("receiveEvent").then(step2);
 
-    function step2()
+    async function step2()
     {
         var request1 = InspectorTest.networkRequests().pop();
         InspectorTest.addResult(request1.url());
         InspectorTest.addResult("resource.type: " + request1.resourceType());
-        InspectorTest.addResult("resource.content before requesting content: " + request1.content);
         InspectorTest.assertTrue(!request1.failed, "Resource loading failed.");
-        request1.requestContent().then(step3);
-    }
 
-    function step3()
-    {
-        var request1 = InspectorTest.networkRequests().pop();
-        InspectorTest.addResult("resource.content after requesting content: " + request1.content);
-
+        var content = await request1.requestContent();
+        InspectorTest.addResult("resource.content after requesting content: " + content);
         InspectorTest.completeTest();
     }
 }

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-fetch-expected.txt b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-fetch-expected.txt
index a285648..8ca676f 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-fetch-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-fetch-expected.txt

@@ -2,6 +2,5 @@
 
 http://127.0.0.1:8000/inspector/network/resources/resource.php
 resource.type: fetch
-resource.content before requesting content: undefined
 resource.content after requesting content: Hello world
 

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-fetch.html b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-fetch.html
index 7890181..f15a6499 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-fetch.html
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-fetch.html

@@ -8,22 +8,20 @@
     InspectorTest.recordNetwork();
     InspectorTest.makeFetch("resources/resource.php", {}, step2);
 
-    function step2()
+    async function step2()
     {
         var request1 = InspectorTest.networkRequests().pop();
         InspectorTest.addResult(request1.url());
         InspectorTest.addResult("resource.type: " + request1.resourceType());
-        InspectorTest.addResult("resource.content before requesting content: " + request1.content);
         InspectorTest.assertTrue(!request1.failed, "Resource loading failed.");
-        request1.requestContent().then(step3);
+
+        var content = await request1.requestContent();
+        InspectorTest.addResult("resource.content after requesting content: " + content);
+        InspectorTest.completeTest();
     }
 
     function step3()
     {
-        var request1 = InspectorTest.networkRequests().pop();
-        InspectorTest.addResult("resource.content after requesting content: " + request1.content);
-
-        InspectorTest.completeTest();
     }
 }
 </script>

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-iframe-load-and-delete-expected.txt b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-iframe-load-and-delete-expected.txt
index 2455c843..1b9ca409 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-iframe-load-and-delete-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-iframe-load-and-delete-expected.txt

@@ -3,10 +3,8 @@
 
 http://127.0.0.1:8000/inspector/network/resources/resource.php
 resource.type: document
-resource.content before requesting content: undefined
 resource.content after requesting content: Hello world
 http://127.0.0.1:8000/inspector/network/resources/resource.php
 resource.type: document
-resource.content before requesting content: undefined
 resource.content after requesting content: Hello world
 

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-iframe-load-and-delete.html b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-iframe-load-and-delete.html
index 782fe5e..763ce4c 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-iframe-load-and-delete.html
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-iframe-load-and-delete.html

@@ -42,34 +42,20 @@
     InspectorTest.addConsoleSniffer(step2);
     InspectorTest.evaluateInPage("loadIframe()");
 
-    function step2()
+    async function step2()
     {
         var requests = InspectorTest.networkRequests();
         var request1 = requests[requests.length - 2];
         InspectorTest.addResult(request1.url());
         InspectorTest.addResult("resource.type: " + request1.resourceType());
-        InspectorTest.addResult("resource.content before requesting content: " + request1.content);
-        request1.requestContent().then(step3);
-    }
-
-    function step3()
-    {
-        var requests = InspectorTest.networkRequests();
-        var request1 = requests[requests.length - 2];
-        InspectorTest.addResult("resource.content after requesting content: " + request1.content);
+        var content = await request1.requestContent();
+        InspectorTest.addResult("resource.content after requesting content: " + content);
 
         var request2 = requests[requests.length - 1];
         InspectorTest.addResult(request2.url());
         InspectorTest.addResult("resource.type: " + request2.resourceType());
-        InspectorTest.addResult("resource.content before requesting content: " + request2.content);
-        request2.requestContent().then(step4);
-    }
-
-    function step4()
-    {
-        var requests = InspectorTest.networkRequests();
-        var request2 = requests[requests.length - 1];
-        InspectorTest.addResult("resource.content after requesting content: " + request2.content);
+        var content = await request2.requestContent();
+        InspectorTest.addResult("resource.content after requesting content: " + content);
 
         InspectorTest.completeTest();
     }

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-image-404-expected.txt b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-image-404-expected.txt
index 474b38e..e56ad81e 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-image-404-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-image-404-expected.txt

@@ -4,7 +4,6 @@
 Bug 84265
 http://127.0.0.1:8000/inspector/network/resources/404.php
 resource.type: image
-resource.content before requesting content: undefined
 resources count = 1
 http://127.0.0.1:8000/inspector/network/resources/404.php
 resource.content after requesting content: 404 - resource was not found.

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-image-404.html b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-image-404.html
index 6721c37f..2405766c 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-image-404.html
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-image-404.html

@@ -26,19 +26,19 @@
         var request1 = InspectorTest.networkRequests().pop();
         InspectorTest.addResult(request1.url());
         InspectorTest.addResult("resource.type: " + request1.resourceType());
-        InspectorTest.addResult("resource.content before requesting content: " + request1.content);
         InspectorTest.assertTrue(!request1.failed, "Resource loading failed.");
         request1.requestContent().then(step3);
     }
 
-    function step3()
+    async function step3()
     {
         var requests = InspectorTest.networkRequests();
         requests.sort(function(a, b) {return a.url().localeCompare(b.url());});
         InspectorTest.addResult("resources count = " + requests.length);
         for (i = 0; i < requests.length; i++) {
             InspectorTest.addResult(requests[i].url());
-            InspectorTest.addResult("resource.content after requesting content: " + requests[i].content);
+            var content = await requests[i].requestContent();
+            InspectorTest.addResult("resource.content after requesting content: " + content);
         }
 
 

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-imported-resource-content-expected.txt b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-imported-resource-content-expected.txt
index 75b163a9..1d67ded8 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-imported-resource-content-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-imported-resource-content-expected.txt

@@ -2,7 +2,6 @@
 
 http://127.0.0.1:8000/inspector/network/resources/imported.html
 resource.type: other
-resource.content before requesting content: undefined
 resource.content after requesting content: Imported Resource
 
 

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-imported-resource-content.html b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-imported-resource-content.html
index 10b44ce..dbe2d29 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-imported-resource-content.html
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-imported-resource-content.html

@@ -21,15 +21,13 @@
         var request = InspectorTest.networkRequests().pop();
         InspectorTest.addResult(request.url());
         InspectorTest.addResult("resource.type: " + request.resourceType());
-        InspectorTest.addResult("resource.content before requesting content: " + request.content);
         InspectorTest.assertTrue(!request.failed, "Resource loading failed.");
         request.requestContent().then(step3);
     }
 
-    function step3()
+    function step3(content)
     {
-        var request = InspectorTest.networkRequests().pop();
-        InspectorTest.addResult("resource.content after requesting content: " + request.content);
+        InspectorTest.addResult("resource.content after requesting content: " + content);
         InspectorTest.completeTest();
     }
 }

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-async-double.html b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-async-double.html
index e1a199c..b5c2bb6 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-async-double.html
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-async-double.html

@@ -23,7 +23,7 @@
     InspectorTest.evaluateInPage("makeXHRForJSONArguments(\"" + jsonArgs1 + "\"); makeXHRForJSONArguments(\"" + jsonArgs2 + "\")");
 
     var totalXHRs = 2;
-    function step2(msg)
+    async function step2(msg)
     {
         if (msg.messageText.indexOf("XHR loaded") === -1 || (--totalXHRs)) {
             InspectorTest.addConsoleSniffer(step2);
@@ -33,21 +33,12 @@
         var requests = InspectorTest.networkRequests();
         var request1 = requests[requests.length - 2];
         var request2 = requests[requests.length - 1];
-        request1.requestContent().then(step3);
-        request2.requestContent().then(step3);
-    }
+        var request1Content = await request1.requestContent();
+        var request2Content = await request2.requestContent();
 
-    var toLoad = 2;
-    function step3()
-    {
-        if (--toLoad)
-            return;
-        var requests = InspectorTest.networkRequests();
-        var request1 = requests[requests.length - 2];
-        var request2 = requests[requests.length - 1];
-        InspectorTest.addResult("resource1.content: " + request1.content);
-        InspectorTest.addResult("resource2.content: " + request2.content);
-        InspectorTest.assertTrue(request1.content === 'request1' && request2.content === 'request2');
+        InspectorTest.addResult("resource1.content: " + request1Content);
+        InspectorTest.addResult("resource2.content: " + request2Content);
+        InspectorTest.assertTrue(request1Content === 'request1' && request2Content === 'request2');
         InspectorTest.completeTest();
     }
 }

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-async-expected.txt b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-async-expected.txt
index 2d157c1..6e0a299 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-async-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-async-expected.txt

@@ -3,6 +3,5 @@
 
 http://127.0.0.1:8000/inspector/network/resources/resource.php
 resource.type: xhr
-resource.content before requesting content: undefined
 resource.content after requesting content: Hello world
 

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-async-response-type-blob-expected.txt b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-async-response-type-blob-expected.txt
index 1309bbd..5599a4c 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-async-response-type-blob-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-async-response-type-blob-expected.txt

@@ -4,6 +4,5 @@
 http://127.0.0.1:8000/inspector/network/resources/resource.php
 resource.type: xhr
 resource.size: 11
-resource.content before requesting content: undefined
 resource.content after requesting content: Hello world
 

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-async-response-type-blob.html b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-async-response-type-blob.html
index d0d7a31..f793ef9 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-async-response-type-blob.html
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-async-response-type-blob.html

@@ -14,15 +14,13 @@
         InspectorTest.addResult(request1.url());
         InspectorTest.addResult("resource.type: " + request1.resourceType());
         InspectorTest.addResult("resource.size: " + request1.resourceSize);
-        InspectorTest.addResult("resource.content before requesting content: " + request1.content);
         InspectorTest.assertTrue(!request1.failed, "Resource loading failed.");
         request1.requestContent().then(step3);
     }
 
-    function step3()
+    function step3(content)
     {
-        var request1 = InspectorTest.networkRequests().pop();
-        InspectorTest.addResult("resource.content after requesting content: " + request1.content);
+        InspectorTest.addResult("resource.content after requesting content: " + content);
 
         InspectorTest.completeTest();
     }

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-async.html b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-async.html
index 50dcc7c2..1ca02bf 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-async.html
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-async.html

@@ -13,15 +13,13 @@
         var request1 = InspectorTest.networkRequests().pop();
         InspectorTest.addResult(request1.url());
         InspectorTest.addResult("resource.type: " + request1.resourceType());
-        InspectorTest.addResult("resource.content before requesting content: " + request1.content);
         InspectorTest.assertTrue(!request1.failed, "Resource loading failed.");
         request1.requestContent().then(step3);
     }
 
-    function step3()
+    function step3(content)
     {
-        var request1 = InspectorTest.networkRequests().pop();
-        InspectorTest.addResult("resource.content after requesting content: " + request1.content);
+        InspectorTest.addResult("resource.content after requesting content: " + content);
 
         InspectorTest.completeTest();
     }

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-binary-content.html b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-binary-content.html
index 0c4517e5f..18fbe31 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-binary-content.html
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-binary-content.html

@@ -9,20 +9,17 @@
     InspectorTest.recordNetwork();
     InspectorTest.makeSimpleXHR("GET", "resources/binary.data", true, step2);
 
-    function step2()
+    async function step2()
     {
         var request = InspectorTest.networkRequests().pop();
         InspectorTest.addResult("request.type: " + request.resourceType());
         InspectorTest.addResult("request.mimeType: " + request.mimeType);
-        request.requestContent().then(step3);
-    }
 
-    function step3()
-    {
-        var request = InspectorTest.networkRequests().pop();
-        InspectorTest.addResult("request.contentEncoded: " + request.contentEncoded);
-        InspectorTest.addResult("request.content: " + request.content);
-        var raw = window.atob(request.content);
+        var contentData = await request.contentData();
+
+        InspectorTest.addResult("request.contentEncoded: " + contentData.encoded);
+        InspectorTest.addResult("request.content: " + contentData.content);
+        var raw = window.atob(contentData.content);
         var bytes = [];
         for (var i = 0; i < raw.length; ++i)
             bytes.push(raw.charCodeAt(i));

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-sync-expected.txt b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-sync-expected.txt
index 0831374..ff9d7172 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-sync-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-sync-expected.txt

@@ -4,6 +4,5 @@
 
 http://127.0.0.1:8000/inspector/network/resources/resource.php
 resource.type: xhr
-resource.content before requesting content: undefined
 resource.content after requesting content: Hello world
 

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-sync.html b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-sync.html
index f40371e..cfed3a3c 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-sync.html
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/network/network-xhr-sync.html

@@ -13,15 +13,13 @@
         var request1 = InspectorTest.networkRequests().pop();
         InspectorTest.addResult(request1.url());
         InspectorTest.addResult("resource.type: " + request1.resourceType());
-        InspectorTest.addResult("resource.content before requesting content: " + request1.content);
         InspectorTest.assertTrue(!request1.failed, "Resource loading failed.");
         request1.requestContent().then(step3);
     }
 
-    function step3()
+    function step3(content)
     {
-        var request1 = InspectorTest.networkRequests().pop();
-        InspectorTest.addResult("resource.content after requesting content: " + request1.content);
+        InspectorTest.addResult("resource.content after requesting content: " + content);
 
         InspectorTest.completeTest();
     }

diff --git a/third_party/WebKit/LayoutTests/overflow/overflow-position-001.html b/third_party/WebKit/LayoutTests/overflow/overflow-position-001.html
new file mode 100644
index 0000000..2076b33c
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/overflow/overflow-position-001.html

@@ -0,0 +1,54 @@
+<!doctype html>
+<script src="../resources/testharness.js"></script>
+<script src="../resources/testharnessreport.js"></script>
+<style>
+#container {
+  writing-mode: horizontal-tb;
+  overflow: scroll;
+  position: relative;
+  width: 200px;
+  height: 100px;
+  box-shadow: 0px 0px 12px 0px black;
+}
+#target {
+  width: 100%;
+  height: 100%;
+  background-color: rgba(0, 255, 0, 0.3);
+}
+</style>
+<p>Overflow: child position and size</p>
+<div id="container">
+  <div id="target">foo</div>
+</div>
+<script>
+
+var container = document.querySelector('#container');
+var target = document.querySelector('#target');
+
+function getTargetOffset() {
+  var containerRect = container.getBoundingClientRect();
+  var targetRect = target.getBoundingClientRect();
+  return {
+    top: targetRect.top - containerRect.top,
+    left: targetRect.left - containerRect.left
+  }
+}
+
+test(function() {
+  assert_equals(target.offsetWidth, container.clientWidth, "width");
+  assert_equals(target.offsetHeight, container.clientHeight, "height");
+  var targetOffset = getTargetOffset();
+  assert_equals(targetOffset.top, container.clientTop, "top");
+  assert_equals(targetOffset.left, container.clientLeft, "left");
+}, "position with scrollbars");
+
+test(function() {
+  container.style.direction = "rtl";
+  assert_equals(target.offsetWidth, container.clientWidth, "width");
+  assert_equals(target.offsetHeight, container.clientHeight, "height");
+  var targetOffset = getTargetOffset();
+  assert_equals(targetOffset.top, container.clientTop, "top");
+  assert_equals(targetOffset.left, container.clientLeft, "left");
+}, "position with scrollbars + rtl");
+</script>
+

diff --git a/third_party/WebKit/LayoutTests/overflow/overflow-position-002.html b/third_party/WebKit/LayoutTests/overflow/overflow-position-002.html
new file mode 100644
index 0000000..a47666a8
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/overflow/overflow-position-002.html

@@ -0,0 +1,54 @@
+<!doctype html>
+<script src="../resources/testharness.js"></script>
+<script src="../resources/testharnessreport.js"></script>
+<style>
+#container {
+  writing-mode: vertical-lr;
+  overflow: scroll;
+  position: relative;
+  width: 200px;
+  height: 100px;
+  box-shadow: 0px 0px 12px 0px black;
+}
+#target {
+  width: 100%;
+  height: 100%;
+  background-color: rgba(0, 255, 0, 0.3);
+}
+</style>
+<p>Overflow: child position and size + writing-mode: vertical-lr</p>
+<div id="container">
+  <div id="target">foo</div>
+</div>
+<script>
+
+var container = document.querySelector('#container');
+var target = document.querySelector('#target');
+
+function getTargetOffset() {
+  var containerRect = container.getBoundingClientRect();
+  var targetRect = target.getBoundingClientRect();
+  return {
+    top: targetRect.top - containerRect.top,
+    left: targetRect.left - containerRect.left
+  }
+}
+
+test(function() {
+  assert_equals(target.offsetWidth, container.clientWidth, "width");
+  assert_equals(target.offsetHeight, container.clientHeight, "height");
+  var targetOffset = getTargetOffset();
+  assert_equals(targetOffset.top, container.clientTop, "top");
+  assert_equals(targetOffset.left, container.clientLeft, "left");
+}, "position with scrollbars");
+
+test(function() {
+  container.style.direction = "rtl";
+  assert_equals(target.offsetWidth, container.clientWidth, "width");
+  assert_equals(target.offsetHeight, container.clientHeight, "height");
+  var targetOffset = getTargetOffset();
+  assert_equals(targetOffset.top, container.clientTop, "top");
+  assert_equals(targetOffset.left, container.clientLeft, "left");
+}, "position with scrollbars + rtl");
+</script>
+

diff --git a/third_party/WebKit/LayoutTests/overflow/overflow-position-003.html b/third_party/WebKit/LayoutTests/overflow/overflow-position-003.html
new file mode 100644
index 0000000..6b958129
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/overflow/overflow-position-003.html

@@ -0,0 +1,54 @@
+<!doctype html>
+<script src="../resources/testharness.js"></script>
+<script src="../resources/testharnessreport.js"></script>
+<style>
+#container {
+  writing-mode: vertical-rl;
+  overflow: scroll;
+  position: relative;
+  width: 200px;
+  height: 100px;
+  box-shadow: 0px 0px 12px 0px black;
+}
+#target {
+  width: 100%;
+  height: 100%;
+  background-color: rgba(0, 255, 0, 0.3);
+}
+</style>
+<p>Overflow: child position and size + writing-mode: vertical-rl</p>
+<div id="container">
+  <div id="target">foo</div>
+</div>
+<script>
+
+var container = document.querySelector('#container');
+var target = document.querySelector('#target');
+
+function getTargetOffset() {
+  var containerRect = container.getBoundingClientRect();
+  var targetRect = target.getBoundingClientRect();
+  return {
+    top: targetRect.top - containerRect.top,
+    left: targetRect.left - containerRect.left
+  }
+}
+
+test(function() {
+  assert_equals(target.offsetWidth, container.clientWidth, "width");
+  assert_equals(target.offsetHeight, container.clientHeight, "height");
+  var targetOffset = getTargetOffset();
+  assert_equals(targetOffset.top, container.clientTop, "top");
+  assert_equals(targetOffset.left, container.clientLeft, "left");
+}, "position with scrollbars");
+
+test(function() {
+  container.style.direction = "rtl";
+  assert_equals(target.offsetWidth, container.clientWidth, "width");
+  assert_equals(target.offsetHeight, container.clientHeight, "height");
+  var targetOffset = getTargetOffset();
+  assert_equals(targetOffset.top, container.clientTop, "top");
+  assert_equals(targetOffset.left, container.clientLeft, "left");
+}, "position with scrollbars + rtl");
+</script>
+

diff --git a/third_party/WebKit/LayoutTests/resources/bluetooth/bluetooth-helpers.js b/third_party/WebKit/LayoutTests/resources/bluetooth/bluetooth-helpers.js
index 86581b8..fbff635 100644
--- a/third_party/WebKit/LayoutTests/resources/bluetooth/bluetooth-helpers.js
+++ b/third_party/WebKit/LayoutTests/resources/bluetooth/bluetooth-helpers.js

@@ -456,26 +456,94 @@
      })]));
 }
 
-// Returns a BluetoothDevice discovered using |options| and its
-// corresponding FakePeripheral.
+// Returns an object containing a BluetoothDevice discovered using |options|,
+// its corresponding FakePeripheral and FakeRemoteGATTServices.
 // The simulated device is called 'Health Thermometer' it has two known service
-// UUIDs: 'generic_access' and 'health_thermometer'. The device has been
-// connected to and its services are ready to be discovered.
+// UUIDs: 'generic_access' and 'health_thermometer' which correspond to two
+// services with the same UUIDs. The device has been connected to and its
+// services are ready to be discovered.
 // TODO(crbug.com/719816): Add characteristics and descriptors.
 function getHealthThermometerDevice(options) {
+  let device;
+  let fake_peripheral;
+  let fake_generic_access;
+  let fake_health_thermometer;
+
+  return getConnectedHealthThermometerDevice(options)
+    .then(result => {
+      ({
+        device,
+        fake_peripheral,
+        fake_generic_access,
+        fake_health_thermometer,
+      } = result);
+    })
+    .then(() => fake_peripheral.setNextGATTDiscoveryResponse({
+      code: HCI_SUCCESS}))
+    .then(() => ({
+      device: device,
+      fake_peripheral: fake_peripheral,
+      fake_generic_access: fake_generic_access,
+      fake_health_thermometer1: fake_health_thermometer,
+    }));
+}
+
+// Similar to getHealthThermometerDevice except that the peripheral has
+// two 'health_thermometer' services.
+function getTwoHealthThermometerServicesDevice(options) {
+  let device;
+  let fake_peripheral;
+  let fake_generic_access;
+  let fake_health_thermometer1;
+  let fake_health_thermometer2;
+
+  return getConnectedHealthThermometerDevice(options)
+    .then(result => {
+      ({
+        device,
+        fake_peripheral,
+        fake_generic_access,
+        fake_health_thermometer: fake_health_thermometer1,
+      } = result);
+    })
+    .then(() => fake_peripheral.addFakeService({uuid: 'health_thermometer'}))
+    .then(s => fake_health_thermometer2 = s)
+    .then(() => fake_peripheral.setNextGATTDiscoveryResponse({
+      code: HCI_SUCCESS}))
+    .then(() => ({
+      device: device,
+      fake_peripheral: fake_peripheral,
+      fake_generic_access: fake_generic_access,
+      fake_health_thermometer1: fake_health_thermometer1,
+      fake_health_thermometer2: fake_health_thermometer2
+    }));
+}
+
+// Similar to getHealthThermometerDevice except the GATT discovery
+// response has not been set yet so more attributes can still be added.
+function getConnectedHealthThermometerDevice(options) {
+  let device;
+  let fake_peripheral;
+  let fake_generic_access;
+  let fake_health_thermometer;
   return getDiscoveredHealthThermometerDevice(options)
-    .then(([device, fake_peripheral]) => {
-      return fake_peripheral.setNextGATTConnectionResponse({code: HCI_SUCCESS})
-        .then(() => device.gatt.connect())
-        .then(() => fake_peripheral.addFakeService({uuid: 'generic_access'}))
-        .then(() => fake_peripheral.addFakeService({
-          uuid: 'health_thermometer'}))
-        .then(() => fake_peripheral.addFakeService({
-          uuid: 'health_thermometer'}))
-        .then(() => fake_peripheral.setNextGATTDiscoveryResponse({
-          code: HCI_SUCCESS}))
-        .then(() => [device, fake_peripheral]);
-    });
+    .then(result => {
+      ({device, fake_peripheral} = result);
+    })
+    .then(() => fake_peripheral.setNextGATTConnectionResponse({
+      code: HCI_SUCCESS}))
+    .then(() => device.gatt.connect())
+    .then(() => fake_peripheral.addFakeService({uuid: 'generic_access'}))
+    .then(s => fake_generic_access = s)
+    .then(() => fake_peripheral.addFakeService({
+      uuid: 'health_thermometer'}))
+    .then(s => fake_health_thermometer = s)
+    .then(() => ({
+      device: device,
+      fake_peripheral: fake_peripheral,
+      fake_generic_access: fake_generic_access,
+      fake_health_thermometer: fake_health_thermometer,
+    }));
 }
 
 // Returns the same device and fake peripheral as getHealthThermometerDevice()
@@ -513,7 +581,10 @@
         }))
         .then(() => requestDeviceWithKeyDown(options))
         .then(device => device.gatt.connect())
-        .then(gatt => [gatt.device, fake_peripheral]);
+        .then(gatt => ({
+          device: gatt.device,
+          fake_peripheral: fake_peripheral
+        }));
     });
 }
 
@@ -521,12 +592,15 @@
 // characteristics, or descriptors.
 function getEmptyHealthThermometerDevice(options) {
   return getDiscoveredHealthThermometerDevice(options)
-    .then(([device, fake_peripheral]) => {
+    .then(({device, fake_peripheral}) => {
       return fake_peripheral.setNextGATTConnectionResponse({code: HCI_SUCCESS})
         .then(() => device.gatt.connect())
         .then(() => fake_peripheral.setNextGATTDiscoveryResponse({
           code: HCI_SUCCESS}))
-        .then(() => [device, fake_peripheral]);
+        .then(() => ({
+          device: device,
+          fake_peripheral: fake_peripheral
+        }));
     });
 }
 
@@ -549,8 +623,7 @@
     .then(fake_peripheral => {
       return requestDeviceWithKeyDown(options)
         .then(device => {
-          return fake_peripheral
-            .setNextGATTConnectionResponse({
+          return fake_peripheral.setNextGATTConnectionResponse({
               code: HCI_SUCCESS})
             .then(() => device.gatt.connect())
             .then(() => fake_peripheral.addFakeService({
@@ -561,7 +634,10 @@
               uuid: 'human_interface_device'}))
             .then(() => fake_peripheral.setNextGATTDiscoveryResponse({
               code: HCI_SUCCESS}))
-            .then(() => [device, fake_peripheral]);
+            .then(() => ({
+              device: device,
+              fake_peripheral: fake_peripheral
+            }));
         });
     });
 };
@@ -578,6 +654,9 @@
   })
   .then(fake_peripheral => {
     return requestDeviceWithKeyDown(options)
-      .then(device => [device, fake_peripheral]);
+      .then(device => ({
+        device: device,
+        fake_peripheral: fake_peripheral
+      }));
   });
 }

diff --git a/third_party/WebKit/ManualTests/forms/calendar-picker.html b/third_party/WebKit/ManualTests/forms/calendar-picker.html
index 99dbdd40..dd9a6c3 100644
--- a/third_party/WebKit/ManualTests/forms/calendar-picker.html
+++ b/third_party/WebKit/ManualTests/forms/calendar-picker.html

@@ -283,28 +283,28 @@
     doc.documentElement.innerHTML = '<head></head><body><div id=main>Loading...</div></body>';
     var commonCssLink = doc.createElement('link');
     commonCssLink.rel = 'stylesheet';
-    commonCssLink.href = '../../Source/web/resources/pickerCommon.css?' + (new Date()).getTime();
+    commonCssLink.href = '../../Source/core/html/forms/resources/pickerCommon.css?' + (new Date()).getTime();
     doc.head.appendChild(commonCssLink);
     var buttonCssLink = doc.createElement('link');
     buttonCssLink.rel = 'stylesheet';
-    buttonCssLink.href = '../../Source/web/resources/pickerButton.css?' + (new Date()).getTime();
+    buttonCssLink.href = '../../Source/core/html/forms/resources/pickerButton.css?' + (new Date()).getTime();
     doc.head.appendChild(buttonCssLink);
     var suggestionPickerCssLink = doc.createElement('link');
     suggestionPickerCssLink.rel = 'stylesheet';
-    suggestionPickerCssLink.href = '../../Source/web/resources/suggestionPicker.css?' + (new Date()).getTime();
+    suggestionPickerCssLink.href = '../../Source/core/html/forms/resources/suggestionPicker.css?' + (new Date()).getTime();
     doc.head.appendChild(suggestionPickerCssLink);
     var link = doc.createElement('link');
     link.rel = 'stylesheet';
-    link.href = '../../Source/web/resources/calendarPicker.css?' + (new Date()).getTime();
+    link.href = '../../Source/core/html/forms/resources/calendarPicker.css?' + (new Date()).getTime();
     doc.head.appendChild(link);
     var commonJsScript = doc.createElement('script');
-    commonJsScript.src = '../../Source/web/resources/pickerCommon.js?' + (new Date()).getTime();
+    commonJsScript.src = '../../Source/core/html/forms/resources/pickerCommon.js?' + (new Date()).getTime();
     doc.body.appendChild(commonJsScript);
     var suggestionPickerJsScript = doc.createElement('script');
-    suggestionPickerJsScript.src = '../../Source/web/resources/suggestionPicker.js?' + (new Date()).getTime();
+    suggestionPickerJsScript.src = '../../Source/core/html/forms/resources/suggestionPicker.js?' + (new Date()).getTime();
     doc.body.appendChild(suggestionPickerJsScript);
     var script = doc.createElement('script');
-    script.src = '../../Source/web/resources/calendarPicker.js?' + (new Date()).getTime();
+    script.src = '../../Source/core/html/forms/resources/calendarPicker.js?' + (new Date()).getTime();
     doc.body.appendChild(script);
 
     var pagePopupController = {

diff --git a/third_party/WebKit/ManualTests/forms/color-suggestion-picker.html b/third_party/WebKit/ManualTests/forms/color-suggestion-picker.html
index 87158624c..88990f6 100644
--- a/third_party/WebKit/ManualTests/forms/color-suggestion-picker.html
+++ b/third_party/WebKit/ManualTests/forms/color-suggestion-picker.html

@@ -38,17 +38,17 @@
     doc.documentElement.innerHTML = '<head></head><body><div id=main>Loading...</div></body>';
     var commonCssLink = doc.createElement('link');
     commonCssLink.rel = 'stylesheet';
-    commonCssLink.href = '../../Source/web/resources/pickerCommon.css?' + (new Date()).getTime();
+    commonCssLink.href = '../../Source/core/html/forms/resources/pickerCommon.css?' + (new Date()).getTime();
     doc.head.appendChild(commonCssLink);
     var link = doc.createElement('link');
     link.rel = 'stylesheet';
-    link.href = '../../Source/web/resources/colorSuggestionPicker.css?' + (new Date()).getTime();
+    link.href = '../../Source/core/html/forms/resources/colorSuggestionPicker.css?' + (new Date()).getTime();
     doc.head.appendChild(link);
     var commonJsScript = doc.createElement('script');
-    commonJsScript.src = '../../Source/web/resources/pickerCommon.js?' + (new Date()).getTime();
+    commonJsScript.src = '../../Source/core/html/forms/resources/pickerCommon.js?' + (new Date()).getTime();
     doc.body.appendChild(commonJsScript);
     var script = doc.createElement('script');
-    script.src = '../../Source/web/resources/colorSuggestionPicker.js?' + (new Date()).getTime();
+    script.src = '../../Source/core/html/forms/resources/colorSuggestionPicker.js?' + (new Date()).getTime();
     doc.body.appendChild(script);
 
     var pagePopupController = {

diff --git a/third_party/WebKit/ManualTests/forms/date-suggestion-picker.html b/third_party/WebKit/ManualTests/forms/date-suggestion-picker.html
index 9e9ec999..127ffb3 100644
--- a/third_party/WebKit/ManualTests/forms/date-suggestion-picker.html
+++ b/third_party/WebKit/ManualTests/forms/date-suggestion-picker.html

@@ -194,28 +194,28 @@
     doc.documentElement.innerHTML = '<head></head><body><div id=main>Loading...</div></body>';
     var commonCssLink = doc.createElement('link');
     commonCssLink.rel = 'stylesheet';
-    commonCssLink.href = '../../Source/web/resources/pickerCommon.css?' + (new Date()).getTime();
+    commonCssLink.href = '../../Source/core/html/forms/resources/pickerCommon.css?' + (new Date()).getTime();
     doc.head.appendChild(commonCssLink);
     var buttonCssLink = doc.createElement('link');
     buttonCssLink.rel = 'stylesheet';
-    buttonCssLink.href = '../../Source/web/resources/pickerButton.css?' + (new Date()).getTime();
+    buttonCssLink.href = '../../Source/core/html/forms/resources/pickerButton.css?' + (new Date()).getTime();
     doc.head.appendChild(buttonCssLink);
     var suggestionPickerCssLink = doc.createElement('link');
     suggestionPickerCssLink.rel = 'stylesheet';
-    suggestionPickerCssLink.href = '../../Source/web/resources/suggestionPicker.css?' + (new Date()).getTime();
+    suggestionPickerCssLink.href = '../../Source/core/html/forms/resources/suggestionPicker.css?' + (new Date()).getTime();
     doc.head.appendChild(suggestionPickerCssLink);
     var link = doc.createElement('link');
     link.rel = 'stylesheet';
-    link.href = '../../Source/web/resources/calendarPicker.css?' + (new Date()).getTime();
+    link.href = '../../Source/core/html/forms/resources/calendarPicker.css?' + (new Date()).getTime();
     doc.head.appendChild(link);
     var commonJsScript = doc.createElement('script');
-    commonJsScript.src = '../../Source/web/resources/pickerCommon.js?' + (new Date()).getTime();
+    commonJsScript.src = '../../Source/core/html/forms/resources/pickerCommon.js?' + (new Date()).getTime();
     doc.body.appendChild(commonJsScript);
     var suggestionPickerJsScript = doc.createElement('script');
-    suggestionPickerJsScript.src = '../../Source/web/resources/suggestionPicker.js?' + (new Date()).getTime();
+    suggestionPickerJsScript.src = '../../Source/core/html/forms/resources/suggestionPicker.js?' + (new Date()).getTime();
     doc.body.appendChild(suggestionPickerJsScript);
     var script = doc.createElement('script');
-    script.src = '../../Source/web/resources/calendarPicker.js?' + (new Date()).getTime();
+    script.src = '../../Source/core/html/forms/resources/calendarPicker.js?' + (new Date()).getTime();
     doc.body.appendChild(script);
 
     var pagePopupController = {

diff --git a/third_party/WebKit/ManualTests/forms/list-picker.html b/third_party/WebKit/ManualTests/forms/list-picker.html
index af87915..358412e 100644
--- a/third_party/WebKit/ManualTests/forms/list-picker.html
+++ b/third_party/WebKit/ManualTests/forms/list-picker.html

@@ -199,17 +199,17 @@
     doc.documentElement.innerHTML = '<!DOCTYPE html><head></head><body><div id=main>Loading...</div></body>';
     var commonCssLink = doc.createElement('link');
     commonCssLink.rel = 'stylesheet';
-    commonCssLink.href = '../../Source/web/resources/pickerCommon.css?' + (new Date()).getTime();
+    commonCssLink.href = '../../Source/core/html/forms/resources/pickerCommon.css?' + (new Date()).getTime();
     doc.head.appendChild(commonCssLink);
     var listPickerCssLink = doc.createElement('link');
     listPickerCssLink.rel = 'stylesheet';
-    listPickerCssLink.href = '../../Source/web/resources/listPicker.css?' + (new Date()).getTime();
+    listPickerCssLink.href = '../../Source/core/html/forms/resources/listPicker.css?' + (new Date()).getTime();
     doc.head.appendChild(listPickerCssLink);
     var commonJsScript = doc.createElement('script');
-    commonJsScript.src = '../../Source/web/resources/pickerCommon.js?' + (new Date()).getTime();
+    commonJsScript.src = '../../Source/core/html/forms/resources/pickerCommon.js?' + (new Date()).getTime();
     doc.body.appendChild(commonJsScript);
     var listPickerJsScript = doc.createElement('script');
-    listPickerJsScript.src = '../../Source/web/resources/listPicker.js?' + (new Date()).getTime();
+    listPickerJsScript.src = '../../Source/core/html/forms/resources/listPicker.js?' + (new Date()).getTime();
     doc.body.appendChild(listPickerJsScript);
 
     var pagePopupController = {

diff --git a/third_party/WebKit/Source/core/dom/BUILD.gn b/third_party/WebKit/Source/core/dom/BUILD.gn
index 18499bd..f8c6ad2d 100644
--- a/third_party/WebKit/Source/core/dom/BUILD.gn
+++ b/third_party/WebKit/Source/core/dom/BUILD.gn

@@ -124,6 +124,10 @@
     "DocumentParserClient.h",
     "DocumentParserTiming.cpp",
     "DocumentParserTiming.h",
+    "DocumentShutdownNotifier.cpp",
+    "DocumentShutdownNotifier.h",
+    "DocumentShutdownObserver.cpp",
+    "DocumentShutdownObserver.h",
     "DocumentStatisticsCollector.cpp",
     "DocumentStatisticsCollector.h",
     "DocumentStyleSheetCollection.cpp",

diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index fd0f51c..780fc4a 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp

@@ -2636,6 +2636,7 @@
   GetPage()->GetEventHandlerRegistry().DocumentDetached(*this);
 
   // Signal destruction to mutation observers.
+  DocumentShutdownNotifier::NotifyContextDestroyed();
   SynchronousMutationNotifier::NotifyContextDestroyed();
 
   // If this Document is associated with a live DocumentLoader, the
@@ -6855,6 +6856,7 @@
   ContainerNode::Trace(visitor);
   ExecutionContext::Trace(visitor);
   SecurityContext::Trace(visitor);
+  DocumentShutdownNotifier::Trace(visitor);
   SynchronousMutationNotifier::Trace(visitor);
 }
 

diff --git a/third_party/WebKit/Source/core/dom/Document.h b/third_party/WebKit/Source/core/dom/Document.h
index efed3a4..758c631f 100644
--- a/third_party/WebKit/Source/core/dom/Document.h
+++ b/third_party/WebKit/Source/core/dom/Document.h

@@ -38,6 +38,8 @@
 #include "core/dom/DocumentEncodingData.h"
 #include "core/dom/DocumentInit.h"
 #include "core/dom/DocumentLifecycle.h"
+#include "core/dom/DocumentShutdownNotifier.h"
+#include "core/dom/DocumentShutdownObserver.h"
 #include "core/dom/DocumentTiming.h"
 #include "core/dom/ExecutionContext.h"
 #include "core/dom/MutationObserver.h"
@@ -252,6 +254,7 @@
                              public TreeScope,
                              public SecurityContext,
                              public ExecutionContext,
+                             public DocumentShutdownNotifier,
                              public SynchronousMutationNotifier,
                              public Supplementable<Document> {
   DEFINE_WRAPPERTYPEINFO();

diff --git a/third_party/WebKit/Source/core/dom/DocumentShutdownNotifier.cpp b/third_party/WebKit/Source/core/dom/DocumentShutdownNotifier.cpp
new file mode 100644
index 0000000..5ebeea36
--- /dev/null
+++ b/third_party/WebKit/Source/core/dom/DocumentShutdownNotifier.cpp

@@ -0,0 +1,14 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "core/dom/DocumentShutdownNotifier.h"
+
+#include "core/dom/Document.h"
+#include "core/dom/DocumentShutdownObserver.h"
+
+namespace blink {
+
+DocumentShutdownNotifier::DocumentShutdownNotifier() = default;
+
+}  // namespace blink

diff --git a/third_party/WebKit/Source/core/dom/DocumentShutdownNotifier.h b/third_party/WebKit/Source/core/dom/DocumentShutdownNotifier.h
new file mode 100644
index 0000000..2fc23368
--- /dev/null
+++ b/third_party/WebKit/Source/core/dom/DocumentShutdownNotifier.h

@@ -0,0 +1,29 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef DocumentShutdownNotifier_h
+#define DocumentShutdownNotifier_h
+
+#include "core/CoreExport.h"
+#include "platform/LifecycleNotifier.h"
+
+namespace blink {
+
+class Document;
+class DocumentShutdownObserver;
+
+// Sibling class of DocumentShutdownObserver; implemented by Document to notify
+// subclasses of DocumentShutdownObserver of Document shutdown.
+class CORE_EXPORT DocumentShutdownNotifier
+    : public LifecycleNotifier<Document, DocumentShutdownObserver> {
+ protected:
+  DocumentShutdownNotifier();
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(DocumentShutdownNotifier);
+};
+
+}  // namespace blink
+
+#endif  // DocumentShutdownNotifier_h

diff --git a/third_party/WebKit/Source/core/dom/DocumentShutdownObserver.cpp b/third_party/WebKit/Source/core/dom/DocumentShutdownObserver.cpp
new file mode 100644
index 0000000..4aec88f
--- /dev/null
+++ b/third_party/WebKit/Source/core/dom/DocumentShutdownObserver.cpp

@@ -0,0 +1,17 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "core/dom/DocumentShutdownObserver.h"
+
+#include "core/dom/Document.h"
+#include "core/dom/DocumentShutdownNotifier.h"
+
+namespace blink {
+
+void DocumentShutdownObserver::ContextDestroyed(Document*) {}
+
+DocumentShutdownObserver::DocumentShutdownObserver()
+    : LifecycleObserver(nullptr) {}
+
+}  // namespace blink

diff --git a/third_party/WebKit/Source/core/dom/DocumentShutdownObserver.h b/third_party/WebKit/Source/core/dom/DocumentShutdownObserver.h
new file mode 100644
index 0000000..d3e83589
--- /dev/null
+++ b/third_party/WebKit/Source/core/dom/DocumentShutdownObserver.h

@@ -0,0 +1,35 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.  Use of
+// this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef DocumentShutdownObserver_h
+#define DocumentShutdownObserver_h
+
+#include "core/CoreExport.h"
+#include "platform/LifecycleObserver.h"
+
+namespace blink {
+
+class Document;
+
+// This class is a base class for classes which observe Document shutdown
+// synchronously.
+// Note: this functionality is also provided by SynchronousMutationObserver,
+// but if you don't need to respond to the other events handled by that class,
+// using this class is more efficient.
+class CORE_EXPORT DocumentShutdownObserver
+    : public LifecycleObserver<Document, DocumentShutdownObserver> {
+ public:
+  // Called when detaching document.
+  virtual void ContextDestroyed(Document*);
+
+ protected:
+  DocumentShutdownObserver();
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(DocumentShutdownObserver);
+};
+
+}  // namespace blink
+
+#endif  // DocumentShutdownObserver_h

diff --git a/third_party/WebKit/Source/core/dom/DocumentTest.cpp b/third_party/WebKit/Source/core/dom/DocumentTest.cpp
index d06b908f..6ebc468 100644
--- a/third_party/WebKit/Source/core/dom/DocumentTest.cpp
+++ b/third_party/WebKit/Source/core/dom/DocumentTest.cpp

@@ -249,6 +249,42 @@
   SynchronousMutationObserver::Trace(visitor);
 }
 
+class TestDocumentShutdownObserver
+    : public GarbageCollectedFinalized<TestDocumentShutdownObserver>,
+      public DocumentShutdownObserver {
+  USING_GARBAGE_COLLECTED_MIXIN(TestDocumentShutdownObserver);
+
+ public:
+  TestDocumentShutdownObserver(Document&);
+  virtual ~TestDocumentShutdownObserver() = default;
+
+  int CountContextDestroyedCalled() const {
+    return context_destroyed_called_counter_;
+  }
+
+  DECLARE_TRACE();
+
+ private:
+  // Implement |DocumentShutdownObserver| member functions.
+  void ContextDestroyed(Document*) final;
+
+  int context_destroyed_called_counter_ = 0;
+
+  DISALLOW_COPY_AND_ASSIGN(TestDocumentShutdownObserver);
+};
+
+TestDocumentShutdownObserver::TestDocumentShutdownObserver(Document& document) {
+  SetContext(&document);
+}
+
+void TestDocumentShutdownObserver::ContextDestroyed(Document*) {
+  ++context_destroyed_called_counter_;
+}
+
+DEFINE_TRACE(TestDocumentShutdownObserver) {
+  DocumentShutdownObserver::Trace(visitor);
+}
+
 class MockValidationMessageClient
     : public GarbageCollectedFinalized<MockValidationMessageClient>,
       public ValidationMessageClient {
@@ -732,6 +768,17 @@
   EXPECT_EQ(3u, observer.UpdatedCharacterDataRecords()[3]->new_length_);
 }
 
+TEST_F(DocumentTest, DocumentShutdownNotifier) {
+  auto& observer = *new TestDocumentShutdownObserver(GetDocument());
+
+  EXPECT_EQ(GetDocument(), observer.LifecycleContext());
+  EXPECT_EQ(0, observer.CountContextDestroyedCalled());
+
+  GetDocument().Shutdown();
+  EXPECT_EQ(nullptr, observer.LifecycleContext());
+  EXPECT_EQ(1, observer.CountContextDestroyedCalled());
+}
+
 // This tests that meta-theme-color can be found correctly
 TEST_F(DocumentTest, ThemeColor) {
   {

diff --git a/third_party/WebKit/Source/core/dom/SynchronousMutationObserver.h b/third_party/WebKit/Source/core/dom/SynchronousMutationObserver.h
index 63e3865..bcfdfa0 100644
--- a/third_party/WebKit/Source/core/dom/SynchronousMutationObserver.h
+++ b/third_party/WebKit/Source/core/dom/SynchronousMutationObserver.h

@@ -20,6 +20,9 @@
 // This class is a base class for classes which observe DOM tree mutation
 // synchronously. If you want to observe DOM tree mutation asynchronously see
 // MutationObserver Web API.
+// Note: if you only need to observe Document shutdown,
+// DocumentShutdownObserver provides this same functionality more efficiently
+// (since it doesn't observe the other events).
 //
 // TODO(yosin): Following classes should be derived from this class to
 // simplify Document class.

diff --git a/third_party/WebKit/Source/core/editing/BUILD.gn b/third_party/WebKit/Source/core/editing/BUILD.gn
index 8e0ef90..6293673 100644
--- a/third_party/WebKit/Source/core/editing/BUILD.gn
+++ b/third_party/WebKit/Source/core/editing/BUILD.gn

@@ -91,6 +91,7 @@
     "VisibleUnitsParagraph.cpp",
     "VisibleUnitsSentence.cpp",
     "VisibleUnitsWord.cpp",
+    "WebSubstringUtil.mm",
     "WritingDirection.h",
     "commands/AppendNodeCommand.cpp",
     "commands/AppendNodeCommand.h",

diff --git a/third_party/WebKit/Source/web/mac/WebSubstringUtil.mm b/third_party/WebKit/Source/core/editing/WebSubstringUtil.mm
similarity index 98%
rename from third_party/WebKit/Source/web/mac/WebSubstringUtil.mm
rename to third_party/WebKit/Source/core/editing/WebSubstringUtil.mm
index 1c5cfec..e892011 100644
--- a/third_party/WebKit/Source/web/mac/WebSubstringUtil.mm
+++ b/third_party/WebKit/Source/core/editing/WebSubstringUtil.mm

@@ -101,9 +101,8 @@
     // to use the font.
     // TODO(shuchen): Support scaling the font as necessary according to CSS
     // transforms, not just pinch-zoom.
-    if (!font ||
-        floor(fontPlatformData.size()) !=
-            floor([[font fontDescriptor] pointSize])) {
+    if (!font || floor(fontPlatformData.size()) !=
+                     floor([[font fontDescriptor] pointSize])) {
       font = [NSFont systemFontOfSize:style->GetFont()
                                           .GetFontDescription()
                                           .ComputedSize() *

diff --git a/third_party/WebKit/Source/web/resources/.clang-format b/third_party/WebKit/Source/core/html/forms/resources/.clang-format
similarity index 100%
rename from third_party/WebKit/Source/web/resources/.clang-format
rename to third_party/WebKit/Source/core/html/forms/resources/.clang-format


diff --git a/third_party/WebKit/Source/web/resources/calendarPicker.css b/third_party/WebKit/Source/core/html/forms/resources/calendarPicker.css
similarity index 100%
rename from third_party/WebKit/Source/web/resources/calendarPicker.css
rename to third_party/WebKit/Source/core/html/forms/resources/calendarPicker.css


diff --git a/third_party/WebKit/Source/web/resources/calendarPicker.js b/third_party/WebKit/Source/core/html/forms/resources/calendarPicker.js
similarity index 100%
rename from third_party/WebKit/Source/web/resources/calendarPicker.js
rename to third_party/WebKit/Source/core/html/forms/resources/calendarPicker.js


diff --git a/third_party/WebKit/Source/web/resources/colorSuggestionPicker.css b/third_party/WebKit/Source/core/html/forms/resources/colorSuggestionPicker.css
similarity index 100%
rename from third_party/WebKit/Source/web/resources/colorSuggestionPicker.css
rename to third_party/WebKit/Source/core/html/forms/resources/colorSuggestionPicker.css


diff --git a/third_party/WebKit/Source/web/resources/colorSuggestionPicker.js b/third_party/WebKit/Source/core/html/forms/resources/colorSuggestionPicker.js
similarity index 100%
rename from third_party/WebKit/Source/web/resources/colorSuggestionPicker.js
rename to third_party/WebKit/Source/core/html/forms/resources/colorSuggestionPicker.js


diff --git a/third_party/WebKit/Source/web/resources/listPicker.css b/third_party/WebKit/Source/core/html/forms/resources/listPicker.css
similarity index 100%
rename from third_party/WebKit/Source/web/resources/listPicker.css
rename to third_party/WebKit/Source/core/html/forms/resources/listPicker.css


diff --git a/third_party/WebKit/Source/web/resources/listPicker.js b/third_party/WebKit/Source/core/html/forms/resources/listPicker.js
similarity index 100%
rename from third_party/WebKit/Source/web/resources/listPicker.js
rename to third_party/WebKit/Source/core/html/forms/resources/listPicker.js


diff --git a/third_party/WebKit/Source/web/resources/pickerButton.css b/third_party/WebKit/Source/core/html/forms/resources/pickerButton.css
similarity index 100%
rename from third_party/WebKit/Source/web/resources/pickerButton.css
rename to third_party/WebKit/Source/core/html/forms/resources/pickerButton.css


diff --git a/third_party/WebKit/Source/web/resources/pickerCommon.css b/third_party/WebKit/Source/core/html/forms/resources/pickerCommon.css
similarity index 100%
rename from third_party/WebKit/Source/web/resources/pickerCommon.css
rename to third_party/WebKit/Source/core/html/forms/resources/pickerCommon.css


diff --git a/third_party/WebKit/Source/web/resources/pickerCommon.js b/third_party/WebKit/Source/core/html/forms/resources/pickerCommon.js
similarity index 100%
rename from third_party/WebKit/Source/web/resources/pickerCommon.js
rename to third_party/WebKit/Source/core/html/forms/resources/pickerCommon.js


diff --git a/third_party/WebKit/Source/web/resources/suggestionPicker.css b/third_party/WebKit/Source/core/html/forms/resources/suggestionPicker.css
similarity index 100%
rename from third_party/WebKit/Source/web/resources/suggestionPicker.css
rename to third_party/WebKit/Source/core/html/forms/resources/suggestionPicker.css


diff --git a/third_party/WebKit/Source/web/resources/suggestionPicker.js b/third_party/WebKit/Source/core/html/forms/resources/suggestionPicker.js
similarity index 100%
rename from third_party/WebKit/Source/web/resources/suggestionPicker.js
rename to third_party/WebKit/Source/core/html/forms/resources/suggestionPicker.js


diff --git a/third_party/WebKit/Source/core/input/EventHandler.cpp b/third_party/WebKit/Source/core/input/EventHandler.cpp
index 63891ab..1b0e7390 100644
--- a/third_party/WebKit/Source/core/input/EventHandler.cpp
+++ b/third_party/WebKit/Source/core/input/EventHandler.cpp

@@ -238,7 +238,6 @@
   scroll_manager_->Clear();
   gesture_manager_->Clear();
   mouse_event_manager_->Clear();
-  mouse_wheel_event_manager_->Clear();
   last_deferred_tap_element_ = nullptr;
   event_handler_will_reset_capturing_mouse_events_node_ = false;
 }

diff --git a/third_party/WebKit/Source/core/input/MouseWheelEventManager.cpp b/third_party/WebKit/Source/core/input/MouseWheelEventManager.cpp
index 6a8a308..e830907 100644
--- a/third_party/WebKit/Source/core/input/MouseWheelEventManager.cpp
+++ b/third_party/WebKit/Source/core/input/MouseWheelEventManager.cpp

@@ -18,100 +18,37 @@
 namespace blink {
 MouseWheelEventManager::MouseWheelEventManager(LocalFrame& frame,
                                                ScrollManager& scroll_manager)
-    : frame_(frame), wheel_target_(nullptr), scroll_manager_(scroll_manager) {}
+    : frame_(frame), scroll_manager_(scroll_manager) {}
 
 DEFINE_TRACE(MouseWheelEventManager) {
   visitor->Trace(frame_);
-  visitor->Trace(wheel_target_);
   visitor->Trace(scroll_manager_);
 }
 
-void MouseWheelEventManager::Clear() {
-  wheel_target_ = nullptr;
-}
-
 WebInputEventResult MouseWheelEventManager::HandleWheelEvent(
     const WebMouseWheelEvent& event) {
-  bool wheel_scroll_latching =
-      RuntimeEnabledFeatures::TouchpadAndWheelScrollLatchingEnabled();
-
+#if OS(MACOSX)
+  // Filter Mac OS specific phases, usually with a zero-delta.
+  // https://crbug.com/553732
+  // TODO(chongz): EventSender sends events with
+  // |WebMouseWheelEvent::PhaseNone|,
+  // but it shouldn't.
+  const int kWheelEventPhaseNoEventMask = WebMouseWheelEvent::kPhaseEnded |
+                                          WebMouseWheelEvent::kPhaseCancelled |
+                                          WebMouseWheelEvent::kPhaseMayBegin;
+  if ((event.phase & kWheelEventPhaseNoEventMask) ||
+      (event.momentum_phase & kWheelEventPhaseNoEventMask))
+    return WebInputEventResult::kNotHandled;
+#endif
   Document* doc = frame_->GetDocument();
-  if (!doc || doc->GetLayoutViewItem().IsNull())
+
+  if (doc->GetLayoutViewItem().IsNull())
     return WebInputEventResult::kNotHandled;
 
   LocalFrameView* view = frame_->View();
   if (!view)
     return WebInputEventResult::kNotHandled;
 
-  if (wheel_scroll_latching) {
-    const int kWheelEventPhaseEndedEventMask =
-        WebMouseWheelEvent::kPhaseEnded | WebMouseWheelEvent::kPhaseCancelled;
-    const int kWheelEventPhaseNoEventMask =
-        kWheelEventPhaseEndedEventMask | WebMouseWheelEvent::kPhaseMayBegin;
-
-    if ((event.phase & kWheelEventPhaseEndedEventMask) ||
-        (event.momentum_phase & kWheelEventPhaseEndedEventMask)) {
-      wheel_target_ = nullptr;
-    }
-
-    if ((event.phase & kWheelEventPhaseNoEventMask) ||
-        (event.momentum_phase & kWheelEventPhaseNoEventMask)) {
-      // Filter wheel events with zero deltas and reset the wheel_target_ node.
-      DCHECK(!event.delta_x && !event.delta_y);
-      return WebInputEventResult::kNotHandled;
-    }
-
-    if (event.phase == WebMouseWheelEvent::kPhaseBegan) {
-      // Find and save the wheel_target_, this target will be used for the rest
-      // of the current scrolling sequence.
-      DCHECK(!wheel_target_);
-      wheel_target_ = FindTargetNode(event, doc, view);
-    }
-  } else {  // !wheel_scroll_latching, wheel_target_ will be updated for each
-            // wheel event.
-#if OS(MACOSX)
-    // Filter Mac OS specific phases, usually with a zero-delta.
-    // https://crbug.com/553732
-    // TODO(chongz): EventSender sends events with
-    // |WebMouseWheelEvent::PhaseNone|,
-    // but it shouldn't.
-    const int kWheelEventPhaseNoEventMask =
-        WebMouseWheelEvent::kPhaseEnded | WebMouseWheelEvent::kPhaseCancelled |
-        WebMouseWheelEvent::kPhaseMayBegin;
-    if ((event.phase & kWheelEventPhaseNoEventMask) ||
-        (event.momentum_phase & kWheelEventPhaseNoEventMask))
-      return WebInputEventResult::kNotHandled;
-#endif
-
-    wheel_target_ = FindTargetNode(event, doc, view);
-  }
-
-  LocalFrame* subframe =
-      EventHandlingUtil::SubframeForTargetNode(wheel_target_.Get());
-  if (subframe) {
-    WebInputEventResult result =
-        subframe->GetEventHandler().HandleWheelEvent(event);
-    if (result != WebInputEventResult::kNotHandled)
-      scroll_manager_->SetFrameWasScrolledByUser();
-    return result;
-  }
-
-  if (wheel_target_) {
-    WheelEvent* dom_event =
-        WheelEvent::Create(event, wheel_target_->GetDocument().domWindow());
-    DispatchEventResult dom_event_result =
-        wheel_target_->DispatchEvent(dom_event);
-    if (dom_event_result != DispatchEventResult::kNotCanceled)
-      return EventHandlingUtil::ToWebInputEventResult(dom_event_result);
-  }
-
-  return WebInputEventResult::kNotHandled;
-}
-
-Node* MouseWheelEventManager::FindTargetNode(const WebMouseWheelEvent& event,
-                                             const Document* doc,
-                                             const LocalFrameView* view) {
-  DCHECK(doc && !doc->GetLayoutViewItem().IsNull() && view);
   LayoutPoint v_point =
       view->RootFrameToContents(FlooredIntPoint(event.PositionInRootFrame()));
 
@@ -128,7 +65,24 @@
   if (!node && result.GetScrollbar())
     node = doc->documentElement();
 
-  return node;
+  LocalFrame* subframe = EventHandlingUtil::SubframeForTargetNode(node);
+  if (subframe) {
+    WebInputEventResult result =
+        subframe->GetEventHandler().HandleWheelEvent(event);
+    if (result != WebInputEventResult::kNotHandled)
+      scroll_manager_->SetFrameWasScrolledByUser();
+    return result;
+  }
+
+  if (node) {
+    WheelEvent* dom_event =
+        WheelEvent::Create(event, node->GetDocument().domWindow());
+    DispatchEventResult dom_event_result = node->DispatchEvent(dom_event);
+    if (dom_event_result != DispatchEventResult::kNotCanceled)
+      return EventHandlingUtil::ToWebInputEventResult(dom_event_result);
+  }
+
+  return WebInputEventResult::kNotHandled;
 }
 
 }  // namespace blink

diff --git a/third_party/WebKit/Source/core/input/MouseWheelEventManager.h b/third_party/WebKit/Source/core/input/MouseWheelEventManager.h
index 809ed02..ecf2e5ae 100644
--- a/third_party/WebKit/Source/core/input/MouseWheelEventManager.h
+++ b/third_party/WebKit/Source/core/input/MouseWheelEventManager.h

@@ -11,10 +11,7 @@
 
 namespace blink {
 
-class Document;
 class LocalFrame;
-class LocalFrameView;
-class Node;
 class ScrollManager;
 class WebMouseWheelEvent;
 
@@ -26,17 +23,10 @@
   explicit MouseWheelEventManager(LocalFrame&, ScrollManager&);
   DECLARE_TRACE();
 
-  void Clear();
-
   WebInputEventResult HandleWheelEvent(const WebMouseWheelEvent&);
 
  private:
-  Node* FindTargetNode(const WebMouseWheelEvent&,
-                       const Document*,
-                       const LocalFrameView*);
-
   const Member<LocalFrame> frame_;
-  Member<Node> wheel_target_;
   Member<ScrollManager> scroll_manager_;
 };
 

diff --git a/third_party/WebKit/Source/core/layout/BUILD.gn b/third_party/WebKit/Source/core/layout/BUILD.gn
index cdd6c4aaf..19144509 100644
--- a/third_party/WebKit/Source/core/layout/BUILD.gn
+++ b/third_party/WebKit/Source/core/layout/BUILD.gn

@@ -462,6 +462,7 @@
       "LayoutThemeFontProviderWin.cpp",
       "LayoutThemeWin.cpp",
       "LayoutThemeWin.h",
+      "WebFontRenderingWin.cpp",
     ]
   } else {  # Not Windows.
     sources += [ "LayoutThemeFontProviderDefault.cpp" ]
@@ -471,6 +472,7 @@
     sources += [
       "LayoutThemeLinux.cpp",
       "LayoutThemeLinux.h",
+      "WebFontRenderingLinux.cpp",
     ]
   }
 
@@ -478,6 +480,7 @@
     sources += [
       "LayoutThemeAndroid.cpp",
       "LayoutThemeAndroid.h",
+      "WebFontRenderingAndroid.cpp",
     ]
   }
 

diff --git a/third_party/WebKit/Source/web/linux/WebFontRendering.cpp b/third_party/WebKit/Source/core/layout/WebFontRenderingAndroid.cpp
similarity index 100%
copy from third_party/WebKit/Source/web/linux/WebFontRendering.cpp
copy to third_party/WebKit/Source/core/layout/WebFontRenderingAndroid.cpp


diff --git a/third_party/WebKit/Source/web/linux/WebFontRendering.cpp b/third_party/WebKit/Source/core/layout/WebFontRenderingLinux.cpp
similarity index 100%
rename from third_party/WebKit/Source/web/linux/WebFontRendering.cpp
rename to third_party/WebKit/Source/core/layout/WebFontRenderingLinux.cpp


diff --git a/third_party/WebKit/Source/web/win/WebFontRendering.cpp b/third_party/WebKit/Source/core/layout/WebFontRenderingWin.cpp
similarity index 100%
rename from third_party/WebKit/Source/web/win/WebFontRendering.cpp
rename to third_party/WebKit/Source/core/layout/WebFontRenderingWin.cpp


diff --git a/third_party/WebKit/Source/core/layout/ng/ng_block_node.cc b/third_party/WebKit/Source/core/layout/ng/ng_block_node.cc
index 8af4036e..f0f2bcd 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_block_node.cc
+++ b/third_party/WebKit/Source/core/layout/ng/ng_block_node.cc

@@ -228,8 +228,9 @@
   if (Style().SpecifiesColumns())
     return false;
 
-  if (!box_->IsLayoutBlockFlow())
+  if (!box_->IsLayoutNGBlockFlow())
     return false;
+
   return RuntimeEnabledFeatures::LayoutNGEnabled();
 }
 

diff --git a/third_party/WebKit/Source/core/page/PrintContextTest.cpp b/third_party/WebKit/Source/core/page/PrintContextTest.cpp
index 98a7ec6..69f59f7 100644
--- a/third_party/WebKit/Source/core/page/PrintContextTest.cpp
+++ b/third_party/WebKit/Source/core/page/PrintContextTest.cpp

@@ -95,7 +95,7 @@
                                page_rect);
       GetPrintContext().OutputLinkedDestinations(context, page_rect);
     }
-    builder.EndRecording()->playback(&canvas);
+    builder.EndRecording()->Playback(&canvas);
     GetPrintContext().EndPrintMode();
   }
 

diff --git a/third_party/WebKit/Source/core/testing/sim/SimDisplayItemList.cpp b/third_party/WebKit/Source/core/testing/sim/SimDisplayItemList.cpp
index 8ebdbb6..0d2b790 100644
--- a/third_party/WebKit/Source/core/testing/sim/SimDisplayItemList.cpp
+++ b/third_party/WebKit/Source/core/testing/sim/SimDisplayItemList.cpp

@@ -17,7 +17,7 @@
                                            sk_sp<const PaintRecord> record,
                                            const WebRect& record_bounds) {
   SimCanvas canvas(record_bounds.width, record_bounds.height);
-  record->playback(&canvas);
+  record->Playback(&canvas);
   commands_.Append(canvas.Commands().data(), canvas.Commands().size());
 }
 

diff --git a/third_party/WebKit/Source/devtools/front_end/network/RequestPreviewView.js b/third_party/WebKit/Source/devtools/front_end/network/RequestPreviewView.js
index ef1cad37..c99d068 100644
--- a/third_party/WebKit/Source/devtools/front_end/network/RequestPreviewView.js
+++ b/third_party/WebKit/Source/devtools/front_end/network/RequestPreviewView.js

@@ -52,6 +52,7 @@
         this._emptyWidget = this._createEmptyWidget();
         this._emptyWidget.show(this.element);
         this._previewView = this._emptyWidget;
+        this._previewViewHandledForTest(this._previewView);
       }
       return;
     }

diff --git a/third_party/WebKit/Source/devtools/front_end/sdk/NetworkManager.js b/third_party/WebKit/Source/devtools/front_end/sdk/NetworkManager.js
index f888690b..b27e2c5e 100644
--- a/third_party/WebKit/Source/devtools/front_end/sdk/NetworkManager.js
+++ b/third_party/WebKit/Source/devtools/front_end/sdk/NetworkManager.js

@@ -74,6 +74,21 @@
   }
 
   /**
+   * @param {!SDK.NetworkRequest} request
+   * @return {!Promise<!SDK.NetworkRequest.ContentData>}
+   */
+  static async requestContentData(request) {
+    if (request.resourceType() === Common.resourceTypes.WebSocket)
+      return {error: 'Content for WebSockets is currently not supported', content: null, encoded: false};
+    if (!request.finished)
+      await request.once(SDK.NetworkRequest.Events.FinishedLoading);
+    var manager = request.networkManager();
+    var response = await manager._networkAgent.invoke_getResponseBody({requestId: request.requestId()});
+    var error = response[Protocol.Error] || null;
+    return {error: error, content: error ? null : response.body, encoded: response.base64Encoded};
+  }
+
+  /**
    * @param {!SDK.NetworkManager.Conditions} conditions
    * @return {!Protocol.Network.ConnectionType}
    * TODO(allada): this belongs to NetworkConditionsSelector, which should hardcode/guess it.

diff --git a/third_party/WebKit/Source/devtools/front_end/sdk/NetworkRequest.js b/third_party/WebKit/Source/devtools/front_end/sdk/NetworkRequest.js
index b6c8a31..7de550b 100644
--- a/third_party/WebKit/Source/devtools/front_end/sdk/NetworkRequest.js
+++ b/third_party/WebKit/Source/devtools/front_end/sdk/NetworkRequest.js

@@ -73,6 +73,7 @@
 
     /** @type {!Common.ResourceType} */
     this._resourceType = Common.resourceTypes.Other;
+    // TODO(allada) Migrate everything away from this and remove it.
     this._contentEncoded = false;
     this._pendingContentCallbacks = [];
     /** @type {!Array.<!SDK.NetworkRequest.WebSocketFrame>} */
@@ -365,11 +366,8 @@
 
     this._finished = x;
 
-    if (x) {
+    if (x)
       this.dispatchEventToListeners(SDK.NetworkRequest.Events.FinishedLoading, this);
-      if (this._pendingContentCallbacks.length)
-        this._innerRequestContent();
-    }
   }
 
   /**
@@ -865,6 +863,7 @@
     return values.join(', ');
   }
 
+  // TODO(allada) Migrate everything away from using this function and use .contentData() instead.
   /**
    * @return {?string|undefined}
    */
@@ -872,6 +871,7 @@
     return this._content;
   }
 
+  // TODO(allada) Migrate everything away from using this function and use .contentData() instead.
   /**
    * @return {?Protocol.Error|undefined}
    */
@@ -879,6 +879,7 @@
     return this._contentError;
   }
 
+  // TODO(allada) Migrate everything away from using this function and use .contentData() instead.
   /**
    * @return {boolean}
    */
@@ -887,6 +888,16 @@
   }
 
   /**
+   * @return {!Promise<!SDK.NetworkRequest.ContentData>}
+   */
+  contentData() {
+    if (this._contentData)
+      return this._contentData;
+    this._contentData = SDK.NetworkManager.requestContentData(this);
+    return this._contentData;
+  }
+
+  /**
    * @override
    * @return {string}
    */
@@ -906,20 +917,13 @@
    * @override
    * @return {!Promise<?string>}
    */
-  requestContent() {
-    // We do not support content retrieval for WebSockets at the moment.
-    // Since WebSockets are potentially long-living, fail requests immediately
-    // to prevent caller blocking until resource is marked as finished.
-    if (this._resourceType === Common.resourceTypes.WebSocket)
-      return Promise.resolve(/** @type {?string} */ (null));
-    if (typeof this._content !== 'undefined')
-      return Promise.resolve(/** @type {?string} */ (this.content || null));
-    var callback;
-    var promise = new Promise(fulfill => callback = fulfill);
-    this._pendingContentCallbacks.push(callback);
-    if (this.finished)
-      this._innerRequestContent();
-    return promise;
+  async requestContent() {
+    var contentData = await this.contentData();
+    // TODO(allada) Migrate away from anyone using .content, .contentError and .contentEncoded.
+    this._content = contentData.content;
+    this._contentError = contentData.error;
+    this._contentEncoded = contentData.encoded;
+    return contentData.content;
   }
 
   /**
@@ -1000,6 +1004,7 @@
     this.requestContent().then(onResourceContent.bind(this));
   }
 
+  // TODO(allada) Migrate this function to use .contentData() instead.
   /**
    * @return {?string}
    */
@@ -1013,22 +1018,6 @@
     return Common.ContentProvider.contentAsDataURL(content, this.mimeType, true, charset);
   }
 
-  async _innerRequestContent() {
-    if (this._contentRequested)
-      return;
-    this._contentRequested = true;
-
-    var response =
-        await this._networkManager.target().networkAgent().invoke_getResponseBody({requestId: this._requestId});
-
-    this._content = response[Protocol.Error] ? null : response.body;
-    this._contentError = response[Protocol.Error];
-    this._contentEncoded = response.base64Encoded;
-    for (var callback of this._pendingContentCallbacks.splice(0))
-      callback(this._content);
-    delete this._contentRequested;
-  }
-
   /**
    * @return {?Protocol.Network.Initiator}
    */
@@ -1143,3 +1132,6 @@
 
 /** @typedef {!{time: number, eventName: string, eventId: string, data: string}} */
 SDK.NetworkRequest.EventSourceMessage;
+
+/** @typedef {!{error: ?string, content: ?string, encoded: boolean}} */
+SDK.NetworkRequest.ContentData;

diff --git a/third_party/WebKit/Source/modules/exported/OWNERS b/third_party/WebKit/Source/modules/exported/OWNERS
new file mode 100644
index 0000000..e67a8c32
--- /dev/null
+++ b/third_party/WebKit/Source/modules/exported/OWNERS

@@ -0,0 +1 @@
+kinuko@chromium.org

diff --git a/third_party/WebKit/Source/platform/BUILD.gn b/third_party/WebKit/Source/platform/BUILD.gn
index aac5578..1f3e9914 100644
--- a/third_party/WebKit/Source/platform/BUILD.gn
+++ b/third_party/WebKit/Source/platform/BUILD.gn

@@ -727,6 +727,8 @@
     "fonts/opentype/OpenTypeTypes.h",
     "fonts/opentype/OpenTypeVerticalData.cpp",
     "fonts/opentype/OpenTypeVerticalData.h",
+    "fonts/opentype/VariableFontCheck.cpp",
+    "fonts/opentype/VariableFontCheck.h",
     "fonts/shaping/CachingWordShapeIterator.cpp",
     "fonts/shaping/CachingWordShapeIterator.h",
     "fonts/shaping/CachingWordShaper.cpp",
@@ -1396,6 +1398,7 @@
     "scroll/ScrollbarThemeOverlayMock.h",
     "scroll/SmoothScrollSequencer.cpp",
     "scroll/SmoothScrollSequencer.h",
+    "scroll/WebScrollbarTheme.mm",
     "speech/PlatformSpeechSynthesisUtterance.cpp",
     "speech/PlatformSpeechSynthesisUtterance.h",
     "speech/PlatformSpeechSynthesisVoice.cpp",

diff --git a/third_party/WebKit/Source/platform/audio/ReverbInputBuffer.cpp b/third_party/WebKit/Source/platform/audio/ReverbInputBuffer.cpp
index 0a6c835..017019b 100644
--- a/third_party/WebKit/Source/platform/audio/ReverbInputBuffer.cpp
+++ b/third_party/WebKit/Source/platform/audio/ReverbInputBuffer.cpp

@@ -35,19 +35,14 @@
 
 void ReverbInputBuffer::Write(const float* source_p, size_t number_of_frames) {
   size_t buffer_length = buffer_.size();
-  bool is_copy_safe = write_index_ + number_of_frames <= buffer_length;
-  DCHECK(is_copy_safe);
-  if (!is_copy_safe)
-    return;
+  size_t index = WriteIndex();
+  size_t new_index = index + number_of_frames;
 
-  memcpy(buffer_.Data() + write_index_, source_p,
-         sizeof(float) * number_of_frames);
+  CHECK_LE(new_index, buffer_length);
 
-  write_index_ += number_of_frames;
-  DCHECK_LE(write_index_, buffer_length);
+  memcpy(buffer_.Data() + index, source_p, sizeof(float) * number_of_frames);
 
-  if (write_index_ >= buffer_length)
-    write_index_ = 0;
+  SetWriteIndex(new_index);
 }
 
 float* ReverbInputBuffer::DirectReadFrom(int* read_index,
@@ -75,7 +70,7 @@
 
 void ReverbInputBuffer::Reset() {
   buffer_.Zero();
-  write_index_ = 0;
+  SetWriteIndex(0);
 }
 
 }  // namespace blink

diff --git a/third_party/WebKit/Source/platform/audio/ReverbInputBuffer.h b/third_party/WebKit/Source/platform/audio/ReverbInputBuffer.h
index e50602c..d6c5008 100644
--- a/third_party/WebKit/Source/platform/audio/ReverbInputBuffer.h
+++ b/third_party/WebKit/Source/platform/audio/ReverbInputBuffer.h

@@ -32,6 +32,7 @@
 #include "platform/PlatformExport.h"
 #include "platform/audio/AudioArray.h"
 #include "platform/wtf/Allocator.h"
+#include "platform/wtf/Atomics.h"
 #include "platform/wtf/Noncopyable.h"
 
 namespace blink {
@@ -52,7 +53,8 @@
   void Write(const float* source_p, size_t number_of_frames);
 
   // Background threads can call this to check if there's anything to read...
-  size_t WriteIndex() const { return write_index_; }
+  size_t WriteIndex() const { return AcquireLoad(&write_index_); }
+  void SetWriteIndex(size_t value) { ReleaseStore(&write_index_, value); }
 
   // The individual background threads read here (and hope that they can keep up
   // with the buffer writing).
@@ -66,6 +68,10 @@
 
  private:
   AudioFloatArray buffer_;
+
+  // write_index_ can be accessed from several threads.  Only use the
+  // getter and the setter to access it atomically.  Don't access
+  // write_index_ directly!
   size_t write_index_;
 };
 

diff --git a/third_party/WebKit/Source/platform/fonts/FontCustomPlatformData.cpp b/third_party/WebKit/Source/platform/fonts/FontCustomPlatformData.cpp
index 2307530..af4daa3 100644
--- a/third_party/WebKit/Source/platform/fonts/FontCustomPlatformData.cpp
+++ b/third_party/WebKit/Source/platform/fonts/FontCustomPlatformData.cpp

@@ -41,6 +41,7 @@
 #include "platform/fonts/mac/CoreTextVariationsSupport.h"
 #endif
 #include "platform/fonts/opentype/FontSettings.h"
+#include "platform/fonts/opentype/VariableFontCheck.h"
 #include "third_party/skia/include/core/SkStream.h"
 #include "third_party/skia/include/core/SkTypeface.h"
 #if OS(WIN) || OS(MACOSX)
@@ -74,7 +75,7 @@
   // now, going with a reasonable upper limit. Deduplication is
   // handled by Skia with priority given to the last occuring
   // assignment.
-  if (variation_settings && variation_settings->size() < UINT16_MAX) {
+  if (VariableFontCheck::IsVariableFont(base_typeface_.get())) {
 #if OS(WIN)
     sk_sp<SkFontMgr> fm(SkFontMgr_New_Custom_Empty());
 #elif OS(MACOSX)
@@ -87,12 +88,15 @@
     sk_sp<SkFontMgr> fm(SkFontMgr::RefDefault());
 #endif
     Vector<SkFontMgr::FontParameters::Axis, 0> axes;
-    axes.ReserveCapacity(variation_settings->size());
-    for (size_t i = 0; i < variation_settings->size(); ++i) {
-      SkFontMgr::FontParameters::Axis axis = {
-          AtomicStringToFourByteTag(variation_settings->at(i).Tag()),
-          SkFloatToScalar(variation_settings->at(i).Value())};
-      axes.push_back(axis);
+
+    if (variation_settings && variation_settings->size() < UINT16_MAX) {
+      axes.ReserveCapacity(variation_settings->size());
+      for (size_t i = 0; i < variation_settings->size(); ++i) {
+        SkFontMgr::FontParameters::Axis axis = {
+            AtomicStringToFourByteTag(variation_settings->at(i).Tag()),
+            SkFloatToScalar(variation_settings->at(i).Value())};
+        axes.push_back(axis);
+      }
     }
 
     sk_sp<SkTypeface> sk_variation_font(fm->createFromStream(

diff --git a/third_party/WebKit/Source/platform/fonts/opentype/VariableFontCheck.cpp b/third_party/WebKit/Source/platform/fonts/opentype/VariableFontCheck.cpp
new file mode 100644
index 0000000..f948a6a
--- /dev/null
+++ b/third_party/WebKit/Source/platform/fonts/opentype/VariableFontCheck.cpp

@@ -0,0 +1,21 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "platform/fonts/opentype/VariableFontCheck.h"
+
+#include "SkTypeface.h"
+#include "platform/wtf/Vector.h"
+
+namespace blink {
+
+bool VariableFontCheck::IsVariableFont(SkTypeface* typeface) {
+  const size_t table_count = typeface->countTables();
+  Vector<SkFontTableTag> table_tags;
+  table_tags.resize(table_count);
+  int table_tags_result = typeface->getTableTags(table_tags.data());
+  return table_tags_result && table_tags.Contains(SkFontTableTag(
+                                  SkSetFourByteTag('f', 'v', 'a', 'r')));
+}
+
+}  // namespace blink

diff --git a/third_party/WebKit/Source/platform/fonts/opentype/VariableFontCheck.h b/third_party/WebKit/Source/platform/fonts/opentype/VariableFontCheck.h
new file mode 100644
index 0000000..e78fc54
--- /dev/null
+++ b/third_party/WebKit/Source/platform/fonts/opentype/VariableFontCheck.h

@@ -0,0 +1,19 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef VariableFontCheck_h
+#define VariableFontCheck_h
+
+class SkTypeface;
+
+namespace blink {
+
+class VariableFontCheck {
+ public:
+  static bool IsVariableFont(SkTypeface*);
+};
+
+}  // namespace blink
+
+#endif

diff --git a/third_party/WebKit/Source/platform/graphics/Canvas2DLayerBridge.cpp b/third_party/WebKit/Source/platform/graphics/Canvas2DLayerBridge.cpp
index 25f2f6c..b2343ea 100644
--- a/third_party/WebKit/Source/platform/graphics/Canvas2DLayerBridge.cpp
+++ b/third_party/WebKit/Source/platform/graphics/Canvas2DLayerBridge.cpp

@@ -791,7 +791,7 @@
       canvas = color_transform_canvas.get();
     }
 
-    recorder_->finishRecordingAsPicture()->playback(canvas);
+    recorder_->finishRecordingAsPicture()->Playback(canvas);
     if (is_deferral_enabled_)
       StartRecording();
     have_recorded_draw_commands_ = false;

diff --git a/third_party/WebKit/Source/platform/graphics/LoggingCanvas.cpp b/third_party/WebKit/Source/platform/graphics/LoggingCanvas.cpp
index 818fda7..e8eb870f 100644
--- a/third_party/WebKit/Source/platform/graphics/LoggingCanvas.cpp
+++ b/third_party/WebKit/Source/platform/graphics/LoggingCanvas.cpp

@@ -910,7 +910,7 @@
 String RecordAsDebugString(const PaintRecord* record, const SkRect& bounds) {
   const SkIRect enclosing_bounds = bounds.roundOut();
   LoggingCanvas canvas(enclosing_bounds.width(), enclosing_bounds.height());
-  record->playback(&canvas);
+  record->Playback(&canvas);
   std::unique_ptr<JSONObject> record_as_json = JSONObject::Create();
   record_as_json->SetObject("cullRect", ObjectForSkRect(bounds));
   record_as_json->SetArray("operations", canvas.Log());

diff --git a/third_party/WebKit/Source/web/mac/WebScrollbarTheme.mm b/third_party/WebKit/Source/platform/scroll/WebScrollbarTheme.mm
similarity index 97%
rename from third_party/WebKit/Source/web/mac/WebScrollbarTheme.mm
rename to third_party/WebKit/Source/platform/scroll/WebScrollbarTheme.mm
index 5078b9a..3f54fdb 100644
--- a/third_party/WebKit/Source/web/mac/WebScrollbarTheme.mm
+++ b/third_party/WebKit/Source/platform/scroll/WebScrollbarTheme.mm

@@ -28,7 +28,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "public/web/mac/WebScrollbarTheme.h"
+#include "public/platform/mac/WebScrollbarTheme.h"
 
 #import <AppKit/AppKit.h>
 

diff --git a/third_party/WebKit/Source/web/BUILD.gn b/third_party/WebKit/Source/web/BUILD.gn
index 8ecaafd..3b8b0a1 100644
--- a/third_party/WebKit/Source/web/BUILD.gn
+++ b/third_party/WebKit/Source/web/BUILD.gn

@@ -80,18 +80,8 @@
     "WebSurroundingText.cpp",
     "WebViewImpl.cpp",
     "WebViewImpl.h",
-    "linux/WebFontRendering.cpp",
-    "mac/WebScrollbarTheme.mm",
-    "mac/WebSubstringUtil.mm",
-    "win/WebFontRendering.cpp",
   ]
 
-  if (is_android) {
-    set_sources_assignment_filter([])
-    sources += [ "linux/WebFontRendering.cpp" ]
-    set_sources_assignment_filter(sources_assignment_filter)
-  }
-
   if (is_mac) {
     libs = [
       "AppKit.framework",

diff --git a/third_party/WebKit/Source/web/PageOverlayTest.cpp b/third_party/WebKit/Source/web/PageOverlayTest.cpp
index 078be62..05d43be 100644
--- a/third_party/WebKit/Source/web/PageOverlayTest.cpp
+++ b/third_party/WebKit/Source/web/PageOverlayTest.cpp

@@ -146,7 +146,7 @@
   GraphicsContext graphics_context(paint_controller);
   graphics_context.BeginRecording(int_rect);
   paint_controller.GetPaintArtifact().Replay(int_rect, graphics_context);
-  graphics_context.EndRecording()->playback(&canvas);
+  graphics_context.EndRecording()->Playback(&canvas);
 }
 
 TEST_F(PageOverlayTest, PageOverlay_VisualRect) {

diff --git a/third_party/WebKit/Source/web/resources/OWNERS b/third_party/WebKit/Source/web/resources/OWNERS
deleted file mode 100644
index 53439ec87..0000000
--- a/third_party/WebKit/Source/web/resources/OWNERS
+++ /dev/null

@@ -1,5 +0,0 @@
-keishi@chromium.org
-tkent@chromium.org
-
-# TEAM: dom-dev@chromium.org
-# COMPONENT: Blink>Forms

diff --git a/third_party/WebKit/Source/web/tests/WebViewTest.cpp b/third_party/WebKit/Source/web/tests/WebViewTest.cpp
index b53d750b..accdbfd 100644
--- a/third_party/WebKit/Source/web/tests/WebViewTest.cpp
+++ b/third_party/WebKit/Source/web/tests/WebViewTest.cpp

@@ -502,7 +502,7 @@
   PaintLayerPainter(*root_layer)
       .PaintLayerContents(builder.Context(), painting_info,
                           kPaintLayerPaintingCompositingAllPhases);
-  builder.EndRecording()->playback(&canvas);
+  builder.EndRecording()->Playback(&canvas);
 
   // The result should be a blend of red and green.
   SkColor color = bitmap.getColor(kWidth / 2, kHeight / 2);

diff --git a/third_party/WebKit/public/BUILD.gn b/third_party/WebKit/public/BUILD.gn
index a4ea98d..4fbfdced 100644
--- a/third_party/WebKit/public/BUILD.gn
+++ b/third_party/WebKit/public/BUILD.gn

@@ -361,6 +361,7 @@
     "platform/linux/WebFontRenderStyle.h",
     "platform/linux/WebSandboxSupport.h",
     "platform/mac/WebSandboxSupport.h",
+    "platform/mac/WebScrollbarTheme.h",
     "platform/modules/background_fetch/WebBackgroundFetchSettledFetch.h",
     "platform/modules/device_orientation/WebDeviceMotionListener.h",
     "platform/modules/device_orientation/WebDeviceOrientationListener.h",
@@ -609,7 +610,6 @@
     "web/WebWidgetClient.h",
     "web/WebWindowFeatures.h",
     "web/linux/WebFontRendering.h",
-    "web/mac/WebScrollbarTheme.h",
     "web/mac/WebSubstringUtil.h",
     "web/mac/WebSubstringUtil.h",
     "web/modules/password_manager/WebFormElementObserver.h",

diff --git a/third_party/WebKit/public/blink_resources.grd b/third_party/WebKit/public/blink_resources.grd
index fd8e780..f975805 100644
--- a/third_party/WebKit/public/blink_resources.grd
+++ b/third_party/WebKit/public/blink_resources.grd

@@ -34,17 +34,17 @@
       <include name="IDR_DOCUMENTXMLTREEVIEWER_CSS" file="../Source/core/xml/DocumentXMLTreeViewer.css" type="BINDATA" compress="gzip"/>
       <include name="IDR_DOCUMENTXMLTREEVIEWER_JS" file="../Source/core/xml/DocumentXMLTreeViewer.js" type="BINDATA" compress="gzip"/>
       <if expr="not is_android">
-        <include name="IDR_PICKER_COMMON_JS" file="../Source/web/resources/pickerCommon.js" type="BINDATA" compress="gzip"/>
-        <include name="IDR_PICKER_COMMON_CSS" file="../Source/web/resources/pickerCommon.css" type="BINDATA" compress="gzip"/>
-        <include name="IDR_CALENDAR_PICKER_CSS" file="../Source/web/resources/calendarPicker.css" type="BINDATA" compress="gzip"/>
-        <include name="IDR_CALENDAR_PICKER_JS" file="../Source/web/resources/calendarPicker.js" type="BINDATA" compress="gzip"/>
-        <include name="IDR_PICKER_BUTTON_CSS" file="../Source/web/resources/pickerButton.css" type="BINDATA" compress="gzip"/>
-        <include name="IDR_SUGGESTION_PICKER_CSS" file="../Source/web/resources/suggestionPicker.css" type="BINDATA" compress="gzip"/>
-        <include name="IDR_SUGGESTION_PICKER_JS" file="../Source/web/resources/suggestionPicker.js" type="BINDATA" compress="gzip"/>
-        <include name="IDR_COLOR_SUGGESTION_PICKER_CSS" file="../Source/web/resources/colorSuggestionPicker.css" type="BINDATA" compress="gzip"/>
-        <include name="IDR_COLOR_SUGGESTION_PICKER_JS" file="../Source/web/resources/colorSuggestionPicker.js" type="BINDATA" compress="gzip"/>
-        <include name="IDR_LIST_PICKER_CSS" file="../Source/web/resources/listPicker.css" type="BINDATA" compress="gzip"/>
-        <include name="IDR_LIST_PICKER_JS" file="../Source/web/resources/listPicker.js" type="BINDATA" compress="gzip"/>
+        <include name="IDR_PICKER_COMMON_JS" file="../Source/core/html/forms/resources/pickerCommon.js" type="BINDATA" compress="gzip"/>
+        <include name="IDR_PICKER_COMMON_CSS" file="../Source/core/html/forms/resources/pickerCommon.css" type="BINDATA" compress="gzip"/>
+        <include name="IDR_CALENDAR_PICKER_CSS" file="../Source/core/html/forms/resources/calendarPicker.css" type="BINDATA" compress="gzip"/>
+        <include name="IDR_CALENDAR_PICKER_JS" file="../Source/core/html/forms/resources/calendarPicker.js" type="BINDATA" compress="gzip"/>
+        <include name="IDR_PICKER_BUTTON_CSS" file="../Source/core/html/forms/resources/pickerButton.css" type="BINDATA" compress="gzip"/>
+        <include name="IDR_SUGGESTION_PICKER_CSS" file="../Source/core/html/forms/resources/suggestionPicker.css" type="BINDATA" compress="gzip"/>
+        <include name="IDR_SUGGESTION_PICKER_JS" file="../Source/core/html/forms/resources/suggestionPicker.js" type="BINDATA" compress="gzip"/>
+        <include name="IDR_COLOR_SUGGESTION_PICKER_CSS" file="../Source/core/html/forms/resources/colorSuggestionPicker.css" type="BINDATA" compress="gzip"/>
+        <include name="IDR_COLOR_SUGGESTION_PICKER_JS" file="../Source/core/html/forms/resources/colorSuggestionPicker.js" type="BINDATA" compress="gzip"/>
+        <include name="IDR_LIST_PICKER_CSS" file="../Source/core/html/forms/resources/listPicker.css" type="BINDATA" compress="gzip"/>
+        <include name="IDR_LIST_PICKER_JS" file="../Source/core/html/forms/resources/listPicker.js" type="BINDATA" compress="gzip"/>
       </if>
       <include name="IDR_AUDIO_SPATIALIZATION_COMPOSITE" file="../Source/platform/audio/resources/Composite.flac" type="BINDATA"/>
     </includes>

diff --git a/third_party/WebKit/public/web/mac/WebScrollbarTheme.h b/third_party/WebKit/public/platform/mac/WebScrollbarTheme.h
similarity index 100%
rename from third_party/WebKit/public/web/mac/WebScrollbarTheme.h
rename to third_party/WebKit/public/platform/mac/WebScrollbarTheme.h


diff --git a/third_party/boringssl/ios-aarch64/crypto/fipsmodule/sha1-armv8.S b/third_party/boringssl/ios-aarch64/crypto/fipsmodule/sha1-armv8.S
index 00a8f10..de9cdf86 100644
--- a/third_party/boringssl/ios-aarch64/crypto/fipsmodule/sha1-armv8.S
+++ b/third_party/boringssl/ios-aarch64/crypto/fipsmodule/sha1-armv8.S

@@ -8,7 +8,11 @@
 
 .align	6
 _sha1_block_data_order:
+#ifdef	__ILP32__
+	ldrsw	x16,LOPENSSL_armcap_P
+#else
 	ldr	x16,LOPENSSL_armcap_P
+#endif
 	adr	x17,LOPENSSL_armcap_P
 	add	x16,x16,x17
 	ldr	w16,[x16]
@@ -1207,7 +1211,11 @@
 .long	0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc	//K_40_59
 .long	0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6	//K_60_79
 LOPENSSL_armcap_P:
+#ifdef	__ILP32__
+.long	_OPENSSL_armcap_P-.
+#else
 .quad	_OPENSSL_armcap_P-.
+#endif
 .byte	83,72,65,49,32,98,108,111,99,107,32,116,114,97,110,115,102,111,114,109,32,102,111,114,32,65,82,77,118,56,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46,111,114,103,62,0
 .align	2
 .align	2

diff --git a/third_party/boringssl/ios-aarch64/crypto/fipsmodule/sha256-armv8.S b/third_party/boringssl/ios-aarch64/crypto/fipsmodule/sha256-armv8.S
index e70d6ba..43811dd 100644
--- a/third_party/boringssl/ios-aarch64/crypto/fipsmodule/sha256-armv8.S
+++ b/third_party/boringssl/ios-aarch64/crypto/fipsmodule/sha256-armv8.S

@@ -1,4 +1,45 @@
-#include <openssl/arm_arch.h>
+// Copyright 2014-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the OpenSSL license (the "License").  You may not use
+// this file except in compliance with the License.  You can obtain a copy
+// in the file LICENSE in the source distribution or at
+// https://www.openssl.org/source/license.html
+
+// ====================================================================
+// Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
+// project. The module is, however, dual licensed under OpenSSL and
+// CRYPTOGAMS licenses depending on where you obtain it. For further
+// details see http://www.openssl.org/~appro/cryptogams/.
+//
+// Permission to use under GPLv2 terms is granted.
+// ====================================================================
+//
+// SHA256/512 for ARMv8.
+//
+// Performance in cycles per processed byte and improvement coefficient
+// over code generated with "default" compiler:
+//
+//		SHA256-hw	SHA256(*)	SHA512
+// Apple A7	1.97		10.5 (+33%)	6.73 (-1%(**))
+// Cortex-A53	2.38		15.5 (+115%)	10.0 (+150%(***))
+// Cortex-A57	2.31		11.6 (+86%)	7.51 (+260%(***))
+// Denver	2.01		10.5 (+26%)	6.70 (+8%)
+// X-Gene			20.0 (+100%)	12.8 (+300%(***))
+// Mongoose	2.36		13.0 (+50%)	8.36 (+33%)
+//
+// (*)	Software SHA256 results are of lesser relevance, presented
+//	mostly for informational purposes.
+// (**)	The result is a trade-off: it's possible to improve it by
+//	10% (or by 1 cycle per round), but at the cost of 20% loss
+//	on Cortex-A53 (or by 4 cycles per round).
+// (***)	Super-impressive coefficients over gcc-generated code are
+//	indication of some compiler "pathology", most notably code
+//	generated with -mgeneral-regs-only is significanty faster
+//	and the gap is only 40-90%.
+
+#ifndef	__KERNEL__
+# include <openssl/arm_arch.h>
+#endif
 
 .text
 
@@ -8,12 +49,18 @@
 
 .align	6
 _sha256_block_data_order:
+#ifndef	__KERNEL__
+# ifdef	__ILP32__
+	ldrsw	x16,LOPENSSL_armcap_P
+# else
 	ldr	x16,LOPENSSL_armcap_P
+# endif
 	adr	x17,LOPENSSL_armcap_P
 	add	x16,x16,x17
 	ldr	w16,[x16]
 	tst	w16,#ARMV8_SHA256
 	b.ne	Lv8_entry
+#endif
 	stp	x29,x30,[sp,#-128]!
 	add	x29,sp,#0
 
@@ -997,12 +1044,19 @@
 .long	0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2
 .long	0	//terminator
 
+#ifndef	__KERNEL__
 .align	3
 LOPENSSL_armcap_P:
+# ifdef	__ILP32__
+.long	_OPENSSL_armcap_P-.
+# else
 .quad	_OPENSSL_armcap_P-.
+# endif
+#endif
 .byte	83,72,65,50,53,54,32,98,108,111,99,107,32,116,114,97,110,115,102,111,114,109,32,102,111,114,32,65,82,77,118,56,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46,111,114,103,62,0
 .align	2
 .align	2
+#ifndef	__KERNEL__
 
 .align	6
 sha256_block_armv8:
@@ -1141,4 +1195,7 @@
 	ldr	x29,[sp],#16
 	ret
 
+#endif
+#ifndef	__KERNEL__
 .comm	_OPENSSL_armcap_P,4,4
+#endif

diff --git a/third_party/boringssl/ios-aarch64/crypto/fipsmodule/sha512-armv8.S b/third_party/boringssl/ios-aarch64/crypto/fipsmodule/sha512-armv8.S
index cc668e2..41159c38 100644
--- a/third_party/boringssl/ios-aarch64/crypto/fipsmodule/sha512-armv8.S
+++ b/third_party/boringssl/ios-aarch64/crypto/fipsmodule/sha512-armv8.S

@@ -1,4 +1,45 @@
-#include <openssl/arm_arch.h>
+// Copyright 2014-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the OpenSSL license (the "License").  You may not use
+// this file except in compliance with the License.  You can obtain a copy
+// in the file LICENSE in the source distribution or at
+// https://www.openssl.org/source/license.html
+
+// ====================================================================
+// Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
+// project. The module is, however, dual licensed under OpenSSL and
+// CRYPTOGAMS licenses depending on where you obtain it. For further
+// details see http://www.openssl.org/~appro/cryptogams/.
+//
+// Permission to use under GPLv2 terms is granted.
+// ====================================================================
+//
+// SHA256/512 for ARMv8.
+//
+// Performance in cycles per processed byte and improvement coefficient
+// over code generated with "default" compiler:
+//
+//		SHA256-hw	SHA256(*)	SHA512
+// Apple A7	1.97		10.5 (+33%)	6.73 (-1%(**))
+// Cortex-A53	2.38		15.5 (+115%)	10.0 (+150%(***))
+// Cortex-A57	2.31		11.6 (+86%)	7.51 (+260%(***))
+// Denver	2.01		10.5 (+26%)	6.70 (+8%)
+// X-Gene			20.0 (+100%)	12.8 (+300%(***))
+// Mongoose	2.36		13.0 (+50%)	8.36 (+33%)
+//
+// (*)	Software SHA256 results are of lesser relevance, presented
+//	mostly for informational purposes.
+// (**)	The result is a trade-off: it's possible to improve it by
+//	10% (or by 1 cycle per round), but at the cost of 20% loss
+//	on Cortex-A53 (or by 4 cycles per round).
+// (***)	Super-impressive coefficients over gcc-generated code are
+//	indication of some compiler "pathology", most notably code
+//	generated with -mgeneral-regs-only is significanty faster
+//	and the gap is only 40-90%.
+
+#ifndef	__KERNEL__
+# include <openssl/arm_arch.h>
+#endif
 
 .text
 
@@ -1015,10 +1056,18 @@
 .quad	0x5fcb6fab3ad6faec,0x6c44198c4a475817
 .quad	0	// terminator
 
+#ifndef	__KERNEL__
 .align	3
 LOPENSSL_armcap_P:
+# ifdef	__ILP32__
+.long	_OPENSSL_armcap_P-.
+# else
 .quad	_OPENSSL_armcap_P-.
+# endif
+#endif
 .byte	83,72,65,53,49,50,32,98,108,111,99,107,32,116,114,97,110,115,102,111,114,109,32,102,111,114,32,65,82,77,118,56,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46,111,114,103,62,0
 .align	2
 .align	2
+#ifndef	__KERNEL__
 .comm	_OPENSSL_armcap_P,4,4
+#endif

diff --git a/third_party/boringssl/ios-arm/crypto/chacha/chacha-armv4.S b/third_party/boringssl/ios-arm/crypto/chacha/chacha-armv4.S
index 3eaecba..ec3555de 100644
--- a/third_party/boringssl/ios-arm/crypto/chacha/chacha-armv4.S
+++ b/third_party/boringssl/ios-arm/crypto/chacha/chacha-armv4.S

@@ -26,7 +26,9 @@
 
 .globl	_ChaCha20_ctr32
 .private_extern	_ChaCha20_ctr32
-
+#ifdef __thumb2__
+.thumb_func	_ChaCha20_ctr32
+#endif
 .align	5
 _ChaCha20_ctr32:
 LChaCha20_ctr32:
@@ -791,7 +793,9 @@
 
 
 
-
+#ifdef __thumb2__
+.thumb_func	ChaCha20_neon
+#endif
 .align	5
 ChaCha20_neon:
 	ldr	r12,[sp,#0]		@ pull pointer to counter and nonce

diff --git a/third_party/boringssl/ios-arm/crypto/fipsmodule/aes-armv4.S b/third_party/boringssl/ios-arm/crypto/fipsmodule/aes-armv4.S
index c9a23f27..2e6c7efa 100644
--- a/third_party/boringssl/ios-arm/crypto/fipsmodule/aes-armv4.S
+++ b/third_party/boringssl/ios-arm/crypto/fipsmodule/aes-armv4.S

@@ -1,3 +1,10 @@
+@ Copyright 2007-2016 The OpenSSL Project Authors. All Rights Reserved.
+@
+@ Licensed under the OpenSSL license (the "License").  You may not use
+@ this file except in compliance with the License.  You can obtain a copy
+@ in the file LICENSE in the source distribution or at
+@ https://www.openssl.org/source/license.html
+
 
 @ ====================================================================
 @ Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
@@ -38,15 +45,12 @@
 #endif
 
 .text
-#if __ARM_ARCH__<7
-.code	32
-#else
+#if defined(__thumb2__) && !defined(__APPLE__)
 .syntax	unified
-# if defined(__thumb2__) && !defined(__APPLE__)
 .thumb
-# else
+#else
 .code	32
-# endif
+#undef __thumb2__
 #endif
 
 
@@ -159,10 +163,12 @@
 @ 		       const AES_KEY *key) {
 .globl	_asm_AES_encrypt
 .private_extern	_asm_AES_encrypt
-
+#ifdef __thumb2__
+.thumb_func	_asm_AES_encrypt
+#endif
 .align	5
 _asm_AES_encrypt:
-#if __ARM_ARCH__<7
+#ifndef	__thumb2__
 	sub	r3,pc,#8		@ _asm_AES_encrypt
 #else
 	adr	r3,_asm_AES_encrypt
@@ -270,7 +276,9 @@
 #endif
 
 
-
+#ifdef __thumb2__
+.thumb_func	_armv4_AES_encrypt
+#endif
 .align	2
 _armv4_AES_encrypt:
 	str	lr,[sp,#-4]!		@ push lr
@@ -409,23 +417,25 @@
 
 .globl	_asm_AES_set_encrypt_key
 .private_extern	_asm_AES_set_encrypt_key
-
+#ifdef __thumb2__
+.thumb_func	_asm_AES_set_encrypt_key
+#endif
 .align	5
 _asm_AES_set_encrypt_key:
 _armv4_AES_set_encrypt_key:
-#if __ARM_ARCH__<7
+#ifndef	__thumb2__
 	sub	r3,pc,#8		@ _asm_AES_set_encrypt_key
 #else
 	adr	r3,_asm_AES_set_encrypt_key
 #endif
 	teq	r0,#0
-#if __ARM_ARCH__>=7
+#ifdef	__thumb2__
 	itt	eq			@ Thumb2 thing, sanity check in ARM
 #endif
 	moveq	r0,#-1
 	beq	Labrt
 	teq	r2,#0
-#if __ARM_ARCH__>=7
+#ifdef	__thumb2__
 	itt	eq			@ Thumb2 thing, sanity check in ARM
 #endif
 	moveq	r0,#-1
@@ -436,7 +446,7 @@
 	teq	r1,#192
 	beq	Lok
 	teq	r1,#256
-#if __ARM_ARCH__>=7
+#ifdef	__thumb2__
 	itt	ne			@ Thumb2 thing, sanity check in ARM
 #endif
 	movne	r0,#-1
@@ -597,7 +607,7 @@
 	str	r2,[r11,#-16]
 	subs	r12,r12,#1
 	str	r3,[r11,#-12]
-#if __ARM_ARCH__>=7
+#ifdef	__thumb2__
 	itt	eq				@ Thumb2 thing, sanity check in ARM
 #endif
 	subeq	r2,r11,#216
@@ -669,7 +679,7 @@
 	str	r2,[r11,#-24]
 	subs	r12,r12,#1
 	str	r3,[r11,#-20]
-#if __ARM_ARCH__>=7
+#ifdef	__thumb2__
 	itt	eq				@ Thumb2 thing, sanity check in ARM
 #endif
 	subeq	r2,r11,#256
@@ -716,7 +726,9 @@
 
 .globl	_asm_AES_set_decrypt_key
 .private_extern	_asm_AES_set_decrypt_key
-
+#ifdef __thumb2__
+.thumb_func	_asm_AES_set_decrypt_key
+#endif
 .align	5
 _asm_AES_set_decrypt_key:
 	str	lr,[sp,#-4]!            @ push lr
@@ -733,7 +745,9 @@
 @ void AES_set_enc2dec_key(const AES_KEY *inp,AES_KEY *out)
 .globl	_AES_set_enc2dec_key
 .private_extern	_AES_set_enc2dec_key
-
+#ifdef __thumb2__
+.thumb_func	_AES_set_enc2dec_key
+#endif
 .align	5
 _AES_set_enc2dec_key:
 _armv4_AES_set_enc2dec_key:
@@ -742,7 +756,7 @@
 	ldr	r12,[r0,#240]
 	mov	r7,r0			@ input
 	add	r8,r0,r12,lsl#4
-	mov	r11,r1			@ ouput
+	mov	r11,r1			@ output
 	add	r10,r1,r12,lsl#4
 	str	r12,[r1,#240]
 
@@ -934,10 +948,12 @@
 @ 		       const AES_KEY *key) {
 .globl	_asm_AES_decrypt
 .private_extern	_asm_AES_decrypt
-
+#ifdef __thumb2__
+.thumb_func	_asm_AES_decrypt
+#endif
 .align	5
 _asm_AES_decrypt:
-#if __ARM_ARCH__<7
+#ifndef	__thumb2__
 	sub	r3,pc,#8		@ _asm_AES_decrypt
 #else
 	adr	r3,_asm_AES_decrypt
@@ -1045,7 +1061,9 @@
 #endif
 
 
-
+#ifdef __thumb2__
+.thumb_func	_armv4_AES_decrypt
+#endif
 .align	2
 _armv4_AES_decrypt:
 	str	lr,[sp,#-4]!		@ push lr

diff --git a/third_party/boringssl/ios-arm/crypto/fipsmodule/aesv8-armx32.S b/third_party/boringssl/ios-arm/crypto/fipsmodule/aesv8-armx32.S
index 9f7aacd..d44c88c 100644
--- a/third_party/boringssl/ios-arm/crypto/fipsmodule/aesv8-armx32.S
+++ b/third_party/boringssl/ios-arm/crypto/fipsmodule/aesv8-armx32.S

@@ -5,6 +5,7 @@
 
 
 .code	32
+#undef	__thumb2__
 .align	5
 Lrcon:
 .long	0x01,0x01,0x01,0x01
@@ -13,7 +14,9 @@
 
 .globl	_aes_hw_set_encrypt_key
 .private_extern	_aes_hw_set_encrypt_key
-
+#ifdef __thumb2__
+.thumb_func	_aes_hw_set_encrypt_key
+#endif
 .align	5
 _aes_hw_set_encrypt_key:
 Lenc_key:
@@ -184,7 +187,9 @@
 
 .globl	_aes_hw_set_decrypt_key
 .private_extern	_aes_hw_set_decrypt_key
-
+#ifdef __thumb2__
+.thumb_func	_aes_hw_set_decrypt_key
+#endif
 .align	5
 _aes_hw_set_decrypt_key:
 	stmdb	sp!,{r4,lr}
@@ -222,7 +227,9 @@
 
 .globl	_aes_hw_encrypt
 .private_extern	_aes_hw_encrypt
-
+#ifdef __thumb2__
+.thumb_func	_aes_hw_encrypt
+#endif
 .align	5
 _aes_hw_encrypt:
 	ldr	r3,[r2,#240]
@@ -252,7 +259,9 @@
 
 .globl	_aes_hw_decrypt
 .private_extern	_aes_hw_decrypt
-
+#ifdef __thumb2__
+.thumb_func	_aes_hw_decrypt
+#endif
 .align	5
 _aes_hw_decrypt:
 	ldr	r3,[r2,#240]
@@ -282,7 +291,9 @@
 
 .globl	_aes_hw_cbc_encrypt
 .private_extern	_aes_hw_cbc_encrypt
-
+#ifdef __thumb2__
+.thumb_func	_aes_hw_cbc_encrypt
+#endif
 .align	5
 _aes_hw_cbc_encrypt:
 	mov	ip,sp
@@ -575,7 +586,9 @@
 
 .globl	_aes_hw_ctr32_encrypt_blocks
 .private_extern	_aes_hw_ctr32_encrypt_blocks
-
+#ifdef __thumb2__
+.thumb_func	_aes_hw_ctr32_encrypt_blocks
+#endif
 .align	5
 _aes_hw_ctr32_encrypt_blocks:
 	mov	ip,sp

diff --git a/third_party/boringssl/ios-arm/crypto/fipsmodule/armv4-mont.S b/third_party/boringssl/ios-arm/crypto/fipsmodule/armv4-mont.S
index ba6c2a56..1d516ef 100644
--- a/third_party/boringssl/ios-arm/crypto/fipsmodule/armv4-mont.S
+++ b/third_party/boringssl/ios-arm/crypto/fipsmodule/armv4-mont.S

@@ -1,7 +1,12 @@
 #include <openssl/arm_arch.h>
 
 .text
+#if defined(__thumb2__)
+.syntax	unified
+.thumb
+#else
 .code	32
+#endif
 
 #if __ARM_MAX_ARCH__>=7
 .align	5
@@ -11,7 +16,9 @@
 
 .globl	_bn_mul_mont
 .private_extern	_bn_mul_mont
-
+#ifdef __thumb2__
+.thumb_func	_bn_mul_mont
+#endif
 
 .align	5
 _bn_mul_mont:
@@ -21,7 +28,7 @@
 #if __ARM_MAX_ARCH__>=7
 	tst	ip,#7
 	bne	Lialu
-	adr	r0,_bn_mul_mont
+	adr	r0,Lbn_mul_mont
 	ldr	r2,LOPENSSL_armcap
 	ldr	r0,[r0,r2]
 #ifdef	__APPLE__
@@ -37,6 +44,9 @@
 #endif
 	cmp	ip,#2
 	mov	r0,ip			@ load num
+#ifdef	__thumb2__
+	ittt	lt
+#endif
 	movlt	r0,#0
 	addlt	sp,sp,#2*4
 	blt	Labrt
@@ -84,10 +94,11 @@
 	ldr	r8,[r0,#14*4]		@ restore n0
 	adc	r14,r14,#0
 	str	r12,[r0]		@ tp[num-1]=
+	mov	r7,sp
 	str	r14,[r0,#4]		@ tp[num]=
 
 Louter:
-	sub	r7,r0,sp		@ "original" r0-1 value
+	sub	r7,r0,r7		@ "original" r0-1 value
 	sub	r1,r1,r7		@ "rewind" ap to &ap[1]
 	ldr	r2,[r4,#4]!		@ *(++bp)
 	sub	r3,r3,r7		@ "rewind" np to &np[1]
@@ -132,11 +143,16 @@
 	str	r14,[r0,#4]		@ tp[num]=
 
 	cmp	r4,r7
+#ifdef	__thumb2__
+	itt	ne
+#endif
+	movne	r7,sp
 	bne	Louter
 
 	ldr	r2,[r0,#12*4]		@ pull rp
+	mov	r5,sp
 	add	r0,r0,#4		@ r0 to point at &tp[num]
-	sub	r5,r0,sp		@ "original" num value
+	sub	r5,r0,r5		@ "original" num value
 	mov	r4,sp			@ "rewind" r4
 	mov	r1,r4			@ "borrow" r1
 	sub	r3,r3,r5		@ "rewind" r3 to &np[0]
@@ -162,13 +178,14 @@
 	cmp	r4,r0
 	bne	Lcopy
 
-	add	sp,r0,#4		@ skip over tp[num+1]
+	mov	sp,r0
+	add	sp,sp,#4		@ skip over tp[num+1]
 	ldmia	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,r12,lr}		@ restore registers
 	add	sp,sp,#2*4		@ skip over {r0,r2}
 	mov	r0,#1
 Labrt:
 #if __ARM_ARCH__>=5
-	bx	lr				@ .word	0xe12fff1e
+	bx	lr				@ bx lr
 #else
 	tst	lr,#1
 	moveq	pc,lr			@ be binary compatible with V4, yet
@@ -179,34 +196,40 @@
 
 
 
-
+#ifdef __thumb2__
+.thumb_func	bn_mul8x_mont_neon
+#endif
 .align	5
 bn_mul8x_mont_neon:
 	mov	ip,sp
 	stmdb	sp!,{r4,r5,r6,r7,r8,r9,r10,r11}
 	vstmdb	sp!,{d8,d9,d10,d11,d12,d13,d14,d15}		@ ABI specification says so
 	ldmia	ip,{r4,r5}		@ load rest of parameter block
+	mov	ip,sp
 
-	sub	r7,sp,#16
+	cmp	r5,#8
+	bhi	LNEON_8n
+
+	@ special case for r5==8, everything is in register bank...
+
 	vld1.32	{d28[0]}, [r2,:32]!
-	sub	r7,r7,r5,lsl#4
+	veor	d8,d8,d8
+	sub	r7,sp,r5,lsl#4
 	vld1.32	{d0,d1,d2,d3},  [r1]!		@ can't specify :32 :-(
 	and	r7,r7,#-64
 	vld1.32	{d30[0]}, [r4,:32]
 	mov	sp,r7			@ alloca
-	veor	d8,d8,d8
-	subs	r8,r5,#8
 	vzip.16	d28,d8
 
 	vmull.u32	q6,d28,d0[0]
 	vmull.u32	q7,d28,d0[1]
 	vmull.u32	q8,d28,d1[0]
-	vshl.i64	d10,d13,#16
+	vshl.i64	d29,d13,#16
 	vmull.u32	q9,d28,d1[1]
 
-	vadd.u64	d10,d10,d12
+	vadd.u64	d29,d29,d12
 	veor	d8,d8,d8
-	vmul.u32	d29,d10,d30
+	vmul.u32	d29,d29,d30
 
 	vmull.u32	q10,d28,d2[0]
 	vld1.32	{d4,d5,d6,d7}, [r3]!
@@ -215,10 +238,6 @@
 	vzip.16	d29,d8
 	vmull.u32	q13,d28,d3[1]
 
-	bne	LNEON_1st
-
-	@ special case for num=8, everything is in register bank...
-
 	vmlal.u32	q6,d29,d4[0]
 	sub	r9,r5,#1
 	vmlal.u32	q7,d29,d4[1]
@@ -254,13 +273,13 @@
 	vmlal.u32	q6,d28,d0[0]
 	vmlal.u32	q7,d28,d0[1]
 	vmlal.u32	q8,d28,d1[0]
-	vshl.i64	d10,d13,#16
+	vshl.i64	d29,d13,#16
 	vmlal.u32	q9,d28,d1[1]
 
-	vadd.u64	d10,d10,d12
+	vadd.u64	d29,d29,d12
 	veor	d8,d8,d8
 	subs	r9,r9,#1
-	vmul.u32	d29,d10,d30
+	vmul.u32	d29,d29,d30
 
 	vmlal.u32	q10,d28,d2[0]
 	vmlal.u32	q11,d28,d2[1]
@@ -297,231 +316,576 @@
 	vshr.u64	d10,d12,#16
 	mov	r8,r5
 	vadd.u64	d13,d13,d10
-	add	r6,sp,#16
+	add	r6,sp,#96
 	vshr.u64	d10,d13,#16
 	vzip.16	d12,d13
 
-	b	LNEON_tail2
+	b	LNEON_tail_entry
 
 .align	4
-LNEON_1st:
-	vmlal.u32	q6,d29,d4[0]
-	vld1.32	{d0,d1,d2,d3}, [r1]!
-	vmlal.u32	q7,d29,d4[1]
-	subs	r8,r8,#8
-	vmlal.u32	q8,d29,d5[0]
-	vmlal.u32	q9,d29,d5[1]
-
-	vmlal.u32	q10,d29,d6[0]
-	vld1.32	{d4,d5}, [r3]!
-	vmlal.u32	q11,d29,d6[1]
-	vst1.64	{q6,q7}, [r7,:256]!
-	vmlal.u32	q12,d29,d7[0]
-	vmlal.u32	q13,d29,d7[1]
-	vst1.64	{q8,q9}, [r7,:256]!
-
-	vmull.u32	q6,d28,d0[0]
-	vld1.32	{d6,d7}, [r3]!
-	vmull.u32	q7,d28,d0[1]
-	vst1.64	{q10,q11}, [r7,:256]!
-	vmull.u32	q8,d28,d1[0]
-	vmull.u32	q9,d28,d1[1]
-	vst1.64	{q12,q13}, [r7,:256]!
-
-	vmull.u32	q10,d28,d2[0]
-	vmull.u32	q11,d28,d2[1]
-	vmull.u32	q12,d28,d3[0]
-	vmull.u32	q13,d28,d3[1]
-
-	bne	LNEON_1st
-
-	vmlal.u32	q6,d29,d4[0]
-	add	r6,sp,#16
-	vmlal.u32	q7,d29,d4[1]
-	sub	r1,r1,r5,lsl#2		@ rewind r1
-	vmlal.u32	q8,d29,d5[0]
-	vld1.64	{q5}, [sp,:128]
-	vmlal.u32	q9,d29,d5[1]
-	sub	r9,r5,#1
-
-	vmlal.u32	q10,d29,d6[0]
-	vst1.64	{q6,q7}, [r7,:256]!
-	vmlal.u32	q11,d29,d6[1]
-	vshr.u64	d10,d10,#16
-	vld1.64	{q6},       [r6, :128]!
-	vmlal.u32	q12,d29,d7[0]
-	vst1.64	{q8,q9}, [r7,:256]!
-	vmlal.u32	q13,d29,d7[1]
-
-	vst1.64	{q10,q11}, [r7,:256]!
-	vadd.u64	d10,d10,d11
-	veor	q4,q4,q4
-	vst1.64	{q12,q13}, [r7,:256]!
-	vld1.64	{q7,q8}, [r6, :256]!
-	vst1.64	{q4},          [r7,:128]
-	vshr.u64	d10,d10,#16
-
-	b	LNEON_outer
-
-.align	4
-LNEON_outer:
-	vld1.32	{d28[0]}, [r2,:32]!
-	sub	r3,r3,r5,lsl#2		@ rewind r3
-	vld1.32	{d0,d1,d2,d3},  [r1]!
-	veor	d8,d8,d8
-	mov	r7,sp
-	vzip.16	d28,d8
+LNEON_8n:
+	veor	q6,q6,q6
+	sub	r7,sp,#128
+	veor	q7,q7,q7
+	sub	r7,r7,r5,lsl#4
+	veor	q8,q8,q8
+	and	r7,r7,#-64
+	veor	q9,q9,q9
+	mov	sp,r7			@ alloca
+	veor	q10,q10,q10
+	add	r7,r7,#256
+	veor	q11,q11,q11
 	sub	r8,r5,#8
-	vadd.u64	d12,d12,d10
+	veor	q12,q12,q12
+	veor	q13,q13,q13
+
+LNEON_8n_init:
+	vst1.64	{q6,q7},[r7,:256]!
+	subs	r8,r8,#8
+	vst1.64	{q8,q9},[r7,:256]!
+	vst1.64	{q10,q11},[r7,:256]!
+	vst1.64	{q12,q13},[r7,:256]!
+	bne	LNEON_8n_init
+
+	add	r6,sp,#256
+	vld1.32	{d0,d1,d2,d3},[r1]!
+	add	r10,sp,#8
+	vld1.32	{d30[0]},[r4,:32]
+	mov	r9,r5
+	b	LNEON_8n_outer
+
+.align	4
+LNEON_8n_outer:
+	vld1.32	{d28[0]},[r2,:32]!	@ *b++
+	veor	d8,d8,d8
+	vzip.16	d28,d8
+	add	r7,sp,#128
+	vld1.32	{d4,d5,d6,d7},[r3]!
 
 	vmlal.u32	q6,d28,d0[0]
-	vld1.64	{q9,q10},[r6,:256]!
 	vmlal.u32	q7,d28,d0[1]
-	vmlal.u32	q8,d28,d1[0]
-	vld1.64	{q11,q12},[r6,:256]!
-	vmlal.u32	q9,d28,d1[1]
-
-	vshl.i64	d10,d13,#16
 	veor	d8,d8,d8
-	vadd.u64	d10,d10,d12
-	vld1.64	{q13},[r6,:128]!
-	vmul.u32	d29,d10,d30
-
+	vmlal.u32	q8,d28,d1[0]
+	vshl.i64	d29,d13,#16
+	vmlal.u32	q9,d28,d1[1]
+	vadd.u64	d29,d29,d12
 	vmlal.u32	q10,d28,d2[0]
-	vld1.32	{d4,d5,d6,d7}, [r3]!
+	vmul.u32	d29,d29,d30
 	vmlal.u32	q11,d28,d2[1]
+	vst1.32	{d28},[sp,:64]		@ put aside smashed b[8*i+0]
 	vmlal.u32	q12,d28,d3[0]
 	vzip.16	d29,d8
 	vmlal.u32	q13,d28,d3[1]
-
-LNEON_inner:
+	vld1.32	{d28[0]},[r2,:32]!	@ *b++
 	vmlal.u32	q6,d29,d4[0]
-	vld1.32	{d0,d1,d2,d3}, [r1]!
+	veor	d10,d10,d10
 	vmlal.u32	q7,d29,d4[1]
-	subs	r8,r8,#8
+	vzip.16	d28,d10
 	vmlal.u32	q8,d29,d5[0]
+	vshr.u64	d12,d12,#16
 	vmlal.u32	q9,d29,d5[1]
-	vst1.64	{q6,q7}, [r7,:256]!
-
 	vmlal.u32	q10,d29,d6[0]
-	vld1.64	{q6},       [r6, :128]!
+	vadd.u64	d12,d12,d13
 	vmlal.u32	q11,d29,d6[1]
-	vst1.64	{q8,q9}, [r7,:256]!
+	vshr.u64	d12,d12,#16
 	vmlal.u32	q12,d29,d7[0]
-	vld1.64	{q7,q8}, [r6, :256]!
 	vmlal.u32	q13,d29,d7[1]
-	vst1.64	{q10,q11}, [r7,:256]!
+	vadd.u64	d14,d14,d12
+	vst1.32	{d29},[r10,:64]!	@ put aside smashed m[8*i+0]
+	vmlal.u32	q7,d28,d0[0]
+	vld1.64	{q6},[r6,:128]!
+	vmlal.u32	q8,d28,d0[1]
+	veor	d8,d8,d8
+	vmlal.u32	q9,d28,d1[0]
+	vshl.i64	d29,d15,#16
+	vmlal.u32	q10,d28,d1[1]
+	vadd.u64	d29,d29,d14
+	vmlal.u32	q11,d28,d2[0]
+	vmul.u32	d29,d29,d30
+	vmlal.u32	q12,d28,d2[1]
+	vst1.32	{d28},[r10,:64]!	@ put aside smashed b[8*i+1]
+	vmlal.u32	q13,d28,d3[0]
+	vzip.16	d29,d8
+	vmlal.u32	q6,d28,d3[1]
+	vld1.32	{d28[0]},[r2,:32]!	@ *b++
+	vmlal.u32	q7,d29,d4[0]
+	veor	d10,d10,d10
+	vmlal.u32	q8,d29,d4[1]
+	vzip.16	d28,d10
+	vmlal.u32	q9,d29,d5[0]
+	vshr.u64	d14,d14,#16
+	vmlal.u32	q10,d29,d5[1]
+	vmlal.u32	q11,d29,d6[0]
+	vadd.u64	d14,d14,d15
+	vmlal.u32	q12,d29,d6[1]
+	vshr.u64	d14,d14,#16
+	vmlal.u32	q13,d29,d7[0]
+	vmlal.u32	q6,d29,d7[1]
+	vadd.u64	d16,d16,d14
+	vst1.32	{d29},[r10,:64]!	@ put aside smashed m[8*i+1]
+	vmlal.u32	q8,d28,d0[0]
+	vld1.64	{q7},[r6,:128]!
+	vmlal.u32	q9,d28,d0[1]
+	veor	d8,d8,d8
+	vmlal.u32	q10,d28,d1[0]
+	vshl.i64	d29,d17,#16
+	vmlal.u32	q11,d28,d1[1]
+	vadd.u64	d29,d29,d16
+	vmlal.u32	q12,d28,d2[0]
+	vmul.u32	d29,d29,d30
+	vmlal.u32	q13,d28,d2[1]
+	vst1.32	{d28},[r10,:64]!	@ put aside smashed b[8*i+2]
+	vmlal.u32	q6,d28,d3[0]
+	vzip.16	d29,d8
+	vmlal.u32	q7,d28,d3[1]
+	vld1.32	{d28[0]},[r2,:32]!	@ *b++
+	vmlal.u32	q8,d29,d4[0]
+	veor	d10,d10,d10
+	vmlal.u32	q9,d29,d4[1]
+	vzip.16	d28,d10
+	vmlal.u32	q10,d29,d5[0]
+	vshr.u64	d16,d16,#16
+	vmlal.u32	q11,d29,d5[1]
+	vmlal.u32	q12,d29,d6[0]
+	vadd.u64	d16,d16,d17
+	vmlal.u32	q13,d29,d6[1]
+	vshr.u64	d16,d16,#16
+	vmlal.u32	q6,d29,d7[0]
+	vmlal.u32	q7,d29,d7[1]
+	vadd.u64	d18,d18,d16
+	vst1.32	{d29},[r10,:64]!	@ put aside smashed m[8*i+2]
+	vmlal.u32	q9,d28,d0[0]
+	vld1.64	{q8},[r6,:128]!
+	vmlal.u32	q10,d28,d0[1]
+	veor	d8,d8,d8
+	vmlal.u32	q11,d28,d1[0]
+	vshl.i64	d29,d19,#16
+	vmlal.u32	q12,d28,d1[1]
+	vadd.u64	d29,d29,d18
+	vmlal.u32	q13,d28,d2[0]
+	vmul.u32	d29,d29,d30
+	vmlal.u32	q6,d28,d2[1]
+	vst1.32	{d28},[r10,:64]!	@ put aside smashed b[8*i+3]
+	vmlal.u32	q7,d28,d3[0]
+	vzip.16	d29,d8
+	vmlal.u32	q8,d28,d3[1]
+	vld1.32	{d28[0]},[r2,:32]!	@ *b++
+	vmlal.u32	q9,d29,d4[0]
+	veor	d10,d10,d10
+	vmlal.u32	q10,d29,d4[1]
+	vzip.16	d28,d10
+	vmlal.u32	q11,d29,d5[0]
+	vshr.u64	d18,d18,#16
+	vmlal.u32	q12,d29,d5[1]
+	vmlal.u32	q13,d29,d6[0]
+	vadd.u64	d18,d18,d19
+	vmlal.u32	q6,d29,d6[1]
+	vshr.u64	d18,d18,#16
+	vmlal.u32	q7,d29,d7[0]
+	vmlal.u32	q8,d29,d7[1]
+	vadd.u64	d20,d20,d18
+	vst1.32	{d29},[r10,:64]!	@ put aside smashed m[8*i+3]
+	vmlal.u32	q10,d28,d0[0]
+	vld1.64	{q9},[r6,:128]!
+	vmlal.u32	q11,d28,d0[1]
+	veor	d8,d8,d8
+	vmlal.u32	q12,d28,d1[0]
+	vshl.i64	d29,d21,#16
+	vmlal.u32	q13,d28,d1[1]
+	vadd.u64	d29,d29,d20
+	vmlal.u32	q6,d28,d2[0]
+	vmul.u32	d29,d29,d30
+	vmlal.u32	q7,d28,d2[1]
+	vst1.32	{d28},[r10,:64]!	@ put aside smashed b[8*i+4]
+	vmlal.u32	q8,d28,d3[0]
+	vzip.16	d29,d8
+	vmlal.u32	q9,d28,d3[1]
+	vld1.32	{d28[0]},[r2,:32]!	@ *b++
+	vmlal.u32	q10,d29,d4[0]
+	veor	d10,d10,d10
+	vmlal.u32	q11,d29,d4[1]
+	vzip.16	d28,d10
+	vmlal.u32	q12,d29,d5[0]
+	vshr.u64	d20,d20,#16
+	vmlal.u32	q13,d29,d5[1]
+	vmlal.u32	q6,d29,d6[0]
+	vadd.u64	d20,d20,d21
+	vmlal.u32	q7,d29,d6[1]
+	vshr.u64	d20,d20,#16
+	vmlal.u32	q8,d29,d7[0]
+	vmlal.u32	q9,d29,d7[1]
+	vadd.u64	d22,d22,d20
+	vst1.32	{d29},[r10,:64]!	@ put aside smashed m[8*i+4]
+	vmlal.u32	q11,d28,d0[0]
+	vld1.64	{q10},[r6,:128]!
+	vmlal.u32	q12,d28,d0[1]
+	veor	d8,d8,d8
+	vmlal.u32	q13,d28,d1[0]
+	vshl.i64	d29,d23,#16
+	vmlal.u32	q6,d28,d1[1]
+	vadd.u64	d29,d29,d22
+	vmlal.u32	q7,d28,d2[0]
+	vmul.u32	d29,d29,d30
+	vmlal.u32	q8,d28,d2[1]
+	vst1.32	{d28},[r10,:64]!	@ put aside smashed b[8*i+5]
+	vmlal.u32	q9,d28,d3[0]
+	vzip.16	d29,d8
+	vmlal.u32	q10,d28,d3[1]
+	vld1.32	{d28[0]},[r2,:32]!	@ *b++
+	vmlal.u32	q11,d29,d4[0]
+	veor	d10,d10,d10
+	vmlal.u32	q12,d29,d4[1]
+	vzip.16	d28,d10
+	vmlal.u32	q13,d29,d5[0]
+	vshr.u64	d22,d22,#16
+	vmlal.u32	q6,d29,d5[1]
+	vmlal.u32	q7,d29,d6[0]
+	vadd.u64	d22,d22,d23
+	vmlal.u32	q8,d29,d6[1]
+	vshr.u64	d22,d22,#16
+	vmlal.u32	q9,d29,d7[0]
+	vmlal.u32	q10,d29,d7[1]
+	vadd.u64	d24,d24,d22
+	vst1.32	{d29},[r10,:64]!	@ put aside smashed m[8*i+5]
+	vmlal.u32	q12,d28,d0[0]
+	vld1.64	{q11},[r6,:128]!
+	vmlal.u32	q13,d28,d0[1]
+	veor	d8,d8,d8
+	vmlal.u32	q6,d28,d1[0]
+	vshl.i64	d29,d25,#16
+	vmlal.u32	q7,d28,d1[1]
+	vadd.u64	d29,d29,d24
+	vmlal.u32	q8,d28,d2[0]
+	vmul.u32	d29,d29,d30
+	vmlal.u32	q9,d28,d2[1]
+	vst1.32	{d28},[r10,:64]!	@ put aside smashed b[8*i+6]
+	vmlal.u32	q10,d28,d3[0]
+	vzip.16	d29,d8
+	vmlal.u32	q11,d28,d3[1]
+	vld1.32	{d28[0]},[r2,:32]!	@ *b++
+	vmlal.u32	q12,d29,d4[0]
+	veor	d10,d10,d10
+	vmlal.u32	q13,d29,d4[1]
+	vzip.16	d28,d10
+	vmlal.u32	q6,d29,d5[0]
+	vshr.u64	d24,d24,#16
+	vmlal.u32	q7,d29,d5[1]
+	vmlal.u32	q8,d29,d6[0]
+	vadd.u64	d24,d24,d25
+	vmlal.u32	q9,d29,d6[1]
+	vshr.u64	d24,d24,#16
+	vmlal.u32	q10,d29,d7[0]
+	vmlal.u32	q11,d29,d7[1]
+	vadd.u64	d26,d26,d24
+	vst1.32	{d29},[r10,:64]!	@ put aside smashed m[8*i+6]
+	vmlal.u32	q13,d28,d0[0]
+	vld1.64	{q12},[r6,:128]!
+	vmlal.u32	q6,d28,d0[1]
+	veor	d8,d8,d8
+	vmlal.u32	q7,d28,d1[0]
+	vshl.i64	d29,d27,#16
+	vmlal.u32	q8,d28,d1[1]
+	vadd.u64	d29,d29,d26
+	vmlal.u32	q9,d28,d2[0]
+	vmul.u32	d29,d29,d30
+	vmlal.u32	q10,d28,d2[1]
+	vst1.32	{d28},[r10,:64]!	@ put aside smashed b[8*i+7]
+	vmlal.u32	q11,d28,d3[0]
+	vzip.16	d29,d8
+	vmlal.u32	q12,d28,d3[1]
+	vld1.32	{d28},[sp,:64]		@ pull smashed b[8*i+0]
+	vmlal.u32	q13,d29,d4[0]
+	vld1.32	{d0,d1,d2,d3},[r1]!
+	vmlal.u32	q6,d29,d4[1]
+	vmlal.u32	q7,d29,d5[0]
+	vshr.u64	d26,d26,#16
+	vmlal.u32	q8,d29,d5[1]
+	vmlal.u32	q9,d29,d6[0]
+	vadd.u64	d26,d26,d27
+	vmlal.u32	q10,d29,d6[1]
+	vshr.u64	d26,d26,#16
+	vmlal.u32	q11,d29,d7[0]
+	vmlal.u32	q12,d29,d7[1]
+	vadd.u64	d12,d12,d26
+	vst1.32	{d29},[r10,:64]	@ put aside smashed m[8*i+7]
+	add	r10,sp,#8		@ rewind
+	sub	r8,r5,#8
+	b	LNEON_8n_inner
 
+.align	4
+LNEON_8n_inner:
+	subs	r8,r8,#8
 	vmlal.u32	q6,d28,d0[0]
-	vld1.64	{q9,q10}, [r6, :256]!
+	vld1.64	{q13},[r6,:128]
 	vmlal.u32	q7,d28,d0[1]
-	vst1.64	{q12,q13}, [r7,:256]!
+	vld1.32	{d29},[r10,:64]!	@ pull smashed m[8*i+0]
 	vmlal.u32	q8,d28,d1[0]
-	vld1.64	{q11,q12}, [r6, :256]!
+	vld1.32	{d4,d5,d6,d7},[r3]!
 	vmlal.u32	q9,d28,d1[1]
-	vld1.32	{d4,d5,d6,d7}, [r3]!
-
+	it	ne
+	addne	r6,r6,#16	@ don't advance in last iteration
 	vmlal.u32	q10,d28,d2[0]
-	vld1.64	{q13},       [r6, :128]!
 	vmlal.u32	q11,d28,d2[1]
 	vmlal.u32	q12,d28,d3[0]
 	vmlal.u32	q13,d28,d3[1]
-
-	bne	LNEON_inner
-
+	vld1.32	{d28},[r10,:64]!	@ pull smashed b[8*i+1]
 	vmlal.u32	q6,d29,d4[0]
-	add	r6,sp,#16
 	vmlal.u32	q7,d29,d4[1]
-	sub	r1,r1,r5,lsl#2		@ rewind r1
 	vmlal.u32	q8,d29,d5[0]
-	vld1.64	{q5}, [sp,:128]
 	vmlal.u32	q9,d29,d5[1]
-	subs	r9,r9,#1
-
 	vmlal.u32	q10,d29,d6[0]
-	vst1.64	{q6,q7}, [r7,:256]!
 	vmlal.u32	q11,d29,d6[1]
-	vld1.64	{q6},       [r6, :128]!
-	vshr.u64	d10,d10,#16
-	vst1.64	{q8,q9}, [r7,:256]!
 	vmlal.u32	q12,d29,d7[0]
-	vld1.64	{q7,q8}, [r6, :256]!
 	vmlal.u32	q13,d29,d7[1]
+	vst1.64	{q6},[r7,:128]!
+	vmlal.u32	q7,d28,d0[0]
+	vld1.64	{q6},[r6,:128]
+	vmlal.u32	q8,d28,d0[1]
+	vld1.32	{d29},[r10,:64]!	@ pull smashed m[8*i+1]
+	vmlal.u32	q9,d28,d1[0]
+	it	ne
+	addne	r6,r6,#16	@ don't advance in last iteration
+	vmlal.u32	q10,d28,d1[1]
+	vmlal.u32	q11,d28,d2[0]
+	vmlal.u32	q12,d28,d2[1]
+	vmlal.u32	q13,d28,d3[0]
+	vmlal.u32	q6,d28,d3[1]
+	vld1.32	{d28},[r10,:64]!	@ pull smashed b[8*i+2]
+	vmlal.u32	q7,d29,d4[0]
+	vmlal.u32	q8,d29,d4[1]
+	vmlal.u32	q9,d29,d5[0]
+	vmlal.u32	q10,d29,d5[1]
+	vmlal.u32	q11,d29,d6[0]
+	vmlal.u32	q12,d29,d6[1]
+	vmlal.u32	q13,d29,d7[0]
+	vmlal.u32	q6,d29,d7[1]
+	vst1.64	{q7},[r7,:128]!
+	vmlal.u32	q8,d28,d0[0]
+	vld1.64	{q7},[r6,:128]
+	vmlal.u32	q9,d28,d0[1]
+	vld1.32	{d29},[r10,:64]!	@ pull smashed m[8*i+2]
+	vmlal.u32	q10,d28,d1[0]
+	it	ne
+	addne	r6,r6,#16	@ don't advance in last iteration
+	vmlal.u32	q11,d28,d1[1]
+	vmlal.u32	q12,d28,d2[0]
+	vmlal.u32	q13,d28,d2[1]
+	vmlal.u32	q6,d28,d3[0]
+	vmlal.u32	q7,d28,d3[1]
+	vld1.32	{d28},[r10,:64]!	@ pull smashed b[8*i+3]
+	vmlal.u32	q8,d29,d4[0]
+	vmlal.u32	q9,d29,d4[1]
+	vmlal.u32	q10,d29,d5[0]
+	vmlal.u32	q11,d29,d5[1]
+	vmlal.u32	q12,d29,d6[0]
+	vmlal.u32	q13,d29,d6[1]
+	vmlal.u32	q6,d29,d7[0]
+	vmlal.u32	q7,d29,d7[1]
+	vst1.64	{q8},[r7,:128]!
+	vmlal.u32	q9,d28,d0[0]
+	vld1.64	{q8},[r6,:128]
+	vmlal.u32	q10,d28,d0[1]
+	vld1.32	{d29},[r10,:64]!	@ pull smashed m[8*i+3]
+	vmlal.u32	q11,d28,d1[0]
+	it	ne
+	addne	r6,r6,#16	@ don't advance in last iteration
+	vmlal.u32	q12,d28,d1[1]
+	vmlal.u32	q13,d28,d2[0]
+	vmlal.u32	q6,d28,d2[1]
+	vmlal.u32	q7,d28,d3[0]
+	vmlal.u32	q8,d28,d3[1]
+	vld1.32	{d28},[r10,:64]!	@ pull smashed b[8*i+4]
+	vmlal.u32	q9,d29,d4[0]
+	vmlal.u32	q10,d29,d4[1]
+	vmlal.u32	q11,d29,d5[0]
+	vmlal.u32	q12,d29,d5[1]
+	vmlal.u32	q13,d29,d6[0]
+	vmlal.u32	q6,d29,d6[1]
+	vmlal.u32	q7,d29,d7[0]
+	vmlal.u32	q8,d29,d7[1]
+	vst1.64	{q9},[r7,:128]!
+	vmlal.u32	q10,d28,d0[0]
+	vld1.64	{q9},[r6,:128]
+	vmlal.u32	q11,d28,d0[1]
+	vld1.32	{d29},[r10,:64]!	@ pull smashed m[8*i+4]
+	vmlal.u32	q12,d28,d1[0]
+	it	ne
+	addne	r6,r6,#16	@ don't advance in last iteration
+	vmlal.u32	q13,d28,d1[1]
+	vmlal.u32	q6,d28,d2[0]
+	vmlal.u32	q7,d28,d2[1]
+	vmlal.u32	q8,d28,d3[0]
+	vmlal.u32	q9,d28,d3[1]
+	vld1.32	{d28},[r10,:64]!	@ pull smashed b[8*i+5]
+	vmlal.u32	q10,d29,d4[0]
+	vmlal.u32	q11,d29,d4[1]
+	vmlal.u32	q12,d29,d5[0]
+	vmlal.u32	q13,d29,d5[1]
+	vmlal.u32	q6,d29,d6[0]
+	vmlal.u32	q7,d29,d6[1]
+	vmlal.u32	q8,d29,d7[0]
+	vmlal.u32	q9,d29,d7[1]
+	vst1.64	{q10},[r7,:128]!
+	vmlal.u32	q11,d28,d0[0]
+	vld1.64	{q10},[r6,:128]
+	vmlal.u32	q12,d28,d0[1]
+	vld1.32	{d29},[r10,:64]!	@ pull smashed m[8*i+5]
+	vmlal.u32	q13,d28,d1[0]
+	it	ne
+	addne	r6,r6,#16	@ don't advance in last iteration
+	vmlal.u32	q6,d28,d1[1]
+	vmlal.u32	q7,d28,d2[0]
+	vmlal.u32	q8,d28,d2[1]
+	vmlal.u32	q9,d28,d3[0]
+	vmlal.u32	q10,d28,d3[1]
+	vld1.32	{d28},[r10,:64]!	@ pull smashed b[8*i+6]
+	vmlal.u32	q11,d29,d4[0]
+	vmlal.u32	q12,d29,d4[1]
+	vmlal.u32	q13,d29,d5[0]
+	vmlal.u32	q6,d29,d5[1]
+	vmlal.u32	q7,d29,d6[0]
+	vmlal.u32	q8,d29,d6[1]
+	vmlal.u32	q9,d29,d7[0]
+	vmlal.u32	q10,d29,d7[1]
+	vst1.64	{q11},[r7,:128]!
+	vmlal.u32	q12,d28,d0[0]
+	vld1.64	{q11},[r6,:128]
+	vmlal.u32	q13,d28,d0[1]
+	vld1.32	{d29},[r10,:64]!	@ pull smashed m[8*i+6]
+	vmlal.u32	q6,d28,d1[0]
+	it	ne
+	addne	r6,r6,#16	@ don't advance in last iteration
+	vmlal.u32	q7,d28,d1[1]
+	vmlal.u32	q8,d28,d2[0]
+	vmlal.u32	q9,d28,d2[1]
+	vmlal.u32	q10,d28,d3[0]
+	vmlal.u32	q11,d28,d3[1]
+	vld1.32	{d28},[r10,:64]!	@ pull smashed b[8*i+7]
+	vmlal.u32	q12,d29,d4[0]
+	vmlal.u32	q13,d29,d4[1]
+	vmlal.u32	q6,d29,d5[0]
+	vmlal.u32	q7,d29,d5[1]
+	vmlal.u32	q8,d29,d6[0]
+	vmlal.u32	q9,d29,d6[1]
+	vmlal.u32	q10,d29,d7[0]
+	vmlal.u32	q11,d29,d7[1]
+	vst1.64	{q12},[r7,:128]!
+	vmlal.u32	q13,d28,d0[0]
+	vld1.64	{q12},[r6,:128]
+	vmlal.u32	q6,d28,d0[1]
+	vld1.32	{d29},[r10,:64]!	@ pull smashed m[8*i+7]
+	vmlal.u32	q7,d28,d1[0]
+	it	ne
+	addne	r6,r6,#16	@ don't advance in last iteration
+	vmlal.u32	q8,d28,d1[1]
+	vmlal.u32	q9,d28,d2[0]
+	vmlal.u32	q10,d28,d2[1]
+	vmlal.u32	q11,d28,d3[0]
+	vmlal.u32	q12,d28,d3[1]
+	it	eq
+	subeq	r1,r1,r5,lsl#2	@ rewind
+	vmlal.u32	q13,d29,d4[0]
+	vld1.32	{d28},[sp,:64]		@ pull smashed b[8*i+0]
+	vmlal.u32	q6,d29,d4[1]
+	vld1.32	{d0,d1,d2,d3},[r1]!
+	vmlal.u32	q7,d29,d5[0]
+	add	r10,sp,#8		@ rewind
+	vmlal.u32	q8,d29,d5[1]
+	vmlal.u32	q9,d29,d6[0]
+	vmlal.u32	q10,d29,d6[1]
+	vmlal.u32	q11,d29,d7[0]
+	vst1.64	{q13},[r7,:128]!
+	vmlal.u32	q12,d29,d7[1]
 
-	vst1.64	{q10,q11}, [r7,:256]!
-	vadd.u64	d10,d10,d11
-	vst1.64	{q12,q13}, [r7,:256]!
-	vshr.u64	d10,d10,#16
+	bne	LNEON_8n_inner
+	add	r6,sp,#128
+	vst1.64	{q6,q7},[r7,:256]!
+	veor	q2,q2,q2		@ d4-d5
+	vst1.64	{q8,q9},[r7,:256]!
+	veor	q3,q3,q3		@ d6-d7
+	vst1.64	{q10,q11},[r7,:256]!
+	vst1.64	{q12},[r7,:128]
 
-	bne	LNEON_outer
+	subs	r9,r9,#8
+	vld1.64	{q6,q7},[r6,:256]!
+	vld1.64	{q8,q9},[r6,:256]!
+	vld1.64	{q10,q11},[r6,:256]!
+	vld1.64	{q12,q13},[r6,:256]!
 
-	mov	r7,sp
-	mov	r8,r5
+	itt	ne
+	subne	r3,r3,r5,lsl#2	@ rewind
+	bne	LNEON_8n_outer
 
-LNEON_tail:
-	vadd.u64	d12,d12,d10
-	vld1.64	{q9,q10}, [r6, :256]!
+	add	r7,sp,#128
+	vst1.64	{q2,q3}, [sp,:256]!	@ start wiping stack frame
 	vshr.u64	d10,d12,#16
+	vst1.64	{q2,q3},[sp,:256]!
 	vadd.u64	d13,d13,d10
-	vld1.64	{q11,q12}, [r6, :256]!
+	vst1.64	{q2,q3}, [sp,:256]!
 	vshr.u64	d10,d13,#16
-	vld1.64	{q13},       [r6, :128]!
+	vst1.64	{q2,q3}, [sp,:256]!
 	vzip.16	d12,d13
 
-LNEON_tail2:
+	mov	r8,r5
+	b	LNEON_tail_entry
+
+.align	4
+LNEON_tail:
+	vadd.u64	d12,d12,d10
+	vshr.u64	d10,d12,#16
+	vld1.64	{q8,q9}, [r6, :256]!
+	vadd.u64	d13,d13,d10
+	vld1.64	{q10,q11}, [r6, :256]!
+	vshr.u64	d10,d13,#16
+	vld1.64	{q12,q13}, [r6, :256]!
+	vzip.16	d12,d13
+
+LNEON_tail_entry:
 	vadd.u64	d14,d14,d10
 	vst1.32	{d12[0]}, [r7, :32]!
 	vshr.u64	d10,d14,#16
 	vadd.u64	d15,d15,d10
 	vshr.u64	d10,d15,#16
 	vzip.16	d14,d15
-
 	vadd.u64	d16,d16,d10
 	vst1.32	{d14[0]}, [r7, :32]!
 	vshr.u64	d10,d16,#16
 	vadd.u64	d17,d17,d10
 	vshr.u64	d10,d17,#16
 	vzip.16	d16,d17
-
 	vadd.u64	d18,d18,d10
 	vst1.32	{d16[0]}, [r7, :32]!
 	vshr.u64	d10,d18,#16
 	vadd.u64	d19,d19,d10
 	vshr.u64	d10,d19,#16
 	vzip.16	d18,d19
-
 	vadd.u64	d20,d20,d10
 	vst1.32	{d18[0]}, [r7, :32]!
 	vshr.u64	d10,d20,#16
 	vadd.u64	d21,d21,d10
 	vshr.u64	d10,d21,#16
 	vzip.16	d20,d21
-
 	vadd.u64	d22,d22,d10
 	vst1.32	{d20[0]}, [r7, :32]!
 	vshr.u64	d10,d22,#16
 	vadd.u64	d23,d23,d10
 	vshr.u64	d10,d23,#16
 	vzip.16	d22,d23
-
 	vadd.u64	d24,d24,d10
 	vst1.32	{d22[0]}, [r7, :32]!
 	vshr.u64	d10,d24,#16
 	vadd.u64	d25,d25,d10
-	vld1.64	{q6}, [r6, :128]!
 	vshr.u64	d10,d25,#16
 	vzip.16	d24,d25
-
 	vadd.u64	d26,d26,d10
 	vst1.32	{d24[0]}, [r7, :32]!
 	vshr.u64	d10,d26,#16
 	vadd.u64	d27,d27,d10
-	vld1.64	{q7,q8},	[r6, :256]!
 	vshr.u64	d10,d27,#16
 	vzip.16	d26,d27
+	vld1.64	{q6,q7}, [r6, :256]!
 	subs	r8,r8,#8
-	vst1.32	{d26[0]}, [r7, :32]!
-
+	vst1.32	{d26[0]},   [r7, :32]!
 	bne	LNEON_tail
 
 	vst1.32	{d10[0]}, [r7, :32]		@ top-most bit
@@ -541,8 +905,9 @@
 	bne	LNEON_sub
 
 	ldr	r10, [r1]				@ load top-most bit
+	mov	r11,sp
 	veor	q0,q0,q0
-	sub	r11,r2,sp				@ this is num*4
+	sub	r11,r2,r11				@ this is num*4
 	veor	q1,q1,q1
 	mov	r1,sp
 	sub	r0,r0,r11				@ rewind r0
@@ -552,30 +917,36 @@
 LNEON_copy_n_zap:
 	ldmia	r1!, {r4,r5,r6,r7}
 	ldmia	r0,  {r8,r9,r10,r11}
+	it	cc
 	movcc	r8, r4
 	vst1.64	{q0,q1}, [r3,:256]!			@ wipe
+	itt	cc
 	movcc	r9, r5
 	movcc	r10,r6
 	vst1.64	{q0,q1}, [r3,:256]!			@ wipe
+	it	cc
 	movcc	r11,r7
 	ldmia	r1, {r4,r5,r6,r7}
 	stmia	r0!, {r8,r9,r10,r11}
 	sub	r1,r1,#16
 	ldmia	r0, {r8,r9,r10,r11}
+	it	cc
 	movcc	r8, r4
 	vst1.64	{q0,q1}, [r1,:256]!			@ wipe
+	itt	cc
 	movcc	r9, r5
 	movcc	r10,r6
 	vst1.64	{q0,q1}, [r3,:256]!			@ wipe
+	it	cc
 	movcc	r11,r7
 	teq	r1,r2				@ preserves carry
 	stmia	r0!, {r8,r9,r10,r11}
 	bne	LNEON_copy_n_zap
 
-	sub	sp,ip,#96
+	mov	sp,ip
 	vldmia	sp!,{d8,d9,d10,d11,d12,d13,d14,d15}
 	ldmia	sp!,{r4,r5,r6,r7,r8,r9,r10,r11}
-	bx	lr						@ .word	0xe12fff1e
+	bx	lr						@ bx lr
 
 #endif
 .byte	77,111,110,116,103,111,109,101,114,121,32,109,117,108,116,105,112,108,105,99,97,116,105,111,110,32,102,111,114,32,65,82,77,118,52,47,78,69,79,78,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46,111,114,103,62,0

diff --git a/third_party/boringssl/ios-arm/crypto/fipsmodule/bsaes-armv7.S b/third_party/boringssl/ios-arm/crypto/fipsmodule/bsaes-armv7.S
index 77cb269..1cf914c 100644
--- a/third_party/boringssl/ios-arm/crypto/fipsmodule/bsaes-armv7.S
+++ b/third_party/boringssl/ios-arm/crypto/fipsmodule/bsaes-armv7.S

@@ -86,7 +86,9 @@
 # undef __thumb2__
 #endif
 
-
+#ifdef __thumb2__
+.thumb_func	_bsaes_decrypt8
+#endif
 .align	4
 _bsaes_decrypt8:
 	adr	r6,_bsaes_decrypt8
@@ -577,7 +579,9 @@
 .align	6
 
 
-
+#ifdef __thumb2__
+.thumb_func	_bsaes_encrypt8
+#endif
 .align	4
 _bsaes_encrypt8:
 	adr	r6,_bsaes_encrypt8
@@ -1012,7 +1016,9 @@
 	veor	q1, q1, q8
 	bx	lr
 
-
+#ifdef __thumb2__
+.thumb_func	_bsaes_key_convert
+#endif
 .align	4
 _bsaes_key_convert:
 	adr	r6,_bsaes_key_convert
@@ -1076,7 +1082,9 @@
 
 .globl	_bsaes_cbc_encrypt
 .private_extern	_bsaes_cbc_encrypt
-
+#ifdef __thumb2__
+.thumb_func	_bsaes_cbc_encrypt
+#endif
 .align	5
 _bsaes_cbc_encrypt:
 #ifndef	__KERNEL__
@@ -1344,7 +1352,9 @@
 
 .globl	_bsaes_ctr32_encrypt_blocks
 .private_extern	_bsaes_ctr32_encrypt_blocks
-
+#ifdef __thumb2__
+.thumb_func	_bsaes_ctr32_encrypt_blocks
+#endif
 .align	5
 _bsaes_ctr32_encrypt_blocks:
 	cmp	r2, #8			@ use plain AES for
@@ -1572,7 +1582,9 @@
 
 .globl	_bsaes_xts_encrypt
 .private_extern	_bsaes_xts_encrypt
-
+#ifdef __thumb2__
+.thumb_func	_bsaes_xts_encrypt
+#endif
 .align	4
 _bsaes_xts_encrypt:
 	mov	ip, sp
@@ -2053,7 +2065,9 @@
 
 .globl	_bsaes_xts_decrypt
 .private_extern	_bsaes_xts_decrypt
-
+#ifdef __thumb2__
+.thumb_func	_bsaes_xts_decrypt
+#endif
 .align	4
 _bsaes_xts_decrypt:
 	mov	ip, sp

diff --git a/third_party/boringssl/ios-arm/crypto/fipsmodule/ghash-armv4.S b/third_party/boringssl/ios-arm/crypto/fipsmodule/ghash-armv4.S
index 39abb3f..0a053c5 100644
--- a/third_party/boringssl/ios-arm/crypto/fipsmodule/ghash-armv4.S
+++ b/third_party/boringssl/ios-arm/crypto/fipsmodule/ghash-armv4.S

@@ -1,9 +1,14 @@
 #include <openssl/arm_arch.h>
 
-.syntax	unified
-
 .text
+#if defined(__thumb2__) || defined(__clang__)
+.syntax	unified
+#endif
+#if defined(__thumb2__)
+.thumb
+#else
 .code	32
+#endif
 
 #ifdef  __clang__
 #define ldrplb  ldrbpl
@@ -19,22 +24,34 @@
 .short	0x9180,0x8DA0,0xA9C0,0xB5E0
 
 
-
+#ifdef __thumb2__
+.thumb_func	rem_4bit_get
+#endif
 rem_4bit_get:
-	sub	r2,pc,#8
-	sub	r2,r2,#32	@ &rem_4bit
+#if defined(__thumb2__)
+	adr	r2,rem_4bit
+#else
+	sub	r2,pc,#8+32	@ &rem_4bit
+#endif
 	b	Lrem_4bit_got
 	nop
+	nop
 
 
 .globl	_gcm_ghash_4bit
 .private_extern	_gcm_ghash_4bit
-
+#ifdef __thumb2__
+.thumb_func	_gcm_ghash_4bit
+#endif
+.align	4
 _gcm_ghash_4bit:
-	sub	r12,pc,#8
+#if defined(__thumb2__)
+	adr	r12,rem_4bit
+#else
+	sub	r12,pc,#8+48		@ &rem_4bit
+#endif
 	add	r3,r2,r3		@ r3 to point at the end
 	stmdb	sp!,{r3,r4,r5,r6,r7,r8,r9,r10,r11,lr}		@ save r3/end too
-	sub	r12,r12,#48		@ &rem_4bit
 
 	ldmia	r12,{r4,r5,r6,r7,r8,r9,r10,r11}		@ copy rem_4bit ...
 	stmdb	sp!,{r4,r5,r6,r7,r8,r9,r10,r11}		@ ... to stack
@@ -81,7 +98,10 @@
 	eor	r5,r5,r6,lsl#28
 	ldrh	r8,[sp,r12]		@ rem_4bit[rem]
 	eor	r6,r10,r6,lsr#4
-	ldrbpl	r12,[r2,r3]
+#ifdef	__thumb2__
+	it	pl
+#endif
+	ldrplb	r12,[r2,r3]
 	eor	r6,r6,r7,lsl#28
 	eor	r7,r11,r7,lsr#4
 
@@ -91,15 +111,24 @@
 	add	r14,r14,r14
 	ldmia	r11,{r8,r9,r10,r11}	@ load Htbl[nhi]
 	eor	r4,r8,r4,lsr#4
-	ldrbpl	r8,[r0,r3]
+#ifdef	__thumb2__
+	it	pl
+#endif
+	ldrplb	r8,[r0,r3]
 	eor	r4,r4,r5,lsl#28
 	eor	r5,r9,r5,lsr#4
 	ldrh	r9,[sp,r14]
 	eor	r5,r5,r6,lsl#28
 	eor	r6,r10,r6,lsr#4
 	eor	r6,r6,r7,lsl#28
+#ifdef	__thumb2__
+	it	pl
+#endif
 	eorpl	r12,r12,r8
 	eor	r7,r11,r7,lsr#4
+#ifdef	__thumb2__
+	itt	pl
+#endif
 	andpl	r14,r12,#0xf0
 	andpl	r12,r12,#0x0f
 	eor	r7,r7,r9,lsl#16	@ ^= rem_4bit[rem]
@@ -137,7 +166,11 @@
 	strb	r10,[r0,#8+1]
 	strb	r11,[r0,#8]
 #endif
-	ldrbne	r12,[r2,#15]
+
+#ifdef __thumb2__
+	it	ne
+#endif
+	ldrneb	r12,[r2,#15]
 #if __ARM_ARCH__>=7 && defined(__ARMEL__)
 	rev	r6,r6
 	str	r6,[r0,#4]
@@ -183,7 +216,9 @@
 
 .globl	_gcm_gmult_4bit
 .private_extern	_gcm_gmult_4bit
-
+#ifdef __thumb2__
+.thumb_func	_gcm_gmult_4bit
+#endif
 _gcm_gmult_4bit:
 	stmdb	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,lr}
 	ldrb	r12,[r0,#15]
@@ -225,7 +260,10 @@
 	eor	r5,r5,r6,lsl#28
 	ldrh	r8,[r2,r12]	@ rem_4bit[rem]
 	eor	r6,r10,r6,lsr#4
-	ldrbpl	r12,[r0,r3]
+#ifdef	__thumb2__
+	it	pl
+#endif
+	ldrplb	r12,[r0,r3]
 	eor	r6,r6,r7,lsl#28
 	eor	r7,r11,r7,lsr#4
 
@@ -242,6 +280,9 @@
 	eor	r6,r10,r6,lsr#4
 	eor	r6,r6,r7,lsl#28
 	eor	r7,r11,r7,lsr#4
+#ifdef	__thumb2__
+	itt	pl
+#endif
 	andpl	r14,r12,#0xf0
 	andpl	r12,r12,#0x0f
 	eor	r7,r7,r8,lsl#16	@ ^= rem_4bit[rem]
@@ -321,7 +362,9 @@
 
 .globl	_gcm_init_neon
 .private_extern	_gcm_init_neon
-
+#ifdef __thumb2__
+.thumb_func	_gcm_init_neon
+#endif
 .align	4
 _gcm_init_neon:
 	vld1.64	d7,[r1]!		@ load H
@@ -343,7 +386,9 @@
 
 .globl	_gcm_gmult_neon
 .private_extern	_gcm_gmult_neon
-
+#ifdef __thumb2__
+.thumb_func	_gcm_gmult_neon
+#endif
 .align	4
 _gcm_gmult_neon:
 	vld1.64	d7,[r0]!		@ load Xi
@@ -362,7 +407,9 @@
 
 .globl	_gcm_ghash_neon
 .private_extern	_gcm_ghash_neon
-
+#ifdef __thumb2__
+.thumb_func	_gcm_ghash_neon
+#endif
 .align	4
 _gcm_ghash_neon:
 	vld1.64	d1,[r0]!		@ load Xi

diff --git a/third_party/boringssl/ios-arm/crypto/fipsmodule/ghashv8-armx32.S b/third_party/boringssl/ios-arm/crypto/fipsmodule/ghashv8-armx32.S
index 10a0ab0..af268926 100644
--- a/third_party/boringssl/ios-arm/crypto/fipsmodule/ghashv8-armx32.S
+++ b/third_party/boringssl/ios-arm/crypto/fipsmodule/ghashv8-armx32.S

@@ -3,9 +3,12 @@
 .text
 
 .code	32
+#undef	__thumb2__
 .globl	_gcm_init_v8
 .private_extern	_gcm_init_v8
-
+#ifdef __thumb2__
+.thumb_func	_gcm_init_v8
+#endif
 .align	4
 _gcm_init_v8:
 	vld1.64	{q9},[r1]		@ load input H
@@ -56,7 +59,9 @@
 
 .globl	_gcm_gmult_v8
 .private_extern	_gcm_gmult_v8
-
+#ifdef __thumb2__
+.thumb_func	_gcm_gmult_v8
+#endif
 .align	4
 _gcm_gmult_v8:
 	vld1.64	{q9},[r0]		@ load Xi
@@ -98,7 +103,9 @@
 
 .globl	_gcm_ghash_v8
 .private_extern	_gcm_ghash_v8
-
+#ifdef __thumb2__
+.thumb_func	_gcm_ghash_v8
+#endif
 .align	4
 _gcm_ghash_v8:
 	vstmdb	sp!,{d8,d9,d10,d11,d12,d13,d14,d15}		@ 32-bit ABI says so

diff --git a/third_party/boringssl/ios-arm/crypto/fipsmodule/sha1-armv4-large.S b/third_party/boringssl/ios-arm/crypto/fipsmodule/sha1-armv4-large.S
index 652ccbc9..f97072c0 100644
--- a/third_party/boringssl/ios-arm/crypto/fipsmodule/sha1-armv4-large.S
+++ b/third_party/boringssl/ios-arm/crypto/fipsmodule/sha1-armv4-large.S

@@ -1,16 +1,24 @@
 #include <openssl/arm_arch.h>
 
 .text
+#if defined(__thumb2__)
+.syntax	unified
+.thumb
+#else
 .code	32
+#endif
 
 .globl	_sha1_block_data_order
 .private_extern	_sha1_block_data_order
-
+#ifdef __thumb2__
+.thumb_func	_sha1_block_data_order
+#endif
 
 .align	5
 _sha1_block_data_order:
 #if __ARM_MAX_ARCH__>=7
-	sub	r3,pc,#8		@ _sha1_block_data_order
+Lsha1_block:
+	adr	r3,Lsha1_block
 	ldr	r12,LOPENSSL_armcap
 	ldr	r12,[r3,r12]		@ OPENSSL_armcap_P
 #ifdef	__APPLE__
@@ -157,7 +165,12 @@
 	eor	r10,r10,r7,ror#2		@ F_00_19(B,C,D)
 	str	r9,[r14,#-4]!
 	add	r3,r3,r10			@ E+=F_00_19(B,C,D)
+#if defined(__thumb2__)
+	mov	r12,sp
+	teq	r14,r12
+#else
 	teq	r14,sp
+#endif
 	bne	L_00_15		@ [((11+4)*5+2)*3]
 	sub	sp,sp,#25*4
 #if __ARM_ARCH__<7
@@ -337,7 +350,12 @@
 						@ F_xx_xx
 	add	r3,r3,r9			@ E+=X[i]
 	add	r3,r3,r10			@ E+=F_20_39(B,C,D)
+#if defined(__thumb2__)
+	mov	r12,sp
+	teq	r14,r12
+#else
 	teq	r14,sp			@ preserve carry
+#endif
 	bne	L_20_39_or_60_79	@ [+((12+3)*5+2)*4]
 	bcs	L_done			@ [+((12+3)*5+2)*4], spare 300 bytes
 
@@ -429,7 +447,12 @@
 	add	r3,r3,r9			@ E+=X[i]
 	add	r3,r3,r10			@ E+=F_40_59(B,C,D)
 	add	r3,r3,r11,ror#2
+#if defined(__thumb2__)
+	mov	r12,sp
+	teq	r14,r12
+#else
 	teq	r14,sp
+#endif
 	bne	L_40_59		@ [+((12+5)*5+2)*4]
 
 	ldr	r8,LK_60_79
@@ -465,7 +488,7 @@
 LK_60_79:.word	0xca62c1d6
 #if __ARM_MAX_ARCH__>=7
 LOPENSSL_armcap:
-.word	OPENSSL_armcap_P-_sha1_block_data_order
+.word	OPENSSL_armcap_P-Lsha1_block
 #endif
 .byte	83,72,65,49,32,98,108,111,99,107,32,116,114,97,110,115,102,111,114,109,32,102,111,114,32,65,82,77,118,52,47,78,69,79,78,47,65,82,77,118,56,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46,111,114,103,62,0
 .align	2
@@ -474,7 +497,9 @@
 
 
 
-
+#ifdef __thumb2__
+.thumb_func	sha1_block_data_order_neon
+#endif
 .align	4
 sha1_block_data_order_neon:
 LNEON:
@@ -483,12 +508,12 @@
 	@ dmb				@ errata #451034 on early Cortex A8
 	@ vstmdb	sp!,{d8-d15}	@ ABI specification says so
 	mov	r14,sp
-	sub	sp,sp,#64		@ alloca
+	sub	r12,sp,#64
 	adr	r8,LK_00_19
-	bic	sp,sp,#15		@ align for 128-bit stores
+	bic	r12,r12,#15		@ align for 128-bit stores
 
 	ldmia	r0,{r3,r4,r5,r6,r7}	@ load context
-	mov	r12,sp
+	mov	sp,r12		@ alloca
 
 	vld1.8	{q0,q1},[r1]!	@ handles unaligned
 	veor	q15,q15,q15
@@ -1181,6 +1206,7 @@
 	sub	r12,r12,#64
 	teq	r1,r2
 	sub	r8,r8,#16
+	it	eq
 	subeq	r1,r1,#64
 	vld1.8	{q0,q1},[r1]!
 	ldr	r9,[sp,#4]
@@ -1310,10 +1336,13 @@
 	add	r4,r4,r10
 	add	r5,r5,r11
 	add	r6,r6,r12
+	it	eq
 	moveq	sp,r14
 	add	r7,r7,r9
+	it	ne
 	ldrne	r9,[sp]
 	stmia	r0,{r3,r4,r5,r6,r7}
+	itt	ne
 	addne	r12,sp,#3*16
 	bne	Loop_neon
 
@@ -1323,6 +1352,15 @@
 #endif
 #if __ARM_MAX_ARCH__>=7
 
+# if defined(__thumb2__)
+#  define INST(a,b,c,d)	.byte	c,d|0xf,a,b
+# else
+#  define INST(a,b,c,d)	.byte	a,b,c,d|0x10
+# endif
+
+#ifdef __thumb2__
+.thumb_func	sha1_block_data_order_armv8
+#endif
 .align	5
 sha1_block_data_order_armv8:
 LARMv8:
@@ -1351,98 +1389,98 @@
 
 	vadd.i32	q13,q8,q5
 	vrev32.8	q7,q7
-.byte	0xc0,0x62,0xb9,0xf3	@ sha1h q3,q0		@ 0
-.byte	0x68,0x0c,0x02,0xf2	@ sha1c q0,q1,q12
+	INST(0xc0,0x62,0xb9,0xf3)	@ sha1h q3,q0		@ 0
+	INST(0x68,0x0c,0x02,0xe2)	@ sha1c q0,q1,q12
 	vadd.i32	q12,q8,q6
-.byte	0x4c,0x8c,0x3a,0xf2	@ sha1su0 q4,q5,q6
-.byte	0xc0,0x42,0xb9,0xf3	@ sha1h q2,q0		@ 1
-.byte	0x6a,0x0c,0x06,0xf2	@ sha1c q0,q3,q13
+	INST(0x4c,0x8c,0x3a,0xe2)	@ sha1su0 q4,q5,q6
+	INST(0xc0,0x42,0xb9,0xf3)	@ sha1h q2,q0		@ 1
+	INST(0x6a,0x0c,0x06,0xe2)	@ sha1c q0,q3,q13
 	vadd.i32	q13,q8,q7
-.byte	0x8e,0x83,0xba,0xf3	@ sha1su1 q4,q7
-.byte	0x4e,0xac,0x3c,0xf2	@ sha1su0 q5,q6,q7
-.byte	0xc0,0x62,0xb9,0xf3	@ sha1h q3,q0		@ 2
-.byte	0x68,0x0c,0x04,0xf2	@ sha1c q0,q2,q12
+	INST(0x8e,0x83,0xba,0xf3)	@ sha1su1 q4,q7
+	INST(0x4e,0xac,0x3c,0xe2)	@ sha1su0 q5,q6,q7
+	INST(0xc0,0x62,0xb9,0xf3)	@ sha1h q3,q0		@ 2
+	INST(0x68,0x0c,0x04,0xe2)	@ sha1c q0,q2,q12
 	vadd.i32	q12,q8,q4
-.byte	0x88,0xa3,0xba,0xf3	@ sha1su1 q5,q4
-.byte	0x48,0xcc,0x3e,0xf2	@ sha1su0 q6,q7,q4
-.byte	0xc0,0x42,0xb9,0xf3	@ sha1h q2,q0		@ 3
-.byte	0x6a,0x0c,0x06,0xf2	@ sha1c q0,q3,q13
+	INST(0x88,0xa3,0xba,0xf3)	@ sha1su1 q5,q4
+	INST(0x48,0xcc,0x3e,0xe2)	@ sha1su0 q6,q7,q4
+	INST(0xc0,0x42,0xb9,0xf3)	@ sha1h q2,q0		@ 3
+	INST(0x6a,0x0c,0x06,0xe2)	@ sha1c q0,q3,q13
 	vadd.i32	q13,q9,q5
-.byte	0x8a,0xc3,0xba,0xf3	@ sha1su1 q6,q5
-.byte	0x4a,0xec,0x38,0xf2	@ sha1su0 q7,q4,q5
-.byte	0xc0,0x62,0xb9,0xf3	@ sha1h q3,q0		@ 4
-.byte	0x68,0x0c,0x04,0xf2	@ sha1c q0,q2,q12
+	INST(0x8a,0xc3,0xba,0xf3)	@ sha1su1 q6,q5
+	INST(0x4a,0xec,0x38,0xe2)	@ sha1su0 q7,q4,q5
+	INST(0xc0,0x62,0xb9,0xf3)	@ sha1h q3,q0		@ 4
+	INST(0x68,0x0c,0x04,0xe2)	@ sha1c q0,q2,q12
 	vadd.i32	q12,q9,q6
-.byte	0x8c,0xe3,0xba,0xf3	@ sha1su1 q7,q6
-.byte	0x4c,0x8c,0x3a,0xf2	@ sha1su0 q4,q5,q6
-.byte	0xc0,0x42,0xb9,0xf3	@ sha1h q2,q0		@ 5
-.byte	0x6a,0x0c,0x16,0xf2	@ sha1p q0,q3,q13
+	INST(0x8c,0xe3,0xba,0xf3)	@ sha1su1 q7,q6
+	INST(0x4c,0x8c,0x3a,0xe2)	@ sha1su0 q4,q5,q6
+	INST(0xc0,0x42,0xb9,0xf3)	@ sha1h q2,q0		@ 5
+	INST(0x6a,0x0c,0x16,0xe2)	@ sha1p q0,q3,q13
 	vadd.i32	q13,q9,q7
-.byte	0x8e,0x83,0xba,0xf3	@ sha1su1 q4,q7
-.byte	0x4e,0xac,0x3c,0xf2	@ sha1su0 q5,q6,q7
-.byte	0xc0,0x62,0xb9,0xf3	@ sha1h q3,q0		@ 6
-.byte	0x68,0x0c,0x14,0xf2	@ sha1p q0,q2,q12
+	INST(0x8e,0x83,0xba,0xf3)	@ sha1su1 q4,q7
+	INST(0x4e,0xac,0x3c,0xe2)	@ sha1su0 q5,q6,q7
+	INST(0xc0,0x62,0xb9,0xf3)	@ sha1h q3,q0		@ 6
+	INST(0x68,0x0c,0x14,0xe2)	@ sha1p q0,q2,q12
 	vadd.i32	q12,q9,q4
-.byte	0x88,0xa3,0xba,0xf3	@ sha1su1 q5,q4
-.byte	0x48,0xcc,0x3e,0xf2	@ sha1su0 q6,q7,q4
-.byte	0xc0,0x42,0xb9,0xf3	@ sha1h q2,q0		@ 7
-.byte	0x6a,0x0c,0x16,0xf2	@ sha1p q0,q3,q13
+	INST(0x88,0xa3,0xba,0xf3)	@ sha1su1 q5,q4
+	INST(0x48,0xcc,0x3e,0xe2)	@ sha1su0 q6,q7,q4
+	INST(0xc0,0x42,0xb9,0xf3)	@ sha1h q2,q0		@ 7
+	INST(0x6a,0x0c,0x16,0xe2)	@ sha1p q0,q3,q13
 	vadd.i32	q13,q9,q5
-.byte	0x8a,0xc3,0xba,0xf3	@ sha1su1 q6,q5
-.byte	0x4a,0xec,0x38,0xf2	@ sha1su0 q7,q4,q5
-.byte	0xc0,0x62,0xb9,0xf3	@ sha1h q3,q0		@ 8
-.byte	0x68,0x0c,0x14,0xf2	@ sha1p q0,q2,q12
+	INST(0x8a,0xc3,0xba,0xf3)	@ sha1su1 q6,q5
+	INST(0x4a,0xec,0x38,0xe2)	@ sha1su0 q7,q4,q5
+	INST(0xc0,0x62,0xb9,0xf3)	@ sha1h q3,q0		@ 8
+	INST(0x68,0x0c,0x14,0xe2)	@ sha1p q0,q2,q12
 	vadd.i32	q12,q10,q6
-.byte	0x8c,0xe3,0xba,0xf3	@ sha1su1 q7,q6
-.byte	0x4c,0x8c,0x3a,0xf2	@ sha1su0 q4,q5,q6
-.byte	0xc0,0x42,0xb9,0xf3	@ sha1h q2,q0		@ 9
-.byte	0x6a,0x0c,0x16,0xf2	@ sha1p q0,q3,q13
+	INST(0x8c,0xe3,0xba,0xf3)	@ sha1su1 q7,q6
+	INST(0x4c,0x8c,0x3a,0xe2)	@ sha1su0 q4,q5,q6
+	INST(0xc0,0x42,0xb9,0xf3)	@ sha1h q2,q0		@ 9
+	INST(0x6a,0x0c,0x16,0xe2)	@ sha1p q0,q3,q13
 	vadd.i32	q13,q10,q7
-.byte	0x8e,0x83,0xba,0xf3	@ sha1su1 q4,q7
-.byte	0x4e,0xac,0x3c,0xf2	@ sha1su0 q5,q6,q7
-.byte	0xc0,0x62,0xb9,0xf3	@ sha1h q3,q0		@ 10
-.byte	0x68,0x0c,0x24,0xf2	@ sha1m q0,q2,q12
+	INST(0x8e,0x83,0xba,0xf3)	@ sha1su1 q4,q7
+	INST(0x4e,0xac,0x3c,0xe2)	@ sha1su0 q5,q6,q7
+	INST(0xc0,0x62,0xb9,0xf3)	@ sha1h q3,q0		@ 10
+	INST(0x68,0x0c,0x24,0xe2)	@ sha1m q0,q2,q12
 	vadd.i32	q12,q10,q4
-.byte	0x88,0xa3,0xba,0xf3	@ sha1su1 q5,q4
-.byte	0x48,0xcc,0x3e,0xf2	@ sha1su0 q6,q7,q4
-.byte	0xc0,0x42,0xb9,0xf3	@ sha1h q2,q0		@ 11
-.byte	0x6a,0x0c,0x26,0xf2	@ sha1m q0,q3,q13
+	INST(0x88,0xa3,0xba,0xf3)	@ sha1su1 q5,q4
+	INST(0x48,0xcc,0x3e,0xe2)	@ sha1su0 q6,q7,q4
+	INST(0xc0,0x42,0xb9,0xf3)	@ sha1h q2,q0		@ 11
+	INST(0x6a,0x0c,0x26,0xe2)	@ sha1m q0,q3,q13
 	vadd.i32	q13,q10,q5
-.byte	0x8a,0xc3,0xba,0xf3	@ sha1su1 q6,q5
-.byte	0x4a,0xec,0x38,0xf2	@ sha1su0 q7,q4,q5
-.byte	0xc0,0x62,0xb9,0xf3	@ sha1h q3,q0		@ 12
-.byte	0x68,0x0c,0x24,0xf2	@ sha1m q0,q2,q12
+	INST(0x8a,0xc3,0xba,0xf3)	@ sha1su1 q6,q5
+	INST(0x4a,0xec,0x38,0xe2)	@ sha1su0 q7,q4,q5
+	INST(0xc0,0x62,0xb9,0xf3)	@ sha1h q3,q0		@ 12
+	INST(0x68,0x0c,0x24,0xe2)	@ sha1m q0,q2,q12
 	vadd.i32	q12,q10,q6
-.byte	0x8c,0xe3,0xba,0xf3	@ sha1su1 q7,q6
-.byte	0x4c,0x8c,0x3a,0xf2	@ sha1su0 q4,q5,q6
-.byte	0xc0,0x42,0xb9,0xf3	@ sha1h q2,q0		@ 13
-.byte	0x6a,0x0c,0x26,0xf2	@ sha1m q0,q3,q13
+	INST(0x8c,0xe3,0xba,0xf3)	@ sha1su1 q7,q6
+	INST(0x4c,0x8c,0x3a,0xe2)	@ sha1su0 q4,q5,q6
+	INST(0xc0,0x42,0xb9,0xf3)	@ sha1h q2,q0		@ 13
+	INST(0x6a,0x0c,0x26,0xe2)	@ sha1m q0,q3,q13
 	vadd.i32	q13,q11,q7
-.byte	0x8e,0x83,0xba,0xf3	@ sha1su1 q4,q7
-.byte	0x4e,0xac,0x3c,0xf2	@ sha1su0 q5,q6,q7
-.byte	0xc0,0x62,0xb9,0xf3	@ sha1h q3,q0		@ 14
-.byte	0x68,0x0c,0x24,0xf2	@ sha1m q0,q2,q12
+	INST(0x8e,0x83,0xba,0xf3)	@ sha1su1 q4,q7
+	INST(0x4e,0xac,0x3c,0xe2)	@ sha1su0 q5,q6,q7
+	INST(0xc0,0x62,0xb9,0xf3)	@ sha1h q3,q0		@ 14
+	INST(0x68,0x0c,0x24,0xe2)	@ sha1m q0,q2,q12
 	vadd.i32	q12,q11,q4
-.byte	0x88,0xa3,0xba,0xf3	@ sha1su1 q5,q4
-.byte	0x48,0xcc,0x3e,0xf2	@ sha1su0 q6,q7,q4
-.byte	0xc0,0x42,0xb9,0xf3	@ sha1h q2,q0		@ 15
-.byte	0x6a,0x0c,0x16,0xf2	@ sha1p q0,q3,q13
+	INST(0x88,0xa3,0xba,0xf3)	@ sha1su1 q5,q4
+	INST(0x48,0xcc,0x3e,0xe2)	@ sha1su0 q6,q7,q4
+	INST(0xc0,0x42,0xb9,0xf3)	@ sha1h q2,q0		@ 15
+	INST(0x6a,0x0c,0x16,0xe2)	@ sha1p q0,q3,q13
 	vadd.i32	q13,q11,q5
-.byte	0x8a,0xc3,0xba,0xf3	@ sha1su1 q6,q5
-.byte	0x4a,0xec,0x38,0xf2	@ sha1su0 q7,q4,q5
-.byte	0xc0,0x62,0xb9,0xf3	@ sha1h q3,q0		@ 16
-.byte	0x68,0x0c,0x14,0xf2	@ sha1p q0,q2,q12
+	INST(0x8a,0xc3,0xba,0xf3)	@ sha1su1 q6,q5
+	INST(0x4a,0xec,0x38,0xe2)	@ sha1su0 q7,q4,q5
+	INST(0xc0,0x62,0xb9,0xf3)	@ sha1h q3,q0		@ 16
+	INST(0x68,0x0c,0x14,0xe2)	@ sha1p q0,q2,q12
 	vadd.i32	q12,q11,q6
-.byte	0x8c,0xe3,0xba,0xf3	@ sha1su1 q7,q6
-.byte	0xc0,0x42,0xb9,0xf3	@ sha1h q2,q0		@ 17
-.byte	0x6a,0x0c,0x16,0xf2	@ sha1p q0,q3,q13
+	INST(0x8c,0xe3,0xba,0xf3)	@ sha1su1 q7,q6
+	INST(0xc0,0x42,0xb9,0xf3)	@ sha1h q2,q0		@ 17
+	INST(0x6a,0x0c,0x16,0xe2)	@ sha1p q0,q3,q13
 	vadd.i32	q13,q11,q7
 
-.byte	0xc0,0x62,0xb9,0xf3	@ sha1h q3,q0		@ 18
-.byte	0x68,0x0c,0x14,0xf2	@ sha1p q0,q2,q12
+	INST(0xc0,0x62,0xb9,0xf3)	@ sha1h q3,q0		@ 18
+	INST(0x68,0x0c,0x14,0xe2)	@ sha1p q0,q2,q12
 
-.byte	0xc0,0x42,0xb9,0xf3	@ sha1h q2,q0		@ 19
-.byte	0x6a,0x0c,0x16,0xf2	@ sha1p q0,q3,q13
+	INST(0xc0,0x42,0xb9,0xf3)	@ sha1h q2,q0		@ 19
+	INST(0x6a,0x0c,0x16,0xe2)	@ sha1p q0,q3,q13
 
 	vadd.i32	q1,q1,q2
 	vadd.i32	q0,q0,q14

diff --git a/third_party/boringssl/ios-arm/crypto/fipsmodule/sha256-armv4.S b/third_party/boringssl/ios-arm/crypto/fipsmodule/sha256-armv4.S
index e55248a1..2ea6517 100644
--- a/third_party/boringssl/ios-arm/crypto/fipsmodule/sha256-armv4.S
+++ b/third_party/boringssl/ios-arm/crypto/fipsmodule/sha256-armv4.S

@@ -87,7 +87,9 @@
 
 .globl	_sha256_block_data_order
 .private_extern	_sha256_block_data_order
-
+#ifdef __thumb2__
+.thumb_func	_sha256_block_data_order
+#endif
 _sha256_block_data_order:
 Lsha256_block_data_order:
 #if __ARM_ARCH__<7 && !defined(__thumb2__)
@@ -1878,7 +1880,9 @@
 
 .globl	_sha256_block_data_order_neon
 .private_extern	_sha256_block_data_order_neon
-
+#ifdef __thumb2__
+.thumb_func	_sha256_block_data_order_neon
+#endif
 .align	5
 .skip	16
 _sha256_block_data_order_neon:
@@ -2668,7 +2672,9 @@
 #  define INST(a,b,c,d)	.byte	a,b,c,d
 # endif
 
-
+#ifdef __thumb2__
+.thumb_func	sha256_block_data_order_armv8
+#endif
 .align	5
 sha256_block_data_order_armv8:
 LARMv8:

diff --git a/third_party/boringssl/ios-arm/crypto/fipsmodule/sha512-armv4.S b/third_party/boringssl/ios-arm/crypto/fipsmodule/sha512-armv4.S
index 7bd3d67..b225c99 100644
--- a/third_party/boringssl/ios-arm/crypto/fipsmodule/sha512-armv4.S
+++ b/third_party/boringssl/ios-arm/crypto/fipsmodule/sha512-armv4.S

@@ -1,3 +1,10 @@
+@ Copyright 2007-2016 The OpenSSL Project Authors. All Rights Reserved.
+@
+@ Licensed under the OpenSSL license (the "License").  You may not use
+@ this file except in compliance with the License.  You can obtain a copy
+@ in the file LICENSE in the source distribution or at
+@ https://www.openssl.org/source/license.html
+
 
 @ ====================================================================
 @ Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
@@ -67,16 +74,12 @@
 #endif
 
 .text
-#if __ARM_ARCH__<7 || defined(__APPLE__)
-.code	32
-#else
+#if defined(__thumb2__)
 .syntax	unified
-# ifdef __thumb2__
-#  define adrl adr
 .thumb
-# else
+# define adrl adr
+#else
 .code	32
-# endif
 #endif
 
 
@@ -133,13 +136,15 @@
 
 .globl	_sha512_block_data_order
 .private_extern	_sha512_block_data_order
-
+#ifdef __thumb2__
+.thumb_func	_sha512_block_data_order
+#endif
 _sha512_block_data_order:
 Lsha512_block_data_order:
-#if __ARM_ARCH__<7
+#if __ARM_ARCH__<7 && !defined(__thumb2__)
 	sub	r3,pc,#8		@ _sha512_block_data_order
 #else
-	adr	r3,_sha512_block_data_order
+	adr	r3,Lsha512_block_data_order
 #endif
 #if __ARM_MAX_ARCH__>=7 && !defined(__KERNEL__)
 	ldr	r12,LOPENSSL_armcap
@@ -534,7 +539,9 @@
 
 .globl	_sha512_block_data_order_neon
 .private_extern	_sha512_block_data_order_neon
-
+#ifdef __thumb2__
+.thumb_func	_sha512_block_data_order_neon
+#endif
 .align	4
 _sha512_block_data_order_neon:
 LNEON:

diff --git a/third_party/boringssl/linux-aarch64/crypto/fipsmodule/sha1-armv8.S b/third_party/boringssl/linux-aarch64/crypto/fipsmodule/sha1-armv8.S
index cfb4aa0..ff361f45 100644
--- a/third_party/boringssl/linux-aarch64/crypto/fipsmodule/sha1-armv8.S
+++ b/third_party/boringssl/linux-aarch64/crypto/fipsmodule/sha1-armv8.S

@@ -9,7 +9,11 @@
 .type	sha1_block_data_order,%function
 .align	6
 sha1_block_data_order:
+#ifdef	__ILP32__
+	ldrsw	x16,.LOPENSSL_armcap_P
+#else
 	ldr	x16,.LOPENSSL_armcap_P
+#endif
 	adr	x17,.LOPENSSL_armcap_P
 	add	x16,x16,x17
 	ldr	w16,[x16]
@@ -1208,7 +1212,11 @@
 .long	0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc,0x8f1bbcdc	//K_40_59
 .long	0xca62c1d6,0xca62c1d6,0xca62c1d6,0xca62c1d6	//K_60_79
 .LOPENSSL_armcap_P:
+#ifdef	__ILP32__
+.long	OPENSSL_armcap_P-.
+#else
 .quad	OPENSSL_armcap_P-.
+#endif
 .byte	83,72,65,49,32,98,108,111,99,107,32,116,114,97,110,115,102,111,114,109,32,102,111,114,32,65,82,77,118,56,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46,111,114,103,62,0
 .align	2
 .align	2

diff --git a/third_party/boringssl/linux-aarch64/crypto/fipsmodule/sha256-armv8.S b/third_party/boringssl/linux-aarch64/crypto/fipsmodule/sha256-armv8.S
index bfc552cb..19db339 100644
--- a/third_party/boringssl/linux-aarch64/crypto/fipsmodule/sha256-armv8.S
+++ b/third_party/boringssl/linux-aarch64/crypto/fipsmodule/sha256-armv8.S

@@ -1,5 +1,46 @@
 #if defined(__aarch64__)
-#include <openssl/arm_arch.h>
+// Copyright 2014-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the OpenSSL license (the "License").  You may not use
+// this file except in compliance with the License.  You can obtain a copy
+// in the file LICENSE in the source distribution or at
+// https://www.openssl.org/source/license.html
+
+// ====================================================================
+// Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
+// project. The module is, however, dual licensed under OpenSSL and
+// CRYPTOGAMS licenses depending on where you obtain it. For further
+// details see http://www.openssl.org/~appro/cryptogams/.
+//
+// Permission to use under GPLv2 terms is granted.
+// ====================================================================
+//
+// SHA256/512 for ARMv8.
+//
+// Performance in cycles per processed byte and improvement coefficient
+// over code generated with "default" compiler:
+//
+//		SHA256-hw	SHA256(*)	SHA512
+// Apple A7	1.97		10.5 (+33%)	6.73 (-1%(**))
+// Cortex-A53	2.38		15.5 (+115%)	10.0 (+150%(***))
+// Cortex-A57	2.31		11.6 (+86%)	7.51 (+260%(***))
+// Denver	2.01		10.5 (+26%)	6.70 (+8%)
+// X-Gene			20.0 (+100%)	12.8 (+300%(***))
+// Mongoose	2.36		13.0 (+50%)	8.36 (+33%)
+//
+// (*)	Software SHA256 results are of lesser relevance, presented
+//	mostly for informational purposes.
+// (**)	The result is a trade-off: it's possible to improve it by
+//	10% (or by 1 cycle per round), but at the cost of 20% loss
+//	on Cortex-A53 (or by 4 cycles per round).
+// (***)	Super-impressive coefficients over gcc-generated code are
+//	indication of some compiler "pathology", most notably code
+//	generated with -mgeneral-regs-only is significanty faster
+//	and the gap is only 40-90%.
+
+#ifndef	__KERNEL__
+# include <openssl/arm_arch.h>
+#endif
 
 .text
 
@@ -9,12 +50,18 @@
 .type	sha256_block_data_order,%function
 .align	6
 sha256_block_data_order:
+#ifndef	__KERNEL__
+# ifdef	__ILP32__
+	ldrsw	x16,.LOPENSSL_armcap_P
+# else
 	ldr	x16,.LOPENSSL_armcap_P
+# endif
 	adr	x17,.LOPENSSL_armcap_P
 	add	x16,x16,x17
 	ldr	w16,[x16]
 	tst	w16,#ARMV8_SHA256
 	b.ne	.Lv8_entry
+#endif
 	stp	x29,x30,[sp,#-128]!
 	add	x29,sp,#0
 
@@ -998,12 +1045,19 @@
 .long	0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2
 .long	0	//terminator
 .size	.LK256,.-.LK256
+#ifndef	__KERNEL__
 .align	3
 .LOPENSSL_armcap_P:
+# ifdef	__ILP32__
+.long	OPENSSL_armcap_P-.
+# else
 .quad	OPENSSL_armcap_P-.
+# endif
+#endif
 .byte	83,72,65,50,53,54,32,98,108,111,99,107,32,116,114,97,110,115,102,111,114,109,32,102,111,114,32,65,82,77,118,56,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46,111,114,103,62,0
 .align	2
 .align	2
+#ifndef	__KERNEL__
 .type	sha256_block_armv8,%function
 .align	6
 sha256_block_armv8:
@@ -1142,5 +1196,8 @@
 	ldr	x29,[sp],#16
 	ret
 .size	sha256_block_armv8,.-sha256_block_armv8
+#endif
+#ifndef	__KERNEL__
 .comm	OPENSSL_armcap_P,4,4
 #endif
+#endif

diff --git a/third_party/boringssl/linux-aarch64/crypto/fipsmodule/sha512-armv8.S b/third_party/boringssl/linux-aarch64/crypto/fipsmodule/sha512-armv8.S
index 4645722..bb052b7 100644
--- a/third_party/boringssl/linux-aarch64/crypto/fipsmodule/sha512-armv8.S
+++ b/third_party/boringssl/linux-aarch64/crypto/fipsmodule/sha512-armv8.S

@@ -1,5 +1,46 @@
 #if defined(__aarch64__)
-#include <openssl/arm_arch.h>
+// Copyright 2014-2016 The OpenSSL Project Authors. All Rights Reserved.
+//
+// Licensed under the OpenSSL license (the "License").  You may not use
+// this file except in compliance with the License.  You can obtain a copy
+// in the file LICENSE in the source distribution or at
+// https://www.openssl.org/source/license.html
+
+// ====================================================================
+// Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
+// project. The module is, however, dual licensed under OpenSSL and
+// CRYPTOGAMS licenses depending on where you obtain it. For further
+// details see http://www.openssl.org/~appro/cryptogams/.
+//
+// Permission to use under GPLv2 terms is granted.
+// ====================================================================
+//
+// SHA256/512 for ARMv8.
+//
+// Performance in cycles per processed byte and improvement coefficient
+// over code generated with "default" compiler:
+//
+//		SHA256-hw	SHA256(*)	SHA512
+// Apple A7	1.97		10.5 (+33%)	6.73 (-1%(**))
+// Cortex-A53	2.38		15.5 (+115%)	10.0 (+150%(***))
+// Cortex-A57	2.31		11.6 (+86%)	7.51 (+260%(***))
+// Denver	2.01		10.5 (+26%)	6.70 (+8%)
+// X-Gene			20.0 (+100%)	12.8 (+300%(***))
+// Mongoose	2.36		13.0 (+50%)	8.36 (+33%)
+//
+// (*)	Software SHA256 results are of lesser relevance, presented
+//	mostly for informational purposes.
+// (**)	The result is a trade-off: it's possible to improve it by
+//	10% (or by 1 cycle per round), but at the cost of 20% loss
+//	on Cortex-A53 (or by 4 cycles per round).
+// (***)	Super-impressive coefficients over gcc-generated code are
+//	indication of some compiler "pathology", most notably code
+//	generated with -mgeneral-regs-only is significanty faster
+//	and the gap is only 40-90%.
+
+#ifndef	__KERNEL__
+# include <openssl/arm_arch.h>
+#endif
 
 .text
 
@@ -1016,11 +1057,19 @@
 .quad	0x5fcb6fab3ad6faec,0x6c44198c4a475817
 .quad	0	// terminator
 .size	.LK512,.-.LK512
+#ifndef	__KERNEL__
 .align	3
 .LOPENSSL_armcap_P:
+# ifdef	__ILP32__
+.long	OPENSSL_armcap_P-.
+# else
 .quad	OPENSSL_armcap_P-.
+# endif
+#endif
 .byte	83,72,65,53,49,50,32,98,108,111,99,107,32,116,114,97,110,115,102,111,114,109,32,102,111,114,32,65,82,77,118,56,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46,111,114,103,62,0
 .align	2
 .align	2
+#ifndef	__KERNEL__
 .comm	OPENSSL_armcap_P,4,4
 #endif
+#endif

diff --git a/third_party/boringssl/linux-arm/crypto/fipsmodule/aes-armv4.S b/third_party/boringssl/linux-arm/crypto/fipsmodule/aes-armv4.S
index 40a1253e..f11bc7e 100644
--- a/third_party/boringssl/linux-arm/crypto/fipsmodule/aes-armv4.S
+++ b/third_party/boringssl/linux-arm/crypto/fipsmodule/aes-armv4.S

@@ -1,4 +1,11 @@
 #if defined(__arm__)
+@ Copyright 2007-2016 The OpenSSL Project Authors. All Rights Reserved.
+@
+@ Licensed under the OpenSSL license (the "License").  You may not use
+@ this file except in compliance with the License.  You can obtain a copy
+@ in the file LICENSE in the source distribution or at
+@ https://www.openssl.org/source/license.html
+
 
 @ ====================================================================
 @ Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
@@ -39,15 +46,12 @@
 #endif
 
 .text
-#if __ARM_ARCH__<7
-.code	32
-#else
+#if defined(__thumb2__) && !defined(__APPLE__)
 .syntax	unified
-# if defined(__thumb2__) && !defined(__APPLE__)
 .thumb
-# else
+#else
 .code	32
-# endif
+#undef __thumb2__
 #endif
 
 .type	AES_Te,%object
@@ -163,7 +167,7 @@
 .type	asm_AES_encrypt,%function
 .align	5
 asm_AES_encrypt:
-#if __ARM_ARCH__<7
+#ifndef	__thumb2__
 	sub	r3,pc,#8		@ asm_AES_encrypt
 #else
 	adr	r3,asm_AES_encrypt
@@ -414,19 +418,19 @@
 .align	5
 asm_AES_set_encrypt_key:
 _armv4_AES_set_encrypt_key:
-#if __ARM_ARCH__<7
+#ifndef	__thumb2__
 	sub	r3,pc,#8		@ asm_AES_set_encrypt_key
 #else
 	adr	r3,asm_AES_set_encrypt_key
 #endif
 	teq	r0,#0
-#if __ARM_ARCH__>=7
+#ifdef	__thumb2__
 	itt	eq			@ Thumb2 thing, sanity check in ARM
 #endif
 	moveq	r0,#-1
 	beq	.Labrt
 	teq	r2,#0
-#if __ARM_ARCH__>=7
+#ifdef	__thumb2__
 	itt	eq			@ Thumb2 thing, sanity check in ARM
 #endif
 	moveq	r0,#-1
@@ -437,7 +441,7 @@
 	teq	r1,#192
 	beq	.Lok
 	teq	r1,#256
-#if __ARM_ARCH__>=7
+#ifdef	__thumb2__
 	itt	ne			@ Thumb2 thing, sanity check in ARM
 #endif
 	movne	r0,#-1
@@ -598,7 +602,7 @@
 	str	r2,[r11,#-16]
 	subs	r12,r12,#1
 	str	r3,[r11,#-12]
-#if __ARM_ARCH__>=7
+#ifdef	__thumb2__
 	itt	eq				@ Thumb2 thing, sanity check in ARM
 #endif
 	subeq	r2,r11,#216
@@ -670,7 +674,7 @@
 	str	r2,[r11,#-24]
 	subs	r12,r12,#1
 	str	r3,[r11,#-20]
-#if __ARM_ARCH__>=7
+#ifdef	__thumb2__
 	itt	eq				@ Thumb2 thing, sanity check in ARM
 #endif
 	subeq	r2,r11,#256
@@ -743,7 +747,7 @@
 	ldr	r12,[r0,#240]
 	mov	r7,r0			@ input
 	add	r8,r0,r12,lsl#4
-	mov	r11,r1			@ ouput
+	mov	r11,r1			@ output
 	add	r10,r1,r12,lsl#4
 	str	r12,[r1,#240]
 
@@ -938,7 +942,7 @@
 .type	asm_AES_decrypt,%function
 .align	5
 asm_AES_decrypt:
-#if __ARM_ARCH__<7
+#ifndef	__thumb2__
 	sub	r3,pc,#8		@ asm_AES_decrypt
 #else
 	adr	r3,asm_AES_decrypt

diff --git a/third_party/boringssl/linux-arm/crypto/fipsmodule/aesv8-armx32.S b/third_party/boringssl/linux-arm/crypto/fipsmodule/aesv8-armx32.S
index c2f6b68e..7c7ef19c 100644
--- a/third_party/boringssl/linux-arm/crypto/fipsmodule/aesv8-armx32.S
+++ b/third_party/boringssl/linux-arm/crypto/fipsmodule/aesv8-armx32.S

@@ -3,9 +3,10 @@
 
 #if __ARM_MAX_ARCH__>=7
 .text
-.arch	armv7-a
+.arch	armv7-a	@ don't confuse not-so-latest binutils with argv8 :-)
 .fpu	neon
 .code	32
+#undef	__thumb2__
 .align	5
 .Lrcon:
 .long	0x01,0x01,0x01,0x01

diff --git a/third_party/boringssl/linux-arm/crypto/fipsmodule/armv4-mont.S b/third_party/boringssl/linux-arm/crypto/fipsmodule/armv4-mont.S
index e59599f..e77a9ea 100644
--- a/third_party/boringssl/linux-arm/crypto/fipsmodule/armv4-mont.S
+++ b/third_party/boringssl/linux-arm/crypto/fipsmodule/armv4-mont.S

@@ -2,7 +2,12 @@
 #include <openssl/arm_arch.h>
 
 .text
+#if defined(__thumb2__)
+.syntax	unified
+.thumb
+#else
 .code	32
+#endif
 
 #if __ARM_MAX_ARCH__>=7
 .align	5
@@ -22,7 +27,7 @@
 #if __ARM_MAX_ARCH__>=7
 	tst	ip,#7
 	bne	.Lialu
-	adr	r0,bn_mul_mont
+	adr	r0,.Lbn_mul_mont
 	ldr	r2,.LOPENSSL_armcap
 	ldr	r0,[r0,r2]
 #ifdef	__APPLE__
@@ -38,6 +43,9 @@
 #endif
 	cmp	ip,#2
 	mov	r0,ip			@ load num
+#ifdef	__thumb2__
+	ittt	lt
+#endif
 	movlt	r0,#0
 	addlt	sp,sp,#2*4
 	blt	.Labrt
@@ -85,10 +93,11 @@
 	ldr	r8,[r0,#14*4]		@ restore n0
 	adc	r14,r14,#0
 	str	r12,[r0]		@ tp[num-1]=
+	mov	r7,sp
 	str	r14,[r0,#4]		@ tp[num]=
 
 .Louter:
-	sub	r7,r0,sp		@ "original" r0-1 value
+	sub	r7,r0,r7		@ "original" r0-1 value
 	sub	r1,r1,r7		@ "rewind" ap to &ap[1]
 	ldr	r2,[r4,#4]!		@ *(++bp)
 	sub	r3,r3,r7		@ "rewind" np to &np[1]
@@ -133,11 +142,16 @@
 	str	r14,[r0,#4]		@ tp[num]=
 
 	cmp	r4,r7
+#ifdef	__thumb2__
+	itt	ne
+#endif
+	movne	r7,sp
 	bne	.Louter
 
 	ldr	r2,[r0,#12*4]		@ pull rp
+	mov	r5,sp
 	add	r0,r0,#4		@ r0 to point at &tp[num]
-	sub	r5,r0,sp		@ "original" num value
+	sub	r5,r0,r5		@ "original" num value
 	mov	r4,sp			@ "rewind" r4
 	mov	r1,r4			@ "borrow" r1
 	sub	r3,r3,r5		@ "rewind" r3 to &np[0]
@@ -163,13 +177,14 @@
 	cmp	r4,r0
 	bne	.Lcopy
 
-	add	sp,r0,#4		@ skip over tp[num+1]
+	mov	sp,r0
+	add	sp,sp,#4		@ skip over tp[num+1]
 	ldmia	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,r12,lr}		@ restore registers
 	add	sp,sp,#2*4		@ skip over {r0,r2}
 	mov	r0,#1
 .Labrt:
 #if __ARM_ARCH__>=5
-	bx	lr				@ .word	0xe12fff1e
+	bx	lr				@ bx lr
 #else
 	tst	lr,#1
 	moveq	pc,lr			@ be binary compatible with V4, yet
@@ -187,27 +202,31 @@
 	stmdb	sp!,{r4,r5,r6,r7,r8,r9,r10,r11}
 	vstmdb	sp!,{d8,d9,d10,d11,d12,d13,d14,d15}		@ ABI specification says so
 	ldmia	ip,{r4,r5}		@ load rest of parameter block
+	mov	ip,sp
 
-	sub	r7,sp,#16
+	cmp	r5,#8
+	bhi	.LNEON_8n
+
+	@ special case for r5==8, everything is in register bank...
+
 	vld1.32	{d28[0]}, [r2,:32]!
-	sub	r7,r7,r5,lsl#4
+	veor	d8,d8,d8
+	sub	r7,sp,r5,lsl#4
 	vld1.32	{d0,d1,d2,d3},  [r1]!		@ can't specify :32 :-(
 	and	r7,r7,#-64
 	vld1.32	{d30[0]}, [r4,:32]
 	mov	sp,r7			@ alloca
-	veor	d8,d8,d8
-	subs	r8,r5,#8
 	vzip.16	d28,d8
 
 	vmull.u32	q6,d28,d0[0]
 	vmull.u32	q7,d28,d0[1]
 	vmull.u32	q8,d28,d1[0]
-	vshl.i64	d10,d13,#16
+	vshl.i64	d29,d13,#16
 	vmull.u32	q9,d28,d1[1]
 
-	vadd.u64	d10,d10,d12
+	vadd.u64	d29,d29,d12
 	veor	d8,d8,d8
-	vmul.u32	d29,d10,d30
+	vmul.u32	d29,d29,d30
 
 	vmull.u32	q10,d28,d2[0]
 	vld1.32	{d4,d5,d6,d7}, [r3]!
@@ -216,10 +235,6 @@
 	vzip.16	d29,d8
 	vmull.u32	q13,d28,d3[1]
 
-	bne	.LNEON_1st
-
-	@ special case for num=8, everything is in register bank...
-
 	vmlal.u32	q6,d29,d4[0]
 	sub	r9,r5,#1
 	vmlal.u32	q7,d29,d4[1]
@@ -255,13 +270,13 @@
 	vmlal.u32	q6,d28,d0[0]
 	vmlal.u32	q7,d28,d0[1]
 	vmlal.u32	q8,d28,d1[0]
-	vshl.i64	d10,d13,#16
+	vshl.i64	d29,d13,#16
 	vmlal.u32	q9,d28,d1[1]
 
-	vadd.u64	d10,d10,d12
+	vadd.u64	d29,d29,d12
 	veor	d8,d8,d8
 	subs	r9,r9,#1
-	vmul.u32	d29,d10,d30
+	vmul.u32	d29,d29,d30
 
 	vmlal.u32	q10,d28,d2[0]
 	vmlal.u32	q11,d28,d2[1]
@@ -298,231 +313,576 @@
 	vshr.u64	d10,d12,#16
 	mov	r8,r5
 	vadd.u64	d13,d13,d10
-	add	r6,sp,#16
+	add	r6,sp,#96
 	vshr.u64	d10,d13,#16
 	vzip.16	d12,d13
 
-	b	.LNEON_tail2
+	b	.LNEON_tail_entry
 
 .align	4
-.LNEON_1st:
-	vmlal.u32	q6,d29,d4[0]
-	vld1.32	{d0,d1,d2,d3}, [r1]!
-	vmlal.u32	q7,d29,d4[1]
-	subs	r8,r8,#8
-	vmlal.u32	q8,d29,d5[0]
-	vmlal.u32	q9,d29,d5[1]
-
-	vmlal.u32	q10,d29,d6[0]
-	vld1.32	{d4,d5}, [r3]!
-	vmlal.u32	q11,d29,d6[1]
-	vst1.64	{q6,q7}, [r7,:256]!
-	vmlal.u32	q12,d29,d7[0]
-	vmlal.u32	q13,d29,d7[1]
-	vst1.64	{q8,q9}, [r7,:256]!
-
-	vmull.u32	q6,d28,d0[0]
-	vld1.32	{d6,d7}, [r3]!
-	vmull.u32	q7,d28,d0[1]
-	vst1.64	{q10,q11}, [r7,:256]!
-	vmull.u32	q8,d28,d1[0]
-	vmull.u32	q9,d28,d1[1]
-	vst1.64	{q12,q13}, [r7,:256]!
-
-	vmull.u32	q10,d28,d2[0]
-	vmull.u32	q11,d28,d2[1]
-	vmull.u32	q12,d28,d3[0]
-	vmull.u32	q13,d28,d3[1]
-
-	bne	.LNEON_1st
-
-	vmlal.u32	q6,d29,d4[0]
-	add	r6,sp,#16
-	vmlal.u32	q7,d29,d4[1]
-	sub	r1,r1,r5,lsl#2		@ rewind r1
-	vmlal.u32	q8,d29,d5[0]
-	vld1.64	{q5}, [sp,:128]
-	vmlal.u32	q9,d29,d5[1]
-	sub	r9,r5,#1
-
-	vmlal.u32	q10,d29,d6[0]
-	vst1.64	{q6,q7}, [r7,:256]!
-	vmlal.u32	q11,d29,d6[1]
-	vshr.u64	d10,d10,#16
-	vld1.64	{q6},       [r6, :128]!
-	vmlal.u32	q12,d29,d7[0]
-	vst1.64	{q8,q9}, [r7,:256]!
-	vmlal.u32	q13,d29,d7[1]
-
-	vst1.64	{q10,q11}, [r7,:256]!
-	vadd.u64	d10,d10,d11
-	veor	q4,q4,q4
-	vst1.64	{q12,q13}, [r7,:256]!
-	vld1.64	{q7,q8}, [r6, :256]!
-	vst1.64	{q4},          [r7,:128]
-	vshr.u64	d10,d10,#16
-
-	b	.LNEON_outer
-
-.align	4
-.LNEON_outer:
-	vld1.32	{d28[0]}, [r2,:32]!
-	sub	r3,r3,r5,lsl#2		@ rewind r3
-	vld1.32	{d0,d1,d2,d3},  [r1]!
-	veor	d8,d8,d8
-	mov	r7,sp
-	vzip.16	d28,d8
+.LNEON_8n:
+	veor	q6,q6,q6
+	sub	r7,sp,#128
+	veor	q7,q7,q7
+	sub	r7,r7,r5,lsl#4
+	veor	q8,q8,q8
+	and	r7,r7,#-64
+	veor	q9,q9,q9
+	mov	sp,r7			@ alloca
+	veor	q10,q10,q10
+	add	r7,r7,#256
+	veor	q11,q11,q11
 	sub	r8,r5,#8
-	vadd.u64	d12,d12,d10
+	veor	q12,q12,q12
+	veor	q13,q13,q13
+
+.LNEON_8n_init:
+	vst1.64	{q6,q7},[r7,:256]!
+	subs	r8,r8,#8
+	vst1.64	{q8,q9},[r7,:256]!
+	vst1.64	{q10,q11},[r7,:256]!
+	vst1.64	{q12,q13},[r7,:256]!
+	bne	.LNEON_8n_init
+
+	add	r6,sp,#256
+	vld1.32	{d0,d1,d2,d3},[r1]!
+	add	r10,sp,#8
+	vld1.32	{d30[0]},[r4,:32]
+	mov	r9,r5
+	b	.LNEON_8n_outer
+
+.align	4
+.LNEON_8n_outer:
+	vld1.32	{d28[0]},[r2,:32]!	@ *b++
+	veor	d8,d8,d8
+	vzip.16	d28,d8
+	add	r7,sp,#128
+	vld1.32	{d4,d5,d6,d7},[r3]!
 
 	vmlal.u32	q6,d28,d0[0]
-	vld1.64	{q9,q10},[r6,:256]!
 	vmlal.u32	q7,d28,d0[1]
-	vmlal.u32	q8,d28,d1[0]
-	vld1.64	{q11,q12},[r6,:256]!
-	vmlal.u32	q9,d28,d1[1]
-
-	vshl.i64	d10,d13,#16
 	veor	d8,d8,d8
-	vadd.u64	d10,d10,d12
-	vld1.64	{q13},[r6,:128]!
-	vmul.u32	d29,d10,d30
-
+	vmlal.u32	q8,d28,d1[0]
+	vshl.i64	d29,d13,#16
+	vmlal.u32	q9,d28,d1[1]
+	vadd.u64	d29,d29,d12
 	vmlal.u32	q10,d28,d2[0]
-	vld1.32	{d4,d5,d6,d7}, [r3]!
+	vmul.u32	d29,d29,d30
 	vmlal.u32	q11,d28,d2[1]
+	vst1.32	{d28},[sp,:64]		@ put aside smashed b[8*i+0]
 	vmlal.u32	q12,d28,d3[0]
 	vzip.16	d29,d8
 	vmlal.u32	q13,d28,d3[1]
-
-.LNEON_inner:
+	vld1.32	{d28[0]},[r2,:32]!	@ *b++
 	vmlal.u32	q6,d29,d4[0]
-	vld1.32	{d0,d1,d2,d3}, [r1]!
+	veor	d10,d10,d10
 	vmlal.u32	q7,d29,d4[1]
-	subs	r8,r8,#8
+	vzip.16	d28,d10
 	vmlal.u32	q8,d29,d5[0]
+	vshr.u64	d12,d12,#16
 	vmlal.u32	q9,d29,d5[1]
-	vst1.64	{q6,q7}, [r7,:256]!
-
 	vmlal.u32	q10,d29,d6[0]
-	vld1.64	{q6},       [r6, :128]!
+	vadd.u64	d12,d12,d13
 	vmlal.u32	q11,d29,d6[1]
-	vst1.64	{q8,q9}, [r7,:256]!
+	vshr.u64	d12,d12,#16
 	vmlal.u32	q12,d29,d7[0]
-	vld1.64	{q7,q8}, [r6, :256]!
 	vmlal.u32	q13,d29,d7[1]
-	vst1.64	{q10,q11}, [r7,:256]!
+	vadd.u64	d14,d14,d12
+	vst1.32	{d29},[r10,:64]!	@ put aside smashed m[8*i+0]
+	vmlal.u32	q7,d28,d0[0]
+	vld1.64	{q6},[r6,:128]!
+	vmlal.u32	q8,d28,d0[1]
+	veor	d8,d8,d8
+	vmlal.u32	q9,d28,d1[0]
+	vshl.i64	d29,d15,#16
+	vmlal.u32	q10,d28,d1[1]
+	vadd.u64	d29,d29,d14
+	vmlal.u32	q11,d28,d2[0]
+	vmul.u32	d29,d29,d30
+	vmlal.u32	q12,d28,d2[1]
+	vst1.32	{d28},[r10,:64]!	@ put aside smashed b[8*i+1]
+	vmlal.u32	q13,d28,d3[0]
+	vzip.16	d29,d8
+	vmlal.u32	q6,d28,d3[1]
+	vld1.32	{d28[0]},[r2,:32]!	@ *b++
+	vmlal.u32	q7,d29,d4[0]
+	veor	d10,d10,d10
+	vmlal.u32	q8,d29,d4[1]
+	vzip.16	d28,d10
+	vmlal.u32	q9,d29,d5[0]
+	vshr.u64	d14,d14,#16
+	vmlal.u32	q10,d29,d5[1]
+	vmlal.u32	q11,d29,d6[0]
+	vadd.u64	d14,d14,d15
+	vmlal.u32	q12,d29,d6[1]
+	vshr.u64	d14,d14,#16
+	vmlal.u32	q13,d29,d7[0]
+	vmlal.u32	q6,d29,d7[1]
+	vadd.u64	d16,d16,d14
+	vst1.32	{d29},[r10,:64]!	@ put aside smashed m[8*i+1]
+	vmlal.u32	q8,d28,d0[0]
+	vld1.64	{q7},[r6,:128]!
+	vmlal.u32	q9,d28,d0[1]
+	veor	d8,d8,d8
+	vmlal.u32	q10,d28,d1[0]
+	vshl.i64	d29,d17,#16
+	vmlal.u32	q11,d28,d1[1]
+	vadd.u64	d29,d29,d16
+	vmlal.u32	q12,d28,d2[0]
+	vmul.u32	d29,d29,d30
+	vmlal.u32	q13,d28,d2[1]
+	vst1.32	{d28},[r10,:64]!	@ put aside smashed b[8*i+2]
+	vmlal.u32	q6,d28,d3[0]
+	vzip.16	d29,d8
+	vmlal.u32	q7,d28,d3[1]
+	vld1.32	{d28[0]},[r2,:32]!	@ *b++
+	vmlal.u32	q8,d29,d4[0]
+	veor	d10,d10,d10
+	vmlal.u32	q9,d29,d4[1]
+	vzip.16	d28,d10
+	vmlal.u32	q10,d29,d5[0]
+	vshr.u64	d16,d16,#16
+	vmlal.u32	q11,d29,d5[1]
+	vmlal.u32	q12,d29,d6[0]
+	vadd.u64	d16,d16,d17
+	vmlal.u32	q13,d29,d6[1]
+	vshr.u64	d16,d16,#16
+	vmlal.u32	q6,d29,d7[0]
+	vmlal.u32	q7,d29,d7[1]
+	vadd.u64	d18,d18,d16
+	vst1.32	{d29},[r10,:64]!	@ put aside smashed m[8*i+2]
+	vmlal.u32	q9,d28,d0[0]
+	vld1.64	{q8},[r6,:128]!
+	vmlal.u32	q10,d28,d0[1]
+	veor	d8,d8,d8
+	vmlal.u32	q11,d28,d1[0]
+	vshl.i64	d29,d19,#16
+	vmlal.u32	q12,d28,d1[1]
+	vadd.u64	d29,d29,d18
+	vmlal.u32	q13,d28,d2[0]
+	vmul.u32	d29,d29,d30
+	vmlal.u32	q6,d28,d2[1]
+	vst1.32	{d28},[r10,:64]!	@ put aside smashed b[8*i+3]
+	vmlal.u32	q7,d28,d3[0]
+	vzip.16	d29,d8
+	vmlal.u32	q8,d28,d3[1]
+	vld1.32	{d28[0]},[r2,:32]!	@ *b++
+	vmlal.u32	q9,d29,d4[0]
+	veor	d10,d10,d10
+	vmlal.u32	q10,d29,d4[1]
+	vzip.16	d28,d10
+	vmlal.u32	q11,d29,d5[0]
+	vshr.u64	d18,d18,#16
+	vmlal.u32	q12,d29,d5[1]
+	vmlal.u32	q13,d29,d6[0]
+	vadd.u64	d18,d18,d19
+	vmlal.u32	q6,d29,d6[1]
+	vshr.u64	d18,d18,#16
+	vmlal.u32	q7,d29,d7[0]
+	vmlal.u32	q8,d29,d7[1]
+	vadd.u64	d20,d20,d18
+	vst1.32	{d29},[r10,:64]!	@ put aside smashed m[8*i+3]
+	vmlal.u32	q10,d28,d0[0]
+	vld1.64	{q9},[r6,:128]!
+	vmlal.u32	q11,d28,d0[1]
+	veor	d8,d8,d8
+	vmlal.u32	q12,d28,d1[0]
+	vshl.i64	d29,d21,#16
+	vmlal.u32	q13,d28,d1[1]
+	vadd.u64	d29,d29,d20
+	vmlal.u32	q6,d28,d2[0]
+	vmul.u32	d29,d29,d30
+	vmlal.u32	q7,d28,d2[1]
+	vst1.32	{d28},[r10,:64]!	@ put aside smashed b[8*i+4]
+	vmlal.u32	q8,d28,d3[0]
+	vzip.16	d29,d8
+	vmlal.u32	q9,d28,d3[1]
+	vld1.32	{d28[0]},[r2,:32]!	@ *b++
+	vmlal.u32	q10,d29,d4[0]
+	veor	d10,d10,d10
+	vmlal.u32	q11,d29,d4[1]
+	vzip.16	d28,d10
+	vmlal.u32	q12,d29,d5[0]
+	vshr.u64	d20,d20,#16
+	vmlal.u32	q13,d29,d5[1]
+	vmlal.u32	q6,d29,d6[0]
+	vadd.u64	d20,d20,d21
+	vmlal.u32	q7,d29,d6[1]
+	vshr.u64	d20,d20,#16
+	vmlal.u32	q8,d29,d7[0]
+	vmlal.u32	q9,d29,d7[1]
+	vadd.u64	d22,d22,d20
+	vst1.32	{d29},[r10,:64]!	@ put aside smashed m[8*i+4]
+	vmlal.u32	q11,d28,d0[0]
+	vld1.64	{q10},[r6,:128]!
+	vmlal.u32	q12,d28,d0[1]
+	veor	d8,d8,d8
+	vmlal.u32	q13,d28,d1[0]
+	vshl.i64	d29,d23,#16
+	vmlal.u32	q6,d28,d1[1]
+	vadd.u64	d29,d29,d22
+	vmlal.u32	q7,d28,d2[0]
+	vmul.u32	d29,d29,d30
+	vmlal.u32	q8,d28,d2[1]
+	vst1.32	{d28},[r10,:64]!	@ put aside smashed b[8*i+5]
+	vmlal.u32	q9,d28,d3[0]
+	vzip.16	d29,d8
+	vmlal.u32	q10,d28,d3[1]
+	vld1.32	{d28[0]},[r2,:32]!	@ *b++
+	vmlal.u32	q11,d29,d4[0]
+	veor	d10,d10,d10
+	vmlal.u32	q12,d29,d4[1]
+	vzip.16	d28,d10
+	vmlal.u32	q13,d29,d5[0]
+	vshr.u64	d22,d22,#16
+	vmlal.u32	q6,d29,d5[1]
+	vmlal.u32	q7,d29,d6[0]
+	vadd.u64	d22,d22,d23
+	vmlal.u32	q8,d29,d6[1]
+	vshr.u64	d22,d22,#16
+	vmlal.u32	q9,d29,d7[0]
+	vmlal.u32	q10,d29,d7[1]
+	vadd.u64	d24,d24,d22
+	vst1.32	{d29},[r10,:64]!	@ put aside smashed m[8*i+5]
+	vmlal.u32	q12,d28,d0[0]
+	vld1.64	{q11},[r6,:128]!
+	vmlal.u32	q13,d28,d0[1]
+	veor	d8,d8,d8
+	vmlal.u32	q6,d28,d1[0]
+	vshl.i64	d29,d25,#16
+	vmlal.u32	q7,d28,d1[1]
+	vadd.u64	d29,d29,d24
+	vmlal.u32	q8,d28,d2[0]
+	vmul.u32	d29,d29,d30
+	vmlal.u32	q9,d28,d2[1]
+	vst1.32	{d28},[r10,:64]!	@ put aside smashed b[8*i+6]
+	vmlal.u32	q10,d28,d3[0]
+	vzip.16	d29,d8
+	vmlal.u32	q11,d28,d3[1]
+	vld1.32	{d28[0]},[r2,:32]!	@ *b++
+	vmlal.u32	q12,d29,d4[0]
+	veor	d10,d10,d10
+	vmlal.u32	q13,d29,d4[1]
+	vzip.16	d28,d10
+	vmlal.u32	q6,d29,d5[0]
+	vshr.u64	d24,d24,#16
+	vmlal.u32	q7,d29,d5[1]
+	vmlal.u32	q8,d29,d6[0]
+	vadd.u64	d24,d24,d25
+	vmlal.u32	q9,d29,d6[1]
+	vshr.u64	d24,d24,#16
+	vmlal.u32	q10,d29,d7[0]
+	vmlal.u32	q11,d29,d7[1]
+	vadd.u64	d26,d26,d24
+	vst1.32	{d29},[r10,:64]!	@ put aside smashed m[8*i+6]
+	vmlal.u32	q13,d28,d0[0]
+	vld1.64	{q12},[r6,:128]!
+	vmlal.u32	q6,d28,d0[1]
+	veor	d8,d8,d8
+	vmlal.u32	q7,d28,d1[0]
+	vshl.i64	d29,d27,#16
+	vmlal.u32	q8,d28,d1[1]
+	vadd.u64	d29,d29,d26
+	vmlal.u32	q9,d28,d2[0]
+	vmul.u32	d29,d29,d30
+	vmlal.u32	q10,d28,d2[1]
+	vst1.32	{d28},[r10,:64]!	@ put aside smashed b[8*i+7]
+	vmlal.u32	q11,d28,d3[0]
+	vzip.16	d29,d8
+	vmlal.u32	q12,d28,d3[1]
+	vld1.32	{d28},[sp,:64]		@ pull smashed b[8*i+0]
+	vmlal.u32	q13,d29,d4[0]
+	vld1.32	{d0,d1,d2,d3},[r1]!
+	vmlal.u32	q6,d29,d4[1]
+	vmlal.u32	q7,d29,d5[0]
+	vshr.u64	d26,d26,#16
+	vmlal.u32	q8,d29,d5[1]
+	vmlal.u32	q9,d29,d6[0]
+	vadd.u64	d26,d26,d27
+	vmlal.u32	q10,d29,d6[1]
+	vshr.u64	d26,d26,#16
+	vmlal.u32	q11,d29,d7[0]
+	vmlal.u32	q12,d29,d7[1]
+	vadd.u64	d12,d12,d26
+	vst1.32	{d29},[r10,:64]	@ put aside smashed m[8*i+7]
+	add	r10,sp,#8		@ rewind
+	sub	r8,r5,#8
+	b	.LNEON_8n_inner
 
+.align	4
+.LNEON_8n_inner:
+	subs	r8,r8,#8
 	vmlal.u32	q6,d28,d0[0]
-	vld1.64	{q9,q10}, [r6, :256]!
+	vld1.64	{q13},[r6,:128]
 	vmlal.u32	q7,d28,d0[1]
-	vst1.64	{q12,q13}, [r7,:256]!
+	vld1.32	{d29},[r10,:64]!	@ pull smashed m[8*i+0]
 	vmlal.u32	q8,d28,d1[0]
-	vld1.64	{q11,q12}, [r6, :256]!
+	vld1.32	{d4,d5,d6,d7},[r3]!
 	vmlal.u32	q9,d28,d1[1]
-	vld1.32	{d4,d5,d6,d7}, [r3]!
-
+	it	ne
+	addne	r6,r6,#16	@ don't advance in last iteration
 	vmlal.u32	q10,d28,d2[0]
-	vld1.64	{q13},       [r6, :128]!
 	vmlal.u32	q11,d28,d2[1]
 	vmlal.u32	q12,d28,d3[0]
 	vmlal.u32	q13,d28,d3[1]
-
-	bne	.LNEON_inner
-
+	vld1.32	{d28},[r10,:64]!	@ pull smashed b[8*i+1]
 	vmlal.u32	q6,d29,d4[0]
-	add	r6,sp,#16
 	vmlal.u32	q7,d29,d4[1]
-	sub	r1,r1,r5,lsl#2		@ rewind r1
 	vmlal.u32	q8,d29,d5[0]
-	vld1.64	{q5}, [sp,:128]
 	vmlal.u32	q9,d29,d5[1]
-	subs	r9,r9,#1
-
 	vmlal.u32	q10,d29,d6[0]
-	vst1.64	{q6,q7}, [r7,:256]!
 	vmlal.u32	q11,d29,d6[1]
-	vld1.64	{q6},       [r6, :128]!
-	vshr.u64	d10,d10,#16
-	vst1.64	{q8,q9}, [r7,:256]!
 	vmlal.u32	q12,d29,d7[0]
-	vld1.64	{q7,q8}, [r6, :256]!
 	vmlal.u32	q13,d29,d7[1]
+	vst1.64	{q6},[r7,:128]!
+	vmlal.u32	q7,d28,d0[0]
+	vld1.64	{q6},[r6,:128]
+	vmlal.u32	q8,d28,d0[1]
+	vld1.32	{d29},[r10,:64]!	@ pull smashed m[8*i+1]
+	vmlal.u32	q9,d28,d1[0]
+	it	ne
+	addne	r6,r6,#16	@ don't advance in last iteration
+	vmlal.u32	q10,d28,d1[1]
+	vmlal.u32	q11,d28,d2[0]
+	vmlal.u32	q12,d28,d2[1]
+	vmlal.u32	q13,d28,d3[0]
+	vmlal.u32	q6,d28,d3[1]
+	vld1.32	{d28},[r10,:64]!	@ pull smashed b[8*i+2]
+	vmlal.u32	q7,d29,d4[0]
+	vmlal.u32	q8,d29,d4[1]
+	vmlal.u32	q9,d29,d5[0]
+	vmlal.u32	q10,d29,d5[1]
+	vmlal.u32	q11,d29,d6[0]
+	vmlal.u32	q12,d29,d6[1]
+	vmlal.u32	q13,d29,d7[0]
+	vmlal.u32	q6,d29,d7[1]
+	vst1.64	{q7},[r7,:128]!
+	vmlal.u32	q8,d28,d0[0]
+	vld1.64	{q7},[r6,:128]
+	vmlal.u32	q9,d28,d0[1]
+	vld1.32	{d29},[r10,:64]!	@ pull smashed m[8*i+2]
+	vmlal.u32	q10,d28,d1[0]
+	it	ne
+	addne	r6,r6,#16	@ don't advance in last iteration
+	vmlal.u32	q11,d28,d1[1]
+	vmlal.u32	q12,d28,d2[0]
+	vmlal.u32	q13,d28,d2[1]
+	vmlal.u32	q6,d28,d3[0]
+	vmlal.u32	q7,d28,d3[1]
+	vld1.32	{d28},[r10,:64]!	@ pull smashed b[8*i+3]
+	vmlal.u32	q8,d29,d4[0]
+	vmlal.u32	q9,d29,d4[1]
+	vmlal.u32	q10,d29,d5[0]
+	vmlal.u32	q11,d29,d5[1]
+	vmlal.u32	q12,d29,d6[0]
+	vmlal.u32	q13,d29,d6[1]
+	vmlal.u32	q6,d29,d7[0]
+	vmlal.u32	q7,d29,d7[1]
+	vst1.64	{q8},[r7,:128]!
+	vmlal.u32	q9,d28,d0[0]
+	vld1.64	{q8},[r6,:128]
+	vmlal.u32	q10,d28,d0[1]
+	vld1.32	{d29},[r10,:64]!	@ pull smashed m[8*i+3]
+	vmlal.u32	q11,d28,d1[0]
+	it	ne
+	addne	r6,r6,#16	@ don't advance in last iteration
+	vmlal.u32	q12,d28,d1[1]
+	vmlal.u32	q13,d28,d2[0]
+	vmlal.u32	q6,d28,d2[1]
+	vmlal.u32	q7,d28,d3[0]
+	vmlal.u32	q8,d28,d3[1]
+	vld1.32	{d28},[r10,:64]!	@ pull smashed b[8*i+4]
+	vmlal.u32	q9,d29,d4[0]
+	vmlal.u32	q10,d29,d4[1]
+	vmlal.u32	q11,d29,d5[0]
+	vmlal.u32	q12,d29,d5[1]
+	vmlal.u32	q13,d29,d6[0]
+	vmlal.u32	q6,d29,d6[1]
+	vmlal.u32	q7,d29,d7[0]
+	vmlal.u32	q8,d29,d7[1]
+	vst1.64	{q9},[r7,:128]!
+	vmlal.u32	q10,d28,d0[0]
+	vld1.64	{q9},[r6,:128]
+	vmlal.u32	q11,d28,d0[1]
+	vld1.32	{d29},[r10,:64]!	@ pull smashed m[8*i+4]
+	vmlal.u32	q12,d28,d1[0]
+	it	ne
+	addne	r6,r6,#16	@ don't advance in last iteration
+	vmlal.u32	q13,d28,d1[1]
+	vmlal.u32	q6,d28,d2[0]
+	vmlal.u32	q7,d28,d2[1]
+	vmlal.u32	q8,d28,d3[0]
+	vmlal.u32	q9,d28,d3[1]
+	vld1.32	{d28},[r10,:64]!	@ pull smashed b[8*i+5]
+	vmlal.u32	q10,d29,d4[0]
+	vmlal.u32	q11,d29,d4[1]
+	vmlal.u32	q12,d29,d5[0]
+	vmlal.u32	q13,d29,d5[1]
+	vmlal.u32	q6,d29,d6[0]
+	vmlal.u32	q7,d29,d6[1]
+	vmlal.u32	q8,d29,d7[0]
+	vmlal.u32	q9,d29,d7[1]
+	vst1.64	{q10},[r7,:128]!
+	vmlal.u32	q11,d28,d0[0]
+	vld1.64	{q10},[r6,:128]
+	vmlal.u32	q12,d28,d0[1]
+	vld1.32	{d29},[r10,:64]!	@ pull smashed m[8*i+5]
+	vmlal.u32	q13,d28,d1[0]
+	it	ne
+	addne	r6,r6,#16	@ don't advance in last iteration
+	vmlal.u32	q6,d28,d1[1]
+	vmlal.u32	q7,d28,d2[0]
+	vmlal.u32	q8,d28,d2[1]
+	vmlal.u32	q9,d28,d3[0]
+	vmlal.u32	q10,d28,d3[1]
+	vld1.32	{d28},[r10,:64]!	@ pull smashed b[8*i+6]
+	vmlal.u32	q11,d29,d4[0]
+	vmlal.u32	q12,d29,d4[1]
+	vmlal.u32	q13,d29,d5[0]
+	vmlal.u32	q6,d29,d5[1]
+	vmlal.u32	q7,d29,d6[0]
+	vmlal.u32	q8,d29,d6[1]
+	vmlal.u32	q9,d29,d7[0]
+	vmlal.u32	q10,d29,d7[1]
+	vst1.64	{q11},[r7,:128]!
+	vmlal.u32	q12,d28,d0[0]
+	vld1.64	{q11},[r6,:128]
+	vmlal.u32	q13,d28,d0[1]
+	vld1.32	{d29},[r10,:64]!	@ pull smashed m[8*i+6]
+	vmlal.u32	q6,d28,d1[0]
+	it	ne
+	addne	r6,r6,#16	@ don't advance in last iteration
+	vmlal.u32	q7,d28,d1[1]
+	vmlal.u32	q8,d28,d2[0]
+	vmlal.u32	q9,d28,d2[1]
+	vmlal.u32	q10,d28,d3[0]
+	vmlal.u32	q11,d28,d3[1]
+	vld1.32	{d28},[r10,:64]!	@ pull smashed b[8*i+7]
+	vmlal.u32	q12,d29,d4[0]
+	vmlal.u32	q13,d29,d4[1]
+	vmlal.u32	q6,d29,d5[0]
+	vmlal.u32	q7,d29,d5[1]
+	vmlal.u32	q8,d29,d6[0]
+	vmlal.u32	q9,d29,d6[1]
+	vmlal.u32	q10,d29,d7[0]
+	vmlal.u32	q11,d29,d7[1]
+	vst1.64	{q12},[r7,:128]!
+	vmlal.u32	q13,d28,d0[0]
+	vld1.64	{q12},[r6,:128]
+	vmlal.u32	q6,d28,d0[1]
+	vld1.32	{d29},[r10,:64]!	@ pull smashed m[8*i+7]
+	vmlal.u32	q7,d28,d1[0]
+	it	ne
+	addne	r6,r6,#16	@ don't advance in last iteration
+	vmlal.u32	q8,d28,d1[1]
+	vmlal.u32	q9,d28,d2[0]
+	vmlal.u32	q10,d28,d2[1]
+	vmlal.u32	q11,d28,d3[0]
+	vmlal.u32	q12,d28,d3[1]
+	it	eq
+	subeq	r1,r1,r5,lsl#2	@ rewind
+	vmlal.u32	q13,d29,d4[0]
+	vld1.32	{d28},[sp,:64]		@ pull smashed b[8*i+0]
+	vmlal.u32	q6,d29,d4[1]
+	vld1.32	{d0,d1,d2,d3},[r1]!
+	vmlal.u32	q7,d29,d5[0]
+	add	r10,sp,#8		@ rewind
+	vmlal.u32	q8,d29,d5[1]
+	vmlal.u32	q9,d29,d6[0]
+	vmlal.u32	q10,d29,d6[1]
+	vmlal.u32	q11,d29,d7[0]
+	vst1.64	{q13},[r7,:128]!
+	vmlal.u32	q12,d29,d7[1]
 
-	vst1.64	{q10,q11}, [r7,:256]!
-	vadd.u64	d10,d10,d11
-	vst1.64	{q12,q13}, [r7,:256]!
-	vshr.u64	d10,d10,#16
+	bne	.LNEON_8n_inner
+	add	r6,sp,#128
+	vst1.64	{q6,q7},[r7,:256]!
+	veor	q2,q2,q2		@ d4-d5
+	vst1.64	{q8,q9},[r7,:256]!
+	veor	q3,q3,q3		@ d6-d7
+	vst1.64	{q10,q11},[r7,:256]!
+	vst1.64	{q12},[r7,:128]
 
-	bne	.LNEON_outer
+	subs	r9,r9,#8
+	vld1.64	{q6,q7},[r6,:256]!
+	vld1.64	{q8,q9},[r6,:256]!
+	vld1.64	{q10,q11},[r6,:256]!
+	vld1.64	{q12,q13},[r6,:256]!
 
-	mov	r7,sp
-	mov	r8,r5
+	itt	ne
+	subne	r3,r3,r5,lsl#2	@ rewind
+	bne	.LNEON_8n_outer
 
-.LNEON_tail:
-	vadd.u64	d12,d12,d10
-	vld1.64	{q9,q10}, [r6, :256]!
+	add	r7,sp,#128
+	vst1.64	{q2,q3}, [sp,:256]!	@ start wiping stack frame
 	vshr.u64	d10,d12,#16
+	vst1.64	{q2,q3},[sp,:256]!
 	vadd.u64	d13,d13,d10
-	vld1.64	{q11,q12}, [r6, :256]!
+	vst1.64	{q2,q3}, [sp,:256]!
 	vshr.u64	d10,d13,#16
-	vld1.64	{q13},       [r6, :128]!
+	vst1.64	{q2,q3}, [sp,:256]!
 	vzip.16	d12,d13
 
-.LNEON_tail2:
+	mov	r8,r5
+	b	.LNEON_tail_entry
+
+.align	4
+.LNEON_tail:
+	vadd.u64	d12,d12,d10
+	vshr.u64	d10,d12,#16
+	vld1.64	{q8,q9}, [r6, :256]!
+	vadd.u64	d13,d13,d10
+	vld1.64	{q10,q11}, [r6, :256]!
+	vshr.u64	d10,d13,#16
+	vld1.64	{q12,q13}, [r6, :256]!
+	vzip.16	d12,d13
+
+.LNEON_tail_entry:
 	vadd.u64	d14,d14,d10
 	vst1.32	{d12[0]}, [r7, :32]!
 	vshr.u64	d10,d14,#16
 	vadd.u64	d15,d15,d10
 	vshr.u64	d10,d15,#16
 	vzip.16	d14,d15
-
 	vadd.u64	d16,d16,d10
 	vst1.32	{d14[0]}, [r7, :32]!
 	vshr.u64	d10,d16,#16
 	vadd.u64	d17,d17,d10
 	vshr.u64	d10,d17,#16
 	vzip.16	d16,d17
-
 	vadd.u64	d18,d18,d10
 	vst1.32	{d16[0]}, [r7, :32]!
 	vshr.u64	d10,d18,#16
 	vadd.u64	d19,d19,d10
 	vshr.u64	d10,d19,#16
 	vzip.16	d18,d19
-
 	vadd.u64	d20,d20,d10
 	vst1.32	{d18[0]}, [r7, :32]!
 	vshr.u64	d10,d20,#16
 	vadd.u64	d21,d21,d10
 	vshr.u64	d10,d21,#16
 	vzip.16	d20,d21
-
 	vadd.u64	d22,d22,d10
 	vst1.32	{d20[0]}, [r7, :32]!
 	vshr.u64	d10,d22,#16
 	vadd.u64	d23,d23,d10
 	vshr.u64	d10,d23,#16
 	vzip.16	d22,d23
-
 	vadd.u64	d24,d24,d10
 	vst1.32	{d22[0]}, [r7, :32]!
 	vshr.u64	d10,d24,#16
 	vadd.u64	d25,d25,d10
-	vld1.64	{q6}, [r6, :128]!
 	vshr.u64	d10,d25,#16
 	vzip.16	d24,d25
-
 	vadd.u64	d26,d26,d10
 	vst1.32	{d24[0]}, [r7, :32]!
 	vshr.u64	d10,d26,#16
 	vadd.u64	d27,d27,d10
-	vld1.64	{q7,q8},	[r6, :256]!
 	vshr.u64	d10,d27,#16
 	vzip.16	d26,d27
+	vld1.64	{q6,q7}, [r6, :256]!
 	subs	r8,r8,#8
-	vst1.32	{d26[0]}, [r7, :32]!
-
+	vst1.32	{d26[0]},   [r7, :32]!
 	bne	.LNEON_tail
 
 	vst1.32	{d10[0]}, [r7, :32]		@ top-most bit
@@ -542,8 +902,9 @@
 	bne	.LNEON_sub
 
 	ldr	r10, [r1]				@ load top-most bit
+	mov	r11,sp
 	veor	q0,q0,q0
-	sub	r11,r2,sp				@ this is num*4
+	sub	r11,r2,r11				@ this is num*4
 	veor	q1,q1,q1
 	mov	r1,sp
 	sub	r0,r0,r11				@ rewind r0
@@ -553,30 +914,36 @@
 .LNEON_copy_n_zap:
 	ldmia	r1!, {r4,r5,r6,r7}
 	ldmia	r0,  {r8,r9,r10,r11}
+	it	cc
 	movcc	r8, r4
 	vst1.64	{q0,q1}, [r3,:256]!			@ wipe
+	itt	cc
 	movcc	r9, r5
 	movcc	r10,r6
 	vst1.64	{q0,q1}, [r3,:256]!			@ wipe
+	it	cc
 	movcc	r11,r7
 	ldmia	r1, {r4,r5,r6,r7}
 	stmia	r0!, {r8,r9,r10,r11}
 	sub	r1,r1,#16
 	ldmia	r0, {r8,r9,r10,r11}
+	it	cc
 	movcc	r8, r4
 	vst1.64	{q0,q1}, [r1,:256]!			@ wipe
+	itt	cc
 	movcc	r9, r5
 	movcc	r10,r6
 	vst1.64	{q0,q1}, [r3,:256]!			@ wipe
+	it	cc
 	movcc	r11,r7
 	teq	r1,r2				@ preserves carry
 	stmia	r0!, {r8,r9,r10,r11}
 	bne	.LNEON_copy_n_zap
 
-	sub	sp,ip,#96
+	mov	sp,ip
 	vldmia	sp!,{d8,d9,d10,d11,d12,d13,d14,d15}
 	ldmia	sp!,{r4,r5,r6,r7,r8,r9,r10,r11}
-	bx	lr						@ .word	0xe12fff1e
+	bx	lr						@ bx lr
 .size	bn_mul8x_mont_neon,.-bn_mul8x_mont_neon
 #endif
 .byte	77,111,110,116,103,111,109,101,114,121,32,109,117,108,116,105,112,108,105,99,97,116,105,111,110,32,102,111,114,32,65,82,77,118,52,47,78,69,79,78,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46,111,114,103,62,0

diff --git a/third_party/boringssl/linux-arm/crypto/fipsmodule/ghash-armv4.S b/third_party/boringssl/linux-arm/crypto/fipsmodule/ghash-armv4.S
index 791b2890..5f8b50d 100644
--- a/third_party/boringssl/linux-arm/crypto/fipsmodule/ghash-armv4.S
+++ b/third_party/boringssl/linux-arm/crypto/fipsmodule/ghash-armv4.S

@@ -1,10 +1,15 @@
 #if defined(__arm__)
 #include <openssl/arm_arch.h>
 
-.syntax	unified
-
 .text
+#if defined(__thumb2__) || defined(__clang__)
+.syntax	unified
+#endif
+#if defined(__thumb2__)
+.thumb
+#else
 .code	32
+#endif
 
 #ifdef  __clang__
 #define ldrplb  ldrbpl
@@ -22,20 +27,28 @@
 
 .type	rem_4bit_get,%function
 rem_4bit_get:
-	sub	r2,pc,#8
-	sub	r2,r2,#32	@ &rem_4bit
+#if defined(__thumb2__)
+	adr	r2,rem_4bit
+#else
+	sub	r2,pc,#8+32	@ &rem_4bit
+#endif
 	b	.Lrem_4bit_got
 	nop
+	nop
 .size	rem_4bit_get,.-rem_4bit_get
 
 .globl	gcm_ghash_4bit
 .hidden	gcm_ghash_4bit
 .type	gcm_ghash_4bit,%function
+.align	4
 gcm_ghash_4bit:
-	sub	r12,pc,#8
+#if defined(__thumb2__)
+	adr	r12,rem_4bit
+#else
+	sub	r12,pc,#8+48		@ &rem_4bit
+#endif
 	add	r3,r2,r3		@ r3 to point at the end
 	stmdb	sp!,{r3,r4,r5,r6,r7,r8,r9,r10,r11,lr}		@ save r3/end too
-	sub	r12,r12,#48		@ &rem_4bit
 
 	ldmia	r12,{r4,r5,r6,r7,r8,r9,r10,r11}		@ copy rem_4bit ...
 	stmdb	sp!,{r4,r5,r6,r7,r8,r9,r10,r11}		@ ... to stack
@@ -82,7 +95,10 @@
 	eor	r5,r5,r6,lsl#28
 	ldrh	r8,[sp,r12]		@ rem_4bit[rem]
 	eor	r6,r10,r6,lsr#4
-	ldrbpl	r12,[r2,r3]
+#ifdef	__thumb2__
+	it	pl
+#endif
+	ldrplb	r12,[r2,r3]
 	eor	r6,r6,r7,lsl#28
 	eor	r7,r11,r7,lsr#4
 
@@ -92,15 +108,24 @@
 	add	r14,r14,r14
 	ldmia	r11,{r8,r9,r10,r11}	@ load Htbl[nhi]
 	eor	r4,r8,r4,lsr#4
-	ldrbpl	r8,[r0,r3]
+#ifdef	__thumb2__
+	it	pl
+#endif
+	ldrplb	r8,[r0,r3]
 	eor	r4,r4,r5,lsl#28
 	eor	r5,r9,r5,lsr#4
 	ldrh	r9,[sp,r14]
 	eor	r5,r5,r6,lsl#28
 	eor	r6,r10,r6,lsr#4
 	eor	r6,r6,r7,lsl#28
+#ifdef	__thumb2__
+	it	pl
+#endif
 	eorpl	r12,r12,r8
 	eor	r7,r11,r7,lsr#4
+#ifdef	__thumb2__
+	itt	pl
+#endif
 	andpl	r14,r12,#0xf0
 	andpl	r12,r12,#0x0f
 	eor	r7,r7,r9,lsl#16	@ ^= rem_4bit[rem]
@@ -138,7 +163,11 @@
 	strb	r10,[r0,#8+1]
 	strb	r11,[r0,#8]
 #endif
-	ldrbne	r12,[r2,#15]
+
+#ifdef __thumb2__
+	it	ne
+#endif
+	ldrneb	r12,[r2,#15]
 #if __ARM_ARCH__>=7 && defined(__ARMEL__)
 	rev	r6,r6
 	str	r6,[r0,#4]
@@ -226,7 +255,10 @@
 	eor	r5,r5,r6,lsl#28
 	ldrh	r8,[r2,r12]	@ rem_4bit[rem]
 	eor	r6,r10,r6,lsr#4
-	ldrbpl	r12,[r0,r3]
+#ifdef	__thumb2__
+	it	pl
+#endif
+	ldrplb	r12,[r0,r3]
 	eor	r6,r6,r7,lsl#28
 	eor	r7,r11,r7,lsr#4
 
@@ -243,6 +275,9 @@
 	eor	r6,r10,r6,lsr#4
 	eor	r6,r6,r7,lsl#28
 	eor	r7,r11,r7,lsr#4
+#ifdef	__thumb2__
+	itt	pl
+#endif
 	andpl	r14,r12,#0xf0
 	andpl	r12,r12,#0x0f
 	eor	r7,r7,r8,lsl#16	@ ^= rem_4bit[rem]

diff --git a/third_party/boringssl/linux-arm/crypto/fipsmodule/ghashv8-armx32.S b/third_party/boringssl/linux-arm/crypto/fipsmodule/ghashv8-armx32.S
index 0e1e631..e83a9c7 100644
--- a/third_party/boringssl/linux-arm/crypto/fipsmodule/ghashv8-armx32.S
+++ b/third_party/boringssl/linux-arm/crypto/fipsmodule/ghashv8-armx32.S

@@ -4,6 +4,7 @@
 .text
 .fpu	neon
 .code	32
+#undef	__thumb2__
 .globl	gcm_init_v8
 .hidden	gcm_init_v8
 .type	gcm_init_v8,%function

diff --git a/third_party/boringssl/linux-arm/crypto/fipsmodule/sha1-armv4-large.S b/third_party/boringssl/linux-arm/crypto/fipsmodule/sha1-armv4-large.S
index 36955fa..a5d88f7 100644
--- a/third_party/boringssl/linux-arm/crypto/fipsmodule/sha1-armv4-large.S
+++ b/third_party/boringssl/linux-arm/crypto/fipsmodule/sha1-armv4-large.S

@@ -2,7 +2,12 @@
 #include <openssl/arm_arch.h>
 
 .text
+#if defined(__thumb2__)
+.syntax	unified
+.thumb
+#else
 .code	32
+#endif
 
 .globl	sha1_block_data_order
 .hidden	sha1_block_data_order
@@ -11,7 +16,8 @@
 .align	5
 sha1_block_data_order:
 #if __ARM_MAX_ARCH__>=7
-	sub	r3,pc,#8		@ sha1_block_data_order
+.Lsha1_block:
+	adr	r3,.Lsha1_block
 	ldr	r12,.LOPENSSL_armcap
 	ldr	r12,[r3,r12]		@ OPENSSL_armcap_P
 #ifdef	__APPLE__
@@ -158,7 +164,12 @@
 	eor	r10,r10,r7,ror#2		@ F_00_19(B,C,D)
 	str	r9,[r14,#-4]!
 	add	r3,r3,r10			@ E+=F_00_19(B,C,D)
+#if defined(__thumb2__)
+	mov	r12,sp
+	teq	r14,r12
+#else
 	teq	r14,sp
+#endif
 	bne	.L_00_15		@ [((11+4)*5+2)*3]
 	sub	sp,sp,#25*4
 #if __ARM_ARCH__<7
@@ -338,7 +349,12 @@
 						@ F_xx_xx
 	add	r3,r3,r9			@ E+=X[i]
 	add	r3,r3,r10			@ E+=F_20_39(B,C,D)
+#if defined(__thumb2__)
+	mov	r12,sp
+	teq	r14,r12
+#else
 	teq	r14,sp			@ preserve carry
+#endif
 	bne	.L_20_39_or_60_79	@ [+((12+3)*5+2)*4]
 	bcs	.L_done			@ [+((12+3)*5+2)*4], spare 300 bytes
 
@@ -430,7 +446,12 @@
 	add	r3,r3,r9			@ E+=X[i]
 	add	r3,r3,r10			@ E+=F_40_59(B,C,D)
 	add	r3,r3,r11,ror#2
+#if defined(__thumb2__)
+	mov	r12,sp
+	teq	r14,r12
+#else
 	teq	r14,sp
+#endif
 	bne	.L_40_59		@ [+((12+5)*5+2)*4]
 
 	ldr	r8,.LK_60_79
@@ -466,7 +487,7 @@
 .LK_60_79:.word	0xca62c1d6
 #if __ARM_MAX_ARCH__>=7
 .LOPENSSL_armcap:
-.word	OPENSSL_armcap_P-sha1_block_data_order
+.word	OPENSSL_armcap_P-.Lsha1_block
 #endif
 .byte	83,72,65,49,32,98,108,111,99,107,32,116,114,97,110,115,102,111,114,109,32,102,111,114,32,65,82,77,118,52,47,78,69,79,78,47,65,82,77,118,56,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46,111,114,103,62,0
 .align	2
@@ -484,12 +505,12 @@
 	@ dmb				@ errata #451034 on early Cortex A8
 	@ vstmdb	sp!,{d8-d15}	@ ABI specification says so
 	mov	r14,sp
-	sub	sp,sp,#64		@ alloca
+	sub	r12,sp,#64
 	adr	r8,.LK_00_19
-	bic	sp,sp,#15		@ align for 128-bit stores
+	bic	r12,r12,#15		@ align for 128-bit stores
 
 	ldmia	r0,{r3,r4,r5,r6,r7}	@ load context
-	mov	r12,sp
+	mov	sp,r12		@ alloca
 
 	vld1.8	{q0,q1},[r1]!	@ handles unaligned
 	veor	q15,q15,q15
@@ -1182,6 +1203,7 @@
 	sub	r12,r12,#64
 	teq	r1,r2
 	sub	r8,r8,#16
+	it	eq
 	subeq	r1,r1,#64
 	vld1.8	{q0,q1},[r1]!
 	ldr	r9,[sp,#4]
@@ -1311,10 +1333,13 @@
 	add	r4,r4,r10
 	add	r5,r5,r11
 	add	r6,r6,r12
+	it	eq
 	moveq	sp,r14
 	add	r7,r7,r9
+	it	ne
 	ldrne	r9,[sp]
 	stmia	r0,{r3,r4,r5,r6,r7}
+	itt	ne
 	addne	r12,sp,#3*16
 	bne	.Loop_neon
 
@@ -1323,6 +1348,13 @@
 .size	sha1_block_data_order_neon,.-sha1_block_data_order_neon
 #endif
 #if __ARM_MAX_ARCH__>=7
+
+# if defined(__thumb2__)
+#  define INST(a,b,c,d)	.byte	c,d|0xf,a,b
+# else
+#  define INST(a,b,c,d)	.byte	a,b,c,d|0x10
+# endif
+
 .type	sha1_block_data_order_armv8,%function
 .align	5
 sha1_block_data_order_armv8:
@@ -1352,98 +1384,98 @@
 
 	vadd.i32	q13,q8,q5
 	vrev32.8	q7,q7
-.byte	0xc0,0x62,0xb9,0xf3	@ sha1h q3,q0		@ 0
-.byte	0x68,0x0c,0x02,0xf2	@ sha1c q0,q1,q12
+	INST(0xc0,0x62,0xb9,0xf3)	@ sha1h q3,q0		@ 0
+	INST(0x68,0x0c,0x02,0xe2)	@ sha1c q0,q1,q12
 	vadd.i32	q12,q8,q6
-.byte	0x4c,0x8c,0x3a,0xf2	@ sha1su0 q4,q5,q6
-.byte	0xc0,0x42,0xb9,0xf3	@ sha1h q2,q0		@ 1
-.byte	0x6a,0x0c,0x06,0xf2	@ sha1c q0,q3,q13
+	INST(0x4c,0x8c,0x3a,0xe2)	@ sha1su0 q4,q5,q6
+	INST(0xc0,0x42,0xb9,0xf3)	@ sha1h q2,q0		@ 1
+	INST(0x6a,0x0c,0x06,0xe2)	@ sha1c q0,q3,q13
 	vadd.i32	q13,q8,q7
-.byte	0x8e,0x83,0xba,0xf3	@ sha1su1 q4,q7
-.byte	0x4e,0xac,0x3c,0xf2	@ sha1su0 q5,q6,q7
-.byte	0xc0,0x62,0xb9,0xf3	@ sha1h q3,q0		@ 2
-.byte	0x68,0x0c,0x04,0xf2	@ sha1c q0,q2,q12
+	INST(0x8e,0x83,0xba,0xf3)	@ sha1su1 q4,q7
+	INST(0x4e,0xac,0x3c,0xe2)	@ sha1su0 q5,q6,q7
+	INST(0xc0,0x62,0xb9,0xf3)	@ sha1h q3,q0		@ 2
+	INST(0x68,0x0c,0x04,0xe2)	@ sha1c q0,q2,q12
 	vadd.i32	q12,q8,q4
-.byte	0x88,0xa3,0xba,0xf3	@ sha1su1 q5,q4
-.byte	0x48,0xcc,0x3e,0xf2	@ sha1su0 q6,q7,q4
-.byte	0xc0,0x42,0xb9,0xf3	@ sha1h q2,q0		@ 3
-.byte	0x6a,0x0c,0x06,0xf2	@ sha1c q0,q3,q13
+	INST(0x88,0xa3,0xba,0xf3)	@ sha1su1 q5,q4
+	INST(0x48,0xcc,0x3e,0xe2)	@ sha1su0 q6,q7,q4
+	INST(0xc0,0x42,0xb9,0xf3)	@ sha1h q2,q0		@ 3
+	INST(0x6a,0x0c,0x06,0xe2)	@ sha1c q0,q3,q13
 	vadd.i32	q13,q9,q5
-.byte	0x8a,0xc3,0xba,0xf3	@ sha1su1 q6,q5
-.byte	0x4a,0xec,0x38,0xf2	@ sha1su0 q7,q4,q5
-.byte	0xc0,0x62,0xb9,0xf3	@ sha1h q3,q0		@ 4
-.byte	0x68,0x0c,0x04,0xf2	@ sha1c q0,q2,q12
+	INST(0x8a,0xc3,0xba,0xf3)	@ sha1su1 q6,q5
+	INST(0x4a,0xec,0x38,0xe2)	@ sha1su0 q7,q4,q5
+	INST(0xc0,0x62,0xb9,0xf3)	@ sha1h q3,q0		@ 4
+	INST(0x68,0x0c,0x04,0xe2)	@ sha1c q0,q2,q12
 	vadd.i32	q12,q9,q6
-.byte	0x8c,0xe3,0xba,0xf3	@ sha1su1 q7,q6
-.byte	0x4c,0x8c,0x3a,0xf2	@ sha1su0 q4,q5,q6
-.byte	0xc0,0x42,0xb9,0xf3	@ sha1h q2,q0		@ 5
-.byte	0x6a,0x0c,0x16,0xf2	@ sha1p q0,q3,q13
+	INST(0x8c,0xe3,0xba,0xf3)	@ sha1su1 q7,q6
+	INST(0x4c,0x8c,0x3a,0xe2)	@ sha1su0 q4,q5,q6
+	INST(0xc0,0x42,0xb9,0xf3)	@ sha1h q2,q0		@ 5
+	INST(0x6a,0x0c,0x16,0xe2)	@ sha1p q0,q3,q13
 	vadd.i32	q13,q9,q7
-.byte	0x8e,0x83,0xba,0xf3	@ sha1su1 q4,q7
-.byte	0x4e,0xac,0x3c,0xf2	@ sha1su0 q5,q6,q7
-.byte	0xc0,0x62,0xb9,0xf3	@ sha1h q3,q0		@ 6
-.byte	0x68,0x0c,0x14,0xf2	@ sha1p q0,q2,q12
+	INST(0x8e,0x83,0xba,0xf3)	@ sha1su1 q4,q7
+	INST(0x4e,0xac,0x3c,0xe2)	@ sha1su0 q5,q6,q7
+	INST(0xc0,0x62,0xb9,0xf3)	@ sha1h q3,q0		@ 6
+	INST(0x68,0x0c,0x14,0xe2)	@ sha1p q0,q2,q12
 	vadd.i32	q12,q9,q4
-.byte	0x88,0xa3,0xba,0xf3	@ sha1su1 q5,q4
-.byte	0x48,0xcc,0x3e,0xf2	@ sha1su0 q6,q7,q4
-.byte	0xc0,0x42,0xb9,0xf3	@ sha1h q2,q0		@ 7
-.byte	0x6a,0x0c,0x16,0xf2	@ sha1p q0,q3,q13
+	INST(0x88,0xa3,0xba,0xf3)	@ sha1su1 q5,q4
+	INST(0x48,0xcc,0x3e,0xe2)	@ sha1su0 q6,q7,q4
+	INST(0xc0,0x42,0xb9,0xf3)	@ sha1h q2,q0		@ 7
+	INST(0x6a,0x0c,0x16,0xe2)	@ sha1p q0,q3,q13
 	vadd.i32	q13,q9,q5
-.byte	0x8a,0xc3,0xba,0xf3	@ sha1su1 q6,q5
-.byte	0x4a,0xec,0x38,0xf2	@ sha1su0 q7,q4,q5
-.byte	0xc0,0x62,0xb9,0xf3	@ sha1h q3,q0		@ 8
-.byte	0x68,0x0c,0x14,0xf2	@ sha1p q0,q2,q12
+	INST(0x8a,0xc3,0xba,0xf3)	@ sha1su1 q6,q5
+	INST(0x4a,0xec,0x38,0xe2)	@ sha1su0 q7,q4,q5
+	INST(0xc0,0x62,0xb9,0xf3)	@ sha1h q3,q0		@ 8
+	INST(0x68,0x0c,0x14,0xe2)	@ sha1p q0,q2,q12
 	vadd.i32	q12,q10,q6
-.byte	0x8c,0xe3,0xba,0xf3	@ sha1su1 q7,q6
-.byte	0x4c,0x8c,0x3a,0xf2	@ sha1su0 q4,q5,q6
-.byte	0xc0,0x42,0xb9,0xf3	@ sha1h q2,q0		@ 9
-.byte	0x6a,0x0c,0x16,0xf2	@ sha1p q0,q3,q13
+	INST(0x8c,0xe3,0xba,0xf3)	@ sha1su1 q7,q6
+	INST(0x4c,0x8c,0x3a,0xe2)	@ sha1su0 q4,q5,q6
+	INST(0xc0,0x42,0xb9,0xf3)	@ sha1h q2,q0		@ 9
+	INST(0x6a,0x0c,0x16,0xe2)	@ sha1p q0,q3,q13
 	vadd.i32	q13,q10,q7
-.byte	0x8e,0x83,0xba,0xf3	@ sha1su1 q4,q7
-.byte	0x4e,0xac,0x3c,0xf2	@ sha1su0 q5,q6,q7
-.byte	0xc0,0x62,0xb9,0xf3	@ sha1h q3,q0		@ 10
-.byte	0x68,0x0c,0x24,0xf2	@ sha1m q0,q2,q12
+	INST(0x8e,0x83,0xba,0xf3)	@ sha1su1 q4,q7
+	INST(0x4e,0xac,0x3c,0xe2)	@ sha1su0 q5,q6,q7
+	INST(0xc0,0x62,0xb9,0xf3)	@ sha1h q3,q0		@ 10
+	INST(0x68,0x0c,0x24,0xe2)	@ sha1m q0,q2,q12
 	vadd.i32	q12,q10,q4
-.byte	0x88,0xa3,0xba,0xf3	@ sha1su1 q5,q4
-.byte	0x48,0xcc,0x3e,0xf2	@ sha1su0 q6,q7,q4
-.byte	0xc0,0x42,0xb9,0xf3	@ sha1h q2,q0		@ 11
-.byte	0x6a,0x0c,0x26,0xf2	@ sha1m q0,q3,q13
+	INST(0x88,0xa3,0xba,0xf3)	@ sha1su1 q5,q4
+	INST(0x48,0xcc,0x3e,0xe2)	@ sha1su0 q6,q7,q4
+	INST(0xc0,0x42,0xb9,0xf3)	@ sha1h q2,q0		@ 11
+	INST(0x6a,0x0c,0x26,0xe2)	@ sha1m q0,q3,q13
 	vadd.i32	q13,q10,q5
-.byte	0x8a,0xc3,0xba,0xf3	@ sha1su1 q6,q5
-.byte	0x4a,0xec,0x38,0xf2	@ sha1su0 q7,q4,q5
-.byte	0xc0,0x62,0xb9,0xf3	@ sha1h q3,q0		@ 12
-.byte	0x68,0x0c,0x24,0xf2	@ sha1m q0,q2,q12
+	INST(0x8a,0xc3,0xba,0xf3)	@ sha1su1 q6,q5
+	INST(0x4a,0xec,0x38,0xe2)	@ sha1su0 q7,q4,q5
+	INST(0xc0,0x62,0xb9,0xf3)	@ sha1h q3,q0		@ 12
+	INST(0x68,0x0c,0x24,0xe2)	@ sha1m q0,q2,q12
 	vadd.i32	q12,q10,q6
-.byte	0x8c,0xe3,0xba,0xf3	@ sha1su1 q7,q6
-.byte	0x4c,0x8c,0x3a,0xf2	@ sha1su0 q4,q5,q6
-.byte	0xc0,0x42,0xb9,0xf3	@ sha1h q2,q0		@ 13
-.byte	0x6a,0x0c,0x26,0xf2	@ sha1m q0,q3,q13
+	INST(0x8c,0xe3,0xba,0xf3)	@ sha1su1 q7,q6
+	INST(0x4c,0x8c,0x3a,0xe2)	@ sha1su0 q4,q5,q6
+	INST(0xc0,0x42,0xb9,0xf3)	@ sha1h q2,q0		@ 13
+	INST(0x6a,0x0c,0x26,0xe2)	@ sha1m q0,q3,q13
 	vadd.i32	q13,q11,q7
-.byte	0x8e,0x83,0xba,0xf3	@ sha1su1 q4,q7
-.byte	0x4e,0xac,0x3c,0xf2	@ sha1su0 q5,q6,q7
-.byte	0xc0,0x62,0xb9,0xf3	@ sha1h q3,q0		@ 14
-.byte	0x68,0x0c,0x24,0xf2	@ sha1m q0,q2,q12
+	INST(0x8e,0x83,0xba,0xf3)	@ sha1su1 q4,q7
+	INST(0x4e,0xac,0x3c,0xe2)	@ sha1su0 q5,q6,q7
+	INST(0xc0,0x62,0xb9,0xf3)	@ sha1h q3,q0		@ 14
+	INST(0x68,0x0c,0x24,0xe2)	@ sha1m q0,q2,q12
 	vadd.i32	q12,q11,q4
-.byte	0x88,0xa3,0xba,0xf3	@ sha1su1 q5,q4
-.byte	0x48,0xcc,0x3e,0xf2	@ sha1su0 q6,q7,q4
-.byte	0xc0,0x42,0xb9,0xf3	@ sha1h q2,q0		@ 15
-.byte	0x6a,0x0c,0x16,0xf2	@ sha1p q0,q3,q13
+	INST(0x88,0xa3,0xba,0xf3)	@ sha1su1 q5,q4
+	INST(0x48,0xcc,0x3e,0xe2)	@ sha1su0 q6,q7,q4
+	INST(0xc0,0x42,0xb9,0xf3)	@ sha1h q2,q0		@ 15
+	INST(0x6a,0x0c,0x16,0xe2)	@ sha1p q0,q3,q13
 	vadd.i32	q13,q11,q5
-.byte	0x8a,0xc3,0xba,0xf3	@ sha1su1 q6,q5
-.byte	0x4a,0xec,0x38,0xf2	@ sha1su0 q7,q4,q5
-.byte	0xc0,0x62,0xb9,0xf3	@ sha1h q3,q0		@ 16
-.byte	0x68,0x0c,0x14,0xf2	@ sha1p q0,q2,q12
+	INST(0x8a,0xc3,0xba,0xf3)	@ sha1su1 q6,q5
+	INST(0x4a,0xec,0x38,0xe2)	@ sha1su0 q7,q4,q5
+	INST(0xc0,0x62,0xb9,0xf3)	@ sha1h q3,q0		@ 16
+	INST(0x68,0x0c,0x14,0xe2)	@ sha1p q0,q2,q12
 	vadd.i32	q12,q11,q6
-.byte	0x8c,0xe3,0xba,0xf3	@ sha1su1 q7,q6
-.byte	0xc0,0x42,0xb9,0xf3	@ sha1h q2,q0		@ 17
-.byte	0x6a,0x0c,0x16,0xf2	@ sha1p q0,q3,q13
+	INST(0x8c,0xe3,0xba,0xf3)	@ sha1su1 q7,q6
+	INST(0xc0,0x42,0xb9,0xf3)	@ sha1h q2,q0		@ 17
+	INST(0x6a,0x0c,0x16,0xe2)	@ sha1p q0,q3,q13
 	vadd.i32	q13,q11,q7
 
-.byte	0xc0,0x62,0xb9,0xf3	@ sha1h q3,q0		@ 18
-.byte	0x68,0x0c,0x14,0xf2	@ sha1p q0,q2,q12
+	INST(0xc0,0x62,0xb9,0xf3)	@ sha1h q3,q0		@ 18
+	INST(0x68,0x0c,0x14,0xe2)	@ sha1p q0,q2,q12
 
-.byte	0xc0,0x42,0xb9,0xf3	@ sha1h q2,q0		@ 19
-.byte	0x6a,0x0c,0x16,0xf2	@ sha1p q0,q3,q13
+	INST(0xc0,0x42,0xb9,0xf3)	@ sha1h q2,q0		@ 19
+	INST(0x6a,0x0c,0x16,0xe2)	@ sha1p q0,q3,q13
 
 	vadd.i32	q1,q1,q2
 	vadd.i32	q0,q0,q14

diff --git a/third_party/boringssl/linux-arm/crypto/fipsmodule/sha512-armv4.S b/third_party/boringssl/linux-arm/crypto/fipsmodule/sha512-armv4.S
index 93a7bf85..bbeddf9 100644
--- a/third_party/boringssl/linux-arm/crypto/fipsmodule/sha512-armv4.S
+++ b/third_party/boringssl/linux-arm/crypto/fipsmodule/sha512-armv4.S

@@ -1,4 +1,11 @@
 #if defined(__arm__)
+@ Copyright 2007-2016 The OpenSSL Project Authors. All Rights Reserved.
+@
+@ Licensed under the OpenSSL license (the "License").  You may not use
+@ this file except in compliance with the License.  You can obtain a copy
+@ in the file LICENSE in the source distribution or at
+@ https://www.openssl.org/source/license.html
+
 
 @ ====================================================================
 @ Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
@@ -68,16 +75,12 @@
 #endif
 
 .text
-#if __ARM_ARCH__<7 || defined(__APPLE__)
-.code	32
-#else
+#if defined(__thumb2__)
 .syntax	unified
-# ifdef __thumb2__
-#  define adrl adr
 .thumb
-# else
+# define adrl adr
+#else
 .code	32
-# endif
 #endif
 
 .type	K512,%object
@@ -137,10 +140,10 @@
 .type	sha512_block_data_order,%function
 sha512_block_data_order:
 .Lsha512_block_data_order:
-#if __ARM_ARCH__<7
+#if __ARM_ARCH__<7 && !defined(__thumb2__)
 	sub	r3,pc,#8		@ sha512_block_data_order
 #else
-	adr	r3,sha512_block_data_order
+	adr	r3,.Lsha512_block_data_order
 #endif
 #if __ARM_MAX_ARCH__>=7 && !defined(__KERNEL__)
 	ldr	r12,.LOPENSSL_armcap

diff --git a/third_party/leveldatabase/env_chromium.cc b/third_party/leveldatabase/env_chromium.cc
index f4c2a291..1246892 100644
--- a/third_party/leveldatabase/env_chromium.cc
+++ b/third_party/leveldatabase/env_chromium.cc

@@ -294,11 +294,13 @@
   FilePath path = FilePath::FromUTF8Unsafe(parent_dir_);
   base::File f(path, base::File::FLAG_OPEN | base::File::FLAG_READ);
   if (!f.IsValid()) {
+    uma_logger_->RecordOSError(kSyncParent, f.error_details());
     return MakeIOError(parent_dir_, "Unable to open directory", kSyncParent,
                        f.error_details());
   }
   if (!f.Flush()) {
     base::File::Error error = LastFileError();
+    uma_logger_->RecordOSError(kSyncParent, error);
     return MakeIOError(parent_dir_, base::File::ErrorToString(error),
                        kSyncParent, error);
   }

diff --git a/third_party/libpng/README.chromium b/third_party/libpng/README.chromium
index 1dcede0..2a38134 100644
--- a/third_party/libpng/README.chromium
+++ b/third_party/libpng/README.chromium

@@ -27,3 +27,5 @@
   https://github.com/glennrp/libpng/commit/f7d5419816d85d0b996c403e788bb707b552524f
 - Avoid leaking params on bad pCAL chunk from upstream (crbug.com/636214):
   https://github.com/glennrp/libpng/commit/7dc03292502cf91a116766d2ab2c4f8fc23e4ab4
+- Fix for large allocation for invalid ICC (crbug.com/729673)
+  https://github.com/glennrp/libpng/commit/92a7c79db2c962d04006b35e2603ba9d5ce75541

diff --git a/third_party/libpng/png.c b/third_party/libpng/png.c
index 65299a0..6e4cbed 100644
--- a/third_party/libpng/png.c
+++ b/third_party/libpng/png.c

@@ -1931,8 +1931,8 @@
 static const png_byte D50_nCIEXYZ[12] =
    { 0x00, 0x00, 0xf6, 0xd6, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0xd3, 0x2d };
 
-int /* PRIVATE */
-png_icc_check_length(png_const_structrp png_ptr, png_colorspacerp colorspace,
+static int /* bool */
+icc_check_length(png_const_structrp png_ptr, png_colorspacerp colorspace,
    png_const_charp name, png_uint_32 profile_length)
 {
    if (profile_length < 132)
@@ -1942,6 +1942,40 @@
    return 1;
 }
 
+#ifdef PNG_READ_iCCP_SUPPORTED
+int /* PRIVATE */
+png_icc_check_length(png_const_structrp png_ptr, png_colorspacerp colorspace,
+    png_const_charp name, png_uint_32 profile_length)
+{
+   if (!icc_check_length(png_ptr, colorspace, name, profile_length))
+      return 0;
+
+   /* This needs to be here because the 'normal' check is in
+    * png_decompress_chunk, yet this happens after the attempt to
+    * png_malloc_base the required data.  We only need this on read; on write
+    * the caller supplies the profile buffer so libpng doesn't allocate it.  See
+    * the call to icc_check_length below (the write case).
+    */
+#  ifdef PNG_SET_USER_LIMITS_SUPPORTED
+      else if (png_ptr->user_chunk_malloc_max > 0 &&
+               png_ptr->user_chunk_malloc_max < profile_length)
+         return png_icc_profile_error(png_ptr, colorspace, name, profile_length,
+             "exceeds application limits");
+#  elif PNG_USER_CHUNK_MALLOC_MAX > 0
+      else if (PNG_USER_CHUNK_MALLOC_MAX < profile_length)
+         return png_icc_profile_error(png_ptr, colorspace, name, profile_length,
+             "exceeds libpng limits");
+#  else /* !SET_USER_LIMITS */
+      /* This will get compiled out on all 32-bit and better systems. */
+      else if (PNG_SIZE_MAX < profile_length)
+         return png_icc_profile_error(png_ptr, colorspace, name, profile_length,
+             "exceeds system limits");
+#  endif /* !SET_USER_LIMITS */
+
+   return 1;
+}
+#endif /* READ_iCCP */
+
 int /* PRIVATE */
 png_icc_check_header(png_const_structrp png_ptr, png_colorspacerp colorspace,
    png_const_charp name, png_uint_32 profile_length,
@@ -2379,7 +2413,7 @@
    if ((colorspace->flags & PNG_COLORSPACE_INVALID) != 0)
       return 0;
 
-   if (png_icc_check_length(png_ptr, colorspace, name, profile_length) != 0 &&
+   if (icc_check_length(png_ptr, colorspace, name, profile_length) != 0 &&
        png_icc_check_header(png_ptr, colorspace, name, profile_length, profile,
           color_type) != 0 &&
        png_icc_check_tag_table(png_ptr, colorspace, name, profile_length,

diff --git a/third_party/libpng/pngpriv.h b/third_party/libpng/pngpriv.h
index 9ea023f..63367135 100644
--- a/third_party/libpng/pngpriv.h
+++ b/third_party/libpng/pngpriv.h

@@ -1541,9 +1541,11 @@
    /* The 'name' is used for information only */
 
 /* Routines for checking parts of an ICC profile. */
+#ifdef PNG_READ_iCCP_SUPPORTED
 PNG_INTERNAL_FUNCTION(int,png_icc_check_length,(png_const_structrp png_ptr,
    png_colorspacerp colorspace, png_const_charp name,
    png_uint_32 profile_length), PNG_EMPTY);
+#endif /* READ_iCCP */
 PNG_INTERNAL_FUNCTION(int,png_icc_check_header,(png_const_structrp png_ptr,
    png_colorspacerp colorspace, png_const_charp name,
    png_uint_32 profile_length,

diff --git a/third_party/libpng/pngtest.c b/third_party/libpng/pngtest.c
index eb431f9..3515265 100644
--- a/third_party/libpng/pngtest.c
+++ b/third_party/libpng/pngtest.c

@@ -514,10 +514,10 @@
 typedef memory_information *memory_infop;
 
 static memory_infop pinformation = NULL;
-static int current_allocation = 0;
-static int maximum_allocation = 0;
-static int total_allocation = 0;
-static int num_allocations = 0;
+static png_alloc_size_t current_allocation = 0;
+static png_alloc_size_t maximum_allocation = 0;
+static png_alloc_size_t total_allocation = 0;
+static png_alloc_size_t num_allocations = 0;
 
 png_voidp PNGCBAPI png_debug_malloc PNGARG((png_structp png_ptr,
     png_alloc_size_t size));
@@ -604,9 +604,10 @@
          if (pinfo->pointer == ptr)
          {
             *ppinfo = pinfo->next;
-            current_allocation -= pinfo->size;
-            if (current_allocation < 0)
+            if (current_allocation < pinfo->size)
                fprintf(STDERR, "Duplicate free of memory\n");
+            else
+               current_allocation -= pinfo->size;
             /* We must free the list element too, but first kill
                the memory that is to be freed. */
             memset(ptr, 0x55, pinfo->size);
@@ -938,6 +939,12 @@
      read_user_chunk_callback);
 #endif
 
+#ifdef PNG_SET_USER_LIMITS_SUPPORTED
+#  ifdef CHUNK_LIMIT /* from the build, for testing */
+      png_set_chunk_malloc_max(read_ptr, CHUNK_LIMIT);
+#  endif /* CHUNK_LIMIT */
+#endif
+
 #ifdef PNG_SETJMP_SUPPORTED
    pngtest_debug("Setting jmpbuf for read struct");
    if (setjmp(png_jmpbuf(read_ptr)))
@@ -1874,7 +1881,7 @@
    {
       int i;
 #if defined(PNG_USER_MEM_SUPPORTED) && PNG_DEBUG
-      int allocation_now = current_allocation;
+      png_alloc_size_t allocation_now = current_allocation;
 #endif
       for (i=2; i<argc; ++i)
       {
@@ -1907,15 +1914,15 @@
          }
 #if defined(PNG_USER_MEM_SUPPORTED) && PNG_DEBUG
          if (allocation_now != current_allocation)
-            fprintf(STDERR, "MEMORY ERROR: %d bytes lost\n",
-               current_allocation - allocation_now);
+            fprintf(STDERR, "MEMORY ERROR: %lu bytes lost\n",
+               (unsigned long)(current_allocation - allocation_now));
 
          if (current_allocation != 0)
          {
             memory_infop pinfo = pinformation;
 
-            fprintf(STDERR, "MEMORY ERROR: %d bytes still allocated\n",
-               current_allocation);
+            fprintf(STDERR, "MEMORY ERROR: %lu bytes still allocated\n",
+               (unsigned long)current_allocation);
 
             while (pinfo != NULL)
             {
@@ -1928,14 +1935,14 @@
 #endif
       }
 #if defined(PNG_USER_MEM_SUPPORTED) && PNG_DEBUG
-         fprintf(STDERR, " Current memory allocation: %10d bytes\n",
-            current_allocation);
-         fprintf(STDERR, " Maximum memory allocation: %10d bytes\n",
-            maximum_allocation);
-         fprintf(STDERR, " Total   memory allocation: %10d bytes\n",
-            total_allocation);
-         fprintf(STDERR, "     Number of allocations: %10d\n",
-            num_allocations);
+         fprintf(STDERR, " Current memory allocation: %20lu bytes\n",
+            (unsigned long)current_allocation);
+         fprintf(STDERR, " Maximum memory allocation: %20lu bytes\n",
+            (unsigned long) maximum_allocation);
+         fprintf(STDERR, " Total   memory allocation: %20lu bytes\n",
+            (unsigned long)total_allocation);
+         fprintf(STDERR, "     Number of allocations: %20lu\n",
+            (unsigned long)num_allocations);
 #endif
    }
 
@@ -1946,7 +1953,7 @@
       {
          int kerror;
 #if defined(PNG_USER_MEM_SUPPORTED) && PNG_DEBUG
-         int allocation_now = current_allocation;
+         png_alloc_size_t allocation_now = current_allocation;
 #endif
          if (i == 1)
             status_dots_requested = 1;
@@ -1996,15 +2003,15 @@
          }
 #if defined(PNG_USER_MEM_SUPPORTED) && PNG_DEBUG
          if (allocation_now != current_allocation)
-             fprintf(STDERR, "MEMORY ERROR: %d bytes lost\n",
-               current_allocation - allocation_now);
+             fprintf(STDERR, "MEMORY ERROR: %lu bytes lost\n",
+               (unsigned long)(current_allocation - allocation_now));
 
          if (current_allocation != 0)
          {
              memory_infop pinfo = pinformation;
 
-             fprintf(STDERR, "MEMORY ERROR: %d bytes still allocated\n",
-                current_allocation);
+             fprintf(STDERR, "MEMORY ERROR: %lu bytes still allocated\n",
+                (unsigned long)current_allocation);
 
              while (pinfo != NULL)
              {
@@ -2016,14 +2023,14 @@
 #endif
        }
 #if defined(PNG_USER_MEM_SUPPORTED) && PNG_DEBUG
-       fprintf(STDERR, " Current memory allocation: %10d bytes\n",
-          current_allocation);
-       fprintf(STDERR, " Maximum memory allocation: %10d bytes\n",
-          maximum_allocation);
-       fprintf(STDERR, " Total   memory allocation: %10d bytes\n",
-          total_allocation);
-       fprintf(STDERR, "     Number of allocations: %10d\n",
-            num_allocations);
+       fprintf(STDERR, " Current memory allocation: %20lu bytes\n",
+          (unsigned long)current_allocation);
+       fprintf(STDERR, " Maximum memory allocation: %20lu bytes\n",
+          (unsigned long)maximum_allocation);
+       fprintf(STDERR, " Total   memory allocation: %20lu bytes\n",
+          (unsigned long)total_allocation);
+       fprintf(STDERR, "     Number of allocations: %20lu\n",
+            (unsigned long)num_allocations);
 #endif
    }
 

diff --git a/third_party/libvpx/README.chromium b/third_party/libvpx/README.chromium
index 0bdb085..6a4d656 100644
--- a/third_party/libvpx/README.chromium
+++ b/third_party/libvpx/README.chromium

@@ -5,9 +5,9 @@
 License File: source/libvpx/LICENSE
 Security Critical: yes
 
-Date: Monday June 12 2017
+Date: Thursday June 15 2017
 Branch: master
-Commit: 4f9d852759ceca15c16f9ffed96c08d4b427f40b
+Commit: 8d391a111a4830f946f6fe8b0cf51be8661224d9
 
 Description:
 Contains the sources used to compile libvpx binaries used by Google Chrome and

diff --git a/third_party/libvpx/source/config/vpx_version.h b/third_party/libvpx/source/config/vpx_version.h
index dfc229b2..d8bb3a1 100644
--- a/third_party/libvpx/source/config/vpx_version.h
+++ b/third_party/libvpx/source/config/vpx_version.h

@@ -1,7 +1,7 @@
 #define VERSION_MAJOR  1
 #define VERSION_MINOR  6
 #define VERSION_PATCH  1
-#define VERSION_EXTRA  "743-g4f9d85275"
+#define VERSION_EXTRA  "750-g8d391a111"
 #define VERSION_PACKED ((VERSION_MAJOR<<16)|(VERSION_MINOR<<8)|(VERSION_PATCH))
-#define VERSION_STRING_NOSP "v1.6.1-743-g4f9d85275"
-#define VERSION_STRING      " v1.6.1-743-g4f9d85275"
+#define VERSION_STRING_NOSP "v1.6.1-750-g8d391a111"
+#define VERSION_STRING      " v1.6.1-750-g8d391a111"

diff --git a/tools/grit/grit/format/data_pack.py b/tools/grit/grit/format/data_pack.py
index 9f92b7c..f9bfc84 100755
--- a/tools/grit/grit/format/data_pack.py
+++ b/tools/grit/grit/format/data_pack.py

@@ -199,20 +199,12 @@
 
 
 def main():
-  if len(sys.argv) > 1:
-    # When an argument is given, read and explode the file to text
-    # format, for easier diffing.
-    data = ReadDataPack(sys.argv[1])
-    print data.encoding
-    for (resource_id, text) in data.resources.iteritems():
-      print '%s: %s' % (resource_id, text)
-  else:
-    # Just write a simple file.
-    data = {1: '', 4: 'this is id 4', 6: 'this is id 6', 10: ''}
-    WriteDataPack(data, 'datapack1.pak', UTF8)
-    data2 = {1000: 'test', 5: 'five'}
-    WriteDataPack(data2, 'datapack2.pak', UTF8)
-    print 'wrote datapack1 and datapack2 to current directory.'
+  # Write a simple file.
+  data = {1: '', 4: 'this is id 4', 6: 'this is id 6', 10: ''}
+  WriteDataPack(data, 'datapack1.pak', UTF8)
+  data2 = {1000: 'test', 5: 'five'}
+  WriteDataPack(data2, 'datapack2.pak', UTF8)
+  print 'wrote datapack1 and datapack2 to current directory.'
 
 
 if __name__ == '__main__':

diff --git a/tools/grit/grit/format/repack.py b/tools/grit/grit/format/repack.py
deleted file mode 100755
index fa0088c..0000000
--- a/tools/grit/grit/format/repack.py
+++ /dev/null

@@ -1,42 +0,0 @@
-#!/usr/bin/env python
-# Copyright (c) 2012 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-"""
-A simple utility function to merge data pack files into a single data pack. See
-http://dev.chromium.org/developers/design-documents/linuxresourcesandlocalizedstrings
-for details about the file format.
-"""
-
-import optparse
-import os
-import sys
-
-if __name__ == '__main__':
-  # Prepend the grit module from the source tree so it takes precedence over
-  # other grit versions that might present in the search path.
-  sys.path.insert(1, os.path.join(os.path.dirname(__file__), '../..'))
-
-import grit.format.data_pack
-
-
-def main(argv):
-  parser = optparse.OptionParser('usage: %prog [options] <output_filename>'
-                                 '<input_file1> [input_file2] ...')
-  parser.add_option('--whitelist', action='store', dest='whitelist',
-                    default=None, help='Full path to the whitelist used to'
-                    'filter output pak file resource IDs')
-  parser.add_option('--suppress-removed-key-output', action='store_true')
-  options, file_paths = parser.parse_args(argv)
-
-  if len(file_paths) < 2:
-    parser.error('Please specify output and at least one input filenames')
-
-  grit.format.data_pack.RePack(
-      file_paths[0], file_paths[1:],
-      whitelist_file=options.whitelist,
-      suppress_removed_key_output=options.suppress_removed_key_output)
-
-if '__main__' == __name__:
-  main(sys.argv[1:])

diff --git a/tools/grit/pak_util.py b/tools/grit/pak_util.py
new file mode 100755
index 0000000..ec43f33
--- /dev/null
+++ b/tools/grit/pak_util.py

@@ -0,0 +1,104 @@
+#!/usr/bin/env python
+# Copyright 2017 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+"""A tool for interacting with .pak files.
+
+For details on the pak file format, see:
+https://dev.chromium.org/developers/design-documents/linuxresourcesandlocalizedstrings
+"""
+
+import argparse
+import hashlib
+import os
+import sys
+
+from grit.format import data_pack
+
+
+def _RepackMain(args):
+  data_pack.RePack(args.output_pak_file, args.input_pak_files, args.whitelist,
+                   args.suppress_removed_key_output)
+
+
+def _ExtractMain(args):
+  pak = data_pack.ReadDataPack(args.pak_file)
+
+  for resource_id, payload in pak.resources.iteritems():
+    path = os.path.join(args.output_dir, str(resource_id))
+    with open(path, 'w') as f:
+      f.write(payload)
+
+
+def _PrintMain(args):
+  pak = data_pack.ReadDataPack(args.pak_file)
+  encoding = 'binary'
+  if pak.encoding == 1:
+    encoding = 'utf-8'
+  elif pak.encoding == 2:
+    encoding = 'utf-16'
+  else:
+    encoding = '?' + str(pak.encoding)
+  print 'Encoding:', encoding
+
+  try_decode = encoding.startswith('utf')
+  # Print IDs in ascending order, since that's the order in which they appear in
+  # the file (order is lost by Python dict).
+  for resource_id in sorted(pak.resources):
+    data = pak.resources[resource_id]
+    desc = '<binary>'
+    if try_decode:
+      try:
+        desc = unicode(data, encoding)
+        if len(desc) > 60:
+          desc = desc[:60] + u'...'
+        desc = desc.replace('\n', '\\n')
+      except UnicodeDecodeError:
+        pass
+    sha1 = hashlib.sha1(data).hexdigest()[:10]
+    line = u'Entry(id={}, len={}, sha1={}): {}'.format(
+        resource_id, len(data), sha1, desc)
+    print line.encode('utf-8')
+
+
+def main():
+  parser = argparse.ArgumentParser(
+      description=__doc__, formatter_class=argparse.RawTextHelpFormatter)
+  sub_parsers = parser.add_subparsers()
+
+  sub_parser = sub_parsers.add_parser('repack',
+      help='Combines several .pak files into one.')
+  sub_parser.add_argument('output_pak_file', help='File to create.')
+  sub_parser.add_argument('input_pak_files', nargs='+',
+      help='Input .pak files.')
+  sub_parser.add_argument('--whitelist',
+      help='Path to a whitelist used to filter output pak file resource IDs.')
+  sub_parser.add_argument('--suppress-removed-key-output', action='store_true',
+      help='Do not log which keys were removed by the whitelist.')
+  sub_parser.set_defaults(func=_RepackMain)
+
+  sub_parser = sub_parsers.add_parser('extract', help='Extracts pak file')
+  sub_parser.add_argument('pak_file')
+  sub_parser.add_argument('-o', '--output-dir', default='.',
+                          help='Directory to extract to.')
+  sub_parser.set_defaults(func=_ExtractMain)
+
+  sub_parser = sub_parsers.add_parser('print',
+      help='Prints all pak IDs and contents. Useful for diffing.')
+  sub_parser.add_argument('pak_file')
+  sub_parser.set_defaults(func=_PrintMain)
+
+  if len(sys.argv) == 1:
+    parser.print_help()
+    sys.exit(1)
+  elif len(sys.argv) == 2 and sys.argv[1] in actions:
+    parser.parse_args(sys.argv[1:] + ['-h'])
+    sys.exit(1)
+
+  args = parser.parse_args()
+  args.func(args)
+
+
+if __name__ == '__main__':
+  main()

diff --git a/tools/grit/repack.gni b/tools/grit/repack.gni
index 8abc397..b489c774 100644
--- a/tools/grit/repack.gni
+++ b/tools/grit/repack.gni

@@ -46,14 +46,14 @@
     assert(defined(invoker.sources), "Need sources for $target_name")
     assert(defined(invoker.output), "Need output for $target_name")
 
-    script = "//tools/grit/grit/format/repack.py"
+    script = "//tools/grit/pak_util.py"
 
     inputs = invoker.sources
     outputs = [
       invoker.output,
     ]
 
-    args = []
+    args = [ "repack" ]
     if (defined(invoker.repack_whitelist)) {
       inputs += [ invoker.repack_whitelist ]
       _rebased_whitelist = rebase_path(invoker.repack_whitelist)

diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
index a602462..00b77cd 100644
--- a/tools/metrics/histograms/enums.xml
+++ b/tools/metrics/histograms/enums.xml

@@ -22163,6 +22163,7 @@
   <int value="-1460462432" label="disable-media-source"/>
   <int value="-1456004000" label="VrShell:disabled"/>
   <int value="-1450576851" label="OmniboxUIExperimentVerticalLayout:enabled"/>
+  <int value="-1444051091" label="ash-disable-night-light"/>
   <int value="-1443796945" label="OfflinePagesSharing:disabled"/>
   <int value="-1440440375" label="WebVrAutopresent:enabled"/>
   <int value="-1440152291" label="disable-gesture-typing"/>

diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index 74d804ad..c053a7a 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml

@@ -89679,8 +89679,7 @@
   <suffix name="WritableFileClose" label="ChromiumWritableFile::Close"/>
   <suffix name="WritableFileFlush" label="ChromiumWritableFile::Flush"/>
   <suffix name="WritableFileSync" label="ChromiumWritableFile::Sync"/>
-  <suffix name="WritableFileSyncParent"
-      label="ChromiumWritableFile::SyncParent"/>
+  <suffix name="SyncParent" label="ChromiumWritableFile::SyncParent"/>
   <affected-histogram name="LevelDBEnv.IDB.IOError.BFE"/>
   <affected-histogram name="LevelDBEnv.IOError.BFE"/>
   <affected-histogram name="LevelDBEnv.ServiceWorker.IOError.BFE"/>

diff --git a/tools/perf/benchmarks/media.py b/tools/perf/benchmarks/media.py
index f2d02c4..4200606 100644
--- a/tools/perf/benchmarks/media.py
+++ b/tools/perf/benchmarks/media.py

@@ -61,6 +61,9 @@
   def Name(cls):
     return 'media.tough_video_cases'
 
+  def GetExpectations(self):
+    return page_sets.ToughVideoCasesDesktopStoryExpectations()
+
 
 @benchmark.Enabled('android')
 @benchmark.Disabled('l', 'android-webview')  # WebView: crbug.com/419689.
@@ -81,6 +84,9 @@
   def Name(cls):
     return 'media.android.tough_video_cases'
 
+  def GetExpectations(self):
+    return page_sets.ToughVideoCasesAndroidStoryExpectations()
+
 
 class _MediaTBMv2Benchmark(perf_benchmark.PerfBenchmark):
   def CreateStorySet(self, options):
@@ -130,6 +136,10 @@
     # is able to cope with the data load generated by TBMv2 metrics.
     return not _IGNORED_STATS_RE.search(value.name)
 
+  def GetExpectations(self):
+    return page_sets.ToughVideoCasesDesktopStoryExpectations()
+
+
 
 @benchmark.Owner(emails=['johnchen@chromium.org', 'crouleau@chromium.org'],
                  component='Internals>Media')
@@ -150,6 +160,9 @@
   def Name(cls):
     return 'media.android.tough_video_cases_tbmv2'
 
+  def GetExpectations(self):
+    return page_sets.ToughVideoCasesAndroidStoryExpectations()
+
   def SetExtraBrowserOptions(self, options):
     # By default, Chrome on Android does not allow autoplay
     # of media: it requires a user gesture event to start a video.
@@ -182,6 +195,9 @@
   def Name(cls):
     return 'media.media_cns_cases'
 
+  def GetExpectations(self):
+    return page_sets.MediaCnsCasesPageSetStoryExpectations()
+
 
 @benchmark.Disabled('android-webview')  # crbug.com/419689
 @benchmark.Owner(emails=['crouleau@chromium.org', 'videostack-eng@google.com'],
@@ -200,3 +216,6 @@
     options.AppendExtraBrowserArgs(
         ['--enable-experimental-web-platform-features',
          '--ignore-autoplay-restrictions'])
+
+  def GetExpectations(self):
+    return page_sets.MseCasesStoryExpectations()

diff --git a/tools/perf/page_sets/media_cns_cases.py b/tools/perf/page_sets/media_cns_cases.py
index b09c1e4..2aee097c 100644
--- a/tools/perf/page_sets/media_cns_cases.py
+++ b/tools/perf/page_sets/media_cns_cases.py

@@ -119,3 +119,10 @@
       else:
         name = url.split('/')[-1]
       self.AddStory(SeekBeforeAndAfterPlayheadPage(url, self, name=name))
+
+
+class MediaCnsCasesPageSetStoryExpectations(
+    story.expectations.StoryExpectations):
+
+  def SetExpectations(self):
+    pass

diff --git a/tools/perf/page_sets/mse_cases.py b/tools/perf/page_sets/mse_cases.py
index 75477b1..1fe631c7 100644
--- a/tools/perf/page_sets/mse_cases.py
+++ b/tools/perf/page_sets/mse_cases.py

@@ -46,3 +46,9 @@
 
     for url in urls_list:
       self.AddStory(MseCasesPage(url, self, url.split('/')[-1]))
+
+class MseCasesStoryExpectations(
+    story.expectations.StoryExpectations):
+
+  def SetExpectations(self):
+    pass

diff --git a/tools/perf/page_sets/tough_video_cases.py b/tools/perf/page_sets/tough_video_cases.py
index 80be1cf1..a66af42 100644
--- a/tools/perf/page_sets/tough_video_cases.py
+++ b/tools/perf/page_sets/tough_video_cases.py

@@ -425,3 +425,18 @@
     self.AddStory(Page31(self))
     self.AddStory(Page33(self))
     self.AddStory(Page36(self))
+
+
+class ToughVideoCasesDesktopStoryExpectations(
+    story.expectations.StoryExpectations):
+
+  def SetExpectations(self):
+    self.PermanentlyDisableBenchmark(
+        [story.expectations.ALL_MOBILE],'Desktop Benchmark')
+
+class ToughVideoCasesAndroidStoryExpectations(
+    story.expectations.StoryExpectations):
+
+  def SetExpectations(self):
+    self.PermanentlyDisableBenchmark(
+        [story.expectations.ALL_DESKTOP],'Android Benchmark')

diff --git a/tools/valgrind/chrome_tests.bat b/tools/valgrind/chrome_tests.bat
deleted file mode 100755
index e917e86..0000000
--- a/tools/valgrind/chrome_tests.bat
+++ /dev/null

@@ -1,53 +0,0 @@
-@echo off

-:: Copyright (c) 2011 The Chromium Authors. All rights reserved.

-:: Use of this source code is governed by a BSD-style license that can be

-:: found in the LICENSE file.

-

-setlocal

-

-set THISDIR=%~dp0

-set TOOL_NAME="unknown"

-

-:: Get the tool name and put it into TOOL_NAME {{{1

-:: NB: SHIFT command doesn't modify %*

-:PARSE_ARGS_LOOP

-  if %1 == () GOTO:TOOLNAME_NOT_FOUND

-  if %1 == --tool GOTO:TOOLNAME_FOUND

-  SHIFT

-  goto :PARSE_ARGS_LOOP

-

-:TOOLNAME_NOT_FOUND

-echo "Please specify a tool (e.g. drmemory) by using --tool flag"

-exit /B 1

-

-:TOOLNAME_FOUND

-SHIFT

-set TOOL_NAME=%1

-:: }}}

-if "%TOOL_NAME%" == "drmemory"          GOTO :SETUP_DRMEMORY

-if "%TOOL_NAME%" == "drmemory_light"    GOTO :SETUP_DRMEMORY

-if "%TOOL_NAME%" == "drmemory_full"     GOTO :SETUP_DRMEMORY

-if "%TOOL_NAME%" == "drmemory_pattern"  GOTO :SETUP_DRMEMORY

-echo "Unknown tool: `%TOOL_NAME%`! Only drmemory is supported right now"

-exit /B 1

-

-:SETUP_DRMEMORY

-:: Set up DRMEMORY_COMMAND to invoke Dr. Memory {{{1

-set DRMEMORY_PATH=%THISDIR%..\..\third_party\drmemory

-set DRMEMORY_SFX=%DRMEMORY_PATH%\drmemory-windows-sfx.exe

-if EXIST %DRMEMORY_SFX% GOTO DRMEMORY_BINARY_OK

-echo "Can't find Dr. Memory executables."

-echo "See http://www.chromium.org/developers/how-tos/using-valgrind/dr-memory"

-echo "for the instructions on how to get them."

-exit /B 1

-

-:DRMEMORY_BINARY_OK

-%DRMEMORY_SFX% -o%DRMEMORY_PATH%\unpacked -y

-set DRMEMORY_COMMAND=%DRMEMORY_PATH%\unpacked\bin\drmemory.exe

-:: }}}

-goto :RUN_TESTS

-

-:RUN_TESTS

-set PYTHONPATH=%THISDIR%../python/google

-set RUNNING_ON_VALGRIND=yes

-python %THISDIR%/chrome_tests.py %*


diff --git a/tools/valgrind/chrome_tests.py b/tools/valgrind/chrome_tests.py
deleted file mode 100755
index 9c7143a..0000000
--- a/tools/valgrind/chrome_tests.py
+++ /dev/null

@@ -1,863 +0,0 @@
-#!/usr/bin/env python
-# Copyright (c) 2012 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-''' Runs various chrome tests through valgrind_test.py.'''
-
-import glob
-import logging
-import multiprocessing
-import optparse
-import os
-import stat
-import subprocess
-import sys
-
-import logging_utils
-import path_utils
-
-import common
-import valgrind_test
-
-class TestNotFound(Exception): pass
-
-class MultipleGTestFiltersSpecified(Exception): pass
-
-class BuildDirNotFound(Exception): pass
-
-class BuildDirAmbiguous(Exception): pass
-
-class ExecutableNotFound(Exception): pass
-
-class BadBinary(Exception): pass
-
-class ChromeTests:
-  SLOW_TOOLS = ["memcheck", "drmemory"]
-  LAYOUT_TESTS_DEFAULT_CHUNK_SIZE = 300
-
-  def __init__(self, options, args, test):
-    if ':' in test:
-      (self._test, self._gtest_filter) = test.split(':', 1)
-    else:
-      self._test = test
-      self._gtest_filter = options.gtest_filter
-
-    if self._test not in self._test_list:
-      raise TestNotFound("Unknown test: %s" % test)
-
-    if options.gtest_filter and options.gtest_filter != self._gtest_filter:
-      raise MultipleGTestFiltersSpecified("Can not specify both --gtest_filter "
-                                          "and --test %s" % test)
-
-    self._options = options
-    self._args = args
-
-    script_dir = path_utils.ScriptDir()
-    # Compute the top of the tree (the "source dir") from the script dir (where
-    # this script lives).  We assume that the script dir is in tools/valgrind/
-    # relative to the top of the tree.
-    self._source_dir = os.path.dirname(os.path.dirname(script_dir))
-    # since this path is used for string matching, make sure it's always
-    # an absolute Unix-style path
-    self._source_dir = os.path.abspath(self._source_dir).replace('\\', '/')
-    valgrind_test_script = os.path.join(script_dir, "valgrind_test.py")
-    self._command_preamble = ["--source-dir=%s" % (self._source_dir)]
-
-    if not self._options.build_dir:
-      dirs = [
-        os.path.join(self._source_dir, "xcodebuild", "Debug"),
-        os.path.join(self._source_dir, "out", "Debug"),
-        os.path.join(self._source_dir, "build", "Debug"),
-      ]
-      build_dir = [d for d in dirs if os.path.isdir(d)]
-      if len(build_dir) > 1:
-        raise BuildDirAmbiguous("Found more than one suitable build dir:\n"
-                                "%s\nPlease specify just one "
-                                "using --build-dir" % ", ".join(build_dir))
-      elif build_dir:
-        self._options.build_dir = build_dir[0]
-      else:
-        self._options.build_dir = None
-
-    if self._options.build_dir:
-      build_dir = os.path.abspath(self._options.build_dir)
-      self._command_preamble += ["--build-dir=%s" % (self._options.build_dir)]
-
-  def _EnsureBuildDirFound(self):
-    if not self._options.build_dir:
-      raise BuildDirNotFound("Oops, couldn't find a build dir, please "
-                             "specify it manually using --build-dir")
-
-  def _DefaultCommand(self, tool, exe=None, valgrind_test_args=None):
-    '''Generates the default command array that most tests will use.'''
-    if exe and common.IsWindows():
-      exe += '.exe'
-
-    cmd = list(self._command_preamble)
-
-    # Find all suppressions matching the following pattern:
-    # tools/valgrind/TOOL/suppressions[_PLATFORM].txt
-    # and list them with --suppressions= prefix.
-    script_dir = path_utils.ScriptDir()
-    tool_name = tool.ToolName();
-    suppression_file = os.path.join(script_dir, tool_name, "suppressions.txt")
-    if os.path.exists(suppression_file):
-      cmd.append("--suppressions=%s" % suppression_file)
-    # Platform-specific suppression
-    for platform in common.PlatformNames():
-      platform_suppression_file = \
-          os.path.join(script_dir, tool_name, 'suppressions_%s.txt' % platform)
-      if os.path.exists(platform_suppression_file):
-        cmd.append("--suppressions=%s" % platform_suppression_file)
-
-    if tool_name == "drmemory":
-      if self._options.drmemory_ops:
-        # prepending " " to avoid Dr. Memory's option confusing optparse
-        cmd += ["--drmemory_ops", " " + self._options.drmemory_ops]
-
-    if self._options.valgrind_tool_flags:
-      cmd += self._options.valgrind_tool_flags.split(" ")
-    if self._options.keep_logs:
-      cmd += ["--keep_logs"]
-    if valgrind_test_args != None:
-      for arg in valgrind_test_args:
-        cmd.append(arg)
-    if exe:
-      self._EnsureBuildDirFound()
-      exe_path = os.path.join(self._options.build_dir, exe)
-      if not os.path.exists(exe_path):
-        raise ExecutableNotFound("Couldn't find '%s'" % exe_path)
-
-      # Make sure we don't try to test ASan-built binaries
-      # with other dynamic instrumentation-based tools.
-      # TODO(timurrrr): also check TSan and MSan?
-      # `nm` might not be available, so use try-except.
-      try:
-        # Do not perform this check on OS X, as 'nm' on 10.6 can't handle
-        # binaries built with Clang 3.5+.
-        if not common.IsMac():
-          nm_output = subprocess.check_output(["nm", exe_path])
-          if nm_output.find("__asan_init") != -1:
-            raise BadBinary("You're trying to run an executable instrumented "
-                            "with AddressSanitizer under %s. Please provide "
-                            "an uninstrumented executable." % tool_name)
-      except OSError:
-        pass
-
-      cmd.append(exe_path)
-      # Valgrind runs tests slowly, so slow tests hurt more; show elapased time
-      # so we can find the slowpokes.
-      cmd.append("--gtest_print_time")
-      # Built-in test launcher for gtest-based executables runs tests using
-      # multiple process by default. Force the single-process mode back.
-      cmd.append("--single-process-tests")
-    if self._options.gtest_repeat:
-      cmd.append("--gtest_repeat=%s" % self._options.gtest_repeat)
-    if self._options.gtest_shuffle:
-      cmd.append("--gtest_shuffle")
-    if self._options.gtest_break_on_failure:
-      cmd.append("--gtest_break_on_failure")
-    if self._options.test_launcher_bot_mode:
-      cmd.append("--test-launcher-bot-mode")
-    if self._options.test_launcher_total_shards is not None:
-      cmd.append("--test-launcher-total-shards=%d" % self._options.test_launcher_total_shards)
-    if self._options.test_launcher_shard_index is not None:
-      cmd.append("--test-launcher-shard-index=%d" % self._options.test_launcher_shard_index)
-    return cmd
-
-  def Run(self):
-    ''' Runs the test specified by command-line argument --test '''
-    logging.info("running test %s" % (self._test))
-    return self._test_list[self._test](self)
-
-  def _AppendGtestFilter(self, tool, name, cmd):
-    '''Append an appropriate --gtest_filter flag to the googletest binary
-       invocation.
-       If the user passed their own filter mentioning only one test, just use
-       it. Otherwise, filter out tests listed in the appropriate gtest_exclude
-       files.
-    '''
-    if (self._gtest_filter and
-        ":" not in self._gtest_filter and
-        "?" not in self._gtest_filter and
-        "*" not in self._gtest_filter):
-      cmd.append("--gtest_filter=%s" % self._gtest_filter)
-      return
-
-    filters = []
-    gtest_files_dir = os.path.join(path_utils.ScriptDir(), "gtest_exclude")
-
-    gtest_filter_files = [
-        os.path.join(gtest_files_dir, name + ".gtest-%s.txt" % tool.ToolName())]
-    # Use ".gtest.txt" files only for slow tools, as they now contain
-    # Valgrind- and Dr.Memory-specific filters.
-    # TODO(glider): rename the files to ".gtest_slow.txt"
-    if tool.ToolName() in ChromeTests.SLOW_TOOLS:
-      gtest_filter_files += [os.path.join(gtest_files_dir, name + ".gtest.txt")]
-    for platform_suffix in common.PlatformNames():
-      gtest_filter_files += [
-        os.path.join(gtest_files_dir, name + ".gtest_%s.txt" % platform_suffix),
-        os.path.join(gtest_files_dir, name + ".gtest-%s_%s.txt" % \
-            (tool.ToolName(), platform_suffix))]
-    logging.info("Reading gtest exclude filter files:")
-    for filename in gtest_filter_files:
-      # strip the leading absolute path (may be very long on the bot)
-      # and the following / or \.
-      readable_filename = filename.replace("\\", "/")  # '\' on Windows
-      readable_filename = readable_filename.replace(self._source_dir, "")[1:]
-      if not os.path.exists(filename):
-        logging.info("  \"%s\" - not found" % readable_filename)
-        continue
-      logging.info("  \"%s\" - OK" % readable_filename)
-      f = open(filename, 'r')
-      for line in f.readlines():
-        if line.startswith("#") or line.startswith("//") or line.isspace():
-          continue
-        line = line.rstrip()
-        test_prefixes = ["FLAKY", "FAILS"]
-        for p in test_prefixes:
-          # Strip prefixes from the test names.
-          line = line.replace(".%s_" % p, ".")
-        # Exclude the original test name.
-        filters.append(line)
-        if line[-2:] != ".*":
-          # List all possible prefixes if line doesn't end with ".*".
-          for p in test_prefixes:
-            filters.append(line.replace(".", ".%s_" % p))
-    # Get rid of duplicates.
-    filters = set(filters)
-    gtest_filter = self._gtest_filter
-    if len(filters):
-      if gtest_filter:
-        gtest_filter += ":"
-        if gtest_filter.find("-") < 0:
-          gtest_filter += "-"
-      else:
-        gtest_filter = "-"
-      gtest_filter += ":".join(filters)
-    if gtest_filter:
-      cmd.append("--gtest_filter=%s" % gtest_filter)
-
-  @staticmethod
-  def ShowTests():
-    test_to_names = {}
-    for name, test_function in ChromeTests._test_list.iteritems():
-      test_to_names.setdefault(test_function, []).append(name)
-
-    name_to_aliases = {}
-    for names in test_to_names.itervalues():
-      names.sort(key=lambda name: len(name))
-      name_to_aliases[names[0]] = names[1:]
-
-    print
-    print "Available tests:"
-    print "----------------"
-    for name, aliases in sorted(name_to_aliases.iteritems()):
-      if aliases:
-        print "   {} (aka {})".format(name, ', '.join(aliases))
-      else:
-        print "   {}".format(name)
-
-  def SetupLdPath(self, requires_build_dir):
-    if requires_build_dir:
-      self._EnsureBuildDirFound()
-    elif not self._options.build_dir:
-      return
-
-    # Append build_dir to LD_LIBRARY_PATH so external libraries can be loaded.
-    if (os.getenv("LD_LIBRARY_PATH")):
-      os.putenv("LD_LIBRARY_PATH", "%s:%s" % (os.getenv("LD_LIBRARY_PATH"),
-                                              self._options.build_dir))
-    else:
-      os.putenv("LD_LIBRARY_PATH", self._options.build_dir)
-
-  def SimpleTest(self, module, name, valgrind_test_args=None, cmd_args=None):
-    tool = valgrind_test.CreateTool(self._options.valgrind_tool)
-    cmd = self._DefaultCommand(tool, name, valgrind_test_args)
-    self._AppendGtestFilter(tool, name, cmd)
-    cmd.extend(['--test-tiny-timeout=1000'])
-    if cmd_args:
-      cmd.extend(cmd_args)
-
-    self.SetupLdPath(True)
-    return tool.Run(cmd, module)
-
-  def RunCmdLine(self):
-    tool = valgrind_test.CreateTool(self._options.valgrind_tool)
-    cmd = self._DefaultCommand(tool, None, self._args)
-    self.SetupLdPath(False)
-    return tool.Run(cmd, None)
-
-  def TestAccessibility(self):
-    return self.SimpleTest("accessibility", "accessibility_unittests")
-
-  def TestAddressInput(self):
-    return self.SimpleTest("addressinput", "libaddressinput_unittests")
-
-  def TestAngle(self):
-    return self.SimpleTest("angle", "angle_unittests")
-
-  def TestAppList(self):
-    return self.SimpleTest("app_list", "app_list_unittests")
-
-  def TestAsh(self):
-    return self.SimpleTest("ash", "ash_unittests")
-
-  def TestAura(self):
-    return self.SimpleTest("aura", "aura_unittests")
-
-  def TestBase(self):
-    return self.SimpleTest("base", "base_unittests")
-
-  def TestBlinkHeap(self):
-    return self.SimpleTest("blink_heap", "blink_heap_unittests")
-
-  def TestBlinkPlatform(self):
-    return self.SimpleTest("blink_platform", "blink_platform_unittests")
-
-  def TestCacheInvalidation(self):
-    return self.SimpleTest("cacheinvalidation", "cacheinvalidation_unittests")
-
-  def TestCast(self):
-    return self.SimpleTest("chrome", "cast_unittests")
-
-  def TestCC(self):
-    return self.SimpleTest("cc", "cc_unittests",
-                           cmd_args=[
-                               "--cc-layer-tree-test-long-timeout"])
-
-  def TestChromeApp(self):
-    return self.SimpleTest("chrome_app", "chrome_app_unittests")
-
-  def TestChromeElf(self):
-    return self.SimpleTest("chrome_elf", "chrome_elf_unittests")
-
-  def TestChromeDriver(self):
-    return self.SimpleTest("chromedriver", "chromedriver_unittests")
-
-  def TestChromeOS(self):
-    return self.SimpleTest("chromeos", "chromeos_unittests")
-
-  def TestComponents(self):
-    return self.SimpleTest("components", "components_unittests")
-
-  def TestCompositor(self):
-    return self.SimpleTest("compositor", "compositor_unittests")
-
-  def TestContent(self):
-    return self.SimpleTest("content", "content_unittests")
-
-  def TestCourgette(self):
-    return self.SimpleTest("courgette", "courgette_unittests")
-
-  def TestCrypto(self):
-    return self.SimpleTest("crypto", "crypto_unittests")
-
-  def TestDevice(self):
-    return self.SimpleTest("device", "device_unittests")
-
-  def TestDisplay(self):
-    return self.SimpleTest("display", "display_unittests")
-
-  def TestEvents(self):
-    return self.SimpleTest("events", "events_unittests")
-
-  def TestExtensions(self):
-    return self.SimpleTest("extensions", "extensions_unittests")
-
-  def TestFFmpegRegressions(self):
-    return self.SimpleTest("chrome", "ffmpeg_regression_tests")
-
-  def TestGCM(self):
-    return self.SimpleTest("gcm", "gcm_unit_tests")
-
-  def TestGfx(self):
-    return self.SimpleTest("gfx", "gfx_unittests")
-
-  def TestGin(self):
-    return self.SimpleTest("gin", "gin_unittests")
-
-  def TestGoogleApis(self):
-    return self.SimpleTest("google_apis", "google_apis_unittests")
-
-  def TestGPU(self):
-    return self.SimpleTest("gpu", "gpu_unittests")
-
-  def TestIpc(self):
-    return self.SimpleTest("ipc", "ipc_tests",
-                           valgrind_test_args=["--trace_children"])
-
-  def TestInstallerUtil(self):
-    return self.SimpleTest("installer_util", "installer_util_unittests")
-
-  def TestInstallStatic(self):
-    return self.SimpleTest("install_static", "install_static_unittests")
-
-  def TestJingle(self):
-    return self.SimpleTest("chrome", "jingle_unittests")
-
-  def TestKeyboard(self):
-    return self.SimpleTest("keyboard", "keyboard_unittests")
-
-  def TestLatency(self):
-    return self.SimpleTest("latency", "latency_unittests")
-
-  def TestMedia(self):
-    return self.SimpleTest("chrome", "media_unittests")
-
-  def TestMessageCenter(self):
-    return self.SimpleTest("message_center", "message_center_unittests")
-
-  def TestMidi(self):
-    return self.SimpleTest("chrome", "midi_unittests")
-
-  def TestMojoCommon(self):
-    return self.SimpleTest("mojo_common", "mojo_common_unittests")
-
-  def TestMojoPublicBindings(self):
-    return self.SimpleTest("mojo_public_bindings",
-                           "mojo_public_bindings_unittests")
-
-  def TestMojoPublicSystem(self):
-    return self.SimpleTest("mojo_public_system",
-                           "mojo_public_system_unittests")
-
-  def TestMojoPublicSysPerf(self):
-    return self.SimpleTest("mojo_public_sysperf",
-                           "mojo_public_system_perftests")
-
-  def TestMojoSystem(self):
-    return self.SimpleTest("mojo_system", "mojo_system_unittests")
-
-  def TestNet(self):
-    return self.SimpleTest("net", "net_unittests")
-
-  def TestNetPerf(self):
-    return self.SimpleTest("net", "net_perftests")
-
-  def TestPhoneNumber(self):
-    return self.SimpleTest("phonenumber", "libphonenumber_unittests")
-
-  def TestPPAPI(self):
-    return self.SimpleTest("chrome", "ppapi_unittests")
-
-  def TestPrinting(self):
-    return self.SimpleTest("chrome", "printing_unittests")
-
-  def TestRemoting(self):
-    return self.SimpleTest("chrome", "remoting_unittests",
-                           cmd_args=[
-                               "--ui-test-action-timeout=60000",
-                               "--ui-test-action-max-timeout=150000"])
-
-  def TestSkia(self):
-    return self.SimpleTest("skia", "skia_unittests")
-
-  def TestSql(self):
-    return self.SimpleTest("chrome", "sql_unittests")
-
-  def TestStorage(self):
-    return self.SimpleTest("storage", "storage_unittests")
-
-  def TestLinuxSandbox(self):
-    return self.SimpleTest("sandbox", "sandbox_linux_unittests")
-
-  def TestUnit(self):
-    # http://crbug.com/51716
-    # Disabling all unit tests
-    # Problems reappeared after r119922
-    if common.IsMac() and (self._options.valgrind_tool == "memcheck"):
-      logging.warning("unit_tests are disabled for memcheck on MacOS.")
-      return 0;
-    return self.SimpleTest("chrome", "unit_tests")
-
-  def TestUIBaseUnit(self):
-    return self.SimpleTest("chrome", "ui_base_unittests")
-
-  def TestUIChromeOS(self):
-    return self.SimpleTest("chrome", "ui_chromeos_unittests")
-
-  def TestURL(self):
-    return self.SimpleTest("chrome", "url_unittests")
-
-  def TestViews(self):
-    return self.SimpleTest("views", "views_unittests")
-
-
-  # Valgrind timeouts are in seconds.
-  UI_VALGRIND_ARGS = ["--timeout=14400", "--trace_children", "--indirect"]
-  # UI test timeouts are in milliseconds.
-  UI_TEST_ARGS = ["--ui-test-action-timeout=60000",
-                  "--ui-test-action-max-timeout=150000",
-                  "--no-sandbox"]
-
-  # TODO(thestig) fine-tune these values.
-  # Valgrind timeouts are in seconds.
-  BROWSER_VALGRIND_ARGS = ["--timeout=50000", "--trace_children", "--indirect"]
-  # Browser test timeouts are in milliseconds.
-  BROWSER_TEST_ARGS = ["--ui-test-action-timeout=400000",
-                       "--ui-test-action-max-timeout=800000",
-                       "--no-sandbox"]
-
-  def TestBrowser(self):
-    return self.SimpleTest("chrome", "browser_tests",
-                           valgrind_test_args=self.BROWSER_VALGRIND_ARGS,
-                           cmd_args=self.BROWSER_TEST_ARGS)
-
-  def TestContentBrowser(self):
-    return self.SimpleTest("content", "content_browsertests",
-                           valgrind_test_args=self.BROWSER_VALGRIND_ARGS,
-                           cmd_args=self.BROWSER_TEST_ARGS)
-
-  def TestInteractiveUI(self):
-    return self.SimpleTest("chrome", "interactive_ui_tests",
-                           valgrind_test_args=self.UI_VALGRIND_ARGS,
-                           cmd_args=self.UI_TEST_ARGS)
-
-  def TestSyncIntegration(self):
-    return self.SimpleTest("chrome", "sync_integration_tests",
-                           valgrind_test_args=self.UI_VALGRIND_ARGS,
-                           cmd_args=(["--ui-test-action-max-timeout=450000"]))
-
-  def TestLayoutChunk(self, chunk_num, chunk_size):
-    # Run tests [chunk_num*chunk_size .. (chunk_num+1)*chunk_size) from the
-    # list of tests.  Wrap around to beginning of list at end.
-    # If chunk_size is zero, run all tests in the list once.
-    # If a text file is given as argument, it is used as the list of tests.
-    assert((chunk_size == 0) != (len(self._args) == 0))
-    # Build the ginormous commandline in 'cmd'.
-    # It's going to be roughly
-    #  python valgrind_test.py ...
-    # but we'll use the --indirect flag to valgrind_test.py
-    # to avoid valgrinding python.
-    # Start by building the valgrind_test.py commandline.
-    tool = valgrind_test.CreateTool(self._options.valgrind_tool)
-    cmd = self._DefaultCommand(tool)
-    cmd.append("--trace_children")
-    cmd.append("--indirect_webkit_layout")
-    cmd.append("--ignore_exit_code")
-    # Now build script_cmd, the run-webkits-tests commandline.
-    # Store each chunk in its own directory so that we can find the data later
-    chunk_dir = os.path.join("layout", "chunk_%05d" % chunk_num)
-    out_dir = os.path.join(path_utils.ScriptDir(), "latest")
-    out_dir = os.path.join(out_dir, chunk_dir)
-    if os.path.exists(out_dir):
-      old_files = glob.glob(os.path.join(out_dir, "*.txt"))
-      for f in old_files:
-        os.remove(f)
-    else:
-      os.makedirs(out_dir)
-    script = os.path.join(self._source_dir, "third_party", "WebKit", "Tools",
-                          "Scripts", "run-webkit-tests")
-    # http://crbug.com/260627: After the switch to content_shell from DRT, each
-    # test now brings up 3 processes.  Under Valgrind, they become memory bound
-    # and can eventually OOM if we don't reduce the total count.
-    # It'd be nice if content_shell automatically throttled the startup of new
-    # tests if we're low on memory.
-    jobs = max(1, int(multiprocessing.cpu_count() * 0.3))
-    script_cmd = ["python", script, "-v",
-                  # run a separate DumpRenderTree for each test
-                  "--batch-size=1",
-                  "--fully-parallel",
-                  "--child-processes=%d" % jobs,
-                  "--time-out-ms=800000",
-                  "--no-retry-failures",  # retrying takes too much time
-                  # http://crbug.com/176908: Don't launch a browser when done.
-                  "--no-show-results",
-                  "--nocheck-sys-deps",
-                  "--additional-driver-flag=--no-sandbox"]
-    # Pass build mode to run-webkit-tests.  We aren't passed it directly,
-    # so parse it out of build_dir.  run-webkit-tests can only handle
-    # the two values "Release" and "Debug".
-    # TODO(Hercules): unify how all our scripts pass around build mode
-    # (--mode / --target / --build-dir / --debug)
-    if self._options.build_dir:
-      build_root, mode = os.path.split(self._options.build_dir)
-      script_cmd.extend(["--build-directory", build_root, "--target", mode])
-    if (chunk_size > 0):
-      script_cmd.append("--run-chunk=%d:%d" % (chunk_num, chunk_size))
-    if len(self._args):
-      # if the arg is a txt file, then treat it as a list of tests
-      if os.path.isfile(self._args[0]) and self._args[0][-4:] == ".txt":
-        script_cmd.append("--test-list=%s" % self._args[0])
-      else:
-        script_cmd.extend(self._args)
-    self._AppendGtestFilter(tool, "layout", script_cmd)
-    # Now run script_cmd with the wrapper in cmd
-    cmd.extend(["--"])
-    cmd.extend(script_cmd)
-
-    # Layout tests often times fail quickly, but the buildbot remains green.
-    # Detect this situation when running with the default chunk size.
-    if chunk_size == self.LAYOUT_TESTS_DEFAULT_CHUNK_SIZE:
-      min_runtime_in_seconds=120
-    else:
-      min_runtime_in_seconds=0
-    ret = tool.Run(cmd, "layout", min_runtime_in_seconds=min_runtime_in_seconds)
-    return ret
-
-
-  def TestLayout(self):
-    # A "chunk file" is maintained in the local directory so that each test
-    # runs a slice of the layout tests of size chunk_size that increments with
-    # each run.  Since tests can be added and removed from the layout tests at
-    # any time, this is not going to give exact coverage, but it will allow us
-    # to continuously run small slices of the layout tests under valgrind rather
-    # than having to run all of them in one shot.
-    chunk_size = self._options.num_tests
-    if chunk_size == 0 or len(self._args):
-      return self.TestLayoutChunk(0, 0)
-    chunk_num = 0
-    chunk_file = os.path.join("valgrind_layout_chunk.txt")
-    logging.info("Reading state from " + chunk_file)
-    try:
-      f = open(chunk_file)
-      if f:
-        chunk_str = f.read()
-        if len(chunk_str):
-          chunk_num = int(chunk_str)
-        # This should be enough so that we have a couple of complete runs
-        # of test data stored in the archive (although note that when we loop
-        # that we almost guaranteed won't be at the end of the test list)
-        if chunk_num > 10000:
-          chunk_num = 0
-        f.close()
-    except IOError, (errno, strerror):
-      logging.error("error reading from file %s (%d, %s)" % (chunk_file,
-                    errno, strerror))
-    # Save the new chunk size before running the tests. Otherwise if a
-    # particular chunk hangs the bot, the chunk number will never get
-    # incremented and the bot will be wedged.
-    logging.info("Saving state to " + chunk_file)
-    try:
-      f = open(chunk_file, "w")
-      chunk_num += 1
-      f.write("%d" % chunk_num)
-      f.close()
-    except IOError, (errno, strerror):
-      logging.error("error writing to file %s (%d, %s)" % (chunk_file, errno,
-                    strerror))
-    # Since we're running small chunks of the layout tests, it's important to
-    # mark the ones that have errors in them.  These won't be visible in the
-    # summary list for long, but will be useful for someone reviewing this bot.
-    return self.TestLayoutChunk(chunk_num, chunk_size)
-
-  # The known list of tests.
-  # Recognise the original abbreviations as well as full executable names.
-  _test_list = {
-    "cmdline" : RunCmdLine,
-    "addressinput": TestAddressInput,
-    "libaddressinput_unittests": TestAddressInput,
-    "accessibility": TestAccessibility,
-    "angle": TestAngle,          "angle_unittests": TestAngle,
-    "app_list": TestAppList,     "app_list_unittests": TestAppList,
-    "ash": TestAsh,              "ash_unittests": TestAsh,
-    "aura": TestAura,            "aura_unittests": TestAura,
-    "base": TestBase,            "base_unittests": TestBase,
-    "blink_heap": TestBlinkHeap,
-    "blink_platform": TestBlinkPlatform,
-    "browser": TestBrowser,      "browser_tests": TestBrowser,
-    "cacheinvalidation": TestCacheInvalidation,
-    "cacheinvalidation_unittests": TestCacheInvalidation,
-    "cast": TestCast,            "cast_unittests": TestCast,
-    "cc": TestCC,                "cc_unittests": TestCC,
-    "chrome_app": TestChromeApp,
-    "chrome_elf": TestChromeElf,
-    "chromedriver": TestChromeDriver,
-    "chromeos": TestChromeOS,    "chromeos_unittests": TestChromeOS,
-    "components": TestComponents,"components_unittests": TestComponents,
-    "compositor": TestCompositor,"compositor_unittests": TestCompositor,
-    "content": TestContent,      "content_unittests": TestContent,
-    "content_browsertests": TestContentBrowser,
-    "courgette": TestCourgette,  "courgette_unittests": TestCourgette,
-    "crypto": TestCrypto,        "crypto_unittests": TestCrypto,
-    "device": TestDevice,        "device_unittests": TestDevice,
-    "display": TestDisplay,      "display_unittests": TestDisplay,
-    "events": TestEvents,        "events_unittests": TestEvents,
-    "extensions": TestExtensions, "extensions_unittests": TestExtensions,
-    "ffmpeg_regression_tests": TestFFmpegRegressions,
-    "gcm": TestGCM,              "gcm_unit_tests": TestGCM,
-    "gin": TestGin,              "gin_unittests": TestGin,
-    "gfx": TestGfx,              "gfx_unittests": TestGfx,
-    "google_apis": TestGoogleApis,
-    "gpu": TestGPU,              "gpu_unittests": TestGPU,
-    "ipc": TestIpc,              "ipc_tests": TestIpc,
-    "installer_util": TestInstallerUtil,
-    "installer_util_unittests": TestInstallerUtil,
-    "install_static_unittests": TestInstallStatic,
-    "interactive_ui": TestInteractiveUI,
-    "jingle": TestJingle,        "jingle_unittests": TestJingle,
-    "keyboard": TestKeyboard,    "keyboard_unittests": TestKeyboard,
-    "latency": TestLatency,      "latency_unittests": TestLatency,
-    "layout": TestLayout,        "layout_tests": TestLayout,
-    "media": TestMedia,          "media_unittests": TestMedia,
-    "message_center": TestMessageCenter,
-    "message_center_unittests" : TestMessageCenter,
-    "midi": TestMidi,             "midi_unittests": TestMidi,
-    "mojo_common": TestMojoCommon,
-    "mojo_common_unittests": TestMojoCommon,
-    "mojo_system": TestMojoSystem,
-    "mojo_system_unittests": TestMojoSystem,
-    "mojo_public_system": TestMojoPublicSystem,
-    "mojo_public_system_unittests": TestMojoPublicSystem,
-    "mojo_public_bindings": TestMojoPublicBindings,
-    "mojo_public_bindings_unittests": TestMojoPublicBindings,
-    "mojo_public_sysperf": TestMojoPublicSysPerf,
-    "net": TestNet,              "net_unittests": TestNet,
-    "net_perf": TestNetPerf,     "net_perftests": TestNetPerf,
-    "phonenumber": TestPhoneNumber,
-    "libphonenumber_unittests": TestPhoneNumber,
-    "ppapi": TestPPAPI,          "ppapi_unittests": TestPPAPI,
-    "printing": TestPrinting,    "printing_unittests": TestPrinting,
-    "remoting": TestRemoting,    "remoting_unittests": TestRemoting,
-    "sandbox": TestLinuxSandbox, "sandbox_linux_unittests": TestLinuxSandbox,
-    "skia": TestSkia,            "skia_unittests": TestSkia,
-    "sql": TestSql,              "sql_unittests": TestSql,
-    "storage": TestStorage,      "storage_unittests": TestStorage,
-    "sync_integration_tests": TestSyncIntegration,
-    "sync_integration": TestSyncIntegration,
-    "ui_base_unit": TestUIBaseUnit,       "ui_base_unittests": TestUIBaseUnit,
-    "ui_chromeos": TestUIChromeOS, "ui_chromeos_unittests": TestUIChromeOS,
-    "unit": TestUnit,            "unit_tests": TestUnit,
-    "url": TestURL,              "url_unittests": TestURL,
-    "views": TestViews,          "views_unittests": TestViews,
-    "webkit": TestLayout,
-  }
-
-
-def _main():
-  parser = optparse.OptionParser("usage: %prog -b <dir> -t <test> "
-                                 "[-t <test> ...]")
-
-  parser.add_option("--help-tests", dest="help_tests", action="store_true",
-                    default=False, help="List all available tests")
-  parser.add_option("-b", "--build-dir",
-                    help="the location of the compiler output")
-  parser.add_option("--target", help="Debug or Release")
-  parser.add_option("-t", "--test", action="append", default=[],
-                    help="which test to run, supports test:gtest_filter format "
-                         "as well.")
-  parser.add_option("--baseline", action="store_true", default=False,
-                    help="generate baseline data instead of validating")
-  parser.add_option("-f", "--force", action="store_true", default=False,
-                    help="run a broken test anyway")
-  parser.add_option("--gtest_filter",
-                    help="additional arguments to --gtest_filter")
-  parser.add_option("--gtest_repeat", help="argument for --gtest_repeat")
-  parser.add_option("--gtest_shuffle", action="store_true", default=False,
-                    help="Randomize tests' orders on every iteration.")
-  parser.add_option("--gtest_break_on_failure", action="store_true",
-                    default=False,
-                    help="Drop in to debugger on assertion failure. Also "
-                         "useful for forcing tests to exit with a stack dump "
-                         "on the first assertion failure when running with "
-                         "--gtest_repeat=-1")
-  parser.add_option("-v", "--verbose", action="store_true", default=False,
-                    help="verbose output - enable debug log messages")
-  parser.add_option("--tool", dest="valgrind_tool", default="memcheck",
-                    help="specify a valgrind tool to run the tests under")
-  parser.add_option("--tool_flags", dest="valgrind_tool_flags", default="",
-                    help="specify custom flags for the selected valgrind tool")
-  parser.add_option("--keep_logs", action="store_true", default=False,
-                    help="store memory tool logs in the <tool>.logs directory "
-                         "instead of /tmp.\nThis can be useful for tool "
-                         "developers/maintainers.\nPlease note that the <tool>"
-                         ".logs directory will be clobbered on tool startup.")
-  parser.add_option("-n", "--num_tests", type="int",
-                    default=ChromeTests.LAYOUT_TESTS_DEFAULT_CHUNK_SIZE,
-                    help="for layout tests: # of subtests per run.  0 for all.")
-  parser.add_option("--test-launcher-bot-mode", action="store_true",
-                    help="run the tests with --test-launcher-bot-mode")
-  parser.add_option("--test-launcher-total-shards", type=int,
-                    help="run the tests with --test-launcher-total-shards")
-  parser.add_option("--test-launcher-shard-index", type=int,
-                    help="run the tests with --test-launcher-shard-index")
-  parser.add_option("--drmemory_ops",
-                    help="extra options passed to Dr. Memory")
-
-  options, args = parser.parse_args()
-
-  # Bake target into build_dir.
-  if options.target and options.build_dir:
-    assert (options.target !=
-            os.path.basename(os.path.dirname(options.build_dir)))
-    options.build_dir = os.path.join(os.path.abspath(options.build_dir),
-                                     options.target)
-
-  if options.verbose:
-    logging_utils.config_root(logging.DEBUG)
-  else:
-    logging_utils.config_root()
-
-  if options.help_tests:
-    ChromeTests.ShowTests()
-    return 0
-
-  if not options.test:
-    parser.error("--test not specified")
-
-  if len(options.test) != 1 and options.gtest_filter:
-    parser.error("--gtest_filter and multiple tests don't make sense together")
-
-  BROKEN_TESTS = {
-    'drmemory_light': [
-      'addressinput',
-      'aura',
-      'base_unittests',
-      'cc',
-      'components', # x64 only?
-      'content',
-      'gfx',
-      'mojo_public_bindings',
-    ],
-    'drmemory_full': [
-      'addressinput',
-      'aura',
-      'base_unittests',
-      'blink_heap',
-      'blink_platform',
-      'browser_tests',
-      'cast',
-      'cc',
-      'chromedriver',
-      'compositor',
-      'content',
-      'content_browsertests',
-      'device',
-      'events',
-      'extensions',
-      'gfx',
-      'google_apis',
-      'gpu',
-      'ipc_tests',
-      'jingle',
-      'keyboard',
-      'media',
-      'midi',
-      'mojo_common',
-      'mojo_public_bindings',
-      'mojo_public_sysperf',
-      'mojo_public_system',
-      'mojo_system',
-      'net',
-      'remoting',
-      'unit',
-      'url',
-    ],
-  }
-
-  for t in options.test:
-    if t in BROKEN_TESTS[options.valgrind_tool] and not options.force:
-      logging.info("Skipping broken %s test %s -- see crbug.com/633693" %
-                   (options.valgrind_tool, t))
-      return 0
-
-    tests = ChromeTests(options, args, t)
-    ret = tests.Run()
-    if ret: return ret
-  return 0
-
-
-if __name__ == "__main__":
-  sys.exit(_main())

diff --git a/tools/valgrind/chrome_tests.sh b/tools/valgrind/chrome_tests.sh
deleted file mode 100755
index 479138e..0000000
--- a/tools/valgrind/chrome_tests.sh
+++ /dev/null

@@ -1,90 +0,0 @@
-#!/bin/bash
-
-# Copyright (c) 2012 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-# Set up some paths and re-direct the arguments to chrome_tests.py
-
-export THISDIR=`dirname $0`
-ARGV_COPY="$@"
-
-# We need to set CHROME_VALGRIND iff using Memcheck:
-#   tools/valgrind/chrome_tests.sh --tool memcheck
-# or
-#   tools/valgrind/chrome_tests.sh --tool=memcheck
-tool="memcheck"  # Default to memcheck.
-while (( "$#" ))
-do
-  if [[ "$1" == "--tool" ]]
-  then
-    tool="$2"
-    shift
-  elif [[ "$1" =~ --tool=(.*) ]]
-  then
-    tool="${BASH_REMATCH[1]}"
-  fi
-  shift
-done
-
-NEEDS_VALGRIND=0
-NEEDS_DRMEMORY=0
-
-case "$tool" in
-  "memcheck")
-    NEEDS_VALGRIND=1
-    ;;
-  "drmemory" | "drmemory_light" | "drmemory_full" | "drmemory_pattern")
-    NEEDS_DRMEMORY=1
-    ;;
-esac
-
-if [ "$NEEDS_VALGRIND" == "1" ]
-then
-  export CHROME_VALGRIND=`sh $THISDIR/locate_valgrind.sh`
-  if [ "$CHROME_VALGRIND" = "" ]
-  then
-    # locate_valgrind.sh failed
-    exit 1
-  fi
-  echo "Using valgrind binaries from ${CHROME_VALGRIND}"
-
-  PATH="${CHROME_VALGRIND}/bin:$PATH"
-  # We need to set these variables to override default lib paths hard-coded into
-  # Valgrind binary.
-  export VALGRIND_LIB="$CHROME_VALGRIND/lib/valgrind"
-  export VALGRIND_LIB_INNER="$CHROME_VALGRIND/lib/valgrind"
-
-  # Clean up some /tmp directories that might be stale due to interrupted
-  # chrome_tests.py execution.
-  # FYI:
-  #   -mtime +1  <- only print files modified more than 24h ago,
-  #   -print0/-0 are needed to handle possible newlines in the filenames.
-  echo "Cleanup /tmp from Valgrind stuff"
-  find /tmp -maxdepth 1 \(\
-        -name "vgdb-pipe-*" -or -name "vg_logs_*" -or -name "valgrind.*" \
-      \) -mtime +1 -print0 | xargs -0 rm -rf
-fi
-
-if [ "$NEEDS_DRMEMORY" == "1" ]
-then
-  if [ -z "$DRMEMORY_COMMAND" ]
-  then
-    DRMEMORY_PATH="$THISDIR/../../third_party/drmemory"
-    DRMEMORY_SFX="$DRMEMORY_PATH/drmemory-windows-sfx.exe"
-    if [ ! -f "$DRMEMORY_SFX" ]
-    then
-      echo "Can't find Dr. Memory executables."
-      echo "See http://www.chromium.org/developers/how-tos/using-valgrind/dr-memory"
-      echo "for the instructions on how to get them."
-      exit 1
-    fi
-
-    chmod +x "$DRMEMORY_SFX"  # Cygwin won't run it without +x.
-    "$DRMEMORY_SFX" -o"$DRMEMORY_PATH/unpacked" -y
-    export DRMEMORY_COMMAND="$DRMEMORY_PATH/unpacked/bin/drmemory.exe"
-  fi
-fi
-
-PYTHONPATH=$THISDIR/../python/google python \
-           "$THISDIR/chrome_tests.py" $ARGV_COPY

diff --git a/tools/valgrind/locate_valgrind.sh b/tools/valgrind/locate_valgrind.sh
deleted file mode 100755
index a1e9bf2..0000000
--- a/tools/valgrind/locate_valgrind.sh
+++ /dev/null

@@ -1,69 +0,0 @@
-#!/bin/bash
-
-# Copyright (c) 2012 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-# Prints a path to Valgrind binaries to be used for Chromium.
-# Select the valgrind from third_party/valgrind by default,
-# but allow users to override this default without editing scripts and
-# without specifying a commandline option
-
-export THISDIR=`dirname $0`
-
-# User may use their own valgrind by giving its path with CHROME_VALGRIND env.
-if [ "$CHROME_VALGRIND" = "" ]
-then
-  # Guess which binaries we should use by uname
-  case "$(uname -a)" in
-  *Linux*x86_64*)
-    PLATFORM="linux_x64"
-    ;;
-  *Linux*86*)
-    PLATFORM="linux_x86"
-    ;;
-  *Darwin*9.[678].[01]*i386*)
-    # Didn't test other kernels.
-    PLATFORM="mac"
-    ;;
-  *Darwin*10.[0-9].[0-9]*i386*)
-    PLATFORM="mac_10.6"
-    ;;
-  *Darwin*10.[0-9].[0-9]*x86_64*)
-    PLATFORM="mac_10.6"
-    ;;
-  *Darwin*11.[0-9].[0-9]*x86_64*)
-    PLATFORM="mac_10.7"
-    ;;
-  *)
-    (echo "Sorry, your platform is not supported:" &&
-     uname -a
-     echo
-     echo "If you're on Mac OS X, please see http://crbug.com/441425") >&2
-    exit 42
-  esac
-
-  # The binaries should be in third_party/valgrind
-  # (checked out from deps/third_party/valgrind/binaries).
-  CHROME_VALGRIND="$THISDIR/../../third_party/valgrind/$PLATFORM"
-
-  # TODO(timurrrr): readlink -f is not present on Mac...
-  if [ "$PLATFORM" != "mac" ] && \
-    [ "$PLATFORM" != "mac_10.6" ] && \
-    [ "$PLATFORM" != "mac_10.7" ]
-  then
-    # Get rid of all "../" dirs
-    CHROME_VALGRIND=$(readlink -f $CHROME_VALGRIND)
-  fi
-fi
-
-if ! test -x $CHROME_VALGRIND/bin/valgrind
-then
-  echo "Oops, could not find Valgrind binaries in your checkout." >&2
-  echo "Please see" >&2
-  echo "  http://dev.chromium.org/developers/how-tos/using-valgrind/get-valgrind" >&2
-  echo "for the instructions on how to download pre-built binaries." >&2
-  exit 1
-fi
-
-echo $CHROME_VALGRIND

diff --git a/tools/valgrind/valgrind.gni b/tools/valgrind/valgrind.gni
deleted file mode 100644
index 84e8e42..0000000
--- a/tools/valgrind/valgrind.gni
+++ /dev/null

@@ -1,64 +0,0 @@
-# Copyright 2016 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-import("//build_overrides/build.gni")
-
-valgrind_dependencies = [
-  "asan/asan_symbolize.py",
-  "asan/third_party/__init__.py",
-  "asan/third_party/asan_symbolize.py",
-  "browser_wrapper_win.py",
-  "chrome_tests.bat",
-  "chrome_tests.py",
-  "chrome_tests.sh",
-  "common.py",
-  "drmemory.bat",
-  "drmemory_analyze.py",
-  "fixed_suppressions.sh",
-  "gdb_helper.py",
-  "locate_valgrind.sh",
-  "memcheck/suppressions.txt",
-  "memcheck/suppressions_linux.txt",
-  "memcheck_analyze.py",
-  "regrind.sh",
-  "scan-build.py",
-  "suppressions.py",
-  "test_suppressions.py",
-  "unused_suppressions.py",
-  "valgrind.sh",
-  "valgrind_test.py",
-  "waterfall.sh",
-]
-
-if (build_with_chromium) {
-  valgrind_dependencies += [
-    "gtest_exclude/ash_unittests.gtest-memcheck.txt",
-    "gtest_exclude/aura_unittests.gtest.txt",
-    "gtest_exclude/base_unittests.gtest.txt",
-    "gtest_exclude/base_unittests.gtest_win-8.txt",
-    "gtest_exclude/base_unittests.gtest_win32.txt",
-    "gtest_exclude/blink_platform_unittests.gtest_win32.txt",
-    "gtest_exclude/browser_tests.gtest-memcheck.txt",
-    "gtest_exclude/chromeos_unittests.gtest.txt",
-    "gtest_exclude/components_unittests.gtest.txt",
-    "gtest_exclude/content_unittests.gtest.txt",
-    "gtest_exclude/extensions_unittests.gtest-memcheck.txt",
-    "gtest_exclude/interactive_ui_tests.gtest.txt",
-    "gtest_exclude/ipc_tests.gtest.txt",
-    "gtest_exclude/media_unittests.gtest.txt",
-    "gtest_exclude/message_center_unittests.gtest.txt",
-    "gtest_exclude/net_unittests.gtest-memcheck.txt",
-    "gtest_exclude/net_unittests.gtest.txt",
-    "gtest_exclude/net_unittests.gtest_linux.txt",
-    "gtest_exclude/remoting_unittests.gtest_win-8.txt",
-    "gtest_exclude/sandbox_linux_unittests.gtest.txt",
-    "gtest_exclude/suppressions.txt",
-    "gtest_exclude/sync_unit_tests.gtest-asan.txt",
-    "gtest_exclude/ui_base_unittests.gtest-memcheck.txt",
-    "gtest_exclude/ui_unittests.gtest-memcheck_linux.txt",
-    "gtest_exclude/unit_tests.gtest-memcheck.txt",
-    "gtest_exclude/unit_tests.gtest.txt",
-    "gtest_exclude/unit_tests.gtest_linux.txt",
-  ]
-}

diff --git a/tools/valgrind/valgrind.sh b/tools/valgrind/valgrind.sh
deleted file mode 100755
index 59b4071..0000000
--- a/tools/valgrind/valgrind.sh
+++ /dev/null

@@ -1,106 +0,0 @@
-#!/bin/bash
-
-# Copyright (c) 2012 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-# This is a small script for manually launching valgrind, along with passing
-# it the suppression file, and some helpful arguments (automatically attaching
-# the debugger on failures, etc).  Run it from your repo root, something like:
-#  $ sh ./tools/valgrind/valgrind.sh ./out/Debug/chrome
-#
-# This is mostly intended for running the chrome browser interactively.
-# To run unit tests, you probably want to run chrome_tests.sh instead.
-# That's the script used by the valgrind buildbot.
-
-export THISDIR=`dirname $0`
-
-setup_memcheck() {
-  RUN_COMMAND="valgrind"
-
-  # Prompt to attach gdb when there was an error detected.
-  DEFAULT_TOOL_FLAGS=("--db-command=gdb -nw %f %p" "--db-attach=yes" \
-                      # Keep the registers in gdb in sync with the code.
-                      "--vex-iropt-register-updates=allregs-at-mem-access" \
-                      # Overwrite newly allocated or freed objects
-                      # with 0x41 to catch inproper use.
-                      "--malloc-fill=41" "--free-fill=41" \
-                      # Increase the size of stacks being tracked.
-                      "--num-callers=30")
-}
-
-setup_unknown() {
-  echo "Unknown tool \"$TOOL_NAME\" specified, the result is not guaranteed"
-  DEFAULT_TOOL_FLAGS=()
-}
-
-set -e
-
-if [ $# -eq 0 ]; then
-  echo "usage: <command to run> <arguments ...>"
-  exit 1
-fi
-
-TOOL_NAME="memcheck"
-declare -a DEFAULT_TOOL_FLAGS[0]
-
-# Select a tool different from memcheck with --tool=TOOL as a first argument
-TMP_STR=`echo $1 | sed 's/^\-\-tool=//'`
-if [ "$TMP_STR" != "$1" ]; then
-  TOOL_NAME="$TMP_STR"
-  shift
-fi
-
-if echo "$@" | grep "\-\-tool" ; then
-  echo "--tool=TOOL must be the first argument" >&2
-  exit 1
-fi
-
-case $TOOL_NAME in
-  memcheck*)  setup_memcheck "$1";;
-  *)          setup_unknown;;
-esac
-
-
-SUPPRESSIONS="$THISDIR/$TOOL_NAME/suppressions.txt"
-
-CHROME_VALGRIND=`sh $THISDIR/locate_valgrind.sh`
-if [ "$CHROME_VALGRIND" = "" ]
-then
-  # locate_valgrind.sh failed
-  exit 1
-fi
-echo "Using valgrind binaries from ${CHROME_VALGRIND}"
-
-set -x
-PATH="${CHROME_VALGRIND}/bin:$PATH"
-# We need to set these variables to override default lib paths hard-coded into
-# Valgrind binary.
-export VALGRIND_LIB="$CHROME_VALGRIND/lib/valgrind"
-export VALGRIND_LIB_INNER="$CHROME_VALGRIND/lib/valgrind"
-
-# G_SLICE=always-malloc: make glib use system malloc
-# NSS_DISABLE_UNLOAD=1: make nss skip dlclosing dynamically loaded modules,
-# which would result in "obj:*" in backtraces.
-# NSS_DISABLE_ARENA_FREE_LIST=1: make nss use system malloc
-# G_DEBUG=fatal_warnings: make  GTK abort on any critical or warning assertions.
-# If it crashes on you in the Options menu, you hit bug 19751,
-# comment out the G_DEBUG=fatal_warnings line.
-#
-# GTEST_DEATH_TEST_USE_FORK=1: make gtest death tests valgrind-friendly
-#
-# When everyone has the latest valgrind, we might want to add
-#  --show-possibly-lost=no
-# to ignore possible but not definite leaks.
-
-G_SLICE=always-malloc \
-NSS_DISABLE_UNLOAD=1 \
-NSS_DISABLE_ARENA_FREE_LIST=1 \
-G_DEBUG=fatal_warnings \
-GTEST_DEATH_TEST_USE_FORK=1 \
-$RUN_COMMAND \
-  --trace-children=yes \
-  --leak-check=yes \
-  --suppressions="$SUPPRESSIONS" \
-  "${DEFAULT_TOOL_FLAGS[@]}" \
-  "$@"

diff --git a/tools/valgrind/valgrind_test.py b/tools/valgrind/valgrind_test.py
deleted file mode 100644
index 8ef4830..0000000
--- a/tools/valgrind/valgrind_test.py
+++ /dev/null

@@ -1,846 +0,0 @@
-# Copyright (c) 2012 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-"""Runs an exe through Valgrind and puts the intermediate files in a
-directory.
-"""
-
-import datetime
-import glob
-import logging
-import optparse
-import os
-import re
-import shutil
-import stat
-import subprocess
-import sys
-import tempfile
-
-import common
-
-import drmemory_analyze
-import memcheck_analyze
-
-class BaseTool(object):
-  """Abstract class for running dynamic error detection tools.
-
-  Always subclass this and implement ToolCommand with framework- and
-  tool-specific stuff.
-  """
-
-  def __init__(self):
-    temp_parent_dir = None
-    self.log_parent_dir = ""
-    if common.IsWindows():
-      # gpu process on Windows Vista+ runs at Low Integrity and can only
-      # write to certain directories (http://crbug.com/119131)
-      #
-      # TODO(bruening): if scripts die in middle and don't clean up temp
-      # dir, we'll accumulate files in profile dir.  should remove
-      # really old files automatically.
-      profile = os.getenv("USERPROFILE")
-      if profile:
-        self.log_parent_dir = profile + "\\AppData\\LocalLow\\"
-        if os.path.exists(self.log_parent_dir):
-          self.log_parent_dir = common.NormalizeWindowsPath(self.log_parent_dir)
-          temp_parent_dir = self.log_parent_dir
-    # Generated every time (even when overridden)
-    self.temp_dir = tempfile.mkdtemp(prefix="vg_logs_", dir=temp_parent_dir)
-    self.log_dir = self.temp_dir # overridable by --keep_logs
-    self.option_parser_hooks = []
-    # TODO(glider): we may not need some of the env vars on some of the
-    # platforms.
-    self._env = {
-      "G_SLICE" : "always-malloc",
-      "NSS_DISABLE_UNLOAD" : "1",
-      "NSS_DISABLE_ARENA_FREE_LIST" : "1",
-      "GTEST_DEATH_TEST_USE_FORK": "1",
-    }
-
-  def ToolName(self):
-    raise NotImplementedError, "This method should be implemented " \
-                               "in the tool-specific subclass"
-
-  def Analyze(self, check_sanity=False):
-    raise NotImplementedError, "This method should be implemented " \
-                               "in the tool-specific subclass"
-
-  def RegisterOptionParserHook(self, hook):
-    # Frameworks and tools can add their own flags to the parser.
-    self.option_parser_hooks.append(hook)
-
-  def CreateOptionParser(self):
-    # Defines Chromium-specific flags.
-    self._parser = optparse.OptionParser("usage: %prog [options] <program to "
-                                         "test>")
-    self._parser.disable_interspersed_args()
-    self._parser.add_option("-t", "--timeout",
-                      dest="timeout", metavar="TIMEOUT", default=10000,
-                      help="timeout in seconds for the run (default 10000)")
-    self._parser.add_option("", "--build-dir",
-                            help="the location of the compiler output")
-    self._parser.add_option("", "--source-dir",
-                            help="path to top of source tree for this build"
-                                 "(used to normalize source paths in baseline)")
-    self._parser.add_option("", "--gtest_filter", default="",
-                            help="which test case to run")
-    self._parser.add_option("", "--gtest_repeat",
-                            help="how many times to run each test")
-    self._parser.add_option("", "--gtest_print_time", action="store_true",
-                            default=False,
-                            help="show how long each test takes")
-    self._parser.add_option("", "--ignore_exit_code", action="store_true",
-                            default=False,
-                            help="ignore exit code of the test "
-                                 "(e.g. test failures)")
-    self._parser.add_option("", "--keep_logs", action="store_true",
-                            default=False,
-                            help="store memory tool logs in the <tool>.logs "
-                                 "directory instead of /tmp.\nThis can be "
-                                 "useful for tool developers/maintainers.\n"
-                                 "Please note that the <tool>.logs directory "
-                                 "will be clobbered on tool startup.")
-
-    # To add framework- or tool-specific flags, please add a hook using
-    # RegisterOptionParserHook in the corresponding subclass.
-    # See ValgrindTool for an example.
-    for hook in self.option_parser_hooks:
-      hook(self, self._parser)
-
-  def ParseArgv(self, args):
-    self.CreateOptionParser()
-
-    # self._tool_flags will store those tool flags which we don't parse
-    # manually in this script.
-    self._tool_flags = []
-    known_args = []
-
-    """ We assume that the first argument not starting with "-" is a program
-    name and all the following flags should be passed to the program.
-    TODO(timurrrr): customize optparse instead
-    """
-    while len(args) > 0 and args[0][:1] == "-":
-      arg = args[0]
-      if (arg == "--"):
-        break
-      if self._parser.has_option(arg.split("=")[0]):
-        known_args += [arg]
-      else:
-        self._tool_flags += [arg]
-      args = args[1:]
-
-    if len(args) > 0:
-      known_args += args
-
-    self._options, self._args = self._parser.parse_args(known_args)
-
-    self._timeout = int(self._options.timeout)
-    self._source_dir = self._options.source_dir
-    if self._options.keep_logs:
-      # log_parent_dir has trailing slash if non-empty
-      self.log_dir = self.log_parent_dir + "%s.logs" % self.ToolName()
-      if os.path.exists(self.log_dir):
-        shutil.rmtree(self.log_dir)
-      os.mkdir(self.log_dir)
-      logging.info("Logs are in " + self.log_dir)
-
-    self._ignore_exit_code = self._options.ignore_exit_code
-    if self._options.gtest_filter != "":
-      self._args.append("--gtest_filter=%s" % self._options.gtest_filter)
-    if self._options.gtest_repeat:
-      self._args.append("--gtest_repeat=%s" % self._options.gtest_repeat)
-    if self._options.gtest_print_time:
-      self._args.append("--gtest_print_time")
-
-    return True
-
-  def Setup(self, args):
-    return self.ParseArgv(args)
-
-  def ToolCommand(self):
-    raise NotImplementedError, "This method should be implemented " \
-                               "in the tool-specific subclass"
-
-  def Cleanup(self):
-    # You may override it in the tool-specific subclass
-    pass
-
-  def Execute(self):
-    """ Execute the app to be tested after successful instrumentation.
-    Full execution command-line provided by subclassers via proc."""
-    logging.info("starting execution...")
-    proc = self.ToolCommand()
-    for var in self._env:
-      common.PutEnvAndLog(var, self._env[var])
-    return common.RunSubprocess(proc, self._timeout)
-
-  def RunTestsAndAnalyze(self, check_sanity):
-    exec_retcode = self.Execute()
-    analyze_retcode = self.Analyze(check_sanity)
-
-    if analyze_retcode:
-      logging.error("Analyze failed.")
-      logging.info("Search the log for '[ERROR]' to see the error reports.")
-      return analyze_retcode
-
-    if exec_retcode:
-      if self._ignore_exit_code:
-        logging.info("Test execution failed, but the exit code is ignored.")
-      else:
-        logging.error("Test execution failed.")
-        return exec_retcode
-    else:
-      logging.info("Test execution completed successfully.")
-
-    if not analyze_retcode:
-      logging.info("Analysis completed successfully.")
-
-    return 0
-
-  def Main(self, args, check_sanity, min_runtime_in_seconds):
-    """Call this to run through the whole process: Setup, Execute, Analyze"""
-    start_time = datetime.datetime.now()
-    retcode = -1
-    if self.Setup(args):
-      retcode = self.RunTestsAndAnalyze(check_sanity)
-      shutil.rmtree(self.temp_dir, ignore_errors=True)
-      self.Cleanup()
-    else:
-      logging.error("Setup failed")
-    end_time = datetime.datetime.now()
-    runtime_in_seconds = (end_time - start_time).seconds
-    hours = runtime_in_seconds / 3600
-    seconds = runtime_in_seconds % 3600
-    minutes = seconds / 60
-    seconds = seconds % 60
-    logging.info("elapsed time: %02d:%02d:%02d" % (hours, minutes, seconds))
-    if (min_runtime_in_seconds > 0 and
-        runtime_in_seconds < min_runtime_in_seconds):
-      logging.error("Layout tests finished too quickly. "
-                    "It should have taken at least %d seconds. "
-                    "Something went wrong?" % min_runtime_in_seconds)
-      retcode = -1
-    return retcode
-
-  def Run(self, args, module, min_runtime_in_seconds=0):
-    MODULES_TO_SANITY_CHECK = ["base"]
-
-    check_sanity = module in MODULES_TO_SANITY_CHECK
-    return self.Main(args, check_sanity, min_runtime_in_seconds)
-
-
-class ValgrindTool(BaseTool):
-  """Abstract class for running Valgrind tools.
-
-  Always subclass this and implement ToolSpecificFlags() and
-  ExtendOptionParser() for tool-specific stuff.
-  """
-  def __init__(self):
-    super(ValgrindTool, self).__init__()
-    self.RegisterOptionParserHook(ValgrindTool.ExtendOptionParser)
-
-  def UseXML(self):
-    # Override if tool prefers nonxml output
-    return True
-
-  def ExtendOptionParser(self, parser):
-    parser.add_option("", "--suppressions", default=[],
-                            action="append",
-                            help="path to a valgrind suppression file")
-    parser.add_option("", "--indirect", action="store_true",
-                            default=False,
-                            help="set BROWSER_WRAPPER rather than "
-                                 "running valgrind directly")
-    parser.add_option("", "--indirect_webkit_layout", action="store_true",
-                            default=False,
-                            help="set --wrapper rather than running Dr. Memory "
-                                 "directly.")
-    parser.add_option("", "--trace_children", action="store_true",
-                            default=False,
-                            help="also trace child processes")
-    parser.add_option("", "--num-callers",
-                            dest="num_callers", default=30,
-                            help="number of callers to show in stack traces")
-    parser.add_option("", "--generate_dsym", action="store_true",
-                          default=False,
-                          help="Generate .dSYM file on Mac if needed. Slow!")
-
-  def Setup(self, args):
-    if not BaseTool.Setup(self, args):
-      return False
-    if common.IsMac():
-      self.PrepareForTestMac()
-    return True
-
-  def PrepareForTestMac(self):
-    """Runs dsymutil if needed.
-
-    Valgrind for Mac OS X requires that debugging information be in a .dSYM
-    bundle generated by dsymutil.  It is not currently able to chase DWARF
-    data into .o files like gdb does, so executables without .dSYM bundles or
-    with the Chromium-specific "fake_dsym" bundles generated by
-    build/mac/strip_save_dsym won't give source file and line number
-    information in valgrind.
-
-    This function will run dsymutil if the .dSYM bundle is missing or if
-    it looks like a fake_dsym.  A non-fake dsym that already exists is assumed
-    to be up to date.
-    """
-    test_command = self._args[0]
-    dsym_bundle = self._args[0] + '.dSYM'
-    dsym_file = os.path.join(dsym_bundle, 'Contents', 'Resources', 'DWARF',
-                             os.path.basename(test_command))
-    dsym_info_plist = os.path.join(dsym_bundle, 'Contents', 'Info.plist')
-
-    needs_dsymutil = True
-    saved_test_command = None
-
-    if os.path.exists(dsym_file) and os.path.exists(dsym_info_plist):
-      # Look for the special fake_dsym tag in dsym_info_plist.
-      dsym_info_plist_contents = open(dsym_info_plist).read()
-
-      if not re.search('^\s*<key>fake_dsym</key>$', dsym_info_plist_contents,
-                       re.MULTILINE):
-        # fake_dsym is not set, this is a real .dSYM bundle produced by
-        # dsymutil.  dsymutil does not need to be run again.
-        needs_dsymutil = False
-      else:
-        # fake_dsym is set.  dsym_file is a copy of the original test_command
-        # before it was stripped.  Copy it back to test_command so that
-        # dsymutil has unstripped input to work with.  Move the stripped
-        # test_command out of the way, it will be restored when this is
-        # done.
-        saved_test_command = test_command + '.stripped'
-        os.rename(test_command, saved_test_command)
-        shutil.copyfile(dsym_file, test_command)
-        shutil.copymode(saved_test_command, test_command)
-
-    if needs_dsymutil:
-      if self._options.generate_dsym:
-        # Remove the .dSYM bundle if it exists.
-        shutil.rmtree(dsym_bundle, True)
-
-        dsymutil_command = ['dsymutil', test_command]
-
-        # dsymutil is crazy slow.  Ideally we'd have a timeout here,
-        # but common.RunSubprocess' timeout is only checked
-        # after each line of output; dsymutil is silent
-        # until the end, and is then killed, which is silly.
-        common.RunSubprocess(dsymutil_command)
-
-        if saved_test_command:
-          os.rename(saved_test_command, test_command)
-      else:
-        logging.info("No real .dSYM for test_command.  Line numbers will "
-                     "not be shown.  Either tell xcode to generate .dSYM "
-                     "file, or use --generate_dsym option to this tool.")
-
-  def ToolCommand(self):
-    """Get the valgrind command to run."""
-    # Note that self._args begins with the exe to be run.
-    tool_name = self.ToolName()
-
-    # Construct the valgrind command.
-    if 'CHROME_VALGRIND' in os.environ:
-      path = os.path.join(os.environ['CHROME_VALGRIND'], "bin", "valgrind")
-    else:
-      path = "valgrind"
-    proc = [path, "--tool=%s" % tool_name]
-
-    proc += ["--num-callers=%i" % int(self._options.num_callers)]
-
-    if self._options.trace_children:
-      proc += ["--trace-children=yes"]
-      proc += ["--trace-children-skip='*dbus-daemon*'"]
-      proc += ["--trace-children-skip='*dbus-launch*'"]
-      proc += ["--trace-children-skip='*perl*'"]
-      proc += ["--trace-children-skip='*python*'"]
-      # This is really Python, but for some reason Valgrind follows it.
-      proc += ["--trace-children-skip='*lsb_release*'"]
-
-    proc += self.ToolSpecificFlags()
-    proc += self._tool_flags
-
-    suppression_count = 0
-    for suppression_file in self._options.suppressions:
-      if os.path.exists(suppression_file):
-        suppression_count += 1
-        proc += ["--suppressions=%s" % suppression_file]
-
-    if not suppression_count:
-      logging.warning("WARNING: NOT USING SUPPRESSIONS!")
-
-    logfilename = self.log_dir + ("/%s." % tool_name) + "%p"
-    if self.UseXML():
-      proc += ["--xml=yes", "--xml-file=" + logfilename]
-    else:
-      proc += ["--log-file=" + logfilename]
-
-    # The Valgrind command is constructed.
-
-    # Handle --indirect_webkit_layout separately.
-    if self._options.indirect_webkit_layout:
-      # Need to create the wrapper before modifying |proc|.
-      wrapper = self.CreateBrowserWrapper(proc, webkit=True)
-      proc = self._args
-      proc.append("--wrapper")
-      proc.append(wrapper)
-      return proc
-
-    if self._options.indirect:
-      wrapper = self.CreateBrowserWrapper(proc)
-      os.environ["BROWSER_WRAPPER"] = wrapper
-      logging.info('export BROWSER_WRAPPER=' + wrapper)
-      proc = []
-    proc += self._args
-    return proc
-
-  def ToolSpecificFlags(self):
-    raise NotImplementedError, "This method should be implemented " \
-                               "in the tool-specific subclass"
-
-  def CreateBrowserWrapper(self, proc, webkit=False):
-    """The program being run invokes Python or something else that can't stand
-    to be valgrinded, and also invokes the Chrome browser. In this case, use a
-    magic wrapper to only valgrind the Chrome browser. Build the wrapper here.
-    Returns the path to the wrapper. It's up to the caller to use the wrapper
-    appropriately.
-    """
-    command = " ".join(proc)
-    # Add the PID of the browser wrapper to the logfile names so we can
-    # separate log files for different UI tests at the analyze stage.
-    command = command.replace("%p", "$$.%p")
-
-    (fd, indirect_fname) = tempfile.mkstemp(dir=self.log_dir,
-                                            prefix="browser_wrapper.",
-                                            text=True)
-    f = os.fdopen(fd, "w")
-    f.write('#!/bin/bash\n'
-            'echo "Started Valgrind wrapper for this test, PID=$$" >&2\n')
-
-    f.write('DIR=`dirname $0`\n'
-            'TESTNAME_FILE=$DIR/testcase.$$.name\n\n')
-
-    if webkit:
-      # Webkit layout_tests pass the URL as the first line of stdin.
-      f.write('tee $TESTNAME_FILE | %s "$@"\n' % command)
-    else:
-      # Try to get the test case name by looking at the program arguments.
-      # i.e. Chromium ui_tests used --test-name arg.
-      # TODO(timurrrr): This doesn't handle "--test-name Test.Name"
-      # TODO(timurrrr): ui_tests are dead. Where do we use the non-webkit
-      # wrapper now? browser_tests? What do they do?
-      f.write('for arg in $@\ndo\n'
-              '  if [[ "$arg" =~ --test-name=(.*) ]]\n  then\n'
-              '    echo ${BASH_REMATCH[1]} >$TESTNAME_FILE\n'
-              '  fi\n'
-              'done\n\n'
-              '%s "$@"\n' % command)
-
-    f.close()
-    os.chmod(indirect_fname, stat.S_IRUSR|stat.S_IXUSR)
-    return indirect_fname
-
-  def CreateAnalyzer(self):
-    raise NotImplementedError, "This method should be implemented " \
-                               "in the tool-specific subclass"
-
-  def GetAnalyzeResults(self, check_sanity=False):
-    # Glob all the files in the log directory
-    filenames = glob.glob(self.log_dir + "/" + self.ToolName() + ".*")
-
-    # If we have browser wrapper, the logfiles are named as
-    # "toolname.wrapper_PID.valgrind_PID".
-    # Let's extract the list of wrapper_PIDs and name it ppids
-    ppids = set([int(f.split(".")[-2]) \
-                for f in filenames if re.search("\.[0-9]+\.[0-9]+$", f)])
-
-    analyzer = self.CreateAnalyzer()
-    if len(ppids) == 0:
-      # Fast path - no browser wrapper was set.
-      return analyzer.Report(filenames, None, check_sanity)
-
-    ret = 0
-    for ppid in ppids:
-      testcase_name = None
-      try:
-        f = open(self.log_dir + ("/testcase.%d.name" % ppid))
-        testcase_name = f.read().strip()
-        f.close()
-        wk_layout_prefix="third_party/WebKit/LayoutTests/"
-        wk_prefix_at = testcase_name.rfind(wk_layout_prefix)
-        if wk_prefix_at != -1:
-          testcase_name = testcase_name[wk_prefix_at + len(wk_layout_prefix):]
-      except IOError:
-        pass
-      print "====================================================="
-      print " Below is the report for valgrind wrapper PID=%d." % ppid
-      if testcase_name:
-        print " It was used while running the `%s` test." % testcase_name
-      else:
-        print " You can find the corresponding test"
-        print " by searching the above log for 'PID=%d'" % ppid
-      sys.stdout.flush()
-
-      ppid_filenames = [f for f in filenames \
-                        if re.search("\.%d\.[0-9]+$" % ppid, f)]
-      # check_sanity won't work with browser wrappers
-      assert check_sanity == False
-      ret |= analyzer.Report(ppid_filenames, testcase_name)
-      print "====================================================="
-      sys.stdout.flush()
-
-    if ret != 0:
-      print ""
-      print "The Valgrind reports are grouped by test names."
-      print "Each test has its PID printed in the log when the test was run"
-      print "and at the beginning of its Valgrind report."
-      print "Hint: you can search for the reports by Ctrl+F -> `=#`"
-      sys.stdout.flush()
-
-    return ret
-
-
-# TODO(timurrrr): Split into a separate file.
-class Memcheck(ValgrindTool):
-  """Memcheck
-  Dynamic memory error detector for Linux & Mac
-
-  http://valgrind.org/info/tools.html#memcheck
-  """
-
-  def __init__(self):
-    super(Memcheck, self).__init__()
-    self.RegisterOptionParserHook(Memcheck.ExtendOptionParser)
-
-  def ToolName(self):
-    return "memcheck"
-
-  def ExtendOptionParser(self, parser):
-    parser.add_option("--leak-check", "--leak_check", type="string",
-                      default="yes",  # --leak-check=yes is equivalent of =full
-                      help="perform leak checking at the end of the run")
-    parser.add_option("", "--show_all_leaks", action="store_true",
-                      default=False,
-                      help="also show less blatant leaks")
-    parser.add_option("", "--track_origins", action="store_true",
-                      default=False,
-                      help="Show whence uninitialized bytes came. 30% slower.")
-
-  def ToolSpecificFlags(self):
-    ret = ["--gen-suppressions=all", "--demangle=no"]
-    ret += ["--leak-check=%s" % self._options.leak_check]
-
-    if self._options.show_all_leaks:
-      ret += ["--show-reachable=yes"]
-    else:
-      ret += ["--show-possibly-lost=no"]
-
-    if self._options.track_origins:
-      ret += ["--track-origins=yes"]
-
-    # TODO(glider): this is a temporary workaround for http://crbug.com/51716
-    # Let's see whether it helps.
-    if common.IsMac():
-      ret += ["--smc-check=all"]
-
-    return ret
-
-  def CreateAnalyzer(self):
-    use_gdb = common.IsMac()
-    return memcheck_analyze.MemcheckAnalyzer(self._source_dir,
-                                            self._options.show_all_leaks,
-                                            use_gdb=use_gdb)
-
-  def Analyze(self, check_sanity=False):
-    ret = self.GetAnalyzeResults(check_sanity)
-
-    if ret != 0:
-      logging.info("Please see http://dev.chromium.org/developers/how-tos/"
-                   "using-valgrind for the info on Memcheck/Valgrind")
-    return ret
-
-
-class DrMemory(BaseTool):
-  """Dr.Memory
-  Dynamic memory error detector for Windows.
-
-  http://dev.chromium.org/developers/how-tos/using-drmemory
-  It is not very mature at the moment, some things might not work properly.
-  """
-
-  def __init__(self, full_mode, pattern_mode):
-    super(DrMemory, self).__init__()
-    self.full_mode = full_mode
-    self.pattern_mode = pattern_mode
-    self.RegisterOptionParserHook(DrMemory.ExtendOptionParser)
-
-  def ToolName(self):
-    return "drmemory"
-
-  def ExtendOptionParser(self, parser):
-    parser.add_option("", "--suppressions", default=[],
-                      action="append",
-                      help="path to a drmemory suppression file")
-    parser.add_option("", "--follow_python", action="store_true",
-                      default=False, dest="follow_python",
-                      help="Monitor python child processes.  If off, neither "
-                      "python children nor any children of python children "
-                      "will be monitored.")
-    parser.add_option("", "--indirect", action="store_true",
-                      default=False,
-                      help="set BROWSER_WRAPPER rather than "
-                           "running Dr. Memory directly on the harness")
-    parser.add_option("", "--indirect_webkit_layout", action="store_true",
-                      default=False,
-                      help="set --wrapper rather than running valgrind "
-                      "directly.")
-    parser.add_option("", "--use_debug", action="store_true",
-                      default=False, dest="use_debug",
-                      help="Run Dr. Memory debug build")
-    parser.add_option("", "--trace_children", action="store_true",
-                      default=True,
-                      help="TODO: default value differs from Valgrind")
-    parser.add_option("", "--drmemory_ops",
-                      help="Extra options passed to Dr. Memory")
-
-  def ToolCommand(self):
-    """Get the tool command to run."""
-    # WINHEAP is what Dr. Memory supports as there are issues w/ both
-    # jemalloc (https://github.com/DynamoRIO/drmemory/issues/320) and
-    # tcmalloc (https://github.com/DynamoRIO/drmemory/issues/314)
-    add_env = {
-      "CHROME_ALLOCATOR" : "WINHEAP",
-      "JSIMD_FORCEMMX"   : "1",  # https://github.com/DynamoRIO/drmemory/issues/540
-    }
-    for k,v in add_env.iteritems():
-      logging.info("export %s=%s", k, v)
-      os.putenv(k, v)
-
-    drmem_cmd = os.getenv("DRMEMORY_COMMAND")
-    if not drmem_cmd:
-      raise RuntimeError, "Please set DRMEMORY_COMMAND environment variable " \
-                          "with the path to drmemory.exe"
-    proc = drmem_cmd.split(" ")
-
-    # By default, don't run python (this will exclude python's children as well)
-    # to reduce runtime.  We're not really interested in spending time finding
-    # bugs in the python implementation.
-    # With file-based config we must update the file every time, and
-    # it will affect simultaneous drmem uses by this user.  While file-based
-    # config has many advantages, here we may want this-instance-only
-    # (https://github.com/DynamoRIO/drmemory/issues/334).
-    drconfig_cmd = [ proc[0].replace("drmemory.exe", "drconfig.exe") ]
-    drconfig_cmd += ["-quiet"] # suppress errors about no 64-bit libs
-    run_drconfig = True
-    if self._options.follow_python:
-      logging.info("Following python children")
-      # -unreg fails if not already registered so query for that first
-      query_cmd = drconfig_cmd + ["-isreg", "python.exe"]
-      query_proc = subprocess.Popen(query_cmd, stdout=subprocess.PIPE,
-                                    shell=True)
-      (query_out, query_err) = query_proc.communicate()
-      if re.search("exe not registered", query_out):
-        run_drconfig = False # all set
-      else:
-        drconfig_cmd += ["-unreg", "python.exe"]
-    else:
-      logging.info("Excluding python children")
-      drconfig_cmd += ["-reg", "python.exe", "-norun"]
-    if run_drconfig:
-      drconfig_retcode = common.RunSubprocess(drconfig_cmd, self._timeout)
-      if drconfig_retcode:
-        logging.error("Configuring whether to follow python children failed " \
-                      "with %d.", drconfig_retcode)
-        raise RuntimeError, "Configuring python children failed "
-
-    suppression_count = 0
-    supp_files = self._options.suppressions
-    if self.full_mode:
-      supp_files += [s.replace(".txt", "_full.txt") for s in supp_files]
-    for suppression_file in supp_files:
-      if os.path.exists(suppression_file):
-        suppression_count += 1
-        proc += ["-suppress", common.NormalizeWindowsPath(suppression_file)]
-
-    if not suppression_count:
-      logging.warning("WARNING: NOT USING SUPPRESSIONS!")
-
-    # Un-comment to dump Dr.Memory events on error
-    #proc += ["-dr_ops", "-dumpcore_mask", "-dr_ops", "0x8bff"]
-
-    # Un-comment and comment next line to debug Dr.Memory
-    #proc += ["-dr_ops", "-no_hide"]
-    #proc += ["-dr_ops", "-msgbox_mask", "-dr_ops", "15"]
-    #Proc += ["-dr_ops", "-stderr_mask", "-dr_ops", "15"]
-    # Ensure we see messages about Dr. Memory crashing!
-    proc += ["-dr_ops", "-stderr_mask", "-dr_ops", "12"]
-
-    if self._options.use_debug:
-      proc += ["-debug"]
-
-    proc += ["-logdir", common.NormalizeWindowsPath(self.log_dir)]
-
-    if self.log_parent_dir:
-      # gpu process on Windows Vista+ runs at Low Integrity and can only
-      # write to certain directories (http://crbug.com/119131)
-      symcache_dir = os.path.join(self.log_parent_dir, "drmemory.symcache")
-    elif self._options.build_dir:
-      # The other case is only possible with -t cmdline.
-      # Anyways, if we omit -symcache_dir the -logdir's value is used which
-      # should be fine.
-      symcache_dir = os.path.join(self._options.build_dir, "drmemory.symcache")
-    if symcache_dir:
-      if not os.path.exists(symcache_dir):
-        try:
-          os.mkdir(symcache_dir)
-        except OSError:
-          logging.warning("Can't create symcache dir?")
-      if os.path.exists(symcache_dir):
-        proc += ["-symcache_dir", common.NormalizeWindowsPath(symcache_dir)]
-
-    # Use -no_summary to suppress DrMemory's summary and init-time
-    # notifications.  We generate our own with drmemory_analyze.py.
-    proc += ["-batch", "-no_summary"]
-
-    # Un-comment to disable interleaved output.  Will also suppress error
-    # messages normally printed to stderr.
-    #proc += ["-quiet", "-no_results_to_stderr"]
-
-    proc += ["-callstack_max_frames", "40"]
-
-    # disable leak scan for now
-    proc += ["-no_count_leaks", "-no_leak_scan"]
-
-    # disable warnings about unaddressable prefetches
-    proc += ["-no_check_prefetch"]
-
-    # crbug.com/413215, no heap mismatch check for Windows release build binary
-    if common.IsWindows() and "Release" in self._options.build_dir:
-        proc += ["-no_check_delete_mismatch"]
-
-    # We are seeing false positive invalid heap args on 64-bit, so we are
-    # disabling the feature for now (xref
-    # https://github.com/DynamoRIO/drmemory/issues/1839).
-    if common.IsWindows() and "Release_x64" in self._options.build_dir:
-        proc += ["-no_check_heap_mismatch"]
-
-    # make callstacks easier to read
-    proc += ["-callstack_srcfile_prefix",
-             "build\\src,chromium\\src,crt_build\\self_x86"]
-    proc += ["-callstack_modname_hide",
-             "*drmemory*,chrome.dll"]
-
-    boring_callers = common.BoringCallers(mangled=False, use_re_wildcards=False)
-    # TODO(timurrrr): In fact, we want "starting from .." instead of "below .."
-    proc += ["-callstack_truncate_below", ",".join(boring_callers)]
-
-    # crbug.com/155839: extra Dr. Memory options passed via --drmemory_ops
-    if self._options.drmemory_ops:
-      proc.extend(self._options.drmemory_ops.split())
-
-    if self.pattern_mode:
-      proc += ["-pattern", "0xf1fd", "-no_count_leaks", "-redzone_size", "0x20"]
-    elif not self.full_mode:
-      proc += ["-light"]
-
-    proc += self._tool_flags
-
-    # Dr.Memory requires -- to separate tool flags from the executable name.
-    proc += ["--"]
-
-    if self._options.indirect or self._options.indirect_webkit_layout:
-      wrapper_path = os.path.join(self._source_dir,
-                                  "tools", "valgrind", "browser_wrapper_win.py")
-      wrapper = " ".join(["python", wrapper_path] + proc)
-      self.CreateBrowserWrapper(wrapper)
-      logging.info("browser wrapper = " + " ".join(proc))
-      if self._options.indirect_webkit_layout:
-        proc = self._args
-        # Layout tests want forward slashes.
-        wrapper = wrapper.replace('\\', '/')
-        proc += ["--wrapper", wrapper]
-        return proc
-      else:
-        proc = []
-
-    # Note that self._args begins with the name of the exe to be run.
-    self._args[0] = common.NormalizeWindowsPath(self._args[0])
-    proc += self._args
-    return proc
-
-  def CreateBrowserWrapper(self, command):
-    os.putenv("BROWSER_WRAPPER", command)
-
-  def Analyze(self, check_sanity=False):
-    # Use one analyzer for all the log files to avoid printing duplicate reports
-    #
-    # TODO(timurrrr): unify this with Valgrind and other tools when we have
-    # https://github.com/DynamoRIO/drmemory/issues/684
-    analyzer = drmemory_analyze.DrMemoryAnalyzer()
-
-    ret = 0
-    if not self._options.indirect and not self._options.indirect_webkit_layout:
-      filenames = glob.glob(self.log_dir + "/*/results.txt")
-
-      ret = analyzer.Report(filenames, None, check_sanity)
-    else:
-      testcases = glob.glob(self.log_dir + "/testcase.*.logs")
-      # If we have browser wrapper, the per-test logdirs are named as
-      # "testcase.wrapper_PID.name".
-      # Let's extract the list of wrapper_PIDs and name it ppids.
-      # NOTE: ppids may contain '_', i.e. they are not ints!
-      ppids = set([f.split(".")[-2] for f in testcases])
-
-      for ppid in ppids:
-        testcase_name = None
-        try:
-          f = open("%s/testcase.%s.name" % (self.log_dir, ppid))
-          testcase_name = f.read().strip()
-          f.close()
-        except IOError:
-          pass
-        print "====================================================="
-        print " Below is the report for drmemory wrapper PID=%s." % ppid
-        if testcase_name:
-          print " It was used while running the `%s` test." % testcase_name
-        else:
-          # TODO(timurrrr): hm, the PID line is suppressed on Windows...
-          print " You can find the corresponding test"
-          print " by searching the above log for 'PID=%s'" % ppid
-        sys.stdout.flush()
-        ppid_filenames = glob.glob("%s/testcase.%s.logs/*/results.txt" %
-                                   (self.log_dir, ppid))
-        ret |= analyzer.Report(ppid_filenames, testcase_name, False)
-        print "====================================================="
-        sys.stdout.flush()
-
-    logging.info("Please see http://dev.chromium.org/developers/how-tos/"
-                 "using-drmemory for the info on Dr. Memory")
-    return ret
-
-
-class ToolFactory:
-  def Create(self, tool_name):
-    if tool_name == "memcheck":
-      return Memcheck()
-    if tool_name == "drmemory" or tool_name == "drmemory_light":
-      # TODO(timurrrr): remove support for "drmemory" when buildbots are
-      # switched to drmemory_light OR make drmemory==drmemory_full the default
-      # mode when the tool is mature enough.
-      return DrMemory(False, False)
-    if tool_name == "drmemory_full":
-      return DrMemory(True, False)
-    if tool_name == "drmemory_pattern":
-      return DrMemory(False, True)
-    try:
-      platform_name = common.PlatformNames()[0]
-    except common.NotImplementedError:
-      platform_name = sys.platform + "(Unknown)"
-    raise RuntimeError, "Unknown tool (tool=%s, platform=%s)" % (tool_name,
-                                                                 platform_name)
-
-def CreateTool(tool):
-  return ToolFactory().Create(tool)

diff --git a/ui/compositor/compositor.cc b/ui/compositor/compositor.cc
index f263927..e76925d 100644
--- a/ui/compositor/compositor.cc
+++ b/ui/compositor/compositor.cc

@@ -43,6 +43,7 @@
 #include "ui/compositor/layer_animator_collection.h"
 #include "ui/compositor/scoped_animation_duration_scale_mode.h"
 #include "ui/display/display_switches.h"
+#include "ui/gfx/color_space_switches.h"
 #include "ui/gfx/icc_profile.h"
 #include "ui/gfx/switches.h"
 #include "ui/gl/gl_switches.h"

diff --git a/ui/compositor/compositor_util.cc b/ui/compositor/compositor_util.cc
index 59631c6..20231eb 100644
--- a/ui/compositor/compositor_util.cc
+++ b/ui/compositor/compositor_util.cc

@@ -9,7 +9,7 @@
 #include "cc/output/renderer_settings.h"
 #include "ui/compositor/compositor_switches.h"
 #include "ui/display/display_switches.h"
-#include "ui/gfx/switches.h"
+#include "ui/gfx/color_space_switches.h"
 
 namespace ui {
 

diff --git a/ui/display/mac/screen_mac.mm b/ui/display/mac/screen_mac.mm
index 0340aef..d74ab25c 100644
--- a/ui/display/mac/screen_mac.mm
+++ b/ui/display/mac/screen_mac.mm

@@ -19,8 +19,8 @@
 #include "base/timer/timer.h"
 #include "ui/display/display.h"
 #include "ui/display/display_change_notifier.h"
+#include "ui/gfx/color_space_switches.h"
 #include "ui/gfx/mac/coordinate_conversion.h"
-#include "ui/gfx/switches.h"
 
 extern "C" {
 Boolean CGDisplayUsesForceToGray(void);

diff --git a/ui/gfx/BUILD.gn b/ui/gfx/BUILD.gn
index cf8e1d3..278bd5f 100644
--- a/ui/gfx/BUILD.gn
+++ b/ui/gfx/BUILD.gn

@@ -54,8 +54,6 @@
     "color_analysis.cc",
     "color_analysis.h",
     "color_palette.h",
-    "color_space_win.cc",
-    "color_space_win.h",
     "color_transform.cc",
     "color_transform.h",
     "color_utils.cc",
@@ -88,9 +86,6 @@
     "gfx_paths.h",
     "half_float.cc",
     "half_float.h",
-    "icc_profile_mac.mm",
-    "icc_profile_win.cc",
-    "icc_profile_x11.cc",
     "icon_util.cc",
     "icon_util.h",
     "image/image.cc",
@@ -237,10 +232,10 @@
   public_deps = [
     ":color_space",
     ":geometry_skia",
+    ":gfx_switches",
     ":memory_buffer_sources",
     ":native_widget_types",
     ":selection_bound_sources",
-    ":switches_sources",
     "//base",
     "//skia",
     "//third_party/icu",
@@ -387,10 +382,7 @@
     deps += [ "//ui/gfx/x" ]
     configs += [ "//build/config/linux:x11" ]
   } else {
-    sources -= [
-      "icc_profile_x11.cc",
-      "path_x11.cc",
-    ]
+    sources -= [ "path_x11.cc" ]
   }
 
   if (use_cairo) {
@@ -402,22 +394,37 @@
   sources = [
     "color_space.cc",
     "color_space.h",
+    "color_space_export.h",
+    "color_space_win.cc",
+    "color_space_win.h",
     "icc_profile.cc",
     "icc_profile.h",
+    "icc_profile_mac.mm",
+    "icc_profile_win.cc",
+    "icc_profile_x11.cc",
     "skia_color_space_util.cc",
     "skia_color_space_util.h",
   ]
   public_deps = [
-    ":gfx_export",
+    ":gfx_switches",
     "//base",
     "//skia",
   ]
-  deps = [
-    ":switches_sources",
-    "//base",
-    "//skia",
-  ]
-  defines = [ "GFX_IMPLEMENTATION" ]
+  if (is_mac) {
+    libs = [
+      "CoreFoundation.framework",
+      "CoreGraphics.framework",
+    ]
+  }
+  if (use_x11) {
+    deps = [
+      "//ui/gfx/x",
+    ]
+    configs += [ "//build/config/linux:x11" ]
+  } else {
+    sources -= [ "icc_profile_x11.cc" ]
+  }
+  defines = [ "COLOR_SPACE_IMPLEMENTATION" ]
 }
 
 # Depend on this to use half_float.h without pulling in all of gfx.
@@ -529,8 +536,8 @@
   defines = [ "GFX_IMPLEMENTATION" ]
 
   deps = [
+    ":gfx_switches",
     ":native_widget_types",
-    ":switches_sources",
     "//base",
     "//ui/gfx/geometry",
   ]
@@ -547,18 +554,23 @@
   }
 }
 
-source_set("switches_sources") {
-  visibility = [ ":*" ]  # Depend on through ":switches_sources".
-
+# TODO(ccameron): This should not be a separate component. Once the flag for
+# color correct rendering is removed, color_space_switches.h may be moved
+# into color_space (since it will be included in fewer places), and once the
+# "best monitor color profile" function is removed, switches.h may be moved
+# back into its own source_set.
+component("gfx_switches") {
   sources = [
+    "color_space_switches.cc",
+    "color_space_switches.h",
     "switches.cc",
     "switches.h",
+    "switches_export.h",
   ]
 
-  defines = [ "GFX_IMPLEMENTATION" ]
+  defines = [ "GFX_SWITCHES_IMPLEMENTATION" ]
 
   deps = [
-    ":gfx_export",
     "//base",
   ]
 }

diff --git a/ui/gfx/color_space.h b/ui/gfx/color_space.h
index 35d3425..813d7d808 100644
--- a/ui/gfx/color_space.h
+++ b/ui/gfx/color_space.h

@@ -12,7 +12,7 @@
 #include "base/macros.h"
 #include "build/build_config.h"
 #include "third_party/skia/include/core/SkColorSpace.h"
-#include "ui/gfx/gfx_export.h"
+#include "ui/gfx/color_space_export.h"
 
 namespace IPC {
 template <class P>
@@ -26,7 +26,7 @@
 // Used to represet a color space for the purpose of color conversion.
 // This is designed to be safe and compact enough to send over IPC
 // between any processes.
-class GFX_EXPORT ColorSpace {
+class COLOR_SPACE_EXPORT ColorSpace {
  public:
   enum class PrimaryID : uint8_t {
     INVALID,
@@ -212,8 +212,8 @@
 };
 
 // Stream operator so ColorSpace can be used in assertion statements.
-GFX_EXPORT std::ostream& operator<<(std::ostream& out,
-                                    const ColorSpace& color_space);
+COLOR_SPACE_EXPORT std::ostream& operator<<(std::ostream& out,
+                                            const ColorSpace& color_space);
 
 }  // namespace gfx
 

diff --git a/ui/gfx/color_space_export.h b/ui/gfx/color_space_export.h
new file mode 100644
index 0000000..a0402b7
--- /dev/null
+++ b/ui/gfx/color_space_export.h

@@ -0,0 +1,29 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef UI_GFX_COLOR_SPACE_EXPORT_H_
+#define UI_GFX_COLOR_SPACE_EXPORT_H_
+
+#if defined(COMPONENT_BUILD)
+#if defined(WIN32)
+
+#if defined(COLOR_SPACE_IMPLEMENTATION)
+#define COLOR_SPACE_EXPORT __declspec(dllexport)
+#else
+#define COLOR_SPACE_EXPORT __declspec(dllimport)
+#endif  // defined(COLOR_SPACE_IMPLEMENTATION)
+
+#else  // defined(WIN32)
+#if defined(COLOR_SPACE_IMPLEMENTATION)
+#define COLOR_SPACE_EXPORT __attribute__((visibility("default")))
+#else
+#define COLOR_SPACE_EXPORT
+#endif
+#endif
+
+#else  // defined(COMPONENT_BUILD)
+#define COLOR_SPACE_EXPORT
+#endif
+
+#endif  // UI_GFX_COLOR_SPACE_EXPORT_H_

diff --git a/ui/gfx/color_space_switches.cc b/ui/gfx/color_space_switches.cc
new file mode 100644
index 0000000..33295ee
--- /dev/null
+++ b/ui/gfx/color_space_switches.cc

@@ -0,0 +1,19 @@
+// Copyright 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ui/gfx/color_space_switches.h"
+#include "build/build_config.h"
+
+namespace switches {
+
+// Convert rasterization and compositing inputs to the output color space
+// before operating on them.
+const char kEnableColorCorrectRendering[] = "enable-color-correct-rendering";
+
+// Force all monitors to be treated as though they have the specified color
+// profile. Accepted values are "srgb" and "generic-rgb" (currently used by Mac
+// layout tests) and "color-spin-gamma24" (used by layout tests).
+const char kForceColorProfile[] = "force-color-profile";
+
+}  // namespace switches

diff --git a/ui/gfx/color_space_switches.h b/ui/gfx/color_space_switches.h
new file mode 100644
index 0000000..904eca3
--- /dev/null
+++ b/ui/gfx/color_space_switches.h

@@ -0,0 +1,19 @@
+// Copyright 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef UI_GFX_COLOR_SPACE_SWITCHES_H_
+#define UI_GFX_COLOR_SPACE_SWITCHES_H_
+
+#include "build/build_config.h"
+#include "ui/gfx/switches_export.h"
+
+namespace switches {
+
+GFX_SWITCHES_EXPORT extern const char kEnableColorCorrectRendering[];
+
+GFX_SWITCHES_EXPORT extern const char kForceColorProfile[];
+
+}  // namespace switches
+
+#endif  // UI_GFX_COLOR_SPACE_SWITCHES_H_

diff --git a/ui/gfx/color_space_win.h b/ui/gfx/color_space_win.h
index af11c6e5..d02bca78 100644
--- a/ui/gfx/color_space_win.h
+++ b/ui/gfx/color_space_win.h

@@ -24,7 +24,7 @@
 
 namespace gfx {
 
-class GFX_EXPORT ColorSpaceWin {
+class COLOR_SPACE_EXPORT ColorSpaceWin {
  public:
   static DXVA2_ExtendedFormat GetExtendedFormat(const ColorSpace& color_space);
   static DXGI_COLOR_SPACE_TYPE GetDXGIColorSpace(const ColorSpace& color_space);

diff --git a/ui/gfx/icc_profile.cc b/ui/gfx/icc_profile.cc
index 723d062..a8d643d 100644
--- a/ui/gfx/icc_profile.cc
+++ b/ui/gfx/icc_profile.cc

@@ -12,8 +12,8 @@
 #include "base/synchronization/lock.h"
 #include "third_party/skia/include/core/SkColorSpaceXform.h"
 #include "third_party/skia/include/core/SkICC.h"
+#include "ui/gfx/color_space_switches.h"
 #include "ui/gfx/skia_color_space_util.h"
-#include "ui/gfx/switches.h"
 
 namespace gfx {
 

diff --git a/ui/gfx/icc_profile.h b/ui/gfx/icc_profile.h
index 8146b77..07f6fcb 100644
--- a/ui/gfx/icc_profile.h
+++ b/ui/gfx/icc_profile.h

@@ -27,7 +27,7 @@
 // can be lossily compressed into a ColorSpace object. This structure should
 // only be sent from higher-privilege processes to lower-privilege processes,
 // as parsing this structure is not secure.
-class GFX_EXPORT ICCProfile {
+class COLOR_SPACE_EXPORT ICCProfile {
  public:
   ICCProfile();
   ICCProfile(ICCProfile&& other);

diff --git a/ui/gfx/mac/io_surface.cc b/ui/gfx/mac/io_surface.cc
index 90dadff5..8fb16032 100644
--- a/ui/gfx/mac/io_surface.cc
+++ b/ui/gfx/mac/io_surface.cc

@@ -15,7 +15,7 @@
 #include "base/metrics/histogram_macros.h"
 #include "base/trace_event/trace_event.h"
 #include "ui/gfx/buffer_format_util.h"
-#include "ui/gfx/switches.h"
+#include "ui/gfx/color_space_switches.h"
 
 namespace gfx {
 

diff --git a/ui/gfx/paint_vector_icon_unittest.cc b/ui/gfx/paint_vector_icon_unittest.cc
index 1adbb3f..de6e497 100644
--- a/ui/gfx/paint_vector_icon_unittest.cc
+++ b/ui/gfx/paint_vector_icon_unittest.cc

@@ -56,7 +56,7 @@
   sk_sp<cc::PaintRecord> record = recorder.finishRecordingAsPicture();
 
   MockCanvas mock(100, 100);
-  record->playback(&mock);
+  record->Playback(&mock);
 
   ASSERT_EQ(1U, mock.paths().size());
   SkPoint last_point;

diff --git a/ui/gfx/skia_color_space_util.cc b/ui/gfx/skia_color_space_util.cc
index 3c71007..51b7e6a 100644
--- a/ui/gfx/skia_color_space_util.cc
+++ b/ui/gfx/skia_color_space_util.cc

@@ -424,9 +424,9 @@
   return false;
 }
 
-bool GFX_EXPORT SkApproximateTransferFn(sk_sp<SkICC> sk_icc,
-                                        float* max_error,
-                                        SkColorSpaceTransferFn* fn) {
+bool SkApproximateTransferFn(sk_sp<SkICC> sk_icc,
+                             float* max_error,
+                             SkColorSpaceTransferFn* fn) {
   SkICC::Tables tables;
   bool got_tables = sk_icc->rawTransferFnData(&tables);
   if (!got_tables)

diff --git a/ui/gfx/skia_color_space_util.h b/ui/gfx/skia_color_space_util.h
index 5ece50e..5260736 100644
--- a/ui/gfx/skia_color_space_util.h
+++ b/ui/gfx/skia_color_space_util.h

@@ -7,38 +7,39 @@
 
 #include "third_party/skia/include/core/SkColorSpace.h"
 #include "third_party/skia/include/core/SkICC.h"
-#include "ui/gfx/gfx_export.h"
+#include "ui/gfx/color_space_export.h"
 
 namespace gfx {
 
-float GFX_EXPORT SkTransferFnEval(const SkColorSpaceTransferFn& fn, float x);
+float COLOR_SPACE_EXPORT SkTransferFnEval(const SkColorSpaceTransferFn& fn,
+                                          float x);
 
-SkColorSpaceTransferFn GFX_EXPORT
+SkColorSpaceTransferFn COLOR_SPACE_EXPORT
 SkTransferFnInverse(const SkColorSpaceTransferFn& fn);
 
-bool GFX_EXPORT
+bool COLOR_SPACE_EXPORT
 SkTransferFnsApproximatelyCancel(const SkColorSpaceTransferFn& a,
                                  const SkColorSpaceTransferFn& b);
 
-bool GFX_EXPORT
+bool COLOR_SPACE_EXPORT
 SkTransferFnIsApproximatelyIdentity(const SkColorSpaceTransferFn& fn);
 
 // Approximates the |n| points in |x| and |t| by the transfer function |fn|.
 // Returns true if the approximation converged.
-bool GFX_EXPORT SkApproximateTransferFn(const float* x,
-                                        const float* t,
-                                        size_t n,
-                                        SkColorSpaceTransferFn* fn);
+bool COLOR_SPACE_EXPORT SkApproximateTransferFn(const float* x,
+                                                const float* t,
+                                                size_t n,
+                                                SkColorSpaceTransferFn* fn);
 
 // Approximates |sk_icc| by the transfer function |fn|. Returns in |max_error|
 // the maximum pointwise of all color channels' transfer functions with |fn|.
 // Returns false if no approximation was possible, or no approximation
 // converged.
-bool GFX_EXPORT SkApproximateTransferFn(sk_sp<SkICC> sk_icc,
-                                        float* max_error,
-                                        SkColorSpaceTransferFn* fn);
+bool COLOR_SPACE_EXPORT SkApproximateTransferFn(sk_sp<SkICC> sk_icc,
+                                                float* max_error,
+                                                SkColorSpaceTransferFn* fn);
 
-bool GFX_EXPORT SkMatrixIsApproximatelyIdentity(const SkMatrix44& m);
+bool COLOR_SPACE_EXPORT SkMatrixIsApproximatelyIdentity(const SkMatrix44& m);
 
 }  // namespace gfx
 

diff --git a/ui/gfx/switches.cc b/ui/gfx/switches.cc
index 0219b5e..07ee2fc 100644
--- a/ui/gfx/switches.cc
+++ b/ui/gfx/switches.cc

@@ -21,13 +21,4 @@
 // Run in headless mode, i.e., without a UI or display server dependencies.
 const char kHeadless[] = "headless";
 
-// Convert rasterization and compositing inputs to the output color space
-// before operating on them.
-const char kEnableColorCorrectRendering[] = "enable-color-correct-rendering";
-
-// Force all monitors to be treated as though they have the specified color
-// profile. Accepted values are "srgb" and "generic-rgb" (currently used by Mac
-// layout tests) and "color-spin-gamma24" (used by layout tests).
-const char kForceColorProfile[] = "force-color-profile";
-
 }  // namespace switches

diff --git a/ui/gfx/switches.h b/ui/gfx/switches.h
index b87dad5..8d2e13e 100644
--- a/ui/gfx/switches.h
+++ b/ui/gfx/switches.h

@@ -6,23 +6,19 @@
 #define UI_GFX_SWITCHES_H_
 
 #include "build/build_config.h"
-#include "ui/gfx/gfx_export.h"
+#include "ui/gfx/switches_export.h"
 
 namespace switches {
 
 #if defined(OS_WIN)
-GFX_EXPORT extern const char kDisableDirectWriteForUI[];
+GFX_SWITCHES_EXPORT extern const char kDisableDirectWriteForUI[];
 #endif
 
 #if defined(OS_MACOSX)
-GFX_EXPORT extern const char kEnableHarfBuzzRenderText[];
+GFX_SWITCHES_EXPORT extern const char kEnableHarfBuzzRenderText[];
 #endif
 
-GFX_EXPORT extern const char kHeadless[];
-
-GFX_EXPORT extern const char kEnableColorCorrectRendering[];
-
-GFX_EXPORT extern const char kForceColorProfile[];
+GFX_SWITCHES_EXPORT extern const char kHeadless[];
 
 }  // namespace switches
 

diff --git a/ui/gfx/switches_export.h b/ui/gfx/switches_export.h
new file mode 100644
index 0000000..34418ae
--- /dev/null
+++ b/ui/gfx/switches_export.h

@@ -0,0 +1,29 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef UI_GFX_SWITCHES_EXPORT_H_
+#define UI_GFX_SWITCHES_EXPORT_H_
+
+#if defined(COMPONENT_BUILD)
+#if defined(WIN32)
+
+#if defined(GFX_SWITCHES_IMPLEMENTATION)
+#define GFX_SWITCHES_EXPORT __declspec(dllexport)
+#else
+#define GFX_SWITCHES_EXPORT __declspec(dllimport)
+#endif  // defined(GFX_SWITCHES_IMPLEMENTATION)
+
+#else  // defined(WIN32)
+#if defined(GFX_SWITCHES_IMPLEMENTATION)
+#define GFX_SWITCHES_EXPORT __attribute__((visibility("default")))
+#else
+#define GFX_SWITCHES_EXPORT
+#endif
+#endif
+
+#else  // defined(COMPONENT_BUILD)
+#define GFX_SWITCHES_EXPORT
+#endif
+
+#endif  // UI_GFX_SWITCHES_EXPORT_H_

diff --git a/ui/login/account_picker/md_user_pod_row.js b/ui/login/account_picker/md_user_pod_row.js
index e9b7f6a..6f35669 100644
--- a/ui/login/account_picker/md_user_pod_row.js
+++ b/ui/login/account_picker/md_user_pod_row.js

@@ -66,12 +66,12 @@
    * @const
    */
   var UserPodTabOrder = {
-    POD_INPUT: 1,          // Password input field and the pod itself.
+    POD_INPUT: 1,          // Password input field, action box menu button and
+                           // the pod itself.
     PIN_KEYBOARD: 2,       // Pin keyboard below the password input field.
     POD_CUSTOM_ICON: 3,    // Pod custom icon next to password input field.
     HEADER_BAR: 4,         // Buttons on the header bar (Shutdown, Add User).
-    ACTION_BOX_BUTTON: 5,  // Action box menu button.
-    POD_MENU_ITEM: 6       // User pod menu items (User info, Remove user).
+    POD_MENU_ITEM: 5       // User pod menu items (User info, Remove user).
   };
 
   /**
@@ -127,18 +127,26 @@
     {state: FINGERPRINT_STATES.FAILED, class: 'failed'}
   ];
 
+  // Supported multi-profile user behavior values.
+  // Keep in sync with the enum in multi_profile_user_controller.h
+  var MULTI_PROFILE_USER_BEHAVIOR = {
+    UNRESTRICTED: 0,
+    PRIMARY_ONLY: 1,
+    NOT_ALLOWED: 2,
+    OWNER_PRIMARY_ONLY: 3
+  };
+
   // Focus and tab order are organized as follows:
   //
   // (1) all user pods have tab index 1 so they are traversed first;
-  // (2) when a user pod is activated, its tab index is set to -1 and its
-  // main input field gets focus and tab index 1;
-  // (3) if pin keyboard is present, it has tab index 2 so it follows the input;
+  // (2) when a user pod is activated, its tab index is set to -1, then its
+  // main input field and action box menu button get focus;
+  // (3) if pin keyboard is present, it has tab index 2 so it follows the
+  // action box menu button;
   // (4) if user pod custom icon is interactive, it has tab index 3;
   // (5) buttons on the header bar have tab index 4;
-  // (6) Action box buttons have tab index 5 and follow the buttons on the
-  // header bar;
-  // (7) User pod menu items (if present) have tab index 6;
-  // (8) lastly, focus jumps to the Status Area and back to user pods.
+  // (6) User pod menu items (if present) have tab index 5;
+  // (7) lastly, focus jumps to the Status Area and back to user pods.
   //
   // 'Focus' event is handled by a capture handler for the whole document
   // and in some cases 'mousedown' event handlers are used instead of 'click'
@@ -754,7 +762,7 @@
     /** @override */
     decorate: function() {
       this.tabIndex = UserPodTabOrder.POD_INPUT;
-      this.actionBoxAreaElement.tabIndex = UserPodTabOrder.ACTION_BOX_BUTTON;
+      this.actionBoxAreaElement.tabIndex = UserPodTabOrder.POD_INPUT;
 
       this.addEventListener('keydown', this.handlePodKeyDown_.bind(this));
       this.addEventListener('click', this.handleClickOnPod_.bind(this));
@@ -1269,12 +1277,15 @@
         this.classList.add('multiprofiles-policy-applied');
         this.setUserPodIconType('policy');
 
-        if (this.user.multiProfilesPolicy == 'primary-only')
+        if (this.user.multiProfilesPolicy ==
+            MULTI_PROFILE_USER_BEHAVIOR.PRIMARY_ONLY) {
           this.querySelector('.mp-policy-primary-only-msg').hidden = false;
-        else if (this.user.multiProfilesPolicy == 'owner-primary-only')
+        } else if (this.user.multiProfilesPolicy ==
+            MULTI_PROFILE_USER_BEHAVIOR.OWNER_PRIMARY_ONLY) {
           this.querySelector('.mp-owner-primary-only-msg').hidden = false;
-        else
+        } else {
           this.querySelector('.mp-policy-not-allowed-msg').hidden = false;
+        }
       } else if (this.user_.isApp) {
         this.setUserPodIconType('app');
       }

diff --git a/ui/login/account_picker/md_user_pod_template.html b/ui/login/account_picker/md_user_pod_template.html
index 11a2bd6..90348ae 100644
--- a/ui/login/account_picker/md_user_pod_template.html
+++ b/ui/login/account_picker/md_user_pod_template.html

@@ -52,6 +52,52 @@
     </div>
 </if>
     <div class="main-pane">
+      <div class="auth-container">
+        <!-- Password Authentication -->
+        <div class="custom-icon-container" hidden></div>
+<if expr="chromeos">
+        <div class="fingerprint-icon-container" hidden
+            aria-label="$i18n{fingerprintIconMessage}">
+          <div class="custom-icon fingerprint-icon-image"></div>
+        </div>
+</if>
+        <div class="password-entry-container">
+          <div class="password-container">
+            <input type="password" class="password"
+                placeholder="$i18n{passwordHint}">
+          </div>
+<if expr="chromeos">
+          <div class="capslock-hint-container">
+            <iron-icon class="capslock-hint" icon="user-pod:caps-lock">
+            </iron-icon>
+          </div>
+          <paper-icon-button class="submit-button" disabled
+                             aria-label="$i18n{submitButtonAccessibleName}"
+                             icon="user-pod:arrow-forward" tabindex="-1">
+          </paper-icon-button>
+</if>
+        </div>
+        <!-- User Click Authentication -->
+        <div class="password-label"></div>
+        <div class="signin-transition-container">
+          <span class="signing-in-label">$i18n{signingIn}</span>
+          <span class="animated-ellipsis-component0">.</span>
+          <span class="animated-ellipsis-component1">.</span>
+          <span class="animated-ellipsis-component2">.</span>
+        </div>
+        <div class="reauth-hint-container">
+          <span class="reauth-warning"></span>
+          <span class="reauth-name-hint"></span>
+        </div>
+        <div class="launch-app-button-container" hidden>
+          <button class="launch-app-button">$i18n{launchAppButton}</button>
+        </div>
+        <div class="input-line">
+          <svg>
+            <line x1="0" y1="0" x2="204" y2="0">
+          </svg>
+        </div>
+      </div>
       <div class="name-container">
         <div class="name"></div>
         <div class="action-box-area">
@@ -117,52 +163,6 @@
           </div>
         </div>
       </div>
-      <div class="auth-container">
-        <!-- Password Authentication -->
-        <div class="custom-icon-container" hidden></div>
-<if expr="chromeos">
-        <div class="fingerprint-icon-container" hidden
-            aria-label="$i18n{fingerprintIconMessage}">
-          <div class="custom-icon fingerprint-icon-image"></div>
-        </div>
-</if>
-        <div class="password-entry-container">
-          <div class="password-container">
-            <input type="password" class="password"
-                placeholder="$i18n{passwordHint}">
-          </div>
-<if expr="chromeos">
-          <div class="capslock-hint-container">
-            <iron-icon class="capslock-hint" icon="user-pod:caps-lock">
-            </iron-icon>
-          </div>
-          <paper-icon-button class="submit-button" disabled
-                             aria-label="$i18n{submitButtonAccessibleName}"
-                             icon="user-pod:arrow-forward" tabindex="-1">
-          </paper-icon-button>
-</if>
-        </div>
-        <!-- User Click Authentication -->
-        <div class="password-label"></div>
-        <div class="signin-transition-container">
-          <span class="signing-in-label">$i18n{signingIn}</span>
-          <span class="animated-ellipsis-component0">.</span>
-          <span class="animated-ellipsis-component1">.</span>
-          <span class="animated-ellipsis-component2">.</span>
-        </div>
-        <div class="reauth-hint-container">
-          <span class="reauth-warning"></span>
-          <span class="reauth-name-hint"></span>
-        </div>
-        <div class="launch-app-button-container" hidden>
-          <button class="launch-app-button">$i18n{launchAppButton}</button>
-        </div>
-        <div class="input-line">
-          <svg>
-            <line x1="0" y1="0" x2="204" y2="0">
-          </svg>
-        </div>
-      </div>
       <div class="public-account-info-container">
         <iron-icon class="learn-more" icon="user-pod:public-session-icon">
         </iron-icon>

diff --git a/ui/login/account_picker/user_pod_row.js b/ui/login/account_picker/user_pod_row.js
index ec915dc..7969075 100644
--- a/ui/login/account_picker/user_pod_row.js
+++ b/ui/login/account_picker/user_pod_row.js

@@ -150,6 +150,15 @@
     {state: FINGERPRINT_STATES.FAILED, class: 'failed'}
   ];
 
+  // Supported multi-profile user behavior values.
+  // Keep in sync with the enum in multi_profile_user_controller.h
+  var MULTI_PROFILE_USER_BEHAVIOR = {
+    UNRESTRICTED: 0,
+    PRIMARY_ONLY: 1,
+    NOT_ALLOWED: 2,
+    OWNER_PRIMARY_ONLY: 3
+  };
+
   // Focus and tab order are organized as follows:
   //
   // (1) all user pods have tab index 1 so they are traversed first;
@@ -1210,12 +1219,15 @@
         this.classList.add('multiprofiles-policy-applied');
         this.setUserPodIconType('policy');
 
-        if (this.user.multiProfilesPolicy == 'primary-only')
+        if (this.user.multiProfilesPolicy ==
+            MULTI_PROFILE_USER_BEHAVIOR.PRIMARY_ONLY) {
           this.querySelector('.mp-policy-primary-only-msg').hidden = false;
-        else if (this.user.multiProfilesPolicy == 'owner-primary-only')
+        } else if (this.user.multiProfilesPolicy ==
+            MULTI_PROFILE_USER_BEHAVIOR.OWNER_PRIMARY_ONLY) {
           this.querySelector('.mp-owner-primary-only-msg').hidden = false;
-        else
+        } else {
           this.querySelector('.mp-policy-not-allowed-msg').hidden = false;
+        }
       } else if (this.user_.isApp) {
         this.setUserPodIconType('app');
       }

diff --git a/ui/views/border_unittest.cc b/ui/views/border_unittest.cc
index ebaab0a3..92e54a1 100644
--- a/ui/views/border_unittest.cc
+++ b/ui/views/border_unittest.cc

@@ -175,7 +175,7 @@
     sk_sp<cc::PaintRecord> record = recorder_->finishRecordingAsPicture();
     std::unique_ptr<MockCanvas> mock(
         new MockCanvas(kCanvasWidth, kCanvasHeight));
-    record->playback(mock.get());
+    record->Playback(mock.get());
     return mock;
   }