diff --git a/BUILD.gn b/BUILD.gn
index 1b4a952..aa706be 100644
--- a/BUILD.gn
+++ b/BUILD.gn
@@ -793,7 +793,7 @@
     # so we need to specify the dependencies here instead.
     if (is_android) {
       deps += [
-        "//breakpad:breakpad_unittests_deps",
+        "//breakpad:breakpad_unittests",
         "//breakpad:dump_syms($host_toolchain)",
         "//breakpad:microdump_stackwalk($host_toolchain)",
         "//breakpad:minidump_dump($host_toolchain)",
diff --git a/DEPS b/DEPS
index d76ab4e..8c2513e 100644
--- a/DEPS
+++ b/DEPS
@@ -43,7 +43,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': 'ca4a86f46f3af38ec8b65a2046eabdee68f4c880',
+  'v8_revision': '3415f608665a373e9067844c1da89e8e532ba74c',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
diff --git a/WATCHLISTS b/WATCHLISTS
index d50618f..0e433ad 100644
--- a/WATCHLISTS
+++ b/WATCHLISTS
@@ -1733,8 +1733,7 @@
     'blink_w3ctests' : [ 'blink-reviews-w3ctests@chromium.org' ],
     'blink_webp': [ 'urvang@chromium.org',
                     'jzern@chromium.org',
-                    'skal@google.com',
-                    'vikasa@google.com' ],
+                    'skal@google.com' ],
     'blink_out_of_process_frames': [ 'dcheng@chromium.org',
                                      'mlamouri+watch-blink@chromium.org' ],
     'blink_screen_orientation': [ 'mlamouri+watch-blink@chromium.org' ],
diff --git a/android_webview/browser/aw_render_thread_context_provider.cc b/android_webview/browser/aw_render_thread_context_provider.cc
index 703bea58..fe115c6d 100644
--- a/android_webview/browser/aw_render_thread_context_provider.cc
+++ b/android_webview/browser/aw_render_thread_context_provider.cc
@@ -64,6 +64,8 @@
 
 AwRenderThreadContextProvider::~AwRenderThreadContextProvider() {
   DCHECK(main_thread_checker_.CalledOnValidThread());
+  if (gr_context_)
+    gr_context_->releaseResourcesAndAbandonContext();
 }
 
 bool AwRenderThreadContextProvider::BindToCurrentThread() {
@@ -98,12 +100,11 @@
   if (gr_context_)
     return gr_context_.get();
 
-  skia::RefPtr<GrGLInterface> interface = skia::AdoptRef(new GrGLInterface);
-  skia_bindings::InitGLES2InterfaceBindings(interface.get(), ContextGL());
-
+  skia::RefPtr<GrGLInterface> interface =
+      skia_bindings::CreateGLES2InterfaceBindings(ContextGL());
   gr_context_ = skia::AdoptRef(GrContext::Create(
+      // GrContext takes ownership of |interface|.
       kOpenGL_GrBackend, reinterpret_cast<GrBackendContext>(interface.get())));
-
   return gr_context_.get();
 }
 
@@ -111,7 +112,7 @@
   DCHECK(main_thread_checker_.CalledOnValidThread());
 
   if (gr_context_)
-    gr_context_.get()->resetContext(state);
+    gr_context_->resetContext(state);
 }
 
 void AwRenderThreadContextProvider::SetupLock() {
diff --git a/ash/shell/content/client/shell_main_delegate.h b/ash/shell/content/client/shell_main_delegate.h
index 71df8da..98bc44d1 100644
--- a/ash/shell/content/client/shell_main_delegate.h
+++ b/ash/shell/content/client/shell_main_delegate.h
@@ -13,7 +13,6 @@
 
 namespace content {
 class ShellContentRendererClient;
-class ShellContentPluginClient;
 class ShellContentUtilityClient;
 }
 
diff --git a/blimp/client/feature/compositor/blimp_context_provider.cc b/blimp/client/feature/compositor/blimp_context_provider.cc
index a0b22e7..2e2874b 100644
--- a/blimp/client/feature/compositor/blimp_context_provider.cc
+++ b/blimp/client/feature/compositor/blimp_context_provider.cc
@@ -53,6 +53,8 @@
 BlimpContextProvider::~BlimpContextProvider() {
   DCHECK(main_thread_checker_.CalledOnValidThread() ||
          context_thread_checker_.CalledOnValidThread());
+  if (gr_context_)
+    gr_context_->releaseResourcesAndAbandonContext();
 }
 
 bool BlimpContextProvider::BindToCurrentThread() {
@@ -87,12 +89,12 @@
   if (gr_context_)
     return gr_context_.get();
 
-  skia::RefPtr<GrGLInterface> interface = skia::AdoptRef(new GrGLInterface);
-  skia_bindings::InitGLES2InterfaceBindings(interface.get(), ContextGL());
+  skia::RefPtr<GrGLInterface> interface =
+      skia_bindings::CreateGLES2InterfaceBindings(ContextGL());
 
   gr_context_ = skia::AdoptRef(GrContext::Create(
+      // GrContext takes ownership of |interface|.
       kOpenGL_GrBackend, reinterpret_cast<GrBackendContext>(interface.get())));
-
   return gr_context_.get();
 }
 
@@ -100,7 +102,7 @@
   DCHECK(context_thread_checker_.CalledOnValidThread());
 
   if (gr_context_)
-    gr_context_.get()->resetContext(state);
+    gr_context_->resetContext(state);
 }
 
 void BlimpContextProvider::SetupLock() {
diff --git a/breakpad/BUILD.gn b/breakpad/BUILD.gn
index 0fd15ceb..1213850 100644
--- a/breakpad/BUILD.gn
+++ b/breakpad/BUILD.gn
@@ -623,10 +623,7 @@
     configs += [ "//build/config/compiler:no_chromium_code" ]
   }
 
-  # "breakpad_unittests" cannot use the test() template because the test is run
-  # as an executable not as an APK on Android.
-  executable("breakpad_unittests") {
-    testonly = true
+  test("breakpad_unittests") {
     set_sources_assignment_filter([])
     sources = [
       "linux/breakpad_googletest_includes.h",
@@ -682,9 +679,11 @@
     }
 
     if (is_android) {
+      use_raw_android_executable = true
       sources += [ "src/common/android/breakpad_getcontext_unittest.cc" ]
       libs = [ "log" ]
       include_dirs += [ "src/common/android/include" ]
+      extra_dist_files = [ "$root_out_dir/linux_dumper_unittest_helper" ]
     }
 
     # Clang's -mstackrealign doesn't work well with
@@ -884,29 +883,8 @@
 }
 
 if (is_android) {
-  create_native_executable_dist("breakpad_unittests_deps") {
-    testonly = true
-    dist_dir = "$root_out_dir/breakpad_unittests_deps"
-    binary = "$root_out_dir/breakpad_unittests"
-    deps = [
-      ":breakpad_unittests",
-    ]
-
-    if (is_component_build) {
-      deps += [ "//build/android:cpplib_stripped" ]
-    }
-  }
-
-  test_runner_script("breakpad_unittests__test_runner_script") {
-    test_name = "breakpad_unittests"
-    test_type = "gtest"
-    test_suite = "breakpad_unittests"
-    isolate_file = "breakpad_unittests.isolate"
-  }
-
   # TODO(GYP) Delete this after we've converted everything to GN.
-  # The _run targets exist only for compatibility w/ GYP.
-  group("breakpad_unittests_apk_run") {
+  group("breakpad_unittests_deps") {
     testonly = true
     deps = [
       ":breakpad_unittests",
diff --git a/breakpad/breakpad.gyp b/breakpad/breakpad.gyp
index 7053d89..5483ca02 100644
--- a/breakpad/breakpad.gyp
+++ b/breakpad/breakpad.gyp
@@ -991,15 +991,14 @@
           'target_name': 'breakpad_unittests_deps',
           'type': 'none',
           'dependencies': [
-            'breakpad_unittests_stripped',
+            'breakpad_unittests',
+            'linux_dumper_unittest_helper',
           ],
-          # For the component build, ensure dependent shared libraries are
-          # stripped and put alongside breakpad_unittest to simplify pushing to
-          # the device.
           'variables': {
-             'output_dir': '<(PRODUCT_DIR)/breakpad_unittests_deps/',
-             'native_binary': '<(PRODUCT_DIR)/breakpad_unittests_stripped',
-             'include_main_binary': 0,
+             'output_dir': '<(PRODUCT_DIR)/breakpad_unittests__dist/',
+             'native_binary': '<(PRODUCT_DIR)/breakpad_unittests',
+             'include_main_binary': 1,
+             'extra_files': ['<(PRODUCT_DIR)/linux_dumper_unittest_helper'],
           },
           'includes': [
             '../build/android/native_app_dependencies.gypi'
diff --git a/build/all.gyp b/build/all.gyp
index 19d08d0..6037e184 100644
--- a/build/all.gyp
+++ b/build/all.gyp
@@ -156,7 +156,6 @@
             '../third_party/lzma_sdk/lzma_sdk.gyp:*',
             '../third_party/mesa/mesa.gyp:*',
             '../third_party/modp_b64/modp_b64.gyp:*',
-            '../third_party/npapi/npapi.gyp:*',
             '../third_party/ots/ots.gyp:*',
             '../third_party/pdfium/samples/samples.gyp:*',
             '../third_party/qcms/qcms.gyp:*',
diff --git a/build/android/gyp/create_dist_jar.py b/build/android/gyp/create_dist_jar.py
index 3f056a7a..0d31c5d 100755
--- a/build/android/gyp/create_dist_jar.py
+++ b/build/android/gyp/create_dist_jar.py
@@ -7,7 +7,6 @@
 """Merges a list of jars into a single jar."""
 
 import optparse
-import re
 import sys
 
 from util import build_utils
@@ -17,8 +16,6 @@
   parser = optparse.OptionParser()
   build_utils.AddDepfileOption(parser)
   parser.add_option('--output', help='Path to output jar.')
-  parser.add_option('--use-ijars', action='store_true',
-                    help='Use .interface.jar rather than the given jars.')
   parser.add_option('--inputs', action='append', help='List of jar inputs.')
   options, _ = parser.parse_args(args)
   build_utils.CheckOptions(options, parser, ['output', 'inputs'])
@@ -27,10 +24,6 @@
   for inputs_arg in options.inputs:
     input_jars.extend(build_utils.ParseGypList(inputs_arg))
 
-  if options.use_ijars:
-    ijar_re = re.compile(r'\.jar$')
-    input_jars = [ijar_re.sub('.interface.jar', p) for p in input_jars]
-
   build_utils.MergeZips(options.output, input_jars)
 
   if options.depfile:
diff --git a/build/android/gyp/javac.py b/build/android/gyp/javac.py
index 1f6d1ba..e8cee1c 100755
--- a/build/android/gyp/javac.py
+++ b/build/android/gyp/javac.py
@@ -69,46 +69,6 @@
 _MAX_MANIFEST_LINE_LEN = 72
 
 
-def _CreateManifest(manifest_path, classpath, main_class=None,
-                    manifest_entries=None):
-  """Creates a manifest file with the given parameters.
-
-  This generates a manifest file that compiles with the spec found at
-  http://docs.oracle.com/javase/7/docs/technotes/guides/jar/jar.html#JAR_Manifest
-
-  Args:
-    manifest_path: The path to the manifest file that should be created.
-    classpath: The JAR files that should be listed on the manifest file's
-      classpath.
-    main_class: If present, the class containing the main() function.
-    manifest_entries: If present, a list of (key, value) pairs to add to
-      the manifest.
-
-  """
-  output = ['Manifest-Version: 1.0']
-  if main_class:
-    output.append('Main-Class: %s' % main_class)
-  if manifest_entries:
-    for k, v in manifest_entries:
-      output.append('%s: %s' % (k, v))
-  if classpath:
-    sanitized_paths = []
-    for path in classpath:
-      sanitized_paths.append(os.path.basename(path.strip('"')))
-    output.append('Class-Path: %s' % ' '.join(sanitized_paths))
-  output.append('Created-By: ')
-  output.append('')
-
-  wrapper = textwrap.TextWrapper(break_long_words=True,
-                                 drop_whitespace=False,
-                                 subsequent_indent=' ',
-                                 width=_MAX_MANIFEST_LINE_LEN - 2)
-  output = '\r\n'.join(w for l in output for w in wrapper.wrap(l))
-
-  with open(manifest_path, 'w') as f:
-    f.write(output)
-
-
 def _ExtractClassFiles(jar_path, dest_dir, java_files):
   """Extracts all .class files not corresponding to |java_files|."""
   # Two challenges exist here:
@@ -160,8 +120,7 @@
       fileobj.write(re.sub(r'/tmp/[^/]*', temp_dir, pdb_data))
 
 
-def _OnStaleMd5(changes, options, javac_cmd, java_files, classpath_inputs,
-                runtime_classpath):
+def _OnStaleMd5(changes, options, javac_cmd, java_files, classpath_inputs):
   with build_utils.TempDir() as temp_dir:
     srcjars = options.java_srcjars
     # The .excluded.jar contains .class files excluded from the main jar.
@@ -263,23 +222,12 @@
       # Make sure output exists.
       build_utils.Touch(pdb_path)
 
-    if options.main_class or options.manifest_entry:
-      entries = []
-      if options.manifest_entry:
-        entries = [e.split(':') for e in options.manifest_entry]
-      manifest_file = os.path.join(temp_dir, 'manifest')
-      _CreateManifest(manifest_file, runtime_classpath, options.main_class,
-                      entries)
-    else:
-      manifest_file = None
-
     glob = options.jar_excluded_classes
     inclusion_predicate = lambda f: not build_utils.MatchesGlob(f, glob)
     exclusion_predicate = lambda f: not inclusion_predicate(f)
 
     jar.JarDirectory(classes_dir,
                      options.jar_path,
-                     manifest_file=manifest_file,
                      predicate=inclusion_predicate)
     jar.JarDirectory(classes_dir,
                      excluded_jar_path,
@@ -310,10 +258,6 @@
       help='Classpath for javac. If this is specified multiple times, they '
       'will all be appended to construct the classpath.')
   parser.add_option(
-      '--use-ijars',
-      action='store_true',
-      help='Whether to use interface jars (.interface.jar) when compiling')
-  parser.add_option(
       '--incremental',
       action='store_true',
       help='Whether to re-use .class files rather than recompiling them '
@@ -327,26 +271,15 @@
       '--jar-excluded-classes',
       default='',
       help='List of .class file patterns to exclude from the jar.')
-
   parser.add_option(
       '--chromium-code',
       type='int',
       help='Whether code being compiled should be built with stricter '
       'warnings for chromium code.')
-
   parser.add_option(
       '--use-errorprone-path',
       help='Use the Errorprone compiler at this path.')
-
   parser.add_option('--jar-path', help='Jar output path.')
-  parser.add_option(
-      '--main-class',
-      help='The class containing the main method.')
-  parser.add_option(
-      '--manifest-entry',
-      action='append',
-      help='Key:value pairs to add to the .jar manifest.')
-
   parser.add_option('--stamp', help='Path to touch on success.')
 
   options, args = parser.parse_args(argv)
@@ -387,13 +320,6 @@
 
   java_files = _FilterJavaFiles(java_files, options.javac_includes)
 
-  runtime_classpath = options.classpath
-  compile_classpath = runtime_classpath
-  if options.use_ijars:
-    ijar_re = re.compile(r'\.jar$')
-    compile_classpath = (
-        [ijar_re.sub('.interface.jar', p) for p in runtime_classpath])
-
   javac_cmd = ['javac']
   if options.use_errorprone_path:
     javac_cmd = [options.use_errorprone_path] + ERRORPRONE_OPTIONS
@@ -403,7 +329,7 @@
       # Chromium only allows UTF8 source files.  Being explicit avoids
       # javac pulling a default encoding from the user's environment.
       '-encoding', 'UTF-8',
-      '-classpath', ':'.join(compile_classpath),
+      '-classpath', ':'.join(options.classpath),
       # Prevent compiler from compiling .java files not listed as inputs.
       # See: http://blog.ltgt.net/most-build-tools-misuse-javac/
       '-sourcepath', ''
@@ -426,10 +352,8 @@
 
   classpath_inputs = options.bootclasspath
   # TODO(agrieve): Remove this .TOC heuristic once GYP is no more.
-  if options.use_ijars:
-    classpath_inputs.extend(compile_classpath)
-  else:
-    for path in compile_classpath:
+  if options.classpath and not options.classpath[0].endswith('.interface.jar'):
+    for path in options.classpath:
       if os.path.exists(path + '.TOC'):
         classpath_inputs.append(path + '.TOC')
       else:
@@ -453,7 +377,7 @@
   # of them does not change what gets written to the depsfile.
   build_utils.CallAndWriteDepfileIfStale(
       lambda changes: _OnStaleMd5(changes, options, javac_cmd, java_files,
-                                  classpath_inputs, runtime_classpath),
+                                  classpath_inputs),
       options,
       input_paths=input_paths,
       input_strings=javac_cmd,
diff --git a/build/android/gyp/write_build_config.py b/build/android/gyp/write_build_config.py
index aad458f..8d4cdb1 100755
--- a/build/android/gyp/write_build_config.py
+++ b/build/android/gyp/write_build_config.py
@@ -177,6 +177,10 @@
   return ret
 
 
+def _AsInterfaceJar(jar_path):
+  return jar_path[:-3] + 'interface.jar'
+
+
 def main(argv):
   parser = optparse.OptionParser()
   build_utils.AddDepfileOption(parser)
@@ -465,15 +469,19 @@
 
   if options.type in ('java_binary', 'java_library', 'android_apk'):
     config['javac']['classpath'] = javac_classpath
+    config['javac']['interface_classpath'] = [
+        _AsInterfaceJar(p) for p in javac_classpath]
     config['java'] = {
       'full_classpath': java_full_classpath
     }
 
   if options.type == 'android_apk':
+    dependency_jars = [c['jar_path'] for c in all_library_deps]
+    all_interface_jars = [
+        _AsInterfaceJar(p) for p in dependency_jars + [options.jar_path]]
     config['dist_jar'] = {
-      'dependency_jars': [
-        c['jar_path'] for c in all_library_deps
-      ]
+      'dependency_jars': dependency_jars,
+      'all_interface_jars': all_interface_jars,
     }
     manifest = AndroidManifest(options.android_manifest)
     deps_info['package_name'] = manifest.GetPackageName()
diff --git a/build/android/native_app_dependencies.gypi b/build/android/native_app_dependencies.gypi
index f74e7ae..4651ac3 100644
--- a/build/android/native_app_dependencies.gypi
+++ b/build/android/native_app_dependencies.gypi
@@ -27,6 +27,7 @@
 {
   'variables': {
     'include_main_binary%': 1,
+    'extra_files%': [],
   },
   'conditions': [
       ['android_must_copy_system_libraries == 1', {
@@ -55,6 +56,14 @@
           },
         ],
       }],
+      ['extra_files!=[]', {
+        'copies': [
+          {
+            'destination': '<(output_dir)',
+            'files': [ '<@(extra_files)' ],
+          }
+        ],
+      }],
       ['include_main_binary==1', {
         'copies': [
           {
diff --git a/build/android/pylib/gtest/gtest_test_instance.py b/build/android/pylib/gtest/gtest_test_instance.py
index f5b2c69..3291116 100644
--- a/build/android/pylib/gtest/gtest_test_instance.py
+++ b/build/android/pylib/gtest/gtest_test_instance.py
@@ -144,9 +144,18 @@
     self._shard_timeout = args.shard_timeout
     self._skip_clear_data = args.skip_clear_data
     self._suite = args.suite_name[0]
+    self._exe_dist_dir = None
 
-    self._exe_path = os.path.join(constants.GetOutDirectory(),
-                                  self._suite)
+    # GYP:
+    if args.executable_dist_dir:
+      self._exe_dist_dir = os.path.abspath(args.executable_dist_dir)
+    else:
+      # TODO(agrieve): Remove auto-detection once recipes pass flag explicitly.
+      exe_dist_dir = os.path.join(constants.GetOutDirectory(),
+                                  '%s__dist' % self._suite)
+
+      if os.path.exists(exe_dist_dir):
+        self._exe_dist_dir = exe_dist_dir
 
     incremental_part = ''
     if args.test_apk_incremental_install_script:
@@ -171,9 +180,7 @@
         self._extras[EXTRA_SHARD_NANO_TIMEOUT] = int(1e9 * self._shard_timeout)
         self._shard_timeout = 900
 
-    if not os.path.exists(self._exe_path):
-      self._exe_path = None
-    if not self._apk_helper and not self._exe_path:
+    if not self._apk_helper and not self._exe_dist_dir:
       error_func('Could not find apk or executable for %s' % self._suite)
 
     self._data_deps = []
@@ -234,8 +241,8 @@
     return self._app_data_files
 
   @property
-  def exe(self):
-    return self._exe_path
+  def exe_dist_dir(self):
+    return self._exe_dist_dir
 
   @property
   def extras(self):
diff --git a/build/android/pylib/local/device/local_device_gtest_run.py b/build/android/pylib/local/device/local_device_gtest_run.py
index a745751..8172790f 100644
--- a/build/android/pylib/local/device/local_device_gtest_run.py
+++ b/build/android/pylib/local/device/local_device_gtest_run.py
@@ -161,26 +161,18 @@
 
 
 class _ExeDelegate(object):
-  def __init__(self, tr, exe):
-    self._exe_host_path = exe
-    self._exe_file_name = os.path.split(exe)[-1]
-    self._exe_device_path = '%s/%s' % (
-        constants.TEST_EXECUTABLE_DIR, self._exe_file_name)
-    deps_host_path = self._exe_host_path + '_deps'
-    if os.path.exists(deps_host_path):
-      self._deps_host_path = deps_host_path
-      self._deps_device_path = self._exe_device_path + '_deps'
-    else:
-      self._deps_host_path = None
+  def __init__(self, tr, dist_dir):
+    self._host_dist_dir = dist_dir
+    self._exe_file_name = os.path.basename(dist_dir)[:-len('__dist')]
+    self._device_dist_dir = posixpath.join(
+        constants.TEST_EXECUTABLE_DIR, os.path.basename(dist_dir))
     self._test_run = tr
 
   def Install(self, device):
     # TODO(jbudorick): Look into merging this with normal data deps pushing if
     # executables become supported on nonlocal environments.
-    host_device_tuples = [(self._exe_host_path, self._exe_device_path)]
-    if self._deps_host_path:
-      host_device_tuples.append((self._deps_host_path, self._deps_device_path))
-    device.PushChangedFiles(host_device_tuples)
+    device.PushChangedFiles([(self._host_dist_dir, self._device_dist_dir)],
+                            delete_device_stale=True)
 
   def Run(self, test, device, flags=None, **kwargs):
     tool = self._test_run.GetTool(device).GetTestWrapper()
@@ -188,17 +180,17 @@
       cmd = [tool]
     else:
       cmd = []
-    cmd.append(self._exe_device_path)
+    cmd.append(posixpath.join(self._device_dist_dir, self._exe_file_name))
 
     if test:
       cmd.append('--gtest_filter=%s' % ':'.join(test))
     if flags:
+      # TODO(agrieve): This won't work if multiple flags are passed.
       cmd.append(flags)
     cwd = constants.TEST_EXECUTABLE_DIR
 
     env = {
-      'LD_LIBRARY_PATH':
-          '%s/%s_deps' % (constants.TEST_EXECUTABLE_DIR, self._exe_file_name),
+      'LD_LIBRARY_PATH': self._device_dist_dir
     }
     try:
       gcov_strip_depth = os.environ['NATIVE_COVERAGE_DEPTH_STRIP']
@@ -228,8 +220,8 @@
 
     if self._test_instance.apk:
       self._delegate = _ApkDelegate(self._test_instance)
-    elif self._test_instance.exe:
-      self._delegate = _ExeDelegate(self, self._test_instance.exe)
+    elif self._test_instance.exe_dist_dir:
+      self._delegate = _ExeDelegate(self, self._test_instance.exe_dist_dir)
     self._crashes = set()
     self._servers = collections.defaultdict(list)
 
diff --git a/build/android/test_runner.py b/build/android/test_runner.py
index e55f8c0..5edc6da 100755
--- a/build/android/test_runner.py
+++ b/build/android/test_runner.py
@@ -249,6 +249,9 @@
   group.add_argument('-s', '--suite', dest='suite_name',
                      nargs='+', metavar='SUITE_NAME', required=True,
                      help='Executable name of the test suite to run.')
+  group.add_argument('--executable-dist-dir',
+                     help="Path to executable's dist directory for native"
+                          " (non-apk) tests.")
   group.add_argument('--test-apk-incremental-install-script',
                      help='Path to install script for the test apk.')
   group.add_argument('--gtest_also_run_disabled_tests',
diff --git a/build/config/android/internal_rules.gni b/build/config/android/internal_rules.gni
index 06dbfb7..71e6d53e 100644
--- a/build/config/android/internal_rules.gni
+++ b/build/config/android/internal_rules.gni
@@ -1477,8 +1477,7 @@
     _rebased_depfile = rebase_path(depfile, root_build_dir)
     args = [
       "--depfile=$_rebased_depfile",
-      "--use-ijars",
-      "--classpath=@FileArg($_rebased_build_config:javac:classpath)",
+      "--classpath=@FileArg($_rebased_build_config:javac:interface_classpath)",
       "--jar-path=$_rebased_jar_path",
       "--java-srcjars=$_rebased_java_srcjars",
       "--java-srcjars=@FileArg($_rebased_build_config:javac:srcjars)",
@@ -2070,22 +2069,32 @@
       "//build/android:test_runner_py",
     ]
 
+    test_runner_args = [
+      _test_type,
+      "--output-directory",
+      rebase_path(root_build_dir, root_build_dir),
+    ]
+
     # apk_target is not used for native executable tests
     # (e.g. breakpad_unittests).
     if (defined(invoker.apk_target)) {
+      assert(!defined(invoker.executable_dist_dir))
       deps += [ "${invoker.apk_target}__build_config" ]
       _apk_build_config =
           get_label_info(invoker.apk_target, "target_gen_dir") + "/" +
           get_label_info(invoker.apk_target, "name") + ".build_config"
       _rebased_apk_build_config = rebase_path(_apk_build_config, root_build_dir)
       assert(_rebased_apk_build_config != "")  # Mark as used.
+    } else if (_test_type == "gtest") {
+      assert(
+          defined(invoker.executable_dist_dir),
+          "Must define either apk_target or executable_dist_dir for test_runner_script()")
+      test_runner_args += [
+        "--executable-dist-dir",
+        rebase_path(invoker.executable_dist_dir, root_build_dir),
+      ]
     }
 
-    test_runner_args = [
-      _test_type,
-      "--output-directory",
-      rebase_path(root_build_dir, root_build_dir),
-    ]
     if (_test_type == "gtest") {
       assert(defined(invoker.test_suite))
       test_runner_args += [
diff --git a/build/config/android/rules.gni b/build/config/android/rules.gni
index 14896fc..ed42b575 100644
--- a/build/config/android/rules.gni
+++ b/build/config/android/rules.gni
@@ -1599,12 +1599,8 @@
         rebase_path(depfile, root_build_dir),
         "--output",
         rebase_path("${_dist_ijar_path}", root_build_dir),
-        "--use-ijars",
-        "--inputs=@FileArg($_rebased_build_config:dist_jar:dependency_jars)",
+        "--inputs=@FileArg($_rebased_build_config:dist_jar:all_interface_jars)",
       ]
-      inputs += [ _jar_path ]
-      _rebased_jar_path = rebase_path([ _jar_path ], root_build_dir)
-      args += [ "--inputs=$_rebased_jar_path" ]
       deps = [
         ":$build_config_target",  # Generates the build config file.
         ":$java_target",  # Generates the jar file.
@@ -2234,7 +2230,7 @@
 #   dist_dir: Directory for the exe and libraries. Everything in this directory
 #     will be deleted before copying in the exe and libraries.
 #   binary: Path to (stripped) executable.
-#   include_main_binary: Whether |binary| should be copied to |dist_dir|.
+#   extra_files: List of extra files to copy in (optional).
 #
 # Example
 #   create_native_executable_dist("foo_dist") {
@@ -2243,34 +2239,27 @@
 #     deps = [ ":the_thing_that_makes_foo" ]
 #   }
 template("create_native_executable_dist") {
-  set_sources_assignment_filter([])
   forward_variables_from(invoker, [ "testonly" ])
 
-  dist_dir = invoker.dist_dir
-  binary = invoker.binary
-  template_name = target_name
+  _libraries_list = "${target_gen_dir}/${target_name}_library_dependencies.list"
 
-  libraries_list =
-      "${target_gen_dir}/${template_name}_library_dependencies.list"
+  _find_deps_target_name = "${target_name}__find_library_dependencies"
 
-  find_deps_target_name = "${template_name}__find_library_dependencies"
-  copy_target_name = "${template_name}__copy_libraries_and_exe"
-
-  action(find_deps_target_name) {
+  # TODO(agrieve): Extract dependent libs from GN rather than readelf.
+  action(_find_deps_target_name) {
     forward_variables_from(invoker, [ "deps" ])
-    visibility = [ ":$copy_target_name" ]
 
     script = "//build/android/gyp/write_ordered_libraries.py"
     depfile = "$target_gen_dir/$target_name.d"
     inputs = [
-      binary,
+      invoker.binary,
       android_readelf,
     ]
     outputs = [
       depfile,
-      libraries_list,
+      _libraries_list,
     ]
-    rebased_binaries = rebase_path([ binary ], root_build_dir)
+    rebased_binaries = rebase_path([ invoker.binary ], root_build_dir)
     args = [
       "--depfile",
       rebase_path(depfile, root_build_dir),
@@ -2278,47 +2267,40 @@
       "--libraries-dir",
       rebase_path(root_shlib_dir, root_build_dir),
       "--output",
-      rebase_path(libraries_list, root_build_dir),
+      rebase_path(_libraries_list, root_build_dir),
       "--readelf",
       rebase_path(android_readelf, root_build_dir),
     ]
   }
 
-  copy_ex(copy_target_name) {
-    visibility = [ ":$template_name" ]
-
+  copy_ex(target_name) {
     clear_dir = true
 
     inputs = [
-      libraries_list,
+      _libraries_list,
+      invoker.binary,
     ]
-    if (defined(invoker.include_main_binary) && invoker.include_main_binary) {
-      inputs += [ binary ]
-    }
 
-    dest = dist_dir
+    dest = invoker.dist_dir
 
-    rebased_libraries_list = rebase_path(libraries_list, root_build_dir)
-    args = [ "--files=@FileArg($rebased_libraries_list:lib_paths)" ]
-    if (defined(invoker.include_main_binary) && invoker.include_main_binary) {
-      rebased_binaries_list = rebase_path([ binary ], root_build_dir)
-      args += [ "--files=$rebased_binaries_list" ]
+    _rebased_libraries_list = rebase_path(_libraries_list, root_build_dir)
+    _rebased_binaries_list = rebase_path([ invoker.binary ], root_build_dir)
+    args = [
+      "--files=@FileArg($_rebased_libraries_list:lib_paths)",
+      "--files=$_rebased_binaries_list",
+    ]
+    if (defined(invoker.extra_files)) {
+      _rebased_extra_files = rebase_path(invoker.extra_files, root_build_dir)
+      args += [ "--files=$_rebased_extra_files" ]
     }
 
     deps = [
-      ":$find_deps_target_name",
+      ":$_find_deps_target_name",
     ]
     if (defined(invoker.deps)) {
       deps += invoker.deps
     }
   }
-
-  group(template_name) {
-    forward_variables_from(invoker, [ "visibility" ])
-    public_deps = [
-      ":$copy_target_name",
-    ]
-  }
 }
 
 # Compile a protocol buffer to java.
diff --git a/build/host_jar.gypi b/build/host_jar.gypi
index 3b8d548..a7e6ab5b 100644
--- a/build/host_jar.gypi
+++ b/build/host_jar.gypi
@@ -82,9 +82,6 @@
           ['"<(jar_excluded_classes)" != ""', {
             'extra_args': ['--jar-excluded-classes=<(jar_excluded_classes)']
           }],
-          ['main_class != ""', {
-            'extra_args': ['--main-class=>(main_class)']
-          }],
           ['enable_errorprone == 1', {
             'extra_inputs': [
               '<(errorprone_exe_path)',
diff --git a/cc/test/test_in_process_context_provider.cc b/cc/test/test_in_process_context_provider.cc
index d3989df..c9358b1f 100644
--- a/cc/test/test_in_process_context_provider.cc
+++ b/cc/test/test_in_process_context_provider.cc
@@ -71,6 +71,8 @@
 }
 
 TestInProcessContextProvider::~TestInProcessContextProvider() {
+  if (gr_context_)
+    gr_context_->releaseResourcesAndAbandonContext();
 }
 
 bool TestInProcessContextProvider::BindToCurrentThread() { return true; }
@@ -87,18 +89,18 @@
   if (gr_context_)
     return gr_context_.get();
 
-  skia::RefPtr<GrGLInterface> interface = skia::AdoptRef(new GrGLInterface);
-  skia_bindings::InitGLES2InterfaceBindings(interface.get(), ContextGL());
+  skia::RefPtr<GrGLInterface> interface =
+      skia_bindings::CreateGLES2InterfaceBindings(ContextGL());
 
   gr_context_ = skia::AdoptRef(GrContext::Create(
+      // GrContext takes ownership of |interface|.
       kOpenGL_GrBackend, reinterpret_cast<GrBackendContext>(interface.get())));
-
   return gr_context_.get();
 }
 
 void TestInProcessContextProvider::InvalidateGrContext(uint32_t state) {
   if (gr_context_)
-    gr_context_.get()->resetContext(state);
+    gr_context_->resetContext(state);
 }
 
 void TestInProcessContextProvider::SetupLock() {
diff --git a/chrome/BUILD.gn b/chrome/BUILD.gn
index 073f6736..43b0454 100644
--- a/chrome/BUILD.gn
+++ b/chrome/BUILD.gn
@@ -494,7 +494,6 @@
     public_deps += [
       "//chrome/browser/devtools",
       "//chrome/child",
-      "//chrome/plugin",
       "//chrome/renderer",
       "//chrome/utility",
       "//content/public/child",
@@ -1019,7 +1018,6 @@
       "//chrome/browser/ui",
       "//chrome/child",
       "//chrome/common",
-      "//chrome/plugin",
       "//chrome/renderer",
       "//chrome/utility",
       "//components/safe_browsing_db:safe_browsing_db_mobile",
diff --git a/chrome/VERSION b/chrome/VERSION
index 2c2df6c..834b947 100644
--- a/chrome/VERSION
+++ b/chrome/VERSION
@@ -1,4 +1,4 @@
 MAJOR=51
 MINOR=0
-BUILD=2700
+BUILD=2701
 PATCH=0
diff --git a/chrome/android/java/res/layout/single_line_bottom_text_dialog.xml b/chrome/android/java/res/layout/auto_sign_in_first_run_dialog.xml
similarity index 100%
rename from chrome/android/java/res/layout/single_line_bottom_text_dialog.xml
rename to chrome/android/java/res/layout/auto_sign_in_first_run_dialog.xml
diff --git a/chrome/android/java/res/layout/new_tab_page_layout.xml b/chrome/android/java/res/layout/new_tab_page_layout.xml
index 14e589aa..febf062 100644
--- a/chrome/android/java/res/layout/new_tab_page_layout.xml
+++ b/chrome/android/java/res/layout/new_tab_page_layout.xml
@@ -12,8 +12,7 @@
     android:orientation="vertical"
     android:gravity="center"
     android:paddingTop="@dimen/toolbar_height_no_shadow"
-    android:visibility="gone"
-    chrome:maxWidth="692dp" >
+    android:visibility="gone" >
 
     <!-- Spacer. Note: this must have layout_weight="1" and the other spacers must have
          layout_weight="0". The NewTabPageLayout will redistribute the extra space between
diff --git a/chrome/android/java/res/layout/upgrade_activity.xml b/chrome/android/java/res/layout/upgrade_activity.xml
index 975cf93..0b6150a 100644
--- a/chrome/android/java/res/layout/upgrade_activity.xml
+++ b/chrome/android/java/res/layout/upgrade_activity.xml
@@ -3,50 +3,49 @@
      Use of this source code is governed by a BSD-style license that can be
      found in the LICENSE file. -->
 
-<!-- Adapted from webapp_splash_screen_large.xml.
-     Actual layout pending UX review. -->
-<RelativeLayout
-    xmlns:android="http://schemas.android.com/apk/res/android"
-    android:id="@+id/webapp_splash_screen_layout"
-    android:layout_width="match_parent"
-    android:layout_height="match_parent"
-    android:layout_marginBottom="@dimen/webapp_splash_offset" >
-
-    <ImageView
-        android:id="@+id/logo_view"
-        android:layout_width="@dimen/signin_image_carousel_width"
-        android:layout_height="wrap_content"
-        android:layout_centerInParent="true"
-        android:contentDescription="@null"
-        android:src="@drawable/fre_product_logo" />
-
-    <LinearLayout
+<merge xmlns:android="http://schemas.android.com/apk/res/android">
+    <RelativeLayout
         android:layout_width="wrap_content"
         android:layout_height="wrap_content"
-        android:layout_alignParentBottom="true"
-        android:layout_centerHorizontal="true"
-        android:layout_marginBottom="@dimen/webapp_splash_large_title_margin_bottom"
-        android:gravity="center"
-        android:orientation="horizontal" >
+        android:layout_gravity="center" >
 
-        <ProgressBar
-            android:layout_width="20dp"
-            android:layout_height="20dp"
-            android:layout_marginEnd="12dp"
-            android:layout_weight="0" />
-
-        <TextView
-            android:id="@+id/message_view"
+        <!-- In case the image's dimensions ever change, cap it at 130dp.  The spec says to set a
+             minimum width of 80dp, as well, but I don't know it makes sense to do that here: if the
+             resource is swapped out for a smaller one, we'll end up with a blurry scaled up icon.
+        -->
+        <ImageView
+            android:id="@+id/logo_view"
             android:layout_width="wrap_content"
             android:layout_height="wrap_content"
-            android:layout_weight="0"
-            android:text="@string/updating_chrome"
-            android:textSize="20sp"
-            android:textColor="@color/default_text_color"
-            android:gravity="center"
-            android:fontFamily="sans-serif"
-            android:maxLines="1" />
+            android:layout_alignParentTop="true"
+            android:layout_centerHorizontal="true"
+            android:maxWidth="130dp"
+            android:scaleType="centerInside"
+            android:contentDescription="@null"
+            android:src="@drawable/fre_product_logo" />
 
-    </LinearLayout>
+        <LinearLayout
+            android:layout_width="wrap_content"
+            android:layout_height="wrap_content"
+            android:layout_below="@id/logo_view"
+            android:layout_centerHorizontal="true"
+            android:layout_marginTop="32dp"
+            android:gravity="center_vertical"
+            android:orientation="horizontal" >
 
-</RelativeLayout>
+            <ProgressBar
+                android:layout_width="16dp"
+                android:layout_height="16dp"
+                android:layout_marginEnd="16dp" />
+
+            <TextView
+                android:id="@+id/message_view"
+                android:layout_width="wrap_content"
+                android:layout_height="wrap_content"
+                android:text="@string/updating_chrome"
+                android:textSize="16sp"
+                android:textColor="@color/default_text_color" />
+
+        </LinearLayout>
+    </RelativeLayout>
+</merge>
\ No newline at end of file
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ntp/NewTabPageLayout.java b/chrome/android/java/src/org/chromium/chrome/browser/ntp/NewTabPageLayout.java
index 2b32ad21..b1d3779 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ntp/NewTabPageLayout.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ntp/NewTabPageLayout.java
@@ -8,15 +8,15 @@
 import android.content.res.Resources;
 import android.util.AttributeSet;
 import android.view.View;
+import android.widget.LinearLayout;
 
 import org.chromium.chrome.R;
-import org.chromium.chrome.browser.widget.BoundedLinearLayout;
 
 /**
  * Layout for the new tab page. This positions the page elements in the correct vertical positions.
  * There are no separate phone and tablet UIs; this layout adapts based on the available space.
  */
-public class NewTabPageLayout extends BoundedLinearLayout {
+public class NewTabPageLayout extends LinearLayout {
 
     // Space permitting, the spacers will grow from 0dp to the heights given below. If there is
     // additional space, it will be distributed evenly between the top and bottom spacers.
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/password_manager/AutoSigninFirstRunDialog.java b/chrome/android/java/src/org/chromium/chrome/browser/password_manager/AutoSigninFirstRunDialog.java
index b635741..1f623cb 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/password_manager/AutoSigninFirstRunDialog.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/password_manager/AutoSigninFirstRunDialog.java
@@ -75,7 +75,7 @@
                         .setPositiveButton(mOkButtonText, this)
                         .setNegativeButton(mTurnOffButtonText, this);
         View view = LayoutInflater.from(mContext).inflate(
-                R.layout.single_line_bottom_text_dialog, null);
+                R.layout.auto_sign_in_first_run_dialog, null);
         TextView summaryView = (TextView) view.findViewById(R.id.summary);
 
         if (mExplanationLinkStart != mExplanationLinkEnd && mExplanationLinkEnd != 0) {
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/preferences/website/CameraInfo.java b/chrome/android/java/src/org/chromium/chrome/browser/preferences/website/CameraInfo.java
index 8b225f18..27e43643 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/preferences/website/CameraInfo.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/preferences/website/CameraInfo.java
@@ -19,7 +19,6 @@
 
     protected void setNativePreferenceValue(
             String origin, String embedder, ContentSetting value, boolean isIncognito) {
-        WebsitePreferenceBridge.nativeSetCameraSettingForOrigin(
-                origin, embedder, value.toInt(), isIncognito);
+        WebsitePreferenceBridge.nativeSetCameraSettingForOrigin(origin, value.toInt(), isIncognito);
     }
 }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/preferences/website/KeygenInfo.java b/chrome/android/java/src/org/chromium/chrome/browser/preferences/website/KeygenInfo.java
index e7068cd..bc60362 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/preferences/website/KeygenInfo.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/preferences/website/KeygenInfo.java
@@ -19,7 +19,6 @@
 
     protected void setNativePreferenceValue(
             String origin, String embedder, ContentSetting value, boolean isIncognito) {
-        WebsitePreferenceBridge.nativeSetKeygenSettingForOrigin(
-                origin, embedder, value.toInt(), isIncognito);
+        WebsitePreferenceBridge.nativeSetKeygenSettingForOrigin(origin, value.toInt(), isIncognito);
     }
 }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/preferences/website/MicrophoneInfo.java b/chrome/android/java/src/org/chromium/chrome/browser/preferences/website/MicrophoneInfo.java
index b3fa056..51dd41c 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/preferences/website/MicrophoneInfo.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/preferences/website/MicrophoneInfo.java
@@ -20,6 +20,6 @@
     protected void setNativePreferenceValue(
             String origin, String embedder, ContentSetting value, boolean isIncognito) {
         WebsitePreferenceBridge.nativeSetMicrophoneSettingForOrigin(
-                origin, embedder, value.toInt(), isIncognito);
+                origin, value.toInt(), isIncognito);
     }
 }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/preferences/website/WebsitePreferenceBridge.java b/chrome/android/java/src/org/chromium/chrome/browser/preferences/website/WebsitePreferenceBridge.java
index a3ec9ea5..2a9c02c 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/preferences/website/WebsitePreferenceBridge.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/preferences/website/WebsitePreferenceBridge.java
@@ -275,7 +275,7 @@
     static native int nativeGetKeygenSettingForOrigin(
             String origin, String embedder, boolean isIncognito);
     static native void nativeSetKeygenSettingForOrigin(
-            String origin, String embedder, int value, boolean isIncognito);
+            String origin, int value, boolean isIncognito);
     private static native boolean nativeGetKeygenBlocked(Object webContents);
     private static native void nativeGetMidiOrigins(Object list);
     static native int nativeGetMidiSettingForOrigin(
@@ -299,9 +299,9 @@
     static native int nativeGetCameraSettingForOrigin(
             String origin, String embedder, boolean isIncognito);
     static native void nativeSetMicrophoneSettingForOrigin(
-            String origin, String embedder, int value, boolean isIncognito);
+            String origin, int value, boolean isIncognito);
     static native void nativeSetCameraSettingForOrigin(
-            String origin, String embedder, int value, boolean isIncognito);
+            String origin, int value, boolean isIncognito);
     private static native void nativeGetCookieOrigins(Object list, boolean managedOnly);
     static native int nativeGetCookieSettingForOrigin(
             String origin, String embedder, boolean isIncognito);
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/signin/AccountSigninView.java b/chrome/android/java/src/org/chromium/chrome/browser/signin/AccountSigninView.java
index c381d1a6..2fbb9e6 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/signin/AccountSigninView.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/signin/AccountSigninView.java
@@ -499,6 +499,7 @@
         updateProfileName();
 
         configureSpinner(false);
+        setButtonsEnabled(true);
         setUpConfirmButton();
         setUpUndoButton();
 
@@ -523,6 +524,9 @@
     }
 
     private void showConfirmSigninPageAccountTrackerServiceCheck() {
+        // Disable the buttons to prevent them being clicked again while waiting for the callbacks.
+        setButtonsEnabled(false);
+
         // Ensure that the AccountTrackerService has a fully up to date GAIA id <-> email mapping,
         // as this is needed for the previous account check.
         if (AccountTrackerService.get(getContext()).checkAndSeedSystemAccounts()) {
@@ -566,6 +570,11 @@
                                 showConfirmSigninPage();
                             }
                         }
+
+                        @Override
+                        public void onCancel() {
+                            setButtonsEnabled(true);
+                        }
                     });
         } else {
             showConfirmSigninPage();
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/sync/SyncAccountSwitcher.java b/chrome/android/java/src/org/chromium/chrome/browser/sync/SyncAccountSwitcher.java
index 5edc3b5..10c5ebf 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/sync/SyncAccountSwitcher.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/sync/SyncAccountSwitcher.java
@@ -87,7 +87,11 @@
                 }
             }
         });
+    }
 
+    @Override
+    public void onCancel() {
+        // The user aborted the 'merge data' dialog, there is nothing to do.
     }
 
     @Override
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/sync/ui/ConfirmImportSyncDataDialog.java b/chrome/android/java/src/org/chromium/chrome/browser/sync/ui/ConfirmImportSyncDataDialog.java
index c20b50b..c83e7bf 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/sync/ui/ConfirmImportSyncDataDialog.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/sync/ui/ConfirmImportSyncDataDialog.java
@@ -41,6 +41,11 @@
          * @param wipeData Whether the user requested that existing data should be wiped.
          */
         public void onConfirm(boolean wipeData);
+
+        /**
+         * The user dismisses the dialog.
+         */
+        public void onCancel();
     }
 
     /**
@@ -169,18 +174,21 @@
 
     @Override
     public void onClick(DialogInterface dialog, int which) {
-        if (which != AlertDialog.BUTTON_POSITIVE) {
-            RecordUserAction.record("Signin_ImportDataPrompt_Cancel");
-            return;
-        }
         if (mListener == null) return;
 
-        assert mConfirmImportOption.isChecked() ^ mKeepSeparateOption.isChecked();
+        if (which == AlertDialog.BUTTON_POSITIVE) {
+            assert mConfirmImportOption.isChecked() ^ mKeepSeparateOption.isChecked();
 
-        RecordUserAction.record(mKeepSeparateOption.isChecked()
-                ? "Signin_ImportDataPrompt_DontImport"
-                : "Signin_ImportDataPrompt_ImportData");
-        mListener.onConfirm(mKeepSeparateOption.isChecked());
+            RecordUserAction.record(mKeepSeparateOption.isChecked()
+                    ? "Signin_ImportDataPrompt_DontImport"
+                    : "Signin_ImportDataPrompt_ImportData");
+            mListener.onConfirm(mKeepSeparateOption.isChecked());
+        } else {
+            assert which == AlertDialog.BUTTON_NEGATIVE;
+
+            RecordUserAction.record("Signin_ImportDataPrompt_Cancel");
+            mListener.onCancel();
+        }
     }
 }
 
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/upgrade/UpgradeActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/upgrade/UpgradeActivity.java
index d487236..3ced5eb4 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/upgrade/UpgradeActivity.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/upgrade/UpgradeActivity.java
@@ -28,7 +28,7 @@
     public static final String EXTRA_INTENT_TO_REFIRE =
             "org.chromium.chrome.browser.upgrade.INTENT_TO_REFIRE";
 
-    private static final long MIN_MS_TO_DISPLAY_ACTIVITY = 1000;
+    private static final long MIN_MS_TO_DISPLAY_ACTIVITY = 3000;
     private static final long INVALID_TIMESTAMP = -1;
 
     private final Handler mHandler;
diff --git a/chrome/app/BUILD.gn b/chrome/app/BUILD.gn
index 92bb6433..9ffef993 100644
--- a/chrome/app/BUILD.gn
+++ b/chrome/app/BUILD.gn
@@ -325,7 +325,6 @@
     "//chrome/browser/policy:path_parser",
     "//chrome/child",
     "//chrome/common",
-    "//chrome/plugin",
     "//chrome/renderer",
     "//chrome/utility",
     "//components/crash/content/app",
diff --git a/chrome/app/DEPS b/chrome/app/DEPS
index a672a05..a8f00e9b 100644
--- a/chrome/app/DEPS
+++ b/chrome/app/DEPS
@@ -6,7 +6,6 @@
   "+chrome/common/chrome_features.h",
   "+chrome/grit",  # For generated headers
   "+chrome/installer",
-  "+chrome/plugin/chrome_content_plugin_client.h",
   "+chrome/renderer/chrome_content_renderer_client.h",
   "+chrome/utility/chrome_content_utility_client.h",
   "+chrome_elf/chrome_elf_main.h",
diff --git a/chrome/app/chrome_main_delegate.cc b/chrome/app/chrome_main_delegate.cc
index e4fa69af..d3626f9 100644
--- a/chrome/app/chrome_main_delegate.cc
+++ b/chrome/app/chrome_main_delegate.cc
@@ -40,7 +40,6 @@
 #include "chrome/common/switch_utils.h"
 #include "chrome/common/trace_event_args_whitelist.h"
 #include "chrome/common/url_constants.h"
-#include "chrome/plugin/chrome_content_plugin_client.h"
 #include "chrome/renderer/chrome_content_renderer_client.h"
 #include "chrome/utility/chrome_content_utility_client.h"
 #include "components/component_updater/component_updater_paths.h"
@@ -145,8 +144,6 @@
     g_chrome_content_renderer_client = LAZY_INSTANCE_INITIALIZER;
 base::LazyInstance<ChromeContentUtilityClient>
     g_chrome_content_utility_client = LAZY_INSTANCE_INITIALIZER;
-base::LazyInstance<ChromeContentPluginClient>
-    g_chrome_content_plugin_client = LAZY_INSTANCE_INITIALIZER;
 #endif
 
 #if !defined(CHROME_MULTIPLE_DLL_CHILD)
@@ -984,14 +981,6 @@
 #endif
 }
 
-content::ContentPluginClient* ChromeMainDelegate::CreateContentPluginClient() {
-#if defined(CHROME_MULTIPLE_DLL_BROWSER)
-  return NULL;
-#else
-  return g_chrome_content_plugin_client.Pointer();
-#endif
-}
-
 content::ContentRendererClient*
 ChromeMainDelegate::CreateContentRendererClient() {
 #if defined(CHROME_MULTIPLE_DLL_BROWSER)
diff --git a/chrome/app/chrome_main_delegate.h b/chrome/app/chrome_main_delegate.h
index 61370a5..fc56a6f 100644
--- a/chrome/app/chrome_main_delegate.h
+++ b/chrome/app/chrome_main_delegate.h
@@ -46,7 +46,6 @@
   bool ShouldEnableProfilerRecording() override;
 
   content::ContentBrowserClient* CreateContentBrowserClient() override;
-  content::ContentPluginClient* CreateContentPluginClient() override;
   content::ContentRendererClient* CreateContentRendererClient() override;
   content::ContentUtilityClient* CreateContentUtilityClient() override;
 
diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
index 056d90af..6d53d75f 100644
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd
@@ -3333,6 +3333,9 @@
           <message name="IDS_TASK_MANAGER_SHARED_MEM_COLUMN" desc="Task manager process shared memory column. Shows the size of the memory used by the process which is shared with other processes">
             Shared memory
           </message>
+          <message name="IDS_TASK_MANAGER_SWAPPED_MEM_COLUMN" desc="Task manager process swapped memory column. Shows the size of the memory that lives in the swap space.">
+            Swapped nemory
+          </message>
           <message name="IDS_TASK_MANAGER_PROFILE_NAME_COLUMN" desc="The name of the column with the name of the profile in which the page is running, if any.">
             Profile
           </message>
@@ -3398,6 +3401,9 @@
           <message name="IDS_TASK_MANAGER_SHARED_MEM_COLUMN" desc="Task manager process shared memory column. Shows the size of the memory used by the process which is shared with other processes">
             Shared Memory
           </message>
+          <message name="IDS_TASK_MANAGER_SWAPPED_MEM_COLUMN" desc="Task manager process swapped memory column. Shows the size of the memory that lives in the swap space.">
+            Swapped Memory
+          </message>
           <message name="IDS_TASK_MANAGER_PROFILE_NAME_COLUMN" desc="The name of the column with the name of the profile in which the page is running, if any.">
             Profile
           </message>
diff --git a/chrome/browser/android/preferences/website_preference_bridge.cc b/chrome/browser/android/preferences/website_preference_bridge.cc
index f044ab92..bd3cda2a 100644
--- a/chrome/browser/android/preferences/website_preference_bridge.cc
+++ b/chrome/browser/android/preferences/website_preference_bridge.cc
@@ -19,6 +19,7 @@
 #include "chrome/browser/content_settings/tab_specific_content_settings.h"
 #include "chrome/browser/content_settings/web_site_settings_uma_util.h"
 #include "chrome/browser/notifications/desktop_notification_profile_util.h"
+#include "chrome/browser/permissions/permission_util.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/storage/storage_info_fetcher.h"
@@ -131,14 +132,15 @@
 void SetSettingForOrigin(JNIEnv* env,
                          ContentSettingsType content_type,
                          jstring origin,
-                         ContentSettingsPattern secondary_pattern,
+                         jstring embedder,
                          ContentSetting setting,
                          jboolean is_incognito) {
-  GURL url(ConvertJavaStringToUTF8(env, origin));
-  GetHostContentSettingsMap(is_incognito)
-      ->SetContentSetting(ContentSettingsPattern::FromURLNoWildcard(url),
-                          secondary_pattern, content_type, std::string(),
-                          setting);
+  GURL origin_url(ConvertJavaStringToUTF8(env, origin));
+  GURL embedder_url =
+      embedder ? GURL(ConvertJavaStringToUTF8(env, embedder)) : GURL();
+  PermissionUtil::SetContentSettingAndRecordRevocation(
+      GetActiveUserProfile(is_incognito), origin_url, embedder_url,
+      content_type, std::string(), setting);
   WebSiteSettingsUmaUtil::LogPermissionChange(content_type, setting);
 }
 
@@ -168,10 +170,8 @@
                                           const JavaParamRef<jstring>& embedder,
                                           jint value,
                                           jboolean is_incognito) {
-  GURL embedder_url(ConvertJavaStringToUTF8(env, embedder));
-  SetSettingForOrigin(env, CONTENT_SETTINGS_TYPE_FULLSCREEN, origin,
-                      ContentSettingsPattern::FromURLNoWildcard(embedder_url),
-                      (ContentSetting) value, is_incognito);
+  SetSettingForOrigin(env, CONTENT_SETTINGS_TYPE_FULLSCREEN, origin, embedder,
+                      static_cast<ContentSetting>(value), is_incognito);
 }
 
 static void GetGeolocationOrigins(JNIEnv* env,
@@ -200,10 +200,8 @@
     const JavaParamRef<jstring>& embedder,
     jint value,
     jboolean is_incognito) {
-  GURL embedder_url(ConvertJavaStringToUTF8(env, embedder));
-  SetSettingForOrigin(env, CONTENT_SETTINGS_TYPE_GEOLOCATION, origin,
-                      ContentSettingsPattern::FromURLNoWildcard(embedder_url),
-                      (ContentSetting) value, is_incognito);
+  SetSettingForOrigin(env, CONTENT_SETTINGS_TYPE_GEOLOCATION, origin, embedder,
+                      static_cast<ContentSetting>(value), is_incognito);
 }
 
 static void GetKeygenOrigins(JNIEnv* env,
@@ -226,13 +224,11 @@
 static void SetKeygenSettingForOrigin(JNIEnv* env,
                                       const JavaParamRef<jclass>& clazz,
                                       const JavaParamRef<jstring>& origin,
-                                      const JavaParamRef<jstring>& embedder,
                                       jint value,
                                       jboolean is_incognito) {
-  GURL embedder_url(ConvertJavaStringToUTF8(env, embedder));
-  SetSettingForOrigin(env, CONTENT_SETTINGS_TYPE_KEYGEN, origin,
-                      ContentSettingsPattern::FromURLNoWildcard(embedder_url),
-                      (ContentSetting) value, is_incognito);
+  // Here 'nullptr' indicates that keygen uses wildcard for embedder.
+  SetSettingForOrigin(env, CONTENT_SETTINGS_TYPE_KEYGEN, origin, nullptr,
+                      static_cast<ContentSetting>(value), is_incognito);
 }
 
 static jboolean GetKeygenBlocked(JNIEnv* env,
@@ -266,10 +262,8 @@
                                     const JavaParamRef<jstring>& embedder,
                                     jint value,
                                     jboolean is_incognito) {
-  GURL embedder_url(ConvertJavaStringToUTF8(env, embedder));
-  SetSettingForOrigin(env, CONTENT_SETTINGS_TYPE_MIDI_SYSEX, origin,
-                      ContentSettingsPattern::FromURLNoWildcard(embedder_url),
-                      (ContentSetting) value, is_incognito);
+  SetSettingForOrigin(env, CONTENT_SETTINGS_TYPE_MIDI_SYSEX, origin, embedder,
+                      static_cast<ContentSetting>(value), is_incognito);
 }
 
 static void GetProtectedMediaIdentifierOrigins(
@@ -300,11 +294,9 @@
     const JavaParamRef<jstring>& embedder,
     jint value,
     jboolean is_incognito) {
-  GURL embedder_url(ConvertJavaStringToUTF8(env, embedder));
   SetSettingForOrigin(env, CONTENT_SETTINGS_TYPE_PROTECTED_MEDIA_IDENTIFIER,
-                      origin,
-                      ContentSettingsPattern::FromURLNoWildcard(embedder_url),
-                      (ContentSetting) value, is_incognito);
+                      origin, embedder, static_cast<ContentSetting>(value),
+                      is_incognito);
 }
 
 static void GetNotificationOrigins(JNIEnv* env,
@@ -394,23 +386,23 @@
 static void SetMicrophoneSettingForOrigin(JNIEnv* env,
                                           const JavaParamRef<jclass>& clazz,
                                           const JavaParamRef<jstring>& origin,
-                                          const JavaParamRef<jstring>& embedder,
                                           jint value,
                                           jboolean is_incognito) {
+  // Here 'nullptr' indicates that microphone uses wildcard for embedder.
   SetSettingForOrigin(env, CONTENT_SETTINGS_TYPE_MEDIASTREAM_MIC, origin,
-                      ContentSettingsPattern::Wildcard(),
-                      (ContentSetting) value, is_incognito);
+                      nullptr, static_cast<ContentSetting>(value),
+                      is_incognito);
 }
 
 static void SetCameraSettingForOrigin(JNIEnv* env,
                                       const JavaParamRef<jclass>& clazz,
                                       const JavaParamRef<jstring>& origin,
-                                      const JavaParamRef<jstring>& embedder,
                                       jint value,
                                       jboolean is_incognito) {
+  // Here 'nullptr' indicates that camera uses wildcard for embedder.
   SetSettingForOrigin(env, CONTENT_SETTINGS_TYPE_MEDIASTREAM_CAMERA, origin,
-                      ContentSettingsPattern::Wildcard(),
-                      (ContentSetting) value, is_incognito);
+                      nullptr, static_cast<ContentSetting>(value),
+                      is_incognito);
 }
 
 static scoped_refptr<content_settings::CookieSettings> GetCookieSettings() {
diff --git a/chrome/browser/content_settings/host_content_settings_map_unittest.cc b/chrome/browser/content_settings/host_content_settings_map_unittest.cc
index a530604..945eabc1 100644
--- a/chrome/browser/content_settings/host_content_settings_map_unittest.cc
+++ b/chrome/browser/content_settings/host_content_settings_map_unittest.cc
@@ -1141,3 +1141,53 @@
           GetPrefName(CONTENT_SETTINGS_TYPE_IMAGES));
   EXPECT_TRUE(all_settings_dictionary->empty());
 }
+
+TEST_F(HostContentSettingsMapTest, MigrateOldSettings) {
+  TestingProfile profile;
+  HostContentSettingsMap* host_content_settings_map =
+      HostContentSettingsMapFactory::GetForProfile(&profile);
+
+  // Set old formatted settings.
+  GURL host("http://example.com/");
+  ContentSettingsPattern pattern =
+      ContentSettingsPattern::FromURLNoWildcard(host);
+
+  // Default setting is BLOCK.
+  EXPECT_EQ(CONTENT_SETTING_BLOCK,
+            host_content_settings_map->GetContentSetting(
+                host, host, CONTENT_SETTINGS_TYPE_KEYGEN, std::string()));
+
+  host_content_settings_map->SetContentSetting(
+      pattern, pattern, CONTENT_SETTINGS_TYPE_KEYGEN, std::string(),
+      CONTENT_SETTING_ALLOW);
+  // Because of the old formatted setting entry which has two same patterns,
+  // SetContentSetting() to (host, GURL()) will be ignored.
+  host_content_settings_map->SetContentSettingDefaultScope(
+      host, GURL(), CONTENT_SETTINGS_TYPE_KEYGEN, std::string(),
+      CONTENT_SETTING_BLOCK);
+  EXPECT_EQ(CONTENT_SETTING_ALLOW,
+            host_content_settings_map->GetContentSetting(
+                host, host, CONTENT_SETTINGS_TYPE_KEYGEN, std::string()));
+
+  host_content_settings_map->MigrateOldSettings();
+
+  ContentSettingsForOneType settings;
+  host_content_settings_map->GetSettingsForOneType(CONTENT_SETTINGS_TYPE_KEYGEN,
+                                                   std::string(), &settings);
+  for (const ContentSettingPatternSource& setting_entry : settings) {
+    EXPECT_EQ(setting_entry.secondary_pattern,
+              ContentSettingsPattern::Wildcard());
+  }
+
+  EXPECT_EQ(CONTENT_SETTING_ALLOW,
+            host_content_settings_map->GetContentSetting(
+                host, host, CONTENT_SETTINGS_TYPE_KEYGEN, std::string()));
+
+  // After migrating old settings, changes to the setting works.
+  host_content_settings_map->SetContentSettingDefaultScope(
+      host, GURL(), CONTENT_SETTINGS_TYPE_KEYGEN, std::string(),
+      CONTENT_SETTING_BLOCK);
+  EXPECT_EQ(CONTENT_SETTING_BLOCK,
+            host_content_settings_map->GetContentSetting(
+                host, host, CONTENT_SETTINGS_TYPE_KEYGEN, std::string()));
+}
diff --git a/chrome/browser/media/router/BUILD.gn b/chrome/browser/media/router/BUILD.gn
index 00ff76d..8e149625 100644
--- a/chrome/browser/media/router/BUILD.gn
+++ b/chrome/browser/media/router/BUILD.gn
@@ -11,14 +11,13 @@
                           "scope",
                           [ "media_router.gypi" ])
 
-# TODO(mfoltz): Fix problem that requires explicitly listing //skia
 static_library("router") {
   deps = [
     "//base",
     "//chrome/common:constants",
     "//components/keyed_service/content",
     "//components/keyed_service/core",
-    "//skia",
+    "//content/public/browser",
     "//url",
   ]
   sources = rebase_path(gypi_values.media_router_sources,
@@ -38,7 +37,7 @@
 
 mojom("mojo_bindings") {
   sources = [
-    "media_router.mojom",
+    "mojo/media_router.mojom",
   ]
 }
 
diff --git a/chrome/browser/media/router/media_router.gyp b/chrome/browser/media/router/media_router.gyp
index 19067a77..2785f49a 100644
--- a/chrome/browser/media/router/media_router.gyp
+++ b/chrome/browser/media/router/media_router.gyp
@@ -19,7 +19,7 @@
         '<(DEPTH)/chrome/common_constants.gyp:common_constants',
         '<(DEPTH)/components/components.gyp:keyed_service_content',
         '<(DEPTH)/components/components.gyp:keyed_service_core',
-        '<(DEPTH)/skia/skia.gyp:skia',
+        '<(DEPTH)/content/content.gyp:content_browser',
         '<(DEPTH)/url/url.gyp:url_lib',
       ],
       'sources': [
@@ -44,7 +44,7 @@
       'target_name': 'media_router_mojo_gen',
       'type': 'none',
       'sources': [
-        'media_router.mojom',
+        'mojo/media_router.mojom',
       ],
       'includes': [
         '../../../../mojo/mojom_bindings_generator.gypi',
@@ -57,8 +57,8 @@
         'media_router_mojo_gen',
       ],
       'sources': [
-        '<(SHARED_INTERMEDIATE_DIR)/chrome/browser/media/router/media_router.mojom.cc',
-        '<(SHARED_INTERMEDIATE_DIR)/chrome/browser/media/router/media_router.mojom.h',
+        '<(SHARED_INTERMEDIATE_DIR)/chrome/browser/media/router/mojo/media_router.mojom.cc',
+        '<(SHARED_INTERMEDIATE_DIR)/chrome/browser/media/router/mojo/media_router.mojom.h',
       ],
     },
     {
diff --git a/chrome/browser/media/router/media_router.mojom b/chrome/browser/media/router/mojo/media_router.mojom
similarity index 100%
rename from chrome/browser/media/router/media_router.mojom
rename to chrome/browser/media/router/mojo/media_router.mojom
diff --git a/chrome/browser/media/router/mojo/media_router_mojo_impl.h b/chrome/browser/media/router/mojo/media_router_mojo_impl.h
index 4bdba2b..0106bd5 100644
--- a/chrome/browser/media/router/mojo/media_router_mojo_impl.h
+++ b/chrome/browser/media/router/mojo/media_router_mojo_impl.h
@@ -24,9 +24,9 @@
 #include "build/build_config.h"
 #include "chrome/browser/media/router/issue.h"
 #include "chrome/browser/media/router/issue_manager.h"
-#include "chrome/browser/media/router/media_router.mojom.h"
 #include "chrome/browser/media/router/media_router_base.h"
 #include "chrome/browser/media/router/media_routes_observer.h"
+#include "chrome/browser/media/router/mojo/media_router.mojom.h"
 #include "mojo/public/cpp/bindings/binding.h"
 
 namespace content {
diff --git a/chrome/browser/media/router/mojo/media_router_mojo_test.h b/chrome/browser/media/router/mojo/media_router_mojo_test.h
index 012a33f8..490373f 100644
--- a/chrome/browser/media/router/mojo/media_router_mojo_test.h
+++ b/chrome/browser/media/router/mojo/media_router_mojo_test.h
@@ -9,8 +9,8 @@
 
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
-#include "chrome/browser/media/router/media_router.mojom.h"
 #include "chrome/browser/media/router/mock_media_router.h"
+#include "chrome/browser/media/router/mojo/media_router.mojom.h"
 #include "chrome/browser/media/router/mojo/media_router_mojo_impl.h"
 #include "chrome/browser/media/router/test_helper.h"
 #include "chrome/test/base/testing_profile.h"
diff --git a/chrome/browser/media/router/mojo/media_router_type_converters.h b/chrome/browser/media/router/mojo/media_router_type_converters.h
index e0bc140b..c484382d 100644
--- a/chrome/browser/media/router/mojo/media_router_type_converters.h
+++ b/chrome/browser/media/router/mojo/media_router_type_converters.h
@@ -11,9 +11,9 @@
 #include "base/memory/scoped_ptr.h"
 #include "chrome/browser/media/router/issue.h"
 #include "chrome/browser/media/router/media_router.h"
-#include "chrome/browser/media/router/media_router.mojom.h"
 #include "chrome/browser/media/router/media_sink.h"
 #include "chrome/browser/media/router/media_source.h"
+#include "chrome/browser/media/router/mojo/media_router.mojom.h"
 #include "chrome/browser/media/router/route_request_result.h"
 #include "content/public/browser/presentation_session.h"
 #include "mojo/common/common_type_converters.h"
diff --git a/chrome/browser/memory/tab_manager.cc b/chrome/browser/memory/tab_manager.cc
index d65bc47..8e7a88a 100644
--- a/chrome/browser/memory/tab_manager.cc
+++ b/chrome/browser/memory/tab_manager.cc
@@ -661,8 +661,12 @@
   // NOTE: This mechanism relies on having a MemoryPressureMonitor
   // implementation that supports "CurrentPressureLevel". This is true on all
   // platforms on which TabManager is used.
+#if !defined(OS_CHROMEOS)
+  // Running GC under memory pressure can cause thrashing. Disable it on
+  // ChromeOS until the thrashing is fixed. crbug.com/588172.
   if (!under_memory_pressure_)
     DoChildProcessDispatch();
+#endif
 }
 
 bool TabManager::IsMediaTab(WebContents* contents) const {
diff --git a/chrome/browser/memory/tab_manager_unittest.cc b/chrome/browser/memory/tab_manager_unittest.cc
index 9becd48..eb88506 100644
--- a/chrome/browser/memory/tab_manager_unittest.cc
+++ b/chrome/browser/memory/tab_manager_unittest.cc
@@ -451,8 +451,15 @@
 
 }  // namespace
 
+// ChildProcessNotification is disabled on Chrome OS. crbug.com/588172.
+#if defined(OS_CHROMEOS)
+#define MAYBE_ChildProcessNotifications DISABLED_ChildProcessNotifications
+#else
+#define MAYBE_ChildProcessNotifications ChildProcessNotifications
+#endif
+
 // Ensure that memory pressure notifications are forwarded to child processes.
-TEST_F(TabManagerTest, ChildProcessNotifications) {
+TEST_F(TabManagerTest, MAYBE_ChildProcessNotifications) {
   TabManager tm;
 
   // Set up the tab strip.
diff --git a/chrome/browser/permissions/permission_uma_util.cc b/chrome/browser/permissions/permission_uma_util.cc
index a936af7..b27935e 100644
--- a/chrome/browser/permissions/permission_uma_util.cc
+++ b/chrome/browser/permissions/permission_uma_util.cc
@@ -35,22 +35,6 @@
 
 namespace {
 
-// Enum for UMA purposes, make sure you update histograms.xml if you add new
-// permission actions. Never delete or reorder an entry; only add new entries
-// immediately before PERMISSION_NUM
-enum PermissionAction {
-  GRANTED = 0,
-  DENIED = 1,
-  DISMISSED = 2,
-  IGNORED = 3,
-  REVOKED = 4,
-  REENABLED = 5,
-  REQUESTED = 6,
-
-  // Always keep this at the end.
-  PERMISSION_ACTION_NUM,
-};
-
 // Deprecated. This method is used for the single-dimensional RAPPOR metrics
 // that are being replaced by the multi-dimensional ones.
 const std::string GetRapporMetric(PermissionType permission,
diff --git a/chrome/browser/permissions/permission_uma_util.h b/chrome/browser/permissions/permission_uma_util.h
index deee1d7..1f5f24b 100644
--- a/chrome/browser/permissions/permission_uma_util.h
+++ b/chrome/browser/permissions/permission_uma_util.h
@@ -15,6 +15,22 @@
 enum class PermissionType;
 }  // namespace content
 
+// Enum for UMA purposes, make sure you update histograms.xml if you add new
+// permission actions. Never delete or reorder an entry; only add new entries
+// immediately before PERMISSION_NUM
+enum PermissionAction {
+  GRANTED = 0,
+  DENIED = 1,
+  DISMISSED = 2,
+  IGNORED = 3,
+  REVOKED = 4,
+  REENABLED = 5,
+  REQUESTED = 6,
+
+  // Always keep this at the end.
+  PERMISSION_ACTION_NUM,
+};
+
 // Provides a convenient way of logging UMA for permission related operations.
 class PermissionUmaUtil {
  public:
diff --git a/chrome/browser/permissions/permission_util.cc b/chrome/browser/permissions/permission_util.cc
index d4369c46..9cc8f04 100644
--- a/chrome/browser/permissions/permission_util.cc
+++ b/chrome/browser/permissions/permission_util.cc
@@ -5,6 +5,9 @@
 #include "chrome/browser/permissions/permission_util.h"
 
 #include "base/logging.h"
+#include "chrome/browser/content_settings/host_content_settings_map_factory.h"
+#include "chrome/browser/permissions/permission_uma_util.h"
+#include "components/content_settings/core/browser/host_content_settings_map.h"
 #include "content/public/browser/permission_type.h"
 
 using content::PermissionType;
@@ -69,3 +72,30 @@
   }
   return true;
 }
+
+void PermissionUtil::SetContentSettingAndRecordRevocation(
+    Profile* profile,
+    const GURL& primary_url,
+    const GURL& secondary_url,
+    ContentSettingsType content_type,
+    std::string resource_identifier,
+    ContentSetting setting) {
+  HostContentSettingsMap* map =
+      HostContentSettingsMapFactory::GetForProfile(profile);
+  ContentSetting previous_value = map->GetContentSetting(
+      primary_url, secondary_url, content_type, resource_identifier);
+
+  map->SetContentSettingDefaultScope(primary_url, secondary_url, content_type,
+                                     resource_identifier, setting);
+
+  ContentSetting final_value = map->GetContentSetting(
+      primary_url, secondary_url, content_type, resource_identifier);
+
+  if (previous_value == CONTENT_SETTING_ALLOW &&
+      final_value != CONTENT_SETTING_ALLOW) {
+    PermissionType permission_type;
+    if (PermissionUtil::GetPermissionType(content_type, &permission_type)) {
+      PermissionUmaUtil::PermissionRevoked(permission_type, primary_url);
+    }
+  }
+}
diff --git a/chrome/browser/permissions/permission_util.h b/chrome/browser/permissions/permission_util.h
index eb0e066..dcc9095 100644
--- a/chrome/browser/permissions/permission_util.h
+++ b/chrome/browser/permissions/permission_util.h
@@ -8,8 +8,12 @@
 #include <string>
 
 #include "base/macros.h"
+#include "components/content_settings/core/common/content_settings.h"
 #include "components/content_settings/core/common/content_settings_types.h"
 
+class GURL;
+class Profile;
+
 namespace content {
 enum class PermissionType;
 }  // namespace content
@@ -29,6 +33,23 @@
   static bool GetPermissionType(ContentSettingsType type,
                                 content::PermissionType* out);
 
+  // Helper method which proxies
+  // HostContentSettingsMap::SetContentSettingDefaultScope(). Checks the content
+  // setting value before and after the change to determine whether it has gone
+  // from ALLOW to BLOCK or ASK, and records metrics accordingly. Should be
+  // called from UI code when a user changes permissions for a particular origin
+  // pair.
+  // TODO(tsergeant): This is a temporary solution to begin gathering metrics.
+  // We should integrate this better with the permissions layer. See
+  // crbug.com/469221.
+  static void SetContentSettingAndRecordRevocation(
+      Profile* profile,
+      const GURL& primary_url,
+      const GURL& secondary_url,
+      ContentSettingsType content_type,
+      std::string resource_identifier,
+      ContentSetting setting);
+
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(PermissionUtil);
 };
diff --git a/chrome/browser/permissions/permission_util_unittest.cc b/chrome/browser/permissions/permission_util_unittest.cc
new file mode 100644
index 0000000..def5eb91
--- /dev/null
+++ b/chrome/browser/permissions/permission_util_unittest.cc
@@ -0,0 +1,54 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/test/histogram_tester.h"
+#include "chrome/browser/content_settings/host_content_settings_map_factory.h"
+#include "chrome/browser/permissions/permission_uma_util.h"
+#include "chrome/browser/permissions/permission_util.h"
+#include "chrome/test/base/testing_profile.h"
+#include "components/content_settings/core/browser/host_content_settings_map.h"
+#include "content/public/test/test_browser_thread_bundle.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+class PermissionUtilTest : public testing::Test {
+  content::TestBrowserThreadBundle thread_bundle_;
+};
+
+TEST_F(PermissionUtilTest, SetContentSettingRecordRevocation) {
+  TestingProfile profile;
+  // TODO(tsergeant): Add more comprehensive tests of PermissionUmaUtil.
+  base::HistogramTester histograms;
+  HostContentSettingsMap* map =
+      HostContentSettingsMapFactory::GetForProfile(&profile);
+  GURL host("https://example.com");
+  ContentSettingsType type = CONTENT_SETTINGS_TYPE_GEOLOCATION;
+
+  // Allow->Block triggers a revocation.
+  map->SetContentSettingDefaultScope(host, host, type, std::string(),
+                                     CONTENT_SETTING_ALLOW);
+  PermissionUtil::SetContentSettingAndRecordRevocation(
+      &profile, host, host, type, std::string(), CONTENT_SETTING_BLOCK);
+  histograms.ExpectBucketCount("Permissions.Action.Geolocation",
+                               PermissionAction::REVOKED, 1);
+
+  // Block->Allow does not trigger a revocation.
+  PermissionUtil::SetContentSettingAndRecordRevocation(
+      &profile, host, host, type, std::string(), CONTENT_SETTING_ALLOW);
+  histograms.ExpectBucketCount("Permissions.Action.Geolocation",
+                               PermissionAction::REVOKED, 1);
+
+  // Allow->Default triggers a revocation when default is 'ask'.
+  map->SetDefaultContentSetting(type, CONTENT_SETTING_ASK);
+  PermissionUtil::SetContentSettingAndRecordRevocation(
+      &profile, host, host, type, std::string(), CONTENT_SETTING_DEFAULT);
+  histograms.ExpectBucketCount("Permissions.Action.Geolocation",
+                               PermissionAction::REVOKED, 2);
+
+  // Allow->Default does not trigger a revocation when default is 'allow'.
+  map->SetDefaultContentSetting(type, CONTENT_SETTING_ALLOW);
+  PermissionUtil::SetContentSettingAndRecordRevocation(
+      &profile, host, host, type, std::string(), CONTENT_SETTING_DEFAULT);
+  histograms.ExpectBucketCount("Permissions.Action.Geolocation",
+                               PermissionAction::REVOKED, 2);
+}
diff --git a/chrome/browser/resources/chromeos/arc_support/background.js b/chrome/browser/resources/chromeos/arc_support/background.js
index bfeacdc..3643043 100644
--- a/chrome/browser/resources/chromeos/arc_support/background.js
+++ b/chrome/browser/resources/chromeos/arc_support/background.js
@@ -168,6 +168,12 @@
   var onAppContentLoad = function() {
     var doc = appWindow.contentWindow.document;
     webview = doc.getElementById('arc-support');
+    // Apply absolute dimension to webview tag in order to avoid UI glitch
+    // when embedded content layout is visible for user, even if 100% width and
+    // height are set in css file.
+    // TODO(khmel): Investigate why relative layout is not enough.
+    webview.style.width = appWindow.innerBounds.width + 'px';
+    webview.style.height = appWindow.innerBounds.height + 'px';
 
     var isApprovalResponse = function(url) {
       var resultUrlPrefix = 'https://accounts.google.com/o/oauth2/approval?';
diff --git a/chrome/browser/resources/chromeos/login/login_common.js b/chrome/browser/resources/chromeos/login/login_common.js
index cd48d35..ac76cfeb9 100644
--- a/chrome/browser/resources/chromeos/login/login_common.js
+++ b/chrome/browser/resources/chromeos/login/login_common.js
@@ -297,12 +297,6 @@
   Oobe.loginForTesting = function(username, password, gaia_id) {
     Oobe.disableSigninUI();
     chrome.send('skipToLoginForTesting', [username]);
-    if (!gaia_id) {
-      /* TODO (alemate): Remove this backward compatibility hack when
-         as soon as all telemetry tests will pass gaia_id directly.
-      */
-      gaia_id = '12345';
-    }
     chrome.send('completeLogin', [gaia_id, username, password, false]);
   };
 
diff --git a/chrome/browser/resources/md_downloads/crisper.js b/chrome/browser/resources/md_downloads/crisper.js
index 352b5bf7..efa2abf0 100644
--- a/chrome/browser/resources/md_downloads/crisper.js
+++ b/chrome/browser/resources/md_downloads/crisper.js
@@ -1431,10 +1431,19 @@
  * or when no paint happens during the animation). This function sets up
  * a timer and emulate the event if it is not fired when the timer expires.
  * @param {!HTMLElement} el The element to watch for webkitTransitionEnd.
- * @param {number} timeOut The maximum wait time in milliseconds for the
- *     webkitTransitionEnd to happen.
+ * @param {number=} opt_timeOut The maximum wait time in milliseconds for the
+ *     webkitTransitionEnd to happen. If not specified, it is fetched from |el|
+ *     using the transitionDuration style value.
  */
-function ensureTransitionEndEvent(el, timeOut) {
+function ensureTransitionEndEvent(el, opt_timeOut) {
+  if (opt_timeOut === undefined) {
+    var style = getComputedStyle(el);
+    opt_timeOut = parseFloat(style.transitionDuration) * 1000;
+
+    // Give an additional 50ms buffer for the animation to complete.
+    opt_timeOut += 50;
+  }
+
   var fired = false;
   el.addEventListener('webkitTransitionEnd', function f(e) {
     el.removeEventListener('webkitTransitionEnd', f);
@@ -1443,7 +1452,7 @@
   window.setTimeout(function() {
     if (!fired)
       cr.dispatchSimpleEvent(el, 'webkitTransitionEnd', true);
-  }, timeOut);
+  }, opt_timeOut);
 }
 
 /**
@@ -1522,369 +1531,6 @@
 function quoteString(str) {
   return str.replace(/([\\\.\+\*\?\[\^\]\$\(\)\{\}\=\!\<\>\|\:])/g, '\\$1');
 };
-// Copyright (c) 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-/**
- * @fileoverview Assertion support.
- */
-
-/**
- * Verify |condition| is truthy and return |condition| if so.
- * @template T
- * @param {T} condition A condition to check for truthiness.  Note that this
- *     may be used to test whether a value is defined or not, and we don't want
- *     to force a cast to Boolean.
- * @param {string=} opt_message A message to show on failure.
- * @return {T} A non-null |condition|.
- */
-function assert(condition, opt_message) {
-  if (!condition) {
-    var message = 'Assertion failed';
-    if (opt_message)
-      message = message + ': ' + opt_message;
-    var error = new Error(message);
-    var global = function() { return this; }();
-    if (global.traceAssertionsForTesting)
-      console.warn(error.stack);
-    throw error;
-  }
-  return condition;
-}
-
-/**
- * Call this from places in the code that should never be reached.
- *
- * For example, handling all the values of enum with a switch() like this:
- *
- *   function getValueFromEnum(enum) {
- *     switch (enum) {
- *       case ENUM_FIRST_OF_TWO:
- *         return first
- *       case ENUM_LAST_OF_TWO:
- *         return last;
- *     }
- *     assertNotReached();
- *     return document;
- *   }
- *
- * This code should only be hit in the case of serious programmer error or
- * unexpected input.
- *
- * @param {string=} opt_message A message to show when this is hit.
- */
-function assertNotReached(opt_message) {
-  assert(false, opt_message || 'Unreachable code hit');
-}
-
-/**
- * @param {*} value The value to check.
- * @param {function(new: T, ...)} type A user-defined constructor.
- * @param {string=} opt_message A message to show when this is hit.
- * @return {T}
- * @template T
- */
-function assertInstanceof(value, type, opt_message) {
-  // We don't use assert immediately here so that we avoid constructing an error
-  // message if we don't have to.
-  if (!(value instanceof type)) {
-    assertNotReached(opt_message || 'Value ' + value +
-                     ' is not a[n] ' + (type.name || typeof type));
-  }
-  return value;
-};
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-cr.define('downloads', function() {
-  /**
-   * @param {string} chromeSendName
-   * @return {function(string):void} A chrome.send() callback with curried name.
-   */
-  function chromeSendWithId(chromeSendName) {
-    return function(id) { chrome.send(chromeSendName, [id]); };
-  }
-
-  /** @constructor */
-  function ActionService() {
-    /** @private {Array<string>} */
-    this.searchTerms_ = [];
-  }
-
-  /**
-   * @param {string} s
-   * @return {string} |s| without whitespace at the beginning or end.
-   */
-  function trim(s) { return s.trim(); }
-
-  /**
-   * @param {string|undefined} value
-   * @return {boolean} Whether |value| is truthy.
-   */
-  function truthy(value) { return !!value; }
-
-  /**
-   * @param {string} searchText Input typed by the user into a search box.
-   * @return {Array<string>} A list of terms extracted from |searchText|.
-   */
-  ActionService.splitTerms = function(searchText) {
-    // Split quoted terms (e.g., 'The "lazy" dog' => ['The', 'lazy', 'dog']).
-    return searchText.split(/"([^"]*)"/).map(trim).filter(truthy);
-  };
-
-  ActionService.prototype = {
-    /** @param {string} id ID of the download to cancel. */
-    cancel: chromeSendWithId('cancel'),
-
-    /** Instructs the browser to clear all finished downloads. */
-    clearAll: function() {
-      if (loadTimeData.getBoolean('allowDeletingHistory')) {
-        chrome.send('clearAll');
-        this.search('');
-      }
-    },
-
-    /** @param {string} id ID of the dangerous download to discard. */
-    discardDangerous: chromeSendWithId('discardDangerous'),
-
-    /** @param {string} url URL of a file to download. */
-    download: function(url) {
-      var a = document.createElement('a');
-      a.href = url;
-      a.setAttribute('download', '');
-      a.click();
-    },
-
-    /** @param {string} id ID of the download that the user started dragging. */
-    drag: chromeSendWithId('drag'),
-
-    /** Loads more downloads with the current search terms. */
-    loadMore: function() {
-      chrome.send('getDownloads', this.searchTerms_);
-    },
-
-    /**
-     * @return {boolean} Whether the user is currently searching for downloads
-     *     (i.e. has a non-empty search term).
-     */
-    isSearching: function() {
-      return this.searchTerms_.length > 0;
-    },
-
-    /** Opens the current local destination for downloads. */
-    openDownloadsFolder: chrome.send.bind(chrome, 'openDownloadsFolder'),
-
-    /**
-     * @param {string} id ID of the download to run locally on the user's box.
-     */
-    openFile: chromeSendWithId('openFile'),
-
-    /** @param {string} id ID the of the progressing download to pause. */
-    pause: chromeSendWithId('pause'),
-
-    /** @param {string} id ID of the finished download to remove. */
-    remove: chromeSendWithId('remove'),
-
-    /** @param {string} id ID of the paused download to resume. */
-    resume: chromeSendWithId('resume'),
-
-    /**
-     * @param {string} id ID of the dangerous download to save despite
-     *     warnings.
-     */
-    saveDangerous: chromeSendWithId('saveDangerous'),
-
-    /** @param {string} searchText What to search for. */
-    search: function(searchText) {
-      var searchTerms = ActionService.splitTerms(searchText);
-      var sameTerms = searchTerms.length == this.searchTerms_.length;
-
-      for (var i = 0; sameTerms && i < searchTerms.length; ++i) {
-        if (searchTerms[i] != this.searchTerms_[i])
-          sameTerms = false;
-      }
-
-      if (sameTerms)
-        return;
-
-      this.searchTerms_ = searchTerms;
-      this.loadMore();
-    },
-
-    /**
-     * Shows the local folder a finished download resides in.
-     * @param {string} id ID of the download to show.
-     */
-    show: chromeSendWithId('show'),
-
-    /** Undo download removal. */
-    undo: chrome.send.bind(chrome, 'undo'),
-  };
-
-  cr.addSingletonGetter(ActionService);
-
-  return {ActionService: ActionService};
-});
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-cr.define('downloads', function() {
-  /**
-   * Explains why a download is in DANGEROUS state.
-   * @enum {string}
-   */
-  var DangerType = {
-    NOT_DANGEROUS: 'NOT_DANGEROUS',
-    DANGEROUS_FILE: 'DANGEROUS_FILE',
-    DANGEROUS_URL: 'DANGEROUS_URL',
-    DANGEROUS_CONTENT: 'DANGEROUS_CONTENT',
-    UNCOMMON_CONTENT: 'UNCOMMON_CONTENT',
-    DANGEROUS_HOST: 'DANGEROUS_HOST',
-    POTENTIALLY_UNWANTED: 'POTENTIALLY_UNWANTED',
-  };
-
-  /**
-   * The states a download can be in. These correspond to states defined in
-   * DownloadsDOMHandler::CreateDownloadItemValue
-   * @enum {string}
-   */
-  var States = {
-    IN_PROGRESS: 'IN_PROGRESS',
-    CANCELLED: 'CANCELLED',
-    COMPLETE: 'COMPLETE',
-    PAUSED: 'PAUSED',
-    DANGEROUS: 'DANGEROUS',
-    INTERRUPTED: 'INTERRUPTED',
-  };
-
-  return {
-    DangerType: DangerType,
-    States: States,
-  };
-});
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Action links are elements that are used to perform an in-page navigation or
-// action (e.g. showing a dialog).
-//
-// They look like normal anchor (<a>) tags as their text color is blue. However,
-// they're subtly different as they're not initially underlined (giving users a
-// clue that underlined links navigate while action links don't).
-//
-// Action links look very similar to normal links when hovered (hand cursor,
-// underlined). This gives the user an idea that clicking this link will do
-// something similar to navigation but in the same page.
-//
-// They can be created in JavaScript like this:
-//
-//   var link = document.createElement('a', 'action-link');  // Note second arg.
-//
-// or with a constructor like this:
-//
-//   var link = new ActionLink();
-//
-// They can be used easily from HTML as well, like so:
-//
-//   <a is="action-link">Click me!</a>
-//
-// NOTE: <action-link> and document.createElement('action-link') don't work.
-
-/**
- * @constructor
- * @extends {HTMLAnchorElement}
- */
-var ActionLink = document.registerElement('action-link', {
-  prototype: {
-    __proto__: HTMLAnchorElement.prototype,
-
-    /** @this {ActionLink} */
-    createdCallback: function() {
-      // Action links can start disabled (e.g. <a is="action-link" disabled>).
-      this.tabIndex = this.disabled ? -1 : 0;
-
-      if (!this.hasAttribute('role'))
-        this.setAttribute('role', 'link');
-
-      this.addEventListener('keydown', function(e) {
-        if (!this.disabled && e.keyIdentifier == 'Enter' && !this.href) {
-          // Schedule a click asynchronously because other 'keydown' handlers
-          // may still run later (e.g. document.addEventListener('keydown')).
-          // Specifically options dialogs break when this timeout isn't here.
-          // NOTE: this affects the "trusted" state of the ensuing click. I
-          // haven't found anything that breaks because of this (yet).
-          window.setTimeout(this.click.bind(this), 0);
-        }
-      });
-
-      function preventDefault(e) {
-        e.preventDefault();
-      }
-
-      function removePreventDefault() {
-        document.removeEventListener('selectstart', preventDefault);
-        document.removeEventListener('mouseup', removePreventDefault);
-      }
-
-      this.addEventListener('mousedown', function() {
-        // This handlers strives to match the behavior of <a href="...">.
-
-        // While the mouse is down, prevent text selection from dragging.
-        document.addEventListener('selectstart', preventDefault);
-        document.addEventListener('mouseup', removePreventDefault);
-
-        // If focus started via mouse press, don't show an outline.
-        if (document.activeElement != this)
-          this.classList.add('no-outline');
-      });
-
-      this.addEventListener('blur', function() {
-        this.classList.remove('no-outline');
-      });
-    },
-
-    /** @type {boolean} */
-    set disabled(disabled) {
-      if (disabled)
-        HTMLAnchorElement.prototype.setAttribute.call(this, 'disabled', '');
-      else
-        HTMLAnchorElement.prototype.removeAttribute.call(this, 'disabled');
-      this.tabIndex = disabled ? -1 : 0;
-    },
-    get disabled() {
-      return this.hasAttribute('disabled');
-    },
-
-    /** @override */
-    setAttribute: function(attr, val) {
-      if (attr.toLowerCase() == 'disabled')
-        this.disabled = true;
-      else
-        HTMLAnchorElement.prototype.setAttribute.apply(this, arguments);
-    },
-
-    /** @override */
-    removeAttribute: function(attr) {
-      if (attr.toLowerCase() == 'disabled')
-        this.disabled = false;
-      else
-        HTMLAnchorElement.prototype.removeAttribute.apply(this, arguments);
-    },
-  },
-
-  extends: 'a',
-});
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// <include src="../../../../ui/webui/resources/js/i18n_template_no_process.js">
-
-i18nTemplate.process(document, loadTimeData);
 /**
    * `IronResizableBehavior` is a behavior that can be used in Polymer elements to
    * coordinate the flow of resize events between "resizers" (elements that control the
@@ -2145,6 +1791,13 @@
     var SPACE_KEY = /^space(bar)?/;
 
     /**
+     * Matches ESC key.
+     *
+     * Value from: http://w3c.github.io/uievents-key/#key-Escape
+     */
+    var ESC_KEY = /^escape$/;
+
+    /**
      * Transforms the key.
      * @param {string} key The KeyBoardEvent.key
      * @param {Boolean} [noSpecialChars] Limits the transformation to
@@ -2156,6 +1809,8 @@
         var lKey = key.toLowerCase();
         if (lKey === ' ' || SPACE_KEY.test(lKey)) {
           validKey = 'space';
+        } else if (ESC_KEY.test(lKey)) {
+          validKey = 'esc';
         } else if (lKey.length == 1) {
           if (!noSpecialChars || KEY_CHAR.test(lKey)) {
             validKey = lKey;
@@ -2199,10 +1854,10 @@
           validKey = 'f' + (keyCode - 112);
         } else if (keyCode >= 48 && keyCode <= 57) {
           // top 0-9 keys
-          validKey = String(48 - keyCode);
+          validKey = String(keyCode - 48);
         } else if (keyCode >= 96 && keyCode <= 105) {
           // num pad 0-9
-          validKey = String(96 - keyCode);
+          validKey = String(keyCode - 96);
         } else {
           validKey = KEY_CODE[keyCode];
         }
@@ -2367,6 +2022,13 @@
         this._resetKeyEventListeners();
       },
 
+      /**
+       * Returns true if a keyboard event matches `eventString`.
+       *
+       * @param {KeyboardEvent} event
+       * @param {string} eventString
+       * @return {boolean}
+       */
       keyboardEventMatchesKeys: function(event, eventString) {
         var keyCombos = parseEventString(eventString);
         for (var i = 0; i < keyCombos.length; ++i) {
@@ -4099,6 +3761,362 @@
   });
 
 })();
+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/**
+ * @fileoverview Assertion support.
+ */
+
+/**
+ * Verify |condition| is truthy and return |condition| if so.
+ * @template T
+ * @param {T} condition A condition to check for truthiness.  Note that this
+ *     may be used to test whether a value is defined or not, and we don't want
+ *     to force a cast to Boolean.
+ * @param {string=} opt_message A message to show on failure.
+ * @return {T} A non-null |condition|.
+ */
+function assert(condition, opt_message) {
+  if (!condition) {
+    var message = 'Assertion failed';
+    if (opt_message)
+      message = message + ': ' + opt_message;
+    var error = new Error(message);
+    var global = function() { return this; }();
+    if (global.traceAssertionsForTesting)
+      console.warn(error.stack);
+    throw error;
+  }
+  return condition;
+}
+
+/**
+ * Call this from places in the code that should never be reached.
+ *
+ * For example, handling all the values of enum with a switch() like this:
+ *
+ *   function getValueFromEnum(enum) {
+ *     switch (enum) {
+ *       case ENUM_FIRST_OF_TWO:
+ *         return first
+ *       case ENUM_LAST_OF_TWO:
+ *         return last;
+ *     }
+ *     assertNotReached();
+ *     return document;
+ *   }
+ *
+ * This code should only be hit in the case of serious programmer error or
+ * unexpected input.
+ *
+ * @param {string=} opt_message A message to show when this is hit.
+ */
+function assertNotReached(opt_message) {
+  assert(false, opt_message || 'Unreachable code hit');
+}
+
+/**
+ * @param {*} value The value to check.
+ * @param {function(new: T, ...)} type A user-defined constructor.
+ * @param {string=} opt_message A message to show when this is hit.
+ * @return {T}
+ * @template T
+ */
+function assertInstanceof(value, type, opt_message) {
+  // We don't use assert immediately here so that we avoid constructing an error
+  // message if we don't have to.
+  if (!(value instanceof type)) {
+    assertNotReached(opt_message || 'Value ' + value +
+                     ' is not a[n] ' + (type.name || typeof type));
+  }
+  return value;
+};
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+cr.define('downloads', function() {
+  /**
+   * @param {string} chromeSendName
+   * @return {function(string):void} A chrome.send() callback with curried name.
+   */
+  function chromeSendWithId(chromeSendName) {
+    return function(id) { chrome.send(chromeSendName, [id]); };
+  }
+
+  /** @constructor */
+  function ActionService() {
+    /** @private {Array<string>} */
+    this.searchTerms_ = [];
+  }
+
+  /**
+   * @param {string} s
+   * @return {string} |s| without whitespace at the beginning or end.
+   */
+  function trim(s) { return s.trim(); }
+
+  /**
+   * @param {string|undefined} value
+   * @return {boolean} Whether |value| is truthy.
+   */
+  function truthy(value) { return !!value; }
+
+  /**
+   * @param {string} searchText Input typed by the user into a search box.
+   * @return {Array<string>} A list of terms extracted from |searchText|.
+   */
+  ActionService.splitTerms = function(searchText) {
+    // Split quoted terms (e.g., 'The "lazy" dog' => ['The', 'lazy', 'dog']).
+    return searchText.split(/"([^"]*)"/).map(trim).filter(truthy);
+  };
+
+  ActionService.prototype = {
+    /** @param {string} id ID of the download to cancel. */
+    cancel: chromeSendWithId('cancel'),
+
+    /** Instructs the browser to clear all finished downloads. */
+    clearAll: function() {
+      if (loadTimeData.getBoolean('allowDeletingHistory')) {
+        chrome.send('clearAll');
+        this.search('');
+      }
+    },
+
+    /** @param {string} id ID of the dangerous download to discard. */
+    discardDangerous: chromeSendWithId('discardDangerous'),
+
+    /** @param {string} url URL of a file to download. */
+    download: function(url) {
+      var a = document.createElement('a');
+      a.href = url;
+      a.setAttribute('download', '');
+      a.click();
+    },
+
+    /** @param {string} id ID of the download that the user started dragging. */
+    drag: chromeSendWithId('drag'),
+
+    /** Loads more downloads with the current search terms. */
+    loadMore: function() {
+      chrome.send('getDownloads', this.searchTerms_);
+    },
+
+    /**
+     * @return {boolean} Whether the user is currently searching for downloads
+     *     (i.e. has a non-empty search term).
+     */
+    isSearching: function() {
+      return this.searchTerms_.length > 0;
+    },
+
+    /** Opens the current local destination for downloads. */
+    openDownloadsFolder: chrome.send.bind(chrome, 'openDownloadsFolder'),
+
+    /**
+     * @param {string} id ID of the download to run locally on the user's box.
+     */
+    openFile: chromeSendWithId('openFile'),
+
+    /** @param {string} id ID the of the progressing download to pause. */
+    pause: chromeSendWithId('pause'),
+
+    /** @param {string} id ID of the finished download to remove. */
+    remove: chromeSendWithId('remove'),
+
+    /** @param {string} id ID of the paused download to resume. */
+    resume: chromeSendWithId('resume'),
+
+    /**
+     * @param {string} id ID of the dangerous download to save despite
+     *     warnings.
+     */
+    saveDangerous: chromeSendWithId('saveDangerous'),
+
+    /** @param {string} searchText What to search for. */
+    search: function(searchText) {
+      var searchTerms = ActionService.splitTerms(searchText);
+      var sameTerms = searchTerms.length == this.searchTerms_.length;
+
+      for (var i = 0; sameTerms && i < searchTerms.length; ++i) {
+        if (searchTerms[i] != this.searchTerms_[i])
+          sameTerms = false;
+      }
+
+      if (sameTerms)
+        return;
+
+      this.searchTerms_ = searchTerms;
+      this.loadMore();
+    },
+
+    /**
+     * Shows the local folder a finished download resides in.
+     * @param {string} id ID of the download to show.
+     */
+    show: chromeSendWithId('show'),
+
+    /** Undo download removal. */
+    undo: chrome.send.bind(chrome, 'undo'),
+  };
+
+  cr.addSingletonGetter(ActionService);
+
+  return {ActionService: ActionService};
+});
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+cr.define('downloads', function() {
+  /**
+   * Explains why a download is in DANGEROUS state.
+   * @enum {string}
+   */
+  var DangerType = {
+    NOT_DANGEROUS: 'NOT_DANGEROUS',
+    DANGEROUS_FILE: 'DANGEROUS_FILE',
+    DANGEROUS_URL: 'DANGEROUS_URL',
+    DANGEROUS_CONTENT: 'DANGEROUS_CONTENT',
+    UNCOMMON_CONTENT: 'UNCOMMON_CONTENT',
+    DANGEROUS_HOST: 'DANGEROUS_HOST',
+    POTENTIALLY_UNWANTED: 'POTENTIALLY_UNWANTED',
+  };
+
+  /**
+   * The states a download can be in. These correspond to states defined in
+   * DownloadsDOMHandler::CreateDownloadItemValue
+   * @enum {string}
+   */
+  var States = {
+    IN_PROGRESS: 'IN_PROGRESS',
+    CANCELLED: 'CANCELLED',
+    COMPLETE: 'COMPLETE',
+    PAUSED: 'PAUSED',
+    DANGEROUS: 'DANGEROUS',
+    INTERRUPTED: 'INTERRUPTED',
+  };
+
+  return {
+    DangerType: DangerType,
+    States: States,
+  };
+});
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Action links are elements that are used to perform an in-page navigation or
+// action (e.g. showing a dialog).
+//
+// They look like normal anchor (<a>) tags as their text color is blue. However,
+// they're subtly different as they're not initially underlined (giving users a
+// clue that underlined links navigate while action links don't).
+//
+// Action links look very similar to normal links when hovered (hand cursor,
+// underlined). This gives the user an idea that clicking this link will do
+// something similar to navigation but in the same page.
+//
+// They can be created in JavaScript like this:
+//
+//   var link = document.createElement('a', 'action-link');  // Note second arg.
+//
+// or with a constructor like this:
+//
+//   var link = new ActionLink();
+//
+// They can be used easily from HTML as well, like so:
+//
+//   <a is="action-link">Click me!</a>
+//
+// NOTE: <action-link> and document.createElement('action-link') don't work.
+
+/**
+ * @constructor
+ * @extends {HTMLAnchorElement}
+ */
+var ActionLink = document.registerElement('action-link', {
+  prototype: {
+    __proto__: HTMLAnchorElement.prototype,
+
+    /** @this {ActionLink} */
+    createdCallback: function() {
+      // Action links can start disabled (e.g. <a is="action-link" disabled>).
+      this.tabIndex = this.disabled ? -1 : 0;
+
+      if (!this.hasAttribute('role'))
+        this.setAttribute('role', 'link');
+
+      this.addEventListener('keydown', function(e) {
+        if (!this.disabled && e.keyIdentifier == 'Enter' && !this.href) {
+          // Schedule a click asynchronously because other 'keydown' handlers
+          // may still run later (e.g. document.addEventListener('keydown')).
+          // Specifically options dialogs break when this timeout isn't here.
+          // NOTE: this affects the "trusted" state of the ensuing click. I
+          // haven't found anything that breaks because of this (yet).
+          window.setTimeout(this.click.bind(this), 0);
+        }
+      });
+
+      function preventDefault(e) {
+        e.preventDefault();
+      }
+
+      function removePreventDefault() {
+        document.removeEventListener('selectstart', preventDefault);
+        document.removeEventListener('mouseup', removePreventDefault);
+      }
+
+      this.addEventListener('mousedown', function() {
+        // This handlers strives to match the behavior of <a href="...">.
+
+        // While the mouse is down, prevent text selection from dragging.
+        document.addEventListener('selectstart', preventDefault);
+        document.addEventListener('mouseup', removePreventDefault);
+
+        // If focus started via mouse press, don't show an outline.
+        if (document.activeElement != this)
+          this.classList.add('no-outline');
+      });
+
+      this.addEventListener('blur', function() {
+        this.classList.remove('no-outline');
+      });
+    },
+
+    /** @type {boolean} */
+    set disabled(disabled) {
+      if (disabled)
+        HTMLAnchorElement.prototype.setAttribute.call(this, 'disabled', '');
+      else
+        HTMLAnchorElement.prototype.removeAttribute.call(this, 'disabled');
+      this.tabIndex = disabled ? -1 : 0;
+    },
+    get disabled() {
+      return this.hasAttribute('disabled');
+    },
+
+    /** @override */
+    setAttribute: function(attr, val) {
+      if (attr.toLowerCase() == 'disabled')
+        this.disabled = true;
+      else
+        HTMLAnchorElement.prototype.setAttribute.apply(this, arguments);
+    },
+
+    /** @override */
+    removeAttribute: function(attr) {
+      if (attr.toLowerCase() == 'disabled')
+        this.disabled = false;
+      else
+        HTMLAnchorElement.prototype.removeAttribute.apply(this, arguments);
+    },
+  },
+
+  extends: 'a',
+});
 (function() {
 
     // monostate data
@@ -9947,7 +9965,7 @@
 `prevent-invalid-input` and `allowed-pattern` attributes together to accomplish this. This feature
 is separate from validation, and `allowed-pattern` does not affect how the input is validated.
 
-    <!-- only allow characters that match [0-9] -->
+    \x3c!-- only allow characters that match [0-9] --\x3e
     <input is="iron-input" prevent-invalid-input allowed-pattern="[0-9]">
 
 @hero hero.svg
@@ -10477,26 +10495,42 @@
     return searchInput ? searchInput.value : '';
   },
 
+  /**
+   * Sets the value of the search field, if it exists.
+   * @param {string} value
+   */
+  setValue: function(value) {
+    var searchInput = this.getSearchInput_();
+    if (searchInput)
+      searchInput.value = value;
+  },
+
   /** @param {SearchFieldDelegate} delegate */
   setDelegate: function(delegate) {
     this.delegate_ = delegate;
   },
 
+  /** @return {Promise<boolean>} */
   showAndFocus: function() {
     this.showingSearch_ = true;
-    this.focus_();
+    return this.focus_();
   },
 
-  /** @private */
+  /**
+   * @return {Promise<boolean>}
+   * @private
+   */
   focus_: function() {
-    this.async(function() {
-      if (!this.showingSearch_)
-        return;
-
-      var searchInput = this.getSearchInput_();
-      if (searchInput)
-        searchInput.focus();
-    });
+    return new Promise(function(resolve) {
+      this.async(function() {
+        if (this.showingSearch_) {
+          var searchInput = this.getSearchInput_();
+          if (searchInput)
+            searchInput.focus();
+        }
+        resolve(this.showingSearch_);
+      });
+    }.bind(this));
   },
 
   /**
@@ -10823,6 +10857,13 @@
 
   return {Manager: Manager};
 });
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// <include src="../../../../ui/webui/resources/js/i18n_template_no_process.js">
+
+i18nTemplate.process(document, loadTimeData);
 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
diff --git a/chrome/browser/resources/md_downloads/vulcanize.py b/chrome/browser/resources/md_downloads/vulcanize.py
index 3ef22dc..673b0d5 100755
--- a/chrome/browser/resources/md_downloads/vulcanize.py
+++ b/chrome/browser/resources/md_downloads/vulcanize.py
@@ -31,10 +31,7 @@
   '--exclude', 'crisper.js',
 
   # These files are already combined and minified.
-  '--exclude', 'polymer-extracted.js',
-  '--exclude', 'polymer-micro-extracted.js',
-  '--exclude', 'polymer-mini-extracted.js',
-  '--exclude', 'polymer_config.js',
+  '--exclude', 'chrome://resources/html/polymer.html',
   '--exclude', 'web-animations-next-lite.min.js',
 
   # These files are dynamically created by C++.
diff --git a/chrome/browser/resources/md_downloads/vulcanized.html b/chrome/browser/resources/md_downloads/vulcanized.html
index d46d884..99498224 100644
--- a/chrome/browser/resources/md_downloads/vulcanized.html
+++ b/chrome/browser/resources/md_downloads/vulcanized.html
@@ -14,14 +14,6 @@
 The complete set of contributors may be found at http://polymer.github.io/CONTRIBUTORS.txt
 Code distributed by Google as part of the polymer project is also
 subject to an additional IP rights grant found at http://polymer.github.io/PATENTS.txt
---><!--
-@license
-Copyright (c) 2014 The Polymer Project Authors. All rights reserved.
-This code may only be used under the BSD style license found at http://polymer.github.io/LICENSE.txt
-The complete set of authors may be found at http://polymer.github.io/AUTHORS.txt
-The complete set of contributors may be found at http://polymer.github.io/CONTRIBUTORS.txt
-Code distributed by Google as part of the polymer project is also
-subject to an additional IP rights grant found at http://polymer.github.io/PATENTS.txt
 -->
   <meta charset="utf-8">
   <title i18n-content="title"></title>
@@ -41,9 +33,47 @@
       margin: 0;
     }
   </style>
-<script src="chrome://resources/js/polymer_config.js"></script>
-<script src="chrome://resources/js/load_time_data.js"></script>
+</head>
+<body><div hidden="" by-vulcanize=""><script src="chrome://resources/js/load_time_data.js"></script>
 <script src="chrome://downloads/strings.js"></script>
+<dom-module id="iron-list" assetpath="chrome://resources/polymer/v1_0/iron-list/">
+  <template>
+    <style>
+      :host {
+        display: block;
+        position: relative;
+      }
+
+      @media only screen and (-webkit-max-device-pixel-ratio: 1) {
+        :host {
+          will-change: transform;
+        }
+      }
+
+      #items {
+        @apply(--iron-list-items-container);
+        position: relative;
+      }
+
+      #items > ::content > * {
+        width: 100%;
+        box-sizing: border-box;
+        position: absolute;
+        top: 0;
+        will-change: transform;
+      }
+    </style>
+
+    <array-selector id="selector" items="{{items}}" selected="{{selectedItems}}" selected-item="{{selectedItem}}">
+    </array-selector>
+
+    <div id="items">
+      <content></content>
+    </div>
+
+  </template>
+</dom-module>
+
 <style>
   /* IE 10 support for HTML5 hidden attr */
   [hidden] {
@@ -348,701 +378,6 @@
 </style>
 
 
-
-
-<style is="custom-style">
-
-  :root {
-
-    --shadow-transition: {
-      transition: box-shadow 0.28s cubic-bezier(0.4, 0, 0.2, 1);
-    };
-
-    --shadow-none: {
-      box-shadow: none;
-    };
-
-    /* from http://codepen.io/shyndman/pen/c5394ddf2e8b2a5c9185904b57421cdb */
-
-    --shadow-elevation-2dp: {
-      box-shadow: 0 2px 2px 0 rgba(0, 0, 0, 0.14),
-                  0 1px 5px 0 rgba(0, 0, 0, 0.12),
-                  0 3px 1px -2px rgba(0, 0, 0, 0.2);
-    };
-
-    --shadow-elevation-3dp: {
-      box-shadow: 0 3px 4px 0 rgba(0, 0, 0, 0.14),
-                  0 1px 8px 0 rgba(0, 0, 0, 0.12),
-                  0 3px 3px -2px rgba(0, 0, 0, 0.4);
-    };
-
-    --shadow-elevation-4dp: {
-      box-shadow: 0 4px 5px 0 rgba(0, 0, 0, 0.14),
-                  0 1px 10px 0 rgba(0, 0, 0, 0.12),
-                  0 2px 4px -1px rgba(0, 0, 0, 0.4);
-    };
-
-    --shadow-elevation-6dp: {
-      box-shadow: 0 6px 10px 0 rgba(0, 0, 0, 0.14),
-                  0 1px 18px 0 rgba(0, 0, 0, 0.12),
-                  0 3px 5px -1px rgba(0, 0, 0, 0.4);
-    };
-
-    --shadow-elevation-8dp: {
-      box-shadow: 0 8px 10px 1px rgba(0, 0, 0, 0.14),
-                  0 3px 14px 2px rgba(0, 0, 0, 0.12),
-                  0 5px 5px -3px rgba(0, 0, 0, 0.4);
-    };
-
-    --shadow-elevation-12dp: {
-      box-shadow: 0 12px 16px 1px rgba(0, 0, 0, 0.14),
-                  0 4px 22px 3px rgba(0, 0, 0, 0.12),
-                  0 6px 7px -4px rgba(0, 0, 0, 0.4);
-    };
-
-    --shadow-elevation-16dp: {
-      box-shadow: 0 16px 24px 2px rgba(0, 0, 0, 0.14),
-                  0  6px 30px 5px rgba(0, 0, 0, 0.12),
-                  0  8px 10px -5px rgba(0, 0, 0, 0.4);
-    };
-
-  }
-
-</style>
-
-
-
-
-<style is="custom-style">
-
-  :root {
-
-    /* Material Design color palette for Google products */
-
-    --google-red-100: #f4c7c3;
-    --google-red-300: #e67c73;
-    --google-red-500: #db4437;
-    --google-red-700: #c53929;
-
-    --google-blue-100: #c6dafc;
-    --google-blue-300: #7baaf7;
-    --google-blue-500: #4285f4;
-    --google-blue-700: #3367d6;
-
-    --google-green-100: #b7e1cd;
-    --google-green-300: #57bb8a;
-    --google-green-500: #0f9d58;
-    --google-green-700: #0b8043;
-
-    --google-yellow-100: #fce8b2;
-    --google-yellow-300: #f7cb4d;
-    --google-yellow-500: #f4b400;
-    --google-yellow-700: #f09300;
-
-    --google-grey-100: #f5f5f5;
-    --google-grey-300: #e0e0e0;
-    --google-grey-500: #9e9e9e;
-    --google-grey-700: #616161;
-    
-    /* Material Design color palette from online spec document */
-
-    --paper-red-50: #ffebee;
-    --paper-red-100: #ffcdd2;
-    --paper-red-200: #ef9a9a;
-    --paper-red-300: #e57373;
-    --paper-red-400: #ef5350;
-    --paper-red-500: #f44336;
-    --paper-red-600: #e53935;
-    --paper-red-700: #d32f2f;
-    --paper-red-800: #c62828;
-    --paper-red-900: #b71c1c;
-    --paper-red-a100: #ff8a80;
-    --paper-red-a200: #ff5252;
-    --paper-red-a400: #ff1744;
-    --paper-red-a700: #d50000;
- 
-    --paper-pink-50: #fce4ec;
-    --paper-pink-100: #f8bbd0;
-    --paper-pink-200: #f48fb1;
-    --paper-pink-300: #f06292;
-    --paper-pink-400: #ec407a;
-    --paper-pink-500: #e91e63;
-    --paper-pink-600: #d81b60;
-    --paper-pink-700: #c2185b;
-    --paper-pink-800: #ad1457;
-    --paper-pink-900: #880e4f;
-    --paper-pink-a100: #ff80ab;
-    --paper-pink-a200: #ff4081;
-    --paper-pink-a400: #f50057;
-    --paper-pink-a700: #c51162;
- 
-    --paper-purple-50: #f3e5f5;
-    --paper-purple-100: #e1bee7;
-    --paper-purple-200: #ce93d8;
-    --paper-purple-300: #ba68c8;
-    --paper-purple-400: #ab47bc;
-    --paper-purple-500: #9c27b0;
-    --paper-purple-600: #8e24aa;
-    --paper-purple-700: #7b1fa2;
-    --paper-purple-800: #6a1b9a;
-    --paper-purple-900: #4a148c;
-    --paper-purple-a100: #ea80fc;
-    --paper-purple-a200: #e040fb;
-    --paper-purple-a400: #d500f9;
-    --paper-purple-a700: #aa00ff;
- 
-    --paper-deep-purple-50: #ede7f6;
-    --paper-deep-purple-100: #d1c4e9;
-    --paper-deep-purple-200: #b39ddb;
-    --paper-deep-purple-300: #9575cd;
-    --paper-deep-purple-400: #7e57c2;
-    --paper-deep-purple-500: #673ab7;
-    --paper-deep-purple-600: #5e35b1;
-    --paper-deep-purple-700: #512da8;
-    --paper-deep-purple-800: #4527a0;
-    --paper-deep-purple-900: #311b92;
-    --paper-deep-purple-a100: #b388ff;
-    --paper-deep-purple-a200: #7c4dff;
-    --paper-deep-purple-a400: #651fff;
-    --paper-deep-purple-a700: #6200ea;
- 
-    --paper-indigo-50: #e8eaf6;
-    --paper-indigo-100: #c5cae9;
-    --paper-indigo-200: #9fa8da;
-    --paper-indigo-300: #7986cb;
-    --paper-indigo-400: #5c6bc0;
-    --paper-indigo-500: #3f51b5;
-    --paper-indigo-600: #3949ab;
-    --paper-indigo-700: #303f9f;
-    --paper-indigo-800: #283593;
-    --paper-indigo-900: #1a237e;
-    --paper-indigo-a100: #8c9eff;
-    --paper-indigo-a200: #536dfe;
-    --paper-indigo-a400: #3d5afe;
-    --paper-indigo-a700: #304ffe;
- 
-    --paper-blue-50: #e3f2fd;
-    --paper-blue-100: #bbdefb;
-    --paper-blue-200: #90caf9;
-    --paper-blue-300: #64b5f6;
-    --paper-blue-400: #42a5f5;
-    --paper-blue-500: #2196f3;
-    --paper-blue-600: #1e88e5;
-    --paper-blue-700: #1976d2;
-    --paper-blue-800: #1565c0;
-    --paper-blue-900: #0d47a1;
-    --paper-blue-a100: #82b1ff;
-    --paper-blue-a200: #448aff;
-    --paper-blue-a400: #2979ff;
-    --paper-blue-a700: #2962ff;
- 
-    --paper-light-blue-50: #e1f5fe;
-    --paper-light-blue-100: #b3e5fc;
-    --paper-light-blue-200: #81d4fa;
-    --paper-light-blue-300: #4fc3f7;
-    --paper-light-blue-400: #29b6f6;
-    --paper-light-blue-500: #03a9f4;
-    --paper-light-blue-600: #039be5;
-    --paper-light-blue-700: #0288d1;
-    --paper-light-blue-800: #0277bd;
-    --paper-light-blue-900: #01579b;
-    --paper-light-blue-a100: #80d8ff;
-    --paper-light-blue-a200: #40c4ff;
-    --paper-light-blue-a400: #00b0ff;
-    --paper-light-blue-a700: #0091ea;
- 
-    --paper-cyan-50: #e0f7fa;
-    --paper-cyan-100: #b2ebf2;
-    --paper-cyan-200: #80deea;
-    --paper-cyan-300: #4dd0e1;
-    --paper-cyan-400: #26c6da;
-    --paper-cyan-500: #00bcd4;
-    --paper-cyan-600: #00acc1;
-    --paper-cyan-700: #0097a7;
-    --paper-cyan-800: #00838f;
-    --paper-cyan-900: #006064;
-    --paper-cyan-a100: #84ffff;
-    --paper-cyan-a200: #18ffff;
-    --paper-cyan-a400: #00e5ff;
-    --paper-cyan-a700: #00b8d4;
- 
-    --paper-teal-50: #e0f2f1;
-    --paper-teal-100: #b2dfdb;
-    --paper-teal-200: #80cbc4;
-    --paper-teal-300: #4db6ac;
-    --paper-teal-400: #26a69a;
-    --paper-teal-500: #009688;
-    --paper-teal-600: #00897b;
-    --paper-teal-700: #00796b;
-    --paper-teal-800: #00695c;
-    --paper-teal-900: #004d40;
-    --paper-teal-a100: #a7ffeb;
-    --paper-teal-a200: #64ffda;
-    --paper-teal-a400: #1de9b6;
-    --paper-teal-a700: #00bfa5;
- 
-    --paper-green-50: #e8f5e9;
-    --paper-green-100: #c8e6c9;
-    --paper-green-200: #a5d6a7;
-    --paper-green-300: #81c784;
-    --paper-green-400: #66bb6a;
-    --paper-green-500: #4caf50;
-    --paper-green-600: #43a047;
-    --paper-green-700: #388e3c;
-    --paper-green-800: #2e7d32;
-    --paper-green-900: #1b5e20;
-    --paper-green-a100: #b9f6ca;
-    --paper-green-a200: #69f0ae;
-    --paper-green-a400: #00e676;
-    --paper-green-a700: #00c853;
- 
-    --paper-light-green-50: #f1f8e9;
-    --paper-light-green-100: #dcedc8;
-    --paper-light-green-200: #c5e1a5;
-    --paper-light-green-300: #aed581;
-    --paper-light-green-400: #9ccc65;
-    --paper-light-green-500: #8bc34a;
-    --paper-light-green-600: #7cb342;
-    --paper-light-green-700: #689f38;
-    --paper-light-green-800: #558b2f;
-    --paper-light-green-900: #33691e;
-    --paper-light-green-a100: #ccff90;
-    --paper-light-green-a200: #b2ff59;
-    --paper-light-green-a400: #76ff03;
-    --paper-light-green-a700: #64dd17;
- 
-    --paper-lime-50: #f9fbe7;
-    --paper-lime-100: #f0f4c3;
-    --paper-lime-200: #e6ee9c;
-    --paper-lime-300: #dce775;
-    --paper-lime-400: #d4e157;
-    --paper-lime-500: #cddc39;
-    --paper-lime-600: #c0ca33;
-    --paper-lime-700: #afb42b;
-    --paper-lime-800: #9e9d24;
-    --paper-lime-900: #827717;
-    --paper-lime-a100: #f4ff81;
-    --paper-lime-a200: #eeff41;
-    --paper-lime-a400: #c6ff00;
-    --paper-lime-a700: #aeea00;
- 
-    --paper-yellow-50: #fffde7;
-    --paper-yellow-100: #fff9c4;
-    --paper-yellow-200: #fff59d;
-    --paper-yellow-300: #fff176;
-    --paper-yellow-400: #ffee58;
-    --paper-yellow-500: #ffeb3b;
-    --paper-yellow-600: #fdd835;
-    --paper-yellow-700: #fbc02d;
-    --paper-yellow-800: #f9a825;
-    --paper-yellow-900: #f57f17;
-    --paper-yellow-a100: #ffff8d;
-    --paper-yellow-a200: #ffff00;
-    --paper-yellow-a400: #ffea00;
-    --paper-yellow-a700: #ffd600;
- 
-    --paper-amber-50: #fff8e1;
-    --paper-amber-100: #ffecb3;
-    --paper-amber-200: #ffe082;
-    --paper-amber-300: #ffd54f;
-    --paper-amber-400: #ffca28;
-    --paper-amber-500: #ffc107;
-    --paper-amber-600: #ffb300;
-    --paper-amber-700: #ffa000;
-    --paper-amber-800: #ff8f00;
-    --paper-amber-900: #ff6f00;
-    --paper-amber-a100: #ffe57f;
-    --paper-amber-a200: #ffd740;
-    --paper-amber-a400: #ffc400;
-    --paper-amber-a700: #ffab00;
- 
-    --paper-orange-50: #fff3e0;
-    --paper-orange-100: #ffe0b2;
-    --paper-orange-200: #ffcc80;
-    --paper-orange-300: #ffb74d;
-    --paper-orange-400: #ffa726;
-    --paper-orange-500: #ff9800;
-    --paper-orange-600: #fb8c00;
-    --paper-orange-700: #f57c00;
-    --paper-orange-800: #ef6c00;
-    --paper-orange-900: #e65100;
-    --paper-orange-a100: #ffd180;
-    --paper-orange-a200: #ffab40;
-    --paper-orange-a400: #ff9100;
-    --paper-orange-a700: #ff6500;
- 
-    --paper-deep-orange-50: #fbe9e7;
-    --paper-deep-orange-100: #ffccbc;
-    --paper-deep-orange-200: #ffab91;
-    --paper-deep-orange-300: #ff8a65;
-    --paper-deep-orange-400: #ff7043;
-    --paper-deep-orange-500: #ff5722;
-    --paper-deep-orange-600: #f4511e;
-    --paper-deep-orange-700: #e64a19;
-    --paper-deep-orange-800: #d84315;
-    --paper-deep-orange-900: #bf360c;
-    --paper-deep-orange-a100: #ff9e80;
-    --paper-deep-orange-a200: #ff6e40;
-    --paper-deep-orange-a400: #ff3d00;
-    --paper-deep-orange-a700: #dd2c00;
- 
-    --paper-brown-50: #efebe9;
-    --paper-brown-100: #d7ccc8;
-    --paper-brown-200: #bcaaa4;
-    --paper-brown-300: #a1887f;
-    --paper-brown-400: #8d6e63;
-    --paper-brown-500: #795548;
-    --paper-brown-600: #6d4c41;
-    --paper-brown-700: #5d4037;
-    --paper-brown-800: #4e342e;
-    --paper-brown-900: #3e2723;
- 
-    --paper-grey-50: #fafafa;
-    --paper-grey-100: #f5f5f5;
-    --paper-grey-200: #eeeeee;
-    --paper-grey-300: #e0e0e0;
-    --paper-grey-400: #bdbdbd;
-    --paper-grey-500: #9e9e9e;
-    --paper-grey-600: #757575;
-    --paper-grey-700: #616161;
-    --paper-grey-800: #424242;
-    --paper-grey-900: #212121;
- 
-    --paper-blue-grey-50: #eceff1;
-    --paper-blue-grey-100: #cfd8dc;
-    --paper-blue-grey-200: #b0bec5;
-    --paper-blue-grey-300: #90a4ae;
-    --paper-blue-grey-400: #78909c;
-    --paper-blue-grey-500: #607d8b;
-    --paper-blue-grey-600: #546e7a;
-    --paper-blue-grey-700: #455a64;
-    --paper-blue-grey-800: #37474f;
-    --paper-blue-grey-900: #263238;
-
-    /* opacity for dark text on a light background */
-    --dark-divider-opacity: 0.12;
-    --dark-disabled-opacity: 0.38; /* or hint text or icon */
-    --dark-secondary-opacity: 0.54;
-    --dark-primary-opacity: 0.87;
-
-    /* opacity for light text on a dark background */
-    --light-divider-opacity: 0.12;
-    --light-disabled-opacity: 0.3; /* or hint text or icon */
-    --light-secondary-opacity: 0.7;
-    --light-primary-opacity: 1.0;
-
-  }
-
-</style>
-
-
-
-
-
-
-<style is="custom-style">
-
-  :root {
-    /*
-     * You can use these generic variables in your elements for easy theming.
-     * For example, if all your elements use `--primary-text-color` as its main
-     * color, then switching from a light to a dark theme is just a matter of
-     * changing the value of `--primary-text-color` in your application.
-     */
-    --primary-text-color: var(--light-theme-text-color);
-    --primary-background-color: var(--light-theme-background-color);
-    --secondary-text-color: var(--light-theme-secondary-color);
-    --disabled-text-color: var(--light-theme-disabled-color);
-    --divider-color: var(--light-theme-divider-color);
-    --error-color: var(--paper-deep-orange-a700);
-
-    /*
-     * Primary and accent colors. Also see color.html for more colors.
-     */
-    --primary-color: var(--paper-indigo-500);
-    --light-primary-color: var(--paper-indigo-100);
-    --dark-primary-color: var(--paper-indigo-700);
-
-    --accent-color: var(--paper-pink-a200);
-    --light-accent-color: var(--paper-pink-a100);
-    --dark-accent-color: var(--paper-pink-a400);
-
-
-    /*
-     * Material Design Light background theme
-     */
-    --light-theme-background-color: #ffffff;
-    --light-theme-base-color: #000000;
-    --light-theme-text-color: var(--paper-grey-900);
-    --light-theme-secondary-color: #737373;  /* for secondary text and icons */
-    --light-theme-disabled-color: #9b9b9b;  /* disabled/hint text */
-    --light-theme-divider-color: #dbdbdb;
-
-    /*
-     * Material Design Dark background theme
-     */
-    --dark-theme-background-color: var(--paper-grey-900);
-    --dark-theme-base-color: #ffffff;
-    --dark-theme-text-color: #ffffff;
-    --dark-theme-secondary-color: #bcbcbc;  /* for secondary text and icons */
-    --dark-theme-disabled-color: #646464;  /* disabled/hint text */
-    --dark-theme-divider-color: #3c3c3c;
-
-    /*
-     * Deprecated values because of their confusing names.
-     */
-    --text-primary-color: var(--dark-theme-text-color);
-    --default-primary-color: var(--primary-color);
-
-  }
-
-</style>
-
-
-
-
-
-
-<script src="chrome://resources/polymer/v1_0/web-animations-js/web-animations-next-lite.min.js"></script>
-
-
-
-
-
-
-
-
-
-
-
-
-<style>
-/* Copyright 2015 The Chromium Authors. All rights reserved.
- * Use of this source code is governed by a BSD-style license that can be
- * found in the LICENSE file. */
-
-@font-face {
-  font-family: 'Roboto';
-  font-style: normal;
-  font-weight: 300;
-  src: local('Roboto Light'), local('Roboto-Light'),
-      url("chrome://resources/roboto/roboto-light.woff2") format('woff2');
-}
-
-@font-face {
-  font-family: 'Roboto';
-  font-style: normal;
-  font-weight: 400;
-  src: local('Roboto'), local('Roboto-Regular'),
-      url("chrome://resources/roboto/roboto-regular.woff2") format('woff2');
-}
-
-@font-face {
-  font-family: 'Roboto';
-  font-style: normal;
-  font-weight: 500;
-  src: local('Roboto Medium'), local('Roboto-Medium'),
-      url("chrome://resources/roboto/roboto-medium.woff2") format('woff2');
-}
-
-</style>
-<style is="custom-style">
-
-  :root {
-
-    /* Shared Styles */
-    --paper-font-common-base: {
-      font-family: 'Roboto', 'Noto', sans-serif;
-      -webkit-font-smoothing: antialiased;
-    };
-
-    --paper-font-common-code: {
-      font-family: 'Roboto Mono', 'Consolas', 'Menlo', monospace;
-      -webkit-font-smoothing: antialiased;
-    };
-
-    --paper-font-common-expensive-kerning: {
-      text-rendering: optimizeLegibility;
-    };
-
-    --paper-font-common-nowrap: {
-      white-space: nowrap;
-      overflow: hidden;
-      text-overflow: ellipsis;
-    };
-
-    /* Material Font Styles */
-
-    --paper-font-display4: {
-      @apply(--paper-font-common-base);
-      @apply(--paper-font-common-nowrap);
-
-      font-size: 112px;
-      font-weight: 300;
-      letter-spacing: -.044em;
-      line-height: 120px;
-    };
-
-    --paper-font-display3: {
-      @apply(--paper-font-common-base);
-      @apply(--paper-font-common-nowrap);
-
-      font-size: 56px;
-      font-weight: 400;
-      letter-spacing: -.026em;
-      line-height: 60px;
-    };
-
-    --paper-font-display2: {
-      @apply(--paper-font-common-base);
-
-      font-size: 45px;
-      font-weight: 400;
-      letter-spacing: -.018em;
-      line-height: 48px;
-    };
-
-    --paper-font-display1: {
-      @apply(--paper-font-common-base);
-
-      font-size: 34px;
-      font-weight: 400;
-      letter-spacing: -.01em;
-      line-height: 40px;
-    };
-
-    --paper-font-headline: {
-      @apply(--paper-font-common-base);
-
-      font-size: 24px;
-      font-weight: 400;
-      letter-spacing: -.012em;
-      line-height: 32px;
-    };
-
-    --paper-font-title: {
-      @apply(--paper-font-common-base);
-      @apply(--paper-font-common-nowrap);
-
-      font-size: 20px;
-      font-weight: 500;
-      line-height: 28px;
-    };
-
-    --paper-font-subhead: {
-      @apply(--paper-font-common-base);
-
-      font-size: 16px;
-      font-weight: 400;
-      line-height: 24px;
-    };
-
-    --paper-font-body2: {
-      @apply(--paper-font-common-base);
-
-      font-size: 14px;
-      font-weight: 500;
-      line-height: 24px;
-    };
-
-    --paper-font-body1: {
-      @apply(--paper-font-common-base);
-
-      font-size: 14px;
-      font-weight: 400;
-      line-height: 20px;
-    };
-
-    --paper-font-caption: {
-      @apply(--paper-font-common-base);
-      @apply(--paper-font-common-nowrap);
-
-      font-size: 12px;
-      font-weight: 400;
-      letter-spacing: 0.011em;
-      line-height: 20px;
-    };
-
-    --paper-font-menu: {
-      @apply(--paper-font-common-base);
-      @apply(--paper-font-common-nowrap);
-
-      font-size: 13px;
-      font-weight: 500;
-      line-height: 24px;
-    };
-
-    --paper-font-button: {
-      @apply(--paper-font-common-base);
-      @apply(--paper-font-common-nowrap);
-
-      font-size: 14px;
-      font-weight: 500;
-      letter-spacing: 0.018em;
-      line-height: 24px;
-      text-transform: uppercase;
-    };
-
-    --paper-font-code2: {
-      @apply(--paper-font-common-code);
-
-      font-size: 14px;
-      font-weight: 700;
-      line-height: 20px;
-    };
-
-    --paper-font-code1: {
-      @apply(--paper-font-common-code);
-
-      font-size: 14px;
-      font-weight: 500;
-      line-height: 20px;
-    };
-
-  }
-
-</style>
-
-
-</head>
-<body><div hidden="" by-vulcanize=""><script src="chrome://resources/polymer/v1_0/polymer/polymer-micro-extracted.js"></script><script src="chrome://resources/polymer/v1_0/polymer/polymer-mini-extracted.js"></script><script src="chrome://resources/polymer/v1_0/polymer/polymer-extracted.js"></script><dom-module id="iron-list" assetpath="chrome://resources/polymer/v1_0/iron-list/">
-  <template>
-    <style>
-      :host {
-        display: block;
-        position: relative;
-      }
-
-      @media only screen and (-webkit-max-device-pixel-ratio: 1) {
-        :host {
-          will-change: transform;
-        }
-      }
-
-      #items {
-        @apply(--iron-list-items-container);
-        position: relative;
-      }
-
-      #items > ::content > * {
-        width: 100%;
-        box-sizing: border-box;
-        position: absolute;
-        top: 0;
-        will-change: transform;
-      }
-    </style>
-
-    <array-selector id="selector" items="{{items}}" selected="{{selectedItems}}" selected-item="{{selectedItem}}">
-    </array-selector>
-
-    <div id="items">
-      <content></content>
-    </div>
-
-  </template>
-</dom-module>
-
 <dom-module id="iron-icon" assetpath="chrome://resources/polymer/v1_0/iron-icon/">
 
   <style>
@@ -1444,6 +779,65 @@
     <div id="waves"></div>
   </template>
 </dom-module>
+<style is="custom-style">
+
+  :root {
+
+    --shadow-transition: {
+      transition: box-shadow 0.28s cubic-bezier(0.4, 0, 0.2, 1);
+    };
+
+    --shadow-none: {
+      box-shadow: none;
+    };
+
+    /* from http://codepen.io/shyndman/pen/c5394ddf2e8b2a5c9185904b57421cdb */
+
+    --shadow-elevation-2dp: {
+      box-shadow: 0 2px 2px 0 rgba(0, 0, 0, 0.14),
+                  0 1px 5px 0 rgba(0, 0, 0, 0.12),
+                  0 3px 1px -2px rgba(0, 0, 0, 0.2);
+    };
+
+    --shadow-elevation-3dp: {
+      box-shadow: 0 3px 4px 0 rgba(0, 0, 0, 0.14),
+                  0 1px 8px 0 rgba(0, 0, 0, 0.12),
+                  0 3px 3px -2px rgba(0, 0, 0, 0.4);
+    };
+
+    --shadow-elevation-4dp: {
+      box-shadow: 0 4px 5px 0 rgba(0, 0, 0, 0.14),
+                  0 1px 10px 0 rgba(0, 0, 0, 0.12),
+                  0 2px 4px -1px rgba(0, 0, 0, 0.4);
+    };
+
+    --shadow-elevation-6dp: {
+      box-shadow: 0 6px 10px 0 rgba(0, 0, 0, 0.14),
+                  0 1px 18px 0 rgba(0, 0, 0, 0.12),
+                  0 3px 5px -1px rgba(0, 0, 0, 0.4);
+    };
+
+    --shadow-elevation-8dp: {
+      box-shadow: 0 8px 10px 1px rgba(0, 0, 0, 0.14),
+                  0 3px 14px 2px rgba(0, 0, 0, 0.12),
+                  0 5px 5px -3px rgba(0, 0, 0, 0.4);
+    };
+
+    --shadow-elevation-12dp: {
+      box-shadow: 0 12px 16px 1px rgba(0, 0, 0, 0.14),
+                  0 4px 22px 3px rgba(0, 0, 0, 0.12),
+                  0 6px 7px -4px rgba(0, 0, 0, 0.4);
+    };
+
+    --shadow-elevation-16dp: {
+      box-shadow: 0 16px 24px 2px rgba(0, 0, 0, 0.14),
+                  0  6px 30px 5px rgba(0, 0, 0, 0.12),
+                  0  8px 10px -5px rgba(0, 0, 0, 0.4);
+    };
+
+  }
+
+</style>
 <dom-module id="paper-material-shared-styles" assetpath="chrome://resources/polymer/v1_0/paper-material/">
   <template>
     <style>
@@ -1474,6 +868,8 @@
     </style>
   </template>
 </dom-module>
+
+
 <dom-module id="paper-material" assetpath="chrome://resources/polymer/v1_0/paper-material/">
   <template>
     <style include="paper-material-shared-styles"></style>
@@ -1544,6 +940,329 @@
   </template>
 </dom-module>
 
+<style is="custom-style">
+
+  :root {
+
+    /* Material Design color palette for Google products */
+
+    --google-red-100: #f4c7c3;
+    --google-red-300: #e67c73;
+    --google-red-500: #db4437;
+    --google-red-700: #c53929;
+
+    --google-blue-100: #c6dafc;
+    --google-blue-300: #7baaf7;
+    --google-blue-500: #4285f4;
+    --google-blue-700: #3367d6;
+
+    --google-green-100: #b7e1cd;
+    --google-green-300: #57bb8a;
+    --google-green-500: #0f9d58;
+    --google-green-700: #0b8043;
+
+    --google-yellow-100: #fce8b2;
+    --google-yellow-300: #f7cb4d;
+    --google-yellow-500: #f4b400;
+    --google-yellow-700: #f09300;
+
+    --google-grey-100: #f5f5f5;
+    --google-grey-300: #e0e0e0;
+    --google-grey-500: #9e9e9e;
+    --google-grey-700: #616161;
+    
+    /* Material Design color palette from online spec document */
+
+    --paper-red-50: #ffebee;
+    --paper-red-100: #ffcdd2;
+    --paper-red-200: #ef9a9a;
+    --paper-red-300: #e57373;
+    --paper-red-400: #ef5350;
+    --paper-red-500: #f44336;
+    --paper-red-600: #e53935;
+    --paper-red-700: #d32f2f;
+    --paper-red-800: #c62828;
+    --paper-red-900: #b71c1c;
+    --paper-red-a100: #ff8a80;
+    --paper-red-a200: #ff5252;
+    --paper-red-a400: #ff1744;
+    --paper-red-a700: #d50000;
+ 
+    --paper-pink-50: #fce4ec;
+    --paper-pink-100: #f8bbd0;
+    --paper-pink-200: #f48fb1;
+    --paper-pink-300: #f06292;
+    --paper-pink-400: #ec407a;
+    --paper-pink-500: #e91e63;
+    --paper-pink-600: #d81b60;
+    --paper-pink-700: #c2185b;
+    --paper-pink-800: #ad1457;
+    --paper-pink-900: #880e4f;
+    --paper-pink-a100: #ff80ab;
+    --paper-pink-a200: #ff4081;
+    --paper-pink-a400: #f50057;
+    --paper-pink-a700: #c51162;
+ 
+    --paper-purple-50: #f3e5f5;
+    --paper-purple-100: #e1bee7;
+    --paper-purple-200: #ce93d8;
+    --paper-purple-300: #ba68c8;
+    --paper-purple-400: #ab47bc;
+    --paper-purple-500: #9c27b0;
+    --paper-purple-600: #8e24aa;
+    --paper-purple-700: #7b1fa2;
+    --paper-purple-800: #6a1b9a;
+    --paper-purple-900: #4a148c;
+    --paper-purple-a100: #ea80fc;
+    --paper-purple-a200: #e040fb;
+    --paper-purple-a400: #d500f9;
+    --paper-purple-a700: #aa00ff;
+ 
+    --paper-deep-purple-50: #ede7f6;
+    --paper-deep-purple-100: #d1c4e9;
+    --paper-deep-purple-200: #b39ddb;
+    --paper-deep-purple-300: #9575cd;
+    --paper-deep-purple-400: #7e57c2;
+    --paper-deep-purple-500: #673ab7;
+    --paper-deep-purple-600: #5e35b1;
+    --paper-deep-purple-700: #512da8;
+    --paper-deep-purple-800: #4527a0;
+    --paper-deep-purple-900: #311b92;
+    --paper-deep-purple-a100: #b388ff;
+    --paper-deep-purple-a200: #7c4dff;
+    --paper-deep-purple-a400: #651fff;
+    --paper-deep-purple-a700: #6200ea;
+ 
+    --paper-indigo-50: #e8eaf6;
+    --paper-indigo-100: #c5cae9;
+    --paper-indigo-200: #9fa8da;
+    --paper-indigo-300: #7986cb;
+    --paper-indigo-400: #5c6bc0;
+    --paper-indigo-500: #3f51b5;
+    --paper-indigo-600: #3949ab;
+    --paper-indigo-700: #303f9f;
+    --paper-indigo-800: #283593;
+    --paper-indigo-900: #1a237e;
+    --paper-indigo-a100: #8c9eff;
+    --paper-indigo-a200: #536dfe;
+    --paper-indigo-a400: #3d5afe;
+    --paper-indigo-a700: #304ffe;
+ 
+    --paper-blue-50: #e3f2fd;
+    --paper-blue-100: #bbdefb;
+    --paper-blue-200: #90caf9;
+    --paper-blue-300: #64b5f6;
+    --paper-blue-400: #42a5f5;
+    --paper-blue-500: #2196f3;
+    --paper-blue-600: #1e88e5;
+    --paper-blue-700: #1976d2;
+    --paper-blue-800: #1565c0;
+    --paper-blue-900: #0d47a1;
+    --paper-blue-a100: #82b1ff;
+    --paper-blue-a200: #448aff;
+    --paper-blue-a400: #2979ff;
+    --paper-blue-a700: #2962ff;
+ 
+    --paper-light-blue-50: #e1f5fe;
+    --paper-light-blue-100: #b3e5fc;
+    --paper-light-blue-200: #81d4fa;
+    --paper-light-blue-300: #4fc3f7;
+    --paper-light-blue-400: #29b6f6;
+    --paper-light-blue-500: #03a9f4;
+    --paper-light-blue-600: #039be5;
+    --paper-light-blue-700: #0288d1;
+    --paper-light-blue-800: #0277bd;
+    --paper-light-blue-900: #01579b;
+    --paper-light-blue-a100: #80d8ff;
+    --paper-light-blue-a200: #40c4ff;
+    --paper-light-blue-a400: #00b0ff;
+    --paper-light-blue-a700: #0091ea;
+ 
+    --paper-cyan-50: #e0f7fa;
+    --paper-cyan-100: #b2ebf2;
+    --paper-cyan-200: #80deea;
+    --paper-cyan-300: #4dd0e1;
+    --paper-cyan-400: #26c6da;
+    --paper-cyan-500: #00bcd4;
+    --paper-cyan-600: #00acc1;
+    --paper-cyan-700: #0097a7;
+    --paper-cyan-800: #00838f;
+    --paper-cyan-900: #006064;
+    --paper-cyan-a100: #84ffff;
+    --paper-cyan-a200: #18ffff;
+    --paper-cyan-a400: #00e5ff;
+    --paper-cyan-a700: #00b8d4;
+ 
+    --paper-teal-50: #e0f2f1;
+    --paper-teal-100: #b2dfdb;
+    --paper-teal-200: #80cbc4;
+    --paper-teal-300: #4db6ac;
+    --paper-teal-400: #26a69a;
+    --paper-teal-500: #009688;
+    --paper-teal-600: #00897b;
+    --paper-teal-700: #00796b;
+    --paper-teal-800: #00695c;
+    --paper-teal-900: #004d40;
+    --paper-teal-a100: #a7ffeb;
+    --paper-teal-a200: #64ffda;
+    --paper-teal-a400: #1de9b6;
+    --paper-teal-a700: #00bfa5;
+ 
+    --paper-green-50: #e8f5e9;
+    --paper-green-100: #c8e6c9;
+    --paper-green-200: #a5d6a7;
+    --paper-green-300: #81c784;
+    --paper-green-400: #66bb6a;
+    --paper-green-500: #4caf50;
+    --paper-green-600: #43a047;
+    --paper-green-700: #388e3c;
+    --paper-green-800: #2e7d32;
+    --paper-green-900: #1b5e20;
+    --paper-green-a100: #b9f6ca;
+    --paper-green-a200: #69f0ae;
+    --paper-green-a400: #00e676;
+    --paper-green-a700: #00c853;
+ 
+    --paper-light-green-50: #f1f8e9;
+    --paper-light-green-100: #dcedc8;
+    --paper-light-green-200: #c5e1a5;
+    --paper-light-green-300: #aed581;
+    --paper-light-green-400: #9ccc65;
+    --paper-light-green-500: #8bc34a;
+    --paper-light-green-600: #7cb342;
+    --paper-light-green-700: #689f38;
+    --paper-light-green-800: #558b2f;
+    --paper-light-green-900: #33691e;
+    --paper-light-green-a100: #ccff90;
+    --paper-light-green-a200: #b2ff59;
+    --paper-light-green-a400: #76ff03;
+    --paper-light-green-a700: #64dd17;
+ 
+    --paper-lime-50: #f9fbe7;
+    --paper-lime-100: #f0f4c3;
+    --paper-lime-200: #e6ee9c;
+    --paper-lime-300: #dce775;
+    --paper-lime-400: #d4e157;
+    --paper-lime-500: #cddc39;
+    --paper-lime-600: #c0ca33;
+    --paper-lime-700: #afb42b;
+    --paper-lime-800: #9e9d24;
+    --paper-lime-900: #827717;
+    --paper-lime-a100: #f4ff81;
+    --paper-lime-a200: #eeff41;
+    --paper-lime-a400: #c6ff00;
+    --paper-lime-a700: #aeea00;
+ 
+    --paper-yellow-50: #fffde7;
+    --paper-yellow-100: #fff9c4;
+    --paper-yellow-200: #fff59d;
+    --paper-yellow-300: #fff176;
+    --paper-yellow-400: #ffee58;
+    --paper-yellow-500: #ffeb3b;
+    --paper-yellow-600: #fdd835;
+    --paper-yellow-700: #fbc02d;
+    --paper-yellow-800: #f9a825;
+    --paper-yellow-900: #f57f17;
+    --paper-yellow-a100: #ffff8d;
+    --paper-yellow-a200: #ffff00;
+    --paper-yellow-a400: #ffea00;
+    --paper-yellow-a700: #ffd600;
+ 
+    --paper-amber-50: #fff8e1;
+    --paper-amber-100: #ffecb3;
+    --paper-amber-200: #ffe082;
+    --paper-amber-300: #ffd54f;
+    --paper-amber-400: #ffca28;
+    --paper-amber-500: #ffc107;
+    --paper-amber-600: #ffb300;
+    --paper-amber-700: #ffa000;
+    --paper-amber-800: #ff8f00;
+    --paper-amber-900: #ff6f00;
+    --paper-amber-a100: #ffe57f;
+    --paper-amber-a200: #ffd740;
+    --paper-amber-a400: #ffc400;
+    --paper-amber-a700: #ffab00;
+ 
+    --paper-orange-50: #fff3e0;
+    --paper-orange-100: #ffe0b2;
+    --paper-orange-200: #ffcc80;
+    --paper-orange-300: #ffb74d;
+    --paper-orange-400: #ffa726;
+    --paper-orange-500: #ff9800;
+    --paper-orange-600: #fb8c00;
+    --paper-orange-700: #f57c00;
+    --paper-orange-800: #ef6c00;
+    --paper-orange-900: #e65100;
+    --paper-orange-a100: #ffd180;
+    --paper-orange-a200: #ffab40;
+    --paper-orange-a400: #ff9100;
+    --paper-orange-a700: #ff6500;
+ 
+    --paper-deep-orange-50: #fbe9e7;
+    --paper-deep-orange-100: #ffccbc;
+    --paper-deep-orange-200: #ffab91;
+    --paper-deep-orange-300: #ff8a65;
+    --paper-deep-orange-400: #ff7043;
+    --paper-deep-orange-500: #ff5722;
+    --paper-deep-orange-600: #f4511e;
+    --paper-deep-orange-700: #e64a19;
+    --paper-deep-orange-800: #d84315;
+    --paper-deep-orange-900: #bf360c;
+    --paper-deep-orange-a100: #ff9e80;
+    --paper-deep-orange-a200: #ff6e40;
+    --paper-deep-orange-a400: #ff3d00;
+    --paper-deep-orange-a700: #dd2c00;
+ 
+    --paper-brown-50: #efebe9;
+    --paper-brown-100: #d7ccc8;
+    --paper-brown-200: #bcaaa4;
+    --paper-brown-300: #a1887f;
+    --paper-brown-400: #8d6e63;
+    --paper-brown-500: #795548;
+    --paper-brown-600: #6d4c41;
+    --paper-brown-700: #5d4037;
+    --paper-brown-800: #4e342e;
+    --paper-brown-900: #3e2723;
+ 
+    --paper-grey-50: #fafafa;
+    --paper-grey-100: #f5f5f5;
+    --paper-grey-200: #eeeeee;
+    --paper-grey-300: #e0e0e0;
+    --paper-grey-400: #bdbdbd;
+    --paper-grey-500: #9e9e9e;
+    --paper-grey-600: #757575;
+    --paper-grey-700: #616161;
+    --paper-grey-800: #424242;
+    --paper-grey-900: #212121;
+ 
+    --paper-blue-grey-50: #eceff1;
+    --paper-blue-grey-100: #cfd8dc;
+    --paper-blue-grey-200: #b0bec5;
+    --paper-blue-grey-300: #90a4ae;
+    --paper-blue-grey-400: #78909c;
+    --paper-blue-grey-500: #607d8b;
+    --paper-blue-grey-600: #546e7a;
+    --paper-blue-grey-700: #455a64;
+    --paper-blue-grey-800: #37474f;
+    --paper-blue-grey-900: #263238;
+
+    /* opacity for dark text on a light background */
+    --dark-divider-opacity: 0.12;
+    --dark-disabled-opacity: 0.38; /* or hint text or icon */
+    --dark-secondary-opacity: 0.54;
+    --dark-primary-opacity: 0.87;
+
+    /* opacity for light text on a dark background */
+    --light-divider-opacity: 0.12;
+    --light-disabled-opacity: 0.3; /* or hint text or icon */
+    --light-secondary-opacity: 0.7;
+    --light-primary-opacity: 1.0;
+
+  }
+
+</style>
+
+
 <dom-module id="paper-progress" assetpath="chrome://resources/polymer/v1_0/paper-progress/">
   <template>
     <style>
@@ -1723,123 +1442,7 @@
 </dom-module>
 
 <dom-module id="downloads-item" assetpath="chrome://downloads/">
-  <template>
-    <h3 id="date">[[computeDate_(data.hideDate, data.since_string, data.date_string)]]</h3>
-
-    <div id="content" on-dragstart="onDragStart_" class$="[[computeClass_(isActive_, isDangerous_, showProgress_)]]">
-      <div id="file-icon-wrapper" class="icon-wrapper">
-        <img class="icon" id="file-icon" alt="" hidden="[[isDangerous_]]">
-        <iron-icon id="danger-icon" icon$="[[computeDangerIcon_(isDangerous_, data.danger_type)]]" hidden="[[!isDangerous_]]"></iron-icon>
-      </div>
-
-      <div id="details">
-        <div id="title-area"><a is="action-link" id="file-link" href="[[data.url]]" on-tap="onFileLinkTap_" hidden="[[!completelyOnDisk_]]">[[data.file_name]]</a><span id="name" hidden="[[completelyOnDisk_]]">[[data.file_name]]</span>
-          <span id="tag">[[computeTag_(data.state, data.last_reason_text, data.file_externally_removed)]]</span>
-        </div>
-
-        <a id="url" target="_blank" href="[[data.url]]">[[data.url]]</a>
-
-        <div id="description">[[computeDescription_(data.state, data.danger_type, data.file_name, data.progress_status_text)]]</div>
-
-        <template is="dom-if" if="[[showProgress_]]">
-          <paper-progress id="progress" indeterminate="[[isIndeterminate_(data.percent)]]" value="[[data.percent]]"></paper-progress>
-        </template>
-
-        <div id="safe" class="controls" hidden="[[isDangerous_]]">
-          <a is="action-link" id="show" i18n-content="controlShowInFolder" on-tap="onShowTap_" hidden="[[!completelyOnDisk_]]"></a>
-          <template is="dom-if" if="[[data.retry]]">
-            <paper-button id="retry" on-tap="onRetryTap_">[[i18n_.retry]]</paper-button>
-          </template>
-          <template is="dom-if" if="[[isInProgress_]]">
-            <paper-button id="pause" on-tap="onPauseTap_">[[i18n_.pause]]</paper-button>
-          </template>
-          <template is="dom-if" if="[[data.resume]]">
-            <paper-button id="resume" on-tap="onResumeTap_">[[i18n_.resume]]</paper-button>
-          </template>
-          <template is="dom-if" if="[[showCancel_]]">
-            <paper-button id="cancel" on-tap="onCancelTap_">[[i18n_.cancel]]</paper-button>
-          </template>
-          <span id="controlled-by"></span>
-        </div>
-
-        <template is="dom-if" if="[[isDangerous_]]">
-          <div id="dangerous" class="controls">
-            
-            <template is="dom-if" if="[[!isMalware_]]">
-              <paper-button id="discard" on-tap="onDiscardDangerousTap_" class="discard">[[i18n_.discard]]</paper-button>
-              <paper-button id="save" on-tap="onSaveDangerousTap_" class="keep">[[i18n_.save]]</paper-button>
-            </template>
-
-            
-            <template is="dom-if" if="[[isMalware_]]">
-              <paper-button id="danger-remove" on-tap="onDiscardDangerousTap_" class="discard">[[i18n_.remove]]</paper-button>
-              <paper-button id="restore" on-tap="onSaveDangerousTap_" class="keep">[[i18n_.restore]]</paper-button>
-            </template>
-          </div>
-        </template>
-      </div>
-
-      <div id="remove-wrapper" class="icon-wrapper">
-        <inky-text-button id="remove" i18n-values="title:controlRemoveFromList" style$="[[computeRemoveStyle_(isDangerous_, showCancel_)]]" on-tap="onRemoveTap_">✕</inky-text-button>
-      </div>
-
-      <div id="incognito" i18n-values="title:inIncognito" hidden="[[!data.otr]]"></div>
-    </div>
-
-  </template>
-  <style>
-/* Copyright 2015 The Chromium Authors. All rights reserved.
- * Use of this source code is governed by a BSD-style license that can be
- * found in the LICENSE file. */
-
-[is='action-link'] {
-  cursor: pointer;
-  display: inline-block;
-  text-decoration: none;
-}
-
-[is='action-link']:hover {
-  text-decoration: underline;
-}
-
-[is='action-link']:active {
-  color: rgb(5, 37, 119);
-  text-decoration: underline;
-}
-
-[is='action-link'][disabled] {
-  color: #999;
-  cursor: default;
-  pointer-events: none;
-  text-decoration: none;
-}
-
-[is='action-link'].no-outline {
-  outline: none;
-}
-
-</style>
-  <style>
-/* Copyright 2015 The Chromium Authors. All rights reserved.
- * Use of this source code is governed by a BSD-style license that can be
- * found in the LICENSE file. */
-
-* {
-  --downloads-item-width: 622px;
-}
-
-[hidden] {
-  display: none !important;
-}
-
-paper-button {
-  font-weight: 500;
-  margin: 0;
-  min-width: auto;
-}
-
-</style>
-  <style>
+  <template><style>
 /* Copyright 2015 The Chromium Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file. */
@@ -2054,8 +1657,183 @@
   right: 10px;
 }
 
+</style><style>
+/* Copyright 2015 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file. */
+
+* {
+  --downloads-item-width: 622px;
+}
+
+[hidden] {
+  display: none !important;
+}
+
+paper-button {
+  font-weight: 500;
+  margin: 0;
+  min-width: auto;
+}
+
+</style><style>
+/* Copyright 2015 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file. */
+
+[is='action-link'] {
+  cursor: pointer;
+  display: inline-block;
+  text-decoration: none;
+}
+
+[is='action-link']:hover {
+  text-decoration: underline;
+}
+
+[is='action-link']:active {
+  color: rgb(5, 37, 119);
+  text-decoration: underline;
+}
+
+[is='action-link'][disabled] {
+  color: #999;
+  cursor: default;
+  pointer-events: none;
+  text-decoration: none;
+}
+
+[is='action-link'].no-outline {
+  outline: none;
+}
+
 </style>
+    <h3 id="date">[[computeDate_(data.hideDate, data.since_string, data.date_string)]]</h3>
+
+    <div id="content" on-dragstart="onDragStart_" class$="[[computeClass_(isActive_, isDangerous_, showProgress_)]]">
+      <div id="file-icon-wrapper" class="icon-wrapper">
+        <img class="icon" id="file-icon" alt="" hidden="[[isDangerous_]]">
+        <iron-icon id="danger-icon" icon$="[[computeDangerIcon_(isDangerous_, data.danger_type)]]" hidden="[[!isDangerous_]]"></iron-icon>
+      </div>
+
+      <div id="details">
+        <div id="title-area"><a is="action-link" id="file-link" href="[[data.url]]" on-tap="onFileLinkTap_" hidden="[[!completelyOnDisk_]]">[[data.file_name]]</a><span id="name" hidden="[[completelyOnDisk_]]">[[data.file_name]]</span>
+          <span id="tag">[[computeTag_(data.state, data.last_reason_text, data.file_externally_removed)]]</span>
+        </div>
+
+        <a id="url" target="_blank" href="[[data.url]]">[[data.url]]</a>
+
+        <div id="description">[[computeDescription_(data.state, data.danger_type, data.file_name, data.progress_status_text)]]</div>
+
+        <template is="dom-if" if="[[showProgress_]]">
+          <paper-progress id="progress" indeterminate="[[isIndeterminate_(data.percent)]]" value="[[data.percent]]"></paper-progress>
+        </template>
+
+        <div id="safe" class="controls" hidden="[[isDangerous_]]">
+          <a is="action-link" id="show" i18n-content="controlShowInFolder" on-tap="onShowTap_" hidden="[[!completelyOnDisk_]]"></a>
+          <template is="dom-if" if="[[data.retry]]">
+            <paper-button id="retry" on-tap="onRetryTap_">[[i18n_.retry]]</paper-button>
+          </template>
+          <template is="dom-if" if="[[isInProgress_]]">
+            <paper-button id="pause" on-tap="onPauseTap_">[[i18n_.pause]]</paper-button>
+          </template>
+          <template is="dom-if" if="[[data.resume]]">
+            <paper-button id="resume" on-tap="onResumeTap_">[[i18n_.resume]]</paper-button>
+          </template>
+          <template is="dom-if" if="[[showCancel_]]">
+            <paper-button id="cancel" on-tap="onCancelTap_">[[i18n_.cancel]]</paper-button>
+          </template>
+          <span id="controlled-by"></span>
+        </div>
+
+        <template is="dom-if" if="[[isDangerous_]]">
+          <div id="dangerous" class="controls">
+            
+            <template is="dom-if" if="[[!isMalware_]]">
+              <paper-button id="discard" on-tap="onDiscardDangerousTap_" class="discard">[[i18n_.discard]]</paper-button>
+              <paper-button id="save" on-tap="onSaveDangerousTap_" class="keep">[[i18n_.save]]</paper-button>
+            </template>
+
+            
+            <template is="dom-if" if="[[isMalware_]]">
+              <paper-button id="danger-remove" on-tap="onDiscardDangerousTap_" class="discard">[[i18n_.remove]]</paper-button>
+              <paper-button id="restore" on-tap="onSaveDangerousTap_" class="keep">[[i18n_.restore]]</paper-button>
+            </template>
+          </div>
+        </template>
+      </div>
+
+      <div id="remove-wrapper" class="icon-wrapper">
+        <inky-text-button id="remove" i18n-values="title:controlRemoveFromList" style$="[[computeRemoveStyle_(isDangerous_, showCancel_)]]" on-tap="onRemoveTap_">✕</inky-text-button>
+      </div>
+
+      <div id="incognito" i18n-values="title:inIncognito" hidden="[[!data.otr]]"></div>
+    </div>
+
+  </template>
+  
+  
+  
   </dom-module>
+
+
+<style is="custom-style">
+
+  :root {
+    /*
+     * You can use these generic variables in your elements for easy theming.
+     * For example, if all your elements use `--primary-text-color` as its main
+     * color, then switching from a light to a dark theme is just a matter of
+     * changing the value of `--primary-text-color` in your application.
+     */
+    --primary-text-color: var(--light-theme-text-color);
+    --primary-background-color: var(--light-theme-background-color);
+    --secondary-text-color: var(--light-theme-secondary-color);
+    --disabled-text-color: var(--light-theme-disabled-color);
+    --divider-color: var(--light-theme-divider-color);
+    --error-color: var(--paper-deep-orange-a700);
+
+    /*
+     * Primary and accent colors. Also see color.html for more colors.
+     */
+    --primary-color: var(--paper-indigo-500);
+    --light-primary-color: var(--paper-indigo-100);
+    --dark-primary-color: var(--paper-indigo-700);
+
+    --accent-color: var(--paper-pink-a200);
+    --light-accent-color: var(--paper-pink-a100);
+    --dark-accent-color: var(--paper-pink-a400);
+
+
+    /*
+     * Material Design Light background theme
+     */
+    --light-theme-background-color: #ffffff;
+    --light-theme-base-color: #000000;
+    --light-theme-text-color: var(--paper-grey-900);
+    --light-theme-secondary-color: #737373;  /* for secondary text and icons */
+    --light-theme-disabled-color: #9b9b9b;  /* disabled/hint text */
+    --light-theme-divider-color: #dbdbdb;
+
+    /*
+     * Material Design Dark background theme
+     */
+    --dark-theme-background-color: var(--paper-grey-900);
+    --dark-theme-base-color: #ffffff;
+    --dark-theme-text-color: #ffffff;
+    --dark-theme-secondary-color: #bcbcbc;  /* for secondary text and icons */
+    --dark-theme-disabled-color: #646464;  /* disabled/hint text */
+    --dark-theme-divider-color: #3c3c3c;
+
+    /*
+     * Deprecated values because of their confusing names.
+     */
+    --text-primary-color: var(--dark-theme-text-color);
+    --default-primary-color: var(--primary-color);
+
+  }
+
+</style>
 <dom-module id="paper-item-shared-styles" assetpath="chrome://resources/polymer/v1_0/paper-item/">
   <template>
     <style>
@@ -2102,6 +1880,8 @@
     </style>
   </template>
 </dom-module>
+
+
 <dom-module id="paper-item" assetpath="chrome://resources/polymer/v1_0/paper-item/">
   <template>
     <style include="paper-item-shared-styles"></style>
@@ -2156,6 +1936,8 @@
     </style>
   </template>
 </dom-module>
+
+
 <dom-module id="paper-menu" assetpath="chrome://resources/polymer/v1_0/paper-menu/">
   <template>
     <style include="paper-menu-shared-styles"></style>
@@ -2208,6 +1990,9 @@
 
 </dom-module>
 
+<script src="chrome://resources/polymer/v1_0/web-animations-js/web-animations-next-lite.min.js"></script>
+
+
 <dom-module id="iron-dropdown" assetpath="chrome://resources/polymer/v1_0/iron-dropdown/">
   <style>
     :host {
@@ -2330,6 +2115,194 @@
   </template>
 
   </dom-module>
+<style>
+/* Copyright 2015 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file. */
+
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 300;
+  src: local('Roboto Light'), local('Roboto-Light'),
+      url("chrome://resources/roboto/roboto-light.woff2") format('woff2');
+}
+
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 400;
+  src: local('Roboto'), local('Roboto-Regular'),
+      url("chrome://resources/roboto/roboto-regular.woff2") format('woff2');
+}
+
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 500;
+  src: local('Roboto Medium'), local('Roboto-Medium'),
+      url("chrome://resources/roboto/roboto-medium.woff2") format('woff2');
+}
+
+</style>
+<style is="custom-style">
+
+  :root {
+
+    /* Shared Styles */
+    --paper-font-common-base: {
+      font-family: 'Roboto', 'Noto', sans-serif;
+      -webkit-font-smoothing: antialiased;
+    };
+
+    --paper-font-common-code: {
+      font-family: 'Roboto Mono', 'Consolas', 'Menlo', monospace;
+      -webkit-font-smoothing: antialiased;
+    };
+
+    --paper-font-common-expensive-kerning: {
+      text-rendering: optimizeLegibility;
+    };
+
+    --paper-font-common-nowrap: {
+      white-space: nowrap;
+      overflow: hidden;
+      text-overflow: ellipsis;
+    };
+
+    /* Material Font Styles */
+
+    --paper-font-display4: {
+      @apply(--paper-font-common-base);
+      @apply(--paper-font-common-nowrap);
+
+      font-size: 112px;
+      font-weight: 300;
+      letter-spacing: -.044em;
+      line-height: 120px;
+    };
+
+    --paper-font-display3: {
+      @apply(--paper-font-common-base);
+      @apply(--paper-font-common-nowrap);
+
+      font-size: 56px;
+      font-weight: 400;
+      letter-spacing: -.026em;
+      line-height: 60px;
+    };
+
+    --paper-font-display2: {
+      @apply(--paper-font-common-base);
+
+      font-size: 45px;
+      font-weight: 400;
+      letter-spacing: -.018em;
+      line-height: 48px;
+    };
+
+    --paper-font-display1: {
+      @apply(--paper-font-common-base);
+
+      font-size: 34px;
+      font-weight: 400;
+      letter-spacing: -.01em;
+      line-height: 40px;
+    };
+
+    --paper-font-headline: {
+      @apply(--paper-font-common-base);
+
+      font-size: 24px;
+      font-weight: 400;
+      letter-spacing: -.012em;
+      line-height: 32px;
+    };
+
+    --paper-font-title: {
+      @apply(--paper-font-common-base);
+      @apply(--paper-font-common-nowrap);
+
+      font-size: 20px;
+      font-weight: 500;
+      line-height: 28px;
+    };
+
+    --paper-font-subhead: {
+      @apply(--paper-font-common-base);
+
+      font-size: 16px;
+      font-weight: 400;
+      line-height: 24px;
+    };
+
+    --paper-font-body2: {
+      @apply(--paper-font-common-base);
+
+      font-size: 14px;
+      font-weight: 500;
+      line-height: 24px;
+    };
+
+    --paper-font-body1: {
+      @apply(--paper-font-common-base);
+
+      font-size: 14px;
+      font-weight: 400;
+      line-height: 20px;
+    };
+
+    --paper-font-caption: {
+      @apply(--paper-font-common-base);
+      @apply(--paper-font-common-nowrap);
+
+      font-size: 12px;
+      font-weight: 400;
+      letter-spacing: 0.011em;
+      line-height: 20px;
+    };
+
+    --paper-font-menu: {
+      @apply(--paper-font-common-base);
+      @apply(--paper-font-common-nowrap);
+
+      font-size: 13px;
+      font-weight: 500;
+      line-height: 24px;
+    };
+
+    --paper-font-button: {
+      @apply(--paper-font-common-base);
+      @apply(--paper-font-common-nowrap);
+
+      font-size: 14px;
+      font-weight: 500;
+      letter-spacing: 0.018em;
+      line-height: 24px;
+      text-transform: uppercase;
+    };
+
+    --paper-font-code2: {
+      @apply(--paper-font-common-code);
+
+      font-size: 14px;
+      font-weight: 700;
+      line-height: 20px;
+    };
+
+    --paper-font-code1: {
+      @apply(--paper-font-common-code);
+
+      font-size: 14px;
+      font-weight: 500;
+      line-height: 20px;
+    };
+
+  }
+
+</style>
+
+
 <dom-module id="paper-input-container" assetpath="chrome://resources/polymer/v1_0/paper-input/">
   <template>
     <style>
@@ -2565,16 +2538,7 @@
 </dom-module>
 
 <dom-module id="cr-search-field" assetpath="chrome://resources/cr_elements/cr_search_field/">
-  <template>
-    <paper-icon-button icon="search" id="search-button" disabled$="[[showingSearch_]]" title="[[label]]" on-click="toggleShowingSearch_"></paper-icon-button>
-    <template is="dom-if" if="[[showingSearch_]]" id="search-container">
-      <paper-input-container id="search-term" on-search="onSearchTermSearch_" on-keydown="onSearchTermKeydown_" hidden$="[[!showingSearch_]]" no-label-float="">
-        <input is="iron-input" id="search-input" type="search" placeholder="[[label]]" incremental="">
-        <paper-icon-button icon="cancel" id="clear-search" on-click="toggleShowingSearch_" title="[[clearLabel]]" hidden$="[[!showingSearch_]]"></paper-icon-button>
-      </paper-input-container>
-    </template>
-  </template>
-  <style>
+  <template><style>
 /* Copyright 2015 The Chromium Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file. */
@@ -2648,48 +2612,18 @@
 }
 
 </style>
+    <paper-icon-button icon="search" id="search-button" disabled$="[[showingSearch_]]" title="[[label]]" on-click="toggleShowingSearch_"></paper-icon-button>
+    <template is="dom-if" if="[[showingSearch_]]" id="search-container">
+      <paper-input-container id="search-term" on-search="onSearchTermSearch_" on-keydown="onSearchTermKeydown_" hidden$="[[!showingSearch_]]" no-label-float="">
+        <input is="iron-input" id="search-input" type="search" placeholder="[[label]]" incremental="">
+        <paper-icon-button icon="cancel" id="clear-search" on-click="toggleShowingSearch_" title="[[clearLabel]]" hidden$="[[!showingSearch_]]"></paper-icon-button>
+      </paper-input-container>
+    </template>
+  </template>
+  
   </dom-module>
 <dom-module id="downloads-toolbar" assetpath="chrome://downloads/">
-  <template>
-    <div id="title">
-      <h1 i18n-content="title"></h1>
-    </div>
-    <div id="actions">
-      <paper-button class="clear-all" i18n-content="clearAll" on-tap="onClearAllTap_"></paper-button>
-      <paper-button i18n-content="openDownloadsFolder" on-tap="onOpenDownloadsFolderTap_"></paper-button>
-    </div>
-    <div id="search">
-      <cr-search-field id="search-input" i18n-values="label:search;clear-label:clearSearch"></cr-search-field>
-      <paper-menu-button id="more" horizontal-align="[[overflowAlign_]]">
-        <paper-icon-button icon="more-vert" i18n-values="title:moreActions" class="dropdown-trigger"></paper-icon-button>
-        <paper-menu class="dropdown-content">
-          <paper-item class="clear-all" i18n-content="clearAll" on-tap="onClearAllTap_"></paper-item>
-          <paper-item i18n-content="openDownloadsFolder" on-tap="onOpenDownloadsFolderTap_"></paper-item>
-        </paper-menu>
-      </paper-menu-button>
-    </div>
-  </template>
-  <style>
-/* Copyright 2015 The Chromium Authors. All rights reserved.
- * Use of this source code is governed by a BSD-style license that can be
- * found in the LICENSE file. */
-
-* {
-  --downloads-item-width: 622px;
-}
-
-[hidden] {
-  display: none !important;
-}
-
-paper-button {
-  font-weight: 500;
-  margin: 0;
-  min-width: auto;
-}
-
-</style>
-  <style>
+  <template><style>
 /* Copyright 2015 The Chromium Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file. */
@@ -2800,25 +2734,7 @@
   }
 }
 
-</style>
-  </dom-module>
-<dom-module id="downloads-manager" assetpath="chrome://downloads/">
-  <template>
-    <downloads-toolbar id="toolbar"></downloads-toolbar>
-    <iron-list id="downloads-list" items="{{items_}}" hidden="[[!hasDownloads_]]">
-      <template>
-        <downloads-item data="[[item]]" hide-date="[[item.hideDate]]">
-        </downloads-item>
-      </template>
-    </iron-list>
-    <div id="no-downloads" hidden="[[hasDownloads_]]">
-      <div>
-        <div class="illustration"></div>
-        <span></span>
-      </div>
-    </div>
-  </template>
-  <style>
+</style><style>
 /* Copyright 2015 The Chromium Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file. */
@@ -2838,7 +2754,29 @@
 }
 
 </style>
-  <style>
+    <div id="title">
+      <h1 i18n-content="title"></h1>
+    </div>
+    <div id="actions">
+      <paper-button class="clear-all" i18n-content="clearAll" on-tap="onClearAllTap_"></paper-button>
+      <paper-button i18n-content="openDownloadsFolder" on-tap="onOpenDownloadsFolderTap_"></paper-button>
+    </div>
+    <div id="search">
+      <cr-search-field id="search-input" i18n-values="label:search;clear-label:clearSearch"></cr-search-field>
+      <paper-menu-button id="more" horizontal-align="[[overflowAlign_]]">
+        <paper-icon-button icon="more-vert" i18n-values="title:moreActions" class="dropdown-trigger"></paper-icon-button>
+        <paper-menu class="dropdown-content">
+          <paper-item class="clear-all" i18n-content="clearAll" on-tap="onClearAllTap_"></paper-item>
+          <paper-item i18n-content="openDownloadsFolder" on-tap="onOpenDownloadsFolderTap_"></paper-item>
+        </paper-menu>
+      </paper-menu-button>
+    </div>
+  </template>
+  
+  
+  </dom-module>
+<dom-module id="downloads-manager" assetpath="chrome://downloads/">
+  <template><style>
 /* Copyright 2015 The Chromium Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file. */
@@ -2884,7 +2822,42 @@
   margin-bottom: 32px;
 }
 
+</style><style>
+/* Copyright 2015 The Chromium Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file. */
+
+* {
+  --downloads-item-width: 622px;
+}
+
+[hidden] {
+  display: none !important;
+}
+
+paper-button {
+  font-weight: 500;
+  margin: 0;
+  min-width: auto;
+}
+
 </style>
+    <downloads-toolbar id="toolbar"></downloads-toolbar>
+    <iron-list id="downloads-list" items="{{items_}}" hidden="[[!hasDownloads_]]">
+      <template>
+        <downloads-item data="[[item]]" hide-date="[[item.hideDate]]">
+        </downloads-item>
+      </template>
+    </iron-list>
+    <div id="no-downloads" hidden="[[hasDownloads_]]">
+      <div>
+        <div class="illustration"></div>
+        <span></span>
+      </div>
+    </div>
+  </template>
+  
+  
   </dom-module>
 </div>
   <downloads-manager></downloads-manager>
@@ -2897,5 +2870,6 @@
   <command id="undo-command" shortcut="Ctrl-U+005A"></command>
   <command id="find-command" shortcut="Ctrl-U+0046"></command>
 </if>
+  <link rel="import" href="chrome://resources/html/polymer.html">
   
   <script src="crisper.js"></script></body></html>
\ No newline at end of file
diff --git a/chrome/browser/resources/md_history/history_toolbar.html b/chrome/browser/resources/md_history/history_toolbar.html
index d46ec51..ea78ae25 100644
--- a/chrome/browser/resources/md_history/history_toolbar.html
+++ b/chrome/browser/resources/md_history/history_toolbar.html
@@ -37,6 +37,10 @@
         padding-left: 24px;
       }
 
+      #search-input {
+        -webkit-padding-end: 20px;
+      }
+
       #items {
         margin: 0 auto;
         max-width: var(--card-max-width);
diff --git a/chrome/browser/resources/md_history/side_bar.html b/chrome/browser/resources/md_history/side_bar.html
index 6297e64b..f9a6faa 100644
--- a/chrome/browser/resources/md_history/side_bar.html
+++ b/chrome/browser/resources/md_history/side_bar.html
@@ -1,7 +1,7 @@
 <link rel="import" href="chrome://resources/html/polymer.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/iron-flex-layout/iron-flex-layout.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/paper-item/paper-item.html">
-<link rel="import" href="chrome://resources/polymer/v1_0/paper-menu/paper-menu.html">
+<link rel="import" href="chrome://resources/polymer/v1_0/paper-listbox/paper-listbox.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/paper-ripple/paper-ripple.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/paper-styles/color.html">
 
@@ -20,21 +20,18 @@
         font-weight: 500;
       }
 
-      paper-menu {
-        --paper-menu-focused-item-after: {
-          background: none;
-        };
-        --paper-menu-selected-item: {
-          color: var(--google-blue-500);
-          font-size: 14px;
-          font-weight: 500;
-        };
+      paper-item.iron-selected {
+        color: var(--google-blue-500);
+        font-weight: 500;
+      }
+
+      paper-listbox {
         -webkit-user-select: none;
         background-color: transparent;
         color: #5a5a5a;
       }
     </style>
-    <paper-menu id="overflow-menu" selected="0" on-iron-select="onSelect_">
+    <paper-listbox id="overflow-menu" selected="0" on-iron-select="onSelect_">
       <paper-item id="history-button">
         <div>$i18n{historyMenuItem}</div>
         <paper-ripple></paper-ripple>
@@ -43,7 +40,7 @@
         <div>$i18n{openTabsMenuItem}</div>
         <paper-ripple></paper-ripple>
       </paper-item>
-    </paper-menu>
+    </paper-listbox>
   </template>
   <script src="chrome://history/side_bar.js"></script>
 </dom-module>
diff --git a/chrome/browser/resources/media_router/elements/issue_banner/issue_banner.html b/chrome/browser/resources/media_router/elements/issue_banner/issue_banner.html
index 3a29dbb..193f1a74 100644
--- a/chrome/browser/resources/media_router/elements/issue_banner/issue_banner.html
+++ b/chrome/browser/resources/media_router/elements/issue_banner/issue_banner.html
@@ -1,4 +1,4 @@
-<link rel="import" href="chrome://resources/polymer/v1_0/polymer/polymer.html">
+<link rel="import" href="chrome://resources/html/polymer.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/iron-icon/iron-icon.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/paper-button/paper-button.html">
 <dom-module name="issue-banner">
diff --git a/chrome/browser/resources/media_router/elements/media_router_container/media_router_container.html b/chrome/browser/resources/media_router/elements/media_router_container/media_router_container.html
index 41ab035..917ab2c8 100644
--- a/chrome/browser/resources/media_router/elements/media_router_container/media_router_container.html
+++ b/chrome/browser/resources/media_router/elements/media_router_container/media_router_container.html
@@ -1,4 +1,4 @@
-<link rel="import" href="chrome://resources/polymer/v1_0/polymer/polymer.html">
+<link rel="import" href="chrome://resources/html/polymer.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/iron-icon/iron-icon.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/iron-icons/av-icons.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/iron-icons/communication-icons.html">
diff --git a/chrome/browser/resources/media_router/elements/media_router_header/media_router_header.html b/chrome/browser/resources/media_router/elements/media_router_header/media_router_header.html
index 30cd1084..f5c2a50 100644
--- a/chrome/browser/resources/media_router/elements/media_router_header/media_router_header.html
+++ b/chrome/browser/resources/media_router/elements/media_router_header/media_router_header.html
@@ -1,4 +1,4 @@
-<link rel="import" href="chrome://resources/polymer/v1_0/polymer/polymer.html">
+<link rel="import" href="chrome://resources/html/polymer.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/paper-icon-button/paper-icon-button.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/paper-toolbar/paper-toolbar.html">
 <dom-module name="media-router-header">
diff --git a/chrome/browser/resources/media_router/elements/media_router_search_highlighter/media_router_search_highlighter.html b/chrome/browser/resources/media_router/elements/media_router_search_highlighter/media_router_search_highlighter.html
index d47727ae..dbb9334 100644
--- a/chrome/browser/resources/media_router/elements/media_router_search_highlighter/media_router_search_highlighter.html
+++ b/chrome/browser/resources/media_router/elements/media_router_search_highlighter/media_router_search_highlighter.html
@@ -1,4 +1,4 @@
-<link rel="import" href="chrome://resources/polymer/v1_0/polymer/polymer.html">
+<link rel="import" href="chrome://resources/html/polymer.html">
 <dom-module id="media-router-search-highlighter">
   <link rel="import" type="css" href="media_router_search_highlighter.css">
   <template>
diff --git a/chrome/browser/resources/media_router/elements/route_details/route_details.html b/chrome/browser/resources/media_router/elements/route_details/route_details.html
index 2e2895d..a601283 100644
--- a/chrome/browser/resources/media_router/elements/route_details/route_details.html
+++ b/chrome/browser/resources/media_router/elements/route_details/route_details.html
@@ -1,4 +1,4 @@
-<link rel="import" href="chrome://resources/polymer/v1_0/polymer/polymer.html">
+<link rel="import" href="chrome://resources/html/polymer.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/paper-button/paper-button.html">
 <dom-module id="route-details">
   <link rel="import" type="css" href="../../media_router_common.css">
diff --git a/chrome/browser/resources/media_router/media_router.html b/chrome/browser/resources/media_router/media_router.html
index 681f4b6..027ff7d 100644
--- a/chrome/browser/resources/media_router/media_router.html
+++ b/chrome/browser/resources/media_router/media_router.html
@@ -6,16 +6,15 @@
 
   <link rel="stylesheet" href="chrome://resources/css/roboto.css">
   <link rel="stylesheet" href="media_router.css">
-  <script src="chrome://resources/js/polymer_config.js"></script>
-  <script src="chrome://resources/js/cr.js"></script>
-  <script src="chrome://resources/js/load_time_data.js"></script>
-  <script src="chrome://resources/js/util.js"></script>
+  <link rel="import" href="chrome://resources/html/cr.html">
+  <link rel="import" href="chrome://resources/html/load_time_data.html">
+  <link rel="import" href="chrome://resources/html/util.html">
   <script src="chrome://media-router/strings.js"></script>
   <script src="chrome://media-router/media_router.js"></script>
   <link rel="import" href="chrome://media-router/elements/media_router_container/media_router_container.html">
 </head>
 <body>
   <media-router-container id="media-router-container"></media-router-container>
-  <script src="chrome://resources/js/i18n_template.js"></script>
+  <link rel="import" href="chrome://resources/html/i18n_template.html">
 </body>
 </html>
diff --git a/chrome/browser/resources/settings/certificate_manager_page/certificate_entry.html b/chrome/browser/resources/settings/certificate_manager_page/certificate_entry.html
index d90eb7e..ed4eef1 100644
--- a/chrome/browser/resources/settings/certificate_manager_page/certificate_entry.html
+++ b/chrome/browser/resources/settings/certificate_manager_page/certificate_entry.html
@@ -21,7 +21,8 @@
         <div class="list-frame">
           <template is="dom-repeat" items="[[model.subnodes]]">
             <settings-certificate-subentry model="[[item]]"
-                certificate-type="[[certificateType]]">
+                certificate-type="[[certificateType]]"
+                is-last$="[[isLast_(index, model)]]">
             </settings-certificate-subentry>
           </template>
         </div>
diff --git a/chrome/browser/resources/settings/certificate_manager_page/certificate_entry.js b/chrome/browser/resources/settings/certificate_manager_page/certificate_entry.js
index c2441ac1..7dddd50 100644
--- a/chrome/browser/resources/settings/certificate_manager_page/certificate_entry.js
+++ b/chrome/browser/resources/settings/certificate_manager_page/certificate_entry.js
@@ -15,4 +15,13 @@
     /** @type {!settings.CertificateType} */
     certificateType: String,
   },
+
+  /**
+   * @param {number} index
+   * @return {boolean} Whether the given index corresponds to the last sub-node.
+   * @private
+   */
+  isLast_: function(index) {
+    return index == this.model.subnodes.length - 1;
+  },
 });
diff --git a/chrome/browser/resources/settings/certificate_manager_page/certificate_subentry.html b/chrome/browser/resources/settings/certificate_manager_page/certificate_subentry.html
index d8bf8693..74b0d5e5 100644
--- a/chrome/browser/resources/settings/certificate_manager_page/certificate_subentry.html
+++ b/chrome/browser/resources/settings/certificate_manager_page/certificate_subentry.html
@@ -31,6 +31,10 @@
       paper-item:hover {
         background-color: var(--settings-hover-color);
       }
+
+      :host([is-last]) .list-item {
+        border-bottom: none;
+      }
     </style>
     <div class="list-item underbar">
       <div class="untrusted" hidden$="[[!model.untrusted]]">
diff --git a/chrome/browser/resources/settings/languages_page/compiled_resources2.gyp b/chrome/browser/resources/settings/languages_page/compiled_resources2.gyp
index 3308e17..bc2d34e 100644
--- a/chrome/browser/resources/settings/languages_page/compiled_resources2.gyp
+++ b/chrome/browser/resources/settings/languages_page/compiled_resources2.gyp
@@ -10,6 +10,7 @@
         '<(DEPTH)/ui/webui/resources/js/compiled_resources2.gyp:cr',
         '<(EXTERNS_GYP):chrome_send',
         '<(EXTERNS_GYP):language_settings_private',
+        '<(INTERFACES_GYP):language_settings_private_interface',
         '../prefs/compiled_resources2.gyp:prefs_types',
         '../prefs/compiled_resources2.gyp:prefs',
         'languages_types',
diff --git a/chrome/browser/resources/settings/languages_page/languages.js b/chrome/browser/resources/settings/languages_page/languages.js
index 4c2cb22..5251ac8 100644
--- a/chrome/browser/resources/settings/languages_page/languages.js
+++ b/chrome/browser/resources/settings/languages_page/languages.js
@@ -23,6 +23,8 @@
 
 var SettingsLanguagesSingletonElement;
 
+cr.exportPath('languageSettings');
+
 (function() {
 'use strict';
 
@@ -77,6 +79,10 @@
     },
   },
 
+  /** @type {!LanguageSettingsPrivate} */
+  languageSettingsPrivate: languageSettings.languageSettingsPrivateApiForTest ||
+      /** @type {!LanguageSettingsPrivate} */(chrome.languageSettingsPrivate),
+
   /**
    * Hash map of languages.supportedLanguages using language codes as keys for
    * fast lookup.
@@ -103,28 +109,31 @@
     var languageList;
     var translateTarget;
 
-    // Request language information to populate the model.
-    Promise.all([
+    /**
+     * Promise to be resolved when the languages singleton has been initialized.
+     * @type {!Promise}
+     */
+    this.initialized = Promise.all([
       // Wait until prefs are initialized before creating the model, so we can
       // include information about enabled languages.
       CrSettingsPrefs.initialized,
 
       // Get the language list.
       new Promise(function(resolve) {
-        chrome.languageSettingsPrivate.getLanguageList(function(list) {
+        this.languageSettingsPrivate.getLanguageList(function(list) {
           languageList = list;
           resolve();
         });
-      }),
+      }.bind(this)),
 
       // Get the translate target language.
       new Promise(function(resolve) {
-        chrome.languageSettingsPrivate.getTranslateTargetLanguage(
+        this.languageSettingsPrivate.getTranslateTargetLanguage(
             function(targetLanguageCode) {
               translateTarget = targetLanguageCode;
               resolve();
             });
-      }),
+      }.bind(this)),
     ]).then(function() {
       this.createModel_(languageList, translateTarget);
       this.initialized_ = true;
@@ -329,7 +338,7 @@
     if (languageCodes.indexOf(languageCode) > -1)
       return;
     languageCodes.push(languageCode);
-    chrome.languageSettingsPrivate.setLanguageList(languageCodes);
+    this.languageSettingsPrivate.setLanguageList(languageCodes);
     this.disableTranslateLanguage(languageCode);
   },
 
@@ -353,7 +362,7 @@
     if (languageIndex == -1)
       return;
     languageCodes.splice(languageIndex, 1);
-    chrome.languageSettingsPrivate.setLanguageList(languageCodes);
+    this.languageSettingsPrivate.setLanguageList(languageCodes);
     this.enableTranslateLanguage(languageCode);
   },
 
@@ -463,11 +472,12 @@
   properties: {
     /**
      * Singleton element created at startup which provides the languages model.
-     * @type {!SettingsLanguagesSingletonElement}
+     * @type {SettingsLanguagesSingletonElement}
      */
     singleton_: {
       type: Object,
-      value: LanguageHelperImpl.getInstance(),
+      value: languageSettings.languageSettingsPrivateApiForTest ?
+             undefined : LanguageHelperImpl.getInstance(),
     },
 
     /**
@@ -483,12 +493,14 @@
   },
 
   ready: function() {
-    // Set the 'languages' property to reference the singleton's model.
-    this._setLanguages(this.singleton_.languages);
-    // Listen for changes to the singleton's languages property, so we know
-    // when to notify hosts of changes to (our reference to) the property.
-    this.listen(
-        this.singleton_, 'languages-changed', 'singletonLanguagesChanged_');
+    this.singleton_.initialized.then(function() {
+      // Set the 'languages' property to reference the singleton's model.
+      this._setLanguages(this.singleton_.languages);
+      // Listen for changes to the singleton's languages property, so we know
+      // when to notify hosts of changes to (our reference to) the property.
+      this.listen(
+          this.singleton_, 'languages-changed', 'singletonLanguagesChanged_');
+    }.bind(this));
   },
 
   /**
diff --git a/chrome/browser/resources/settings/languages_page/languages_page.html b/chrome/browser/resources/settings/languages_page/languages_page.html
index 927b4abb..9c84dbb 100644
--- a/chrome/browser/resources/settings/languages_page/languages_page.html
+++ b/chrome/browser/resources/settings/languages_page/languages_page.html
@@ -35,7 +35,7 @@
           <cr-expand-button expanded="{{languagesOpened_}}">
           </cr-expand-button>
         </div>
-        <iron-collapse id="collapse" opened="[[languagesOpened_]]">
+        <iron-collapse id="languagesCollapse" opened="[[languagesOpened_]]">
           <div class="list-frame vertical-list">
             <array-selector id="languageSelector"
                 selected="{{detailLanguage}}"
@@ -70,7 +70,8 @@
           <cr-expand-button expanded="{{inputMethodsOpened_}}">
           </cr-expand-button>
         </div>
-        <iron-collapse id="collapse" opened="[[inputMethodsOpened_]]">
+        <iron-collapse id="inputMethodsCollapse"
+            opened="[[inputMethodsOpened_]]">
           <div class="list-frame vertical-list">
             <template is="dom-repeat" items="{{languages.inputMethods}}">
               <div class="list-item">
@@ -98,7 +99,7 @@
           <cr-expand-button expanded="{{spellCheckOpened_}}">
           </cr-expand-button>
         </div>
-        <iron-collapse id="collapse" opened="[[spellCheckOpened_]]">
+        <iron-collapse id="spellCheckCollapse" opened="[[spellCheckOpened_]]">
           <div class="list-frame vertical-list">
             <div class="list-item">
               <template is="dom-repeat" items="{{languages.enabledLanguages}}">
diff --git a/chrome/browser/resources/settings/prefs/prefs.js b/chrome/browser/resources/settings/prefs/prefs.js
index e466e58..54c0aa2 100644
--- a/chrome/browser/resources/settings/prefs/prefs.js
+++ b/chrome/browser/resources/settings/prefs/prefs.js
@@ -411,7 +411,7 @@
     getPrefKeyFromPath_: function(path) {
       // Skip the first token, which refers to the member variable (this.prefs).
       var parts = path.split('.');
-      assert(parts.shift() == 'prefs');
+      assert(parts.shift() == 'prefs', "Path doesn't begin with 'prefs'");
 
       for (let i = 1; i <= parts.length; i++) {
         let key = parts.slice(0, i).join('.');
diff --git a/chrome/browser/resources/settings/settings_page/settings_animated_pages.css b/chrome/browser/resources/settings/settings_page/settings_animated_pages.css
deleted file mode 100644
index 6de1938..0000000
--- a/chrome/browser/resources/settings/settings_page/settings_animated_pages.css
+++ /dev/null
@@ -1,11 +0,0 @@
-/* Copyright 2015 The Chromium Authors. All rights reserved.
- * Use of this source code is governed by a BSD-style license that can be
- * found in the LICENSE file. */
-
-/**
- * @fileoverview
- * Styles used for animating settings subpages.
- */
-neon-animated-pages ::content > .iron-selected {
-  position: static;
-}
diff --git a/chrome/browser/resources/settings/settings_page/settings_animated_pages.html b/chrome/browser/resources/settings/settings_page/settings_animated_pages.html
index 7f9ac271..3d9a761d 100644
--- a/chrome/browser/resources/settings/settings_page/settings_animated_pages.html
+++ b/chrome/browser/resources/settings/settings_page/settings_animated_pages.html
@@ -12,8 +12,12 @@
 <link rel="import" href="chrome://resources/polymer/v1_0/neon-animation/neon-animation-runner-behavior.html">
 
 <dom-module id="settings-animated-pages">
-  <link rel="import" type="css" href="settings_animated_pages.css">
   <template>
+    <style>
+      neon-animated-pages ::content > .iron-selected {
+        position: static;
+      }
+    </style>
     <neon-animated-pages id="animatedPages" attr-for-selected="id">
       <content select="*"></content>
     </neon-animated-pages>
diff --git a/chrome/browser/resources/settings/settings_resources.grd b/chrome/browser/resources/settings/settings_resources.grd
index fdc6a7e..5fcd3e6 100644
--- a/chrome/browser/resources/settings/settings_resources.grd
+++ b/chrome/browser/resources/settings/settings_resources.grd
@@ -39,9 +39,6 @@
       <structure name="IDR_SETTINGS_ALL_SITES_JS"
                  file="site_settings/all_sites.js"
                  type="chrome_html" />
-      <structure name="IDR_SETTINGS_CR_SETTINGS_ANIMATED_PAGES_CSS"
-                 file="settings_page/settings_animated_pages.css"
-                 type="chrome_html" />
       <structure name="IDR_SETTINGS_CR_SETTINGS_ANIMATED_PAGES_HTML"
                  file="settings_page/settings_animated_pages.html"
                  type="chrome_html" />
diff --git a/chrome/browser/ssl/chrome_ssl_host_state_delegate.cc b/chrome/browser/ssl/chrome_ssl_host_state_delegate.cc
index e3cd5dd..30a0ce36 100644
--- a/chrome/browser/ssl/chrome_ssl_host_state_delegate.cc
+++ b/chrome/browser/ssl/chrome_ssl_host_state_delegate.cc
@@ -109,6 +109,9 @@
   map->GetSettingsForOneType(CONTENT_SETTINGS_TYPE_SSL_CERT_DECISIONS,
                              std::string(), &settings);
   for (const ContentSettingPatternSource& setting : settings) {
+    // Migrate user preference settings only.
+    if (setting.source != "preference")
+      continue;
     // Migrate old-format settings only.
     if (setting.secondary_pattern != ContentSettingsPattern::Wildcard()) {
       GURL url(setting.primary_pattern.ToString());
diff --git a/chrome/browser/task_management/sampling/task_group.h b/chrome/browser/task_management/sampling/task_group.h
index 4d6eed2..4781d2c 100644
--- a/chrome/browser/task_management/sampling/task_group.h
+++ b/chrome/browser/task_management/sampling/task_group.h
@@ -70,6 +70,9 @@
   int64_t private_bytes() const { return memory_usage_.private_bytes; }
   int64_t shared_bytes() const { return memory_usage_.shared_bytes; }
   int64_t physical_bytes() const { return memory_usage_.physical_bytes; }
+#if defined(OS_CHROMEOS)
+  int64_t swapped_bytes() const { return memory_usage_.swapped_bytes; }
+#endif
   int64_t gpu_memory() const { return gpu_memory_; }
   bool gpu_memory_has_duplicates() const { return gpu_memory_has_duplicates_; }
   int64_t per_process_network_usage() const {
diff --git a/chrome/browser/task_management/sampling/task_group_sampler.cc b/chrome/browser/task_management/sampling/task_group_sampler.cc
index da1983c..93b0c2e 100644
--- a/chrome/browser/task_management/sampling/task_group_sampler.cc
+++ b/chrome/browser/task_management/sampling/task_group_sampler.cc
@@ -145,6 +145,9 @@
     memory_usage.physical_bytes -=
         static_cast<int64_t>(ws_usage.shareable * 1024);
 #endif
+#if defined(OS_CHROMEOS)
+    memory_usage.swapped_bytes = ws_usage.swapped * 1024;
+#endif
   }
 
   return memory_usage;
diff --git a/chrome/browser/task_management/sampling/task_group_sampler.h b/chrome/browser/task_management/sampling/task_group_sampler.h
index 60fec2b..4b3b9450 100644
--- a/chrome/browser/task_management/sampling/task_group_sampler.h
+++ b/chrome/browser/task_management/sampling/task_group_sampler.h
@@ -23,15 +23,14 @@
 // Wraps the memory usage stats values together so that it can be sent between
 // the UI and the worker threads.
 struct MemoryUsageStats {
-  int64_t private_bytes;
-  int64_t shared_bytes;
-  int64_t physical_bytes;
+  int64_t private_bytes = -1;
+  int64_t shared_bytes = -1;
+  int64_t physical_bytes = -1;
+#if defined(OS_CHROMEOS)
+  int64_t swapped_bytes = -1;
+#endif
 
-  MemoryUsageStats()
-      : private_bytes(-1),
-        shared_bytes(-1),
-        physical_bytes(-1) {
-  }
+  MemoryUsageStats() {}
 };
 
 // Defines the expensive process' stats sampler that will calculate these
diff --git a/chrome/browser/task_management/sampling/task_manager_impl.cc b/chrome/browser/task_management/sampling/task_manager_impl.cc
index 39e9943b5..957bf92 100644
--- a/chrome/browser/task_management/sampling/task_manager_impl.cc
+++ b/chrome/browser/task_management/sampling/task_manager_impl.cc
@@ -95,6 +95,14 @@
   return GetTaskGroupByTaskId(task_id)->shared_bytes();
 }
 
+int64_t TaskManagerImpl::GetSwappedMemoryUsage(TaskId task_id) const {
+#if defined(OS_CHROMEOS)
+  return GetTaskGroupByTaskId(task_id)->swapped_bytes();
+#else
+  return -1;
+#endif
+}
+
 int64_t TaskManagerImpl::GetGpuMemoryUsage(TaskId task_id,
                                            bool* has_duplicates) const {
   const TaskGroup* task_group = GetTaskGroupByTaskId(task_id);
diff --git a/chrome/browser/task_management/sampling/task_manager_impl.h b/chrome/browser/task_management/sampling/task_manager_impl.h
index 0e92023..109ab68 100644
--- a/chrome/browser/task_management/sampling/task_manager_impl.h
+++ b/chrome/browser/task_management/sampling/task_manager_impl.h
@@ -41,6 +41,7 @@
   int64_t GetPhysicalMemoryUsage(TaskId task_id) const override;
   int64_t GetPrivateMemoryUsage(TaskId task_id) const override;
   int64_t GetSharedMemoryUsage(TaskId task_id) const override;
+  int64_t GetSwappedMemoryUsage(TaskId task_id) const override;
   int64_t GetGpuMemoryUsage(TaskId task_id,
                             bool* has_duplicates) const override;
   int GetIdleWakeupsPerSecond(TaskId task_id) const override;
diff --git a/chrome/browser/task_management/task_manager_interface.h b/chrome/browser/task_management/task_manager_interface.h
index 79d65e1..4eccc70 100644
--- a/chrome/browser/task_management/task_manager_interface.h
+++ b/chrome/browser/task_management/task_manager_interface.h
@@ -61,6 +61,7 @@
   virtual int64_t GetPhysicalMemoryUsage(TaskId task_id) const = 0;
   virtual int64_t GetPrivateMemoryUsage(TaskId task_id) const = 0;
   virtual int64_t GetSharedMemoryUsage(TaskId task_id) const = 0;
+  virtual int64_t GetSwappedMemoryUsage(TaskId task_id) const = 0;
 
   // Returns the GPU memory usage of the task with |task_id| in bytes. A value
   // of -1 means no valid value is currently available.
diff --git a/chrome/browser/task_management/test_task_manager.cc b/chrome/browser/task_management/test_task_manager.cc
index be08007..5a27ab9 100644
--- a/chrome/browser/task_management/test_task_manager.cc
+++ b/chrome/browser/task_management/test_task_manager.cc
@@ -38,6 +38,10 @@
   return -1;
 }
 
+int64_t TestTaskManager::GetSwappedMemoryUsage(TaskId task_id) const {
+  return -1;
+}
+
 int64_t TestTaskManager::GetGpuMemoryUsage(TaskId task_id,
                                            bool* has_duplicates) const {
   return -1;
diff --git a/chrome/browser/task_management/test_task_manager.h b/chrome/browser/task_management/test_task_manager.h
index e3a1838..b4cc4b1 100644
--- a/chrome/browser/task_management/test_task_manager.h
+++ b/chrome/browser/task_management/test_task_manager.h
@@ -28,6 +28,7 @@
   int64_t GetPhysicalMemoryUsage(TaskId task_id) const override;
   int64_t GetPrivateMemoryUsage(TaskId task_id) const override;
   int64_t GetSharedMemoryUsage(TaskId task_id) const override;
+  int64_t GetSwappedMemoryUsage(TaskId task_id) const override;
   int64_t GetGpuMemoryUsage(TaskId task_id,
                             bool* has_duplicates) const override;
   int GetIdleWakeupsPerSecond(TaskId task_id) const override;
diff --git a/chrome/browser/ui/browser.h b/chrome/browser/ui/browser.h
index 758148d..9b246a2 100644
--- a/chrome/browser/ui/browser.h
+++ b/chrome/browser/ui/browser.h
@@ -820,7 +820,7 @@
                          DetachType type);
 
   // Shared code between Reload() and ReloadBypassingCache().
-  void ReloadInternal(WindowOpenDisposition disposition, bool ignore_cache);
+  void ReloadInternal(WindowOpenDisposition disposition, bool bypass_cache);
 
   // Returns true if the Browser window supports a location bar. Having support
   // for the location bar does not mean it will be visible.
diff --git a/chrome/browser/ui/browser_commands.cc b/chrome/browser/ui/browser_commands.cc
index 2cad2c4..e2bd5ce 100644
--- a/chrome/browser/ui/browser_commands.cc
+++ b/chrome/browser/ui/browser_commands.cc
@@ -214,7 +214,7 @@
 
 void ReloadInternal(Browser* browser,
                     WindowOpenDisposition disposition,
-                    bool ignore_cache) {
+                    bool bypass_cache) {
   // As this is caused by a user action, give the focus to the page.
   //
   // Also notify RenderViewHostDelegate of the user gesture; this is
@@ -226,10 +226,10 @@
 
   DevToolsWindow* devtools =
       DevToolsWindow::GetInstanceForInspectedWebContents(new_tab);
-  if (devtools && devtools->ReloadInspectedWebContents(ignore_cache))
+  if (devtools && devtools->ReloadInspectedWebContents(bypass_cache))
     return;
 
-  if (ignore_cache)
+  if (bypass_cache)
     new_tab->GetController().ReloadBypassingCache(true);
   else
     new_tab->GetController().Reload(true);
diff --git a/chrome/browser/ui/cocoa/browser_window_controller.mm b/chrome/browser/ui/cocoa/browser_window_controller.mm
index cdea9ad1..3e01fce 100644
--- a/chrome/browser/ui/cocoa/browser_window_controller.mm
+++ b/chrome/browser/ui/cocoa/browser_window_controller.mm
@@ -407,18 +407,6 @@
     // Create the bridge for the status bubble.
     statusBubble_ = new StatusBubbleMac([self window], self);
 
-    // Register for application hide/unhide notifications.
-    [[NSNotificationCenter defaultCenter]
-         addObserver:self
-            selector:@selector(applicationDidHide:)
-                name:NSApplicationDidHideNotification
-              object:nil];
-    [[NSNotificationCenter defaultCenter]
-         addObserver:self
-            selector:@selector(applicationDidUnhide:)
-                name:NSApplicationDidUnhideNotification
-              object:nil];
-
     // This must be done after the view is added to the window since it relies
     // on the window bounds to determine whether to show buttons or not.
     if ([self hasToolbar])  // Do not create the buttons in popups.
@@ -657,12 +645,6 @@
 // Called when we have been minimized.
 - (void)windowDidMiniaturize:(NSNotification *)notification {
   [self saveWindowPositionIfNeeded];
-
-  // Let the selected RenderWidgetHostView know, so that it can tell plugins.
-  if (WebContents* contents = [self webContents]) {
-    if (RenderWidgetHostView* rwhv = contents->GetRenderWidgetHostView())
-      rwhv->SetWindowVisibility(false);
-  }
 }
 
 // Called when we have been unminimized.
@@ -670,36 +652,6 @@
   // Make sure the window's show_state (which is now ui::SHOW_STATE_NORMAL)
   // gets saved.
   [self saveWindowPositionIfNeeded];
-
-  // Let the selected RenderWidgetHostView know, so that it can tell plugins.
-  if (WebContents* contents = [self webContents]) {
-    if (RenderWidgetHostView* rwhv = contents->GetRenderWidgetHostView())
-      rwhv->SetWindowVisibility(true);
-  }
-}
-
-// Called when the application has been hidden.
-- (void)applicationDidHide:(NSNotification *)notification {
-  // Let the selected RenderWidgetHostView know, so that it can tell plugins
-  // (unless we are minimized, in which case nothing has really changed).
-  if (![[self window] isMiniaturized]) {
-    if (WebContents* contents = [self webContents]) {
-      if (RenderWidgetHostView* rwhv = contents->GetRenderWidgetHostView())
-        rwhv->SetWindowVisibility(false);
-    }
-  }
-}
-
-// Called when the application has been unhidden.
-- (void)applicationDidUnhide:(NSNotification *)notification {
-  // Let the selected RenderWidgetHostView know, so that it can tell plugins
-  // (unless we are minimized, in which case nothing has really changed).
-  if (![[self window] isMiniaturized]) {
-    if (WebContents* contents = [self webContents]) {
-      if (RenderWidgetHostView* rwhv = contents->GetRenderWidgetHostView())
-        rwhv->SetWindowVisibility(true);
-    }
-  }
 }
 
 // Called when the user clicks the zoom button (or selects it from the Window
@@ -1729,12 +1681,6 @@
     statusBubble_->UpdateSizeAndPosition();
   }
 
-  // Let the selected RenderWidgetHostView know, so that it can tell plugins.
-  if (WebContents* contents = [self webContents]) {
-    if (RenderWidgetHostView* rwhv = contents->GetRenderWidgetHostView())
-      rwhv->WindowFrameChanged();
-  }
-
   // The FindBar needs to know its own position to properly detect overlaps
   // with find results. The position changes whenever the window is resized,
   // and |layoutSubviews| computes the FindBar's position.
@@ -1777,12 +1723,6 @@
       (windowTopGrowth_ > 0 && NSMinY(windowFrame) != NSMinY(workarea)) ||
       (windowBottomGrowth_ > 0 && NSMaxY(windowFrame) != NSMaxY(workarea)))
     [self resetWindowGrowthState];
-
-  // Let the selected RenderWidgetHostView know, so that it can tell plugins.
-  if (WebContents* contents = [self webContents]) {
-    if (RenderWidgetHostView* rwhv = contents->GetRenderWidgetHostView())
-      rwhv->WindowFrameChanged();
-  }
 }
 
 // Delegate method called when window will be resized; not called for
diff --git a/chrome/browser/ui/cocoa/browser_window_controller_private.mm b/chrome/browser/ui/cocoa/browser_window_controller_private.mm
index 85d1f50..5961fca3 100644
--- a/chrome/browser/ui/cocoa/browser_window_controller_private.mm
+++ b/chrome/browser/ui/cocoa/browser_window_controller_private.mm
@@ -310,22 +310,8 @@
   NSView* tabContentView = [self tabContentArea];
   NSRect tabContentFrame = [tabContentView frame];
 
-  bool contentShifted =
-      NSMaxY(tabContentFrame) != NSMaxY(newFrame) ||
-      NSMinX(tabContentFrame) != NSMinX(newFrame);
-
   tabContentFrame = newFrame;
   [tabContentView setFrame:tabContentFrame];
-
-  // If the relayout shifts the content area up or down, let the renderer know.
-  if (contentShifted) {
-    WebContents* contents = [self webContents];
-    if (contents) {
-      RenderWidgetHostView* rwhv = contents->GetRenderWidgetHostView();
-      if (rwhv)
-        rwhv->WindowFrameChanged();
-    }
-  }
 }
 
 - (void)adjustToolbarAndBookmarkBarForCompression:(CGFloat)compression {
diff --git a/chrome/browser/ui/cocoa/extensions/extension_popup_controller.mm b/chrome/browser/ui/cocoa/extensions/extension_popup_controller.mm
index a714d48..483d17b 100644
--- a/chrome/browser/ui/cocoa/extensions/extension_popup_controller.mm
+++ b/chrome/browser/ui/cocoa/extensions/extension_popup_controller.mm
@@ -68,9 +68,6 @@
 // Called when the extension view is shown.
 - (void)onViewDidShow;
 
-// Called when the window moves or resizes. Notifies the extension.
-- (void)onWindowChanged;
-
 @end
 
 class ExtensionPopupContainer : public ExtensionViewMac::Container {
@@ -406,27 +403,6 @@
   [self onSizeChanged:pendingSize_];
 }
 
-- (void)onWindowChanged {
-  // The window is positioned before creating the host, to ensure the host is
-  // created with the correct screen information.
-  if (!host_)
-    return;
-
-  ExtensionViewMac* extensionView =
-      static_cast<ExtensionViewMac*>(host_->view());
-  // Let the extension view know, so that it can tell plugins.
-  if (extensionView)
-    extensionView->WindowFrameChanged();
-}
-
-- (void)windowDidResize:(NSNotification*)notification {
-  [self onWindowChanged];
-}
-
-- (void)windowDidMove:(NSNotification*)notification {
-  [self onWindowChanged];
-}
-
 // Private (TestingAPI)
 + (void)setAnimationsEnabledForTesting:(BOOL)enabled {
   gAnimationsEnabled = enabled;
diff --git a/chrome/browser/ui/cocoa/extensions/extension_view_mac.h b/chrome/browser/ui/cocoa/extensions/extension_view_mac.h
index 36cbd8c6..ca0f212 100644
--- a/chrome/browser/ui/cocoa/extensions/extension_view_mac.h
+++ b/chrome/browser/ui/cocoa/extensions/extension_view_mac.h
@@ -52,9 +52,6 @@
   // Sets the container for this view.
   void set_container(Container* container) { container_ = container; }
 
-  // Informs the view that its containing window's frame changed.
-  void WindowFrameChanged();
-
   // Create the host view, adding it as a subview of |superview|.
   void CreateWidgetHostViewIn(gfx::NativeView superview);
 
diff --git a/chrome/browser/ui/cocoa/extensions/extension_view_mac.mm b/chrome/browser/ui/cocoa/extensions/extension_view_mac.mm
index 0f98745..275b6749 100644
--- a/chrome/browser/ui/cocoa/extensions/extension_view_mac.mm
+++ b/chrome/browser/ui/cocoa/extensions/extension_view_mac.mm
@@ -34,11 +34,6 @@
 ExtensionViewMac::~ExtensionViewMac() {
 }
 
-void ExtensionViewMac::WindowFrameChanged() {
-  if (render_view_host()->GetWidget()->GetView())
-    render_view_host()->GetWidget()->GetView()->WindowFrameChanged();
-}
-
 void ExtensionViewMac::CreateWidgetHostViewIn(gfx::NativeView superview) {
   [superview addSubview:GetNativeView()];
   extension_host_->CreateRenderViewSoon();
diff --git a/chrome/browser/ui/content_settings/content_setting_bubble_model.cc b/chrome/browser/ui/content_settings/content_setting_bubble_model.cc
index 3c5fd67..03377a0 100644
--- a/chrome/browser/ui/content_settings/content_setting_bubble_model.cc
+++ b/chrome/browser/ui/content_settings/content_setting_bubble_model.cc
@@ -18,6 +18,7 @@
 #include "chrome/browser/custom_handlers/protocol_handler_registry_factory.h"
 #include "chrome/browser/infobars/infobar_service.h"
 #include "chrome/browser/media/media_capture_devices_dispatcher.h"
+#include "chrome/browser/permissions/permission_util.h"
 #include "chrome/browser/plugins/chrome_plugin_service_filter.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/blocked_content/popup_blocker_tab_helper.h"
@@ -722,8 +723,6 @@
 void ContentSettingMediaStreamBubbleModel::UpdateSettings(
     ContentSetting setting) {
   if (profile()) {
-    HostContentSettingsMap* content_settings =
-        HostContentSettingsMapFactory::GetForProfile(profile());
     TabSpecificContentSettings* tab_content_settings =
         TabSpecificContentSettings::FromWebContents(web_contents());
     // The same urls must be used as in other places (e.g. the infobar) in
@@ -731,12 +730,12 @@
     // TODO(markusheintz): Extract to a helper so that there is only a single
     // place to touch.
     if (MicrophoneAccessed()) {
-      content_settings->SetContentSettingDefaultScope(
+      PermissionUtil::SetContentSettingAndRecordRevocation(profile(),
           tab_content_settings->media_stream_access_origin(), GURL(),
           CONTENT_SETTINGS_TYPE_MEDIASTREAM_MIC, std::string(), setting);
     }
     if (CameraAccessed()) {
-      content_settings->SetContentSettingDefaultScope(
+      PermissionUtil::SetContentSettingAndRecordRevocation(profile(),
           tab_content_settings->media_stream_access_origin(), GURL(),
           CONTENT_SETTINGS_TYPE_MEDIASTREAM_CAMERA, std::string(), setting);
     }
@@ -940,11 +939,9 @@
       TabSpecificContentSettings::FromWebContents(web_contents());
   const ContentSettingsUsagesState::StateMap& state_map =
       content_settings->geolocation_usages_state().state_map();
-  HostContentSettingsMap* settings_map =
-      HostContentSettingsMapFactory::GetForProfile(profile());
 
   for (const std::pair<GURL, ContentSetting>& map_entry : state_map) {
-    settings_map->SetContentSettingDefaultScope(
+    PermissionUtil::SetContentSettingAndRecordRevocation(profile(),
         map_entry.first, embedder_url, CONTENT_SETTINGS_TYPE_GEOLOCATION,
         std::string(), CONTENT_SETTING_DEFAULT);
   }
@@ -1199,13 +1196,12 @@
       TabSpecificContentSettings::FromWebContents(web_contents());
   const ContentSettingsUsagesState::StateMap& state_map =
       content_settings->midi_usages_state().state_map();
-  HostContentSettingsMap* settings_map =
-      HostContentSettingsMapFactory::GetForProfile(profile());
 
   for (const std::pair<GURL, ContentSetting>& map_entry : state_map) {
-    settings_map->SetContentSettingDefaultScope(
-        map_entry.first, embedder_url, CONTENT_SETTINGS_TYPE_MIDI_SYSEX,
-        std::string(), CONTENT_SETTING_DEFAULT);
+    PermissionUtil::SetContentSettingAndRecordRevocation(
+        profile(), map_entry.first, embedder_url,
+        CONTENT_SETTINGS_TYPE_MIDI_SYSEX, std::string(),
+        CONTENT_SETTING_DEFAULT);
   }
 }
 
diff --git a/chrome/browser/ui/task_manager/task_manager_columns.cc b/chrome/browser/ui/task_manager/task_manager_columns.cc
index 866fbfe..008d402a 100644
--- a/chrome/browser/ui/task_manager/task_manager_columns.cc
+++ b/chrome/browser/ui/task_manager/task_manager_columns.cc
@@ -31,6 +31,12 @@
     arraysize("800 MiB") * kCharWidth, -1, true, false, false },
   { IDS_TASK_MANAGER_PRIVATE_MEM_COLUMN, ui::TableColumn::RIGHT, -1, 0,
     arraysize("800 MiB") * kCharWidth, -1, true, false, false },
+
+#if defined(OS_CHROMEOS)
+  { IDS_TASK_MANAGER_SWAPPED_MEM_COLUMN, ui::TableColumn::RIGHT, -1, 0,
+    arraysize("800 MiB") * kCharWidth, -1, true, false, false },
+#endif
+
   { IDS_TASK_MANAGER_CPU_COLUMN, ui::TableColumn::RIGHT, -1, 0,
     arraysize("99.9") * kCharWidth, -1, true, false, true },
   { IDS_TASK_MANAGER_NET_COLUMN, ui::TableColumn::RIGHT, -1, 0,
@@ -98,6 +104,7 @@
   def(IDS_TASK_MANAGER_PHYSICAL_MEM_COLUMN) \
   def(IDS_TASK_MANAGER_SHARED_MEM_COLUMN) \
   def(IDS_TASK_MANAGER_PRIVATE_MEM_COLUMN) \
+  def(IDS_TASK_MANAGER_SWAPPED_MEM_COLUMN) \
   def(IDS_TASK_MANAGER_CPU_COLUMN) \
   def(IDS_TASK_MANAGER_NET_COLUMN) \
   def(IDS_TASK_MANAGER_PROCESS_ID_COLUMN) \
diff --git a/chrome/browser/ui/task_manager/task_manager_table_model.cc b/chrome/browser/ui/task_manager/task_manager_table_model.cc
index d853780..b757e102 100644
--- a/chrome/browser/ui/task_manager/task_manager_table_model.cc
+++ b/chrome/browser/ui/task_manager/task_manager_table_model.cc
@@ -52,6 +52,7 @@
     case IDS_TASK_MANAGER_PRIVATE_MEM_COLUMN:
     case IDS_TASK_MANAGER_SHARED_MEM_COLUMN:
     case IDS_TASK_MANAGER_PHYSICAL_MEM_COLUMN:
+    case IDS_TASK_MANAGER_SWAPPED_MEM_COLUMN:
     case IDS_TASK_MANAGER_CPU_COLUMN:
     case IDS_TASK_MANAGER_NET_COLUMN:
     case IDS_TASK_MANAGER_PROCESS_ID_COLUMN:
@@ -312,6 +313,10 @@
       return stringifier_->GetMemoryUsageText(
           observed_task_manager()->GetPhysicalMemoryUsage(tasks_[row]), false);
 
+    case IDS_TASK_MANAGER_SWAPPED_MEM_COLUMN:
+      return stringifier_->GetMemoryUsageText(
+          observed_task_manager()->GetSwappedMemoryUsage(tasks_[row]), false);
+
     case IDS_TASK_MANAGER_PROCESS_ID_COLUMN:
       return stringifier_->GetProcessIdText(
           observed_task_manager()->GetProcessId(tasks_[row]));
@@ -443,6 +448,11 @@
           observed_task_manager()->GetPhysicalMemoryUsage(tasks_[row1]),
           observed_task_manager()->GetPhysicalMemoryUsage(tasks_[row2]));
 
+    case IDS_TASK_MANAGER_SWAPPED_MEM_COLUMN:
+      return ValueCompare(
+          observed_task_manager()->GetSwappedMemoryUsage(tasks_[row1]),
+          observed_task_manager()->GetSwappedMemoryUsage(tasks_[row2]));
+
     case IDS_TASK_MANAGER_NACL_DEBUG_STUB_PORT_COLUMN:
       return ValueCompare(
           observed_task_manager()->GetNaClDebugStubPort(tasks_[row1]),
@@ -614,13 +624,16 @@
     case IDS_TASK_MANAGER_PHYSICAL_MEM_COLUMN:
     case IDS_TASK_MANAGER_PRIVATE_MEM_COLUMN:
     case IDS_TASK_MANAGER_SHARED_MEM_COLUMN:
+    case IDS_TASK_MANAGER_SWAPPED_MEM_COLUMN:
       type = REFRESH_TYPE_MEMORY;
       if (table_view_delegate_->IsColumnVisible(
               IDS_TASK_MANAGER_PHYSICAL_MEM_COLUMN) ||
           table_view_delegate_->IsColumnVisible(
               IDS_TASK_MANAGER_PRIVATE_MEM_COLUMN) ||
           table_view_delegate_->IsColumnVisible(
-              IDS_TASK_MANAGER_SHARED_MEM_COLUMN)) {
+              IDS_TASK_MANAGER_SHARED_MEM_COLUMN) ||
+          table_view_delegate_->IsColumnVisible(
+              IDS_TASK_MANAGER_SWAPPED_MEM_COLUMN)) {
         new_visibility = true;
       }
       break;
diff --git a/chrome/browser/ui/website_settings/website_settings.cc b/chrome/browser/ui/website_settings/website_settings.cc
index 9996abb..4246c2d 100644
--- a/chrome/browser/ui/website_settings/website_settings.cc
+++ b/chrome/browser/ui/website_settings/website_settings.cc
@@ -286,6 +286,8 @@
         "WebsiteSettings.OriginInfo.PermissionChanged.Blocked", histogram_value,
         num_values);
     // Trigger Rappor sampling if it is a permission revoke action.
+    // TODO(tsergeant): Integrate this with the revocation recording performed
+    // in the permissions layer. See crbug.com/469221.
     content::PermissionType permission_type;
     if (PermissionUtil::GetPermissionType(type, &permission_type)) {
       PermissionUmaUtil::PermissionRevoked(permission_type,
diff --git a/chrome/browser/ui/webui/engagement/site_engagement_ui.cc b/chrome/browser/ui/webui/engagement/site_engagement_ui.cc
index d53fe7a..e14a273c 100644
--- a/chrome/browser/ui/webui/engagement/site_engagement_ui.cc
+++ b/chrome/browser/ui/webui/engagement/site_engagement_ui.cc
@@ -55,7 +55,7 @@
                                        double score) override {
     GURL origin_gurl(origin.get());
     if (!origin_gurl.is_valid() || score < 0 ||
-        score > SiteEngagementScore::kMaxPoints || isnan(score)) {
+        score > SiteEngagementScore::kMaxPoints || std::isnan(score)) {
       return;
     }
 
diff --git a/chrome/chrome.gyp b/chrome/chrome.gyp
index 6ed93f8..235f087 100644
--- a/chrome/chrome.gyp
+++ b/chrome/chrome.gyp
@@ -32,7 +32,6 @@
         ],
         'chromium_child_dependencies': [
           'child',
-          'plugin',
           'renderer',
           'utility',
           '../content/content.gyp:content_gpu',
@@ -114,7 +113,6 @@
         'chrome_dll.gypi',
         'chrome_exe.gypi',
         'chrome_installer.gypi',
-        'chrome_plugin.gypi',
         'chrome_renderer.gypi',
         'chrome_tests.gypi',
         'chrome_tests_unit.gypi',
diff --git a/chrome/chrome_android.gypi b/chrome/chrome_android.gypi
index 66d44ef..9b33eb0 100644
--- a/chrome/chrome_android.gypi
+++ b/chrome/chrome_android.gypi
@@ -15,7 +15,6 @@
         'chrome.gyp:browser_ui',
         'chrome.gyp:child',
         'chrome_features.gyp:chrome_common_features',
-        'chrome.gyp:plugin',
         'chrome.gyp:renderer',
         'chrome.gyp:utility',
         '../components/components.gyp:safe_browsing_db_mobile',
diff --git a/chrome/chrome_plugin.gypi b/chrome/chrome_plugin.gypi
deleted file mode 100644
index 4b1ddb2..0000000
--- a/chrome/chrome_plugin.gypi
+++ /dev/null
@@ -1,27 +0,0 @@
-# Copyright 2014 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'targets': [
-    {
-      'target_name': 'plugin',
-      'type': 'static_library',
-      'variables': { 'enable_wexit_time_destructors': 1, },
-      'dependencies': [
-        '../base/base.gyp:base',
-        '../gin/gin.gyp:gin',
-        'chrome_features.gyp:chrome_common_features',
-        'chrome_resources.gyp:chrome_strings',
-      ],
-      'include_dirs': [
-        '..',
-        '<(grit_out_dir)',
-      ],
-      'sources': [
-        'plugin/chrome_content_plugin_client.cc',
-        'plugin/chrome_content_plugin_client.h',
-      ],
-    },
-  ],
-}
diff --git a/chrome/chrome_tests.gypi b/chrome/chrome_tests.gypi
index 445dce98..954d45e 100644
--- a/chrome/chrome_tests.gypi
+++ b/chrome/chrome_tests.gypi
@@ -1008,6 +1008,7 @@
       'test/data/webui/settings/change_picture_browsertest_chromeos.js',
       'test/data/webui/settings/cr_settings_browsertest.js',
       'test/data/webui/settings/easy_unlock_browsertest_chromeos.js',
+      'test/data/webui/settings/languages_page_browsertest.js',
       'test/data/webui/settings/on_startup_browsertest.js',
       'test/data/webui/settings/settings_page_browsertest.js',
       'test/data/webui/settings/settings_passwords_section_browsertest.js',
diff --git a/chrome/chrome_tests_unit.gypi b/chrome/chrome_tests_unit.gypi
index 1c1225b..37d6f59 100644
--- a/chrome/chrome_tests_unit.gypi
+++ b/chrome/chrome_tests_unit.gypi
@@ -167,6 +167,7 @@
       'browser/permissions/chooser_context_base_unittest.cc',
       'browser/permissions/permission_context_base_unittest.cc',
       'browser/permissions/permission_manager_unittest.cc',
+      'browser/permissions/permission_util_unittest.cc',
       'browser/policy/cloud/cloud_policy_invalidator_unittest.cc',
       'browser/policy/cloud/remote_commands_invalidator_unittest.cc',
       'browser/policy/cloud/user_policy_signin_service_unittest.cc',
@@ -1858,7 +1859,6 @@
         ['OS!="ios"', {
           'dependencies': [
             'child',
-            'plugin',
             'renderer',
             'utility',
             '../content/content.gyp:content_gpu',
diff --git a/chrome/plugin/BUILD.gn b/chrome/plugin/BUILD.gn
deleted file mode 100644
index 39d26023..0000000
--- a/chrome/plugin/BUILD.gn
+++ /dev/null
@@ -1,22 +0,0 @@
-# Copyright 2014 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-static_library("plugin") {
-  sources = [
-    "chrome_content_plugin_client.cc",
-    "chrome_content_plugin_client.h",
-  ]
-
-  configs += [
-    "//build/config/compiler:wexit_time_destructors",
-    "//v8:external_startup_data",
-  ]
-
-  deps = [
-    "//base",
-    "//chrome:strings",
-    "//content/public/plugin",
-    "//gin",
-  ]
-}
diff --git a/chrome/plugin/DEPS b/chrome/plugin/DEPS
deleted file mode 100644
index 8c270f43..0000000
--- a/chrome/plugin/DEPS
+++ /dev/null
@@ -1,6 +0,0 @@
-include_rules = [
-  "+content/public/plugin",
-  "+gin/public/isolate_holder.h",
-  "+gin/v8_initializer.h",
-  "+media/base",
-]
diff --git a/chrome/plugin/chrome_content_plugin_client.cc b/chrome/plugin/chrome_content_plugin_client.cc
deleted file mode 100644
index 8441d535..0000000
--- a/chrome/plugin/chrome_content_plugin_client.cc
+++ /dev/null
@@ -1,16 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chrome/plugin/chrome_content_plugin_client.h"
-
-#ifdef V8_USE_EXTERNAL_STARTUP_DATA
-#include "gin/v8_initializer.h"
-#endif
-
-void ChromeContentPluginClient::PreSandboxInitialization() {
-#ifdef V8_USE_EXTERNAL_STARTUP_DATA
-  gin::V8Initializer::LoadV8Snapshot();
-  gin::V8Initializer::LoadV8Natives();
-#endif
-}
diff --git a/chrome/plugin/chrome_content_plugin_client.h b/chrome/plugin/chrome_content_plugin_client.h
deleted file mode 100644
index 0db0955..0000000
--- a/chrome/plugin/chrome_content_plugin_client.h
+++ /dev/null
@@ -1,15 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROME_PLUGIN_CHROME_CONTENT_PLUGIN_CLIENT_H_
-#define CHROME_PLUGIN_CHROME_CONTENT_PLUGIN_CLIENT_H_
-
-#include "content/public/plugin/content_plugin_client.h"
-
-class ChromeContentPluginClient : public content::ContentPluginClient {
- public:
-  void PreSandboxInitialization() override;
-};
-
-#endif  // CHROME_PLUGIN_CHROME_CONTENT_PLUGIN_CLIENT_H_
diff --git a/chrome/renderer/net/net_error_helper.cc b/chrome/renderer/net/net_error_helper.cc
index 07087b7..5a19bcc 100644
--- a/chrome/renderer/net/net_error_helper.cc
+++ b/chrome/renderer/net/net_error_helper.cc
@@ -304,10 +304,9 @@
                  base::Unretained(this)));
 }
 
-void NetErrorHelper::ReloadPage(bool ignore_cache) {
-  // TODO(crbug.com/599364): Rename |ignore_cache| or change it to enum.
+void NetErrorHelper::ReloadPage(bool bypass_cache) {
   render_frame()->GetWebFrame()->reload(
-      ignore_cache ? blink::WebFrameLoadType::ReloadBypassingCache
+      bypass_cache ? blink::WebFrameLoadType::ReloadBypassingCache
                    : blink::WebFrameLoadType::Reload);
 }
 
diff --git a/chrome/renderer/net/net_error_helper.h b/chrome/renderer/net/net_error_helper.h
index 66b9ff89..67f6da2 100644
--- a/chrome/renderer/net/net_error_helper.h
+++ b/chrome/renderer/net/net_error_helper.h
@@ -105,7 +105,7 @@
   void CancelFetchNavigationCorrections() override;
   void SendTrackingRequest(const GURL& tracking_url,
                            const std::string& tracking_request_body) override;
-  void ReloadPage(bool ignore_cache) override;
+  void ReloadPage(bool bypass_cache) override;
   void LoadPageFromCache(const GURL& page_url) override;
   void DiagnoseError(const GURL& page_url) override;
   void ShowOfflinePages() override;
diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
index 2b9f3c74..6619b88 100644
--- a/chrome/test/BUILD.gn
+++ b/chrome/test/BUILD.gn
@@ -130,7 +130,6 @@
   if (!is_ios) {
     public_deps += [
       "//chrome/child",
-      "//chrome/plugin",
       "//chrome/renderer",
       "//chrome/utility",
       "//components/autofill/core/browser:test_support",
@@ -142,7 +141,6 @@
       "//components/web_resource:test_support",
       "//content/public/child",
       "//content/public/common",
-      "//content/public/plugin",
       "//content/public/renderer",
       "//content/public/utility",
       "//google_apis:test_support",
diff --git a/chrome/test/data/webui/polymer_browser_test_base.js b/chrome/test/data/webui/polymer_browser_test_base.js
index bab6405..f3a9b167 100644
--- a/chrome/test/data/webui/polymer_browser_test_base.js
+++ b/chrome/test/data/webui/polymer_browser_test_base.js
@@ -91,10 +91,9 @@
     // Import Polymer and iron-test-helpers before running tests.
     suiteSetup(function() {
       var promises = [];
-      if (typeof Polymer != 'function') {
+      if (!window.Polymer) {
         promises.push(
-            PolymerTest.importHtml(
-                'chrome://resources/polymer/v1_0/polymer/polymer.html'));
+            PolymerTest.importHtml('chrome://resources/html/polymer.html'));
       }
       if (typeof MockInteractions != 'object') {
         // Avoid importing the HTML file because iron-test-helpers assumes it is
diff --git a/chrome/test/data/webui/settings/fake_language_settings_private.js b/chrome/test/data/webui/settings/fake_language_settings_private.js
new file mode 100644
index 0000000..96aa9149
--- /dev/null
+++ b/chrome/test/data/webui/settings/fake_language_settings_private.js
@@ -0,0 +1,185 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/**
+ * @fileoverview Fake implementation of chrome.languageSettingsPrivate
+ * for testing.
+ */
+cr.define('settings', function() {
+  /**
+   * Fake of the chrome.languageSettingsPrivate API.
+   * @constructor
+   * @implements {LanguageSettingsPrivate}
+   */
+  function FakeLanguageSettingsPrivate() {
+    /** @type {!Array<!chrome.languageSettingsPrivate.Language>} */
+    this.languages = [{
+      // English and some variants.
+      code: 'en',
+      displayName: 'English',
+      nativeDisplayName: 'English',
+      supportsTranslate: true,
+    }, {
+      code: 'en-CA',
+      displayName: 'English (Canada)',
+      nativeDisplayName: 'English (Canada)',
+      supportsSpellcheck: true,
+      supportsUI: true,
+    }, {
+      code: 'en-US',
+      displayName: 'English (United States)',
+      nativeDisplayName: 'English (United States)',
+      supportsSpellcheck: true,
+      supportsUI: true,
+    }, {
+      // A standalone language.
+      code: "sw",
+      displayName: "Swahili",
+      nativeDisplayName: "Kiswahili",
+      supportsTranslate: true,
+      supportsUI: true,
+    }, {
+      // A standalone language that doesn't support anything.
+      code: "tk",
+      displayName: "Turkmen",
+      nativeDisplayName: "Turkmen"
+    }, {
+      // Edge cases:
+      // Norwegian is the macrolanguage for "nb" (see below).
+      code: "no",
+      displayName: "Norwegian",
+      nativeDisplayName: "norsk",
+      supportsTranslate: true,
+    }, {
+      // Norwegian language codes don't start with "no-" but should still
+      // fall under the Norwegian macrolanguage.
+      // TODO(michaelpg): Test this is ordered correctly.
+      code: "nb",
+      displayName: "Norwegian Bokmål",
+      nativeDisplayName: "norsk bokmål",
+      supportsSpellcheck: true,
+      supportsUI: true,
+    }];
+  }
+
+  FakeLanguageSettingsPrivate.prototype = {
+    // Methods for use in testing.
+
+    /** @param {SettingsPrefsElement} */
+    setSettingsPrefs: function(settingsPrefs) {
+      this.settingsPrefs_ = settingsPrefs;
+    },
+
+    // LanguageSettingsPrivate fake.
+
+    /**
+     * Gets languages available for translate, spell checking, input and locale.
+     * @param {function(!Array<!chrome.languageSettingsPrivate.Language>)}
+     *     callback
+     */
+    getLanguageList: function(callback) {
+      setTimeout(function() {
+        callback(JSON.parse(JSON.stringify(this.languages)));
+      }.bind(this));
+    },
+
+    /**
+     * Sets the accepted languages, used to decide which languages to translate,
+     * generate the Accept-Language header, etc.
+     * @param {!Array<string>} languageCodes
+     */
+    setLanguageList: function(languageCodes) {
+      var languages = languageCodes.join(',');
+      this.settingsPrefs_.set('prefs.intl.accept_languages.value', languages);
+      if (cr.isChromeOS) {
+        this.settingsPrefs_.set(
+            'prefs.settings.language.preferred_languages.value', languages);
+      }
+    },
+
+    /**
+     * Gets the current status of the chosen spell check dictionaries.
+     * @param {function(!Array<
+     *     !chrome.languageSettingsPrivate.SpellcheckDictionaryStatus>):void}
+     *     callback
+     */
+    getSpellcheckDictionaryStatuses: assertNotReached,
+
+    /**
+     * Gets the custom spell check words, in sorted order.
+     * @param {function(!Array<string>):void} callback
+     */
+    getSpellcheckWords: assertNotReached,
+
+    /**
+     * Adds a word to the custom dictionary.
+     * @param {string} word
+     */
+    addSpellcheckWord: assertNotReached,
+
+    /**
+     * Removes a word from the custom dictionary.
+     * @param {string} word
+     */
+    removeSpellcheckWord: assertNotReached,
+
+    /**
+     * Gets the translate target language (in most cases, the display locale).
+     * @param {function(string):void} callback
+     */
+    getTranslateTargetLanguage: function(callback) {
+      setTimeout(callback.bind(null, 'en'));
+    },
+
+    /**
+     * Gets all supported input methods, including third-party IMEs. Chrome OS
+     * only.
+     * @param {function(!chrome.languageSettingsPrivate.InputMethodLists):void}
+     *     callback
+     */
+    getInputMethodLists: assertNotReached,
+
+    /**
+     * Adds the input method to the current user's list of enabled input
+     * methods, enabling the input method for the current user. Chrome OS only.
+     * @param {string} inputMethodId
+     */
+    addInputMethod: assertNotReached,
+
+    /**
+     * Removes the input method from the current user's list of enabled input
+     * methods, disabling the input method for the current user. Chrome OS only.
+     * @param {string} inputMethodId
+     */
+    removeInputMethod: assertNotReached,
+
+    /**
+     * Called when the pref for the dictionaries used for spell checking changes
+     * or the status of one of the spell check dictionaries changes.
+     * @type {!ChromeEvent}
+     */
+    onSpellcheckDictionariesChanged: new FakeChromeEvent(),
+
+    /**
+     * Called when words are added to and/or removed from the custom spell check
+     * dictionary.
+     * @type {!ChromeEvent}
+     */
+    onCustomDictionaryChanged: new FakeChromeEvent(),
+
+    /**
+     * Called when an input method is added.
+     * @type {!ChromeEvent}
+     */
+    onInputMethodAdded: new FakeChromeEvent(),
+
+    /**
+     * Called when an input method is removed.
+     * @type {!ChromeEvent}
+     */
+    onInputMethodRemoved: new FakeChromeEvent(),
+  };
+
+  return {FakeLanguageSettingsPrivate: FakeLanguageSettingsPrivate};
+});
diff --git a/chrome/test/data/webui/settings/languages_page_browsertest.js b/chrome/test/data/webui/settings/languages_page_browsertest.js
new file mode 100644
index 0000000..b80f4b80
--- /dev/null
+++ b/chrome/test/data/webui/settings/languages_page_browsertest.js
@@ -0,0 +1,217 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/** @fileoverview Suite of tests for settings-languages-page. */
+
+/** @const {string} Path to root from chrome/test/data/webui/settings/. */
+var ROOT_PATH = '../../../../../';
+
+// Polymer BrowserTest fixture.
+GEN_INCLUDE(
+    [ROOT_PATH + 'chrome/test/data/webui/polymer_browser_test_base.js']);
+// SettingsPageBrowserTest fixture.
+GEN_INCLUDE([ROOT_PATH +
+             'chrome/test/data/webui/settings/settings_page_browsertest.js']);
+
+var languageSettings = languageSettings || {};
+
+/**
+ * Test class for settings-languages-singleton.
+ * @constructor
+ * @extends {PolymerTest}
+ */
+function SettingsLanguagesSingletonBrowserTest() {
+}
+
+SettingsLanguagesSingletonBrowserTest.prototype = {
+  __proto__: PolymerTest.prototype,
+
+  /** @override */
+  browsePreload: 'chrome://md-settings/languages_page/languages.html',
+
+  /** @override */
+  extraLibraries: PolymerTest.getLibraries(ROOT_PATH).concat([
+    '../fake_chrome_event.js',
+    'fake_language_settings_private.js',
+    'fake_settings_private.js'
+  ]),
+
+  /** @type {LanguageSettingsPrivate} */
+  languageSettingsPrivateApi: undefined,
+
+  /** @override */
+  runAccessibilityChecks: false,
+
+  /** @override */
+  preLoad: function() {
+    PolymerTest.prototype.preLoad.call(this);
+    this.languageSettingsPrivateApi =
+        new settings.FakeLanguageSettingsPrivate();
+    cr.exportPath('languageSettings').languageSettingsPrivateApiForTest =
+        this.languageSettingsPrivateApi;
+  },
+};
+
+// Tests settings-languages-singleton.
+TEST_F('SettingsLanguagesSingletonBrowserTest', 'LanguagesSingleton',
+       function() {
+  var settingsPrefs;
+  var fakePrefs = [{
+    key: 'intl.app_locale',
+    type: chrome.settingsPrivate.PrefType.STRING,
+    value: 'en-US',
+  }, {
+    key: 'intl.accept_languages',
+    type: chrome.settingsPrivate.PrefType.STRING,
+    value: 'en-US,sw',
+  }, {
+    key: 'spellcheck.dictionaries',
+    type: chrome.settingsPrivate.PrefType.LIST,
+    value: ['en-US'],
+  }, {
+    key: 'translate_blocked_languages',
+    type: chrome.settingsPrivate.PrefType.LIST,
+    value: ['en-US'],
+  }];
+  if (cr.isChromeOS) {
+    fakePrefs.push({
+      key: 'settings.language.preferred_languages',
+      type: chrome.settingsPrivate.PrefType.STRING,
+      value: 'en-US,sw',
+    });
+  }
+
+  var self = this;
+  suite('LanguagesSingleton', function() {
+    var languageHelper;
+
+    suiteSetup(function() {
+      CrSettingsPrefs.deferInitialization = true;
+      settingsPrefs = document.createElement('settings-prefs');
+      assertTrue(!!settingsPrefs);
+      var fakeApi = new settings.FakeSettingsPrivate(fakePrefs);
+      settingsPrefs.initializeForTesting(fakeApi);
+
+      self.languageSettingsPrivateApi.setSettingsPrefs(settingsPrefs);
+      languageHelper = LanguageHelperImpl.getInstance();
+      return languageHelper.initialized;
+    });
+
+    test('languages model', function() {
+      for (var i = 0; i < self.languageSettingsPrivateApi.languages.length;
+           i++) {
+        assertEquals(self.languageSettingsPrivateApi.languages[i].code,
+                     languageHelper.languages.supportedLanguages[i].code);
+      }
+      assertEquals('en-US',
+                   languageHelper.languages.enabledLanguages[0].language.code);
+      assertEquals('sw',
+                   languageHelper.languages.enabledLanguages[1].language.code);
+      assertEquals('en', languageHelper.languages.translateTarget);
+
+      // TODO(michaelpg): Test other aspects of the model.
+    });
+
+    test('modifying languages', function() {
+      assertTrue(languageHelper.isLanguageEnabled('en-US'));
+      assertTrue(languageHelper.isLanguageEnabled('sw'));
+      assertFalse(languageHelper.isLanguageEnabled('en-CA'));
+
+      languageHelper.enableLanguage('en-CA');
+      assertTrue(languageHelper.isLanguageEnabled('en-CA'));
+      languageHelper.disableLanguage('sw');
+      assertFalse(languageHelper.isLanguageEnabled('sw'));
+
+      // TODO(michaelpg): Test other modifications.
+    });
+  });
+
+  mocha.run();
+});
+
+/**
+ * Test class for settings-languages-page.
+ * @constructor
+ * @extends {SettingsPageBrowserTest}
+ */
+function SettingsLanguagesPageBrowserTest() {
+}
+
+SettingsLanguagesPageBrowserTest.prototype = {
+  __proto__: SettingsPageBrowserTest.prototype,
+
+  /** @override */
+  browsePreload: 'chrome://md-settings/advanced',
+
+  /** @override */
+  preLoad: function() {
+    SettingsPageBrowserTest.prototype.preLoad.call(this);
+    settingsHidePagesByDefaultForTest = true;
+  },
+};
+
+// May time out on debug builders and memory bots because
+// the Settings page can take several seconds to load in a Release build
+// and several times that in a Debug build. See https://crbug.com/558434.
+GEN('#if defined(MEMORY_SANITIZER) || !defined(NDEBUG)');
+GEN('#define MAYBE_LanguagesPage DISABLED_LanguagesPage');
+GEN('#else');
+GEN('#define MAYBE_LanguagesPage LanguagesPage');
+GEN('#endif');
+
+// Runs languages page tests.
+TEST_F('SettingsLanguagesPageBrowserTest', 'MAYBE_LanguagesPage', function() {
+  suite('languages page', function() {
+    testing.Test.disableAnimationsAndTransitions();
+
+    var advanced = this.getPage('advanced');
+
+    suiteSetup(function() {
+      advanced.set('pageVisibility.languages', true);
+      Polymer.dom.flush();
+
+      return LanguageHelperImpl.getInstance().initialized;
+    });
+
+    test('languages page', function(done) {
+      var languagesSection = this.getSection(advanced, 'languages');
+      assertTrue(!!languagesSection);
+      var languagesPage =
+          languagesSection.querySelector('settings-languages-page');
+      assertTrue(!!languagesPage);
+
+      var manageLanguagesButton =
+          languagesPage.$.languagesCollapse.querySelector('.list-button');
+      MockInteractions.tap(manageLanguagesButton);
+      assertTrue(!!languagesPage.$$('settings-manage-languages-page'));
+
+      // TODO(michaelpg): figure out why setTimeout is necessary, only after
+      // opening the first subpage.
+      setTimeout(function() {
+        var languageButton = languagesPage.$.languagesCollapse.querySelector(
+            '.list-item paper-icon-button[icon=settings]');
+        assertTrue(!!languageButton);
+        MockInteractions.tap(languageButton);
+
+        assertTrue(!!languagesPage.root.querySelector(
+            'settings-language-detail-page'));
+
+        var spellCheckCollapse = languagesPage.$.spellCheckCollapse;
+        assertEquals(cr.isMac, !spellCheckCollapse);
+        if (!cr.isMac) {
+          var spellCheckButton = spellCheckCollapse.querySelector(
+              '.list-button');
+          MockInteractions.tap(spellCheckButton);
+          assertTrue(!!languagesPage.$$('settings-edit-dictionary-page'));
+        }
+        done();
+      }.bind(this));
+    }.bind(this));
+  }.bind(this));
+
+  // TODO(michaelpg): Test more aspects of the languages UI.
+
+  // Run all registered tests.
+  mocha.run();
+});
diff --git a/chrome/utility/chrome_content_utility_client.cc b/chrome/utility/chrome_content_utility_client.cc
index 85cbd63..e7f7ac2 100644
--- a/chrome/utility/chrome_content_utility_client.cc
+++ b/chrome/utility/chrome_content_utility_client.cc
@@ -197,6 +197,15 @@
 
 void ChromeContentUtilityClient::RegisterMojoServices(
     content::ServiceRegistry* registry) {
+  // When the utility process is running with elevated privileges, we need to
+  // filter messages so that only a whitelist of IPCs can run. In Mojo, there's
+  // no way of filtering individual messages. Instead, we can avoid adding
+  // non-whitelisted Mojo services to the ServiceRegistry.
+  // TODO(amistry): Use a whitelist once the whistlisted IPCs have been
+  // converted to Mojo.
+  if (filter_messages_)
+    return;
+
 #if !defined(OS_ANDROID)
   registry->AddService<net::interfaces::ProxyResolverFactory>(
       base::Bind(CreateProxyResolverFactory));
diff --git a/components/content_settings/core/browser/host_content_settings_map.cc b/components/content_settings/core/browser/host_content_settings_map.cc
index e023a79..5307adea 100644
--- a/components/content_settings/core/browser/host_content_settings_map.cc
+++ b/components/content_settings/core/browser/host_content_settings_map.cc
@@ -166,6 +166,8 @@
       new content_settings::DefaultProvider(prefs_, is_off_the_record_);
   default_provider->AddObserver(this);
   content_settings_providers_[DEFAULT_PROVIDER] = default_provider;
+
+  MigrateOldSettings();
 }
 
 // static
@@ -439,6 +441,52 @@
                     resource_identifier, setting);
 }
 
+void HostContentSettingsMap::MigrateOldSettings() {
+  const ContentSettingsType kMigrateContentSettingTypes[] = {
+      // Only content types of scoping type: REQUESTING_DOMAIN_ONLY_SCOPE,
+      // REQUESTING_ORIGIN_ONLY_SCOPE and TOP_LEVEL_DOMAIN_ONLY_SCOPE need to be
+      // migrated.
+      CONTENT_SETTINGS_TYPE_KEYGEN};
+  for (const ContentSettingsType& type : kMigrateContentSettingTypes) {
+    WebsiteSettingsInfo::ScopingType scoping_type =
+        content_settings::ContentSettingsRegistry::GetInstance()
+            ->Get(type)
+            ->website_settings_info()
+            ->scoping_type();
+    DCHECK_NE(
+        scoping_type,
+        WebsiteSettingsInfo::REQUESTING_ORIGIN_AND_TOP_LEVEL_ORIGIN_SCOPE);
+
+    ContentSettingsForOneType settings;
+    GetSettingsForOneType(type, std::string(), &settings);
+    for (const ContentSettingPatternSource& setting_entry : settings) {
+      // Migrate user preference settings only.
+      if (setting_entry.source != "preference")
+        continue;
+      // Migrate old-format settings only.
+      if (setting_entry.secondary_pattern !=
+          ContentSettingsPattern::Wildcard()) {
+        GURL url(setting_entry.primary_pattern.ToString());
+        // Pull out the value of the old-format setting. Only do this if the
+        // patterns are as we expect them to be, otherwise the setting will just
+        // be removed for safety.
+        ContentSetting content_setting = CONTENT_SETTING_DEFAULT;
+        if (setting_entry.primary_pattern == setting_entry.secondary_pattern &&
+            url.is_valid()) {
+          content_setting = GetContentSetting(url, url, type, std::string());
+        }
+        // Remove the old pattern.
+        SetContentSetting(setting_entry.primary_pattern,
+                          setting_entry.secondary_pattern, type, std::string(),
+                          CONTENT_SETTING_DEFAULT);
+        // Set the new pattern.
+        SetContentSettingDefaultScope(url, GURL(), type, std::string(),
+                                      content_setting);
+      }
+    }
+  }
+}
+
 ContentSetting HostContentSettingsMap::GetContentSettingAndMaybeUpdateLastUsage(
     const GURL& primary_url,
     const GURL& secondary_url,
diff --git a/components/content_settings/core/browser/host_content_settings_map.h b/components/content_settings/core/browser/host_content_settings_map.h
index 9273057..7a75222a41 100644
--- a/components/content_settings/core/browser/host_content_settings_map.h
+++ b/components/content_settings/core/browser/host_content_settings_map.h
@@ -279,7 +279,8 @@
 
  private:
   friend class base::RefCountedThreadSafe<HostContentSettingsMap>;
-  friend class HostContentSettingsMapTest_NonDefaultSettings_Test;
+  friend class HostContentSettingsMapTest_MigrateOldSettings_Test;
+
   friend class content_settings::TestUtils;
 
   typedef std::map<ProviderType, content_settings::ProviderInterface*>
@@ -293,6 +294,17 @@
       ContentSettingsType content_type,
       content_settings::ProviderInterface* provider) const;
 
+  // Migrate old settings for ContentSettingsTypes which only use a primary
+  // pattern. Settings which only used a primary pattern were inconsistent in
+  // what they did with the secondary pattern. Some stored a
+  // ContentSettingsPattern::Wildcard() whereas others stored the same pattern
+  // twice. This function migrates all such settings to use
+  // ContentSettingsPattern::Wildcard(). This allows us to make the scoping code
+  // consistent across different settings.
+  // TODO(lshang): Remove this when clients have migrated (~M53). We should
+  // leave in some code to remove old-format settings for a long time.
+  void MigrateOldSettings();
+
   // Adds content settings for |content_type| and |resource_identifier|,
   // provided by |provider|, into |settings|. If |incognito| is true, adds only
   // the content settings which are applicable to the incognito mode and differ
diff --git a/components/error_page/renderer/net_error_helper_core.cc b/components/error_page/renderer/net_error_helper_core.cc
index d5c6ca7..eb930ae 100644
--- a/components/error_page/renderer/net_error_helper_core.cc
+++ b/components/error_page/renderer/net_error_helper_core.cc
@@ -888,11 +888,11 @@
   return updated_error;
 }
 
-void NetErrorHelperCore::Reload(bool ignore_cache) {
+void NetErrorHelperCore::Reload(bool bypass_cache) {
   if (!committed_error_page_info_) {
     return;
   }
-  delegate_->ReloadPage(ignore_cache);
+  delegate_->ReloadPage(bypass_cache);
 }
 
 bool NetErrorHelperCore::MaybeStartAutoReloadTimer() {
diff --git a/components/error_page/renderer/net_error_helper_core.h b/components/error_page/renderer/net_error_helper_core.h
index 1dc97e6c..426cd07 100644
--- a/components/error_page/renderer/net_error_helper_core.h
+++ b/components/error_page/renderer/net_error_helper_core.h
@@ -105,7 +105,7 @@
         const std::string& tracking_request_body) = 0;
 
     // Starts a reload of the page in the observed frame.
-    virtual void ReloadPage(bool ignore_cache) = 0;
+    virtual void ReloadPage(bool bypass_cache) = 0;
 
     // Load the original page from cache.
     virtual void LoadPageFromCache(const GURL& page_url) = 0;
@@ -232,7 +232,7 @@
 
   blink::WebURLError GetUpdatedError(const blink::WebURLError& error) const;
 
-  void Reload(bool ignore_cache);
+  void Reload(bool bypass_cache);
   bool MaybeStartAutoReloadTimer();
   void StartAutoReloadTimer();
   void AutoReloadTimerFired();
diff --git a/components/error_page/renderer/net_error_helper_core_unittest.cc b/components/error_page/renderer/net_error_helper_core_unittest.cc
index 2b3a3a9c..512e3789 100644
--- a/components/error_page/renderer/net_error_helper_core_unittest.cc
+++ b/components/error_page/renderer/net_error_helper_core_unittest.cc
@@ -424,9 +424,9 @@
     request_body_.clear();
   }
 
-  void ReloadPage(bool ignore_cache) override {
+  void ReloadPage(bool bypass_cache) override {
     reload_count_++;
-    if (ignore_cache)
+    if (bypass_cache)
       reload_bypassing_cache_count_++;
   }
 
diff --git a/components/guest_view/renderer/guest_view_container.cc b/components/guest_view/renderer/guest_view_container.cc
index 4d8df382..0c63a16f 100644
--- a/components/guest_view/renderer/guest_view_container.cc
+++ b/components/guest_view/renderer/guest_view_container.cc
@@ -98,14 +98,16 @@
   if (element_instance_id() != guest_view::kInstanceIDNone)
     g_guest_view_container_map.Get().erase(element_instance_id());
 
-  if (pending_response_.get())
-    pending_response_->ExecuteCallbackIfAvailable(0 /* argc */, nullptr);
+  if (!embedder_frame_destroyed) {
+    if (pending_response_.get())
+      pending_response_->ExecuteCallbackIfAvailable(0 /* argc */, nullptr);
 
-  while (pending_requests_.size() > 0) {
-    linked_ptr<GuestViewRequest> pending_request = pending_requests_.front();
-    pending_requests_.pop_front();
-    // Call the JavaScript callbacks with no arguments which implies an error.
-    pending_request->ExecuteCallbackIfAvailable(0 /* argc */, nullptr);
+    while (pending_requests_.size() > 0) {
+      linked_ptr<GuestViewRequest> pending_request = pending_requests_.front();
+      pending_requests_.pop_front();
+      // Call the JavaScript callbacks with no arguments which implies an error.
+      pending_request->ExecuteCallbackIfAvailable(0 /* argc */, nullptr);
+    }
   }
 
   delete this;
diff --git a/content/BUILD.gn b/content/BUILD.gn
index 1ece4f9..d2d450a6 100644
--- a/content/BUILD.gn
+++ b/content/BUILD.gn
@@ -62,7 +62,6 @@
     "//content/public/child:child_sources",
     "//content/public/gpu:gpu_sources",
     "//content/public/common:common_sources",
-    "//content/public/plugin:plugin_sources",
     "//content/public/renderer:renderer_sources",
     "//content/public/utility:utility_sources",
   ]
diff --git a/content/DEPS b/content/DEPS
index 55a5fe1..531e5ed 100644
--- a/content/DEPS
+++ b/content/DEPS
@@ -60,7 +60,6 @@
   "+third_party/flac",
   "+third_party/libjingle",
   "+third_party/mozilla",
-  "+third_party/npapi/bindings",
   "+third_party/ocmock",
   "+third_party/re2",
   "+third_party/skia",
diff --git a/content/app/content_main_runner.cc b/content/app/content_main_runner.cc
index 1bca247..fefb3212 100644
--- a/content/app/content_main_runner.cc
+++ b/content/app/content_main_runner.cc
@@ -56,7 +56,6 @@
 #include "content/public/common/main_function_params.h"
 #include "content/public/common/sandbox_init.h"
 #include "content/public/gpu/content_gpu_client.h"
-#include "content/public/plugin/content_plugin_client.h"
 #include "content/public/renderer/content_renderer_client.h"
 #include "content/public/utility/content_utility_client.h"
 #include "content/renderer/in_process_renderer_thread.h"
@@ -133,8 +132,6 @@
 #if !defined(CHROME_MULTIPLE_DLL_BROWSER)
 base::LazyInstance<ContentGpuClient>
     g_empty_content_gpu_client = LAZY_INSTANCE_INITIALIZER;
-base::LazyInstance<ContentPluginClient>
-    g_empty_content_plugin_client = LAZY_INSTANCE_INITIALIZER;
 base::LazyInstance<ContentRendererClient>
     g_empty_content_renderer_client = LAZY_INSTANCE_INITIALIZER;
 base::LazyInstance<ContentUtilityClient>
@@ -236,16 +233,9 @@
         content_client->gpu_ = &g_empty_content_gpu_client.Get();
     }
 
-    if (process_type == switches::kPluginProcess ||
-        process_type == switches::kPpapiPluginProcess) {
-      if (delegate)
-        content_client->plugin_ = delegate->CreateContentPluginClient();
-      if (!content_client->plugin_)
-        content_client->plugin_ = &g_empty_content_plugin_client.Get();
-      // Single process not supported in split dll mode.
-    } else if (process_type == switches::kRendererProcess ||
-               base::CommandLine::ForCurrentProcess()->HasSwitch(
-                   switches::kSingleProcess)) {
+    if (process_type == switches::kRendererProcess ||
+        base::CommandLine::ForCurrentProcess()->HasSwitch(
+            switches::kSingleProcess)) {
       if (delegate)
         content_client->renderer_ = delegate->CreateContentRendererClient();
       if (!content_client->renderer_)
diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
index b0b38b6..2ada88c 100644
--- a/content/browser/BUILD.gn
+++ b/content/browser/BUILD.gn
@@ -96,7 +96,6 @@
     "//third_party/kasko:kasko_features",
     "//third_party/leveldatabase",
     "//third_party/libyuv",
-    "//third_party/npapi",
     "//third_party/re2",
     "//third_party/webrtc",
     "//third_party/webrtc/base:rtc_base",
diff --git a/content/browser/android/in_process/context_provider_in_process.cc b/content/browser/android/in_process/context_provider_in_process.cc
index f27734ac..e7cbb65e 100644
--- a/content/browser/android/in_process/context_provider_in_process.cc
+++ b/content/browser/android/in_process/context_provider_in_process.cc
@@ -11,7 +11,7 @@
 #include "base/callback_helpers.h"
 #include "base/strings/stringprintf.h"
 #include "cc/output/managed_memory_policy.h"
-#include "content/common/gpu/client/grcontext_for_webgraphicscontext3d.h"
+#include "content/common/gpu/client/grcontext_for_gles2_interface.h"
 #include "gpu/blink/webgraphicscontext3d_in_process_command_buffer_impl.h"
 #include "gpu/command_buffer/client/gles2_implementation.h"
 #include "third_party/skia/include/gpu/GrContext.h"
@@ -25,11 +25,11 @@
  public:
   explicit LostContextCallbackProxy(ContextProviderInProcess* provider)
       : provider_(provider) {
-    provider_->WebContext3DImpl()->setContextLostCallback(this);
+    provider_->context3d_->setContextLostCallback(this);
   }
 
   ~LostContextCallbackProxy() override {
-    provider_->WebContext3DImpl()->setContextLostCallback(NULL);
+    provider_->context3d_->setContextLostCallback(nullptr);
   }
 
   void onContextLost() override {
@@ -45,19 +45,16 @@
     scoped_ptr<WebGraphicsContext3DInProcessCommandBufferImpl> context3d,
     const std::string& debug_name) {
   if (!context3d)
-    return NULL;
+    return nullptr;
   return new ContextProviderInProcess(std::move(context3d), debug_name);
 }
 
 ContextProviderInProcess::ContextProviderInProcess(
     scoped_ptr<WebGraphicsContext3DInProcessCommandBufferImpl> context3d,
     const std::string& debug_name)
-    : debug_name_(debug_name) {
+    : context3d_(std::move(context3d)), debug_name_(debug_name) {
   DCHECK(main_thread_checker_.CalledOnValidThread());
-  DCHECK(context3d);
-  gr_interface_ = skia::AdoptRef(
-      new GrGLInterfaceForWebGraphicsContext3D(std::move(context3d)));
-  DCHECK(gr_interface_->WebContext3D());
+  DCHECK(context3d_);
   context_thread_checker_.DetachFromThread();
 }
 
@@ -70,20 +67,11 @@
   DCHECK(lost_context_callback_proxy_);  // Is bound to thread.
   DCHECK(context_thread_checker_.CalledOnValidThread());
 
-  return WebContext3DImpl();
-}
-
-gpu_blink::WebGraphicsContext3DInProcessCommandBufferImpl*
-    ContextProviderInProcess::WebContext3DImpl() {
-  DCHECK(gr_interface_->WebContext3D());
-
-  return
-      static_cast<gpu_blink::WebGraphicsContext3DInProcessCommandBufferImpl*>(
-          gr_interface_->WebContext3D());
+  return context3d_.get();
 }
 
 bool ContextProviderInProcess::BindToCurrentThread() {
-  DCHECK(WebContext3DImpl());
+  DCHECK(context3d_);
 
   // This is called on the thread the context will be used.
   DCHECK(context_thread_checker_.CalledOnValidThread());
@@ -91,14 +79,13 @@
   if (lost_context_callback_proxy_)
     return true;
 
-  if (!WebContext3DImpl()->InitializeOnCurrentThread())
+  if (!context3d_->InitializeOnCurrentThread())
     return false;
 
-  gr_interface_->BindToCurrentThread();
   InitializeCapabilities();
 
   const std::string unique_context_name =
-      base::StringPrintf("%s-%p", debug_name_.c_str(), WebContext3DImpl());
+      base::StringPrintf("%s-%p", debug_name_.c_str(), context3d_.get());
   ContextGL()->TraceBeginCHROMIUM("gpu_toplevel", unique_context_name.c_str());
 
   lost_context_callback_proxy_.reset(new LostContextCallbackProxy(this));
@@ -110,9 +97,9 @@
 }
 
 void ContextProviderInProcess::InitializeCapabilities() {
-  capabilities_.gpu = WebContext3DImpl()->GetImplementation()->capabilities();
+  capabilities_.gpu = context3d_->GetImplementation()->capabilities();
 
-  size_t mapped_memory_limit = WebContext3DImpl()->GetMappedMemoryLimit();
+  size_t mapped_memory_limit = context3d_->GetMappedMemoryLimit();
   capabilities_.max_transfer_buffer_usage_bytes =
       mapped_memory_limit ==
               WebGraphicsContext3DInProcessCommandBufferImpl::kNoLimit
@@ -128,21 +115,21 @@
 }
 
 ::gpu::gles2::GLES2Interface* ContextProviderInProcess::ContextGL() {
-  DCHECK(WebContext3DImpl());
+  DCHECK(context3d_);
   DCHECK(lost_context_callback_proxy_);  // Is bound to thread.
   DCHECK(context_thread_checker_.CalledOnValidThread());
 
-  return WebContext3DImpl()->GetGLInterface();
+  return context3d_->GetGLInterface();
 }
 
 ::gpu::ContextSupport* ContextProviderInProcess::ContextSupport() {
-  DCHECK(WebContext3DImpl());
+  DCHECK(context3d_);
   if (!lost_context_callback_proxy_)
     return NULL;  // Not bound to anything.
 
   DCHECK(context_thread_checker_.CalledOnValidThread());
 
-  return WebContext3DImpl()->GetContextSupport();
+  return context3d_->GetContextSupport();
 }
 
 class GrContext* ContextProviderInProcess::GrContext() {
@@ -152,7 +139,8 @@
   if (gr_context_)
     return gr_context_->get();
 
-  gr_context_.reset(new GrContextForWebGraphicsContext3D(gr_interface_));
+  gr_context_.reset(
+      new GrContextForGLES2Interface(context3d_->GetGLInterface()));
   return gr_context_->get();
 }
 
@@ -165,7 +153,7 @@
 }
 
 void ContextProviderInProcess::SetupLock() {
-  WebContext3DImpl()->SetLock(&context_lock_);
+  context3d_->SetLock(&context_lock_);
 }
 
 base::Lock* ContextProviderInProcess::GetLock() {
diff --git a/content/browser/android/in_process/context_provider_in_process.h b/content/browser/android/in_process/context_provider_in_process.h
index fe24f94..37f494a 100644
--- a/content/browser/android/in_process/context_provider_in_process.h
+++ b/content/browser/android/in_process/context_provider_in_process.h
@@ -14,7 +14,6 @@
 #include "base/synchronization/lock.h"
 #include "base/threading/thread_checker.h"
 #include "cc/blink/context_provider_web_context.h"
-#include "skia/ext/refptr.h"
 
 namespace blink { class WebGraphicsContext3D; }
 
@@ -24,8 +23,7 @@
 
 namespace content {
 
-class GrContextForWebGraphicsContext3D;
-class GrGLInterfaceForWebGraphicsContext3D;
+class GrContextForGLES2Interface;
 
 class ContextProviderInProcess
     : NON_EXPORTED_BASE(public cc_blink::ContextProviderWebContext) {
@@ -45,8 +43,6 @@
   // cc_blink::ContextProviderWebContext:
   blink::WebGraphicsContext3D* WebContext3D() override;
 
-  gpu_blink::WebGraphicsContext3DInProcessCommandBufferImpl* WebContext3DImpl();
-
   // cc::ContextProvider:
   bool BindToCurrentThread() override;
   void DetachFromThread() override;
@@ -67,8 +63,9 @@
   base::ThreadChecker main_thread_checker_;
   base::ThreadChecker context_thread_checker_;
 
-  skia::RefPtr<GrGLInterfaceForWebGraphicsContext3D> gr_interface_;
-  scoped_ptr<GrContextForWebGraphicsContext3D> gr_context_;
+  scoped_ptr<gpu_blink::WebGraphicsContext3DInProcessCommandBufferImpl>
+      context3d_;
+  scoped_ptr<GrContextForGLES2Interface> gr_context_;
 
   LostContextCallback lost_context_callback_;
 
diff --git a/content/browser/frame_host/render_widget_host_view_child_frame.cc b/content/browser/frame_host/render_widget_host_view_child_frame.cc
index 59155ca0..6c022fb 100644
--- a/content/browser/frame_host/render_widget_host_view_child_frame.cc
+++ b/content/browser/frame_host/render_widget_host_view_child_frame.cc
@@ -469,12 +469,6 @@
 void RenderWidgetHostViewChildFrame::SetActive(bool active) {
 }
 
-void RenderWidgetHostViewChildFrame::SetWindowVisibility(bool visible) {
-}
-
-void RenderWidgetHostViewChildFrame::WindowFrameChanged() {
-}
-
 void RenderWidgetHostViewChildFrame::ShowDefinitionForSelection() {
 }
 
@@ -491,11 +485,6 @@
 
 void RenderWidgetHostViewChildFrame::StopSpeaking() {
 }
-
-bool RenderWidgetHostViewChildFrame::PostProcessEventForPluginIme(
-      const NativeWebKeyboardEvent& event) {
-  return false;
-}
 #endif  // defined(OS_MACOSX)
 
 void RenderWidgetHostViewChildFrame::RegisterFrameSwappedCallback(
diff --git a/content/browser/frame_host/render_widget_host_view_child_frame.h b/content/browser/frame_host/render_widget_host_view_child_frame.h
index 4c4a74f3..825ca060 100644
--- a/content/browser/frame_host/render_widget_host_view_child_frame.h
+++ b/content/browser/frame_host/render_widget_host_view_child_frame.h
@@ -148,17 +148,11 @@
 #if defined(OS_MACOSX)
   // RenderWidgetHostView implementation.
   void SetActive(bool active) override;
-  void SetWindowVisibility(bool visible) override;
-  void WindowFrameChanged() override;
   void ShowDefinitionForSelection() override;
   bool SupportsSpeech() const override;
   void SpeakSelection() override;
   bool IsSpeaking() const override;
   void StopSpeaking() override;
-
-  // RenderWidgetHostViewBase implementation.
-  bool PostProcessEventForPluginIme(
-      const NativeWebKeyboardEvent& event) override;
 #endif  // defined(OS_MACOSX)
 
   // RenderWidgetHostViewBase implementation.
diff --git a/content/browser/frame_host/render_widget_host_view_guest.cc b/content/browser/frame_host/render_widget_host_view_guest.cc
index 5db6053..b477006b 100644
--- a/content/browser/frame_host/render_widget_host_view_guest.cc
+++ b/content/browser/frame_host/render_widget_host_view_guest.cc
@@ -447,14 +447,6 @@
   platform_view_->SetActive(active);
 }
 
-void RenderWidgetHostViewGuest::SetWindowVisibility(bool visible) {
-  platform_view_->SetWindowVisibility(visible);
-}
-
-void RenderWidgetHostViewGuest::WindowFrameChanged() {
-  platform_view_->WindowFrameChanged();
-}
-
 void RenderWidgetHostViewGuest::ShowDefinitionForSelection() {
   if (!guest_)
     return;
@@ -493,12 +485,6 @@
 void RenderWidgetHostViewGuest::StopSpeaking() {
   platform_view_->StopSpeaking();
 }
-
-bool RenderWidgetHostViewGuest::PostProcessEventForPluginIme(
-    const NativeWebKeyboardEvent& event) {
-  return false;
-}
-
 #endif  // defined(OS_MACOSX)
 
 #if defined(OS_ANDROID) || defined(USE_AURA)
diff --git a/content/browser/frame_host/render_widget_host_view_guest.h b/content/browser/frame_host/render_widget_host_view_guest.h
index a780224e..4e800c8 100644
--- a/content/browser/frame_host/render_widget_host_view_guest.h
+++ b/content/browser/frame_host/render_widget_host_view_guest.h
@@ -112,17 +112,11 @@
 #if defined(OS_MACOSX)
   // RenderWidgetHostView implementation.
   void SetActive(bool active) override;
-  void SetWindowVisibility(bool visible) override;
-  void WindowFrameChanged() override;
   void ShowDefinitionForSelection() override;
   bool SupportsSpeech() const override;
   void SpeakSelection() override;
   bool IsSpeaking() const override;
   void StopSpeaking() override;
-
-  // RenderWidgetHostViewBase implementation.
-  bool PostProcessEventForPluginIme(
-      const NativeWebKeyboardEvent& event) override;
 #endif  // defined(OS_MACOSX)
 
 #if defined(OS_ANDROID) || defined(USE_AURA)
diff --git a/content/browser/gpu/gpu_ipc_browsertests.cc b/content/browser/gpu/gpu_ipc_browsertests.cc
index 2a9a78c..1d77399 100644
--- a/content/browser/gpu/gpu_ipc_browsertests.cc
+++ b/content/browser/gpu/gpu_ipc_browsertests.cc
@@ -14,7 +14,9 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/test/content_browser_test.h"
 #include "gpu/blink/webgraphicscontext3d_in_process_command_buffer_impl.h"
+#include "skia/ext/refptr.h"
 #include "third_party/skia/include/core/SkCanvas.h"
+#include "third_party/skia/include/core/SkPaint.h"
 #include "third_party/skia/include/core/SkSurface.h"
 #include "third_party/skia/include/gpu/GrContext.h"
 #include "ui/gl/gl_switches.h"
@@ -233,17 +235,28 @@
   EXPECT_TRUE(provider->BindToCurrentThread());
 
   skia::RefPtr<GrContext> gr_context = skia::SharePtr(provider->GrContext());
-  provider = nullptr;
 
   SkImageInfo info = SkImageInfo::MakeN32Premul(100, 100);
   skia::RefPtr<SkSurface> surface = skia::AdoptRef(SkSurface::NewRenderTarget(
       gr_context.get(), SkBudgeted::kNo, info));
+  EXPECT_TRUE(surface);
+
+  // Destroy the GL context after we made a surface.
+  provider = nullptr;
+
+  // New surfaces will fail to create now.
+  skia::RefPtr<SkSurface> surface2 = skia::AdoptRef(
+      SkSurface::NewRenderTarget(gr_context.get(), SkBudgeted::kNo, info));
+  EXPECT_FALSE(surface2);
+
+  // Drop our reference to the gr_context also.
   gr_context = nullptr;
 
-  // use the canvas after the provider and grcontext have been locally
-  // unref'ed. This should work just fine thanks to SkSurface_Gpu ref'ing
-  // the GrContext, which is ref'ing the GrGLInterfaceForWebGraphicsContext3D,
-  // which owns the commandbuffer instance.
+  // After the context provider is destroyed, the surface no longer has access
+  // to the GrContext, even though it's alive. Use the canvas after the provider
+  // and GrContext have been locally unref'ed. This should work fine as the
+  // GrContext has been abandoned when the GL context provider was destroyed
+  // above.
   SkPaint greenFillPaint;
   greenFillPaint.setColor(SK_ColorGREEN);
   greenFillPaint.setStyle(SkPaint::kFill_Style);
diff --git a/content/browser/renderer_host/font_utils_linux.cc b/content/browser/renderer_host/font_utils_linux.cc
index 715923d..245475f6 100644
--- a/content/browser/renderer_host/font_utils_linux.cc
+++ b/content/browser/renderer_host/font_utils_linux.cc
@@ -12,8 +12,8 @@
 #include <string>
 
 #include "base/posix/eintr_wrapper.h"
+#include "ppapi/c/private/pp_private_font_charset.h"
 #include "ppapi/c/trusted/ppb_browser_font_trusted.h"
-#include "third_party/npapi/bindings/npapi_extensions.h"
 
 namespace {
 
@@ -41,30 +41,30 @@
 
   bool is_lgc = false;
   switch (fdwCharSet) {
-    case NPCharsetAnsi:
+    case PP_PRIVATEFONTCHARSET_ANSI:
     // These values I don't really know what to do with, so I'm going to map
     // them to English also.
-    case NPCharsetDefault:
-    case NPCharsetMac:
-    case NPCharsetOEM:
-    case NPCharsetSymbol:
+    case PP_PRIVATEFONTCHARSET_DEFAULT:
+    case PP_PRIVATEFONTCHARSET_MAC:
+    case PP_PRIVATEFONTCHARSET_OEM:
+    case PP_PRIVATEFONTCHARSET_SYMBOL:
       is_lgc = true;
       FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("en"));
       break;
-    case NPCharsetBaltic:
+    case PP_PRIVATEFONTCHARSET_BALTIC:
       // The three baltic languages.
       is_lgc = true;
       FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("et"));
       FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("lv"));
       FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("lt"));
       break;
-    case NPCharsetChineseBIG5:
+    case PP_PRIVATEFONTCHARSET_CHINESEBIG5:
       FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("zh-tw"));
       break;
-    case NPCharsetGB2312:
+    case PP_PRIVATEFONTCHARSET_GB2312:
       FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("zh-cn"));
       break;
-    case NPCharsetEastEurope:
+    case PP_PRIVATEFONTCHARSET_EASTEUROPE:
       // A scattering of eastern European languages.
       is_lgc = true;
       FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("pl"));
@@ -73,38 +73,38 @@
       FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("hu"));
       FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("hr"));
       break;
-    case NPCharsetGreek:
+    case PP_PRIVATEFONTCHARSET_GREEK:
       is_lgc = true;
       FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("el"));
       break;
-    case NPCharsetHangul:
-    case NPCharsetJohab:
+    case PP_PRIVATEFONTCHARSET_HANGUL:
+    case PP_PRIVATEFONTCHARSET_JOHAB:
       // Korean
       FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("ko"));
       break;
-    case NPCharsetRussian:
+    case PP_PRIVATEFONTCHARSET_RUSSIAN:
       is_lgc = true;
       FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("ru"));
       break;
-    case NPCharsetShiftJIS:
+    case PP_PRIVATEFONTCHARSET_SHIFTJIS:
       // Japanese
       FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("ja"));
       break;
-    case NPCharsetTurkish:
+    case PP_PRIVATEFONTCHARSET_TURKISH:
       is_lgc = true;
       FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("tr"));
       break;
-    case NPCharsetVietnamese:
+    case PP_PRIVATEFONTCHARSET_VIETNAMESE:
       is_lgc = true;
       FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("vi"));
       break;
-    case NPCharsetArabic:
+    case PP_PRIVATEFONTCHARSET_ARABIC:
       FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("ar"));
       break;
-    case NPCharsetHebrew:
+    case PP_PRIVATEFONTCHARSET_HEBREW:
       FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("he"));
       break;
-    case NPCharsetThai:
+    case PP_PRIVATEFONTCHARSET_THAI:
       FcLangSetAdd(langset, reinterpret_cast<const FcChar8*>("th"));
       break;
       // default:
diff --git a/content/browser/renderer_host/render_widget_host_impl.cc b/content/browser/renderer_host/render_widget_host_impl.cc
index b7bee6d..cacb05f6 100644
--- a/content/browser/renderer_host/render_widget_host_impl.cc
+++ b/content/browser/renderer_host/render_widget_host_impl.cc
@@ -1899,11 +1899,6 @@
       InputEventAckState ack_result) {
   latency_tracker_.OnInputEventAck(event.event, &event.latency);
 
-#if defined(OS_MACOSX)
-  if (!is_hidden() && view_ && view_->PostProcessEventForPluginIme(event.event))
-    return;
-#endif
-
   // We only send unprocessed key event upwards if we are not hidden,
   // because the user has moved away from us and no longer expect any effect
   // of this key event.
diff --git a/content/browser/renderer_host/render_widget_host_view_base.h b/content/browser/renderer_host/render_widget_host_view_base.h
index 463ece5..d06673e 100644
--- a/content/browser/renderer_host/render_widget_host_view_base.h
+++ b/content/browser/renderer_host/render_widget_host_view_base.h
@@ -364,15 +364,6 @@
   virtual void LockCompositingSurface() = 0;
   virtual void UnlockCompositingSurface() = 0;
 
-#if defined(OS_MACOSX)
-  // Does any event handling necessary for plugin IME; should be called after
-  // the plugin has already had a chance to process the event. If plugin IME is
-  // not enabled, this is a no-op, so it is always safe to call.
-  // Returns true if the event was handled by IME.
-  virtual bool PostProcessEventForPluginIme(
-      const NativeWebKeyboardEvent& event) = 0;
-#endif
-
   // Updates the range of the marked text in an IME composition.
   virtual void ImeCompositionRangeChanged(
       const gfx::Range& range,
diff --git a/content/browser/renderer_host/render_widget_host_view_mac.h b/content/browser/renderer_host/render_widget_host_view_mac.h
index 2a4ad7f..0c1b9a9c 100644
--- a/content/browser/renderer_host/render_widget_host_view_mac.h
+++ b/content/browser/renderer_host/render_widget_host_view_mac.h
@@ -81,8 +81,6 @@
   // Is YES if there was a mouse-down as yet unbalanced with a mouse-up.
   BOOL hasOpenMouseDown_;
 
-  NSWindow* lastWindow_;  // weak
-
   // The cursor for the page. This is passed up from the renderer.
   base::scoped_nsobject<NSCursor> currentCursor_;
 
@@ -143,12 +141,6 @@
   // etc.
   content::EditCommands editCommands_;
 
-  // The plugin that currently has focus (-1 if no plugin has focus).
-  int focusedPluginIdentifier_;
-
-  // Whether or not plugin IME is currently enabled active.
-  BOOL pluginImeActive_;
-
   // Whether the previous mouse event was ignored due to hitTest check.
   BOOL mouseEventWasIgnored_;
 
@@ -204,13 +196,6 @@
 - (void)cancelComposition;
 // Confirm ongoing composition.
 - (void)confirmComposition;
-// Enables or disables plugin IME.
-- (void)setPluginImeActive:(BOOL)active;
-// Updates the current plugin focus state.
-- (void)pluginFocusChanged:(BOOL)focused forPlugin:(int)pluginId;
-// Evaluates the event in the context of plugin IME, if plugin IME is enabled.
-// Returns YES if the event was handled.
-- (BOOL)postProcessEventForPluginIme:(NSEvent*)event;
 - (void)updateCursor:(NSCursor*)cursor;
 - (NSRect)firstViewRectForCharacterRange:(NSRange)theRange
                              actualRange:(NSRangePointer)actualRange;
@@ -285,8 +270,6 @@
   gfx::Rect GetViewBounds() const override;
   void SetShowingContextMenu(bool showing) override;
   void SetActive(bool active) override;
-  void SetWindowVisibility(bool visible) override;
-  void WindowFrameChanged() override;
   void ShowDefinitionForSelection() override;
   bool SupportsSpeech() const override;
   void SpeakSelection() override;
@@ -334,8 +317,6 @@
   BrowserAccessibilityManager* CreateBrowserAccessibilityManager(
       BrowserAccessibilityDelegate* delegate, bool for_root_frame) override;
   gfx::Point AccessibilityOriginInScreen(const gfx::Rect& bounds) override;
-  bool PostProcessEventForPluginIme(
-      const NativeWebKeyboardEvent& event) override;
 
   bool HasAcceleratedSurface(const gfx::Size& desired_size) override;
   void GetScreenInfo(blink::WebScreenInfo* results) override;
@@ -385,9 +366,6 @@
 
   void SetTextInputActive(bool active);
 
-  // Sends completed plugin IME notification and text back to the renderer.
-  void PluginImeCompositionCompleted(const base::string16& text, int plugin_id);
-
   const std::string& selected_text() const { return selected_text_; }
   const gfx::Range& composition_range() const { return composition_range_; }
   const base::string16& selection_text() const { return selection_text_; }
@@ -559,8 +537,6 @@
   void DestroyBrowserCompositorView();
 
   // IPC message handlers.
-  void OnPluginFocusChanged(bool focused, int plugin_id);
-  void OnStartPluginIme();
   void OnGetRenderedTextCompleted(const std::string& text);
 
   // Send updated vsync parameters to the renderer.
diff --git a/content/browser/renderer_host/render_widget_host_view_mac.mm b/content/browser/renderer_host/render_widget_host_view_mac.mm
index c1b56a5..6c95876 100644
--- a/content/browser/renderer_host/render_widget_host_view_mac.mm
+++ b/content/browser/renderer_host/render_widget_host_view_mac.mm
@@ -71,7 +71,6 @@
 #include "skia/ext/skia_utils_mac.h"
 #include "third_party/WebKit/public/platform/WebScreenInfo.h"
 #include "third_party/WebKit/public/web/WebInputEvent.h"
-#import "third_party/mozilla/ComplexTextInputPanel.h"
 #import "ui/base/clipboard/clipboard_util_mac.h"
 #include "ui/base/cocoa/animation_utils.h"
 #include "ui/base/cocoa/cocoa_base_utils.h"
@@ -187,7 +186,6 @@
 - (void)windowChangedGlobalFrame:(NSNotification*)notification;
 - (void)windowDidBecomeKey:(NSNotification*)notification;
 - (void)windowDidResignKey:(NSNotification*)notification;
-- (void)checkForPluginImeCancellation;
 - (void)updateScreenProperties;
 - (void)setResponderDelegate:
         (NSObject<RenderWidgetHostViewMacDelegate>*)delegate;
@@ -687,8 +685,6 @@
 bool RenderWidgetHostViewMac::OnMessageReceived(const IPC::Message& message) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(RenderWidgetHostViewMac, message)
-    IPC_MESSAGE_HANDLER(ViewHostMsg_PluginFocusChanged, OnPluginFocusChanged)
-    IPC_MESSAGE_HANDLER(ViewHostMsg_StartPluginIme, OnStartPluginIme)
     IPC_MESSAGE_HANDLER(ViewMsg_GetRenderedTextCompleted,
         OnGetRenderedTextCompleted)
     IPC_MESSAGE_UNHANDLED(handled = false)
@@ -1272,27 +1268,6 @@
   }
 }
 
-bool RenderWidgetHostViewMac::PostProcessEventForPluginIme(
-    const NativeWebKeyboardEvent& event) {
-  // Check WebInputEvent type since multiple types of events can be sent into
-  // WebKit for the same OS event (e.g., RawKeyDown and Char), so filtering is
-  // necessary to avoid double processing.
-  // Also check the native type, since NSFlagsChanged is considered a key event
-  // for WebKit purposes, but isn't considered a key event by the OS.
-  if (event.type == WebInputEvent::RawKeyDown &&
-      [event.os_event type] == NSKeyDown)
-    return [cocoa_view_ postProcessEventForPluginIme:event.os_event];
-  return false;
-}
-
-void RenderWidgetHostViewMac::PluginImeCompositionCompleted(
-    const base::string16& text, int plugin_id) {
-  if (render_widget_host_) {
-    render_widget_host_->Send(new ViewMsg_PluginImeCompositionCompleted(
-        render_widget_host_->GetRoutingID(), text, plugin_id));
-  }
-}
-
 bool RenderWidgetHostViewMac::GetLineBreakIndex(
     const std::vector<gfx::Rect>& bounds,
     const gfx::Range& range,
@@ -1689,25 +1664,8 @@
   }
   if (HasFocus())
     SetTextInputActive(active);
-  if (!active) {
-    [cocoa_view_ setPluginImeActive:NO];
+  if (!active)
     UnlockMouse();
-  }
-}
-
-void RenderWidgetHostViewMac::SetWindowVisibility(bool visible) {
-  if (render_widget_host_) {
-    render_widget_host_->Send(new ViewMsg_SetWindowVisibility(
-        render_widget_host_->GetRoutingID(), visible));
-  }
-}
-
-void RenderWidgetHostViewMac::WindowFrameChanged() {
-  if (render_widget_host_) {
-    render_widget_host_->Send(new ViewMsg_WindowFrameChanged(
-        render_widget_host_->GetRoutingID(), GetBoundsInRootWindow(),
-        GetViewBounds()));
-  }
 }
 
 void RenderWidgetHostViewMac::ShowDefinitionForSelection() {
@@ -1768,15 +1726,6 @@
   }
 }
 
-void RenderWidgetHostViewMac::OnPluginFocusChanged(bool focused,
-                                                   int plugin_id) {
-  [cocoa_view_ pluginFocusChanged:(focused ? YES : NO) forPlugin:plugin_id];
-}
-
-void RenderWidgetHostViewMac::OnStartPluginIme() {
-  [cocoa_view_ setPluginImeActive:YES];
-}
-
 void RenderWidgetHostViewMac::OnGetRenderedTextCompleted(
     const std::string& text) {
   SpeakText(text);
@@ -1832,7 +1781,6 @@
     renderWidgetHostView_.reset(r);
     canBeKeyView_ = YES;
     opaque_ = YES;
-    focusedPluginIdentifier_ = -1;
     pinchHasReachedZoomThreshold_ = false;
 
     // OpenGL support:
@@ -2208,18 +2156,9 @@
   hasEditCommands_ = NO;
   editCommands_.clear();
 
-  // Before doing anything with a key down, check to see if plugin IME has been
-  // cancelled, since the plugin host needs to be informed of that before
-  // receiving the keydown.
-  if ([theEvent type] == NSKeyDown)
-    [self checkForPluginImeCancellation];
-
   // Sends key down events to input method first, then we can decide what should
   // be done according to input method's feedback.
-  // If a plugin is active, bypass this step since events are forwarded directly
-  // to the plugin IME.
-  if (focusedPluginIdentifier_ == -1)
-    [self interpretKeyEvents:[NSArray arrayWithObject:theEvent]];
+  [self interpretKeyEvents:[NSArray arrayWithObject:theEvent]];
 
   handlingKeyDown_ = NO;
 
@@ -3122,9 +3061,6 @@
 // nil when the caret is in non-editable content or password box to avoid
 // making input methods do their work.
 - (NSTextInputContext *)inputContext {
-  if (focusedPluginIdentifier_ != -1)
-    return [[ComplexTextInputPanel sharedComplexTextInputPanel] inputContext];
-
   switch(renderWidgetHostView_->text_input_type_) {
     case ui::TEXT_INPUT_TYPE_NONE:
     case ui::TEXT_INPUT_TYPE_PASSWORD:
@@ -3277,22 +3213,6 @@
     renderWidgetHostView_->DestroySuspendedBrowserCompositorViewIfNeeded();
   }
 
-  if (canBeKeyView_) {
-    NSWindow* newWindow = [self window];
-    // Pointer comparison only, since we don't know if lastWindow_ is still
-    // valid.
-    if (newWindow) {
-      // If we move into a new window, refresh the frame information. We
-      // don't need to do it if it was the same window as it used to be in,
-      // since that case is covered by WasShown(). We only want to do this for
-      // real browser views, not popups.
-      if (newWindow != lastWindow_) {
-        lastWindow_ = newWindow;
-        renderWidgetHostView_->WindowFrameChanged();
-      }
-    }
-  }
-
   // If we switch windows (or are removed from the view hierarchy), cancel any
   // open mouse-downs.
   if (hasOpenMouseDown_) {
@@ -3404,54 +3324,6 @@
   [self cancelComposition];
 }
 
-- (void)setPluginImeActive:(BOOL)active {
-  if (active == pluginImeActive_)
-    return;
-
-  pluginImeActive_ = active;
-  if (!active) {
-    [[ComplexTextInputPanel sharedComplexTextInputPanel] cancelComposition];
-    renderWidgetHostView_->PluginImeCompositionCompleted(
-        base::string16(), focusedPluginIdentifier_);
-  }
-}
-
-- (void)pluginFocusChanged:(BOOL)focused forPlugin:(int)pluginId {
-  if (focused)
-    focusedPluginIdentifier_ = pluginId;
-  else if (focusedPluginIdentifier_ == pluginId)
-    focusedPluginIdentifier_ = -1;
-
-  // Whenever plugin focus changes, plugin IME resets.
-  [self setPluginImeActive:NO];
-}
-
-- (BOOL)postProcessEventForPluginIme:(NSEvent*)event {
-  if (!pluginImeActive_)
-    return false;
-
-  ComplexTextInputPanel* inputPanel =
-      [ComplexTextInputPanel sharedComplexTextInputPanel];
-  NSString* composited_string = nil;
-  BOOL handled = [inputPanel interpretKeyEvent:event
-                                        string:&composited_string];
-  if (composited_string) {
-    renderWidgetHostView_->PluginImeCompositionCompleted(
-        base::SysNSStringToUTF16(composited_string), focusedPluginIdentifier_);
-    pluginImeActive_ = NO;
-  }
-  return handled;
-}
-
-- (void)checkForPluginImeCancellation {
-  if (pluginImeActive_ &&
-      ![[ComplexTextInputPanel sharedComplexTextInputPanel] inComposition]) {
-    renderWidgetHostView_->PluginImeCompositionCompleted(
-        base::string16(), focusedPluginIdentifier_);
-    pluginImeActive_ = NO;
-  }
-}
-
 // Overriding a NSResponder method to support application services.
 
 - (id)validRequestorForSendType:(NSString*)sendType
diff --git a/content/browser/renderer_host/render_widget_host_view_mus.cc b/content/browser/renderer_host/render_widget_host_view_mus.cc
index ebd0f47..eb29bde 100644
--- a/content/browser/renderer_host/render_widget_host_view_mus.cc
+++ b/content/browser/renderer_host/render_widget_host_view_mus.cc
@@ -272,13 +272,6 @@
 void RenderWidgetHostViewMus::SetActive(bool active) {
 }
 
-void RenderWidgetHostViewMus::SetWindowVisibility(bool visible) {
-  // TODO(fsamuel): Propagate visibility to Mus?
-}
-
-void RenderWidgetHostViewMus::WindowFrameChanged() {
-}
-
 void RenderWidgetHostViewMus::ShowDefinitionForSelection() {
   // TODO(fsamuel): Implement this on Mac.
 }
@@ -300,12 +293,6 @@
 void RenderWidgetHostViewMus::StopSpeaking() {
   // TODO(fsamuel): Implement this on Mac.
 }
-
-bool RenderWidgetHostViewMus::PostProcessEventForPluginIme(
-    const NativeWebKeyboardEvent& event) {
-  return false;
-}
-
 #endif  // defined(OS_MACOSX)
 
 void RenderWidgetHostViewMus::LockCompositingSurface() {
diff --git a/content/browser/renderer_host/render_widget_host_view_mus.h b/content/browser/renderer_host/render_widget_host_view_mus.h
index 2f5e8759..3a96b9f 100644
--- a/content/browser/renderer_host/render_widget_host_view_mus.h
+++ b/content/browser/renderer_host/render_widget_host_view_mus.h
@@ -105,17 +105,11 @@
 #if defined(OS_MACOSX)
   // RenderWidgetHostView implementation.
   void SetActive(bool active) override;
-  void SetWindowVisibility(bool visible) override;
-  void WindowFrameChanged() override;
   void ShowDefinitionForSelection() override;
   bool SupportsSpeech() const override;
   void SpeakSelection() override;
   bool IsSpeaking() const override;
   void StopSpeaking() override;
-
-  // RenderWidgetHostViewBase implementation.
-  bool PostProcessEventForPluginIme(
-      const NativeWebKeyboardEvent& event) override;
 #endif  // defined(OS_MACOSX)
 
   void LockCompositingSurface() override;
diff --git a/content/browser/renderer_host/sandbox_ipc_linux.cc b/content/browser/renderer_host/sandbox_ipc_linux.cc
index 8088598b..62feacc5 100644
--- a/content/browser/renderer_host/sandbox_ipc_linux.cc
+++ b/content/browser/renderer_host/sandbox_ipc_linux.cc
@@ -29,7 +29,6 @@
 #include "ppapi/c/trusted/ppb_browser_font_trusted.h"
 #include "third_party/WebKit/public/platform/linux/WebFontInfo.h"
 #include "third_party/WebKit/public/web/WebKit.h"
-#include "third_party/npapi/bindings/npapi_extensions.h"
 #include "third_party/skia/include/ports/SkFontConfigInterface.h"
 #include "ui/gfx/font.h"
 #include "ui/gfx/font_render_params.h"
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index 4a747f4..3540350 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -2383,13 +2383,13 @@
       render_view_host->GetRoutingID(), history_offset, history_length));
 }
 
-void WebContentsImpl::ReloadFocusedFrame(bool ignore_cache) {
+void WebContentsImpl::ReloadFocusedFrame(bool bypass_cache) {
   RenderFrameHost* focused_frame = GetFocusedFrame();
   if (!focused_frame)
     return;
 
   focused_frame->Send(new FrameMsg_Reload(
-      focused_frame->GetRoutingID(), ignore_cache));
+      focused_frame->GetRoutingID(), bypass_cache));
 }
 
 void WebContentsImpl::ReloadLoFiImages() {
diff --git a/content/browser/web_contents/web_contents_impl.h b/content/browser/web_contents/web_contents_impl.h
index 77f73ea..384bdd307 100644
--- a/content/browser/web_contents/web_contents_impl.h
+++ b/content/browser/web_contents/web_contents_impl.h
@@ -296,7 +296,7 @@
       RenderFrameHost* outer_contents_frame) override;
   void Stop() override;
   WebContents* Clone() override;
-  void ReloadFocusedFrame(bool ignore_cache) override;
+  void ReloadFocusedFrame(bool bypass_cache) override;
   void Undo() override;
   void Redo() override;
   void Cut() override;
diff --git a/content/child/BUILD.gn b/content/child/BUILD.gn
index 623e755..b3526cb 100644
--- a/content/child/BUILD.gn
+++ b/content/child/BUILD.gn
@@ -55,7 +55,6 @@
     "//third_party/WebKit/public:image_resources",
     "//third_party/WebKit/public:resources",
     "//third_party/icu",
-    "//third_party/npapi",
     "//ui/base",
     "//ui/events/gestures/blink",
     "//ui/gfx",
diff --git a/content/common/frame_messages.h b/content/common/frame_messages.h
index e1069a2..66cacbc1117 100644
--- a/content/common/frame_messages.h
+++ b/content/common/frame_messages.h
@@ -727,10 +727,10 @@
 IPC_MESSAGE_ROUTED1(FrameMsg_ShowTransitionElements,
                     std::string /* css_selector */)
 
-// Tells the renderer to reload the frame, optionally ignoring the cache while
+// Tells the renderer to reload the frame, optionally bypassing the cache while
 // doing so.
 IPC_MESSAGE_ROUTED1(FrameMsg_Reload,
-                    bool /* ignore_cache */)
+                    bool /* bypass_cache */)
 
 // Notifies the color chooser client that the user selected a color.
 IPC_MESSAGE_ROUTED2(FrameMsg_DidChooseColorResponse, unsigned, SkColor)
diff --git a/content/common/gpu/client/context_provider_command_buffer.cc b/content/common/gpu/client/context_provider_command_buffer.cc
index a1d206f..7ef9e732 100644
--- a/content/common/gpu/client/context_provider_command_buffer.cc
+++ b/content/common/gpu/client/context_provider_command_buffer.cc
@@ -12,7 +12,7 @@
 #include "base/callback_helpers.h"
 #include "base/strings/stringprintf.h"
 #include "cc/output/managed_memory_policy.h"
-#include "content/common/gpu/client/grcontext_for_webgraphicscontext3d.h"
+#include "content/common/gpu/client/grcontext_for_gles2_interface.h"
 #include "gpu/command_buffer/client/gles2_implementation.h"
 #include "third_party/skia/include/gpu/GrContext.h"
 
@@ -23,11 +23,11 @@
  public:
   explicit LostContextCallbackProxy(ContextProviderCommandBuffer* provider)
       : provider_(provider) {
-    provider_->WebContext3DNoChecks()->setContextLostCallback(this);
+    provider_->context3d_->setContextLostCallback(this);
   }
 
   ~LostContextCallbackProxy() override {
-    provider_->WebContext3DNoChecks()->setContextLostCallback(NULL);
+    provider_->context3d_->setContextLostCallback(NULL);
   }
 
   void onContextLost() override { provider_->OnLostContext(); }
@@ -49,12 +49,11 @@
 ContextProviderCommandBuffer::ContextProviderCommandBuffer(
     scoped_ptr<WebGraphicsContext3DCommandBufferImpl> context3d,
     CommandBufferContextType type)
-    : context_type_(type),
+    : context3d_(std::move(context3d)),
+      context_type_(type),
       debug_name_(CommandBufferContextTypeToString(type)) {
-  gr_interface_ = skia::AdoptRef(
-      new GrGLInterfaceForWebGraphicsContext3D(std::move(context3d)));
   DCHECK(main_thread_checker_.CalledOnValidThread());
-  DCHECK(gr_interface_->WebContext3D());
+  DCHECK(context3d_);
   context_thread_checker_.DetachFromThread();
 }
 
@@ -63,52 +62,42 @@
          context_thread_checker_.CalledOnValidThread());
 
   // Destroy references to the context3d_ before leaking it.
-  if (WebContext3DNoChecks()->GetCommandBufferProxy())
-    WebContext3DNoChecks()->GetCommandBufferProxy()->SetLock(nullptr);
+  if (context3d_->GetCommandBufferProxy())
+    context3d_->GetCommandBufferProxy()->SetLock(nullptr);
   lost_context_callback_proxy_.reset();
 }
 
 gpu::CommandBufferProxyImpl*
 ContextProviderCommandBuffer::GetCommandBufferProxy() {
-  return WebContext3DNoChecks()->GetCommandBufferProxy();
+  return context3d_->GetCommandBufferProxy();
 }
 
 WebGraphicsContext3DCommandBufferImpl*
 ContextProviderCommandBuffer::WebContext3D() {
-  DCHECK(gr_interface_);
-  DCHECK(gr_interface_->WebContext3D());
+  DCHECK(context3d_);
   DCHECK(lost_context_callback_proxy_);  // Is bound to thread.
   DCHECK(context_thread_checker_.CalledOnValidThread());
 
-  return WebContext3DNoChecks();
-}
-
-WebGraphicsContext3DCommandBufferImpl*
-    ContextProviderCommandBuffer::WebContext3DNoChecks() {
-  DCHECK(gr_interface_);
-  return static_cast<WebGraphicsContext3DCommandBufferImpl*>(
-      gr_interface_->WebContext3D());
+  return context3d_.get();
 }
 
 bool ContextProviderCommandBuffer::BindToCurrentThread() {
   // This is called on the thread the context will be used.
   DCHECK(context_thread_checker_.CalledOnValidThread());
-  DCHECK(gr_interface_ && gr_interface_->WebContext3D());
 
   if (lost_context_callback_proxy_)
     return true;
 
-  WebContext3DNoChecks()->SetContextType(context_type_);
-  if (!WebContext3DNoChecks()->InitializeOnCurrentThread())
+  context3d_->SetContextType(context_type_);
+  if (!context3d_->InitializeOnCurrentThread())
     return false;
 
-  gr_interface_->BindToCurrentThread();
   InitializeCapabilities();
 
   std::string unique_context_name =
-      base::StringPrintf("%s-%p", debug_name_.c_str(), WebContext3DNoChecks());
-  WebContext3DNoChecks()->GetImplementation()->TraceBeginCHROMIUM(
-      "gpu_toplevel", unique_context_name.c_str());
+      base::StringPrintf("%s-%p", debug_name_.c_str(), context3d_.get());
+  context3d_->GetGLInterface()->TraceBeginCHROMIUM("gpu_toplevel",
+                                                   unique_context_name.c_str());
 
   lost_context_callback_proxy_.reset(new LostContextCallbackProxy(this));
   return true;
@@ -119,13 +108,15 @@
 }
 
 gpu::gles2::GLES2Interface* ContextProviderCommandBuffer::ContextGL() {
+  DCHECK(context3d_);
   DCHECK(lost_context_callback_proxy_);  // Is bound to thread.
+  DCHECK(context_thread_checker_.CalledOnValidThread());
 
-  return WebContext3D()->GetImplementation();
+  return context3d_->GetImplementation();
 }
 
 gpu::ContextSupport* ContextProviderCommandBuffer::ContextSupport() {
-  return WebContext3DNoChecks()->GetContextSupport();
+  return context3d_->GetContextSupport();
 }
 
 class GrContext* ContextProviderCommandBuffer::GrContext() {
@@ -135,7 +126,8 @@
   if (gr_context_)
     return gr_context_->get();
 
-  gr_context_.reset(new GrContextForWebGraphicsContext3D(gr_interface_));
+  gr_context_.reset(
+      new GrContextForGLES2Interface(context3d_->GetGLInterface()));
 
   // If GlContext is already lost, also abandon the new GrContext.
   if (gr_context_->get() &&
@@ -154,7 +146,8 @@
 }
 
 void ContextProviderCommandBuffer::SetupLock() {
-  WebContext3D()->GetCommandBufferProxy()->SetLock(&context_lock_);
+  DCHECK(context3d_);
+  context3d_->GetCommandBufferProxy()->SetLock(&context_lock_);
 }
 
 base::Lock* ContextProviderCommandBuffer::GetLock() {
@@ -187,9 +180,9 @@
 
 void ContextProviderCommandBuffer::InitializeCapabilities() {
   Capabilities caps;
-  caps.gpu = WebContext3DNoChecks()->GetImplementation()->capabilities();
+  caps.gpu = context3d_->GetImplementation()->capabilities();
 
-  size_t mapped_memory_limit = WebContext3DNoChecks()->GetMappedMemoryLimit();
+  size_t mapped_memory_limit = context3d_->GetMappedMemoryLimit();
   caps.max_transfer_buffer_usage_bytes =
       mapped_memory_limit == WebGraphicsContext3DCommandBufferImpl::kNoLimit
       ? std::numeric_limits<size_t>::max() : mapped_memory_limit;
diff --git a/content/common/gpu/client/context_provider_command_buffer.h b/content/common/gpu/client/context_provider_command_buffer.h
index b68d3d7..65b0e50 100644
--- a/content/common/gpu/client/context_provider_command_buffer.h
+++ b/content/common/gpu/client/context_provider_command_buffer.h
@@ -16,12 +16,10 @@
 #include "content/common/content_export.h"
 #include "content/common/gpu/client/command_buffer_metrics.h"
 #include "content/common/gpu/client/webgraphicscontext3d_command_buffer_impl.h"
-#include "skia/ext/refptr.h"
 
 namespace content {
 
-class GrContextForWebGraphicsContext3D;
-class GrGLInterfaceForWebGraphicsContext3D;
+class GrContextForGLES2Interface;
 
 // Implementation of cc::ContextProvider that provides a
 // WebGraphicsContext3DCommandBufferImpl context and a GrContext.
@@ -60,14 +58,13 @@
   void OnLostContext();
 
  private:
-  WebGraphicsContext3DCommandBufferImpl* WebContext3DNoChecks();
   void InitializeCapabilities();
 
   base::ThreadChecker main_thread_checker_;
   base::ThreadChecker context_thread_checker_;
 
-  skia::RefPtr<GrGLInterfaceForWebGraphicsContext3D> gr_interface_;
-  scoped_ptr<GrContextForWebGraphicsContext3D> gr_context_;
+  scoped_ptr<WebGraphicsContext3DCommandBufferImpl> context3d_;
+  scoped_ptr<GrContextForGLES2Interface> gr_context_;
 
   cc::ContextProvider::Capabilities capabilities_;
   CommandBufferContextType context_type_;
@@ -78,7 +75,6 @@
   base::Lock context_lock_;
 
   class LostContextCallbackProxy;
-  friend class LostContextCallbackProxy;
   scoped_ptr<LostContextCallbackProxy> lost_context_callback_proxy_;
 };
 
diff --git a/content/common/gpu/client/grcontext_for_gles2_interface.cc b/content/common/gpu/client/grcontext_for_gles2_interface.cc
new file mode 100644
index 0000000..bfd11c8b
--- /dev/null
+++ b/content/common/gpu/client/grcontext_for_gles2_interface.cc
@@ -0,0 +1,62 @@
+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/common/gpu/client/grcontext_for_gles2_interface.h"
+
+#include <stddef.h>
+#include <string.h>
+#include <utility>
+
+#include "base/lazy_instance.h"
+#include "base/macros.h"
+#include "base/trace_event/trace_event.h"
+#include "gpu/command_buffer/client/gles2_interface.h"
+#include "gpu/skia_bindings/gl_bindings_skia_cmd_buffer.h"
+#include "third_party/skia/include/gpu/GrContext.h"
+#include "third_party/skia/include/gpu/gl/GrGLInterface.h"
+
+namespace content {
+
+GrContextForGLES2Interface::GrContextForGLES2Interface(
+    gpu::gles2::GLES2Interface* gl) {
+  skia::RefPtr<GrGLInterface> interface =
+      skia_bindings::CreateGLES2InterfaceBindings(gl);
+  gr_context_ = skia::AdoptRef(
+      GrContext::Create(kOpenGL_GrBackend,
+                        // GrContext takes ownership of |interface|.
+                        reinterpret_cast<GrBackendContext>(interface.get())));
+  if (gr_context_) {
+    // The limit of the number of GPU resources we hold in the GrContext's
+    // GPU cache.
+    static const int kMaxGaneshResourceCacheCount = 2048;
+    // The limit of the bytes allocated toward GPU resources in the GrContext's
+    // GPU cache.
+    static const size_t kMaxGaneshResourceCacheBytes = 96 * 1024 * 1024;
+
+    gr_context_->setResourceCacheLimits(kMaxGaneshResourceCacheCount,
+                                        kMaxGaneshResourceCacheBytes);
+  }
+}
+
+GrContextForGLES2Interface::~GrContextForGLES2Interface() {
+  // At this point the GLES2Interface is going to be destroyed, so have
+  // the GrContext clean up and not try to use it anymore.
+  if (gr_context_)
+    gr_context_->releaseResourcesAndAbandonContext();
+}
+
+void GrContextForGLES2Interface::OnLostContext() {
+  if (gr_context_)
+    gr_context_->abandonContext();
+}
+
+void GrContextForGLES2Interface::FreeGpuResources() {
+  if (gr_context_) {
+    TRACE_EVENT_INSTANT0("gpu", "GrContext::freeGpuResources",
+                         TRACE_EVENT_SCOPE_THREAD);
+    gr_context_->freeGpuResources();
+  }
+}
+
+}  // namespace content
diff --git a/content/common/gpu/client/grcontext_for_gles2_interface.h b/content/common/gpu/client/grcontext_for_gles2_interface.h
new file mode 100644
index 0000000..aa8d2a56
--- /dev/null
+++ b/content/common/gpu/client/grcontext_for_gles2_interface.h
@@ -0,0 +1,42 @@
+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_COMMON_GPU_CLIENT_GRCONTEXT_FOR_GLES2_INTERFACE_H_
+#define CONTENT_COMMON_GPU_CLIENT_GRCONTEXT_FOR_GLES2_INTERFACE_H_
+
+#include "base/macros.h"
+#include "skia/ext/refptr.h"
+
+class GrContext;
+
+namespace gpu {
+namespace gles2 {
+class GLES2Interface;
+}
+}
+
+namespace content {
+
+// This class binds an offscreen GrContext to an offscreen context3d. The
+// context3d is used by the GrContext so must be valid as long as this class
+// is alive.
+class GrContextForGLES2Interface {
+ public:
+  explicit GrContextForGLES2Interface(gpu::gles2::GLES2Interface* gl);
+  virtual ~GrContextForGLES2Interface();
+
+  GrContext* get() { return gr_context_.get(); }
+
+  void OnLostContext();
+  void FreeGpuResources();
+
+ private:
+  skia::RefPtr<class GrContext> gr_context_;
+
+  DISALLOW_COPY_AND_ASSIGN(GrContextForGLES2Interface);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_COMMON_GPU_CLIENT_GRCONTEXT_FOR_GLES2_INTERFACE_H_
diff --git a/content/common/gpu/client/grcontext_for_webgraphicscontext3d.cc b/content/common/gpu/client/grcontext_for_webgraphicscontext3d.cc
deleted file mode 100644
index 905090e..0000000
--- a/content/common/gpu/client/grcontext_for_webgraphicscontext3d.cc
+++ /dev/null
@@ -1,80 +0,0 @@
-// Copyright (c) 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/gpu/client/grcontext_for_webgraphicscontext3d.h"
-
-#include <stddef.h>
-#include <string.h>
-#include <utility>
-
-#include "base/lazy_instance.h"
-#include "base/macros.h"
-#include "base/trace_event/trace_event.h"
-#include "gpu/blink/webgraphicscontext3d_impl.h"
-#include "gpu/command_buffer/client/gles2_lib.h"
-#include "gpu/skia_bindings/gl_bindings_skia_cmd_buffer.h"
-#include "third_party/skia/include/gpu/GrContext.h"
-
-using gpu_blink::WebGraphicsContext3DImpl;
-
-namespace content {
-
-GrContextForWebGraphicsContext3D::GrContextForWebGraphicsContext3D(
-    skia::RefPtr<GrGLInterfaceForWebGraphicsContext3D> gr_interface) {
-  if (!gr_interface || !gr_interface->WebContext3D())
-    return;
-
-  skia_bindings::InitGLES2InterfaceBindings(
-      gr_interface.get(), gr_interface->WebContext3D()->GetGLInterface());
-
-  gr_context_ = skia::AdoptRef(GrContext::Create(
-      kOpenGL_GrBackend,
-      reinterpret_cast<GrBackendContext>(gr_interface.get())));
-  if (gr_context_) {
-    // The limit of the number of GPU resources we hold in the GrContext's
-    // GPU cache.
-    static const int kMaxGaneshResourceCacheCount = 2048;
-    // The limit of the bytes allocated toward GPU resources in the GrContext's
-    // GPU cache.
-    static const size_t kMaxGaneshResourceCacheBytes = 96 * 1024 * 1024;
-
-    gr_context_->setResourceCacheLimits(kMaxGaneshResourceCacheCount,
-                                        kMaxGaneshResourceCacheBytes);
-  }
-}
-
-GrContextForWebGraphicsContext3D::~GrContextForWebGraphicsContext3D() {
-}
-
-void GrContextForWebGraphicsContext3D::OnLostContext() {
-  if (gr_context_)
-    gr_context_->abandonContext();
-}
-
-void GrContextForWebGraphicsContext3D::FreeGpuResources() {
-  if (gr_context_) {
-    TRACE_EVENT_INSTANT0("gpu", "GrContext::freeGpuResources", \
-        TRACE_EVENT_SCOPE_THREAD);
-    gr_context_->freeGpuResources();
-  }
-}
-
-GrGLInterfaceForWebGraphicsContext3D::GrGLInterfaceForWebGraphicsContext3D(
-    scoped_ptr<gpu_blink::WebGraphicsContext3DImpl> context3d)
-    : context3d_(std::move(context3d)) {}
-
-void GrGLInterfaceForWebGraphicsContext3D::BindToCurrentThread() {
-  context_thread_checker_.DetachFromThread();
-}
-
-GrGLInterfaceForWebGraphicsContext3D::~GrGLInterfaceForWebGraphicsContext3D() {
-  DCHECK(context_thread_checker_.CalledOnValidThread());
-#if !defined(NDEBUG)
-  // Set all the function pointers to zero, in order to crash if function
-  // pointers are used after free.
-  memset(&fFunctions, 0, sizeof(GrGLInterface::Functions));
-#endif
-}
-
-}  // namespace content
diff --git a/content/common/gpu/client/grcontext_for_webgraphicscontext3d.h b/content/common/gpu/client/grcontext_for_webgraphicscontext3d.h
deleted file mode 100644
index 7597f90..0000000
--- a/content/common/gpu/client/grcontext_for_webgraphicscontext3d.h
+++ /dev/null
@@ -1,66 +0,0 @@
-// Copyright (c) 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_GPU_CLIENT_GRCONTEXT_FOR_WEBGRAPHICSCONTEXT3D_H_
-#define CONTENT_COMMON_GPU_CLIENT_GRCONTEXT_FOR_WEBGRAPHICSCONTEXT3D_H_
-
-#include "base/macros.h"
-#include "base/memory/scoped_ptr.h"
-#include "base/threading/thread_checker.h"
-#include "skia/ext/refptr.h"
-#include "third_party/skia/include/gpu/gl/GrGLInterface.h"
-
-class GrContext;
-
-namespace gpu_blink {
-class WebGraphicsContext3DImpl;
-}
-
-namespace content {
-
-// Wrap WebGraphicsContext3DImpl into a GrGLInterface object, which allows
-// the WebGraphicsContext3DImpl to be jointly refcounted (indirectly)
-// by the GrContext and the context provider. This makes it legal for the
-// GrContext to be invoked when it outlives the context provider that created
-// it. By doing this we no longer have to worry about use after free errors
-// caused a lack of consideration for object destruction order.
-class GrGLInterfaceForWebGraphicsContext3D final : public GrGLInterface {
- public:
-  GrGLInterfaceForWebGraphicsContext3D(
-      scoped_ptr<gpu_blink::WebGraphicsContext3DImpl> context3d);
-  ~GrGLInterfaceForWebGraphicsContext3D() final;
-
-  void BindToCurrentThread();
-
-  gpu_blink::WebGraphicsContext3DImpl* WebContext3D() const {
-    return context3d_.get();
-  }
- private:
-  base::ThreadChecker context_thread_checker_;
-  scoped_ptr<gpu_blink::WebGraphicsContext3DImpl> context3d_;
-};
-
-// This class binds an offscreen GrContext to an offscreen context3d. The
-// context3d is used by the GrContext so must be valid as long as this class
-// is alive.
-class GrContextForWebGraphicsContext3D {
- public:
-  explicit GrContextForWebGraphicsContext3D(
-      skia::RefPtr<GrGLInterfaceForWebGraphicsContext3D> context3d);
-  virtual ~GrContextForWebGraphicsContext3D();
-
-  GrContext* get() { return gr_context_.get(); }
-
-  void OnLostContext();
-  void FreeGpuResources();
-
- private:
-  skia::RefPtr<class GrContext> gr_context_;
-
-  DISALLOW_COPY_AND_ASSIGN(GrContextForWebGraphicsContext3D);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_GPU_CLIENT_GRCONTEXT_FOR_WEBGRAPHICSCONTEXT3D_H_
diff --git a/content/common/gpu/media/vt_video_decode_accelerator_mac.cc b/content/common/gpu/media/vt_video_decode_accelerator_mac.cc
index 4a88b28..4954c6d 100644
--- a/content/common/gpu/media/vt_video_decode_accelerator_mac.cc
+++ b/content/common/gpu/media/vt_video_decode_accelerator_mac.cc
@@ -74,9 +74,9 @@
 BuildImageConfig(CMVideoDimensions coded_dimensions) {
   base::ScopedCFTypeRef<CFMutableDictionaryRef> image_config;
 
-  // 4:2:2 is used over the native 4:2:0 because only 4:2:2 can be directly
-  // bound to a texture by CGLTexImageIOSurface2D().
-  int32_t pixel_format = kCVPixelFormatType_422YpCbCr8;
+  // Note that 4:2:0 textures cannot be used directly as RGBA in OpenGL, but are
+  // lower power than 4:2:2 when composited directly by CoreAnimation.
+  int32_t pixel_format = kCVPixelFormatType_420YpCbCr8BiPlanarVideoRange;
 #define CFINT(i) CFNumberCreate(kCFAllocatorDefault, kCFNumberSInt32Type, &i)
   base::ScopedCFTypeRef<CFNumberRef> cf_pixel_format(CFINT(pixel_format));
   base::ScopedCFTypeRef<CFNumberRef> cf_width(CFINT(coded_dimensions.width));
@@ -88,7 +88,7 @@
   image_config.reset(
       CFDictionaryCreateMutable(
           kCFAllocatorDefault,
-          4,  // capacity
+          3,  // capacity
           &kCFTypeDictionaryKeyCallBacks,
           &kCFTypeDictionaryValueCallBacks));
   if (!image_config.get())
@@ -98,8 +98,6 @@
                        cf_pixel_format);
   CFDictionarySetValue(image_config, kCVPixelBufferWidthKey, cf_width);
   CFDictionarySetValue(image_config, kCVPixelBufferHeightKey, cf_height);
-  CFDictionarySetValue(image_config, kCVPixelBufferOpenGLCompatibilityKey,
-                       kCFBooleanTrue);
 
   return image_config;
 }
@@ -1040,26 +1038,13 @@
   scoped_refptr<gl::GLImageIOSurface> gl_image(
       new gl::GLImageIOSurface(frame.coded_size, GL_BGRA_EXT));
   if (!gl_image->Initialize(io_surface, gfx::GenericSharedMemoryId(),
-        gfx::BufferFormat::UYVY_422)) {
+        gfx::BufferFormat::YUV_420_BIPLANAR)) {
     NOTIFY_STATUS("Failed to initialize GLImageIOSurface", PLATFORM_FAILURE,
         SFT_PLATFORM_ERROR);
   }
 
-  if (gfx::GetGLImplementation() != gfx::kGLImplementationDesktopGLCoreProfile)
-    glEnable(GL_TEXTURE_RECTANGLE_ARB);
-  gfx::ScopedTextureBinder texture_binder(GL_TEXTURE_RECTANGLE_ARB,
-                                          picture_info->service_texture_id);
-  bool bind_result = gl_image->BindTexImage(GL_TEXTURE_RECTANGLE_ARB);
-  if (gfx::GetGLImplementation() != gfx::kGLImplementationDesktopGLCoreProfile)
-    glDisable(GL_TEXTURE_RECTANGLE_ARB);
-  if (!bind_result) {
-    NOTIFY_STATUS("Failed BindTexImage on GLImageIOSurface", PLATFORM_FAILURE,
-        SFT_PLATFORM_ERROR);
-    return false;
-  }
-
   bind_image_.Run(picture_info->client_texture_id, GL_TEXTURE_RECTANGLE_ARB,
-                  gl_image, true);
+                  gl_image, false);
 
   // Assign the new image(s) to the the picture info.
   picture_info->gl_image = gl_image;
diff --git a/content/common/view_messages.h b/content/common/view_messages.h
index 2818439..2c07df7 100644
--- a/content/common/view_messages.h
+++ b/content/common/view_messages.h
@@ -884,21 +884,6 @@
 // ViewHostMsg_SmartClipDataExtracted IPC.
 IPC_MESSAGE_ROUTED1(ViewMsg_ExtractSmartClipData,
                     gfx::Rect /* rect */)
-
-#elif defined(OS_MACOSX)
-// Let the RenderView know its window has changed visibility.
-IPC_MESSAGE_ROUTED1(ViewMsg_SetWindowVisibility,
-                    bool /* visibile */)
-
-// Let the RenderView know its window's frame has changed.
-IPC_MESSAGE_ROUTED2(ViewMsg_WindowFrameChanged,
-                    gfx::Rect /* window frame */,
-                    gfx::Rect /* content view frame */)
-
-// Tell the renderer that plugin IME has completed.
-IPC_MESSAGE_ROUTED2(ViewMsg_PluginImeCompositionCompleted,
-                    base::string16 /* text */,
-                    int /* plugin_id */)
 #endif
 
 // Sent by the browser as a reply to ViewHostMsg_SwapCompositorFrame.
@@ -1303,14 +1288,6 @@
                     int /* y */)
 
 #elif defined(OS_MACOSX)
-// Informs the browser that a plugin has gained or lost focus.
-IPC_MESSAGE_ROUTED2(ViewHostMsg_PluginFocusChanged,
-                    bool, /* focused */
-                    int /* plugin_id */)
-
-// Instructs the browser to start plugin IME.
-IPC_MESSAGE_ROUTED0(ViewHostMsg_StartPluginIme)
-
 // Receives content of a web page as plain text.
 IPC_MESSAGE_ROUTED1(ViewMsg_GetRenderedTextCompleted, std::string)
 #endif
diff --git a/content/content_child.gypi b/content/content_child.gypi
index 54692b7..02e2137 100644
--- a/content/content_child.gypi
+++ b/content/content_child.gypi
@@ -17,7 +17,6 @@
     '../third_party/WebKit/public/blink.gyp:blink',
     '../third_party/WebKit/public/blink_resources.gyp:blink_image_resources',
     '../third_party/WebKit/public/blink_resources.gyp:blink_resources',
-    '../third_party/npapi/npapi.gyp:npapi',
     '../ui/base/ui_base.gyp:ui_base',
     '../ui/events/events.gyp:gestures_blink',
     '../ui/gfx/gfx.gyp:gfx',
diff --git a/content/content_common.gypi b/content/content_common.gypi
index 281d6b5..c908be29 100644
--- a/content/content_common.gypi
+++ b/content/content_common.gypi
@@ -356,8 +356,8 @@
       'common/gpu/client/gpu_video_decode_accelerator_host.h',
       'common/gpu/client/gpu_video_encode_accelerator_host.cc',
       'common/gpu/client/gpu_video_encode_accelerator_host.h',
-      'common/gpu/client/grcontext_for_webgraphicscontext3d.cc',
-      'common/gpu/client/grcontext_for_webgraphicscontext3d.h',
+      'common/gpu/client/grcontext_for_gles2_interface.cc',
+      'common/gpu/client/grcontext_for_gles2_interface.h',
       'common/gpu/client/webgraphicscontext3d_command_buffer_impl.cc',
       'common/gpu/client/webgraphicscontext3d_command_buffer_impl.h',
       'common/gpu/gpu_channel.cc',
diff --git a/content/content_plugin.gypi b/content/content_plugin.gypi
deleted file mode 100644
index 5d3ca95..0000000
--- a/content/content_plugin.gypi
+++ /dev/null
@@ -1,46 +0,0 @@
-# Copyright (c) 2011 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'conditions': [
-    ['enable_plugins==1 and OS!="linux"', {
-      'dependencies': [
-        '../skia/skia.gyp:skia',
-        '../third_party/WebKit/public/blink.gyp:blink',
-        '../third_party/npapi/npapi.gyp:npapi',
-      ],
-      'include_dirs': [
-        '<(INTERMEDIATE_DIR)',
-      ],
-      'sources': [
-        # All .cc, .h, .m, and .mm files under plugins except for tests and
-        # mocks.
-        'plugin/plugin_channel.cc',
-        'plugin/plugin_channel.h',
-        'plugin/plugin_interpose_util_mac.h',
-        'plugin/plugin_interpose_util_mac.mm',
-        'plugin/plugin_main.cc',
-        'plugin/plugin_main_mac.mm',
-        'plugin/plugin_thread.cc',
-        'plugin/plugin_thread.h',
-        'plugin/webplugin_accelerated_surface_proxy_mac.cc',
-        'plugin/webplugin_accelerated_surface_proxy_mac.h',
-        'plugin/webplugin_delegate_stub.cc',
-        'plugin/webplugin_delegate_stub.h',
-        'plugin/webplugin_proxy.cc',
-        'plugin/webplugin_proxy.h',
-        'public/plugin/content_plugin_client.h',
-      ],
-      # These are layered in conditionals in the event other platforms
-      # end up using this module as well.
-      'conditions': [
-        ['OS=="win"', {
-          'include_dirs': [
-            '<(DEPTH)/third_party/wtl/include',
-          ],
-        }],
-      ],
-    }],
-  ],
-}
diff --git a/content/content_ppapi_plugin.gypi b/content/content_ppapi_plugin.gypi
index 89c200f..4e4ccd9b 100644
--- a/content/content_ppapi_plugin.gypi
+++ b/content/content_ppapi_plugin.gypi
@@ -7,6 +7,7 @@
     ['enable_plugins==1', {
       'dependencies': [
         '../base/base.gyp:base',
+        '../gin/gin.gyp:gin',
         '../ppapi/ppapi_internal.gyp:ppapi_ipc',
         '../ui/base/ui_base.gyp:ui_base',
         '../ui/gfx/gfx.gyp:gfx',
diff --git a/content/content_renderer.gypi b/content/content_renderer.gypi
index 29580ea..4ecb9c3 100644
--- a/content/content_renderer.gypi
+++ b/content/content_renderer.gypi
@@ -36,7 +36,6 @@
     '../third_party/icu/icu.gyp:icuuc',
     '../third_party/libjingle/libjingle.gyp:libjingle',
     '../third_party/libyuv/libyuv.gyp:libyuv',
-    '../third_party/npapi/npapi.gyp:npapi',
     '../third_party/widevine/cdm/widevine_cdm.gyp:widevine_cdm_version_h',
     '../ui/accessibility/accessibility.gyp:accessibility',
     '../ui/events/blink/events_blink.gyp:events_blink',
diff --git a/content/content_tests.gypi b/content/content_tests.gypi
index 4b597ccf..9ae1dda 100644
--- a/content/content_tests.gypi
+++ b/content/content_tests.gypi
@@ -178,10 +178,6 @@
       'test/web_contents_observer_sanity_checker.h',
       'test/web_gesture_curve_mock.cc',
       'test/web_gesture_curve_mock.h',
-      'test/weburl_loader_mock.cc',
-      'test/weburl_loader_mock.h',
-      'test/weburl_loader_mock_factory.cc',
-      'test/weburl_loader_mock_factory.h',
     ],
     'content_browsertests_sources': [
       'app/mojo/mojo_browsertest.cc',
@@ -871,6 +867,7 @@
         '../testing/gmock.gyp:gmock',
         '../testing/gtest.gyp:gtest',
         '../third_party/WebKit/public/blink.gyp:blink',
+        '../third_party/WebKit/public/blink.gyp:blink_test_support',
         '../ui/accessibility/accessibility.gyp:ax_gen',
         '../ui/base/ime/ui_base_ime.gyp:ui_base_ime',
         '../ui/base/ui_base.gyp:ui_base',
diff --git a/content/ppapi_plugin/BUILD.gn b/content/ppapi_plugin/BUILD.gn
index eb608e7..e8dfe47 100644
--- a/content/ppapi_plugin/BUILD.gn
+++ b/content/ppapi_plugin/BUILD.gn
@@ -21,6 +21,7 @@
   visibility = [
     ":ppapi_plugin",
     "//content",  # For the component build.
+    "//gin",
   ]
 
   sources = [
@@ -36,7 +37,10 @@
     "ppapi_thread.h",
   ]
 
-  configs += [ "//content:content_implementation" ]
+  configs += [
+    "//content:content_implementation",
+    "//v8:external_startup_data",
+  ]
 
   deps = [
     "//base",
diff --git a/content/ppapi_plugin/DEPS b/content/ppapi_plugin/DEPS
index bde9e92..9959c2f 100644
--- a/content/ppapi_plugin/DEPS
+++ b/content/ppapi_plugin/DEPS
@@ -1,6 +1,7 @@
 include_rules = [
   "+content/child",
-  "+content/public/plugin",
+  "+gin/public/isolate_holder.h",
+  "+gin/v8_initializer.h",
   "+ppapi/c",
   "+ppapi/proxy",
 ]
diff --git a/content/ppapi_plugin/ppapi_plugin_main.cc b/content/ppapi_plugin/ppapi_plugin_main.cc
index 71ecf15..3c74b83 100644
--- a/content/ppapi_plugin/ppapi_plugin_main.cc
+++ b/content/ppapi_plugin/ppapi_plugin_main.cc
@@ -20,7 +20,6 @@
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/main_function_params.h"
-#include "content/public/plugin/content_plugin_client.h"
 #include "ipc/ipc_sender.h"
 #include "ppapi/proxy/plugin_globals.h"
 #include "ppapi/proxy/proxy_module.h"
@@ -45,6 +44,10 @@
 #include "content/public/common/sandbox_init.h"
 #endif
 
+#ifdef V8_USE_EXTERNAL_STARTUP_DATA
+#include "gin/v8_initializer.h"
+#endif
+
 #if defined(OS_POSIX) && !defined(OS_ANDROID)
 #include <stdlib.h>
 #endif
@@ -123,10 +126,10 @@
   base::trace_event::TraceLog::GetInstance()->SetProcessSortIndex(
       kTraceEventPpapiProcessSortIndex);
 
-  // Allow the embedder to perform any necessary per-process initialization
-  // before the sandbox is initialized.
-  if (GetContentClient()->plugin())
-    GetContentClient()->plugin()->PreSandboxInitialization();
+#ifdef V8_USE_EXTERNAL_STARTUP_DATA
+  gin::V8Initializer::LoadV8Snapshot();
+  gin::V8Initializer::LoadV8Natives();
+#endif
 
 #if defined(OS_LINUX)
   LinuxSandbox::InitializeSandbox();
diff --git a/content/ppapi_plugin/ppapi_thread.cc b/content/ppapi_plugin/ppapi_thread.cc
index 96770b5..ccd4f7bb 100644
--- a/content/ppapi_plugin/ppapi_thread.cc
+++ b/content/ppapi_plugin/ppapi_thread.cc
@@ -36,7 +36,6 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/common/pepper_plugin_info.h"
 #include "content/public/common/sandbox_init.h"
-#include "content/public/plugin/content_plugin_client.h"
 #include "ipc/ipc_channel_handle.h"
 #include "ipc/ipc_platform_file.h"
 #include "ipc/ipc_sync_channel.h"
@@ -550,13 +549,6 @@
 void PpapiThread::SavePluginName(const base::FilePath& path) {
   ppapi::proxy::PluginGlobals::Get()->set_plugin_name(
       path.BaseName().AsUTF8Unsafe());
-
-  // plugin() is NULL when in-process, which is fine, because this is
-  // just a hook for setting the process name.
-  if (GetContentClient()->plugin()) {
-    GetContentClient()->plugin()->PluginProcessStarted(
-        path.BaseName().RemoveExtension().LossyDisplayName());
-  }
 }
 
 static std::string GetHistogramName(bool is_broker,
diff --git a/content/public/app/BUILD.gn b/content/public/app/BUILD.gn
index df5e5d34..c6280d3 100644
--- a/content/public/app/BUILD.gn
+++ b/content/public/app/BUILD.gn
@@ -37,7 +37,6 @@
   "//content:export",
   "//content/public/common:common_sources",
   "//content/public/gpu:gpu_sources",
-  "//content/public/plugin:plugin_sources",
   "//content/public/renderer:renderer_sources",
   "//content/public/utility:utility_sources",
 ]
diff --git a/content/public/app/DEPS b/content/public/app/DEPS
index 47482a5..8fe7158 100644
--- a/content/public/app/DEPS
+++ b/content/public/app/DEPS
@@ -1,7 +1,6 @@
 include_rules = [
   "+content/public/browser/content_browser_client.h",
   "+content/public/gpu/content_gpu_client.h",
-  "+content/public/plugin/content_plugin_client.h",
   "+content/public/renderer/content_renderer_client.h",
   "+content/public/utility/content_utility_client.h",
 ]
diff --git a/content/public/app/content_main_delegate.cc b/content/public/app/content_main_delegate.cc
index 57f04f7f..d833cb0 100644
--- a/content/public/app/content_main_delegate.cc
+++ b/content/public/app/content_main_delegate.cc
@@ -7,7 +7,6 @@
 #include "build/build_config.h"
 
 #include "content/public/gpu/content_gpu_client.h"
-#include "content/public/plugin/content_plugin_client.h"
 #include "content/public/renderer/content_renderer_client.h"
 #include "content/public/utility/content_utility_client.h"
 
@@ -71,14 +70,6 @@
 #endif
 }
 
-ContentPluginClient* ContentMainDelegate::CreateContentPluginClient() {
-#if defined(CHROME_MULTIPLE_DLL_BROWSER)
-  return NULL;
-#else
-  return new ContentPluginClient();
-#endif
-}
-
 ContentRendererClient* ContentMainDelegate::CreateContentRendererClient() {
 #if defined(CHROME_MULTIPLE_DLL_BROWSER)
   return NULL;
diff --git a/content/public/app/content_main_delegate.h b/content/public/app/content_main_delegate.h
index 5155af88..1dcb57f 100644
--- a/content/public/app/content_main_delegate.h
+++ b/content/public/app/content_main_delegate.h
@@ -17,7 +17,6 @@
 
 class ContentBrowserClient;
 class ContentGpuClient;
-class ContentPluginClient;
 class ContentRendererClient;
 class ContentUtilityClient;
 class ZygoteForkDelegate;
@@ -90,7 +89,6 @@
   // override this.
   virtual ContentBrowserClient* CreateContentBrowserClient();
   virtual ContentGpuClient* CreateContentGpuClient();
-  virtual ContentPluginClient* CreateContentPluginClient();
   virtual ContentRendererClient* CreateContentRendererClient();
   virtual ContentUtilityClient* CreateContentUtilityClient();
 };
diff --git a/content/public/browser/render_widget_host_view.h b/content/public/browser/render_widget_host_view.h
index 7c749a2..99459add 100644
--- a/content/public/browser/render_widget_host_view.h
+++ b/content/public/browser/render_widget_host_view.h
@@ -163,17 +163,6 @@
   // Set the view's active state (i.e., tint state of controls).
   virtual void SetActive(bool active) = 0;
 
-  // Notifies the view that its enclosing window has changed visibility
-  // (minimized/unminimized, app hidden/unhidden, etc).
-  // TODO(stuartmorgan): This is a temporary plugin-specific workaround for
-  // <http://crbug.com/34266>. Once that is fixed, this (and the corresponding
-  // message and renderer-side handling) can be removed in favor of using
-  // WasHidden/WasShown.
-  virtual void SetWindowVisibility(bool visible) = 0;
-
-  // Informs the view that its containing window's frame changed.
-  virtual void WindowFrameChanged() = 0;
-
   // Brings up the dictionary showing a definition for the selected text.
   virtual void ShowDefinitionForSelection() = 0;
 
diff --git a/content/public/browser/web_contents.h b/content/public/browser/web_contents.h
index 96a3feb..deb4cfd 100644
--- a/content/public/browser/web_contents.h
+++ b/content/public/browser/web_contents.h
@@ -418,7 +418,7 @@
   virtual WebContents* Clone() = 0;
 
   // Reloads the focused frame.
-  virtual void ReloadFocusedFrame(bool ignore_cache) = 0;
+  virtual void ReloadFocusedFrame(bool bypass_cache) = 0;
 
   // Reloads all the Lo-Fi images in this WebContents. Ignores the cache and
   // reloads from the network.
diff --git a/content/public/common/common_param_traits.cc b/content/public/common/common_param_traits.cc
index f402cca..641ac26 100644
--- a/content/public/common/common_param_traits.cc
+++ b/content/public/common/common_param_traits.cc
@@ -83,15 +83,13 @@
 bool ParamTraits<net::IPEndPoint>::Read(const base::Pickle* m,
                                         base::PickleIterator* iter,
                                         param_type* p) {
-  net::IPAddressNumber address;
+  net::IPAddress address;
   uint16_t port;
   if (!ReadParam(m, iter, &address) || !ReadParam(m, iter, &port))
     return false;
-  if (address.size() &&
-      address.size() != net::kIPv4AddressSize &&
-      address.size() != net::kIPv6AddressSize) {
+  if (!address.empty() && !address.IsValid())
     return false;
-  }
+
   *p = net::IPEndPoint(address, port);
   return true;
 }
diff --git a/content/public/common/content_client.cc b/content/public/common/content_client.cc
index 49682c6..087d8b7 100644
--- a/content/public/common/content_client.cc
+++ b/content/public/common/content_client.cc
@@ -64,7 +64,6 @@
 ContentClient::ContentClient()
     : browser_(NULL),
       gpu_(NULL),
-      plugin_(NULL),
       renderer_(NULL),
       utility_(NULL) {}
 
diff --git a/content/public/common/content_client.h b/content/public/common/content_client.h
index 36994151..d7b0230 100644
--- a/content/public/common/content_client.h
+++ b/content/public/common/content_client.h
@@ -43,7 +43,6 @@
 class ContentBrowserClient;
 class ContentClient;
 class ContentGpuClient;
-class ContentPluginClient;
 class ContentRendererClient;
 class ContentUtilityClient;
 struct PepperPluginInfo;
@@ -74,7 +73,6 @@
 
   ContentBrowserClient* browser() { return browser_; }
   ContentGpuClient* gpu() { return gpu_; }
-  ContentPluginClient* plugin() { return plugin_; }
   ContentRendererClient* renderer() { return renderer_; }
   ContentUtilityClient* utility() { return utility_; }
 
@@ -168,8 +166,6 @@
   ContentBrowserClient* browser_;
   // The embedder API for participating in gpu logic.
   ContentGpuClient* gpu_;
-  // The embedder API for participating in plugin logic.
-  ContentPluginClient* plugin_;
   // The embedder API for participating in renderer logic.
   ContentRendererClient* renderer_;
   // The embedder API for participating in utility logic.
diff --git a/content/public/plugin/BUILD.gn b/content/public/plugin/BUILD.gn
deleted file mode 100644
index c935f87..0000000
--- a/content/public/plugin/BUILD.gn
+++ /dev/null
@@ -1,30 +0,0 @@
-# Copyright 2014 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-# See //content/BUILD.gn for how this works.
-group("plugin") {
-  if (is_component_build) {
-    public_deps = [
-      "//content",
-    ]
-  } else {
-    public_deps = [
-      ":plugin_sources",
-    ]
-  }
-}
-
-source_set("plugin_sources") {
-  # External code should depend on via ":plugin" above.
-  visibility = [ "//content/*" ]
-
-  sources = [
-    "content_plugin_client.h",
-  ]
-
-  deps = [
-    "//base",
-    "//content/public/common:common_sources",
-  ]
-}
diff --git a/content/public/plugin/content_plugin_client.h b/content/public/plugin/content_plugin_client.h
deleted file mode 100644
index f68c3ad5..0000000
--- a/content/public/plugin/content_plugin_client.h
+++ /dev/null
@@ -1,28 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_PUBLIC_PLUGIN_CONTENT_PLUGIN_CLIENT_H_
-#define CONTENT_PUBLIC_PLUGIN_CONTENT_PLUGIN_CLIENT_H_
-
-#include "base/strings/string16.h"
-#include "content/public/common/content_client.h"
-
-namespace content {
-
-// Embedder API for participating in plugin logic.
-class CONTENT_EXPORT ContentPluginClient {
- public:
-  virtual ~ContentPluginClient() {}
-
-  // Called to perform any per-process initialization necessary before
-  // the sandbox is initialized for the plugin process.
-  virtual void PreSandboxInitialization() {}
-
-  // Notifies that a plugin process has started.
-  virtual void PluginProcessStarted(const base::string16& plugin_name) {}
-};
-
-}  // namespace content
-
-#endif  // CONTENT_PUBLIC_PLUGIN_CONTENT_PLUGIN_CLIENT_H_
diff --git a/content/renderer/BUILD.gn b/content/renderer/BUILD.gn
index 56eacc0..b1c9977f 100644
--- a/content/renderer/BUILD.gn
+++ b/content/renderer/BUILD.gn
@@ -75,7 +75,6 @@
     "//third_party/icu",
     "//third_party/libjingle",
     "//third_party/libyuv",
-    "//third_party/npapi",
     "//third_party/widevine/cdm:version_h",
     "//ui/accessibility",
     "//ui/base",
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index c894509f..9426ed14 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -2101,10 +2101,8 @@
   frame_->dispatchMessageEventWithOriginCheck(target_origin, msg_event);
 }
 
-void RenderFrameImpl::OnReload(bool ignore_cache) {
-  // TODO(crbug.com/599364): Rename |ignore_cache| or change it to enum.
-  // Eventually we may remove FrameMsg_Reload, and use FrameMsg_Navigate.
-  frame_->reload(ignore_cache ? WebFrameLoadType::ReloadBypassingCache
+void RenderFrameImpl::OnReload(bool bypass_cache) {
+  frame_->reload(bypass_cache ? WebFrameLoadType::ReloadBypassingCache
                               : WebFrameLoadType::Reload);
 }
 
@@ -5302,9 +5300,9 @@
   // corresponds to a back/forward navigation event. Update the parameters
   // depending on the navigation type.
   if (is_reload) {
-    bool ignore_cache = (common_params.navigation_type ==
+    bool bypass_cache = (common_params.navigation_type ==
                          FrameMsg_Navigate_Type::RELOAD_BYPASSING_CACHE);
-    load_type = ignore_cache ? WebFrameLoadType::ReloadBypassingCache
+    load_type = bypass_cache ? WebFrameLoadType::ReloadBypassingCache
                              : WebFrameLoadType::Reload;
 
     if (!browser_side_navigation) {
diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
index a852cad..267b7b2 100644
--- a/content/renderer/render_frame_impl.h
+++ b/content/renderer/render_frame_impl.h
@@ -763,7 +763,7 @@
       const std::vector<blink::WebCompositionUnderline>& underlines);
   void OnExecuteNoValueEditCommand(const std::string& name);
   void OnExtendSelectionAndDelete(int before, int after);
-  void OnReload(bool ignore_cache);
+  void OnReload(bool bypass_cache);
   void OnReloadLoFiImages();
   void OnTextSurroundingSelectionRequest(uint32_t max_length);
   void OnSetAccessibilityMode(AccessibilityMode new_mode);
diff --git a/content/shell/BUILD.gn b/content/shell/BUILD.gn
index 58e3a2f1..739c090 100644
--- a/content/shell/BUILD.gn
+++ b/content/shell/BUILD.gn
@@ -200,7 +200,6 @@
     "//content/public/app:both",
     "//content/public/browser",
     "//content/public/common",
-    "//content/public/plugin",
     "//content/public/renderer",
     "//content/public/utility",
   ]
diff --git a/content/test/BUILD.gn b/content/test/BUILD.gn
index f1c9595..44a50657 100644
--- a/content/test/BUILD.gn
+++ b/content/test/BUILD.gn
@@ -40,6 +40,7 @@
     "//content/public/browser",
     "//content/public/common",
     "//third_party/WebKit/public:blink",
+    "//third_party/WebKit/public:test_support",
   ]
   deps = [
     ":browsertest_base",
@@ -56,7 +57,6 @@
     "//content/gpu",
     "//content/public/browser",
     "//content/public/child",
-    "//content/public/plugin",
     "//content/public/renderer",
     "//content/public/utility",
     "//content/renderer:for_content_tests",
@@ -448,7 +448,6 @@
     "//content/public/browser",
     "//content/public/child",
     "//content/public/common",
-    "//content/public/plugin",
     "//content/public/renderer",
     "//content/renderer:for_content_tests",
     "//content/shell:content_shell_lib",
@@ -657,7 +656,6 @@
     "//content/public/child",
     "//content/public/common",
     "//content/public/common:mojo_bindings",
-    "//content/public/plugin",
     "//content/public/renderer",
     "//content/renderer:for_content_tests",
     "//crypto",
diff --git a/content/test/test_blink_web_unit_test_support.cc b/content/test/test_blink_web_unit_test_support.cc
index 83f1a28..0d5d7cf 100644
--- a/content/test/test_blink_web_unit_test_support.cc
+++ b/content/test/test_blink_web_unit_test_support.cc
@@ -22,7 +22,6 @@
 #include "components/scheduler/test/lazy_scheduler_message_loop_delegate_for_tests.h"
 #include "content/test/mock_webclipboard_impl.h"
 #include "content/test/web_gesture_curve_mock.h"
-#include "content/test/weburl_loader_mock_factory.h"
 #include "media/base/media.h"
 #include "net/cookies/cookie_monster.h"
 #include "storage/browser/database/vfs_backend.h"
@@ -34,6 +33,7 @@
 #include "third_party/WebKit/public/platform/WebStorageNamespace.h"
 #include "third_party/WebKit/public/platform/WebString.h"
 #include "third_party/WebKit/public/platform/WebURL.h"
+#include "third_party/WebKit/public/web/WebCache.h"
 #include "third_party/WebKit/public/web/WebDatabase.h"
 #include "third_party/WebKit/public/web/WebKit.h"
 #include "third_party/WebKit/public/web/WebNetworkStateNotifier.h"
@@ -92,7 +92,7 @@
   base::mac::ScopedNSAutoreleasePool autorelease_pool;
 #endif
 
-  url_loader_factory_.reset(new WebURLLoaderMockFactory());
+  url_loader_factory_ = blink::WebURLLoaderMockFactory::create();
   mock_clipboard_.reset(new MockWebClipboardImpl());
 
 #ifdef V8_USE_EXTERNAL_STARTUP_DATA
@@ -191,7 +191,7 @@
 }
 
 blink::WebURLLoader* TestBlinkWebUnitTestSupport::createURLLoader() {
-  return url_loader_factory_->CreateURLLoader(
+  return url_loader_factory_->createURLLoader(
       BlinkPlatformImpl::createURLLoader());
 }
 
@@ -308,32 +308,33 @@
     const blink::WebURL& url,
     const blink::WebURLResponse& response,
     const blink::WebString& file_path) {
-  url_loader_factory_->RegisterURL(url, response, file_path);
+  url_loader_factory_->registerURL(url, response, file_path);
 }
 
 void TestBlinkWebUnitTestSupport::registerMockedErrorURL(
     const blink::WebURL& url,
     const blink::WebURLResponse& response,
     const blink::WebURLError& error) {
-  url_loader_factory_->RegisterErrorURL(url, response, error);
+  url_loader_factory_->registerErrorURL(url, response, error);
 }
 
 void TestBlinkWebUnitTestSupport::unregisterMockedURL(
     const blink::WebURL& url) {
-  url_loader_factory_->UnregisterURL(url);
+  url_loader_factory_->unregisterURL(url);
 }
 
 void TestBlinkWebUnitTestSupport::unregisterAllMockedURLs() {
-  url_loader_factory_->UnregisterAllURLs();
+  url_loader_factory_->unregisterAllURLs();
+  blink::WebCache::clear();
 }
 
 void TestBlinkWebUnitTestSupport::serveAsynchronousMockedRequests() {
-  url_loader_factory_->ServeAsynchronousRequests();
+  url_loader_factory_->serveAsynchronousRequests();
 }
 
 void TestBlinkWebUnitTestSupport::setLoaderDelegate(
     blink::WebURLLoaderTestDelegate* delegate) {
-  url_loader_factory_->set_delegate(delegate);
+  url_loader_factory_->setLoaderDelegate(delegate);
 }
 
 blink::WebThread* TestBlinkWebUnitTestSupport::currentThread() {
diff --git a/content/test/test_blink_web_unit_test_support.h b/content/test/test_blink_web_unit_test_support.h
index 32da3f3..c192b15 100644
--- a/content/test/test_blink_web_unit_test_support.h
+++ b/content/test/test_blink_web_unit_test_support.h
@@ -15,7 +15,7 @@
 #include "content/child/webfileutilities_impl.h"
 #include "content/test/mock_webblob_registry_impl.h"
 #include "content/test/mock_webclipboard_impl.h"
-#include "content/test/weburl_loader_mock_factory.h"
+#include "third_party/WebKit/public/platform/WebURLLoaderMockFactory.h"
 #include "third_party/WebKit/public/platform/WebUnitTestSupport.h"
 
 namespace base {
@@ -74,6 +74,7 @@
   blink::WebUnitTestSupport* unitTestSupport() override;
 
   // WebUnitTestSupport implementation
+  // TODO(kinuko): Remove these methods.
   void registerMockedURL(const blink::WebURL& url,
                          const blink::WebURLResponse& response,
                          const blink::WebString& filePath) override;
@@ -95,7 +96,7 @@
   scoped_ptr<MockWebClipboardImpl> mock_clipboard_;
   WebFileUtilitiesImpl file_utilities_;
   base::ScopedTempDir file_system_root_;
-  scoped_ptr<WebURLLoaderMockFactory> url_loader_factory_;
+  scoped_ptr<blink::WebURLLoaderMockFactory> url_loader_factory_;
   cc_blink::WebCompositorSupportImpl compositor_support_;
   scoped_ptr<scheduler::RendererScheduler> renderer_scheduler_;
   scoped_ptr<blink::WebThread> web_thread_;
diff --git a/content/test/test_render_view_host.cc b/content/test/test_render_view_host.cc
index ab0c3d3d..a0f3e13 100644
--- a/content/test/test_render_view_host.cc
+++ b/content/test/test_render_view_host.cc
@@ -171,11 +171,6 @@
 void TestRenderWidgetHostView::StopSpeaking() {
 }
 
-bool TestRenderWidgetHostView::PostProcessEventForPluginIme(
-    const NativeWebKeyboardEvent& event) {
-  return false;
-}
-
 #endif
 
 bool TestRenderWidgetHostView::GetScreenColorProfile(
diff --git a/content/test/test_render_view_host.h b/content/test/test_render_view_host.h
index fa40ece2..75a03cd 100644
--- a/content/test/test_render_view_host.h
+++ b/content/test/test_render_view_host.h
@@ -82,8 +82,6 @@
   gfx::Rect GetViewBounds() const override;
 #if defined(OS_MACOSX)
   void SetActive(bool active) override;
-  void SetWindowVisibility(bool visible) override {}
-  void WindowFrameChanged() override {}
   void ShowDefinitionForSelection() override {}
   bool SupportsSpeech() const override;
   void SpeakSelection() override;
@@ -124,10 +122,6 @@
       const base::Callback<void(const gfx::Rect&, bool)>& callback) override;
   bool CanCopyToVideoFrame() const override;
   bool HasAcceleratedSurface(const gfx::Size& desired_size) override;
-#if defined(OS_MACOSX)
-  bool PostProcessEventForPluginIme(
-      const NativeWebKeyboardEvent& event) override;
-#endif
   void LockCompositingSurface() override {}
   void UnlockCompositingSurface() override {}
   void GetScreenInfo(blink::WebScreenInfo* results) override {}
diff --git a/content/test/web_gesture_curve_mock.cc b/content/test/web_gesture_curve_mock.cc
index 1007b7e..5e7fe9c1 100644
--- a/content/test/web_gesture_curve_mock.cc
+++ b/content/test/web_gesture_curve_mock.cc
@@ -4,7 +4,6 @@
 
 #include "content/test/web_gesture_curve_mock.h"
 
-#include "content/test/weburl_loader_mock_factory.h"
 #include "third_party/WebKit/public/platform/WebFloatSize.h"
 #include "third_party/WebKit/public/platform/WebGestureCurveTarget.h"
 
diff --git a/content/test/weburl_loader_mock.cc b/content/test/weburl_loader_mock.cc
deleted file mode 100644
index 7a43fc99..0000000
--- a/content/test/weburl_loader_mock.cc
+++ /dev/null
@@ -1,167 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/test/weburl_loader_mock.h"
-
-#include "base/logging.h"
-#include "base/memory/scoped_ptr.h"
-#include "content/child/web_url_loader_impl.h"
-#include "content/test/weburl_loader_mock_factory.h"
-#include "third_party/WebKit/public/platform/URLConversion.h"
-#include "third_party/WebKit/public/platform/WebData.h"
-#include "third_party/WebKit/public/platform/WebURLError.h"
-#include "third_party/WebKit/public/platform/WebURLLoaderClient.h"
-#include "third_party/WebKit/public/platform/WebUnitTestSupport.h"
-
-WebURLLoaderMock::WebURLLoaderMock(WebURLLoaderMockFactory* factory,
-                                   blink::WebURLLoader* default_loader)
-    : factory_(factory),
-      client_(NULL),
-      default_loader_(default_loader),
-      using_default_loader_(false),
-      is_deferred_(false),
-      weak_factory_(this) {
-}
-
-WebURLLoaderMock::~WebURLLoaderMock() {
-}
-
-void WebURLLoaderMock::ServeAsynchronousRequest(
-    blink::WebURLLoaderTestDelegate* delegate,
-    const blink::WebURLResponse& response,
-    const blink::WebData& data,
-    const blink::WebURLError& error) {
-  DCHECK(!using_default_loader_);
-  if (!client_)
-    return;
-
-  // If no delegate is provided then create an empty one. The default behavior
-  // will just proxy to the client.
-  scoped_ptr<blink::WebURLLoaderTestDelegate> defaultDelegate;
-  if (!delegate) {
-    defaultDelegate.reset(new blink::WebURLLoaderTestDelegate());
-    delegate = defaultDelegate.get();
-  }
-
-  // didReceiveResponse() and didReceiveData() might end up getting ::cancel()
-  // to be called which will make the ResourceLoader to delete |this|.
-  base::WeakPtr<WebURLLoaderMock> self(GetWeakPtr());
-
-  delegate->didReceiveResponse(client_, this, response);
-  if (!self)
-    return;
-
-  if (error.reason) {
-    delegate->didFail(client_, this, error);
-    return;
-  }
-  delegate->didReceiveData(client_, this, data.data(), data.size(),
-                             data.size());
-  if (!self)
-    return;
-
-  delegate->didFinishLoading(client_, this, 0, data.size());
-}
-
-blink::WebURLRequest WebURLLoaderMock::ServeRedirect(
-    const blink::WebURLRequest& request,
-    const blink::WebURLResponse& redirectResponse) {
-  GURL redirectURL(
-      blink::WebStringToGURL(redirectResponse.httpHeaderField("Location")));
-
-  net::RedirectInfo redirectInfo;
-  redirectInfo.new_method = request.httpMethod().utf8();
-  redirectInfo.new_url = redirectURL;
-  redirectInfo.new_first_party_for_cookies = redirectURL;
-
-  blink::WebURLRequest newRequest;
-  newRequest.initialize();
-  content::WebURLLoaderImpl::PopulateURLRequestForRedirect(
-      request,
-      redirectInfo,
-      request.referrerPolicy(),
-      request.skipServiceWorker(),
-      &newRequest);
-
-  base::WeakPtr<WebURLLoaderMock> self(GetWeakPtr());
-
-  client_->willFollowRedirect(this, newRequest, redirectResponse);
-
-  // |this| might be deleted in willFollowRedirect().
-  if (!self)
-    return newRequest;
-
-  if (redirectURL != GURL(newRequest.url())) {
-    // Only follow the redirect if WebKit left the URL unmodified.
-    // We assume that WebKit only changes the URL to suppress a redirect, and we
-    // assume that it does so by setting it to be invalid.
-    DCHECK(!newRequest.url().isValid());
-    cancel();
-  }
-
-  return newRequest;
-}
-
-void WebURLLoaderMock::loadSynchronously(const blink::WebURLRequest& request,
-                                         blink::WebURLResponse& response,
-                                         blink::WebURLError& error,
-                                         blink::WebData& data) {
-  if (factory_->IsMockedURL(request.url())) {
-    factory_->LoadSynchronously(request, &response, &error, &data);
-    return;
-  }
-  DCHECK(static_cast<const GURL&>(request.url()).SchemeIs("data"))
-      << "loadSynchronously shouldn't be falling back: "
-      << request.url().string().utf8();
-  using_default_loader_ = true;
-  default_loader_->loadSynchronously(request, response, error, data);
-}
-
-void WebURLLoaderMock::loadAsynchronously(const blink::WebURLRequest& request,
-                                          blink::WebURLLoaderClient* client) {
-  CHECK(client);
-  if (factory_->IsMockedURL(request.url())) {
-    client_ = client;
-    factory_->LoadAsynchronouly(request, this);
-    return;
-  }
-  DCHECK(static_cast<const GURL&>(request.url()).SchemeIs("data"))
-      << "loadAsynchronously shouldn't be falling back: "
-      << request.url().string().utf8();
-  using_default_loader_ = true;
-  default_loader_->loadAsynchronously(request, client);
-}
-
-void WebURLLoaderMock::cancel() {
-  if (using_default_loader_) {
-    default_loader_->cancel();
-    return;
-  }
-  client_ = NULL;
-  factory_->CancelLoad(this);
-}
-
-void WebURLLoaderMock::setDefersLoading(bool deferred) {
-  is_deferred_ = deferred;
-  if (using_default_loader_) {
-    default_loader_->setDefersLoading(deferred);
-    return;
-  }
-
-  // Ignores setDefersLoading(false) safely.
-  if (!deferred)
-    return;
-
-  // setDefersLoading(true) is not implemented.
-  NOTIMPLEMENTED();
-}
-
-void WebURLLoaderMock::setLoadingTaskRunner(blink::WebTaskRunner*) {
-  // In principle this is NOTIMPLEMENTED(), but if we put that here it floods
-  // the console during webkit unit tests, so we leave the function empty.
-}
-
-base::WeakPtr<WebURLLoaderMock> WebURLLoaderMock::GetWeakPtr() {
-  return weak_factory_.GetWeakPtr();
-}
diff --git a/content/test/weburl_loader_mock.h b/content/test/weburl_loader_mock.h
deleted file mode 100644
index a95cd01..0000000
--- a/content/test/weburl_loader_mock.h
+++ /dev/null
@@ -1,74 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_TEST_WEBURL_LOADER_MOCK_H_
-#define CONTENT_TEST_WEBURL_LOADER_MOCK_H_
-
-#include "base/macros.h"
-#include "base/memory/scoped_ptr.h"
-#include "base/memory/weak_ptr.h"
-#include "third_party/WebKit/public/platform/WebURLLoader.h"
-
-namespace blink {
-class WebData;
-struct WebURLError;
-class WebURLLoaderClient;
-class WebURLLoaderTestDelegate;
-class WebURLRequest;
-class WebURLResponse;
-}
-
-class WebURLLoaderMockFactory;
-
-// A simple class for mocking WebURLLoader.
-// If the WebURLLoaderMockFactory it is associated with has been configured to
-// mock the request it gets, it serves the mocked resource.  Otherwise it just
-// forwards it to the default loader.
-class WebURLLoaderMock : public blink::WebURLLoader {
- public:
-  // This object becomes the owner of |default_loader|.
-  WebURLLoaderMock(WebURLLoaderMockFactory* factory,
-                   blink::WebURLLoader* default_loader);
-  ~WebURLLoaderMock() override;
-
-  // Simulates the asynchronous request being served.
-  void ServeAsynchronousRequest(blink::WebURLLoaderTestDelegate* delegate,
-                                const blink::WebURLResponse& response,
-                                const blink::WebData& data,
-                                const blink::WebURLError& error);
-
-  // Simulates the redirect being served.
-  blink::WebURLRequest ServeRedirect(
-      const blink::WebURLRequest& request,
-      const blink::WebURLResponse& redirectResponse);
-
-  // WebURLLoader methods:
-  void loadSynchronously(const blink::WebURLRequest& request,
-                         blink::WebURLResponse& response,
-                         blink::WebURLError& error,
-                         blink::WebData& data) override;
-  void loadAsynchronously(const blink::WebURLRequest& request,
-                          blink::WebURLLoaderClient* client) override;
-  void cancel() override;
-  void setDefersLoading(bool defer) override;
-  void setLoadingTaskRunner(blink::WebTaskRunner*) override;
-
-  bool is_deferred() { return is_deferred_; }
-  bool is_cancelled() { return !client_; }
-
-  base::WeakPtr<WebURLLoaderMock> GetWeakPtr();
-
- private:
-  WebURLLoaderMockFactory* factory_;
-  blink::WebURLLoaderClient* client_;
-  scoped_ptr<blink::WebURLLoader> default_loader_;
-  bool using_default_loader_;
-  bool is_deferred_;
-
-  base::WeakPtrFactory<WebURLLoaderMock> weak_factory_;
-
-  DISALLOW_COPY_AND_ASSIGN(WebURLLoaderMock);
-};
-
-#endif  // CONTENT_TEST_WEBURL_LOADER_MOCK_H_
diff --git a/content/test/weburl_loader_mock_factory.cc b/content/test/weburl_loader_mock_factory.cc
deleted file mode 100644
index b9ef2be..0000000
--- a/content/test/weburl_loader_mock_factory.cc
+++ /dev/null
@@ -1,177 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/test/weburl_loader_mock_factory.h"
-
-#include <stdint.h>
-
-#include "base/files/file_util.h"
-#include "base/logging.h"
-#include "base/run_loop.h"
-#include "build/build_config.h"
-#include "content/test/weburl_loader_mock.h"
-#include "third_party/WebKit/public/platform/FilePathConversion.h"
-#include "third_party/WebKit/public/platform/WebString.h"
-#include "third_party/WebKit/public/platform/WebURLError.h"
-#include "third_party/WebKit/public/platform/WebURLRequest.h"
-#include "third_party/WebKit/public/platform/WebURLResponse.h"
-#include "third_party/WebKit/public/web/WebCache.h"
-
-using blink::WebCache;
-using blink::WebData;
-using blink::WebString;
-using blink::WebURL;
-using blink::WebURLError;
-using blink::WebURLLoader;
-using blink::WebURLRequest;
-using blink::WebURLResponse;
-
-WebURLLoaderMockFactory::WebURLLoaderMockFactory() : delegate_(nullptr) {}
-
-WebURLLoaderMockFactory::~WebURLLoaderMockFactory() {}
-
-void WebURLLoaderMockFactory::RegisterURL(const WebURL& url,
-                                          const WebURLResponse& response,
-                                          const WebString& file_path) {
-  ResponseInfo response_info;
-  response_info.response = response;
-  if (!file_path.isNull() && !file_path.isEmpty()) {
-    response_info.file_path = blink::WebStringToFilePath(file_path);
-    DCHECK(base::PathExists(response_info.file_path))
-        << response_info.file_path.MaybeAsASCII() << " does not exist.";
-  }
-
-  DCHECK(url_to_reponse_info_.find(url) == url_to_reponse_info_.end());
-  url_to_reponse_info_[url] = response_info;
-}
-
-
-void WebURLLoaderMockFactory::RegisterErrorURL(const WebURL& url,
-                                               const WebURLResponse& response,
-                                               const WebURLError& error) {
-  DCHECK(url_to_reponse_info_.find(url) == url_to_reponse_info_.end());
-  RegisterURL(url, response, WebString());
-  url_to_error_info_[url] = error;
-}
-
-void WebURLLoaderMockFactory::UnregisterURL(const blink::WebURL& url) {
-  URLToResponseMap::iterator iter = url_to_reponse_info_.find(url);
-  DCHECK(iter != url_to_reponse_info_.end());
-  url_to_reponse_info_.erase(iter);
-
-  URLToErrorMap::iterator error_iter = url_to_error_info_.find(url);
-  if (error_iter != url_to_error_info_.end())
-    url_to_error_info_.erase(error_iter);
-}
-
-void WebURLLoaderMockFactory::UnregisterAllURLs() {
-  url_to_reponse_info_.clear();
-  url_to_error_info_.clear();
-  WebCache::clear();
-}
-
-void WebURLLoaderMockFactory::ServeAsynchronousRequests() {
-  // Serving a request might trigger more requests, so we cannot iterate on
-  // pending_loaders_ as it might get modified.
-  while (!pending_loaders_.empty()) {
-    LoaderToRequestMap::iterator iter = pending_loaders_.begin();
-    base::WeakPtr<WebURLLoaderMock> loader(iter->first->GetWeakPtr());
-    const WebURLRequest request = iter->second;
-    pending_loaders_.erase(loader.get());
-
-    WebURLResponse response;
-    WebURLError error;
-    WebData data;
-    LoadRequest(request, &response, &error, &data);
-    // Follow any redirects while the loader is still active.
-    while (response.httpStatusCode() >= 300 &&
-           response.httpStatusCode() < 400) {
-      WebURLRequest newRequest = loader->ServeRedirect(request, response);
-      if (!loader || loader->is_cancelled() || loader->is_deferred())
-        break;
-      LoadRequest(newRequest, &response, &error, &data);
-    }
-    // Serve the request if the loader is still active.
-    if (loader && !loader->is_cancelled() && !loader->is_deferred())
-      loader->ServeAsynchronousRequest(delegate_, response, data, error);
-  }
-  base::RunLoop().RunUntilIdle();
-}
-
-bool WebURLLoaderMockFactory::IsMockedURL(const blink::WebURL& url) {
-  return url_to_reponse_info_.find(url) != url_to_reponse_info_.end();
-}
-
-void WebURLLoaderMockFactory::CancelLoad(WebURLLoaderMock* loader) {
-  pending_loaders_.erase(loader);
-}
-
-WebURLLoader* WebURLLoaderMockFactory::CreateURLLoader(
-    WebURLLoader* default_loader) {
-  DCHECK(default_loader);
-  return new WebURLLoaderMock(this, default_loader);
-}
-
-void WebURLLoaderMockFactory::LoadSynchronously(const WebURLRequest& request,
-                                                WebURLResponse* response,
-                                                WebURLError* error,
-                                                WebData* data) {
-  LoadRequest(request, response, error, data);
-}
-
-void WebURLLoaderMockFactory::LoadAsynchronouly(const WebURLRequest& request,
-                                                WebURLLoaderMock* loader) {
-  LoaderToRequestMap::iterator iter = pending_loaders_.find(loader);
-  DCHECK(iter == pending_loaders_.end());
-  pending_loaders_[loader] = request;
-}
-
-void WebURLLoaderMockFactory::LoadRequest(const WebURLRequest& request,
-                                          WebURLResponse* response,
-                                          WebURLError* error,
-                                          WebData* data) {
-  URLToErrorMap::const_iterator error_iter =
-      url_to_error_info_.find(request.url());
-  if (error_iter != url_to_error_info_.end())
-    *error = error_iter->second;
-
-  URLToResponseMap::const_iterator iter =
-      url_to_reponse_info_.find(request.url());
-  if (iter == url_to_reponse_info_.end()) {
-    // Non mocked URLs should not have been passed to the default URLLoader.
-    NOTREACHED();
-    return;
-  }
-
-  if (!error->reason && !ReadFile(iter->second.file_path, data)) {
-    NOTREACHED();
-    return;
-  }
-
-  *response = iter->second.response;
-}
-
-// static
-bool WebURLLoaderMockFactory::ReadFile(const base::FilePath& file_path,
-                                       WebData* data) {
-  // If the path is empty then we return an empty file so tests can simulate
-  // requests without needing to actually load files.
-  if (file_path.empty())
-    return true;
-
-  int64_t file_size = 0;
-  if (!base::GetFileSize(file_path, &file_size))
-    return false;
-
-  int size = static_cast<int>(file_size);
-  scoped_ptr<char[]> buffer(new char[size]);
-  data->reset();
-  int read_count = base::ReadFile(file_path, buffer.get(), size);
-  if (read_count == -1)
-    return false;
-  DCHECK(read_count == size);
-  data->assign(buffer.get(), size);
-
-  return true;
-}
diff --git a/content/test/weburl_loader_mock_factory.h b/content/test/weburl_loader_mock_factory.h
deleted file mode 100644
index 10cb414..0000000
--- a/content/test/weburl_loader_mock_factory.h
+++ /dev/null
@@ -1,122 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_TEST_WEBURL_LOADER_MOCK_FACTORY_H_
-#define CONTENT_TEST_WEBURL_LOADER_MOCK_FACTORY_H_
-
-#include <map>
-
-#include "base/files/file_path.h"
-#include "base/macros.h"
-#include "base/memory/weak_ptr.h"
-#include "third_party/WebKit/public/platform/WebURL.h"
-#include "third_party/WebKit/public/platform/WebURLError.h"
-#include "third_party/WebKit/public/platform/WebURLRequest.h"
-#include "third_party/WebKit/public/platform/WebURLResponse.h"
-
-namespace blink {
-class WebData;
-class WebURLLoader;
-class WebURLLoaderTestDelegate;
-}
-
-class WebURLLoaderMock;
-
-// A factory that creates WebURLLoaderMock to simulate resource loading in
-// tests.
-// You register files for specific URLs, the content of the file is then served
-// when these URLs are loaded.
-// In order to serve the asynchronous requests, you need to invoke
-// ServeAsynchronousRequest.
-class WebURLLoaderMockFactory {
- public:
-  WebURLLoaderMockFactory();
-  virtual ~WebURLLoaderMockFactory();
-
-  // Called by TestBlinkWebUnitTestSupport to create a WebURLLoader.
-  // Non-mocked request are forwarded to |default_loader| which should not be
-  // NULL.
-  virtual blink::WebURLLoader* CreateURLLoader(
-      blink::WebURLLoader* default_loader);
-
-  // Registers a response and the file to be served when the specified URL
-  // is loaded. If no file is specified then the response content will be empty.
-  void RegisterURL(const blink::WebURL& url,
-                   const blink::WebURLResponse& response,
-                   const blink::WebString& filePath = blink::WebString());
-
-  // Registers an error to be served when the specified URL is requested.
-  void RegisterErrorURL(const blink::WebURL& url,
-                        const blink::WebURLResponse& response,
-                        const blink::WebURLError& error);
-
-  // Unregisters |url| so it will no longer be mocked.
-  void UnregisterURL(const blink::WebURL& url);
-
-  // Unregister all URLs so no URL will be mocked anymore.
-  void UnregisterAllURLs();
-
-  // Serves all the pending asynchronous requests.
-  void ServeAsynchronousRequests();
-
-  // Returns the last request handled by |ServeAsynchronousRequests()|.
-  blink::WebURLRequest GetLastHandledAsynchronousRequest();
-
-  // Returns true if |url| was registered for being mocked.
-  bool IsMockedURL(const blink::WebURL& url);
-
-  // Called by the loader to load a resource.
-  void LoadSynchronously(const blink::WebURLRequest& request,
-                         blink::WebURLResponse* response,
-                         blink::WebURLError* error,
-                         blink::WebData* data);
-  void LoadAsynchronouly(const blink::WebURLRequest& request,
-                         WebURLLoaderMock* loader);
-
-  // Removes the loader from the list of pending loaders.
-  void CancelLoad(WebURLLoaderMock* loader);
-
-  void set_delegate(blink::WebURLLoaderTestDelegate* delegate) {
-    delegate_ = delegate;
-  }
-
- private:
-  struct ResponseInfo {
-    blink::WebURLResponse response;
-    base::FilePath file_path;
-  };
-
-
-  // Loads the specified request and populates the response, error and data
-  // accordingly.
-  void LoadRequest(const blink::WebURLRequest& request,
-                   blink::WebURLResponse* response,
-                   blink::WebURLError* error,
-                   blink::WebData* data);
-
-  // Checks if the loader is pending. Otherwise, it may have been deleted.
-  bool IsPending(base::WeakPtr<WebURLLoaderMock> loader);
-
-  // Reads |m_filePath| and puts its content in |data|.
-  // Returns true if it successfully read the file.
-  static bool ReadFile(const base::FilePath& file_path, blink::WebData* data);
-
-  blink::WebURLLoaderTestDelegate* delegate_;
-
-  // The loaders that have not being served data yet.
-  typedef std::map<WebURLLoaderMock*, blink::WebURLRequest> LoaderToRequestMap;
-  LoaderToRequestMap pending_loaders_;
-
-  typedef std::map<GURL, blink::WebURLError> URLToErrorMap;
-  URLToErrorMap url_to_error_info_;
-
-  // Table of the registered URLs and the responses that they should receive.
-  typedef std::map<GURL, ResponseInfo> URLToResponseMap;
-  URLToResponseMap url_to_reponse_info_;
-
-  DISALLOW_COPY_AND_ASSIGN(WebURLLoaderMockFactory);
-};
-
-#endif  // CONTENT_TEST_WEBURL_LOADER_MOCK_FACTORY_H_
-
diff --git a/extensions/renderer/dispatcher.cc b/extensions/renderer/dispatcher.cc
index 77a4e7b..f841ee98 100644
--- a/extensions/renderer/dispatcher.cc
+++ b/extensions/renderer/dispatcher.cc
@@ -809,7 +809,7 @@
 
 #if defined(ENABLE_MEDIA_ROUTER)
   resources.push_back(
-      std::make_pair("chrome/browser/media/router/media_router.mojom",
+      std::make_pair("chrome/browser/media/router/mojo/media_router.mojom",
                      IDR_MEDIA_ROUTER_MOJOM_JS));
   resources.push_back(
       std::make_pair("media_router_bindings", IDR_MEDIA_ROUTER_BINDINGS_JS));
diff --git a/extensions/renderer/resources/extensions_renderer_resources.grd b/extensions/renderer/resources/extensions_renderer_resources.grd
index b4f5dad..7108db6 100644
--- a/extensions/renderer/resources/extensions_renderer_resources.grd
+++ b/extensions/renderer/resources/extensions_renderer_resources.grd
@@ -100,7 +100,7 @@
 
       <!-- Media Router Mojo service and bindings. -->
       <if expr="enable_media_router">
-        <include name="IDR_MEDIA_ROUTER_MOJOM_JS" file="${mojom_root}\chrome\browser\media\router\media_router.mojom.js" use_base_dir="false" type="BINDATA" />
+        <include name="IDR_MEDIA_ROUTER_MOJOM_JS" file="${mojom_root}\chrome\browser\media\router\mojo\media_router.mojom.js" use_base_dir="false" type="BINDATA" />
         <include name="IDR_MEDIA_ROUTER_BINDINGS_JS" file="media_router_bindings.js" type="BINDATA" />
       </if>
     </includes>
diff --git a/extensions/renderer/resources/media_router_bindings.js b/extensions/renderer/resources/media_router_bindings.js
index 391ffad..7b83e6f 100644
--- a/extensions/renderer/resources/media_router_bindings.js
+++ b/extensions/renderer/resources/media_router_bindings.js
@@ -8,7 +8,7 @@
     'mojo/public/js/bindings',
     'mojo/public/js/core',
     'content/public/renderer/frame_service_registry',
-    'chrome/browser/media/router/media_router.mojom',
+    'chrome/browser/media/router/mojo/media_router.mojom',
     'extensions/common/mojo/keep_alive.mojom',
     'mojo/public/js/connection',
     'mojo/public/js/router',
diff --git a/gpu/blink/webgraphicscontext3d_impl.cc b/gpu/blink/webgraphicscontext3d_impl.cc
index e539b5f..5a5cdbd 100644
--- a/gpu/blink/webgraphicscontext3d_impl.cc
+++ b/gpu/blink/webgraphicscontext3d_impl.cc
@@ -16,6 +16,7 @@
 #include "gpu/command_buffer/client/gles2_lib.h"
 #include "gpu/command_buffer/common/gles2_cmd_utils.h"
 #include "gpu/command_buffer/common/sync_token.h"
+#include "gpu/skia_bindings/gl_bindings_skia_cmd_buffer.h"
 
 #include "third_party/khronos/GLES2/gl2.h"
 #ifndef GL_GLEXT_PROTOTYPES
diff --git a/gpu/skia_bindings/DEPS b/gpu/skia_bindings/DEPS
index 3e2b989..6b85449 100644
--- a/gpu/skia_bindings/DEPS
+++ b/gpu/skia_bindings/DEPS
@@ -1,4 +1,5 @@
 include_rules = [
+  "+skia/ext/refptr.h",
   "+third_party/khronos",
   "+third_party/skia",
 ]
diff --git a/gpu/skia_bindings/gl_bindings_skia_cmd_buffer.cc b/gpu/skia_bindings/gl_bindings_skia_cmd_buffer.cc
index 7f96b3b1..b2a3fa8 100644
--- a/gpu/skia_bindings/gl_bindings_skia_cmd_buffer.cc
+++ b/gpu/skia_bindings/gl_bindings_skia_cmd_buffer.cc
@@ -21,8 +21,8 @@
 
 namespace skia_bindings {
 
-void InitGLES2InterfaceBindings(GrGLInterface* interface,
-                                GLES2Interface* impl) {
+skia::RefPtr<GrGLInterface> CreateGLES2InterfaceBindings(GLES2Interface* impl) {
+  skia::RefPtr<GrGLInterface> interface = skia::AdoptRef(new GrGLInterface);
   interface->fStandard = kGLES_GrGLStandard;
   interface->fExtensions.init(
       kGLES_GrGLStandard, gles_bind(&GLES2Interface::GetString, impl), nullptr,
@@ -246,6 +246,7 @@
       gles_bind(&GLES2Interface::BindFragmentInputLocationCHROMIUM, impl);
   functions->fCoverageModulation =
       gles_bind(&GLES2Interface::CoverageModulationCHROMIUM, impl);
+  return interface;
 }
 
 }  // namespace skia_bindings
diff --git a/gpu/skia_bindings/gl_bindings_skia_cmd_buffer.h b/gpu/skia_bindings/gl_bindings_skia_cmd_buffer.h
index 8b8760d4..dc69248ce 100644
--- a/gpu/skia_bindings/gl_bindings_skia_cmd_buffer.h
+++ b/gpu/skia_bindings/gl_bindings_skia_cmd_buffer.h
@@ -5,6 +5,7 @@
 #ifndef GPU_SKIA_BINDINGS_GL_BINDINGS_SKIA_CMD_BUFFER_H_
 #define GPU_SKIA_BINDINGS_GL_BINDINGS_SKIA_CMD_BUFFER_H_
 
+#include "skia/ext/refptr.h"
 #include "third_party/skia/include/core/SkTypes.h"
 
 struct GrGLInterface;
@@ -19,7 +20,8 @@
 
 // The GPU back-end for skia requires pointers to GL functions. This function
 // initializes bindings for skia-gpu to a GLES2Interface object.
-void InitGLES2InterfaceBindings(GrGLInterface*, gpu::gles2::GLES2Interface*);
+skia::RefPtr<GrGLInterface> CreateGLES2InterfaceBindings(
+    gpu::gles2::GLES2Interface*);
 
 }  // namespace skia_bindings
 
diff --git a/ios/web/web_state/ui/crw_web_controller.mm b/ios/web/web_state/ui/crw_web_controller.mm
index 1a7163e..99665674 100644
--- a/ios/web/web_state/ui/crw_web_controller.mm
+++ b/ios/web/web_state/ui/crw_web_controller.mm
@@ -1327,8 +1327,10 @@
   // Load the url. The UIWebView delegate callbacks take care of updating the
   // session history and UI.
   const GURL targetURL([self currentNavigationURL]);
-  if (!targetURL.is_valid())
+  if (!targetURL.is_valid()) {
+    [self didFinishWithURL:targetURL loadSuccess:NO];
     return;
+  }
 
   // JavaScript should never be evaluated here. User-entered JS should be
   // evaluated via stringByEvaluatingUserJavaScriptFromString.
diff --git a/media/mojo/services/BUILD.gn b/media/mojo/services/BUILD.gn
index c917069..c740979 100644
--- a/media/mojo/services/BUILD.gn
+++ b/media/mojo/services/BUILD.gn
@@ -79,6 +79,7 @@
     "//media/mojo/interfaces",
     "//mojo/common",
     "//mojo/public/c/system:for_component",
+    "//mojo/shell/public/cpp:sources",
     "//mojo/shell/public/interfaces",
   ]
 }
@@ -92,6 +93,7 @@
     "//mojo/common",
     "//mojo/public/c/system:for_component",
     "//mojo/shell/public/interfaces",
+    "//url",
   ]
 
   sources = [
@@ -180,6 +182,7 @@
     ":renderer_service",
     "//base",
     "//media",
+    "//media/mojo/interfaces",
     "//mojo/shell/public/cpp",
   ]
 }
@@ -196,6 +199,7 @@
     ":application",
     "//base",
     "//media",
+    "//mojo/shell/public/cpp:sources",
   ]
 
   if (enable_test_mojo_media_client) {
@@ -228,8 +232,11 @@
 
   deps = [
     ":application",
+    "//base",
+    "//media",
     "//mojo/logging",
     "//mojo/public/c/system:for_shared_library",
+    "//mojo/shell/public/cpp:sources",
   ]
 }
 
@@ -250,7 +257,10 @@
 
   deps = [
     ":proxy",
+    "//media",
     "//media/base:test_support",
+    "//media/mojo/common",
+    "//media/mojo/interfaces",
     "//mojo/shell/public/cpp:test_support",
     "//testing/gmock",
     "//testing/gtest",
diff --git a/media/mojo/services/mojo_media_application_factory.cc b/media/mojo/services/mojo_media_application_factory.cc
index 0261982..88ce7bc 100644
--- a/media/mojo/services/mojo_media_application_factory.cc
+++ b/media/mojo/services/mojo_media_application_factory.cc
@@ -8,13 +8,13 @@
 #include "media/mojo/services/mojo_media_application.h"
 
 #if defined(ENABLE_TEST_MOJO_MEDIA_CLIENT)
-#include "media/mojo/services/test_mojo_media_client.h"
+#include "media/mojo/services/test_mojo_media_client.h"  // nogncheck
 using DefaultClient = media::TestMojoMediaClient;
 #elif defined(OS_ANDROID)
-#include "media/mojo/services/android_mojo_media_client.h"
+#include "media/mojo/services/android_mojo_media_client.h"  // nogncheck
 using DefaultClient = media::AndroidMojoMediaClient;
 #else
-#include "media/mojo/services/default_mojo_media_client.h"
+#include "media/mojo/services/default_mojo_media_client.h"  // nogncheck
 using DefaultClient = media::DefaultMojoMediaClient;
 #endif
 
diff --git a/net/BUILD.gn b/net/BUILD.gn
index dc19b130..fdfe0b6 100644
--- a/net/BUILD.gn
+++ b/net/BUILD.gn
@@ -163,8 +163,6 @@
       "quic/crypto/aead_base_encrypter_nss.cc",
       "quic/crypto/aes_128_gcm_12_decrypter_nss.cc",
       "quic/crypto/aes_128_gcm_12_encrypter_nss.cc",
-      "quic/crypto/chacha20_poly1305_decrypter_nss.cc",
-      "quic/crypto/chacha20_poly1305_encrypter_nss.cc",
       "quic/crypto/chacha20_poly1305_rfc7539_decrypter_nss.cc",
       "quic/crypto/chacha20_poly1305_rfc7539_encrypter_nss.cc",
       "quic/crypto/channel_id_nss.cc",
@@ -195,8 +193,6 @@
       "quic/crypto/aead_base_encrypter_openssl.cc",
       "quic/crypto/aes_128_gcm_12_decrypter_openssl.cc",
       "quic/crypto/aes_128_gcm_12_encrypter_openssl.cc",
-      "quic/crypto/chacha20_poly1305_decrypter_openssl.cc",
-      "quic/crypto/chacha20_poly1305_encrypter_openssl.cc",
       "quic/crypto/chacha20_poly1305_rfc7539_decrypter_openssl.cc",
       "quic/crypto/chacha20_poly1305_rfc7539_encrypter_openssl.cc",
       "quic/crypto/channel_id_openssl.cc",
diff --git a/net/net.gypi b/net/net.gypi
index 1d3b05b..b47e43f 100644
--- a/net/net.gypi
+++ b/net/net.gypi
@@ -253,10 +253,6 @@
       'quic/crypto/aes_128_gcm_12_decrypter_openssl.cc',
       'quic/crypto/aes_128_gcm_12_encrypter.h',
       'quic/crypto/aes_128_gcm_12_encrypter_openssl.cc',
-      'quic/crypto/chacha20_poly1305_decrypter.h',
-      'quic/crypto/chacha20_poly1305_decrypter_openssl.cc',
-      'quic/crypto/chacha20_poly1305_encrypter.h',
-      'quic/crypto/chacha20_poly1305_encrypter_openssl.cc',
       'quic/crypto/chacha20_poly1305_rfc7539_decrypter.h',
       'quic/crypto/chacha20_poly1305_rfc7539_decrypter_openssl.cc',
       'quic/crypto/chacha20_poly1305_rfc7539_encrypter.h',
@@ -1010,8 +1006,6 @@
       'quic/crypto/aes_128_gcm_12_encrypter_nss.cc',
       'quic/crypto/cert_compressor.cc',
       'quic/crypto/cert_compressor.h',
-      'quic/crypto/chacha20_poly1305_decrypter_nss.cc',
-      'quic/crypto/chacha20_poly1305_encrypter_nss.cc',
       'quic/crypto/chacha20_poly1305_rfc7539_decrypter_nss.cc',
       'quic/crypto/chacha20_poly1305_rfc7539_encrypter_nss.cc',
       'quic/crypto/channel_id_nss.cc',
@@ -1585,8 +1579,6 @@
       'quic/crypto/aes_128_gcm_12_decrypter_test.cc',
       'quic/crypto/aes_128_gcm_12_encrypter_test.cc',
       'quic/crypto/cert_compressor_test.cc',
-      'quic/crypto/chacha20_poly1305_decrypter_test.cc',
-      'quic/crypto/chacha20_poly1305_encrypter_test.cc',
       'quic/crypto/chacha20_poly1305_rfc7539_decrypter_test.cc',
       'quic/crypto/chacha20_poly1305_rfc7539_encrypter_test.cc',
       'quic/crypto/channel_id_test.cc',
diff --git a/net/net_common.gypi b/net/net_common.gypi
index c09336e1..f5e56c4 100644
--- a/net/net_common.gypi
+++ b/net/net_common.gypi
@@ -119,8 +119,6 @@
           'quic/crypto/aead_base_encrypter_nss.cc',
           'quic/crypto/aes_128_gcm_12_decrypter_nss.cc',
           'quic/crypto/aes_128_gcm_12_encrypter_nss.cc',
-          'quic/crypto/chacha20_poly1305_decrypter_nss.cc',
-          'quic/crypto/chacha20_poly1305_encrypter_nss.cc',
           'quic/crypto/chacha20_poly1305_rfc7539_decrypter_nss.cc',
           'quic/crypto/chacha20_poly1305_rfc7539_encrypter_nss.cc',
           'quic/crypto/channel_id_nss.cc',
@@ -159,8 +157,6 @@
           'quic/crypto/aead_base_encrypter_openssl.cc',
           'quic/crypto/aes_128_gcm_12_decrypter_openssl.cc',
           'quic/crypto/aes_128_gcm_12_encrypter_openssl.cc',
-          'quic/crypto/chacha20_poly1305_decrypter_openssl.cc',
-          'quic/crypto/chacha20_poly1305_encrypter_openssl.cc',
           'quic/crypto/chacha20_poly1305_rfc7539_decrypter_openssl.cc',
           'quic/crypto/chacha20_poly1305_rfc7539_encrypter_openssl.cc',
           'quic/crypto/channel_id_openssl.cc',
diff --git a/net/quic/crypto/chacha20_poly1305_decrypter_nss.cc b/net/quic/crypto/chacha20_poly1305_decrypter_nss.cc
deleted file mode 100644
index aeff43a..0000000
--- a/net/quic/crypto/chacha20_poly1305_decrypter_nss.cc
+++ /dev/null
@@ -1,61 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "net/quic/crypto/chacha20_poly1305_decrypter.h"
-
-#include <pk11pub.h>
-
-using base::StringPiece;
-
-namespace net {
-
-namespace {
-
-const size_t kKeySize = 32;
-const size_t kNoncePrefixSize = 0;
-
-}  // namespace
-
-ChaCha20Poly1305Decrypter::ChaCha20Poly1305Decrypter()
-    : AeadBaseDecrypter(CKM_NSS_CHACHA20_POLY1305,
-                        kKeySize,
-                        kAuthTagSize,
-                        kNoncePrefixSize) {
-  static_assert(kKeySize <= kMaxKeySize, "key size too big");
-  static_assert(kNoncePrefixSize <= kMaxNoncePrefixSize,
-                "nonce prefix size too big");
-}
-
-ChaCha20Poly1305Decrypter::~ChaCha20Poly1305Decrypter() {}
-
-void ChaCha20Poly1305Decrypter::FillAeadParams(StringPiece nonce,
-                                               StringPiece associated_data,
-                                               size_t auth_tag_size,
-                                               AeadParams* aead_params) const {
-  aead_params->len = sizeof(aead_params->data.nss_aead_params);
-  CK_NSS_AEAD_PARAMS* nss_aead_params = &aead_params->data.nss_aead_params;
-  nss_aead_params->pIv =
-      reinterpret_cast<CK_BYTE*>(const_cast<char*>(nonce.data()));
-  nss_aead_params->ulIvLen = nonce.size();
-  nss_aead_params->pAAD =
-      reinterpret_cast<CK_BYTE*>(const_cast<char*>(associated_data.data()));
-  nss_aead_params->ulAADLen = associated_data.size();
-  nss_aead_params->ulTagLen = auth_tag_size;
-}
-
-const char* ChaCha20Poly1305Decrypter::cipher_name() const {
-  // TODO(rtenneti): Use TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305 instead of
-  // hard coded string.
-  // return TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305;
-  return "ECDHE-RSA-CHACHA20-POLY1305";
-}
-
-uint32_t ChaCha20Poly1305Decrypter::cipher_id() const {
-  // TODO(rtenneti): when Chromium requires NSS 3.15.2 or later, use
-  // TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 instead of 0xCC13.
-  // "OR" 0x03000000 to match OpenSSL/BoringSSL implementations.
-  return 0x03000000 | 0xCC13;
-}
-
-}  // namespace net
diff --git a/net/quic/crypto/chacha20_poly1305_decrypter_openssl.cc b/net/quic/crypto/chacha20_poly1305_decrypter_openssl.cc
deleted file mode 100644
index 683f13b..0000000
--- a/net/quic/crypto/chacha20_poly1305_decrypter_openssl.cc
+++ /dev/null
@@ -1,41 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "net/quic/crypto/chacha20_poly1305_decrypter.h"
-
-#include <openssl/evp.h>
-#include <openssl/tls1.h>
-
-namespace net {
-
-namespace {
-
-const size_t kKeySize = 32;
-const size_t kNoncePrefixSize = 0;
-
-}  // namespace
-
-// QUIC currently uses the draft-agl-tls-chacha20poly1305-04 ChaCha20-Poly1305
-// construction rather than RFC 7539.
-ChaCha20Poly1305Decrypter::ChaCha20Poly1305Decrypter()
-    : AeadBaseDecrypter(EVP_aead_chacha20_poly1305_old(),
-                        kKeySize,
-                        kAuthTagSize,
-                        kNoncePrefixSize) {
-  static_assert(kKeySize <= kMaxKeySize, "key size too big");
-  static_assert(kNoncePrefixSize <= kMaxNoncePrefixSize,
-                "nonce prefix size too big");
-}
-
-ChaCha20Poly1305Decrypter::~ChaCha20Poly1305Decrypter() {}
-
-const char* ChaCha20Poly1305Decrypter::cipher_name() const {
-  return TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305_OLD;
-}
-
-uint32_t ChaCha20Poly1305Decrypter::cipher_id() const {
-  return TLS1_CK_ECDHE_RSA_CHACHA20_POLY1305_OLD;
-}
-
-}  // namespace net
diff --git a/net/quic/crypto/chacha20_poly1305_decrypter_test.cc b/net/quic/crypto/chacha20_poly1305_decrypter_test.cc
deleted file mode 100644
index 5fac2d5..0000000
--- a/net/quic/crypto/chacha20_poly1305_decrypter_test.cc
+++ /dev/null
@@ -1,138 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "net/quic/crypto/chacha20_poly1305_decrypter.h"
-
-#include "net/quic/quic_flags.h"
-#include "net/quic/test_tools/quic_test_utils.h"
-
-using base::StringPiece;
-using std::string;
-
-namespace {
-
-// The test vectors come from draft-agl-tls-chacha20poly1305-04 Section 7.
-
-// Each test vector consists of six strings of lowercase hexadecimal digits.
-// The strings may be empty (zero length). A test vector with a nullptr |key|
-// marks the end of an array of test vectors.
-struct TestVector {
-  // Input:
-  const char* key;
-  const char* iv;
-  const char* aad;
-  const char* ct;
-
-  // Expected output:
-  const char* pt;  // An empty string "" means decryption succeeded and
-                   // the plaintext is zero-length. NULL means decryption
-                   // failed.
-};
-
-const TestVector test_vectors[] = {
-    {"4290bcb154173531f314af57f3be3b5006da371ece272afa1b5dbdd110"
-     "0a1007",
-     "cd7cf67be39c794a", "87e229d4500845a079c0",
-     "e3e446f7ede9a19b62a4677dabf4e3d24b876bb28475",  // "3896e1d6" truncated.
-     "86d09974840bded2a5ca"},
-    // Modify the ciphertext (ChaCha20 encryption output).
-    {
-        "4290bcb154173531f314af57f3be3b5006da371ece272afa1b5dbdd110"
-        "0a1007",
-        "cd7cf67be39c794a", "87e229d4500845a079c0",
-        "f3e446f7ede9a19b62a4677dabf4e3d24b876bb28475",  // "3896e1d6"
-                                                         // truncated.
-        nullptr                                          // FAIL
-    },
-    // Modify the ciphertext (Poly1305 authenticator).
-    {
-        "4290bcb154173531f314af57f3be3b5006da371ece272afa1b5dbdd110"
-        "0a1007",
-        "cd7cf67be39c794a", "87e229d4500845a079c0",
-        "e3e446f7ede9a19b62a4677dabf4e3d24b876bb28476",  // "3896e1d6"
-                                                         // truncated.
-        nullptr                                          // FAIL
-    },
-    // Modify the associated data.
-    {
-        "4290bcb154173531f314af57f3be3b5006da371ece272afa1b5dbdd110"
-        "0a1007",
-        "dd7cf67be39c794a", "87e229d4500845a079c0",
-        "e3e446f7ede9a19b62a4677dabf4e3d24b876bb28475",  // "3896e1d6"
-                                                         // truncated.
-        nullptr                                          // FAIL
-    },
-    {nullptr}};
-
-}  // namespace
-
-namespace net {
-namespace test {
-
-// DecryptWithNonce wraps the |Decrypt| method of |decrypter| to allow passing
-// in an nonce and also to allocate the buffer needed for the plaintext.
-QuicData* DecryptWithNonce(ChaCha20Poly1305Decrypter* decrypter,
-                           StringPiece nonce,
-                           StringPiece associated_data,
-                           StringPiece ciphertext) {
-  QuicPathId path_id = kDefaultPathId;
-  QuicPacketNumber packet_number;
-  StringPiece nonce_prefix(nonce.data(), nonce.size() - sizeof(packet_number));
-  decrypter->SetNoncePrefix(nonce_prefix);
-  memcpy(&packet_number, nonce.data() + nonce_prefix.size(),
-         sizeof(packet_number));
-  path_id = static_cast<QuicPathId>(
-      packet_number >> 8 * (sizeof(packet_number) - sizeof(path_id)));
-  packet_number &= UINT64_C(0x00FFFFFFFFFFFFFF);
-  scoped_ptr<char[]> output(new char[ciphertext.length()]);
-  size_t output_length = 0;
-  const bool success = decrypter->DecryptPacket(
-      path_id, packet_number, associated_data, ciphertext, output.get(),
-      &output_length, ciphertext.length());
-  if (!success) {
-    return nullptr;
-  }
-  return new QuicData(output.release(), output_length, true);
-}
-
-TEST(ChaCha20Poly1305DecrypterTest, Decrypt) {
-  for (size_t i = 0; test_vectors[i].key != nullptr; i++) {
-    // If not present then decryption is expected to fail.
-    bool has_pt = test_vectors[i].pt;
-
-    // Decode the test vector.
-    string key;
-    string iv;
-    string aad;
-    string ct;
-    string pt;
-    ASSERT_TRUE(DecodeHexString(test_vectors[i].key, &key));
-    ASSERT_TRUE(DecodeHexString(test_vectors[i].iv, &iv));
-    ASSERT_TRUE(DecodeHexString(test_vectors[i].aad, &aad));
-    ASSERT_TRUE(DecodeHexString(test_vectors[i].ct, &ct));
-    if (has_pt) {
-      ASSERT_TRUE(DecodeHexString(test_vectors[i].pt, &pt));
-    }
-
-    ChaCha20Poly1305Decrypter decrypter;
-    ASSERT_TRUE(decrypter.SetKey(key));
-    scoped_ptr<QuicData> decrypted(DecryptWithNonce(
-        &decrypter, iv,
-        // This deliberately tests that the decrypter can handle an AAD that
-        // is set to nullptr, as opposed to a zero-length, non-nullptr pointer.
-        StringPiece(aad.length() ? aad.data() : nullptr, aad.length()), ct));
-    if (!decrypted.get()) {
-      EXPECT_FALSE(has_pt);
-      continue;
-    }
-    EXPECT_TRUE(has_pt);
-
-    ASSERT_EQ(pt.length(), decrypted->length());
-    test::CompareCharArraysWithHexError("plaintext", decrypted->data(),
-                                        pt.length(), pt.data(), pt.length());
-  }
-}
-
-}  // namespace test
-}  // namespace net
diff --git a/net/quic/crypto/chacha20_poly1305_encrypter_nss.cc b/net/quic/crypto/chacha20_poly1305_encrypter_nss.cc
deleted file mode 100644
index 9b0e9bfb..0000000
--- a/net/quic/crypto/chacha20_poly1305_encrypter_nss.cc
+++ /dev/null
@@ -1,47 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "net/quic/crypto/chacha20_poly1305_encrypter.h"
-
-#include <pk11pub.h>
-
-using base::StringPiece;
-
-namespace net {
-
-namespace {
-
-const size_t kKeySize = 32;
-const size_t kNoncePrefixSize = 0;
-
-}  // namespace
-
-ChaCha20Poly1305Encrypter::ChaCha20Poly1305Encrypter()
-    : AeadBaseEncrypter(CKM_NSS_CHACHA20_POLY1305,
-                        kKeySize,
-                        kAuthTagSize,
-                        kNoncePrefixSize) {
-  static_assert(kKeySize <= kMaxKeySize, "key size too big");
-  static_assert(kNoncePrefixSize <= kMaxNoncePrefixSize,
-                "nonce prefix size too big");
-}
-
-ChaCha20Poly1305Encrypter::~ChaCha20Poly1305Encrypter() {}
-
-void ChaCha20Poly1305Encrypter::FillAeadParams(StringPiece nonce,
-                                               StringPiece associated_data,
-                                               size_t auth_tag_size,
-                                               AeadParams* aead_params) const {
-  aead_params->len = sizeof(aead_params->data.nss_aead_params);
-  CK_NSS_AEAD_PARAMS* nss_aead_params = &aead_params->data.nss_aead_params;
-  nss_aead_params->pIv =
-      reinterpret_cast<CK_BYTE*>(const_cast<char*>(nonce.data()));
-  nss_aead_params->ulIvLen = nonce.size();
-  nss_aead_params->pAAD =
-      reinterpret_cast<CK_BYTE*>(const_cast<char*>(associated_data.data()));
-  nss_aead_params->ulAADLen = associated_data.size();
-  nss_aead_params->ulTagLen = auth_tag_size;
-}
-
-}  // namespace net
diff --git a/net/quic/crypto/chacha20_poly1305_encrypter_openssl.cc b/net/quic/crypto/chacha20_poly1305_encrypter_openssl.cc
deleted file mode 100644
index 9a75eec..0000000
--- a/net/quic/crypto/chacha20_poly1305_encrypter_openssl.cc
+++ /dev/null
@@ -1,32 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "net/quic/crypto/chacha20_poly1305_encrypter.h"
-
-#include <openssl/evp.h>
-
-namespace net {
-
-namespace {
-
-const size_t kKeySize = 32;
-const size_t kNoncePrefixSize = 0;
-
-}  // namespace
-
-// QUIC currently uses the draft-agl-tls-chacha20poly1305-04 ChaCha20-Poly1305
-// construction rather than RFC 7539.
-ChaCha20Poly1305Encrypter::ChaCha20Poly1305Encrypter()
-    : AeadBaseEncrypter(EVP_aead_chacha20_poly1305_old(),
-                        kKeySize,
-                        kAuthTagSize,
-                        kNoncePrefixSize) {
-  static_assert(kKeySize <= kMaxKeySize, "key size too big");
-  static_assert(kNoncePrefixSize <= kMaxNoncePrefixSize,
-                "nonce prefix size too big");
-}
-
-ChaCha20Poly1305Encrypter::~ChaCha20Poly1305Encrypter() {}
-
-}  // namespace net
diff --git a/net/quic/crypto/chacha20_poly1305_encrypter_test.cc b/net/quic/crypto/chacha20_poly1305_encrypter_test.cc
deleted file mode 100644
index 0c491820..0000000
--- a/net/quic/crypto/chacha20_poly1305_encrypter_test.cc
+++ /dev/null
@@ -1,102 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "net/quic/crypto/chacha20_poly1305_encrypter.h"
-
-#include "net/quic/test_tools/quic_test_utils.h"
-
-using base::StringPiece;
-using std::string;
-
-namespace {
-
-// The test vectors come from draft-agl-tls-chacha20poly1305-04 Section 7.
-
-// Each test vector consists of five strings of lowercase hexadecimal digits.
-// The strings may be empty (zero length). A test vector with a nullptr |key|
-// marks the end of an array of test vectors.
-struct TestVector {
-  const char* key;
-  const char* pt;
-  const char* iv;
-  const char* aad;
-  const char* ct;
-};
-
-const TestVector test_vectors[] = {
-    {
-        "4290bcb154173531f314af57f3be3b5006da371ece272afa1b5dbdd110"
-        "0a1007",
-        "86d09974840bded2a5ca", "cd7cf67be39c794a", "87e229d4500845a079c0",
-        "e3e446f7ede9a19b62a4677dabf4e3d24b876bb28475"  // "3896e1d6" truncated.
-    },
-    {nullptr}};
-
-}  // namespace
-
-namespace net {
-namespace test {
-
-// EncryptWithNonce wraps the |Encrypt| method of |encrypter| to allow passing
-// in an nonce and also to allocate the buffer needed for the ciphertext.
-QuicData* EncryptWithNonce(ChaCha20Poly1305Encrypter* encrypter,
-                           StringPiece nonce,
-                           StringPiece associated_data,
-                           StringPiece plaintext) {
-  size_t ciphertext_size = encrypter->GetCiphertextSize(plaintext.length());
-  scoped_ptr<char[]> ciphertext(new char[ciphertext_size]);
-
-  if (!encrypter->Encrypt(nonce, associated_data, plaintext,
-                          reinterpret_cast<unsigned char*>(ciphertext.get()))) {
-    return nullptr;
-  }
-
-  return new QuicData(ciphertext.release(), ciphertext_size, true);
-}
-
-TEST(ChaCha20Poly1305EncrypterTest, Encrypt) {
-  for (size_t i = 0; test_vectors[i].key != nullptr; i++) {
-    // Decode the test vector.
-    string key;
-    string pt;
-    string iv;
-    string aad;
-    string ct;
-    ASSERT_TRUE(DecodeHexString(test_vectors[i].key, &key));
-    ASSERT_TRUE(DecodeHexString(test_vectors[i].pt, &pt));
-    ASSERT_TRUE(DecodeHexString(test_vectors[i].iv, &iv));
-    ASSERT_TRUE(DecodeHexString(test_vectors[i].aad, &aad));
-    ASSERT_TRUE(DecodeHexString(test_vectors[i].ct, &ct));
-
-    ChaCha20Poly1305Encrypter encrypter;
-    ASSERT_TRUE(encrypter.SetKey(key));
-    scoped_ptr<QuicData> encrypted(EncryptWithNonce(
-        &encrypter, iv,
-        // This deliberately tests that the encrypter can handle an AAD that
-        // is set to nullptr, as opposed to a zero-length, non-nullptr pointer.
-        StringPiece(aad.length() ? aad.data() : nullptr, aad.length()), pt));
-    ASSERT_TRUE(encrypted.get());
-
-    test::CompareCharArraysWithHexError("ciphertext", encrypted->data(),
-                                        encrypted->length(), ct.data(),
-                                        ct.length());
-  }
-}
-
-TEST(ChaCha20Poly1305EncrypterTest, GetMaxPlaintextSize) {
-  ChaCha20Poly1305Encrypter encrypter;
-  EXPECT_EQ(1000u, encrypter.GetMaxPlaintextSize(1012));
-  EXPECT_EQ(100u, encrypter.GetMaxPlaintextSize(112));
-  EXPECT_EQ(10u, encrypter.GetMaxPlaintextSize(22));
-}
-
-TEST(ChaCha20Poly1305EncrypterTest, GetCiphertextSize) {
-  ChaCha20Poly1305Encrypter encrypter;
-  EXPECT_EQ(1012u, encrypter.GetCiphertextSize(1000));
-  EXPECT_EQ(112u, encrypter.GetCiphertextSize(100));
-  EXPECT_EQ(22u, encrypter.GetCiphertextSize(10));
-}
-
-}  // namespace test
-}  // namespace net
diff --git a/net/quic/crypto/crypto_protocol.h b/net/quic/crypto/crypto_protocol.h
index 3a2cf3d1..f1bbd47f 100644
--- a/net/quic/crypto/crypto_protocol.h
+++ b/net/quic/crypto/crypto_protocol.h
@@ -47,7 +47,6 @@
 // AEAD algorithms
 const QuicTag kNULL = TAG('N', 'U', 'L', 'N');   // null algorithm
 const QuicTag kAESG = TAG('A', 'E', 'S', 'G');   // AES128 + GCM-12
-const QuicTag kCC12 = TAG('C', 'C', '1', '2');   // ChaCha20 + Poly1305
 const QuicTag kCC20 = TAG('C', 'C', '2', '0');   // ChaCha20 + Poly1305 RFC7539
 
 // Socket receive buffer
diff --git a/net/quic/crypto/quic_crypto_client_config.cc b/net/quic/crypto/quic_crypto_client_config.cc
index 4bfcc82..a6906a7 100644
--- a/net/quic/crypto/quic_crypto_client_config.cc
+++ b/net/quic/crypto/quic_crypto_client_config.cc
@@ -384,7 +384,6 @@
   if (ChaCha20Poly1305Rfc7539Encrypter::IsSupported()) {
     aead.push_back(kCC20);
   }
-  aead.push_back(kCC12);
   aead.push_back(kAESG);
 
   disable_ecdsa_ = false;
diff --git a/net/quic/crypto/quic_crypto_server_config.cc b/net/quic/crypto/quic_crypto_server_config.cc
index 68a5658..2d0c664 100644
--- a/net/quic/crypto/quic_crypto_server_config.cc
+++ b/net/quic/crypto/quic_crypto_server_config.cc
@@ -294,12 +294,9 @@
   } else {
     msg.SetTaglist(kKEXS, kC255, 0);
   }
-  if (FLAGS_quic_crypto_server_config_default_has_chacha20) {
-    if (ChaCha20Poly1305Rfc7539Encrypter::IsSupported()) {
-      msg.SetTaglist(kAEAD, kAESG, kCC12, kCC20, 0);
-    } else {
-      msg.SetTaglist(kAEAD, kAESG, kCC12, 0);
-    }
+  if (FLAGS_quic_crypto_server_config_default_has_chacha20 &&
+      ChaCha20Poly1305Rfc7539Encrypter::IsSupported()) {
+    msg.SetTaglist(kAEAD, kAESG, kCC20, 0);
   } else {
     msg.SetTaglist(kAEAD, kAESG, 0);
   }
diff --git a/net/quic/crypto/quic_crypto_server_config_test.cc b/net/quic/crypto/quic_crypto_server_config_test.cc
index 1578bd9..270cd9a2 100644
--- a/net/quic/crypto/quic_crypto_server_config_test.cc
+++ b/net/quic/crypto/quic_crypto_server_config_test.cc
@@ -9,6 +9,7 @@
 #include "base/stl_util.h"
 #include "net/quic/crypto/aes_128_gcm_12_encrypter.h"
 #include "net/quic/crypto/cert_compressor.h"
+#include "net/quic/crypto/chacha20_poly1305_rfc7539_encrypter.h"
 #include "net/quic/crypto/crypto_handshake_message.h"
 #include "net/quic/crypto/crypto_secret_boxer.h"
 #include "net/quic/crypto/crypto_server_config_protobuf.h"
@@ -243,7 +244,11 @@
   ASSERT_EQ(QUIC_NO_ERROR, message->GetTaglist(kAEAD, &aead_tags, &aead_len));
   vector<QuicTag> aead(aead_tags, aead_tags + aead_len);
   EXPECT_THAT(aead, ::testing::Contains(kAESG));
-  EXPECT_LE(2u, aead.size());
+  if (ChaCha20Poly1305Rfc7539Encrypter::IsSupported()) {
+    EXPECT_LE(2u, aead.size());
+  } else {
+    EXPECT_LE(1u, aead.size());
+  }
 }
 
 TEST(QuicCryptoServerConfigTest, ServerConfigDisableChaCha) {
diff --git a/net/quic/crypto/quic_decrypter.cc b/net/quic/crypto/quic_decrypter.cc
index 1253b872..eae1f8fc 100644
--- a/net/quic/crypto/quic_decrypter.cc
+++ b/net/quic/crypto/quic_decrypter.cc
@@ -5,7 +5,6 @@
 #include "net/quic/crypto/quic_decrypter.h"
 
 #include "net/quic/crypto/aes_128_gcm_12_decrypter.h"
-#include "net/quic/crypto/chacha20_poly1305_decrypter.h"
 #include "net/quic/crypto/chacha20_poly1305_rfc7539_decrypter.h"
 #include "net/quic/crypto/crypto_protocol.h"
 #include "net/quic/crypto/null_decrypter.h"
@@ -17,8 +16,6 @@
   switch (algorithm) {
     case kAESG:
       return new Aes128Gcm12Decrypter();
-    case kCC12:
-      return new ChaCha20Poly1305Decrypter();
     case kCC20:
       return new ChaCha20Poly1305Rfc7539Decrypter();
     case kNULL:
diff --git a/net/quic/crypto/quic_encrypter.cc b/net/quic/crypto/quic_encrypter.cc
index 0cd727b0..e483b6f 100644
--- a/net/quic/crypto/quic_encrypter.cc
+++ b/net/quic/crypto/quic_encrypter.cc
@@ -5,7 +5,6 @@
 #include "net/quic/crypto/quic_encrypter.h"
 
 #include "net/quic/crypto/aes_128_gcm_12_encrypter.h"
-#include "net/quic/crypto/chacha20_poly1305_encrypter.h"
 #include "net/quic/crypto/chacha20_poly1305_rfc7539_encrypter.h"
 #include "net/quic/crypto/crypto_protocol.h"
 #include "net/quic/crypto/null_encrypter.h"
@@ -17,8 +16,6 @@
   switch (algorithm) {
     case kAESG:
       return new Aes128Gcm12Encrypter();
-    case kCC12:
-      return new ChaCha20Poly1305Encrypter();
     case kCC20:
       return new ChaCha20Poly1305Rfc7539Encrypter();
     case kNULL:
diff --git a/net/quic/quic_chromium_client_session.cc b/net/quic/quic_chromium_client_session.cc
index 8be38c18..afb0746 100644
--- a/net/quic/quic_chromium_client_session.cc
+++ b/net/quic/quic_chromium_client_session.cc
@@ -530,10 +530,6 @@
       cipher_suite = 0xc02f;  // TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
       security_bits = 128;
       break;
-    case kCC12:
-      cipher_suite = 0xcc13;  // TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
-      security_bits = 256;
-      break;
     case kCC20:
       cipher_suite = 0xcc13;  // TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
       security_bits = 256;
diff --git a/remoting/host/BUILD.gn b/remoting/host/BUILD.gn
index 93fdf43..fd572d9 100644
--- a/remoting/host/BUILD.gn
+++ b/remoting/host/BUILD.gn
@@ -217,6 +217,10 @@
       "security_key/fake_remote_security_key_ipc_client.h",
       "security_key/fake_remote_security_key_ipc_server.cc",
       "security_key/fake_remote_security_key_ipc_server.h",
+      "security_key/fake_remote_security_key_message_reader.cc",
+      "security_key/fake_remote_security_key_message_reader.h",
+      "security_key/fake_remote_security_key_message_writer.cc",
+      "security_key/fake_remote_security_key_message_writer.h",
       "setup/mock_oauth_client.cc",
       "setup/mock_oauth_client.h",
     ]
@@ -288,8 +292,8 @@
       "security_key/gnubby_extension_session_unittest.cc",
       "security_key/remote_security_key_ipc_client_unittest.cc",
       "security_key/remote_security_key_ipc_server_unittest.cc",
-      "security_key/remote_security_key_message_reader_unittest.cc",
-      "security_key/remote_security_key_message_writer_unittest.cc",
+      "security_key/remote_security_key_message_reader_impl_unittest.cc",
+      "security_key/remote_security_key_message_writer_impl_unittest.cc",
       "server_log_entry_host_unittest.cc",
       "setup/me2me_native_messaging_host_unittest.cc",
       "setup/oauth_helper_unittest.cc",
diff --git a/remoting/host/security_key/fake_remote_security_key_message_reader.cc b/remoting/host/security_key/fake_remote_security_key_message_reader.cc
new file mode 100644
index 0000000..6af236d
--- /dev/null
+++ b/remoting/host/security_key/fake_remote_security_key_message_reader.cc
@@ -0,0 +1,30 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "remoting/host/security_key/fake_remote_security_key_message_reader.h"
+
+#include "base/callback.h"
+#include "base/memory/weak_ptr.h"
+#include "remoting/host/security_key/security_key_message.h"
+
+namespace remoting {
+
+FakeRemoteSecurityKeyMessageReader::FakeRemoteSecurityKeyMessageReader()
+    : weak_factory_(this) {}
+
+FakeRemoteSecurityKeyMessageReader::~FakeRemoteSecurityKeyMessageReader() {}
+
+base::WeakPtr<FakeRemoteSecurityKeyMessageReader>
+FakeRemoteSecurityKeyMessageReader::AsWeakPtr() {
+  return weak_factory_.GetWeakPtr();
+}
+
+void FakeRemoteSecurityKeyMessageReader::Start(
+    const SecurityKeyMessageCallback& message_callback,
+    const base::Closure& error_callback) {
+  message_callback_ = message_callback;
+  error_callback_ = error_callback;
+}
+
+}  // namespace remoting
diff --git a/remoting/host/security_key/fake_remote_security_key_message_reader.h b/remoting/host/security_key/fake_remote_security_key_message_reader.h
new file mode 100644
index 0000000..bfe7c68
--- /dev/null
+++ b/remoting/host/security_key/fake_remote_security_key_message_reader.h
@@ -0,0 +1,48 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef REMOTING_HOST_SECURITY_KEY_FAKE_REMOTE_SECURITY_KEY_MESSAGE_READER_H_
+#define REMOTING_HOST_SECURITY_KEY_FAKE_REMOTE_SECURITY_KEY_MESSAGE_READER_H_
+
+#include "base/callback.h"
+#include "base/macros.h"
+#include "base/memory/weak_ptr.h"
+#include "remoting/host/security_key/remote_security_key_message_reader.h"
+#include "remoting/host/security_key/security_key_message.h"
+
+namespace remoting {
+
+// Simulates the RemoteSecurityKeyMessageReader and provides access to data
+// members for testing.
+class FakeRemoteSecurityKeyMessageReader
+    : public RemoteSecurityKeyMessageReader {
+ public:
+  FakeRemoteSecurityKeyMessageReader();
+  ~FakeRemoteSecurityKeyMessageReader() override;
+
+  // RemoteSecurityKeyMessageReader interface.
+  void Start(const SecurityKeyMessageCallback& message_callback,
+             const base::Closure& error_callback) override;
+
+  base::WeakPtr<FakeRemoteSecurityKeyMessageReader> AsWeakPtr();
+
+  const SecurityKeyMessageCallback& message_callback() {
+    return message_callback_;
+  }
+
+  const base::Closure& error_callback() { return error_callback_; }
+
+ private:
+  // Caller-supplied message and error callbacks.
+  SecurityKeyMessageCallback message_callback_;
+  base::Closure error_callback_;
+
+  base::WeakPtrFactory<FakeRemoteSecurityKeyMessageReader> weak_factory_;
+
+  DISALLOW_COPY_AND_ASSIGN(FakeRemoteSecurityKeyMessageReader);
+};
+
+}  // namespace remoting
+
+#endif  // REMOTING_HOST_SECURITY_KEY_FAKE_REMOTE_SECURITY_KEY_MESSAGE_READER_H_
diff --git a/remoting/host/security_key/fake_remote_security_key_message_writer.cc b/remoting/host/security_key/fake_remote_security_key_message_writer.cc
new file mode 100644
index 0000000..c263f69
--- /dev/null
+++ b/remoting/host/security_key/fake_remote_security_key_message_writer.cc
@@ -0,0 +1,53 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "remoting/host/security_key/fake_remote_security_key_message_writer.h"
+
+#include <string>
+#include <utility>
+
+#include "base/callback.h"
+#include "base/location.h"
+#include "base/macros.h"
+#include "base/memory/weak_ptr.h"
+#include "base/thread_task_runner_handle.h"
+#include "remoting/host/security_key/security_key_message.h"
+
+namespace remoting {
+
+FakeRemoteSecurityKeyMessageWriter::FakeRemoteSecurityKeyMessageWriter(
+    const base::Closure& write_callback)
+    : write_callback_(write_callback), weak_factory_(this) {
+  DCHECK(!write_callback_.is_null());
+}
+
+FakeRemoteSecurityKeyMessageWriter::~FakeRemoteSecurityKeyMessageWriter() {}
+
+base::WeakPtr<FakeRemoteSecurityKeyMessageWriter>
+FakeRemoteSecurityKeyMessageWriter::AsWeakPtr() {
+  return weak_factory_.GetWeakPtr();
+}
+
+bool FakeRemoteSecurityKeyMessageWriter::WriteMessage(
+    RemoteSecurityKeyMessageType message_type) {
+  last_message_type_ = message_type;
+  last_message_payload_.clear();
+
+  base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE, write_callback_);
+
+  return write_request_succeeded_;
+}
+
+bool FakeRemoteSecurityKeyMessageWriter::WriteMessageWithPayload(
+    RemoteSecurityKeyMessageType message_type,
+    const std::string& message_payload) {
+  last_message_type_ = message_type;
+  last_message_payload_ = message_payload;
+
+  base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE, write_callback_);
+
+  return write_request_succeeded_;
+}
+
+}  // namespace remoting
diff --git a/remoting/host/security_key/fake_remote_security_key_message_writer.h b/remoting/host/security_key/fake_remote_security_key_message_writer.h
new file mode 100644
index 0000000..4ae6759
--- /dev/null
+++ b/remoting/host/security_key/fake_remote_security_key_message_writer.h
@@ -0,0 +1,65 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef REMOTING_HOST_SECURITY_KEY_FAKE_REMOTE_SECURITY_KEY_MESSAGE_WRITER_H_
+#define REMOTING_HOST_SECURITY_KEY_FAKE_REMOTE_SECURITY_KEY_MESSAGE_WRITER_H_
+
+#include <string>
+
+#include "base/callback.h"
+#include "base/macros.h"
+#include "base/memory/weak_ptr.h"
+#include "remoting/host/security_key/remote_security_key_message_writer.h"
+#include "remoting/host/security_key/security_key_message.h"
+
+namespace remoting {
+
+// Simulates the RemoteSecurityKeyMessageWriter and provides access to data
+// members for testing.
+class FakeRemoteSecurityKeyMessageWriter
+    : public RemoteSecurityKeyMessageWriter {
+ public:
+  explicit FakeRemoteSecurityKeyMessageWriter(
+      const base::Closure& write_callback);
+  ~FakeRemoteSecurityKeyMessageWriter() override;
+
+  // RemoteSecurityKeyMessageWriter interface.
+  bool WriteMessage(RemoteSecurityKeyMessageType message_type) override;
+  bool WriteMessageWithPayload(RemoteSecurityKeyMessageType message_type,
+                               const std::string& message_payload) override;
+
+  base::WeakPtr<FakeRemoteSecurityKeyMessageWriter> AsWeakPtr();
+
+  RemoteSecurityKeyMessageType last_message_type() {
+    return last_message_type_;
+  }
+
+  const std::string& last_message_payload() { return last_message_payload_; }
+
+  void set_write_request_succeeded(bool should_succeed) {
+    write_request_succeeded_ = should_succeed;
+  }
+
+ private:
+  // Tracks the last message_type value written.
+  RemoteSecurityKeyMessageType last_message_type_ =
+      RemoteSecurityKeyMessageType::INVALID;
+
+  // Tracks the last message_payload value written.
+  std::string last_message_payload_;
+
+  // This value is returned by the WriteMessage* functions above.
+  bool write_request_succeeded_ = true;
+
+  // Signaled whenever a write is requested.
+  base::Closure write_callback_;
+
+  base::WeakPtrFactory<FakeRemoteSecurityKeyMessageWriter> weak_factory_;
+
+  DISALLOW_COPY_AND_ASSIGN(FakeRemoteSecurityKeyMessageWriter);
+};
+
+}  // namespace remoting
+
+#endif  // REMOTING_HOST_SECURITY_KEY_FAKE_REMOTE_SECURITY_KEY_MESSAGE_WRITER_H_
diff --git a/remoting/host/security_key/remote_security_key_message_reader.h b/remoting/host/security_key/remote_security_key_message_reader.h
index 08ed9297..035244e 100644
--- a/remoting/host/security_key/remote_security_key_message_reader.h
+++ b/remoting/host/security_key/remote_security_key_message_reader.h
@@ -5,64 +5,26 @@
 #ifndef REMOTING_HOST_SECURITY_KEY_REMOTE_SECURITY_KEY_MESSAGE_READER_H_
 #define REMOTING_HOST_SECURITY_KEY_REMOTE_SECURITY_KEY_MESSAGE_READER_H_
 
-#include "base/callback.h"
-#include "base/files/file.h"
-#include "base/macros.h"
-#include "base/memory/scoped_ptr.h"
-#include "base/memory/weak_ptr.h"
-#include "base/threading/thread.h"
+#include "base/callback_forward.h"
 #include "remoting/host/security_key/security_key_message.h"
 
-namespace base {
-class SingleThreadTaskRunner;
-}  // namespace base
-
 namespace remoting {
 
-// Used for receiving remote security key messages using a file handle.
+// Interface used for listening for remote security key messages and notifying
+// listeners when one is received.
 class RemoteSecurityKeyMessageReader {
  public:
-  explicit RemoteSecurityKeyMessageReader(base::File input_file);
-  ~RemoteSecurityKeyMessageReader();
+  virtual ~RemoteSecurityKeyMessageReader() {}
 
-  // Starts reading messages from the input file provided in the C'Tor.
+  // Starts the process of listening for security key messages.
   // |message_callback| is called for each received message.
   // |error_callback| is called in case of an error or the file is closed.
   // This method is asynchronous, callbacks will be called on the thread this
   // method is called on.  These callbacks can be called up to the point this
   // instance is destroyed and may be destroyed as a result of the callback
   // being invoked.
-  void Start(SecurityKeyMessageCallback message_callback,
-             base::Closure error_callback);
-
- private:
-  // Reads a message from the remote security key process and passes it to
-  // |message_callback_| on the originating thread. Run on |read_task_runner_|.
-  void ReadMessage();
-
-  // Callback run on |read_task_runner_| when an error occurs or EOF is reached.
-  void NotifyError();
-
-  // Used for callbacks on the appropriate task runner to signal status changes.
-  // These callbacks are invoked on |main_task_runner_|.
-  void InvokeMessageCallback(scoped_ptr<SecurityKeyMessage> message);
-  void InvokeErrorCallback();
-
-  base::File read_stream_;
-
-  // Caller-supplied message and error callbacks.
-  SecurityKeyMessageCallback message_callback_;
-  base::Closure error_callback_;
-
-  // Thread used for blocking IO operations.
-  base::Thread reader_thread_;
-  scoped_refptr<base::SingleThreadTaskRunner> main_task_runner_;
-  scoped_refptr<base::SingleThreadTaskRunner> read_task_runner_;
-
-  base::WeakPtr<RemoteSecurityKeyMessageReader> reader_;
-  base::WeakPtrFactory<RemoteSecurityKeyMessageReader> weak_factory_;
-
-  DISALLOW_COPY_AND_ASSIGN(RemoteSecurityKeyMessageReader);
+  virtual void Start(const SecurityKeyMessageCallback& message_callback,
+                     const base::Closure& error_callback) = 0;
 };
 
 }  // namespace remoting
diff --git a/remoting/host/security_key/remote_security_key_message_reader_impl.cc b/remoting/host/security_key/remote_security_key_message_reader_impl.cc
new file mode 100644
index 0000000..0431742
--- /dev/null
+++ b/remoting/host/security_key/remote_security_key_message_reader_impl.cc
@@ -0,0 +1,133 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "remoting/host/security_key/remote_security_key_message_reader_impl.h"
+
+#include <cstdint>
+#include <string>
+#include <utility>
+
+#include "base/bind.h"
+#include "base/files/file.h"
+#include "base/macros.h"
+#include "base/single_thread_task_runner.h"
+#include "base/stl_util.h"
+#include "base/thread_task_runner_handle.h"
+#include "remoting/host/security_key/security_key_message.h"
+
+namespace remoting {
+
+RemoteSecurityKeyMessageReaderImpl::RemoteSecurityKeyMessageReaderImpl(
+    base::File input_file)
+    : read_stream_(std::move(input_file)),
+      reader_thread_("RemoteSecurityKeyMessageReaderImpl"),
+      weak_factory_(this) {
+  base::Thread::Options options;
+  options.message_loop_type = base::MessageLoop::TYPE_IO;
+  reader_thread_.StartWithOptions(options);
+
+  read_task_runner_ = reader_thread_.task_runner();
+  main_task_runner_ = base::ThreadTaskRunnerHandle::Get();
+}
+
+RemoteSecurityKeyMessageReaderImpl::~RemoteSecurityKeyMessageReaderImpl() {
+  DCHECK(main_task_runner_->RunsTasksOnCurrentThread());
+
+  // In order to ensure the reader thread is stopped cleanly, we want to stop
+  // the thread before the task runners and weak pointers are invalidated.
+  reader_thread_.Stop();
+}
+
+void RemoteSecurityKeyMessageReaderImpl::Start(
+    const SecurityKeyMessageCallback& message_callback,
+    const base::Closure& error_callback) {
+  DCHECK(main_task_runner_->RunsTasksOnCurrentThread());
+
+  message_callback_ = message_callback;
+  error_callback_ = error_callback;
+
+  // base::Unretained is safe since this class owns the thread running this task
+  // which will be destroyed before this instance is.
+  read_task_runner_->PostTask(
+      FROM_HERE, base::Bind(&RemoteSecurityKeyMessageReaderImpl::ReadMessage,
+                            base::Unretained(this)));
+}
+
+void RemoteSecurityKeyMessageReaderImpl::ReadMessage() {
+  DCHECK(read_task_runner_->RunsTasksOnCurrentThread());
+
+  while (true) {
+    if (!read_stream_.IsValid()) {
+      LOG(ERROR) << "Cannot read from invalid stream.";
+      NotifyError();
+      return;
+    }
+
+    // Read the message header to retrieve the remaining message length.
+    uint32_t total_message_size_bytes;
+    int read_result = read_stream_.ReadAtCurrentPos(
+        reinterpret_cast<char*>(&total_message_size_bytes),
+        SecurityKeyMessage::kHeaderSizeBytes);
+    if (read_result != SecurityKeyMessage::kHeaderSizeBytes) {
+      // 0 means EOF which is normal and should not be logged as an error.
+      if (read_result != 0) {
+        LOG(ERROR) << "Failed to read message header, read returned "
+                   << read_result;
+      }
+      NotifyError();
+      return;
+    }
+
+    if (!SecurityKeyMessage::IsValidMessageSize(total_message_size_bytes)) {
+      LOG(ERROR) << "Message size too large: " << total_message_size_bytes;
+      NotifyError();
+      return;
+    }
+
+    std::string message_data(total_message_size_bytes, '\0');
+    read_result = read_stream_.ReadAtCurrentPos(string_as_array(&message_data),
+                                                total_message_size_bytes);
+    // The static cast is safe as we know the value is smaller than max int.
+    if (read_result != static_cast<int>(total_message_size_bytes)) {
+      LOG(ERROR) << "Failed to read message: " << read_result;
+      NotifyError();
+      return;
+    }
+
+    scoped_ptr<SecurityKeyMessage> message(new SecurityKeyMessage());
+    if (!message->ParseMessage(message_data)) {
+      LOG(ERROR) << "Invalid message data received.";
+      NotifyError();
+      return;
+    }
+
+    // Notify callback of the new message received.
+    main_task_runner_->PostTask(
+        FROM_HERE,
+        base::Bind(&RemoteSecurityKeyMessageReaderImpl::InvokeMessageCallback,
+                   weak_factory_.GetWeakPtr(), base::Passed(&message)));
+  }
+}
+
+void RemoteSecurityKeyMessageReaderImpl::NotifyError() {
+  DCHECK(read_task_runner_->RunsTasksOnCurrentThread());
+
+  main_task_runner_->PostTask(
+      FROM_HERE,
+      base::Bind(&RemoteSecurityKeyMessageReaderImpl::InvokeErrorCallback,
+                 weak_factory_.GetWeakPtr()));
+}
+
+void RemoteSecurityKeyMessageReaderImpl::InvokeMessageCallback(
+    scoped_ptr<SecurityKeyMessage> message) {
+  DCHECK(main_task_runner_->RunsTasksOnCurrentThread());
+  message_callback_.Run(std::move(message));
+}
+
+void RemoteSecurityKeyMessageReaderImpl::InvokeErrorCallback() {
+  DCHECK(main_task_runner_->RunsTasksOnCurrentThread());
+  error_callback_.Run();
+}
+
+}  // namespace remoting
diff --git a/remoting/host/security_key/remote_security_key_message_reader_impl.h b/remoting/host/security_key/remote_security_key_message_reader_impl.h
new file mode 100644
index 0000000..e1e0747
--- /dev/null
+++ b/remoting/host/security_key/remote_security_key_message_reader_impl.h
@@ -0,0 +1,67 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef REMOTING_HOST_SECURITY_KEY_REMOTE_SECURITY_KEY_MESSAGE_READER_IMPL_H_
+#define REMOTING_HOST_SECURITY_KEY_REMOTE_SECURITY_KEY_MESSAGE_READER_IMPL_H_
+
+#include "base/callback.h"
+#include "base/files/file.h"
+#include "base/macros.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/memory/weak_ptr.h"
+#include "base/threading/thread.h"
+#include "remoting/host/security_key/remote_security_key_message_reader.h"
+#include "remoting/host/security_key/security_key_message.h"
+
+namespace base {
+class SingleThreadTaskRunner;
+}  // namespace base
+
+namespace remoting {
+
+// RemoteSecurityKeyMessageReader implementation that receives messages from
+// a pipe.
+class RemoteSecurityKeyMessageReaderImpl
+    : public RemoteSecurityKeyMessageReader {
+ public:
+  explicit RemoteSecurityKeyMessageReaderImpl(base::File input_file);
+  ~RemoteSecurityKeyMessageReaderImpl() override;
+
+  // RemoteSecurityKeyMessageReader interface.
+  void Start(const SecurityKeyMessageCallback& message_callback,
+             const base::Closure& error_callback) override;
+
+ private:
+  // Reads a message from the remote security key process and passes it to
+  // |message_callback_| on the originating thread. Run on |read_task_runner_|.
+  void ReadMessage();
+
+  // Callback run on |read_task_runner_| when an error occurs or EOF is reached.
+  void NotifyError();
+
+  // Used for callbacks on the appropriate task runner to signal status changes.
+  // These callbacks are invoked on |main_task_runner_|.
+  void InvokeMessageCallback(scoped_ptr<SecurityKeyMessage> message);
+  void InvokeErrorCallback();
+
+  base::File read_stream_;
+
+  // Caller-supplied message and error callbacks.
+  SecurityKeyMessageCallback message_callback_;
+  base::Closure error_callback_;
+
+  // Thread used for blocking IO operations.
+  base::Thread reader_thread_;
+  scoped_refptr<base::SingleThreadTaskRunner> main_task_runner_;
+  scoped_refptr<base::SingleThreadTaskRunner> read_task_runner_;
+
+  base::WeakPtr<RemoteSecurityKeyMessageReaderImpl> reader_;
+  base::WeakPtrFactory<RemoteSecurityKeyMessageReaderImpl> weak_factory_;
+
+  DISALLOW_COPY_AND_ASSIGN(RemoteSecurityKeyMessageReaderImpl);
+};
+
+}  // namespace remoting
+
+#endif  // REMOTING_HOST_SECURITY_KEY_REMOTE_SECURITY_KEY_MESSAGE_READER_IMPL_H_
diff --git a/remoting/host/security_key/remote_security_key_message_reader_unittest.cc b/remoting/host/security_key/remote_security_key_message_reader_impl_unittest.cc
similarity index 63%
rename from remoting/host/security_key/remote_security_key_message_reader_unittest.cc
rename to remoting/host/security_key/remote_security_key_message_reader_impl_unittest.cc
index 0fa82c0e..3664a6ca 100644
--- a/remoting/host/security_key/remote_security_key_message_reader_unittest.cc
+++ b/remoting/host/security_key/remote_security_key_message_reader_impl_unittest.cc
@@ -12,6 +12,7 @@
 #include "base/memory/scoped_ptr.h"
 #include "base/message_loop/message_loop.h"
 #include "base/run_loop.h"
+#include "remoting/host/security_key/remote_security_key_message_reader_impl.h"
 #include "remoting/host/security_key/security_key_message.h"
 #include "remoting/host/setup/test_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -24,21 +25,28 @@
 
 namespace remoting {
 
-class RemoteSecurityKeyMessageReaderTest : public testing::Test {
+class RemoteSecurityKeyMessageReaderImplTest : public testing::Test {
  public:
-  RemoteSecurityKeyMessageReaderTest();
-  ~RemoteSecurityKeyMessageReaderTest() override;
+  RemoteSecurityKeyMessageReaderImplTest();
+  ~RemoteSecurityKeyMessageReaderImplTest() override;
 
   // SecurityKeyMessageCallback passed to the Reader. Stores |message| so it can
   // be verified by tests.
   void OnMessage(scoped_ptr<SecurityKeyMessage> message);
 
+  // Used as a callback to signal completion.
+  void OperationComplete();
+
  protected:
   // testing::Test interface.
   void SetUp() override;
 
   // Runs the MessageLoop until the reader has completed and called back.
-  void Run();
+  void RunLoop();
+
+  // Closes |write_file_| and runs the MessageLoop until the reader has
+  // completed and called back.
+  void CloseWriteFileAndRunLoop();
 
   // Writes a message (header+code+body) to the write-end of the pipe.
   void WriteMessage(RemoteSecurityKeyMessageType message_type,
@@ -55,38 +63,52 @@
 
  private:
   base::MessageLoopForIO message_loop_;
-  base::RunLoop run_loop_;
+  scoped_ptr<base::RunLoop> run_loop_;
 
-  DISALLOW_COPY_AND_ASSIGN(RemoteSecurityKeyMessageReaderTest);
+  DISALLOW_COPY_AND_ASSIGN(RemoteSecurityKeyMessageReaderImplTest);
 };
 
-RemoteSecurityKeyMessageReaderTest::RemoteSecurityKeyMessageReaderTest() {}
+RemoteSecurityKeyMessageReaderImplTest::RemoteSecurityKeyMessageReaderImplTest()
+    : run_loop_(new base::RunLoop()) {}
 
-RemoteSecurityKeyMessageReaderTest::~RemoteSecurityKeyMessageReaderTest() {}
+RemoteSecurityKeyMessageReaderImplTest::
+    ~RemoteSecurityKeyMessageReaderImplTest() {}
 
-void RemoteSecurityKeyMessageReaderTest::SetUp() {
+void RemoteSecurityKeyMessageReaderImplTest::SetUp() {
   ASSERT_TRUE(MakePipe(&read_file_, &write_file_));
-  reader_.reset(new RemoteSecurityKeyMessageReader(std::move(read_file_)));
+  reader_.reset(new RemoteSecurityKeyMessageReaderImpl(std::move(read_file_)));
 
   // base::Unretained is safe since no further tasks can run after
   // RunLoop::Run() returns.
-  reader_->Start(base::Bind(&RemoteSecurityKeyMessageReaderTest::OnMessage,
-                            base::Unretained(this)),
-                 run_loop_.QuitClosure());
+  reader_->Start(
+      base::Bind(&RemoteSecurityKeyMessageReaderImplTest::OnMessage,
+                 base::Unretained(this)),
+      base::Bind(&RemoteSecurityKeyMessageReaderImplTest::OperationComplete,
+                 base::Unretained(this)));
 }
 
-void RemoteSecurityKeyMessageReaderTest::Run() {
-  // Close the write-end, so the reader doesn't block waiting for more data.
+void RemoteSecurityKeyMessageReaderImplTest::RunLoop() {
+  run_loop_->Run();
+  run_loop_.reset(new base::RunLoop());
+}
+
+void RemoteSecurityKeyMessageReaderImplTest::CloseWriteFileAndRunLoop() {
   write_file_.Close();
-  run_loop_.Run();
+  run_loop_->Run();
+  run_loop_.reset(new base::RunLoop());
 }
 
-void RemoteSecurityKeyMessageReaderTest::OnMessage(
+void RemoteSecurityKeyMessageReaderImplTest::OnMessage(
     scoped_ptr<SecurityKeyMessage> message) {
   messages_received_.push_back(std::move(message));
+  OperationComplete();
 }
 
-void RemoteSecurityKeyMessageReaderTest::WriteMessage(
+void RemoteSecurityKeyMessageReaderImplTest::OperationComplete() {
+  run_loop_->Quit();
+}
+
+void RemoteSecurityKeyMessageReaderImplTest::WriteMessage(
     RemoteSecurityKeyMessageType message_type,
     const std::string& message_payload) {
   uint32_t length =
@@ -100,93 +122,91 @@
   }
 }
 
-void RemoteSecurityKeyMessageReaderTest::WriteData(const char* data,
-                                                   int length) {
+void RemoteSecurityKeyMessageReaderImplTest::WriteData(const char* data,
+                                                       int length) {
   int written = write_file_.WriteAtCurrentPos(data, length);
   ASSERT_EQ(length, written);
 }
 
-TEST_F(RemoteSecurityKeyMessageReaderTest, EnsureReaderTornDownCleanly) {
-  // This test is different from the others as the files used for reading and
-  // writing are still open when the reader instance is destroyed.  This test is
-  // meant to ensure that no asserts/exceptions/hangs occur during shutdown.
+TEST_F(RemoteSecurityKeyMessageReaderImplTest, SingleMessageWithNoPayload) {
   WriteMessage(kTestMessageType, std::string());
-  reader_.reset();
-}
-
-TEST_F(RemoteSecurityKeyMessageReaderTest, SingleMessageWithNoPayload) {
-  WriteMessage(kTestMessageType, std::string());
-  Run();
+  RunLoop();
   ASSERT_EQ(1u, messages_received_.size());
   ASSERT_EQ(kTestMessageType, messages_received_[0]->type());
   ASSERT_EQ("", messages_received_[0]->payload());
+
+  CloseWriteFileAndRunLoop();
 }
 
-TEST_F(RemoteSecurityKeyMessageReaderTest, SingleMessageWithPayload) {
+TEST_F(RemoteSecurityKeyMessageReaderImplTest, SingleMessageWithPayload) {
   std::string payload("I AM A VALID MESSAGE PAYLOAD!!!!!!!!!!!!!!!!!!!!!!");
   WriteMessage(kTestMessageType, payload);
-  Run();
+  RunLoop();
   ASSERT_EQ(1u, messages_received_.size());
   ASSERT_EQ(kTestMessageType, messages_received_[0]->type());
   ASSERT_EQ(payload, messages_received_[0]->payload());
+
+  CloseWriteFileAndRunLoop();
 }
 
-TEST_F(RemoteSecurityKeyMessageReaderTest, SingleMessageWithLargePayload) {
+TEST_F(RemoteSecurityKeyMessageReaderImplTest, SingleMessageWithLargePayload) {
   std::string payload(kMaxSecurityKeyMessageByteCount -
                           SecurityKeyMessage::kMessageTypeSizeBytes,
                       'Y');
   WriteMessage(kTestMessageType, payload);
-  Run();
+  RunLoop();
   ASSERT_EQ(1u, messages_received_.size());
   ASSERT_EQ(kTestMessageType, messages_received_[0]->type());
   ASSERT_EQ(payload, messages_received_[0]->payload());
+
+  CloseWriteFileAndRunLoop();
 }
 
-TEST_F(RemoteSecurityKeyMessageReaderTest, EmptyFile) {
-  Run();
+TEST_F(RemoteSecurityKeyMessageReaderImplTest, EmptyFile) {
+  CloseWriteFileAndRunLoop();
   ASSERT_EQ(0u, messages_received_.size());
 }
 
-TEST_F(RemoteSecurityKeyMessageReaderTest, InvalidMessageLength) {
+TEST_F(RemoteSecurityKeyMessageReaderImplTest, InvalidMessageLength) {
   uint32_t length = kMaxSecurityKeyMessageByteCount + 1;
   ASSERT_FALSE(SecurityKeyMessage::IsValidMessageSize(length));
   WriteData(reinterpret_cast<char*>(&length), sizeof(length));
-  Run();
+  CloseWriteFileAndRunLoop();
   ASSERT_EQ(0u, messages_received_.size());
 }
 
-TEST_F(RemoteSecurityKeyMessageReaderTest, ShortHeader) {
+TEST_F(RemoteSecurityKeyMessageReaderImplTest, ShortHeader) {
   // Write only 3 bytes - the message length header is supposed to be 4 bytes.
   WriteData("xxx", SecurityKeyMessage::kHeaderSizeBytes - 1);
-  Run();
+  CloseWriteFileAndRunLoop();
   ASSERT_EQ(0u, messages_received_.size());
 }
 
-TEST_F(RemoteSecurityKeyMessageReaderTest, ZeroLengthMessage) {
+TEST_F(RemoteSecurityKeyMessageReaderImplTest, ZeroLengthMessage) {
   uint32_t length = 0;
   WriteData(reinterpret_cast<char*>(&length), sizeof(length));
-  Run();
+  CloseWriteFileAndRunLoop();
   ASSERT_EQ(0u, messages_received_.size());
 }
 
-TEST_F(RemoteSecurityKeyMessageReaderTest, MissingControlCode) {
+TEST_F(RemoteSecurityKeyMessageReaderImplTest, MissingControlCode) {
   uint32_t length = 1;
   WriteData(reinterpret_cast<char*>(&length), sizeof(length));
-  Run();
+  CloseWriteFileAndRunLoop();
   ASSERT_EQ(0u, messages_received_.size());
 }
 
-TEST_F(RemoteSecurityKeyMessageReaderTest, MissingPayload) {
+TEST_F(RemoteSecurityKeyMessageReaderImplTest, MissingPayload) {
   uint32_t length = 2;
   WriteData(reinterpret_cast<char*>(&length), sizeof(length));
 
   char test_control_code = static_cast<char>(kTestMessageType);
   WriteData(&test_control_code, sizeof(test_control_code));
-  Run();
+  CloseWriteFileAndRunLoop();
   ASSERT_EQ(0u, messages_received_.size());
 }
 
-TEST_F(RemoteSecurityKeyMessageReaderTest, MultipleMessages) {
+TEST_F(RemoteSecurityKeyMessageReaderImplTest, MultipleMessages) {
   std::vector<std::string> payloads({"", "S",  // Really short
                                      "", "Short", "", "Medium Length", "",
                                      "Longer than medium, but not super long",
@@ -194,10 +214,11 @@
 
   for (auto& payload : payloads) {
     WriteMessage(kTestMessageType, payload);
+    RunLoop();
   }
 
-  Run();
   ASSERT_EQ(payloads.size(), messages_received_.size());
+  CloseWriteFileAndRunLoop();
 
   for (size_t i = 0; i < payloads.size(); i++) {
     ASSERT_EQ(kTestMessageType, messages_received_[i]->type());
diff --git a/remoting/host/security_key/remote_security_key_message_writer.h b/remoting/host/security_key/remote_security_key_message_writer.h
index 1566e79..d18e34d 100644
--- a/remoting/host/security_key/remote_security_key_message_writer.h
+++ b/remoting/host/security_key/remote_security_key_message_writer.h
@@ -7,7 +7,6 @@
 
 #include <string>
 
-#include "base/files/file.h"
 #include "base/macros.h"
 #include "remoting/host/security_key/security_key_message.h"
 
@@ -16,24 +15,15 @@
 // Used for sending remote security key messages using a file handle.
 class RemoteSecurityKeyMessageWriter {
  public:
-  explicit RemoteSecurityKeyMessageWriter(base::File output_file);
-  ~RemoteSecurityKeyMessageWriter();
+  virtual ~RemoteSecurityKeyMessageWriter() {}
 
   // Writes a remote security key message w/o a payload to |output_stream_|.
-  bool WriteMessage(RemoteSecurityKeyMessageType message_type);
+  virtual bool WriteMessage(RemoteSecurityKeyMessageType message_type) = 0;
 
   // Writes a remote security key message with a payload to |output_stream_|.
-  bool WriteMessageWithPayload(RemoteSecurityKeyMessageType message_type,
-                               const std::string& message_payload);
-
- private:
-  // Writes |bytes_to_write| bytes from |message| to |output_stream_|.
-  bool WriteBytesToOutput(const char* message, int bytes_to_write);
-
-  base::File output_stream_;
-  bool write_failed_ = false;
-
-  DISALLOW_COPY_AND_ASSIGN(RemoteSecurityKeyMessageWriter);
+  virtual bool WriteMessageWithPayload(
+      RemoteSecurityKeyMessageType message_type,
+      const std::string& message_payload) = 0;
 };
 
 }  // namespace remoting
diff --git a/remoting/host/security_key/remote_security_key_message_writer_impl.cc b/remoting/host/security_key/remote_security_key_message_writer_impl.cc
new file mode 100644
index 0000000..4a434dfb
--- /dev/null
+++ b/remoting/host/security_key/remote_security_key_message_writer_impl.cc
@@ -0,0 +1,83 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "remoting/host/security_key/remote_security_key_message_writer_impl.h"
+
+#include <cstdint>
+#include <string>
+#include <utility>
+
+#include "remoting/host/security_key/security_key_message.h"
+
+namespace remoting {
+
+RemoteSecurityKeyMessageWriterImpl::RemoteSecurityKeyMessageWriterImpl(
+    base::File output_file)
+    : output_stream_(std::move(output_file)) {}
+
+RemoteSecurityKeyMessageWriterImpl::~RemoteSecurityKeyMessageWriterImpl() {}
+
+bool RemoteSecurityKeyMessageWriterImpl::WriteMessage(
+    RemoteSecurityKeyMessageType message_type) {
+  return WriteMessageWithPayload(message_type, std::string());
+}
+
+bool RemoteSecurityKeyMessageWriterImpl::WriteMessageWithPayload(
+    RemoteSecurityKeyMessageType message_type,
+    const std::string& message_payload) {
+  if (write_failed_ || !output_stream_.IsValid()) {
+    return false;
+  }
+
+  int message_payload_size_bytes = message_payload.size();
+  uint32_t total_message_size_bytes =
+      SecurityKeyMessage::kMessageTypeSizeBytes + message_payload_size_bytes;
+  CHECK(SecurityKeyMessage::IsValidMessageSize(total_message_size_bytes));
+
+  // First we send the message header which is the length of the message_type
+  // and message_payload in bytes.
+  if (!WriteBytesToOutput(reinterpret_cast<char*>(&total_message_size_bytes),
+                          SecurityKeyMessage::kHeaderSizeBytes)) {
+    LOG(ERROR) << "Failed to send message header.";
+    return false;
+  }
+
+  // Next we send the message_type.
+  if (!WriteBytesToOutput(reinterpret_cast<char*>(&message_type),
+                          SecurityKeyMessage::kMessageTypeSizeBytes)) {
+    LOG(ERROR) << "Failed to send message type.";
+    return false;
+  }
+
+  // Lastly, send the message data if appropriate.
+  if (!message_payload.empty()) {
+    if (!WriteBytesToOutput(message_payload.data(),
+                            message_payload_size_bytes)) {
+      LOG(ERROR) << "Failed to send message payload.";
+      return false;
+    }
+  }
+
+  return true;
+}
+
+bool RemoteSecurityKeyMessageWriterImpl::WriteBytesToOutput(
+    const char* message,
+    int bytes_to_write) {
+  DCHECK(message);
+  DCHECK_GT(bytes_to_write, 0);
+
+  int result = output_stream_.WriteAtCurrentPos(message, bytes_to_write);
+  if (result != bytes_to_write) {
+    LOG(ERROR) << "Failed to write all bytes to output stream.  bytes written: "
+               << result << ", file error: "
+               << base::File::ErrorToString(output_stream_.error_details());
+    write_failed_ = true;
+    return false;
+  }
+
+  return true;
+}
+
+}  // namespace remoting
diff --git a/remoting/host/security_key/remote_security_key_message_writer_impl.h b/remoting/host/security_key/remote_security_key_message_writer_impl.h
new file mode 100644
index 0000000..13d99e4
--- /dev/null
+++ b/remoting/host/security_key/remote_security_key_message_writer_impl.h
@@ -0,0 +1,41 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef REMOTING_HOST_SECURITY_KEY_REMOTE_SECURITY_KEY_MESSAGE_WRITER_IMPL_H_
+#define REMOTING_HOST_SECURITY_KEY_REMOTE_SECURITY_KEY_MESSAGE_WRITER_IMPL_H_
+
+#include <string>
+
+#include "base/files/file.h"
+#include "base/macros.h"
+#include "remoting/host/security_key/remote_security_key_message_writer.h"
+#include "remoting/host/security_key/security_key_message.h"
+
+namespace remoting {
+
+// Used for sending remote security key messages using a file handle.
+class RemoteSecurityKeyMessageWriterImpl
+    : public RemoteSecurityKeyMessageWriter {
+ public:
+  explicit RemoteSecurityKeyMessageWriterImpl(base::File output_file);
+  ~RemoteSecurityKeyMessageWriterImpl() override;
+
+ private:
+  // RemoteSecurityKeyMessageWriter interface.
+  bool WriteMessage(RemoteSecurityKeyMessageType message_type) override;
+  bool WriteMessageWithPayload(RemoteSecurityKeyMessageType message_type,
+                               const std::string& message_payload) override;
+
+  // Writes |bytes_to_write| bytes from |message| to |output_stream_|.
+  bool WriteBytesToOutput(const char* message, int bytes_to_write);
+
+  base::File output_stream_;
+  bool write_failed_ = false;
+
+  DISALLOW_COPY_AND_ASSIGN(RemoteSecurityKeyMessageWriterImpl);
+};
+
+}  // namespace remoting
+
+#endif  // REMOTING_HOST_SECURITY_KEY_REMOTE_SECURITY_KEY_MESSAGE_WRITER_IMPL_H_
diff --git a/remoting/host/security_key/remote_security_key_message_writer_unittest.cc b/remoting/host/security_key/remote_security_key_message_writer_impl_unittest.cc
similarity index 80%
rename from remoting/host/security_key/remote_security_key_message_writer_unittest.cc
rename to remoting/host/security_key/remote_security_key_message_writer_impl_unittest.cc
index c8b7d17b..4aeb0b8 100644
--- a/remoting/host/security_key/remote_security_key_message_writer_unittest.cc
+++ b/remoting/host/security_key/remote_security_key_message_writer_impl_unittest.cc
@@ -15,6 +15,7 @@
 #include "base/task_runner_util.h"
 #include "base/threading/thread.h"
 #include "base/time/time.h"
+#include "remoting/host/security_key/remote_security_key_message_writer_impl.h"
 #include "remoting/host/security_key/security_key_message.h"
 #include "remoting/host/setup/test_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -27,10 +28,10 @@
 
 namespace remoting {
 
-class RemoteSecurityKeyMessageWriterTest : public testing::Test {
+class RemoteSecurityKeyMessageWriterImplTest : public testing::Test {
  public:
-  RemoteSecurityKeyMessageWriterTest();
-  ~RemoteSecurityKeyMessageWriterTest() override;
+  RemoteSecurityKeyMessageWriterImplTest();
+  ~RemoteSecurityKeyMessageWriterImplTest() override;
 
   // Run on a separate thread, this method reads the message written to the
   // output stream and returns the result.
@@ -56,14 +57,16 @@
   std::string message_result_;
 
  private:
-  DISALLOW_COPY_AND_ASSIGN(RemoteSecurityKeyMessageWriterTest);
+  DISALLOW_COPY_AND_ASSIGN(RemoteSecurityKeyMessageWriterImplTest);
 };
 
-RemoteSecurityKeyMessageWriterTest::RemoteSecurityKeyMessageWriterTest() {}
+RemoteSecurityKeyMessageWriterImplTest::
+    RemoteSecurityKeyMessageWriterImplTest() {}
 
-RemoteSecurityKeyMessageWriterTest::~RemoteSecurityKeyMessageWriterTest() {}
+RemoteSecurityKeyMessageWriterImplTest::
+    ~RemoteSecurityKeyMessageWriterImplTest() {}
 
-std::string RemoteSecurityKeyMessageWriterTest::ReadMessage(
+std::string RemoteSecurityKeyMessageWriterImplTest::ReadMessage(
     int payload_length_bytes) {
   std::string message_header(SecurityKeyMessage::kHeaderSizeBytes, '\0');
   read_file_.ReadAtCurrentPos(string_as_array(&message_header),
@@ -82,19 +85,19 @@
   return message_header + message_type + message_data;
 }
 
-void RemoteSecurityKeyMessageWriterTest::OnReadComplete(
+void RemoteSecurityKeyMessageWriterImplTest::OnReadComplete(
     const base::Closure& done_callback,
     const std::string& result) {
   message_result_ = result;
   done_callback.Run();
 }
 
-void RemoteSecurityKeyMessageWriterTest::SetUp() {
+void RemoteSecurityKeyMessageWriterImplTest::SetUp() {
   ASSERT_TRUE(MakePipe(&read_file_, &write_file_));
-  writer_.reset(new RemoteSecurityKeyMessageWriter(std::move(write_file_)));
+  writer_.reset(new RemoteSecurityKeyMessageWriterImpl(std::move(write_file_)));
 }
 
-void RemoteSecurityKeyMessageWriterTest::WriteMessageToOutput(
+void RemoteSecurityKeyMessageWriterImplTest::WriteMessageToOutput(
     const std::string& payload) {
   // Thread used for blocking IO operations.
   base::Thread reader_thread("ReaderThread");
@@ -109,9 +112,9 @@
 
   ASSERT_TRUE(base::PostTaskAndReplyWithResult(
       reader_thread.task_runner().get(), FROM_HERE,
-      base::Bind(&RemoteSecurityKeyMessageWriterTest::ReadMessage,
+      base::Bind(&RemoteSecurityKeyMessageWriterImplTest::ReadMessage,
                  base::Unretained(this), payload.size()),
-      base::Bind(&RemoteSecurityKeyMessageWriterTest::OnReadComplete,
+      base::Bind(&RemoteSecurityKeyMessageWriterImplTest::OnReadComplete,
                  base::Unretained(this), run_loop.QuitClosure())));
 
   if (payload.size()) {
@@ -141,20 +144,20 @@
   ASSERT_LE(read_file_.ReadAtCurrentPos(&unused, 1), 0);
 }
 
-TEST_F(RemoteSecurityKeyMessageWriterTest, WriteMessageWithoutPayload) {
+TEST_F(RemoteSecurityKeyMessageWriterImplTest, WriteMessageWithoutPayload) {
   std::string empty_payload;
   WriteMessageToOutput(empty_payload);
 }
 
-TEST_F(RemoteSecurityKeyMessageWriterTest, WriteMessageWithPayload) {
+TEST_F(RemoteSecurityKeyMessageWriterImplTest, WriteMessageWithPayload) {
   WriteMessageToOutput("Super-test-payload!");
 }
 
-TEST_F(RemoteSecurityKeyMessageWriterTest, WriteMessageWithLargePayload) {
+TEST_F(RemoteSecurityKeyMessageWriterImplTest, WriteMessageWithLargePayload) {
   WriteMessageToOutput(std::string(kLargeMessageSizeBytes, 'Y'));
 }
 
-TEST_F(RemoteSecurityKeyMessageWriterTest, WriteMultipleMessages) {
+TEST_F(RemoteSecurityKeyMessageWriterImplTest, WriteMultipleMessages) {
   int total_messages_to_write = 10;
   for (int i = 0; i < total_messages_to_write; i++) {
     if (i % 2 == 0) {
@@ -192,7 +195,7 @@
   ASSERT_LE(read_file_.ReadAtCurrentPos(&unused, 1), 0);
 }
 
-TEST_F(RemoteSecurityKeyMessageWriterTest, EnsureWriteFailsWhenPipeClosed) {
+TEST_F(RemoteSecurityKeyMessageWriterImplTest, EnsureWriteFailsWhenPipeClosed) {
   // Close the read end so that writing fails immediately.
   read_file_.Close();
 
diff --git a/remoting/remoting_host_srcs.gypi b/remoting/remoting_host_srcs.gypi
index afe2213..4f47585c 100644
--- a/remoting/remoting_host_srcs.gypi
+++ b/remoting/remoting_host_srcs.gypi
@@ -225,10 +225,12 @@
       'host/security_key/remote_security_key_ipc_server.h',
       'host/security_key/remote_security_key_ipc_server_impl.cc',
       'host/security_key/remote_security_key_ipc_server_impl.h',
-      'host/security_key/remote_security_key_message_reader.cc',
       'host/security_key/remote_security_key_message_reader.h',
-      'host/security_key/remote_security_key_message_writer.cc',
+      'host/security_key/remote_security_key_message_reader_impl.cc',
+      'host/security_key/remote_security_key_message_reader_impl.h',
       'host/security_key/remote_security_key_message_writer.h',
+      'host/security_key/remote_security_key_message_writer_impl.cc',
+      'host/security_key/remote_security_key_message_writer_impl.h',
       'host/security_key/security_key_message.cc',
       'host/security_key/security_key_message.h',
       'host/server_log_entry_host.cc',
diff --git a/remoting/remoting_test.gypi b/remoting/remoting_test.gypi
index 945d6e8..8109619 100644
--- a/remoting/remoting_test.gypi
+++ b/remoting/remoting_test.gypi
@@ -37,6 +37,10 @@
         'host/security_key/fake_remote_security_key_ipc_client.h',
         'host/security_key/fake_remote_security_key_ipc_server.cc',
         'host/security_key/fake_remote_security_key_ipc_server.h',
+        'host/security_key/fake_remote_security_key_message_reader.cc',
+        'host/security_key/fake_remote_security_key_message_reader.h',
+        'host/security_key/fake_remote_security_key_message_writer.cc',
+        'host/security_key/fake_remote_security_key_message_writer.h',
         'protocol/fake_authenticator.cc',
         'protocol/fake_authenticator.h',
         'protocol/fake_connection_to_client.cc',
@@ -300,8 +304,8 @@
         'host/security_key/gnubby_extension_session_unittest.cc',
         'host/security_key/remote_security_key_ipc_client_unittest.cc',
         'host/security_key/remote_security_key_ipc_server_unittest.cc',
-        'host/security_key/remote_security_key_message_reader_unittest.cc',
-        'host/security_key/remote_security_key_message_writer_unittest.cc',
+        'host/security_key/remote_security_key_message_reader_impl_unittest.cc',
+        'host/security_key/remote_security_key_message_writer_impl_unittest.cc',
         'host/server_log_entry_host_unittest.cc',
         'host/setup/me2me_native_messaging_host.cc',
         'host/setup/me2me_native_messaging_host.h',
diff --git a/sandbox/linux/BUILD.gn b/sandbox/linux/BUILD.gn
index e08f42b..4b5d1265 100644
--- a/sandbox/linux/BUILD.gn
+++ b/sandbox/linux/BUILD.gn
@@ -192,33 +192,14 @@
       rebase_path(outputs, root_build_dir) + rebase_path(inputs, root_build_dir)
 }
 
-# TODO(GYP): Delete these after we've converted everything to GN.
-# The _run targets exist only for compatibility w/ GYP.
-group("sandbox_linux_unittests_run") {
-  testonly = true
-  deps = [
-    ":sandbox_linux_unittests",
-  ]
-}
-
-if (is_android) {
-  group("sandbox_linux_unittests_apk_run") {
-    testonly = true
-    deps = [
-      ":sandbox_linux_unittests",
-    ]
-  }
-}
-
-# The main sandboxing test target. "sandbox_linux_unittests" cannot use the
-# test() template because the test is run as an executable not as an APK on
-# Android.
-executable("sandbox_linux_unittests") {
-  testonly = true
+test("sandbox_linux_unittests") {
   deps = [
     ":sandbox_linux_unittests_sources",
     "//build/config/sanitizers:deps",
   ]
+  if (is_android) {
+    use_raw_android_executable = true
+  }
 }
 
 component("seccomp_bpf") {
@@ -454,23 +435,11 @@
 }
 
 if (is_android) {
-  create_native_executable_dist("sandbox_linux_unittests_deps") {
+  # TODO(GYP) Delete this after we've converted everything to GN.
+  group("sandbox_linux_unittests_deps") {
     testonly = true
-    dist_dir = "$root_out_dir/sandbox_linux_unittests_deps"
-    binary = "$root_out_dir/sandbox_linux_unittests"
     deps = [
       ":sandbox_linux_unittests",
     ]
-
-    if (is_component_build) {
-      deps += [ "//build/android:cpplib_stripped" ]
-    }
-  }
-
-  test_runner_script("sandbox_linux_unittests__test_runner_script") {
-    test_name = "sandbox_linux_unittests"
-    test_type = "gtest"
-    test_suite = "sandbox_linux_unittests"
-    isolate_file = "//sandbox/sandbox_linux_unittests_android.isolate"
   }
 }
diff --git a/sandbox/linux/sandbox_linux.gypi b/sandbox/linux/sandbox_linux.gypi
index 9576802..c19bdb1c 100644
--- a/sandbox/linux/sandbox_linux.gypi
+++ b/sandbox/linux/sandbox_linux.gypi
@@ -376,29 +376,15 @@
     [ 'OS=="android"', {
       'targets': [
       {
-        'target_name': 'sandbox_linux_unittests_stripped',
-        'type': 'none',
-        'dependencies': [ 'sandbox_linux_unittests' ],
-        'actions': [{
-          'action_name': 'strip sandbox_linux_unittests',
-          'inputs': [ '<(PRODUCT_DIR)/sandbox_linux_unittests' ],
-          'outputs': [ '<(PRODUCT_DIR)/sandbox_linux_unittests_stripped' ],
-          'action': [ '<(android_strip)', '<@(_inputs)', '-o', '<@(_outputs)' ],
-        }],
-      },
-      {
         'target_name': 'sandbox_linux_unittests_deps',
         'type': 'none',
         'dependencies': [
-          'sandbox_linux_unittests_stripped',
+          'sandbox_linux_unittests',
         ],
-        # For the component build, ensure dependent shared libraries are
-        # stripped and put alongside sandbox_linux_unittests to simplify pushing
-        # to the device.
         'variables': {
-           'output_dir': '<(PRODUCT_DIR)/sandbox_linux_unittests_deps/',
-           'native_binary': '<(PRODUCT_DIR)/sandbox_linux_unittests_stripped',
-           'include_main_binary': 0,
+           'output_dir': '<(PRODUCT_DIR)/sandbox_linux_unittests__dist/',
+           'native_binary': '<(PRODUCT_DIR)/sandbox_linux_unittests',
+           'include_main_binary': 1,
         },
         'includes': [
           '../../build/android/native_app_dependencies.gypi'
diff --git a/testing/test.gni b/testing/test.gni
index b438780..13c4342 100644
--- a/testing/test.gni
+++ b/testing/test.gni
@@ -8,76 +8,15 @@
 
 # Define a test as an executable (or apk on Android) with the "testonly" flag
 # set.
+# Variable:
+#   use_raw_android_executable: Use executable() rather than android_apk().
 template("test") {
   if (is_android) {
     import("//build/config/android/config.gni")
     import("//build/config/android/rules.gni")
 
-    _library_target = "_${target_name}__library"
-    _apk_target = "${target_name}_apk"
-
-    shared_library(_library_target) {
-      # Configs will always be defined since we set_defaults for a component
-      # in the main config. We want to use those rather than whatever came with
-      # the nested shared/static library inside the component.
-      configs = []  # Prevent list overwriting warning.
-      configs = invoker.configs
-
-      testonly = true
-
-      # Don't use "*" to forward all variables since some (like output_name
-      # and isolate_file) apply only to the APK below.
-      deps = []
-      forward_variables_from(invoker,
-                             [
-                               "all_dependent_configs",
-                               "allow_circular_includes_from",
-                               "cflags",
-                               "cflags_c",
-                               "cflags_cc",
-                               "check_includes",
-                               "data",
-                               "data_deps",
-                               "datadeps",
-                               "defines",
-                               "deps",
-                               "include_dirs",
-                               "ldflags",
-                               "lib_dirs",
-                               "libs",
-                               "output_extension",
-                               "output_name",
-                               "public",
-                               "public_configs",
-                               "public_deps",
-                               "sources",
-                               "visibility",
-                             ])
-
-      if (!defined(invoker.use_default_launcher) ||
-          invoker.use_default_launcher) {
-        deps += [ "//testing/android/native_test:native_test_native_code" ]
-      }
-    }
-
-    unittest_apk(_apk_target) {
-      forward_variables_from(invoker,
-                             [
-                               "android_manifest",
-                               "deps",
-                               "enable_multidex",
-                               "use_default_launcher",
-                               "write_asset_list",
-                             ])
-      unittests_dep = ":$_library_target"
-      apk_name = invoker.target_name
-      if (defined(invoker.output_name)) {
-        apk_name = invoker.output_name
-        unittests_binary = "lib${apk_name}.so"
-        install_script_name = "install_${invoker.output_name}"
-      }
-      deps += [ ":$_library_target" ]
-    }
+    _use_raw_android_executable = defined(invoker.use_raw_android_executable) &&
+                                  invoker.use_raw_android_executable
 
     # output_name is used to allow targets with the same name but in different
     # packages to still produce unique runner scripts.
@@ -85,46 +24,131 @@
     if (defined(invoker.output_name)) {
       _output_name = invoker.output_name
     }
+
+    if (_use_raw_android_executable) {
+      _exec_target = "${target_name}__exec"
+      _dist_target = "${target_name}__dist"
+      _exec_output =
+          "$target_out_dir/${invoker.target_name}/${invoker.target_name}"
+
+      executable(_exec_target) {
+        # Configs will always be defined since we set_defaults in BUILDCONFIG.gn.
+        configs = []
+        data_deps = []
+        forward_variables_from(invoker, "*", [ "extra_dist_files" ])
+        testonly = true
+
+        # Thanks to the set_defaults() for test(), configs are initialized with
+        # the default shared_library configs rather than executable configs.
+        configs -= [
+          "//build/config:shared_library_config",
+          "//build/config/android:hide_native_jni_exports",
+        ]
+        configs += [ "//build/config:executable_config" ]
+
+        # Don't output to the root or else conflict with the group() below.
+        output_name = rebase_path(_exec_output, root_out_dir)
+        if (is_component_build || is_asan) {
+          data_deps += [ "//build/android:cpplib_stripped" ]
+        }
+      }
+
+      create_native_executable_dist(_dist_target) {
+        testonly = true
+        dist_dir = "$root_out_dir/$target_name"
+        binary = _exec_output
+        deps = [
+          ":$_exec_target",
+        ]
+        if (defined(invoker.extra_dist_files)) {
+          extra_files = invoker.extra_dist_files
+        }
+      }
+    } else {
+      _library_target = "_${target_name}__library"
+      _apk_target = "${target_name}_apk"
+      _apk_specific_vars = [
+        "android_manifest",
+        "enable_multidex",
+        "use_default_launcher",
+        "write_asset_list",
+      ]
+      shared_library(_library_target) {
+        # Configs will always be defined since we set_defaults in BUILDCONFIG.gn.
+        configs = []  # Prevent list overwriting warning.
+        configs = invoker.configs
+        testonly = true
+
+        deps = []
+        forward_variables_from(invoker,
+                               "*",
+                               _apk_specific_vars + [
+                                     "isolate_file",
+                                     "visibility",
+                                   ])
+
+        if (!defined(invoker.use_default_launcher) ||
+            invoker.use_default_launcher) {
+          deps += [ "//testing/android/native_test:native_test_native_code" ]
+        }
+      }
+      unittest_apk(_apk_target) {
+        forward_variables_from(invoker, _apk_specific_vars + [ "deps" ])
+        unittests_dep = ":$_library_target"
+        apk_name = invoker.target_name
+        if (defined(invoker.output_name)) {
+          apk_name = invoker.output_name
+          unittests_binary = "lib${apk_name}.so"
+          install_script_name = "install_${invoker.output_name}"
+        }
+        deps += [ ":$_library_target" ]
+      }
+
+      # Incremental test targets work only for .apks.
+      _incremental_test_runner_target =
+          "${_output_name}_incremental__test_runner_script"
+      test_runner_script(_incremental_test_runner_target) {
+        forward_variables_from(invoker, [ "isolate_file" ])
+        apk_target = ":$_apk_target"
+        test_name = "${_output_name}_incremental"
+        test_type = "gtest"
+        test_suite = _output_name
+        incremental_install = true
+      }
+      group("${target_name}_incremental") {
+        testonly = true
+        datadeps = [
+          ":$_incremental_test_runner_target",
+        ]
+        deps = [
+          ":${_apk_target}_incremental",
+        ]
+      }
+    }
+
     _test_runner_target = "${_output_name}__test_runner_script"
     test_runner_script(_test_runner_target) {
-      apk_target = ":$_apk_target"
+      forward_variables_from(invoker, [ "isolate_file" ])
+      if (_use_raw_android_executable) {
+        executable_dist_dir = "$root_out_dir/$_dist_target"
+      } else {
+        apk_target = ":$_apk_target"
+      }
       test_name = _output_name
       test_type = "gtest"
       test_suite = _output_name
-      if (defined(invoker.isolate_file)) {
-        isolate_file = invoker.isolate_file
-      }
-    }
-    _incremental_test_runner_target =
-        "${_output_name}_incremental__test_runner_script"
-    test_runner_script(_incremental_test_runner_target) {
-      apk_target = ":$_apk_target"
-      test_name = "${_output_name}_incremental"
-      test_type = "gtest"
-      test_suite = _output_name
-      incremental_install = true
-      if (defined(invoker.isolate_file)) {
-        isolate_file = invoker.isolate_file
-      }
     }
 
     group(target_name) {
       testonly = true
-      datadeps = [
+      deps = [
         ":$_test_runner_target",
       ]
-      deps = [
-        ":$_apk_target",
-      ]
-    }
-    group("${target_name}_incremental") {
-      testonly = true
-      datadeps = [
-        ":$_incremental_test_runner_target",
-      ]
-      deps = [
-        ":${_apk_target}_incremental",
-      ]
+      if (_use_raw_android_executable) {
+        deps += [ ":$_dist_target" ]
+      } else {
+        deps += [ ":$_apk_target" ]
+      }
     }
 
     # TODO(GYP): Delete this after we've converted everything to GN.
diff --git a/third_party/WebKit/LayoutTests/LeakExpectations b/third_party/WebKit/LayoutTests/LeakExpectations
index c89e01615..d13e35c3 100644
--- a/third_party/WebKit/LayoutTests/LeakExpectations
+++ b/third_party/WebKit/LayoutTests/LeakExpectations
@@ -172,3 +172,4 @@
 crbug.com/595155 intersection-observer/same-document-root.html [ Leak ]
 crbug.com/595155 intersection-observer/same-document-zero-size-target.html [ Leak ]
 crbug.com/595155 intersection-observer/timestamp.html [ Leak ]
+crbug.com/595155 intersection-observer/unclipped-root.html [ Leak ]
diff --git a/third_party/WebKit/LayoutTests/OilpanExpectations b/third_party/WebKit/LayoutTests/OilpanExpectations
deleted file mode 100644
index c5ed577..0000000
--- a/third_party/WebKit/LayoutTests/OilpanExpectations
+++ /dev/null
@@ -1,205 +0,0 @@
-# This file is used by the Oilpan bots (and anyone building in that config)
-# to track Oilpan-specific failures.
-
-# TODO(haraken): Remove this file once we finish shipping Oilpan.
-# Before removing this file, we need to remove the --additional-expectations
-# flag from the recipes of all oilpan bots.
-
-crbug.com/597776 [ Mac ] fast/text-autosizing/tables/css-table-lots-of-text-many-cells.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text-autosizing/tables/css-table-single-cell-lots-of-text.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text-autosizing/tables/fixed-table-lots-of-text-many-cells.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text-autosizing/tables/fixed-table-single-cell-lots-of-text.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text-autosizing/tables/lots-of-text-many-cells.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text-autosizing/tables/narrow-percentage-width.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text-autosizing/tables/narrow-specified-width.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text-autosizing/tables/nested-table-wrapping.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text-autosizing/tables/nested-tables.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text-autosizing/tables/single-cell-lots-of-text.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text-autosizing/tables/single-percent-width-cell-lots-of-text.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text-autosizing/tables/table-cell-inflation.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text-autosizing/tables/table-for-layout.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text-autosizing/tables/wide-percentage-width.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text-autosizing/tables/wide-specified-width.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/aat-morx.html [ Failure Failure Failure Failure ]
-crbug.com/597776 [ Mac ] fast/text/atsui-kerning-and-ligatures.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/atsui-multiple-renderers.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/atsui-partial-selection.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/atsui-pointtooffset-calls-cg.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/atsui-rtl-override-selection.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/atsui-small-caps-punctuation-size.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/atsui-spacing-features.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/basic/002.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/basic/003.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/basic/004.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/basic/005.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/basic/006.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/basic/007.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/basic/008.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/basic/011.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/basic/012.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/basic/013.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/basic/014.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/basic/015.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/basic/generic-family-changes.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/bidi-embedding-pop-and-push-same.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/bidi-img-alt-text.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/break-word.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/capitalize-boundaries.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/capitalize-empty-generated-string.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/capitalize-preserve-nbsp.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/caps-lock-indicator-disabled.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/caps-lock-indicator-enabled.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/cg-fallback-bolding.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/complex-path-with-no-subpixel-fonts.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/complex-preferred-logical-widths.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/complex-synthetic-bold-space-width.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/complex-text-rtl-selection-repaint.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/delete-hard-break-character.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/drawBidiText.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/embed-at-end-of-pre-wrap-line.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/emoji-web-font.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/emoticons.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/emphasis-complex.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/emphasis-ellipsis-complextext.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/emphasis.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/fake-italic.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/fallback-for-custom-font.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/firstline/001.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/firstline/002.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/firstline/003.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/font-ascent-mac.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/font-fallback.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/font-initial.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/font-smallcaps-layout.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/font-stretch-variant.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/font-stretch.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/font-weight-variant.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/font-weight.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/format-control.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/in-rendered-text-rtl.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/001.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/alef-connected.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/bidi-AN-after-L.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/bidi-AN-after-empty-run.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/bidi-CS-after-AN.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/bidi-L2-run-reordering.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/bidi-LDB-2-CSS.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/bidi-LDB-2-HTML.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/bidi-LDB-2-formatting-characters.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/bidi-control-chars-treated-as-ZWS.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/bidi-european-terminators.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/bidi-explicit-embedding.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/bidi-ignored-for-first-child-inline.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/bidi-innertext.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/bidi-layout-across-linebreak.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/bidi-linebreak-001.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/bidi-linebreak-002.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/bidi-linebreak-003.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/bidi-listbox-atsui.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/bidi-listbox.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/bidi-menulist.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/bidi-mirror-he-ar.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/bidi-neutral-directionality-paragraph-start.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/bidi-neutral-run.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/bidi-override.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/bold-bengali.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/complex-character-based-fallback.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/danda-space.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/hebrew-vowels.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/hindi-spacing.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/hindi-whitespace.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/khmer-selection.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/lang-glyph-cache-separation.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/menulist-width-rtl.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/mixed-directionality-selection.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/plane2.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/pop-up-button-text-alignment-and-direction.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/rtl-caret.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/rtl-negative-letter-spacing.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/rtl-white-space-pre-wrap.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/text-spliced-font.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/thai-baht-space.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/thai-line-breaks.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/unicode-bidi-plaintext-in-textarea.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/unicode-bidi-plaintext.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/international/wrap-CJK-001.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/justified-selection-at-edge.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/justified-selection.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/justify-ideograph-complex.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/justify-ideograph-simple.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/justify-ideograph-vertical.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/large-text-composed-char.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/line-breaks-after-white-space.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/line-breaks.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/line-initial-and-final-swashes.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/midword-break-after-breakable-char.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/midword-break-before-surrogate-pair.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/midword-break-hang.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/monospace-width-cache.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/reset-emptyRun.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/selection-hard-linebreak.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/selection-painting-hidpi.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/selection-rect-line-height-too-big.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/selection-rect-line-height-too-small.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/shadow-translucent-fill.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/shaping/same-script-different-lang.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/shaping/shaping-script-order.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/shaping/shaping-selection-rect.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/should-use-atsui.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/small-caps-turkish.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/softHyphen.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/text-letter-spacing.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/text-shadow-no-default-color.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/text-stroke-with-border.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/textIteratorNilRenderer.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/unicode-fallback-font.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/vertical-rl-rtl-linebreak.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/vertical-surrogate-pair.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/wbr-in-pre-crash.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/wbr-pre.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/wbr-styled.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/wbr.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/001.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/002.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/003.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/004.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/005.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/006.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/007.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/008.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/009.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/010.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/011.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/012.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/015.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/016.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/018.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/019.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/020.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/021.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/023.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/024.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/025.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/026.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/027.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/028.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/029.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/030.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/normal-after-nowrap-breaking.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/nowrap-clear-float.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/pre-newline-box-test.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/pre-wrap-last-char.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/pre-wrap-line-test.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/pre-wrap-overflow-selection.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/pre-wrap-spaces-after-newline.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/select-new-line-with-line-break-normal.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/whitespace/span-in-word-space-causes-overflow.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/wide-zero-width-space.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/word-break-run-rounding.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/word-break-soft-hyphen.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/word-break.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/word-space.html [ Failure ]
-crbug.com/597776 [ Mac ] fast/text/zero-font-size.html [ Failure ]
-crbug.com/597776 [ Mac ] ietestcenter/css3/text/textshadow-003.htm [ Failure ]
-crbug.com/597776 [ Mac ] ietestcenter/css3/text/textshadow-004.htm [ Failure ]
-
diff --git a/third_party/WebKit/LayoutTests/OilpanLeakExpectations b/third_party/WebKit/LayoutTests/OilpanLeakExpectations
deleted file mode 100644
index 87656421..0000000
--- a/third_party/WebKit/LayoutTests/OilpanLeakExpectations
+++ /dev/null
@@ -1,10 +0,0 @@
-# This file is used for tests that only need to be suppressed on the Chromium
-# WebKit Leak bots.
-#
-# This list isn't comprehensive yet, and Leak Detector bots are not tree closers atm.
-# Gardeners are welcome to touch this file, but you can ignore the failures
-# and wait for kouhei@ or hajimehoshi@ to maintain this file.
-#
-# Also, while Oilpan is enabled on ToT it will not read leak expectations from this
-# file. So gardeners, put Oilpan leak expectations in LeakExpectations in a section
-# labelled "Oilpan" or some such.
diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index 57cfbf3..942139f 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations
@@ -286,6 +286,9 @@
 # crbug.com/521730 [ Win10 ] fast/text/complex-text-opacity.html [ Failure Timeout ]
 crbug.com/524859 transforms/2d/hindi-rotated.html [ NeedsManualRebaseline ]
 
+crbug.com/437696 animations/rotate-transform-equivalent.html [ NeedsRebaseline ]
+crbug.com/437696 virtual/threaded/animations/rotate-transform-equivalent.html [ NeedsRebaseline ]
+
 crbug.com/569139 fast/js/string-replace-2.html [ NeedsManualRebaseline ]
 crbug.com/569139 fast/js/regexp-caching.html [ NeedsManualRebaseline ]
 crbug.com/597221 fast/dom/Window/window-postmessage-clone-deep-array.html [ NeedsManualRebaseline ]
diff --git a/third_party/WebKit/LayoutTests/animations/composition/rotate-composition.html b/third_party/WebKit/LayoutTests/animations/composition/rotate-composition.html
new file mode 100644
index 0000000..33c870b5
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/animations/composition/rotate-composition.html
@@ -0,0 +1,102 @@
+<!DOCTYPE html>
+<meta charset="UTF-8">
+<script src="../interpolation/resources/interpolation-test.js"></script>
+<script>
+assertComposition({
+  property: 'rotate',
+  underlying: '100deg',
+  addFrom: '10deg',
+  addTo: '30deg',
+}, [
+  {at: -1, is: '90deg'},
+  {at: 0, is: '110deg'},
+  {at: 0.25, is: '115deg'},
+  {at: 0.75, is: '125deg'},
+  {at: 1, is: '130deg'},
+  {at: 2, is: '150deg'},
+]);
+
+assertComposition({
+  property: 'rotate',
+  underlying: '200deg 1 0 0',
+  addFrom: '-100deg 1 0 0',
+  replaceTo: '40deg 1 0 0',
+}, [
+  {at: -1, is: '160deg 1 0 0'},
+  {at: 0, is: '100deg 1 0 0'},
+  {at: 0.25, is: '85deg 1 0 0'},
+  {at: 0.75, is: '55deg 1 0 0'},
+  {at: 1, is: '40deg 1 0 0'},
+  {at: 2, is: '-20deg 1 0 0'},
+]);
+
+assertComposition({
+  property: 'rotate',
+  underlying: '-40deg 0 1 0',
+  replaceFrom: '50deg 0 1 0',
+  addTo: '10deg 0 1 0',
+}, [
+  {at: -1, is: '130deg 0 1 0'},
+  {at: 0, is: '50deg 0 1 0'},
+  {at: 0.25, is: '30deg 0 1 0'},
+  {at: 0.75, is: '-10deg 0 1 0'},
+  {at: 1, is: '-30deg 0 1 0'},
+  {at: 2, is: '-110deg 0 1 0'},
+]);
+
+assertComposition({
+  property: 'rotate',
+  underlying: '40deg 1 2 3',
+  addFrom: '10deg 2 4 6',
+  addTo: '50deg 3 6 9',
+}, [
+  {at: -1, is: '10deg 1 2 3'},
+  {at: 0, is: '50deg 1 2 3'},
+  {at: 0.25, is: '60deg 1 2 3'},
+  {at: 0.75, is: '80deg 1 2 3'},
+  {at: 1, is: '90deg 1 2 3'},
+  {at: 2, is: '130deg 1 2 3'},
+]);
+
+assertComposition({
+  property: 'rotate',
+  underlying: '270deg 1 2 3',
+  addFrom: '90deg 1 2 3',
+  replaceTo: '100deg 0 1 0',
+}, [
+  {at: -1, is: '100deg -5.49276e-17 -1 -1.64783e-16'},
+  {at: 0, is: '360deg 1 2 3'},
+  {at: 0.25, is: '25deg -1.20172e-16 1 -3.60516e-16'},
+  {at: 0.75, is: '75deg -1.51909e-17 1 -4.55726e-17'},
+  {at: 1, is: '100deg 0 1 0'},
+  {at: 2, is: '160deg -3.3235e-17 -1 -9.97049e-17'},
+]);
+
+assertComposition({
+  property: 'rotate',
+  underlying: '90deg 1 2 3',
+  addFrom: '270deg 2 4 6',
+  replaceTo: '100deg 0 1 0',
+}, [
+  {at: -1, is: '100deg -5.49276e-17 -1 -1.64783e-16'},
+  {at: 0, is: '360deg 1 2 3'},
+  {at: 0.25, is: '25deg -1.20172e-16 1 -3.60516e-16'},
+  {at: 0.75, is: '75deg -1.51909e-17 1 -4.55726e-17'},
+  {at: 1, is: '100deg 0 1 0'},
+  {at: 2, is: '160deg -3.3235e-17 -1 -9.97049e-17'},
+]);
+
+assertComposition({
+  property: 'rotate',
+  underlying: '90deg 1 0 0',
+  addFrom: '180deg 0 1 0',
+  replaceTo: '90deg 0 0 1',
+}, [
+  {at: -1, is: '90deg -6.12323e-17 -1 1.57009e-16'},
+  {at: 0, is: '180deg -4.32978e-17 -0.707107 -0.707107'},
+  {at: 0.25, is: '131.81deg -1.48952e-16 -0.894427 -0.447214'},
+  {at: 0.75, is: '70.5288deg -2.94392e-17 -0.707107 0.707107'},
+  {at: 1, is: '90deg'},
+  {at: 2, is: '90deg -6.12323e-17 -1 -4.71028e-16'},
+]);
+</script>
diff --git a/third_party/WebKit/LayoutTests/animations/responsive/rotate-responsive.html b/third_party/WebKit/LayoutTests/animations/responsive/rotate-responsive.html
new file mode 100644
index 0000000..7710fbd1
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/animations/responsive/rotate-responsive.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<script src="resources/responsive-test.js"></script>
+<script>
+assertCSSResponsive({
+  property: 'rotate',
+  from: 'inherit',
+  to: '100deg 0 1 0',
+  configurations: [{
+    state: {inherited: '60deg 0 1 0'},
+    expect: [
+      {at: 0.25, is: '70deg 0 1 0'},
+      {at: 0.75, is: '90deg 0 1 0'},
+    ],
+  }, {
+    state: {inherited: '140deg 0 1 0'},
+    expect: [
+      {at: 0.25, is: '130deg 0 1 0'},
+      {at: 0.75, is: '110deg 0 1 0'},
+    ],
+  }],
+});
+</script>
diff --git a/third_party/WebKit/LayoutTests/animations/rotate-transform-equivalent.html b/third_party/WebKit/LayoutTests/animations/rotate-transform-equivalent.html
new file mode 100644
index 0000000..057953d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/animations/rotate-transform-equivalent.html
@@ -0,0 +1,32 @@
+<style>
+.target {
+  position: absolute;
+  font-size: 100px;
+  width: 100px;
+  height: 100px;
+  border: solid;
+}
+#rotateAdd { color: red; }
+#rotateReplace { color: red; }
+#transform { color: green; }
+</style>
+There should be no red visible.
+<div class="target" id="rotateAdd">F</div>
+<div class="target" id="rotateReplace">F</div>
+<div class="target" id="transform">F</div>
+<script>
+var timing = {fill: 'forwards', iterations: 0.75};
+rotateAdd.style.rotate = '90deg 1 0 0';
+rotateAdd.animate([
+  {rotate: '-180deg 0 1 0', composite: 'add'},
+  {rotate: '90deg 0 0 1'},
+], timing);
+rotateReplace.animate([
+  {rotate: '180deg 0 -0.707107 -0.707107'},
+  {rotate: '90deg 0 0 1'},
+], timing);
+transform.animate([
+  {transform: 'rotate3d(1, 0, 0, 90deg) rotate3d(0, 1, 0, -180deg)'},
+  {transform: 'rotate3d(0, 0, 1, 90deg)'},
+], timing);
+</script>
diff --git a/third_party/WebKit/LayoutTests/http/tests/fetch/script-tests/fetch.js b/third_party/WebKit/LayoutTests/http/tests/fetch/script-tests/fetch.js
index d2d188c..1e9a7723 100644
--- a/third_party/WebKit/LayoutTests/http/tests/fetch/script-tests/fetch.js
+++ b/third_party/WebKit/LayoutTests/http/tests/fetch/script-tests/fetch.js
@@ -171,7 +171,7 @@
       .then(function(response) {
           assert_equals(response.status, 0);
           assert_equals(response.type, 'opaqueredirect');
-          assert_equals(response.url, '');
+          assert_equals(response.url, request.url);
         });
   }, 'Manual redirect fetch returns opaque redirect response');
 
diff --git a/third_party/WebKit/LayoutTests/intersection-observer/unclipped-root-expected.txt b/third_party/WebKit/LayoutTests/intersection-observer/unclipped-root-expected.txt
new file mode 100644
index 0000000..71764f4a
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/intersection-observer/unclipped-root-expected.txt
@@ -0,0 +1,25 @@
+Test that border bounding box is used to calculate intersection with a non-scrolling root.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS entries.length is 0
+PASS entries.length is 0
+PASS entries.length is 1
+PASS entries[0].boundingClientRect.left is 15
+PASS entries[0].boundingClientRect.right is 115
+PASS entries[0].boundingClientRect.top is 210
+PASS entries[0].boundingClientRect.bottom is 310
+PASS entries[0].intersectionRect.left is 15
+PASS entries[0].intersectionRect.right is 115
+PASS entries[0].intersectionRect.top is 210
+PASS entries[0].intersectionRect.bottom is 222
+PASS entries[0].rootBounds.left is 8
+PASS entries[0].rootBounds.right is 222
+PASS entries[0].rootBounds.top is 8
+PASS entries[0].rootBounds.bottom is 222
+PASS entries[0].target is [object HTMLDivElement]
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/third_party/WebKit/LayoutTests/intersection-observer/unclipped-root.html b/third_party/WebKit/LayoutTests/intersection-observer/unclipped-root.html
new file mode 100644
index 0000000..2bb0c81f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/intersection-observer/unclipped-root.html
@@ -0,0 +1,67 @@
+<!DOCTYPE html>
+<script src="../resources/js-test.js"></script>
+<script src="helper-functions.js"></script>
+<style>
+#root {
+  overflow: visible;
+  height: 200px;
+  width: 200px;
+  border: 7px solid black;
+}
+#target {
+  width: 100px;
+  height: 100px;
+  background-color: green;
+}
+</style>
+<div id="root">
+  <div id="target" style="transform: translateY(300px)"></div>
+</div>
+
+<script>
+description("Test that border bounding box is used to calculate intersection with a non-scrolling root.");
+var target = document.getElementById("target");
+var root = document.getElementById("root");
+var entries = [];
+var observer = new IntersectionObserver(
+    changes => { entries.push(...changes) },
+    { root: document.getElementById("root") }
+);
+
+onload = function() {
+  observer.observe(target);
+  entries.push(...observer.takeRecords());
+  shouldBeEqualToNumber("entries.length", 0);
+  // See README for explanation of double RAF.
+  requestAnimationFrame(() => { requestAnimationFrame(step0) });
+}
+
+function step0() {
+  entries.push(...observer.takeRecords());
+  shouldBeEqualToNumber("entries.length", 0);
+  target.style.transform = "translateY(195px)";
+  requestAnimationFrame(step1);
+}
+
+function step1() {
+  entries.push(...observer.takeRecords());
+  shouldBeEqualToNumber("entries.length", 1);
+  if (entries.length > 0) {
+    shouldBeEqualToNumber("entries[0].boundingClientRect.left", 15);
+    shouldBeEqualToNumber("entries[0].boundingClientRect.right", 115);
+    shouldBeEqualToNumber("entries[0].boundingClientRect.top", 210);
+    shouldBeEqualToNumber("entries[0].boundingClientRect.bottom", 310);
+    shouldBeEqualToNumber("entries[0].intersectionRect.left", 15);
+    shouldBeEqualToNumber("entries[0].intersectionRect.right", 115);
+    shouldBeEqualToNumber("entries[0].intersectionRect.top", 210);
+    shouldBeEqualToNumber("entries[0].intersectionRect.bottom", 222);
+    shouldBeEqualToNumber("entries[0].rootBounds.left", 8);
+    shouldBeEqualToNumber("entries[0].rootBounds.right", 222);
+    shouldBeEqualToNumber("entries[0].rootBounds.top", 8);
+    shouldBeEqualToNumber("entries[0].rootBounds.bottom", 222);
+    shouldEvaluateToSameObject("entries[0].target", target);
+  }
+
+  finishJSTest();
+}
+</script>
diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp b/third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp
index b4de42a8..771e66a 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp
@@ -98,9 +98,7 @@
 
 DEFINE_TRACE(ScriptController)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_windowProxyManager);
-#endif
 }
 
 void ScriptController::clearForClose()
diff --git a/third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp b/third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp
index cb67468..40dd1b89 100644
--- a/third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp
@@ -228,9 +228,7 @@
 
 DEFINE_TRACE(V8AbstractEventListener)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_workerGlobalScope);
-#endif
     EventListener::trace(visitor);
 }
 
diff --git a/third_party/WebKit/Source/bindings/core/v8/WindowProxyManager.cpp b/third_party/WebKit/Source/bindings/core/v8/WindowProxyManager.cpp
index 675acae3..8c5536c 100644
--- a/third_party/WebKit/Source/bindings/core/v8/WindowProxyManager.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/WindowProxyManager.cpp
@@ -21,11 +21,9 @@
 
 DEFINE_TRACE(WindowProxyManager)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_frame);
     visitor->trace(m_windowProxy);
     visitor->trace(m_isolatedWorlds);
-#endif
 }
 
 WindowProxy* WindowProxyManager::windowProxy(DOMWrapperWorld& world)
diff --git a/third_party/WebKit/Source/core/BUILD.gn b/third_party/WebKit/Source/core/BUILD.gn
index 971efcc..84a2476 100644
--- a/third_party/WebKit/Source/core/BUILD.gn
+++ b/third_party/WebKit/Source/core/BUILD.gn
@@ -75,7 +75,6 @@
     "//third_party/libwebp",
     "//third_party/libxml",
     "//third_party/libxslt",
-    "//third_party/npapi",
     "//third_party/qcms",
     "//third_party/sqlite",
 
@@ -102,12 +101,12 @@
     "//third_party/libwebp",
     "//third_party/libxml",
     "//third_party/libxslt",
-    "//third_party/npapi",
     "//third_party/ots",
     "//third_party/qcms",
     "//third_party/snappy",
     "//third_party/sqlite",
     "//third_party/zlib",
+    "//ui/gfx/geometry",
     "//url",
     "//v8",
   ]
@@ -156,7 +155,6 @@
     "//skia",
     "//third_party/WebKit/Source/platform",
     "//third_party/WebKit/Source/wtf",
-    "//third_party/npapi",
     "//third_party/qcms",
     "//url",
     "//v8",
@@ -439,7 +437,6 @@
     "//third_party/libwebp",
     "//third_party/libxml",
     "//third_party/libxslt",
-    "//third_party/npapi",
     "//third_party/qcms",
     "//third_party/sqlite",
 
diff --git a/third_party/WebKit/Source/core/animation/AnimationInputHelpers.cpp b/third_party/WebKit/Source/core/animation/AnimationInputHelpers.cpp
index 68071a9..532cd58 100644
--- a/third_party/WebKit/Source/core/animation/AnimationInputHelpers.cpp
+++ b/third_party/WebKit/Source/core/animation/AnimationInputHelpers.cpp
@@ -116,7 +116,6 @@
             &SVGNames::modeAttr,
             &SVGNames::numOctavesAttr,
             &SVGNames::offsetAttr,
-            &SVGNames::opacityAttr,
             &SVGNames::operatorAttr,
             &SVGNames::orderAttr,
             &SVGNames::orientAttr,
@@ -170,8 +169,10 @@
             &SVGNames::yChannelSelectorAttr,
             &SVGNames::zAttr,
         };
-        for (size_t i = 0; i < WTF_ARRAY_LENGTH(attributes); i++)
+        for (size_t i = 0; i < WTF_ARRAY_LENGTH(attributes); i++) {
+            ASSERT(!SVGElement::isAnimatableCSSProperty(*attributes[i]));
             supportedAttributes.set(*attributes[i], attributes[i]);
+        }
     }
     return supportedAttributes;
 }
diff --git a/third_party/WebKit/Source/core/animation/CSSRotateInterpolationType.cpp b/third_party/WebKit/Source/core/animation/CSSRotateInterpolationType.cpp
new file mode 100644
index 0000000..de246b6
--- /dev/null
+++ b/third_party/WebKit/Source/core/animation/CSSRotateInterpolationType.cpp
@@ -0,0 +1,178 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "core/animation/CSSRotateInterpolationType.h"
+
+#include "core/css/resolver/StyleBuilderConverter.h"
+#include "platform/transforms/RotateTransformOperation.h"
+#include "platform/transforms/Rotation.h"
+
+namespace blink {
+
+class CSSRotateNonInterpolableValue : public NonInterpolableValue {
+public:
+    static PassRefPtr<CSSRotateNonInterpolableValue> create(const Rotation& rotation)
+    {
+        return adoptRef(new CSSRotateNonInterpolableValue(true, rotation, Rotation(), false, false));
+    }
+
+    static PassRefPtr<CSSRotateNonInterpolableValue> create(const CSSRotateNonInterpolableValue& start, const CSSRotateNonInterpolableValue& end)
+    {
+        return adoptRef(new CSSRotateNonInterpolableValue(false, start.rotation(), end.rotation(), start.isAdditive(), end.isAdditive()));
+    }
+
+    PassRefPtr<CSSRotateNonInterpolableValue> composite(const CSSRotateNonInterpolableValue& other, double otherProgress)
+    {
+        ASSERT(m_isSingle && !m_isStartAdditive);
+        if (other.m_isSingle) {
+            ASSERT(otherProgress == 0);
+            ASSERT(other.isAdditive());
+            return create(Rotation::add(rotation(), other.rotation()));
+        }
+
+        ASSERT(other.m_isStartAdditive || other.m_isEndAdditive);
+        Rotation start = other.m_isStartAdditive ? Rotation::add(rotation(), other.m_start) : other.m_start;
+        Rotation end = other.m_isEndAdditive ? Rotation::add(rotation(), other.m_end) : other.m_end;
+        return create(Rotation::slerp(start, end, otherProgress));
+    }
+
+    void setSingleAdditive() { ASSERT(m_isSingle); m_isStartAdditive = true; }
+
+    Rotation slerpedRotation(double progress) const
+    {
+        ASSERT(!m_isStartAdditive && !m_isEndAdditive);
+        ASSERT(!m_isSingle || progress == 0);
+        if (progress == 0)
+            return m_start;
+        if (progress == 1)
+            return m_end;
+        return Rotation::slerp(m_start, m_end, progress);
+    }
+
+    DECLARE_NON_INTERPOLABLE_VALUE_TYPE();
+
+private:
+    CSSRotateNonInterpolableValue(bool isSingle, const Rotation& start, const Rotation& end, bool isStartAdditive, bool isEndAdditive)
+        : m_isSingle(isSingle)
+        , m_start(start)
+        , m_end(end)
+        , m_isStartAdditive(isStartAdditive)
+        , m_isEndAdditive(isEndAdditive)
+    { }
+
+    const Rotation& rotation() const { ASSERT(m_isSingle); return m_start; }
+    bool isAdditive() const { ASSERT(m_isSingle); return m_isStartAdditive; }
+
+    bool m_isSingle;
+    Rotation m_start;
+    Rotation m_end;
+    bool m_isStartAdditive;
+    bool m_isEndAdditive;
+};
+
+DEFINE_NON_INTERPOLABLE_VALUE_TYPE(CSSRotateNonInterpolableValue);
+DEFINE_NON_INTERPOLABLE_VALUE_TYPE_CASTS(CSSRotateNonInterpolableValue);
+
+namespace {
+
+Rotation getRotation(const ComputedStyle& style)
+{
+    if (!style.rotate())
+        return Rotation(FloatPoint3D(0, 0, 1), 0);
+    return Rotation(style.rotate()->axis(), style.rotate()->angle());
+}
+
+InterpolationValue convertRotation(const Rotation& rotation)
+{
+    return InterpolationValue(InterpolableNumber::create(0), CSSRotateNonInterpolableValue::create(rotation));
+}
+
+class InheritedRotationChecker : public InterpolationType::ConversionChecker {
+public:
+    static PassOwnPtr<InheritedRotationChecker> create(const Rotation& inheritedRotation)
+    {
+        return adoptPtr(new InheritedRotationChecker(inheritedRotation));
+    }
+
+    bool isValid(const InterpolationEnvironment& environment, const InterpolationValue& underlying) const final
+    {
+        Rotation inheritedRotation = getRotation(*environment.state().parentStyle());
+        return m_inheritedRotation.axis == inheritedRotation.axis
+            && m_inheritedRotation.angle == inheritedRotation.angle;
+    }
+private:
+    InheritedRotationChecker(const Rotation& inheritedRotation)
+        : m_inheritedRotation(inheritedRotation)
+    { }
+
+    const Rotation m_inheritedRotation;
+};
+
+} // namespace
+
+InterpolationValue CSSRotateInterpolationType::maybeConvertNeutral(const InterpolationValue& underlying, ConversionCheckers&) const
+{
+    return convertRotation(Rotation());
+}
+
+InterpolationValue CSSRotateInterpolationType::maybeConvertInitial(const StyleResolverState&) const
+{
+    return convertRotation(getRotation(ComputedStyle::initialStyle()));
+}
+
+InterpolationValue CSSRotateInterpolationType::maybeConvertInherit(const StyleResolverState& state, ConversionCheckers& conversionCheckers) const
+{
+    Rotation inheritedRotation = getRotation(*state.parentStyle());
+    conversionCheckers.append(InheritedRotationChecker::create(inheritedRotation));
+    return convertRotation(inheritedRotation);
+}
+
+InterpolationValue CSSRotateInterpolationType::maybeConvertValue(const CSSValue& value, const StyleResolverState&, ConversionCheckers&) const
+{
+    return convertRotation(StyleBuilderConverter::convertRotation(value));
+}
+
+InterpolationValue CSSRotateInterpolationType::maybeConvertSingle(const PropertySpecificKeyframe& keyframe, const InterpolationEnvironment& environment, const InterpolationValue& underlying, ConversionCheckers& conversionCheckers) const
+{
+    InterpolationValue result = CSSInterpolationType::maybeConvertSingle(keyframe, environment, underlying, conversionCheckers);
+    if (!result)
+        return nullptr;
+    if (keyframe.composite() != EffectModel::CompositeReplace)
+        toCSSRotateNonInterpolableValue(*result.nonInterpolableValue).setSingleAdditive();
+    return result;
+}
+
+PairwiseInterpolationValue CSSRotateInterpolationType::mergeSingleConversions(InterpolationValue&& start, InterpolationValue&& end) const
+{
+    return PairwiseInterpolationValue(
+        InterpolableNumber::create(0),
+        InterpolableNumber::create(1),
+        CSSRotateNonInterpolableValue::create(
+            toCSSRotateNonInterpolableValue(*start.nonInterpolableValue),
+            toCSSRotateNonInterpolableValue(*end.nonInterpolableValue)));
+}
+
+InterpolationValue CSSRotateInterpolationType::maybeConvertUnderlyingValue(const InterpolationEnvironment& environment) const
+{
+    return convertRotation(getRotation(*environment.state().style()));
+}
+
+void CSSRotateInterpolationType::composite(UnderlyingValueOwner& underlyingValueOwner, double underlyingFraction, const InterpolationValue& value, double interpolationFraction) const
+{
+    CSSRotateNonInterpolableValue& underlyingNonInterpolableValue = toCSSRotateNonInterpolableValue(*underlyingValueOwner.value().nonInterpolableValue);
+    const CSSRotateNonInterpolableValue& nonInterpolableValue = toCSSRotateNonInterpolableValue(*value.nonInterpolableValue);
+    double progress = toInterpolableNumber(*value.interpolableValue).value();
+    underlyingValueOwner.mutableValue().nonInterpolableValue = underlyingNonInterpolableValue.composite(nonInterpolableValue, progress);
+}
+
+void CSSRotateInterpolationType::apply(const InterpolableValue& interpolableValue, const NonInterpolableValue* untypedNonInterpolableValue, InterpolationEnvironment& environment) const
+{
+    double progress = toInterpolableNumber(interpolableValue).value();
+    const CSSRotateNonInterpolableValue& nonInterpolableValue = toCSSRotateNonInterpolableValue(*untypedNonInterpolableValue);
+    Rotation rotation = nonInterpolableValue.slerpedRotation(progress);
+    environment.state().style()->setRotate(RotateTransformOperation::create(rotation, TransformOperation::Rotate3D));
+}
+
+
+} // namespace blink
diff --git a/third_party/WebKit/Source/core/animation/CSSRotateInterpolationType.h b/third_party/WebKit/Source/core/animation/CSSRotateInterpolationType.h
new file mode 100644
index 0000000..472c46f
--- /dev/null
+++ b/third_party/WebKit/Source/core/animation/CSSRotateInterpolationType.h
@@ -0,0 +1,35 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CSSRotateInterpolationType_h
+#define CSSRotateInterpolationType_h
+
+#include "core/animation/CSSInterpolationType.h"
+
+namespace blink {
+
+class CSSRotateInterpolationType : public CSSInterpolationType {
+public:
+    CSSRotateInterpolationType(CSSPropertyID property)
+        : CSSInterpolationType(property)
+    {
+        ASSERT(property == CSSPropertyRotate);
+    }
+
+    InterpolationValue maybeConvertUnderlyingValue(const InterpolationEnvironment&) const final;
+    InterpolationValue maybeConvertSingle(const PropertySpecificKeyframe&, const InterpolationEnvironment&, const InterpolationValue& underlying, ConversionCheckers&) const final;
+    PairwiseInterpolationValue mergeSingleConversions(InterpolationValue&& start, InterpolationValue&& end) const final;
+    void composite(UnderlyingValueOwner&, double underlyingFraction, const InterpolationValue&, double interpolationFraction) const final;
+    void apply(const InterpolableValue&, const NonInterpolableValue*, InterpolationEnvironment&) const final;
+
+private:
+    InterpolationValue maybeConvertNeutral(const InterpolationValue& underlying, ConversionCheckers&) const final;
+    InterpolationValue maybeConvertInitial(const StyleResolverState&) const final;
+    InterpolationValue maybeConvertInherit(const StyleResolverState&, ConversionCheckers&) const final;
+    InterpolationValue maybeConvertValue(const CSSValue&, const StyleResolverState&, ConversionCheckers&) const final;
+};
+
+} // namespace blink
+
+#endif // CSSRotateInterpolationType_h
diff --git a/third_party/WebKit/Source/core/animation/ElementAnimations.cpp b/third_party/WebKit/Source/core/animation/ElementAnimations.cpp
index 8de58e9..bac668c 100644
--- a/third_party/WebKit/Source/core/animation/ElementAnimations.cpp
+++ b/third_party/WebKit/Source/core/animation/ElementAnimations.cpp
@@ -103,9 +103,6 @@
     visitor->trace(m_cssAnimations);
     visitor->trace(m_animationStack);
     visitor->trace(m_animations);
-#if !ENABLE(OILPAN)
-    visitor->trace(m_effects);
-#endif
 }
 
 const ComputedStyle* ElementAnimations::baseComputedStyle() const
diff --git a/third_party/WebKit/Source/core/animation/PropertyInterpolationTypesMapping.cpp b/third_party/WebKit/Source/core/animation/PropertyInterpolationTypesMapping.cpp
index 19955ad..a52533c0 100644
--- a/third_party/WebKit/Source/core/animation/PropertyInterpolationTypesMapping.cpp
+++ b/third_party/WebKit/Source/core/animation/PropertyInterpolationTypesMapping.cpp
@@ -23,6 +23,7 @@
 #include "core/animation/CSSPathInterpolationType.h"
 #include "core/animation/CSSPositionAxisListInterpolationType.h"
 #include "core/animation/CSSPositionInterpolationType.h"
+#include "core/animation/CSSRotateInterpolationType.h"
 #include "core/animation/CSSScaleInterpolationType.h"
 #include "core/animation/CSSShadowListInterpolationType.h"
 #include "core/animation/CSSSizeListInterpolationType.h"
@@ -235,6 +236,9 @@
         case CSSPropertyShapeOutside:
             applicableTypes->append(adoptPtr(new CSSBasicShapeInterpolationType(cssProperty)));
             break;
+        case CSSPropertyRotate:
+            applicableTypes->append(adoptPtr(new CSSRotateInterpolationType(cssProperty)));
+            break;
         default:
             // TODO(alancutter): Support all interpolable CSS properties here so we can stop falling back to the old StyleInterpolation implementation.
             if (CSSPropertyMetadata::isInterpolableProperty(cssProperty))
diff --git a/third_party/WebKit/Source/core/clipboard/DataTransfer.cpp b/third_party/WebKit/Source/core/clipboard/DataTransfer.cpp
index feef506..8b833124 100644
--- a/third_party/WebKit/Source/core/clipboard/DataTransfer.cpp
+++ b/third_party/WebKit/Source/core/clipboard/DataTransfer.cpp
@@ -512,9 +512,7 @@
 {
     visitor->trace(m_dataObject);
     visitor->trace(m_dragImage);
-#if ENABLE(OILPAN)
     visitor->trace(m_dragImageElement);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/core.gyp b/third_party/WebKit/Source/core/core.gyp
index d9e71e06..ba194f4 100644
--- a/third_party/WebKit/Source/core/core.gyp
+++ b/third_party/WebKit/Source/core/core.gyp
@@ -114,7 +114,6 @@
         '<(DEPTH)/third_party/libwebp/libwebp.gyp:libwebp',
         '<(DEPTH)/third_party/libxml/libxml.gyp:libxml',
         '<(DEPTH)/third_party/libxslt/libxslt.gyp:libxslt',
-        '<(DEPTH)/third_party/npapi/npapi.gyp:npapi',
         '<(DEPTH)/third_party/qcms/qcms.gyp:qcms',
         '<(DEPTH)/third_party/snappy/snappy.gyp:snappy',
         '<(DEPTH)/third_party/sqlite/sqlite.gyp:sqlite',
@@ -177,11 +176,11 @@
         '<(DEPTH)/third_party/libwebp/libwebp.gyp:libwebp',
         '<(DEPTH)/third_party/libxml/libxml.gyp:libxml',
         '<(DEPTH)/third_party/libxslt/libxslt.gyp:libxslt',
-        '<(DEPTH)/third_party/npapi/npapi.gyp:npapi',
         '<(DEPTH)/third_party/ots/ots.gyp:ots',
         '<(DEPTH)/third_party/qcms/qcms.gyp:qcms',
         '<(DEPTH)/third_party/sqlite/sqlite.gyp:sqlite',
         '<(DEPTH)/third_party/zlib/zlib.gyp:zlib',
+        '<(DEPTH)/ui/gfx/gfx.gyp:gfx_geometry',
         '<(DEPTH)/url/url.gyp:url_lib',
         '<(DEPTH)/v8/tools/gyp/v8.gyp:v8',
       ],
@@ -196,7 +195,6 @@
         '<(DEPTH)/third_party/libwebp/libwebp.gyp:libwebp',
         '<(DEPTH)/third_party/libxml/libxml.gyp:libxml',
         '<(DEPTH)/third_party/libxslt/libxslt.gyp:libxslt',
-        '<(DEPTH)/third_party/npapi/npapi.gyp:npapi',
         '<(DEPTH)/third_party/ots/ots.gyp:ots',
         '<(DEPTH)/third_party/qcms/qcms.gyp:qcms',
         '<(DEPTH)/third_party/sqlite/sqlite.gyp:sqlite',
@@ -458,7 +456,6 @@
         '../platform/blink_platform.gyp:blink_platform',
         '../wtf/wtf.gyp:wtf',
         '<(DEPTH)/skia/skia.gyp:skia',
-        '<(DEPTH)/third_party/npapi/npapi.gyp:npapi',
         '<(DEPTH)/third_party/qcms/qcms.gyp:qcms',
         '<(DEPTH)/url/url.gyp:url_lib',
         '<(DEPTH)/v8/tools/gyp/v8.gyp:v8',
@@ -468,7 +465,6 @@
         '../platform/blink_platform.gyp:blink_platform',
         '../wtf/wtf.gyp:wtf',
         '<(DEPTH)/skia/skia.gyp:skia',
-        '<(DEPTH)/third_party/npapi/npapi.gyp:npapi',
         '<(DEPTH)/third_party/qcms/qcms.gyp:qcms',
         '<(DEPTH)/url/url.gyp:url_lib',
         '<(DEPTH)/v8/tools/gyp/v8.gyp:v8',
@@ -544,7 +540,6 @@
         '<(DEPTH)/skia/skia.gyp:skia',
         '<(DEPTH)/third_party/libxml/libxml.gyp:libxml',
         '<(DEPTH)/third_party/libxslt/libxslt.gyp:libxslt',
-        '<(DEPTH)/third_party/npapi/npapi.gyp:npapi',
         '<(DEPTH)/third_party/qcms/qcms.gyp:qcms',
         '<(DEPTH)/third_party/snappy/snappy.gyp:snappy',
         '<(DEPTH)/third_party/sqlite/sqlite.gyp:sqlite',
@@ -556,7 +551,6 @@
         '../wtf/wtf.gyp:wtf',
         '<(DEPTH)/base/base.gyp:base',
         '<(DEPTH)/skia/skia.gyp:skia',
-        '<(DEPTH)/third_party/npapi/npapi.gyp:npapi',
         '<(DEPTH)/third_party/qcms/qcms.gyp:qcms',
         '<(DEPTH)/url/url.gyp:url_lib',
         '<(DEPTH)/v8/tools/gyp/v8.gyp:v8',
diff --git a/third_party/WebKit/Source/core/core.gypi b/third_party/WebKit/Source/core/core.gypi
index 5e7158e3..5a5b226d 100644
--- a/third_party/WebKit/Source/core/core.gypi
+++ b/third_party/WebKit/Source/core/core.gypi
@@ -907,6 +907,8 @@
             'animation/CSSPositionAxisListInterpolationType.cpp',
             'animation/CSSPositionAxisListInterpolationType.h',
             'animation/CSSPositionInterpolationType.h',
+            'animation/CSSRotateInterpolationType.cpp',
+            'animation/CSSRotateInterpolationType.h',
             'animation/CSSScaleInterpolationType.cpp',
             'animation/CSSScaleInterpolationType.h',
             'animation/CSSShadowListInterpolationType.cpp',
diff --git a/third_party/WebKit/Source/core/css/CSSFontSelector.cpp b/third_party/WebKit/Source/core/css/CSSFontSelector.cpp
index 536c118..bdbf13a 100644
--- a/third_party/WebKit/Source/core/css/CSSFontSelector.cpp
+++ b/third_party/WebKit/Source/core/css/CSSFontSelector.cpp
@@ -181,12 +181,10 @@
 
 DEFINE_TRACE(CSSFontSelector)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_document);
     visitor->trace(m_fontFaceCache);
     visitor->trace(m_clients);
     visitor->trace(m_fontLoader);
-#endif
     FontSelector::trace(visitor);
 }
 
diff --git a/third_party/WebKit/Source/core/css/CSSGradientValue.cpp b/third_party/WebKit/Source/core/css/CSSGradientValue.cpp
index 86e41a8..32f7a354 100644
--- a/third_party/WebKit/Source/core/css/CSSGradientValue.cpp
+++ b/third_party/WebKit/Source/core/css/CSSGradientValue.cpp
@@ -584,13 +584,11 @@
 
 DEFINE_TRACE_AFTER_DISPATCH(CSSGradientValue)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_firstX);
     visitor->trace(m_firstY);
     visitor->trace(m_secondX);
     visitor->trace(m_secondY);
     visitor->trace(m_stops);
-#endif
     CSSImageGeneratorValue::traceAfterDispatch(visitor);
 }
 
diff --git a/third_party/WebKit/Source/core/css/CSSGroupingRule.cpp b/third_party/WebKit/Source/core/css/CSSGroupingRule.cpp
index c887679..5e8f361b 100644
--- a/third_party/WebKit/Source/core/css/CSSGroupingRule.cpp
+++ b/third_party/WebKit/Source/core/css/CSSGroupingRule.cpp
@@ -158,9 +158,7 @@
 DEFINE_TRACE(CSSGroupingRule)
 {
     CSSRule::trace(visitor);
-#if ENABLE(OILPAN)
     visitor->trace(m_childRuleCSSOMWrappers);
-#endif
     visitor->trace(m_groupRule);
     visitor->trace(m_ruleListCSSOMWrapper);
 }
diff --git a/third_party/WebKit/Source/core/css/CSSKeyframesRule.cpp b/third_party/WebKit/Source/core/css/CSSKeyframesRule.cpp
index 45785a8..6c80236 100644
--- a/third_party/WebKit/Source/core/css/CSSKeyframesRule.cpp
+++ b/third_party/WebKit/Source/core/css/CSSKeyframesRule.cpp
@@ -217,9 +217,7 @@
 DEFINE_TRACE(CSSKeyframesRule)
 {
     CSSRule::trace(visitor);
-#if ENABLE(OILPAN)
     visitor->trace(m_childRuleCSSOMWrappers);
-#endif
     visitor->trace(m_keyframesRule);
     visitor->trace(m_ruleListCSSOMWrapper);
 }
diff --git a/third_party/WebKit/Source/core/css/CSSPrimitiveValue.cpp b/third_party/WebKit/Source/core/css/CSSPrimitiveValue.cpp
index 9deb027..51666b6 100644
--- a/third_party/WebKit/Source/core/css/CSSPrimitiveValue.cpp
+++ b/third_party/WebKit/Source/core/css/CSSPrimitiveValue.cpp
@@ -830,7 +830,6 @@
 
 DEFINE_TRACE_AFTER_DISPATCH(CSSPrimitiveValue)
 {
-#if ENABLE(OILPAN)
     switch (type()) {
     case UnitType::Calc:
         visitor->trace(m_value.calc);
@@ -838,7 +837,6 @@
     default:
         break;
     }
-#endif
     CSSValue::traceAfterDispatch(visitor);
 }
 
diff --git a/third_party/WebKit/Source/core/css/CSSPropertySourceData.cpp b/third_party/WebKit/Source/core/css/CSSPropertySourceData.cpp
index c8ddbcd..2b8b9fa 100644
--- a/third_party/WebKit/Source/core/css/CSSPropertySourceData.cpp
+++ b/third_party/WebKit/Source/core/css/CSSPropertySourceData.cpp
@@ -76,14 +76,12 @@
 
 DEFINE_TRACE(CSSRuleSourceData)
 {
-#if ENABLE(OILPAN)
     visitor->trace(ruleHeaderRange);
     visitor->trace(ruleBodyRange);
     visitor->trace(selectorRanges);
     visitor->trace(styleSourceData);
     visitor->trace(childRules);
     visitor->trace(mediaSourceData);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/css/CSSPropertySourceData.h b/third_party/WebKit/Source/core/css/CSSPropertySourceData.h
index f28b792..d70074a 100644
--- a/third_party/WebKit/Source/core/css/CSSPropertySourceData.h
+++ b/third_party/WebKit/Source/core/css/CSSPropertySourceData.h
@@ -77,9 +77,7 @@
 
     DEFINE_INLINE_TRACE()
     {
-#if ENABLE(OILPAN)
         visitor->trace(propertyData);
-#endif
     }
 
     HeapVector<CSSPropertySourceData> propertyData;
@@ -104,9 +102,7 @@
 
     DEFINE_INLINE_TRACE()
     {
-#if ENABLE(OILPAN)
         visitor->trace(expData);
-#endif
     }
 
     HeapVector<CSSMediaQueryExpSourceData> expData;
@@ -120,9 +116,7 @@
 
     DEFINE_INLINE_TRACE()
     {
-#if ENABLE(OILPAN)
         visitor->trace(queryData);
-#endif
     }
 
     HeapVector<Member<CSSMediaQuerySourceData>> queryData;
diff --git a/third_party/WebKit/Source/core/css/CSSRule.cpp b/third_party/WebKit/Source/core/css/CSSRule.cpp
index 09c06d3..38788f8 100644
--- a/third_party/WebKit/Source/core/css/CSSRule.cpp
+++ b/third_party/WebKit/Source/core/css/CSSRule.cpp
@@ -43,7 +43,6 @@
 
 DEFINE_TRACE(CSSRule)
 {
-#if ENABLE(OILPAN)
     // This makes the parent link strong, which is different from the
     // pre-oilpan world, where the parent link is mysteriously zeroed under
     // some circumstances.
@@ -51,7 +50,6 @@
         visitor->trace(m_parentRule);
     else
         visitor->trace(m_parentStyleSheet);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/css/CSSSegmentedFontFace.cpp b/third_party/WebKit/Source/core/css/CSSSegmentedFontFace.cpp
index d3bde98..4226d1c2 100644
--- a/third_party/WebKit/Source/core/css/CSSSegmentedFontFace.cpp
+++ b/third_party/WebKit/Source/core/css/CSSSegmentedFontFace.cpp
@@ -181,10 +181,8 @@
 
 DEFINE_TRACE(CSSSegmentedFontFace)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_fontSelector);
     visitor->trace(m_fontFaces);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/css/CSSValuePool.cpp b/third_party/WebKit/Source/core/css/CSSValuePool.cpp
index 53dce3f..12c18bc 100644
--- a/third_party/WebKit/Source/core/css/CSSValuePool.cpp
+++ b/third_party/WebKit/Source/core/css/CSSValuePool.cpp
@@ -164,7 +164,6 @@
 
 DEFINE_TRACE(CSSValuePool)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_inheritedValue);
     visitor->trace(m_implicitInitialValue);
     visitor->trace(m_explicitInitialValue);
@@ -179,7 +178,6 @@
     visitor->trace(m_numberValueCache);
     visitor->trace(m_fontFaceValueCache);
     visitor->trace(m_fontFamilyValueCache);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/css/FontFaceCache.cpp b/third_party/WebKit/Source/core/css/FontFaceCache.cpp
index 3b9fc85..dc9f9b0c 100644
--- a/third_party/WebKit/Source/core/css/FontFaceCache.cpp
+++ b/third_party/WebKit/Source/core/css/FontFaceCache.cpp
@@ -153,12 +153,10 @@
 
 DEFINE_TRACE(FontFaceCache)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_fontFaces);
     visitor->trace(m_fonts);
     visitor->trace(m_styleRuleToFontFace);
     visitor->trace(m_cssConnectedFontFaces);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/css/MediaList.cpp b/third_party/WebKit/Source/core/css/MediaList.cpp
index 9dbd736..ee24959 100644
--- a/third_party/WebKit/Source/core/css/MediaList.cpp
+++ b/third_party/WebKit/Source/core/css/MediaList.cpp
@@ -161,9 +161,7 @@
 {
     // We don't support tracing of vectors of OwnPtrs (ie. OwnPtr<Vector<OwnPtr<MediaQuery>>>).
     // Since this is a transitional object we are just ifdef'ing it out when oilpan is not enabled.
-#if ENABLE(OILPAN)
     visitor->trace(m_queries);
-#endif
 }
 
 MediaList::MediaList(MediaQuerySet* mediaQueries, CSSStyleSheet* parentSheet)
diff --git a/third_party/WebKit/Source/core/css/MediaQuery.cpp b/third_party/WebKit/Source/core/css/MediaQuery.cpp
index f6ab5195..5b553880 100644
--- a/third_party/WebKit/Source/core/css/MediaQuery.cpp
+++ b/third_party/WebKit/Source/core/css/MediaQuery.cpp
@@ -136,9 +136,7 @@
 {
     // We don't support tracing of vectors of OwnPtrs (ie. OwnPtr<Vector<OwnPtr<MediaQuery>>>).
     // Since this is a transitional object we are just ifdef'ing it out when oilpan is not enabled.
-#if ENABLE(OILPAN)
     visitor->trace(m_expressions);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/css/MediaQueryList.cpp b/third_party/WebKit/Source/core/css/MediaQueryList.cpp
index f73268c..8595543 100644
--- a/third_party/WebKit/Source/core/css/MediaQueryList.cpp
+++ b/third_party/WebKit/Source/core/css/MediaQueryList.cpp
@@ -133,11 +133,9 @@
 
 DEFINE_TRACE(MediaQueryList)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_matcher);
     visitor->trace(m_media);
     visitor->trace(m_listeners);
-#endif
     EventTargetWithInlineData::trace(visitor);
     ActiveDOMObject::trace(visitor);
 }
diff --git a/third_party/WebKit/Source/core/css/MediaQueryMatcher.cpp b/third_party/WebKit/Source/core/css/MediaQueryMatcher.cpp
index 444af68..e7674732 100644
--- a/third_party/WebKit/Source/core/css/MediaQueryMatcher.cpp
+++ b/third_party/WebKit/Source/core/css/MediaQueryMatcher.cpp
@@ -145,12 +145,10 @@
 
 DEFINE_TRACE(MediaQueryMatcher)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_document);
     visitor->trace(m_evaluator);
     visitor->trace(m_mediaLists);
     visitor->trace(m_viewportListeners);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/css/RuleFeature.cpp b/third_party/WebKit/Source/core/css/RuleFeature.cpp
index 38f3468..7d665f6 100644
--- a/third_party/WebKit/Source/core/css/RuleFeature.cpp
+++ b/third_party/WebKit/Source/core/css/RuleFeature.cpp
@@ -779,10 +779,8 @@
 
 DEFINE_TRACE(RuleFeatureSet)
 {
-#if ENABLE(OILPAN)
     visitor->trace(siblingRules);
     visitor->trace(uncommonAttributeRules);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/css/RuleFeatureSetTest.cpp b/third_party/WebKit/Source/core/css/RuleFeatureSetTest.cpp
index eecbec14..7b194f3 100644
--- a/third_party/WebKit/Source/core/css/RuleFeatureSetTest.cpp
+++ b/third_party/WebKit/Source/core/css/RuleFeatureSetTest.cpp
@@ -182,10 +182,8 @@
 
     DEFINE_INLINE_TRACE()
     {
-#if ENABLE(OILPAN)
         visitor->trace(m_ruleFeatureSet);
         visitor->trace(m_document);
-#endif
     }
 
 private:
diff --git a/third_party/WebKit/Source/core/css/RuleSet.cpp b/third_party/WebKit/Source/core/css/RuleSet.cpp
index 3d19f18..87cdaac 100644
--- a/third_party/WebKit/Source/core/css/RuleSet.cpp
+++ b/third_party/WebKit/Source/core/css/RuleSet.cpp
@@ -360,17 +360,14 @@
 
 DEFINE_TRACE(RuleSet::PendingRuleMaps)
 {
-#if ENABLE(OILPAN)
     visitor->trace(idRules);
     visitor->trace(classRules);
     visitor->trace(tagRules);
     visitor->trace(shadowPseudoElementRules);
-#endif
 }
 
 DEFINE_TRACE(RuleSet)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_idRules);
     visitor->trace(m_classRules);
     visitor->trace(m_tagRules);
@@ -394,7 +391,6 @@
 #ifndef NDEBUG
     visitor->trace(m_allRules);
 #endif
-#endif
 }
 
 #ifndef NDEBUG
diff --git a/third_party/WebKit/Source/core/css/SelectorFilter.cpp b/third_party/WebKit/Source/core/css/SelectorFilter.cpp
index 61580269..b1ea350 100644
--- a/third_party/WebKit/Source/core/css/SelectorFilter.cpp
+++ b/third_party/WebKit/Source/core/css/SelectorFilter.cpp
@@ -185,9 +185,7 @@
 
 DEFINE_TRACE(SelectorFilter)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_parentStack);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/css/StylePropertySet.cpp b/third_party/WebKit/Source/core/css/StylePropertySet.cpp
index 9531be6..09a1e44 100644
--- a/third_party/WebKit/Source/core/css/StylePropertySet.cpp
+++ b/third_party/WebKit/Source/core/css/StylePropertySet.cpp
@@ -554,10 +554,8 @@
 
 DEFINE_TRACE_AFTER_DISPATCH(MutableStylePropertySet)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_cssomWrapper);
     visitor->trace(m_propertyVector);
-#endif
     StylePropertySet::traceAfterDispatch(visitor);
 }
 
diff --git a/third_party/WebKit/Source/core/css/StyleSheetContents.cpp b/third_party/WebKit/Source/core/css/StyleSheetContents.cpp
index 95868a7e..f60e9286 100644
--- a/third_party/WebKit/Source/core/css/StyleSheetContents.cpp
+++ b/third_party/WebKit/Source/core/css/StyleSheetContents.cpp
@@ -662,7 +662,6 @@
 
 DEFINE_TRACE(StyleSheetContents)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_ownerRule);
     visitor->trace(m_importRules);
     visitor->trace(m_namespaceRules);
@@ -670,7 +669,6 @@
     visitor->trace(m_loadingClients);
     visitor->trace(m_completedClients);
     visitor->trace(m_ruleSet);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/css/invalidation/StyleInvalidator.cpp b/third_party/WebKit/Source/core/css/invalidation/StyleInvalidator.cpp
index 0c72c28..4bf4e90 100644
--- a/third_party/WebKit/Source/core/css/invalidation/StyleInvalidator.cpp
+++ b/third_party/WebKit/Source/core/css/invalidation/StyleInvalidator.cpp
@@ -330,9 +330,7 @@
 
 DEFINE_TRACE(StyleInvalidator)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_pendingInvalidationMap);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/css/resolver/MatchedPropertiesCache.cpp b/third_party/WebKit/Source/core/css/resolver/MatchedPropertiesCache.cpp
index 20d8b6a..d7aa238 100644
--- a/third_party/WebKit/Source/core/css/resolver/MatchedPropertiesCache.cpp
+++ b/third_party/WebKit/Source/core/css/resolver/MatchedPropertiesCache.cpp
@@ -166,9 +166,7 @@
 
 DEFINE_TRACE(MatchedPropertiesCache)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_cache);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/css/resolver/MatchedPropertiesCache.h b/third_party/WebKit/Source/core/css/resolver/MatchedPropertiesCache.h
index 101c8e9e..b43a066 100644
--- a/third_party/WebKit/Source/core/css/resolver/MatchedPropertiesCache.h
+++ b/third_party/WebKit/Source/core/css/resolver/MatchedPropertiesCache.h
@@ -46,9 +46,7 @@
     void clear();
     DEFINE_INLINE_TRACE()
     {
-#if ENABLE(OILPAN)
         visitor->trace(matchedProperties);
-#endif
     }
 };
 
diff --git a/third_party/WebKit/Source/core/css/resolver/ScopedStyleResolver.cpp b/third_party/WebKit/Source/core/css/resolver/ScopedStyleResolver.cpp
index ba120ef3..a931f65 100644
--- a/third_party/WebKit/Source/core/css/resolver/ScopedStyleResolver.cpp
+++ b/third_party/WebKit/Source/core/css/resolver/ScopedStyleResolver.cpp
@@ -191,12 +191,10 @@
 
 DEFINE_TRACE(ScopedStyleResolver)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_scope);
     visitor->trace(m_authorStyleSheets);
     visitor->trace(m_keyframesRuleMap);
     visitor->trace(m_treeBoundaryCrossingRuleSet);
-#endif
 }
 
 static void addRules(RuleSet* ruleSet, const HeapVector<MinimalRuleData>& rules)
diff --git a/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp b/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp
index 0597e24..f88701ee 100644
--- a/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp
+++ b/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp
@@ -928,7 +928,7 @@
     return TranslateTransformOperation::create(tx, ty, tz, TransformOperation::Translate3D);
 }
 
-PassRefPtr<RotateTransformOperation> StyleBuilderConverter::convertRotate(StyleResolverState& state, const CSSValue& value)
+Rotation StyleBuilderConverter::convertRotation(const CSSValue& value)
 {
     const CSSValueList& list = toCSSValueList(value);
     ASSERT(list.length() == 1 || list.length() == 4);
@@ -941,8 +941,12 @@
         y = toCSSPrimitiveValue(list.item(2))->getDoubleValue();
         z = toCSSPrimitiveValue(list.item(3))->getDoubleValue();
     }
+    return Rotation(FloatPoint3D(x, y, z), angle);
+}
 
-    return RotateTransformOperation::create(x, y, z, angle, TransformOperation::Rotate3D);
+PassRefPtr<RotateTransformOperation> StyleBuilderConverter::convertRotate(StyleResolverState& state, const CSSValue& value)
+{
+    return RotateTransformOperation::create(convertRotation(value), TransformOperation::Rotate3D);
 }
 
 PassRefPtr<ScaleTransformOperation> StyleBuilderConverter::convertScale(StyleResolverState& state, const CSSValue& value)
diff --git a/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.h b/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.h
index 7fb05c2..b0bfc08 100644
--- a/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.h
+++ b/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.h
@@ -40,6 +40,7 @@
 #include "platform/LengthSize.h"
 #include "platform/fonts/FontDescription.h"
 #include "platform/text/TabSize.h"
+#include "platform/transforms/Rotation.h"
 #include "wtf/Allocator.h"
 
 namespace blink {
@@ -112,6 +113,7 @@
     static PassRefPtr<StylePath> convertPathOrNone(StyleResolverState&, const CSSValue&);
     static StyleMotionRotation convertMotionRotation(const CSSValue&);
     template <CSSValueID cssValueFor0, CSSValueID cssValueFor100> static Length convertPositionLength(StyleResolverState&, const CSSValue&);
+    static Rotation convertRotation(const CSSValue&);
 };
 
 template <typename T>
diff --git a/third_party/WebKit/Source/core/css/resolver/StyleResolver.cpp b/third_party/WebKit/Source/core/css/resolver/StyleResolver.cpp
index 1be5fad..fae3e66 100644
--- a/third_party/WebKit/Source/core/css/resolver/StyleResolver.cpp
+++ b/third_party/WebKit/Source/core/css/resolver/StyleResolver.cpp
@@ -1724,7 +1724,6 @@
 
 DEFINE_TRACE(StyleResolver)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_matchedPropertiesCache);
     visitor->trace(m_medium);
     visitor->trace(m_viewportDependentMediaQueryResults);
@@ -1739,7 +1738,6 @@
     visitor->trace(m_styleSharingLists);
     visitor->trace(m_pendingStyleSheets);
     visitor->trace(m_document);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index f1a07252..5598d4f 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -5063,7 +5063,7 @@
         enforceSuborigin(*getSecurityOrigin()->suborigin());
 }
 
-void Document::initContentSecurityPolicy(RawPtr<ContentSecurityPolicy> csp)
+void Document::initContentSecurityPolicy(ContentSecurityPolicy* csp)
 {
     setContentSecurityPolicy(csp ? csp : ContentSecurityPolicy::create());
     if (m_frame && m_frame->tree().parent() && m_frame->tree().parent()->isLocalFrame()) {
diff --git a/third_party/WebKit/Source/core/dom/Document.h b/third_party/WebKit/Source/core/dom/Document.h
index 5b7e5af..5726efc0 100644
--- a/third_party/WebKit/Source/core/dom/Document.h
+++ b/third_party/WebKit/Source/core/dom/Document.h
@@ -858,7 +858,7 @@
     const SVGDocumentExtensions* svgExtensions();
     SVGDocumentExtensions& accessSVGExtensions();
 
-    void initContentSecurityPolicy(RawPtr<ContentSecurityPolicy> = nullptr);
+    void initContentSecurityPolicy(ContentSecurityPolicy* = nullptr);
 
     bool isSecureTransitionTo(const KURL&) const;
 
diff --git a/third_party/WebKit/Source/core/dom/DocumentOrderedList.cpp b/third_party/WebKit/Source/core/dom/DocumentOrderedList.cpp
index 645ed16..aa853789c 100644
--- a/third_party/WebKit/Source/core/dom/DocumentOrderedList.cpp
+++ b/third_party/WebKit/Source/core/dom/DocumentOrderedList.cpp
@@ -64,9 +64,7 @@
 
 DEFINE_TRACE(DocumentOrderedList)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_nodes);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/dom/DocumentOrderedMap.cpp b/third_party/WebKit/Source/core/dom/DocumentOrderedMap.cpp
index 7e7ed61..cb4a0a4 100644
--- a/third_party/WebKit/Source/core/dom/DocumentOrderedMap.cpp
+++ b/third_party/WebKit/Source/core/dom/DocumentOrderedMap.cpp
@@ -205,17 +205,13 @@
 
 DEFINE_TRACE(DocumentOrderedMap)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_map);
-#endif
 }
 
 DEFINE_TRACE(DocumentOrderedMap::MapEntry)
 {
     visitor->trace(element);
-#if ENABLE(OILPAN)
     visitor->trace(orderedList);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/dom/DocumentParser.cpp b/third_party/WebKit/Source/core/dom/DocumentParser.cpp
index 3b5a066..856191f 100644
--- a/third_party/WebKit/Source/core/dom/DocumentParser.cpp
+++ b/third_party/WebKit/Source/core/dom/DocumentParser.cpp
@@ -53,9 +53,7 @@
 DEFINE_TRACE(DocumentParser)
 {
     visitor->trace(m_document);
-#if ENABLE(OILPAN)
     visitor->trace(m_clients);
-#endif
 }
 
 void DocumentParser::setDecoder(PassOwnPtr<TextResourceDecoder>)
diff --git a/third_party/WebKit/Source/core/dom/Element.cpp b/third_party/WebKit/Source/core/dom/Element.cpp
index 1d8eb54..aaa0de22 100644
--- a/third_party/WebKit/Source/core/dom/Element.cpp
+++ b/third_party/WebKit/Source/core/dom/Element.cpp
@@ -3667,11 +3667,9 @@
 
 DEFINE_TRACE(Element)
 {
-#if ENABLE(OILPAN)
     if (hasRareData())
         visitor->trace(elementRareData());
     visitor->trace(m_elementData);
-#endif
     ContainerNode::trace(visitor);
 }
 
diff --git a/third_party/WebKit/Source/core/dom/ElementDataCache.cpp b/third_party/WebKit/Source/core/dom/ElementDataCache.cpp
index 1cde844c..3cc041fd 100644
--- a/third_party/WebKit/Source/core/dom/ElementDataCache.cpp
+++ b/third_party/WebKit/Source/core/dom/ElementDataCache.cpp
@@ -64,9 +64,7 @@
 
 DEFINE_TRACE(ElementDataCache)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_shareableElementDataCache);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/dom/ElementRareData.cpp b/third_party/WebKit/Source/core/dom/ElementRareData.cpp
index e415121..762b5968 100644
--- a/third_party/WebKit/Source/core/dom/ElementRareData.cpp
+++ b/third_party/WebKit/Source/core/dom/ElementRareData.cpp
@@ -62,9 +62,7 @@
     visitor->trace(m_classList);
     visitor->trace(m_shadow);
     visitor->trace(m_attributeMap);
-#if ENABLE(OILPAN)
     visitor->trace(m_attrNodeList);
-#endif
     visitor->trace(m_elementAnimations);
     visitor->trace(m_cssomWrapper);
     visitor->trace(m_customElementDefinition);
diff --git a/third_party/WebKit/Source/core/dom/FrameRequestCallbackCollection.cpp b/third_party/WebKit/Source/core/dom/FrameRequestCallbackCollection.cpp
index f9e6469..e6f451f 100644
--- a/third_party/WebKit/Source/core/dom/FrameRequestCallbackCollection.cpp
+++ b/third_party/WebKit/Source/core/dom/FrameRequestCallbackCollection.cpp
@@ -75,11 +75,9 @@
 
 DEFINE_TRACE(FrameRequestCallbackCollection)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_callbacks);
     visitor->trace(m_callbacksToInvoke);
     visitor->trace(m_context);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/dom/Fullscreen.cpp b/third_party/WebKit/Source/core/dom/Fullscreen.cpp
index 56cd0441..a51865e 100644
--- a/third_party/WebKit/Source/core/dom/Fullscreen.cpp
+++ b/third_party/WebKit/Source/core/dom/Fullscreen.cpp
@@ -610,11 +610,9 @@
 
 DEFINE_TRACE(Fullscreen)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_fullScreenElement);
     visitor->trace(m_fullScreenElementStack);
     visitor->trace(m_eventQueue);
-#endif
     Supplement<Document>::trace(visitor);
     DocumentLifecycleObserver::trace(visitor);
 }
diff --git a/third_party/WebKit/Source/core/dom/IdTargetObserverRegistry.cpp b/third_party/WebKit/Source/core/dom/IdTargetObserverRegistry.cpp
index 85cdd6c..9007eda 100644
--- a/third_party/WebKit/Source/core/dom/IdTargetObserverRegistry.cpp
+++ b/third_party/WebKit/Source/core/dom/IdTargetObserverRegistry.cpp
@@ -36,10 +36,8 @@
 
 DEFINE_TRACE(IdTargetObserverRegistry)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_registry);
     visitor->trace(m_notifyingObserversInSet);
-#endif
 }
 
 void IdTargetObserverRegistry::addObserver(const AtomicString& id, IdTargetObserver* observer)
diff --git a/third_party/WebKit/Source/core/dom/IntersectionObservation.cpp b/third_party/WebKit/Source/core/dom/IntersectionObservation.cpp
index 9222e00..3ecc33a 100644
--- a/third_party/WebKit/Source/core/dom/IntersectionObservation.cpp
+++ b/third_party/WebKit/Source/core/dom/IntersectionObservation.cpp
@@ -55,8 +55,7 @@
     LayoutObject* rootLayoutObject = m_observer->rootLayoutObject();
     if (rootLayoutObject->isLayoutView())
         rect = LayoutRect(toLayoutView(rootLayoutObject)->frameView()->visibleContentRect());
-    // TODO(szager): Obey the spec -- use content box for a scrolling element, border box otherwise.
-    else if (rootLayoutObject->isBox())
+    else if (rootLayoutObject->isBox() && rootLayoutObject->hasOverflowClip())
         rect = LayoutRect(toLayoutBox(rootLayoutObject)->contentBoxRect());
     else
         rect = LayoutRect(toLayoutBoxModelObject(rootLayoutObject)->borderBoundingBox());
diff --git a/third_party/WebKit/Source/core/dom/IntersectionObserver.cpp b/third_party/WebKit/Source/core/dom/IntersectionObserver.cpp
index 25fa579..c784a1c 100644
--- a/third_party/WebKit/Source/core/dom/IntersectionObserver.cpp
+++ b/third_party/WebKit/Source/core/dom/IntersectionObserver.cpp
@@ -308,9 +308,7 @@
 
 DEFINE_TRACE(IntersectionObserver)
 {
-#if ENABLE(OILPAN)
     visitor->template registerWeakMembers<IntersectionObserver, &IntersectionObserver::clearWeakMembers>(this);
-#endif
     visitor->trace(m_callback);
     visitor->trace(m_observations);
     visitor->trace(m_entries);
diff --git a/third_party/WebKit/Source/core/dom/MutationObserver.cpp b/third_party/WebKit/Source/core/dom/MutationObserver.cpp
index 5ba305a..7b233e00 100644
--- a/third_party/WebKit/Source/core/dom/MutationObserver.cpp
+++ b/third_party/WebKit/Source/core/dom/MutationObserver.cpp
@@ -269,12 +269,10 @@
 
 DEFINE_TRACE(MutationObserver)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_callback);
     visitor->trace(m_records);
     visitor->trace(m_registrations);
     visitor->trace(m_callback);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/dom/MutationObserverInterestGroup.cpp b/third_party/WebKit/Source/core/dom/MutationObserverInterestGroup.cpp
index b3fb0de..dd5f826 100644
--- a/third_party/WebKit/Source/core/dom/MutationObserverInterestGroup.cpp
+++ b/third_party/WebKit/Source/core/dom/MutationObserverInterestGroup.cpp
@@ -83,9 +83,7 @@
 
 DEFINE_TRACE(MutationObserverInterestGroup)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_observers);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/dom/MutationObserverRegistration.cpp b/third_party/WebKit/Source/core/dom/MutationObserverRegistration.cpp
index 74012d4..2d0c04f 100644
--- a/third_party/WebKit/Source/core/dom/MutationObserverRegistration.cpp
+++ b/third_party/WebKit/Source/core/dom/MutationObserverRegistration.cpp
@@ -144,9 +144,7 @@
     visitor->trace(m_observer);
     visitor->trace(m_registrationNode);
     visitor->trace(m_registrationNodeKeepAlive);
-#if ENABLE(OILPAN)
     visitor->trace(m_transientRegistrationNodes);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/dom/Node.cpp b/third_party/WebKit/Source/core/dom/Node.cpp
index e277ee8..cfabb0f 100644
--- a/third_party/WebKit/Source/core/dom/Node.cpp
+++ b/third_party/WebKit/Source/core/dom/Node.cpp
@@ -2368,7 +2368,6 @@
 
 DEFINE_TRACE(Node)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_parentOrShadowHostNode);
     visitor->trace(m_previous);
     visitor->trace(m_next);
@@ -2378,7 +2377,6 @@
         visitor->trace(rareData());
 
     visitor->trace(m_treeScope);
-#endif
     EventTarget::trace(visitor);
 }
 
diff --git a/third_party/WebKit/Source/core/dom/NodeListsNodeData.cpp b/third_party/WebKit/Source/core/dom/NodeListsNodeData.cpp
index 5f2c584..fc93217d 100644
--- a/third_party/WebKit/Source/core/dom/NodeListsNodeData.cpp
+++ b/third_party/WebKit/Source/core/dom/NodeListsNodeData.cpp
@@ -46,11 +46,9 @@
 
 DEFINE_TRACE(NodeListsNodeData)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_childNodeList);
     visitor->trace(m_atomicNameCaches);
     visitor->trace(m_tagCollectionCacheNS);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/dom/NodeRareData.h b/third_party/WebKit/Source/core/dom/NodeRareData.h
index a85bd3ac..ac84de9 100644
--- a/third_party/WebKit/Source/core/dom/NodeRareData.h
+++ b/third_party/WebKit/Source/core/dom/NodeRareData.h
@@ -44,10 +44,8 @@
 
     DEFINE_INLINE_TRACE()
     {
-#if ENABLE(OILPAN)
         visitor->trace(registry);
         visitor->trace(transientRegistry);
-#endif
     }
 
 private:
diff --git a/third_party/WebKit/Source/core/dom/NthIndexCache.cpp b/third_party/WebKit/Source/core/dom/NthIndexCache.cpp
index 76c2cbd..b2fa3d5 100644
--- a/third_party/WebKit/Source/core/dom/NthIndexCache.cpp
+++ b/third_party/WebKit/Source/core/dom/NthIndexCache.cpp
@@ -256,9 +256,7 @@
 
 DEFINE_TRACE(NthIndexData)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_elementIndexMap);
-#endif
 }
 
 #if !ENABLE(OILPAN)
diff --git a/third_party/WebKit/Source/core/dom/ScriptRunner.cpp b/third_party/WebKit/Source/core/dom/ScriptRunner.cpp
index 38d9117..3c67e0fb 100644
--- a/third_party/WebKit/Source/core/dom/ScriptRunner.cpp
+++ b/third_party/WebKit/Source/core/dom/ScriptRunner.cpp
@@ -281,13 +281,11 @@
 
 DEFINE_TRACE(ScriptRunner)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_document);
     visitor->trace(m_pendingInOrderScripts);
     visitor->trace(m_pendingAsyncScripts);
     visitor->trace(m_asyncScriptsToExecuteSoon);
     visitor->trace(m_inOrderScriptsToExecuteSoon);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/dom/ScriptedAnimationController.cpp b/third_party/WebKit/Source/core/dom/ScriptedAnimationController.cpp
index 98339e6..989f2ff6 100644
--- a/third_party/WebKit/Source/core/dom/ScriptedAnimationController.cpp
+++ b/third_party/WebKit/Source/core/dom/ScriptedAnimationController.cpp
@@ -52,13 +52,11 @@
 
 DEFINE_TRACE(ScriptedAnimationController)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_document);
     visitor->trace(m_callbackCollection);
     visitor->trace(m_eventQueue);
     visitor->trace(m_mediaQueryListListeners);
     visitor->trace(m_perFrameEvents);
-#endif
 }
 
 void ScriptedAnimationController::suspend()
diff --git a/third_party/WebKit/Source/core/dom/StyleEngine.cpp b/third_party/WebKit/Source/core/dom/StyleEngine.cpp
index 35f85b6..9938cdf 100644
--- a/third_party/WebKit/Source/core/dom/StyleEngine.cpp
+++ b/third_party/WebKit/Source/core/dom/StyleEngine.cpp
@@ -794,7 +794,6 @@
 
 DEFINE_TRACE(StyleEngine)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_document);
     visitor->trace(m_injectedAuthorStyleSheets);
     visitor->trace(m_documentStyleSheetCollection);
@@ -806,7 +805,6 @@
     visitor->trace(m_fontSelector);
     visitor->trace(m_textToSheetCache);
     visitor->trace(m_sheetToTextCache);
-#endif
     CSSFontSelectorClient::trace(visitor);
 }
 
diff --git a/third_party/WebKit/Source/core/dom/UserActionElementSet.cpp b/third_party/WebKit/Source/core/dom/UserActionElementSet.cpp
index 44138f20..67873b94 100644
--- a/third_party/WebKit/Source/core/dom/UserActionElementSet.cpp
+++ b/third_party/WebKit/Source/core/dom/UserActionElementSet.cpp
@@ -119,9 +119,7 @@
 
 DEFINE_TRACE(UserActionElementSet)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_elements);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/dom/custom/CustomElementMicrotaskDispatcher.cpp b/third_party/WebKit/Source/core/dom/custom/CustomElementMicrotaskDispatcher.cpp
index de3b3c8..9f5e184 100644
--- a/third_party/WebKit/Source/core/dom/custom/CustomElementMicrotaskDispatcher.cpp
+++ b/third_party/WebKit/Source/core/dom/custom/CustomElementMicrotaskDispatcher.cpp
@@ -80,9 +80,7 @@
 
 DEFINE_TRACE(CustomElementMicrotaskDispatcher)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_elements);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/dom/custom/CustomElementRegistry.cpp b/third_party/WebKit/Source/core/dom/custom/CustomElementRegistry.cpp
index 15b331c..c78a7e5 100644
--- a/third_party/WebKit/Source/core/dom/custom/CustomElementRegistry.cpp
+++ b/third_party/WebKit/Source/core/dom/custom/CustomElementRegistry.cpp
@@ -99,9 +99,7 @@
 
 DEFINE_TRACE(CustomElementRegistry)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_definitions);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/dom/custom/CustomElementUpgradeCandidateMap.cpp b/third_party/WebKit/Source/core/dom/custom/CustomElementUpgradeCandidateMap.cpp
index 0ec63a9b..6588a69 100644
--- a/third_party/WebKit/Source/core/dom/custom/CustomElementUpgradeCandidateMap.cpp
+++ b/third_party/WebKit/Source/core/dom/custom/CustomElementUpgradeCandidateMap.cpp
@@ -94,10 +94,8 @@
 
 DEFINE_TRACE(CustomElementUpgradeCandidateMap)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_upgradeCandidates);
     visitor->trace(m_unresolvedDefinitions);
-#endif
     CustomElementObserver::trace(visitor);
 }
 
diff --git a/third_party/WebKit/Source/core/dom/shadow/DistributedNodes.cpp b/third_party/WebKit/Source/core/dom/shadow/DistributedNodes.cpp
index 29af2089..8abccda7 100644
--- a/third_party/WebKit/Source/core/dom/shadow/DistributedNodes.cpp
+++ b/third_party/WebKit/Source/core/dom/shadow/DistributedNodes.cpp
@@ -72,10 +72,8 @@
 
 DEFINE_TRACE(DistributedNodes)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_nodes);
     visitor->trace(m_indices);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/dom/shadow/ElementShadow.cpp b/third_party/WebKit/Source/core/dom/shadow/ElementShadow.cpp
index 2c5f2ca..24a59a2 100644
--- a/third_party/WebKit/Source/core/dom/shadow/ElementShadow.cpp
+++ b/third_party/WebKit/Source/core/dom/shadow/ElementShadow.cpp
@@ -396,7 +396,6 @@
 
 DEFINE_TRACE(ElementShadow)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_nodeToInsertionPoints);
     visitor->trace(m_selectFeatures);
     // Shadow roots are linked with previous and next pointers which are traced.
@@ -404,7 +403,6 @@
     // rest will be traced from there.
     visitor->trace(m_shadowRoots.head());
     visitor->trace(m_slotAssignment);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/dom/shadow/ShadowRootRareData.h b/third_party/WebKit/Source/core/dom/shadow/ShadowRootRareData.h
index 28e456d..a01cc2ef 100644
--- a/third_party/WebKit/Source/core/dom/shadow/ShadowRootRareData.h
+++ b/third_party/WebKit/Source/core/dom/shadow/ShadowRootRareData.h
@@ -115,15 +115,15 @@
 inline void ShadowRootRareData::didRemoveInsertionPoint(InsertionPoint* point)
 {
     ASSERT(point);
-    if (isHTMLShadowElement(*point))
+    if (isHTMLShadowElement(*point)) {
+        ASSERT(m_descendantShadowElementCount > 0);
         --m_descendantShadowElementCount;
-    else if (isHTMLContentElement(*point))
+    } else if (isHTMLContentElement(*point)) {
+        ASSERT(m_descendantContentElementCount > 0);
         --m_descendantContentElementCount;
-    else
+    } else {
         ASSERT_NOT_REACHED();
-
-    ASSERT(m_descendantContentElementCount >= 0);
-    ASSERT(m_descendantShadowElementCount >= 0);
+    }
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp b/third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp
index 8f0dfab1..386b0fe2 100644
--- a/third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp
+++ b/third_party/WebKit/Source/core/dom/shadow/SlotAssignment.cpp
@@ -100,9 +100,7 @@
 
 DEFINE_TRACE(SlotAssignment)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_assignment);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/editing/markers/DocumentMarkerController.cpp b/third_party/WebKit/Source/core/editing/markers/DocumentMarkerController.cpp
index 790ea770..768821c 100644
--- a/third_party/WebKit/Source/core/editing/markers/DocumentMarkerController.cpp
+++ b/third_party/WebKit/Source/core/editing/markers/DocumentMarkerController.cpp
@@ -509,9 +509,7 @@
 
 DEFINE_TRACE(DocumentMarkerController)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_markers);
-#endif
 }
 
 void DocumentMarkerController::removeMarkers(Node* node, DocumentMarker::MarkerTypes markerTypes)
diff --git a/third_party/WebKit/Source/core/events/DOMWindowEventQueue.cpp b/third_party/WebKit/Source/core/events/DOMWindowEventQueue.cpp
index 072ca42..ecda176e 100644
--- a/third_party/WebKit/Source/core/events/DOMWindowEventQueue.cpp
+++ b/third_party/WebKit/Source/core/events/DOMWindowEventQueue.cpp
@@ -76,10 +76,8 @@
 
 DEFINE_TRACE(DOMWindowEventQueue)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_pendingEventTimer);
     visitor->trace(m_queuedEvents);
-#endif
     EventQueue::trace(visitor);
 }
 
diff --git a/third_party/WebKit/Source/core/events/EventPath.cpp b/third_party/WebKit/Source/core/events/EventPath.cpp
index 67d80dd..085d0689a 100644
--- a/third_party/WebKit/Source/core/events/EventPath.cpp
+++ b/third_party/WebKit/Source/core/events/EventPath.cpp
@@ -376,13 +376,11 @@
 
 DEFINE_TRACE(EventPath)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_nodeEventContexts);
     visitor->trace(m_node);
     visitor->trace(m_event);
     visitor->trace(m_treeScopeEventContexts);
     visitor->trace(m_windowEventContext);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/events/MessageEvent.cpp b/third_party/WebKit/Source/core/events/MessageEvent.cpp
index 4c984ac..d1107f5 100644
--- a/third_party/WebKit/Source/core/events/MessageEvent.cpp
+++ b/third_party/WebKit/Source/core/events/MessageEvent.cpp
@@ -207,9 +207,7 @@
 {
     visitor->trace(m_dataAsBlob);
     visitor->trace(m_source);
-#if ENABLE(OILPAN)
     visitor->trace(m_ports);
-#endif
     Event::trace(visitor);
 }
 
diff --git a/third_party/WebKit/Source/core/events/TreeScopeEventContext.cpp b/third_party/WebKit/Source/core/events/TreeScopeEventContext.cpp
index d0d7482..fbe7465 100644
--- a/third_party/WebKit/Source/core/events/TreeScopeEventContext.cpp
+++ b/third_party/WebKit/Source/core/events/TreeScopeEventContext.cpp
@@ -104,9 +104,7 @@
     visitor->trace(m_eventPath);
     visitor->trace(m_touchEventContext);
     visitor->trace(m_containingClosedShadowTree);
-#if ENABLE(OILPAN)
     visitor->trace(m_children);
-#endif
 }
 
 int TreeScopeEventContext::calculateTreeOrderAndSetNearestAncestorClosedTree(int orderNumber, TreeScopeEventContext* nearestAncestorClosedTreeScopeEventContext)
diff --git a/third_party/WebKit/Source/core/fetch/Resource.cpp b/third_party/WebKit/Source/core/fetch/Resource.cpp
index ed78f21..931a415 100644
--- a/third_party/WebKit/Source/core/fetch/Resource.cpp
+++ b/third_party/WebKit/Source/core/fetch/Resource.cpp
@@ -118,9 +118,7 @@
 
 DEFINE_TRACE(Resource::CacheHandler)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_resource);
-#endif
     CachedMetadataHandler::trace(visitor);
 }
 
@@ -261,9 +259,7 @@
 DEFINE_TRACE(Resource)
 {
     visitor->trace(m_loader);
-#if ENABLE(OILPAN)
     visitor->trace(m_cacheHandler);
-#endif
 }
 
 void Resource::load(ResourceFetcher* fetcher)
diff --git a/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp b/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
index 22cf53e..2724a7d 100644
--- a/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
+++ b/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
@@ -1192,11 +1192,9 @@
     visitor->trace(m_archive);
     visitor->trace(m_loaders);
     visitor->trace(m_nonBlockingLoaders);
-#if ENABLE(OILPAN)
     visitor->trace(m_documentResources);
     visitor->trace(m_preloads);
     visitor->trace(m_resourceTimingInfoMap);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/fileapi/FileReader.cpp b/third_party/WebKit/Source/core/fileapi/FileReader.cpp
index 542428e..3b455487 100644
--- a/third_party/WebKit/Source/core/fileapi/FileReader.cpp
+++ b/third_party/WebKit/Source/core/fileapi/FileReader.cpp
@@ -123,10 +123,8 @@
 
     DEFINE_INLINE_TRACE()
     {
-#if ENABLE(OILPAN)
         visitor->trace(m_pendingReaders);
         visitor->trace(m_runningReaders);
-#endif
         Supplement<ExecutionContext>::trace(visitor);
     }
 
diff --git a/third_party/WebKit/Source/core/frame/BarProp.h b/third_party/WebKit/Source/core/frame/BarProp.h
index 13152c6..3dde0a0c 100644
--- a/third_party/WebKit/Source/core/frame/BarProp.h
+++ b/third_party/WebKit/Source/core/frame/BarProp.h
@@ -45,7 +45,7 @@
 public:
     enum Type { Locationbar, Menubar, Personalbar, Scrollbars, Statusbar, Toolbar };
 
-    static RawPtr<BarProp> create(LocalFrame* frame, Type type)
+    static BarProp* create(LocalFrame* frame, Type type)
     {
         return new BarProp(frame, type);
     }
diff --git a/third_party/WebKit/Source/core/frame/Console.cpp b/third_party/WebKit/Source/core/frame/Console.cpp
index 8a99747..7b4b45a 100644
--- a/third_party/WebKit/Source/core/frame/Console.cpp
+++ b/third_party/WebKit/Source/core/frame/Console.cpp
@@ -66,7 +66,7 @@
     return frame()->document();
 }
 
-void Console::reportMessageToConsole(RawPtr<ConsoleMessage> consoleMessage)
+void Console::reportMessageToConsole(ConsoleMessage* consoleMessage)
 {
     if (!frame())
         return;
diff --git a/third_party/WebKit/Source/core/frame/Console.h b/third_party/WebKit/Source/core/frame/Console.h
index 6375e0e..f5194ef 100644
--- a/third_party/WebKit/Source/core/frame/Console.h
+++ b/third_party/WebKit/Source/core/frame/Console.h
@@ -55,7 +55,7 @@
 
 protected:
     ExecutionContext* context() override;
-    void reportMessageToConsole(RawPtr<ConsoleMessage>) override;
+    void reportMessageToConsole(ConsoleMessage*) override;
 
 private:
     explicit Console(LocalFrame*);
diff --git a/third_party/WebKit/Source/core/frame/ConsoleBase.cpp b/third_party/WebKit/Source/core/frame/ConsoleBase.cpp
index d41e61f..9e47e83 100644
--- a/third_party/WebKit/Source/core/frame/ConsoleBase.cpp
+++ b/third_party/WebKit/Source/core/frame/ConsoleBase.cpp
@@ -43,57 +43,57 @@
 {
 }
 
-void ConsoleBase::debug(ScriptState* scriptState, RawPtr<ScriptArguments> arguments)
+void ConsoleBase::debug(ScriptState* scriptState, ScriptArguments* arguments)
 {
     internalAddMessage(LogMessageType, DebugMessageLevel, scriptState, arguments);
 }
 
-void ConsoleBase::error(ScriptState* scriptState, RawPtr<ScriptArguments> arguments)
+void ConsoleBase::error(ScriptState* scriptState, ScriptArguments* arguments)
 {
     internalAddMessage(LogMessageType, ErrorMessageLevel, scriptState, arguments, false);
 }
 
-void ConsoleBase::info(ScriptState* scriptState, RawPtr<ScriptArguments> arguments)
+void ConsoleBase::info(ScriptState* scriptState, ScriptArguments* arguments)
 {
     internalAddMessage(LogMessageType, InfoMessageLevel, scriptState, arguments);
 }
 
-void ConsoleBase::log(ScriptState* scriptState, RawPtr<ScriptArguments> arguments)
+void ConsoleBase::log(ScriptState* scriptState, ScriptArguments* arguments)
 {
     internalAddMessage(LogMessageType, LogMessageLevel, scriptState, arguments);
 }
 
-void ConsoleBase::warn(ScriptState* scriptState, RawPtr<ScriptArguments> arguments)
+void ConsoleBase::warn(ScriptState* scriptState, ScriptArguments* arguments)
 {
     internalAddMessage(LogMessageType, WarningMessageLevel, scriptState, arguments);
 }
 
-void ConsoleBase::dir(ScriptState* scriptState, RawPtr<ScriptArguments> arguments)
+void ConsoleBase::dir(ScriptState* scriptState, ScriptArguments* arguments)
 {
     internalAddMessage(DirMessageType, LogMessageLevel, scriptState, arguments);
 }
 
-void ConsoleBase::dirxml(ScriptState* scriptState, RawPtr<ScriptArguments> arguments)
+void ConsoleBase::dirxml(ScriptState* scriptState, ScriptArguments* arguments)
 {
     internalAddMessage(DirXMLMessageType, LogMessageLevel, scriptState, arguments);
 }
 
-void ConsoleBase::table(ScriptState* scriptState, RawPtr<ScriptArguments> arguments)
+void ConsoleBase::table(ScriptState* scriptState, ScriptArguments* arguments)
 {
     internalAddMessage(TableMessageType, LogMessageLevel, scriptState, arguments);
 }
 
-void ConsoleBase::clear(ScriptState* scriptState, RawPtr<ScriptArguments> arguments)
+void ConsoleBase::clear(ScriptState* scriptState, ScriptArguments* arguments)
 {
     internalAddMessage(ClearMessageType, LogMessageLevel, scriptState, arguments, true);
 }
 
-void ConsoleBase::trace(ScriptState* scriptState, RawPtr<ScriptArguments> arguments)
+void ConsoleBase::trace(ScriptState* scriptState, ScriptArguments* arguments)
 {
     internalAddMessage(TraceMessageType, LogMessageLevel, scriptState, arguments, true);
 }
 
-void ConsoleBase::assertCondition(ScriptState* scriptState, RawPtr<ScriptArguments> arguments, bool condition)
+void ConsoleBase::assertCondition(ScriptState* scriptState, ScriptArguments* arguments, bool condition)
 {
     if (condition)
         return;
@@ -101,7 +101,7 @@
     internalAddMessage(AssertMessageType, ErrorMessageLevel, scriptState, arguments, true);
 }
 
-void ConsoleBase::count(ScriptState* scriptState, RawPtr<ScriptArguments> arguments)
+void ConsoleBase::count(ScriptState* scriptState, ScriptArguments* arguments)
 {
     RefPtr<ScriptCallStack> callStack(ScriptCallStack::capture(1));
     // Follow Firebug's behavior of counting with null and undefined title in
@@ -114,11 +114,11 @@
     HashCountedSet<String>::AddResult result = m_counts.add(identifier);
     String message = title + ": " + String::number(result.storedValue->value);
 
-    RawPtr<ConsoleMessage> consoleMessage = ConsoleMessage::create(ConsoleAPIMessageSource, DebugMessageLevel, message);
+    ConsoleMessage* consoleMessage = ConsoleMessage::create(ConsoleAPIMessageSource, DebugMessageLevel, message);
     consoleMessage->setType(CountMessageType);
     consoleMessage->setScriptState(scriptState);
     consoleMessage->setCallStack(callStack.release());
-    reportMessageToConsole(consoleMessage.release());
+    reportMessageToConsole(consoleMessage);
 }
 
 void ConsoleBase::markTimeline(const String& title)
@@ -165,11 +165,11 @@
     double elapsed = monotonicallyIncreasingTime() - startTime;
     String message = title + String::format(": %.3fms", elapsed * 1000);
 
-    RawPtr<ConsoleMessage> consoleMessage = ConsoleMessage::create(ConsoleAPIMessageSource, DebugMessageLevel, message);
+    ConsoleMessage* consoleMessage = ConsoleMessage::create(ConsoleAPIMessageSource, DebugMessageLevel, message);
     consoleMessage->setType(TimeEndMessageType);
     consoleMessage->setScriptState(scriptState);
     consoleMessage->setCallStack(ScriptCallStack::capture(1));
-    reportMessageToConsole(consoleMessage.release());
+    reportMessageToConsole(consoleMessage);
 }
 
 void ConsoleBase::timeStamp(const String& title)
@@ -192,12 +192,12 @@
     TRACE_EVENT_COPY_ASYNC_END0("blink.console", formatTimelineTitle(title).utf8().data(), this);
 }
 
-void ConsoleBase::group(ScriptState* scriptState, RawPtr<ScriptArguments> arguments)
+void ConsoleBase::group(ScriptState* scriptState, ScriptArguments* arguments)
 {
     internalAddMessage(StartGroupMessageType, LogMessageLevel, scriptState, arguments, true);
 }
 
-void ConsoleBase::groupCollapsed(ScriptState* scriptState, RawPtr<ScriptArguments> arguments)
+void ConsoleBase::groupCollapsed(ScriptState* scriptState, ScriptArguments* arguments)
 {
     internalAddMessage(StartGroupCollapsedMessageType, LogMessageLevel, scriptState, arguments, true);
 }
@@ -207,24 +207,24 @@
     internalAddMessage(EndGroupMessageType, LogMessageLevel, nullptr, nullptr, true);
 }
 
-void ConsoleBase::internalAddMessage(MessageType type, MessageLevel level, ScriptState* scriptState, RawPtr<ScriptArguments> scriptArguments, bool acceptNoArguments)
+void ConsoleBase::internalAddMessage(MessageType type, MessageLevel level, ScriptState* scriptState, ScriptArguments* scriptArguments, bool acceptNoArguments)
 {
-    RawPtr<ScriptArguments> arguments = scriptArguments;
+    ScriptArguments* arguments = scriptArguments;
     if (!acceptNoArguments && (!arguments || !arguments->argumentCount()))
         return;
 
     if (scriptState && !scriptState->contextIsValid())
-        arguments.clear();
+        arguments = nullptr;
     String message;
     if (arguments)
         arguments->getFirstArgumentAsString(message);
 
-    RawPtr<ConsoleMessage> consoleMessage = ConsoleMessage::create(ConsoleAPIMessageSource, level, message);
+    ConsoleMessage* consoleMessage = ConsoleMessage::create(ConsoleAPIMessageSource, level, message);
     consoleMessage->setType(type);
     consoleMessage->setScriptState(scriptState);
     consoleMessage->setScriptArguments(arguments);
     consoleMessage->setCallStack(ScriptCallStack::captureForConsole());
-    reportMessageToConsole(consoleMessage.release());
+    reportMessageToConsole(consoleMessage);
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/frame/ConsoleBase.h b/third_party/WebKit/Source/core/frame/ConsoleBase.h
index 6ea355d..f2839bf9 100644
--- a/third_party/WebKit/Source/core/frame/ConsoleBase.h
+++ b/third_party/WebKit/Source/core/frame/ConsoleBase.h
@@ -47,18 +47,18 @@
 class CORE_EXPORT ConsoleBase : public GarbageCollectedFinalized<ConsoleBase>, public ScriptWrappable {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    void debug(ScriptState*, RawPtr<ScriptArguments>);
-    void error(ScriptState*, RawPtr<ScriptArguments>);
-    void info(ScriptState*, RawPtr<ScriptArguments>);
-    void log(ScriptState*, RawPtr<ScriptArguments>);
-    void clear(ScriptState*, RawPtr<ScriptArguments>);
-    void warn(ScriptState*, RawPtr<ScriptArguments>);
-    void dir(ScriptState*, RawPtr<ScriptArguments>);
-    void dirxml(ScriptState*, RawPtr<ScriptArguments>);
-    void table(ScriptState*, RawPtr<ScriptArguments>);
-    void trace(ScriptState*, RawPtr<ScriptArguments>);
-    void assertCondition(ScriptState*, RawPtr<ScriptArguments>, bool condition);
-    void count(ScriptState*, RawPtr<ScriptArguments>);
+    void debug(ScriptState*, ScriptArguments*);
+    void error(ScriptState*, ScriptArguments*);
+    void info(ScriptState*, ScriptArguments*);
+    void log(ScriptState*, ScriptArguments*);
+    void clear(ScriptState*, ScriptArguments*);
+    void warn(ScriptState*, ScriptArguments*);
+    void dir(ScriptState*, ScriptArguments*);
+    void dirxml(ScriptState*, ScriptArguments*);
+    void table(ScriptState*, ScriptArguments*);
+    void trace(ScriptState*, ScriptArguments*);
+    void assertCondition(ScriptState*, ScriptArguments*, bool condition);
+    void count(ScriptState*, ScriptArguments*);
     void markTimeline(const String&);
     void profile(const String&);
     void profileEnd(const String&);
@@ -67,8 +67,8 @@
     void timeStamp(const String&);
     void timeline(ScriptState*, const String&);
     void timelineEnd(ScriptState*, const String&);
-    void group(ScriptState*, RawPtr<ScriptArguments>);
-    void groupCollapsed(ScriptState*, RawPtr<ScriptArguments>);
+    void group(ScriptState*, ScriptArguments*);
+    void groupCollapsed(ScriptState*, ScriptArguments*);
     void groupEnd();
 
     DEFINE_INLINE_VIRTUAL_TRACE() { }
@@ -77,10 +77,10 @@
 
 protected:
     virtual ExecutionContext* context() = 0;
-    virtual void reportMessageToConsole(RawPtr<ConsoleMessage>) = 0;
+    virtual void reportMessageToConsole(ConsoleMessage*) = 0;
 
 private:
-    void internalAddMessage(MessageType, MessageLevel, ScriptState*, RawPtr<ScriptArguments>, bool acceptNoArguments = false);
+    void internalAddMessage(MessageType, MessageLevel, ScriptState*, ScriptArguments*, bool acceptNoArguments = false);
 
     HashCountedSet<String> m_counts;
     HashMap<String, double> m_times;
diff --git a/third_party/WebKit/Source/core/frame/DOMTimer.cpp b/third_party/WebKit/Source/core/frame/DOMTimer.cpp
index 2b82589..6eccc775 100644
--- a/third_party/WebKit/Source/core/frame/DOMTimer.cpp
+++ b/third_party/WebKit/Source/core/frame/DOMTimer.cpp
@@ -51,7 +51,7 @@
         && nestingLevel == 1; // Gestures should not be forwarded to nested timers.
 }
 
-int DOMTimer::install(ExecutionContext* context, RawPtr<ScheduledAction> action, int timeout, bool singleShot)
+int DOMTimer::install(ExecutionContext* context, ScheduledAction* action, int timeout, bool singleShot)
 {
     int timeoutID = context->timers()->installNewTimeout(context, action, timeout, singleShot);
     TRACE_EVENT_INSTANT1("devtools.timeline", "TimerInstall", TRACE_EVENT_SCOPE_THREAD, "data", InspectorTimerInstallEvent::data(context, timeoutID, timeout, singleShot));
@@ -66,7 +66,7 @@
     InspectorInstrumentation::didRemoveTimer(context, timeoutID);
 }
 
-DOMTimer::DOMTimer(ExecutionContext* context, RawPtr<ScheduledAction> action, int interval, bool singleShot, int timeoutID)
+DOMTimer::DOMTimer(ExecutionContext* context, ScheduledAction* action, int interval, bool singleShot, int timeoutID)
     : SuspendableTimer(context)
     , m_timeoutID(timeoutID)
     , m_nestingLevel(context->timers()->timerNestingLevel() + 1)
@@ -124,11 +124,9 @@
         return;
     }
 
-    RawPtr<DOMTimer> protect(this);
-
     // Unregister the timer from ExecutionContext before executing the action
     // for one-shot timers.
-    RawPtr<ScheduledAction> action = m_action.release();
+    ScheduledAction* action = m_action.release();
     context->timers()->removeTimeoutByID(m_timeoutID);
 
     action->execute(context);
diff --git a/third_party/WebKit/Source/core/frame/DOMTimer.h b/third_party/WebKit/Source/core/frame/DOMTimer.h
index a38d65f..ad00b44 100644
--- a/third_party/WebKit/Source/core/frame/DOMTimer.h
+++ b/third_party/WebKit/Source/core/frame/DOMTimer.h
@@ -44,7 +44,7 @@
     USING_GARBAGE_COLLECTED_MIXIN(DOMTimer);
 public:
     // Creates a new timer owned by the ExecutionContext, starts it and returns its ID.
-    static int install(ExecutionContext*, RawPtr<ScheduledAction>, int timeout, bool singleShot);
+    static int install(ExecutionContext*, ScheduledAction*, int timeout, bool singleShot);
     static void removeByID(ExecutionContext*, int timeoutID);
 
     ~DOMTimer() override;
@@ -64,12 +64,12 @@
 private:
     friend class DOMTimerCoordinator; // For create().
 
-    static RawPtr<DOMTimer> create(ExecutionContext* context, RawPtr<ScheduledAction> action, int timeout, bool singleShot, int timeoutID)
+    static DOMTimer* create(ExecutionContext* context, ScheduledAction* action, int timeout, bool singleShot, int timeoutID)
     {
         return new DOMTimer(context, action, timeout, singleShot, timeoutID);
     }
 
-    DOMTimer(ExecutionContext*, RawPtr<ScheduledAction>, int interval, bool singleShot, int timeoutID);
+    DOMTimer(ExecutionContext*, ScheduledAction*, int interval, bool singleShot, int timeoutID);
     void fired() override;
 
     WebTaskRunner* timerTaskRunner() const override;
diff --git a/third_party/WebKit/Source/core/frame/DOMTimerCoordinator.cpp b/third_party/WebKit/Source/core/frame/DOMTimerCoordinator.cpp
index dd916ce4..e7238f90 100644
--- a/third_party/WebKit/Source/core/frame/DOMTimerCoordinator.cpp
+++ b/third_party/WebKit/Source/core/frame/DOMTimerCoordinator.cpp
@@ -17,7 +17,7 @@
 {
 }
 
-int DOMTimerCoordinator::installNewTimeout(ExecutionContext* context, RawPtr<ScheduledAction> action, int timeout, bool singleShot)
+int DOMTimerCoordinator::installNewTimeout(ExecutionContext* context, ScheduledAction* action, int timeout, bool singleShot)
 {
     // FIXME: DOMTimers depends heavily on ExecutionContext. Decouple them.
     ASSERT(context->timers() == this);
@@ -44,9 +44,7 @@
 
 DEFINE_TRACE(DOMTimerCoordinator)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_timers);
-#endif
 }
 
 int DOMTimerCoordinator::nextID()
diff --git a/third_party/WebKit/Source/core/frame/DOMTimerCoordinator.h b/third_party/WebKit/Source/core/frame/DOMTimerCoordinator.h
index ebe02147..a2d17b3 100644
--- a/third_party/WebKit/Source/core/frame/DOMTimerCoordinator.h
+++ b/third_party/WebKit/Source/core/frame/DOMTimerCoordinator.h
@@ -28,7 +28,7 @@
     explicit DOMTimerCoordinator(PassOwnPtr<WebTaskRunner>);
 
     // Creates and installs a new timer. Returns the assigned ID.
-    int installNewTimeout(ExecutionContext*, RawPtr<ScheduledAction>, int timeout, bool singleShot);
+    int installNewTimeout(ExecutionContext*, ScheduledAction*, int timeout, bool singleShot);
 
     // Removes and disposes the timer with the specified ID, if any. This may
     // destroy the timer.
diff --git a/third_party/WebKit/Source/core/frame/DOMWindow.cpp b/third_party/WebKit/Source/core/frame/DOMWindow.cpp
index c5781fad..8255c209 100644
--- a/third_party/WebKit/Source/core/frame/DOMWindow.cpp
+++ b/third_party/WebKit/Source/core/frame/DOMWindow.cpp
@@ -214,11 +214,11 @@
     else if (MixedContentChecker::isMixedContent(frame()->securityContext()->getSecurityOrigin(), sourceDocument->url()))
         UseCounter::count(frame(), UseCounter::PostMessageFromInsecureToSecure);
 
-    RawPtr<MessageEvent> event = MessageEvent::create(channels.release(), message, sourceOrigin, String(), source, sourceSuborigin);
+    MessageEvent* event = MessageEvent::create(channels.release(), message, sourceOrigin, String(), source, sourceSuborigin);
     // Give the embedder a chance to intercept this postMessage.  If the
     // target is a remote frame, the message will be forwarded through the
     // browser process.
-    if (frame()->client()->willCheckAndDispatchMessageEvent(target.get(), event.get(), source->document()->frame()))
+    if (frame()->client()->willCheckAndDispatchMessageEvent(target.get(), event, source->document()->frame()))
         return;
 
     // Capture stack trace only when inspector front-end is loaded as it may be time consuming.
diff --git a/third_party/WebKit/Source/core/frame/DOMWindow.h b/third_party/WebKit/Source/core/frame/DOMWindow.h
index 7f66a804..7461a06 100644
--- a/third_party/WebKit/Source/core/frame/DOMWindow.h
+++ b/third_party/WebKit/Source/core/frame/DOMWindow.h
@@ -157,13 +157,13 @@
     virtual void resizeBy(int x, int y) const = 0;
     virtual void resizeTo(int width, int height) const = 0;
 
-    virtual RawPtr<MediaQueryList> matchMedia(const String&) = 0;
+    virtual MediaQueryList* matchMedia(const String&) = 0;
 
     // DOM Level 2 Style Interface
-    virtual RawPtr<CSSStyleDeclaration> getComputedStyle(Element*, const String& pseudoElt) const = 0;
+    virtual CSSStyleDeclaration* getComputedStyle(Element*, const String& pseudoElt) const = 0;
 
     // WebKit extensions
-    virtual RawPtr<CSSRuleList> getMatchedCSSRules(Element*, const String& pseudoElt) const = 0;
+    virtual CSSRuleList* getMatchedCSSRules(Element*, const String& pseudoElt) const = 0;
 
     // WebKit animation extensions
     virtual int requestAnimationFrame(FrameRequestCallback*) = 0;
diff --git a/third_party/WebKit/Source/core/frame/DOMWindowTimers.cpp b/third_party/WebKit/Source/core/frame/DOMWindowTimers.cpp
index 24e1ee3..7efe08c 100644
--- a/third_party/WebKit/Source/core/frame/DOMWindowTimers.cpp
+++ b/third_party/WebKit/Source/core/frame/DOMWindowTimers.cpp
@@ -75,8 +75,8 @@
         // be done using the scheduler instead.
         V8GCForContextDispose::instance().notifyIdle();
     }
-    RawPtr<ScheduledAction> action = ScheduledAction::create(scriptState, handler, arguments);
-    return DOMTimer::install(executionContext, action.release(), timeout, true);
+    ScheduledAction* action = ScheduledAction::create(scriptState, handler, arguments);
+    return DOMTimer::install(executionContext, action, timeout, true);
 }
 
 int setTimeout(ScriptState* scriptState, EventTarget& eventTarget, const String& handler, int timeout, const Vector<ScriptValue>&)
@@ -93,8 +93,8 @@
         // be done using the scheduler instead.
         V8GCForContextDispose::instance().notifyIdle();
     }
-    RawPtr<ScheduledAction> action = ScheduledAction::create(scriptState, handler);
-    return DOMTimer::install(executionContext, action.release(), timeout, true);
+    ScheduledAction* action = ScheduledAction::create(scriptState, handler);
+    return DOMTimer::install(executionContext, action, timeout, true);
 }
 
 int setInterval(ScriptState* scriptState, EventTarget& eventTarget, const ScriptValue& handler, int timeout, const Vector<ScriptValue>& arguments)
@@ -102,8 +102,8 @@
     ExecutionContext* executionContext = eventTarget.getExecutionContext();
     if (!isAllowed(scriptState, executionContext, false))
         return 0;
-    RawPtr<ScheduledAction> action = ScheduledAction::create(scriptState, handler, arguments);
-    return DOMTimer::install(executionContext, action.release(), timeout, false);
+    ScheduledAction* action = ScheduledAction::create(scriptState, handler, arguments);
+    return DOMTimer::install(executionContext, action, timeout, false);
 }
 
 int setInterval(ScriptState* scriptState, EventTarget& eventTarget, const String& handler, int timeout, const Vector<ScriptValue>&)
@@ -115,8 +115,8 @@
     // perfomance issue.
     if (handler.isEmpty())
         return 0;
-    RawPtr<ScheduledAction> action = ScheduledAction::create(scriptState, handler);
-    return DOMTimer::install(executionContext, action.release(), timeout, false);
+    ScheduledAction* action = ScheduledAction::create(scriptState, handler);
+    return DOMTimer::install(executionContext, action, timeout, false);
 }
 
 void clearTimeout(EventTarget& eventTarget, int timeoutID)
diff --git a/third_party/WebKit/Source/core/frame/DeviceSingleWindowEventController.cpp b/third_party/WebKit/Source/core/frame/DeviceSingleWindowEventController.cpp
index 954cc88..cc50258 100644
--- a/third_party/WebKit/Source/core/frame/DeviceSingleWindowEventController.cpp
+++ b/third_party/WebKit/Source/core/frame/DeviceSingleWindowEventController.cpp
@@ -28,16 +28,15 @@
     dispatchDeviceEvent(lastEvent());
 }
 
-void DeviceSingleWindowEventController::dispatchDeviceEvent(RawPtr<Event> prpEvent)
+void DeviceSingleWindowEventController::dispatchDeviceEvent(Event* event)
 {
     if (!document().domWindow() || document().activeDOMObjectsAreSuspended() || document().activeDOMObjectsAreStopped())
         return;
 
-    RawPtr<Event> event = prpEvent;
     document().domWindow()->dispatchEvent(event);
 
     if (m_needsCheckingNullEvents) {
-        if (isNullEvent(event.get()))
+        if (isNullEvent(event))
             stopUpdating();
         else
             m_needsCheckingNullEvents = false;
diff --git a/third_party/WebKit/Source/core/frame/DeviceSingleWindowEventController.h b/third_party/WebKit/Source/core/frame/DeviceSingleWindowEventController.h
index 041c75d..4ceece7 100644
--- a/third_party/WebKit/Source/core/frame/DeviceSingleWindowEventController.h
+++ b/third_party/WebKit/Source/core/frame/DeviceSingleWindowEventController.h
@@ -33,9 +33,9 @@
 
     Document& document() const { return *m_document; }
 
-    void dispatchDeviceEvent(const RawPtr<Event>);
+    void dispatchDeviceEvent(Event*);
 
-    virtual RawPtr<Event> lastEvent() const = 0;
+    virtual Event* lastEvent() const = 0;
     virtual const AtomicString& eventTypeName() const = 0;
     virtual bool isNullEvent(Event*) const = 0;
 
diff --git a/third_party/WebKit/Source/core/frame/FrameConsole.cpp b/third_party/WebKit/Source/core/frame/FrameConsole.cpp
index cd96bf14..6229144e 100644
--- a/third_party/WebKit/Source/core/frame/FrameConsole.cpp
+++ b/third_party/WebKit/Source/core/frame/FrameConsole.cpp
@@ -69,9 +69,8 @@
 {
 }
 
-void FrameConsole::addMessage(RawPtr<ConsoleMessage> prpConsoleMessage)
+void FrameConsole::addMessage(ConsoleMessage* consoleMessage)
 {
-    RawPtr<ConsoleMessage> consoleMessage = prpConsoleMessage;
     if (muteCount && consoleMessage->source() != ConsoleAPIMessageSource)
         return;
 
@@ -128,9 +127,9 @@
     if (response.wasFallbackRequiredByServiceWorker())
         return;
     String message = "Failed to load resource: the server responded with a status of " + String::number(response.httpStatusCode()) + " (" + response.httpStatusText() + ')';
-    RawPtr<ConsoleMessage> consoleMessage = ConsoleMessage::create(NetworkMessageSource, ErrorMessageLevel, message, response.url().getString());
+    ConsoleMessage* consoleMessage = ConsoleMessage::create(NetworkMessageSource, ErrorMessageLevel, message, response.url().getString());
     consoleMessage->setRequestIdentifier(requestIdentifier);
-    addMessage(consoleMessage.release());
+    addMessage(consoleMessage);
 }
 
 void FrameConsole::mute()
@@ -178,9 +177,9 @@
         message.appendLiteral(": ");
         message.append(error.localizedDescription());
     }
-    RawPtr<ConsoleMessage> consoleMessage = ConsoleMessage::create(NetworkMessageSource, ErrorMessageLevel, message.toString(), error.failingURL());
+    ConsoleMessage* consoleMessage = ConsoleMessage::create(NetworkMessageSource, ErrorMessageLevel, message.toString(), error.failingURL());
     consoleMessage->setRequestIdentifier(requestIdentifier);
-    storage->reportMessage(m_frame->document(), consoleMessage.release());
+    storage->reportMessage(m_frame->document(), consoleMessage);
 }
 
 DEFINE_TRACE(FrameConsole)
diff --git a/third_party/WebKit/Source/core/frame/FrameConsole.h b/third_party/WebKit/Source/core/frame/FrameConsole.h
index 19e52b7e..56728344 100644
--- a/third_party/WebKit/Source/core/frame/FrameConsole.h
+++ b/third_party/WebKit/Source/core/frame/FrameConsole.h
@@ -50,12 +50,12 @@
 // It's meant as an abstraction around ChromeClient calls and the way that Blink core/ can add messages to the console.
 class CORE_EXPORT FrameConsole final : public GarbageCollected<FrameConsole> {
 public:
-    static RawPtr<FrameConsole> create(LocalFrame& frame)
+    static FrameConsole* create(LocalFrame& frame)
     {
         return new FrameConsole(frame);
     }
 
-    void addMessage(RawPtr<ConsoleMessage>);
+    void addMessage(ConsoleMessage*);
     void adoptWorkerMessagesAfterTermination(WorkerInspectorProxy*);
 
     void reportResourceResponseReceived(DocumentLoader*, unsigned long requestIdentifier, const ResourceResponse&);
diff --git a/third_party/WebKit/Source/core/frame/FrameHost.cpp b/third_party/WebKit/Source/core/frame/FrameHost.cpp
index 52ccca43..cf736ea3 100644
--- a/third_party/WebKit/Source/core/frame/FrameHost.cpp
+++ b/third_party/WebKit/Source/core/frame/FrameHost.cpp
@@ -40,7 +40,7 @@
 
 namespace blink {
 
-RawPtr<FrameHost> FrameHost::create(Page& page)
+FrameHost* FrameHost::create(Page& page)
 {
     return new FrameHost(page);
 }
diff --git a/third_party/WebKit/Source/core/frame/FrameHost.h b/third_party/WebKit/Source/core/frame/FrameHost.h
index 838ec18..40b4169 100644
--- a/third_party/WebKit/Source/core/frame/FrameHost.h
+++ b/third_party/WebKit/Source/core/frame/FrameHost.h
@@ -65,7 +65,7 @@
 class CORE_EXPORT FrameHost final : public GarbageCollectedFinalized<FrameHost> {
     WTF_MAKE_NONCOPYABLE(FrameHost);
 public:
-    static RawPtr<FrameHost> create(Page&);
+    static FrameHost* create(Page&);
     ~FrameHost();
 
     // Careful: This function will eventually be removed.
diff --git a/third_party/WebKit/Source/core/frame/FrameOwner.h b/third_party/WebKit/Source/core/frame/FrameOwner.h
index 2dfa9fe..18fa474 100644
--- a/third_party/WebKit/Source/core/frame/FrameOwner.h
+++ b/third_party/WebKit/Source/core/frame/FrameOwner.h
@@ -43,7 +43,7 @@
 class CORE_EXPORT DummyFrameOwner : public GarbageCollectedFinalized<DummyFrameOwner>, public FrameOwner {
     USING_GARBAGE_COLLECTED_MIXIN(DummyFrameOwner);
 public:
-    static RawPtr<DummyFrameOwner> create()
+    static DummyFrameOwner* create()
     {
         return new DummyFrameOwner;
     }
diff --git a/third_party/WebKit/Source/core/frame/FrameSerializer.cpp b/third_party/WebKit/Source/core/frame/FrameSerializer.cpp
index a944291..a088867 100644
--- a/third_party/WebKit/Source/core/frame/FrameSerializer.cpp
+++ b/third_party/WebKit/Source/core/frame/FrameSerializer.cpp
@@ -430,8 +430,8 @@
     // image properties there might be.
     unsigned propertyCount = styleDeclaration->propertyCount();
     for (unsigned i = 0; i < propertyCount; ++i) {
-        RawPtr<CSSValue> cssValue = styleDeclaration->propertyAt(i).value();
-        retrieveResourcesForCSSValue(cssValue.get(), document);
+        CSSValue* cssValue = styleDeclaration->propertyAt(i).value();
+        retrieveResourcesForCSSValue(cssValue, document);
     }
 }
 
diff --git a/third_party/WebKit/Source/core/frame/FrameView.cpp b/third_party/WebKit/Source/core/frame/FrameView.cpp
index 99641926..0f5a989 100644
--- a/third_party/WebKit/Source/core/frame/FrameView.cpp
+++ b/third_party/WebKit/Source/core/frame/FrameView.cpp
@@ -164,21 +164,21 @@
     init();
 }
 
-RawPtr<FrameView> FrameView::create(LocalFrame* frame)
+FrameView* FrameView::create(LocalFrame* frame)
 {
-    RawPtr<FrameView> view = new FrameView(frame);
+    FrameView* view = new FrameView(frame);
     view->show();
-    return view.release();
+    return view;
 }
 
-RawPtr<FrameView> FrameView::create(LocalFrame* frame, const IntSize& initialSize)
+FrameView* FrameView::create(LocalFrame* frame, const IntSize& initialSize)
 {
-    RawPtr<FrameView> view = new FrameView(frame);
+    FrameView* view = new FrameView(frame);
     view->Widget::setFrameRect(IntRect(view->location(), initialSize));
     view->setLayoutSizeInternal(initialSize);
 
     view->show();
-    return view.release();
+    return view;
 }
 
 FrameView::~FrameView()
@@ -193,7 +193,6 @@
 
 DEFINE_TRACE(FrameView)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_frame);
     visitor->trace(m_fragmentAnchor);
     visitor->trace(m_scrollableAreas);
@@ -204,7 +203,6 @@
     visitor->trace(m_children);
     visitor->trace(m_viewportScrollableArea);
     visitor->trace(m_scrollAnchor);
-#endif
     Widget::trace(visitor);
     ScrollableArea::trace(visitor);
 }
@@ -495,7 +493,7 @@
     return false;
 }
 
-RawPtr<Scrollbar> FrameView::createScrollbar(ScrollbarOrientation orientation)
+Scrollbar* FrameView::createScrollbar(ScrollbarOrientation orientation)
 {
     Element* customScrollbarElement = nullptr;
     LocalFrame* customScrollbarFrame = nullptr;
@@ -756,7 +754,7 @@
     // FrameView for a layout. After that the LayoutEmbeddedObject (ownerLayoutObject) carries the
     // correct size, which LayoutSVGRoot::computeReplacedLogicalWidth/Height rely on, when laying
     // out for the first time, or when the LayoutSVGRoot size has changed dynamically (eg. via <script>).
-    RawPtr<FrameView> frameView = ownerLayoutObject->frame()->view();
+    FrameView* frameView = ownerLayoutObject->frame()->view();
 
     // Mark the owner layoutObject as needing layout.
     ownerLayoutObject->setNeedsLayoutAndPrefWidthsRecalcAndFullPaintInvalidation(LayoutInvalidationReason::Unknown);
@@ -925,9 +923,6 @@
     TRACE_EVENT0("blink,benchmark", "FrameView::layout");
     TRACE_EVENT_SCOPED_SAMPLING_STATE("blink", "Layout");
 
-    // Protect the view from being deleted during layout (in recalcStyle)
-    RawPtr<FrameView> protector(this);
-
     if (m_autoSizeInfo)
         m_autoSizeInfo->autoSizeIfNeeded();
 
@@ -1610,8 +1605,6 @@
     if (!hasViewportConstrainedObjects())
         return;
 
-    RawPtr<FrameView> protect(this);
-
     // If there fixed position elements, scrolling may cause compositing layers to change.
     // Update widget and layer positions after scrolling, but only if we're not inside of
     // layout.
@@ -1906,7 +1899,7 @@
 
 void FrameView::scrollToFragmentAnchor()
 {
-    RawPtr<Node> anchorNode = m_fragmentAnchor;
+    Node* anchorNode = m_fragmentAnchor;
     if (!anchorNode)
         return;
 
@@ -1924,21 +1917,21 @@
                 rect = documentElement->boundingBox();
         }
 
-        RawPtr<Frame> boundaryFrame = m_frame->findUnsafeParentScrollPropagationBoundary();
+        Frame* boundaryFrame = m_frame->findUnsafeParentScrollPropagationBoundary();
 
         // FIXME: Handle RemoteFrames
         if (boundaryFrame && boundaryFrame->isLocalFrame())
-            toLocalFrame(boundaryFrame.get())->view()->setSafeToPropagateScrollToParent(false);
+            toLocalFrame(boundaryFrame)->view()->setSafeToPropagateScrollToParent(false);
 
         // Scroll nested layers and frames to reveal the anchor.
         // Align to the top and to the closest side (this matches other browsers).
         anchorNode->layoutObject()->scrollRectToVisible(rect, ScrollAlignment::alignToEdgeIfNeeded, ScrollAlignment::alignTopAlways);
 
         if (boundaryFrame && boundaryFrame->isLocalFrame())
-            toLocalFrame(boundaryFrame.get())->view()->setSafeToPropagateScrollToParent(true);
+            toLocalFrame(boundaryFrame)->view()->setSafeToPropagateScrollToParent(true);
 
         if (AXObjectCache* cache = m_frame->document()->existingAXObjectCache())
-            cache->handleScrolledToAnchor(anchorNode.get());
+            cache->handleScrolledToAnchor(anchorNode);
     }
 
     // The fragment anchor should only be maintained while the frame is still loading.
@@ -1988,7 +1981,6 @@
 void FrameView::updateWidgetsTimerFired(Timer<FrameView>*)
 {
     ASSERT(!isInPerformLayout());
-    RawPtr<FrameView> protect(this);
     m_updateWidgetsTimer.stop();
     for (unsigned i = 0; i < maxUpdateWidgetsIterations; ++i) {
         if (updateWidgets())
@@ -2021,7 +2013,6 @@
     // We should ASSERT(isActive()); or at least return early if we can!
     ASSERT(!isInPerformLayout()); // Always before or after performLayout(), part of the highest-level layout() call.
     TRACE_EVENT0("blink,benchmark", "FrameView::performPostLayoutTasks");
-    RawPtr<FrameView> protect(this);
 
     m_postLayoutTasksTimer.stop();
 
@@ -2413,9 +2404,6 @@
     // Otherwise the lifecycles of the frames might be out of sync.
     ASSERT(m_frame->isLocalRoot());
 
-    // Updating layout can run script, which can tear down the FrameView.
-    RawPtr<FrameView> protector(this);
-
     if (shouldThrottleRendering()) {
         updateViewportIntersectionsForSubtree(std::min(phases, OnlyUpToCompositingCleanPlusScrolling));
         return;
@@ -3065,12 +3053,11 @@
     return maximumPosition.expandedTo(minimumScrollPosition());
 }
 
-void FrameView::addChild(RawPtr<Widget> prpChild)
+void FrameView::addChild(Widget* child)
 {
-    Widget* child = prpChild.get();
     ASSERT(child != this && !child->parent());
     child->setParent(this);
-    m_children.add(prpChild);
+    m_children.add(child);
 }
 
 void FrameView::setHasHorizontalScrollbar(bool hasBar)
diff --git a/third_party/WebKit/Source/core/frame/FrameView.h b/third_party/WebKit/Source/core/frame/FrameView.h
index 087f54b..30ff045 100644
--- a/third_party/WebKit/Source/core/frame/FrameView.h
+++ b/third_party/WebKit/Source/core/frame/FrameView.h
@@ -91,8 +91,8 @@
     friend class LayoutPart; // for invalidateTreeIfNeeded
 
 public:
-    static RawPtr<FrameView> create(LocalFrame*);
-    static RawPtr<FrameView> create(LocalFrame*, const IntSize& initialSize);
+    static FrameView* create(LocalFrame*);
+    static FrameView* create(LocalFrame*, const IntSize& initialSize);
 
     ~FrameView() override;
 
@@ -111,7 +111,7 @@
 
     void setCanHaveScrollbars(bool);
 
-    RawPtr<Scrollbar> createScrollbar(ScrollbarOrientation);
+    Scrollbar* createScrollbar(ScrollbarOrientation);
 
     void setContentsSize(const IntSize&);
 
@@ -396,7 +396,7 @@
     // Functions for child manipulation and inspection.
     void setParent(Widget*) override;
     void removeChild(Widget*);
-    void addChild(RawPtr<Widget>);
+    void addChild(Widget*);
     const ChildrenWidgetSet* children() const { return &m_children; }
 
     // If the scroll view does not use a native widget, then it will have cross-platform Scrollbars. These functions
diff --git a/third_party/WebKit/Source/core/frame/FrameViewAutoSizeInfo.cpp b/third_party/WebKit/Source/core/frame/FrameViewAutoSizeInfo.cpp
index b714c0e0..dafc4eb 100644
--- a/third_party/WebKit/Source/core/frame/FrameViewAutoSizeInfo.cpp
+++ b/third_party/WebKit/Source/core/frame/FrameViewAutoSizeInfo.cpp
@@ -84,7 +84,7 @@
         // Since the dimensions are only for the view rectangle, once a
         // dimension exceeds the maximum, there is no need to increase it further.
         if (newSize.width() > m_maxAutoSize.width()) {
-            RawPtr<Scrollbar> localHorizontalScrollbar = m_frameView->horizontalScrollbar();
+            Scrollbar* localHorizontalScrollbar = m_frameView->horizontalScrollbar();
             if (!localHorizontalScrollbar)
                 localHorizontalScrollbar = m_frameView->createScrollbar(HorizontalScrollbar);
             if (!localHorizontalScrollbar->isOverlayScrollbar())
@@ -93,7 +93,7 @@
             // Don't bother checking for a vertical scrollbar because the width is at
             // already greater the maximum.
         } else if (newSize.height() > m_maxAutoSize.height()) {
-            RawPtr<Scrollbar> localVerticalScrollbar = m_frameView->verticalScrollbar();
+            Scrollbar* localVerticalScrollbar = m_frameView->verticalScrollbar();
             if (!localVerticalScrollbar)
                 localVerticalScrollbar = m_frameView->createScrollbar(VerticalScrollbar);
             if (!localVerticalScrollbar->isOverlayScrollbar())
diff --git a/third_party/WebKit/Source/core/frame/FrameViewAutoSizeInfo.h b/third_party/WebKit/Source/core/frame/FrameViewAutoSizeInfo.h
index efe9e11..a1eb3e8 100644
--- a/third_party/WebKit/Source/core/frame/FrameViewAutoSizeInfo.h
+++ b/third_party/WebKit/Source/core/frame/FrameViewAutoSizeInfo.h
@@ -18,7 +18,7 @@
 class FrameViewAutoSizeInfo final : public GarbageCollected<FrameViewAutoSizeInfo> {
     WTF_MAKE_NONCOPYABLE(FrameViewAutoSizeInfo);
 public:
-    static RawPtr<FrameViewAutoSizeInfo> create(FrameView* frameView)
+    static FrameViewAutoSizeInfo* create(FrameView* frameView)
     {
         return new FrameViewAutoSizeInfo(frameView);
     }
diff --git a/third_party/WebKit/Source/core/frame/ImageBitmap.cpp b/third_party/WebKit/Source/core/frame/ImageBitmap.cpp
index 9ba029c..16262f8 100644
--- a/third_party/WebKit/Source/core/frame/ImageBitmap.cpp
+++ b/third_party/WebKit/Source/core/frame/ImageBitmap.cpp
@@ -344,43 +344,43 @@
 {
 }
 
-RawPtr<ImageBitmap> ImageBitmap::create(HTMLImageElement* image, const IntRect& cropRect, Document* document, const ImageBitmapOptions& options)
+ImageBitmap* ImageBitmap::create(HTMLImageElement* image, const IntRect& cropRect, Document* document, const ImageBitmapOptions& options)
 {
     IntRect normalizedCropRect = normalizeRect(cropRect);
     return new ImageBitmap(image, normalizedCropRect, document, options);
 }
 
-RawPtr<ImageBitmap> ImageBitmap::create(HTMLVideoElement* video, const IntRect& cropRect, Document* document, const ImageBitmapOptions& options)
+ImageBitmap* ImageBitmap::create(HTMLVideoElement* video, const IntRect& cropRect, Document* document, const ImageBitmapOptions& options)
 {
     IntRect normalizedCropRect = normalizeRect(cropRect);
     return new ImageBitmap(video, normalizedCropRect, document, options);
 }
 
-RawPtr<ImageBitmap> ImageBitmap::create(HTMLCanvasElement* canvas, const IntRect& cropRect, const ImageBitmapOptions& options)
+ImageBitmap* ImageBitmap::create(HTMLCanvasElement* canvas, const IntRect& cropRect, const ImageBitmapOptions& options)
 {
     IntRect normalizedCropRect = normalizeRect(cropRect);
     return new ImageBitmap(canvas, normalizedCropRect, options);
 }
 
-RawPtr<ImageBitmap> ImageBitmap::create(ImageData* data, const IntRect& cropRect, const ImageBitmapOptions& options)
+ImageBitmap* ImageBitmap::create(ImageData* data, const IntRect& cropRect, const ImageBitmapOptions& options)
 {
     IntRect normalizedCropRect = normalizeRect(cropRect);
     return new ImageBitmap(data, normalizedCropRect, options);
 }
 
-RawPtr<ImageBitmap> ImageBitmap::create(ImageBitmap* bitmap, const IntRect& cropRect, const ImageBitmapOptions& options)
+ImageBitmap* ImageBitmap::create(ImageBitmap* bitmap, const IntRect& cropRect, const ImageBitmapOptions& options)
 {
     IntRect normalizedCropRect = normalizeRect(cropRect);
     return new ImageBitmap(bitmap, normalizedCropRect, options);
 }
 
-RawPtr<ImageBitmap> ImageBitmap::create(PassRefPtr<StaticBitmapImage> image, const IntRect& cropRect, const ImageBitmapOptions& options)
+ImageBitmap* ImageBitmap::create(PassRefPtr<StaticBitmapImage> image, const IntRect& cropRect, const ImageBitmapOptions& options)
 {
     IntRect normalizedCropRect = normalizeRect(cropRect);
     return new ImageBitmap(image, normalizedCropRect, options);
 }
 
-RawPtr<ImageBitmap> ImageBitmap::create(PassRefPtr<StaticBitmapImage> image)
+ImageBitmap* ImageBitmap::create(PassRefPtr<StaticBitmapImage> image)
 {
     return new ImageBitmap(image);
 }
diff --git a/third_party/WebKit/Source/core/frame/ImageBitmap.h b/third_party/WebKit/Source/core/frame/ImageBitmap.h
index 56eabc8..f82174b 100644
--- a/third_party/WebKit/Source/core/frame/ImageBitmap.h
+++ b/third_party/WebKit/Source/core/frame/ImageBitmap.h
@@ -34,13 +34,13 @@
 class CORE_EXPORT ImageBitmap final : public GarbageCollectedFinalized<ImageBitmap>, public ScriptWrappable, public CanvasImageSource, public ImageBitmapSource {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static RawPtr<ImageBitmap> create(HTMLImageElement*, const IntRect&, Document*, const ImageBitmapOptions& = ImageBitmapOptions());
-    static RawPtr<ImageBitmap> create(HTMLVideoElement*, const IntRect&, Document*, const ImageBitmapOptions& = ImageBitmapOptions());
-    static RawPtr<ImageBitmap> create(HTMLCanvasElement*, const IntRect&, const ImageBitmapOptions& = ImageBitmapOptions());
-    static RawPtr<ImageBitmap> create(ImageData*, const IntRect&, const ImageBitmapOptions& = ImageBitmapOptions());
-    static RawPtr<ImageBitmap> create(ImageBitmap*, const IntRect&, const ImageBitmapOptions& = ImageBitmapOptions());
-    static RawPtr<ImageBitmap> create(PassRefPtr<StaticBitmapImage>);
-    static RawPtr<ImageBitmap> create(PassRefPtr<StaticBitmapImage>, const IntRect&, const ImageBitmapOptions& = ImageBitmapOptions());
+    static ImageBitmap* create(HTMLImageElement*, const IntRect&, Document*, const ImageBitmapOptions& = ImageBitmapOptions());
+    static ImageBitmap* create(HTMLVideoElement*, const IntRect&, Document*, const ImageBitmapOptions& = ImageBitmapOptions());
+    static ImageBitmap* create(HTMLCanvasElement*, const IntRect&, const ImageBitmapOptions& = ImageBitmapOptions());
+    static ImageBitmap* create(ImageData*, const IntRect&, const ImageBitmapOptions& = ImageBitmapOptions());
+    static ImageBitmap* create(ImageBitmap*, const IntRect&, const ImageBitmapOptions& = ImageBitmapOptions());
+    static ImageBitmap* create(PassRefPtr<StaticBitmapImage>);
+    static ImageBitmap* create(PassRefPtr<StaticBitmapImage>, const IntRect&, const ImageBitmapOptions& = ImageBitmapOptions());
     static PassRefPtr<SkImage> getSkImageFromDecoder(PassOwnPtr<ImageDecoder>);
 
     StaticBitmapImage* bitmapImage() const { return (m_image) ? m_image.get() : nullptr; }
diff --git a/third_party/WebKit/Source/core/frame/ImageBitmapTest.cpp b/third_party/WebKit/Source/core/frame/ImageBitmapTest.cpp
index 72194afc..0a0da75d 100644
--- a/third_party/WebKit/Source/core/frame/ImageBitmapTest.cpp
+++ b/third_party/WebKit/Source/core/frame/ImageBitmapTest.cpp
@@ -81,20 +81,20 @@
 TEST_F(ImageBitmapTest, ImageResourceConsistency)
 {
     const ImageBitmapOptions defaultOptions;
-    RawPtr<HTMLImageElement> imageElement = HTMLImageElement::create(*Document::create().get());
-    RawPtr<ImageResource> image = ImageResource::create(StaticBitmapImage::create(m_image).get());
-    imageElement->setImageResource(image.get());
+    HTMLImageElement* imageElement = HTMLImageElement::create(*Document::create().get());
+    ImageResource* image = ImageResource::create(StaticBitmapImage::create(m_image).get());
+    imageElement->setImageResource(image);
 
-    RawPtr<ImageBitmap> imageBitmapNoCrop = ImageBitmap::create(imageElement.get(),
+    ImageBitmap* imageBitmapNoCrop = ImageBitmap::create(imageElement,
         IntRect(0, 0, m_image->width(), m_image->height()),
         &(imageElement->document()), defaultOptions);
-    RawPtr<ImageBitmap> imageBitmapInteriorCrop = ImageBitmap::create(imageElement.get(),
+    ImageBitmap* imageBitmapInteriorCrop = ImageBitmap::create(imageElement,
         IntRect(m_image->width() / 2, m_image->height() / 2, m_image->width() / 2, m_image->height() / 2),
         &(imageElement->document()), defaultOptions);
-    RawPtr<ImageBitmap> imageBitmapExteriorCrop = ImageBitmap::create(imageElement.get(),
+    ImageBitmap* imageBitmapExteriorCrop = ImageBitmap::create(imageElement,
         IntRect(-m_image->width() / 2, -m_image->height() / 2, m_image->width(), m_image->height()),
         &(imageElement->document()), defaultOptions);
-    RawPtr<ImageBitmap> imageBitmapOutsideCrop = ImageBitmap::create(imageElement.get(),
+    ImageBitmap* imageBitmapOutsideCrop = ImageBitmap::create(imageElement,
         IntRect(-m_image->width(), -m_image->height(), m_image->width(), m_image->height()),
         &(imageElement->document()), defaultOptions);
 
@@ -109,20 +109,20 @@
 // Verifies that ImageBitmaps constructed from HTMLImageElements hold a reference to the original Image if the HTMLImageElement src is changed.
 TEST_F(ImageBitmapTest, ImageBitmapSourceChanged)
 {
-    RawPtr<HTMLImageElement> image = HTMLImageElement::create(*Document::create().get());
-    RawPtr<ImageResource> originalImageResource = ImageResource::create(
+    HTMLImageElement* image = HTMLImageElement::create(*Document::create().get());
+    ImageResource* originalImageResource = ImageResource::create(
         StaticBitmapImage::create(m_image).get());
-    image->setImageResource(originalImageResource.get());
+    image->setImageResource(originalImageResource);
 
     const ImageBitmapOptions defaultOptions;
-    RawPtr<ImageBitmap> imageBitmap = ImageBitmap::create(image.get(),
+    ImageBitmap* imageBitmap = ImageBitmap::create(image,
         IntRect(0, 0, m_image->width(), m_image->height()),
         &(image->document()), defaultOptions);
     ASSERT_EQ(imageBitmap->bitmapImage()->imageForCurrentFrame(), originalImageResource->getImage()->imageForCurrentFrame());
 
-    RawPtr<ImageResource> newImageResource = ImageResource::create(
+    ImageResource* newImageResource = ImageResource::create(
         StaticBitmapImage::create(m_image2).get());
-    image->setImageResource(newImageResource.get());
+    image->setImageResource(newImageResource);
 
     // The ImageBitmap should contain the same data as the original cached image
     {
diff --git a/third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp b/third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp
index c874421..f178a4be 100644
--- a/third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp
+++ b/third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp
@@ -85,7 +85,7 @@
 {
 }
 
-RawPtr<LocalDOMWindow::WindowFrameObserver> LocalDOMWindow::WindowFrameObserver::create(LocalDOMWindow* window, LocalFrame& frame)
+LocalDOMWindow::WindowFrameObserver* LocalDOMWindow::WindowFrameObserver::create(LocalDOMWindow* window, LocalFrame& frame)
 {
     return new WindowFrameObserver(window, frame);
 }
@@ -116,7 +116,7 @@
 class PostMessageTimer final : public GarbageCollectedFinalized<PostMessageTimer>, public SuspendableTimer {
     USING_GARBAGE_COLLECTED_MIXIN(PostMessageTimer);
 public:
-    PostMessageTimer(LocalDOMWindow& window, RawPtr<MessageEvent> event, SecurityOrigin* targetOrigin, PassRefPtr<ScriptCallStack> stackTrace, UserGestureToken* userGestureToken)
+    PostMessageTimer(LocalDOMWindow& window, MessageEvent* event, SecurityOrigin* targetOrigin, PassRefPtr<ScriptCallStack> stackTrace, UserGestureToken* userGestureToken)
         : SuspendableTimer(window.document())
         , m_event(event)
         , m_window(&window)
@@ -128,7 +128,7 @@
         m_asyncOperationId = InspectorInstrumentation::traceAsyncOperationStarting(getExecutionContext(), "postMessage");
     }
 
-    RawPtr<MessageEvent> event() const { return m_event.get(); }
+    MessageEvent* event() const { return m_event.get(); }
     SecurityOrigin* targetOrigin() const { return m_targetOrigin.get(); }
     ScriptCallStack* stackTrace() const { return m_stackTrace.get(); }
     UserGestureToken* userGestureToken() const { return m_userGestureToken.get(); }
@@ -333,9 +333,9 @@
     dispatchEvent(Event::create(EventTypeNames::languagechange));
 }
 
-RawPtr<Document> LocalDOMWindow::createDocument(const String& mimeType, const DocumentInit& init, bool forceXHTML)
+Document* LocalDOMWindow::createDocument(const String& mimeType, const DocumentInit& init, bool forceXHTML)
 {
-    RawPtr<Document> document = nullptr;
+    Document* document = nullptr;
     if (forceXHTML) {
         // This is a hack for XSLTProcessor. See XSLTProcessor::createDocumentFromSource().
         document = Document::create(init);
@@ -345,10 +345,10 @@
             document = SinkDocument::create(init);
     }
 
-    return document.release();
+    return document;
 }
 
-RawPtr<Document> LocalDOMWindow::installNewDocument(const String& mimeType, const DocumentInit& init, bool forceXHTML)
+Document* LocalDOMWindow::installNewDocument(const String& mimeType, const DocumentInit& init, bool forceXHTML)
 {
     ASSERT(init.frame() == frame());
 
@@ -381,7 +381,7 @@
     return m_eventQueue.get();
 }
 
-void LocalDOMWindow::enqueueWindowEvent(RawPtr<Event> event)
+void LocalDOMWindow::enqueueWindowEvent(Event* event)
 {
     if (!m_eventQueue)
         return;
@@ -389,7 +389,7 @@
     m_eventQueue->enqueueEvent(event);
 }
 
-void LocalDOMWindow::enqueueDocumentEvent(RawPtr<Event> event)
+void LocalDOMWindow::enqueueDocumentEvent(Event* event)
 {
     if (!m_eventQueue)
         return;
@@ -404,7 +404,7 @@
     // workaround to avoid Editing code crashes.  We should always dispatch
     // 'load' event asynchronously.  crbug.com/569511.
     if (ScopedEventQueue::instance()->shouldQueueEvents() && m_document) {
-        m_document->postTask(BLINK_FROM_HERE, createSameThreadTask(&LocalDOMWindow::dispatchLoadEvent, RawPtr<LocalDOMWindow>(this)));
+        m_document->postTask(BLINK_FROM_HERE, createSameThreadTask(&LocalDOMWindow::dispatchLoadEvent, this));
         return;
     }
     dispatchLoadEvent();
@@ -495,7 +495,7 @@
     return this;
 }
 
-RawPtr<MediaQueryList> LocalDOMWindow::matchMedia(const String& media)
+MediaQueryList* LocalDOMWindow::matchMedia(const String& media)
 {
     return document() ? document()->mediaQueryMatcher().matchMedia(media) : nullptr;
 }
@@ -681,17 +681,17 @@
     return m_navigator.get();
 }
 
-void LocalDOMWindow::schedulePostMessage(RawPtr<MessageEvent> event, SecurityOrigin* target, PassRefPtr<ScriptCallStack> stackTrace)
+void LocalDOMWindow::schedulePostMessage(MessageEvent* event, SecurityOrigin* target, PassRefPtr<ScriptCallStack> stackTrace)
 {
     // Allowing unbounded amounts of messages to build up for a suspended context
     // is problematic; consider imposing a limit or other restriction if this
     // surfaces often as a problem (see crbug.com/587012).
 
     // Schedule the message.
-    RawPtr<PostMessageTimer> timer = new PostMessageTimer(*this, event, target, stackTrace, UserGestureIndicator::currentToken());
+    PostMessageTimer* timer = new PostMessageTimer(*this, event, target, stackTrace, UserGestureIndicator::currentToken());
     timer->startOneShot(0, BLINK_FROM_HERE);
     timer->suspendIfNeeded();
-    m_postMessageTimers.add(timer.release());
+    m_postMessageTimers.add(timer);
 }
 
 void LocalDOMWindow::postMessageTimerFired(PostMessageTimer* timer)
@@ -699,7 +699,7 @@
     if (!isCurrentlyDisplayedInFrame())
         return;
 
-    RawPtr<MessageEvent> event = timer->event();
+    MessageEvent* event = timer->event();
 
     UserGestureIndicator gestureIndicator(timer->userGestureToken());
 
@@ -723,9 +723,9 @@
 
         if (!validTarget) {
             String message = ExceptionMessages::failedToExecute("postMessage", "DOMWindow", "The target origin provided ('" + intendedTargetOrigin->toString() + "') does not match the recipient window's origin ('" + document()->getSecurityOrigin()->toString() + "').");
-            RawPtr<ConsoleMessage> consoleMessage = ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, message);
+            ConsoleMessage* consoleMessage = ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, message);
             consoleMessage->setCallStack(stackTrace);
-            frameConsole()->addMessage(consoleMessage.release());
+            frameConsole()->addMessage(consoleMessage);
             return;
         }
     }
@@ -860,10 +860,6 @@
     if (!isCurrentlyDisplayedInFrame())
         return false;
 
-    // |frame()| can be destructed during |Editor::findString()| via
-    // |Document::updateLayout()|, e.g. event handler removes a frame.
-    RawPtr<LocalFrame> protectFrame(frame());
-
     // FIXME (13016): Support searchInFrames and showDialog
     FindOptions options = (backwards ? Backwards : 0) | (caseSensitive ? 0 : CaseInsensitive) | (wrap ? WrapAround : 0) | (wholeWord ? WholeWord | AtWordStarts : 0);
     return frame()->editor().findString(string, options);
@@ -1076,13 +1072,13 @@
     return m_media.get();
 }
 
-RawPtr<CSSStyleDeclaration> LocalDOMWindow::getComputedStyle(Element* elt, const String& pseudoElt) const
+CSSStyleDeclaration* LocalDOMWindow::getComputedStyle(Element* elt, const String& pseudoElt) const
 {
     ASSERT(elt);
     return CSSComputedStyleDeclaration::create(elt, false, pseudoElt);
 }
 
-RawPtr<CSSRuleList> LocalDOMWindow::getMatchedCSSRules(Element* element, const String& pseudoElement) const
+CSSRuleList* LocalDOMWindow::getMatchedCSSRules(Element* element, const String& pseudoElement) const
 {
     if (!element)
         return nullptr;
@@ -1366,11 +1362,11 @@
 
 void LocalDOMWindow::dispatchLoadEvent()
 {
-    RawPtr<Event> loadEvent(Event::create(EventTypeNames::load));
+    Event* loadEvent(Event::create(EventTypeNames::load));
     if (frame() && frame()->loader().documentLoader() && !frame()->loader().documentLoader()->timing().loadEventStart()) {
         // The DocumentLoader (and thus its DocumentLoadTiming) might get destroyed while dispatching
         // the event, so protect it to prevent writing the end time into freed memory.
-        RawPtr<DocumentLoader> documentLoader = frame()->loader().documentLoader();
+        DocumentLoader* documentLoader = frame()->loader().documentLoader();
         DocumentLoadTiming& timing = documentLoader->timing();
         timing.markLoadEventStart();
         dispatchEvent(loadEvent, document());
@@ -1390,20 +1386,17 @@
     InspectorInstrumentation::loadEventFired(frame());
 }
 
-DispatchEventResult LocalDOMWindow::dispatchEvent(RawPtr<Event> prpEvent, RawPtr<EventTarget> prpTarget)
+DispatchEventResult LocalDOMWindow::dispatchEvent(Event* event, EventTarget* target)
 {
     ASSERT(!EventDispatchForbiddenScope::isEventDispatchForbidden());
 
-    RawPtr<EventTarget> protect(this);
-    RawPtr<Event> event = prpEvent;
-
     event->setTrusted(true);
-    event->setTarget(prpTarget ? prpTarget : this);
+    event->setTarget(target ? target : this);
     event->setCurrentTarget(this);
     event->setEventPhase(Event::AT_TARGET);
 
     TRACE_EVENT1("devtools.timeline", "EventDispatch", "data", InspectorEventDispatchEvent::data(*event));
-    return fireEventListeners(event.get());
+    return fireEventListeners(event);
 }
 
 void LocalDOMWindow::removeAllEventListeners()
@@ -1437,7 +1430,7 @@
     frameConsole()->addMessage(ConsoleMessage::create(JSMessageSource, ErrorMessageLevel, message));
 }
 
-RawPtr<DOMWindow> LocalDOMWindow::open(const String& urlString, const AtomicString& frameName, const String& windowFeaturesString,
+DOMWindow* LocalDOMWindow::open(const String& urlString, const AtomicString& frameName, const String& windowFeaturesString,
     LocalDOMWindow* callingWindow, LocalDOMWindow* enteredWindow)
 {
     if (!isCurrentlyDisplayedInFrame())
@@ -1491,7 +1484,7 @@
     }
 
     WindowFeatures features(windowFeaturesString);
-    RawPtr<DOMWindow> newWindow = createWindow(urlString, frameName, features, *callingWindow, *firstFrame, *frame());
+    DOMWindow* newWindow = createWindow(urlString, frameName, features, *callingWindow, *firstFrame, *frame());
     return features.noopener ? nullptr : newWindow;
 }
 
diff --git a/third_party/WebKit/Source/core/frame/LocalDOMWindow.h b/third_party/WebKit/Source/core/frame/LocalDOMWindow.h
index daf07d8..d2b0e76 100644
--- a/third_party/WebKit/Source/core/frame/LocalDOMWindow.h
+++ b/third_party/WebKit/Source/core/frame/LocalDOMWindow.h
@@ -67,8 +67,8 @@
     USING_GARBAGE_COLLECTED_MIXIN(LocalDOMWindow);
     USING_PRE_FINALIZER(LocalDOMWindow, dispose);
 public:
-    static RawPtr<Document> createDocument(const String& mimeType, const DocumentInit&, bool forceXHTML);
-    static RawPtr<LocalDOMWindow> create(LocalFrame& frame)
+    static Document* createDocument(const String& mimeType, const DocumentInit&, bool forceXHTML);
+    static LocalDOMWindow* create(LocalFrame& frame)
     {
         return new LocalDOMWindow(frame);
     }
@@ -77,7 +77,7 @@
 
     DECLARE_VIRTUAL_TRACE();
 
-    RawPtr<Document> installNewDocument(const String& mimeType, const DocumentInit&, bool forceXHTML = false);
+    Document* installNewDocument(const String& mimeType, const DocumentInit&, bool forceXHTML = false);
 
     // EventTarget overrides:
     ExecutionContext* getExecutionContext() const override;
@@ -137,15 +137,15 @@
     void moveTo(int x, int y) const override;
     void resizeBy(int x, int y) const override;
     void resizeTo(int width, int height) const override;
-    RawPtr<MediaQueryList> matchMedia(const String&) override;
-    RawPtr<CSSStyleDeclaration> getComputedStyle(Element*, const String& pseudoElt) const override;
-    RawPtr<CSSRuleList> getMatchedCSSRules(Element*, const String& pseudoElt) const override;
+    MediaQueryList* matchMedia(const String&) override;
+    CSSStyleDeclaration* getComputedStyle(Element*, const String& pseudoElt) const override;
+    CSSRuleList* getMatchedCSSRules(Element*, const String& pseudoElt) const override;
     int requestAnimationFrame(FrameRequestCallback*) override;
     int webkitRequestAnimationFrame(FrameRequestCallback*) override;
     void cancelAnimationFrame(int id) override;
     int requestIdleCallback(IdleRequestCallback*, const IdleRequestOptions&) override;
     void cancelIdleCallback(int id) override;
-    void schedulePostMessage(RawPtr<MessageEvent>, SecurityOrigin* target, PassRefPtr<ScriptCallStack>);
+    void schedulePostMessage(MessageEvent*, SecurityOrigin* target, PassRefPtr<ScriptCallStack>);
 
     void registerProperty(DOMWindowProperty*);
     void unregisterProperty(DOMWindowProperty*);
@@ -159,7 +159,7 @@
 
     Element* frameElement() const;
 
-    RawPtr<DOMWindow> open(const String& urlString, const AtomicString& frameName, const String& windowFeaturesString,
+    DOMWindow* open(const String& urlString, const AtomicString& frameName, const String& windowFeaturesString,
         LocalDOMWindow* callingWindow, LocalDOMWindow* enteredWindow);
 
     FrameConsole* frameConsole() const;
@@ -175,7 +175,7 @@
     void removeAllEventListeners() override;
 
     using EventTarget::dispatchEvent;
-    DispatchEventResult dispatchEvent(RawPtr<Event> prpEvent, RawPtr<EventTarget> prpTarget);
+    DispatchEventResult dispatchEvent(Event*, EventTarget*);
 
     void finishedLoading();
 
@@ -186,8 +186,8 @@
     void willDetachDocumentFromFrame();
 
     EventQueue* getEventQueue() const;
-    void enqueueWindowEvent(RawPtr<Event>);
-    void enqueueDocumentEvent(RawPtr<Event>);
+    void enqueueWindowEvent(Event*);
+    void enqueueDocumentEvent(Event*);
     void enqueuePageshowEvent(PageshowEventPersistence);
     void enqueueHashchangeEvent(const String& oldURL, const String& newURL);
     void enqueuePopstateEvent(PassRefPtr<SerializedScriptValue>);
@@ -215,7 +215,7 @@
     class WindowFrameObserver final : public GarbageCollected<WindowFrameObserver>, public LocalFrameLifecycleObserver {
         USING_GARBAGE_COLLECTED_MIXIN(WindowFrameObserver);
     public:
-        static RawPtr<WindowFrameObserver> create(LocalDOMWindow*, LocalFrame&);
+        static WindowFrameObserver* create(LocalDOMWindow*, LocalFrame&);
 
         DECLARE_VIRTUAL_TRACE();
 
diff --git a/third_party/WebKit/Source/core/frame/LocalFrame.cpp b/third_party/WebKit/Source/core/frame/LocalFrame.cpp
index 7f498ae4..971bdcd5 100644
--- a/third_party/WebKit/Source/core/frame/LocalFrame.cpp
+++ b/third_party/WebKit/Source/core/frame/LocalFrame.cpp
@@ -165,14 +165,14 @@
 
 } // namespace
 
-RawPtr<LocalFrame> LocalFrame::create(FrameLoaderClient* client, FrameHost* host, FrameOwner* owner)
+LocalFrame* LocalFrame::create(FrameLoaderClient* client, FrameHost* host, FrameOwner* owner)
 {
-    RawPtr<LocalFrame> frame = new LocalFrame(client, host, owner);
-    InspectorInstrumentation::frameAttachedToParent(frame.get());
-    return frame.release();
+    LocalFrame* frame = new LocalFrame(client, host, owner);
+    InspectorInstrumentation::frameAttachedToParent(frame);
+    return frame;
 }
 
-void LocalFrame::setView(RawPtr<FrameView> view)
+void LocalFrame::setView(FrameView* view)
 {
     ASSERT(!m_view || m_view != view);
     ASSERT(!document() || !document()->isActive());
@@ -196,7 +196,7 @@
 
     setView(nullptr);
 
-    RawPtr<FrameView> frameView = nullptr;
+    FrameView* frameView = nullptr;
     if (isLocalRoot) {
         frameView = FrameView::create(this, viewportSize);
 
@@ -316,9 +316,6 @@
 void LocalFrame::detach(FrameDetachType type)
 {
     PluginScriptForbiddenScope forbidPluginDestructorScripting;
-    // A lot of the following steps can result in the current frame being
-    // detached, so protect a reference to it.
-    RawPtr<LocalFrame> protect(this);
     m_loader.stopAllLoaders();
     // Don't allow any new child frames to load in this frame: attaching a new
     // child frame during or after detaching children results in an attached
@@ -408,7 +405,7 @@
         page()->scrollingCoordinator()->willDestroyScrollableArea(m_view.get());
 }
 
-void LocalFrame::setDOMWindow(RawPtr<LocalDOMWindow> domWindow)
+void LocalFrame::setDOMWindow(LocalDOMWindow* domWindow)
 {
     // Oilpan: setDOMWindow() cannot be used when finalizing. Which
     // is acceptable as its actions are either not needed or handled
@@ -521,9 +518,9 @@
     }
 
     // Subframes of the one we're printing don't lay out to the page size.
-    for (RawPtr<Frame> child = tree().firstChild(); child; child = child->tree().nextSibling()) {
+    for (Frame* child = tree().firstChild(); child; child = child->tree().nextSibling()) {
         if (child->isLocalFrame())
-            toLocalFrame(child.get())->setPrinting(printing, FloatSize(), FloatSize(), 0);
+            toLocalFrame(child)->setPrinting(printing, FloatSize(), FloatSize(), 0);
     }
 }
 
@@ -598,9 +595,9 @@
     m_pageZoomFactor = pageZoomFactor;
     m_textZoomFactor = textZoomFactor;
 
-    for (RawPtr<Frame> child = tree().firstChild(); child; child = child->tree().nextSibling()) {
+    for (Frame* child = tree().firstChild(); child; child = child->tree().nextSibling()) {
         if (child->isLocalFrame())
-            toLocalFrame(child.get())->setPageAndTextZoomFactors(m_pageZoomFactor, m_textZoomFactor);
+            toLocalFrame(child)->setPageAndTextZoomFactors(m_pageZoomFactor, m_textZoomFactor);
     }
 
     document->setNeedsStyleRecalc(SubtreeStyleChange, StyleChangeReasonForTracing::create(StyleChangeReason::Zoom));
@@ -610,9 +607,9 @@
 void LocalFrame::deviceScaleFactorChanged()
 {
     document()->mediaQueryAffectingValueChanged();
-    for (RawPtr<Frame> child = tree().firstChild(); child; child = child->tree().nextSibling()) {
+    for (Frame* child = tree().firstChild(); child; child = child->tree().nextSibling()) {
         if (child->isLocalFrame())
-            toLocalFrame(child.get())->deviceScaleFactorChanged();
+            toLocalFrame(child)->deviceScaleFactorChanged();
     }
 }
 
diff --git a/third_party/WebKit/Source/core/frame/LocalFrame.h b/third_party/WebKit/Source/core/frame/LocalFrame.h
index 447c6d8..8c253a2c 100644
--- a/third_party/WebKit/Source/core/frame/LocalFrame.h
+++ b/third_party/WebKit/Source/core/frame/LocalFrame.h
@@ -80,10 +80,10 @@
 class CORE_EXPORT LocalFrame : public Frame, public LocalFrameLifecycleNotifier, public Supplementable<LocalFrame>, public DisplayItemClient {
     USING_GARBAGE_COLLECTED_MIXIN(LocalFrame);
 public:
-    static RawPtr<LocalFrame> create(FrameLoaderClient*, FrameHost*, FrameOwner*);
+    static LocalFrame* create(FrameLoaderClient*, FrameHost*, FrameOwner*);
 
     void init();
-    void setView(RawPtr<FrameView>);
+    void setView(FrameView*);
     void createView(const IntSize&, const Color&, bool,
         ScrollbarMode = ScrollbarAuto, bool horizontalLock = false,
         ScrollbarMode = ScrollbarAuto, bool verticalLock = false);
@@ -106,7 +106,7 @@
     void willDetachFrameHost();
 
     LocalDOMWindow* localDOMWindow() const;
-    void setDOMWindow(RawPtr<LocalDOMWindow>);
+    void setDOMWindow(LocalDOMWindow*);
     FrameView* view() const;
     Document* document() const;
     void setPagePopupOwner(Element&);
diff --git a/third_party/WebKit/Source/core/frame/Location.cpp b/third_party/WebKit/Source/core/frame/Location.cpp
index 8c335115..b83f6ff 100644
--- a/third_party/WebKit/Source/core/frame/Location.cpp
+++ b/third_party/WebKit/Source/core/frame/Location.cpp
@@ -117,14 +117,14 @@
     return DOMURLUtilsReadOnly::origin(url());
 }
 
-RawPtr<DOMStringList> Location::ancestorOrigins() const
+DOMStringList* Location::ancestorOrigins() const
 {
-    RawPtr<DOMStringList> origins = DOMStringList::create(DOMStringList::Location);
+    DOMStringList* origins = DOMStringList::create(DOMStringList::Location);
     if (!m_frame)
-        return origins.release();
+        return origins;
     for (Frame* frame = m_frame->tree().parent(); frame; frame = frame->tree().parent())
         origins->append(frame->securityContext()->getSecurityOrigin()->toString());
-    return origins.release();
+    return origins;
 }
 
 String Location::hash() const
diff --git a/third_party/WebKit/Source/core/frame/Location.h b/third_party/WebKit/Source/core/frame/Location.h
index ba568d73..d107cd854 100644
--- a/third_party/WebKit/Source/core/frame/Location.h
+++ b/third_party/WebKit/Source/core/frame/Location.h
@@ -52,7 +52,7 @@
 class CORE_EXPORT Location final : public GarbageCollected<Location>, public ScriptWrappable {
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static RawPtr<Location> create(Frame* frame)
+    static Location* create(Frame* frame)
     {
         return new Location(frame);
     }
@@ -83,7 +83,7 @@
     String hash() const;
     String origin() const;
 
-    RawPtr<DOMStringList> ancestorOrigins() const;
+    DOMStringList* ancestorOrigins() const;
 
     // Just return the |this| object the way the normal valueOf function on the Object prototype would.
     // The valueOf function is only added to make sure that it cannot be overwritten on location
diff --git a/third_party/WebKit/Source/core/frame/PlatformEventDispatcher.cpp b/third_party/WebKit/Source/core/frame/PlatformEventDispatcher.cpp
index eacf116c..76d1c9bb 100644
--- a/third_party/WebKit/Source/core/frame/PlatformEventDispatcher.cpp
+++ b/third_party/WebKit/Source/core/frame/PlatformEventDispatcher.cpp
@@ -67,9 +67,7 @@
 
 DEFINE_TRACE(PlatformEventDispatcher)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_controllers);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/frame/RemoteDOMWindow.cpp b/third_party/WebKit/Source/core/frame/RemoteDOMWindow.cpp
index 83c5c704..2950999 100644
--- a/third_party/WebKit/Source/core/frame/RemoteDOMWindow.cpp
+++ b/third_party/WebKit/Source/core/frame/RemoteDOMWindow.cpp
@@ -287,19 +287,19 @@
     ASSERT_NOT_REACHED();
 }
 
-RawPtr<MediaQueryList> RemoteDOMWindow::matchMedia(const String&)
+MediaQueryList* RemoteDOMWindow::matchMedia(const String&)
 {
     ASSERT_NOT_REACHED();
     return nullptr;
 }
 
-RawPtr<CSSStyleDeclaration> RemoteDOMWindow::getComputedStyle(Element*, const String& pseudoElt) const
+CSSStyleDeclaration* RemoteDOMWindow::getComputedStyle(Element*, const String& pseudoElt) const
 {
     ASSERT_NOT_REACHED();
     return nullptr;
 }
 
-RawPtr<CSSRuleList> RemoteDOMWindow::getMatchedCSSRules(Element*, const String& pseudoElt) const
+CSSRuleList* RemoteDOMWindow::getMatchedCSSRules(Element*, const String& pseudoElt) const
 {
     ASSERT_NOT_REACHED();
     return nullptr;
diff --git a/third_party/WebKit/Source/core/frame/RemoteDOMWindow.h b/third_party/WebKit/Source/core/frame/RemoteDOMWindow.h
index 8760e48..d0cb65d 100644
--- a/third_party/WebKit/Source/core/frame/RemoteDOMWindow.h
+++ b/third_party/WebKit/Source/core/frame/RemoteDOMWindow.h
@@ -12,7 +12,7 @@
 
 class RemoteDOMWindow final : public DOMWindow {
 public:
-    static RawPtr<RemoteDOMWindow> create(RemoteFrame& frame)
+    static RemoteDOMWindow* create(RemoteFrame& frame)
     {
         return new RemoteDOMWindow(frame);
     }
@@ -70,9 +70,9 @@
     void moveTo(int x, int y) const override;
     void resizeBy(int x, int y) const override;
     void resizeTo(int width, int height) const override;
-    RawPtr<MediaQueryList> matchMedia(const String&) override;
-    RawPtr<CSSStyleDeclaration> getComputedStyle(Element*, const String& pseudoElt) const override;
-    RawPtr<CSSRuleList> getMatchedCSSRules(Element*, const String& pseudoElt) const override;
+    MediaQueryList* matchMedia(const String&) override;
+    CSSStyleDeclaration* getComputedStyle(Element*, const String& pseudoElt) const override;
+    CSSRuleList* getMatchedCSSRules(Element*, const String& pseudoElt) const override;
     int requestAnimationFrame(FrameRequestCallback*) override;
     int webkitRequestAnimationFrame(FrameRequestCallback*) override;
     void cancelAnimationFrame(int id) override;
diff --git a/third_party/WebKit/Source/core/frame/RemoteFrame.cpp b/third_party/WebKit/Source/core/frame/RemoteFrame.cpp
index 6ffa31b..9255891 100644
--- a/third_party/WebKit/Source/core/frame/RemoteFrame.cpp
+++ b/third_party/WebKit/Source/core/frame/RemoteFrame.cpp
@@ -33,7 +33,7 @@
 {
 }
 
-RawPtr<RemoteFrame> RemoteFrame::create(RemoteFrameClient* client, FrameHost* host, FrameOwner* owner)
+RemoteFrame* RemoteFrame::create(RemoteFrameClient* client, FrameHost* host, FrameOwner* owner)
 {
     return new RemoteFrame(client, host, owner);
 }
@@ -89,10 +89,6 @@
 void RemoteFrame::detach(FrameDetachType type)
 {
     PluginScriptForbiddenScope forbidPluginDestructorScripting;
-    // Frame::detach() requires the caller to keep a reference to this, since
-    // otherwise it may clear the last reference to this, causing it to be
-    // deleted, which can cause a use-after-free.
-    RawPtr<RemoteFrame> protect(this);
     detachChildren();
     if (!client())
         return;
@@ -143,7 +139,7 @@
         remoteFrameClient()->visibilityChanged(visible);
 }
 
-void RemoteFrame::setView(RawPtr<RemoteFrameView> view)
+void RemoteFrame::setView(RemoteFrameView* view)
 {
     // Oilpan: as RemoteFrameView performs no finalization actions,
     // no explicit dispose() of it needed here. (cf. FrameView::dispose().)
diff --git a/third_party/WebKit/Source/core/frame/RemoteFrame.h b/third_party/WebKit/Source/core/frame/RemoteFrame.h
index 994a1745..71005c89 100644
--- a/third_party/WebKit/Source/core/frame/RemoteFrame.h
+++ b/third_party/WebKit/Source/core/frame/RemoteFrame.h
@@ -24,7 +24,7 @@
 
 class CORE_EXPORT RemoteFrame: public Frame {
 public:
-    static RawPtr<RemoteFrame> create(RemoteFrameClient*, FrameHost*, FrameOwner*);
+    static RemoteFrame* create(RemoteFrameClient*, FrameHost*, FrameOwner*);
 
     ~RemoteFrame() override;
 
@@ -55,7 +55,7 @@
 
     void advanceFocus(WebFocusType, LocalFrame* source);
 
-    void setView(RawPtr<RemoteFrameView>);
+    void setView(RemoteFrameView*);
     void createView();
 
     RemoteFrameView* view() const;
diff --git a/third_party/WebKit/Source/core/frame/RemoteFrameView.cpp b/third_party/WebKit/Source/core/frame/RemoteFrameView.cpp
index 719b436..a12d3e5d 100644
--- a/third_party/WebKit/Source/core/frame/RemoteFrameView.cpp
+++ b/third_party/WebKit/Source/core/frame/RemoteFrameView.cpp
@@ -20,11 +20,11 @@
 {
 }
 
-RawPtr<RemoteFrameView> RemoteFrameView::create(RemoteFrame* remoteFrame)
+RemoteFrameView* RemoteFrameView::create(RemoteFrame* remoteFrame)
 {
-    RawPtr<RemoteFrameView> view = new RemoteFrameView(remoteFrame);
+    RemoteFrameView* view = new RemoteFrameView(remoteFrame);
     view->show();
-    return view.release();
+    return view;
 }
 
 void RemoteFrameView::dispose()
diff --git a/third_party/WebKit/Source/core/frame/RemoteFrameView.h b/third_party/WebKit/Source/core/frame/RemoteFrameView.h
index 21548333..3eeb6c3e 100644
--- a/third_party/WebKit/Source/core/frame/RemoteFrameView.h
+++ b/third_party/WebKit/Source/core/frame/RemoteFrameView.h
@@ -15,7 +15,7 @@
 
 class RemoteFrameView final : public Widget {
 public:
-    static RawPtr<RemoteFrameView> create(RemoteFrame*);
+    static RemoteFrameView* create(RemoteFrame*);
 
     ~RemoteFrameView() override;
 
diff --git a/third_party/WebKit/Source/core/frame/RootFrameViewport.h b/third_party/WebKit/Source/core/frame/RootFrameViewport.h
index a2888c4..2b0a4d9 100644
--- a/third_party/WebKit/Source/core/frame/RootFrameViewport.h
+++ b/third_party/WebKit/Source/core/frame/RootFrameViewport.h
@@ -24,7 +24,7 @@
 class CORE_EXPORT RootFrameViewport final : public GarbageCollectedFinalized<RootFrameViewport>, public ScrollableArea {
     USING_GARBAGE_COLLECTED_MIXIN(RootFrameViewport);
 public:
-    static RawPtr<RootFrameViewport> create(ScrollableArea& visualViewport, ScrollableArea& layoutViewport)
+    static RootFrameViewport* create(ScrollableArea& visualViewport, ScrollableArea& layoutViewport)
     {
         return new RootFrameViewport(visualViewport, layoutViewport);
     }
diff --git a/third_party/WebKit/Source/core/frame/RootFrameViewportTest.cpp b/third_party/WebKit/Source/core/frame/RootFrameViewportTest.cpp
index 219693ef..e0edd0c 100644
--- a/third_party/WebKit/Source/core/frame/RootFrameViewportTest.cpp
+++ b/third_party/WebKit/Source/core/frame/RootFrameViewportTest.cpp
@@ -26,7 +26,7 @@
 class ScrollableAreaStub : public GarbageCollectedFinalized<ScrollableAreaStub>, public ScrollableArea {
     USING_GARBAGE_COLLECTED_MIXIN(ScrollableAreaStub);
 public:
-    static RawPtr<ScrollableAreaStub> create(const IntSize& viewportSize, const IntSize& contentsSize)
+    static ScrollableAreaStub* create(const IntSize& viewportSize, const IntSize& contentsSize)
     {
         return new ScrollableAreaStub(viewportSize, contentsSize);
     }
@@ -113,7 +113,7 @@
 
 class RootFrameViewStub : public ScrollableAreaStub {
 public:
-    static RawPtr<RootFrameViewStub> create(const IntSize& viewportSize, const IntSize& contentsSize)
+    static RootFrameViewStub* create(const IntSize& viewportSize, const IntSize& contentsSize)
     {
         return new RootFrameViewStub(viewportSize, contentsSize);
     }
@@ -135,7 +135,7 @@
 
 class VisualViewportStub : public ScrollableAreaStub {
 public:
-    static RawPtr<VisualViewportStub> create(const IntSize& viewportSize, const IntSize& contentsSize)
+    static VisualViewportStub* create(const IntSize& viewportSize, const IntSize& contentsSize)
     {
         return new VisualViewportStub(viewportSize, contentsSize);
     }
@@ -189,10 +189,10 @@
 TEST_F(RootFrameViewportTest, UserInputScrollable)
 {
     IntSize viewportSize(100, 150);
-    RawPtr<RootFrameViewStub> layoutViewport = RootFrameViewStub::create(viewportSize, IntSize(200, 300));
-    RawPtr<VisualViewportStub> visualViewport = VisualViewportStub::create(viewportSize, viewportSize);
+    RootFrameViewStub* layoutViewport = RootFrameViewStub::create(viewportSize, IntSize(200, 300));
+    VisualViewportStub* visualViewport = VisualViewportStub::create(viewportSize, viewportSize);
 
-    RawPtr<ScrollableArea> rootFrameViewport = RootFrameViewport::create(*visualViewport.get(), *layoutViewport.get());
+    ScrollableArea* rootFrameViewport = RootFrameViewport::create(*visualViewport, *layoutViewport);
 
     visualViewport->setScale(2);
 
@@ -250,10 +250,10 @@
 TEST_F(RootFrameViewportTest, TestScrollAnimatorUpdatedBeforeScroll)
 {
     IntSize viewportSize(100, 150);
-    RawPtr<RootFrameViewStub> layoutViewport = RootFrameViewStub::create(viewportSize, IntSize(200, 300));
-    RawPtr<VisualViewportStub> visualViewport = VisualViewportStub::create(viewportSize, viewportSize);
+    RootFrameViewStub* layoutViewport = RootFrameViewStub::create(viewportSize, IntSize(200, 300));
+    VisualViewportStub* visualViewport = VisualViewportStub::create(viewportSize, viewportSize);
 
-    RawPtr<ScrollableArea> rootFrameViewport = RootFrameViewport::create(*visualViewport.get(), *layoutViewport.get());
+    ScrollableArea* rootFrameViewport = RootFrameViewport::create(*visualViewport, *layoutViewport);
 
     visualViewport->setScale(2);
 
@@ -289,10 +289,10 @@
 TEST_F(RootFrameViewportTest, ScrollIntoView)
 {
     IntSize viewportSize(100, 150);
-    RawPtr<RootFrameViewStub> layoutViewport = RootFrameViewStub::create(viewportSize, IntSize(200, 300));
-    RawPtr<VisualViewportStub> visualViewport = VisualViewportStub::create(viewportSize, viewportSize);
+    RootFrameViewStub* layoutViewport = RootFrameViewStub::create(viewportSize, IntSize(200, 300));
+    VisualViewportStub* visualViewport = VisualViewportStub::create(viewportSize, viewportSize);
 
-    RawPtr<ScrollableArea> rootFrameViewport = RootFrameViewport::create(*visualViewport.get(), *layoutViewport.get());
+    ScrollableArea* rootFrameViewport = RootFrameViewport::create(*visualViewport, *layoutViewport);
 
     // Test that the visual viewport is scrolled if the viewport has been
     // resized (as is the case when the ChromeOS keyboard comes up) but not
@@ -364,10 +364,10 @@
 TEST_F(RootFrameViewportTest, SetScrollPosition)
 {
     IntSize viewportSize(500, 500);
-    RawPtr<RootFrameViewStub> layoutViewport = RootFrameViewStub::create(viewportSize, IntSize(1000, 2000));
-    RawPtr<VisualViewportStub> visualViewport = VisualViewportStub::create(viewportSize, viewportSize);
+    RootFrameViewStub* layoutViewport = RootFrameViewStub::create(viewportSize, IntSize(1000, 2000));
+    VisualViewportStub* visualViewport = VisualViewportStub::create(viewportSize, viewportSize);
 
-    RawPtr<ScrollableArea> rootFrameViewport = RootFrameViewport::create(*visualViewport.get(), *layoutViewport.get());
+    ScrollableArea* rootFrameViewport = RootFrameViewport::create(*visualViewport, *layoutViewport);
 
     visualViewport->setScale(2);
 
@@ -399,10 +399,10 @@
 TEST_F(RootFrameViewportTest, VisibleContentRect)
 {
     IntSize viewportSize(500, 401);
-    RawPtr<RootFrameViewStub> layoutViewport = RootFrameViewStub::create(viewportSize, IntSize(1000, 2000));
-    RawPtr<VisualViewportStub> visualViewport = VisualViewportStub::create(viewportSize, viewportSize);
+    RootFrameViewStub* layoutViewport = RootFrameViewStub::create(viewportSize, IntSize(1000, 2000));
+    VisualViewportStub* visualViewport = VisualViewportStub::create(viewportSize, viewportSize);
 
-    RawPtr<ScrollableArea> rootFrameViewport = RootFrameViewport::create(*visualViewport.get(), *layoutViewport.get());
+    ScrollableArea* rootFrameViewport = RootFrameViewport::create(*visualViewport, *layoutViewport);
 
     rootFrameViewport->setScrollPosition(DoublePoint(100, 75), ProgrammaticScroll);
 
@@ -424,11 +424,11 @@
 TEST_F(RootFrameViewportTest, ViewportScrollOrder)
 {
     IntSize viewportSize(100, 100);
-    RawPtr<RootFrameViewStub> layoutViewport = RootFrameViewStub::create(viewportSize, IntSize(200, 300));
-    RawPtr<VisualViewportStub> visualViewport = VisualViewportStub::create(viewportSize, viewportSize);
+    RootFrameViewStub* layoutViewport = RootFrameViewStub::create(viewportSize, IntSize(200, 300));
+    VisualViewportStub* visualViewport = VisualViewportStub::create(viewportSize, viewportSize);
 
-    RawPtr<ScrollableArea> rootFrameViewport =
-        RootFrameViewport::create(*visualViewport.get(), *layoutViewport.get());
+    ScrollableArea* rootFrameViewport =
+        RootFrameViewport::create(*visualViewport, *layoutViewport);
 
     visualViewport->setScale(2);
 
diff --git a/third_party/WebKit/Source/core/frame/SmartClip.cpp b/third_party/WebKit/Source/core/frame/SmartClip.cpp
index e4edf18e..b17f5fd6 100644
--- a/third_party/WebKit/Source/core/frame/SmartClip.cpp
+++ b/third_party/WebKit/Source/core/frame/SmartClip.cpp
@@ -69,7 +69,7 @@
     return m_string;
 }
 
-SmartClip::SmartClip(RawPtr<LocalFrame> frame)
+SmartClip::SmartClip(LocalFrame* frame)
     : m_frame(frame)
 {
 }
diff --git a/third_party/WebKit/Source/core/frame/SmartClip.h b/third_party/WebKit/Source/core/frame/SmartClip.h
index c6417c8..70ce049 100644
--- a/third_party/WebKit/Source/core/frame/SmartClip.h
+++ b/third_party/WebKit/Source/core/frame/SmartClip.h
@@ -70,7 +70,7 @@
 class CORE_EXPORT SmartClip {
     STACK_ALLOCATED();
 public:
-    explicit SmartClip(RawPtr<LocalFrame>);
+    explicit SmartClip(LocalFrame*);
 
     SmartClipData dataForRect(const IntRect&);
 
diff --git a/third_party/WebKit/Source/core/frame/SubresourceIntegrityTest.cpp b/third_party/WebKit/Source/core/frame/SubresourceIntegrityTest.cpp
index 970e0bde..b9aecf4 100644
--- a/third_party/WebKit/Source/core/frame/SubresourceIntegrityTest.cpp
+++ b/third_party/WebKit/Source/core/frame/SubresourceIntegrityTest.cpp
@@ -150,16 +150,16 @@
     void expectIntegrity(const char* integrity, const char* script, size_t size, const KURL& url, const KURL& requestorUrl, CorsStatus corsStatus = WithCors)
     {
         scriptElement->setAttribute(HTMLNames::integrityAttr, integrity);
-        EXPECT_TRUE(SubresourceIntegrity::CheckSubresourceIntegrity(*scriptElement, script, size, url, *createTestResource(url, requestorUrl, corsStatus).get()));
+        EXPECT_TRUE(SubresourceIntegrity::CheckSubresourceIntegrity(*scriptElement, script, size, url, *createTestResource(url, requestorUrl, corsStatus)));
     }
 
     void expectIntegrityFailure(const char* integrity, const char* script, size_t size, const KURL& url, const KURL& requestorUrl, CorsStatus corsStatus = WithCors)
     {
         scriptElement->setAttribute(HTMLNames::integrityAttr, integrity);
-        EXPECT_FALSE(SubresourceIntegrity::CheckSubresourceIntegrity(*scriptElement, script, size, url, *createTestResource(url, requestorUrl, corsStatus).get()));
+        EXPECT_FALSE(SubresourceIntegrity::CheckSubresourceIntegrity(*scriptElement, script, size, url, *createTestResource(url, requestorUrl, corsStatus)));
     }
 
-    RawPtr<Resource> createTestResource(const KURL& url, const KURL& allowOriginUrl, CorsStatus corsStatus)
+    Resource* createTestResource(const KURL& url, const KURL& allowOriginUrl, CorsStatus corsStatus)
     {
         ResourceResponse response;
         response.setURL(url);
@@ -168,7 +168,7 @@
             response.setHTTPHeaderField("access-control-allow-origin", SecurityOrigin::create(allowOriginUrl)->toAtomicString());
             response.setHTTPHeaderField("access-control-allow-credentials", "true");
         }
-        RawPtr<Resource> resource = Resource::create(ResourceRequest(response.url()), Resource::Raw);
+        Resource* resource = Resource::create(ResourceRequest(response.url()), Resource::Raw);
         resource->setResponse(response);
         return resource;
     }
diff --git a/third_party/WebKit/Source/core/frame/TopControls.h b/third_party/WebKit/Source/core/frame/TopControls.h
index 7236585..2a27d49e 100644
--- a/third_party/WebKit/Source/core/frame/TopControls.h
+++ b/third_party/WebKit/Source/core/frame/TopControls.h
@@ -21,7 +21,7 @@
 // complete (i.e, upon ScrollEnd or FlingEnd).
 class CORE_EXPORT TopControls final : public GarbageCollectedFinalized<TopControls> {
 public:
-    static RawPtr<TopControls> create(const FrameHost& host)
+    static TopControls* create(const FrameHost& host)
     {
         return new TopControls(host);
     }
diff --git a/third_party/WebKit/Source/core/frame/VisualViewport.h b/third_party/WebKit/Source/core/frame/VisualViewport.h
index 54c6e763..a509231 100644
--- a/third_party/WebKit/Source/core/frame/VisualViewport.h
+++ b/third_party/WebKit/Source/core/frame/VisualViewport.h
@@ -70,7 +70,7 @@
     USING_GARBAGE_COLLECTED_MIXIN(VisualViewport);
     DEFINE_WRAPPERTYPEINFO();
 public:
-    static RawPtr<VisualViewport> create(FrameHost& host)
+    static VisualViewport* create(FrameHost& host)
     {
         return new VisualViewport(host);
     }
diff --git a/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp b/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp
index 1fcf8b49f..9ee22e5 100644
--- a/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp
+++ b/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp
@@ -57,9 +57,9 @@
     m_reportOnly = type == ContentSecurityPolicyHeaderTypeReport;
 }
 
-RawPtr<CSPDirectiveList> CSPDirectiveList::create(ContentSecurityPolicy* policy, const UChar* begin, const UChar* end, ContentSecurityPolicyHeaderType type, ContentSecurityPolicyHeaderSource source)
+CSPDirectiveList* CSPDirectiveList::create(ContentSecurityPolicy* policy, const UChar* begin, const UChar* end, ContentSecurityPolicyHeaderType type, ContentSecurityPolicyHeaderSource source)
 {
-    RawPtr<CSPDirectiveList> directives = new CSPDirectiveList(policy, type, source);
+    CSPDirectiveList* directives = new CSPDirectiveList(policy, type, source);
     directives->parse(begin, end);
 
     if (!directives->checkEval(directives->operativeDirective(directives->m_scriptSrc.get()))) {
@@ -70,7 +70,7 @@
     if (directives->isReportOnly() && directives->reportEndpoints().isEmpty())
         policy->reportMissingReportURI(String(begin, end - begin));
 
-    return directives.release();
+    return directives;
 }
 
 void CSPDirectiveList::reportViolation(const String& directiveText, const String& effectiveDirective, const String& consoleMessage, const KURL& blockedURL) const
@@ -102,9 +102,9 @@
     // never get thrown in report-only mode because the caller won't see
     // a violation.)
     if (m_reportOnly || exceptionStatus == ContentSecurityPolicy::WillNotThrowException) {
-        RawPtr<ConsoleMessage> consoleMessage = ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, reportMessage);
+        ConsoleMessage* consoleMessage = ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, reportMessage);
         consoleMessage->setScriptState(scriptState);
-        m_policy->logToConsole(consoleMessage.release());
+        m_policy->logToConsole(consoleMessage);
     }
     m_policy->reportViolation(directiveText, effectiveDirective, message, blockedURL, m_reportEndpoints, m_header, ContentSecurityPolicy::EvalViolation);
 }
diff --git a/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.h b/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.h
index db5ccdf8..9dcf74d 100644
--- a/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.h
+++ b/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.h
@@ -25,7 +25,7 @@
 class CSPDirectiveList : public GarbageCollectedFinalized<CSPDirectiveList> {
     WTF_MAKE_NONCOPYABLE(CSPDirectiveList);
 public:
-    static RawPtr<CSPDirectiveList> create(ContentSecurityPolicy*, const UChar* begin, const UChar* end, ContentSecurityPolicyHeaderType, ContentSecurityPolicyHeaderSource);
+    static CSPDirectiveList* create(ContentSecurityPolicy*, const UChar* begin, const UChar* end, ContentSecurityPolicyHeaderType, ContentSecurityPolicyHeaderSource);
 
     void parse(const UChar* begin, const UChar* end);
 
diff --git a/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp b/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
index d4f207b..a89159e4 100644
--- a/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
+++ b/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
@@ -995,7 +995,7 @@
     logToConsole(ConsoleMessage::create(SecurityMessageSource, level, message));
 }
 
-void ContentSecurityPolicy::logToConsole(RawPtr<ConsoleMessage> consoleMessage, LocalFrame* frame)
+void ContentSecurityPolicy::logToConsole(ConsoleMessage* consoleMessage, LocalFrame* frame)
 {
     if (frame)
         frame->document()->addConsoleMessage(consoleMessage);
diff --git a/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.h b/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.h
index 89982dd..cfb8795 100644
--- a/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.h
+++ b/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.h
@@ -131,7 +131,7 @@
         URLViolation
     };
 
-    static RawPtr<ContentSecurityPolicy> create()
+    static ContentSecurityPolicy* create()
     {
         return new ContentSecurityPolicy();
     }
@@ -214,7 +214,7 @@
 
     // If a frame is passed in, the message will be logged to its active document's console.
     // Otherwise, the message will be logged to this object's |m_executionContext|.
-    void logToConsole(RawPtr<ConsoleMessage>, LocalFrame* = nullptr);
+    void logToConsole(ConsoleMessage*, LocalFrame* = nullptr);
 
     void reportDirectiveAsSourceExpression(const String& directiveName, const String& sourceExpression);
     void reportDuplicateDirective(const String&);
diff --git a/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicyTest.cpp b/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicyTest.cpp
index 5b5ceec..4427a75 100644
--- a/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicyTest.cpp
+++ b/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicyTest.cpp
@@ -88,7 +88,7 @@
     KURL exampleUrl(KURL(), "http://example.com");
     KURL notExampleUrl(KURL(), "http://not-example.com");
 
-    RawPtr<ContentSecurityPolicy> csp2 = ContentSecurityPolicy::create();
+    ContentSecurityPolicy* csp2 = ContentSecurityPolicy::create();
     csp2->copyStateFrom(csp.get());
     EXPECT_FALSE(csp2->allowScriptFromSource(exampleUrl, ContentSecurityPolicy::DidNotRedirect, ContentSecurityPolicy::SuppressReport));
     EXPECT_TRUE(csp2->allowPluginType("application/x-type-1", "application/x-type-1", exampleUrl, ContentSecurityPolicy::SuppressReport));
@@ -105,7 +105,7 @@
     KURL exampleUrl(KURL(), "http://example.com");
     KURL notExampleUrl(KURL(), "http://not-example.com");
 
-    RawPtr<ContentSecurityPolicy> csp2 = ContentSecurityPolicy::create();
+    ContentSecurityPolicy* csp2 = ContentSecurityPolicy::create();
     csp2->copyPluginTypesFrom(csp.get());
     EXPECT_TRUE(csp2->allowScriptFromSource(exampleUrl, ContentSecurityPolicy::DidNotRedirect, ContentSecurityPolicy::SuppressReport));
     EXPECT_TRUE(csp2->allowPluginType("application/x-type-1", "application/x-type-1", exampleUrl, ContentSecurityPolicy::SuppressReport));
diff --git a/third_party/WebKit/Source/core/html/HTMLCollection.h b/third_party/WebKit/Source/core/html/HTMLCollection.h
index 59bb446..3cc3d48 100644
--- a/third_party/WebKit/Source/core/html/HTMLCollection.h
+++ b/third_party/WebKit/Source/core/html/HTMLCollection.h
@@ -85,10 +85,8 @@
 
         DEFINE_INLINE_TRACE()
         {
-#if ENABLE(OILPAN)
             visitor->trace(m_idCache);
             visitor->trace(m_nameCache);
-#endif
         }
 
     private:
diff --git a/third_party/WebKit/Source/core/html/HTMLFieldSetElement.cpp b/third_party/WebKit/Source/core/html/HTMLFieldSetElement.cpp
index 61b1b50..b0638e8a 100644
--- a/third_party/WebKit/Source/core/html/HTMLFieldSetElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLFieldSetElement.cpp
@@ -51,9 +51,7 @@
 
 DEFINE_TRACE(HTMLFieldSetElement)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_associatedElements);
-#endif
     HTMLFormControlElement::trace(visitor);
 }
 
diff --git a/third_party/WebKit/Source/core/html/HTMLFormElement.cpp b/third_party/WebKit/Source/core/html/HTMLFormElement.cpp
index 16a0678..fc459a3 100644
--- a/third_party/WebKit/Source/core/html/HTMLFormElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLFormElement.cpp
@@ -98,13 +98,11 @@
 
 DEFINE_TRACE(HTMLFormElement)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_pastNamesMap);
     visitor->trace(m_radioButtonGroupScope);
     visitor->trace(m_associatedElements);
     visitor->trace(m_imageElements);
     visitor->trace(m_pendingAutocompleteEventsQueue);
-#endif
     HTMLElement::trace(visitor);
 }
 
diff --git a/third_party/WebKit/Source/core/html/HTMLMediaElement.cpp b/third_party/WebKit/Source/core/html/HTMLMediaElement.cpp
index 0e2c06a..06d4a93 100644
--- a/third_party/WebKit/Source/core/html/HTMLMediaElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLMediaElement.cpp
@@ -107,7 +107,7 @@
 using namespace HTMLNames;
 
 using WeakMediaElementSet = HeapHashSet<WeakMember<HTMLMediaElement>>;
-using DocumentElementSetMap = HeapHashMap<WeakMember<Document>, WeakMediaElementSet>;
+using DocumentElementSetMap = HeapHashMap<WeakMember<Document>, Member<WeakMediaElementSet>>;
 
 namespace {
 
@@ -147,18 +147,26 @@
 void addElementToDocumentMap(HTMLMediaElement* element, Document* document)
 {
     DocumentElementSetMap& map = documentToElementSetMap();
-    WeakMediaElementSet set = map.take(document);
-    set.add(element);
-    map.add(document, set);
+    WeakMediaElementSet* set = nullptr;
+    auto it = map.find(document);
+    if (it == map.end()) {
+        set = new WeakMediaElementSet;
+        map.add(document, set);
+    } else {
+        set = it->value;
+    }
+    set->add(element);
 }
 
 void removeElementFromDocumentMap(HTMLMediaElement* element, Document* document)
 {
     DocumentElementSetMap& map = documentToElementSetMap();
-    WeakMediaElementSet set = map.take(document);
-    set.remove(element);
-    if (!set.isEmpty())
-        map.add(document, set);
+    auto it = map.find(document);
+    ASSERT(it != map.end());
+    WeakMediaElementSet* set = it->value;
+    set->remove(element);
+    if (set->isEmpty())
+        map.remove(it);
 }
 
 class AudioSourceProviderClientLockScope {
@@ -3356,7 +3364,11 @@
 
 void HTMLMediaElement::setTextTrackKindUserPreferenceForAllMediaElements(Document* document)
 {
-    WeakMediaElementSet elements = documentToElementSetMap().get(document);
+    auto it = documentToElementSetMap().find(document);
+    if (it == documentToElementSetMap().end())
+        return;
+    ASSERT(it->value);
+    WeakMediaElementSet& elements = *it->value;
     for (const auto& element : elements)
         element->automaticTrackSelectionForUpdatedUserPreference();
 }
diff --git a/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp b/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
index 9182cce..1c2af0e 100644
--- a/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
@@ -1821,9 +1821,7 @@
 
 DEFINE_TRACE(HTMLSelectElement)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_listItems);
-#endif
     visitor->trace(m_lastOnChangeOption);
     visitor->trace(m_activeSelectionAnchor);
     visitor->trace(m_activeSelectionEnd);
diff --git a/third_party/WebKit/Source/core/html/HTMLSlotElement.cpp b/third_party/WebKit/Source/core/html/HTMLSlotElement.cpp
index 6f25704..3e0495f 100644
--- a/third_party/WebKit/Source/core/html/HTMLSlotElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLSlotElement.cpp
@@ -286,12 +286,10 @@
 
 DEFINE_TRACE(HTMLSlotElement)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_assignedNodes);
     visitor->trace(m_distributedNodes);
     visitor->trace(m_distributedIndices);
     visitor->trace(m_oldDistributedNodes);
-#endif
     HTMLElement::trace(visitor);
 }
 
diff --git a/third_party/WebKit/Source/core/html/canvas/CanvasFontCache.cpp b/third_party/WebKit/Source/core/html/canvas/CanvasFontCache.cpp
index dcd35037c..f3ff785 100644
--- a/third_party/WebKit/Source/core/html/canvas/CanvasFontCache.cpp
+++ b/third_party/WebKit/Source/core/html/canvas/CanvasFontCache.cpp
@@ -153,10 +153,8 @@
 
 DEFINE_TRACE(CanvasFontCache)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_fetchedFonts);
     visitor->trace(m_document);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/html/forms/FormController.cpp b/third_party/WebKit/Source/core/html/forms/FormController.cpp
index 134ff9c..1de236f 100644
--- a/third_party/WebKit/Source/core/html/forms/FormController.cpp
+++ b/third_party/WebKit/Source/core/html/forms/FormController.cpp
@@ -293,9 +293,7 @@
     static FormKeyGenerator* create() { return new FormKeyGenerator; }
     DEFINE_INLINE_TRACE()
     {
-#if ENABLE(OILPAN)
         visitor->trace(m_formToKeyMap);
-#endif
     }
     const AtomicString& formKey(const HTMLFormControlElementWithState&);
     void willDeleteForm(HTMLFormElement*);
@@ -386,9 +384,7 @@
 
 DEFINE_TRACE(DocumentState)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_formControls);
-#endif
 }
 
 void DocumentState::addControl(HTMLFormControlElementWithState* control)
diff --git a/third_party/WebKit/Source/core/html/forms/RadioButtonGroupScope.cpp b/third_party/WebKit/Source/core/html/forms/RadioButtonGroupScope.cpp
index 8ffe3a6..53621abc 100644
--- a/third_party/WebKit/Source/core/html/forms/RadioButtonGroupScope.cpp
+++ b/third_party/WebKit/Source/core/html/forms/RadioButtonGroupScope.cpp
@@ -210,10 +210,8 @@
 
 DEFINE_TRACE(RadioButtonGroup)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_members);
     visitor->trace(m_checkedButton);
-#endif
 }
 
 // ----------------------------------------------------------------
@@ -322,9 +320,7 @@
 
 DEFINE_TRACE(RadioButtonGroupScope)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_nameToGroupMap);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/html/imports/HTMLImportLoader.cpp b/third_party/WebKit/Source/core/html/imports/HTMLImportLoader.cpp
index d2453a3..21bca5c 100644
--- a/third_party/WebKit/Source/core/html/imports/HTMLImportLoader.cpp
+++ b/third_party/WebKit/Source/core/html/imports/HTMLImportLoader.cpp
@@ -223,9 +223,7 @@
 DEFINE_TRACE(HTMLImportLoader)
 {
     visitor->trace(m_controller);
-#if ENABLE(OILPAN)
     visitor->trace(m_imports);
-#endif
     visitor->trace(m_document);
     visitor->trace(m_writer);
     visitor->trace(m_microtaskQueue);
diff --git a/third_party/WebKit/Source/core/html/parser/HTMLElementStack.cpp b/third_party/WebKit/Source/core/html/parser/HTMLElementStack.cpp
index 2726f5f..c767904 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLElementStack.cpp
+++ b/third_party/WebKit/Source/core/html/parser/HTMLElementStack.cpp
@@ -150,10 +150,8 @@
 
 DEFINE_TRACE(HTMLElementStack::ElementRecord)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_item);
     visitor->trace(m_next);
-#endif
 }
 
 HTMLElementStack::HTMLElementStack()
diff --git a/third_party/WebKit/Source/core/html/parser/HTMLFormattingElementList.h b/third_party/WebKit/Source/core/html/parser/HTMLFormattingElementList.h
index 9dd3a1e..3c5b7c9 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLFormattingElementList.h
+++ b/third_party/WebKit/Source/core/html/parser/HTMLFormattingElementList.h
@@ -128,9 +128,7 @@
 
     DEFINE_INLINE_TRACE()
     {
-#if ENABLE(OILPAN)
         visitor->trace(m_entries);
-#endif
     }
 
 #ifndef NDEBUG
diff --git a/third_party/WebKit/Source/core/html/shadow/DateTimeEditElement.cpp b/third_party/WebKit/Source/core/html/shadow/DateTimeEditElement.cpp
index ff4fcdf..837c935 100644
--- a/third_party/WebKit/Source/core/html/shadow/DateTimeEditElement.cpp
+++ b/third_party/WebKit/Source/core/html/shadow/DateTimeEditElement.cpp
@@ -462,9 +462,7 @@
 
 DEFINE_TRACE(DateTimeEditElement)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_fields);
-#endif
     visitor->trace(m_editControlOwner);
     HTMLDivElement::trace(visitor);
 }
diff --git a/third_party/WebKit/Source/core/input/EventHandler.cpp b/third_party/WebKit/Source/core/input/EventHandler.cpp
index ae2dd983..c68a6f26 100644
--- a/third_party/WebKit/Source/core/input/EventHandler.cpp
+++ b/third_party/WebKit/Source/core/input/EventHandler.cpp
@@ -276,7 +276,6 @@
 
 DEFINE_TRACE(EventHandler)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_frame);
     visitor->trace(m_mousePressNode);
     visitor->trace(m_resizeScrollableArea);
@@ -296,7 +295,6 @@
     visitor->trace(m_lastDeferredTapElement);
     visitor->trace(m_selectionController);
     visitor->trace(m_pointerEventManager);
-#endif
 }
 
 DragState& EventHandler::dragState()
diff --git a/third_party/WebKit/Source/core/input/PointerEventManager.cpp b/third_party/WebKit/Source/core/input/PointerEventManager.cpp
index ffdc2ed..4196e60 100644
--- a/third_party/WebKit/Source/core/input/PointerEventManager.cpp
+++ b/third_party/WebKit/Source/core/input/PointerEventManager.cpp
@@ -568,11 +568,9 @@
 
 DEFINE_TRACE(PointerEventManager)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_nodeUnderPointer);
     visitor->trace(m_pointerCaptureTarget);
     visitor->trace(m_pendingPointerCaptureTarget);
-#endif
 }
 
 
diff --git a/third_party/WebKit/Source/core/inspector/AsyncCallTracker.cpp b/third_party/WebKit/Source/core/inspector/AsyncCallTracker.cpp
index 2b83d47..1d7ee74b 100644
--- a/third_party/WebKit/Source/core/inspector/AsyncCallTracker.cpp
+++ b/third_party/WebKit/Source/core/inspector/AsyncCallTracker.cpp
@@ -88,7 +88,6 @@
     DEFINE_INLINE_VIRTUAL_TRACE()
     {
         visitor->trace(m_tracker);
-#if ENABLE(OILPAN)
         visitor->trace(m_timerCallChains);
         visitor->trace(m_animationFrameCallChains);
         visitor->trace(m_eventCallChains);
@@ -96,7 +95,6 @@
         visitor->trace(m_mutationObserverCallChains);
         visitor->trace(m_executionContextTaskCallChains);
         visitor->trace(m_asyncOperations);
-#endif
         ContextLifecycleObserver::trace(visitor);
     }
 
@@ -423,10 +421,8 @@
 
 DEFINE_TRACE(AsyncCallTracker)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_executionContextDataMap);
     visitor->trace(m_instrumentingAgents);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/inspector/InspectorAnimationAgent.cpp b/third_party/WebKit/Source/core/inspector/InspectorAnimationAgent.cpp
index 6a39a09..64f758fb 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorAnimationAgent.cpp
+++ b/third_party/WebKit/Source/core/inspector/InspectorAnimationAgent.cpp
@@ -487,14 +487,12 @@
 
 DEFINE_TRACE(InspectorAnimationAgent)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_inspectedFrames);
     visitor->trace(m_domAgent);
     visitor->trace(m_cssAgent);
     visitor->trace(m_idToAnimation);
     visitor->trace(m_idToAnimationType);
     visitor->trace(m_idToAnimationClone);
-#endif
     InspectorBaseAgent::trace(visitor);
 }
 
diff --git a/third_party/WebKit/Source/core/inspector/InspectorBaseAgent.cpp b/third_party/WebKit/Source/core/inspector/InspectorBaseAgent.cpp
index 56c103b..bd830a8 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorBaseAgent.cpp
+++ b/third_party/WebKit/Source/core/inspector/InspectorBaseAgent.cpp
@@ -136,9 +136,7 @@
 DEFINE_TRACE(InspectorAgentRegistry)
 {
     visitor->trace(m_instrumentingAgents);
-#if ENABLE(OILPAN)
     visitor->trace(m_agents);
-#endif
 }
 
 void InspectorAgentRegistry::didCommitLoadForLocalFrame(LocalFrame* frame)
diff --git a/third_party/WebKit/Source/core/inspector/InspectorCSSAgent.cpp b/third_party/WebKit/Source/core/inspector/InspectorCSSAgent.cpp
index cb63ec0..7b401ba 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorCSSAgent.cpp
+++ b/third_party/WebKit/Source/core/inspector/InspectorCSSAgent.cpp
@@ -2104,7 +2104,6 @@
     visitor->trace(m_inspectedFrames);
     visitor->trace(m_resourceAgent);
     visitor->trace(m_resourceContentLoader);
-#if ENABLE(OILPAN)
     visitor->trace(m_idToInspectorStyleSheet);
     visitor->trace(m_idToInspectorStyleSheetForInlineStyle);
     visitor->trace(m_cssStyleSheetToInspectorStyleSheet);
@@ -2112,7 +2111,6 @@
     visitor->trace(m_invalidatedDocuments);
     visitor->trace(m_nodeToInspectorStyleSheet);
     visitor->trace(m_documentToViaInspectorStyleSheet);
-#endif
     visitor->trace(m_inspectorUserAgentStyleSheet);
     InspectorBaseAgent::trace(visitor);
 }
diff --git a/third_party/WebKit/Source/core/inspector/InspectorDOMAgent.cpp b/third_party/WebKit/Source/core/inspector/InspectorDOMAgent.cpp
index b2e3425..ca150bc8 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorDOMAgent.cpp
+++ b/third_party/WebKit/Source/core/inspector/InspectorDOMAgent.cpp
@@ -181,9 +181,7 @@
 DEFINE_TRACE(InspectorRevalidateDOMTask)
 {
     visitor->trace(m_domAgent);
-#if ENABLE(OILPAN)
     visitor->trace(m_styleAttrInvalidatedElements);
-#endif
 }
 
 String InspectorDOMAgent::toErrorString(ExceptionState& exceptionState)
@@ -2079,7 +2077,6 @@
 {
     visitor->trace(m_domListener);
     visitor->trace(m_inspectedFrames);
-#if ENABLE(OILPAN)
     visitor->trace(m_documentNodeToIdMap);
     visitor->trace(m_danglingNodeToIdMaps);
     visitor->trace(m_idToNode);
@@ -2087,7 +2084,6 @@
     visitor->trace(m_document);
     visitor->trace(m_revalidateTask);
     visitor->trace(m_searchResults);
-#endif
     visitor->trace(m_history);
     visitor->trace(m_domEditor);
     InspectorBaseAgent::trace(visitor);
diff --git a/third_party/WebKit/Source/core/inspector/InspectorDOMDebuggerAgent.cpp b/third_party/WebKit/Source/core/inspector/InspectorDOMDebuggerAgent.cpp
index ee58ce9..507fb3a 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorDOMDebuggerAgent.cpp
+++ b/third_party/WebKit/Source/core/inspector/InspectorDOMDebuggerAgent.cpp
@@ -146,9 +146,7 @@
 DEFINE_TRACE(InspectorDOMDebuggerAgent)
 {
     visitor->trace(m_domAgent);
-#if ENABLE(OILPAN)
     visitor->trace(m_domBreakpoints);
-#endif
     InspectorBaseAgent::trace(visitor);
 }
 
diff --git a/third_party/WebKit/Source/core/inspector/InspectorResourceContentLoader.cpp b/third_party/WebKit/Source/core/inspector/InspectorResourceContentLoader.cpp
index 354b9f9..4465651 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorResourceContentLoader.cpp
+++ b/third_party/WebKit/Source/core/inspector/InspectorResourceContentLoader.cpp
@@ -164,11 +164,9 @@
 
 DEFINE_TRACE(InspectorResourceContentLoader)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_inspectedFrame);
     visitor->trace(m_pendingResourceClients);
     visitor->trace(m_resources);
-#endif
 }
 
 void InspectorResourceContentLoader::didCommitLoadForLocalFrame(LocalFrame* frame)
diff --git a/third_party/WebKit/Source/core/inspector/InspectorWorkerAgent.cpp b/third_party/WebKit/Source/core/inspector/InspectorWorkerAgent.cpp
index 06d41b43..c2abbf7 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorWorkerAgent.cpp
+++ b/third_party/WebKit/Source/core/inspector/InspectorWorkerAgent.cpp
@@ -193,10 +193,8 @@
 
 DEFINE_TRACE(InspectorWorkerAgent)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_connectedProxies);
     visitor->trace(m_consoleAgent);
-#endif
     visitor->trace(m_inspectedFrames);
     InspectorBaseAgent<InspectorWorkerAgent, protocol::Frontend::Worker>::trace(visitor);
 }
diff --git a/third_party/WebKit/Source/core/inspector/NetworkResourcesData.cpp b/third_party/WebKit/Source/core/inspector/NetworkResourcesData.cpp
index c573352..767557e 100644
--- a/third_party/WebKit/Source/core/inspector/NetworkResourcesData.cpp
+++ b/third_party/WebKit/Source/core/inspector/NetworkResourcesData.cpp
@@ -157,9 +157,7 @@
 
 DEFINE_TRACE(NetworkResourcesData)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_requestIdToResourceDataMap);
-#endif
 }
 
 void NetworkResourcesData::resourceCreated(const String& requestId, const String& loaderId, const KURL& requestedURL)
diff --git a/third_party/WebKit/Source/core/inspector/PageConsoleAgent.cpp b/third_party/WebKit/Source/core/inspector/PageConsoleAgent.cpp
index 6916c8f..a4ae0d6 100644
--- a/third_party/WebKit/Source/core/inspector/PageConsoleAgent.cpp
+++ b/third_party/WebKit/Source/core/inspector/PageConsoleAgent.cpp
@@ -64,9 +64,7 @@
 {
     visitor->trace(m_inspectorDOMAgent);
     visitor->trace(m_inspectedFrames);
-#if ENABLE(OILPAN)
     visitor->trace(m_workersWithEnabledConsole);
-#endif
     InspectorConsoleAgent::trace(visitor);
 }
 
diff --git a/third_party/WebKit/Source/core/layout/LayoutScrollbar.cpp b/third_party/WebKit/Source/core/layout/LayoutScrollbar.cpp
index 56b879b..75b9adb 100644
--- a/third_party/WebKit/Source/core/layout/LayoutScrollbar.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutScrollbar.cpp
@@ -82,10 +82,8 @@
 
 DEFINE_TRACE(LayoutScrollbar)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_owner);
     visitor->trace(m_owningFrame);
-#endif
     Scrollbar::trace(visitor);
 }
 
diff --git a/third_party/WebKit/Source/core/layout/svg/LayoutSVGResourceFilter.cpp b/third_party/WebKit/Source/core/layout/svg/LayoutSVGResourceFilter.cpp
index aec63ed..b0ebc109 100644
--- a/third_party/WebKit/Source/core/layout/svg/LayoutSVGResourceFilter.cpp
+++ b/third_party/WebKit/Source/core/layout/svg/LayoutSVGResourceFilter.cpp
@@ -29,10 +29,8 @@
 
 DEFINE_TRACE(FilterData)
 {
-#if ENABLE(OILPAN)
     visitor->trace(filter);
     visitor->trace(nodeMap);
-#endif
 }
 
 void FilterData::dispose()
diff --git a/third_party/WebKit/Source/core/layout/svg/SVGTextLayoutAttributesBuilder.cpp b/third_party/WebKit/Source/core/layout/svg/SVGTextLayoutAttributesBuilder.cpp
index 326ddda3..520f25d 100644
--- a/third_party/WebKit/Source/core/layout/svg/SVGTextLayoutAttributesBuilder.cpp
+++ b/third_party/WebKit/Source/core/layout/svg/SVGTextLayoutAttributesBuilder.cpp
@@ -162,60 +162,84 @@
         data.y = 0;
 }
 
-static inline void updateCharacterData(unsigned i, float& lastRotation, SVGCharacterData& data, const SVGLengthContext& lengthContext, const SVGLengthList* xList, const SVGLengthList* yList, const SVGLengthList* dxList, const SVGLengthList* dyList, const SVGNumberList* rotateList)
+namespace {
+
+class AttributeListsIterator {
+    STACK_ALLOCATED();
+public:
+    AttributeListsIterator(SVGTextPositioningElement*);
+
+    bool hasAttributes() const
+    {
+        return m_xListRemaining || m_yListRemaining
+            || m_dxListRemaining || m_dyListRemaining
+            || m_rotateListRemaining;
+    }
+    void updateCharacterData(size_t index, SVGCharacterData&);
+
+private:
+    SVGLengthContext m_lengthContext;
+    Member<SVGLengthList> m_xList;
+    unsigned m_xListRemaining;
+    Member<SVGLengthList> m_yList;
+    unsigned m_yListRemaining;
+    Member<SVGLengthList> m_dxList;
+    unsigned m_dxListRemaining;
+    Member<SVGLengthList> m_dyList;
+    unsigned m_dyListRemaining;
+    Member<SVGNumberList> m_rotateList;
+    unsigned m_rotateListRemaining;
+};
+
+AttributeListsIterator::AttributeListsIterator(SVGTextPositioningElement* element)
+    : m_lengthContext(element)
+    , m_xList(element->x()->currentValue())
+    , m_xListRemaining(m_xList->length())
+    , m_yList(element->y()->currentValue())
+    , m_yListRemaining(m_yList->length())
+    , m_dxList(element->dx()->currentValue())
+    , m_dxListRemaining(m_dxList->length())
+    , m_dyList(element->dy()->currentValue())
+    , m_dyListRemaining(m_dyList->length())
+    , m_rotateList(element->rotate()->currentValue())
+    , m_rotateListRemaining(m_rotateList->length())
 {
-    if (xList)
-        data.x = xList->at(i)->value(lengthContext);
-    if (yList)
-        data.y = yList->at(i)->value(lengthContext);
-    if (dxList)
-        data.dx = dxList->at(i)->value(lengthContext);
-    if (dyList)
-        data.dy = dyList->at(i)->value(lengthContext);
-    if (rotateList) {
-        data.rotate = rotateList->at(i)->value();
-        lastRotation = data.rotate;
+}
+
+inline void AttributeListsIterator::updateCharacterData(size_t index, SVGCharacterData& data)
+{
+    if (m_xListRemaining) {
+        data.x = m_xList->at(index)->value(m_lengthContext);
+        --m_xListRemaining;
+    }
+    if (m_yListRemaining) {
+        data.y = m_yList->at(index)->value(m_lengthContext);
+        --m_yListRemaining;
+    }
+    if (m_dxListRemaining) {
+        data.dx = m_dxList->at(index)->value(m_lengthContext);
+        --m_dxListRemaining;
+    }
+    if (m_dyListRemaining) {
+        data.dy = m_dyList->at(index)->value(m_lengthContext);
+        --m_dyListRemaining;
+    }
+    if (m_rotateListRemaining) {
+        data.rotate = m_rotateList->at(std::min(index, m_rotateList->length() - 1))->value();
+        // The last rotation value spans the whole scope.
+        if (m_rotateListRemaining > 1)
+            --m_rotateListRemaining;
     }
 }
 
+} // namespace
+
 void SVGTextLayoutAttributesBuilder::fillCharacterDataMap(const TextPosition& position)
 {
-    RawPtr<SVGLengthList> xList = position.element->x()->currentValue();
-    RawPtr<SVGLengthList> yList = position.element->y()->currentValue();
-    RawPtr<SVGLengthList> dxList = position.element->dx()->currentValue();
-    RawPtr<SVGLengthList> dyList = position.element->dy()->currentValue();
-    RawPtr<SVGNumberList> rotateList = position.element->rotate()->currentValue();
-
-    unsigned xListSize = xList->length();
-    unsigned yListSize = yList->length();
-    unsigned dxListSize = dxList->length();
-    unsigned dyListSize = dyList->length();
-    unsigned rotateListSize = rotateList->length();
-    if (!xListSize && !yListSize && !dxListSize && !dyListSize && !rotateListSize)
-        return;
-
-    float lastRotation = SVGTextLayoutAttributes::emptyValue();
-    SVGLengthContext lengthContext(position.element);
-    for (unsigned i = 0; i < position.length; ++i) {
-        const SVGLengthList* xListPtr = i < xListSize ? xList.get() : 0;
-        const SVGLengthList* yListPtr = i < yListSize ? yList.get() : 0;
-        const SVGLengthList* dxListPtr = i < dxListSize ? dxList.get() : 0;
-        const SVGLengthList* dyListPtr = i < dyListSize ? dyList.get() : 0;
-        const SVGNumberList* rotateListPtr = i < rotateListSize ? rotateList.get() : 0;
-        if (!xListPtr && !yListPtr && !dxListPtr && !dyListPtr && !rotateListPtr)
-            break;
-
+    AttributeListsIterator attrLists(position.element);
+    for (unsigned i = 0; attrLists.hasAttributes() && i < position.length; ++i) {
         SVGCharacterData& data = m_characterDataMap.add(position.start + i + 1, SVGCharacterData()).storedValue->value;
-        updateCharacterData(i, lastRotation, data, lengthContext, xListPtr, yListPtr, dxListPtr, dyListPtr, rotateListPtr);
-    }
-
-    // The last rotation value always spans the whole scope.
-    if (SVGTextLayoutAttributes::isEmptyValue(lastRotation))
-        return;
-
-    for (unsigned i = rotateList->length(); i < position.length; ++i) {
-        SVGCharacterData& data = m_characterDataMap.add(position.start + i + 1, SVGCharacterData()).storedValue->value;
-        data.rotate = lastRotation;
+        attrLists.updateCharacterData(i, data);
     }
 }
 
diff --git a/third_party/WebKit/Source/core/loader/DocumentLoader.h b/third_party/WebKit/Source/core/loader/DocumentLoader.h
index 984f7d5..9cc7b2a 100644
--- a/third_party/WebKit/Source/core/loader/DocumentLoader.h
+++ b/third_party/WebKit/Source/core/loader/DocumentLoader.h
@@ -117,7 +117,7 @@
     void clearRedirectChain();
     void appendRedirect(const KURL&);
 
-    RawPtr<ContentSecurityPolicy> releaseContentSecurityPolicy() { return m_contentSecurityPolicy.release(); }
+    ContentSecurityPolicy* releaseContentSecurityPolicy() { return m_contentSecurityPolicy.release(); }
 
     ClientHintsPreferences& clientHintsPreferences() { return m_clientHintsPreferences; }
 
diff --git a/third_party/WebKit/Source/core/loader/EmptyClients.cpp b/third_party/WebKit/Source/core/loader/EmptyClients.cpp
index 94e8e6c..cb0f8b2 100644
--- a/third_party/WebKit/Source/core/loader/EmptyClients.cpp
+++ b/third_party/WebKit/Source/core/loader/EmptyClients.cpp
@@ -162,7 +162,7 @@
     return nullptr;
 }
 
-void EmptyTextCheckerClient::requestCheckingOfString(RawPtr<TextCheckingRequest>)
+void EmptyTextCheckerClient::requestCheckingOfString(TextCheckingRequest*)
 {
 }
 
diff --git a/third_party/WebKit/Source/core/loader/EmptyClients.h b/third_party/WebKit/Source/core/loader/EmptyClients.h
index 2ac5d1fd..8cb3a8c 100644
--- a/third_party/WebKit/Source/core/loader/EmptyClients.h
+++ b/third_party/WebKit/Source/core/loader/EmptyClients.h
@@ -282,7 +282,7 @@
 
     void checkSpellingOfString(const String&, int*, int*) override {}
     void checkGrammarOfString(const String&, Vector<GrammarDetail>&, int*, int*) override {}
-    void requestCheckingOfString(RawPtr<TextCheckingRequest>) override;
+    void requestCheckingOfString(TextCheckingRequest*) override;
 };
 
 class EmptySpellCheckerClient : public SpellCheckerClient {
diff --git a/third_party/WebKit/Source/core/page/PrintContext.cpp b/third_party/WebKit/Source/core/page/PrintContext.cpp
index 1eb1dcc4..69010082 100644
--- a/third_party/WebKit/Source/core/page/PrintContext.cpp
+++ b/third_party/WebKit/Source/core/page/PrintContext.cpp
@@ -317,10 +317,8 @@
 
 DEFINE_TRACE(PrintContext)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_frame);
     visitor->trace(m_linkedDestinations);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/page/scrolling/ScrollingCoordinator.cpp b/third_party/WebKit/Source/core/page/scrolling/ScrollingCoordinator.cpp
index 9e4a8dd8..e15eb53 100644
--- a/third_party/WebKit/Source/core/page/scrolling/ScrollingCoordinator.cpp
+++ b/third_party/WebKit/Source/core/page/scrolling/ScrollingCoordinator.cpp
@@ -105,10 +105,8 @@
 DEFINE_TRACE(ScrollingCoordinator)
 {
     visitor->trace(m_page);
-#if ENABLE(OILPAN)
     visitor->trace(m_horizontalScrollbars);
     visitor->trace(m_verticalScrollbars);
-#endif
 }
 
 void ScrollingCoordinator::setShouldHandleScrollGestureOnMainThreadRegion(const Region& region)
diff --git a/third_party/WebKit/Source/core/svg/SVGCursorElement.cpp b/third_party/WebKit/Source/core/svg/SVGCursorElement.cpp
index cc8426a..c77b069 100644
--- a/third_party/WebKit/Source/core/svg/SVGCursorElement.cpp
+++ b/third_party/WebKit/Source/core/svg/SVGCursorElement.cpp
@@ -88,11 +88,9 @@
 
 DEFINE_TRACE(SVGCursorElement)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_x);
     visitor->trace(m_y);
     visitor->trace(m_clients);
-#endif
     SVGElement::trace(visitor);
     SVGTests::trace(visitor);
     SVGURIReference::trace(visitor);
diff --git a/third_party/WebKit/Source/core/svg/SVGDocumentExtensions.cpp b/third_party/WebKit/Source/core/svg/SVGDocumentExtensions.cpp
index df5b5777..d4f7ef5 100644
--- a/third_party/WebKit/Source/core/svg/SVGDocumentExtensions.cpp
+++ b/third_party/WebKit/Source/core/svg/SVGDocumentExtensions.cpp
@@ -358,14 +358,12 @@
 
 DEFINE_TRACE(SVGDocumentExtensions)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_document);
     visitor->trace(m_timeContainers);
     visitor->trace(m_webAnimationsPendingSVGElements);
     visitor->trace(m_relativeLengthSVGRoots);
     visitor->trace(m_pendingResources);
     visitor->trace(m_pendingResourcesForRemoval);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/svg/SVGElement.cpp b/third_party/WebKit/Source/core/svg/SVGElement.cpp
index 50909a34..54255cd5 100644
--- a/third_party/WebKit/Source/core/svg/SVGElement.cpp
+++ b/third_party/WebKit/Source/core/svg/SVGElement.cpp
@@ -1207,12 +1207,10 @@
 
 DEFINE_TRACE(SVGElement)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_elementsWithRelativeLengths);
     visitor->trace(m_attributeToPropertyMap);
     visitor->trace(m_SVGRareData);
     visitor->trace(m_className);
-#endif
     Element::trace(visitor);
 }
 
diff --git a/third_party/WebKit/Source/core/svg/SVGElementRareData.cpp b/third_party/WebKit/Source/core/svg/SVGElementRareData.cpp
index 6dcd4470..c7b0e16 100644
--- a/third_party/WebKit/Source/core/svg/SVGElementRareData.cpp
+++ b/third_party/WebKit/Source/core/svg/SVGElementRareData.cpp
@@ -34,7 +34,6 @@
 
 DEFINE_TRACE(SVGElementRareData)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_outgoingReferences);
     visitor->trace(m_incomingReferences);
     visitor->trace(m_animatedSMILStyleProperties);
@@ -42,7 +41,6 @@
     visitor->trace(m_correspondingElement);
     visitor->trace(m_owner);
     visitor->template registerWeakMembers<SVGElementRareData, &SVGElementRareData::processWeakMembers>(this);
-#endif
 }
 
 void SVGElementRareData::processWeakMembers(Visitor* visitor)
diff --git a/third_party/WebKit/Source/core/svg/SVGFilterElement.cpp b/third_party/WebKit/Source/core/svg/SVGFilterElement.cpp
index c6d3b44..7cf3e658 100644
--- a/third_party/WebKit/Source/core/svg/SVGFilterElement.cpp
+++ b/third_party/WebKit/Source/core/svg/SVGFilterElement.cpp
@@ -68,14 +68,12 @@
 
 DEFINE_TRACE(SVGFilterElement)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_x);
     visitor->trace(m_y);
     visitor->trace(m_width);
     visitor->trace(m_height);
     visitor->trace(m_filterUnits);
     visitor->trace(m_primitiveUnits);
-#endif
     SVGElement::trace(visitor);
     SVGURIReference::trace(visitor);
 }
diff --git a/third_party/WebKit/Source/core/svg/animation/SMILTimeContainer.cpp b/third_party/WebKit/Source/core/svg/animation/SMILTimeContainer.cpp
index 311e6a9..f6d9521 100644
--- a/third_party/WebKit/Source/core/svg/animation/SMILTimeContainer.cpp
+++ b/third_party/WebKit/Source/core/svg/animation/SMILTimeContainer.cpp
@@ -556,9 +556,7 @@
 
 DEFINE_TRACE(SMILTimeContainer)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_scheduledAnimations);
-#endif
     visitor->trace(m_ownerSVGElement);
 }
 
diff --git a/third_party/WebKit/Source/core/svg/animation/SVGSMILElement.cpp b/third_party/WebKit/Source/core/svg/animation/SVGSMILElement.cpp
index 0df9aad..f8e05d5d 100644
--- a/third_party/WebKit/Source/core/svg/animation/SVGSMILElement.cpp
+++ b/third_party/WebKit/Source/core/svg/animation/SVGSMILElement.cpp
@@ -1364,12 +1364,10 @@
 
 DEFINE_TRACE(SVGSMILElement)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_targetElement);
     visitor->trace(m_timeContainer);
     visitor->trace(m_conditions);
     visitor->trace(m_syncBaseDependents);
-#endif
     SVGElement::trace(visitor);
     SVGTests::trace(visitor);
 }
diff --git a/third_party/WebKit/Source/core/svg/graphics/filters/SVGFilterBuilder.cpp b/third_party/WebKit/Source/core/svg/graphics/filters/SVGFilterBuilder.cpp
index 8d81568..f2ec633 100644
--- a/third_party/WebKit/Source/core/svg/graphics/filters/SVGFilterBuilder.cpp
+++ b/third_party/WebKit/Source/core/svg/graphics/filters/SVGFilterBuilder.cpp
@@ -105,10 +105,8 @@
 
 DEFINE_TRACE(SVGFilterGraphNodeMap)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_effectRenderer);
     visitor->trace(m_effectReferences);
-#endif
 }
 
 SVGFilterBuilder::SVGFilterBuilder(
diff --git a/third_party/WebKit/Source/core/workers/WorkerConsole.cpp b/third_party/WebKit/Source/core/workers/WorkerConsole.cpp
index ac0e060..b6ca6d3 100644
--- a/third_party/WebKit/Source/core/workers/WorkerConsole.cpp
+++ b/third_party/WebKit/Source/core/workers/WorkerConsole.cpp
@@ -46,7 +46,7 @@
 {
 }
 
-void WorkerConsole::reportMessageToConsole(RawPtr<ConsoleMessage> consoleMessage)
+void WorkerConsole::reportMessageToConsole(ConsoleMessage* consoleMessage)
 {
     m_scope->addConsoleMessage(consoleMessage);
 }
diff --git a/third_party/WebKit/Source/core/workers/WorkerConsole.h b/third_party/WebKit/Source/core/workers/WorkerConsole.h
index 86b318c..f5b70fe1 100644
--- a/third_party/WebKit/Source/core/workers/WorkerConsole.h
+++ b/third_party/WebKit/Source/core/workers/WorkerConsole.h
@@ -57,7 +57,7 @@
 
 protected:
     ExecutionContext* context() override;
-    void reportMessageToConsole(RawPtr<ConsoleMessage>) override;
+    void reportMessageToConsole(ConsoleMessage*) override;
 
 private:
     explicit WorkerConsole(WorkerGlobalScope*);
diff --git a/third_party/WebKit/Source/core/workers/WorkerEventQueue.cpp b/third_party/WebKit/Source/core/workers/WorkerEventQueue.cpp
index bba58e3..336765e 100644
--- a/third_party/WebKit/Source/core/workers/WorkerEventQueue.cpp
+++ b/third_party/WebKit/Source/core/workers/WorkerEventQueue.cpp
@@ -51,10 +51,8 @@
 
 DEFINE_TRACE(WorkerEventQueue)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_executionContext);
     visitor->trace(m_eventTaskMap);
-#endif
     EventQueue::trace(visitor);
 }
 
diff --git a/third_party/WebKit/Source/core/xml/parser/XMLDocumentParser.cpp b/third_party/WebKit/Source/core/xml/parser/XMLDocumentParser.cpp
index 11aa9607..e85cedc 100644
--- a/third_party/WebKit/Source/core/xml/parser/XMLDocumentParser.cpp
+++ b/third_party/WebKit/Source/core/xml/parser/XMLDocumentParser.cpp
@@ -883,9 +883,7 @@
 DEFINE_TRACE(XMLDocumentParser)
 {
     visitor->trace(m_currentNode);
-#if ENABLE(OILPAN)
     visitor->trace(m_currentNodeStack);
-#endif
     visitor->trace(m_leafTextNode);
     visitor->trace(m_xmlErrors);
     visitor->trace(m_pendingScript);
diff --git a/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp b/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp
index ef5256c5..bd3d738 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp
@@ -1284,10 +1284,8 @@
 
 DEFINE_TRACE(AXObjectCacheImpl)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_document);
     visitor->trace(m_nodeObjectMapping);
-#endif
 
     visitor->trace(m_objects);
     visitor->trace(m_notificationsToPost);
diff --git a/third_party/WebKit/Source/modules/canvas2d/HitRegion.cpp b/third_party/WebKit/Source/modules/canvas2d/HitRegion.cpp
index f7cb323..42eb2c7 100644
--- a/third_party/WebKit/Source/modules/canvas2d/HitRegion.cpp
+++ b/third_party/WebKit/Source/modules/canvas2d/HitRegion.cpp
@@ -134,11 +134,9 @@
 
 DEFINE_TRACE(HitRegionManager)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_hitRegionList);
     visitor->trace(m_hitRegionIdMap);
     visitor->trace(m_hitRegionControlMap);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/modules/device_light/DeviceLightController.cpp b/third_party/WebKit/Source/modules/device_light/DeviceLightController.cpp
index adce04d..51a96dc 100644
--- a/third_party/WebKit/Source/modules/device_light/DeviceLightController.cpp
+++ b/third_party/WebKit/Source/modules/device_light/DeviceLightController.cpp
@@ -54,7 +54,7 @@
     DeviceLightDispatcher::instance().removeController(this);
 }
 
-RawPtr<Event> DeviceLightController::lastEvent() const
+Event* DeviceLightController::lastEvent() const
 {
     return DeviceLightEvent::create(EventTypeNames::devicelight,
         DeviceLightDispatcher::instance().latestDeviceLightData());
diff --git a/third_party/WebKit/Source/modules/device_light/DeviceLightController.h b/third_party/WebKit/Source/modules/device_light/DeviceLightController.h
index f8fa7707..e437035 100644
--- a/third_party/WebKit/Source/modules/device_light/DeviceLightController.h
+++ b/third_party/WebKit/Source/modules/device_light/DeviceLightController.h
@@ -32,7 +32,7 @@
     bool hasLastData() override;
 
     // Inherited from DeviceSingleWindowEventController.
-    RawPtr<Event> lastEvent() const override;
+    Event* lastEvent() const override;
     const AtomicString& eventTypeName() const override;
     bool isNullEvent(Event*) const override;
 };
diff --git a/third_party/WebKit/Source/modules/device_orientation/DeviceMotionController.cpp b/third_party/WebKit/Source/modules/device_orientation/DeviceMotionController.cpp
index 4e3f1e3..d4e952b 100644
--- a/third_party/WebKit/Source/modules/device_orientation/DeviceMotionController.cpp
+++ b/third_party/WebKit/Source/modules/device_orientation/DeviceMotionController.cpp
@@ -82,7 +82,7 @@
     DeviceMotionDispatcher::instance().removeController(this);
 }
 
-RawPtr<Event> DeviceMotionController::lastEvent() const
+Event* DeviceMotionController::lastEvent() const
 {
     return DeviceMotionEvent::create(EventTypeNames::devicemotion, DeviceMotionDispatcher::instance().latestDeviceMotionData());
 }
diff --git a/third_party/WebKit/Source/modules/device_orientation/DeviceMotionController.h b/third_party/WebKit/Source/modules/device_orientation/DeviceMotionController.h
index 6bd69be6..c45484b 100644
--- a/third_party/WebKit/Source/modules/device_orientation/DeviceMotionController.h
+++ b/third_party/WebKit/Source/modules/device_orientation/DeviceMotionController.h
@@ -35,7 +35,7 @@
     bool hasLastData() override;
 
     // Inherited from DeviceSingleWindowEventController.
-    RawPtr<Event> lastEvent() const override;
+    Event* lastEvent() const override;
     const AtomicString& eventTypeName() const override;
     bool isNullEvent(Event*) const override;
 };
diff --git a/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationController.cpp b/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationController.cpp
index a6b606b7..d8f70e22 100644
--- a/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationController.cpp
+++ b/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationController.cpp
@@ -94,7 +94,7 @@
     dispatcherInstance().removeController(this);
 }
 
-RawPtr<Event> DeviceOrientationController::lastEvent() const
+Event* DeviceOrientationController::lastEvent() const
 {
     return DeviceOrientationEvent::create(eventTypeName(), lastData());
 }
diff --git a/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationController.h b/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationController.h
index ea72d7e..0f8c1f9 100644
--- a/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationController.h
+++ b/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationController.h
@@ -44,7 +44,7 @@
     bool hasLastData() override;
 
     // Inherited from DeviceSingleWindowEventController.
-    RawPtr<Event> lastEvent() const override;
+    Event* lastEvent() const override;
     const AtomicString& eventTypeName() const override;
     bool isNullEvent(Event*) const override;
 
diff --git a/third_party/WebKit/Source/modules/fetch/FetchResponseData.cpp b/third_party/WebKit/Source/modules/fetch/FetchResponseData.cpp
index afeca9ba..567b3e5 100644
--- a/third_party/WebKit/Source/modules/fetch/FetchResponseData.cpp
+++ b/third_party/WebKit/Source/modules/fetch/FetchResponseData.cpp
@@ -116,8 +116,11 @@
 FetchResponseData* FetchResponseData::createOpaqueFilteredResponse()
 {
     // "An opaque filtered response is a filtered response whose type is
-    // |opaque|, status is 0, status message is the empty byte sequence, header
-    // list is an empty list, and body is null."
+    // 'opaque', url list is the empty list, status is 0, status message is the
+    // empty byte sequence, header list is the empty list, body is null, and
+    // cache state is 'none'."
+    //
+    // https://fetch.spec.whatwg.org/#concept-filtered-response-opaque
     FetchResponseData* response = new FetchResponseData(OpaqueType, 0, "");
     response->m_internalResponse = this;
     return response;
@@ -125,11 +128,13 @@
 
 FetchResponseData* FetchResponseData::createOpaqueRedirectFilteredResponse()
 {
-    // "An opaque-redirect filtered response is a filtered response whose type
-    // is |opaqueredirect|, status is 0, status message is the empty byte
-    // sequence, header list is the empty list, body is null, and cache state is
-    // |none|.
+    // "An opaque filtered response is a filtered response whose type is
+    // 'opaqueredirect', status is 0, status message is the empty byte sequence,
+    // header list is the empty list, body is null, and cache state is 'none'."
+    //
+    // https://fetch.spec.whatwg.org/#concept-filtered-response-opaque-redirect
     FetchResponseData* response = new FetchResponseData(OpaqueRedirectType, 0, "");
+    response->m_url = m_url;
     response->m_internalResponse = this;
     return response;
 }
diff --git a/third_party/WebKit/Source/modules/fetch/FetchResponseDataTest.cpp b/third_party/WebKit/Source/modules/fetch/FetchResponseDataTest.cpp
index b2d5667..9bb05cb 100644
--- a/third_party/WebKit/Source/modules/fetch/FetchResponseDataTest.cpp
+++ b/third_party/WebKit/Source/modules/fetch/FetchResponseDataTest.cpp
@@ -143,6 +143,15 @@
     EXPECT_FALSE(opaqueResponseData->headerList()->has("cache-control"));
 }
 
+TEST_F(FetchResponseDataTest, OpaqueRedirectFilter)
+{
+    FetchResponseData* internalResponse = createInternalResponse();
+    FetchResponseData* opaqueResponseData = internalResponse->createOpaqueRedirectFilteredResponse();
+
+    EXPECT_EQ(opaqueResponseData->headerList()->size(), 0u);
+    EXPECT_EQ(opaqueResponseData->url(), internalResponse->url());
+}
+
 TEST_F(FetchResponseDataTest, OpaqueFilterOnResponseWithAccessControlExposeHeaders)
 {
     FetchResponseData* internalResponse = createInternalResponse();
diff --git a/third_party/WebKit/Source/modules/geolocation/testing/GeolocationClientMock.cpp b/third_party/WebKit/Source/modules/geolocation/testing/GeolocationClientMock.cpp
index d7fe4501..269f122c 100644
--- a/third_party/WebKit/Source/modules/geolocation/testing/GeolocationClientMock.cpp
+++ b/third_party/WebKit/Source/modules/geolocation/testing/GeolocationClientMock.cpp
@@ -180,9 +180,7 @@
 
 DEFINE_TRACE(GeolocationClientMock)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_controllers);
-#endif
     visitor->trace(m_lastPosition);
     visitor->trace(m_pendingPermissions);
     GeolocationClient::trace(visitor);
diff --git a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
index 3e21a098..c3dad86d 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
@@ -6276,9 +6276,7 @@
 
 DEFINE_TRACE(WebGLRenderingContextBase)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_contextObjects);
-#endif
     visitor->trace(m_errorMessageCallbackAdapter);
     visitor->trace(m_boundArrayBuffer);
     visitor->trace(m_defaultVertexArrayObject);
diff --git a/third_party/WebKit/Source/modules/worklet/WorkletConsole.cpp b/third_party/WebKit/Source/modules/worklet/WorkletConsole.cpp
index e721cf3..cd70148 100644
--- a/third_party/WebKit/Source/modules/worklet/WorkletConsole.cpp
+++ b/third_party/WebKit/Source/modules/worklet/WorkletConsole.cpp
@@ -19,7 +19,7 @@
 {
 }
 
-void WorkletConsole::reportMessageToConsole(RawPtr<ConsoleMessage> consoleMessage)
+void WorkletConsole::reportMessageToConsole(ConsoleMessage* consoleMessage)
 {
     m_scope->addConsoleMessage(consoleMessage);
 }
diff --git a/third_party/WebKit/Source/modules/worklet/WorkletConsole.h b/third_party/WebKit/Source/modules/worklet/WorkletConsole.h
index 91c14a13..d25a564 100644
--- a/third_party/WebKit/Source/modules/worklet/WorkletConsole.h
+++ b/third_party/WebKit/Source/modules/worklet/WorkletConsole.h
@@ -28,7 +28,7 @@
 
 protected:
     ExecutionContext* context() final;
-    void reportMessageToConsole(RawPtr<ConsoleMessage>) final;
+    void reportMessageToConsole(ConsoleMessage*) final;
 
 private:
     explicit WorkletConsole(WorkletGlobalScope*);
diff --git a/third_party/WebKit/Source/platform/AsyncMethodRunner.h b/third_party/WebKit/Source/platform/AsyncMethodRunner.h
index 66ae3ad..b8ef39e 100644
--- a/third_party/WebKit/Source/platform/AsyncMethodRunner.h
+++ b/third_party/WebKit/Source/platform/AsyncMethodRunner.h
@@ -120,11 +120,7 @@
 
     DEFINE_INLINE_TRACE()
     {
-#if ENABLE(OILPAN)
         visitor->trace(m_object);
-#else
-        TraceIfNeeded<typename RawPtrOrMemberTrait<TargetClass>::Type>::trace(visitor, m_object);
-#endif
     }
 
 private:
@@ -144,11 +140,7 @@
 
     Timer<AsyncMethodRunner<TargetClass>> m_timer;
 
-#if ENABLE(OILPAN)
     Member<TargetClass> m_object;
-#else
-    typename RawPtrOrMemberTrait<TargetClass>::Type m_object;
-#endif
     TargetMethod m_method;
 
     bool m_suspended;
diff --git a/third_party/WebKit/Source/platform/MemoryPurgeController.cpp b/third_party/WebKit/Source/platform/MemoryPurgeController.cpp
index be7caa7..170d621 100644
--- a/third_party/WebKit/Source/platform/MemoryPurgeController.cpp
+++ b/third_party/WebKit/Source/platform/MemoryPurgeController.cpp
@@ -29,10 +29,6 @@
 {
 }
 
-MemoryPurgeController::~MemoryPurgeController()
-{
-}
-
 void MemoryPurgeController::purgeMemory()
 {
     // TODO(bashi): Add UMA
@@ -44,9 +40,7 @@
 
 DEFINE_TRACE(MemoryPurgeController)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_clients);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/platform/MemoryPurgeController.h b/third_party/WebKit/Source/platform/MemoryPurgeController.h
index c9e363cf..d51f553 100644
--- a/third_party/WebKit/Source/platform/MemoryPurgeController.h
+++ b/third_party/WebKit/Source/platform/MemoryPurgeController.h
@@ -36,16 +36,15 @@
 // for reducing memory consumption and notifies its clients.
 // Since we want to control memory per tab, MemoryPurgeController is owned by
 // Page.
-class PLATFORM_EXPORT MemoryPurgeController final : public GarbageCollectedFinalized<MemoryPurgeController> {
+class PLATFORM_EXPORT MemoryPurgeController final : public GarbageCollected<MemoryPurgeController> {
     WTF_MAKE_NONCOPYABLE(MemoryPurgeController);
 public:
     static void onMemoryPressure(WebMemoryPressureLevel);
 
-    static RawPtr<MemoryPurgeController> create()
+    static MemoryPurgeController* create()
     {
         return new MemoryPurgeController;
     }
-    ~MemoryPurgeController();
 
     void registerClient(MemoryPurgeClient* client)
     {
diff --git a/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in b/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in
index 221fbfba..4e10bad 100644
--- a/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in
+++ b/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in
@@ -218,7 +218,7 @@
 WebVR depends_on=GeometryInterfaces, status=test
 WebVTTRegions status=experimental
 V8IdleTasks
-VisibilityChangeOnUnload status=test
+VisibilityChangeOnUnload status=experimental
 XSLT status=stable
 smil status=stable
 ScrollCustomization
diff --git a/third_party/WebKit/Source/platform/Widget.cpp b/third_party/WebKit/Source/platform/Widget.cpp
index ecbe933d..b4aa2afa 100644
--- a/third_party/WebKit/Source/platform/Widget.cpp
+++ b/third_party/WebKit/Source/platform/Widget.cpp
@@ -39,9 +39,6 @@
 
 Widget::~Widget()
 {
-#if !ENABLE(OILPAN)
-    ASSERT(!parent());
-#endif
 }
 
 DEFINE_TRACE(Widget)
diff --git a/third_party/WebKit/Source/platform/animation/UnitBezier.cpp b/third_party/WebKit/Source/platform/animation/UnitBezier.cpp
deleted file mode 100644
index 41aeac29..0000000
--- a/third_party/WebKit/Source/platform/animation/UnitBezier.cpp
+++ /dev/null
@@ -1,113 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "platform/animation/UnitBezier.h"
-
-namespace blink {
-
-const double UnitBezier::kBezierEpsilon = 1e-7;
-
-UnitBezier::UnitBezier(double p1x, double p1y, double p2x, double p2y)
-{
-    initCoefficients(p1x, p1y, p2x, p2y);
-    initGradients(p1x, p1y, p2x, p2y);
-    initRange(p1y, p2y);
-}
-
-void UnitBezier::initCoefficients(double p1x, double p1y, double p2x, double p2y)
-{
-    // Calculate the polynomial coefficients, implicit first and last control points are (0,0) and (1,1).
-    cx = 3.0 * p1x;
-    bx = 3.0 * (p2x - p1x) - cx;
-    ax = 1.0 - cx -bx;
-
-    cy = 3.0 * p1y;
-    by = 3.0 * (p2y - p1y) - cy;
-    ay = 1.0 - cy - by;
-}
-
-void UnitBezier::initGradients(double p1x, double p1y, double p2x, double p2y)
-{
-    // End-point gradients are used to calculate timing function results
-    // outside the range [0, 1].
-    //
-    // There are three possibilities for the gradient at each end:
-    // (1) the closest control point is not horizontally coincident with regard to
-    //     (0, 0) or (1, 1). In this case the line between the end point and
-    //     the control point is tangent to the bezier at the end point.
-    // (2) the closest control point is coincident with the end point. In
-    //     this case the line between the end point and the far control
-    //     point is tangent to the bezier at the end point.
-    // (3) the closest control point is horizontally coincident with the end
-    //     point, but vertically distinct. In this case the gradient at the
-    //     end point is Infinite. However, this causes issues when
-    //     interpolating. As a result, we break down to a simple case of
-    //     0 gradient under these conditions.
-
-    if (p1x > 0)
-        m_startGradient = p1y / p1x;
-    else if (!p1y && p2x > 0)
-        m_startGradient = p2y / p2x;
-    else
-        m_startGradient = 0;
-
-    if (p2x < 1)
-        m_endGradient = (p2y - 1) / (p2x - 1);
-    else if (p2x == 1 && p1x < 1)
-        m_endGradient = (p1y - 1) / (p1x - 1);
-    else
-        m_endGradient = 0;
-}
-
-void UnitBezier::initRange(double p1y, double p2y)
-{
-    m_rangeMin = 0;
-    m_rangeMax = 1;
-    if (0 <= p1y && p1y < 1 && 0 <= p2y && p2y <= 1)
-        return;
-
-    // Represent the function's derivative in the form at^2 + bt + c
-    // as in sampleCurveDerivativeY.
-    // (Technically this is (dy/dt)*(1/3), which is suitable for finding zeros
-    // but does not actually give the slope of the curve.)
-    const double a = 3.0 * ay;
-    const double b = 2.0 * by;
-    const double c = cy;
-
-    // Check if the derivative is constant.
-    if (std::abs(a) < kBezierEpsilon && std::abs(b) < kBezierEpsilon)
-        return;
-
-    // Zeros of the function's derivative.
-    double t1 = 0;
-    double t2 = 0;
-
-    if (std::abs(a) < kBezierEpsilon) {
-        // The function's derivative is linear.
-        t1 = -c / b;
-    } else {
-        // The function's derivative is a quadratic. We find the zeros of this
-        // quadratic using the quadratic formula.
-        double discriminant = b * b - 4 * a * c;
-        if (discriminant < 0)
-            return;
-        double discriminantSqrt = sqrt(discriminant);
-        t1 = (-b + discriminantSqrt) / (2 * a);
-        t2 = (-b - discriminantSqrt) / (2 * a);
-    }
-
-    double sol1 = 0;
-    double sol2 = 0;
-
-    if (0 < t1 && t1 < 1)
-        sol1 = sampleCurveY(t1);
-
-    if (0 < t2 && t2 < 1)
-        sol2 = sampleCurveY(t2);
-
-    m_rangeMin = std::min(std::min(m_rangeMin, sol1), sol2);
-    m_rangeMax = std::max(std::max(m_rangeMax, sol1), sol2);
-}
-
-} // namespace blink
diff --git a/third_party/WebKit/Source/platform/animation/UnitBezier.h b/third_party/WebKit/Source/platform/animation/UnitBezier.h
index dc0db7211..bd4c6480 100644
--- a/third_party/WebKit/Source/platform/animation/UnitBezier.h
+++ b/third_party/WebKit/Source/platform/animation/UnitBezier.h
@@ -1,169 +1,49 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
 
 #ifndef UnitBezier_h
 #define UnitBezier_h
 
-#include "platform/PlatformExport.h"
+#include "ui/gfx/geometry/cubic_bezier.h"
 #include "wtf/Allocator.h"
-#include "wtf/Assertions.h"
-
-#include <algorithm>
-#include <cmath>
 
 namespace blink {
 
-struct PLATFORM_EXPORT UnitBezier {
+// TODO(loyso): Erase blink::UnitBezier and use gfx::CubicBezier directly.
+struct UnitBezier {
     USING_FAST_MALLOC(UnitBezier);
 public:
-    UnitBezier(double p1x, double p1y, double p2x, double p2y);
-
-    static const double kBezierEpsilon;
+    UnitBezier(double p1x, double p1y, double p2x, double p2y)
+        : m_cubicBezier(p1x, p1y, p2x, p2y)
+    {
+    }
 
     double sampleCurveX(double t) const
     {
-        // `ax t^3 + bx t^2 + cx t' expanded using Horner's rule.
-        return ((ax * t + bx) * t + cx) * t;
+        return m_cubicBezier.SampleCurveX(t);
     }
 
     double sampleCurveY(double t) const
     {
-        return ((ay * t + by) * t + cy) * t;
-    }
-
-    double sampleCurveDerivativeX(double t) const
-    {
-        return (3.0 * ax * t + 2.0 * bx) * t + cx;
-    }
-
-    double sampleCurveDerivativeY(double t) const
-    {
-        return (3.0 * ay * t + 2.0 * by) * t + cy;
-    }
-
-    // Given an x value, find a parametric value it came from.
-    double solveCurveX(double x, double epsilon) const
-    {
-        ASSERT(x >= 0.0);
-        ASSERT(x <= 1.0);
-
-        double t0;
-        double t1;
-        double t2;
-        double x2;
-        double d2;
-        int i;
-
-        // First try a few iterations of Newton's method -- normally very fast.
-        for (t2 = x, i = 0; i < 8; i++) {
-            x2 = sampleCurveX(t2) - x;
-            if (fabs (x2) < epsilon)
-                return t2;
-            d2 = sampleCurveDerivativeX(t2);
-            if (fabs(d2) < 1e-6)
-                break;
-            t2 = t2 - x2 / d2;
-        }
-
-        // Fall back to the bisection method for reliability.
-        t0 = 0.0;
-        t1 = 1.0;
-        t2 = x;
-
-        while (t0 < t1) {
-            x2 = sampleCurveX(t2);
-            if (fabs(x2 - x) < epsilon)
-                return t2;
-            if (x > x2)
-                t0 = t2;
-            else
-                t1 = t2;
-            t2 = (t1 - t0) * .5 + t0;
-        }
-
-        // Failure.
-        return t2;
+        return m_cubicBezier.SampleCurveY(t);
     }
 
     // Evaluates y at the given x.
     double solve(double x) const
     {
-        return solveWithEpsilon(x, kBezierEpsilon);
+        return m_cubicBezier.Solve(x);
     }
 
     // Evaluates y at the given x. The epsilon parameter provides a hint as to the required
     // accuracy and is not guaranteed.
     double solveWithEpsilon(double x, double epsilon) const
     {
-        if (x < 0.0)
-            return 0.0 + m_startGradient * x;
-        if (x > 1.0)
-            return 1.0 + m_endGradient * (x - 1.0);
-        return sampleCurveY(solveCurveX(x, epsilon));
-    }
-
-    // Returns an approximation of dy/dx at the given x.
-    double slope(double x) const
-    {
-        return slopeWithEpsilon(x, kBezierEpsilon);
-    }
-
-    double slopeWithEpsilon(double x, double epsilon) const
-    {
-        double t = solveCurveX(x, epsilon);
-        double dx = sampleCurveDerivativeX(t);
-        double dy = sampleCurveDerivativeY(t);
-        return dy / dx;
-    }
-
-    // Sets |min| and |max| to the bezier's minimum and maximium y values in the
-    // interval [0, 1].
-    void range(double* min, double* max) const
-    {
-        *min = m_rangeMin;
-        *max = m_rangeMax;
+        return m_cubicBezier.SolveWithEpsilon(x, epsilon);
     }
 
 private:
-    void initCoefficients(double p1x, double p1y, double p2x, double p2y);
-    void initGradients(double p1x, double p1y, double p2x, double p2y);
-    void initRange(double p1y, double p2y);
-
-    double ax;
-    double bx;
-    double cx;
-
-    double ay;
-    double by;
-    double cy;
-
-    double m_startGradient;
-    double m_endGradient;
-
-    double m_rangeMin;
-    double m_rangeMax;
+    gfx::CubicBezier m_cubicBezier;
 };
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/platform/animation/UnitBezierTest.cpp b/third_party/WebKit/Source/platform/animation/UnitBezierTest.cpp
deleted file mode 100644
index e5172b22..0000000
--- a/third_party/WebKit/Source/platform/animation/UnitBezierTest.cpp
+++ /dev/null
@@ -1,192 +0,0 @@
-/*
- * Copyright (C) 2013 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
- * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "platform/animation/UnitBezier.h"
-
-#include "base/memory/scoped_ptr.h"
-#include "testing/gtest/include/gtest/gtest.h"
-
-namespace blink {
-
-TEST(UnitBezierTest, BasicUse)
-{
-    UnitBezier bezier(0.5, 1.0, 0.5, 1.0);
-    EXPECT_EQ(0.875, bezier.solve(0.5));
-}
-
-TEST(UnitBezierTest, Overshoot)
-{
-    UnitBezier bezier(0.5, 2.0, 0.5, 2.0);
-    EXPECT_EQ(1.625, bezier.solve(0.5));
-}
-
-TEST(UnitBezierTest, Undershoot)
-{
-    UnitBezier bezier(0.5, -1.0, 0.5, -1.0);
-    EXPECT_EQ(-0.625, bezier.solve(0.5));
-}
-
-TEST(UnitBezierTest, InputAtEdgeOfRange)
-{
-    UnitBezier bezier(0.5, 1.0, 0.5, 1.0);
-    EXPECT_EQ(0.0, bezier.solve(0.0));
-    EXPECT_EQ(1.0, bezier.solve(1.0));
-}
-
-TEST(UnitBezierTest, InputOutOfRange)
-{
-    UnitBezier bezier(0.5, 1.0, 0.5, 1.0);
-    EXPECT_EQ(-2.0, bezier.solve(-1.0));
-    EXPECT_EQ(1.0, bezier.solve(2.0));
-}
-
-TEST(UnitBezierTest, InputOutOfRangeLargeEpsilon)
-{
-    UnitBezier bezier(0.5, 1.0, 0.5, 1.0);
-    EXPECT_EQ(-2.0, bezier.solveWithEpsilon(-1.0, 1.0));
-    EXPECT_EQ(1.0, bezier.solveWithEpsilon(2.0, 1.0));
-}
-
-TEST(UnitBezierTest, InputOutOfRangeCoincidentEndpoints)
-{
-    UnitBezier bezier(0.0, 0.0, 1.0, 1.0);
-    EXPECT_EQ(-1.0, bezier.solve(-1.0));
-    EXPECT_EQ(2.0, bezier.solve(2.0));
-}
-
-TEST(UnitBezierTest, InputOutOfRangeVerticalGradient)
-{
-    UnitBezier bezier(0.0, 1.0, 1.0, 0.0);
-    EXPECT_EQ(0.0, bezier.solve(-1.0));
-    EXPECT_EQ(1.0, bezier.solve(2.0));
-}
-
-TEST(UnitBezierTest, InputOutOfRangeDistinctEndpoints)
-{
-    UnitBezier bezier(0.1, 0.2, 0.8, 0.8);
-    EXPECT_EQ(-2.0, bezier.solve(-1.0));
-    EXPECT_EQ(2.0, bezier.solve(2.0));
-}
-
-TEST(UnitBezierTest, Range)
-{
-    double epsilon = 0.00015;
-    double min, max;
-
-    // Derivative is a constant.
-    scoped_ptr<UnitBezier> bezier(
-        new UnitBezier(0.25, (1.0 / 3.0), 0.75, (2.0 / 3.0)));
-    bezier->range(&min, &max);
-    EXPECT_EQ(0, min);
-    EXPECT_EQ(1, max);
-
-    // Derivative is linear.
-    bezier.reset(new UnitBezier(0.25, -0.5, 0.75, (-1.0 / 6.0)));
-    bezier->range(&min, &max);
-    EXPECT_NEAR(min, -0.225, epsilon);
-    EXPECT_EQ(1, max);
-
-    // Derivative has no real roots.
-    bezier.reset(new UnitBezier(0.25, 0.25, 0.75, 0.5));
-    bezier->range(&min, &max);
-    EXPECT_EQ(0, min);
-    EXPECT_EQ(1, max);
-
-    // Derivative has exactly one real root.
-    bezier.reset(new UnitBezier(0.0, 1.0, 1.0, 0.0));
-    bezier->range(&min, &max);
-    EXPECT_EQ(0, min);
-    EXPECT_EQ(1, max);
-
-    // Derivative has one root < 0 and one root > 1.
-    bezier.reset(new UnitBezier(0.25, 0.1, 0.75, 0.9));
-    bezier->range(&min, &max);
-    EXPECT_EQ(0, min);
-    EXPECT_EQ(1, max);
-
-    // Derivative has two roots in [0,1].
-    bezier.reset(new UnitBezier(0.25, 2.5, 0.75, 0.5));
-    bezier->range(&min, &max);
-    EXPECT_EQ(0, min);
-    EXPECT_NEAR(max, 1.28818, epsilon);
-    bezier.reset(new UnitBezier(0.25, 0.5, 0.75, -1.5));
-    bezier->range(&min, &max);
-    EXPECT_NEAR(min, -0.28818, epsilon);
-    EXPECT_EQ(1, max);
-
-    // Derivative has one root < 0 and one root in [0,1].
-    bezier.reset(new UnitBezier(0.25, 0.1, 0.75, 1.5));
-    bezier->range(&min, &max);
-    EXPECT_EQ(0, min);
-    EXPECT_NEAR(max, 1.10755, epsilon);
-
-    // Derivative has one root in [0,1] and one root > 1.
-    bezier.reset(new UnitBezier(0.25, -0.5, 0.75, 0.9));
-    bezier->range(&min, &max);
-    EXPECT_NEAR(min, -0.10755, epsilon);
-    EXPECT_EQ(1, max);
-
-    // Derivative has two roots < 0.
-    bezier.reset(new UnitBezier(0.25, 0.3, 0.75, 0.633));
-    bezier->range(&min, &max);
-    EXPECT_EQ(0, min);
-    EXPECT_EQ(1, max);
-
-    // Derivative has two roots > 1.
-    bezier.reset(new UnitBezier(0.25, 0.367, 0.75, 0.7));
-    bezier->range(&min, &max);
-    EXPECT_EQ(0.f, min);
-    EXPECT_EQ(1.f, max);
-}
-
-TEST(UnitBezierTest, Slope)
-{
-    UnitBezier bezier(0.25, 0.0, 0.75, 1.0);
-
-    double epsilon = 0.00015;
-
-    EXPECT_NEAR(bezier.slope(0), 0, epsilon);
-    EXPECT_NEAR(bezier.slope(0.05), 0.42170, epsilon);
-    EXPECT_NEAR(bezier.slope(0.1), 0.69778, epsilon);
-    EXPECT_NEAR(bezier.slope(0.15), 0.89121, epsilon);
-    EXPECT_NEAR(bezier.slope(0.2), 1.03184, epsilon);
-    EXPECT_NEAR(bezier.slope(0.25), 1.13576, epsilon);
-    EXPECT_NEAR(bezier.slope(0.3), 1.21239, epsilon);
-    EXPECT_NEAR(bezier.slope(0.35), 1.26751, epsilon);
-    EXPECT_NEAR(bezier.slope(0.4), 1.30474, epsilon);
-    EXPECT_NEAR(bezier.slope(0.45), 1.32628, epsilon);
-    EXPECT_NEAR(bezier.slope(0.5), 1.33333, epsilon);
-    EXPECT_NEAR(bezier.slope(0.55), 1.32628, epsilon);
-    EXPECT_NEAR(bezier.slope(0.6), 1.30474, epsilon);
-    EXPECT_NEAR(bezier.slope(0.65), 1.26751, epsilon);
-    EXPECT_NEAR(bezier.slope(0.7), 1.21239, epsilon);
-    EXPECT_NEAR(bezier.slope(0.75), 1.13576, epsilon);
-    EXPECT_NEAR(bezier.slope(0.8), 1.03184, epsilon);
-    EXPECT_NEAR(bezier.slope(0.85), 0.89121, epsilon);
-    EXPECT_NEAR(bezier.slope(0.9), 0.69778, epsilon);
-    EXPECT_NEAR(bezier.slope(0.95), 0.42170, epsilon);
-    EXPECT_NEAR(bezier.slope(1), 0, epsilon);
-}
-
-} // namespace blink
diff --git a/third_party/WebKit/Source/platform/blink_platform.gypi b/third_party/WebKit/Source/platform/blink_platform.gypi
index cd719c06..70968fd 100644
--- a/third_party/WebKit/Source/platform/blink_platform.gypi
+++ b/third_party/WebKit/Source/platform/blink_platform.gypi
@@ -174,7 +174,6 @@
       'animation/CubicBezierControlPoints.h',
       'animation/TimingFunction.cpp',
       'animation/TimingFunction.h',
-      'animation/UnitBezier.cpp',
       'animation/UnitBezier.h',
       'audio/AudioArray.h',
       'audio/AudioBus.cpp',
@@ -1137,7 +1136,6 @@
       'animation/CompositorAnimationTimelineTest.cpp',
       'animation/CompositorFloatAnimationCurveTest.cpp',
       'animation/TimingFunctionTest.cpp',
-      'animation/UnitBezierTest.cpp',
       'blob/BlobDataTest.cpp',
       'clipboard/ClipboardUtilitiesTest.cpp',
       'exported/FilePathConversionTest.cpp',
@@ -1269,6 +1267,10 @@
       'testing/UnitTestHelpers.h',
       'testing/WebLayerTreeViewImplForTesting.cpp',
       'testing/WebLayerTreeViewImplForTesting.h',
+      'testing/weburl_loader_mock.cc',
+      'testing/weburl_loader_mock.h',
+      'testing/weburl_loader_mock_factory_impl.cc',
+      'testing/weburl_loader_mock_factory_impl.h',
     ],
     'conditions': [
       ['OS=="win"',
diff --git a/third_party/WebKit/Source/platform/fonts/Font.cpp b/third_party/WebKit/Source/platform/fonts/Font.cpp
index a6fc2b1..a2ecac9e 100644
--- a/third_party/WebKit/Source/platform/fonts/Font.cpp
+++ b/third_party/WebKit/Source/platform/fonts/Font.cpp
@@ -95,7 +95,7 @@
         && (m_fontFallbackList ? m_fontFallbackList->generation() : 0) == (other.m_fontFallbackList ? other.m_fontFallbackList->generation() : 0);
 }
 
-void Font::update(RawPtr<FontSelector> fontSelector) const
+void Font::update(FontSelector* fontSelector) const
 {
     // FIXME: It is pretty crazy that we are willing to just poke into a RefPtr, but it ends up
     // being reasonably safe (because inherited fonts in the render tree pick up the new
diff --git a/third_party/WebKit/Source/platform/fonts/Font.h b/third_party/WebKit/Source/platform/fonts/Font.h
index 15a04e86..a2135bc 100644
--- a/third_party/WebKit/Source/platform/fonts/Font.h
+++ b/third_party/WebKit/Source/platform/fonts/Font.h
@@ -74,7 +74,7 @@
 
     const FontDescription& getFontDescription() const { return m_fontDescription; }
 
-    void update(RawPtr<FontSelector>) const;
+    void update(FontSelector*) const;
 
     enum CustomFontNotReadyAction { DoNotPaintIfFontNotReady, UseFallbackIfFontNotReady };
     bool drawText(SkCanvas*, const TextRunPaintInfo&, const FloatPoint&, float deviceScaleFactor, const SkPaint&) const;
diff --git a/third_party/WebKit/Source/platform/fonts/FontCache.cpp b/third_party/WebKit/Source/platform/fonts/FontCache.cpp
index f2ab8a1..b97d46bb 100644
--- a/third_party/WebKit/Source/platform/fonts/FontCache.cpp
+++ b/third_party/WebKit/Source/platform/fonts/FontCache.cpp
@@ -308,14 +308,6 @@
     fontCacheClients().add(client);
 }
 
-#if !ENABLE(OILPAN)
-void FontCache::removeClient(FontCacheClient* client)
-{
-    ASSERT(fontCacheClients().contains(client));
-    fontCacheClients().remove(client);
-}
-#endif
-
 static unsigned short gGeneration = 0;
 
 unsigned short FontCache::generation()
diff --git a/third_party/WebKit/Source/platform/fonts/FontCache.h b/third_party/WebKit/Source/platform/fonts/FontCache.h
index 0c20a056..10e5f61 100644
--- a/third_party/WebKit/Source/platform/fonts/FontCache.h
+++ b/third_party/WebKit/Source/platform/fonts/FontCache.h
@@ -95,9 +95,6 @@
     ShapeCache* getShapeCache(const FallbackListCompositeKey&);
 
     void addClient(FontCacheClient*);
-#if !ENABLE(OILPAN)
-    void removeClient(FontCacheClient*);
-#endif
 
     unsigned short generation();
     void invalidate();
diff --git a/third_party/WebKit/Source/platform/fonts/FontFallbackList.cpp b/third_party/WebKit/Source/platform/fonts/FontFallbackList.cpp
index 85f610d..713ed39 100644
--- a/third_party/WebKit/Source/platform/fonts/FontFallbackList.cpp
+++ b/third_party/WebKit/Source/platform/fonts/FontFallbackList.cpp
@@ -50,7 +50,7 @@
 {
 }
 
-void FontFallbackList::invalidate(RawPtr<FontSelector> fontSelector)
+void FontFallbackList::invalidate(FontSelector* fontSelector)
 {
     releaseFontData();
     m_fontList.clear();
diff --git a/third_party/WebKit/Source/platform/fonts/FontFallbackList.h b/third_party/WebKit/Source/platform/fonts/FontFallbackList.h
index be7f0954..652eaba 100644
--- a/third_party/WebKit/Source/platform/fonts/FontFallbackList.h
+++ b/third_party/WebKit/Source/platform/fonts/FontFallbackList.h
@@ -68,7 +68,7 @@
 
     ~FontFallbackList() { releaseFontData(); }
     bool isValid() const;
-    void invalidate(RawPtr<FontSelector>);
+    void invalidate(FontSelector*);
 
     bool loadingCustomFonts() const;
     bool shouldSkipDrawing() const;
diff --git a/third_party/WebKit/Source/platform/graphics/GraphicsLayerTest.cpp b/third_party/WebKit/Source/platform/graphics/GraphicsLayerTest.cpp
index 827a987..e0c0616 100644
--- a/third_party/WebKit/Source/platform/graphics/GraphicsLayerTest.cpp
+++ b/third_party/WebKit/Source/platform/graphics/GraphicsLayerTest.cpp
@@ -161,7 +161,7 @@
 class FakeScrollableArea : public GarbageCollectedFinalized<FakeScrollableArea>, public ScrollableArea {
     USING_GARBAGE_COLLECTED_MIXIN(FakeScrollableArea);
 public:
-    static RawPtr<FakeScrollableArea> create()
+    static FakeScrollableArea* create()
     {
         return new FakeScrollableArea;
     }
@@ -201,8 +201,8 @@
 
 TEST_F(GraphicsLayerTest, applyScrollToScrollableArea)
 {
-    RawPtr<FakeScrollableArea> scrollableArea = FakeScrollableArea::create();
-    m_graphicsLayer->setScrollableArea(scrollableArea.get(), false);
+    FakeScrollableArea* scrollableArea = FakeScrollableArea::create();
+    m_graphicsLayer->setScrollableArea(scrollableArea, false);
 
     WebDoublePoint scrollPosition(7, 9);
     m_platformLayer->setScrollPositionDouble(scrollPosition);
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEBlend.cpp b/third_party/WebKit/Source/platform/graphics/filters/FEBlend.cpp
index 92a2d15..7561b29 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEBlend.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEBlend.cpp
@@ -37,7 +37,7 @@
 {
 }
 
-RawPtr<FEBlend> FEBlend::create(Filter* filter, WebBlendMode mode)
+FEBlend* FEBlend::create(Filter* filter, WebBlendMode mode)
 {
     return new FEBlend(filter, mode);
 }
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEBlend.h b/third_party/WebKit/Source/platform/graphics/filters/FEBlend.h
index 1adc52e..0ac88ab8 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEBlend.h
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEBlend.h
@@ -30,7 +30,7 @@
 
 class PLATFORM_EXPORT FEBlend final : public FilterEffect {
 public:
-    static RawPtr<FEBlend> create(Filter*, WebBlendMode);
+    static FEBlend* create(Filter*, WebBlendMode);
 
     WebBlendMode blendMode() const;
     bool setBlendMode(WebBlendMode);
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEBoxReflect.cpp b/third_party/WebKit/Source/platform/graphics/filters/FEBoxReflect.cpp
index 4ef9fee..9cf8318 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEBoxReflect.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEBoxReflect.cpp
@@ -10,7 +10,7 @@
 
 namespace blink {
 
-RawPtr<FEBoxReflect> FEBoxReflect::create(Filter* filter, ReflectionDirection direction, float offset)
+FEBoxReflect* FEBoxReflect::create(Filter* filter, ReflectionDirection direction, float offset)
 {
     return new FEBoxReflect(filter, direction, offset);
 }
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEBoxReflect.h b/third_party/WebKit/Source/platform/graphics/filters/FEBoxReflect.h
index 8a52885..1b136d1 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEBoxReflect.h
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEBoxReflect.h
@@ -14,7 +14,7 @@
 // Used to implement the -webkit-box-reflect property as a filter.
 class PLATFORM_EXPORT FEBoxReflect final : public FilterEffect {
 public:
-    static RawPtr<FEBoxReflect> create(Filter*, ReflectionDirection, float offset);
+    static FEBoxReflect* create(Filter*, ReflectionDirection, float offset);
 
     // FilterEffect implementation
     FloatRect mapRect(const FloatRect&, bool forward = true) const final;
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEColorMatrix.cpp b/third_party/WebKit/Source/platform/graphics/filters/FEColorMatrix.cpp
index 0c348b6a..39d5df9 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEColorMatrix.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEColorMatrix.cpp
@@ -39,7 +39,7 @@
 {
 }
 
-RawPtr<FEColorMatrix> FEColorMatrix::create(Filter* filter, ColorMatrixType type, const Vector<float>& values)
+FEColorMatrix* FEColorMatrix::create(Filter* filter, ColorMatrixType type, const Vector<float>& values)
 {
     return new FEColorMatrix(filter, type, values);
 }
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEColorMatrix.h b/third_party/WebKit/Source/platform/graphics/filters/FEColorMatrix.h
index 3bc868b..3e3d123 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEColorMatrix.h
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEColorMatrix.h
@@ -38,7 +38,7 @@
 
 class PLATFORM_EXPORT FEColorMatrix final : public FilterEffect {
 public:
-    static RawPtr<FEColorMatrix> create(Filter*, ColorMatrixType, const Vector<float>&);
+    static FEColorMatrix* create(Filter*, ColorMatrixType, const Vector<float>&);
 
     ColorMatrixType type() const;
     bool setType(ColorMatrixType);
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEComponentTransfer.cpp b/third_party/WebKit/Source/platform/graphics/filters/FEComponentTransfer.cpp
index 3834235..a086b117 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEComponentTransfer.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEComponentTransfer.cpp
@@ -45,7 +45,7 @@
 {
 }
 
-RawPtr<FEComponentTransfer> FEComponentTransfer::create(Filter* filter, const ComponentTransferFunction& redFunc,
+FEComponentTransfer* FEComponentTransfer::create(Filter* filter, const ComponentTransferFunction& redFunc,
     const ComponentTransferFunction& greenFunc, const ComponentTransferFunction& blueFunc, const ComponentTransferFunction& alphaFunc)
 {
     return new FEComponentTransfer(filter, redFunc, greenFunc, blueFunc, alphaFunc);
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEComponentTransfer.h b/third_party/WebKit/Source/platform/graphics/filters/FEComponentTransfer.h
index cc70b04e..8dcd95c 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEComponentTransfer.h
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEComponentTransfer.h
@@ -62,7 +62,7 @@
 
 class PLATFORM_EXPORT FEComponentTransfer final : public FilterEffect {
 public:
-    static RawPtr<FEComponentTransfer> create(Filter*, const ComponentTransferFunction& redFunc, const ComponentTransferFunction& greenFunc,
+    static FEComponentTransfer* create(Filter*, const ComponentTransferFunction& redFunc, const ComponentTransferFunction& greenFunc,
         const ComponentTransferFunction& blueFunc, const ComponentTransferFunction& alphaFunc);
 
     TextStream& externalRepresentation(TextStream&, int indention) const override;
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEComposite.cpp b/third_party/WebKit/Source/platform/graphics/filters/FEComposite.cpp
index 1dbe3a68..67026eb 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEComposite.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEComposite.cpp
@@ -43,7 +43,7 @@
 {
 }
 
-RawPtr<FEComposite> FEComposite::create(Filter* filter, const CompositeOperationType& type, float k1, float k2, float k3, float k4)
+FEComposite* FEComposite::create(Filter* filter, const CompositeOperationType& type, float k1, float k2, float k3, float k4)
 {
     return new FEComposite(filter, type, k1, k2, k3, k4);
 }
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEComposite.h b/third_party/WebKit/Source/platform/graphics/filters/FEComposite.h
index 863b3852..085e252 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEComposite.h
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEComposite.h
@@ -41,7 +41,7 @@
 
 class PLATFORM_EXPORT FEComposite final : public FilterEffect {
 public:
-    static RawPtr<FEComposite> create(Filter*, const CompositeOperationType&, float, float, float, float);
+    static FEComposite* create(Filter*, const CompositeOperationType&, float, float, float, float);
 
     CompositeOperationType operation() const;
     bool setOperation(CompositeOperationType);
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEConvolveMatrix.cpp b/third_party/WebKit/Source/platform/graphics/filters/FEConvolveMatrix.cpp
index a01a3508..b19909e3 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEConvolveMatrix.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEConvolveMatrix.cpp
@@ -46,7 +46,7 @@
 {
 }
 
-RawPtr<FEConvolveMatrix> FEConvolveMatrix::create(Filter* filter, const IntSize& kernelSize,
+FEConvolveMatrix* FEConvolveMatrix::create(Filter* filter, const IntSize& kernelSize,
     float divisor, float bias, const IntPoint& targetOffset, EdgeModeType edgeMode,
     bool preserveAlpha, const Vector<float>& kernelMatrix)
 {
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEConvolveMatrix.h b/third_party/WebKit/Source/platform/graphics/filters/FEConvolveMatrix.h
index 6a24e2e2..0e42081 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEConvolveMatrix.h
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEConvolveMatrix.h
@@ -41,7 +41,7 @@
 
 class PLATFORM_EXPORT FEConvolveMatrix final : public FilterEffect {
 public:
-    static RawPtr<FEConvolveMatrix> create(Filter*, const IntSize&,
+    static FEConvolveMatrix* create(Filter*, const IntSize&,
         float, float, const IntPoint&, EdgeModeType, bool, const Vector<float>&);
 
     bool setDivisor(float);
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEDiffuseLighting.cpp b/third_party/WebKit/Source/platform/graphics/filters/FEDiffuseLighting.cpp
index 7a843d3..afc59d5 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEDiffuseLighting.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEDiffuseLighting.cpp
@@ -33,7 +33,7 @@
 {
 }
 
-RawPtr<FEDiffuseLighting> FEDiffuseLighting::create(Filter* filter, const Color& lightingColor,
+FEDiffuseLighting* FEDiffuseLighting::create(Filter* filter, const Color& lightingColor,
     float surfaceScale, float diffuseConstant, PassRefPtr<LightSource> lightSource)
 {
     return new FEDiffuseLighting(filter, lightingColor, surfaceScale, diffuseConstant, lightSource);
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEDiffuseLighting.h b/third_party/WebKit/Source/platform/graphics/filters/FEDiffuseLighting.h
index 185093c..ac802f7 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEDiffuseLighting.h
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEDiffuseLighting.h
@@ -31,7 +31,7 @@
 
 class PLATFORM_EXPORT FEDiffuseLighting final : public FELighting {
 public:
-    static RawPtr<FEDiffuseLighting> create(Filter*, const Color&, float, float,
+    static FEDiffuseLighting* create(Filter*, const Color&, float, float,
         PassRefPtr<LightSource>);
     ~FEDiffuseLighting() override;
 
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEDisplacementMap.cpp b/third_party/WebKit/Source/platform/graphics/filters/FEDisplacementMap.cpp
index 3b360e48..cc9ddb5 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEDisplacementMap.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEDisplacementMap.cpp
@@ -39,7 +39,7 @@
 {
 }
 
-RawPtr<FEDisplacementMap> FEDisplacementMap::create(Filter* filter, ChannelSelectorType xChannelSelector,
+FEDisplacementMap* FEDisplacementMap::create(Filter* filter, ChannelSelectorType xChannelSelector,
     ChannelSelectorType yChannelSelector, float scale)
 {
     return new FEDisplacementMap(filter, xChannelSelector, yChannelSelector, scale);
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEDisplacementMap.h b/third_party/WebKit/Source/platform/graphics/filters/FEDisplacementMap.h
index a31bb52..50ae7a1f 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEDisplacementMap.h
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEDisplacementMap.h
@@ -37,7 +37,7 @@
 
 class PLATFORM_EXPORT FEDisplacementMap final : public FilterEffect {
 public:
-    static RawPtr<FEDisplacementMap> create(Filter*, ChannelSelectorType xChannelSelector, ChannelSelectorType yChannelSelector, float);
+    static FEDisplacementMap* create(Filter*, ChannelSelectorType xChannelSelector, ChannelSelectorType yChannelSelector, float);
 
     ChannelSelectorType xChannelSelector() const;
     bool setXChannelSelector(const ChannelSelectorType);
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEDropShadow.cpp b/third_party/WebKit/Source/platform/graphics/filters/FEDropShadow.cpp
index 74ba212..5bf275a 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEDropShadow.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEDropShadow.cpp
@@ -39,7 +39,7 @@
 {
 }
 
-RawPtr<FEDropShadow> FEDropShadow::create(Filter* filter, float stdX, float stdY, float dx, float dy, const Color& shadowColor, float shadowOpacity)
+FEDropShadow* FEDropShadow::create(Filter* filter, float stdX, float stdY, float dx, float dy, const Color& shadowColor, float shadowOpacity)
 {
     return new FEDropShadow(filter, stdX, stdY, dx, dy, shadowColor, shadowOpacity);
 }
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEDropShadow.h b/third_party/WebKit/Source/platform/graphics/filters/FEDropShadow.h
index a8e9d5c..7305c486 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEDropShadow.h
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEDropShadow.h
@@ -28,7 +28,7 @@
 
 class PLATFORM_EXPORT FEDropShadow final : public FilterEffect {
 public:
-    static RawPtr<FEDropShadow> create(Filter*, float, float, float, float, const Color&, float);
+    static FEDropShadow* create(Filter*, float, float, float, float, const Color&, float);
 
     FloatRect mapRect(const FloatRect&, bool forward = true) const final;
 
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEFlood.cpp b/third_party/WebKit/Source/platform/graphics/filters/FEFlood.cpp
index 205f898..5f6519b8 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEFlood.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEFlood.cpp
@@ -38,7 +38,7 @@
     FilterEffect::setOperatingColorSpace(ColorSpaceDeviceRGB);
 }
 
-RawPtr<FEFlood> FEFlood::create(Filter* filter, const Color& floodColor, float floodOpacity)
+FEFlood* FEFlood::create(Filter* filter, const Color& floodColor, float floodOpacity)
 {
     return new FEFlood(filter, floodColor, floodOpacity);
 }
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEFlood.h b/third_party/WebKit/Source/platform/graphics/filters/FEFlood.h
index 38146fe..ffd81e9 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEFlood.h
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEFlood.h
@@ -30,7 +30,7 @@
 
 class PLATFORM_EXPORT FEFlood final: public FilterEffect {
 public:
-    static RawPtr<FEFlood> create(Filter*, const Color&, float);
+    static FEFlood* create(Filter*, const Color&, float);
 
     Color floodColor() const;
     bool setFloodColor(const Color &);
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEGaussianBlur.cpp b/third_party/WebKit/Source/platform/graphics/filters/FEGaussianBlur.cpp
index ff9e2fe..bf3fd068 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEGaussianBlur.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEGaussianBlur.cpp
@@ -45,7 +45,7 @@
 {
 }
 
-RawPtr<FEGaussianBlur> FEGaussianBlur::create(Filter* filter, float x, float y)
+FEGaussianBlur* FEGaussianBlur::create(Filter* filter, float x, float y)
 {
     return new FEGaussianBlur(filter, x, y);
 }
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEGaussianBlur.h b/third_party/WebKit/Source/platform/graphics/filters/FEGaussianBlur.h
index 61070fe2..45b78f7e 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEGaussianBlur.h
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEGaussianBlur.h
@@ -29,7 +29,7 @@
 
 class PLATFORM_EXPORT FEGaussianBlur final : public FilterEffect {
 public:
-    static RawPtr<FEGaussianBlur> create(Filter*, float, float);
+    static FEGaussianBlur* create(Filter*, float, float);
 
     FloatRect mapRect(const FloatRect&, bool forward = true) const final;
     FloatRect determineAbsolutePaintRect(const FloatRect& requestedRect) override;
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEMerge.cpp b/third_party/WebKit/Source/platform/graphics/filters/FEMerge.cpp
index 6bb6b3090..addd37e 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEMerge.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEMerge.cpp
@@ -34,7 +34,7 @@
 {
 }
 
-RawPtr<FEMerge> FEMerge::create(Filter* filter)
+FEMerge* FEMerge::create(Filter* filter)
 {
     return new FEMerge(filter);
 }
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEMerge.h b/third_party/WebKit/Source/platform/graphics/filters/FEMerge.h
index 415ecbb..9986c5d3 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEMerge.h
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEMerge.h
@@ -29,7 +29,7 @@
 
 class PLATFORM_EXPORT FEMerge final : public FilterEffect {
 public:
-    static RawPtr<FEMerge> create(Filter*);
+    static FEMerge* create(Filter*);
 
     TextStream& externalRepresentation(TextStream&, int indention) const override;
 
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEMorphology.cpp b/third_party/WebKit/Source/platform/graphics/filters/FEMorphology.cpp
index 5d904de..2f3bfcd 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEMorphology.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEMorphology.cpp
@@ -39,7 +39,7 @@
 {
 }
 
-RawPtr<FEMorphology> FEMorphology::create(Filter* filter, MorphologyOperatorType type, float radiusX, float radiusY)
+FEMorphology* FEMorphology::create(Filter* filter, MorphologyOperatorType type, float radiusX, float radiusY)
 {
     return new FEMorphology(filter, type, radiusX, radiusY);
 }
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEMorphology.h b/third_party/WebKit/Source/platform/graphics/filters/FEMorphology.h
index b714ed7..17fd1b2 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEMorphology.h
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEMorphology.h
@@ -35,7 +35,7 @@
 
 class PLATFORM_EXPORT FEMorphology final : public FilterEffect {
 public:
-    static RawPtr<FEMorphology> create(Filter*, MorphologyOperatorType, float radiusX, float radiusY);
+    static FEMorphology* create(Filter*, MorphologyOperatorType, float radiusX, float radiusY);
     MorphologyOperatorType morphologyOperator() const;
     bool setMorphologyOperator(MorphologyOperatorType);
 
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEOffset.cpp b/third_party/WebKit/Source/platform/graphics/filters/FEOffset.cpp
index d0bd1e2..a9ceb34 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEOffset.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEOffset.cpp
@@ -38,7 +38,7 @@
 {
 }
 
-RawPtr<FEOffset> FEOffset::create(Filter* filter, float dx, float dy)
+FEOffset* FEOffset::create(Filter* filter, float dx, float dy)
 {
     return new FEOffset(filter, dx, dy);
 }
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FEOffset.h b/third_party/WebKit/Source/platform/graphics/filters/FEOffset.h
index 85d7c362..41797a2 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FEOffset.h
+++ b/third_party/WebKit/Source/platform/graphics/filters/FEOffset.h
@@ -29,7 +29,7 @@
 
 class PLATFORM_EXPORT FEOffset final : public FilterEffect {
 public:
-    static RawPtr<FEOffset> create(Filter*, float dx, float dy);
+    static FEOffset* create(Filter*, float dx, float dy);
 
     float dx() const;
     void setDx(float);
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FESpecularLighting.cpp b/third_party/WebKit/Source/platform/graphics/filters/FESpecularLighting.cpp
index 270aed1..5940eb1 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FESpecularLighting.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/FESpecularLighting.cpp
@@ -35,7 +35,7 @@
 {
 }
 
-RawPtr<FESpecularLighting> FESpecularLighting::create(Filter* filter, const Color& lightingColor,
+FESpecularLighting* FESpecularLighting::create(Filter* filter, const Color& lightingColor,
     float surfaceScale, float specularConstant, float specularExponent, PassRefPtr<LightSource> lightSource)
 {
     return new FESpecularLighting(filter, lightingColor, surfaceScale, specularConstant, specularExponent,
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FESpecularLighting.h b/third_party/WebKit/Source/platform/graphics/filters/FESpecularLighting.h
index 9328afd..02dc625 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FESpecularLighting.h
+++ b/third_party/WebKit/Source/platform/graphics/filters/FESpecularLighting.h
@@ -29,7 +29,7 @@
 
 class PLATFORM_EXPORT FESpecularLighting final : public FELighting {
 public:
-    static RawPtr<FESpecularLighting> create(Filter*, const Color&, float, float,
+    static FESpecularLighting* create(Filter*, const Color&, float, float,
         float, PassRefPtr<LightSource>);
     ~FESpecularLighting() override;
 
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FETile.cpp b/third_party/WebKit/Source/platform/graphics/filters/FETile.cpp
index a93610a..df734c2 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FETile.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/FETile.cpp
@@ -33,7 +33,7 @@
 {
 }
 
-RawPtr<FETile> FETile::create(Filter* filter)
+FETile* FETile::create(Filter* filter)
 {
     return new FETile(filter);
 }
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FETile.h b/third_party/WebKit/Source/platform/graphics/filters/FETile.h
index 07f6874..d44a161 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FETile.h
+++ b/third_party/WebKit/Source/platform/graphics/filters/FETile.h
@@ -29,7 +29,7 @@
 
 class PLATFORM_EXPORT FETile final : public FilterEffect {
 public:
-    static RawPtr<FETile> create(Filter*);
+    static FETile* create(Filter*);
 
     FloatRect mapPaintRect(const FloatRect&, bool forward = true) const final;
 
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FETurbulence.cpp b/third_party/WebKit/Source/platform/graphics/filters/FETurbulence.cpp
index bc956599..c391bb10 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FETurbulence.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/FETurbulence.cpp
@@ -44,7 +44,7 @@
 {
 }
 
-RawPtr<FETurbulence> FETurbulence::create(Filter* filter, TurbulenceType type, float baseFrequencyX, float baseFrequencyY, int numOctaves, float seed, bool stitchTiles)
+FETurbulence* FETurbulence::create(Filter* filter, TurbulenceType type, float baseFrequencyX, float baseFrequencyY, int numOctaves, float seed, bool stitchTiles)
 {
     return new FETurbulence(filter, type, baseFrequencyX, baseFrequencyY, numOctaves, seed, stitchTiles);
 }
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FETurbulence.h b/third_party/WebKit/Source/platform/graphics/filters/FETurbulence.h
index 7b5364a..d67bedd 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FETurbulence.h
+++ b/third_party/WebKit/Source/platform/graphics/filters/FETurbulence.h
@@ -39,7 +39,7 @@
 
 class PLATFORM_EXPORT FETurbulence final : public FilterEffect {
 public:
-    static RawPtr<FETurbulence> create(Filter*, TurbulenceType, float, float, int, float, bool);
+    static FETurbulence* create(Filter*, TurbulenceType, float, float, int, float, bool);
 
     TurbulenceType type() const;
     bool setType(TurbulenceType);
diff --git a/third_party/WebKit/Source/platform/graphics/filters/Filter.cpp b/third_party/WebKit/Source/platform/graphics/filters/Filter.cpp
index 3ba1b29..d2df29b64 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/Filter.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/Filter.cpp
@@ -48,12 +48,12 @@
 {
 }
 
-RawPtr<Filter> Filter::create(const FloatRect& referenceBox, const FloatRect& filterRegion, float scale, UnitScaling unitScaling)
+Filter* Filter::create(const FloatRect& referenceBox, const FloatRect& filterRegion, float scale, UnitScaling unitScaling)
 {
     return new Filter(referenceBox, filterRegion, scale, unitScaling);
 }
 
-RawPtr<Filter> Filter::create(float scale)
+Filter* Filter::create(float scale)
 {
     return new Filter(FloatRect(), FloatRect(), scale, UserSpace);
 }
@@ -101,7 +101,7 @@
         point.z() * sqrtf(referenceBox().size().diagonalLengthSquared() / 2));
 }
 
-void Filter::setLastEffect(RawPtr<FilterEffect> effect)
+void Filter::setLastEffect(FilterEffect* effect)
 {
     m_lastEffect = effect;
 }
diff --git a/third_party/WebKit/Source/platform/graphics/filters/Filter.h b/third_party/WebKit/Source/platform/graphics/filters/Filter.h
index 160197b..7307394 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/Filter.h
+++ b/third_party/WebKit/Source/platform/graphics/filters/Filter.h
@@ -42,8 +42,8 @@
         BoundingBox
     };
 
-    static RawPtr<Filter> create(const FloatRect& referenceBox, const FloatRect& filterRegion, float scale, UnitScaling);
-    static RawPtr<Filter> create(float scale);
+    static Filter* create(const FloatRect& referenceBox, const FloatRect& filterRegion, float scale, UnitScaling);
+    static Filter* create(float scale);
 
     ~Filter();
     DECLARE_TRACE();
@@ -62,7 +62,7 @@
     const FloatRect& filterRegion() const { return m_filterRegion; }
     const FloatRect& referenceBox() const { return m_referenceBox; }
 
-    void setLastEffect(RawPtr<FilterEffect>);
+    void setLastEffect(FilterEffect*);
     FilterEffect* lastEffect() const { return m_lastEffect.get(); }
 
     SourceGraphic* getSourceGraphic() const { return m_sourceGraphic.get(); }
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FilterOperation.cpp b/third_party/WebKit/Source/platform/graphics/filters/FilterOperation.cpp
index b73900a..6bbb031 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FilterOperation.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/FilterOperation.cpp
@@ -29,7 +29,7 @@
 
 namespace blink {
 
-RawPtr<FilterOperation> FilterOperation::blend(const FilterOperation* from, const FilterOperation* to, double progress)
+FilterOperation* FilterOperation::blend(const FilterOperation* from, const FilterOperation* to, double progress)
 {
     ASSERT(from || to);
     if (to)
@@ -43,7 +43,7 @@
     FilterOperation::trace(visitor);
 }
 
-RawPtr<FilterOperation> BasicColorMatrixFilterOperation::blend(const FilterOperation* from, double progress) const
+FilterOperation* BasicColorMatrixFilterOperation::blend(const FilterOperation* from, double progress) const
 {
     double fromAmount;
     if (from) {
@@ -82,7 +82,7 @@
     return BasicColorMatrixFilterOperation::create(result, m_type);
 }
 
-RawPtr<FilterOperation> BasicComponentTransferFilterOperation::blend(const FilterOperation* from, double progress) const
+FilterOperation* BasicComponentTransferFilterOperation::blend(const FilterOperation* from, double progress) const
 {
     double fromAmount;
     if (from) {
@@ -120,7 +120,7 @@
     return BasicComponentTransferFilterOperation::create(result, m_type);
 }
 
-RawPtr<FilterOperation> BlurFilterOperation::blend(const FilterOperation* from, double progress) const
+FilterOperation* BlurFilterOperation::blend(const FilterOperation* from, double progress) const
 {
     LengthType lengthType = m_stdDeviation.type();
     if (!from)
@@ -130,7 +130,7 @@
     return BlurFilterOperation::create(m_stdDeviation.blend(fromOp->m_stdDeviation, progress, ValueRangeNonNegative));
 }
 
-RawPtr<FilterOperation> DropShadowFilterOperation::blend(const FilterOperation* from, double progress) const
+FilterOperation* DropShadowFilterOperation::blend(const FilterOperation* from, double progress) const
 {
     if (!from) {
         return DropShadowFilterOperation::create(
@@ -146,7 +146,7 @@
         blink::blend(fromOp->getColor(), m_color, progress));
 }
 
-RawPtr<FilterOperation> BoxReflectFilterOperation::blend(const FilterOperation* from, double progress) const
+FilterOperation* BoxReflectFilterOperation::blend(const FilterOperation* from, double progress) const
 {
     ASSERT_NOT_REACHED();
     return nullptr;
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FilterOperation.h b/third_party/WebKit/Source/platform/graphics/filters/FilterOperation.h
index 1b7fc20..7a9cdff 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FilterOperation.h
+++ b/third_party/WebKit/Source/platform/graphics/filters/FilterOperation.h
@@ -88,7 +88,7 @@
     virtual ~FilterOperation() { }
     DEFINE_INLINE_VIRTUAL_TRACE() { }
 
-    static RawPtr<FilterOperation> blend(const FilterOperation* from, const FilterOperation* to, double progress);
+    static FilterOperation* blend(const FilterOperation* from, const FilterOperation* to, double progress);
     virtual bool operator==(const FilterOperation&) const = 0;
     bool operator!=(const FilterOperation& o) const { return !(*this == o); }
 
@@ -109,7 +109,7 @@
     OperationType m_type;
 
 private:
-    virtual RawPtr<FilterOperation> blend(const FilterOperation* from, double progress) const = 0;
+    virtual FilterOperation* blend(const FilterOperation* from, double progress) const = 0;
 };
 
 #define DEFINE_FILTER_OPERATION_TYPE_CASTS(thisType, operationType) \
@@ -117,7 +117,7 @@
 
 class PLATFORM_EXPORT ReferenceFilterOperation : public FilterOperation {
 public:
-    static RawPtr<ReferenceFilterOperation> create(const String& url, const AtomicString& fragment)
+    static ReferenceFilterOperation* create(const String& url, const AtomicString& fragment)
     {
         return new ReferenceFilterOperation(url, fragment);
     }
@@ -129,12 +129,12 @@
     const AtomicString& fragment() const { return m_fragment; }
 
     Filter* getFilter() const { return m_filter.get(); }
-    void setFilter(RawPtr<Filter> filter) { m_filter = filter; }
+    void setFilter(Filter* filter) { m_filter = filter; }
 
     DECLARE_VIRTUAL_TRACE();
 
 private:
-    RawPtr<FilterOperation> blend(const FilterOperation* from, double progress) const override
+    FilterOperation* blend(const FilterOperation* from, double progress) const override
     {
         ASSERT_NOT_REACHED();
         return nullptr;
@@ -166,7 +166,7 @@
 // For HUE_ROTATE, the angle of rotation is stored in m_amount.
 class PLATFORM_EXPORT BasicColorMatrixFilterOperation : public FilterOperation {
 public:
-    static RawPtr<BasicColorMatrixFilterOperation> create(double amount, OperationType type)
+    static BasicColorMatrixFilterOperation* create(double amount, OperationType type)
     {
         return new BasicColorMatrixFilterOperation(amount, type);
     }
@@ -175,7 +175,7 @@
 
 
 private:
-    RawPtr<FilterOperation> blend(const FilterOperation* from, double progress) const override;
+    FilterOperation* blend(const FilterOperation* from, double progress) const override;
     bool operator==(const FilterOperation& o) const override
     {
         if (!isSameType(o))
@@ -204,7 +204,7 @@
 // INVERT, BRIGHTNESS, CONTRAST and OPACITY are variations on a basic component transfer effect.
 class PLATFORM_EXPORT BasicComponentTransferFilterOperation : public FilterOperation {
 public:
-    static RawPtr<BasicComponentTransferFilterOperation> create(double amount, OperationType type)
+    static BasicComponentTransferFilterOperation* create(double amount, OperationType type)
     {
         return new BasicComponentTransferFilterOperation(amount, type);
     }
@@ -215,7 +215,7 @@
 
 
 private:
-    RawPtr<FilterOperation> blend(const FilterOperation* from, double progress) const override;
+    FilterOperation* blend(const FilterOperation* from, double progress) const override;
     bool operator==(const FilterOperation& o) const override
     {
         if (!isSameType(o))
@@ -243,7 +243,7 @@
 
 class PLATFORM_EXPORT BlurFilterOperation : public FilterOperation {
 public:
-    static RawPtr<BlurFilterOperation> create(const Length& stdDeviation)
+    static BlurFilterOperation* create(const Length& stdDeviation)
     {
         return new BlurFilterOperation(stdDeviation);
     }
@@ -255,7 +255,7 @@
 
 
 private:
-    RawPtr<FilterOperation> blend(const FilterOperation* from, double progress) const override;
+    FilterOperation* blend(const FilterOperation* from, double progress) const override;
     bool operator==(const FilterOperation& o) const override
     {
         if (!isSameType(o))
@@ -277,7 +277,7 @@
 
 class PLATFORM_EXPORT DropShadowFilterOperation : public FilterOperation {
 public:
-    static RawPtr<DropShadowFilterOperation> create(const IntPoint& location, int stdDeviation, Color color)
+    static DropShadowFilterOperation* create(const IntPoint& location, int stdDeviation, Color color)
     {
         return new DropShadowFilterOperation(location, stdDeviation, color);
     }
@@ -293,7 +293,7 @@
 
 
 private:
-    RawPtr<FilterOperation> blend(const FilterOperation* from, double progress) const override;
+    FilterOperation* blend(const FilterOperation* from, double progress) const override;
     bool operator==(const FilterOperation& o) const override
     {
         if (!isSameType(o))
@@ -319,7 +319,7 @@
 
 class PLATFORM_EXPORT BoxReflectFilterOperation : public FilterOperation {
 public:
-    static RawPtr<BoxReflectFilterOperation> create(ReflectionDirection direction, float offset)
+    static BoxReflectFilterOperation* create(ReflectionDirection direction, float offset)
     {
         return new BoxReflectFilterOperation(direction, offset);
     }
@@ -331,7 +331,7 @@
     bool movesPixels() const override { return true; }
 
 private:
-    RawPtr<FilterOperation> blend(const FilterOperation* from, double progress) const override;
+    FilterOperation* blend(const FilterOperation* from, double progress) const override;
     bool operator==(const FilterOperation&) const override;
 
     BoxReflectFilterOperation(ReflectionDirection direction, float offset)
diff --git a/third_party/WebKit/Source/platform/graphics/filters/FilterOperations.h b/third_party/WebKit/Source/platform/graphics/filters/FilterOperations.h
index 6d6ca129..758d67e 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/FilterOperations.h
+++ b/third_party/WebKit/Source/platform/graphics/filters/FilterOperations.h
@@ -37,11 +37,7 @@
 typedef IntRectOutsets FilterOutsets;
 
 class PLATFORM_EXPORT FilterOperations {
-#if ENABLE(OILPAN)
     DISALLOW_NEW();
-#else
-    USING_FAST_MALLOC(FilterOperations);
-#endif
 public:
     FilterOperations();
     FilterOperations(const FilterOperations& other) { *this = other; }
@@ -84,7 +80,6 @@
     FilterOperationVector m_operations;
 };
 
-#if ENABLE(OILPAN)
 // Wrapper object for the FilterOperations part object.
 class FilterOperationsWrapper : public GarbageCollected<FilterOperationsWrapper> {
 public:
@@ -114,7 +109,6 @@
 
     FilterOperations m_operations;
 };
-#endif
 
 } // namespace blink
 
diff --git a/third_party/WebKit/Source/platform/graphics/filters/ImageFilterBuilderTest.cpp b/third_party/WebKit/Source/platform/graphics/filters/ImageFilterBuilderTest.cpp
index 206ad4a..50c25a5d 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/ImageFilterBuilderTest.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/ImageFilterBuilderTest.cpp
@@ -40,21 +40,21 @@
     void colorSpaceTest()
     {
         // Build filter tree
-        RawPtr<Filter> referenceFilter = Filter::create(1.0f);
+        Filter* referenceFilter = Filter::create(1.0f);
 
         // Add a dummy source graphic input
-        RawPtr<FilterEffect> sourceEffect = referenceFilter->getSourceGraphic();
+        FilterEffect* sourceEffect = referenceFilter->getSourceGraphic();
         sourceEffect->setOperatingColorSpace(ColorSpaceDeviceRGB);
 
         // Add a blur effect (with input : source)
-        RawPtr<FilterEffect> blurEffect =
-            FEGaussianBlur::create(referenceFilter.get(), 3.0f, 3.0f);
+        FilterEffect* blurEffect =
+            FEGaussianBlur::create(referenceFilter, 3.0f, 3.0f);
         blurEffect->setOperatingColorSpace(ColorSpaceLinearRGB);
         blurEffect->inputEffects().append(sourceEffect);
 
         // Add a blend effect (with inputs : blur, source)
-        RawPtr<FilterEffect> blendEffect =
-            FEBlend::create(referenceFilter.get(), WebBlendModeNormal);
+        FilterEffect* blendEffect =
+            FEBlend::create(referenceFilter, WebBlendModeNormal);
         blendEffect->setOperatingColorSpace(ColorSpaceDeviceRGB);
         FilterEffectVector& blendInputs = blendEffect->inputEffects();
         blendInputs.reserveCapacity(2);
@@ -62,7 +62,7 @@
         blendInputs.append(blurEffect);
 
         // Add a merge effect (with inputs : blur, blend)
-        RawPtr<FilterEffect> mergeEffect = FEMerge::create(referenceFilter.get());
+        FilterEffect* mergeEffect = FEMerge::create(referenceFilter);
         mergeEffect->setOperatingColorSpace(ColorSpaceLinearRGB);
         FilterEffectVector& mergeInputs = mergeEffect->inputEffects();
         mergeInputs.reserveCapacity(2);
diff --git a/third_party/WebKit/Source/platform/graphics/filters/PaintFilterEffect.cpp b/third_party/WebKit/Source/platform/graphics/filters/PaintFilterEffect.cpp
index 1d7263ed..a86950b 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/PaintFilterEffect.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/PaintFilterEffect.cpp
@@ -21,7 +21,7 @@
 {
 }
 
-RawPtr<PaintFilterEffect> PaintFilterEffect::create(Filter* filter, const SkPaint& paint)
+PaintFilterEffect* PaintFilterEffect::create(Filter* filter, const SkPaint& paint)
 {
     return new PaintFilterEffect(filter, paint);
 }
diff --git a/third_party/WebKit/Source/platform/graphics/filters/PaintFilterEffect.h b/third_party/WebKit/Source/platform/graphics/filters/PaintFilterEffect.h
index a216773c..edd3b6e 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/PaintFilterEffect.h
+++ b/third_party/WebKit/Source/platform/graphics/filters/PaintFilterEffect.h
@@ -12,7 +12,7 @@
 
 class PLATFORM_EXPORT PaintFilterEffect : public FilterEffect {
 public:
-    static RawPtr<PaintFilterEffect> create(Filter*, const SkPaint&);
+    static PaintFilterEffect* create(Filter*, const SkPaint&);
     ~PaintFilterEffect() override;
 
     FilterEffectType getFilterEffectType() const override { return FilterEffectTypeSourceInput; }
diff --git a/third_party/WebKit/Source/platform/graphics/filters/SourceAlpha.cpp b/third_party/WebKit/Source/platform/graphics/filters/SourceAlpha.cpp
index c29793d..f20f989 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/SourceAlpha.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/SourceAlpha.cpp
@@ -29,7 +29,7 @@
 
 namespace blink {
 
-RawPtr<SourceAlpha> SourceAlpha::create(FilterEffect* sourceEffect)
+SourceAlpha* SourceAlpha::create(FilterEffect* sourceEffect)
 {
     return new SourceAlpha(sourceEffect);
 }
diff --git a/third_party/WebKit/Source/platform/graphics/filters/SourceAlpha.h b/third_party/WebKit/Source/platform/graphics/filters/SourceAlpha.h
index 3b2d8ea..5e37e7c 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/SourceAlpha.h
+++ b/third_party/WebKit/Source/platform/graphics/filters/SourceAlpha.h
@@ -27,7 +27,7 @@
 
 class PLATFORM_EXPORT SourceAlpha final : public FilterEffect {
 public:
-    static RawPtr<SourceAlpha> create(FilterEffect*);
+    static SourceAlpha* create(FilterEffect*);
 
     FloatRect determineAbsolutePaintRect(const FloatRect& requestedRect) override;
 
diff --git a/third_party/WebKit/Source/platform/graphics/filters/SourceGraphic.cpp b/third_party/WebKit/Source/platform/graphics/filters/SourceGraphic.cpp
index 7293c5e..150badb 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/SourceGraphic.cpp
+++ b/third_party/WebKit/Source/platform/graphics/filters/SourceGraphic.cpp
@@ -37,7 +37,7 @@
 {
 }
 
-RawPtr<SourceGraphic> SourceGraphic::create(Filter* filter)
+SourceGraphic* SourceGraphic::create(Filter* filter)
 {
     return new SourceGraphic(filter);
 }
diff --git a/third_party/WebKit/Source/platform/graphics/filters/SourceGraphic.h b/third_party/WebKit/Source/platform/graphics/filters/SourceGraphic.h
index 58c2f44..9c9d2ca 100644
--- a/third_party/WebKit/Source/platform/graphics/filters/SourceGraphic.h
+++ b/third_party/WebKit/Source/platform/graphics/filters/SourceGraphic.h
@@ -31,7 +31,7 @@
 
 class PLATFORM_EXPORT SourceGraphic final : public FilterEffect {
 public:
-    static RawPtr<SourceGraphic> create(Filter*);
+    static SourceGraphic* create(Filter*);
     ~SourceGraphic() override;
 
     FloatRect determineAbsolutePaintRect(const FloatRect& requestedRect) override;
diff --git a/third_party/WebKit/Source/platform/heap/Heap.cpp b/third_party/WebKit/Source/platform/heap/Heap.cpp
index 1419b90..cb41196d 100644
--- a/third_party/WebKit/Source/platform/heap/Heap.cpp
+++ b/third_party/WebKit/Source/platform/heap/Heap.cpp
@@ -112,6 +112,12 @@
     s_isLowEndDevice = base::SysInfo::IsLowEndDevice();
 }
 
+void ProcessHeap::resetHeapCounters()
+{
+    s_totalAllocatedObjectSize = 0;
+    s_totalMarkedObjectSize = 0;
+}
+
 void Heap::init()
 {
     ThreadState::init();
@@ -688,6 +694,7 @@
 
     Heap::reportMemoryUsageForTracing();
 
+    ProcessHeap::resetHeapCounters();
     Heap::heapStats().reset();
     for (ThreadState* state : ThreadState::attachedThreads())
         state->resetHeapCounters();
diff --git a/third_party/WebKit/Source/platform/heap/Heap.h b/third_party/WebKit/Source/platform/heap/Heap.h
index 14c091ab..2d9e284 100644
--- a/third_party/WebKit/Source/platform/heap/Heap.h
+++ b/third_party/WebKit/Source/platform/heap/Heap.h
@@ -119,6 +119,7 @@
     static void increaseTotalAllocatedSpace(size_t delta) { atomicAdd(&s_totalAllocatedSpace, static_cast<long>(delta)); }
     static void decreaseTotalAllocatedSpace(size_t delta) { atomicSubtract(&s_totalAllocatedSpace, static_cast<long>(delta)); }
     static size_t totalAllocatedSpace() { return acquireLoad(&s_totalAllocatedSpace); }
+    static void resetHeapCounters();
 
 private:
     static bool s_isLowEndDevice;
@@ -466,7 +467,7 @@
     }
 
 #define IS_EAGERLY_FINALIZED() (pageFromObject(this)->arena()->arenaIndex() == BlinkGC::EagerSweepArenaIndex)
-#if ENABLE(ASSERT) && ENABLE(OILPAN)
+#if ENABLE(ASSERT)
 class VerifyEagerFinalization {
     DISALLOW_NEW();
 public:
diff --git a/third_party/WebKit/Source/platform/heap/HeapTest.cpp b/third_party/WebKit/Source/platform/heap/HeapTest.cpp
index f2ef207..d66b29ff 100644
--- a/third_party/WebKit/Source/platform/heap/HeapTest.cpp
+++ b/third_party/WebKit/Source/platform/heap/HeapTest.cpp
@@ -1405,9 +1405,6 @@
 
     virtual ~SuperClass()
     {
-#if !ENABLE(OILPAN)
-        m_pointsBack->setBackPointer(0);
-#endif
         --s_aliveCount;
     }
 
diff --git a/third_party/WebKit/Source/platform/heap/MarkingVisitorImpl.h b/third_party/WebKit/Source/platform/heap/MarkingVisitorImpl.h
index bc3d497..cc320a7 100644
--- a/third_party/WebKit/Source/platform/heap/MarkingVisitorImpl.h
+++ b/third_party/WebKit/Source/platform/heap/MarkingVisitorImpl.h
@@ -12,8 +12,6 @@
 #include "wtf/Functional.h"
 #include "wtf/HashFunctions.h"
 #include "wtf/Locker.h"
-#include "wtf/RawPtr.h"
-#include "wtf/RefCounted.h"
 #include "wtf/TypeTraits.h"
 
 namespace blink {
diff --git a/third_party/WebKit/Source/platform/heap/ThreadState.cpp b/third_party/WebKit/Source/platform/heap/ThreadState.cpp
index 54c06e0d..2e3bd22 100644
--- a/third_party/WebKit/Source/platform/heap/ThreadState.cpp
+++ b/third_party/WebKit/Source/platform/heap/ThreadState.cpp
@@ -1050,20 +1050,14 @@
 #if defined(ADDRESS_SANITIZER)
 void ThreadState::poisonAllHeaps()
 {
-    // TODO(Oilpan): enable the poisoning always.
-#if ENABLE(OILPAN)
-    // ..along with poisoning all unmarked objects in the other arenas.
+    // Poisoning all unmarked objects in the other arenas.
     for (int i = 1; i < BlinkGC::NumberOfArenas; i++)
         m_arenas[i]->poisonArena();
-#endif
 }
 
 void ThreadState::poisonEagerArena()
 {
-    // TODO(Oilpan): enable the poisoning always.
-#if ENABLE(OILPAN)
     m_arenas[BlinkGC::EagerSweepArenaIndex]->poisonArena();
-#endif
 }
 #endif
 
diff --git a/third_party/WebKit/Source/platform/heap/Visitor.h b/third_party/WebKit/Source/platform/heap/Visitor.h
index a683882c..46260bdd 100644
--- a/third_party/WebKit/Source/platform/heap/Visitor.h
+++ b/third_party/WebKit/Source/platform/heap/Visitor.h
@@ -193,64 +193,6 @@
         TraceTrait<T>::trace(Derived::fromHelper(this), &const_cast<T&>(t));
     }
 
-#if !ENABLE(OILPAN)
-    // These trace methods are needed to allow compiling and calling trace on
-    // transition types. We need to support calls in the non-oilpan build
-    // because a fully transitioned type (which will have its trace method
-    // called) might trace a field that is in transition. Once transition types
-    // are removed these can be removed.
-    template<typename T> void trace(const OwnPtr<T>&) { }
-    template<typename T> void trace(const RefPtr<T>&) { }
-    template<typename T> void trace(const RawPtr<T>&) { }
-    template<typename T> void trace(const WeakPtr<T>&) { }
-
-    // On non-oilpan builds, it is convenient to allow calling trace on
-    // WillBeHeap{Vector,Deque}<FooPtrWillBeMember<T>>.
-    // Forbid tracing on-heap objects in off-heap collections.
-    // This is forbidden because convservative marking cannot identify
-    // those off-heap collection backing stores.
-    template<typename T, size_t inlineCapacity> void trace(const Vector<OwnPtr<T>, inlineCapacity>& vector)
-    {
-        static_assert(!IsGarbageCollectedType<T>::value, "cannot trace garbage collected object inside Vector");
-    }
-    template<typename T, size_t inlineCapacity> void trace(const Vector<RefPtr<T>, inlineCapacity>& vector)
-    {
-        static_assert(!IsGarbageCollectedType<T>::value, "cannot trace garbage collected object inside Vector");
-    }
-    template<typename T, size_t inlineCapacity> void trace(const Vector<RawPtr<T>, inlineCapacity>& vector)
-    {
-        static_assert(!IsGarbageCollectedType<T>::value, "cannot trace garbage collected object inside Vector");
-    }
-    template<typename T, size_t inlineCapacity> void trace(const Vector<WeakPtr<T>, inlineCapacity>& vector)
-    {
-        static_assert(!IsGarbageCollectedType<T>::value, "cannot trace garbage collected object inside Vector");
-    }
-    template<typename T, size_t inlineCapacity> void trace(const Vector<T, inlineCapacity>& vector)
-    {
-        static_assert(!IsGarbageCollectedType<T>::value, "cannot trace garbage collected object inside Vector");
-    }
-    template<typename T, size_t N> void trace(const Deque<OwnPtr<T>, N>& deque)
-    {
-        static_assert(!IsGarbageCollectedType<T>::value, "cannot trace garbage collected object inside Deque");
-    }
-    template<typename T, size_t N> void trace(const Deque<RefPtr<T>, N>& deque)
-    {
-        static_assert(!IsGarbageCollectedType<T>::value, "cannot trace garbage collected object inside Deque");
-    }
-    template<typename T, size_t N> void trace(const Deque<RawPtr<T>, N>& deque)
-    {
-        static_assert(!IsGarbageCollectedType<T>::value, "cannot trace garbage collected object inside Deque");
-    }
-    template<typename T, size_t N> void trace(const Deque<WeakPtr<T>, N>& deque)
-    {
-        static_assert(!IsGarbageCollectedType<T>::value, "cannot trace garbage collected object inside Deque");
-    }
-    template<typename T, size_t N> void trace(const Deque<T, N>& deque)
-    {
-        static_assert(!IsGarbageCollectedType<T>::value, "cannot trace garbage collected object inside Deque");
-    }
-#endif
-
     void markNoTracing(const void* pointer) { Derived::fromHelper(this)->mark(pointer, reinterpret_cast<TraceCallback>(0)); }
     void markHeaderNoTracing(HeapObjectHeader* header) { Derived::fromHelper(this)->markHeader(header, reinterpret_cast<TraceCallback>(0)); }
 
diff --git a/third_party/WebKit/Source/platform/mac/ScrollAnimatorMac.mm b/third_party/WebKit/Source/platform/mac/ScrollAnimatorMac.mm
index 4012cc3..dba7b51 100644
--- a/third_party/WebKit/Source/platform/mac/ScrollAnimatorMac.mm
+++ b/third_party/WebKit/Source/platform/mac/ScrollAnimatorMac.mm
@@ -673,7 +673,7 @@
 
 namespace blink {
 
-RawPtr<ScrollAnimatorBase> ScrollAnimatorBase::create(ScrollableArea* scrollableArea)
+ScrollAnimatorBase* ScrollAnimatorBase::create(ScrollableArea* scrollableArea)
 {
     return new ScrollAnimatorMac(scrollableArea);
 }
@@ -686,9 +686,7 @@
     , m_haveScrolledSincePageLoad(false)
     , m_needsScrollerStyleUpdate(false)
 {
-#if ENABLE(OILPAN)
     ThreadState::current()->registerPreFinalizer(this);
-#endif
 
     m_scrollAnimationHelperDelegate.adoptNS([[BlinkScrollAnimationHelperDelegate alloc] initWithScrollAnimator:this]);
     m_scrollAnimationHelper.adoptNS([[NSClassFromString(@"NSScrollAnimationHelper") alloc] initWithDelegate:m_scrollAnimationHelperDelegate.get()]);
@@ -701,9 +699,6 @@
 
 ScrollAnimatorMac::~ScrollAnimatorMac()
 {
-#if !ENABLE(OILPAN)
-    dispose();
-#endif
 }
 
 void ScrollAnimatorMac::dispose()
diff --git a/third_party/WebKit/Source/platform/mhtml/ArchiveResource.cpp b/third_party/WebKit/Source/platform/mhtml/ArchiveResource.cpp
index 367e95cde..19c4dbe 100644
--- a/third_party/WebKit/Source/platform/mhtml/ArchiveResource.cpp
+++ b/third_party/WebKit/Source/platform/mhtml/ArchiveResource.cpp
@@ -30,7 +30,7 @@
 
 namespace blink {
 
-inline ArchiveResource::ArchiveResource(
+ArchiveResource::ArchiveResource(
     PassRefPtr<SharedBuffer> data,
     const KURL& url,
     const String& contentID,
@@ -49,15 +49,14 @@
 {
 }
 
-RawPtr<ArchiveResource> ArchiveResource::create(
+ArchiveResource* ArchiveResource::create(
     PassRefPtr<SharedBuffer> data,
     const KURL& url,
     const String& contentID,
     const AtomicString& mimeType,
     const AtomicString& textEncoding)
 {
-    return new ArchiveResource(
-        data, url, contentID, mimeType, textEncoding);
+    return new ArchiveResource(data, url, contentID, mimeType, textEncoding);
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/platform/mhtml/ArchiveResource.h b/third_party/WebKit/Source/platform/mhtml/ArchiveResource.h
index 434cc667..a126366 100644
--- a/third_party/WebKit/Source/platform/mhtml/ArchiveResource.h
+++ b/third_party/WebKit/Source/platform/mhtml/ArchiveResource.h
@@ -39,7 +39,7 @@
 
 class PLATFORM_EXPORT ArchiveResource final : public GarbageCollectedFinalized<ArchiveResource> {
 public:
-    static RawPtr<ArchiveResource> create(
+    static ArchiveResource* create(
         PassRefPtr<SharedBuffer>,
         const KURL&,
         const String& contentId,
diff --git a/third_party/WebKit/Source/platform/mhtml/MHTMLArchive.cpp b/third_party/WebKit/Source/platform/mhtml/MHTMLArchive.cpp
index c638293..db74084 100644
--- a/third_party/WebKit/Source/platform/mhtml/MHTMLArchive.cpp
+++ b/third_party/WebKit/Source/platform/mhtml/MHTMLArchive.cpp
@@ -71,7 +71,7 @@
 {
 }
 
-RawPtr<MHTMLArchive> MHTMLArchive::create(const KURL& url, SharedBuffer* data)
+MHTMLArchive* MHTMLArchive::create(const KURL& url, SharedBuffer* data)
 {
     // For security reasons we only load MHTML pages from local URLs.
     if (!SchemeRegistry::shouldTreatURLSchemeAsLocal(url.protocol()))
@@ -82,7 +82,7 @@
     if (resources.isEmpty())
         return nullptr; // Invalid MHTML file.
 
-    RawPtr<MHTMLArchive> archive = new MHTMLArchive;
+    MHTMLArchive* archive = new MHTMLArchive;
     // The first document suitable resource is the main resource of the top frame.
     for (size_t i = 0; i < resources.size(); ++i) {
         const AtomicString& mimeType = resources[i]->mimeType();
@@ -91,7 +91,7 @@
         else
             archive->setMainResource(resources[i].get());
     }
-    return archive.release();
+    return archive;
 }
 
 void MHTMLArchive::generateMHTMLHeader(
@@ -220,7 +220,7 @@
     outputBuffer.append(asciiString.data(), asciiString.length());
 }
 
-void MHTMLArchive::setMainResource(RawPtr<ArchiveResource> mainResource)
+void MHTMLArchive::setMainResource(ArchiveResource* mainResource)
 {
     m_mainResource = mainResource;
 }
@@ -242,9 +242,7 @@
 DEFINE_TRACE(MHTMLArchive)
 {
     visitor->trace(m_mainResource);
-#if ENABLE(OILPAN)
     visitor->trace(m_subresources);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/platform/mhtml/MHTMLArchive.h b/third_party/WebKit/Source/platform/mhtml/MHTMLArchive.h
index d0bca90..3b8df32 100644
--- a/third_party/WebKit/Source/platform/mhtml/MHTMLArchive.h
+++ b/third_party/WebKit/Source/platform/mhtml/MHTMLArchive.h
@@ -49,7 +49,7 @@
 
 class PLATFORM_EXPORT MHTMLArchive final : public GarbageCollectedFinalized<MHTMLArchive> {
 public:
-    static RawPtr<MHTMLArchive> create(const KURL&, SharedBuffer*);
+    static MHTMLArchive* create(const KURL&, SharedBuffer*);
     ~MHTMLArchive();
 
     // Binary encoding results in smaller MHTML files but they might not work in other browsers.
@@ -100,7 +100,7 @@
 private:
     MHTMLArchive();
 
-    void setMainResource(RawPtr<ArchiveResource>);
+    void setMainResource(ArchiveResource*);
     void addSubresource(ArchiveResource*);
 
     Member<ArchiveResource> m_mainResource;
diff --git a/third_party/WebKit/Source/platform/mhtml/MHTMLParser.cpp b/third_party/WebKit/Source/platform/mhtml/MHTMLParser.cpp
index 3a06937..c1c7b3d 100644
--- a/third_party/WebKit/Source/platform/mhtml/MHTMLParser.cpp
+++ b/third_party/WebKit/Source/platform/mhtml/MHTMLParser.cpp
@@ -46,9 +46,9 @@
 // This class is a limited MIME parser used to parse the MIME headers of MHTML files.
 class MIMEHeader : public GarbageCollectedFinalized<MIMEHeader> {
 public:
-    static RawPtr<MIMEHeader> create()
+    static MIMEHeader* create()
     {
-        return new MIMEHeader();
+        return new MIMEHeader;
     }
 
     enum Encoding {
@@ -60,7 +60,7 @@
         Unknown
     };
 
-    static RawPtr<MIMEHeader> parseHeader(SharedBufferChunkReader* crLFLineReader);
+    static MIMEHeader* parseHeader(SharedBufferChunkReader* crLFLineReader);
 
     bool isMultipart() const { return m_contentType.startsWith("multipart/", TextCaseInsensitive); }
 
@@ -130,9 +130,9 @@
     return keyValuePairs;
 }
 
-RawPtr<MIMEHeader> MIMEHeader::parseHeader(SharedBufferChunkReader* buffer)
+MIMEHeader* MIMEHeader::parseHeader(SharedBufferChunkReader* buffer)
 {
-    RawPtr<MIMEHeader> mimeHeader = MIMEHeader::create();
+    MIMEHeader* mimeHeader = MIMEHeader::create();
     KeyValueMap keyValuePairs = retrieveKeyValuePairs(buffer);
     KeyValueMap::iterator mimeParametersIterator = keyValuePairs.find("content-type");
     if (mimeParametersIterator != keyValuePairs.end()) {
@@ -166,7 +166,7 @@
     if (mimeParametersIterator != keyValuePairs.end())
         mimeHeader->m_contentID = mimeParametersIterator->value;
 
-    return mimeHeader.release();
+    return mimeHeader;
 }
 
 MIMEHeader::Encoding MIMEHeader::parseContentTransferEncoding(const String& text)
@@ -208,9 +208,9 @@
 
 HeapVector<Member<ArchiveResource>> MHTMLParser::parseArchive()
 {
-    RawPtr<MIMEHeader> header = MIMEHeader::parseHeader(&m_lineReader);
+    MIMEHeader* header = MIMEHeader::parseHeader(&m_lineReader);
     HeapVector<Member<ArchiveResource>> resources;
-    if (!parseArchiveWithHeader(header.get(), resources))
+    if (!parseArchiveWithHeader(header, resources))
         resources.clear();
     return resources;
 }
@@ -225,7 +225,7 @@
     if (!header->isMultipart()) {
         // With IE a page with no resource is not multi-part.
         bool endOfArchiveReached = false;
-        RawPtr<ArchiveResource> resource = parseNextPart(*header, String(), String(), endOfArchiveReached);
+        ArchiveResource* resource = parseNextPart(*header, String(), String(), endOfArchiveReached);
         if (!resource)
             return false;
         resources.append(resource);
@@ -237,14 +237,14 @@
 
     bool endOfArchive = false;
     while (!endOfArchive) {
-        RawPtr<MIMEHeader> resourceHeader = MIMEHeader::parseHeader(&m_lineReader);
+        MIMEHeader* resourceHeader = MIMEHeader::parseHeader(&m_lineReader);
         if (!resourceHeader) {
             DLOG(ERROR) << "Failed to parse MHTML, invalid MIME header.";
             return false;
         }
         if (resourceHeader->contentType() == "multipart/alternative") {
             // Ignore IE nesting which makes little sense (IE seems to nest only some of the frames).
-            if (!parseArchiveWithHeader(resourceHeader.get(), resources)) {
+            if (!parseArchiveWithHeader(resourceHeader, resources)) {
                 DLOG(ERROR) << "Failed to parse MHTML subframe.";
                 return false;
             }
@@ -253,7 +253,7 @@
             continue;
         }
 
-        RawPtr<ArchiveResource> resource = parseNextPart(*resourceHeader, header->endOfPartBoundary(), header->endOfDocumentBoundary(), endOfArchive);
+        ArchiveResource* resource = parseNextPart(*resourceHeader, header->endOfPartBoundary(), header->endOfDocumentBoundary(), endOfArchive);
         if (!resource) {
             DLOG(ERROR) << "Failed to parse MHTML part.";
             return false;
@@ -264,7 +264,7 @@
 }
 
 
-RawPtr<ArchiveResource> MHTMLParser::parseNextPart(const MIMEHeader& mimeHeader, const String& endOfPartBoundary, const String& endOfDocumentBoundary, bool& endOfArchiveReached)
+ArchiveResource* MHTMLParser::parseNextPart(const MIMEHeader& mimeHeader, const String& endOfPartBoundary, const String& endOfDocumentBoundary, bool& endOfArchiveReached)
 {
     ASSERT(endOfPartBoundary.isEmpty() == endOfDocumentBoundary.isEmpty());
 
diff --git a/third_party/WebKit/Source/platform/mhtml/MHTMLParser.h b/third_party/WebKit/Source/platform/mhtml/MHTMLParser.h
index 9134e9e..87841ee 100644
--- a/third_party/WebKit/Source/platform/mhtml/MHTMLParser.h
+++ b/third_party/WebKit/Source/platform/mhtml/MHTMLParser.h
@@ -64,7 +64,7 @@
 
 private:
     bool parseArchiveWithHeader(MIMEHeader*, HeapVector<Member<ArchiveResource>>&);
-    RawPtr<ArchiveResource> parseNextPart(const MIMEHeader&, const String& endOfPartBoundary, const String& endOfDocumentBoundary, bool& endOfArchiveReached);
+    ArchiveResource* parseNextPart(const MIMEHeader&, const String& endOfPartBoundary, const String& endOfDocumentBoundary, bool& endOfArchiveReached);
 
     SharedBufferChunkReader m_lineReader;
 };
diff --git a/third_party/WebKit/Source/platform/scroll/ProgrammaticScrollAnimator.cpp b/third_party/WebKit/Source/platform/scroll/ProgrammaticScrollAnimator.cpp
index 61ecc6f..5b4323c8 100644
--- a/third_party/WebKit/Source/platform/scroll/ProgrammaticScrollAnimator.cpp
+++ b/third_party/WebKit/Source/platform/scroll/ProgrammaticScrollAnimator.cpp
@@ -15,11 +15,6 @@
 
 namespace blink {
 
-RawPtr<ProgrammaticScrollAnimator> ProgrammaticScrollAnimator::create(ScrollableArea* scrollableArea)
-{
-    return new ProgrammaticScrollAnimator(scrollableArea);
-}
-
 ProgrammaticScrollAnimator::ProgrammaticScrollAnimator(ScrollableArea* scrollableArea)
     : m_scrollableArea(scrollableArea)
     , m_startTime(0.0)
diff --git a/third_party/WebKit/Source/platform/scroll/ProgrammaticScrollAnimator.h b/third_party/WebKit/Source/platform/scroll/ProgrammaticScrollAnimator.h
index f7d6604..fa0d38ce 100644
--- a/third_party/WebKit/Source/platform/scroll/ProgrammaticScrollAnimator.h
+++ b/third_party/WebKit/Source/platform/scroll/ProgrammaticScrollAnimator.h
@@ -24,7 +24,10 @@
 class ProgrammaticScrollAnimator : public ScrollAnimatorCompositorCoordinator {
     WTF_MAKE_NONCOPYABLE(ProgrammaticScrollAnimator);
 public:
-    static RawPtr<ProgrammaticScrollAnimator> create(ScrollableArea*);
+    static ProgrammaticScrollAnimator* create(ScrollableArea* scrollableArea)
+    {
+        return new ProgrammaticScrollAnimator(scrollableArea);
+    }
 
     virtual ~ProgrammaticScrollAnimator();
 
diff --git a/third_party/WebKit/Source/platform/scroll/ScrollAnimator.cpp b/third_party/WebKit/Source/platform/scroll/ScrollAnimator.cpp
index 0cac7150..3f5cd774 100644
--- a/third_party/WebKit/Source/platform/scroll/ScrollAnimator.cpp
+++ b/third_party/WebKit/Source/platform/scroll/ScrollAnimator.cpp
@@ -53,7 +53,7 @@
 
 } // namespace
 
-RawPtr<ScrollAnimatorBase> ScrollAnimatorBase::create(ScrollableArea* scrollableArea)
+ScrollAnimatorBase* ScrollAnimatorBase::create(ScrollableArea* scrollableArea)
 {
     if (scrollableArea && scrollableArea->scrollAnimatorEnabled())
         return new ScrollAnimator(scrollableArea);
diff --git a/third_party/WebKit/Source/platform/scroll/ScrollAnimatorBase.h b/third_party/WebKit/Source/platform/scroll/ScrollAnimatorBase.h
index a6f2c02..f8b6c38 100644
--- a/third_party/WebKit/Source/platform/scroll/ScrollAnimatorBase.h
+++ b/third_party/WebKit/Source/platform/scroll/ScrollAnimatorBase.h
@@ -48,7 +48,7 @@
 
 class PLATFORM_EXPORT ScrollAnimatorBase : public ScrollAnimatorCompositorCoordinator {
 public:
-    static RawPtr<ScrollAnimatorBase> create(ScrollableArea*);
+    static ScrollAnimatorBase* create(ScrollableArea*);
 
     virtual ~ScrollAnimatorBase();
 
diff --git a/third_party/WebKit/Source/platform/scroll/ScrollAnimatorCompositorCoordinator.cpp b/third_party/WebKit/Source/platform/scroll/ScrollAnimatorCompositorCoordinator.cpp
index d27bebb..5dcc838 100644
--- a/third_party/WebKit/Source/platform/scroll/ScrollAnimatorCompositorCoordinator.cpp
+++ b/third_party/WebKit/Source/platform/scroll/ScrollAnimatorCompositorCoordinator.cpp
@@ -22,9 +22,7 @@
     , m_compositorAnimationId(0)
     , m_compositorAnimationGroupId(0)
 {
-#if ENABLE(OILPAN)
     ThreadState::current()->registerPreFinalizer(this);
-#endif
     m_compositorPlayer = adoptPtr(CompositorFactory::current().createAnimationPlayer());
     ASSERT(m_compositorPlayer);
     m_compositorPlayer->setAnimationDelegate(this);
@@ -32,9 +30,6 @@
 
 ScrollAnimatorCompositorCoordinator::~ScrollAnimatorCompositorCoordinator()
 {
-#if !ENABLE(OILPAN)
-    ScrollAnimatorCompositorCoordinator::dispose();
-#endif
 }
 
 void ScrollAnimatorCompositorCoordinator::dispose()
diff --git a/third_party/WebKit/Source/platform/scroll/ScrollAnimatorTest.cpp b/third_party/WebKit/Source/platform/scroll/ScrollAnimatorTest.cpp
index e0a9c98..aafe7f9 100644
--- a/third_party/WebKit/Source/platform/scroll/ScrollAnimatorTest.cpp
+++ b/third_party/WebKit/Source/platform/scroll/ScrollAnimatorTest.cpp
@@ -53,7 +53,7 @@
 class MockScrollableArea : public GarbageCollectedFinalized<MockScrollableArea>, public ScrollableArea {
     USING_GARBAGE_COLLECTED_MIXIN(MockScrollableArea);
 public:
-    static RawPtr<MockScrollableArea> create(bool scrollAnimatorEnabled)
+    static MockScrollableArea* create(bool scrollAnimatorEnabled)
     {
         return new MockScrollableArea(scrollAnimatorEnabled);
     }
@@ -134,8 +134,8 @@
 
 TEST(ScrollAnimatorTest, MainThreadStates)
 {
-    RawPtr<MockScrollableArea> scrollableArea = MockScrollableArea::create(true);
-    RawPtr<ScrollAnimator> scrollAnimator = new ScrollAnimator(scrollableArea.get(), getMockedTime);
+    MockScrollableArea* scrollableArea = MockScrollableArea::create(true);
+    ScrollAnimator* scrollAnimator = new ScrollAnimator(scrollableArea, getMockedTime);
 
     EXPECT_CALL(*scrollableArea, minimumScrollPosition()).Times(AtLeast(1))
         .WillRepeatedly(Return(IntPoint()));
@@ -181,8 +181,8 @@
 
 TEST(ScrollAnimatorTest, MainThreadEnabled)
 {
-    RawPtr<MockScrollableArea> scrollableArea = MockScrollableArea::create(true);
-    RawPtr<ScrollAnimator> scrollAnimator = new ScrollAnimator(scrollableArea.get(), getMockedTime);
+    MockScrollableArea* scrollableArea = MockScrollableArea::create(true);
+    ScrollAnimator* scrollAnimator = new ScrollAnimator(scrollableArea, getMockedTime);
 
     EXPECT_CALL(*scrollableArea, minimumScrollPosition()).Times(AtLeast(1)).WillRepeatedly(Return(IntPoint()));
     EXPECT_CALL(*scrollableArea, maximumScrollPosition()).Times(AtLeast(1)).WillRepeatedly(Return(IntPoint(1000, 1000)));
@@ -258,8 +258,8 @@
 // non-smooth scroll offset animation.
 TEST(ScrollAnimatorTest, AnimatedScrollAborted)
 {
-    RawPtr<MockScrollableArea> scrollableArea = MockScrollableArea::create(true);
-    RawPtr<ScrollAnimator> scrollAnimator = new ScrollAnimator(scrollableArea.get(), getMockedTime);
+    MockScrollableArea* scrollableArea = MockScrollableArea::create(true);
+    ScrollAnimator* scrollAnimator = new ScrollAnimator(scrollableArea, getMockedTime);
 
     EXPECT_CALL(*scrollableArea, minimumScrollPosition()).Times(AtLeast(1))
         .WillRepeatedly(Return(IntPoint()));
@@ -305,8 +305,8 @@
 // completed on the main thread.
 TEST(ScrollAnimatorTest, AnimatedScrollTakeover)
 {
-    RawPtr<MockScrollableArea> scrollableArea = MockScrollableArea::create(true);
-    RawPtr<TestScrollAnimator> scrollAnimator = new TestScrollAnimator(scrollableArea.get(), getMockedTime);
+    MockScrollableArea* scrollableArea = MockScrollableArea::create(true);
+    TestScrollAnimator* scrollAnimator = new TestScrollAnimator(scrollableArea, getMockedTime);
 
     EXPECT_CALL(*scrollableArea, minimumScrollPosition()).Times(AtLeast(1))
         .WillRepeatedly(Return(IntPoint()));
@@ -354,8 +354,8 @@
 
 TEST(ScrollAnimatorTest, Disabled)
 {
-    RawPtr<MockScrollableArea> scrollableArea = MockScrollableArea::create(false);
-    RawPtr<ScrollAnimator> scrollAnimator = new ScrollAnimator(scrollableArea.get(), getMockedTime);
+    MockScrollableArea* scrollableArea = MockScrollableArea::create(false);
+    ScrollAnimator* scrollAnimator = new ScrollAnimator(scrollableArea, getMockedTime);
 
     EXPECT_CALL(*scrollableArea, minimumScrollPosition()).Times(AtLeast(1)).WillRepeatedly(Return(IntPoint()));
     EXPECT_CALL(*scrollableArea, maximumScrollPosition()).Times(AtLeast(1)).WillRepeatedly(Return(IntPoint(1000, 1000)));
@@ -387,8 +387,8 @@
 // See crbug.com/598548.
 TEST(ScrollAnimatorTest, CancellingAnimationResetsState)
 {
-    RawPtr<MockScrollableArea> scrollableArea = MockScrollableArea::create(true);
-    RawPtr<ScrollAnimator> scrollAnimator = new ScrollAnimator(scrollableArea.get(), getMockedTime);
+    MockScrollableArea* scrollableArea = MockScrollableArea::create(true);
+    ScrollAnimator* scrollAnimator = new ScrollAnimator(scrollableArea, getMockedTime);
 
     EXPECT_CALL(*scrollableArea, minimumScrollPosition()).Times(AtLeast(1))
         .WillRepeatedly(Return(IntPoint()));
@@ -448,8 +448,8 @@
 // happens.
 TEST(ScrollAnimatorTest, CancellingCompositorAnimation)
 {
-    RawPtr<MockScrollableArea> scrollableArea = MockScrollableArea::create(true);
-    RawPtr<TestScrollAnimator> scrollAnimator = new TestScrollAnimator(scrollableArea.get(), getMockedTime);
+    MockScrollableArea* scrollableArea = MockScrollableArea::create(true);
+    TestScrollAnimator* scrollAnimator = new TestScrollAnimator(scrollableArea, getMockedTime);
 
     EXPECT_CALL(*scrollableArea, minimumScrollPosition()).Times(AtLeast(1))
         .WillRepeatedly(Return(IntPoint()));
diff --git a/third_party/WebKit/Source/platform/scroll/ScrollableArea.cpp b/third_party/WebKit/Source/platform/scroll/ScrollableArea.cpp
index 839bd06c..f1aff61 100644
--- a/third_party/WebKit/Source/platform/scroll/ScrollableArea.cpp
+++ b/third_party/WebKit/Source/platform/scroll/ScrollableArea.cpp
@@ -40,7 +40,6 @@
 #include "platform/scroll/MainThreadScrollingReason.h"
 #include "platform/scroll/ProgrammaticScrollAnimator.h"
 #include "platform/scroll/ScrollbarTheme.h"
-#include "wtf/PassOwnPtr.h"
 
 #include "platform/TraceEvent.h"
 
@@ -51,7 +50,7 @@
 
 struct SameSizeAsScrollableArea {
     virtual ~SameSizeAsScrollableArea();
-#if ENABLE(ASSERT) && ENABLE(OILPAN)
+#if ENABLE(ASSERT)
     VerifyEagerFinalization verifyEager;
 #endif
     Member<void*> pointer[2];
@@ -94,9 +93,7 @@
 
 void ScrollableArea::clearScrollAnimators()
 {
-#if OS(MACOSX) && ENABLE(OILPAN)
-    // TODO(ymalik): Let oilpan decide when to call dispose rather than
-    // explicitly calling it here to cleanup.
+#if OS(MACOSX)
     if (m_scrollAnimator)
         m_scrollAnimator->dispose();
 #endif
diff --git a/third_party/WebKit/Source/platform/scroll/ScrollableArea.h b/third_party/WebKit/Source/platform/scroll/ScrollableArea.h
index cea0e0e..87912f4 100644
--- a/third_party/WebKit/Source/platform/scroll/ScrollableArea.h
+++ b/third_party/WebKit/Source/platform/scroll/ScrollableArea.h
@@ -62,16 +62,7 @@
     IncludeScrollbars,
 };
 
-#if ENABLE(OILPAN)
-// Oilpan: Using the transition type GarbageCollectedMixin is
-// problematic non-Oilpan as the type expands to DummyBase, exporting it
-// also from 'platform' as a result. Bringing about duplicate DummyBases
-// as core also exports same; with component build linking fails as a
-// result. Hence the workaround of not using a transition type.
 class PLATFORM_EXPORT ScrollableArea : public GarbageCollectedMixin {
-#else
-class PLATFORM_EXPORT ScrollableArea {
-#endif
     WTF_MAKE_NONCOPYABLE(ScrollableArea);
 public:
     static int pixelsPerLineStep(HostWindow*);
@@ -130,10 +121,10 @@
     ScrollAnimatorBase& scrollAnimator() const;
 
     // This getter will return null if the ScrollAnimatorBase hasn't been created yet.
-    ScrollAnimatorBase* existingScrollAnimator() const { return m_scrollAnimator.get(); }
+    ScrollAnimatorBase* existingScrollAnimator() const { return m_scrollAnimator; }
 
     ProgrammaticScrollAnimator& programmaticScrollAnimator() const;
-    ProgrammaticScrollAnimator* existingProgrammaticScrollAnimator() const { return m_programmaticScrollAnimator.get(); }
+    ProgrammaticScrollAnimator* existingProgrammaticScrollAnimator() const { return m_programmaticScrollAnimator; }
 
     virtual CompositorAnimationTimeline* compositorAnimationTimeline() const { return nullptr; }
 
diff --git a/third_party/WebKit/Source/platform/scroll/ScrollableAreaTest.cpp b/third_party/WebKit/Source/platform/scroll/ScrollableAreaTest.cpp
index 4938193..5f9ac36 100644
--- a/third_party/WebKit/Source/platform/scroll/ScrollableAreaTest.cpp
+++ b/third_party/WebKit/Source/platform/scroll/ScrollableAreaTest.cpp
@@ -24,7 +24,7 @@
 class MockScrollableArea : public GarbageCollectedFinalized<MockScrollableArea>, public ScrollableArea {
     USING_GARBAGE_COLLECTED_MIXIN(MockScrollableArea);
 public:
-    static RawPtr<MockScrollableArea> create(const IntPoint& maximumScrollPosition)
+    static MockScrollableArea* create(const IntPoint& maximumScrollPosition)
     {
         return new MockScrollableArea(maximumScrollPosition);
     }
@@ -97,7 +97,7 @@
 
 TEST_F(ScrollableAreaTest, ScrollAnimatorCurrentPositionShouldBeSync)
 {
-    RawPtr<MockScrollableArea> scrollableArea = MockScrollableArea::create(IntPoint(0, 100));
+    MockScrollableArea* scrollableArea = MockScrollableArea::create(IntPoint(0, 100));
     scrollableArea->setScrollPosition(IntPoint(0, 10000), CompositorScroll);
     EXPECT_EQ(100.0, scrollableArea->scrollAnimator().currentPosition().y());
 }
@@ -115,8 +115,8 @@
 TEST_F(ScrollableAreaTest, ScrollbarTrackAndThumbRepaint)
 {
     ScrollbarThemeWithMockInvalidation theme;
-    RawPtr<MockScrollableArea> scrollableArea = MockScrollableArea::create(IntPoint(0, 100));
-    RawPtr<Scrollbar> scrollbar = Scrollbar::createForTesting(scrollableArea.get(), HorizontalScrollbar, RegularScrollbar, &theme);
+    MockScrollableArea* scrollableArea = MockScrollableArea::create(IntPoint(0, 100));
+    Scrollbar* scrollbar = Scrollbar::createForTesting(scrollableArea, HorizontalScrollbar, RegularScrollbar, &theme);
 
     EXPECT_CALL(theme, shouldRepaintAllPartsOnInvalidation()).WillRepeatedly(Return(true));
     EXPECT_TRUE(scrollbar->trackNeedsRepaint());
@@ -160,7 +160,7 @@
 TEST_F(ScrollableAreaTest, ScrollbarGraphicsLayerInvalidation)
 {
     ScrollbarTheme::setMockScrollbarsEnabled(true);
-    RawPtr<MockScrollableArea> scrollableArea = MockScrollableArea::create(IntPoint(0, 100));
+    MockScrollableArea* scrollableArea = MockScrollableArea::create(IntPoint(0, 100));
     MockGraphicsLayerClient graphicsLayerClient;
     FakeGraphicsLayer graphicsLayer(&graphicsLayerClient);
     graphicsLayer.setDrawsContent(true);
@@ -168,7 +168,7 @@
 
     EXPECT_CALL(*scrollableArea, layerForHorizontalScrollbar()).WillRepeatedly(Return(&graphicsLayer));
 
-    RawPtr<Scrollbar> scrollbar = Scrollbar::create(scrollableArea.get(), HorizontalScrollbar, RegularScrollbar, nullptr);
+    Scrollbar* scrollbar = Scrollbar::create(scrollableArea, HorizontalScrollbar, RegularScrollbar, nullptr);
     graphicsLayer.resetTrackedPaintInvalidations();
     scrollbar->setNeedsPaintInvalidation(NoPart);
     EXPECT_TRUE(graphicsLayer.hasTrackedPaintInvalidations());
@@ -180,11 +180,11 @@
 TEST_F(ScrollableAreaTest, InvalidatesNonCompositedScrollbarsWhenThumbMoves)
 {
     ScrollbarThemeWithMockInvalidation theme;
-    RawPtr<MockScrollableArea> scrollableArea = MockScrollableArea::create(IntPoint(100, 100));
-    RawPtr<Scrollbar> horizontalScrollbar = Scrollbar::createForTesting(scrollableArea.get(), HorizontalScrollbar, RegularScrollbar, &theme);
-    RawPtr<Scrollbar> verticalScrollbar = Scrollbar::createForTesting(scrollableArea.get(), VerticalScrollbar, RegularScrollbar, &theme);
-    EXPECT_CALL(*scrollableArea, horizontalScrollbar()).WillRepeatedly(Return(horizontalScrollbar.get()));
-    EXPECT_CALL(*scrollableArea, verticalScrollbar()).WillRepeatedly(Return(verticalScrollbar.get()));
+    MockScrollableArea* scrollableArea = MockScrollableArea::create(IntPoint(100, 100));
+    Scrollbar* horizontalScrollbar = Scrollbar::createForTesting(scrollableArea, HorizontalScrollbar, RegularScrollbar, &theme);
+    Scrollbar* verticalScrollbar = Scrollbar::createForTesting(scrollableArea, VerticalScrollbar, RegularScrollbar, &theme);
+    EXPECT_CALL(*scrollableArea, horizontalScrollbar()).WillRepeatedly(Return(horizontalScrollbar));
+    EXPECT_CALL(*scrollableArea, verticalScrollbar()).WillRepeatedly(Return(verticalScrollbar));
 
     // Regardless of whether the theme invalidates any parts, non-composited
     // scrollbars have to be repainted if the thumb moves.
@@ -212,15 +212,15 @@
 TEST_F(ScrollableAreaTest, InvalidatesCompositedScrollbarsIfPartsNeedRepaint)
 {
     ScrollbarThemeWithMockInvalidation theme;
-    RawPtr<MockScrollableArea> scrollableArea = MockScrollableArea::create(IntPoint(100, 100));
-    RawPtr<Scrollbar> horizontalScrollbar = Scrollbar::createForTesting(scrollableArea.get(), HorizontalScrollbar, RegularScrollbar, &theme);
+    MockScrollableArea* scrollableArea = MockScrollableArea::create(IntPoint(100, 100));
+    Scrollbar* horizontalScrollbar = Scrollbar::createForTesting(scrollableArea, HorizontalScrollbar, RegularScrollbar, &theme);
     horizontalScrollbar->clearTrackNeedsRepaint();
     horizontalScrollbar->clearThumbNeedsRepaint();
-    RawPtr<Scrollbar> verticalScrollbar = Scrollbar::createForTesting(scrollableArea.get(), VerticalScrollbar, RegularScrollbar, &theme);
+    Scrollbar* verticalScrollbar = Scrollbar::createForTesting(scrollableArea, VerticalScrollbar, RegularScrollbar, &theme);
     verticalScrollbar->clearTrackNeedsRepaint();
     verticalScrollbar->clearThumbNeedsRepaint();
-    EXPECT_CALL(*scrollableArea, horizontalScrollbar()).WillRepeatedly(Return(horizontalScrollbar.get()));
-    EXPECT_CALL(*scrollableArea, verticalScrollbar()).WillRepeatedly(Return(verticalScrollbar.get()));
+    EXPECT_CALL(*scrollableArea, horizontalScrollbar()).WillRepeatedly(Return(horizontalScrollbar));
+    EXPECT_CALL(*scrollableArea, verticalScrollbar()).WillRepeatedly(Return(verticalScrollbar));
 
     // Composited scrollbars only need repainting when parts become invalid
     // (e.g. if the track changes appearance when the thumb reaches the end).
@@ -277,7 +277,7 @@
 
 TEST_F(ScrollableAreaTest, RecalculatesScrollbarOverlayIfBackgroundChanges)
 {
-    RawPtr<MockScrollableArea> scrollableArea = MockScrollableArea::create(IntPoint(0, 100));
+    MockScrollableArea* scrollableArea = MockScrollableArea::create(IntPoint(0, 100));
 
     EXPECT_EQ(ScrollbarOverlayStyleDefault, scrollableArea->getScrollbarOverlayStyle());
     scrollableArea->recalculateScrollbarOverlayStyle(Color(34, 85, 51));
diff --git a/third_party/WebKit/Source/platform/scroll/Scrollbar.cpp b/third_party/WebKit/Source/platform/scroll/Scrollbar.cpp
index eb2e484..c54bccc9 100644
--- a/third_party/WebKit/Source/platform/scroll/Scrollbar.cpp
+++ b/third_party/WebKit/Source/platform/scroll/Scrollbar.cpp
@@ -37,16 +37,6 @@
 
 namespace blink {
 
-RawPtr<Scrollbar> Scrollbar::create(ScrollableArea* scrollableArea, ScrollbarOrientation orientation, ScrollbarControlSize size, HostWindow* hostWindow)
-{
-    return new Scrollbar(scrollableArea, orientation, size, hostWindow);
-}
-
-RawPtr<Scrollbar> Scrollbar::createForTesting(ScrollableArea* scrollableArea, ScrollbarOrientation orientation, ScrollbarControlSize size, ScrollbarTheme* theme)
-{
-    return new Scrollbar(scrollableArea, orientation, size, nullptr, theme);
-}
-
 Scrollbar::Scrollbar(ScrollableArea* scrollableArea, ScrollbarOrientation orientation, ScrollbarControlSize controlSize, HostWindow* hostWindow, ScrollbarTheme* theme)
     : m_scrollableArea(scrollableArea)
     , m_orientation(orientation)
diff --git a/third_party/WebKit/Source/platform/scroll/Scrollbar.h b/third_party/WebKit/Source/platform/scroll/Scrollbar.h
index 2024d62..197e691 100644
--- a/third_party/WebKit/Source/platform/scroll/Scrollbar.h
+++ b/third_party/WebKit/Source/platform/scroll/Scrollbar.h
@@ -33,7 +33,6 @@
 #include "platform/scroll/ScrollTypes.h"
 #include "platform/scroll/ScrollbarThemeClient.h"
 #include "wtf/MathExtras.h"
-#include "wtf/PassRefPtr.h"
 
 namespace blink {
 
@@ -48,10 +47,16 @@
 
 class PLATFORM_EXPORT Scrollbar : public Widget, public ScrollbarThemeClient {
 public:
-    static RawPtr<Scrollbar> create(ScrollableArea*, ScrollbarOrientation, ScrollbarControlSize, HostWindow*);
+    static Scrollbar* create(ScrollableArea* scrollableArea, ScrollbarOrientation orientation, ScrollbarControlSize size, HostWindow* hostWindow)
+    {
+        return new Scrollbar(scrollableArea, orientation, size, hostWindow);
+    }
 
     // Theme object ownership remains with the caller and it must outlive the scrollbar.
-    static RawPtr<Scrollbar> createForTesting(ScrollableArea*, ScrollbarOrientation, ScrollbarControlSize, ScrollbarTheme*);
+    static Scrollbar* createForTesting(ScrollableArea* scrollableArea, ScrollbarOrientation orientation, ScrollbarControlSize size, ScrollbarTheme* theme)
+    {
+        return new Scrollbar(scrollableArea, orientation, size, nullptr, theme);
+    }
 
     ~Scrollbar() override;
 
@@ -176,9 +181,7 @@
 
     // Promptly unregister from the theme manager + run finalizers of derived Scrollbars.
     EAGERLY_FINALIZE();
-#if ENABLE(OILPAN)
     DECLARE_EAGER_FINALIZATION_OPERATOR_NEW();
-#endif
     DECLARE_VIRTUAL_TRACE();
 
 protected:
diff --git a/third_party/WebKit/Source/platform/testing/DEPS b/third_party/WebKit/Source/platform/testing/DEPS
index e9a6106c..431405c 100644
--- a/third_party/WebKit/Source/platform/testing/DEPS
+++ b/third_party/WebKit/Source/platform/testing/DEPS
@@ -3,6 +3,7 @@
     # directories and files instead of writing 'base/'.
     "+base/command_line.h",
     "+base/path_service.h",
+    "+base/run_loop.h",
     "+base/message_loop",
     "+base/metrics/statistics_recorder.h",
     "+base/test/test_io_thread.h",
diff --git a/third_party/WebKit/Source/platform/testing/FontTestHelpers.cpp b/third_party/WebKit/Source/platform/testing/FontTestHelpers.cpp
index 93a9186..4b1904b 100644
--- a/third_party/WebKit/Source/platform/testing/FontTestHelpers.cpp
+++ b/third_party/WebKit/Source/platform/testing/FontTestHelpers.cpp
@@ -20,7 +20,7 @@
 
 class TestFontSelector : public FontSelector {
 public:
-    static RawPtr<TestFontSelector> create(const String& path)
+    static TestFontSelector* create(const String& path)
     {
         RefPtr<SharedBuffer> fontBuffer = testing::readFromFile(path);
         String otsParseMessage;
diff --git a/third_party/WebKit/Source/platform/testing/weburl_loader_mock.cc b/third_party/WebKit/Source/platform/testing/weburl_loader_mock.cc
new file mode 100644
index 0000000..ab0f8e9
--- /dev/null
+++ b/third_party/WebKit/Source/platform/testing/weburl_loader_mock.cc
@@ -0,0 +1,167 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "platform/testing/weburl_loader_mock.h"
+
+#include "platform/testing/weburl_loader_mock_factory_impl.h"
+#include "public/platform/URLConversion.h"
+#include "public/platform/WebData.h"
+#include "public/platform/WebURLError.h"
+#include "public/platform/WebURLLoaderClient.h"
+#include "public/platform/WebUnitTestSupport.h"
+#include "wtf/PassOwnPtr.h"
+
+namespace blink {
+
+WebURLLoaderMock::WebURLLoaderMock(WebURLLoaderMockFactoryImpl* factory,
+                                   WebURLLoader* default_loader)
+    : factory_(factory),
+      default_loader_(adoptPtr(default_loader)),
+      weak_factory_(this) {
+}
+
+WebURLLoaderMock::~WebURLLoaderMock() {
+}
+
+void WebURLLoaderMock::ServeAsynchronousRequest(
+    WebURLLoaderTestDelegate* delegate,
+    const WebURLResponse& response,
+    const WebData& data,
+    const WebURLError& error) {
+  DCHECK(!using_default_loader_);
+  if (!client_)
+    return;
+
+  // If no delegate is provided then create an empty one. The default behavior
+  // will just proxy to the client.
+  OwnPtr<WebURLLoaderTestDelegate> default_delegate;
+  if (!delegate) {
+    default_delegate = adoptPtr(new WebURLLoaderTestDelegate());
+    delegate = default_delegate.get();
+  }
+
+  // didReceiveResponse() and didReceiveData() might end up getting ::cancel()
+  // to be called which will make the ResourceLoader to delete |this|.
+  WeakPtr<WebURLLoaderMock> self = weak_factory_.createWeakPtr();
+
+  delegate->didReceiveResponse(client_, this, response);
+  if (!self)
+    return;
+
+  if (error.reason) {
+    delegate->didFail(client_, this, error);
+    return;
+  }
+  delegate->didReceiveData(client_, this, data.data(), data.size(),
+                           data.size());
+  if (!self)
+    return;
+
+  delegate->didFinishLoading(client_, this, 0, data.size());
+}
+
+WebURLRequest WebURLLoaderMock::ServeRedirect(
+    const WebURLRequest& request,
+    const WebURLResponse& redirectResponse) {
+  KURL redirectURL(
+      ParsedURLString, redirectResponse.httpHeaderField("Location"));
+
+  WebURLRequest newRequest;
+  newRequest.initialize();
+  newRequest.setURL(redirectURL);
+  newRequest.setFirstPartyForCookies(redirectURL);
+  newRequest.setDownloadToFile(request.downloadToFile());
+  newRequest.setUseStreamOnResponse(request.useStreamOnResponse());
+  newRequest.setRequestContext(request.getRequestContext());
+  newRequest.setFrameType(request.getFrameType());
+  newRequest.setSkipServiceWorker(request.skipServiceWorker());
+  newRequest.setShouldResetAppCache(request.shouldResetAppCache());
+  newRequest.setFetchRequestMode(request.getFetchRequestMode());
+  newRequest.setFetchCredentialsMode(request.getFetchCredentialsMode());
+  newRequest.setHTTPMethod(request.httpMethod());
+  newRequest.setHTTPBody(request.httpBody());
+
+  WeakPtr<WebURLLoaderMock> self = weak_factory_.createWeakPtr();
+
+  client_->willFollowRedirect(this, newRequest, redirectResponse);
+
+  // |this| might be deleted in willFollowRedirect().
+  if (!self)
+    return newRequest;
+
+  if (redirectURL != KURL(newRequest.url())) {
+    // Only follow the redirect if WebKit left the URL unmodified.
+    // We assume that WebKit only changes the URL to suppress a redirect, and we
+    // assume that it does so by setting it to be invalid.
+    DCHECK(!newRequest.url().isValid());
+    cancel();
+  }
+
+  return newRequest;
+}
+
+void WebURLLoaderMock::loadSynchronously(const WebURLRequest& request,
+                                         WebURLResponse& response,
+                                         WebURLError& error,
+                                         WebData& data) {
+  if (factory_->IsMockedURL(request.url())) {
+    factory_->LoadSynchronously(request, &response, &error, &data);
+    return;
+  }
+  DCHECK(KURL(request.url()).protocolIsData())
+      << "loadSynchronously shouldn't be falling back: "
+      << request.url().string().utf8();
+  using_default_loader_ = true;
+  default_loader_->loadSynchronously(request, response, error, data);
+}
+
+void WebURLLoaderMock::loadAsynchronously(const WebURLRequest& request,
+                                          WebURLLoaderClient* client) {
+  DCHECK(client);
+  if (factory_->IsMockedURL(request.url())) {
+    client_ = client;
+    factory_->LoadAsynchronouly(request, this);
+    return;
+  }
+  DCHECK(KURL(request.url()).protocolIsData())
+      << "loadAsynchronously shouldn't be falling back: "
+      << request.url().string().utf8();
+  using_default_loader_ = true;
+  default_loader_->loadAsynchronously(request, client);
+}
+
+void WebURLLoaderMock::cancel() {
+  if (using_default_loader_) {
+    default_loader_->cancel();
+    return;
+  }
+  client_ = nullptr;
+  factory_->CancelLoad(this);
+}
+
+void WebURLLoaderMock::setDefersLoading(bool deferred) {
+  is_deferred_ = deferred;
+  if (using_default_loader_) {
+    default_loader_->setDefersLoading(deferred);
+    return;
+  }
+
+  // Ignores setDefersLoading(false) safely.
+  if (!deferred)
+    return;
+
+  // setDefersLoading(true) is not implemented.
+  NOTIMPLEMENTED();
+}
+
+void WebURLLoaderMock::setLoadingTaskRunner(WebTaskRunner*) {
+  // In principle this is NOTIMPLEMENTED(), but if we put that here it floods
+  // the console during webkit unit tests, so we leave the function empty.
+}
+
+WeakPtr<WebURLLoaderMock> WebURLLoaderMock::GetWeakPtr() {
+  return weak_factory_.createWeakPtr();
+}
+
+} // namespace blink
diff --git a/third_party/WebKit/Source/platform/testing/weburl_loader_mock.h b/third_party/WebKit/Source/platform/testing/weburl_loader_mock.h
new file mode 100644
index 0000000..b796266
--- /dev/null
+++ b/third_party/WebKit/Source/platform/testing/weburl_loader_mock.h
@@ -0,0 +1,75 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef WebURLLoaderMock_h
+#define WebURLLoaderMock_h
+
+#include "base/macros.h"
+#include "public/platform/WebURLLoader.h"
+#include "wtf/OwnPtr.h"
+#include "wtf/WeakPtr.h"
+
+namespace blink {
+
+class WebData;
+struct WebURLError;
+class WebURLLoaderClient;
+class WebURLLoaderMockFactoryImpl;
+class WebURLLoaderTestDelegate;
+class WebURLRequest;
+class WebURLResponse;
+
+// A simple class for mocking WebURLLoader.
+// If the WebURLLoaderMockFactory it is associated with has been configured to
+// mock the request it gets, it serves the mocked resource.  Otherwise it just
+// forwards it to the default loader.
+class WebURLLoaderMock : public WebURLLoader {
+ public:
+  // This object becomes the owner of |default_loader|.
+  WebURLLoaderMock(WebURLLoaderMockFactoryImpl* factory,
+                   WebURLLoader* default_loader);
+  ~WebURLLoaderMock() override;
+
+  // Simulates the asynchronous request being served.
+  void ServeAsynchronousRequest(WebURLLoaderTestDelegate* delegate,
+                                const WebURLResponse& response,
+                                const WebData& data,
+                                const WebURLError& error);
+
+  // Simulates the redirect being served.
+  WebURLRequest ServeRedirect(
+      const WebURLRequest& request,
+      const WebURLResponse& redirectResponse);
+
+  // WebURLLoader methods:
+  void loadSynchronously(const WebURLRequest& request,
+                         WebURLResponse& response,
+                         WebURLError& error,
+                         WebData& data) override;
+  void loadAsynchronously(const WebURLRequest& request,
+                          WebURLLoaderClient* client) override;
+  void cancel() override;
+  void setDefersLoading(bool defer) override;
+  void setLoadingTaskRunner(WebTaskRunner*) override;
+
+  bool is_deferred() { return is_deferred_; }
+  bool is_cancelled() { return !client_; }
+
+  WeakPtr<WebURLLoaderMock> GetWeakPtr();
+
+ private:
+  WebURLLoaderMockFactoryImpl* factory_ = nullptr;
+  WebURLLoaderClient* client_ = nullptr;
+  OwnPtr<WebURLLoader> default_loader_;
+  bool using_default_loader_ = false;
+  bool is_deferred_ = false;
+
+  WeakPtrFactory<WebURLLoaderMock> weak_factory_;
+
+  DISALLOW_COPY_AND_ASSIGN(WebURLLoaderMock);
+};
+
+} // namespace blink
+
+#endif  // WebURLLoaderMock_h
diff --git a/third_party/WebKit/Source/platform/testing/weburl_loader_mock_factory_impl.cc b/third_party/WebKit/Source/platform/testing/weburl_loader_mock_factory_impl.cc
new file mode 100644
index 0000000..d71b097b
--- /dev/null
+++ b/third_party/WebKit/Source/platform/testing/weburl_loader_mock_factory_impl.cc
@@ -0,0 +1,169 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "platform/testing/weburl_loader_mock_factory_impl.h"
+
+#include <stdint.h>
+
+#include "base/files/file_util.h"
+#include "base/run_loop.h"
+#include "platform/testing/UnitTestHelpers.h"
+#include "platform/testing/weburl_loader_mock.h"
+#include "public/platform/FilePathConversion.h"
+#include "public/platform/WebString.h"
+#include "public/platform/WebURLError.h"
+#include "public/platform/WebURLRequest.h"
+#include "public/platform/WebURLResponse.h"
+
+namespace blink {
+
+WebPassOwnPtr<WebURLLoaderMockFactory> WebURLLoaderMockFactory::create()
+{
+    return adoptWebPtr(static_cast<WebURLLoaderMockFactory*>(
+        new WebURLLoaderMockFactoryImpl));
+}
+
+WebURLLoaderMockFactoryImpl::WebURLLoaderMockFactoryImpl() {}
+
+WebURLLoaderMockFactoryImpl::~WebURLLoaderMockFactoryImpl() {}
+
+WebURLLoader* WebURLLoaderMockFactoryImpl::createURLLoader(
+    WebURLLoader* default_loader) {
+  DCHECK(default_loader);
+  return new WebURLLoaderMock(this, default_loader);
+}
+
+void WebURLLoaderMockFactoryImpl::registerURL(const WebURL& url,
+                                              const WebURLResponse& response,
+                                              const WebString& file_path) {
+  ResponseInfo response_info;
+  response_info.response = response;
+  if (!file_path.isNull() && !file_path.isEmpty()) {
+    response_info.file_path = blink::WebStringToFilePath(file_path);
+    DCHECK(base::PathExists(response_info.file_path))
+        << response_info.file_path.MaybeAsASCII() << " does not exist.";
+  }
+
+  DCHECK(url_to_reponse_info_.find(url) == url_to_reponse_info_.end());
+  url_to_reponse_info_.set(url, response_info);
+}
+
+
+void WebURLLoaderMockFactoryImpl::registerErrorURL(
+    const WebURL& url,
+    const WebURLResponse& response,
+    const WebURLError& error) {
+  DCHECK(url_to_reponse_info_.find(url) == url_to_reponse_info_.end());
+  registerURL(url, response, WebString());
+  url_to_error_info_.set(url, error);
+}
+
+void WebURLLoaderMockFactoryImpl::unregisterURL(const blink::WebURL& url) {
+  URLToResponseMap::iterator iter = url_to_reponse_info_.find(url);
+  DCHECK(iter != url_to_reponse_info_.end());
+  url_to_reponse_info_.remove(iter);
+
+  URLToErrorMap::iterator error_iter = url_to_error_info_.find(url);
+  if (error_iter != url_to_error_info_.end())
+    url_to_error_info_.remove(error_iter);
+}
+
+void WebURLLoaderMockFactoryImpl::unregisterAllURLs() {
+  url_to_reponse_info_.clear();
+  url_to_error_info_.clear();
+}
+
+void WebURLLoaderMockFactoryImpl::serveAsynchronousRequests() {
+  // Serving a request might trigger more requests, so we cannot iterate on
+  // pending_loaders_ as it might get modified.
+  while (!pending_loaders_.isEmpty()) {
+    LoaderToRequestMap::iterator iter = pending_loaders_.begin();
+    WeakPtr<WebURLLoaderMock> loader(iter->key->GetWeakPtr());
+    const WebURLRequest request = iter->value;
+    pending_loaders_.remove(loader.get());
+
+    WebURLResponse response;
+    WebURLError error;
+    WebData data;
+    LoadRequest(request, &response, &error, &data);
+    // Follow any redirects while the loader is still active.
+    while (response.httpStatusCode() >= 300 &&
+           response.httpStatusCode() < 400) {
+      WebURLRequest newRequest = loader->ServeRedirect(request, response);
+      if (!loader || loader->is_cancelled() || loader->is_deferred())
+        break;
+      LoadRequest(newRequest, &response, &error, &data);
+    }
+    // Serve the request if the loader is still active.
+    if (loader && !loader->is_cancelled() && !loader->is_deferred())
+      loader->ServeAsynchronousRequest(delegate_, response, data, error);
+  }
+  base::RunLoop().RunUntilIdle();
+}
+
+bool WebURLLoaderMockFactoryImpl::IsMockedURL(const blink::WebURL& url) {
+  return url_to_reponse_info_.find(url) != url_to_reponse_info_.end();
+}
+
+void WebURLLoaderMockFactoryImpl::CancelLoad(WebURLLoaderMock* loader) {
+  pending_loaders_.remove(loader);
+}
+
+void WebURLLoaderMockFactoryImpl::LoadSynchronously(
+    const WebURLRequest& request,
+    WebURLResponse* response,
+    WebURLError* error,
+    WebData* data) {
+  LoadRequest(request, response, error, data);
+}
+
+void WebURLLoaderMockFactoryImpl::LoadAsynchronouly(
+    const WebURLRequest& request,
+    WebURLLoaderMock* loader) {
+  DCHECK(!pending_loaders_.contains(loader));
+  pending_loaders_.set(loader, request);
+}
+
+void WebURLLoaderMockFactoryImpl::LoadRequest(const WebURLRequest& request,
+                                              WebURLResponse* response,
+                                              WebURLError* error,
+                                              WebData* data) {
+  URLToErrorMap::const_iterator error_iter =
+      url_to_error_info_.find(request.url());
+  if (error_iter != url_to_error_info_.end())
+    *error = error_iter->value;
+
+  URLToResponseMap::const_iterator iter =
+      url_to_reponse_info_.find(request.url());
+  if (iter == url_to_reponse_info_.end()) {
+    // Non mocked URLs should not have been passed to the default URLLoader.
+    NOTREACHED();
+    return;
+  }
+
+  if (!error->reason && !ReadFile(iter->value.file_path, data)) {
+    NOTREACHED();
+    return;
+  }
+
+  *response = iter->value.response;
+}
+
+// static
+bool WebURLLoaderMockFactoryImpl::ReadFile(const base::FilePath& file_path,
+                                           WebData* data) {
+  // If the path is empty then we return an empty file so tests can simulate
+  // requests without needing to actually load files.
+  if (file_path.empty())
+    return true;
+
+  std::string buffer;
+  if (!base::ReadFileToString(file_path, &buffer))
+    return false;
+
+  data->assign(buffer.data(), buffer.size());
+  return true;
+}
+
+} // namespace blink
diff --git a/third_party/WebKit/Source/platform/testing/weburl_loader_mock_factory_impl.h b/third_party/WebKit/Source/platform/testing/weburl_loader_mock_factory_impl.h
new file mode 100644
index 0000000..e783488
--- /dev/null
+++ b/third_party/WebKit/Source/platform/testing/weburl_loader_mock_factory_impl.h
@@ -0,0 +1,107 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef WebURLLoaderMockFactoryImpl_h
+#define WebURLLoaderMockFactoryImpl_h
+
+#include <map>
+
+#include "base/files/file_path.h"
+#include "base/macros.h"
+#include "platform/weborigin/KURL.h"
+#include "platform/weborigin/KURLHash.h"
+#include "public/platform/WebURL.h"
+#include "public/platform/WebURLError.h"
+#include "public/platform/WebURLLoaderMockFactory.h"
+#include "public/platform/WebURLRequest.h"
+#include "public/platform/WebURLResponse.h"
+#include "wtf/HashMap.h"
+#include "wtf/WeakPtr.h"
+
+namespace blink {
+
+class WebData;
+class WebURLLoader;
+class WebURLLoaderMock;
+class WebURLLoaderTestDelegate;
+
+// A factory that creates WebURLLoaderMock to simulate resource loading in
+// tests.
+// You register files for specific URLs, the content of the file is then served
+// when these URLs are loaded.
+// In order to serve the asynchronous requests, you need to invoke
+// ServeAsynchronousRequest.
+class WebURLLoaderMockFactoryImpl : public WebURLLoaderMockFactory {
+ public:
+  WebURLLoaderMockFactoryImpl();
+  virtual ~WebURLLoaderMockFactoryImpl();
+
+  // WebURLLoaderMockFactory:
+  virtual WebURLLoader* createURLLoader(WebURLLoader* default_loader) override;
+  void registerURL(const WebURL& url,
+                   const WebURLResponse& response,
+                   const WebString& filePath = WebString()) override;
+  void registerErrorURL(const WebURL& url,
+                        const WebURLResponse& response,
+                        const WebURLError& error) override;
+  void unregisterURL(const WebURL& url) override;
+  void unregisterAllURLs() override;
+  void serveAsynchronousRequests() override;
+  void setLoaderDelegate(WebURLLoaderTestDelegate* delegate) override {
+    delegate_ = delegate;
+  }
+
+  // Returns true if |url| was registered for being mocked.
+  bool IsMockedURL(const WebURL& url);
+
+  // Called by the loader to load a resource.
+  void LoadSynchronously(const WebURLRequest& request,
+                         WebURLResponse* response,
+                         WebURLError* error,
+                         WebData* data);
+  void LoadAsynchronouly(const WebURLRequest& request,
+                         WebURLLoaderMock* loader);
+
+  // Removes the loader from the list of pending loaders.
+  void CancelLoad(WebURLLoaderMock* loader);
+
+ private:
+  struct ResponseInfo {
+    WebURLResponse response;
+    base::FilePath file_path;
+  };
+
+  // Loads the specified request and populates the response, error and data
+  // accordingly.
+  void LoadRequest(const WebURLRequest& request,
+                   WebURLResponse* response,
+                   WebURLError* error,
+                   WebData* data);
+
+  // Checks if the loader is pending. Otherwise, it may have been deleted.
+  bool IsPending(WeakPtr<WebURLLoaderMock> loader);
+
+  // Reads |m_filePath| and puts its content in |data|.
+  // Returns true if it successfully read the file.
+  static bool ReadFile(const base::FilePath& file_path, WebData* data);
+
+  WebURLLoaderTestDelegate* delegate_ = nullptr;
+
+  // The loaders that have not being served data yet.
+  using LoaderToRequestMap = HashMap<WebURLLoaderMock*, WebURLRequest>;
+  LoaderToRequestMap pending_loaders_;
+
+  typedef HashMap<KURL, WebURLError> URLToErrorMap;
+  URLToErrorMap url_to_error_info_;
+
+  // Table of the registered URLs and the responses that they should receive.
+  using URLToResponseMap = HashMap<KURL, ResponseInfo>;
+  URLToResponseMap url_to_reponse_info_;
+
+  DISALLOW_COPY_AND_ASSIGN(WebURLLoaderMockFactoryImpl);
+};
+
+} // namespace blink
+
+#endif  // WebURLLoaderMockFactoryImpl_h
diff --git a/third_party/WebKit/Source/platform/text/TextCheckerClient.h b/third_party/WebKit/Source/platform/text/TextCheckerClient.h
index 8bcec6655..bb9761a 100644
--- a/third_party/WebKit/Source/platform/text/TextCheckerClient.h
+++ b/third_party/WebKit/Source/platform/text/TextCheckerClient.h
@@ -43,7 +43,7 @@
 
     virtual void checkSpellingOfString(const String&, int* misspellingLocation, int* misspellingLength) = 0;
     virtual void checkGrammarOfString(const String&, Vector<GrammarDetail>&, int* badGrammarLocation, int* badGrammarLength) = 0;
-    virtual void requestCheckingOfString(RawPtr<TextCheckingRequest>) = 0;
+    virtual void requestCheckingOfString(TextCheckingRequest*) = 0;
 };
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/platform/transforms/Rotation.cpp b/third_party/WebKit/Source/platform/transforms/Rotation.cpp
index 9bb4dd9..9785410 100644
--- a/third_party/WebKit/Source/platform/transforms/Rotation.cpp
+++ b/third_party/WebKit/Source/platform/transforms/Rotation.cpp
@@ -108,4 +108,18 @@
     return extractFromMatrix(toMatrix, progress < 0.5 ? from : to);
 }
 
+Rotation Rotation::add(const Rotation& a, const Rotation& b)
+{
+    double angleA;
+    double angleB;
+    FloatPoint3D axis;
+    if (getCommonAxis(a, b, axis, angleA, angleB))
+        return Rotation(axis, angleA + angleB);
+
+    TransformationMatrix matrix;
+    matrix.rotate3d(a);
+    matrix.rotate3d(b);
+    return extractFromMatrix(matrix, b);
+}
+
 } // namespace blink
diff --git a/third_party/WebKit/Source/platform/transforms/Rotation.h b/third_party/WebKit/Source/platform/transforms/Rotation.h
index 6fc4dad..2124eed5 100644
--- a/third_party/WebKit/Source/platform/transforms/Rotation.h
+++ b/third_party/WebKit/Source/platform/transforms/Rotation.h
@@ -28,6 +28,9 @@
     // A progress of 0 corresponds to "from" and a progress of 1 corresponds to "to".
     static Rotation slerp(const Rotation& from, const Rotation& to, double progress);
 
+    // Returns a rotation whose effect is equivalent to applying a followed by b.
+    static Rotation add(const Rotation& /*a*/, const Rotation& /*b*/);
+
     // No restrictions on the axis vector.
     FloatPoint3D axis;
 
diff --git a/third_party/WebKit/Source/platform/v8_inspector/InjectedScript.cpp b/third_party/WebKit/Source/platform/v8_inspector/InjectedScript.cpp
index 61e1c4a..f5095fea 100644
--- a/third_party/WebKit/Source/platform/v8_inspector/InjectedScript.cpp
+++ b/third_party/WebKit/Source/platform/v8_inspector/InjectedScript.cpp
@@ -224,7 +224,7 @@
     function.appendArgument(generatePreview);
     bool hadException = false;
     v8::Local<v8::Value> r = callFunctionWithEvalEnabled(function, hadException);
-    if (hasInternalError(errorString, hadException))
+    if (hasInternalError(errorString, hadException || r.IsEmpty()))
         return v8::MaybeLocal<v8::Value>();
     return r;
 }
diff --git a/third_party/WebKit/Source/web/AssociatedURLLoaderTest.cpp b/third_party/WebKit/Source/web/AssociatedURLLoaderTest.cpp
index c47e789..f178fb7 100644
--- a/third_party/WebKit/Source/web/AssociatedURLLoaderTest.cpp
+++ b/third_party/WebKit/Source/web/AssociatedURLLoaderTest.cpp
@@ -474,7 +474,7 @@
 {
     KURL url = toKURL("http://www.test.com/RedirectCrossOriginFailure.html");
     char redirect[] = "http://www.other.com/RedirectCrossOriginFailure.html";  // Cross-origin
-    KURL redirectURL;
+    KURL redirectURL = toKURL(redirect);
 
     WebURLRequest request;
     request.initialize();
diff --git a/third_party/WebKit/Source/web/SpellCheckerClientImpl.cpp b/third_party/WebKit/Source/web/SpellCheckerClientImpl.cpp
index 25d322f..08d03ab 100644
--- a/third_party/WebKit/Source/web/SpellCheckerClientImpl.cpp
+++ b/third_party/WebKit/Source/web/SpellCheckerClientImpl.cpp
@@ -137,14 +137,14 @@
         *misspellingLength = spellLength;
 }
 
-void SpellCheckerClientImpl::requestCheckingOfString(RawPtr<TextCheckingRequest> request)
+void SpellCheckerClientImpl::requestCheckingOfString(TextCheckingRequest* request)
 {
-    if (m_webView->spellCheckClient()) {
-        const String& text = request->data().text();
-        const Vector<uint32_t>& markers = request->data().markers();
-        const Vector<unsigned>& markerOffsets = request->data().offsets();
-        m_webView->spellCheckClient()->requestCheckingOfText(text, markers, markerOffsets, new WebTextCheckingCompletionImpl(request));
-    }
+    if (!m_webView->spellCheckClient())
+        return;
+    const String& text = request->data().text();
+    const Vector<uint32_t>& markers = request->data().markers();
+    const Vector<unsigned>& markerOffsets = request->data().offsets();
+    m_webView->spellCheckClient()->requestCheckingOfText(text, markers, markerOffsets, new WebTextCheckingCompletionImpl(request));
 }
 
 void SpellCheckerClientImpl::checkGrammarOfString(const String& text, WTF::Vector<GrammarDetail>& details, int* badGrammarLocation, int* badGrammarLength)
diff --git a/third_party/WebKit/Source/web/SpellCheckerClientImpl.h b/third_party/WebKit/Source/web/SpellCheckerClientImpl.h
index 81e47191..307635e 100644
--- a/third_party/WebKit/Source/web/SpellCheckerClientImpl.h
+++ b/third_party/WebKit/Source/web/SpellCheckerClientImpl.h
@@ -53,7 +53,7 @@
     void updateSpellingUIWithMisspelledWord(const String&) override;
     void showSpellingUI(bool show) override;
     bool spellingUIIsShowing() override;
-    void requestCheckingOfString(RawPtr<TextCheckingRequest>) override;
+    void requestCheckingOfString(TextCheckingRequest*) override;
 
     TextCheckerClient& textChecker() override { return *this; }
 
diff --git a/third_party/WebKit/Source/web/TextFinder.cpp b/third_party/WebKit/Source/web/TextFinder.cpp
index 0443f93..d1bb76c 100644
--- a/third_party/WebKit/Source/web/TextFinder.cpp
+++ b/third_party/WebKit/Source/web/TextFinder.cpp
@@ -811,14 +811,12 @@
 
 DEFINE_TRACE(TextFinder)
 {
-#if ENABLE(OILPAN)
     visitor->trace(m_ownerFrame);
     visitor->trace(m_currentActiveMatchFrame);
     visitor->trace(m_activeMatch);
     visitor->trace(m_resumeScopingFromRange);
     visitor->trace(m_deferredScopingWork);
     visitor->trace(m_findMatchesCache);
-#endif
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/web/WebBindings.cpp b/third_party/WebKit/Source/web/WebBindings.cpp
deleted file mode 100644
index 35d7268f8..0000000
--- a/third_party/WebKit/Source/web/WebBindings.cpp
+++ /dev/null
@@ -1,136 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "public/web/WebBindings.h"
-
-namespace blink {
-
-bool WebBindings::construct(NPP npp, NPObject* object, const NPVariant* args, uint32_t argCount, NPVariant* result)
-{
-    return false;
-}
-
-NPObject* WebBindings::createObject(NPP npp, NPClass* npClass)
-{
-    return nullptr;
-}
-
-bool WebBindings::enumerate(NPP npp, NPObject* object, NPIdentifier** identifier, uint32_t* identifierCount)
-{
-    return false;
-}
-
-bool WebBindings::evaluate(NPP npp, NPObject* object, NPString* script, NPVariant* result)
-{
-    return false;
-}
-
-NPIdentifier WebBindings::getIntIdentifier(int32_t number)
-{
-    return nullptr;
-}
-
-bool WebBindings::getProperty(NPP npp, NPObject* object, NPIdentifier property, NPVariant* result)
-{
-    return false;
-}
-
-NPIdentifier WebBindings::getStringIdentifier(const NPUTF8* string)
-{
-    return nullptr;
-}
-
-void WebBindings::getStringIdentifiers(const NPUTF8** names, int32_t nameCount, NPIdentifier* identifiers)
-{
-}
-
-bool WebBindings::hasMethod(NPP npp, NPObject* object, NPIdentifier method)
-{
-    return false;
-}
-
-bool WebBindings::hasProperty(NPP npp, NPObject* object, NPIdentifier property)
-{
-    return false;
-}
-
-bool WebBindings::identifierIsString(NPIdentifier identifier)
-{
-    return false;
-}
-
-int32_t WebBindings::intFromIdentifier(NPIdentifier identifier)
-{
-    return 0;
-}
-
-bool WebBindings::invoke(NPP npp, NPObject* object, NPIdentifier method, const NPVariant* args, uint32_t argCount, NPVariant* result)
-{
-    return false;
-}
-
-bool WebBindings::invokeDefault(NPP npp, NPObject* object, const NPVariant* args, uint32_t argCount, NPVariant* result)
-{
-    return false;
-}
-
-void WebBindings::releaseObject(NPObject* object)
-{
-}
-
-void WebBindings::releaseVariantValue(NPVariant* variant)
-{
-}
-
-bool WebBindings::removeProperty(NPP npp, NPObject* object, NPIdentifier identifier)
-{
-    return false;
-}
-
-NPObject* WebBindings::retainObject(NPObject* object)
-{
-    return nullptr;
-}
-
-void WebBindings::setException(NPObject* object, const NPUTF8* message)
-{
-}
-
-bool WebBindings::setProperty(NPP npp, NPObject* object, NPIdentifier identifier, const NPVariant* value)
-{
-    return false;
-}
-
-NPUTF8* WebBindings::utf8FromIdentifier(NPIdentifier identifier)
-{
-    return nullptr;
-}
-
-} // namespace blink
diff --git a/third_party/WebKit/Source/web/web.gyp b/third_party/WebKit/Source/web/web.gyp
index add62a7..a16f53c 100644
--- a/third_party/WebKit/Source/web/web.gyp
+++ b/third_party/WebKit/Source/web/web.gyp
@@ -62,14 +62,12 @@
                 '<(DEPTH)/skia/skia.gyp:skia',
                 '<(angle_path)/src/angle.gyp:translator',
                 '<(DEPTH)/third_party/icu/icu.gyp:icuuc',
-                '<(DEPTH)/third_party/npapi/npapi.gyp:npapi',
                 '<(DEPTH)/ui/gfx/gfx.gyp:gfx_geometry',
                 '<(DEPTH)/v8/tools/gyp/v8.gyp:v8',
             ],
             'export_dependent_settings': [
                 '<(DEPTH)/skia/skia.gyp:skia',
                 '<(DEPTH)/third_party/icu/icu.gyp:icuuc',
-                '<(DEPTH)/third_party/npapi/npapi.gyp:npapi',
                 '<(DEPTH)/v8/tools/gyp/v8.gyp:v8',
             ],
             'include_dirs': [
diff --git a/third_party/WebKit/Source/web/web.gypi b/third_party/WebKit/Source/web/web.gypi
index 86f8049..706502bd 100644
--- a/third_party/WebKit/Source/web/web.gypi
+++ b/third_party/WebKit/Source/web/web.gypi
@@ -108,7 +108,6 @@
       'WebArrayBuffer.cpp',
       'WebArrayBufferConverter.cpp',
       'WebArrayBufferView.cpp',
-      'WebBindings.cpp',
       'WebBlob.cpp',
       'WebCache.cpp',
       'WebColorSuggestion.cpp',
diff --git a/third_party/WebKit/Source/wtf/UniquePtrTransitionGuide.md b/third_party/WebKit/Source/wtf/UniquePtrTransitionGuide.md
index d4bb66f..2b1651c 100644
--- a/third_party/WebKit/Source/wtf/UniquePtrTransitionGuide.md
+++ b/third_party/WebKit/Source/wtf/UniquePtrTransitionGuide.md
@@ -33,8 +33,8 @@
     owned->useThis();
     T& reference = *owned;
     T* pointer = owned.get();
-    owned.reset();      // Or: owned = std::unique_ptr<T>()
-    owned.reset(new T); // Or: owned = std::unique_ptr<T>(...)
+    owned.reset();      // Or: owned = nullptr
+    owned.reset(new T); // Or: owned = std::unique_ptr<T>(new T)
     T* leakedPointer = owned.release();
 }
 ```
diff --git a/third_party/WebKit/public/BUILD.gn b/third_party/WebKit/public/BUILD.gn
index 2a34296..adcf3dd8 100644
--- a/third_party/WebKit/public/BUILD.gn
+++ b/third_party/WebKit/public/BUILD.gn
@@ -54,7 +54,9 @@
 
 # GYP version: WebKit/public/blink.gyp:blink_test_support
 group("test_support") {
+  testonly = true
   public_deps = [
+    "//third_party/WebKit/Source/platform:test_support",
     "//third_party/WebKit/Source/web:test_support",
   ]
 }
@@ -125,9 +127,6 @@
 
     # Blink exposes icu headers in the public API.
     "//third_party/icu:icu_config",
-
-    # Blink exposes NPAPI headers in the public API.
-    "//third_party/npapi:npapi_config",
   ]
   sources = blink_headers_values.blink_public_sources
 }
diff --git a/third_party/WebKit/public/blink.gyp b/third_party/WebKit/public/blink.gyp
index 82ddef9..8a430d7f 100644
--- a/third_party/WebKit/public/blink.gyp
+++ b/third_party/WebKit/public/blink.gyp
@@ -85,9 +85,11 @@
             'target_name': 'blink_test_support',
             'type': 'none',
             'dependencies': [
+                '../Source/platform/blink_platform_tests.gyp:blink_platform_test_support',
                 '../Source/web/web.gyp:blink_web_test_support',
             ],
             'export_dependent_settings': [
+                '../Source/platform/blink_platform_tests.gyp:blink_platform_test_support',
                 '../Source/web/web.gyp:blink_web_test_support',
             ],
         },
diff --git a/third_party/WebKit/public/blink_headers.gypi b/third_party/WebKit/public/blink_headers.gypi
index d1252dc..a33b550 100644
--- a/third_party/WebKit/public/blink_headers.gypi
+++ b/third_party/WebKit/public/blink_headers.gypi
@@ -331,7 +331,6 @@
       "web/WebArrayBufferConverter.h",
       "web/WebArrayBufferView.h",
       "web/WebAutofillClient.h",
-      "web/WebBindings.h",
       "web/WebBlob.h",
       "web/WebCSSParser.h",
       "web/WebCache.h",
diff --git a/third_party/WebKit/public/platform/WebURLLoaderMockFactory.h b/third_party/WebKit/public/platform/WebURLLoaderMockFactory.h
new file mode 100644
index 0000000..a2e6c955
--- /dev/null
+++ b/third_party/WebKit/public/platform/WebURLLoaderMockFactory.h
@@ -0,0 +1,57 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef WebURLLoaderMockFactory_h
+#define WebURLLoaderMockFactory_h
+
+#include "public/platform/WebCommon.h"
+#include "public/platform/WebData.h"
+#include "public/platform/WebPassOwnPtr.h"
+#include "public/platform/WebString.h"
+#include "public/platform/WebURLLoaderTestDelegate.h"
+
+namespace blink {
+
+class WebURL;
+class WebURLResponse;
+struct WebURLError;
+
+class WebURLLoaderMockFactory {
+public:
+    static WebPassOwnPtr<WebURLLoaderMockFactory> create();
+
+    virtual ~WebURLLoaderMockFactory() {}
+
+    // Create a WebURLLoader that takes care of mocked requests.
+    // Non-mocked request are forwarded to given loader which should not
+    // be nullptr.
+    virtual WebURLLoader* createURLLoader(WebURLLoader*) = 0;
+
+    // Registers a response and the file to be served when the specified URL
+    // is loaded. If no file is specified then the response content will be empty.
+    virtual void registerURL(const WebURL&, const WebURLResponse&, const WebString& filePath) = 0;
+
+    // Registers an error to be served when the specified URL is requested.
+    virtual void registerErrorURL(const WebURL&, const WebURLResponse&, const WebURLError&) = 0;
+
+    // Unregisters URLs so they are no longer mocked.
+    virtual void unregisterURL(const WebURL&) = 0;
+    virtual void unregisterAllURLs() = 0;
+
+    // Causes all pending asynchronous requests to be served. When this method
+    // returns all the pending requests have been processed.
+    // Note: this may not work as expected if more requests could be made
+    // asynchronously from different threads (e.g. when HTML parser thread
+    // is being involved).
+    // DO NOT USE THIS for Frame loading; always use methods defined in
+    // FrameTestHelpers instead.
+    virtual void serveAsynchronousRequests() = 0;
+
+    // Set a delegate that allows callbacks for all WebURLLoaderClients to be intercepted.
+    virtual void setLoaderDelegate(WebURLLoaderTestDelegate*) = 0;
+};
+
+} // namespace blink
+
+#endif // WebURLLoaderMockFactory_h
diff --git a/third_party/WebKit/public/platform/WebUnitTestSupport.h b/third_party/WebKit/public/platform/WebUnitTestSupport.h
index 0ae4b0e..9be7da9 100644
--- a/third_party/WebKit/public/platform/WebUnitTestSupport.h
+++ b/third_party/WebKit/public/platform/WebUnitTestSupport.h
@@ -38,6 +38,7 @@
 class WebURLResponse;
 struct WebURLError;
 
+// TODO(kinuko): Deprecate this.
 class WebUnitTestSupport {
 public:
     virtual void registerMockedURL(const WebURL&, const WebURLResponse&, const WebString& filePath) { }
diff --git a/third_party/WebKit/public/web/WebBindings.h b/third_party/WebKit/public/web/WebBindings.h
deleted file mode 100644
index 604385c..0000000
--- a/third_party/WebKit/public/web/WebBindings.h
+++ /dev/null
@@ -1,111 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef WebBindings_h
-#define WebBindings_h
-
-#include "../platform/WebCommon.h"
-#include <bindings/npruntime.h>
-
-namespace blink {
-
-// A haphazard collection of functions for dealing with plugins.
-class WebBindings {
-public:
-    // NPN Functions ------------------------------------------------------
-    // These are all defined in npruntime.h and are well documented.
-
-    // NPN_Construct
-    BLINK_EXPORT static bool construct(NPP, NPObject*, const NPVariant* args, uint32_t argCount, NPVariant* result);
-
-    // NPN_CreateObject
-    BLINK_EXPORT static NPObject* createObject(NPP, NPClass*);
-
-    // NPN_Enumerate
-    BLINK_EXPORT static bool enumerate(NPP, NPObject*, NPIdentifier**, uint32_t* identifierCount);
-
-    // NPN_Evaluate
-    BLINK_EXPORT static bool evaluate(NPP, NPObject*, NPString* script, NPVariant* result);
-
-    // NPN_GetIntIdentifier
-    BLINK_EXPORT static NPIdentifier getIntIdentifier(int32_t number);
-
-    // NPN_GetProperty
-    BLINK_EXPORT static bool getProperty(NPP, NPObject*, NPIdentifier property, NPVariant *result);
-
-    // NPN_GetStringIdentifier
-    BLINK_EXPORT static NPIdentifier getStringIdentifier(const NPUTF8* string);
-
-    // NPN_GetStringIdentifiers
-    BLINK_EXPORT static void getStringIdentifiers(const NPUTF8** names, int32_t nameCount, NPIdentifier*);
-
-    // NPN_HasMethod
-    BLINK_EXPORT static bool hasMethod(NPP, NPObject*, NPIdentifier method);
-
-    // NPN_HasProperty
-    BLINK_EXPORT static bool hasProperty(NPP, NPObject*, NPIdentifier property);
-
-    // NPN_IdentifierIsString
-    BLINK_EXPORT static bool identifierIsString(NPIdentifier);
-
-    // NPN_IntFromIdentifier
-    BLINK_EXPORT static int32_t intFromIdentifier(NPIdentifier);
-
-    // NPN_Invoke
-    BLINK_EXPORT static bool invoke(NPP, NPObject*, NPIdentifier method, const NPVariant* args, uint32_t argCount, NPVariant* result);
-
-    // NPN_InvokeDefault
-    BLINK_EXPORT static bool invokeDefault(NPP, NPObject*, const NPVariant* args, uint32_t argCount, NPVariant* result);
-
-    // NPN_ReleaseObject
-    BLINK_EXPORT static void releaseObject(NPObject*);
-
-    // NPN_ReleaseVariantValue
-    BLINK_EXPORT static void releaseVariantValue(NPVariant*);
-
-    // NPN_RemoveProperty
-    BLINK_EXPORT static bool removeProperty(NPP, NPObject*, NPIdentifier);
-
-    // NPN_RetainObject
-    BLINK_EXPORT static NPObject* retainObject(NPObject*);
-
-    // NPN_SetException
-    BLINK_EXPORT static void setException(NPObject*, const NPUTF8* message);
-
-    // NPN_SetProperty
-    BLINK_EXPORT static bool setProperty(NPP, NPObject*, NPIdentifier, const NPVariant*);
-
-    // NPN_UTF8FromIdentifier
-    BLINK_EXPORT static NPUTF8* utf8FromIdentifier(NPIdentifier);
-};
-
-} // namespace blink
-
-#endif
diff --git a/third_party/closure_compiler/interfaces/compiled_resources2.gyp b/third_party/closure_compiler/interfaces/compiled_resources2.gyp
index f02ee87e2..e4f5fcb 100644
--- a/third_party/closure_compiler/interfaces/compiled_resources2.gyp
+++ b/third_party/closure_compiler/interfaces/compiled_resources2.gyp
@@ -17,6 +17,10 @@
       'includes': ['../include_js.gypi'],
     },
     {
+      'target_name': 'language_settings_private_interface',
+      'includes': ['../include_js.gypi'],
+    },
+    {
       'target_name': 'networking_private_interface',
       'includes': ['../include_js.gypi'],
     },
diff --git a/third_party/closure_compiler/interfaces/language_settings_private_interface.js b/third_party/closure_compiler/interfaces/language_settings_private_interface.js
new file mode 100644
index 0000000..9a82ae0
--- /dev/null
+++ b/third_party/closure_compiler/interfaces/language_settings_private_interface.js
@@ -0,0 +1,122 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This file was generated by:
+//   ./tools/json_schema_compiler/compiler.py.
+
+/** @fileoverview Interface for languageSettingsPrivate that can be overriden. */
+
+assertNotReached('Interface file for Closure Compiler should not be executed.');
+
+/** @interface */
+function LanguageSettingsPrivate() {}
+
+LanguageSettingsPrivate.prototype = {
+  /**
+   * Gets languages available for translate, spell checking, input and locale.
+   * @param {function(!Array<!chrome.languageSettingsPrivate.Language>):void}
+   *     callback
+   * @see https://developer.chrome.com/extensions/languageSettingsPrivate#method-getLanguageList
+   */
+  getLanguageList: assertNotReached,
+
+  /**
+   * Sets the accepted languages, used to decide which languages to translate,
+   * generate the Accept-Language header, etc.
+   * @param {!Array<string>} languageCodes
+   * @see https://developer.chrome.com/extensions/languageSettingsPrivate#method-setLanguageList
+   */
+  setLanguageList: assertNotReached,
+
+  /**
+   * Gets the current status of the chosen spell check dictionaries.
+   * @param {function(!Array<!chrome.languageSettingsPrivate.SpellcheckDictionaryStatus>):void}
+   *     callback
+   * @see https://developer.chrome.com/extensions/languageSettingsPrivate#method-getSpellcheckDictionaryStatuses
+   */
+  getSpellcheckDictionaryStatuses: assertNotReached,
+
+  /**
+   * Gets the custom spell check words, in sorted order.
+   * @param {function(!Array<string>):void} callback
+   * @see https://developer.chrome.com/extensions/languageSettingsPrivate#method-getSpellcheckWords
+   */
+  getSpellcheckWords: assertNotReached,
+
+  /**
+   * Adds a word to the custom dictionary.
+   * @param {string} word
+   * @see https://developer.chrome.com/extensions/languageSettingsPrivate#method-addSpellcheckWord
+   */
+  addSpellcheckWord: assertNotReached,
+
+  /**
+   * Removes a word from the custom dictionary.
+   * @param {string} word
+   * @see https://developer.chrome.com/extensions/languageSettingsPrivate#method-removeSpellcheckWord
+   */
+  removeSpellcheckWord: assertNotReached,
+
+  /**
+   * Gets the translate target language (in most cases, the display locale).
+   * @param {function(string):void} callback
+   * @see https://developer.chrome.com/extensions/languageSettingsPrivate#method-getTranslateTargetLanguage
+   */
+  getTranslateTargetLanguage: assertNotReached,
+
+  /**
+   * Gets all supported input methods, including third-party IMEs. Chrome OS
+   * only.
+   * @param {function(!chrome.languageSettingsPrivate.InputMethodLists):void}
+   *     callback
+   * @see https://developer.chrome.com/extensions/languageSettingsPrivate#method-getInputMethodLists
+   */
+  getInputMethodLists: assertNotReached,
+
+  /**
+   * Adds the input method to the current user's list of enabled input methods,
+   * enabling the input method for the current user. Chrome OS only.
+   * @param {string} inputMethodId
+   * @see https://developer.chrome.com/extensions/languageSettingsPrivate#method-addInputMethod
+   */
+  addInputMethod: assertNotReached,
+
+  /**
+   * Removes the input method from the current user's list of enabled input
+   * methods, disabling the input method for the current user. Chrome OS only.
+   * @param {string} inputMethodId
+   * @see https://developer.chrome.com/extensions/languageSettingsPrivate#method-removeInputMethod
+   */
+  removeInputMethod: assertNotReached,
+};
+
+/**
+ * Called when the pref for the dictionaries used for spell checking changes or
+ * the status of one of the spell check dictionaries changes.
+ * @type {!ChromeEvent}
+ * @see https://developer.chrome.com/extensions/languageSettingsPrivate#event-onSpellcheckDictionariesChanged
+ */
+LanguageSettingsPrivate.prototype.onSpellcheckDictionariesChanged;
+
+/**
+ * Called when words are added to and/or removed from the custom spell check
+ * dictionary.
+ * @type {!ChromeEvent}
+ * @see https://developer.chrome.com/extensions/languageSettingsPrivate#event-onCustomDictionaryChanged
+ */
+LanguageSettingsPrivate.prototype.onCustomDictionaryChanged;
+
+/**
+ * Called when an input method is added.
+ * @type {!ChromeEvent}
+ * @see https://developer.chrome.com/extensions/languageSettingsPrivate#event-onInputMethodAdded
+ */
+LanguageSettingsPrivate.prototype.onInputMethodAdded;
+
+/**
+ * Called when an input method is removed.
+ * @type {!ChromeEvent}
+ * @see https://developer.chrome.com/extensions/languageSettingsPrivate#event-onInputMethodRemoved
+ */
+LanguageSettingsPrivate.prototype.onInputMethodRemoved;
diff --git a/third_party/mozilla/BUILD.gn b/third_party/mozilla/BUILD.gn
index b815009..af465a91 100644
--- a/third_party/mozilla/BUILD.gn
+++ b/third_party/mozilla/BUILD.gn
@@ -4,8 +4,6 @@
 
 component("mozilla") {
   sources = [
-    "ComplexTextInputPanel.h",
-    "ComplexTextInputPanel.mm",
     "MozillaExport.h",
     "NSPasteboard+Utils.h",
     "NSPasteboard+Utils.mm",
diff --git a/third_party/mozilla/ComplexTextInputPanel.h b/third_party/mozilla/ComplexTextInputPanel.h
deleted file mode 100644
index 314a4b93..0000000
--- a/third_party/mozilla/ComplexTextInputPanel.h
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- * Modified by Josh Aas of Mozilla Corporation.
- */
-
-#ifndef ComplexTextInputPanel_h_
-#define ComplexTextInputPanel_h_
-
-#import <Cocoa/Cocoa.h>
-
-#include "MozillaExport.h"
-
-#if MAC_OS_X_VERSION_MAX_ALLOWED <= MAC_OS_X_VERSION_10_5
-@class NSTextInputContext;
-#endif
-
-MOZILLA_EXPORT @interface ComplexTextInputPanel : NSPanel {
-  NSTextView *mInputTextView;
-}
-
-+ (ComplexTextInputPanel*)sharedComplexTextInputPanel;
-
-- (NSTextInputContext*)inputContext;
-- (BOOL)interpretKeyEvent:(NSEvent*)event string:(NSString**)string;
-- (void)cancelComposition;
-- (BOOL)inComposition;
-
-@end
-
-#endif // ComplexTextInputPanel_h_
diff --git a/third_party/mozilla/ComplexTextInputPanel.mm b/third_party/mozilla/ComplexTextInputPanel.mm
deleted file mode 100644
index 0eb49e2..0000000
--- a/third_party/mozilla/ComplexTextInputPanel.mm
+++ /dev/null
@@ -1,147 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- *
- * Modified by Josh Aas of Mozilla Corporation.
- */
-
-#import "ComplexTextInputPanel.h"
-
-#if MAC_OS_X_VERSION_MAX_ALLOWED <= MAC_OS_X_VERSION_10_5
-@interface NSView (SnowLeopardMethods)
-- (NSTextInputContext *)inputContext;
-@end
-
-// This is actually an NSTextInputContext method, but we can't declare
-// that since the whole class is 10.6+.
-@interface NSObject (SnowLeopardMethods)
-- (BOOL)handleEvent:(NSEvent *)theEvent;
-@end
-
-static NSString* const NSTextInputContextKeyboardSelectionDidChangeNotification =
-    @"NSTextInputContextKeyboardSelectionDidChangeNotification";
-#endif
-
-#define kInputWindowHeight 20
-
-@implementation ComplexTextInputPanel
-
-+ (ComplexTextInputPanel*)sharedComplexTextInputPanel
-{
-  static ComplexTextInputPanel *sComplexTextInputPanel;
-  if (!sComplexTextInputPanel)
-    sComplexTextInputPanel = [[ComplexTextInputPanel alloc] init];
-  return sComplexTextInputPanel;
-}
-
-- (id)init
-{
-  // In the original Apple code the style mask is given by a function which is not open source.
-  // What could possibly be worth hiding in that function, I do not know.
-  // Courtesy of gdb: stylemask: 011000011111, 0x61f
-  self = [super initWithContentRect:NSZeroRect styleMask:0x61f backing:NSBackingStoreBuffered defer:YES];
-  if (!self)
-    return nil;
-
-  // Set the frame size.
-  NSRect visibleFrame = [[NSScreen mainScreen] visibleFrame];
-  NSRect frame = NSMakeRect(visibleFrame.origin.x, visibleFrame.origin.y, visibleFrame.size.width, kInputWindowHeight);
-
-  [self setFrame:frame display:NO];
-
-  mInputTextView = [[NSTextView alloc] initWithFrame:[self.contentView frame]];        
-  mInputTextView.autoresizingMask = NSViewWidthSizable | NSViewHeightSizable | NSViewMaxXMargin | NSViewMinXMargin | NSViewMaxYMargin | NSViewMinYMargin;
-
-  NSScrollView* scrollView = [[NSScrollView alloc] initWithFrame:[self.contentView frame]];
-  scrollView.documentView = mInputTextView;
-  self.contentView = scrollView;
-  [scrollView release];
-
-  [self setFloatingPanel:YES];
-
-  [[NSNotificationCenter defaultCenter] addObserver:self
-                                           selector:@selector(keyboardInputSourceChanged:)
-                                               name:NSTextInputContextKeyboardSelectionDidChangeNotification
-                                             object:nil];
-
-  return self;
-}
-
-- (void)dealloc
-{
-  [[NSNotificationCenter defaultCenter] removeObserver:self];
-  
-  [mInputTextView release];
-  
-  [super dealloc];
-}
-
-- (void)keyboardInputSourceChanged:(NSNotification *)notification
-{
-  [self cancelComposition];
-}
-
-- (BOOL)interpretKeyEvent:(NSEvent*)event string:(NSString**)string
-{
-  BOOL hadMarkedText = [mInputTextView hasMarkedText];
-
-  *string = nil;
-
-  if (![[mInputTextView inputContext] handleEvent:event])
-    return NO;
-
-  if ([mInputTextView hasMarkedText]) {
-    // Don't show the input method window for dead keys
-    if ([[event characters] length] > 0)
-      [self orderFront:nil];
-
-    return YES;
-  } else {
-    [self orderOut:nil];
-
-    NSString *text = [[mInputTextView textStorage] string];
-    if ([text length] > 0)
-      *string = [[text copy] autorelease];
-  }
-
-  [mInputTextView setString:@""];
-  return hadMarkedText;
-}
-
-- (NSTextInputContext*)inputContext
-{
-  return [mInputTextView inputContext];
-}
-
-- (void)cancelComposition
-{
-  [mInputTextView setString:@""];
-  [self orderOut:nil];
-}
-
-- (BOOL)inComposition
-{
-  return [mInputTextView hasMarkedText];
-}
-
-@end
diff --git a/third_party/mozilla/README.chromium b/third_party/mozilla/README.chromium
index 5f4dfb3..7f026248 100644
--- a/third_party/mozilla/README.chromium
+++ b/third_party/mozilla/README.chromium
@@ -28,13 +28,3 @@
 - MOZILLA_EXPORT was added to some constants in NSPasteboard+Utils.h.
 - +[NSWorkspace(CaminoDefaultBrowserAdditions) isLeopardOrHigher] hidden since
   it relies on methods deprecated in 10.8 (and is unused in Chrome).
-
------------------------------------------------------------------
-
-Also includes IME panel from Gecko, which is based on WebKit's implementation.
-Although it comes from Mozilla (http://mxr.mozilla.org), it uses the original
-WebKit license.
-
-Local modifications:
-- #ifdef'd definitions of a few symbols were added to support the 10.5 SDK.
-- MOZILLA_EXPORT was added to the IME panel class in ComplexTextInputPanel.h.
diff --git a/third_party/mozilla/mozilla.gyp b/third_party/mozilla/mozilla.gyp
index 950014e4..79e18d3 100644
--- a/third_party/mozilla/mozilla.gyp
+++ b/third_party/mozilla/mozilla.gyp
@@ -8,8 +8,6 @@
       'target_name': 'mozilla',
       'type': '<(component)',
       'sources': [
-        'ComplexTextInputPanel.h',
-        'ComplexTextInputPanel.mm',
         'MozillaExport.h',
         'NSPasteboard+Utils.h',
         'NSPasteboard+Utils.mm',
diff --git a/third_party/npapi/BUILD.gn b/third_party/npapi/BUILD.gn
deleted file mode 100644
index 7314702a..0000000
--- a/third_party/npapi/BUILD.gn
+++ /dev/null
@@ -1,27 +0,0 @@
-# Copyright 2014 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-config("npapi_config") {
-  # Some things #include "bindings/npapi.h" and others just #include
-  # "npapi.h". Account for both flavors.
-  include_dirs = [
-    ".",
-    "bindings",
-  ]
-}
-
-source_set("npapi") {
-  # Just headers but this allows us to track dependencies on these.
-  sources = [
-    "bindings/npapi.h",
-    "bindings/npapi_extensions.h",
-    "bindings/npapi_x11.h",
-    "bindings/npfunctions.h",
-    "bindings/nphostapi.h",
-    "bindings/npruntime.h",
-    "bindings/nptypes.h",
-  ]
-
-  public_configs = [ ":npapi_config" ]
-}
diff --git a/third_party/npapi/LICENSE b/third_party/npapi/LICENSE
deleted file mode 100644
index 2765f9c..0000000
--- a/third_party/npapi/LICENSE
+++ /dev/null
@@ -1,32 +0,0 @@
-Version: MPL 1.1/GPL 2.0/LGPL 2.1
-
-The contents of this file are subject to the Mozilla Public License Version
-1.1 (the "License"); you may not use this file except in compliance with
-the License. You may obtain a copy of the License at
-http://www.mozilla.org/MPL/
-
-Software distributed under the License is distributed on an "AS IS" basis,
-WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
-for the specific language governing rights and limitations under the
-License.
-
-The Original Code is mozilla.org code.
-
-The Initial Developer of the Original Code is
-Netscape Communications Corporation.
-Portions created by the Initial Developer are Copyright (C) 1998
-the Initial Developer. All Rights Reserved.
-
-Contributor(s):
-
-Alternatively, the contents of this file may be used under the terms of
-either the GNU General Public License Version 2 or later (the "GPL"), or
-the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
-in which case the provisions of the GPL or the LGPL are applicable instead
-of those above. If you wish to allow use of your version of this file only
-under the terms of either the GPL or the LGPL, and not to allow others to
-use your version of this file under the terms of the MPL, indicate your
-decision by deleting the provisions above and replace them with the notice
-and other provisions required by the GPL or the LGPL. If you do not delete
-the provisions above, a recipient may use your version of this file under
-the terms of any one of the MPL, the GPL or the LGPL.
diff --git a/third_party/npapi/README.chromium b/third_party/npapi/README.chromium
deleted file mode 100644
index d71c02b..0000000
--- a/third_party/npapi/README.chromium
+++ /dev/null
@@ -1,9 +0,0 @@
-Name: Netscape Plugin Application Programming Interface (NPAPI)
-Short Name: npapi
-URL: http://mxr.mozilla.org/mozilla-central/source/modules/plugin/base/public/
-Version: unknown
-Security Critical: yes
-License: MPL 1.1/GPL 2.0/LGPL 2.1
-
-Modifications:
-- Converted to utf-8 with: vim +"argdo write ++enc=utf-8" *.h
diff --git a/third_party/npapi/bindings/DEPS b/third_party/npapi/bindings/DEPS
deleted file mode 100644
index 4e143b6..0000000
--- a/third_party/npapi/bindings/DEPS
+++ /dev/null
@@ -1,3 +0,0 @@
-include_rules = [
-  '+base',
-]
diff --git a/third_party/npapi/bindings/npapi.h b/third_party/npapi/bindings/npapi.h
deleted file mode 100644
index 97eb900..0000000
--- a/third_party/npapi/bindings/npapi.h
+++ /dev/null
@@ -1,921 +0,0 @@
-/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 1998
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#ifndef npapi_h_
-#define npapi_h_
-
-#if defined(__OS2__)
-#pragma pack(1)
-#endif
-
-/* BEGIN GOOGLE MODIFICATIONS */
-
-#ifndef __native_client__
-#include "nptypes.h"
-#endif
-
-#include <stdint.h>
-#include <sys/types.h>
-
-/* END GOOGLE MODIFICATIONS */
-
-#if defined(__OS2__) || defined(OS2)
-#ifndef XP_OS2
-#define XP_OS2 1
-#endif
-#endif
-
-#if defined(_WIN32) && !defined(__SYMBIAN32__)
-#include <windows.h>
-#ifndef XP_WIN
-#define XP_WIN 1
-#endif
-#endif
-
-/* BEGIN GOOGLE MODIFICATIONS */
-/* On Linux and Mac, be sure to set Mozilla-specific macros. */
-#if defined(USE_X11)
-#if !defined(XP_UNIX)
-#define XP_UNIX 1
-#endif
-#if !defined(MOZ_X11)
-#define MOZ_X11 1
-#endif
-#endif
-/* END GOOGLE MODIFICATIONS */
-
-#if defined(__SYMBIAN32__)
-#ifndef XP_SYMBIAN
-#define XP_SYMBIAN 1
-#undef XP_WIN
-#endif
-#endif
-
-#if defined(__APPLE_CC__) && !defined(XP_UNIX)
-#ifndef XP_MACOSX
-#define XP_MACOSX 1
-#endif
-#endif
-
-#if defined(XP_MACOSX) && defined(__LP64__)
-#define NP_NO_QUICKDRAW
-#define NP_NO_CARBON
-#endif
-
-#if defined(XP_MACOSX)
-#include <ApplicationServices/ApplicationServices.h>
-#include <OpenGL/OpenGL.h>
-#ifndef NP_NO_CARBON
-#include <Carbon/Carbon.h>
-#endif
-#endif
-
-#if defined(XP_UNIX)
-#include <stdio.h>
-/* BEGIN GOOGLE MODIFICATIONS */
-#if 0
-/* END GOOGLE MODIFICATIONS */
-#if defined(MOZ_X11)
-#include <X11/Xlib.h>
-#include <X11/Xutil.h>
-#endif
-/* BEGIN GOOGLE MODIFICATIONS */
-#endif
-/* END GOOGLE MODIFICATIONS */
-#endif
-
-#if defined(XP_SYMBIAN)
-#include <QEvent>
-#include <QRegion>
-#endif
-
-/*----------------------------------------------------------------------*/
-/*                        Plugin Version Constants                      */
-/*----------------------------------------------------------------------*/
-
-#define NP_VERSION_MAJOR 0
-#define NP_VERSION_MINOR 27
-
-
-/* The OS/2 version of Netscape uses RC_DATA to define the
-   mime types, file extensions, etc that are required.
-   Use a vertical bar to separate types, end types with \0.
-   FileVersion and ProductVersion are 32bit ints, all other
-   entries are strings that MUST be terminated with a \0.
-
-AN EXAMPLE:
-
-RCDATA NP_INFO_ProductVersion { 1,0,0,1,}
-
-RCDATA NP_INFO_MIMEType    { "video/x-video|",
-                             "video/x-flick\0" }
-RCDATA NP_INFO_FileExtents { "avi|",
-                             "flc\0" }
-RCDATA NP_INFO_FileOpenName{ "MMOS2 video player(*.avi)|",
-                             "MMOS2 Flc/Fli player(*.flc)\0" }
-
-RCDATA NP_INFO_FileVersion       { 1,0,0,1 }
-RCDATA NP_INFO_CompanyName       { "Netscape Communications\0" }
-RCDATA NP_INFO_FileDescription   { "NPAVI32 Extension DLL\0"
-RCDATA NP_INFO_InternalName      { "NPAVI32\0" )
-RCDATA NP_INFO_LegalCopyright    { "Copyright Netscape Communications \251 1996\0"
-RCDATA NP_INFO_OriginalFilename  { "NVAPI32.DLL" }
-RCDATA NP_INFO_ProductName       { "NPAVI32 Dynamic Link Library\0" }
-*/
-/* RC_DATA types for version info - required */
-#define NP_INFO_ProductVersion      1
-#define NP_INFO_MIMEType            2
-#define NP_INFO_FileOpenName        3
-#define NP_INFO_FileExtents         4
-/* RC_DATA types for version info - used if found */
-#define NP_INFO_FileDescription     5
-#define NP_INFO_ProductName         6
-/* RC_DATA types for version info - optional */
-#define NP_INFO_CompanyName         7
-#define NP_INFO_FileVersion         8
-#define NP_INFO_InternalName        9
-#define NP_INFO_LegalCopyright      10
-#define NP_INFO_OriginalFilename    11
-
-#ifndef RC_INVOKED
-
-/*----------------------------------------------------------------------*/
-/*                       Definition of Basic Types                      */
-/*----------------------------------------------------------------------*/
-
-typedef unsigned char NPBool;
-typedef int16_t       NPError;
-typedef int16_t       NPReason;
-typedef char*         NPMIMEType;
-
-/*----------------------------------------------------------------------*/
-/*                       Structures and definitions                     */
-/*----------------------------------------------------------------------*/
-
-#if !defined(__LP64__)
-#if defined(XP_MACOSX)
-#pragma options align=mac68k
-#endif
-#endif /* __LP64__ */
-
-/*
- *  NPP is a plugin's opaque instance handle
- */
-typedef struct _NPP
-{
-  void* pdata;      /* plugin private data */
-  void* ndata;      /* netscape private data */
-} NPP_t;
-
-typedef NPP_t*  NPP;
-
-typedef struct _NPStream
-{
-  void*    pdata; /* plugin private data */
-  void*    ndata; /* netscape private data */
-  const    char* url;
-  uint32_t end;
-  uint32_t lastmodified;
-  void*    notifyData;
-  const    char* headers; /* Response headers from host.
-                           * Exists only for >= NPVERS_HAS_RESPONSE_HEADERS.
-                           * Used for HTTP only; NULL for non-HTTP.
-                           * Available from NPP_NewStream onwards.
-                           * Plugin should copy this data before storing it.
-                           * Includes HTTP status line and all headers,
-                           * preferably verbatim as received from server,
-                           * headers formatted as in HTTP ("Header: Value"),
-                           * and newlines (\n, NOT \r\n) separating lines.
-                           * Terminated by \n\0 (NOT \n\n\0). */
-} NPStream;
-
-typedef struct _NPByteRange
-{
-  int32_t  offset; /* negative offset means from the end */
-  uint32_t length;
-  struct _NPByteRange* next;
-} NPByteRange;
-
-typedef struct _NPSavedData
-{
-  int32_t len;
-  void*   buf;
-} NPSavedData;
-
-typedef struct _NPRect
-{
-  uint16_t top;
-  uint16_t left;
-  uint16_t bottom;
-  uint16_t right;
-} NPRect;
-
-typedef struct _NPSize
-{
-  int32_t width;
-  int32_t height;
-} NPSize;
-
-typedef enum {
-  NPFocusNext = 0,
-  NPFocusPrevious = 1
-} NPFocusDirection;
-
-/* Return values for NPP_HandleEvent */
-#define kNPEventNotHandled 0
-#define kNPEventHandled 1
-/* Exact meaning must be spec'd in event model. */
-#define kNPEventStartIME 2
-
-#if defined(XP_UNIX)
-/*
- * Unix specific structures and definitions
- */
-
-/*
- * Callback Structures.
- *
- * These are used to pass additional platform specific information.
- */
-enum {
-  NP_SETWINDOW = 1,
-  NP_PRINT
-};
-
-typedef struct
-{
-  int32_t type;
-} NPAnyCallbackStruct;
-
-/* BEGIN GOOGLE MODIFICATIONS */
-typedef struct _NPSetWindowCallbackStruct NPSetWindowCallbackStruct;
-/* END GOOGLE MODIFICATIONS */
-
-typedef struct
-{
-  int32_t type;
-  FILE* fp;
-} NPPrintCallbackStruct;
-
-#endif /* XP_UNIX */
-
-#if defined(XP_MACOSX)
-typedef enum {
-#ifndef NP_NO_QUICKDRAW
-  NPDrawingModelQuickDraw = 0,
-#endif
-  NPDrawingModelCoreGraphics = 1,
-  NPDrawingModelOpenGL = 2,
-  NPDrawingModelCoreAnimation = 3,
-  NPDrawingModelInvalidatingCoreAnimation = 4
-} NPDrawingModel;
-
-typedef enum {
-#ifndef NP_NO_CARBON
-  NPEventModelCarbon = 0,
-#endif
-  NPEventModelCocoa = 1
-} NPEventModel;
-#endif
-
-/*
- *   The following masks are applied on certain platforms to NPNV and
- *   NPPV selectors that pass around pointers to COM interfaces. Newer
- *   compilers on some platforms may generate vtables that are not
- *   compatible with older compilers. To prevent older plugins from
- *   not understanding a new browser's ABI, these masks change the
- *   values of those selectors on those platforms. To remain backwards
- *   compatible with different versions of the browser, plugins can
- *   use these masks to dynamically determine and use the correct C++
- *   ABI that the browser is expecting. This does not apply to Windows
- *   as Microsoft's COM ABI will likely not change.
- */
-
-#define NP_ABI_GCC3_MASK  0x10000000
-/*
- *   gcc 3.x generated vtables on UNIX and OSX are incompatible with
- *   previous compilers.
- */
-#if (defined(XP_UNIX) && defined(__GNUC__) && (__GNUC__ >= 3))
-#define _NP_ABI_MIXIN_FOR_GCC3 NP_ABI_GCC3_MASK
-#else
-#define _NP_ABI_MIXIN_FOR_GCC3 0
-#endif
-
-#if defined(XP_MACOSX)
-#define NP_ABI_MACHO_MASK 0x01000000
-#define _NP_ABI_MIXIN_FOR_MACHO NP_ABI_MACHO_MASK
-#else
-#define _NP_ABI_MIXIN_FOR_MACHO 0
-#endif
-
-#define NP_ABI_MASK (_NP_ABI_MIXIN_FOR_GCC3 | _NP_ABI_MIXIN_FOR_MACHO)
-
-/*
- * List of variable names for which NPP_GetValue shall be implemented
- */
-typedef enum {
-  NPPVpluginNameString = 1,
-  NPPVpluginDescriptionString,
-  NPPVpluginWindowBool,
-  NPPVpluginTransparentBool,
-  NPPVjavaClass,
-  NPPVpluginWindowSize,
-  NPPVpluginTimerInterval,
-  NPPVpluginScriptableInstance = (10 | NP_ABI_MASK),
-  NPPVpluginScriptableIID = 11,
-  NPPVjavascriptPushCallerBool = 12,
-  NPPVpluginKeepLibraryInMemory = 13,
-  NPPVpluginNeedsXEmbed         = 14,
-
-  /* Get the NPObject for scripting the plugin. Introduced in NPAPI minor version 14.
-   */
-  NPPVpluginScriptableNPObject  = 15,
-
-  /* Get the plugin value (as \0-terminated UTF-8 string data) for
-   * form submission if the plugin is part of a form. Use
-   * NPN_MemAlloc() to allocate memory for the string data. Introduced
-   * in NPAPI minor version 15.
-   */
-  NPPVformValue = 16,
-
-  NPPVpluginUrlRequestsDisplayedBool = 17,
-
-  /* Checks if the plugin is interested in receiving the http body of
-   * all http requests (including failed ones, http status != 200).
-   */
-  NPPVpluginWantsAllNetworkStreams = 18,
-
-  /* Browsers can retrieve a native ATK accessibility plug ID via this variable. */
-  NPPVpluginNativeAccessibleAtkPlugId = 19,
-
-  /* Checks to see if the plugin would like the browser to load the "src" attribute. */
-  NPPVpluginCancelSrcStream = 20,
-
-  NPPVsupportsAdvancedKeyHandling = 21,
-
-  NPPVpluginUsesDOMForCursorBool = 22
-
-#if defined(XP_MACOSX)
-  /* Used for negotiating drawing models */
-  , NPPVpluginDrawingModel = 1000
-  /* Used for negotiating event models */
-  , NPPVpluginEventModel = 1001
-  /* In the NPDrawingModelCoreAnimation drawing model, the browser asks the plugin for a Core Animation layer. */
-  , NPPVpluginCoreAnimationLayer = 1003
-#endif
-
-#if defined(MOZ_PLATFORM_MAEMO) && ((MOZ_PLATFORM_MAEMO == 5) || (MOZ_PLATFORM_MAEMO == 6))
-  , NPPVpluginWindowlessLocalBool = 2002
-#endif
-} NPPVariable;
-
-/*
- * List of variable names for which NPN_GetValue should be implemented.
- */
-typedef enum {
-  NPNVxDisplay = 1,
-  NPNVxtAppContext,
-  NPNVnetscapeWindow,
-  NPNVjavascriptEnabledBool,
-  NPNVasdEnabledBool,
-  NPNVisOfflineBool,
-
-  NPNVserviceManager = (10 | NP_ABI_MASK),
-  NPNVDOMElement     = (11 | NP_ABI_MASK),
-  NPNVDOMWindow      = (12 | NP_ABI_MASK),
-  NPNVToolkit        = (13 | NP_ABI_MASK),
-  NPNVSupportsXEmbedBool = 14,
-
-  /* Get the NPObject wrapper for the browser window. */
-  NPNVWindowNPObject = 15,
-
-  /* Get the NPObject wrapper for the plugins DOM element. */
-  NPNVPluginElementNPObject = 16,
-
-  NPNVSupportsWindowless = 17,
-
-  NPNVprivateModeBool = 18,
-
-  NPNVsupportsAdvancedKeyHandling = 21,
-
-  NPNVdocumentOrigin = 22
-
-#if defined(XP_MACOSX)
-  /* Used for negotiating drawing models */
-  , NPNVpluginDrawingModel = 1000
-#ifndef NP_NO_QUICKDRAW
-  , NPNVsupportsQuickDrawBool = 2000
-#endif
-  , NPNVsupportsCoreGraphicsBool = 2001
-  , NPNVsupportsOpenGLBool = 2002
-  , NPNVsupportsCoreAnimationBool = 2003
-  , NPNVsupportsInvalidatingCoreAnimationBool = 2004
-#ifndef NP_NO_CARBON
-  , NPNVsupportsCarbonBool = 3000 /* TRUE if the browser supports the Carbon event model */
-#endif
-  , NPNVsupportsCocoaBool = 3001 /* TRUE if the browser supports the Cocoa event model */
-  , NPNVsupportsUpdatedCocoaTextInputBool = 3002 /* TRUE if the browser supports the updated
-                                                    Cocoa text input specification. */
-  , NPNVsupportsCompositingCoreAnimationPluginsBool = 74656 /* TRUE if the browser supports
-                                                               CA model compositing */
-#endif
-#if defined(MOZ_PLATFORM_MAEMO) && ((MOZ_PLATFORM_MAEMO == 5) || (MOZ_PLATFORM_MAEMO == 6))
-  , NPNVSupportsWindowlessLocal = 2002
-#endif
-} NPNVariable;
-
-typedef enum {
-  NPNURLVCookie = 501,
-  NPNURLVProxy
-} NPNURLVariable;
-
-/*
- * The type of Toolkit the widgets use
- */
-typedef enum {
-  NPNVGtk12 = 1,
-  NPNVGtk2
-} NPNToolkitType;
-
-/*
- * The type of a NPWindow - it specifies the type of the data structure
- * returned in the window field.
- */
-typedef enum {
-  NPWindowTypeWindow = 1,
-  NPWindowTypeDrawable
-} NPWindowType;
-
-typedef struct _NPWindow
-{
-  void* window;  /* Platform specific window handle */
-                 /* OS/2: x - Position of bottom left corner */
-                 /* OS/2: y - relative to visible netscape window */
-  int32_t  x;      /* Position of top left corner relative */
-  int32_t  y;      /* to a netscape page. */
-  uint32_t width;  /* Maximum window size */
-  uint32_t height;
-  NPRect   clipRect; /* Clipping rectangle in port coordinates */
-#if (defined(XP_UNIX) || defined(XP_SYMBIAN)) && !defined(XP_MACOSX)
-  void * ws_info; /* Platform-dependent additional data */
-#endif /* XP_UNIX */
-  NPWindowType type; /* Is this a window or a drawable? */
-} NPWindow;
-
-typedef struct _NPImageExpose
-{
-  char*    data;       /* image pointer */
-  int32_t  stride;     /* Stride of data image pointer */
-  int32_t  depth;      /* Depth of image pointer */
-  int32_t  x;          /* Expose x */
-  int32_t  y;          /* Expose y */
-  uint32_t width;      /* Expose width */
-  uint32_t height;     /* Expose height */
-  NPSize   dataSize;   /* Data buffer size */
-  float    translateX; /* translate X matrix value */
-  float    translateY; /* translate Y matrix value */
-  float    scaleX;     /* scale X matrix value */
-  float    scaleY;     /* scale Y matrix value */
-} NPImageExpose;
-
-typedef struct _NPFullPrint
-{
-  NPBool pluginPrinted;/* Set TRUE if plugin handled fullscreen printing */
-  NPBool printOne;     /* TRUE if plugin should print one copy to default
-                          printer */
-  void* platformPrint; /* Platform-specific printing info */
-} NPFullPrint;
-
-typedef struct _NPEmbedPrint
-{
-  NPWindow window;
-  void* platformPrint; /* Platform-specific printing info */
-} NPEmbedPrint;
-
-typedef struct _NPPrint
-{
-  uint16_t mode;               /* NP_FULL or NP_EMBED */
-  union
-  {
-    NPFullPrint fullPrint;   /* if mode is NP_FULL */
-    NPEmbedPrint embedPrint; /* if mode is NP_EMBED */
-  } print;
-} NPPrint;
-
-#if defined(XP_MACOSX)
-#ifndef NP_NO_CARBON
-typedef EventRecord NPEvent;
-#endif
-#elif defined(XP_SYMBIAN)
-typedef QEvent NPEvent;
-#elif defined(XP_WIN)
-typedef struct _NPEvent
-{
-  uint16_t event;
-  uintptr_t wParam;
-  uintptr_t lParam;
-} NPEvent;
-#elif defined(XP_OS2)
-typedef struct _NPEvent
-{
-  uint32_t event;
-  uint32_t wParam;
-  uint32_t lParam;
-} NPEvent;
-#elif defined(XP_UNIX) && defined(MOZ_X11)
-/* BEGIN GOOGLE MODIFICATIONS */
-typedef union _XEvent XEvent;
-/* END GOOGLE MODIFICATIONS */
-typedef XEvent NPEvent;
-#else
-typedef void*  NPEvent;
-#endif
-
-#if defined(XP_MACOSX)
-typedef void* NPRegion;
-#ifndef NP_NO_QUICKDRAW
-typedef RgnHandle NPQDRegion;
-#endif
-typedef CGPathRef NPCGRegion;
-#elif defined(XP_WIN)
-typedef HRGN NPRegion;
-#elif defined(XP_UNIX) && defined(MOZ_X11)
-/* BEGIN GOOGLE MODIFICATIONS */
-typedef struct _XRegion *Region;	
-/* END GOOGLE MODIFICATIONS */
-typedef Region NPRegion;
-#elif defined(XP_SYMBIAN)
-typedef QRegion* NPRegion;
-#else
-typedef void *NPRegion;
-#endif
-
-typedef struct _NPNSString NPNSString;
-typedef struct _NPNSWindow NPNSWindow;
-typedef struct _NPNSMenu   NPNSMenu;
-
-#if defined(XP_MACOSX)
-typedef NPNSMenu NPMenu;
-#else
-typedef void *NPMenu;
-#endif
-
-typedef enum {
-  NPCoordinateSpacePlugin = 1,
-  NPCoordinateSpaceWindow,
-  NPCoordinateSpaceFlippedWindow,
-  NPCoordinateSpaceScreen,
-  NPCoordinateSpaceFlippedScreen
-} NPCoordinateSpace;
-
-#if defined(XP_MACOSX)
-
-#ifndef NP_NO_QUICKDRAW
-typedef struct NP_Port
-{
-  CGrafPtr port;
-  int32_t portx; /* position inside the topmost window */
-  int32_t porty;
-} NP_Port;
-#endif /* NP_NO_QUICKDRAW */
-
-/*
- * NP_CGContext is the type of the NPWindow's 'window' when the plugin specifies NPDrawingModelCoreGraphics
- * as its drawing model.
- */
-
-typedef struct NP_CGContext
-{
-  CGContextRef context;
-  void *window; /* A WindowRef under the Carbon event model. */
-} NP_CGContext;
-
-/*
- * NP_GLContext is the type of the NPWindow's 'window' when the plugin specifies NPDrawingModelOpenGL as its
- * drawing model.
- */
-
-typedef struct NP_GLContext
-{
-  CGLContextObj context;
-#ifdef NP_NO_CARBON
-  NPNSWindow *window;
-#else
-  void *window; /* Can be either an NSWindow or a WindowRef depending on the event model */
-#endif
-} NP_GLContext;
-
-typedef enum {
-  NPCocoaEventDrawRect = 1,
-  NPCocoaEventMouseDown,
-  NPCocoaEventMouseUp,
-  NPCocoaEventMouseMoved,
-  NPCocoaEventMouseEntered,
-  NPCocoaEventMouseExited,
-  NPCocoaEventMouseDragged,
-  NPCocoaEventKeyDown,
-  NPCocoaEventKeyUp,
-  NPCocoaEventFlagsChanged,
-  NPCocoaEventFocusChanged,
-  NPCocoaEventWindowFocusChanged,
-  NPCocoaEventScrollWheel,
-  NPCocoaEventTextInput
-} NPCocoaEventType;
-
-typedef struct _NPCocoaEvent {
-  NPCocoaEventType type;
-  uint32_t version;
-  union {
-    struct {
-      uint32_t modifierFlags;
-      double   pluginX;
-      double   pluginY;
-      int32_t  buttonNumber;
-      int32_t  clickCount;
-      double   deltaX;
-      double   deltaY;
-      double   deltaZ;
-    } mouse;
-    struct {
-      uint32_t    modifierFlags;
-      NPNSString *characters;
-      NPNSString *charactersIgnoringModifiers;
-      NPBool      isARepeat;
-      uint16_t    keyCode;
-    } key;
-    struct {
-      CGContextRef context;
-      double x;
-      double y;
-      double width;
-      double height;
-    } draw;
-    struct {
-      NPBool hasFocus;
-    } focus;
-    struct {
-      NPNSString *text;
-    } text;
-  } data;
-} NPCocoaEvent;
-
-#ifndef NP_NO_CARBON
-/* Non-standard event types that can be passed to HandleEvent */
-enum NPEventType {
-  NPEventType_GetFocusEvent = (osEvt + 16),
-  NPEventType_LoseFocusEvent,
-  NPEventType_AdjustCursorEvent,
-  NPEventType_MenuCommandEvent,
-  NPEventType_ClippingChangedEvent,
-  NPEventType_ScrollingBeginsEvent = 1000,
-  NPEventType_ScrollingEndsEvent
-};
-#endif /* NP_NO_CARBON */
-
-#endif /* XP_MACOSX */
-
-/*
- * Values for mode passed to NPP_New:
- */
-#define NP_EMBED 1
-#define NP_FULL  2
-
-/*
- * Values for stream type passed to NPP_NewStream:
- */
-#define NP_NORMAL     1
-#define NP_SEEK       2
-#define NP_ASFILE     3
-#define NP_ASFILEONLY 4
-
-#define NP_MAXREADY (((unsigned)(~0)<<1)>>1)
-
-/*
- * Flags for NPP_ClearSiteData.
- */
-#define NP_CLEAR_ALL   0
-#define NP_CLEAR_CACHE (1 << 0)
-
-#if !defined(__LP64__)
-#if defined(XP_MACOSX)
-#pragma options align=reset
-#endif
-#endif /* __LP64__ */
-
-/*----------------------------------------------------------------------*/
-/*       Error and Reason Code definitions                              */
-/*----------------------------------------------------------------------*/
-
-/*
- * Values of type NPError:
- */
-#define NPERR_BASE                         0
-#define NPERR_NO_ERROR                    (NPERR_BASE + 0)
-#define NPERR_GENERIC_ERROR               (NPERR_BASE + 1)
-#define NPERR_INVALID_INSTANCE_ERROR      (NPERR_BASE + 2)
-#define NPERR_INVALID_FUNCTABLE_ERROR     (NPERR_BASE + 3)
-#define NPERR_MODULE_LOAD_FAILED_ERROR    (NPERR_BASE + 4)
-#define NPERR_OUT_OF_MEMORY_ERROR         (NPERR_BASE + 5)
-#define NPERR_INVALID_PLUGIN_ERROR        (NPERR_BASE + 6)
-#define NPERR_INVALID_PLUGIN_DIR_ERROR    (NPERR_BASE + 7)
-#define NPERR_INCOMPATIBLE_VERSION_ERROR  (NPERR_BASE + 8)
-#define NPERR_INVALID_PARAM               (NPERR_BASE + 9)
-#define NPERR_INVALID_URL                 (NPERR_BASE + 10)
-#define NPERR_FILE_NOT_FOUND              (NPERR_BASE + 11)
-#define NPERR_NO_DATA                     (NPERR_BASE + 12)
-#define NPERR_STREAM_NOT_SEEKABLE         (NPERR_BASE + 13)
-#define NPERR_TIME_RANGE_NOT_SUPPORTED    (NPERR_BASE + 14)
-#define NPERR_MALFORMED_SITE              (NPERR_BASE + 15)
-
-/*
- * Values of type NPReason:
- */
-#define NPRES_BASE          0
-#define NPRES_DONE         (NPRES_BASE + 0)
-#define NPRES_NETWORK_ERR  (NPRES_BASE + 1)
-#define NPRES_USER_BREAK   (NPRES_BASE + 2)
-
-/*
- * Don't use these obsolete error codes any more.
- */
-#define NP_NOERR  NP_NOERR_is_obsolete_use_NPERR_NO_ERROR
-#define NP_EINVAL NP_EINVAL_is_obsolete_use_NPERR_GENERIC_ERROR
-#define NP_EABORT NP_EABORT_is_obsolete_use_NPRES_USER_BREAK
-
-/*
- * Version feature information
- */
-#define NPVERS_HAS_STREAMOUTPUT             8
-#define NPVERS_HAS_NOTIFICATION             9
-#define NPVERS_HAS_LIVECONNECT              9
-#define NPVERS_68K_HAS_LIVECONNECT          11
-#define NPVERS_HAS_WINDOWLESS               11
-#define NPVERS_HAS_XPCONNECT_SCRIPTING      13
-#define NPVERS_HAS_NPRUNTIME_SCRIPTING      14
-#define NPVERS_HAS_FORM_VALUES              15
-#define NPVERS_HAS_POPUPS_ENABLED_STATE     16
-#define NPVERS_HAS_RESPONSE_HEADERS         17
-#define NPVERS_HAS_NPOBJECT_ENUM            18
-#define NPVERS_HAS_PLUGIN_THREAD_ASYNC_CALL 19
-#define NPVERS_HAS_ALL_NETWORK_STREAMS      20
-#define NPVERS_HAS_URL_AND_AUTH_INFO        21
-#define NPVERS_HAS_PRIVATE_MODE             22
-#define NPVERS_MACOSX_HAS_COCOA_EVENTS      23
-#define NPVERS_HAS_ADVANCED_KEY_HANDLING    25
-#define NPVERS_HAS_URL_REDIRECT_HANDLING    26
-#define NPVERS_HAS_CLEAR_SITE_DATA          27
-
-/*----------------------------------------------------------------------*/
-/*                        Function Prototypes                           */
-/*----------------------------------------------------------------------*/
-
-#if defined(__OS2__)
-#define NP_LOADDS _System
-#else
-#define NP_LOADDS
-#endif
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-/* NPP_* functions are provided by the plugin and called by the navigator. */
-
-#if defined(XP_UNIX)
-const char* NPP_GetMIMEDescription(void);
-#endif
-
-NPError NP_LOADDS NPP_New(NPMIMEType pluginType, NPP instance,
-                          uint16_t mode, int16_t argc, char* argn[],
-                          char* argv[], NPSavedData* saved);
-NPError NP_LOADDS NPP_Destroy(NPP instance, NPSavedData** save);
-NPError NP_LOADDS NPP_SetWindow(NPP instance, NPWindow* window);
-NPError NP_LOADDS NPP_NewStream(NPP instance, NPMIMEType type,
-                                NPStream* stream, NPBool seekable,
-                                uint16_t* stype);
-NPError NP_LOADDS NPP_DestroyStream(NPP instance, NPStream* stream,
-                                    NPReason reason);
-int32_t NP_LOADDS NPP_WriteReady(NPP instance, NPStream* stream);
-int32_t NP_LOADDS NPP_Write(NPP instance, NPStream* stream, int32_t offset,
-                            int32_t len, void* buffer);
-void    NP_LOADDS NPP_StreamAsFile(NPP instance, NPStream* stream,
-                                   const char* fname);
-void    NP_LOADDS NPP_Print(NPP instance, NPPrint* platformPrint);
-int16_t NP_LOADDS NPP_HandleEvent(NPP instance, void* event);
-void    NP_LOADDS NPP_URLNotify(NPP instance, const char* url,
-                                NPReason reason, void* notifyData);
-NPError NP_LOADDS NPP_GetValue(NPP instance, NPPVariable variable, void *value);
-NPError NP_LOADDS NPP_SetValue(NPP instance, NPNVariable variable, void *value);
-NPBool  NP_LOADDS NPP_GotFocus(NPP instance, NPFocusDirection direction);
-void    NP_LOADDS NPP_LostFocus(NPP instance);
-void    NP_LOADDS NPP_URLRedirectNotify(NPP instance, const char* url, int32_t status, void* notifyData);
-NPError NP_LOADDS NPP_ClearSiteData(const char* site, uint64_t flags, uint64_t maxAge);
-char**  NP_LOADDS NPP_GetSitesWithData(void);
-
-/* NPN_* functions are provided by the navigator and called by the plugin. */
-void        NP_LOADDS NPN_Version(int* plugin_major, int* plugin_minor,
-                                  int* netscape_major, int* netscape_minor);
-NPError     NP_LOADDS NPN_GetURLNotify(NPP instance, const char* url,
-                                       const char* target, void* notifyData);
-NPError     NP_LOADDS NPN_GetURL(NPP instance, const char* url,
-                                 const char* target);
-NPError     NP_LOADDS NPN_PostURLNotify(NPP instance, const char* url,
-                                        const char* target, uint32_t len,
-                                        const char* buf, NPBool file,
-                                        void* notifyData);
-NPError     NP_LOADDS NPN_PostURL(NPP instance, const char* url,
-                                  const char* target, uint32_t len,
-                                  const char* buf, NPBool file);
-NPError     NP_LOADDS NPN_RequestRead(NPStream* stream, NPByteRange* rangeList);
-NPError     NP_LOADDS NPN_NewStream(NPP instance, NPMIMEType type,
-                                    const char* target, NPStream** stream);
-int32_t     NP_LOADDS NPN_Write(NPP instance, NPStream* stream, int32_t len,
-                                void* buffer);
-NPError     NP_LOADDS NPN_DestroyStream(NPP instance, NPStream* stream,
-                                        NPReason reason);
-void        NP_LOADDS NPN_Status(NPP instance, const char* message);
-const char* NP_LOADDS NPN_UserAgent(NPP instance);
-void*       NP_LOADDS NPN_MemAlloc(uint32_t size);
-void        NP_LOADDS NPN_MemFree(void* ptr);
-uint32_t    NP_LOADDS NPN_MemFlush(uint32_t size);
-void        NP_LOADDS NPN_ReloadPlugins(NPBool reloadPages);
-NPError     NP_LOADDS NPN_GetValue(NPP instance, NPNVariable variable,
-                                   void *value);
-NPError     NP_LOADDS NPN_SetValue(NPP instance, NPPVariable variable,
-                                   void *value);
-void        NP_LOADDS NPN_InvalidateRect(NPP instance, NPRect *invalidRect);
-void        NP_LOADDS NPN_InvalidateRegion(NPP instance,
-                                           NPRegion invalidRegion);
-void        NP_LOADDS NPN_ForceRedraw(NPP instance);
-void        NP_LOADDS NPN_PushPopupsEnabledState(NPP instance, NPBool enabled);
-void        NP_LOADDS NPN_PopPopupsEnabledState(NPP instance);
-void        NP_LOADDS NPN_PluginThreadAsyncCall(NPP instance,
-                                                void (*func) (void *),
-                                                void *userData);
-NPError     NP_LOADDS NPN_GetValueForURL(NPP instance, NPNURLVariable variable,
-                                         const char *url, char **value,
-                                         uint32_t *len);
-NPError     NP_LOADDS NPN_SetValueForURL(NPP instance, NPNURLVariable variable,
-                                         const char *url, const char *value,
-                                         uint32_t len);
-NPError     NP_LOADDS NPN_GetAuthenticationInfo(NPP instance,
-                                                const char *protocol,
-                                                const char *host, int32_t port,
-                                                const char *scheme,
-                                                const char *realm,
-                                                char **username, uint32_t *ulen,
-                                                char **password,
-                                                uint32_t *plen);
-uint32_t    NP_LOADDS NPN_ScheduleTimer(NPP instance, uint32_t interval, NPBool repeat, void (*timerFunc)(NPP npp, uint32_t timerID));
-void        NP_LOADDS NPN_UnscheduleTimer(NPP instance, uint32_t timerID);
-NPError     NP_LOADDS NPN_PopUpContextMenu(NPP instance, NPMenu* menu);
-NPBool      NP_LOADDS NPN_ConvertPoint(NPP instance, double sourceX, double sourceY, NPCoordinateSpace sourceSpace, double *destX, double *destY, NPCoordinateSpace destSpace);
-NPBool      NP_LOADDS NPN_HandleEvent(NPP instance, void *event, NPBool handled);
-NPBool      NP_LOADDS NPN_UnfocusInstance(NPP instance, NPFocusDirection direction);
-void        NP_LOADDS NPN_URLRedirectResponse(NPP instance, void* notifyData, NPBool allow);
-
-#ifdef __cplusplus
-}  /* end extern "C" */
-#endif
-
-#endif /* RC_INVOKED */
-#if defined(__OS2__)
-#pragma pack()
-#endif
-
-#endif /* npapi_h_ */
diff --git a/third_party/npapi/bindings/npapi_extensions.h b/third_party/npapi/bindings/npapi_extensions.h
deleted file mode 100644
index 144417b..0000000
--- a/third_party/npapi/bindings/npapi_extensions.h
+++ /dev/null
@@ -1,1079 +0,0 @@
-/* Copyright (c) 2006-2009 The Chromium Authors. All rights reserved.
- * Use of this source code is governed by a BSD-style license that can be
- * found in the LICENSE file.
- */
-
-#ifndef _NP_EXTENSIONS_H_
-#define _NP_EXTENSIONS_H_
-
-// Use the shorter include path here so that this file can be used in non-
-// Chromium projects, such as the Native Client SDK.
-#include "npapi.h"
-
-#include <stddef.h>         // For size_t
-
-/*
- * A fake "enum" value for getting browser-implemented Pepper extensions.
- * The variable returns a pointer to an NPNExtensions structure. */
-#define NPNVPepperExtensions ((NPNVariable) 4000)
-
-/*
- * A fake "enum" value for getting plugin-implemented Pepper extensions.
- * The variable returns a pointer to an NPPExtensions structure. */
-#define NPPVPepperExtensions ((NPPVariable) 4001)
-
-typedef void NPDeviceConfig;
-typedef void NPDeviceContext;
-typedef void NPUserData;
-
-/* unique id for each device interface */
-typedef int32_t NPDeviceID;
-
-/* Events -------------------------------------------------------------------*/
-
-typedef enum {
-  NPMouseButton_None    = -1,
-  NPMouseButton_Left    = 0,
-  NPMouseButton_Middle  = 1,
-  NPMouseButton_Right   = 2
-} NPMouseButtons;
-
-typedef enum {
-  NPEventType_Undefined   = -1,
-  NPEventType_MouseDown   = 0,
-  NPEventType_MouseUp     = 1,
-  NPEventType_MouseMove   = 2,
-  NPEventType_MouseEnter  = 3,
-  NPEventType_MouseLeave  = 4,
-  NPEventType_MouseWheel  = 5,
-  NPEventType_RawKeyDown  = 6,
-  NPEventType_KeyDown     = 7,
-  NPEventType_KeyUp       = 8,
-  NPEventType_Char        = 9,
-  NPEventType_Minimize    = 10,
-  NPEventType_Focus       = 11,
-  NPEventType_Device      = 12
-} NPEventTypes;
-
-typedef enum {
-  NPEventModifier_ShiftKey         = 1 << 0,
-  NPEventModifier_ControlKey       = 1 << 1,
-  NPEventModifier_AltKey           = 1 << 2,
-  NPEventModifier_MetaKey          = 1 << 3,
-  NPEventModifier_IsKeyPad         = 1 << 4,
-  NPEventModifier_IsAutoRepeat     = 1 << 5,
-  NPEventModifier_LeftButtonDown   = 1 << 6,
-  NPEventModifier_MiddleButtonDown = 1 << 7,
-  NPEventModifier_RightButtonDown  = 1 << 8
-} NPEventModifiers;
-
-typedef struct _NPKeyEvent
-{
-  uint32_t modifier;
-  uint32_t normalizedKeyCode;
-} NPKeyEvent;
-
-typedef struct _NPCharacterEvent
-{
-  uint32_t modifier;
-  uint16_t text[4];
-  uint16_t unmodifiedText[4];
-} NPCharacterEvent;
-
-typedef struct _NPMouseEvent
-{
-  uint32_t modifier;
-  int32_t button;
-  int32_t x;
-  int32_t y;
-  int32_t clickCount;
-} NPMouseEvent;
-
-typedef struct _NPMouseWheelEvent
-{
-  uint32_t modifier;
-  float deltaX;
-  float deltaY;
-  float wheelTicksX;
-  float wheelTicksY;
-  uint32_t scrollByPage;
-} NPMouseWheelEvent;
-
-typedef struct _NPDeviceEvent {
-  uint32_t device_uid;
-  uint32_t subtype;
-  /* uint8_t generic[0]; */
-} NPDeviceEvent;
-
-typedef struct _NPMinimizeEvent {
-  int32_t value;
-} NPMinimizeEvent;
-
-typedef struct _NPFocusEvent {
-  int32_t value;
-} NPFocusEvent;
-
-typedef struct _NPPepperEvent
-{
-  uint32_t size;
-  int32_t type;
-  double timeStampSeconds;
-  union {
-    NPKeyEvent key;
-    NPCharacterEvent character;
-    NPMouseEvent mouse;
-    NPMouseWheelEvent wheel;
-    NPMinimizeEvent minimize;
-    NPFocusEvent focus;
-    NPDeviceEvent device;
-  } u;
-} NPPepperEvent;
-
-/* 2D -----------------------------------------------------------------------*/
-
-#define NPPepper2DDevice 1
-
-typedef struct _NPDeviceContext2DConfig {
-} NPDeviceContext2DConfig;
-
-typedef struct _NPDeviceContext2D
-{
-  /* Internal value used by the browser to identify this device. */
-  void* reserved;
-
-  /* A pointer to the pixel data. This data is 8-bit values in BGRA order in
-   * memory. Each row will start |stride| bytes after the previous one.
-   *
-   * THIS DATA USES PREMULTIPLIED ALPHA. This means that each color channel has
-   * been multiplied with the corresponding alpha, which makes compositing
-   * easier. If any color channels have a value greater than the alpha value,
-   * you'll likely get crazy colors and weird artifacts. */
-  void* region;
-
-  /* Length of each row of pixels in bytes. This may be larger than width * 4
-   * if there is padding at the end of each row to help with alignment. */
-  int32_t stride;
-
-  /* The dirty region that the plugin has painted into the buffer. This
-   * will be initialized to the size of the plugin image in
-   * initializeContextPtr. The plugin can change the values to only
-   * update portions of the image. */
-  struct {
-    int32_t left;
-    int32_t top;
-    int32_t right;
-    int32_t bottom;
-  } dirty;
-} NPDeviceContext2D;
-
-typedef struct _NPDeviceBuffer {
-  void* ptr;
-  size_t size;
-} NPDeviceBuffer;
-
-/* completion callback for flush device */
-typedef void (*NPDeviceFlushContextCallbackPtr)(
-    NPP instance,
-    NPDeviceContext* context,
-    NPError err,
-    NPUserData* userData);
-
-/* query single capabilities of device */
-typedef NPError (
-    *NPDeviceQueryCapabilityPtr)(NPP instance,
-    int32_t capability,
-    int32_t *value);
-/* query config (configuration == a set of capabilities) */
-typedef NPError (
-    *NPDeviceQueryConfigPtr)(NPP instance,
-    const NPDeviceConfig* request,
-    NPDeviceConfig* obtain);
-/* device initialization */
-typedef NPError (*NPDeviceInitializeContextPtr)(
-    NPP instance,
-    const NPDeviceConfig* config,
-    NPDeviceContext* context);
-/* peek at device state */
-typedef NPError (*NPDeviceGetStateContextPtr) (
-    NPP instance,
-    NPDeviceContext* context,
-    int32_t state,
-    intptr_t* value);
-/* poke device state */
-typedef NPError (*NPDeviceSetStateContextPtr) (
-    NPP instance,
-    NPDeviceContext* context,
-    int32_t state,
-    intptr_t value);
-/* flush context, if callback, userData are NULL */
-/* this becomes a blocking call */
-typedef NPError (*NPDeviceFlushContextPtr)(
-    NPP instance,
-    NPDeviceContext* context,
-    NPDeviceFlushContextCallbackPtr callback,
-    void* userData);
-/* destroy device context.  Application responsible for */
-/* freeing context, if applicable */
-typedef NPError (*NPDeviceDestroyContextPtr)(
-    NPP instance,
-    NPDeviceContext* context);
-/* Create a buffer associated with a particular context. The usage of the */
-/* buffer is device specific. The lifetime of the buffer is scoped with the */
-/* lifetime of the context. */
-typedef NPError (*NPDeviceCreateBufferPtr)(
-    NPP instance,
-    NPDeviceContext* context,
-    size_t size,
-    int32_t* id);
-/* Destroy a buffer associated with a particular context. */
-typedef NPError (*NPDeviceDestroyBufferPtr)(
-    NPP instance,
-    NPDeviceContext* context,
-    int32_t id);
-/* Map a buffer id to its address. */
-typedef NPError (*NPDeviceMapBufferPtr)(
-    NPP instance,
-    NPDeviceContext* context,
-    int32_t id,
-    NPDeviceBuffer* buffer);
-
-
-/* forward decl typdef structs */
-typedef struct NPDevice NPDevice;
-typedef struct NPNExtensions NPNExtensions;
-
-// DEPRECATED: this typedef is just for the NaCl code until they switch to NPNExtensions.
-// PLEASE REMOVE THIS WHEN THE NACL CODE IS UPDATED.
-typedef struct NPNExtensions NPExtensions;
-
-
-/* New experimental device API. */
-
-/* Mode for calls to NPDeviceSynchronizeContext. */
-typedef enum {
-  /* Get or set locally cached state without synchronizing or communicating   */
-  /* with the service process (or thread).                                    */
-  NPDeviceSynchronizationMode_Cached,
-
-  /* Exchanges state with service process (or thread). Does not wait for any  */
-  /* progress before returning.                                               */
-  NPDeviceSynchronizationMode_Immediate,
-
-  /* Exchanges state with service process (or thread). Blocks caller until    */
-  /* further progress can be made.                                            */
-  NPDeviceSynchronizationMode_Flush
-} NPDeviceSynchronizationMode;
-
-/* Get the number of configs supported by a given device. */
-typedef NPError (*NPDeviceGetNumConfigsPtr)(NPP instance,
-                                            int32_t* numConfigs);
-
-/* Get attribute values from a config. NPDeviceGetConfigs might return        */
-/* multiple configs. This function can be used to examine them to             */
-/* find the most suitable. For example, NPDeviceGetConfigs might return one   */
-/* config with antialiasing enabled and one without. This can be determined   */
-/* using this function.                                                       */
-/* Inputs:                                                                    */
-/*  config: The config index to extract the attributes from.                  */
-/*  attribList: Array of input config attribute / value pairs                 */
-/*              terminated with NPAttrib_End.                                 */
-/* Outputs:                                                                   */
-/*  attribList: The values paired up with each attribute are filled in        */
-/*              on return.                                                    */
-typedef NPError (*NPDeviceGetConfigAttribsPtr)(NPP instance,
-                                               int32_t config,
-                                               int32_t* attribList);
-
-/* Create a device context based on a particular device configuration and a   */
-/* list config input attributes.                                              */
-/* Inputs:                                                                    */
-/*  config: The device configuration to use.                                  */
-/*  attribList: NULL or an array of context specific attribute / value        */
-/*              pairs terminated with NPAttrib_End.                           */
-/* Outputs:                                                                   */
-/*  context: The created context.                                             */
-typedef NPError (*NPDeviceCreateContextPtr)(NPP instance,
-                                            int32_t config,
-                                            const int32_t* attribList,
-                                            NPDeviceContext** context);
-
-/* Destroy a context.                                                         */
-/* Inputs:                                                                    */
-/*  context: The context to destroy.                                          */
-/*typedef NPError (*NPDestroyContext)(NPP instance,                           */
-/*                                    NPDeviceContext* context);              */
-
-/* This type should be cast to the type associated with the particular        */
-/* callback type */
-typedef void (*NPDeviceGenericCallbackPtr)(void);
-
-/* Register a callback with a context. Callbacks are never invoked after the  */
-/* associated context has been destroyed. The semantics of the particular     */
-/* callback type determine which thread the callback is invoked on. It might  */
-/* be the plugin thread, the thread RegisterCallback is invoked on or a       */
-/* special thread created for servicing callbacks, such as an audio thread    */
-/* Inputs:                                                                    */
-/*  callbackType: The device specific callback type                           */
-/*  callback: The callback to invoke. The signature varies by type. Use       */
-/*            NULL to unregister the callback for a particular type.          */
-/*  callbackData: A value that is passed to the callback function. Other      */
-/*                callback arguments vary by type.                            */
-typedef NPError (*NPDeviceRegisterCallbackPtr)(
-    NPP instance,
-    NPDeviceContext* context,
-    int32_t callbackType,
-    NPDeviceGenericCallbackPtr callback,
-    void* callbackData);
-
-/* Callback for NPDeviceSynchronizeContext.                                   */
-/* Inputs:                                                                    */
-/*  instance: The associated plugin instance.                                 */
-/*  context: The context that was flushed.                                    */
-/*  error: Indicates success of flush operation.                              */
-/*  data: The completion callback data that was passed to                     */
-/*        NPDeviceSynchronizeContext.                                         */
-typedef void (*NPDeviceSynchronizeContextCallbackPtr)(
-    NPP instance,
-    NPDeviceContext* context,
-    NPError error,
-    void* data);
-
-/* Synchronize the state of a device context. Takes lists of input and output */
-/* attributes. Generally, the input attributes are copied into the context    */
-/* and the output attributes are filled in the state of the context either    */
-/* after (before) the synchronization depending on whether it is synchronous  */
-/* (asynchronous). The get the state of the context after an asynchronous     */
-/* synchronization, call this function a second time with Cached mode after   */
-/* the callback has been invoked.                                             */
-/* Inputs:                                                                    */
-/*  context: The context to synchronize.                                      */
-/*  mode: The type of synchronization to perform.                             */
-/*  inputAttribList: NULL or an array of input synchronization attribute /    */
-/*                   value pairs terminated with NPAttrib_End.                */
-/*  outputAttribList: NULL or an array of output synchronization              */
-/*                    attributes / uninitialized value pairs terminated       */
-/*                    with NPAttrib_End.                                      */
-/*  callback: NULL for synchronous operation or completion callback function  */
-/*            for asynchronous operation.                                     */
-/*  callbackData: Argument passed to callback function.                       */
-/* Outputs:                                                                   */
-/*  outputAttribList: The values paired up with each attribute are filled     */
-/*                    in on return for synchronous operation.                 */
-typedef NPError (*NPDeviceSynchronizeContextPtr)(
-    NPP instance,
-    NPDeviceContext* context,
-    NPDeviceSynchronizationMode mode,
-    const int32_t* inputAttribList,
-    int32_t* outputAttribList,
-    NPDeviceSynchronizeContextCallbackPtr callback,
-    void* callbackData);
-
-/* All attributes shared between devices, with the exception of               */
-/* NPDeviceContextAttrib_End, have bit 31 set. Device specific attributes     */
-/* have the bit clear.                                                        */
-enum {
-  /* Used to terminate arrays of attribute / value pairs. */
-  NPAttrib_End   = 0,
-
-  /* Error status of context. Non-zero means error. Shared by all devices,    */
-  /* though error values are device specific.                                 */
-  NPAttrib_Error = 0x80000000
-};
-
-/* generic device interface */
-struct NPDevice {
-  NPDeviceQueryCapabilityPtr queryCapability;
-  NPDeviceQueryConfigPtr queryConfig;
-  NPDeviceInitializeContextPtr initializeContext;
-  NPDeviceSetStateContextPtr setStateContext;
-  NPDeviceGetStateContextPtr getStateContext;
-  NPDeviceFlushContextPtr flushContext;
-  NPDeviceDestroyContextPtr destroyContext;
-  NPDeviceCreateBufferPtr createBuffer;
-  NPDeviceDestroyBufferPtr destroyBuffer;
-  NPDeviceMapBufferPtr mapBuffer;
-
-  /* Experimental device API */
-  NPDeviceGetNumConfigsPtr getNumConfigs;
-  NPDeviceGetConfigAttribsPtr getConfigAttribs;
-  NPDeviceCreateContextPtr createContext;
-/*  NPDeviceDestroyContextPtr destroyContext; */
-  NPDeviceRegisterCallbackPtr registerCallback;
-  NPDeviceSynchronizeContextPtr synchronizeContext;
-/*  NPDeviceCreateBufferPtr createBuffer; */
-/*  NPDeviceDestroyBufferPtr destroyBuffer; */
-/*  NPDeviceMapBufferPtr mapBuffer; */
-};
-
-/* returns NULL if deviceID unavailable / unrecognized */
-typedef NPDevice* (*NPAcquireDevicePtr)(
-    NPP instance,
-    NPDeviceID device);
-
-/* Updates the number of find results for the current search term.  If
- * there are no matches 0 should be passed in.  Only when the plugin has
- * finished searching should it pass in the final count with finalResult set to
- * true. */
-typedef void (*NPNumberOfFindResultsChangedPtr)(
-    NPP instance,
-    int total,
-    bool finalResult);
-
- /* Updates the index of the currently selected search item. */
-typedef void (*NPSelectedFindResultChangedPtr)(
-    NPP instance,
-    int index);
-
-/* Theming -----------------------------------------------------------------*/
-typedef int32_t NPWidgetID;
-
-typedef enum {
-  NPWidgetTypeScrollbar = 0
-} NPWidgetType;
-
-typedef struct _NPScrollbarCreateParams {
-  bool vertical;
-} NPScrollbarCreateParams;
-
-typedef struct _NPRect32
-{
-  uint32_t top;
-  uint32_t left;
-  uint32_t bottom;
-  uint32_t right;
-} NPRect32;
-
-typedef struct _NPScrollbarTickMarks {
-  uint32_t count;
-  NPRect32* tickmarks;
-} NPScrollbarTickMarks;
-
-typedef enum {
-  NPWidgetPropertyLocation = 0,  // variable is NPRect*.
-  NPWidgetPropertyDirtyRect = 1,  // Get only.  variable is NPRec*.
-  NPWidgetPropertyScrollbarThickness = 2,  // Get only.  variable is int32_t*.
-  NPWidgetPropertyScrollbarValue = 3,  // variable is int32_t*.
-  NPWidgetPropertyScrollbarDocumentSize = 4,  // Set only. variable is int32_t*.
-  // Set only.  variable is NPScrollbarTickMarks*.
-  NPWidgetPropertyScrollbarTickMarks = 5,
-  // Set only.  variable is bool* (true for forward, false for backward).
-  NPWidgetPropertyScrollbarScrollByLine = 6,
-  // Set only.  variable is bool* (true for forward, false for backward).
-  NPWidgetPropertyScrollbarScrollByPage = 7,
-  // Set only.  variable is bool* (true for forward, false for backward).
-  NPWidgetPropertyScrollbarScrollByDocument = 8,
-  // Set only.  variable is int32_t* (positive forward, negative  backward).
-  NPWidgetPropertyScrollbarScrollByPixels = 9
-} NPWidgetProperty;
-
-// Creates a widget.  If it returns NPERR_NO_ERROR then id will contain a unique
-// identifer for the widget that's used for the next functions.
-typedef NPError (*NPCreateWidgetPtr) (
-    NPP instance,
-    NPWidgetType type,
-    void* params,  // Widget specific.
-    NPWidgetID* id);
-
-// Destroys a widget.
-typedef NPError (*NPDestroyWidgetPtr) (
-    NPP instance,
-    NPWidgetID id);
-
-// Paint the dirty rectangle of the given widget into context.
-typedef NPError (*NPPaintWidgetPtr) (
-    NPP instance,
-    NPWidgetID id,
-    NPDeviceContext2D* context,
-    NPRect* dirty);
-
-// Pass in a pepper event to a plugin.  It'll return true iff it uses it.
-typedef bool (*NPHandleWidgetEventPtr) (
-    NPP instance,
-    NPWidgetID id,
-    NPPepperEvent* event);
-
-// Gets a property of the widget.  "value" varies depending on the variable.
-typedef NPError (*NPGetWidgetPropertyPtr) (
-    NPP instance,
-    NPWidgetID id,
-    NPWidgetProperty property,
-    void* value);
-
-// Sets a property of the widget.
-typedef NPError (*NPSetWidgetPropertyPtr) (
-    NPP instance,
-    NPWidgetID id,
-    NPWidgetProperty property,
-    void* value);
-
-typedef struct _NPWidgetExtensions {
-  NPCreateWidgetPtr createWidget;
-  NPDestroyWidgetPtr destroyWidget;
-  NPPaintWidgetPtr paintWidget;
-  NPHandleWidgetEventPtr handleWidgetEvent;
-  NPGetWidgetPropertyPtr getWidgetProperty;
-  NPSetWidgetPropertyPtr setWidgetProperty;
-} NPWidgetExtensions;
-
-typedef NPWidgetExtensions* (*NPGetWidgetExtensionsPtr)(
-    NPP instance);
-
-
-/* Supports opening files anywhere on the system after prompting the user to
- * pick one.
- *
- * This API is asynchronous. It will return immediately and the user will be
- * prompted in parallel to pick a file. The plugin may continue to receive
- * events while the open file dialog is up, and may continue to paint. Plugins
- * may want to ignore input events between the call and the callback to avoid
- * reentrant behavior. If the return value is not NPERR_NO_ERROR, the callback
- * will NOT be executed.
- *
- * It is an error to call BrowseForFile before a previous call has executed
- * the callback.
- *
- * Setting the flags to "Open" requires that the file exist to allow picking.
- * Setting the flags to "Save" allows selecting nonexistant files (which will
- * then be created), and will prompt the user if they want to overwrite an
- * existing file if it exists.
- *
- * The plugin may specify a comma-separated list of possible mime types in
- * the "extensions" parameter. If no extensions are specified, the dialog box
- * will default to allowing all extensions. The first extension in the list
- * will be the default.
- *
- * TODO(brettw) On Windows the extensions traditionally include a text
- * description with the extension in the popup, do we want to allow this?
- * We should probably also allow the ability to put "All files" in the
- * list on Windows.
- *
- * Once the user has picked a file or has canceled the dialog box, the given
- * callback will be called with the results of the operation and the passed in
- * "user data" pointer. If the user successfully picked a file, the filename
- * will be non-NULL and will contain a pointer to an array of strings, one for
- * each file picked (the first file will be file_paths[0]). This buffer will
- * become invalid as soon as the call completes, so it is the plugin's
- * responsibility to copy the filename(sp if it needs future access to them.
- * A NULL file_paths in the callback means the user canceled the dialog box.
- *
- * The filename will be in UTF-8. It may not actually correspond to the actual
- * file on disk on a Linux system, because we'll do our best to convert it from
- * the filesystem's locale to UTF-8. Instead, the string will be appropriate for
- * displaying to the user which file they picked.
- * */
-typedef enum {
-  NPChooseFile_Open = 1,
-  NPChooseFile_OpenMultiple = 2,
-  NPChooseFile_Save = 3
-} NPChooseFileMode;
-typedef void (*NPChooseFileCallback)(const char** filePaths,
-                                     uint32_t pathCount,
-                                     void* userData);
-typedef NPError (*NPChooseFilePtr)(
-    NPP instance,
-    const char* mimeTypes,
-    NPChooseFileMode mode,
-    NPChooseFileCallback callback,
-    void* userData);
-
-typedef enum {
-  NPCursorTypePointer = 0,
-  NPCursorTypeCross = 1,
-  NPCursorTypeHand = 2,
-  NPCursorTypeIBeam = 3,
-  NPCursorTypeWait = 4,
-  NPCursorTypeHelp = 5,
-  NPCursorTypeEastResize = 6,
-  NPCursorTypeNorthResize = 7,
-  NPCursorTypeNorthEastResize = 8,
-  NPCursorTypeNorthWestResize = 9,
-  NPCursorTypeSouthResize = 10,
-  NPCursorTypeSouthEastResize = 11,
-  NPCursorTypeSouthWestResize = 12,
-  NPCursorTypeWestResize = 13,
-  NPCursorTypeNorthSouthResize = 14,
-  NPCursorTypeEastWestResize = 15,
-  NPCursorTypeNorthEastSouthWestResize = 16,
-  NPCursorTypeNorthWestSouthEastResize = 17,
-  NPCursorTypeColumnResize = 18,
-  NPCursorTypeRowResize = 19,
-  NPCursorTypeMiddlePanning = 20,
-  NPCursorTypeEastPanning = 21,
-  NPCursorTypeNorthPanning = 22,
-  NPCursorTypeNorthEastPanning = 23,
-  NPCursorTypeNorthWestPanning = 24,
-  NPCursorTypeSouthPanning = 25,
-  NPCursorTypeSouthEastPanning = 26,
-  NPCursorTypeSouthWestPanning = 27,
-  NPCursorTypeWestPanning = 28,
-  NPCursorTypeMove = 29,
-  NPCursorTypeVerticalText = 30,
-  NPCursorTypeCell = 31,
-  NPCursorTypeContextMenu = 32,
-  NPCursorTypeAlias = 33,
-  NPCursorTypeProgress = 34,
-  NPCursorTypeNoDrop = 35,
-  NPCursorTypeCopy = 36,
-  NPCursorTypeNone = 37,
-  NPCursorTypeNotAllowed = 38,
-  NPCursorTypeZoomIn = 39,
-  NPCursorTypeZoomOut = 40
-} NPCursorType;
-
-// Temporary SetCursor API.
-typedef NPError (*NPSetCursorPtr)(
-    NPP instance,
-    NPCursorType type);
-
-/* unique id for each font */
-typedef int NPFontID;
-
-typedef enum {
-  NPCharsetAnsi = 0,
-  NPCharsetDefault = 1,
-  NPCharsetSymbol = 2,
-  NPCharsetMac = 77,
-  NPCharsetShiftJIS = 128,
-  NPCharsetHangul = 129,
-  NPCharsetJohab = 130,
-  NPCharsetGB2312 =134,
-  NPCharsetChineseBIG5 = 136,
-  NPCharsetGreek = 161,
-  NPCharsetTurkish = 162,
-  NPCharsetVietnamese = 163,
-  NPCharsetHebrew = 177,
-  NPCharsetArabic = 178,
-  NPCharsetBaltic = 186,
-  NPCharsetRussian = 204,
-  NPCharsetThai = 222,
-  NPCharsetEastEurope = 238,
-  NPCharsetOEM = 255
-} NPCharset;
-
-typedef enum {
-  NPPitchDefault,
-  NPPitchFixed
-} NPPitch;
-
-typedef enum {
-  NPFamilyDefault,
-  NPFamilyRoman,
-  NPFamilyScript
-} NPFamily;
-
-typedef struct _NPFontDescription {
-  const char* face;
-  int weight;
-  bool italic;
-  NPPitch pitch;
-  NPFamily family;
-  NPCharset charset;
-} NPFontDescription;
-
-// Return a font which best matches the given properties.
-typedef NPError (*NPMatchFontWithFallbackPtr) (
-    NPP instance,
-    const NPFontDescription* description,
-    NPFontID* id);
-
-// Loads a specified font table for the given font.
-//   table: the table in *big-endian* format, or 0 for the whole font file.
-//   output: a buffer of size output_length that gets the data.  can be 0, in
-//     which case output_length will be set to the required size in bytes.
-//   output_length: size of output, if it's not 0.
-typedef NPError (*GetFontTablePtr) (
-    NPP instance,
-    NPFontID id,
-    uint32_t table,
-    void* output,
-    size_t* output_length);
-
-// Destroys a font.
-typedef NPError (*NPDestroyFontPtr) (
-    NPP instance,
-    NPFontID id);
-
-typedef struct _NPFontExtensions {
-  NPMatchFontWithFallbackPtr matchFontWithFallback;
-  GetFontTablePtr getFontTable;
-  NPDestroyFontPtr destroyFont;
-} NPFontExtensions;
-
-typedef NPFontExtensions* (*NPGetFontExtensionsPtr)(
-    NPP instance);
-
-/* Pepper extensions */
-struct NPNExtensions {
-  /* Device interface acquisition */
-  NPAcquireDevicePtr acquireDevice;
-  /* Find */
-  NPNumberOfFindResultsChangedPtr numberOfFindResultsChanged;
-  NPSelectedFindResultChangedPtr selectedFindResultChanged;
-  /* File I/O extensions */
-  NPChooseFilePtr chooseFile;
-  /* Widget */
-  NPGetWidgetExtensionsPtr getWidgetExtensions;
-  /* Cursor */
-  NPSetCursorPtr setCursor;
-  /* Font */
-  NPGetFontExtensionsPtr getFontExtensions;
-};
-
-/* 3D -----------------------------------------------------------------------*/
-
-#define NPPepper3DDevice 2
-
-typedef struct _NPDeviceContext3DConfig {
-  int32_t commandBufferSize;
-} NPDeviceContext3DConfig;
-
-typedef enum _NPDeviceContext3DError {
-  // No error has ocurred.
-  NPDeviceContext3DError_NoError,
-
-  // The size of a command was invalid.
-  NPDeviceContext3DError_InvalidSize,
-
-  // An offset was out of bounds.
-  NPDeviceContext3DError_OutOfBounds,
-
-  // A command was not recognized.
-  NPDeviceContext3DError_UnknownCommand,
-
-  // The arguments to a command were invalid.
-  NPDeviceContext3DError_InvalidArguments,
-
-  // The 3D context was lost, for example due to a power management event. The
-  // context must be destroyed and a new one created.
-  NPDeviceContext3DError_LostContext,
-
-  // Any other error.
-  NPDeviceContext3DError_GenericError
-} NPDeviceContext3DError;
-
-typedef struct _NPDeviceContext3D NPDeviceContext3D;
-
-typedef void (*NPDeviceContext3DRepaintPtr)(NPP npp,
-                                            NPDeviceContext3D* context);
-
-// TODO(apatrick): this need not be exposed when we switch over to the new
-// device API. It's layout can also be implementation dependent.
-typedef struct _NPDeviceContext3D
-{
-  void* reserved;
-
-  // If true, then a flush will only complete once the get offset has advanced
-  // on the GPU thread. If false, then the get offset might have changed but
-  // the GPU thread will respond as quickly as possible without guaranteeing
-  // having made any progress in executing pending commands. Set to true
-  // to ensure that progress is made or when flushing in a loop waiting for the
-  // GPU to reach a certain state, for example in advancing beyond a particular
-  // token. Set to false when flushing to query the current state, for example
-  // whether an error has occurred.
-  bool waitForProgress;
-
-  // Buffer in which commands are stored.
-  void* commandBuffer;
-  int32_t commandBufferSize;
-
-  // Offset in command buffer reader has reached. Synchronized on flush.
-  int32_t getOffset;
-
-  // Offset in command buffer writer has reached. Synchronized on flush.
-  int32_t putOffset;
-
-  // Last processed token. Synchronized on flush.
-  int32_t token;
-
-  // Callback invoked on the main thread when the context must be repainted.
-  // TODO(apatrick): move this out of the context struct like the rest of the
-  // fields.
-  NPDeviceContext3DRepaintPtr repaintCallback;
-
-  // Error status. Synchronized on flush.
-  NPDeviceContext3DError error;
-} NPDeviceContext3D;
-
-
-/* Begin 3D specific portion of experimental device API */
-
-/* Device buffer ID reserved for command buffer */
-enum {
-  NP3DCommandBufferId = 0
-};
-
-/* 3D attributes */
-enum {
-  /* Example GetConfigAttribs attributes. See EGL 1.4 spec. */
-  /* These may be passed to GetConfigAttribs. */
-  NP3DAttrib_BufferSize        = 0x3020,
-  NP3DAttrib_AlphaSize         = 0x3021,
-  NP3DAttrib_BlueSize          = 0x3022,
-  NP3DAttrib_GreenSize         = 0x3023,
-  NP3DAttrib_RedSize           = 0x3024,
-  NP3DAttrib_DepthSize         = 0x3025,
-  NP3DAttrib_StencilSize       = 0x3026,
-  NP3DAttrib_SurfaceType       = 0x3033,
-
-  /* Example CreateContext attributes. See EGL 1.4 spec. */
-  /* These may be passed to CreateContext. */
-  NP3DAttrib_SwapBehavior       = 0x3093,
-  NP3DAttrib_MultisampleResolve = 0x3099,
-
-  /* Size of command buffer in 32-bit entries. */
-  /* This may be passed to CreateContext as an input or SynchronizeContext as */
-  /* an output. */
-  NP3DAttrib_CommandBufferSize  = 0x10000000,
-
-  /* These may be passed to SynchronizeContext. */
-
-  /* Offset in command buffer writer has reached. In / out.*/
-  NP3DAttrib_PutOffset,
-
-  /* Offset in command buffer reader has reached. Out only. */
-  NP3DAttrib_GetOffset,
-
-  /* Last processed token. Out only. */
-  NP3DAttrib_Token
-};
-
-/* 3D callbacks */
-enum {
-  /* This callback is invoked whenever the plugin must repaint everything.    */
-  /* This might be because the window manager must repaint a window or        */
-  /* the context has been lost, for example a power management event.         */
-  NP3DCallback_Repaint = 1
-};
-
-/* Flags for NPConfig3DOutAttrib_SurfaceType */
-enum {
-  NP3DSurfaceType_MultisampleResolveBox = 0x0200,
-  NP3DSurfaceType_SwapBehaviorPreserved = 0x0400
-};
-
-/* Values for NPConfig3DInAttrib_SwapBehavior */
-enum {
-  NP3DSwapBehavior_Preserved            = 0x3094,
-  NP3DSwapBehavior_Destroyed            = 0x3095
-};
-
-/* Values for NPConfig3DInAttrib_MultisampleResolve */
-enum {
-  NP3DMultisampleResolve_Default        = 0x309A,
-  NP3DMultisampleResolve_Box            = 0x309B
-};
-
-/* End 3D specific API */
-
-/* Audio --------------------------------------------------------------------*/
-
-#define NPPepperAudioDevice 3
-
-/* min & max sample frame count */
-typedef enum {
-  NPAudioMinSampleFrameCount = 64,
-  NPAudioMaxSampleFrameCount = 32768
-} NPAudioSampleFrameCounts;
-
-/* supported sample rates */
-typedef enum {
-  NPAudioSampleRate44100Hz = 44100,
-  NPAudioSampleRate48000Hz = 48000,
-  NPAudioSampleRate96000Hz = 96000
-} NPAudioSampleRates;
-
-/* supported sample formats */
-typedef enum {
-  NPAudioSampleTypeInt16   = 0,
-  NPAudioSampleTypeFloat32 = 1
-} NPAudioSampleTypes;
-
-/* supported channel layouts */
-/* there is code that depends on these being the actual number of channels */
-typedef enum {
-  NPAudioChannelNone     = 0,
-  NPAudioChannelMono     = 1,
-  NPAudioChannelStereo   = 2,
-  NPAudioChannelThree    = 3,
-  NPAudioChannelFour     = 4,
-  NPAudioChannelFive     = 5,
-  NPAudioChannelFiveOne  = 6,
-  NPAudioChannelSeven    = 7,
-  NPAudioChannelSevenOne = 8
-} NPAudioChannels;
-
-/* audio context states */
-typedef enum {
-  NPAudioContextStateCallback = 0,
-  NPAudioContextStateUnderrunCounter = 1
-} NPAudioContextStates;
-
-/* audio context state values */
-typedef enum {
-  NPAudioCallbackStop = 0,
-  NPAudioCallbackStart = 1
-} NPAudioContextStateValues;
-
-/* audio query capabilities */
-typedef enum {
-  NPAudioCapabilitySampleRate              = 0,
-  NPAudioCapabilitySampleType              = 1,
-  NPAudioCapabilitySampleFrameCount        = 2,
-  NPAudioCapabilitySampleFrameCount44100Hz = 3,
-  NPAudioCapabilitySampleFrameCount48000Hz = 4,
-  NPAudioCapabilitySampleFrameCount96000Hz = 5,
-  NPAudioCapabilityOutputChannelMap        = 6,
-  NPAudioCapabilityInputChannelMap         = 7
-} NPAudioCapabilities;
-
-typedef struct _NPDeviceContextAudio NPDeviceContextAudio;
-
-/* user supplied callback function */
-typedef void (*NPAudioCallback)(NPDeviceContextAudio *context);
-
-typedef struct _NPDeviceContextAudioConfig {
-  int32_t sampleRate;
-  int32_t sampleType;
-  int32_t outputChannelMap;
-  int32_t inputChannelMap;
-  int32_t sampleFrameCount;
-  uint32_t startThread;
-  uint32_t flags;
-  NPAudioCallback callback;
-  void *userData;
-} NPDeviceContextAudioConfig;
-
-struct _NPDeviceContextAudio {
-  NPDeviceContextAudioConfig config;
-  void *outBuffer;
-  void *inBuffer;
-  void *reserved;
-};
-
-/* Printing related APIs ---------------------------------------------------*/
-
-/* Defines a contiguous range of pages to be printed. Page numbers use a
- * zero-based index. */
-typedef struct _NPPrintPageNumberRange {
-  int32_t firstPageNumber;
-  int32_t lastPageNumber;
-} NPPrintPageNumberRange;
-
-/* Being a print operation. Returns the total number of pages to print at the
- * given printableArea size and DPI. printableArea is in points (a point is 1/72
- * of an inch). The plugin is expected to remember the values of printableArea
- * and printerDPI for use in subsequent print interface calls. These values
- * should be cleared in printEnd. */
-typedef NPError (*NPPPrintBeginPtr) (
-    NPP instance,
-    NPRect* printableArea,
-    int32_t printerDPI,
-    int32_t* numPages);
-/* Returns the required raster dimensions for the given page. */
-typedef NPError (*NPPGetRasterDimensionsPtr) (
-    NPP instance,
-    int32_t pageNumber,
-    int32_t* widthInPixels,
-    int32_t* heightInPixels);
-/* Prints the specified page This allows the plugin to print a raster output. */
-typedef NPError (*NPPPrintPageRasterPtr) (
-    NPP instance,
-    int32_t pageNumber,
-    NPDeviceContext2D* printSurface);
-/* Ends the print operation */
-typedef NPError (*NPPPrintEndPtr) (NPP instance);
-/* Prints the specified pages as PDF. The plugin allocates the output buffer
- * pointed to by pdf_output using the browser-supplied NPN_MemAlloc function.
- * The caller is expected to free the output buffer upon success.*/
-typedef NPError (*NPPrintPagesAsPDFPtr)(NPP instance,
-                                        NPPrintPageNumberRange* page_ranges,
-                                        int32_t page_range_count,
-                                        unsigned char** pdf_output,
-                                        int32_t* output_size);
-
-
-/* TODO(sanjeevr) : Provide a vector interface for printing. We need to decide
- * on a vector format that can support embedded fonts. A vector format will
- * greatly reduce the size of the required output buffer. */
-
-typedef struct _NPPPrintExtensions {
-  NPPPrintBeginPtr printBegin;
-  NPPGetRasterDimensionsPtr getRasterDimensions;
-  NPPPrintPageRasterPtr printPageRaster;
-  NPPPrintEndPtr printEnd;
-  NPPrintPagesAsPDFPtr printPagesAsPDF;
-} NPPPrintExtensions;
-
-/* Returns NULL if the plugin does not support print extensions */
-typedef NPPPrintExtensions* (*NPPGetPrintExtensionsPtr)(NPP instance);
-
-/* Find ---------------------------------------------------------------------*/
-
-/* Finds the given UTF-8 text starting at the current selection.  The number of
- * results will be updated asynchronously via numberOfFindResultsChanged.  Note
- * that multiple StartFind calls can happen before StopFind is called in the
- * case of the search term changing. */
-typedef NPError (*NPPStartFindPtr) (
-    NPP instance,
-    const char* text,
-    bool caseSensitive);
-
-/* Go to the next/previous result. */
-typedef NPError (*NPPSelectFindResultPtr) (
-    NPP instance,
-    bool forward);
-
-/* Tells the plugin that the find operation has stopped, so it should clear
- * any highlighting. */
-typedef NPError (*NPPStopFindPtr) (
-    NPP instance);
-
-typedef struct _NPPFindExtensions {
-  NPPStartFindPtr startFind;
-  NPPSelectFindResultPtr selectFindResult;
-  NPPStopFindPtr stopFind;
-} NPPFindExtensions;
-
-/* Returns NULL if the plugin does not support find extensions. */
-typedef NPPFindExtensions* (*NPPGetFindExtensionsPtr)(NPP instance);
-
-/* Zooms a plugin to the given factor.  If text_only is true, then only the text
- * should be zoomed. */
-typedef NPError (*NPPZoomPtr) (
-    NPP instance,
-    float factor,
-    bool text_only);
-
-typedef NPError (*NPPWidgetPropertyChangedPtr) (
-    NPP instance,
-    NPWidgetID id,
-    NPWidgetProperty property);
-
-/* type of selection */
-typedef enum {
-  NPSelectionTypeAny       = 0,
-  NPSelectionTypePlainText = 1,
-  NPSelectionTypeHTML      = 2
-} NPSelectionType;
-
-/* Gets the selection.  NPERR_GENERIC_ERROR is returned if nothing is selected.
- * 'type' is both an input and output parameter.  The caller can request a
- * specific type, and if the plugin can't provide it, it will return
- * NPERR_GENERIC_ERROR.  Or the caller can specify NPSelectionTypeAny to let the
- * plugin pick the best format for the data.  The result is returned in a buffer
- * that's owned by the caller and which is allocated using NPN_MemAlloc.  If no
- * data is available, NPERR_GENERIC_ERROR is returned. */
-typedef NPError (*NPPGetSelectionPtr) (
-    NPP instance,
-    NPSelectionType* type,
-    void** data);
-
-typedef struct _NPPExtensions {
-  NPPGetPrintExtensionsPtr getPrintExtensions;
-  NPPGetFindExtensionsPtr getFindExtensions;
-  NPPZoomPtr zoom;
-  NPPWidgetPropertyChangedPtr widgetPropertyChanged;
-  NPPGetSelectionPtr getSelection;
-} NPPExtensions;
-
-#endif  /* _NP_EXTENSIONS_H_ */
diff --git a/third_party/npapi/bindings/npapi_extensions_private.h b/third_party/npapi/bindings/npapi_extensions_private.h
deleted file mode 100644
index 3b0a4587..0000000
--- a/third_party/npapi/bindings/npapi_extensions_private.h
+++ /dev/null
@@ -1,27 +0,0 @@
-/* Copyright (c) 2006-2010 The Chromium Authors. All rights reserved.
- * Use of this source code is governed by a BSD-style license that can be
- * found in the LICENSE file.
- */
-
-#ifndef _NP_EXTENSIONS_PRIVATE_H_
-#define _NP_EXTENSIONS_PRIVATE_H_
-
-#include "third_party/npapi/bindings/npapi.h"
-
-// Some reserved GetStateContext/SetStateContext selectors.
-typedef enum {
-  NPExtensionsReservedStateSharedMemory = 66536,
-  // Used by the Device2D and Audio devices to return a pointer to the
-  // structure used to implement the shared memory buffer for the device.
-  NPExtensionsReservedStateSharedMemorySize = 66537,
-  // Used by the Audio device to return a pointer to the
-  // structure used to implement the shared memory buffer for the device.
-  NPExtensionsReservedStateSyncChannel = 66538,
-  // Used by the Audio device to return a pointer to the
-  // structure used to implement the synchronization channel for the device.
-  NPExtensionsReservedStateSharedMemoryChecksum = 66539
-  // Used by the Device2D to return the CRC32 checksum of the content
-  // stored in the shared memory buffer for the device.
-} NPExtensionsReservedStates;
-
-#endif  /* _NP_EXTENSIONS_PRIVATE_H_ */
diff --git a/third_party/npapi/bindings/npapi_x11.h b/third_party/npapi/bindings/npapi_x11.h
deleted file mode 100644
index 84ca0789..0000000
--- a/third_party/npapi/bindings/npapi_x11.h
+++ /dev/null
@@ -1,62 +0,0 @@
-/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 1998
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#ifndef THIRD_PARTY_NPAPI_BINDINGS_NPAPI_X11_H_
-#define THIRD_PARTY_NPAPI_BINDINGS_NPAPI_X11_H_
-
-// This file was split off the original npapi.h, to avoid including intrusive X
-// headers unless necessary.
-
-#include "third_party/npapi/bindings/npapi.h"
-
-#ifdef XP_UNIX
-#include <X11/Xlib.h>
-#include <X11/Xutil.h>
-
-typedef struct _NPSetWindowCallbackStruct
-{
-  int32_t      type;
-#ifdef MOZ_X11
-  Display*     display;
-  Visual*      visual;
-  Colormap     colormap;
-  unsigned int depth;
-#endif
-} NPSetWindowCallbackStruct;
-#endif
-
-#endif  // THIRD_PARTY_NPAPI_BINDINGS_NPAPI_X11_H_
diff --git a/third_party/npapi/bindings/npfunctions.h b/third_party/npapi/bindings/npfunctions.h
deleted file mode 100644
index f755b04..0000000
--- a/third_party/npapi/bindings/npfunctions.h
+++ /dev/null
@@ -1,239 +0,0 @@
-/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 1998
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#ifndef npfunctions_h_
-#define npfunctions_h_
-
-#ifdef __OS2__
-#pragma pack(1)
-#define NP_LOADDS _System
-#else
-#define NP_LOADDS
-#endif
-
-#include "npapi.h"
-#include "npruntime.h"
-
-typedef NPError      (* NP_LOADDS NPP_NewProcPtr)(NPMIMEType pluginType, NPP instance, uint16_t mode, int16_t argc, char* argn[], char* argv[], NPSavedData* saved);
-typedef NPError      (* NP_LOADDS NPP_DestroyProcPtr)(NPP instance, NPSavedData** save);
-typedef NPError      (* NP_LOADDS NPP_SetWindowProcPtr)(NPP instance, NPWindow* window);
-typedef NPError      (* NP_LOADDS NPP_NewStreamProcPtr)(NPP instance, NPMIMEType type, NPStream* stream, NPBool seekable, uint16_t* stype);
-typedef NPError      (* NP_LOADDS NPP_DestroyStreamProcPtr)(NPP instance, NPStream* stream, NPReason reason);
-typedef int32_t      (* NP_LOADDS NPP_WriteReadyProcPtr)(NPP instance, NPStream* stream);
-typedef int32_t      (* NP_LOADDS NPP_WriteProcPtr)(NPP instance, NPStream* stream, int32_t offset, int32_t len, void* buffer);
-typedef void         (* NP_LOADDS NPP_StreamAsFileProcPtr)(NPP instance, NPStream* stream, const char* fname);
-typedef void         (* NP_LOADDS NPP_PrintProcPtr)(NPP instance, NPPrint* platformPrint);
-typedef int16_t      (* NP_LOADDS NPP_HandleEventProcPtr)(NPP instance, void* event);
-typedef void         (* NP_LOADDS NPP_URLNotifyProcPtr)(NPP instance, const char* url, NPReason reason, void* notifyData);
-/* Any NPObjects returned to the browser via NPP_GetValue should be retained
-   by the plugin on the way out. The browser is responsible for releasing. */
-typedef NPError      (* NP_LOADDS NPP_GetValueProcPtr)(NPP instance, NPPVariable variable, void *ret_value);
-typedef NPError      (* NP_LOADDS NPP_SetValueProcPtr)(NPP instance, NPNVariable variable, void *value);
-typedef NPBool       (* NP_LOADDS NPP_GotFocusPtr)(NPP instance, NPFocusDirection direction);
-typedef void         (* NP_LOADDS NPP_LostFocusPtr)(NPP instance);
-typedef void         (* NP_LOADDS NPP_URLRedirectNotifyPtr)(NPP instance, const char* url, int32_t status, void* notifyData);
-typedef NPError      (* NP_LOADDS NPP_ClearSiteDataPtr)(const char* site, uint64_t flags, uint64_t maxAge);
-typedef char**       (* NP_LOADDS NPP_GetSitesWithDataPtr)(void);
-
-typedef NPError      (*NPN_GetValueProcPtr)(NPP instance, NPNVariable variable, void *ret_value);
-typedef NPError      (*NPN_SetValueProcPtr)(NPP instance, NPPVariable variable, void *value);
-typedef NPError      (*NPN_GetURLNotifyProcPtr)(NPP instance, const char* url, const char* window, void* notifyData);
-typedef NPError      (*NPN_PostURLNotifyProcPtr)(NPP instance, const char* url, const char* window, uint32_t len, const char* buf, NPBool file, void* notifyData);
-typedef NPError      (*NPN_GetURLProcPtr)(NPP instance, const char* url, const char* window);
-typedef NPError      (*NPN_PostURLProcPtr)(NPP instance, const char* url, const char* window, uint32_t len, const char* buf, NPBool file);
-typedef NPError      (*NPN_RequestReadProcPtr)(NPStream* stream, NPByteRange* rangeList);
-typedef NPError      (*NPN_NewStreamProcPtr)(NPP instance, NPMIMEType type, const char* window, NPStream** stream);
-typedef int32_t      (*NPN_WriteProcPtr)(NPP instance, NPStream* stream, int32_t len, void* buffer);
-typedef NPError      (*NPN_DestroyStreamProcPtr)(NPP instance, NPStream* stream, NPReason reason);
-typedef void         (*NPN_StatusProcPtr)(NPP instance, const char* message);
-/* Browser manages the lifetime of the buffer returned by NPN_UserAgent, don't
-   depend on it sticking around and don't free it. */
-typedef const char*  (*NPN_UserAgentProcPtr)(NPP instance);
-typedef void*        (*NPN_MemAllocProcPtr)(uint32_t size);
-typedef void         (*NPN_MemFreeProcPtr)(void* ptr);
-typedef uint32_t     (*NPN_MemFlushProcPtr)(uint32_t size);
-typedef void         (*NPN_ReloadPluginsProcPtr)(NPBool reloadPages);
-typedef void*        (*NPN_GetJavaEnvProcPtr)(void);
-typedef void*        (*NPN_GetJavaPeerProcPtr)(NPP instance);
-typedef void         (*NPN_InvalidateRectProcPtr)(NPP instance, NPRect *rect);
-typedef void         (*NPN_InvalidateRegionProcPtr)(NPP instance, NPRegion region);
-typedef void         (*NPN_ForceRedrawProcPtr)(NPP instance);
-typedef NPIdentifier (*NPN_GetStringIdentifierProcPtr)(const NPUTF8* name);
-typedef void         (*NPN_GetStringIdentifiersProcPtr)(const NPUTF8** names, int32_t nameCount, NPIdentifier* identifiers);
-typedef NPIdentifier (*NPN_GetIntIdentifierProcPtr)(int32_t intid);
-typedef bool         (*NPN_IdentifierIsStringProcPtr)(NPIdentifier identifier);
-typedef NPUTF8*      (*NPN_UTF8FromIdentifierProcPtr)(NPIdentifier identifier);
-typedef int32_t      (*NPN_IntFromIdentifierProcPtr)(NPIdentifier identifier);
-typedef NPObject*    (*NPN_CreateObjectProcPtr)(NPP npp, NPClass *aClass);
-typedef NPObject*    (*NPN_RetainObjectProcPtr)(NPObject *obj);
-typedef void         (*NPN_ReleaseObjectProcPtr)(NPObject *obj);
-typedef bool         (*NPN_InvokeProcPtr)(NPP npp, NPObject* obj, NPIdentifier methodName, const NPVariant *args, uint32_t argCount, NPVariant *result);
-typedef bool         (*NPN_InvokeDefaultProcPtr)(NPP npp, NPObject* obj, const NPVariant *args, uint32_t argCount, NPVariant *result);
-typedef bool         (*NPN_EvaluateProcPtr)(NPP npp, NPObject *obj, NPString *script, NPVariant *result);
-typedef bool         (*NPN_GetPropertyProcPtr)(NPP npp, NPObject *obj, NPIdentifier propertyName, NPVariant *result);
-typedef bool         (*NPN_SetPropertyProcPtr)(NPP npp, NPObject *obj, NPIdentifier propertyName, const NPVariant *value);
-typedef bool         (*NPN_RemovePropertyProcPtr)(NPP npp, NPObject *obj, NPIdentifier propertyName);
-typedef bool         (*NPN_HasPropertyProcPtr)(NPP npp, NPObject *obj, NPIdentifier propertyName);
-typedef bool         (*NPN_HasMethodProcPtr)(NPP npp, NPObject *obj, NPIdentifier propertyName);
-typedef void         (*NPN_ReleaseVariantValueProcPtr)(NPVariant *variant);
-typedef void         (*NPN_SetExceptionProcPtr)(NPObject *obj, const NPUTF8 *message);
-typedef void         (*NPN_PushPopupsEnabledStateProcPtr)(NPP npp, NPBool enabled);
-typedef void         (*NPN_PopPopupsEnabledStateProcPtr)(NPP npp);
-typedef bool         (*NPN_EnumerateProcPtr)(NPP npp, NPObject *obj, NPIdentifier **identifier, uint32_t *count);
-typedef void         (*NPN_PluginThreadAsyncCallProcPtr)(NPP instance, void (*func)(void *), void *userData);
-typedef bool         (*NPN_ConstructProcPtr)(NPP npp, NPObject* obj, const NPVariant *args, uint32_t argCount, NPVariant *result);
-typedef NPError      (*NPN_GetValueForURLPtr)(NPP npp, NPNURLVariable variable, const char *url, char **value, uint32_t *len);
-typedef NPError      (*NPN_SetValueForURLPtr)(NPP npp, NPNURLVariable variable, const char *url, const char *value, uint32_t len);
-typedef NPError      (*NPN_GetAuthenticationInfoPtr)(NPP npp, const char *protocol, const char *host, int32_t port, const char *scheme, const char *realm, char **username, uint32_t *ulen, char **password, uint32_t *plen);
-typedef uint32_t     (*NPN_ScheduleTimerPtr)(NPP instance, uint32_t interval, NPBool repeat, void (*timerFunc)(NPP npp, uint32_t timerID));
-typedef void         (*NPN_UnscheduleTimerPtr)(NPP instance, uint32_t timerID);
-typedef NPError      (*NPN_PopUpContextMenuPtr)(NPP instance, NPMenu* menu);
-typedef NPBool       (*NPN_ConvertPointPtr)(NPP instance, double sourceX, double sourceY, NPCoordinateSpace sourceSpace, double *destX, double *destY, NPCoordinateSpace destSpace);
-typedef NPBool       (*NPN_HandleEventPtr)(NPP instance, void *event, NPBool handled);
-typedef NPBool       (*NPN_UnfocusInstancePtr)(NPP instance, NPFocusDirection direction);
-typedef void         (*NPN_URLRedirectResponsePtr)(NPP instance, void* notifyData, NPBool allow);
-
-typedef struct _NPPluginFuncs {
-  uint16_t size;
-  uint16_t version;
-  NPP_NewProcPtr newp;
-  NPP_DestroyProcPtr destroy;
-  NPP_SetWindowProcPtr setwindow;
-  NPP_NewStreamProcPtr newstream;
-  NPP_DestroyStreamProcPtr destroystream;
-  NPP_StreamAsFileProcPtr asfile;
-  NPP_WriteReadyProcPtr writeready;
-  NPP_WriteProcPtr write;
-  NPP_PrintProcPtr print;
-  NPP_HandleEventProcPtr event;
-  NPP_URLNotifyProcPtr urlnotify;
-  void* javaClass;
-  NPP_GetValueProcPtr getvalue;
-  NPP_SetValueProcPtr setvalue;
-  NPP_GotFocusPtr gotfocus;
-  NPP_LostFocusPtr lostfocus;
-  NPP_URLRedirectNotifyPtr urlredirectnotify;
-  NPP_ClearSiteDataPtr clearsitedata;
-  NPP_GetSitesWithDataPtr getsiteswithdata;
-} NPPluginFuncs;
-
-typedef struct _NPNetscapeFuncs {
-  uint16_t size;
-  uint16_t version;
-  NPN_GetURLProcPtr geturl;
-  NPN_PostURLProcPtr posturl;
-  NPN_RequestReadProcPtr requestread;
-  NPN_NewStreamProcPtr newstream;
-  NPN_WriteProcPtr write;
-  NPN_DestroyStreamProcPtr destroystream;
-  NPN_StatusProcPtr status;
-  NPN_UserAgentProcPtr uagent;
-  NPN_MemAllocProcPtr memalloc;
-  NPN_MemFreeProcPtr memfree;
-  NPN_MemFlushProcPtr memflush;
-  NPN_ReloadPluginsProcPtr reloadplugins;
-  NPN_GetJavaEnvProcPtr getJavaEnv;
-  NPN_GetJavaPeerProcPtr getJavaPeer;
-  NPN_GetURLNotifyProcPtr geturlnotify;
-  NPN_PostURLNotifyProcPtr posturlnotify;
-  NPN_GetValueProcPtr getvalue;
-  NPN_SetValueProcPtr setvalue;
-  NPN_InvalidateRectProcPtr invalidaterect;
-  NPN_InvalidateRegionProcPtr invalidateregion;
-  NPN_ForceRedrawProcPtr forceredraw;
-  NPN_GetStringIdentifierProcPtr getstringidentifier;
-  NPN_GetStringIdentifiersProcPtr getstringidentifiers;
-  NPN_GetIntIdentifierProcPtr getintidentifier;
-  NPN_IdentifierIsStringProcPtr identifierisstring;
-  NPN_UTF8FromIdentifierProcPtr utf8fromidentifier;
-  NPN_IntFromIdentifierProcPtr intfromidentifier;
-  NPN_CreateObjectProcPtr createobject;
-  NPN_RetainObjectProcPtr retainobject;
-  NPN_ReleaseObjectProcPtr releaseobject;
-  NPN_InvokeProcPtr invoke;
-  NPN_InvokeDefaultProcPtr invokeDefault;
-  NPN_EvaluateProcPtr evaluate;
-  NPN_GetPropertyProcPtr getproperty;
-  NPN_SetPropertyProcPtr setproperty;
-  NPN_RemovePropertyProcPtr removeproperty;
-  NPN_HasPropertyProcPtr hasproperty;
-  NPN_HasMethodProcPtr hasmethod;
-  NPN_ReleaseVariantValueProcPtr releasevariantvalue;
-  NPN_SetExceptionProcPtr setexception;
-  NPN_PushPopupsEnabledStateProcPtr pushpopupsenabledstate;
-  NPN_PopPopupsEnabledStateProcPtr poppopupsenabledstate;
-  NPN_EnumerateProcPtr enumerate;
-  NPN_PluginThreadAsyncCallProcPtr pluginthreadasynccall;
-  NPN_ConstructProcPtr construct;
-  NPN_GetValueForURLPtr getvalueforurl;
-  NPN_SetValueForURLPtr setvalueforurl;
-  NPN_GetAuthenticationInfoPtr getauthenticationinfo;
-  NPN_ScheduleTimerPtr scheduletimer;
-  NPN_UnscheduleTimerPtr unscheduletimer;
-  NPN_PopUpContextMenuPtr popupcontextmenu;
-  NPN_ConvertPointPtr convertpoint;
-  NPN_HandleEventPtr handleevent;
-  NPN_UnfocusInstancePtr unfocusinstance;
-  NPN_URLRedirectResponsePtr urlredirectresponse;
-} NPNetscapeFuncs;
-
-#ifdef XP_MACOSX
-/*
- * Mac OS X version(s) of NP_GetMIMEDescription(const char *)
- * These can be called to retreive MIME information from the plugin dynamically
- *
- * Note: For compatibility with Quicktime, BPSupportedMIMEtypes is another way
- *       to get mime info from the plugin only on OSX and may not be supported
- *       in furture version -- use NP_GetMIMEDescription instead
- */
-enum
-{
- kBPSupportedMIMETypesStructVers_1    = 1
-};
-typedef struct _BPSupportedMIMETypes
-{
- SInt32    structVersion;      /* struct version */
- Handle    typeStrings;        /* STR# formated handle, allocated by plugin */
- Handle    infoStrings;        /* STR# formated handle, allocated by plugin */
-} BPSupportedMIMETypes;
-OSErr BP_GetSupportedMIMETypes(BPSupportedMIMETypes *mimeInfo, UInt32 flags);
-#define NP_GETMIMEDESCRIPTION_NAME "NP_GetMIMEDescription"
-typedef const char* (*NP_GetMIMEDescriptionProcPtr)(void);
-typedef OSErr (*BP_GetSupportedMIMETypesProcPtr)(BPSupportedMIMETypes*, UInt32);
-#endif
-
-#endif /* npfunctions_h_ */
diff --git a/third_party/npapi/bindings/nphostapi.h b/third_party/npapi/bindings/nphostapi.h
deleted file mode 100644
index aebf6f14..0000000
--- a/third_party/npapi/bindings/nphostapi.h
+++ /dev/null
@@ -1,40 +0,0 @@
-// Copyright (c) 2010 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef _NPHOSTAPI_H_
-#define _NPHOSTAPI_H_
-
-#include "third_party/npapi/bindings/npapi.h"
-#include "third_party/npapi/bindings/npapi_extensions.h"
-#include "third_party/npapi/bindings/npfunctions.h"
-#include "third_party/npapi/bindings/npruntime.h"
-
-// Define an OS-neutral wrapper for shared library entry points
-#if defined(OS_WIN)
-#define API_CALL __stdcall
-#else
-#define API_CALL
-#endif
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-//
-// NPAPI library entry points
-//
-#if defined(OS_POSIX) && !defined(OS_MACOSX)
-typedef NPError (API_CALL * NP_InitializeFunc)(NPNetscapeFuncs* pNFuncs,
-                                               NPPluginFuncs* pPFuncs);
-#else
-typedef NPError (API_CALL * NP_InitializeFunc)(NPNetscapeFuncs* pFuncs);
-typedef NPError (API_CALL * NP_GetEntryPointsFunc)(NPPluginFuncs* pFuncs);
-#endif
-typedef NPError (API_CALL * NP_ShutdownFunc)(void);
-
-#ifdef __cplusplus
-} // extern "C"
-#endif
-
-#endif // _NPHOSTAPI_H_
diff --git a/third_party/npapi/bindings/npruntime.h b/third_party/npapi/bindings/npruntime.h
deleted file mode 100644
index 9f7848c..0000000
--- a/third_party/npapi/bindings/npruntime.h
+++ /dev/null
@@ -1,397 +0,0 @@
-/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
-/*
- * Copyright (c) 2004, Apple Computer, Inc. and The Mozilla Foundation.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- * 3. Neither the names of Apple Computer, Inc. ("Apple") or The Mozilla
- * Foundation ("Mozilla") nor the names of their contributors may be used
- * to endorse or promote products derived from this software without
- * specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE, MOZILLA AND THEIR CONTRIBUTORS "AS
- * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
- * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE, MOZILLA OR
- * THEIR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
- * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- */
-#ifndef _NP_RUNTIME_H_
-#define _NP_RUNTIME_H_
-
-// BEGIN GOOGLE MODIFICATIONS
-#include "npapi.h"
-// END GOOGLE MODIFICATIONS
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-#include "nptypes.h"
-
-/*
-    This API is used to facilitate binding code written in C to script
-    objects.  The API in this header does not assume the presence of a
-    user agent.  That is, it can be used to bind C code to scripting
-    environments outside of the context of a user agent.
-
-    However, the normal use of the this API is in the context of a
-    scripting environment running in a browser or other user agent.
-    In particular it is used to support the extended Netscape
-    script-ability API for plugins (NP-SAP).  NP-SAP is an extension
-    of the Netscape plugin API.  As such we have adopted the use of
-    the "NP" prefix for this API.
-
-    The following NP{N|P}Variables were added to the Netscape plugin
-    API (in npapi.h):
-
-    NPNVWindowNPObject
-    NPNVPluginElementNPObject
-    NPPVpluginScriptableNPObject
-
-    These variables are exposed through NPN_GetValue() and
-    NPP_GetValue() (respectively) and are used to establish the
-    initial binding between the user agent and native code.  The DOM
-    objects in the user agent can be examined and manipulated using
-    the NPN_ functions that operate on NPObjects described in this
-    header.
-
-    To the extent possible the assumptions about the scripting
-    language used by the scripting environment have been minimized.
-*/
-
-#define NP_BEGIN_MACRO  do {
-#define NP_END_MACRO    } while (0)
-
-/*
-    Objects (non-primitive data) passed between 'C' and script is
-    always wrapped in an NPObject.  The 'interface' of an NPObject is
-    described by an NPClass.
-*/
-typedef struct NPObject NPObject;
-typedef struct NPClass NPClass;
-
-typedef char NPUTF8;
-typedef struct _NPString {
-    const NPUTF8 *UTF8Characters;
-    uint32_t UTF8Length;
-} NPString;
-
-typedef enum {
-    NPVariantType_Void,
-    NPVariantType_Null,
-    NPVariantType_Bool,
-    NPVariantType_Int32,
-    NPVariantType_Double,
-    NPVariantType_String,
-    NPVariantType_Object
-} NPVariantType;
-
-typedef struct _NPVariant {
-    NPVariantType type;
-    union {
-        bool boolValue;
-        int32_t intValue;
-        double doubleValue;
-        NPString stringValue;
-        NPObject *objectValue;
-    } value;
-} NPVariant;
-
-/*
-    NPN_ReleaseVariantValue is called on all 'out' parameters
-    references.  Specifically it is to be called on variants that own
-    their value, as is the case with all non-const NPVariant*
-    arguments after a successful call to any methods (except this one)
-    in this API.
-
-    After calling NPN_ReleaseVariantValue, the type of the variant
-    will be NPVariantType_Void.
-*/
-void NPN_ReleaseVariantValue(NPVariant *variant);
-
-#define NPVARIANT_IS_VOID(_v)    ((_v).type == NPVariantType_Void)
-#define NPVARIANT_IS_NULL(_v)    ((_v).type == NPVariantType_Null)
-#define NPVARIANT_IS_BOOLEAN(_v) ((_v).type == NPVariantType_Bool)
-#define NPVARIANT_IS_INT32(_v)   ((_v).type == NPVariantType_Int32)
-#define NPVARIANT_IS_DOUBLE(_v)  ((_v).type == NPVariantType_Double)
-#define NPVARIANT_IS_STRING(_v)  ((_v).type == NPVariantType_String)
-#define NPVARIANT_IS_OBJECT(_v)  ((_v).type == NPVariantType_Object)
-
-#define NPVARIANT_TO_BOOLEAN(_v) ((_v).value.boolValue)
-#define NPVARIANT_TO_INT32(_v)   ((_v).value.intValue)
-#define NPVARIANT_TO_DOUBLE(_v)  ((_v).value.doubleValue)
-#define NPVARIANT_TO_STRING(_v)  ((_v).value.stringValue)
-#define NPVARIANT_TO_OBJECT(_v)  ((_v).value.objectValue)
-
-#define VOID_TO_NPVARIANT(_v)                                                 \
-NP_BEGIN_MACRO                                                                \
-    (_v).type = NPVariantType_Void;                                           \
-    (_v).value.objectValue = NULL;                                            \
-NP_END_MACRO
-
-#define NULL_TO_NPVARIANT(_v)                                                 \
-NP_BEGIN_MACRO                                                                \
-    (_v).type = NPVariantType_Null;                                           \
-    (_v).value.objectValue = NULL;                                            \
-NP_END_MACRO
-
-#define BOOLEAN_TO_NPVARIANT(_val, _v)                                        \
-NP_BEGIN_MACRO                                                                \
-    (_v).type = NPVariantType_Bool;                                           \
-    (_v).value.boolValue = !!(_val);                                          \
-NP_END_MACRO
-
-#define INT32_TO_NPVARIANT(_val, _v)                                          \
-NP_BEGIN_MACRO                                                                \
-    (_v).type = NPVariantType_Int32;                                          \
-    (_v).value.intValue = _val;                                               \
-NP_END_MACRO
-
-#define DOUBLE_TO_NPVARIANT(_val, _v)                                         \
-NP_BEGIN_MACRO                                                                \
-    (_v).type = NPVariantType_Double;                                         \
-    (_v).value.doubleValue = _val;                                            \
-NP_END_MACRO
-
-#define STRINGZ_TO_NPVARIANT(_val, _v)                                        \
-NP_BEGIN_MACRO                                                                \
-    (_v).type = NPVariantType_String;                                         \
-    NPString str = { _val, (uint32_t)(strlen(_val)) };                        \
-    (_v).value.stringValue = str;                                             \
-NP_END_MACRO
-
-#define STRINGN_TO_NPVARIANT(_val, _len, _v)                                  \
-NP_BEGIN_MACRO                                                                \
-    (_v).type = NPVariantType_String;                                         \
-    NPString str = { _val, (uint32_t)(_len) };                                \
-    (_v).value.stringValue = str;                                             \
-NP_END_MACRO
-
-#define OBJECT_TO_NPVARIANT(_val, _v)                                         \
-NP_BEGIN_MACRO                                                                \
-    (_v).type = NPVariantType_Object;                                         \
-    (_v).value.objectValue = _val;                                            \
-NP_END_MACRO
-
-
-/*
-  Type mappings (JavaScript types have been used for illustration
-    purposes):
-
-  JavaScript       to             C (NPVariant with type:)
-  undefined                       NPVariantType_Void
-  null                            NPVariantType_Null
-  Boolean                         NPVariantType_Bool
-  Number                          NPVariantType_Double or NPVariantType_Int32
-  String                          NPVariantType_String
-  Object                          NPVariantType_Object
-
-  C (NPVariant with type:)   to   JavaScript
-  NPVariantType_Void              undefined
-  NPVariantType_Null              null
-  NPVariantType_Bool              Boolean
-  NPVariantType_Int32             Number
-  NPVariantType_Double            Number
-  NPVariantType_String            String
-  NPVariantType_Object            Object
-*/
-
-typedef void *NPIdentifier;
-
-/*
-    NPObjects have methods and properties.  Methods and properties are
-    identified with NPIdentifiers.  These identifiers may be reflected
-    in script.  NPIdentifiers can be either strings or integers, IOW,
-    methods and properties can be identified by either strings or
-    integers (i.e. foo["bar"] vs foo[1]). NPIdentifiers can be
-    compared using ==.  In case of any errors, the requested
-    NPIdentifier(s) will be NULL. NPIdentifier lifetime is controlled
-    by the browser. Plugins do not need to worry about memory management
-    with regards to NPIdentifiers.
-*/
-NPIdentifier NPN_GetStringIdentifier(const NPUTF8 *name);
-void NPN_GetStringIdentifiers(const NPUTF8 **names, int32_t nameCount,
-                              NPIdentifier *identifiers);
-NPIdentifier NPN_GetIntIdentifier(int32_t intid);
-bool NPN_IdentifierIsString(NPIdentifier identifier);
-
-/*
-    The NPUTF8 returned from NPN_UTF8FromIdentifier SHOULD be freed.
-*/
-NPUTF8 *NPN_UTF8FromIdentifier(NPIdentifier identifier);
-
-/*
-    Get the integer represented by identifier. If identifier is not an
-    integer identifier, the behaviour is undefined.
-*/
-int32_t NPN_IntFromIdentifier(NPIdentifier identifier);
-
-/*
-    NPObject behavior is implemented using the following set of
-    callback functions.
-
-    The NPVariant *result argument of these functions (where
-    applicable) should be released using NPN_ReleaseVariantValue().
-*/
-typedef NPObject *(*NPAllocateFunctionPtr)(NPP npp, NPClass *aClass);
-typedef void (*NPDeallocateFunctionPtr)(NPObject *npobj);
-typedef void (*NPInvalidateFunctionPtr)(NPObject *npobj);
-typedef bool (*NPHasMethodFunctionPtr)(NPObject *npobj, NPIdentifier name);
-typedef bool (*NPInvokeFunctionPtr)(NPObject *npobj, NPIdentifier name,
-                                    const NPVariant *args, uint32_t argCount,
-                                    NPVariant *result);
-typedef bool (*NPInvokeDefaultFunctionPtr)(NPObject *npobj,
-                                           const NPVariant *args,
-                                           uint32_t argCount,
-                                           NPVariant *result);
-typedef bool (*NPHasPropertyFunctionPtr)(NPObject *npobj, NPIdentifier name);
-typedef bool (*NPGetPropertyFunctionPtr)(NPObject *npobj, NPIdentifier name,
-                                         NPVariant *result);
-typedef bool (*NPSetPropertyFunctionPtr)(NPObject *npobj, NPIdentifier name,
-                                         const NPVariant *value);
-typedef bool (*NPRemovePropertyFunctionPtr)(NPObject *npobj,
-                                            NPIdentifier name);
-typedef bool (*NPEnumerationFunctionPtr)(NPObject *npobj, NPIdentifier **value,
-                                         uint32_t *count);
-typedef bool (*NPConstructFunctionPtr)(NPObject *npobj,
-                                       const NPVariant *args,
-                                       uint32_t argCount,
-                                       NPVariant *result);
-
-/*
-    NPObjects returned by create, retain, invoke, and getProperty pass
-    a reference count to the caller.  That is, the callee adds a
-    reference count which passes to the caller.  It is the caller's
-    responsibility to release the returned object.
-
-    NPInvokeFunctionPtr function may return 0 to indicate a void
-    result.
-
-    NPInvalidateFunctionPtr is called by the scripting environment
-    when the native code is shutdown.  Any attempt to message a
-    NPObject instance after the invalidate callback has been
-    called will result in undefined behavior, even if the native code
-    is still retaining those NPObject instances.  (The runtime
-    will typically return immediately, with 0 or NULL, from an attempt
-    to dispatch to a NPObject, but this behavior should not be
-    depended upon.)
-
-    The NPEnumerationFunctionPtr function may pass an array of
-    NPIdentifiers back to the caller. The callee allocs the memory of
-    the array using NPN_MemAlloc(), and it's the caller's responsibility
-    to release it using NPN_MemFree().
-*/
-struct NPClass
-{
-    uint32_t structVersion;
-    NPAllocateFunctionPtr allocate;
-    NPDeallocateFunctionPtr deallocate;
-    NPInvalidateFunctionPtr invalidate;
-    NPHasMethodFunctionPtr hasMethod;
-    NPInvokeFunctionPtr invoke;
-    NPInvokeDefaultFunctionPtr invokeDefault;
-    NPHasPropertyFunctionPtr hasProperty;
-    NPGetPropertyFunctionPtr getProperty;
-    NPSetPropertyFunctionPtr setProperty;
-    NPRemovePropertyFunctionPtr removeProperty;
-    NPEnumerationFunctionPtr enumerate;
-    NPConstructFunctionPtr construct;
-};
-
-#define NP_CLASS_STRUCT_VERSION      3
-
-#define NP_CLASS_STRUCT_VERSION_ENUM 2
-#define NP_CLASS_STRUCT_VERSION_CTOR 3
-
-#define NP_CLASS_STRUCT_VERSION_HAS_ENUM(npclass)   \
-        ((npclass)->structVersion >= NP_CLASS_STRUCT_VERSION_ENUM)
-
-#define NP_CLASS_STRUCT_VERSION_HAS_CTOR(npclass)   \
-        ((npclass)->structVersion >= NP_CLASS_STRUCT_VERSION_CTOR)
-
-struct NPObject {
-    NPClass *_class;
-    uint32_t referenceCount;
-    /*
-     * Additional space may be allocated here by types of NPObjects
-     */
-};
-
-/*
-    If the class has an allocate function, NPN_CreateObject invokes
-    that function, otherwise a NPObject is allocated and
-    returned. This method will initialize the referenceCount member of
-    the NPObject to 1.
-*/
-NPObject *NPN_CreateObject(NPP npp, NPClass *aClass);
-
-/*
-    Increment the NPObject's reference count.
-*/
-NPObject *NPN_RetainObject(NPObject *npobj);
-
-/*
-    Decremented the NPObject's reference count.  If the reference
-    count goes to zero, the class's destroy function is invoke if
-    specified, otherwise the object is freed directly.
-*/
-void NPN_ReleaseObject(NPObject *npobj);
-
-/*
-    Functions to access script objects represented by NPObject.
-
-    Calls to script objects are synchronous.  If a function returns a
-    value, it will be supplied via the result NPVariant
-    argument. Successful calls will return true, false will be
-    returned in case of an error.
-
-    Calls made from plugin code to script must be made from the thread
-    on which the plugin was initialized.
-*/
-
-bool NPN_Invoke(NPP npp, NPObject *npobj, NPIdentifier methodName,
-                const NPVariant *args, uint32_t argCount, NPVariant *result);
-bool NPN_InvokeDefault(NPP npp, NPObject *npobj, const NPVariant *args,
-                       uint32_t argCount, NPVariant *result);
-bool NPN_Evaluate(NPP npp, NPObject *npobj, NPString *script,
-                  NPVariant *result);
-bool NPN_GetProperty(NPP npp, NPObject *npobj, NPIdentifier propertyName,
-                     NPVariant *result);
-bool NPN_SetProperty(NPP npp, NPObject *npobj, NPIdentifier propertyName,
-                     const NPVariant *value);
-bool NPN_RemoveProperty(NPP npp, NPObject *npobj, NPIdentifier propertyName);
-bool NPN_HasProperty(NPP npp, NPObject *npobj, NPIdentifier propertyName);
-bool NPN_HasMethod(NPP npp, NPObject *npobj, NPIdentifier methodName);
-bool NPN_Enumerate(NPP npp, NPObject *npobj, NPIdentifier **identifier,
-                   uint32_t *count);
-bool NPN_Construct(NPP npp, NPObject *npobj, const NPVariant *args,
-                   uint32_t argCount, NPVariant *result);
-
-/*
-    NPN_SetException may be called to trigger a script exception upon
-    return from entry points into NPObjects.  Typical usage:
-
-    NPN_SetException (npobj, message);
-*/
-void NPN_SetException(NPObject *npobj, const NPUTF8 *message);
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif
diff --git a/third_party/npapi/bindings/nptypes.h b/third_party/npapi/bindings/nptypes.h
deleted file mode 100644
index abcc96b..0000000
--- a/third_party/npapi/bindings/nptypes.h
+++ /dev/null
@@ -1,121 +0,0 @@
-/* -*- Mode: C; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is mozilla.org code.
- *
- * The Initial Developer of the Original Code is
- * mozilla.org.
- * Portions created by the Initial Developer are Copyright (C) 2004
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *   Johnny Stenback <jst@mozilla.org> (Original author)
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either the GNU General Public License Version 2 or later (the "GPL"), or
- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-#ifndef nptypes_h_
-#define nptypes_h_
-
-/*
- * Header file for ensuring that C99 types ([u]int32_t, [u]int64_t and bool) and
- * true/false macros are available.
- */
-
-#if defined(WIN32) || defined(OS2)
-  /*
-   * Win32 and OS/2 don't know C99, so define [u]int_16/32/64 here. The bool
-   * is predefined tho, both in C and C++.
-   */
-  typedef short int16_t;
-  typedef unsigned short uint16_t;
-  typedef int int32_t;
-  typedef unsigned int uint32_t;
-  typedef long long int64_t;
-  typedef unsigned long long uint64_t;
-#elif defined(_AIX) || defined(__sun) || defined(__osf__) || defined(IRIX) || defined(HPUX)
-  /*
-   * AIX and SunOS ship a inttypes.h header that defines [u]int32_t,
-   * but not bool for C.
-   */
-  #include <inttypes.h>
-
-  #ifndef __cplusplus
-    typedef int bool;
-    #define true   1
-    #define false  0
-  #endif
-#elif defined(bsdi) || defined(FREEBSD) || defined(OPENBSD)
-  /*
-   * BSD/OS, FreeBSD, and OpenBSD ship sys/types.h that define int32_t and
-   * u_int32_t.
-   */
-  #include <sys/types.h>
-
-  /*
-   * BSD/OS ships no header that defines uint32_t, nor bool (for C)
-   */
-  #if defined(bsdi)
-  typedef u_int32_t uint32_t;
-  typedef u_int64_t uint64_t;
-
-  #if !defined(__cplusplus)
-    typedef int bool;
-    #define true   1
-    #define false  0
-  #endif
-  #else
-  /*
-   * FreeBSD and OpenBSD define uint32_t and bool.
-   */
-    #include <inttypes.h>
-    #include <stdbool.h>
-  #endif
-#elif defined(BEOS)
-  #include <inttypes.h>
-#else
-  /*
-   * For those that ship a standard C99 stdint.h header file, include
-   * it. Can't do the same for stdbool.h tho, since some systems ship
-   * with a stdbool.h file that doesn't compile!
-   */
-  #include <stdint.h>
-
-  #ifndef __cplusplus
-    #if !defined(__GNUC__) || (__GNUC__ > 2 || __GNUC_MINOR__ > 95)
-      #include <stdbool.h>
-    #else
-      /*
-       * GCC 2.91 can't deal with a typedef for bool, but a #define
-       * works.
-       */
-      #define bool int
-      #define true   1
-      #define false  0
-    #endif
-  #endif
-#endif
-
-#endif /* nptypes_h_ */
diff --git a/third_party/npapi/npapi.gyp b/third_party/npapi/npapi.gyp
deleted file mode 100644
index 82de3b1d..0000000
--- a/third_party/npapi/npapi.gyp
+++ /dev/null
@@ -1,37 +0,0 @@
-# Copyright (c) 2009 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-{
-  'targets': [
-    {
-      'target_name': 'npapi',
-      'type': 'none',
-      'direct_dependent_settings': {
-        'include_dirs': [
-          # Some things #include "bindings/npapi.h" and others just #include
-          # "npapi.h".  Account for both flavors.
-          '.',
-          'bindings',
-        ],
-      },
-      # Even though these are just headers and aren't compiled, adding them to
-      # the project makes it possible to open them in various IDEs.
-      'sources': [
-        'bindings/npapi.h',
-        'bindings/npapi_extensions.h',
-        'bindings/npfunctions.h',
-        'bindings/nphostapi.h',
-        'bindings/nptypes.h',
-        'bindings/npruntime.h',
-      ],
-      'conditions': [
-        ['use_x11 == 1', {
-          'sources': [
-            'bindings/npapi_x11.h',
-          ],
-        }],
-      ],
-    },
-  ],
-}
diff --git a/third_party/polymer/v1_0/reproduce.sh b/third_party/polymer/v1_0/reproduce.sh
index e1f39f04..01b6cbf 100755
--- a/third_party/polymer/v1_0/reproduce.sh
+++ b/third_party/polymer/v1_0/reproduce.sh
@@ -97,6 +97,11 @@
   echo
 fi
 
+echo 'Creating a summary of components...'
 python create_components_summary.py > components_summary.txt
 
+echo 'Creating GYP files for interfaces and externs...'
 ./generate_gyp.sh
+
+echo 'Vulcanizing dependent UIs (i.e. downloads)...'
+python ../../../chrome/browser/resources/md_downloads/vulcanize.py
diff --git a/tools/android/forwarder2/BUILD.gn b/tools/android/forwarder2/BUILD.gn
index a118d65..6899a7ee 100644
--- a/tools/android/forwarder2/BUILD.gn
+++ b/tools/android/forwarder2/BUILD.gn
@@ -54,7 +54,6 @@
   create_native_executable_dist("device_forwarder_prepare_dist") {
     dist_dir = "$root_build_dir/forwarder_dist"
     binary = "$root_build_dir/device_forwarder"
-    include_main_binary = true
     deps = [
       ":device_forwarder",
     ]
diff --git a/tools/android/loading/core_set.py b/tools/android/loading/core_set.py
index 3bbb66f..910c280 100644
--- a/tools/android/loading/core_set.py
+++ b/tools/android/loading/core_set.py
@@ -42,7 +42,15 @@
       sack.ConsumeGraph(graph)
       name_graphs.append(graph)
     graph_sets.append(name_graphs)
-  json.dump({'page_core': [l for l in sack.CoreSet(*graph_sets)],
+  core = sack.CoreSet(*graph_sets)
+  json.dump({'page_core': [{'label': b.label,
+                            'name': b.name,
+                            'count': b.num_nodes}
+                           for b in core],
+             'non_core': [{'label': b.label,
+                           'name': b.name,
+                           'count': b.num_nodes}
+                          for b in sack.bags if b not in core],
              'threshold': sack.CORE_THRESHOLD},
             output, sort_keys=True, indent=2)
   output.write('\n')
@@ -80,39 +88,9 @@
                              for s in sites])
 
 
-def _AllCores(prefix, graph_set_names, output, threshold):
-  """Compute all core sets (per-set and overall page core) for a site."""
-  core_sets = []
-  _Progress('Using threshold %s' % threshold)
-  big_sack = resource_sack.GraphSack()
-  graph_sets = []
-  for name in graph_set_names:
-    _Progress('Finding core set for %s' % name)
-    sack = resource_sack.GraphSack()
-    sack.CORE_THRESHOLD = threshold
-    this_set = []
-    for filename in glob.iglob('-'.join([prefix, name, '*.trace'])):
-      _Progress('Reading %s' % filename)
-      trace = loading_trace.LoadingTrace.FromJsonFile(filename)
-      graph = dependency_graph.RequestDependencyGraph(
-          trace.request_track.GetEvents(),
-          request_dependencies_lens.RequestDependencyLens(trace))
-      sack.ConsumeGraph(graph)
-      big_sack.ConsumeGraph(graph)
-      this_set.append(graph)
-    core_sets.append({
-        'set_name': name,
-        'core_set': [l for l in sack.CoreSet()]
-    })
-    graph_sets.append(this_set)
-  json.dump({'core_sets': core_sets,
-             'page_core': [l for l in big_sack.CoreSet(*graph_sets)]},
-            output, sort_keys=True, indent=2)
-
-
 def _ReadCoreSet(filename):
   data = json.load(open(filename))
-  return set(data['page_core'])
+  return set(page['name'] for page in data['page_core'])
 
 
 def _Compare(a_name, b_name, csv):
@@ -172,28 +150,9 @@
                            help='trace file prefix')
   page_core.add_argument('--output', required=True,
                            help='JSON output file name')
-  page_core.set_defaults(
-      executor=lambda args:
-      _PageCore(args.prefix, args.sets.split(','), file(args.output, 'w')))
-
-  all_cores = subparsers.add_parser(
-      'all_cores',
-      help=('compute core and page core sets. Computes the core for each set '
-            'in --sets and then the overall page core using trace files '
-            'of form {--prefix}{set}*.trace. Outputs all the sets as JSON'))
-  all_cores.add_argument('--sets', required=True,
-                         help='sets to combine, comma-separated')
-  all_cores.add_argument('--prefix', required=True,
-                         help='input file prefix')
-  all_cores.add_argument('--output', required=True,
-                         help='JSON output file name')
-  all_cores.add_argument('--threshold',
-                         default=resource_sack.GraphSack.CORE_THRESHOLD,
-                         type=float, help='core set threshold')
-  all_cores.set_defaults(
-      executor=lambda args:
-      _AllCores(args.prefix, args.sets.split(','), file(args.output, 'w'),
-                args.threshold))
+  page_core.set_defaults(executor=lambda args:
+                         _PageCore(args.prefix, args.sets.split(','),
+                                   file(args.output, 'w')))
 
   compare = subparsers.add_parser(
       'compare',
diff --git a/tools/android/loading/resource_sack.py b/tools/android/loading/resource_sack.py
index 563bb77..d7fe331 100644
--- a/tools/android/loading/resource_sack.py
+++ b/tools/android/loading/resource_sack.py
@@ -47,9 +47,23 @@
     # Maps graph -> _GraphInfo structures for each graph we've consumed.
     self._graph_info = {}
 
+    # How we generate names.
+    self._name_generator = lambda n: n.request.url
+
     # Our graph, updated after each ConsumeGraph.
     self._graph = None
 
+  def SetNameGenerator(self, generator):
+    """Set the generator we use for names.
+
+    This will define the equivalence class of requests we use to define sacks.
+
+    Args:
+      generator: a function taking a RequestDependencyGraph node and returning a
+        string.
+    """
+    self._name_generator = generator
+
   def ConsumeGraph(self, request_graph):
     """Add a graph and process.
 
@@ -66,6 +80,10 @@
     # explicit graph creation from the client.
     self._graph = graph.DirectedGraph(self.bags, self._edges.itervalues())
 
+  def GetBag(self, node):
+    """Find the bag for a node, or None if not found."""
+    return self._name_to_bag.get(self._name_generator(node), None)
+
   def AddNode(self, request_graph, node):
     """Add a node to our collection.
 
@@ -76,7 +94,7 @@
     Returns:
       The Bag containing the node.
     """
-    sack_name = self._GetSackName(node)
+    sack_name = self._name_generator(node)
     if sack_name not in self._name_to_bag:
       self._name_to_bag[sack_name] = Bag(self, sack_name)
     bag = self._name_to_bag[sack_name]
@@ -107,7 +125,7 @@
         computed.
 
     Returns:
-      A set of bag labels (as strings) in the core set.
+      A set of bags in the core set.
     """
     if not graph_sets:
       graph_sets = [self._graph_info.keys()]
@@ -151,12 +169,9 @@
     for b in self.bags:
       count = sum([g in graph_set for g in b.graphs])
       if float(count) / num_graphs > self.CORE_THRESHOLD:
-        core.add(b.label)
+        core.add(b)
     return core
 
-  def _GetSackName(self, node):
-    return self._MakeShortname(node.request.url)
-
   @classmethod
   def _MakeShortname(cls, url):
     # TODO(lizeb): Move this method to a convenient common location.
@@ -173,14 +188,19 @@
 
 
 class Bag(graph.Node):
-  def __init__(self, sack, label):
+  def __init__(self, sack, name):
     super(Bag, self).__init__()
     self._sack = sack
-    self._label = label
+    self._name = name
+    self._label = GraphSack._MakeShortname(name)
     # Maps a ResourceGraph to its Nodes contained in this Bag.
     self._graphs = defaultdict(set)
 
   @property
+  def name(self):
+    return self._name
+
+  @property
   def label(self):
     return self._label
 
@@ -192,6 +212,9 @@
   def num_nodes(self):
     return sum(len(g) for g in self._graphs.itervalues())
 
+  def GraphNodes(self, g):
+    return self._graphs.get(g, set())
+
   def AddNode(self, request_graph, node):
     if node in self._graphs[request_graph]:
       return  # Already added.
diff --git a/tools/android/loading/resource_sack_unittest.py b/tools/android/loading/resource_sack_unittest.py
index 5c3e54d6..30c1d0e 100644
--- a/tools/android/loading/resource_sack_unittest.py
+++ b/tools/android/loading/resource_sack_unittest.py
@@ -72,7 +72,9 @@
 
   def test_Core(self):
     # We will use a core threshold of 0.5 to make it easier to define
-    # graphs. Resources 0 and 1 are core and others are not.
+    # graphs. Resources 0 and 1 are core and others are not. We check full names
+    # and node counts as we output that for core set analysis. In subsequent
+    # tests we just check labels to make the tests easier to read.
     graphs = [self.SimpleGraph([0, 1, 2]),
               self.SimpleGraph([0, 1, 3]),
               self.SimpleGraph([0, 1, 4]),
@@ -81,7 +83,8 @@
     sack.CORE_THRESHOLD = 0.5
     for g in graphs:
       sack.ConsumeGraph(g)
-    self.assertEqual(set(['0/', '1/']), sack.CoreSet())
+    self.assertEqual(set([('http://0', 4), ('http://1', 3)]),
+                     set((b.name, b.num_nodes) for b in sack.CoreSet()))
 
   def test_IntersectingCore(self):
     # Graph set A has core set {0, 1} and B {0, 2} so the final core set should
@@ -96,10 +99,13 @@
     for g in set_A + set_B + set_C:
       sack.ConsumeGraph(g)
     self.assertEqual(set(), sack.CoreSet())
-    self.assertEqual(set(['0/', '1/']), sack.CoreSet(set_A))
-    self.assertEqual(set(['0/', '2/']), sack.CoreSet(set_B))
+    self.assertEqual(set(['0/', '1/']),
+                     set(b.label for b in sack.CoreSet(set_A)))
+    self.assertEqual(set(['0/', '2/']),
+                     set(b.label for b in sack.CoreSet(set_B)))
     self.assertEqual(set(), sack.CoreSet(set_C))
-    self.assertEqual(set(['0/']), sack.CoreSet(set_A, set_B))
+    self.assertEqual(set(['0/']),
+                     set(b.label for b in sack.CoreSet(set_A, set_B)))
     self.assertEqual(set(), sack.CoreSet(set_A, set_B, set_C))
 
   def test_Simililarity(self):
diff --git a/tools/android/md5sum/BUILD.gn b/tools/android/md5sum/BUILD.gn
index 391ffb8..7cce4c9 100644
--- a/tools/android/md5sum/BUILD.gn
+++ b/tools/android/md5sum/BUILD.gn
@@ -38,7 +38,6 @@
   create_native_executable_dist("md5sum_prepare_dist") {
     dist_dir = "$root_build_dir/md5sum_dist"
     binary = "$root_build_dir/md5sum_bin"
-    include_main_binary = true
     deps = [
       ":md5sum_bin",
     ]
diff --git a/tools/metrics/rappor/rappor.xml b/tools/metrics/rappor/rappor.xml
index 7dff4c9..9c19155a 100644
--- a/tools/metrics/rappor/rappor.xml
+++ b/tools/metrics/rappor/rappor.xml
@@ -258,7 +258,8 @@
   <owner>tsergeant@chromium.org</owner>
   <summary>
     The domain for which an AudioCapture permission was revoked. Also recorded
-    as a multi-dimensional metric in Permissions.Action.AudioCapture.
+    as a multi-dimensional metric in Permissions.Action.AudioCapture. Note: This
+    metric is recorded for more revocation actions as of 2016-04-01 (M51).
   </summary>
 </rappor-metric>
 
@@ -309,7 +310,8 @@
     type="ETLD_PLUS_ONE">
   <owner>jialiul@chromium.org</owner>
   <summary>
-    The domain for which a Geolocation permission was revoked.
+    The domain for which a Geolocation permission was revoked. Note: This
+    metric is recorded for more revocation actions as of 2016-04-01 (M51).
   </summary>
 </rappor-metric>
 
@@ -364,7 +366,8 @@
     type="ETLD_PLUS_ONE">
   <owner>jialiul@chromium.org</owner>
   <summary>
-    The domain for which a Notification permission was revoked.
+    The domain for which a Notification permission was revoked. Note: This
+    metric is recorded for more revocation actions as of 2016-04-01 (M51).
   </summary>
 </rappor-metric>
 
@@ -421,7 +424,8 @@
   <owner>tsergeant@chromium.org</owner>
   <summary>
     The domain for which an VideoCapture permission was revoked. Also recorded
-    as a multi-dimensional metric in Permissions.Action.VideoCapture.
+    as a multi-dimensional metric in Permissions.Action.VideoCapture. Note: This
+    metric is recorded for more revocation actions as of 2016-04-01 (M51).
   </summary>
 </rappor-metric>
 
diff --git a/ui/compositor/test/in_process_context_provider.cc b/ui/compositor/test/in_process_context_provider.cc
index ebf913d5..0ec09c4 100644
--- a/ui/compositor/test/in_process_context_provider.cc
+++ b/ui/compositor/test/in_process_context_provider.cc
@@ -70,6 +70,8 @@
 InProcessContextProvider::~InProcessContextProvider() {
   DCHECK(main_thread_checker_.CalledOnValidThread() ||
          context_thread_checker_.CalledOnValidThread());
+  if (gr_context_)
+    gr_context_->releaseResourcesAndAbandonContext();
 }
 
 bool InProcessContextProvider::BindToCurrentThread() {
@@ -132,12 +134,11 @@
   if (gr_context_)
     return gr_context_.get();
 
-  skia::RefPtr<GrGLInterface> interface = skia::AdoptRef(new GrGLInterface);
-  skia_bindings::InitGLES2InterfaceBindings(interface.get(), ContextGL());
-
+  skia::RefPtr<GrGLInterface> interface =
+      skia_bindings::CreateGLES2InterfaceBindings(ContextGL());
   gr_context_ = skia::AdoptRef(GrContext::Create(
+      // GrContext takes ownership of |interface|.
       kOpenGL_GrBackend, reinterpret_cast<GrBackendContext>(interface.get())));
-
   return gr_context_.get();
 }
 
diff --git a/ui/file_manager/file_manager/foreground/js/file_manager_commands.js b/ui/file_manager/file_manager/foreground/js/file_manager_commands.js
index d577d1e..4e8cea50 100644
--- a/ui/file_manager/file_manager/foreground/js/file_manager_commands.js
+++ b/ui/file_manager/file_manager/foreground/js/file_manager_commands.js
@@ -1463,7 +1463,7 @@
 });
 
 /**
- * Opens the gear menu on Alt-E.
+ * Opens the gear menu.
  * @type {Command}
  */
 CommandHandler.COMMANDS_['open-gear-menu'] = /** @type {Command} */ ({
diff --git a/ui/file_manager/file_manager/main.html b/ui/file_manager/file_manager/main.html
index e3e0198..02305b2 100644
--- a/ui/file_manager/file_manager/main.html
+++ b/ui/file_manager/file_manager/main.html
@@ -117,7 +117,7 @@
 
       <command id="install-new-extension"
                i18n-values="label:INSTALL_NEW_EXTENSION_LABEL">
-      <command id="open-gear-menu" shortcut="U+0045-Alt">
+      <command id="open-gear-menu" shortcut="U+0045-Alt U+0046-Alt">
     </commands>
 
     <cr-menu id="file-context-menu" class="chrome-menu files-menu"
diff --git a/ui/gfx/geometry/cubic_bezier.cc b/ui/gfx/geometry/cubic_bezier.cc
index fe6dfcc..55ad400 100644
--- a/ui/gfx/geometry/cubic_bezier.cc
+++ b/ui/gfx/geometry/cubic_bezier.cc
@@ -11,129 +11,91 @@
 
 namespace gfx {
 
-namespace {
-
 static const double kBezierEpsilon = 1e-7;
-static const int MAX_STEPS = 30;
 
-static double eval_bezier(double p1, double p2, double t) {
-  const double p1_times_3 = 3.0 * p1;
-  const double p2_times_3 = 3.0 * p2;
-  const double h3 = p1_times_3;
-  const double h1 = p1_times_3 - p2_times_3 + 1.0;
-  const double h2 = p2_times_3 - 6.0 * p1;
-  return t * (t * (t * h1 + h2) + h3);
+CubicBezier::CubicBezier(double p1x, double p1y, double p2x, double p2y) {
+  InitCoefficients(p1x, p1y, p2x, p2y);
+  InitGradients(p1x, p1y, p2x, p2y);
+  InitRange(p1y, p2y);
 }
 
-static double eval_bezier_derivative(double p1, double p2, double t) {
-  const double h1 = 9.0 * p1 - 9.0 * p2 + 3.0;
-  const double h2 = 6.0 * p2 - 12.0 * p1;
-  const double h3 = 3.0 * p1;
-  return t * (t * h1 + h2) + h3;
+void CubicBezier::InitCoefficients(double p1x,
+                                   double p1y,
+                                   double p2x,
+                                   double p2y) {
+  // Calculate the polynomial coefficients, implicit first and last control
+  // points are (0,0) and (1,1).
+  cx_ = 3.0 * p1x;
+  bx_ = 3.0 * (p2x - p1x) - cx_;
+  ax_ = 1.0 - cx_ - bx_;
+
+  cy_ = 3.0 * p1y;
+  by_ = 3.0 * (p2y - p1y) - cy_;
+  ay_ = 1.0 - cy_ - by_;
 }
 
-// Finds t such that eval_bezier(x1, x2, t) = x.
-// There is a unique solution if x1 and x2 lie within (0, 1).
-static double bezier_interp(double x1,
-                            double x2,
-                            double x) {
-  DCHECK_GE(1.0, x1);
-  DCHECK_LE(0.0, x1);
-  DCHECK_GE(1.0, x2);
-  DCHECK_LE(0.0, x2);
+void CubicBezier::InitGradients(double p1x,
+                                double p1y,
+                                double p2x,
+                                double p2y) {
+  // End-point gradients are used to calculate timing function results
+  // outside the range [0, 1].
+  //
+  // There are three possibilities for the gradient at each end:
+  // (1) the closest control point is not horizontally coincident with regard to
+  //     (0, 0) or (1, 1). In this case the line between the end point and
+  //     the control point is tangent to the bezier at the end point.
+  // (2) the closest control point is coincident with the end point. In
+  //     this case the line between the end point and the far control
+  //     point is tangent to the bezier at the end point.
+  // (3) the closest control point is horizontally coincident with the end
+  //     point, but vertically distinct. In this case the gradient at the
+  //     end point is Infinite. However, this causes issues when
+  //     interpolating. As a result, we break down to a simple case of
+  //     0 gradient under these conditions.
 
-  x1 = std::min(std::max(x1, 0.0), 1.0);
-  x2 = std::min(std::max(x2, 0.0), 1.0);
-  x = std::min(std::max(x, 0.0), 1.0);
-
-  // We're just going to do bisection for now (for simplicity), but we could
-  // easily do some newton steps if this turns out to be a bottleneck.
-  double t = 0.0;
-  double step = 1.0;
-  for (int i = 0; i < MAX_STEPS; ++i, step *= 0.5) {
-    const double error = eval_bezier(x1, x2, t) - x;
-    if (std::abs(error) < kBezierEpsilon)
-      break;
-    t += error > 0.0 ? -step : step;
-  }
-
-  // We should have terminated the above loop because we got close to x, not
-  // because we exceeded MAX_STEPS. Do a DCHECK here to confirm.
-  DCHECK_GT(kBezierEpsilon, std::abs(eval_bezier(x1, x2, t) - x));
-
-  return t;
-}
-
-}  // namespace
-
-CubicBezier::CubicBezier(double x1, double y1, double x2, double y2)
-    : x1_(x1),
-      y1_(y1),
-      x2_(x2),
-      y2_(y2) {
-  InitGradients();
-}
-
-CubicBezier::~CubicBezier() {
-}
-
-void CubicBezier::InitGradients() {
-  if (x1_ > 0)
-    start_gradient_ = y1_ / x1_;
-  else if (!y1_ && x2_ > 0)
-    start_gradient_ = y2_ / x2_;
+  if (p1x > 0)
+    start_gradient_ = p1y / p1x;
+  else if (!p1y && p2x > 0)
+    start_gradient_ = p2y / p2x;
   else
     start_gradient_ = 0;
 
-  if (x2_ < 1)
-    end_gradient_ = (y2_ - 1) / (x2_ - 1);
-  else if (x2_ == 1 && x1_ < 1)
-    end_gradient_ = (y1_ - 1) / (x1_ - 1);
+  if (p2x < 1)
+    end_gradient_ = (p2y - 1) / (p2x - 1);
+  else if (p2x == 1 && p1x < 1)
+    end_gradient_ = (p1y - 1) / (p1x - 1);
   else
     end_gradient_ = 0;
 }
 
-double CubicBezier::Solve(double x) const {
-  if (x < 0)
-    return start_gradient_ * x;
-  if (x > 1)
-    return 1.0 + end_gradient_ * (x - 1.0);
-
-  return eval_bezier(y1_, y2_, bezier_interp(x1_, x2_, x));
-}
-
-double CubicBezier::Slope(double x) const {
-  double t = bezier_interp(x1_, x2_, x);
-  double dx_dt = eval_bezier_derivative(x1_, x2_, t);
-  double dy_dt = eval_bezier_derivative(y1_, y2_, t);
-  return dy_dt / dx_dt;
-}
-
-void CubicBezier::Range(double* min, double* max) const {
-  *min = 0;
-  *max = 1;
-  if (0 <= y1_ && y1_ < 1 && 0 <= y2_ && y2_ <= 1)
+void CubicBezier::InitRange(double p1y, double p2y) {
+  range_min_ = 0;
+  range_max_ = 1;
+  if (0 <= p1y && p1y < 1 && 0 <= p2y && p2y <= 1)
     return;
 
-  // Represent the function's derivative in the form at^2 + bt + c.
+  const double epsilon = kBezierEpsilon;
+
+  // Represent the function's derivative in the form at^2 + bt + c
+  // as in sampleCurveDerivativeY.
   // (Technically this is (dy/dt)*(1/3), which is suitable for finding zeros
   // but does not actually give the slope of the curve.)
-  double a = 3 * (y1_ - y2_) + 1;
-  double b = 2 * (y2_ - 2 * y1_);
-  double c = y1_;
+  const double a = 3.0 * ay_;
+  const double b = 2.0 * by_;
+  const double c = cy_;
 
   // Check if the derivative is constant.
-  if (std::abs(a) < kBezierEpsilon &&
-      std::abs(b) < kBezierEpsilon)
+  if (std::abs(a) < epsilon && std::abs(b) < epsilon)
     return;
 
   // Zeros of the function's derivative.
-  double t_1 = 0;
-  double t_2 = 0;
+  double t1 = 0;
+  double t2 = 0;
 
-  if (std::abs(a) < kBezierEpsilon) {
+  if (std::abs(a) < epsilon) {
     // The function's derivative is linear.
-    t_1 = -c / b;
+    t1 = -c / b;
   } else {
     // The function's derivative is a quadratic. We find the zeros of this
     // quadratic using the quadratic formula.
@@ -141,21 +103,79 @@
     if (discriminant < 0)
       return;
     double discriminant_sqrt = sqrt(discriminant);
-    t_1 = (-b + discriminant_sqrt) / (2 * a);
-    t_2 = (-b - discriminant_sqrt) / (2 * a);
+    t1 = (-b + discriminant_sqrt) / (2 * a);
+    t2 = (-b - discriminant_sqrt) / (2 * a);
   }
 
-  double sol_1 = 0;
-  double sol_2 = 0;
+  double sol1 = 0;
+  double sol2 = 0;
 
-  if (0 < t_1 && t_1 < 1)
-    sol_1 = eval_bezier(y1_, y2_, t_1);
+  if (0 < t1 && t1 < 1)
+    sol1 = SampleCurveY(t1);
 
-  if (0 < t_2 && t_2 < 1)
-    sol_2 = eval_bezier(y1_, y2_, t_2);
+  if (0 < t2 && t2 < 1)
+    sol2 = SampleCurveY(t2);
 
-  *min = std::min(std::min(*min, sol_1), sol_2);
-  *max = std::max(std::max(*max, sol_1), sol_2);
+  range_min_ = std::min(std::min(range_min_, sol1), sol2);
+  range_max_ = std::max(std::max(range_max_, sol1), sol2);
+}
+
+double CubicBezier::SolveCurveX(double x, double epsilon) const {
+  DCHECK_GE(x, 0.0);
+  DCHECK_LE(x, 1.0);
+
+  double t0;
+  double t1;
+  double t2;
+  double x2;
+  double d2;
+  int i;
+
+  // First try a few iterations of Newton's method -- normally very fast.
+  for (t2 = x, i = 0; i < 8; i++) {
+    x2 = SampleCurveX(t2) - x;
+    if (fabs(x2) < epsilon)
+      return t2;
+    d2 = SampleCurveDerivativeX(t2);
+    if (fabs(d2) < 1e-6)
+      break;
+    t2 = t2 - x2 / d2;
+  }
+
+  // Fall back to the bisection method for reliability.
+  t0 = 0.0;
+  t1 = 1.0;
+  t2 = x;
+
+  while (t0 < t1) {
+    x2 = SampleCurveX(t2);
+    if (fabs(x2 - x) < epsilon)
+      return t2;
+    if (x > x2)
+      t0 = t2;
+    else
+      t1 = t2;
+    t2 = (t1 - t0) * .5 + t0;
+  }
+
+  // Failure.
+  return t2;
+}
+
+double CubicBezier::Solve(double x) const {
+  return SolveWithEpsilon(x, kBezierEpsilon);
+}
+
+double CubicBezier::SlopeWithEpsilon(double x, double epsilon) const {
+  x = std::min(std::max(x, 0.0), 1.0);
+  double t = SolveCurveX(x, epsilon);
+  double dx = SampleCurveDerivativeX(t);
+  double dy = SampleCurveDerivativeY(t);
+  return dy / dx;
+}
+
+double CubicBezier::Slope(double x) const {
+  return SlopeWithEpsilon(x, kBezierEpsilon);
 }
 
 }  // namespace gfx
diff --git a/ui/gfx/geometry/cubic_bezier.h b/ui/gfx/geometry/cubic_bezier.h
index 5a885f3..1bae2c41 100644
--- a/ui/gfx/geometry/cubic_bezier.h
+++ b/ui/gfx/geometry/cubic_bezier.h
@@ -12,30 +12,75 @@
 
 class GFX_EXPORT CubicBezier {
  public:
-  CubicBezier(double x1, double y1, double x2, double y2);
-  ~CubicBezier();
+  CubicBezier(double p1x, double p1y, double p2x, double p2y);
 
-  // Returns an approximation of y at the given x.
+  double SampleCurveX(double t) const {
+    // `ax t^3 + bx t^2 + cx t' expanded using Horner's rule.
+    return ((ax_ * t + bx_) * t + cx_) * t;
+  }
+
+  double SampleCurveY(double t) const {
+    return ((ay_ * t + by_) * t + cy_) * t;
+  }
+
+  double SampleCurveDerivativeX(double t) const {
+    return (3.0 * ax_ * t + 2.0 * bx_) * t + cx_;
+  }
+
+  double SampleCurveDerivativeY(double t) const {
+    return (3.0 * ay_ * t + 2.0 * by_) * t + cy_;
+  }
+
+  // Given an x value, find a parametric value it came from.
+  // x must be in [0, 1] range. Doesn't use gradients.
+  double SolveCurveX(double x, double epsilon) const;
+
+  // Evaluates y at the given x with default epsilon.
   double Solve(double x) const;
+  // Evaluates y at the given x. The epsilon parameter provides a hint as to the
+  // required accuracy and is not guaranteed. Uses gradients if x is
+  // out of [0, 1] range.
+  double SolveWithEpsilon(double x, double epsilon) const {
+    if (x < 0.0)
+      return 0.0 + start_gradient_ * x;
+    if (x > 1.0)
+      return 1.0 + end_gradient_ * (x - 1.0);
+    return SampleCurveY(SolveCurveX(x, epsilon));
+  }
 
-  // Returns an approximation of dy/dx at the given x.
+  // Returns an approximation of dy/dx at the given x with default epsilon.
   double Slope(double x) const;
+  // Returns an approximation of dy/dx at the given x.
+  // Clamps x to range [0, 1].
+  double SlopeWithEpsilon(double x, double epsilon) const;
 
   // Sets |min| and |max| to the bezier's minimum and maximium y values in the
   // interval [0, 1].
-  void Range(double* min, double* max) const;
+  // TODO(loyso): Implement this as two independent getters.
+  void Range(double* min, double* max) const {
+    *min = range_min_;
+    *max = range_max_;
+  }
 
  private:
-  void InitGradients();
+  void InitCoefficients(double p1x, double p1y, double p2x, double p2y);
+  void InitGradients(double p1x, double p1y, double p2x, double p2y);
+  void InitRange(double p1y, double p2y);
 
-  double x1_;
-  double y1_;
-  double x2_;
-  double y2_;
+  double ax_;
+  double bx_;
+  double cx_;
+
+  double ay_;
+  double by_;
+  double cy_;
 
   double start_gradient_;
   double end_gradient_;
 
+  double range_min_;
+  double range_max_;
+
   DISALLOW_ASSIGN(CubicBezier);
 };
 
diff --git a/ui/gfx/geometry/cubic_bezier_unittest.cc b/ui/gfx/geometry/cubic_bezier_unittest.cc
index 9ade0da..a698361 100644
--- a/ui/gfx/geometry/cubic_bezier_unittest.cc
+++ b/ui/gfx/geometry/cubic_bezier_unittest.cc
@@ -35,6 +35,15 @@
   EXPECT_NEAR(function.Solve(0.9), 0.96021, epsilon);
   EXPECT_NEAR(function.Solve(0.95), 0.98863, epsilon);
   EXPECT_NEAR(function.Solve(1), 1, epsilon);
+
+  CubicBezier basic_use(0.5, 1.0, 0.5, 1.0);
+  EXPECT_EQ(0.875, basic_use.Solve(0.5));
+
+  CubicBezier overshoot(0.5, 2.0, 0.5, 2.0);
+  EXPECT_EQ(1.625, overshoot.Solve(0.5));
+
+  CubicBezier undershoot(0.5, -1.0, 0.5, -1.0);
+  EXPECT_EQ(-0.625, undershoot.Solve(0.5));
 }
 
 // Tests that solving the bezier works with knots with y not in (0, 1).
@@ -141,6 +150,7 @@
 
   double epsilon = 0.00015;
 
+  EXPECT_NEAR(function.Slope(-0.1), 0, epsilon);
   EXPECT_NEAR(function.Slope(0), 0, epsilon);
   EXPECT_NEAR(function.Slope(0.05), 0.42170, epsilon);
   EXPECT_NEAR(function.Slope(0.1), 0.69778, epsilon);
@@ -162,6 +172,7 @@
   EXPECT_NEAR(function.Slope(0.9), 0.69778, epsilon);
   EXPECT_NEAR(function.Slope(0.95), 0.42170, epsilon);
   EXPECT_NEAR(function.Slope(1), 0, epsilon);
+  EXPECT_NEAR(function.Slope(1.1), 0, epsilon);
 }
 
 TEST(CubicBezierTest, InputOutOfRange) {
@@ -169,25 +180,33 @@
   EXPECT_EQ(-2.0, simple.Solve(-1.0));
   EXPECT_EQ(1.0, simple.Solve(2.0));
 
-  CubicBezier coincidentEndpoints(0.0, 0.0, 1.0, 1.0);
-  EXPECT_EQ(-1.0, coincidentEndpoints.Solve(-1.0));
-  EXPECT_EQ(2.0, coincidentEndpoints.Solve(2.0));
+  CubicBezier at_edge_of_range(0.5, 1.0, 0.5, 1.0);
+  EXPECT_EQ(0.0, at_edge_of_range.Solve(0.0));
+  EXPECT_EQ(1.0, at_edge_of_range.Solve(1.0));
 
-  CubicBezier verticalGradient(0.0, 1.0, 1.0, 0.0);
-  EXPECT_EQ(0.0, verticalGradient.Solve(-1.0));
-  EXPECT_EQ(1.0, verticalGradient.Solve(2.0));
+  CubicBezier large_epsilon(0.5, 1.0, 0.5, 1.0);
+  EXPECT_EQ(-2.0, large_epsilon.SolveWithEpsilon(-1.0, 1.0));
+  EXPECT_EQ(1.0, large_epsilon.SolveWithEpsilon(2.0, 1.0));
 
-  CubicBezier distinctEndpoints(0.1, 0.2, 0.8, 0.8);
-  EXPECT_EQ(-2.0, distinctEndpoints.Solve(-1.0));
-  EXPECT_EQ(2.0, distinctEndpoints.Solve(2.0));
+  CubicBezier coincident_endpoints(0.0, 0.0, 1.0, 1.0);
+  EXPECT_EQ(-1.0, coincident_endpoints.Solve(-1.0));
+  EXPECT_EQ(2.0, coincident_endpoints.Solve(2.0));
 
-  CubicBezier coincidentEndpoint(0.0, 0.0, 0.8, 0.8);
-  EXPECT_EQ(-1.0, coincidentEndpoint.Solve(-1.0));
-  EXPECT_EQ(2.0, coincidentEndpoint.Solve(2.0));
+  CubicBezier vertical_gradient(0.0, 1.0, 1.0, 0.0);
+  EXPECT_EQ(0.0, vertical_gradient.Solve(-1.0));
+  EXPECT_EQ(1.0, vertical_gradient.Solve(2.0));
 
-  CubicBezier threeCoincidentPoints(0.0, 0.0, 0.0, 0.0);
-  EXPECT_EQ(0, threeCoincidentPoints.Solve(-1.0));
-  EXPECT_EQ(2.0, threeCoincidentPoints.Solve(2.0));
+  CubicBezier distinct_endpoints(0.1, 0.2, 0.8, 0.8);
+  EXPECT_EQ(-2.0, distinct_endpoints.Solve(-1.0));
+  EXPECT_EQ(2.0, distinct_endpoints.Solve(2.0));
+
+  CubicBezier coincident_endpoint(0.0, 0.0, 0.8, 0.8);
+  EXPECT_EQ(-1.0, coincident_endpoint.Solve(-1.0));
+  EXPECT_EQ(2.0, coincident_endpoint.Solve(2.0));
+
+  CubicBezier three_coincident_points(0.0, 0.0, 0.0, 0.0);
+  EXPECT_EQ(0, three_coincident_points.Solve(-1.0));
+  EXPECT_EQ(2.0, three_coincident_points.Solve(2.0));
 
 }
 
diff --git a/ui/webui/resources/cr_elements/cr_shared_menu/cr_shared_menu.html b/ui/webui/resources/cr_elements/cr_shared_menu/cr_shared_menu.html
index e2354a4..6ff5f550 100644
--- a/ui/webui/resources/cr_elements/cr_shared_menu/cr_shared_menu.html
+++ b/ui/webui/resources/cr_elements/cr_shared_menu/cr_shared_menu.html
@@ -4,7 +4,7 @@
 <link rel="import" href="chrome://resources/html/cr/ui/position_util.html">
 <link rel="import" href="chrome://resources/html/util.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/paper-styles/shadow.html">
-<link rel="import" href="chrome://resources/polymer/v1_0/paper-menu/paper-menu.html">
+<link rel="import" href="chrome://resources/polymer/v1_0/paper-listbox/paper-listbox.html">
 
 <dom-module id="cr-shared-menu">
   <template>
@@ -19,9 +19,9 @@
         display: block;
       }
     </style>
-    <paper-menu id="menu">
+    <paper-listbox id="menu">
       <content></content>
-    </paper-menu>
+    </paper-listbox>
   </template>
   <script src="cr_shared_menu.js"></script>
 </dom-module>