diff --git a/DEPS b/DEPS
index e5863ea2..4745b7cb 100644
--- a/DEPS
+++ b/DEPS

@@ -40,7 +40,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': '6ad3d2fa38589fafd8b1c203996a402bd8b24362',
+  'skia_revision': '253b4dd51fab530054bcf28a59341b4bd1622430',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.

diff --git a/ash/common/wm/default_state.cc b/ash/common/wm/default_state.cc
index d7e49d9..d17253e6 100644
--- a/ash/common/wm/default_state.cc
+++ b/ash/common/wm/default_state.cc

@@ -451,12 +451,12 @@
       }
       gfx::Rect work_area_in_parent =
           GetDisplayWorkAreaBoundsInParent(window_state->window());
-      gfx::Rect bounds = window_state->window()->GetBounds();
+      gfx::Rect bounds = window_state->window()->GetTargetBounds();
       // When display bounds has changed, make sure the entire window is fully
       // visible.
       bounds.AdjustToFit(work_area_in_parent);
       window_state->AdjustSnappedBounds(&bounds);
-      if (window_state->window()->GetBounds() != bounds)
+      if (window_state->window()->GetTargetBounds() != bounds)
         window_state->SetBoundsDirectAnimated(bounds);
       return true;
     }
@@ -476,11 +476,11 @@
       }
       gfx::Rect work_area_in_parent =
           GetDisplayWorkAreaBoundsInParent(window_state->window());
-      gfx::Rect bounds = window_state->window()->GetBounds();
+      gfx::Rect bounds = window_state->window()->GetTargetBounds();
       wm::AdjustBoundsToEnsureMinimumWindowVisibility(work_area_in_parent,
                                                       &bounds);
       window_state->AdjustSnappedBounds(&bounds);
-      if (window_state->window()->GetBounds() != bounds)
+      if (window_state->window()->GetTargetBounds() != bounds)
         window_state->SetBoundsDirectAnimated(bounds);
       return true;
     }

diff --git a/ash/common/wm/workspace/workspace_layout_manager_unittest.cc b/ash/common/wm/workspace/workspace_layout_manager_unittest.cc
index 5b102ca..6bf4acb 100644
--- a/ash/common/wm/workspace/workspace_layout_manager_unittest.cc
+++ b/ash/common/wm/workspace/workspace_layout_manager_unittest.cc

@@ -29,6 +29,7 @@
 #include "ui/aura/env.h"
 #include "ui/base/ui_base_switches.h"
 #include "ui/base/ui_base_types.h"
+#include "ui/compositor/scoped_animation_duration_scale_mode.h"
 #include "ui/display/display.h"
 #include "ui/display/screen.h"
 #include "ui/gfx/geometry/insets.h"
@@ -539,6 +540,42 @@
   EXPECT_FALSE(observer.is_fullscreen());
 }
 
+// For crbug.com/673803, snapped window may not adjust snapped bounds on work
+// area changed properly if window's layer is doing animation. We should use
+// GetTargetBounds to check if snapped bounds need to be changed.
+TEST_F(WorkspaceLayoutManagerTest,
+       SnappedWindowMayNotAdjustBoundsOnWorkAreaChanged) {
+  UpdateDisplay("300x400");
+  std::unique_ptr<WindowOwner> window_owner(
+      CreateTestWindow(gfx::Rect(10, 20, 100, 200)));
+  WmWindow* window = window_owner->window();
+  wm::WindowState* window_state = window->GetWindowState();
+  gfx::Insets insets(0, 0, 50, 0);
+  WmShell::Get()->SetDisplayWorkAreaInsets(window, insets);
+  const wm::WMEvent snap_left(wm::WM_EVENT_SNAP_LEFT);
+  window_state->OnWMEvent(&snap_left);
+  EXPECT_EQ(wm::WINDOW_STATE_TYPE_LEFT_SNAPPED, window_state->GetStateType());
+  const gfx::Rect kWorkAreaBounds =
+      display::Screen::GetScreen()->GetPrimaryDisplay().work_area();
+  gfx::Rect expected_bounds =
+      gfx::Rect(kWorkAreaBounds.x(), kWorkAreaBounds.y(),
+                kWorkAreaBounds.width() / 2, kWorkAreaBounds.height());
+  EXPECT_EQ(expected_bounds.ToString(), window->GetBounds().ToString());
+
+  ui::ScopedAnimationDurationScaleMode test_duration_mode(
+      ui::ScopedAnimationDurationScaleMode::NON_ZERO_DURATION);
+  // The following two SetDisplayWorkAreaInsets calls simulate the case of
+  // crbug.com/673803 that work area first becomes fullscreen and then returns
+  // to the original state.
+  WmShell::Get()->SetDisplayWorkAreaInsets(window, gfx::Insets(0, 0, 0, 0));
+  ui::LayerAnimator* animator = window->GetLayer()->GetAnimator();
+  EXPECT_TRUE(animator->is_animating());
+  WmShell::Get()->SetDisplayWorkAreaInsets(window, insets);
+  animator->StopAnimating();
+  EXPECT_FALSE(animator->is_animating());
+  EXPECT_EQ(expected_bounds.ToString(), window->GetBounds().ToString());
+}
+
 // Following "Solo" tests were originally written for BaseLayoutManager.
 using WorkspaceLayoutManagerSoloTest = AshTest;
 

diff --git a/build/android/PRESUBMIT.py b/build/android/PRESUBMIT.py
index 6bc7b44..3c1e87e 100644
--- a/build/android/PRESUBMIT.py
+++ b/build/android/PRESUBMIT.py

@@ -32,7 +32,8 @@
           J('gyp'),
           J('buildbot'),
           J('..', '..', 'third_party', 'catapult', 'common', 'py_trace_event'),
-          J('..', '..', 'third_party', 'catapult', 'devil')
+          J('..', '..', 'third_party', 'catapult', 'devil'),
+          J('..', '..', 'third_party', 'catapult', 'tracing')
       ]))
   output.extend(input_api.canned_checks.RunPylint(
       input_api,

diff --git a/build/android/pylib/__init__.py b/build/android/pylib/__init__.py
index 5dc2d76..c8a26de 100644
--- a/build/android/pylib/__init__.py
+++ b/build/android/pylib/__init__.py

@@ -5,16 +5,21 @@
 import os
 import sys
 
-_DEVIL_PATH = os.path.abspath(os.path.join(
-    os.path.dirname(__file__), '..', '..', '..', 'third_party', 'catapult',
-    'devil'))
 
-_PYTRACE_PATH = os.path.abspath(os.path.join(
-    os.path.dirname(__file__), '..', '..', '..', 'third_party', 'catapult',
-    'common', 'py_trace_event'))
+_CATAPULT_PATH = os.path.abspath(os.path.join(
+    os.path.dirname(__file__), '..', '..', '..', 'third_party', 'catapult'))
+
+_DEVIL_PATH = os.path.join(_CATAPULT_PATH, 'devil')
+
+_PYTRACE_PATH = os.path.join(_CATAPULT_PATH, 'common', 'py_trace_event')
+
+_TRACE2HTML_PATH = os.path.join(_CATAPULT_PATH, 'tracing')
 
 if _DEVIL_PATH not in sys.path:
   sys.path.append(_DEVIL_PATH)
 
 if _PYTRACE_PATH not in sys.path:
   sys.path.append(_PYTRACE_PATH)
+
+if _TRACE2HTML_PATH not in sys.path:
+  sys.path.append(_TRACE2HTML_PATH)

diff --git a/build/android/pylib/local/device/local_device_perf_test_run.py b/build/android/pylib/local/device/local_device_perf_test_run.py
index 799dedc..03f6ed7 100644
--- a/build/android/pylib/local/device/local_device_perf_test_run.py
+++ b/build/android/pylib/local/device/local_device_perf_test_run.py

@@ -113,9 +113,7 @@
         exit_code, output = cmd_helper.GetCmdStatusAndOutputWithTimeout(
             cmd, timeout, cwd=cwd, shell=True)
       end_time = time.time()
-      chart_json_output = self._test_instance.ReadChartjsonOutput(
-          self._output_dir)
-      json_output = self._test_instance.ReadJsonOutput(self._output_dir)
+      json_output = self._test_instance.ReadChartjsonOutput(self._output_dir)
       if exit_code == 0:
         result_type = base_test_result.ResultType.PASS
       else:
@@ -124,12 +122,10 @@
       end_time = time.time()
       exit_code = -1
       output = e.output
-      chart_json_output = ''
       json_output = ''
       result_type = base_test_result.ResultType.TIMEOUT
     return self._ProcessTestResult(test, cmd, start_time, end_time, exit_code,
-                                   output, chart_json_output, json_output,
-                                   result_type)
+                                   output, json_output, result_type)
 
   def _CreateCmd(self, test):
     cmd = []
@@ -138,7 +134,6 @@
     cmd.append(self._tests[test]['cmd'])
     if self._output_dir:
       cmd.append('--output-dir=%s' % self._output_dir)
-      cmd.append('--output-format=json')
     return ' '.join(self._ExtendCmd(cmd))
 
   def _ExtendCmd(self, cmd): # pylint: disable=no-self-use
@@ -155,7 +150,7 @@
     raise NotImplementedError
 
   def _ProcessTestResult(self, test, cmd, start_time, end_time, exit_code,
-                         output, chart_json_output, json_output, result_type):
+                         output, json_output, result_type):
     if exit_code is None:
       exit_code = -1
 
@@ -171,8 +166,7 @@
     persisted_result = {
         'name': test,
         'output': [output],
-        'chartjson': chart_json_output,
-        'json': json_output,
+        'chartjson': json_output,
         'archive_bytes': archive_bytes,
         'exit_code': exit_code,
         'actual_exit_code': actual_exit_code,
@@ -431,7 +425,7 @@
     # Affinitize the tests.
     if self._test_instance.trace_output:
       assert not trace_event.trace_is_enabled(), 'Tracing already running.'
-      trace_event.trace_enable(self._test_instance.trace_output)
+      trace_event.trace_enable(self._test_instance.trace_output + '.json')
     self._SplitTestsByAffinity()
     if not self._test_buckets and not self._no_device_tests:
       raise local_device_test_run.NoTestsError()
@@ -472,6 +466,9 @@
     if self._test_instance.trace_output:
       assert trace_event.trace_is_enabled(), 'Tracing not running.'
       trace_event.trace_disable()
+      local_device_test_run.LocalDeviceTestRun._JsonToTrace(
+          self._test_instance.trace_output + '.json',
+          self._test_instance.trace_output)
     return host_test_results + device_test_results
 
   # override

diff --git a/build/android/pylib/local/device/local_device_test_run.py b/build/android/pylib/local/device/local_device_test_run.py
index 1d7ebdf8..c754a3d4 100644
--- a/build/android/pylib/local/device/local_device_test_run.py
+++ b/build/android/pylib/local/device/local_device_test_run.py

@@ -16,6 +16,7 @@
 from pylib.base import test_run
 from pylib.base import test_collection
 from pylib.local.device import local_device_environment
+from tracing_build import trace2html
 
 
 _SIGTERM_TEST_LOG = (
@@ -203,6 +204,13 @@
   def _ShouldShard(self):
     raise NotImplementedError
 
+  @staticmethod
+  def _JsonToTrace(json_path, html_path):
+    # First argument is call site.
+    cmd = [__file__, json_path, '--title', 'Android Test Runner Trace',
+           '--output', html_path]
+    trace2html.Main(cmd)
+
 
 class NoTestsError(Exception):
   """Error for when no tests are found."""

diff --git a/build/android/pylib/perf/perf_test_instance.py b/build/android/pylib/perf/perf_test_instance.py
index 84663368..3121d8d 100644
--- a/build/android/pylib/perf/perf_test_instance.py
+++ b/build/android/pylib/perf/perf_test_instance.py

@@ -73,7 +73,6 @@
     self._min_battery_level = args.min_battery_level
     self._no_timeout = args.no_timeout
     self._output_chartjson_data = args.output_chartjson_data
-    self._output_json_data = args.output_json_data
     self._output_json_list = args.output_json_list
     self._print_step = args.print_step
     self._single_step = (
@@ -108,7 +107,7 @@
           data['has_archive'] = persisted_result['archive_bytes'] is not None
         step_values.append(data)
 
-      with file(self.output_json_list, 'w') as o:
+      with file(self._output_json_list, 'w') as o:
         o.write(json.dumps(step_values))
       return base_test_result.ResultType.PASS
     except KeyError:
@@ -138,17 +137,13 @@
           i, persisted_outputs[i])
     print output_formatted
 
-    if self.output_json_data:
-      with file(self.output_json_data, 'w') as f:
-        f.write(persisted_result['json'])
-
-    if self.output_chartjson_data:
-      with file(self.output_chartjson_data, 'w') as f:
+    if self._output_chartjson_data:
+      with file(self._output_chartjson_data, 'w') as f:
         f.write(persisted_result['chartjson'])
 
-    if self.output_dir_archive_path:
+    if self._output_dir_archive_path:
       if persisted_result['archive_bytes'] is not None:
-        with file(self.output_dir_archive_path, 'wb') as f:
+        with file(self._output_dir_archive_path, 'wb') as f:
           f.write(persisted_result['archive_bytes'])
       else:
         logging.error('The output dir was not archived.')
@@ -175,21 +170,6 @@
                     ' the test.')
       return ''
 
-  @staticmethod
-  def ReadJsonOutput(output_dir):
-    if not output_dir:
-      return ''
-    json_output_path = os.path.join(output_dir, 'results.json')
-    try:
-      with open(json_output_path) as f:
-        return f.read()
-    except IOError:
-      logging.exception('Exception when reading results.json.')
-      logging.error('This usually means that telemetry did not run, so it could'
-                    ' not generate the file. Please check the device running'
-                    ' the test.')
-      return ''
-
   def WriteBuildBotJson(self, output_dir):
     """Write metadata about the buildbot environment to the output dir."""
     if not output_dir or not self._write_buildbot_json:
@@ -238,10 +218,6 @@
     return self._output_dir_archive_path
 
   @property
-  def output_json_data(self):
-    return self._output_json_data
-
-  @property
   def output_json_list(self):
     return self._output_json_list
 

diff --git a/build/android/test_runner.py b/build/android/test_runner.py
index d2b9fad..612060af 100755
--- a/build/android/test_runner.py
+++ b/build/android/test_runner.py

@@ -500,9 +500,7 @@
 
   group.add_argument(
       '--output-json-list', type=os.path.realpath,
-      help='Writes a JSON list of information for each --steps into the given '
-           'file. Information includes runtime and device affinity for each '
-           '--steps.')
+      help='Write a simple list of names from --steps into the given file.')
   group.add_argument(
       '--collect-chartjson-data',
       action='store_true',
@@ -510,11 +508,7 @@
   group.add_argument(
       '--output-chartjson-data',
       type=os.path.realpath,
-      help='Writes telemetry chartjson formatted output into the given file.')
-  group.add_argument(
-      '--output-json-data',
-      type=os.path.realpath,
-      help='Writes telemetry JSON formatted output into the given file.')
+      help='Write out chartjson into the given file.')
   # TODO(rnephew): Remove this when everything moves to new option in platform
   # mode.
   group.add_argument(

diff --git a/build/android/test_runner.pydeps b/build/android/test_runner.pydeps
index fee0f25..ea43ae8b 100644
--- a/build/android/test_runner.pydeps
+++ b/build/android/test_runner.pydeps

@@ -75,6 +75,43 @@
 ../../third_party/catapult/devil/devil/utils/timeout_retry.py
 ../../third_party/catapult/devil/devil/utils/watchdog_timer.py
 ../../third_party/catapult/devil/devil/utils/zip_utils.py
+../../third_party/catapult/third_party/beautifulsoup4/bs4/__init__.py
+../../third_party/catapult/third_party/beautifulsoup4/bs4/builder/__init__.py
+../../third_party/catapult/third_party/beautifulsoup4/bs4/builder/_html5lib.py
+../../third_party/catapult/third_party/beautifulsoup4/bs4/builder/_htmlparser.py
+../../third_party/catapult/third_party/beautifulsoup4/bs4/builder/_lxml.py
+../../third_party/catapult/third_party/beautifulsoup4/bs4/dammit.py
+../../third_party/catapult/third_party/beautifulsoup4/bs4/element.py
+../../third_party/catapult/third_party/html5lib-python/html5lib/__init__.py
+../../third_party/catapult/third_party/html5lib-python/html5lib/constants.py
+../../third_party/catapult/third_party/html5lib-python/html5lib/html5parser.py
+../../third_party/catapult/third_party/html5lib-python/html5lib/inputstream.py
+../../third_party/catapult/third_party/html5lib-python/html5lib/serializer/__init__.py
+../../third_party/catapult/third_party/html5lib-python/html5lib/serializer/htmlserializer.py
+../../third_party/catapult/third_party/html5lib-python/html5lib/tokenizer.py
+../../third_party/catapult/third_party/html5lib-python/html5lib/treebuilders/__init__.py
+../../third_party/catapult/third_party/html5lib-python/html5lib/treebuilders/_base.py
+../../third_party/catapult/third_party/html5lib-python/html5lib/treewalkers/__init__.py
+../../third_party/catapult/third_party/html5lib-python/html5lib/trie/__init__.py
+../../third_party/catapult/third_party/html5lib-python/html5lib/trie/_base.py
+../../third_party/catapult/third_party/html5lib-python/html5lib/trie/py.py
+../../third_party/catapult/third_party/html5lib-python/html5lib/utils.py
+../../third_party/catapult/third_party/py_vulcanize/py_vulcanize/__init__.py
+../../third_party/catapult/third_party/py_vulcanize/py_vulcanize/generate.py
+../../third_party/catapult/third_party/py_vulcanize/py_vulcanize/html_generation_controller.py
+../../third_party/catapult/third_party/py_vulcanize/py_vulcanize/html_module.py
+../../third_party/catapult/third_party/py_vulcanize/py_vulcanize/js_utils.py
+../../third_party/catapult/third_party/py_vulcanize/py_vulcanize/module.py
+../../third_party/catapult/third_party/py_vulcanize/py_vulcanize/parse_html_deps.py
+../../third_party/catapult/third_party/py_vulcanize/py_vulcanize/project.py
+../../third_party/catapult/third_party/py_vulcanize/py_vulcanize/resource.py
+../../third_party/catapult/third_party/py_vulcanize/py_vulcanize/resource_loader.py
+../../third_party/catapult/third_party/py_vulcanize/py_vulcanize/strip_js_comments.py
+../../third_party/catapult/third_party/py_vulcanize/py_vulcanize/style_sheet.py
+../../third_party/catapult/third_party/six/six.py
+../../third_party/catapult/tracing/tracing_build/__init__.py
+../../third_party/catapult/tracing/tracing_build/trace2html.py
+../../third_party/catapult/tracing/tracing_project.py
 ../../tools/swarming_client/libs/__init__.py
 ../../tools/swarming_client/libs/logdog/__init__.py
 ../../tools/swarming_client/libs/logdog/bootstrap.py

diff --git a/chrome/android/java/res/layout/bookmark_row_content.xml b/chrome/android/java/res/layout/bookmark_row_content.xml
index f176914..e7bf8e9 100644
--- a/chrome/android/java/res/layout/bookmark_row_content.xml
+++ b/chrome/android/java/res/layout/bookmark_row_content.xml

@@ -17,7 +17,7 @@
 
         <ImageView
             android:id="@+id/bookmark_image"
-            android:layout_width="64dp"
+            android:layout_width="@dimen/selectable_list_layout_start_icon_width"
             android:layout_height="match_parent"
             android:contentDescription="@null"
             android:scaleType="center" />

diff --git a/chrome/android/java/res/layout/history_item_view.xml b/chrome/android/java/res/layout/history_item_view.xml
index dc314a0b5..7922ec5 100644
--- a/chrome/android/java/res/layout/history_item_view.xml
+++ b/chrome/android/java/res/layout/history_item_view.xml

@@ -3,70 +3,57 @@
      Use of this source code is governed by a BSD-style license that can be
      found in the LICENSE file. -->
 
-<!-- TODO(twellington): Polish this after spec is available. -->
 <org.chromium.chrome.browser.history.HistoryItemView
     xmlns:android="http://schemas.android.com/apk/res/android"
     xmlns:chrome="http://schemas.android.com/apk/res-auto"
-    android:layout_width="wrap_content"
+    android:layout_width="match_parent"
     android:layout_height="wrap_content" >
 
-    <RelativeLayout
+    <LinearLayout
         android:id="@+id/content"
         android:layout_width="match_parent"
         android:layout_height="wrap_content"
-        android:layout_marginStart="16dp"
-        android:layout_marginEnd="16dp"
         android:paddingTop="16dp"
-        android:paddingBottom="16dp" >
+        android:paddingBottom="16dp"
+        android:orientation="horizontal" >
 
         <ImageView
             android:id="@+id/icon_view"
-            android:layout_width="@dimen/default_favicon_size"
-            android:layout_height="@dimen/default_favicon_size"
-            android:layout_alignParentStart="true"
-            android:layout_centerVertical="true"
-            android:layout_marginEnd="16dp"
+            style="@style/HistoryStartIcon"
             android:contentDescription="@null"
-            android:scaleType="center"
             android:src="@drawable/default_favicon" />
 
-        <TextView
-            android:id="@+id/title"
-            android:layout_width="0dp"
-            android:layout_height="wrap_content"
-            android:layout_alignParentTop="true"
-            android:layout_toEndOf="@+id/icon_view"
-            android:layout_toStartOf="@+id/remove"
-            android:singleLine="true"
-            android:ellipsize="end"
-            android:textColor="@color/default_text_color"
-            android:textSize="16sp" />
+        <LinearLayout
+          android:layout_width="0dp"
+          android:layout_height="wrap_content"
+          android:layout_weight="1"
+          android:orientation="vertical" >
 
-        <TextView
-            android:id="@+id/domain"
-            android:layout_width="0dp"
-            android:layout_height="wrap_content"
-            android:layout_alignParentBottom="true"
-            android:layout_toEndOf="@+id/icon_view"
-            android:layout_toStartOf="@+id/remove"
-            android:layout_below="@+id/title"
-            android:singleLine="true"
-            android:ellipsize="end"
-            android:textColor="@color/google_grey_600"
-            android:textSize="14sp" />
+          <TextView
+              android:id="@+id/title"
+              android:layout_width="match_parent"
+              android:layout_height="wrap_content"
+              android:singleLine="true"
+              android:ellipsize="end"
+              android:textColor="@color/default_text_color"
+              android:textSize="16sp" />
+
+          <TextView
+              android:id="@+id/domain"
+              android:layout_width="match_parent"
+              android:layout_height="wrap_content"
+              android:singleLine="true"
+              android:ellipsize="end"
+              android:textColor="@color/google_grey_600"
+              android:textSize="14sp" />
+        </LinearLayout>
 
         <org.chromium.chrome.browser.widget.TintedImageButton
             android:id="@+id/remove"
-            android:layout_width="@dimen/selectable_list_layout_end_icon"
-            android:layout_height="@dimen/selectable_list_layout_end_icon"
-            android:layout_centerVertical="true"
-            android:layout_alignParentEnd="true"
-            android:background="@null"
+            style="@style/HistoryEndIcon"
             android:contentDescription="@string/remove"
-            android:paddingEnd="16dp"
-            android:paddingStart="16dp"
             android:src="@drawable/btn_trash"
             chrome:tint="@color/dark_mode_tint" />
-    </RelativeLayout>
+    </LinearLayout>
 
 </org.chromium.chrome.browser.history.HistoryItemView>
\ No newline at end of file

diff --git a/chrome/android/java/res/layout/history_toolbar.xml b/chrome/android/java/res/layout/history_toolbar.xml
index e482bb7c..e3654a0d 100644
--- a/chrome/android/java/res/layout/history_toolbar.xml
+++ b/chrome/android/java/res/layout/history_toolbar.xml

@@ -5,9 +5,42 @@
 
 <org.chromium.chrome.browser.history.HistoryManagerToolbar
     xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:chrome="http://schemas.android.com/apk/res-auto"
     android:layout_width="match_parent"
-    android:layout_height="match_parent" >
+    android:layout_height="match_parent"
+    android:paddingStart="0dp"
+    android:paddingEnd="0dp" >
 
     <include layout="@layout/number_roll_view" />
 
+    <!-- TODO(twellington): extract so this can be shared with downloads. -->
+    <LinearLayout
+        android:id="@+id/history_search"
+        android:layout_width="match_parent"
+        android:layout_height="match_parent"
+        android:orientation="horizontal"
+        android:visibility="gone" >
+        <EditText
+            android:id="@+id/history_search_text"
+            android:layout_width="0dp"
+            android:layout_height="match_parent"
+            android:layout_weight="1"
+            android:background="@null"
+            android:hint="@string/history_manager_search"
+            android:imeOptions="flagNoExtractUi|actionSearch"
+            android:inputType="textNoSuggestions"
+            android:singleLine="true"
+            android:textColor="@color/default_text_color"
+            android:textSize="16sp" />
+
+        <org.chromium.chrome.browser.widget.TintedImageButton
+            android:id="@+id/delete_button"
+            style="@style/HistoryEndIcon"
+            android:src="@drawable/btn_delete_url"
+            android:contentDescription="@string/accessibility_toolbar_btn_delete_url"
+            android:visibility="invisible"
+            chrome:tint="@color/dark_mode_tint" />
+
+    </LinearLayout>
+
 </org.chromium.chrome.browser.history.HistoryManagerToolbar>
\ No newline at end of file

diff --git a/chrome/android/java/res/menu/history_manager_menu.xml b/chrome/android/java/res/menu/history_manager_menu.xml
index e530740..f71c8e0 100644
--- a/chrome/android/java/res/menu/history_manager_menu.xml
+++ b/chrome/android/java/res/menu/history_manager_menu.xml

@@ -7,7 +7,13 @@
     xmlns:chrome="http://schemas.android.com/apk/res-auto" >
 
     <group android:id="@+id/normal_menu_group" >
-        <!-- TODO(twellington): add search and info button. -->
+        <!-- TODO(twellington): add privacy disclaimer toggle button. -->
+        <item
+            android:id="@+id/search_menu_id"
+            android:icon="@drawable/ic_search"
+            android:title="@string/search"
+            android:visible="false"
+            chrome:showAsAction="ifRoom" />
         <item
             android:id="@+id/close_menu_id"
             android:icon="@drawable/btn_close"

diff --git a/chrome/android/java/res/menu/website_preferences_menu.xml b/chrome/android/java/res/menu/website_preferences_menu.xml
index 3be2f44..04c18e3c 100644
--- a/chrome/android/java/res/menu/website_preferences_menu.xml
+++ b/chrome/android/java/res/menu/website_preferences_menu.xml

@@ -6,7 +6,7 @@
 <menu xmlns:android="http://schemas.android.com/apk/res/android"
     xmlns:chrome="http://schemas.android.com/apk/res-auto">
     <item android:id="@+id/search"
-          android:title="@string/website_settings_search"
+          android:title="@string/search"
           chrome:showAsAction="always"
           chrome:actionViewClass="android.support.v7.widget.SearchView" />
 </menu>

diff --git a/chrome/android/java/res/values-v17/styles.xml b/chrome/android/java/res/values-v17/styles.xml
index 4c19ba9..545d532 100644
--- a/chrome/android/java/res/values-v17/styles.xml
+++ b/chrome/android/java/res/values-v17/styles.xml

@@ -596,4 +596,19 @@
     <style name="NewTabPageRecyclerView">
         <item name="android:colorEdgeEffect">@color/google_grey_300</item>
     </style>
+
+    <!-- History UI -->
+    <style name="HistoryStartIcon">
+        <item name="android:layout_width">@dimen/selectable_list_layout_start_icon_width</item>
+        <item name="android:layout_height">match_parent</item>
+        <item name="android:scaleType">center</item>
+    </style>
+    <style name="HistoryEndIcon">
+        <item name="android:layout_width">wrap_content</item>
+        <item name="android:layout_height">match_parent</item>
+        <item name="android:paddingStart">16dp</item>
+        <item name="android:paddingEnd">16dp</item>
+        <item name="android:background">@null</item>
+        <item name="android:scaleType">center</item>
+    </style>
 </resources>

diff --git a/chrome/android/java/res/values/dimens.xml b/chrome/android/java/res/values/dimens.xml
index 8fb94f0..c60262d 100644
--- a/chrome/android/java/res/values/dimens.xml
+++ b/chrome/android/java/res/values/dimens.xml

@@ -394,4 +394,5 @@
     <!--  Miscellaneous dimensions -->
     <dimen name="action_bar_shadow_height">10dp</dimen>
     <dimen name="selectable_list_layout_end_icon">24dp</dimen>
+    <dimen name="selectable_list_layout_start_icon_width">64dp</dimen>
 </resources>

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/download/ui/DownloadManagerUi.java b/chrome/android/java/src/org/chromium/chrome/browser/download/ui/DownloadManagerUi.java
index c1af1f6..afb387ec 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/download/ui/DownloadManagerUi.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/download/ui/DownloadManagerUi.java

@@ -176,7 +176,7 @@
     private Activity mActivity;
     private ViewGroup mMainView;
     private DownloadManagerToolbar mToolbar;
-    private SelectableListLayout mSelectableListLayout;
+    private SelectableListLayout<DownloadHistoryItemWrapper> mSelectableListLayout;
 
     public DownloadManagerUi(
             Activity activity, boolean isOffTheRecord, ComponentName parentComponent) {
@@ -192,8 +192,8 @@
             addDrawerListener(drawerLayout);
         }
 
-        mSelectableListLayout =
-                (SelectableListLayout) mMainView.findViewById(R.id.selectable_list);
+        mSelectableListLayout = (SelectableListLayout<DownloadHistoryItemWrapper>)
+                mMainView.findViewById(R.id.selectable_list);
 
         mSelectableListLayout.initializeEmptyView(
                 VectorDrawableCompat.create(mActivity.getResources(),

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/history/HistoryAdapter.java b/chrome/android/java/src/org/chromium/chrome/browser/history/HistoryAdapter.java
index 0846357..657a02f 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/history/HistoryAdapter.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/history/HistoryAdapter.java

@@ -50,8 +50,11 @@
     private boolean mIsDestroyed;
     private boolean mIsInitialized;
     private boolean mIsLoadingItems;
+    private boolean mIsSearching;
     private boolean mHasMorePotentialItems;
+    private boolean mClearOnNextQueryComplete;
     private long mNextQueryEndTime;
+    private String mQueryText = EMPTY_QUERY;
 
     public HistoryAdapter(SelectionDelegate<HistoryItem> delegate, HistoryManager manager) {
         setHasStableIds(true);
@@ -72,8 +75,11 @@
      * Initializes the HistoryAdapter and loads the first set of browsing history items.
      */
     public void initialize() {
+        mIsInitialized = false;
         mIsLoadingItems = true;
-        mBridge.queryHistory(EMPTY_QUERY, 0);
+        mNextQueryEndTime = 0;
+        mClearOnNextQueryComplete = true;
+        mBridge.queryHistory(mQueryText, mNextQueryEndTime);
     }
 
     /**
@@ -86,7 +92,7 @@
         mIsLoadingItems = true;
         addFooter();
         notifyDataSetChanged();
-        mBridge.queryHistory(EMPTY_QUERY, mNextQueryEndTime);
+        mBridge.queryHistory(mQueryText, mNextQueryEndTime);
     }
 
     /**
@@ -97,17 +103,35 @@
     }
 
     /**
+     * Called to perform a search.
+     * @param query The text to search for.
+     */
+    public void search(String query) {
+        mQueryText = query;
+        mNextQueryEndTime = 0;
+        mIsSearching = true;
+        mClearOnNextQueryComplete = true;
+        mBridge.queryHistory(mQueryText, mNextQueryEndTime);
+    }
+
+    /**
+     * Called when a search is ended.
+     */
+    public void onEndSearch() {
+        mQueryText = EMPTY_QUERY;
+        mIsSearching = false;
+
+        // Re-initialize the data in the adapter.
+        initialize();
+    }
+
+    /**
      * Adds the HistoryItem to the list of items being removed and removes it from the adapter. The
      * removal will not be committed until #removeItems() is called.
      * @param item The item to mark for removal.
      */
     public void markItemForRemoval(HistoryItem item) {
-        ItemGroup group = getGroupAt(item.getPosition()).first;
-        group.removeItem(item);
-        // Remove the group if only the date header is left.
-        if (group.size() == 1) removeGroup(group);
-        notifyDataSetChanged();
-
+        removeItem(item);
         mBridge.markItemForRemoval(item);
     }
 
@@ -146,9 +170,13 @@
         // destroyed to avoid unnecessary work.
         if (mIsDestroyed) return;
 
-        if (!mIsInitialized) {
+        if (mClearOnNextQueryComplete) {
             clear(true);
-            if (items.size() > 0) addHeader();
+            mClearOnNextQueryComplete = false;
+        }
+
+        if (!mIsInitialized) {
+            if (items.size() > 0 && !mIsSearching) addHeader();
             mIsInitialized = true;
         }
 

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/history/HistoryManager.java b/chrome/android/java/src/org/chromium/chrome/browser/history/HistoryManager.java
index 894356a..51ae37a5 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/history/HistoryManager.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/history/HistoryManager.java

@@ -43,9 +43,10 @@
     private static final int MEGABYTES_TO_BYTES =  1024 * 1024;
 
     private final Activity mActivity;
-    private final SelectableListLayout mSelectableListLayout;
+    private final SelectableListLayout<HistoryItem> mSelectableListLayout;
     private final HistoryAdapter mHistoryAdapter;
     private final SelectionDelegate<HistoryItem> mSelectionDelegate;
+    private final HistoryManagerToolbar mToolbar;
     private LargeIconBridge mLargeIconBridge;
 
     /**
@@ -59,12 +60,13 @@
         mHistoryAdapter = new HistoryAdapter(mSelectionDelegate, this);
 
         mSelectableListLayout =
-                (SelectableListLayout) LayoutInflater.from(activity).inflate(
+                (SelectableListLayout<HistoryItem>) LayoutInflater.from(activity).inflate(
                         R.layout.history_main, null);
         RecyclerView recyclerView = mSelectableListLayout.initializeRecyclerView(mHistoryAdapter);
-        mSelectableListLayout.initializeToolbar(R.layout.history_toolbar, mSelectionDelegate,
-                R.string.menu_history, null, R.id.normal_menu_group,
-                R.id.selection_mode_menu_group, this);
+        mToolbar = (HistoryManagerToolbar) mSelectableListLayout.initializeToolbar(
+                R.layout.history_toolbar, mSelectionDelegate, R.string.menu_history, null,
+                R.id.normal_menu_group, R.id.selection_mode_menu_group, this);
+        mToolbar.setManager(this);
         mSelectableListLayout.initializeEmptyView(
                 TintedDrawable.constructTintedDrawable(mActivity.getResources(),
                         R.drawable.history_large),
@@ -114,6 +116,9 @@
             mHistoryAdapter.removeItems();
             mSelectionDelegate.clearSelection();
             return true;
+        } else if (item.getItemId() == R.id.search_menu_id) {
+            mToolbar.showSearchView();
+            mSelectableListLayout.setEmptyViewText(R.string.history_manager_no_results);
         }
         return false;
     }
@@ -195,6 +200,22 @@
     }
 
     /**
+     * Called to perform a search.
+     * @param query The text to search for.
+     */
+    public void performSearch(String query) {
+        mHistoryAdapter.search(query);
+    }
+
+    /**
+     * Called when a search is ended.
+     */
+    public void onEndSearch() {
+        mHistoryAdapter.onEndSearch();
+        mSelectableListLayout.setEmptyViewText(R.string.history_manager_empty);
+    }
+
+    /**
      * @return The {@link LargeIconBridge} used to fetch large favicons.
      */
     public LargeIconBridge getLargeIconBridge() {

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/history/HistoryManagerToolbar.java b/chrome/android/java/src/org/chromium/chrome/browser/history/HistoryManagerToolbar.java
index 29bfbf0..b04194c0 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/history/HistoryManagerToolbar.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/history/HistoryManagerToolbar.java

@@ -5,16 +5,38 @@
 package org.chromium.chrome.browser.history;
 
 import android.content.Context;
+import android.text.Editable;
+import android.text.TextUtils;
+import android.text.TextWatcher;
 import android.util.AttributeSet;
+import android.view.KeyEvent;
+import android.view.View;
+import android.view.inputmethod.EditorInfo;
+import android.widget.EditText;
+import android.widget.LinearLayout;
+import android.widget.TextView;
+import android.widget.TextView.OnEditorActionListener;
 
 import org.chromium.chrome.R;
+import org.chromium.chrome.browser.widget.TintedImageButton;
 import org.chromium.chrome.browser.widget.selection.SelectionToolbar;
+import org.chromium.ui.UiUtils;
 import org.chromium.ui.base.DeviceFormFactor;
 
+import java.util.List;
+
 /**
  * The SelectionToolbar for the browsing history UI.
  */
-public class HistoryManagerToolbar extends SelectionToolbar<HistoryItem> {
+public class HistoryManagerToolbar extends SelectionToolbar<HistoryItem>
+        implements OnEditorActionListener {
+    private HistoryManager mManager;
+    private boolean mIsSearching;
+
+    private LinearLayout mSearchView;
+    private EditText mSearchEditText;
+    private TintedImageButton mDeleteTextButton;
+
     public HistoryManagerToolbar(Context context, AttributeSet attrs) {
         super(context, attrs);
         inflateMenu(R.menu.history_manager_menu);
@@ -25,4 +47,107 @@
 
         // TODO(twellington): Add content descriptions to the number roll view.
     }
+
+    @Override
+    protected void onFinishInflate() {
+        super.onFinishInflate();
+        mSearchView = (LinearLayout) findViewById(R.id.history_search);
+
+        mSearchEditText = (EditText) findViewById(R.id.history_search_text);
+        mSearchEditText.setOnEditorActionListener(this);
+        mSearchEditText.addTextChangedListener(new TextWatcher() {
+            @Override
+            public void onTextChanged(CharSequence s, int start, int before, int count) {
+                mDeleteTextButton.setVisibility(
+                        TextUtils.isEmpty(s) ? View.INVISIBLE : View.VISIBLE);
+                if (mIsSearching) mManager.performSearch(s.toString());
+            }
+
+            @Override
+            public void beforeTextChanged(CharSequence s, int start, int count, int after) {}
+
+            @Override
+            public void afterTextChanged(Editable s) {}
+        });
+
+        mDeleteTextButton = (TintedImageButton) findViewById(R.id.delete_button);
+        mDeleteTextButton.setOnClickListener(new OnClickListener() {
+            @Override
+            public void onClick(View v) {
+                mSearchEditText.setText("");
+            }
+        });
+    }
+
+    /**
+     * @param manager The {@link HistoryManager} associated with this toolbar.
+     */
+    public void setManager(HistoryManager manager) {
+        mManager = manager;
+    }
+
+    /**
+     * Shows the search edit text box and related views.
+     */
+    public void showSearchView() {
+        mIsSearching = true;
+        mSelectionDelegate.clearSelection();
+
+        getMenu().setGroupVisible(mNormalGroupResId, false);
+        getMenu().setGroupVisible(mSelectedGroupResId, false);
+        setNavigationButton(NAVIGATION_BUTTON_BACK);
+        mSearchView.setVisibility(View.VISIBLE);
+
+        mSearchEditText.requestFocus();
+        UiUtils.showKeyboard(mSearchEditText);
+        setTitle(null);
+    }
+
+    /**
+     * Hides the search edit text box and related views.
+     */
+    public void hideSearchView() {
+        mIsSearching = false;
+        mSearchEditText.setText("");
+        UiUtils.hideKeyboard(mSearchEditText);
+        mSearchView.setVisibility(View.GONE);
+
+        mManager.onEndSearch();
+    }
+
+    @Override
+    public void onSelectionStateChange(List<HistoryItem> selectedItems) {
+        super.onSelectionStateChange(selectedItems);
+        if (!mIsSearching) return;
+
+        if (mIsSelectionEnabled) {
+            mSearchView.setVisibility(View.GONE);
+            UiUtils.hideKeyboard(mSearchEditText);
+        } else {
+            mSearchView.setVisibility(View.VISIBLE);
+            getMenu().setGroupVisible(mNormalGroupResId, false);
+            setNavigationButton(NAVIGATION_BUTTON_BACK);
+        }
+    }
+
+    @Override
+    protected void onDataChanged(int numItems) {
+        getMenu().findItem(R.id.search_menu_id).setVisible(!mIsSearching && numItems != 0);
+    }
+
+    @Override
+    public boolean onEditorAction(TextView v, int actionId, KeyEvent event) {
+        if (actionId == EditorInfo.IME_ACTION_SEARCH) {
+            UiUtils.hideKeyboard(v);
+        }
+        return false;
+    }
+
+    @Override
+    protected void onNavigationBack() {
+        hideSearchView();
+
+        // Call #onSelectionStateChange() to reset toolbar buttons and title.
+        super.onSelectionStateChange(mSelectionDelegate.getSelectedItems());
+    }
 }

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/widget/DateDividedAdapter.java b/chrome/android/java/src/org/chromium/chrome/browser/widget/DateDividedAdapter.java
index e61211c..ad4c281 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/widget/DateDividedAdapter.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/widget/DateDividedAdapter.java

@@ -16,6 +16,7 @@
 import android.widget.TextView;
 
 import org.chromium.chrome.R;
+import org.chromium.chrome.browser.widget.DateDividedAdapter.ItemGroup;
 
 import java.util.ArrayList;
 import java.util.Calendar;
@@ -442,10 +443,20 @@
     }
 
     /**
-     * @param group The group to remove from the adapter.
+     * @param item The item to remove from the adapter.
      */
-    protected void removeGroup(ItemGroup group) {
-        mGroups.remove(group);
+    protected void removeItem(TimedItem item) {
+        ItemGroup group = getGroupAt(item.getPosition()).first;
+        group.removeItem(item);
+        mSize--;
+
+        // Remove the group if only the date header is left.
+        if (group.size() == 1) {
+            mGroups.remove(group);
+            mSize--;
+        }
+
+        notifyDataSetChanged();
     }
 
     /**

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/widget/selection/SelectableListLayout.java b/chrome/android/java/src/org/chromium/chrome/browser/widget/selection/SelectableListLayout.java
index 7783b73..464b5b5 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/widget/selection/SelectableListLayout.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/widget/selection/SelectableListLayout.java

@@ -34,13 +34,16 @@
  *
  * After the SelectableListLayout is inflated, it should be initialized through calls to
  * #initializeRecyclerView(), #initializeToolbar(), and #initializeEmptyView().
+ *
+ * @param <E> The type of the selectable items this layout holds.
  */
-public class SelectableListLayout extends RelativeLayout {
+public class SelectableListLayout<E> extends RelativeLayout {
     private Adapter<RecyclerView.ViewHolder> mAdapter;
     private ViewStub mToolbarStub;
     private TextView mEmptyView;
     private LoadingView mLoadingView;
     private RecyclerView mRecyclerView;
+    SelectionToolbar<E> mToolbar;
 
     private final AdapterDataObserver mAdapterObserver = new AdapterDataObserver() {
         @Override
@@ -55,6 +58,8 @@
             // At inflation, the RecyclerView is set to gone, and the loading view is visible. As
             // long as the adapter data changes, we show the recycler view, and hide loading view.
             mLoadingView.hideLoadingUI();
+
+            mToolbar.onDataChanged(mAdapter.getItemCount());
         }
     };
 
@@ -116,16 +121,17 @@
      * @param listener The OnMenuItemClickListener to set on the toolbar.
      * @return The initialized SelectionToolbar.
      */
-    public <E> SelectionToolbar<E> initializeToolbar(int toolbarLayoutId,
+    public SelectionToolbar<E> initializeToolbar(int toolbarLayoutId,
             SelectionDelegate<E> delegate, int titleResId, @Nullable DrawerLayout drawerLayout,
             int normalGroupResId, int selectedGroupResId, OnMenuItemClickListener listener) {
         mToolbarStub.setLayoutResource(toolbarLayoutId);
         @SuppressWarnings("unchecked")
         SelectionToolbar<E> toolbar = (SelectionToolbar<E>) mToolbarStub.inflate();
-        toolbar.initialize(delegate, titleResId, drawerLayout, normalGroupResId,
+        mToolbar = toolbar;
+        mToolbar.initialize(delegate, titleResId, drawerLayout, normalGroupResId,
                 selectedGroupResId);
-        toolbar.setOnMenuItemClickListener(listener);
-        return toolbar;
+        mToolbar.setOnMenuItemClickListener(listener);
+        return mToolbar;
     }
 
     /**
@@ -140,6 +146,13 @@
     }
 
     /**
+     * @param emptyStringResId The string to show when the selectable list is empty.
+     */
+    public void setEmptyViewText(int emptyStringResId) {
+        mEmptyView.setText(emptyStringResId);
+    }
+
+    /**
      * Called when the view that owns the SelectableListLayout is destroyed.
      */
     public void onDestroyed() {

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/widget/selection/SelectionToolbar.java b/chrome/android/java/src/org/chromium/chrome/browser/widget/selection/SelectionToolbar.java
index 85c98b28..447f057 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/widget/selection/SelectionToolbar.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/widget/selection/SelectionToolbar.java

@@ -48,8 +48,8 @@
     private ActionBarDrawerToggle mActionBarDrawerToggle;
     private int mNavigationButton;
     private int mTitleResId;
-    private int mNormalGroupResId;
-    private int mSelectedGroupResId;
+    protected int mNormalGroupResId;
+    protected int mSelectedGroupResId;
 
     /**
      * Constructor for inflating from XML.
@@ -230,6 +230,12 @@
     }
 
     /**
+     * Called when the data in the selectable list this toolbar is associated with changes.
+     * @param numItems The number of items in the selectable list.
+     */
+    protected void onDataChanged(int numItems) {}
+
+    /**
      * Set up ActionBarDrawerToggle, a.k.a. hamburger button.
      */
     private void initActionBarDrawerToggle() {

diff --git a/chrome/android/java/strings/android_chrome_strings.grd b/chrome/android/java/strings/android_chrome_strings.grd
index 8b86bfc8..74cf94a 100644
--- a/chrome/android/java/strings/android_chrome_strings.grd
+++ b/chrome/android/java/strings/android_chrome_strings.grd

@@ -203,6 +203,9 @@
       <message name="IDS_SHARE" desc="Content description for a button to share item(s). [CHAR-LIMIT=20]">
         Share
       </message>
+      <message name="IDS_SEARCH" desc="The label for a search button.">
+        Search
+      </message>
 
       <!-- Main Preferences -->
       <message name="IDS_PREFERENCES" desc="Title for Chrome's Settings.">
@@ -722,9 +725,6 @@
       <message name="IDS_WEBSITE_SETTINGS_PERMISSIONS_ALLOW_DSE" desc="Summary text explaining that Chrome will allow the default search engine to access the user's location, but only when the user searches directly from the address bar. e.g. Location access: Allow (for address bar searches)">
         Allow (for address bar searches)
       </message>
-      <message name="IDS_WEBSITE_SETTINGS_SEARCH" desc="The label for the search button on the Website Settings page.">
-        Search
-      </message>
       <message name="IDS_WEBSITE_RESET" desc="The label for the button allowing users to clear all data and reset the permissions for a website.">
         Clear &amp; reset
       </message>
@@ -1806,6 +1806,12 @@
       <message name="IDS_HISTORY_MANAGER_EMPTY" desc="Indicates that there are no browsing history items.">
         No history here
       </message>
+      <message name="IDS_HISTORY_MANAGER_NO_RESULTS" desc="Text explaining that no browsing history items match a search query.">
+        No history found
+      </message>
+      <message name="IDS_HISTORY_MANAGER_SEARCH" desc="Placeholder text for the input field that allows users to search browsing history.">
+        Search your history
+      </message>
 
       <!-- Document mode messages -->
       <message name="IDS_CLOSE_ALL_INCOGNITO_NOTIFICATION" desc="Message on the notification that closes all incognito tabs in document mode">

diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
index 35a9209b..46c660b3 100644
--- a/chrome/browser/BUILD.gn
+++ b/chrome/browser/BUILD.gn

@@ -224,8 +224,6 @@
     "chrome_content_browser_client_parts.h",
     "chrome_device_client.cc",
     "chrome_device_client.h",
-    "chrome_net_benchmarking_message_filter.cc",
-    "chrome_net_benchmarking_message_filter.h",
     "chrome_notification_types.h",
     "chrome_quota_permission_context.cc",
     "chrome_quota_permission_context.h",
@@ -696,6 +694,8 @@
     "net/timed_cache.h",
     "net/url_info.cc",
     "net/url_info.h",
+    "net_benchmarking.cc",
+    "net_benchmarking.h",
     "notifications/alert_dispatcher_mac.h",
     "notifications/desktop_notification_profile_util.cc",
     "notifications/desktop_notification_profile_util.h",

diff --git a/chrome/browser/browser_resources.grd b/chrome/browser/browser_resources.grd
index 62190b9..ebb38e3f 100644
--- a/chrome/browser/browser_resources.grd
+++ b/chrome/browser/browser_resources.grd

@@ -116,6 +116,7 @@
       <include name="IDR_BLUETOOTH_INTERNALS_INTERFACES_JS" file="resources\bluetooth_internals\interfaces.js" type="BINDATA" compress="gzip" />
       <include name="IDR_BLUETOOTH_INTERNALS_JS" file="resources\bluetooth_internals\bluetooth_internals.js" type="BINDATA" compress="gzip" />
       <include name="IDR_BLUETOOTH_INTERNALS_SIDEBAR_JS" file="resources\bluetooth_internals\sidebar.js" type="BINDATA" compress="gzip" />
+      <include name="IDR_BLUETOOTH_INTERNALS_SNACKBAR_JS" file="resources\bluetooth_internals\snackbar.js" type="BINDATA" compress="gzip" />
       <include name="IDR_BOOKMARKS_MANIFEST" file="resources\bookmark_manager\manifest.json" type="BINDATA" />
       <if expr="is_posix and not is_macosx and not is_ios">
         <include name="IDR_CERTIFICATE_VIEWER_HTML" file="resources\certificate_viewer.html" type="BINDATA" />

diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
index 9a39f74..b9b18e8 100644
--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc

@@ -41,7 +41,6 @@
 #include "chrome/browser/budget_service/budget_service_impl.h"
 #include "chrome/browser/character_encoding.h"
 #include "chrome/browser/chrome_content_browser_client_parts.h"
-#include "chrome/browser/chrome_net_benchmarking_message_filter.h"
 #include "chrome/browser/chrome_quota_permission_context.h"
 #include "chrome/browser/content_settings/cookie_settings_factory.h"
 #include "chrome/browser/content_settings/host_content_settings_map_factory.h"
@@ -54,6 +53,7 @@
 #include "chrome/browser/memory/chrome_memory_coordinator_delegate.h"
 #include "chrome/browser/metrics/chrome_browser_main_extra_parts_metrics.h"
 #include "chrome/browser/nacl_host/nacl_browser_delegate_impl.h"
+#include "chrome/browser/net_benchmarking.h"
 #include "chrome/browser/notifications/platform_notification_service_impl.h"
 #include "chrome/browser/page_load_metrics/metrics_navigation_throttle.h"
 #include "chrome/browser/password_manager/chrome_password_manager_client.h"
@@ -1038,9 +1038,6 @@
     content::RenderProcessHost* host) {
   int id = host->GetID();
   Profile* profile = Profile::FromBrowserContext(host->GetBrowserContext());
-  net::URLRequestContextGetter* context =
-      host->GetStoragePartition()->GetURLRequestContext();
-
   host->AddFilter(new ChromeRenderMessageFilter(
       id, profile, host->GetStoragePartition()->GetServiceWorkerContext()));
 #if BUILDFLAG(ENABLE_EXTENSIONS)
@@ -1055,7 +1052,6 @@
 #if BUILDFLAG(USE_BROWSER_SPELLCHECKER)
   host->AddFilter(new SpellCheckMessageFilterPlatform(id));
 #endif
-  host->AddFilter(new ChromeNetBenchmarkingMessageFilter(profile, context));
   host->AddFilter(new prerender::PrerenderMessageFilter(id, profile));
   host->AddFilter(new TtsMessageFilter(host->GetBrowserContext()));
 #if BUILDFLAG(ENABLE_WEBRTC)
@@ -1076,6 +1072,8 @@
 
 #endif
 #if !defined(DISABLE_NACL)
+  net::URLRequestContextGetter* context =
+      host->GetStoragePartition()->GetURLRequestContext();
   host->AddFilter(new nacl::NaClHostMessageFilter(
       id, profile->IsOffTheRecord(),
       profile->GetPath(),
@@ -2963,7 +2961,14 @@
       base::Bind(&rappor::RapporRecorderImpl::Create,
                  g_browser_process->rappor_service()),
       ui_task_runner);
-
+  if (NetBenchmarking::CheckBenchmarkingEnabled()) {
+    Profile* profile =
+        Profile::FromBrowserContext(render_process_host->GetBrowserContext());
+    net::URLRequestContextGetter* context =
+        render_process_host->GetStoragePartition()->GetURLRequestContext();
+    registry->AddInterface(
+        base::Bind(&NetBenchmarking::Create, profile, context));
+  }
 #if defined(OS_CHROMEOS)
   registry->AddInterface<metrics::mojom::LeakDetector>(
       base::Bind(&metrics::LeakDetectorRemoteController::Create),

diff --git a/chrome/browser/chrome_content_browser_manifest_overlay.json b/chrome/browser/chrome_content_browser_manifest_overlay.json
index 479ebae4..9cc37ffa 100644
--- a/chrome/browser/chrome_content_browser_manifest_overlay.json
+++ b/chrome/browser/chrome_content_browser_manifest_overlay.json

@@ -7,6 +7,7 @@
         "renderer": [
           "autofill::mojom::AutofillDriver",
           "autofill::mojom::PasswordManagerDriver",
+          "chrome::mojom::NetBenchmarking",
           "chrome::mojom::FieldTrialRecorder",
           "extensions::StashService",
           "metrics::mojom::LeakDetector",

diff --git a/chrome/browser/chrome_net_benchmarking_message_filter.cc b/chrome/browser/chrome_net_benchmarking_message_filter.cc
deleted file mode 100644
index ef57cf85d..0000000
--- a/chrome/browser/chrome_net_benchmarking_message_filter.cc
+++ /dev/null

@@ -1,159 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chrome/browser/chrome_net_benchmarking_message_filter.h"
-
-#include <memory>
-
-#include "base/bind.h"
-#include "base/bind_helpers.h"
-#include "base/command_line.h"
-#include "base/macros.h"
-#include "chrome/browser/net/predictor.h"
-#include "chrome/browser/profiles/profile.h"
-#include "chrome/common/benchmarking_messages.h"
-#include "chrome/common/chrome_switches.h"
-#include "net/base/net_errors.h"
-#include "net/disk_cache/disk_cache.h"
-#include "net/dns/host_cache.h"
-#include "net/dns/host_resolver.h"
-#include "net/http/http_cache.h"
-#include "net/url_request/url_request_context.h"
-#include "net/url_request/url_request_context_getter.h"
-
-namespace {
-
-void ClearCacheCallback(ChromeNetBenchmarkingMessageFilter* filter,
-                        IPC::Message* reply_msg,
-                        int result) {
-  ChromeViewHostMsg_ClearCache::WriteReplyParams(reply_msg, result);
-  filter->Send(reply_msg);
-}
-
-}  // namespace
-
-ChromeNetBenchmarkingMessageFilter::ChromeNetBenchmarkingMessageFilter(
-    Profile* profile,
-    net::URLRequestContextGetter* request_context)
-    : BrowserMessageFilter(ChromeBenchmarkingMsgStart),
-      profile_(profile),
-      request_context_(request_context) {
-}
-
-ChromeNetBenchmarkingMessageFilter::~ChromeNetBenchmarkingMessageFilter() {
-}
-
-bool ChromeNetBenchmarkingMessageFilter::OnMessageReceived(
-    const IPC::Message& message) {
-  bool handled = true;
-  IPC_BEGIN_MESSAGE_MAP(ChromeNetBenchmarkingMessageFilter, message)
-    IPC_MESSAGE_HANDLER(ChromeViewHostMsg_CloseCurrentConnections,
-                        OnCloseCurrentConnections)
-    IPC_MESSAGE_HANDLER_DELAY_REPLY(ChromeViewHostMsg_ClearCache, OnClearCache)
-    IPC_MESSAGE_HANDLER(ChromeViewHostMsg_ClearHostResolverCache,
-                        OnClearHostResolverCache)
-    IPC_MESSAGE_HANDLER(ChromeViewHostMsg_ClearPredictorCache,
-                        OnClearPredictorCache)
-    IPC_MESSAGE_UNHANDLED(handled = false)
-  IPC_END_MESSAGE_MAP()
-  return handled;
-}
-
-void ChromeNetBenchmarkingMessageFilter::OverrideThreadForMessage(
-    const IPC::Message& message,
-    content::BrowserThread::ID* thread) {
-  if (message.type() == ChromeViewHostMsg_ClearPredictorCache::ID)
-    *thread = content::BrowserThread::UI;
-}
-
-void ChromeNetBenchmarkingMessageFilter::OnClearCache(IPC::Message* reply_msg) {
-  // This function is disabled unless the user has enabled
-  // benchmarking extensions.
-  if (!CheckBenchmarkingEnabled()) {
-    NOTREACHED() << "Received unexpected benchmarking IPC";
-    return;
-  }
-  int rv = -1;
-
-  disk_cache::Backend* backend = request_context_->GetURLRequestContext()->
-      http_transaction_factory()->GetCache()->GetCurrentBackend();
-  if (backend) {
-    net::CompletionCallback callback =
-        base::Bind(&ClearCacheCallback, base::RetainedRef(this), reply_msg);
-    rv = backend->DoomAllEntries(callback);
-    if (rv == net::ERR_IO_PENDING) {
-      // The callback will send the reply.
-      return;
-    }
-  }
-  ChromeViewHostMsg_ClearCache::WriteReplyParams(reply_msg, rv);
-  Send(reply_msg);
-}
-
-void ChromeNetBenchmarkingMessageFilter::OnClearHostResolverCache() {
-  // This function is disabled unless the user has enabled
-  // benchmarking extensions.
-  if (!CheckBenchmarkingEnabled()) {
-    NOTREACHED() << "Received unexpected benchmarking IPC";
-    return;
-  }
-  net::HostCache* cache =
-      request_context_->GetURLRequestContext()->host_resolver()->GetHostCache();
-  if (cache) {
-    cache->clear();
-  }
-}
-
-void ChromeNetBenchmarkingMessageFilter::OnCloseCurrentConnections() {
-  // This function is disabled unless the user has enabled
-  // benchmarking extensions.
-  if (!CheckBenchmarkingEnabled()) {
-    NOTREACHED() << "Received unexpected benchmarking IPC";
-    return;
-  }
-  request_context_->GetURLRequestContext()->
-      http_transaction_factory()->GetCache()->CloseAllConnections();
-}
-
-void ChromeNetBenchmarkingMessageFilter::OnSetCacheMode(bool enabled) {
-  // This function is disabled unless the user has enabled
-  // benchmarking extensions.
-  if (!CheckBenchmarkingEnabled()) {
-    NOTREACHED() << "Received unexpected benchmarking IPC";
-    return;
-  }
-  net::HttpCache::Mode mode = enabled ?
-      net::HttpCache::NORMAL : net::HttpCache::DISABLE;
-  net::HttpCache* http_cache = request_context_->GetURLRequestContext()->
-      http_transaction_factory()->GetCache();
-  http_cache->set_mode(mode);
-}
-
-void ChromeNetBenchmarkingMessageFilter::OnClearPredictorCache() {
-  // This function is disabled unless the user has enabled
-  // benchmarking extensions.
-  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
-  if (!CheckBenchmarkingEnabled()) {
-    NOTREACHED() << "Received unexpected benchmarking IPC";
-    return;
-  }
-  // TODO(623967): Ensure that the profile or predictor are not accessed after
-  // they have been shut down.
-  chrome_browser_net::Predictor* predictor = profile_->GetNetworkPredictor();
-  if (predictor)
-    predictor->DiscardAllResultsAndClearPrefsOnUIThread();
-}
-
-bool ChromeNetBenchmarkingMessageFilter::CheckBenchmarkingEnabled() const {
-  static bool checked = false;
-  static bool result = false;
-  if (!checked) {
-    const base::CommandLine& command_line =
-        *base::CommandLine::ForCurrentProcess();
-    result = command_line.HasSwitch(switches::kEnableNetBenchmarking);
-    checked = true;
-  }
-  return result;
-}
-

diff --git a/chrome/browser/chrome_net_benchmarking_message_filter.h b/chrome/browser/chrome_net_benchmarking_message_filter.h
deleted file mode 100644
index 269074f..0000000
--- a/chrome/browser/chrome_net_benchmarking_message_filter.h
+++ /dev/null

@@ -1,55 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROME_BROWSER_CHROME_NET_BENCHMARKING_MESSAGE_FILTER_H_
-#define CHROME_BROWSER_CHROME_NET_BENCHMARKING_MESSAGE_FILTER_H_
-
-#include "base/macros.h"
-#include "content/public/browser/browser_message_filter.h"
-
-namespace net {
-class URLRequestContextGetter;
-}
-
-class Profile;
-
-// This class filters out incoming Chrome-specific benchmarking IPC messages
-// for the renderer process on the IPC thread.
-class ChromeNetBenchmarkingMessageFilter
-    : public content::BrowserMessageFilter {
- public:
-  ChromeNetBenchmarkingMessageFilter(
-      Profile* profile,
-      net::URLRequestContextGetter* request_context);
-
-  // content::BrowserMessageFilter methods:
-  bool OnMessageReceived(const IPC::Message& message) override;
-  void OverrideThreadForMessage(const IPC::Message& message,
-                                content::BrowserThread::ID* thread) override;
-
-
- private:
-  ~ChromeNetBenchmarkingMessageFilter() override;
-
-  // Message handlers.
-  void OnCloseCurrentConnections();
-  void OnClearCache(IPC::Message* reply_msg);
-  void OnClearHostResolverCache();
-  void OnSetCacheMode(bool enabled);
-  void OnClearPredictorCache();
-
-  // Returns true if benchmarking is enabled for chrome.
-  bool CheckBenchmarkingEnabled() const;
-
-  // The Profile associated with our renderer process.  This should only be
-  // accessed on the UI thread!
-  // TODO(623967): Store the Predictor* here instead of the Profile.
-  Profile* profile_;
-  scoped_refptr<net::URLRequestContextGetter> request_context_;
-
-  DISALLOW_COPY_AND_ASSIGN(ChromeNetBenchmarkingMessageFilter);
-};
-
-#endif  // CHROME_BROWSER_CHROME_NET_BENCHMARKING_MESSAGE_FILTER_H_
-

diff --git a/chrome/browser/net_benchmarking.cc b/chrome/browser/net_benchmarking.cc
new file mode 100644
index 0000000..b6792c6
--- /dev/null
+++ b/chrome/browser/net_benchmarking.cc

@@ -0,0 +1,105 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/net_benchmarking.h"
+
+#include <memory>
+#include <utility>
+
+#include "base/bind.h"
+#include "base/bind_helpers.h"
+#include "base/command_line.h"
+#include "base/macros.h"
+#include "chrome/browser/net/predictor.h"
+#include "chrome/browser/profiles/profile.h"
+#include "chrome/common/chrome_switches.h"
+#include "chrome/common/net_benchmarking.mojom.h"
+#include "content/public/browser/browser_thread.h"
+#include "mojo/public/cpp/bindings/strong_binding.h"
+#include "net/base/net_errors.h"
+#include "net/disk_cache/disk_cache.h"
+#include "net/dns/host_cache.h"
+#include "net/dns/host_resolver.h"
+#include "net/http/http_cache.h"
+#include "net/url_request/url_request_context.h"
+#include "net/url_request/url_request_context_getter.h"
+
+using content::BrowserThread;
+
+namespace {
+
+void ClearPredictorCacheOnUIThread(Profile* profile) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  // TODO(623967): Ensure that the profile or predictor are not accessed after
+  // they have been shut down.
+  chrome_browser_net::Predictor* predictor = profile->GetNetworkPredictor();
+  if (predictor)
+    predictor->DiscardAllResultsAndClearPrefsOnUIThread();
+}
+
+}  // namespace
+
+NetBenchmarking::NetBenchmarking(Profile* profile,
+                                 net::URLRequestContextGetter* request_context)
+    : profile_(profile), request_context_(request_context) {}
+
+NetBenchmarking::~NetBenchmarking() {}
+
+// static
+void NetBenchmarking::Create(Profile* profile,
+                             net::URLRequestContextGetter* request_context,
+                             chrome::mojom::NetBenchmarkingRequest request) {
+  mojo::MakeStrongBinding(
+      base::MakeUnique<NetBenchmarking>(profile, request_context),
+      std::move(request));
+}
+
+// static
+bool NetBenchmarking::CheckBenchmarkingEnabled() {
+  const base::CommandLine& command_line =
+      *base::CommandLine::ForCurrentProcess();
+  return command_line.HasSwitch(switches::kEnableNetBenchmarking);
+}
+
+void NetBenchmarking::ClearCache(const ClearCacheCallback& callback) {
+  int rv = -1;
+
+  disk_cache::Backend* backend = request_context_->GetURLRequestContext()
+                                     ->http_transaction_factory()
+                                     ->GetCache()
+                                     ->GetCurrentBackend();
+  if (backend) {
+    rv = backend->DoomAllEntries(callback);
+    if (rv == net::ERR_IO_PENDING) {
+      // Callback is handled by backend.
+      return;
+    }
+  }
+  callback.Run(rv);
+}
+
+void NetBenchmarking::ClearHostResolverCache(
+    const ClearHostResolverCacheCallback& callback) {
+  net::HostCache* cache =
+      request_context_->GetURLRequestContext()->host_resolver()->GetHostCache();
+  if (cache)
+    cache->clear();
+  callback.Run();
+}
+
+void NetBenchmarking::CloseCurrentConnections(
+    const CloseCurrentConnectionsCallback& callback) {
+  request_context_->GetURLRequestContext()
+      ->http_transaction_factory()
+      ->GetCache()
+      ->CloseAllConnections();
+  callback.Run();
+}
+
+void NetBenchmarking::ClearPredictorCache(
+    const ClearPredictorCacheCallback& callback) {
+  BrowserThread::PostTaskAndReply(
+      BrowserThread::UI, FROM_HERE,
+      base::Bind(&ClearPredictorCacheOnUIThread, profile_), callback);
+}

diff --git a/chrome/browser/net_benchmarking.h b/chrome/browser/net_benchmarking.h
new file mode 100644
index 0000000..ac990c3a
--- /dev/null
+++ b/chrome/browser/net_benchmarking.h

@@ -0,0 +1,50 @@
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_NET_BENCHMARKING_H_
+#define CHROME_BROWSER_NET_BENCHMARKING_H_
+
+#include "base/macros.h"
+#include "chrome/browser/profiles/profile.h"
+#include "chrome/common/net_benchmarking.mojom.h"
+
+namespace net {
+class URLRequestContextGetter;
+}
+
+class Profile;
+
+// This class handles Chrome-specific benchmarking IPC messages
+// for the renderer process.
+class NetBenchmarking : public chrome::mojom::NetBenchmarking {
+ public:
+  NetBenchmarking(Profile* profile,
+                  net::URLRequestContextGetter* request_context);
+  ~NetBenchmarking() override;
+
+  static void Create(Profile* profile,
+                     net::URLRequestContextGetter* request_context,
+                     chrome::mojom::NetBenchmarkingRequest request);
+  static bool CheckBenchmarkingEnabled();
+
+ private:
+  // chrome:mojom:NetBenchmarking.
+  void CloseCurrentConnections(
+      const CloseCurrentConnectionsCallback& callback) override;
+  void ClearCache(const ClearCacheCallback& callback) override;
+  void ClearHostResolverCache(
+      const ClearHostResolverCacheCallback& callback) override;
+  void ClearPredictorCache(
+      const ClearPredictorCacheCallback& callback) override;
+
+  // The Profile associated with our renderer process.  This should only be
+  // accessed on the UI thread!
+  // TODO(623967): Store the Predictor* here instead of the Profile.
+  Profile* profile_;
+  scoped_refptr<net::URLRequestContextGetter> request_context_;
+
+  DISALLOW_COPY_AND_ASSIGN(NetBenchmarking);
+};
+
+#endif  // CHROME_BROWSER_NET_BENCHMARKING_H_

diff --git a/chrome/browser/page_load_metrics/observers/protocol_page_load_metrics_observer.cc b/chrome/browser/page_load_metrics/observers/protocol_page_load_metrics_observer.cc
index 94b5f6d..788d31a 100644
--- a/chrome/browser/page_load_metrics/observers/protocol_page_load_metrics_observer.cc
+++ b/chrome/browser/page_load_metrics/observers/protocol_page_load_metrics_observer.cc

@@ -57,6 +57,7 @@
     case net::HttpResponseInfo::CONNECTION_INFO_QUIC_34:
     case net::HttpResponseInfo::CONNECTION_INFO_QUIC_35:
     case net::HttpResponseInfo::CONNECTION_INFO_QUIC_36:
+    case net::HttpResponseInfo::CONNECTION_INFO_QUIC_37:
       PAGE_LOAD_HISTOGRAM(
           "PageLoad.Clients.Protocol.QUIC.ParseTiming.NavigationToParseStart",
           timing.parse_start.value());
@@ -103,6 +104,7 @@
     case net::HttpResponseInfo::CONNECTION_INFO_QUIC_34:
     case net::HttpResponseInfo::CONNECTION_INFO_QUIC_35:
     case net::HttpResponseInfo::CONNECTION_INFO_QUIC_36:
+    case net::HttpResponseInfo::CONNECTION_INFO_QUIC_37:
       PAGE_LOAD_HISTOGRAM(
           "PageLoad.Clients.Protocol.QUIC.PaintTiming."
           "NavigationToFirstContentfulPaint",
@@ -154,6 +156,7 @@
     case net::HttpResponseInfo::CONNECTION_INFO_QUIC_34:
     case net::HttpResponseInfo::CONNECTION_INFO_QUIC_35:
     case net::HttpResponseInfo::CONNECTION_INFO_QUIC_36:
+    case net::HttpResponseInfo::CONNECTION_INFO_QUIC_37:
       PAGE_LOAD_HISTOGRAM(
           "PageLoad.Clients.Protocol.QUIC.Experimental.PaintTiming."
           "NavigationToFirstMeaningfulPaint",
@@ -197,6 +200,7 @@
     case net::HttpResponseInfo::CONNECTION_INFO_QUIC_34:
     case net::HttpResponseInfo::CONNECTION_INFO_QUIC_35:
     case net::HttpResponseInfo::CONNECTION_INFO_QUIC_36:
+    case net::HttpResponseInfo::CONNECTION_INFO_QUIC_37:
       PAGE_LOAD_HISTOGRAM(
           "PageLoad.Clients.Protocol.QUIC.DocumentTiming."
           "NavigationToDOMContentLoadedEventFired",
@@ -236,6 +240,7 @@
     case net::HttpResponseInfo::CONNECTION_INFO_QUIC_34:
     case net::HttpResponseInfo::CONNECTION_INFO_QUIC_35:
     case net::HttpResponseInfo::CONNECTION_INFO_QUIC_36:
+    case net::HttpResponseInfo::CONNECTION_INFO_QUIC_37:
       PAGE_LOAD_HISTOGRAM(
           "PageLoad.Clients.Protocol.QUIC.DocumentTiming."
           "NavigationToLoadEventFired",

diff --git a/chrome/browser/resources/bluetooth_internals/bluetooth_internals.css b/chrome/browser/resources/bluetooth_internals/bluetooth_internals.css
index b33ee950..ea4b872 100644
--- a/chrome/browser/resources/bluetooth_internals/bluetooth_internals.css
+++ b/chrome/browser/resources/bluetooth_internals/bluetooth_internals.css

@@ -4,6 +4,7 @@
  */
 
 :root {
+  --fade-duration: 225ms;
   --md-timing-function: cubic-bezier(.4, 0, .6, 1);
   --sidebar-width: 155px;
   --sidebar-neg-width: calc(var(--sidebar-width) * -1);
@@ -133,11 +134,10 @@
 }
 
 .sidebar-content button:hover {
-  background-color: #E0E0E0;
+  background-color: #e0e0e0;
 }
 
 .overlay {
-  --fade-duration: 225ms;
   background-color: rgba(0, 0, 0, .5);
   bottom: 0;
   left: 0;
@@ -177,17 +177,17 @@
 
 table th,
 table td {
-  border: 1px solid #D9D9D9;
+  border: 1px solid #d9d9d9;
   padding: 7px;
 }
 
 table th {
-  background-color: #F0F0F0;
+  background-color: #f0f0f0;
   font-weight: normal;
 }
 
 table .removed {
-  background-color: #BDBDBD;
+  background-color: #bdbdbd;
 }
 
 @media screen and (max-width: 600px) {
@@ -206,3 +206,81 @@
     font-weight: bold;
   }
 }
+
+/* Snackbar */
+.snackbar {
+  background-color: #323232;
+  border-radius: 2px;
+  bottom: 0;
+  color: #f1f1f1;
+  display: flex;
+  font-size: 1.5em;
+  justify-content: center;
+  left: 0;
+  margin: 0 auto;
+  max-height: 52px;
+  min-height: 20px;
+  opacity: 0;
+  padding: 14px 24px;
+  position: fixed;
+  right: 0;
+  transform: translate3d(0, 80px, 0);
+  transition: opacity var(--fade-duration), transform var(--fade-duration),
+      visibility var(--fade-duration);
+  transition-timing-function: var(--md-timing-function);
+  visibility: hidden;
+}
+
+.snackbar a {
+  -webkit-margin-start: auto;
+  display: flex;
+  flex-direction: column;
+  justify-content: center;
+  text-transform: uppercase;
+}
+
+@media screen and (min-width: 601px) {
+  .snackbar {
+    max-width: 568px;
+    min-width: 288px;
+  }
+}
+
+@media screen and (max-width: 600px) {
+  .snackbar {
+    border-radius: 0;
+    margin: 0;
+    right: 0;
+  }
+}
+
+.snackbar div {
+  -webkit-margin-end: 24px;
+  align-self: flex-start;
+}
+
+.snackbar a {
+  color: rgb(238, 255, 65);
+}
+
+.snackbar.success {
+  background-color: rgb(76, 175, 80);
+}
+
+.snackbar.warning {
+  background-color: rgb(255, 152, 0);
+}
+
+.snackbar.warning a {
+  color: rgb(17, 85, 204);
+}
+
+.snackbar.error {
+  background-color: rgb(244, 67, 54);
+}
+
+.snackbar.open {
+  opacity: 1;
+  transform: translate3d(0, 0, 0);
+  visibility: visible;
+}
\ No newline at end of file

diff --git a/chrome/browser/resources/bluetooth_internals/bluetooth_internals.html b/chrome/browser/resources/bluetooth_internals/bluetooth_internals.html
index befe113..467daca 100644
--- a/chrome/browser/resources/bluetooth_internals/bluetooth_internals.html
+++ b/chrome/browser/resources/bluetooth_internals/bluetooth_internals.html

@@ -19,6 +19,7 @@
   <link rel="import" href="chrome://resources/html/action_link.html">
   <link rel="import" href="chrome://resources/html/util.html">
 
+  <script src="snackbar.js"></script>
   <script src="interfaces.js"></script>
   <script src="adapter_broker.js"></script>
   <script src="device_collection.js"></script>
@@ -36,6 +37,7 @@
     </header>
     <section id="devices" hidden></section>
   </div>
+  <div id="snackbar-container"></div>
   <aside id="sidebar">
     <div class="overlay"></div>
     <section class="sidebar-content">

diff --git a/chrome/browser/resources/bluetooth_internals/bluetooth_internals.js b/chrome/browser/resources/bluetooth_internals/bluetooth_internals.js
index f15709c2..a87c537 100644
--- a/chrome/browser/resources/bluetooth_internals/bluetooth_internals.js
+++ b/chrome/browser/resources/bluetooth_internals/bluetooth_internals.js

@@ -15,6 +15,8 @@
 cr.define('bluetooth_internals', function() {
   /** @const */ var DevicesPage = devices_page.DevicesPage;
   /** @const */ var PageManager = cr.ui.pageManager.PageManager;
+  /** @const */ var Snackbar = snackbar.Snackbar;
+  /** @const */ var SnackbarType = snackbar.SnackbarType;
 
   /**
    * Observer for page changes. Used to update page title header.
@@ -48,6 +50,64 @@
   /** @type {devices_page.DevicesPage} */
   var devicesPage = null;
 
+  function handleInspect(event) {
+    // TODO(crbug.com/663470): Move connection logic to DeviceDetailsView
+    // when it's added in chrome://bluetooth-internals.
+    var address = event.detail.address;
+    var proxy = deviceAddressToProxy.get(address);
+
+    if (proxy) {
+      // Device is already connected, so disconnect.
+      proxy.disconnect();
+      deviceAddressToProxy.delete(address);
+      devices.updateConnectionStatus(
+          address, device_collection.ConnectionStatus.DISCONNECTED);
+      return;
+    }
+
+    devices.updateConnectionStatus(
+        address, device_collection.ConnectionStatus.CONNECTING);
+
+    adapterBroker.connectToDevice(address).then(function(deviceProxy) {
+      var deviceInfo = devices.getByAddress(address);
+      if (!deviceInfo) {
+        // Device no longer in list, so drop the connection.
+        deviceProxy.disconnect();
+        return;
+      }
+
+      deviceAddressToProxy.set(address, deviceProxy);
+      devices.updateConnectionStatus(
+          address, device_collection.ConnectionStatus.CONNECTED);
+      Snackbar.show(deviceInfo.name_for_display + ': Connected',
+          SnackbarType.SUCCESS);
+
+      // Fetch services asynchronously.
+      return deviceProxy.getServices();
+    }).then(function(response) {
+      if (!response) return;
+
+      var deviceInfo = devices.getByAddress(address);
+      deviceInfo.services = response.services;
+      devices.addOrUpdate(deviceInfo);
+    }).catch(function(error) {
+      // If a connection error occurs while fetching the services, the proxy
+      // reference must be removed.
+      var proxy = deviceAddressToProxy.get(address);
+      if (proxy) {
+        proxy.disconnect();
+        deviceAddressToProxy.delete(address);
+      }
+
+      devices.updateConnectionStatus(
+          address, device_collection.ConnectionStatus.DISCONNECTED);
+
+      var deviceInfo = devices.getByAddress(address);
+      Snackbar.show(deviceInfo.name_for_display + ': ' + error.message,
+          SnackbarType.ERROR, 'Retry', function() { handleInspect(event); });
+    });
+  }
+
   function setupDeviceSystem(response) {
     // Hook up device collection events.
     adapterBroker.addEventListener('deviceadded', function(event) {
@@ -63,50 +123,7 @@
     response.devices.forEach(devices.addOrUpdate, devices /* this */);
 
     devicesPage.setDevices(devices);
-    devicesPage.pageDiv.addEventListener('inspectpressed', function() {
-      // TODO(crbug.com/663470): Move connection logic to DeviceDetailsView
-      // when it's added in chrome://bluetooth-internals.
-      var address = event.detail.address;
-      var proxy = deviceAddressToProxy.get(address);
-
-      if (proxy) {
-        // Device is already connected, so disconnect.
-        proxy.disconnect();
-        deviceAddressToProxy.delete(address);
-        devices.updateConnectionStatus(
-            address, device_collection.ConnectionStatus.DISCONNECTED);
-        return;
-      }
-
-      devices.updateConnectionStatus(
-          address, device_collection.ConnectionStatus.CONNECTING);
-
-      adapterBroker.connectToDevice(address).then(function(deviceProxy) {
-        if (!devices.getByAddress(address)) {
-          // Device no longer in list, so drop the connection.
-          deviceProxy.disconnect();
-          return;
-        }
-
-        deviceAddressToProxy.set(address, deviceProxy);
-        devices.updateConnectionStatus(
-            address, device_collection.ConnectionStatus.CONNECTED);
-
-        // Fetch services asynchronously.
-        return deviceProxy.getServices();
-      }).then(function(response) {
-        if (!response) return;
-
-        var deviceInfo = devices.getByAddress(address);
-        deviceInfo.services = response.services;
-        devices.addOrUpdate(deviceInfo);
-      }).catch(function(error) {
-        devices.updateConnectionStatus(
-            address,
-            device_collection.ConnectionStatus.DISCONNECTED,
-            error);
-      });
-    });
+    devicesPage.pageDiv.addEventListener('inspectpressed', handleInspect);
   }
 
   function setupPages() {
@@ -140,7 +157,10 @@
       .then(function(response) { console.log('adapter', response.info); })
       .then(function() { return adapterBroker.getDevices(); })
       .then(setupDeviceSystem)
-      .catch(function(error) { console.error(error); });
+      .catch(function(error) {
+        Snackbar.show(error.message, SnackbarType.ERROR);
+        console.error(error);
+      });
   }
 
   return {

diff --git a/chrome/browser/resources/bluetooth_internals/device_collection.js b/chrome/browser/resources/bluetooth_internals/device_collection.js
index e7e6ae3..6f68ec9e 100644
--- a/chrome/browser/resources/bluetooth_internals/device_collection.js
+++ b/chrome/browser/resources/bluetooth_internals/device_collection.js

@@ -87,18 +87,11 @@
     /**
      * Updates the device connection status.
      * @param {string} address The address of the device.
-     * @param {number} status .
-     * @param {?Error} opt_error Optional Error from connection.
+     * @param {number} status The new connection status.
      */
     updateConnectionStatus: function(address, status, opt_error) {
-      var message = (opt_error && opt_error.message) || '';
-
       var device = assert(this.getByAddress(address), 'Device does not exist');
       device.connectionStatus = status;
-
-      // TODO(crbug.com/663830): Replace connection error column with better
-      // notification system.
-      device.connectionMessage = message;
       this.updateIndex(this.indexOf(device));
     },
   };

diff --git a/chrome/browser/resources/bluetooth_internals/device_table.js b/chrome/browser/resources/bluetooth_internals/device_table.js
index 0fe0291..be9e4b0e 100644
--- a/chrome/browser/resources/bluetooth_internals/device_table.js
+++ b/chrome/browser/resources/bluetooth_internals/device_table.js

@@ -14,7 +14,6 @@
     SERVICES: 3,
     CONNECTION_STATE: 4,
     INSPECT_LINK: 5,
-    CONNECTION_ERROR: 6,
   };
 
   /**
@@ -117,10 +116,6 @@
       // Make two extra cells for the inspect link and connect errors.
       var inspectCell = row.insertCell();
 
-      // TODO(crbug.com/663830): Replace connection error column with better
-      // notification system.
-      var connectErrorCell = row.insertCell();
-
       var inspectLink = document.createElement('a', 'action-link');
       inspectCell.appendChild(inspectLink);
       inspectLink.addEventListener('click', function() {
@@ -172,12 +167,6 @@
         default: assert('case not handled');
       }
 
-      // TODO(crbug.com/663830): Replace connection error column with better
-      // notification system.
-      var connectErrorCell = row.cells[COLUMNS.CONNECTION_ERROR];
-      connectErrorCell.textContent = device.connectionMessage;
-      connectErrorCell.hidden = !device.connectionMessage;
-
       // Update the properties based on the header field path.
       for (var i = 0; i < this.headers_.length; i++) {
         var header = this.headers_[i];

diff --git a/chrome/browser/resources/bluetooth_internals/sidebar.js b/chrome/browser/resources/bluetooth_internals/sidebar.js
index 81fcb2e..f060e713 100644
--- a/chrome/browser/resources/bluetooth_internals/sidebar.js
+++ b/chrome/browser/resources/bluetooth_internals/sidebar.js

@@ -45,6 +45,7 @@
     close: function() {
       this.sidebarDiv_.classList.remove('open');
       document.body.style.overflow = '';
+      document.dispatchEvent(new CustomEvent('contentfocus'));
     },
 
     /**
@@ -53,6 +54,7 @@
     open: function() {
       document.body.style.overflow = 'hidden';
       this.sidebarDiv_.classList.add('open');
+      document.dispatchEvent(new CustomEvent('contentblur'));
     },
 
     /**

diff --git a/chrome/browser/resources/bluetooth_internals/snackbar.js b/chrome/browser/resources/bluetooth_internals/snackbar.js
new file mode 100644
index 0000000..9cca49e
--- /dev/null
+++ b/chrome/browser/resources/bluetooth_internals/snackbar.js

@@ -0,0 +1,226 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/**
+ * Javascript for Snackbar controls, served from chrome://bluetooth-internals/.
+ */
+
+cr.define('snackbar', function() {
+  /** @typedef {{
+   *    message: string,
+   *    type: string,
+   *    actionText: (string|undefined),
+   *    action: (function()|undefined)
+   *  }}
+   */
+  var SnackbarOptions;
+
+  /** @const {number} */ var SHOW_DURATION = 5000;
+
+  /**
+   * Enum of Snackbar types. Used by Snackbar to determine the styling for the
+   * Snackbar.
+   * @enum {string}
+   */
+  var SnackbarType = {
+    INFO: 'info',
+    SUCCESS: 'success',
+    WARNING: 'warning',
+    ERROR: 'error',
+  };
+
+  /**
+   * Notification bar for displaying a simple message with an action link.
+   * This element should not be instantiated directly. Instead, users should
+   * use the Snackbar.show and Snackbar.dismiss functions to ensure proper
+   * queuing of messages.
+   */
+  var Snackbar = cr.ui.define('div');
+
+  Snackbar.prototype = {
+    __proto__: HTMLDivElement.prototype,
+
+    /**
+     * Decorates an element as a UI element class. Creates the message div and
+     * action link for the new Snackbar.
+     */
+    decorate: function() {
+      this.classList.add('snackbar');
+      this.messageDiv_ = document.createElement('div');
+      this.appendChild(this.messageDiv_);
+      this.actionLink_ = document.createElement('a', 'action-link');
+      this.appendChild(this.actionLink_);
+
+      this.boundStartTimeout_ = this.startTimeout_.bind(this);
+      this.boundStopTimeout_ = this.stopTimeout_.bind(this);
+      this.addEventListener('mouseleave', this.boundStartTimeout_);
+      this.addEventListener('mouseenter', this.boundStopTimeout_);
+
+      this.timeoutId_ = null;
+    },
+
+    /**
+     * Initializes the content of the Snackbar with the given |options|
+     * including the message, action link text, and click action of the link.
+     * @param {!SnackbarOptions} options
+     */
+    initialize: function(options) {
+      this.messageDiv_.textContent = options.message;
+      this.classList.add(options.type);
+      this.actionLink_.textContent = options.actionText || 'Dismiss';
+
+      this.actionLink_.addEventListener('click', function() {
+        if (options.action) options.action();
+        this.dismiss();
+      }.bind(this));
+    },
+
+    /**
+     * Shows the Snackbar.
+     */
+    show: function() {
+      this.classList.add('open');
+      if (Snackbar.hasContentFocus_) this.startTimeout_();
+      else this.stopTimeout_();
+
+      document.addEventListener('contentfocus', this.boundStartTimeout_);
+      document.addEventListener('contentblur', this.boundStopTimeout_);
+    },
+
+    /**
+     * Dismisses the Snackbar. Once the Snackbar is completely hidden, the
+     * 'dismissed' event is fired.
+     */
+    dismiss: function() {
+      this.addEventListener('webkitTransitionEnd', function(event) {
+        if (event.propertyName === 'transform')
+          this.dispatchEvent(new CustomEvent('dismissed'));
+      }.bind(this));
+
+      ensureTransitionEndEvent(this, SHOW_DURATION);
+      this.classList.remove('open');
+
+      document.removeEventListener('contentfocus', this.boundStartTimeout_);
+      document.removeEventListener('contentblur', this.boundStopTimeout_);
+    },
+
+    /**
+     * Starts the timeout for dismissing the Snackbar.
+     * @private
+     */
+    startTimeout_: function() {
+      this.timeoutId_ = setTimeout(function() {
+        this.dismiss();
+      }.bind(this), SHOW_DURATION);
+    },
+
+    /**
+     * Stops the timeout for dismissing the Snackbar. Only clears the timeout
+     * when the Snackbar is open.
+     * @private
+     */
+    stopTimeout_: function() {
+      if (this.classList.contains('open')) {
+        clearTimeout(this.timeoutId_);
+        this.timeoutId_ = null;
+      }
+    },
+  };
+
+  /** @private {?Snackbar} */
+  Snackbar.current_ = null;
+
+  /** @private {!Array<!SnackbarOptions>} */
+  Snackbar.queue_ = [];
+
+  /** @private {boolean} */
+  Snackbar.hasContentFocus_ = true;
+
+  // There is a chance where the snackbar is shown but the content doesn't have
+  // focus. In this case, the current focus state must be tracked so the
+  // snackbar can pause the dismiss timeout.
+  document.addEventListener('contentfocus', function() {
+    Snackbar.hasContentFocus_ = true;
+  });
+  document.addEventListener('contentblur', function() {
+    Snackbar.hasContentFocus_ = false;
+  });
+
+  /**
+   * TODO(crbug.com/675299): Add ability to specify parent element to Snackbar.
+   * Creates a Snackbar and shows it if one is not showing already. If a
+   * Snackbar is already active, the next Snackbar is queued.
+   * @param {string} message The message to display in the Snackbar.
+   * @param {string=} opt_type A string determining the Snackbar type: info,
+   *     success, warning, error. If not provided, info type is used.
+   * @param {string=} opt_actionText The text to display for the action link.
+   * @param {function()=} opt_action A function to be called when the user
+   *     presses the action link.
+   * @return {!Snackbar}
+   */
+  Snackbar.show = function(message, opt_type, opt_actionText, opt_action) {
+    var options = {
+      message: message,
+      type: opt_type || SnackbarType.INFO,
+      actionText: opt_actionText,
+      action: opt_action,
+    };
+
+    var newSnackbar = new Snackbar();
+    newSnackbar.initialize(options);
+
+    if (Snackbar.current_)
+      Snackbar.queue_.push(newSnackbar);
+    else
+      Snackbar.show_(newSnackbar);
+
+    return newSnackbar;
+  };
+
+  /**
+   * TODO(crbug.com/675299): Add ability to specify parent element to Snackbar.
+   * Creates a Snackbar and sets events for queuing the next Snackbar to show.
+   * @param {!Snackbar} newSnackbar
+   * @private
+   */
+  Snackbar.show_ = function(newSnackbar) {
+    $('snackbar-container').appendChild(newSnackbar);
+
+    newSnackbar.addEventListener('dismissed', function() {
+      $('snackbar-container').removeChild(Snackbar.current_);
+
+      var newSnackbar = Snackbar.queue_.shift();
+      if (newSnackbar) {
+        Snackbar.show_(newSnackbar);
+        return;
+      }
+
+      Snackbar.current_ = null;
+    });
+
+    Snackbar.current_ = newSnackbar;
+
+    // Show the Snackbar after a slight delay to allow for a layout reflow.
+    setTimeout(function() {
+      newSnackbar.show();
+    }, 10);
+  };
+
+  /**
+   * Dismisses the Snackbar currently showing.
+   * @param {boolean} clearQueue If true, clears the Snackbar queue before
+   *     dismissing.
+   */
+  Snackbar.dismiss = function(clearQueue) {
+    if (clearQueue) Snackbar.queue_ = [];
+    if (Snackbar.current_) Snackbar.current_.dismiss();
+  };
+
+
+
+  return {
+    Snackbar: Snackbar,
+    SnackbarType: SnackbarType,
+  };
+});

diff --git a/chrome/browser/ui/webui/bluetooth_internals/bluetooth_internals_ui.cc b/chrome/browser/ui/webui/bluetooth_internals/bluetooth_internals_ui.cc
index f11a7ed..ba5f948d 100644
--- a/chrome/browser/ui/webui/bluetooth_internals/bluetooth_internals_ui.cc
+++ b/chrome/browser/ui/webui/bluetooth_internals/bluetooth_internals_ui.cc

@@ -32,6 +32,8 @@
                                IDR_BLUETOOTH_INTERNALS_INTERFACES_JS);
   html_source->AddResourcePath("sidebar.js",
                                IDR_BLUETOOTH_INTERNALS_SIDEBAR_JS);
+  html_source->AddResourcePath("snackbar.js",
+                               IDR_BLUETOOTH_INTERNALS_SNACKBAR_JS);
 
   html_source->AddResourcePath(
       "device/bluetooth/public/interfaces/adapter.mojom",

diff --git a/chrome/common/BUILD.gn b/chrome/common/BUILD.gn
index 95e78576..05d7ef9 100644
--- a/chrome/common/BUILD.gn
+++ b/chrome/common/BUILD.gn

@@ -677,6 +677,7 @@
     "conflicts/module_database_win.mojom",
     "conflicts/module_event_win.mojom",
     "field_trial_recorder.mojom",
+    "net_benchmarking.mojom",
     "network_diagnostics.mojom",
     "renderer_configuration.mojom",
     "resource_usage_reporter.mojom",

diff --git a/chrome/common/benchmarking_messages.h b/chrome/common/benchmarking_messages.h
deleted file mode 100644
index c0e366e..0000000
--- a/chrome/common/benchmarking_messages.h
+++ /dev/null

@@ -1,40 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Multiply-included file, no traditional include guard.
-
-#include <string>
-
-#include "build/build_config.h"
-
-#include "ipc/ipc_message_macros.h"
-#include "ui/gfx/native_widget_types.h"
-
-#define IPC_MESSAGE_START ChromeBenchmarkingMsgStart
-
-// Message sent from the renderer to the browser to request that the browser
-// close all sockets.  Used for debugging/testing.
-//
-// This message must be synchronous so that the test harness can not
-// issue further network requests before it completes.
-IPC_SYNC_MESSAGE_CONTROL0_0(ChromeViewHostMsg_CloseCurrentConnections)
-
-// Message sent from the renderer to the browser to request that the browser
-// enable or disable the cache.  Used for debugging/testing.
-IPC_MESSAGE_CONTROL1(ChromeViewHostMsg_SetCacheMode,
-                     bool /* enabled */)
-
-// Message sent from the renderer to the browser to request that the browser
-// clear the cache.  Used for debugging/testing.
-// |result| is the returned status from the operation.
-IPC_SYNC_MESSAGE_CONTROL0_1(ChromeViewHostMsg_ClearCache,
-                            int /* result */)
-
-// Message sent from the renderer to the browser to request that the browser
-// clear the host cache.  Used for debugging/testing.
-IPC_SYNC_MESSAGE_CONTROL0_0(ChromeViewHostMsg_ClearHostResolverCache)
-
-// Message sent from the renderer to the browser to request that the browser
-// clear the predictor cache.  Used for debugging/testing.
-IPC_SYNC_MESSAGE_CONTROL0_0(ChromeViewHostMsg_ClearPredictorCache)

diff --git a/chrome/common/common_message_generator.h b/chrome/common/common_message_generator.h
index 553c873..5202dab 100644
--- a/chrome/common/common_message_generator.h
+++ b/chrome/common/common_message_generator.h

@@ -4,7 +4,6 @@
 
 // Multiply-included file, hence no include guard.
 
-#include "chrome/common/benchmarking_messages.h"
 #include "chrome/common/chrome_utility_messages.h"
 #include "chrome/common/common_param_traits_macros.h"
 #include "chrome/common/mac/app_shim_messages.h"

diff --git a/chrome/common/net_benchmarking.mojom b/chrome/common/net_benchmarking.mojom
new file mode 100644
index 0000000..ec9e7e6
--- /dev/null
+++ b/chrome/common/net_benchmarking.mojom

@@ -0,0 +1,28 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module chrome.mojom;
+
+interface NetBenchmarking {
+  // Message sent from the renderer to the browser to request that the browser
+  // close all sockets.  Used for debugging/testing.
+  [Sync]
+  CloseCurrentConnections() => ();
+
+  // Message sent from the renderer to the browser to request that the browser
+  // clear the cache.  Used for debugging/testing.
+  // |result| is the returned status from the operation.
+  [Sync]
+  ClearCache() => (int32 result);
+
+  // Message sent from the renderer to the browser to request that the browser
+  // clear the host cache.  Used for debugging/testing.
+  [Sync]
+  ClearHostResolverCache() => ();
+  
+  // Message sent from the renderer to the browser to request that the browser
+  // clear the predictor cache.  Used for debugging/testing.
+  [Sync]
+  ClearPredictorCache() => ();
+};

diff --git a/chrome/renderer/net_benchmarking_extension.cc b/chrome/renderer/net_benchmarking_extension.cc
index 2164281..fa1464fd 100644
--- a/chrome/renderer/net_benchmarking_extension.cc
+++ b/chrome/renderer/net_benchmarking_extension.cc

@@ -4,8 +4,9 @@
 
 #include "chrome/renderer/net_benchmarking_extension.h"
 
-#include "chrome/common/benchmarking_messages.h"
+#include "chrome/common/net_benchmarking.mojom.h"
 #include "content/public/renderer/render_thread.h"
+#include "services/service_manager/public/cpp/interface_provider.h"
 #include "third_party/WebKit/public/web/WebCache.h"
 #include "v8/include/v8.h"
 
@@ -62,28 +63,38 @@
     return v8::Local<v8::FunctionTemplate>();
   }
 
+  static chrome::mojom::NetBenchmarking& GetNetBenchmarking() {
+    CR_DEFINE_STATIC_LOCAL(chrome::mojom::NetBenchmarkingPtr, net_benchmarking,
+                           (ConnectToBrowser()));
+    return *net_benchmarking;
+  }
+
+  static chrome::mojom::NetBenchmarkingPtr ConnectToBrowser() {
+    chrome::mojom::NetBenchmarkingPtr net_benchmarking;
+    content::RenderThread::Get()->GetRemoteInterfaces()->GetInterface(
+        &net_benchmarking);
+    return net_benchmarking;
+  }
+
   static void ClearCache(const v8::FunctionCallbackInfo<v8::Value>& args) {
     int rv;
-    content::RenderThread::Get()->Send(new ChromeViewHostMsg_ClearCache(&rv));
+    GetNetBenchmarking().ClearCache(&rv);
     WebCache::clear();
   }
 
   static void ClearHostResolverCache(
       const v8::FunctionCallbackInfo<v8::Value>& args) {
-    content::RenderThread::Get()->Send(
-        new ChromeViewHostMsg_ClearHostResolverCache());
+    GetNetBenchmarking().ClearHostResolverCache();
   }
 
   static void ClearPredictorCache(
       const v8::FunctionCallbackInfo<v8::Value>& args) {
-    content::RenderThread::Get()->Send(
-        new ChromeViewHostMsg_ClearPredictorCache());
+    GetNetBenchmarking().ClearPredictorCache();
   }
 
   static void CloseConnections(
       const v8::FunctionCallbackInfo<v8::Value>& args) {
-    content::RenderThread::Get()->Send(
-        new ChromeViewHostMsg_CloseCurrentConnections());
+    GetNetBenchmarking().CloseCurrentConnections();
   }
 };
 

diff --git a/chrome/test/data/webui/bluetooth_internals_browsertest.js b/chrome/test/data/webui/bluetooth_internals_browsertest.js
index 1def822..fd2edc3a 100644
--- a/chrome/test/data/webui/bluetooth_internals_browsertest.js
+++ b/chrome/test/data/webui/bluetooth_internals_browsertest.js

@@ -264,6 +264,7 @@
     teardown(function() {
       adapterFactory.reset();
       sidebarObj.close();
+      snackbar.Snackbar.dismiss(true);
     });
 
     /**
@@ -465,8 +466,93 @@
       sidebarObj.close();
       expectFalse(sidebarNode.classList.contains('open'));
     });
+
+    /* Snackbar Tests */
+    function finishSnackbarTest(done) {
+      // Let event queue finish.
+      setTimeout(function() {
+        expectEquals(0, $('snackbar-container').children.length);
+        expectFalse(!!snackbar.Snackbar.current_);
+        done();
+      }, 10);
+    }
+
+    test('Snackbar_ShowTimeout', function(done) {
+      var snackbar1 = snackbar.Snackbar.show('Message 1');
+      assertEquals(1, $('snackbar-container').children.length);
+
+      snackbar1.addEventListener('dismissed', function() {
+        finishSnackbarTest(done);
+      });
+    });
+
+    test('Snackbar_ShowDismiss', function(done) {
+      var snackbar1 = snackbar.Snackbar.show('Message 1');
+      assertEquals(1, $('snackbar-container').children.length);
+      snackbar1.addEventListener('dismissed', function() {
+        finishSnackbarTest(done);
+      });
+
+      snackbar.Snackbar.dismiss();
+    });
+
+    test('Snackbar_QueueThreeDismiss', function(done) {
+      var expectedCalls = 3;
+      var actualCalls = 0;
+
+      var snackbar1 = snackbar.Snackbar.show('Message 1');
+      var snackbar2 = snackbar.Snackbar.show('Message 2');
+      var snackbar3 = snackbar.Snackbar.show('Message 3');
+
+      assertEquals(1, $('snackbar-container').children.length);
+      expectEquals(2, snackbar.Snackbar.queue_.length);
+
+      function next() {
+        actualCalls++;
+        snackbar.Snackbar.dismiss();
+      }
+
+      snackbar1.addEventListener('dismissed', next);
+      snackbar2.addEventListener('dismissed', next);
+      snackbar3.addEventListener('dismissed', function() {
+        next();
+        expectEquals(expectedCalls, actualCalls);
+        finishSnackbarTest(done);
+      });
+
+      snackbar.Snackbar.dismiss();
+    });
+
+    test('Snackbar_QueueThreeDismissAll', function(done) {
+      var expectedCalls = 1;
+      var actualCalls = 0;
+
+      var snackbar1 = snackbar.Snackbar.show('Message 1');
+      var snackbar2 = snackbar.Snackbar.show('Message 2');
+      var snackbar3 = snackbar.Snackbar.show('Message 3');
+
+      assertEquals(1, $('snackbar-container').children.length);
+      expectEquals(2, snackbar.Snackbar.queue_.length);
+
+      function next() {
+        assertTrue(false);
+      }
+
+      snackbar1.addEventListener('dismissed', function() {
+        expectEquals(0, snackbar.Snackbar.queue_.length);
+        expectFalse(!!snackbar.Snackbar.current_);
+        snackbar.Snackbar.dismiss();
+
+        finishSnackbarTest(done);
+      });
+      snackbar2.addEventListener('dismissed', next);
+      snackbar3.addEventListener('dismissed', next);
+
+      snackbar.Snackbar.dismiss(true);
+    });
   });
 
+
   // Run all registered tests.
   mocha.run();
 });

diff --git a/chromecast/media/cma/backend/BUILD.gn b/chromecast/media/cma/backend/BUILD.gn
index 8f6c822c..b0b18ab 100644
--- a/chromecast/media/cma/backend/BUILD.gn
+++ b/chromecast/media/cma/backend/BUILD.gn

@@ -76,3 +76,17 @@
     "//chromecast/public",
   ]
 }
+
+# Implementation of video decoder that discards decoder buffers.
+# Used on audio platforms for media streams containing video.
+source_set("null") {
+  sources = [
+    "video_decoder_null.cc",
+    "video_decoder_null.h",
+  ]
+
+  deps = [
+    "//base",
+    "//chromecast/public/media",
+  ]
+}

diff --git a/chromecast/media/cma/backend/alsa/BUILD.gn b/chromecast/media/cma/backend/alsa/BUILD.gn
index 8b38f102..93040a1 100644
--- a/chromecast/media/cma/backend/alsa/BUILD.gn
+++ b/chromecast/media/cma/backend/alsa/BUILD.gn

@@ -46,8 +46,6 @@
     "stream_mixer_alsa_input.h",
     "stream_mixer_alsa_input_impl.cc",
     "stream_mixer_alsa_input_impl.h",
-    "video_decoder_alsa.cc",
-    "video_decoder_alsa.h",
   ]
 
   libs = [ "asound" ]
@@ -58,6 +56,7 @@
     ":slew_volume",
     "//base",
     "//chromecast/base",
+    "//chromecast/media/cma/backend:null",
     "//chromecast/media/cma/base",
     "//chromecast/media/cma/decoder",
     "//chromecast/public/media",

diff --git a/chromecast/media/cma/backend/alsa/media_pipeline_backend_alsa.cc b/chromecast/media/cma/backend/alsa/media_pipeline_backend_alsa.cc
index 05e08793..8c33d6b7 100644
--- a/chromecast/media/cma/backend/alsa/media_pipeline_backend_alsa.cc
+++ b/chromecast/media/cma/backend/alsa/media_pipeline_backend_alsa.cc

@@ -8,7 +8,7 @@
 
 #include "chromecast/base/task_runner_impl.h"
 #include "chromecast/media/cma/backend/alsa/audio_decoder_alsa.h"
-#include "chromecast/media/cma/backend/alsa/video_decoder_alsa.h"
+#include "chromecast/media/cma/backend/video_decoder_null.h"
 
 namespace chromecast {
 namespace media {
@@ -35,7 +35,7 @@
   DCHECK_EQ(kStateUninitialized, state_);
   if (video_decoder_)
     return nullptr;
-  video_decoder_.reset(new VideoDecoderAlsa());
+  video_decoder_.reset(new VideoDecoderNull());
   return video_decoder_.get();
 }
 

diff --git a/chromecast/media/cma/backend/alsa/media_pipeline_backend_alsa.h b/chromecast/media/cma/backend/alsa/media_pipeline_backend_alsa.h
index 23b524d..de0baade 100644
--- a/chromecast/media/cma/backend/alsa/media_pipeline_backend_alsa.h
+++ b/chromecast/media/cma/backend/alsa/media_pipeline_backend_alsa.h

@@ -20,7 +20,7 @@
 namespace chromecast {
 namespace media {
 class AudioDecoderAlsa;
-class VideoDecoderAlsa;
+class VideoDecoderNull;
 
 class MediaPipelineBackendAlsa : public MediaPipelineBackend {
  public:
@@ -54,7 +54,7 @@
   State state_;
 
   const MediaPipelineDeviceParams params_;
-  std::unique_ptr<VideoDecoderAlsa> video_decoder_;
+  std::unique_ptr<VideoDecoderNull> video_decoder_;
   std::unique_ptr<AudioDecoderAlsa> audio_decoder_;
 
   DISALLOW_COPY_AND_ASSIGN(MediaPipelineBackendAlsa);

diff --git a/chromecast/media/cma/backend/alsa/video_decoder_alsa.cc b/chromecast/media/cma/backend/video_decoder_null.cc
similarity index 63%
rename from chromecast/media/cma/backend/alsa/video_decoder_alsa.cc
rename to chromecast/media/cma/backend/video_decoder_null.cc
index 69842019..b36ce0a8 100644
--- a/chromecast/media/cma/backend/alsa/video_decoder_alsa.cc
+++ b/chromecast/media/cma/backend/video_decoder_null.cc

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chromecast/media/cma/backend/alsa/video_decoder_alsa.h"
+#include "chromecast/media/cma/backend/video_decoder_null.h"
 
 #include "base/bind.h"
 #include "base/location.h"
@@ -13,35 +13,35 @@
 namespace chromecast {
 namespace media {
 
-VideoDecoderAlsa::VideoDecoderAlsa()
+VideoDecoderNull::VideoDecoderNull()
     : delegate_(nullptr), weak_factory_(this) {}
 
-VideoDecoderAlsa::~VideoDecoderAlsa() {}
+VideoDecoderNull::~VideoDecoderNull() {}
 
-void VideoDecoderAlsa::SetDelegate(Delegate* delegate) {
+void VideoDecoderNull::SetDelegate(Delegate* delegate) {
   DCHECK(delegate);
   delegate_ = delegate;
 }
 
-MediaPipelineBackend::BufferStatus VideoDecoderAlsa::PushBuffer(
+MediaPipelineBackend::BufferStatus VideoDecoderNull::PushBuffer(
     CastDecoderBuffer* buffer) {
   DCHECK(delegate_);
   DCHECK(buffer);
   if (buffer->end_of_stream()) {
     base::ThreadTaskRunnerHandle::Get()->PostTask(
-        FROM_HERE, base::Bind(&VideoDecoderAlsa::OnEndOfStream,
+        FROM_HERE, base::Bind(&VideoDecoderNull::OnEndOfStream,
                               weak_factory_.GetWeakPtr()));
   }
   return MediaPipelineBackend::kBufferSuccess;
 }
 
-void VideoDecoderAlsa::GetStatistics(Statistics* statistics) {}
+void VideoDecoderNull::GetStatistics(Statistics* statistics) {}
 
-bool VideoDecoderAlsa::SetConfig(const VideoConfig& config) {
+bool VideoDecoderNull::SetConfig(const VideoConfig& config) {
   return true;
 }
 
-void VideoDecoderAlsa::OnEndOfStream() {
+void VideoDecoderNull::OnEndOfStream() {
   delegate_->OnEndOfStream();
 }
 

diff --git a/chromecast/media/cma/backend/alsa/video_decoder_alsa.h b/chromecast/media/cma/backend/video_decoder_null.h
similarity index 65%
rename from chromecast/media/cma/backend/alsa/video_decoder_alsa.h
rename to chromecast/media/cma/backend/video_decoder_null.h
index ccaa19cd..b80c7d0 100644
--- a/chromecast/media/cma/backend/alsa/video_decoder_alsa.h
+++ b/chromecast/media/cma/backend/video_decoder_null.h

@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CHROMECAST_MEDIA_CMA_BACKEND_ALSA_VIDEO_DECODER_ALSA_H_
-#define CHROMECAST_MEDIA_CMA_BACKEND_ALSA_VIDEO_DECODER_ALSA_H_
+#ifndef CHROMECAST_MEDIA_CMA_BACKEND_VIDEO_DECODER_NULL_H_
+#define CHROMECAST_MEDIA_CMA_BACKEND_VIDEO_DECODER_NULL_H_
 
 #include <stdint.h>
 
@@ -14,10 +14,10 @@
 namespace chromecast {
 namespace media {
 
-class VideoDecoderAlsa : public MediaPipelineBackend::VideoDecoder {
+class VideoDecoderNull : public MediaPipelineBackend::VideoDecoder {
  public:
-  VideoDecoderAlsa();
-  ~VideoDecoderAlsa() override;
+  VideoDecoderNull();
+  ~VideoDecoderNull() override;
 
   // MediaPipelineBackend::VideoDecoder implementation:
   void SetDelegate(Delegate* delegate) override;
@@ -30,12 +30,12 @@
   void OnEndOfStream();
 
   Delegate* delegate_;
-  base::WeakPtrFactory<VideoDecoderAlsa> weak_factory_;
+  base::WeakPtrFactory<VideoDecoderNull> weak_factory_;
 
-  DISALLOW_COPY_AND_ASSIGN(VideoDecoderAlsa);
+  DISALLOW_COPY_AND_ASSIGN(VideoDecoderNull);
 };
 
 }  // namespace media
 }  // namespace chromecast
 
-#endif  // CHROMECAST_MEDIA_CMA_BACKEND_ALSA_VIDEO_DECODER_ALSA_H_
+#endif  // CHROMECAST_MEDIA_CMA_BACKEND_VIDEO_DECODER_NULL_H_

diff --git a/components/cryptauth/eid_generator.cc b/components/cryptauth/eid_generator.cc
index 057190c..8155349 100644
--- a/components/cryptauth/eid_generator.cc
+++ b/components/cryptauth/eid_generator.cc

@@ -29,6 +29,7 @@
 const int64_t EidGenerator::kNumMsInBeginningOfEidPeriod =
     base::TimeDelta::FromHours(2).InMilliseconds();
 const int32_t EidGenerator::kNumBytesInEidValue = 2;
+const int8_t EidGenerator::kBluetooth4Flag = 0x01;
 
 // static
 EidGenerator* EidGenerator::GetInstance() {
@@ -170,12 +171,18 @@
     const std::string& advertisement_service_data,
     const std::vector<RemoteDevice>& device_list,
     const std::vector<BeaconSeed>& scanning_device_beacon_seeds) const {
+  // Resize the service data to analyze only the first |2 * kNumBytesInEidValue|
+  // bytes. The bytes following these are flags, so they are not needed to
+  // identify the device which sent a message.
+  std::string service_data_without_flags = advertisement_service_data;
+  service_data_without_flags.resize(2 * kNumBytesInEidValue);
+
   for (const auto& remote_device : device_list) {
     std::vector<std::string> possible_advertisements =
         GeneratePossibleAdvertisements(remote_device.public_key,
                                        scanning_device_beacon_seeds);
     for (const auto& possible_advertisement : possible_advertisements) {
-      if (advertisement_service_data == possible_advertisement) {
+      if (service_data_without_flags == possible_advertisement) {
         return const_cast<RemoteDevice*>(&remote_device);
       }
     }

diff --git a/components/cryptauth/eid_generator.h b/components/cryptauth/eid_generator.h
index 89230e94..6219992 100644
--- a/components/cryptauth/eid_generator.h
+++ b/components/cryptauth/eid_generator.h

@@ -65,6 +65,12 @@
     const std::unique_ptr<DataWithTimestamp> adjacent_data;
   };
 
+  // The flag used to denote that a Bluetooth 4.0 device has sent an
+  // advertisement. This flag indicates to the recipient that the sender cannot
+  // act as both a central- and peripheral-role device simultaneously, so the
+  // recipient should advertise back instead of initializing a connection.
+  static const int8_t kBluetooth4Flag;
+
   static EidGenerator* GetInstance();
   virtual ~EidGenerator();
 

diff --git a/components/cryptauth/eid_generator_unittest.cc b/components/cryptauth/eid_generator_unittest.cc
index cd1d20c..8912647 100644
--- a/components/cryptauth/eid_generator_unittest.cc
+++ b/components/cryptauth/eid_generator_unittest.cc

@@ -542,6 +542,48 @@
   EXPECT_EQ(correct_device.public_key, identified_device->public_key);
 }
 
+TEST_F(CryptAuthEidGeneratorTest,
+    TestIdentifyRemoteDevice_OneDevice_ServiceDataWithOneByteFlag_Success) {
+  SetTestTime(kDefaultCurrentPeriodStart);
+
+  std::string service_data =
+      GenerateFakeAdvertisement(kSecondSeed, kDefaultCurrentPeriodStart,
+                                kDefaultAdvertisingDevicePublicKey);
+
+  // Identifying device should still succeed if there is an extra "flag" byte
+  // after the first 4 bytes.
+  service_data.append(1, static_cast<char>(EidGenerator::kBluetooth4Flag));
+
+  RemoteDevice correct_device =
+      CreateRemoteDevice(kDefaultAdvertisingDevicePublicKey);
+  std::vector<RemoteDevice> device_list = {correct_device};
+  const RemoteDevice* identified_device =
+      eid_generator_->IdentifyRemoteDeviceByAdvertisement(
+          service_data, device_list, scanning_device_beacon_seeds_);
+  EXPECT_EQ(correct_device.public_key, identified_device->public_key);
+}
+
+TEST_F(CryptAuthEidGeneratorTest,
+    TestIdentifyRemoteDevice_OneDevice_ServiceDataWithLongerFlag_Success) {
+  SetTestTime(kDefaultCurrentPeriodStart);
+
+  std::string service_data =
+      GenerateFakeAdvertisement(kSecondSeed, kDefaultCurrentPeriodStart,
+                                kDefaultAdvertisingDevicePublicKey);
+
+  // Identifying device should still succeed if there are extra "flag" bytes
+  // after the first 4 bytes.
+  service_data.append("extra_flag_bytes");
+
+  RemoteDevice correct_device =
+      CreateRemoteDevice(kDefaultAdvertisingDevicePublicKey);
+  std::vector<RemoteDevice> device_list = {correct_device};
+  const RemoteDevice* identified_device =
+      eid_generator_->IdentifyRemoteDeviceByAdvertisement(
+          service_data, device_list, scanning_device_beacon_seeds_);
+  EXPECT_EQ(correct_device.public_key, identified_device->public_key);
+}
+
 TEST_F(CryptAuthEidGeneratorTest, TestIdentifyRemoteDevice_OneDevice_Failure) {
   SetTestTime(kDefaultCurrentPeriodStart);
 

diff --git a/components/domain_reliability/util.cc b/components/domain_reliability/util.cc
index b95a0ba..f4af66913 100644
--- a/components/domain_reliability/util.cc
+++ b/components/domain_reliability/util.cc

@@ -124,6 +124,7 @@
     case net::HttpResponseInfo::CONNECTION_INFO_QUIC_34:
     case net::HttpResponseInfo::CONNECTION_INFO_QUIC_35:
     case net::HttpResponseInfo::CONNECTION_INFO_QUIC_36:
+    case net::HttpResponseInfo::CONNECTION_INFO_QUIC_37:
       return "QUIC";
     case net::HttpResponseInfo::NUM_OF_CONNECTION_INFOS:
       NOTREACHED();

diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
index 4b2c635..2648052e 100644
--- a/content/browser/BUILD.gn
+++ b/content/browser/BUILD.gn

@@ -1755,8 +1755,8 @@
       "renderer_host/render_widget_host_view_android.h",
       "screen_orientation/screen_orientation_delegate_android.cc",
       "screen_orientation/screen_orientation_delegate_android.h",
-      "screen_orientation/screen_orientation_message_filter_android.cc",
-      "screen_orientation/screen_orientation_message_filter_android.h",
+      "screen_orientation/screen_orientation_listener_android.cc",
+      "screen_orientation/screen_orientation_listener_android.h",
       "web_contents/web_contents_android.cc",
       "web_contents/web_contents_android.h",
       "web_contents/web_contents_view_android.cc",

diff --git a/content/browser/accessibility/browser_accessibility_cocoa.mm b/content/browser/accessibility/browser_accessibility_cocoa.mm
index 9b1017d..545a8d42 100644
--- a/content/browser/accessibility/browser_accessibility_cocoa.mm
+++ b/content/browser/accessibility/browser_accessibility_cocoa.mm

@@ -2,13 +2,16 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#import "content/browser/accessibility/browser_accessibility_cocoa.h"
+
 #include <execinfo.h>
 #include <stddef.h>
 #include <stdint.h>
-
-#import "content/browser/accessibility/browser_accessibility_cocoa.h"
+#include <string.h>
 
 #include <map>
+#include <memory>
+#include <utility>
 
 #include "base/mac/foundation_util.h"
 #include "base/mac/scoped_cftyperef.h"
@@ -23,8 +26,12 @@
 #include "content/browser/accessibility/one_shot_accessibility_tree_search.h"
 #include "content/public/common/content_client.h"
 #include "third_party/skia/include/core/SkColor.h"
+#include "ui/accessibility/ax_range.h"
 #import "ui/accessibility/platform/ax_platform_node_mac.h"
 
+using AXPlatformPositionInstance =
+    content::AXPlatformPosition::AXPositionInstance;
+using AXPlatformRange = ui::AXRange<AXPlatformPositionInstance::element_type>;
 using content::AXPlatformPosition;
 using content::AXTreeIDRegistry;
 using content::AccessibilityMatchPredicate;
@@ -128,88 +135,92 @@
 
 }  // extern "C"
 
-id CreateTextMarker(const BrowserAccessibility& object,
-                    int offset,
-                    ui::AXTextAffinity affinity) {
-  if (!object.instance_active())
-    return nil;
-
-  const auto manager = object.manager();
-  DCHECK(manager);
-  auto marker_data = AXPlatformPosition::CreateTextPosition(
-      manager->ax_tree_id(), object.GetId(), offset, affinity);
-  return (id)base::mac::CFTypeRefToNSObjectAutorelease(
-      AXTextMarkerCreate(kCFAllocatorDefault,
-                         reinterpret_cast<const UInt8*>(marker_data.release()),
-                         sizeof(AXPlatformPosition)));
+// to call |release| on it to transfer ownership of the position to the text
+// marker object.
+id CreateTextMarker(AXPlatformPositionInstance position) {
+  AXTextMarkerRef text_marker = AXTextMarkerCreate(
+      kCFAllocatorDefault, reinterpret_cast<const UInt8*>(position.release()),
+      sizeof(AXPlatformPosition));
+  return static_cast<id>(
+      base::mac::CFTypeRefToNSObjectAutorelease(text_marker));
 }
 
-id CreateTextMarkerRange(const BrowserAccessibility& start_object,
-                         int start_offset,
-                         ui::AXTextAffinity start_affinity,
-                         const BrowserAccessibility& end_object,
-                         int end_offset,
-                         ui::AXTextAffinity end_affinity) {
-  id start_marker = CreateTextMarker(
-        start_object, start_offset, start_affinity);
-  id end_marker = CreateTextMarker(end_object, end_offset, end_affinity);
-  return (id)base::mac::CFTypeRefToNSObjectAutorelease(
-      AXTextMarkerRangeCreate(kCFAllocatorDefault, start_marker, end_marker));
+// |range| is destructed at the end of this method and ownership of its |anchor|
+// and |focus| are transfered to the marker range object.
+id CreateTextMarkerRange(const AXPlatformRange range) {
+  AXTextMarkerRef start_marker = AXTextMarkerCreate(
+      kCFAllocatorDefault, reinterpret_cast<const UInt8*>(range.anchor()),
+      sizeof(AXPlatformPosition));
+  AXTextMarkerRef end_marker = AXTextMarkerCreate(
+      kCFAllocatorDefault, reinterpret_cast<const UInt8*>(range.focus()),
+      sizeof(AXPlatformPosition));
+  AXTextMarkerRangeRef marker_range =
+      AXTextMarkerRangeCreate(kCFAllocatorDefault, start_marker, end_marker);
+  return static_cast<id>(
+      base::mac::CFTypeRefToNSObjectAutorelease(marker_range));
 }
 
-bool GetTextMarkerData(AXTextMarkerRef text_marker,
-                       BrowserAccessibility** object,
-                       int* offset,
-                       ui::AXTextAffinity* affinity) {
+AXPlatformPositionInstance CreatePositionFromTextMarker(
+    AXTextMarkerRef text_marker) {
   DCHECK(text_marker);
-  DCHECK(object && offset);
   if (AXTextMarkerGetLength(text_marker) != sizeof(AXPlatformPosition))
-    return false;
+    return AXPlatformPosition::CreateNullPosition();
   const UInt8* source_buffer = AXTextMarkerGetBytePtr(text_marker);
   if (!source_buffer)
-    return false;
+    return AXPlatformPosition::CreateNullPosition();
   UInt8* destination_buffer = new UInt8[sizeof(AXPlatformPosition)];
   std::memcpy(destination_buffer, source_buffer, sizeof(AXPlatformPosition));
-  AXPlatformPosition::AXPositionInstance marker_data(
+  AXPlatformPosition::AXPositionInstance position(
       reinterpret_cast<AXPlatformPosition::AXPositionInstance::pointer>(
           destination_buffer));
-  if (marker_data->IsNullPosition())
-    return false;
-
-  *object = marker_data->GetAnchor();
-  if (!*object)
-    return false;
-
-  *offset = marker_data->text_offset();
-  if (*offset < 0)
-    return false;
-
-  *affinity = marker_data->affinity();
-  return true;
+  if (!position)
+    return AXPlatformPosition::CreateNullPosition();
+  return position;
 }
 
-bool GetTextMarkerRange(AXTextMarkerRangeRef marker_range,
-                        BrowserAccessibility** start_object,
-                        int* start_offset,
-                        ui::AXTextAffinity* start_affinity,
-                        BrowserAccessibility** end_object,
-                        int* end_offset,
-                        ui::AXTextAffinity* end_affinity) {
+AXPlatformRange CreateRangeFromTextMarkerRange(
+    AXTextMarkerRangeRef marker_range) {
   DCHECK(marker_range);
-  DCHECK(start_object && start_offset);
-  DCHECK(end_object && end_offset);
-
   base::ScopedCFTypeRef<AXTextMarkerRef> start_marker(
       AXTextMarkerRangeCopyStartMarker(marker_range));
   base::ScopedCFTypeRef<AXTextMarkerRef> end_marker(
       AXTextMarkerRangeCopyEndMarker(marker_range));
   if (!start_marker.get() || !end_marker.get())
-    return false;
+    return AXPlatformRange();
 
-  return GetTextMarkerData(start_marker.get(),
-                           start_object, start_offset, start_affinity) &&
-         GetTextMarkerData(end_marker.get(),
-                           end_object, end_offset, end_affinity);
+  AXPlatformPositionInstance anchor =
+      CreatePositionFromTextMarker(start_marker.get());
+  AXPlatformPositionInstance focus =
+      CreatePositionFromTextMarker(end_marker.get());
+  // |AXPlatformRange| takes ownership of its anchor and focus.
+  return AXPlatformRange(std::move(anchor), std::move(focus));
+}
+
+AXPlatformPositionInstance CreateTextPosition(
+    const BrowserAccessibility& object,
+    int offset,
+    ui::AXTextAffinity affinity) {
+  if (!object.instance_active())
+    return AXPlatformPosition::CreateNullPosition();
+
+  const BrowserAccessibilityManager* manager = object.manager();
+  DCHECK(manager);
+  return AXPlatformPosition::CreateTextPosition(
+      manager->ax_tree_id(), object.GetId(), offset, affinity);
+}
+
+AXPlatformRange CreateTextRange(const BrowserAccessibility& start_object,
+                                int start_offset,
+                                ui::AXTextAffinity start_affinity,
+                                const BrowserAccessibility& end_object,
+                                int end_offset,
+                                ui::AXTextAffinity end_affinity) {
+  AXPlatformPositionInstance anchor =
+      CreateTextPosition(start_object, start_offset, start_affinity);
+  AXPlatformPositionInstance focus =
+      CreateTextPosition(end_object, end_offset, end_affinity);
+  // |AXPlatformRange| takes ownership of its anchor and focus.
+  return AXPlatformRange(std::move(anchor), std::move(focus));
 }
 
 void AddMisspelledTextAttributes(
@@ -243,21 +254,10 @@
 }
 
 NSString* GetTextForTextMarkerRange(AXTextMarkerRangeRef marker_range) {
-  BrowserAccessibility* start_object;
-  BrowserAccessibility* end_object;
-  int start_offset, end_offset;
-  ui::AXTextAffinity start_affinity, end_affinity;
-  if (!GetTextMarkerRange(marker_range,
-                          &start_object, &start_offset, &start_affinity,
-                          &end_object, &end_offset, &end_affinity)) {
+  AXPlatformRange range = CreateRangeFromTextMarkerRange(marker_range);
+  if (range.IsNull())
     return nil;
-  }
-  DCHECK(start_object && end_object);
-  DCHECK_GE(start_offset, 0);
-  DCHECK_GE(end_offset, 0);
-
-  return base::SysUTF16ToNSString(BrowserAccessibilityManager::GetTextForRange(
-      *start_object, start_offset, *end_object, end_offset));
+  return base::SysUTF16ToNSString(range.GetText());
 }
 
 NSAttributedString* GetAttributedTextForTextMarkerRange(
@@ -266,11 +266,15 @@
   BrowserAccessibility* end_object;
   int start_offset, end_offset;
   ui::AXTextAffinity start_affinity, end_affinity;
-  if (!GetTextMarkerRange(marker_range,
-                          &start_object, &start_offset, &start_affinity,
-                          &end_object, &end_offset, &end_affinity)) {
+  AXPlatformRange ax_range = CreateRangeFromTextMarkerRange(marker_range);
+  if (ax_range.IsNull())
     return nil;
-  }
+  start_object = ax_range.anchor()->GetAnchor();
+  end_object = ax_range.focus()->GetAnchor();
+  start_offset = ax_range.anchor()->text_offset();
+  end_offset = ax_range.focus()->text_offset();
+  start_affinity = ax_range.anchor()->affinity();
+  end_affinity = ax_range.focus()->affinity();
 
   NSString* text = base::SysUTF16ToNSString(
       BrowserAccessibilityManager::GetTextForRange(*start_object, *end_object));
@@ -902,30 +906,14 @@
 // Returns a text marker that points to the last character in the document that
 // can be selected with VoiceOver.
 - (id)endTextMarker {
-  if (![self instanceActive])
-    return nil;
-
   const BrowserAccessibility* root =
       browserAccessibility_->manager()->GetRoot();
   if (!root)
     return nil;
 
-  const BrowserAccessibility* last_text_object =
-      root->InternalDeepestLastChild();
-  if (last_text_object && !last_text_object->IsTextOnlyObject()) {
-    last_text_object =
-        BrowserAccessibilityManager::PreviousTextOnlyObject(last_text_object);
-  }
-  while (last_text_object) {
-    last_text_object =
-        BrowserAccessibilityManager::PreviousTextOnlyObject(last_text_object);
-  }
-  if (!last_text_object)
-    return nil;
-
-  return CreateTextMarker(*last_text_object,
-                          last_text_object->GetText().length(),
-                          ui::AX_TEXT_AFFINITY_DOWNSTREAM);
+  AXPlatformPositionInstance position =
+      CreateTextPosition(*root, 0, ui::AX_TEXT_AFFINITY_DOWNSTREAM);
+  return CreateTextMarker(position->CreatePositionAtEndOfAnchor());
 }
 
 - (NSNumber*)expanded {
@@ -1636,8 +1624,9 @@
         manager->GetTreeData().sel_anchor_affinity;
   ui::AXTextAffinity focusAffinity = manager->GetTreeData().sel_focus_affinity;
 
-  return CreateTextMarkerRange(*anchorObject, anchorOffset, anchorAffinity,
-                               *focusObject, focusOffset, focusAffinity);
+  return CreateTextMarkerRange(CreateTextRange(*anchorObject, anchorOffset,
+                                               anchorAffinity, *focusObject,
+                                               focusOffset, focusAffinity));
 }
 
 - (NSValue*)size {
@@ -1674,28 +1663,14 @@
 // Returns a text marker that points to the first character in the document that
 // can be selected with VoiceOver.
 - (id)startTextMarker {
-  if (![self instanceActive])
-    return nil;
-
   const BrowserAccessibility* root =
       browserAccessibility_->manager()->GetRoot();
   if (!root)
     return nil;
 
-  const BrowserAccessibility* first_text_object =
-      root->InternalDeepestFirstChild();
-  if (first_text_object && !first_text_object->IsTextOnlyObject()) {
-    first_text_object =
-        BrowserAccessibilityManager::NextTextOnlyObject(first_text_object);
-  }
-  while (first_text_object) {
-    first_text_object =
-        BrowserAccessibilityManager::NextTextOnlyObject(first_text_object);
-  }
-  if (!first_text_object)
-    return nil;
-
-  return CreateTextMarker(*first_text_object, 0, ui::AX_TEXT_AFFINITY_UPSTREAM);
+  AXPlatformPositionInstance position =
+      CreateTextPosition(*root, 0, ui::AX_TEXT_AFFINITY_DOWNSTREAM);
+  return CreateTextMarker(position->CreatePositionAtStartOfAnchor());
 }
 
 // Returns a subrole based upon the role.
@@ -1992,7 +1967,6 @@
 
 // Returns the accessibility value for the given attribute and parameter. If the
 // value isn't supported this will return nil.
-// TODO(nektar): Implement all unimplemented attributes, e.g. text markers.
 - (id)accessibilityAttributeValue:(NSString*)attribute
                      forParameter:(id)parameter {
   if (![self instanceActive])
@@ -2094,181 +2068,106 @@
   }
 
   if ([attribute isEqualToString:@"AXUIElementForTextMarker"]) {
-    BrowserAccessibility* object;
-    int offset;
-    ui::AXTextAffinity affinity;
-    if (GetTextMarkerData(parameter, &object, &offset, &affinity))
-      return ToBrowserAccessibilityCocoa(object);
+    AXPlatformPositionInstance position =
+        CreatePositionFromTextMarker(parameter);
+    if (!position->IsNullPosition())
+      return ToBrowserAccessibilityCocoa(position->GetAnchor());
 
     return nil;
   }
 
   if ([attribute isEqualToString:@"AXTextMarkerRangeForUIElement"]) {
-    return CreateTextMarkerRange(*browserAccessibility_, 0,
-                                 ui::AX_TEXT_AFFINITY_UPSTREAM,
-                                 *browserAccessibility_,
-                                 browserAccessibility_->GetText().length(),
-                                 ui::AX_TEXT_AFFINITY_DOWNSTREAM);
+    AXPlatformPositionInstance startPosition = CreateTextPosition(
+        *browserAccessibility_, 0, ui::AX_TEXT_AFFINITY_DOWNSTREAM);
+    AXPlatformPositionInstance endPosition =
+        startPosition->CreatePositionAtEndOfAnchor();
+    AXPlatformRange range =
+        AXPlatformRange(std::move(startPosition), std::move(endPosition));
+    return CreateTextMarkerRange(std::move(range));
   }
 
   if ([attribute isEqualToString:@"AXStringForTextMarkerRange"])
-    GetTextForTextMarkerRange(parameter);
+    return GetTextForTextMarkerRange(parameter);
 
   if ([attribute isEqualToString:@"AXAttributedStringForTextMarkerRange"])
     return GetAttributedTextForTextMarkerRange(parameter);
 
   if ([attribute isEqualToString:@"AXNextTextMarkerForTextMarker"]) {
-    BrowserAccessibility* object;
-    int offset;
-    ui::AXTextAffinity affinity;
-    if (!GetTextMarkerData(parameter, &object, &offset, &affinity))
+    AXPlatformPositionInstance position =
+        CreatePositionFromTextMarker(parameter);
+    if (position->IsNullPosition())
       return nil;
-
-    DCHECK(object);
-    if ((object->IsSimpleTextControl() || object->IsTextOnlyObject()) &&
-        offset < static_cast<int>(object->GetText().length())) {
-      ++offset;
-    } else {
-      do {
-        object = BrowserAccessibilityManager::NextTextOnlyObject(object);
-      } while (
-          object &&
-          !(object->IsTextOnlyObject() && object->GetText().length() == 0));
-      if (!object)
-        return nil;
-
-      offset = 0;
-    }
-
-    return CreateTextMarker(*object, offset, ui::AX_TEXT_AFFINITY_DOWNSTREAM);
+    return CreateTextMarker(position->CreateNextCharacterPosition());
   }
 
   if ([attribute isEqualToString:@"AXPreviousTextMarkerForTextMarker"]) {
-    BrowserAccessibility* object;
-    int offset;
-    ui::AXTextAffinity affinity;
-    if (!GetTextMarkerData(parameter, &object, &offset, &affinity))
+    AXPlatformPositionInstance position =
+        CreatePositionFromTextMarker(parameter);
+    if (position->IsNullPosition())
       return nil;
-
-    DCHECK(object);
-    if ((object->IsSimpleTextControl() || object->IsTextOnlyObject()) &&
-        offset > 0) {
-      --offset;
-    } else {
-      do {
-        object = BrowserAccessibilityManager::PreviousTextOnlyObject(object);
-      } while (
-          object &&
-          !(object->IsTextOnlyObject() && object->GetText().length() == 0));
-      if (!object)
-        return nil;
-
-      offset = object->GetText().length() - 1;
-    }
-
-    return CreateTextMarker(*object, offset, ui::AX_TEXT_AFFINITY_DOWNSTREAM);
+    return CreateTextMarker(position->CreatePreviousCharacterPosition());
   }
 
-  // Currently we approximate end offsets of words and do not actually calculate
-  // end offsets of lines, but use the start offset of the next line instead.
-  // This seems to work in simple text fields.
-  // TODO(nektar): Fix end offsets of words and lines.
   if ([attribute isEqualToString:@"AXLeftWordTextMarkerRangeForTextMarker"]) {
-    BrowserAccessibility* object;
-    int original_offset;
-    ui::AXTextAffinity affinity;
-    if (!GetTextMarkerData(parameter, &object, &original_offset, &affinity))
+    AXPlatformPositionInstance position =
+        CreatePositionFromTextMarker(parameter);
+    if (position->IsNullPosition())
       return nil;
 
-    int start_offset =
-        object->GetWordStartBoundary(original_offset, ui::BACKWARDS_DIRECTION);
-    DCHECK_GE(start_offset, 0);
-
-    int end_offset =
-        object->GetWordStartBoundary(start_offset, ui::FORWARDS_DIRECTION);
-    DCHECK_GE(end_offset, 0);
-    if (start_offset < end_offset &&
-        end_offset < static_cast<int>(object->GetText().length())) {
-      --end_offset;
-    }
-    return CreateTextMarkerRange(*object, start_offset, affinity,
-                                 *object, end_offset, affinity);
+    AXPlatformPositionInstance startPosition =
+        position->CreatePreviousWordStartPosition();
+    AXPlatformPositionInstance endPosition =
+        startPosition->CreateNextWordEndPosition();
+    AXPlatformRange range(std::move(startPosition), std::move(endPosition));
+    return CreateTextMarkerRange(std::move(range));
   }
 
   if ([attribute isEqualToString:@"AXRightWordTextMarkerRangeForTextMarker"]) {
-    BrowserAccessibility* object;
-    int original_offset;
-    ui::AXTextAffinity affinity;
-    if (!GetTextMarkerData(parameter, &object, &original_offset, &affinity))
+    AXPlatformPositionInstance position =
+        CreatePositionFromTextMarker(parameter);
+    if (position->IsNullPosition())
       return nil;
 
-    int start_offset =
-        object->GetWordStartBoundary(original_offset, ui::FORWARDS_DIRECTION);
-    DCHECK_GE(start_offset, 0);
-
-    int end_offset =
-        object->GetWordStartBoundary(start_offset, ui::FORWARDS_DIRECTION);
-    DCHECK_GE(end_offset, 0);
-    if (start_offset < end_offset &&
-        end_offset < static_cast<int>(object->GetText().length())) {
-      --end_offset;
-    }
-    return CreateTextMarkerRange(*object, start_offset, affinity,
-                                 *object, end_offset, affinity);
+    AXPlatformPositionInstance endPosition =
+        position->CreateNextWordEndPosition();
+    AXPlatformPositionInstance startPosition =
+        endPosition->CreatePreviousWordStartPosition();
+    AXPlatformRange range(std::move(startPosition), std::move(endPosition));
+    return CreateTextMarkerRange(std::move(range));
   }
 
   if ([attribute isEqualToString:@"AXNextWordEndTextMarkerForTextMarker"]) {
-    BrowserAccessibility* object;
-    int offset;
-    ui::AXTextAffinity affinity;
-    if (!GetTextMarkerData(parameter, &object, &offset, &affinity))
+    AXPlatformPositionInstance position =
+        CreatePositionFromTextMarker(parameter);
+    if (position->IsNullPosition())
       return nil;
-
-    offset = object->GetWordStartBoundary(offset, ui::FORWARDS_DIRECTION);
-    DCHECK_GE(offset, 0);
-    if (offset > 0 && offset < static_cast<int>(object->GetText().length()))
-      --offset;
-    return CreateTextMarker(*object, offset, affinity);
+    return CreateTextMarker(position->CreateNextWordEndPosition());
   }
 
   if ([attribute
           isEqualToString:@"AXPreviousWordStartTextMarkerForTextMarker"]) {
-    BrowserAccessibility* object;
-    int offset;
-    ui::AXTextAffinity affinity;
-    if (!GetTextMarkerData(parameter, &object, &offset, &affinity))
+    AXPlatformPositionInstance position =
+        CreatePositionFromTextMarker(parameter);
+    if (position->IsNullPosition())
       return nil;
-
-    offset = object->GetWordStartBoundary(offset, ui::BACKWARDS_DIRECTION);
-    DCHECK_GE(offset, 0);
-    return CreateTextMarker(*object, offset, affinity);
+    return CreateTextMarker(position->CreatePreviousWordStartPosition());
   }
 
   if ([attribute isEqualToString:@"AXNextLineEndTextMarkerForTextMarker"]) {
-    BrowserAccessibility* object;
-    int offset;
-    ui::AXTextAffinity affinity;
-    if (!GetTextMarkerData(parameter, &object, &offset, &affinity))
+    AXPlatformPositionInstance position =
+        CreatePositionFromTextMarker(parameter);
+    if (position->IsNullPosition())
       return nil;
-
-    offset = object->GetLineStartBoundary(
-        offset, ui::FORWARDS_DIRECTION, affinity);
-    DCHECK_GE(offset, 0);
-    return CreateTextMarker(*object, offset, affinity);
+    return CreateTextMarker(position->CreateNextLineEndPosition());
   }
 
   if ([attribute
           isEqualToString:@"AXPreviousLineStartTextMarkerForTextMarker"]) {
-    BrowserAccessibility* object;
-    int offset;
-    ui::AXTextAffinity affinity;
-    if (!GetTextMarkerData(parameter, &object, &offset, &affinity))
+    AXPlatformPositionInstance position =
+        CreatePositionFromTextMarker(parameter);
+    if (position->IsNullPosition())
       return nil;
-
-    offset = object->GetLineStartBoundary(
-        offset, ui::BACKWARDS_DIRECTION, affinity);
-    DCHECK_GE(offset, 0);
-    return CreateTextMarker(*object, offset, affinity);
+    return CreateTextMarker(position->CreatePreviousLineStartPosition());
   }
 
   if ([attribute isEqualToString:@"AXLengthForTextMarkerRange"]) {
@@ -2314,20 +2213,14 @@
 
   if ([attribute isEqualToString:
            NSAccessibilityLineTextMarkerRangeForTextMarkerParameterizedAttribute]) {
-    BrowserAccessibility* object;
-    int offset;
-    ui::AXTextAffinity affinity;
-    if (!GetTextMarkerData(parameter, &object, &offset, &affinity))
+    AXPlatformPositionInstance position =
+        CreatePositionFromTextMarker(parameter);
+    if (position->IsNullPosition())
       return nil;
 
-    DCHECK(object);
-    int startOffset =
-        object->GetLineStartBoundary(offset, ui::BACKWARDS_DIRECTION, affinity);
-    int endOffset =
-        object->GetLineStartBoundary(offset, ui::FORWARDS_DIRECTION, affinity);
-    return CreateTextMarkerRange(
-        *object, startOffset, ui::AX_TEXT_AFFINITY_UPSTREAM,
-        *object, endOffset, ui::AX_TEXT_AFFINITY_DOWNSTREAM);
+    AXPlatformRange range(position->CreatePreviousLineStartPosition(),
+                          position->CreateNextLineEndPosition());
+    return CreateTextMarkerRange(std::move(range));
   }
 
   if ([attribute isEqualToString:
@@ -2335,12 +2228,14 @@
     BrowserAccessibility* startObject;
     BrowserAccessibility* endObject;
     int startOffset, endOffset;
-    ui::AXTextAffinity startAffinity, endAffinity;
-    if (!GetTextMarkerRange(parameter,
-                            &startObject, &startOffset, &startAffinity,
-                            &endObject, &endOffset, &endAffinity)) {
+    AXPlatformRange range = CreateRangeFromTextMarkerRange(parameter);
+    if (range.IsNull())
       return nil;
-    }
+
+    startObject = range.anchor()->GetAnchor();
+    endObject = range.focus()->GetAnchor();
+    startOffset = range.anchor()->text_offset();
+    endOffset = range.focus()->text_offset();
     DCHECK(startObject && endObject);
     DCHECK_GE(startOffset, 0);
     DCHECK_GE(endOffset, 0);
@@ -2360,44 +2255,21 @@
     if (![parameter isKindOfClass:[NSArray class]])
       return nil;
 
-    NSArray* array = parameter;
-    id first = [array objectAtIndex:0];
-    id second = [array objectAtIndex:1];
-    BrowserAccessibility* object1;
-    int offset1;
-    ui::AXTextAffinity affinity1;
-    if (!GetTextMarkerData(first, &object1, &offset1, &affinity1))
+    NSArray* text_marker_array = parameter;
+    if ([text_marker_array count] != 2)
       return nil;
 
-    BrowserAccessibility* object2;
-    int offset2;
-    ui::AXTextAffinity affinity2;
-    if (!GetTextMarkerData(second, &object2, &offset2, &affinity2))
-      return nil;
-
-    bool isInOrder = true;
-    if (object1 == object2) {
-      if (offset2 > offset1)
-        isInOrder = true;
-      else if (offset2 < offset1)
-        isInOrder = false;
-      else
-        return nil;
+    AXPlatformPositionInstance startPosition =
+        CreatePositionFromTextMarker([text_marker_array objectAtIndex:0]);
+    AXPlatformPositionInstance endPosition =
+        CreatePositionFromTextMarker([text_marker_array objectAtIndex:1]);
+    if (*startPosition <= *endPosition) {
+      return CreateTextMarkerRange(
+          AXPlatformRange(std::move(startPosition), std::move(endPosition)));
+    } else {
+      return CreateTextMarkerRange(
+          AXPlatformRange(std::move(endPosition), std::move(startPosition)));
     }
-
-    ui::AXTreeOrder order = BrowserAccessibilityManager::CompareNodes(
-        *object1, *object2);
-    if (order == ui::AX_TREE_ORDER_BEFORE ||
-        (order == ui::AX_TREE_ORDER_EQUAL && offset1 < offset2)) {
-      return CreateTextMarkerRange(*object1, offset1, affinity1,
-                                   *object2, offset2, affinity2);
-    }
-    if (order == ui::AX_TREE_ORDER_AFTER ||
-        (order == ui::AX_TREE_ORDER_EQUAL && offset1 > offset2)) {
-      return CreateTextMarkerRange(*object2, offset2, affinity2,
-                                   *object1, offset1, affinity1);
-    }
-    return nil;
   }
 
   if ([attribute isEqualToString:

diff --git a/content/browser/leveldb_wrapper_impl.cc b/content/browser/leveldb_wrapper_impl.cc
index cef3f86..c5571d8 100644
--- a/content/browser/leveldb_wrapper_impl.cc
+++ b/content/browser/leveldb_wrapper_impl.cc

@@ -259,10 +259,12 @@
     std::vector<leveldb::mojom::KeyValuePtr> data) {
   DCHECK(!map_);
   map_.reset(new ValueMap);
+  bytes_used_ = 0;
   for (auto& it : data) {
     DCHECK_GE(it->key.size(), prefix_.size());
     (*map_)[std::vector<uint8_t>(it->key.begin() + prefix_.size(),
                                  it->key.end())] = it->value;
+    bytes_used_ += it->key.size() - prefix_.size() + it->value.size();
   }
 
   // We proceed without using a backing store, nothing will be persisted but the

diff --git a/content/browser/leveldb_wrapper_impl_unittest.cc b/content/browser/leveldb_wrapper_impl_unittest.cc
index e173d98..75856c51 100644
--- a/content/browser/leveldb_wrapper_impl_unittest.cc
+++ b/content/browser/leveldb_wrapper_impl_unittest.cc

@@ -314,4 +314,129 @@
   EXPECT_EQ(value2, get_mock_data(kTestPrefix + key2));
 }
 
+TEST_F(LevelDBWrapperImplTest, PutOverQuotaLargeValue) {
+  std::vector<uint8_t> key = StdStringToUint8Vector("newkey");
+  std::vector<uint8_t> value(kTestSizeLimit, 4);
+
+  bool called = false;
+  bool success;
+  wrapper()->Put(key, value, kTestSource,
+                 base::Bind(&SuccessCallback, &called, &success));
+  ASSERT_TRUE(called);
+  EXPECT_FALSE(success);
+
+  value.resize(kTestSizeLimit / 2);
+  called = false;
+  wrapper()->Put(key, value, kTestSource,
+                 base::Bind(&SuccessCallback, &called, &success));
+  ASSERT_TRUE(called);
+  EXPECT_TRUE(success);
+}
+
+TEST_F(LevelDBWrapperImplTest, PutOverQuotaLargeKey) {
+  std::vector<uint8_t> key(kTestSizeLimit, 'a');
+  std::vector<uint8_t> value = StdStringToUint8Vector("newvalue");
+
+  bool called = false;
+  bool success;
+  wrapper()->Put(key, value, kTestSource,
+                 base::Bind(&SuccessCallback, &called, &success));
+  ASSERT_TRUE(called);
+  EXPECT_FALSE(success);
+
+  key.resize(kTestSizeLimit / 2);
+  called = false;
+  wrapper()->Put(key, value, kTestSource,
+                 base::Bind(&SuccessCallback, &called, &success));
+  ASSERT_TRUE(called);
+  EXPECT_TRUE(success);
+}
+
+TEST_F(LevelDBWrapperImplTest, PutWhenAlreadyOverQuota) {
+  std::string key = "largedata";
+  std::vector<uint8_t> value(kTestSizeLimit, 4);
+
+  set_mock_data(kTestPrefix + key, Uint8VectorToStdString(value));
+
+  // Put with same data should succeed.
+  bool called = false;
+  bool success;
+  wrapper()->Put(StdStringToUint8Vector(key), value, kTestSource,
+                 base::Bind(&SuccessCallback, &called, &success));
+  ASSERT_TRUE(called);
+  EXPECT_TRUE(success);
+
+  // Put with same data size should succeed.
+  called = false;
+  value[1] = 13;
+  wrapper()->Put(StdStringToUint8Vector(key), value, kTestSource,
+                 base::Bind(&SuccessCallback, &called, &success));
+  ASSERT_TRUE(called);
+  EXPECT_TRUE(success);
+
+  // Adding a new key when already over quota should not succeed.
+  called = false;
+  wrapper()->Put(StdStringToUint8Vector("newkey"), {1, 2, 3}, kTestSource,
+                 base::Bind(&SuccessCallback, &called, &success));
+  ASSERT_TRUE(called);
+  EXPECT_FALSE(success);
+
+  // Reducing size should also succeed.
+  value.resize(kTestSizeLimit / 2);
+  called = false;
+  wrapper()->Put(StdStringToUint8Vector(key), value, kTestSource,
+                 base::Bind(&SuccessCallback, &called, &success));
+  ASSERT_TRUE(called);
+  EXPECT_TRUE(success);
+
+  // Increasing size again should succeed, as still under the limit.
+  value.resize(value.size() + 1);
+  called = false;
+  wrapper()->Put(StdStringToUint8Vector(key), value, kTestSource,
+                 base::Bind(&SuccessCallback, &called, &success));
+  ASSERT_TRUE(called);
+  EXPECT_TRUE(success);
+
+  // But increasing back to original size should fail.
+  value.resize(kTestSizeLimit);
+  called = false;
+  wrapper()->Put(StdStringToUint8Vector(key), value, kTestSource,
+                 base::Bind(&SuccessCallback, &called, &success));
+  ASSERT_TRUE(called);
+  EXPECT_FALSE(success);
+}
+
+TEST_F(LevelDBWrapperImplTest, PutWhenAlreadyOverQuotaBecauseOfLargeKey) {
+  std::vector<uint8_t> key(kTestSizeLimit, 'x');
+  std::vector<uint8_t> value = StdStringToUint8Vector("value");
+
+  set_mock_data(kTestPrefix + Uint8VectorToStdString(key),
+                Uint8VectorToStdString(value));
+
+  // Put with same data size should succeed.
+  bool called = false;
+  bool success;
+  value[0] = 'X';
+  wrapper()->Put(key, value, kTestSource,
+                 base::Bind(&SuccessCallback, &called, &success));
+  ASSERT_TRUE(called);
+  EXPECT_TRUE(success);
+
+  // Reducing size should also succeed.
+  value.clear();
+  called = false;
+  wrapper()->Put(key, value, kTestSource,
+                 base::Bind(&SuccessCallback, &called, &success));
+  ASSERT_TRUE(called);
+  EXPECT_TRUE(success);
+
+  // Increasing size should fail.
+  value.resize(1, 'a');
+  called = false;
+  wrapper()->Put(key, value, kTestSource,
+                 base::Bind(&SuccessCallback, &called, &success));
+  ASSERT_TRUE(called);
+  EXPECT_FALSE(success);
+}
+
 }  // namespace content

diff --git a/content/browser/loader/resource_loader.cc b/content/browser/loader/resource_loader.cc
index e30970b9..bb77021 100644
--- a/content/browser/loader/resource_loader.cc
+++ b/content/browser/loader/resource_loader.cc

@@ -157,6 +157,11 @@
 }
 
 void ResourceLoader::StartRequest() {
+  if (delegate_->HandleExternalProtocol(this, request_->url())) {
+    CancelAndIgnore();
+    return;
+  }
+
   // Give the handler a chance to delay the URLRequest from being started.
   bool defer_start = false;
   if (!handler_->OnWillStart(request_->url(), &defer_start)) {
@@ -268,6 +273,12 @@
     }
   }
 
+  if (delegate_->HandleExternalProtocol(this, redirect_info.new_url)) {
+    // The request is complete so we can remove it.
+    CancelAndIgnore();
+    return;
+  }
+
   scoped_refptr<ResourceResponse> response = new ResourceResponse();
   PopulateResourceResponse(info, request_.get(), response.get());
   delegate_->DidReceiveRedirect(this, redirect_info.new_url, response.get());
@@ -275,12 +286,6 @@
     Cancel();
   } else if (*defer) {
     deferred_stage_ = DEFERRED_REDIRECT;  // Follow redirect when resumed.
-    DCHECK(deferred_redirect_url_.is_empty());
-    deferred_redirect_url_ = redirect_info.new_url;
-  } else if (delegate_->HandleExternalProtocol(this, redirect_info.new_url)) {
-    // The request is complete so we can remove it.
-    CancelAndIgnore();
-    return;
   }
 }
 
@@ -445,7 +450,7 @@
       StartRequestInternal();
       break;
     case DEFERRED_REDIRECT:
-      FollowDeferredRedirectInternal();
+      request_->FollowDeferredRedirect();
       break;
     case DEFERRED_READ:
       base::ThreadTaskRunnerHandle::Get()->PostTask(
@@ -473,17 +478,10 @@
 void ResourceLoader::StartRequestInternal() {
   DCHECK(!request_->is_pending());
 
-  // Note: at this point any possible deferred start actions are already over.
-
   if (!request_->status().is_success()) {
     return;
   }
 
-  if (delegate_->HandleExternalProtocol(this, request_->url())) {
-    CancelAndIgnore();
-    return;
-  }
-
   started_request_ = true;
   request_->Start();
 
@@ -536,17 +534,6 @@
   }
 }
 
-void ResourceLoader::FollowDeferredRedirectInternal() {
-  DCHECK(!deferred_redirect_url_.is_empty());
-  GURL redirect_url = deferred_redirect_url_;
-  deferred_redirect_url_ = GURL();
-  if (delegate_->HandleExternalProtocol(this, deferred_redirect_url_)) {
-    CancelAndIgnore();
-  } else {
-    request_->FollowDeferredRedirect();
-  }
-}
-
 void ResourceLoader::CompleteResponseStarted() {
   ResourceRequestInfoImpl* info = GetRequestInfo();
   scoped_refptr<ResourceResponse> response = new ResourceResponse();

diff --git a/content/browser/loader/resource_loader.h b/content/browser/loader/resource_loader.h
index 40603a4..43b7530 100644
--- a/content/browser/loader/resource_loader.h
+++ b/content/browser/loader/resource_loader.h

@@ -16,7 +16,6 @@
 #include "content/browser/ssl/ssl_error_handler.h"
 #include "content/common/content_export.h"
 #include "net/url_request/url_request.h"
-#include "url/gurl.h"
 
 namespace net {
 class X509Certificate;
@@ -84,7 +83,6 @@
 
   void StartRequestInternal();
   void CancelRequestInternal(int error, bool from_renderer);
-  void FollowDeferredRedirectInternal();
   void CompleteResponseStarted();
   void ReadMore(bool is_continuation);
   void ResumeReading();
@@ -141,9 +139,6 @@
   bool started_request_;
   int times_cancelled_after_request_start_;
 
-  // Stores the URL from a deferred redirect.
-  GURL deferred_redirect_url_;
-
   base::WeakPtrFactory<ResourceLoader> weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(ResourceLoader);

diff --git a/content/browser/loader/resource_loader_unittest.cc b/content/browser/loader/resource_loader_unittest.cc
index cda1a544..6515453 100644
--- a/content/browser/loader/resource_loader_unittest.cc
+++ b/content/browser/loader/resource_loader_unittest.cc

@@ -7,10 +7,8 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#include <deque>
 #include <memory>
 #include <utility>
-#include <vector>
 
 #include "base/files/file.h"
 #include "base/files/file_util.h"
@@ -503,18 +501,7 @@
   bool HandleExternalProtocol(ResourceLoader* loader,
                               const GURL& url) override {
     EXPECT_EQ(loader, loader_.get());
-    ++handle_external_protocol_;
-
-    // Check that calls to HandleExternalProtocol always happen after the calls
-    // to the ResourceHandler's OnWillStart and OnRequestRedirected.
-    EXPECT_EQ(handle_external_protocol_,
-              raw_ptr_resource_handler_->on_will_start_called() +
-                  raw_ptr_resource_handler_->on_request_redirected_called());
-
-    bool return_value = handle_external_protocol_results_.front();
-    if (handle_external_protocol_results_.size() > 1)
-      handle_external_protocol_results_.pop_front();
-    return return_value;
+    return false;
   }
   void DidStartRequest(ResourceLoader* loader) override {
     EXPECT_EQ(loader, loader_.get());
@@ -561,12 +548,6 @@
   int did_received_redirect_ = 0;
   int did_receive_response_ = 0;
   int did_finish_loading_ = 0;
-  int handle_external_protocol_ = 0;
-
-  // Allows controlling the return values of sequential calls to
-  // HandleExternalProtocol. Values are removed by the measure they are used
-  // but the last one which is used for all following calls.
-  std::deque<bool> handle_external_protocol_results_{false};
 
   net::URLRequestJobFactoryImpl job_factory_;
   TestNetworkQualityEstimator network_quality_estimator_;
@@ -768,7 +749,6 @@
   EXPECT_EQ(1, did_received_redirect_);
   EXPECT_EQ(1, did_receive_response_);
   EXPECT_EQ(1, did_finish_loading_);
-  EXPECT_EQ(2, handle_external_protocol_);
   EXPECT_EQ(1, raw_ptr_resource_handler_->on_request_redirected_called());
   EXPECT_EQ(1, raw_ptr_resource_handler_->on_response_completed_called());
   EXPECT_EQ(net::OK, raw_ptr_resource_handler_->final_status().error());
@@ -785,53 +765,12 @@
   EXPECT_EQ(0, did_received_redirect_);
   EXPECT_EQ(1, did_receive_response_);
   EXPECT_EQ(1, did_finish_loading_);
-  EXPECT_EQ(1, handle_external_protocol_);
   EXPECT_EQ(0, raw_ptr_resource_handler_->on_request_redirected_called());
   EXPECT_EQ(1, raw_ptr_resource_handler_->on_response_completed_called());
   EXPECT_EQ(net::OK, raw_ptr_resource_handler_->final_status().error());
   EXPECT_EQ(test_data(), raw_ptr_resource_handler_->body());
 }
 
-// Test the case where ResourceHandler defers nothing and the request is handled
-// as an external protocol on start.
-TEST_F(ResourceLoaderTest, SyncExternalProtocolHandlingOnStart) {
-  handle_external_protocol_results_ = {true};
-
-  loader_->StartRequest();
-  raw_ptr_resource_handler_->WaitUntilResponseComplete();
-  EXPECT_EQ(0, did_start_request_);
-  EXPECT_EQ(0, did_received_redirect_);
-  EXPECT_EQ(0, did_receive_response_);
-  EXPECT_EQ(1, did_finish_loading_);
-  EXPECT_EQ(1, handle_external_protocol_);
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_will_start_called());
-  EXPECT_EQ(0, raw_ptr_resource_handler_->on_request_redirected_called());
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_response_completed_called());
-  EXPECT_EQ(net::ERR_ABORTED,
-            raw_ptr_resource_handler_->final_status().error());
-  EXPECT_TRUE(raw_ptr_resource_handler_->body().empty());
-}
-
-// Test the case where ResourceHandler defers nothing and the request is handled
-// as an external protocol on redirect.
-TEST_F(ResourceLoaderTest, SyncExternalProtocolHandlingOnRedirect) {
-  handle_external_protocol_results_ = {false, true};
-
-  loader_->StartRequest();
-  raw_ptr_resource_handler_->WaitUntilResponseComplete();
-  EXPECT_EQ(1, did_start_request_);
-  EXPECT_EQ(1, did_received_redirect_);
-  EXPECT_EQ(0, did_receive_response_);
-  EXPECT_EQ(1, did_finish_loading_);
-  EXPECT_EQ(2, handle_external_protocol_);
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_will_start_called());
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_request_redirected_called());
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_response_completed_called());
-  EXPECT_EQ(net::ERR_ABORTED,
-            raw_ptr_resource_handler_->final_status().error());
-  EXPECT_TRUE(raw_ptr_resource_handler_->body().empty());
-}
-
 // Test the case the ResourceHandler defers everything.
 TEST_F(ResourceLoaderTest, AsyncResourceHandler) {
   raw_ptr_resource_handler_->set_defer_on_will_start(true);
@@ -852,13 +791,11 @@
   EXPECT_EQ(1, raw_ptr_resource_handler_->on_will_start_called());
   EXPECT_EQ(0, raw_ptr_resource_handler_->on_request_redirected_called());
   EXPECT_EQ(0, raw_ptr_resource_handler_->on_response_completed_called());
-  EXPECT_EQ(0, handle_external_protocol_);
 
   // Resume and run until OnRequestRedirected.
   raw_ptr_resource_handler_->Resume();
   raw_ptr_resource_handler_->WaitUntilDeferred();
   EXPECT_EQ(1, raw_ptr_resource_handler_->on_request_redirected_called());
-  EXPECT_EQ(1, handle_external_protocol_);
 
   // Spinning the message loop should not advance the state further.
   base::RunLoop().RunUntilIdle();
@@ -867,95 +804,11 @@
   EXPECT_EQ(1, raw_ptr_resource_handler_->on_request_redirected_called());
   EXPECT_EQ(0, raw_ptr_resource_handler_->on_will_read_called());
   EXPECT_EQ(0, raw_ptr_resource_handler_->on_response_completed_called());
-  EXPECT_EQ(1, handle_external_protocol_);
 
   // Resume and run until OnResponseStarted.
   raw_ptr_resource_handler_->Resume();
   raw_ptr_resource_handler_->WaitUntilDeferred();
   EXPECT_EQ(1, raw_ptr_resource_handler_->on_response_started_called());
-  EXPECT_EQ(2, handle_external_protocol_);
-
-  // Spinning the message loop should not advance the state further.
-  base::RunLoop().RunUntilIdle();
-  EXPECT_EQ(1, did_receive_response_);
-  EXPECT_EQ(0, did_finish_loading_);
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_response_started_called());
-  EXPECT_EQ(0, raw_ptr_resource_handler_->on_will_read_called());
-  EXPECT_EQ(0, raw_ptr_resource_handler_->on_response_completed_called());
-
-  // Resume and run until OnReadCompleted.
-  raw_ptr_resource_handler_->Resume();
-  raw_ptr_resource_handler_->WaitUntilDeferred();
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_read_completed_called());
-
-  // Spinning the message loop should not advance the state further.
-  base::RunLoop().RunUntilIdle();
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_will_read_called());
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_read_completed_called());
-  EXPECT_EQ(0, raw_ptr_resource_handler_->on_read_eof());
-  EXPECT_EQ(0, raw_ptr_resource_handler_->on_response_completed_called());
-
-  // Resume and run until the final 0-byte read, signaling EOF.
-  raw_ptr_resource_handler_->Resume();
-  raw_ptr_resource_handler_->WaitUntilDeferred();
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_read_eof());
-
-  // Spinning the message loop should not advance the state further.
-  base::RunLoop().RunUntilIdle();
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_read_eof());
-  EXPECT_EQ(0, raw_ptr_resource_handler_->on_response_completed_called());
-  EXPECT_EQ(test_data(), raw_ptr_resource_handler_->body());
-
-  // Resume and run until OnResponseCompleted is called, which again defers the
-  // request.
-  raw_ptr_resource_handler_->Resume();
-  raw_ptr_resource_handler_->WaitUntilResponseComplete();
-  EXPECT_EQ(0, did_finish_loading_);
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_response_completed_called());
-  EXPECT_EQ(net::OK, raw_ptr_resource_handler_->final_status().error());
-  EXPECT_EQ(test_data(), raw_ptr_resource_handler_->body());
-
-  // Resume and run until all pending tasks. Note that OnResponseCompleted was
-  // invoked in the previous section, so can't use RunUntilCompleted().
-  raw_ptr_resource_handler_->Resume();
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_response_completed_called());
-
-  base::RunLoop().RunUntilIdle();
-  EXPECT_EQ(1, did_finish_loading_);
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_response_completed_called());
-  EXPECT_EQ(net::OK, raw_ptr_resource_handler_->final_status().error());
-  EXPECT_EQ(test_data(), raw_ptr_resource_handler_->body());
-  EXPECT_EQ(2, handle_external_protocol_);
-}
-
-// Same as above, except reads complete asynchronously and there's no redirect.
-TEST_F(ResourceLoaderTest, AsyncResourceHandlerAsyncReads) {
-  SetUpResourceLoaderForUrl(test_async_url());
-
-  raw_ptr_resource_handler_->set_defer_on_will_start(true);
-  raw_ptr_resource_handler_->set_defer_on_response_started(true);
-  raw_ptr_resource_handler_->set_defer_on_read_completed(true);
-  raw_ptr_resource_handler_->set_defer_on_read_eof(true);
-  raw_ptr_resource_handler_->set_defer_on_response_completed(true);
-
-  // Start and run until OnWillStart.
-  loader_->StartRequest();
-  raw_ptr_resource_handler_->WaitUntilDeferred();
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_will_start_called());
-
-  // Spinning the message loop should not advance the state further.
-  base::RunLoop().RunUntilIdle();
-  EXPECT_EQ(0, did_start_request_);
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_will_start_called());
-  EXPECT_EQ(0, raw_ptr_resource_handler_->on_request_redirected_called());
-  EXPECT_EQ(0, raw_ptr_resource_handler_->on_response_completed_called());
-  EXPECT_EQ(0, handle_external_protocol_);
-
-  // Resume and run until OnResponseStarted.
-  raw_ptr_resource_handler_->Resume();
-  raw_ptr_resource_handler_->WaitUntilDeferred();
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_response_started_called());
-  EXPECT_EQ(1, handle_external_protocol_);
 
   // Spinning the message loop should not advance the state further.
   base::RunLoop().RunUntilIdle();
@@ -1007,7 +860,85 @@
   EXPECT_EQ(1, raw_ptr_resource_handler_->on_response_completed_called());
   EXPECT_EQ(net::OK, raw_ptr_resource_handler_->final_status().error());
   EXPECT_EQ(test_data(), raw_ptr_resource_handler_->body());
-  EXPECT_EQ(1, handle_external_protocol_);
+}
+
+// Same as above, except reads complete asynchronously and there's no redirect.
+TEST_F(ResourceLoaderTest, AsyncResourceHandlerAsyncReads) {
+  SetUpResourceLoaderForUrl(test_async_url());
+
+  raw_ptr_resource_handler_->set_defer_on_will_start(true);
+  raw_ptr_resource_handler_->set_defer_on_response_started(true);
+  raw_ptr_resource_handler_->set_defer_on_read_completed(true);
+  raw_ptr_resource_handler_->set_defer_on_read_eof(true);
+  raw_ptr_resource_handler_->set_defer_on_response_completed(true);
+
+  // Start and run until OnWillStart.
+  loader_->StartRequest();
+  raw_ptr_resource_handler_->WaitUntilDeferred();
+  EXPECT_EQ(1, raw_ptr_resource_handler_->on_will_start_called());
+
+  // Spinning the message loop should not advance the state further.
+  base::RunLoop().RunUntilIdle();
+  EXPECT_EQ(0, did_start_request_);
+  EXPECT_EQ(1, raw_ptr_resource_handler_->on_will_start_called());
+  EXPECT_EQ(0, raw_ptr_resource_handler_->on_request_redirected_called());
+  EXPECT_EQ(0, raw_ptr_resource_handler_->on_response_completed_called());
+
+  // Resume and run until OnResponseStarted.
+  raw_ptr_resource_handler_->Resume();
+  raw_ptr_resource_handler_->WaitUntilDeferred();
+  EXPECT_EQ(1, raw_ptr_resource_handler_->on_response_started_called());
+
+  // Spinning the message loop should not advance the state further.
+  base::RunLoop().RunUntilIdle();
+  EXPECT_EQ(1, did_receive_response_);
+  EXPECT_EQ(0, did_finish_loading_);
+  EXPECT_EQ(1, raw_ptr_resource_handler_->on_response_started_called());
+  EXPECT_EQ(0, raw_ptr_resource_handler_->on_will_read_called());
+  EXPECT_EQ(0, raw_ptr_resource_handler_->on_response_completed_called());
+
+  // Resume and run until OnReadCompleted.
+  raw_ptr_resource_handler_->Resume();
+  raw_ptr_resource_handler_->WaitUntilDeferred();
+  EXPECT_EQ(1, raw_ptr_resource_handler_->on_read_completed_called());
+
+  // Spinning the message loop should not advance the state further.
+  base::RunLoop().RunUntilIdle();
+  EXPECT_EQ(1, raw_ptr_resource_handler_->on_will_read_called());
+  EXPECT_EQ(1, raw_ptr_resource_handler_->on_read_completed_called());
+  EXPECT_EQ(0, raw_ptr_resource_handler_->on_read_eof());
+  EXPECT_EQ(0, raw_ptr_resource_handler_->on_response_completed_called());
+
+  // Resume and run until the final 0-byte read, signalling EOF.
+  raw_ptr_resource_handler_->Resume();
+  raw_ptr_resource_handler_->WaitUntilDeferred();
+  EXPECT_EQ(1, raw_ptr_resource_handler_->on_read_eof());
+
+  // Spinning the message loop should not advance the state further.
+  base::RunLoop().RunUntilIdle();
+  EXPECT_EQ(1, raw_ptr_resource_handler_->on_read_eof());
+  EXPECT_EQ(0, raw_ptr_resource_handler_->on_response_completed_called());
+  EXPECT_EQ(test_data(), raw_ptr_resource_handler_->body());
+
+  // Resume and run until OnResponseCompleted is called, which again defers the
+  // request.
+  raw_ptr_resource_handler_->Resume();
+  raw_ptr_resource_handler_->WaitUntilResponseComplete();
+  EXPECT_EQ(0, did_finish_loading_);
+  EXPECT_EQ(1, raw_ptr_resource_handler_->on_response_completed_called());
+  EXPECT_EQ(net::OK, raw_ptr_resource_handler_->final_status().error());
+  EXPECT_EQ(test_data(), raw_ptr_resource_handler_->body());
+
+  // Resume and run until all pending tasks. Note that OnResponseCompleted was
+  // invoked in the previous section, so can't use RunUntilCompleted().
+  raw_ptr_resource_handler_->Resume();
+  EXPECT_EQ(1, raw_ptr_resource_handler_->on_response_completed_called());
+
+  base::RunLoop().RunUntilIdle();
+  EXPECT_EQ(1, did_finish_loading_);
+  EXPECT_EQ(1, raw_ptr_resource_handler_->on_response_completed_called());
+  EXPECT_EQ(net::OK, raw_ptr_resource_handler_->final_status().error());
+  EXPECT_EQ(test_data(), raw_ptr_resource_handler_->body());
 }
 
 TEST_F(ResourceLoaderTest, SyncCancelOnWillStart) {
@@ -1018,7 +949,6 @@
   base::RunLoop().RunUntilIdle();
   EXPECT_EQ(0, did_start_request_);
   EXPECT_EQ(1, did_finish_loading_);
-  EXPECT_EQ(0, handle_external_protocol_);
   EXPECT_EQ(1, raw_ptr_resource_handler_->on_will_start_called());
   EXPECT_EQ(0, raw_ptr_resource_handler_->on_request_redirected_called());
   EXPECT_EQ(0, raw_ptr_resource_handler_->on_response_started_called());
@@ -1038,7 +968,6 @@
   EXPECT_EQ(1, did_received_redirect_);
   EXPECT_EQ(0, did_receive_response_);
   EXPECT_EQ(1, did_finish_loading_);
-  EXPECT_EQ(1, handle_external_protocol_);
   EXPECT_EQ(1, raw_ptr_resource_handler_->on_request_redirected_called());
   EXPECT_EQ(0, raw_ptr_resource_handler_->on_will_read_called());
   EXPECT_EQ(0, raw_ptr_resource_handler_->on_read_completed_called());
@@ -1161,7 +1090,6 @@
   base::RunLoop().RunUntilIdle();
   EXPECT_EQ(0, did_start_request_);
   EXPECT_EQ(1, did_finish_loading_);
-  EXPECT_EQ(0, handle_external_protocol_);
   EXPECT_EQ(1, raw_ptr_resource_handler_->on_will_start_called());
   EXPECT_EQ(0, raw_ptr_resource_handler_->on_request_redirected_called());
   EXPECT_EQ(0, raw_ptr_resource_handler_->on_response_started_called());
@@ -1181,7 +1109,6 @@
   EXPECT_EQ(1, did_received_redirect_);
   EXPECT_EQ(0, did_receive_response_);
   EXPECT_EQ(1, did_finish_loading_);
-  EXPECT_EQ(1, handle_external_protocol_);
   EXPECT_EQ(1, raw_ptr_resource_handler_->on_request_redirected_called());
   EXPECT_EQ(0, raw_ptr_resource_handler_->on_will_read_called());
   EXPECT_EQ(0, raw_ptr_resource_handler_->on_read_completed_called());
@@ -1277,67 +1204,6 @@
   EXPECT_EQ(test_data(), raw_ptr_resource_handler_->body());
 }
 
-// Tests the request being deferred and then being handled as an external
-// protocol, both on start.
-TEST_F(ResourceLoaderTest, AsyncExternalProtocolHandlingOnStart) {
-  handle_external_protocol_results_ = {true};
-  raw_ptr_resource_handler_->set_defer_on_will_start(true);
-
-  loader_->StartRequest();
-  raw_ptr_resource_handler_->WaitUntilDeferred();
-  EXPECT_EQ(0, did_finish_loading_);
-  EXPECT_EQ(0, handle_external_protocol_);
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_will_start_called());
-  EXPECT_EQ(0, raw_ptr_resource_handler_->on_response_completed_called());
-
-  raw_ptr_resource_handler_->Resume();
-  raw_ptr_resource_handler_->WaitUntilResponseComplete();
-  EXPECT_EQ(0, did_start_request_);
-  EXPECT_EQ(1, did_finish_loading_);
-  EXPECT_EQ(1, handle_external_protocol_);
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_will_start_called());
-  EXPECT_EQ(0, raw_ptr_resource_handler_->on_request_redirected_called());
-  EXPECT_EQ(0, raw_ptr_resource_handler_->on_response_started_called());
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_response_completed_called());
-
-  EXPECT_EQ(net::ERR_ABORTED,
-            raw_ptr_resource_handler_->final_status().error());
-  EXPECT_EQ("", raw_ptr_resource_handler_->body());
-}
-
-// Tests the request being deferred and then being handled as an external
-// protocol, both on redirect.
-TEST_F(ResourceLoaderTest, AsyncExternalProtocolHandlingOnRedirect) {
-  handle_external_protocol_results_ = {false, true};
-  raw_ptr_resource_handler_->set_defer_on_request_redirected(true);
-
-  loader_->StartRequest();
-  raw_ptr_resource_handler_->WaitUntilDeferred();
-  EXPECT_EQ(1, did_start_request_);
-  EXPECT_EQ(1, did_received_redirect_);
-  EXPECT_EQ(0, did_finish_loading_);
-  EXPECT_EQ(1, handle_external_protocol_);
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_will_start_called());
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_request_redirected_called());
-  EXPECT_EQ(0, raw_ptr_resource_handler_->on_response_completed_called());
-
-  raw_ptr_resource_handler_->Resume();
-  raw_ptr_resource_handler_->WaitUntilResponseComplete();
-  EXPECT_EQ(1, did_start_request_);
-  EXPECT_EQ(1, did_received_redirect_);
-  EXPECT_EQ(0, did_receive_response_);
-  EXPECT_EQ(1, did_finish_loading_);
-  EXPECT_EQ(2, handle_external_protocol_);
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_will_start_called());
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_request_redirected_called());
-  EXPECT_EQ(0, raw_ptr_resource_handler_->on_response_started_called());
-  EXPECT_EQ(1, raw_ptr_resource_handler_->on_response_completed_called());
-
-  EXPECT_EQ(net::ERR_ABORTED,
-            raw_ptr_resource_handler_->final_status().error());
-  EXPECT_EQ("", raw_ptr_resource_handler_->body());
-}
-
 TEST_F(ResourceLoaderTest, RequestFailsOnStart) {
   SetUpResourceLoaderForUrl(
       net::URLRequestFailedJob::GetMockHttpUrlWithFailurePhase(
@@ -1349,7 +1215,6 @@
   EXPECT_EQ(0, did_received_redirect_);
   EXPECT_EQ(0, did_receive_response_);
   EXPECT_EQ(1, did_finish_loading_);
-  EXPECT_EQ(1, handle_external_protocol_);
   EXPECT_EQ(1, raw_ptr_resource_handler_->on_will_start_called());
   EXPECT_EQ(0, raw_ptr_resource_handler_->on_request_redirected_called());
   EXPECT_EQ(0, raw_ptr_resource_handler_->on_response_started_called());
@@ -1409,7 +1274,6 @@
   EXPECT_EQ(0, raw_ptr_resource_handler_->on_request_redirected_called());
   EXPECT_EQ(0, raw_ptr_resource_handler_->on_response_started_called());
   EXPECT_EQ(0, raw_ptr_resource_handler_->on_response_completed_called());
-  EXPECT_EQ(1, handle_external_protocol_);
 
   raw_ptr_resource_handler_->CancelWithError(net::ERR_FAILED);
   raw_ptr_resource_handler_->WaitUntilResponseComplete();
@@ -1417,7 +1281,6 @@
   EXPECT_EQ(0, did_received_redirect_);
   EXPECT_EQ(0, did_receive_response_);
   EXPECT_EQ(1, did_finish_loading_);
-  EXPECT_EQ(1, handle_external_protocol_);
   EXPECT_EQ(1, raw_ptr_resource_handler_->on_will_start_called());
   EXPECT_EQ(0, raw_ptr_resource_handler_->on_request_redirected_called());
   EXPECT_EQ(0, raw_ptr_resource_handler_->on_response_started_called());
@@ -1438,14 +1301,12 @@
   EXPECT_EQ(1, raw_ptr_resource_handler_->on_response_started_called());
   EXPECT_EQ(0, raw_ptr_resource_handler_->on_read_completed_called());
   EXPECT_EQ(0, raw_ptr_resource_handler_->on_response_completed_called());
-  EXPECT_EQ(1, handle_external_protocol_);
 
   raw_ptr_resource_handler_->CancelWithError(net::ERR_FAILED);
   raw_ptr_resource_handler_->WaitUntilResponseComplete();
   EXPECT_EQ(0, did_received_redirect_);
   EXPECT_EQ(1, did_receive_response_);
   EXPECT_EQ(1, did_finish_loading_);
-  EXPECT_EQ(1, handle_external_protocol_);
   EXPECT_EQ(1, raw_ptr_resource_handler_->on_will_start_called());
   EXPECT_EQ(0, raw_ptr_resource_handler_->on_request_redirected_called());
   EXPECT_EQ(1, raw_ptr_resource_handler_->on_response_started_called());

diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
index 4a248aac..5cbe9463 100644
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc

@@ -200,7 +200,7 @@
 
 #if defined(OS_ANDROID)
 #include "content/browser/android/child_process_launcher_android.h"
-#include "content/browser/screen_orientation/screen_orientation_message_filter_android.h"
+#include "content/browser/screen_orientation/screen_orientation_listener_android.h"
 #include "content/public/browser/android/java_interfaces.h"
 #include "ipc/ipc_sync_channel.h"
 #include "media/audio/android/audio_manager_android.h"
@@ -1180,7 +1180,7 @@
   AddFilter(new PushMessagingMessageFilter(
       GetID(), storage_partition_impl_->GetServiceWorkerContext()));
 #if defined(OS_ANDROID)
-  AddFilter(new ScreenOrientationMessageFilterAndroid());
+  AddFilter(new ScreenOrientationListenerAndroid());
   synchronous_compositor_filter_ =
       new SynchronousCompositorBrowserFilter(GetID());
   AddFilter(synchronous_compositor_filter_.get());

diff --git a/content/browser/screen_orientation/screen_orientation_listener_android.cc b/content/browser/screen_orientation/screen_orientation_listener_android.cc
new file mode 100644
index 0000000..850e89e5
--- /dev/null
+++ b/content/browser/screen_orientation/screen_orientation_listener_android.cc

@@ -0,0 +1,46 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/screen_orientation/screen_orientation_listener_android.h"
+
+#include "base/message_loop/message_loop.h"
+#include "content/browser/screen_orientation/screen_orientation_delegate_android.h"
+#include "content/common/screen_orientation_messages.h"
+
+namespace content {
+
+ScreenOrientationListenerAndroid::ScreenOrientationListenerAndroid()
+    : BrowserMessageFilter(ScreenOrientationMsgStart),
+      BrowserAssociatedInterface<device::mojom::ScreenOrientationListener>(
+          this,
+          this),
+      listeners_count_(0) {}
+
+ScreenOrientationListenerAndroid::~ScreenOrientationListenerAndroid() {
+  DCHECK(base::MessageLoopForIO::IsCurrent());
+  if (listeners_count_ > 0)
+    ScreenOrientationDelegateAndroid::StopAccurateListening();
+}
+
+bool ScreenOrientationListenerAndroid::OnMessageReceived(
+    const IPC::Message& message) {
+  return false;
+}
+
+void ScreenOrientationListenerAndroid::Start() {
+  DCHECK(base::MessageLoopForIO::IsCurrent());
+  ++listeners_count_;
+  if (listeners_count_ == 1)
+    ScreenOrientationDelegateAndroid::StartAccurateListening();
+}
+
+void ScreenOrientationListenerAndroid::Stop() {
+  DCHECK(base::MessageLoopForIO::IsCurrent());
+  DCHECK(listeners_count_ > 0);
+  --listeners_count_;
+  if (listeners_count_ == 0)
+    ScreenOrientationDelegateAndroid::StopAccurateListening();
+}
+
+}  // namespace content

diff --git a/content/browser/screen_orientation/screen_orientation_listener_android.h b/content/browser/screen_orientation/screen_orientation_listener_android.h
new file mode 100644
index 0000000..680af97
--- /dev/null
+++ b/content/browser/screen_orientation/screen_orientation_listener_android.h

@@ -0,0 +1,40 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_SCREEN_ORIENTATION_SCREEN_ORIENTATION_LISTENER_ANDROID_H_
+#define CONTENT_BROWSER_SCREEN_ORIENTATION_SCREEN_ORIENTATION_LISTENER_ANDROID_H_
+
+#include "base/macros.h"
+#include "content/public/browser/browser_associated_interface.h"
+#include "content/public/browser/browser_message_filter.h"
+#include "device/screen_orientation/public/interfaces/screen_orientation.mojom.h"
+
+namespace content {
+
+class ScreenOrientationListenerAndroid
+    : public BrowserMessageFilter,
+      public BrowserAssociatedInterface<
+          device::mojom::ScreenOrientationListener>,
+      public NON_EXPORTED_BASE(device::mojom::ScreenOrientationListener) {
+ public:
+  ScreenOrientationListenerAndroid();
+
+  // BrowserMessageFilter implementation.
+  bool OnMessageReceived(const IPC::Message& message) override;
+
+ private:
+  ~ScreenOrientationListenerAndroid() override;
+
+  // device::mojom::ScreenOrientationListener:
+  void Start() override;
+  void Stop() override;
+
+  int listeners_count_;
+
+  DISALLOW_COPY_AND_ASSIGN(ScreenOrientationListenerAndroid);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_SCREEN_ORIENTATION_SCREEN_ORIENTATION_LISTENER_ANDROID_H_

diff --git a/content/browser/screen_orientation/screen_orientation_message_filter_android.cc b/content/browser/screen_orientation/screen_orientation_message_filter_android.cc
deleted file mode 100644
index cd7bd18..0000000
--- a/content/browser/screen_orientation/screen_orientation_message_filter_android.cc
+++ /dev/null

@@ -1,49 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/screen_orientation/screen_orientation_message_filter_android.h"
-
-#include "content/browser/screen_orientation/screen_orientation_delegate_android.h"
-#include "content/common/screen_orientation_messages.h"
-
-namespace content {
-
-ScreenOrientationMessageFilterAndroid::ScreenOrientationMessageFilterAndroid()
-    : BrowserMessageFilter(ScreenOrientationMsgStart)
-    , listeners_count_(0) {
-}
-
-ScreenOrientationMessageFilterAndroid::~ScreenOrientationMessageFilterAndroid()
-{
-  if (listeners_count_ > 0)
-    ScreenOrientationDelegateAndroid::StopAccurateListening();
-}
-
-bool ScreenOrientationMessageFilterAndroid::OnMessageReceived(
-    const IPC::Message& message) {
-  bool handled = true;
-  IPC_BEGIN_MESSAGE_MAP(ScreenOrientationMessageFilterAndroid, message)
-    IPC_MESSAGE_HANDLER(ScreenOrientationHostMsg_StartListening,
-                        OnStartListening)
-    IPC_MESSAGE_HANDLER(ScreenOrientationHostMsg_StopListening,
-                        OnStopListening)
-    IPC_MESSAGE_UNHANDLED(handled = false)
-  IPC_END_MESSAGE_MAP()
-  return handled;
-}
-
-void ScreenOrientationMessageFilterAndroid::OnStartListening() {
-  ++listeners_count_;
-  if (listeners_count_ == 1)
-    ScreenOrientationDelegateAndroid::StartAccurateListening();
-}
-
-void ScreenOrientationMessageFilterAndroid::OnStopListening() {
-  DCHECK(listeners_count_ > 0);
-  --listeners_count_;
-  if (listeners_count_ == 0)
-    ScreenOrientationDelegateAndroid::StopAccurateListening();
-}
-
-}  // namespace content

diff --git a/content/browser/screen_orientation/screen_orientation_message_filter_android.h b/content/browser/screen_orientation/screen_orientation_message_filter_android.h
deleted file mode 100644
index be506f3c..0000000
--- a/content/browser/screen_orientation/screen_orientation_message_filter_android.h
+++ /dev/null

@@ -1,33 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_BROWSER_SCREEN_ORIENTATION_SCREEN_ORIENTATION_MESSAGE_FILTER_ANDROID_H_
-#define CONTENT_BROWSER_SCREEN_ORIENTATION_SCREEN_ORIENTATION_MESSAGE_FILTER_ANDROID_H_
-
-#include "base/macros.h"
-#include "content/public/browser/browser_message_filter.h"
-
-namespace content {
-
-class ScreenOrientationMessageFilterAndroid : public BrowserMessageFilter {
- public:
-  ScreenOrientationMessageFilterAndroid();
-
-  // BrowserMessageFilter implementation.
-  bool OnMessageReceived(const IPC::Message& message) override;
-
- private:
-  ~ScreenOrientationMessageFilterAndroid() override;
-
-  void OnStartListening();
-  void OnStopListening();
-
-  int listeners_count_;
-
-  DISALLOW_COPY_AND_ASSIGN(ScreenOrientationMessageFilterAndroid);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_BROWSER_SCREEN_ORIENTATION_SCREEN_ORIENTATION_MESSAGE_FILTER_ANDROID_H_

diff --git a/content/common/screen_orientation_messages.h b/content/common/screen_orientation_messages.h
index 1a0e3e8..fd456622 100644
--- a/content/common/screen_orientation_messages.h
+++ b/content/common/screen_orientation_messages.h

@@ -19,17 +19,3 @@
 IPC_ENUM_TRAITS_MIN_MAX_VALUE(blink::WebScreenOrientationLockType,
                               blink::WebScreenOrientationLockDefault,
                               blink::WebScreenOrientationLockNatural)
-
-// The renderer process is now using the Screen Orientation API and informs the
-// browser process that it should start accurately listening to the screen
-// orientation if it wasn't already.
-// This is only expected to be acted upon when the underlying platform requires
-// heavy work in order to accurately know the screen orientation.
-IPC_MESSAGE_CONTROL0(ScreenOrientationHostMsg_StartListening)
-
-// The renderer process is no longer using the Screen Orientation API and
-// informs the browser process that it can stop accurately listening to the
-// screen orientation if no other process cares about it.
-// This is only expected to be acted upon when the underlying platform requires
-// heavy work in order to accurately know the screen orientation.
-IPC_MESSAGE_CONTROL0(ScreenOrientationHostMsg_StopListening)

diff --git a/content/public/common/manifest.h b/content/public/common/manifest.h
index 8e6ce266..d558d66 100644
--- a/content/public/common/manifest.h
+++ b/content/public/common/manifest.h

@@ -27,6 +27,11 @@
   // Structure representing an icon as per the Manifest specification, see:
   // http://w3c.github.io/manifest/#dfn-icon-object
   struct CONTENT_EXPORT Icon {
+    enum IconPurpose {
+      ANY = 0,
+      BADGE,
+    };
+
     Icon();
     Icon(const Icon& other);
     ~Icon();
@@ -46,6 +51,11 @@
     // Empty if the parsing failed, the field was not present or empty.
     // The special value "any" is represented by gfx::Size(0, 0).
     std::vector<gfx::Size> sizes;
+
+    // Empty if the field was not present or not of type "string". Defaults to
+    // a vector with a single value, IconPurpose::ANY, for all other parsing
+    // exceptions.
+    std::vector<IconPurpose> purpose;
   };
 
   // Structure representing a related application.

diff --git a/content/renderer/manifest/manifest_parser.cc b/content/renderer/manifest/manifest_parser.cc
index 442e0d8..93e5969 100644
--- a/content/renderer/manifest/manifest_parser.cc
+++ b/content/renderer/manifest/manifest_parser.cc

@@ -276,6 +276,38 @@
   return sizes;
 }
 
+std::vector<Manifest::Icon::IconPurpose> ManifestParser::ParseIconPurpose(
+    const base::DictionaryValue& icon) {
+  base::NullableString16 purpose_str = ParseString(icon, "purpose", NoTrim);
+  std::vector<Manifest::Icon::IconPurpose> purposes;
+
+  if (purpose_str.is_null()) {
+    purposes.push_back(Manifest::Icon::IconPurpose::ANY);
+    return purposes;
+  }
+
+  std::vector<base::string16> keywords = base::SplitString(
+      purpose_str.string(), base::ASCIIToUTF16(" "),
+      base::TRIM_WHITESPACE, base::SPLIT_WANT_NONEMPTY);
+  for (const base::string16& keyword : keywords) {
+    if (base::LowerCaseEqualsASCII(keyword, "any")) {
+      purposes.push_back(Manifest::Icon::IconPurpose::ANY);
+    } else if (base::LowerCaseEqualsASCII(keyword, "badge")) {
+      purposes.push_back(Manifest::Icon::IconPurpose::BADGE);
+    } else {
+      AddErrorInfo(
+          "found icon with invalid purpose. "
+          "Using default value 'any'.");
+    }
+  }
+
+  if (purposes.empty()) {
+    purposes.push_back(Manifest::Icon::IconPurpose::ANY);
+  }
+
+  return purposes;
+}
+
 std::vector<Manifest::Icon> ManifestParser::ParseIcons(
     const base::DictionaryValue& dictionary) {
   std::vector<Manifest::Icon> icons;
@@ -300,6 +332,7 @@
       continue;
     icon.type = ParseIconType(*icon_dictionary);
     icon.sizes = ParseIconSizes(*icon_dictionary);
+    icon.purpose = ParseIconPurpose(*icon_dictionary);
 
     icons.push_back(icon);
   }

diff --git a/content/renderer/manifest/manifest_parser.h b/content/renderer/manifest/manifest_parser.h
index 9355930..3487b81 100644
--- a/content/renderer/manifest/manifest_parser.h
+++ b/content/renderer/manifest/manifest_parser.h

@@ -131,6 +131,15 @@
   // by gfx::Size(0, 0).
   std::vector<gfx::Size> ParseIconSizes(const base::DictionaryValue& icon);
 
+  // Parses the 'purpose' field of an icon, as defined in:
+  // https://w3c.github.io/manifest/#dfn-steps-for-processing-a-purpose-member-of-an-image
+  // Returns a vector of Manifest::Icon::IconPurpose with the successfully
+  // parsed icon purposes, an empty vector if the field was not present or not
+  // of type "string", and a vector containing Manifest::Icon::IconPurpose::Any
+  // for all other parsing exceptions.
+  std::vector<Manifest::Icon::IconPurpose> ParseIconPurpose(
+      const base::DictionaryValue& icon);
+
   // Parses the 'icons' field of a Manifest, as defined in:
   // https://w3c.github.io/manifest/#dfn-steps-for-processing-an-array-of-images
   // Returns a vector of Manifest::Icon with the successfully parsed icons, if

diff --git a/content/renderer/manifest/manifest_parser_unittest.cc b/content/renderer/manifest/manifest_parser_unittest.cc
index a2d12554..1026b3e 100644
--- a/content/renderer/manifest/manifest_parser_unittest.cc
+++ b/content/renderer/manifest/manifest_parser_unittest.cc

@@ -878,6 +878,110 @@
   }
 }
 
+TEST_F(ManifestParserTest, IconPurposeParseRules) {
+  const std::string kPurposeParseStringError =
+      "property 'purpose' ignored, type string expected.";
+  const std::string kPurposeInvalidValueError =
+      "found icon with invalid purpose. "
+      "Using default value 'any'.";
+
+  // Smoke test.
+  {
+    Manifest manifest = ParseManifest("{ \"icons\": [ {\"src\": \"\","
+        "\"purpose\": \"any\" } ] }");
+    EXPECT_EQ(manifest.icons[0].purpose.size(), 1u);
+    EXPECT_EQ(0u, GetErrorCount());
+  }
+
+  // Trim leading and trailing whitespaces.
+  {
+    Manifest manifest = ParseManifest("{ \"icons\": [ {\"src\": \"\","
+        "\"purpose\": \"  any  \" } ] }");
+    EXPECT_EQ(manifest.icons[0].purpose.size(), 1u);
+    EXPECT_EQ(0u, GetErrorCount());
+  }
+
+  // 'any' is added when property isn't present.
+  {
+    Manifest manifest = ParseManifest("{ \"icons\": [ {\"src\": \"\" } ] }");
+    EXPECT_EQ(manifest.icons[0].purpose.size(), 1u);
+    EXPECT_EQ(manifest.icons[0].purpose[0], Manifest::Icon::IconPurpose::ANY);
+    EXPECT_EQ(0u, GetErrorCount());
+  }
+
+  // 'any' is added with error message when property isn't a string (is a
+  // number).
+  {
+    Manifest manifest = ParseManifest("{ \"icons\": [ {\"src\": \"\","
+        "\"purpose\": 42 } ] }");
+    EXPECT_EQ(manifest.icons[0].purpose.size(), 1u);
+    EXPECT_EQ(manifest.icons[0].purpose[0], Manifest::Icon::IconPurpose::ANY);
+    ASSERT_EQ(1u, GetErrorCount());
+    EXPECT_EQ(kPurposeParseStringError, errors()[0]);
+  }
+
+  // 'any' is added with error message when property isn't a string (is a
+  // dictionary).
+  {
+    Manifest manifest = ParseManifest("{ \"icons\": [ {\"src\": \"\","
+        "\"purpose\": {} } ] }");
+    EXPECT_EQ(manifest.icons[0].purpose.size(), 1u);
+    EXPECT_EQ(manifest.icons[0].purpose[0], Manifest::Icon::IconPurpose::ANY);
+    ASSERT_EQ(1u, GetErrorCount());
+    EXPECT_EQ(kPurposeParseStringError, errors()[0]);
+  }
+
+  // Smoke test: values correctly parsed.
+  {
+    Manifest manifest = ParseManifest("{ \"icons\": [ {\"src\": \"\","
+        "\"purpose\": \"Any Badge\" } ] }");
+    ASSERT_EQ(manifest.icons[0].purpose.size(), 2u);
+    EXPECT_EQ(manifest.icons[0].purpose[0], Manifest::Icon::IconPurpose::ANY);
+    EXPECT_EQ(manifest.icons[0].purpose[1], Manifest::Icon::IconPurpose::BADGE);
+    EXPECT_EQ(0u, GetErrorCount());
+  }
+
+  // Trim whitespaces between values.
+  {
+    Manifest manifest = ParseManifest("{ \"icons\": [ {\"src\": \"\","
+        "\"purpose\": \"  Any   Badge  \" } ] }");
+    ASSERT_EQ(manifest.icons[0].purpose.size(), 2u);
+    EXPECT_EQ(manifest.icons[0].purpose[0], Manifest::Icon::IconPurpose::ANY);
+    EXPECT_EQ(manifest.icons[0].purpose[1], Manifest::Icon::IconPurpose::BADGE);
+    EXPECT_EQ(0u, GetErrorCount());
+  }
+
+  // Twice the same value is parsed twice.
+  {
+    Manifest manifest = ParseManifest("{ \"icons\": [ {\"src\": \"\","
+        "\"purpose\": \"badge badge\" } ] }");
+    ASSERT_EQ(manifest.icons[0].purpose.size(), 2u);
+    EXPECT_EQ(manifest.icons[0].purpose[0], Manifest::Icon::IconPurpose::BADGE);
+    EXPECT_EQ(manifest.icons[0].purpose[1], Manifest::Icon::IconPurpose::BADGE);
+    EXPECT_EQ(0u, GetErrorCount());
+  }
+
+  // Invalid icon purpose is ignored.
+  {
+    Manifest manifest = ParseManifest("{ \"icons\": [ {\"src\": \"\","
+        "\"purpose\": \"badge notification\" } ] }");
+    ASSERT_EQ(manifest.icons[0].purpose.size(), 1u);
+    EXPECT_EQ(manifest.icons[0].purpose[0], Manifest::Icon::IconPurpose::BADGE);
+    ASSERT_EQ(1u, GetErrorCount());
+    EXPECT_EQ(kPurposeInvalidValueError, errors()[0]);
+  }
+
+  // 'any' is added when developer-supplied purpose is invalid.
+  {
+    Manifest manifest = ParseManifest("{ \"icons\": [ {\"src\": \"\","
+        "\"purpose\": \"notification\" } ] }");
+    ASSERT_EQ(manifest.icons[0].purpose.size(), 1u);
+    EXPECT_EQ(manifest.icons[0].purpose[0], Manifest::Icon::IconPurpose::ANY);
+    ASSERT_EQ(1u, GetErrorCount());
+    EXPECT_EQ(kPurposeInvalidValueError, errors()[0]);
+  }
+}
+
 TEST_F(ManifestParserTest, RelatedApplicationsParseRules) {
   // If no application, empty list.
   {

diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 7b6e75e..bacdf86 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc

@@ -1932,11 +1932,15 @@
 }
 
 void RenderFrameImpl::OnCopyImageAt(int x, int y) {
-  frame_->copyImageAt(WebPoint(x, y));
+  blink::WebFloatRect viewport_position(x, y, 0, 0);
+  GetRenderWidget()->convertWindowToViewport(&viewport_position);
+  frame_->copyImageAt(WebPoint(viewport_position.x, viewport_position.y));
 }
 
 void RenderFrameImpl::OnSaveImageAt(int x, int y) {
-  frame_->saveImageAt(WebPoint(x, y));
+  blink::WebFloatRect viewport_position(x, y, 0, 0);
+  GetRenderWidget()->convertWindowToViewport(&viewport_position);
+  frame_->saveImageAt(WebPoint(viewport_position.x, viewport_position.y));
 }
 
 void RenderFrameImpl::OnAddMessageToConsole(ConsoleMessageLevel level,

diff --git a/content/renderer/screen_orientation/screen_orientation_observer.cc b/content/renderer/screen_orientation/screen_orientation_observer.cc
index 8cb05fe..4549d98a 100644
--- a/content/renderer/screen_orientation/screen_orientation_observer.cc
+++ b/content/renderer/screen_orientation/screen_orientation_observer.cc

@@ -4,7 +4,7 @@
 
 #include "content/renderer/screen_orientation/screen_orientation_observer.h"
 
-#include "content/common/screen_orientation_messages.h"
+#include "content/renderer/render_thread_impl.h"
 
 namespace content {
 
@@ -23,11 +23,20 @@
 }
 
 void ScreenOrientationObserver::SendStartMessage() {
-  RenderThread::Get()->Send(new ScreenOrientationHostMsg_StartListening());
+  GetScreenOrientationListener()->Start();
 }
 
 void ScreenOrientationObserver::SendStopMessage() {
-  RenderThread::Get()->Send(new ScreenOrientationHostMsg_StopListening());
+  GetScreenOrientationListener()->Stop();
+}
+
+device::mojom::ScreenOrientationListener*
+ScreenOrientationObserver::GetScreenOrientationListener() {
+  if (!listener_) {
+    RenderThreadImpl::current()->GetChannel()->GetRemoteAssociatedInterface(
+        &listener_);
+  }
+  return listener_.get();
 }
 
 } // namespace content

diff --git a/content/renderer/screen_orientation/screen_orientation_observer.h b/content/renderer/screen_orientation/screen_orientation_observer.h
index 48cca8c..3e39689 100644
--- a/content/renderer/screen_orientation/screen_orientation_observer.h
+++ b/content/renderer/screen_orientation/screen_orientation_observer.h

@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "content/public/renderer/platform_event_observer.h"
+#include "device/screen_orientation/public/interfaces/screen_orientation.mojom.h"
 
 namespace content {
 
@@ -27,6 +28,11 @@
  protected:
   void SendStartMessage() override;
   void SendStopMessage() override;
+
+ private:
+  device::mojom::ScreenOrientationListener* GetScreenOrientationListener();
+
+  device::mojom::ScreenOrientationListenerAssociatedPtr listener_;
 };
 
 }; // namespace content

diff --git a/device/screen_orientation/public/interfaces/screen_orientation.mojom b/device/screen_orientation/public/interfaces/screen_orientation.mojom
index 0cc849e..c542188 100644
--- a/device/screen_orientation/public/interfaces/screen_orientation.mojom
+++ b/device/screen_orientation/public/interfaces/screen_orientation.mojom

@@ -11,3 +11,19 @@
     (ScreenOrientationLockResult result);
   UnlockOrientation();
 };
+
+// ScreenOrientationListener is expected to be used when the platform requires
+// heavy work in order to accurately know the screen orientation.
+// For example, on Android, this is required for Jelly Bean, where there is no
+// API to be notified of a screen orientation change of 180 degrees.
+interface ScreenOrientationListener {
+  // The renderer process is now using the Screen Orientation API and informs
+  // the browser process that it should start accurately listening to the screen
+  // orientation if it wasn't already.
+  Start();
+  
+  // The renderer process is no longer using the Screen Orientation API and
+  // informs the browser process that it can stop accurately listening to the
+  // screen orientation if no other process cares about it.
+  Stop();
+};

diff --git a/net/base/int128.h b/net/base/int128.h
index b9be53d..c2fc51b 100644
--- a/net/base/int128.h
+++ b/net/base/int128.h

@@ -66,6 +66,10 @@
   uint128(double v);
 };
 
+inline uint128 MakeUint128(uint64_t top, uint64_t bottom) {
+  return uint128(top, bottom);
+}
+
 // This is a POD form of uint128 which can be used for static variables which
 // need to be operated on as uint128.
 struct uint128_pod {

diff --git a/net/http/http_network_transaction_unittest.cc b/net/http/http_network_transaction_unittest.cc
index f5cfd56..e5c8135 100644
--- a/net/http/http_network_transaction_unittest.cc
+++ b/net/http/http_network_transaction_unittest.cc

@@ -847,10 +847,10 @@
 
   std::unique_ptr<HttpNetworkSession> session(CreateSession(&session_deps_));
 
+  HttpRequestInfo request;
   std::unique_ptr<HttpTransaction> trans(
       new HttpNetworkTransaction(DEFAULT_PRIORITY, session.get()));
 
-  HttpRequestInfo request;
   request.method = "GET";
   request.url = GURL("http://www.example.com:2000/");
   TestCompletionCallback callback;
@@ -870,10 +870,10 @@
   session_deps_.http_09_on_non_default_ports_enabled = true;
   std::unique_ptr<HttpNetworkSession> session(CreateSession(&session_deps_));
 
+  HttpRequestInfo request;
   std::unique_ptr<HttpTransaction> trans(
       new HttpNetworkTransaction(DEFAULT_PRIORITY, session.get()));
 
-  HttpRequestInfo request;
   request.method = "GET";
   request.url = GURL("http://www.example.com:2000/");
   TestCompletionCallback callback;
@@ -10393,8 +10393,8 @@
   // Mark the QUIC alternative service as broken.
   http_server_properties->MarkAlternativeServiceBroken(alternative_service);
 
-  HttpNetworkTransaction trans(DEFAULT_PRIORITY, session.get());
   HttpRequestInfo request;
+  HttpNetworkTransaction trans(DEFAULT_PRIORITY, session.get());
   request.method = "GET";
   request.url = GURL(origin_url);
   TestCompletionCallback callback;
@@ -10466,8 +10466,8 @@
   const AlternativeServiceVector alternative_service_vector =
       http_server_properties->GetAlternativeServices(server);
 
-  HttpNetworkTransaction trans(DEFAULT_PRIORITY, session.get());
   HttpRequestInfo request;
+  HttpNetworkTransaction trans(DEFAULT_PRIORITY, session.get());
   request.method = "GET";
   request.url = GURL(origin_url);
   TestCompletionCallback callback;
@@ -13818,8 +13818,8 @@
   http_server_properties->SetAlternativeService(server, alternative_service,
                                                 expiration);
 
-  HttpNetworkTransaction trans(DEFAULT_PRIORITY, session.get());
   HttpRequestInfo request;
+  HttpNetworkTransaction trans(DEFAULT_PRIORITY, session.get());
   request.method = "GET";
   request.url = GURL("https://www.example.org:443");
   TestCompletionCallback callback;
@@ -13993,8 +13993,8 @@
                                                 expiration);
 
   // First transaction to alternative to open an HTTP/1.1 socket.
-  HttpNetworkTransaction trans1(DEFAULT_PRIORITY, session.get());
   HttpRequestInfo request1;
+  HttpNetworkTransaction trans1(DEFAULT_PRIORITY, session.get());
   request1.method = "GET";
   request1.url = GURL(alternative_url);
   request1.load_flags = 0;
@@ -14017,8 +14017,8 @@
   // finds one which is HTTP/1.1, and should ignore it, and should not try to
   // open other connections to alternative server.  The Job to server fails, so
   // this request fails.
-  HttpNetworkTransaction trans2(DEFAULT_PRIORITY, session.get());
   HttpRequestInfo request2;
+  HttpNetworkTransaction trans2(DEFAULT_PRIORITY, session.get());
   request2.method = "GET";
   request2.url = GURL(origin_url);
   request2.load_flags = 0;
@@ -14029,8 +14029,8 @@
 
   // Another transaction to alternative.  This is to test that the HTTP/1.1
   // socket is still open and in the pool.
-  HttpNetworkTransaction trans3(DEFAULT_PRIORITY, session.get());
   HttpRequestInfo request3;
+  HttpNetworkTransaction trans3(DEFAULT_PRIORITY, session.get());
   request3.method = "GET";
   request3.url = GURL(alternative_url);
   request3.load_flags = 0;
@@ -15140,11 +15140,11 @@
   FakeStreamFactory* fake_factory = new FakeStreamFactory();
   peer.SetHttpStreamFactory(std::unique_ptr<HttpStreamFactory>(fake_factory));
 
+  HttpRequestInfo request;
   HttpNetworkTransaction trans(LOW, session.get());
 
   ASSERT_FALSE(fake_factory->last_stream_request());
 
-  HttpRequestInfo request;
   TestCompletionCallback callback;
   EXPECT_EQ(ERR_IO_PENDING,
             trans.Start(&request, callback.callback(), NetLogWithSource()));
@@ -15163,9 +15163,9 @@
   FakeStreamFactory* fake_factory = new FakeStreamFactory();
   peer.SetHttpStreamFactory(std::unique_ptr<HttpStreamFactory>(fake_factory));
 
+  HttpRequestInfo request;
   HttpNetworkTransaction trans(LOW, session.get());
 
-  HttpRequestInfo request;
   TestCompletionCallback callback;
   EXPECT_EQ(ERR_IO_PENDING,
             trans.Start(&request, callback.callback(), NetLogWithSource()));
@@ -15188,9 +15188,9 @@
   FakeStreamFactory* fake_factory = new FakeStreamFactory();
   peer.SetHttpStreamFactory(std::unique_ptr<HttpStreamFactory>(fake_factory));
 
+  HttpRequestInfo request;
   HttpNetworkTransaction trans(LOW, session.get());
 
-  HttpRequestInfo request;
   TestCompletionCallback callback;
   EXPECT_EQ(ERR_IO_PENDING,
             trans.Start(&request, callback.callback(), NetLogWithSource()));
@@ -15220,11 +15220,11 @@
     peer.SetHttpStreamFactoryForWebSocket(
         std::unique_ptr<HttpStreamFactory>(fake_factory));
 
+    HttpRequestInfo request;
     HttpNetworkTransaction trans(LOW, session.get());
     trans.SetWebSocketHandshakeStreamCreateHelper(
         &websocket_stream_create_helper);
 
-    HttpRequestInfo request;
     TestCompletionCallback callback;
     request.method = "GET";
     request.url = GURL(test_cases[i]);

diff --git a/net/http/http_response_info.cc b/net/http/http_response_info.cc
index 02bfefa8..48a7a24 100644
--- a/net/http/http_response_info.cc
+++ b/net/http/http_response_info.cc

@@ -438,6 +438,7 @@
     case CONNECTION_INFO_QUIC_34:
     case CONNECTION_INFO_QUIC_35:
     case CONNECTION_INFO_QUIC_36:
+    case CONNECTION_INFO_QUIC_37:
       return true;
     case NUM_OF_CONNECTION_INFOS:
       NOTREACHED();
@@ -480,6 +481,8 @@
       return "http/2+quic/35";
     case CONNECTION_INFO_QUIC_36:
       return "http/2+quic/36";
+    case CONNECTION_INFO_QUIC_37:
+      return "http/2+quic/37";
     case CONNECTION_INFO_HTTP0_9:
       return "http/0.9";
     case CONNECTION_INFO_HTTP1_0:

diff --git a/net/http/http_response_info.h b/net/http/http_response_info.h
index 83bc630..0182b61 100644
--- a/net/http/http_response_info.h
+++ b/net/http/http_response_info.h

@@ -47,6 +47,7 @@
     CONNECTION_INFO_QUIC_34 = 12,
     CONNECTION_INFO_QUIC_35 = 13,
     CONNECTION_INFO_QUIC_36 = 14,
+    CONNECTION_INFO_QUIC_37 = 15,
     NUM_OF_CONNECTION_INFOS,
   };
 

diff --git a/net/quic/chromium/quic_http_stream.cc b/net/quic/chromium/quic_http_stream.cc
index dcd9449..5363292 100644
--- a/net/quic/chromium/quic_http_stream.cc
+++ b/net/quic/chromium/quic_http_stream.cc

@@ -139,6 +139,8 @@
       return HttpResponseInfo::CONNECTION_INFO_QUIC_35;
     case QUIC_VERSION_36:
       return HttpResponseInfo::CONNECTION_INFO_QUIC_36;
+    case QUIC_VERSION_37:
+      return HttpResponseInfo::CONNECTION_INFO_QUIC_37;
   }
   NOTREACHED();
   return HttpResponseInfo::CONNECTION_INFO_QUIC_UNKNOWN_VERSION;

diff --git a/net/quic/core/crypto/aead_base_decrypter.cc b/net/quic/core/crypto/aead_base_decrypter.cc
index 1da2261..f6763217 100644
--- a/net/quic/core/crypto/aead_base_decrypter.cc
+++ b/net/quic/core/crypto/aead_base_decrypter.cc

@@ -115,7 +115,8 @@
   return true;
 }
 
-bool AeadBaseDecrypter::DecryptPacket(QuicPathId path_id,
+bool AeadBaseDecrypter::DecryptPacket(QuicVersion /*version*/,
+                                      QuicPathId path_id,
                                       QuicPacketNumber packet_number,
                                       StringPiece associated_data,
                                       StringPiece ciphertext,

diff --git a/net/quic/core/crypto/aead_base_decrypter.h b/net/quic/core/crypto/aead_base_decrypter.h
index c687eac..d2c7f35 100644
--- a/net/quic/core/crypto/aead_base_decrypter.h
+++ b/net/quic/core/crypto/aead_base_decrypter.h

@@ -29,7 +29,8 @@
   bool SetNoncePrefix(base::StringPiece nonce_prefix) override;
   bool SetPreliminaryKey(base::StringPiece key) override;
   bool SetDiversificationNonce(const DiversificationNonce& nonce) override;
-  bool DecryptPacket(QuicPathId path_id,
+  bool DecryptPacket(QuicVersion version,
+                     QuicPathId path_id,
                      QuicPacketNumber packet_number,
                      base::StringPiece associated_data,
                      base::StringPiece ciphertext,

diff --git a/net/quic/core/crypto/aead_base_encrypter.cc b/net/quic/core/crypto/aead_base_encrypter.cc
index 477810fc..9917ae05 100644
--- a/net/quic/core/crypto/aead_base_encrypter.cc
+++ b/net/quic/core/crypto/aead_base_encrypter.cc

@@ -104,7 +104,8 @@
   return true;
 }
 
-bool AeadBaseEncrypter::EncryptPacket(QuicPathId path_id,
+bool AeadBaseEncrypter::EncryptPacket(QuicVersion /*version*/,
+                                      QuicPathId path_id,
                                       QuicPacketNumber packet_number,
                                       StringPiece associated_data,
                                       StringPiece plaintext,

diff --git a/net/quic/core/crypto/aead_base_encrypter.h b/net/quic/core/crypto/aead_base_encrypter.h
index 4a534dd..1c2a1cc 100644
--- a/net/quic/core/crypto/aead_base_encrypter.h
+++ b/net/quic/core/crypto/aead_base_encrypter.h

@@ -27,7 +27,8 @@
   // QuicEncrypter implementation
   bool SetKey(base::StringPiece key) override;
   bool SetNoncePrefix(base::StringPiece nonce_prefix) override;
-  bool EncryptPacket(QuicPathId path_id,
+  bool EncryptPacket(QuicVersion version,
+                     QuicPathId path_id,
                      QuicPacketNumber packet_number,
                      base::StringPiece associated_data,
                      base::StringPiece plaintext,

diff --git a/net/quic/core/crypto/aes_128_gcm_12_decrypter_test.cc b/net/quic/core/crypto/aes_128_gcm_12_decrypter_test.cc
index 64e8f30..3ca950a 100644
--- a/net/quic/core/crypto/aes_128_gcm_12_decrypter_test.cc
+++ b/net/quic/core/crypto/aes_128_gcm_12_decrypter_test.cc

@@ -215,8 +215,8 @@
   std::unique_ptr<char[]> output(new char[ciphertext.length()]);
   size_t output_length = 0;
   const bool success = decrypter->DecryptPacket(
-      path_id, packet_number, associated_data, ciphertext, output.get(),
-      &output_length, ciphertext.length());
+      QuicVersionMax(), path_id, packet_number, associated_data, ciphertext,
+      output.get(), &output_length, ciphertext.length());
   if (!success) {
     return nullptr;
   }

diff --git a/net/quic/core/crypto/cert_compressor.cc b/net/quic/core/crypto/cert_compressor.cc
index 0e0ca063..2986e782 100644
--- a/net/quic/core/crypto/cert_compressor.cc
+++ b/net/quic/core/crypto/cert_compressor.cc

@@ -194,7 +194,7 @@
     if (cached_valid) {
       bool cached = false;
 
-      uint64_t hash = QuicUtils::FNV1a_64_Hash(i->data(), i->size());
+      uint64_t hash = QuicUtils::FNV1a_64_Hash(*i);
       // This assumes that the machine is little-endian.
       for (size_t j = 0; j < client_cached_cert_hashes.size();
            j += sizeof(uint64_t)) {
@@ -325,7 +325,7 @@
 
   for (std::vector<string>::const_iterator i = certs.begin(); i != certs.end();
        ++i) {
-    ret.push_back(QuicUtils::FNV1a_64_Hash(i->data(), i->size()));
+    ret.push_back(QuicUtils::FNV1a_64_Hash(*i));
   }
 
   return ret;

diff --git a/net/quic/core/crypto/cert_compressor_test.cc b/net/quic/core/crypto/cert_compressor_test.cc
index 631c832..9c0e98f 100644
--- a/net/quic/core/crypto/cert_compressor_test.cc
+++ b/net/quic/core/crypto/cert_compressor_test.cc

@@ -70,7 +70,7 @@
 TEST(CertCompressor, Cached) {
   std::vector<string> chain;
   chain.push_back("testcert");
-  uint64_t hash = QuicUtils::FNV1a_64_Hash(chain[0].data(), chain[0].size());
+  uint64_t hash = QuicUtils::FNV1a_64_Hash(chain[0]);
   StringPiece hash_bytes(reinterpret_cast<char*>(&hash), sizeof(hash));
   const string compressed =
       CertCompressor::CompressChain(chain, StringPiece(), hash_bytes, nullptr);

diff --git a/net/quic/core/crypto/chacha20_poly1305_decrypter_test.cc b/net/quic/core/crypto/chacha20_poly1305_decrypter_test.cc
index a0ca47c7..52762b8 100644
--- a/net/quic/core/crypto/chacha20_poly1305_decrypter_test.cc
+++ b/net/quic/core/crypto/chacha20_poly1305_decrypter_test.cc

@@ -129,8 +129,8 @@
   std::unique_ptr<char[]> output(new char[ciphertext.length()]);
   size_t output_length = 0;
   const bool success = decrypter->DecryptPacket(
-      path_id, packet_number, associated_data, ciphertext, output.get(),
-      &output_length, ciphertext.length());
+      QuicVersionMax(), path_id, packet_number, associated_data, ciphertext,
+      output.get(), &output_length, ciphertext.length());
   if (!success) {
     return nullptr;
   }

diff --git a/net/quic/core/crypto/chacha20_poly1305_encrypter_test.cc b/net/quic/core/crypto/chacha20_poly1305_encrypter_test.cc
index 863be31..b1c86a5 100644
--- a/net/quic/core/crypto/chacha20_poly1305_encrypter_test.cc
+++ b/net/quic/core/crypto/chacha20_poly1305_encrypter_test.cc

@@ -99,14 +99,14 @@
   string plaintext = "plaintext";
   char encrypted[1024];
   size_t len;
-  ASSERT_TRUE(encrypter.EncryptPacket(path_id, packet_number, associated_data,
-                                      plaintext, encrypted, &len,
-                                      arraysize(encrypted)));
+  ASSERT_TRUE(encrypter.EncryptPacket(QuicVersionMax(), path_id, packet_number,
+                                      associated_data, plaintext, encrypted,
+                                      &len, arraysize(encrypted)));
   StringPiece ciphertext(encrypted, len);
   char decrypted[1024];
-  ASSERT_TRUE(decrypter.DecryptPacket(path_id, packet_number, associated_data,
-                                      ciphertext, decrypted, &len,
-                                      arraysize(decrypted)));
+  ASSERT_TRUE(decrypter.DecryptPacket(QuicVersionMax(), path_id, packet_number,
+                                      associated_data, ciphertext, decrypted,
+                                      &len, arraysize(decrypted)));
 }
 
 TEST(ChaCha20Poly1305EncrypterTest, Encrypt) {

diff --git a/net/quic/core/crypto/crypto_framer.cc b/net/quic/core/crypto/crypto_framer.cc
index c2a83d6..2fd7239 100644
--- a/net/quic/core/crypto/crypto_framer.cc
+++ b/net/quic/core/crypto/crypto_framer.cc

@@ -34,7 +34,7 @@
 
   bool error() const { return error_; }
 
-  CryptoHandshakeMessage* release() { return out_.release(); }
+  std::unique_ptr<CryptoHandshakeMessage> release() { return std::move(out_); }
 
  private:
   std::unique_ptr<CryptoHandshakeMessage> out_;
@@ -51,7 +51,8 @@
 CryptoFramer::~CryptoFramer() {}
 
 // static
-CryptoHandshakeMessage* CryptoFramer::ParseMessage(StringPiece in) {
+std::unique_ptr<CryptoHandshakeMessage> CryptoFramer::ParseMessage(
+    StringPiece in) {
   OneShotVisitor visitor;
   CryptoFramer framer;
 

diff --git a/net/quic/core/crypto/crypto_framer.h b/net/quic/core/crypto/crypto_framer.h
index e4ab863..bd316fd 100644
--- a/net/quic/core/crypto/crypto_framer.h
+++ b/net/quic/core/crypto/crypto_framer.h

@@ -5,9 +5,9 @@
 #ifndef NET_QUIC_CORE_CRYPTO_CRYPTO_FRAMER_H_
 #define NET_QUIC_CORE_CRYPTO_CRYPTO_FRAMER_H_
 
-#include <stddef.h>
-#include <stdint.h>
-
+#include <cstddef>
+#include <cstdint>
+#include <memory>
 #include <utility>
 #include <vector>
 
@@ -45,7 +45,8 @@
   // ParseMessage parses exactly one message from the given StringPiece. If
   // there is an error, the message is truncated, or the message has trailing
   // garbage then nullptr will be returned.
-  static CryptoHandshakeMessage* ParseMessage(base::StringPiece in);
+  static std::unique_ptr<CryptoHandshakeMessage> ParseMessage(
+      base::StringPiece in);
 
   // Set callbacks to be called from the framer.  A visitor must be set, or
   // else the framer will crash.  It is acceptable for the visitor to do

diff --git a/net/quic/core/crypto/crypto_protocol.h b/net/quic/core/crypto/crypto_protocol.h
index 80b61ad0..3c6d9c3 100644
--- a/net/quic/core/crypto/crypto_protocol.h
+++ b/net/quic/core/crypto/crypto_protocol.h

@@ -44,7 +44,6 @@
 const QuicTag kC255 = TAG('C', '2', '5', '5');   // ECDH, Curve25519
 
 // AEAD algorithms
-const QuicTag kNULL = TAG('N', 'U', 'L', 'N');   // null algorithm
 const QuicTag kAESG = TAG('A', 'E', 'S', 'G');   // AES128 + GCM-12
 const QuicTag kCC20 = TAG('C', 'C', '2', '0');   // ChaCha20 + Poly1305 RFC7539
 

diff --git a/net/quic/core/crypto/crypto_secret_boxer.cc b/net/quic/core/crypto/crypto_secret_boxer.cc
index 986e34ab..15d0720 100644
--- a/net/quic/core/crypto/crypto_secret_boxer.cc
+++ b/net/quic/core/crypto/crypto_secret_boxer.cc

@@ -108,10 +108,11 @@
     for (const string& key : keys_) {
       if (decrypter->SetKey(key)) {
         decrypter->SetNoncePrefix(nonce_prefix);
-        if (decrypter->DecryptPacket(
-                /*path_id=*/0u, packet_number,
-                /*associated data=*/StringPiece(), ciphertext, plaintext,
-                &plaintext_length, kMaxPacketSize)) {
+        if (decrypter->DecryptPacket(QUIC_VERSION_36,
+                                     /*path_id=*/0u, packet_number,
+                                     /*associated data=*/StringPiece(),
+                                     ciphertext, plaintext, &plaintext_length,
+                                     kMaxPacketSize)) {
           ok = true;
           break;
         }

diff --git a/net/quic/core/crypto/crypto_server_test.cc b/net/quic/core/crypto/crypto_server_test.cc
index ccdb50a9..fdf91b7c 100644
--- a/net/quic/core/crypto/crypto_server_test.cc
+++ b/net/quic/core/crypto/crypto_server_test.cc

@@ -174,7 +174,7 @@
 
     StringPiece scfg;
     ASSERT_TRUE(out_.GetStringPiece(kSCFG, &scfg));
-    server_config_.reset(CryptoFramer::ParseMessage(scfg));
+    server_config_ = CryptoFramer::ParseMessage(scfg);
 
     StringPiece scid;
     ASSERT_TRUE(server_config_->GetStringPiece(kSCID, &scid));

diff --git a/net/quic/core/crypto/crypto_utils.cc b/net/quic/core/crypto/crypto_utils.cc
index 362971d..941250c 100644
--- a/net/quic/core/crypto/crypto_utils.cc
+++ b/net/quic/core/crypto/crypto_utils.cc

@@ -207,8 +207,8 @@
 }
 
 // static
-uint64_t CryptoUtils::ComputeLeafCertHash(const std::string& cert) {
-  return QuicUtils::FNV1a_64_Hash(cert.data(), cert.size());
+uint64_t CryptoUtils::ComputeLeafCertHash(StringPiece cert) {
+  return QuicUtils::FNV1a_64_Hash(cert);
 }
 
 QuicErrorCode CryptoUtils::ValidateServerHello(

diff --git a/net/quic/core/crypto/crypto_utils.h b/net/quic/core/crypto/crypto_utils.h
index 458a904..044c8b7 100644
--- a/net/quic/core/crypto/crypto_utils.h
+++ b/net/quic/core/crypto/crypto_utils.h

@@ -127,7 +127,7 @@
 
   // Computes the FNV-1a hash of the provided DER-encoded cert for use in the
   // XLCT tag.
-  static uint64_t ComputeLeafCertHash(const std::string& cert);
+  static uint64_t ComputeLeafCertHash(base::StringPiece cert);
 
   // Validates that |server_hello| is actually an SHLO message and that it is
   // not part of a downgrade attack.

diff --git a/net/quic/core/crypto/null_decrypter.cc b/net/quic/core/crypto/null_decrypter.cc
index dabbff5..b33d535 100644
--- a/net/quic/core/crypto/null_decrypter.cc
+++ b/net/quic/core/crypto/null_decrypter.cc

@@ -15,7 +15,8 @@
 
 namespace net {
 
-NullDecrypter::NullDecrypter() {}
+NullDecrypter::NullDecrypter(Perspective perspective)
+    : perspective_(perspective) {}
 
 bool NullDecrypter::SetKey(StringPiece key) {
   return key.empty();
@@ -35,7 +36,8 @@
   return true;
 }
 
-bool NullDecrypter::DecryptPacket(QuicPathId /*path_id*/,
+bool NullDecrypter::DecryptPacket(QuicVersion version,
+                                  QuicPathId /*path_id*/,
                                   QuicPacketNumber /*packet_number*/,
                                   StringPiece associated_data,
                                   StringPiece ciphertext,
@@ -54,7 +56,7 @@
     QUIC_BUG << "Output buffer must be larger than the plaintext.";
     return false;
   }
-  if (hash != ComputeHash(associated_data, plaintext)) {
+  if (hash != ComputeHash(version, associated_data, plaintext)) {
     return false;
   }
   // Copy the plaintext to output.
@@ -91,11 +93,23 @@
   return true;
 }
 
-uint128 NullDecrypter::ComputeHash(const StringPiece data1,
+uint128 NullDecrypter::ComputeHash(QuicVersion version,
+                                   const StringPiece data1,
                                    const StringPiece data2) const {
-  uint128 correct_hash = QuicUtils::FNV1a_128_Hash_Two(
-      data1.data(), data1.length(), data2.data(), data2.length());
-  uint128 mask(UINT64_C(0x0), UINT64_C(0xffffffff));
+  uint128 correct_hash;
+  if (version > QUIC_VERSION_36) {
+    if (perspective_ == Perspective::IS_CLIENT) {
+      // Peer is a server.
+      correct_hash = QuicUtils::FNV1a_128_Hash_Three(data1, data2, "Server");
+
+    } else {
+      // Peer is a client.
+      correct_hash = QuicUtils::FNV1a_128_Hash_Three(data1, data2, "Client");
+    }
+  } else {
+    correct_hash = QuicUtils::FNV1a_128_Hash_Two(data1, data2);
+  }
+  uint128 mask = MakeUint128(UINT64_C(0x0), UINT64_C(0xffffffff));
   mask <<= 96;
   correct_hash &= ~mask;
   return correct_hash;

diff --git a/net/quic/core/crypto/null_decrypter.h b/net/quic/core/crypto/null_decrypter.h
index 42f7332..28b6328 100644
--- a/net/quic/core/crypto/null_decrypter.h
+++ b/net/quic/core/crypto/null_decrypter.h

@@ -11,6 +11,7 @@
 #include "base/compiler_specific.h"
 #include "base/macros.h"
 #include "net/quic/core/crypto/quic_decrypter.h"
+#include "net/quic/core/quic_types.h"
 #include "net/quic/platform/api/quic_export.h"
 
 namespace net {
@@ -22,7 +23,7 @@
 // verify a hash (fnv128) over both the payload and associated data.
 class QUIC_EXPORT_PRIVATE NullDecrypter : public QuicDecrypter {
  public:
-  NullDecrypter();
+  explicit NullDecrypter(Perspective perspective);
   ~NullDecrypter() override {}
 
   // QuicDecrypter implementation
@@ -30,7 +31,8 @@
   bool SetNoncePrefix(base::StringPiece nonce_prefix) override;
   bool SetPreliminaryKey(base::StringPiece key) override;
   bool SetDiversificationNonce(const DiversificationNonce& nonce) override;
-  bool DecryptPacket(QuicPathId path_id,
+  bool DecryptPacket(QuicVersion version,
+                     QuicPathId path_id,
                      QuicPacketNumber packet_number,
                      base::StringPiece associated_data,
                      base::StringPiece ciphertext,
@@ -45,7 +47,11 @@
 
  private:
   bool ReadHash(QuicDataReader* reader, uint128* hash);
-  uint128 ComputeHash(base::StringPiece data1, base::StringPiece data2) const;
+  uint128 ComputeHash(QuicVersion version,
+                      base::StringPiece data1,
+                      base::StringPiece data2) const;
+
+  Perspective perspective_;
 
   DISALLOW_COPY_AND_ASSIGN(NullDecrypter);
 };

diff --git a/net/quic/core/crypto/null_decrypter_test.cc b/net/quic/core/crypto/null_decrypter_test.cc
index d615f34..56d20c2c 100644
--- a/net/quic/core/crypto/null_decrypter_test.cc
+++ b/net/quic/core/crypto/null_decrypter_test.cc

@@ -12,7 +12,45 @@
 
 class NullDecrypterTest : public ::testing::TestWithParam<bool> {};
 
-TEST_F(NullDecrypterTest, Decrypt) {
+TEST_F(NullDecrypterTest, DecryptClient) {
+  unsigned char expected[] = {
+      // fnv hash
+      0x97, 0xdc, 0x27, 0x2f, 0x18, 0xa8, 0x56, 0x73, 0xdf, 0x8d, 0x1d, 0xd0,
+      // payload
+      'g', 'o', 'o', 'd', 'b', 'y', 'e', '!',
+  };
+  const char* data = reinterpret_cast<const char*>(expected);
+  size_t len = arraysize(expected);
+  NullDecrypter decrypter(Perspective::IS_SERVER);
+  char buffer[256];
+  size_t length = 0;
+  ASSERT_TRUE(decrypter.DecryptPacket(QUIC_VERSION_37, kDefaultPathId, 0,
+                                      "hello world!", StringPiece(data, len),
+                                      buffer, &length, 256));
+  EXPECT_LT(0u, length);
+  EXPECT_EQ("goodbye!", StringPiece(buffer, length));
+}
+
+TEST_F(NullDecrypterTest, DecryptServer) {
+  unsigned char expected[] = {
+      // fnv hash
+      0x63, 0x5e, 0x08, 0x03, 0x32, 0x80, 0x8f, 0x73, 0xdf, 0x8d, 0x1d, 0x1a,
+      // payload
+      'g', 'o', 'o', 'd', 'b', 'y', 'e', '!',
+  };
+  const char* data = reinterpret_cast<const char*>(expected);
+  size_t len = arraysize(expected);
+  NullDecrypter decrypter(Perspective::IS_CLIENT);
+  char buffer[256];
+  size_t length = 0;
+  ASSERT_TRUE(decrypter.DecryptPacket(QUIC_VERSION_37, kDefaultPathId, 0,
+                                      "hello world!", StringPiece(data, len),
+                                      buffer, &length, 256));
+  EXPECT_LT(0u, length);
+  EXPECT_EQ("goodbye!", StringPiece(buffer, length));
+}
+
+TEST_F(NullDecrypterTest, DecryptClientPre37) {
   unsigned char expected[] = {
       // fnv hash
       0xa0, 0x6f, 0x44, 0x8a, 0x44, 0xf8, 0x18, 0x3b, 0x47, 0x91, 0xb2, 0x13,
@@ -21,12 +59,31 @@
   };
   const char* data = reinterpret_cast<const char*>(expected);
   size_t len = arraysize(expected);
-  NullDecrypter decrypter;
+  NullDecrypter decrypter(Perspective::IS_CLIENT);
   char buffer[256];
   size_t length = 0;
-  ASSERT_TRUE(decrypter.DecryptPacket(kDefaultPathId, 0, "hello world!",
-                                      StringPiece(data, len), buffer, &length,
-                                      256));
+  ASSERT_TRUE(decrypter.DecryptPacket(QUIC_VERSION_36, kDefaultPathId, 0,
+                                      "hello world!", StringPiece(data, len),
+                                      buffer, &length, 256));
+  EXPECT_LT(0u, length);
+  EXPECT_EQ("goodbye!", StringPiece(buffer, length));
+}
+
+TEST_F(NullDecrypterTest, DecryptServerPre37) {
+  unsigned char expected[] = {
+      // fnv hash
+      0xa0, 0x6f, 0x44, 0x8a, 0x44, 0xf8, 0x18, 0x3b, 0x47, 0x91, 0xb2, 0x13,
+      // payload
+      'g', 'o', 'o', 'd', 'b', 'y', 'e', '!',
+  };
+  const char* data = reinterpret_cast<const char*>(expected);
+  size_t len = arraysize(expected);
+  NullDecrypter decrypter(Perspective::IS_SERVER);
+  char buffer[256];
+  size_t length = 0;
+  ASSERT_TRUE(decrypter.DecryptPacket(QUIC_VERSION_36, kDefaultPathId, 0,
+                                      "hello world!", StringPiece(data, len),
+                                      buffer, &length, 256));
   EXPECT_LT(0u, length);
   EXPECT_EQ("goodbye!", StringPiece(buffer, length));
 }
@@ -40,12 +97,12 @@
   };
   const char* data = reinterpret_cast<const char*>(expected);
   size_t len = arraysize(expected);
-  NullDecrypter decrypter;
+  NullDecrypter decrypter(Perspective::IS_CLIENT);
   char buffer[256];
   size_t length = 0;
-  ASSERT_FALSE(decrypter.DecryptPacket(kDefaultPathId, 0, "hello world!",
-                                       StringPiece(data, len), buffer, &length,
-                                       256));
+  ASSERT_FALSE(decrypter.DecryptPacket(QUIC_VERSION_35, kDefaultPathId, 0,
+                                       "hello world!", StringPiece(data, len),
+                                       buffer, &length, 256));
 }
 
 TEST_F(NullDecrypterTest, ShortInput) {
@@ -55,12 +112,12 @@
   };
   const char* data = reinterpret_cast<const char*>(expected);
   size_t len = arraysize(expected);
-  NullDecrypter decrypter;
+  NullDecrypter decrypter(Perspective::IS_CLIENT);
   char buffer[256];
   size_t length = 0;
-  ASSERT_FALSE(decrypter.DecryptPacket(kDefaultPathId, 0, "hello world!",
-                                       StringPiece(data, len), buffer, &length,
-                                       256));
+  ASSERT_FALSE(decrypter.DecryptPacket(QUIC_VERSION_35, kDefaultPathId, 0,
+                                       "hello world!", StringPiece(data, len),
+                                       buffer, &length, 256));
 }
 
 }  // namespace test

diff --git a/net/quic/core/crypto/null_encrypter.cc b/net/quic/core/crypto/null_encrypter.cc
index 6fbe53f..986563b 100644
--- a/net/quic/core/crypto/null_encrypter.cc
+++ b/net/quic/core/crypto/null_encrypter.cc

@@ -14,7 +14,8 @@
 
 const size_t kHashSizeShort = 12;  // size of uint128 serialized short
 
-NullEncrypter::NullEncrypter() {}
+NullEncrypter::NullEncrypter(Perspective perspective)
+    : perspective_(perspective) {}
 
 bool NullEncrypter::SetKey(StringPiece key) {
   return key.empty();
@@ -24,7 +25,8 @@
   return nonce_prefix.empty();
 }
 
-bool NullEncrypter::EncryptPacket(QuicPathId /*path_id*/,
+bool NullEncrypter::EncryptPacket(QuicVersion version,
+                                  QuicPathId /*path_id*/,
                                   QuicPacketNumber /*packet_number*/,
                                   StringPiece associated_data,
                                   StringPiece plaintext,
@@ -35,9 +37,18 @@
   if (max_output_length < len) {
     return false;
   }
-  uint128 hash = QuicUtils::FNV1a_128_Hash_Two(
-      associated_data.data(), associated_data.size(), plaintext.data(),
-      plaintext.size());
+  uint128 hash;
+  if (version > QUIC_VERSION_36) {
+    if (perspective_ == Perspective::IS_SERVER) {
+      hash =
+          QuicUtils::FNV1a_128_Hash_Three(associated_data, plaintext, "Server");
+    } else {
+      hash =
+          QuicUtils::FNV1a_128_Hash_Three(associated_data, plaintext, "Client");
+    }
+  } else {
+    hash = QuicUtils::FNV1a_128_Hash_Two(associated_data, plaintext);
+  }
   // TODO(ianswett): memmove required for in place encryption.  Placing the
   // hash at the end would allow use of memcpy, doing nothing for in place.
   memmove(output + GetHashLength(), plaintext.data(), plaintext.length());

diff --git a/net/quic/core/crypto/null_encrypter.h b/net/quic/core/crypto/null_encrypter.h
index 456be5d..988eedc 100644
--- a/net/quic/core/crypto/null_encrypter.h
+++ b/net/quic/core/crypto/null_encrypter.h

@@ -10,6 +10,7 @@
 #include "base/compiler_specific.h"
 #include "base/macros.h"
 #include "net/quic/core/crypto/quic_encrypter.h"
+#include "net/quic/core/quic_types.h"
 #include "net/quic/platform/api/quic_export.h"
 
 namespace net {
@@ -19,13 +20,14 @@
 // generate a MAC (fnv128) over both the payload and associated data.
 class QUIC_EXPORT_PRIVATE NullEncrypter : public QuicEncrypter {
  public:
-  NullEncrypter();
+  explicit NullEncrypter(Perspective perspective);
   ~NullEncrypter() override {}
 
   // QuicEncrypter implementation
   bool SetKey(base::StringPiece key) override;
   bool SetNoncePrefix(base::StringPiece nonce_prefix) override;
-  bool EncryptPacket(QuicPathId path_id,
+  bool EncryptPacket(QuicVersion version,
+                     QuicPathId path_id,
                      QuicPacketNumber packet_number,
                      base::StringPiece associated_data,
                      base::StringPiece plaintext,
@@ -42,6 +44,8 @@
  private:
   size_t GetHashLength() const;
 
+  Perspective perspective_;
+
   DISALLOW_COPY_AND_ASSIGN(NullEncrypter);
 };
 

diff --git a/net/quic/core/crypto/null_encrypter_test.cc b/net/quic/core/crypto/null_encrypter_test.cc
index 8987807..e0296e4 100644
--- a/net/quic/core/crypto/null_encrypter_test.cc
+++ b/net/quic/core/crypto/null_encrypter_test.cc

@@ -12,33 +12,87 @@
 
 class NullEncrypterTest : public ::testing::TestWithParam<bool> {};
 
-TEST_F(NullEncrypterTest, Encrypt) {
+TEST_F(NullEncrypterTest, EncryptClient) {
+  unsigned char expected[] = {
+      // fnv hash
+      0x97, 0xdc, 0x27, 0x2f, 0x18, 0xa8, 0x56, 0x73, 0xdf, 0x8d, 0x1d, 0xd0,
+      // payload
+      'g', 'o', 'o', 'd', 'b', 'y', 'e', '!',
+  };
+  char encrypted[256];
+  size_t encrypted_len = 0;
+  NullEncrypter encrypter(Perspective::IS_CLIENT);
+  ASSERT_TRUE(encrypter.EncryptPacket(QUIC_VERSION_37, kDefaultPathId, 0,
+                                      "hello world!", "goodbye!", encrypted,
+                                      &encrypted_len, 256));
+  test::CompareCharArraysWithHexError(
+      "encrypted data", encrypted, encrypted_len,
+      reinterpret_cast<const char*>(expected), arraysize(expected));
+}
+
+TEST_F(NullEncrypterTest, EncryptServer) {
+  unsigned char expected[] = {
+      // fnv hash
+      0x63, 0x5e, 0x08, 0x03, 0x32, 0x80, 0x8f, 0x73, 0xdf, 0x8d, 0x1d, 0x1a,
+      // payload
+      'g', 'o', 'o', 'd', 'b', 'y', 'e', '!',
+  };
+  char encrypted[256];
+  size_t encrypted_len = 0;
+  NullEncrypter encrypter(Perspective::IS_SERVER);
+  ASSERT_TRUE(encrypter.EncryptPacket(QUIC_VERSION_37, kDefaultPathId, 0,
+                                      "hello world!", "goodbye!", encrypted,
+                                      &encrypted_len, 256));
+  test::CompareCharArraysWithHexError(
+      "encrypted data", encrypted, encrypted_len,
+      reinterpret_cast<const char*>(expected), arraysize(expected));
+}
+
+TEST_F(NullEncrypterTest, EncryptClientPre37) {
   unsigned char expected[] = {
       // fnv hash
       0xa0, 0x6f, 0x44, 0x8a, 0x44, 0xf8, 0x18, 0x3b, 0x47, 0x91, 0xb2, 0x13,
       // payload
       'g', 'o', 'o', 'd', 'b', 'y', 'e', '!',
   };
-  NullEncrypter encrypter;
   char encrypted[256];
   size_t encrypted_len = 0;
-  ASSERT_TRUE(encrypter.EncryptPacket(kDefaultPathId, 0, "hello world!",
-                                      "goodbye!", encrypted, &encrypted_len,
-                                      256));
+  NullEncrypter encrypter(Perspective::IS_CLIENT);
+  ASSERT_TRUE(encrypter.EncryptPacket(QUIC_VERSION_36, kDefaultPathId, 0,
+                                      "hello world!", "goodbye!", encrypted,
+                                      &encrypted_len, 256));
+  test::CompareCharArraysWithHexError(
+      "encrypted data", encrypted, encrypted_len,
+      reinterpret_cast<const char*>(expected), arraysize(expected));
+}
+
+TEST_F(NullEncrypterTest, EncryptServerPre37) {
+  unsigned char expected[] = {
+      // fnv hash
+      0xa0, 0x6f, 0x44, 0x8a, 0x44, 0xf8, 0x18, 0x3b, 0x47, 0x91, 0xb2, 0x13,
+      // payload
+      'g', 'o', 'o', 'd', 'b', 'y', 'e', '!',
+  };
+  char encrypted[256];
+  size_t encrypted_len = 0;
+  NullEncrypter encrypter(Perspective::IS_SERVER);
+  ASSERT_TRUE(encrypter.EncryptPacket(QUIC_VERSION_36, kDefaultPathId, 0,
+                                      "hello world!", "goodbye!", encrypted,
+                                      &encrypted_len, 256));
   test::CompareCharArraysWithHexError(
       "encrypted data", encrypted, encrypted_len,
       reinterpret_cast<const char*>(expected), arraysize(expected));
 }
 
 TEST_F(NullEncrypterTest, GetMaxPlaintextSize) {
-  NullEncrypter encrypter;
+  NullEncrypter encrypter(Perspective::IS_CLIENT);
   EXPECT_EQ(1000u, encrypter.GetMaxPlaintextSize(1012));
   EXPECT_EQ(100u, encrypter.GetMaxPlaintextSize(112));
   EXPECT_EQ(10u, encrypter.GetMaxPlaintextSize(22));
 }
 
 TEST_F(NullEncrypterTest, GetCiphertextSize) {
-  NullEncrypter encrypter;
+  NullEncrypter encrypter(Perspective::IS_CLIENT);
   EXPECT_EQ(1012u, encrypter.GetCiphertextSize(1000));
   EXPECT_EQ(112u, encrypter.GetCiphertextSize(100));
   EXPECT_EQ(22u, encrypter.GetCiphertextSize(10));

diff --git a/net/quic/core/crypto/quic_crypto_client_config.cc b/net/quic/core/crypto/quic_crypto_client_config.cc
index 31c003a..7a71f259 100644
--- a/net/quic/core/crypto/quic_crypto_client_config.cc
+++ b/net/quic/core/crypto/quic_crypto_client_config.cc

@@ -112,7 +112,7 @@
   }
 
   if (!scfg_.get()) {
-    scfg_.reset(CryptoFramer::ParseMessage(server_config_));
+    scfg_ = CryptoFramer::ParseMessage(server_config_);
     DCHECK(scfg_.get());
   }
   return scfg_.get();
@@ -150,7 +150,7 @@
   const CryptoHandshakeMessage* new_scfg;
 
   if (!matches_existing) {
-    new_scfg_storage.reset(CryptoFramer::ParseMessage(server_config));
+    new_scfg_storage = CryptoFramer::ParseMessage(server_config);
     new_scfg = new_scfg_storage.get();
   } else {
     new_scfg = GetServerConfig();
@@ -477,7 +477,7 @@
     hashes.reserve(certs.size());
     for (std::vector<string>::const_iterator i = certs.begin();
          i != certs.end(); ++i) {
-      hashes.push_back(QuicUtils::FNV1a_64_Hash(i->data(), i->size()));
+      hashes.push_back(QuicUtils::FNV1a_64_Hash(*i));
     }
     out->SetVector(kCCRT, hashes);
   }
@@ -657,9 +657,10 @@
     std::unique_ptr<char[]> output(new char[encrypted_len]);
     size_t output_size = 0;
     if (!crypters.encrypter->EncryptPacket(
-            kDefaultPathId /* path id */, 0 /* packet number */,
-            StringPiece() /* associated data */, cetv_plaintext.AsStringPiece(),
-            output.get(), &output_size, encrypted_len)) {
+            preferred_version, kDefaultPathId /* path id */,
+            0 /* packet number */, StringPiece() /* associated data */,
+            cetv_plaintext.AsStringPiece(), output.get(), &output_size,
+            encrypted_len)) {
       *error_details = "Packet encryption failed";
       return QUIC_ENCRYPTION_FAILURE;
     }

diff --git a/net/quic/core/crypto/quic_crypto_server_config.cc b/net/quic/core/crypto/quic_crypto_server_config.cc
index 61dc3b8..35de5ecc 100644
--- a/net/quic/core/crypto/quic_crypto_server_config.cc
+++ b/net/quic/core/crypto/quic_crypto_server_config.cc

@@ -900,7 +900,7 @@
     char plaintext[kMaxPacketSize];
     size_t plaintext_length = 0;
     const bool success = crypters.decrypter->DecryptPacket(
-        kDefaultPathId, 0 /* packet number */,
+        QUIC_VERSION_35, kDefaultPathId, 0 /* packet number */,
         StringPiece() /* associated data */, cetv_ciphertext, plaintext,
         &plaintext_length, kMaxPacketSize);
     if (!success) {

diff --git a/net/quic/core/crypto/quic_decrypter.cc b/net/quic/core/crypto/quic_decrypter.cc
index 5d8f3d3..2ff6f33 100644
--- a/net/quic/core/crypto/quic_decrypter.cc
+++ b/net/quic/core/crypto/quic_decrypter.cc

@@ -22,8 +22,6 @@
       return new Aes128Gcm12Decrypter();
     case kCC20:
       return new ChaCha20Poly1305Decrypter();
-    case kNULL:
-      return new NullDecrypter();
     default:
       LOG(FATAL) << "Unsupported algorithm: " << algorithm;
       return nullptr;

diff --git a/net/quic/core/crypto/quic_decrypter.h b/net/quic/core/crypto/quic_decrypter.h
index ac2ca34..1c518cce 100644
--- a/net/quic/core/crypto/quic_decrypter.h
+++ b/net/quic/core/crypto/quic_decrypter.h

@@ -66,7 +66,8 @@
   // to form the nonce.
   // TODO(wtc): add a way for DecryptPacket to report decryption failure due
   // to non-authentic inputs, as opposed to other reasons for failure.
-  virtual bool DecryptPacket(QuicPathId path_id,
+  virtual bool DecryptPacket(QuicVersion version,
+                             QuicPathId path_id,
                              QuicPacketNumber packet_number,
                              base::StringPiece associated_data,
                              base::StringPiece ciphertext,

diff --git a/net/quic/core/crypto/quic_encrypter.cc b/net/quic/core/crypto/quic_encrypter.cc
index 2c19078d..a650485 100644
--- a/net/quic/core/crypto/quic_encrypter.cc
+++ b/net/quic/core/crypto/quic_encrypter.cc

@@ -18,8 +18,6 @@
       return new Aes128Gcm12Encrypter();
     case kCC20:
       return new ChaCha20Poly1305Encrypter();
-    case kNULL:
-      return new NullEncrypter();
     default:
       LOG(FATAL) << "Unsupported algorithm: " << algorithm;
       return nullptr;

diff --git a/net/quic/core/crypto/quic_encrypter.h b/net/quic/core/crypto/quic_encrypter.h
index f5b721a0..2bc045e 100644
--- a/net/quic/core/crypto/quic_encrypter.h
+++ b/net/quic/core/crypto/quic_encrypter.h

@@ -48,7 +48,8 @@
   // SetNoncePrefix() to form the nonce. |output| must not overlap with
   // |associated_data|. If |output| overlaps with |plaintext| then
   // |plaintext| must be <= |output|.
-  virtual bool EncryptPacket(QuicPathId path_id,
+  virtual bool EncryptPacket(QuicVersion version,
+                             QuicPathId path_id,
                              QuicPacketNumber packet_number,
                              base::StringPiece associated_data,
                              base::StringPiece plaintext,

diff --git a/net/quic/core/quic_connection.h b/net/quic/core/quic_connection.h
index ecbe8d6..926f4bc2 100644
--- a/net/quic/core/quic_connection.h
+++ b/net/quic/core/quic_connection.h

@@ -743,6 +743,9 @@
                                          const std::string& details,
                                          AckBundling ack_mode);
 
+  // Returns true if the packet should be discarded and not sent.
+  virtual bool ShouldDiscardPacket(const SerializedPacket& packet);
+
  private:
   friend class test::QuicConnectionPeer;
   friend class test::PacketSavingConnection;
@@ -790,9 +793,6 @@
   // Writes as many pending retransmissions as possible.
   void WritePendingRetransmissions();
 
-  // Returns true if the packet should be discarded and not sent.
-  bool ShouldDiscardPacket(const SerializedPacket& packet);
-
   // Queues |packet| in the hopes that it can be decrypted in the
   // future, when a new key is installed.
   void QueueUndecryptablePacket(const QuicEncryptedPacket& packet);

diff --git a/net/quic/core/quic_connection_test.cc b/net/quic/core/quic_connection_test.cc
index 5449770..3637805 100644
--- a/net/quic/core/quic_connection_test.cc
+++ b/net/quic/core/quic_connection_test.cc

@@ -88,7 +88,8 @@
 
   bool SetNoncePrefix(StringPiece nonce_prefix) override { return true; }
 
-  bool EncryptPacket(QuicPathId path_id,
+  bool EncryptPacket(QuicVersion /*version*/,
+                     QuicPathId path_id,
                      QuicPacketNumber packet_number,
                      StringPiece associated_data,
                      StringPiece plaintext,
@@ -152,7 +153,8 @@
     return true;
   }
 
-  bool DecryptPacket(QuicPathId path_id,
+  bool DecryptPacket(QuicVersion /*version*/,
+                     QuicPathId path_id,
                      QuicPacketNumber packet_number,
                      StringPiece associated_data,
                      StringPiece ciphertext,
@@ -271,7 +273,7 @@
  public:
   TestPacketWriter(QuicVersion version, MockClock* clock)
       : version_(version),
-        framer_(SupportedVersions(version_)),
+        framer_(SupportedVersions(version_), Perspective::IS_SERVER),
         last_packet_size_(0),
         write_blocked_(false),
         write_should_fail_(false),
@@ -473,7 +475,7 @@
                        perspective,
                        SupportedVersions(version)) {
     writer->set_perspective(perspective);
-    SetEncrypter(ENCRYPTION_FORWARD_SECURE, new NullEncrypter());
+    SetEncrypter(ENCRYPTION_FORWARD_SECURE, new NullEncrypter(perspective));
   }
 
   void SendAck() { QuicConnectionPeer::SendAck(this); }
@@ -859,7 +861,7 @@
     std::unique_ptr<QuicPacket> packet(
         ConstructDataPacket(path_id, number, has_stop_waiting));
     char buffer[kMaxPacketSize];
-    size_t encrypted_length = framer_.EncryptPayload(
+    size_t encrypted_length = peer_framer_.EncryptPayload(
         level, path_id, number, *packet, buffer, kMaxPacketSize);
     connection_.ProcessUdpPacket(
         kSelfAddress, kPeerAddress,
@@ -873,7 +875,7 @@
   void ProcessClosePacket(QuicPathId path_id, QuicPacketNumber number) {
     std::unique_ptr<QuicPacket> packet(ConstructClosePacket(number));
     char buffer[kMaxPacketSize];
-    size_t encrypted_length = framer_.EncryptPayload(
+    size_t encrypted_length = peer_framer_.EncryptPayload(
         ENCRYPTION_NONE, path_id, number, *packet, buffer, kMaxPacketSize);
     connection_.ProcessUdpPacket(
         kSelfAddress, kPeerAddress,
@@ -1216,7 +1218,7 @@
   frames.push_back(QuicFrame(padding));
   std::unique_ptr<QuicPacket> packet(ConstructPacket(header, frames));
   char buffer[kMaxPacketSize];
-  size_t encrypted_length = framer_.EncryptPayload(
+  size_t encrypted_length = peer_framer_.EncryptPayload(
       ENCRYPTION_NONE, kDefaultPathId, 12, *packet, buffer, kMaxPacketSize);
   EXPECT_EQ(kMaxPacketSize, encrypted_length);
 
@@ -1250,7 +1252,7 @@
   frames.push_back(QuicFrame(padding));
   std::unique_ptr<QuicPacket> packet(ConstructPacket(header, frames));
   char buffer[kMaxPacketSize];
-  size_t encrypted_length = framer_.EncryptPayload(
+  size_t encrypted_length = peer_framer_.EncryptPayload(
       ENCRYPTION_NONE, kDefaultPathId, 12, *packet, buffer, kMaxPacketSize);
   EXPECT_EQ(kMaxPacketSize, encrypted_length);
 
@@ -2576,7 +2578,7 @@
   use_tagging_decrypter();
 
   const uint8_t tag = 0x07;
-  framer_.SetEncrypter(ENCRYPTION_INITIAL, new TaggingEncrypter(tag));
+  peer_framer_.SetEncrypter(ENCRYPTION_INITIAL, new TaggingEncrypter(tag));
 
   // Process an encrypted packet which can not yet be decrypted which should
   // result in the packet being buffered.
@@ -2609,7 +2611,7 @@
   use_tagging_decrypter();
 
   const uint8_t tag = 0x07;
-  framer_.SetEncrypter(ENCRYPTION_INITIAL, new TaggingEncrypter(tag));
+  peer_framer_.SetEncrypter(ENCRYPTION_INITIAL, new TaggingEncrypter(tag));
 
   // Process an encrypted packet which can not yet be decrypted which should
   // result in the packet being buffered.
@@ -3504,7 +3506,7 @@
 TEST_P(QuicConnectionTest, TimeoutAfter5ServerRTOs) {
   FLAGS_quic_only_5rto_client_side = true;
   connection_.SetMaxTailLossProbes(kDefaultPathId, 2);
-  QuicConnectionPeer::SetPerspective(&connection_, Perspective::IS_SERVER);
+  set_perspective(Perspective::IS_SERVER);
   QuicFramerPeer::SetPerspective(QuicConnectionPeer::GetFramer(&connection_),
                                  Perspective::IS_SERVER);
   creator_->StopSendingVersion();
@@ -3640,7 +3642,7 @@
   EXPECT_FALSE(connection_.GetAckAlarm()->IsSet());
   const uint8_t tag = 0x07;
   connection_.SetDecrypter(ENCRYPTION_INITIAL, new StrictTaggingDecrypter(tag));
-  framer_.SetEncrypter(ENCRYPTION_INITIAL, new TaggingEncrypter(tag));
+  peer_framer_.SetEncrypter(ENCRYPTION_INITIAL, new TaggingEncrypter(tag));
   // Process a packet from the non-crypto stream.
   frame1_.stream_id = 3;
 
@@ -3677,7 +3679,7 @@
   EXPECT_FALSE(connection_.GetAckAlarm()->IsSet());
   const uint8_t tag = 0x07;
   connection_.SetDecrypter(ENCRYPTION_INITIAL, new StrictTaggingDecrypter(tag));
-  framer_.SetEncrypter(ENCRYPTION_INITIAL, new TaggingEncrypter(tag));
+  peer_framer_.SetEncrypter(ENCRYPTION_INITIAL, new TaggingEncrypter(tag));
   // Process a packet from the non-crypto stream.
   frame1_.stream_id = 3;
 
@@ -3729,7 +3731,7 @@
   EXPECT_FALSE(connection_.GetAckAlarm()->IsSet());
   const uint8_t tag = 0x07;
   connection_.SetDecrypter(ENCRYPTION_INITIAL, new StrictTaggingDecrypter(tag));
-  framer_.SetEncrypter(ENCRYPTION_INITIAL, new TaggingEncrypter(tag));
+  peer_framer_.SetEncrypter(ENCRYPTION_INITIAL, new TaggingEncrypter(tag));
   // Process a packet from the non-crypto stream.
   frame1_.stream_id = 3;
 
@@ -3781,7 +3783,7 @@
   EXPECT_FALSE(connection_.GetAckAlarm()->IsSet());
   const uint8_t tag = 0x07;
   connection_.SetDecrypter(ENCRYPTION_INITIAL, new StrictTaggingDecrypter(tag));
-  framer_.SetEncrypter(ENCRYPTION_INITIAL, new TaggingEncrypter(tag));
+  peer_framer_.SetEncrypter(ENCRYPTION_INITIAL, new TaggingEncrypter(tag));
   // Process a packet from the non-crypto stream.
   frame1_.stream_id = 3;
 
@@ -3841,7 +3843,7 @@
   EXPECT_FALSE(connection_.GetAckAlarm()->IsSet());
   const uint8_t tag = 0x07;
   connection_.SetDecrypter(ENCRYPTION_INITIAL, new StrictTaggingDecrypter(tag));
-  framer_.SetEncrypter(ENCRYPTION_INITIAL, new TaggingEncrypter(tag));
+  peer_framer_.SetEncrypter(ENCRYPTION_INITIAL, new TaggingEncrypter(tag));
   // Process a packet from the non-crypto stream.
   frame1_.stream_id = 3;
 
@@ -3914,7 +3916,7 @@
   EXPECT_FALSE(connection_.GetAckAlarm()->IsSet());
   const uint8_t tag = 0x07;
   connection_.SetDecrypter(ENCRYPTION_INITIAL, new StrictTaggingDecrypter(tag));
-  framer_.SetEncrypter(ENCRYPTION_INITIAL, new TaggingEncrypter(tag));
+  peer_framer_.SetEncrypter(ENCRYPTION_INITIAL, new TaggingEncrypter(tag));
   // Process a packet from the non-crypto stream.
   frame1_.stream_id = 3;
 
@@ -3976,7 +3978,7 @@
   EXPECT_FALSE(connection_.GetAckAlarm()->IsSet());
   const uint8_t tag = 0x07;
   connection_.SetDecrypter(ENCRYPTION_INITIAL, new StrictTaggingDecrypter(tag));
-  framer_.SetEncrypter(ENCRYPTION_INITIAL, new TaggingEncrypter(tag));
+  peer_framer_.SetEncrypter(ENCRYPTION_INITIAL, new TaggingEncrypter(tag));
   // Process a packet from the non-crypto stream.
   frame1_.stream_id = 3;
 
@@ -4431,8 +4433,8 @@
 
   // Send a version negotiation packet.
   std::unique_ptr<QuicEncryptedPacket> encrypted(
-      framer_.BuildVersionNegotiationPacket(connection_id_,
-                                            AllSupportedVersions()));
+      peer_framer_.BuildVersionNegotiationPacket(connection_id_,
+                                                 AllSupportedVersions()));
   std::unique_ptr<QuicReceivedPacket> received(
       ConstructReceivedPacket(*encrypted, QuicTime::Zero()));
   connection_.ProcessUdpPacket(kSelfAddress, kPeerAddress, *received);
@@ -4448,7 +4450,7 @@
   frames.push_back(QuicFrame(&frame1_));
   std::unique_ptr<QuicPacket> packet(ConstructPacket(header, frames));
   char buffer[kMaxPacketSize];
-  size_t encrypted_length = framer_.EncryptPayload(
+  size_t encrypted_length = peer_framer_.EncryptPayload(
       ENCRYPTION_NONE, kDefaultPathId, 12, *packet, buffer, kMaxPacketSize);
   ASSERT_NE(0u, encrypted_length);
   EXPECT_CALL(visitor_, OnStreamFrame(_)).Times(1);
@@ -4537,7 +4539,7 @@
   std::unique_ptr<QuicPacket> packet(ConstructPacket(header, frames));
   EXPECT_TRUE(nullptr != packet.get());
   char buffer[kMaxPacketSize];
-  size_t encrypted_length = framer_.EncryptPayload(
+  size_t encrypted_length = peer_framer_.EncryptPayload(
       ENCRYPTION_NONE, kDefaultPathId, 1, *packet, buffer, kMaxPacketSize);
 
   EXPECT_CALL(visitor_, OnConnectionClosed(QUIC_PEER_GOING_AWAY, _,

diff --git a/net/quic/core/quic_data_reader.cc b/net/quic/core/quic_data_reader.cc
index 642a3c8..855c71ab 100644
--- a/net/quic/core/quic_data_reader.cc
+++ b/net/quic/core/quic_data_reader.cc

@@ -78,7 +78,7 @@
   }
 
   // Set result.
-  result->set(data_ + pos_, size);
+  *result = StringPiece(data_ + pos_, size);
 
   // Iterate.
   pos_ += size;

diff --git a/net/quic/core/quic_flags_list.h b/net/quic/core/quic_flags_list.h
index 9bed32d..e6aab7e 100644
--- a/net/quic/core/quic_flags_list.h
+++ b/net/quic/core/quic_flags_list.h

@@ -169,3 +169,12 @@
 
 // If true, fix Cubic\'s use of kBetaLastMax for n-connection emulation.
 QUIC_FLAG(bool, FLAGS_quic_fix_beta_last_max, false)
+
+// If true, enable QUIC v37.
+QUIC_FLAG(bool, FLAGS_quic_enable_version_37, false)
+
+// If true, disables QUIC v34.
+QUIC_FLAG(bool, FLAGS_quic_disable_version_34, false)
+
+// Allow quic to properly support proxying 100 Continue responses.
+QUIC_FLAG(bool, FLAGS_quic_supports_100_continue, false)

diff --git a/net/quic/core/quic_flow_controller.cc b/net/quic/core/quic_flow_controller.cc
index 7fd7b5a..12c0368 100644
--- a/net/quic/core/quic_flow_controller.cc
+++ b/net/quic/core/quic_flow_controller.cc

@@ -36,6 +36,7 @@
   receive_window_size_limit_ = (id_ == kConnectionLevelId)
                                    ? kSessionReceiveWindowLimit
                                    : kStreamReceiveWindowLimit;
+  DCHECK_LE(receive_window_size_, receive_window_size_limit_);
 
   DVLOG(1) << ENDPOINT << "Created flow controller for stream " << id_
            << ", setting initial receive window offset to: "
@@ -240,6 +241,7 @@
 }
 
 void QuicFlowController::UpdateReceiveWindowSize(QuicStreamOffset size) {
+  DCHECK_LE(size, receive_window_size_limit_);
   DVLOG(1) << ENDPOINT << "UpdateReceiveWindowSize for stream " << id_ << ": "
            << size;
   if (receive_window_size_ != receive_window_offset_) {

diff --git a/net/quic/core/quic_framer.cc b/net/quic/core/quic_framer.cc
index b7b1809..5eff49d 100644
--- a/net/quic/core/quic_framer.cc
+++ b/net/quic/core/quic_framer.cc

@@ -15,6 +15,8 @@
 #include "net/quic/core/crypto/crypto_framer.h"
 #include "net/quic/core/crypto/crypto_handshake_message.h"
 #include "net/quic/core/crypto/crypto_protocol.h"
+#include "net/quic/core/crypto/null_decrypter.h"
+#include "net/quic/core/crypto/null_encrypter.h"
 #include "net/quic/core/crypto/quic_decrypter.h"
 #include "net/quic/core/crypto/quic_encrypter.h"
 #include "net/quic/core/quic_bug_tracker.h"
@@ -148,8 +150,8 @@
       last_timestamp_(QuicTime::Delta::Zero()) {
   DCHECK(!supported_versions.empty());
   quic_version_ = supported_versions_[0];
-  decrypter_.reset(QuicDecrypter::Create(kNULL));
-  encrypter_[ENCRYPTION_NONE].reset(QuicEncrypter::Create(kNULL));
+  decrypter_ = base::MakeUnique<NullDecrypter>(perspective);
+  encrypter_[ENCRYPTION_NONE] = base::MakeUnique<NullEncrypter>(perspective);
 }
 
 QuicFramer::~QuicFramer() {}
@@ -1566,7 +1568,7 @@
                                   char* buffer) {
   size_t output_length = 0;
   if (!encrypter_[level]->EncryptPacket(
-          path_id, packet_number,
+          quic_version_, path_id, packet_number,
           StringPiece(buffer, ad_len),                       // Associated data
           StringPiece(buffer + ad_len, total_len - ad_len),  // Plaintext
           buffer + ad_len,  // Destination buffer
@@ -1593,10 +1595,10 @@
   memmove(buffer, associated_data.data(), ad_len);
   // Encrypt the plaintext into the buffer.
   size_t output_length = 0;
-  if (!encrypter_[level]->EncryptPacket(path_id, packet_number, associated_data,
-                                        packet.Plaintext(quic_version_),
-                                        buffer + ad_len, &output_length,
-                                        buffer_len - ad_len)) {
+  if (!encrypter_[level]->EncryptPacket(
+          quic_version_, path_id, packet_number, associated_data,
+          packet.Plaintext(quic_version_), buffer + ad_len, &output_length,
+          buffer_len - ad_len)) {
     RaiseError(QUIC_ENCRYPTION_FAILURE);
     return 0;
   }
@@ -1636,8 +1638,8 @@
       header.public_header.packet_number_length);
 
   bool success = decrypter_->DecryptPacket(
-      header.path_id, header.packet_number, associated_data, encrypted,
-      decrypted_buffer, decrypted_length, buffer_length);
+      quic_version_, header.path_id, header.packet_number, associated_data,
+      encrypted, decrypted_buffer, decrypted_length, buffer_length);
   if (success) {
     visitor_->OnDecryptedPacket(decrypter_level_);
   } else if (alternative_decrypter_.get() != nullptr) {
@@ -1660,8 +1662,8 @@
 
     if (try_alternative_decryption) {
       success = alternative_decrypter_->DecryptPacket(
-          header.path_id, header.packet_number, associated_data, encrypted,
-          decrypted_buffer, decrypted_length, buffer_length);
+          quic_version_, header.path_id, header.packet_number, associated_data,
+          encrypted, decrypted_buffer, decrypted_length, buffer_length);
     }
     if (success) {
       visitor_->OnDecryptedPacket(alternative_decrypter_level_);

diff --git a/net/quic/core/quic_framer_test.cc b/net/quic/core/quic_framer_test.cc
index 533994b..7401a054 100644
--- a/net/quic/core/quic_framer_test.cc
+++ b/net/quic/core/quic_framer_test.cc

@@ -15,6 +15,7 @@
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
 #include "net/quic/core/crypto/null_decrypter.h"
+#include "net/quic/core/crypto/null_encrypter.h"
 #include "net/quic/core/crypto/quic_decrypter.h"
 #include "net/quic/core/crypto/quic_encrypter.h"
 #include "net/quic/core/quic_packets.h"
@@ -111,13 +112,15 @@
   ~TestEncrypter() override {}
   bool SetKey(StringPiece key) override { return true; }
   bool SetNoncePrefix(StringPiece nonce_prefix) override { return true; }
-  bool EncryptPacket(QuicPathId path_id,
+  bool EncryptPacket(QuicVersion version,
+                     QuicPathId path_id,
                      QuicPacketNumber packet_number,
                      StringPiece associated_data,
                      StringPiece plaintext,
                      char* output,
                      size_t* output_length,
                      size_t max_output_length) override {
+    version_ = version;
     path_id_ = path_id;
     packet_number_ = packet_number;
     associated_data_ = associated_data.as_string();
@@ -136,6 +139,9 @@
   }
   StringPiece GetKey() const override { return StringPiece(); }
   StringPiece GetNoncePrefix() const override { return StringPiece(); }
+
+  QuicVersion version_;
+  Perspective perspective_;
   QuicPathId path_id_;
   QuicPacketNumber packet_number_;
   string associated_data_;
@@ -154,13 +160,15 @@
   bool SetDiversificationNonce(const DiversificationNonce& key) override {
     return true;
   }
-  bool DecryptPacket(QuicPathId path_id,
+  bool DecryptPacket(QuicVersion version,
+                     QuicPathId path_id,
                      QuicPacketNumber packet_number,
                      StringPiece associated_data,
                      StringPiece ciphertext,
                      char* output,
                      size_t* output_length,
                      size_t max_output_length) override {
+    version_ = version;
     path_id_ = path_id;
     packet_number_ = packet_number;
     associated_data_ = associated_data.as_string();
@@ -174,6 +182,8 @@
   const char* cipher_name() const override { return "Test"; }
   // Use a distinct value starting with 0xFFFFFF, which is never used by TLS.
   uint32_t cipher_id() const override { return 0xFFFFFFF2; }
+  QuicVersion version_;
+  Perspective perspective_;
   QuicPathId path_id_;
   QuicPacketNumber packet_number_;
   string associated_data_;
@@ -358,6 +368,7 @@
   bool CheckEncryption(QuicPathId path_id,
                        QuicPacketNumber packet_number,
                        QuicPacket* packet) {
+    EXPECT_EQ(version_, encrypter_->version_);
     if (packet_number != encrypter_->packet_number_) {
       LOG(ERROR) << "Encrypted incorrect packet number.  expected "
                  << packet_number << " actual: " << encrypter_->packet_number_;
@@ -383,6 +394,7 @@
                        bool includes_version,
                        bool includes_path_id,
                        bool includes_diversification_nonce) {
+    EXPECT_EQ(version_, decrypter_->version_);
     if (visitor_.header_->packet_number != decrypter_->packet_number_) {
       LOG(ERROR) << "Decrypted incorrect packet number.  expected "
                  << visitor_.header_->packet_number
@@ -1314,7 +1326,8 @@
 
 TEST_P(QuicFramerTest, MissingDiversificationNonce) {
   QuicFramerPeer::SetPerspective(&framer_, Perspective::IS_CLIENT);
-  framer_.SetDecrypter(ENCRYPTION_NONE, new NullDecrypter());
+  framer_.SetDecrypter(ENCRYPTION_NONE,
+                       new NullDecrypter(Perspective::IS_CLIENT));
   decrypter_ = new test::TestDecrypter();
   framer_.SetAlternativeDecrypter(ENCRYPTION_INITIAL, decrypter_, false);
 
@@ -4052,8 +4065,10 @@
 TEST_P(QuicFramerTest, ConstructEncryptedPacket) {
   // Since we are using ConstructEncryptedPacket, we have to set the framer's
   // crypto to be Null.
-  framer_.SetDecrypter(ENCRYPTION_NONE, QuicDecrypter::Create(kNULL));
-  framer_.SetEncrypter(ENCRYPTION_NONE, QuicEncrypter::Create(kNULL));
+  framer_.SetDecrypter(ENCRYPTION_NONE,
+                       new NullDecrypter(framer_.perspective()));
+  framer_.SetEncrypter(ENCRYPTION_NONE,
+                       new NullEncrypter(framer_.perspective()));
   QuicVersionVector versions;
   versions.push_back(framer_.version());
   std::unique_ptr<QuicEncryptedPacket> packet(ConstructEncryptedPacket(
@@ -4086,14 +4101,16 @@
 TEST_P(QuicFramerTest, ConstructMisFramedEncryptedPacket) {
   // Since we are using ConstructEncryptedPacket, we have to set the framer's
   // crypto to be Null.
-  framer_.SetDecrypter(ENCRYPTION_NONE, QuicDecrypter::Create(kNULL));
-  framer_.SetEncrypter(ENCRYPTION_NONE, QuicEncrypter::Create(kNULL));
+  framer_.SetDecrypter(ENCRYPTION_NONE,
+                       new NullDecrypter(framer_.perspective()));
+  framer_.SetEncrypter(ENCRYPTION_NONE,
+                       new NullEncrypter(framer_.perspective()));
   QuicVersionVector versions;
   versions.push_back(framer_.version());
   std::unique_ptr<QuicEncryptedPacket> packet(ConstructMisFramedEncryptedPacket(
       42, false, false, false, kDefaultPathId, kTestQuicStreamId, kTestString,
       PACKET_8BYTE_CONNECTION_ID, PACKET_6BYTE_PACKET_NUMBER, &versions,
-      Perspective::IS_SERVER));
+      Perspective::IS_CLIENT));
 
   MockFramerVisitor visitor;
   framer_.set_visitor(&visitor);

diff --git a/net/quic/core/quic_packet_creator_test.cc b/net/quic/core/quic_packet_creator_test.cc
index 3e006ef..96b9c76 100644
--- a/net/quic/core/quic_packet_creator_test.cc
+++ b/net/quic/core/quic_packet_creator_test.cc

@@ -131,8 +131,10 @@
         serialized_packet_(creator_.NoPacket()) {
     creator_.set_connection_id_length(GetParam().connection_id_length);
 
-    creator_.SetEncrypter(ENCRYPTION_INITIAL, new NullEncrypter());
-    creator_.SetEncrypter(ENCRYPTION_FORWARD_SECURE, new NullEncrypter());
+    creator_.SetEncrypter(ENCRYPTION_INITIAL,
+                          new NullEncrypter(Perspective::IS_CLIENT));
+    creator_.SetEncrypter(ENCRYPTION_FORWARD_SECURE,
+                          new NullEncrypter(Perspective::IS_CLIENT));
     client_framer_.set_visitor(&framer_visitor_);
     server_framer_.set_visitor(&framer_visitor_);
   }

diff --git a/net/quic/core/quic_packet_generator_test.cc b/net/quic/core/quic_packet_generator_test.cc
index 8837e44..17ae9901 100644
--- a/net/quic/core/quic_packet_generator_test.cc
+++ b/net/quic/core/quic_packet_generator_test.cc

@@ -109,7 +109,8 @@
                 Perspective::IS_CLIENT),
         generator_(42, &framer_, &buffer_allocator_, &delegate_),
         creator_(QuicPacketGeneratorPeer::GetPacketCreator(&generator_)) {
-    creator_->SetEncrypter(ENCRYPTION_FORWARD_SECURE, new NullEncrypter());
+    creator_->SetEncrypter(ENCRYPTION_FORWARD_SECURE,
+                           new NullEncrypter(Perspective::IS_CLIENT));
     creator_->set_encryption_level(ENCRYPTION_FORWARD_SECURE);
   }
 
@@ -446,7 +447,7 @@
   // Set the packet size be enough for two stream frames with 0 stream offset,
   // but not enough for a stream frame of 0 offset and one with non-zero offset.
   size_t length =
-      NullEncrypter().GetCiphertextSize(0) +
+      NullEncrypter(Perspective::IS_CLIENT).GetCiphertextSize(0) +
       GetPacketHeaderSize(
           framer_.version(), creator_->connection_id_length(), kIncludeVersion,
           !kIncludePathId, !kIncludeDiversificationNonce,

diff --git a/net/quic/core/quic_session_test.cc b/net/quic/core/quic_session_test.cc
index 5c5c58bb..58023dbc 100644
--- a/net/quic/core/quic_session_test.cc
+++ b/net/quic/core/quic_session_test.cc

@@ -119,8 +119,9 @@
         crypto_stream_(this),
         writev_consumes_all_data_(false) {
     Initialize();
-    this->connection()->SetEncrypter(ENCRYPTION_FORWARD_SECURE,
-                                     new NullEncrypter());
+    this->connection()->SetEncrypter(
+        ENCRYPTION_FORWARD_SECURE,
+        new NullEncrypter(connection->perspective()));
   }
 
   ~TestSession() override { delete connection(); }

diff --git a/net/quic/core/quic_spdy_stream.h b/net/quic/core/quic_spdy_stream.h
index 41a5674..ef0e1c4 100644
--- a/net/quic/core/quic_spdy_stream.h
+++ b/net/quic/core/quic_spdy_stream.h

@@ -206,6 +206,8 @@
       QuicReferenceCountedPointer<QuicAckListenerInterface>
           ack_notifier_delegate) override;
 
+  void set_headers_decompressed(bool val) { headers_decompressed_ = val; }
+
  private:
   friend class test::QuicSpdyStreamPeer;
   friend class test::QuicStreamPeer;

diff --git a/net/quic/core/quic_stream_sequencer_buffer_test.cc b/net/quic/core/quic_stream_sequencer_buffer_test.cc
index dcef21ea..855fe16 100644
--- a/net/quic/core/quic_stream_sequencer_buffer_test.cc
+++ b/net/quic/core/quic_stream_sequencer_buffer_test.cc

@@ -138,7 +138,7 @@
 TEST_F(QuicStreamSequencerBufferTest, OnStreamDataInvalidSource) {
   // Pass in an invalid source, expects to return error.
   StringPiece source;
-  source.set(nullptr, 1024);
+  source = StringPiece(nullptr, 1024);
   size_t written;
   clock_.AdvanceTime(QuicTime::Delta::FromSeconds(1));
   QuicTime t = clock_.ApproximateNow();

diff --git a/net/quic/core/quic_utils.cc b/net/quic/core/quic_utils.cc
index e4dcd9b..479b6e1f 100644
--- a/net/quic/core/quic_utils.cc
+++ b/net/quic/core/quic_utils.cc

@@ -34,7 +34,7 @@
 #endif
 
 #ifdef QUIC_UTIL_HAS_UINT128
-uint128 IncrementalHashFast(uint128 uhash, const char* data, size_t len) {
+uint128 IncrementalHashFast(uint128 uhash, StringPiece data) {
   // This code ends up faster than the naive implementation for 2 reasons:
   // 1. uint128 from base/int128.h is sufficiently complicated that the compiler
   //    cannot transform the multiplication by kPrime into a shift-multiply-add;
@@ -46,49 +46,50 @@
       (static_cast<__uint128_t>(16777216) << 64) + 315;
   __uint128_t xhash = (static_cast<__uint128_t>(Uint128High64(uhash)) << 64) +
                       Uint128Low64(uhash);
-  const uint8_t* octets = reinterpret_cast<const uint8_t*>(data);
-  for (size_t i = 0; i < len; ++i) {
+  const uint8_t* octets = reinterpret_cast<const uint8_t*>(data.data());
+  for (size_t i = 0; i < data.length(); ++i) {
     xhash = (xhash ^ octets[i]) * kPrime;
   }
-  return uint128(static_cast<uint64_t>(xhash >> 64),
-                 static_cast<uint64_t>(xhash & UINT64_C(0xFFFFFFFFFFFFFFFF)));
+  return MakeUint128(
+      static_cast<uint64_t>(xhash >> 64),
+      static_cast<uint64_t>(xhash & UINT64_C(0xFFFFFFFFFFFFFFFF)));
 }
 #endif
 
 #ifndef QUIC_UTIL_HAS_UINT128
 // Slow implementation of IncrementalHash. In practice, only used by Chromium.
-uint128 IncrementalHashSlow(uint128 hash, const char* data, size_t len) {
+uint128 IncrementalHashSlow(uint128 hash, StringPiece data) {
   // kPrime = 309485009821345068724781371
-  static const uint128 kPrime(16777216, 315);
-  const uint8_t* octets = reinterpret_cast<const uint8_t*>(data);
-  for (size_t i = 0; i < len; ++i) {
-    hash = hash ^ uint128(0, octets[i]);
+  static const uint128 kPrime = MakeUint128(16777216, 315);
+  const uint8_t* octets = reinterpret_cast<const uint8_t*>(data.data());
+  for (size_t i = 0; i < data.length(); ++i) {
+    hash = hash ^ MakeUint128(0, octets[i]);
     hash = hash * kPrime;
   }
   return hash;
 }
 #endif
 
-uint128 IncrementalHash(uint128 hash, const char* data, size_t len) {
+uint128 IncrementalHash(uint128 hash, StringPiece data) {
 #ifdef QUIC_UTIL_HAS_UINT128
-  return IncrementalHashFast(hash, data, len);
+  return IncrementalHashFast(hash, data);
 #else
-  return IncrementalHashSlow(hash, data, len);
+  return IncrementalHashSlow(hash, data);
 #endif
 }
 
 }  // namespace
 
 // static
-uint64_t QuicUtils::FNV1a_64_Hash(const char* data, int len) {
+uint64_t QuicUtils::FNV1a_64_Hash(StringPiece data) {
   static const uint64_t kOffset = UINT64_C(14695981039346656037);
   static const uint64_t kPrime = UINT64_C(1099511628211);
 
-  const uint8_t* octets = reinterpret_cast<const uint8_t*>(data);
+  const uint8_t* octets = reinterpret_cast<const uint8_t*>(data.data());
 
   uint64_t hash = kOffset;
 
-  for (int i = 0; i < len; ++i) {
+  for (size_t i = 0; i < data.length(); ++i) {
     hash = hash ^ octets[i];
     hash = hash * kPrime;
   }
@@ -97,26 +98,35 @@
 }
 
 // static
-uint128 QuicUtils::FNV1a_128_Hash(const char* data, int len) {
-  return FNV1a_128_Hash_Two(data, len, nullptr, 0);
+uint128 QuicUtils::FNV1a_128_Hash(StringPiece data) {
+  return FNV1a_128_Hash_Three(data, StringPiece(), StringPiece());
 }
 
 // static
-uint128 QuicUtils::FNV1a_128_Hash_Two(const char* data1,
-                                      int len1,
-                                      const char* data2,
-                                      int len2) {
+uint128 QuicUtils::FNV1a_128_Hash_Two(StringPiece data1, StringPiece data2) {
+  return FNV1a_128_Hash_Three(data1, data2, StringPiece());
+}
+
+// static
+uint128 QuicUtils::FNV1a_128_Hash_Three(StringPiece data1,
+                                        StringPiece data2,
+                                        StringPiece data3) {
   // The two constants are defined as part of the hash algorithm.
   // see http://www.isthe.com/chongo/tech/comp/fnv/
   // kOffset = 144066263297769815596495629667062367629
-  const uint128 kOffset(UINT64_C(7809847782465536322),
-                        UINT64_C(7113472399480571277));
+  const uint128 kOffset =
+      MakeUint128(UINT64_C(7809847782465536322), UINT64_C(7113472399480571277));
 
-  uint128 hash = IncrementalHash(kOffset, data1, len1);
-  if (data2 == nullptr) {
+  uint128 hash = IncrementalHash(kOffset, data1);
+  if (data2.empty()) {
     return hash;
   }
-  return IncrementalHash(hash, data2, len2);
+
+  hash = IncrementalHash(hash, data2);
+  if (data3.empty()) {
+    return hash;
+  }
+  return IncrementalHash(hash, data3);
 }
 
 // static

diff --git a/net/quic/core/quic_utils.h b/net/quic/core/quic_utils.h
index 52eb8497..09ded399 100644
--- a/net/quic/core/quic_utils.h
+++ b/net/quic/core/quic_utils.h

@@ -35,18 +35,22 @@
  public:
   // Returns the 64 bit FNV1a hash of the data.  See
   // http://www.isthe.com/chongo/tech/comp/fnv/index.html#FNV-param
-  static uint64_t FNV1a_64_Hash(const char* data, int len);
+  static uint64_t FNV1a_64_Hash(base::StringPiece data);
 
-  // returns the 128 bit FNV1a hash of the data.  See
+  // Returns the 128 bit FNV1a hash of the data.  See
   // http://www.isthe.com/chongo/tech/comp/fnv/index.html#FNV-param
-  static uint128 FNV1a_128_Hash(const char* data1, int len1);
+  static uint128 FNV1a_128_Hash(base::StringPiece data);
 
-  // returns the 128 bit FNV1a hash of the two sequences of data.  See
+  // Returns the 128 bit FNV1a hash of the two sequences of data.  See
   // http://www.isthe.com/chongo/tech/comp/fnv/index.html#FNV-param
-  static uint128 FNV1a_128_Hash_Two(const char* data1,
-                                    int len1,
-                                    const char* data2,
-                                    int len2);
+  static uint128 FNV1a_128_Hash_Two(base::StringPiece data1,
+                                    base::StringPiece data2);
+
+  // Returns the 128 bit FNV1a hash of the three sequences of data.  See
+  // http://www.isthe.com/chongo/tech/comp/fnv/index.html#FNV-param
+  static uint128 FNV1a_128_Hash_Three(base::StringPiece data1,
+                                      base::StringPiece data2,
+                                      base::StringPiece data3);
 
   // SerializeUint128 writes the first 96 bits of |v| in little-endian form
   // to |out|.

diff --git a/net/quic/core/quic_utils_test.cc b/net/quic/core/quic_utils_test.cc
index 7b8ca2ff..ea18cb2 100644
--- a/net/quic/core/quic_utils_test.cc
+++ b/net/quic/core/quic_utils_test.cc

@@ -92,12 +92,12 @@
   // see http://www.isthe.com/chongo/tech/comp/fnv/
   // hash = 144066263297769815596495629667062367629
   uint128 hash =
-      uint128(UINT64_C(7809847782465536322), UINT64_C(7113472399480571277));
+      MakeUint128(UINT64_C(7809847782465536322), UINT64_C(7113472399480571277));
   // kPrime = 309485009821345068724781371
-  const uint128 kPrime(16777216, 315);
+  const uint128 kPrime = MakeUint128(16777216, 315);
   const uint8_t* octets = reinterpret_cast<const uint8_t*>(data);
   for (size_t i = 0; i < len; ++i) {
-    hash = hash ^ uint128(0, octets[i]);
+    hash = hash ^ MakeUint128(0, octets[i]);
     hash = hash * kPrime;
   }
   return hash;
@@ -109,8 +109,8 @@
     data[i] = i % 255;
   }
   EXPECT_EQ(IncrementalHashReference(data.data(), data.size()),
-            QuicUtils::FNV1a_128_Hash(
-                reinterpret_cast<const char*>(data.data()), data.size()));
+            QuicUtils::FNV1a_128_Hash(StringPiece(
+                reinterpret_cast<const char*>(data.data()), data.size())));
 }
 
 TEST(QuicUtilsTest, HexDump) {

diff --git a/net/quic/core/quic_version_manager.cc b/net/quic/core/quic_version_manager.cc
index 6bbfe801..9a45c77 100644
--- a/net/quic/core/quic_version_manager.cc
+++ b/net/quic/core/quic_version_manager.cc

@@ -10,7 +10,9 @@
 namespace net {
 
 QuicVersionManager::QuicVersionManager(QuicVersionVector supported_versions)
-    : enable_version_36_(FLAGS_quic_enable_version_36_v3),
+    : enable_version_37_(FLAGS_quic_enable_version_37),
+      enable_version_36_(FLAGS_quic_enable_version_36_v3),
+      disable_version_34_(FLAGS_quic_disable_version_34),
       allowed_supported_versions_(supported_versions),
       filtered_supported_versions_(
           FilterSupportedVersions(supported_versions)) {}
@@ -23,8 +25,12 @@
 }
 
 void QuicVersionManager::MaybeRefilterSupportedVersions() {
-  if (enable_version_36_ != FLAGS_quic_enable_version_36_v3) {
+  if (enable_version_37_ != FLAGS_quic_enable_version_37 ||
+      enable_version_36_ != FLAGS_quic_enable_version_36_v3 ||
+      disable_version_34_ != FLAGS_quic_disable_version_34) {
+    enable_version_37_ = FLAGS_quic_enable_version_37;
     enable_version_36_ = FLAGS_quic_enable_version_36_v3;
+    disable_version_34_ = FLAGS_quic_disable_version_34;
     RefilterSupportedVersions();
   }
 }

diff --git a/net/quic/core/quic_version_manager.h b/net/quic/core/quic_version_manager.h
index 83deef40..348dbb4 100644
--- a/net/quic/core/quic_version_manager.h
+++ b/net/quic/core/quic_version_manager.h

@@ -31,8 +31,12 @@
   }
 
  private:
+  // FLAGS_quic_enable_version_37
+  bool enable_version_37_;
   // FLAGS_quic_enable_version_36_v3
   bool enable_version_36_;
+  // FLAGS_quic_disable_version_34
+  bool disable_version_34_;
   // The list of versions that may be supported.
   QuicVersionVector allowed_supported_versions_;
   // This vector contains QUIC versions which are currently supported based on

diff --git a/net/quic/core/quic_version_manager_test.cc b/net/quic/core/quic_version_manager_test.cc
index 0529259..34173eb6 100644
--- a/net/quic/core/quic_version_manager_test.cc
+++ b/net/quic/core/quic_version_manager_test.cc

@@ -17,14 +17,36 @@
 TEST(QuicVersionManagerTest, QuicVersionManager) {
   QuicFlagSaver flags;
   FLAGS_quic_enable_version_36_v3 = false;
+  FLAGS_quic_enable_version_37 = false;
+  FLAGS_quic_disable_version_34 = false;
   QuicVersionManager manager(AllSupportedVersions());
   EXPECT_EQ(FilterSupportedVersions(AllSupportedVersions()),
             manager.GetSupportedVersions());
+
   FLAGS_quic_enable_version_36_v3 = true;
   EXPECT_EQ(FilterSupportedVersions(AllSupportedVersions()),
             manager.GetSupportedVersions());
+  ASSERT_EQ(3u, manager.GetSupportedVersions().size());
   EXPECT_EQ(QUIC_VERSION_36, manager.GetSupportedVersions()[0]);
   EXPECT_EQ(QUIC_VERSION_35, manager.GetSupportedVersions()[1]);
+  EXPECT_EQ(QUIC_VERSION_34, manager.GetSupportedVersions()[2]);
+
+  FLAGS_quic_enable_version_37 = true;
+  EXPECT_EQ(FilterSupportedVersions(AllSupportedVersions()),
+            manager.GetSupportedVersions());
+  ASSERT_EQ(4u, manager.GetSupportedVersions().size());
+  EXPECT_EQ(QUIC_VERSION_37, manager.GetSupportedVersions()[0]);
+  EXPECT_EQ(QUIC_VERSION_36, manager.GetSupportedVersions()[1]);
+  EXPECT_EQ(QUIC_VERSION_35, manager.GetSupportedVersions()[2]);
+  EXPECT_EQ(QUIC_VERSION_34, manager.GetSupportedVersions()[3]);
+
+  FLAGS_quic_disable_version_34 = true;
+  EXPECT_EQ(FilterSupportedVersions(AllSupportedVersions()),
+            manager.GetSupportedVersions());
+  ASSERT_EQ(3u, manager.GetSupportedVersions().size());
+  EXPECT_EQ(QUIC_VERSION_37, manager.GetSupportedVersions()[0]);
+  EXPECT_EQ(QUIC_VERSION_36, manager.GetSupportedVersions()[1]);
+  EXPECT_EQ(QUIC_VERSION_35, manager.GetSupportedVersions()[2]);
 }
 
 }  // namespace

diff --git a/net/quic/core/quic_versions.cc b/net/quic/core/quic_versions.cc
index f14c772..4633209f 100644
--- a/net/quic/core/quic_versions.cc
+++ b/net/quic/core/quic_versions.cc

@@ -32,10 +32,18 @@
   QuicVersionVector filtered_versions(versions.size());
   filtered_versions.clear();  // Guaranteed by spec not to change capacity.
   for (QuicVersion version : versions) {
-    if (version == QUIC_VERSION_36) {
+    if (version == QUIC_VERSION_37) {
+      if (FLAGS_quic_enable_version_37 && FLAGS_quic_enable_version_36_v3) {
+        filtered_versions.push_back(version);
+      }
+    } else if (version == QUIC_VERSION_36) {
       if (FLAGS_quic_enable_version_36_v3) {
         filtered_versions.push_back(version);
       }
+    } else if (version == QUIC_VERSION_34) {
+      if (!FLAGS_quic_disable_version_34) {
+        filtered_versions.push_back(version);
+      }
     } else {
       filtered_versions.push_back(version);
     }
@@ -62,6 +70,8 @@
       return MakeQuicTag('Q', '0', '3', '5');
     case QUIC_VERSION_36:
       return MakeQuicTag('Q', '0', '3', '6');
+    case QUIC_VERSION_37:
+      return MakeQuicTag('Q', '0', '3', '7');
     default:
       // This shold be an ERROR because we should never attempt to convert an
       // invalid QuicVersion to be written to the wire.
@@ -90,6 +100,7 @@
     RETURN_STRING_LITERAL(QUIC_VERSION_34);
     RETURN_STRING_LITERAL(QUIC_VERSION_35);
     RETURN_STRING_LITERAL(QUIC_VERSION_36);
+    RETURN_STRING_LITERAL(QUIC_VERSION_37);
     default:
       return "QUIC_VERSION_UNSUPPORTED";
   }

diff --git a/net/quic/core/quic_versions.h b/net/quic/core/quic_versions.h
index 841de1b..d3a567159 100644
--- a/net/quic/core/quic_versions.h
+++ b/net/quic/core/quic_versions.h

@@ -28,6 +28,7 @@
                          // header, uses new ack and stop waiting wire format.
   QUIC_VERSION_35 = 35,  // Allows endpoints to independently set stream limit.
   QUIC_VERSION_36 = 36,  // Add support to force HOL blocking.
+  QUIC_VERSION_37 = 37,  // Add perspective into null encryption.
 
   // IMPORTANT: if you are adding to this std::list, follow the instructions at
   // http://sites/quic/adding-and-removing-versions
@@ -41,7 +42,7 @@
 // IMPORTANT: if you are adding to this list, follow the instructions at
 // http://sites/quic/adding-and-removing-versions
 static const QuicVersion kSupportedQuicVersions[] = {
-    QUIC_VERSION_36, QUIC_VERSION_35, QUIC_VERSION_34};
+    QUIC_VERSION_37, QUIC_VERSION_36, QUIC_VERSION_35, QUIC_VERSION_34};
 
 typedef std::vector<QuicVersion> QuicVersionVector;
 

diff --git a/net/quic/core/quic_versions_test.cc b/net/quic/core/quic_versions_test.cc
index b1746ec9..40978c49 100644
--- a/net/quic/core/quic_versions_test.cc
+++ b/net/quic/core/quic_versions_test.cc

@@ -125,44 +125,67 @@
   }
 }
 
-TEST(QuicVersionsTest, FilterSupportedVersions) {
+TEST(QuicVersionsTest, FilterSupportedVersionsNo34) {
   QuicFlagSaver flags;
   QuicVersionVector all_versions = {QUIC_VERSION_34, QUIC_VERSION_35,
-                                    QUIC_VERSION_36};
+                                    QUIC_VERSION_36, QUIC_VERSION_37};
 
+  FLAGS_quic_disable_version_34 = true;
   FLAGS_quic_enable_version_36_v3 = false;
+  FLAGS_quic_enable_version_37 = false;
 
   QuicVersionVector filtered_versions = FilterSupportedVersions(all_versions);
-  ASSERT_EQ(2u, filtered_versions.size());
-  EXPECT_EQ(QUIC_VERSION_34, filtered_versions[0]);
-}
-
-TEST(QuicVersionsTest, FilterSupportedVersionsAllVersions) {
-  QuicFlagSaver flags;
-  QuicVersionVector all_versions = {QUIC_VERSION_34, QUIC_VERSION_35,
-                                    QUIC_VERSION_36};
-
-  FLAGS_quic_enable_version_36_v3 = true;
-
-  QuicVersionVector filtered_versions = FilterSupportedVersions(all_versions);
-  ASSERT_EQ(all_versions, filtered_versions);
+  ASSERT_EQ(1u, filtered_versions.size());
+  EXPECT_EQ(QUIC_VERSION_35, filtered_versions[0]);
 }
 
 TEST(QuicVersionsTest, FilterSupportedVersionsNo36) {
   QuicFlagSaver flags;
   QuicVersionVector all_versions = {QUIC_VERSION_34, QUIC_VERSION_35,
-                                    QUIC_VERSION_36};
+                                    QUIC_VERSION_36, QUIC_VERSION_37};
 
+  FLAGS_quic_disable_version_34 = false;
   FLAGS_quic_enable_version_36_v3 = false;
+  FLAGS_quic_enable_version_37 = false;
 
-  all_versions.pop_back();  // Remove 36
+  QuicVersionVector filtered_versions = FilterSupportedVersions(all_versions);
+  ASSERT_EQ(2u, filtered_versions.size());
+  EXPECT_EQ(QUIC_VERSION_34, filtered_versions[0]);
+  EXPECT_EQ(QUIC_VERSION_35, filtered_versions[1]);
+}
 
-  ASSERT_EQ(all_versions, FilterSupportedVersions(all_versions));
+TEST(QuicVersionsTest, FilterSupportedVersionsNo37) {
+  QuicFlagSaver flags;
+  QuicVersionVector all_versions = {QUIC_VERSION_34, QUIC_VERSION_35,
+                                    QUIC_VERSION_36, QUIC_VERSION_37};
+
+  FLAGS_quic_disable_version_34 = false;
+  FLAGS_quic_enable_version_36_v3 = true;
+  FLAGS_quic_enable_version_37 = false;
+
+  QuicVersionVector filtered_versions = FilterSupportedVersions(all_versions);
+  ASSERT_EQ(3u, filtered_versions.size());
+  EXPECT_EQ(QUIC_VERSION_34, filtered_versions[0]);
+  EXPECT_EQ(QUIC_VERSION_35, filtered_versions[1]);
+  EXPECT_EQ(QUIC_VERSION_36, filtered_versions[2]);
+}
+
+TEST(QuicVersionsTest, FilterSupportedVersionsAllVersions) {
+  QuicFlagSaver flags;
+  QuicVersionVector all_versions = {QUIC_VERSION_34, QUIC_VERSION_35,
+                                    QUIC_VERSION_36, QUIC_VERSION_37};
+
+  FLAGS_quic_disable_version_34 = false;
+  FLAGS_quic_enable_version_36_v3 = true;
+  FLAGS_quic_enable_version_37 = true;
+
+  QuicVersionVector filtered_versions = FilterSupportedVersions(all_versions);
+  ASSERT_EQ(all_versions, filtered_versions);
 }
 
 TEST(QuicVersionsTest, LookUpVersionByIndex) {
   QuicVersionVector all_versions = {QUIC_VERSION_34, QUIC_VERSION_35,
-                                    QUIC_VERSION_36};
+                                    QUIC_VERSION_36, QUIC_VERSION_37};
   int version_count = all_versions.size();
   for (int i = -5; i <= version_count + 1; ++i) {
     if (i >= 0 && i < version_count) {

diff --git a/net/quic/test_tools/crypto_test_utils.cc b/net/quic/test_tools/crypto_test_utils.cc
index 416ea3d..fdba134 100644
--- a/net/quic/test_tools/crypto_test_utils.cc
+++ b/net/quic/test_tools/crypto_test_utils.cc

@@ -582,8 +582,7 @@
     return 0;
   }
 
-  return QuicUtils::FNV1a_64_Hash(chain->certs.at(0).c_str(),
-                                  chain->certs.at(0).length());
+  return QuicUtils::FNV1a_64_Hash(chain->certs.at(0));
 }
 
 class MockCommonCertSets : public CommonCertSets {

diff --git a/net/quic/test_tools/mock_crypto_client_stream.cc b/net/quic/test_tools/mock_crypto_client_stream.cc
index 7a6dbff..25ba8684 100644
--- a/net/quic/test_tools/mock_crypto_client_stream.cc
+++ b/net/quic/test_tools/mock_crypto_client_stream.cc

@@ -4,6 +4,8 @@
 
 #include "net/quic/test_tools/mock_crypto_client_stream.h"
 
+#include "net/quic/core/crypto/null_decrypter.h"
+#include "net/quic/core/crypto/null_encrypter.h"
 #include "net/quic/core/crypto/quic_decrypter.h"
 #include "net/quic/core/crypto/quic_encrypter.h"
 #include "net/quic/core/quic_client_session_base.h"
@@ -64,10 +66,10 @@
         reinterpret_cast<QuicClientSessionBase*>(session())
             ->OnProofVerifyDetailsAvailable(*proof_verify_details_);
       }
-      session()->connection()->SetDecrypter(ENCRYPTION_INITIAL,
-                                            QuicDecrypter::Create(kNULL));
-      session()->connection()->SetEncrypter(ENCRYPTION_INITIAL,
-                                            QuicEncrypter::Create(kNULL));
+      session()->connection()->SetDecrypter(
+          ENCRYPTION_INITIAL, new NullDecrypter(Perspective::IS_CLIENT));
+      session()->connection()->SetEncrypter(
+          ENCRYPTION_INITIAL, new NullEncrypter(Perspective::IS_CLIENT));
       session()->connection()->SetDefaultEncryptionLevel(ENCRYPTION_INITIAL);
       session()->OnCryptoHandshakeEvent(
           QuicSession::ENCRYPTION_FIRST_ESTABLISHED);
@@ -84,10 +86,10 @@
             ->OnProofVerifyDetailsAvailable(*proof_verify_details_);
       }
       SetConfigNegotiated();
-      session()->connection()->SetDecrypter(ENCRYPTION_FORWARD_SECURE,
-                                            QuicDecrypter::Create(kNULL));
-      session()->connection()->SetEncrypter(ENCRYPTION_FORWARD_SECURE,
-                                            QuicEncrypter::Create(kNULL));
+      session()->connection()->SetDecrypter(
+          ENCRYPTION_FORWARD_SECURE, new NullDecrypter(Perspective::IS_CLIENT));
+      session()->connection()->SetEncrypter(
+          ENCRYPTION_FORWARD_SECURE, new NullEncrypter(Perspective::IS_CLIENT));
       session()->connection()->SetDefaultEncryptionLevel(
           ENCRYPTION_FORWARD_SECURE);
       session()->OnCryptoHandshakeEvent(QuicSession::HANDSHAKE_CONFIRMED);
@@ -108,10 +110,10 @@
   if (event == QuicSession::HANDSHAKE_CONFIRMED) {
     handshake_confirmed_ = true;
     SetConfigNegotiated();
-    session()->connection()->SetDecrypter(ENCRYPTION_FORWARD_SECURE,
-                                          QuicDecrypter::Create(kNULL));
-    session()->connection()->SetEncrypter(ENCRYPTION_FORWARD_SECURE,
-                                          QuicEncrypter::Create(kNULL));
+    session()->connection()->SetDecrypter(
+        ENCRYPTION_FORWARD_SECURE, new NullDecrypter(Perspective::IS_CLIENT));
+    session()->connection()->SetEncrypter(
+        ENCRYPTION_FORWARD_SECURE, new NullEncrypter(Perspective::IS_CLIENT));
     session()->connection()->SetDefaultEncryptionLevel(
         ENCRYPTION_FORWARD_SECURE);
   }

diff --git a/net/quic/test_tools/quic_test_utils.cc b/net/quic/test_tools/quic_test_utils.cc
index b99c7f1..a95af0d 100644
--- a/net/quic/test_tools/quic_test_utils.cc
+++ b/net/quic/test_tools/quic_test_utils.cc

@@ -780,13 +780,14 @@
                                    size_t* payload_length) {
   *payload_length = 1;
   const size_t stream_length =
-      NullEncrypter().GetCiphertextSize(*payload_length) +
+      NullEncrypter(Perspective::IS_CLIENT).GetCiphertextSize(*payload_length) +
       QuicPacketCreator::StreamFramePacketOverhead(
           version, PACKET_8BYTE_CONNECTION_ID, include_version, include_path_id,
           include_diversification_nonce, packet_number_length, 0u);
   const size_t ack_length =
-      NullEncrypter().GetCiphertextSize(
-          QuicFramer::GetMinAckFrameSize(version, PACKET_1BYTE_PACKET_NUMBER)) +
+      NullEncrypter(Perspective::IS_CLIENT)
+          .GetCiphertextSize(QuicFramer::GetMinAckFrameSize(
+              version, PACKET_1BYTE_PACKET_NUMBER)) +
       GetPacketHeaderSize(version, connection_id_length, include_version,
                           include_path_id, include_diversification_nonce,
                           packet_number_length);
@@ -794,7 +795,8 @@
     *payload_length = 1 + ack_length - stream_length;
   }
 
-  return NullEncrypter().GetCiphertextSize(*payload_length) +
+  return NullEncrypter(Perspective::IS_CLIENT)
+             .GetCiphertextSize(*payload_length) +
          QuicPacketCreator::StreamFramePacketOverhead(
              version, connection_id_length, include_version, include_path_id,
              include_diversification_nonce, packet_number_length, 0u);

diff --git a/net/quic/test_tools/simulator/actor.cc b/net/quic/test_tools/simulator/actor.cc
index 0fdf26f..2aa8391 100644
--- a/net/quic/test_tools/simulator/actor.cc
+++ b/net/quic/test_tools/simulator/actor.cc

@@ -5,10 +5,12 @@
 #include "net/quic/test_tools/simulator/actor.h"
 #include "net/quic/test_tools/simulator/simulator.h"
 
+using std::string;
+
 namespace net {
 namespace simulator {
 
-Actor::Actor(Simulator* simulator, std::string name)
+Actor::Actor(Simulator* simulator, string name)
     : simulator_(simulator),
       clock_(simulator->GetClock()),
       name_(std::move(name)) {

diff --git a/net/quic/test_tools/simulator/alarm_factory.cc b/net/quic/test_tools/simulator/alarm_factory.cc
index 7c89557..43eb54d 100644
--- a/net/quic/test_tools/simulator/alarm_factory.cc
+++ b/net/quic/test_tools/simulator/alarm_factory.cc

@@ -7,6 +7,7 @@
 #include "net/quic/test_tools/simulator/alarm_factory.h"
 
 using base::StringPrintf;
+using std::string;
 
 namespace net {
 namespace simulator {
@@ -16,7 +17,7 @@
 class Alarm : public QuicAlarm {
  public:
   Alarm(Simulator* simulator,
-        std::string name,
+        string name,
         QuicArenaScopedPtr<QuicAlarm::Delegate> delegate)
       : QuicAlarm(std::move(delegate)), adapter_(simulator, name, this) {}
   ~Alarm() override {}
@@ -34,7 +35,7 @@
   // interfaces.
   class Adapter : public Actor {
    public:
-    Adapter(Simulator* simulator, std::string name, Alarm* parent)
+    Adapter(Simulator* simulator, string name, Alarm* parent)
         : Actor(simulator, name), parent_(parent) {}
     ~Adapter() override {}
 
@@ -52,12 +53,12 @@
   Adapter adapter_;
 };
 
-AlarmFactory::AlarmFactory(Simulator* simulator, std::string name)
+AlarmFactory::AlarmFactory(Simulator* simulator, string name)
     : simulator_(simulator), name_(std::move(name)), counter_(0) {}
 
 AlarmFactory::~AlarmFactory() {}
 
-std::string AlarmFactory::GetNewAlarmName() {
+string AlarmFactory::GetNewAlarmName() {
   ++counter_;
   return StringPrintf("%s (alarm %i)", name_.c_str(), counter_);
 }

diff --git a/net/quic/test_tools/simulator/link.cc b/net/quic/test_tools/simulator/link.cc
index 6104ee5..2ce999e3 100644
--- a/net/quic/test_tools/simulator/link.cc
+++ b/net/quic/test_tools/simulator/link.cc

@@ -2,11 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "base/strings/stringprintf.h"
 #include "net/quic/test_tools/simulator/link.h"
+
+#include "base/strings/stringprintf.h"
 #include "net/quic/test_tools/simulator/simulator.h"
 
 using base::StringPrintf;
+using std::string;
 
 namespace net {
 namespace simulator {
@@ -15,7 +17,7 @@
 const uint64_t kMaxRandomDelayUs = 10;
 
 OneWayLink::OneWayLink(Simulator* simulator,
-                       std::string name,
+                       string name,
                        UnconstrainedPortInterface* sink,
                        QuicBandwidth bandwidth,
                        QuicTime::Delta propagation_delay)
@@ -84,7 +86,7 @@
 }
 
 SymmetricLink::SymmetricLink(Simulator* simulator,
-                             std::string name,
+                             string name,
                              UnconstrainedPortInterface* sink_a,
                              UnconstrainedPortInterface* sink_b,
                              QuicBandwidth bandwidth,

diff --git a/net/quic/test_tools/simulator/packet_filter.cc b/net/quic/test_tools/simulator/packet_filter.cc
index a988d9b..e6f97f0 100644
--- a/net/quic/test_tools/simulator/packet_filter.cc
+++ b/net/quic/test_tools/simulator/packet_filter.cc

@@ -4,12 +4,12 @@
 
 #include "net/quic/test_tools/simulator/packet_filter.h"
 
+using std::string;
+
 namespace net {
 namespace simulator {
 
-PacketFilter::PacketFilter(Simulator* simulator,
-                           std::string name,
-                           Endpoint* input)
+PacketFilter::PacketFilter(Simulator* simulator, string name, Endpoint* input)
     : Endpoint(simulator, name), input_(input) {
   input_->SetTxPort(this);
 }

diff --git a/net/quic/test_tools/simulator/port.cc b/net/quic/test_tools/simulator/port.cc
index 11e4eda..2ae0b9a 100644
--- a/net/quic/test_tools/simulator/port.cc
+++ b/net/quic/test_tools/simulator/port.cc

@@ -4,6 +4,8 @@
 
 #include "net/quic/test_tools/simulator/port.h"
 
+using std::string;
+
 namespace net {
 namespace simulator {
 
@@ -14,7 +16,7 @@
 
 Packet::Packet(const Packet& packet) = default;
 
-Endpoint::Endpoint(Simulator* simulator, std::string name)
+Endpoint::Endpoint(Simulator* simulator, string name)
     : Actor(simulator, name) {}
 
 }  // namespace simulator

diff --git a/net/quic/test_tools/simulator/queue.cc b/net/quic/test_tools/simulator/queue.cc
index 05704430..1c45ab18 100644
--- a/net/quic/test_tools/simulator/queue.cc
+++ b/net/quic/test_tools/simulator/queue.cc

@@ -4,16 +4,19 @@
 
 #include "net/quic/test_tools/simulator/queue.h"
 
+using std::string;
+
 namespace net {
 namespace simulator {
 
 Queue::ListenerInterface::~ListenerInterface() {}
 
-Queue::Queue(Simulator* simulator, std::string name, QuicByteCount capacity)
+Queue::Queue(Simulator* simulator, string name, QuicByteCount capacity)
     : Actor(simulator, name),
       capacity_(capacity),
       bytes_queued_(0),
       listener_(nullptr) {}
+
 Queue::~Queue() {}
 
 void Queue::set_tx_port(ConstrainedPortInterface* port) {

diff --git a/net/quic/test_tools/simulator/quic_endpoint.cc b/net/quic/test_tools/simulator/quic_endpoint.cc
index 2b54eb28..fd482305f 100644
--- a/net/quic/test_tools/simulator/quic_endpoint.cc
+++ b/net/quic/test_tools/simulator/quic_endpoint.cc

@@ -12,6 +12,7 @@
 #include "net/quic/test_tools/simulator/simulator.h"
 
 using base::StringPrintf;
+using std::string;
 
 namespace net {
 namespace simulator {
@@ -21,7 +22,7 @@
 const char kStreamDataContents = 'Q';
 
 // Takes a SHA-1 hash of the name and converts it into five 32-bit integers.
-static std::vector<uint32_t> HashNameIntoFive32BitIntegers(std::string name) {
+static std::vector<uint32_t> HashNameIntoFive32BitIntegers(string name) {
   const std::string hash = base::SHA1HashString(name);
 
   std::vector<uint32_t> output;
@@ -37,14 +38,14 @@
   return output;
 }
 
-QuicSocketAddress GetAddressFromName(std::string name) {
+QuicSocketAddress GetAddressFromName(string name) {
   const std::vector<uint32_t> hash = HashNameIntoFive32BitIntegers(name);
 
   // Generate a random port between 1025 and 65535.
   const uint16_t port = 1025 + hash[0] % (65535 - 1025 + 1);
 
   // Generate a random 10.x.x.x address, where x is between 1 and 254.
-  std::string ip_address({10, 0, 0, 0});
+  string ip_address{"\xa\0\0\0", 4};
   for (size_t i = 1; i < 4; i++) {
     ip_address[i] = 1 + hash[i] % 254;
   }
@@ -54,8 +55,8 @@
 }
 
 QuicEndpoint::QuicEndpoint(Simulator* simulator,
-                           std::string name,
-                           std::string peer_name,
+                           string name,
+                           string peer_name,
                            Perspective perspective,
                            QuicConnectionId connection_id)
     : Endpoint(simulator, name),
@@ -81,8 +82,10 @@
 
   connection_.SetSelfAddress(GetAddressFromName(name));
   connection_.set_visitor(this);
-  connection_.SetEncrypter(ENCRYPTION_FORWARD_SECURE, new NullEncrypter());
-  connection_.SetDecrypter(ENCRYPTION_FORWARD_SECURE, new NullDecrypter());
+  connection_.SetEncrypter(ENCRYPTION_FORWARD_SECURE,
+                           new NullEncrypter(perspective));
+  connection_.SetDecrypter(ENCRYPTION_FORWARD_SECURE,
+                           new NullDecrypter(perspective));
   connection_.SetDefaultEncryptionLevel(ENCRYPTION_FORWARD_SECURE);
 
   // Configure the connection as if it received a handshake.  This is important
@@ -191,7 +194,7 @@
   packet->destination = endpoint_->peer_name_;
   packet->tx_timestamp = endpoint_->clock_->Now();
 
-  packet->contents = std::string(buffer, buf_len);
+  packet->contents = string(buffer, buf_len);
   packet->size = buf_len;
 
   endpoint_->nic_tx_queue_.AcceptPacket(std::move(packet));
@@ -242,7 +245,7 @@
 }
 
 QuicEndpointMultiplexer::QuicEndpointMultiplexer(
-    std::string name,
+    string name,
     std::initializer_list<QuicEndpoint*> endpoints)
     : Endpoint((*endpoints.begin())->simulator(), name) {
   for (QuicEndpoint* endpoint : endpoints) {

diff --git a/net/quic/test_tools/simulator/quic_endpoint_test.cc b/net/quic/test_tools/simulator/quic_endpoint_test.cc
index 5213727b..8204bc59 100644
--- a/net/quic/test_tools/simulator/quic_endpoint_test.cc
+++ b/net/quic/test_tools/simulator/quic_endpoint_test.cc

@@ -10,7 +10,7 @@
 #include "net/quic/test_tools/simulator/simulator.h"
 #include "net/quic/test_tools/simulator/switch.h"
 
-#include "net/test/gtest_util.h"
+#include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 using ::testing::_;

diff --git a/net/quic/test_tools/simulator/simulator_test.cc b/net/quic/test_tools/simulator/simulator_test.cc
index 07f19117..6e16db6f2 100644
--- a/net/quic/test_tools/simulator/simulator_test.cc
+++ b/net/quic/test_tools/simulator/simulator_test.cc

@@ -13,9 +13,10 @@
 #include "net/quic/test_tools/simulator/switch.h"
 #include "net/quic/test_tools/simulator/traffic_policer.h"
 
-#include "net/test/gtest_util.h"
+#include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
+using std::string;
 using testing::_;
 using testing::Return;
 using testing::StrictMock;
@@ -26,7 +27,7 @@
 // A simple counter that increments its value by 1 every specified period.
 class Counter : public Actor {
  public:
-  Counter(Simulator* simulator, std::string name, QuicTime::Delta period)
+  Counter(Simulator* simulator, string name, QuicTime::Delta period)
       : Actor(simulator, name), value_(-1), period_(period) {
     Schedule(clock_->Now());
   }
@@ -84,7 +85,7 @@
     per_destination_packet_counter_.clear();
   }
 
-  QuicPacketCount CountPacketsForDestination(std::string destination) const {
+  QuicPacketCount CountPacketsForDestination(string destination) const {
     auto result_it = per_destination_packet_counter_.find(destination);
     if (result_it == per_destination_packet_counter_.cend()) {
       return 0;
@@ -96,8 +97,7 @@
   QuicByteCount bytes_;
   QuicPacketCount packets_;
 
-  std::unordered_map<std::string, QuicPacketCount>
-      per_destination_packet_counter_;
+  std::unordered_map<string, QuicPacketCount> per_destination_packet_counter_;
 };
 
 // Sends the packet to the specified destination at the uplink rate.  Provides a
@@ -105,9 +105,9 @@
 class LinkSaturator : public Endpoint {
  public:
   LinkSaturator(Simulator* simulator,
-                std::string name,
+                string name,
                 QuicByteCount packet_size,
-                std::string destination)
+                string destination)
       : Endpoint(simulator, name),
         packet_size_(packet_size),
         destination_(std::move(destination)),
@@ -151,7 +151,7 @@
 
  private:
   QuicByteCount packet_size_;
-  std::string destination_;
+  string destination_;
 
   ConstrainedPortInterface* tx_port_;
   CounterPort rx_port_;
@@ -425,7 +425,7 @@
 class AlarmToggler : public Actor {
  public:
   AlarmToggler(Simulator* simulator,
-               std::string name,
+               string name,
                QuicAlarm* alarm,
                QuicTime::Delta interval)
       : Actor(simulator, name),
@@ -571,7 +571,7 @@
 
 class MockPacketFilter : public PacketFilter {
  public:
-  MockPacketFilter(Simulator* simulator, std::string name, Endpoint* endpoint)
+  MockPacketFilter(Simulator* simulator, string name, Endpoint* endpoint)
       : PacketFilter(simulator, name, endpoint) {}
   MOCK_METHOD1(FilterPacket, bool(const Packet&));
 };

diff --git a/net/quic/test_tools/simulator/switch.cc b/net/quic/test_tools/simulator/switch.cc
index 6490274..f8dc00af 100644
--- a/net/quic/test_tools/simulator/switch.cc
+++ b/net/quic/test_tools/simulator/switch.cc

@@ -4,30 +4,32 @@
 
 #include <cinttypes>
 
+#include "base/format_macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/strings/stringprintf.h"
 #include "net/quic/test_tools/simulator/switch.h"
 
 using base::StringPrintf;
+using std::string;
 
 namespace net {
 namespace simulator {
 
 Switch::Switch(Simulator* simulator,
-               std::string name,
+               string name,
                SwitchPortNumber port_count,
                QuicByteCount queue_capacity) {
   for (size_t port_number = 1; port_number <= port_count; port_number++) {
-    ports_.emplace_back(
-        simulator, StringPrintf("%s (port %zu)", name.c_str(), port_number),
-        this, port_number, queue_capacity);
+    ports_.emplace_back(simulator, StringPrintf("%s (port %" PRIuS ")",
+                                                name.c_str(), port_number),
+                        this, port_number, queue_capacity);
   }
 }
 
 Switch::~Switch() {}
 
 Switch::Port::Port(Simulator* simulator,
-                   std::string name,
+                   string name,
                    Switch* parent,
                    SwitchPortNumber port_number,
                    QuicByteCount queue_capacity)

diff --git a/net/quic/test_tools/simulator/traffic_policer.cc b/net/quic/test_tools/simulator/traffic_policer.cc
index 93e1c8d3..5570119 100644
--- a/net/quic/test_tools/simulator/traffic_policer.cc
+++ b/net/quic/test_tools/simulator/traffic_policer.cc

@@ -6,11 +6,13 @@
 
 #include <algorithm>
 
+using std::string;
+
 namespace net {
 namespace simulator {
 
 TrafficPolicer::TrafficPolicer(Simulator* simulator,
-                               std::string name,
+                               string name,
                                QuicByteCount initial_bucket_size,
                                QuicByteCount max_bucket_size,
                                QuicBandwidth target_bandwidth,

diff --git a/net/tools/quic/quic_client_session.h b/net/tools/quic/quic_client_session.h
index c2b4bc4..055fb1c24 100644
--- a/net/tools/quic/quic_client_session.h
+++ b/net/tools/quic/quic_client_session.h

@@ -47,7 +47,7 @@
       const ProofVerifyDetails& verify_details) override;
 
   // Performs a crypto handshake with the server.
-  void CryptoConnect();
+  virtual void CryptoConnect();
 
   // Returns the number of client hello messages that have been sent on the
   // crypto stream. If the handshake has completed then this is one greater

diff --git a/net/tools/quic/quic_client_session_test.cc b/net/tools/quic/quic_client_session_test.cc
index 8e79152..b086a21 100644
--- a/net/tools/quic/quic_client_session_test.cc
+++ b/net/tools/quic/quic_client_session_test.cc

@@ -308,9 +308,10 @@
 
   // Verify that a decryptable packet with bad frames does close the connection.
   QuicConnectionId connection_id = session_->connection()->connection_id();
+  QuicVersionVector versions = {GetParam()};
   std::unique_ptr<QuicEncryptedPacket> packet(ConstructMisFramedEncryptedPacket(
       connection_id, false, false, false, kDefaultPathId, 100, "data",
-      PACKET_8BYTE_CONNECTION_ID, PACKET_6BYTE_PACKET_NUMBER, nullptr,
+      PACKET_8BYTE_CONNECTION_ID, PACKET_6BYTE_PACKET_NUMBER, &versions,
       Perspective::IS_SERVER));
   std::unique_ptr<QuicReceivedPacket> received(
       ConstructReceivedPacket(*packet, QuicTime::Zero()));

diff --git a/net/tools/quic/quic_dispatcher_test.cc b/net/tools/quic/quic_dispatcher_test.cc
index d5fbaeb..6792f18 100644
--- a/net/tools/quic/quic_dispatcher_test.cc
+++ b/net/tools/quic/quic_dispatcher_test.cc

@@ -537,9 +537,12 @@
 }
 
 TEST_F(QuicDispatcherTest, SupportedVersionsChangeInFlight) {
-  DCHECK_EQ(3u, arraysize(kSupportedQuicVersions));
+  static_assert(arraysize(kSupportedQuicVersions) == 4u,
+                "Supported versions out of sync");
   FLAGS_quic_fix_version_manager = true;
+  FLAGS_quic_disable_version_34 = false;
   FLAGS_quic_enable_version_36_v3 = true;
+  FLAGS_quic_enable_version_37 = true;
   QuicSocketAddress client_address(QuicIpAddress::Loopback4(), 1);
   server_address_ = QuicSocketAddress(QuicIpAddress::Any4(), 5);
   QuicConnectionId connection_id = 1;
@@ -602,6 +605,32 @@
   ProcessPacket(client_address, connection_id, true, QUIC_VERSION_35,
                 SerializeCHLO(), PACKET_8BYTE_CONNECTION_ID,
                 PACKET_6BYTE_PACKET_NUMBER, 1);
+
+  // Turn off version 34.
+  FLAGS_quic_disable_version_34 = true;
+  ++connection_id;
+  EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address))
+      .Times(0);
+  ProcessPacket(client_address, connection_id, true, QUIC_VERSION_34,
+                SerializeCHLO(), PACKET_8BYTE_CONNECTION_ID,
+                PACKET_6BYTE_PACKET_NUMBER, 1);
+
+  // Turn on version 34.
+  FLAGS_quic_disable_version_34 = false;
+  ++connection_id;
+  EXPECT_CALL(*dispatcher_, CreateQuicSession(connection_id, client_address))
+      .WillOnce(testing::Return(CreateSession(
+          dispatcher_.get(), config_, connection_id, client_address,
+          &mock_helper_, &mock_alarm_factory_, &crypto_config_,
+          QuicDispatcherPeer::GetCache(dispatcher_.get()), &session1_)));
+  EXPECT_CALL(*reinterpret_cast<MockQuicConnection*>(session1_->connection()),
+              ProcessUdpPacket(_, _, _))
+      .WillOnce(testing::WithArgs<2>(
+          Invoke(CreateFunctor(&QuicDispatcherTest::ValidatePacket,
+                               base::Unretained(this), connection_id))));
+  ProcessPacket(client_address, connection_id, true, QUIC_VERSION_34,
+                SerializeCHLO(), PACKET_8BYTE_CONNECTION_ID,
+                PACKET_6BYTE_PACKET_NUMBER, 1);
 }
 
 // Enables mocking of the handshake-confirmation for stateless rejects.

diff --git a/net/tools/quic/quic_spdy_client_stream.cc b/net/tools/quic/quic_spdy_client_stream.cc
index 6de90df..1274c47 100644
--- a/net/tools/quic/quic_spdy_client_stream.cc
+++ b/net/tools/quic/quic_spdy_client_stream.cc

@@ -28,7 +28,8 @@
       response_code_(0),
       header_bytes_read_(0),
       header_bytes_written_(0),
-      session_(session) {}
+      session_(session),
+      has_preliminary_headers_(false) {}
 
 QuicSpdyClientStream::~QuicSpdyClientStream() {}
 
@@ -63,6 +64,15 @@
     return;
   }
 
+  if (FLAGS_quic_supports_100_continue && response_code_ == 100 &&
+      !has_preliminary_headers_) {
+    // These are preliminary 100 Continue headers, not the actual response
+    // headers.
+    set_headers_decompressed(false);
+    has_preliminary_headers_ = true;
+    preliminary_headers_ = std::move(response_headers_);
+  }
+
   ConsumeHeaderList();
   DVLOG(1) << "headers complete for stream " << id();
 

diff --git a/net/tools/quic/quic_spdy_client_stream.h b/net/tools/quic/quic_spdy_client_stream.h
index d2e58c4..cd3d6346 100644
--- a/net/tools/quic/quic_spdy_client_stream.h
+++ b/net/tools/quic/quic_spdy_client_stream.h

@@ -58,6 +58,8 @@
   // Returns whatever headers have been received for this stream.
   const SpdyHeaderBlock& response_headers() { return response_headers_; }
 
+  const SpdyHeaderBlock& preliminary_headers() { return preliminary_headers_; }
+
   size_t header_bytes_read() const { return header_bytes_read_; }
 
   size_t header_bytes_written() const { return header_bytes_written_; }
@@ -81,6 +83,12 @@
 
   QuicClientSession* session_;
 
+  // These preliminary headers are used for the 100 Continue headers
+  // that may arrive before the response headers when the request has
+  // Expect: 100-continue.
+  bool has_preliminary_headers_;
+  SpdyHeaderBlock preliminary_headers_;
+
   DISALLOW_COPY_AND_ASSIGN(QuicSpdyClientStream);
 };
 

diff --git a/net/tools/quic/quic_spdy_client_stream_test.cc b/net/tools/quic/quic_spdy_client_stream_test.cc
index 2c03945..1c3223f 100644
--- a/net/tools/quic/quic_spdy_client_stream_test.cc
+++ b/net/tools/quic/quic_spdy_client_stream_test.cc

@@ -118,6 +118,34 @@
   EXPECT_EQ(body_, stream_->data());
 }
 
+TEST_F(QuicSpdyClientStreamTest, TestFraming100Continue) {
+  headers_[":status"] = "100";
+  FLAGS_quic_supports_100_continue = true;
+  auto headers = AsHeaderList(headers_);
+  stream_->OnStreamHeaderList(false, headers.uncompressed_header_bytes(),
+                              headers);
+  stream_->OnStreamFrame(
+      QuicStreamFrame(stream_->id(), /*fin=*/false, /*offset=*/0, body_));
+  EXPECT_EQ("100", stream_->preliminary_headers().find(":status")->second);
+  EXPECT_EQ(0u, stream_->response_headers().size());
+  EXPECT_EQ(100, stream_->response_code());
+  EXPECT_EQ("", stream_->data());
+}
+
+TEST_F(QuicSpdyClientStreamTest, TestFraming100ContinueNoFlag) {
+  headers_[":status"] = "100";
+  FLAGS_quic_supports_100_continue = false;
+  auto headers = AsHeaderList(headers_);
+  stream_->OnStreamHeaderList(false, headers.uncompressed_header_bytes(),
+                              headers);
+  stream_->OnStreamFrame(
+      QuicStreamFrame(stream_->id(), /*fin=*/false, /*offset=*/0, body_));
+  EXPECT_EQ(0u, stream_->preliminary_headers().size());
+  EXPECT_EQ("100", stream_->response_headers().find(":status")->second);
+  EXPECT_EQ(100, stream_->response_code());
+  EXPECT_EQ(body_, stream_->data());
+}
+
 TEST_F(QuicSpdyClientStreamTest, TestFramingOnePacket) {
   auto headers = AsHeaderList(headers_);
   stream_->OnStreamHeaderList(false, headers.uncompressed_header_bytes(),

diff --git a/net/tools/quic/test_tools/quic_test_client.cc b/net/tools/quic/test_tools/quic_test_client.cc
index 29f15113..697488c 100644
--- a/net/tools/quic/test_tools/quic_test_client.cc
+++ b/net/tools/quic/test_tools/quic_test_client.cc

@@ -570,6 +570,13 @@
   return &response_headers_;
 }
 
+const SpdyHeaderBlock* QuicTestClient::preliminary_headers() const {
+  if (stream_ != nullptr) {
+    preliminary_headers_ = stream_->preliminary_headers().Clone();
+  }
+  return &preliminary_headers_;
+}
+
 const SpdyHeaderBlock& QuicTestClient::response_trailers() const {
   return response_trailers_;
 }
@@ -616,6 +623,7 @@
   response_headers_complete_ = stream_->headers_decompressed();
   response_headers_ = stream_->response_headers().Clone();
   response_trailers_ = stream_->received_trailers().Clone();
+  preliminary_headers_ = stream_->preliminary_headers().Clone();
   stream_error_ = stream_->stream_error();
   bytes_read_ = stream_->stream_bytes_read() + stream_->header_bytes_read();
   bytes_written_ =

diff --git a/net/tools/quic/test_tools/quic_test_client.h b/net/tools/quic/test_tools/quic_test_client.h
index 5f24d249..10aaecb8 100644
--- a/net/tools/quic/test_tools/quic_test_client.h
+++ b/net/tools/quic/test_tools/quic_test_client.h

@@ -152,6 +152,7 @@
   bool response_complete() const;
   bool response_headers_complete() const;
   const SpdyHeaderBlock* response_headers() const;
+  const SpdyHeaderBlock* preliminary_headers() const;
   int64_t response_size() const;
   int64_t response_body_size() const;
   size_t bytes_read() const;
@@ -310,6 +311,7 @@
   bool response_complete_;
   bool response_headers_complete_;
   mutable SpdyHeaderBlock response_headers_;
+  mutable SpdyHeaderBlock preliminary_headers_;
 
   // Parsed response trailers (if present), copied from the stream in OnClose.
   SpdyHeaderBlock response_trailers_;

diff --git a/ppapi/proxy/video_decoder_resource_unittest.cc b/ppapi/proxy/video_decoder_resource_unittest.cc
index 80c28035..8f80d7a 100644
--- a/ppapi/proxy/video_decoder_resource_unittest.cc
+++ b/ppapi/proxy/video_decoder_resource_unittest.cc

@@ -147,13 +147,15 @@
         &sink(), PpapiHostMsg_VideoDecoder_GetShm::ID, PP_OK, shm_msg_reply);
     sink().AddFilter(&shm_msg_handler);
 
+    std::unique_ptr<base::SharedMemoryHandle> shm_handle;
+    std::unique_ptr<SerializedHandle> serialized_handle;
     base::SharedMemory shm;
     if (expected_shm_msg) {
       shm.CreateAnonymous(kShmSize);
-      base::SharedMemoryHandle shm_handle;
-      shm.ShareToProcess(base::GetCurrentProcessHandle(), &shm_handle);
-      SerializedHandle serialized_handle(shm_handle, kShmSize);
-      shm_msg_handler.set_serialized_handle(&serialized_handle);
+      shm_handle.reset(new base::SharedMemoryHandle());
+      shm.ShareToProcess(base::GetCurrentProcessHandle(), shm_handle.get());
+      serialized_handle.reset(new SerializedHandle(*shm_handle, kShmSize));
+      shm_msg_handler.set_serialized_handle(serialized_handle.get());
     }
 
     memset(decode_buffer_, 0x55, kDecodeBufferSize);

diff --git a/testing/buildbot/chromium.chromiumos.json b/testing/buildbot/chromium.chromiumos.json
index 56dc913..8057a263 100644
--- a/testing/buildbot/chromium.chromiumos.json
+++ b/testing/buildbot/chromium.chromiumos.json

@@ -173,9 +173,6 @@
         "test": "gfx_unittests"
       },
       {
-        "args": [
-          "--ozone-platform=x11"
-        ],
         "swarming": {
           "can_use_on_swarming_builders": true
         },
@@ -185,6 +182,12 @@
         "swarming": {
           "can_use_on_swarming_builders": true
         },
+        "test": "gl_unittests_ozonex"
+      },
+      {
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
         "test": "google_apis_unittests"
       },
       {

diff --git a/testing/buildbot/gn_isolate_map.pyl b/testing/buildbot/gn_isolate_map.pyl
index da15df6d..0c93ee25 100644
--- a/testing/buildbot/gn_isolate_map.pyl
+++ b/testing/buildbot/gn_isolate_map.pyl

@@ -20,7 +20,8 @@
 #  "windowed_test_launcher"
 #  : the test is a gtest-based test that uses the "brave-new-test-launcher"
 #    from //base/test:test_support and needs to run under Xvfb if run on
-#    some platforms (eg. Linux Desktop, X11 CrOS and Ozone CrOS).
+#    an X11-based platform (use_x11=true or use_ozone=true &&
+#    --ozone_platform=x11).
 #  "console_test_launcher"
 #  : the test is a gtest-based test that uses the "brave-new-test-launcher"
 #    from //base/test:test_support but does not need Xvfb.
@@ -449,9 +450,16 @@
   },
   "gl_unittests": {
     "label": "//ui/gl:gl_unittests",
-    "type": "windowed_test_launcher",
+    "type": "raw",
     "args": [],
   },
+  "gl_unittests_ozonex": {
+    "label": "//ui/gl:gl_unittests_ozonex",
+    "label_type": "group",
+    "type": "windowed_test_launcher",
+    "executable": "gl_unittests",
+    "args": ["--ozone-platform=x11"],
+  },
   "gn_all": {
     "label": "//:gn_all",
     "type": "additional_compile_target",

diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index c598ca6c..336cca2 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations

@@ -2422,7 +2422,6 @@
 # crbug.com/664858 virtual/threaded/fast/scroll-behavior/smooth-scroll/scroll-during-selection.html [ Pass Failure ]
 
 crbug.com/664859 virtual/threaded/transitions/opacity-transform-transitions-inside-iframe.html [ Pass Failure ]
-crbug.com/664859 virtual/threaded/transitions/opacity-transition-zindex.html [ Pass Failure ]
 crbug.com/664859 virtual/threaded/transitions/position-background-transition.html [ Pass Failure ]
 crbug.com/664859 virtual/threaded/transitions/transition-end-event-container.html [ Pass Failure ]
 crbug.com/664859 virtual/threaded/transitions/transition-end-event-multiple-02.html [ Pass Failure ]

diff --git a/third_party/WebKit/LayoutTests/css3/motion-path/motion-rotation-overflow-crash.html b/third_party/WebKit/LayoutTests/css3/motion-path/motion-rotation-overflow-crash.html
index 36a4f8766..29587a95 100644
--- a/third_party/WebKit/LayoutTests/css3/motion-path/motion-rotation-overflow-crash.html
+++ b/third_party/WebKit/LayoutTests/css3/motion-path/motion-rotation-overflow-crash.html

@@ -2,7 +2,7 @@
 <script src="../../resources/testharnessreport.js"></script>
 <style>
 body {
-  offset: path("M 2 9223372036854775640 h 112 v 18446744073709551478") 170141183460469231731687303715884105727rad 44px;
+  offset: path("M 2 9223372036854775640 h 112 v 18446744073709551478") 6772159099343311147963407119496477758278323944392504792520726726528445908706753060030057770863072007690525803528990028771578716997626504007399536732362342681220306922677405220428480102113641824539771557937974021684448585322739937495322648385679803197878862537591342648461579499923703493989594208073045976755073456313663842125268129997886257177874866252782866713636942669286588447097343808037614382288341687498451651245152153424054000300383726062592046846049867203248174598084843154rad reverse 44px;
 }
 </style>
 <script>

diff --git a/third_party/WebKit/LayoutTests/fast/forms/form-reset-crash.html b/third_party/WebKit/LayoutTests/fast/forms/form-reset-crash.html
new file mode 100644
index 0000000..b7b18623
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/forms/form-reset-crash.html

@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<body>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<div id="htmlvar00004">
+<input>
+</div>
+<form id="form">
+<output><span id="container-in-output"></span></output>
+</form>
+<script>
+test(() => {
+  document.querySelector('#container-in-output').appendChild(document.querySelector('#htmlvar00004'));
+  document.querySelector('#form').reset();
+}, 'Do not crash by resetting <output>.');
+</script>
+</body>

diff --git a/third_party/WebKit/LayoutTests/fast/forms/radio/radio-group-name-case-expected.txt b/third_party/WebKit/LayoutTests/fast/forms/radio/radio-group-name-case-expected.txt
deleted file mode 100644
index 8704666d..0000000
--- a/third_party/WebKit/LayoutTests/fast/forms/radio/radio-group-name-case-expected.txt
+++ /dev/null

@@ -1,79 +0,0 @@
-CONSOLE WARNING: line 1: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=r and name=R
-CONSOLE WARNING: line 1: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=radio and name=rAdIO
-CONSOLE WARNING: line 1: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=radio and name=RADIO
-CONSOLE WARNING: line 1: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=ñ and name=Ñ
-CONSOLE WARNING: line 1: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=ς and name=σ
-CONSOLE WARNING: line 1: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=ς and name=Σ
-CONSOLE WARNING: line 1: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=i and name=I
-Case shouldn't matter when it comes to radio group names
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-Test 1
-form.elements[0].name = 'r';
-form.elements[1].name = 'r';
-form.elements[2].name = 'R';
-PASS form.elements[0].checked is false
-PASS form.elements[1].checked is false
-PASS form.elements[2].checked is true
-
-Test 2
-form.elements[0].name = 'radio';
-form.elements[1].name = 'rAdIO';
-form.elements[2].name = 'RADIO';
-PASS form.elements[0].checked is false
-PASS form.elements[1].checked is false
-PASS form.elements[2].checked is true
-
-Test 3 (LATIN SMALL LETTER N WITH TILDE / LATIN CAPITAL LETTER N WITH TILDE)
-form.elements[0].name = '\u00F1';
-form.elements[1].name = '\u00F1';
-form.elements[2].name = '\u00D1';
-PASS form.elements[0].checked is false
-PASS form.elements[1].checked is false
-PASS form.elements[2].checked is true
-
-Test 4 (LATIN SMALL LETTER SHARP S / SS)
-form.elements[0].name = '\u00DF';
-form.elements[1].name = '\u00DF';
-form.elements[2].name = 'SS';
-PASS form.elements[0].checked is false
-FAIL form.elements[1].checked should be false. Was true.
-PASS form.elements[2].checked is true
-
-Test 5 (DESERET SMALL LETTER LONG I / DESERET CAPITAL LETTER LONG I)
-form.elements[0].name = '\uD801\uDC28';
-form.elements[1].name = '\uD801\uDC28';
-form.elements[2].name = '\uD801\uDC00';
-PASS form.elements[0].checked is false
-FAIL form.elements[1].checked should be false. Was true.
-PASS form.elements[2].checked is true
-
-Test 6 (GREEK SMALL LETTER FINAL SIGMA / GREEK SMALL LETTER SIGMA / GREEK CAPITAL LETTER SIGMA)
-form.elements[0].name = '\u03C2';
-form.elements[1].name = '\u03C3';
-form.elements[2].name = '\u03A3';
-PASS form.elements[0].checked is false
-PASS form.elements[1].checked is false
-PASS form.elements[2].checked is true
-
-Test 7 (LATIN CAPITAL LETTER I WITH DOT ABOVE)
-form.elements[0].name = '\u0130';
-form.elements[1].name = '\u0069';
-form.elements[2].name = '\u0130';
-PASS form.elements[0].checked is false
-FAIL form.elements[1].checked should be false. Was true.
-PASS form.elements[2].checked is true
-
-Test 8 (LATIN SMALL LETTER DOTLESS I)
-form.elements[0].name = '\u0131';
-form.elements[1].name = '\u0049';
-form.elements[2].name = '\u0131';
-PASS form.elements[0].checked is false
-FAIL form.elements[1].checked should be false. Was true.
-PASS form.elements[2].checked is true
-PASS successfullyParsed is true
-
-TEST COMPLETE
-    

diff --git a/third_party/WebKit/LayoutTests/fast/forms/radio/radio-group-name-case.html b/third_party/WebKit/LayoutTests/fast/forms/radio/radio-group-name-case.html
deleted file mode 100644
index 1ede6c2..0000000
--- a/third_party/WebKit/LayoutTests/fast/forms/radio/radio-group-name-case.html
+++ /dev/null

@@ -1,87 +0,0 @@
-<!DOCTYPE html>
-<body>
-<script src="../../../resources/js-test.js"></script>
-
-<form>
-    <input type=radio>
-    <input type=radio>
-    <input type=radio>
- </form>
- 
- <script>
- description("Case shouldn't matter when it comes to radio group names");
- 
- function checkAllRadioButtonsInOrder() {
-     for (var i = 0; i < form.elements.length; i++)
-        form.elements[i].checked = false;
-     for (var i = 0; i < form.elements.length; i++)
-        form.elements[i].checked = true;
- }
- 
- function testCheckedCorrectness() {
-    var i;
-    for (i = 0; i < (form.elements.length - 1); i++) {
-        shouldBeFalse("form.elements[" + i + "].checked");
-    }
-    shouldBeTrue("form.elements[" + i + "].checked");
- }
- 
- form = document.forms[0];
- 
- debug("Test 1");
- evalAndLog("form.elements[0].name = 'r';");
- evalAndLog("form.elements[1].name = 'r';");
- evalAndLog("form.elements[2].name = 'R';");
- checkAllRadioButtonsInOrder();
- testCheckedCorrectness();
- 
- debug("\nTest 2");
- evalAndLog("form.elements[0].name = 'radio';");
- evalAndLog("form.elements[1].name = 'rAdIO';");
- evalAndLog("form.elements[2].name = 'RADIO';");
- checkAllRadioButtonsInOrder();
- testCheckedCorrectness();
- 
- debug("\nTest 3 (LATIN SMALL LETTER N WITH TILDE / LATIN CAPITAL LETTER N WITH TILDE)");
- evalAndLog("form.elements[0].name = '\\u00F1';");
- evalAndLog("form.elements[1].name = '\\u00F1';");
- evalAndLog("form.elements[2].name = '\\u00D1';");
- checkAllRadioButtonsInOrder();
- testCheckedCorrectness();
- 
- debug("\nTest 4 (LATIN SMALL LETTER SHARP S / SS)");
- evalAndLog("form.elements[0].name = '\\u00DF';");
- evalAndLog("form.elements[1].name = '\\u00DF';");
- evalAndLog("form.elements[2].name = 'SS';")
- checkAllRadioButtonsInOrder();
- testCheckedCorrectness();
- 
- debug("\nTest 5 (DESERET SMALL LETTER LONG I / DESERET CAPITAL LETTER LONG I)");
- evalAndLog("form.elements[0].name = '\\uD801\\uDC28';");
- evalAndLog("form.elements[1].name = '\\uD801\\uDC28';");
- evalAndLog("form.elements[2].name = '\\uD801\\uDC00';");
- checkAllRadioButtonsInOrder();
- testCheckedCorrectness();
- 
- debug("\nTest 6 (GREEK SMALL LETTER FINAL SIGMA / GREEK SMALL LETTER SIGMA / GREEK CAPITAL LETTER SIGMA)");
- evalAndLog("form.elements[0].name = '\\u03C2';");
- evalAndLog("form.elements[1].name = '\\u03C3';");
- evalAndLog("form.elements[2].name = '\\u03A3';");
- checkAllRadioButtonsInOrder();
- testCheckedCorrectness();
- 
- debug("\nTest 7 (LATIN CAPITAL LETTER I WITH DOT ABOVE)");
- evalAndLog("form.elements[0].name = '\\u0130';");
- evalAndLog("form.elements[1].name = '\\u0069';");
- evalAndLog("form.elements[2].name = '\\u0130';");
- checkAllRadioButtonsInOrder();
- testCheckedCorrectness();
- 
- debug("\nTest 8 (LATIN SMALL LETTER DOTLESS I)");
- evalAndLog("form.elements[0].name = '\\u0131';");
- evalAndLog("form.elements[1].name = '\\u0049';");
- evalAndLog("form.elements[2].name = '\\u0131';");
- checkAllRadioButtonsInOrder();
- testCheckedCorrectness();
- </script> 
- </body>
\ No newline at end of file

diff --git a/third_party/WebKit/LayoutTests/fast/performance/longtasktiming.html b/third_party/WebKit/LayoutTests/fast/performance/longtasktiming.html
index df10326..cd5f045 100644
--- a/third_party/WebKit/LayoutTests/fast/performance/longtasktiming.html
+++ b/third_party/WebKit/LayoutTests/fast/performance/longtasktiming.html

@@ -13,8 +13,10 @@
                     "entryType expected to be: longtask");
                 assert_equals(entries[i].name, "same-origin-self",
                     "name expected to be: same-origin-self");
-                assert_greater_than(entries[i].duration, 50000,
+                assert_greater_than(entries[i].duration, 50,
                     "duration expected to be greater than 50ms threshold");
+                assert_equals(entries[i].startTime, Math.floor(entries[i].startTime),
+                    "startTime expected to have 1 miilisecond granularity");
             }
             observer.disconnect();
             t.done();

diff --git a/third_party/WebKit/LayoutTests/imported/wpt/html/browsers/origin/cross-origin-objects/cross-origin-objects-exceptions-expected.txt b/third_party/WebKit/LayoutTests/imported/wpt/html/browsers/origin/cross-origin-objects/cross-origin-objects-exceptions-expected.txt
index 71a6b78..3fe90b6 100644
--- a/third_party/WebKit/LayoutTests/imported/wpt/html/browsers/origin/cross-origin-objects/cross-origin-objects-exceptions-expected.txt
+++ b/third_party/WebKit/LayoutTests/imported/wpt/html/browsers/origin/cross-origin-objects/cross-origin-objects-exceptions-expected.txt

@@ -10,7 +10,7 @@
 FAIL [[Delete]] Should throw on cross-origin objects assert_throws: Can't delete cross-origin indexed property function "function () { delete C[0]; }" did not throw
 FAIL [[DefineOwnProperty]] Should throw for cross-origin objects assert_throws: Can't define cross-origin value property length function "function () { Object.defineProperty(obj, prop, valueDesc); }" did not throw
 FAIL [[Enumerate]] should return an empty iterator assert_unreached: Shouldn't have been able to enumerate stop on cross-origin Window Reached unreachable code
-FAIL [[OwnPropertyKeys]] should return all properties from cross-origin objects assert_array_equals: Object.getOwnPropertyNames() gives the right answer for cross-origin Window lengths differ, expected 862 got 13
+FAIL [[OwnPropertyKeys]] should return all properties from cross-origin objects assert_array_equals: Object.getOwnPropertyNames() gives the right answer for cross-origin Window lengths differ, expected 871 got 13
 PASS A and B jointly observe the same identity for cross-origin Window and Location 
 PASS Cross-origin functions get local Function.prototype 
 FAIL Cross-origin Window accessors get local Function.prototype Cannot read property 'name' of undefined

diff --git a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/the-input-element/radio-expected.txt b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/the-input-element/radio-expected.txt
index 6f3ea616..87e4441 100644
--- a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/the-input-element/radio-expected.txt
+++ b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/the-input-element/radio-expected.txt

@@ -1,11 +1,10 @@
-CONSOLE WARNING: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=groüp2 and name=groÜp2
 This is a testharness.js-based test.
 FAIL click on mutable radio fires click event, then input event, then change event assert_true: change event should fire after input event expected true got false
 PASS click on non-mutable radio doesn't fire the input event 
 PASS click on non-mutable radio doesn't fire the change event 
 PASS canceled activation steps on unchecked radio 
 PASS only one control of a radio button group can have its checkedness set to true 
-PASS radio inputs with name attributes groüp2 and groÜp2 belong to the same radio button group 
+FAIL radio inputs with name attributes groüp2 and groÜp2 belong to the same radio button group assert_false: expected false got true
 PASS changing the name of a radio input element and setting its checkedness to true makes all the other elements' checkedness in the same radio button group be set to false 
 Harness: the test ran to completion.
 

diff --git a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/the-input-element/radio-groupname-case-expected.txt b/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/the-input-element/radio-groupname-case-expected.txt
deleted file mode 100644
index e27aff1..0000000
--- a/third_party/WebKit/LayoutTests/imported/wpt/html/semantics/forms/the-input-element/radio-groupname-case-expected.txt
+++ /dev/null

@@ -1,27 +0,0 @@
-CONSOLE WARNING: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=sImPlE and name=simple
-CONSOLE WARNING: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=sImPlE and name=SIMPLE
-CONSOLE WARNING: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=paSSfield-killroyß and name=passfield-killroyß
-CONSOLE WARNING: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=paSSfield-killroyß and name=PASSFIELD-KILLROYß
-CONSOLE WARNING: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=paSSfield-killroyß and name=paſſfield-killroyß
-CONSOLE WARNING: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=paSSfield-killroyß and name=passfield-Killroyß
-CONSOLE WARNING: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=paßfield-killroyß and name=paẞfield-killroyß
-CONSOLE WARNING: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=paSSfield-killroyß and name=passfield-killroyẞ
-CONSOLE WARNING: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=глупый and name=ГЛУПЫЙ
-CONSOLE WARNING: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=глупый and name=ГЛУПЫЙ
-CONSOLE WARNING: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=åωk and name=ÅΩK
-CONSOLE WARNING: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=åωk and name=Åωk
-CONSOLE WARNING: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=åωk and name=åΩk
-CONSOLE WARNING: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=åωk and name=åωK
-CONSOLE WARNING: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=blⒶh1 and name=blⓐh1
-CONSOLE WARNING: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=tÉdz5アパートFi and name=TÉDZ5アパートFi
-CONSOLE WARNING: Case-insensitive matching for <input type=radio name=...> is deprecated and will be removed in M57, around March 2017. See https://www.chromestatus.com/features/6165799291060224 for more details. Comparing name=ΣΣ and name=σς
-This is a testharness.js-based test.
-FAIL Among names like sImPlE, everything must be checkable at the same time assert_true: sImPlE must be checked expected true got false
-FAIL Among names like paSSfield-killroyß, everything must be checkable at the same time assert_true: paSSfield-killroyß must be checked expected true got false
-FAIL Among names like глупый, everything must be checkable at the same time assert_true: глупый must be checked expected true got false
-FAIL Among names like åωk, everything must be checkable at the same time assert_true: åωk must be checked expected true got false
-FAIL Among names like blah1, everything must be checkable at the same time assert_true: blⒶh1 must be checked expected true got false
-FAIL Among names like tÉdz5アパートFi, everything must be checkable at the same time assert_true: tÉdz5アパートFi must be checked expected true got false
-FAIL Among names like ΣΣ, everything must be checkable at the same time assert_true: ΣΣ must be checked expected true got false
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/platform/mac/transitions/opacity-transition-zindex-expected.png b/third_party/WebKit/LayoutTests/platform/mac/transitions/opacity-transition-zindex-expected.png
deleted file mode 100644
index 503c947c..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/transitions/opacity-transition-zindex-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/mac/virtual/threaded/transitions/opacity-transition-zindex-expected.png b/third_party/WebKit/LayoutTests/platform/mac/virtual/threaded/transitions/opacity-transition-zindex-expected.png
deleted file mode 100644
index 503c947c..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/virtual/threaded/transitions/opacity-transition-zindex-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/transitions/opacity-transition-zindex-expected.png b/third_party/WebKit/LayoutTests/platform/win/transitions/opacity-transition-zindex-expected.png
deleted file mode 100644
index d8d678b..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/transitions/opacity-transition-zindex-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/platform/win/virtual/threaded/transitions/opacity-transition-zindex-expected.png b/third_party/WebKit/LayoutTests/platform/win/virtual/threaded/transitions/opacity-transition-zindex-expected.png
deleted file mode 100644
index d8d678b..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/virtual/threaded/transitions/opacity-transition-zindex-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/transitions/opacity-transition-zindex-expected.png b/third_party/WebKit/LayoutTests/transitions/opacity-transition-zindex-expected.png
new file mode 100644
index 0000000..43c5d9c
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/transitions/opacity-transition-zindex-expected.png
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/transitions/opacity-transition-zindex-expected.txt b/third_party/WebKit/LayoutTests/transitions/opacity-transition-zindex-expected.txt
index 98b699b..575a79e0 100644
--- a/third_party/WebKit/LayoutTests/transitions/opacity-transition-zindex-expected.txt
+++ b/third_party/WebKit/LayoutTests/transitions/opacity-transition-zindex-expected.txt

@@ -2,11 +2,11 @@
   LayoutView at (0,0) size 800x600
 layer at (0,0) size 800x320
   LayoutBlockFlow {HTML} at (0,0) size 800x320
-    LayoutBlockFlow {BODY} at (8,10) size 784x300
-layer at (18,10) size 300x300 transparent layerType: background only
-layer at (168,160) size 100x100
+    LayoutBlockFlow {BODY} at (0,10) size 800x300
+layer at (10,10) size 300x300 transparent layerType: background only
+layer at (160,160) size 100x100
   LayoutBlockFlow (positioned) zI: -1 {DIV} at (150,150) size 100x100 [bgcolor=#FFA500]
-layer at (18,10) size 300x300 transparent layerType: foreground only
+layer at (10,10) size 300x300 transparent layerType: foreground only
   LayoutBlockFlow (relative positioned) {DIV} at (10,0) size 300x300 [bgcolor=#008000]
-layer at (28,20) size 200x200
+layer at (20,20) size 200x200
   LayoutBlockFlow (positioned) {DIV} at (10,10) size 200x200 [bgcolor=#0000FF]

diff --git a/third_party/WebKit/LayoutTests/transitions/opacity-transition-zindex.html b/third_party/WebKit/LayoutTests/transitions/opacity-transition-zindex.html
index 7dafbdd..0e0c9ca 100644
--- a/third_party/WebKit/LayoutTests/transitions/opacity-transition-zindex.html
+++ b/third_party/WebKit/LayoutTests/transitions/opacity-transition-zindex.html

@@ -3,22 +3,22 @@
 <html>
 <head>
   <style>
-    .container {
+    * {
+      margin: 0;
+    }
+    #container {
       position: relative;
       height: 300px;
       width: 300px;
       margin: 10px;
       background-color: green;
+      opacity: 0.5;
       transition-property: opacity;
       transition-timing-function: linear;
       transition-duration: 5s;
     }
-  
-    #first {
-      opacity: 0.5;
-    }
 
-    .box {
+    #box {
       position: absolute;
       left: 10px;
       top: 10px;
@@ -27,7 +27,7 @@
       background-color: blue;
     }
 
-    .indicator {
+    #indicator {
       position: absolute;
       top: 150px;
       left: 150px;
@@ -41,9 +41,14 @@
     if (window.testRunner)
       testRunner.waitUntilDone();
 
+    function waitForCompositor() {
+      var box = document.getElementById('box');
+      return box.animate({transform: ['scale(1)', 'scale(1)']}, 1).ready;
+    }
+
     function runTest()
     {
-      var container = document.getElementById('first');
+      var container = document.getElementById('container');
       container.style.opacity = 1;
       
       // dump the tree in the middle of the transition
@@ -52,7 +57,9 @@
           window.internals.pauseAnimations(2.5);
       }
       if (window.testRunner) {
+        waitForCompositor().then(() => {
           testRunner.notifyDone();
+        });
       }
     }
     // FIXME: this should use runTransitionTest().
@@ -61,9 +68,9 @@
 </head>
 <body>
 
-  <div class="container" id="first">
-    <div class="box"></div>
-    <div class="indicator"></div>
+  <div id="container">
+    <div id="box"></div>
+    <div id="indicator"></div>
   </div>
 
 </body>

diff --git a/third_party/WebKit/LayoutTests/typedcssom/inlinestyle/properties/transform-expected.txt b/third_party/WebKit/LayoutTests/typedcssom/inlinestyle/properties/transform-expected.txt
index c69cea0b..b9af4b0 100644
--- a/third_party/WebKit/LayoutTests/typedcssom/inlinestyle/properties/transform-expected.txt
+++ b/third_party/WebKit/LayoutTests/typedcssom/inlinestyle/properties/transform-expected.txt

@@ -3,6 +3,14 @@
 PASS Setting transform to initial 
 PASS Setting transform to inherit 
 PASS Setting transform to unset 
+PASS Setting transform to CSSTransformValue with value skew(30deg, 0deg) 
+PASS Setting transform to CSSTransformValue with value skew(10rad, 0deg) 
+PASS Setting transform to CSSTransformValue with value skew(2grad, 0deg) 
+PASS Setting transform to CSSTransformValue with value skew(0.2turn, 0deg) 
+PASS Setting transform to CSSTransformValue with value skew(0deg, 30deg) 
+PASS Setting transform to CSSTransformValue with value skew(0deg, 10rad) 
+PASS Setting transform to CSSTransformValue with value skew(0deg, 2grad) 
+PASS Setting transform to CSSTransformValue with value skew(0deg, 0.2turn) 
 PASS Setting transform to CSSTransformValue with value rotate(30deg) 
 PASS Setting transform to CSSTransformValue with value rotate(10rad) 
 PASS Setting transform to CSSTransformValue with value rotate(2grad) 
@@ -24,6 +32,14 @@
 FAIL Getting transform when it is set to initial assert_true: result instanceof CSSKeywordValue: expected true got false
 FAIL Getting transform when it is set to inherit assert_true: result instanceof CSSKeywordValue: expected true got false
 FAIL Getting transform when it is set to unset assert_true: result instanceof CSSKeywordValue: expected true got false
+PASS Getting transform with a CSSTransformValue whose value is skew(30deg, 0deg) 
+PASS Getting transform with a CSSTransformValue whose value is skew(10rad, 0deg) 
+PASS Getting transform with a CSSTransformValue whose value is skew(2grad, 0deg) 
+PASS Getting transform with a CSSTransformValue whose value is skew(0.2turn, 0deg) 
+PASS Getting transform with a CSSTransformValue whose value is skew(0deg, 30deg) 
+PASS Getting transform with a CSSTransformValue whose value is skew(0deg, 10rad) 
+PASS Getting transform with a CSSTransformValue whose value is skew(0deg, 2grad) 
+PASS Getting transform with a CSSTransformValue whose value is skew(0deg, 0.2turn) 
 PASS Getting transform with a CSSTransformValue whose value is rotate(30deg) 
 PASS Getting transform with a CSSTransformValue whose value is rotate(10rad) 
 PASS Getting transform with a CSSTransformValue whose value is rotate(2grad) 
@@ -32,6 +48,18 @@
 PASS Getting transform with a CSSTransformValue whose value is rotate3d(1, 2, 3, 10rad) 
 PASS Getting transform with a CSSTransformValue whose value is rotate3d(1, 2, 3, 2grad) 
 PASS Getting transform with a CSSTransformValue whose value is rotate3d(1, 2, 3, 0.2turn) 
+PASS Getting transform when it is set to "skew(45deg)" via a string 
+PASS Getting transform when it is set to "skew(1rad)" via a string 
+PASS Getting transform when it is set to "skew(6.2grad)" via a string 
+PASS Getting transform when it is set to "skew(0.31turn)" via a string 
+PASS Getting transform when it is set to "skewX(45deg)" via a string 
+PASS Getting transform when it is set to "skewX(1rad)" via a string 
+PASS Getting transform when it is set to "skewX(6.2grad)" via a string 
+PASS Getting transform when it is set to "skewX(0.31turn)" via a string 
+PASS Getting transform when it is set to "skewY(45deg)" via a string 
+PASS Getting transform when it is set to "skewY(1rad)" via a string 
+PASS Getting transform when it is set to "skewY(6.2grad)" via a string 
+PASS Getting transform when it is set to "skewY(0.31turn)" via a string 
 PASS Getting transform when it is set to "rotateX(45deg)" via a string 
 PASS Getting transform when it is set to "rotateX(1rad)" via a string 
 PASS Getting transform when it is set to "rotateX(6.2grad)" via a string 
@@ -52,5 +80,9 @@
 PASS Unhandled case doesn't crash. 
 PASS Getting transform when it has a rotate with a calc angle does not crash 
 PASS Getting transform when it has a rotate3d with a calc angle does not crash 
+PASS Getting transform when it has a skew with a calc angle does not crash 
+PASS Getting transform when it has a 2-argument skew with a calc angle does not crash 
+PASS Getting transform when it has a skewX with a calc angle does not crash 
+PASS Getting transform when it has a skewY with a calc angle does not crash 
 Harness: the test ran to completion.
 

diff --git a/third_party/WebKit/LayoutTests/typedcssom/inlinestyle/properties/transform.html b/third_party/WebKit/LayoutTests/typedcssom/inlinestyle/properties/transform.html
index 5b8b1be..19f5cca 100644
--- a/third_party/WebKit/LayoutTests/typedcssom/inlinestyle/properties/transform.html
+++ b/third_party/WebKit/LayoutTests/typedcssom/inlinestyle/properties/transform.html

@@ -7,6 +7,12 @@
 
 <script>
 
+let zeroAngle = new CSSAngleValue(0, 'deg');
+
+function angleValue(value, unit) {
+  return new CSSAngleValue(value, unit);
+}
+
 function cssTransformWithRotate(angleValue) {
   return new CSSTransformValue([
       new CSSRotation(angleValue)]);
@@ -28,47 +34,73 @@
     // Scales
     // TODO(meade)
     // Skews
-    // TODO(meade)
+    new CSSTransformValue([new CSSSkew(angleValue(30, 'deg'), zeroAngle)]),
+    new CSSTransformValue([new CSSSkew(angleValue(10, 'rad'), zeroAngle)]),
+    new CSSTransformValue([new CSSSkew(angleValue(2, 'grad'), zeroAngle)]),
+    new CSSTransformValue([new CSSSkew(angleValue(0.2, 'turn'), zeroAngle)]),
+    new CSSTransformValue([new CSSSkew(zeroAngle, angleValue(30, 'deg'))]),
+    new CSSTransformValue([new CSSSkew(zeroAngle, angleValue(10, 'rad'))]),
+    new CSSTransformValue([new CSSSkew(zeroAngle, angleValue(2, 'grad'))]),
+    new CSSTransformValue([new CSSSkew(zeroAngle, angleValue(0.2, 'turn'))]),
     // Rotations
-    cssTransformWithRotate(new CSSAngleValue(30, 'deg')),
-    cssTransformWithRotate(new CSSAngleValue(10, 'rad')),
-    cssTransformWithRotate(new CSSAngleValue(2, 'grad')),
-    cssTransformWithRotate(new CSSAngleValue(0.2, 'turn')),
-    cssTransformWithRotate3D(1, 2, 3, new CSSAngleValue(30, 'deg')),
-    cssTransformWithRotate3D(1, 2, 3, new CSSAngleValue(10, 'rad')),
-    cssTransformWithRotate3D(1, 2, 3, new CSSAngleValue(2, 'grad')),
-    cssTransformWithRotate3D(1, 2, 3, new CSSAngleValue(0.2, 'turn')),
+    cssTransformWithRotate(angleValue(30, 'deg')),
+    cssTransformWithRotate(angleValue(10, 'rad')),
+    cssTransformWithRotate(angleValue(2, 'grad')),
+    cssTransformWithRotate(angleValue(0.2, 'turn')),
+    cssTransformWithRotate3D(1, 2, 3, angleValue(30, 'deg')),
+    cssTransformWithRotate3D(1, 2, 3, angleValue(10, 'rad')),
+    cssTransformWithRotate3D(1, 2, 3, angleValue(2, 'grad')),
+    cssTransformWithRotate3D(1, 2, 3, angleValue(0.2, 'turn')),
     // Perspectives
     // TODO(meade)
   ],
   // Values with these strings aren't used in Typed OM, but can also be
   // represented by the specified values.
   validStringMappings: {
+    // Skews
+    'skew(45deg)':
+      new CSSTransformValue([new CSSSkew(angleValue(45, 'deg'), zeroAngle)]),
+    'skew(1rad)':
+      new CSSTransformValue([new CSSSkew(angleValue(1, 'rad'), zeroAngle)]),
+    'skew(6.2grad)':
+      new CSSTransformValue([new CSSSkew(angleValue(6.2, 'grad'), zeroAngle)]),
+    'skew(0.31turn)':
+      new CSSTransformValue([new CSSSkew(angleValue(0.31, 'turn'), zeroAngle)]),
+    'skewX(45deg)':
+      new CSSTransformValue([new CSSSkew(angleValue(45, 'deg'), zeroAngle)]),
+    'skewX(1rad)':
+      new CSSTransformValue([new CSSSkew(angleValue(1, 'rad'), zeroAngle)]),
+    'skewX(6.2grad)':
+      new CSSTransformValue([new CSSSkew(angleValue(6.2, 'grad'), zeroAngle)]),
+    'skewX(0.31turn)':
+      new CSSTransformValue([new CSSSkew(angleValue(0.31, 'turn'), zeroAngle)]),
+    'skewY(45deg)':
+      new CSSTransformValue([new CSSSkew(zeroAngle, angleValue(45, 'deg'))]),
+    'skewY(1rad)':
+      new CSSTransformValue([new CSSSkew(zeroAngle, angleValue(1, 'rad'))]),
+    'skewY(6.2grad)':
+      new CSSTransformValue([new CSSSkew(zeroAngle, angleValue(6.2, 'grad'))]),
+    'skewY(0.31turn)':
+      new CSSTransformValue([new CSSSkew(zeroAngle, angleValue(0.31, 'turn'))]),
     // Rotations
-    'rotateX(45deg)':
-      cssTransformWithRotate3D(1, 0, 0, new CSSAngleValue(45, 'deg')),
-    'rotateX(1rad)':
-      cssTransformWithRotate3D(1, 0, 0, new CSSAngleValue(1, 'rad')),
+    'rotateX(45deg)': cssTransformWithRotate3D(1, 0, 0, angleValue(45, 'deg')),
+    'rotateX(1rad)': cssTransformWithRotate3D(1, 0, 0, angleValue(1, 'rad')),
     'rotateX(6.2grad)':
-      cssTransformWithRotate3D(1, 0, 0, new CSSAngleValue(6.2, 'grad')),
+      cssTransformWithRotate3D(1, 0, 0, angleValue(6.2, 'grad')),
     'rotateX(0.31turn)':
-      cssTransformWithRotate3D(1, 0, 0, new CSSAngleValue(0.31, 'turn')),
-    'rotateY(45deg)':
-      cssTransformWithRotate3D(0, 1, 0, new CSSAngleValue(45, 'deg')),
-    'rotateY(1rad)':
-      cssTransformWithRotate3D(0, 1, 0, new CSSAngleValue(1, 'rad')),
+      cssTransformWithRotate3D(1, 0, 0, angleValue(0.31, 'turn')),
+    'rotateY(45deg)': cssTransformWithRotate3D(0, 1, 0, angleValue(45, 'deg')),
+    'rotateY(1rad)': cssTransformWithRotate3D(0, 1, 0, angleValue(1, 'rad')),
     'rotateY(6.2grad)':
-      cssTransformWithRotate3D(0, 1, 0, new CSSAngleValue(6.2, 'grad')),
+      cssTransformWithRotate3D(0, 1, 0, angleValue(6.2, 'grad')),
     'rotateY(0.31turn)':
-      cssTransformWithRotate3D(0, 1, 0, new CSSAngleValue(0.31, 'turn')),
-    'rotateZ(45deg)':
-      cssTransformWithRotate3D(0, 0, 1, new CSSAngleValue(45, 'deg')),
-    'rotateZ(1rad)':
-      cssTransformWithRotate3D(0, 0, 1, new CSSAngleValue(1, 'rad')),
+      cssTransformWithRotate3D(0, 1, 0, angleValue(0.31, 'turn')),
+    'rotateZ(45deg)': cssTransformWithRotate3D(0, 0, 1, angleValue(45, 'deg')),
+    'rotateZ(1rad)': cssTransformWithRotate3D(0, 0, 1, angleValue(1, 'rad')),
     'rotateZ(6.2grad)':
-      cssTransformWithRotate3D(0, 0, 1, new CSSAngleValue(6.2, 'grad')),
+      cssTransformWithRotate3D(0, 0, 1, angleValue(6.2, 'grad')),
     'rotateZ(0.31turn)':
-      cssTransformWithRotate3D(0, 0, 1, new CSSAngleValue(0.31, 'turn')),
+      cssTransformWithRotate3D(0, 0, 1, angleValue(0.31, 'turn')),
   },
   supportsMultiple: false,
   invalidObjects: [new CSSSimpleLength(4, 'px')]
@@ -96,5 +128,38 @@
   assert_equals(result.cssText, 'rotate3d(1, 2, 3, calc(102.296deg))');
 }, 'Getting transform when it has a rotate3d with a calc angle does not crash');
 
-</script>
+test(function() {
+  testElement.style.transform = 'skew(calc(5deg + 0.1rad))';
+  let result = testElement.styleMap.get('transform');
+  assert_equals(result.cssText, 'skew(calc(10.7296deg))');
+  assert_equals(result.constructor,  CSSStyleValue);
+}, 'Getting transform when it has a skew with a calc angle does not crash');
 
+test(function() {
+  testElement.style.transform = 'skew(calc(5deg + 0.1rad), 5deg)';
+  let result = testElement.styleMap.get('transform');
+  assert_equals(result.cssText, 'skew(calc(10.7296deg), 5deg)');
+  assert_equals(result.constructor,  CSSStyleValue);
+
+  testElement.style.transform = 'skew(5deg, calc(5deg + 0.1rad))';
+  result = testElement.styleMap.get('transform');
+  assert_equals(result.cssText, 'skew(5deg, calc(10.7296deg))');
+  assert_equals(result.constructor,  CSSStyleValue);
+}, 'Getting transform when it has a 2-argument skew with a calc angle ' +
+   'does not crash');
+
+test(function() {
+  testElement.style.transform = 'skewX(calc(5deg + 0.1rad))';
+  let result = testElement.styleMap.get('transform');
+  assert_equals(result.cssText, 'skewX(calc(10.7296deg))');
+  assert_equals(result.constructor,  CSSStyleValue);
+}, 'Getting transform when it has a skewX with a calc angle does not crash');
+
+test(function() {
+  testElement.style.transform = 'skewY(calc(5deg + 0.1rad))';
+  let result = testElement.styleMap.get('transform');
+  assert_equals(result.cssText, 'skewY(calc(10.7296deg))');
+  assert_equals(result.constructor,  CSSStyleValue);
+}, 'Getting transform when it has a skewY with a calc angle does not crash');
+
+</script>

diff --git a/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt b/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt
index af899f8..977236a 100644
--- a/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt
+++ b/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt

@@ -1890,20 +1890,35 @@
     getter axes
     getter buttons
     getter connected
+    getter displayId
+    getter hand
     getter id
     getter index
     getter mapping
+    getter pose
     getter timestamp
     method constructor
 interface GamepadButton
     attribute @@toStringTag
     getter pressed
+    getter touched
     getter value
     method constructor
 interface GamepadEvent : Event
     attribute @@toStringTag
     getter gamepad
     method constructor
+interface GamepadPose
+    attribute @@toStringTag
+    getter angularAcceleration
+    getter angularVelocity
+    getter hasOrientation
+    getter hasPosition
+    getter linearAcceleration
+    getter linearVelocity
+    getter orientation
+    getter position
+    method constructor
 interface Gyroscope : Sensor
     attribute @@toStringTag
     getter reading
@@ -4212,6 +4227,7 @@
     method getGamepads
     method getInstalledRelatedApps
     method getUserMedia
+    method getVRDisplays
     method isProtocolHandlerRegistered
     method javaEnabled
     method registerProtocolHandler
@@ -6803,6 +6819,84 @@
     getter bytesWritten
     getter status
     method constructor
+interface VRDisplay : EventTarget
+    attribute @@toStringTag
+    getter capabilities
+    getter depthFar
+    getter depthNear
+    getter displayId
+    getter displayName
+    getter isConnected
+    getter isPresenting
+    getter stageParameters
+    method cancelAnimationFrame
+    method constructor
+    method exitPresent
+    method getEyeParameters
+    method getFrameData
+    method getLayers
+    method getPose
+    method requestAnimationFrame
+    method requestPresent
+    method resetPose
+    method submitFrame
+    setter depthFar
+    setter depthNear
+interface VRDisplayCapabilities
+    attribute @@toStringTag
+    getter canPresent
+    getter hasExternalDisplay
+    getter hasOrientation
+    getter hasPosition
+    getter maxLayers
+    method constructor
+interface VRDisplayEvent : Event
+    attribute @@toStringTag
+    getter display
+    getter reason
+    method constructor
+interface VREyeParameters
+    attribute @@toStringTag
+    getter fieldOfView
+    getter offset
+    getter renderHeight
+    getter renderWidth
+    method constructor
+interface VRFieldOfView
+    attribute @@toStringTag
+    getter downDegrees
+    getter leftDegrees
+    getter rightDegrees
+    getter upDegrees
+    method constructor
+    setter downDegrees
+    setter leftDegrees
+    setter rightDegrees
+    setter upDegrees
+interface VRFrameData
+    attribute @@toStringTag
+    getter leftProjectionMatrix
+    getter leftViewMatrix
+    getter pose
+    getter rightProjectionMatrix
+    getter rightViewMatrix
+    getter timestamp
+    method constructor
+interface VRPose
+    attribute @@toStringTag
+    getter angularAcceleration
+    getter angularVelocity
+    getter linearAcceleration
+    getter linearVelocity
+    getter orientation
+    getter position
+    method constructor
+interface VRStageParameters
+    attribute @@toStringTag
+    getter sittingToStandingTransform
+    getter sizeX
+    getter sizeZ
+    method constructor
 interface VTTCue : TextTrackCue
     attribute @@toStringTag
     getter align

diff --git a/third_party/WebKit/ManualTests/vr/webvr-manual-tests.txt b/third_party/WebKit/ManualTests/vr/webvr-manual-tests.txt
new file mode 100644
index 0000000..6fbc887e
--- /dev/null
+++ b/third_party/WebKit/ManualTests/vr/webvr-manual-tests.txt

@@ -0,0 +1,170 @@
+This is a copy of the manual test cases being run on Chrome's native WebVR
+implementation as of December 20th 2016. The most up-to-date version can be
+found in this doc:
+https://docs.google.com/a/google.com/document/d/1gMB0idLG3jYFc7GTB8pwh9dJkvDKgMEjQ5P6gMr1HSk/edit?usp=sharing
+Currently, these are run on Pixel and Pixel XL devices running Nougat.
+
+
+Setup
+* Install the Chrome Canary build
+* Unless the test case explicitly says to enable it, ensure that WebVR is disabled in chrome://flags
+* Run the following commands while the test device is attached to a workstation
+   * adb root
+   * adb shell “rm /data/local/tmp/chrome-command-line”
+   * adb shell “rm /data/local/chrome-command-line”
+
+
+Functionality Testing
+1. All supported Android phones can enter presentation mode and trigger DON flow
+   1. Access https://toji.github.io/webvr-samples/03-vr-presentation.html?polyfill=0 on the test device
+   2. Select the “Enter VR” button
+   3. Ensure that a message comes up asking you to insert the device into your headset
+   4. Insert the device into the headset
+   5. Ensure that a message comes up asking you to hold down the home button on your controller
+   6. Hold down the home button on your controller
+   7. Ensure that the WebVR content is now rendered in a binocular view
+
+2. All supported Android phones can properly exit presentation mode
+   1. Access https://toji.github.io/webvr-samples/03-vr-presentation.html?polyfill=0 on the test device
+   2. Select the “Enter VR” button
+   3. If asked to insert the phone into the Daydream headset, do so
+   4. If asked to hold the home button on the Daydream controller, do so
+   5. Select the “cross” in the upper left corner and ensure that WebVR stops presenting
+   6. Select the “Enter VR” button
+   7. If asked to insert the phone into the Daydream headset, do so
+   8. If asked to hold the home button on the Daydream controller, do so
+   9. Drag down from the top of the screen and select Android’s back button, then ensure that WebVR stops presenting
+
+3. 360 images are displayed correctly when using WebVR
+   1. Access https://toji.github.io/webvr-samples/XX-360-panorama.html?polyfill=0 on the test device
+   2. Verify that the “magic window” viewer adjusts with device movement and displays the 360 image properly in all directions (360 degrees horizontally and vertically). Ensure that there are no visual bugs such as missing sections of the photo.
+   3. Select the “Enter VR” button
+   4. If asked to insert the phone into the Daydream headset, do so
+   5. If asked to hold the home button on the Daydream controller, do so
+   6. Optional: Insert the test device into a VR viewer
+   7. Verify that the binocular view adjusts with device movement and displays the 360 image properly in all directions (360 degrees horizontally and vertically).
+
+4. WebVR output is compatible with VR viewers on supported Android devices
+   1. Access https://toji.github.io/webvr-samples/03-vr-presentation.html?polyfill=0 on the test device
+   2. Select the “Enter VR” button
+   3. If asked to insert the phone into the Daydream headset, do so
+   4. If asked to hold the home button on the Daydream controller, do so
+   5. Ensure that the content is viewable through the VR viewer and that the image wraps around the user.
+
+5. WebVR supports VR/positional audio
+   1. Access https://toji.github.io/webvr-samples/06-vr-audio.html?polyfill=0 on the test device
+   2. Attach headphones to the test device
+   3. Select the “Start Sound” button
+   4. Ensure that guitar, drums, and percussion can all be heard
+   5. Verify that the different sounds come from different colored cubes
+      1. Green: Percussion
+      2. Blue: Drums
+      3. Red: Guitar
+   6. Verify that the relative position of the cubes affects the perceived location of the audio sources when the test device’s position is changed
+   7. Select the “Enter VR” button
+   8. If asked to insert the phone into the Daydream headset, do so
+   9. If asked to hold the home button on the Daydream controller, do so
+   10. Repeat steps 5 and 6
+
+6. All supported Android phones reported as VR displays
+   1. Access https://toji.github.io/webvr-samples/00-hello-webvr.html?polyfill=0 on the test device
+   2. Ensure that a single VR display is listed
+
+7. All supported Android phones report correct capabilities and status
+   1. Access https://toji.github.io/webvr-samples/00-hello-webvr.html?polyfill=0 on the test device
+   2. Ensure that these top level bullets match
+      1. isConnected: true
+      2. isPresenting: false
+   3. Under the “capabilities” bullet, ensure that the following points match
+      1. hasPosition: false
+      2. hasOrientation: true
+      3. hasExternalDisplay: false
+      4. canPresent: true
+
+8. Accessing an http site (as opposed to https) in presentation mode displays a warning to the user that the site is not secure
+   1. Enable the WebVR flag in chrome://flags
+   2. Access http://media.tojicode.com/q3bsp/ on the test device
+   3. Select the VR button
+   4. If asked to insert the phone into the Daydream headset, do so
+   5. If asked to hold the home button on the Daydream controller, do so
+   6. Ensure that a warning is displayed in the center of the user’s view.
+   7. Disable the WebVR flag in chrome://flags
+
+9. Resetting pose functions correctly
+   1. In magic window mode:
+      1. Access https://toji.github.io/webvr-samples/03-vr-presentation.html?polyfill=0 on the test device
+      2. Rotate the device vertically until it is completely vertical (i.e. the screen is directly in front of the user and not rotated)
+      3. Turn the test device right or left until the FPS display is no longer in view, approximately 90 degrees
+      4. Select the “Reset Pose” button
+      5. Verify that the content’s view has been updated so that the FPS display is now centered
+      6. Turn the test device right or left until the FPS display is no longer in view, then rotate the device upwards approximately 30 degrees
+      7. Select the “Reset Pose” button
+      8. Verify that the FPS display is not immediately visible
+      9. Rotate the device downwards until it is completely vertical again
+      10. Verify that the FPS display is now visible and centered
+   2. On Daydream devices:
+      1. Access https://toji.github.io/webvr-samples/03-vr-presentation.html?polyfill=0 on the test device
+      2. Select the “Enter VR” button
+      3. If asked to insert the phone into the Daydream headset, do so
+      4. If asked to hold the home button on the Daydream controller, do so
+      5. Rotate the device vertically until it is completely vertical (i.e. the screen is directly in front of the user and not rotated)
+      6. Turn the test device right or left until the FPS display is no longer in view, approximately 90 degrees
+      7. Hold down the home button on the Daydream controller for 2 seconds
+      8. Verify that the content’s view has been updated so that the FPS display is now centered
+      9. Turn the test device right or left until the FPS display is no longer in view, then rotate the device upwards approximately 30 degrees
+      10. Hold down the home button on the Daydream controller for 2 seconds
+      11. Verify that the FPS display is not immediately visible
+      12. Rotate the device downwards until it is completely vertical again
+      13. Verify that the FPS display is now visible and centered
+
+10. WebVR origin trial function is disabled for non-whitelisted vr websites
+   1. Make sure WebVR flag is disabled
+   2. Go to https://threejs.org/examples/webvr_cubes.html
+   3. Verify that WebVR is not enabled for this website, you will see the warning message: “Your browser does not support WebVR. See webvr.info for assistance.”
+   4. Enable WebVR flag
+   5. Go to https://threejs.org/examples/webvr_cubes.html again
+   6. Verify that warning message disappears
+
+11. Inserting device into headset when on a page with WebVR content automatically presents (Only supported on Pixel/Pixel XL)
+   1. Access https://webvr.info/samples/03-vr-presentation.html on the test device
+   2. Insert the device into a Daydream headset
+   3. If asked to hold the home button on the Daydream controller, do so
+   4. Ensure that the device is now presenting the WebVR content
+
+12. Magic window and Daydream clicks register in WebVR content
+   1. Access https://webvr.info/samples/03-vr-presentation.html on the test device
+   2. Tap the screen and ensure that the background changes color
+   3. Select the “Enter VR” button
+   4. If asked to insert the phone into the Daydream headset, do so
+   5. If asked to hold the home button on the Daydream controller, do so
+   6. Click the trackpad button on the Daydream controller
+   7. Ensure that the background changes color
+
+13. Presentation fails if the DON flow is canceled
+   1. Access https://webvr.info/samples/03-vr-presentation.html on the test device
+   2. Select the “Enter VR” button
+   3. Do not insert the phone into the Daydream headset. Hold the phone vertically in landscape mode. If still asked to insert the device into the headset, double tap the screen, which should skip the screen
+   4. When asked to hold down the controller button, press the system back button
+   5. Ensure that you are returned to the WebVR content in magic window mode and that a “requestPresent failed” error is displayed.
+
+14. Test case to verify webvr will not crash webview
+   1. Download webview test shell app or build it with the system_webview_shell_apk target
+   2. Run the following adb command to install it
+      adb install -r SystemWebViewShell.apk
+   3. Make sure that Chrome Canary is selected as the WebView implementation under System Settings > Developer Options > WebView implementation
+   4. Open ‘WebView Browser Tester’, and make sure the webview version is the expected one (same version number as Canary).
+   5. Open https://webvr.info/samples/03-vr-presentation.html in ‘WebView Browser Tester’
+   6. Ensure it shows the following error message
+      “ERROR: Your browser does not support WebVR. See webvr.info for assistance.”
+
+15. Attempting to present without completing Daydream setup redirects user to setup
+   1. Go to Settings > Apps > Google VR Services
+   2. Select “Disable”, confirm that you want to disable it, and when asked if you want to reset the app to the factory version, confirm that you do
+   3. Go to ‘Play Store’ and update VR Services to the latest version
+   4. Install ‘Chrome canary’ from play store
+   5. Open ‘Chrome canary’ and update ‘Play service’ if needed
+   6. Open ‘https://webvr.info/samples/03-vr-presentation.html’ in Canary
+   7. Tap “Enter VR” button, or insert device into headset
+   8. It should automatically redirect to setup flow
+   9. Follow the setup flow to set up daydream
+   10. Reopen https://webvr.info/samples/03-vr-presentation.html in Canary again and make sure it works

diff --git a/third_party/WebKit/Source/bindings/bindings.gni b/third_party/WebKit/Source/bindings/bindings.gni
index bca6a68..575564d3 100644
--- a/third_party/WebKit/Source/bindings/bindings.gni
+++ b/third_party/WebKit/Source/bindings/bindings.gni

@@ -39,6 +39,7 @@
                     "core/v8/BindingSecurity.cpp",
                     "core/v8/BindingSecurity.h",
                     "core/v8/CallbackPromiseAdapter.h",
+                    "core/v8/CompiledScript.h",
                     "core/v8/ConditionalFeatures.cpp",
                     "core/v8/ConditionalFeatures.h",
                     "core/v8/V0CustomElementBinding.cpp",
@@ -225,6 +226,7 @@
 bindings_unittest_files =
     get_path_info([
                     "core/v8/DocumentWriteEvaluatorTest.cpp",
+                    "core/v8/ScriptControllerTest.cpp",
                     "core/v8/ScriptPromisePropertyTest.cpp",
                     "core/v8/ScriptPromiseResolverTest.cpp",
                     "core/v8/ScriptPromiseTest.cpp",

diff --git a/third_party/WebKit/Source/bindings/core/v8/CompiledScript.h b/third_party/WebKit/Source/bindings/core/v8/CompiledScript.h
new file mode 100644
index 0000000..7a05fb5b
--- /dev/null
+++ b/third_party/WebKit/Source/bindings/core/v8/CompiledScript.h

@@ -0,0 +1,49 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CompiledScript_h
+#define CompiledScript_h
+
+#include "bindings/core/v8/ScriptSourceCode.h"
+#include "platform/heap/GarbageCollected.h"
+#include "wtf/Assertions.h"
+#include "wtf/text/TextPosition.h"
+
+#include <v8.h>
+
+namespace blink {
+
+// This wraps a global handle on a V8 object (the compiled script).
+// Because that script may contain further references to other objects, do not
+// keep long-lasting references to this object, as they may induce cycles
+// between V8 and Oilpan.
+class CompiledScript : public GarbageCollectedFinalized<CompiledScript> {
+ public:
+  CompiledScript(v8::Isolate* isolate,
+                 v8::Local<v8::Script> script,
+                 const ScriptSourceCode& sourceCode)
+      : m_sourceCode(sourceCode), m_script(isolate, script) {
+    DCHECK(!script.IsEmpty());
+  }
+
+  v8::Local<v8::Script> script(v8::Isolate* isolate) const {
+    return m_script.Get(isolate);
+  }
+
+  const ScriptSourceCode& sourceCode() const { return m_sourceCode; }
+  const KURL& url() const { return m_sourceCode.url(); }
+  const TextPosition& startPosition() const {
+    return m_sourceCode.startPosition();
+  }
+
+  DEFINE_INLINE_TRACE() { visitor->trace(m_sourceCode); }
+
+ private:
+  ScriptSourceCode m_sourceCode;
+  v8::Global<v8::Script> m_script;
+};
+
+}  // namespace blink
+
+#endif  // CompiledScript_h

diff --git a/third_party/WebKit/Source/bindings/core/v8/DocumentWriteEvaluator.cpp b/third_party/WebKit/Source/bindings/core/v8/DocumentWriteEvaluator.cpp
index e31698b..826a04f 100644
--- a/third_party/WebKit/Source/bindings/core/v8/DocumentWriteEvaluator.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/DocumentWriteEvaluator.cpp

@@ -9,7 +9,7 @@
 #include "bindings/core/v8/V8ScriptRunner.h"
 #include "core/frame/Location.h"
 #include "core/html/parser/HTMLParserThread.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "wtf/text/StringUTF8Adaptor.h"
 
 #include <v8.h>

diff --git a/third_party/WebKit/Source/bindings/core/v8/ScheduledAction.cpp b/third_party/WebKit/Source/bindings/core/v8/ScheduledAction.cpp
index aace7e2..a6f0b9e 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScheduledAction.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/ScheduledAction.cpp

@@ -41,7 +41,7 @@
 #include "core/frame/LocalFrame.h"
 #include "core/workers/WorkerGlobalScope.h"
 #include "core/workers/WorkerThread.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp b/third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp
index f6d5d75..01e4852 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp

@@ -32,6 +32,7 @@
 
 #include "bindings/core/v8/ScriptController.h"
 
+#include "bindings/core/v8/CompiledScript.h"
 #include "bindings/core/v8/ScriptSourceCode.h"
 #include "bindings/core/v8/ScriptValue.h"
 #include "bindings/core/v8/V8Binding.h"
@@ -65,7 +66,7 @@
 #include "platform/Histogram.h"
 #include "platform/UserGestureIndicator.h"
 #include "platform/Widget.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "public/platform/Platform.h"
 #include "wtf/CurrentTime.h"
@@ -93,6 +94,32 @@
   m_windowProxyManager->updateSecurityOrigin(securityOrigin);
 }
 
+namespace {
+
+V8CacheOptions cacheOptions(const ScriptResource* resource,
+                            const Settings* settings) {
+  V8CacheOptions v8CacheOptions(V8CacheOptionsDefault);
+  if (settings)
+    v8CacheOptions = settings->v8CacheOptions();
+  if (resource && !resource->response().cacheStorageCacheName().isNull()) {
+    switch (settings->v8CacheStrategiesForCacheStorage()) {
+      case V8CacheStrategiesForCacheStorage::None:
+        v8CacheOptions = V8CacheOptionsNone;
+        break;
+      case V8CacheStrategiesForCacheStorage::Normal:
+        v8CacheOptions = V8CacheOptionsCode;
+        break;
+      case V8CacheStrategiesForCacheStorage::Default:
+      case V8CacheStrategiesForCacheStorage::Aggressive:
+        v8CacheOptions = V8CacheOptionsAlways;
+        break;
+    }
+  }
+  return v8CacheOptions;
+}
+
+}  // namespace
+
 v8::Local<v8::Value> ScriptController::executeScriptAndReturnValue(
     v8::Local<v8::Context> context,
     const ScriptSourceCode& source,
@@ -105,24 +132,8 @@
 
   v8::Local<v8::Value> result;
   {
-    V8CacheOptions v8CacheOptions(V8CacheOptionsDefault);
-    if (frame()->settings())
-      v8CacheOptions = frame()->settings()->v8CacheOptions();
-    if (source.resource() &&
-        !source.resource()->response().cacheStorageCacheName().isNull()) {
-      switch (frame()->settings()->v8CacheStrategiesForCacheStorage()) {
-        case V8CacheStrategiesForCacheStorage::None:
-          v8CacheOptions = V8CacheOptionsNone;
-          break;
-        case V8CacheStrategiesForCacheStorage::Normal:
-          v8CacheOptions = V8CacheOptionsCode;
-          break;
-        case V8CacheStrategiesForCacheStorage::Default:
-        case V8CacheStrategiesForCacheStorage::Aggressive:
-          v8CacheOptions = V8CacheOptionsAlways;
-          break;
-      }
-    }
+    V8CacheOptions v8CacheOptions =
+        cacheOptions(source.resource(), frame()->settings());
 
     // Isolate exceptions that occur when compiling and executing
     // the code. These exceptions should not interfere with
@@ -150,6 +161,54 @@
   return result;
 }
 
+CompiledScript* ScriptController::compileScriptInMainWorld(
+    const ScriptSourceCode& source,
+    AccessControlStatus accessControlStatus) {
+  V8CacheOptions v8CacheOptions =
+      cacheOptions(source.resource(), frame()->settings());
+
+  v8::HandleScope handleScope(isolate());
+  v8::TryCatch tryCatch(isolate());
+  tryCatch.SetVerbose(true);
+
+  v8::Local<v8::Script> script;
+  if (!v8Call(V8ScriptRunner::compileScript(
+                  source, isolate(), accessControlStatus, v8CacheOptions),
+              script, tryCatch)) {
+    return nullptr;
+  }
+
+  TRACE_EVENT_INSTANT1(TRACE_DISABLED_BY_DEFAULT("devtools.timeline"),
+                       "UpdateCounters", TRACE_EVENT_SCOPE_THREAD, "data",
+                       InspectorUpdateCountersEvent::data());
+  return new CompiledScript(isolate(), script, source);
+}
+
+void ScriptController::executeScriptInMainWorld(
+    const CompiledScript& compiledScript) {
+  TRACE_EVENT1("devtools.timeline", "EvaluateScript", "data",
+               InspectorEvaluateScriptEvent::data(
+                   frame(), compiledScript.url().getString(),
+                   compiledScript.startPosition()));
+  InspectorInstrumentation::NativeBreakpoint nativeBreakpoint(
+      frame()->document(), "scriptFirstStatement", false);
+
+  v8::HandleScope handleScope(isolate());
+  v8::TryCatch tryCatch(isolate());
+  tryCatch.SetVerbose(true);
+
+  v8::Local<v8::Value> result;
+  if (!v8Call(
+          V8ScriptRunner::runCompiledScript(
+              isolate(), compiledScript.script(isolate()), frame()->document()),
+          result, tryCatch))
+    return;
+
+  TRACE_EVENT_INSTANT1(TRACE_DISABLED_BY_DEFAULT("devtools.timeline"),
+                       "UpdateCounters", TRACE_EVENT_SCOPE_THREAD, "data",
+                       InspectorUpdateCountersEvent::data());
+}
+
 bool ScriptController::initializeMainWorld() {
   if (m_windowProxyManager->mainWorldProxy()->isContextInitialized())
     return false;

diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptController.h b/third_party/WebKit/Source/bindings/core/v8/ScriptController.h
index 425a2083..991ac7c 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptController.h
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptController.h

@@ -46,6 +46,7 @@
 
 namespace blink {
 
+class CompiledScript;
 class DOMWrapperWorld;
 class Element;
 class HTMLDocument;
@@ -96,6 +97,12 @@
       const ScriptSourceCode&,
       AccessControlStatus = NotSharableCrossOrigin);
 
+  // The same, but separated into two phases.
+  // compileScriptInMainWorld may return nullptr.
+  CompiledScript* compileScriptInMainWorld(const ScriptSourceCode&,
+                                           AccessControlStatus);
+  void executeScriptInMainWorld(const CompiledScript&);
+
   // Executes JavaScript in an isolated world. The script gets its own global
   // scope, its own prototypes for intrinsic JavaScript objects (String, Array,
   // and so-on), and its own wrappers for all DOM nodes and DOM constructors.

diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptControllerTest.cpp b/third_party/WebKit/Source/bindings/core/v8/ScriptControllerTest.cpp
new file mode 100644
index 0000000..850f86e
--- /dev/null
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptControllerTest.cpp

@@ -0,0 +1,40 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "bindings/core/v8/ScriptController.h"
+
+#include "bindings/core/v8/ScriptSourceCode.h"
+#include "bindings/core/v8/V8BindingForTesting.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace blink {
+namespace {
+
+TEST(ScriptControllerTest, CompileAndExecuteScriptInMainWorld) {
+  V8TestingScope scope;
+  ScriptController& script = scope.frame().script();
+  CompiledScript* compiled = script.compileScriptInMainWorld(
+      ScriptSourceCode("x = 42;"), NotSharableCrossOrigin);
+  script.executeScriptInMainWorld(*compiled);
+  v8::Local<v8::Value> value =
+      script.executeScriptInMainWorldAndReturnValue(ScriptSourceCode("x"));
+  EXPECT_EQ(42, value->Int32Value());
+}
+
+TEST(ScriptControllerTest, CompileAndExecuteScriptInMainWorldInterleaved) {
+  V8TestingScope scope;
+  ScriptController& script = scope.frame().script();
+  CompiledScript* compiled = script.compileScriptInMainWorld(
+      ScriptSourceCode("x *= 2;"), NotSharableCrossOrigin);
+  CompiledScript* compiled2 = script.compileScriptInMainWorld(
+      ScriptSourceCode("x = 21;"), NotSharableCrossOrigin);
+  script.executeScriptInMainWorld(*compiled2);
+  script.executeScriptInMainWorld(*compiled);
+  v8::Local<v8::Value> value =
+      script.executeScriptInMainWorldAndReturnValue(ScriptSourceCode("x"));
+  EXPECT_EQ(42, value->Int32Value());
+}
+
+}  // namespace
+}  // namespace blink

diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptStreamer.cpp b/third_party/WebKit/Source/bindings/core/v8/ScriptStreamer.cpp
index 1daf0bd..3c29ed9 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptStreamer.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptStreamer.cpp

@@ -16,7 +16,7 @@
 #include "platform/CrossThreadFunctional.h"
 #include "platform/Histogram.h"
 #include "platform/SharedBuffer.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "public/platform/WebScheduler.h"
 #include "wtf/Deque.h"
 #include "wtf/PtrUtil.h"

diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptStreamerThread.cpp b/third_party/WebKit/Source/bindings/core/v8/ScriptStreamerThread.cpp
index 1547e99..aed61c4ab 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptStreamerThread.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptStreamerThread.cpp

@@ -7,7 +7,7 @@
 #include "bindings/core/v8/ScriptStreamer.h"
 #include "core/inspector/InspectorTraceEvents.h"
 #include "platform/WebTaskRunner.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebTraceLocation.h"
 #include "wtf/PtrUtil.h"

diff --git a/third_party/WebKit/Source/bindings/core/v8/SerializedScriptValueFactory.cpp b/third_party/WebKit/Source/bindings/core/v8/SerializedScriptValueFactory.cpp
index 5e2d7c5..9bc601d 100644
--- a/third_party/WebKit/Source/bindings/core/v8/SerializedScriptValueFactory.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/SerializedScriptValueFactory.cpp

@@ -12,7 +12,7 @@
 #include "core/dom/DOMArrayBuffer.h"
 #include "core/dom/MessagePort.h"
 #include "core/frame/ImageBitmap.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "wtf/ByteOrder.h"
 #include "wtf/text/StringBuffer.h"
 

diff --git a/third_party/WebKit/Source/bindings/core/v8/SourceLocation.cpp b/third_party/WebKit/Source/bindings/core/v8/SourceLocation.cpp
index 2176ac735..845551af 100644
--- a/third_party/WebKit/Source/bindings/core/v8/SourceLocation.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/SourceLocation.cpp

@@ -13,7 +13,7 @@
 #include "core/inspector/ThreadDebugger.h"
 #include "core/inspector/V8InspectorString.h"
 #include "platform/ScriptForbiddenScope.h"
-#include "platform/tracing/TracedValue.h"
+#include "platform/instrumentation/tracing/TracedValue.h"
 #include "wtf/PtrUtil.h"
 #include <memory>
 

diff --git a/third_party/WebKit/Source/bindings/core/v8/V8Binding.cpp b/third_party/WebKit/Source/bindings/core/v8/V8Binding.cpp
index c0e45245..f228925a 100644
--- a/third_party/WebKit/Source/bindings/core/v8/V8Binding.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/V8Binding.cpp

@@ -61,7 +61,7 @@
 #include "core/workers/WorkerGlobalScope.h"
 #include "core/workers/WorkletGlobalScope.h"
 #include "core/xml/XPathNSResolver.h"
-#include "platform/tracing/TracedValue.h"
+#include "platform/instrumentation/tracing/TracedValue.h"
 #include "wtf/MathExtras.h"
 #include "wtf/StdLibExtras.h"
 #include "wtf/Threading.h"

diff --git a/third_party/WebKit/Source/bindings/core/v8/V8DOMConfiguration.cpp b/third_party/WebKit/Source/bindings/core/v8/V8DOMConfiguration.cpp
index c0abc74..6eb6094 100644
--- a/third_party/WebKit/Source/bindings/core/v8/V8DOMConfiguration.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/V8DOMConfiguration.cpp

@@ -31,7 +31,7 @@
 #include "bindings/core/v8/GeneratedCodeHelper.h"  // just for DCHECK
 #include "bindings/core/v8/V8ObjectConstructor.h"
 #include "bindings/core/v8/V8PerContextData.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/bindings/core/v8/V8GCController.cpp b/third_party/WebKit/Source/bindings/core/v8/V8GCController.cpp
index 1a003fc..6ded783 100644
--- a/third_party/WebKit/Source/bindings/core/v8/V8GCController.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/V8GCController.cpp

@@ -45,7 +45,7 @@
 #include "core/inspector/InspectorTraceEvents.h"
 #include "platform/Histogram.h"
 #include "platform/RuntimeEnabledFeatures.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "public/platform/BlameContext.h"
 #include "public/platform/Platform.h"
 #include "wtf/Vector.h"

diff --git a/third_party/WebKit/Source/bindings/core/v8/V8HTMLConstructor.cpp b/third_party/WebKit/Source/bindings/core/v8/V8HTMLConstructor.cpp
index a938f4b..b8871675 100644
--- a/third_party/WebKit/Source/bindings/core/v8/V8HTMLConstructor.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/V8HTMLConstructor.cpp

@@ -19,7 +19,7 @@
 #include "core/dom/custom/CustomElementRegistry.h"
 #include "core/frame/LocalDOMWindow.h"
 #include "platform/RuntimeEnabledFeatures.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/bindings/core/v8/V8Initializer.cpp b/third_party/WebKit/Source/bindings/core/v8/V8Initializer.cpp
index c0ed0c3..c272659 100644
--- a/third_party/WebKit/Source/bindings/core/v8/V8Initializer.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/V8Initializer.cpp

@@ -53,7 +53,7 @@
 #include "core/workers/WorkerGlobalScope.h"
 #include "platform/EventDispatchForbiddenScope.h"
 #include "platform/RuntimeEnabledFeatures.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebScheduler.h"
 #include "public/platform/WebThread.h"

diff --git a/third_party/WebKit/Source/bindings/core/v8/V8ObjectConstructor.cpp b/third_party/WebKit/Source/bindings/core/v8/V8ObjectConstructor.cpp
index 405b1382..c7c9fe0 100644
--- a/third_party/WebKit/Source/bindings/core/v8/V8ObjectConstructor.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/V8ObjectConstructor.cpp

@@ -28,7 +28,7 @@
 #include "bindings/core/v8/V8ScriptRunner.h"
 #include "core/dom/Document.h"
 #include "core/frame/LocalFrame.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/bindings/core/v8/V8PagePopupControllerBinding.cpp b/third_party/WebKit/Source/bindings/core/v8/V8PagePopupControllerBinding.cpp
index 4f6b7e4c..e9af666 100644
--- a/third_party/WebKit/Source/bindings/core/v8/V8PagePopupControllerBinding.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/V8PagePopupControllerBinding.cpp

@@ -12,7 +12,7 @@
 #include "core/frame/LocalDOMWindow.h"
 #include "core/page/PagePopupController.h"
 #include "core/page/PagePopupSupplement.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/bindings/core/v8/V8ScriptRunner.cpp b/third_party/WebKit/Source/bindings/core/v8/V8ScriptRunner.cpp
index 7c8faf4..9e618c7 100644
--- a/third_party/WebKit/Source/bindings/core/v8/V8ScriptRunner.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/V8ScriptRunner.cpp

@@ -40,7 +40,7 @@
 #include "core/loader/resource/ScriptResource.h"
 #include "platform/Histogram.h"
 #include "platform/ScriptForbiddenScope.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "public/platform/Platform.h"
 #include "wtf/CurrentTime.h"
 

diff --git a/third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp b/third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp
index fa2a6818..327a437 100644
--- a/third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp

@@ -61,7 +61,7 @@
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/ScriptForbiddenScope.h"
 #include "platform/heap/Handle.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "public/platform/Platform.h"
 #include "wtf/Assertions.h"

diff --git a/third_party/WebKit/Source/bindings/modules/v8/SerializedScriptValueForModulesFactory.cpp b/third_party/WebKit/Source/bindings/modules/v8/SerializedScriptValueForModulesFactory.cpp
index a1ffde32..621e899 100644
--- a/third_party/WebKit/Source/bindings/modules/v8/SerializedScriptValueForModulesFactory.cpp
+++ b/third_party/WebKit/Source/bindings/modules/v8/SerializedScriptValueForModulesFactory.cpp

@@ -10,7 +10,7 @@
 #include "bindings/modules/v8/serialization/V8ScriptValueDeserializerForModules.h"
 #include "bindings/modules/v8/serialization/V8ScriptValueSerializerForModules.h"
 #include "core/dom/ExceptionCode.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/core/animation/Animation.cpp b/third_party/WebKit/Source/core/animation/Animation.cpp
index 8799d30..03ea17a 100644
--- a/third_party/WebKit/Source/core/animation/Animation.cpp
+++ b/third_party/WebKit/Source/core/animation/Animation.cpp

@@ -43,7 +43,7 @@
 #include "core/inspector/InspectorTraceEvents.h"
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/animation/CompositorAnimationPlayer.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebCompositorSupport.h"
 #include "wtf/MathExtras.h"

diff --git a/third_party/WebKit/Source/core/animation/AnimationTimeline.cpp b/third_party/WebKit/Source/core/animation/AnimationTimeline.cpp
index 8f8659d..f7fb988d 100644
--- a/third_party/WebKit/Source/core/animation/AnimationTimeline.cpp
+++ b/third_party/WebKit/Source/core/animation/AnimationTimeline.cpp

@@ -38,7 +38,7 @@
 #include "core/page/Page.h"
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/animation/CompositorAnimationTimeline.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebCompositorSupport.h"
 #include "wtf/PtrUtil.h"

diff --git a/third_party/WebKit/Source/core/animation/CompositorPendingAnimations.cpp b/third_party/WebKit/Source/core/animation/CompositorPendingAnimations.cpp
index c86e85c7..b99515d5 100644
--- a/third_party/WebKit/Source/core/animation/CompositorPendingAnimations.cpp
+++ b/third_party/WebKit/Source/core/animation/CompositorPendingAnimations.cpp

@@ -35,7 +35,7 @@
 #include "core/dom/Document.h"
 #include "core/frame/FrameView.h"
 #include "core/page/Page.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/core/animation/CustomCompositorAnimationManager.cpp b/third_party/WebKit/Source/core/animation/CustomCompositorAnimationManager.cpp
index c2c5201..12c9c67 100644
--- a/third_party/WebKit/Source/core/animation/CustomCompositorAnimationManager.cpp
+++ b/third_party/WebKit/Source/core/animation/CustomCompositorAnimationManager.cpp

@@ -8,7 +8,7 @@
 #include "core/dom/Element.h"
 #include "core/dom/Node.h"
 #include "platform/graphics/CompositorMutation.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/core/animation/CustomCompositorAnimations.cpp b/third_party/WebKit/Source/core/animation/CustomCompositorAnimations.cpp
index 9039142..c1a2afb 100644
--- a/third_party/WebKit/Source/core/animation/CustomCompositorAnimations.cpp
+++ b/third_party/WebKit/Source/core/animation/CustomCompositorAnimations.cpp

@@ -12,7 +12,7 @@
 #include "core/animation/animatable/AnimatableTransform.h"
 #include "core/animation/animatable/AnimatableValue.h"
 #include "platform/graphics/CompositorMutation.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/transforms/Matrix3DTransformOperation.h"
 #include "platform/transforms/MatrixTransformOperation.h"
 #include "platform/transforms/TransformOperations.h"

diff --git a/third_party/WebKit/Source/core/css/RuleSet.cpp b/third_party/WebKit/Source/core/css/RuleSet.cpp
index c1273e1..bf5ffe0 100644
--- a/third_party/WebKit/Source/core/css/RuleSet.cpp
+++ b/third_party/WebKit/Source/core/css/RuleSet.cpp

@@ -40,7 +40,7 @@
 #include "core/html/track/TextTrackCue.h"
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/heap/HeapTerminatedArrayBuilder.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/weborigin/SecurityOrigin.h"
 
 #include "wtf/TerminatedArrayBuilder.h"

diff --git a/third_party/WebKit/Source/core/css/StyleSheetContents.cpp b/third_party/WebKit/Source/core/css/StyleSheetContents.cpp
index 42715a55..982ca98 100644
--- a/third_party/WebKit/Source/core/css/StyleSheetContents.cpp
+++ b/third_party/WebKit/Source/core/css/StyleSheetContents.cpp

@@ -34,7 +34,7 @@
 #include "core/inspector/InspectorTraceEvents.h"
 #include "core/loader/resource/CSSStyleSheetResource.h"
 #include "platform/Histogram.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/weborigin/SecurityOrigin.h"
 
 namespace blink {

diff --git a/third_party/WebKit/Source/core/css/cssom/CSSAngleValue.cpp b/third_party/WebKit/Source/core/css/cssom/CSSAngleValue.cpp
index a1216f52..fe6c9ce 100644
--- a/third_party/WebKit/Source/core/css/cssom/CSSAngleValue.cpp
+++ b/third_party/WebKit/Source/core/css/cssom/CSSAngleValue.cpp

@@ -10,11 +10,16 @@
 
 namespace blink {
 
+CSSAngleValue* CSSAngleValue::create(double value,
+                                     CSSPrimitiveValue::UnitType unit) {
+  DCHECK(CSSPrimitiveValue::isAngle(unit));
+  return new CSSAngleValue(value, unit);
+}
+
 CSSAngleValue* CSSAngleValue::create(double value, const String& unit) {
   CSSPrimitiveValue::UnitType primitiveUnit =
       CSSPrimitiveValue::stringToUnitType(unit);
-  DCHECK(CSSPrimitiveValue::isAngle(primitiveUnit));
-  return new CSSAngleValue(value, primitiveUnit);
+  return create(value, primitiveUnit);
 }
 
 CSSAngleValue* CSSAngleValue::fromCSSValue(const CSSPrimitiveValue& value) {

diff --git a/third_party/WebKit/Source/core/css/cssom/CSSAngleValue.h b/third_party/WebKit/Source/core/css/cssom/CSSAngleValue.h
index 8e47d7e..a9f17b3c 100644
--- a/third_party/WebKit/Source/core/css/cssom/CSSAngleValue.h
+++ b/third_party/WebKit/Source/core/css/cssom/CSSAngleValue.h

@@ -16,6 +16,7 @@
 
  public:
   static CSSAngleValue* create(double value, const String& unit);
+  static CSSAngleValue* create(double value, CSSPrimitiveValue::UnitType);
   static CSSAngleValue* fromCSSValue(const CSSPrimitiveValue&);
 
   StyleValueType type() const override { return AngleType; }

diff --git a/third_party/WebKit/Source/core/css/cssom/CSSSkew.cpp b/third_party/WebKit/Source/core/css/cssom/CSSSkew.cpp
index 41ccab13..681ae1d 100644
--- a/third_party/WebKit/Source/core/css/cssom/CSSSkew.cpp
+++ b/third_party/WebKit/Source/core/css/cssom/CSSSkew.cpp

@@ -6,9 +6,46 @@
 
 #include "core/css/CSSFunctionValue.h"
 #include "core/css/CSSPrimitiveValue.h"
+#include "core/css/cssom/CSSAngleValue.h"
 
 namespace blink {
 
+CSSSkew* CSSSkew::fromCSSValue(const CSSFunctionValue& value) {
+  const CSSPrimitiveValue& xValue = toCSSPrimitiveValue(value.item(0));
+  if (xValue.isCalculated()) {
+    // TODO(meade): Decide what we want to do with calc angles.
+    return nullptr;
+  }
+  DCHECK(xValue.isAngle());
+  switch (value.functionType()) {
+    case CSSValueSkew:
+      if (value.length() == 2U) {
+        const CSSPrimitiveValue& yValue = toCSSPrimitiveValue(value.item(1));
+        if (yValue.isCalculated()) {
+          // TODO(meade): Decide what we want to do with calc angles.
+          return nullptr;
+        }
+        DCHECK(yValue.isAngle());
+        return CSSSkew::create(CSSAngleValue::fromCSSValue(xValue),
+                               CSSAngleValue::fromCSSValue(yValue));
+      }
+    // Else fall through; skew(ax) == skewX(ax).
+    case CSSValueSkewX:
+      DCHECK_EQ(value.length(), 1U);
+      return CSSSkew::create(
+          CSSAngleValue::fromCSSValue(xValue),
+          CSSAngleValue::create(0, CSSPrimitiveValue::UnitType::Degrees));
+    case CSSValueSkewY:
+      DCHECK_EQ(value.length(), 1U);
+      return CSSSkew::create(
+          CSSAngleValue::create(0, CSSPrimitiveValue::UnitType::Degrees),
+          CSSAngleValue::fromCSSValue(xValue));
+    default:
+      NOTREACHED();
+      return nullptr;
+  }
+}
+
 CSSFunctionValue* CSSSkew::toCSSValue() const {
   CSSFunctionValue* result = CSSFunctionValue::create(CSSValueSkew);
   result->append(*CSSPrimitiveValue::create(m_ax->value(), m_ax->unit()));

diff --git a/third_party/WebKit/Source/core/css/cssom/CSSSkew.h b/third_party/WebKit/Source/core/css/cssom/CSSSkew.h
index 73416c6..e7b715f 100644
--- a/third_party/WebKit/Source/core/css/cssom/CSSSkew.h
+++ b/third_party/WebKit/Source/core/css/cssom/CSSSkew.h

@@ -20,9 +20,7 @@
     return new CSSSkew(ax, ay);
   }
 
-  static CSSSkew* fromCSSValue(const CSSFunctionValue& value) {
-    return nullptr;
-  }
+  static CSSSkew* fromCSSValue(const CSSFunctionValue&);
 
   // Bindings requires returning non-const pointers. This is safe because
   // CSSAngleValues are immutable.

diff --git a/third_party/WebKit/Source/core/css/invalidation/InvalidationSet.cpp b/third_party/WebKit/Source/core/css/invalidation/InvalidationSet.cpp
index 6ddc285..e5dcb21a 100644
--- a/third_party/WebKit/Source/core/css/invalidation/InvalidationSet.cpp
+++ b/third_party/WebKit/Source/core/css/invalidation/InvalidationSet.cpp

@@ -33,7 +33,7 @@
 #include "core/css/resolver/StyleResolver.h"
 #include "core/dom/Element.h"
 #include "core/inspector/InspectorTraceEvents.h"
-#include "platform/tracing/TracedValue.h"
+#include "platform/instrumentation/tracing/TracedValue.h"
 #include "wtf/Compiler.h"
 #include "wtf/PtrUtil.h"
 #include "wtf/text/StringBuilder.h"

diff --git a/third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp b/third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp
index 5dd65ae4..1e64f1bbf 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSParserImpl.cpp

@@ -28,7 +28,7 @@
 #include "core/dom/Element.h"
 #include "core/frame/Deprecation.h"
 #include "core/frame/UseCounter.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "wtf/PtrUtil.h"
 #include <bitset>
 #include <memory>

diff --git a/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp b/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
index 107bf24..d2cf85d 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp

@@ -2051,8 +2051,8 @@
                                const CSSParserContext& context,
                                bool inQuirksMode) {
   CSSValueList* list = nullptr;
-  while (CSSValue* image =
-             consumeImage(range, context, ConsumeGeneratedImage::Forbid)) {
+  while (CSSValue* image = consumeImage(range, context,
+                                        ConsumeGeneratedImagePolicy::Forbid)) {
     double num;
     IntPoint hotSpot(-1, -1);
     bool hotSpotSpecified = false;

diff --git a/third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp b/third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp
index bc5add7bb..ab71b3d 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.cpp

@@ -1207,7 +1207,7 @@
 
 CSSValue* consumeImage(CSSParserTokenRange& range,
                        const CSSParserContext& context,
-                       ConsumeGeneratedImage generatedImage) {
+                       ConsumeGeneratedImagePolicy generatedImage) {
   AtomicString uri = consumeUrlAsStringView(range).toAtomicString();
   if (!uri.isNull())
     return createCSSImageValueWithReferrer(uri, context);
@@ -1215,8 +1215,10 @@
     CSSValueID id = range.peek().functionId();
     if (id == CSSValueWebkitImageSet)
       return consumeImageSet(range, context);
-    if (generatedImage == ConsumeGeneratedImage::Allow && isGeneratedImage(id))
+    if (generatedImage == ConsumeGeneratedImagePolicy::Allow &&
+        isGeneratedImage(id)) {
       return consumeGeneratedImage(range, context);
+    }
   }
   return nullptr;
 }

diff --git a/third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.h b/third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.h
index 681e764..e518ad4 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.h
+++ b/third_party/WebKit/Source/core/css/parser/CSSPropertyParserHelpers.h

@@ -84,11 +84,12 @@
                                    CSSValue*& resultX,
                                    CSSValue*& resultY);
 
-enum class ConsumeGeneratedImage { Allow, Forbid };
+enum class ConsumeGeneratedImagePolicy { Allow, Forbid };
 
-CSSValue* consumeImage(CSSParserTokenRange&,
-                       const CSSParserContext&,
-                       ConsumeGeneratedImage = ConsumeGeneratedImage::Allow);
+CSSValue* consumeImage(
+    CSSParserTokenRange&,
+    const CSSParserContext&,
+    ConsumeGeneratedImagePolicy = ConsumeGeneratedImagePolicy::Allow);
 CSSValue* consumeImageOrNone(CSSParserTokenRange&, const CSSParserContext&);
 
 bool isCSSWideKeyword(StringView);

diff --git a/third_party/WebKit/Source/core/css/resolver/SharedStyleFinder.cpp b/third_party/WebKit/Source/core/css/resolver/SharedStyleFinder.cpp
index 193bfa4..842676f 100644
--- a/third_party/WebKit/Source/core/css/resolver/SharedStyleFinder.cpp
+++ b/third_party/WebKit/Source/core/css/resolver/SharedStyleFinder.cpp

@@ -50,7 +50,7 @@
 #include "core/html/HTMLOptionElement.h"
 #include "core/style/ComputedStyle.h"
 #include "core/svg/SVGElement.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "wtf/HashSet.h"
 #include "wtf/text/AtomicString.h"
 

diff --git a/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp b/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp
index d1ae57f..3aa55be 100644
--- a/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp
+++ b/third_party/WebKit/Source/core/css/resolver/StyleBuilderConverter.cpp

@@ -895,13 +895,13 @@
     } else if (item->isIdentifierValue() &&
                toCSSIdentifierValue(*item).getValueID() == CSSValueReverse) {
       result.type = OffsetRotationAuto;
-      result.angle += 180;
+      result.angle = clampTo<float>(result.angle + 180);
     } else {
       const CSSPrimitiveValue& primitiveValue = toCSSPrimitiveValue(*item);
-      result.angle += primitiveValue.computeDegrees();
+      result.angle =
+          clampTo<float>(result.angle + primitiveValue.computeDegrees());
     }
   }
-  result.angle = clampTo<float>(result.angle);
 
   return result;
 }

diff --git a/third_party/WebKit/Source/core/css/resolver/StyleResolverStats.h b/third_party/WebKit/Source/core/css/resolver/StyleResolverStats.h
index 9f1cdeea..9d70263 100644
--- a/third_party/WebKit/Source/core/css/resolver/StyleResolverStats.h
+++ b/third_party/WebKit/Source/core/css/resolver/StyleResolverStats.h

@@ -31,8 +31,8 @@
 #ifndef StyleResolverStats_h
 #define StyleResolverStats_h
 
-#include "platform/tracing/TraceEvent.h"
-#include "platform/tracing/TracedValue.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TracedValue.h"
 #include "wtf/PtrUtil.h"
 #include <memory>
 

diff --git a/third_party/WebKit/Source/core/dom/CompositorProxyClient.cpp b/third_party/WebKit/Source/core/dom/CompositorProxyClient.cpp
index 5250f0ff..e9209a9 100644
--- a/third_party/WebKit/Source/core/dom/CompositorProxyClient.cpp
+++ b/third_party/WebKit/Source/core/dom/CompositorProxyClient.cpp

@@ -4,7 +4,7 @@
 
 #include "core/dom/CompositorProxyClient.h"
 
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/core/dom/ContextLifecycleObserver.cpp b/third_party/WebKit/Source/core/dom/ContextLifecycleObserver.cpp
index 24fcf42..829c1c0 100644
--- a/third_party/WebKit/Source/core/dom/ContextLifecycleObserver.cpp
+++ b/third_party/WebKit/Source/core/dom/ContextLifecycleObserver.cpp

@@ -9,6 +9,25 @@
 
 namespace blink {
 
+ContextClient::ContextClient(LocalFrame* frame)
+    : m_executionContext(frame ? frame->document() : nullptr) {}
+
+ExecutionContext* ContextClient::getExecutionContext() const {
+  return m_executionContext && !m_executionContext->isContextDestroyed()
+             ? m_executionContext
+             : nullptr;
+}
+
+LocalFrame* ContextClient::frame() const {
+  return m_executionContext && m_executionContext->isDocument()
+             ? toDocument(m_executionContext)->frame()
+             : nullptr;
+}
+
+DEFINE_TRACE(ContextClient) {
+  visitor->trace(m_executionContext);
+}
+
 LocalFrame* ContextLifecycleObserver::frame() const {
   return getExecutionContext() && getExecutionContext()->isDocument()
              ? toDocument(getExecutionContext())->frame()

diff --git a/third_party/WebKit/Source/core/dom/ContextLifecycleObserver.h b/third_party/WebKit/Source/core/dom/ContextLifecycleObserver.h
index a2fddd3..73eb0a6 100644
--- a/third_party/WebKit/Source/core/dom/ContextLifecycleObserver.h
+++ b/third_party/WebKit/Source/core/dom/ContextLifecycleObserver.h

@@ -35,14 +35,35 @@
 
 class LocalFrame;
 
+// ContextClient and ContextLifecycleObserver are helpers to associate a
+// class with an ExecutionContext. ContextLifecycleObserver provides an
+// additional contextDestroyed() hook to execute cleanup code when a
+// context is destroyed. Prefer the simpler ContextClient when possible.
+//
+// getExecutionContext() returns null after the observing context is detached.
+// frame() returns null after the observing context is detached or if the
+// context doesn't have a frame (i.e., if the context is not a Document).
+
+class CORE_EXPORT ContextClient : public GarbageCollectedMixin {
+ public:
+  ExecutionContext* getExecutionContext() const;
+  LocalFrame* frame() const;
+
+  DECLARE_VIRTUAL_TRACE();
+
+ protected:
+  explicit ContextClient(ExecutionContext* executionContext)
+      : m_executionContext(executionContext) {}
+  explicit ContextClient(LocalFrame*);
+
+ private:
+  WeakMember<ExecutionContext> m_executionContext;
+};
+
 class CORE_EXPORT ContextLifecycleObserver
     : public LifecycleObserver<ExecutionContext, ContextLifecycleObserver> {
  public:
-  // Returns null after the observing context is detached.
   ExecutionContext* getExecutionContext() const { return lifecycleContext(); }
-
-  // Returns null after the observing context is detached or if the context
-  // doesn't have a frame (i.e., if the context is not a Document).
   LocalFrame* frame() const;
 
   enum Type {

diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index 29283db..0795e7c 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp

@@ -233,13 +233,13 @@
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/ScriptForbiddenScope.h"
 #include "platform/WebFrameScheduler.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/network/ContentSecurityPolicyParsers.h"
 #include "platform/network/HTTPParsers.h"
 #include "platform/scroll/Scrollbar.h"
 #include "platform/scroll/ScrollbarTheme.h"
 #include "platform/text/PlatformLocale.h"
 #include "platform/text/SegmentedString.h"
-#include "platform/tracing/TraceEvent.h"
 #include "platform/weborigin/OriginAccessEntry.h"
 #include "platform/weborigin/SchemeRegistry.h"
 #include "platform/weborigin/SecurityOrigin.h"

diff --git a/third_party/WebKit/Source/core/dom/DocumentParserTiming.cpp b/third_party/WebKit/Source/core/dom/DocumentParserTiming.cpp
index 4e7ef3a..0559424 100644
--- a/third_party/WebKit/Source/core/dom/DocumentParserTiming.cpp
+++ b/third_party/WebKit/Source/core/dom/DocumentParserTiming.cpp

@@ -6,7 +6,7 @@
 
 #include "core/dom/Document.h"
 #include "core/loader/DocumentLoader.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/core/dom/DocumentTiming.cpp b/third_party/WebKit/Source/core/dom/DocumentTiming.cpp
index 8f8cf08e..e9acbac3 100644
--- a/third_party/WebKit/Source/core/dom/DocumentTiming.cpp
+++ b/third_party/WebKit/Source/core/dom/DocumentTiming.cpp

@@ -6,7 +6,7 @@
 
 #include "core/dom/Document.h"
 #include "core/loader/DocumentLoader.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/core/dom/IntersectionObserverController.cpp b/third_party/WebKit/Source/core/dom/IntersectionObserverController.cpp
index 6b49dee2..409fb9c 100644
--- a/third_party/WebKit/Source/core/dom/IntersectionObserverController.cpp
+++ b/third_party/WebKit/Source/core/dom/IntersectionObserverController.cpp

@@ -7,7 +7,7 @@
 #include "core/dom/Document.h"
 #include "core/dom/Element.h"
 #include "core/dom/TaskRunnerHelper.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/core/dom/Node.cpp b/third_party/WebKit/Source/core/dom/Node.cpp
index 2b39822..54d7625 100644
--- a/third_party/WebKit/Source/core/dom/Node.cpp
+++ b/third_party/WebKit/Source/core/dom/Node.cpp

@@ -99,8 +99,8 @@
 #include "platform/EventDispatchForbiddenScope.h"
 #include "platform/InstanceCounters.h"
 #include "platform/RuntimeEnabledFeatures.h"
-#include "platform/tracing/TraceEvent.h"
-#include "platform/tracing/TracedValue.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TracedValue.h"
 #include "wtf/HashSet.h"
 #include "wtf/Vector.h"
 #include "wtf/allocator/Partitions.h"

diff --git a/third_party/WebKit/Source/core/dom/ScriptedIdleTaskController.cpp b/third_party/WebKit/Source/core/dom/ScriptedIdleTaskController.cpp
index 9f7b67a..263766a0c 100644
--- a/third_party/WebKit/Source/core/dom/ScriptedIdleTaskController.cpp
+++ b/third_party/WebKit/Source/core/dom/ScriptedIdleTaskController.cpp

@@ -10,7 +10,7 @@
 #include "core/frame/PerformanceMonitor.h"
 #include "core/inspector/InspectorTraceEvents.h"
 #include "platform/Histogram.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebScheduler.h"
 #include "public/platform/WebTraceLocation.h"

diff --git a/third_party/WebKit/Source/core/dom/StyleChangeReason.cpp b/third_party/WebKit/Source/core/dom/StyleChangeReason.cpp
index 824e82f..7bb49c6 100644
--- a/third_party/WebKit/Source/core/dom/StyleChangeReason.cpp
+++ b/third_party/WebKit/Source/core/dom/StyleChangeReason.cpp

@@ -4,7 +4,7 @@
 
 #include "core/dom/StyleChangeReason.h"
 
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "wtf/StaticConstructors.h"
 
 namespace blink {

diff --git a/third_party/WebKit/Source/core/dom/StyleElement.cpp b/third_party/WebKit/Source/core/dom/StyleElement.cpp
index 75b9a53..c64bf5f 100644
--- a/third_party/WebKit/Source/core/dom/StyleElement.cpp
+++ b/third_party/WebKit/Source/core/dom/StyleElement.cpp

@@ -33,7 +33,7 @@
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "core/html/HTMLStyleElement.h"
 #include "core/svg/SVGStyleElement.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "wtf/text/StringBuilder.h"
 
 namespace blink {

diff --git a/third_party/WebKit/Source/core/dom/StyleEngine.cpp b/third_party/WebKit/Source/core/dom/StyleEngine.cpp
index 51e43284..af6777e9 100644
--- a/third_party/WebKit/Source/core/dom/StyleEngine.cpp
+++ b/third_party/WebKit/Source/core/dom/StyleEngine.cpp

@@ -57,7 +57,7 @@
 #include "core/page/Page.h"
 #include "core/svg/SVGStyleElement.h"
 #include "platform/fonts/FontCache.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace blink {
 
@@ -426,28 +426,14 @@
   m_resolver->setRuleUsageTracker(m_tracker);
 }
 
-void StyleEngine::clearResolver() {
+void StyleEngine::clearResolvers() {
   DCHECK(!document().inStyleRecalc());
   DCHECK(isMaster() || !m_resolver);
 
   document().clearScopedStyleResolver();
-  // TODO(rune@opera.com): The clearing of all shadow tree scoped style
-  // resolvers below should not be necessary. It was introduced to fix a crash
-  // bug (https://crbug.com/447976) when clearResolver is called from didDetach
-  // on document destruction. That was pre-oilpan, and removing the for-loop
-  // below does not re-introduce that crash. If m_activeTreeScopes keeps too
-  // much memory alive after detach, we should probably clear m_activeTreeScopes
-  // in didDetach instead.
-  //
-  // The current code will clear too much if clearResolver is called from
-  // clearMasterResolver as a result of a Reconstruct in
-  // DocumentStyleSheetCollection. Such a reconstruct should not necessarily
-  // affect scoped resolvers from shadow trees at all.
   for (TreeScope* treeScope : m_activeTreeScopes)
     treeScope->clearScopedStyleResolver();
 
-  m_treeBoundaryCrossingScopes.clear();
-
   if (m_resolver) {
     TRACE_EVENT1("blink", "StyleEngine::clearResolver", "frame",
                  document().frame());
@@ -457,8 +443,11 @@
 }
 
 void StyleEngine::didDetach() {
+  clearResolvers();
   m_globalRuleSet.dispose();
-  clearResolver();
+  m_treeBoundaryCrossingScopes.clear();
+  m_dirtyTreeScopes.clear();
+  m_activeTreeScopes.clear();
   m_viewportResolver = nullptr;
   m_mediaQueryEvaluator = nullptr;
   clearFontCache();

diff --git a/third_party/WebKit/Source/core/dom/StyleEngine.h b/third_party/WebKit/Source/core/dom/StyleEngine.h
index f5c9ac70..7f1027ba 100644
--- a/third_party/WebKit/Source/core/dom/StyleEngine.h
+++ b/third_party/WebKit/Source/core/dom/StyleEngine.h

@@ -187,7 +187,6 @@
   }
 
   bool hasResolver() const { return m_resolver; }
-  void clearResolver();
 
   StyleInvalidator& styleInvalidator() { return m_styleInvalidator; }
   bool mediaQueryAffectedByViewportChange();
@@ -287,6 +286,7 @@
   }
 
   void createResolver();
+  void clearResolvers();
 
   CSSStyleSheet* parseSheet(Element&,
                             const String& text,

diff --git a/third_party/WebKit/Source/core/dom/custom/CustomElementReactionQueue.cpp b/third_party/WebKit/Source/core/dom/custom/CustomElementReactionQueue.cpp
index 342f91e4..2e81df0e4 100644
--- a/third_party/WebKit/Source/core/dom/custom/CustomElementReactionQueue.cpp
+++ b/third_party/WebKit/Source/core/dom/custom/CustomElementReactionQueue.cpp

@@ -6,7 +6,7 @@
 
 #include "core/dom/Element.h"
 #include "core/dom/custom/CustomElementReaction.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/core/dom/custom/CustomElementRegistry.cpp b/third_party/WebKit/Source/core/dom/custom/CustomElementRegistry.cpp
index 88298258..79d0833 100644
--- a/third_party/WebKit/Source/core/dom/custom/CustomElementRegistry.cpp
+++ b/third_party/WebKit/Source/core/dom/custom/CustomElementRegistry.cpp

@@ -23,7 +23,7 @@
 #include "core/dom/custom/CustomElementUpgradeSorter.h"
 #include "core/dom/custom/V0CustomElementRegistrationContext.h"
 #include "core/frame/LocalDOMWindow.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "wtf/Allocator.h"
 
 namespace blink {

diff --git a/third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp b/third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp
index c59b7d0..13c1cbd 100644
--- a/third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp
+++ b/third_party/WebKit/Source/core/editing/commands/ReplaceSelectionCommand.cpp

@@ -59,7 +59,7 @@
 #include "core/html/HTMLSpanElement.h"
 #include "core/layout/LayoutObject.h"
 #include "core/layout/LayoutText.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "wtf/StdLibExtras.h"
 #include "wtf/Vector.h"
 

diff --git a/third_party/WebKit/Source/core/editing/spellcheck/IdleSpellCheckCallback.cpp b/third_party/WebKit/Source/core/editing/spellcheck/IdleSpellCheckCallback.cpp
index 7ce3ead9..6e5195e 100644
--- a/third_party/WebKit/Source/core/editing/spellcheck/IdleSpellCheckCallback.cpp
+++ b/third_party/WebKit/Source/core/editing/spellcheck/IdleSpellCheckCallback.cpp

@@ -20,7 +20,7 @@
 #include "core/html/TextControlElement.h"
 #include "core/layout/LayoutObject.h"
 #include "platform/RuntimeEnabledFeatures.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "wtf/CurrentTime.h"
 
 namespace blink {

diff --git a/third_party/WebKit/Source/core/events/EventDispatcher.cpp b/third_party/WebKit/Source/core/events/EventDispatcher.cpp
index 5ed1e54f..5f796b53 100644
--- a/third_party/WebKit/Source/core/events/EventDispatcher.cpp
+++ b/third_party/WebKit/Source/core/events/EventDispatcher.cpp

@@ -42,7 +42,7 @@
 #include "core/html/HTMLElement.h"
 #include "core/inspector/InspectorTraceEvents.h"
 #include "platform/EventDispatchForbiddenScope.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "wtf/RefPtr.h"
 
 namespace blink {

diff --git a/third_party/WebKit/Source/core/events/GenericEventQueue.cpp b/third_party/WebKit/Source/core/events/GenericEventQueue.cpp
index 81d40f3..1a17852 100644
--- a/third_party/WebKit/Source/core/events/GenericEventQueue.cpp
+++ b/third_party/WebKit/Source/core/events/GenericEventQueue.cpp

@@ -27,7 +27,7 @@
 
 #include "core/events/Event.h"
 #include "core/inspector/InspectorInstrumentation.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/core/fetch/MemoryCache.cpp b/third_party/WebKit/Source/core/fetch/MemoryCache.cpp
index 64da484..d1205da 100644
--- a/third_party/WebKit/Source/core/fetch/MemoryCache.cpp
+++ b/third_party/WebKit/Source/core/fetch/MemoryCache.cpp

@@ -23,7 +23,7 @@
 #include "core/fetch/MemoryCache.h"
 
 #include "core/fetch/ResourceLoadingLog.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "platform/weborigin/SecurityOriginHash.h"
 #include "public/platform/Platform.h"

diff --git a/third_party/WebKit/Source/core/fetch/MemoryCache.h b/third_party/WebKit/Source/core/fetch/MemoryCache.h
index 5893e3bb..684067e 100644
--- a/third_party/WebKit/Source/core/fetch/MemoryCache.h
+++ b/third_party/WebKit/Source/core/fetch/MemoryCache.h

@@ -29,7 +29,7 @@
 #include "core/CoreExport.h"
 #include "core/fetch/Resource.h"
 #include "platform/MemoryCoordinator.h"
-#include "platform/tracing/MemoryCacheDumpProvider.h"
+#include "platform/instrumentation/tracing/MemoryCacheDumpProvider.h"
 #include "public/platform/WebThread.h"
 #include "wtf/Allocator.h"
 #include "wtf/HashMap.h"

diff --git a/third_party/WebKit/Source/core/fetch/Resource.cpp b/third_party/WebKit/Source/core/fetch/Resource.cpp
index f3959e7d..3fb287d76 100644
--- a/third_party/WebKit/Source/core/fetch/Resource.cpp
+++ b/third_party/WebKit/Source/core/fetch/Resource.cpp

@@ -38,8 +38,8 @@
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/SharedBuffer.h"
 #include "platform/WebTaskRunner.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/network/HTTPParsers.h"
-#include "platform/tracing/TraceEvent.h"
 #include "platform/weborigin/KURL.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebCachePolicy.h"

diff --git a/third_party/WebKit/Source/core/fetch/Resource.h b/third_party/WebKit/Source/core/fetch/Resource.h
index a0b81cd..352ce25 100644
--- a/third_party/WebKit/Source/core/fetch/Resource.h
+++ b/third_party/WebKit/Source/core/fetch/Resource.h

@@ -32,11 +32,11 @@
 #include "platform/MemoryCoordinator.h"
 #include "platform/SharedBuffer.h"
 #include "platform/Timer.h"
+#include "platform/instrumentation/tracing/web_process_memory_dump.h"
 #include "platform/network/ResourceError.h"
 #include "platform/network/ResourceLoadPriority.h"
 #include "platform/network/ResourceRequest.h"
 #include "platform/network/ResourceResponse.h"
-#include "platform/tracing/web_process_memory_dump.h"
 #include "public/platform/WebDataConsumerHandle.h"
 #include "wtf/Allocator.h"
 #include "wtf/AutoReset.h"

diff --git a/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp b/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
index 29de249..449a09b 100644
--- a/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
+++ b/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp

@@ -35,13 +35,13 @@
 #include "core/fetch/UniqueIdentifier.h"
 #include "platform/Histogram.h"
 #include "platform/RuntimeEnabledFeatures.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TracedValue.h"
 #include "platform/mhtml/ArchiveResource.h"
 #include "platform/mhtml/MHTMLArchive.h"
 #include "platform/network/NetworkInstrumentation.h"
 #include "platform/network/NetworkUtils.h"
 #include "platform/network/ResourceTimingInfo.h"
-#include "platform/tracing/TraceEvent.h"
-#include "platform/tracing/TracedValue.h"
 #include "platform/weborigin/KnownPorts.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "platform/weborigin/SecurityPolicy.h"

diff --git a/third_party/WebKit/Source/core/frame/BarProp.cpp b/third_party/WebKit/Source/core/frame/BarProp.cpp
index 6aacda9..6a76bba6 100644
--- a/third_party/WebKit/Source/core/frame/BarProp.cpp
+++ b/third_party/WebKit/Source/core/frame/BarProp.cpp

@@ -35,30 +35,28 @@
 namespace blink {
 
 BarProp::BarProp(LocalFrame* frame, Type type)
-    : DOMWindowProperty(frame), m_type(type) {}
+    : ContextClient(frame), m_type(type) {}
 
 DEFINE_TRACE(BarProp) {
-  DOMWindowProperty::trace(visitor);
+  ContextClient::trace(visitor);
 }
 
 bool BarProp::visible() const {
   if (!frame())
     return false;
-  FrameHost* host = frame()->host();
-  if (!host)
-    return false;
+  DCHECK(frame()->host());
 
   switch (m_type) {
     case Locationbar:
     case Personalbar:
     case Toolbar:
-      return host->chromeClient().toolbarsVisible();
+      return frame()->host()->chromeClient().toolbarsVisible();
     case Menubar:
-      return host->chromeClient().menubarVisible();
+      return frame()->host()->chromeClient().menubarVisible();
     case Scrollbars:
-      return host->chromeClient().scrollbarsVisible();
+      return frame()->host()->chromeClient().scrollbarsVisible();
     case Statusbar:
-      return host->chromeClient().statusbarVisible();
+      return frame()->host()->chromeClient().statusbarVisible();
   }
 
   NOTREACHED();

diff --git a/third_party/WebKit/Source/core/frame/BarProp.h b/third_party/WebKit/Source/core/frame/BarProp.h
index 6de982b..983eac1 100644
--- a/third_party/WebKit/Source/core/frame/BarProp.h
+++ b/third_party/WebKit/Source/core/frame/BarProp.h

@@ -30,7 +30,7 @@
 #define BarProp_h
 
 #include "bindings/core/v8/ScriptWrappable.h"
-#include "core/frame/DOMWindowProperty.h"
+#include "core/dom/ContextLifecycleObserver.h"
 #include "platform/heap/Handle.h"
 
 namespace blink {
@@ -39,7 +39,7 @@
 
 class BarProp final : public GarbageCollected<BarProp>,
                       public ScriptWrappable,
-                      public DOMWindowProperty {
+                      public ContextClient {
   DEFINE_WRAPPERTYPEINFO();
   USING_GARBAGE_COLLECTED_MIXIN(BarProp);
 

diff --git a/third_party/WebKit/Source/core/frame/DOMTimer.cpp b/third_party/WebKit/Source/core/frame/DOMTimer.cpp
index 492982f4..228dcb82 100644
--- a/third_party/WebKit/Source/core/frame/DOMTimer.cpp
+++ b/third_party/WebKit/Source/core/frame/DOMTimer.cpp

@@ -30,7 +30,7 @@
 #include "core/frame/PerformanceMonitor.h"
 #include "core/inspector/InspectorInstrumentation.h"
 #include "core/inspector/InspectorTraceEvents.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "wtf/CurrentTime.h"
 
 namespace blink {

diff --git a/third_party/WebKit/Source/core/frame/Deprecation.cpp b/third_party/WebKit/Source/core/frame/Deprecation.cpp
index 3b7c019..153099c 100644
--- a/third_party/WebKit/Source/core/frame/Deprecation.cpp
+++ b/third_party/WebKit/Source/core/frame/Deprecation.cpp

@@ -247,12 +247,6 @@
       return "<source src> with a <picture> parent is invalid and therefore "
              "ignored. Please use <source srcset> instead.";
 
-    case UseCounter::RadioNameMatchingASCIICaseless:
-    case UseCounter::RadioNameMatchingCaseFolding:
-      return willBeRemoved(
-          "Case-insensitive matching for <input type=radio name=...>", M57,
-          "6165799291060224");
-
     case UseCounter::ConsoleTimeline:
       return replacedBy("'console.timeline'", "'console.time'");
 

diff --git a/third_party/WebKit/Source/core/frame/FrameSerializer.cpp b/third_party/WebKit/Source/core/frame/FrameSerializer.cpp
index 61e15e4..5eab834 100644
--- a/third_party/WebKit/Source/core/frame/FrameSerializer.cpp
+++ b/third_party/WebKit/Source/core/frame/FrameSerializer.cpp

@@ -63,7 +63,7 @@
 #include "platform/SerializedResource.h"
 #include "platform/graphics/Image.h"
 #include "platform/heap/Handle.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "wtf/HashSet.h"
 #include "wtf/text/CString.h"
 #include "wtf/text/StringBuilder.h"

diff --git a/third_party/WebKit/Source/core/frame/FrameView.cpp b/third_party/WebKit/Source/core/frame/FrameView.cpp
index ebe85e16..591df08 100644
--- a/third_party/WebKit/Source/core/frame/FrameView.cpp
+++ b/third_party/WebKit/Source/core/frame/FrameView.cpp

@@ -115,12 +115,12 @@
 #include "platform/graphics/paint/CullRect.h"
 #include "platform/graphics/paint/PaintController.h"
 #include "platform/graphics/paint/ScopedPaintChunkProperties.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TracedValue.h"
 #include "platform/json/JSONValues.h"
 #include "platform/scroll/ScrollAnimatorBase.h"
 #include "platform/scroll/ScrollbarTheme.h"
 #include "platform/text/TextStream.h"
-#include "platform/tracing/TraceEvent.h"
-#include "platform/tracing/TracedValue.h"
 #include "public/platform/WebDisplayItemList.h"
 #include "wtf/CurrentTime.h"
 #include "wtf/PtrUtil.h"

diff --git a/third_party/WebKit/Source/core/frame/UseCounter.cpp b/third_party/WebKit/Source/core/frame/UseCounter.cpp
index 8bded68..383f0723 100644
--- a/third_party/WebKit/Source/core/frame/UseCounter.cpp
+++ b/third_party/WebKit/Source/core/frame/UseCounter.cpp

@@ -36,7 +36,7 @@
 #include "core/inspector/ConsoleMessage.h"
 #include "core/workers/WorkerOrWorkletGlobalScope.h"
 #include "platform/Histogram.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace {
 

diff --git a/third_party/WebKit/Source/core/frame/UseCounter.h b/third_party/WebKit/Source/core/frame/UseCounter.h
index e451205f..38f0676 100644
--- a/third_party/WebKit/Source/core/frame/UseCounter.h
+++ b/third_party/WebKit/Source/core/frame/UseCounter.h

@@ -1199,9 +1199,6 @@
     MapNameMatchingStrict = 1510,
     MapNameMatchingASCIICaseless = 1511,
     MapNameMatchingUnicodeLower = 1512,
-    RadioNameMatchingStrict = 1513,
-    RadioNameMatchingASCIICaseless = 1514,
-    RadioNameMatchingCaseFolding = 1515,
     InputSelectionGettersThrow = 1517,
     UsbGetDevices = 1519,
     UsbRequestDevice = 1520,

diff --git a/third_party/WebKit/Source/core/frame/VisualViewport.cpp b/third_party/WebKit/Source/core/frame/VisualViewport.cpp
index 3a27c0c..a56b8e1e 100644
--- a/third_party/WebKit/Source/core/frame/VisualViewport.cpp
+++ b/third_party/WebKit/Source/core/frame/VisualViewport.cpp

@@ -50,9 +50,9 @@
 #include "platform/geometry/FloatSize.h"
 #include "platform/graphics/CompositorMutableProperties.h"
 #include "platform/graphics/GraphicsLayer.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/scroll/Scrollbar.h"
 #include "platform/scroll/ScrollbarThemeOverlay.h"
-#include "platform/tracing/TraceEvent.h"
 #include "public/platform/WebCompositorSupport.h"
 #include "public/platform/WebScrollbar.h"
 #include "public/platform/WebScrollbarLayer.h"

diff --git a/third_party/WebKit/Source/core/html/HTMLFormElement.cpp b/third_party/WebKit/Source/core/html/HTMLFormElement.cpp
index 94552349..d8437be 100644
--- a/third_party/WebKit/Source/core/html/HTMLFormElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLFormElement.cpp

@@ -465,7 +465,10 @@
     return;
   }
 
-  for (const auto& element : listedElements()) {
+  // Copy the element list because |reset()| implementation can update DOM
+  // structure.
+  ListedElement::List elements(listedElements());
+  for (const auto& element : elements) {
     if (element->isFormControlElement())
       toHTMLFormControlElement(element)->reset();
   }

diff --git a/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp b/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
index 0808d59..788b7922 100644
--- a/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLSelectElement.cpp

@@ -73,8 +73,8 @@
 #include "core/page/SpatialNavigation.h"
 #include "platform/PlatformMouseEvent.h"
 #include "platform/PopupMenu.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/text/PlatformLocale.h"
-#include "platform/tracing/TraceEvent.h"
 
 using namespace WTF::Unicode;
 

diff --git a/third_party/WebKit/Source/core/html/forms/RadioButtonGroupScope.cpp b/third_party/WebKit/Source/core/html/forms/RadioButtonGroupScope.cpp
index 75a9388..0bf469de 100644
--- a/third_party/WebKit/Source/core/html/forms/RadioButtonGroupScope.cpp
+++ b/third_party/WebKit/Source/core/html/forms/RadioButtonGroupScope.cpp

@@ -21,30 +21,11 @@
 #include "core/html/forms/RadioButtonGroupScope.h"
 
 #include "core/InputTypeNames.h"
-#include "core/frame/Deprecation.h"
-#include "core/frame/FrameConsole.h"
-#include "core/frame/LocalFrame.h"
 #include "core/html/HTMLInputElement.h"
-#include "core/inspector/ConsoleMessage.h"
 #include "wtf/HashMap.h"
 
 namespace blink {
 
-namespace {
-
-void addSingletonDeprecationMessage(const LocalFrame* frame,
-                                    UseCounter::Feature feature,
-                                    const AtomicString& name1,
-                                    const AtomicString& name2) {
-  if (!frame)
-    return;
-  frame->console().addSingletonMessage(ConsoleMessage::create(
-      DeprecationMessageSource, WarningMessageLevel,
-      Deprecation::deprecationMessage(feature) + " Comparing name=" + name1 +
-          " and name=" + name2));
-}
-}
-
 class RadioButtonGroup : public GarbageCollected<RadioButtonGroup> {
  public:
   static RadioButtonGroup* create();
@@ -234,22 +215,8 @@
     m_nameToGroupMap = new NameToGroupMap;
 
   auto keyValue = m_nameToGroupMap->add(element->name(), nullptr).storedValue;
-  if (!keyValue->value) {
+  if (!keyValue->value)
     keyValue->value = RadioButtonGroup::create();
-  } else {
-    if (keyValue->key == element->name()) {
-      UseCounter::count(element->document(),
-                        UseCounter::RadioNameMatchingStrict);
-    } else if (equalIgnoringASCIICase(keyValue->key, element->name())) {
-      addSingletonDeprecationMessage(element->document().frame(),
-                                     UseCounter::RadioNameMatchingASCIICaseless,
-                                     keyValue->key, element->name());
-    } else {
-      addSingletonDeprecationMessage(element->document().frame(),
-                                     UseCounter::RadioNameMatchingCaseFolding,
-                                     keyValue->key, element->name());
-    }
-  }
   keyValue->value->add(element);
 }
 

diff --git a/third_party/WebKit/Source/core/html/forms/RadioButtonGroupScope.h b/third_party/WebKit/Source/core/html/forms/RadioButtonGroupScope.h
index f093983b..6df3f00 100644
--- a/third_party/WebKit/Source/core/html/forms/RadioButtonGroupScope.h
+++ b/third_party/WebKit/Source/core/html/forms/RadioButtonGroupScope.h

@@ -47,8 +47,7 @@
   unsigned groupSizeFor(const HTMLInputElement*) const;
 
  private:
-  using NameToGroupMap =
-      HeapHashMap<AtomicString, Member<RadioButtonGroup>, CaseFoldingHash>;
+  using NameToGroupMap = HeapHashMap<AtomicString, Member<RadioButtonGroup>>;
   Member<NameToGroupMap> m_nameToGroupMap;
 };
 

diff --git a/third_party/WebKit/Source/core/html/parser/BackgroundHTMLParser.cpp b/third_party/WebKit/Source/core/html/parser/BackgroundHTMLParser.cpp
index df8fcc3..152defdd 100644
--- a/third_party/WebKit/Source/core/html/parser/BackgroundHTMLParser.cpp
+++ b/third_party/WebKit/Source/core/html/parser/BackgroundHTMLParser.cpp

@@ -32,7 +32,7 @@
 #include "platform/CrossThreadFunctional.h"
 #include "platform/Histogram.h"
 #include "platform/WebTaskRunner.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "public/platform/Platform.h"
 #include "wtf/CurrentTime.h"
 #include "wtf/Functional.h"

diff --git a/third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp b/third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp
index d2e0a7e..1a41b81 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp
+++ b/third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp

@@ -53,7 +53,7 @@
 #include "platform/SharedBuffer.h"
 #include "platform/WebFrameScheduler.h"
 #include "platform/heap/Handle.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebLoadingBehaviorFlag.h"
 #include "public/platform/WebScheduler.h"

diff --git a/third_party/WebKit/Source/core/html/parser/HTMLParserScriptRunner.cpp b/third_party/WebKit/Source/core/html/parser/HTMLParserScriptRunner.cpp
index cded6c1..c01b999 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLParserScriptRunner.cpp
+++ b/third_party/WebKit/Source/core/html/parser/HTMLParserScriptRunner.cpp

@@ -42,8 +42,8 @@
 #include "core/loader/resource/ScriptResource.h"
 #include "platform/Histogram.h"
 #include "platform/WebFrameScheduler.h"
-#include "platform/tracing/TraceEvent.h"
-#include "platform/tracing/TracedValue.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TracedValue.h"
 #include "public/platform/Platform.h"
 #include <inttypes.h>
 #include <memory>

diff --git a/third_party/WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp b/third_party/WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp
index b15ceb4..881de8f4 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp
+++ b/third_party/WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp

@@ -48,9 +48,9 @@
 #include "core/html/parser/HTMLTokenizer.h"
 #include "core/loader/LinkLoader.h"
 #include "platform/Histogram.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/network/mime/ContentType.h"
 #include "platform/network/mime/MIMETypeRegistry.h"
-#include "platform/tracing/TraceEvent.h"
 #include <memory>
 
 namespace blink {

diff --git a/third_party/WebKit/Source/core/input/EventHandler.cpp b/third_party/WebKit/Source/core/input/EventHandler.cpp
index 56091e6..9c31d0a 100644
--- a/third_party/WebKit/Source/core/input/EventHandler.cpp
+++ b/third_party/WebKit/Source/core/input/EventHandler.cpp

@@ -94,9 +94,9 @@
 #include "platform/geometry/FloatPoint.h"
 #include "platform/graphics/Image.h"
 #include "platform/heap/Handle.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/scroll/ScrollAnimatorBase.h"
 #include "platform/scroll/Scrollbar.h"
-#include "platform/tracing/TraceEvent.h"
 #include "public/platform/WebInputEvent.h"
 #include "wtf/Assertions.h"
 #include "wtf/CurrentTime.h"

diff --git a/third_party/WebKit/Source/core/inspector/InspectorTraceEvents.cpp b/third_party/WebKit/Source/core/inspector/InspectorTraceEvents.cpp
index 9a57c8c..5dc9862 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorTraceEvents.cpp
+++ b/third_party/WebKit/Source/core/inspector/InspectorTraceEvents.cpp

@@ -27,10 +27,10 @@
 #include "core/xmlhttprequest/XMLHttpRequest.h"
 #include "platform/InstanceCounters.h"
 #include "platform/graphics/GraphicsLayer.h"
+#include "platform/instrumentation/tracing/TracedValue.h"
 #include "platform/network/ResourceLoadPriority.h"
 #include "platform/network/ResourceRequest.h"
 #include "platform/network/ResourceResponse.h"
-#include "platform/tracing/TracedValue.h"
 #include "platform/weborigin/KURL.h"
 #include "wtf/Vector.h"
 #include "wtf/text/TextPosition.h"

diff --git a/third_party/WebKit/Source/core/inspector/InspectorTraceEvents.h b/third_party/WebKit/Source/core/inspector/InspectorTraceEvents.h
index a48bcc32..87b8f26 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorTraceEvents.h
+++ b/third_party/WebKit/Source/core/inspector/InspectorTraceEvents.h

@@ -8,8 +8,8 @@
 #include "core/CoreExport.h"
 #include "core/css/CSSSelector.h"
 #include "platform/heap/Handle.h"
-#include "platform/tracing/TraceEvent.h"
-#include "platform/tracing/TracedValue.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TracedValue.h"
 #include "wtf/Forward.h"
 #include "wtf/Functional.h"
 #include <memory>

diff --git a/third_party/WebKit/Source/core/inspector/InspectorTracingAgent.cpp b/third_party/WebKit/Source/core/inspector/InspectorTracingAgent.cpp
index 1ed6b474..28678dc 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorTracingAgent.cpp
+++ b/third_party/WebKit/Source/core/inspector/InspectorTracingAgent.cpp

@@ -11,7 +11,7 @@
 #include "core/inspector/InspectedFrames.h"
 #include "core/inspector/InspectorTraceEvents.h"
 #include "core/inspector/InspectorWorkerAgent.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/core/layout/LayoutAnalyzer.cpp b/third_party/WebKit/Source/core/layout/LayoutAnalyzer.cpp
index 9ea6a7d6..509c15e 100644
--- a/third_party/WebKit/Source/core/layout/LayoutAnalyzer.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutAnalyzer.cpp

@@ -8,7 +8,7 @@
 #include "core/layout/LayoutBlock.h"
 #include "core/layout/LayoutObject.h"
 #include "core/layout/LayoutText.h"
-#include "platform/tracing/TracedValue.h"
+#include "platform/instrumentation/tracing/TracedValue.h"
 #include <memory>
 
 namespace blink {

diff --git a/third_party/WebKit/Source/core/layout/LayoutObject.cpp b/third_party/WebKit/Source/core/layout/LayoutObject.cpp
index 7e6d1b8..290a52f 100644
--- a/third_party/WebKit/Source/core/layout/LayoutObject.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutObject.cpp

@@ -80,7 +80,7 @@
 #include "platform/InstanceCounters.h"
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/geometry/TransformState.h"
-#include "platform/tracing/TracedValue.h"
+#include "platform/instrumentation/tracing/TracedValue.h"
 #include "wtf/allocator/Partitions.h"
 #include "wtf/text/StringBuilder.h"
 #include "wtf/text/WTFString.h"

diff --git a/third_party/WebKit/Source/core/layout/LayoutView.cpp b/third_party/WebKit/Source/core/layout/LayoutView.cpp
index e64bad4..5beaba00 100644
--- a/third_party/WebKit/Source/core/layout/LayoutView.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutView.cpp

@@ -44,8 +44,8 @@
 #include "platform/geometry/FloatQuad.h"
 #include "platform/geometry/TransformState.h"
 #include "platform/graphics/paint/PaintController.h"
-#include "platform/tracing/TraceEvent.h"
-#include "platform/tracing/TracedValue.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TracedValue.h"
 #include "public/platform/Platform.h"
 #include "wtf/PtrUtil.h"
 #include <inttypes.h>

diff --git a/third_party/WebKit/Source/core/layout/TracedLayoutObject.h b/third_party/WebKit/Source/core/layout/TracedLayoutObject.h
index a629245..c53ec521 100644
--- a/third_party/WebKit/Source/core/layout/TracedLayoutObject.h
+++ b/third_party/WebKit/Source/core/layout/TracedLayoutObject.h

@@ -5,7 +5,7 @@
 #ifndef TracedLayoutObject_h
 #define TracedLayoutObject_h
 
-#include "platform/tracing/TracedValue.h"
+#include "platform/instrumentation/tracing/TracedValue.h"
 #include <memory>
 
 namespace blink {

diff --git a/third_party/WebKit/Source/core/layout/compositing/CompositingInputsUpdater.cpp b/third_party/WebKit/Source/core/layout/compositing/CompositingInputsUpdater.cpp
index 24332fe..28324a3 100644
--- a/third_party/WebKit/Source/core/layout/compositing/CompositingInputsUpdater.cpp
+++ b/third_party/WebKit/Source/core/layout/compositing/CompositingInputsUpdater.cpp

@@ -12,7 +12,7 @@
 #include "core/layout/compositing/CompositedLayerMapping.h"
 #include "core/layout/compositing/PaintLayerCompositor.h"
 #include "core/paint/PaintLayer.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/core/layout/compositing/CompositingLayerAssigner.cpp b/third_party/WebKit/Source/core/layout/compositing/CompositingLayerAssigner.cpp
index 03ad486e..ed11c2c5 100644
--- a/third_party/WebKit/Source/core/layout/compositing/CompositingLayerAssigner.cpp
+++ b/third_party/WebKit/Source/core/layout/compositing/CompositingLayerAssigner.cpp

@@ -31,7 +31,7 @@
 #include "core/layout/compositing/CompositedLayerMapping.h"
 #include "core/page/Page.h"
 #include "core/page/scrolling/ScrollingCoordinator.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/core/layout/compositing/CompositingRequirementsUpdater.cpp b/third_party/WebKit/Source/core/layout/compositing/CompositingRequirementsUpdater.cpp
index 762ab7b..ae698fe6 100644
--- a/third_party/WebKit/Source/core/layout/compositing/CompositingRequirementsUpdater.cpp
+++ b/third_party/WebKit/Source/core/layout/compositing/CompositingRequirementsUpdater.cpp

@@ -31,7 +31,7 @@
 #include "core/paint/PaintLayer.h"
 #include "core/paint/PaintLayerStackingNode.h"
 #include "core/paint/PaintLayerStackingNodeIterator.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/core/layout/compositing/GraphicsLayerUpdater.cpp b/third_party/WebKit/Source/core/layout/compositing/GraphicsLayerUpdater.cpp
index 9978c50..ccec84d 100644
--- a/third_party/WebKit/Source/core/layout/compositing/GraphicsLayerUpdater.cpp
+++ b/third_party/WebKit/Source/core/layout/compositing/GraphicsLayerUpdater.cpp

@@ -31,7 +31,7 @@
 #include "core/layout/compositing/CompositedLayerMapping.h"
 #include "core/layout/compositing/PaintLayerCompositor.h"
 #include "core/paint/PaintLayer.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/core/layout/compositing/PaintLayerCompositor.cpp b/third_party/WebKit/Source/core/layout/compositing/PaintLayerCompositor.cpp
index d129904..e6946ab 100644
--- a/third_party/WebKit/Source/core/layout/compositing/PaintLayerCompositor.cpp
+++ b/third_party/WebKit/Source/core/layout/compositing/PaintLayerCompositor.cpp

@@ -67,8 +67,8 @@
 #include "platform/graphics/paint/PaintController.h"
 #include "platform/graphics/paint/SkPictureBuilder.h"
 #include "platform/graphics/paint/TransformDisplayItem.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/json/JSONValues.h"
-#include "platform/tracing/TraceEvent.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/core/loader/DocumentLoadTiming.cpp b/third_party/WebKit/Source/core/loader/DocumentLoadTiming.cpp
index ad37b6f..670e49b 100644
--- a/third_party/WebKit/Source/core/loader/DocumentLoadTiming.cpp
+++ b/third_party/WebKit/Source/core/loader/DocumentLoadTiming.cpp

@@ -26,7 +26,7 @@
 #include "core/loader/DocumentLoadTiming.h"
 
 #include "core/loader/DocumentLoader.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "wtf/RefPtr.h"
 

diff --git a/third_party/WebKit/Source/core/loader/FrameFetchContext.cpp b/third_party/WebKit/Source/core/loader/FrameFetchContext.cpp
index b823b31..c45604d4 100644
--- a/third_party/WebKit/Source/core/loader/FrameFetchContext.cpp
+++ b/third_party/WebKit/Source/core/loader/FrameFetchContext.cpp

@@ -68,11 +68,11 @@
 #include "core/timing/DOMWindowPerformance.h"
 #include "core/timing/Performance.h"
 #include "platform/WebFrameScheduler.h"
+#include "platform/instrumentation/tracing/TracedValue.h"
 #include "platform/mhtml/MHTMLArchive.h"
 #include "platform/network/NetworkUtils.h"
 #include "platform/network/ResourceLoadPriority.h"
 #include "platform/network/ResourceTimingInfo.h"
-#include "platform/tracing/TracedValue.h"
 #include "platform/weborigin/SchemeRegistry.h"
 #include "platform/weborigin/SecurityPolicy.h"
 #include "public/platform/WebCachePolicy.h"

diff --git a/third_party/WebKit/Source/core/loader/FrameLoader.cpp b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
index 89d17d0f..0dc6311 100644
--- a/third_party/WebKit/Source/core/loader/FrameLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/FrameLoader.cpp

@@ -89,10 +89,10 @@
 #include "platform/ScriptForbiddenScope.h"
 #include "platform/UserGestureIndicator.h"
 #include "platform/feature_policy/FeaturePolicy.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/network/HTTPParsers.h"
 #include "platform/network/ResourceRequest.h"
 #include "platform/scroll/ScrollAnimatorBase.h"
-#include "platform/tracing/TraceEvent.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "platform/weborigin/SecurityPolicy.h"
 #include "platform/weborigin/Suborigin.h"

diff --git a/third_party/WebKit/Source/core/loader/FrameLoader.h b/third_party/WebKit/Source/core/loader/FrameLoader.h
index d2fba45..3e98f0f 100644
--- a/third_party/WebKit/Source/core/loader/FrameLoader.h
+++ b/third_party/WebKit/Source/core/loader/FrameLoader.h

@@ -45,8 +45,8 @@
 #include "core/loader/NavigationPolicy.h"
 #include "platform/Timer.h"
 #include "platform/heap/Handle.h"
+#include "platform/instrumentation/tracing/TracedValue.h"
 #include "platform/network/ResourceRequest.h"
-#include "platform/tracing/TracedValue.h"
 #include "public/platform/WebInsecureRequestPolicy.h"
 #include "wtf/Forward.h"
 #include "wtf/HashSet.h"

diff --git a/third_party/WebKit/Source/core/loader/resource/ImageResource.cpp b/third_party/WebKit/Source/core/loader/resource/ImageResource.cpp
index a13e82a..07888c2 100644
--- a/third_party/WebKit/Source/core/loader/resource/ImageResource.cpp
+++ b/third_party/WebKit/Source/core/loader/resource/ImageResource.cpp

@@ -33,7 +33,7 @@
 #include "platform/Histogram.h"
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/SharedBuffer.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "public/platform/Platform.h"
 #include "wtf/CurrentTime.h"
 #include "wtf/StdLibExtras.h"

diff --git a/third_party/WebKit/Source/core/loader/resource/ImageResourceContent.cpp b/third_party/WebKit/Source/core/loader/resource/ImageResourceContent.cpp
index 15707f7..6099801 100644
--- a/third_party/WebKit/Source/core/loader/resource/ImageResourceContent.cpp
+++ b/third_party/WebKit/Source/core/loader/resource/ImageResourceContent.cpp

@@ -14,7 +14,7 @@
 #include "platform/geometry/IntSize.h"
 #include "platform/graphics/BitmapImage.h"
 #include "platform/graphics/PlaceholderImage.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "wtf/StdLibExtras.h"
 #include "wtf/Vector.h"
 #include <memory>

diff --git a/third_party/WebKit/Source/core/loader/resource/ScriptResource.cpp b/third_party/WebKit/Source/core/loader/resource/ScriptResource.cpp
index 28bb404..57d5197 100644
--- a/third_party/WebKit/Source/core/loader/resource/ScriptResource.cpp
+++ b/third_party/WebKit/Source/core/loader/resource/ScriptResource.cpp

@@ -31,9 +31,9 @@
 #include "core/fetch/ResourceClientWalker.h"
 #include "core/fetch/ResourceFetcher.h"
 #include "platform/SharedBuffer.h"
+#include "platform/instrumentation/tracing/web_memory_allocator_dump.h"
+#include "platform/instrumentation/tracing/web_process_memory_dump.h"
 #include "platform/network/mime/MIMETypeRegistry.h"
-#include "platform/tracing/web_memory_allocator_dump.h"
-#include "platform/tracing/web_process_memory_dump.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/core/page/PageAnimator.cpp b/third_party/WebKit/Source/core/page/PageAnimator.cpp
index 0fa50e1..9ba3ee6f 100644
--- a/third_party/WebKit/Source/core/page/PageAnimator.cpp
+++ b/third_party/WebKit/Source/core/page/PageAnimator.cpp

@@ -10,7 +10,7 @@
 #include "core/page/ChromeClient.h"
 #include "core/page/Page.h"
 #include "core/svg/SVGDocumentExtensions.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "wtf/AutoReset.h"
 
 namespace blink {

diff --git a/third_party/WebKit/Source/core/page/scrolling/ScrollingCoordinator.cpp b/third_party/WebKit/Source/core/page/scrolling/ScrollingCoordinator.cpp
index 3b603c8..833dd7e 100644
--- a/third_party/WebKit/Source/core/page/scrolling/ScrollingCoordinator.cpp
+++ b/third_party/WebKit/Source/core/page/scrolling/ScrollingCoordinator.cpp

@@ -51,13 +51,13 @@
 #include "platform/geometry/Region.h"
 #include "platform/geometry/TransformState.h"
 #include "platform/graphics/GraphicsLayer.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #if OS(MACOSX)
 #include "platform/mac/ScrollAnimatorMac.h"
 #endif
 #include "platform/scroll/MainThreadScrollingReason.h"
 #include "platform/scroll/ScrollAnimatorBase.h"
 #include "platform/scroll/ScrollbarTheme.h"
-#include "platform/tracing/TraceEvent.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebCompositorSupport.h"
 #include "public/platform/WebLayerPositionConstraint.h"

diff --git a/third_party/WebKit/Source/core/paint/FirstMeaningfulPaintDetector.cpp b/third_party/WebKit/Source/core/paint/FirstMeaningfulPaintDetector.cpp
index cc0bd77..e34e023 100644
--- a/third_party/WebKit/Source/core/paint/FirstMeaningfulPaintDetector.cpp
+++ b/third_party/WebKit/Source/core/paint/FirstMeaningfulPaintDetector.cpp

@@ -7,7 +7,7 @@
 #include "core/css/FontFaceSet.h"
 #include "core/fetch/ResourceFetcher.h"
 #include "core/paint/PaintTiming.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/core/paint/PaintLayer.cpp b/third_party/WebKit/Source/core/paint/PaintLayer.cpp
index 99697900..4f39b06 100644
--- a/third_party/WebKit/Source/core/paint/PaintLayer.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintLayer.cpp

@@ -81,7 +81,7 @@
 #include "platform/geometry/TransformState.h"
 #include "platform/graphics/CompositorFilterOperations.h"
 #include "platform/graphics/filters/Filter.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/transforms/TransformationMatrix.h"
 #include "wtf/PtrUtil.h"
 #include "wtf/StdLibExtras.h"

diff --git a/third_party/WebKit/Source/core/paint/PaintTiming.cpp b/third_party/WebKit/Source/core/paint/PaintTiming.cpp
index 2536ce0..2a62dcb 100644
--- a/third_party/WebKit/Source/core/paint/PaintTiming.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintTiming.cpp

@@ -9,7 +9,7 @@
 #include "core/frame/LocalFrame.h"
 #include "core/loader/DocumentLoader.h"
 #include "platform/WebFrameScheduler.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/core/svg/graphics/SVGImage.cpp b/third_party/WebKit/Source/core/svg/graphics/SVGImage.cpp
index a3321a0..f13a6b7 100644
--- a/third_party/WebKit/Source/core/svg/graphics/SVGImage.cpp
+++ b/third_party/WebKit/Source/core/svg/graphics/SVGImage.cpp

@@ -55,7 +55,7 @@
 #include "platform/graphics/paint/CullRect.h"
 #include "platform/graphics/paint/DrawingRecorder.h"
 #include "platform/graphics/paint/SkPictureBuilder.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "third_party/skia/include/core/SkPicture.h"
 #include "wtf/PassRefPtr.h"
 

diff --git a/third_party/WebKit/Source/core/testing/Internals.cpp b/third_party/WebKit/Source/core/testing/Internals.cpp
index 7e91730..639084b5 100644
--- a/third_party/WebKit/Source/core/testing/Internals.cpp
+++ b/third_party/WebKit/Source/core/testing/Internals.cpp

@@ -135,11 +135,11 @@
 #include "platform/geometry/LayoutRect.h"
 #include "platform/graphics/GraphicsLayer.h"
 #include "platform/heap/Handle.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/network/ResourceLoadPriority.h"
 #include "platform/scroll/ProgrammaticScrollAnimator.h"
 #include "platform/scroll/ScrollbarTheme.h"
 #include "platform/testing/URLTestHelpers.h"
-#include "platform/tracing/TraceEvent.h"
 #include "platform/weborigin/SchemeRegistry.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebConnectionType.h"

diff --git a/third_party/WebKit/Source/core/timing/PerformanceBase.cpp b/third_party/WebKit/Source/core/timing/PerformanceBase.cpp
index 2b8ea03..e77a457 100644
--- a/third_party/WebKit/Source/core/timing/PerformanceBase.cpp
+++ b/third_party/WebKit/Source/core/timing/PerformanceBase.cpp

@@ -433,9 +433,9 @@
   if (!hasObserverFor(PerformanceEntry::LongTask))
     return;
   PerformanceEntry* entry = PerformanceLongTaskTiming::create(
-      monotonicTimeToDOMHighResTimeStampInMillis(startTime),
-      monotonicTimeToDOMHighResTimeStampInMillis(endTime), name,
-      culpritFrameSrc, culpritFrameId, culpritFrameName);
+      monotonicTimeToDOMHighResTimeStamp(startTime),
+      monotonicTimeToDOMHighResTimeStamp(endTime), name, culpritFrameSrc,
+      culpritFrameId, culpritFrameName);
   notifyObserversOfEntry(*entry);
 }
 
@@ -562,11 +562,6 @@
       clampTimeResolution(timeInSeconds));
 }
 
-double PerformanceBase::monotonicTimeToDOMHighResTimeStampInMillis(
-    DOMHighResTimeStamp monotonicTime) const {
-  return monotonicTimeToDOMHighResTimeStamp(monotonicTime) * 1000;
-}
-
 DOMHighResTimeStamp PerformanceBase::now() const {
   return monotonicTimeToDOMHighResTimeStamp(monotonicallyIncreasingTime());
 }

diff --git a/third_party/WebKit/Source/core/timing/PerformanceBase.h b/third_party/WebKit/Source/core/timing/PerformanceBase.h
index 2418bd6..82d8590 100644
--- a/third_party/WebKit/Source/core/timing/PerformanceBase.h
+++ b/third_party/WebKit/Source/core/timing/PerformanceBase.h

@@ -78,7 +78,6 @@
   // document's time origin and has a time resolution that is safe for
   // exposing to web.
   DOMHighResTimeStamp monotonicTimeToDOMHighResTimeStamp(double) const;
-  double monotonicTimeToDOMHighResTimeStampInMillis(DOMHighResTimeStamp) const;
   DOMHighResTimeStamp now() const;
 
   double timeOrigin() const { return m_timeOrigin; }

diff --git a/third_party/WebKit/Source/core/timing/PerformanceLongTaskTiming.cpp b/third_party/WebKit/Source/core/timing/PerformanceLongTaskTiming.cpp
index f8266a5..6b9032c 100644
--- a/third_party/WebKit/Source/core/timing/PerformanceLongTaskTiming.cpp
+++ b/third_party/WebKit/Source/core/timing/PerformanceLongTaskTiming.cpp

@@ -8,13 +8,25 @@
 
 namespace blink {
 
+namespace {
+
+double clampToMillisecond(double timeInMillis) {
+  // Long task times are clamped to 1 millisecond for security.
+  return floor(timeInMillis);
+}
+
+}  // namespace
+
 PerformanceLongTaskTiming::PerformanceLongTaskTiming(double startTime,
                                                      double endTime,
                                                      String name,
                                                      String culpritFrameSrc,
                                                      String culpritFrameId,
                                                      String culpritFrameName)
-    : PerformanceEntry(name, "longtask", startTime, endTime),
+    : PerformanceEntry(name,
+                       "longtask",
+                       clampToMillisecond(startTime),
+                       clampToMillisecond(endTime)),
       m_culpritFrameSrc(culpritFrameSrc),
       m_culpritFrameId(culpritFrameId),
       m_culpritFrameName(culpritFrameName) {}

diff --git a/third_party/WebKit/Source/core/timing/PerformanceUserTiming.cpp b/third_party/WebKit/Source/core/timing/PerformanceUserTiming.cpp
index b4c66c7..7ef949d 100644
--- a/third_party/WebKit/Source/core/timing/PerformanceUserTiming.cpp
+++ b/third_party/WebKit/Source/core/timing/PerformanceUserTiming.cpp

@@ -31,7 +31,7 @@
 #include "core/timing/PerformanceMark.h"
 #include "core/timing/PerformanceMeasure.h"
 #include "platform/Histogram.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "public/platform/Platform.h"
 #include "wtf/text/StringHash.h"
 

diff --git a/third_party/WebKit/Source/core/workers/WorkerInspectorProxy.cpp b/third_party/WebKit/Source/core/workers/WorkerInspectorProxy.cpp
index b7d8c57..a47f701 100644
--- a/third_party/WebKit/Source/core/workers/WorkerInspectorProxy.cpp
+++ b/third_party/WebKit/Source/core/workers/WorkerInspectorProxy.cpp

@@ -13,7 +13,7 @@
 #include "core/workers/WorkerGlobalScope.h"
 #include "core/workers/WorkerThread.h"
 #include "platform/WebTaskRunner.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/weborigin/KURL.h"
 #include "public/platform/WebTraceLocation.h"
 

diff --git a/third_party/WebKit/Source/core/xml/parser/XMLDocumentParser.cpp b/third_party/WebKit/Source/core/xml/parser/XMLDocumentParser.cpp
index fecf34a6..e34934e 100644
--- a/third_party/WebKit/Source/core/xml/parser/XMLDocumentParser.cpp
+++ b/third_party/WebKit/Source/core/xml/parser/XMLDocumentParser.cpp

@@ -62,10 +62,10 @@
 #include "core/xml/parser/XMLParserInput.h"
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/SharedBuffer.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/network/ResourceError.h"
 #include "platform/network/ResourceRequest.h"
 #include "platform/network/ResourceResponse.h"
-#include "platform/tracing/TraceEvent.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "wtf/AutoReset.h"
 #include "wtf/PtrUtil.h"

diff --git a/third_party/WebKit/Source/devtools/front_end/network/NetworkDataGridNode.js b/third_party/WebKit/Source/devtools/front_end/network/NetworkDataGridNode.js
index 57690c4b..fcc888c 100644
--- a/third_party/WebKit/Source/devtools/front_end/network/NetworkDataGridNode.js
+++ b/third_party/WebKit/Source/devtools/front_end/network/NetworkDataGridNode.js

@@ -33,6 +33,84 @@
  */
 Network.NetworkNode = class extends UI.SortableDataGridNode {
   /**
+   * @param {!Network.NetworkLogView} parentView
+   */
+  constructor(parentView) {
+    super({});
+    this._parentView = parentView;
+    this._isHovered = false;
+    this._showingInitiatorChain = false;
+  }
+
+  /**
+   * @return {!Network.NetworkLogView}
+   */
+  parentView() {
+    return this._parentView;
+  }
+
+  /**
+   * @return {boolean}
+   */
+  hovered() {
+    return this._isHovered;
+  }
+
+  /**
+   * @return {boolean}
+   */
+  showingInitiatorChain() {
+    return this._showingInitiatorChain;
+  }
+
+  /**
+   * @override
+   * @return {number}
+   */
+  nodeSelfHeight() {
+    return this._parentView.rowHeight();
+  }
+
+  /**
+   * @param {boolean} hovered
+   * @param {boolean} showInitiatorChain
+   */
+  setHovered(hovered, showInitiatorChain) {
+    if (this._isHovered === hovered && this._showingInitiatorChain === showInitiatorChain)
+      return;
+    if (this._isHovered !== hovered) {
+      this._isHovered = hovered;
+      if (this.attached())
+        this.element().classList.toggle('hover', hovered);
+    }
+    if (this._showingInitiatorChain !== showInitiatorChain) {
+      this._showingInitiatorChain = showInitiatorChain;
+      this.showingInitiatorChainChanged();
+    }
+    this._parentView.stylesChanged();
+  }
+
+  /**
+   * @protected
+   */
+  showingInitiatorChainChanged() {
+  }
+
+  /**
+   * @return {boolean}
+   */
+  isOnInitiatorPath() {
+    return false;
+  }
+
+  /**
+   * @return {boolean}
+   */
+  isOnInitiatedPath() {
+    return false;
+  }
+
+  /**
    * @return {?SDK.NetworkRequest}
    */
   request() {
@@ -63,11 +141,12 @@
    * @param {!SDK.NetworkRequest} request
    */
   constructor(parentView, request) {
-    super({});
-    this._parentView = parentView;
+    super(parentView);
     this._request = request;
     this._isNavigationRequest = false;
     this.selectable = true;
+    this._isOnInitiatorPath = false;
+    this._isOnInitiatedPath = false;
   }
 
   /**
@@ -332,6 +411,67 @@
   }
 
   /**
+   * @override
+   */
+  showingInitiatorChainChanged() {
+    var showInitiatorChain = this.showingInitiatorChain();
+
+    var initiatorGraph = this._request.initiatorGraph();
+    for (var request of initiatorGraph.initiators) {
+      if (request === this._request)
+        continue;
+      var node = this.parentView().nodeForRequest(request);
+      if (!node)
+        continue;
+      node._setIsOnInitiatorPath(showInitiatorChain);
+    }
+    for (var request of initiatorGraph.initiated) {
+      if (request === this._request)
+        continue;
+      var node = this.parentView().nodeForRequest(request);
+      if (!node)
+        continue;
+      node._setIsOnInitiatedPath(showInitiatorChain);
+    }
+  }
+
+  /**
+   * @param {boolean} isOnInitiatorPath
+   */
+  _setIsOnInitiatorPath(isOnInitiatorPath) {
+    if (this._isOnInitiatorPath === isOnInitiatorPath || !this.attached())
+      return;
+    this._isOnInitiatorPath = isOnInitiatorPath;
+    this.element().classList.toggle('network-node-on-initiator-path', isOnInitiatorPath);
+  }
+
+  /**
+   * @override
+   * @return {boolean}
+   */
+  isOnInitiatorPath() {
+    return this._isOnInitiatorPath;
+  }
+
+  /**
+   * @param {boolean} isOnInitiatedPath
+   */
+  _setIsOnInitiatedPath(isOnInitiatedPath) {
+    if (this._isOnInitiatedPath === isOnInitiatedPath || !this.attached())
+      return;
+    this._isOnInitiatedPath = isOnInitiatedPath;
+    this.element().classList.toggle('network-node-on-initiated-path', isOnInitiatedPath);
+  }
+
+  /**
+   * @override
+   * @return {boolean}
+   */
+  isOnInitiatedPath() {
+    return this._isOnInitiatedPath;
+  }
+
+  /**
    * @return {string}
    */
   displayType() {
@@ -379,7 +519,7 @@
    * @return {number}
    */
   nodeSelfHeight() {
-    return this._parentView.rowHeight();
+    return this.parentView().rowHeight();
   }
 
   /**
@@ -495,7 +635,7 @@
 
   dispose() {
     if (this._linkifiedInitiatorAnchor)
-      this._parentView.linkifier.disposeAnchor(this._request.target(), this._linkifiedInitiatorAnchor);
+      this.parentView().linkifier.disposeAnchor(this._request.target(), this._linkifiedInitiatorAnchor);
   }
 
   /**
@@ -504,7 +644,7 @@
    */
   select(supressSelectedEvent) {
     super.select(supressSelectedEvent);
-    this._parentView.dispatchEventToListeners(Network.NetworkLogView.Events.RequestSelected, this._request);
+    this.parentView().dispatchEventToListeners(Network.NetworkLogView.Events.RequestSelected, this._request);
   }
 
   /**
@@ -637,7 +777,7 @@
 
       case SDK.NetworkRequest.InitiatorType.Script:
         if (!this._linkifiedInitiatorAnchor) {
-          this._linkifiedInitiatorAnchor = this._parentView.linkifier.linkifyScriptLocation(
+          this._linkifiedInitiatorAnchor = this.parentView().linkifier.linkifyScriptLocation(
               request.target(), initiator.scriptId, initiator.url, initiator.lineNumber, initiator.columnNumber);
           this._linkifiedInitiatorAnchor.title = '';
         }
@@ -709,20 +849,11 @@
    * @param {string} name
    */
   constructor(parentView, name) {
-    super({});
-    this._parentView = parentView;
+    super(parentView);
     this._name = name;
   }
 
   /**
-   * @override
-   * @return {number}
-   */
-  nodeSelfHeight() {
-    return this._parentView.rowHeight();
-  }
-
-  /**
    * @param {!Element} element
    * @param {string} text
    */
@@ -747,30 +878,6 @@
 
   /**
    * @override
-   * @return {null}
-   */
-  request() {
-    return null;
-  }
-
-  /**
-   * @override
-   * @return {boolean}
-   */
-  isNavigationRequest() {
-    return false;
-  }
-
-  /**
-   * @override
-   * @return {null}
-   */
-  asRequestNode() {
-    return null;
-  }
-
-  /**
-   * @override
    * @param {boolean=} supressSelectedEvent
    */
   select(supressSelectedEvent) {

diff --git a/third_party/WebKit/Source/devtools/front_end/network/NetworkLogView.js b/third_party/WebKit/Source/devtools/front_end/network/NetworkLogView.js
index 72b947b..3a5a3d8 100644
--- a/third_party/WebKit/Source/devtools/front_end/network/NetworkLogView.js
+++ b/third_party/WebKit/Source/devtools/front_end/network/NetworkLogView.js

@@ -336,6 +336,14 @@
   }
 
   /**
+   * @param {!SDK.NetworkRequest} request
+   * @return {?Network.NetworkNode}
+   */
+  nodeForRequest(request) {
+    return this._nodesByRequestId.get(request.requestId);
+  }
+
+  /**
    * @return {number}
    */
   headerHeight() {
@@ -515,7 +523,7 @@
     this._dataGrid.element.classList.add('network-log-grid');
     this._dataGrid.element.addEventListener('mousedown', this._dataGridMouseDown.bind(this), true);
     this._dataGrid.element.addEventListener('mousemove', this._dataGridMouseMove.bind(this), true);
-    this._dataGrid.element.addEventListener('mouseleave', this._dataGridMouseLeave.bind(this), true);
+    this._dataGrid.element.addEventListener('mouseleave', () => this._setHoveredNode(null), true);
   }
 
   /**
@@ -526,21 +534,6 @@
         /** @type {?Network.NetworkNode} */ (this._dataGrid.dataGridNodeFromNode(/** @type {!Node} */ (event.target)));
     var highlightInitiatorChain = event.shiftKey;
     this._setHoveredNode(node, highlightInitiatorChain);
-    this._highlightInitiatorChain((highlightInitiatorChain && node) ? node.request() : null);
-  }
-
-  _dataGridMouseLeave() {
-    this._setHoveredNode(null);
-    this._highlightInitiatorChain(null);
-  }
-
-  /**
-   * @param {?Network.NetworkNode} node
-   * @param {boolean} highlightInitiatorChain
-   */
-  setHoveredNode(node, highlightInitiatorChain) {
-    this._setHoveredNode(node, highlightInitiatorChain);
-    this._highlightInitiatorChain((node && highlightInitiatorChain) ? node.request() : null);
   }
 
   /**
@@ -549,11 +542,10 @@
    */
   _setHoveredNode(node, highlightInitiatorChain) {
     if (this._hoveredNode)
-      this._hoveredNode.element().classList.remove('hover');
+      this._hoveredNode.setHovered(false, false);
     this._hoveredNode = node;
     if (this._hoveredNode)
-      this._hoveredNode.element().classList.add('hover');
-    this._columns.setHoveredNode(this._hoveredNode, !!highlightInitiatorChain);
+      this._hoveredNode.setHovered(true, !!highlightInitiatorChain);
   }
 
   /**
@@ -564,35 +556,6 @@
       event.consume();
   }
 
-  /**
-   * @param {?SDK.NetworkRequest} request
-   */
-  _highlightInitiatorChain(request) {
-    if (this._requestWithHighlightedInitiators === request)
-      return;
-    this._requestWithHighlightedInitiators = request;
-
-    if (!request) {
-      for (var node of this._nodesByRequestId.values()) {
-        if (!node.dataGrid)
-          continue;
-        node.element().classList.remove('network-node-on-initiator-path', 'network-node-on-initiated-path');
-      }
-      return;
-    }
-
-    var initiatorGraph = request.initiatorGraph();
-    for (var node of this._nodesByRequestId.values()) {
-      if (!node.dataGrid)
-        continue;
-      node.element().classList.toggle(
-          'network-node-on-initiator-path',
-          node.request() !== request && initiatorGraph.initiators.has(node.request()));
-      node.element().classList.toggle(
-          'network-node-on-initiated-path', node.request() !== request && initiatorGraph.initiated.has(node.request()));
-    }
-  }
-
   _updateSummaryBar() {
     var requestsNumber = this._nodesByRequestId.size;
 
@@ -789,6 +752,10 @@
     return this._dataGrid.rootNode().flatChildren();
   }
 
+  stylesChanged() {
+    this._columns.scheduleRefresh();
+  }
+
   _refresh() {
     this._needsRefresh = false;
 

diff --git a/third_party/WebKit/Source/devtools/front_end/network/NetworkLogViewColumns.js b/third_party/WebKit/Source/devtools/front_end/network/NetworkLogViewColumns.js
index 8b52c9f..547090a 100644
--- a/third_party/WebKit/Source/devtools/front_end/network/NetworkLogViewColumns.js
+++ b/third_party/WebKit/Source/devtools/front_end/network/NetworkLogViewColumns.js

@@ -122,13 +122,6 @@
     this._waterfallColumn.element.addEventListener('mousewheel', this._onMouseWheel.bind(this, false), {passive: true});
     this._dataGridScroller.addEventListener('mousewheel', this._onMouseWheel.bind(this, true), true);
 
-    this._waterfallColumn.element.addEventListener('mousemove', event => {
-      var hoveredNode = this._waterfallColumn.getNodeFromPoint(event.offsetX, event.offsetY + event.target.offsetTop);
-      this._networkLogView.setHoveredNode(hoveredNode, event.shiftKey);
-    }, true);
-    this._waterfallColumn.element.addEventListener(
-        'mouseleave', this._networkLogView.setHoveredNode.bind(this._networkLogView, null, false), true);
-
     this._waterfallScroller = this._waterfallColumn.contentElement.createChild('div', 'network-waterfall-v-scroll');
     this._waterfallScroller.addEventListener('scroll', this._syncScrollers.bind(this), {passive: true});
     this._waterfallScrollerContent = this._waterfallScroller.createChild('div', 'network-waterfall-v-scroll-content');
@@ -171,8 +164,6 @@
       event.consume(true);
     this._activeScroller.scrollTop -= event.wheelDeltaY;
     this._syncScrollers();
-    var node = this._waterfallColumn.getNodeFromPoint(event.offsetX, event.offsetY);
-    this._networkLogView.setHoveredNode(node, event.shiftKey);
   }
 
   _syncScrollers() {
@@ -202,14 +193,6 @@
     this._waterfallColumn.update(this._activeScroller.scrollTop, this._eventDividers, nodes);
   }
 
-  /**
-   * @param {?Network.NetworkNode} node
-   * @param {boolean} highlightInitiatorChain
-   */
-  setHoveredNode(node, highlightInitiatorChain) {
-    this._waterfallColumn.setHoveredNode(node, highlightInitiatorChain);
-  }
-
   _createWaterfallHeader() {
     this._waterfallHeaderElement = this._waterfallColumn.contentElement.createChild('div', 'network-waterfall-header');
     this._waterfallHeaderElement.addEventListener('click', waterfallHeaderClicked.bind(this));
@@ -243,6 +226,10 @@
     this._waterfallRequestsAreStale = true;
   }
 
+  scheduleRefresh() {
+    this._waterfallColumn.scheduleDraw();
+  }
+
   _updateRowsSize() {
     var largeRows = !!this._networkLogLargeRowsSetting.get();
     this._dataGrid.element.classList.toggle('small', !largeRows);

diff --git a/third_party/WebKit/Source/devtools/front_end/network/NetworkWaterfallColumn.js b/third_party/WebKit/Source/devtools/front_end/network/NetworkWaterfallColumn.js
index bc1fa4a..f158413 100644
--- a/third_party/WebKit/Source/devtools/front_end/network/NetworkWaterfallColumn.js
+++ b/third_party/WebKit/Source/devtools/front_end/network/NetworkWaterfallColumn.js

@@ -39,8 +39,6 @@
 
     /** @type {?Network.NetworkNode} */
     this._hoveredNode = null;
-    /** @type {?SDK.NetworkRequest.InitiatorGraph} */
-    this._initiatorGraph = null;
 
     /** @type {!Map<string, !Array<number>>} */
     this._eventDividers = new Map();
@@ -57,6 +55,9 @@
     this._borderColorsForResourceTypeCache = new Map();
     /** @type {!Map<string, !CanvasGradient>} */
     this._colorsForResourceTypeCache = new Map();
+
+    this.element.addEventListener('mousemove', this._onMouseMove.bind(this), true);
+    this.element.addEventListener('mouseleave', event => this._setHoveredNode(null, false), true);
   }
 
   /**
@@ -74,6 +75,13 @@
   }
 
   /**
+   * @param {!Event} event
+   */
+  _onMouseMove(event) {
+    this._setHoveredNode(this.getNodeFromPoint(event.offsetX, event.offsetY), event.shiftKey);
+  }
+
+  /**
    * @param {!Element} element
    * @param {!Event} event
    * @return {!AnchorBox|undefined}
@@ -81,17 +89,17 @@
   _getPopoverAnchor(element, event) {
     if (!this._hoveredNode)
       return;
+    var request = this._hoveredNode.request();
+    if (!request)
+      return;
     var useTimingBars = !Common.moduleSetting('networkColorCodeResourceTypes').get() && !this._calculator.startAtZero;
     if (useTimingBars) {
-      var request = this._hoveredNode.request();
-      if (!request)
-        return;
       var range = Network.RequestTimingView.calculateRequestTimeRanges(request, 0)
                       .find(data => data.name === Network.RequestTimeRangeNames.Total);
       var start = this._timeToPosition(range.start);
       var end = this._timeToPosition(range.end);
     } else {
-      var range = this._getSimplifiedBarRange(this.request(), 0);
+      var range = this._getSimplifiedBarRange(request, 0);
       var start = range.start;
       var end = range.end;
     }
@@ -105,7 +113,7 @@
     if (event.clientX < this._canvasPosition.left + start || event.clientX > this._canvasPosition.left + end)
       return;
 
-    var rowIndex = this._nodes.findIndex(node => this._hoveredNode === node);
+    var rowIndex = this._nodes.findIndex(node => node.hovered());
     var barHeight = this._getBarHeight(range.name);
     var y = this._headerHeight + (this._rowHeight * rowIndex - this._scrollTop) + ((this._rowHeight - barHeight) / 2);
 
@@ -138,10 +146,12 @@
    * @param {?Network.NetworkNode} node
    * @param {boolean} highlightInitiatorChain
    */
-  setHoveredNode(node, highlightInitiatorChain) {
+  _setHoveredNode(node, highlightInitiatorChain) {
+    if (this._hoveredNode)
+      this._hoveredNode.setHovered(false, false);
     this._hoveredNode = node;
-    this._initiatorGraph = (highlightInitiatorChain && node && node.request()) ? node.request().initiatorGraph() : null;
-    this.update();
+    if (this._hoveredNode)
+      this._hoveredNode.setHovered(true, highlightInitiatorChain);
   }
 
   /**
@@ -194,8 +204,10 @@
    * @param {!Array<!Network.NetworkNode>=} nodes
    */
   update(scrollTop, eventDividers, nodes) {
-    if (scrollTop !== undefined)
+    if (scrollTop !== undefined && this._scrollTop !== scrollTop) {
+      this._popoverHelper.hidePopover();
       this._scrollTop = scrollTop;
+    }
     if (nodes) {
       this._nodes = nodes;
       this._calculateCanvasSize();
@@ -454,7 +466,7 @@
 
     /** @type {?{left: string, right: string, tooltip: (string|undefined)}} */
     var labels = null;
-    if (node === this._hoveredNode) {
+    if (node.hovered()) {
       labels = this._calculator.computeBarGraphLabels(request);
       this._drawSimplifiedBarDetails(
           context, labels.left, labels.right, ranges.start, ranges.mid, ranges.mid + barWidth + borderOffset);
@@ -585,7 +597,8 @@
    */
   _decorateRow(context, node, rowNumber, y) {
     var isOddRow = rowNumber % 2 === 1;
-    if (isOddRow && this._hoveredNode !== node && !node.isNavigationRequest() && !this._initiatorGraph)
+    if (isOddRow && !node.hovered() && !node.isNavigationRequest() && !node.isOnInitiatorPath() &&
+        !node.isOnInitiatedPath())
       return;
 
     var color = getRowColor.call(this);
@@ -603,15 +616,12 @@
      * @this {Network.NetworkWaterfallColumn}
      */
     function getRowColor() {
-      var request = node.request();
-      if (this._hoveredNode === node)
+      if (node.hovered())
         return this._rowHoverColor;
-      if (request && this._initiatorGraph) {
-        if (this._initiatorGraph.initiators.has(request))
-          return this._parentInitiatorColor;
-        if (this._initiatorGraph.initiated.has(request))
-          return this._initiatedColor;
-      }
+      if (node.isOnInitiatorPath())
+        return this._parentInitiatorColor;
+      if (node.isOnInitiatedPath())
+        return this._initiatedColor;
       if (node.isNavigationRequest())
         return this._rowNavigationRequestColor;
       if (rowNumber % 2 === 1)

diff --git a/third_party/WebKit/Source/devtools/front_end/persistence/Persistence.js b/third_party/WebKit/Source/devtools/front_end/persistence/Persistence.js
index 8ecf83d..f2594ad 100644
--- a/third_party/WebKit/Source/devtools/front_end/persistence/Persistence.js
+++ b/third_party/WebKit/Source/devtools/front_end/persistence/Persistence.js

@@ -17,6 +17,9 @@
     /** @type {!Map<string, number>} */
     this._filePathPrefixesToBindingCount = new Map();
 
+    /** @type {!Multimap<!Workspace.UISourceCode, function()>} */
+    this._subscribedBindingEventListeners = new Multimap();
+
     if (Runtime.experiments.isEnabled('persistence2')) {
       var linkDecorator = new Persistence.PersistenceUtils.LinkDecorator(this);
       Components.Linkifier.setLinkDecorator(linkDecorator);
@@ -94,6 +97,9 @@
     this._addFilePathBindingPrefixes(binding.fileSystem.url());
 
     this._moveBreakpoints(binding.fileSystem, binding.network);
+
+    this._notifyBindingEvent(binding.network);
+    this._notifyBindingEvent(binding.fileSystem);
     this.dispatchEventToListeners(Persistence.Persistence.Events.BindingCreated, binding);
   }
 
@@ -121,8 +127,10 @@
         Workspace.UISourceCode.Events.WorkingCopyChanged, this._onWorkingCopyChanged, this);
 
     this._removeFilePathBindingPrefixes(binding.fileSystem.url());
-
     this._breakpointManager.copyBreakpoints(binding.network.url(), binding.fileSystem);
+
+    this._notifyBindingEvent(binding.network);
+    this._notifyBindingEvent(binding.fileSystem);
     this.dispatchEventToListeners(Persistence.Persistence.Events.BindingRemoved, binding);
   }
 
@@ -268,6 +276,33 @@
 
   /**
    * @param {!Workspace.UISourceCode} uiSourceCode
+   * @param {function()} listener
+   */
+  subscribeForBindingEvent(uiSourceCode, listener) {
+    this._subscribedBindingEventListeners.set(uiSourceCode, listener);
+  }
+
+  /**
+   * @param {!Workspace.UISourceCode} uiSourceCode
+   * @param {function()} listener
+   */
+  unsubscribeFromBindingEvent(uiSourceCode, listener) {
+    this._subscribedBindingEventListeners.remove(uiSourceCode, listener);
+  }
+
+  /**
+   * @param {!Workspace.UISourceCode} uiSourceCode
+   */
+  _notifyBindingEvent(uiSourceCode) {
+    if (!this._subscribedBindingEventListeners.has(uiSourceCode))
+      return;
+    var listeners = Array.from(this._subscribedBindingEventListeners.get(uiSourceCode));
+    for (var listener of listeners)
+      listener.call(null);
+  }
+
+  /**
+   * @param {!Workspace.UISourceCode} uiSourceCode
    * @return {?Workspace.UISourceCode}
    */
   fileSystem(uiSourceCode) {

diff --git a/third_party/WebKit/Source/devtools/front_end/sources/SourcesView.js b/third_party/WebKit/Source/devtools/front_end/sources/SourcesView.js
index f7fd80c..e815b65 100644
--- a/third_party/WebKit/Source/devtools/front_end/sources/SourcesView.js
+++ b/third_party/WebKit/Source/devtools/front_end/sources/SourcesView.js

@@ -52,6 +52,7 @@
     this._scriptViewToolbar = new UI.Toolbar('', this._toolbarContainerElement);
     this._scriptViewToolbar.element.style.flex = 'auto';
     this._bottomToolbar = new UI.Toolbar('', this._toolbarContainerElement);
+    this._bindingChangeBound = this._onBindingChanged.bind(this);
 
     UI.startBatchUpdate();
     workspace.uiSourceCodes().forEach(this._addUISourceCode.bind(this));
@@ -89,11 +90,6 @@
 
     this._shortcuts = {};
     this.element.addEventListener('keydown', this._handleKeyDown.bind(this), false);
-
-    Persistence.persistence.addEventListener(
-        Persistence.Persistence.Events.BindingCreated, this._onBindingChanged, this);
-    Persistence.persistence.addEventListener(
-        Persistence.Persistence.Events.BindingRemoved, this._onBindingChanged, this);
   }
 
   /**
@@ -399,24 +395,17 @@
       /** @type {!Sources.UISourceCodeFrame} */ (sourceView).dispose();
   }
 
-  /**
-   * @param {!Common.Event} event
-   */
-  _onBindingChanged(event) {
-    if (!this._executionLocation)
-      return;
-    var binding = /** @type {!Persistence.PersistenceBinding} */ (event.data);
-    var uiSourceCode = this._executionLocation.uiSourceCode;
-    if (binding.network !== uiSourceCode)
-      return;
+  _onBindingChanged() {
     this.setExecutionLocation(this._executionLocation);
     this.showSourceLocation(
         this._executionLocation.uiSourceCode, this._executionLocation.lineNumber, this._executionLocation.columnNumber);
   }
 
   clearCurrentExecutionLine() {
-    if (this._executionSourceFrame)
-      this._executionSourceFrame.clearExecutionLine();
+    if (!this._executionLocation)
+      return;
+    Persistence.persistence.unsubscribeFromBindingEvent(this._executionLocation.uiSourceCode, this._bindingChangeBound);
+    this._executionSourceFrame.clearExecutionLine();
     this._executionSourceFrame = null;
     this._executionLocation = null;
   }
@@ -429,13 +418,14 @@
     var binding = Persistence.persistence.binding(uiLocation.uiSourceCode);
     var uiSourceCode = binding ? binding.fileSystem : uiLocation.uiSourceCode;
     var sourceView = this._getOrCreateSourceView(uiSourceCode);
-    if (sourceView instanceof Sources.UISourceCodeFrame) {
-      var sourceFrame = /** @type {!Sources.UISourceCodeFrame} */ (sourceView);
-      sourceFrame.setExecutionLocation(
-          new Workspace.UILocation(uiSourceCode, uiLocation.lineNumber, uiLocation.columnNumber));
-      this._executionSourceFrame = sourceFrame;
-      this._executionLocation = uiLocation;
-    }
+    if (!(sourceView instanceof Sources.UISourceCodeFrame))
+      return;
+    Persistence.persistence.subscribeForBindingEvent(uiLocation.uiSourceCode, this._bindingChangeBound);
+    var sourceFrame = /** @type {!Sources.UISourceCodeFrame} */ (sourceView);
+    sourceFrame.setExecutionLocation(
+        new Workspace.UILocation(uiSourceCode, uiLocation.lineNumber, uiLocation.columnNumber));
+    this._executionSourceFrame = sourceFrame;
+    this._executionLocation = uiLocation;
   }
 
   /**

diff --git a/third_party/WebKit/Source/devtools/front_end/sources/UISourceCodeFrame.js b/third_party/WebKit/Source/devtools/front_end/sources/UISourceCodeFrame.js
index 7ee4c75..7604cf9f 100644
--- a/third_party/WebKit/Source/devtools/front_end/sources/UISourceCodeFrame.js
+++ b/third_party/WebKit/Source/devtools/front_end/sources/UISourceCodeFrame.js

@@ -61,10 +61,7 @@
     this._messageAndDecorationListeners = [];
     this._installMessageAndDecorationListeners();
 
-    Persistence.persistence.addEventListener(
-        Persistence.Persistence.Events.BindingCreated, this._onBindingChanged, this);
-    Persistence.persistence.addEventListener(
-        Persistence.Persistence.Events.BindingRemoved, this._onBindingChanged, this);
+    Persistence.persistence.subscribeForBindingEvent(this._uiSourceCode, this._onBindingChanged.bind(this));
 
     this.textEditor.addEventListener(
         SourceFrame.SourcesTextEditor.Events.EditorBlurred,

diff --git a/third_party/WebKit/Source/devtools/front_end/timeline/TimelineController.js b/third_party/WebKit/Source/devtools/front_end/timeline/TimelineController.js
index cb11727..80358bb 100644
--- a/third_party/WebKit/Source/devtools/front_end/timeline/TimelineController.js
+++ b/third_party/WebKit/Source/devtools/front_end/timeline/TimelineController.js

@@ -51,9 +51,8 @@
       if (Common.moduleSetting('highResolutionCpuProfiling').get())
         categoriesArray.push(disabledByDefault('v8.cpu_profiler.hires'));
     }
-    if (options.captureCauses || options.enableJSSampling)
-      categoriesArray.push(disabledByDefault('devtools.timeline.stack'));
-    if (options.captureCauses && Runtime.experiments.isEnabled('timelineInvalidationTracking'))
+    categoriesArray.push(disabledByDefault('devtools.timeline.stack'));
+    if (Runtime.experiments.isEnabled('timelineInvalidationTracking'))
       categoriesArray.push(disabledByDefault('devtools.timeline.invalidationTracking'));
     if (options.capturePictures) {
       categoriesArray.push(
@@ -280,9 +279,7 @@
 };
 
 /** @typedef {!{
- *    captureCauses: (boolean|undefined),
  *    enableJSSampling: (boolean|undefined),
- *    captureMemory: (boolean|undefined),
  *    capturePictures: (boolean|undefined),
  *    captureFilmStrip: (boolean|undefined)
  *  }}

diff --git a/third_party/WebKit/Source/devtools/front_end/timeline/TimelineFlameChartView.js b/third_party/WebKit/Source/devtools/front_end/timeline/TimelineFlameChartView.js
index 7dbc9ce8..9f70886 100644
--- a/third_party/WebKit/Source/devtools/front_end/timeline/TimelineFlameChartView.js
+++ b/third_party/WebKit/Source/devtools/front_end/timeline/TimelineFlameChartView.js

@@ -463,17 +463,6 @@
     this._delegate.select(dataProvider.createSelection(entryIndex));
   }
 
-  /**
-   * @param {boolean} enable
-   * @param {boolean=} animate
-   */
-  enableNetworkPane(enable, animate) {
-    if (enable)
-      this._splitWidget.showBoth(animate);
-    else
-      this._splitWidget.hideSidebar(animate);
-  }
-
   resizeToPreferredHeights() {
     this._splitWidget.setSidebarSize(this._networkDataProvider.preferredHeight());
   }

diff --git a/third_party/WebKit/Source/devtools/front_end/timeline/TimelinePanel.js b/third_party/WebKit/Source/devtools/front_end/timeline/TimelinePanel.js
index 0ebe7ea..cf603e9 100644
--- a/third_party/WebKit/Source/devtools/front_end/timeline/TimelinePanel.js
+++ b/third_party/WebKit/Source/devtools/front_end/timeline/TimelinePanel.js

@@ -76,9 +76,7 @@
     /** @type {!Array<!Timeline.TimelineModeView>} */
     this._currentViews = [];
 
-    this._captureNetworkSetting = Common.settings.createSetting('timelineCaptureNetwork', false);
     this._captureJSProfileSetting = Common.settings.createSetting('timelineEnableJSSampling', true);
-    this._captureMemorySetting = Common.settings.createSetting('timelineCaptureMemory', false);
     this._captureLayersAndPicturesSetting = Common.settings.createSetting('timelineCaptureLayersAndPictures', false);
     this._captureFilmStripSetting = Common.settings.createSetting('timelineCaptureFilmStrip', false);
 
@@ -127,8 +125,6 @@
     Extensions.extensionServer.addEventListener(
         Extensions.ExtensionServer.Events.TraceProviderAdded, this._recreateToolbarItems, this);
 
-    this._captureNetworkSetting.addChangeListener(this._onNetworkChanged, this);
-    this._captureMemorySetting.addChangeListener(this._onModeChanged, this);
     this._captureFilmStripSetting.addChangeListener(this._onModeChanged, this);
 
     this._detailsSplitWidget.show(this._timelinePane.element);
@@ -478,24 +474,17 @@
     this._removeAllModeViews();
     this._flameChart = new Timeline.TimelineFlameChartView(
         this, this._model, this._frameModel, this._irModel, this._extensionTracingModels, this._filters);
-    this._flameChart.enableNetworkPane(this._captureNetworkSetting.get());
     this._addModeView(this._flameChart);
 
     if (showMemory) {
       this._addModeView(
           new Timeline.MemoryCountersGraph(this, this._model, [Timeline.TimelineUIUtils.visibleEventsFilter()]));
     }
-    this._flameChart.enableNetworkPane(true);
 
     this.doResize();
     this.select(null);
   }
 
-  _onNetworkChanged() {
-    if (this._flameChart)
-      this._flameChart.enableNetworkPane(this._captureNetworkSetting.get(), true);
-  }
-
   _onCPUThrottlingChanged() {
     if (!this._cpuThrottlingManager)
       return;
@@ -527,9 +516,7 @@
         provider => Timeline.TimelinePanel._settingForTraceProvider(provider).get());
 
     var captureOptions = {
-      captureCauses: true,
       enableJSSampling: this._captureJSProfileSetting.get(),
-      captureMemory: this._captureMemorySetting.get(),
       capturePictures: this._captureLayersAndPicturesSetting.get(),
       captureFilmStrip: this._captureFilmStripSetting.get()
     };

diff --git a/third_party/WebKit/Source/devtools/front_end/timeline/timelinePanel.css b/third_party/WebKit/Source/devtools/front_end/timeline/timelinePanel.css
index d94c188..79fa08f3 100644
--- a/third_party/WebKit/Source/devtools/front_end/timeline/timelinePanel.css
+++ b/third_party/WebKit/Source/devtools/front_end/timeline/timelinePanel.css

@@ -481,7 +481,8 @@
 }
 
 .timeline-overview-popover .frame .thumbnail img {
-    max-width: 200px;
+    max-width: 300px;
+    max-height: 500px;
 }
 
 .timeline-tree-view {

diff --git a/third_party/WebKit/Source/devtools/front_end/ui/Toolbar.js b/third_party/WebKit/Source/devtools/front_end/ui/Toolbar.js
index e552335b..8d2462c2 100644
--- a/third_party/WebKit/Source/devtools/front_end/ui/Toolbar.js
+++ b/third_party/WebKit/Source/devtools/front_end/ui/Toolbar.js

@@ -43,6 +43,7 @@
     this.element = parentElement ? parentElement.createChild('div') : createElement('div');
     this.element.className = className;
     this.element.classList.add('toolbar');
+    this._enabled = true;
     this._shadowRoot = UI.createShadowRootWithCoreStyles(this.element, 'ui/toolbar.css');
     this._contentElement = this._shadowRoot.createChild('div', 'toolbar-shadow');
     this._insertionPoint = this._contentElement.createChild('content');
@@ -219,8 +220,9 @@
    * @param {boolean} enabled
    */
   setEnabled(enabled) {
+    this._enabled = enabled;
     for (var item of this._items)
-      item.setEnabled(enabled);
+      item._applyEnabledState();
   }
 
   /**
@@ -229,6 +231,8 @@
   appendToolbarItem(item) {
     this._items.push(item);
     item._toolbar = this;
+    if (!this._enabled)
+      item._applyEnabledState();
     if (this._reverse)
       this._contentElement.insertBefore(item.element, this._insertionPoint.nextSibling);
     else
@@ -399,7 +403,7 @@
   }
 
   _applyEnabledState() {
-    this.element.disabled = !this._enabled;
+    this.element.disabled = !this._enabled || (this._toolbar && !this._toolbar._enabled);
   }
 
   /**
@@ -824,7 +828,7 @@
    * @override
    */
   _applyEnabledState() {
-    this._selectElement.disabled = !this._enabled;
+    this._selectElement.disabled = !this._enabled || (this._toolbar && !this._toolbar._enabled);
   }
 
   /**

diff --git a/third_party/WebKit/Source/modules/compositorworker/AnimationWorkletThread.cpp b/third_party/WebKit/Source/modules/compositorworker/AnimationWorkletThread.cpp
index dd38ef6..45bf88f 100644
--- a/third_party/WebKit/Source/modules/compositorworker/AnimationWorkletThread.cpp
+++ b/third_party/WebKit/Source/modules/compositorworker/AnimationWorkletThread.cpp

@@ -6,7 +6,7 @@
 
 #include "core/workers/WorkerThreadStartupData.h"
 #include "modules/compositorworker/AnimationWorkletGlobalScope.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "wtf/PtrUtil.h"
 

diff --git a/third_party/WebKit/Source/modules/compositorworker/CompositorWorkerThread.cpp b/third_party/WebKit/Source/modules/compositorworker/CompositorWorkerThread.cpp
index d4d3866..3df7759 100644
--- a/third_party/WebKit/Source/modules/compositorworker/CompositorWorkerThread.cpp
+++ b/third_party/WebKit/Source/modules/compositorworker/CompositorWorkerThread.cpp

@@ -7,7 +7,7 @@
 #include "core/workers/InProcessWorkerObjectProxy.h"
 #include "core/workers/WorkerThreadStartupData.h"
 #include "modules/compositorworker/CompositorWorkerGlobalScope.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "wtf/Assertions.h"
 #include <memory>
 

diff --git a/third_party/WebKit/Source/modules/indexeddb/IDBTracing.h b/third_party/WebKit/Source/modules/indexeddb/IDBTracing.h
index d39b876e..9348f8d 100644
--- a/third_party/WebKit/Source/modules/indexeddb/IDBTracing.h
+++ b/third_party/WebKit/Source/modules/indexeddb/IDBTracing.h

@@ -29,7 +29,7 @@
 #ifndef IDBTracing_h
 #define IDBTracing_h
 
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #define IDB_TRACE(a) TRACE_EVENT0("IndexedDB", (a));
 
 #endif  // IDBTracing_h

diff --git a/third_party/WebKit/Source/modules/mediasource/MediaSource.cpp b/third_party/WebKit/Source/modules/mediasource/MediaSource.cpp
index 2669cdde..88a34cc2 100644
--- a/third_party/WebKit/Source/modules/mediasource/MediaSource.cpp
+++ b/third_party/WebKit/Source/modules/mediasource/MediaSource.cpp

@@ -44,9 +44,9 @@
 #include "modules/mediasource/MediaSourceRegistry.h"
 #include "modules/mediasource/SourceBufferTrackBaseSupplement.h"
 #include "platform/RuntimeEnabledFeatures.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/network/mime/ContentType.h"
 #include "platform/network/mime/MIMETypeRegistry.h"
-#include "platform/tracing/TraceEvent.h"
 #include "public/platform/WebMediaSource.h"
 #include "public/platform/WebSourceBuffer.h"
 #include "wtf/PtrUtil.h"

diff --git a/third_party/WebKit/Source/modules/mediasource/SourceBuffer.cpp b/third_party/WebKit/Source/modules/mediasource/SourceBuffer.cpp
index 3c41ffcf..c78480d1 100644
--- a/third_party/WebKit/Source/modules/mediasource/SourceBuffer.cpp
+++ b/third_party/WebKit/Source/modules/mediasource/SourceBuffer.cpp

@@ -50,7 +50,7 @@
 #include "modules/mediasource/MediaSource.h"
 #include "modules/mediasource/SourceBufferTrackBaseSupplement.h"
 #include "platform/RuntimeEnabledFeatures.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "public/platform/WebSourceBuffer.h"
 #include "wtf/MathExtras.h"
 #include <limits>
@@ -1213,7 +1213,7 @@
   if (!appendSuccess) {
     m_pendingAppendData.clear();
     m_pendingAppendDataOffset = 0;
-    appendError(DecodeError);
+    appendError();
   } else {
     m_pendingAppendDataOffset += appendSize;
 
@@ -1269,8 +1269,8 @@
   scheduleEvent(EventTypeNames::updateend);
 }
 
-void SourceBuffer::appendError(AppendError err) {
-  BLINK_SBLOG << __func__ << " this=" << this << " AppendError=" << err;
+void SourceBuffer::appendError() {
+  BLINK_SBLOG << __func__ << " this=" << this;
   // Section 3.5.3 Append Error Algorithm
   // https://dvcs.w3.org/hg/html-media/raw-file/default/media-source/media-source.html#sourcebuffer-append-error
 
@@ -1290,12 +1290,7 @@
 
   // 5. If decode error is true, then run the end of stream algorithm with the
   // error parameter set to "decode".
-  if (err == DecodeError) {
-    m_source->endOfStream("decode", ASSERT_NO_EXCEPTION);
-  } else {
-    DCHECK_EQ(err, NoDecodeError);
-    // Nothing else to do in this case.
-  }
+  m_source->endOfStream("decode", ASSERT_NO_EXCEPTION);
 }
 
 DEFINE_TRACE(SourceBuffer) {

diff --git a/third_party/WebKit/Source/modules/mediasource/SourceBuffer.h b/third_party/WebKit/Source/modules/mediasource/SourceBuffer.h
index 8d5be07..6e4d9d6 100644
--- a/third_party/WebKit/Source/modules/mediasource/SourceBuffer.h
+++ b/third_party/WebKit/Source/modules/mediasource/SourceBuffer.h

@@ -117,8 +117,6 @@
   DECLARE_VIRTUAL_TRACE();
 
  private:
-  enum AppendError { NoDecodeError, DecodeError };
-
   SourceBuffer(std::unique_ptr<WebSourceBuffer>,
                MediaSource*,
                GenericEventQueue*);
@@ -131,7 +129,7 @@
   bool evictCodedFrames(size_t newDataSize);
   void appendBufferInternal(const unsigned char*, unsigned, ExceptionState&);
   void appendBufferAsyncPart();
-  void appendError(AppendError);
+  void appendError();
 
   void removeAsyncPart();
 

diff --git a/third_party/WebKit/Source/modules/webaudio/AudioWorkletThread.cpp b/third_party/WebKit/Source/modules/webaudio/AudioWorkletThread.cpp
index 0c222c6..46b891c 100644
--- a/third_party/WebKit/Source/modules/webaudio/AudioWorkletThread.cpp
+++ b/third_party/WebKit/Source/modules/webaudio/AudioWorkletThread.cpp

@@ -10,7 +10,7 @@
 #include "platform/CrossThreadFunctional.h"
 #include "platform/WaitableEvent.h"
 #include "platform/WebThreadSupportingGC.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "public/platform/Platform.h"
 #include "wtf/Assertions.h"

diff --git a/third_party/WebKit/Source/modules/websockets/InspectorWebSocketEvents.h b/third_party/WebKit/Source/modules/websockets/InspectorWebSocketEvents.h
index f196e4a..21f1597 100644
--- a/third_party/WebKit/Source/modules/websockets/InspectorWebSocketEvents.h
+++ b/third_party/WebKit/Source/modules/websockets/InspectorWebSocketEvents.h

@@ -7,8 +7,8 @@
 
 #include "core/inspector/InspectorTraceEvents.h"
 #include "platform/heap/Handle.h"
-#include "platform/tracing/TraceEvent.h"
-#include "platform/tracing/TracedValue.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TracedValue.h"
 #include "wtf/Forward.h"
 #include "wtf/Functional.h"
 #include <memory>

diff --git a/third_party/WebKit/Source/platform/BUILD.gn b/third_party/WebKit/Source/platform/BUILD.gn
index 48aa77c..d45fa60 100644
--- a/third_party/WebKit/Source/platform/BUILD.gn
+++ b/third_party/WebKit/Source/platform/BUILD.gn

@@ -1081,6 +1081,15 @@
     "image-encoders/PNGImageEncoder.h",
     "image-encoders/WEBPImageEncoder.cpp",
     "image-encoders/WEBPImageEncoder.h",
+    "instrumentation/tracing/MemoryCacheDumpProvider.cpp",
+    "instrumentation/tracing/MemoryCacheDumpProvider.h",
+    "instrumentation/tracing/TraceEvent.h",
+    "instrumentation/tracing/TracedValue.cpp",
+    "instrumentation/tracing/TracedValue.h",
+    "instrumentation/tracing/web_memory_allocator_dump.cc",
+    "instrumentation/tracing/web_memory_allocator_dump.h",
+    "instrumentation/tracing/web_process_memory_dump.cc",
+    "instrumentation/tracing/web_process_memory_dump.h",
     "json/JSONParser.cpp",
     "json/JSONParser.h",
     "json/JSONValues.cpp",
@@ -1348,15 +1357,6 @@
     "text/win/HyphenationWin.cpp",
     "threading/BackgroundTaskRunner.cpp",
     "threading/BackgroundTaskRunner.h",
-    "tracing/MemoryCacheDumpProvider.cpp",
-    "tracing/MemoryCacheDumpProvider.h",
-    "tracing/TraceEvent.h",
-    "tracing/TracedValue.cpp",
-    "tracing/TracedValue.h",
-    "tracing/web_memory_allocator_dump.cc",
-    "tracing/web_memory_allocator_dump.h",
-    "tracing/web_process_memory_dump.cc",
-    "tracing/web_process_memory_dump.h",
     "transforms/AffineTransform.cpp",
     "transforms/AffineTransform.h",
     "transforms/IdentityTransformOperation.h",
@@ -1753,6 +1753,8 @@
     "image-decoders/jpeg/JPEGImageDecoderTest.cpp",
     "image-decoders/png/PNGImageDecoderTest.cpp",
     "image-decoders/webp/WEBPImageDecoderTest.cpp",
+    "instrumentation/tracing/TracedValueTest.cpp",
+    "instrumentation/tracing/web_process_memory_dump_test.cc",
     "json/JSONParserTest.cpp",
     "json/JSONValuesTest.cpp",
     "mac/VersionUtilMacTest.mm",
@@ -1803,8 +1805,6 @@
     "text/TextEncodingDetectorTest.cpp",
     "text/UnicodeUtilitiesTest.cpp",
     "threading/BackgroundTaskRunnerTest.cpp",
-    "tracing/TracedValueTest.cpp",
-    "tracing/web_process_memory_dump_test.cc",
     "transforms/AffineTransformTest.cpp",
     "transforms/RotationTest.cpp",
     "transforms/TransformOperationsTest.cpp",

diff --git a/third_party/WebKit/Source/platform/MemoryCoordinator.cpp b/third_party/WebKit/Source/platform/MemoryCoordinator.cpp
index a768a50..c116f3e 100644
--- a/third_party/WebKit/Source/platform/MemoryCoordinator.cpp
+++ b/third_party/WebKit/Source/platform/MemoryCoordinator.cpp

@@ -7,7 +7,7 @@
 #include "base/sys_info.h"
 #include "platform/fonts/FontCache.h"
 #include "platform/graphics/ImageDecodingStore.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "wtf/allocator/Partitions.h"
 
 namespace blink {

diff --git a/third_party/WebKit/Source/platform/PlatformInstrumentation.h b/third_party/WebKit/Source/platform/PlatformInstrumentation.h
index 8c5ce10..239c3672 100644
--- a/third_party/WebKit/Source/platform/PlatformInstrumentation.h
+++ b/third_party/WebKit/Source/platform/PlatformInstrumentation.h

@@ -32,7 +32,7 @@
 #define PlatformInstrumentation_h
 
 #include "platform/PlatformExport.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "wtf/text/WTFString.h"
 
 namespace blink {

diff --git a/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in b/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in
index 50da78f..de0dc54 100644
--- a/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in
+++ b/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in

@@ -114,7 +114,7 @@
 FramebustingNeedsSameOriginOrUserGesture status=stable, settable_from_internals=True
 FullscreenUnprefixed status=test, settable_from_internals=True
 FrameTimingSupport status=experimental
-GamepadExtensions origin_trial_feature_name=WebVR
+GamepadExtensions status=test, origin_trial_feature_name=WebVR
 GeometryInterfaces status=experimental, implied_by=CompositorWorker
 GetUserMedia status=stable
 GlobalCacheStorage status=stable
@@ -258,7 +258,7 @@
 WebGLDraftExtensions status=experimental
 WebGLImageChromium
 WebUSB status=experimental, origin_trial_feature_name=WebUSB
-WebVR origin_trial_feature_name=WebVR
+WebVR status=test, origin_trial_feature_name=WebVR
 WebVTTRegions status=experimental
 V8BasedStructuredClone status=stable
 V8IdleTasks

diff --git a/third_party/WebKit/Source/platform/SharedBuffer.cpp b/third_party/WebKit/Source/platform/SharedBuffer.cpp
index dd8cc05..06900fee 100644
--- a/third_party/WebKit/Source/platform/SharedBuffer.cpp
+++ b/third_party/WebKit/Source/platform/SharedBuffer.cpp

@@ -26,7 +26,7 @@
 
 #include "platform/SharedBuffer.h"
 
-#include "platform/tracing/web_process_memory_dump.h"
+#include "platform/instrumentation/tracing/web_process_memory_dump.h"
 #include "wtf/text/UTF8.h"
 #include "wtf/text/Unicode.h"
 

diff --git a/third_party/WebKit/Source/platform/Timer.cpp b/third_party/WebKit/Source/platform/Timer.cpp
index 3d28ff4..5e056f8 100644
--- a/third_party/WebKit/Source/platform/Timer.cpp
+++ b/third_party/WebKit/Source/platform/Timer.cpp

@@ -26,7 +26,7 @@
 
 #include "platform/Timer.h"
 
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebScheduler.h"
 #include "wtf/AddressSanitizer.h"
@@ -96,10 +96,13 @@
     return;
   }
 
+  bool active = isActive();
   m_weakPtrFactory.revokeAll();
-
   m_webTaskRunner = taskRunner->clone();
 
+  if (!active)
+    return;
+
   double now = timerMonotonicallyIncreasingTime();
   double nextFireTime = std::max(m_nextFireTime, now);
   m_nextFireTime = 0;

diff --git a/third_party/WebKit/Source/platform/TimerTest.cpp b/third_party/WebKit/Source/platform/TimerTest.cpp
index 22885732..edbff11 100644
--- a/third_party/WebKit/Source/platform/TimerTest.cpp
+++ b/third_party/WebKit/Source/platform/TimerTest.cpp

@@ -695,5 +695,27 @@
   EXPECT_FALSE(taskRunner2->IsEmpty());
 }
 
+// This test checks that when inactive timer is moved to a different task
+// runner it isn't activated.
+TEST_F(TimerTest, MoveToNewTaskRunnerWithoutTasks) {
+  scoped_refptr<scheduler::TaskQueue> taskRunner1(
+      m_platform.rendererScheduler()->NewTimerTaskRunner(
+          scheduler::TaskQueue::QueueType::TEST));
+  scheduler::WebTaskRunnerImpl webTaskRunner1(taskRunner1);
+
+  scoped_refptr<scheduler::TaskQueue> taskRunner2(
+      m_platform.rendererScheduler()->NewTimerTaskRunner(
+          scheduler::TaskQueue::QueueType::TEST));
+  scheduler::WebTaskRunnerImpl webTaskRunner2(taskRunner2);
+
+  TimerForTest<TimerTest> timer(&webTaskRunner1, this,
+                                &TimerTest::countingTask);
+
+  m_platform.runUntilIdle();
+  EXPECT_TRUE(!m_runTimes.size());
+  EXPECT_TRUE(taskRunner1->IsEmpty());
+  EXPECT_TRUE(taskRunner2->IsEmpty());
+}
+
 }  // namespace
 }  // namespace blink

diff --git a/third_party/WebKit/Source/platform/exported/Platform.cpp b/third_party/WebKit/Source/platform/exported/Platform.cpp
index 404e0e5..70fee4a 100644
--- a/third_party/WebKit/Source/platform/exported/Platform.cpp
+++ b/third_party/WebKit/Source/platform/exported/Platform.cpp

@@ -36,7 +36,7 @@
 #include "platform/fonts/FontCacheMemoryDumpProvider.h"
 #include "platform/heap/BlinkGCMemoryDumpProvider.h"
 #include "platform/heap/GCTaskRunner.h"
-#include "platform/tracing/MemoryCacheDumpProvider.h"
+#include "platform/instrumentation/tracing/MemoryCacheDumpProvider.h"
 #include "public/platform/InterfaceProvider.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebPrerenderingSupport.h"

diff --git a/third_party/WebKit/Source/platform/fonts/FontCache.cpp b/third_party/WebKit/Source/platform/fonts/FontCache.cpp
index a4a98b19..07f07289 100644
--- a/third_party/WebKit/Source/platform/fonts/FontCache.cpp
+++ b/third_party/WebKit/Source/platform/fonts/FontCache.cpp

@@ -45,8 +45,8 @@
 #include "platform/fonts/TextRenderingMode.h"
 #include "platform/fonts/opentype/OpenTypeVerticalData.h"
 #include "platform/fonts/shaping/ShapeCache.h"
-#include "platform/tracing/web_memory_allocator_dump.h"
-#include "platform/tracing/web_process_memory_dump.h"
+#include "platform/instrumentation/tracing/web_memory_allocator_dump.h"
+#include "platform/instrumentation/tracing/web_process_memory_dump.h"
 #include "public/platform/Platform.h"
 #include "ui/gfx/font_list.h"
 #include "wtf/HashMap.h"

diff --git a/third_party/WebKit/Source/platform/fonts/WebFontDecoder.cpp b/third_party/WebKit/Source/platform/fonts/WebFontDecoder.cpp
index 722a68d..41dc288 100644
--- a/third_party/WebKit/Source/platform/fonts/WebFontDecoder.cpp
+++ b/third_party/WebKit/Source/platform/fonts/WebFontDecoder.cpp

@@ -34,7 +34,7 @@
 #include "platform/SharedBuffer.h"
 #include "platform/fonts/FontCache.h"
 #include "platform/graphics/skia/SkiaUtils.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "public/platform/Platform.h"
 #include "third_party/harfbuzz-ng/src/hb.h"
 #include "third_party/ots/include/ots-memory-stream.h"

diff --git a/third_party/WebKit/Source/platform/graphics/BitmapImage.cpp b/third_party/WebKit/Source/platform/graphics/BitmapImage.cpp
index 93a1e92..c0ad01ba 100644
--- a/third_party/WebKit/Source/platform/graphics/BitmapImage.cpp
+++ b/third_party/WebKit/Source/platform/graphics/BitmapImage.cpp

@@ -35,7 +35,7 @@
 #include "platform/graphics/ImageObserver.h"
 #include "platform/graphics/StaticBitmapImage.h"
 #include "platform/graphics/skia/SkiaUtils.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "third_party/skia/include/core/SkCanvas.h"
 #include "wtf/PassRefPtr.h"
 #include "wtf/PtrUtil.h"

diff --git a/third_party/WebKit/Source/platform/graphics/Canvas2DLayerBridge.cpp b/third_party/WebKit/Source/platform/graphics/Canvas2DLayerBridge.cpp
index 023b5a5..cd0597a 100644
--- a/third_party/WebKit/Source/platform/graphics/Canvas2DLayerBridge.cpp
+++ b/third_party/WebKit/Source/platform/graphics/Canvas2DLayerBridge.cpp

@@ -38,7 +38,7 @@
 #include "platform/graphics/GraphicsLayer.h"
 #include "platform/graphics/ImageBuffer.h"
 #include "platform/graphics/gpu/SharedContextRateLimiter.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebCompositorSupport.h"
 #include "public/platform/WebGraphicsContext3DProvider.h"

diff --git a/third_party/WebKit/Source/platform/graphics/ContentLayerDelegate.cpp b/third_party/WebKit/Source/platform/graphics/ContentLayerDelegate.cpp
index c8adc2a..10b886a 100644
--- a/third_party/WebKit/Source/platform/graphics/ContentLayerDelegate.cpp
+++ b/third_party/WebKit/Source/platform/graphics/ContentLayerDelegate.cpp

@@ -30,8 +30,8 @@
 #include "platform/graphics/GraphicsLayer.h"
 #include "platform/graphics/paint/PaintController.h"
 #include "platform/image-decoders/ImageDecoder.h"
-#include "platform/tracing/TraceEvent.h"
-#include "platform/tracing/TracedValue.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TracedValue.h"
 #include "public/platform/WebDisplayItemList.h"
 #include "public/platform/WebRect.h"
 #include "third_party/skia/include/core/SkPicture.h"

diff --git a/third_party/WebKit/Source/platform/graphics/DecodingImageGenerator.cpp b/third_party/WebKit/Source/platform/graphics/DecodingImageGenerator.cpp
index 29eefb7..8dfd3b4 100644
--- a/third_party/WebKit/Source/platform/graphics/DecodingImageGenerator.cpp
+++ b/third_party/WebKit/Source/platform/graphics/DecodingImageGenerator.cpp

@@ -30,7 +30,7 @@
 #include "platform/graphics/ImageFrameGenerator.h"
 #include "platform/image-decoders/ImageDecoder.h"
 #include "platform/image-decoders/SegmentReader.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "third_party/skia/include/core/SkData.h"
 #include <memory>
 

diff --git a/third_party/WebKit/Source/platform/graphics/FirstPaintInvalidationTracking.cpp b/third_party/WebKit/Source/platform/graphics/FirstPaintInvalidationTracking.cpp
index af48d5b..ec7f047 100644
--- a/third_party/WebKit/Source/platform/graphics/FirstPaintInvalidationTracking.cpp
+++ b/third_party/WebKit/Source/platform/graphics/FirstPaintInvalidationTracking.cpp

@@ -4,7 +4,7 @@
 
 #include "platform/graphics/FirstPaintInvalidationTracking.h"
 
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/platform/graphics/GraphicsContext.cpp b/third_party/WebKit/Source/platform/graphics/GraphicsContext.cpp
index b27784a4..c783956 100644
--- a/third_party/WebKit/Source/platform/graphics/GraphicsContext.cpp
+++ b/third_party/WebKit/Source/platform/graphics/GraphicsContext.cpp

@@ -34,7 +34,7 @@
 #include "platform/graphics/ImageBuffer.h"
 #include "platform/graphics/Path.h"
 #include "platform/graphics/paint/PaintController.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/weborigin/KURL.h"
 #include "skia/ext/platform_canvas.h"
 #include "third_party/skia/include/core/SkAnnotation.h"

diff --git a/third_party/WebKit/Source/platform/graphics/GraphicsLayer.cpp b/third_party/WebKit/Source/platform/graphics/GraphicsLayer.cpp
index d2a9211..78f7b5e9 100644
--- a/third_party/WebKit/Source/platform/graphics/GraphicsLayer.cpp
+++ b/third_party/WebKit/Source/platform/graphics/GraphicsLayer.cpp

@@ -42,10 +42,10 @@
 #include "platform/graphics/paint/DrawingRecorder.h"
 #include "platform/graphics/paint/PaintController.h"
 #include "platform/graphics/paint/RasterInvalidationTracking.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/json/JSONValues.h"
 #include "platform/scroll/ScrollableArea.h"
 #include "platform/text/TextStream.h"
-#include "platform/tracing/TraceEvent.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebCompositorSupport.h"
 #include "public/platform/WebFloatPoint.h"

diff --git a/third_party/WebKit/Source/platform/graphics/Image.cpp b/third_party/WebKit/Source/platform/graphics/Image.cpp
index 0531c450..065a8a3e 100644
--- a/third_party/WebKit/Source/platform/graphics/Image.cpp
+++ b/third_party/WebKit/Source/platform/graphics/Image.cpp

@@ -36,8 +36,8 @@
 #include "platform/graphics/BitmapImage.h"
 #include "platform/graphics/DeferredImageDecoder.h"
 #include "platform/graphics/GraphicsContext.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/network/mime/MIMETypeRegistry.h"
-#include "platform/tracing/TraceEvent.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebData.h"
 #include "third_party/skia/include/core/SkCanvas.h"

diff --git a/third_party/WebKit/Source/platform/graphics/ImageDecodingStore.cpp b/third_party/WebKit/Source/platform/graphics/ImageDecodingStore.cpp
index 6f755da7..3a6c3e6 100644
--- a/third_party/WebKit/Source/platform/graphics/ImageDecodingStore.cpp
+++ b/third_party/WebKit/Source/platform/graphics/ImageDecodingStore.cpp

@@ -26,7 +26,7 @@
 #include "platform/graphics/ImageDecodingStore.h"
 
 #include "platform/graphics/ImageFrameGenerator.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "wtf/Threading.h"
 #include <memory>
 

diff --git a/third_party/WebKit/Source/platform/graphics/ImageFrameGenerator.cpp b/third_party/WebKit/Source/platform/graphics/ImageFrameGenerator.cpp
index d6c4fc3..27e93bc 100644
--- a/third_party/WebKit/Source/platform/graphics/ImageFrameGenerator.cpp
+++ b/third_party/WebKit/Source/platform/graphics/ImageFrameGenerator.cpp

@@ -28,7 +28,7 @@
 #include "SkData.h"
 #include "platform/graphics/ImageDecodingStore.h"
 #include "platform/image-decoders/ImageDecoder.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "third_party/skia/include/core/SkYUVSizeInfo.h"
 #include "wtf/PtrUtil.h"
 #include <memory>

diff --git a/third_party/WebKit/Source/platform/graphics/gpu/DrawingBuffer.cpp b/third_party/WebKit/Source/platform/graphics/gpu/DrawingBuffer.cpp
index 547c1341..2b4a2a4 100644
--- a/third_party/WebKit/Source/platform/graphics/gpu/DrawingBuffer.cpp
+++ b/third_party/WebKit/Source/platform/graphics/gpu/DrawingBuffer.cpp

@@ -40,7 +40,7 @@
 #include "platform/graphics/ImageBuffer.h"
 #include "platform/graphics/WebGraphicsContext3DProviderWrapper.h"
 #include "platform/graphics/gpu/Extensions3DUtil.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebCompositorSupport.h"
 #include "public/platform/WebExternalBitmap.h"

diff --git a/third_party/WebKit/Source/platform/graphics/paint/PaintArtifact.cpp b/third_party/WebKit/Source/platform/graphics/paint/PaintArtifact.cpp
index fbc8c08..5983861 100644
--- a/third_party/WebKit/Source/platform/graphics/paint/PaintArtifact.cpp
+++ b/third_party/WebKit/Source/platform/graphics/paint/PaintArtifact.cpp

@@ -7,7 +7,7 @@
 #include "platform/geometry/IntRect.h"
 #include "platform/graphics/GraphicsLayer.h"
 #include "platform/graphics/paint/DrawingDisplayItem.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "public/platform/WebDisplayItemList.h"
 #include "third_party/skia/include/core/SkRegion.h"
 

diff --git a/third_party/WebKit/Source/platform/graphics/paint/PaintController.cpp b/third_party/WebKit/Source/platform/graphics/paint/PaintController.cpp
index d32ea34a..13da458 100644
--- a/third_party/WebKit/Source/platform/graphics/paint/PaintController.cpp
+++ b/third_party/WebKit/Source/platform/graphics/paint/PaintController.cpp

@@ -6,7 +6,7 @@
 
 #include "platform/graphics/GraphicsLayer.h"
 #include "platform/graphics/paint/DrawingDisplayItem.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "third_party/skia/include/core/SkPictureAnalyzer.h"
 #include "wtf/AutoReset.h"
 #include "wtf/text/StringBuilder.h"

diff --git a/third_party/WebKit/Source/platform/heap/BlinkGCMemoryDumpProvider.cpp b/third_party/WebKit/Source/platform/heap/BlinkGCMemoryDumpProvider.cpp
index 0a54f00..b4f686df 100644
--- a/third_party/WebKit/Source/platform/heap/BlinkGCMemoryDumpProvider.cpp
+++ b/third_party/WebKit/Source/platform/heap/BlinkGCMemoryDumpProvider.cpp

@@ -10,7 +10,7 @@
 #include "base/trace_event/process_memory_dump.h"
 #include "base/trace_event/trace_event_memory_overhead.h"
 #include "platform/heap/Handle.h"
-#include "platform/tracing/web_memory_allocator_dump.h"
+#include "platform/instrumentation/tracing/web_memory_allocator_dump.h"
 #include "public/platform/Platform.h"
 #include "wtf/StdLibExtras.h"
 #include "wtf/Threading.h"

diff --git a/third_party/WebKit/Source/platform/heap/Heap.cpp b/third_party/WebKit/Source/platform/heap/Heap.cpp
index c44068b..046c80f9 100644
--- a/third_party/WebKit/Source/platform/heap/Heap.cpp
+++ b/third_party/WebKit/Source/platform/heap/Heap.cpp

@@ -41,9 +41,9 @@
 #include "platform/heap/PagePool.h"
 #include "platform/heap/SafePoint.h"
 #include "platform/heap/ThreadState.h"
-#include "platform/tracing/TraceEvent.h"
-#include "platform/tracing/web_memory_allocator_dump.h"
-#include "platform/tracing/web_process_memory_dump.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/web_memory_allocator_dump.h"
+#include "platform/instrumentation/tracing/web_process_memory_dump.h"
 #include "public/platform/Platform.h"
 #include "wtf/Assertions.h"
 #include "wtf/CurrentTime.h"

diff --git a/third_party/WebKit/Source/platform/heap/HeapPage.cpp b/third_party/WebKit/Source/platform/heap/HeapPage.cpp
index c1940b3..6863654 100644
--- a/third_party/WebKit/Source/platform/heap/HeapPage.cpp
+++ b/third_party/WebKit/Source/platform/heap/HeapPage.cpp

@@ -41,9 +41,9 @@
 #include "platform/heap/PagePool.h"
 #include "platform/heap/SafePoint.h"
 #include "platform/heap/ThreadState.h"
-#include "platform/tracing/TraceEvent.h"
-#include "platform/tracing/web_memory_allocator_dump.h"
-#include "platform/tracing/web_process_memory_dump.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/web_memory_allocator_dump.h"
+#include "platform/instrumentation/tracing/web_process_memory_dump.h"
 #include "public/platform/Platform.h"
 #include "wtf/Assertions.h"
 #include "wtf/AutoReset.h"

diff --git a/third_party/WebKit/Source/platform/heap/ThreadState.cpp b/third_party/WebKit/Source/platform/heap/ThreadState.cpp
index 9d4756a..fa5ef1d 100644
--- a/third_party/WebKit/Source/platform/heap/ThreadState.cpp
+++ b/third_party/WebKit/Source/platform/heap/ThreadState.cpp

@@ -42,9 +42,9 @@
 #include "platform/heap/PagePool.h"
 #include "platform/heap/SafePoint.h"
 #include "platform/heap/Visitor.h"
-#include "platform/tracing/TraceEvent.h"
-#include "platform/tracing/web_memory_allocator_dump.h"
-#include "platform/tracing/web_process_memory_dump.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/web_memory_allocator_dump.h"
+#include "platform/instrumentation/tracing/web_process_memory_dump.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebScheduler.h"
 #include "public/platform/WebThread.h"

diff --git a/third_party/WebKit/Source/platform/instrumentation/DEPS b/third_party/WebKit/Source/platform/instrumentation/DEPS
new file mode 100644
index 0000000..18a8e5e
--- /dev/null
+++ b/third_party/WebKit/Source/platform/instrumentation/DEPS

@@ -0,0 +1,11 @@
+include_rules = [
+    "+base/gtest_prod_util.h",
+    "+base/json",
+    "+base/macros.h",
+    "+base/memory",
+    "+base/strings",
+    "+base/time",
+    "+base/trace_event",
+    "+base/values.h",
+    "+skia/ext/skia_trace_memory_dump_impl.h",
+]

diff --git a/third_party/WebKit/Source/platform/tracing/OWNERS b/third_party/WebKit/Source/platform/instrumentation/OWNERS
similarity index 100%
rename from third_party/WebKit/Source/platform/tracing/OWNERS
rename to third_party/WebKit/Source/platform/instrumentation/OWNERS


diff --git a/third_party/WebKit/Source/platform/tracing/MemoryCacheDumpProvider.cpp b/third_party/WebKit/Source/platform/instrumentation/tracing/MemoryCacheDumpProvider.cpp
similarity index 94%
rename from third_party/WebKit/Source/platform/tracing/MemoryCacheDumpProvider.cpp
rename to third_party/WebKit/Source/platform/instrumentation/tracing/MemoryCacheDumpProvider.cpp
index 437d9bc..095a6fc 100644
--- a/third_party/WebKit/Source/platform/tracing/MemoryCacheDumpProvider.cpp
+++ b/third_party/WebKit/Source/platform/instrumentation/tracing/MemoryCacheDumpProvider.cpp

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "platform/tracing/MemoryCacheDumpProvider.h"
+#include "platform/instrumentation/tracing/MemoryCacheDumpProvider.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/platform/tracing/MemoryCacheDumpProvider.h b/third_party/WebKit/Source/platform/instrumentation/tracing/MemoryCacheDumpProvider.h
similarity index 95%
rename from third_party/WebKit/Source/platform/tracing/MemoryCacheDumpProvider.h
rename to third_party/WebKit/Source/platform/instrumentation/tracing/MemoryCacheDumpProvider.h
index 8cf8b9e..22b2ee6 100644
--- a/third_party/WebKit/Source/platform/tracing/MemoryCacheDumpProvider.h
+++ b/third_party/WebKit/Source/platform/instrumentation/tracing/MemoryCacheDumpProvider.h

@@ -9,7 +9,7 @@
 #include "base/trace_event/process_memory_dump.h"
 #include "platform/PlatformExport.h"
 #include "platform/heap/Handle.h"
-#include "platform/tracing/web_process_memory_dump.h"
+#include "platform/instrumentation/tracing/web_process_memory_dump.h"
 #include "wtf/Allocator.h"
 
 namespace blink {

diff --git a/third_party/WebKit/Source/platform/tracing/TraceEvent.h b/third_party/WebKit/Source/platform/instrumentation/tracing/TraceEvent.h
similarity index 100%
rename from third_party/WebKit/Source/platform/tracing/TraceEvent.h
rename to third_party/WebKit/Source/platform/instrumentation/tracing/TraceEvent.h


diff --git a/third_party/WebKit/Source/platform/tracing/TracedValue.cpp b/third_party/WebKit/Source/platform/instrumentation/tracing/TracedValue.cpp
similarity index 97%
rename from third_party/WebKit/Source/platform/tracing/TracedValue.cpp
rename to third_party/WebKit/Source/platform/instrumentation/tracing/TracedValue.cpp
index 534b26a9..2a6637b 100644
--- a/third_party/WebKit/Source/platform/tracing/TracedValue.cpp
+++ b/third_party/WebKit/Source/platform/instrumentation/tracing/TracedValue.cpp

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "platform/tracing/TracedValue.h"
+#include "platform/instrumentation/tracing/TracedValue.h"
 
 #include "wtf/PtrUtil.h"
 #include "wtf/text/StringUTF8Adaptor.h"

diff --git a/third_party/WebKit/Source/platform/tracing/TracedValue.h b/third_party/WebKit/Source/platform/instrumentation/tracing/TracedValue.h
similarity index 100%
rename from third_party/WebKit/Source/platform/tracing/TracedValue.h
rename to third_party/WebKit/Source/platform/instrumentation/tracing/TracedValue.h


diff --git a/third_party/WebKit/Source/platform/tracing/TracedValueTest.cpp b/third_party/WebKit/Source/platform/instrumentation/tracing/TracedValueTest.cpp
similarity index 98%
rename from third_party/WebKit/Source/platform/tracing/TracedValueTest.cpp
rename to third_party/WebKit/Source/platform/instrumentation/tracing/TracedValueTest.cpp
index 1552ad3..0f4a86ee 100644
--- a/third_party/WebKit/Source/platform/tracing/TracedValueTest.cpp
+++ b/third_party/WebKit/Source/platform/instrumentation/tracing/TracedValueTest.cpp

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "platform/tracing/TracedValue.h"
+#include "platform/instrumentation/tracing/TracedValue.h"
 
 #include "base/json/json_reader.h"
 #include "base/values.h"

diff --git a/third_party/WebKit/Source/platform/tracing/web_memory_allocator_dump.cc b/third_party/WebKit/Source/platform/instrumentation/tracing/web_memory_allocator_dump.cc
similarity index 95%
rename from third_party/WebKit/Source/platform/tracing/web_memory_allocator_dump.cc
rename to third_party/WebKit/Source/platform/instrumentation/tracing/web_memory_allocator_dump.cc
index 099e45a..275c3b2 100644
--- a/third_party/WebKit/Source/platform/tracing/web_memory_allocator_dump.cc
+++ b/third_party/WebKit/Source/platform/instrumentation/tracing/web_memory_allocator_dump.cc

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "platform/tracing/web_memory_allocator_dump.h"
+#include "platform/instrumentation/tracing/web_memory_allocator_dump.h"
 
 #include "base/trace_event/memory_allocator_dump.h"
 #include "wtf/text/StringUTF8Adaptor.h"

diff --git a/third_party/WebKit/Source/platform/tracing/web_memory_allocator_dump.h b/third_party/WebKit/Source/platform/instrumentation/tracing/web_memory_allocator_dump.h
similarity index 100%
rename from third_party/WebKit/Source/platform/tracing/web_memory_allocator_dump.h
rename to third_party/WebKit/Source/platform/instrumentation/tracing/web_memory_allocator_dump.h


diff --git a/third_party/WebKit/Source/platform/tracing/web_process_memory_dump.cc b/third_party/WebKit/Source/platform/instrumentation/tracing/web_process_memory_dump.cc
similarity index 97%
rename from third_party/WebKit/Source/platform/tracing/web_process_memory_dump.cc
rename to third_party/WebKit/Source/platform/instrumentation/tracing/web_process_memory_dump.cc
index 625666fa..8030ded 100644
--- a/third_party/WebKit/Source/platform/tracing/web_process_memory_dump.cc
+++ b/third_party/WebKit/Source/platform/instrumentation/tracing/web_process_memory_dump.cc

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "platform/tracing/web_process_memory_dump.h"
+#include "platform/instrumentation/tracing/web_process_memory_dump.h"
 
 #include "base/memory/discardable_memory.h"
 #include "base/memory/ptr_util.h"
@@ -11,7 +11,7 @@
 #include "base/trace_event/process_memory_dump.h"
 #include "base/trace_event/trace_event_argument.h"
 #include "base/trace_event/trace_event_memory_overhead.h"
-#include "platform/tracing/web_memory_allocator_dump.h"
+#include "platform/instrumentation/tracing/web_memory_allocator_dump.h"
 #include "skia/ext/skia_trace_memory_dump_impl.h"
 #include "wtf/text/StringUTF8Adaptor.h"
 

diff --git a/third_party/WebKit/Source/platform/tracing/web_process_memory_dump.h b/third_party/WebKit/Source/platform/instrumentation/tracing/web_process_memory_dump.h
similarity index 98%
rename from third_party/WebKit/Source/platform/tracing/web_process_memory_dump.h
rename to third_party/WebKit/Source/platform/instrumentation/tracing/web_process_memory_dump.h
index 3d3c755..d1f8474 100644
--- a/third_party/WebKit/Source/platform/tracing/web_process_memory_dump.h
+++ b/third_party/WebKit/Source/platform/instrumentation/tracing/web_process_memory_dump.h

@@ -10,7 +10,7 @@
 #include "base/trace_event/heap_profiler_allocation_context.h"
 #include "base/trace_event/memory_dump_request_args.h"
 #include "platform/PlatformExport.h"
-#include "platform/tracing/web_memory_allocator_dump.h"
+#include "platform/instrumentation/tracing/web_memory_allocator_dump.h"
 #include "wtf/HashMap.h"
 #include "wtf/text/WTFString.h"
 #include <map>

diff --git a/third_party/WebKit/Source/platform/tracing/web_process_memory_dump_test.cc b/third_party/WebKit/Source/platform/instrumentation/tracing/web_process_memory_dump_test.cc
similarity index 97%
rename from third_party/WebKit/Source/platform/tracing/web_process_memory_dump_test.cc
rename to third_party/WebKit/Source/platform/instrumentation/tracing/web_process_memory_dump_test.cc
index de85cb39c..cd71bb4 100644
--- a/third_party/WebKit/Source/platform/tracing/web_process_memory_dump_test.cc
+++ b/third_party/WebKit/Source/platform/instrumentation/tracing/web_process_memory_dump_test.cc

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "platform/tracing/web_process_memory_dump.h"
+#include "platform/instrumentation/tracing/web_process_memory_dump.h"
 
 #include "base/memory/discardable_memory.h"
 #include "base/test/test_discardable_memory_allocator.h"
@@ -10,7 +10,7 @@
 #include "base/trace_event/process_memory_dump.h"
 #include "base/trace_event/trace_event_argument.h"
 #include "base/values.h"
-#include "platform/tracing/web_memory_allocator_dump.h"
+#include "platform/instrumentation/tracing/web_memory_allocator_dump.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace blink {

diff --git a/third_party/WebKit/Source/platform/network/NetworkInstrumentation.cpp b/third_party/WebKit/Source/platform/network/NetworkInstrumentation.cpp
index f5aa724..0899461 100644
--- a/third_party/WebKit/Source/platform/network/NetworkInstrumentation.cpp
+++ b/third_party/WebKit/Source/platform/network/NetworkInstrumentation.cpp

@@ -5,9 +5,9 @@
 #include "platform/network/NetworkInstrumentation.h"
 
 #include "base/trace_event/trace_event.h"
+#include "platform/instrumentation/tracing/TracedValue.h"
 #include "platform/network/ResourceLoadPriority.h"
 #include "platform/network/ResourceRequest.h"
-#include "platform/tracing/TracedValue.h"
 
 namespace network_instrumentation {
 

diff --git a/third_party/WebKit/Source/platform/network/ResourceLoadTiming.cpp b/third_party/WebKit/Source/platform/network/ResourceLoadTiming.cpp
index 311efc6..60802bc 100644
--- a/third_party/WebKit/Source/platform/network/ResourceLoadTiming.cpp
+++ b/third_party/WebKit/Source/platform/network/ResourceLoadTiming.cpp

@@ -4,7 +4,7 @@
 
 #include "platform/network/ResourceLoadTiming.h"
 
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 
 namespace blink {
 

diff --git a/third_party/WebKit/Source/platform/scroll/ScrollAnimator.cpp b/third_party/WebKit/Source/platform/scroll/ScrollAnimator.cpp
index 65c2fb1..4c27d32 100644
--- a/third_party/WebKit/Source/platform/scroll/ScrollAnimator.cpp
+++ b/third_party/WebKit/Source/platform/scroll/ScrollAnimator.cpp

@@ -33,9 +33,9 @@
 #include "cc/animation/scroll_offset_animation_curve.h"
 #include "platform/animation/CompositorAnimation.h"
 #include "platform/graphics/GraphicsLayer.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/scroll/MainThreadScrollingReason.h"
 #include "platform/scroll/ScrollableArea.h"
-#include "platform/tracing/TraceEvent.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebCompositorSupport.h"
 #include "wtf/CurrentTime.h"

diff --git a/third_party/WebKit/Source/platform/scroll/ScrollableArea.cpp b/third_party/WebKit/Source/platform/scroll/ScrollableArea.cpp
index 18576a9..0e1681e 100644
--- a/third_party/WebKit/Source/platform/scroll/ScrollableArea.cpp
+++ b/third_party/WebKit/Source/platform/scroll/ScrollableArea.cpp

@@ -33,12 +33,11 @@
 
 #include "platform/HostWindow.h"
 #include "platform/graphics/GraphicsLayer.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/scroll/MainThreadScrollingReason.h"
 #include "platform/scroll/ProgrammaticScrollAnimator.h"
 #include "platform/scroll/ScrollbarTheme.h"
 
-#include "platform/tracing/TraceEvent.h"
-
 static const int kPixelsPerLineStep = 40;
 static const float kMinFractionToStepWhenPaging = 0.875f;
 

diff --git a/third_party/WebKit/Source/web/CompositorMutatorImpl.cpp b/third_party/WebKit/Source/web/CompositorMutatorImpl.cpp
index 43576d2..a3a64ea 100644
--- a/third_party/WebKit/Source/web/CompositorMutatorImpl.cpp
+++ b/third_party/WebKit/Source/web/CompositorMutatorImpl.cpp

@@ -11,7 +11,7 @@
 #include "platform/graphics/CompositorMutationsTarget.h"
 #include "platform/graphics/CompositorMutatorClient.h"
 #include "platform/heap/Handle.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "public/platform/Platform.h"
 #include "web/CompositorProxyClientImpl.h"
 #include "wtf/PtrUtil.h"

diff --git a/third_party/WebKit/Source/web/CompositorProxyClientImpl.cpp b/third_party/WebKit/Source/web/CompositorProxyClientImpl.cpp
index 4ebda27..07275554 100644
--- a/third_party/WebKit/Source/web/CompositorProxyClientImpl.cpp
+++ b/third_party/WebKit/Source/web/CompositorProxyClientImpl.cpp

@@ -7,7 +7,7 @@
 #include "core/dom/CompositorProxy.h"
 #include "modules/compositorworker/CompositorWorkerGlobalScope.h"
 #include "platform/graphics/CompositorMutableStateProvider.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "web/CompositorMutatorImpl.h"
 #include "wtf/CurrentTime.h"
 

diff --git a/third_party/WebKit/Source/web/WebDevToolsAgentImpl.cpp b/third_party/WebKit/Source/web/WebDevToolsAgentImpl.cpp
index d3704bac..9c9a0ea 100644
--- a/third_party/WebKit/Source/web/WebDevToolsAgentImpl.cpp
+++ b/third_party/WebKit/Source/web/WebDevToolsAgentImpl.cpp

@@ -69,7 +69,7 @@
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/graphics/GraphicsContext.h"
 #include "platform/graphics/paint/PaintController.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebLayerTreeView.h"
 #include "public/platform/WebRect.h"

diff --git a/third_party/WebKit/Source/web/WebFrameSerializer.cpp b/third_party/WebKit/Source/web/WebFrameSerializer.cpp
index 97e8c4f..08bb204 100644
--- a/third_party/WebKit/Source/web/WebFrameSerializer.cpp
+++ b/third_party/WebKit/Source/web/WebFrameSerializer.cpp

@@ -46,11 +46,11 @@
 #include "platform/Histogram.h"
 #include "platform/SerializedResource.h"
 #include "platform/SharedBuffer.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/mhtml/MHTMLArchive.h"
 #include "platform/mhtml/MHTMLParser.h"
 #include "platform/network/ResourceRequest.h"
 #include "platform/network/ResourceResponse.h"
-#include "platform/tracing/TraceEvent.h"
 #include "platform/weborigin/KURL.h"
 #include "public/platform/WebString.h"
 #include "public/platform/WebURL.h"

diff --git a/third_party/WebKit/Source/web/WebLocalFrameImpl.cpp b/third_party/WebKit/Source/web/WebLocalFrameImpl.cpp
index 2f43443..535bf42 100644
--- a/third_party/WebKit/Source/web/WebLocalFrameImpl.cpp
+++ b/third_party/WebKit/Source/web/WebLocalFrameImpl.cpp

@@ -172,10 +172,10 @@
 #include "platform/graphics/paint/SkPictureBuilder.h"
 #include "platform/graphics/skia/SkiaUtils.h"
 #include "platform/heap/Handle.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/network/ResourceRequest.h"
 #include "platform/scroll/ScrollTypes.h"
 #include "platform/scroll/ScrollbarTheme.h"
-#include "platform/tracing/TraceEvent.h"
 #include "platform/weborigin/KURL.h"
 #include "platform/weborigin/SchemeRegistry.h"
 #include "platform/weborigin/SecurityPolicy.h"

diff --git a/third_party/WebKit/Source/web/WebPagePopupImpl.cpp b/third_party/WebKit/Source/web/WebPagePopupImpl.cpp
index d2a8c441..bdd2be2 100644
--- a/third_party/WebKit/Source/web/WebPagePopupImpl.cpp
+++ b/third_party/WebKit/Source/web/WebPagePopupImpl.cpp

@@ -53,7 +53,7 @@
 #include "platform/ScriptForbiddenScope.h"
 #include "platform/animation/CompositorAnimationHost.h"
 #include "platform/heap/Handle.h"
-#include "platform/tracing/TraceEvent.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "public/platform/WebCompositeAndReadbackAsyncCallback.h"
 #include "public/platform/WebCursorInfo.h"
 #include "public/platform/WebFloatRect.h"

diff --git a/third_party/WebKit/Source/web/WebViewImpl.cpp b/third_party/WebKit/Source/web/WebViewImpl.cpp
index 32fa319..97b239b 100644
--- a/third_party/WebKit/Source/web/WebViewImpl.cpp
+++ b/third_party/WebKit/Source/web/WebViewImpl.cpp

@@ -114,8 +114,8 @@
 #include "platform/graphics/gpu/DrawingBuffer.h"
 #include "platform/graphics/paint/DrawingRecorder.h"
 #include "platform/image-decoders/ImageDecoder.h"
+#include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/scroll/ScrollbarTheme.h"
-#include "platform/tracing/TraceEvent.h"
 #include "platform/weborigin/SchemeRegistry.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebCompositeAndReadbackAsyncCallback.h"

diff --git a/third_party/WebKit/Source/web/tests/WebFrameTest.cpp b/third_party/WebKit/Source/web/tests/WebFrameTest.cpp
index dca39b8..089729b5 100644
--- a/third_party/WebKit/Source/web/tests/WebFrameTest.cpp
+++ b/third_party/WebKit/Source/web/tests/WebFrameTest.cpp

@@ -4118,8 +4118,8 @@
   registerMockedHttpURLLoad(secondURL);
   registerMockedHttpURLLoad(thirdURL);
 
-  FrameTestHelpers::WebViewHelper webViewHelper;
   ClearScrollStateOnCommitWebFrameClient client;
+  FrameTestHelpers::WebViewHelper webViewHelper;
   webViewHelper.initializeAndLoad(m_baseURL + firstURL, true, &client);
   webViewHelper.resize(WebSize(pageWidth, pageHeight));
   webViewHelper.webView()->mainFrame()->setScrollOffset(
@@ -7398,8 +7398,8 @@
   registerMockedHttpURLLoad("history.html");
   registerMockedHttpURLLoad("find.html");
 
-  FrameTestHelpers::WebViewHelper webViewHelper;
   TestHistoryWebFrameClient client;
+  FrameTestHelpers::WebViewHelper webViewHelper;
   webViewHelper.initializeAndLoad("about:blank", true, &client);
 
   WebFrame* frame = webViewHelper.webView()->mainFrame();
@@ -7430,8 +7430,8 @@
   registerMockedHttpURLLoad("history.html");
   registerMockedHttpURLLoad("find.html");
 
-  FrameTestHelpers::WebViewHelper webViewHelper;
   TestHistoryWebFrameClient client;
+  FrameTestHelpers::WebViewHelper webViewHelper;
   webViewHelper.initializeAndLoad("about:blank", true, &client);
 
   WebFrame* frame = webViewHelper.webView()->mainFrame();
@@ -8446,8 +8446,8 @@
 
 TEST_P(ParameterizedWebFrameTest, ThemeColor) {
   registerMockedHttpURLLoad("theme_color_test.html");
-  FrameTestHelpers::WebViewHelper webViewHelper;
   ThemeColorTestWebFrameClient client;
+  FrameTestHelpers::WebViewHelper webViewHelper;
   webViewHelper.initializeAndLoad(m_baseURL + "theme_color_test.html", true,
                                   &client);
   EXPECT_TRUE(client.didNotify());
@@ -10108,8 +10108,8 @@
 
 TEST_F(WebFrameTest, CallbackOrdering) {
   registerMockedHttpURLLoad("foo.html");
-  FrameTestHelpers::WebViewHelper webViewHelper;
   CallbackOrderingWebFrameClient client;
+  FrameTestHelpers::WebViewHelper webViewHelper;
   webViewHelper.initializeAndLoad(m_baseURL + "foo.html", true, &client);
 }
 

diff --git a/third_party/minigbm/OWNERS b/third_party/minigbm/OWNERS
index f9c5878a..afeec1c1 100644
--- a/third_party/minigbm/OWNERS
+++ b/third_party/minigbm/OWNERS

@@ -1,2 +1,3 @@
 marcheu@chromium.org
 spang@chromium.org
+gurchetansingh@chromium.org

diff --git a/tools/mb/mb.py b/tools/mb/mb.py
index edbb434..59b820ad 100755
--- a/tools/mb/mb.py
+++ b/tools/mb/mb.py

@@ -1060,14 +1060,14 @@
 
     android = 'target_os="android"' in vals['gn_args']
     ozone = 'use_ozone=true' in vals['gn_args']
-    chromeos = 'target_os="chromeos"' in vals['gn_args']
+    ozone_x11 = (ozone and 'args' in isolate_map[target] and
+                 '--ozone-platform=x11' in isolate_map[target]['args'])
 
-    # This should be true if tests with type='windowed_test_launcher' are
-    # expected to run using xvfb. For example, Linux Desktop, X11 CrOS and
-    # Ozone CrOS builds.
-    use_xvfb = (self.platform == 'linux2' and
+    # This needs to mirror the settings in //build/config/ui.gni:
+    # use_x11 = is_linux && !use_ozone || use_ozone && --ozone-platform=x11
+    use_x11 = (self.platform == 'linux2' and
                not android and
-               ((not ozone) or (ozone and chromeos)))
+               (ozone_x11 or not ozone))
 
     asan = 'is_asan=true' in vals['gn_args']
     msan = 'is_msan=true' in vals['gn_args']
@@ -1103,7 +1103,7 @@
       ]
       cmdline = (['./../../build/android/test_wrapper/logdog_wrapper.py']
                  + logdog_command + test_cmdline)
-    elif use_xvfb and test_type == 'windowed_test_launcher':
+    elif use_x11 and test_type == 'windowed_test_launcher':
       extra_files = [
           '../../testing/test_env.py',
           '../../testing/xvfb.py',

diff --git a/tools/win/ShowGlobals/ShowGlobals.cc b/tools/win/ShowGlobals/ShowGlobals.cc
new file mode 100644
index 0000000..3dcea86
--- /dev/null
+++ b/tools/win/ShowGlobals/ShowGlobals.cc

@@ -0,0 +1,247 @@
+// Copyright (c) 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This tool scans a PDB file and prints out information about 'interesting'
+// global variables. This includes duplicates and large globals. This is often
+// helpful inunderstanding code bloat or finding inefficient globals.
+//
+// Duplicate global variables often happen when constructs like this are placed
+// in a header file:
+//
+//     const double sqrt_two = sqrt(2.0);
+//
+// Many (although usually not all) of the translation units that include this
+// header file will get a copy of sqrt_two, possibly including an initializer.
+// Because 'const' implies 'static' there are no warnings or errors from the
+// linker. This duplication can happen with float/double, structs and classes,
+// and arrays - any non-integral type.
+//
+// Global variables are not necessarily a problem but it is useful to understand
+// them, and monitoring their changes can be instructive.
+
+#include <atlbase.h>
+#include <dia2.h>
+#include <stdio.h>
+
+#include <algorithm>
+#include <vector>
+
+// Helper function for comparing strings - returns a strcmp/wcscmp compatible
+// value.
+int StringCompare(const std::wstring& lhs, const std::wstring& rhs) {
+  return wcscmp(lhs.c_str(), rhs.c_str());
+}
+
+// Use this struct to record data about symbols for sorting and analysis.
+struct SymbolData {
+  SymbolData(ULONGLONG size, DWORD section, const wchar_t* name)
+      : size(size), section(section), name(name) {}
+
+  ULONGLONG size;
+  DWORD section;
+  std::wstring name;
+};
+
+// Comparison function for when sorting symbol data by name, in order to allow
+// looking for duplicate symbols. It uses the symbol size as a tiebreaker. This
+// is necessary because sometimes there are symbols with matching names but
+// different sizes in which case they aren't actually duplicates. These false
+// positives happen because namespaces are omitted from the symbol names that
+// DIA2 returns.
+bool NameCompare(const SymbolData& lhs, const SymbolData& rhs) {
+  int nameCompare = StringCompare(lhs.name, rhs.name);
+  if (nameCompare == 0)
+    return lhs.size < rhs.size;
+  return nameCompare < 0;
+}
+
+// Comparison function for when sorting symbols by size, in order to allow
+// finding the largest global variables. Use the symbol names as a tiebreaker
+// in order to get consistent ordering.
+bool SizeCompare(const SymbolData& lhs, const SymbolData& rhs) {
+  if (lhs.size == rhs.size)
+    return StringCompare(lhs.name, rhs.name) < 0;
+  return lhs.size < rhs.size;
+}
+
+// Use this struct to store data about repeated globals, for later sorting.
+struct RepeatData {
+  RepeatData(ULONGLONG repeat_count,
+             ULONGLONG bytes_wasted,
+             const std::wstring& name)
+      : repeat_count(repeat_count), bytes_wasted(bytes_wasted), name(name) {}
+  bool operator<(const RepeatData& rhs) {
+    return bytes_wasted < rhs.bytes_wasted;
+  }
+
+  ULONGLONG repeat_count;
+  ULONGLONG bytes_wasted;
+  std::wstring name;
+};
+
+bool DumpInterestingGlobals(IDiaSymbol* global, const wchar_t* filename) {
+  wprintf(L"#Dups\tDupSize\t  Size\tSection\tSymbol name\tPDB name\n");
+
+  // How many bytes must be wasted on repeats before being listed.
+  const int kWastageThreshold = 100;
+  // How big must an individual symbol be before being listed.
+  const int kBigSizeThreshold = 500;
+
+  std::vector<SymbolData> symbols;
+  std::vector<RepeatData> repeats;
+
+  CComPtr<IDiaEnumSymbols> enum_symbols;
+  HRESULT result =
+      global->findChildren(SymTagData, NULL, nsNone, &enum_symbols);
+  if (FAILED(result)) {
+    wprintf(L"ERROR - DumpInterestingGlobals() returned no symbols.\n");
+    return false;
+  }
+
+  CComPtr<IDiaSymbol> symbol;
+  // Must call symbol.Release() at end of loop to prepare for reuse of symbol
+  // smart pointer, because DIA2 is not smart-pointer aware.
+  for (ULONG celt = 0;
+       SUCCEEDED(enum_symbols->Next(1, &symbol, &celt)) && (celt == 1);
+       symbol.Release()) {
+    // If we call get_length on symbol it works for functions but not for
+    // data. For some reason for data we have to call get_type() to get
+    // another IDiaSymbol object which we can query for length.
+    CComPtr<IDiaSymbol> type_symbol;
+    if (FAILED(symbol->get_type(&type_symbol))) {
+      wprintf(L"Get_type failed.\n");
+      continue;
+    }
+
+    // Errors in the remainder of this loop can be ignored silently.
+    ULONGLONG size = 0;
+    type_symbol->get_length(&size);
+
+    // Use -1 and -2 as canary values to indicate various failures.
+    DWORD section = static_cast<DWORD>(-1);
+    if (symbol->get_addressSection(&section) != S_OK)
+      section = static_cast<DWORD>(-2);
+
+    CComBSTR name;
+    if (symbol->get_name(&name) == S_OK) {
+      symbols.push_back(SymbolData(size, section, name));
+    }
+  }
+
+  // Sort the symbols by name/size so that we can print a report about duplicate
+  // variables.
+  std::sort(symbols.begin(), symbols.end(), NameCompare);
+  for (auto p = symbols.begin(); p != symbols.end(); /**/) {
+    auto pScan = p;
+    // Scan the data looking for symbols that have the same name
+    // and size.
+    while (pScan != symbols.end() && p->size == pScan->size &&
+           StringCompare(p->name, pScan->name) == 0)
+      ++pScan;
+
+    // Calculate how many times the symbol name/size appears in this PDB.
+    size_t repeat_count = pScan - p;
+    if (repeat_count > 1) {
+      // Change the count from how many instances of this variable there are to
+      // how many *excess* instances there are.
+      --repeat_count;
+      ULONGLONG bytes_wasted = repeat_count * p->size;
+      if (bytes_wasted > kWastageThreshold) {
+        repeats.push_back(RepeatData(repeat_count, bytes_wasted, p->name));
+      }
+    }
+
+    p = pScan;
+  }
+
+  // Print a summary of duplicated variables, sorted to put the worst offenders
+  // first.
+  std::sort(repeats.begin(), repeats.end());
+  std::reverse(repeats.begin(), repeats.end());
+  for (const auto& repeat : repeats) {
+    // The empty field contain a zero so that Excel/sheets will more easily
+    // create the pivot tables that I want.
+    wprintf(L"%llu\t%llu\t%6u\t%u\t%s\t%s\n", repeat.repeat_count,
+            repeat.bytes_wasted, 0, 0, repeat.name.c_str(), filename);
+  }
+  wprintf(L"\n");
+
+  // Print a summary of the largest global variables
+  std::sort(symbols.begin(), symbols.end(), SizeCompare);
+  std::reverse(symbols.begin(), symbols.end());
+  for (const auto& s : symbols) {
+    if (s.size < kBigSizeThreshold)
+      break;
+    // The empty fields contain a zero so that the columns line up which can
+    // be important when pasting the data into a spreadsheet.
+    wprintf(L"%u\t%u\t%6llu\t%u\t%s\t%s\n", 0, 0, s.size, s.section,
+            s.name.c_str(), filename);
+  }
+
+  return true;
+}
+
+bool Initialize(const wchar_t* filename,
+                CComPtr<IDiaDataSource>& source,
+                CComPtr<IDiaSession>& session,
+                CComPtr<IDiaSymbol>& global) {
+  // Initialize DIA2
+  HRESULT hr = CoCreateInstance(__uuidof(DiaSource), NULL, CLSCTX_INPROC_SERVER,
+                                __uuidof(IDiaDataSource), (void**)&source);
+  if (FAILED(hr)) {
+    wprintf(L"Failed to initialized DIA2 - %08X.\n", hr);
+    return false;
+  }
+
+  // Open the PDB
+  hr = source->loadDataFromPdb(filename);
+  if (FAILED(hr)) {
+    wprintf(L"LoadDataFromPdb failed - %08X.\n", hr);
+    return false;
+  }
+
+  hr = source->openSession(&session);
+  if (FAILED(hr)) {
+    wprintf(L"OpenSession failed - %08X.\n", hr);
+    return false;
+  }
+
+  // Retrieve a reference to the global scope
+  hr = session->get_globalScope(&global);
+  if (hr != S_OK) {
+    wprintf(L"Get_globalScope failed - %08X.\n", hr);
+    return false;
+  }
+
+  return true;
+}
+
+int wmain(int argc, wchar_t* argv[]) {
+  if (argc < 2) {
+    wprintf(L"Usage: ShowGlobals file.pdb");
+    return -1;
+  }
+
+  const wchar_t* filename = argv[1];
+
+  HRESULT hr = CoInitialize(NULL);
+  if (FAILED(hr)) {
+    wprintf(L"CoInitialize failed - %08X.", hr);
+    return false;
+  }
+
+  // Extra scope so that we can call CoUninitialize after we destroy our local
+  // variables.
+  {
+    CComPtr<IDiaDataSource> source;
+    CComPtr<IDiaSession> session;
+    CComPtr<IDiaSymbol> global;
+    if (!(Initialize(filename, source, session, global)))
+      return -1;
+
+    DumpInterestingGlobals(global, filename);
+  }
+
+  CoUninitialize();
+}

diff --git a/tools/win/ShowGlobals/ShowGlobals.sln b/tools/win/ShowGlobals/ShowGlobals.sln
new file mode 100644
index 0000000..a13cff2
--- /dev/null
+++ b/tools/win/ShowGlobals/ShowGlobals.sln

@@ -0,0 +1,28 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio 14
+VisualStudioVersion = 14.0.25420.1
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ShowGlobals", "ShowGlobals.vcxproj", "{6D21CDE5-0037-4065-8833-6F11E6094884}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|x64 = Debug|x64
+		Debug|x86 = Debug|x86
+		Release|x64 = Release|x64
+		Release|x86 = Release|x86
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{6D21CDE5-0037-4065-8833-6F11E6094884}.Debug|x64.ActiveCfg = Debug|x64
+		{6D21CDE5-0037-4065-8833-6F11E6094884}.Debug|x64.Build.0 = Debug|x64
+		{6D21CDE5-0037-4065-8833-6F11E6094884}.Debug|x86.ActiveCfg = Debug|Win32
+		{6D21CDE5-0037-4065-8833-6F11E6094884}.Debug|x86.Build.0 = Debug|Win32
+		{6D21CDE5-0037-4065-8833-6F11E6094884}.Release|x64.ActiveCfg = Release|x64
+		{6D21CDE5-0037-4065-8833-6F11E6094884}.Release|x64.Build.0 = Release|x64
+		{6D21CDE5-0037-4065-8833-6F11E6094884}.Release|x86.ActiveCfg = Release|Win32
+		{6D21CDE5-0037-4065-8833-6F11E6094884}.Release|x86.Build.0 = Release|Win32
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

diff --git a/tools/win/ShowGlobals/ShowGlobals.vcxproj b/tools/win/ShowGlobals/ShowGlobals.vcxproj
new file mode 100644
index 0000000..177b923
--- /dev/null
+++ b/tools/win/ShowGlobals/ShowGlobals.vcxproj

@@ -0,0 +1,154 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="14.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{6D21CDE5-0037-4065-8833-6F11E6094884}</ProjectGuid>
+    <Keyword>Win32Proj</Keyword>
+    <RootNamespace>ShowGlobals</RootNamespace>
+    <WindowsTargetPlatformVersion>8.1</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v140</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v140</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v140</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v140</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <PrecompiledHeader>NotUsing</PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <SDLCheck>true</SDLCheck>
+      <AdditionalIncludeDirectories>$(VSInstallDir)\DIA SDK\Include</AdditionalIncludeDirectories>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <PrecompiledHeader>NotUsing</PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <SDLCheck>true</SDLCheck>
+      <AdditionalIncludeDirectories>$(VSInstallDir)\DIA SDK\Include</AdditionalIncludeDirectories>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <PrecompiledHeader>NotUsing</PrecompiledHeader>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <SDLCheck>true</SDLCheck>
+      <AdditionalIncludeDirectories>$(VSInstallDir)\DIA SDK\Include</AdditionalIncludeDirectories>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <PrecompiledHeader>NotUsing</PrecompiledHeader>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <SDLCheck>true</SDLCheck>
+      <AdditionalIncludeDirectories>$(VSInstallDir)\DIA SDK\Include</AdditionalIncludeDirectories>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="ShowGlobals.cc" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
\ No newline at end of file

diff --git a/ui/accessibility/ax_node_position_unittest.cc b/ui/accessibility/ax_node_position_unittest.cc
index f2fc9c3..253967c 100644
--- a/ui/accessibility/ax_node_position_unittest.cc
+++ b/ui/accessibility/ax_node_position_unittest.cc

@@ -1900,7 +1900,7 @@
 
 // TODO(nektar): Move these tests to their own file.
 
-TEST_F(AXPositionTest, AXRangeGetText) {
+TEST_F(AXPositionTest, AXRangeGetTextWithWholeObjects) {
   base::string16 all_text = base::UTF8ToUTF16("ButtonCheck boxLine 1\nLine 2");
   // Create a range starting from the button object and ending at the last
   // character of the root, i.e. at the last character of the second line in the
@@ -1918,4 +1918,22 @@
   EXPECT_EQ(all_text, backward_range.GetText());
 }
 
+TEST_F(AXPositionTest, AXRangeGetTextWithTextOffsets) {
+  base::string16 most_text = base::UTF8ToUTF16("tonCheck boxLine 1\nLine");
+  // Create a range starting from the third character in the button object and
+  // ending two characters before the end of the root.
+  TestPositionType start = AXNodePosition::CreateTextPosition(
+      tree_.data().tree_id, button_.id, 3 /* text_offset */,
+      AX_TEXT_AFFINITY_DOWNSTREAM);
+  TestPositionType end = AXNodePosition::CreateTextPosition(
+      tree_.data().tree_id, static_text2_.id, 4 /* text_offset */,
+      AX_TEXT_AFFINITY_DOWNSTREAM);
+  AXRange<AXPosition<AXNodePosition, AXNode>> forward_range(start->Clone(),
+                                                            end->Clone());
+  EXPECT_EQ(most_text, forward_range.GetText());
+  AXRange<AXPosition<AXNodePosition, AXNode>> backward_range(std::move(end),
+                                                             std::move(start));
+  EXPECT_EQ(most_text, backward_range.GetText());
+}
+
 }  // namespace ui

diff --git a/ui/accessibility/ax_position.h b/ui/accessibility/ax_position.h
index fab1002f..5186c73 100644
--- a/ui/accessibility/ax_position.h
+++ b/ui/accessibility/ax_position.h

@@ -150,7 +150,8 @@
       return str;
 
     std::string text = base::UTF16ToUTF8(GetInnerText());
-    DCHECK(!text.empty());
+    DCHECK_GE(text_offset_, 0);
+    DCHECK_LE(text_offset_, static_cast<int>(text.length()));
     std::string annotated_text;
     if (text_offset() == MaxTextOffset()) {
       annotated_text = text + "<>";
@@ -268,11 +269,10 @@
     // If the anchor node has no text inside it then the child index should be
     // set to |BEFORE_TEXT|, hence the check for the text's length.
     if (copy->MaxTextOffset() > 0 &&
-        copy->text_offset_ == copy->MaxTextOffset()) {
+        copy->text_offset_ >= copy->MaxTextOffset()) {
       copy->child_index_ = copy->AnchorChildCount();
     } else {
       DCHECK_GE(copy->text_offset_, 0);
-      DCHECK_LT(copy->text_offset_, copy->MaxTextOffset());
       copy->child_index_ = BEFORE_TEXT;
 
       int current_offset = 0;

diff --git a/ui/accessibility/ax_range.h b/ui/accessibility/ax_range.h
index 7235c06..914f350 100644
--- a/ui/accessibility/ax_range.h
+++ b/ui/accessibility/ax_range.h

@@ -39,7 +39,7 @@
 
   AXRange(const AXRange& other) = delete;
 
-  AXRange(const AXRange&& other) : AXRange() {
+  AXRange(AXRange&& other) : AXRange() {
     anchor_.swap(other.anchor_);
     focus_.swap(other.focus_);
   }
@@ -78,21 +78,32 @@
     if (IsNull())
       return text;
 
-    std::unique_ptr<AXPositionType> first, second;
-    if (*anchor_ <= *focus_) {
-      first = anchor_->AsLeafTextPosition();
-      second = focus_->AsLeafTextPosition();
+    std::unique_ptr<AXPositionType> start, end;
+    if (*anchor_ < *focus_) {
+      start = anchor_->AsLeafTextPosition();
+      end = focus_->AsLeafTextPosition();
     } else {
-      first = focus_->AsLeafTextPosition();
-      second = anchor_->AsLeafTextPosition();
+      start = focus_->AsLeafTextPosition();
+      end = anchor_->AsLeafTextPosition();
     }
 
-    do {
-      text += first->GetInnerText();
-      first = first->CreateNextTextAnchorPosition();
-    } while (*first <= *second);
+    int start_offset = start->text_offset();
+    DCHECK_GE(start_offset, 0);
+    int end_offset = end->text_offset();
+    DCHECK_GE(end_offset, 0);
 
-    return text;
+    do {
+      text += start->GetInnerText();
+      start = start->CreateNextTextAnchorPosition();
+    } while (!start->IsNullPosition() && *start <= *end);
+
+    if (static_cast<size_t>(start_offset) > text.length())
+      return base::string16();
+
+    text = text.substr(start_offset, base::string16::npos);
+    size_t text_length = text.length() - end->GetInnerText().length() +
+                         static_cast<size_t>(end_offset);
+    return text.substr(0, text_length);
   }
 
  private:

diff --git a/ui/gl/BUILD.gn b/ui/gl/BUILD.gn
index 073f6878..a1f9c69 100644
--- a/ui/gl/BUILD.gn
+++ b/ui/gl/BUILD.gn

@@ -408,6 +408,26 @@
   ]
 }
 
+# Non-Ozone trybots end up trying to build this when building "all" and failing
+# when X11 isn't there.
+if (ozone_platform_x11) {
+  group("gl_unittests_ozonex") {
+    testonly = true
+    data_deps = [
+      ":gl_unittests",
+    ]
+  }
+
+  # TODO(GYP_GONE): Delete this after we've converted everything to GN.
+  # The _run targets exist only for compatibility w/ GYP.
+  group("gl_unittests_ozonex_run") {
+    testonly = true
+    deps = [
+      ":gl_unittests_ozonex",
+    ]
+  }
+}
+
 if (is_android) {
   generate_jar_jni("surface_jni_headers") {
     jni_package = "ui/gl"

diff --git a/ui/views/widget/widget_interactive_uitest.cc b/ui/views/widget/widget_interactive_uitest.cc
index 8fa88e7ca..3986ee4 100644
--- a/ui/views/widget/widget_interactive_uitest.cc
+++ b/ui/views/widget/widget_interactive_uitest.cc

@@ -1557,6 +1557,8 @@
 
   EXPECT_TRUE(observer.activation_observed());
   EXPECT_TRUE(child->HasCapture());
+
+  child->RemoveObserver(&observer);
 }