diff --git a/DEPS b/DEPS
index 4818a123..6ccb5cd 100644
--- a/DEPS
+++ b/DEPS
@@ -43,7 +43,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': '7488482075015df10015af9039dde7d2abc9a9a1',
+  'v8_revision': 'c6b1c5d3b6fa5bb639310036c3eaf06068dc0f15',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -187,7 +187,7 @@
    Var('chromium_git') + '/chromium/third_party/ffmpeg.git' + '@' + 'a41fa511bc02a9b133b6c966cd950dbdf0dbbe56',
 
   'src/third_party/libjingle/source/talk':
-    Var('chromium_git') + '/external/webrtc/trunk/talk.git' + '@' + '4f3cab280a86c3b33739e4e0350657585396c821', # commit position 11218
+    Var('chromium_git') + '/external/webrtc/trunk/talk.git' + '@' + 'c954cbc91eab17e7d22adac491d85feb3db183fa', # commit position 11229
 
   'src/third_party/usrsctp/usrsctplib':
     Var('chromium_git') + '/external/github.com/sctplab/usrsctp' + '@' + 'c60ec8b35c3fe6027d7a3faae89d1c8d7dd3ce98',
@@ -211,7 +211,7 @@
    Var('chromium_git') + '/native_client/src/third_party/scons-2.0.1.git' + '@' + '1c1550e17fc26355d08627fbdec13d8291227067',
 
   'src/third_party/webrtc':
-    Var('chromium_git') + '/external/webrtc/trunk/webrtc.git' + '@' + '8b9ae391efdc410049de519c8f4d01785c0622e0', # commit position 11221
+    Var('chromium_git') + '/external/webrtc/trunk/webrtc.git' + '@' + '80590d95583b5268d4a872db8681e6ab8c0d99f0', # commit position 11229
 
   'src/third_party/openmax_dl':
     Var('chromium_git') + '/external/webrtc/deps/third_party/openmax.git' + '@' +  Var('openmax_dl_revision'),
diff --git a/android_webview/javatests/src/org/chromium/android_webview/test/WebViewAsynchronousFindApisTest.java b/android_webview/javatests/src/org/chromium/android_webview/test/WebViewAsynchronousFindApisTest.java
index f211b78..159983b 100644
--- a/android_webview/javatests/src/org/chromium/android_webview/test/WebViewAsynchronousFindApisTest.java
+++ b/android_webview/javatests/src/org/chromium/android_webview/test/WebViewAsynchronousFindApisTest.java
@@ -6,7 +6,6 @@
 
 import android.test.suitebuilder.annotation.SmallTest;
 
-import org.chromium.base.test.util.DisabledTest;
 import org.chromium.base.test.util.Feature;
 
 /**
@@ -27,16 +26,12 @@
         assertEquals(4, findAllAsyncOnUiThread("chuck"));
     }
 
-    /*
     @SmallTest
     @Feature({"AndroidWebView", "FindInPage"})
-    crbug.com/311495
-    */
-    @DisabledTest
     public void testFindAllDoubleNext() throws Throwable {
         assertEquals(4, findAllAsyncOnUiThread("wood"));
         assertEquals(4, findAllAsyncOnUiThread("wood"));
-        assertEquals(1, findNextOnUiThread(true));
+        assertEquals(2, findNextOnUiThread(true));
     }
 
     @SmallTest
@@ -112,17 +107,13 @@
         clearMatchesOnUiThread();
     }
 
-    /*
     @SmallTest
     @Feature({"AndroidWebView", "FindInPage"})
-    crbug.com/311495
-    */
-    @DisabledTest
     public void testClearFindNext() throws Throwable {
         assertEquals(4, findAllAsyncOnUiThread("wood"));
         clearMatchesOnUiThread();
         assertEquals(4, findAllAsyncOnUiThread("wood"));
-        assertEquals(1, findNextOnUiThread(true));
+        assertEquals(2, findNextOnUiThread(true));
     }
 
     @SmallTest
diff --git a/cc/BUILD.gn b/cc/BUILD.gn
index 88fff04..48b5106 100644
--- a/cc/BUILD.gn
+++ b/cc/BUILD.gn
@@ -375,6 +375,7 @@
     "raster/single_thread_task_graph_runner.h",
     "raster/synchronous_task_graph_runner.cc",
     "raster/synchronous_task_graph_runner.h",
+    "raster/task_category.h",
     "raster/task_graph_runner.cc",
     "raster/task_graph_runner.h",
     "raster/task_graph_work_queue.cc",
diff --git a/cc/cc.gyp b/cc/cc.gyp
index d9bebc4..061ccdce 100644
--- a/cc/cc.gyp
+++ b/cc/cc.gyp
@@ -431,6 +431,7 @@
         'raster/one_copy_tile_task_worker_pool.h',
         'raster/raster_buffer.cc',
         'raster/raster_buffer.h',
+        'raster/task_category.h',
         'raster/scoped_gpu_raster.cc',
         'raster/scoped_gpu_raster.h',
         'raster/single_thread_task_graph_runner.cc',
diff --git a/cc/raster/task_category.h b/cc/raster/task_category.h
new file mode 100644
index 0000000..8b1addf
--- /dev/null
+++ b/cc/raster/task_category.h
@@ -0,0 +1,23 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CC_RASTER_TASK_CATEGORY_H_
+#define CC_RASTER_TASK_CATEGORY_H_
+
+#include <cstdint>
+
+namespace cc {
+
+// This enum provides values for TaskGraph::Node::category, which is a uint16_t.
+// We don't use an enum class here, as we want to keep TaskGraph::Node::category
+// generic, allowing other consumers to provide their own of values.
+enum TaskCategory : uint16_t {
+  TASK_CATEGORY_NONCONCURRENT_FOREGROUND,
+  TASK_CATEGORY_FOREGROUND,
+  TASK_CATEGORY_BACKGROUND,
+};
+
+}  // namespace cc
+
+#endif  // CC_RASTER_TASK_CATEGORY_H_
diff --git a/cc/test/fake_tile_manager.cc b/cc/test/fake_tile_manager.cc
index 9dde7495..b905446 100644
--- a/cc/test/fake_tile_manager.cc
+++ b/cc/test/fake_tile_manager.cc
@@ -77,7 +77,8 @@
                   std::numeric_limits<size_t>::max(),
                   false /* use_partial_raster */) {
   SetResources(nullptr, g_fake_tile_task_runner.Pointer(),
-               std::numeric_limits<size_t>::max());
+               std::numeric_limits<size_t>::max(),
+               false /* use_gpu_rasterization */);
 }
 
 FakeTileManager::FakeTileManager(TileManagerClient* client,
@@ -87,7 +88,8 @@
                   std::numeric_limits<size_t>::max(),
                   false /* use_partial_raster */) {
   SetResources(resource_pool, g_fake_tile_task_runner.Pointer(),
-               std::numeric_limits<size_t>::max());
+               std::numeric_limits<size_t>::max(),
+               false /* use_gpu_rasterization */);
 }
 
 FakeTileManager::~FakeTileManager() {}
diff --git a/cc/tiles/tile_manager.cc b/cc/tiles/tile_manager.cc
index 400fff2..88afa63 100644
--- a/cc/tiles/tile_manager.cc
+++ b/cc/tiles/tile_manager.cc
@@ -24,6 +24,7 @@
 #include "cc/debug/traced_value.h"
 #include "cc/layers/picture_layer_impl.h"
 #include "cc/raster/raster_buffer.h"
+#include "cc/raster/task_category.h"
 #include "cc/raster/tile_task_runner.h"
 #include "cc/tiles/tile.h"
 #include "ui/gfx/geometry/rect_conversions.h"
@@ -169,24 +170,42 @@
 
 void InsertNodeForTask(TaskGraph* graph,
                        TileTask* task,
-                       size_t priority,
+                       uint16_t category,
+                       uint16_t priority,
                        size_t dependencies) {
   DCHECK(std::find_if(graph->nodes.begin(), graph->nodes.end(),
                       [task](const TaskGraph::Node& node) {
                         return node.task == task;
                       }) == graph->nodes.end());
-
-  // TODO(ericrk): Add in more logic around category selection.
   graph->nodes.push_back(
-      TaskGraph::Node(task, 0 /* category */, priority, dependencies));
+      TaskGraph::Node(task, category, priority, dependencies));
 }
 
 void InsertNodesForRasterTask(TaskGraph* graph,
                               RasterTask* raster_task,
                               const ImageDecodeTask::Vector& decode_tasks,
-                              size_t priority) {
+                              size_t priority,
+                              bool use_gpu_rasterization,
+                              bool high_priority) {
   size_t dependencies = 0u;
 
+  // Determine the TaskCategory for raster tasks - if a task uses GPU, it
+  // cannot run concurrently and is assigned
+  // TASK_CATEGORY_NONCONCURRENT_FOREGROUND, regardless of its priority.
+  // Otherwise its category is based on its priority.
+  TaskCategory raster_task_category;
+  if (use_gpu_rasterization) {
+    raster_task_category = TASK_CATEGORY_NONCONCURRENT_FOREGROUND;
+  } else {
+    raster_task_category =
+        high_priority ? TASK_CATEGORY_FOREGROUND : TASK_CATEGORY_BACKGROUND;
+  }
+
+  // Determine the TaskCategory for decode tasks. This category is based on
+  // the priority of the raster task which depends on it.
+  TaskCategory decode_task_category =
+      high_priority ? TASK_CATEGORY_FOREGROUND : TASK_CATEGORY_BACKGROUND;
+
   // Insert image decode tasks.
   for (ImageDecodeTask::Vector::const_iterator it = decode_tasks.begin();
        it != decode_tasks.end(); ++it) {
@@ -204,13 +223,22 @@
                      [decode_task](const TaskGraph::Node& node) {
                        return node.task == decode_task;
                      });
-    if (decode_it == graph->nodes.end())
-      InsertNodeForTask(graph, decode_task, priority, 0u);
+
+    // Tasks are inserted in priority order, so existing decode tasks should
+    // already be FOREGROUND if this is a high priority task.
+    DCHECK(decode_it == graph->nodes.end() || !high_priority ||
+           static_cast<uint16_t>(TASK_CATEGORY_FOREGROUND) ==
+               decode_it->category);
+
+    if (decode_it == graph->nodes.end()) {
+      InsertNodeForTask(graph, decode_task, decode_task_category, priority, 0u);
+    }
 
     graph->edges.push_back(TaskGraph::Edge(decode_task, raster_task));
   }
 
-  InsertNodeForTask(graph, raster_task, priority, dependencies);
+  InsertNodeForTask(graph, raster_task, raster_task_category, priority,
+                    dependencies);
 }
 
 class TaskSetFinishedTaskImpl : public TileTask {
@@ -282,6 +310,7 @@
       tile_task_runner_(nullptr),
       scheduled_raster_task_limit_(scheduled_raster_task_limit),
       use_partial_raster_(use_partial_raster),
+      use_gpu_rasterization_(false),
       all_tiles_that_need_to_be_rasterized_are_scheduled_(true),
       did_check_for_completed_tasks_since_last_schedule_tasks_(true),
       did_oom_on_last_assign_(false),
@@ -329,10 +358,12 @@
 
 void TileManager::SetResources(ResourcePool* resource_pool,
                                TileTaskRunner* tile_task_runner,
-                               size_t scheduled_raster_task_limit) {
+                               size_t scheduled_raster_task_limit,
+                               bool use_gpu_rasterization) {
   DCHECK(!tile_task_runner_);
   DCHECK(tile_task_runner);
 
+  use_gpu_rasterization_ = use_gpu_rasterization;
   scheduled_raster_task_limit_ = scheduled_raster_task_limit;
   resource_pool_ = resource_pool;
   tile_task_runner_ = tile_task_runner;
@@ -752,16 +783,24 @@
     all_count++;
     graph_.edges.push_back(TaskGraph::Edge(task, all_done_task.get()));
 
-    InsertNodesForRasterTask(&graph_, task, task->dependencies(), priority++);
+    bool high_priority =
+        tile->required_for_draw() || tile->required_for_activation();
+    InsertNodesForRasterTask(&graph_, task, task->dependencies(), priority++,
+                             use_gpu_rasterization_, high_priority);
   }
 
+  // Insert nodes for our task completion tasks. We enqueue these using
+  // FOREGROUND priority as they are relatively quick tasks and we'd like
+  // to trigger our callbacks quickly to aid in scheduling.
   InsertNodeForTask(&graph_, required_for_activation_done_task.get(),
+                    TASK_CATEGORY_FOREGROUND,
                     kRequiredForActivationDoneTaskPriority,
                     required_for_activate_count);
   InsertNodeForTask(&graph_, required_for_draw_done_task.get(),
-                    kRequiredForDrawDoneTaskPriority, required_for_draw_count);
-  InsertNodeForTask(&graph_, all_done_task.get(), kAllDoneTaskPriority,
-                    all_count);
+                    TASK_CATEGORY_FOREGROUND, kRequiredForDrawDoneTaskPriority,
+                    required_for_draw_count);
+  InsertNodeForTask(&graph_, all_done_task.get(), TASK_CATEGORY_FOREGROUND,
+                    kAllDoneTaskPriority, all_count);
 
   // We must reduce the amount of unused resoruces before calling
   // ScheduleTasks to prevent usage from rising above limits.
diff --git a/cc/tiles/tile_manager.h b/cc/tiles/tile_manager.h
index 00f22e3..bb58c57 100644
--- a/cc/tiles/tile_manager.h
+++ b/cc/tiles/tile_manager.h
@@ -117,7 +117,8 @@
   // SetResources.
   void SetResources(ResourcePool* resource_pool,
                     TileTaskRunner* tile_task_runner,
-                    size_t scheduled_raster_task_limit);
+                    size_t scheduled_raster_task_limit,
+                    bool use_gpu_rasterization);
 
   // This causes any completed raster work to finalize, so that tiles get up to
   // date draw information.
@@ -291,6 +292,7 @@
   GlobalStateThatImpactsTilePriority global_state_;
   size_t scheduled_raster_task_limit_;
   const bool use_partial_raster_;
+  bool use_gpu_rasterization_;
 
   typedef base::hash_map<Tile::Id, Tile*> TileMap;
   TileMap tiles_;
diff --git a/cc/trees/layer_tree_host_impl.cc b/cc/trees/layer_tree_host_impl.cc
index 3608a60..d31265c 100644
--- a/cc/trees/layer_tree_host_impl.cc
+++ b/cc/trees/layer_tree_host_impl.cc
@@ -2203,7 +2203,8 @@
   tile_manager_->SetResources(
       resource_pool_.get(), tile_task_worker_pool_->AsTileTaskRunner(),
       is_synchronous_single_threaded_ ? std::numeric_limits<size_t>::max()
-                                      : settings_.scheduled_raster_task_limit);
+                                      : settings_.scheduled_raster_task_limit,
+      use_gpu_rasterization_);
   UpdateTileManagerMemoryPolicy(ActualManagedMemoryPolicy());
 }
 
diff --git a/chrome/VERSION b/chrome/VERSION
index 21d6ef7..f954ad5 100644
--- a/chrome/VERSION
+++ b/chrome/VERSION
@@ -1,4 +1,4 @@
 MAJOR=49
 MINOR=0
-BUILD=2620
+BUILD=2621
 PATCH=0
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/download/ChromeDownloadDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/download/ChromeDownloadDelegate.java
index 2211a8d..ceeebd3 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/download/ChromeDownloadDelegate.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/download/ChromeDownloadDelegate.java
@@ -467,6 +467,7 @@
     private void enqueueDownloadManagerRequest(final DownloadInfo info) {
         DownloadManagerService.getDownloadManagerService(
                 mContext.getApplicationContext()).enqueueDownloadManagerRequest(info, true);
+        closeBlankTab();
     }
 
     /**
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ntp/NewTabPage.java b/chrome/android/java/src/org/chromium/chrome/browser/ntp/NewTabPage.java
index 857151e..08fef953 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ntp/NewTabPage.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ntp/NewTabPage.java
@@ -27,6 +27,7 @@
 import org.chromium.base.metrics.RecordUserAction;
 import org.chromium.chrome.R;
 import org.chromium.chrome.browser.ChromeApplication;
+import org.chromium.chrome.browser.ChromeFeatureList;
 import org.chromium.chrome.browser.ChromeSwitches;
 import org.chromium.chrome.browser.NativePage;
 import org.chromium.chrome.browser.UrlConstants;
@@ -210,6 +211,13 @@
     }
 
     private final NewTabPageManager mNewTabPageManager = new NewTabPageManager() {
+        private static final String NTP_OFFLINE_PAGES_FEATURE_NAME = "NTPOfflinePages";
+
+        private boolean isNtpOfflinePagesEnabled() {
+            return OfflinePageBridge.isEnabled()
+                    && ChromeFeatureList.isEnabled(NTP_OFFLINE_PAGES_FEATURE_NAME);
+        }
+
         @Override
         public boolean isLocationBarShownInNTP() {
             if (mIsDestroyed) return false;
@@ -444,7 +452,7 @@
 
         @Override
         public boolean isOfflineAvailable(String pageUrl) {
-            if (mIsDestroyed || !OfflinePageBridge.isEnabled()) return false;
+            if (mIsDestroyed || !isNtpOfflinePagesEnabled()) return false;
             if (mOfflinePageBridge == null) mOfflinePageBridge = new OfflinePageBridge(mProfile);
             return mOfflinePageBridge.getPageByOnlineURL(pageUrl) != null;
         }
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/download/DownloadTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/download/DownloadTest.java
index c628273..0c390756 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/download/DownloadTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/download/DownloadTest.java
@@ -10,7 +10,6 @@
 import android.view.View;
 
 import org.chromium.base.test.util.CommandLineFlags;
-import org.chromium.base.test.util.DisabledTest;
 import org.chromium.base.test.util.Feature;
 import org.chromium.chrome.R;
 import org.chromium.chrome.browser.ChromeSwitches;
@@ -90,12 +89,8 @@
         assertTrue(hasDownload("superbo.txt", SUPERBO_CONTENTS));
     }
 
-    /*
-    Empty tab not closed.
     @MediumTest
     @Feature({"Downloads"})
-    */
-    @DisabledTest
     public void testCloseEmptyDownloadTab() throws Exception {
         loadUrl(TestHttpServerClient.getUrl("chrome/test/data/android/download/get.html"));
         waitForFocus();
diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
index 9d66217c..38b373a 100644
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd
@@ -4451,6 +4451,15 @@
         <message name="IDS_EXTENSIONS_SHOW_BUTTON" desc="The text for the Show link.">
           Show button
         </message>
+        <message name="IDS_EXTENSIONS_LOG_LEVEL_INFO" desc="Alt-text indicating a low severity level for the error icon in the chrome://extensions page.">
+          Log
+        </message>
+        <message name="IDS_EXTENSIONS_LOG_LEVEL_WARN" desc="Alt-text indicating a medium severity level for the error icon in the chrome://extensions page.">
+          Warning
+        </message>
+        <message name="IDS_EXTENSIONS_LOG_LEVEL_ERROR" desc="Alt-text indicating a high severity level for the error icon in the chrome://extensions page.">
+          Error
+        </message>
         <message name="IDS_MD_EXTENSIONS_ITEM_ID" desc="The text for the label next to the extension id.">
           &lt;span&gt;ID:&lt;/span&gt;<ph name="EXTENSION_ID">$1<ex>cfhdojbkjhnklbpkdaibdccddilifddb</ex></ph>
         </message>
@@ -14582,12 +14591,18 @@
       </message>
     </if>
 
-      <message name="IDS_FLAGS_ENABLE_BROTLI_NAME" desc="Title for the flag to enable Brotli Content-Encoding.">
-        Brotli Content-Encoding.
-      </message>
-      <message name="IDS_FLAGS_ENABLE_BROTLI_DESCRIPTION" desc="Description for the flag to enable Brotli Content-Encoding.">
-        Enable Brotli Content-Encoding support.
-      </message>
+    <message name="IDS_FLAGS_ENABLE_BROTLI_NAME" desc="Title for the flag to enable Brotli Content-Encoding.">
+      Brotli Content-Encoding.
+    </message>
+    <message name="IDS_FLAGS_ENABLE_BROTLI_DESCRIPTION" desc="Description for the flag to enable Brotli Content-Encoding.">
+      Enable Brotli Content-Encoding support.
+    </message>
+    <message name="IDS_FLAGS_ENABLE_WEBFONTS_INTERVENTION_NAME" desc="Title for the flag to enable WebFonts User Agent Intervention.">
+      User Agent Intervention for WebFonts loading.
+    </message>
+    <message name="IDS_FLAGS_ENABLE_WEBFONTS_INTERVENTION_DESCRIPTION" desc="Description for the flag to enable WebFonts User Agent Intervention.">
+      Enable User Agent Intervention for WebFonts loading.
+    </message>
 
     </messages>
   </release>
diff --git a/chrome/app/settings_strings.grdp b/chrome/app/settings_strings.grdp
index 7f6779f..3fdd5ed 100644
--- a/chrome/app/settings_strings.grdp
+++ b/chrome/app/settings_strings.grdp
@@ -73,6 +73,9 @@
   <message name="IDS_SETTINGS_APPEARANCE" desc="Name of the settings page which displays appearance preferences.">
     Appearance
   </message>
+  <message name="IDS_SETTINGS_EXAMPLE_DOT_COM" desc="Placeholder text for URL input example.">
+    www.example.com
+  </message>
   <message name="IDS_SETTINGS_SET_WALLPAPER" desc="Name of the control which allows the user to set the wallpaper.">
     Set wallpaper
   </message>
@@ -91,8 +94,8 @@
   <message name="IDS_SETTINGS_HOME_PAGE_NTP" desc="Description of the New Tab Page when set as the home page.">
     New Tab Page
   </message>
-  <message name="IDS_SETTINGS_OPEN_THIS_PAGE" desc="Label of the input box for the home page.">
-    Open this page:
+  <message name="IDS_SETTINGS_OTHER" desc="Label of the input box for the home page.">
+    Other
   </message>
   <message name="IDS_SETTINGS_CHANGE_HOME_PAGE" desc="Label of the control to change the home page.">
     Change
diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
index e2a3980c..3d38898 100644
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc
@@ -2118,6 +2118,11 @@
      IDS_FLAGS_WEBGL2_DESCRIPTION,
      kOsAll,
      SINGLE_VALUE_TYPE(switches::kEnableUnsafeES3APIs)},
+    {"enable-webfonts-intervention",
+      IDS_FLAGS_ENABLE_WEBFONTS_INTERVENTION_NAME,
+      IDS_FLAGS_ENABLE_WEBFONTS_INTERVENTION_DESCRIPTION,
+      kOsAll,
+      FEATURE_VALUE_TYPE(features::kWebFontsIntervention)},
     // NOTE: Adding new command-line switches requires adding corresponding
     // entries to enum "LoginCustomFlags" in histograms.xml. See note in
     // histograms.xml and don't forget to run AboutFlagsHistogramTest unit test.
diff --git a/chrome/browser/android/chrome_feature_list.cc b/chrome/browser/android/chrome_feature_list.cc
index 4ab54143..8b44469 100644
--- a/chrome/browser/android/chrome_feature_list.cc
+++ b/chrome/browser/android/chrome_feature_list.cc
@@ -24,11 +24,16 @@
 // this array may either refer to features defined in this file (above) or in
 // other locations in the code base (e.g. chrome/, components/, etc).
 const base::Feature* kFeaturesExposedToJava[] = {
+    &kNTPOfflinePagesFeature,
     &kPhysicalWebFeature,
 };
 
 }  // namespace
 
+const base::Feature kNTPOfflinePagesFeature {
+  "NTPOfflinePages", base::FEATURE_DISABLED_BY_DEFAULT
+};
+
 const base::Feature kPhysicalWebFeature {
   "PhysicalWeb", base::FEATURE_DISABLED_BY_DEFAULT
 };
diff --git a/chrome/browser/android/chrome_feature_list.h b/chrome/browser/android/chrome_feature_list.h
index 2c00428..17ca186 100644
--- a/chrome/browser/android/chrome_feature_list.h
+++ b/chrome/browser/android/chrome_feature_list.h
@@ -12,6 +12,7 @@
 namespace chrome {
 namespace android {
 
+extern const base::Feature kNTPOfflinePagesFeature;
 extern const base::Feature kPhysicalWebFeature;
 
 bool RegisterChromeFeatureListJni(JNIEnv* env);
diff --git a/chrome/browser/android/metrics/launch_metrics.cc b/chrome/browser/android/metrics/launch_metrics.cc
index 3168667..77003c61 100644
--- a/chrome/browser/android/metrics/launch_metrics.cc
+++ b/chrome/browser/android/metrics/launch_metrics.cc
@@ -7,9 +7,12 @@
 #include "base/android/jni_string.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/user_metrics.h"
+#include "base/time/time.h"
 #include "chrome/browser/android/shortcut_info.h"
 #include "chrome/browser/banners/app_banner_settings_helper.h"
 #include "chrome/browser/browser_process.h"
+#include "chrome/browser/engagement/site_engagement_service.h"
+#include "chrome/browser/profiles/profile.h"
 #include "components/rappor/rappor_utils.h"
 #include "content/public/browser/web_contents.h"
 #include "jni/LaunchMetrics_jni.h"
@@ -45,6 +48,13 @@
         web_contents, url, url.spec(),
         AppBannerSettingsHelper::APP_BANNER_EVENT_DID_ADD_TO_HOMESCREEN,
         base::Time::Now());
+
+    // Tell the Site Engagement Service about this launch as sites recently
+    // launched from a shortcut receive a boost to their engagement.
+    SiteEngagementService* service = SiteEngagementService::Get(
+        Profile::FromBrowserContext(web_contents->GetBrowserContext()));
+    if (service)
+      service->SetLastShortcutLaunchTime(url);
   }
 
   std::string rappor_metric_source;
diff --git a/chrome/browser/engagement/site_engagement_metrics.cc b/chrome/browser/engagement/site_engagement_metrics.cc
index fb2dc6b..3346816 100644
--- a/chrome/browser/engagement/site_engagement_metrics.cc
+++ b/chrome/browser/engagement/site_engagement_metrics.cc
@@ -5,7 +5,7 @@
 #include "chrome/browser/engagement/site_engagement_metrics.h"
 
 #include "base/metrics/histogram_macros.h"
-#include "base/metrics/sparse_histogram.h"
+#include "base/strings/string_number_conversions.h"
 
 const char SiteEngagementMetrics::kTotalEngagementHistogram[] =
     "SiteEngagementService.TotalEngagement";
@@ -34,6 +34,12 @@
 const char SiteEngagementMetrics::kEngagementTypeHistogram[] =
     "SiteEngagementService.EngagementType";
 
+const char SiteEngagementMetrics::kEngagementBucketHistogramBase[] =
+    "SiteEngagementService.EngagementScoreBucket_";
+
+const char SiteEngagementMetrics::kDaysSinceLastShortcutLaunchHistogram[] =
+    "SiteEngagementService.DaysSinceLastShortcutLaunch";
+
 void SiteEngagementMetrics::RecordTotalSiteEngagement(
     double total_engagement) {
   UMA_HISTOGRAM_COUNTS_10000(kTotalEngagementHistogram, total_engagement);
@@ -53,8 +59,29 @@
 
 void SiteEngagementMetrics::RecordEngagementScores(
     std::map<GURL, double> score_map) {
+  // Record the percentage of sites that fall in each 10-point wide range. These
+  // numbers are used as suffixes for the
+  // SiteEngagementService.EngagementScoreBucket_* histogram. If these bases
+  // change, the EngagementScoreBuckets suffix in histograms.xml should be
+  // updated.
+  static const int kBucketBases[] = {0, 10, 20, 30, 40, 50, 60, 70, 80, 90};
+  std::map<int, int> score_buckets;
+  for (size_t i = 0; i < arraysize(kBucketBases); ++i)
+    score_buckets[kBucketBases[i]] = 0;
+
   for (const auto& value: score_map) {
     UMA_HISTOGRAM_COUNTS_100(kEngagementScoreHistogram, value.second);
+    score_buckets.lower_bound(value.second)->second++;
+  }
+
+  for (const auto& b : score_buckets) {
+    std::string histogram_name =
+        kEngagementBucketHistogramBase + base::IntToString(b.first);
+
+    base::LinearHistogram::FactoryGet(
+        histogram_name, 1, 100, 10,
+        base::HistogramBase::kUmaTargetedHistogramFlag)
+        ->Add(b.second * 100 / score_map.size());
   }
 }
 
@@ -77,3 +104,7 @@
 void SiteEngagementMetrics::RecordEngagement(EngagementType type) {
   UMA_HISTOGRAM_ENUMERATION(kEngagementTypeHistogram, type, ENGAGEMENT_LAST);
 }
+
+void SiteEngagementMetrics::RecordDaysSinceLastShortcutLaunch(int days) {
+  UMA_HISTOGRAM_COUNTS_100(kDaysSinceLastShortcutLaunchHistogram, days);
+}
diff --git a/chrome/browser/engagement/site_engagement_metrics.h b/chrome/browser/engagement/site_engagement_metrics.h
index f4eaa7f..b9f5c42c 100644
--- a/chrome/browser/engagement/site_engagement_metrics.h
+++ b/chrome/browser/engagement/site_engagement_metrics.h
@@ -24,6 +24,7 @@
     ENGAGEMENT_WHEEL,
     ENGAGEMENT_MEDIA_HIDDEN,
     ENGAGEMENT_MEDIA_VISIBLE,
+    ENGAGEMENT_WEBAPP_SHORTCUT_LAUNCH,
     ENGAGEMENT_LAST,
   };
 
@@ -36,9 +37,11 @@
   static void RecordOriginsWithMaxDailyEngagement(int total_origins);
   static void RecordPercentOriginsWithMaxEngagement(double percentage);
   static void RecordEngagement(EngagementType type);
+  static void RecordDaysSinceLastShortcutLaunch(int days);
 
  private:
   FRIEND_TEST_ALL_PREFIXES(SiteEngagementServiceTest, CheckHistograms);
+  FRIEND_TEST_ALL_PREFIXES(SiteEngagementServiceTest, LastShortcutLaunch);
   FRIEND_TEST_ALL_PREFIXES(SiteEngagementHelperTest,
                            MixedInputEngagementAccumulation);
   static const char kTotalEngagementHistogram[];
@@ -50,6 +53,8 @@
   static const char kOriginsWithMaxDailyEngagementHistogram[];
   static const char kPercentOriginsWithMaxEngagementHistogram[];
   static const char kEngagementTypeHistogram[];
+  static const char kEngagementBucketHistogramBase[];
+  static const char kDaysSinceLastShortcutLaunchHistogram[];
 };
 
 #endif  // CHROME_BROWSER_ENGAGEMENT_SITE_ENGAGEMENT_METRICS_H_
diff --git a/chrome/browser/engagement/site_engagement_service.cc b/chrome/browser/engagement/site_engagement_service.cc
index 1c9a7832..dbd4db73 100644
--- a/chrome/browser/engagement/site_engagement_service.cc
+++ b/chrome/browser/engagement/site_engagement_service.cc
@@ -16,6 +16,7 @@
 #include "base/strings/string_util.h"
 #include "base/time/clock.h"
 #include "base/time/default_clock.h"
+#include "base/time/time.h"
 #include "base/values.h"
 #include "chrome/browser/banners/app_banner_settings_helper.h"
 #include "chrome/browser/content_settings/host_content_settings_map_factory.h"
@@ -46,6 +47,7 @@
   "user_input_points",
   "visible_media_playing_points",
   "hidden_media_playing_points",
+  "web_app_installed_points"
 };
 
 // Length of time between metrics logging.
@@ -58,6 +60,10 @@
 // values are in microseconds, so this delta comes out at one second.
 const double kTimeDelta = 1000000;
 
+// Number of days after the last launch of an origin from an installed shortcut
+// for which WEB_APP_INSTALLED_POINTS will be added to the engagement score.
+const int kMaxDaysSinceShortcutLaunch = 10;
+
 scoped_ptr<ContentSettingsForOneType> GetEngagementContentSettings(
     HostContentSettingsMap* settings_map) {
   scoped_ptr<ContentSettingsForOneType> engagement_settings(
@@ -117,11 +123,14 @@
     0.05,  // USER_INPUT_POINTS
     0.02,  // VISIBLE_MEDIA_POINTS
     0.01,  // HIDDEN_MEDIA_POINTS
+    5,     // WEB_APP_INSTALLED_POINTS
 };
 
 const char* SiteEngagementScore::kRawScoreKey = "rawScore";
 const char* SiteEngagementScore::kPointsAddedTodayKey = "pointsAddedToday";
 const char* SiteEngagementScore::kLastEngagementTimeKey = "lastEngagementTime";
+const char* SiteEngagementScore::kLastShortcutLaunchTimeKey =
+    "lastShortcutLaunchTime";
 
 double SiteEngagementScore::GetMaxPointsPerDay() {
   return param_values[MAX_POINTS_PER_DAY];
@@ -151,6 +160,10 @@
   return param_values[HIDDEN_MEDIA_POINTS];
 }
 
+double SiteEngagementScore::GetWebAppInstalledPoints() {
+  return param_values[WEB_APP_INSTALLED_POINTS];
+}
+
 void SiteEngagementScore::UpdateFromVariations() {
   double param_vals[MAX_VARIATION];
 
@@ -179,16 +192,19 @@
     : SiteEngagementScore(clock) {
   score_dict.GetDouble(kRawScoreKey, &raw_score_);
   score_dict.GetDouble(kPointsAddedTodayKey, &points_added_today_);
+
   double internal_time;
   if (score_dict.GetDouble(kLastEngagementTimeKey, &internal_time))
     last_engagement_time_ = base::Time::FromInternalValue(internal_time);
+  if (score_dict.GetDouble(kLastShortcutLaunchTimeKey, &internal_time))
+    last_shortcut_launch_time_ = base::Time::FromInternalValue(internal_time);
 }
 
 SiteEngagementScore::~SiteEngagementScore() {
 }
 
 double SiteEngagementScore::Score() const {
-  return DecayedScore();
+  return std::min(DecayedScore() + BonusScore(), kMaxPoints);
 }
 
 void SiteEngagementScore::AddPoints(double points) {
@@ -225,17 +241,23 @@
   double raw_score_orig = 0;
   double points_added_today_orig = 0;
   double last_engagement_time_internal_orig = 0;
+  double last_shortcut_launch_time_internal_orig = 0;
 
   score_dict->GetDouble(kRawScoreKey, &raw_score_orig);
   score_dict->GetDouble(kPointsAddedTodayKey, &points_added_today_orig);
   score_dict->GetDouble(kLastEngagementTimeKey,
-                      &last_engagement_time_internal_orig);
+                        &last_engagement_time_internal_orig);
+  score_dict->GetDouble(kLastShortcutLaunchTimeKey,
+                        &last_shortcut_launch_time_internal_orig);
   bool changed =
       DoublesConsideredDifferent(raw_score_orig, raw_score_, kScoreDelta) ||
       DoublesConsideredDifferent(points_added_today_orig, points_added_today_,
                                  kScoreDelta) ||
       DoublesConsideredDifferent(last_engagement_time_internal_orig,
                                  last_engagement_time_.ToInternalValue(),
+                                 kTimeDelta) ||
+      DoublesConsideredDifferent(last_shortcut_launch_time_internal_orig,
+                                 last_shortcut_launch_time_.ToInternalValue(),
                                  kTimeDelta);
 
   if (!changed)
@@ -244,7 +266,9 @@
   score_dict->SetDouble(kRawScoreKey, raw_score_);
   score_dict->SetDouble(kPointsAddedTodayKey, points_added_today_);
   score_dict->SetDouble(kLastEngagementTimeKey,
-                      last_engagement_time_.ToInternalValue());
+                        last_engagement_time_.ToInternalValue());
+  score_dict->SetDouble(kLastShortcutLaunchTimeKey,
+                        last_shortcut_launch_time_.ToInternalValue());
 
   return true;
 }
@@ -253,7 +277,8 @@
     : clock_(clock),
       raw_score_(0),
       points_added_today_(0),
-      last_engagement_time_() {}
+      last_engagement_time_(),
+      last_shortcut_launch_time_() {}
 
 double SiteEngagementScore::DecayedScore() const {
   // Note that users can change their clock, so from this system's perspective
@@ -269,6 +294,15 @@
   return std::max(0.0, decayed_score);
 }
 
+double SiteEngagementScore::BonusScore() const {
+  int days_since_shortcut_launch =
+      (clock_->Now() - last_shortcut_launch_time_).InDays();
+  if (days_since_shortcut_launch <= kMaxDaysSinceShortcutLaunch)
+    return GetWebAppInstalledPoints();
+
+  return 0;
+}
+
 const char SiteEngagementService::kEngagementParams[] = "SiteEngagement";
 
 // static
@@ -362,6 +396,32 @@
                           weak_factory_.GetWeakPtr()));
 }
 
+void SiteEngagementService::SetLastShortcutLaunchTime(const GURL& url) {
+  HostContentSettingsMap* settings_map =
+    HostContentSettingsMapFactory::GetForProfile(profile_);
+  scoped_ptr<base::DictionaryValue> score_dict =
+      GetScoreDictForOrigin(settings_map, url);
+  SiteEngagementScore score(clock_.get(), *score_dict);
+
+  // Record the number of days since the last launch in UMA. If the user's clock
+  // has changed back in time, set this to 0.
+  base::Time now = clock_->Now();
+  base::Time last_launch = score.last_shortcut_launch_time();
+  if (!last_launch.is_null()) {
+    SiteEngagementMetrics::RecordDaysSinceLastShortcutLaunch(
+        std::max(0, (now - last_launch).InDays()));
+  }
+  SiteEngagementMetrics::RecordEngagement(
+      SiteEngagementMetrics::ENGAGEMENT_WEBAPP_SHORTCUT_LAUNCH);
+
+  score.set_last_shortcut_launch_time(now);
+  if (score.UpdateScoreDict(score_dict.get())) {
+    settings_map->SetWebsiteSettingDefaultScope(
+        url, GURL(), CONTENT_SETTINGS_TYPE_SITE_ENGAGEMENT, std::string(),
+        score_dict.release());
+  }
+}
+
 double SiteEngagementService::GetScore(const GURL& url) {
   HostContentSettingsMap* settings_map =
     HostContentSettingsMapFactory::GetForProfile(profile_);
diff --git a/chrome/browser/engagement/site_engagement_service.h b/chrome/browser/engagement/site_engagement_service.h
index 7f735d0..53ad612 100644
--- a/chrome/browser/engagement/site_engagement_service.h
+++ b/chrome/browser/engagement/site_engagement_service.h
@@ -51,6 +51,11 @@
     VISIBLE_MEDIA_POINTS,
     HIDDEN_MEDIA_POINTS,
 
+    // The number of points added to engagement when a site is launched from
+    // homescreen or added as a bookmark app. This bonus will apply for ten days
+    // following a launch; each new launch resets the ten days.
+    WEB_APP_INSTALLED_POINTS,
+
     MAX_VARIATION
   };
 
@@ -64,6 +69,7 @@
   static double GetUserInputPoints();
   static double GetVisibleMediaPoints();
   static double GetHiddenMediaPoints();
+  static double GetWebAppInstalledPoints();
 
   // Update the default engagement settings via variations.
   static void UpdateFromVariations();
@@ -81,6 +87,12 @@
   // Returns true if the maximum number of points today has been added.
   bool MaxPointsPerDayAdded();
 
+  // Get/set the last time this origin was launched from an installed shortcut.
+  base::Time last_shortcut_launch_time() { return last_shortcut_launch_time_; }
+  void set_last_shortcut_launch_time(const base::Time& time) {
+    last_shortcut_launch_time_ = time;
+  }
+
   // Updates the content settings dictionary |score_dict| with the current score
   // fields. Returns true if |score_dict| changed, otherwise return false.
   bool UpdateScoreDict(base::DictionaryValue* score_dict);
@@ -97,6 +109,7 @@
   static const char* kRawScoreKey;
   static const char* kPointsAddedTodayKey;
   static const char* kLastEngagementTimeKey;
+  static const char* kLastShortcutLaunchTimeKey;
 
   // This version of the constructor is used in unit tests.
   explicit SiteEngagementScore(base::Clock* clock);
@@ -104,6 +117,9 @@
   // Determine the score, accounting for any decay.
   double DecayedScore() const;
 
+  // Determine any score bonus from having installed shortcuts.
+  double BonusScore() const;
+
   // The clock used to vend times. Enables time travelling in tests. Owned by
   // the SiteEngagementService.
   base::Clock* clock_;
@@ -120,6 +136,10 @@
   // any one day.
   base::Time last_engagement_time_;
 
+  // The last time the site with this score was launched from an installed
+  // shortcut.
+  base::Time last_shortcut_launch_time_;
+
   DISALLOW_COPY_AND_ASSIGN(SiteEngagementScore);
 };
 
@@ -181,6 +201,10 @@
                      const history::URLRows& deleted_rows,
                      const std::set<GURL>& favicon_urls) override;
 
+  // Update the last time |url| was opened from an installed shortcut to be
+  // clock_->Now().
+  void SetLastShortcutLaunchTime(const GURL& url);
+
   // Overridden from SiteEngagementScoreProvider:
   double GetScore(const GURL& url) override;
   double GetTotalEngagementPoints() override;
@@ -192,6 +216,7 @@
   FRIEND_TEST_ALL_PREFIXES(SiteEngagementServiceTest, GetMedianEngagement);
   FRIEND_TEST_ALL_PREFIXES(SiteEngagementServiceTest, GetTotalNavigationPoints);
   FRIEND_TEST_ALL_PREFIXES(SiteEngagementServiceTest, GetTotalUserInputPoints);
+  FRIEND_TEST_ALL_PREFIXES(SiteEngagementServiceTest, LastShortcutLaunch);
   FRIEND_TEST_ALL_PREFIXES(SiteEngagementServiceTest,
                            CleanupOriginsOnHistoryDeletion);
   FRIEND_TEST_ALL_PREFIXES(AppBannerSettingsHelperTest, SiteEngagementTrigger);
diff --git a/chrome/browser/engagement/site_engagement_service_unittest.cc b/chrome/browser/engagement/site_engagement_service_unittest.cc
index b56a826..6e792773 100644
--- a/chrome/browser/engagement/site_engagement_service_unittest.cc
+++ b/chrome/browser/engagement/site_engagement_service_unittest.cc
@@ -574,6 +574,64 @@
   EXPECT_DOUBLE_EQ(0.4, service->GetTotalEngagementPoints());
 }
 
+TEST_F(SiteEngagementServiceTest, LastShortcutLaunch) {
+  base::SimpleTestClock* clock = new base::SimpleTestClock();
+  scoped_ptr<SiteEngagementService> service(
+      new SiteEngagementService(profile(), make_scoped_ptr(clock)));
+
+  base::HistogramTester histograms;
+
+  base::Time current_day = GetReferenceTime();
+  clock->SetNow(current_day - base::TimeDelta::FromDays(5));
+
+  // The https and http versions of www.google.com should be separate. But
+  // different paths on the same origin should be treated the same.
+  GURL url1("https://www.google.com/");
+  GURL url2("http://www.google.com/");
+  GURL url3("http://www.google.com/maps");
+
+  EXPECT_EQ(0, service->GetScore(url1));
+  EXPECT_EQ(0, service->GetScore(url2));
+  EXPECT_EQ(0, service->GetScore(url3));
+
+  service->SetLastShortcutLaunchTime(url2);
+  histograms.ExpectTotalCount(
+      SiteEngagementMetrics::kDaysSinceLastShortcutLaunchHistogram, 0);
+  histograms.ExpectUniqueSample(
+      SiteEngagementMetrics::kEngagementTypeHistogram,
+      SiteEngagementMetrics::ENGAGEMENT_WEBAPP_SHORTCUT_LAUNCH, 1);
+
+  service->AddPoints(url1, 2.0);
+  service->AddPoints(url2, 2.0);
+  clock->SetNow(current_day);
+  service->SetLastShortcutLaunchTime(url2);
+
+  histograms.ExpectTotalCount(
+      SiteEngagementMetrics::kDaysSinceLastShortcutLaunchHistogram, 1);
+  histograms.ExpectUniqueSample(
+      SiteEngagementMetrics::kEngagementTypeHistogram,
+      SiteEngagementMetrics::ENGAGEMENT_WEBAPP_SHORTCUT_LAUNCH, 2);
+
+  EXPECT_DOUBLE_EQ(2.0, service->GetScore(url1));
+  EXPECT_DOUBLE_EQ(7.0, service->GetScore(url2));
+
+  clock->SetNow(GetReferenceTime() + base::TimeDelta::FromDays(1));
+  EXPECT_DOUBLE_EQ(2.0, service->GetScore(url1));
+  EXPECT_DOUBLE_EQ(7.0, service->GetScore(url2));
+
+  clock->SetNow(GetReferenceTime() + base::TimeDelta::FromDays(7));
+  EXPECT_DOUBLE_EQ(0.0, service->GetScore(url1));
+  EXPECT_DOUBLE_EQ(5.0, service->GetScore(url2));
+
+  clock->SetNow(GetReferenceTime() + base::TimeDelta::FromDays(10));
+  EXPECT_DOUBLE_EQ(0.0, service->GetScore(url1));
+  EXPECT_DOUBLE_EQ(5.0, service->GetScore(url2));
+
+  clock->SetNow(GetReferenceTime() + base::TimeDelta::FromDays(11));
+  EXPECT_DOUBLE_EQ(0.0, service->GetScore(url1));
+  EXPECT_DOUBLE_EQ(0.0, service->GetScore(url2));
+}
+
 TEST_F(SiteEngagementServiceTest, CheckHistograms) {
   base::SimpleTestClock* clock = new base::SimpleTestClock();
   scoped_ptr<SiteEngagementService> service(
diff --git a/chrome/browser/extensions/api/easy_unlock_private/easy_unlock_private_api.cc b/chrome/browser/extensions/api/easy_unlock_private/easy_unlock_private_api.cc
index 9399d29..4558e418 100644
--- a/chrome/browser/extensions/api/easy_unlock_private/easy_unlock_private_api.cc
+++ b/chrome/browser/extensions/api/easy_unlock_private/easy_unlock_private_api.cc
@@ -352,14 +352,12 @@
   strings->SetString(
       "setupErrorFindingPhone",
       l10n_util::GetStringUTF16(IDS_EASY_UNLOCK_SETUP_ERROR_FINDING_PHONE));
-  strings->SetString(
-      "setupErrorSyncPhoneState",
-       l10n_util::GetStringUTF16(
-           IDS_EASY_UNLOCK_SETUP_ERROR_SYNC_PHONE_STATE_FAILED));
-  strings->SetString(
-      "setupErrorConnectingToPhone",
-      l10n_util::GetStringFUTF16(
-          IDS_EASY_UNLOCK_SETUP_ERROR_CONNECTING_TO_PHONE, device_type));
+  strings->SetString("setupErrorSyncPhoneState",
+                     l10n_util::GetStringUTF16(
+                         IDS_EASY_UNLOCK_SETUP_ERROR_SYNC_PHONE_STATE_FAILED));
+  strings->SetString("setupErrorConnectingToPhone",
+                     l10n_util::GetStringUTF16(
+                         IDS_EASY_UNLOCK_SETUP_ERROR_CONNECTING_TO_PHONE));
 
   SetResult(strings.release());
   return true;
diff --git a/chrome/browser/extensions/api/networking_private/networking_private_service_client_apitest.cc b/chrome/browser/extensions/api/networking_private/networking_private_service_client_apitest.cc
index eafc1e5..ecb8d09 100644
--- a/chrome/browser/extensions/api/networking_private/networking_private_service_client_apitest.cc
+++ b/chrome/browser/extensions/api/networking_private/networking_private_service_client_apitest.cc
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <utility>
+
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/command_line.h"
@@ -89,7 +91,7 @@
     scoped_ptr<wifi::FakeWiFiService> wifi_service(new wifi::FakeWiFiService());
     scoped_ptr<CryptoVerifyStub> crypto_verify(new CryptoVerifyStub);
     return scoped_ptr<KeyedService>(new NetworkingPrivateServiceClient(
-        wifi_service.Pass(), crypto_verify.Pass()));
+        std::move(wifi_service), std::move(crypto_verify)));
   }
 
   void SetUpOnMainThread() override {
diff --git a/chrome/browser/extensions/bookmark_app_helper.cc b/chrome/browser/extensions/bookmark_app_helper.cc
index e8da9979..0a9da716 100644
--- a/chrome/browser/extensions/bookmark_app_helper.cc
+++ b/chrome/browser/extensions/bookmark_app_helper.cc
@@ -156,8 +156,11 @@
   // Generate container icons from smaller icons.
   const int kIconSizesToGenerate[] = {
       extension_misc::EXTENSION_ICON_SMALL,
+      extension_misc::EXTENSION_ICON_SMALL * 2,
       extension_misc::EXTENSION_ICON_MEDIUM,
+      extension_misc::EXTENSION_ICON_MEDIUM * 2,
       extension_misc::EXTENSION_ICON_LARGE,
+      extension_misc::EXTENSION_ICON_LARGE * 2,
   };
   return std::set<int>(kIconSizesToGenerate,
                        kIconSizesToGenerate + arraysize(kIconSizesToGenerate));
@@ -189,9 +192,6 @@
        it != generate_sizes.end(); ++it) {
     extensions::BookmarkAppHelper::GenerateIcon(
         bitmap_map, *it, generated_icon_color, icon_letter);
-    // Also generate the 2x resource for this size.
-    extensions::BookmarkAppHelper::GenerateIcon(
-        bitmap_map, *it * 2, generated_icon_color, icon_letter);
   }
 }
 
@@ -377,11 +377,16 @@
     ordered_bitmaps[it->bitmap.width()] = *it;
   }
 
-  for (const auto& size : sizes) {
-    // Find the closest not-smaller bitmap.
-    auto bitmaps_it = ordered_bitmaps.lower_bound(size);
-    if (bitmaps_it != ordered_bitmaps.end()) {
-      output_bitmaps[size] = bitmaps_it->second;
+  if (ordered_bitmaps.size() > 0) {
+    for (const auto& size : sizes) {
+      // Find the closest not-smaller bitmap, or failing that use the largest
+      // icon available.
+      auto bitmaps_it = ordered_bitmaps.lower_bound(size);
+      if (bitmaps_it != ordered_bitmaps.end())
+        output_bitmaps[size] = bitmaps_it->second;
+      else
+        output_bitmaps[size] = ordered_bitmaps.rbegin()->second;
+
       // Resize the bitmap if it does not exactly match the desired size.
       if (output_bitmaps[size].bitmap.width() != size) {
         output_bitmaps[size].bitmap = skia::ImageOperations::Resize(
diff --git a/chrome/browser/extensions/bookmark_app_helper_unittest.cc b/chrome/browser/extensions/bookmark_app_helper_unittest.cc
index fe0cb02..1a29e7f 100644
--- a/chrome/browser/extensions/bookmark_app_helper_unittest.cc
+++ b/chrome/browser/extensions/bookmark_app_helper_unittest.cc
@@ -145,6 +145,21 @@
 }
 
 std::vector<BookmarkAppHelper::BitmapAndSource>::const_iterator
+FindLargestBitmapAndSourceVector(
+    const std::vector<BookmarkAppHelper::BitmapAndSource>& bitmap_vector) {
+  auto result = bitmap_vector.end();
+  int largest = -1;
+  for (std::vector<BookmarkAppHelper::BitmapAndSource>::const_iterator it =
+           bitmap_vector.begin();
+       it != bitmap_vector.end(); ++it) {
+    if (it->bitmap.width() > largest) {
+      result = it;
+    }
+  }
+  return result;
+}
+
+std::vector<BookmarkAppHelper::BitmapAndSource>::const_iterator
 FindMatchingBitmapAndSourceVector(
     const std::vector<BookmarkAppHelper::BitmapAndSource>& bitmap_vector,
     int size) {
@@ -188,48 +203,58 @@
     std::vector<BookmarkAppHelper::BitmapAndSource> downloaded,
     std::map<int, BookmarkAppHelper::BitmapAndSource> size_map,
     std::set<int> sizes_to_generate,
-    int expected_generated) {
+    int expected_generated,
+    int expected_resized) {
   GURL empty_url("");
   int number_generated = 0;
+  int number_resized = 0;
 
+  auto icon_largest = FindLargestBitmapAndSourceVector(downloaded);
   for (const auto& size : sizes_to_generate) {
     auto icon_downloaded = FindMatchingBitmapAndSourceVector(downloaded, size);
     auto icon_larger = FindEqualOrLargerBitmapAndSourceVector(downloaded, size);
     if (icon_downloaded == downloaded.end()) {
       auto icon_resized = size_map.find(size);
-      if (icon_larger == downloaded.end()) {
-        // There is no larger downloaded icon. Expect an icon to be generated.
-        EXPECT_NE(icon_resized, size_map.end());
-        EXPECT_EQ(icon_resized->second.bitmap.width(), size);
-        EXPECT_EQ(icon_resized->second.bitmap.height(), size);
-        EXPECT_EQ(icon_resized->second.bitmap.height(), size);
-        EXPECT_EQ(icon_resized->second.source_url, empty_url);
+      if (icon_largest == downloaded.end()) {
+        // There are no downloaded icons. Expect an icon to be generated.
+        EXPECT_NE(size_map.end(), icon_resized);
+        EXPECT_EQ(size, icon_resized->second.bitmap.width());
+        EXPECT_EQ(size, icon_resized->second.bitmap.height());
+        EXPECT_EQ(size, icon_resized->second.bitmap.height());
+        EXPECT_EQ(empty_url, icon_resized->second.source_url);
         ++number_generated;
       } else {
-        // There is a larger downloaded icon. Expect the larger icon to be
-        // resized down to fit this size.
-        EXPECT_NE(icon_resized, size_map.end());
-        EXPECT_EQ(icon_resized->second.bitmap.width(), size);
-        EXPECT_EQ(icon_resized->second.bitmap.height(), size);
-        EXPECT_EQ(icon_resized->second.bitmap.height(), size);
-        EXPECT_EQ(icon_resized->second.source_url, icon_larger->source_url);
+        // If there is a larger downloaded icon, it should be resized. Otherwise
+        // the largest downloaded icon should be resized.
+        auto icon_to_resize = icon_largest;
+        if (icon_larger != downloaded.end())
+          icon_to_resize = icon_larger;
+        EXPECT_NE(size_map.end(), icon_resized);
+        EXPECT_EQ(size, icon_resized->second.bitmap.width());
+        EXPECT_EQ(size, icon_resized->second.bitmap.height());
+        EXPECT_EQ(size, icon_resized->second.bitmap.height());
+        EXPECT_EQ(icon_to_resize->source_url, icon_resized->second.source_url);
+        ++number_resized;
       }
     } else {
       // There is an icon of exactly this size downloaded. Expect no icon to be
       // generated, and the existing downloaded icon to be used.
       auto icon_resized = size_map.find(size);
-      EXPECT_NE(icon_resized, size_map.end());
-      EXPECT_EQ(icon_resized->second.bitmap.width(), size);
-      EXPECT_EQ(icon_resized->second.bitmap.height(), size);
-      EXPECT_EQ(icon_downloaded->bitmap.width(), size);
-      EXPECT_EQ(icon_downloaded->bitmap.height(), size);
-      EXPECT_EQ(icon_resized->second.source_url, icon_downloaded->source_url);
+      EXPECT_NE(size_map.end(), icon_resized);
+      EXPECT_EQ(size, icon_resized->second.bitmap.width());
+      EXPECT_EQ(size, icon_resized->second.bitmap.height());
+      EXPECT_EQ(size, icon_downloaded->bitmap.width());
+      EXPECT_EQ(size, icon_downloaded->bitmap.height());
+      EXPECT_EQ(icon_downloaded->source_url, icon_resized->second.source_url);
     }
   }
-  EXPECT_EQ(number_generated, expected_generated);
+  EXPECT_EQ(expected_generated, number_generated);
+  EXPECT_EQ(expected_resized, number_resized);
 }
 
-void TestIconGeneration(int icon_size, int expected_generated) {
+void TestIconGeneration(int icon_size,
+                        int expected_generated,
+                        int expected_resized) {
   std::vector<BookmarkAppHelper::BitmapAndSource> downloaded;
 
   // Add an icon with a URL and bitmap. 'Download' it.
@@ -247,7 +272,8 @@
 
   ValidateIconsGeneratedAndResizedCorrectly(downloaded, size_map,
                                             TestSizesToGenerate(),
-                                            expected_generated);
+                                            expected_generated,
+                                            expected_resized);
 }
 
 }  // namespace
@@ -559,12 +585,13 @@
     std::map<int, BookmarkAppHelper::BitmapAndSource> results(
         BookmarkAppHelper::ConstrainBitmapsToSizes(bitmaps, desired_sizes));
 
-    EXPECT_EQ(5u, results.size());
+    EXPECT_EQ(6u, results.size());
     ValidateBitmapSizeAndColor(results[16].bitmap, 16, SK_ColorRED);
     ValidateBitmapSizeAndColor(results[32].bitmap, 32, SK_ColorGREEN);
     ValidateBitmapSizeAndColor(results[48].bitmap, 48, SK_ColorYELLOW);
     ValidateBitmapSizeAndColor(results[96].bitmap, 96, SK_ColorYELLOW);
     ValidateBitmapSizeAndColor(results[128].bitmap, 128, SK_ColorYELLOW);
+    ValidateBitmapSizeAndColor(results[256].bitmap, 256, SK_ColorYELLOW);
   }
   {
     std::vector<BookmarkAppHelper::BitmapAndSource> bitmaps;
@@ -606,7 +633,7 @@
   EXPECT_FALSE(IsValidBookmarkAppUrl(GURL("chrome://extensions")));
 }
 
-TEST_F(BookmarkAppHelperTest, IconsGeneratedOnlyWhenNoneLarger) {
+TEST_F(BookmarkAppHelperTest, IconsResizedFromOddSizes) {
   std::vector<BookmarkAppHelper::BitmapAndSource> downloaded;
 
   // Add three icons with a URL and bitmap. 'Download' each of them.
@@ -634,13 +661,12 @@
       BookmarkAppHelper::ResizeIconsAndGenerateMissing(
           downloaded, TestSizesToGenerate(), &web_app_info);
 
-  // The largest icon downloaded is smaller than EXTENSION_ICON_LARGE, so one
-  // icon should be generated.
+  // No icons should be generated. The LARGE and MEDIUM sizes should be resized.
   ValidateIconsGeneratedAndResizedCorrectly(
-      downloaded, size_map, TestSizesToGenerate(), 1);
+      downloaded, size_map, TestSizesToGenerate(), 0, 2);
 }
 
-TEST_F(BookmarkAppHelperTest, IconsGeneratedWhenNotDownloaded) {
+TEST_F(BookmarkAppHelperTest, IconsResizedFromLarger) {
   std::vector<BookmarkAppHelper::BitmapAndSource> downloaded;
 
   // Add three icons with a URL and bitmap. 'Download' two of them and pretend
@@ -665,15 +691,10 @@
       BookmarkAppHelper::ResizeIconsAndGenerateMissing(
           downloaded, TestSizesToGenerate(), &web_app_info);
 
-  // Expect icon for EXTENSION_ICON_LARGE to be resized from the gigantor icon
+  // Expect icon for MEDIUM and LARGE to be resized from the gigantor icon
   // as it was not downloaded.
   ValidateIconsGeneratedAndResizedCorrectly(
-      downloaded, size_map, TestSizesToGenerate(), 0);
-
-  // Verify specifically that the EXTENSION_ICON_LARGE icon was resized.
-  const auto it = size_map.find(kIconSizeLarge);
-  EXPECT_NE(it, size_map.end());
-  EXPECT_EQ(it->second.source_url, GURL(kAppIconURL3));
+      downloaded, size_map, TestSizesToGenerate(), 0, 2);
 }
 
 TEST_F(BookmarkAppHelperTest, AllIconsGeneratedWhenNotDownloaded) {
@@ -698,11 +719,11 @@
 
   // Expect all icons to be generated.
   ValidateIconsGeneratedAndResizedCorrectly(
-      downloaded, size_map, TestSizesToGenerate(), 3);
+      downloaded, size_map, TestSizesToGenerate(), 3, 0);
 }
 
 
-TEST_F(BookmarkAppHelperTest, LargeIconGeneratedWhenNotDownloaded) {
+TEST_F(BookmarkAppHelperTest, IconResizedFromLargerAndSmaller) {
   std::vector<BookmarkAppHelper::BitmapAndSource> downloaded;
 
   // Pretend the huge icon wasn't downloaded but two smaller ones were.
@@ -726,27 +747,27 @@
       BookmarkAppHelper::ResizeIconsAndGenerateMissing(
           downloaded, TestSizesToGenerate(), &web_app_info);
 
-  // Expect icon for EXTENSION_ICON_LARGE to be generated as the gigantor icon
-  // was not downloaded.
+  // Expect no icons to be generated, but the LARGE and SMALL icons to be
+  // resized from the MEDIUM icon.
   ValidateIconsGeneratedAndResizedCorrectly(
-      downloaded, size_map, TestSizesToGenerate(), 1);
+      downloaded, size_map, TestSizesToGenerate(), 0, 2);
 
-  // Verify specifically that the LARGE icons was generated.
+  // Verify specifically that the LARGE icons was resized from the medium icon.
   const auto it = size_map.find(kIconSizeLarge);
-  EXPECT_NE(it, size_map.end());
-  EXPECT_EQ(it->second.source_url, GURL());
+  EXPECT_NE(size_map.end(), it);
+  EXPECT_EQ(GURL(kAppIconURL2), it->second.source_url);
 }
 
-TEST_F(BookmarkAppHelperTest, AllIconsGeneratedWhenOnlyASmallOneIsProvided) {
+TEST_F(BookmarkAppHelperTest, IconsResizedWhenOnlyATinyOneIsProvided) {
   // When only a tiny icon is downloaded (smaller than the three desired
-  // sizes), 3 icons should be generated.
-  TestIconGeneration(kIconSizeTiny, 3);
+  // sizes), 3 icons should be resized.
+  TestIconGeneration(kIconSizeTiny, 0, 3);
 }
 
-TEST_F(BookmarkAppHelperTest, NoIconsGeneratedWhenAVeryLargeOneIsProvided) {
-  // When an enormous icon is provided, each desired icon size should fall back
-  // to it, and no icons should be generated.
-  TestIconGeneration(kIconSizeGigantor, 0);
+TEST_F(BookmarkAppHelperTest, IconsResizedWhenOnlyAGigantorOneIsProvided) {
+  // When an enormous icon is provided, each desired icon size should be resized
+  // from it, and no icons should be generated.
+  TestIconGeneration(kIconSizeGigantor, 0, 3);
 }
 
 }  // namespace extensions
diff --git a/chrome/browser/media_galleries/fileapi/iphoto_file_util.cc b/chrome/browser/media_galleries/fileapi/iphoto_file_util.cc
index 112def1..1f58e3d63 100644
--- a/chrome/browser/media_galleries/fileapi/iphoto_file_util.cc
+++ b/chrome/browser/media_galleries/fileapi/iphoto_file_util.cc
@@ -6,6 +6,7 @@
 
 #include <set>
 #include <string>
+#include <utility>
 #include <vector>
 
 #include "base/bind_helpers.h"
@@ -84,7 +85,7 @@
   // |data_provider| may be NULL if the file system was revoked before this
   // operation had a chance to run.
   if (!data_provider) {
-    GetFileInfoWithFreshDataProvider(context.Pass(), url, callback, false);
+    GetFileInfoWithFreshDataProvider(std::move(context), url, callback, false);
   } else {
     data_provider->RefreshData(
         base::Bind(&IPhotoFileUtil::GetFileInfoWithFreshDataProvider,
@@ -101,7 +102,8 @@
   // |data_provider| may be NULL if the file system was revoked before this
   // operation had a chance to run.
   if (!data_provider) {
-    ReadDirectoryWithFreshDataProvider(context.Pass(), url, callback, false);
+    ReadDirectoryWithFreshDataProvider(std::move(context), url, callback,
+                                       false);
   } else {
     data_provider->RefreshData(
         base::Bind(&IPhotoFileUtil::ReadDirectoryWithFreshDataProvider,
@@ -118,7 +120,7 @@
   // |data_provider| may be NULL if the file system was revoked before this
   // operation had a chance to run.
   if (!data_provider) {
-    CreateSnapshotFileWithFreshDataProvider(context.Pass(), url, callback,
+    CreateSnapshotFileWithFreshDataProvider(std::move(context), url, callback,
                                             false);
   } else {
     data_provider->RefreshData(
@@ -142,7 +144,7 @@
     }
     return;
   }
-  NativeMediaFileUtil::GetFileInfoOnTaskRunnerThread(context.Pass(), url,
+  NativeMediaFileUtil::GetFileInfoOnTaskRunnerThread(std::move(context), url,
                                                      callback);
 }
 
@@ -160,7 +162,7 @@
     }
     return;
   }
-  NativeMediaFileUtil::ReadDirectoryOnTaskRunnerThread(context.Pass(), url,
+  NativeMediaFileUtil::ReadDirectoryOnTaskRunnerThread(std::move(context), url,
                                                        callback);
 }
 
@@ -182,8 +184,8 @@
     }
     return;
   }
-  NativeMediaFileUtil::CreateSnapshotFileOnTaskRunnerThread(context.Pass(), url,
-                                                            callback);
+  NativeMediaFileUtil::CreateSnapshotFileOnTaskRunnerThread(std::move(context),
+                                                            url, callback);
 }
 
 // Begin actual implementation.
diff --git a/chrome/browser/media_galleries/fileapi/iphoto_file_util_unittest.cc b/chrome/browser/media_galleries/fileapi/iphoto_file_util_unittest.cc
index 0aa61c84..c912ef5 100644
--- a/chrome/browser/media_galleries/fileapi/iphoto_file_util_unittest.cc
+++ b/chrome/browser/media_galleries/fileapi/iphoto_file_util_unittest.cc
@@ -2,9 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "chrome/browser/media_galleries/fileapi/iphoto_file_util.h"
+
 #include <map>
 #include <set>
 #include <string>
+#include <utility>
 #include <vector>
 
 #include "base/bind.h"
@@ -18,7 +21,6 @@
 #include "base/thread_task_runner_handle.h"
 #include "base/time/time.h"
 #include "chrome/browser/media_galleries/fileapi/iphoto_data_provider.h"
-#include "chrome/browser/media_galleries/fileapi/iphoto_file_util.h"
 #include "chrome/browser/media_galleries/fileapi/media_file_system_backend.h"
 #include "chrome/browser/media_galleries/fileapi/media_path_filter.h"
 #include "chrome/browser/media_galleries/imported_media_gallery_registry.h"
@@ -213,11 +215,8 @@
         base::ThreadTaskRunnerHandle::Get().get(),
         base::ThreadTaskRunnerHandle::Get().get(),
         storage::ExternalMountPoints::CreateRefCounted().get(),
-        storage_policy.get(),
-        NULL,
-        additional_providers.Pass(),
-        std::vector<storage::URLRequestAutoMountHandler>(),
-        profile_dir_.path(),
+        storage_policy.get(), NULL, std::move(additional_providers),
+        std::vector<storage::URLRequestAutoMountHandler>(), profile_dir_.path(),
         content::CreateAllowFileAccessOptions());
   }
 
diff --git a/chrome/browser/media_galleries/fileapi/itunes_file_util.cc b/chrome/browser/media_galleries/fileapi/itunes_file_util.cc
index e3e7b139..9cce7a8 100644
--- a/chrome/browser/media_galleries/fileapi/itunes_file_util.cc
+++ b/chrome/browser/media_galleries/fileapi/itunes_file_util.cc
@@ -8,6 +8,7 @@
 
 #include <set>
 #include <string>
+#include <utility>
 #include <vector>
 
 #include "base/bind_helpers.h"
@@ -75,7 +76,7 @@
   // |data_provider| may be NULL if the file system was revoked before this
   // operation had a chance to run.
   if (!data_provider) {
-    GetFileInfoWithFreshDataProvider(context.Pass(), url, callback, false);
+    GetFileInfoWithFreshDataProvider(std::move(context), url, callback, false);
   } else {
     data_provider->RefreshData(
         base::Bind(&ITunesFileUtil::GetFileInfoWithFreshDataProvider,
@@ -92,7 +93,8 @@
   // |data_provider| may be NULL if the file system was revoked before this
   // operation had a chance to run.
   if (!data_provider) {
-    ReadDirectoryWithFreshDataProvider(context.Pass(), url, callback, false);
+    ReadDirectoryWithFreshDataProvider(std::move(context), url, callback,
+                                       false);
   } else {
     data_provider->RefreshData(
         base::Bind(&ITunesFileUtil::ReadDirectoryWithFreshDataProvider,
@@ -109,7 +111,7 @@
   // |data_provider| may be NULL if the file system was revoked before this
   // operation had a chance to run.
   if (!data_provider) {
-    CreateSnapshotFileWithFreshDataProvider(context.Pass(), url, callback,
+    CreateSnapshotFileWithFreshDataProvider(std::move(context), url, callback,
                                             false);
   } else {
     data_provider->RefreshData(
@@ -363,7 +365,7 @@
     }
     return;
   }
-  NativeMediaFileUtil::GetFileInfoOnTaskRunnerThread(context.Pass(), url,
+  NativeMediaFileUtil::GetFileInfoOnTaskRunnerThread(std::move(context), url,
                                                      callback);
 }
 
@@ -381,7 +383,7 @@
     }
     return;
   }
-  NativeMediaFileUtil::ReadDirectoryOnTaskRunnerThread(context.Pass(), url,
+  NativeMediaFileUtil::ReadDirectoryOnTaskRunnerThread(std::move(context), url,
                                                        callback);
 }
 
@@ -403,8 +405,8 @@
     }
     return;
   }
-  NativeMediaFileUtil::CreateSnapshotFileOnTaskRunnerThread(context.Pass(), url,
-                                                            callback);
+  NativeMediaFileUtil::CreateSnapshotFileOnTaskRunnerThread(std::move(context),
+                                                            url, callback);
 }
 
 ITunesDataProvider* ITunesFileUtil::GetDataProvider() {
diff --git a/chrome/browser/media_galleries/fileapi/itunes_file_util_unittest.cc b/chrome/browser/media_galleries/fileapi/itunes_file_util_unittest.cc
index de5184b..377d3339 100644
--- a/chrome/browser/media_galleries/fileapi/itunes_file_util_unittest.cc
+++ b/chrome/browser/media_galleries/fileapi/itunes_file_util_unittest.cc
@@ -2,8 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "chrome/browser/media_galleries/fileapi/itunes_file_util.h"
+
 #include <set>
 #include <string>
+#include <utility>
 #include <vector>
 
 #include "base/bind.h"
@@ -17,7 +20,6 @@
 #include "base/thread_task_runner_handle.h"
 #include "base/time/time.h"
 #include "chrome/browser/media_galleries/fileapi/itunes_data_provider.h"
-#include "chrome/browser/media_galleries/fileapi/itunes_file_util.h"
 #include "chrome/browser/media_galleries/fileapi/media_file_system_backend.h"
 #include "chrome/browser/media_galleries/fileapi/media_path_filter.h"
 #include "chrome/browser/media_galleries/imported_media_gallery_registry.h"
@@ -181,11 +183,8 @@
         base::ThreadTaskRunnerHandle::Get().get(),
         base::ThreadTaskRunnerHandle::Get().get(),
         storage::ExternalMountPoints::CreateRefCounted().get(),
-        storage_policy.get(),
-        NULL,
-        additional_providers.Pass(),
-        std::vector<storage::URLRequestAutoMountHandler>(),
-        profile_dir_.path(),
+        storage_policy.get(), NULL, std::move(additional_providers),
+        std::vector<storage::URLRequestAutoMountHandler>(), profile_dir_.path(),
         content::CreateAllowFileAccessOptions());
   }
 
diff --git a/chrome/browser/media_galleries/fileapi/picasa_data_provider_browsertest.cc b/chrome/browser/media_galleries/fileapi/picasa_data_provider_browsertest.cc
index d8187e43..c869bcf 100644
--- a/chrome/browser/media_galleries/fileapi/picasa_data_provider_browsertest.cc
+++ b/chrome/browser/media_galleries/fileapi/picasa_data_provider_browsertest.cc
@@ -2,6 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "chrome/browser/media_galleries/fileapi/picasa_data_provider.h"
+
+#include <utility>
 #include <vector>
 
 #include "base/files/file_enumerator.h"
@@ -14,7 +17,6 @@
 #include "base/run_loop.h"
 #include "build/build_config.h"
 #include "chrome/browser/media_galleries/fileapi/media_file_system_backend.h"
-#include "chrome/browser/media_galleries/fileapi/picasa_data_provider.h"
 #include "chrome/common/media_galleries/picasa_test_util.h"
 #include "chrome/common/media_galleries/picasa_types.h"
 #include "chrome/test/base/in_process_browser_test.h"
@@ -156,7 +158,7 @@
  private:
   void OnTempDirWatchStarted(
       scoped_ptr<base::FilePathWatcher> temp_dir_watcher) override {
-    PicasaDataProvider::OnTempDirWatchStarted(temp_dir_watcher.Pass());
+    PicasaDataProvider::OnTempDirWatchStarted(std::move(temp_dir_watcher));
 
     file_watch_request_returned_ = true;
     for (std::vector<ReadyCallback>::const_iterator it =
diff --git a/chrome/browser/media_galleries/fileapi/picasa_file_util.cc b/chrome/browser/media_galleries/fileapi/picasa_file_util.cc
index 6d2ca1c1..2871aed 100644
--- a/chrome/browser/media_galleries/fileapi/picasa_file_util.cc
+++ b/chrome/browser/media_galleries/fileapi/picasa_file_util.cc
@@ -5,6 +5,7 @@
 #include "chrome/browser/media_galleries/fileapi/picasa_file_util.h"
 
 #include <string>
+#include <utility>
 #include <vector>
 
 #include "base/bind_helpers.h"
@@ -92,7 +93,7 @@
   // |data_provider| may be NULL if the file system was revoked before this
   // operation had a chance to run.
   if (!data_provider) {
-    GetFileInfoWithFreshDataProvider(context.Pass(), url, callback, false);
+    GetFileInfoWithFreshDataProvider(std::move(context), url, callback, false);
   } else {
     data_provider->RefreshData(
         GetDataTypeForURL(url),
@@ -112,7 +113,8 @@
   // |data_provider| may be NULL if the file system was revoked before this
   // operation had a chance to run.
   if (!data_provider) {
-    ReadDirectoryWithFreshDataProvider(context.Pass(), url, callback, false);
+    ReadDirectoryWithFreshDataProvider(std::move(context), url, callback,
+                                       false);
   } else {
     data_provider->RefreshData(
         GetDataTypeForURL(url),
@@ -374,8 +376,8 @@
         base::Bind(callback, base::File::FILE_ERROR_IO, base::File::Info()));
     return;
   }
-  NativeMediaFileUtil::GetFileInfoOnTaskRunnerThread(
-      context.Pass(), url, callback);
+  NativeMediaFileUtil::GetFileInfoOnTaskRunnerThread(std::move(context), url,
+                                                     callback);
 }
 
 void PicasaFileUtil::ReadDirectoryWithFreshDataProvider(
@@ -390,8 +392,8 @@
         base::Bind(callback, base::File::FILE_ERROR_IO, EntryList(), false));
     return;
   }
-  NativeMediaFileUtil::ReadDirectoryOnTaskRunnerThread(
-      context.Pass(), url, callback);
+  NativeMediaFileUtil::ReadDirectoryOnTaskRunnerThread(std::move(context), url,
+                                                       callback);
 }
 
 PicasaDataProvider* PicasaFileUtil::GetDataProvider() {
diff --git a/chrome/browser/media_galleries/fileapi/picasa_file_util_unittest.cc b/chrome/browser/media_galleries/fileapi/picasa_file_util_unittest.cc
index ae8d7d31..51dda01f 100644
--- a/chrome/browser/media_galleries/fileapi/picasa_file_util_unittest.cc
+++ b/chrome/browser/media_galleries/fileapi/picasa_file_util_unittest.cc
@@ -2,11 +2,14 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "chrome/browser/media_galleries/fileapi/picasa_file_util.h"
+
 #include <stddef.h>
 #include <stdint.h>
 
 #include <set>
 #include <string>
+#include <utility>
 #include <vector>
 
 #include "base/bind_helpers.h"
@@ -25,7 +28,6 @@
 #include "chrome/browser/media_galleries/fileapi/media_file_system_backend.h"
 #include "chrome/browser/media_galleries/fileapi/media_path_filter.h"
 #include "chrome/browser/media_galleries/fileapi/picasa_data_provider.h"
-#include "chrome/browser/media_galleries/fileapi/picasa_file_util.h"
 #include "chrome/browser/media_galleries/imported_media_gallery_registry.h"
 #include "chrome/common/media_galleries/picasa_types.h"
 #include "chrome/common/media_galleries/pmp_constants.h"
@@ -251,11 +253,8 @@
         base::ThreadTaskRunnerHandle::Get().get(),
         base::ThreadTaskRunnerHandle::Get().get(),
         storage::ExternalMountPoints::CreateRefCounted().get(),
-        storage_policy.get(),
-        NULL,
-        additional_providers.Pass(),
-        std::vector<storage::URLRequestAutoMountHandler>(),
-        profile_dir_.path(),
+        storage_policy.get(), NULL, std::move(additional_providers),
+        std::vector<storage::URLRequestAutoMountHandler>(), profile_dir_.path(),
         content::CreateAllowFileAccessOptions());
   }
 
diff --git a/chrome/browser/media_galleries/fileapi/safe_iapps_library_parser.cc b/chrome/browser/media_galleries/fileapi/safe_iapps_library_parser.cc
index 5e7f042..827b295 100644
--- a/chrome/browser/media_galleries/fileapi/safe_iapps_library_parser.cc
+++ b/chrome/browser/media_galleries/fileapi/safe_iapps_library_parser.cc
@@ -4,6 +4,8 @@
 
 #include "chrome/browser/media_galleries/fileapi/safe_iapps_library_parser.h"
 
+#include <utility>
+
 #include "build/build_config.h"
 #include "chrome/browser/media_galleries/fileapi/media_file_system_backend.h"
 #include "chrome/common/chrome_utility_messages.h"
@@ -89,18 +91,16 @@
   }
 
   if (!itunes_callback_.is_null()) {
-    utility_process_host_->Send(
-        new ChromeUtilityMsg_ParseITunesLibraryXmlFile(
-            IPC::TakeFileHandleForProcess(
-                library_file_.Pass(),
-                utility_process_host_->GetData().handle)));
+    utility_process_host_->Send(new ChromeUtilityMsg_ParseITunesLibraryXmlFile(
+        IPC::TakeFileHandleForProcess(
+            std::move(library_file_),
+            utility_process_host_->GetData().handle)));
   } else if (!iphoto_callback_.is_null()) {
 #if defined(OS_MACOSX)
-    utility_process_host_->Send(
-        new ChromeUtilityMsg_ParseIPhotoLibraryXmlFile(
-            IPC::TakeFileHandleForProcess(
-                library_file_.Pass(),
-                utility_process_host_->GetData().handle)));
+    utility_process_host_->Send(new ChromeUtilityMsg_ParseIPhotoLibraryXmlFile(
+        IPC::TakeFileHandleForProcess(
+            std::move(library_file_),
+            utility_process_host_->GetData().handle)));
 #endif
   }
 
diff --git a/chrome/browser/media_galleries/fileapi/safe_picasa_album_table_reader.cc b/chrome/browser/media_galleries/fileapi/safe_picasa_album_table_reader.cc
index e5aaadc9..ee68dae 100644
--- a/chrome/browser/media_galleries/fileapi/safe_picasa_album_table_reader.cc
+++ b/chrome/browser/media_galleries/fileapi/safe_picasa_album_table_reader.cc
@@ -4,6 +4,8 @@
 
 #include "chrome/browser/media_galleries/fileapi/safe_picasa_album_table_reader.h"
 
+#include <utility>
+
 #include "base/bind.h"
 #include "base/logging.h"
 #include "chrome/browser/media_galleries/fileapi/media_file_system_backend.h"
@@ -20,7 +22,7 @@
 
 SafePicasaAlbumTableReader::SafePicasaAlbumTableReader(
     AlbumTableFiles album_table_files)
-    : album_table_files_(album_table_files.Pass()),
+    : album_table_files_(std::move(album_table_files)),
       parser_state_(INITIAL_STATE) {
   // TODO(tommycli): Add DCHECK to make sure |album_table_files| are all
   // opened read-only once security adds ability to check PlatformFiles.
@@ -85,26 +87,26 @@
   }
   AlbumTableFilesForTransit files_for_transit;
   files_for_transit.indicator_file = IPC::TakeFileHandleForProcess(
-      album_table_files_.indicator_file.Pass(),
+      std::move(album_table_files_.indicator_file),
       utility_process_host_->GetData().handle);
-  files_for_transit.category_file = IPC::TakeFileHandleForProcess(
-      album_table_files_.category_file.Pass(),
-      utility_process_host_->GetData().handle);
-  files_for_transit.date_file = IPC::TakeFileHandleForProcess(
-      album_table_files_.date_file.Pass(),
-      utility_process_host_->GetData().handle);
-  files_for_transit.filename_file = IPC::TakeFileHandleForProcess(
-      album_table_files_.filename_file.Pass(),
-      utility_process_host_->GetData().handle);
-  files_for_transit.name_file = IPC::TakeFileHandleForProcess(
-      album_table_files_.name_file.Pass(),
-      utility_process_host_->GetData().handle);
-  files_for_transit.token_file = IPC::TakeFileHandleForProcess(
-      album_table_files_.token_file.Pass(),
-      utility_process_host_->GetData().handle);
-  files_for_transit.uid_file = IPC::TakeFileHandleForProcess(
-      album_table_files_.uid_file.Pass(),
-      utility_process_host_->GetData().handle);
+  files_for_transit.category_file =
+      IPC::TakeFileHandleForProcess(std::move(album_table_files_.category_file),
+                                    utility_process_host_->GetData().handle);
+  files_for_transit.date_file =
+      IPC::TakeFileHandleForProcess(std::move(album_table_files_.date_file),
+                                    utility_process_host_->GetData().handle);
+  files_for_transit.filename_file =
+      IPC::TakeFileHandleForProcess(std::move(album_table_files_.filename_file),
+                                    utility_process_host_->GetData().handle);
+  files_for_transit.name_file =
+      IPC::TakeFileHandleForProcess(std::move(album_table_files_.name_file),
+                                    utility_process_host_->GetData().handle);
+  files_for_transit.token_file =
+      IPC::TakeFileHandleForProcess(std::move(album_table_files_.token_file),
+                                    utility_process_host_->GetData().handle);
+  files_for_transit.uid_file =
+      IPC::TakeFileHandleForProcess(std::move(album_table_files_.uid_file),
+                                    utility_process_host_->GetData().handle);
   utility_process_host_->Send(new ChromeUtilityMsg_ParsePicasaPMPDatabase(
       files_for_transit));
   parser_state_ = STARTED_PARSING_STATE;
diff --git a/chrome/browser/password_manager/password_manager_browsertest.cc b/chrome/browser/password_manager/password_manager_browsertest.cc
index 25a60c8..71f3029 100644
--- a/chrome/browser/password_manager/password_manager_browsertest.cc
+++ b/chrome/browser/password_manager/password_manager_browsertest.cc
@@ -1574,6 +1574,52 @@
   observer.Wait();
   EXPECT_FALSE(prompt_observer->IsShowingPrompt());
 }
+
+// Current and target URLs contain different parameters and references. This
+// test checks that parameters and references in origins are ignored for
+// form origin comparison.
+IN_PROC_BROWSER_TEST_F(
+    PasswordManagerBrowserTestBase,
+    PromptForPushStateWhenFormDisappears_ParametersInOrigins) {
+  NavigateToFile("/password/password_push_state.html?login#r");
+
+  NavigationObserver observer(WebContents());
+  observer.set_quit_on_entry_committed(true);
+  scoped_ptr<PromptObserver> prompt_observer(
+      PromptObserver::Create(WebContents()));
+  std::string fill_and_submit =
+      "add_parameters_to_target_url = true;"
+      "document.getElementById('pa_username_field').value = 'temp';"
+      "document.getElementById('pa_password_field').value = 'random';"
+      "document.getElementById('pa_submit_button').click()";
+  ASSERT_TRUE(content::ExecuteScript(RenderViewHost(), fill_and_submit));
+  observer.Wait();
+  EXPECT_TRUE(prompt_observer->IsShowingPrompt());
+}
+
+// Similar to the case above, but this time the form persists after
+// 'history.pushState()'. The password manager should find the login form even
+// if target and current URLs contain different parameters or references.
+// Save password prompt should not show up.
+IN_PROC_BROWSER_TEST_F(
+    PasswordManagerBrowserTestBase,
+    PromptForPushStateWhenFormPersists_ParametersInOrigins) {
+  NavigateToFile("/password/password_push_state.html?login#r");
+
+  NavigationObserver observer(WebContents());
+  observer.set_quit_on_entry_committed(true);
+  scoped_ptr<PromptObserver> prompt_observer(
+      PromptObserver::Create(WebContents()));
+  std::string fill_and_submit =
+      "should_delete_testform = false;"
+      "add_parameters_to_target_url = true;"
+      "document.getElementById('pa_username_field').value = 'temp';"
+      "document.getElementById('pa_password_field').value = 'random';"
+      "document.getElementById('pa_submit_button').click()";
+  ASSERT_TRUE(content::ExecuteScript(RenderViewHost(), fill_and_submit));
+  observer.Wait();
+  EXPECT_FALSE(prompt_observer->IsShowingPrompt());
+}
 #endif  // !OS_MACOSX && !OS_ANDROID
 
 IN_PROC_BROWSER_TEST_F(PasswordManagerBrowserTestBase,
diff --git a/chrome/browser/password_manager/password_store_factory.cc b/chrome/browser/password_manager/password_store_factory.cc
index 6730ae9..484f071bb 100644
--- a/chrome/browser/password_manager/password_store_factory.cc
+++ b/chrome/browser/password_manager/password_store_factory.cc
@@ -171,8 +171,8 @@
           os_crypt::switches::kUseMockKeychain)
           ? new crypto::MockAppleKeychain()
           : new crypto::AppleKeychain());
-  ps = new PasswordStoreProxyMac(main_thread_runner, keychain.Pass(),
-                                 login_db.Pass(), profile->GetPrefs());
+  ps = new PasswordStoreProxyMac(main_thread_runner, std::move(keychain),
+                                 std::move(login_db), profile->GetPrefs());
 #elif defined(OS_CHROMEOS) || defined(OS_ANDROID)
   // For now, we use PasswordStoreDefault. We might want to make a native
   // backend for PasswordStoreX (see below) in the future though.
diff --git a/chrome/browser/password_manager/password_store_mac.cc b/chrome/browser/password_manager/password_store_mac.cc
index 15fa9ece..740c2948 100644
--- a/chrome/browser/password_manager/password_store_mac.cc
+++ b/chrome/browser/password_manager/password_store_mac.cc
@@ -500,9 +500,9 @@
   MoveAllFormsOut(
       forms, [&remaining, extracted](scoped_ptr<autofill::PasswordForm> form) {
         if (IsLoginDatabaseOnlyForm(*form))
-          extracted->push_back(form.Pass());
+          extracted->push_back(std::move(form));
         else
-          remaining.push_back(form.Pass());
+          remaining.push_back(std::move(form));
       });
   forms->swap(remaining);
 }
@@ -539,9 +539,9 @@
     if (best_match) {
       used_keychain_forms.insert(best_match);
       form->password_value = best_match->password_value;
-      merged_forms->push_back(form.Pass());
+      merged_forms->push_back(std::move(form));
     } else {
-      unused_database_forms.push_back(form.Pass());
+      unused_database_forms.push_back(std::move(form));
     }
   });
   database_forms->swap(unused_database_forms);
@@ -607,7 +607,7 @@
         ExtractPasswordsMergeableWithForm(keychain, item_form_pairs, *form);
 
     ScopedVector<autofill::PasswordForm> db_form_container;
-    db_form_container.push_back(form.Pass());
+    db_form_container.push_back(std::move(form));
     MergePasswordForms(&keychain_matches, &db_form_container, passwords);
     AppendSecondToFirst(&unused_db_forms, &db_form_container);
   });
@@ -691,10 +691,10 @@
           true);  // Load password attributes and data.
       // Do not include blacklisted items found in the keychain.
       if (!form_with_password->blacklisted_by_user)
-        matches.push_back(form_with_password.Pass());
+        matches.push_back(std::move(form_with_password));
     }
   }
-  return matches.Pass();
+  return matches;
 }
 
 }  // namespace internal_keychain_helpers
@@ -841,12 +841,12 @@
     scoped_ptr<PasswordForm> form(new PasswordForm());
     if (internal_keychain_helpers::FillPasswordFormFromKeychainItem(
             *keychain_, item, form.get(), true)) {
-      forms.push_back(form.Pass());
+      forms.push_back(std::move(form));
     }
     keychain_->Free(item);
   }
   items->clear();
-  return forms.Pass();
+  return forms;
 }
 
 SecKeychainItemRef MacKeychainPasswordFormAdapter::KeychainItemForForm(
@@ -958,7 +958,7 @@
     scoped_refptr<base::SingleThreadTaskRunner> db_thread_runner,
     scoped_ptr<AppleKeychain> keychain)
     : password_manager::PasswordStore(main_thread_runner, db_thread_runner),
-      keychain_(keychain.Pass()),
+      keychain_(std::move(keychain)),
       login_metadata_db_(nullptr) {
   DCHECK(keychain_);
 }
@@ -1151,7 +1151,7 @@
             scoped_ptr<autofill::PasswordForm> form_to_consider) {
           if (origin.IsSameOriginWith(url::Origin(form_to_consider->origin)) &&
               login_metadata_db_->RemoveLogin(*form_to_consider))
-            forms_to_remove.push_back(form_to_consider.Pass());
+            forms_to_remove.push_back(std::move(form_to_consider));
         });
     if (!forms_to_remove.empty()) {
       RemoveKeychainForms(forms_to_remove.get());
@@ -1254,7 +1254,7 @@
     NotifyLoginsChanged(FormsToRemoveChangeList(database_forms.get()));
   }
 
-  return matched_forms.Pass();
+  return matched_forms;
 }
 
 bool PasswordStoreMac::FillAutofillableLogins(
@@ -1339,7 +1339,7 @@
   MoveAllFormsOut(forms, [this, &removed_forms](
                              scoped_ptr<autofill::PasswordForm> form) {
     if (login_metadata_db_->RemoveLogin(*form))
-      removed_forms.push_back(form.Pass());
+      removed_forms.push_back(std::move(form));
   });
   removed_forms.swap(*forms);
 }
diff --git a/chrome/browser/password_manager/password_store_proxy_mac.cc b/chrome/browser/password_manager/password_store_proxy_mac.cc
index 0124317..3a9fb69 100644
--- a/chrome/browser/password_manager/password_store_proxy_mac.cc
+++ b/chrome/browser/password_manager/password_store_proxy_mac.cc
@@ -5,6 +5,7 @@
 #include "chrome/browser/password_manager/password_store_proxy_mac.h"
 
 #include <string>
+#include <utility>
 
 #include "base/metrics/histogram_macros.h"
 #include "chrome/browser/password_manager/password_store_mac.h"
@@ -21,7 +22,7 @@
     scoped_ptr<password_manager::LoginDatabase> login_db,
     PrefService* prefs)
     : PasswordStore(main_thread_runner, nullptr),
-      login_metadata_db_(login_db.Pass()) {
+      login_metadata_db_(std::move(login_db)) {
   DCHECK(login_metadata_db_);
   migration_status_.Init(password_manager::prefs::kKeychainMigrationStatus,
                          prefs);
@@ -32,7 +33,7 @@
         new SimplePasswordStoreMac(main_thread_runner, nullptr, nullptr);
   } else {
     password_store_mac_ =
-        new PasswordStoreMac(main_thread_runner, nullptr, keychain.Pass());
+        new PasswordStoreMac(main_thread_runner, nullptr, std::move(keychain));
   }
 }
 
@@ -96,7 +97,7 @@
 
   if (status == MigrationStatus::MIGRATED) {
     password_store_simple_->InitWithTaskRunner(GetBackgroundTaskRunner(),
-                                               login_metadata_db_.Pass());
+                                               std::move(login_metadata_db_));
   } else {
     password_store_mac_->set_login_metadata_db(login_metadata_db_.get());
     password_store_mac_->InitWithTaskRunner(GetBackgroundTaskRunner());
@@ -114,7 +115,7 @@
         DCHECK(!password_store_simple_);
         password_store_simple_ = new SimplePasswordStoreMac(
             main_thread_runner_, GetBackgroundTaskRunner(),
-            login_metadata_db_.Pass());
+            std::move(login_metadata_db_));
       } else {
         status = (status == MigrationStatus::FAILED_ONCE
                       ? MigrationStatus::FAILED_TWICE
diff --git a/chrome/browser/password_manager/password_store_proxy_mac_unittest.cc b/chrome/browser/password_manager/password_store_proxy_mac_unittest.cc
index d4a0d56d..2ea0d468 100644
--- a/chrome/browser/password_manager/password_store_proxy_mac_unittest.cc
+++ b/chrome/browser/password_manager/password_store_proxy_mac_unittest.cc
@@ -4,6 +4,8 @@
 
 #include "chrome/browser/password_manager/password_store_proxy_mac.h"
 
+#include <utility>
+
 #include "base/files/scoped_temp_dir.h"
 #include "base/macros.h"
 #include "base/scoped_observer.h"
@@ -145,7 +147,7 @@
 void PasswordStoreProxyMacTest::SetUp() {
   scoped_ptr<password_manager::LoginDatabase> login_db(
       new password_manager::LoginDatabase(test_login_db_file_path()));
-  CreateAndInitPasswordStore(login_db.Pass());
+  CreateAndInitPasswordStore(std::move(login_db));
 }
 
 void PasswordStoreProxyMacTest::TearDown() {
@@ -156,7 +158,7 @@
     scoped_ptr<password_manager::LoginDatabase> login_db) {
   store_ = new PasswordStoreProxyMac(
       BrowserThread::GetMessageLoopProxyForThread(BrowserThread::UI),
-      make_scoped_ptr(new crypto::MockAppleKeychain), login_db.Pass(),
+      make_scoped_ptr(new crypto::MockAppleKeychain), std::move(login_db),
       &testing_prefs_);
   ASSERT_TRUE(store_->Init(syncer::SyncableService::StartSyncFlare()));
 }
@@ -445,7 +447,7 @@
     keychain_->set_locked(true);
   store_ = new PasswordStoreProxyMac(
       BrowserThread::GetMessageLoopProxyForThread(BrowserThread::UI),
-      keychain_.Pass(), login_db_.Pass(), &testing_prefs_);
+      std::move(keychain_), std::move(login_db_), &testing_prefs_);
   ASSERT_TRUE(store_->Init(syncer::SyncableService::StartSyncFlare()));
   FinishAsyncProcessing();
 
diff --git a/chrome/browser/password_manager/simple_password_store_mac.cc b/chrome/browser/password_manager/simple_password_store_mac.cc
index a16673d9..8d4171cc 100644
--- a/chrome/browser/password_manager/simple_password_store_mac.cc
+++ b/chrome/browser/password_manager/simple_password_store_mac.cc
@@ -4,12 +4,15 @@
 
 #include "chrome/browser/password_manager/simple_password_store_mac.h"
 
+#include <utility>
+
 SimplePasswordStoreMac::SimplePasswordStoreMac(
     scoped_refptr<base::SingleThreadTaskRunner> main_thread_runner,
     scoped_refptr<base::SingleThreadTaskRunner> background_thread_runner,
     scoped_ptr<password_manager::LoginDatabase> login_db)
-    : PasswordStoreDefault(main_thread_runner, background_thread_runner,
-                           login_db.Pass()) {
+    : PasswordStoreDefault(main_thread_runner,
+                           background_thread_runner,
+                           std::move(login_db)) {
   if (this->login_db())
     this->login_db()->set_clear_password_values(false);
 }
@@ -22,7 +25,7 @@
     scoped_ptr<password_manager::LoginDatabase> login_db) {
   db_thread_runner_ = background_task_runner;
   DCHECK(GetBackgroundTaskRunner()->BelongsToCurrentThread());
-  set_login_db(login_db.Pass());
+  set_login_db(std::move(login_db));
   if (this->login_db())
     this->login_db()->set_clear_password_values(false);
 }
diff --git a/chrome/browser/plugins/plugin_infobar_delegates.cc b/chrome/browser/plugins/plugin_infobar_delegates.cc
index 2c457c0..84dc8a0 100644
--- a/chrome/browser/plugins/plugin_infobar_delegates.cc
+++ b/chrome/browser/plugins/plugin_infobar_delegates.cc
@@ -4,6 +4,8 @@
 
 #include "chrome/browser/plugins/plugin_infobar_delegates.h"
 
+#include <utility>
+
 #include "base/bind.h"
 #include "base/path_service.h"
 #include "base/strings/utf_string_conversions.h"
@@ -57,10 +59,11 @@
   base::string16 name(plugin_metadata->name());
   infobar_service->AddInfoBar(infobar_service->CreateConfirmInfoBar(
       scoped_ptr<ConfirmInfoBarDelegate>(new OutdatedPluginInfoBarDelegate(
-          installer, plugin_metadata.Pass(),
+          installer, std::move(plugin_metadata),
           l10n_util::GetStringFUTF16(
-              (installer->state() == PluginInstaller::INSTALLER_STATE_IDLE) ?
-                  IDS_PLUGIN_OUTDATED_PROMPT : IDS_PLUGIN_DOWNLOADING,
+              (installer->state() == PluginInstaller::INSTALLER_STATE_IDLE)
+                  ? IDS_PLUGIN_OUTDATED_PROMPT
+                  : IDS_PLUGIN_DOWNLOADING,
               name)))));
 }
 
@@ -71,7 +74,7 @@
     : ConfirmInfoBarDelegate(),
       WeakPluginInstallerObserver(installer),
       identifier_(plugin_metadata->identifier()),
-      plugin_metadata_(plugin_metadata.Pass()),
+      plugin_metadata_(std::move(plugin_metadata)),
       message_(message) {
   content::RecordAction(UserMetricsAction("OutdatedPluginInfobar.Shown"));
   std::string name = base::UTF16ToUTF8(plugin_metadata_->name());
@@ -208,7 +211,7 @@
       infobar,
       infobar->owner()->CreateConfirmInfoBar(
           scoped_ptr<ConfirmInfoBarDelegate>(new OutdatedPluginInfoBarDelegate(
-              installer, plugin_metadata.Pass(), message))));
+              installer, std::move(plugin_metadata), message))));
 }
 
 #if defined(OS_WIN)
diff --git a/chrome/browser/plugins/plugin_installer.cc b/chrome/browser/plugins/plugin_installer.cc
index bef3f4d7..3c6204b 100644
--- a/chrome/browser/plugins/plugin_installer.cc
+++ b/chrome/browser/plugins/plugin_installer.cc
@@ -4,6 +4,8 @@
 
 #include "chrome/browser/plugins/plugin_installer.h"
 
+#include <utility>
+
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/process/process.h"
@@ -107,7 +109,7 @@
   download_parameters->set_callback(
       base::Bind(&PluginInstaller::DownloadStarted, base::Unretained(this)));
   RecordDownloadSource(DOWNLOAD_INITIATED_BY_PLUGIN_INSTALLER);
-  download_manager->DownloadUrl(download_parameters.Pass());
+  download_manager->DownloadUrl(std::move(download_parameters));
 }
 
 void PluginInstaller::DownloadStarted(
diff --git a/chrome/browser/plugins/plugin_installer_unittest.cc b/chrome/browser/plugins/plugin_installer_unittest.cc
index 8a123a7..6938e24 100644
--- a/chrome/browser/plugins/plugin_installer_unittest.cc
+++ b/chrome/browser/plugins/plugin_installer_unittest.cc
@@ -51,7 +51,7 @@
       new testing::StrictMock<content::MockDownloadItem>());
   ON_CALL(*mock_download_item, GetState())
       .WillByDefault(testing::Return(content::DownloadItem::IN_PROGRESS));
-  return mock_download_item.Pass();
+  return mock_download_item;
 }
 
 class TestPluginInstallerObserver : public PluginInstallerObserver {
diff --git a/chrome/browser/plugins/plugin_observer.cc b/chrome/browser/plugins/plugin_observer.cc
index 83857747..10f80d63 100644
--- a/chrome/browser/plugins/plugin_observer.cc
+++ b/chrome/browser/plugins/plugin_observer.cc
@@ -4,6 +4,8 @@
 
 #include "chrome/browser/plugins/plugin_observer.h"
 
+#include <utility>
+
 #include "base/auto_reset.h"
 #include "base/bind.h"
 #include "base/debug/crash_logging.h"
@@ -87,8 +89,7 @@
     : TabModalConfirmDialogDelegate(web_contents),
       WeakPluginInstallerObserver(installer),
       web_contents_(web_contents),
-      plugin_metadata_(plugin_metadata.Pass()) {
-}
+      plugin_metadata_(std::move(plugin_metadata)) {}
 
 base::string16 ConfirmInstallDialogDelegate::GetTitle() {
   return l10n_util::GetStringFUTF16(
@@ -379,8 +380,9 @@
   if (finder->FindPluginWithIdentifier(identifier, &installer, &plugin)) {
     plugin_placeholders_[placeholder_id] = new PluginPlaceholderHost(
         this, placeholder_id, plugin->name(), installer);
-    OutdatedPluginInfoBarDelegate::Create(InfoBarService::FromWebContents(
-        web_contents()), installer, plugin.Pass());
+    OutdatedPluginInfoBarDelegate::Create(
+        InfoBarService::FromWebContents(web_contents()), installer,
+        std::move(plugin));
   } else {
     NOTREACHED();
   }
diff --git a/chrome/browser/policy/chrome_browser_policy_connector.cc b/chrome/browser/policy/chrome_browser_policy_connector.cc
index e6d786b4..b9d3dfe 100644
--- a/chrome/browser/policy/chrome_browser_policy_connector.cc
+++ b/chrome/browser/policy/chrome_browser_policy_connector.cc
@@ -103,7 +103,7 @@
       BrowserThread::GetMessageLoopProxyForThread(BrowserThread::FILE),
       GetManagedPolicyPath(),
       new MacPreferences()));
-  return new AsyncPolicyProvider(GetSchemaRegistry(), loader.Pass());
+  return new AsyncPolicyProvider(GetSchemaRegistry(), std::move(loader));
 #elif defined(OS_POSIX) && !defined(OS_ANDROID)
   base::FilePath config_dir_path;
   if (PathService::Get(chrome::DIR_POLICY_FILES, &config_dir_path)) {
diff --git a/chrome/browser/resources/extensions/extension_error.js b/chrome/browser/resources/extensions/extension_error.js
index 0f50425..7853a15 100644
--- a/chrome/browser/resources/extensions/extension_error.js
+++ b/chrome/browser/resources/extensions/extension_error.js
@@ -67,18 +67,21 @@
        * @type {(ManifestError|RuntimeError)}
        */
       this.error = error;
+      var iconAltTextKey = 'extensionLogLevelWarn';
 
       // Add an additional class for the severity level.
       if (error.type == chrome.developerPrivate.ErrorType.RUNTIME) {
         switch (error.severity) {
           case chrome.developerPrivate.ErrorLevel.LOG:
             this.classList.add('extension-error-severity-info');
+            iconAltTextKey = 'extensionLogLevelInfo';
             break;
           case chrome.developerPrivate.ErrorLevel.WARN:
             this.classList.add('extension-error-severity-warning');
             break;
           case chrome.developerPrivate.ErrorLevel.ERROR:
             this.classList.add('extension-error-severity-fatal');
+            iconAltTextKey = 'extensionLogLevelError';
             break;
           default:
             assertNotReached();
@@ -90,9 +93,7 @@
 
       var iconNode = document.createElement('img');
       iconNode.className = 'extension-error-icon';
-      // TODO(hcarmona): Populate alt text with a proper description since this
-      // icon conveys the severity of the error. (info, warning, fatal).
-      iconNode.alt = '';
+      iconNode.alt = loadTimeData.getString(iconAltTextKey);
       this.insertBefore(iconNode, this.firstChild);
 
       var messageSpan = this.querySelector('.extension-error-message');
diff --git a/chrome/browser/resources/media_router/elements/media_router_container/media_router_container.js b/chrome/browser/resources/media_router/elements/media_router_container/media_router_container.js
index 942e5e4..0db2848 100644
--- a/chrome/browser/resources/media_router/elements/media_router_container/media_router_container.js
+++ b/chrome/browser/resources/media_router/elements/media_router_container/media_router_container.js
@@ -1077,4 +1077,27 @@
       this.fire('navigate-to-cast-mode-list');
     }
   },
+
+  /**
+   * Compute the new maximum height of the sink list and update the style.
+   *
+   * @param {number} dialogHeight The height of the Media Router dialog.
+   */
+  updateMaxSinkListHeight: function(dialogHeight) {
+    var headerHeight = this.$$('#container-header').offsetHeight;
+    var firstRunFlowHeight =
+        this.computeShowFirstRunFlow_(this.showFirstRunFlow,
+                                      this.currentView_) ?
+        this.$$('#first-run-flow').offsetHeight : 0;
+    this.$['container-header'].style.marginTop = firstRunFlowHeight + 'px';
+    this.$['sink-list-view'].style.marginTop =
+        firstRunFlowHeight + headerHeight + 'px';
+
+    // TODO(apacible): After non-fatal issue banner has been updated to appear
+    // below the sink list rather than overlapping, take into account the
+    // banner height when calculating the sink list height.
+    // crbug.com/567362
+    this.$['sink-list'].style.maxHeight =
+        dialogHeight - headerHeight - firstRunFlowHeight + 'px';
+  },
 });
diff --git a/chrome/browser/resources/media_router/media_router_ui_interface.js b/chrome/browser/resources/media_router/media_router_ui_interface.js
index 4467aa4..49044f8 100644
--- a/chrome/browser/resources/media_router/media_router_ui_interface.js
+++ b/chrome/browser/resources/media_router/media_router_ui_interface.js
@@ -99,6 +99,15 @@
     container.allSinks = sinkList;
   }
 
+  /**
+   * Updates the max height of the dialog
+   *
+   * @param {number} height
+   */
+  function updateMaxHeight(height) {
+    container.updateMaxSinkListHeight(height);
+  }
+
   return {
     onNotifyRouteCreationTimeout: onNotifyRouteCreationTimeout,
     onCreateRouteResponseReceived: onCreateRouteResponseReceived,
@@ -108,6 +117,7 @@
     setIssue: setIssue,
     setRouteList: setRouteList,
     setSinkList: setSinkList,
+    updateMaxHeight: updateMaxHeight,
   };
 });
 
diff --git a/chrome/browser/resources/pdf/elements/viewer-page-selector/viewer-page-selector.css b/chrome/browser/resources/pdf/elements/viewer-page-selector/viewer-page-selector.css
index 051d257..ab124ab 100644
--- a/chrome/browser/resources/pdf/elements/viewer-page-selector/viewer-page-selector.css
+++ b/chrome/browser/resources/pdf/elements/viewer-page-selector/viewer-page-selector.css
@@ -4,7 +4,7 @@
 
 :host {
   color: #fff;
-  font-size: 88.8%;
+  font-size: 94.4%;
 }
 
 :host ::selection {
@@ -48,5 +48,5 @@
 
 #slash,
 #pagelength {
-  font-size: 81.25%;
+  font-size: 76.5%;
 }
diff --git a/chrome/browser/resources/settings/appearance_page/appearance_page.html b/chrome/browser/resources/settings/appearance_page/appearance_page.html
index 04a5f5a..1aa5153 100644
--- a/chrome/browser/resources/settings/appearance_page/appearance_page.html
+++ b/chrome/browser/resources/settings/appearance_page/appearance_page.html
@@ -57,11 +57,11 @@
             <paper-radio-button name="true"
                 >[[i18n('homePageNtp')]]</paper-radio-button>
             <paper-radio-button name="false"
-                >[[i18n('openThisPage')]]</paper-radio-button>
+                >[[i18n('other')]]</paper-radio-button>
           </settings-radio-group>
           <div class="radio-extended">
             <settings-input no-label-float pref="{{prefs.homepage}}"
-                label="[[i18n('onStartupEnterUrl')]]">
+                label="[[i18n('exampleDotCom')]]">
             </settings-input>
           </div>
         </template>
diff --git a/chrome/browser/safe_browsing/incident_reporting/binary_integrity_analyzer_mac.cc b/chrome/browser/safe_browsing/incident_reporting/binary_integrity_analyzer_mac.cc
index a6ad5f1c..ab34959be 100644
--- a/chrome/browser/safe_browsing/incident_reporting/binary_integrity_analyzer_mac.cc
+++ b/chrome/browser/safe_browsing/incident_reporting/binary_integrity_analyzer_mac.cc
@@ -6,6 +6,8 @@
 
 #include <stddef.h>
 
+#include <utility>
+
 #include "base/files/file_util.h"
 #include "base/mac/bundle_locations.h"
 #include "chrome/browser/safe_browsing/incident_reporting/binary_integrity_incident.h"
@@ -33,7 +35,7 @@
       incident(new ClientIncidentReport_IncidentData_BinaryIntegrityIncident());
   if (!evaluator.PerformEvaluation(incident.get())) {
     incident_receiver->AddIncidentForProcess(
-        make_scoped_ptr(new BinaryIntegrityIncident(incident.Pass())));
+        make_scoped_ptr(new BinaryIntegrityIncident(std::move(incident))));
   } else {
     // Clear past incidents involving this bundle if the signature is
     // now valid.
diff --git a/chrome/browser/safe_browsing/protocol_manager.cc b/chrome/browser/safe_browsing/protocol_manager.cc
index e8a6d16..cd69a97 100644
--- a/chrome/browser/safe_browsing/protocol_manager.cc
+++ b/chrome/browser/safe_browsing/protocol_manager.cc
@@ -134,6 +134,35 @@
                                          config);
 }
 
+// static
+// Backoff interval is MIN(((2^(n-1))*15 minutes) * (RAND + 1), 24 hours) where
+// n is the number of consecutive errors.
+base::TimeDelta SafeBrowsingProtocolManager::GetNextV4BackOffInterval(
+    size_t* error_count,
+    size_t* multiplier) {
+  DCHECK(multiplier && error_count);
+  (*error_count)++;
+  if (*error_count > 1 && *error_count < 9) {
+    // With error count 9 and above we will hit the 24 hour max interval.
+    // Cap the multiplier here to prevent integer overflow errors.
+    *multiplier *= 2;
+  }
+  base::TimeDelta next = base::TimeDelta::FromMinutes(
+      *multiplier * (1 + base::RandDouble()) * 15);
+
+  base::TimeDelta day = base::TimeDelta::FromHours(24);
+
+  if (next < day)
+    return next;
+  else
+    return day;
+}
+
+void SafeBrowsingProtocolManager::ResetGetHashV4Errors() {
+  gethash_v4_error_count_ = 0;
+  gethash_v4_back_off_mult_ = 1;
+}
+
 SafeBrowsingProtocolManager::SafeBrowsingProtocolManager(
     SafeBrowsingProtocolManagerDelegate* delegate,
     net::URLRequestContextGetter* request_context_getter,
@@ -142,12 +171,15 @@
       request_type_(NO_REQUEST),
       update_error_count_(0),
       gethash_error_count_(0),
+      gethash_v4_error_count_(0),
       update_back_off_mult_(1),
       gethash_back_off_mult_(1),
+      gethash_v4_back_off_mult_(1),
       next_update_interval_(base::TimeDelta::FromSeconds(
           base::RandInt(kSbTimerStartIntervalSecMin,
                         kSbTimerStartIntervalSecMax))),
       chunk_pending_to_write_(false),
+      next_gethash_v4_time_(Time::FromDoubleT(0)),
       version_(config.version),
       update_size_(0),
       client_name_(config.client_name),
@@ -283,6 +315,12 @@
         response.negative_cache_duration().seconds());
   }
 
+  if (response.has_minimum_wait_duration()) {
+    // Seconds resolution is good enough so we ignore the nanos field.
+    next_gethash_v4_time_ = Time::Now() + base::TimeDelta::FromSeconds(
+        response.minimum_wait_duration().seconds());
+  }
+
   // Loop over the threat matches and fill in full_hashes.
   for (const ThreatMatch& match : response.matches()) {
     // Make sure the platform and threat entry type match.
@@ -330,7 +368,16 @@
     ThreatType threat_type,
     FullHashCallback callback) {
   DCHECK(CalledOnValidThread());
-  // TODO(kcarattini): Implement backoff behavior.
+  // We need to wait the minimum waiting duration, and if we are in backoff,
+  // we need to check if we're past the next allowed time. If we are, we can
+  // proceed with the request. If not, we are required to return empty results
+  // (i.e. treat the page as safe).
+  if (Time::Now() <= next_gethash_v4_time_) {
+    // TODO(kcarattini): Add UMA recording.
+    std::vector<SBFullHashResult> full_hashes;
+    callback.Run(full_hashes, base::TimeDelta());
+    return;
+  }
 
   std::string req_base64 = GetV4HashRequest(prefixes, platforms, threat_type);
   GURL gethash_url = GetV4HashUrl(req_base64);
@@ -435,8 +482,7 @@
     base::TimeDelta negative_cache_duration;
     if (status.is_success() && response_code == net::HTTP_OK) {
       // TODO(kcarattini): Add UMA reporting.
-      // TODO(kcarattini): Implement backoff and minimum waiting duration
-      // compliance.
+      ResetGetHashV4Errors();
       std::string data;
       source->GetResponseAsString(&data);
       if (!ParseV4HashResponse(data, &full_hashes, &negative_cache_duration)) {
@@ -444,7 +490,7 @@
         // TODO(kcarattini): Add UMA reporting.
       }
     } else {
-      // TODO(kcarattini): Handle error by setting backoff interval.
+      HandleGetHashV4Error(Time::Now());
       // TODO(kcarattini): Add UMA reporting.
       DVLOG(1) << "SafeBrowsing GetEncodedFullHashes request for: " <<
           source->GetURL() << " failed with error: " << status.error() <<
@@ -866,6 +912,13 @@
   next_gethash_time_ = now + next;
 }
 
+void SafeBrowsingProtocolManager::HandleGetHashV4Error(const Time& now) {
+  DCHECK(CalledOnValidThread());
+  base::TimeDelta next = GetNextV4BackOffInterval(
+      &gethash_v4_error_count_, &gethash_v4_back_off_mult_);
+  next_gethash_v4_time_ = now + next;
+}
+
 void SafeBrowsingProtocolManager::UpdateFinished(bool success) {
   UpdateFinished(success, !success);
 }
diff --git a/chrome/browser/safe_browsing/protocol_manager.h b/chrome/browser/safe_browsing/protocol_manager.h
index fe35428..7faba47 100644
--- a/chrome/browser/safe_browsing/protocol_manager.h
+++ b/chrome/browser/safe_browsing/protocol_manager.h
@@ -216,6 +216,8 @@
                            TestParseV4HashResponseNonPermissionMetadata);
   FRIEND_TEST_ALL_PREFIXES(SafeBrowsingProtocolManagerTest,
                            TestGetHashBackOffTimes);
+  FRIEND_TEST_ALL_PREFIXES(SafeBrowsingProtocolManagerTest,
+                           TestGetV4HashBackOffTimes);
   FRIEND_TEST_ALL_PREFIXES(SafeBrowsingProtocolManagerTest, TestNextChunkUrl);
   FRIEND_TEST_ALL_PREFIXES(SafeBrowsingProtocolManagerTest, TestUpdateUrl);
   friend class SafeBrowsingServerTest;
@@ -284,6 +286,15 @@
   base::TimeDelta GetNextBackOffInterval(size_t* error_count,
                                          size_t* multiplier) const;
 
+  // Worker function for calculating the V4 GetHash backoff times.
+  // |multiplier| is doubled for each consecutive error after the
+  // first, and |error_count| is incremented with each call.
+  static base::TimeDelta GetNextV4BackOffInterval(size_t* error_count,
+                                                  size_t* multiplier);
+
+  // Resets the V4 gethash error counter and multiplier.
+  void ResetGetHashV4Errors();
+
   // Manages our update with the next allowable update time. If 'back_off_' is
   // true, we must decrease the frequency of requests of the SafeBrowsing
   // service according to section 5 of the protocol specification.
@@ -318,6 +329,10 @@
   // current time is |now|.
   void HandleGetHashError(const base::Time& now);
 
+  // Updates internal state for each GetHash V4 response error, assuming that
+  // the current time is |now|.
+  void HandleGetHashV4Error(const base::Time& now);
+
   // Helper function for update completion.
   void UpdateFinished(bool success);
   void UpdateFinished(bool success, bool back_off);
@@ -356,13 +371,16 @@
   // The kind of request that is currently in progress.
   SafeBrowsingRequestType request_type_;
 
-  // The number of HTTP response errors, used for request backoff timing.
+  // The number of HTTP response errors since the the last successful HTTP
+  // response, used for request backoff timing.
   size_t update_error_count_;
   size_t gethash_error_count_;
+  size_t gethash_v4_error_count_;
 
   // Multipliers which double (max == 8) for each error after the second.
   size_t update_back_off_mult_;
   size_t gethash_back_off_mult_;
+  size_t gethash_v4_back_off_mult_;
 
   // Multiplier between 0 and 1 to spread clients over an interval.
   float back_off_fuzz_;
@@ -394,6 +412,10 @@
 
   // While in GetHash backoff, we can't make another GetHash until this time.
   base::Time next_gethash_time_;
+  // For v4, the next gethash time is set to the backoff time is the last
+  // response was an error, or the minimum wait time if the last response was
+  // successful.
+  base::Time next_gethash_v4_time_;
 
   // Current product version sent in each request.
   std::string version_;
diff --git a/chrome/browser/safe_browsing/protocol_manager_unittest.cc b/chrome/browser/safe_browsing/protocol_manager_unittest.cc
index 765750fa..b670f51a 100644
--- a/chrome/browser/safe_browsing/protocol_manager_unittest.cc
+++ b/chrome/browser/safe_browsing/protocol_manager_unittest.cc
@@ -254,6 +254,77 @@
   EXPECT_TRUE(pm->next_gethash_time_== now + TimeDelta::FromMinutes(480));
 }
 
+TEST_F(SafeBrowsingProtocolManagerTest, TestGetV4HashBackOffTimes) {
+  scoped_ptr<SafeBrowsingProtocolManager> pm(CreateProtocolManager(NULL));
+
+  // No errors or back off time yet.
+  EXPECT_EQ(0U, pm->gethash_v4_error_count_);
+  EXPECT_EQ(1U, pm->gethash_v4_back_off_mult_);
+  Time now = Time::Now();
+  EXPECT_TRUE(pm->next_gethash_v4_time_ < now);
+
+  // 1 error.
+  pm->HandleGetHashV4Error(now);
+  EXPECT_EQ(1U, pm->gethash_v4_error_count_);
+  EXPECT_EQ(1U, pm->gethash_v4_back_off_mult_);
+  EXPECT_LE(now + TimeDelta::FromMinutes(15), pm->next_gethash_v4_time_);
+  EXPECT_GE(now + TimeDelta::FromMinutes(30), pm->next_gethash_v4_time_);
+
+  // 2 errors.
+  pm->HandleGetHashV4Error(now);
+  EXPECT_EQ(2U, pm->gethash_v4_error_count_);
+  EXPECT_EQ(2U, pm->gethash_v4_back_off_mult_);
+  EXPECT_LE(now + TimeDelta::FromMinutes(30), pm->next_gethash_v4_time_);
+  EXPECT_GE(now + TimeDelta::FromMinutes(60), pm->next_gethash_v4_time_);
+
+  // 3 errors.
+  pm->HandleGetHashV4Error(now);
+  EXPECT_EQ(3U, pm->gethash_v4_error_count_);
+  EXPECT_EQ(4U, pm->gethash_v4_back_off_mult_);
+  EXPECT_LE(now + TimeDelta::FromMinutes(60), pm->next_gethash_v4_time_);
+  EXPECT_GE(now + TimeDelta::FromMinutes(120), pm->next_gethash_v4_time_);
+
+  // 4 errors.
+  pm->HandleGetHashV4Error(now);
+  EXPECT_EQ(4U, pm->gethash_v4_error_count_);
+  EXPECT_EQ(8U, pm->gethash_v4_back_off_mult_);
+  EXPECT_LE(now + TimeDelta::FromMinutes(120), pm->next_gethash_v4_time_);
+  EXPECT_GE(now + TimeDelta::FromMinutes(240), pm->next_gethash_v4_time_);
+
+  // 5 errors.
+  pm->HandleGetHashV4Error(now);
+  EXPECT_EQ(5U, pm->gethash_v4_error_count_);
+  EXPECT_EQ(16U, pm->gethash_v4_back_off_mult_);
+  EXPECT_LE(now + TimeDelta::FromMinutes(240), pm->next_gethash_v4_time_);
+  EXPECT_GE(now + TimeDelta::FromMinutes(480), pm->next_gethash_v4_time_);
+
+  // 6 errors.
+  pm->HandleGetHashV4Error(now);
+  EXPECT_EQ(6U, pm->gethash_v4_error_count_);
+  EXPECT_EQ(32U, pm->gethash_v4_back_off_mult_);
+  EXPECT_LE(now + TimeDelta::FromMinutes(480), pm->next_gethash_v4_time_);
+  EXPECT_GE(now + TimeDelta::FromMinutes(960), pm->next_gethash_v4_time_);
+
+  // 7 errors.
+  pm->HandleGetHashV4Error(now);
+  EXPECT_EQ(7U, pm->gethash_v4_error_count_);
+  EXPECT_EQ(64U, pm->gethash_v4_back_off_mult_);
+  EXPECT_LE(now + TimeDelta::FromMinutes(960), pm->next_gethash_v4_time_);
+  EXPECT_GE(now + TimeDelta::FromMinutes(1920), pm->next_gethash_v4_time_);
+
+  // 8 errors, reached max backoff.
+  pm->HandleGetHashV4Error(now);
+  EXPECT_EQ(8U, pm->gethash_v4_error_count_);
+  EXPECT_EQ(128U, pm->gethash_v4_back_off_mult_);
+  EXPECT_EQ(now + TimeDelta::FromHours(24), pm->next_gethash_v4_time_);
+
+  // 9 errors, reached max backoff and multiplier capped.
+  pm->HandleGetHashV4Error(now);
+  EXPECT_EQ(9U, pm->gethash_v4_error_count_);
+  EXPECT_EQ(128U, pm->gethash_v4_back_off_mult_);
+  EXPECT_EQ(now + TimeDelta::FromHours(24), pm->next_gethash_v4_time_);
+}
+
 TEST_F(SafeBrowsingProtocolManagerTest, TestGetHashUrl) {
   scoped_ptr<SafeBrowsingProtocolManager> pm(CreateProtocolManager(NULL));
 
@@ -329,6 +400,7 @@
 
   FindFullHashesResponse res;
   res.mutable_negative_cache_duration()->set_seconds(600);
+  res.mutable_minimum_wait_duration()->set_seconds(400);
   ThreatMatch* m = res.add_matches();
   m->set_threat_type(API_ABUSE);
   m->set_platform_type(CHROME_PLATFORM);
@@ -345,6 +417,7 @@
   std::string res_data;
   res.SerializeToString(&res_data);
 
+  Time now = Time::Now();
   std::vector<SBFullHashResult> full_hashes;
   base::TimeDelta cache_lifetime;
   pm->ParseV4HashResponse(res_data, &full_hashes, &cache_lifetime);
@@ -355,6 +428,7 @@
       SBFullHashForString("Everything's shiny, Cap'n."), full_hashes[0].hash));
   EXPECT_EQ("NOTIFICATIONS,", full_hashes[0].metadata);
   EXPECT_EQ(base::TimeDelta::FromSeconds(300), full_hashes[0].cache_duration);
+  EXPECT_LE(now + base::TimeDelta::FromSeconds(400), pm->next_gethash_v4_time_);
 }
 
 // Adds an entry with an ignored ThreatEntryType.
diff --git a/chrome/browser/safe_browsing/sandboxed_dmg_analyzer_mac.cc b/chrome/browser/safe_browsing/sandboxed_dmg_analyzer_mac.cc
index 81da207..8b1f9bbd 100644
--- a/chrome/browser/safe_browsing/sandboxed_dmg_analyzer_mac.cc
+++ b/chrome/browser/safe_browsing/sandboxed_dmg_analyzer_mac.cc
@@ -4,6 +4,8 @@
 
 #include "chrome/browser/safe_browsing/sandboxed_dmg_analyzer_mac.h"
 
+#include <utility>
+
 #include "base/bind.h"
 #include "chrome/common/chrome_utility_messages.h"
 #include "chrome/common/safe_browsing/zip_analyzer_results.h"
@@ -92,7 +94,7 @@
 
   utility_process_host_->Send(
       new ChromeUtilityMsg_AnalyzeDmgFileForDownloadProtection(
-          IPC::TakeFileHandleForProcess(file_.Pass(), utility_process)));
+          IPC::TakeFileHandleForProcess(std::move(file_), utility_process)));
 }
 
 void SandboxedDMGAnalyzer::OnAnalysisFinished(
diff --git a/chrome/browser/ui/app_list/app_list_service_mac.mm b/chrome/browser/ui/app_list/app_list_service_mac.mm
index 699dcfd..03a81b1 100644
--- a/chrome/browser/ui/app_list/app_list_service_mac.mm
+++ b/chrome/browser/ui/app_list/app_list_service_mac.mm
@@ -8,6 +8,8 @@
 #import <Cocoa/Cocoa.h>
 #include <stddef.h>
 
+#include <utility>
+
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/files/file_util.h"
@@ -151,7 +153,7 @@
   if (installed_version == 0)
     shortcut_locations.in_quick_launch_bar = true;
 
-  web_app::CreateNonAppShortcut(shortcut_locations, shortcut_info.Pass());
+  web_app::CreateNonAppShortcut(shortcut_locations, std::move(shortcut_info));
 
   local_state->SetInteger(prefs::kAppLauncherShortcutVersion,
                           kShortcutVersion);
diff --git a/chrome/browser/ui/cocoa/accelerators_cocoa.mm b/chrome/browser/ui/cocoa/accelerators_cocoa.mm
index 9d08d37..6038cac 100644
--- a/chrome/browser/ui/cocoa/accelerators_cocoa.mm
+++ b/chrome/browser/ui/cocoa/accelerators_cocoa.mm
@@ -7,6 +7,8 @@
 #import <Cocoa/Cocoa.h>
 #include <stddef.h>
 
+#include <utility>
+
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/singleton.h"
@@ -127,7 +129,7 @@
 
   scoped_ptr<ui::PlatformAccelerator> platform_accelerator =
       PlatformAcceleratorFromKeyCode(key_code, cocoa_modifiers);
-  accelerator.set_platform_accelerator(platform_accelerator.Pass());
+  accelerator.set_platform_accelerator(std::move(platform_accelerator));
   return accelerator;
 }
 
diff --git a/chrome/browser/ui/cocoa/autofill/layout_view.mm b/chrome/browser/ui/cocoa/autofill/layout_view.mm
index 04881e2..59e7db92 100644
--- a/chrome/browser/ui/cocoa/autofill/layout_view.mm
+++ b/chrome/browser/ui/cocoa/autofill/layout_view.mm
@@ -4,12 +4,14 @@
 
 #import "chrome/browser/ui/cocoa/autofill/layout_view.h"
 
+#include <utility>
+
 #include "chrome/browser/ui/cocoa/autofill/simple_grid_layout.h"
 
 @implementation LayoutView
 
 - (void)setLayoutManager:(scoped_ptr<SimpleGridLayout>)layout {
-  layout_ = layout.Pass();
+  layout_ = std::move(layout);
 }
 
 - (SimpleGridLayout*)layoutManager {
diff --git a/chrome/browser/ui/cocoa/browser_window_controller.mm b/chrome/browser/ui/cocoa/browser_window_controller.mm
index 58b55a3..0299daa4 100644
--- a/chrome/browser/ui/cocoa/browser_window_controller.mm
+++ b/chrome/browser/ui/cocoa/browser_window_controller.mm
@@ -6,6 +6,7 @@
 
 #include <cmath>
 #include <numeric>
+#include <utility>
 
 #include "base/command_line.h"
 #include "base/mac/bundle_locations.h"
@@ -1674,11 +1675,11 @@
           sourceLanguage,
           targetLanguage));
   scoped_ptr<TranslateBubbleModel> model(
-      new TranslateBubbleModelImpl(step, uiDelegate.Pass()));
-  translateBubbleController_ = [[TranslateBubbleController alloc]
-                                 initWithParentWindow:self
-                                                model:model.Pass()
-                                          webContents:contents];
+      new TranslateBubbleModelImpl(step, std::move(uiDelegate)));
+  translateBubbleController_ =
+      [[TranslateBubbleController alloc] initWithParentWindow:self
+                                                        model:std::move(model)
+                                                  webContents:contents];
   [translateBubbleController_ showWindow:nil];
 
   NSNotificationCenter* center = [NSNotificationCenter defaultCenter];
diff --git a/chrome/browser/ui/cocoa/confirm_bubble_cocoa.mm b/chrome/browser/ui/cocoa/confirm_bubble_cocoa.mm
index a9fa98cd..80a5475 100644
--- a/chrome/browser/ui/cocoa/confirm_bubble_cocoa.mm
+++ b/chrome/browser/ui/cocoa/confirm_bubble_cocoa.mm
@@ -4,6 +4,8 @@
 
 #import "chrome/browser/ui/cocoa/confirm_bubble_cocoa.h"
 
+#include <utility>
+
 #include "base/strings/string16.h"
 #include "chrome/browser/themes/theme_service.h"
 #import "chrome/browser/ui/cocoa/confirm_bubble_controller.h"
@@ -51,7 +53,7 @@
   ConfirmBubbleController* controller =
       [[ConfirmBubbleController alloc] initWithParent:anchor_view
                                                origin:origin.ToCGPoint()
-                                                model:model.Pass()];
+                                                model:std::move(model)];
   [anchor_view addSubview:[controller view]
                positioned:NSWindowAbove
                relativeTo:nil];
diff --git a/chrome/browser/ui/cocoa/confirm_bubble_controller.mm b/chrome/browser/ui/cocoa/confirm_bubble_controller.mm
index b7143e7..7f7d45d 100644
--- a/chrome/browser/ui/cocoa/confirm_bubble_controller.mm
+++ b/chrome/browser/ui/cocoa/confirm_bubble_controller.mm
@@ -4,6 +4,8 @@
 
 #import "chrome/browser/ui/cocoa/confirm_bubble_controller.h"
 
+#include <utility>
+
 #include "base/strings/sys_string_conversions.h"
 #import "chrome/browser/ui/cocoa/browser_window_controller.h"
 #import "chrome/browser/ui/cocoa/confirm_bubble_cocoa.h"
@@ -19,7 +21,7 @@
   if ((self = [super initWithNibName:nil bundle:nil])) {
     parent_ = parent;
     origin_ = origin;
-    model_ = model.Pass();
+    model_ = std::move(model);
   }
   return self;
 }
diff --git a/chrome/browser/ui/cocoa/confirm_bubble_controller_unittest.mm b/chrome/browser/ui/cocoa/confirm_bubble_controller_unittest.mm
index be249f7d..4c2745836 100644
--- a/chrome/browser/ui/cocoa/confirm_bubble_controller_unittest.mm
+++ b/chrome/browser/ui/cocoa/confirm_bubble_controller_unittest.mm
@@ -2,12 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#import "chrome/browser/ui/cocoa/confirm_bubble_controller.h"
+
+#include <utility>
+
 #include "base/compiler_specific.h"
 #include "base/strings/string16.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/ui/cocoa/cocoa_test_helper.h"
 #import "chrome/browser/ui/cocoa/confirm_bubble_cocoa.h"
-#import "chrome/browser/ui/cocoa/confirm_bubble_controller.h"
 #include "chrome/browser/ui/confirm_bubble_model.h"
 #import "testing/gtest_mac.h"
 #import "ui/gfx/geometry/point.h"
@@ -107,7 +110,7 @@
     controller_ =
         [[ConfirmBubbleController alloc] initWithParent:view
                                                  origin:origin.ToCGPoint()
-                                                  model:model_.Pass()];
+                                                  model:std::move(model_)];
     [view addSubview:[controller_ view]
           positioned:NSWindowAbove
           relativeTo:nil];
diff --git a/chrome/browser/ui/cocoa/constrained_window/constrained_window_mac.mm b/chrome/browser/ui/cocoa/constrained_window/constrained_window_mac.mm
index f043fad5..16f755c 100644
--- a/chrome/browser/ui/cocoa/constrained_window/constrained_window_mac.mm
+++ b/chrome/browser/ui/cocoa/constrained_window/constrained_window_mac.mm
@@ -4,6 +4,8 @@
 
 #include "chrome/browser/ui/cocoa/constrained_window/constrained_window_mac.h"
 
+#include <utility>
+
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #import "chrome/browser/ui/cocoa/constrained_window/constrained_window_sheet.h"
@@ -29,7 +31,8 @@
   auto manager = WebContentsModalDialogManager::FromWebContents(web_contents);
   scoped_ptr<SingleWebContentsDialogManagerCocoa> native_manager(
       new SingleWebContentsDialogManagerCocoa(this, sheet, manager));
-  manager->ShowDialogWithManager([sheet sheetWindow], native_manager.Pass());
+  manager->ShowDialogWithManager([sheet sheetWindow],
+                                 std::move(native_manager));
 }
 
 ConstrainedWindowMac::~ConstrainedWindowMac() {
diff --git a/chrome/browser/ui/cocoa/download/download_shelf_controller_unittest.mm b/chrome/browser/ui/cocoa/download/download_shelf_controller_unittest.mm
index 48f3579cf..2fd6aca 100644
--- a/chrome/browser/ui/cocoa/download/download_shelf_controller_unittest.mm
+++ b/chrome/browser/ui/cocoa/download/download_shelf_controller_unittest.mm
@@ -2,15 +2,18 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#import "chrome/browser/ui/cocoa/download/download_shelf_controller.h"
+
 #import <Cocoa/Cocoa.h>
 
+#include <utility>
+
 #import "base/mac/scoped_block.h"
 #import "base/mac/scoped_nsobject.h"
 #include "base/memory/scoped_ptr.h"
 #include "chrome/browser/download/download_shelf.h"
 #include "chrome/browser/ui/cocoa/cocoa_profile_test.h"
 #import "chrome/browser/ui/cocoa/download/download_item_controller.h"
-#import "chrome/browser/ui/cocoa/download/download_shelf_controller.h"
 #import "chrome/browser/ui/cocoa/view_resizer_pong.h"
 #include "content/public/test/mock_download_item.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -36,7 +39,7 @@
 @implementation WrappedMockDownloadItem
 - (id)initWithMockDownload:(scoped_ptr<content::MockDownloadItem>)download {
   if ((self = [super init])) {
-    download_ = download.Pass();
+    download_ = std::move(download);
   }
   return self;
 }
@@ -143,7 +146,8 @@
       .WillByDefault(Return(content::DownloadItem::IN_PROGRESS));
 
   base::scoped_nsobject<WrappedMockDownloadItem> wrappedMockDownload(
-      [[WrappedMockDownloadItem alloc] initWithMockDownload:download.Pass()]);
+      [[WrappedMockDownloadItem alloc]
+          initWithMockDownload:std::move(download)]);
 
   id item_controller =
       [OCMockObject mockForClass:[DownloadItemController class]];
diff --git a/chrome/browser/ui/cocoa/extensions/browser_actions_container_view.mm b/chrome/browser/ui/cocoa/extensions/browser_actions_container_view.mm
index c2429c41..4de33c2 100644
--- a/chrome/browser/ui/cocoa/extensions/browser_actions_container_view.mm
+++ b/chrome/browser/ui/cocoa/extensions/browser_actions_container_view.mm
@@ -5,6 +5,7 @@
 #import "chrome/browser/ui/cocoa/extensions/browser_actions_container_view.h"
 
 #include <algorithm>
+#include <utility>
 
 #import "chrome/browser/ui/cocoa/view_id_util.h"
 #include "grit/theme_resources.h"
@@ -167,7 +168,7 @@
 
 - (void)setHighlight:(scoped_ptr<ui::NinePartImageIds>)highlight {
   if (highlight || highlight_) {
-    highlight_ = highlight.Pass();
+    highlight_ = std::move(highlight);
     // We don't allow resizing when the container is highlighting.
     resizable_ = highlight.get() == nullptr;
     [self setNeedsDisplay:YES];
diff --git a/chrome/browser/ui/cocoa/extensions/browser_actions_controller.mm b/chrome/browser/ui/cocoa/extensions/browser_actions_controller.mm
index 71d31d7..c01b9f8 100644
--- a/chrome/browser/ui/cocoa/extensions/browser_actions_controller.mm
+++ b/chrome/browser/ui/cocoa/extensions/browser_actions_controller.mm
@@ -7,6 +7,7 @@
 #include <stddef.h>
 
 #include <string>
+#include <utility>
 
 #include "base/macros.h"
 #include "base/strings/sys_string_conversions.h"
@@ -289,10 +290,10 @@
   extensions::ExtensionMessageBubbleController* weak_controller =
       bubble_controller.get();
   scoped_ptr<ExtensionMessageBubbleBridge> bridge(
-      new ExtensionMessageBubbleBridge(bubble_controller.Pass(),
+      new ExtensionMessageBubbleBridge(std::move(bubble_controller),
                                        anchor_action != nullptr));
   ToolbarActionsBarBubbleMac* bubble =
-      [controller_ createMessageBubble:bridge.Pass()
+      [controller_ createMessageBubble:std::move(bridge)
                           anchorToSelf:anchor_action != nil];
   weak_controller->OnShown();
   [bubble showWindow:nil];
@@ -570,7 +571,7 @@
       highlight.reset(
           new ui::NinePartImageIds(IMAGE_GRID(IDR_DEVELOPER_MODE_HIGHLIGHT)));
   }
-  [containerView_ setHighlight:highlight.Pass()];
+  [containerView_ setHighlight:std::move(highlight)];
 
   std::vector<ToolbarActionViewController*> toolbar_actions =
       toolbarActionsBar_->GetActions();
@@ -812,8 +813,7 @@
     scoped_ptr<ToolbarActionsBarBubbleDelegate> delegate(
         new ExtensionToolbarIconSurfacingBubbleDelegate(browser_->profile()));
     ToolbarActionsBarBubbleMac* bubble =
-        [self createMessageBubble:delegate.Pass()
-                     anchorToSelf:YES];
+        [self createMessageBubble:std::move(delegate) anchorToSelf:YES];
     [bubble showWindow:nil];
   }
   [containerView_ setTrackingEnabled:NO];
@@ -1034,7 +1034,7 @@
   activeBubble_ = [[ToolbarActionsBarBubbleMac alloc]
       initWithParentWindow:[containerView_ window]
                anchorPoint:anchor
-                  delegate:delegate.Pass()];
+                  delegate:std::move(delegate)];
   [[NSNotificationCenter defaultCenter]
       addObserver:self
          selector:@selector(bubbleWindowClosing:)
diff --git a/chrome/browser/ui/cocoa/extensions/extension_action_platform_delegate_cocoa.mm b/chrome/browser/ui/cocoa/extensions/extension_action_platform_delegate_cocoa.mm
index 8da3f175..db8a936d 100644
--- a/chrome/browser/ui/cocoa/extensions/extension_action_platform_delegate_cocoa.mm
+++ b/chrome/browser/ui/cocoa/extensions/extension_action_platform_delegate_cocoa.mm
@@ -73,7 +73,7 @@
     ExtensionActionViewController::PopupShowAction show_action) {
   BOOL devMode =
       show_action == ExtensionActionViewController::SHOW_POPUP_AND_INSPECT;
-  [ExtensionPopupController host:host.Pass()
+  [ExtensionPopupController host:std::move(host)
                        inBrowser:controller_->browser()
                       anchoredAt:GetPopupPoint()
                    arrowLocation:info_bubble::kTopRight
diff --git a/chrome/browser/ui/cocoa/extensions/extension_install_dialog_controller_browsertest.mm b/chrome/browser/ui/cocoa/extensions/extension_install_dialog_controller_browsertest.mm
index 2e069dd..d9068be 100644
--- a/chrome/browser/ui/cocoa/extensions/extension_install_dialog_controller_browsertest.mm
+++ b/chrome/browser/ui/cocoa/extensions/extension_install_dialog_controller_browsertest.mm
@@ -4,6 +4,8 @@
 
 #import "chrome/browser/ui/cocoa/extensions/extension_install_dialog_controller.h"
 
+#include <utility>
+
 #include "chrome/browser/extensions/extension_install_prompt_show_params.h"
 #include "chrome/browser/extensions/extension_install_prompt_test_helper.h"
 #include "chrome/browser/ui/browser.h"
@@ -37,9 +39,8 @@
       chrome::BuildExtensionInstallPrompt(extension_.get());
 
   ExtensionInstallDialogController* controller =
-      new ExtensionInstallDialogController(&show_params,
-                                           test_helper.GetCallback(),
-                                           prompt.Pass());
+      new ExtensionInstallDialogController(
+          &show_params, test_helper.GetCallback(), std::move(prompt));
 
   base::scoped_nsobject<NSWindow> window(
       [[[controller->view_controller() view] window] retain]);
@@ -65,9 +66,8 @@
       chrome::BuildExtensionPostInstallPermissionsPrompt(extension_.get());
 
   ExtensionInstallDialogController* controller =
-      new ExtensionInstallDialogController(&show_params,
-                                           test_helper.GetCallback(),
-                                           prompt.Pass());
+      new ExtensionInstallDialogController(
+          &show_params, test_helper.GetCallback(), std::move(prompt));
 
   base::scoped_nsobject<NSWindow> window(
       [[[controller->view_controller() view] window] retain]);
diff --git a/chrome/browser/ui/cocoa/extensions/extension_install_prompt_test_utils.mm b/chrome/browser/ui/cocoa/extensions/extension_install_prompt_test_utils.mm
index f04a424..a7160cfe 100644
--- a/chrome/browser/ui/cocoa/extensions/extension_install_prompt_test_utils.mm
+++ b/chrome/browser/ui/cocoa/extensions/extension_install_prompt_test_utils.mm
@@ -70,7 +70,7 @@
           ExtensionInstallPrompt::INSTALL_PROMPT));
   prompt->set_extension(extension);
   prompt->set_icon(LoadInstallPromptIcon());
-  return prompt.Pass();
+  return prompt;
 }
 
 scoped_ptr<ExtensionInstallPrompt::Prompt>
@@ -80,7 +80,7 @@
           ExtensionInstallPrompt::POST_INSTALL_PERMISSIONS_PROMPT));
   prompt->set_extension(extension);
   prompt->set_icon(LoadInstallPromptIcon());
-  return prompt.Pass();
+  return prompt;
 }
 
 }  // namespace chrome
diff --git a/chrome/browser/ui/cocoa/extensions/extension_install_view_controller.mm b/chrome/browser/ui/cocoa/extensions/extension_install_view_controller.mm
index 7960f53..1fe1b5d 100644
--- a/chrome/browser/ui/cocoa/extensions/extension_install_view_controller.mm
+++ b/chrome/browser/ui/cocoa/extensions/extension_install_view_controller.mm
@@ -6,6 +6,8 @@
 
 #include <stddef.h>
 
+#include <utility>
+
 #include "base/auto_reset.h"
 #include "base/i18n/rtl.h"
 #include "base/mac/bundle_locations.h"
@@ -248,7 +250,7 @@
     profile_ = profile;
     navigator_ = navigator;
     delegate_ = delegate;
-    prompt_ = prompt.Pass();
+    prompt_ = std::move(prompt);
     warnings_.reset([[self buildWarnings:*prompt_] retain]);
   }
   return self;
diff --git a/chrome/browser/ui/cocoa/extensions/extension_install_view_controller_unittest.mm b/chrome/browser/ui/cocoa/extensions/extension_install_view_controller_unittest.mm
index 50697f4..4772c37 100644
--- a/chrome/browser/ui/cocoa/extensions/extension_install_view_controller_unittest.mm
+++ b/chrome/browser/ui/cocoa/extensions/extension_install_view_controller_unittest.mm
@@ -2,8 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#import "chrome/browser/ui/cocoa/extensions/extension_install_view_controller.h"
+
 #import <Cocoa/Cocoa.h>
 
+#include <utility>
+
 #import "base/mac/scoped_nsobject.h"
 #include "base/strings/sys_string_conversions.h"
 #include "base/strings/utf_string_conversions.h"
@@ -11,7 +15,6 @@
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/cocoa/cocoa_profile_test.h"
 #import "chrome/browser/ui/cocoa/extensions/extension_install_prompt_test_utils.h"
-#import "chrome/browser/ui/cocoa/extensions/extension_install_view_controller.h"
 #include "extensions/common/extension.h"
 #include "extensions/common/permissions/permission_message_provider.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -84,10 +87,11 @@
   base::string16 permissionString = prompt->GetPermission(0, type);
 
   base::scoped_nsobject<ExtensionInstallViewController> controller(
-      [[ExtensionInstallViewController alloc] initWithProfile:profile()
-                                                    navigator:browser()
-                                                     delegate:&delegate
-                                                       prompt:prompt.Pass()]);
+      [[ExtensionInstallViewController alloc]
+          initWithProfile:profile()
+                navigator:browser()
+                 delegate:&delegate
+                   prompt:std::move(prompt)]);
 
   [controller view];  // Force nib load.
 
@@ -140,10 +144,11 @@
   prompt->SetPermissions(permissions, type);
 
   base::scoped_nsobject<ExtensionInstallViewController> controller(
-      [[ExtensionInstallViewController alloc] initWithProfile:profile()
-                                                    navigator:browser()
-                                                     delegate:&delegate
-                                                       prompt:prompt.Pass()]);
+      [[ExtensionInstallViewController alloc]
+          initWithProfile:profile()
+                navigator:browser()
+                 delegate:&delegate
+                   prompt:std::move(prompt)]);
 
   [controller view];  // Force nib load.
   [controller ok:nil];
@@ -179,7 +184,7 @@
           initWithProfile:profile()
                 navigator:browser()
                  delegate:&delegate1
-                   prompt:one_warning_prompt.Pass()]);
+                   prompt:std::move(one_warning_prompt)]);
 
   [controller1 view];  // Force nib load.
 
@@ -188,7 +193,7 @@
           initWithProfile:profile()
                 navigator:browser()
                  delegate:&delegate2
-                   prompt:two_warnings_prompt.Pass()]);
+                   prompt:std::move(two_warnings_prompt)]);
 
   [controller2 view];  // Force nib load.
 
@@ -216,7 +221,7 @@
           initWithProfile:profile()
                 navigator:browser()
                  delegate:&delegate
-                   prompt:no_warnings_prompt.Pass()]);
+                   prompt:std::move(no_warnings_prompt)]);
 
   [controller view];  // Force nib load.
 
@@ -262,7 +267,7 @@
           initWithProfile:profile()
                 navigator:browser()
                  delegate:&delegate
-                   prompt:inline_prompt.Pass()]);
+                   prompt:std::move(inline_prompt)]);
 
   [controller view];  // Force nib load.
 
@@ -320,10 +325,11 @@
   prompt->SetPermissions(permissions, type);
 
   base::scoped_nsobject<ExtensionInstallViewController> controller(
-      [[ExtensionInstallViewController alloc] initWithProfile:profile()
-                                                    navigator:browser()
-                                                     delegate:&delegate
-                                                       prompt:prompt.Pass()]);
+      [[ExtensionInstallViewController alloc]
+          initWithProfile:profile()
+                navigator:browser()
+                 delegate:&delegate
+                   prompt:std::move(prompt)]);
 
   [controller view];  // Force nib load.
 
@@ -355,10 +361,11 @@
   base::string16 permissionString = prompt->GetPermissionsDetails(0, type);
 
   base::scoped_nsobject<ExtensionInstallViewController> controller(
-      [[ExtensionInstallViewController alloc] initWithProfile:profile()
-                                                    navigator:browser()
-                                                     delegate:&delegate
-                                                       prompt:prompt.Pass()]);
+      [[ExtensionInstallViewController alloc]
+          initWithProfile:profile()
+                navigator:browser()
+                 delegate:&delegate
+                   prompt:std::move(prompt)]);
 
   [controller view];  // Force nib load.
 
diff --git a/chrome/browser/ui/cocoa/extensions/extension_message_bubble_bridge.mm b/chrome/browser/ui/cocoa/extensions/extension_message_bubble_bridge.mm
index 28b77e5e..f7cb1f5 100644
--- a/chrome/browser/ui/cocoa/extensions/extension_message_bubble_bridge.mm
+++ b/chrome/browser/ui/cocoa/extensions/extension_message_bubble_bridge.mm
@@ -4,15 +4,16 @@
 
 #include "chrome/browser/ui/cocoa/extensions/extension_message_bubble_bridge.h"
 
+#include <utility>
+
 #include "chrome/browser/extensions/extension_message_bubble_controller.h"
 #include "chrome/browser/ui/cocoa/extensions/toolbar_actions_bar_bubble_mac.h"
 
 ExtensionMessageBubbleBridge::ExtensionMessageBubbleBridge(
     scoped_ptr<extensions::ExtensionMessageBubbleController> controller,
     bool anchored_to_extension)
-    : controller_(controller.Pass()),
-      anchored_to_extension_(anchored_to_extension) {
-}
+    : controller_(std::move(controller)),
+      anchored_to_extension_(anchored_to_extension) {}
 
 ExtensionMessageBubbleBridge::~ExtensionMessageBubbleBridge() {
 }
diff --git a/chrome/browser/ui/cocoa/extensions/extension_popup_controller.mm b/chrome/browser/ui/cocoa/extensions/extension_popup_controller.mm
index d38805a..b192160 100644
--- a/chrome/browser/ui/cocoa/extensions/extension_popup_controller.mm
+++ b/chrome/browser/ui/cocoa/extensions/extension_popup_controller.mm
@@ -5,6 +5,7 @@
 #import "chrome/browser/ui/cocoa/extensions/extension_popup_controller.h"
 
 #include <algorithm>
+#include <utility>
 
 #include "base/callback.h"
 #include "base/macros.h"
@@ -276,7 +277,7 @@
                 anchoredAt:anchoredAt
              arrowLocation:arrowLocation
                    devMode:devMode];
-  [gPopup setExtensionViewHost:host.Pass()];
+  [gPopup setExtensionViewHost:std::move(host)];
   return gPopup;
 }
 
diff --git a/chrome/browser/ui/cocoa/extensions/toolbar_actions_bar_bubble_mac.mm b/chrome/browser/ui/cocoa/extensions/toolbar_actions_bar_bubble_mac.mm
index c10ea568..f9c83fd 100644
--- a/chrome/browser/ui/cocoa/extensions/toolbar_actions_bar_bubble_mac.mm
+++ b/chrome/browser/ui/cocoa/extensions/toolbar_actions_bar_bubble_mac.mm
@@ -4,6 +4,8 @@
 
 #import "chrome/browser/ui/cocoa/extensions/toolbar_actions_bar_bubble_mac.h"
 
+#include <utility>
+
 #include "base/mac/foundation_util.h"
 #include "base/strings/sys_string_conversions.h"
 #import "chrome/browser/ui/cocoa/info_bubble_view.h"
@@ -73,7 +75,7 @@
                        parentWindow:parentWindow
                          anchoredAt:anchorPoint])) {
     acknowledged_ = NO;
-    delegate_ = delegate.Pass();
+    delegate_ = std::move(delegate);
 
     ui::NativeTheme* nativeTheme = ui::NativeThemeMac::instance();
     [[self bubble] setAlignment:info_bubble::kAlignArrowToAnchor];
diff --git a/chrome/browser/ui/cocoa/extensions/windowed_install_dialog_controller.mm b/chrome/browser/ui/cocoa/extensions/windowed_install_dialog_controller.mm
index ed06c87..2b2178e3 100644
--- a/chrome/browser/ui/cocoa/extensions/windowed_install_dialog_controller.mm
+++ b/chrome/browser/ui/cocoa/extensions/windowed_install_dialog_controller.mm
@@ -4,6 +4,8 @@
 
 #import "chrome/browser/ui/cocoa/extensions/windowed_install_dialog_controller.h"
 
+#include <utility>
+
 #import "base/callback_helpers.h"
 #import "base/mac/sdk_forward_declarations.h"
 #include "base/message_loop/message_loop.h"
@@ -39,7 +41,7 @@
       initWithProfile:show_params->profile()
             navigator:show_params->GetParentWebContents()
              delegate:this
-               prompt:prompt.Pass()]);
+               prompt:std::move(prompt)]);
   [[install_controller_ window] makeKeyAndOrderFront:nil];
 }
 
@@ -98,7 +100,7 @@
         initWithProfile:profile
               navigator:navigator
                delegate:delegate
-                 prompt:prompt.Pass()]);
+                 prompt:std::move(prompt)]);
     NSWindow* window = [self window];
 
     // Ensure the window does not display behind the app launcher window, and is
diff --git a/chrome/browser/ui/cocoa/infobars/alternate_nav_infobar_controller.mm b/chrome/browser/ui/cocoa/infobars/alternate_nav_infobar_controller.mm
index 8e614fef..1259104 100644
--- a/chrome/browser/ui/cocoa/infobars/alternate_nav_infobar_controller.mm
+++ b/chrome/browser/ui/cocoa/infobars/alternate_nav_infobar_controller.mm
@@ -6,6 +6,8 @@
 
 #include <stddef.h>
 
+#include <utility>
+
 #include "base/logging.h"
 #include "base/strings/sys_string_conversions.h"
 #include "chrome/browser/ui/cocoa/infobars/infobar_cocoa.h"
@@ -63,9 +65,9 @@
 // static
 scoped_ptr<infobars::InfoBar> AlternateNavInfoBarDelegate::CreateInfoBar(
     scoped_ptr<AlternateNavInfoBarDelegate> delegate) {
-  scoped_ptr<InfoBarCocoa> infobar(new InfoBarCocoa(delegate.Pass()));
+  scoped_ptr<InfoBarCocoa> infobar(new InfoBarCocoa(std::move(delegate)));
   base::scoped_nsobject<AlternateNavInfoBarController> controller(
       [[AlternateNavInfoBarController alloc] initWithInfoBar:infobar.get()]);
   infobar->set_controller(controller);
-  return infobar.Pass();
+  return std::move(infobar);
 }
diff --git a/chrome/browser/ui/cocoa/infobars/confirm_infobar_controller.mm b/chrome/browser/ui/cocoa/infobars/confirm_infobar_controller.mm
index aa5478d..bf5642c 100644
--- a/chrome/browser/ui/cocoa/infobars/confirm_infobar_controller.mm
+++ b/chrome/browser/ui/cocoa/infobars/confirm_infobar_controller.mm
@@ -4,6 +4,8 @@
 
 #include "chrome/browser/ui/cocoa/infobars/confirm_infobar_controller.h"
 
+#include <utility>
+
 #include "base/logging.h"
 #include "base/strings/sys_string_conversions.h"
 #include "chrome/browser/infobars/infobar_service.h"
@@ -147,9 +149,9 @@
 
 scoped_ptr<infobars::InfoBar> InfoBarService::CreateConfirmInfoBar(
     scoped_ptr<ConfirmInfoBarDelegate> delegate) {
-  scoped_ptr<InfoBarCocoa> infobar(new InfoBarCocoa(delegate.Pass()));
+  scoped_ptr<InfoBarCocoa> infobar(new InfoBarCocoa(std::move(delegate)));
   base::scoped_nsobject<ConfirmInfoBarController> controller(
       [[ConfirmInfoBarController alloc] initWithInfoBar:infobar.get()]);
   infobar->set_controller(controller);
-  return infobar.Pass();
+  return std::move(infobar);
 }
diff --git a/chrome/browser/ui/cocoa/infobars/confirm_infobar_controller_unittest.mm b/chrome/browser/ui/cocoa/infobars/confirm_infobar_controller_unittest.mm
index a14305a..93de71a 100644
--- a/chrome/browser/ui/cocoa/infobars/confirm_infobar_controller_unittest.mm
+++ b/chrome/browser/ui/cocoa/infobars/confirm_infobar_controller_unittest.mm
@@ -4,6 +4,8 @@
 
 #import "chrome/browser/ui/cocoa/infobars/confirm_infobar_controller.h"
 
+#include <utility>
+
 #include "base/mac/scoped_nsobject.h"
 #include "base/strings/string_util.h"
 #include "base/strings/sys_string_conversions.h"
@@ -93,7 +95,7 @@
 
    scoped_ptr<infobars::InfoBarDelegate> delegate(
        new MockConfirmInfoBarDelegate(this));
-    infobar_ = new InfoBarCocoa(delegate.Pass());
+   infobar_ = new InfoBarCocoa(std::move(delegate));
     infobar_->SetOwner(InfoBarService::FromWebContents(web_contents_.get()));
 
     controller_.reset([[TestConfirmInfoBarController alloc]
diff --git a/chrome/browser/ui/cocoa/infobars/infobar_cocoa.mm b/chrome/browser/ui/cocoa/infobars/infobar_cocoa.mm
index c3183a1..11753bab 100644
--- a/chrome/browser/ui/cocoa/infobars/infobar_cocoa.mm
+++ b/chrome/browser/ui/cocoa/infobars/infobar_cocoa.mm
@@ -4,12 +4,12 @@
 
 #include "chrome/browser/ui/cocoa/infobars/infobar_cocoa.h"
 
+#include <utility>
+
 #import "chrome/browser/ui/cocoa/infobars/infobar_controller.h"
 
 InfoBarCocoa::InfoBarCocoa(scoped_ptr<infobars::InfoBarDelegate> delegate)
-    : infobars::InfoBar(delegate.Pass()),
-      weak_ptr_factory_(this) {
-}
+    : infobars::InfoBar(std::move(delegate)), weak_ptr_factory_(this) {}
 
 InfoBarCocoa::~InfoBarCocoa() {
   if (controller())
diff --git a/chrome/browser/ui/cocoa/infobars/infobar_container_controller_unittest.mm b/chrome/browser/ui/cocoa/infobars/infobar_container_controller_unittest.mm
index c91e123..6de886a 100644
--- a/chrome/browser/ui/cocoa/infobars/infobar_container_controller_unittest.mm
+++ b/chrome/browser/ui/cocoa/infobars/infobar_container_controller_unittest.mm
@@ -6,6 +6,8 @@
 
 #import <Cocoa/Cocoa.h>
 
+#include <utility>
+
 #include "base/mac/scoped_nsobject.h"
 #include "chrome/browser/infobars/infobar_service.h"
 #include "chrome/browser/ui/cocoa/cocoa_profile_test.h"
@@ -62,7 +64,8 @@
 
   scoped_ptr<infobars::InfoBarDelegate> confirm_delegate(
       new MockConfirmInfoBarDelegate(NULL));
-  scoped_ptr<InfoBarCocoa> infobar(new InfoBarCocoa(confirm_delegate.Pass()));
+  scoped_ptr<InfoBarCocoa> infobar(
+      new InfoBarCocoa(std::move(confirm_delegate)));
   base::scoped_nsobject<ConfirmInfoBarController> controller(
       [[ConfirmInfoBarController alloc] initWithInfoBar:infobar.get()]);
   infobar->set_controller(controller);
diff --git a/chrome/browser/ui/cocoa/infobars/save_password_infobar_controller.mm b/chrome/browser/ui/cocoa/infobars/save_password_infobar_controller.mm
index 005e00a..aa3ecf9 100644
--- a/chrome/browser/ui/cocoa/infobars/save_password_infobar_controller.mm
+++ b/chrome/browser/ui/cocoa/infobars/save_password_infobar_controller.mm
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <utility>
+
 #include "chrome/browser/password_manager/save_password_infobar_delegate.h"
 #include "chrome/browser/ui/chrome_style.h"
 #include "chrome/browser/ui/cocoa/infobars/confirm_infobar_controller.h"
@@ -31,11 +33,11 @@
 
 scoped_ptr<infobars::InfoBar> CreateSavePasswordInfoBar
     (scoped_ptr<SavePasswordInfoBarDelegate> delegate) {
-  scoped_ptr<InfoBarCocoa> infobar(new InfoBarCocoa(delegate.Pass()));
+  scoped_ptr<InfoBarCocoa> infobar(new InfoBarCocoa(std::move(delegate)));
   base::scoped_nsobject<SavePasswordInfobarController> controller(
       [[SavePasswordInfobarController alloc] initWithInfoBar:infobar.get()]);
   infobar->set_controller(controller);
-  return infobar.Pass();
+  return std::move(infobar);
 }
 
 @end
diff --git a/chrome/browser/ui/cocoa/infobars/translate_infobar_base.mm b/chrome/browser/ui/cocoa/infobars/translate_infobar_base.mm
index 14fce732f..2bdc727 100644
--- a/chrome/browser/ui/cocoa/infobars/translate_infobar_base.mm
+++ b/chrome/browser/ui/cocoa/infobars/translate_infobar_base.mm
@@ -6,6 +6,8 @@
 
 #include <stddef.h>
 
+#include <utility>
+
 #include "base/logging.h"
 #include "base/strings/sys_string_conversions.h"
 #include "chrome/app/chrome_command_ids.h"
@@ -32,7 +34,7 @@
 
 scoped_ptr<infobars::InfoBar> ChromeTranslateClient::CreateInfoBar(
     scoped_ptr<translate::TranslateInfoBarDelegate> delegate) const {
-  scoped_ptr<InfoBarCocoa> infobar(new InfoBarCocoa(delegate.Pass()));
+  scoped_ptr<InfoBarCocoa> infobar(new InfoBarCocoa(std::move(delegate)));
   base::scoped_nsobject<TranslateInfoBarControllerBase> infobar_controller;
   switch (infobar->delegate()->AsTranslateInfoBarDelegate()->translate_step()) {
     case translate::TRANSLATE_STEP_BEFORE_TRANSLATE:
@@ -52,7 +54,7 @@
       NOTREACHED();
   }
   infobar->set_controller(infobar_controller);
-  return infobar.Pass();
+  return std::move(infobar);
 }
 
 @implementation TranslateInfoBarControllerBase (FrameChangeObserver)
diff --git a/chrome/browser/ui/cocoa/infobars/translate_infobar_unittest.mm b/chrome/browser/ui/cocoa/infobars/translate_infobar_unittest.mm
index aef043b..475c511 100644
--- a/chrome/browser/ui/cocoa/infobars/translate_infobar_unittest.mm
+++ b/chrome/browser/ui/cocoa/infobars/translate_infobar_unittest.mm
@@ -5,6 +5,8 @@
 #import <Cocoa/Cocoa.h>
 #include <stddef.h>
 
+#include <utility>
+
 #import "base/mac/scoped_nsobject.h"
 #include "base/macros.h"
 #import "base/strings/string_util.h"
@@ -104,7 +106,7 @@
     scoped_ptr<translate::TranslateInfoBarDelegate> delegate(
         new MockTranslateInfoBarDelegate(web_contents_.get(), type, error));
     scoped_ptr<infobars::InfoBar> infobar(
-        chrome_translate_client->CreateInfoBar(delegate.Pass()));
+        chrome_translate_client->CreateInfoBar(std::move(delegate)));
     if (infobar_)
       infobar_->CloseSoon();
     infobar_ = static_cast<InfoBarCocoa*>(infobar.release());
diff --git a/chrome/browser/ui/cocoa/location_bar/location_bar_view_mac.mm b/chrome/browser/ui/cocoa/location_bar/location_bar_view_mac.mm
index 5fccba5f..f736c22 100644
--- a/chrome/browser/ui/cocoa/location_bar/location_bar_view_mac.mm
+++ b/chrome/browser/ui/cocoa/location_bar/location_bar_view_mac.mm
@@ -50,7 +50,6 @@
 #include "chrome/browser/ui/content_settings/content_setting_image_model.h"
 #include "chrome/browser/ui/passwords/manage_passwords_ui_controller.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
-#include "chrome/browser/ui/toolbar/chrome_toolbar_model.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/pref_names.h"
 #include "components/bookmarks/common/bookmark_pref_names.h"
@@ -441,15 +440,13 @@
   }
 
   const bool is_keyword_hint = omnibox_view_->model()->is_keyword_hint();
-  ChromeToolbarModel* chrome_toolbar_model =
-      static_cast<ChromeToolbarModel*>(GetToolbarModel());
   if (!keyword.empty() && !is_keyword_hint) {
     // Switch from location icon to keyword mode.
     location_icon_decoration_->SetVisible(false);
     selected_keyword_decoration_->SetVisible(true);
     selected_keyword_decoration_->SetKeyword(short_name, is_extension_keyword);
     selected_keyword_decoration_->SetImage(GetKeywordImage(keyword));
-  } else if (chrome_toolbar_model->GetSecurityLevel(false) ==
+  } else if (GetToolbarModel()->GetSecurityLevel(false) ==
              security_state::SecurityStateModel::EV_SECURE) {
     // Switch from location icon to show the EV bubble instead.
     location_icon_decoration_->SetVisible(false);
diff --git a/chrome/browser/ui/cocoa/media_picker/desktop_media_picker_cocoa.mm b/chrome/browser/ui/cocoa/media_picker/desktop_media_picker_cocoa.mm
index 8708f3a..d8d4a3e 100644
--- a/chrome/browser/ui/cocoa/media_picker/desktop_media_picker_cocoa.mm
+++ b/chrome/browser/ui/cocoa/media_picker/desktop_media_picker_cocoa.mm
@@ -4,6 +4,8 @@
 
 #include "chrome/browser/ui/cocoa/media_picker/desktop_media_picker_cocoa.h"
 
+#include <utility>
+
 #import "chrome/browser/ui/cocoa/media_picker/desktop_media_picker_controller.h"
 
 DesktopMediaPickerCocoa::DesktopMediaPickerCocoa() {
@@ -19,12 +21,12 @@
                                    const base::string16& target_name,
                                    scoped_ptr<DesktopMediaList> media_list,
                                    const DoneCallback& done_callback) {
-  controller_.reset(
-      [[DesktopMediaPickerController alloc] initWithMediaList:media_list.Pass()
-                                                       parent:parent
-                                                     callback:done_callback
-                                                      appName:app_name
-                                                   targetName:target_name]);
+  controller_.reset([[DesktopMediaPickerController alloc]
+      initWithMediaList:std::move(media_list)
+                 parent:parent
+               callback:done_callback
+                appName:app_name
+             targetName:target_name]);
   [controller_ showWindow:nil];
 }
 
diff --git a/chrome/browser/ui/cocoa/media_picker/desktop_media_picker_controller.mm b/chrome/browser/ui/cocoa/media_picker/desktop_media_picker_controller.mm
index 488f547..80cc9cb8 100644
--- a/chrome/browser/ui/cocoa/media_picker/desktop_media_picker_controller.mm
+++ b/chrome/browser/ui/cocoa/media_picker/desktop_media_picker_controller.mm
@@ -4,6 +4,8 @@
 
 #import "chrome/browser/ui/cocoa/media_picker/desktop_media_picker_controller.h"
 
+#include <utility>
+
 #include "base/bind.h"
 #include "base/command_line.h"
 #import "base/mac/bundle_locations.h"
@@ -75,7 +77,7 @@
     [parent addChildWindow:window ordered:NSWindowAbove];
     [window setDelegate:self];
     [self initializeContentsWithAppName:appName targetName:targetName];
-    media_list_ = media_list.Pass();
+    media_list_ = std::move(media_list);
     media_list_->SetViewDialogWindowId(content::DesktopMediaID(
        content::DesktopMediaID::TYPE_WINDOW, [window windowNumber]));
     doneCallback_ = callback;
diff --git a/chrome/browser/ui/cocoa/omnibox/omnibox_view_mac.mm b/chrome/browser/ui/cocoa/omnibox/omnibox_view_mac.mm
index 8c219dff..f87e350 100644
--- a/chrome/browser/ui/cocoa/omnibox/omnibox_view_mac.mm
+++ b/chrome/browser/ui/cocoa/omnibox/omnibox_view_mac.mm
@@ -19,13 +19,14 @@
 #include "chrome/browser/ui/cocoa/omnibox/omnibox_popup_view_mac.h"
 #include "chrome/browser/ui/omnibox/chrome_omnibox_client.h"
 #include "chrome/browser/ui/omnibox/clipboard_utils.h"
-#include "chrome/browser/ui/toolbar/chrome_toolbar_model.h"
 #include "chrome/grit/generated_resources.h"
 #include "components/omnibox/browser/autocomplete_input.h"
 #include "components/omnibox/browser/autocomplete_match.h"
 #include "components/omnibox/browser/omnibox_edit_controller.h"
 #include "components/omnibox/browser/omnibox_field_trial.h"
 #include "components/omnibox/browser/omnibox_popup_model.h"
+#include "components/security_state/security_state_model.h"
+#include "components/toolbar/toolbar_model.h"
 #include "content/public/browser/web_contents.h"
 #include "extensions/common/constants.h"
 #import "third_party/mozilla/NSPasteboard+Utils.h"
@@ -539,13 +540,11 @@
     }
   }
 
-  ChromeToolbarModel* chrome_toolbar_model =
-      static_cast<ChromeToolbarModel*>(controller()->GetToolbarModel());
   // TODO(shess): GTK has this as a member var, figure out why.
   // [Could it be to not change if no change?  If so, I'm guessing
   // AppKit may already handle that.]
   const security_state::SecurityStateModel::SecurityLevel security_level =
-      chrome_toolbar_model->GetSecurityLevel(false);
+      controller()->GetToolbarModel()->GetSecurityLevel(false);
 
   // Emphasize the scheme for security UI display purposes (if necessary).
   if (!model()->user_input_in_progress() && model()->CurrentTextIsURL() &&
diff --git a/chrome/browser/ui/cocoa/passwords/account_avatar_fetcher_manager.mm b/chrome/browser/ui/cocoa/passwords/account_avatar_fetcher_manager.mm
index 618b782..b475b24 100644
--- a/chrome/browser/ui/cocoa/passwords/account_avatar_fetcher_manager.mm
+++ b/chrome/browser/ui/cocoa/passwords/account_avatar_fetcher_manager.mm
@@ -4,6 +4,8 @@
 
 #import "chrome/browser/ui/cocoa/passwords/account_avatar_fetcher_manager.h"
 
+#include <utility>
+
 #include "base/memory/weak_ptr.h"
 #import "chrome/browser/ui/cocoa/passwords/credential_item_view.h"
 #include "chrome/browser/ui/passwords/account_avatar_fetcher.h"
@@ -69,7 +71,7 @@
       new AccountAvatarFetcherBridge(self, view));
   AccountAvatarFetcher* fetcher =
       new AccountAvatarFetcher(avatarURL, bridge->AsWeakPtr());
-  bridges_.push_back(bridge.Pass());
+  bridges_.push_back(std::move(bridge));
   [self startRequestWithFetcher:fetcher];
 }
 
diff --git a/chrome/browser/ui/cocoa/passwords/account_chooser_view_controller_unittest.mm b/chrome/browser/ui/cocoa/passwords/account_chooser_view_controller_unittest.mm
index e8bbc0a..b9c747d4 100644
--- a/chrome/browser/ui/cocoa/passwords/account_chooser_view_controller_unittest.mm
+++ b/chrome/browser/ui/cocoa/passwords/account_chooser_view_controller_unittest.mm
@@ -4,6 +4,8 @@
 
 #import "chrome/browser/ui/cocoa/passwords/account_chooser_view_controller.h"
 
+#include <utility>
+
 #include "base/mac/foundation_util.h"
 #include "base/memory/scoped_vector.h"
 #include "base/strings/string16.h"
@@ -57,7 +59,7 @@
 scoped_ptr<autofill::PasswordForm> Credential(const char* username) {
   scoped_ptr<autofill::PasswordForm> credential(new autofill::PasswordForm);
   credential->username_value = base::ASCIIToUTF16(username);
-  return credential.Pass();
+  return credential;
 }
 
 // Tests for the account chooser view of the password management bubble.
@@ -102,7 +104,7 @@
   local_forms.push_back(Credential("pizza"));
   ScopedVector<const autofill::PasswordForm> federated_forms;
   federated_forms.push_back(Credential("taco"));
-  SetUpAccountChooser(local_forms.Pass(), federated_forms.Pass());
+  SetUpAccountChooser(std::move(local_forms), std::move(federated_forms));
   // Trigger creation of controller and check the views.
   NSTableView* view = controller().credentialsView;
   ASSERT_NSNE(nil, view);
@@ -127,8 +129,8 @@
   ScopedVector<const autofill::PasswordForm> local_forms;
   scoped_ptr<autofill::PasswordForm> form = Credential("taco");
   form->icon_url = GURL("http://foo");
-  local_forms.push_back(form.Pass());
-  SetUpAccountChooser(local_forms.Pass(),
+  local_forms.push_back(std::move(form));
+  SetUpAccountChooser(std::move(local_forms),
                       ScopedVector<const autofill::PasswordForm>());
   // Trigger creation of the controller and check the fetched URLs.
   controller();
@@ -145,7 +147,7 @@
   local_forms.push_back(Credential("pizza"));
   ScopedVector<const autofill::PasswordForm> federated_forms;
   federated_forms.push_back(Credential("taco"));
-  SetUpAccountChooser(local_forms.Pass(), federated_forms.Pass());
+  SetUpAccountChooser(std::move(local_forms), std::move(federated_forms));
   EXPECT_CALL(*ui_controller(),
               ChooseCredential(
                   *Credential("taco"),
@@ -160,7 +162,7 @@
        SelectingNopeDismissesDialog) {
   ScopedVector<const autofill::PasswordForm> local_forms;
   local_forms.push_back(Credential("pizza"));
-  SetUpAccountChooser(local_forms.Pass(),
+  SetUpAccountChooser(std::move(local_forms),
                       ScopedVector<const autofill::PasswordForm>());
   [controller().cancelButton performClick:nil];
   EXPECT_TRUE(delegate().dismissed);
diff --git a/chrome/browser/ui/cocoa/renderer_context_menu/render_view_context_menu_mac.mm b/chrome/browser/ui/cocoa/renderer_context_menu/render_view_context_menu_mac.mm
index 26ceb2f..dafc7c2a 100644
--- a/chrome/browser/ui/cocoa/renderer_context_menu/render_view_context_menu_mac.mm
+++ b/chrome/browser/ui/cocoa/renderer_context_menu/render_view_context_menu_mac.mm
@@ -4,6 +4,8 @@
 
 #include "chrome/browser/ui/cocoa/renderer_context_menu/render_view_context_menu_mac.h"
 
+#include <utility>
+
 #include "base/compiler_specific.h"
 #import "base/mac/scoped_sending_event.h"
 #include "base/macros.h"
@@ -88,7 +90,7 @@
       bidi_submenu_model_(this),
       parent_view_(parent_view) {
   scoped_ptr<ToolkitDelegate> delegate(new ToolkitDelegateMac(this));
-  set_toolkit_delegate(delegate.Pass());
+  set_toolkit_delegate(std::move(delegate));
 }
 
 RenderViewContextMenuMac::~RenderViewContextMenuMac() {
diff --git a/chrome/browser/ui/cocoa/ssl_client_certificate_selector_cocoa.mm b/chrome/browser/ui/cocoa/ssl_client_certificate_selector_cocoa.mm
index 5df6b12..8c7d66d 100644
--- a/chrome/browser/ui/cocoa/ssl_client_certificate_selector_cocoa.mm
+++ b/chrome/browser/ui/cocoa/ssl_client_certificate_selector_cocoa.mm
@@ -7,6 +7,8 @@
 #import <SecurityInterface/SFChooseIdentityPanel.h>
 #include <stddef.h>
 
+#include <utility>
+
 #include "base/logging.h"
 #include "base/mac/foundation_util.h"
 #include "base/strings/string_util.h"
@@ -51,7 +53,7 @@
       SSLClientCertificateSelectorCocoa* controller)
       : SSLClientAuthObserver(browser_context,
                               cert_request_info,
-                              delegate.Pass()),
+                              std::move(delegate)),
         controller_(controller) {}
 
   // SSLClientAuthObserver implementation:
@@ -97,7 +99,7 @@
       [[SSLClientCertificateSelectorCocoa alloc]
           initWithBrowserContext:contents->GetBrowserContext()
                  certRequestInfo:cert_request_info
-                        delegate:delegate.Pass()];
+                        delegate:std::move(delegate)];
   [selector displayForWebContents:contents];
 }
 
@@ -113,7 +115,7 @@
   DCHECK(certRequestInfo);
   if ((self = [super init])) {
     observer_.reset(new SSLClientAuthObserverCocoaBridge(
-        browserContext, certRequestInfo, delegate.Pass(), self));
+        browserContext, certRequestInfo, std::move(delegate), self));
   }
   return self;
 }
diff --git a/chrome/browser/ui/cocoa/tab_contents/chrome_web_contents_view_delegate_mac.mm b/chrome/browser/ui/cocoa/tab_contents/chrome_web_contents_view_delegate_mac.mm
index 81a6648..983ae52 100644
--- a/chrome/browser/ui/cocoa/tab_contents/chrome_web_contents_view_delegate_mac.mm
+++ b/chrome/browser/ui/cocoa/tab_contents/chrome_web_contents_view_delegate_mac.mm
@@ -4,6 +4,8 @@
 
 #import "chrome/browser/ui/cocoa/tab_contents/chrome_web_contents_view_delegate_mac.h"
 
+#include <utility>
+
 #include "base/profiler/scoped_tracker.h"
 #import "chrome/browser/renderer_host/chrome_render_widget_host_view_mac_delegate.h"
 #include "chrome/browser/ui/browser.h"
@@ -61,7 +63,7 @@
       FROM_HERE_WITH_EXPLICIT_FUNCTION(
           "458401 ChromeWebContentsViewDelegateMac::ShowMenu"));
 
-  context_menu_ = menu.Pass();
+  context_menu_ = std::move(menu);
   if (!context_menu_.get())
     return;
 
@@ -113,7 +115,7 @@
     menu->Init();
   }
 
-  return menu.Pass();
+  return menu;
 }
 
 content::RenderWidgetHostView*
diff --git a/chrome/browser/ui/cocoa/tab_modal_confirm_dialog_mac.mm b/chrome/browser/ui/cocoa/tab_modal_confirm_dialog_mac.mm
index abddcf9d..6935ce1 100644
--- a/chrome/browser/ui/cocoa/tab_modal_confirm_dialog_mac.mm
+++ b/chrome/browser/ui/cocoa/tab_modal_confirm_dialog_mac.mm
@@ -4,6 +4,8 @@
 
 #include "chrome/browser/ui/cocoa/tab_modal_confirm_dialog_mac.h"
 
+#include <utility>
+
 #include "base/mac/scoped_nsobject.h"
 #include "chrome/browser/ui/browser_dialogs.h"
 #import "chrome/browser/ui/cocoa/constrained_window/constrained_window_alert.h"
@@ -120,7 +122,7 @@
   // prevent a double-delete by moving delegate_ to a stack variable.
   if (!delegate_)
     return;
-  scoped_ptr<TabModalConfirmDialogDelegate> delegate(delegate_.Pass());
+  scoped_ptr<TabModalConfirmDialogDelegate> delegate(std::move(delegate_));
   // Provide a disposition in case the dialog was closed without accepting or
   // cancelling.
   delegate->Close();
diff --git a/chrome/browser/ui/cocoa/translate/translate_bubble_controller.mm b/chrome/browser/ui/cocoa/translate/translate_bubble_controller.mm
index 8fbcdbe..975b0b3 100644
--- a/chrome/browser/ui/cocoa/translate/translate_bubble_controller.mm
+++ b/chrome/browser/ui/cocoa/translate/translate_bubble_controller.mm
@@ -4,6 +4,8 @@
 
 #import "chrome/browser/ui/cocoa/translate/translate_bubble_controller.h"
 
+#include <utility>
+
 #include "base/mac/foundation_util.h"
 #include "base/mac/scoped_nsobject.h"
 #include "base/macros.h"
@@ -124,7 +126,7 @@
                        parentWindow:parentWindow
                          anchoredAt:NSZeroPoint])) {
     webContents_ = webContents;
-    model_ = model.Pass();
+    model_ = std::move(model);
     if (model_->GetViewState() !=
         TranslateBubbleModel::VIEW_STATE_BEFORE_TRANSLATE) {
       translateExecuted_ = YES;
diff --git a/chrome/browser/ui/extensions/application_launch.cc b/chrome/browser/ui/extensions/application_launch.cc
index 84a1ab7..0025d35 100644
--- a/chrome/browser/ui/extensions/application_launch.cc
+++ b/chrome/browser/ui/extensions/application_launch.cc
@@ -13,6 +13,7 @@
 #include "chrome/browser/app_mode/app_mode_utils.h"
 #include "chrome/browser/apps/per_app_settings_service.h"
 #include "chrome/browser/apps/per_app_settings_service_factory.h"
+#include "chrome/browser/engagement/site_engagement_service.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/extensions/launch_util.h"
 #include "chrome/browser/extensions/tab_helper.h"
@@ -340,17 +341,23 @@
                             params.container,
                             extensions::NUM_LAUNCH_CONTAINERS);
 
+  GURL url = UrlForExtension(extension, params.override_url);
   if (extension->from_bookmark()) {
     UMA_HISTOGRAM_ENUMERATION("Extensions.BookmarkAppLaunchContainer",
                               params.container,
                               extensions::NUM_LAUNCH_CONTAINERS);
+
+    // Record the launch time in the site engagement service. A recent bookmark
+    // app launch will provide an engagement boost to the origin.
+    SiteEngagementService* service = SiteEngagementService::Get(profile);
+    if (service)
+      service->SetLastShortcutLaunchTime(url);
   }
 
   // Record v1 app launch. Platform app launch is recorded when dispatching
   // the onLaunched event.
   prefs->SetLastLaunchTime(extension->id(), base::Time::Now());
 
-  GURL url = UrlForExtension(extension, params.override_url);
   switch (params.container) {
     case extensions::LAUNCH_CONTAINER_NONE: {
       NOTREACHED();
diff --git a/chrome/browser/ui/toolbar/chrome_toolbar_model.cc b/chrome/browser/ui/toolbar/chrome_toolbar_model.cc
deleted file mode 100644
index 1902fecb..0000000
--- a/chrome/browser/ui/toolbar/chrome_toolbar_model.cc
+++ /dev/null
@@ -1,9 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chrome/browser/ui/toolbar/chrome_toolbar_model.h"
-
-ChromeToolbarModel::ChromeToolbarModel() {}
-
-ChromeToolbarModel::~ChromeToolbarModel() {}
diff --git a/chrome/browser/ui/toolbar/chrome_toolbar_model.h b/chrome/browser/ui/toolbar/chrome_toolbar_model.h
deleted file mode 100644
index 629cf053..0000000
--- a/chrome/browser/ui/toolbar/chrome_toolbar_model.h
+++ /dev/null
@@ -1,34 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROME_BROWSER_UI_TOOLBAR_CHROME_TOOLBAR_MODEL_H_
-#define CHROME_BROWSER_UI_TOOLBAR_CHROME_TOOLBAR_MODEL_H_
-
-#include "base/macros.h"
-#include "components/security_state/security_state_model.h"
-#include "components/toolbar/toolbar_model.h"
-
-// This class is a //chrome-specific extension of the ToolbarModel interface.
-// TODO(blundell): Now that SecurityStateModel::SecurityLevel is componentized,
-// GetSecurityLevel() can be folded into ToolbarModel and this class can go
-// away. crbug.com/515071
-class ChromeToolbarModel : public ToolbarModel {
- public:
-  ~ChromeToolbarModel() override;
-
-  // Returns the security level that the toolbar should display.  If
-  // |ignore_editing| is true, the result reflects the underlying state of the
-  // page without regard to any user edits that may be in progress in the
-  // omnibox.
-  virtual security_state::SecurityStateModel::SecurityLevel GetSecurityLevel(
-      bool ignore_editing) const = 0;
-
- protected:
-  ChromeToolbarModel();
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(ChromeToolbarModel);
-};
-
-#endif  // CHROME_BROWSER_UI_TOOLBAR_CHROME_TOOLBAR_MODEL_H_
diff --git a/chrome/browser/ui/toolbar/test_toolbar_model.cc b/chrome/browser/ui/toolbar/test_toolbar_model.cc
index d9ed9ea..556c0fbf 100644
--- a/chrome/browser/ui/toolbar/test_toolbar_model.cc
+++ b/chrome/browser/ui/toolbar/test_toolbar_model.cc
@@ -8,8 +8,7 @@
 #include "ui/gfx/vector_icons_public.h"
 
 TestToolbarModel::TestToolbarModel()
-    : ChromeToolbarModel(),
-      perform_search_term_replacement_(false),
+    : perform_search_term_replacement_(false),
       security_level_(security_state::SecurityStateModel::NONE),
 #if defined(TOOLKIT_VIEWS)
       icon_(gfx::VectorIconId::LOCATION_BAR_HTTP),
diff --git a/chrome/browser/ui/toolbar/test_toolbar_model.h b/chrome/browser/ui/toolbar/test_toolbar_model.h
index b29dcc1..9acc0c3a 100644
--- a/chrome/browser/ui/toolbar/test_toolbar_model.h
+++ b/chrome/browser/ui/toolbar/test_toolbar_model.h
@@ -10,7 +10,7 @@
 #include "base/compiler_specific.h"
 #include "base/macros.h"
 #include "base/strings/string16.h"
-#include "chrome/browser/ui/toolbar/chrome_toolbar_model.h"
+#include "components/toolbar/toolbar_model.h"
 
 namespace gfx {
 enum class VectorIconId;
@@ -19,7 +19,7 @@
 // A ToolbarModel that is backed by instance variables, which are initialized
 // with some basic values that can be changed with the provided setters. This
 // should be used only for testing.
-class TestToolbarModel : public ChromeToolbarModel {
+class TestToolbarModel : public ToolbarModel {
  public:
   TestToolbarModel();
   ~TestToolbarModel() override;
diff --git a/chrome/browser/ui/toolbar/toolbar_model_impl.h b/chrome/browser/ui/toolbar/toolbar_model_impl.h
index 623d6da3..e9485b2 100644
--- a/chrome/browser/ui/toolbar/toolbar_model_impl.h
+++ b/chrome/browser/ui/toolbar/toolbar_model_impl.h
@@ -12,7 +12,7 @@
 #include "base/compiler_specific.h"
 #include "base/macros.h"
 #include "base/strings/string16.h"
-#include "chrome/browser/ui/toolbar/chrome_toolbar_model.h"
+#include "components/toolbar/toolbar_model.h"
 #include "url/gurl.h"
 
 class Profile;
@@ -30,7 +30,7 @@
 // This class is the model used by the toolbar, location bar and autocomplete
 // edit.  It populates its states from the current navigation entry retrieved
 // from the navigation controller returned by GetNavigationController().
-class ToolbarModelImpl : public ChromeToolbarModel {
+class ToolbarModelImpl : public ToolbarModel {
  public:
   explicit ToolbarModelImpl(ToolbarModelDelegate* delegate);
   ~ToolbarModelImpl() override;
diff --git a/chrome/browser/ui/views/browser_dialogs_views_mac.cc b/chrome/browser/ui/views/browser_dialogs_views_mac.cc
index 0cc628a..68ab357b 100644
--- a/chrome/browser/ui/views/browser_dialogs_views_mac.cc
+++ b/chrome/browser/ui/views/browser_dialogs_views_mac.cc
@@ -2,10 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/ui/browser_dialogs.h"
+#include <utility>
 
 #include "chrome/browser/ui/bookmarks/bookmark_bubble_sign_in_delegate.h"
 #include "chrome/browser/ui/browser.h"
+#include "chrome/browser/ui/browser_dialogs.h"
 #include "chrome/browser/ui/views/bookmarks/bookmark_bubble_view.h"
 #include "chrome/browser/ui/views/website_settings/website_settings_popup_view.h"
 
@@ -39,7 +40,7 @@
       new BookmarkBubbleSignInDelegate(browser));
 
   BookmarkBubbleView::ShowBubble(nullptr, gfx::Rect(anchor_point, gfx::Size()),
-                                 parent, observer, delegate.Pass(),
+                                 parent, observer, std::move(delegate),
                                  browser->profile(), url, already_bookmarked);
 }
 
diff --git a/chrome/browser/ui/views/constrained_web_dialog_delegate_views.cc b/chrome/browser/ui/views/constrained_web_dialog_delegate_views.cc
index 12a9068..4a4a74d 100644
--- a/chrome/browser/ui/views/constrained_web_dialog_delegate_views.cc
+++ b/chrome/browser/ui/views/constrained_web_dialog_delegate_views.cc
@@ -210,14 +210,12 @@
   gfx::Size GetPreferredSize() const override {
     gfx::Size size;
     if (!impl_->closed_via_webui()) {
-      // The size is set here if the dialog has been auto-resized in
-      // WebDialogWebContentsDelegateViews's ResizeDueToAutoResize.
+      // If auto-resizing is enabled and the dialog has been auto-resized,
+      // GetPreferredSize() will return the appropriate current size.  In this
+      // case, GetDialogSize() should leave its argument untouched.  In all
+      // other cases, GetDialogSize() will overwrite the passed-in size.
       size = WebView::GetPreferredSize();
-      if (size.IsEmpty()) {
-        // The size set here if the dialog has not been auto-resized or
-        // auto-resizable is not enabled.
-        GetWebDialogDelegate()->GetDialogSize(&size);
-      }
+      GetWebDialogDelegate()->GetDialogSize(&size);
     }
     return size;
   }
diff --git a/chrome/browser/ui/views/location_bar/location_bar_view.cc b/chrome/browser/ui/views/location_bar/location_bar_view.cc
index 95a3003..af627390 100644
--- a/chrome/browser/ui/views/location_bar/location_bar_view.cc
+++ b/chrome/browser/ui/views/location_bar/location_bar_view.cc
@@ -58,6 +58,7 @@
 #include "components/omnibox/browser/omnibox_popup_view.h"
 #include "components/search_engines/template_url.h"
 #include "components/search_engines/template_url_service.h"
+#include "components/toolbar/toolbar_model.h"
 #include "components/translate/core/browser/language_state.h"
 #include "components/ui/zoom/zoom_controller.h"
 #include "components/ui/zoom/zoom_event_manager.h"
@@ -1040,9 +1041,7 @@
 }
 
 bool LocationBarView::ShouldShowEVBubble() const {
-  const ChromeToolbarModel* chrome_toolbar_model =
-      static_cast<const ChromeToolbarModel*>(GetToolbarModel());
-  return (chrome_toolbar_model->GetSecurityLevel(false) ==
+  return (GetToolbarModel()->GetSecurityLevel(false) ==
           security_state::SecurityStateModel::EV_SECURE);
 }
 
diff --git a/chrome/browser/ui/views/location_bar/location_bar_view.h b/chrome/browser/ui/views/location_bar/location_bar_view.h
index f71b524..c14a145 100644
--- a/chrome/browser/ui/views/location_bar/location_bar_view.h
+++ b/chrome/browser/ui/views/location_bar/location_bar_view.h
@@ -16,7 +16,6 @@
 #include "chrome/browser/extensions/extension_context_menu_model.h"
 #include "chrome/browser/ui/location_bar/location_bar.h"
 #include "chrome/browser/ui/omnibox/chrome_omnibox_edit_controller.h"
-#include "chrome/browser/ui/toolbar/chrome_toolbar_model.h"
 #include "chrome/browser/ui/views/dropdown_bar_host.h"
 #include "chrome/browser/ui/views/dropdown_bar_host_delegate.h"
 #include "chrome/browser/ui/views/extensions/extension_popup.h"
diff --git a/chrome/browser/ui/views/omnibox/omnibox_view_views.cc b/chrome/browser/ui/views/omnibox/omnibox_view_views.cc
index 19bd981b..bc7b351 100644
--- a/chrome/browser/ui/views/omnibox/omnibox_view_views.cc
+++ b/chrome/browser/ui/views/omnibox/omnibox_view_views.cc
@@ -31,6 +31,7 @@
 #include "components/omnibox/browser/omnibox_field_trial.h"
 #include "components/omnibox/browser/omnibox_popup_model.h"
 #include "components/search/search.h"
+#include "components/toolbar/toolbar_model.h"
 #include "content/public/browser/web_contents.h"
 #include "extensions/common/constants.h"
 #include "net/base/escape.h"
@@ -436,9 +437,7 @@
 }
 
 void OmniboxViewViews::UpdateSecurityLevel() {
-  ChromeToolbarModel* chrome_toolbar_model =
-      static_cast<ChromeToolbarModel*>(controller()->GetToolbarModel());
-  security_level_ = chrome_toolbar_model->GetSecurityLevel(false);
+  security_level_ = controller()->GetToolbarModel()->GetSecurityLevel(false);
 }
 
 void OmniboxViewViews::SetWindowTextAndCaretPos(const base::string16& text,
diff --git a/chrome/browser/ui/views/omnibox/omnibox_view_views.h b/chrome/browser/ui/views/omnibox/omnibox_view_views.h
index 11564bc..f38b5c8 100644
--- a/chrome/browser/ui/views/omnibox/omnibox_view_views.h
+++ b/chrome/browser/ui/views/omnibox/omnibox_view_views.h
@@ -15,8 +15,8 @@
 #include "base/memory/scoped_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "build/build_config.h"
-#include "chrome/browser/ui/toolbar/chrome_toolbar_model.h"
 #include "components/omnibox/browser/omnibox_view.h"
+#include "components/security_state/security_state_model.h"
 #include "ui/base/window_open_disposition.h"
 #include "ui/gfx/range/range.h"
 #include "ui/views/controls/textfield/textfield.h"
diff --git a/chrome/browser/ui/webui/constrained_web_dialog_ui_browsertest.cc b/chrome/browser/ui/webui/constrained_web_dialog_ui_browsertest.cc
index cc1a222..fbdf04f8 100644
--- a/chrome/browser/ui/webui/constrained_web_dialog_ui_browsertest.cc
+++ b/chrome/browser/ui/webui/constrained_web_dialog_ui_browsertest.cc
@@ -61,6 +61,17 @@
   bool contents_destroyed_;
 };
 
+class AutoResizingTestWebDialogDelegate
+    : public ui::test::TestWebDialogDelegate {
+ public:
+  explicit AutoResizingTestWebDialogDelegate(const GURL& url)
+      : TestWebDialogDelegate(url) {}
+  ~AutoResizingTestWebDialogDelegate() override {}
+
+  // Dialog delegates for auto-resizing dialogs are expected not to set |size|.
+  void GetDialogSize(gfx::Size* size) const override {}
+};
+
 }  // namespace
 
 class ConstrainedWebDialogBrowserTest : public InProcessBrowserTest {
@@ -150,7 +161,7 @@
 
   // The delegate deletes itself.
   WebDialogDelegate* delegate =
-      new ui::test::TestWebDialogDelegate(GURL(kTestDataURL));
+      new AutoResizingTestWebDialogDelegate(GURL(kTestDataURL));
   WebContents* web_contents =
       browser()->tab_strip_model()->GetActiveWebContents();
   ASSERT_TRUE(web_contents);
diff --git a/chrome/browser/ui/webui/extensions/extension_settings_handler.cc b/chrome/browser/ui/webui/extensions/extension_settings_handler.cc
index 5fdbfd2..3203c31 100644
--- a/chrome/browser/ui/webui/extensions/extension_settings_handler.cc
+++ b/chrome/browser/ui/webui/extensions/extension_settings_handler.cc
@@ -193,6 +193,13 @@
                     l10n_util::GetStringUTF16(
                         IDS_EXTENSIONS_DISABLED_UPDATE_REQUIRED_BY_POLICY));
 
+  source->AddLocalizedString("extensionLogLevelInfo",
+                             IDS_EXTENSIONS_LOG_LEVEL_INFO);
+  source->AddLocalizedString("extensionLogLevelWarn",
+                             IDS_EXTENSIONS_LOG_LEVEL_WARN);
+  source->AddLocalizedString("extensionLogLevelError",
+                             IDS_EXTENSIONS_LOG_LEVEL_ERROR);
+
   // TODO(estade): comb through the above strings to find ones no longer used in
   // uber extensions.
   source->AddString("extensionUninstall",
diff --git a/chrome/browser/ui/webui/media_router/media_router_dialog_controller_impl.cc b/chrome/browser/ui/webui/media_router/media_router_dialog_controller_impl.cc
index d433f60..bf57e82 100644
--- a/chrome/browser/ui/webui/media_router/media_router_dialog_controller_impl.cc
+++ b/chrome/browser/ui/webui/media_router/media_router_dialog_controller_impl.cc
@@ -13,10 +13,13 @@
 #include "build/build_config.h"
 #include "chrome/browser/media/router/presentation_service_delegate_impl.h"
 #include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/ui/browser_finder.h"
+#include "chrome/browser/ui/browser_window.h"
 #include "chrome/browser/ui/toolbar/media_router_action.h"
 #include "chrome/browser/ui/webui/constrained_web_dialog_ui.h"
 #include "chrome/browser/ui/webui/media_router/media_router_ui.h"
 #include "chrome/common/url_constants.h"
+#include "components/guest_view/browser/guest_view_base.h"
 #include "components/web_modal/web_contents_modal_dialog_host.h"
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/navigation_details.h"
@@ -41,7 +44,7 @@
 #if defined(OS_MACOSX)
 const int kFixedHeight = 350;
 #else
-const int kMaxHeight = 400;
+const int kMaxHeight = 2000;
 const int kMinHeight = 80;
 #endif
 const int kWidth = 340;
@@ -51,12 +54,14 @@
 
 namespace {
 
-// WebDialogDelegate that specifies what the media router dialog
+// WebDialogDelegate that specifies what the Media Router dialog
 // will look like.
 class MediaRouterDialogDelegate : public WebDialogDelegate {
  public:
-  explicit MediaRouterDialogDelegate(base::WeakPtr<MediaRouterAction> action)
-      : action_(action) {}
+  MediaRouterDialogDelegate(base::WeakPtr<MediaRouterAction> action,
+      const base::WeakPtr<MediaRouterDialogControllerImpl>& controller)
+      : action_(action),
+        controller_(controller) {}
   ~MediaRouterDialogDelegate() override {}
 
   // WebDialogDelegate implementation.
@@ -102,6 +107,7 @@
 
  private:
   base::WeakPtr<MediaRouterAction> action_;
+  base::WeakPtr<MediaRouterDialogControllerImpl> controller_;
 
   DISALLOW_COPY_AND_ASSIGN(MediaRouterDialogDelegate);
 };
@@ -112,8 +118,10 @@
 #if defined(OS_MACOSX)
   *size = gfx::Size(kWidth, kFixedHeight);
 #else
-  // size is not used because the dialog is auto-resizeable.
-  *size = gfx::Size();
+  // GetDialogSize() is called when the browser window resizes. We may want to
+  // update the maximum height of the dialog and scale the WebUI to the new
+  // height. |size| is not set because the dialog is auto-resizeable.
+  controller_->UpdateMaxDialogSize();
 #endif
 }
 
@@ -162,7 +170,8 @@
 MediaRouterDialogControllerImpl::MediaRouterDialogControllerImpl(
     WebContents* web_contents)
     : MediaRouterDialogController(web_contents),
-      media_router_dialog_pending_(false) {
+      media_router_dialog_pending_(false),
+      weak_ptr_factory_(this) {
 }
 
 MediaRouterDialogControllerImpl::~MediaRouterDialogControllerImpl() {
@@ -183,6 +192,33 @@
   return GetMediaRouterDialog() != nullptr;
 }
 
+void MediaRouterDialogControllerImpl::UpdateMaxDialogSize() {
+  WebContents* media_router_dialog = GetMediaRouterDialog();
+  if (!media_router_dialog)
+    return;
+
+  content::WebUI* web_ui = media_router_dialog->GetWebUI();
+  if (web_ui) {
+    MediaRouterUI* media_router_ui =
+        static_cast<MediaRouterUI*>(web_ui->GetController());
+    if (media_router_ui) {
+      Browser* browser = chrome::FindBrowserWithWebContents(initiator());
+      web_modal::WebContentsModalDialogHost* host = nullptr;
+      if (browser)
+        host = browser->window()->GetWebContentsModalDialogHost();
+
+      gfx::Size maxSize = host ?
+          host->GetMaximumDialogSize() :
+          initiator()->GetContainerBounds().size();
+
+      // The max height of the dialog should be 90% of the browser window
+      // height. The width stays fixed.
+      maxSize.Enlarge(0, -0.1 * maxSize.height());
+      media_router_ui->UpdateMaxDialogHeight(maxSize.height());
+    }
+  }
+}
+
 void MediaRouterDialogControllerImpl::CloseMediaRouterDialog() {
   WebContents* media_router_dialog = GetMediaRouterDialog();
   if (!media_router_dialog)
@@ -208,7 +244,7 @@
   DCHECK(profile);
 
   WebDialogDelegate* web_dialog_delegate =
-      new MediaRouterDialogDelegate(action_);
+      new MediaRouterDialogDelegate(action_, weak_ptr_factory_.GetWeakPtr());
   // |web_dialog_delegate|'s owner is |constrained_delegate|.
   // |constrained_delegate| is owned by the parent |views::View|.
   // TODO(apacible): Remove after autoresizing is implemented for OSX.
diff --git a/chrome/browser/ui/webui/media_router/media_router_dialog_controller_impl.h b/chrome/browser/ui/webui/media_router/media_router_dialog_controller_impl.h
index 2ce9a28..1388b5a 100644
--- a/chrome/browser/ui/webui/media_router/media_router_dialog_controller_impl.h
+++ b/chrome/browser/ui/webui/media_router/media_router_dialog_controller_impl.h
@@ -39,6 +39,8 @@
   // MediaRouterDialogController:
   bool IsShowingMediaRouterDialog() const override;
 
+  void UpdateMaxDialogSize();
+
  private:
   class DialogWebContentsObserver;
   friend class content::WebContentsUserData<MediaRouterDialogControllerImpl>;
@@ -73,6 +75,8 @@
   // when the overflow menu is opened and destroyed when the menu is closed.
   base::WeakPtr<MediaRouterAction> action_;
 
+  base::WeakPtrFactory<MediaRouterDialogControllerImpl> weak_ptr_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(MediaRouterDialogControllerImpl);
 };
 
diff --git a/chrome/browser/ui/webui/media_router/media_router_ui.cc b/chrome/browser/ui/webui/media_router/media_router_ui.cc
index 3bd6885e..7814a68 100644
--- a/chrome/browser/ui/webui/media_router/media_router_ui.cc
+++ b/chrome/browser/ui/webui/media_router/media_router_ui.cc
@@ -536,4 +536,8 @@
   }
 }
 
+void MediaRouterUI::UpdateMaxDialogHeight(int height) {
+  handler_->UpdateMaxDialogHeight(height);
+}
+
 }  // namespace media_router
diff --git a/chrome/browser/ui/webui/media_router/media_router_ui.h b/chrome/browser/ui/webui/media_router/media_router_ui.h
index 09dc618..575b8f5 100644
--- a/chrome/browser/ui/webui/media_router/media_router_ui.h
+++ b/chrome/browser/ui/webui/media_router/media_router_ui.h
@@ -138,6 +138,8 @@
   void OnUIInitiallyLoaded();
   void OnUIInitialDataReceived();
 
+  void UpdateMaxDialogHeight(int height);
+
  private:
   FRIEND_TEST_ALL_PREFIXES(MediaRouterUITest, SortedSinks);
   FRIEND_TEST_ALL_PREFIXES(MediaRouterUITest,
diff --git a/chrome/browser/ui/webui/media_router/media_router_webui_message_handler.cc b/chrome/browser/ui/webui/media_router/media_router_webui_message_handler.cc
index 45288c42d..aa9e597 100644
--- a/chrome/browser/ui/webui/media_router/media_router_webui_message_handler.cc
+++ b/chrome/browser/ui/webui/media_router/media_router_webui_message_handler.cc
@@ -12,6 +12,7 @@
 #include "base/metrics/user_metrics.h"
 #include "base/prefs/pref_service.h"
 #include "base/strings/stringprintf.h"
+#include "base/values.h"
 #include "chrome/browser/media/router/issue.h"
 #include "chrome/browser/media/router/media_router_metrics.h"
 #include "chrome/browser/profiles/profile.h"
@@ -56,6 +57,7 @@
 const char kSetSinkList[] = "media_router.ui.setSinkList";
 const char kSetRouteList[] = "media_router.ui.setRouteList";
 const char kSetCastModeList[] = "media_router.ui.setCastModeList";
+const char kUpdateMaxHeight[] = "media_router.ui.updateMaxHeight";
 const char kWindowOpen[] = "window.open";
 
 scoped_ptr<base::ListValue> SinksToValue(
@@ -242,6 +244,12 @@
       issue ? *IssueToValue(*issue) : *base::Value::CreateNullValue());
 }
 
+void MediaRouterWebUIMessageHandler::UpdateMaxDialogHeight(int height) {
+  DVLOG(2) << "UpdateMaxDialogHeight";
+  web_ui()->CallJavascriptFunction(kUpdateMaxHeight,
+                                   base::FundamentalValue(height));
+}
+
 void MediaRouterWebUIMessageHandler::NotifyRouteCreationTimeout() {
   DVLOG(2) << "NotifyRouteCreationTimeout";
   web_ui()->CallJavascriptFunction(kNotifyRouteCreationTimeout);
diff --git a/chrome/browser/ui/webui/media_router/media_router_webui_message_handler.h b/chrome/browser/ui/webui/media_router/media_router_webui_message_handler.h
index 0f67811e..e5bec19 100644
--- a/chrome/browser/ui/webui/media_router/media_router_webui_message_handler.h
+++ b/chrome/browser/ui/webui/media_router/media_router_webui_message_handler.h
@@ -12,6 +12,7 @@
 #include "chrome/browser/ui/webui/media_router/media_cast_mode.h"
 #include "chrome/browser/ui/webui/media_router/media_sink_with_cast_modes.h"
 #include "content/public/browser/web_ui_message_handler.h"
+#include "ui/gfx/geometry/size.h"
 
 namespace base {
 class DictionaryValue;
@@ -43,6 +44,10 @@
   // there are no more issues.
   void UpdateIssue(const Issue* issue);
 
+  // Updates the maximum dialog height to allow the WebUI properly scale when
+  // the browser window changes.
+  void UpdateMaxDialogHeight(int height);
+
   // Notifies the dialog that the route creation attempt timed out.
   void NotifyRouteCreationTimeout();
 
diff --git a/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc b/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
index 963a5562..8e1d2f80 100644
--- a/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
+++ b/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
@@ -103,6 +103,8 @@
   html_source->AddLocalizedString(
       "appearancePageTitle", IDS_SETTINGS_APPEARANCE);
   html_source->AddLocalizedString(
+      "exampleDotCom", IDS_SETTINGS_EXAMPLE_DOT_COM);
+  html_source->AddLocalizedString(
       "setWallpaper", IDS_SETTINGS_SET_WALLPAPER);
   html_source->AddLocalizedString(
       "getThemes", IDS_SETTINGS_THEMES);
@@ -115,7 +117,7 @@
   html_source->AddLocalizedString(
       "homePageNtp", IDS_SETTINGS_HOME_PAGE_NTP);
   html_source->AddLocalizedString(
-      "openThisPage", IDS_SETTINGS_OPEN_THIS_PAGE);
+      "other", IDS_SETTINGS_OTHER);
   html_source->AddLocalizedString(
       "changeHomePage", IDS_SETTINGS_CHANGE_HOME_PAGE);
   html_source->AddLocalizedString(
diff --git a/chrome/browser/web_applications/web_app_mac.mm b/chrome/browser/web_applications/web_app_mac.mm
index 274154e..22a153ea 100644
--- a/chrome/browser/web_applications/web_app_mac.mm
+++ b/chrome/browser/web_applications/web_app_mac.mm
@@ -8,6 +8,8 @@
 #import <Cocoa/Cocoa.h>
 #include <stdint.h>
 
+#include <utility>
+
 #include "base/command_line.h"
 #include "base/files/file_enumerator.h"
 #include "base/files/file_util.h"
@@ -309,7 +311,7 @@
       shortcut_info->profile_path, shortcut_info->extension_id, GURL());
   UpdatePlatformShortcutsInternal(shortcut_data_dir, base::string16(),
                                   *shortcut_info, file_handlers_info);
-  LaunchShimOnFileThread(shortcut_info.Pass(), true);
+  LaunchShimOnFileThread(std::move(shortcut_info), true);
 }
 
 void UpdateAndLaunchShim(
diff --git a/chrome/chrome_browser_ui.gypi b/chrome/chrome_browser_ui.gypi
index 667d1b4a..a6a6a46 100644
--- a/chrome/chrome_browser_ui.gypi
+++ b/chrome/chrome_browser_ui.gypi
@@ -2795,8 +2795,6 @@
       'browser/ui/webui/local_discovery/local_discovery_ui_handler.h',
     ],
     'chrome_browser_ui_toolbar_model_sources': [
-      'browser/ui/toolbar/chrome_toolbar_model.cc',
-      'browser/ui/toolbar/chrome_toolbar_model.h',
       'browser/ui/toolbar/toolbar_model_delegate.h',
       'browser/ui/toolbar/toolbar_model_impl.cc',
       'browser/ui/toolbar/toolbar_model_impl.h',
diff --git a/chrome/renderer/autofill/form_autofill_browsertest.cc b/chrome/renderer/autofill/form_autofill_browsertest.cc
index 3dfdd69..9985fc26 100644
--- a/chrome/renderer/autofill/form_autofill_browsertest.cc
+++ b/chrome/renderer/autofill/form_autofill_browsertest.cc
@@ -217,7 +217,8 @@
 
     const FormData& form = forms[0];
     EXPECT_EQ(ASCIIToUTF16("TestForm"), form.name);
-    EXPECT_EQ(GURL(web_frame->document().url()), form.origin);
+    EXPECT_EQ(GetCanonicalOriginForDocument(web_frame->document()),
+              form.origin);
     EXPECT_EQ(GURL("http://cnn.com"), form.action);
 
     const std::vector<FormFieldData>& fields = form.fields;
@@ -520,7 +521,8 @@
     FormFieldData field;
     EXPECT_TRUE(
         FindFormAndFieldForFormControlElement(input_element, &form, &field));
-    EXPECT_EQ(GURL(web_frame->document().url()), form.origin);
+    EXPECT_EQ(GetCanonicalOriginForDocument(web_frame->document()),
+              form.origin);
     if (!unowned) {
       EXPECT_EQ(ASCIIToUTF16("TestForm"), form.name);
       EXPECT_EQ(GURL("http://buh.com"), form.action);
@@ -576,7 +578,8 @@
     FormFieldData field;
     EXPECT_TRUE(
         FindFormAndFieldForFormControlElement(textarea_element, &form, &field));
-    EXPECT_EQ(GURL(web_frame->document().url()), form.origin);
+    EXPECT_EQ(GetCanonicalOriginForDocument(web_frame->document()),
+              form.origin);
     if (!unowned) {
       EXPECT_EQ(ASCIIToUTF16("TestForm"), form.name);
       EXPECT_EQ(GURL("http://buh.com"), form.action);
@@ -636,7 +639,8 @@
     FormFieldData field;
     EXPECT_TRUE(
         FindFormAndFieldForFormControlElement(input_element, &form, &field));
-    EXPECT_EQ(GURL(web_frame->document().url()), form.origin);
+    EXPECT_EQ(GetCanonicalOriginForDocument(web_frame->document()),
+              form.origin);
     if (!unowned) {
       EXPECT_EQ(ASCIIToUTF16("TestForm"), form.name);
       EXPECT_EQ(GURL("http://buh.com"), form.action);
@@ -677,7 +681,8 @@
     FormFieldData field2;
     EXPECT_TRUE(
         FindFormAndFieldForFormControlElement(input_element, &form2, &field2));
-    EXPECT_EQ(GURL(web_frame->document().url()), form2.origin);
+    EXPECT_EQ(GetCanonicalOriginForDocument(web_frame->document()),
+              form2.origin);
     if (!unowned) {
       EXPECT_EQ(ASCIIToUTF16("TestForm"), form2.name);
       EXPECT_EQ(GURL("http://buh.com"), form2.action);
@@ -724,7 +729,8 @@
     FormFieldData field;
     EXPECT_TRUE(
         FindFormAndFieldForFormControlElement(input_element, &form, &field));
-    EXPECT_EQ(GURL(web_frame->document().url()), form.origin);
+    EXPECT_EQ(GetCanonicalOriginForDocument(web_frame->document()),
+              form.origin);
     if (!unowned) {
       EXPECT_EQ(ASCIIToUTF16("TestForm"), form.name);
       EXPECT_EQ(GURL("http://buh.com"), form.action);
@@ -757,7 +763,8 @@
     FormFieldData field2;
     EXPECT_TRUE(
         FindFormAndFieldForFormControlElement(input_element, &form2, &field2));
-    EXPECT_EQ(GURL(web_frame->document().url()), form2.origin);
+    EXPECT_EQ(GetCanonicalOriginForDocument(web_frame->document()),
+              form2.origin);
     if (!unowned) {
       EXPECT_EQ(ASCIIToUTF16("TestForm"), form2.name);
       EXPECT_EQ(GURL("http://buh.com"), form2.action);
@@ -796,7 +803,8 @@
     FormFieldData field;
     EXPECT_TRUE(
         FindFormAndFieldForFormControlElement(input_element, &form, &field));
-    EXPECT_EQ(GURL(web_frame->document().url()), form.origin);
+    EXPECT_EQ(GetCanonicalOriginForDocument(web_frame->document()),
+              form.origin);
     if (!unowned) {
       EXPECT_EQ(ASCIIToUTF16("TestForm"), form.name);
       EXPECT_EQ(GURL("http://buh.com"), form.action);
@@ -829,7 +837,8 @@
     FormFieldData field2;
     EXPECT_TRUE(
         FindFormAndFieldForFormControlElement(input_element, &form2, &field2));
-    EXPECT_EQ(GURL(web_frame->document().url()), form2.origin);
+    EXPECT_EQ(GetCanonicalOriginForDocument(web_frame->document()),
+              form2.origin);
     if (!unowned) {
       EXPECT_EQ(ASCIIToUTF16("TestForm"), form2.name);
       EXPECT_EQ(GURL("http://buh.com"), form2.action);
@@ -872,7 +881,8 @@
     FormFieldData field;
     EXPECT_TRUE(
         FindFormAndFieldForFormControlElement(input_element, &form, &field));
-    EXPECT_EQ(GURL(web_frame->document().url()), form.origin);
+    EXPECT_EQ(GetCanonicalOriginForDocument(web_frame->document()),
+              form.origin);
     if (!unowned) {
       EXPECT_TRUE(form.name.empty());
       EXPECT_EQ(GURL("http://abc.com"), form.action);
@@ -912,7 +922,8 @@
     FormFieldData field2;
     EXPECT_TRUE(
         FindFormAndFieldForFormControlElement(input_element, &form2, &field2));
-    EXPECT_EQ(GURL(web_frame->document().url()), form2.origin);
+    EXPECT_EQ(GetCanonicalOriginForDocument(web_frame->document()),
+              form2.origin);
     if (!unowned) {
       EXPECT_TRUE(form2.name.empty());
       EXPECT_EQ(GURL("http://abc.com"), form2.action);
@@ -957,7 +968,8 @@
     FormFieldData field;
     EXPECT_TRUE(
         FindFormAndFieldForFormControlElement(input_element, &form, &field));
-    EXPECT_EQ(GURL(web_frame->document().url()), form.origin);
+    EXPECT_EQ(GetCanonicalOriginForDocument(web_frame->document()),
+              form.origin);
     if (!unowned) {
       EXPECT_EQ(ASCIIToUTF16("TestForm"), form.name);
       EXPECT_EQ(GURL("http://buh.com"), form.action);
@@ -1004,7 +1016,8 @@
     FormFieldData field2;
     EXPECT_TRUE(
         FindFormAndFieldForFormControlElement(input_element, &form2, &field2));
-    EXPECT_EQ(GURL(web_frame->document().url()), form2.origin);
+    EXPECT_EQ(GetCanonicalOriginForDocument(web_frame->document()),
+              form2.origin);
     if (!unowned) {
       EXPECT_EQ(ASCIIToUTF16("TestForm"), form2.name);
       EXPECT_EQ(GURL("http://buh.com"), form2.action);
@@ -1067,7 +1080,8 @@
     FormFieldData field;
     EXPECT_TRUE(
         FindFormAndFieldForFormControlElement(firstname, &form, &field));
-    EXPECT_EQ(GURL(web_frame->document().url()), form.origin);
+    EXPECT_EQ(GetCanonicalOriginForDocument(web_frame->document()),
+              form.origin);
     EXPECT_FALSE(form.origin.is_empty());
     if (!unowned) {
       EXPECT_EQ(ASCIIToUTF16("TestForm"), form.name);
@@ -1167,7 +1181,8 @@
     FormFieldData field;
     EXPECT_TRUE(
         FindFormAndFieldForFormControlElement(firstname, &form, &field));
-    EXPECT_EQ(GURL(web_frame->document().url()), form.origin);
+    EXPECT_EQ(GetCanonicalOriginForDocument(web_frame->document()),
+              form.origin);
     EXPECT_FALSE(form.origin.is_empty());
     if (!unowned) {
       EXPECT_EQ(ASCIIToUTF16("TestForm"), form.name);
@@ -1987,7 +2002,7 @@
                                        &form,
                                        &field));
   EXPECT_EQ(ASCIIToUTF16("TestForm"), form.name);
-  EXPECT_EQ(GURL(frame->document().url()), form.origin);
+  EXPECT_EQ(GetCanonicalOriginForDocument(frame->document()), form.origin);
   EXPECT_FALSE(form.origin.is_empty());
   EXPECT_EQ(GURL("http://cnn.com"), form.action);
 
@@ -2185,7 +2200,8 @@
   // First form.
   const FormData& form = forms[0];
   EXPECT_EQ(ASCIIToUTF16("TestForm"), form.name);
-  EXPECT_EQ(GURL(web_frame->document().url()), form.origin);
+  EXPECT_EQ(GetCanonicalOriginForDocument(web_frame->document()),
+            form.origin);
   EXPECT_FALSE(form.origin.is_empty());
   EXPECT_EQ(GURL("http://cnn.com"), form.action);
 
@@ -2214,7 +2230,8 @@
   // Second form.
   const FormData& form2 = forms[1];
   EXPECT_EQ(ASCIIToUTF16("TestForm2"), form2.name);
-  EXPECT_EQ(GURL(web_frame->document().url()), form2.origin);
+  EXPECT_EQ(GetCanonicalOriginForDocument(web_frame->document()),
+            form2.origin);
   EXPECT_FALSE(form.origin.is_empty());
   EXPECT_EQ(GURL("http://zoo.com"), form2.action);
 
@@ -3655,7 +3672,7 @@
                                        &form,
                                        nullptr));
   EXPECT_EQ(ASCIIToUTF16("TestForm"), form.name);
-  EXPECT_EQ(GURL(frame->document().url()), form.origin);
+  EXPECT_EQ(GetCanonicalOriginForDocument(frame->document()), form.origin);
   EXPECT_FALSE(form.origin.is_empty());
   EXPECT_EQ(GURL("http://cnn.com"), form.action);
 
@@ -3714,7 +3731,7 @@
                                        &form,
                                        nullptr));
   EXPECT_EQ(ASCIIToUTF16("TestForm"), form.name);
-  EXPECT_EQ(GURL(frame->document().url()), form.origin);
+  EXPECT_EQ(GetCanonicalOriginForDocument(frame->document()), form.origin);
   EXPECT_EQ(GURL("http://cnn.com"), form.action);
 
   const std::vector<FormFieldData>& fields = form.fields;
@@ -4034,7 +4051,7 @@
       static_cast<ExtractMask>(EXTRACT_VALUE | EXTRACT_OPTION_TEXT), &form,
       nullptr));
   EXPECT_EQ(ASCIIToUTF16("TestForm"), form.name);
-  EXPECT_EQ(GURL(frame->document().url()), form.origin);
+  EXPECT_EQ(GetCanonicalOriginForDocument(frame->document()), form.origin);
   EXPECT_EQ(GURL("http://cnn.com"), form.action);
 
   const std::vector<FormFieldData>& fields = form.fields;
@@ -4071,7 +4088,7 @@
                                        &form,
                                        nullptr));
   EXPECT_EQ(ASCIIToUTF16("TestForm"), form.name);
-  EXPECT_EQ(GURL(frame->document().url()), form.origin);
+  EXPECT_EQ(GetCanonicalOriginForDocument(frame->document()), form.origin);
   EXPECT_EQ(GURL("http://cnn.com"), form.action);
 
   ASSERT_EQ(3U, fields.size());
diff --git a/chrome/renderer/spellchecker/spellcheck_unittest.cc b/chrome/renderer/spellchecker/spellcheck_unittest.cc
index 2b6e2b9..3beb7bb 100644
--- a/chrome/renderer/spellchecker/spellcheck_unittest.cc
+++ b/chrome/renderer/spellchecker/spellcheck_unittest.cc
@@ -75,7 +75,7 @@
     spell_check_->languages_.push_back(new SpellcheckLanguage());
     spell_check_->languages_.front()->platform_spelling_engine_.reset(
         new HunspellEngine);
-    spell_check_->languages_.front()->Init(file.Pass(), language);
+    spell_check_->languages_.front()->Init(std::move(file), language);
 #else
     spell_check_->AddSpellcheckLanguage(std::move(file), language);
 #endif
diff --git a/chrome/test/data/password/password_push_state.html b/chrome/test/data/password/password_push_state.html
index a8f107f..18e57e36 100644
--- a/chrome/test/data/password/password_push_state.html
+++ b/chrome/test/data/password/password_push_state.html
@@ -3,6 +3,7 @@
 <script>
 
 var should_delete_testform = true;
+var add_parameters_to_target_url = false;
 
 function handleSubmitFormEvent(e) {
     e.preventDefault();
@@ -10,7 +11,10 @@
       var form_element = e.currentTarget;
       form_element.parentNode.removeChild(form_element);
     }
-    history.pushState({}, "", "password_push_state.html");
+    var target_url = "password_push_state.html";
+    if (add_parameters_to_target_url)
+      target_url += "?ref=1#a";
+    history.pushState({}, "", target_url);
 }
 
 window.onload = function() {
@@ -20,6 +24,8 @@
           .addEventListener("submit", handleSubmitFormEvent);
   document.getElementById("empty_action_login_form")
           .addEventListener("submit", handleSubmitFormEvent);
+  document.getElementById("params_action_login_form")
+          .addEventListener("submit", handleSubmitFormEvent);
 }
 
 </script>
@@ -41,7 +47,7 @@
 </form>
 
 <!-- Two forms with empty actions. The password manager should distinguish the 
-login form with empty action from another forms. -->
+login form with empty action from other forms. -->
 <form action="" id="empty_action_login_form">
   <input type="text" id="ea_username_field" name="username_field">
   <input type="password" id="ea_password_field" name="password_field">
@@ -54,6 +60,22 @@
   <input type="submit" id="ea_submit_button2" name="submit_button">
 </form>
 
+<!-- Forms for testing that origin/action parameters and references are ignored
+in form comparison, i.e. we use canonical origins and actions.
+Here we also test that if an action coincides with frame url, all form data
+should be used to compare forms. -->
+<form action="password_push_state.html?ref=2#b" id="params_action_login_form">
+  <input type="text" id="pa_username_field" name="username_field">
+  <input type="password" id="pa_password_field" name="password_field">
+  <input type="submit" id="pa_submit_button" name="submit_button">
+</form>
+
+<form action="password_push_state.html?ref=1#a" id="params_action_another_form">
+  <input type="text" id="pa_username_field2" name="username_field">
+  <input type="password" id="pa_password_field2" name="password_field">
+  <input type="submit" id="pa_submit_button2" name="submit_button">
+</form>
+
 </body>
 </html>
 
diff --git a/chrome/utility/extensions/extensions_handler.cc b/chrome/utility/extensions/extensions_handler.cc
index b79a912b4..fdd6dfd 100644
--- a/chrome/utility/extensions/extensions_handler.cc
+++ b/chrome/utility/extensions/extensions_handler.cc
@@ -165,7 +165,7 @@
     const IPC::PlatformFileForTransit& iphoto_library_file) {
   iphoto::IPhotoLibraryParser parser;
   base::File file = IPC::PlatformFileForTransitToFile(iphoto_library_file);
-  bool result = parser.Parse(iapps::ReadFileAsString(file.Pass()));
+  bool result = parser.Parse(iapps::ReadFileAsString(std::move(file)));
   Send(new ChromeUtilityHostMsg_GotIPhotoLibrary(result, parser.library()));
   ReleaseProcessIfNeeded();
 }
@@ -176,7 +176,7 @@
     const IPC::PlatformFileForTransit& itunes_library_file) {
   itunes::ITunesLibraryParser parser;
   base::File file = IPC::PlatformFileForTransitToFile(itunes_library_file);
-  bool result = parser.Parse(iapps::ReadFileAsString(file.Pass()));
+  bool result = parser.Parse(iapps::ReadFileAsString(std::move(file)));
   Send(new ChromeUtilityHostMsg_GotITunesLibrary(result, parser.library()));
   ReleaseProcessIfNeeded();
 }
@@ -199,7 +199,7 @@
   files.uid_file =
       IPC::PlatformFileForTransitToFile(album_table_files.uid_file);
 
-  picasa::PicasaAlbumTableReader reader(files.Pass());
+  picasa::PicasaAlbumTableReader reader(std::move(files));
   bool parse_success = reader.Init();
   Send(new ChromeUtilityHostMsg_ParsePicasaPMPDatabase_Finished(
       parse_success, reader.albums(), reader.folders()));
diff --git a/chrome/utility/media_galleries/picasa_album_table_reader.cc b/chrome/utility/media_galleries/picasa_album_table_reader.cc
index 3a7e651..a02b03f 100644
--- a/chrome/utility/media_galleries/picasa_album_table_reader.cc
+++ b/chrome/utility/media_galleries/picasa_album_table_reader.cc
@@ -8,6 +8,7 @@
 
 #include <algorithm>
 #include <string>
+#include <utility>
 
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
@@ -29,9 +30,7 @@
 }  // namespace
 
 PicasaAlbumTableReader::PicasaAlbumTableReader(AlbumTableFiles table_files)
-    : table_files_(table_files.Pass()),
-      initialized_(false) {
-}
+    : table_files_(std::move(table_files)), initialized_(false) {}
 
 PicasaAlbumTableReader::~PicasaAlbumTableReader() {
 }
diff --git a/chrome/utility/media_galleries/picasa_album_table_reader_unittest.cc b/chrome/utility/media_galleries/picasa_album_table_reader_unittest.cc
index 80a8afae..5941a2bd 100644
--- a/chrome/utility/media_galleries/picasa_album_table_reader_unittest.cc
+++ b/chrome/utility/media_galleries/picasa_album_table_reader_unittest.cc
@@ -2,12 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "chrome/utility/media_galleries/picasa_album_table_reader.h"
+
 #include <stdint.h>
 
+#include <utility>
+
 #include "base/files/scoped_temp_dir.h"
 #include "chrome/common/media_galleries/picasa_test_util.h"
 #include "chrome/common/media_galleries/pmp_constants.h"
-#include "chrome/utility/media_galleries/picasa_album_table_reader.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace picasa {
@@ -59,7 +62,7 @@
                   filename_vector, name_vector, token_vector, uid_vector);
 
   AlbumTableFiles album_table_files(temp_dir.path());
-  PicasaAlbumTableReader reader(album_table_files.Pass());
+  PicasaAlbumTableReader reader(std::move(album_table_files));
 
   ASSERT_TRUE(reader.Init());
 
diff --git a/chrome/utility/safe_browsing/mac/dmg_iterator.cc b/chrome/utility/safe_browsing/mac/dmg_iterator.cc
index 270bef7..834e9310 100644
--- a/chrome/utility/safe_browsing/mac/dmg_iterator.cc
+++ b/chrome/utility/safe_browsing/mac/dmg_iterator.cc
@@ -28,7 +28,7 @@
   for (size_t i = 0; i < udif_.GetNumberOfPartitions(); ++i) {
     if (udif_.GetPartitionType(i) == "Apple_HFS" ||
         udif_.GetPartitionType(i) == "Apple_HFSX") {
-      partitions_.push_back(udif_.GetPartitionReadStream(i).Pass());
+      partitions_.push_back(udif_.GetPartitionReadStream(i));
     }
   }
 
diff --git a/chrome/utility/safe_browsing/mac/udif.cc b/chrome/utility/safe_browsing/mac/udif.cc
index 807a762..8e3ce0f 100644
--- a/chrome/utility/safe_browsing/mac/udif.cc
+++ b/chrome/utility/safe_browsing/mac/udif.cc
@@ -4,12 +4,13 @@
 
 #include "chrome/utility/safe_browsing/mac/udif.h"
 
-#include <bzlib.h>
 #include <CoreFoundation/CoreFoundation.h>
+#include <bzlib.h>
 #include <libkern/OSByteOrder.h>
 #include <uuid/uuid.h>
 
 #include <algorithm>
+#include <utility>
 
 #include "base/logging.h"
 #include "base/mac/foundation_util.h"
@@ -470,7 +471,7 @@
       }
     }
 
-    blocks_.push_back(block.Pass());
+    blocks_.push_back(std::move(block));
     partition_names_.push_back(partition_name);
   }
 
diff --git a/chromeos/CHROMEOS_LKGM b/chromeos/CHROMEOS_LKGM
index 5519c51a..621e21a1 100644
--- a/chromeos/CHROMEOS_LKGM
+++ b/chromeos/CHROMEOS_LKGM
@@ -1 +1 @@
-7809.0.0
\ No newline at end of file
+7821.0.0
\ No newline at end of file
diff --git a/components/autofill/content/renderer/form_autofill_util.cc b/components/autofill/content/renderer/form_autofill_util.cc
index 1655f1abc..b7bb4012 100644
--- a/components/autofill/content/renderer/form_autofill_util.cc
+++ b/components/autofill/content/renderer/form_autofill_util.cc
@@ -1133,7 +1133,7 @@
     ExtractMask extract_mask,
     FormData* form,
     FormFieldData* field) {
-  form->origin = document.url();
+  form->origin = GetCanonicalOriginForDocument(document);
   form->is_form_tag = false;
 
   return FormOrFieldsetsToFormData(nullptr, element, fieldsets,
@@ -1165,7 +1165,7 @@
                    const GURL& canonical_action,
                    const GURL& canonical_origin,
                    const FormData& form_data) {
-  const GURL frame_url = GURL(frame->document().url().string().utf8());
+  const GURL frame_origin = GetCanonicalOriginForDocument(frame->document());
   blink::WebVector<WebFormElement> forms;
   frame->document().forms(forms);
 
@@ -1189,9 +1189,8 @@
 
     GURL iter_canonical_action = GetCanonicalActionForForm(form);
 #if !defined(OS_MACOSX) && !defined(OS_ANDROID)
-    bool form_action_is_empty = iter_canonical_action.is_empty()
-                                || iter_canonical_action == frame_url;
-
+    bool form_action_is_empty = iter_canonical_action.is_empty() ||
+                                iter_canonical_action == frame_origin;
     if (action_is_empty != form_action_is_empty)
       continue;
 
@@ -1414,7 +1413,7 @@
     return false;
 
   form->name = GetFormIdentifier(form_element);
-  form->origin = frame->document().url();
+  form->origin = GetCanonicalOriginForDocument(frame->document());
   form->action = frame->document().completeURL(form_element.action());
 
   // If the completed URL is not valid, just use the action we get from
diff --git a/components/mus/public/cpp/lib/window.cc b/components/mus/public/cpp/lib/window.cc
index aae1e20..4885537b 100644
--- a/components/mus/public/cpp/lib/window.cc
+++ b/components/mus/public/cpp/lib/window.cc
@@ -778,6 +778,7 @@
   DCHECK(relative);
   DCHECK_NE(window, relative);
   DCHECK_EQ(window->parent(), relative->parent());
+  DCHECK(window->parent());
 
   if (!AdjustStackingForTransientWindows(&window, &relative, &direction,
                                          window->stacking_target_))
diff --git a/components/mus/public/cpp/tests/window_unittest.cc b/components/mus/public/cpp/tests/window_unittest.cc
index 9df5b3f4..5b706582 100644
--- a/components/mus/public/cpp/tests/window_unittest.cc
+++ b/components/mus/public/cpp/tests/window_unittest.cc
@@ -130,8 +130,8 @@
 }
 
 namespace {
-DEFINE_WINDOW_PROPERTY_KEY(int, kIntKey, -2);
-DEFINE_WINDOW_PROPERTY_KEY(const char*, kStringKey, "squeamish");
+MUS_DEFINE_WINDOW_PROPERTY_KEY(int, kIntKey, -2);
+MUS_DEFINE_WINDOW_PROPERTY_KEY(const char*, kStringKey, "squeamish");
 }
 
 TEST_F(WindowTest, Property) {
@@ -179,7 +179,7 @@
 
 TestProperty* TestProperty::last_deleted_ = NULL;
 
-DEFINE_OWNED_WINDOW_PROPERTY_KEY(TestProperty, kOwnedKey, NULL);
+MUS_DEFINE_OWNED_WINDOW_PROPERTY_KEY(TestProperty, kOwnedKey, NULL);
 
 }  // namespace
 
diff --git a/components/mus/public/cpp/window_property.h b/components/mus/public/cpp/window_property.h
index 71f0749..d89a7b7e 100644
--- a/components/mus/public/cpp/window_property.h
+++ b/components/mus/public/cpp/window_property.h
@@ -14,31 +14,33 @@
 //
 //  #include "components/mus/public/cpp/window_property.h"
 //
-//  DECLARE_EXPORTED_WINDOW_PROPERTY_TYPE(FOO_EXPORT, MyType);
+//  MUS_DECLARE_EXPORTED_WINDOW_PROPERTY_TYPE(FOO_EXPORT, MyType);
 //  namespace foo {
 //    // Use this to define an exported property that is primitive,
 //    // or a pointer you don't want automatically deleted.
-//    DEFINE_WINDOW_PROPERTY_KEY(MyType, kMyKey, MyDefault);
+//    MUS_DEFINE_WINDOW_PROPERTY_KEY(MyType, kMyKey, MyDefault);
 //
 //    // Use this to define an exported property whose value is a heap
 //    // allocated object, and has to be owned and freed by the window.
-//    DEFINE_OWNED_WINDOW_PROPERTY_KEY(gfx::Rect, kRestoreBoundsKey, nullptr);
+//    MUS_DEFINE_OWNED_WINDOW_PROPERTY_KEY(gfx::Rect, kRestoreBoundsKey,
+//        nullptr);
 //
 //    // Use this to define a non exported property that is primitive,
 //    // or a pointer you don't want to automatically deleted, and is used
 //    // only in a specific file. This will define the property in an unnamed
 //    // namespace which cannot be accessed from another file.
-//    DEFINE_LOCAL_WINDOW_PROPERTY_KEY(MyType, kMyKey, MyDefault);
+//    MUS_DEFINE_LOCAL_WINDOW_PROPERTY_KEY(MyType, kMyKey, MyDefault);
 //
 //  }  // foo namespace
 //
 // To define a new type used for WindowProperty.
 //
 //  // outside all namespaces:
-//  DECLARE_EXPORTED_WINDOW_PROPERTY_TYPE(FOO_EXPORT, MyType)
+//  MUS_DECLARE_EXPORTED_WINDOW_PROPERTY_TYPE(FOO_EXPORT, MyType)
 //
-// If a property type is not exported, use DECLARE_WINDOW_PROPERTY_TYPE(MyType)
-// which is a shorthand for DECLARE_EXPORTED_WINDOW_PROPERTY_TYPE(, MyType).
+// If a property type is not exported, use
+// MUS_DECLARE_WINDOW_PROPERTY_TYPE(MyType) which is a shorthand for
+// MUS_DECLARE_EXPORTED_WINDOW_PROPERTY_TYPE(, MyType).
 
 namespace mus {
 
@@ -118,17 +120,17 @@
 }  // namespace mus
 
 // Macros to instantiate the property getter/setter template functions.
-#define DECLARE_EXPORTED_WINDOW_PROPERTY_TYPE(EXPORT, T) \
-  template EXPORT void mus::Window::SetLocalProperty(    \
-      const mus::WindowProperty<T>*, T);                 \
-  template EXPORT T mus::Window::GetLocalProperty(       \
-      const mus::WindowProperty<T>*) const;              \
-  template EXPORT void mus::Window::ClearLocalProperty(  \
+#define MUS_DECLARE_EXPORTED_WINDOW_PROPERTY_TYPE(EXPORT, T) \
+  template EXPORT void mus::Window::SetLocalProperty(        \
+      const mus::WindowProperty<T>*, T);                     \
+  template EXPORT T mus::Window::GetLocalProperty(           \
+      const mus::WindowProperty<T>*) const;                  \
+  template EXPORT void mus::Window::ClearLocalProperty(      \
       const mus::WindowProperty<T>*);
-#define DECLARE_WINDOW_PROPERTY_TYPE(T) \
-  DECLARE_EXPORTED_WINDOW_PROPERTY_TYPE(, T)
+#define MUS_DECLARE_WINDOW_PROPERTY_TYPE(T) \
+  MUS_DECLARE_EXPORTED_WINDOW_PROPERTY_TYPE(, T)
 
-#define DEFINE_WINDOW_PROPERTY_KEY(TYPE, NAME, DEFAULT)                     \
+#define MUS_DEFINE_WINDOW_PROPERTY_KEY(TYPE, NAME, DEFAULT)                 \
   static_assert(sizeof(TYPE) <= sizeof(int64_t),                            \
                 "Property type must fit in 64 bits");                       \
   namespace {                                                               \
@@ -136,7 +138,7 @@
   }                                                                         \
   const mus::WindowProperty<TYPE>* const NAME = &NAME##_Value;
 
-#define DEFINE_LOCAL_WINDOW_PROPERTY_KEY(TYPE, NAME, DEFAULT)               \
+#define MUS_DEFINE_LOCAL_WINDOW_PROPERTY_KEY(TYPE, NAME, DEFAULT)           \
   static_assert(sizeof(TYPE) <= sizeof(int64_t),                            \
                 "Property type must fit in 64 bits");                       \
   namespace {                                                               \
@@ -144,7 +146,7 @@
   const mus::WindowProperty<TYPE>* const NAME = &NAME##_Value;              \
   }
 
-#define DEFINE_OWNED_WINDOW_PROPERTY_KEY(TYPE, NAME, DEFAULT)           \
+#define MUS_DEFINE_OWNED_WINDOW_PROPERTY_KEY(TYPE, NAME, DEFAULT)       \
   namespace {                                                           \
   void Deallocator##NAME(int64_t p) {                                   \
     enum { type_must_be_complete = sizeof(TYPE) };                      \
diff --git a/components/mus/ws/default_access_policy.cc b/components/mus/ws/default_access_policy.cc
index fb012f82..8948462 100644
--- a/components/mus/ws/default_access_policy.cc
+++ b/components/mus/ws/default_access_policy.cc
@@ -37,18 +37,18 @@
 bool DefaultAccessPolicy::CanAddTransientWindow(
     const ServerWindow* parent,
     const ServerWindow* child) const {
-  return WasCreatedByThisConnection(child) &&
+  return (delegate_->HasRootForAccessPolicy(child) ||
+          WasCreatedByThisConnection(child)) &&
          (delegate_->HasRootForAccessPolicy(parent) ||
           WasCreatedByThisConnection(parent));
 }
 
 bool DefaultAccessPolicy::CanRemoveTransientWindowFromParent(
     const ServerWindow* window) const {
-  if (!WasCreatedByThisConnection(window))
-    return false;  // Can only unparent windows we created.
-
-  return delegate_->HasRootForAccessPolicy(window->transient_parent()) ||
-         WasCreatedByThisConnection(window->transient_parent());
+  return (delegate_->HasRootForAccessPolicy(window) ||
+          WasCreatedByThisConnection(window)) &&
+         (delegate_->HasRootForAccessPolicy(window->transient_parent()) ||
+          WasCreatedByThisConnection(window->transient_parent()));
 }
 
 bool DefaultAccessPolicy::CanReorderWindow(
diff --git a/components/mus/ws/window_tree_impl.cc b/components/mus/ws/window_tree_impl.cc
index 80690ca..71532ce 100644
--- a/components/mus/ws/window_tree_impl.cc
+++ b/components/mus/ws/window_tree_impl.cc
@@ -409,11 +409,18 @@
                                           const ServerWindow* relative_window,
                                           mojom::OrderDirection direction,
                                           bool originated_change) {
+  DCHECK_EQ(window->parent(), relative_window->parent());
   if (originated_change || !IsWindowKnown(window) ||
       !IsWindowKnown(relative_window) ||
       connection_manager_->DidConnectionMessageClient(id_))
     return;
 
+  // Do not notify ordering changes of the root windows, since the client
+  // doesn't know about the ancestors of the roots, and so can't do anything
+  // about this ordering change of the root.
+  if (HasRoot(window) || HasRoot(relative_window))
+    return;
+
   client_->OnWindowReordered(MapWindowIdToClient(window),
                              MapWindowIdToClient(relative_window), direction);
   connection_manager_->OnConnectionMessagedClient(id_);
diff --git a/components/password_manager/core/browser/password_manager_unittest.cc b/components/password_manager/core/browser/password_manager_unittest.cc
index 31b3f6c..ae1fef1b 100644
--- a/components/password_manager/core/browser/password_manager_unittest.cc
+++ b/components/password_manager/core/browser/password_manager_unittest.cc
@@ -55,7 +55,12 @@
 class MockPasswordManagerClient : public StubPasswordManagerClient {
  public:
   MockPasswordManagerClient() {
-    ON_CALL(*this, GetStoreResultFilter()).WillByDefault(Return(&filter_));
+    EXPECT_CALL(*this, GetStoreResultFilter())
+        .Times(AnyNumber())
+        .WillRepeatedly(Return(&filter_));
+    EXPECT_CALL(*this, IsUpdatePasswordUIEnabled())
+        .Times(AnyNumber())
+        .WillRepeatedly(Return(true));
     ON_CALL(filter_, ShouldSave(_)).WillByDefault(Return(true));
   }
 
@@ -69,6 +74,7 @@
   MOCK_METHOD0(AutomaticPasswordSaveIndicator, void());
   MOCK_METHOD0(GetPrefs, PrefService*());
   MOCK_METHOD0(GetDriver, PasswordManagerDriver*());
+  MOCK_CONST_METHOD0(IsUpdatePasswordUIEnabled, bool());
   MOCK_CONST_METHOD0(GetStoreResultFilter, const CredentialsFilter*());
 
   // Workaround for scoped_ptr<> lacking a copy constructor.
@@ -163,6 +169,16 @@
     return form;
   }
 
+  PasswordForm MakeAndroidCredential() {
+    PasswordForm android_form;
+    android_form.origin = GURL("android://hash@google.com");
+    android_form.signon_realm = "android://hash@google.com";
+    android_form.username_value = ASCIIToUTF16("google");
+    android_form.password_value = ASCIIToUTF16("password");
+    android_form.is_affiliation_based_match = true;
+    return android_form;
+  }
+
   // Reproduction of the form present on twitter's login page.
   PasswordForm MakeTwitterLoginForm() {
     PasswordForm form;
@@ -1290,24 +1306,18 @@
 }
 
 TEST_F(PasswordManagerTest, AutofillingOfAffiliatedCredentials) {
-  PasswordForm form(MakeSimpleForm());
-  std::vector<PasswordForm> observed;
-  observed.push_back(form);
-
-  PasswordForm android_form;
-  android_form.origin = GURL("android://hash@google.com");
-  android_form.signon_realm = "android://hash@google.com";
-  android_form.username_value = ASCIIToUTF16("google");
-  android_form.password_value = ASCIIToUTF16("password");
-  android_form.is_affiliation_based_match = true;
+  PasswordForm android_form(MakeAndroidCredential());
+  PasswordForm observed_form(MakeSimpleForm());
+  std::vector<PasswordForm> observed_forms;
+  observed_forms.push_back(observed_form);
 
   autofill::PasswordFormFillData form_data;
   EXPECT_CALL(driver_, FillPasswordForm(_)).WillOnce(SaveArg<0>(&form_data));
   EXPECT_CALL(*store_, GetLogins(_, _, _))
       .WillOnce(WithArg<2>(InvokeConsumer(android_form)));
-  manager()->OnPasswordFormsParsed(&driver_, observed);
-  observed.clear();
-  manager()->OnPasswordFormsRendered(&driver_, observed, true);
+  manager()->OnPasswordFormsParsed(&driver_, observed_forms);
+  observed_forms.clear();
+  manager()->OnPasswordFormsRendered(&driver_, observed_forms, true);
 
   EXPECT_EQ(android_form.username_value, form_data.username_field.value);
   EXPECT_EQ(android_form.password_value, form_data.password_field.value);
@@ -1317,18 +1327,68 @@
   EXPECT_CALL(client_, IsSavingAndFillingEnabledForCurrentPage())
       .WillRepeatedly(Return(true));
 
-  PasswordForm filled_form(form);
+  PasswordForm filled_form(observed_form);
   filled_form.username_value = android_form.username_value;
   filled_form.password_value = android_form.password_value;
   OnPasswordFormSubmitted(filled_form);
 
-  observed.clear();
-  EXPECT_CALL(*store_, UpdateLogin(_));
+  PasswordForm saved_form;
+  EXPECT_CALL(*store_, UpdateLogin(_)).WillOnce(SaveArg<0>(&saved_form));
   EXPECT_CALL(client_, PromptUserToSaveOrUpdatePasswordPtr(_, _)).Times(0);
   EXPECT_CALL(*store_, AddLogin(_)).Times(0);
   EXPECT_CALL(*store_, UpdateLoginWithPrimaryKey(_, _)).Times(0);
-  manager()->OnPasswordFormsParsed(&driver_, observed);
-  manager()->OnPasswordFormsRendered(&driver_, observed, true);
+
+  observed_forms.clear();
+  manager()->OnPasswordFormsParsed(&driver_, observed_forms);
+  manager()->OnPasswordFormsRendered(&driver_, observed_forms, true);
+  EXPECT_THAT(saved_form, FormMatches(android_form));
+}
+
+// If the manager fills a credential originally saved from an affiliated Android
+// application, and the user overwrites the password, they should be prompted if
+// they want to update.  If so, the Android credential itself should be updated.
+TEST_F(PasswordManagerTest, UpdatePasswordOfAffiliatedCredential) {
+  PasswordForm android_form(MakeAndroidCredential());
+  PasswordForm observed_form(MakeSimpleForm());
+  std::vector<PasswordForm> observed_forms;
+  observed_forms.push_back(observed_form);
+
+  autofill::PasswordFormFillData form_data;
+  EXPECT_CALL(driver_, FillPasswordForm(_)).WillOnce(SaveArg<0>(&form_data));
+  EXPECT_CALL(*store_, GetLogins(_, _, _))
+      .WillOnce(WithArg<2>(InvokeConsumer(android_form)));
+  manager()->OnPasswordFormsParsed(&driver_, observed_forms);
+  observed_forms.clear();
+  manager()->OnPasswordFormsRendered(&driver_, observed_forms, true);
+
+  EXPECT_CALL(client_, IsSavingAndFillingEnabledForCurrentPage())
+      .WillRepeatedly(Return(true));
+
+  PasswordForm filled_form(observed_form);
+  filled_form.username_value = android_form.username_value;
+  filled_form.password_value = ASCIIToUTF16("new_password");
+  OnPasswordFormSubmitted(filled_form);
+
+  scoped_ptr<PasswordFormManager> form_manager_to_save;
+  EXPECT_CALL(client_,
+              PromptUserToSaveOrUpdatePasswordPtr(
+                  _, CredentialSourceType::CREDENTIAL_SOURCE_PASSWORD_MANAGER))
+      .WillOnce(WithArg<0>(SaveToScopedPtr(&form_manager_to_save)));
+
+  observed_forms.clear();
+  manager()->OnPasswordFormsParsed(&driver_, observed_forms);
+  manager()->OnPasswordFormsRendered(&driver_, observed_forms, true);
+
+  PasswordForm saved_form;
+  EXPECT_CALL(*store_, AddLogin(_)).Times(0);
+  EXPECT_CALL(*store_, UpdateLoginWithPrimaryKey(_, _)).Times(0);
+  EXPECT_CALL(*store_, UpdateLogin(_)).WillOnce(SaveArg<0>(&saved_form));
+  ASSERT_TRUE(form_manager_to_save);
+  form_manager_to_save->Save();
+
+  PasswordForm expected_form(android_form);
+  expected_form.password_value = filled_form.password_value;
+  EXPECT_THAT(saved_form, FormMatches(expected_form));
 }
 
 }  // namespace password_manager
diff --git a/components/policy/core/common/mac_util.cc b/components/policy/core/common/mac_util.cc
index eb397789..f5b4cebc 100644
--- a/components/policy/core/common/mac_util.cc
+++ b/components/policy/core/common/mac_util.cc
@@ -5,6 +5,7 @@
 #include "components/policy/core/common/mac_util.h"
 
 #include <string>
+#include <utility>
 
 #include "base/mac/foundation_util.h"
 #include "base/strings/sys_string_conversions.h"
@@ -77,7 +78,7 @@
   if (CFDictionaryRef dict = CFCast<CFDictionaryRef>(property)) {
     scoped_ptr<base::DictionaryValue> dict_value(new base::DictionaryValue());
     CFDictionaryApplyFunction(dict, DictionaryEntryToValue, dict_value.get());
-    return dict_value.Pass();
+    return std::move(dict_value);
   }
 
   if (CFArrayRef array = CFCast<CFArrayRef>(property)) {
@@ -86,7 +87,7 @@
                          CFRangeMake(0, CFArrayGetCount(array)),
                          ArrayEntryToValue,
                          list_value.get());
-    return list_value.Pass();
+    return std::move(list_value);
   }
 
   return nullptr;
diff --git a/components/policy/core/common/policy_loader_mac.mm b/components/policy/core/common/policy_loader_mac.mm
index 8546764..0a2be3e 100644
--- a/components/policy/core/common/policy_loader_mac.mm
+++ b/components/policy/core/common/policy_loader_mac.mm
@@ -100,7 +100,7 @@
   // Load policy for the registered components.
   LoadPolicyForDomain(POLICY_DOMAIN_EXTENSIONS, "extensions", bundle.get());
 
-  return bundle.Pass();
+  return bundle;
 }
 
 base::Time PolicyLoaderMac::LastModificationTime() {
diff --git a/components/policy/core/common/policy_loader_mac_unittest.cc b/components/policy/core/common/policy_loader_mac_unittest.cc
index 3ab7394..9f51e05f 100644
--- a/components/policy/core/common/policy_loader_mac_unittest.cc
+++ b/components/policy/core/common/policy_loader_mac_unittest.cc
@@ -2,8 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "components/policy/core/common/policy_loader_mac.h"
+
 #include <CoreFoundation/CoreFoundation.h>
 
+#include <utility>
+
 #include "base/callback.h"
 #include "base/files/file_path.h"
 #include "base/mac/scoped_cftyperef.h"
@@ -14,7 +18,6 @@
 #include "components/policy/core/common/configuration_policy_provider_test.h"
 #include "components/policy/core/common/external_data_fetcher.h"
 #include "components/policy/core/common/policy_bundle.h"
-#include "components/policy/core/common/policy_loader_mac.h"
 #include "components/policy/core/common/policy_map.h"
 #include "components/policy/core/common/policy_test_utils.h"
 #include "components/policy/core/common/policy_types.h"
@@ -73,7 +76,7 @@
   prefs_ = new MockPreferences();
   scoped_ptr<AsyncPolicyLoader> loader(
       new PolicyLoaderMac(task_runner, base::FilePath(), prefs_));
-  return new AsyncPolicyProvider(registry, loader.Pass());
+  return new AsyncPolicyProvider(registry, std::move(loader));
 }
 
 void TestHarness::InstallEmptyPolicy() {}
@@ -144,7 +147,8 @@
     PolicyTestBase::SetUp();
     scoped_ptr<AsyncPolicyLoader> loader(
         new PolicyLoaderMac(loop_.task_runner(), base::FilePath(), prefs_));
-    provider_.reset(new AsyncPolicyProvider(&schema_registry_, loader.Pass()));
+    provider_.reset(
+        new AsyncPolicyProvider(&schema_registry_, std::move(loader)));
     provider_->Init(&schema_registry_);
   }
 
diff --git a/components/sync_driver/generic_change_processor.cc b/components/sync_driver/generic_change_processor.cc
index 9c6b862..2df9820 100644
--- a/components/sync_driver/generic_change_processor.cc
+++ b/components/sync_driver/generic_change_processor.cc
@@ -154,8 +154,7 @@
         specifics->mutable_password()->mutable_client_only_encrypted_data()->
             CopyFrom(it->extra->unencrypted());
       }
-      const syncer::AttachmentIdList empty_list_of_attachment_ids =
-          syncer::AttachmentIdList();
+      const syncer::AttachmentIdList empty_list_of_attachment_ids;
       syncer_changes_.push_back(syncer::SyncChange(
           FROM_HERE, syncer::SyncChange::ACTION_DELETE,
           syncer::SyncData::CreateRemoteData(
diff --git a/components/toolbar.gypi b/components/toolbar.gypi
index 77dc0390..4a94c60 100644
--- a/components/toolbar.gypi
+++ b/components/toolbar.gypi
@@ -11,6 +11,7 @@
       'dependencies': [
         '../base/base.gyp:base',
         '../url/url.gyp:url_lib',
+        'security_state',
       ],
       'include_dirs': [
         '..',
diff --git a/components/toolbar/BUILD.gn b/components/toolbar/BUILD.gn
index e5401b1..098f41de 100644
--- a/components/toolbar/BUILD.gn
+++ b/components/toolbar/BUILD.gn
@@ -10,6 +10,7 @@
 
   deps = [
     "//base",
+    "//components/security_state",
     "//url",
   ]
 }
diff --git a/components/toolbar/DEPS b/components/toolbar/DEPS
new file mode 100644
index 0000000..668e2b8
--- /dev/null
+++ b/components/toolbar/DEPS
@@ -0,0 +1,3 @@
+include_rules = [
+  "+components/security_state",
+]
diff --git a/components/toolbar/toolbar_model.h b/components/toolbar/toolbar_model.h
index 0a12208b..d0aee6b 100644
--- a/components/toolbar/toolbar_model.h
+++ b/components/toolbar/toolbar_model.h
@@ -11,6 +11,7 @@
 
 #include "base/macros.h"
 #include "base/strings/string16.h"
+#include "components/security_state/security_state_model.h"
 #include "url/gurl.h"
 
 namespace gfx {
@@ -60,6 +61,13 @@
   // in progress in the omnibox.
   virtual bool WouldPerformSearchTermReplacement(bool ignore_editing) const = 0;
 
+  // Returns the security level that the toolbar should display.  If
+  // |ignore_editing| is true, the result reflects the underlying state of the
+  // page without regard to any user edits that may be in progress in the
+  // omnibox.
+  virtual security_state::SecurityStateModel::SecurityLevel GetSecurityLevel(
+      bool ignore_editing) const = 0;
+
   // Returns true if a call to GetText() would return something other than the
   // URL because of search term replacement.
   bool WouldReplaceURL() const;
diff --git a/components/web_view/frame.cc b/components/web_view/frame.cc
index 877a53f..62dca5a 100644
--- a/components/web_view/frame.cc
+++ b/components/web_view/frame.cc
@@ -25,12 +25,12 @@
 
 using mus::Window;
 
-DECLARE_WINDOW_PROPERTY_TYPE(web_view::Frame*);
+MUS_DECLARE_WINDOW_PROPERTY_TYPE(web_view::Frame*);
 
 namespace web_view {
 
 // Used to find the Frame associated with a Window.
-DEFINE_LOCAL_WINDOW_PROPERTY_KEY(Frame*, kFrame, nullptr);
+MUS_DEFINE_LOCAL_WINDOW_PROPERTY_KEY(Frame*, kFrame, nullptr);
 
 namespace {
 
diff --git a/components/wifi/network_properties.cc b/components/wifi/network_properties.cc
index 4e12aae..91aa5758 100644
--- a/components/wifi/network_properties.cc
+++ b/components/wifi/network_properties.cc
@@ -59,7 +59,7 @@
   }
   value->Set(onc::network_type::kWiFi, wifi.release());
 
-  return value.Pass();
+  return value;
 }
 
 bool NetworkProperties::UpdateFromValue(const base::DictionaryValue& value) {
diff --git a/components/wifi/wifi_test.cc b/components/wifi/wifi_test.cc
index d99ee86..30014aff 100644
--- a/components/wifi/wifi_test.cc
+++ b/components/wifi/wifi_test.cc
@@ -3,7 +3,9 @@
 // found in the LICENSE file.
 
 #include <stdio.h>
+
 #include <string>
+#include <utility>
 
 #include "base/at_exit.h"
 #include "base/bind.h"
@@ -177,8 +179,8 @@
       std::string new_network_guid;
       properties->SetString("WiFi.SSID", network_guid);
       VLOG(0) << "Creating Network: " << *properties;
-      wifi_service_->CreateNetwork(
-          false, properties.Pass(), &new_network_guid, &error);
+      wifi_service_->CreateNetwork(false, std::move(properties),
+                                   &new_network_guid, &error);
       VLOG(0) << error << ":\n" << new_network_guid;
       return true;
     }
@@ -189,7 +191,8 @@
       std::string error;
       if (!properties->empty()) {
         VLOG(0) << "Using connect properties: " << *properties;
-        wifi_service_->SetProperties(network_guid, properties.Pass(), &error);
+        wifi_service_->SetProperties(network_guid, std::move(properties),
+                                     &error);
       }
 
       wifi_service_->SetEventObservers(
diff --git a/content/browser/accessibility/accessibility_tree_formatter_mac.mm b/content/browser/accessibility/accessibility_tree_formatter_mac.mm
index 88f7978..0721a9e 100644
--- a/content/browser/accessibility/accessibility_tree_formatter_mac.mm
+++ b/content/browser/accessibility/accessibility_tree_formatter_mac.mm
@@ -57,7 +57,7 @@
                        static_cast<int>(node_position.x - root_left));
   position->SetInteger(kYCoordDictAttr,
       static_cast<int>(-node_position.y - node_size.height - root_top));
-  return position.Pass();
+  return position;
 }
 
 scoped_ptr<base::DictionaryValue>
@@ -66,14 +66,14 @@
   NSSize node_size = [[cocoa_node size] sizeValue];
   size->SetInteger(kHeightDictAttr, static_cast<int>(node_size.height));
   size->SetInteger(kWidthDictAttr, static_cast<int>(node_size.width));
-  return size.Pass();
+  return size;
 }
 
 scoped_ptr<base::DictionaryValue> PopulateRange(NSRange range) {
   scoped_ptr<base::DictionaryValue> rangeDict(new base::DictionaryValue);
   rangeDict->SetInteger(kRangeLocDictAttr, static_cast<int>(range.location));
   rangeDict->SetInteger(kRangeLenDictAttr, static_cast<int>(range.length));
-  return rangeDict.Pass();
+  return rangeDict;
 }
 
 // Returns true if |value| is an NSValue containing a NSRange.
@@ -89,7 +89,7 @@
   scoped_ptr<base::ListValue> list(new base::ListValue);
   for (NSUInteger i = 0; i < [array count]; i++)
     list->Append(PopulateObject([array objectAtIndex:i]).release());
-  return list.Pass();
+  return list;
 }
 
 scoped_ptr<base::StringValue> StringForBrowserAccessibility(
@@ -123,7 +123,7 @@
 
   NSString* result = [tokens componentsJoinedByString:@" "];
   return scoped_ptr<base::StringValue>(
-      new base::StringValue(SysNSStringToUTF16(result))).Pass();
+      new base::StringValue(SysNSStringToUTF16(result)));
 }
 
 scoped_ptr<base::Value> PopulateObject(id value) {
@@ -138,9 +138,8 @@
         (BrowserAccessibilityCocoa*) value));
   }
 
-  return scoped_ptr<base::Value>(
-      new base::StringValue(
-          SysNSStringToUTF16([NSString stringWithFormat:@"%@", value]))).Pass();
+  return scoped_ptr<base::Value>(new base::StringValue(
+      SysNSStringToUTF16([NSString stringWithFormat:@"%@", value])));
 }
 
 NSArray* BuildAllAttributesArray() {
diff --git a/content/browser/child_process_launcher.cc b/content/browser/child_process_launcher.cc
index 40d78e0..57a6368 100644
--- a/content/browser/child_process_launcher.cc
+++ b/content/browser/child_process_launcher.cc
@@ -248,8 +248,7 @@
       BootstrapSandboxManager* sandbox_manager =
           BootstrapSandboxManager::GetInstance();
       if (sandbox_manager->EnabledForSandbox(sandbox_type)) {
-        pre_exec_delegate =
-            sandbox_manager->sandbox()->NewClient(sandbox_type).Pass();
+        pre_exec_delegate = sandbox_manager->sandbox()->NewClient(sandbox_type);
       }
     }
     options.pre_exec_delegate = pre_exec_delegate.get();
diff --git a/content/browser/compositor/browser_compositor_view_mac.mm b/content/browser/compositor/browser_compositor_view_mac.mm
index d4104d2..4670ed02 100644
--- a/content/browser/compositor/browser_compositor_view_mac.mm
+++ b/content/browser/compositor/browser_compositor_view_mac.mm
@@ -6,6 +6,8 @@
 
 #include <stdint.h>
 
+#include <utility>
+
 #include "base/lazy_instance.h"
 #include "base/trace_event/trace_event.h"
 #include "content/browser/compositor/image_transport_factory.h"
@@ -76,8 +78,8 @@
 scoped_ptr<BrowserCompositorMac> BrowserCompositorMac::Create() {
   DCHECK(ui::WindowResizeHelperMac::Get()->task_runner());
   if (g_recyclable_browser_compositor.Get())
-    return g_recyclable_browser_compositor.Get().Pass();
-  return scoped_ptr<BrowserCompositorMac>(new BrowserCompositorMac).Pass();
+    return std::move(g_recyclable_browser_compositor.Get());
+  return scoped_ptr<BrowserCompositorMac>(new BrowserCompositorMac);
 }
 
 // static
diff --git a/content/browser/device_sensors/ambient_light_mac.cc b/content/browser/device_sensors/ambient_light_mac.cc
index 187f6a06..6f8d3d9 100644
--- a/content/browser/device_sensors/ambient_light_mac.cc
+++ b/content/browser/device_sensors/ambient_light_mac.cc
@@ -6,6 +6,8 @@
 
 #include "content/browser/device_sensors/ambient_light_mac.h"
 
+#include <utility>
+
 #include "base/mac/scoped_cftyperef.h"
 #include "base/mac/scoped_ioobject.h"
 
@@ -23,7 +25,7 @@
 // static
 scoped_ptr<AmbientLightSensor> AmbientLightSensor::Create() {
   scoped_ptr<AmbientLightSensor> light_sensor(new AmbientLightSensor);
-  return light_sensor->Init() ? light_sensor.Pass() : nullptr;
+  return light_sensor->Init() ? std::move(light_sensor) : nullptr;
 }
 
 AmbientLightSensor::~AmbientLightSensor() {
diff --git a/content/browser/loader/async_resource_handler.cc b/content/browser/loader/async_resource_handler.cc
index 512ad72..df08aa7 100644
--- a/content/browser/loader/async_resource_handler.cc
+++ b/content/browser/loader/async_resource_handler.cc
@@ -16,7 +16,6 @@
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/time/time.h"
-#include "build/build_config.h"
 #include "content/browser/devtools/devtools_netlog_observer.h"
 #include "content/browser/host_zoom_map_impl.h"
 #include "content/browser/loader/resource_buffer.h"
@@ -34,10 +33,6 @@
 #include "net/log/net_log.h"
 #include "net/url_request/redirect_info.h"
 
-#if defined(OS_WIN)
-#include <windows.h>
-#endif
-
 using base::TimeDelta;
 using base::TimeTicks;
 
@@ -327,13 +322,6 @@
 
     // TODO(erikchen): Temporary debugging. http://crbug.com/527588.
     CHECK_LE(size, kBufferSize);
-#if defined(OS_WIN)
-    int handle_int = static_cast<int>(HandleToLong(handle.GetHandle()));
-    filter->Send(
-        new ResourceMsg_SetDataBufferDebug1(GetRequestID(), handle_int));
-    filter->Send(
-        new ResourceMsg_SetDataBufferDebug2(GetRequestID(), handle_int + 3));
-#endif
     filter->Send(new ResourceMsg_SetDataBuffer(
         GetRequestID(), handle, size, filter->peer_pid()));
     sent_first_data_msg_ = true;
diff --git a/content/browser/loader/async_revalidation_manager_browsertest.cc b/content/browser/loader/async_revalidation_manager_browsertest.cc
new file mode 100644
index 0000000..f799943
--- /dev/null
+++ b/content/browser/loader/async_revalidation_manager_browsertest.cc
@@ -0,0 +1,220 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <string>
+#include <utility>
+
+#include "base/bind.h"
+#include "base/bind_helpers.h"
+#include "base/command_line.h"
+#include "base/macros.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/run_loop.h"
+#include "base/strings/string16.h"
+#include "base/strings/string_piece.h"
+#include "base/strings/stringprintf.h"
+#include "base/strings/utf_string_conversions.h"
+#include "content/public/test/browser_test_utils.h"
+#include "content/public/test/content_browser_test.h"
+#include "content/public/test/content_browser_test_utils.h"
+#include "content/shell/browser/shell.h"
+#include "net/test/embedded_test_server/embedded_test_server.h"
+#include "net/test/embedded_test_server/http_request.h"
+#include "net/test/embedded_test_server/http_response.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "url/gurl.h"
+
+namespace content {
+
+namespace {
+
+using net::test_server::HttpResponse;
+using net::test_server::HttpRequest;
+using net::test_server::BasicHttpResponse;
+
+const char kCountedHtmlPath[] = "/counted.html";
+const char kCookieHtmlPath[] = "/cookie.html";
+
+class AsyncRevalidationManagerBrowserTest : public ContentBrowserTest {
+ protected:
+  AsyncRevalidationManagerBrowserTest() {}
+  ~AsyncRevalidationManagerBrowserTest() override {}
+
+  void SetUp() override {
+    ASSERT_TRUE(embedded_test_server()->InitializeAndListen());
+    ContentBrowserTest::SetUp();
+  }
+
+  void SetUpOnMainThread() override {
+    embedded_test_server()->StartAcceptingConnections();
+  }
+
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    command_line->AppendSwitch("enable-stale-while-revalidate");
+  }
+
+  base::RunLoop* run_loop() { return &run_loop_; }
+  int requests_counted() const { return requests_counted_; }
+
+  // This method lacks diagnostics for the failure case because TitleWatcher
+  // will just wait until the test times out if |expected_title| does not
+  // appear.
+  bool TitleBecomes(const GURL& url, const std::string& expected_title) {
+    base::string16 expected_title16(base::ASCIIToUTF16(expected_title));
+    TitleWatcher title_watcher(shell()->web_contents(), expected_title16);
+    NavigateToURL(shell(), url);
+    return title_watcher.WaitAndGetTitle() == expected_title16;
+  }
+
+  void RegisterCountingRequestHandler() {
+    embedded_test_server()->RegisterRequestHandler(base::Bind(
+        &AsyncRevalidationManagerBrowserTest::CountingRequestHandler, this));
+  }
+
+  void RegisterCookieRequestHandler() {
+    embedded_test_server()->RegisterRequestHandler(base::Bind(
+        &AsyncRevalidationManagerBrowserTest::CookieRequestHandler, this));
+  }
+
+ private:
+  // A request handler which increases the number in the title tag on every
+  // request.
+  scoped_ptr<HttpResponse> CountingRequestHandler(const HttpRequest& request) {
+    if (request.relative_url != kCountedHtmlPath)
+      return nullptr;
+
+    int version = ++requests_counted_;
+
+    scoped_ptr<BasicHttpResponse> http_response(StaleWhileRevalidateHeaders());
+    http_response->set_content(
+        base::StringPrintf("<title>Version %d</title>", version));
+
+    // The second time this handler is run is the async revalidation. Tests can
+    // use this for synchronisation.
+    if (version == 2)
+      run_loop_.Quit();
+    return std::move(http_response);
+  }
+
+  // A request handler which increases a cookie value on every request.
+  scoped_ptr<HttpResponse> CookieRequestHandler(const HttpRequest& request) {
+    static const char kHtml[] =
+        "<script>\n"
+        "var intervalId;\n"
+        "function checkCookie() {\n"
+        "  if (document.cookie.search(/version=2/) != -1) {\n"
+        "    clearInterval(intervalId);\n"
+        "    document.title = \"PASS\";\n"
+        "  }\n"
+        "}\n"
+        "intervalId = setInterval(checkCookie, 10);\n"
+        "</script>\n"
+        "<title>Loaded</title>\n";
+
+    if (request.relative_url != kCookieHtmlPath)
+      return nullptr;
+
+    int version = ++requests_counted_;
+
+    scoped_ptr<BasicHttpResponse> http_response(StaleWhileRevalidateHeaders());
+    http_response->AddCustomHeader("Set-Cookie",
+                                   base::StringPrintf("version=%d", version));
+    http_response->set_content(kHtml);
+
+    return std::move(http_response);
+  }
+
+  // Generate the standard response headers common to all request handlers.
+  scoped_ptr<BasicHttpResponse> StaleWhileRevalidateHeaders() {
+    scoped_ptr<BasicHttpResponse> http_response(new BasicHttpResponse);
+    http_response->set_code(net::HTTP_OK);
+    http_response->set_content_type("text/html; charset=utf-8");
+    http_response->AddCustomHeader("Cache-Control",
+                                   "max-age=0, stale-while-revalidate=86400");
+    // A validator is needed for revalidations, and hence
+    // stale-while-revalidate, to work.
+    std::string etag = base::StringPrintf(
+        "\"AsyncRevalidationManagerBrowserTest%d\"", requests_counted_);
+    http_response->AddCustomHeader("ETag", etag);
+    return http_response;
+  }
+
+  base::RunLoop run_loop_;
+  int requests_counted_ = 0;
+
+  DISALLOW_COPY_AND_ASSIGN(AsyncRevalidationManagerBrowserTest);
+};
+
+// Verify that the "Cache-Control: stale-while-revalidate" directive correctly
+// triggers an async revalidation.
+IN_PROC_BROWSER_TEST_F(AsyncRevalidationManagerBrowserTest,
+                       StaleWhileRevalidateIsApplied) {
+  RegisterCountingRequestHandler();
+  GURL url(embedded_test_server()->GetURL(kCountedHtmlPath));
+
+  EXPECT_TRUE(TitleBecomes(url, "Version 1"));
+
+  // The first request happens synchronously.
+  EXPECT_EQ(1, requests_counted());
+
+  // Force the renderer to be destroyed so that the Blink cache doesn't
+  // interfere with the result.
+  NavigateToURL(shell(), GURL("about:blank"));
+
+  // Load the page again. We should get the stale version from the cache.
+  EXPECT_TRUE(TitleBecomes(url, "Version 1"));
+
+  // Wait for the async revalidation to complete.
+  run_loop()->Run();
+  EXPECT_EQ(2, requests_counted());
+}
+
+// The fresh cache entry must become visible once the async revalidation request
+// has been sent.
+IN_PROC_BROWSER_TEST_F(AsyncRevalidationManagerBrowserTest, CacheIsUpdated) {
+  using base::ASCIIToUTF16;
+  RegisterCountingRequestHandler();
+  GURL url(embedded_test_server()->GetURL(kCountedHtmlPath));
+
+  EXPECT_TRUE(TitleBecomes(url, "Version 1"));
+
+  // Reset the renderer cache.
+  NavigateToURL(shell(), GURL("about:blank"));
+
+  // Load the page again. We should get the stale version from the cache.
+  EXPECT_TRUE(TitleBecomes(url, "Version 1"));
+
+  // Wait for the async revalidation request to be processed by the
+  // EmbeddedTestServer.
+  run_loop()->Run();
+
+  // Reset the renderer cache.
+  NavigateToURL(shell(), GURL("about:blank"));
+
+  // Since the async revalidation request has been sent, the cache can no
+  // longer return the stale contents.
+  EXPECT_TRUE(TitleBecomes(url, "Version 2"));
+}
+
+// When the asynchronous revalidation arrives, any cookies it contains must be
+// applied immediately.
+IN_PROC_BROWSER_TEST_F(AsyncRevalidationManagerBrowserTest,
+                       CookieSetAsynchronously) {
+  RegisterCookieRequestHandler();
+  GURL url(embedded_test_server()->GetURL(kCookieHtmlPath));
+
+  // Set cookie to version=1
+  NavigateToURL(shell(), url);
+
+  // Reset render cache.
+  NavigateToURL(shell(), GURL("about:blank"));
+
+  // The page will load from the cache, then when the async revalidation
+  // completes the cookie will update.
+  EXPECT_TRUE(TitleBecomes(url, "PASS"));
+}
+
+}  // namespace
+
+}  // namespace content
diff --git a/content/browser/media/midi_host.cc b/content/browser/media/midi_host.cc
index 1e6de1e2..30261ef7 100644
--- a/content/browser/media/midi_host.cc
+++ b/content/browser/media/midi_host.cc
@@ -59,10 +59,19 @@
   DCHECK(midi_manager_);
 }
 
-MidiHost::~MidiHost() {
-  // Close an open session, or abort opening a session.
-  if (is_session_requested_ && midi_manager_)
+MidiHost::~MidiHost() = default;
+
+void MidiHost::OnChannelClosing() {
+  // If we get here the MidiHost is going to be destroyed soon. Prevent any
+  // subsequent calls from MidiManager by closing our session.
+  // If Send() is called from a different thread (e.g. a separate thread owned
+  // by the MidiManager implementation), it will get posted to the IO thread.
+  // There is a race condition here if our refcount is 0 and we're about to or
+  // have already entered OnDestruct().
+  if (is_session_requested_ && midi_manager_) {
     midi_manager_->EndSession(this);
+    is_session_requested_ = false;
+  }
 }
 
 void MidiHost::OnDestruct() const {
diff --git a/content/browser/media/midi_host.h b/content/browser/media/midi_host.h
index 671bd3c..ca3706c 100644
--- a/content/browser/media/midi_host.h
+++ b/content/browser/media/midi_host.h
@@ -38,6 +38,7 @@
   MidiHost(int renderer_process_id, media::midi::MidiManager* midi_manager);
 
   // BrowserMessageFilter implementation.
+  void OnChannelClosing() override;
   void OnDestruct() const override;
   bool OnMessageReceived(const IPC::Message& message) override;
 
diff --git a/content/browser/renderer_host/render_widget_host_view_mac.mm b/content/browser/renderer_host/render_widget_host_view_mac.mm
index 3cbbb9a..ef38d30 100644
--- a/content/browser/renderer_host/render_widget_host_view_mac.mm
+++ b/content/browser/renderer_host/render_widget_host_view_mac.mm
@@ -657,7 +657,7 @@
     browser_compositor_->accelerated_widget_mac()->ResetNSView();
     browser_compositor_->compositor()->SetScaleAndSize(1.0, gfx::Size(0, 0));
     browser_compositor_->compositor()->SetRootLayer(nullptr);
-    BrowserCompositorMac::Recycle(browser_compositor_.Pass());
+    BrowserCompositorMac::Recycle(std::move(browser_compositor_));
     browser_compositor_state_ = BrowserCompositorDestroyed;
   }
 }
@@ -1250,7 +1250,7 @@
 void RenderWidgetHostViewMac::BeginFrameSubscription(
     scoped_ptr<RenderWidgetHostViewFrameSubscriber> subscriber) {
   DCHECK(delegated_frame_host_);
-  delegated_frame_host_->BeginFrameSubscription(subscriber.Pass());
+  delegated_frame_host_->BeginFrameSubscription(std::move(subscriber));
 }
 
 void RenderWidgetHostViewMac::EndFrameSubscription() {
diff --git a/content/browser/web_contents/web_drag_source_mac.mm b/content/browser/web_contents/web_drag_source_mac.mm
index 9e6443be..a94f9d3 100644
--- a/content/browser/web_contents/web_drag_source_mac.mm
+++ b/content/browser/web_contents/web_drag_source_mac.mm
@@ -6,6 +6,8 @@
 
 #include <sys/param.h>
 
+#include <utility>
+
 #include "base/bind.h"
 #include "base/files/file.h"
 #include "base/files/file_path.h"
@@ -313,14 +315,11 @@
     return nil;
 
   if (downloadURL_.is_valid() && contents_) {
-    scoped_refptr<DragDownloadFile> dragFileDownloader(new DragDownloadFile(
-        filePath,
-        file.Pass(),
-        downloadURL_,
-        content::Referrer(contents_->GetLastCommittedURL(),
-                          dropData_->referrer_policy),
-        contents_->GetEncoding(),
-        contents_));
+    scoped_refptr<DragDownloadFile> dragFileDownloader(
+        new DragDownloadFile(filePath, std::move(file), downloadURL_,
+                             content::Referrer(contents_->GetLastCommittedURL(),
+                                               dropData_->referrer_policy),
+                             contents_->GetEncoding(), contents_));
 
     // The finalizer will take care of closing and deletion.
     dragFileDownloader->Start(new PromiseFileFinalizer(
diff --git a/content/child/resource_dispatcher.cc b/content/child/resource_dispatcher.cc
index 94cfc79..bcb99b9 100644
--- a/content/child/resource_dispatcher.cc
+++ b/content/child/resource_dispatcher.cc
@@ -40,10 +40,6 @@
 #include "net/base/request_priority.h"
 #include "net/http/http_response_headers.h"
 
-#if defined(OS_WIN)
-#include <windows.h>
-#endif
-
 namespace content {
 
 namespace {
@@ -190,22 +186,6 @@
     request_info->peer->OnReceivedCachedMetadata(&data.front(), data.size());
 }
 
-#if defined(OS_WIN)
-void ResourceDispatcher::OnSetDataBufferDebug1(int request_id, int handle) {
-  PendingRequestInfo* request_info = GetPendingRequestInfo(request_id);
-  if (!request_info)
-    return;
-  request_info->handle1 = handle;
-}
-
-void ResourceDispatcher::OnSetDataBufferDebug2(int request_id, int handle) {
-  PendingRequestInfo* request_info = GetPendingRequestInfo(request_id);
-  if (!request_info)
-    return;
-  request_info->handle2 = handle - 3;
-}
-#endif
-
 void ResourceDispatcher::OnSetDataBuffer(int request_id,
                                          base::SharedMemoryHandle shm_handle,
                                          int shm_size,
@@ -217,11 +197,6 @@
 
   bool shm_valid = base::SharedMemory::IsHandleValid(shm_handle);
   CHECK((shm_valid && shm_size > 0) || (!shm_valid && !shm_size));
-#if defined(OS_WIN)
-  int handle_int = static_cast<int>(HandleToLong(shm_handle.GetHandle()));
-  CHECK(request_info->handle2 != -2 && request_info->handle2 == handle_int);
-  CHECK(request_info->handle1 != -2 && request_info->handle1 == handle_int);
-#endif
 
   request_info->buffer.reset(
       new base::SharedMemory(shm_handle, true));  // read only
@@ -561,7 +536,8 @@
       frame_origin(frame_origin),
       response_url(request_url),
       download_to_file(download_to_file),
-      request_start(base::TimeTicks::Now()) {}
+      request_start(base::TimeTicks::Now()) {
+}
 
 ResourceDispatcher::PendingRequestInfo::~PendingRequestInfo() {
   if (threaded_data_provider)
@@ -575,10 +551,6 @@
     IPC_MESSAGE_HANDLER(ResourceMsg_ReceivedCachedMetadata,
                         OnReceivedCachedMetadata)
     IPC_MESSAGE_HANDLER(ResourceMsg_ReceivedRedirect, OnReceivedRedirect)
-#if defined(OS_WIN)
-    IPC_MESSAGE_HANDLER(ResourceMsg_SetDataBufferDebug1, OnSetDataBufferDebug1)
-    IPC_MESSAGE_HANDLER(ResourceMsg_SetDataBufferDebug2, OnSetDataBufferDebug2)
-#endif
     IPC_MESSAGE_HANDLER(ResourceMsg_SetDataBuffer, OnSetDataBuffer)
     IPC_MESSAGE_HANDLER(ResourceMsg_DataReceivedDebug, OnReceivedDataDebug)
     IPC_MESSAGE_HANDLER(ResourceMsg_DataReceived, OnReceivedData)
@@ -763,10 +735,6 @@
     case ResourceMsg_ReceivedResponse::ID:
     case ResourceMsg_ReceivedCachedMetadata::ID:
     case ResourceMsg_ReceivedRedirect::ID:
-#if defined(OS_WIN)
-    case ResourceMsg_SetDataBufferDebug1::ID:
-    case ResourceMsg_SetDataBufferDebug2::ID:
-#endif
     case ResourceMsg_SetDataBuffer::ID:
     case ResourceMsg_DataReceivedDebug::ID:
     case ResourceMsg_DataReceived::ID:
diff --git a/content/child/resource_dispatcher.h b/content/child/resource_dispatcher.h
index edd5450..8f1946e 100644
--- a/content/child/resource_dispatcher.h
+++ b/content/child/resource_dispatcher.h
@@ -21,7 +21,6 @@
 #include "base/memory/weak_ptr.h"
 #include "base/single_thread_task_runner.h"
 #include "base/time/time.h"
-#include "build/build_config.h"
 #include "content/common/content_export.h"
 #include "content/public/common/resource_type.h"
 #include "ipc/ipc_listener.h"
@@ -179,12 +178,6 @@
 
     // Debugging for https://code.google.com/p/chromium/issues/detail?id=527588.
     int data_offset = -1;
-#if defined(OS_WIN)
-    // This handle is passed through Chrome IPC as a raw int.
-    int handle1 = -2;
-    // This handle is passed through Chrome IPC as a raw int + 3.
-    int handle2 = -2;
-#endif
   };
   using PendingRequestMap = std::map<int, scoped_ptr<PendingRequestInfo>>;
 
@@ -202,10 +195,6 @@
   void OnReceivedRedirect(int request_id,
                           const net::RedirectInfo& redirect_info,
                           const ResourceResponseHead& response_head);
-#if defined(OS_WIN)
-  void OnSetDataBufferDebug1(int request_id, int handle);
-  void OnSetDataBufferDebug2(int request_id, int handle);
-#endif
   void OnSetDataBuffer(int request_id,
                        base::SharedMemoryHandle shm_handle,
                        int shm_size,
diff --git a/content/child/resource_dispatcher_unittest.cc b/content/child/resource_dispatcher_unittest.cc
index f902985..aafa029c 100644
--- a/content/child/resource_dispatcher_unittest.cc
+++ b/content/child/resource_dispatcher_unittest.cc
@@ -17,7 +17,6 @@
 #include "base/process/process_handle.h"
 #include "base/run_loop.h"
 #include "base/stl_util.h"
-#include "build/build_config.h"
 #include "content/child/request_extra_data.h"
 #include "content/child/request_info.h"
 #include "content/common/appcache_interfaces.h"
@@ -299,12 +298,6 @@
     base::SharedMemoryHandle duplicate_handle;
     EXPECT_TRUE(shared_memory->ShareToProcess(base::GetCurrentProcessHandle(),
                                               &duplicate_handle));
-#if defined(OS_WIN)
-    EXPECT_TRUE(dispatcher_.OnMessageReceived(ResourceMsg_SetDataBufferDebug1(
-        request_id, HandleToLong(duplicate_handle.GetHandle()))));
-    EXPECT_TRUE(dispatcher_.OnMessageReceived(ResourceMsg_SetDataBufferDebug2(
-        request_id, HandleToLong(duplicate_handle.GetHandle()) + 3)));
-#endif
     EXPECT_TRUE(dispatcher_.OnMessageReceived(
         ResourceMsg_SetDataBuffer(request_id, duplicate_handle,
                                   shared_memory->requested_size(), 0)));
diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.cc
index 655ced6..906280cd9 100644
--- a/content/child/runtime_features.cc
+++ b/content/child/runtime_features.cc
@@ -10,6 +10,7 @@
 #include "base/feature_list.h"
 #include "base/metrics/field_trial.h"
 #include "base/strings/string_split.h"
+#include "base/strings/string_util.h"
 #include "build/build_config.h"
 #include "content/common/content_switches_internal.h"
 #include "content/public/common/content_features.h"
@@ -21,7 +22,6 @@
 #if defined(OS_ANDROID)
 #include <cpu-features.h>
 #include "base/android/build_info.h"
-#include "base/metrics/field_trial.h"
 #include "media/base/android/media_codec_util.h"
 #elif defined(OS_WIN)
 #include "base/win/windows_version.h"
@@ -207,6 +207,9 @@
   if (command_line.HasSwitch(switches::kDisablePresentationAPI))
     WebRuntimeFeatures::enablePresentationAPI(false);
 
+  if (base::FeatureList::IsEnabled(features::kWebFontsIntervention))
+    WebRuntimeFeatures::enableWebFontsIntervention(true);
+
   // Enable explicitly enabled features, and then disable explicitly disabled
   // ones.
   if (command_line.HasSwitch(switches::kEnableBlinkFeatures)) {
diff --git a/content/common/font_list_mac.mm b/content/common/font_list_mac.mm
index 64a54cd..f4a7cedd 100644
--- a/content/common/font_list_mac.mm
+++ b/content/common/font_list_mac.mm
@@ -27,7 +27,7 @@
     font_item->Append(new base::StringValue(loc_family));
     font_list->Append(font_item);
   }
-  return font_list.Pass();
+  return font_list;
 }
 
 }  // namespace content
diff --git a/content/common/gpu/child_window_surface_win.cc b/content/common/gpu/child_window_surface_win.cc
index 1208161..738caea 100644
--- a/content/common/gpu/child_window_surface_win.cc
+++ b/content/common/gpu/child_window_surface_win.cc
@@ -5,11 +5,13 @@
 #include "content/common/gpu/child_window_surface_win.h"
 
 #include "base/compiler_specific.h"
+#include "base/win/scoped_hdc.h"
 #include "base/win/wrapped_window_proc.h"
 #include "content/common/gpu/gpu_channel_manager.h"
 #include "content/common/gpu/gpu_messages.h"
 #include "ui/base/win/hidden_window.h"
 #include "ui/gfx/native_widget_types.h"
+#include "ui/gfx/win/hwnd_util.h"
 #include "ui/gl/egl_util.h"
 #include "ui/gl/gl_context.h"
 #include "ui/gl/gl_surface_egl.h"
@@ -30,15 +32,17 @@
       // Prevent windows from erasing the background.
       return 1;
     case WM_PAINT:
-      // Do not paint anything.
       PAINTSTRUCT paint;
       if (BeginPaint(window, &paint)) {
-        // DirectComposition composites with the contents under the SwapChain,
-        // so ensure that's cleared.
-        if (!IsRectEmpty(&paint.rcPaint)) {
-          FillRect(paint.hdc, &paint.rcPaint,
-                   (HBRUSH)GetStockObject(BLACK_BRUSH));
-        }
+        ChildWindowSurfaceWin* window_surface =
+            reinterpret_cast<ChildWindowSurfaceWin*>(
+                gfx::GetWindowUserData(window));
+        DCHECK(window_surface);
+
+        // Wait to clear the contents until a GL draw occurs, as otherwise an
+        // unsightly black flash may happen if the GL contents are still
+        // transparent.
+        window_surface->InvalidateWindowRect(gfx::Rect(paint.rcPaint));
         EndPaint(window, &paint);
       }
       return 0;
@@ -119,6 +123,7 @@
       WS_CHILDWINDOW | WS_DISABLED | WS_VISIBLE, 0, 0,
       windowRect.right - windowRect.left, windowRect.bottom - windowRect.top,
       ui::GetHiddenWindow(), NULL, NULL, NULL);
+  gfx::SetWindowUserData(window_, this);
   manager_->Send(new GpuHostMsg_AcceleratedSurfaceCreatedChildWindow(
       parent_window_, window_));
   return true;
@@ -168,7 +173,41 @@
   }
 }
 
+gfx::SwapResult ChildWindowSurfaceWin::SwapBuffers() {
+  gfx::SwapResult result = NativeViewGLSurfaceEGL::SwapBuffers();
+  ClearInvalidContents();
+  return result;
+}
+
+gfx::SwapResult ChildWindowSurfaceWin::PostSubBuffer(int x,
+                                                     int y,
+                                                     int width,
+                                                     int height) {
+  gfx::SwapResult result =
+      NativeViewGLSurfaceEGL::PostSubBuffer(x, y, width, height);
+  ClearInvalidContents();
+  return result;
+}
+
+void ChildWindowSurfaceWin::InvalidateWindowRect(const gfx::Rect& rect) {
+  rect_to_clear_.Union(rect);
+}
+
+void ChildWindowSurfaceWin::ClearInvalidContents() {
+  if (!rect_to_clear_.IsEmpty()) {
+    base::win::ScopedGetDC dc(window_);
+
+    RECT rect = rect_to_clear_.ToRECT();
+
+    // DirectComposition composites with the contents under the SwapChain,
+    // so ensure that's cleared. GDI treats black as transparent.
+    FillRect(dc, &rect, reinterpret_cast<HBRUSH>(GetStockObject(BLACK_BRUSH)));
+    rect_to_clear_ = gfx::Rect();
+  }
+}
+
 ChildWindowSurfaceWin::~ChildWindowSurfaceWin() {
+  gfx::SetWindowUserData(window_, nullptr);
   DestroyWindow(window_);
 }
 
diff --git a/content/common/gpu/child_window_surface_win.h b/content/common/gpu/child_window_surface_win.h
index 7e8dfafa..83acd88a 100644
--- a/content/common/gpu/child_window_surface_win.h
+++ b/content/common/gpu/child_window_surface_win.h
@@ -22,13 +22,20 @@
               float scale_factor,
               bool has_alpha) override;
   bool InitializeNativeWindow() override;
+  gfx::SwapResult SwapBuffers() override;
+  gfx::SwapResult PostSubBuffer(int x, int y, int width, int height) override;
+
+  void InvalidateWindowRect(const gfx::Rect& rect);
 
  protected:
   ~ChildWindowSurfaceWin() override;
 
  private:
+  void ClearInvalidContents();
+
   HWND parent_window_;
   GpuChannelManager* manager_;
+  gfx::Rect rect_to_clear_;
 
   DISALLOW_COPY_AND_ASSIGN(ChildWindowSurfaceWin);
 };
diff --git a/content/common/resource_messages.h b/content/common/resource_messages.h
index 918afc1..cc0b3d0 100644
--- a/content/common/resource_messages.h
+++ b/content/common/resource_messages.h
@@ -12,7 +12,6 @@
 
 #include "base/memory/shared_memory.h"
 #include "base/process/process.h"
-#include "build/build_config.h"
 #include "content/common/content_param_traits_macros.h"
 #include "content/common/navigation_params.h"
 #include "content/common/resource_request_body.h"
@@ -334,22 +333,6 @@
                      net::RedirectInfo /* redirect_info */,
                      content::ResourceResponseHead)
 
-#if defined(OS_WIN)
-// A message that always precedes ResourceMsg_SetDataBuffer. |shm_handle| is the
-// underlying HANDLE of base::SharedMemoryHandle converted to an int. Exists to
-// help debug https://code.google.com/p/chromium/issues/detail?id=527588.
-IPC_MESSAGE_CONTROL2(ResourceMsg_SetDataBufferDebug1,
-                     int /* request_id */,
-                     int /* shm_handle */)
-
-// A message that always precedes ResourceMsg_SetDataBuffer. |shm_handle| is the
-// underlying HANDLE of base::SharedMemoryHandle converted to an int + 3. Exists
-// to help debug https://code.google.com/p/chromium/issues/detail?id=527588.
-IPC_MESSAGE_CONTROL2(ResourceMsg_SetDataBufferDebug2,
-                     int /* request_id */,
-                     int /* shm_handle */)
-#endif
-
 // Sent to set the shared memory buffer to be used to transmit response data to
 // the renderer.  Subsequent DataReceived messages refer to byte ranges in the
 // shared memory buffer.  The shared memory buffer should be retained by the
@@ -360,6 +343,7 @@
 //
 // TODO(darin): The |renderer_pid| parameter is just a temporary parameter,
 // added to help in debugging crbug/160401.
+//
 IPC_MESSAGE_CONTROL4(ResourceMsg_SetDataBuffer,
                      int /* request_id */,
                      base::SharedMemoryHandle /* shm_handle */,
diff --git a/content/content_tests.gypi b/content/content_tests.gypi
index 86362712..02d726e 100644
--- a/content/content_tests.gypi
+++ b/content/content_tests.gypi
@@ -232,6 +232,7 @@
       'browser/indexed_db/mock_browsertest_indexed_db_class_factory.cc',
       'browser/indexed_db/mock_browsertest_indexed_db_class_factory.h',
       'browser/loader/async_resource_handler_browsertest.cc',
+      'browser/loader/async_revalidation_manager_browsertest.cc',
       'browser/loader/cross_site_resource_handler_browsertest.cc',
       'browser/loader/resource_dispatcher_host_browsertest.cc',
       'browser/manifest/manifest_browsertest.cc',
diff --git a/content/gpu/gpu_main.cc b/content/gpu/gpu_main.cc
index 0686c575..6ab39548 100644
--- a/content/gpu/gpu_main.cc
+++ b/content/gpu/gpu_main.cc
@@ -5,6 +5,8 @@
 #include <stddef.h>
 #include <stdlib.h>
 
+#include <utility>
+
 #include "base/lazy_instance.h"
 #include "base/message_loop/message_loop.h"
 #include "base/metrics/histogram.h"
@@ -197,7 +199,7 @@
   // This is necessary for CoreAnimation layers hosted in the GPU process to be
   // drawn. See http://crbug.com/312462.
   scoped_ptr<base::MessagePump> pump(new base::MessagePumpCFRunLoop());
-  base::MessageLoop main_message_loop(pump.Pass());
+  base::MessageLoop main_message_loop(std::move(pump));
 #else
   base::MessageLoop main_message_loop(base::MessageLoop::TYPE_IO);
 #endif
diff --git a/content/public/android/javatests/src/org/chromium/content/browser/webcontents/WebContentsTest.java b/content/public/android/javatests/src/org/chromium/content/browser/webcontents/WebContentsTest.java
index eabf0e9..607519ce 100644
--- a/content/public/android/javatests/src/org/chromium/content/browser/webcontents/WebContentsTest.java
+++ b/content/public/android/javatests/src/org/chromium/content/browser/webcontents/WebContentsTest.java
@@ -9,12 +9,13 @@
 import android.os.Parcel;
 import android.test.suitebuilder.annotation.SmallTest;
 
-import org.chromium.base.test.util.DisabledTest;
+import org.chromium.base.ThreadUtils;
 import org.chromium.content_public.browser.WebContents;
 import org.chromium.content_shell.Shell;
 import org.chromium.content_shell_apk.ContentShellActivity;
 import org.chromium.content_shell_apk.ContentShellTestBase;
 
+import java.util.concurrent.Callable;
 import java.util.concurrent.ExecutionException;
 
 /**
@@ -34,24 +35,22 @@
      * @throws InterruptedException
      * @throws ExecutionException
      */
-    /*
     @SmallTest
-    https://crbug.com/538625
-    */
-    @DisabledTest
     public void testWebContentsIsDestroyedMethod() throws InterruptedException, ExecutionException {
         final ContentShellActivity activity = launchContentShellWithUrl(TEST_URL_1);
         waitForActiveShellToBeDoneLoading();
         WebContents webContents = activity.getActiveWebContents();
 
-        assertFalse("WebContents incorrectly marked as destroyed", webContents.isDestroyed());
+        assertFalse("WebContents incorrectly marked as destroyed",
+                isWebContentsDestroyed(webContents));
 
         // Launch a new shell.
         Shell originalShell = activity.getActiveShell();
         loadNewShell(TEST_URL_1);
         assertNotSame("New shell not created", activity.getActiveShell(), originalShell);
 
-        assertTrue("WebContents incorrectly marked as not destroyed", webContents.isDestroyed());
+        assertTrue("WebContents incorrectly marked as not destroyed",
+                isWebContentsDestroyed(webContents));
     }
 
     /**
@@ -88,6 +87,7 @@
      * Check that it is possible to serialize and deserialize a WebContents object through Bundles.
      * @throws InterruptedException
      */
+    @SmallTest
     public void testWebContentsSerializeDeserializeInBundle() throws InterruptedException {
         launchContentShellWithUrl(TEST_URL_1);
         waitForActiveShellToBeDoneLoading();
@@ -126,6 +126,7 @@
      * Check that it is possible to serialize and deserialize a WebContents object through Intents.
      * @throws InterruptedException
      */
+    @SmallTest
     public void testWebContentsSerializeDeserializeInIntent() throws InterruptedException {
         launchContentShellWithUrl(TEST_URL_1);
         waitForActiveShellToBeDoneLoading();
@@ -199,11 +200,7 @@
      * @throws InterruptedException
      * @throws ExecutionException
      */
-    /*
     @SmallTest
-    https://crbug.com/538625
-    */
-    @DisabledTest
     public void testSerializingADestroyedWebContentsDoesNotDeserialize()
             throws InterruptedException, ExecutionException {
         ContentShellActivity activity = launchContentShellWithUrl(TEST_URL_1);
@@ -211,7 +208,7 @@
         WebContents webContents = activity.getActiveWebContents();
         loadNewShell(TEST_URL_1);
 
-        assertTrue("WebContents not destroyed", webContents.isDestroyed());
+        assertTrue("WebContents not destroyed", isWebContentsDestroyed(webContents));
 
         Parcel parcel = Parcel.obtain();
 
@@ -238,11 +235,7 @@
      * @throws InterruptedException
      * @throws ExecutionException
      */
-    /*
     @SmallTest
-    https://crbug.com/538625
-    */
-    @DisabledTest
     public void testDestroyingAWebContentsAfterSerializingDoesNotDeserialize()
             throws InterruptedException, ExecutionException {
         ContentShellActivity activity = launchContentShellWithUrl(TEST_URL_1);
@@ -257,7 +250,7 @@
 
             // Destroy the WebContents.
             loadNewShell(TEST_URL_1);
-            assertTrue("WebContents not destroyed", webContents.isDestroyed());
+            assertTrue("WebContents not destroyed", isWebContentsDestroyed(webContents));
 
             // Try to read back the WebContents.
             parcel.setDataPosition(0);
@@ -311,4 +304,13 @@
             parcel.recycle();
         }
     }
+
+    private boolean isWebContentsDestroyed(final WebContents webContents) {
+        return ThreadUtils.runOnUiThreadBlockingNoException(new Callable<Boolean>() {
+            @Override
+            public Boolean call() throws Exception {
+                return webContents.isDestroyed();
+            }
+        });
+    }
 }
diff --git a/content/public/common/content_features.cc b/content/public/common/content_features.cc
index d01bfa8d..c0b3a7f 100644
--- a/content/public/common/content_features.cc
+++ b/content/public/common/content_features.cc
@@ -23,6 +23,10 @@
 const base::Feature kExperimentalFramework{"ExperimentalFramework",
                                            base::FEATURE_DISABLED_BY_DEFAULT};
 
+// An experimental User Agent Intervention on WebFonts loading.
+const base::Feature kWebFontsIntervention{"WebFontsIntervention",
+                                          base::FEATURE_DISABLED_BY_DEFAULT};
+
 #if defined(OS_ANDROID)
 // FeatureList definition for the Seccomp field trial.
 const base::Feature kSeccompSandboxAndroid{"SeccompSandboxAndroid",
diff --git a/content/public/common/content_features.h b/content/public/common/content_features.h
index ad962cc..0fe8feb 100644
--- a/content/public/common/content_features.h
+++ b/content/public/common/content_features.h
@@ -19,6 +19,7 @@
 CONTENT_EXPORT extern const base::Feature kBrotliEncoding;
 CONTENT_EXPORT extern const base::Feature kDownloadResumption;
 CONTENT_EXPORT extern const base::Feature kExperimentalFramework;
+CONTENT_EXPORT extern const base::Feature kWebFontsIntervention;
 
 #if defined(OS_ANDROID)
 CONTENT_EXPORT extern const base::Feature kSeccompSandboxAndroid;
diff --git a/content/renderer/media/webrtc/media_stream_remote_audio_track.cc b/content/renderer/media/webrtc/media_stream_remote_audio_track.cc
index 179a1fd..8bb5e0a5 100644
--- a/content/renderer/media/webrtc/media_stream_remote_audio_track.cc
+++ b/content/renderer/media/webrtc/media_stream_remote_audio_track.cc
@@ -62,9 +62,10 @@
 
  private:
   void OnData(const void* audio_data, int bits_per_sample, int sample_rate,
-              int number_of_channels, size_t number_of_frames) override {
-    if (!audio_bus_ || audio_bus_->channels() != number_of_channels ||
-        audio_bus_->frames() != static_cast<int>(number_of_frames)) {
+              size_t number_of_channels, size_t number_of_frames) override {
+    if (!audio_bus_ ||
+        static_cast<size_t>(audio_bus_->channels()) != number_of_channels ||
+        static_cast<size_t>(audio_bus_->frames()) != number_of_frames) {
       audio_bus_ = media::AudioBus::Create(number_of_channels,
                                            number_of_frames);
     }
@@ -74,9 +75,9 @@
 
     bool format_changed = false;
     if (params_.format() != media::AudioParameters::AUDIO_PCM_LOW_LATENCY ||
-        params_.channels() != number_of_channels ||
+        static_cast<size_t>(params_.channels()) != number_of_channels ||
         params_.sample_rate() != sample_rate ||
-        params_.frames_per_buffer() != static_cast<int>(number_of_frames)) {
+        static_cast<size_t>(params_.frames_per_buffer()) != number_of_frames) {
       params_ = media::AudioParameters(
           media::AudioParameters::AUDIO_PCM_LOW_LATENCY,
           media::GuessChannelLayout(number_of_channels),
diff --git a/content/renderer/media/webrtc/media_stream_remote_video_source.cc b/content/renderer/media/webrtc/media_stream_remote_video_source.cc
index 1ee27ee..6eab00b3 100644
--- a/content/renderer/media/webrtc/media_stream_remote_video_source.cc
+++ b/content/renderer/media/webrtc/media_stream_remote_video_source.cc
@@ -104,10 +104,6 @@
 
     gfx::Size size(frame->GetWidth(), frame->GetHeight());
 
-    // Non-square pixels are unsupported.
-    DCHECK_EQ(frame->GetPixelWidth(), 1u);
-    DCHECK_EQ(frame->GetPixelHeight(), 1u);
-
     // Make a shallow copy. Both |frame| and |video_frame| will share a single
     // reference counted frame buffer. Const cast and hope no one will overwrite
     // the data.
diff --git a/content/renderer/media/webrtc/mock_peer_connection_dependency_factory.cc b/content/renderer/media/webrtc/mock_peer_connection_dependency_factory.cc
index 1e1d749c..d4e6116 100644
--- a/content/renderer/media/webrtc/mock_peer_connection_dependency_factory.cc
+++ b/content/renderer/media/webrtc/mock_peer_connection_dependency_factory.cc
@@ -158,18 +158,10 @@
 };
 
 MockVideoRenderer::MockVideoRenderer()
-    : width_(0),
-      height_(0),
-      num_(0) {}
+    : num_(0) {}
 
 MockVideoRenderer::~MockVideoRenderer() {}
 
-bool MockVideoRenderer::SetSize(int width, int height, int reserved) {
-  width_ = width;
-  height_ = height;
-  return true;
-}
-
 bool MockVideoRenderer::RenderFrame(const cricket::VideoFrame* frame) {
   ++num_;
   return true;
diff --git a/content/renderer/media/webrtc/mock_peer_connection_dependency_factory.h b/content/renderer/media/webrtc/mock_peer_connection_dependency_factory.h
index c3b7835..15d6bf2 100644
--- a/content/renderer/media/webrtc/mock_peer_connection_dependency_factory.h
+++ b/content/renderer/media/webrtc/mock_peer_connection_dependency_factory.h
@@ -24,16 +24,11 @@
  public:
   MockVideoRenderer();
   ~MockVideoRenderer() override;
-  bool SetSize(int width, int height, int reserved) override;
   bool RenderFrame(const cricket::VideoFrame* frame) override;
 
-  int width() const { return width_; }
-  int height() const { return height_; }
   int num() const { return num_; }
 
  private:
-  int width_;
-  int height_;
   int num_;
 };
 
diff --git a/content/renderer/media/webrtc/webrtc_local_audio_track_adapter_unittest.cc b/content/renderer/media/webrtc/webrtc_local_audio_track_adapter_unittest.cc
index 6a8f6db..e34ddb73 100644
--- a/content/renderer/media/webrtc/webrtc_local_audio_track_adapter_unittest.cc
+++ b/content/renderer/media/webrtc/webrtc_local_audio_track_adapter_unittest.cc
@@ -26,7 +26,7 @@
   MOCK_METHOD5(OnData, void(const void* audio_data,
                             int bits_per_sample,
                             int sample_rate,
-                            int number_of_channels,
+                            size_t number_of_channels,
                             size_t number_of_frames));
 };
 
diff --git a/content/renderer/pepper/content_decryptor_delegate.cc b/content/renderer/pepper/content_decryptor_delegate.cc
index 3482ded..fbead03c 100644
--- a/content/renderer/pepper/content_decryptor_delegate.cc
+++ b/content/renderer/pepper/content_decryptor_delegate.cc
@@ -1067,7 +1067,7 @@
 
   Decryptor::AudioDecodeCB audio_decode_cb = audio_decode_cb_.ResetAndReturn();
 
-  const Decryptor::AudioFrames empty_frames = Decryptor::AudioFrames();
+  const Decryptor::AudioFrames empty_frames;
 
   Decryptor::Status status =
       PpDecryptResultToMediaDecryptorStatus(sample_info->result);
@@ -1279,7 +1279,7 @@
     video_decrypt_cb_.ResetAndReturn().Run(media::Decryptor::kError, NULL);
 
   if (!audio_decode_cb_.is_null()) {
-    const media::Decryptor::AudioFrames empty_frames = Decryptor::AudioFrames();
+    const media::Decryptor::AudioFrames empty_frames;
     audio_decode_cb_.ResetAndReturn().Run(media::Decryptor::kError,
                                           empty_frames);
   }
diff --git a/content/renderer/renderer_main.cc b/content/renderer/renderer_main.cc
index 1847018ba..94f105c 100644
--- a/content/renderer/renderer_main.cc
+++ b/content/renderer/renderer_main.cc
@@ -147,7 +147,7 @@
   // http://crbug.com/306348#c24 for details.
   scoped_ptr<base::MessagePump> pump(new base::MessagePumpNSRunLoop());
   scoped_ptr<base::MessageLoop> main_message_loop(
-      new base::MessageLoop(pump.Pass()));
+      new base::MessageLoop(std::move(pump)));
 #else
   // The main message loop of the renderer services doesn't have IO or UI tasks.
   scoped_ptr<base::MessageLoop> main_message_loop(new base::MessageLoop());
@@ -206,8 +206,8 @@
     // TODO(markus): Check if it is OK to unconditionally move this
     // instruction down.
     RenderProcessImpl render_process;
-    RenderThreadImpl::Create(main_message_loop.Pass(),
-                             renderer_scheduler.Pass());
+    RenderThreadImpl::Create(std::move(main_message_loop),
+                             std::move(renderer_scheduler));
 #endif
     bool run_loop = true;
     if (!no_sandbox)
diff --git a/device/bluetooth/android/java/src/org/chromium/device/bluetooth/Wrappers.java b/device/bluetooth/android/java/src/org/chromium/device/bluetooth/Wrappers.java
index ea78782..d53e233 100644
--- a/device/bluetooth/android/java/src/org/chromium/device/bluetooth/Wrappers.java
+++ b/device/bluetooth/android/java/src/org/chromium/device/bluetooth/Wrappers.java
@@ -330,6 +330,10 @@
         boolean writeCharacteristic(BluetoothGattCharacteristicWrapper characteristic) {
             return mGatt.writeCharacteristic(characteristic.mCharacteristic);
         }
+
+        boolean writeDescriptor(BluetoothGattDescriptorWrapper descriptor) {
+            return mGatt.writeDescriptor(descriptor.mDescriptor);
+        }
     }
 
     /**
@@ -499,5 +503,13 @@
         public UUID getUuid() {
             return mDescriptor.getUuid();
         }
+
+        public byte[] getValue() {
+            return mDescriptor.getValue();
+        }
+
+        public boolean setValue(byte[] value) {
+            return mDescriptor.setValue(value);
+        }
     }
 }
diff --git a/device/bluetooth/bluetooth_l2cap_channel_mac.mm b/device/bluetooth/bluetooth_l2cap_channel_mac.mm
index 218721c..b136d27 100644
--- a/device/bluetooth/bluetooth_l2cap_channel_mac.mm
+++ b/device/bluetooth/bluetooth_l2cap_channel_mac.mm
@@ -99,7 +99,7 @@
   else
     channel.reset();
 
-  return channel.Pass();
+  return channel;
 }
 
 void BluetoothL2capChannelMac::SetSocket(BluetoothSocketMac* socket) {
diff --git a/device/bluetooth/bluetooth_rfcomm_channel_mac.mm b/device/bluetooth/bluetooth_rfcomm_channel_mac.mm
index 2b27a1c..53f2240 100644
--- a/device/bluetooth/bluetooth_rfcomm_channel_mac.mm
+++ b/device/bluetooth/bluetooth_rfcomm_channel_mac.mm
@@ -94,7 +94,7 @@
     channel.reset();
   }
 
-  return channel.Pass();
+  return channel;
 }
 
 void BluetoothRfcommChannelMac::SetSocket(BluetoothSocketMac* socket) {
diff --git a/device/bluetooth/bluetooth_socket_mac.mm b/device/bluetooth/bluetooth_socket_mac.mm
index 0157d10..c82e5d2b 100644
--- a/device/bluetooth/bluetooth_socket_mac.mm
+++ b/device/bluetooth/bluetooth_socket_mac.mm
@@ -10,6 +10,7 @@
 #include <limits>
 #include <sstream>
 #include <string>
+#include <utility>
 
 #include "base/bind.h"
 #include "base/callback.h"
@@ -648,7 +649,7 @@
   DVLOG(1) << device_address << " " << uuid_.canonical_value()
            << ": channel open complete.";
 
-  scoped_ptr<ConnectCallbacks> temp = connect_callbacks_.Pass();
+  scoped_ptr<ConnectCallbacks> temp = std::move(connect_callbacks_);
   if (status != kIOReturnSuccess) {
     ReleaseChannel();
     std::stringstream error;
@@ -724,7 +725,7 @@
 
   // If there is a pending read callback, call it now.
   if (receive_callbacks_) {
-    scoped_ptr<ReceiveCallbacks> temp = receive_callbacks_.Pass();
+    scoped_ptr<ReceiveCallbacks> temp = std::move(receive_callbacks_);
     temp->success_callback.Run(buffer->size(), buffer);
     return;
   }
@@ -834,7 +835,7 @@
   DCHECK(thread_checker_.CalledOnValidThread());
 
   if (receive_callbacks_) {
-    scoped_ptr<ReceiveCallbacks> temp = receive_callbacks_.Pass();
+    scoped_ptr<ReceiveCallbacks> temp = std::move(receive_callbacks_);
     temp->error_callback.Run(BluetoothSocket::kDisconnected,
                              kSocketNotConnected);
   }
diff --git a/device/bluetooth/test/android/java/src/org/chromium/device/bluetooth/Fakes.java b/device/bluetooth/test/android/java/src/org/chromium/device/bluetooth/Fakes.java
index f9656e9..56c950ed 100644
--- a/device/bluetooth/test/android/java/src/org/chromium/device/bluetooth/Fakes.java
+++ b/device/bluetooth/test/android/java/src/org/chromium/device/bluetooth/Fakes.java
@@ -306,6 +306,7 @@
         boolean mReadCharacteristicWillFailSynchronouslyOnce = false;
         boolean mSetCharacteristicNotificationWillFailSynchronouslyOnce = false;
         boolean mWriteCharacteristicWillFailSynchronouslyOnce = false;
+        boolean mWriteDescriptorWillFailSynchronouslyOnce = false;
 
         public FakeBluetoothGatt(FakeBluetoothDevice device) {
             super(null, null);
@@ -361,6 +362,17 @@
                     mDevice.mAdapter.mNativeBluetoothTestAndroid, characteristic.getValue());
             return true;
         }
+
+        @Override
+        boolean writeDescriptor(Wrappers.BluetoothGattDescriptorWrapper descriptor) {
+            if (mWriteDescriptorWillFailSynchronouslyOnce) {
+                mWriteDescriptorWillFailSynchronouslyOnce = false;
+                return false;
+            }
+            nativeOnFakeBluetoothGattWriteDescriptor(
+                    mDevice.mAdapter.mNativeBluetoothTestAndroid, descriptor.getValue());
+            return true;
+        }
     }
 
     /**
@@ -533,7 +545,8 @@
                             + uuidString + "' that has already been added to this characteristic.");
                 }
             }
-            fakeCharacteristic.mDescriptors.add(new FakeBluetoothGattDescriptor(uuid));
+            fakeCharacteristic.mDescriptors.add(
+                    new FakeBluetoothGattDescriptor(fakeCharacteristic, uuid));
         }
 
         // -----------------------------------------------------------------------------------------
@@ -575,11 +588,27 @@
      * Fakes android.bluetooth.BluetoothGattDescriptor.
      */
     static class FakeBluetoothGattDescriptor extends Wrappers.BluetoothGattDescriptorWrapper {
+        final FakeBluetoothGattCharacteristic mCharacteristic;
         final UUID mUuid;
+        byte[] mValue;
 
-        public FakeBluetoothGattDescriptor(UUID uuid) {
+        public FakeBluetoothGattDescriptor(
+                FakeBluetoothGattCharacteristic characteristic, UUID uuid) {
             super(null);
+            mCharacteristic = characteristic;
             mUuid = uuid;
+            mValue = new byte[0];
+        }
+
+        // Cause subsequent value write of a descriptor to fail synchronously.
+        @CalledByNative("FakeBluetoothGattDescriptor")
+        private static void setWriteDescriptorWillFailSynchronouslyOnce(
+                ChromeBluetoothRemoteGattDescriptor chromeDescriptor) {
+            FakeBluetoothGattDescriptor fakeDescriptor =
+                    (FakeBluetoothGattDescriptor) chromeDescriptor.mDescriptor;
+
+            fakeDescriptor.mCharacteristic.mService.mDevice.mGatt
+                    .mWriteDescriptorWillFailSynchronouslyOnce = true;
         }
 
         // -----------------------------------------------------------------------------------------
@@ -589,6 +618,17 @@
         public UUID getUuid() {
             return mUuid;
         }
+
+        @Override
+        public byte[] getValue() {
+            return mValue;
+        }
+
+        @Override
+        public boolean setValue(byte[] value) {
+            mValue = value;
+            return true;
+        }
     }
 
     // ---------------------------------------------------------------------------------------------
@@ -616,4 +656,8 @@
     // Binds to BluetoothTestAndroid::OnFakeBluetoothGattWriteCharacteristic.
     private static native void nativeOnFakeBluetoothGattWriteCharacteristic(
             long nativeBluetoothTestAndroid, byte[] value);
+
+    // Binds to BluetoothTestAndroid::OnFakeBluetoothGattWriteDescriptor.
+    private static native void nativeOnFakeBluetoothGattWriteDescriptor(
+            long nativeBluetoothTestAndroid, byte[] value);
 }
diff --git a/device/bluetooth/test/bluetooth_test.cc b/device/bluetooth/test/bluetooth_test.cc
index 0c4e891..5feec018 100644
--- a/device/bluetooth/test/bluetooth_test.cc
+++ b/device/bluetooth/test/bluetooth_test.cc
@@ -231,6 +231,7 @@
   gatt_notify_characteristic_attempts_ = 0;
   gatt_read_characteristic_attempts_ = 0;
   gatt_write_characteristic_attempts_ = 0;
+  gatt_write_descriptor_attempts_ = 0;
 }
 
 }  // namespace device
diff --git a/device/bluetooth/test/bluetooth_test.h b/device/bluetooth/test/bluetooth_test.h
index c0b5092..8f0bd31 100644
--- a/device/bluetooth/test/bluetooth_test.h
+++ b/device/bluetooth/test/bluetooth_test.h
@@ -176,6 +176,11 @@
       BluetoothGattCharacteristic* characteristic,
       const std::string& uuid) {}
 
+  // Simulates a Descriptor Write operation failing synchronously once for
+  // an unknown reason.
+  virtual void SimulateGattDescriptorWriteWillFailSynchronouslyOnce(
+      BluetoothGattDescriptor* descriptor) {}
+
   // Removes the device from the adapter and deletes it.
   virtual void DeleteDevice(BluetoothDevice* device);
 
@@ -232,6 +237,7 @@
   int gatt_notify_characteristic_attempts_ = 0;
   int gatt_read_characteristic_attempts_ = 0;
   int gatt_write_characteristic_attempts_ = 0;
+  int gatt_write_descriptor_attempts_ = 0;
 
   // The following values are used to make sure the correct callbacks
   // have been called. They are not reset when calling ResetEventCounts().
diff --git a/device/bluetooth/test/bluetooth_test_android.cc b/device/bluetooth/test/bluetooth_test_android.cc
index eb48b0b..3ae446f5 100644
--- a/device/bluetooth/test/bluetooth_test_android.cc
+++ b/device/bluetooth/test/bluetooth_test_android.cc
@@ -299,6 +299,15 @@
       base::android::ConvertUTF8ToJavaString(env, uuid).obj());
 }
 
+void BluetoothTestAndroid::SimulateGattDescriptorWriteWillFailSynchronouslyOnce(
+    BluetoothGattDescriptor* descriptor) {
+  BluetoothRemoteGattDescriptorAndroid* descriptor_android =
+      static_cast<BluetoothRemoteGattDescriptorAndroid*>(descriptor);
+  Java_FakeBluetoothGattDescriptor_setWriteDescriptorWillFailSynchronouslyOnce(
+      base::android::AttachCurrentThread(),
+      descriptor_android->GetJavaObject().obj());
+}
+
 void BluetoothTestAndroid::OnFakeBluetoothDeviceConnectGattCalled(
     JNIEnv* env,
     const JavaParamRef<jobject>& caller) {
@@ -337,4 +346,12 @@
   base::android::JavaByteArrayToByteVector(env, value, &last_write_value_);
 }
 
+void BluetoothTestAndroid::OnFakeBluetoothGattWriteDescriptor(
+    JNIEnv* env,
+    const JavaParamRef<jobject>& caller,
+    const JavaParamRef<jbyteArray>& value) {
+  gatt_write_descriptor_attempts_++;
+  base::android::JavaByteArrayToByteVector(env, value, &last_write_value_);
+}
+
 }  // namespace device
diff --git a/device/bluetooth/test/bluetooth_test_android.h b/device/bluetooth/test/bluetooth_test_android.h
index 290faa6..be11c4c 100644
--- a/device/bluetooth/test/bluetooth_test_android.h
+++ b/device/bluetooth/test/bluetooth_test_android.h
@@ -64,6 +64,8 @@
       BluetoothGattCharacteristic* characteristic) override;
   void SimulateGattDescriptor(BluetoothGattCharacteristic* characteristic,
                               const std::string& uuid) override;
+  void SimulateGattDescriptorWriteWillFailSynchronouslyOnce(
+      BluetoothGattDescriptor* descriptor) override;
 
   // Records that Java FakeBluetoothDevice connectGatt was called.
   void OnFakeBluetoothDeviceConnectGattCalled(
@@ -97,6 +99,12 @@
       const base::android::JavaParamRef<jobject>& caller,
       const base::android::JavaParamRef<jbyteArray>& value);
 
+  // Records that Java FakeBluetoothGatt writeDescriptor was called.
+  void OnFakeBluetoothGattWriteDescriptor(
+      JNIEnv* env,
+      const base::android::JavaParamRef<jobject>& caller,
+      const base::android::JavaParamRef<jbyteArray>& value);
+
   base::android::ScopedJavaGlobalRef<jobject> j_fake_bluetooth_adapter_;
 };
 
diff --git a/device/serial/serial_device_enumerator_mac.cc b/device/serial/serial_device_enumerator_mac.cc
index 3a81f1d1..7854c99d 100644
--- a/device/serial/serial_device_enumerator_mac.cc
+++ b/device/serial/serial_device_enumerator_mac.cc
@@ -9,6 +9,7 @@
 #include <stdint.h>
 
 #include <algorithm>
+#include <utility>
 
 #include "base/files/file_enumerator.h"
 #include "base/files/file_path.h"
@@ -106,13 +107,13 @@
   CFMutableDictionaryRef matchingDict =
       IOServiceMatching(kIOSerialBSDServiceValue);
   if (!matchingDict)
-    return devices.Pass();
+    return devices;
 
   io_iterator_t it;
   kern_return_t kr =
       IOServiceGetMatchingServices(kIOMasterPortDefault, matchingDict, &it);
   if (kr != KERN_SUCCESS)
-    return devices.Pass();
+    return devices;
 
   base::mac::ScopedIOObject<io_iterator_t> scoped_it(it);
   base::mac::ScopedIOObject<io_service_t> scoped_device;
@@ -148,18 +149,18 @@
                           &dialinDevice)) {
       serial::DeviceInfoPtr dialin_info = callout_info.Clone();
       dialin_info->path = dialinDevice;
-      devices.push_back(dialin_info.Pass());
+      devices.push_back(std::move(dialin_info));
     }
 
     mojo::String calloutDevice;
     if (GetStringProperty(scoped_device.get(), CFSTR(kIOCalloutDeviceKey),
                           &calloutDevice)) {
       callout_info->path = calloutDevice;
-      devices.push_back(callout_info.Pass());
+      devices.push_back(std::move(callout_info));
     }
   }
 
-  return devices.Pass();
+  return devices;
 }
 
 // Returns an array of devices as retrieved through the old method of
@@ -192,12 +193,12 @@
       if (base::MatchPattern(next_device, *i)) {
         serial::DeviceInfoPtr info(serial::DeviceInfo::New());
         info->path = next_device;
-        devices.push_back(info.Pass());
+        devices.push_back(std::move(info));
         break;
       }
     }
   } while (true);
-  return devices.Pass();
+  return devices;
 }
 
 }  // namespace
@@ -236,7 +237,7 @@
   mojo::Array<serial::DeviceInfoPtr> devices;
   deviceMap.DecomposeMapTo(&paths, &devices);
 
-  return devices.Pass();
+  return devices;
 }
 
 }  // namespace device
diff --git a/gpu/command_buffer/client/gles2_implementation.cc b/gpu/command_buffer/client/gles2_implementation.cc
index 1ae946d2..0f23569 100644
--- a/gpu/command_buffer/client/gles2_implementation.cc
+++ b/gpu/command_buffer/client/gles2_implementation.cc
@@ -3564,7 +3564,8 @@
                                            &size,
                                            &unpadded_row_size,
                                            &padded_row_size,
-                                           &skip_size)) {
+                                           &skip_size,
+                                           nullptr)) {
     SetGLError(GL_INVALID_VALUE, "glReadPixels", "size too large.");
     return;
   }
diff --git a/gpu/command_buffer/common/gles2_cmd_utils.cc b/gpu/command_buffer/common/gles2_cmd_utils.cc
index 86c0a7f..4c7fcf7 100644
--- a/gpu/command_buffer/common/gles2_cmd_utils.cc
+++ b/gpu/command_buffer/common/gles2_cmd_utils.cc
@@ -511,22 +511,30 @@
                                           uint32_t bytes_per_group,
                                           int alignment,
                                           uint32_t* rt_unpadded_row_size,
-                                          uint32_t* rt_padded_row_size) {
+                                          uint32_t* rt_padded_row_size,
+                                          uint32_t* rt_padding) {
   DCHECK(alignment == 1 || alignment == 2 ||
          alignment == 4 || alignment == 8);
   uint32_t unpadded_row_size;
   if (!SafeMultiplyUint32(width, bytes_per_group, &unpadded_row_size)) {
     return false;
   }
-  uint32_t temp;
-  if (!SafeAddUint32(unpadded_row_size, alignment - 1, &temp)) {
-    return false;
+  uint32_t residual = unpadded_row_size % alignment;
+  uint32_t padding = 0;
+  uint32_t padded_row_size = unpadded_row_size;
+  if (residual > 0) {
+    padding = alignment - residual;
+    if (!SafeAddUint32(unpadded_row_size, padding, &padded_row_size)) {
+      return false;
+    }
   }
-  uint32_t padded_row_size = (temp / alignment) * alignment;
+
   if (rt_unpadded_row_size)
     *rt_unpadded_row_size = unpadded_row_size;
   if (rt_padded_row_size)
     *rt_padded_row_size = padded_row_size;
+  if (rt_padding)
+    *rt_padding = padding;
   return true;
 }
 
@@ -537,7 +545,7 @@
                                           uint32_t* padded_row_size) {
   uint32_t bytes_per_group = ComputeImageGroupSize(format, type);
   return ComputeImageRowSizeHelper(
-      width, bytes_per_group, alignment, nullptr, padded_row_size);
+      width, bytes_per_group, alignment, nullptr, padded_row_size, nullptr);
 }
 
 // Returns the amount of data glTexImage*D or glTexSubImage*D will access.
@@ -554,14 +562,15 @@
   params.alignment = alignment;
   return ComputeImageDataSizesES3(
       width, height, depth, format, type, params,
-      size, opt_unpadded_row_size, opt_padded_row_size, nullptr);
+      size, opt_unpadded_row_size, opt_padded_row_size, nullptr, nullptr);
 }
 
 bool GLES2Util::ComputeImageDataSizesES3(
     int width, int height, int depth, int format, int type,
     const PixelStoreParams& params,
     uint32_t* size, uint32_t* opt_unpadded_row_size,
-    uint32_t* opt_padded_row_size, uint32_t* opt_skip_size) {
+    uint32_t* opt_padded_row_size, uint32_t* opt_skip_size,
+    uint32_t* opt_padding) {
   DCHECK(width >= 0 && height >= 0 && depth >= 0);
 
   uint32_t bytes_per_group = ComputeImageGroupSize(format, type);
@@ -569,12 +578,14 @@
   uint32_t unpadded_row_size;
   uint32_t padded_row_size;
   if (!ComputeImageRowSizeHelper(width, bytes_per_group, params.alignment,
-                                 &unpadded_row_size, &padded_row_size)) {
+                                 &unpadded_row_size, &padded_row_size,
+                                 opt_padding)) {
     return false;
   }
   if (params.row_length > 0 &&
       !ComputeImageRowSizeHelper(params.row_length, bytes_per_group,
-                                 params.alignment, nullptr, &padded_row_size)) {
+                                 params.alignment, nullptr, &padded_row_size,
+                                 opt_padding)) {
     // Here we re-compute the padded_row_size, but the unpadded_row_size
     // isn't affected. That is, the last row isn't affected by ROW_LENGTH.
     return false;
diff --git a/gpu/command_buffer/common/gles2_cmd_utils.h b/gpu/command_buffer/common/gles2_cmd_utils.h
index ea79b2b4..848abcaea 100644
--- a/gpu/command_buffer/common/gles2_cmd_utils.h
+++ b/gpu/command_buffer/common/gles2_cmd_utils.h
@@ -143,7 +143,8 @@
       int width, int height, int depth, int format, int type,
       const PixelStoreParams& params,
       uint32_t* size, uint32_t* opt_unpadded_row_size,
-      uint32_t* opt_padded_row_size, uint32_t* opt_skip_size);
+      uint32_t* opt_padded_row_size, uint32_t* opt_skip_size,
+      uint32_t* opt_padding);
 
   static size_t RenderbufferBytesPerPixel(int format);
 
@@ -224,7 +225,8 @@
                                         uint32_t bytes_per_group,
                                         int alignment,
                                         uint32_t* rt_unpadded_row_size,
-                                        uint32_t* rt_padded_row_size);
+                                        uint32_t* rt_padded_row_size,
+                                        uint32_t* rt_padding);
 
   static const EnumToString* const enum_to_string_table_;
   static const size_t enum_to_string_table_len_;
diff --git a/gpu/command_buffer/common/gles2_cmd_utils_unittest.cc b/gpu/command_buffer/common/gles2_cmd_utils_unittest.cc
index e2b0950..d1f731f 100644
--- a/gpu/command_buffer/common/gles2_cmd_utils_unittest.cc
+++ b/gpu/command_buffer/common/gles2_cmd_utils_unittest.cc
@@ -329,17 +329,19 @@
   uint32_t unpadded_row_size;
   uint32_t padded_row_size;
   uint32_t skip_size;
+  uint32_t padding;
 
   {  // Default
     PixelStoreParams params;
     EXPECT_TRUE(GLES2Util::ComputeImageDataSizesES3(
         kWidth, kHeight, kDepth, GL_RGB, GL_UNSIGNED_BYTE, params,
-        &size, &unpadded_row_size, &padded_row_size, &skip_size));
+        &size, &unpadded_row_size, &padded_row_size, &skip_size, &padding));
     EXPECT_EQ(kWidth * 3, unpadded_row_size);
     EXPECT_EQ(kWidth * 3 + 3, padded_row_size);
     EXPECT_EQ(padded_row_size * (kHeight * kDepth - 1) + unpadded_row_size,
               size);
     EXPECT_EQ(0u, skip_size);
+    EXPECT_EQ(3u, padding);
   }
 
   {  // row_length > width
@@ -348,13 +350,14 @@
     uint32_t kPadding = 1;  // 5 * 3 = 15 -> 16
     EXPECT_TRUE(GLES2Util::ComputeImageDataSizesES3(
         kWidth, kHeight, kDepth, GL_RGB, GL_UNSIGNED_BYTE, params,
-        &size, &unpadded_row_size, &padded_row_size, &skip_size));
+        &size, &unpadded_row_size, &padded_row_size, &skip_size, &padding));
     EXPECT_EQ(static_cast<uint32_t>(kWidth * 3), unpadded_row_size);
     EXPECT_EQ(static_cast<uint32_t>(params.row_length * 3 + kPadding),
               padded_row_size);
     EXPECT_EQ(padded_row_size * (kHeight * kDepth - 1) + unpadded_row_size,
               size);
     EXPECT_EQ(0u, skip_size);
+    EXPECT_EQ(kPadding, padding);
   }
 
   {  // row_length < width
@@ -363,13 +366,14 @@
     uint32_t kPadding = 2;  // 2 * 3 = 6 -> 8
     EXPECT_TRUE(GLES2Util::ComputeImageDataSizesES3(
         kWidth, kHeight, kDepth, GL_RGB, GL_UNSIGNED_BYTE, params,
-        &size, &unpadded_row_size, &padded_row_size, &skip_size));
+        &size, &unpadded_row_size, &padded_row_size, &skip_size, &padding));
     EXPECT_EQ(static_cast<uint32_t>(kWidth * 3), unpadded_row_size);
     EXPECT_EQ(static_cast<uint32_t>(params.row_length * 3 + kPadding),
               padded_row_size);
     EXPECT_EQ(padded_row_size * (kHeight * kDepth - 1) + unpadded_row_size,
               size);
     EXPECT_EQ(0u, skip_size);
+    EXPECT_EQ(kPadding, padding);
   }
 
   {  // image_height > height
@@ -378,12 +382,13 @@
     uint32_t kPadding = 3; // 3 * 3 = 9 -> 21
     EXPECT_TRUE(GLES2Util::ComputeImageDataSizesES3(
         kWidth, kHeight, kDepth, GL_RGB, GL_UNSIGNED_BYTE, params,
-        &size, &unpadded_row_size, &padded_row_size, &skip_size));
+        &size, &unpadded_row_size, &padded_row_size, &skip_size, &padding));
     EXPECT_EQ(kWidth * 3, unpadded_row_size);
     EXPECT_EQ(kWidth * 3 + kPadding, padded_row_size);
     EXPECT_EQ((params.image_height * (kDepth - 1) + kHeight - 1) *
               padded_row_size + unpadded_row_size, size);
     EXPECT_EQ(0u, skip_size);
+    EXPECT_EQ(kPadding, padding);
   }
 
   {  // image_height < height
@@ -392,12 +397,13 @@
     uint32_t kPadding = 3; // 3 * 3 = 9 -> 12
     EXPECT_TRUE(GLES2Util::ComputeImageDataSizesES3(
         kWidth, kHeight, kDepth, GL_RGB, GL_UNSIGNED_BYTE, params,
-        &size, &unpadded_row_size, &padded_row_size, &skip_size));
+        &size, &unpadded_row_size, &padded_row_size, &skip_size, &padding));
     EXPECT_EQ(kWidth * 3, unpadded_row_size);
     EXPECT_EQ(kWidth * 3 + kPadding, padded_row_size);
     EXPECT_EQ((params.image_height * (kDepth - 1) + kHeight - 1) *
               padded_row_size + unpadded_row_size, size);
     EXPECT_EQ(0u, skip_size);
+    EXPECT_EQ(kPadding, padding);
   }
 
   {  // skip_pixels, skip_rows, skip_images, alignment = 4, RGB
@@ -408,7 +414,7 @@
     uint32_t kPadding = 3; // 3 * 3 = 9 -> 12
     EXPECT_TRUE(GLES2Util::ComputeImageDataSizesES3(
         kWidth, kHeight, kDepth, GL_RGB, GL_UNSIGNED_BYTE, params,
-        &size, &unpadded_row_size, &padded_row_size, &skip_size));
+        &size, &unpadded_row_size, &padded_row_size, &skip_size, &padding));
     EXPECT_EQ(kWidth * 3, unpadded_row_size);
     EXPECT_EQ(kWidth * 3 + kPadding, padded_row_size);
     EXPECT_EQ(padded_row_size * kHeight * params.skip_images +
@@ -416,6 +422,7 @@
               skip_size);
     EXPECT_EQ(padded_row_size * (kWidth * kDepth - 1) + unpadded_row_size,
               size);
+    EXPECT_EQ(kPadding, padding);
   }
 
   {  // skip_pixels, skip_rows, skip_images, alignment = 8, RGBA
@@ -427,7 +434,7 @@
     uint32_t kPadding = 4; // 3 * 4 = 12 -> 16
     EXPECT_TRUE(GLES2Util::ComputeImageDataSizesES3(
         kWidth, kHeight, kDepth, GL_RGBA, GL_UNSIGNED_BYTE, params,
-        &size, &unpadded_row_size, &padded_row_size, &skip_size));
+        &size, &unpadded_row_size, &padded_row_size, &skip_size, &padding));
     EXPECT_EQ(kWidth * 4, unpadded_row_size);
     EXPECT_EQ(kWidth * 4 + kPadding, padded_row_size);
     EXPECT_EQ(padded_row_size * kHeight * params.skip_images +
@@ -435,6 +442,7 @@
               skip_size);
     EXPECT_EQ(padded_row_size * (kWidth * kDepth - 1) + unpadded_row_size,
               size);
+    EXPECT_EQ(kPadding, padding);
   }
 }
 
diff --git a/gpu/command_buffer/service/context_state.cc b/gpu/command_buffer/service/context_state.cc
index 1a3a8c0..8b299dc8 100644
--- a/gpu/command_buffer/service/context_state.cc
+++ b/gpu/command_buffer/service/context_state.cc
@@ -451,12 +451,8 @@
     return;
   if (bound_pixel_pack_buffer.get()) {
     glPixelStorei(GL_PACK_ROW_LENGTH, pack_row_length);
-    glPixelStorei(GL_PACK_SKIP_PIXELS, pack_skip_pixels);
-    glPixelStorei(GL_PACK_SKIP_ROWS, pack_skip_rows);
   } else {
     glPixelStorei(GL_PACK_ROW_LENGTH, 0);
-    glPixelStorei(GL_PACK_SKIP_PIXELS, 0);
-    glPixelStorei(GL_PACK_SKIP_ROWS, 0);
   }
 }
 
diff --git a/gpu/command_buffer/service/gles2_cmd_decoder.cc b/gpu/command_buffer/service/gles2_cmd_decoder.cc
index 026e2a9..515a825 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder.cc
+++ b/gpu/command_buffer/service/gles2_cmd_decoder.cc
@@ -9130,17 +9130,19 @@
   uint32_t unpadded_row_size = 0;
   uint32_t padded_row_size = 0;
   uint32_t skip_size = 0;
+  uint32_t padding = 0;
   if (!GLES2Util::ComputeImageDataSizesES3(width, height, 1,
                                            format, type,
                                            params,
                                            &pixels_size,
                                            &unpadded_row_size,
                                            &padded_row_size,
-                                           &skip_size)) {
+                                           &skip_size,
+                                           &padding)) {
     return error::kOutOfBounds;
   }
 
-  void* pixels = nullptr;
+  uint8_t* pixels = nullptr;
   Buffer* buffer = state_.bound_pixel_pack_buffer.get();
   if (pixels_shm_id == 0) {
     if (buffer) {
@@ -9150,7 +9152,7 @@
         return error::kNoError;
       }
       uint32_t size = 0;
-      if (!SafeAddUint32(pixels_size, pixels_shm_offset, &size)) {
+      if (!SafeAddUint32(pixels_size + skip_size, pixels_shm_offset, &size)) {
         LOCAL_SET_GL_ERROR(
             GL_INVALID_VALUE, "glReadPixels", "size + offset overflow");
         return error::kNoError;
@@ -9160,7 +9162,8 @@
             "pixel pack buffer is not large enough");
         return error::kNoError;
       }
-      pixels = reinterpret_cast<void *>(pixels_shm_offset);
+      pixels = reinterpret_cast<uint8_t *>(pixels_shm_offset);
+      pixels += skip_size;
     } else {
       return error::kInvalidArguments;
     }
@@ -9168,7 +9171,8 @@
     if (buffer) {
       return error::kInvalidArguments;
     } else {
-      pixels = GetSharedMemoryAs<void*>(
+      DCHECK_EQ(0u, skip_size);
+      pixels = GetSharedMemoryAs<uint8_t*>(
           pixels_shm_id, pixels_shm_offset, pixels_size);
       if (!pixels) {
         return error::kOutOfBounds;
@@ -9318,27 +9322,17 @@
   if (!max_rect.Contains(rect)) {
     rect.Intersect(max_rect);
     if (!rect.IsEmpty()) {
-      // TODO(yunchao): need to handle the out-of-bounds case for reading pixels
-      // into PIXEL_PACK buffer.
-      if (pixels_shm_id == 0) {
-        LOCAL_SET_GL_ERROR(GL_INVALID_OPERATION, "glReadPixels",
-            "read pixels out of bounds into PIXEL_PACK buffer");
-        return error::kNoError;
-      }
-
-      int8_t* dst = static_cast<int8_t*>(pixels);
       if (y < 0) {
-        uint32_t skip_rows_bytes = static_cast<uint32_t>(-y) * padded_row_size;
-        dst += skip_rows_bytes;
+        pixels += static_cast<uint32_t>(-y) * padded_row_size;;
       }
       if (x < 0) {
         uint32_t group_size = GLES2Util::ComputeImageGroupSize(format, type);
         uint32_t leading_bytes = static_cast<uint32_t>(-x) * group_size;
-        dst += leading_bytes;
+        pixels += leading_bytes;
       }
       for (GLint iy = rect.y(); iy < rect.bottom(); ++iy) {
-        glReadPixels(rect.x(), iy, rect.width(), 1, format, type, dst);
-        dst += padded_row_size;
+        glReadPixels(rect.x(), iy, rect.width(), 1, format, type, pixels);
+        pixels += padded_row_size;
       }
     }
   } else {
@@ -9373,7 +9367,34 @@
         glDeleteBuffersARB(1, &buffer);
       }
     }
-    glReadPixels(x, y, width, height, format, type, pixels);
+    if (pixels_shm_id == 0 &&
+        workarounds().pack_parameters_workaround_with_pack_buffer) {
+      if (state_.pack_row_length > 0 && state_.pack_row_length < width) {
+        // Some drivers (for example, NVidia Linux) reset in this case.
+        for (GLint iy = y; iy < y + height; ++iy) {
+          // Need to set PACK_ALIGNMENT for last row. See comment below.
+          if (iy + 1 == y + height && padding > 0)
+            glPixelStorei(GL_PACK_ALIGNMENT, 1);
+          glReadPixels(x, iy, width, 1, format, type, pixels);
+          if (iy + 1 == y + height && padding > 0)
+            glPixelStorei(GL_PACK_ALIGNMENT, state_.pack_alignment);
+          pixels += padded_row_size;
+        }
+      } else if (padding > 0) {
+        // Some drivers (for example, NVidia Linux) incorrectly require the
+        // pack buffer to have padding for the last row.
+        if (height > 1)
+          glReadPixels(x, y, width, height - 1, format, type, pixels);
+        glPixelStorei(GL_PACK_ALIGNMENT, 1);
+        pixels += padded_row_size * (height - 1);
+        glReadPixels(x, y + height - 1, width, 1, format, type, pixels);
+        glPixelStorei(GL_PACK_ALIGNMENT, state_.pack_alignment);
+      } else {
+        glReadPixels(x, y, width, height, format, type, pixels);
+      }
+    } else {
+      glReadPixels(x, y, width, height, format, type, pixels);
+    }
   }
   if (pixels_shm_id != 0) {
     GLenum error = LOCAL_PEEK_GL_ERROR("glReadPixels");
@@ -9425,16 +9446,20 @@
     default:
       break;
   }
-  // For pack and unpack parameters (except for alignment), we don't apply them
-  // if no buffer is bound at PIXEL_PACK or PIXEL_UNPACK. We will handle pack
-  // and unpack according to the user specified parameters on the client side.
+  // For pack skip parameters, we don't apply them and handle them in command
+  // buffer.
+  // For alignment parameters, we always apply them.
+  // For other parameters, we don't apply them if no buffer is bound at
+  // PIXEL_PACK or PIXEL_UNPACK. We will handle pack and unpack according to
+  // the user specified parameters on the client side.
   switch (pname) {
     case GL_PACK_ROW_LENGTH:
-    case GL_PACK_SKIP_PIXELS:
-    case GL_PACK_SKIP_ROWS:
       if (state_.bound_pixel_pack_buffer.get())
         glPixelStorei(pname, param);
       break;
+    case GL_PACK_SKIP_PIXELS:
+    case GL_PACK_SKIP_ROWS:
+      break;
     case GL_UNPACK_ROW_LENGTH:
     case GL_UNPACK_IMAGE_HEIGHT:
     case GL_UNPACK_SKIP_PIXELS:
diff --git a/gpu/command_buffer/service/gles2_cmd_decoder_unittest_base.cc b/gpu/command_buffer/service/gles2_cmd_decoder_unittest_base.cc
index 4c4e9f0..88a46bd 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder_unittest_base.cc
+++ b/gpu/command_buffer/service/gles2_cmd_decoder_unittest_base.cc
@@ -841,12 +841,6 @@
     EXPECT_CALL(*gl_, PixelStorei(GL_PACK_ROW_LENGTH, _))
         .Times(1)
         .RetiresOnSaturation();
-    EXPECT_CALL(*gl_, PixelStorei(GL_PACK_SKIP_PIXELS, _))
-        .Times(1)
-        .RetiresOnSaturation();
-    EXPECT_CALL(*gl_, PixelStorei(GL_PACK_SKIP_ROWS, _))
-        .Times(1)
-        .RetiresOnSaturation();
   }
   cmds::BindBuffer cmd;
   cmd.Init(target, client_id);
@@ -1825,6 +1819,15 @@
   EXPECT_EQ(error::kNoError, ExecuteCmd(cmd));
 }
 
+void GLES2DecoderTestBase::DoPixelStorei(GLenum pname, GLint param) {
+  EXPECT_CALL(*gl_, PixelStorei(pname, param))
+      .Times(1)
+      .RetiresOnSaturation();
+  cmds::PixelStorei cmd;
+  cmd.Init(pname, param);
+  EXPECT_EQ(error::kNoError, ExecuteCmd(cmd));
+}
+
 void GLES2DecoderTestBase::SetupVertexBuffer() {
   DoEnableVertexAttribArray(1);
   DoBindBuffer(GL_ARRAY_BUFFER, client_buffer_id_, kServiceBufferId);
@@ -1929,12 +1932,6 @@
     EXPECT_CALL(*gl_, PixelStorei(GL_PACK_ROW_LENGTH, 0))
         .Times(1)
         .RetiresOnSaturation();
-    EXPECT_CALL(*gl_, PixelStorei(GL_PACK_SKIP_PIXELS, 0))
-        .Times(1)
-        .RetiresOnSaturation();
-    EXPECT_CALL(*gl_, PixelStorei(GL_PACK_SKIP_ROWS, 0))
-        .Times(1)
-        .RetiresOnSaturation();
     EXPECT_CALL(*gl_, PixelStorei(GL_UNPACK_ROW_LENGTH, 0))
         .Times(1)
         .RetiresOnSaturation();
diff --git a/gpu/command_buffer/service/gles2_cmd_decoder_unittest_base.h b/gpu/command_buffer/service/gles2_cmd_decoder_unittest_base.h
index ff8c0ab5..1e08254 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder_unittest_base.h
+++ b/gpu/command_buffer/service/gles2_cmd_decoder_unittest_base.h
@@ -356,6 +356,8 @@
 
   void DoScissor(GLint x, GLint y, GLsizei width, GLsizei height);
 
+  void DoPixelStorei(GLenum pname, GLint param);
+
   void SetupVertexBuffer();
   void SetupAllNeededVertexBuffers();
 
diff --git a/gpu/command_buffer/service/gles2_cmd_decoder_unittest_framebuffers.cc b/gpu/command_buffer/service/gles2_cmd_decoder_unittest_framebuffers.cc
index 3383e269..ec0234df 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder_unittest_framebuffers.cc
+++ b/gpu/command_buffer/service/gles2_cmd_decoder_unittest_framebuffers.cc
@@ -818,6 +818,166 @@
   EXPECT_EQ(GL_INVALID_OPERATION, GetGLError());
 }
 
+TEST_P(GLES2DecoderManualInitTest, ReadPixels2RowLengthWorkaround) {
+  base::CommandLine command_line(0, NULL);
+  command_line.AppendSwitchASCII(
+      switches::kGpuDriverBugWorkarounds,
+      base::IntToString(gpu::PACK_PARAMETERS_WORKAROUND_WITH_PACK_BUFFER));
+  command_line.AppendSwitch(switches::kEnableUnsafeES3APIs);
+  InitState init;
+  init.gl_version = "OpenGL ES 3.0";
+  init.bind_generates_resource = true;
+  init.context_type = CONTEXT_TYPE_OPENGLES3;
+  InitDecoderWithCommandLine(init, &command_line);
+
+  const GLsizei kWidth = 5;
+  const GLsizei kHeight = 3;
+  const GLint kBytesPerPixel = 4;
+  const GLenum kFormat = GL_RGBA;
+  const GLenum kType = GL_UNSIGNED_BYTE;
+  const GLint kRowLength = 4;
+  GLint size = (kRowLength * (kHeight - 1) + kWidth) * kBytesPerPixel;
+
+  DoBindBuffer(GL_PIXEL_PACK_BUFFER, client_buffer_id_, kServiceBufferId);
+  DoBufferData(GL_PIXEL_PACK_BUFFER, size);
+
+  DoPixelStorei(GL_PACK_ROW_LENGTH, kRowLength);
+
+  EXPECT_CALL(*gl_, GetError())
+      .WillOnce(Return(GL_NO_ERROR))
+      .RetiresOnSaturation();
+  for (GLint ii = 0; ii < kHeight; ++ii) {
+    void* offset = reinterpret_cast<void*>(ii * kRowLength * kBytesPerPixel);
+    EXPECT_CALL(*gl_, ReadPixels(0, ii, kWidth, 1, kFormat, kType, offset))
+        .Times(1)
+        .RetiresOnSaturation();
+  }
+
+  ReadPixels cmd;
+  cmd.Init(0, 0, kWidth, kHeight,
+           kFormat, kType,
+           0, 0, 0, 0,
+           false);
+  EXPECT_EQ(error::kNoError, ExecuteCmd(cmd));
+  EXPECT_EQ(GL_NO_ERROR, GetGLError());
+}
+
+TEST_P(GLES2DecoderManualInitTest, ReadPixels2AlignmentWorkaround) {
+  base::CommandLine command_line(0, NULL);
+  command_line.AppendSwitchASCII(
+      switches::kGpuDriverBugWorkarounds,
+      base::IntToString(gpu::PACK_PARAMETERS_WORKAROUND_WITH_PACK_BUFFER));
+  command_line.AppendSwitch(switches::kEnableUnsafeES3APIs);
+  InitState init;
+  init.gl_version = "OpenGL ES 3.0";
+  init.bind_generates_resource = true;
+  init.context_type = CONTEXT_TYPE_OPENGLES3;
+  InitDecoderWithCommandLine(init, &command_line);
+
+  const GLsizei kWidth = 5;
+  const GLsizei kHeight = 3;
+  const GLint kBytesPerPixel = 4;
+  const GLenum kFormat = GL_RGBA;
+  const GLenum kType = GL_UNSIGNED_BYTE;
+  const GLint kAlignment = 8;
+  const GLint kPadding = 4;
+  GLint size = kWidth * kBytesPerPixel * kHeight + kPadding * (kHeight - 1);
+
+  DoBindBuffer(GL_PIXEL_PACK_BUFFER, client_buffer_id_, kServiceBufferId);
+  DoBufferData(GL_PIXEL_PACK_BUFFER, size);
+
+  DoPixelStorei(GL_PACK_ALIGNMENT, kAlignment);
+
+  EXPECT_CALL(*gl_, GetError())
+      .WillOnce(Return(GL_NO_ERROR))
+      .RetiresOnSaturation();
+  uint8_t* offset = reinterpret_cast<uint8_t*>(0);
+  EXPECT_CALL(*gl_,
+              ReadPixels(0, 0, kWidth, kHeight - 1, kFormat, kType, offset))
+      .Times(1)
+      .RetiresOnSaturation();
+  EXPECT_CALL(*gl_, PixelStorei(GL_PACK_ALIGNMENT, 1))
+      .Times(1)
+      .RetiresOnSaturation();
+  offset += (kWidth * kBytesPerPixel + kPadding) * (kHeight - 1);
+  EXPECT_CALL(*gl_,
+              ReadPixels(0, kHeight - 1, kWidth, 1, kFormat, kType, offset))
+      .Times(1)
+      .RetiresOnSaturation();
+  EXPECT_CALL(*gl_, PixelStorei(GL_PACK_ALIGNMENT, kAlignment))
+      .Times(1)
+      .RetiresOnSaturation();
+
+  ReadPixels cmd;
+  cmd.Init(0, 0, kWidth, kHeight,
+           kFormat, kType,
+           0, 0, 0, 0,
+           false);
+  EXPECT_EQ(error::kNoError, ExecuteCmd(cmd));
+  EXPECT_EQ(GL_NO_ERROR, GetGLError());
+}
+
+TEST_P(GLES2DecoderManualInitTest,
+       ReadPixels2RowLengthAndAlignmentWorkarounds) {
+  base::CommandLine command_line(0, NULL);
+  command_line.AppendSwitchASCII(
+      switches::kGpuDriverBugWorkarounds,
+      base::IntToString(gpu::PACK_PARAMETERS_WORKAROUND_WITH_PACK_BUFFER));
+  command_line.AppendSwitch(switches::kEnableUnsafeES3APIs);
+  InitState init;
+  init.gl_version = "OpenGL ES 3.0";
+  init.bind_generates_resource = true;
+  init.context_type = CONTEXT_TYPE_OPENGLES3;
+  InitDecoderWithCommandLine(init, &command_line);
+
+  const GLsizei kWidth = 5;
+  const GLsizei kHeight = 3;
+  const GLint kBytesPerPixel = 4;
+  const GLenum kFormat = GL_RGBA;
+  const GLenum kType = GL_UNSIGNED_BYTE;
+  const GLint kAlignment = 8;
+  const GLint kRowLength = 3;
+  const GLint kPadding = 4;
+  GLint padded_row_size = kRowLength * kBytesPerPixel + kPadding;
+  GLint unpadded_row_size = kWidth * kBytesPerPixel;
+  GLint size = padded_row_size * (kHeight - 1) + unpadded_row_size;
+
+  DoBindBuffer(GL_PIXEL_PACK_BUFFER, client_buffer_id_, kServiceBufferId);
+  DoBufferData(GL_PIXEL_PACK_BUFFER, size);
+
+  DoPixelStorei(GL_PACK_ALIGNMENT, kAlignment);
+  DoPixelStorei(GL_PACK_ROW_LENGTH, kRowLength);
+
+  EXPECT_CALL(*gl_, GetError())
+      .WillOnce(Return(GL_NO_ERROR))
+      .RetiresOnSaturation();
+  for (GLint ii = 0; ii < kHeight - 1; ++ii) {
+    void* offset = reinterpret_cast<void*>(ii * padded_row_size);
+    EXPECT_CALL(*gl_, ReadPixels(0, ii, kWidth, 1, kFormat, kType, offset))
+        .Times(1)
+        .RetiresOnSaturation();
+  }
+  EXPECT_CALL(*gl_, PixelStorei(GL_PACK_ALIGNMENT, 1))
+      .Times(1)
+      .RetiresOnSaturation();
+  void* offset = reinterpret_cast<void*>((kHeight - 1) * padded_row_size);
+  EXPECT_CALL(*gl_,
+              ReadPixels(0, kHeight - 1, kWidth, 1, kFormat, kType, offset))
+      .Times(1)
+      .RetiresOnSaturation();
+  EXPECT_CALL(*gl_, PixelStorei(GL_PACK_ALIGNMENT, kAlignment))
+      .Times(1)
+      .RetiresOnSaturation();
+
+  ReadPixels cmd;
+  cmd.Init(0, 0, kWidth, kHeight,
+           kFormat, kType,
+           0, 0, 0, 0,
+           false);
+  EXPECT_EQ(error::kNoError, ExecuteCmd(cmd));
+  EXPECT_EQ(GL_NO_ERROR, GetGLError());
+}
+
 TEST_P(GLES2DecoderRGBBackbufferTest, ReadPixelsNoAlphaBackbuffer) {
   const GLsizei kWidth = 3;
   const GLsizei kHeight = 3;
diff --git a/gpu/config/gpu_driver_bug_list_json.cc b/gpu/config/gpu_driver_bug_list_json.cc
index cff0b94..1f88d35b 100644
--- a/gpu/config/gpu_driver_bug_list_json.cc
+++ b/gpu/config/gpu_driver_bug_list_json.cc
@@ -19,7 +19,7 @@
 {
   "name": "gpu driver bug list",
   // Please update the version number whenever you change this file.
-  "version": "8.38",
+  "version": "8.39",
   "entries": [
     {
       "id": 1,
@@ -1684,6 +1684,19 @@
       "features": [
         "disable_discard_framebuffer"
       ]
+    },
+    {
+      "id": 142,
+      "cr_bugs": [563714],
+      "description": "Pack parameters work incorrectly with pack buffer bound",
+      "os": {
+        "type": "linux"
+      },
+      "vendor_id": "0x10de",
+      "gl_vendor": "NVIDIA.*",
+      "features": [
+        "pack_parameters_workaround_with_pack_buffer"
+      ]
     }
   ]
 }
diff --git a/gpu/config/gpu_driver_bug_workaround_type.h b/gpu/config/gpu_driver_bug_workaround_type.h
index 864627c4..46cbb03 100644
--- a/gpu/config/gpu_driver_bug_workaround_type.h
+++ b/gpu/config/gpu_driver_bug_workaround_type.h
@@ -106,6 +106,8 @@
          needs_glsl_built_in_function_emulation)             \
   GPU_OP(NEEDS_OFFSCREEN_BUFFER_WORKAROUND,                  \
          needs_offscreen_buffer_workaround)                  \
+  GPU_OP(PACK_PARAMETERS_WORKAROUND_WITH_PACK_BUFFER,        \
+         pack_parameters_workaround_with_pack_buffer)        \
   GPU_OP(REGENERATE_STRUCT_NAMES,                            \
          regenerate_struct_names)                            \
   GPU_OP(REMOVE_POW_WITH_CONSTANT_EXPONENT,                  \
diff --git a/gpu/gles2_conform_support/BUILD.gn b/gpu/gles2_conform_support/BUILD.gn
index 4d1e26c2..cf6114fc 100644
--- a/gpu/gles2_conform_support/BUILD.gn
+++ b/gpu/gles2_conform_support/BUILD.gn
@@ -200,11 +200,12 @@
   ]
 
   if (internal_gles2_conform_tests) {
-    deps += [
-      ":generate_gles2_conform_tests",
+    data_deps = [
       ":gles2_conform_test_windowless",
     ]
+    deps += [ ":generate_gles2_conform_tests" ]
     sources += [ "$target_gen_dir/gles2_conform_test_autogen.cc" ]
+    data += [ "//third_party/gles2_conform/GTF_ES/" ]
 
     # TODO: Make these tests pull in the correct data dependencies once they
     # are exported in GN. Maybe from  //third_party/gles2_conform/GTF_ES/
diff --git a/ios/public/provider/chrome/browser/string_provider.cc b/ios/public/provider/chrome/browser/string_provider.cc
index eeecb90..300ed5b 100644
--- a/ios/public/provider/chrome/browser/string_provider.cc
+++ b/ios/public/provider/chrome/browser/string_provider.cc
@@ -14,22 +14,6 @@
   return std::string();
 }
 
-int StringProvider::GetUnsafePortTitleID() {
-  return 0;
-}
-
-int StringProvider::GetUnsafePortHeadlineID() {
-  return 0;
-}
-
-int StringProvider::GetUnsafePortMessageID() {
-  return 0;
-}
-
-int StringProvider::GetUnsafePortDetailsID() {
-  return 0;
-}
-
 base::string16 StringProvider::GetProductName() {
   return base::string16();
 }
diff --git a/ios/public/provider/chrome/browser/string_provider.h b/ios/public/provider/chrome/browser/string_provider.h
index ebd0ae181..69a4880 100644
--- a/ios/public/provider/chrome/browser/string_provider.h
+++ b/ios/public/provider/chrome/browser/string_provider.h
@@ -28,13 +28,7 @@
 
   // Returns the string to display in the omnibox context menu for the user to
   // copy the URL for the current search query into the pasteboard.
-  virtual std::string GetOmniboxCopyUrlString() = 0;
-
-  // Return the resource IDs used to display unsafe port errors.
-  virtual int GetUnsafePortTitleID();
-  virtual int GetUnsafePortHeadlineID();
-  virtual int GetUnsafePortMessageID();
-  virtual int GetUnsafePortDetailsID();
+  virtual std::string GetOmniboxCopyUrlString();
 
   // Returns the product name (e.g. "Google Chrome").
   virtual base::string16 GetProductName();
diff --git a/mash/wm/property_util.cc b/mash/wm/property_util.cc
index 5224e39..67b11b6 100644
--- a/mash/wm/property_util.cc
+++ b/mash/wm/property_util.cc
@@ -16,7 +16,7 @@
 namespace wm {
 namespace {
 
-DEFINE_LOCAL_WINDOW_PROPERTY_KEY(Shadow*, kLocalShadowProperty, nullptr);
+MUS_DEFINE_LOCAL_WINDOW_PROPERTY_KEY(Shadow*, kLocalShadowProperty, nullptr);
 
 }  // namespace
 
diff --git a/media/BUILD.gn b/media/BUILD.gn
index e16f1f2..96ccfba 100644
--- a/media/BUILD.gn
+++ b/media/BUILD.gn
@@ -226,6 +226,8 @@
     "filters/ivf_parser.h",
     "filters/jpeg_parser.cc",
     "filters/jpeg_parser.h",
+    "filters/media_source_state.cc",
+    "filters/media_source_state.h",
     "filters/opus_constants.cc",
     "filters/opus_constants.h",
     "filters/source_buffer_range.cc",
diff --git a/media/capture/video/mac/video_capture_device_decklink_mac.mm b/media/capture/video/mac/video_capture_device_decklink_mac.mm
index 5df132d..3841be64 100644
--- a/media/capture/video/mac/video_capture_device_decklink_mac.mm
+++ b/media/capture/video/mac/video_capture_device_decklink_mac.mm
@@ -4,6 +4,8 @@
 
 #include "media/capture/video/mac/video_capture_device_decklink_mac.h"
 
+#include <utility>
+
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
@@ -477,7 +479,7 @@
     const VideoCaptureParams& params,
     scoped_ptr<VideoCaptureDevice::Client> client) {
   DCHECK(thread_checker_.CalledOnValidThread());
-  client_ = client.Pass();
+  client_ = std::move(client);
   if (decklink_capture_delegate_.get())
     decklink_capture_delegate_->AllocateAndStart(params);
 }
diff --git a/media/capture/video/mac/video_capture_device_factory_mac.mm b/media/capture/video/mac/video_capture_device_factory_mac.mm
index 2098f3e..5d92f7eb1 100644
--- a/media/capture/video/mac/video_capture_device_factory_mac.mm
+++ b/media/capture/video/mac/video_capture_device_factory_mac.mm
@@ -7,6 +7,8 @@
 #import <IOKit/audio/IOAudioTypes.h>
 #include <stddef.h>
 
+#include <utility>
+
 #include "base/bind.h"
 #include "base/location.h"
 #include "base/macros.h"
@@ -68,7 +70,7 @@
       name.set_is_blacklisted(true);
     device_names->push_back(name);
   }
-  return device_names.Pass();
+  return device_names;
 }
 
 static void RunDevicesEnumeratedCallback(
@@ -80,7 +82,7 @@
   tracked_objects::ScopedTracker tracking_profile(
       FROM_HERE_WITH_EXPLICIT_FUNCTION(
           "458397 media::RunDevicesEnumeratedCallback"));
-  callback.Run(device_names.Pass());
+  callback.Run(std::move(device_names));
 }
 
 VideoCaptureDeviceFactoryMac::VideoCaptureDeviceFactoryMac(
@@ -109,7 +111,7 @@
       capture_device.reset();
     }
   }
-  return scoped_ptr<VideoCaptureDevice>(capture_device.Pass());
+  return scoped_ptr<VideoCaptureDevice>(std::move(capture_device));
 }
 
 void VideoCaptureDeviceFactoryMac::GetDeviceNames(
@@ -158,7 +160,7 @@
     scoped_ptr<VideoCaptureDevice::Names> device_names(
         new VideoCaptureDevice::Names());
     GetDeviceNames(device_names.get());
-    callback.Run(device_names.Pass());
+    callback.Run(std::move(device_names));
   } else {
     DVLOG(1) << "Enumerating video capture devices using QTKit";
     base::PostTaskAndReplyWithResult(
diff --git a/media/capture/video/mac/video_capture_device_mac.mm b/media/capture/video/mac/video_capture_device_mac.mm
index 00e1c003..ec6fcaf8 100644
--- a/media/capture/video/mac/video_capture_device_mac.mm
+++ b/media/capture/video/mac/video_capture_device_mac.mm
@@ -11,6 +11,7 @@
 #include <stdint.h>
 
 #include <limits>
+#include <utility>
 
 #include "base/bind.h"
 #include "base/location.h"
@@ -377,7 +378,7 @@
   if (!AVFoundationGlue::IsAVFoundationSupported())
     GetBestMatchSupportedResolution(&resolution);
 
-  client_ = client.Pass();
+  client_ = std::move(client);
   if (device_name_.capture_api_type() == Name::AVFOUNDATION)
     LogMessage("Using AVFoundation for device: " + device_name_.name());
   else
diff --git a/media/capture/video/video_capture_device_unittest.cc b/media/capture/video/video_capture_device_unittest.cc
index 7db16aa9..2b6ef438 100644
--- a/media/capture/video/video_capture_device_unittest.cc
+++ b/media/capture/video/video_capture_device_unittest.cc
@@ -294,7 +294,7 @@
     capture_params.requested_format.frame_size.SetSize(640, 480);
     capture_params.requested_format.frame_rate = 30;
     capture_params.requested_format.pixel_format = PIXEL_FORMAT_I420;
-    device->AllocateAndStart(capture_params, client_.Pass());
+    device->AllocateAndStart(capture_params, std::move(client_));
     device->StopAndDeAllocate();
   }
 #endif
diff --git a/media/cast/sender/h264_vt_encoder_unittest.cc b/media/cast/sender/h264_vt_encoder_unittest.cc
index 49a451d..4798a216 100644
--- a/media/cast/sender/h264_vt_encoder_unittest.cc
+++ b/media/cast/sender/h264_vt_encoder_unittest.cc
@@ -231,9 +231,8 @@
         new base::PowerMonitor(scoped_ptr<TestPowerSource>(power_source_)));
 
     cast_environment_ = new CastEnvironment(
-        scoped_ptr<base::TickClock>(clock_).Pass(),
-        message_loop_.task_runner(), message_loop_.task_runner(),
-        message_loop_.task_runner());
+        scoped_ptr<base::TickClock>(clock_), message_loop_.task_runner(),
+        message_loop_.task_runner(), message_loop_.task_runner());
     encoder_.reset(new H264VideoToolboxEncoder(
         cast_environment_, video_sender_config_,
         base::Bind(&SaveOperationalStatus, &operational_status_)));
diff --git a/media/filters/chunk_demuxer.cc b/media/filters/chunk_demuxer.cc
index 1fd3a83..f8bffcd 100644
--- a/media/filters/chunk_demuxer.cc
+++ b/media/filters/chunk_demuxer.cc
@@ -26,864 +26,6 @@
 
 namespace media {
 
-static TimeDelta EndTimestamp(const StreamParser::BufferQueue& queue) {
-  return queue.back()->timestamp() + queue.back()->duration();
-}
-
-// List of time ranges for each SourceBuffer.
-typedef std::list<Ranges<TimeDelta> > RangesList;
-static Ranges<TimeDelta> ComputeIntersection(const RangesList& activeRanges,
-                                             bool ended) {
-  // Implementation of HTMLMediaElement.buffered algorithm in MSE spec.
-  // https://dvcs.w3.org/hg/html-media/raw-file/default/media-source/media-source.html#dom-htmlmediaelement.buffered
-
-  // Step 1: If activeSourceBuffers.length equals 0 then return an empty
-  //  TimeRanges object and abort these steps.
-  if (activeRanges.empty())
-    return Ranges<TimeDelta>();
-
-  // Step 2: Let active ranges be the ranges returned by buffered for each
-  //  SourceBuffer object in activeSourceBuffers.
-  // Step 3: Let highest end time be the largest range end time in the active
-  //  ranges.
-  TimeDelta highest_end_time;
-  for (RangesList::const_iterator itr = activeRanges.begin();
-       itr != activeRanges.end(); ++itr) {
-    if (!itr->size())
-      continue;
-
-    highest_end_time = std::max(highest_end_time, itr->end(itr->size() - 1));
-  }
-
-  // Step 4: Let intersection ranges equal a TimeRange object containing a
-  //  single range from 0 to highest end time.
-  Ranges<TimeDelta> intersection_ranges;
-  intersection_ranges.Add(TimeDelta(), highest_end_time);
-
-  // Step 5: For each SourceBuffer object in activeSourceBuffers run the
-  //  following steps:
-  for (RangesList::const_iterator itr = activeRanges.begin();
-       itr != activeRanges.end(); ++itr) {
-    // Step 5.1: Let source ranges equal the ranges returned by the buffered
-    //  attribute on the current SourceBuffer.
-    Ranges<TimeDelta> source_ranges = *itr;
-
-    // Step 5.2: If readyState is "ended", then set the end time on the last
-    //  range in source ranges to highest end time.
-    if (ended && source_ranges.size() > 0u) {
-      source_ranges.Add(source_ranges.start(source_ranges.size() - 1),
-                        highest_end_time);
-    }
-
-    // Step 5.3: Let new intersection ranges equal the intersection between
-    // the intersection ranges and the source ranges.
-    // Step 5.4: Replace the ranges in intersection ranges with the new
-    // intersection ranges.
-    intersection_ranges = intersection_ranges.IntersectionWith(source_ranges);
-  }
-
-  return intersection_ranges;
-}
-
-// Contains state belonging to a source id.
-// TODO: SourceState needs to be moved to a separate file and covered with unit
-// tests (see crbug.com/525836)
-class SourceState {
- public:
-  // Callback signature used to create ChunkDemuxerStreams.
-  typedef base::Callback<ChunkDemuxerStream*(
-      DemuxerStream::Type)> CreateDemuxerStreamCB;
-
-  typedef ChunkDemuxer::InitSegmentReceivedCB InitSegmentReceivedCB;
-
-  typedef base::Callback<void(
-      ChunkDemuxerStream*, const TextTrackConfig&)> NewTextTrackCB;
-
-  SourceState(scoped_ptr<StreamParser> stream_parser,
-              scoped_ptr<FrameProcessor> frame_processor,
-              const CreateDemuxerStreamCB& create_demuxer_stream_cb,
-              const scoped_refptr<MediaLog>& media_log);
-
-  ~SourceState();
-
-  void Init(const StreamParser::InitCB& init_cb,
-            bool allow_audio,
-            bool allow_video,
-            const StreamParser::EncryptedMediaInitDataCB&
-                encrypted_media_init_data_cb,
-            const NewTextTrackCB& new_text_track_cb);
-
-  // Appends new data to the StreamParser.
-  // Returns true if the data was successfully appended. Returns false if an
-  // error occurred. |*timestamp_offset| is used and possibly updated by the
-  // append. |append_window_start| and |append_window_end| correspond to the MSE
-  // spec's similarly named source buffer attributes that are used in coded
-  // frame processing. |init_segment_received_cb| is run for each new fully
-  // parsed initialization segment.
-  bool Append(const uint8_t* data,
-              size_t length,
-              TimeDelta append_window_start,
-              TimeDelta append_window_end,
-              TimeDelta* timestamp_offset,
-              const InitSegmentReceivedCB& init_segment_received_cb);
-
-  // Aborts the current append sequence and resets the parser.
-  void ResetParserState(TimeDelta append_window_start,
-                        TimeDelta append_window_end,
-                        TimeDelta* timestamp_offset);
-
-  // Calls Remove(|start|, |end|, |duration|) on all
-  // ChunkDemuxerStreams managed by this object.
-  void Remove(TimeDelta start, TimeDelta end, TimeDelta duration);
-
-  // If the buffer is full, attempts to try to free up space, as specified in
-  // the "Coded Frame Eviction Algorithm" in the Media Source Extensions Spec.
-  // Returns false iff buffer is still full after running eviction.
-  // https://w3c.github.io/media-source/#sourcebuffer-coded-frame-eviction
-  bool EvictCodedFrames(DecodeTimestamp media_time, size_t newDataSize);
-
-  // Returns true if currently parsing a media segment, or false otherwise.
-  bool parsing_media_segment() const { return parsing_media_segment_; }
-
-  // Sets |frame_processor_|'s sequence mode to |sequence_mode|.
-  void SetSequenceMode(bool sequence_mode);
-
-  // Signals the coded frame processor to update its group start timestamp to be
-  // |timestamp_offset| if it is in sequence append mode.
-  void SetGroupStartTimestampIfInSequenceMode(base::TimeDelta timestamp_offset);
-
-  // Returns the range of buffered data in this source, capped at |duration|.
-  // |ended| - Set to true if end of stream has been signaled and the special
-  // end of stream range logic needs to be executed.
-  Ranges<TimeDelta> GetBufferedRanges(TimeDelta duration, bool ended) const;
-
-  // Returns the highest buffered duration across all streams managed
-  // by this object.
-  // Returns TimeDelta() if none of the streams contain buffered data.
-  TimeDelta GetMaxBufferedDuration() const;
-
-  // Helper methods that call methods with similar names on all the
-  // ChunkDemuxerStreams managed by this object.
-  void StartReturningData();
-  void AbortReads();
-  void Seek(TimeDelta seek_time);
-  void CompletePendingReadIfPossible();
-  void OnSetDuration(TimeDelta duration);
-  void MarkEndOfStream();
-  void UnmarkEndOfStream();
-  void Shutdown();
-  // Sets the memory limit on each stream of a specific type.
-  // |memory_limit| is the maximum number of bytes each stream of type |type|
-  // is allowed to hold in its buffer.
-  void SetMemoryLimits(DemuxerStream::Type type, size_t memory_limit);
-  bool IsSeekWaitingForData() const;
-
- private:
-  // Called by the |stream_parser_| when a new initialization segment is
-  // encountered.
-  // Returns true on a successful call. Returns false if an error occurred while
-  // processing decoder configurations.
-  bool OnNewConfigs(bool allow_audio, bool allow_video,
-                    const AudioDecoderConfig& audio_config,
-                    const VideoDecoderConfig& video_config,
-                    const StreamParser::TextTrackConfigMap& text_configs);
-
-  // Called by the |stream_parser_| at the beginning of a new media segment.
-  void OnNewMediaSegment();
-
-  // Called by the |stream_parser_| at the end of a media segment.
-  void OnEndOfMediaSegment();
-
-  // Called by the |stream_parser_| when new buffers have been parsed.
-  // It processes the new buffers using |frame_processor_|, which includes
-  // appending the processed frames to associated demuxer streams for each
-  // frame's track.
-  // Returns true on a successful call. Returns false if an error occurred while
-  // processing the buffers.
-  bool OnNewBuffers(const StreamParser::BufferQueue& audio_buffers,
-                    const StreamParser::BufferQueue& video_buffers,
-                    const StreamParser::TextBufferQueueMap& text_map);
-
-  void OnSourceInitDone(const StreamParser::InitParameters& params);
-
-  // EstimateVideoDataSize uses some heuristics to estimate the size of the
-  // video size in the chunk of muxed audio/video data without parsing it.
-  // This is used by EvictCodedFrames algorithm, which happens before Append
-  // (and therefore before parsing is performed) to prepare space for new data.
-  size_t EstimateVideoDataSize(size_t muxed_data_chunk_size) const;
-
-  CreateDemuxerStreamCB create_demuxer_stream_cb_;
-  NewTextTrackCB new_text_track_cb_;
-
-  // During Append(), if OnNewBuffers() coded frame processing updates the
-  // timestamp offset then |*timestamp_offset_during_append_| is also updated
-  // so Append()'s caller can know the new offset. This pointer is only non-NULL
-  // during the lifetime of an Append() call.
-  TimeDelta* timestamp_offset_during_append_;
-
-  // During Append(), coded frame processing triggered by OnNewBuffers()
-  // requires these two attributes. These are only valid during the lifetime of
-  // an Append() call.
-  TimeDelta append_window_start_during_append_;
-  TimeDelta append_window_end_during_append_;
-
-  // Set to true if the next buffers appended within the append window
-  // represent the start of a new media segment. This flag being set
-  // triggers a call to |new_segment_cb_| when the new buffers are
-  // appended. The flag is set on actual media segment boundaries and
-  // when the "append window" filtering causes discontinuities in the
-  // appended data.
-  // TODO(wolenetz/acolwell): Investigate if we need this, or if coded frame
-  // processing's discontinuity logic is enough. See http://crbug.com/351489.
-  bool new_media_segment_;
-
-  // Keeps track of whether a media segment is being parsed.
-  bool parsing_media_segment_;
-
-  // The object used to parse appended data.
-  scoped_ptr<StreamParser> stream_parser_;
-
-  ChunkDemuxerStream* audio_;  // Not owned by |this|.
-  ChunkDemuxerStream* video_;  // Not owned by |this|.
-
-  typedef std::map<StreamParser::TrackId, ChunkDemuxerStream*> TextStreamMap;
-  TextStreamMap text_stream_map_;  // |this| owns the map's stream pointers.
-
-  scoped_ptr<FrameProcessor> frame_processor_;
-  scoped_refptr<MediaLog> media_log_;
-  StreamParser::InitCB init_cb_;
-
-  // During Append(), OnNewConfigs() will trigger the initialization segment
-  // received algorithm. This callback is only non-NULL during the lifetime of
-  // an Append() call. Note, the MSE spec explicitly disallows this algorithm
-  // during an Abort(), since Abort() is allowed only to emit coded frames, and
-  // only if the parser is PARSING_MEDIA_SEGMENT (not an INIT segment).
-  InitSegmentReceivedCB init_segment_received_cb_;
-
-  // Indicates that timestampOffset should be updated automatically during
-  // OnNewBuffers() based on the earliest end timestamp of the buffers provided.
-  // TODO(wolenetz): Refactor this function while integrating April 29, 2014
-  // changes to MSE spec. See http://crbug.com/371499.
-  bool auto_update_timestamp_offset_;
-
-  DISALLOW_COPY_AND_ASSIGN(SourceState);
-};
-
-SourceState::SourceState(scoped_ptr<StreamParser> stream_parser,
-                         scoped_ptr<FrameProcessor> frame_processor,
-                         const CreateDemuxerStreamCB& create_demuxer_stream_cb,
-                         const scoped_refptr<MediaLog>& media_log)
-    : create_demuxer_stream_cb_(create_demuxer_stream_cb),
-      timestamp_offset_during_append_(NULL),
-      new_media_segment_(false),
-      parsing_media_segment_(false),
-      stream_parser_(stream_parser.release()),
-      audio_(NULL),
-      video_(NULL),
-      frame_processor_(frame_processor.release()),
-      media_log_(media_log),
-      auto_update_timestamp_offset_(false) {
-  DCHECK(!create_demuxer_stream_cb_.is_null());
-  DCHECK(frame_processor_);
-}
-
-SourceState::~SourceState() {
-  Shutdown();
-
-  STLDeleteValues(&text_stream_map_);
-}
-
-void SourceState::Init(
-    const StreamParser::InitCB& init_cb,
-    bool allow_audio,
-    bool allow_video,
-    const StreamParser::EncryptedMediaInitDataCB& encrypted_media_init_data_cb,
-    const NewTextTrackCB& new_text_track_cb) {
-  new_text_track_cb_ = new_text_track_cb;
-  init_cb_ = init_cb;
-
-  stream_parser_->Init(
-      base::Bind(&SourceState::OnSourceInitDone, base::Unretained(this)),
-      base::Bind(&SourceState::OnNewConfigs, base::Unretained(this),
-                 allow_audio, allow_video),
-      base::Bind(&SourceState::OnNewBuffers, base::Unretained(this)),
-      new_text_track_cb_.is_null(), encrypted_media_init_data_cb,
-      base::Bind(&SourceState::OnNewMediaSegment, base::Unretained(this)),
-      base::Bind(&SourceState::OnEndOfMediaSegment, base::Unretained(this)),
-      media_log_);
-}
-
-void SourceState::SetSequenceMode(bool sequence_mode) {
-  DCHECK(!parsing_media_segment_);
-
-  frame_processor_->SetSequenceMode(sequence_mode);
-}
-
-void SourceState::SetGroupStartTimestampIfInSequenceMode(
-    base::TimeDelta timestamp_offset) {
-  DCHECK(!parsing_media_segment_);
-
-  frame_processor_->SetGroupStartTimestampIfInSequenceMode(timestamp_offset);
-}
-
-bool SourceState::Append(
-    const uint8_t* data,
-    size_t length,
-    TimeDelta append_window_start,
-    TimeDelta append_window_end,
-    TimeDelta* timestamp_offset,
-    const InitSegmentReceivedCB& init_segment_received_cb) {
-  DCHECK(timestamp_offset);
-  DCHECK(!timestamp_offset_during_append_);
-  DCHECK(!init_segment_received_cb.is_null());
-  DCHECK(init_segment_received_cb_.is_null());
-  append_window_start_during_append_ = append_window_start;
-  append_window_end_during_append_ = append_window_end;
-  timestamp_offset_during_append_ = timestamp_offset;
-  init_segment_received_cb_= init_segment_received_cb;
-
-  // TODO(wolenetz/acolwell): Curry and pass a NewBuffersCB here bound with
-  // append window and timestamp offset pointer. See http://crbug.com/351454.
-  bool result = stream_parser_->Parse(data, length);
-  if (!result) {
-    MEDIA_LOG(ERROR, media_log_)
-        << __FUNCTION__ << ": stream parsing failed."
-        << " Data size=" << length
-        << " append_window_start=" << append_window_start.InSecondsF()
-        << " append_window_end=" << append_window_end.InSecondsF();
-  }
-  timestamp_offset_during_append_ = NULL;
-  init_segment_received_cb_.Reset();
-  return result;
-}
-
-void SourceState::ResetParserState(TimeDelta append_window_start,
-                                   TimeDelta append_window_end,
-                                   base::TimeDelta* timestamp_offset) {
-  DCHECK(timestamp_offset);
-  DCHECK(!timestamp_offset_during_append_);
-  timestamp_offset_during_append_ = timestamp_offset;
-  append_window_start_during_append_ = append_window_start;
-  append_window_end_during_append_ = append_window_end;
-
-  stream_parser_->Flush();
-  timestamp_offset_during_append_ = NULL;
-
-  frame_processor_->Reset();
-  parsing_media_segment_ = false;
-}
-
-void SourceState::Remove(TimeDelta start, TimeDelta end, TimeDelta duration) {
-  if (audio_)
-    audio_->Remove(start, end, duration);
-
-  if (video_)
-    video_->Remove(start, end, duration);
-
-  for (TextStreamMap::iterator itr = text_stream_map_.begin();
-       itr != text_stream_map_.end(); ++itr) {
-    itr->second->Remove(start, end, duration);
-  }
-}
-
-size_t SourceState::EstimateVideoDataSize(size_t muxed_data_chunk_size) const {
-  DCHECK(audio_);
-  DCHECK(video_);
-
-  size_t videoBufferedSize = video_->GetBufferedSize();
-  size_t audioBufferedSize = audio_->GetBufferedSize();
-  if (videoBufferedSize == 0 || audioBufferedSize == 0) {
-    // At this point either audio or video buffer is empty, which means buffer
-    // levels are probably low anyway and we should have enough space in the
-    // buffers for appending new data, so just take a very rough guess.
-    return muxed_data_chunk_size * 7 / 8;
-  }
-
-  // We need to estimate how much audio and video data is going to be in the
-  // newly appended data chunk to make space for the new data. And we need to do
-  // that without parsing the data (which will happen later, in the Append
-  // phase). So for now we can only rely on some heuristic here. Let's assume
-  // that the proportion of the audio/video in the new data chunk is the same as
-  // the current ratio of buffered audio/video.
-  // Longer term this should go away once we further change the MSE GC algorithm
-  // to work across all streams of a SourceBuffer (see crbug.com/520704).
-  double videoBufferedSizeF = static_cast<double>(videoBufferedSize);
-  double audioBufferedSizeF = static_cast<double>(audioBufferedSize);
-
-  double totalBufferedSizeF = videoBufferedSizeF + audioBufferedSizeF;
-  CHECK_GT(totalBufferedSizeF, 0.0);
-
-  double videoRatio = videoBufferedSizeF / totalBufferedSizeF;
-  CHECK_GE(videoRatio, 0.0);
-  CHECK_LE(videoRatio, 1.0);
-  double estimatedVideoSize = muxed_data_chunk_size * videoRatio;
-  return static_cast<size_t>(estimatedVideoSize);
-}
-
-bool SourceState::EvictCodedFrames(DecodeTimestamp media_time,
-                                   size_t newDataSize) {
-  bool success = true;
-
-  DVLOG(3) << __FUNCTION__ << " media_time=" << media_time.InSecondsF()
-           << " newDataSize=" << newDataSize
-           << " videoBufferedSize=" << (video_ ? video_->GetBufferedSize() : 0)
-           << " audioBufferedSize=" << (audio_ ? audio_->GetBufferedSize() : 0);
-
-  size_t newAudioSize = 0;
-  size_t newVideoSize = 0;
-  if (audio_ && video_) {
-    newVideoSize = EstimateVideoDataSize(newDataSize);
-    newAudioSize = newDataSize - newVideoSize;
-  } else if (video_) {
-    newVideoSize = newDataSize;
-  } else if (audio_) {
-    newAudioSize = newDataSize;
-  }
-
-  DVLOG(3) << __FUNCTION__ << " estimated audio/video sizes: "
-           << " newVideoSize=" << newVideoSize
-           << " newAudioSize=" << newAudioSize;
-
-  if (audio_)
-    success = audio_->EvictCodedFrames(media_time, newAudioSize) && success;
-
-  if (video_)
-    success = video_->EvictCodedFrames(media_time, newVideoSize) && success;
-
-  for (TextStreamMap::iterator itr = text_stream_map_.begin();
-       itr != text_stream_map_.end(); ++itr) {
-    success = itr->second->EvictCodedFrames(media_time, 0) && success;
-  }
-
-  DVLOG(3) << __FUNCTION__ << " result=" << success
-           << " videoBufferedSize=" << (video_ ? video_->GetBufferedSize() : 0)
-           << " audioBufferedSize=" << (audio_ ? audio_->GetBufferedSize() : 0);
-
-  return success;
-}
-
-Ranges<TimeDelta> SourceState::GetBufferedRanges(TimeDelta duration,
-                                                 bool ended) const {
-  // TODO(acolwell): When we start allowing disabled tracks we'll need to update
-  // this code to only add ranges from active tracks.
-  RangesList ranges_list;
-  if (audio_)
-    ranges_list.push_back(audio_->GetBufferedRanges(duration));
-
-  if (video_)
-    ranges_list.push_back(video_->GetBufferedRanges(duration));
-
-  for (TextStreamMap::const_iterator itr = text_stream_map_.begin();
-       itr != text_stream_map_.end(); ++itr) {
-    ranges_list.push_back(itr->second->GetBufferedRanges(duration));
-  }
-
-  return ComputeIntersection(ranges_list, ended);
-}
-
-TimeDelta SourceState::GetMaxBufferedDuration() const {
-  TimeDelta max_duration;
-
-  if (audio_)
-    max_duration = std::max(max_duration, audio_->GetBufferedDuration());
-
-  if (video_)
-    max_duration = std::max(max_duration, video_->GetBufferedDuration());
-
-  for (TextStreamMap::const_iterator itr = text_stream_map_.begin();
-       itr != text_stream_map_.end(); ++itr) {
-    max_duration = std::max(max_duration, itr->second->GetBufferedDuration());
-  }
-
-  return max_duration;
-}
-
-void SourceState::StartReturningData() {
-  if (audio_)
-    audio_->StartReturningData();
-
-  if (video_)
-    video_->StartReturningData();
-
-  for (TextStreamMap::iterator itr = text_stream_map_.begin();
-       itr != text_stream_map_.end(); ++itr) {
-    itr->second->StartReturningData();
-  }
-}
-
-void SourceState::AbortReads() {
-  if (audio_)
-    audio_->AbortReads();
-
-  if (video_)
-    video_->AbortReads();
-
-  for (TextStreamMap::iterator itr = text_stream_map_.begin();
-       itr != text_stream_map_.end(); ++itr) {
-    itr->second->AbortReads();
-  }
-}
-
-void SourceState::Seek(TimeDelta seek_time) {
-  if (audio_)
-    audio_->Seek(seek_time);
-
-  if (video_)
-    video_->Seek(seek_time);
-
-  for (TextStreamMap::iterator itr = text_stream_map_.begin();
-       itr != text_stream_map_.end(); ++itr) {
-    itr->second->Seek(seek_time);
-  }
-}
-
-void SourceState::CompletePendingReadIfPossible() {
-  if (audio_)
-    audio_->CompletePendingReadIfPossible();
-
-  if (video_)
-    video_->CompletePendingReadIfPossible();
-
-  for (TextStreamMap::iterator itr = text_stream_map_.begin();
-       itr != text_stream_map_.end(); ++itr) {
-    itr->second->CompletePendingReadIfPossible();
-  }
-}
-
-void SourceState::OnSetDuration(TimeDelta duration) {
-  if (audio_)
-    audio_->OnSetDuration(duration);
-
-  if (video_)
-    video_->OnSetDuration(duration);
-
-  for (TextStreamMap::iterator itr = text_stream_map_.begin();
-       itr != text_stream_map_.end(); ++itr) {
-    itr->second->OnSetDuration(duration);
-  }
-}
-
-void SourceState::MarkEndOfStream() {
-  if (audio_)
-    audio_->MarkEndOfStream();
-
-  if (video_)
-    video_->MarkEndOfStream();
-
-  for (TextStreamMap::iterator itr = text_stream_map_.begin();
-       itr != text_stream_map_.end(); ++itr) {
-    itr->second->MarkEndOfStream();
-  }
-}
-
-void SourceState::UnmarkEndOfStream() {
-  if (audio_)
-    audio_->UnmarkEndOfStream();
-
-  if (video_)
-    video_->UnmarkEndOfStream();
-
-  for (TextStreamMap::iterator itr = text_stream_map_.begin();
-       itr != text_stream_map_.end(); ++itr) {
-    itr->second->UnmarkEndOfStream();
-  }
-}
-
-void SourceState::Shutdown() {
-  if (audio_)
-    audio_->Shutdown();
-
-  if (video_)
-    video_->Shutdown();
-
-  for (TextStreamMap::iterator itr = text_stream_map_.begin();
-       itr != text_stream_map_.end(); ++itr) {
-    itr->second->Shutdown();
-  }
-}
-
-void SourceState::SetMemoryLimits(DemuxerStream::Type type,
-                                  size_t memory_limit) {
-  switch (type) {
-    case DemuxerStream::AUDIO:
-      if (audio_)
-        audio_->SetStreamMemoryLimit(memory_limit);
-      break;
-    case DemuxerStream::VIDEO:
-      if (video_)
-        video_->SetStreamMemoryLimit(memory_limit);
-      break;
-    case DemuxerStream::TEXT:
-      for (TextStreamMap::iterator itr = text_stream_map_.begin();
-           itr != text_stream_map_.end(); ++itr) {
-        itr->second->SetStreamMemoryLimit(memory_limit);
-      }
-      break;
-    case DemuxerStream::UNKNOWN:
-    case DemuxerStream::NUM_TYPES:
-      NOTREACHED();
-      break;
-  }
-}
-
-bool SourceState::IsSeekWaitingForData() const {
-  if (audio_ && audio_->IsSeekWaitingForData())
-    return true;
-
-  if (video_ && video_->IsSeekWaitingForData())
-    return true;
-
-  // NOTE: We are intentionally not checking the text tracks
-  // because text tracks are discontinuous and may not have data
-  // for the seek position. This is ok and playback should not be
-  // stalled because we don't have cues. If cues, with timestamps after
-  // the seek time, eventually arrive they will be delivered properly
-  // in response to ChunkDemuxerStream::Read() calls.
-
-  return false;
-}
-
-bool SourceState::OnNewConfigs(
-    bool allow_audio, bool allow_video,
-    const AudioDecoderConfig& audio_config,
-    const VideoDecoderConfig& video_config,
-    const StreamParser::TextTrackConfigMap& text_configs) {
-  DVLOG(1) << "OnNewConfigs(" << allow_audio << ", " << allow_video
-           << ", " << audio_config.IsValidConfig()
-           << ", " << video_config.IsValidConfig() << ")";
-  DCHECK(!init_segment_received_cb_.is_null());
-
-  if (!audio_config.IsValidConfig() && !video_config.IsValidConfig()) {
-    DVLOG(1) << "OnNewConfigs() : Audio & video config are not valid!";
-    return false;
-  }
-
-  // Signal an error if we get configuration info for stream types that weren't
-  // specified in AddId() or more configs after a stream is initialized.
-  if (allow_audio != audio_config.IsValidConfig()) {
-    MEDIA_LOG(ERROR, media_log_)
-        << "Initialization segment"
-        << (audio_config.IsValidConfig() ? " has" : " does not have")
-        << " an audio track, but the mimetype"
-        << (allow_audio ? " specifies" : " does not specify")
-        << " an audio codec.";
-    return false;
-  }
-
-  if (allow_video != video_config.IsValidConfig()) {
-    MEDIA_LOG(ERROR, media_log_)
-        << "Initialization segment"
-        << (video_config.IsValidConfig() ? " has" : " does not have")
-        << " a video track, but the mimetype"
-        << (allow_video ? " specifies" : " does not specify")
-        << " a video codec.";
-    return false;
-  }
-
-  bool success = true;
-  if (audio_config.IsValidConfig()) {
-    if (!audio_) {
-      media_log_->SetBooleanProperty("found_audio_stream", true);
-    }
-    if (!audio_ ||
-        audio_->audio_decoder_config().codec() != audio_config.codec()) {
-      media_log_->SetStringProperty("audio_codec_name",
-                                    GetCodecName(audio_config.codec()));
-    }
-
-    if (!audio_) {
-      audio_ = create_demuxer_stream_cb_.Run(DemuxerStream::AUDIO);
-
-      if (!audio_) {
-        DVLOG(1) << "Failed to create an audio stream.";
-        return false;
-      }
-
-      if (!frame_processor_->AddTrack(FrameProcessor::kAudioTrackId, audio_)) {
-        DVLOG(1) << "Failed to add audio track to frame processor.";
-        return false;
-      }
-    }
-
-    frame_processor_->OnPossibleAudioConfigUpdate(audio_config);
-    success &= audio_->UpdateAudioConfig(audio_config, media_log_);
-  }
-
-  if (video_config.IsValidConfig()) {
-    if (!video_) {
-      media_log_->SetBooleanProperty("found_video_stream", true);
-    }
-    if (!video_ ||
-        video_->video_decoder_config().codec() != video_config.codec()) {
-      media_log_->SetStringProperty("video_codec_name",
-                                    GetCodecName(video_config.codec()));
-    }
-
-    if (!video_) {
-      video_ = create_demuxer_stream_cb_.Run(DemuxerStream::VIDEO);
-
-      if (!video_) {
-        DVLOG(1) << "Failed to create a video stream.";
-        return false;
-      }
-
-      if (!frame_processor_->AddTrack(FrameProcessor::kVideoTrackId, video_)) {
-        DVLOG(1) << "Failed to add video track to frame processor.";
-        return false;
-      }
-    }
-
-    success &= video_->UpdateVideoConfig(video_config, media_log_);
-  }
-
-  typedef StreamParser::TextTrackConfigMap::const_iterator TextConfigItr;
-  if (text_stream_map_.empty()) {
-    for (TextConfigItr itr = text_configs.begin();
-         itr != text_configs.end(); ++itr) {
-      ChunkDemuxerStream* const text_stream =
-          create_demuxer_stream_cb_.Run(DemuxerStream::TEXT);
-      if (!frame_processor_->AddTrack(itr->first, text_stream)) {
-        success &= false;
-        MEDIA_LOG(ERROR, media_log_) << "Failed to add text track ID "
-                                     << itr->first << " to frame processor.";
-        break;
-      }
-      text_stream->UpdateTextConfig(itr->second, media_log_);
-      text_stream_map_[itr->first] = text_stream;
-      new_text_track_cb_.Run(text_stream, itr->second);
-    }
-  } else {
-    const size_t text_count = text_stream_map_.size();
-    if (text_configs.size() != text_count) {
-      success &= false;
-      MEDIA_LOG(ERROR, media_log_)
-          << "The number of text track configs changed.";
-    } else if (text_count == 1) {
-      TextConfigItr config_itr = text_configs.begin();
-      TextStreamMap::iterator stream_itr = text_stream_map_.begin();
-      ChunkDemuxerStream* text_stream = stream_itr->second;
-      TextTrackConfig old_config = text_stream->text_track_config();
-      TextTrackConfig new_config(config_itr->second.kind(),
-                                 config_itr->second.label(),
-                                 config_itr->second.language(),
-                                 old_config.id());
-      if (!new_config.Matches(old_config)) {
-        success &= false;
-        MEDIA_LOG(ERROR, media_log_)
-            << "New text track config does not match old one.";
-      } else {
-        StreamParser::TrackId old_id = stream_itr->first;
-        StreamParser::TrackId new_id = config_itr->first;
-        if (new_id != old_id) {
-          if (frame_processor_->UpdateTrack(old_id, new_id)) {
-            text_stream_map_.clear();
-            text_stream_map_[config_itr->first] = text_stream;
-          } else {
-            success &= false;
-            MEDIA_LOG(ERROR, media_log_)
-                << "Error remapping single text track number";
-          }
-        }
-      }
-    } else {
-      for (TextConfigItr config_itr = text_configs.begin();
-           config_itr != text_configs.end(); ++config_itr) {
-        TextStreamMap::iterator stream_itr =
-            text_stream_map_.find(config_itr->first);
-        if (stream_itr == text_stream_map_.end()) {
-          success &= false;
-          MEDIA_LOG(ERROR, media_log_)
-              << "Unexpected text track configuration for track ID "
-              << config_itr->first;
-          break;
-        }
-
-        const TextTrackConfig& new_config = config_itr->second;
-        ChunkDemuxerStream* stream = stream_itr->second;
-        TextTrackConfig old_config = stream->text_track_config();
-        if (!new_config.Matches(old_config)) {
-          success &= false;
-          MEDIA_LOG(ERROR, media_log_) << "New text track config for track ID "
-                                       << config_itr->first
-                                       << " does not match old one.";
-          break;
-        }
-      }
-    }
-  }
-
-  frame_processor_->SetAllTrackBuffersNeedRandomAccessPoint();
-
-  DVLOG(1) << "OnNewConfigs() : " << (success ? "success" : "failed");
-  if (success)
-    init_segment_received_cb_.Run();
-
-  return success;
-}
-
-void SourceState::OnNewMediaSegment() {
-  DVLOG(2) << "OnNewMediaSegment()";
-  parsing_media_segment_ = true;
-  new_media_segment_ = true;
-}
-
-void SourceState::OnEndOfMediaSegment() {
-  DVLOG(2) << "OnEndOfMediaSegment()";
-  parsing_media_segment_ = false;
-  new_media_segment_ = false;
-}
-
-bool SourceState::OnNewBuffers(
-    const StreamParser::BufferQueue& audio_buffers,
-    const StreamParser::BufferQueue& video_buffers,
-    const StreamParser::TextBufferQueueMap& text_map) {
-  DVLOG(2) << "OnNewBuffers()";
-  DCHECK(timestamp_offset_during_append_);
-  DCHECK(parsing_media_segment_);
-
-  const TimeDelta timestamp_offset_before_processing =
-      *timestamp_offset_during_append_;
-
-  // Calculate the new timestamp offset for audio/video tracks if the stream
-  // parser has requested automatic updates.
-  TimeDelta new_timestamp_offset = timestamp_offset_before_processing;
-  if (auto_update_timestamp_offset_) {
-    const bool have_audio_buffers = !audio_buffers.empty();
-    const bool have_video_buffers = !video_buffers.empty();
-    if (have_audio_buffers && have_video_buffers) {
-      new_timestamp_offset +=
-          std::min(EndTimestamp(audio_buffers), EndTimestamp(video_buffers));
-    } else if (have_audio_buffers) {
-      new_timestamp_offset += EndTimestamp(audio_buffers);
-    } else if (have_video_buffers) {
-      new_timestamp_offset += EndTimestamp(video_buffers);
-    }
-  }
-
-  if (!frame_processor_->ProcessFrames(audio_buffers,
-                                       video_buffers,
-                                       text_map,
-                                       append_window_start_during_append_,
-                                       append_window_end_during_append_,
-                                       &new_media_segment_,
-                                       timestamp_offset_during_append_)) {
-    return false;
-  }
-
-  // Only update the timestamp offset if the frame processor hasn't already.
-  if (auto_update_timestamp_offset_ &&
-      timestamp_offset_before_processing == *timestamp_offset_during_append_) {
-    *timestamp_offset_during_append_ = new_timestamp_offset;
-  }
-
-  return true;
-}
-
-void SourceState::OnSourceInitDone(const StreamParser::InitParameters& params) {
-  auto_update_timestamp_offset_ = params.auto_update_timestamp_offset;
-  base::ResetAndReturn(&init_cb_).Run(params);
-}
-
 ChunkDemuxerStream::ChunkDemuxerStream(Type type,
                                        bool splice_frames_enabled)
     : type_(type),
@@ -933,7 +75,7 @@
   base::AutoLock auto_lock(lock_);
 
   // This method should not be called for text tracks. See the note in
-  // SourceState::IsSeekWaitingForData().
+  // MediaSourceState::IsSeekWaitingForData().
   DCHECK_NE(type_, DemuxerStream::TEXT);
 
   return stream_->IsSeekPending();
@@ -1386,12 +528,12 @@
                                     base::Unretained(this)),
                          media_log_));
 
-  scoped_ptr<SourceState> source_state(new SourceState(
+  scoped_ptr<MediaSourceState> source_state(new MediaSourceState(
       std::move(stream_parser), std::move(frame_processor),
       base::Bind(&ChunkDemuxer::CreateDemuxerStream, base::Unretained(this)),
       media_log_));
 
-  SourceState::NewTextTrackCB new_text_track_cb;
+  MediaSourceState::NewTextTrackCB new_text_track_cb;
 
   if (enable_text_) {
     new_text_track_cb = base::Bind(&ChunkDemuxer::OnNewTextTrack,
@@ -1424,7 +566,7 @@
   base::AutoLock auto_lock(lock_);
   DCHECK(!id.empty());
 
-  SourceStateMap::const_iterator itr = source_state_map_.find(id);
+  MediaSourceStateMap::const_iterator itr = source_state_map_.find(id);
 
   DCHECK(itr != source_state_map_.end());
   return itr->second->GetBufferedRanges(duration_, state_ == ENDED);
@@ -1445,7 +587,7 @@
       DecodeTimestamp::FromPresentationTime(currentMediaTime);
 
   DCHECK(!id.empty());
-  SourceStateMap::const_iterator itr = source_state_map_.find(id);
+  MediaSourceStateMap::const_iterator itr = source_state_map_.find(id);
   if (itr == source_state_map_.end()) {
     LOG(WARNING) << __FUNCTION__ << " stream " << id << " not found";
     return false;
@@ -1460,7 +602,7 @@
     TimeDelta append_window_start,
     TimeDelta append_window_end,
     TimeDelta* timestamp_offset,
-    const InitSegmentReceivedCB& init_segment_received_cb) {
+    const MediaSourceState::InitSegmentReceivedCB& init_segment_received_cb) {
   DVLOG(1) << "AppendData(" << id << ", " << length << ")";
 
   DCHECK(!id.empty());
@@ -1619,7 +761,7 @@
   duration_ = duration_td;
   host_->SetDuration(duration_);
 
-  for (SourceStateMap::iterator itr = source_state_map_.begin();
+  for (MediaSourceStateMap::iterator itr = source_state_map_.begin();
        itr != source_state_map_.end(); ++itr) {
     itr->second->OnSetDuration(duration_);
   }
@@ -1672,7 +814,7 @@
   }
 
   bool old_waiting_for_data = IsSeekWaitingForData_Locked();
-  for (SourceStateMap::iterator itr = source_state_map_.begin();
+  for (MediaSourceStateMap::iterator itr = source_state_map_.begin();
        itr != source_state_map_.end(); ++itr) {
     itr->second->MarkEndOfStream();
   }
@@ -1701,7 +843,7 @@
 
   ChangeState_Locked(INITIALIZED);
 
-  for (SourceStateMap::iterator itr = source_state_map_.begin();
+  for (MediaSourceStateMap::iterator itr = source_state_map_.begin();
        itr != source_state_map_.end(); ++itr) {
     itr->second->UnmarkEndOfStream();
   }
@@ -1724,7 +866,7 @@
 
 void ChunkDemuxer::SetMemoryLimits(DemuxerStream::Type type,
                                    size_t memory_limit) {
-  for (SourceStateMap::iterator itr = source_state_map_.begin();
+  for (MediaSourceStateMap::iterator itr = source_state_map_.begin();
        itr != source_state_map_.end(); ++itr) {
     itr->second->SetMemoryLimits(type, memory_limit);
   }
@@ -1772,7 +914,7 @@
 
 bool ChunkDemuxer::IsSeekWaitingForData_Locked() const {
   lock_.AssertAcquired();
-  for (SourceStateMap::const_iterator itr = source_state_map_.begin();
+  for (MediaSourceStateMap::const_iterator itr = source_state_map_.begin();
        itr != source_state_map_.end(); ++itr) {
     if (itr->second->IsSeekWaitingForData())
       return true;
@@ -1905,7 +1047,7 @@
 
   TimeDelta max_duration;
 
-  for (SourceStateMap::const_iterator itr = source_state_map_.begin();
+  for (MediaSourceStateMap::const_iterator itr = source_state_map_.begin();
        itr != source_state_map_.end(); ++itr) {
     max_duration = std::max(max_duration,
                             itr->second->GetMaxBufferedDuration());
@@ -1929,45 +1071,45 @@
   bool ended = state_ == ENDED;
   // TODO(acolwell): When we start allowing SourceBuffers that are not active,
   // we'll need to update this loop to only add ranges from active sources.
-  RangesList ranges_list;
-  for (SourceStateMap::const_iterator itr = source_state_map_.begin();
+  MediaSourceState::RangesList ranges_list;
+  for (MediaSourceStateMap::const_iterator itr = source_state_map_.begin();
        itr != source_state_map_.end(); ++itr) {
     ranges_list.push_back(itr->second->GetBufferedRanges(duration_, ended));
   }
 
-  return ComputeIntersection(ranges_list, ended);
+  return MediaSourceState::ComputeRangesIntersection(ranges_list, ended);
 }
 
 void ChunkDemuxer::StartReturningData() {
-  for (SourceStateMap::iterator itr = source_state_map_.begin();
+  for (MediaSourceStateMap::iterator itr = source_state_map_.begin();
        itr != source_state_map_.end(); ++itr) {
     itr->second->StartReturningData();
   }
 }
 
 void ChunkDemuxer::AbortPendingReads() {
-  for (SourceStateMap::iterator itr = source_state_map_.begin();
+  for (MediaSourceStateMap::iterator itr = source_state_map_.begin();
        itr != source_state_map_.end(); ++itr) {
     itr->second->AbortReads();
   }
 }
 
 void ChunkDemuxer::SeekAllSources(TimeDelta seek_time) {
-  for (SourceStateMap::iterator itr = source_state_map_.begin();
+  for (MediaSourceStateMap::iterator itr = source_state_map_.begin();
        itr != source_state_map_.end(); ++itr) {
     itr->second->Seek(seek_time);
   }
 }
 
 void ChunkDemuxer::CompletePendingReadsIfPossible() {
-  for (SourceStateMap::iterator itr = source_state_map_.begin();
+  for (MediaSourceStateMap::iterator itr = source_state_map_.begin();
        itr != source_state_map_.end(); ++itr) {
     itr->second->CompletePendingReadIfPossible();
   }
 }
 
 void ChunkDemuxer::ShutdownAllStreams() {
-  for (SourceStateMap::iterator itr = source_state_map_.begin();
+  for (MediaSourceStateMap::iterator itr = source_state_map_.begin();
        itr != source_state_map_.end(); ++itr) {
     itr->second->Shutdown();
   }
diff --git a/media/filters/chunk_demuxer.h b/media/filters/chunk_demuxer.h
index d07caab..6954793 100644
--- a/media/filters/chunk_demuxer.h
+++ b/media/filters/chunk_demuxer.h
@@ -21,12 +21,12 @@
 #include "media/base/demuxer_stream.h"
 #include "media/base/ranges.h"
 #include "media/base/stream_parser.h"
+#include "media/filters/media_source_state.h"
 #include "media/filters/source_buffer_stream.h"
 
 namespace media {
 
 class FFmpegURLProtocol;
-class SourceState;
 
 class MEDIA_EXPORT ChunkDemuxerStream : public DemuxerStream {
  public:
@@ -157,8 +157,6 @@
     kReachedIdLimit,  // Reached ID limit. We can't handle any more IDs.
   };
 
-  typedef base::Closure InitSegmentReceivedCB;
-
   // |open_cb| Run when Initialize() is called to signal that the demuxer
   //   is ready to receive media data via AppenData().
   // |encrypted_media_init_data_cb| Run when the demuxer determines that an
@@ -237,13 +235,14 @@
   // processing.
   // |init_segment_received_cb| is run for each newly successfully parsed
   // initialization segment.
-  void AppendData(const std::string& id,
-                  const uint8_t* data,
-                  size_t length,
-                  base::TimeDelta append_window_start,
-                  base::TimeDelta append_window_end,
-                  base::TimeDelta* timestamp_offset,
-                  const InitSegmentReceivedCB& init_segment_received_cb);
+  void AppendData(
+      const std::string& id,
+      const uint8_t* data,
+      size_t length,
+      base::TimeDelta append_window_start,
+      base::TimeDelta append_window_end,
+      base::TimeDelta* timestamp_offset,
+      const MediaSourceState::InitSegmentReceivedCB& init_segment_received_cb);
 
   // Aborts parsing the current segment and reset the parser to a state where
   // it can accept a new segment.
@@ -333,7 +332,7 @@
   // false if any can not.
   bool CanEndOfStream_Locked() const;
 
-  // SourceState callbacks.
+  // MediaSourceState callbacks.
   void OnSourceInitDone(const StreamParser::InitParameters& params);
 
   // Creates a DemuxerStream for the specified |type|.
@@ -411,8 +410,8 @@
   base::Time timeline_offset_;
   DemuxerStream::Liveness liveness_;
 
-  typedef std::map<std::string, SourceState*> SourceStateMap;
-  SourceStateMap source_state_map_;
+  typedef std::map<std::string, MediaSourceState*> MediaSourceStateMap;
+  MediaSourceStateMap source_state_map_;
 
   // Used to ensure that (1) config data matches the type and codec provided in
   // AddId(), (2) only 1 audio and 1 video sources are added, and (3) ids may be
diff --git a/media/filters/chunk_demuxer_unittest.cc b/media/filters/chunk_demuxer_unittest.cc
index 94698d4..5e1f777 100644
--- a/media/filters/chunk_demuxer_unittest.cc
+++ b/media/filters/chunk_demuxer_unittest.cc
@@ -1199,7 +1199,7 @@
   MockDemuxerHost host_;
 
   scoped_ptr<ChunkDemuxer> demuxer_;
-  ChunkDemuxer::InitSegmentReceivedCB init_segment_received_cb_;
+  MediaSourceState::InitSegmentReceivedCB init_segment_received_cb_;
 
   base::TimeDelta append_window_start_for_next_append_;
   base::TimeDelta append_window_end_for_next_append_;
diff --git a/media/filters/media_source_state.cc b/media/filters/media_source_state.cc
new file mode 100644
index 0000000..f7c021ba
--- /dev/null
+++ b/media/filters/media_source_state.cc
@@ -0,0 +1,697 @@
+// Copyright (c) 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "media/filters/media_source_state.h"
+
+#include "base/callback_helpers.h"
+#include "base/stl_util.h"
+#include "media/filters/chunk_demuxer.h"
+#include "media/filters/frame_processor.h"
+#include "media/filters/source_buffer_stream.h"
+
+namespace media {
+
+static TimeDelta EndTimestamp(const StreamParser::BufferQueue& queue) {
+  return queue.back()->timestamp() + queue.back()->duration();
+}
+
+// List of time ranges for each SourceBuffer.
+// static
+Ranges<TimeDelta> MediaSourceState::ComputeRangesIntersection(
+    const RangesList& activeRanges,
+    bool ended) {
+  // TODO(servolk): Perhaps this can be removed in favor of blink implementation
+  // (MediaSource::buffered)? Currently this is only used on Android and for
+  // updating DemuxerHost's buffered ranges during AppendData() as well as
+  // SourceBuffer.buffered property implemetation.
+  // Implementation of HTMLMediaElement.buffered algorithm in MSE spec.
+  // https://dvcs.w3.org/hg/html-media/raw-file/default/media-source/media-source.html#dom-htmlmediaelement.buffered
+
+  // Step 1: If activeSourceBuffers.length equals 0 then return an empty
+  //  TimeRanges object and abort these steps.
+  if (activeRanges.empty())
+    return Ranges<TimeDelta>();
+
+  // Step 2: Let active ranges be the ranges returned by buffered for each
+  //  SourceBuffer object in activeSourceBuffers.
+  // Step 3: Let highest end time be the largest range end time in the active
+  //  ranges.
+  TimeDelta highest_end_time;
+  for (RangesList::const_iterator itr = activeRanges.begin();
+       itr != activeRanges.end(); ++itr) {
+    if (!itr->size())
+      continue;
+
+    highest_end_time = std::max(highest_end_time, itr->end(itr->size() - 1));
+  }
+
+  // Step 4: Let intersection ranges equal a TimeRange object containing a
+  //  single range from 0 to highest end time.
+  Ranges<TimeDelta> intersection_ranges;
+  intersection_ranges.Add(TimeDelta(), highest_end_time);
+
+  // Step 5: For each SourceBuffer object in activeSourceBuffers run the
+  //  following steps:
+  for (RangesList::const_iterator itr = activeRanges.begin();
+       itr != activeRanges.end(); ++itr) {
+    // Step 5.1: Let source ranges equal the ranges returned by the buffered
+    //  attribute on the current SourceBuffer.
+    Ranges<TimeDelta> source_ranges = *itr;
+
+    // Step 5.2: If readyState is "ended", then set the end time on the last
+    //  range in source ranges to highest end time.
+    if (ended && source_ranges.size() > 0u) {
+      source_ranges.Add(source_ranges.start(source_ranges.size() - 1),
+                        highest_end_time);
+    }
+
+    // Step 5.3: Let new intersection ranges equal the intersection between
+    // the intersection ranges and the source ranges.
+    // Step 5.4: Replace the ranges in intersection ranges with the new
+    // intersection ranges.
+    intersection_ranges = intersection_ranges.IntersectionWith(source_ranges);
+  }
+
+  return intersection_ranges;
+}
+
+MediaSourceState::MediaSourceState(
+    scoped_ptr<StreamParser> stream_parser,
+    scoped_ptr<FrameProcessor> frame_processor,
+    const CreateDemuxerStreamCB& create_demuxer_stream_cb,
+    const scoped_refptr<MediaLog>& media_log)
+    : create_demuxer_stream_cb_(create_demuxer_stream_cb),
+      timestamp_offset_during_append_(NULL),
+      new_media_segment_(false),
+      parsing_media_segment_(false),
+      stream_parser_(stream_parser.release()),
+      audio_(NULL),
+      video_(NULL),
+      frame_processor_(frame_processor.release()),
+      media_log_(media_log),
+      auto_update_timestamp_offset_(false) {
+  DCHECK(!create_demuxer_stream_cb_.is_null());
+  DCHECK(frame_processor_);
+}
+
+MediaSourceState::~MediaSourceState() {
+  Shutdown();
+
+  STLDeleteValues(&text_stream_map_);
+}
+
+void MediaSourceState::Init(
+    const StreamParser::InitCB& init_cb,
+    bool allow_audio,
+    bool allow_video,
+    const StreamParser::EncryptedMediaInitDataCB& encrypted_media_init_data_cb,
+    const NewTextTrackCB& new_text_track_cb) {
+  new_text_track_cb_ = new_text_track_cb;
+  init_cb_ = init_cb;
+
+  stream_parser_->Init(
+      base::Bind(&MediaSourceState::OnSourceInitDone, base::Unretained(this)),
+      base::Bind(&MediaSourceState::OnNewConfigs, base::Unretained(this),
+                 allow_audio, allow_video),
+      base::Bind(&MediaSourceState::OnNewBuffers, base::Unretained(this)),
+      new_text_track_cb_.is_null(), encrypted_media_init_data_cb,
+      base::Bind(&MediaSourceState::OnNewMediaSegment, base::Unretained(this)),
+      base::Bind(&MediaSourceState::OnEndOfMediaSegment,
+                 base::Unretained(this)),
+      media_log_);
+}
+
+void MediaSourceState::SetSequenceMode(bool sequence_mode) {
+  DCHECK(!parsing_media_segment_);
+
+  frame_processor_->SetSequenceMode(sequence_mode);
+}
+
+void MediaSourceState::SetGroupStartTimestampIfInSequenceMode(
+    base::TimeDelta timestamp_offset) {
+  DCHECK(!parsing_media_segment_);
+
+  frame_processor_->SetGroupStartTimestampIfInSequenceMode(timestamp_offset);
+}
+
+bool MediaSourceState::Append(
+    const uint8_t* data,
+    size_t length,
+    TimeDelta append_window_start,
+    TimeDelta append_window_end,
+    TimeDelta* timestamp_offset,
+    const InitSegmentReceivedCB& init_segment_received_cb) {
+  DCHECK(timestamp_offset);
+  DCHECK(!timestamp_offset_during_append_);
+  DCHECK(!init_segment_received_cb.is_null());
+  DCHECK(init_segment_received_cb_.is_null());
+  append_window_start_during_append_ = append_window_start;
+  append_window_end_during_append_ = append_window_end;
+  timestamp_offset_during_append_ = timestamp_offset;
+  init_segment_received_cb_ = init_segment_received_cb;
+
+  // TODO(wolenetz/acolwell): Curry and pass a NewBuffersCB here bound with
+  // append window and timestamp offset pointer. See http://crbug.com/351454.
+  bool result = stream_parser_->Parse(data, length);
+  if (!result) {
+    MEDIA_LOG(ERROR, media_log_)
+        << __FUNCTION__ << ": stream parsing failed."
+        << " Data size=" << length
+        << " append_window_start=" << append_window_start.InSecondsF()
+        << " append_window_end=" << append_window_end.InSecondsF();
+  }
+  timestamp_offset_during_append_ = NULL;
+  init_segment_received_cb_.Reset();
+  return result;
+}
+
+void MediaSourceState::ResetParserState(TimeDelta append_window_start,
+                                        TimeDelta append_window_end,
+                                        base::TimeDelta* timestamp_offset) {
+  DCHECK(timestamp_offset);
+  DCHECK(!timestamp_offset_during_append_);
+  timestamp_offset_during_append_ = timestamp_offset;
+  append_window_start_during_append_ = append_window_start;
+  append_window_end_during_append_ = append_window_end;
+
+  stream_parser_->Flush();
+  timestamp_offset_during_append_ = NULL;
+
+  frame_processor_->Reset();
+  parsing_media_segment_ = false;
+}
+
+void MediaSourceState::Remove(TimeDelta start,
+                              TimeDelta end,
+                              TimeDelta duration) {
+  if (audio_)
+    audio_->Remove(start, end, duration);
+
+  if (video_)
+    video_->Remove(start, end, duration);
+
+  for (TextStreamMap::iterator itr = text_stream_map_.begin();
+       itr != text_stream_map_.end(); ++itr) {
+    itr->second->Remove(start, end, duration);
+  }
+}
+
+size_t MediaSourceState::EstimateVideoDataSize(
+    size_t muxed_data_chunk_size) const {
+  DCHECK(audio_);
+  DCHECK(video_);
+
+  size_t videoBufferedSize = video_->GetBufferedSize();
+  size_t audioBufferedSize = audio_->GetBufferedSize();
+  if (videoBufferedSize == 0 || audioBufferedSize == 0) {
+    // At this point either audio or video buffer is empty, which means buffer
+    // levels are probably low anyway and we should have enough space in the
+    // buffers for appending new data, so just take a very rough guess.
+    return muxed_data_chunk_size * 7 / 8;
+  }
+
+  // We need to estimate how much audio and video data is going to be in the
+  // newly appended data chunk to make space for the new data. And we need to do
+  // that without parsing the data (which will happen later, in the Append
+  // phase). So for now we can only rely on some heuristic here. Let's assume
+  // that the proportion of the audio/video in the new data chunk is the same as
+  // the current ratio of buffered audio/video.
+  // Longer term this should go away once we further change the MSE GC algorithm
+  // to work across all streams of a SourceBuffer (see crbug.com/520704).
+  double videoBufferedSizeF = static_cast<double>(videoBufferedSize);
+  double audioBufferedSizeF = static_cast<double>(audioBufferedSize);
+
+  double totalBufferedSizeF = videoBufferedSizeF + audioBufferedSizeF;
+  CHECK_GT(totalBufferedSizeF, 0.0);
+
+  double videoRatio = videoBufferedSizeF / totalBufferedSizeF;
+  CHECK_GE(videoRatio, 0.0);
+  CHECK_LE(videoRatio, 1.0);
+  double estimatedVideoSize = muxed_data_chunk_size * videoRatio;
+  return static_cast<size_t>(estimatedVideoSize);
+}
+
+bool MediaSourceState::EvictCodedFrames(DecodeTimestamp media_time,
+                                        size_t newDataSize) {
+  bool success = true;
+
+  DVLOG(3) << __FUNCTION__ << " media_time=" << media_time.InSecondsF()
+           << " newDataSize=" << newDataSize
+           << " videoBufferedSize=" << (video_ ? video_->GetBufferedSize() : 0)
+           << " audioBufferedSize=" << (audio_ ? audio_->GetBufferedSize() : 0);
+
+  size_t newAudioSize = 0;
+  size_t newVideoSize = 0;
+  if (audio_ && video_) {
+    newVideoSize = EstimateVideoDataSize(newDataSize);
+    newAudioSize = newDataSize - newVideoSize;
+  } else if (video_) {
+    newVideoSize = newDataSize;
+  } else if (audio_) {
+    newAudioSize = newDataSize;
+  }
+
+  DVLOG(3) << __FUNCTION__ << " estimated audio/video sizes: "
+           << " newVideoSize=" << newVideoSize
+           << " newAudioSize=" << newAudioSize;
+
+  if (audio_)
+    success = audio_->EvictCodedFrames(media_time, newAudioSize) && success;
+
+  if (video_)
+    success = video_->EvictCodedFrames(media_time, newVideoSize) && success;
+
+  for (TextStreamMap::iterator itr = text_stream_map_.begin();
+       itr != text_stream_map_.end(); ++itr) {
+    success = itr->second->EvictCodedFrames(media_time, 0) && success;
+  }
+
+  DVLOG(3) << __FUNCTION__ << " result=" << success
+           << " videoBufferedSize=" << (video_ ? video_->GetBufferedSize() : 0)
+           << " audioBufferedSize=" << (audio_ ? audio_->GetBufferedSize() : 0);
+
+  return success;
+}
+
+Ranges<TimeDelta> MediaSourceState::GetBufferedRanges(TimeDelta duration,
+                                                      bool ended) const {
+  // TODO(acolwell): When we start allowing disabled tracks we'll need to update
+  // this code to only add ranges from active tracks.
+  RangesList ranges_list;
+  if (audio_)
+    ranges_list.push_back(audio_->GetBufferedRanges(duration));
+
+  if (video_)
+    ranges_list.push_back(video_->GetBufferedRanges(duration));
+
+  for (TextStreamMap::const_iterator itr = text_stream_map_.begin();
+       itr != text_stream_map_.end(); ++itr) {
+    ranges_list.push_back(itr->second->GetBufferedRanges(duration));
+  }
+
+  return ComputeRangesIntersection(ranges_list, ended);
+}
+
+TimeDelta MediaSourceState::GetMaxBufferedDuration() const {
+  TimeDelta max_duration;
+
+  if (audio_)
+    max_duration = std::max(max_duration, audio_->GetBufferedDuration());
+
+  if (video_)
+    max_duration = std::max(max_duration, video_->GetBufferedDuration());
+
+  for (TextStreamMap::const_iterator itr = text_stream_map_.begin();
+       itr != text_stream_map_.end(); ++itr) {
+    max_duration = std::max(max_duration, itr->second->GetBufferedDuration());
+  }
+
+  return max_duration;
+}
+
+void MediaSourceState::StartReturningData() {
+  if (audio_)
+    audio_->StartReturningData();
+
+  if (video_)
+    video_->StartReturningData();
+
+  for (TextStreamMap::iterator itr = text_stream_map_.begin();
+       itr != text_stream_map_.end(); ++itr) {
+    itr->second->StartReturningData();
+  }
+}
+
+void MediaSourceState::AbortReads() {
+  if (audio_)
+    audio_->AbortReads();
+
+  if (video_)
+    video_->AbortReads();
+
+  for (TextStreamMap::iterator itr = text_stream_map_.begin();
+       itr != text_stream_map_.end(); ++itr) {
+    itr->second->AbortReads();
+  }
+}
+
+void MediaSourceState::Seek(TimeDelta seek_time) {
+  if (audio_)
+    audio_->Seek(seek_time);
+
+  if (video_)
+    video_->Seek(seek_time);
+
+  for (TextStreamMap::iterator itr = text_stream_map_.begin();
+       itr != text_stream_map_.end(); ++itr) {
+    itr->second->Seek(seek_time);
+  }
+}
+
+void MediaSourceState::CompletePendingReadIfPossible() {
+  if (audio_)
+    audio_->CompletePendingReadIfPossible();
+
+  if (video_)
+    video_->CompletePendingReadIfPossible();
+
+  for (TextStreamMap::iterator itr = text_stream_map_.begin();
+       itr != text_stream_map_.end(); ++itr) {
+    itr->second->CompletePendingReadIfPossible();
+  }
+}
+
+void MediaSourceState::OnSetDuration(TimeDelta duration) {
+  if (audio_)
+    audio_->OnSetDuration(duration);
+
+  if (video_)
+    video_->OnSetDuration(duration);
+
+  for (TextStreamMap::iterator itr = text_stream_map_.begin();
+       itr != text_stream_map_.end(); ++itr) {
+    itr->second->OnSetDuration(duration);
+  }
+}
+
+void MediaSourceState::MarkEndOfStream() {
+  if (audio_)
+    audio_->MarkEndOfStream();
+
+  if (video_)
+    video_->MarkEndOfStream();
+
+  for (TextStreamMap::iterator itr = text_stream_map_.begin();
+       itr != text_stream_map_.end(); ++itr) {
+    itr->second->MarkEndOfStream();
+  }
+}
+
+void MediaSourceState::UnmarkEndOfStream() {
+  if (audio_)
+    audio_->UnmarkEndOfStream();
+
+  if (video_)
+    video_->UnmarkEndOfStream();
+
+  for (TextStreamMap::iterator itr = text_stream_map_.begin();
+       itr != text_stream_map_.end(); ++itr) {
+    itr->second->UnmarkEndOfStream();
+  }
+}
+
+void MediaSourceState::Shutdown() {
+  if (audio_)
+    audio_->Shutdown();
+
+  if (video_)
+    video_->Shutdown();
+
+  for (TextStreamMap::iterator itr = text_stream_map_.begin();
+       itr != text_stream_map_.end(); ++itr) {
+    itr->second->Shutdown();
+  }
+}
+
+void MediaSourceState::SetMemoryLimits(DemuxerStream::Type type,
+                                       size_t memory_limit) {
+  switch (type) {
+    case DemuxerStream::AUDIO:
+      if (audio_)
+        audio_->SetStreamMemoryLimit(memory_limit);
+      break;
+    case DemuxerStream::VIDEO:
+      if (video_)
+        video_->SetStreamMemoryLimit(memory_limit);
+      break;
+    case DemuxerStream::TEXT:
+      for (TextStreamMap::iterator itr = text_stream_map_.begin();
+           itr != text_stream_map_.end(); ++itr) {
+        itr->second->SetStreamMemoryLimit(memory_limit);
+      }
+      break;
+    case DemuxerStream::UNKNOWN:
+    case DemuxerStream::NUM_TYPES:
+      NOTREACHED();
+      break;
+  }
+}
+
+bool MediaSourceState::IsSeekWaitingForData() const {
+  if (audio_ && audio_->IsSeekWaitingForData())
+    return true;
+
+  if (video_ && video_->IsSeekWaitingForData())
+    return true;
+
+  // NOTE: We are intentionally not checking the text tracks
+  // because text tracks are discontinuous and may not have data
+  // for the seek position. This is ok and playback should not be
+  // stalled because we don't have cues. If cues, with timestamps after
+  // the seek time, eventually arrive they will be delivered properly
+  // in response to ChunkDemuxerStream::Read() calls.
+
+  return false;
+}
+
+bool MediaSourceState::OnNewConfigs(
+    bool allow_audio,
+    bool allow_video,
+    const AudioDecoderConfig& audio_config,
+    const VideoDecoderConfig& video_config,
+    const StreamParser::TextTrackConfigMap& text_configs) {
+  DVLOG(1) << "OnNewConfigs(" << allow_audio << ", " << allow_video << ", "
+           << audio_config.IsValidConfig() << ", "
+           << video_config.IsValidConfig() << ")";
+  DCHECK(!init_segment_received_cb_.is_null());
+
+  if (!audio_config.IsValidConfig() && !video_config.IsValidConfig()) {
+    DVLOG(1) << "OnNewConfigs() : Audio & video config are not valid!";
+    return false;
+  }
+
+  // Signal an error if we get configuration info for stream types that weren't
+  // specified in AddId() or more configs after a stream is initialized.
+  if (allow_audio != audio_config.IsValidConfig()) {
+    MEDIA_LOG(ERROR, media_log_)
+        << "Initialization segment"
+        << (audio_config.IsValidConfig() ? " has" : " does not have")
+        << " an audio track, but the mimetype"
+        << (allow_audio ? " specifies" : " does not specify")
+        << " an audio codec.";
+    return false;
+  }
+
+  if (allow_video != video_config.IsValidConfig()) {
+    MEDIA_LOG(ERROR, media_log_)
+        << "Initialization segment"
+        << (video_config.IsValidConfig() ? " has" : " does not have")
+        << " a video track, but the mimetype"
+        << (allow_video ? " specifies" : " does not specify")
+        << " a video codec.";
+    return false;
+  }
+
+  bool success = true;
+  if (audio_config.IsValidConfig()) {
+    if (!audio_) {
+      media_log_->SetBooleanProperty("found_audio_stream", true);
+    }
+    if (!audio_ ||
+        audio_->audio_decoder_config().codec() != audio_config.codec()) {
+      media_log_->SetStringProperty("audio_codec_name",
+                                    GetCodecName(audio_config.codec()));
+    }
+
+    if (!audio_) {
+      audio_ = create_demuxer_stream_cb_.Run(DemuxerStream::AUDIO);
+
+      if (!audio_) {
+        DVLOG(1) << "Failed to create an audio stream.";
+        return false;
+      }
+
+      if (!frame_processor_->AddTrack(FrameProcessor::kAudioTrackId, audio_)) {
+        DVLOG(1) << "Failed to add audio track to frame processor.";
+        return false;
+      }
+    }
+
+    frame_processor_->OnPossibleAudioConfigUpdate(audio_config);
+    success &= audio_->UpdateAudioConfig(audio_config, media_log_);
+  }
+
+  if (video_config.IsValidConfig()) {
+    if (!video_) {
+      media_log_->SetBooleanProperty("found_video_stream", true);
+    }
+    if (!video_ ||
+        video_->video_decoder_config().codec() != video_config.codec()) {
+      media_log_->SetStringProperty("video_codec_name",
+                                    GetCodecName(video_config.codec()));
+    }
+
+    if (!video_) {
+      video_ = create_demuxer_stream_cb_.Run(DemuxerStream::VIDEO);
+
+      if (!video_) {
+        DVLOG(1) << "Failed to create a video stream.";
+        return false;
+      }
+
+      if (!frame_processor_->AddTrack(FrameProcessor::kVideoTrackId, video_)) {
+        DVLOG(1) << "Failed to add video track to frame processor.";
+        return false;
+      }
+    }
+
+    success &= video_->UpdateVideoConfig(video_config, media_log_);
+  }
+
+  typedef StreamParser::TextTrackConfigMap::const_iterator TextConfigItr;
+  if (text_stream_map_.empty()) {
+    for (TextConfigItr itr = text_configs.begin(); itr != text_configs.end();
+         ++itr) {
+      ChunkDemuxerStream* const text_stream =
+          create_demuxer_stream_cb_.Run(DemuxerStream::TEXT);
+      if (!frame_processor_->AddTrack(itr->first, text_stream)) {
+        success &= false;
+        MEDIA_LOG(ERROR, media_log_) << "Failed to add text track ID "
+                                     << itr->first << " to frame processor.";
+        break;
+      }
+      text_stream->UpdateTextConfig(itr->second, media_log_);
+      text_stream_map_[itr->first] = text_stream;
+      new_text_track_cb_.Run(text_stream, itr->second);
+    }
+  } else {
+    const size_t text_count = text_stream_map_.size();
+    if (text_configs.size() != text_count) {
+      success &= false;
+      MEDIA_LOG(ERROR, media_log_)
+          << "The number of text track configs changed.";
+    } else if (text_count == 1) {
+      TextConfigItr config_itr = text_configs.begin();
+      TextStreamMap::iterator stream_itr = text_stream_map_.begin();
+      ChunkDemuxerStream* text_stream = stream_itr->second;
+      TextTrackConfig old_config = text_stream->text_track_config();
+      TextTrackConfig new_config(
+          config_itr->second.kind(), config_itr->second.label(),
+          config_itr->second.language(), old_config.id());
+      if (!new_config.Matches(old_config)) {
+        success &= false;
+        MEDIA_LOG(ERROR, media_log_)
+            << "New text track config does not match old one.";
+      } else {
+        StreamParser::TrackId old_id = stream_itr->first;
+        StreamParser::TrackId new_id = config_itr->first;
+        if (new_id != old_id) {
+          if (frame_processor_->UpdateTrack(old_id, new_id)) {
+            text_stream_map_.clear();
+            text_stream_map_[config_itr->first] = text_stream;
+          } else {
+            success &= false;
+            MEDIA_LOG(ERROR, media_log_)
+                << "Error remapping single text track number";
+          }
+        }
+      }
+    } else {
+      for (TextConfigItr config_itr = text_configs.begin();
+           config_itr != text_configs.end(); ++config_itr) {
+        TextStreamMap::iterator stream_itr =
+            text_stream_map_.find(config_itr->first);
+        if (stream_itr == text_stream_map_.end()) {
+          success &= false;
+          MEDIA_LOG(ERROR, media_log_)
+              << "Unexpected text track configuration for track ID "
+              << config_itr->first;
+          break;
+        }
+
+        const TextTrackConfig& new_config = config_itr->second;
+        ChunkDemuxerStream* stream = stream_itr->second;
+        TextTrackConfig old_config = stream->text_track_config();
+        if (!new_config.Matches(old_config)) {
+          success &= false;
+          MEDIA_LOG(ERROR, media_log_) << "New text track config for track ID "
+                                       << config_itr->first
+                                       << " does not match old one.";
+          break;
+        }
+      }
+    }
+  }
+
+  frame_processor_->SetAllTrackBuffersNeedRandomAccessPoint();
+
+  DVLOG(1) << "OnNewConfigs() : " << (success ? "success" : "failed");
+  if (success)
+    init_segment_received_cb_.Run();
+
+  return success;
+}
+
+void MediaSourceState::OnNewMediaSegment() {
+  DVLOG(2) << "OnNewMediaSegment()";
+  parsing_media_segment_ = true;
+  new_media_segment_ = true;
+}
+
+void MediaSourceState::OnEndOfMediaSegment() {
+  DVLOG(2) << "OnEndOfMediaSegment()";
+  parsing_media_segment_ = false;
+  new_media_segment_ = false;
+}
+
+bool MediaSourceState::OnNewBuffers(
+    const StreamParser::BufferQueue& audio_buffers,
+    const StreamParser::BufferQueue& video_buffers,
+    const StreamParser::TextBufferQueueMap& text_map) {
+  DVLOG(2) << "OnNewBuffers()";
+  DCHECK(timestamp_offset_during_append_);
+  DCHECK(parsing_media_segment_);
+
+  const TimeDelta timestamp_offset_before_processing =
+      *timestamp_offset_during_append_;
+
+  // Calculate the new timestamp offset for audio/video tracks if the stream
+  // parser has requested automatic updates.
+  TimeDelta new_timestamp_offset = timestamp_offset_before_processing;
+  if (auto_update_timestamp_offset_) {
+    const bool have_audio_buffers = !audio_buffers.empty();
+    const bool have_video_buffers = !video_buffers.empty();
+    if (have_audio_buffers && have_video_buffers) {
+      new_timestamp_offset +=
+          std::min(EndTimestamp(audio_buffers), EndTimestamp(video_buffers));
+    } else if (have_audio_buffers) {
+      new_timestamp_offset += EndTimestamp(audio_buffers);
+    } else if (have_video_buffers) {
+      new_timestamp_offset += EndTimestamp(video_buffers);
+    }
+  }
+
+  if (!frame_processor_->ProcessFrames(
+          audio_buffers, video_buffers, text_map,
+          append_window_start_during_append_, append_window_end_during_append_,
+          &new_media_segment_, timestamp_offset_during_append_)) {
+    return false;
+  }
+
+  // Only update the timestamp offset if the frame processor hasn't already.
+  if (auto_update_timestamp_offset_ &&
+      timestamp_offset_before_processing == *timestamp_offset_during_append_) {
+    *timestamp_offset_during_append_ = new_timestamp_offset;
+  }
+
+  return true;
+}
+
+void MediaSourceState::OnSourceInitDone(
+    const StreamParser::InitParameters& params) {
+  auto_update_timestamp_offset_ = params.auto_update_timestamp_offset;
+  base::ResetAndReturn(&init_cb_).Run(params);
+}
+
+}  // namespace media
diff --git a/media/filters/media_source_state.h b/media/filters/media_source_state.h
new file mode 100644
index 0000000..4ec8325
--- /dev/null
+++ b/media/filters/media_source_state.h
@@ -0,0 +1,214 @@
+// Copyright (c) 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MEDIA_FILTERS_MEDIA_SOURCE_STATE_H_
+#define MEDIA_FILTERS_MEDIA_SOURCE_STATE_H_
+
+#include <list>
+
+#include "base/bind.h"
+#include "base/macros.h"
+#include "media/base/demuxer_stream.h"
+#include "media/base/media_export.h"
+#include "media/base/stream_parser.h"
+#include "media/base/stream_parser_buffer.h"
+
+namespace media {
+
+using base::TimeDelta;
+
+class ChunkDemuxerStream;
+class FrameProcessor;
+
+// Contains state belonging to a source id.
+class MEDIA_EXPORT MediaSourceState {
+ public:
+  // Callback signature used to create ChunkDemuxerStreams.
+  typedef base::Callback<ChunkDemuxerStream*(DemuxerStream::Type)>
+      CreateDemuxerStreamCB;
+
+  typedef base::Closure InitSegmentReceivedCB;
+
+  typedef base::Callback<void(ChunkDemuxerStream*, const TextTrackConfig&)>
+      NewTextTrackCB;
+
+  MediaSourceState(scoped_ptr<StreamParser> stream_parser,
+                   scoped_ptr<FrameProcessor> frame_processor,
+                   const CreateDemuxerStreamCB& create_demuxer_stream_cb,
+                   const scoped_refptr<MediaLog>& media_log);
+
+  ~MediaSourceState();
+
+  void Init(const StreamParser::InitCB& init_cb,
+            bool allow_audio,
+            bool allow_video,
+            const StreamParser::EncryptedMediaInitDataCB&
+                encrypted_media_init_data_cb,
+            const NewTextTrackCB& new_text_track_cb);
+
+  // Appends new data to the StreamParser.
+  // Returns true if the data was successfully appended. Returns false if an
+  // error occurred. |*timestamp_offset| is used and possibly updated by the
+  // append. |append_window_start| and |append_window_end| correspond to the MSE
+  // spec's similarly named source buffer attributes that are used in coded
+  // frame processing. |init_segment_received_cb| is run for each new fully
+  // parsed initialization segment.
+  bool Append(const uint8_t* data,
+              size_t length,
+              TimeDelta append_window_start,
+              TimeDelta append_window_end,
+              TimeDelta* timestamp_offset,
+              const InitSegmentReceivedCB& init_segment_received_cb);
+
+  // Aborts the current append sequence and resets the parser.
+  void ResetParserState(TimeDelta append_window_start,
+                        TimeDelta append_window_end,
+                        TimeDelta* timestamp_offset);
+
+  // Calls Remove(|start|, |end|, |duration|) on all
+  // ChunkDemuxerStreams managed by this object.
+  void Remove(TimeDelta start, TimeDelta end, TimeDelta duration);
+
+  // If the buffer is full, attempts to try to free up space, as specified in
+  // the "Coded Frame Eviction Algorithm" in the Media Source Extensions Spec.
+  // Returns false iff buffer is still full after running eviction.
+  // https://w3c.github.io/media-source/#sourcebuffer-coded-frame-eviction
+  bool EvictCodedFrames(DecodeTimestamp media_time, size_t newDataSize);
+
+  // Returns true if currently parsing a media segment, or false otherwise.
+  bool parsing_media_segment() const { return parsing_media_segment_; }
+
+  // Sets |frame_processor_|'s sequence mode to |sequence_mode|.
+  void SetSequenceMode(bool sequence_mode);
+
+  // Signals the coded frame processor to update its group start timestamp to be
+  // |timestamp_offset| if it is in sequence append mode.
+  void SetGroupStartTimestampIfInSequenceMode(base::TimeDelta timestamp_offset);
+
+  // Returns the range of buffered data in this source, capped at |duration|.
+  // |ended| - Set to true if end of stream has been signaled and the special
+  // end of stream range logic needs to be executed.
+  Ranges<TimeDelta> GetBufferedRanges(TimeDelta duration, bool ended) const;
+
+  // Returns the highest buffered duration across all streams managed
+  // by this object.
+  // Returns TimeDelta() if none of the streams contain buffered data.
+  TimeDelta GetMaxBufferedDuration() const;
+
+  // Helper methods that call methods with similar names on all the
+  // ChunkDemuxerStreams managed by this object.
+  void StartReturningData();
+  void AbortReads();
+  void Seek(TimeDelta seek_time);
+  void CompletePendingReadIfPossible();
+  void OnSetDuration(TimeDelta duration);
+  void MarkEndOfStream();
+  void UnmarkEndOfStream();
+  void Shutdown();
+  // Sets the memory limit on each stream of a specific type.
+  // |memory_limit| is the maximum number of bytes each stream of type |type|
+  // is allowed to hold in its buffer.
+  void SetMemoryLimits(DemuxerStream::Type type, size_t memory_limit);
+  bool IsSeekWaitingForData() const;
+
+  typedef std::list<Ranges<TimeDelta>> RangesList;
+  static Ranges<TimeDelta> ComputeRangesIntersection(
+      const RangesList& activeRanges,
+      bool ended);
+
+ private:
+  // Called by the |stream_parser_| when a new initialization segment is
+  // encountered.
+  // Returns true on a successful call. Returns false if an error occurred while
+  // processing decoder configurations.
+  bool OnNewConfigs(bool allow_audio,
+                    bool allow_video,
+                    const AudioDecoderConfig& audio_config,
+                    const VideoDecoderConfig& video_config,
+                    const StreamParser::TextTrackConfigMap& text_configs);
+
+  // Called by the |stream_parser_| at the beginning of a new media segment.
+  void OnNewMediaSegment();
+
+  // Called by the |stream_parser_| at the end of a media segment.
+  void OnEndOfMediaSegment();
+
+  // Called by the |stream_parser_| when new buffers have been parsed.
+  // It processes the new buffers using |frame_processor_|, which includes
+  // appending the processed frames to associated demuxer streams for each
+  // frame's track.
+  // Returns true on a successful call. Returns false if an error occurred while
+  // processing the buffers.
+  bool OnNewBuffers(const StreamParser::BufferQueue& audio_buffers,
+                    const StreamParser::BufferQueue& video_buffers,
+                    const StreamParser::TextBufferQueueMap& text_map);
+
+  void OnSourceInitDone(const StreamParser::InitParameters& params);
+
+  // EstimateVideoDataSize uses some heuristics to estimate the size of the
+  // video size in the chunk of muxed audio/video data without parsing it.
+  // This is used by EvictCodedFrames algorithm, which happens before Append
+  // (and therefore before parsing is performed) to prepare space for new data.
+  size_t EstimateVideoDataSize(size_t muxed_data_chunk_size) const;
+
+  CreateDemuxerStreamCB create_demuxer_stream_cb_;
+  NewTextTrackCB new_text_track_cb_;
+
+  // During Append(), if OnNewBuffers() coded frame processing updates the
+  // timestamp offset then |*timestamp_offset_during_append_| is also updated
+  // so Append()'s caller can know the new offset. This pointer is only non-NULL
+  // during the lifetime of an Append() call.
+  TimeDelta* timestamp_offset_during_append_;
+
+  // During Append(), coded frame processing triggered by OnNewBuffers()
+  // requires these two attributes. These are only valid during the lifetime of
+  // an Append() call.
+  TimeDelta append_window_start_during_append_;
+  TimeDelta append_window_end_during_append_;
+
+  // Set to true if the next buffers appended within the append window
+  // represent the start of a new media segment. This flag being set
+  // triggers a call to |new_segment_cb_| when the new buffers are
+  // appended. The flag is set on actual media segment boundaries and
+  // when the "append window" filtering causes discontinuities in the
+  // appended data.
+  // TODO(wolenetz/acolwell): Investigate if we need this, or if coded frame
+  // processing's discontinuity logic is enough. See http://crbug.com/351489.
+  bool new_media_segment_;
+
+  // Keeps track of whether a media segment is being parsed.
+  bool parsing_media_segment_;
+
+  // The object used to parse appended data.
+  scoped_ptr<StreamParser> stream_parser_;
+
+  ChunkDemuxerStream* audio_;  // Not owned by |this|.
+  ChunkDemuxerStream* video_;  // Not owned by |this|.
+
+  typedef std::map<StreamParser::TrackId, ChunkDemuxerStream*> TextStreamMap;
+  TextStreamMap text_stream_map_;  // |this| owns the map's stream pointers.
+
+  scoped_ptr<FrameProcessor> frame_processor_;
+  scoped_refptr<MediaLog> media_log_;
+  StreamParser::InitCB init_cb_;
+
+  // During Append(), OnNewConfigs() will trigger the initialization segment
+  // received algorithm. This callback is only non-NULL during the lifetime of
+  // an Append() call. Note, the MSE spec explicitly disallows this algorithm
+  // during an Abort(), since Abort() is allowed only to emit coded frames, and
+  // only if the parser is PARSING_MEDIA_SEGMENT (not an INIT segment).
+  InitSegmentReceivedCB init_segment_received_cb_;
+
+  // Indicates that timestampOffset should be updated automatically during
+  // OnNewBuffers() based on the earliest end timestamp of the buffers provided.
+  // TODO(wolenetz): Refactor this function while integrating April 29, 2014
+  // changes to MSE spec. See http://crbug.com/371499.
+  bool auto_update_timestamp_offset_;
+
+  DISALLOW_COPY_AND_ASSIGN(MediaSourceState);
+};
+
+}  // namespace media
+
+#endif  // MEDIA_FILTERS_MEDIA_SOURCE_STATE_H_
diff --git a/media/media.gyp b/media/media.gyp
index 08cd4c9..6c1b76e 100644
--- a/media/media.gyp
+++ b/media/media.gyp
@@ -588,6 +588,8 @@
         'filters/in_memory_url_protocol.h',
         'filters/jpeg_parser.cc',
         'filters/jpeg_parser.h',
+        'filters/media_source_state.cc',
+        'filters/media_source_state.h',
         'filters/opus_audio_decoder.cc',
         'filters/opus_audio_decoder.h',
         'filters/opus_constants.cc',
diff --git a/media/midi/midi_manager.cc b/media/midi/midi_manager.cc
index 21f6c23..55b5a37 100644
--- a/media/midi/midi_manager.cc
+++ b/media/midi/midi_manager.cc
@@ -126,11 +126,14 @@
         pending_clients_.insert(client);
       }
     }
+
+    if (completion == Completion::COMPLETE_SYNCHRONOUSLY) {
+      client->CompleteStartSession(result);
+      return;
+    }
   }
 
-  if (completion == Completion::COMPLETE_SYNCHRONOUSLY) {
-    client->CompleteStartSession(result);
-  } else if (completion == Completion::INVOKE_INITIALIZATION) {
+  if (completion == Completion::INVOKE_INITIALIZATION) {
     // Lazily initialize the MIDI back-end.
     TRACE_EVENT0("midi", "MidiManager::StartInitialization");
     // CompleteInitialization() will be called asynchronously when platform
@@ -143,7 +146,8 @@
   ReportUsage(Usage::SESSION_ENDED);
 
   // At this point, |client| can be in the destruction process, and calling
-  // any method of |client| is dangerous.
+  // any method of |client| is dangerous. Calls on clients *must* be protected
+  // by |lock_| to prevent race conditions.
   base::AutoLock auto_lock(lock_);
   clients_.erase(client);
   pending_clients_.erase(client);
@@ -156,9 +160,6 @@
 
   // Continue to hold lock_ here in case another thread is currently doing
   // EndSession.
-  // Note that if we are in EndSession, then a destructor is being called and
-  // it isn't really safe to call this method. But we don't have another way to
-  // check this right now.
   client->AccumulateMidiBytesSent(n);
 }
 
diff --git a/media/video/gpu_memory_buffer_video_frame_pool.cc b/media/video/gpu_memory_buffer_video_frame_pool.cc
index dcb9e5a..14910ad 100644
--- a/media/video/gpu_memory_buffer_video_frame_pool.cc
+++ b/media/video/gpu_memory_buffer_video_frame_pool.cc
@@ -579,7 +579,11 @@
   // Insert a sync_token, this is needed to make sure that the textures the
   // mailboxes refer to will be used only after all the previous commands posted
   // in the command buffer have been processed.
-  gpu::SyncToken sync_token(gles2->InsertSyncPointCHROMIUM());
+  const GLuint64 fence_sync = gles2->InsertFenceSyncCHROMIUM();
+  gles2->OrderingBarrierCHROMIUM();
+
+  gpu::SyncToken sync_token;
+  gles2->GenUnverifiedSyncTokenCHROMIUM(fence_sync, sync_token.GetData());
   for (size_t i = 0; i < num_planes; i += planes_per_copy)
     mailbox_holders[i].sync_token = sync_token;
 
diff --git a/media/video/gpu_memory_buffer_video_frame_pool_unittest.cc b/media/video/gpu_memory_buffer_video_frame_pool_unittest.cc
index e6a66d0..0e6f3ef 100644
--- a/media/video/gpu_memory_buffer_video_frame_pool_unittest.cc
+++ b/media/video/gpu_memory_buffer_video_frame_pool_unittest.cc
@@ -23,15 +23,44 @@
     *textures = ++gen_textures;
   }
 
-  GLuint InsertSyncPointCHROMIUM() override { return ++sync_point; }
+  void ShallowFlushCHROMIUM() override {
+    flushed_fence_sync_ = next_fence_sync_ - 1;
+  }
+
+  void OrderingBarrierCHROMIUM() override {
+    flushed_fence_sync_ = next_fence_sync_ - 1;
+  }
+
+  GLuint64 InsertFenceSyncCHROMIUM() override { return next_fence_sync_++; }
+
+  void GenSyncTokenCHROMIUM(GLuint64 fence_sync, GLbyte* sync_token) override {
+    gpu::SyncToken sync_token_data;
+    if (fence_sync <= flushed_fence_sync_) {
+      sync_token_data.Set(gpu::CommandBufferNamespace::GPU_IO, 0, 0,
+                          fence_sync);
+      sync_token_data.SetVerifyFlush();
+    }
+    memcpy(sync_token, &sync_token_data, sizeof(sync_token_data));
+  }
+
+  void GenUnverifiedSyncTokenCHROMIUM(GLuint64 fence_sync,
+                                      GLbyte* sync_token) override {
+    gpu::SyncToken sync_token_data;
+    if (fence_sync <= flushed_fence_sync_) {
+      sync_token_data.Set(gpu::CommandBufferNamespace::GPU_IO, 0, 0,
+                          fence_sync);
+    }
+    memcpy(sync_token, &sync_token_data, sizeof(sync_token_data));
+  }
 
   void GenMailboxCHROMIUM(GLbyte* mailbox) override {
-    *reinterpret_cast<unsigned*>(mailbox) = ++this->mailbox;
+    *reinterpret_cast<unsigned*>(mailbox) = ++mailbox_;
   }
 
  private:
-  unsigned sync_point = 0u;
-  unsigned mailbox = 0u;
+  uint64_t next_fence_sync_ = 1u;
+  uint64_t flushed_fence_sync_ = 0u;
+  unsigned mailbox_ = 0u;
 };
 
 }  // unnamed namespace
diff --git a/net/cert/multi_threaded_cert_verifier.cc b/net/cert/multi_threaded_cert_verifier.cc
index 68f2751..23f1d87 100644
--- a/net/cert/multi_threaded_cert_verifier.cc
+++ b/net/cert/multi_threaded_cert_verifier.cc
@@ -427,7 +427,7 @@
 
   requests_++;
 
-  const CertificateList empty_cert_list = CertificateList();
+  const CertificateList empty_cert_list;
   const CertificateList& additional_trust_anchors =
       trust_anchor_provider_ ?
           trust_anchor_provider_->GetAdditionalTrustAnchors() : empty_cert_list;
diff --git a/net/url_request/url_request_filter.cc b/net/url_request/url_request_filter.cc
index e28319d..83248e2 100644
--- a/net/url_request/url_request_filter.cc
+++ b/net/url_request/url_request_filter.cc
@@ -53,7 +53,7 @@
   DCHECK(OnMessageLoopForInterceptorAddition());
   DCHECK_EQ(0u, hostname_interceptor_map_.count(make_pair(scheme, hostname)));
   hostname_interceptor_map_[make_pair(scheme, hostname)] =
-      interceptor.release();
+      std::move(interceptor);
 
 #ifndef NDEBUG
   // Check to see if we're masking URLs in the url_interceptor_map_.
@@ -71,12 +71,9 @@
 void URLRequestFilter::RemoveHostnameHandler(const std::string& scheme,
                                              const std::string& hostname) {
   DCHECK(OnMessageLoopForInterceptorRemoval());
-  HostnameInterceptorMap::iterator it =
-      hostname_interceptor_map_.find(make_pair(scheme, hostname));
-  DCHECK(it != hostname_interceptor_map_.end());
+  int removed = hostname_interceptor_map_.erase(make_pair(scheme, hostname));
+  DCHECK(removed);
 
-  delete it->second;
-  hostname_interceptor_map_.erase(it);
   // Note that we don't unregister from the URLRequest ProtocolFactory as
   // this would leave no protocol factory for the remaining hostname and URL
   // handlers.
@@ -89,7 +86,7 @@
   if (!url.is_valid())
     return false;
   DCHECK_EQ(0u, url_interceptor_map_.count(url.spec()));
-  url_interceptor_map_[url.spec()] = interceptor.release();
+  url_interceptor_map_.set(url.spec(), std::move(interceptor));
 
   // Check to see if this URL is masked by a hostname handler.
   DCHECK_EQ(0u, hostname_interceptor_map_.count(make_pair(url.scheme(),
@@ -100,11 +97,8 @@
 
 void URLRequestFilter::RemoveUrlHandler(const GURL& url) {
   DCHECK(OnMessageLoopForInterceptorRemoval());
-  URLInterceptorMap::iterator it = url_interceptor_map_.find(url.spec());
-  DCHECK(it != url_interceptor_map_.end());
-
-  delete it->second;
-  url_interceptor_map_.erase(it);
+  int removed = url_interceptor_map_.erase(url.spec());
+  DCHECK(removed);
   // Note that we don't unregister from the URLRequest ProtocolFactory as
   // this would leave no protocol factory for the remaining hostname and URL
   // handlers.
@@ -112,8 +106,8 @@
 
 void URLRequestFilter::ClearHandlers() {
   DCHECK(OnMessageLoopForInterceptorRemoval());
-  STLDeleteValues(&url_interceptor_map_);
-  STLDeleteValues(&hostname_interceptor_map_);
+  url_interceptor_map_.clear();
+  hostname_interceptor_map_.clear();
   hit_count_ = 0;
 }
 
diff --git a/net/url_request/url_request_filter.h b/net/url_request/url_request_filter.h
index 0bd2f59..7c46048 100644
--- a/net/url_request/url_request_filter.h
+++ b/net/url_request/url_request_filter.h
@@ -8,6 +8,7 @@
 #include <string>
 
 #include "base/containers/hash_tables.h"
+#include "base/containers/scoped_ptr_hash_map.h"
 #include "base/macros.h"
 #include "base/memory/scoped_ptr.h"
 #include "net/base/net_export.h"
@@ -71,10 +72,11 @@
 
  private:
   // scheme,hostname -> URLRequestInterceptor
-  typedef std::map<std::pair<std::string, std::string>,
-      URLRequestInterceptor* > HostnameInterceptorMap;
+  using HostnameInterceptorMap = std::map<std::pair<std::string, std::string>,
+                                          scoped_ptr<URLRequestInterceptor>>;
   // URL -> URLRequestInterceptor
-  typedef base::hash_map<std::string, URLRequestInterceptor*> URLInterceptorMap;
+  using URLInterceptorMap =
+      base::ScopedPtrHashMap<std::string, scoped_ptr<URLRequestInterceptor>>;
 
   URLRequestFilter();
   ~URLRequestFilter() override;
diff --git a/sandbox/mac/bootstrap_sandbox.cc b/sandbox/mac/bootstrap_sandbox.cc
index d006f3f..dee7903c 100644
--- a/sandbox/mac/bootstrap_sandbox.cc
+++ b/sandbox/mac/bootstrap_sandbox.cc
@@ -68,7 +68,7 @@
   if (kr != KERN_SUCCESS) {
     BOOTSTRAP_LOG(ERROR, kr)
         << "Failed to bootstrap_check_in the sandbox server.";
-    return null.Pass();
+    return null;
   }
   sandbox->check_in_port_.reset(port);
 
@@ -81,9 +81,9 @@
 
   // Start the sandbox server.
   if (!sandbox->launchd_server_->Initialize(MACH_PORT_NULL))
-    return null.Pass();
+    return null;
 
-  return sandbox.Pass();
+  return sandbox;
 }
 
 // Warning: This function must be safe to call in
diff --git a/testing/buildbot/chromium.gpu.fyi.json b/testing/buildbot/chromium.gpu.fyi.json
index 922a81d..257ef9906 100644
--- a/testing/buildbot/chromium.gpu.fyi.json
+++ b/testing/buildbot/chromium.gpu.fyi.json
@@ -96,6 +96,21 @@
           ]
         },
         "test": "gl_unittests"
+      },
+      {
+        "args": [
+          "--use-gpu-in-tests"
+        ],
+        "swarming": {
+          "can_use_on_swarming_builders": true,
+          "dimension_sets": [
+            {
+              "gpu": "10de:104a",
+              "os": "Linux"
+            }
+          ]
+        },
+        "test": "gles2_conform_test"
       }
     ],
     "isolated_scripts": [
@@ -376,6 +391,21 @@
             }
           ]
         },
+        "test": "angle_end2end_tests"
+      },
+      {
+        "args": [
+          "--use-gpu-in-tests"
+        ],
+        "swarming": {
+          "can_use_on_swarming_builders": true,
+          "dimension_sets": [
+            {
+              "gpu": "10de:104a",
+              "os": "Linux"
+            }
+          ]
+        },
         "test": "angle_unittests"
       },
       {
@@ -439,6 +469,21 @@
         "test": "gl_unittests"
       },
       {
+        "args": [
+          "--use-gpu-in-tests"
+        ],
+        "swarming": {
+          "can_use_on_swarming_builders": true,
+          "dimension_sets": [
+            {
+              "gpu": "10de:104a",
+              "os": "Linux"
+            }
+          ]
+        },
+        "test": "gles2_conform_test"
+      },
+      {
         "override_compile_targets": [
           "tab_capture_end2end_tests_run"
         ],
@@ -1628,6 +1673,21 @@
           ]
         },
         "test": "gl_unittests"
+      },
+      {
+        "args": [
+          "--use-gpu-in-tests"
+        ],
+        "swarming": {
+          "can_use_on_swarming_builders": true,
+          "dimension_sets": [
+            {
+              "gpu": "10de:104a",
+              "os": "Windows"
+            }
+          ]
+        },
+        "test": "gles2_conform_test"
       }
     ],
     "isolated_scripts": [
@@ -1954,6 +2014,21 @@
             }
           ]
         },
+        "test": "angle_end2end_tests"
+      },
+      {
+        "args": [
+          "--use-gpu-in-tests"
+        ],
+        "swarming": {
+          "can_use_on_swarming_builders": true,
+          "dimension_sets": [
+            {
+              "gpu": "10de:104a",
+              "os": "Windows"
+            }
+          ]
+        },
         "test": "angle_unittests"
       },
       {
@@ -2017,6 +2092,21 @@
         "test": "gl_unittests"
       },
       {
+        "args": [
+          "--use-gpu-in-tests"
+        ],
+        "swarming": {
+          "can_use_on_swarming_builders": true,
+          "dimension_sets": [
+            {
+              "gpu": "10de:104a",
+              "os": "Windows"
+            }
+          ]
+        },
+        "test": "gles2_conform_test"
+      },
+      {
         "override_compile_targets": [
           "tab_capture_end2end_tests_run"
         ],
diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index f719ae2..d8955b83 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations
@@ -503,6 +503,8 @@
 crbug.com/441840 imported/csswg-test/css-shapes-1/shape-outside/values/shape-outside-polygon-004.html [ Failure ]
 crbug.com/441840 imported/csswg-test/css-shapes-1/shape-outside/values/shape-outside-shape-arguments-000.html [ Failure ]
 
+crbug.com/574577 imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-break-word-fit-content-001.html [ Failure ]
+
 crbug.com/505151 imported/csswg-test/css-writing-modes-3/abs-pos-non-replaced-icb-vlr-003.xht [ Failure ]
 crbug.com/505151 imported/csswg-test/css-writing-modes-3/abs-pos-non-replaced-icb-vlr-005.xht [ Failure ]
 crbug.com/505151 imported/csswg-test/css-writing-modes-3/abs-pos-non-replaced-icb-vlr-011.xht [ Failure ]
diff --git a/third_party/WebKit/LayoutTests/W3CImportExpectations b/third_party/WebKit/LayoutTests/W3CImportExpectations
index 75fb2b12c..720ad33 100644
--- a/third_party/WebKit/LayoutTests/W3CImportExpectations
+++ b/third_party/WebKit/LayoutTests/W3CImportExpectations
@@ -40,7 +40,19 @@
 imported/csswg-test/css-style-attr-1 [ Skip ]
 imported/csswg-test/css-syntax-3 [ Skip ]
 imported/csswg-test/css-tables-3 [ Skip ]
-imported/csswg-test/css-text-3 [ Skip ]
+imported/csswg-test/css-text-3/hanging-punctuation [ Skip ]
+imported/csswg-test/css-text-3/i18n [ Skip ]
+imported/csswg-test/css-text-3/line-break [ Skip ]
+## Owners: kojii@chromium.org
+# imported/csswg-test/css-text-3/overflow-wrap [ Pass ]
+imported/csswg-test/css-text-3/support [ Skip ]
+imported/csswg-test/css-text-3/tab-size [ Skip ]
+imported/csswg-test/css-text-3/text-align [ Skip ]
+imported/csswg-test/css-text-3/text-indent [ Skip ]
+imported/csswg-test/css-text-3/text-justify [ Skip ]
+imported/csswg-test/css-text-3/text-transform [ Skip ]
+imported/csswg-test/css-text-3/white-space [ Skip ]
+imported/csswg-test/css-text-3/word-break [ Skip ]
 imported/csswg-test/css-text-decor-3 [ Skip ]
 imported/csswg-test/css-transforms-1 [ Skip ]
 imported/csswg-test/css-transitions-1 [ Skip ]
diff --git a/third_party/WebKit/LayoutTests/animations/svg-attribute-composition/svg-transform-matrix-expected.txt b/third_party/WebKit/LayoutTests/animations/svg-attribute-composition/svg-transform-matrix-expected.txt
new file mode 100644
index 0000000..e373784
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/animations/svg-attribute-composition/svg-transform-matrix-expected.txt
@@ -0,0 +1,15 @@
+CONSOLE WARNING: SVG's SMIL animations (<animate>, <set>, etc.) are deprecated and will be removed. Please use CSS animations or Web animations instead.
+This is a testharness.js-based test.
+PASS This test uses interpolation-test.js. 
+PASS SMIL: Interpolate attribute <transform> with underlying [matrix(1 2 3 4 5 6)] from add [rotate(10 20 30)] to add [rotate(30 70 150)] at (0) is [matrix(1 2 3 4 5 6) rotate(10 20 30)] 
+PASS SMIL: Interpolate attribute <transform> with underlying [matrix(1 2 3 4 5 6)] from add [rotate(10 20 30)] to add [rotate(30 70 150)] at (0.2) is [matrix(1 2 3 4 5 6) rotate(14 30 54)] 
+PASS SMIL: Interpolate attribute <transform> with underlying [matrix(1 2 3 4 5 6)] from add [rotate(10 20 30)] to add [rotate(30 70 150)] at (0.6) is [matrix(1 2 3 4 5 6) rotate(22 50 102)] 
+PASS SMIL: Interpolate attribute <transform> with underlying [matrix(1 2 3 4 5 6)] from add [rotate(10 20 30)] to add [rotate(30 70 150)] at (1) is [matrix(1 2 3 4 5 6) rotate(30 70 150)] 
+FAIL Web Animations: Interpolate attribute <transform> with underlying [matrix(1 2 3 4 5 6)] from add [rotate(10 20 30)] to add [rotate(30 70 150)] at (-0.4) is [matrix(1 2 3 4 5 6) rotate(2 0 -18)] assert_equals: expected "1 , 0 , 1 , 2 , 3 , 4 , 5 , 6 , 4 , 2 , 1 , 0.03 , - 0.03 , 1 , - 0.63 , - 0.01 " but got "4 , 2 , 1 , 0.03 , - 0.03 , 1 , - 0.63 , - 0.01 "
+FAIL Web Animations: Interpolate attribute <transform> with underlying [matrix(1 2 3 4 5 6)] from add [rotate(10 20 30)] to add [rotate(30 70 150)] at (0) is [matrix(1 2 3 4 5 6) rotate(10 20 30)] assert_equals: expected "1 , 0 , 1 , 2 , 3 , 4 , 5 , 6 , 4 , 10 , 0.98 , 0.17 , - 0.17 , 0.98 , 5.51 , - 3.02 " but got "4 , 10 , 0.98 , 0.17 , - 0.17 , 0.98 , 5.51 , - 3.02 "
+FAIL Web Animations: Interpolate attribute <transform> with underlying [matrix(1 2 3 4 5 6)] from add [rotate(10 20 30)] to add [rotate(30 70 150)] at (0.2) is [matrix(1 2 3 4 5 6) rotate(14 30 54)] assert_equals: expected "1 , 0 , 1 , 2 , 3 , 4 , 5 , 6 , 4 , 14 , 0.97 , 0.24 , - 0.24 , 0.97 , 13.95 , - 5.65 " but got "4 , 14 , 0.97 , 0.24 , - 0.24 , 0.97 , 13.95 , - 5.65 "
+FAIL Web Animations: Interpolate attribute <transform> with underlying [matrix(1 2 3 4 5 6)] from add [rotate(10 20 30)] to add [rotate(30 70 150)] at (0.6) is [matrix(1 2 3 4 5 6) rotate(22 50 102)] assert_equals: expected "1 , 0 , 1 , 2 , 3 , 4 , 5 , 6 , 4 , 22 , 0.93 , 0.37 , - 0.37 , 0.93 , 41.85 , - 11.3 " but got "4 , 22 , 0.93 , 0.37 , - 0.37 , 0.93 , 41.85 , - 11.3 "
+FAIL Web Animations: Interpolate attribute <transform> with underlying [matrix(1 2 3 4 5 6)] from add [rotate(10 20 30)] to add [rotate(30 70 150)] at (1) is [matrix(1 2 3 4 5 6) rotate(30 70 150)] assert_equals: expected "1 , 0 , 1 , 2 , 3 , 4 , 5 , 6 , 4 , 30 , 0.87 , 0.5 , - 0.5 , 0.87 , 84.38 , - 14.9 " but got "4 , 30 , 0.87 , 0.5 , - 0.5 , 0.87 , 84.38 , - 14.9 "
+FAIL Web Animations: Interpolate attribute <transform> with underlying [matrix(1 2 3 4 5 6)] from add [rotate(10 20 30)] to add [rotate(30 70 150)] at (1.4) is [matrix(1 2 3 4 5 6) rotate(38 90 198)] assert_equals: expected "1 , 0 , 1 , 2 , 3 , 4 , 5 , 6 , 4 , 38 , 0.79 , 0.62 , - 0.62 , 0.79 , 140.98 , - 13.44 " but got "4 , 38 , 0.79 , 0.62 , - 0.62 , 0.79 , 140.98 , - 13.44 "
+Harness: the test ran to completion.
+
diff --git a/third_party/WebKit/LayoutTests/animations/svg-attribute-composition/svg-transform-matrix.html b/third_party/WebKit/LayoutTests/animations/svg-attribute-composition/svg-transform-matrix.html
new file mode 100644
index 0000000..7207b27
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/animations/svg-attribute-composition/svg-transform-matrix.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<body>
+<template id="target-template">
+<svg width="90" height="90">
+<line x1="1" y1="2" x2="3" y2="4" class="target" />
+</svg>
+</template>
+<script src="../svg-attribute-interpolation/resources/interpolation-test.js"></script>
+<script>
+'use strict';
+
+assertAttributeInterpolation({
+  property: 'transform',
+  underlying: 'matrix(1 2 3 4 5 6)',
+  from: 'rotate(10 20 30)',
+  fromComposite: 'add',
+  to: 'rotate(30 70 150)',
+  toComposite: 'add'
+}, [
+  {at: -0.4, is: 'matrix(1 2 3 4 5 6) rotate(2 0 -18)'},
+  {at: 0, is: 'matrix(1 2 3 4 5 6) rotate(10 20 30)'},
+  {at: 0.2, is: 'matrix(1 2 3 4 5 6) rotate(14 30 54)'},
+  {at: 0.6, is: 'matrix(1 2 3 4 5 6) rotate(22 50 102)'},
+  {at: 1, is: 'matrix(1 2 3 4 5 6) rotate(30 70 150)'},
+  {at: 1.4, is: 'matrix(1 2 3 4 5 6) rotate(38 90 198)'}
+]);
+
+</script>
+</body>
+</html>
diff --git a/third_party/WebKit/LayoutTests/fast/css/variables/variable-resolution-order-independent.html b/third_party/WebKit/LayoutTests/fast/css/variables/variable-resolution-order-independent.html
new file mode 100644
index 0000000..41806e42
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/css/variables/variable-resolution-order-independent.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+<style>
+div {
+    width: 100px;
+    height: 100px;
+}
+#firstdiv {
+    --green: green;
+    --clr: var(--green);
+    --foo: var(--clr);
+    --bar: var(--clr);
+    background-color: var(--bar);
+}
+#seconddiv {
+    --green: green;
+    --clr: var(--green);
+    --bar: var(--clr);
+    --foo: var(--clr);
+    background-color: var(--bar);
+}
+</style>
+
+<div id="firstdiv"></div>
+<div id="seconddiv"></div>
+
+<script>
+test(function() {
+  assert_equals(getComputedStyle(firstdiv).backgroundColor, 'rgb(0, 128, 0)');
+  assert_equals(getComputedStyle(seconddiv).backgroundColor, 'rgb(0, 128, 0)');
+}, 'Background color needs to resolved to green independent of ordering of variable declaration.');
+</script>
diff --git a/third_party/WebKit/LayoutTests/fast/scrolling/fractional-scroll-height-chaining-expected.txt b/third_party/WebKit/LayoutTests/fast/scrolling/fractional-scroll-height-chaining-expected.txt
new file mode 100644
index 0000000..bd8e53a
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/scrolling/fractional-scroll-height-chaining-expected.txt
@@ -0,0 +1,10 @@
+Verifies that main-thread scrolls chain correctly from a fractional-height scroller to its parent.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS scrollY is 40
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/third_party/WebKit/LayoutTests/fast/scrolling/fractional-scroll-height-chaining.html b/third_party/WebKit/LayoutTests/fast/scrolling/fractional-scroll-height-chaining.html
new file mode 100644
index 0000000..2eb2a04a
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/scrolling/fractional-scroll-height-chaining.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<script src="../../resources/js-test.js"></script>
+<style>
+
+#scroller {
+    background-color: #ccc;
+    margin-top: 20px;
+    overflow: scroll;
+}
+
+#fracheight {
+    height: 1200.3px;
+}
+
+</style>
+<div id="scroller" onmousewheel="">
+  <div id="fracheight"></div>
+</div>
+<script>
+description("Verifies that main-thread scrolls chain correctly from a " +
+            "fractional-height scroller to its parent.");
+
+if (window.eventSender) {
+    internals.settings.setScrollAnimatorEnabled(false);
+    eventSender.mouseMoveTo(100, 400);
+    eventSender.mouseScrollBy(0, -1);
+    shouldBe("scrollY", "40");
+}
+else
+    debug("To run interactively, try to scroll the page with the mouse " +
+          "wheel while the pointer is inside the gray box below.")
+
+</script>
diff --git a/third_party/WebKit/LayoutTests/fast/table/table-rowspan-cell-override-logical-content-height-reset-issue-expected.txt b/third_party/WebKit/LayoutTests/fast/table/table-rowspan-cell-override-logical-content-height-reset-issue-expected.txt
new file mode 100644
index 0000000..e72b8a0
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/table/table-rowspan-cell-override-logical-content-height-reset-issue-expected.txt
@@ -0,0 +1,4 @@
+Test for chromium bug : 445253. Setting rowspan=2 on the table cell causes the whole table to resize again and again.
+
+
+PASS
diff --git a/third_party/WebKit/LayoutTests/fast/table/table-rowspan-cell-override-logical-content-height-reset-issue.html b/third_party/WebKit/LayoutTests/fast/table/table-rowspan-cell-override-logical-content-height-reset-issue.html
new file mode 100644
index 0000000..3bee468d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/table/table-rowspan-cell-override-logical-content-height-reset-issue.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<style>
+    td, textarea { font: 20px/1 Ahem }
+</style>
+<script src="../../resources/check-layout.js"></script>
+<body>
+    <h3>Test for chromium bug : <a href="https://code.google.com/p/chromium/issues/detail?id=445253">445253</a>. Setting rowspan=2 on the table cell causes the whole table to resize again and again.</h3>
+    <table border="1" data-expected-height="58">
+        <tr>
+            <td rowspan="2" id="ta"><textarea style='height:100%;'>Text area text</textarea></td>
+        </tr>
+    </table>
+</body>
+
+<script>
+    document.body.offsetTop;
+    document.getElementById("ta").rowSpan="2";
+    checkLayout('table');
+</script>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-001-expected.html b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-001-expected.html
new file mode 100644
index 0000000..e9bc3e80
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-001-expected.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Test Reference File</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<style>
+  #test {
+    border: 5px solid orange;
+    font: 20px/1 Ahem;
+    width: 200px;
+  }
+</style>
+<body>
+  <p class="instructions" style="display:none">Test passes if the black box is within the orange box.</p>
+  <p id="test">FillerText<br>FillerText<br>FillerText<br>FillerText</p>
+</body>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-001.html b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-001.html
new file mode 100644
index 0000000..7a01eaf4
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-001.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Test: overflow-wrap - break-word (basic)</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<link rel="author" title="Shiyou Tan" href="mailto:shiyoux.tan@intel.com">
+<link rel="help" title="6.2. Overflow Wrapping: the 'word-wrap'/'overflow-wrap' property" href="http://www.w3.org/TR/css-text-3/#overflow-wrap">
+<link rel="match" href="overflow-wrap-001-ref.html">
+<meta name="flags" content="ahem">
+<meta name="assert" content="The 'overflow-wrap' property set 'break-word' breaks the word at an arbitrary point">
+<style>
+  #test {
+    border: 5px solid orange;
+    font: 20px/1 Ahem;
+    overflow-wrap: break-word;
+    width: 200px;
+  }
+</style>
+<body>
+  <p class="instructions" style="display:none">Test passes if the black box is within the orange box.</p>
+  <p id="test">FillerTextFillerTextFillerTextFillerText</p>
+</body>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-002-expected.html b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-002-expected.html
new file mode 100644
index 0000000..236dc21
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-002-expected.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Test Reference File</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<style>
+  #ref {
+    border: 5px solid orange;
+    font: 20px/1 Ahem;
+    width: 200px;
+  }
+  #test {
+    border: 5px solid blue;
+    font: 20px/1 Ahem;
+    width: 200px;
+  }
+</style>
+<body>
+  <p class="instructions" style="display:none">Test passes if the black box overflows the blue border box, but fits within the orange border box.</p>
+  <p id="ref">FillerText<br>FillerText<br>FillerText<br>FillerText</p>
+  <p id="test">FillerTextFillerTextFillerTextFillerText</p>
+</body>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-002.html b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-002.html
new file mode 100644
index 0000000..a54e7a3f9b
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-002.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Test: overflow-wrap - break-word and white-space - nowrap</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<link rel="author" title="Shiyou Tan" href="mailto:shiyoux.tan@intel.com">
+<link rel="help" title="6.2. Overflow Wrapping: the 'word-wrap'/'overflow-wrap' property" href="http://www.w3.org/TR/css-text-3/#overflow-wrap">
+<link rel="help" href="http://www.w3.org/TR/css-text-3/#white-space">
+<link rel="match" href="overflow-wrap-002-ref.html">
+<meta name="flags" content="ahem">
+<meta name="assert" content="Test checks that the 'overflow-wrap' property has effect if and only if the 'white-space' allows wrapping">
+<style>
+  #ref {
+    border: 5px solid orange;
+    font: 20px/1 Ahem;
+    overflow-wrap: break-word;
+    width: 200px;
+  }
+  #test {
+    border: 5px solid blue;
+    font: 20px/1 Ahem;
+    overflow-wrap: break-word;
+    white-space: nowrap;
+    width: 200px;
+  }
+</style>
+<body>
+  <p class="instructions" style="display:none">Test passes if the black box overflows the blue border box, but fits within the orange border box.</p>
+  <p id="ref">FillerTextFillerTextFillerTextFillerText</p>
+  <p id="test">FillerTextFillerTextFillerTextFillerText</p>
+</body>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-003-expected.html b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-003-expected.html
new file mode 100644
index 0000000..fd43bf9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-003-expected.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Test Reference File</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<style>
+  #test {
+    border: 5px solid orange;
+    font: 20px/1 Ahem;
+    width: 20em;
+  }
+</style>
+<body>
+  <p class="instructions" style="display:none">Test passes if the black box displayed in two rows within the orange box.</p>
+  <p id="test">FillerTextFillerText<br>FillerTextFillerText</p>
+</body>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-003.html b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-003.html
new file mode 100644
index 0000000..6679524
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-003.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Test: overflow-wrap - break-word (white space)</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<link rel="author" title="Shiyou Tan" href="mailto:shiyoux.tan@intel.com">
+<link rel="help" title="6.2. Overflow Wrapping: the 'word-wrap'/'overflow-wrap' property" href="http://www.w3.org/TR/css-text-3/#overflow-wrap">
+<link rel="match" href="overflow-wrap-003-ref.html">
+<meta name="flags" content="ahem">
+<meta name="assert" content="The 'overflow-wrap' property set 'break-word' breaks line at white space">
+<style>
+  #test {
+    border: 5px solid orange;
+    font: 20px/1 Ahem;
+    overflow-wrap: break-word;
+    width: 20em;
+  }
+</style>
+<body>
+  <p class="instructions" style="display:none">Test passes if the black box displayed in two rows within the orange box.</p>
+  <p id="test">FillerTextFillerText FillerTextFillerText</p>
+</body>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-004-expected.html b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-004-expected.html
new file mode 100644
index 0000000..0df8e8b5
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-004-expected.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Test Reference File</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<style>
+  #test {
+    border: 5px solid orange;
+    font: 20px/1 Ahem;
+    width: 200px;
+  }
+</style>
+<body>
+  <p class="instructions" style="display:none">Test passes if the black box overflows the orange box.</p>
+  <p id="test">FillerTextFillerTextFillerTextFillerText</p>
+</body>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-004.html b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-004.html
new file mode 100644
index 0000000..428f7d5
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-004.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Test: overflow-wrap - normal (basic)</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<link rel="author" title="Shiyou Tan" href="mailto:shiyoux.tan@intel.com">
+<link rel="help" title="6.2. Overflow Wrapping: the 'word-wrap'/'overflow-wrap' property" href="http://www.w3.org/TR/css-text-3/#overflow-wrap">
+<link rel="match" href="overflow-wrap-004-ref.html">
+<meta name="flags" content="ahem">
+<meta name="assert" content="The 'overflow-wrap' property set 'normal' overflows container">
+<style>
+  #test {
+    border: 5px solid orange;
+    font: 20px/1 Ahem;
+    overflow-wrap: normal;
+    width: 200px;
+  }
+</style>
+<body>
+  <p class="instructions" style="display:none">Test passes if the black box overflows the orange box.</p>
+  <p id="test">FillerTextFillerTextFillerTextFillerText</p>
+</body>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-005-expected.html b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-005-expected.html
new file mode 100644
index 0000000..fd43bf9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-005-expected.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Test Reference File</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<style>
+  #test {
+    border: 5px solid orange;
+    font: 20px/1 Ahem;
+    width: 20em;
+  }
+</style>
+<body>
+  <p class="instructions" style="display:none">Test passes if the black box displayed in two rows within the orange box.</p>
+  <p id="test">FillerTextFillerText<br>FillerTextFillerText</p>
+</body>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-005.html b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-005.html
new file mode 100644
index 0000000..8f86f43
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-005.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Test: overflow-wrap - normal (white space)</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<link rel="author" title="Shiyou Tan" href="mailto:shiyoux.tan@intel.com">
+<link rel="help" title="6.2. Overflow Wrapping: the 'word-wrap'/'overflow-wrap' property" href="http://www.w3.org/TR/css-text-3/#overflow-wrap">
+<link rel="match" href="overflow-wrap-003-ref.html">
+<meta name="flags" content="ahem">
+<meta name="assert" content="The 'overflow-wrap' property set 'normal' will break line at white space">
+<style>
+  #test {
+    border: 5px solid orange;
+    font: 20px/1 Ahem;
+    overflow-wrap: normal;
+    width: 20em;
+  }
+</style>
+<body>
+  <p class="instructions" style="display:none">Test passes if the black box displayed in two rows within the orange box.</p>
+  <p id="test">FillerTextFillerText FillerTextFillerText</p>
+</body>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-break-word-001-expected.html b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-break-word-001-expected.html
new file mode 100644
index 0000000..0e0300a
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-break-word-001-expected.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Reference File</title>
+<link rel="author" title="Florian Rivoal" href="http://florian.rivoal.net/">
+<style>
+div {
+  position: relative;
+  width: 100px;
+  height: 100px;
+  background: green;
+}
+</style>
+<body>
+  <p>Test passes if there is a <strong>filled green square</strong> and <strong>no red</strong>.</p>
+  <div></div>
+</body>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-break-word-001.html b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-break-word-001.html
new file mode 100644
index 0000000..0601978
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-break-word-001.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Test: overflow-wrap: break-word</title>
+<link rel="author" title="Florian Rivoal" href="http://florian.rivoal.net/">
+<link rel="help" href="https://drafts.csswg.org/css-text-3/#valdef-overflow-wrap-break-word">
+<meta name="flags" content="ahem">
+<link rel="match" href="reference/overflow-wrap-break-word-001-ref.html">
+<meta name="assert" content="sequences of nbsp characters that would cause overflow are expected to be broken when overflow-wrap is break-word">
+<style>
+div {
+  position: relative;
+  width: 100px;
+  height: 100px;
+  font-family: ahem;
+  color: red;
+  overflow-wrap: break-word;
+  font-size: 25px;
+  line-height: 27px;
+}
+div::after{
+  content: "";
+  position: absolute;
+  top: 0; left: 0; bottom: 0; right: 0;
+  background: green;
+}
+</style>
+<body>
+  <p>Test passes if there is a <strong>filled green square</strong> and <strong>no red</strong>.</p>
+  <div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;X</div>
+</body>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-break-word-fit-content-001-expected.html b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-break-word-fit-content-001-expected.html
new file mode 100644
index 0000000..a1302472
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-break-word-fit-content-001-expected.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Test: overflow-wrap: break-word with fit-content</title>
+<link rel="author" title="Koji Ishii" href="kojiishi@gmail.com">
+<style>
+.test {
+  display: inline-block;
+  font-size: 20px;
+  line-height: 1;
+  margin-bottom: .2em;
+}
+</style>
+<body>
+<div id="log"></div>
+<p class="instructions" style="display:none">Tests pass if all lines do not wrap.
+<div><div class="test">&#x1D70B;</div></div>
+<div><div class="test">𝜋</div></div>
+</body>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-break-word-fit-content-001.html b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-break-word-fit-content-001.html
new file mode 100644
index 0000000..66cffbf
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/overflow-wrap-break-word-fit-content-001.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Test: overflow-wrap: break-word with fit-content</title>
+<link rel="author" title="Koji Ishii" href="kojiishi@gmail.com">
+<link rel="help" title="6.2. Overflow Wrapping: the 'word-wrap'/'overflow-wrap' property" href="http://www.w3.org/TR/css-text-3/#overflow-wrap">
+<meta name="flags" content="">
+<link rel="match" href="reference/overflow-wrap-break-word-fit-content-001.html">
+<meta name="assert" content="The 'overflow-wrap: break-word' must not break surrogate pairs">
+<style>
+.test {
+  display: inline-block;
+  word-wrap: break-word;
+  font-size: 20px;
+  line-height: 1;
+  margin-bottom: .2em;
+}
+</style>
+<body>
+<div id="log"></div>
+<p class="instructions" style="display:none">Tests pass if all lines do not wrap.
+<div><div class="test">&#x1D70B;</div></div>
+<div><div class="test">𝜋</div></div>
+</body>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-001-expected.html b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-001-expected.html
new file mode 100644
index 0000000..e9bc3e80
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-001-expected.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Test Reference File</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<style>
+  #test {
+    border: 5px solid orange;
+    font: 20px/1 Ahem;
+    width: 200px;
+  }
+</style>
+<body>
+  <p class="instructions" style="display:none">Test passes if the black box is within the orange box.</p>
+  <p id="test">FillerText<br>FillerText<br>FillerText<br>FillerText</p>
+</body>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-001.html b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-001.html
new file mode 100644
index 0000000..a51a91b
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-001.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Test: word-wrap - break-word (basic)</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<link rel="author" title="Shiyou Tan" href="mailto:shiyoux.tan@intel.com">
+<link rel="help" title="6.2. Overflow Wrapping: the 'word-wrap'/'overflow-wrap' property" href="http://www.w3.org/TR/css-text-3/#overflow-wrap">
+<link rel="match" href="overflow-wrap-001-ref.html">
+<meta name="flags" content="ahem">
+<meta name="assert" content="The 'word-wrap' property set 'break-word' breaks the word at an arbitrary point">
+<style>
+  #test {
+    border: 5px solid orange;
+    font: 20px/1 Ahem;
+    word-wrap: break-word;
+    width: 200px;
+  }
+</style>
+<body>
+  <p class="instructions" style="display:none">Test passes if the black box is within the orange box.</p>
+  <p id="test">FillerTextFillerTextFillerTextFillerText</p>
+</body>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-002-expected.html b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-002-expected.html
new file mode 100644
index 0000000..236dc21
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-002-expected.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Test Reference File</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<style>
+  #ref {
+    border: 5px solid orange;
+    font: 20px/1 Ahem;
+    width: 200px;
+  }
+  #test {
+    border: 5px solid blue;
+    font: 20px/1 Ahem;
+    width: 200px;
+  }
+</style>
+<body>
+  <p class="instructions" style="display:none">Test passes if the black box overflows the blue border box, but fits within the orange border box.</p>
+  <p id="ref">FillerText<br>FillerText<br>FillerText<br>FillerText</p>
+  <p id="test">FillerTextFillerTextFillerTextFillerText</p>
+</body>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-002.html b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-002.html
new file mode 100644
index 0000000..50597d8
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-002.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Test: word-wrap - break-word and white-space - nowrap</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<link rel="author" title="Shiyou Tan" href="mailto:shiyoux.tan@intel.com">
+<link rel="help" title="6.2. Overflow Wrapping: the 'word-wrap'/'overflow-wrap' property" href="http://www.w3.org/TR/css-text-3/#overflow-wrap">
+<link rel="help" href="http://www.w3.org/TR/css-text-3/#white-space">
+<link rel="match" href="overflow-wrap-002-ref.html">
+<meta name="flags" content="ahem">
+<meta name="assert" content="Test checks that the 'word-wrap' property has effect if and only if the 'white-space' allows wrapping">
+<style>
+  #ref {
+    border: 5px solid orange;
+    font: 20px/1 Ahem;
+    word-wrap: break-word;
+    width: 200px;
+  }
+  #test {
+    border: 5px solid blue;
+    font: 20px/1 Ahem;
+    word-wrap: break-word;
+    white-space: nowrap;
+    width: 200px;
+  }
+</style>
+<body>
+  <p class="instructions" style="display:none">Test passes if the black box overflows the blue border box, but fits within the orange border box.</p>
+  <p id="ref">FillerTextFillerTextFillerTextFillerText</p>
+  <p id="test">FillerTextFillerTextFillerTextFillerText</p>
+</body>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-003-expected.html b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-003-expected.html
new file mode 100644
index 0000000..fd43bf9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-003-expected.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Test Reference File</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<style>
+  #test {
+    border: 5px solid orange;
+    font: 20px/1 Ahem;
+    width: 20em;
+  }
+</style>
+<body>
+  <p class="instructions" style="display:none">Test passes if the black box displayed in two rows within the orange box.</p>
+  <p id="test">FillerTextFillerText<br>FillerTextFillerText</p>
+</body>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-003.html b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-003.html
new file mode 100644
index 0000000..dd49385
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-003.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Test: word-wrap - break-word (white space)</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<link rel="author" title="Shiyou Tan" href="mailto:shiyoux.tan@intel.com">
+<link rel="help" title="6.2. Overflow Wrapping: the 'word-wrap'/'overflow-wrap' property" href="http://www.w3.org/TR/css-text-3/#overflow-wrap">
+<link rel="match" href="overflow-wrap-003-ref.html">
+<meta name="flags" content="ahem">
+<meta name="assert" content="The 'word-wrap' property set 'break-word' breaks line at white space">
+<style>
+  #test {
+    border: 5px solid orange;
+    font: 20px/1 Ahem;
+    word-wrap: break-word;
+    width: 20em;
+  }
+</style>
+<body>
+  <p class="instructions" style="display:none">Test passes if the black box displayed in two rows within the orange box.</p>
+  <p id="test">FillerTextFillerText FillerTextFillerText</p>
+</body>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-004-expected.html b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-004-expected.html
new file mode 100644
index 0000000..0df8e8b5
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-004-expected.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Test Reference File</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<style>
+  #test {
+    border: 5px solid orange;
+    font: 20px/1 Ahem;
+    width: 200px;
+  }
+</style>
+<body>
+  <p class="instructions" style="display:none">Test passes if the black box overflows the orange box.</p>
+  <p id="test">FillerTextFillerTextFillerTextFillerText</p>
+</body>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-004.html b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-004.html
new file mode 100644
index 0000000..02e7e2d7
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-004.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Test: word-wrap - normal (basic)</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<link rel="author" title="Shiyou Tan" href="mailto:shiyoux.tan@intel.com">
+<link rel="help" title="6.2. Overflow Wrapping: the 'word-wrap'/'overflow-wrap' property" href="http://www.w3.org/TR/css-text-3/#overflow-wrap">
+<link rel="match" href="overflow-wrap-004-ref.html">
+<meta name="flags" content="ahem">
+<meta name="assert" content="The 'word-wrap' property set 'normal' overflows container">
+<style>
+  #test {
+    border: 5px solid orange;
+    font: 20px/1 Ahem;
+    word-wrap: normal;
+    width: 200px;
+  }
+</style>
+<body>
+  <p class="instructions" style="display:none">Test passes if the black box overflows the orange box.</p>
+  <p id="test">FillerTextFillerTextFillerTextFillerText</p>
+</body>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-005-expected.html b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-005-expected.html
new file mode 100644
index 0000000..fd43bf9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-005-expected.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Test Reference File</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<style>
+  #test {
+    border: 5px solid orange;
+    font: 20px/1 Ahem;
+    width: 20em;
+  }
+</style>
+<body>
+  <p class="instructions" style="display:none">Test passes if the black box displayed in two rows within the orange box.</p>
+  <p id="test">FillerTextFillerText<br>FillerTextFillerText</p>
+</body>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-005.html b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-005.html
new file mode 100644
index 0000000..99eb81cc
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/imported/csswg-test/css-text-3/overflow-wrap/word-wrap-005.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>CSS Text Test: word-wrap - normal (white space)</title>
+<link rel="author" title="Intel" href="http://www.intel.com">
+<link rel="author" title="Shiyou Tan" href="mailto:shiyoux.tan@intel.com">
+<link rel="help" title="6.2. Overflow Wrapping: the 'word-wrap'/'overflow-wrap' property" href="http://www.w3.org/TR/css-text-3/#overflow-wrap">
+<link rel="match" href="overflow-wrap-003-ref.html">
+<meta name="flags" content="ahem">
+<meta name="assert" content="The 'word-wrap' property set 'normal' will break line at white space">
+<style>
+  #test {
+    border: 5px solid orange;
+    font: 20px/1 Ahem;
+    word-wrap: normal;
+    width: 20em;
+  }
+</style>
+<body>
+  <p class="instructions" style="display:none">Test passes if the black box displayed in two rows within the orange box.</p>
+  <p id="test">FillerTextFillerText FillerTextFillerText</p>
+</body>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-writing-modes-3/text-orientation-014-expected.xht b/third_party/WebKit/LayoutTests/imported/csswg-test/css-writing-modes-3/text-orientation-014-expected.xht
deleted file mode 100644
index 8e96cc6..0000000
--- a/third_party/WebKit/LayoutTests/imported/csswg-test/css-writing-modes-3/text-orientation-014-expected.xht
+++ /dev/null
@@ -1,52 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
-<html xmlns="http://www.w3.org/1999/xhtml">
-	<head>
-		<title>CSS Reftest Reference</title>
-		<!--  reftest for text-orientation-014.xht  -->
-		<link rel="author" title="Taka Oshiyama" href="mailto:takaoshiyama@gmail.com" />
-		<meta http-equiv="content-language" content="en" />
-		<style type="text/css">
-				.view_ahem
-				{
-					background: pink;
-					border: 1px solid black;
-					color: blue;
-					font: 20px/1 "Ahem";
-					height: 3em;
-					margin: 10px;
-					width: 3em;
-					white-space: pre;
-				}
-				.control_ahem
-				{
-					writing-mode: horizontal-tb;
-				}
-				.view
-				{
-					border: 1px solid gray;
-					font-size: 1.5em;
-					line-height: 1.5;
-					margin-bottom: 10px;
-					width: 3em;
-					writing-mode: vertical-rl;
-				}
-				.control
-				{
-					text-combine-upright: none;
-				}
-		</style>
-	</head>
-	<body lang="en">
-		<p>Test passes if a pair of rectangles is <strong>identical</strong> including <strong>layout</strong> and <strong>orientation</strong>.</p>
-		<div class="view_ahem"><span class="control_ahem">7 1
- 52
- 63</span></div>
-		<div class="view_ahem"><span class="control_ahem">7 1
- 52
- 63</span></div>
-		<hr />
-		<div class="view"><span class="control">123Abc<br />def456</span></div>
-		<div class="view"><span class="control">123Abc<br />def456</span></div>
-	</body>
-</html>
diff --git a/third_party/WebKit/LayoutTests/imported/csswg-test/css-writing-modes-3/text-orientation-014.xht b/third_party/WebKit/LayoutTests/imported/csswg-test/css-writing-modes-3/text-orientation-014.xht
deleted file mode 100644
index 390d70dd..0000000
--- a/third_party/WebKit/LayoutTests/imported/csswg-test/css-writing-modes-3/text-orientation-014.xht
+++ /dev/null
@@ -1,70 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
-<html xmlns="http://www.w3.org/1999/xhtml">
-	<head>
-		<title>CSS Writing Modes Test: text-orientation - sideways</title>
-		<link rel="author" title="Taka Oshiyama" href="mailto:takaoshiyama@gmail.com" />
-		<link rel="help" title="5.1. Orienting Text: the 'text-orientation' property" href="http://www.w3.org/TR/css-writing-modes-3/#text-orientation" />
-		<link rel="match" href="reference/text-orientation-014-ref.xht" />
-		<meta http-equiv="content-language" content="en" />
-		<meta name="flags" content="ahem" />
-		<meta name="assert" content="This test checks that 'text-orientation: sideways' causes text to be set as if in a horizontal layout, but rotated 90° clockwise, in vertical writing modes. This is effective to verify 1.block flow direction, 2.inline direction and 3.glyph orientation." />
-		<style type="text/css">
-				.view_ahem
-				{
-					background: pink;
-					border: 1px solid black;
-					color: blue;
-					font: 20px/1 "Ahem";
-					height: 3em;
-					margin: 10px;
-					width: 3em;
-					white-space: pre;
-				}
-				#test_ahem
-				{
-					text-orientation: sideways;				/* The property to be tested */
-					writing-mode: vertical-rl;
-				}
-				#control_ahem
-				{
-					writing-mode: horizontal-tb;
-				}
-				.view
-				{
-					border: 1px solid gray;
-					font-size: 1.5em;
-					line-height: 1.5;
-					margin-bottom: 10px;
-					width: 3em;
-					writing-mode: vertical-rl;
-				}
-				#test
-				{
-					text-orientation: sideways;				/* The property to be tested */
-				}
-				#control
-				{
-					text-combine-upright: none;
-				}
-		</style>
-	</head>
-	<body lang="en">
-		<!-- 
-			This test consists of a pair of sub-tests which complements each other.
-			Logically, the test should verify 1.block flow direction, 2.inline direction
-			and 3.glyph orientation. The "Ahem" sub-test comes first and checks 1. and 2. ,
-			whereas "glyph" sub-test comes later and also checks 3.
-		 -->
-		<p>Test passes if a pair of rectangles is <strong>identical</strong> including <strong>layout</strong> and <strong>orientation</strong>.</p>
-		<div class="view_ahem"><span id="test_ahem">123
- 56
-7  </span></div>
-		<div class="view_ahem"><span id="control_ahem">7 1
- 52
- 63</span></div>
-		<hr />
-		<div class="view"><span id="test">123Abc<br />def456</span></div>
-		<div class="view"><span id="control">123Abc<br />def456</span></div>
-	</body>
-</html>
diff --git a/third_party/WebKit/Source/build/scripts/in_generator.py b/third_party/WebKit/Source/build/scripts/in_generator.py
index fcd5f01..841f00e 100644
--- a/third_party/WebKit/Source/build/scripts/in_generator.py
+++ b/third_party/WebKit/Source/build/scripts/in_generator.py
@@ -50,11 +50,6 @@
             self.in_file = None
         self._outputs = {}  # file_name -> generator
 
-    def wrap_with_condition(self, string, condition):
-        if not condition:
-            return string
-        return "#if ENABLE(%(condition)s)\n%(string)s\n#endif" % { 'condition' : condition, 'string' : string }
-
     def _write_file_if_changed(self, output_dir, contents, file_name):
         path = os.path.join(output_dir, file_name)
 
diff --git a/third_party/WebKit/Source/build/scripts/make_element_type_helpers.py b/third_party/WebKit/Source/build/scripts/make_element_type_helpers.py
index 76fee0e..f502fc9 100755
--- a/third_party/WebKit/Source/build/scripts/make_element_type_helpers.py
+++ b/third_party/WebKit/Source/build/scripts/make_element_type_helpers.py
@@ -42,7 +42,6 @@
         'namespaceURI': '',
     }
     filters = {
-        'enable_conditional': name_utilities.enable_conditional_if_endif,
         'hash': hasher.hash,
         'symbol': _symbol,
     }
diff --git a/third_party/WebKit/Source/build/scripts/make_event_factory.py b/third_party/WebKit/Source/build/scripts/make_event_factory.py
index d89ce5d..aa87658f 100755
--- a/third_party/WebKit/Source/build/scripts/make_event_factory.py
+++ b/third_party/WebKit/Source/build/scripts/make_event_factory.py
@@ -62,7 +62,6 @@
 class EventFactoryWriter(in_generator.Writer):
     defaults = {
         'ImplementedAs': None,
-        'Conditional': None,
         'RuntimeEnabled': None,
     }
     default_parameters = {
@@ -72,7 +71,6 @@
     }
     filters = {
         'cpp_name': name_utilities.cpp_name,
-        'enable_conditional': name_utilities.enable_conditional_if_endif,
         'lower_first': name_utilities.lower_first,
         'case_insensitive_matching': case_insensitive_matching,
         'script_name': name_utilities.script_name,
@@ -126,12 +124,11 @@
                 subdir_name = 'modules'
             else:
                 subdir_name = 'core'
-            include = '#include "%(path)s"\n#include "bindings/%(subdir_name)s/v8/V8%(script_name)s.h"' % {
+            includes[cpp_name] = '#include "%(path)s"\n#include "bindings/%(subdir_name)s/v8/V8%(script_name)s.h"' % {
                 'path': self._headers_header_include_path(entry),
                 'script_name': name_utilities.script_name(entry),
                 'subdir_name': subdir_name,
             }
-            includes[cpp_name] = self.wrap_with_condition(include, entry['Conditional'])
         return includes.values()
 
     def generate_headers_header(self):
diff --git a/third_party/WebKit/Source/build/scripts/make_experimental_features.py b/third_party/WebKit/Source/build/scripts/make_experimental_features.py
index 05fc835..3033d950 100755
--- a/third_party/WebKit/Source/build/scripts/make_experimental_features.py
+++ b/third_party/WebKit/Source/build/scripts/make_experimental_features.py
@@ -39,9 +39,6 @@
 # but generate different files.
 class ExperimentalFeatureWriter(make_runtime_features.RuntimeFeatureWriter):
     class_name = 'ExperimentalFeatures'
-    filters = {
-        'enable_conditional': name_utilities.enable_conditional_if_endif,
-    }
 
     def __init__(self, in_file_path):
         super(ExperimentalFeatureWriter, self).__init__(in_file_path)
@@ -56,7 +53,7 @@
             'features': self._features,
         }
 
-    @template_expander.use_jinja(class_name + '.h.tmpl', filters=filters)
+    @template_expander.use_jinja(class_name + '.h.tmpl')
     def generate_header(self):
         return {
             'features': self._features,
diff --git a/third_party/WebKit/Source/build/scripts/make_internal_runtime_flags.py b/third_party/WebKit/Source/build/scripts/make_internal_runtime_flags.py
index 216ed431..1313941 100755
--- a/third_party/WebKit/Source/build/scripts/make_internal_runtime_flags.py
+++ b/third_party/WebKit/Source/build/scripts/make_internal_runtime_flags.py
@@ -40,9 +40,6 @@
 # but generate different files.
 class InternalRuntimeFlagsWriter(make_runtime_features.RuntimeFeatureWriter):
     class_name = 'InternalRuntimeFlags'
-    filters = {
-        'enable_conditional': name_utilities.enable_conditional_if_endif,
-    }
 
     def __init__(self, in_file_path):
         super(InternalRuntimeFlagsWriter, self).__init__(in_file_path)
@@ -57,7 +54,7 @@
             'standard_features': self._standard_features,
         }
 
-    @template_expander.use_jinja(class_name + '.h.tmpl', filters=filters)
+    @template_expander.use_jinja(class_name + '.h.tmpl')
     def generate_header(self):
         return {
             'features': self._features,
diff --git a/third_party/WebKit/Source/build/scripts/make_names.py b/third_party/WebKit/Source/build/scripts/make_names.py
index 52eed3a..740c5fa6 100755
--- a/third_party/WebKit/Source/build/scripts/make_names.py
+++ b/third_party/WebKit/Source/build/scripts/make_names.py
@@ -57,7 +57,6 @@
     }
     filters = {
         'cpp_name': name_utilities.cpp_name,
-        'enable_conditional': name_utilities.enable_conditional_if_endif,
         'hash': hasher.hash,
         'script_name': name_utilities.script_name,
         'symbol': _symbol,
diff --git a/third_party/WebKit/Source/build/scripts/make_qualified_names.py b/third_party/WebKit/Source/build/scripts/make_qualified_names.py
index f93e83e..a7d9d1a7 100755
--- a/third_party/WebKit/Source/build/scripts/make_qualified_names.py
+++ b/third_party/WebKit/Source/build/scripts/make_qualified_names.py
@@ -56,7 +56,6 @@
     }
     filters = {
         'hash': hasher.hash,
-        'enable_conditional': name_utilities.enable_conditional_if_endif,
         'symbol': _symbol,
         'to_macro_style': name_utilities.to_macro_style,
     }
diff --git a/third_party/WebKit/Source/build/scripts/make_runtime_features.py b/third_party/WebKit/Source/build/scripts/make_runtime_features.py
index 273d91f..c44550c0 100755
--- a/third_party/WebKit/Source/build/scripts/make_runtime_features.py
+++ b/third_party/WebKit/Source/build/scripts/make_runtime_features.py
@@ -37,9 +37,6 @@
 
 class RuntimeFeatureWriter(in_generator.Writer):
     class_name = 'RuntimeEnabledFeatures'
-    filters = {
-        'enable_conditional': name_utilities.enable_conditional_if_endif,
-    }
 
     # FIXME: valid_values and defaults should probably roll into one object.
     valid_values = {
@@ -87,11 +84,11 @@
             'standard_features': self._standard_features,
         }
 
-    @template_expander.use_jinja(class_name + '.h.tmpl', filters=filters)
+    @template_expander.use_jinja(class_name + '.h.tmpl')
     def generate_header(self):
         return self._template_inputs()
 
-    @template_expander.use_jinja(class_name + '.cpp.tmpl', filters=filters)
+    @template_expander.use_jinja(class_name + '.cpp.tmpl')
     def generate_implementation(self):
         return self._template_inputs()
 
diff --git a/third_party/WebKit/Source/build/scripts/name_utilities.py b/third_party/WebKit/Source/build/scripts/name_utilities.py
index fd853b2..88d9ac4c 100644
--- a/third_party/WebKit/Source/build/scripts/name_utilities.py
+++ b/third_party/WebKit/Source/build/scripts/name_utilities.py
@@ -84,13 +84,3 @@
 
 def cpp_name(entry):
     return entry['ImplementedAs'] or script_name(entry)
-
-
-def enable_conditional_if_endif(code, feature):
-    # Jinja2 filter to generate if/endif directive blocks based on a feature
-    if not feature:
-        return code
-    condition = 'ENABLE(%s)' % feature
-    return ('#if %s\n' % condition +
-            code +
-            '#endif // %s\n' % condition)
diff --git a/third_party/WebKit/Source/build/scripts/templates/ElementFactory.cpp.tmpl b/third_party/WebKit/Source/build/scripts/templates/ElementFactory.cpp.tmpl
index 4fc9d67..9f1814d 100644
--- a/third_party/WebKit/Source/build/scripts/templates/ElementFactory.cpp.tmpl
+++ b/third_party/WebKit/Source/build/scripts/templates/ElementFactory.cpp.tmpl
@@ -33,7 +33,6 @@
 static FunctionMap* g_constructors = 0;
 
 {% for tag in tags|sort if not tag.noConstructor %}
-{% filter enable_conditional(tag.Conditional) %}
 static PassRefPtrWillBeRawPtr<{{namespace}}Element> {{tag|symbol}}Constructor(
     Document& document,
     {% if namespace == 'HTML' %}
@@ -52,7 +51,6 @@
         {%- if tag.constructorNeedsCreatedByParser %}, createdByParser{% endif -%}
     );
 }
-{% endfilter %}
 {% endfor %}
 
 struct Create{{namespace}}FunctionMapData {
@@ -68,9 +66,7 @@
     // compile in MSVC. If tags list is empty, add check to skip this.
     static const Create{{namespace}}FunctionMapData data[] = {
     {% for tag in tags|sort if not tag.noConstructor %}
-    {% filter enable_conditional(tag.Conditional) %}
         { {{tag|symbol}}Tag, {{tag|symbol}}Constructor },
-    {% endfilter %}
     {% endfor %}
     };
     for (size_t i = 0; i < WTF_ARRAY_LENGTH(data); i++)
diff --git a/third_party/WebKit/Source/build/scripts/templates/ElementTypeHelpers.h.tmpl b/third_party/WebKit/Source/build/scripts/templates/ElementTypeHelpers.h.tmpl
index 124db34..ceaee9c 100644
--- a/third_party/WebKit/Source/build/scripts/templates/ElementTypeHelpers.h.tmpl
+++ b/third_party/WebKit/Source/build/scripts/templates/ElementTypeHelpers.h.tmpl
@@ -11,7 +11,6 @@
 namespace blink {
 // Type checking.
 {% for tag in tags|sort if not tag.multipleTagNames and not tag.noTypeHelpers %}
-{% filter enable_conditional(tag.Conditional) %}
 class {{tag.interface}};
 void is{{tag.interface}}(const {{tag.interface}}&); // Catch unnecessary runtime check of type known at compile time.
 void is{{tag.interface}}(const {{tag.interface}}*); // Catch unnecessary runtime check of type known at compile time.
@@ -30,16 +29,13 @@
 inline bool is{{tag.interface}}(const Node* node) { return node && is{{tag.interface}}(*node); }
 template <> inline bool isElementOfType<const {{tag.interface}}>(const Node& node) { return is{{tag.interface}}(node); }
 template <> inline bool isElementOfType<const {{tag.interface}}>(const {{namespace}}Element& element) { return is{{tag.interface}}(element); }
-{% endfilter %}
 
 {% endfor %}
 // Using macros because the types are forward-declared and we don't want to use reinterpret_cast in the
 // casting functions above. reinterpret_cast would be unsafe due to multiple inheritence.
 
 {% for tag in tags|sort if not tag.multipleTagNames and not tag.noTypeHelpers %}
-{% filter enable_conditional(tag.Conditional) %}
 #define to{{tag.interface}}(x) blink::toElement<blink::{{tag.interface}}>(x)
-{% endfilter %}
 {% endfor %}
 } // namespace blink
 
diff --git a/third_party/WebKit/Source/build/scripts/templates/EventFactory.cpp.tmpl b/third_party/WebKit/Source/build/scripts/templates/EventFactory.cpp.tmpl
index b09af67d..cdc87e5 100644
--- a/third_party/WebKit/Source/build/scripts/templates/EventFactory.cpp.tmpl
+++ b/third_party/WebKit/Source/build/scripts/templates/EventFactory.cpp.tmpl
@@ -15,14 +15,12 @@
 PassRefPtrWillBeRawPtr<{{namespace}}> {{namespace}}{{suffix}}Factory::create(const String& type)
 {
     {% for event in events %}
-    {% filter enable_conditional(event.Conditional) %}
     {% if event|script_name|case_insensitive_matching %}
     if (equalIgnoringCase(type, "{{event|script_name}}"){% if event.RuntimeEnabled %} && RuntimeEnabledFeatures::{{event.RuntimeEnabled|lower_first}}(){% endif %})
     {% else %}
     if (type == "{{event|script_name}}"{% if event.RuntimeEnabled %} && RuntimeEnabledFeatures::{{event.RuntimeEnabled|lower_first}}(){% endif %})
     {% endif %}
         return {{event|cpp_name}}::create();
-    {% endfilter %}
     {% endfor %}
     return nullptr;
 }
diff --git a/third_party/WebKit/Source/build/scripts/templates/InternalRuntimeFlags.h.tmpl b/third_party/WebKit/Source/build/scripts/templates/InternalRuntimeFlags.h.tmpl
index 12bacc6..df2f2f6 100644
--- a/third_party/WebKit/Source/build/scripts/templates/InternalRuntimeFlags.h.tmpl
+++ b/third_party/WebKit/Source/build/scripts/templates/InternalRuntimeFlags.h.tmpl
@@ -28,9 +28,7 @@
     If we do that, we also need to respect Internals::resetToConsistentState.
 #}
     {% for feature in standard_features %}
-    {% filter enable_conditional(feature.condition) %}
     bool {{feature.first_lowered_name}}Enabled() { return RuntimeEnabledFeatures::{{feature.first_lowered_name}}Enabled(); }
-    {% endfilter %}
     {% endfor %}
 
     DEFINE_INLINE_TRACE() { }
diff --git a/third_party/WebKit/Source/build/scripts/templates/MakeNames.cpp.tmpl b/third_party/WebKit/Source/build/scripts/templates/MakeNames.cpp.tmpl
index 93309dc..e29eab8 100644
--- a/third_party/WebKit/Source/build/scripts/templates/MakeNames.cpp.tmpl
+++ b/third_party/WebKit/Source/build/scripts/templates/MakeNames.cpp.tmpl
@@ -18,9 +18,7 @@
 void* {{suffix}}NamesStorage[{{namespace}}{{suffix}}NamesCount * ((sizeof(AtomicString) + sizeof(void *) - 1) / sizeof(void *))];
 
 {% for entry in entries|sort(attribute='name', case_sensitive=True) %}
-{% filter enable_conditional(entry.Conditional) %}
 const AtomicString& {{entry|symbol}} = reinterpret_cast<AtomicString*>(&{{suffix}}NamesStorage)[{{loop.index0}}];
-{% endfilter %}
 {% endfor %}
 
 void init{{suffix}}()
diff --git a/third_party/WebKit/Source/build/scripts/templates/MakeNames.h.tmpl b/third_party/WebKit/Source/build/scripts/templates/MakeNames.h.tmpl
index e1ff10b..6ee6ad6 100644
--- a/third_party/WebKit/Source/build/scripts/templates/MakeNames.h.tmpl
+++ b/third_party/WebKit/Source/build/scripts/templates/MakeNames.h.tmpl
@@ -27,9 +27,7 @@
 namespace {{namespace}}Names {
 
 {% for entry in entries|sort %}
-{% filter enable_conditional(entry.Conditional) %}
 {{symbol_export}}extern const WTF::AtomicString& {{entry|symbol}};
-{% endfilter %}
 {% endfor %}
 
 const unsigned {{namespace}}{{suffix}}NamesCount = {{entries|length}};
diff --git a/third_party/WebKit/Source/build/scripts/templates/RuntimeEnabledFeatures.cpp.tmpl b/third_party/WebKit/Source/build/scripts/templates/RuntimeEnabledFeatures.cpp.tmpl
index 5405244..116573e 100644
--- a/third_party/WebKit/Source/build/scripts/templates/RuntimeEnabledFeatures.cpp.tmpl
+++ b/third_party/WebKit/Source/build/scripts/templates/RuntimeEnabledFeatures.cpp.tmpl
@@ -26,9 +26,7 @@
 RuntimeEnabledFeatures::Backup::Backup()
     :
     {% for feature in standard_features %}
-    {% filter enable_conditional(feature.condition) %}
     {%+ if not loop.first %}, {% endif -%}m_{{feature.first_lowered_name}}(RuntimeEnabledFeatures::{{feature.first_lowered_name}}Enabled())
-    {% endfilter %}
     {% endfor %}
 {
 }
@@ -36,9 +34,7 @@
 void RuntimeEnabledFeatures::Backup::restore()
 {
     {% for feature in standard_features %}
-    {% filter enable_conditional(feature.condition) %}
     RuntimeEnabledFeatures::set{{feature.name}}Enabled(m_{{feature.first_lowered_name}});
-    {% endfilter %}
     {% endfor %}
 }
 
@@ -55,20 +51,16 @@
 void RuntimeEnabledFeatures::setFeatureEnabledFromString(const std::string& name, bool isEnabled)
 {
     {% for feature in standard_features %}
-    {% filter enable_conditional(feature.condition) %}
     if (caseInsensitiveEqual(name, "{{feature.name}}")) {
         set{{feature.name}}Enabled(isEnabled);
         return;
     }
-    {% endfilter %}
     {% endfor %}
     WTF_LOG_ERROR("RuntimeEnabledFeature not recognized: %s", name.c_str());
 }
 
 {% for feature in standard_features %}
-{% filter enable_conditional(feature.condition) %}
 bool RuntimeEnabledFeatures::is{{feature.name}}Enabled = {{'true' if feature.status == 'stable' else 'false'}};
-{% endfilter %}
 {% endfor %}
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/build/scripts/templates/RuntimeEnabledFeatures.h.tmpl b/third_party/WebKit/Source/build/scripts/templates/RuntimeEnabledFeatures.h.tmpl
index 84a6bf4..bfdc7cba 100644
--- a/third_party/WebKit/Source/build/scripts/templates/RuntimeEnabledFeatures.h.tmpl
+++ b/third_party/WebKit/Source/build/scripts/templates/RuntimeEnabledFeatures.h.tmpl
@@ -23,9 +23,7 @@
 
     private:
         {% for feature in standard_features %}
-        {% filter enable_conditional(feature.condition) %}
         bool m_{{feature.first_lowered_name}};
-        {% endfilter %}
         {% endfor %}
     };
 
@@ -58,9 +56,7 @@
     RuntimeEnabledFeatures() { }
 
     {% for feature in standard_features %}
-    {% filter enable_conditional(feature.condition) %}
     static bool is{{feature.name}}Enabled;
-    {% endfilter %}
     {% endfor %}
 };
 
diff --git a/third_party/WebKit/Source/core/core.gypi b/third_party/WebKit/Source/core/core.gypi
index aece00b..1267bb8 100644
--- a/third_party/WebKit/Source/core/core.gypi
+++ b/third_party/WebKit/Source/core/core.gypi
@@ -2405,6 +2405,8 @@
             'dom/ElementDataCache.h',
             'dom/ElementFullscreen.cpp',
             'dom/ElementFullscreen.h',
+            'dom/ElementIntersectionObserverData.cpp',
+            'dom/ElementIntersectionObserverData.h',
             'dom/ElementRareData.cpp',
             'dom/ElementRareData.h',
             'dom/ElementTraversal.h',
@@ -2477,8 +2479,6 @@
             'dom/NodeFilter.cpp',
             'dom/NodeFilter.h',
             'dom/NodeFilterCondition.h',
-            'dom/NodeIntersectionObserverData.cpp',
-            'dom/NodeIntersectionObserverData.h',
             'dom/NodeIterator.cpp',
             'dom/NodeIterator.h',
             'dom/NodeIteratorBase.cpp',
diff --git a/third_party/WebKit/Source/core/css/resolver/CSSVariableResolver.cpp b/third_party/WebKit/Source/core/css/resolver/CSSVariableResolver.cpp
index 73284bf..11af23e 100644
--- a/third_party/WebKit/Source/core/css/resolver/CSSVariableResolver.cpp
+++ b/third_party/WebKit/Source/core/css/resolver/CSSVariableResolver.cpp
@@ -55,7 +55,7 @@
         Vector<CSSParserToken> tokens;
         if (variableData->needsVariableResolution()) {
             m_variablesSeen.add(variableName);
-            resolveVariableReferencesFromTokens(variableData->tokens(), result, context);
+            resolveVariableReferencesFromTokens(variableData->tokens(), tokens, context);
             m_variablesSeen.remove(variableName);
 
             // The old variable data holds onto the backing string the new resolved CSSVariableData
diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index 1b49e405..7b68c8d 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -83,7 +83,6 @@
 #include "core/dom/NodeChildRemovalTracker.h"
 #include "core/dom/NodeComputedStyle.h"
 #include "core/dom/NodeFilter.h"
-#include "core/dom/NodeIntersectionObserverData.h"
 #include "core/dom/NodeIterator.h"
 #include "core/dom/NodeRareData.h"
 #include "core/dom/NodeTraversal.h"
@@ -610,9 +609,6 @@
     if (svgExtensions())
         accessSVGExtensions().pauseAnimations();
 
-    if (m_intersectionObserverData)
-        m_intersectionObserverData->dispose();
-
     m_lifecycle.advanceTo(DocumentLifecycle::Disposed);
     DocumentLifecycleNotifier::notifyDocumentWasDisposed();
 
@@ -5085,13 +5081,6 @@
     return *m_intersectionObserverController;
 }
 
-NodeIntersectionObserverData& Document::ensureIntersectionObserverData()
-{
-    if (!m_intersectionObserverData)
-        m_intersectionObserverData = new NodeIntersectionObserverData();
-    return *m_intersectionObserverData;
-}
-
 void Document::reportBlockedScriptExecutionToInspector(const String& directiveText)
 {
     InspectorInstrumentation::scriptExecutionBlockedByCSP(this, directiveText);
diff --git a/third_party/WebKit/Source/core/dom/Document.h b/third_party/WebKit/Source/core/dom/Document.h
index 89243ae..c2edfa0a 100644
--- a/third_party/WebKit/Source/core/dom/Document.h
+++ b/third_party/WebKit/Source/core/dom/Document.h
@@ -136,7 +136,6 @@
 class MediaQueryListListener;
 class MediaQueryMatcher;
 class NodeFilter;
-class NodeIntersectionObserverData;
 class NodeIterator;
 class NthIndexCache;
 class OriginAccessEntry;
@@ -690,7 +689,6 @@
 
     IntersectionObserverController* intersectionObserverController();
     IntersectionObserverController& ensureIntersectionObserverController();
-    NodeIntersectionObserverData& ensureIntersectionObserverData();
 
     void updateViewportDescription();
     void processReferrerPolicy(const String& policy);
@@ -1407,7 +1405,6 @@
     PersistentWillBeMember<CanvasFontCache> m_canvasFontCache;
 
     PersistentWillBeMember<IntersectionObserverController> m_intersectionObserverController;
-    PersistentWillBeMember<NodeIntersectionObserverData> m_intersectionObserverData;
 
     int m_nodeCount;
 };
diff --git a/third_party/WebKit/Source/core/dom/Element.cpp b/third_party/WebKit/Source/core/dom/Element.cpp
index 652c7083..0b9901e 100644
--- a/third_party/WebKit/Source/core/dom/Element.cpp
+++ b/third_party/WebKit/Source/core/dom/Element.cpp
@@ -54,6 +54,7 @@
 #include "core/dom/ClientRectList.h"
 #include "core/dom/DatasetDOMStringMap.h"
 #include "core/dom/ElementDataCache.h"
+#include "core/dom/ElementIntersectionObserverData.h"
 #include "core/dom/ElementRareData.h"
 #include "core/dom/ElementTraversal.h"
 #include "core/dom/ExceptionCode.h"
@@ -64,7 +65,6 @@
 #include "core/dom/MutationRecord.h"
 #include "core/dom/NamedNodeMap.h"
 #include "core/dom/NodeComputedStyle.h"
-#include "core/dom/NodeIntersectionObserverData.h"
 #include "core/dom/PresentationAttributeStyle.h"
 #include "core/dom/PseudoElement.h"
 #include "core/dom/ScriptableDocumentParser.h"
@@ -2596,14 +2596,14 @@
     return nullptr;
 }
 
-NodeIntersectionObserverData* Element::intersectionObserverData() const
+ElementIntersectionObserverData* Element::intersectionObserverData() const
 {
     if (elementRareData())
         return elementRareData()->intersectionObserverData();
     return nullptr;
 }
 
-NodeIntersectionObserverData& Element::ensureIntersectionObserverData()
+ElementIntersectionObserverData& Element::ensureIntersectionObserverData()
 {
     return ensureElementRareData().ensureIntersectionObserverData();
 }
diff --git a/third_party/WebKit/Source/core/dom/Element.h b/third_party/WebKit/Source/core/dom/Element.h
index 6383990..e778e157 100644
--- a/third_party/WebKit/Source/core/dom/Element.h
+++ b/third_party/WebKit/Source/core/dom/Element.h
@@ -52,6 +52,7 @@
 class DOMStringMap;
 class DOMTokenList;
 class Dictionary;
+class ElementIntersectionObserverData;
 class ElementRareData;
 class ElementShadow;
 class ExceptionState;
@@ -59,7 +60,6 @@
 class IntSize;
 class Locale;
 class MutableStylePropertySet;
-class NodeIntersectionObserverData;
 class PropertySetCSSStyleDeclaration;
 class PseudoElement;
 class ScrollState;
@@ -554,8 +554,8 @@
 
     SpellcheckAttributeState spellcheckAttributeState() const;
 
-    NodeIntersectionObserverData* intersectionObserverData() const;
-    NodeIntersectionObserverData& ensureIntersectionObserverData();
+    ElementIntersectionObserverData* intersectionObserverData() const;
+    ElementIntersectionObserverData& ensureIntersectionObserverData();
 
 protected:
     Element(const QualifiedName& tagName, Document*, ConstructionType);
diff --git a/third_party/WebKit/Source/core/dom/ElementIntersectionObserverData.cpp b/third_party/WebKit/Source/core/dom/ElementIntersectionObserverData.cpp
new file mode 100644
index 0000000..f4c306c
--- /dev/null
+++ b/third_party/WebKit/Source/core/dom/ElementIntersectionObserverData.cpp
@@ -0,0 +1,95 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "core/dom/ElementIntersectionObserverData.h"
+
+#include "core/dom/Document.h"
+#include "core/dom/Element.h"
+#include "core/dom/IntersectionObservation.h"
+#include "core/dom/IntersectionObserver.h"
+#include "core/dom/IntersectionObserverController.h"
+
+namespace blink {
+
+ElementIntersectionObserverData::ElementIntersectionObserverData() { }
+
+ElementIntersectionObserverData::~ElementIntersectionObserverData() { }
+
+bool ElementIntersectionObserverData::hasIntersectionObserver() const
+{
+    return !m_intersectionObservers.isEmpty();
+}
+
+bool ElementIntersectionObserverData::hasIntersectionObservation() const
+{
+    return !m_intersectionObservations.isEmpty();
+}
+
+IntersectionObservation* ElementIntersectionObserverData::getObservationFor(IntersectionObserver& observer)
+{
+    auto i = m_intersectionObservations.find(&observer);
+    if (i == m_intersectionObservations.end())
+        return nullptr;
+    return i->value;
+}
+
+void ElementIntersectionObserverData::addObservation(IntersectionObservation& observation)
+{
+    m_intersectionObservations.add(&observation.observer(), &observation);
+}
+
+void ElementIntersectionObserverData::removeObservation(IntersectionObserver& observer)
+{
+    m_intersectionObservations.remove(&observer);
+}
+
+void ElementIntersectionObserverData::activateValidIntersectionObservers(Element& element)
+{
+    IntersectionObserverController& controller = element.document().ensureIntersectionObserverController();
+    for (auto& observer : m_intersectionObservers) {
+        controller.addTrackedObserver(*observer);
+        observer->setActive(true);
+    }
+    for (auto& observation : m_intersectionObservations)
+        observation.value->setActive(observation.key->isDescendantOfRoot(&element));
+}
+
+void ElementIntersectionObserverData::deactivateAllIntersectionObservers(Element& element)
+{
+    element.document().ensureIntersectionObserverController().removeTrackedObserversForRoot(element);
+    for (auto& observer : m_intersectionObservers)
+        observer->setActive(false);
+    for (auto& observation : m_intersectionObservations)
+        observation.value->setActive(false);
+}
+
+#if !ENABLE(OILPAN)
+void ElementIntersectionObserverData::dispose()
+{
+    HeapVector<Member<IntersectionObserver>> observersToDisconnect;
+    copyToVector(m_intersectionObservers, observersToDisconnect);
+    for (auto& observer : observersToDisconnect)
+        observer->disconnect();
+    ASSERT(m_intersectionObservers.isEmpty());
+}
+#endif
+
+WeakPtrWillBeRawPtr<Element> ElementIntersectionObserverData::createWeakPtr(Element* element)
+{
+#if ENABLE(OILPAN)
+    return element;
+#else
+    if (!m_weakPointerFactory)
+        m_weakPointerFactory = adoptPtrWillBeNoop(new WeakPtrFactory<Element>(element));
+    return m_weakPointerFactory->createWeakPtr();
+#endif
+}
+
+DEFINE_TRACE(ElementIntersectionObserverData)
+{
+    visitor->trace(m_intersectionObservers);
+    visitor->trace(m_intersectionObservations);
+}
+
+} // namespace blink
diff --git a/third_party/WebKit/Source/core/dom/ElementIntersectionObserverData.h b/third_party/WebKit/Source/core/dom/ElementIntersectionObserverData.h
new file mode 100644
index 0000000..b416f365
--- /dev/null
+++ b/third_party/WebKit/Source/core/dom/ElementIntersectionObserverData.h
@@ -0,0 +1,49 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef ElementIntersectionObserverData_h
+#define ElementIntersectionObserverData_h
+
+#include "platform/heap/Handle.h"
+
+namespace blink {
+
+class Element;
+class IntersectionObservation;
+class IntersectionObserver;
+
+class ElementIntersectionObserverData : public GarbageCollectedFinalized<ElementIntersectionObserverData> {
+public:
+    DECLARE_TRACE();
+    ElementIntersectionObserverData();
+    ~ElementIntersectionObserverData();
+
+    bool hasIntersectionObserver() const;
+    bool hasIntersectionObservation() const;
+    IntersectionObservation* getObservationFor(IntersectionObserver&);
+    void addObservation(IntersectionObservation&);
+    void removeObservation(IntersectionObserver&);
+    void activateValidIntersectionObservers(Element&);
+    void deactivateAllIntersectionObservers(Element&);
+
+#if !ENABLE(OILPAN)
+    void dispose();
+#endif
+
+    WeakPtrWillBeRawPtr<Element> createWeakPtr(Element*);
+
+private:
+    // IntersectionObservers for which the Element owning this data is root.
+    HeapHashSet<WeakMember<IntersectionObserver>> m_intersectionObservers;
+    // IntersectionObservations for which the Element owning this data is target.
+    HeapHashMap<Member<IntersectionObserver>, Member<IntersectionObservation>> m_intersectionObservations;
+
+#if !ENABLE(OILPAN)
+    OwnPtr<WeakPtrFactory<Element>> m_weakPointerFactory;
+#endif
+};
+
+} // namespace blink
+
+#endif // ElementIntersectionObserverData_h
diff --git a/third_party/WebKit/Source/core/dom/ElementRareData.h b/third_party/WebKit/Source/core/dom/ElementRareData.h
index e3b7468a..e66e9f45 100644
--- a/third_party/WebKit/Source/core/dom/ElementRareData.h
+++ b/third_party/WebKit/Source/core/dom/ElementRareData.h
@@ -26,8 +26,8 @@
 #include "core/dom/Attr.h"
 #include "core/dom/CompositorProxiedPropertySet.h"
 #include "core/dom/DatasetDOMStringMap.h"
+#include "core/dom/ElementIntersectionObserverData.h"
 #include "core/dom/NamedNodeMap.h"
-#include "core/dom/NodeIntersectionObserverData.h"
 #include "core/dom/NodeRareData.h"
 #include "core/dom/PseudoElement.h"
 #include "core/dom/custom/CustomElementDefinition.h"
@@ -125,11 +125,11 @@
     AttrNodeList* attrNodeList() { return m_attrNodeList.get(); }
     void removeAttrNodeList() { m_attrNodeList.clear(); }
 
-    NodeIntersectionObserverData* intersectionObserverData() const { return m_intersectionObserverData.get(); }
-    NodeIntersectionObserverData& ensureIntersectionObserverData()
+    ElementIntersectionObserverData* intersectionObserverData() const { return m_intersectionObserverData.get(); }
+    ElementIntersectionObserverData& ensureIntersectionObserverData()
     {
         if (!m_intersectionObserverData)
-            m_intersectionObserverData = new NodeIntersectionObserverData();
+            m_intersectionObserverData = new ElementIntersectionObserverData();
         return *m_intersectionObserverData;
     }
 
@@ -153,7 +153,7 @@
     OwnPtr<CompositorProxiedPropertySet> m_proxiedProperties;
 
     PersistentWillBeMember<ElementAnimations> m_elementAnimations;
-    PersistentWillBeMember<NodeIntersectionObserverData> m_intersectionObserverData;
+    PersistentWillBeMember<ElementIntersectionObserverData> m_intersectionObserverData;
 
     RefPtr<ComputedStyle> m_computedStyle;
     RefPtrWillBeMember<CustomElementDefinition> m_customElementDefinition;
diff --git a/third_party/WebKit/Source/core/dom/IntersectionObservation.cpp b/third_party/WebKit/Source/core/dom/IntersectionObservation.cpp
index 1f06da2f..3fcc21c 100644
--- a/third_party/WebKit/Source/core/dom/IntersectionObservation.cpp
+++ b/third_party/WebKit/Source/core/dom/IntersectionObservation.cpp
@@ -23,15 +23,10 @@
 {
 }
 
-Element* IntersectionObservation::target() const
-{
-    return toElement(m_target.get());
-}
-
 void IntersectionObservation::initializeGeometry(IntersectionGeometry& geometry)
 {
     ASSERT(m_target);
-    LayoutObject* targetLayoutObject = target()->layoutObject();
+    LayoutObject* targetLayoutObject = m_target->layoutObject();
     if (targetLayoutObject->isBoxModelObject())
         geometry.targetRect = toLayoutBoxModelObject(targetLayoutObject)->visualOverflowRect();
     else
@@ -45,7 +40,7 @@
     // TODO(szager): the writing mode flipping needs a test.
     ASSERT(m_target);
     LayoutObject* rootLayoutObject = m_observer->rootLayoutObject();
-    LayoutObject* targetLayoutObject = target()->layoutObject();
+    LayoutObject* targetLayoutObject = m_target->layoutObject();
     targetLayoutObject->mapToVisibleRectInAncestorSpace(toLayoutBoxModelObject(rootLayoutObject), rect, nullptr);
     if (rootLayoutObject->hasOverflowClip()) {
         LayoutBox* rootLayoutBox = toLayoutBox(rootLayoutObject);
@@ -59,10 +54,10 @@
 
 void IntersectionObservation::clipToFrameView(IntersectionGeometry& geometry)
 {
-    Node* rootNode = m_observer->root();
+    Element* rootElement = m_observer->root();
     LayoutObject* rootLayoutObject = m_observer->rootLayoutObject();
-    if (rootLayoutObject->isLayoutView()) {
-        geometry.rootRect = LayoutRect(toLayoutView(rootLayoutObject)->frameView()->visibleContentRect());
+    if (rootElement == rootElement->document().documentElement()) {
+        geometry.rootRect = LayoutRect(rootElement->document().view()->visibleContentRect());
         m_observer->applyRootMargin(geometry.rootRect);
         geometry.intersectionRect.intersect(geometry.rootRect);
     } else {
@@ -73,7 +68,7 @@
         m_observer->applyRootMargin(geometry.rootRect);
     }
 
-    LayoutPoint scrollPosition(rootNode->document().view()->scrollPosition());
+    LayoutPoint scrollPosition(rootElement->document().view()->scrollPosition());
     geometry.targetRect.moveBy(-scrollPosition);
     geometry.intersectionRect.moveBy(-scrollPosition);
     geometry.rootRect.moveBy(-scrollPosition);
@@ -88,7 +83,7 @@
 {
     ASSERT(m_target);
     LayoutObject* rootLayoutObject = m_observer->rootLayoutObject();
-    LayoutObject* targetLayoutObject = target()->layoutObject();
+    LayoutObject* targetLayoutObject = m_target->layoutObject();
     if (!rootLayoutObject->isBoxModelObject())
         return false;
     if (!targetLayoutObject->isBoxModelObject() && !targetLayoutObject->isText())
@@ -162,7 +157,7 @@
 void IntersectionObservation::disconnect()
 {
     if (m_target)
-        target()->ensureIntersectionObserverData().removeObservation(this->observer());
+        m_target->ensureIntersectionObserverData().removeObservation(this->observer());
     m_observer->removeObservation(*this);
     m_observer.clear();
 }
diff --git a/third_party/WebKit/Source/core/dom/IntersectionObservation.h b/third_party/WebKit/Source/core/dom/IntersectionObservation.h
index 702882a..e832c621 100644
--- a/third_party/WebKit/Source/core/dom/IntersectionObservation.h
+++ b/third_party/WebKit/Source/core/dom/IntersectionObservation.h
@@ -12,7 +12,6 @@
 
 class Element;
 class IntersectionObserver;
-class Node;
 
 class IntersectionObservation : public GarbageCollectedFinalized<IntersectionObservation> {
 public:
@@ -25,7 +24,7 @@
     };
 
     IntersectionObserver& observer() const { return *m_observer; }
-    Element* target() const;
+    Element* target() const { return m_target.get(); }
     bool isActive() const { return m_active; }
     void setActive(bool active) { m_active = active; }
     unsigned lastThresholdIndex() const { return m_lastThresholdIndex; }
@@ -44,12 +43,7 @@
     bool computeGeometry(IntersectionGeometry&);
 
     Member<IntersectionObserver> m_observer;
-
-    // TODO(szager): Why Node instead of Element?  Because NodeIntersectionObserverData::createWeakPtr()
-    // returns a WeakPtr<Node>, which cannot be coerced into a WeakPtr<Element>.  When oilpan rolls out,
-    // this can be changed to WeakMember<Element>.
-    WeakPtrWillBeWeakMember<Node> m_target;
-
+    WeakPtrWillBeWeakMember<Element> m_target;
     unsigned m_active : 1;
     unsigned m_shouldReportRootBounds : 1;
     unsigned m_lastThresholdIndex : 30;
diff --git a/third_party/WebKit/Source/core/dom/IntersectionObserver.cpp b/third_party/WebKit/Source/core/dom/IntersectionObserver.cpp
index b29b69e8..5758a6b 100644
--- a/third_party/WebKit/Source/core/dom/IntersectionObserver.cpp
+++ b/third_party/WebKit/Source/core/dom/IntersectionObserver.cpp
@@ -7,13 +7,13 @@
 #include "bindings/core/v8/ExceptionState.h"
 #include "core/css/parser/CSSParserTokenRange.h"
 #include "core/css/parser/CSSTokenizer.h"
+#include "core/dom/ElementIntersectionObserverData.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/dom/ExecutionContext.h"
 #include "core/dom/IntersectionObserverCallback.h"
 #include "core/dom/IntersectionObserverController.h"
 #include "core/dom/IntersectionObserverEntry.h"
 #include "core/dom/IntersectionObserverInit.h"
-#include "core/dom/NodeIntersectionObserverData.h"
 #include "core/html/HTMLFrameOwnerElement.h"
 #include "core/layout/LayoutView.h"
 #include "platform/Timer.h"
@@ -81,17 +81,17 @@
 
 IntersectionObserver* IntersectionObserver::create(const IntersectionObserverInit& observerInit, IntersectionObserverCallback& callback, ExceptionState& exceptionState)
 {
-    RefPtrWillBeRawPtr<Node> root = observerInit.root();
+    RefPtrWillBeRawPtr<Element> root = observerInit.root();
     if (!root) {
         // TODO(szager): Use Document instead of document element for implicit root. (crbug.com/570538)
         ExecutionContext* context = callback.executionContext();
         ASSERT(context->isDocument());
         Frame* mainFrame = toDocument(context)->frame()->tree().top();
         if (mainFrame && mainFrame->isLocalFrame())
-            root = toLocalFrame(mainFrame)->document();
+            root = toLocalFrame(mainFrame)->document()->documentElement();
     }
     if (!root) {
-        exceptionState.throwDOMException(HierarchyRequestError, "Unable to get root node in main frame to track.");
+        exceptionState.throwDOMException(HierarchyRequestError, "Unable to get root element in main frame to track.");
         return nullptr;
     }
 
@@ -112,18 +112,15 @@
     return new IntersectionObserver(callback, *root, rootMargin, thresholds);
 }
 
-IntersectionObserver::IntersectionObserver(IntersectionObserverCallback& callback, Node& root, const Vector<Length>& rootMargin, const Vector<float>& thresholds)
+IntersectionObserver::IntersectionObserver(IntersectionObserverCallback& callback, Element& root, const Vector<Length>& rootMargin, const Vector<float>& thresholds)
     : m_callback(&callback)
+    , m_root(root.ensureIntersectionObserverData().createWeakPtr(&root))
     , m_thresholds(thresholds)
     , m_topMargin(Fixed)
     , m_rightMargin(Fixed)
     , m_bottomMargin(Fixed)
     , m_leftMargin(Fixed)
 {
-    if (root.isDocumentNode())
-        m_root = toDocument(root).ensureIntersectionObserverData().createWeakPtr(&root);
-    else
-        m_root = toElement(root).ensureIntersectionObserverData().createWeakPtr(&root);
     switch (rootMargin.size()) {
     case 0:
         break;
@@ -152,24 +149,24 @@
     root.document().ensureIntersectionObserverController().addTrackedObserver(*this);
 }
 
-LayoutObject* IntersectionObserver::rootLayoutObject() const
+LayoutObject* IntersectionObserver::rootLayoutObject()
 {
-    Node* rootNode = root();
-    if (rootNode->isDocumentNode())
-        return toDocument(rootNode)->layoutView();
-    return toElement(rootNode)->layoutObject();
+    Element* rootElement = root();
+    if (rootElement == rootElement->document().documentElement())
+        return rootElement->document().layoutView();
+    return rootElement->layoutObject();
 }
 
 bool IntersectionObserver::isDescendantOfRoot(const Element* target) const
 {
     // Is m_root an ancestor, through the DOM and frame trees, of target?
-    Node* rootNode = root();
-    if (!rootNode || !target || target == rootNode)
+    Element* rootElement = m_root.get();
+    if (!rootElement || !target || target == rootElement)
         return false;
-    if (!target->inDocument() || !rootNode->inDocument())
+    if (!target->inDocument() || !rootElement->inDocument())
         return false;
 
-    Document* rootDocument = &rootNode->document();
+    Document* rootDocument = &rootElement->document();
     Document* targetDocument = &target->document();
     while (targetDocument != rootDocument) {
         target = targetDocument->ownerElement();
@@ -177,11 +174,7 @@
             return false;
         targetDocument = &target->document();
     }
-    if (rootNode->isDocumentNode()) {
-        ASSERT(targetDocument == rootNode);
-        return true;
-    }
-    return target->isDescendantOf(rootNode);
+    return target->isDescendantOf(rootElement);
 }
 
 void IntersectionObserver::observe(Element* target, ExceptionState& exceptionState)
diff --git a/third_party/WebKit/Source/core/dom/IntersectionObserver.h b/third_party/WebKit/Source/core/dom/IntersectionObserver.h
index 79d8c27..e07cdb2 100644
--- a/third_party/WebKit/Source/core/dom/IntersectionObserver.h
+++ b/third_party/WebKit/Source/core/dom/IntersectionObserver.h
@@ -32,8 +32,8 @@
     void unobserve(Element*, ExceptionState&);
     HeapVector<Member<IntersectionObserverEntry>> takeRecords();
 
-    Node* root() const { return m_root.get(); }
-    LayoutObject* rootLayoutObject() const;
+    Element* root() { return m_root.get(); }
+    LayoutObject* rootLayoutObject();
     bool hasPercentMargin() const;
     const Length& topMargin() const { return m_topMargin; }
     const Length& rightMargin() const { return m_rightMargin; }
@@ -53,12 +53,12 @@
     DECLARE_TRACE();
 
 private:
-    explicit IntersectionObserver(IntersectionObserverCallback&, Node&, const Vector<Length>& rootMargin, const Vector<float>& thresholds);
+    explicit IntersectionObserver(IntersectionObserverCallback&, Element&, const Vector<Length>& rootMargin, const Vector<float>& thresholds);
 
     void checkRootAndDetachIfNeeded();
 
     Member<IntersectionObserverCallback> m_callback;
-    WeakPtrWillBeWeakMember<Node> m_root;
+    WeakPtrWillBeWeakMember<Element> m_root;
     HeapHashSet<WeakMember<IntersectionObservation>> m_observations;
     HeapVector<Member<IntersectionObserverEntry>> m_entries;
     Vector<float> m_thresholds;
diff --git a/third_party/WebKit/Source/core/dom/IntersectionObserverController.cpp b/third_party/WebKit/Source/core/dom/IntersectionObserverController.cpp
index 02106329..f8fb2b9 100644
--- a/third_party/WebKit/Source/core/dom/IntersectionObserverController.cpp
+++ b/third_party/WebKit/Source/core/dom/IntersectionObserverController.cpp
@@ -75,7 +75,7 @@
     m_trackedIntersectionObservers.add(&observer);
 }
 
-void IntersectionObserverController::removeTrackedObserversForRoot(const Node& root)
+void IntersectionObserverController::removeTrackedObserversForRoot(const Element& root)
 {
     HeapVector<Member<IntersectionObserver>> toRemove;
     for (auto& observer : m_trackedIntersectionObservers) {
diff --git a/third_party/WebKit/Source/core/dom/IntersectionObserverController.h b/third_party/WebKit/Source/core/dom/IntersectionObserverController.h
index e75ede9f..8bde0c9 100644
--- a/third_party/WebKit/Source/core/dom/IntersectionObserverController.h
+++ b/third_party/WebKit/Source/core/dom/IntersectionObserverController.h
@@ -28,7 +28,7 @@
     void deliverIntersectionObservations(Timer<IntersectionObserverController>*);
     void computeTrackedIntersectionObservations();
     void addTrackedObserver(IntersectionObserver&);
-    void removeTrackedObserversForRoot(const Node&);
+    void removeTrackedObserversForRoot(const Element&);
 
     DECLARE_TRACE();
 
diff --git a/third_party/WebKit/Source/core/dom/NodeIntersectionObserverData.cpp b/third_party/WebKit/Source/core/dom/NodeIntersectionObserverData.cpp
deleted file mode 100644
index ec0a6249..0000000
--- a/third_party/WebKit/Source/core/dom/NodeIntersectionObserverData.cpp
+++ /dev/null
@@ -1,101 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "core/dom/NodeIntersectionObserverData.h"
-
-#include "core/dom/Document.h"
-#include "core/dom/IntersectionObservation.h"
-#include "core/dom/IntersectionObserver.h"
-#include "core/dom/IntersectionObserverController.h"
-
-namespace blink {
-
-NodeIntersectionObserverData::NodeIntersectionObserverData() { }
-
-NodeIntersectionObserverData::~NodeIntersectionObserverData() { }
-
-bool NodeIntersectionObserverData::hasIntersectionObserver() const
-{
-    return !m_intersectionObservers.isEmpty();
-}
-
-bool NodeIntersectionObserverData::hasIntersectionObservation() const
-{
-    return !m_intersectionObservations.isEmpty();
-}
-
-IntersectionObservation* NodeIntersectionObserverData::getObservationFor(IntersectionObserver& observer)
-{
-    auto i = m_intersectionObservations.find(&observer);
-    if (i == m_intersectionObservations.end())
-        return nullptr;
-    return i->value;
-}
-
-void NodeIntersectionObserverData::addObservation(IntersectionObservation& observation)
-{
-    m_intersectionObservations.add(&observation.observer(), &observation);
-}
-
-void NodeIntersectionObserverData::removeObservation(IntersectionObserver& observer)
-{
-    m_intersectionObservations.remove(&observer);
-}
-
-void NodeIntersectionObserverData::activateValidIntersectionObservers(Node& node)
-{
-    IntersectionObserverController& controller = node.document().ensureIntersectionObserverController();
-    // Activate observers for which node is root.
-    for (auto& observer : m_intersectionObservers) {
-        controller.addTrackedObserver(*observer);
-        observer->setActive(true);
-    }
-    // A document can be root, but not target.
-    if (node.isDocumentNode())
-        return;
-    // Active observers for which node is target.
-    for (auto& observation : m_intersectionObservations)
-        observation.value->setActive(observation.key->isDescendantOfRoot(&toElement(node)));
-}
-
-void NodeIntersectionObserverData::deactivateAllIntersectionObservers(Node& node)
-{
-    node.document().ensureIntersectionObserverController().removeTrackedObserversForRoot(node);
-    for (auto& observer : m_intersectionObservers)
-        observer->setActive(false);
-    for (auto& observation : m_intersectionObservations)
-        observation.value->setActive(false);
-}
-
-#if !ENABLE(OILPAN)
-void NodeIntersectionObserverData::dispose()
-{
-    HeapVector<Member<IntersectionObserver>> observersToDisconnect;
-    copyToVector(m_intersectionObservers, observersToDisconnect);
-    for (auto& observer : observersToDisconnect)
-        observer->disconnect();
-    ASSERT(m_intersectionObservers.isEmpty());
-}
-#endif
-
-WeakPtrWillBeRawPtr<Node> NodeIntersectionObserverData::createWeakPtr(Node* node)
-{
-#if ENABLE(OILPAN)
-    return node;
-#else
-    if (!m_weakPointerFactory)
-        m_weakPointerFactory = adoptPtrWillBeNoop(new WeakPtrFactory<Node>(node));
-    WeakPtr<Node> result = m_weakPointerFactory->createWeakPtr();
-    ASSERT(result.get() == node);
-    return result;
-#endif
-}
-
-DEFINE_TRACE(NodeIntersectionObserverData)
-{
-    visitor->trace(m_intersectionObservers);
-    visitor->trace(m_intersectionObservations);
-}
-
-} // namespace blink
diff --git a/third_party/WebKit/Source/core/dom/NodeIntersectionObserverData.h b/third_party/WebKit/Source/core/dom/NodeIntersectionObserverData.h
deleted file mode 100644
index 80faa61..0000000
--- a/third_party/WebKit/Source/core/dom/NodeIntersectionObserverData.h
+++ /dev/null
@@ -1,49 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef NodeIntersectionObserverData_h
-#define NodeIntersectionObserverData_h
-
-#include "platform/heap/Handle.h"
-
-namespace blink {
-
-class Node;
-class IntersectionObservation;
-class IntersectionObserver;
-
-class NodeIntersectionObserverData : public GarbageCollectedFinalized<NodeIntersectionObserverData> {
-public:
-    DECLARE_TRACE();
-    NodeIntersectionObserverData();
-    ~NodeIntersectionObserverData();
-
-    bool hasIntersectionObserver() const;
-    bool hasIntersectionObservation() const;
-    IntersectionObservation* getObservationFor(IntersectionObserver&);
-    void addObservation(IntersectionObservation&);
-    void removeObservation(IntersectionObserver&);
-    void activateValidIntersectionObservers(Node&);
-    void deactivateAllIntersectionObservers(Node&);
-
-#if !ENABLE(OILPAN)
-    void dispose();
-#endif
-
-    WeakPtrWillBeRawPtr<Node> createWeakPtr(Node*);
-
-private:
-    // IntersectionObservers for which the Node owning this data is root.
-    HeapHashSet<WeakMember<IntersectionObserver>> m_intersectionObservers;
-    // IntersectionObservations for which the Node owning this data is target.
-    HeapHashMap<Member<IntersectionObserver>, Member<IntersectionObservation>> m_intersectionObservations;
-
-#if !ENABLE(OILPAN)
-    OwnPtr<WeakPtrFactory<Node>> m_weakPointerFactory;
-#endif
-};
-
-} // namespace blink
-
-#endif // NodeIntersectionObserverData_h
diff --git a/third_party/WebKit/Source/core/editing/EditingUtilities.cpp b/third_party/WebKit/Source/core/editing/EditingUtilities.cpp
index b074c72..141190a 100644
--- a/third_party/WebKit/Source/core/editing/EditingUtilities.cpp
+++ b/third_party/WebKit/Source/core/editing/EditingUtilities.cpp
@@ -1275,7 +1275,7 @@
     RefPtrWillBeRawPtr<Text> tabTextNode = prpTabTextNode;
 
     // Make the span to hold the tab.
-    RefPtrWillBeRawPtr<HTMLSpanElement> spanElement = toHTMLSpanElement(document.createElement(spanTag, false).get());
+    RefPtrWillBeRawPtr<HTMLSpanElement> spanElement = HTMLSpanElement::create(document);
     spanElement->setAttribute(classAttr, AppleTabSpanClass);
     spanElement->setAttribute(styleAttr, "white-space:pre");
 
@@ -1298,11 +1298,6 @@
     return createTabSpanElement(document, PassRefPtrWillBeRawPtr<Text>(nullptr));
 }
 
-PassRefPtrWillBeRawPtr<HTMLBRElement> createBlockPlaceholderElement(Document& document)
-{
-    return toHTMLBRElement(document.createElement(brTag, false).get());
-}
-
 bool isNodeRendered(const Node& node)
 {
     LayoutObject* layoutObject = node.layoutObject();
diff --git a/third_party/WebKit/Source/core/editing/EditingUtilities.h b/third_party/WebKit/Source/core/editing/EditingUtilities.h
index 22904bff..ac9bcbc 100644
--- a/third_party/WebKit/Source/core/editing/EditingUtilities.h
+++ b/third_party/WebKit/Source/core/editing/EditingUtilities.h
@@ -278,7 +278,6 @@
 
 PassRefPtrWillBeRawPtr<HTMLSpanElement> createTabSpanElement(Document&);
 PassRefPtrWillBeRawPtr<HTMLSpanElement> createTabSpanElement(Document&, const String& tabText);
-PassRefPtrWillBeRawPtr<HTMLBRElement> createBlockPlaceholderElement(Document&);
 
 Element* editableRootForPosition(const Position&, EditableType = ContentIsEditable);
 Element* editableRootForPosition(const PositionInComposedTree&, EditableType = ContentIsEditable);
diff --git a/third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp b/third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp
index 7e0c168..46c4fd2 100644
--- a/third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp
+++ b/third_party/WebKit/Source/core/editing/FrameSelectionTest.cpp
@@ -70,7 +70,7 @@
     // Create a new document without frame by using DOMImplementation.
     DocumentInit dummy;
     RefPtrWillBeRawPtr<Document> documentWithoutFrame = Document::create();
-    RefPtrWillBeRawPtr<Element> body = documentWithoutFrame->createElement(HTMLNames::bodyTag, false);
+    RefPtrWillBeRawPtr<Element> body = HTMLBodyElement::create(*documentWithoutFrame);
     documentWithoutFrame->appendChild(body);
     RefPtrWillBeRawPtr<Text> anotherText = documentWithoutFrame->createTextNode("Hello, another world");
     body->appendChild(anotherText);
diff --git a/third_party/WebKit/Source/core/editing/GranularityStrategyTest.cpp b/third_party/WebKit/Source/core/editing/GranularityStrategyTest.cpp
index ab2b9d8a..a019d6b 100644
--- a/third_party/WebKit/Source/core/editing/GranularityStrategyTest.cpp
+++ b/third_party/WebKit/Source/core/editing/GranularityStrategyTest.cpp
@@ -3,7 +3,6 @@
 // found in the LICENSE file.
 
 #include "bindings/core/v8/ExceptionStatePlaceholder.h"
-#include "core/HTMLNames.h"
 #include "core/dom/Document.h"
 #include "core/dom/Element.h"
 #include "core/dom/Text.h"
@@ -12,6 +11,7 @@
 #include "core/frame/Settings.h"
 #include "core/html/HTMLBodyElement.h"
 #include "core/html/HTMLDocument.h"
+#include "core/html/HTMLSpanElement.h"
 #include "core/testing/DummyPageHolder.h"
 #include "platform/heap/Handle.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -228,7 +228,7 @@
     RefPtrWillBeRawPtr<Text> text1 = document().createTextNode(str1);
     RefPtrWillBeRawPtr<Text> text2 = document().createTextNode(str2);
     RefPtrWillBeRawPtr<Text> text3 = document().createTextNode(str3);
-    RefPtrWillBeRawPtr<Element> span = document().createElement(HTMLNames::spanTag, true);
+    RefPtrWillBeRawPtr<Element> span = HTMLSpanElement::create(document());
     Element* div = document().getElementById("mytext");
     div->appendChild(text1);
     div->appendChild(span);
diff --git a/third_party/WebKit/Source/core/editing/commands/ApplyStyleCommand.cpp b/third_party/WebKit/Source/core/editing/commands/ApplyStyleCommand.cpp
index ae543b5..a626143 100644
--- a/third_party/WebKit/Source/core/editing/commands/ApplyStyleCommand.cpp
+++ b/third_party/WebKit/Source/core/editing/commands/ApplyStyleCommand.cpp
@@ -112,16 +112,6 @@
     return hasNoAttributeOrOnlyStyleAttribute(toHTMLFontElement(element), shouldStyleAttributeBeEmpty);
 }
 
-static PassRefPtrWillBeRawPtr<HTMLFontElement> createFontElement(Document& document)
-{
-    return toHTMLFontElement(createHTMLElement(document, fontTag).get());
-}
-
-PassRefPtrWillBeRawPtr<HTMLSpanElement> createStyleSpanElement(Document& document)
-{
-    return toHTMLSpanElement(createHTMLElement(document, spanTag).get());
-}
-
 ApplyStyleCommand::ApplyStyleCommand(Document& document, const EditingStyle* style, EditAction editingAction, EPropertyLevel propertyLevel)
     : CompositeEditCommand(document)
     , m_style(style->copy())
@@ -404,7 +394,7 @@
         } else if (node->isTextNode() && node->layoutObject() && node->parentNode() != lastStyledNode) {
             // Last styled node was not parent node of this text node, but we wish to style this
             // text node. To make this possible, add a style span to surround this text node.
-            RefPtrWillBeRawPtr<HTMLSpanElement> span = createStyleSpanElement(document());
+            RefPtrWillBeRawPtr<HTMLSpanElement> span = HTMLSpanElement::create(document());
             surroundNodeRangeWithElement(node, node, span.get());
             element = span.release();
         }  else {
@@ -1444,7 +1434,7 @@
 {
     // It's okay to obtain the style at the startNode because we've removed all relevant styles from the current run.
     if (!startNode->isElementNode()) {
-        dummyElement = createStyleSpanElement(document());
+        dummyElement = HTMLSpanElement::create(document());
         insertNodeAt(dummyElement, positionBeforeNode(startNode.get()));
         return positionBeforeNode(dummyElement.get());
     }
@@ -1487,7 +1477,7 @@
             if (styleChange.applyFontSize())
                 setNodeAttribute(fontContainer, sizeAttr, AtomicString(styleChange.fontSize()));
         } else {
-            RefPtrWillBeRawPtr<HTMLFontElement> fontElement = createFontElement(document());
+            RefPtrWillBeRawPtr<HTMLFontElement> fontElement = HTMLFontElement::create(document());
             if (styleChange.applyFontColor())
                 fontElement->setAttribute(colorAttr, AtomicString(styleChange.fontColor()));
             if (styleChange.applyFontFace())
@@ -1512,28 +1502,28 @@
                 setNodeAttribute(styleContainer, styleAttr, AtomicString(styleChange.cssStyle()));
             }
         } else {
-            RefPtrWillBeRawPtr<HTMLSpanElement> styleElement = createStyleSpanElement(document());
+            RefPtrWillBeRawPtr<HTMLSpanElement> styleElement = HTMLSpanElement::create(document());
             styleElement->setAttribute(styleAttr, AtomicString(styleChange.cssStyle()));
             surroundNodeRangeWithElement(startNode, endNode, styleElement.release());
         }
     }
 
     if (styleChange.applyBold())
-        surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), bTag));
+        surroundNodeRangeWithElement(startNode, endNode, HTMLElement::create(bTag, document()));
 
     if (styleChange.applyItalic())
-        surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), iTag));
+        surroundNodeRangeWithElement(startNode, endNode, HTMLElement::create(iTag, document()));
 
     if (styleChange.applyUnderline())
-        surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), uTag));
+        surroundNodeRangeWithElement(startNode, endNode, HTMLElement::create(uTag, document()));
 
     if (styleChange.applyLineThrough())
-        surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), strikeTag));
+        surroundNodeRangeWithElement(startNode, endNode, HTMLElement::create(strikeTag, document()));
 
     if (styleChange.applySubscript())
-        surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), subTag));
+        surroundNodeRangeWithElement(startNode, endNode, HTMLElement::create(subTag, document()));
     else if (styleChange.applySuperscript())
-        surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), supTag));
+        surroundNodeRangeWithElement(startNode, endNode, HTMLElement::create(supTag, document()));
 
     if (m_styledInlineElement && addStyledElement == AddStyledElement)
         surroundNodeRangeWithElement(startNode, endNode, m_styledInlineElement->cloneElementWithoutChildren());
diff --git a/third_party/WebKit/Source/core/editing/commands/ApplyStyleCommand.h b/third_party/WebKit/Source/core/editing/commands/ApplyStyleCommand.h
index a44a730..97bf2e7 100644
--- a/third_party/WebKit/Source/core/editing/commands/ApplyStyleCommand.h
+++ b/third_party/WebKit/Source/core/editing/commands/ApplyStyleCommand.h
@@ -137,7 +137,6 @@
 bool isEmptyFontTag(const Element*, ShouldStyleAttributeBeEmpty = StyleAttributeShouldBeEmpty);
 bool isLegacyAppleHTMLSpanElement(const Node*);
 bool isStyleSpanOrSpanWithOnlyStyleAttribute(const Element*);
-PassRefPtrWillBeRawPtr<HTMLSpanElement> createStyleSpanElement(Document&);
 
 } // namespace blink
 
diff --git a/third_party/WebKit/Source/core/editing/commands/CompositeEditCommand.cpp b/third_party/WebKit/Source/core/editing/commands/CompositeEditCommand.cpp
index 6c0de1a..bb1c1cd 100644
--- a/third_party/WebKit/Source/core/editing/commands/CompositeEditCommand.cpp
+++ b/third_party/WebKit/Source/core/editing/commands/CompositeEditCommand.cpp
@@ -852,7 +852,7 @@
     // Should assert isLayoutBlockFlow || isInlineFlow when deletion improves. See 4244964.
     ASSERT(container->layoutObject());
 
-    RefPtrWillBeRawPtr<HTMLBRElement> placeholder = createBlockPlaceholderElement(document());
+    RefPtrWillBeRawPtr<HTMLBRElement> placeholder = HTMLBRElement::create(document());
     appendNode(placeholder, container);
     return placeholder.release();
 }
@@ -865,7 +865,7 @@
     // Should assert isLayoutBlockFlow || isInlineFlow when deletion improves. See 4244964.
     ASSERT(pos.anchorNode()->layoutObject());
 
-    RefPtrWillBeRawPtr<HTMLBRElement> placeholder = createBlockPlaceholderElement(document());
+    RefPtrWillBeRawPtr<HTMLBRElement> placeholder = HTMLBRElement::create(document());
     insertNodeAt(placeholder, pos);
     return placeholder.release();
 }
diff --git a/third_party/WebKit/Source/core/editing/commands/ReplaceNodeWithSpanCommand.cpp b/third_party/WebKit/Source/core/editing/commands/ReplaceNodeWithSpanCommand.cpp
index a4bcf1ce..029da6a 100644
--- a/third_party/WebKit/Source/core/editing/commands/ReplaceNodeWithSpanCommand.cpp
+++ b/third_party/WebKit/Source/core/editing/commands/ReplaceNodeWithSpanCommand.cpp
@@ -70,7 +70,7 @@
     if (!m_elementToReplace->inDocument())
         return;
     if (!m_spanElement)
-        m_spanElement = toHTMLSpanElement(createHTMLElement(m_elementToReplace->document(), spanTag).get());
+        m_spanElement = HTMLSpanElement::create(m_elementToReplace->document());
     swapInNodePreservingAttributesAndChildren(m_spanElement.get(), *m_elementToReplace);
 }
 
diff --git a/third_party/WebKit/Source/core/editing/commands/WrapContentsInDummySpanCommand.cpp b/third_party/WebKit/Source/core/editing/commands/WrapContentsInDummySpanCommand.cpp
index 50a2ae5..0666f234 100644
--- a/third_party/WebKit/Source/core/editing/commands/WrapContentsInDummySpanCommand.cpp
+++ b/third_party/WebKit/Source/core/editing/commands/WrapContentsInDummySpanCommand.cpp
@@ -51,7 +51,7 @@
 
 void WrapContentsInDummySpanCommand::doApply()
 {
-    m_dummySpan = createStyleSpanElement(document());
+    m_dummySpan = HTMLSpanElement::create(document());
 
     executeApply();
 }
diff --git a/third_party/WebKit/Source/core/editing/serializers/Serialization.cpp b/third_party/WebKit/Source/core/editing/serializers/Serialization.cpp
index 8b1e3f6a..ed10bcdb 100644
--- a/third_party/WebKit/Source/core/editing/serializers/Serialization.cpp
+++ b/third_party/WebKit/Source/core/editing/serializers/Serialization.cpp
@@ -386,7 +386,7 @@
     Document& document = paragraph->document();
 
     if (string.isEmpty()) {
-        paragraph->appendChild(createBlockPlaceholderElement(document));
+        paragraph->appendChild(HTMLBRElement::create(document));
         return;
     }
 
diff --git a/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp b/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp
index dc49ff08..5d02a29e 100644
--- a/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp
+++ b/third_party/WebKit/Source/core/editing/spellcheck/SpellChecker.cpp
@@ -515,6 +515,16 @@
 
     // Since the text may be quite big chunk it up and adjust to the sentence boundary.
     const int kChunkSize = 16 * 1024;
+
+    // Check the full paragraph instead if the paragraph is short, which saves
+    // the cost on sentence boundary finding.
+    if (fullParagraphToCheck.rangeLength() <= kChunkSize) {
+        RefPtrWillBeRawPtr<SpellCheckRequest> request = SpellCheckRequest::create(resolveTextCheckingTypeMask(textCheckingOptions), TextCheckingProcessBatch, paragraphRange, paragraphRange, 0);
+        if (request)
+            m_spellCheckRequester->requestCheckingFor(request);
+        return;
+    }
+
     CharacterIterator checkRangeIterator(fullParagraphToCheck.checkingRange(), TextIteratorEmitsObjectReplacementCharacter);
     for (int requestNum = 0; !checkRangeIterator.atEnd(); requestNum++) {
         EphemeralRange chunkRange = checkRangeIterator.calculateCharacterSubrange(0, kChunkSize);
diff --git a/third_party/WebKit/Source/core/frame/UseCounter.h b/third_party/WebKit/Source/core/frame/UseCounter.h
index 11ebf3c..b4721d0b 100644
--- a/third_party/WebKit/Source/core/frame/UseCounter.h
+++ b/third_party/WebKit/Source/core/frame/UseCounter.h
@@ -955,6 +955,9 @@
         V8InputDeviceCapabilities_FiresTouchEvents_AttributeGetter = 1098,
         DataElement = 1099,
         TimeElement = 1100,
+        SVG1DOMUriReference = 1101,
+        SVG1DOMZoomAndPan = 1102,
+        V8SVGGraphicsElement_Transform_AttributeGetter = 1103,
 
         // Add new features immediately above this line. Don't change assigned
         // numbers of any item, and don't reuse removed slots.
diff --git a/third_party/WebKit/Source/core/html/HTMLSpanElement.h b/third_party/WebKit/Source/core/html/HTMLSpanElement.h
index 65bf41b..536412b6 100644
--- a/third_party/WebKit/Source/core/html/HTMLSpanElement.h
+++ b/third_party/WebKit/Source/core/html/HTMLSpanElement.h
@@ -26,11 +26,12 @@
 #ifndef HTMLSpanElement_h
 #define HTMLSpanElement_h
 
+#include "core/CoreExport.h"
 #include "core/html/HTMLElement.h"
 
 namespace blink {
 
-class HTMLSpanElement : public HTMLElement {
+class CORE_EXPORT HTMLSpanElement : public HTMLElement {
     DEFINE_WRAPPERTYPEINFO();
 public:
     DECLARE_NODE_FACTORY(HTMLSpanElement);
diff --git a/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp b/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
index a8f3d77..eff7bfb 100644
--- a/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
@@ -789,25 +789,21 @@
 
                         rowSpanCells.append(cell);
                         lastRowSpanCell = cell;
-
-                        // Find out the baseline. The baseline is set on the first row in a rowSpan.
-                        updateBaselineForCell(cell, r, baselineDescent);
                     }
-                    continue;
                 }
 
-                ASSERT(cell->rowSpan() == 1);
-
-                if (cell->hasOverrideLogicalContentHeight()) {
+                if (cell->rowIndex() == r && cell->hasOverrideLogicalContentHeight()) {
                     cell->clearIntrinsicPadding();
                     cell->clearOverrideSize();
                     cell->forceChildLayout();
                 }
 
-                m_rowPos[r + 1] = std::max(m_rowPos[r + 1], m_rowPos[r] + cell->logicalHeightForRowSizing());
+                if (cell->rowSpan() == 1)
+                    m_rowPos[r + 1] = std::max(m_rowPos[r + 1], m_rowPos[r] + cell->logicalHeightForRowSizing());
 
-                // Find out the baseline.
-                updateBaselineForCell(cell, r, baselineDescent);
+                // Find out the baseline. The baseline is set on the first row in a rowSpan.
+                if (cell->rowIndex() == r)
+                    updateBaselineForCell(cell, r, baselineDescent);
             }
         }
 
diff --git a/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp b/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp
index 06fa39a4..b021e1f 100644
--- a/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp
@@ -432,7 +432,12 @@
     IntSize visibleSize;
     if (box().hasOverflowClip()) {
         contentSize = IntSize(pixelSnappedScrollWidth(), pixelSnappedScrollHeight());
-        visibleSize = enclosingIntRect(box().overflowClipRect(LayoutPoint())).size();
+        visibleSize = pixelSnappedIntRect(box().overflowClipRect(box().location())).size();
+
+        // TODO(skobes): We should really ASSERT that contentSize >= visibleSize
+        // when we are not the root layer, but we can't because contentSize is
+        // based on stale layout overflow data (http://crbug.com/576933).
+        contentSize = contentSize.expandedTo(visibleSize);
     }
     return -scrollOrigin() + (contentSize - visibleSize);
 }
diff --git a/third_party/WebKit/Source/core/svg/SVGGraphicsElement.idl b/third_party/WebKit/Source/core/svg/SVGGraphicsElement.idl
index d30f99b..77474ef 100644
--- a/third_party/WebKit/Source/core/svg/SVGGraphicsElement.idl
+++ b/third_party/WebKit/Source/core/svg/SVGGraphicsElement.idl
@@ -31,7 +31,7 @@
 // http://www.w3.org/TR/SVG2/types.html#InterfaceSVGGraphicsElement
 
 interface SVGGraphicsElement : SVGElement {
-    [MeasureAs=SVG1DOM] readonly attribute SVGAnimatedTransformList transform;
+    [Measure] readonly attribute SVGAnimatedTransformList transform;
 
     [MeasureAs=SVGLocatableNearestViewportElement] readonly attribute SVGElement nearestViewportElement;
     [MeasureAs=SVGLocatableFarthestViewportElement] readonly attribute SVGElement farthestViewportElement;
diff --git a/third_party/WebKit/Source/core/svg/SVGURIReference.idl b/third_party/WebKit/Source/core/svg/SVGURIReference.idl
index 65f310f3..18932b0 100644
--- a/third_party/WebKit/Source/core/svg/SVGURIReference.idl
+++ b/third_party/WebKit/Source/core/svg/SVGURIReference.idl
@@ -29,5 +29,5 @@
 [
     NoInterfaceObject, // Always used on target of 'implements'
 ] interface SVGURIReference {
-    [MeasureAs=SVG1DOM] readonly attribute SVGAnimatedString href;
+    [MeasureAs=SVG1DOMUriReference] readonly attribute SVGAnimatedString href;
 };
diff --git a/third_party/WebKit/Source/core/svg/SVGUnitTypes.idl b/third_party/WebKit/Source/core/svg/SVGUnitTypes.idl
index c46fbd5a2..2b42b50 100644
--- a/third_party/WebKit/Source/core/svg/SVGUnitTypes.idl
+++ b/third_party/WebKit/Source/core/svg/SVGUnitTypes.idl
@@ -30,7 +30,7 @@
     WillBeGarbageCollected
 ] interface SVGUnitTypes {
     // Unit Types
-    [MeasureAs=SVG1DOM] const unsigned short SVG_UNIT_TYPE_UNKNOWN           = 0;
-    [MeasureAs=SVG1DOM] const unsigned short SVG_UNIT_TYPE_USERSPACEONUSE    = 1;
-    [MeasureAs=SVG1DOM] const unsigned short SVG_UNIT_TYPE_OBJECTBOUNDINGBOX = 2;
+    const unsigned short SVG_UNIT_TYPE_UNKNOWN           = 0;
+    const unsigned short SVG_UNIT_TYPE_USERSPACEONUSE    = 1;
+    const unsigned short SVG_UNIT_TYPE_OBJECTBOUNDINGBOX = 2;
 };
diff --git a/third_party/WebKit/Source/core/svg/SVGZoomAndPan.idl b/third_party/WebKit/Source/core/svg/SVGZoomAndPan.idl
index b61124a4..624eae4 100644
--- a/third_party/WebKit/Source/core/svg/SVGZoomAndPan.idl
+++ b/third_party/WebKit/Source/core/svg/SVGZoomAndPan.idl
@@ -31,9 +31,9 @@
 ] interface SVGZoomAndPan {
 
     // Zoom and Pan Types
-    [MeasureAs=SVG1DOM] const unsigned short SVG_ZOOMANDPAN_UNKNOWN = 0;
-    [MeasureAs=SVG1DOM] const unsigned short SVG_ZOOMANDPAN_DISABLE = 1;
-    [MeasureAs=SVG1DOM] const unsigned short SVG_ZOOMANDPAN_MAGNIFY = 2;
+    const unsigned short SVG_ZOOMANDPAN_UNKNOWN = 0;
+    const unsigned short SVG_ZOOMANDPAN_DISABLE = 1;
+    const unsigned short SVG_ZOOMANDPAN_MAGNIFY = 2;
 
-    [MeasureAs=SVG1DOM, RaisesException=Setter] attribute unsigned short zoomAndPan;
+    [MeasureAs=SVG1DOMZoomAndPan, RaisesException=Setter] attribute unsigned short zoomAndPan;
 };
diff --git a/third_party/WebKit/Source/devtools/front_end/network/networkLogView.css b/third_party/WebKit/Source/devtools/front_end/network/networkLogView.css
index 38b3deb..64c11f5 100644
--- a/third_party/WebKit/Source/devtools/front_end/network/networkLogView.css
+++ b/third_party/WebKit/Source/devtools/front_end/network/networkLogView.css
@@ -35,14 +35,13 @@
 
 .network-summary-bar {
     flex: 0 0 27px;
+    line-height: 27px;
     padding-left: 5px;
     background-color: #eee;
     border-top: 1px solid #ccc;
     white-space: nowrap;
     text-overflow: ellipsis;
     overflow: hidden;
-    display: flex;
-    align-items: center;
 }
 
 .network-summary-bar label[is=dt-icon-label] {
diff --git a/third_party/WebKit/Source/devtools/front_end/source_frame/imageView.css b/third_party/WebKit/Source/devtools/front_end/source_frame/imageView.css
index e2be192..4e2e215 100644
--- a/third_party/WebKit/Source/devtools/front_end/source_frame/imageView.css
+++ b/third_party/WebKit/Source/devtools/front_end/source_frame/imageView.css
@@ -4,6 +4,10 @@
  * found in the LICENSE file.
  */
 
+.image-view {
+    overflow: auto;
+}
+
 .image-view > .image {
     padding: 20px 20px 10px 20px;
     text-align: center;
diff --git a/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in b/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in
index 63707874..494f077 100644
--- a/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in
+++ b/third_party/WebKit/Source/platform/RuntimeEnabledFeatures.in
@@ -215,3 +215,4 @@
 ScrollCustomization
 ScrollRestoration status=stable
 WakeLock status=experimental
+WebFontsIntervention status=stable
diff --git a/third_party/WebKit/Source/web/WebRuntimeFeatures.cpp b/third_party/WebKit/Source/web/WebRuntimeFeatures.cpp
index ae0d7c2..14565df33 100644
--- a/third_party/WebKit/Source/web/WebRuntimeFeatures.cpp
+++ b/third_party/WebKit/Source/web/WebRuntimeFeatures.cpp
@@ -325,4 +325,9 @@
     RuntimeEnabledFeatures::setPresentationEnabled(enable);
 }
 
+void WebRuntimeFeatures::enableWebFontsIntervention(bool enable)
+{
+    RuntimeEnabledFeatures::setWebFontsInterventionEnabled(enable);
+}
+
 } // namespace blink
diff --git a/third_party/WebKit/public/web/WebRuntimeFeatures.h b/third_party/WebKit/public/web/WebRuntimeFeatures.h
index 1080bc6..bab7df98 100644
--- a/third_party/WebKit/public/web/WebRuntimeFeatures.h
+++ b/third_party/WebKit/public/web/WebRuntimeFeatures.h
@@ -163,6 +163,8 @@
     BLINK_EXPORT static void enableNewMediaPlaybackUi(bool);
 
     BLINK_EXPORT static void enablePresentationAPI(bool);
+
+    BLINK_EXPORT static void enableWebFontsIntervention(bool);
 private:
     WebRuntimeFeatures();
 };
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index 649bad20..9c53f49 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -45639,6 +45639,17 @@
   <summary>Number of retries until the final response was recorded.</summary>
 </histogram>
 
+<histogram name="SiteEngagementService.DaysSinceLastShortcutLaunch"
+    units="days">
+  <owner>calamity@chromium.org</owner>
+  <owner>dominickn@chromium.org</owner>
+  <summary>
+    The number of days between launches of an origin saved to homescreen or as a
+    bookmark app shortcut. Recorded at the second and each following launch of a
+    specific origin from a shortcut, independently per origin.
+  </summary>
+</histogram>
+
 <histogram name="SiteEngagementService.EngagementScore">
   <owner>calamity@chromium.org</owner>
   <owner>dominickn@chromium.org</owner>
@@ -45649,6 +45660,15 @@
   </summary>
 </histogram>
 
+<histogram name="SiteEngagementService.EngagementScoreBucket" units="%">
+  <owner>calamity@chromium.org</owner>
+  <summary>
+    The percentage of sites on a user's profile that have engagement scores that
+    fall in these buckets, recorded at startup per non-incognito profile, and
+    then upon the first engagement-increasing event every hour thereafter.
+  </summary>
+</histogram>
+
 <histogram name="SiteEngagementService.EngagementType"
     enum="SiteEngagementServiceEngagementType">
   <owner>calamity@chromium.org</owner>
@@ -65054,6 +65074,11 @@
   <int value="1097" label="V8RegExpPrototypeToString"/>
   <int value="1098"
       label="V8InputDeviceCapabilities_FiresTouchEvents_AttributeGetter"/>
+  <int value="1099" label="DataElement"/>
+  <int value="1100" label="TimeElement"/>
+  <int value="1101" label="SVG1DOMUriReference"/>
+  <int value="1102" label="SVG1DOMZoomAndPan"/>
+  <int value="1103" label="V8SVGGraphicsElement_Transform_AttributeGetter"/>
 </enum>
 
 <enum name="FetchRequestMode" type="int">
@@ -69339,6 +69364,7 @@
   <int value="27507364" label="apps-keep-chrome-alive"/>
   <int value="37024318" label="disable-affiliation-based-matching"/>
   <int value="48159177" label="reduced-referrer-granularity"/>
+  <int value="56723110" label="enable-webfonts-intervention"/>
   <int value="61205887" label="enable-text-input-focus-manager"/>
   <int value="75747474" label="disable-webview-signin-flow"/>
   <int value="78998551" label="disable-hosted-app-shim-creation"/>
@@ -77059,6 +77085,7 @@
   <int value="4" label="Mouse wheel"/>
   <int value="5" label="Media (foreground tab)"/>
   <int value="6" label="Media (background tab)"/>
+  <int value="7" label="Webapp shortcut launch"/>
 </enum>
 
 <enum name="SiteIsolationMimeType" type="int">
@@ -81808,6 +81835,21 @@
   <affected-histogram name="Media.EME.Widevine"/>
 </histogram_suffixes>
 
+<histogram_suffixes name="EngagementScoreBuckets">
+  <owner>calamity@chromium.org</owner>
+  <suffix name="0"/>
+  <suffix name="10"/>
+  <suffix name="20"/>
+  <suffix name="30"/>
+  <suffix name="40"/>
+  <suffix name="50"/>
+  <suffix name="60"/>
+  <suffix name="70"/>
+  <suffix name="80"/>
+  <suffix name="90"/>
+  <affected-histogram name="SiteEngagementService.EngagementScoreBucket"/>
+</histogram_suffixes>
+
 <histogram_suffixes name="ExitFunnels" separator=".">
   <suffix name="BackgroundOff"/>
   <suffix name="BackgroundOn"/>
diff --git a/ui/events/gestures/motion_event_aura.cc b/ui/events/gestures/motion_event_aura.cc
index 60f9854..7b6e34e 100644
--- a/ui/events/gestures/motion_event_aura.cc
+++ b/ui/events/gestures/motion_event_aura.cc
@@ -10,6 +10,22 @@
 namespace ui {
 namespace {
 
+MotionEvent::ToolType EventPointerTypeToMotionEventToolType(
+    EventPointerType type) {
+  switch (type) {
+    case EventPointerType::POINTER_TYPE_UNKNOWN:
+      return MotionEvent::TOOL_TYPE_UNKNOWN;
+    case EventPointerType::POINTER_TYPE_MOUSE:
+      return MotionEvent::TOOL_TYPE_MOUSE;
+    case EventPointerType::POINTER_TYPE_PEN:
+      return MotionEvent::TOOL_TYPE_STYLUS;
+    case EventPointerType::POINTER_TYPE_TOUCH:
+      return MotionEvent::TOOL_TYPE_FINGER;
+  }
+
+  return MotionEvent::TOOL_TYPE_UNKNOWN;
+}
+
 PointerProperties GetPointerPropertiesFromTouchEvent(const TouchEvent& touch) {
   PointerProperties pointer_properties;
   pointer_properties.x = touch.x();
@@ -31,8 +47,8 @@
     pointer_properties.orientation = 0;
   }
 
-  // TODO(jdduke): Plumb tool type from the platform, crbug.com/404128.
-  pointer_properties.tool_type = MotionEvent::TOOL_TYPE_UNKNOWN;
+  pointer_properties.tool_type = EventPointerTypeToMotionEventToolType(
+      touch.pointer_details().pointer_type());
 
   return pointer_properties;
 }
diff --git a/ui/events/gestures/motion_event_aura_unittest.cc b/ui/events/gestures/motion_event_aura_unittest.cc
index e5415c2d..75f49ff 100644
--- a/ui/events/gestures/motion_event_aura_unittest.cc
+++ b/ui/events/gestures/motion_event_aura_unittest.cc
@@ -255,6 +255,7 @@
   EXPECT_FLOAT_EQ(radius_y, event.GetTouchMinor(0) / 2);
   EXPECT_FLOAT_EQ(rotation_angle, event.GetOrientation(0) * 180 / M_PI + 90);
   EXPECT_FLOAT_EQ(pressure, event.GetPressure(0));
+  EXPECT_EQ(MotionEvent::TOOL_TYPE_FINGER, event.GetToolType(0));
 
   // Test case: radius_x < radius_y, rotation_angle < 90
   radius_x = 67.89f;
@@ -270,6 +271,7 @@
   EXPECT_FLOAT_EQ(radius_x, event.GetTouchMinor(1) / 2);
   EXPECT_FLOAT_EQ(rotation_angle, event.GetOrientation(1) * 180 / M_PI);
   EXPECT_FLOAT_EQ(pressure, event.GetPressure(1));
+  EXPECT_EQ(MotionEvent::TOOL_TYPE_FINGER, event.GetToolType(1));
 
   // Test cloning of tap params
   // TODO(mustaq): Make a separate clone test, crbug.com/450655
@@ -281,6 +283,7 @@
   EXPECT_FLOAT_EQ(radius_x, clone->GetTouchMinor(1) / 2);
   EXPECT_FLOAT_EQ(rotation_angle, clone->GetOrientation(1) * 180 / M_PI);
   EXPECT_FLOAT_EQ(pressure, clone->GetPressure(1));
+  EXPECT_EQ(MotionEvent::TOOL_TYPE_FINGER, clone->GetToolType(1));
 
   // TODO(mustaq): The move test seems out-of-scope here, crbug.com/450655
   radius_x = 76.98f;
@@ -297,6 +300,7 @@
   EXPECT_FLOAT_EQ(radius_x, event.GetTouchMinor(1) / 2);
   EXPECT_FLOAT_EQ(rotation_angle, event.GetOrientation(1) * 180 / M_PI);
   EXPECT_FLOAT_EQ(pressure, event.GetPressure(1));
+  EXPECT_EQ(MotionEvent::TOOL_TYPE_FINGER, event.GetToolType(1));
 
   // Test case: radius_x > radius_y, rotation_angle > 90
   radius_x = 123.45f;
@@ -312,6 +316,7 @@
   EXPECT_FLOAT_EQ(radius_y, event.GetTouchMinor(2) / 2);
   EXPECT_FLOAT_EQ(rotation_angle, event.GetOrientation(2) * 180 / M_PI + 90);
   EXPECT_FLOAT_EQ(pressure, event.GetPressure(2));
+  EXPECT_EQ(MotionEvent::TOOL_TYPE_FINGER, event.GetToolType(2));
 
   // Test case: radius_x < radius_y, rotation_angle > 90
   radius_x = 67.89f;
@@ -327,6 +332,7 @@
   EXPECT_FLOAT_EQ(radius_x, event.GetTouchMinor(3) / 2);
   EXPECT_FLOAT_EQ(rotation_angle, event.GetOrientation(3) * 180 / M_PI + 180);
   EXPECT_FLOAT_EQ(pressure, event.GetPressure(3));
+  EXPECT_EQ(MotionEvent::TOOL_TYPE_FINGER, event.GetToolType(3));
 }
 
 TEST(MotionEventAuraTest, Timestamps) {
@@ -421,12 +427,13 @@
 TEST(MotionEventAuraTest, ToolType) {
   MotionEventAura event;
 
-  // For now, all pointers have an unknown tool type.
-  // TODO(jdduke): Expand this test when ui::TouchEvent identifies the source
-  // touch type, crbug.com/404128.
   EXPECT_TRUE(event.OnTouch(TouchWithType(ET_TOUCH_PRESSED, 7)));
   ASSERT_EQ(1U, event.GetPointerCount());
-  EXPECT_EQ(MotionEvent::TOOL_TYPE_UNKNOWN, event.GetToolType(0));
+  EXPECT_EQ(MotionEvent::TOOL_TYPE_FINGER, event.GetToolType(0));
+
+  // TODO(robert.bradford): crbug.com/575162: Test TOOL_TYPE_PEN when
+  // TouchEvents can have their PointerDetails::pointer_type() something other
+  // than POINTER_TYPE_TOUCH
 }
 
 TEST(MotionEventAuraTest, Flags) {
diff --git a/ui/file_manager/audio_player/css/audio_player.css b/ui/file_manager/audio_player/css/audio_player.css
index 06c01630..2ba0d15 100644
--- a/ui/file_manager/audio_player/css/audio_player.css
+++ b/ui/file_manager/audio_player/css/audio_player.css
@@ -38,8 +38,8 @@
 /* Customized scrollbar for the playlist. */
 
 ::-webkit-scrollbar {
-  height: 16px;
-  width: 16px;
+  height: 11px;
+  width: 11px;
 }
 
 ::-webkit-scrollbar-button {
@@ -49,20 +49,16 @@
 
 ::-webkit-scrollbar-thumb {
   background-clip: padding-box;
-  background-color: rgba(255, 255, 255, 0.15);
-  box-shadow: inset 1px 1px 0 rgba(0, 0, 0, 0.10),
-              inset 0 -1px 0  rgba(0, 0, 0, 0.07);
+  background-color: rgba(0, 0, 0, 0.2);
   min-height: 28px;
 }
 
 ::-webkit-scrollbar-thumb:hover {
-  background-color: rgba(255, 255, 255, 0.20);
-  box-shadow: inset 1px 1px 1px rgba(0, 0, 0, 0.25);
+  background-color: rgba(0, 0, 0, 0.3);
 }
 
 ::-webkit-scrollbar-thumb:active {
-  background-color: rgba(255, 255, 255, 0.25);
-  box-shadow: inset 1px 1px 3px rgba(0, 0, 0, 0.35);
+  background-color: rgba(0, 0, 0, 0.4);
 }
 
 ::-webkit-scrollbar-thumb:vertical {
@@ -72,20 +68,9 @@
   border-top: 0 solid transparent;
 }
 
-::-webkit-scrollbar-track:hover {
-  background-color: rgba(0, 0, 0, 0.05);
-  box-shadow: inset 1px 0 0 rgba(0, 0, 0, 0.10);
-}
-
-::-webkit-scrollbar-track:active {
-  background-color: rgba(0, 0, 0, 0.05);
-  box-shadow: inset 1px 0 0 rgba(0, 0, 0, 0.14),
-              inset -1px -1px 0 rgba(0, 0, 0, 0.07);
-}
-
 ::-webkit-scrollbar-track:vertical {
   background-clip: padding-box;
-  background-color: transparent;
+  background-color: rgba(255, 255, 255, 0.5);
   border-left: 5px solid transparent;
   border-right: 0 solid transparent;
 }
diff --git a/ui/gfx/paint_vector_icon.cc b/ui/gfx/paint_vector_icon.cc
index 3f9078c..7121fde 100644
--- a/ui/gfx/paint_vector_icon.cc
+++ b/ui/gfx/paint_vector_icon.cc
@@ -292,7 +292,6 @@
             gfx::Size(static_cast<int>(dip_size), static_cast<int>(dip_size)),
             false),
         id_(id),
-        path_(),
         color_(color),
         badge_id_(badge_id) {}
 
diff --git a/ui/message_center/cocoa/popup_collection_unittest.mm b/ui/message_center/cocoa/popup_collection_unittest.mm
index 274d375..f802888 100644
--- a/ui/message_center/cocoa/popup_collection_unittest.mm
+++ b/ui/message_center/cocoa/popup_collection_unittest.mm
@@ -4,6 +4,8 @@
 
 #import "ui/message_center/cocoa/popup_collection.h"
 
+#include <utility>
+
 #include "base/mac/scoped_nsobject.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/message_loop/message_loop.h"
@@ -54,14 +56,14 @@
                      " be displayed"),
         gfx::Image(), base::string16(), GURL(), DummyNotifierId(),
         message_center::RichNotificationData(), NULL));
-    center_->AddNotification(notification.Pass());
+    center_->AddNotification(std::move(notification));
 
     notification.reset(new message_center::Notification(
         message_center::NOTIFICATION_TYPE_SIMPLE, "2", ASCIIToUTF16("Two"),
         ASCIIToUTF16("This is the second notification."), gfx::Image(),
         base::string16(), GURL(), DummyNotifierId(),
         message_center::RichNotificationData(), NULL));
-    center_->AddNotification(notification.Pass());
+    center_->AddNotification(std::move(notification));
 
     notification.reset(new message_center::Notification(
         message_center::NOTIFICATION_TYPE_SIMPLE, "3", ASCIIToUTF16("Three"),
@@ -73,7 +75,7 @@
                      "if the notification is way too big"),
         gfx::Image(), base::string16(), GURL(), DummyNotifierId(),
         message_center::RichNotificationData(), NULL));
-    center_->AddNotification(notification.Pass());
+    center_->AddNotification(std::move(notification));
     WaitForAnimationEnded();
   }
 
@@ -123,7 +125,7 @@
       ASCIIToUTF16("This is the fourth notification."), gfx::Image(),
       base::string16(), GURL(), DummyNotifierId(),
       message_center::RichNotificationData(), NULL));
-  center_->AddNotification(notification.Pass());
+  center_->AddNotification(std::move(notification));
   WaitForAnimationEnded();
 
   // Remove "1" and "3" should fit on screen.
@@ -166,7 +168,7 @@
       message_center::NOTIFICATION_TYPE_SIMPLE, "4", ASCIIToUTF16("Four"),
       ASCIIToUTF16("This is the fourth notification."), gfx::Image(),
       base::string16(), GURL(), DummyNotifierId(), optional, NULL));
-  center_->AddNotification(notification.Pass());
+  center_->AddNotification(std::move(notification));
   WaitForAnimationEnded();
   EXPECT_TRUE(CheckSpacingBetween([popups objectAtIndex:2],
                                   [popups objectAtIndex:3]));
@@ -199,7 +201,7 @@
                    " be displayed"),
       gfx::Image(), base::string16(), GURL(), DummyNotifierId(),
       message_center::RichNotificationData(), NULL));
-  center_->AddNotification(notification.Pass());
+  center_->AddNotification(std::move(notification));
   WaitForAnimationEnded();
   EXPECT_EQ(1u, [[collection_ popups] count]);
 
@@ -216,7 +218,7 @@
                    "long notification."),
       gfx::Image(), base::string16(), GURL(), DummyNotifierId(),
       message_center::RichNotificationData(), NULL));
-  center_->UpdateNotification("1", notification.Pass());
+  center_->UpdateNotification("1", std::move(notification));
   WaitForAnimationEnded();
   EXPECT_EQ(0u, [[collection_ popups] count]);
 }
@@ -256,7 +258,7 @@
                    "longer body"),
       gfx::Image(), base::string16(), GURL(), DummyNotifierId(),
       message_center::RichNotificationData(), NULL));
-  center_->AddNotification(notification.Pass());
+  center_->AddNotification(std::move(notification));
   WaitForAnimationEnded();
   EXPECT_GT(NSHeight([[controller view] frame]), NSHeight(old_frame));
 
@@ -280,7 +282,7 @@
       message_center::RichNotificationData(), NULL));
   notification->set_priority(-1);
 
-  center_->AddNotification(notification.Pass());
+  center_->AddNotification(std::move(notification));
   WaitForAnimationEnded();
   NSArray* popups = [collection_ popups];
   EXPECT_EQ(0u, [popups count]);
@@ -293,7 +295,7 @@
       message_center::RichNotificationData(), NULL));
   notification->set_priority(1);
 
-  center_->UpdateNotification("1", notification.Pass());
+  center_->UpdateNotification("1", std::move(notification));
   WaitForAnimationEnded();
   EXPECT_EQ(1u, [popups count]);
 }
@@ -307,7 +309,7 @@
                    " be displayed"),
       gfx::Image(), base::string16(), GURL(), DummyNotifierId(),
       message_center::RichNotificationData(), NULL));
-  center_->AddNotification(notification.Pass());
+  center_->AddNotification(std::move(notification));
 
   // Release the popup collection before the animation ends. No crash should
   // be expected.
@@ -334,7 +336,7 @@
       message_center::NOTIFICATION_TYPE_SIMPLE, "1", ASCIIToUTF16("One"),
       ASCIIToUTF16("New message."), gfx::Image(), base::string16(), GURL(),
       DummyNotifierId(), message_center::RichNotificationData(), NULL));
-  center_->UpdateNotification("1", notification.Pass());
+  center_->UpdateNotification("1", std::move(notification));
 
   // Release the popup collection before the animation ends. No crash should
   // be expected.
diff --git a/ui/views/mus/native_widget_mus.cc b/ui/views/mus/native_widget_mus.cc
index 6c644a8..11b77a2 100644
--- a/ui/views/mus/native_widget_mus.cc
+++ b/ui/views/mus/native_widget_mus.cc
@@ -16,6 +16,7 @@
 #include "ui/aura/layout_manager.h"
 #include "ui/aura/mus/mus_util.h"
 #include "ui/aura/window.h"
+#include "ui/aura/window_property.h"
 #include "ui/base/hit_test.h"
 #include "ui/gfx/canvas.h"
 #include "ui/native_theme/native_theme_aura.h"
@@ -30,9 +31,13 @@
 #include "ui/wm/core/capture_controller.h"
 #include "ui/wm/core/focus_controller.h"
 
+DECLARE_WINDOW_PROPERTY_TYPE(mus::Window*);
+
 namespace views {
 namespace {
 
+DEFINE_WINDOW_PROPERTY_KEY(mus::Window*, kMusWindow, nullptr);
+
 // TODO: figure out what this should be.
 class FocusRulesImpl : public wm::BaseFocusRules {
  public:
@@ -288,6 +293,7 @@
   window_tree_host_->AddObserver(this);
   window_tree_host_->InitHost();
   aura::Env::GetInstance()->set_context_factory(default_context_factory);
+  window_tree_host_->window()->SetProperty(kMusWindow, window_);
 
   focus_client_.reset(new wm::FocusController(new FocusRulesImpl));
 
@@ -308,8 +314,16 @@
   content_->Show();
   content_->SetTransparent(true);
   content_->SetFillsBoundsCompletely(false);
-
   window_tree_host_->window()->AddChild(content_);
+
+  // Set-up transiency if appropriate.
+  if (params.parent && !params.child) {
+    aura::Window* parent_root = params.parent->GetRootWindow();
+    mus::Window* parent_mus = parent_root->GetProperty(kMusWindow);
+    if (parent_mus)
+      parent_mus->AddTransientWindow(window_);
+  }
+
   // TODO(beng): much else, see [Desktop]NativeWidgetAura.
 
   native_widget_delegate_->OnNativeWidgetCreated(false);
diff --git a/ui/views/widget/native_widget_mac.mm b/ui/views/widget/native_widget_mac.mm
index e34f61d..f61ff817 100644
--- a/ui/views/widget/native_widget_mac.mm
+++ b/ui/views/widget/native_widget_mac.mm
@@ -6,6 +6,8 @@
 
 #import <Cocoa/Cocoa.h>
 
+#include <utility>
+
 #include "base/mac/foundation_util.h"
 #include "base/mac/scoped_nsobject.h"
 #include "base/strings/sys_string_conversions.h"
@@ -367,7 +369,7 @@
   // Notify observers while |bridged_| is still valid.
   delegate_->OnNativeWidgetDestroying();
   // Reset |bridge_| to NULL before destroying it.
-  scoped_ptr<BridgedNativeWidget> bridge(bridge_.Pass());
+  scoped_ptr<BridgedNativeWidget> bridge(std::move(bridge_));
 }
 
 void NativeWidgetMac::Show() {