diff --git a/DEPS b/DEPS
index 61939b1..365d45e 100644
--- a/DEPS
+++ b/DEPS
@@ -83,11 +83,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': 'b0c427b1f286524aa3bfd497056b0626c84a20b9',
+  'skia_revision': '2f5b8d81c231ef4acb4b5671c0956a249f0ef4cf',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': '95d2f6fba2f6a7cf061931dfc7c889a41415c994',
+  'v8_revision': 'bf50906e3ea90d3597ce792971c15bf717383ee0',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -95,7 +95,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling ANGLE
   # and whatever else without interference from each other.
-  'angle_revision': 'e4741fd0f2bce711a90bdebe2ac8e83cf944b8e8',
+  'angle_revision': '5dd4ad896bcb69b7e3747c1a17e6b07da63753e8',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling build tools
   # and whatever else without interference from each other.
@@ -139,7 +139,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling catapult
   # and whatever else without interference from each other.
-  'catapult_revision': '69f2184e9c4351f5216d1ebe52bfd4c37ea79081',
+  'catapult_revision': '52dc3feb012cce1d690b12d0b137c6c9bd5a4ff1',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libFuzzer
   # and whatever else without interference from each other.
@@ -658,7 +658,7 @@
     Var('chromium_git') + '/external/khronosgroup/webgl.git' + '@' + 'd458ada06171a85af00367251a4ed55db7fe2018',
 
   'src/third_party/webrtc':
-    Var('webrtc_git') + '/src.git' + '@' + '1f5e98d97eca1b557d6299c87ec6642ba8b0ac46', # commit position 21742
+    Var('webrtc_git') + '/src.git' + '@' + 'f61b3ba65e3d868267ea141c88b59127163e4766', # commit position 21742
 
   'src/third_party/xdg-utils': {
       'url': Var('chromium_git') + '/chromium/deps/xdg-utils.git' + '@' + 'd80274d5869b17b8c9067a1022e4416ee7ed5e0d',
diff --git a/android_webview/DEPS b/android_webview/DEPS
index 3751d71..1fe149f 100644
--- a/android_webview/DEPS
+++ b/android_webview/DEPS
@@ -24,6 +24,7 @@
   # Only this one header in media which doesn't depend on anything else.
   "+media/media_features.h",
   "+net",
+  "+services/network/public/cpp",
   "+services/viz/public/interfaces",
   "+skia",
   "+third_party/skia/include",
diff --git a/android_webview/browser/aw_content_browser_client.cc b/android_webview/browser/aw_content_browser_client.cc
index e6664c6..b569e64 100644
--- a/android_webview/browser/aw_content_browser_client.cc
+++ b/android_webview/browser/aw_content_browser_client.cc
@@ -56,7 +56,6 @@
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/storage_partition.h"
 #include "content/public/browser/web_contents.h"
-#include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/service_names.mojom.h"
 #include "content/public/common/url_constants.h"
@@ -66,6 +65,7 @@
 #include "net/log/net_log.h"
 #include "net/ssl/ssl_cert_request_info.h"
 #include "net/ssl/ssl_info.h"
+#include "services/network/public/cpp/features.h"
 #include "services/service_manager/public/cpp/binder_registry.h"
 #include "storage/browser/quota/quota_settings.h"
 #include "ui/base/resource/resource_bundle.h"
@@ -560,7 +560,7 @@
     service_manager::BinderRegistry* registry,
     blink::AssociatedInterfaceRegistry* associated_registry,
     content::RenderProcessHost* render_process_host) {
-  if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     registry->AddInterface(
         base::Bind(
             &safe_browsing::MojoSafeBrowsingImpl::MaybeCreate,
@@ -577,7 +577,7 @@
     const base::Callback<content::WebContents*()>& wc_getter,
     content::NavigationUIData* navigation_ui_data) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  DCHECK(base::FeatureList::IsEnabled(features::kNetworkService));
+  DCHECK(base::FeatureList::IsEnabled(network::features::kNetworkService));
 
   std::vector<std::unique_ptr<content::URLLoaderThrottle>> result;
 
diff --git a/android_webview/java/src/org/chromium/android_webview/AwContents.java b/android_webview/java/src/org/chromium/android_webview/AwContents.java
index c0911894..26f0220 100644
--- a/android_webview/java/src/org/chromium/android_webview/AwContents.java
+++ b/android_webview/java/src/org/chromium/android_webview/AwContents.java
@@ -81,6 +81,7 @@
 import org.chromium.content_public.browser.SelectionClient;
 import org.chromium.content_public.browser.SelectionPopupController;
 import org.chromium.content_public.browser.WebContents;
+import org.chromium.content_public.browser.WebContentsAccessibility;
 import org.chromium.content_public.browser.WebContentsInternals;
 import org.chromium.content_public.browser.navigation_controller.LoadURLType;
 import org.chromium.content_public.browser.navigation_controller.UserAgentOverrideOption;
@@ -2407,6 +2408,10 @@
         return mWebContents.hasAccessedInitialDocument();
     }
 
+    private WebContentsAccessibility getWebContentsAccessibility() {
+        return WebContentsAccessibility.fromWebContents(mWebContents);
+    }
+
     @TargetApi(Build.VERSION_CODES.M)
     public void onProvideVirtualStructure(ViewStructure structure) {
         if (isDestroyedOrNoOperation(WARN)) return;
@@ -2417,7 +2422,7 @@
         }
         // for webview, the platform already calculates the scroll (as it is a view) in
         // ViewStructure tree. Do not offset for it in the snapshop x,y position calculations.
-        mContentViewCore.onProvideVirtualStructure(structure, true);
+        getWebContentsAccessibility().onProvideVirtualStructure(structure, true);
     }
 
     public void onProvideAutoFillVirtualStructure(ViewStructure structure, int flags) {
@@ -2716,8 +2721,9 @@
     }
 
     public boolean supportsAccessibilityAction(int action) {
-        return isDestroyedOrNoOperation(WARN) ? false
-                : mContentViewCore.supportsAccessibilityAction(action);
+        return isDestroyedOrNoOperation(WARN)
+                ? false
+                : getWebContentsAccessibility().supportsAction(action);
     }
 
     /**
@@ -3546,15 +3552,16 @@
 
         @Override
         public AccessibilityNodeProvider getAccessibilityNodeProvider() {
-            return isDestroyedOrNoOperation(WARN) ? null
-                                                  : mContentViewCore.getAccessibilityNodeProvider();
+            return isDestroyedOrNoOperation(WARN)
+                    ? null
+                    : getWebContentsAccessibility().getAccessibilityNodeProvider();
         }
 
         @Override
         public boolean performAccessibilityAction(final int action, final Bundle arguments) {
             return isDestroyedOrNoOperation(WARN)
                     ? false
-                    : mContentViewCore.performAccessibilityAction(action, arguments);
+                    : getWebContentsAccessibility().performAction(action, arguments);
         }
     }
 
diff --git a/android_webview/javatests/src/org/chromium/android_webview/test/AwContentsGarbageCollectionTest.java b/android_webview/javatests/src/org/chromium/android_webview/test/AwContentsGarbageCollectionTest.java
index 8cab0a6..cc6bed5 100644
--- a/android_webview/javatests/src/org/chromium/android_webview/test/AwContentsGarbageCollectionTest.java
+++ b/android_webview/javatests/src/org/chromium/android_webview/test/AwContentsGarbageCollectionTest.java
@@ -30,6 +30,7 @@
 import org.chromium.content.browser.test.util.Criteria;
 import org.chromium.content.browser.test.util.CriteriaHelper;
 import org.chromium.content_public.browser.ImeAdapter;
+import org.chromium.content_public.browser.WebContentsAccessibility;
 import org.chromium.content_public.common.ContentUrlConstants;
 
 /**
@@ -174,7 +175,8 @@
             mActivityTestRule.loadUrlAsync(
                     containerViews[i].getAwContents(), ContentUrlConstants.ABOUT_BLANK_DISPLAY_URL);
             providers[i] = ThreadUtils.runOnUiThreadBlocking(() -> {
-                containerView.getContentViewCore().setAccessibilityState(true);
+                WebContentsAccessibility.fromWebContents(containerView.getWebContents())
+                        .setState(true);
                 return containerView.getAccessibilityNodeProvider();
             });
             Assert.assertNotNull(providers[i]);
diff --git a/android_webview/renderer/DEPS b/android_webview/renderer/DEPS
index 6468d5d..6805730 100644
--- a/android_webview/renderer/DEPS
+++ b/android_webview/renderer/DEPS
@@ -20,7 +20,8 @@
   "+media/base",
 
   "+printing",
-  
+
+  "+services/network/public/cpp",
   "+services/service_manager/public/cpp",
 
   "+third_party/WebKit/public/platform",
diff --git a/android_webview/renderer/aw_content_renderer_client.cc b/android_webview/renderer/aw_content_renderer_client.cc
index f65272f3..a9e45cd 100644
--- a/android_webview/renderer/aw_content_renderer_client.cc
+++ b/android_webview/renderer/aw_content_renderer_client.cc
@@ -33,7 +33,6 @@
 #include "components/visitedlink/renderer/visitedlink_slave.h"
 #include "components/web_restrictions/interfaces/web_restrictions.mojom.h"
 #include "content/public/child/child_thread.h"
-#include "content/public/common/content_features.h"
 #include "content/public/common/service_manager_connection.h"
 #include "content/public/common/service_names.mojom.h"
 #include "content/public/common/simple_connection_filter.h"
@@ -45,6 +44,7 @@
 #include "content/public/renderer/render_view.h"
 #include "net/base/escape.h"
 #include "net/base/net_errors.h"
+#include "services/network/public/cpp/features.h"
 #include "services/service_manager/public/cpp/connector.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 #include "third_party/WebKit/public/platform/WebString.h"
@@ -352,7 +352,7 @@
 bool AwContentRendererClient::UsingSafeBrowsingMojoService() {
   if (safe_browsing_)
     return true;
-  if (!base::FeatureList::IsEnabled(features::kNetworkService))
+  if (!base::FeatureList::IsEnabled(network::features::kNetworkService))
     return false;
   RenderThread::Get()->GetConnector()->BindInterface(
       content::mojom::kBrowserServiceName, &safe_browsing_);
diff --git a/android_webview/renderer/aw_url_loader_throttle_provider.cc b/android_webview/renderer/aw_url_loader_throttle_provider.cc
index 11240e1e..2a5be521 100644
--- a/android_webview/renderer/aw_url_loader_throttle_provider.cc
+++ b/android_webview/renderer/aw_url_loader_throttle_provider.cc
@@ -11,6 +11,7 @@
 #include "content/public/common/content_features.h"
 #include "content/public/common/service_names.mojom.h"
 #include "content/public/renderer/render_thread.h"
+#include "services/network/public/cpp/features.h"
 #include "services/service_manager/public/cpp/connector.h"
 
 namespace android_webview {
@@ -20,7 +21,7 @@
     : type_(type) {
   DETACH_FROM_THREAD(thread_checker_);
 
-  if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     content::RenderThread::Get()->GetConnector()->BindInterface(
         content::mojom::kBrowserServiceName,
         mojo::MakeRequest(&safe_browsing_info_));
@@ -41,7 +42,7 @@
   std::vector<std::unique_ptr<content::URLLoaderThrottle>> throttles;
 
   bool network_service_enabled =
-      base::FeatureList::IsEnabled(features::kNetworkService);
+      base::FeatureList::IsEnabled(network::features::kNetworkService);
   // Some throttles have already been added in the browser for frame resources.
   // Don't add them for frame requests.
   bool is_frame_resource = content::IsResourceTypeFrame(resource_type);
diff --git a/base/files/dir_reader_posix_unittest.cc b/base/files/dir_reader_posix_unittest.cc
index 349e00d..ad239ce 100644
--- a/base/files/dir_reader_posix_unittest.cc
+++ b/base/files/dir_reader_posix_unittest.cc
@@ -21,7 +21,7 @@
 
 namespace base {
 
-#if defined(ADDRESS_SANITIZER)
+#if defined(ADDRESS_SANITIZER) && defined(OS_ANDROID)
 // On ASAN builds, the working directory for the test is /, which is not
 // readable. See crbug.com/804348.
 #define MAYBE_Read DISABLED_Read
diff --git a/base/metrics/sparse_histogram_unittest.cc b/base/metrics/sparse_histogram_unittest.cc
index 5f333e0..0bf2167 100644
--- a/base/metrics/sparse_histogram_unittest.cc
+++ b/base/metrics/sparse_histogram_unittest.cc
@@ -206,7 +206,7 @@
   }
 
   const StatisticsRecorder::Histograms histograms =
-      StatisticsRecorder::GetHistograms();
+      StatisticsRecorder::Sort(StatisticsRecorder::GetHistograms());
   ASSERT_THAT(histograms, testing::SizeIs(2));
   EXPECT_STREQ(histograms[0]->histogram_name(), "Sparse0");
   EXPECT_STREQ(histograms[1]->histogram_name(), "Sparse1");
diff --git a/base/metrics/statistics_recorder.cc b/base/metrics/statistics_recorder.cc
index 60e430e..28773a1 100644
--- a/base/metrics/statistics_recorder.cc
+++ b/base/metrics/statistics_recorder.cc
@@ -137,7 +137,8 @@
 // static
 void StatisticsRecorder::WriteHTMLGraph(const std::string& query,
                                         std::string* output) {
-  for (const HistogramBase* const histogram : GetSnapshot(query)) {
+  for (const HistogramBase* const histogram :
+       Sort(WithName(GetHistograms(), query))) {
     histogram->WriteHTMLGraph(output);
     *output += "<br><hr><br>";
   }
@@ -151,7 +152,8 @@
   else
     output->append("Collections of all histograms\n");
 
-  for (const HistogramBase* const histogram : GetSnapshot(query)) {
+  for (const HistogramBase* const histogram :
+       Sort(WithName(GetHistograms(), query))) {
     histogram->WriteAscii(output);
     output->append("\n");
   }
@@ -161,7 +163,7 @@
 std::string StatisticsRecorder::ToJSON(JSONVerbosityLevel verbosity_level) {
   std::string output = "{\"histograms\":[";
   const char* sep = "";
-  for (const HistogramBase* const histogram : GetHistograms()) {
+  for (const HistogramBase* const histogram : Sort(GetHistograms())) {
     output += sep;
     sep = ",";
     std::string json;
@@ -221,8 +223,11 @@
     HistogramBase::Flags flags_to_set,
     HistogramBase::Flags required_flags,
     HistogramSnapshotManager* snapshot_manager) {
-  snapshot_manager->PrepareDeltas(GetKnownHistograms(include_persistent),
-                                  flags_to_set, required_flags);
+  Histograms histograms = GetHistograms();
+  if (!include_persistent)
+    histograms = NonPersistent(std::move(histograms));
+  snapshot_manager->PrepareDeltas(Sort(std::move(histograms)), flags_to_set,
+                                  required_flags);
 }
 
 // static
@@ -323,9 +328,7 @@
 }
 
 // static
-template <typename Predicate>
-StatisticsRecorder::Histograms StatisticsRecorder::GetHistogramsWithPredicate(
-    const Predicate predicate) {
+StatisticsRecorder::Histograms StatisticsRecorder::GetHistograms() {
   // This must be called *before* the lock is acquired below because it will
   // call back into this object to register histograms. Those called methods
   // will acquire the lock at that time.
@@ -333,46 +336,47 @@
 
   Histograms out;
 
-  {
-    const AutoLock auto_lock(lock_.Get());
-    EnsureGlobalRecorderWhileLocked();
-    out.reserve(top_->histograms_.size());
-    for (const auto& entry : top_->histograms_) {
-      const HistogramBase* const histogram = entry.second;
-      DCHECK(histogram);
-      if (predicate(*histogram))
-        out.push_back(entry.second);
-    }
-  }
+  const AutoLock auto_lock(lock_.Get());
+  EnsureGlobalRecorderWhileLocked();
 
-  std::sort(out.begin(), out.end(), &HistogramNameLesser);
+  out.reserve(top_->histograms_.size());
+  for (const auto& entry : top_->histograms_)
+    out.push_back(entry.second);
+
   return out;
 }
 
 // static
-StatisticsRecorder::Histograms StatisticsRecorder::GetHistograms() {
-  return GetHistogramsWithPredicate([](const HistogramBase&) { return true; });
+StatisticsRecorder::Histograms StatisticsRecorder::Sort(Histograms histograms) {
+  std::sort(histograms.begin(), histograms.end(), &HistogramNameLesser);
+  return histograms;
 }
 
 // static
-StatisticsRecorder::Histograms StatisticsRecorder::GetKnownHistograms(
-    bool include_persistent) {
-  return GetHistogramsWithPredicate(
-      [include_persistent](const HistogramBase& histogram) {
-        return include_persistent ||
-               (histogram.flags() & HistogramBase::kIsPersistent) == 0;
-      });
-}
-
-// static
-StatisticsRecorder::Histograms StatisticsRecorder::GetSnapshot(
+StatisticsRecorder::Histograms StatisticsRecorder::WithName(
+    Histograms histograms,
     const std::string& query) {
   // Need a C-string query for comparisons against C-string histogram name.
   const char* const query_string = query.c_str();
-  return GetHistogramsWithPredicate(
-      [query_string](const HistogramBase& histogram) {
-        return strstr(histogram.histogram_name(), query_string) != nullptr;
-      });
+  histograms.erase(std::remove_if(histograms.begin(), histograms.end(),
+                                  [query_string](const HistogramBase* const h) {
+                                    return !strstr(h->histogram_name(),
+                                                   query_string);
+                                  }),
+                   histograms.end());
+  return histograms;
+}
+
+// static
+StatisticsRecorder::Histograms StatisticsRecorder::NonPersistent(
+    Histograms histograms) {
+  histograms.erase(
+      std::remove_if(histograms.begin(), histograms.end(),
+                     [](const HistogramBase* const h) {
+                       return (h->flags() & HistogramBase::kIsPersistent) != 0;
+                     }),
+      histograms.end());
+  return histograms;
 }
 
 // static
diff --git a/base/metrics/statistics_recorder.h b/base/metrics/statistics_recorder.h
index c994b7e2..03651a9 100644
--- a/base/metrics/statistics_recorder.h
+++ b/base/metrics/statistics_recorder.h
@@ -109,7 +109,7 @@
 
   // Gets existing histograms.
   //
-  // The returned histograms are sorted by name.
+  // The order of returned histograms is not guaranteed.
   //
   // Ownership of the individual histograms remains with the StatisticsRecorder.
   //
@@ -143,17 +143,6 @@
                             HistogramBase::Flags required_flags,
                             HistogramSnapshotManager* snapshot_manager);
 
-  // Gets registered histograms. Only histograms which have |query| as a
-  // substring in their name are extracted. An empty query returns all
-  // registered histograms.
-  //
-  // The returned histograms are sorted by name.
-  //
-  // Ownership of the individual histograms remains with the StatisticsRecorder.
-  //
-  // This method is thread safe.
-  static Histograms GetSnapshot(const std::string& query);
-
   typedef base::Callback<void(HistogramBase::Sample)> OnSampleCallback;
 
   // Sets the callback to notify when a new sample is recorded on the histogram
@@ -224,6 +213,16 @@
   // This method is thread safe.
   static bool ShouldRecordHistogram(uint64_t histogram_hash);
 
+  // Sorts histograms by name.
+  static Histograms Sort(Histograms histograms);
+
+  // Filters histograms by name. Only histograms which have |query| as a
+  // substring in their name are kept. An empty query keeps all histograms.
+  static Histograms WithName(Histograms histograms, const std::string& query);
+
+  // Filters histograms by persistency. Only non-persistent histograms are kept.
+  static Histograms NonPersistent(Histograms histograms);
+
  private:
   typedef std::vector<WeakPtr<HistogramProvider>> HistogramProviders;
 
@@ -255,26 +254,6 @@
   // Precondition: The global lock is already acquired.
   static void EnsureGlobalRecorderWhileLocked();
 
-  // Gets existing histograms matching |predicate|. |Predicate| must have the
-  // signature bool(const HistogramBase&).
-  //
-  // The returned histograms are sorted by name.
-  //
-  // Ownership of the individual histograms remains with the StatisticsRecorder.
-  //
-  // This method is thread safe.
-  template <typename Predicate>
-  static Histograms GetHistogramsWithPredicate(Predicate predicate);
-
-  // Gets existing histograms.
-  //
-  // The returned histograms are sorted by name.
-  //
-  // Ownership of the individual histograms remains with the StatisticsRecorder.
-  //
-  // This method is thread safe.
-  static Histograms GetKnownHistograms(bool include_persistent);
-
   // Gets histogram providers.
   //
   // This method is thread safe.
diff --git a/base/metrics/statistics_recorder_unittest.cc b/base/metrics/statistics_recorder_unittest.cc
index 79ab7bf..9e3197e 100644
--- a/base/metrics/statistics_recorder_unittest.cc
+++ b/base/metrics/statistics_recorder_unittest.cc
@@ -54,7 +54,6 @@
 
 namespace base {
 
-using testing::ElementsAre;
 using testing::IsEmpty;
 using testing::SizeIs;
 using testing::UnorderedElementsAre;
@@ -142,7 +141,8 @@
   EXPECT_EQ(StatisticsRecorder::RegisterOrDeleteDuplicate(histogram),
             histogram);
   EXPECT_TRUE(HasGlobalRecorder());
-  EXPECT_THAT(StatisticsRecorder::GetHistograms(), ElementsAre(histogram));
+  EXPECT_THAT(StatisticsRecorder::GetHistograms(),
+              UnorderedElementsAre(histogram));
 
   UninitializeStatisticsRecorder();
   EXPECT_FALSE(HasGlobalRecorder());
@@ -202,19 +202,22 @@
   // Register the Histogram.
   EXPECT_EQ(histogram1,
             StatisticsRecorder::RegisterOrDeleteDuplicate(histogram1));
-  EXPECT_THAT(StatisticsRecorder::GetHistograms(), ElementsAre(histogram1));
+  EXPECT_THAT(StatisticsRecorder::GetHistograms(),
+              UnorderedElementsAre(histogram1));
 
   // Register the same Histogram again.
   EXPECT_EQ(histogram1,
             StatisticsRecorder::RegisterOrDeleteDuplicate(histogram1));
-  EXPECT_THAT(StatisticsRecorder::GetHistograms(), ElementsAre(histogram1));
+  EXPECT_THAT(StatisticsRecorder::GetHistograms(),
+              UnorderedElementsAre(histogram1));
 
   // Register another Histogram with the same name.
   Histogram* const histogram2 = CreateHistogram("TestHistogram1", 1, 1000, 10);
   EXPECT_NE(histogram1, histogram2);
   EXPECT_EQ(histogram1,
             StatisticsRecorder::RegisterOrDeleteDuplicate(histogram2));
-  EXPECT_THAT(StatisticsRecorder::GetHistograms(), ElementsAre(histogram1));
+  EXPECT_THAT(StatisticsRecorder::GetHistograms(),
+              UnorderedElementsAre(histogram1));
 
   // Register another Histogram with a different name.
   Histogram* const histogram3 = CreateHistogram("TestHistogram0", 1, 1000, 10);
@@ -222,7 +225,7 @@
   EXPECT_EQ(histogram3,
             StatisticsRecorder::RegisterOrDeleteDuplicate(histogram3));
   EXPECT_THAT(StatisticsRecorder::GetHistograms(),
-              ElementsAre(histogram3, histogram1));
+              UnorderedElementsAre(histogram1, histogram3));
 }
 
 TEST_P(StatisticsRecorderTest, FindHistogram) {
@@ -259,14 +262,17 @@
   EXPECT_FALSE(StatisticsRecorder::FindHistogram("TestHistogram"));
 }
 
-TEST_P(StatisticsRecorderTest, GetSnapshot) {
+TEST_P(StatisticsRecorderTest, WithName) {
   Histogram::FactoryGet("TestHistogram1", 1, 1000, 10, Histogram::kNoFlags);
   Histogram::FactoryGet("TestHistogram2", 1, 1000, 10, Histogram::kNoFlags);
   Histogram::FactoryGet("TestHistogram3", 1, 1000, 10, Histogram::kNoFlags);
 
-  EXPECT_THAT(StatisticsRecorder::GetSnapshot("Test"), SizeIs(3));
-  EXPECT_THAT(StatisticsRecorder::GetSnapshot("1"), SizeIs(1));
-  EXPECT_THAT(StatisticsRecorder::GetSnapshot("hello"), IsEmpty());
+  const auto histograms = StatisticsRecorder::GetHistograms();
+  EXPECT_THAT(histograms, SizeIs(3));
+  EXPECT_THAT(StatisticsRecorder::WithName(histograms, ""), SizeIs(3));
+  EXPECT_THAT(StatisticsRecorder::WithName(histograms, "Test"), SizeIs(3));
+  EXPECT_THAT(StatisticsRecorder::WithName(histograms, "1"), SizeIs(1));
+  EXPECT_THAT(StatisticsRecorder::WithName(histograms, "hello"), IsEmpty());
 }
 
 TEST_P(StatisticsRecorderTest, RegisterHistogramWithFactoryGet) {
@@ -275,25 +281,27 @@
   // Create a histogram.
   HistogramBase* const histogram1 = Histogram::FactoryGet(
       "TestHistogram", 1, 1000, 10, HistogramBase::kNoFlags);
-  EXPECT_THAT(StatisticsRecorder::GetHistograms(), ElementsAre(histogram1));
+  EXPECT_THAT(StatisticsRecorder::GetHistograms(),
+              UnorderedElementsAre(histogram1));
 
   // Get an existing histogram.
   HistogramBase* const histogram2 = Histogram::FactoryGet(
       "TestHistogram", 1, 1000, 10, HistogramBase::kNoFlags);
   EXPECT_EQ(histogram1, histogram2);
-  EXPECT_THAT(StatisticsRecorder::GetHistograms(), ElementsAre(histogram1));
+  EXPECT_THAT(StatisticsRecorder::GetHistograms(),
+              UnorderedElementsAre(histogram1));
 
   // Create a LinearHistogram.
   HistogramBase* const histogram3 = LinearHistogram::FactoryGet(
       "TestLinearHistogram", 1, 1000, 10, HistogramBase::kNoFlags);
   EXPECT_THAT(StatisticsRecorder::GetHistograms(),
-              ElementsAre(histogram1, histogram3));
+              UnorderedElementsAre(histogram1, histogram3));
 
   // Create a BooleanHistogram.
   HistogramBase* const histogram4 = BooleanHistogram::FactoryGet(
       "TestBooleanHistogram", HistogramBase::kNoFlags);
   EXPECT_THAT(StatisticsRecorder::GetHistograms(),
-              ElementsAre(histogram4, histogram1, histogram3));
+              UnorderedElementsAre(histogram1, histogram3, histogram4));
 
   // Create a CustomHistogram.
   std::vector<int> custom_ranges;
@@ -301,8 +309,9 @@
   custom_ranges.push_back(5);
   HistogramBase* const histogram5 = CustomHistogram::FactoryGet(
       "TestCustomHistogram", custom_ranges, HistogramBase::kNoFlags);
-  EXPECT_THAT(StatisticsRecorder::GetHistograms(),
-              ElementsAre(histogram4, histogram5, histogram1, histogram3));
+  EXPECT_THAT(
+      StatisticsRecorder::GetHistograms(),
+      UnorderedElementsAre(histogram1, histogram3, histogram4, histogram5));
 }
 
 TEST_P(StatisticsRecorderTest, RegisterHistogramWithMacros) {
@@ -402,9 +411,10 @@
   Histogram::FactoryGet("IterationTest1", 1, 64, 16, HistogramBase::kNoFlags);
   Histogram::FactoryGet("IterationTest2", 1, 64, 16, HistogramBase::kNoFlags);
 
-  EXPECT_THAT(StatisticsRecorder::GetKnownHistograms(true), SizeIs(2));
-  EXPECT_THAT(StatisticsRecorder::GetKnownHistograms(false),
-              SizeIs(use_persistent_histogram_allocator_ ? 0 : 2));
+  auto histograms = StatisticsRecorder::GetHistograms();
+  EXPECT_THAT(histograms, SizeIs(2));
+  histograms = StatisticsRecorder::NonPersistent(std::move(histograms));
+  EXPECT_THAT(histograms, SizeIs(use_persistent_histogram_allocator_ ? 0 : 2));
 
   // Create a new global allocator using the same memory as the old one. Any
   // old one is kept around so the memory doesn't get released.
@@ -420,12 +430,10 @@
   UninitializeStatisticsRecorder();
   InitializeStatisticsRecorder();
 
-  StatisticsRecorder::ImportGlobalPersistentHistograms();
-  EXPECT_THAT(StatisticsRecorder::GetKnownHistograms(true),
-              SizeIs(use_persistent_histogram_allocator_ ? 2 : 0));
-
-  StatisticsRecorder::ImportGlobalPersistentHistograms();
-  EXPECT_THAT(StatisticsRecorder::GetKnownHistograms(false), IsEmpty());
+  histograms = StatisticsRecorder::GetHistograms();
+  EXPECT_THAT(histograms, SizeIs(use_persistent_histogram_allocator_ ? 2 : 0));
+  histograms = StatisticsRecorder::NonPersistent(std::move(histograms));
+  EXPECT_THAT(histograms, IsEmpty());
 }
 
 namespace {
diff --git a/base/test/histogram_tester.cc b/base/test/histogram_tester.cc
index ca8edba..2a63b8c 100644
--- a/base/test/histogram_tester.cc
+++ b/base/test/histogram_tester.cc
@@ -124,7 +124,7 @@
   CountsMap result;
 
   // Find candidate matches by using the logic built into GetSnapshot().
-  for (HistogramBase* histogram : StatisticsRecorder::GetSnapshot(prefix)) {
+  for (const HistogramBase* histogram : StatisticsRecorder::GetHistograms()) {
     if (!StartsWith(histogram->histogram_name(), prefix,
                     CompareCase::SENSITIVE)) {
       continue;
diff --git a/build/toolchain/concurrent_links.gni b/build/toolchain/concurrent_links.gni
index 0cdcff52..6962c46 100644
--- a/build/toolchain/concurrent_links.gni
+++ b/build/toolchain/concurrent_links.gni
@@ -35,8 +35,6 @@
     _args = [ "--mem_per_link_gb=4" ]
   } else if (is_android && !is_component_build && symbol_level == 2) {
     _args = [ "--mem_per_link_gb=25" ]
-  } else if (is_linux && symbol_level == 1) {
-    _args = [ "--mem_per_link_gb=3" ]
   } else {
     _args = []
   }
diff --git a/cc/BUILD.gn b/cc/BUILD.gn
index 5f1f80b..ae8cf0f 100644
--- a/cc/BUILD.gn
+++ b/cc/BUILD.gn
@@ -53,6 +53,8 @@
     "layers/append_quads_data.cc",
     "layers/append_quads_data.h",
     "layers/content_layer_client.h",
+    "layers/deadline_policy.cc",
+    "layers/deadline_policy.h",
     "layers/draw_mode.h",
     "layers/draw_properties.cc",
     "layers/draw_properties.h",
diff --git a/cc/layers/deadline_policy.cc b/cc/layers/deadline_policy.cc
new file mode 100644
index 0000000..91ba191
--- /dev/null
+++ b/cc/layers/deadline_policy.cc
@@ -0,0 +1,36 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "cc/layers/deadline_policy.h"
+
+namespace cc {
+
+// static
+DeadlinePolicy DeadlinePolicy::UseExistingDeadline() {
+  return DeadlinePolicy(Type::kUseExistingDeadline);
+}
+
+// static
+DeadlinePolicy DeadlinePolicy::UseDefaultDeadline() {
+  return DeadlinePolicy(Type::kUseDefaultDeadline);
+}
+
+// static
+DeadlinePolicy DeadlinePolicy::UseSpecifiedDeadline(
+    uint32_t deadline_in_frames) {
+  return DeadlinePolicy(deadline_in_frames);
+}
+
+DeadlinePolicy::DeadlinePolicy(Type policy_type)
+    : policy_type_(policy_type), deadline_in_frames_(base::nullopt) {
+  DCHECK_NE(Type::kUseSpecifiedDeadline, policy_type_);
+}
+
+DeadlinePolicy::DeadlinePolicy(uint32_t deadline_in_frames)
+    : policy_type_(Type::kUseSpecifiedDeadline),
+      deadline_in_frames_(deadline_in_frames) {}
+
+DeadlinePolicy::DeadlinePolicy(const DeadlinePolicy& other) = default;
+
+}  // namespace cc
diff --git a/cc/layers/deadline_policy.h b/cc/layers/deadline_policy.h
new file mode 100644
index 0000000..a5dd8031
--- /dev/null
+++ b/cc/layers/deadline_policy.h
@@ -0,0 +1,68 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CC_LAYERS_DEADLINE_POLICY_H_
+#define CC_LAYERS_DEADLINE_POLICY_H_
+
+#include <cstdint>
+
+#include "base/macros.h"
+#include "base/optional.h"
+#include "cc/cc_export.h"
+
+namespace cc {
+
+class CC_EXPORT DeadlinePolicy {
+ public:
+  enum Type {
+    kUseExistingDeadline,
+    kUseDefaultDeadline,
+    kUseSpecifiedDeadline
+  };
+
+  static DeadlinePolicy UseExistingDeadline();
+
+  static DeadlinePolicy UseDefaultDeadline();
+
+  static DeadlinePolicy UseSpecifiedDeadline(uint32_t deadline_in_frames);
+
+  DeadlinePolicy(const DeadlinePolicy& other);
+
+  DeadlinePolicy& operator=(const DeadlinePolicy& other) = default;
+
+  ~DeadlinePolicy() = default;
+
+  bool use_existing_deadline() const {
+    return policy_type_ == DeadlinePolicy::kUseExistingDeadline;
+  }
+
+  base::Optional<uint32_t> deadline_in_frames() const {
+    DCHECK(policy_type_ == Type::kUseDefaultDeadline ||
+           policy_type_ == Type::kUseSpecifiedDeadline);
+    return deadline_in_frames_;
+  }
+
+  Type policy_type() const { return policy_type_; }
+
+  bool operator==(const DeadlinePolicy& other) const {
+    return other.policy_type_ == policy_type_ &&
+           other.deadline_in_frames_ == deadline_in_frames_;
+  }
+
+  bool operator!=(const DeadlinePolicy& other) const {
+    return !(*this == other);
+  }
+
+ private:
+  explicit DeadlinePolicy(Type policy_type);
+
+  explicit DeadlinePolicy(uint32_t deadline_in_frames);
+
+  Type policy_type_;
+  base::Optional<uint32_t> deadline_in_frames_;
+};
+
+}  // namespace cc
+
+#endif  // CC_LAYERS_DEADLINE_POLICY_H_
diff --git a/cc/layers/surface_layer.cc b/cc/layers/surface_layer.cc
index b60778f..2aae0de3 100644
--- a/cc/layers/surface_layer.cc
+++ b/cc/layers/surface_layer.cc
@@ -24,15 +24,15 @@
   DCHECK(!layer_tree_host());
 }
 
-void SurfaceLayer::SetPrimarySurfaceId(
-    const viz::SurfaceId& surface_id,
-    base::Optional<uint32_t> deadline_in_frames) {
+void SurfaceLayer::SetPrimarySurfaceId(const viz::SurfaceId& surface_id,
+                                       const DeadlinePolicy& deadline_policy) {
   if (primary_surface_id_ == surface_id &&
-      deadline_in_frames_ == deadline_in_frames) {
+      deadline_policy.use_existing_deadline()) {
     return;
   }
   primary_surface_id_ = surface_id;
-  deadline_in_frames_ = deadline_in_frames;
+  if (!deadline_policy.use_existing_deadline())
+    deadline_in_frames_ = deadline_policy.deadline_in_frames();
   UpdateDrawsContent(HasDrawableContent());
   SetNeedsCommit();
 }
diff --git a/cc/layers/surface_layer.h b/cc/layers/surface_layer.h
index a627a94..8a8a5ba 100644
--- a/cc/layers/surface_layer.h
+++ b/cc/layers/surface_layer.h
@@ -7,6 +7,7 @@
 
 #include "base/macros.h"
 #include "cc/cc_export.h"
+#include "cc/layers/deadline_policy.h"
 #include "cc/layers/layer.h"
 #include "components/viz/common/surfaces/surface_info.h"
 #include "third_party/skia/include/core/SkColor.h"
@@ -21,7 +22,7 @@
   static scoped_refptr<SurfaceLayer> Create();
 
   void SetPrimarySurfaceId(const viz::SurfaceId& surface_id,
-                           base::Optional<uint32_t> deadline_in_frames);
+                           const DeadlinePolicy& deadline_policy);
   void SetFallbackSurfaceId(const viz::SurfaceId& surface_id);
 
   // When stretch_content_to_fill_bounds is true, the scale of the embedded
@@ -41,6 +42,10 @@
     return fallback_surface_id_;
   }
 
+  base::Optional<uint32_t> deadline_in_frames() const {
+    return deadline_in_frames_;
+  }
+
  protected:
   SurfaceLayer();
   bool HasDrawableContent() const override;
diff --git a/cc/layers/surface_layer_unittest.cc b/cc/layers/surface_layer_unittest.cc
index d20d7f8..907c2bc0 100644
--- a/cc/layers/surface_layer_unittest.cc
+++ b/cc/layers/surface_layer_unittest.cc
@@ -82,8 +82,11 @@
   viz::SurfaceId primary_id(
       kArbitraryFrameSinkId,
       viz::LocalSurfaceId(1, base::UnguessableToken::Create()));
-  layer->SetPrimarySurfaceId(primary_id, 1u);
-  layer->SetPrimarySurfaceId(primary_id, 2u);
+  layer->SetPrimarySurfaceId(primary_id,
+                             DeadlinePolicy::UseSpecifiedDeadline(1u));
+  layer->SetPrimarySurfaceId(primary_id,
+                             DeadlinePolicy::UseSpecifiedDeadline(2u));
+  layer->SetPrimarySurfaceId(primary_id, DeadlinePolicy::UseExistingDeadline());
   layer->SetFallbackSurfaceId(primary_id);
   layer->SetBackgroundColor(SK_ColorBLUE);
   layer->SetStretchContentToFillBounds(true);
@@ -152,14 +155,16 @@
   // animation is done.
   scoped_refptr<SurfaceLayer> layer1 = SurfaceLayer::Create();
   layer1->SetLayerTreeHost(layer_tree_host_.get());
-  layer1->SetPrimarySurfaceId(old_surface_id, base::nullopt);
+  layer1->SetPrimarySurfaceId(old_surface_id,
+                              DeadlinePolicy::UseDefaultDeadline());
   layer1->SetFallbackSurfaceId(old_surface_id);
 
   // This layer will eventually be switched be switched to show the new surface
   // id and will be retained when animation is done.
   scoped_refptr<SurfaceLayer> layer2 = SurfaceLayer::Create();
   layer2->SetLayerTreeHost(layer_tree_host_.get());
-  layer2->SetPrimarySurfaceId(old_surface_id, base::nullopt);
+  layer2->SetPrimarySurfaceId(old_surface_id,
+                              DeadlinePolicy::UseDefaultDeadline());
   layer2->SetFallbackSurfaceId(old_surface_id);
 
   std::unique_ptr<SurfaceLayerImpl> layer_impl1 =
@@ -179,7 +184,8 @@
       viz::LocalSurfaceId(2, base::UnguessableToken::Create()));
 
   // Switch the new layer to use |new_surface_id|.
-  layer2->SetPrimarySurfaceId(new_surface_id, base::nullopt);
+  layer2->SetPrimarySurfaceId(new_surface_id,
+                              DeadlinePolicy::UseDefaultDeadline());
   layer2->SetFallbackSurfaceId(new_surface_id);
 
   SynchronizeTrees();
@@ -213,7 +219,7 @@
 
   scoped_refptr<SurfaceLayer> layer1 = SurfaceLayer::Create();
   layer1->SetLayerTreeHost(layer_tree_host_.get());
-  layer1->SetPrimarySurfaceId(surface_id, base::nullopt);
+  layer1->SetPrimarySurfaceId(surface_id, DeadlinePolicy::UseDefaultDeadline());
   layer1->SetFallbackSurfaceId(surface_id);
 
   // Verify the surface id is in SurfaceLayerIds() and needs_surface_ids_sync()
@@ -231,7 +237,7 @@
   // Create the second layer that is a clone of the first.
   scoped_refptr<SurfaceLayer> layer2 = SurfaceLayer::Create();
   layer2->SetLayerTreeHost(layer_tree_host_.get());
-  layer2->SetPrimarySurfaceId(surface_id, base::nullopt);
+  layer2->SetPrimarySurfaceId(surface_id, DeadlinePolicy::UseDefaultDeadline());
   layer2->SetFallbackSurfaceId(surface_id);
 
   // Verify that after creating the second layer with the same surface id that
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
index b0212dd..d83d4fc 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
@@ -137,10 +137,11 @@
 import org.chromium.components.feature_engagement.FeatureConstants;
 import org.chromium.components.feature_engagement.Tracker;
 import org.chromium.content.browser.ContentVideoView;
-import org.chromium.content.browser.ContentViewCore;
 import org.chromium.content.browser.crypto.CipherFactory;
 import org.chromium.content.common.ContentSwitches;
 import org.chromium.content_public.browser.LoadUrlParams;
+import org.chromium.content_public.browser.WebContents;
+import org.chromium.content_public.browser.WebContentsAccessibility;
 import org.chromium.content_public.common.Referrer;
 import org.chromium.ui.base.DeviceFormFactor;
 import org.chromium.ui.base.PageTransition;
@@ -2114,13 +2115,10 @@
             mLayoutManager.showOverview(false);
             return;
         }
-        ContentViewCore contentViewCore = currentTab.getContentViewCore();
 
         if (!mLayoutManager.overviewVisible()) {
             getCompositorViewHolder().hideKeyboard(() -> mLayoutManager.showOverview(true));
-            if (contentViewCore != null) {
-                contentViewCore.setAccessibilityState(false);
-            }
+            updateAccessibilityState(false);
         } else {
             Layout activeLayout = mLayoutManager.getActiveLayout();
             if (activeLayout instanceof StackLayout) {
@@ -2129,18 +2127,19 @@
             if (getCurrentTabModel().getCount() != 0) {
                 // Don't hide overview if current tab stack is empty()
                 mLayoutManager.hideOverview(true);
-
-                // hideOverview could change the current tab.  Update the local variables.
-                currentTab = getActivityTab();
-                contentViewCore = currentTab != null ? currentTab.getContentViewCore() : null;
-
-                if (contentViewCore != null) {
-                    contentViewCore.setAccessibilityState(true);
-                }
+                updateAccessibilityState(true);
             }
         }
     }
 
+    private void updateAccessibilityState(boolean enabled) {
+        Tab currentTab = getActivityTab();
+        WebContents webContents = currentTab != null ? currentTab.getWebContents() : null;
+        if (webContents != null) {
+            WebContentsAccessibility.fromWebContents(webContents).setState(enabled);
+        }
+    }
+
     @Override
     public void onSaveInstanceState(Bundle outState) {
         super.onSaveInstanceState(outState);
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill/AutofillPopupBridge.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill/AutofillPopupBridge.java
index 92fe2be..7067f6f 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill/AutofillPopupBridge.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill/AutofillPopupBridge.java
@@ -19,7 +19,7 @@
 import org.chromium.components.autofill.AutofillDelegate;
 import org.chromium.components.autofill.AutofillPopup;
 import org.chromium.components.autofill.AutofillSuggestion;
-import org.chromium.content.browser.accessibility.WebContentsAccessibility;
+import org.chromium.content_public.browser.WebContentsAccessibility;
 import org.chromium.ui.DropdownItem;
 import org.chromium.ui.base.WindowAndroid;
 
@@ -47,17 +47,15 @@
         } else {
             mAutofillPopup = new AutofillPopup(activity, anchorView, this);
             mContext = activity;
-            mWebContentsAccessibility = ((ChromeActivity) activity)
-                                                .getCurrentContentViewCore()
-                                                .getWebContentsAccessibility();
+            mWebContentsAccessibility = WebContentsAccessibility.fromWebContents(
+                    ((ChromeActivity) activity).getCurrentContentViewCore().getWebContents());
         }
     }
 
     @CalledByNative
     private static AutofillPopupBridge create(View anchorView, long nativeAutofillPopupViewAndroid,
             WindowAndroid windowAndroid) {
-        return new AutofillPopupBridge(anchorView, nativeAutofillPopupViewAndroid,
-                windowAndroid);
+        return new AutofillPopupBridge(anchorView, nativeAutofillPopupViewAndroid, windowAndroid);
     }
 
     @Override
@@ -77,9 +75,7 @@
 
     @Override
     public void accessibilityFocusCleared() {
-        if (mWebContentsAccessibility != null) {
-            mWebContentsAccessibility.onAutofillPopupAccessibilityFocusCleared();
-        }
+        mWebContentsAccessibility.onAutofillPopupAccessibilityFocusCleared();
     }
 
     @Override
@@ -95,9 +91,7 @@
     private void dismiss() {
         if (mAutofillPopup != null) mAutofillPopup.dismiss();
         if (mDeletionDialog != null) mDeletionDialog.dismiss();
-        if (mWebContentsAccessibility != null) {
-            mWebContentsAccessibility.onAutofillPopupDismissed();
-        }
+        mWebContentsAccessibility.onAutofillPopupDismissed();
     }
 
     /**
@@ -119,9 +113,7 @@
         if (mAutofillPopup != null) {
             mAutofillPopup.filterAndShow(
                     suggestions, isRtl, backgroundColor, dividerColor, dropdownItemHeight, margin);
-            if (mWebContentsAccessibility != null) {
-                mWebContentsAccessibility.onAutofillPopupDisplayed(mAutofillPopup.getListView());
-            }
+            mWebContentsAccessibility.onAutofillPopupDisplayed(mAutofillPopup.getListView());
         }
     }
 
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/preferences/password/ReauthenticationManager.java b/chrome/android/java/src/org/chromium/chrome/browser/preferences/password/ReauthenticationManager.java
index bcdad13..a78fafb7 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/preferences/password/ReauthenticationManager.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/preferences/password/ReauthenticationManager.java
@@ -26,7 +26,12 @@
  */
 public final class ReauthenticationManager {
     // Used for various ways to override checks provided by this class.
-    public enum OverrideState { NOT_OVERRIDDEN, AVAILABLE, UNAVAILABLE }
+    @Retention(RetentionPolicy.SOURCE)
+    @IntDef({OVERRIDE_STATE_NOT_OVERRIDDEN, OVERRIDE_STATE_AVAILABLE, OVERRIDE_STATE_UNAVAILABLE})
+    public @interface OverrideState {}
+    public static final int OVERRIDE_STATE_NOT_OVERRIDDEN = 0;
+    public static final int OVERRIDE_STATE_AVAILABLE = 1;
+    public static final int OVERRIDE_STATE_UNAVAILABLE = 2;
 
     // Used to specify the scope of the reauthentication -- either to grant bulk access like, e.g.,
     // exporting passwords, or just one-at-a-time, like, e.g., viewing a single password.
@@ -54,11 +59,13 @@
 
     // Used in tests to override the result of checking for screen lock set-up. This allows the
     // tests to be independent of a particular device configuration.
-    private static OverrideState sScreenLockSetUpOverride = OverrideState.NOT_OVERRIDDEN;
+    @OverrideState
+    private static int sScreenLockSetUpOverride = OVERRIDE_STATE_NOT_OVERRIDDEN;
 
     // Used in tests to override the result of checking for availability of the screen-locking API.
     // This allows the tests to be independent of a particular device configuration.
-    private static OverrideState sApiOverride = OverrideState.NOT_OVERRIDDEN;
+    @OverrideState
+    private static int sApiOverride = OVERRIDE_STATE_NOT_OVERRIDDEN;
 
     // Used in tests to avoid displaying the OS reauth dialog.
     private static boolean sSkipSystemReauth = false;
@@ -83,14 +90,14 @@
     }
 
     @VisibleForTesting
-    public static void setScreenLockSetUpOverride(OverrideState screenLockSetUpOverride) {
+    public static void setScreenLockSetUpOverride(@OverrideState int screenLockSetUpOverride) {
         sScreenLockSetUpOverride = screenLockSetUpOverride;
     }
 
     @VisibleForTesting
-    public static void setApiOverride(OverrideState apiOverride) {
+    public static void setApiOverride(@OverrideState int apiOverride) {
         // Ensure that tests don't accidentally try to launch the OS-provided lock screen.
-        if (apiOverride == OverrideState.AVAILABLE) {
+        if (apiOverride == OVERRIDE_STATE_AVAILABLE) {
             PasswordReauthenticationFragment.preventLockingForTesting();
         }
 
@@ -108,11 +115,11 @@
      */
     public static boolean isReauthenticationApiAvailable() {
         switch (sApiOverride) {
-            case NOT_OVERRIDDEN:
+            case OVERRIDE_STATE_NOT_OVERRIDDEN:
                 return Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP;
-            case AVAILABLE:
+            case OVERRIDE_STATE_AVAILABLE:
                 return true;
-            case UNAVAILABLE:
+            case OVERRIDE_STATE_UNAVAILABLE:
                 return false;
         }
         // This branch is not reachable.
@@ -169,12 +176,12 @@
      */
     public static boolean isScreenLockSetUp(Context context) {
         switch (sScreenLockSetUpOverride) {
-            case NOT_OVERRIDDEN:
+            case OVERRIDE_STATE_NOT_OVERRIDDEN:
                 return ((KeyguardManager) context.getSystemService(Context.KEYGUARD_SERVICE))
                         .isKeyguardSecure();
-            case AVAILABLE:
+            case OVERRIDE_STATE_AVAILABLE:
                 return true;
-            case UNAVAILABLE:
+            case OVERRIDE_STATE_UNAVAILABLE:
                 return false;
         }
         // This branch is not reachable.
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/Tab.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/Tab.java
index cfaf029..fafe2aea 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tab/Tab.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/Tab.java
@@ -116,6 +116,7 @@
 import org.chromium.content_public.browser.LoadUrlParams;
 import org.chromium.content_public.browser.SelectionPopupController;
 import org.chromium.content_public.browser.WebContents;
+import org.chromium.content_public.browser.WebContentsAccessibility;
 import org.chromium.content_public.common.BrowserControlsState;
 import org.chromium.content_public.common.Referrer;
 import org.chromium.content_public.common.ResourceRequestBody;
@@ -1823,9 +1824,10 @@
             mNativePage = null;
             destroyNativePageInternal(previousNativePage);
 
-            if (mContentViewCore != null) {
-                mContentViewCore.setObscuredByAnotherView(false);
-                mContentViewCore.getWebContents().setImportance(ChildProcessImportance.NORMAL);
+            WebContents oldWebContents = getWebContents();
+            if (oldWebContents != null) {
+                oldWebContents.setImportance(ChildProcessImportance.NORMAL);
+                getWebContentsAccessibility(oldWebContents).setObscuredByAnotherView(false);
             }
 
             mContentViewCore = cvc;
@@ -1871,7 +1873,7 @@
             // For browser tabs, we want to set accessibility focus to the page
             // when it loads. This is not the default behavior for embedded
             // web views.
-            mContentViewCore.setShouldSetAccessibilityFocusOnPageLoad(true);
+            getWebContentsAccessibility(getWebContents()).setShouldFocusOnPageLoad(true);
 
             ImeAdapter.fromWebContents(mContentViewCore.getWebContents())
                     .addEventObserver(new ImeEventObserver() {
@@ -1912,6 +1914,10 @@
         GestureListenerManager.fromWebContents(webContents).addListener(mGestureStateListener);
     }
 
+    private static WebContentsAccessibility getWebContentsAccessibility(WebContents webContents) {
+        return webContents != null ? WebContentsAccessibility.fromWebContents(webContents) : null;
+    }
+
     /**
      * Shows a native page for url if it's a valid chrome-native URL. Otherwise, does nothing.
      * @param url The url of the current navigation.
@@ -3168,11 +3174,11 @@
             }
         }
 
-        ContentViewCore cvc = getContentViewCore();
-        if (cvc != null) {
+        WebContentsAccessibility wcax = getWebContentsAccessibility(getWebContents());
+        if (wcax != null) {
             boolean isWebContentObscured = isObscuredByAnotherViewForAccessibility()
                     || isShowingSadTab();
-            cvc.setObscuredByAnotherView(isWebContentObscured);
+            wcax.setObscuredByAnotherView(isWebContentObscured);
         }
     }
 
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/preferences/password/SavePasswordsPreferencesTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/preferences/password/SavePasswordsPreferencesTest.java
index 7cc1090d..149086e 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/preferences/password/SavePasswordsPreferencesTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/preferences/password/SavePasswordsPreferencesTest.java
@@ -384,7 +384,7 @@
         // Ensure there are no saved passwords reported to settings.
         setPasswordSource(null);
 
-        ReauthenticationManager.setApiOverride(ReauthenticationManager.OverrideState.AVAILABLE);
+        ReauthenticationManager.setApiOverride(ReauthenticationManager.OVERRIDE_STATE_AVAILABLE);
 
         final Preferences preferences =
                 PreferencesTest.startPreferences(InstrumentationRegistry.getInstrumentation(),
@@ -409,7 +409,7 @@
     public void testExportMenuEnabled() throws Exception {
         setPasswordSource(new SavedPasswordEntry("https://example.com", "test user", "password"));
 
-        ReauthenticationManager.setApiOverride(ReauthenticationManager.OverrideState.AVAILABLE);
+        ReauthenticationManager.setApiOverride(ReauthenticationManager.OVERRIDE_STATE_AVAILABLE);
 
         final Preferences preferences =
                 PreferencesTest.startPreferences(InstrumentationRegistry.getInstrumentation(),
@@ -434,7 +434,7 @@
     @SmallTest
     @Feature({"Preferences"})
     public void testExportMenuMissing() throws Exception {
-        ReauthenticationManager.setApiOverride(ReauthenticationManager.OverrideState.AVAILABLE);
+        ReauthenticationManager.setApiOverride(ReauthenticationManager.OVERRIDE_STATE_AVAILABLE);
 
         final Preferences preferences =
                 PreferencesTest.startPreferences(InstrumentationRegistry.getInstrumentation(),
@@ -459,9 +459,9 @@
     public void testExportTriggersSerialization() throws Exception {
         setPasswordSource(new SavedPasswordEntry("https://example.com", "test user", "password"));
 
-        ReauthenticationManager.setApiOverride(ReauthenticationManager.OverrideState.AVAILABLE);
+        ReauthenticationManager.setApiOverride(ReauthenticationManager.OVERRIDE_STATE_AVAILABLE);
         ReauthenticationManager.setScreenLockSetUpOverride(
-                ReauthenticationManager.OverrideState.AVAILABLE);
+                ReauthenticationManager.OVERRIDE_STATE_AVAILABLE);
 
         final Preferences preferences =
                 PreferencesTest.startPreferences(InstrumentationRegistry.getInstrumentation(),
@@ -490,9 +490,9 @@
     public void testExportMenuItem() throws Exception {
         setPasswordSource(new SavedPasswordEntry("https://example.com", "test user", "password"));
 
-        ReauthenticationManager.setApiOverride(ReauthenticationManager.OverrideState.AVAILABLE);
+        ReauthenticationManager.setApiOverride(ReauthenticationManager.OVERRIDE_STATE_AVAILABLE);
         ReauthenticationManager.setScreenLockSetUpOverride(
-                ReauthenticationManager.OverrideState.AVAILABLE);
+                ReauthenticationManager.OVERRIDE_STATE_AVAILABLE);
 
         final Preferences preferences =
                 PreferencesTest.startPreferences(InstrumentationRegistry.getInstrumentation(),
@@ -521,9 +521,9 @@
     public void testExportMenuItemNoLock() throws Exception {
         setPasswordSource(new SavedPasswordEntry("https://example.com", "test user", "password"));
 
-        ReauthenticationManager.setApiOverride(ReauthenticationManager.OverrideState.AVAILABLE);
+        ReauthenticationManager.setApiOverride(ReauthenticationManager.OVERRIDE_STATE_AVAILABLE);
         ReauthenticationManager.setScreenLockSetUpOverride(
-                ReauthenticationManager.OverrideState.UNAVAILABLE);
+                ReauthenticationManager.OVERRIDE_STATE_UNAVAILABLE);
 
         final Preferences preferences =
                 PreferencesTest.startPreferences(InstrumentationRegistry.getInstrumentation(),
@@ -550,9 +550,9 @@
     public void testExportMenuItemReenabledNoLock() throws Exception {
         setPasswordSource(new SavedPasswordEntry("https://example.com", "test user", "password"));
 
-        ReauthenticationManager.setApiOverride(ReauthenticationManager.OverrideState.AVAILABLE);
+        ReauthenticationManager.setApiOverride(ReauthenticationManager.OVERRIDE_STATE_AVAILABLE);
         ReauthenticationManager.setScreenLockSetUpOverride(
-                ReauthenticationManager.OverrideState.UNAVAILABLE);
+                ReauthenticationManager.OVERRIDE_STATE_UNAVAILABLE);
 
         final Preferences preferences =
                 PreferencesTest.startPreferences(InstrumentationRegistry.getInstrumentation(),
@@ -582,7 +582,7 @@
     public void testExportMenuItemReenabledReauthFailure() throws Exception {
         setPasswordSource(new SavedPasswordEntry("https://example.com", "test user", "password"));
 
-        ReauthenticationManager.setApiOverride(ReauthenticationManager.OverrideState.AVAILABLE);
+        ReauthenticationManager.setApiOverride(ReauthenticationManager.OVERRIDE_STATE_AVAILABLE);
         ReauthenticationManager.setSkipSystemReauth(true);
 
         final Preferences preferences =
@@ -621,9 +621,9 @@
     public void testExportIntent() throws Exception {
         setPasswordSource(new SavedPasswordEntry("https://example.com", "test user", "password"));
 
-        ReauthenticationManager.setApiOverride(ReauthenticationManager.OverrideState.AVAILABLE);
+        ReauthenticationManager.setApiOverride(ReauthenticationManager.OVERRIDE_STATE_AVAILABLE);
         ReauthenticationManager.setScreenLockSetUpOverride(
-                ReauthenticationManager.OverrideState.AVAILABLE);
+                ReauthenticationManager.OVERRIDE_STATE_AVAILABLE);
 
         final Preferences preferences =
                 PreferencesTest.startPreferences(InstrumentationRegistry.getInstrumentation(),
@@ -665,9 +665,9 @@
     public void testViewPasswordNoLock() throws Exception {
         setPasswordSource(new SavedPasswordEntry("https://example.com", "test user", "password"));
 
-        ReauthenticationManager.setApiOverride(ReauthenticationManager.OverrideState.AVAILABLE);
+        ReauthenticationManager.setApiOverride(ReauthenticationManager.OVERRIDE_STATE_AVAILABLE);
         ReauthenticationManager.setScreenLockSetUpOverride(
-                ReauthenticationManager.OverrideState.UNAVAILABLE);
+                ReauthenticationManager.OVERRIDE_STATE_UNAVAILABLE);
 
         final Preferences preferences =
                 PreferencesTest.startPreferences(InstrumentationRegistry.getInstrumentation(),
@@ -692,9 +692,9 @@
         setPasswordSource(
                 new SavedPasswordEntry("https://example.com", "test user", "test password"));
 
-        ReauthenticationManager.setApiOverride(ReauthenticationManager.OverrideState.AVAILABLE);
+        ReauthenticationManager.setApiOverride(ReauthenticationManager.OVERRIDE_STATE_AVAILABLE);
         ReauthenticationManager.setScreenLockSetUpOverride(
-                ReauthenticationManager.OverrideState.AVAILABLE);
+                ReauthenticationManager.OVERRIDE_STATE_AVAILABLE);
 
         final Preferences preferences =
                 PreferencesTest.startPreferences(InstrumentationRegistry.getInstrumentation(),
@@ -973,9 +973,9 @@
     public void testSearchResultsPersistAfterEntryInspection() throws Exception {
         setPasswordSourceWithMultipleEntries(GREEK_GODS);
         setPasswordExceptions(new String[] {"http://exclu.de", "http://not-inclu.de"});
-        ReauthenticationManager.setApiOverride(ReauthenticationManager.OverrideState.AVAILABLE);
+        ReauthenticationManager.setApiOverride(ReauthenticationManager.OVERRIDE_STATE_AVAILABLE);
         ReauthenticationManager.setScreenLockSetUpOverride(
-                ReauthenticationManager.OverrideState.AVAILABLE);
+                ReauthenticationManager.OVERRIDE_STATE_AVAILABLE);
         PreferencesTest.startPreferences(InstrumentationRegistry.getInstrumentation(),
                 SavePasswordsPreferences.class.getName());
 
diff --git a/chrome/app/settings_strings.grdp b/chrome/app/settings_strings.grdp
index abbbdf5..49e775c3 100644
--- a/chrome/app/settings_strings.grdp
+++ b/chrome/app/settings_strings.grdp
@@ -620,6 +620,25 @@
   <message name="IDS_SETTINGS_PASSWORDS_EXPORT" desc="A button in the dialog for exporting passwords from Chrome. A password list will be written to a destination, which the user will be asked to choose after initiating this action.">
     Export passwords...
   </message>
+  <message name="IDS_SETTINGS_PASSWORDS_EXPORT_TRY_AGAIN" desc="A button in the dialog for exporting passwords from Chrome. The action is to attempt to export the passwords again. A password list will be written to a destination, which the user will be asked to choose after initiating this action.">
+    Try again...
+  </message>
+  <message name="IDS_SETTINGS_PASSWORDS_EXPORTING_TITLE" desc="The title of a dialog for exporting passwords. This title is shown while Chrome is performing the export and the user should wait.">
+    Exporting passwords...
+  </message>
+  <message name="IDS_SETTINGS_PASSWORDS_EXPORTING_FAILURE_TITLE" desc="The title to a dialog, which is shown if exporting passwords to a folder has failed.">
+    Can't export passwords to "<ph name="FOLDER">$1<ex>Documents</ex></ph>"
+  </message>
+  <message name="IDS_SETTINGS_PASSWORDS_EXPORTING_FAILURE_TIPS" desc="Message that is shown when exporting passwords has failed. Below it is a list of things the user can try to resolve the problem.">
+    Try the following tips
+  </message>
+  <message name="IDS_SETTINGS_PASSWORDS_EXPORTING_FAILURE_TIP_ENOUGH_SPACE" desc="Message that is shown when exporting passwords has failed. This is part of a list of things the user can try to resolve the problem. This advice implies that there isn't enough space on the disk for the new file to be written.">
+    Make sure there is enough space on your device
+  </message>
+  <message name="IDS_SETTINGS_PASSWORDS_EXPORTING_FAILURE_TIP_ANOTHER_FOLDER" desc="Message that is shown when exporting passwords has failed. This is part of a list of things the user can try to resolve the problem. This advice implies that Chrome couldn't write into the specified folder.">
+    Export your passwords to another folder
+  </message>
+
 
   <!-- Default Browser Page -->
   <if expr="not chromeos">
diff --git a/chrome/app/theme/chrome_unscaled_resources.grd b/chrome/app/theme/chrome_unscaled_resources.grd
index a85f252..383d4821 100644
--- a/chrome/app/theme/chrome_unscaled_resources.grd
+++ b/chrome/app/theme/chrome_unscaled_resources.grd
@@ -22,6 +22,10 @@
           <include name="IDR_PRODUCT_LOGO_128_BETA" file="google_chrome/product_logo_128_beta.png" type="BINDATA" />
           <include name="IDR_PRODUCT_LOGO_128_DEV" file="google_chrome/product_logo_128_dev.png" type="BINDATA" />
         </if>
+        <if expr="chromeos">
+          <include name="IDR_PRODUCT_LOGO_24PX_1X" file="google_chrome/chrome_24px_1x.svg" type="BINDATA" />
+          <include name="IDR_PRODUCT_LOGO_24PX_2X" file="google_chrome/chrome_24px_2x.svg" type="BINDATA" />
+        </if>
         <if expr="is_win">
           <!-- External company logo, displayed in the Chrome Cleanup WebUI if
                cleanup functionality is powered by an external company. -->
diff --git a/chrome/app/vector_icons/BUILD.gn b/chrome/app/vector_icons/BUILD.gn
index 4b367df..7188a4d8 100644
--- a/chrome/app/vector_icons/BUILD.gn
+++ b/chrome/app/vector_icons/BUILD.gn
@@ -105,6 +105,7 @@
     "trash_can.icon",
     "usb_security_key.icon",
     "user_account_avatar.icon",
+    "user_menu_guest.icon",
     "volume_up.icon",
     "warning_badge.icon",
     "web.icon",
diff --git a/chrome/app/vector_icons/user_menu_guest.icon b/chrome/app/vector_icons/user_menu_guest.icon
new file mode 100644
index 0000000..e0ece26
--- /dev/null
+++ b/chrome/app/vector_icons/user_menu_guest.icon
@@ -0,0 +1,38 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+CANVAS_DIMENSIONS, 16,
+MOVE_TO, 6, 2,
+ARC_TO, 2.01f, 2.01f, 0, 0, 1, 8, 0,
+R_CUBIC_TO, 1.1f, 0, 2, 0.9f, 2, 2,
+R_H_LINE_TO, 2.6f,
+R_CUBIC_TO, 0.77f, 0, 1.4f, 0.63f, 1.4f, 1.4f,
+V_LINE_TO, 13.6f,
+R_CUBIC_TO, 0, 0.77f, -0.63f, 1.4f, -1.4f, 1.4f,
+H_LINE_TO, 3.4f,
+R_CUBIC_TO, -0.77f, 0, -1.4f, -0.63f, -1.4f, -1.4f,
+V_LINE_TO, 3.4f,
+R_CUBIC_TO, 0, -0.77f, 0.63f, -1.4f, 1.4f, -1.4f,
+H_LINE_TO, 6,
+CLOSE,
+MOVE_TO, 8, 1,
+R_CUBIC_TO, -0.55f, 0, -1, 0.45f, -1, 1,
+R_CUBIC_TO, 0, 0.55f, 0.45f, 1, 1, 1,
+R_CUBIC_TO, 0.55f, 0, 1, -0.45f, 1, -1,
+R_CUBIC_TO, 0, -0.55f, -0.45f, -1, -1, -1,
+CLOSE,
+R_MOVE_TO, 0, 4,
+R_CUBIC_TO, -1.11f, 0, -2, 0.89f, -2, 2,
+R_CUBIC_TO, 0, 1.11f, 0.89f, 2, 2, 2,
+R_CUBIC_TO, 1.11f, 0, 2, -0.89f, 2, -2,
+R_CUBIC_TO, 0, -1.11f, -0.89f, -2, -2, -2,
+CLOSE,
+R_MOVE_TO, 4, 8,
+R_V_LINE_TO, -0.93f,
+CUBIC_TO, 12, 10.73f, 9.33f, 10, 8, 10,
+R_CUBIC_TO, -1.33f, 0, -4, 0.73f, -4, 2.07f,
+V_LINE_TO, 13,
+R_H_LINE_TO, 8,
+CLOSE,
+END
diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
index 3fb8761..ee6a9f6d 100644
--- a/chrome/browser/BUILD.gn
+++ b/chrome/browser/BUILD.gn
@@ -1748,7 +1748,6 @@
     "//content/public/common:feature_h264_with_openh264_ffmpeg",
     "//content/public/common:features",
     "//content/public/common:service_names",
-    "//content/public/network",
     "//courgette:courgette_lib",
     "//crypto",
     "//crypto:platform",
@@ -1783,6 +1782,8 @@
     "//services/identity:lib",
     "//services/identity/public/cpp",
     "//services/metrics/public/cpp:ukm_builders",
+    "//services/network:network_service",
+    "//services/network/public/cpp",
     "//services/network/public/interfaces",
     "//services/preferences/public/cpp",
     "//services/preferences/public/cpp:service_main",
@@ -2627,6 +2628,9 @@
       "resource_coordinator/tab_manager_stats_collector.h",
       "resource_coordinator/tab_manager_web_contents_data.cc",
       "resource_coordinator/tab_manager_web_contents_data.h",
+      "resource_coordinator/tab_metrics_logger.h",
+      "resource_coordinator/tab_metrics_logger_impl.cc",
+      "resource_coordinator/tab_metrics_logger_impl.h",
       "resource_coordinator/tab_stats.cc",
       "resource_coordinator/tab_stats.h",
       "resource_coordinator/time.cc",
@@ -2773,6 +2777,7 @@
       "//chrome/app/vector_icons",
       "//chrome/browser/policy:path_parser",
       "//chrome/browser/profile_resetter:profile_reset_report_proto",
+      "//chrome/browser/resource_coordinator:tab_metrics_event_proto",
       "//chrome/browser/resources:component_extension_resources",
       "//chrome/browser/search:generated",
       "//chrome/common/importer:interfaces",
diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
index fcecf97..70191d6 100644
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc
@@ -107,6 +107,7 @@
 #include "ppapi/features/features.h"
 #include "printing/features/features.h"
 #include "services/device/public/cpp/device_features.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/network_switches.h"
 #include "services/service_manager/sandbox/switches.h"
 #include "third_party/libaom/av1_features.h"
@@ -3084,7 +3085,7 @@
     {"enable-renderer-side-resource-scheduler",
      flag_descriptions::kRendererSideResourceSchedulerName,
      flag_descriptions::kRendererSideResourceSchedulerDescription, kOsAll,
-     FEATURE_VALUE_TYPE(features::kRendererSideResourceScheduler)},
+     FEATURE_VALUE_TYPE(network::features::kRendererSideResourceScheduler)},
 
 #if defined(OS_CHROMEOS)
     {"force-tablet-mode", flag_descriptions::kUiModeName,
@@ -3332,7 +3333,7 @@
 
     {"network-service", flag_descriptions::kEnableNetworkServiceName,
      flag_descriptions::kEnableNetworkServiceDescription, kOsAll,
-     FEATURE_VALUE_TYPE(features::kNetworkService)},
+     FEATURE_VALUE_TYPE(network::features::kNetworkService)},
 
     {"network-service-in-process",
      flag_descriptions::kEnableNetworkServiceInProcessName,
@@ -3341,7 +3342,7 @@
 
     {"out-of-blink-cors", flag_descriptions::kEnableOutOfBlinkCORSName,
      flag_descriptions::kEnableOutOfBlinkCORSDescription, kOsAll,
-     FEATURE_VALUE_TYPE(features::kOutOfBlinkCORS)},
+     FEATURE_VALUE_TYPE(network::features::kOutOfBlinkCORS)},
 
     {"keep-alive-renderer-for-keepalive-requests",
      flag_descriptions::kKeepAliveRendererForKeepaliveRequestsName,
diff --git a/chrome/browser/android/history_report/delta_file_backend_leveldb.cc b/chrome/browser/android/history_report/delta_file_backend_leveldb.cc
index 9c15a31..c21e6ec 100644
--- a/chrome/browser/android/history_report/delta_file_backend_leveldb.cc
+++ b/chrome/browser/android/history_report/delta_file_backend_leveldb.cc
@@ -10,6 +10,7 @@
 #include "base/logging.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/stringprintf.h"
+#include "base/trace_event/process_memory_dump.h"
 #include "chrome/browser/android/history_report/delta_file_commons.h"
 #include "third_party/leveldatabase/env_chromium.h"
 #include "third_party/leveldatabase/src/include/leveldb/comparator.h"
@@ -236,4 +237,27 @@
   return dump;
 }
 
+bool DeltaFileBackend::OnMemoryDump(
+    const base::trace_event::MemoryDumpArgs& args,
+    base::trace_event::ProcessMemoryDump* pmd) {
+  if (!db_)
+    return true;
+
+  // leveldb_env::DBTracker already records memory usage. Add ownership edge
+  // to the dump.
+  auto* tracker_dump =
+      leveldb_env::DBTracker::GetOrCreateAllocatorDump(pmd, db_.get());
+  if (!tracker_dump)
+    return true;
+
+  auto* dump = pmd->CreateAllocatorDump(
+      base::StringPrintf("history/delta_file_service/leveldb_0x%" PRIXPTR,
+                         reinterpret_cast<uintptr_t>(db_.get())));
+  dump->AddScalar(base::trace_event::MemoryAllocatorDump::kNameSize,
+                  base::trace_event::MemoryAllocatorDump::kUnitsBytes,
+                  tracker_dump->GetSizeInternal());
+  pmd->AddOwnershipEdge(dump->guid(), tracker_dump->guid());
+  return true;
+}
+
 }  // namespace history_report
diff --git a/chrome/browser/android/history_report/delta_file_backend_leveldb.h b/chrome/browser/android/history_report/delta_file_backend_leveldb.h
index bb0def0..924db72 100644
--- a/chrome/browser/android/history_report/delta_file_backend_leveldb.h
+++ b/chrome/browser/android/history_report/delta_file_backend_leveldb.h
@@ -12,6 +12,7 @@
 
 #include "base/files/file_path.h"
 #include "base/macros.h"
+#include "base/trace_event/memory_dump_provider.h"
 
 class GURL;
 
@@ -24,10 +25,10 @@
 class DeltaFileEntryWithData;
 
 // Backend for delta file.
-class DeltaFileBackend {
+class DeltaFileBackend : public base::trace_event::MemoryDumpProvider {
  public:
   explicit DeltaFileBackend(const base::FilePath& dir);
-  ~DeltaFileBackend();
+  ~DeltaFileBackend() override;
 
   // Adds new addition entry to delta file
   void PageAdded(const GURL& url);
@@ -50,6 +51,10 @@
   // Dumps internal state to string. For debuging.
   std::string Dump();
 
+  // base::trace_event::MemoryDumpProvider implementation:
+  bool OnMemoryDump(const base::trace_event::MemoryDumpArgs& args,
+                    base::trace_event::ProcessMemoryDump* pmd) override;
+
  private:
   // Starts delta file backend.
   bool Init();
diff --git a/chrome/browser/android/history_report/delta_file_service.cc b/chrome/browser/android/history_report/delta_file_service.cc
index 1699d17..1c798cc 100644
--- a/chrome/browser/android/history_report/delta_file_service.cc
+++ b/chrome/browser/android/history_report/delta_file_service.cc
@@ -9,6 +9,7 @@
 #include "base/synchronization/waitable_event.h"
 #include "base/task_scheduler/post_task.h"
 #include "base/task_scheduler/task_traits.h"
+#include "base/trace_event/memory_dump_manager.h"
 #include "chrome/browser/android/history_report/delta_file_backend_leveldb.h"
 #include "chrome/browser/android/history_report/delta_file_commons.h"
 #include "content/public/browser/browser_thread.h"
@@ -61,6 +62,12 @@
   finished->Signal();
 }
 
+void DoUnregisterMDP(
+    std::unique_ptr<history_report::DeltaFileBackend> backend) {
+  base::trace_event::MemoryDumpManager::GetInstance()->UnregisterDumpProvider(
+      backend.get());
+}
+
 }  // namespace
 
 namespace history_report {
@@ -70,9 +77,19 @@
 DeltaFileService::DeltaFileService(const base::FilePath& dir)
     : task_runner_(base::CreateSequencedTaskRunnerWithTraits(
           {base::MayBlock(), base::TaskShutdownBehavior::BLOCK_SHUTDOWN})),
-      delta_file_backend_(new DeltaFileBackend(dir)) {}
+      delta_file_backend_(new DeltaFileBackend(dir)) {
+  base::trace_event::MemoryDumpManager::GetInstance()
+      ->RegisterDumpProviderWithSequencedTaskRunner(
+          delta_file_backend_.get(), "HistoryReport", task_runner_,
+          base::trace_event::MemoryDumpProvider::Options());
+}
 
-DeltaFileService::~DeltaFileService() {}
+DeltaFileService::~DeltaFileService() {
+  // Unregister should happen on task runner.
+  task_runner_->PostTask(
+      FROM_HERE, base::BindOnce(&DoUnregisterMDP,
+                                base::Passed(std::move(delta_file_backend_))));
+}
 
 void DeltaFileService::PageAdded(const GURL& url) {
   task_runner_->PostTask(
diff --git a/chrome/browser/android/history_report/usage_reports_buffer_backend.cc b/chrome/browser/android/history_report/usage_reports_buffer_backend.cc
index f7f6ea7..adb7dc3 100644
--- a/chrome/browser/android/history_report/usage_reports_buffer_backend.cc
+++ b/chrome/browser/android/history_report/usage_reports_buffer_backend.cc
@@ -10,6 +10,8 @@
 #include "base/logging.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/string_number_conversions.h"
+#include "base/strings/stringprintf.h"
+#include "base/trace_event/process_memory_dump.h"
 #include "chrome/browser/android/history_report/usage_report_util.h"
 #include "chrome/browser/android/proto/delta_file.pb.h"
 #include "third_party/leveldatabase/env_chromium.h"
@@ -141,5 +143,28 @@
   return dump;
 }
 
+bool UsageReportsBufferBackend::OnMemoryDump(
+    const base::trace_event::MemoryDumpArgs& args,
+    base::trace_event::ProcessMemoryDump* pmd) {
+  if (!db_)
+    return true;
+
+  // leveldb_env::DBTracker already records memory usage. Add ownership edge
+  // to the dump.
+  auto* tracker_dump =
+      leveldb_env::DBTracker::GetOrCreateAllocatorDump(pmd, db_.get());
+  if (!tracker_dump)
+    return true;
+
+  auto* dump = pmd->CreateAllocatorDump(
+      base::StringPrintf("history/usage_reports_buffer/leveldb_0x%" PRIXPTR,
+                         reinterpret_cast<uintptr_t>(db_.get())));
+  dump->AddScalar(base::trace_event::MemoryAllocatorDump::kNameSize,
+                  base::trace_event::MemoryAllocatorDump::kUnitsBytes,
+                  tracker_dump->GetSizeInternal());
+  pmd->AddOwnershipEdge(dump->guid(), tracker_dump->guid());
+  return true;
+}
+
 }  // namespace history_report
 
diff --git a/chrome/browser/android/history_report/usage_reports_buffer_backend.h b/chrome/browser/android/history_report/usage_reports_buffer_backend.h
index 3f3b120..4e274cb 100644
--- a/chrome/browser/android/history_report/usage_reports_buffer_backend.h
+++ b/chrome/browser/android/history_report/usage_reports_buffer_backend.h
@@ -13,6 +13,7 @@
 
 #include "base/files/file_path.h"
 #include "base/macros.h"
+#include "base/trace_event/memory_dump_provider.h"
 
 namespace base {
 class FilePath;
@@ -27,11 +28,11 @@
 class UsageReport;
 
 // Stores usage reports which will be sent for history reporting in batches.
-class UsageReportsBufferBackend {
+class UsageReportsBufferBackend : public base::trace_event::MemoryDumpProvider {
  public:
   explicit UsageReportsBufferBackend(const base::FilePath& dir);
 
-  ~UsageReportsBufferBackend();
+  ~UsageReportsBufferBackend() override;
 
   // Creates and initializes the internal data structures.
   bool Init();
@@ -49,6 +50,10 @@
   // Dumps internal state to string. For debuging.
   std::string Dump();
 
+  // base::trace_event::MemoryDumpProvider implementation:
+  bool OnMemoryDump(const base::trace_event::MemoryDumpArgs& args,
+                    base::trace_event::ProcessMemoryDump* pmd) override;
+
  private:
   // NULL until Init method is called.
   std::unique_ptr<leveldb::DB> db_;
diff --git a/chrome/browser/android/history_report/usage_reports_buffer_service.cc b/chrome/browser/android/history_report/usage_reports_buffer_service.cc
index 308ce83a..117c687 100644
--- a/chrome/browser/android/history_report/usage_reports_buffer_service.cc
+++ b/chrome/browser/android/history_report/usage_reports_buffer_service.cc
@@ -9,6 +9,7 @@
 #include "base/synchronization/waitable_event.h"
 #include "base/task_scheduler/post_task.h"
 #include "base/task_scheduler/task_traits.h"
+#include "base/trace_event/memory_dump_manager.h"
 #include "chrome/browser/android/history_report/usage_reports_buffer_backend.h"
 #include "chrome/browser/android/proto/delta_file.pb.h"
 
@@ -57,6 +58,12 @@
   finished->Signal();
 }
 
+void DoUnregisterMDP(
+    std::unique_ptr<history_report::UsageReportsBufferBackend> backend) {
+  base::trace_event::MemoryDumpManager::GetInstance()->UnregisterDumpProvider(
+      backend.get());
+}
+
 }  // namespace
 
 namespace history_report {
@@ -64,9 +71,19 @@
 UsageReportsBufferService::UsageReportsBufferService(const base::FilePath& dir)
     : task_runner_(base::CreateSequencedTaskRunnerWithTraits(
           {base::MayBlock(), base::TaskShutdownBehavior::BLOCK_SHUTDOWN})),
-      backend_(new UsageReportsBufferBackend(dir)) {}
+      backend_(new UsageReportsBufferBackend(dir)) {
+  base::trace_event::MemoryDumpManager::GetInstance()
+      ->RegisterDumpProviderWithSequencedTaskRunner(
+          backend_.get(), "HistoryReport", task_runner_,
+          base::trace_event::MemoryDumpProvider::Options());
+}
 
-UsageReportsBufferService::~UsageReportsBufferService() {}
+UsageReportsBufferService::~UsageReportsBufferService() {
+  // Unregister should happen on task runner.
+  task_runner_->PostTask(
+      FROM_HERE,
+      base::BindOnce(&DoUnregisterMDP, base::Passed(std::move(backend_))));
+}
 
 void UsageReportsBufferService::Init() {
   task_runner_->PostTask(FROM_HERE,
diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
index 9ec455a..e48151d 100644
--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc
@@ -232,6 +232,7 @@
 #include "ppapi/features/features.h"
 #include "ppapi/host/ppapi_host.h"
 #include "printing/features/features.h"
+#include "services/network/public/cpp/features.h"
 #include "services/preferences/public/cpp/in_process_service_factory.h"
 #include "services/preferences/public/interfaces/preferences.mojom.h"
 #include "services/proxy_resolver/public/interfaces/proxy_resolver.mojom.h"
@@ -3700,7 +3701,7 @@
     const base::Callback<content::WebContents*()>& wc_getter,
     content::NavigationUIData* navigation_ui_data) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  DCHECK(base::FeatureList::IsEnabled(features::kNetworkService));
+  DCHECK(base::FeatureList::IsEnabled(network::features::kNetworkService));
 
   std::vector<std::unique_ptr<content::URLLoaderThrottle>> result;
 
diff --git a/chrome/browser/chrome_network_service_restart_browsertest.cc b/chrome/browser/chrome_network_service_restart_browsertest.cc
index a3d17074..6127c21 100644
--- a/chrome/browser/chrome_network_service_restart_browsertest.cc
+++ b/chrome/browser/chrome_network_service_restart_browsertest.cc
@@ -11,9 +11,9 @@
 #include "chrome/test/base/in_process_browser_test.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/storage_partition.h"
-#include "content/public/common/content_features.h"
 #include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
+#include "services/network/public/cpp/features.h"
 
 namespace content {
 
@@ -23,7 +23,8 @@
 class ChromeNetworkServiceRestartBrowserTest : public InProcessBrowserTest {
  public:
   ChromeNetworkServiceRestartBrowserTest() {
-    scoped_feature_list_.InitAndEnableFeature(features::kNetworkService);
+    scoped_feature_list_.InitAndEnableFeature(
+        network::features::kNetworkService);
     EXPECT_TRUE(embedded_test_server()->Start());
   }
 
diff --git a/chrome/browser/chromeos/login/wizard_controller.cc b/chrome/browser/chromeos/login/wizard_controller.cc
index 2fff2b6..9cd3ab0 100644
--- a/chrome/browser/chromeos/login/wizard_controller.cc
+++ b/chrome/browser/chromeos/login/wizard_controller.cc
@@ -581,6 +581,7 @@
 }
 
 void WizardController::ShowSyncConsentScreen() {
+#if defined(GOOGLE_CHROME_BUILD)
   const user_manager::UserManager* user_manager =
       user_manager::UserManager::Get();
   // Skip for non-regular users.
@@ -594,6 +595,9 @@
   VLOG(1) << "Showing Sync Consent screen.";
   UpdateStatusAreaVisibilityForScreen(OobeScreen::SCREEN_SYNC_CONSENT);
   SetCurrentScreen(GetScreen(OobeScreen::SCREEN_SYNC_CONSENT));
+#else
+  ShowArcTermsOfServiceScreen();
+#endif
 }
 
 void WizardController::ShowArcTermsOfServiceScreen() {
diff --git a/chrome/browser/exo_parts.cc b/chrome/browser/exo_parts.cc
index 64528ee..6383a0c 100644
--- a/chrome/browser/exo_parts.cc
+++ b/chrome/browser/exo_parts.cc
@@ -14,20 +14,44 @@
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/message_loop/message_loop.h"
+#include "chrome/browser/chromeos/file_manager/app_id.h"
+#include "chrome/browser/chromeos/file_manager/fileapi_util.h"
 #include "chrome/browser/chromeos/file_manager/path_util.h"
+#include "chrome/browser/chromeos/profiles/profile_helper.h"
 #include "chrome/browser/ui/ash/ash_util.h"
 #include "chrome/common/chrome_switches.h"
 #include "components/exo/display.h"
 #include "components/exo/file_helper.h"
 #include "components/exo/wayland/server.h"
 #include "components/exo/wm_helper.h"
+#include "components/user_manager/user_manager.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/common/drop_data.h"
+#include "storage/browser/fileapi/file_system_context.h"
+#include "storage/browser/fileapi/file_system_url.h"
 #include "ui/arc/notification/arc_notification_surface_manager_impl.h"
 
 namespace {
 
 constexpr char kMimeTypeArcUriList[] = "application/x-arc-uri-list";
 
+storage::FileSystemContext* GetFileSystemContext() {
+  // Obtains the primary profile.
+  if (!user_manager::UserManager::IsInitialized())
+    return nullptr;
+  const user_manager::User* primary_user =
+      user_manager::UserManager::Get()->GetPrimaryUser();
+  if (!primary_user)
+    return nullptr;
+  Profile* primary_profile =
+      chromeos::ProfileHelper::Get()->GetProfileByUser(primary_user);
+  if (!primary_profile)
+    return nullptr;
+
+  return file_manager::util::GetFileSystemContextForExtensionId(
+      primary_profile, file_manager::kFileManagerAppId);
+}
+
 class ChromeFileHelper : public exo::FileHelper {
  public:
   ChromeFileHelper() {}
@@ -42,10 +66,30 @@
                       GURL* out) override {
     return file_manager::util::ConvertPathToArcUrl(path, out);
   }
-  bool GetUrlFromFileSystemUrl(const std::string& app_id,
-                               const GURL& url,
-                               GURL* out) override {
-    return false;
+  bool GetUrlsFromPickle(const std::string& app_id,
+                         const base::Pickle& pickle,
+                         std::vector<GURL>* out_urls) override {
+    storage::FileSystemContext* file_system_context = GetFileSystemContext();
+    if (!file_system_context)
+      return false;
+
+    std::vector<content::DropData::FileSystemFileInfo> file_system_files;
+    if (!content::DropData::FileSystemFileInfo::ReadFileSystemFilesFromPickle(
+            pickle, &file_system_files))
+      return false;
+
+    for (const auto& file_system_file : file_system_files) {
+      const storage::FileSystemURL file_system_url =
+          file_system_context->CrackURL(file_system_file.url);
+      GURL out_url;
+      // TODO(niwa): Check that app_id is an Arc app once the caller
+      //             (exo::DataOffer) starts filling app_id.
+      if (file_manager::util::ConvertPathToArcUrl(file_system_url.path(),
+                                                  &out_url)) {
+        out_urls->push_back(out_url);
+      }
+    }
+    return !out_urls->empty();
   }
 };
 
diff --git a/chrome/browser/extensions/api/automation/automation_apitest.cc b/chrome/browser/extensions/api/automation/automation_apitest.cc
index 81b2727..f0b29ef 100644
--- a/chrome/browser/extensions/api/automation/automation_apitest.cc
+++ b/chrome/browser/extensions/api/automation/automation_apitest.cc
@@ -120,7 +120,13 @@
       << message_;
 }
 
-IN_PROC_BROWSER_TEST_F(AutomationApiTest, Location) {
+// Disabled due to flakiness: https://crbug.com/807128.
+#if defined(OS_CHROMEOS) && defined(NDEBUG)
+#define MAYBE_Location DISABLED_Location
+#else
+#define MAYBE_Location Location
+#endif
+IN_PROC_BROWSER_TEST_F(AutomationApiTest, MAYBE_Location) {
   StartEmbeddedTestServer();
   ASSERT_TRUE(RunExtensionSubtest("automation/tests/tabs", "location.html"))
       << message_;
diff --git a/chrome/browser/extensions/lazy_background_page_apitest.cc b/chrome/browser/extensions/lazy_background_page_apitest.cc
index e7843d1..a169bdd 100644
--- a/chrome/browser/extensions/lazy_background_page_apitest.cc
+++ b/chrome/browser/extensions/lazy_background_page_apitest.cc
@@ -22,11 +22,9 @@
 #include "chrome/browser/ui/browser_window.h"
 #include "chrome/browser/ui/location_bar/location_bar.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
-#include "chrome/common/chrome_features.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/extensions/api/tabs.h"
-#include "chrome/common/pref_names.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/test/base/ui_test_utils.h"
 #include "components/app_modal/javascript_app_modal_dialog.h"
@@ -621,82 +619,6 @@
         "    ele[0].innerHTML.search('(Inactive)') > 0);",
         &is_inactive));
   }
-  EXPECT_TRUE(is_inactive);
-}
-
-// TODO(dpapad): Remove the _MD suffix once the non-MD test is deleted.
-IN_PROC_BROWSER_TEST_F(LazyBackgroundPageApiTest, UpdateExtensionsPage_MD) {
-  base::test::ScopedFeatureList scoped_feature_list;
-  scoped_feature_list.InitWithFeatures(
-      {features::kMaterialDesignExtensions} /* enabled */, {} /* disabled */);
-
-  // Need to turn on developer mode, otherwise the info to be tested is not
-  // displayed in chrome://extensions.
-  browser()->profile()->GetPrefs()->SetBoolean(
-      prefs::kExtensionsUIDeveloperMode, true);
-
-  // Need to get the extension ID first, before opening the corresponding
-  // details page on chrome://extensions.
-  ui_test_utils::NavigateToURL(browser(), GURL(url::kAboutBlankURL));
-  ResultCatcher catcher;
-  base::FilePath extdir = test_data_dir_.AppendASCII("lazy_background_page")
-                              .AppendASCII("wait_for_view");
-  const Extension* extension = LoadExtension(extdir);
-  ASSERT_TRUE(extension);
-  EXPECT_TRUE(catcher.GetNextResult()) << catcher.message();
-
-  // The extension should've opened a new tab to an extension page.
-  EXPECT_EQ(
-      extension->GetResourceURL("extension_page.html").spec(),
-      browser()->tab_strip_model()->GetActiveWebContents()->GetURL().spec());
-
-  browser()->tab_strip_model()->ActivateTabAt(0, false);
-  std::string details_page_url = chrome::kChromeUIExtensionsURL;
-  details_page_url += "?id=" + extension->id();
-  ui_test_utils::NavigateToURL(browser(), GURL(details_page_url));
-  auto* extensions_page = browser()->tab_strip_model()->GetActiveWebContents();
-
-  // Lazy Background Page still exists, because the extension created a new tab
-  // to an extension page.
-  EXPECT_TRUE(IsBackgroundPageAlive(last_loaded_extension_id()));
-
-  // Close the new tab.
-  LazyBackgroundObserver page_complete;
-  browser()->tab_strip_model()->CloseWebContentsAt(1,
-                                                   TabStripModel::CLOSE_NONE);
-  page_complete.WaitUntilClosed();
-
-  // Lazy Background Page has been shut down.
-  EXPECT_FALSE(IsBackgroundPageAlive(last_loaded_extension_id()));
-
-  // Updating the extensions page is a process that has back-and-forth
-  // communication (i.e., backend tells extensions page something changed,
-  // extensions page requests updated data, backend responds with updated data,
-  // and so forth). This makes it difficult to know for sure when the page is
-  // done updating, so just try a few times. We limit the total number of
-  // attempts so that a) the test *fails* (instead of times out), and b) we
-  // know we're not making a ridiculous amount of trips to update the page.
-  const char setup_js[] =
-      R"(const detailView = document.querySelector('extensions-manager').
-             shadowRoot.querySelector('extensions-detail-view');
-         const inspectableViews = detailView.shadowRoot.querySelector(
-             '#inspectable-views');
-        )";
-  EXPECT_TRUE(
-      content::ExecuteScript(extensions_page, base::StringPrintf(setup_js)));
-
-  bool is_inactive = false;
-  int kMaxTries = 10;
-  int num_tries = 0;
-
-  while (!is_inactive && num_tries++ < kMaxTries) {
-    EXPECT_TRUE(content::ExecuteScriptAndExtractBool(
-        extensions_page,
-        "window.domAutomationController.send("
-        "    inspectableViews.innerHTML.includes('(Inactive)'));",
-        &is_inactive));
-  }
-  EXPECT_TRUE(is_inactive);
 }
 
 // Tests that the lazy background page will be unloaded if the onSuspend event
diff --git a/chrome/browser/io_thread.cc b/chrome/browser/io_thread.cc
index 8791bca..3c04a0d 100644
--- a/chrome/browser/io_thread.cc
+++ b/chrome/browser/io_thread.cc
@@ -63,9 +63,6 @@
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/user_agent.h"
-#include "content/public/network/ignore_errors_cert_verifier.h"
-#include "content/public/network/network_service.h"
-#include "content/public/network/url_request_context_builder_mojo.h"
 #include "extensions/features/features.h"
 #include "net/cert/caching_cert_verifier.h"
 #include "net/cert/cert_verifier.h"
@@ -98,7 +95,11 @@
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_builder.h"
 #include "net/url_request/url_request_context_getter.h"
+#include "services/network/public/cpp/features.h"
+#include "services/network/public/cpp/ignore_errors_cert_verifier.h"
+#include "services/network/public/cpp/network_service.h"
 #include "services/network/public/cpp/network_switches.h"
+#include "services/network/public/cpp/url_request_context_builder_mojo.h"
 #include "url/url_constants.h"
 
 #if BUILDFLAG(ENABLE_EXTENSIONS)
@@ -743,7 +744,7 @@
 }
 
 void IOThread::SetUpProxyService(
-    content::URLRequestContextBuilderMojo* builder) const {
+    network::URLRequestContextBuilderMojo* builder) const {
 #if defined(OS_CHROMEOS)
   builder->SetDhcpFetcherFactory(
       base::MakeUnique<chromeos::DhcpProxyScriptFetcherFactoryChromeos>());
@@ -761,8 +762,8 @@
 }
 
 void IOThread::ConstructSystemRequestContext() {
-  std::unique_ptr<content::URLRequestContextBuilderMojo> builder =
-      base::MakeUnique<content::URLRequestContextBuilderMojo>();
+  std::unique_ptr<network::URLRequestContextBuilderMojo> builder =
+      base::MakeUnique<network::URLRequestContextBuilderMojo>();
 
   builder->set_network_quality_estimator(
       globals_->network_quality_estimator.get());
@@ -800,11 +801,12 @@
   const base::CommandLine& command_line =
       *base::CommandLine::ForCurrentProcess();
   builder->SetCertVerifier(
-      content::IgnoreErrorsCertVerifier::MaybeWrapCertVerifier(
+      network::IgnoreErrorsCertVerifier::MaybeWrapCertVerifier(
           command_line, switches::kUserDataDir, std::move(cert_verifier)));
   UMA_HISTOGRAM_BOOLEAN(
       "Net.Certificate.IgnoreCertificateErrorsSPKIListPresent",
-      command_line.HasSwitch(switches::kIgnoreCertificateErrorsSPKIList));
+      command_line.HasSwitch(
+          network::switches::kIgnoreCertificateErrorsSPKIList));
 
   std::unique_ptr<net::MultiLogCTVerifier> ct_verifier =
       base::MakeUnique<net::MultiLogCTVerifier>();
@@ -817,7 +819,7 @@
   if (!is_quic_allowed_on_init_)
     globals_->quic_disabled = true;
 
-  if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     globals_->system_request_context_owner =
         std::move(builder)->Create(std::move(network_context_params_).get(),
                                    !is_quic_allowed_on_init_, net_log_);
diff --git a/chrome/browser/io_thread.h b/chrome/browser/io_thread.h
index 796ba0c..fc44bc4d 100644
--- a/chrome/browser/io_thread.h
+++ b/chrome/browser/io_thread.h
@@ -29,10 +29,10 @@
 #include "components/ssl_config/ssl_config_service_manager.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/browser_thread_delegate.h"
-#include "content/public/network/url_request_context_owner.h"
 #include "extensions/features/features.h"
 #include "net/base/network_change_notifier.h"
 #include "net/nqe/network_quality_estimator.h"
+#include "services/network/public/cpp/url_request_context_owner.h"
 #include "services/network/public/interfaces/network_service.mojom.h"
 
 class PrefRegistrySimple;
@@ -53,10 +53,6 @@
 class DnsProbeService;
 }
 
-namespace content {
-class URLRequestContextBuilderMojo;
-}
-
 namespace data_usage {
 class DataUseAggregator;
 }
@@ -90,6 +86,10 @@
 class ChromeNetLog;
 }
 
+namespace network {
+class URLRequestContextBuilderMojo;
+}
+
 namespace policy {
 class PolicyService;
 }  // namespace policy
@@ -134,7 +134,7 @@
     // content::NetworkContext class that owns |system_request_context|.
     std::unique_ptr<network::mojom::NetworkContext> system_network_context;
     // When the network service is disabled, this owns |system_request_context|.
-    content::URLRequestContextOwner system_request_context_owner;
+    network::URLRequestContextOwner system_request_context_owner;
     net::URLRequestContext* system_request_context;
     SystemRequestContextLeakChecker system_request_context_leak_checker;
 #if BUILDFLAG(ENABLE_EXTENSIONS)
@@ -212,7 +212,7 @@
   bool PacHttpsUrlStrippingEnabled() const;
 
   // Configures |builder|'s ProxyResolutionService based on prefs and policies.
-  void SetUpProxyService(content::URLRequestContextBuilderMojo* builder) const;
+  void SetUpProxyService(network::URLRequestContextBuilderMojo* builder) const;
 
   // Gets a pointer to the NetworkService. Can only be called on the UI thread.
   // When out-of-process NetworkService is enabled, this is a reference to the
diff --git a/chrome/browser/loader/chrome_resource_dispatcher_host_delegate.cc b/chrome/browser/loader/chrome_resource_dispatcher_host_delegate.cc
index 1148a34..da8e4e2e 100644
--- a/chrome/browser/loader/chrome_resource_dispatcher_host_delegate.cc
+++ b/chrome/browser/loader/chrome_resource_dispatcher_host_delegate.cc
@@ -87,6 +87,7 @@
 #include "net/base/request_priority.h"
 #include "net/http/http_response_headers.h"
 #include "net/url_request/url_request.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/resource_response.h"
 #include "third_party/protobuf/src/google/protobuf/repeated_field.h"
 
@@ -697,7 +698,7 @@
     // TODO(jam): remove this throttle once http://crbug.com/740130 is fixed and
     // PrerendererURLLoaderThrottle can be used for frame requests in the
     // network-service-disabled mode.
-    if (!base::FeatureList::IsEnabled(features::kNetworkService) &&
+    if (!base::FeatureList::IsEnabled(network::features::kNetworkService) &&
         content::IsResourceTypeFrame(info->GetResourceType())) {
       throttles->push_back(
           base::MakeUnique<prerender::PrerenderResourceThrottle>(request));
diff --git a/chrome/browser/mac/exception_processor_unittest.mm b/chrome/browser/mac/exception_processor_unittest.mm
index 2253e50..445a2b8 100644
--- a/chrome/browser/mac/exception_processor_unittest.mm
+++ b/chrome/browser/mac/exception_processor_unittest.mm
@@ -48,7 +48,8 @@
 }
 
 TEST(ExceptionProcessorTest, RecordException) {
-  EXPECT_THAT(StatisticsRecorder::GetSnapshot("OSX.NSException"),
+  EXPECT_THAT(StatisticsRecorder::WithName(StatisticsRecorder::GetHistograms(),
+                                           "OSX.NSException"),
               testing::IsEmpty());
 
   // Record some known exceptions.
@@ -71,7 +72,8 @@
 
   // We should have exactly the right number of exceptions.
   const StatisticsRecorder::Histograms histograms =
-      StatisticsRecorder::GetSnapshot("OSX.NSException");
+      StatisticsRecorder::WithName(StatisticsRecorder::GetHistograms(),
+                                   "OSX.NSException");
   ASSERT_THAT(histograms, testing::SizeIs(1));
   EXPECT_EQ(HistogramBase::kUmaTargetedHistogramFlag, histograms[0]->flags());
 
diff --git a/chrome/browser/net/DEPS b/chrome/browser/net/DEPS
index 4e3a9cb..6582d2d 100644
--- a/chrome/browser/net/DEPS
+++ b/chrome/browser/net/DEPS
@@ -4,3 +4,8 @@
   "+components/user_manager",
 ]
 
+specific_include_rules = {
+  '.*_[a-z]*test.*': [
+    "+services/network/test",
+  ],
+}
diff --git a/chrome/browser/net/dns_probe_browsertest.cc b/chrome/browser/net/dns_probe_browsertest.cc
index e7b286e..7f4f773 100644
--- a/chrome/browser/net/dns_probe_browsertest.cc
+++ b/chrome/browser/net/dns_probe_browsertest.cc
@@ -28,7 +28,6 @@
 #include "components/prefs/pref_service.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/web_contents.h"
-#include "content/public/common/content_features.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/test_navigation_observer.h"
 #include "content/public/test/url_loader_interceptor.h"
@@ -40,6 +39,7 @@
 #include "net/url_request/url_request_filter.h"
 #include "net/url_request/url_request_interceptor.h"
 #include "net/url_request/url_request_job.h"
+#include "services/network/public/cpp/features.h"
 
 using base::Bind;
 using base::BindOnce;
@@ -511,7 +511,7 @@
       BindOnce(&DnsProbeBrowserTestIOThreadHelper::SetUpOnIOThread,
                Unretained(helper_), g_browser_process->io_thread()));
 
-  if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     // Just instantiating this helper is enough to respond to
     // http(s)://mock.failed.request requests.
     url_loader_interceptor_ =
diff --git a/chrome/browser/net/errorpage_browsertest.cc b/chrome/browser/net/errorpage_browsertest.cc
index 50a360749..f81196d 100644
--- a/chrome/browser/net/errorpage_browsertest.cc
+++ b/chrome/browser/net/errorpage_browsertest.cc
@@ -55,7 +55,6 @@
 #include "content/public/browser/storage_partition.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_observer.h"
-#include "content/public/common/content_features.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/test_navigation_observer.h"
 #include "content/public/test/url_loader_interceptor.h"
@@ -78,6 +77,7 @@
 #include "net/url_request/url_request_job.h"
 #include "net/url_request/url_request_test_job.h"
 #include "net/url_request/url_request_test_util.h"
+#include "services/network/public/cpp/features.h"
 #include "ui/base/l10n/l10n_util.h"
 
 #if defined(OS_CHROMEOS)
@@ -455,7 +455,7 @@
   friend LinkDoctorInterceptor;
 
   DNSErrorPageTest() {
-    if (!base::FeatureList::IsEnabled(features::kNetworkService))
+    if (!base::FeatureList::IsEnabled(network::features::kNetworkService))
       return;
 
     url_loader_interceptor_ = std::make_unique<content::URLLoaderInterceptor>(
@@ -563,7 +563,7 @@
     UIThreadSearchTermsData search_terms_data(browser()->profile());
     search_term_url_ = GURL(search_terms_data.GoogleBaseURLValue());
 
-    if (!base::FeatureList::IsEnabled(features::kNetworkService)) {
+    if (!base::FeatureList::IsEnabled(network::features::kNetworkService)) {
       std::unique_ptr<net::URLRequestInterceptor> owned_interceptor(
           new LinkDoctorInterceptor(this));
 
@@ -1208,7 +1208,7 @@
   void InstallInterceptor(const GURL& url, int32_t requests_to_fail) {
     requests_ = failures_ = 0;
 
-    if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+    if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
       url_loader_interceptor_ =
           std::make_unique<content::URLLoaderInterceptor>(base::BindRepeating(
               [](int32_t requests_to_fail, int32_t* requests, int32_t* failures,
@@ -1377,7 +1377,7 @@
  public:
   // InProcessBrowserTest:
   void SetUpOnMainThread() override {
-    if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+    if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
       url_loader_interceptor_ =
           std::make_unique<content::URLLoaderInterceptor>(base::BindRepeating(
               [](content::URLLoaderInterceptor::RequestParams* params) {
@@ -1397,7 +1397,7 @@
   }
 
   void TearDownOnMainThread() override {
-    if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+    if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
       url_loader_interceptor_.reset();
     } else {
       BrowserThread::PostTask(
diff --git a/chrome/browser/net/network_connection_tracker_browsertest.cc b/chrome/browser/net/network_connection_tracker_browsertest.cc
index 17c4740..805b2ce 100644
--- a/chrome/browser/net/network_connection_tracker_browsertest.cc
+++ b/chrome/browser/net/network_connection_tracker_browsertest.cc
@@ -11,13 +11,13 @@
 #include "build/build_config.h"
 #include "chrome/browser/browser_process_impl.h"
 #include "chrome/test/base/in_process_browser_test.h"
-#include "content/public/common/content_features.h"
 #include "content/public/common/network_connection_tracker.h"
 #include "content/public/common/service_manager_connection.h"
 #include "content/public/common/service_names.mojom.h"
 #include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "net/base/network_change_notifier.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/interfaces/network_service_test.mojom.h"
 #include "services/service_manager/public/cpp/connector.h"
 
@@ -77,9 +77,11 @@
  public:
   NetworkConnectionTrackerBrowserTest() : network_service_enabled_(GetParam()) {
     if (network_service_enabled_) {
-      scoped_feature_list_.InitAndEnableFeature(features::kNetworkService);
+      scoped_feature_list_.InitAndEnableFeature(
+          network::features::kNetworkService);
     } else {
-      scoped_feature_list_.InitAndDisableFeature(features::kNetworkService);
+      scoped_feature_list_.InitAndDisableFeature(
+          network::features::kNetworkService);
     }
   }
   ~NetworkConnectionTrackerBrowserTest() override {}
diff --git a/chrome/browser/net/network_context_configuration_browsertest.cc b/chrome/browser/net/network_context_configuration_browsertest.cc
index f8c01c3..fdbcb504 100644
--- a/chrome/browser/net/network_context_configuration_browsertest.cc
+++ b/chrome/browser/net/network_context_configuration_browsertest.cc
@@ -27,13 +27,11 @@
 #include "components/proxy_config/proxy_config_pref_names.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/storage_partition.h"
-#include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/simple_url_loader.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/simple_url_loader_test_helper.h"
-#include "content/public/test/test_url_loader_client.h"
 #include "mojo/common/data_pipe_utils.h"
 #include "net/base/filename_util.h"
 #include "net/base/host_port_pair.h"
@@ -44,11 +42,13 @@
 #include "net/test/embedded_test_server/http_response.h"
 #include "net/test/spawned_test_server/spawned_test_server.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/resource_response.h"
 #include "services/network/public/cpp/resource_response_info.h"
 #include "services/network/public/interfaces/network_service.mojom.h"
 #include "services/network/public/interfaces/url_loader.mojom.h"
 #include "services/network/public/interfaces/url_loader_factory.mojom.h"
+#include "services/network/test/test_url_loader_client.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace {
@@ -93,7 +93,7 @@
 
   void SetUpInProcessBrowserTestFixture() override {
     if (GetParam().network_service_state != NetworkServiceState::kDisabled)
-      feature_list_.InitAndEnableFeature(features::kNetworkService);
+      feature_list_.InitAndEnableFeature(network::features::kNetworkService);
   }
 
   void SetUpOnMainThread() override {
@@ -442,7 +442,7 @@
   GURL test_url = GURL(content::kChromeUINetworkViewCacheURL + test_url_string);
   ASSERT_TRUE(test_url.is_valid()) << test_url_string;
 
-  content::TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   // Read from the cache directly, as the test server may theoretically have
   // been restarted on the same port by another test.
   network_context()->HandleViewCacheRequest(test_url,
diff --git a/chrome/browser/net/profile_network_context_service.cc b/chrome/browser/net/profile_network_context_service.cc
index 9a3e863..d9d152b 100644
--- a/chrome/browser/net/profile_network_context_service.cc
+++ b/chrome/browser/net/profile_network_context_service.cc
@@ -23,10 +23,10 @@
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/network_service_instance.h"
-#include "content/public/common/content_features.h"
 #include "content/public/common/service_names.mojom.h"
 #include "mojo/public/cpp/bindings/associated_interface_ptr.h"
 #include "net/net_features.h"
+#include "services/network/public/cpp/features.h"
 
 ProfileNetworkContextService::ProfileNetworkContextService(Profile* profile)
     : profile_(profile), proxy_config_monitor_(profile) {
@@ -44,7 +44,7 @@
 
 network::mojom::NetworkContextPtr
 ProfileNetworkContextService::CreateMainNetworkContext() {
-  if (!base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (!base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     // |profile_io_data_main_network_context_| may be initialized if
     // SetUpProfileIOdataMainContext was called first.
     if (!profile_io_data_main_network_context_) {
@@ -74,7 +74,7 @@
     *network_context_request = std::move(profile_io_data_context_request_);
   }
 
-  if (!base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (!base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     *network_context_params = CreateMainNetworkContextParams();
     return;
   }
diff --git a/chrome/browser/net/profile_network_context_service_browsertest.cc b/chrome/browser/net/profile_network_context_service_browsertest.cc
index 42b6493..8b97d3da 100644
--- a/chrome/browser/net/profile_network_context_service_browsertest.cc
+++ b/chrome/browser/net/profile_network_context_service_browsertest.cc
@@ -26,12 +26,11 @@
 #include "chrome/test/base/in_process_browser_test.h"
 #include "components/prefs/pref_service.h"
 #include "content/public/browser/storage_partition.h"
-#include "content/public/common/content_features.h"
 #include "content/public/test/simple_url_loader_test_helper.h"
-#include "content/public/test/test_url_loader_client.h"
 #include "mojo/common/data_pipe_utils.h"
 #include "net/base/load_flags.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/interfaces/url_loader_factory.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -55,7 +54,7 @@
 
   void SetUpInProcessBrowserTestFixture() override {
     if (GetParam() == NetworkServiceState::kEnabled)
-      feature_list_.InitAndEnableFeature(features::kNetworkService);
+      feature_list_.InitAndEnableFeature(network::features::kNetworkService);
   }
 
   void SetUpOnMainThread() override {
diff --git a/chrome/browser/net/system_network_context_manager.cc b/chrome/browser/net/system_network_context_manager.cc
index 985ac6b..43a21f7 100644
--- a/chrome/browser/net/system_network_context_manager.cc
+++ b/chrome/browser/net/system_network_context_manager.cc
@@ -23,9 +23,10 @@
 #include "content/public/browser/network_service_instance.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/service_names.mojom.h"
-#include "content/public/network/network_service.h"
 #include "mojo/public/cpp/bindings/associated_interface_ptr.h"
 #include "net/net_features.h"
+#include "services/network/public/cpp/features.h"
+#include "services/network/public/cpp/network_service.h"
 
 namespace {
 
@@ -37,7 +38,7 @@
     safe_browsing::SafeBrowsingService* safe_browsing_service) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
 
-  if (!base::FeatureList::IsEnabled(features::kNetworkService))
+  if (!base::FeatureList::IsEnabled(network::features::kNetworkService))
     content::GetNetworkServiceImpl()->DisableQuic();
   io_thread->DisableQuic();
 
@@ -52,7 +53,7 @@
     g_system_network_context_manager = LAZY_INSTANCE_INITIALIZER;
 
 network::mojom::NetworkContext* SystemNetworkContextManager::GetContext() {
-  if (!base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (!base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     // SetUp should already have been called.
     DCHECK(io_thread_network_context_);
     return io_thread_network_context_.get();
@@ -84,7 +85,7 @@
     network::mojom::NetworkContextRequest* network_context_request,
     network::mojom::NetworkContextParamsPtr* network_context_params,
     bool* is_quic_allowed) {
-  if (!base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (!base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     *network_context_request = mojo::MakeRequest(&io_thread_network_context_);
     *network_context_params = CreateNetworkContextParams();
   } else {
@@ -114,7 +115,7 @@
   // Profiles will also have QUIC disabled (because both IOThread's
   // NetworkService and the network service, if enabled will disable QUIC).
 
-  if (base::FeatureList::IsEnabled(features::kNetworkService))
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService))
     content::GetNetworkService()->DisableQuic();
 
   IOThread* io_thread = g_browser_process->io_thread();
diff --git a/chrome/browser/policy/policy_network_browsertest.cc b/chrome/browser/policy/policy_network_browsertest.cc
index b65a3c94..57a51ca 100644
--- a/chrome/browser/policy/policy_network_browsertest.cc
+++ b/chrome/browser/policy/policy_network_browsertest.cc
@@ -29,7 +29,6 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/network_service_instance.h"
 #include "content/public/browser/storage_partition.h"
-#include "content/public/common/content_features.h"
 #include "content/public/test/browser_test.h"
 #include "content/public/test/browser_test_utils.h"
 #include "net/cert/test_root_certs.h"
@@ -38,6 +37,7 @@
 #include "net/test/test_data_directory.h"
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_getter.h"
+#include "services/network/public/cpp/features.h"
 
 #if defined(OS_CHROMEOS)
 #include "chromeos/chromeos_switches.h"
@@ -104,7 +104,7 @@
 }
 
 bool IsQuicEnabledForSystem() {
-  if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     return IsQuicEnabled(
         g_browser_process->system_network_context_manager()->GetContext());
   }
@@ -317,7 +317,7 @@
     // To avoid any races between sending future requests and disabling QUIC in
     // the network process, flush the NetworkService Mojo interface, which is
     // the one that has the DisableQuic() method.
-    if (base::FeatureList::IsEnabled(features::kNetworkService))
+    if (base::FeatureList::IsEnabled(network::features::kNetworkService))
       content::FlushNetworkServiceInstanceForTesting();
   }
 
diff --git a/chrome/browser/prerender/prerender_browsertest.cc b/chrome/browser/prerender/prerender_browsertest.cc
index 866f4e59..1aa31660 100644
--- a/chrome/browser/prerender/prerender_browsertest.cc
+++ b/chrome/browser/prerender/prerender_browsertest.cc
@@ -100,7 +100,6 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/common/browser_side_navigation_policy.h"
-#include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/test/browser_test_utils.h"
@@ -131,6 +130,7 @@
 #include "net/url_request/url_request_context_getter.h"
 #include "net/url_request/url_request_filter.h"
 #include "net/url_request/url_request_job.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/resource_request_body.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -975,7 +975,7 @@
                                             base::Closure closure) {
     // TODO(jam): use the URLLoaderInterceptor for the non-network service path
     // once http://crbug.com/740130 is fixed.
-    if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+    if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
       DCHECK(!interceptor_);
       interceptor_ = std::make_unique<content::URLLoaderInterceptor>(
           base::BindLambdaForTesting(
diff --git a/chrome/browser/prerender/prerender_nostate_prefetch_browsertest.cc b/chrome/browser/prerender/prerender_nostate_prefetch_browsertest.cc
index 4611805..693c8f1 100644
--- a/chrome/browser/prerender/prerender_nostate_prefetch_browsertest.cc
+++ b/chrome/browser/prerender/prerender_nostate_prefetch_browsertest.cc
@@ -46,6 +46,7 @@
 #include "net/test/embedded_test_server/request_handler_util.h"
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_getter.h"
+#include "services/network/public/cpp/features.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 using prerender::test_utils::DestructionWaiter;
@@ -321,7 +322,7 @@
   GURL prefetch_script = src_server()->GetURL(kPrefetchScript);
 
   bool use_interceptor_for_frame_requests =
-      base::FeatureList::IsEnabled(features::kNetworkService);
+      base::FeatureList::IsEnabled(network::features::kNetworkService);
   if (!use_interceptor_for_frame_requests) {
     // Until http://crbug.com/747130 is fixed, navigation requests won't go
     // through URLLoader.
@@ -493,7 +494,7 @@
   });
 
   bool use_interceptor = false;
-  if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     use_interceptor = true;
   } else {
     // Until http://crbug.com/747130 is fixed, navigation requests won't go
diff --git a/chrome/browser/profiles/profile_io_data.cc b/chrome/browser/profiles/profile_io_data.cc
index 0709f55..ed1955f62 100644
--- a/chrome/browser/profiles/profile_io_data.cc
+++ b/chrome/browser/profiles/profile_io_data.cc
@@ -78,11 +78,7 @@
 #include "content/public/browser/network_service_instance.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/resource_context.h"
-#include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
-#include "content/public/network/ignore_errors_cert_verifier.h"
-#include "content/public/network/network_service.h"
-#include "content/public/network/url_request_context_builder_mojo.h"
 #include "extensions/features/features.h"
 #include "net/cert/caching_cert_verifier.h"
 #include "net/cert/cert_verifier.h"
@@ -113,7 +109,11 @@
 #include "net/url_request/url_request_intercepting_job_factory.h"
 #include "net/url_request/url_request_interceptor.h"
 #include "net/url_request/url_request_job_factory_impl.h"
+#include "services/network/public/cpp/features.h"
+#include "services/network/public/cpp/ignore_errors_cert_verifier.h"
+#include "services/network/public/cpp/network_service.h"
 #include "services/network/public/cpp/proxy_config_traits.h"
+#include "services/network/public/cpp/url_request_context_builder_mojo.h"
 #include "third_party/WebKit/public/public_features.h"
 
 #if BUILDFLAG(ENABLE_EXTENSIONS)
@@ -1061,8 +1061,8 @@
   extensions_request_context_->set_name("extensions");
 
   // Create the main request context.
-  std::unique_ptr<content::URLRequestContextBuilderMojo> builder =
-      base::MakeUnique<content::URLRequestContextBuilderMojo>();
+  std::unique_ptr<network::URLRequestContextBuilderMojo> builder =
+      base::MakeUnique<network::URLRequestContextBuilderMojo>();
 
   builder->set_shared_http_user_agent_settings(
       chrome_http_user_agent_settings_.get());
@@ -1172,7 +1172,7 @@
 #endif
     const base::CommandLine& command_line =
         *base::CommandLine::ForCurrentProcess();
-    cert_verifier = content::IgnoreErrorsCertVerifier::MaybeWrapCertVerifier(
+    cert_verifier = network::IgnoreErrorsCertVerifier::MaybeWrapCertVerifier(
         command_line, switches::kUserDataDir, std::move(cert_verifier));
     builder->SetCertVerifier(std::move(cert_verifier));
   }
@@ -1211,7 +1211,7 @@
   builder->SetCreateHttpTransactionFactoryCallback(
       base::BindOnce(&content::CreateDevToolsNetworkTransactionFactory));
 
-  if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     main_request_context_owner_ = std::move(builder)->Create(
         std::move(profile_params_->main_network_context_params).get(),
         io_thread_globals->quic_disabled, io_thread->net_log());
diff --git a/chrome/browser/profiles/profile_io_data.h b/chrome/browser/profiles/profile_io_data.h
index 408d939..4aaedc5 100644
--- a/chrome/browser/profiles/profile_io_data.h
+++ b/chrome/browser/profiles/profile_io_data.h
@@ -28,7 +28,6 @@
 #include "components/prefs/pref_member.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/resource_context.h"
-#include "content/public/network/url_request_context_owner.h"
 #include "extensions/features/features.h"
 #include "net/cookies/cookie_store.h"
 #include "net/http/http_cache.h"
@@ -37,6 +36,7 @@
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_interceptor.h"
 #include "net/url_request/url_request_job_factory.h"
+#include "services/network/public/cpp/url_request_context_owner.h"
 #include "services/network/public/interfaces/network_service.mojom.h"
 
 class ChromeHttpUserAgentSettings;
@@ -610,7 +610,7 @@
   // content::NetworkContext class that owns |main_request_context_|.
   mutable std::unique_ptr<network::mojom::NetworkContext> main_network_context_;
   // When the network service is disabled, this owns |system_request_context|.
-  mutable content::URLRequestContextOwner main_request_context_owner_;
+  mutable network::URLRequestContextOwner main_request_context_owner_;
   mutable net::URLRequestContext* main_request_context_;
 
   // Pointed to by the TransportSecurityState (owned by
diff --git a/chrome/browser/ui/tabs/BUILD.gn b/chrome/browser/resource_coordinator/BUILD.gn
similarity index 100%
rename from chrome/browser/ui/tabs/BUILD.gn
rename to chrome/browser/resource_coordinator/BUILD.gn
diff --git a/chrome/browser/resource_coordinator/tab_activity_watcher.cc b/chrome/browser/resource_coordinator/tab_activity_watcher.cc
index f18fef1..a7aa3a5 100644
--- a/chrome/browser/resource_coordinator/tab_activity_watcher.cc
+++ b/chrome/browser/resource_coordinator/tab_activity_watcher.cc
@@ -5,8 +5,8 @@
 #include "chrome/browser/resource_coordinator/tab_activity_watcher.h"
 
 #include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/resource_coordinator/tab_metrics_logger_impl.h"
 #include "chrome/browser/ui/browser.h"
-#include "chrome/browser/ui/tabs/tab_metrics_logger_impl.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/browser/ui/tabs/window_activity_watcher.h"
 #include "content/public/browser/browser_context.h"
diff --git a/chrome/browser/resource_coordinator/tab_activity_watcher_unittest.cc b/chrome/browser/resource_coordinator/tab_activity_watcher_unittest.cc
index 148182d..aa853db 100644
--- a/chrome/browser/resource_coordinator/tab_activity_watcher_unittest.cc
+++ b/chrome/browser/resource_coordinator/tab_activity_watcher_unittest.cc
@@ -11,9 +11,9 @@
 #include "chrome/browser/engagement/site_engagement_service.h"
 #include "chrome/browser/resource_coordinator/tab_activity_watcher.h"
 #include "chrome/browser/resource_coordinator/tab_manager.h"
+#include "chrome/browser/resource_coordinator/tab_metrics_event.pb.h"
+#include "chrome/browser/resource_coordinator/tab_metrics_logger_impl.h"
 #include "chrome/browser/ui/browser.h"
-#include "chrome/browser/ui/tabs/tab_metrics_event.pb.h"
-#include "chrome/browser/ui/tabs/tab_metrics_logger_impl.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/browser/ui/tabs/tab_ukm_test_helper.h"
 #include "chrome/test/base/test_browser_window.h"
diff --git a/chrome/browser/ui/tabs/tab_metrics_event.proto b/chrome/browser/resource_coordinator/tab_metrics_event.proto
similarity index 100%
rename from chrome/browser/ui/tabs/tab_metrics_event.proto
rename to chrome/browser/resource_coordinator/tab_metrics_event.proto
diff --git a/chrome/browser/ui/tabs/tab_metrics_logger.h b/chrome/browser/resource_coordinator/tab_metrics_logger.h
similarity index 87%
rename from chrome/browser/ui/tabs/tab_metrics_logger.h
rename to chrome/browser/resource_coordinator/tab_metrics_logger.h
index 6ab87af0..5d72ec9 100644
--- a/chrome/browser/ui/tabs/tab_metrics_logger.h
+++ b/chrome/browser/resource_coordinator/tab_metrics_logger.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CHROME_BROWSER_UI_TABS_TAB_METRICS_LOGGER_H_
-#define CHROME_BROWSER_UI_TABS_TAB_METRICS_LOGGER_H_
+#ifndef CHROME_BROWSER_RESOURCE_COORDINATOR_TAB_METRICS_LOGGER_H_
+#define CHROME_BROWSER_RESOURCE_COORDINATOR_TAB_METRICS_LOGGER_H_
 
 #include "base/macros.h"
 #include "services/metrics/public/cpp/ukm_source_id.h"
@@ -48,4 +48,4 @@
                                 const TabMetrics& tab_metrics) = 0;
 };
 
-#endif  // CHROME_BROWSER_UI_TABS_TAB_METRICS_LOGGER_H_
+#endif  // CHROME_BROWSER_RESOURCE_COORDINATOR_TAB_METRICS_LOGGER_H_
diff --git a/chrome/browser/ui/tabs/tab_metrics_logger_impl.cc b/chrome/browser/resource_coordinator/tab_metrics_logger_impl.cc
similarity index 98%
rename from chrome/browser/ui/tabs/tab_metrics_logger_impl.cc
rename to chrome/browser/resource_coordinator/tab_metrics_logger_impl.cc
index 3a1ed8c..341e6e2 100644
--- a/chrome/browser/ui/tabs/tab_metrics_logger_impl.cc
+++ b/chrome/browser/resource_coordinator/tab_metrics_logger_impl.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/ui/tabs/tab_metrics_logger_impl.h"
+#include "chrome/browser/resource_coordinator/tab_metrics_logger_impl.h"
 
 #include <algorithm>
 #include <string>
@@ -223,7 +223,7 @@
       .SetHasFormEntry(
           web_contents->GetPageImportanceSignals().had_form_interaction)
       // TODO(michaelpg): This dependency should be reversed during the
-      // resource_coordinator refactor: crbug.com/775644.
+      // resource_coordinator refactor: https://crbug.com/775644.
       .SetIsExtensionProtected(!tab_manager->IsTabAutoDiscardable(web_contents))
       .SetIsPinned(tab_strip_model->IsTabPinned(index))
       .SetNavigationEntryCount(web_contents->GetController().GetEntryCount())
diff --git a/chrome/browser/ui/tabs/tab_metrics_logger_impl.h b/chrome/browser/resource_coordinator/tab_metrics_logger_impl.h
similarity index 77%
rename from chrome/browser/ui/tabs/tab_metrics_logger_impl.h
rename to chrome/browser/resource_coordinator/tab_metrics_logger_impl.h
index c0ceb7c..f3c8b050 100644
--- a/chrome/browser/ui/tabs/tab_metrics_logger_impl.h
+++ b/chrome/browser/resource_coordinator/tab_metrics_logger_impl.h
@@ -2,15 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CHROME_BROWSER_UI_TABS_TAB_METRICS_LOGGER_IMPL_H_
-#define CHROME_BROWSER_UI_TABS_TAB_METRICS_LOGGER_IMPL_H_
+#ifndef CHROME_BROWSER_RESOURCE_COORDINATOR_TAB_METRICS_LOGGER_IMPL_H_
+#define CHROME_BROWSER_RESOURCE_COORDINATOR_TAB_METRICS_LOGGER_IMPL_H_
 
 #include <string>
 
 #include "base/gtest_prod_util.h"
 #include "base/macros.h"
-#include "chrome/browser/ui/tabs/tab_metrics_event.pb.h"
-#include "chrome/browser/ui/tabs/tab_metrics_logger.h"
+#include "chrome/browser/resource_coordinator/tab_metrics_event.pb.h"
+#include "chrome/browser/resource_coordinator/tab_metrics_logger.h"
 
 // Logs a TabManager.TabMetrics UKM for a tab when requested. Includes
 // information relevant to the tab and its WebContents.
@@ -39,4 +39,4 @@
   DISALLOW_COPY_AND_ASSIGN(TabMetricsLoggerImpl);
 };
 
-#endif  // CHROME_BROWSER_UI_TABS_TAB_METRICS_LOGGER_IMPL_H_
+#endif  // CHROME_BROWSER_RESOURCE_COORDINATOR_TAB_METRICS_LOGGER_IMPL_H_
diff --git a/chrome/browser/ui/tabs/tab_metrics_logger_impl_unittest.cc b/chrome/browser/resource_coordinator/tab_metrics_logger_impl_unittest.cc
similarity index 96%
rename from chrome/browser/ui/tabs/tab_metrics_logger_impl_unittest.cc
rename to chrome/browser/resource_coordinator/tab_metrics_logger_impl_unittest.cc
index d308ab0..df0a457 100644
--- a/chrome/browser/ui/tabs/tab_metrics_logger_impl_unittest.cc
+++ b/chrome/browser/resource_coordinator/tab_metrics_logger_impl_unittest.cc
@@ -2,9 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/ui/tabs/tab_metrics_logger_impl.h"
+#include "chrome/browser/resource_coordinator/tab_metrics_logger_impl.h"
 
-#include "chrome/browser/ui/tabs/tab_metrics_event.pb.h"
+#include "chrome/browser/resource_coordinator/tab_metrics_event.pb.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 using metrics::TabMetricsEvent;
diff --git a/chrome/browser/resources/chromeos/login/sync_consent.html b/chrome/browser/resources/chromeos/login/sync_consent.html
index 9b56374..15efe707 100644
--- a/chrome/browser/resources/chromeos/login/sync_consent.html
+++ b/chrome/browser/resources/chromeos/login/sync_consent.html
@@ -53,9 +53,10 @@
       </div>
       <div class="footer layout vertical">
         <div class="overview-list-item flex layout horizontal center">
-          <hd-iron-icon class="overview-list-item-icon"
-              icon1x="sync-consent-32:googleg" icon2x="sync-consent-64:googleg">
-          </hd-iron-icon>
+          <img srcset="chrome://oobe/logo_24px-1x.svg 1x,
+                       chrome://oobe/logo_24px-2x.svg 2x"
+              class="overview-list-item-icon">
+          </img>
           <div class="overview-list-item-text flex layout vertical
               center-justified">
             <div class="overview-list-item-title">
diff --git a/chrome/browser/resources/md_history/app.js b/chrome/browser/resources/md_history/app.js
index c187aca..56f975fb2 100644
--- a/chrome/browser/resources/md_history/app.js
+++ b/chrome/browser/resources/md_history/app.js
@@ -168,6 +168,13 @@
                         .getSelectedItemCount();
   },
 
+  selectOrUnselectAll: function() {
+    const list = /** @type {HistoryListElement} */ (this.$.history);
+    const toolbar = /** @type {HistoryToolbarElement} */ (this.$.toolbar);
+    list.selectOrUnselectAll();
+    toolbar.count = list.getSelectedItemCount();
+  },
+
   /**
    * Listens for call to cancel selection and loops through all items to set
    * checkbox to be unselected.
@@ -218,6 +225,9 @@
       case 'delete-command':
         e.canExecute = this.$.toolbar.count > 0;
         break;
+      case 'select-all-command':
+        e.canExecute = !this.$.toolbar.searchField.isSearchFocused();
+        break;
     }
   },
 
@@ -230,6 +240,8 @@
       this.focusToolbarSearchField();
     else if (e.command.id == 'delete-command')
       this.deleteSelected();
+    else if (e.command.id == 'select-all-command')
+      this.selectOrUnselectAll();
   },
 
   /**
diff --git a/chrome/browser/resources/md_history/history.html b/chrome/browser/resources/md_history/history.html
index cc221ba..d98bd50 100644
--- a/chrome/browser/resources/md_history/history.html
+++ b/chrome/browser/resources/md_history/history.html
@@ -79,6 +79,12 @@
 </if>
   <command id="delete-command" shortcut="Delete Backspace">
   <command id="slash-command" shortcut="/">
+<if expr="is_macosx">
+  <command id="select-all-command" shortcut="Meta|a">
+</if>
+<if expr="not is_macosx">
+  <command id="select-all-command" shortcut="Ctrl|a">
+</if>
 
   <link rel="import" href="chrome://resources/html/util.html">
   <link rel="import" href="chrome://resources/html/load_time_data.html">
diff --git a/chrome/browser/resources/md_history/history_list.js b/chrome/browser/resources/md_history/history_list.js
index 8b94ed48..9cd061e 100644
--- a/chrome/browser/resources/md_history/history_list.js
+++ b/chrome/browser/resources/md_history/history_list.js
@@ -138,6 +138,25 @@
     this.fire('query-history', false);
   },
 
+  selectOrUnselectAll: function() {
+    if (this.historyData_.length == this.getSelectedItemCount())
+      this.unselectAllItems();
+    else
+      this.selectAllItems();
+  },
+
+  /**
+   * Select each item in |historyData|.
+   */
+  selectAllItems: function() {
+    if (this.historyData_.length == this.getSelectedItemCount())
+      return;
+
+    this.historyData_.forEach((item, index) => {
+      this.changeSelection_(index, true);
+    });
+  },
+
   /**
    * Deselect each item in |selectedItems|.
    */
@@ -205,6 +224,10 @@
         .then((items) => {
           this.removeItemsByIndex_(Array.from(this.selectedItems));
           this.fire('unselect-all');
+          if (this.historyData_.length == 0) {
+            // Try reloading if nothing is rendered.
+            this.fire('query-history', false);
+          }
         });
   },
 
diff --git a/chrome/browser/resources/settings/passwords_and_forms_page/passwords_export_dialog.html b/chrome/browser/resources/settings/passwords_and_forms_page/passwords_export_dialog.html
index 9353ae7e..40e3a155 100644
--- a/chrome/browser/resources/settings/passwords_and_forms_page/passwords_export_dialog.html
+++ b/chrome/browser/resources/settings/passwords_and_forms_page/passwords_export_dialog.html
@@ -8,8 +8,12 @@
 <dom-module id="passwords-export-dialog">
   <template>
     <style include="settings-shared iron-flex">
+      paper-progress {
+        width: 100%;
+        --paper-progress-active-color: var(--google-blue-500);
+      }
     </style>
-    <dialog is="cr-dialog" id="dialog" close-text="$i18n{close}">
+    <dialog is="cr-dialog" id="dialog_start" close-text="$i18n{close}">
       <div slot="title">$i18n{exportPasswordsTitle}</div>
       <div slot="body">
         <div class="layout horizontal center">
@@ -27,6 +31,41 @@
         </paper-button>
       </div>
     </dialog>
+
+    <dialog is="cr-dialog" id="dialog_progress" close-text="$i18n{close}">
+      <div slot="title">$i18n{exportingPasswordsTitle}</div>
+      <div slot="body">
+        <paper-progress indeterminate class="blue"></paper-progress>
+      </div>
+      <div slot="button-container">
+        <paper-button class="secondary-button header-aligned-button"
+            on-tap="onCancelButtonTap_">
+          $i18n{cancel}
+        </paper-button>
+      </div>
+    </dialog>
+
+    <dialog is="cr-dialog" id="dialog_error" close-text="$i18n{close}">
+      <div slot="title">[[exportErrorMessage]]</div>
+      <div slot="body">
+        $i18n{exportPasswordsFailTips}
+        <ul>
+          <li>$i18n{exportPasswordsFailTipsEnoughSpace}</li>
+          <li>$i18n{exportPasswordsFailTipsAnotherFolder}</li>
+        </ul>
+      </div>
+      <div slot="button-container">
+        <paper-button class="secondary-button header-aligned-button"
+            on-tap="onCancelButtonTap_">
+          $i18n{cancel}
+        </paper-button>
+        <paper-button class="action-button header-aligned-button"
+            on-tap="onExportTap_">
+          $i18n{exportPasswordsTryAgain}
+        </paper-button>
+      </div>
+    </dialog>
+
   </template>
   <script src="passwords_export_dialog.js"></script>
-</dom-module>
\ No newline at end of file
+</dom-module>
diff --git a/chrome/browser/resources/settings/passwords_and_forms_page/passwords_export_dialog.js b/chrome/browser/resources/settings/passwords_and_forms_page/passwords_export_dialog.js
index 9730cb04..3a1d087 100644
--- a/chrome/browser/resources/settings/passwords_and_forms_page/passwords_export_dialog.js
+++ b/chrome/browser/resources/settings/passwords_and_forms_page/passwords_export_dialog.js
@@ -10,9 +10,43 @@
 (function() {
 'use strict';
 
+/**
+ * The states of the export passwords dialog.
+ * @enum {string}
+ */
+const States = {
+  START: 'START',
+  IN_PROGRESS: 'IN_PROGRESS',
+  ERROR: 'ERROR',
+};
+
+const ProgressStatus = chrome.passwordsPrivate.ExportProgressStatus;
+
+/**
+ * The amount of time (ms) between the start of the export and the moment we
+ * start showing the progress bar.
+ * @type {number}
+ */
+const progressBarDelayMs = 100;
+
+/**
+ * The minimum amount of time (ms) that the progress bar will be visible.
+ * @type {number}
+ */
+const progressBarBlockMs = 2000;
+
 Polymer({
   is: 'passwords-export-dialog',
 
+  behaviors: [I18nBehavior],
+
+  properties: {
+    /** The error that occurred while exporting. */
+    exportErrorMessage: String,
+  },
+
+  listeners: {'cancel': 'close'},
+
   /**
    * The interface for callbacks to the browser.
    * Defined in passwords_section.js
@@ -21,16 +55,114 @@
    */
   passwordManager_: null,
 
+  /** @private {function(!PasswordManager.PasswordExportProgress):void} */
+  onPasswordsFileExportProgressListener_: null,
+
+  /**
+   * The task that will display the progress bar, if the export doesn't finish
+   * quickly. This is null, unless the task is currently scheduled.
+   * @private {?number}
+   */
+  progressTaskToken_: null,
+
+  /**
+   * The task that will display the completion of the export, if any. We display
+   * the progress bar for at least 2000ms, therefore, if export finishes
+   * earlier, we cache the result in |delayedProgress_| and this task will
+   * consume it. This is null, unless the task is currently scheduled.
+   * @private {?number}
+   */
+  delayedCompletionToken_: null,
+
+  /**
+   * We display the progress bar for at least 2000ms. If progress is achieved
+   * earlier, we store the update here and consume it later.
+   * @private {?PasswordManager.PasswordExportProgress}
+   */
+  delayedProgress_: null,
+
   /** @override */
   attached: function() {
-    this.$.dialog.showModal();
-
     this.passwordManager_ = PasswordManagerImpl.getInstance();
+
+    this.switchToDialog_(States.START);
+
+    this.onPasswordsFileExportProgressListener_ =
+        this.onPasswordsFileExportProgress_.bind(this);
+
+    // If export started on a different tab and is still in progress, display a
+    // busy UI.
+    this.passwordManager_.requestExportProgressStatus(status => {
+      if (status == ProgressStatus.IN_PROGRESS)
+        this.switchToDialog_(States.IN_PROGRESS);
+    });
+
+    this.passwordManager_.addPasswordsFileExportProgressListener(
+        this.onPasswordsFileExportProgressListener_);
+  },
+
+  /**
+   * Handles an export progress event by changing the visible dialog or caching
+   * the event for later consumption.
+   * @param {!PasswordManager.PasswordExportProgress} progress
+   * @private
+   */
+  onPasswordsFileExportProgress_(progress) {
+    // If Chrome has already started displaying the progress bar
+    // (|progressTaskToken_ is null) and hasn't completed its minimum display
+    // time (|delayedCompletionToken_| is not null) progress should be cached
+    // for consumption when the blocking time ends.
+    const progressBlocked =
+        !this.progressTaskToken_ && !!this.delayedCompletionToken_;
+    if (!progressBlocked) {
+      clearTimeout(this.progressTaskToken_);
+      this.progressTaskToken_ = null;
+      this.processProgress_(progress);
+    } else {
+      this.delayedProgress_ = progress;
+    }
+  },
+
+  /**
+   * Displays the progress bar and suspends further UI updates for
+   * |progressBarBlockMs|.
+   * @private
+   */
+  progressTask_() {
+    this.progressTaskToken_ = null;
+    this.switchToDialog_(States.IN_PROGRESS);
+
+    this.delayedCompletionToken_ =
+        setTimeout(this.delayedCompletionTask_.bind(this), progressBarBlockMs);
+  },
+
+  /**
+   * Unblocks progress after showing the progress bar for |progressBarBlock|ms
+   * and processes any progress that was delayed.
+   * @private
+   */
+  delayedCompletionTask_() {
+    this.delayedCompletionToken_ = null;
+    if (this.delayedProgress_) {
+      this.processProgress_(this.delayedProgress_);
+      this.delayedProgress_ = null;
+    }
   },
 
   /** Closes the dialog. */
   close: function() {
-    this.$.dialog.close();
+    clearTimeout(this.progressTaskToken_);
+    clearTimeout(this.delayedCompletionToken_);
+    this.progressTaskToken_ = null;
+    this.delayedCompletionToken_ = null;
+    this.passwordManager_.removePasswordsFileExportProgressListener(
+        this.onPasswordsFileExportProgressListener_);
+    if (this.$.dialog_start.open)
+      this.$.dialog_start.close();
+    if (this.$.dialog_progress.open)
+      this.$.dialog_progress.close();
+    if (this.$.dialog_error.open)
+      this.$.dialog_error.close();
   },
 
   /**
@@ -38,15 +170,56 @@
    * @private
    */
   onExportTap_: function() {
-    this.passwordManager_.exportPasswords(this.onExportRequested_);
+    this.passwordManager_.exportPasswords(() => {
+      if (chrome.runtime.lastError &&
+          chrome.runtime.lastError.message == 'in-progress') {
+        // Exporting was started by a different call to exportPasswords() and is
+        // is still in progress. This UI needs to be updated to the current
+        // status.
+        this.switchToDialog_(States.IN_PROGRESS);
+      }
+    });
   },
 
   /**
-   * Callback to let us know whether our request for exporting was accepted.
+   * Prepares and displays the appropriate view (with delay, if necessary).
+   * @param {!PasswordManager.PasswordExportProgress} progress
    * @private
    */
-  onExportRequested_: function(accepted) {
-    // TODO(http://crbug/789561) Jump to "export in progress" UI.
+  processProgress_(progress) {
+    if (progress.status == ProgressStatus.IN_PROGRESS) {
+      this.progressTaskToken_ =
+          setTimeout(this.progressTask_.bind(this), progressBarDelayMs);
+      return;
+    }
+    if (progress.status == ProgressStatus.SUCCEEDED) {
+      this.close();
+      return;
+    }
+    if (progress.status == ProgressStatus.FAILED_WRITE_FAILED) {
+      this.exportErrorMessage =
+          this.i18n('exportPasswordsFailTitle', progress.folderName);
+      this.switchToDialog_(States.ERROR);
+      return;
+    }
+  },
+
+  /**
+   * Opens the specified dialog and hides the others.
+   * @param {!States} state the dialog to open.
+   * @private
+   */
+  switchToDialog_(state) {
+    this.$.dialog_start.open = false;
+    this.$.dialog_error.open = false;
+    this.$.dialog_progress.open = false;
+
+    if (state == States.START)
+      this.$.dialog_start.showModal();
+    if (state == States.ERROR)
+      this.$.dialog_error.showModal();
+    if (state == States.IN_PROGRESS)
+      this.$.dialog_progress.showModal();
   },
 
   /**
diff --git a/chrome/browser/search/one_google_bar/one_google_bar_fetcher_impl.cc b/chrome/browser/search/one_google_bar/one_google_bar_fetcher_impl.cc
index b5de9c4..f7d5c84 100644
--- a/chrome/browser/search/one_google_bar/one_google_bar_fetcher_impl.cc
+++ b/chrome/browser/search/one_google_bar/one_google_bar_fetcher_impl.cc
@@ -16,6 +16,8 @@
 #include "chrome/common/chrome_content_client.h"
 #include "components/google/core/browser/google_url_tracker.h"
 #include "components/google/core/browser/google_util.h"
+#include "components/signin/core/browser/chrome_connected_header_helper.h"
+#include "components/signin/core/browser/signin_header_helper.h"
 #include "components/variations/net/variations_http_headers.h"
 #include "content/public/common/service_manager_connection.h"
 #include "net/base/load_flags.h"
@@ -135,6 +137,7 @@
                           const GURL& google_base_url,
                           const std::string& application_locale,
                           const base::Optional<std::string>& api_url_override,
+                          bool account_consistency_mirror_required,
                           FetchDoneCallback callback);
   ~AuthenticatedURLFetcher() override = default;
 
@@ -151,6 +154,9 @@
   const GURL google_base_url_;
   const std::string application_locale_;
   const base::Optional<std::string> api_url_override_;
+#if defined(OS_CHROMEOS)
+  const bool account_consistency_mirror_required_;
+#endif
 
   FetchDoneCallback callback_;
 
@@ -163,11 +169,15 @@
     const GURL& google_base_url,
     const std::string& application_locale,
     const base::Optional<std::string>& api_url_override,
+    bool account_consistency_mirror_required,
     FetchDoneCallback callback)
     : request_context_(request_context),
       google_base_url_(google_base_url),
       application_locale_(application_locale),
       api_url_override_(api_url_override),
+#if defined(OS_CHROMEOS)
+      account_consistency_mirror_required_(account_consistency_mirror_required),
+#endif
       callback_(std::move(callback)) {}
 
 GURL OneGoogleBarFetcherImpl::AuthenticatedURLFetcher::GetApiUrl() const {
@@ -193,6 +203,27 @@
   // transmission of experiments coming from the variations server.
   variations::AppendVariationHeaders(url, variations::InIncognito::kNo,
                                      variations::SignedIn::kNo, &headers);
+#if defined(OS_CHROMEOS)
+  signin::ChromeConnectedHeaderHelper chrome_connected_header_helper(
+      account_consistency_mirror_required_);
+  int profile_mode = signin::PROFILE_MODE_DEFAULT;
+  if (account_consistency_mirror_required_) {
+    // For the child account case (where currently
+    // |account_consistency_mirror_required_| is true on Chrome OS), we always
+    // want to disable adding an account and going to incognito.
+    profile_mode = signin::PROFILE_MODE_INCOGNITO_DISABLED |
+                   signin::PROFILE_MODE_ADD_ACCOUNT_DISABLED;
+  }
+  std::string chrome_connected_header_value =
+      chrome_connected_header_helper.BuildRequestHeader(
+          /*is_header_request=*/true, url,
+          // Account ID is only needed for (drive|docs).google.com.
+          /*account_id=*/std::string(), profile_mode);
+  if (!chrome_connected_header_value.empty()) {
+    headers.SetHeader(signin::kChromeConnectedHeader,
+                      chrome_connected_header_value);
+  }
+#endif
   return headers.ToString();
 }
 
@@ -241,11 +272,13 @@
     net::URLRequestContextGetter* request_context,
     GoogleURLTracker* google_url_tracker,
     const std::string& application_locale,
-    const base::Optional<std::string>& api_url_override)
+    const base::Optional<std::string>& api_url_override,
+    bool account_consistency_mirror_required)
     : request_context_(request_context),
       google_url_tracker_(google_url_tracker),
       application_locale_(application_locale),
       api_url_override_(api_url_override),
+      account_consistency_mirror_required_(account_consistency_mirror_required),
       weak_ptr_factory_(this) {}
 
 OneGoogleBarFetcherImpl::~OneGoogleBarFetcherImpl() = default;
@@ -263,6 +296,7 @@
   // the result obsolete.
   pending_request_ = base::MakeUnique<AuthenticatedURLFetcher>(
       request_context_, google_base_url, application_locale_, api_url_override_,
+      account_consistency_mirror_required_,
       base::BindOnce(&OneGoogleBarFetcherImpl::FetchDone,
                      base::Unretained(this)));
   pending_request_->Start();
diff --git a/chrome/browser/search/one_google_bar/one_google_bar_fetcher_impl.h b/chrome/browser/search/one_google_bar/one_google_bar_fetcher_impl.h
index 1c4eaf4..0104272 100644
--- a/chrome/browser/search/one_google_bar/one_google_bar_fetcher_impl.h
+++ b/chrome/browser/search/one_google_bar/one_google_bar_fetcher_impl.h
@@ -37,7 +37,8 @@
   OneGoogleBarFetcherImpl(net::URLRequestContextGetter* request_context,
                           GoogleURLTracker* google_url_tracker,
                           const std::string& application_locale,
-                          const base::Optional<std::string>& api_url_override);
+                          const base::Optional<std::string>& api_url_override,
+                          bool account_consistency_mirror_required);
   ~OneGoogleBarFetcherImpl() override;
 
   void Fetch(OneGoogleCallback callback) override;
@@ -56,6 +57,7 @@
   GoogleURLTracker* google_url_tracker_;
   const std::string application_locale_;
   const base::Optional<std::string> api_url_override_;
+  const bool account_consistency_mirror_required_;
 
   std::vector<OneGoogleCallback> callbacks_;
   std::unique_ptr<AuthenticatedURLFetcher> pending_request_;
diff --git a/chrome/browser/search/one_google_bar/one_google_bar_fetcher_impl_unittest.cc b/chrome/browser/search/one_google_bar/one_google_bar_fetcher_impl_unittest.cc
index 4ca9bb7..f5d317a5 100644
--- a/chrome/browser/search/one_google_bar/one_google_bar_fetcher_impl_unittest.cc
+++ b/chrome/browser/search/one_google_bar/one_google_bar_fetcher_impl_unittest.cc
@@ -15,6 +15,7 @@
 #include "base/time/time.h"
 #include "chrome/browser/search/one_google_bar/one_google_bar_data.h"
 #include "components/google/core/browser/google_url_tracker.h"
+#include "components/signin/core/browser/signin_header_helper.h"
 #include "content/public/test/test_browser_thread_bundle.h"
 #include "content/public/test/test_service_manager_context.h"
 #include "net/http/http_request_headers.h"
@@ -59,10 +60,24 @@
 
 class OneGoogleBarFetcherImplTest : public testing::Test {
  public:
-  OneGoogleBarFetcherImplTest() : OneGoogleBarFetcherImplTest(base::nullopt) {}
+  OneGoogleBarFetcherImplTest()
+      : OneGoogleBarFetcherImplTest(
+            /*api_url_override=*/base::nullopt,
+            /*account_consistency_mirror_required=*/false) {}
+
+  explicit OneGoogleBarFetcherImplTest(
+      const base::Optional<std::string>& api_url_override)
+      : OneGoogleBarFetcherImplTest(
+            api_url_override,
+            /*account_consistency_mirror_required=*/false) {}
+
+  explicit OneGoogleBarFetcherImplTest(bool account_consistency_mirror_required)
+      : OneGoogleBarFetcherImplTest(/*api_url_override=*/base::nullopt,
+                                    account_consistency_mirror_required) {}
 
   OneGoogleBarFetcherImplTest(
-      const base::Optional<std::string>& api_url_override)
+      const base::Optional<std::string>& api_url_override,
+      bool account_consistency_mirror_required)
       : task_runner_(new base::TestSimpleTaskRunner()),
         request_context_getter_(
             new net::TestURLRequestContextGetter(task_runner_)),
@@ -71,7 +86,8 @@
         one_google_bar_fetcher_(request_context_getter_.get(),
                                 &google_url_tracker_,
                                 kApplicationLocale,
-                                api_url_override) {}
+                                api_url_override,
+                                account_consistency_mirror_required) {}
 
   net::TestURLFetcher* GetRunningURLFetcher() {
     // All created URLFetchers have ID 0 by default.
@@ -292,6 +308,58 @@
 }}})json");
 }
 
+TEST_F(OneGoogleBarFetcherImplTest, MirrorAccountConsistencyNotRequired) {
+  // Trigger a request.
+  base::MockCallback<OneGoogleBarFetcher::OneGoogleCallback> callback;
+  one_google_bar_fetcher()->Fetch(callback.Get());
+  net::TestURLFetcher* fetcher = GetRunningURLFetcher();
+
+  net::HttpRequestHeaders headers;
+  fetcher->GetExtraRequestHeaders(&headers);
+#if defined(OS_CHROMEOS)
+  // On Chrome OS, X-Chrome-Connected header is present, but
+  // enable_account_consistency is set to false.
+  std::string header_value;
+  EXPECT_TRUE(headers.GetHeader(signin::kChromeConnectedHeader, &header_value));
+  // mode = PROFILE_MODE_DEFAULT
+  EXPECT_EQ("mode=0,enable_account_consistency=false", header_value);
+#else
+  // On not Chrome OS, the X-Chrome-Connected header must not be present.
+  EXPECT_FALSE(headers.HasHeader(signin::kChromeConnectedHeader));
+#endif
+}
+
+class OneGoogleBarFetcherImplWithMirrorAccountConsistencyTest
+    : public OneGoogleBarFetcherImplTest {
+ public:
+  OneGoogleBarFetcherImplWithMirrorAccountConsistencyTest()
+      : OneGoogleBarFetcherImplTest(true) {}
+};
+
+TEST_F(OneGoogleBarFetcherImplWithMirrorAccountConsistencyTest,
+       MirrorAccountConsistencyRequired) {
+  // Trigger a request.
+  base::MockCallback<OneGoogleBarFetcher::OneGoogleCallback> callback;
+  one_google_bar_fetcher()->Fetch(callback.Get());
+  net::TestURLFetcher* fetcher = GetRunningURLFetcher();
+
+  // Make sure mirror account consistency is requested.
+  net::HttpRequestHeaders headers;
+  fetcher->GetExtraRequestHeaders(&headers);
+#if defined(OS_CHROMEOS)
+  // On Chrome OS, X-Chrome-Connected header is present, and
+  // enable_account_consistency is set to true.
+  std::string header_value;
+  EXPECT_TRUE(headers.GetHeader(signin::kChromeConnectedHeader, &header_value));
+  // mode = PROFILE_MODE_INCOGNITO_DISABLED | PROFILE_MODE_ADD_ACCOUNT_DISABLED
+  EXPECT_EQ("mode=3,enable_account_consistency=true", header_value);
+#else
+  // This is not a valid case (mirror account consistency can only be required
+  // on Chrome OS). This ensures in this case nothing happens.
+  EXPECT_FALSE(headers.HasHeader(signin::kChromeConnectedHeader));
+#endif
+}
+
 class OneGoogleBarFetcherImplWithRelativeApiUrlOverrideTest
     : public OneGoogleBarFetcherImplTest {
  public:
diff --git a/chrome/browser/search/one_google_bar/one_google_bar_service_factory.cc b/chrome/browser/search/one_google_bar/one_google_bar_service_factory.cc
index 526b5849..e7372dd 100644
--- a/chrome/browser/search/one_google_bar/one_google_bar_service_factory.cc
+++ b/chrome/browser/search/one_google_bar/one_google_bar_service_factory.cc
@@ -4,18 +4,24 @@
 
 #include "chrome/browser/search/one_google_bar/one_google_bar_service_factory.h"
 
+#include <string>
+
 #include "base/feature_list.h"
 #include "base/memory/ptr_util.h"
 #include "base/metrics/field_trial_params.h"
 #include "base/optional.h"
 #include "chrome/browser/browser_process.h"
+#include "chrome/browser/content_settings/cookie_settings_factory.h"
 #include "chrome/browser/google/google_url_tracker_factory.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/search/one_google_bar/one_google_bar_fetcher_impl.h"
 #include "chrome/browser/search/one_google_bar/one_google_bar_service.h"
+#include "chrome/browser/signin/account_consistency_mode_manager.h"
 #include "chrome/browser/signin/gaia_cookie_manager_service_factory.h"
 #include "chrome/common/chrome_features.h"
+#include "components/content_settings/core/browser/cookie_settings.h"
 #include "components/keyed_service/content/browser_context_dependency_manager.h"
+#include "components/signin/core/browser/signin_header_helper.h"
 #include "content/public/browser/browser_context.h"
 
 // static
@@ -34,6 +40,7 @@
     : BrowserContextKeyedServiceFactory(
           "OneGoogleBarService",
           BrowserContextDependencyManager::GetInstance()) {
+  DependsOn(CookieSettingsFactory::GetInstance());
   DependsOn(GaiaCookieManagerServiceFactory::GetInstance());
   DependsOn(GoogleURLTrackerFactory::GetInstance());
 }
@@ -57,9 +64,13 @@
   if (!override_api_url_str.empty()) {
     override_api_url = override_api_url_str;
   }
+  content_settings::CookieSettings* cookie_settings =
+      CookieSettingsFactory::GetForProfile(profile).get();
   return new OneGoogleBarService(
       cookie_service,
       base::MakeUnique<OneGoogleBarFetcherImpl>(
           profile->GetRequestContext(), google_url_tracker,
-          g_browser_process->GetApplicationLocale(), override_api_url));
+          g_browser_process->GetApplicationLocale(), override_api_url,
+          AccountConsistencyModeManager::IsMirrorEnabledForProfile(profile) &&
+              signin::SettingsAllowSigninCookies(cookie_settings)));
 }
diff --git a/chrome/browser/sessions/better_session_restore_browsertest.cc b/chrome/browser/sessions/better_session_restore_browsertest.cc
index e4bc973..bb15de18 100644
--- a/chrome/browser/sessions/better_session_restore_browsertest.cc
+++ b/chrome/browser/sessions/better_session_restore_browsertest.cc
@@ -47,7 +47,6 @@
 #include "components/keep_alive_registry/scoped_keep_alive.h"
 #include "components/prefs/pref_service.h"
 #include "content/public/browser/web_contents.h"
-#include "content/public/common/content_features.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/url_loader_interceptor.h"
@@ -57,6 +56,7 @@
 #include "net/url_request/url_request_filter.h"
 #include "net/url_request/url_request_interceptor.h"
 #include "net/url_request/url_request_test_job.h"
+#include "services/network/public/cpp/features.h"
 
 #if defined(OS_MACOSX)
 #include "base/mac/scoped_nsautorelease_pool.h"
@@ -185,7 +185,7 @@
     // SetUpOnMainThread(), because during a session restore the restored tab
     // comes up before SetUpOnMainThread().  Note that at this point, we do not
     // have a profile.
-    if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+    if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
       url_loader_interceptor_ = std::make_unique<content::URLLoaderInterceptor>(
           base::BindLambdaForTesting(
               [&](content::URLLoaderInterceptor::RequestParams* params) {
diff --git a/chrome/browser/signin/dice_response_handler.cc b/chrome/browser/signin/dice_response_handler.cc
index 7799ebf2..5d1e0c9 100644
--- a/chrome/browser/signin/dice_response_handler.cc
+++ b/chrome/browser/signin/dice_response_handler.cc
@@ -49,6 +49,8 @@
   kSignoutPrimary = 1,
   // Received a signout header for other account(s).
   kSignoutSecondary = 2,
+  // Received a "EnableSync" header.
+  kEnableSync = 3,
 
   kDiceResponseHeaderCount
 };
@@ -312,6 +314,7 @@
     const std::string& email,
     std::unique_ptr<ProcessDiceHeaderDelegate> delegate) {
   VLOG(1) << "Start processing Dice enable sync response";
+  RecordDiceResponseHeader(kEnableSync);
   for (auto it = token_fetchers_.begin(); it != token_fetchers_.end(); ++it) {
     DiceTokenFetcher* fetcher = it->get();
     if (fetcher->gaia_id() == gaia_id) {
@@ -340,20 +343,21 @@
 
   // If one of the signed out accounts is the main Chrome account, then force a
   // complete signout. Otherwise simply revoke the corresponding tokens.
-  std::string current_account = signin_manager_->GetAuthenticatedAccountId();
-  std::vector<std::string> signed_out_accounts;
+  std::string primary_account = signin_manager_->GetAuthenticatedAccountId();
+  std::vector<std::string> secondary_accounts;
   for (const auto& account_info : account_infos) {
     std::string signed_out_account =
         account_tracker_service_->PickAccountIdForAccount(account_info.gaia_id,
                                                           account_info.email);
-    if (signed_out_account == current_account) {
+    if (signed_out_account == primary_account) {
+      RecordDiceResponseHeader(kSignoutPrimary);
+
       // If Dice migration is not complete, the token for the main account must
       // not be deleted when signing out of the web.
       if (!signin::IsDiceEnabledForProfile(signin_client_->GetPrefs()))
         continue;
 
       VLOG(1) << "[Dice] Signing out all accounts.";
-      RecordDiceResponseHeader(kSignoutPrimary);
       signin_manager_->SignOutAndRemoveAllAccounts(
           signin_metrics::SERVER_FORCED_DISABLE,
           signin_metrics::SignoutDelete::IGNORE_METRIC);
@@ -361,12 +365,16 @@
       token_fetchers_.clear();
       return;
     } else {
-      signed_out_accounts.push_back(signed_out_account);
+      secondary_accounts.push_back(signed_out_account);
     }
   }
 
-  RecordDiceResponseHeader(kSignoutSecondary);
-  for (const auto& account : signed_out_accounts) {
+  if (signin::IsDiceEnabledForProfile(signin_client_->GetPrefs()) ||
+      secondary_accounts.size() == account_infos.size()) {
+    RecordDiceResponseHeader(kSignoutSecondary);
+  }
+
+  for (const auto& account : secondary_accounts) {
     VLOG(1) << "[Dice]: Revoking token for account: " << account;
     token_service_->RevokeCredentials(account);
     // If a token fetch is in flight for the same account, cancel it.
diff --git a/chrome/browser/ssl/DEPS b/chrome/browser/ssl/DEPS
index a565ea0..6c8b2b42 100644
--- a/chrome/browser/ssl/DEPS
+++ b/chrome/browser/ssl/DEPS
@@ -7,6 +7,6 @@
   "cert_verifier_browser_test.cc": [
     # TODO(jam): Temporary until it or a public header is available in
     # services/network.
-    "+content/network/network_context.h",
+    "+services/network/network_context.h",
   ],
 }
diff --git a/chrome/browser/ssl/cert_verifier_browser_test.cc b/chrome/browser/ssl/cert_verifier_browser_test.cc
index 53a95c3..205370e 100644
--- a/chrome/browser/ssl/cert_verifier_browser_test.cc
+++ b/chrome/browser/ssl/cert_verifier_browser_test.cc
@@ -6,14 +6,14 @@
 
 #include "base/command_line.h"
 #include "chrome/browser/profiles/profile_io_data.h"
-#include "content/network/network_context.h"
-#include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/service_manager_connection.h"
 #include "content/public/common/service_names.mojom.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/network_service_test_helper.h"
 #include "mojo/public/cpp/bindings/sync_call_restrictions.h"
+#include "services/network/network_context.h"
+#include "services/network/public/cpp/features.h"
 #include "services/service_manager/public/cpp/connector.h"
 
 CertVerifierBrowserTest::CertVerifier::CertVerifier(
@@ -26,7 +26,7 @@
     int default_result) {
   verifier_->set_default_result(default_result);
 
-  if (!base::FeatureList::IsEnabled(features::kNetworkService) ||
+  if (!base::FeatureList::IsEnabled(network::features::kNetworkService) ||
       content::IsNetworkServiceRunningInProcess()) {
     return;
   }
@@ -50,7 +50,7 @@
     int rv) {
   verifier_->AddResultForCertAndHost(cert, host_pattern, verify_result, rv);
 
-  if (!base::FeatureList::IsEnabled(features::kNetworkService) ||
+  if (!base::FeatureList::IsEnabled(network::features::kNetworkService) ||
       content::IsNetworkServiceRunningInProcess()) {
     return;
   }
@@ -83,7 +83,7 @@
     base::CommandLine* command_line) {
   // Check here instead of the constructor since some tests may set the feature
   // flag in their constructor.
-  if (!base::FeatureList::IsEnabled(features::kNetworkService) ||
+  if (!base::FeatureList::IsEnabled(network::features::kNetworkService) ||
       content::IsNetworkServiceRunningInProcess()) {
     return;
   }
@@ -99,7 +99,7 @@
   ProfileIOData::SetCertVerifierForTesting(mock_cert_verifier_.get());
 
   if (content::IsNetworkServiceRunningInProcess()) {
-    content::NetworkContext::SetCertVerifierForTesting(
+    network::NetworkContext::SetCertVerifierForTesting(
         mock_cert_verifier_.get());
   }
 }
@@ -107,7 +107,7 @@
 void CertVerifierBrowserTest::TearDownInProcessBrowserTestFixture() {
   ProfileIOData::SetCertVerifierForTesting(nullptr);
   if (content::IsNetworkServiceRunningInProcess())
-    content::NetworkContext::SetCertVerifierForTesting(nullptr);
+    network::NetworkContext::SetCertVerifierForTesting(nullptr);
 }
 
 CertVerifierBrowserTest::CertVerifier*
diff --git a/chrome/browser/ssl/ssl_browsertest.cc b/chrome/browser/ssl/ssl_browsertest.cc
index 4f2607c..4ee54b9 100644
--- a/chrome/browser/ssl/ssl_browsertest.cc
+++ b/chrome/browser/ssl/ssl_browsertest.cc
@@ -112,7 +112,6 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/common/browser_side_navigation_policy.h"
-#include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/page_state.h"
 #include "content/public/common/web_preferences.h"
@@ -149,6 +148,8 @@
 #include "net/url_request/url_request_filter.h"
 #include "net/url_request/url_request_job.h"
 #include "net/url_request/url_request_test_util.h"
+#include "services/network/public/cpp/features.h"
+#include "services/network/public/cpp/network_switches.h"
 #include "third_party/WebKit/common/associated_interfaces/associated_interface_provider.h"
 #include "ui/base/l10n/l10n_util.h"
 
@@ -445,7 +446,7 @@
   std::string hostname = kHstsTestHostName;
   const base::Time expiry = base::Time::Now() + base::TimeDelta::FromDays(1000);
   bool include_subdomains = false;
-  if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     mojo::ScopedAllowSyncCallForTesting allow_sync_call;
     content::StoragePartition* partition =
         content::BrowserContext::GetDefaultStoragePartition(profile);
@@ -1123,8 +1124,8 @@
         https_server_mismatched_.GetCertificate().get());
     // Browser will ignore certificate errors for chains matching one of the
     // public keys from the list.
-    command_line->AppendSwitchASCII(switches::kIgnoreCertificateErrorsSPKIList,
-                                    whitelist_flag);
+    command_line->AppendSwitchASCII(
+        network::switches::kIgnoreCertificateErrorsSPKIList, whitelist_flag);
   }
 };
 
@@ -1142,8 +1143,8 @@
         MakeCertSPKIFingerprint(wss_server_expired_.GetCertificate().get());
     // Browser will ignore certificate errors for chains matching one of the
     // public keys from the list.
-    command_line->AppendSwitchASCII(switches::kIgnoreCertificateErrorsSPKIList,
-                                    whitelist_flag);
+    command_line->AppendSwitchASCII(
+        network::switches::kIgnoreCertificateErrorsSPKIList, whitelist_flag);
   }
 };
 
@@ -6929,7 +6930,7 @@
   }
 }
 
-// Checks that SimpleURLLoader, which uses content/network/url_loader.cc, goes
+// Checks that SimpleURLLoader, which uses services/network/url_loader.cc, goes
 // through the new NetworkServiceClient interface to deliver cert error
 // notifications to the browser which then overrides the certificate error.
 IN_PROC_BROWSER_TEST_F(SSLUITestBase, SimpleURLLoaderCertError) {
diff --git a/chrome/browser/ui/BUILD.gn b/chrome/browser/ui/BUILD.gn
index fc5012f..de6e1d77 100644
--- a/chrome/browser/ui/BUILD.gn
+++ b/chrome/browser/ui/BUILD.gn
@@ -1492,9 +1492,6 @@
       "tabs/tab_change_type.h",
       "tabs/tab_menu_model.cc",
       "tabs/tab_menu_model.h",
-      "tabs/tab_metrics_logger.h",
-      "tabs/tab_metrics_logger_impl.cc",
-      "tabs/tab_metrics_logger_impl.h",
       "tabs/tab_network_state.cc",
       "tabs/tab_network_state.h",
       "tabs/tab_strip_model.cc",
@@ -1738,7 +1735,7 @@
       "//chrome/browser:theme_properties",
       "//chrome/browser/media/router",
       "//chrome/browser/profile_resetter:profile_reset_report_proto",
-      "//chrome/browser/ui/tabs:tab_metrics_event_proto",
+      "//chrome/browser/resource_coordinator:tab_metrics_event_proto",
       "//chrome/common:features",
       "//chrome/common:search_mojom",
       "//components/feedback/proto",
@@ -1925,8 +1922,6 @@
       "views/frame/browser_frame_header_ash.h",
       "views/frame/browser_non_client_frame_view_ash.cc",
       "views/frame/browser_non_client_frame_view_ash.h",
-      "views/frame/hosted_app_frame_header_ash.cc",
-      "views/frame/hosted_app_frame_header_ash.h",
       "views/frame/immersive_context_mus.cc",
       "views/frame/immersive_context_mus.h",
       "views/frame/immersive_handler_factory_mus.cc",
diff --git a/chrome/browser/ui/overlay/overlay_surface_embedder.cc b/chrome/browser/ui/overlay/overlay_surface_embedder.cc
index b7c0581..c90f435 100644
--- a/chrome/browser/ui/overlay/overlay_surface_embedder.cc
+++ b/chrome/browser/ui/overlay/overlay_surface_embedder.cc
@@ -22,6 +22,7 @@
 void OverlaySurfaceEmbedder::SetPrimarySurfaceId(
     const viz::SurfaceId& surface_id) {
   // SurfaceInfo has information about the embedded surface.
-  surface_layer_->SetShowPrimarySurface(surface_id, window_->GetBounds().size(),
-                                        SK_ColorBLACK);
+  surface_layer_->SetShowPrimarySurface(
+      surface_id, window_->GetBounds().size(), SK_ColorBLACK,
+      cc::DeadlinePolicy::UseDefaultDeadline());
 }
diff --git a/chrome/browser/ui/startup/bad_flags_prompt.cc b/chrome/browser/ui/startup/bad_flags_prompt.cc
index 85d4473..c310382 100644
--- a/chrome/browser/ui/startup/bad_flags_prompt.cc
+++ b/chrome/browser/ui/startup/bad_flags_prompt.cc
@@ -32,6 +32,7 @@
 #include "google_apis/gaia/gaia_switches.h"
 #include "media/base/media_switches.h"
 #include "media/media_features.h"
+#include "services/network/public/cpp/network_switches.h"
 #include "services/service_manager/sandbox/switches.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/resource/resource_bundle.h"
@@ -66,6 +67,7 @@
   // Unsupported flags for which to display a warning that "stability and
   // security will suffer".
   static const char* kBadFlags[] = {
+    network::switches::kIgnoreCertificateErrorsSPKIList,
     // These flags disable sandbox-related security.
     service_manager::switches::kDisableGpuSandbox,
     service_manager::switches::kDisableSeccompFilterSandbox,
@@ -88,7 +90,6 @@
     switches::kDisableWebRtcEncryption,
 #endif
     switches::kIgnoreCertificateErrors,
-    switches::kIgnoreCertificateErrorsSPKIList,
     invalidation::switches::kSyncAllowInsecureXmppConnection,
 
     // These flags change the URLs that handle PII.
diff --git a/chrome/browser/ui/tabs/window_activity_watcher.cc b/chrome/browser/ui/tabs/window_activity_watcher.cc
index e2bde563..ceb3532 100644
--- a/chrome/browser/ui/tabs/window_activity_watcher.cc
+++ b/chrome/browser/ui/tabs/window_activity_watcher.cc
@@ -7,10 +7,10 @@
 #include "base/optional.h"
 #include "base/scoped_observer.h"
 #include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/resource_coordinator/tab_metrics_event.pb.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_list.h"
 #include "chrome/browser/ui/browser_window.h"
-#include "chrome/browser/ui/tabs/tab_metrics_event.pb.h"
 #include "services/metrics/public/cpp/metrics_utils.h"
 #include "services/metrics/public/cpp/ukm_builders.h"
 #include "services/metrics/public/cpp/ukm_recorder.h"
diff --git a/chrome/browser/ui/tabs/window_activity_watcher_unittest.cc b/chrome/browser/ui/tabs/window_activity_watcher_unittest.cc
index 3820da30..a938fac6 100644
--- a/chrome/browser/ui/tabs/window_activity_watcher_unittest.cc
+++ b/chrome/browser/ui/tabs/window_activity_watcher_unittest.cc
@@ -10,9 +10,9 @@
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/strings/stringprintf.h"
+#include "chrome/browser/resource_coordinator/tab_metrics_event.pb.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_list.h"
-#include "chrome/browser/ui/tabs/tab_metrics_event.pb.h"
 #include "chrome/browser/ui/tabs/tab_ukm_test_helper.h"
 #include "chrome/test/base/test_browser_window.h"
 #include "chrome/test/base/testing_profile.h"
diff --git a/chrome/browser/ui/views/frame/browser_non_client_frame_view_ash.cc b/chrome/browser/ui/views/frame/browser_non_client_frame_view_ash.cc
index 697abbb2..88103aa0 100644
--- a/chrome/browser/ui/views/frame/browser_non_client_frame_view_ash.cc
+++ b/chrome/browser/ui/views/frame/browser_non_client_frame_view_ash.cc
@@ -30,7 +30,6 @@
 #include "chrome/browser/ui/views/frame/browser_frame_header_ash.h"
 #include "chrome/browser/ui/views/frame/browser_view.h"
 #include "chrome/browser/ui/views/frame/hosted_app_button_container.h"
-#include "chrome/browser/ui/views/frame/hosted_app_frame_header_ash.h"
 #include "chrome/browser/ui/views/frame/immersive_mode_controller.h"
 #include "chrome/browser/ui/views/profiles/profile_indicator_icon.h"
 #include "chrome/browser/ui/views/tab_icon_view.h"
@@ -522,12 +521,20 @@
                                caption_button_container_, back_button_);
     return browser_frame_header;
   }
-  std::unique_ptr<ash::DefaultFrameHeader> default_frame_header = nullptr;
+  std::unique_ptr<ash::DefaultFrameHeader> default_frame_header =
+      std::make_unique<ash::DefaultFrameHeader>(frame(), this,
+                                                caption_button_container_);
   if (extensions::HostedAppBrowserController::IsForExperimentalHostedAppBrowser(
           browser)) {
-    default_frame_header = std::make_unique<HostedAppFrameHeaderAsh>(
-        browser->hosted_app_controller(), frame(), this,
-        caption_button_container_);
+    // Hosted apps apply a theme color if specified by the extension.
+    base::Optional<SkColor> theme_color =
+        browser->hosted_app_controller()->GetThemeColor();
+    if (theme_color) {
+      SkColor opaque_theme_color =
+          SkColorSetA(theme_color.value(), SK_AlphaOPAQUE);
+      default_frame_header->SetFrameColors(opaque_theme_color,
+                                           opaque_theme_color);
+    }
 
     // Add the container for extra hosted app buttons (e.g app menu button).
     SkColor button_color = ash::FrameCaptionButton::GetButtonColor(
@@ -537,14 +544,10 @@
         SkColorSetA(button_color,
                     255 * ash::kInactiveFrameButtonIconAlphaRatio));
     caption_button_container_->AddChildViewAt(hosted_app_button_container_, 0);
-  } else {
-    default_frame_header = std::make_unique<ash::DefaultFrameHeader>(
-        frame(), this, caption_button_container_);
-    if (!browser->is_app()) {
-      // For non app (i.e. WebUI) windows (e.g. Settings) use MD frame color.
-      default_frame_header->SetFrameColors(kMdWebUIFrameColor,
-                                           kMdWebUIFrameColor);
-    }
+  } else if (!browser->is_app()) {
+    // For non app (i.e. WebUI) windows (e.g. Settings) use MD frame color.
+    default_frame_header->SetFrameColors(kMdWebUIFrameColor,
+                                         kMdWebUIFrameColor);
   }
 
   if (back_button_)
diff --git a/chrome/browser/ui/views/frame/browser_non_client_frame_view_ash_browsertest.cc b/chrome/browser/ui/views/frame/browser_non_client_frame_view_ash_browsertest.cc
index 1dcfd95f..067ade2 100644
--- a/chrome/browser/ui/views/frame/browser_non_client_frame_view_ash_browsertest.cc
+++ b/chrome/browser/ui/views/frame/browser_non_client_frame_view_ash_browsertest.cc
@@ -7,6 +7,7 @@
 #include "ash/ash_constants.h"
 #include "ash/frame/caption_buttons/frame_caption_button.h"
 #include "ash/frame/caption_buttons/frame_caption_button_container_view.h"
+#include "ash/frame/default_frame_header.h"
 #include "ash/frame/frame_header.h"
 #include "ash/public/cpp/ash_switches.h"
 #include "ash/public/cpp/immersive/immersive_fullscreen_controller_test_api.h"
@@ -35,7 +36,6 @@
 #include "chrome/browser/ui/views/bookmarks/bookmark_bar_view.h"
 #include "chrome/browser/ui/views/frame/browser_view.h"
 #include "chrome/browser/ui/views/frame/hosted_app_button_container.h"
-#include "chrome/browser/ui/views/frame/hosted_app_frame_header_ash.h"
 #include "chrome/browser/ui/views/frame/immersive_mode_controller.h"
 #include "chrome/browser/ui/views/frame/immersive_mode_controller_ash.h"
 #include "chrome/browser/ui/views/profiles/profile_indicator_icon.h"
@@ -494,7 +494,7 @@
 
   // Ensure the theme color is set.
   auto* frame_header =
-      static_cast<HostedAppFrameHeaderAsh*>(frame_view->frame_header_.get());
+      static_cast<ash::DefaultFrameHeader*>(frame_view->frame_header_.get());
   EXPECT_EQ(SK_ColorBLUE, frame_header->GetActiveFrameColor());
   EXPECT_EQ(SK_ColorBLUE, frame_header->GetInactiveFrameColor());
   EXPECT_EQ(SK_ColorWHITE, button_container->active_icon_color_);
@@ -549,26 +549,6 @@
   histograms.ExpectBucketCount(
       "ContentSettings.ImagePressed",
       static_cast<int>(ContentSettingImageModel::ImageType::GEOLOCATION), 1);
-
-  // The app and domain should render next to the window title.
-  frame_header->LayoutRenderTexts(gfx::Rect(300, 30), 100, 100);
-  EXPECT_EQ(gfx::Rect(100, 30),
-            frame_header->title_render_text_->display_rect());
-  EXPECT_EQ(gfx::Rect(100, 0, 100, 30),
-            frame_header->app_and_domain_render_text_->display_rect());
-
-  // The title should prefer truncating the window title.
-  frame_header->LayoutRenderTexts(gfx::Rect(300, 30), 250, 100);
-  EXPECT_EQ(gfx::Rect(200, 30),
-            frame_header->title_render_text_->display_rect());
-  EXPECT_EQ(gfx::Rect(200, 0, 100, 30),
-            frame_header->app_and_domain_render_text_->display_rect());
-
-  // The app and domain should be clipped to the available title bounds.
-  frame_header->LayoutRenderTexts(gfx::Rect(60, 30), 250, 100);
-  EXPECT_EQ(gfx::Rect(0, 30), frame_header->title_render_text_->display_rect());
-  EXPECT_EQ(gfx::Rect(60, 30),
-            frame_header->app_and_domain_render_text_->display_rect());
 }
 
 namespace {
diff --git a/chrome/browser/ui/views/frame/browser_view.cc b/chrome/browser/ui/views/frame/browser_view.cc
index 4f2019f..e6ad4b4f 100644
--- a/chrome/browser/ui/views/frame/browser_view.cc
+++ b/chrome/browser/ui/views/frame/browser_view.cc
@@ -1615,13 +1615,6 @@
 
 bool BrowserView::ShouldShowWindowTitle() const {
 #if defined(OS_CHROMEOS)
-  // Hosted apps on ChromeOS should always show their window icon.
-  if (extensions::HostedAppBrowserController::IsForExperimentalHostedAppBrowser(
-          browser())) {
-    DCHECK(browser_->SupportsWindowFeature(Browser::FEATURE_TITLEBAR));
-    return true;
-  }
-
   // For Chrome OS only, trusted windows (apps and settings) do not show a
   // title, crbug.com/119411. Child windows (i.e. popups) do show a title.
   if (browser_->is_trusted_source()) {
diff --git a/chrome/browser/ui/views/frame/hosted_app_frame_header_ash.cc b/chrome/browser/ui/views/frame/hosted_app_frame_header_ash.cc
deleted file mode 100644
index 8ee1968..0000000
--- a/chrome/browser/ui/views/frame/hosted_app_frame_header_ash.cc
+++ /dev/null
@@ -1,111 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chrome/browser/ui/views/frame/hosted_app_frame_header_ash.h"
-
-#include "base/strings/utf_string_conversions.h"
-#include "chrome/browser/ui/extensions/hosted_app_browser_controller.h"
-#include "chrome/grit/generated_resources.h"
-#include "ui/base/l10n/l10n_util.h"
-#include "ui/gfx/canvas.h"
-#include "ui/gfx/render_text.h"
-#include "ui/views/view.h"
-#include "ui/views/widget/native_widget_aura.h"
-
-HostedAppFrameHeaderAsh::HostedAppFrameHeaderAsh(
-    extensions::HostedAppBrowserController* app_controller,
-    views::Widget* frame,
-    views::View* header_view,
-    ash::FrameCaptionButtonContainerView* caption_button_container)
-    : DefaultFrameHeader(frame, header_view, caption_button_container),
-      app_controller_(app_controller),
-      app_name_(base::UTF8ToUTF16(app_controller->GetAppShortName())),
-      app_and_domain_(l10n_util::GetStringFUTF16(
-          IDS_HOSTED_APP_NAME_AND_DOMAIN,
-          app_name_,
-          base::UTF8ToUTF16(app_controller->GetDomainAndRegistry()))) {
-  // Hosted apps apply a theme color if specified by the extension.
-  base::Optional<SkColor> theme_color = app_controller->GetThemeColor();
-  if (theme_color) {
-    SkColor opaque_theme_color =
-        SkColorSetA(theme_color.value(), SK_AlphaOPAQUE);
-    SetFrameColors(opaque_theme_color, opaque_theme_color);
-  }
-
-  title_render_text_ = CreateRenderText();
-  app_and_domain_render_text_ = CreateRenderText();
-  app_and_domain_render_text_->SetHorizontalAlignment(gfx::ALIGN_RIGHT);
-}
-
-HostedAppFrameHeaderAsh::~HostedAppFrameHeaderAsh() {}
-
-std::unique_ptr<gfx::RenderText> HostedAppFrameHeaderAsh::CreateRenderText() {
-  auto render_text = gfx::RenderText::CreateHarfBuzzInstance();
-  render_text->SetFontList(views::NativeWidgetAura::GetWindowTitleFontList());
-  render_text->SetCursorEnabled(false);
-  render_text->SetColor(GetTitleColor());
-  render_text->SetElideBehavior(gfx::FADE_TAIL);
-  return render_text;
-}
-
-void HostedAppFrameHeaderAsh::UpdateRenderTexts() {
-  // TODO(calamity): Investigate localization implications of using a separator
-  // like this.
-  constexpr char kSeparator[] = " | ";
-
-  // If the title matches the app name, don't render the title.
-  base::string16 title = app_controller_->GetTitle();
-  if (title == app_name_)
-    title = base::string16();
-
-  // Add a separator if the title isn't empty.
-  app_and_domain_render_text_->SetText(
-      title.empty() ? app_and_domain_
-                    : base::ASCIIToUTF16(kSeparator) + app_and_domain_);
-
-  title_render_text_->SetText(title);
-}
-
-void HostedAppFrameHeaderAsh::LayoutRenderTexts(
-    const gfx::Rect& available_title_bounds,
-    int title_width,
-    int app_and_domain_width) {
-  // The title is either its own width if it fits, or the space remaining
-  // after rendering the app and domain (which may be negative, but gets clamped
-  // to 0).
-  gfx::Rect title_bounds = available_title_bounds;
-  title_bounds.set_width(
-      std::min(title_bounds.width() - app_and_domain_width, title_width));
-  title_bounds.set_x(view()->GetMirroredXForRect(title_bounds));
-  title_render_text_->SetDisplayRect(title_bounds);
-
-  // The app and domain are placed to the right of the title and clipped to the
-  // original title bounds. This string is given full width whenever possible.
-  gfx::Rect app_and_domain_bounds = available_title_bounds;
-  app_and_domain_bounds.set_x(title_bounds.right());
-  app_and_domain_bounds.set_width(app_and_domain_width);
-  app_and_domain_bounds.Intersect(available_title_bounds);
-  app_and_domain_bounds.set_x(
-      view()->GetMirroredXForRect(app_and_domain_bounds));
-  app_and_domain_render_text_->SetDisplayRect(app_and_domain_bounds);
-}
-
-void HostedAppFrameHeaderAsh::PaintTitleBar(gfx::Canvas* canvas) {
-  title_render_text_->Draw(canvas);
-  app_and_domain_render_text_->Draw(canvas);
-}
-
-// TODO(calamity): Make this elide behavior more sophisticated in handling other
-// possible translations and languages (the domain should always render).
-void HostedAppFrameHeaderAsh::LayoutHeader() {
-  DefaultFrameHeader::LayoutHeader();
-
-  // We only need to recalculate the strings when the window title changes, and
-  // that causes the NonClientView to Layout(), which calls into us here.
-  UpdateRenderTexts();
-
-  LayoutRenderTexts(GetAvailableTitleBounds(),
-                    title_render_text_->GetStringSize().width(),
-                    app_and_domain_render_text_->GetStringSize().width());
-}
diff --git a/chrome/browser/ui/views/frame/hosted_app_frame_header_ash.h b/chrome/browser/ui/views/frame/hosted_app_frame_header_ash.h
deleted file mode 100644
index db25791..0000000
--- a/chrome/browser/ui/views/frame/hosted_app_frame_header_ash.h
+++ /dev/null
@@ -1,67 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROME_BROWSER_UI_VIEWS_FRAME_HOSTED_APP_FRAME_HEADER_ASH_H_
-#define CHROME_BROWSER_UI_VIEWS_FRAME_HOSTED_APP_FRAME_HEADER_ASH_H_
-
-#include "ash/frame/default_frame_header.h"
-#include "base/gtest_prod_util.h"
-#include "base/macros.h"
-
-namespace gfx {
-class Canvas;
-class RenderText;
-}  // namespace gfx
-
-namespace extensions {
-class HostedAppBrowserController;
-}  // namespace extensions
-
-// Helper class for managing the hosted app window header.
-class HostedAppFrameHeaderAsh : public ash::DefaultFrameHeader {
- public:
-  HostedAppFrameHeaderAsh(
-      extensions::HostedAppBrowserController* app_controller,
-      views::Widget* frame,
-      views::View* header_view,
-      ash::FrameCaptionButtonContainerView* caption_button_container);
-  ~HostedAppFrameHeaderAsh() override;
-
- private:
-  FRIEND_TEST_ALL_PREFIXES(HostedAppNonClientFrameViewAshTest, HostedAppFrame);
-
-  // Create a render text for this header.
-  std::unique_ptr<gfx::RenderText> CreateRenderText();
-
-  // Refresh the text inside the render texts.
-  void UpdateRenderTexts();
-
-  // Render the app and domain to the right of the window title, truncating the
-  // the window title first if the combination doesn't fit.
-  void LayoutRenderTexts(const gfx::Rect& available_title_bounds,
-                         int title_width,
-                         int app_and_domain_width);
-
-  // ash::DefaultFrameHeader:
-  void PaintTitleBar(gfx::Canvas* canvas) override;
-  void LayoutHeader() override;
-
-  extensions::HostedAppBrowserController* app_controller_;  // Weak.
-
-  // The render text for the window title.
-  std::unique_ptr<gfx::RenderText> title_render_text_;
-
-  // The render text for the app and domain in the title bar.
-  std::unique_ptr<gfx::RenderText> app_and_domain_render_text_;
-
-  // The name of the app.
-  const base::string16 app_name_;
-
-  // The app and domain string to display in the title bar.
-  const base::string16 app_and_domain_;
-
-  DISALLOW_COPY_AND_ASSIGN(HostedAppFrameHeaderAsh);
-};
-
-#endif  // CHROME_BROWSER_UI_VIEWS_FRAME_HOSTED_APP_FRAME_HEADER_ASH_H_
diff --git a/chrome/browser/ui/views/profiles/profile_chooser_view.cc b/chrome/browser/ui/views/profiles/profile_chooser_view.cc
index 90c376e..dbd99c5 100644
--- a/chrome/browser/ui/views/profiles/profile_chooser_view.cc
+++ b/chrome/browser/ui/views/profiles/profile_chooser_view.cc
@@ -1148,7 +1148,7 @@
     if (service->GetBoolean(prefs::kBrowserGuestModeEnabled)) {
       guest_profile_button_ =
           new HoverButton(this,
-                          gfx::CreateVectorIcon(kAccountCircleIcon, kIconSize,
+                          gfx::CreateVectorIcon(kUserMenuGuestIcon, kIconSize,
                                                 gfx::kChromeIconGrey),
                           l10n_util::GetStringUTF16(IDS_GUEST_PROFILE_NAME));
       layout->StartRow(1, 0);
diff --git a/chrome/browser/ui/webui/chromeos/login/oobe_ui.cc b/chrome/browser/ui/webui/chromeos/login/oobe_ui.cc
index 60a4918..b55575d7 100644
--- a/chrome/browser/ui/webui/chromeos/login/oobe_ui.cc
+++ b/chrome/browser/ui/webui/chromeos/login/oobe_ui.cc
@@ -120,6 +120,11 @@
 const char kArcPlaystoreLogoPath[] = "playstore.svg";
 const char kProductLogoPath[] = "product-logo.png";
 
+#if defined(GOOGLE_CHROME_BUILD)
+const char kLogo24PX1XSvgPath[] = "logo_24px-1x.svg";
+const char kLogo24PX2XSvgPath[] = "logo_24px-2x.svg";
+#endif
+
 // Creates a WebUIDataSource for chrome://oobe
 content::WebUIDataSource* CreateOobeUIDataSource(
     const base::DictionaryValue& localized_strings,
@@ -177,6 +182,11 @@
     source->AddResourcePath(kCustomElementsUserPodHTMLPath,
                             IDR_CUSTOM_ELEMENTS_USER_POD_HTML);
   }
+#if defined(GOOGLE_CHROME_BUILD)
+  source->AddResourcePath(kLogo24PX1XSvgPath, IDR_PRODUCT_LOGO_24PX_1X);
+  source->AddResourcePath(kLogo24PX2XSvgPath, IDR_PRODUCT_LOGO_24PX_2X);
+  // No #else section here as Sync Settings screen is Chrome-specific.
+#endif
 
   // Required for postprocessing of Goolge PlayStore Terms.
   source->AddResourcePath(kArcPlaystoreCSSPath, IDR_ARC_SUPPORT_PLAYSTORE_CSS);
diff --git a/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc b/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
index f9bfd0f..cff34e16 100644
--- a/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
+++ b/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
@@ -1304,7 +1304,17 @@
       {"passwordDeleted", IDS_SETTINGS_PASSWORD_DELETED_PASSWORD},
       {"exportPasswordsTitle", IDS_SETTINGS_PASSWORDS_EXPORT_TITLE},
       {"exportPasswordsDescription", IDS_SETTINGS_PASSWORDS_EXPORT_DESCRIPTION},
-      {"exportPasswords", IDS_SETTINGS_PASSWORDS_EXPORT}};
+      {"exportPasswords", IDS_SETTINGS_PASSWORDS_EXPORT},
+      {"exportingPasswordsTitle", IDS_SETTINGS_PASSWORDS_EXPORTING_TITLE},
+      {"exportPasswordsTryAgain", IDS_SETTINGS_PASSWORDS_EXPORT_TRY_AGAIN},
+      {"exportPasswordsFailTitle",
+       IDS_SETTINGS_PASSWORDS_EXPORTING_FAILURE_TITLE},
+      {"exportPasswordsFailTips",
+       IDS_SETTINGS_PASSWORDS_EXPORTING_FAILURE_TIPS},
+      {"exportPasswordsFailTipsEnoughSpace",
+       IDS_SETTINGS_PASSWORDS_EXPORTING_FAILURE_TIP_ENOUGH_SPACE},
+      {"exportPasswordsFailTipsAnotherFolder",
+       IDS_SETTINGS_PASSWORDS_EXPORTING_FAILURE_TIP_ANOTHER_FOLDER}};
 
   html_source->AddString(
       "managePasswordsLabel",
diff --git a/chrome/common/importer/pstore_declarations.h b/chrome/common/importer/pstore_declarations.h
index e06ab6c7..74b5954 100644
--- a/chrome/common/importer/pstore_declarations.h
+++ b/chrome/common/importer/pstore_declarations.h
@@ -29,8 +29,11 @@
 typedef DWORD PST_ACCESSMODE;
 #define PST_E_OK _HRESULT_TYPEDEF_(0x00000000L)
 
-interface IEnumPStoreItems : public IUnknown
-{
+interface
+#ifdef __clang__
+    [[clang::lto_visibility_public]]
+#endif
+    IEnumPStoreItems : public IUnknown {
  public:
   virtual HRESULT STDMETHODCALLTYPE Next(
       DWORD celt,
@@ -45,8 +48,11 @@
       IEnumPStoreItems __RPC_FAR *__RPC_FAR *ppenum) = 0;
 };
 
-interface IPStore : public IUnknown
-{
+interface
+#ifdef __clang__
+    [[clang::lto_visibility_public]]
+#endif
+    IPStore : public IUnknown {
  public:
   virtual HRESULT STDMETHODCALLTYPE GetInfo(
       PST_PROVIDERINFO* __RPC_FAR *ppProperties) = 0;
diff --git a/chrome/renderer/url_loader_throttle_provider_impl.cc b/chrome/renderer/url_loader_throttle_provider_impl.cc
index 32ffd35..dae7694 100644
--- a/chrome/renderer/url_loader_throttle_provider_impl.cc
+++ b/chrome/renderer/url_loader_throttle_provider_impl.cc
@@ -19,6 +19,7 @@
 #include "content/public/renderer/render_frame.h"
 #include "content/public/renderer/render_thread.h"
 #include "content/public/renderer/render_view.h"
+#include "services/network/public/cpp/features.h"
 #include "services/service_manager/public/cpp/connector.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 
@@ -49,7 +50,7 @@
       chrome_content_renderer_client_(chrome_content_renderer_client) {
   DETACH_FROM_THREAD(thread_checker_);
 
-  if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     content::RenderThread::Get()->GetConnector()->BindInterface(
         content::mojom::kBrowserServiceName,
         mojo::MakeRequest(&safe_browsing_info_));
@@ -70,7 +71,7 @@
   std::vector<std::unique_ptr<content::URLLoaderThrottle>> throttles;
 
   bool network_service_enabled =
-      base::FeatureList::IsEnabled(features::kNetworkService);
+      base::FeatureList::IsEnabled(network::features::kNetworkService);
   // Some throttles have already been added in the browser for frame resources.
   // Don't add them for frame requests.
   bool is_frame_resource = content::IsResourceTypeFrame(resource_type);
diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
index 8c5bdfb..b0e8119 100644
--- a/chrome/test/BUILD.gn
+++ b/chrome/test/BUILD.gn
@@ -2075,12 +2075,28 @@
   ]
 }
 
+# Temporary target for running benchmarks without building Chrome
+# Will be removed as a part of crbug.com/758632
+group("telemetry_perf_tests_experimental") {
+  testonly = true
+  deps = [
+    "//tools/perf/:perf_experimental",
+  ]
+
+  data = [
+    # Needed for isolate script to execute.
+    "//testing/scripts/common.py",
+    "//testing/xvfb.py",
+    "//testing/scripts/run_telemetry_benchmark_as_googletest.py",
+  ]
+}
+
 # New target that will replace telemetry_perf_tests when testing
 # is done.
 group("performance_test_suite") {
   testonly = true
   deps = [
-    "//chrome/test:telemetry_perf_tests",
+    "//chrome/test:telemetry_perf_tests_experimental",
   ]
 
   data = [
@@ -2823,6 +2839,7 @@
       "../browser/resource_coordinator/tab_manager_stats_collector_unittest.cc",
       "../browser/resource_coordinator/tab_manager_unittest.cc",
       "../browser/resource_coordinator/tab_manager_web_contents_data_unittest.cc",
+      "../browser/resource_coordinator/tab_metrics_logger_impl_unittest.cc",
 
       # Android does not use the Message Center notification system.
       "../browser/net/firefox_proxy_settings_unittest.cc",
@@ -2905,7 +2922,6 @@
       "../browser/ui/tabs/pinned_tab_test_utils.cc",
       "../browser/ui/tabs/pinned_tab_test_utils.h",
       "../browser/ui/tabs/tab_menu_model_unittest.cc",
-      "../browser/ui/tabs/tab_metrics_logger_impl_unittest.cc",
       "../browser/ui/tabs/tab_strip_model_stats_recorder_unittest.cc",
       "../browser/ui/tabs/tab_strip_model_unittest.cc",
       "../browser/ui/tabs/tab_ukm_test_helper.cc",
@@ -2973,8 +2989,11 @@
       "../utility/importer/safari_importer_unittest.mm",
     ]
     deps += [
+      "//chrome/browser/resource_coordinator:tab_metrics_event_proto",
       "//components/favicon/core/test:test_support",
       "//components/signin/core/browser:signin_features",
+      "//components/ukm:test_support",
+      "//services/metrics/public/cpp:ukm_builders",
       "//third_party/libaddressinput",
     ]
     if (is_mac) {
diff --git a/chrome/test/data/webui/md_history/history_list_test.js b/chrome/test/data/webui/md_history/history_list_test.js
index 4d3d7c1..971c719b 100644
--- a/chrome/test/data/webui/md_history/history_list_test.js
+++ b/chrome/test/data/webui/md_history/history_list_test.js
@@ -142,6 +142,29 @@
     });
   });
 
+  test('selection of all items using ctrl + a', function() {
+    app.historyResult(createHistoryInfo(), TEST_HISTORY_RESULTS);
+    return PolymerTest.flushTasks().then(function() {
+      const field = toolbar.$['main-toolbar'].getSearchField();
+      field.blur();
+      assertFalse(field.showingSearch);
+
+      const modifier = cr.isMac ? 'meta' : 'ctrl';
+      MockInteractions.pressAndReleaseKeyOn(
+          document.body, 65, modifier, 'a');
+
+      assertDeepEquals([true, true, true, true],
+                       element.historyData_.map(i => i.selected));
+
+      // If everything is already selected, the same shortcut will trigger
+      // cancelling selection.
+      MockInteractions.pressAndReleaseKeyOn(
+          document.body, 65, modifier, 'a');
+      assertDeepEquals([false, false, false, false],
+                       element.historyData_.map(i => i.selected));
+    });
+  });
+
   test('setting first and last items', function() {
     app.historyResult(createHistoryInfo(), TEST_HISTORY_RESULTS);
 
diff --git a/chrome/test/data/webui/settings/settings_passwords_section_browsertest.js b/chrome/test/data/webui/settings/settings_passwords_section_browsertest.js
index ee43d9f..8227f976 100644
--- a/chrome/test/data/webui/settings/settings_passwords_section_browsertest.js
+++ b/chrome/test/data/webui/settings/settings_passwords_section_browsertest.js
@@ -15,6 +15,9 @@
 GEN_INCLUDE([ROOT_PATH +
     'chrome/test/data/webui/settings/passwords_and_autofill_fake_data.js']);
 
+// Mock timer.
+GEN_INCLUDE([ROOT_PATH + 'chrome/test/data/webui/mock_timer.js']);
+
 /**
  * @constructor
  * @extends {PolymerTest}
@@ -169,7 +172,18 @@
    * @return {!Object}
    * @private
    */
-  function createExportPasswordsDialog() {
+  function createExportPasswordsDialog(passwordManager) {
+    passwordManager.requestExportProgressStatus = callback => {
+      callback(chrome.passwordsPrivate.ExportProgressStatus.NOT_STARTED);
+    };
+    passwordManager.addPasswordsFileExportProgressListener = callback => {
+      passwordManager.progressCallback = callback;
+    };
+    passwordManager.removePasswordsFileExportProgressListener = () => {};
+    passwordManager.exportPasswords = (callback) => {
+      callback();
+    };
+
     const dialog = document.createElement('passwords-export-dialog');
     document.body.appendChild(dialog);
     Polymer.dom.flush();
@@ -571,17 +585,6 @@
       MockInteractions.tap(passwordListItem.$$('#showPasswordButton'));
     });
 
-    // Test that tapping "Export passwords..." notifies the browser accordingly
-    test('startExport', function(done) {
-      const exportDialog = createExportPasswordsDialog();
-
-      passwordManager.exportPasswords = () => {
-        done();
-      };
-
-      MockInteractions.tap(exportDialog.$.exportPasswordsButton);
-    });
-
     test('closingPasswordsSectionHidesUndoToast', function(done) {
       const passwordEntry = FakeDataMaker.passwordEntry('goo.gl', 'bart', 1);
       const passwordsSection =
@@ -602,6 +605,113 @@
 
       done();
     });
+
+    // Test that tapping "Export passwords..." notifies the browser accordingly
+    test('startExport', function(done) {
+      const exportDialog = createExportPasswordsDialog(passwordManager);
+
+      passwordManager.exportPasswords = (callback) => {
+        callback();
+        done();
+      };
+
+      MockInteractions.tap(exportDialog.$.exportPasswordsButton);
+    });
+
+    // Test the export flow. If exporting is fast, we should skip the
+    // in-progress view altogether.
+    test('exportFlowFast', function(done) {
+      const exportDialog = createExportPasswordsDialog(passwordManager);
+      const progressCallback = passwordManager.progressCallback;
+
+      // Use this to freeze the delayed progress bar and avoid flakiness.
+      let mockTimer = new MockTimer();
+      mockTimer.install();
+
+      assertTrue(exportDialog.$.dialog_start.open);
+      MockInteractions.tap(exportDialog.$.exportPasswordsButton);
+      assertTrue(exportDialog.$.dialog_start.open);
+      progressCallback(
+          {status: chrome.passwordsPrivate.ExportProgressStatus.IN_PROGRESS});
+      progressCallback(
+          {status: chrome.passwordsPrivate.ExportProgressStatus.SUCCEEDED});
+
+      // When we are done, the export dialog closes completely.
+      assertFalse(exportDialog.$.dialog_start.open);
+      assertFalse(exportDialog.$.dialog_error.open);
+      assertFalse(exportDialog.$.dialog_progress.open);
+      done();
+
+      mockTimer.uninstall();
+    });
+
+    // The error view is shown when an error occurs.
+    test('exportFlowError', function(done) {
+      const exportDialog = createExportPasswordsDialog(passwordManager);
+      const progressCallback = passwordManager.progressCallback;
+
+      // Use this to freeze the delayed progress bar and avoid flakiness.
+      let mockTimer = new MockTimer();
+      mockTimer.install();
+
+      assertTrue(exportDialog.$.dialog_start.open);
+      MockInteractions.tap(exportDialog.$.exportPasswordsButton);
+      assertTrue(exportDialog.$.dialog_start.open);
+      progressCallback(
+          {status: chrome.passwordsPrivate.ExportProgressStatus.IN_PROGRESS});
+      progressCallback({
+        status:
+            chrome.passwordsPrivate.ExportProgressStatus.FAILED_WRITE_FAILED,
+        folderName: 'tmp',
+      });
+
+      assertTrue(exportDialog.$.dialog_error.open);
+      done();
+
+      mockTimer.uninstall();
+    });
+
+    // Test the export flow. If exporting is slow, Chrome should show the
+    // in-progress dialog for at least 2000ms.
+    test('exportFlowSlow', function(done) {
+      const exportDialog = createExportPasswordsDialog(passwordManager);
+      const progressCallback = passwordManager.progressCallback;
+
+      let mockTimer = new MockTimer();
+      mockTimer.install();
+
+      // The initial dialog remains open for 100ms after export enters the
+      // in-progress state.
+      assertTrue(exportDialog.$.dialog_start.open);
+      MockInteractions.tap(exportDialog.$.exportPasswordsButton);
+      assertTrue(exportDialog.$.dialog_start.open);
+      progressCallback(
+          {status: chrome.passwordsPrivate.ExportProgressStatus.IN_PROGRESS});
+      assertTrue(exportDialog.$.dialog_start.open);
+
+      // After 100ms of not having completed, the dialog switches to the
+      // progress bar. Chrome will continue to show the progress bar for 2000ms,
+      // despite a completion event.
+      mockTimer.tick(99);
+      assertTrue(exportDialog.$.dialog_start.open);
+      mockTimer.tick(1);
+      assertTrue(exportDialog.$.dialog_progress.open);
+      progressCallback(
+          {status: chrome.passwordsPrivate.ExportProgressStatus.SUCCEEDED});
+      assertTrue(exportDialog.$.dialog_progress.open);
+
+      // After 2000ms, Chrome will display the completion event.
+      mockTimer.tick(1999);
+      assertTrue(exportDialog.$.dialog_progress.open);
+      mockTimer.tick(1);
+      // On SUCCEEDED the dialog closes completely.
+      assertFalse(exportDialog.$.dialog_progress.open);
+      assertFalse(exportDialog.$.dialog_start.open);
+      assertFalse(exportDialog.$.dialog_error.open);
+      done();
+
+      mockTimer.uninstall();
+    });
   });
 
   mocha.run();
diff --git a/chrome/utility/BUILD.gn b/chrome/utility/BUILD.gn
index ded8b0e..9c3fc5d8 100644
--- a/chrome/utility/BUILD.gn
+++ b/chrome/utility/BUILD.gn
@@ -38,13 +38,13 @@
     "//components/url_formatter",
     "//content/public/child",
     "//content/public/common",
-    "//content/public/network",
     "//content/public/utility",
     "//extensions/features",
     "//ipc",
     "//media",
     "//net:net_with_v8",
     "//printing/features",
+    "//services/network/public/cpp",
     "//services/service_manager/public/cpp",
     "//skia",
     "//sql",
diff --git a/chrome/utility/DEPS b/chrome/utility/DEPS
index 2523034..da238f5 100644
--- a/chrome/utility/DEPS
+++ b/chrome/utility/DEPS
@@ -24,12 +24,12 @@
   "+components/printing/service/public/interfaces",
   "+components/wifi",
   "+content/public/child",
-  "+content/public/network",
   "+content/public/utility",
   "+extensions/common",
   "+extensions/features",
   "+extensions/utility",
   "+media",
+  "+services/network/public",
   "+services/proxy_resolver",
   "+services/service_manager/embedder",
   "+services/service_manager/public/cpp",
diff --git a/chrome/utility/chrome_content_utility_client.cc b/chrome/utility/chrome_content_utility_client.cc
index ae1958f..9b066127 100644
--- a/chrome/utility/chrome_content_utility_client.cc
+++ b/chrome/utility/chrome_content_utility_client.cc
@@ -37,8 +37,8 @@
 #include "chrome/common/resource_usage_reporter.mojom.h"
 #include "chrome/utility/importer/profile_import_impl.h"
 #include "chrome/utility/importer/profile_import_service.h"
-#include "content/public/network/url_request_context_builder_mojo.h"
 #include "net/proxy_resolution/proxy_resolver_v8.h"
+#include "services/network/public/cpp/url_request_context_builder_mojo.h"
 #include "services/proxy_resolver/proxy_resolver_service.h"  // nogncheck
 #include "services/proxy_resolver/public/interfaces/proxy_resolver.mojom.h"  // nogncheck
 #endif  // !defined(OS_ANDROID)
diff --git a/components/autofill/content/renderer/page_passwords_analyser.cc b/components/autofill/content/renderer/page_passwords_analyser.cc
index 141d40e..7a6c1a5c 100644
--- a/components/autofill/content/renderer/page_passwords_analyser.cc
+++ b/components/autofill/content/renderer/page_passwords_analyser.cc
@@ -320,7 +320,7 @@
   switch (password_count) {
     case 3:
       (*autocomplete_suggestions)[password_inputs[0]] = "current-password";
-    // Fall-through here to match the last two password fields.
+      FALLTHROUGH;  // To match the last two password fields.
     case 2:
       (*autocomplete_suggestions)[password_inputs[password_count - 2]] =
           "new-password";
diff --git a/components/dom_distiller/content/renderer/distiller_native_javascript.cc b/components/dom_distiller/content/renderer/distiller_native_javascript.cc
index ae6959a..0af444e 100644
--- a/components/dom_distiller/content/renderer/distiller_native_javascript.cc
+++ b/components/dom_distiller/content/renderer/distiller_native_javascript.cc
@@ -42,19 +42,19 @@
   // wrapper function for binding. Note that calling distiller_js_service.get()
   // does not transfer ownership of the interface.
   BindFunctionToObject(
-      distiller_obj, "openSettings",
+      isolate, distiller_obj, "openSettings",
       base::Bind(
           &mojom::DistillerJavaScriptService::HandleDistillerOpenSettingsCall,
           base::Unretained(distiller_js_service_.get())));
 }
 
-template<typename Sig>
+template <typename Sig>
 void DistillerNativeJavaScript::BindFunctionToObject(
+    v8::Isolate* isolate,
     v8::Local<v8::Object> javascript_object,
     const std::string& name,
     const base::Callback<Sig> callback) {
   // Get the isolate associated with this object.
-  v8::Isolate* isolate = javascript_object->GetIsolate();
   javascript_object->Set(
       gin::StringToSymbol(isolate, name),
       gin::CreateFunctionTemplate(isolate, callback)->GetFunction());
diff --git a/components/dom_distiller/content/renderer/distiller_native_javascript.h b/components/dom_distiller/content/renderer/distiller_native_javascript.h
index 28078f0..ecea477 100644
--- a/components/dom_distiller/content/renderer/distiller_native_javascript.h
+++ b/components/dom_distiller/content/renderer/distiller_native_javascript.h
@@ -26,8 +26,9 @@
 
  private:
   // Add a function to the provided object.
-  template<typename Sig>
-  void BindFunctionToObject(v8::Local<v8::Object> javascript_object,
+  template <typename Sig>
+  void BindFunctionToObject(v8::Isolate* isolate,
+                            v8::Local<v8::Object> javascript_object,
                             const std::string& name,
                             const base::Callback<Sig> callback);
   // Make sure the mojo service is connected.
diff --git a/components/exo/data_device_unittest.cc b/components/exo/data_device_unittest.cc
index e721cfd..dd77d1c 100644
--- a/components/exo/data_device_unittest.cc
+++ b/components/exo/data_device_unittest.cc
@@ -114,9 +114,9 @@
                       GURL* out) override {
     return true;
   }
-  bool GetUrlFromFileSystemUrl(const std::string& app_id,
-                               const GURL& url,
-                               GURL* out) override {
+  bool GetUrlsFromPickle(const std::string& app_id,
+                         const base::Pickle& pickle,
+                         std::vector<GURL>* out_urls) override {
     return false;
   }
 
diff --git a/components/exo/data_offer.cc b/components/exo/data_offer.cc
index 13fca50..c0239ae 100644
--- a/components/exo/data_offer.cc
+++ b/components/exo/data_offer.cc
@@ -6,6 +6,7 @@
 
 #include "base/files/file_util.h"
 #include "base/memory/ref_counted_memory.h"
+#include "base/pickle.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/task_scheduler/post_task.h"
 #include "components/exo/data_offer_delegate.h"
@@ -52,6 +53,49 @@
     DLOG(ERROR) << "Failed to write drop data";
 }
 
+// Gets a comma-separated list of urls extracted from |data|->file.
+bool GetUrlListFromDataFile(FileHelper* file_helper,
+                            const ui::OSExchangeData& data,
+                            base::string16* url_list_string) {
+  if (!data.HasFile())
+    return false;
+  std::vector<ui::FileInfo> files;
+  if (data.GetFilenames(&files)) {
+    for (const auto& info : files) {
+      GURL url;
+      // TODO(niwa): Need to fill the correct app_id.
+      if (file_helper->GetUrlFromPath(/* app_id */ "", info.path, &url)) {
+        if (!url_list_string->empty())
+          *url_list_string += base::UTF8ToUTF16(kUriListSeparator);
+        *url_list_string += base::UTF8ToUTF16(url.spec());
+      }
+    }
+  }
+  return !url_list_string->empty();
+}
+
+// Gets a comma-separated list of urls extracted from |data|->pickle.
+bool GetUrlListFromDataPickle(FileHelper* file_helper,
+                              const ui::OSExchangeData& data,
+                              base::string16* url_list_string) {
+  static const char kFormatString[] = "chromium/x-file-system-files";
+  CR_DEFINE_STATIC_LOCAL(ui::Clipboard::FormatType, formatType,
+                         (ui::Clipboard::GetFormatType(kFormatString)));
+  base::Pickle pickle;
+  if (!data.GetPickledData(formatType, &pickle))
+    return false;
+  std::vector<GURL> app_urls;
+  // TODO(niwa): Need to fill the correct app_id.
+  if (file_helper->GetUrlsFromPickle(/* app_id */ "", pickle, &app_urls)) {
+    for (const GURL& app_url : app_urls) {
+      if (!url_list_string->empty())
+        *url_list_string += base::UTF8ToUTF16(kUriListSeparator);
+      *url_list_string += base::UTF8ToUTF16(app_url.spec());
+    }
+  }
+  return !url_list_string->empty();
+}
+
 }  // namespace
 
 DataOffer::DataOffer(DataOfferDelegate* delegate) : delegate_(delegate) {}
@@ -102,30 +146,21 @@
 void DataOffer::SetDropData(FileHelper* file_helper,
                             const ui::OSExchangeData& data) {
   DCHECK_EQ(0u, data_.size());
-  if (data.HasString()) {
+
+  base::string16 url_list_string;
+  bool found_urls =
+      GetUrlListFromDataFile(file_helper, data, &url_list_string) ||
+      GetUrlListFromDataPickle(file_helper, data, &url_list_string);
+  if (found_urls) {
+    data_.emplace(file_helper->GetMimeTypeForUriList(),
+                  RefCountedString16::TakeString(std::move(url_list_string)));
+  } else if (data.HasString()) {
     base::string16 string_content;
     if (data.GetString(&string_content)) {
       data_.emplace(std::string(ui::Clipboard::kMimeTypeText),
                     RefCountedString16::TakeString(std::move(string_content)));
     }
   }
-  if (data.HasFile()) {
-    std::vector<ui::FileInfo> files;
-    if (data.GetFilenames(&files)) {
-      base::string16 url_list;
-      for (const auto& info : files) {
-        GURL url;
-        // TODO(hirono): Need to fill the corret app_id.
-        if (file_helper->GetUrlFromPath(/* app_id */ "", info.path, &url)) {
-          if (!url_list.empty())
-            url_list += base::UTF8ToUTF16(kUriListSeparator);
-          url_list += base::UTF8ToUTF16(url.spec());
-        }
-      }
-      data_.emplace(file_helper->GetMimeTypeForUriList(),
-                    RefCountedString16::TakeString(std::move(url_list)));
-    }
-  }
   for (const auto& pair : data_) {
     delegate_->OnOffer(pair.first);
   }
diff --git a/components/exo/data_offer_unittest.cc b/components/exo/data_offer_unittest.cc
index 0c8976ec..59508d3 100644
--- a/components/exo/data_offer_unittest.cc
+++ b/components/exo/data_offer_unittest.cc
@@ -77,10 +77,13 @@
     *out = GURL("file://" + path.AsUTF8Unsafe());
     return true;
   }
-  bool GetUrlFromFileSystemUrl(const std::string& app_id,
-                               const GURL& url,
-                               GURL* out) override {
-    return false;
+  bool GetUrlsFromPickle(const std::string& app_id,
+                         const base::Pickle& pickle,
+                         std::vector<GURL>* out_urls) override {
+    // TODO(niwa): Check app_id once we start filling app_id in DataOffer.
+    out_urls->push_back(
+        GURL("content://org.chromium.arc.chromecontentprovider/path/to/file1"));
+    return true;
   }
 
  private:
@@ -165,6 +168,26 @@
   EXPECT_EQ("text/uri-list", delegate.mime_types()[0]);
 }
 
+TEST_F(DataOfferTest, SetPickleDropData) {
+  TestDataOfferDelegate delegate;
+  DataOffer data_offer(&delegate);
+
+  TestFileHelper file_helper;
+  ui::OSExchangeData data;
+
+  base::Pickle pickle;
+  pickle.WriteUInt32(1);  // num files
+  pickle.WriteString("filesystem:chrome-extension://path/to/file1");
+  pickle.WriteInt64(1000);   // file size
+  pickle.WriteString("id");  // filesystem id
+  data.SetPickledData(
+      ui::Clipboard::GetFormatType("chromium/x-file-system-files"), pickle);
+  data_offer.SetDropData(&file_helper, data);
+
+  EXPECT_EQ(1u, delegate.mime_types().size());
+  EXPECT_EQ("text/uri-list", delegate.mime_types()[0]);
+}
+
 TEST_F(DataOfferTest, ReceiveString) {
   TestDataOfferDelegate delegate;
   DataOffer data_offer(&delegate);
@@ -203,6 +226,35 @@
   EXPECT_EQ(base::ASCIIToUTF16("file:///test/downloads/file"), result);
 }
 
+TEST_F(DataOfferTest, ReceiveUriListFromPickle) {
+  TestDataOfferDelegate delegate;
+  DataOffer data_offer(&delegate);
+
+  TestFileHelper file_helper;
+  ui::OSExchangeData data;
+
+  base::Pickle pickle;
+  pickle.WriteUInt32(1);  // num files
+  pickle.WriteString("filesystem:chrome-extension://path/to/file1");
+  pickle.WriteInt64(1000);   // file size
+  pickle.WriteString("id");  // filesystem id
+  data.SetPickledData(
+      ui::Clipboard::GetFormatType("chromium/x-file-system-files"), pickle);
+  data_offer.SetDropData(&file_helper, data);
+
+  base::ScopedFD read_pipe;
+  base::ScopedFD write_pipe;
+  CreatePipe(&read_pipe, &write_pipe);
+
+  data_offer.Receive("text/uri-list", std::move(write_pipe));
+  base::string16 result;
+  ASSERT_TRUE(ReadString16(std::move(read_pipe), &result));
+  EXPECT_EQ(
+      base::ASCIIToUTF16(
+          "content://org.chromium.arc.chromecontentprovider/path/to/file1"),
+      result);
+}
+
 TEST_F(DataOfferTest, SetClipboardData) {
   TestDataOfferDelegate delegate;
   DataOffer data_offer(&delegate);
diff --git a/components/exo/display_unittest.cc b/components/exo/display_unittest.cc
index cf56b55..bd0836d 100644
--- a/components/exo/display_unittest.cc
+++ b/components/exo/display_unittest.cc
@@ -232,9 +232,9 @@
                       GURL* out) override {
     return true;
   }
-  bool GetUrlFromFileSystemUrl(const std::string& app_id,
-                               const GURL& url,
-                               GURL* out) override {
+  bool GetUrlsFromPickle(const std::string& app_id,
+                         const base::Pickle& pickle,
+                         std::vector<GURL>* out_urls) override {
     return false;
   }
 };
diff --git a/components/exo/file_helper.h b/components/exo/file_helper.h
index 28702db..b1dfb5ba 100644
--- a/components/exo/file_helper.h
+++ b/components/exo/file_helper.h
@@ -33,11 +33,12 @@
                               const base::FilePath& path,
                               GURL* out) = 0;
 
-  // Converts filesystem:// URL to something that applications can understand.
-  // e.g. content:// URI for Android apps.
-  virtual bool GetUrlFromFileSystemUrl(const std::string& app_id,
-                                       const GURL& file_system_url,
-                                       GURL* out) = 0;
+  // Takes in |pickle| constructed by the web contents view, reads filesystem
+  // URLs from it and converts the URLs to something that applications can
+  // understand.  e.g. content:// URI for Android apps.
+  virtual bool GetUrlsFromPickle(const std::string& app_id,
+                                 const base::Pickle& pickle,
+                                 std::vector<GURL>* out_urls) = 0;
 };
 
 }  // namespace exo
diff --git a/components/policy/proto/device_management_backend.proto b/components/policy/proto/device_management_backend.proto
index ad589bc..dc155d50 100644
--- a/components/policy/proto/device_management_backend.proto
+++ b/components/policy/proto/device_management_backend.proto
@@ -235,7 +235,9 @@
   //   google/chromeos/device => ChromeDeviceSettingsProto
   //   google/chromeos/user => ChromeSettingsProto
   //   google/chromeos/publicaccount => ChromeSettingsProto
+  //   google/chrome/machine-level-user => ChromeSettingsProto
   //   google/chrome/extension => ExternalPolicyData
+  //   google/chrome/machine-level-extension => ExternalPolicyData
   //   google/chromeos/signinextension => ExternalPolicyData
   //   google/android/user => ChromeSettingsProto
   //   google/ios/user => ChromeSettingsProto
@@ -883,6 +885,10 @@
 
   // Profile specific reports, one per profile.
   repeated ChromeUserProfileReport chrome_user_profile_reports = 3;
+
+  // Executable path is guaranteed to be unique per Chrome install on the same
+  // machine.
+  optional string executable_path = 4;
 }
 
 // Report the status of a Chrome installation on non-Chrome OS platform.
diff --git a/components/signin/core/browser/signin_manager.cc b/components/signin/core/browser/signin_manager.cc
index faa7209a9..f793a7ab 100644
--- a/components/signin/core/browser/signin_manager.cc
+++ b/components/signin/core/browser/signin_manager.cc
@@ -39,6 +39,7 @@
       prohibit_signout_(false),
       type_(SIGNIN_TYPE_NONE),
       client_(client),
+      diagnostics_client_(nullptr),
       token_service_(token_service),
       cookie_manager_service_(cookie_manager_service),
       signin_manager_signed_in_(false),
@@ -434,6 +435,11 @@
 }
 
 void SigninManager::FireGoogleSigninSucceeded() {
+  if (diagnostics_client_) {
+    diagnostics_client_->WillFireGoogleSigninSucceeded(
+        GetAuthenticatedAccountInfo());
+  }
+
   std::string account_id = GetAuthenticatedAccountId();
   std::string email = GetAuthenticatedAccountInfo().email;
   for (auto& observer : observer_list_) {
@@ -445,6 +451,10 @@
 
 void SigninManager::FireGoogleSignedOut(const std::string& account_id,
                                         const AccountInfo& account_info) {
+  if (diagnostics_client_) {
+    diagnostics_client_->WillFireGoogleSignedOut(account_info);
+  }
+
   for (auto& observer : observer_list_) {
     observer.GoogleSignedOut(account_id, account_info.email);
     observer.GoogleSignedOut(account_info);
diff --git a/components/signin/core/browser/signin_manager.h b/components/signin/core/browser/signin_manager.h
index 508ac0b..862fc97 100644
--- a/components/signin/core/browser/signin_manager.h
+++ b/components/signin/core/browser/signin_manager.h
@@ -47,6 +47,10 @@
 class SigninClient;
 class SigninErrorController;
 
+namespace identity {
+class IdentityManager;
+}
+
 class SigninManager : public SigninManagerBase,
                       public AccountTrackerService::Observer,
                       public OAuth2TokenService::Observer {
@@ -175,6 +179,23 @@
                          bool remove_all_accounts);
 
  private:
+  // Interface that gives information on internal SigninManager operations. Only
+  // for use by IdentityManager during the conversion of the codebase to use
+  // //services/identity/public/cpp.
+  class DiagnosticsClient {
+   public:
+    // Sent just before GoogleSigninSucceeded() is fired on observers.
+    virtual void WillFireGoogleSigninSucceeded(
+        const AccountInfo& account_info) = 0;
+    // Sent just before GoogleSignedOut() is fired on observers.
+    virtual void WillFireGoogleSignedOut(const AccountInfo& account_info) = 0;
+  };
+
+  void set_diagnostics_client(DiagnosticsClient* diagnostics_client) {
+    DCHECK(!diagnostics_client_ || !diagnostics_client);
+    diagnostics_client_ = diagnostics_client;
+  }
+
   enum SigninType {
     SIGNIN_TYPE_NONE,
     SIGNIN_TYPE_WITH_REFRESH_TOKEN,
@@ -183,6 +204,7 @@
 
   std::string SigninTypeToString(SigninType type);
   friend class FakeSigninManager;
+  friend class identity::IdentityManager;
   FRIEND_TEST_ALL_PREFIXES(SigninManagerTest, ClearTransientSigninData);
   FRIEND_TEST_ALL_PREFIXES(SigninManagerTest, ProvideSecondFactorSuccess);
   FRIEND_TEST_ALL_PREFIXES(SigninManagerTest, ProvideSecondFactorFailure);
@@ -259,6 +281,9 @@
   // object.
   SigninClient* client_;
 
+  // The DiagnosticsClient object associated with this object. May be null.
+  DiagnosticsClient* diagnostics_client_;
+
   // The ProfileOAuth2TokenService instance associated with this object. Must
   // outlive this object.
   ProfileOAuth2TokenService* token_service_;
diff --git a/components/storage_monitor/BUILD.gn b/components/storage_monitor/BUILD.gn
index 6c565d3..87f15eb 100644
--- a/components/storage_monitor/BUILD.gn
+++ b/components/storage_monitor/BUILD.gn
@@ -62,6 +62,8 @@
     sources += [
       "media_transfer_protocol_device_observer_chromeos.cc",
       "media_transfer_protocol_device_observer_chromeos.h",
+      "storage_info_utils.cc",
+      "storage_info_utils.h",
     ]
   }
 
diff --git a/components/storage_monitor/media_transfer_protocol_device_observer_chromeos.cc b/components/storage_monitor/media_transfer_protocol_device_observer_chromeos.cc
index 4f367798..803a451 100644
--- a/components/storage_monitor/media_transfer_protocol_device_observer_chromeos.cc
+++ b/components/storage_monitor/media_transfer_protocol_device_observer_chromeos.cc
@@ -6,94 +6,12 @@
 
 #include <vector>
 
-#include "base/files/file_path.h"
-#include "base/stl_util.h"
-#include "base/strings/string_number_conversions.h"
-#include "base/strings/string_split.h"
 #include "base/strings/utf_string_conversions.h"
-#include "components/storage_monitor/removable_device_constants.h"
+#include "components/storage_monitor/storage_info.h"
+#include "components/storage_monitor/storage_info_utils.h"
 
 namespace storage_monitor {
 
-namespace {
-
-// Device root path constant.
-const char kRootPath[] = "/";
-
-// Constructs and returns the location of the device using the |storage_name|.
-std::string GetDeviceLocationFromStorageName(const std::string& storage_name) {
-  // Construct a dummy device path using the storage name. This is only used
-  // for registering device media file system.
-  // E.g.: If the |storage_name| is "usb:2,2:12345" then "/usb:2,2:12345" is the
-  // device location.
-  DCHECK(!storage_name.empty());
-  return kRootPath + storage_name;
-}
-
-// Returns the storage identifier of the device from the given |storage_name|.
-// E.g. If the |storage_name| is "usb:2,2:65537", the storage identifier is
-// "65537".
-std::string GetStorageIdFromStorageName(const std::string& storage_name) {
-  std::vector<base::StringPiece> name_parts = base::SplitStringPiece(
-      storage_name, ":", base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL);
-  return name_parts.size() == 3 ? name_parts[2].as_string() : std::string();
-}
-
-// Returns a unique device id from the given |storage_info|.
-std::string GetDeviceIdFromStorageInfo(
-    const device::mojom::MtpStorageInfo& storage_info) {
-  const std::string storage_id =
-      GetStorageIdFromStorageName(storage_info.storage_name);
-  if (storage_id.empty())
-    return std::string();
-
-  // Some devices have multiple data stores. Therefore, include storage id as
-  // part of unique id along with vendor, model and volume information.
-  const std::string vendor_id = base::UintToString(storage_info.vendor_id);
-  const std::string model_id = base::UintToString(storage_info.product_id);
-  return StorageInfo::MakeDeviceId(
-      StorageInfo::MTP_OR_PTP,
-      kVendorModelVolumeStoragePrefix + vendor_id + ":" + model_id + ":" +
-          storage_info.volume_identifier + ":" + storage_id);
-}
-
-// Returns the |data_store_id| string in the required format.
-// If the |data_store_id| is 65537, this function returns " (65537)".
-std::string GetFormattedIdString(const std::string& data_store_id) {
-  return ("(" + data_store_id + ")");
-}
-
-// Helper function to get device label from storage information.
-base::string16 GetDeviceLabelFromStorageInfo(
-    const device::mojom::MtpStorageInfo& storage_info) {
-  std::string device_label;
-  const std::string& vendor_name = storage_info.vendor;
-  device_label = vendor_name;
-
-  const std::string& product_name = storage_info.product;
-  if (!product_name.empty()) {
-    if (!device_label.empty())
-      device_label += " ";
-    device_label += product_name;
-  }
-
-  // Add the data store id to the device label.
-  if (!device_label.empty()) {
-    const std::string& volume_id = storage_info.volume_identifier;
-    if (!volume_id.empty()) {
-      device_label += GetFormattedIdString(volume_id);
-    } else {
-      const std::string data_store_id =
-          GetStorageIdFromStorageName(storage_info.storage_name);
-      if (!data_store_id.empty())
-        device_label += GetFormattedIdString(data_store_id);
-    }
-  }
-  return base::UTF8ToUTF16(device_label);
-}
-
-}  // namespace
-
 MediaTransferProtocolDeviceObserverChromeOS::
     MediaTransferProtocolDeviceObserverChromeOS(
         StorageMonitor::Receiver* receiver,
diff --git a/components/storage_monitor/media_transfer_protocol_device_observer_chromeos_unittest.cc b/components/storage_monitor/media_transfer_protocol_device_observer_chromeos_unittest.cc
index 697b41d..27f0f40 100644
--- a/components/storage_monitor/media_transfer_protocol_device_observer_chromeos_unittest.cc
+++ b/components/storage_monitor/media_transfer_protocol_device_observer_chromeos_unittest.cc
@@ -15,6 +15,7 @@
 #include "base/strings/utf_string_conversions.h"
 #include "components/storage_monitor/mock_removable_storage_observer.h"
 #include "components/storage_monitor/storage_info.h"
+#include "components/storage_monitor/storage_info_utils.h"
 #include "components/storage_monitor/storage_monitor.h"
 #include "components/storage_monitor/test_storage_monitor.h"
 #include "content/public/test/test_browser_thread_bundle.h"
@@ -45,10 +46,8 @@
 base::LazyInstance<std::map<std::string, device::mojom::MtpStorageInfo>>::Leaky
       g_fake_storage_info_map = LAZY_INSTANCE_INITIALIZER;
 
-// Helper function to get fake MTP device details.
-void GetFakeMtpStorageInfo(
-    const std::string& storage_name,
-    device::MediaTransferProtocolManager::GetStorageInfoCallback callback) {
+const device::mojom::MtpStorageInfo* GetFakeMtpStorageInfoSync(
+    const std::string& storage_name) {
   // Fill the map out if it is empty.
   if (g_fake_storage_info_map.Get().empty()) {
     // Add the invalid MTP storage info.
@@ -69,9 +68,14 @@
   }
 
   const auto it = g_fake_storage_info_map.Get().find(storage_name);
-  const auto* storage_info =
-      it != g_fake_storage_info_map.Get().end() ? &it->second : nullptr;
-  std::move(callback).Run(storage_info);
+  return it != g_fake_storage_info_map.Get().end() ? &it->second : nullptr;
+}
+
+// Helper function to get fake MTP device details.
+void GetFakeMtpStorageInfo(
+    const std::string& storage_name,
+    device::MediaTransferProtocolManager::GetStorageInfoCallback callback) {
+  std::move(callback).Run(GetFakeMtpStorageInfoSync(storage_name));
 }
 
 class TestMediaTransferProtocolDeviceObserverChromeOS
@@ -152,12 +156,17 @@
 
 // Test to verify basic mtp storage attach and detach notifications.
 TEST_F(MediaTransferProtocolDeviceObserverChromeOSTest, BasicAttachDetach) {
+  auto* mtpStorageInfo = GetFakeMtpStorageInfoSync(kStorageWithValidInfo);
+  std::string device_id = GetDeviceIdFromStorageInfo(*mtpStorageInfo);
 
   // Attach a mtp storage.
   mtp_device_observer()->MtpStorageAttached(kStorageWithValidInfo);
 
   EXPECT_EQ(1, observer().attach_calls());
   EXPECT_EQ(0, observer().detach_calls());
+  EXPECT_EQ(device_id, observer().last_attached().device_id());
+  EXPECT_EQ(GetDeviceLocationFromStorageName(kStorageWithValidInfo),
+            observer().last_attached().location());
   EXPECT_EQ(base::ASCIIToUTF16(kStorageVendor),
             observer().last_attached().vendor_name());
   EXPECT_EQ(base::ASCIIToUTF16(kStorageProduct),
@@ -168,6 +177,7 @@
 
   EXPECT_EQ(1, observer().attach_calls());
   EXPECT_EQ(1, observer().detach_calls());
+  EXPECT_EQ(device_id, observer().last_detached().device_id());
 }
 
 // When a mtp storage device with invalid storage label and id is
diff --git a/components/storage_monitor/storage_info_utils.cc b/components/storage_monitor/storage_info_utils.cc
new file mode 100644
index 0000000..0f94ea5
--- /dev/null
+++ b/components/storage_monitor/storage_info_utils.cc
@@ -0,0 +1,98 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/storage_monitor/storage_info_utils.h"
+
+#include <string>
+
+#include "base/files/file_path.h"
+#include "base/stl_util.h"
+#include "base/strings/string_number_conversions.h"
+#include "base/strings/string_split.h"
+#include "base/strings/utf_string_conversions.h"
+#include "components/storage_monitor/removable_device_constants.h"
+#include "components/storage_monitor/storage_info.h"
+
+namespace storage_monitor {
+
+namespace {
+
+// Device root path constant.
+const char kRootPath[] = "/";
+
+// Returns the storage identifier of the device from the given |storage_name|.
+// E.g. If the |storage_name| is "usb:2,2:65537", the storage identifier is
+// "65537".
+std::string GetStorageIdFromStorageName(const std::string& storage_name) {
+  std::vector<base::StringPiece> name_parts = base::SplitStringPiece(
+      storage_name, ":", base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL);
+  return name_parts.size() == 3 ? name_parts[2].as_string() : std::string();
+}
+
+// Returns the |data_store_id| string in the required format.
+// If the |data_store_id| is 65537, this function returns " (65537)".
+std::string GetFormattedIdString(const std::string& data_store_id) {
+  return ("(" + data_store_id + ")");
+}
+
+}  // namespace
+
+// Constructs and returns the location of the device using the |storage_name|.
+std::string GetDeviceLocationFromStorageName(const std::string& storage_name) {
+  // Construct a dummy device path using the storage name. This is only used
+  // for registering device media file system.
+  // E.g.: If the |storage_name| is "usb:2,2:12345" then "/usb:2,2:12345" is the
+  // device location.
+  DCHECK(!storage_name.empty());
+  return kRootPath + storage_name;
+}
+
+// Returns a unique device id from the given |storage_info|.
+std::string GetDeviceIdFromStorageInfo(
+    const device::mojom::MtpStorageInfo& storage_info) {
+  const std::string storage_id =
+      GetStorageIdFromStorageName(storage_info.storage_name);
+  if (storage_id.empty())
+    return std::string();
+
+  // Some devices have multiple data stores. Therefore, include storage id as
+  // part of unique id along with vendor, model and volume information.
+  const std::string vendor_id = base::UintToString(storage_info.vendor_id);
+  const std::string model_id = base::UintToString(storage_info.product_id);
+  return StorageInfo::MakeDeviceId(
+      StorageInfo::MTP_OR_PTP,
+      kVendorModelVolumeStoragePrefix + vendor_id + ":" + model_id + ":" +
+          storage_info.volume_identifier + ":" + storage_id);
+}
+
+// Helper function to get device label from storage information.
+base::string16 GetDeviceLabelFromStorageInfo(
+    const device::mojom::MtpStorageInfo& storage_info) {
+  std::string device_label;
+  const std::string& vendor_name = storage_info.vendor;
+  device_label = vendor_name;
+
+  const std::string& product_name = storage_info.product;
+  if (!product_name.empty()) {
+    if (!device_label.empty())
+      device_label += " ";
+    device_label += product_name;
+  }
+
+  // Add the data store id to the device label.
+  if (!device_label.empty()) {
+    const std::string& volume_id = storage_info.volume_identifier;
+    if (!volume_id.empty()) {
+      device_label += GetFormattedIdString(volume_id);
+    } else {
+      const std::string data_store_id =
+          GetStorageIdFromStorageName(storage_info.storage_name);
+      if (!data_store_id.empty())
+        device_label += GetFormattedIdString(data_store_id);
+    }
+  }
+  return base::UTF8ToUTF16(device_label);
+}
+
+}  // namespace storage_monitor
diff --git a/components/storage_monitor/storage_info_utils.h b/components/storage_monitor/storage_info_utils.h
new file mode 100644
index 0000000..32d667d
--- /dev/null
+++ b/components/storage_monitor/storage_info_utils.h
@@ -0,0 +1,31 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// StorageInfoUtil provides some general functions to get information
+// from device::mojom::MtpStorageInfo needed by storage_monitor::StorageInfo.
+
+#ifndef COMPONENTS_STORAGE_MONITOR_STORAGE_INFO_UTILS_H_
+#define COMPONENTS_STORAGE_MONITOR_STORAGE_INFO_UTILS_H_
+
+#include <string>
+
+#include "base/strings/string16.h"
+#include "device/media_transfer_protocol/public/interfaces/mtp_storage_info.mojom.h"
+
+namespace storage_monitor {
+
+// Constructs and returns the location of the device using the |storage_name|.
+std::string GetDeviceLocationFromStorageName(const std::string& storage_name);
+
+// Returns a unique device id from the given |storage_info|.
+std::string GetDeviceIdFromStorageInfo(
+    const device::mojom::MtpStorageInfo& storage_info);
+
+// Helper function to get device label from storage information.
+base::string16 GetDeviceLabelFromStorageInfo(
+    const device::mojom::MtpStorageInfo& storage_info);
+
+}  // namespace storage_monitor
+
+#endif  // COMPONENTS_STORAGE_MONITOR_STORAGE_INFO_UTILS_H_
diff --git a/content/BUILD.gn b/content/BUILD.gn
index 6123821..bc818db7 100644
--- a/content/BUILD.gn
+++ b/content/BUILD.gn
@@ -65,7 +65,6 @@
     "//content/public/child:child_sources",
     "//content/public/common:common_sources",
     "//content/public/gpu:gpu_sources",
-    "//content/public/network:network_sources",
     "//content/public/renderer:renderer_sources",
     "//content/public/utility:utility_sources",
   ]
diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
index 11aaf4b..49759752 100644
--- a/content/browser/BUILD.gn
+++ b/content/browser/BUILD.gn
@@ -129,6 +129,7 @@
     "//services/file/public/interfaces",
     "//services/metrics",
     "//services/metrics/public/cpp:metrics_cpp",
+    "//services/network:network_service",
     "//services/network/public/cpp",
     "//services/network/public/interfaces",
     "//services/resource_coordinator:lib",
diff --git a/content/browser/accessibility/web_contents_accessibility_android.cc b/content/browser/accessibility/web_contents_accessibility_android.cc
index 27bdab7..2d82fca 100644
--- a/content/browser/accessibility/web_contents_accessibility_android.cc
+++ b/content/browser/accessibility/web_contents_accessibility_android.cc
@@ -19,7 +19,7 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/use_zoom_for_dsf_policy.h"
-#include "jni/WebContentsAccessibility_jni.h"
+#include "jni/WebContentsAccessibilityImpl_jni.h"
 #include "ui/events/android/motion_event_android.h"
 
 using base::android::AttachCurrentThread;
@@ -364,7 +364,7 @@
   // Clean up autofill popup proxy node in case the popup was not dismissed.
   DeleteAutofillPopupProxy();
 
-  Java_WebContentsAccessibility_onNativeObjectDestroyed(env, obj);
+  Java_WebContentsAccessibilityImpl_onNativeObjectDestroyed(env, obj);
 }
 
 jboolean WebContentsAccessibilityAndroid::IsEnabled(
@@ -403,8 +403,8 @@
   ScopedJavaLocalRef<jobject> obj = java_ref_.get(env);
   if (obj.is_null())
     return false;
-  return Java_WebContentsAccessibility_shouldRespectDisplayedPasswordText(env,
-                                                                          obj);
+  return Java_WebContentsAccessibilityImpl_shouldRespectDisplayedPasswordText(
+      env, obj);
 }
 
 bool WebContentsAccessibilityAndroid::ShouldExposePasswordText() {
@@ -412,7 +412,7 @@
   ScopedJavaLocalRef<jobject> obj = java_ref_.get(env);
   if (obj.is_null())
     return false;
-  return Java_WebContentsAccessibility_shouldExposePasswordText(env, obj);
+  return Java_WebContentsAccessibilityImpl_shouldExposePasswordText(env, obj);
 }
 
 void WebContentsAccessibilityAndroid::HandlePageLoaded(int32_t unique_id) {
@@ -420,7 +420,7 @@
   ScopedJavaLocalRef<jobject> obj = java_ref_.get(env);
   if (obj.is_null())
     return;
-  Java_WebContentsAccessibility_handlePageLoaded(env, obj, unique_id);
+  Java_WebContentsAccessibilityImpl_handlePageLoaded(env, obj, unique_id);
 }
 
 void WebContentsAccessibilityAndroid::HandleContentChanged(int32_t unique_id) {
@@ -428,7 +428,7 @@
   ScopedJavaLocalRef<jobject> obj = java_ref_.get(env);
   if (obj.is_null())
     return;
-  Java_WebContentsAccessibility_handleContentChanged(env, obj, unique_id);
+  Java_WebContentsAccessibilityImpl_handleContentChanged(env, obj, unique_id);
 }
 
 void WebContentsAccessibilityAndroid::HandleFocusChanged(int32_t unique_id) {
@@ -436,7 +436,7 @@
   ScopedJavaLocalRef<jobject> obj = java_ref_.get(env);
   if (obj.is_null())
     return;
-  Java_WebContentsAccessibility_handleFocusChanged(env, obj, unique_id);
+  Java_WebContentsAccessibilityImpl_handleFocusChanged(env, obj, unique_id);
 }
 
 void WebContentsAccessibilityAndroid::HandleCheckStateChanged(
@@ -445,7 +445,8 @@
   ScopedJavaLocalRef<jobject> obj = java_ref_.get(env);
   if (obj.is_null())
     return;
-  Java_WebContentsAccessibility_handleCheckStateChanged(env, obj, unique_id);
+  Java_WebContentsAccessibilityImpl_handleCheckStateChanged(env, obj,
+                                                            unique_id);
 }
 
 void WebContentsAccessibilityAndroid::HandleClicked(int32_t unique_id) {
@@ -453,7 +454,7 @@
   ScopedJavaLocalRef<jobject> obj = java_ref_.get(env);
   if (obj.is_null())
     return;
-  Java_WebContentsAccessibility_handleClicked(env, obj, unique_id);
+  Java_WebContentsAccessibilityImpl_handleClicked(env, obj, unique_id);
 }
 
 void WebContentsAccessibilityAndroid::HandleScrollPositionChanged(
@@ -462,8 +463,8 @@
   ScopedJavaLocalRef<jobject> obj = java_ref_.get(env);
   if (obj.is_null())
     return;
-  Java_WebContentsAccessibility_handleScrollPositionChanged(env, obj,
-                                                            unique_id);
+  Java_WebContentsAccessibilityImpl_handleScrollPositionChanged(env, obj,
+                                                                unique_id);
 }
 
 void WebContentsAccessibilityAndroid::HandleScrolledToAnchor(
@@ -472,7 +473,7 @@
   ScopedJavaLocalRef<jobject> obj = java_ref_.get(env);
   if (obj.is_null())
     return;
-  Java_WebContentsAccessibility_handleScrolledToAnchor(env, obj, unique_id);
+  Java_WebContentsAccessibilityImpl_handleScrolledToAnchor(env, obj, unique_id);
 }
 
 void WebContentsAccessibilityAndroid::AnnounceLiveRegionText(
@@ -481,7 +482,7 @@
   ScopedJavaLocalRef<jobject> obj = java_ref_.get(env);
   if (obj.is_null())
     return;
-  Java_WebContentsAccessibility_announceLiveRegionText(
+  Java_WebContentsAccessibilityImpl_announceLiveRegionText(
       env, obj, base::android::ConvertUTF16ToJavaString(env, text));
 }
 
@@ -491,7 +492,8 @@
   ScopedJavaLocalRef<jobject> obj = java_ref_.get(env);
   if (obj.is_null())
     return;
-  Java_WebContentsAccessibility_handleTextSelectionChanged(env, obj, unique_id);
+  Java_WebContentsAccessibilityImpl_handleTextSelectionChanged(env, obj,
+                                                               unique_id);
 }
 
 void WebContentsAccessibilityAndroid::HandleEditableTextChanged(
@@ -500,7 +502,8 @@
   ScopedJavaLocalRef<jobject> obj = java_ref_.get(env);
   if (obj.is_null())
     return;
-  Java_WebContentsAccessibility_handleEditableTextChanged(env, obj, unique_id);
+  Java_WebContentsAccessibilityImpl_handleEditableTextChanged(env, obj,
+                                                              unique_id);
 }
 
 void WebContentsAccessibilityAndroid::HandleSliderChanged(int32_t unique_id) {
@@ -508,7 +511,7 @@
   ScopedJavaLocalRef<jobject> obj = java_ref_.get(env);
   if (obj.is_null())
     return;
-  Java_WebContentsAccessibility_handleSliderChanged(env, obj, unique_id);
+  Java_WebContentsAccessibilityImpl_handleSliderChanged(env, obj, unique_id);
 }
 
 void WebContentsAccessibilityAndroid::SendDelayedWindowContentChangedEvent() {
@@ -516,7 +519,8 @@
   ScopedJavaLocalRef<jobject> obj = java_ref_.get(env);
   if (obj.is_null())
     return;
-  Java_WebContentsAccessibility_sendDelayedWindowContentChangedEvent(env, obj);
+  Java_WebContentsAccessibilityImpl_sendDelayedWindowContentChangedEvent(env,
+                                                                         obj);
 }
 
 void WebContentsAccessibilityAndroid::HandleHover(int32_t unique_id) {
@@ -524,7 +528,7 @@
   ScopedJavaLocalRef<jobject> obj = java_ref_.get(env);
   if (obj.is_null())
     return;
-  Java_WebContentsAccessibility_handleHover(env, obj, unique_id);
+  Java_WebContentsAccessibilityImpl_handleHover(env, obj, unique_id);
 }
 
 bool WebContentsAccessibilityAndroid::OnHoverEvent(
@@ -534,7 +538,8 @@
   if (obj.is_null())
     return false;
 
-  if (!Java_WebContentsAccessibility_onHoverEvent(env, obj, event.GetAction()))
+  if (!Java_WebContentsAccessibilityImpl_onHoverEvent(env, obj,
+                                                      event.GetAction()))
     return false;
 
   // |HitTest| sends an IPC to the render process to do the hit testing.
@@ -555,7 +560,7 @@
   ScopedJavaLocalRef<jobject> obj = java_ref_.get(env);
   if (obj.is_null())
     return;
-  Java_WebContentsAccessibility_handleNavigate(env, obj);
+  Java_WebContentsAccessibilityImpl_handleNavigate(env, obj);
 }
 
 base::android::ScopedJavaLocalRef<jstring>
@@ -649,31 +654,31 @@
   if (node->PlatformGetParent()) {
     auto* android_node =
         static_cast<BrowserAccessibilityAndroid*>(node->PlatformGetParent());
-    Java_WebContentsAccessibility_setAccessibilityNodeInfoParent(
+    Java_WebContentsAccessibilityImpl_setAccessibilityNodeInfoParent(
         env, obj, info, android_node->unique_id());
   }
   for (unsigned i = 0; i < node->PlatformChildCount(); ++i) {
     auto* android_node =
         static_cast<BrowserAccessibilityAndroid*>(node->PlatformGetChild(i));
-    Java_WebContentsAccessibility_addAccessibilityNodeInfoChild(
+    Java_WebContentsAccessibilityImpl_addAccessibilityNodeInfoChild(
         env, obj, info, android_node->unique_id());
   }
-  Java_WebContentsAccessibility_setAccessibilityNodeInfoBooleanAttributes(
+  Java_WebContentsAccessibilityImpl_setAccessibilityNodeInfoBooleanAttributes(
       env, obj, info, unique_id, node->IsCheckable(), node->IsChecked(),
       node->IsClickable(), node->IsEnabled(), node->IsFocusable(),
       node->IsFocused(), node->IsPassword(), node->IsScrollable(),
       node->IsSelected(), node->IsVisibleToUser());
-  Java_WebContentsAccessibility_addAccessibilityNodeInfoActions(
+  Java_WebContentsAccessibilityImpl_addAccessibilityNodeInfoActions(
       env, obj, info, unique_id, node->CanScrollForward(),
       node->CanScrollBackward(), node->CanScrollUp(), node->CanScrollDown(),
       node->CanScrollLeft(), node->CanScrollRight(), node->IsClickable(),
       node->IsEditableText(), node->IsEnabled(), node->IsFocusable(),
       node->IsFocused(), node->IsCollapsed(), node->IsExpanded(),
       node->HasNonEmptyValue());
-  Java_WebContentsAccessibility_setAccessibilityNodeInfoClassName(
+  Java_WebContentsAccessibilityImpl_setAccessibilityNodeInfoClassName(
       env, obj, info,
       base::android::ConvertUTF8ToJavaString(env, node->GetClassName()));
-  Java_WebContentsAccessibility_setAccessibilityNodeInfoText(
+  Java_WebContentsAccessibilityImpl_setAccessibilityNodeInfoText(
       env, obj, info,
       base::android::ConvertUTF16ToJavaString(env, node->GetText()),
       node->IsLink(), node->IsEditableText(),
@@ -682,7 +687,7 @@
                    ax::mojom::StringAttribute::kLanguage)));
   base::string16 element_id;
   if (node->GetHtmlAttribute("id", &element_id)) {
-    Java_WebContentsAccessibility_setAccessibilityNodeInfoViewIdResourceName(
+    Java_WebContentsAccessibilityImpl_setAccessibilityNodeInfoViewIdResourceName(
         env, obj, info,
         base::android::ConvertUTF16ToJavaString(env, element_id));
   }
@@ -694,12 +699,12 @@
     parent_relative_rect.Offset(-parent_rect.OffsetFromOrigin());
   }
   bool is_root = node->PlatformGetParent() == NULL;
-  Java_WebContentsAccessibility_setAccessibilityNodeInfoLocation(
+  Java_WebContentsAccessibilityImpl_setAccessibilityNodeInfoLocation(
       env, obj, info, unique_id, absolute_rect.x(), absolute_rect.y(),
       parent_relative_rect.x(), parent_relative_rect.y(), absolute_rect.width(),
       absolute_rect.height(), is_root);
 
-  Java_WebContentsAccessibility_setAccessibilityNodeInfoKitKatAttributes(
+  Java_WebContentsAccessibilityImpl_setAccessibilityNodeInfoKitKatAttributes(
       env, obj, info, is_root, node->IsEditableText(),
       base::android::ConvertUTF8ToJavaString(env, node->GetRoleString()),
       base::android::ConvertUTF16ToJavaString(env, node->GetRoleDescription()),
@@ -707,7 +712,7 @@
       node->GetIntAttribute(ax::mojom::IntAttribute::kTextSelStart),
       node->GetIntAttribute(ax::mojom::IntAttribute::kTextSelEnd));
 
-  Java_WebContentsAccessibility_setAccessibilityNodeInfoLollipopAttributes(
+  Java_WebContentsAccessibilityImpl_setAccessibilityNodeInfoLollipopAttributes(
       env, obj, info, node->CanOpenPopup(), node->IsContentInvalid(),
       node->IsDismissable(), node->IsMultiLine(), node->AndroidInputType(),
       node->AndroidLiveRegionType());
@@ -715,21 +720,21 @@
   bool has_character_locations =
       node->GetRole() == ax::mojom::Role::kStaticText ||
       node->IsInterestingOnAndroid();
-  Java_WebContentsAccessibility_setAccessibilityNodeInfoOAttributes(
+  Java_WebContentsAccessibilityImpl_setAccessibilityNodeInfoOAttributes(
       env, obj, info, has_character_locations);
 
   if (node->IsCollection()) {
-    Java_WebContentsAccessibility_setAccessibilityNodeInfoCollectionInfo(
+    Java_WebContentsAccessibilityImpl_setAccessibilityNodeInfoCollectionInfo(
         env, obj, info, node->RowCount(), node->ColumnCount(),
         node->IsHierarchical());
   }
   if (node->IsCollectionItem() || node->IsHeading()) {
-    Java_WebContentsAccessibility_setAccessibilityNodeInfoCollectionItemInfo(
+    Java_WebContentsAccessibilityImpl_setAccessibilityNodeInfoCollectionItemInfo(
         env, obj, info, node->RowIndex(), node->RowSpan(), node->ColumnIndex(),
         node->ColumnSpan(), node->IsHeading());
   }
   if (node->IsRangeType()) {
-    Java_WebContentsAccessibility_setAccessibilityNodeInfoRangeInfo(
+    Java_WebContentsAccessibilityImpl_setAccessibilityNodeInfoRangeInfo(
         env, obj, info, node->AndroidRangeType(), node->RangeMin(),
         node->RangeMax(), node->RangeCurrentValue());
   }
@@ -747,15 +752,15 @@
   if (!node)
     return false;
 
-  Java_WebContentsAccessibility_setAccessibilityEventBooleanAttributes(
+  Java_WebContentsAccessibilityImpl_setAccessibilityEventBooleanAttributes(
       env, obj, event, node->IsChecked(), node->IsEnabled(), node->IsPassword(),
       node->IsScrollable());
-  Java_WebContentsAccessibility_setAccessibilityEventClassName(
+  Java_WebContentsAccessibilityImpl_setAccessibilityEventClassName(
       env, obj, event,
       base::android::ConvertUTF8ToJavaString(env, node->GetClassName()));
-  Java_WebContentsAccessibility_setAccessibilityEventListAttributes(
+  Java_WebContentsAccessibilityImpl_setAccessibilityEventListAttributes(
       env, obj, event, node->GetItemIndex(), node->GetItemCount());
-  Java_WebContentsAccessibility_setAccessibilityEventScrollAttributes(
+  Java_WebContentsAccessibilityImpl_setAccessibilityEventScrollAttributes(
       env, obj, event, node->GetScrollX(), node->GetScrollY(),
       node->GetMaxScrollX(), node->GetMaxScrollY());
 
@@ -763,7 +768,7 @@
     case ANDROID_ACCESSIBILITY_EVENT_TEXT_CHANGED: {
       base::string16 before_text = node->GetTextChangeBeforeText();
       base::string16 text = node->GetText();
-      Java_WebContentsAccessibility_setAccessibilityEventTextChangedAttrs(
+      Java_WebContentsAccessibilityImpl_setAccessibilityEventTextChangedAttrs(
           env, obj, event, node->GetTextChangeFromIndex(),
           node->GetTextChangeAddedCount(), node->GetTextChangeRemovedCount(),
           base::android::ConvertUTF16ToJavaString(env, before_text),
@@ -772,7 +777,7 @@
     }
     case ANDROID_ACCESSIBILITY_EVENT_TEXT_SELECTION_CHANGED: {
       base::string16 text = node->GetText();
-      Java_WebContentsAccessibility_setAccessibilityEventSelectionAttrs(
+      Java_WebContentsAccessibilityImpl_setAccessibilityEventSelectionAttrs(
           env, obj, event, node->GetSelectionStart(), node->GetSelectionEnd(),
           node->GetEditableTextLength(),
           base::android::ConvertUTF16ToJavaString(env, text));
@@ -782,26 +787,26 @@
       break;
   }
 
-  Java_WebContentsAccessibility_setAccessibilityEventLollipopAttributes(
+  Java_WebContentsAccessibilityImpl_setAccessibilityEventLollipopAttributes(
       env, obj, event, node->CanOpenPopup(), node->IsContentInvalid(),
       node->IsDismissable(), node->IsMultiLine(), node->AndroidInputType(),
       node->AndroidLiveRegionType());
   if (node->IsCollection()) {
-    Java_WebContentsAccessibility_setAccessibilityEventCollectionInfo(
+    Java_WebContentsAccessibilityImpl_setAccessibilityEventCollectionInfo(
         env, obj, event, node->RowCount(), node->ColumnCount(),
         node->IsHierarchical());
   }
   if (node->IsHeading()) {
-    Java_WebContentsAccessibility_setAccessibilityEventHeadingFlag(env, obj,
-                                                                   event, true);
+    Java_WebContentsAccessibilityImpl_setAccessibilityEventHeadingFlag(
+        env, obj, event, true);
   }
   if (node->IsCollectionItem()) {
-    Java_WebContentsAccessibility_setAccessibilityEventCollectionItemInfo(
+    Java_WebContentsAccessibilityImpl_setAccessibilityEventCollectionItemInfo(
         env, obj, event, node->RowIndex(), node->RowSpan(), node->ColumnIndex(),
         node->ColumnSpan());
   }
   if (node->IsRangeType()) {
-    Java_WebContentsAccessibility_setAccessibilityEventRangeInfo(
+    Java_WebContentsAccessibilityImpl_setAccessibilityEventRangeInfo(
         env, obj, event, node->AndroidRangeType(), node->RangeMin(),
         node->RangeMax(), node->RangeCurrentValue());
   }
@@ -993,7 +998,7 @@
   if (root_manager_->NextAtGranularity(granularity, cursor_index, node,
                                        &start_index, &end_index)) {
     base::string16 text = node->GetText();
-    Java_WebContentsAccessibility_finishGranularityMove(
+    Java_WebContentsAccessibilityImpl_finishGranularityMove(
         env, obj, base::android::ConvertUTF16ToJavaString(env, text),
         extend_selection, start_index, end_index, true);
     return true;
@@ -1029,7 +1034,7 @@
   int end_index = -1;
   if (root_manager_->PreviousAtGranularity(granularity, cursor_index, node,
                                            &start_index, &end_index)) {
-    Java_WebContentsAccessibility_finishGranularityMove(
+    Java_WebContentsAccessibilityImpl_finishGranularityMove(
         env, obj, base::android::ConvertUTF16ToJavaString(env, node->GetText()),
         extend_selection, start_index, end_index, false);
     return true;
@@ -1200,7 +1205,7 @@
   if (obj.is_null())
     return;
 
-  Java_WebContentsAccessibility_notifyFrameInfoInitialized(env, obj);
+  Java_WebContentsAccessibilityImpl_notifyFrameInfoInitialized(env, obj);
   frame_info_initialized_ = true;
 }
 
@@ -1211,8 +1216,8 @@
     return;
 
   int event_type_mask =
-      Java_WebContentsAccessibility_getAccessibilityServiceEventTypeMask(env,
-                                                                         obj);
+      Java_WebContentsAccessibilityImpl_getAccessibilityServiceEventTypeMask(
+          env, obj);
   EVENT_TYPE_HISTOGRAM(event_type_mask, ANNOUNCEMENT);
   EVENT_TYPE_HISTOGRAM(event_type_mask, ASSIST_READING_CONTEXT);
   EVENT_TYPE_HISTOGRAM(event_type_mask, GESTURE_DETECTION_END);
@@ -1241,7 +1246,7 @@
   EVENT_TYPE_HISTOGRAM(event_type_mask, WINDOW_STATE_CHANGED);
 
   int feedback_type_mask =
-      Java_WebContentsAccessibility_getAccessibilityServiceFeedbackTypeMask(
+      Java_WebContentsAccessibilityImpl_getAccessibilityServiceFeedbackTypeMask(
           env, obj);
   FEEDBACK_TYPE_HISTOGRAM(feedback_type_mask, SPOKEN);
   FEEDBACK_TYPE_HISTOGRAM(feedback_type_mask, HAPTIC);
@@ -1251,7 +1256,8 @@
   FEEDBACK_TYPE_HISTOGRAM(feedback_type_mask, BRAILLE);
 
   int flags_mask =
-      Java_WebContentsAccessibility_getAccessibilityServiceFlagsMask(env, obj);
+      Java_WebContentsAccessibilityImpl_getAccessibilityServiceFlagsMask(env,
+                                                                         obj);
   FLAGS_HISTOGRAM(flags_mask, INCLUDE_NOT_IMPORTANT_VIEWS);
   FLAGS_HISTOGRAM(flags_mask, REQUEST_TOUCH_EXPLORATION_MODE);
   FLAGS_HISTOGRAM(flags_mask, REQUEST_ENHANCED_WEB_ACCESSIBILITY);
@@ -1261,7 +1267,7 @@
   FLAGS_HISTOGRAM(flags_mask, FORCE_DIRECT_BOOT_AWARE);
 
   int capabilities_mask =
-      Java_WebContentsAccessibility_getAccessibilityServiceCapabilitiesMask(
+      Java_WebContentsAccessibilityImpl_getAccessibilityServiceCapabilitiesMask(
           env, obj);
   CAPABILITY_TYPE_HISTOGRAM(capabilities_mask, CAN_RETRIEVE_WINDOW_CONTENT);
   CAPABILITY_TYPE_HISTOGRAM(capabilities_mask, CAN_REQUEST_TOUCH_EXPLORATION);
@@ -1272,7 +1278,7 @@
   CAPABILITY_TYPE_HISTOGRAM(capabilities_mask, CAN_PERFORM_GESTURES);
 }
 
-jlong JNI_WebContentsAccessibility_Init(
+jlong JNI_WebContentsAccessibilityImpl_Init(
     JNIEnv* env,
     const JavaParamRef<jobject>& obj,
     const JavaParamRef<jobject>& jweb_contents) {
diff --git a/content/browser/appcache/appcache_browsertest.cc b/content/browser/appcache/appcache_browsertest.cc
index 676460e..9192bbe 100644
--- a/content/browser/appcache/appcache_browsertest.cc
+++ b/content/browser/appcache/appcache_browsertest.cc
@@ -7,7 +7,6 @@
 #include "base/test/scoped_feature_list.h"
 #include "build/build_config.h"
 #include "content/browser/appcache/appcache_subresource_url_factory.h"
-#include "content/public/common/content_features.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -18,6 +17,7 @@
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/test/embedded_test_server/http_request.h"
 #include "net/test/embedded_test_server/http_response.h"
+#include "services/network/public/cpp/features.h"
 namespace content {
 
 // This class currently enables the network service feature, which allows us to
@@ -25,7 +25,8 @@
 class AppCacheNetworkServiceBrowserTest : public ContentBrowserTest {
  public:
   AppCacheNetworkServiceBrowserTest() {
-    scoped_feature_list_.InitAndEnableFeature(features::kNetworkService);
+    scoped_feature_list_.InitAndEnableFeature(
+        network::features::kNetworkService);
   }
 
   ~AppCacheNetworkServiceBrowserTest() override {}
diff --git a/content/browser/appcache/appcache_host.cc b/content/browser/appcache/appcache_host.cc
index b79c46243..fb36d40 100644
--- a/content/browser/appcache/appcache_host.cc
+++ b/content/browser/appcache/appcache_host.cc
@@ -16,6 +16,7 @@
 #include "content/browser/appcache/appcache_subresource_url_factory.h"
 #include "content/public/common/content_features.h"
 #include "net/url_request/url_request.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/interfaces/url_loader_factory.mojom.h"
 #include "storage/browser/quota/quota_manager_proxy.h"
 
@@ -527,7 +528,7 @@
 }
 
 void AppCacheHost::MaybePassSubresourceFactory() {
-  if (!base::FeatureList::IsEnabled(features::kNetworkService))
+  if (!base::FeatureList::IsEnabled(network::features::kNetworkService))
     return;
 
   // We already have a valid factory. This happens when the document was loaded
diff --git a/content/browser/appcache/appcache_request_handler.cc b/content/browser/appcache/appcache_request_handler.cc
index 729e5201..a72a03e 100644
--- a/content/browser/appcache/appcache_request_handler.cc
+++ b/content/browser/appcache/appcache_request_handler.cc
@@ -20,9 +20,9 @@
 #include "content/browser/appcache/appcache_url_request_job.h"
 #include "content/browser/service_worker/service_worker_request_handler.h"
 #include "content/common/navigation_subresource_loader_params.h"
-#include "content/public/common/content_features.h"
 #include "net/url_request/url_request.h"
 #include "net/url_request/url_request_job.h"
+#include "services/network/public/cpp/features.h"
 
 namespace content {
 
@@ -180,7 +180,7 @@
 
   // We don't fallback for responses that we delivered.
   if (job_.get()) {
-    if (!base::FeatureList::IsEnabled(features::kNetworkService)) {
+    if (!base::FeatureList::IsEnabled(network::features::kNetworkService)) {
       DCHECK(!job_->IsDeliveringNetworkResponse());
       return nullptr;
     } else if (job_->IsDeliveringAppCacheResponse() ||
@@ -347,7 +347,7 @@
 std::unique_ptr<AppCacheJob> AppCacheRequestHandler::CreateJob(
     net::NetworkDelegate* network_delegate) {
   std::unique_ptr<AppCacheJob> job;
-  if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     job.reset(new AppCacheURLLoaderJob(request_->AsURLLoaderRequest(),
                                        storage(), std::move(loader_callback_)));
   } else {
diff --git a/content/browser/appcache/appcache_request_handler_unittest.cc b/content/browser/appcache/appcache_request_handler_unittest.cc
index 8d419286..d2bf1620 100644
--- a/content/browser/appcache/appcache_request_handler_unittest.cc
+++ b/content/browser/appcache/appcache_request_handler_unittest.cc
@@ -35,7 +35,6 @@
 #include "content/browser/appcache/appcache_url_request_job.h"
 #include "content/browser/appcache/mock_appcache_policy.h"
 #include "content/browser/appcache/mock_appcache_service.h"
-#include "content/public/common/content_features.h"
 #include "net/base/net_errors.h"
 #include "net/base/request_priority.h"
 #include "net/http/http_response_headers.h"
@@ -45,6 +44,7 @@
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_error_job.h"
 #include "net/url_request/url_request_job_factory.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -220,7 +220,7 @@
       : host_(nullptr), request_(nullptr), request_handler_type_(GetParam()) {
     AppCacheRequestHandler::SetRunningInTests(true);
     if (request_handler_type_ == URLLOADER)
-      feature_list_.InitAndEnableFeature(features::kNetworkService);
+      feature_list_.InitAndEnableFeature(network::features::kNetworkService);
   }
 
   ~AppCacheRequestHandlerTest() {
diff --git a/content/browser/appcache/appcache_update_job_unittest.cc b/content/browser/appcache/appcache_update_job_unittest.cc
index 7f7d3af..7d83cd92 100644
--- a/content/browser/appcache/appcache_update_job_unittest.cc
+++ b/content/browser/appcache/appcache_update_job_unittest.cc
@@ -28,7 +28,6 @@
 #include "content/browser/appcache/appcache_update_url_loader_request.h"
 #include "content/browser/appcache/mock_appcache_service.h"
 #include "content/browser/url_loader_factory_getter.h"
-#include "content/public/common/content_features.h"
 #include "content/public/test/test_browser_thread_bundle.h"
 #include "mojo/public/cpp/bindings/binding.h"
 #include "mojo/public/cpp/system/data_pipe.h"
@@ -40,6 +39,7 @@
 #include "net/url_request/url_request_job_factory_impl.h"
 #include "net/url_request/url_request_test_job.h"
 #include "net/url_request/url_request_test_util.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/interfaces/url_loader.mojom.h"
 #include "services/network/public/interfaces/url_loader_factory.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -712,7 +712,7 @@
 
     if (request_handler_type_ == URLLOADER) {
       loader_factory_getter_ = new URLLoaderFactoryGetter();
-      feature_list_.InitAndEnableFeature(features::kNetworkService);
+      feature_list_.InitAndEnableFeature(network::features::kNetworkService);
       BrowserThread::PostTask(
           BrowserThread::IO, FROM_HERE,
           base::BindOnce(&AppCacheUpdateJobTest::InitializeFactory,
diff --git a/content/browser/appcache/appcache_update_request_base.cc b/content/browser/appcache/appcache_update_request_base.cc
index b2f68d2..194624f5 100644
--- a/content/browser/appcache/appcache_update_request_base.cc
+++ b/content/browser/appcache/appcache_update_request_base.cc
@@ -7,6 +7,7 @@
 #include "content/browser/appcache/appcache_update_url_request.h"
 #include "content/public/common/content_features.h"
 #include "net/url_request/url_request_context.h"
+#include "services/network/public/cpp/features.h"
 
 namespace content {
 
@@ -51,7 +52,7 @@
     const GURL& url,
     int buffer_size,
     URLFetcher* fetcher) {
-  if (!base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (!base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     return std::unique_ptr<UpdateRequestBase>(new UpdateURLRequest(
         appcache_service->request_context(), url, buffer_size, fetcher));
   } else {
diff --git a/content/browser/blob_storage/blob_url_unittest.cc b/content/browser/blob_storage/blob_url_unittest.cc
index b3ad892..35a2322 100644
--- a/content/browser/blob_storage/blob_url_unittest.cc
+++ b/content/browser/blob_storage/blob_url_unittest.cc
@@ -22,7 +22,6 @@
 #include "content/browser/blob_storage/blob_url_loader_factory.h"
 #include "content/browser/url_loader_factory_getter.h"
 #include "content/public/test/test_browser_thread_bundle.h"
-#include "content/public/test/test_url_loader_client.h"
 #include "mojo/common/data_pipe_utils.h"
 #include "net/base/net_errors.h"
 #include "net/base/request_priority.h"
@@ -36,6 +35,7 @@
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_job_factory_impl.h"
 #include "net/url_request/url_request_test_util.h"
+#include "services/network/test/test_url_loader_client.h"
 #include "storage/browser/blob/blob_data_builder.h"
 #include "storage/browser/blob/blob_data_handle.h"
 #include "storage/browser/blob/blob_data_snapshot.h"
@@ -288,7 +288,7 @@
         request.headers = extra_headers;
 
         network::mojom::URLLoaderPtr url_loader;
-        TestURLLoaderClient url_loader_client;
+        network::TestURLLoaderClient url_loader_client;
         scoped_refptr<BlobURLLoaderFactory> factory =
             BlobURLLoaderFactory::Create(
                 base::BindOnce(&BlobURLRequestJobTest::GetStorageContext,
@@ -338,7 +338,7 @@
             MakeRequest(&blob_ptr));
 
         network::mojom::URLLoaderPtr url_loader;
-        TestURLLoaderClient url_loader_client;
+        network::TestURLLoaderClient url_loader_client;
         blob_ptr->CreateLoader(MakeRequest(&url_loader), extra_headers,
                                url_loader_client.CreateInterfacePtr());
         url_loader_client.RunUntilComplete();
diff --git a/content/browser/browser_side_navigation_browsertest.cc b/content/browser/browser_side_navigation_browsertest.cc
index fdb17c8..cd5a4c0f 100644
--- a/content/browser/browser_side_navigation_browsertest.cc
+++ b/content/browser/browser_side_navigation_browsertest.cc
@@ -35,6 +35,7 @@
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/test/url_request/url_request_failed_job.h"
+#include "services/network/public/cpp/features.h"
 #include "url/gurl.h"
 
 namespace content {
@@ -529,7 +530,7 @@
   // NetworkService, it is not used so the request is not canceled.
   // TODO(arthursonzogni): Find a way to cancel a request from the browser
   // with the NetworkService.
-  if (base::FeatureList::IsEnabled(features::kNetworkService))
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService))
     return;
 
   ControllableHttpResponse response(embedded_test_server(), "/main_document");
diff --git a/content/browser/devtools/devtools_network_transaction_factory.cc b/content/browser/devtools/devtools_network_transaction_factory.cc
index 7ac2a922..ebb3fc4 100644
--- a/content/browser/devtools/devtools_network_transaction_factory.cc
+++ b/content/browser/devtools/devtools_network_transaction_factory.cc
@@ -4,13 +4,14 @@
 
 #include "content/public/browser/devtools_network_transaction_factory.h"
 
-#include "content/network/throttling/throttling_network_transaction_factory.h"
+#include "services/network/throttling/throttling_network_transaction_factory.h"
 
 namespace content {
 
 std::unique_ptr<net::HttpTransactionFactory>
 CreateDevToolsNetworkTransactionFactory(net::HttpNetworkSession* session) {
-  return std::make_unique<ThrottlingNetworkTransactionFactory>(session);
+  return std::make_unique<network::ThrottlingNetworkTransactionFactory>(
+      session);
 }
 
 }  // namespace content
diff --git a/content/browser/devtools/protocol/browser_handler.cc b/content/browser/devtools/protocol/browser_handler.cc
index 93c8b18b..b5d8593 100644
--- a/content/browser/devtools/protocol/browser_handler.cc
+++ b/content/browser/devtools/protocol/browser_handler.cc
@@ -82,7 +82,9 @@
   DCHECK(out_histograms);
   *out_histograms = std::make_unique<Array<Browser::Histogram>>();
   for (const base::HistogramBase* const h :
-       base::StatisticsRecorder::GetSnapshot(in_query.fromMaybe(""))) {
+       base::StatisticsRecorder::Sort(base::StatisticsRecorder::WithName(
+           base::StatisticsRecorder::GetHistograms(),
+           in_query.fromMaybe("")))) {
     DCHECK(h);
     (*out_histograms)->addItem(Convert(*h));
   }
diff --git a/content/browser/devtools/render_frame_devtools_agent_host.cc b/content/browser/devtools/render_frame_devtools_agent_host.cc
index fb770b2..e50b700c 100644
--- a/content/browser/devtools/render_frame_devtools_agent_host.cc
+++ b/content/browser/devtools/render_frame_devtools_agent_host.cc
@@ -47,10 +47,10 @@
 #include "content/public/browser/render_widget_host_iterator.h"
 #include "content/public/browser/web_contents_delegate.h"
 #include "content/public/common/browser_side_navigation_policy.h"
-#include "content/public/common/content_features.h"
 #include "mojo/public/cpp/bindings/associated_binding.h"
 #include "net/base/load_flags.h"
 #include "net/http/http_request_headers.h"
+#include "services/network/public/cpp/features.h"
 #include "third_party/WebKit/common/associated_interfaces/associated_interface_provider.h"
 
 #if defined(OS_ANDROID)
@@ -487,7 +487,7 @@
   if (!frame_host_)
     return;
   uint32_t process_id = frame_host_->GetProcess()->GetID();
-  if (base::FeatureList::IsEnabled(features::kNetworkService))
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService))
     GetNetworkService()->SetRawHeadersAccess(process_id, true);
   ChildProcessSecurityPolicyImpl::GetInstance()->GrantReadRawCookies(
       process_id);
@@ -511,7 +511,7 @@
 
   // We are the last to disconnect from the renderer -> revoke permissions.
   if (!process_has_agents) {
-    if (base::FeatureList::IsEnabled(features::kNetworkService))
+    if (base::FeatureList::IsEnabled(network::features::kNetworkService))
       GetNetworkService()->SetRawHeadersAccess(process_host->GetID(), false);
     ChildProcessSecurityPolicyImpl::GetInstance()->RevokeReadRawCookies(
         process_host->GetID());
diff --git a/content/browser/download/download_file_impl.cc b/content/browser/download/download_file_impl.cc
index 278594a..6edb2d4 100644
--- a/content/browser/download/download_file_impl.cc
+++ b/content/browser/download/download_file_impl.cc
@@ -27,6 +27,7 @@
 #include "crypto/sha2.h"
 #include "mojo/public/c/system/types.h"
 #include "net/base/io_buffer.h"
+#include "services/network/public/cpp/features.h"
 
 namespace content {
 
@@ -525,7 +526,7 @@
   DCHECK(is_paused_);
   is_paused_ = false;
 
-  if (!base::FeatureList::IsEnabled(features::kNetworkService))
+  if (!base::FeatureList::IsEnabled(network::features::kNetworkService))
     return;
 
   for (auto& stream : source_streams_) {
@@ -539,7 +540,8 @@
 void DownloadFileImpl::StreamActive(SourceStream* source_stream,
                                     MojoResult result) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  if (base::FeatureList::IsEnabled(features::kNetworkService) && is_paused_)
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService) &&
+      is_paused_)
     return;
 
   base::TimeTicks start(base::TimeTicks::Now());
diff --git a/content/browser/download/download_manager_impl.cc b/content/browser/download/download_manager_impl.cc
index a85896e..916b58dc 100644
--- a/content/browser/download/download_manager_impl.cc
+++ b/content/browser/download/download_manager_impl.cc
@@ -54,7 +54,6 @@
 #include "content/public/browser/resource_context.h"
 #include "content/public/browser/web_contents_delegate.h"
 #include "content/public/common/browser_side_navigation_policy.h"
-#include "content/public/common/content_features.h"
 #include "content/public/common/previews_state.h"
 #include "content/public/common/referrer.h"
 #include "net/base/elements_upload_data_stream.h"
@@ -63,6 +62,7 @@
 #include "net/base/upload_bytes_element_reader.h"
 #include "net/url_request/url_request_context.h"
 #include "services/metrics/public/cpp/ukm_source_id.h"
+#include "services/network/public/cpp/features.h"
 #include "storage/browser/blob/blob_url_request_job_factory.h"
 #include "url/origin.h"
 
@@ -1065,7 +1065,7 @@
 void DownloadManagerImpl::BeginDownloadInternal(
     std::unique_ptr<content::DownloadUrlParameters> params,
     uint32_t id) {
-  if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     std::unique_ptr<network::ResourceRequest> request =
         CreateResourceRequest(params.get());
     StoragePartitionImpl* storage_partition =
diff --git a/content/browser/download/download_worker.cc b/content/browser/download/download_worker.cc
index 2f3ff98..91e82202 100644
--- a/content/browser/download/download_worker.cc
+++ b/content/browser/download/download_worker.cc
@@ -10,6 +10,7 @@
 #include "content/public/browser/download_interrupt_reasons.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_features.h"
+#include "services/network/public/cpp/features.h"
 
 namespace content {
 namespace {
@@ -44,7 +45,7 @@
     scoped_refptr<URLLoaderFactoryGetter> url_loader_factory_getter) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
-  if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     std::unique_ptr<network::ResourceRequest> request =
         CreateResourceRequest(params.get());
     return std::unique_ptr<ResourceDownloader, BrowserThread::DeleteOnIOThread>(
diff --git a/content/browser/frame_host/navigation_request.cc b/content/browser/frame_host/navigation_request.cc
index 511ee204..c2d290e 100644
--- a/content/browser/frame_host/navigation_request.cc
+++ b/content/browser/frame_host/navigation_request.cc
@@ -55,6 +55,7 @@
 #include "net/base/url_util.h"
 #include "net/http/http_request_headers.h"
 #include "net/url_request/redirect_info.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/resource_request_body.h"
 #include "services/network/public/cpp/resource_response.h"
 #include "third_party/WebKit/common/sandbox_flags.h"
@@ -1157,7 +1158,7 @@
     // If this is a download, intercept the navigation response and pass it to
     // DownloadManager, and cancel the navigation.
     if (is_download_ &&
-        base::FeatureList::IsEnabled(features::kNetworkService)) {
+        base::FeatureList::IsEnabled(network::features::kNetworkService)) {
       // TODO(arthursonzogni): Pass the real ResourceRequest. For the moment
       // only these 4 parameters will be used, but it may evolve quickly.
       auto resource_request = std::make_unique<network::ResourceRequest>();
@@ -1183,7 +1184,7 @@
     // Call ProceedWithResponse()
     // Note: There is no need to call ProceedWithResponse() when the Network
     // Service is enabled. See https://crbug.com/791049.
-    if (!base::FeatureList::IsEnabled(features::kNetworkService)) {
+    if (!base::FeatureList::IsEnabled(network::features::kNetworkService)) {
       if (!IsNavigationMojoResponseEnabled()) {
         loader_->ProceedWithResponse();
       } else {
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index e24261a..c8b3e57a 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -102,7 +102,6 @@
 #include "content/common/swapped_out_messages.h"
 #include "content/common/url_loader_factory_bundle.mojom.h"
 #include "content/common/widget.mojom.h"
-#include "content/network/restricted_cookie_manager.h"
 #include "content/public/browser/ax_event_notification_details.h"
 #include "content/public/browser/browser_accessibility_state.h"
 #include "content/public/browser/browser_context.h"
@@ -143,7 +142,9 @@
 #include "services/device/public/interfaces/sensor_provider.mojom.h"
 #include "services/device/public/interfaces/wake_lock.mojom.h"
 #include "services/device/public/interfaces/wake_lock_context.mojom.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/interfaces/network_service.mojom.h"
+#include "services/network/restricted_cookie_manager.h"
 #include "services/resource_coordinator/public/cpp/frame_resource_coordinator.h"
 #include "services/resource_coordinator/public/cpp/resource_coordinator_features.h"
 #include "services/service_manager/public/cpp/connector.h"
@@ -374,7 +375,7 @@
 }
 
 bool IsOutOfProcessNetworkService() {
-  return base::FeatureList::IsEnabled(features::kNetworkService) &&
+  return base::FeatureList::IsEnabled(network::features::kNetworkService) &&
          !base::FeatureList::IsEnabled(features::kNetworkServiceInProcess) &&
          !base::CommandLine::ForCurrentProcess()->HasSwitch(
              switches::kSingleProcess);
@@ -3536,7 +3537,7 @@
 
   std::unique_ptr<URLLoaderFactoryBundleInfo> subresource_loader_factories;
   mojom::ControllerServiceWorkerInfoPtr controller_service_worker_info;
-  if (base::FeatureList::IsEnabled(features::kNetworkService) &&
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService) &&
       (!is_same_document || is_first_navigation)) {
     subresource_loader_factories =
         std::make_unique<URLLoaderFactoryBundleInfo>();
@@ -3624,7 +3625,7 @@
 
   // It is imperative that cross-document navigations always provide a set of
   // subresource ULFs when the Network Service is enabled.
-  DCHECK(!base::FeatureList::IsEnabled(features::kNetworkService) ||
+  DCHECK(!base::FeatureList::IsEnabled(network::features::kNetworkService) ||
          is_same_document || !is_first_navigation ||
          subresource_loader_factories);
 
@@ -4120,7 +4121,7 @@
 }
 
 void RenderFrameHostImpl::OnNetworkServiceConnectionError() {
-  DCHECK(base::FeatureList::IsEnabled(features::kNetworkService));
+  DCHECK(base::FeatureList::IsEnabled(network::features::kNetworkService));
   DCHECK(network_service_connection_error_handler_holder_.is_bound() &&
          network_service_connection_error_handler_holder_.encountered_error());
   network::mojom::URLLoaderFactoryPtrInfo default_factory_info;
diff --git a/content/browser/frame_host/render_frame_host_impl_browsertest.cc b/content/browser/frame_host/render_frame_host_impl_browsertest.cc
index e7f4a16e..4c12cfc 100644
--- a/content/browser/frame_host/render_frame_host_impl_browsertest.cc
+++ b/content/browser/frame_host/render_frame_host_impl_browsertest.cc
@@ -22,7 +22,6 @@
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/common/browser_side_navigation_policy.h"
 #include "content/public/common/content_client.h"
-#include "content/public/common/content_features.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -36,6 +35,7 @@
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/test/embedded_test_server/http_request.h"
+#include "services/network/public/cpp/features.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "third_party/WebKit/common/page/page_visibility_state.mojom.h"
 
@@ -531,7 +531,7 @@
                        StreamHandleReleasedOnRendererCrash) {
   // Disable this test when the |stream_handle_| is not used.
   if (!IsBrowserSideNavigationEnabled() ||
-      base::FeatureList::IsEnabled(features::kNetworkService) ||
+      base::FeatureList::IsEnabled(network::features::kNetworkService) ||
       IsNavigationMojoResponseEnabled()) {
     return;
   }
diff --git a/content/browser/frame_host/render_frame_message_filter.cc b/content/browser/frame_host/render_frame_message_filter.cc
index 6e105e13..5a4a13b2 100644
--- a/content/browser/frame_host/render_frame_message_filter.cc
+++ b/content/browser/frame_host/render_frame_message_filter.cc
@@ -33,7 +33,6 @@
 #include "content/public/browser/download_url_parameters.h"
 #include "content/public/browser/storage_partition.h"
 #include "content/public/common/content_constants.h"
-#include "content/public/common/content_features.h"
 #include "gpu/GLES2/gl2extchromium.h"
 #include "mojo/public/cpp/system/message_pipe.h"
 #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
@@ -44,6 +43,7 @@
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "ppapi/features/features.h"
+#include "services/network/public/cpp/features.h"
 #include "services/service_manager/public/interfaces/interface_provider.mojom.h"
 #include "storage/browser/blob/blob_storage_context.h"
 #include "third_party/WebKit/common/frame_policy.h"
@@ -471,7 +471,7 @@
           render_frame_id, options))
     return;
 
-  if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     // TODO(jam): modify GetRequestContextForURL to work with network service.
     // Merge this with code path below for non-network service.
     cookie_manager_->SetCanonicalCookie(*cookie, url.SchemeIsCryptographic(),
@@ -513,7 +513,7 @@
         net::CookieOptions::SameSiteCookieMode::DO_NOT_INCLUDE);
   }
 
-  if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     // TODO(jam): modify GetRequestContextForURL to work with network service.
     // Merge this with code path below for non-network service.
     cookie_manager_->GetCookieList(
diff --git a/content/browser/gpu/gpu_data_manager_impl_private.cc b/content/browser/gpu/gpu_data_manager_impl_private.cc
index 3288ffa..5bdd40c 100644
--- a/content/browser/gpu/gpu_data_manager_impl_private.cc
+++ b/content/browser/gpu/gpu_data_manager_impl_private.cc
@@ -484,10 +484,15 @@
 void GpuDataManagerImplPrivate::UpdateGpuInfo(const gpu::GPUInfo& gpu_info) {
   bool sandboxed = gpu_info_.sandboxed;
   gpu_info_ = gpu_info;
-  // On certain platforms (for now, Windows), complete GPUInfo is
-  // collected through an unsandboxed GPU process, so the original
-  // |sandboxed| should be kept.
-  gpu_info_.sandboxed = sandboxed;
+#if defined(OS_WIN)
+  // On Windows, complete GPUInfo is collected through an unsandboxed
+  // GPU process. If the regular GPU process is sandboxed, it should
+  // not be overwritten.
+  if (sandboxed)
+    gpu_info_.sandboxed = true;
+#else
+  (void)sandboxed;
+#endif  // OS_WIN
 
   if (complete_gpu_info_already_requested_ &&
       !NeedsCompleteGpuInfoCollection()) {
diff --git a/content/browser/loader/mojo_async_resource_handler.cc b/content/browser/loader/mojo_async_resource_handler.cc
index 6bc73c3e..87f8079 100644
--- a/content/browser/loader/mojo_async_resource_handler.cc
+++ b/content/browser/loader/mojo_async_resource_handler.cc
@@ -605,12 +605,12 @@
   mojo::ReportBadMessage(error);
 }
 
-std::unique_ptr<UploadProgressTracker>
+std::unique_ptr<network::UploadProgressTracker>
 MojoAsyncResourceHandler::CreateUploadProgressTracker(
     const base::Location& from_here,
-    UploadProgressTracker::UploadProgressReportCallback callback) {
-  return std::make_unique<UploadProgressTracker>(from_here, std::move(callback),
-                                                 request());
+    network::UploadProgressTracker::UploadProgressReportCallback callback) {
+  return std::make_unique<network::UploadProgressTracker>(
+      from_here, std::move(callback), request());
 }
 
 void MojoAsyncResourceHandler::OnTransfer(
diff --git a/content/browser/loader/mojo_async_resource_handler.h b/content/browser/loader/mojo_async_resource_handler.h
index c4fc140a..76b657b 100644
--- a/content/browser/loader/mojo_async_resource_handler.h
+++ b/content/browser/loader/mojo_async_resource_handler.h
@@ -15,7 +15,6 @@
 #include "base/memory/weak_ptr.h"
 #include "content/browser/loader/resource_handler.h"
 #include "content/common/content_export.h"
-#include "content/network/upload_progress_tracker.h"
 #include "content/public/common/resource_type.h"
 #include "mojo/public/cpp/bindings/binding.h"
 #include "mojo/public/cpp/system/data_pipe.h"
@@ -23,6 +22,7 @@
 #include "net/base/io_buffer.h"
 #include "net/base/request_priority.h"
 #include "services/network/public/interfaces/url_loader.mojom.h"
+#include "services/network/upload_progress_tracker.h"
 
 class GURL;
 
@@ -124,9 +124,10 @@
 
   // These functions can be overriden only for tests.
   virtual void ReportBadMessage(const std::string& error);
-  virtual std::unique_ptr<UploadProgressTracker> CreateUploadProgressTracker(
+  virtual std::unique_ptr<network::UploadProgressTracker>
+  CreateUploadProgressTracker(
       const base::Location& from_here,
-      UploadProgressTracker::UploadProgressReportCallback callback);
+      network::UploadProgressTracker::UploadProgressReportCallback callback);
 
   void OnTransfer(network::mojom::URLLoaderRequest mojo_request,
                   network::mojom::URLLoaderClientPtr url_loader_client);
@@ -166,7 +167,7 @@
   scoped_refptr<SharedWriter> shared_writer_;
   mojo::ScopedDataPipeConsumerHandle response_body_consumer_handle_;
 
-  std::unique_ptr<UploadProgressTracker> upload_progress_tracker_;
+  std::unique_ptr<network::UploadProgressTracker> upload_progress_tracker_;
 
   base::WeakPtrFactory<MojoAsyncResourceHandler> weak_factory_;
   DISALLOW_COPY_AND_ASSIGN(MojoAsyncResourceHandler);
diff --git a/content/browser/loader/mojo_async_resource_handler_unittest.cc b/content/browser/loader/mojo_async_resource_handler_unittest.cc
index 7a2ac356..107dcb6 100644
--- a/content/browser/loader/mojo_async_resource_handler_unittest.cc
+++ b/content/browser/loader/mojo_async_resource_handler_unittest.cc
@@ -34,7 +34,6 @@
 #include "content/public/common/resource_type.h"
 #include "content/public/test/test_browser_context.h"
 #include "content/public/test/test_browser_thread_bundle.h"
-#include "content/public/test/test_url_loader_client.h"
 #include "mojo/public/c/system/data_pipe.h"
 #include "mojo/public/c/system/types.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
@@ -57,6 +56,7 @@
 #include "services/network/public/cpp/url_loader_completion_status.h"
 #include "services/network/public/interfaces/url_loader.mojom.h"
 #include "services/network/public/interfaces/url_loader_factory.mojom.h"
+#include "services/network/test/test_url_loader_client.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "ui/base/page_transition_types.h"
 
@@ -83,9 +83,9 @@
   DISALLOW_COPY_AND_ASSIGN(DummyUploadDataStream);
 };
 
-class FakeUploadProgressTracker : public UploadProgressTracker {
+class FakeUploadProgressTracker : public network::UploadProgressTracker {
  public:
-  using UploadProgressTracker::UploadProgressTracker;
+  using network::UploadProgressTracker::UploadProgressTracker;
 
   net::UploadProgress GetUploadProgress() const override {
     return upload_progress_;
@@ -254,9 +254,10 @@
     has_received_bad_message_ = true;
   }
 
-  std::unique_ptr<UploadProgressTracker> CreateUploadProgressTracker(
+  std::unique_ptr<network::UploadProgressTracker> CreateUploadProgressTracker(
       const base::Location& from_here,
-      UploadProgressTracker::UploadProgressReportCallback callback) override {
+      network::UploadProgressTracker::UploadProgressReportCallback callback)
+      override {
     DCHECK(!upload_progress_tracker_);
 
     auto upload_progress_tracker = std::make_unique<FakeUploadProgressTracker>(
@@ -415,7 +416,7 @@
   ResourceDispatcherHostImpl rdh_;
   network::mojom::URLLoaderFactoryPtr url_loader_factory_;
   network::mojom::URLLoaderPtr url_loader_proxy_;
-  TestURLLoaderClient url_loader_client_;
+  network::TestURLLoaderClient url_loader_client_;
   std::unique_ptr<TestBrowserContext> browser_context_;
   net::TestDelegate url_request_delegate_;
   std::unique_ptr<net::URLRequest> request_;
diff --git a/content/browser/loader/navigation_url_loader.cc b/content/browser/loader/navigation_url_loader.cc
index 84026ff..3eecf60 100644
--- a/content/browser/loader/navigation_url_loader.cc
+++ b/content/browser/loader/navigation_url_loader.cc
@@ -15,7 +15,7 @@
 #include "content/browser/loader/url_loader_request_handler.h"
 #include "content/public/browser/navigation_ui_data.h"
 #include "content/public/common/browser_side_navigation_policy.h"
-#include "content/public/common/content_features.h"
+#include "services/network/public/cpp/features.h"
 
 namespace content {
 
@@ -34,7 +34,7 @@
         resource_context, storage_partition, std::move(request_info),
         std::move(navigation_ui_data), service_worker_handle, delegate);
   }
-  if (base::FeatureList::IsEnabled(features::kNetworkService) ||
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService) ||
       IsNavigationMojoResponseEnabled()) {
     return std::make_unique<NavigationURLLoaderNetworkService>(
         resource_context, storage_partition, std::move(request_info),
diff --git a/content/browser/loader/navigation_url_loader_network_service.cc b/content/browser/loader/navigation_url_loader_network_service.cc
index a108c0a..8588ddb78 100644
--- a/content/browser/loader/navigation_url_loader_network_service.cc
+++ b/content/browser/loader/navigation_url_loader_network_service.cc
@@ -55,6 +55,7 @@
 #include "net/url_request/redirect_util.h"
 #include "net/url_request/url_request.h"
 #include "net/url_request/url_request_context.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/loader_util.h"
 #include "services/network/public/interfaces/request_context_frame_type.mojom.h"
 #include "services/network/public/interfaces/url_loader_factory.mojom.h"
@@ -66,7 +67,7 @@
 namespace {
 
 bool IsRequestHandlerEnabled() {
-  return base::FeatureList::IsEnabled(features::kNetworkService) ||
+  return base::FeatureList::IsEnabled(network::features::kNetworkService) ||
          base::FeatureList::IsEnabled(features::kSignedHTTPExchange);
 }
 
@@ -279,7 +280,7 @@
     if (is_main_frame)
       options |= network::mojom::kURLLoadOptionSendSSLInfoForCertificateError;
 
-    if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+    if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
       options |= network::mojom::kURLLoadOptionSniffMimeType;
     } else {
       // TODO(arthursonzogni): This is a temporary option. Remove this as soon
@@ -300,7 +301,7 @@
       AppCacheNavigationHandleCore* appcache_handle_core,
       network::mojom::URLLoaderRequest url_loader,
       network::mojom::URLLoaderClientPtr url_loader_client) {
-    DCHECK(!base::FeatureList::IsEnabled(features::kNetworkService));
+    DCHECK(!base::FeatureList::IsEnabled(network::features::kNetworkService));
     DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
     default_loader_used_ = true;
@@ -336,7 +337,7 @@
       AppCacheNavigationHandleCore* appcache_handle_core,
       std::unique_ptr<NavigationRequestInfo> request_info,
       std::unique_ptr<NavigationUIData> navigation_ui_data) {
-    DCHECK(!base::FeatureList::IsEnabled(features::kNetworkService));
+    DCHECK(!base::FeatureList::IsEnabled(network::features::kNetworkService));
     DCHECK_CURRENTLY_ON(BrowserThread::IO);
     DCHECK(!started_);
     started_ = true;
@@ -367,7 +368,7 @@
       network::mojom::URLLoaderFactoryPtrInfo factory_for_webui,
       int frame_tree_node_id,
       std::unique_ptr<service_manager::Connector> connector) {
-    DCHECK(base::FeatureList::IsEnabled(features::kNetworkService));
+    DCHECK(base::FeatureList::IsEnabled(network::features::kNetworkService));
     DCHECK_CURRENTLY_ON(BrowserThread::IO);
     DCHECK(!started_);
     global_request_id_ = MakeGlobalRequestID();
@@ -464,7 +465,7 @@
       default_loader_used_ = false;
       url_loader_ = ThrottlingURLLoader::CreateLoaderAndStart(
           std::move(start_loader_callback),
-          base::FeatureList::IsEnabled(features::kNetworkService)
+          base::FeatureList::IsEnabled(network::features::kNetworkService)
               ? GetContentClient()->browser()->CreateURLLoaderThrottles(
                     web_contents_getter_, navigation_ui_data_.get())
               : std::vector<std::unique_ptr<content::URLLoaderThrottle>>(),
@@ -855,7 +856,7 @@
                                         allow_download_);
   }
 
-  if (!base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (!base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     DCHECK(!request_controller_);
     request_controller_ = std::make_unique<URLLoaderRequestController>(
         /* initial_handlers = */
diff --git a/content/browser/loader/navigation_url_loader_network_service_unittest.cc b/content/browser/loader/navigation_url_loader_network_service_unittest.cc
index a250e9a3..a0eff0a 100644
--- a/content/browser/loader/navigation_url_loader_network_service_unittest.cc
+++ b/content/browser/loader/navigation_url_loader_network_service_unittest.cc
@@ -12,13 +12,10 @@
 #include "content/common/navigation_params.h"
 #include "content/common/navigation_params.mojom.h"
 #include "content/common/service_manager/service_manager_connection_impl.h"
-#include "content/network/network_context.h"
-#include "content/network/url_loader.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/navigation_ui_data.h"
 #include "content/public/browser/storage_partition.h"
-#include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/service_manager_connection.h"
 #include "content/public/test/test_browser_context.h"
@@ -27,6 +24,9 @@
 #include "net/base/load_flags.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "services/network/network_context.h"
+#include "services/network/public/cpp/features.h"
+#include "services/network/url_loader.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/WebKit/common/page/page_visibility_state.mojom.h"
 
@@ -38,7 +38,7 @@
   explicit TestURLLoaderRequestHandler(
       base::Optional<network::ResourceRequest>* most_recent_resource_request)
       : most_recent_resource_request_(most_recent_resource_request),
-        context_(NetworkContext::CreateForTesting()) {}
+        context_(network::NetworkContext::CreateForTesting()) {}
   ~TestURLLoaderRequestHandler() override {}
 
   void MaybeCreateLoader(const network::ResourceRequest& resource_request,
@@ -54,10 +54,10 @@
                    network::mojom::URLLoaderClientPtr client) {
     *most_recent_resource_request_ = resource_request;
     // The URLLoader will delete itself upon completion.
-    new URLLoader(context_.get(), std::move(request), 0 /* options */,
-                  resource_request, false /* report_raw_headers */,
-                  std::move(client), TRAFFIC_ANNOTATION_FOR_TESTS,
-                  0 /* process_id */);
+    new network::URLLoader(context_.get(), std::move(request), 0 /* options */,
+                           resource_request, false /* report_raw_headers */,
+                           std::move(client), TRAFFIC_ANNOTATION_FOR_TESTS,
+                           0 /* process_id */);
   }
 
   bool MaybeCreateLoaderForResponse(
@@ -71,7 +71,7 @@
  private:
   base::Optional<network::ResourceRequest>*
       most_recent_resource_request_;  // NOT OWNED.
-  std::unique_ptr<NetworkContext> context_;
+  std::unique_ptr<network::NetworkContext> context_;
 };
 
 }  // namespace
@@ -80,7 +80,7 @@
  public:
   NavigationURLLoaderNetworkServiceTest()
       : thread_bundle_(TestBrowserThreadBundle::IO_MAINLOOP) {
-    feature_list_.InitAndEnableFeature(features::kNetworkService);
+    feature_list_.InitAndEnableFeature(network::features::kNetworkService);
 
     // Because the network service is enabled we need a ServiceManagerConnection
     // or BrowserContext::GetDefaultStoragePartition will segfault when
diff --git a/content/browser/loader/resource_dispatcher_host_unittest.cc b/content/browser/loader/resource_dispatcher_host_unittest.cc
index 0621c87..5cc213e 100644
--- a/content/browser/loader/resource_dispatcher_host_unittest.cc
+++ b/content/browser/loader/resource_dispatcher_host_unittest.cc
@@ -57,7 +57,6 @@
 #include "content/public/test/test_browser_context.h"
 #include "content/public/test/test_browser_thread_bundle.h"
 #include "content/public/test/test_renderer_host.h"
-#include "content/public/test/test_url_loader_client.h"
 #include "content/public/test/test_utils.h"
 #include "content/test/test_content_browser_client.h"
 #include "content/test/test_navigation_url_loader_delegate.h"
@@ -81,6 +80,7 @@
 #include "net/url_request/url_request_test_job.h"
 #include "net/url_request/url_request_test_util.h"
 #include "services/network/public/cpp/resource_request.h"
+#include "services/network/test/test_url_loader_client.h"
 #include "storage/browser/blob/shareable_file_reference.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/WebKit/common/page/page_visibility_state.mojom.h"
@@ -835,7 +835,7 @@
       return;
     }
     network::mojom::URLLoaderPtr loader;
-    TestURLLoaderClient client;
+    network::TestURLLoaderClient client;
 
     MakeTestRequestWithResourceType(
         filter_.get(), 0, 1, url, RESOURCE_TYPE_MAIN_FRAME,
@@ -974,7 +974,7 @@
     URLRequestTestDelayedStartJob::CompleteStart(req);
 }
 
-void CheckSuccessfulRequest(TestURLLoaderClient* client,
+void CheckSuccessfulRequest(network::TestURLLoaderClient* client,
                             const std::string& reference_data) {
   if (!reference_data.empty()) {
     client->RunUntilResponseBodyArrived();
@@ -994,7 +994,7 @@
 // cancel two of them, and make sure that each sent the proper notifications.
 TEST_F(ResourceDispatcherHostTest, Cancel) {
   network::mojom::URLLoaderPtr loader1, loader2, loader3, loader4;
-  TestURLLoaderClient client1, client2, client3, client4;
+  network::TestURLLoaderClient client1, client2, client3, client4;
   MakeTestRequest(0, 1, net::URLRequestTestJob::test_url_1(),
                   mojo::MakeRequest(&loader1), client1.CreateInterfacePtr());
   MakeTestRequest(0, 2, net::URLRequestTestJob::test_url_2(),
@@ -1042,7 +1042,7 @@
 
 TEST_F(ResourceDispatcherHostTest, DownloadToNetworkCache) {
   network::mojom::URLLoaderPtr loader1, loader2;
-  TestURLLoaderClient client1, client2;
+  network::TestURLLoaderClient client1, client2;
   // Normal request.
   MakeTestRequest(0, 1, net::URLRequestTestJob::test_url_2(),
                   mojo::MakeRequest(&loader1), client1.CreateInterfacePtr());
@@ -1089,7 +1089,7 @@
 // complete.
 TEST_F(ResourceDispatcherHostTest, DetachedResourceTimesOut) {
   network::mojom::URLLoaderPtr loader;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   MakeTestRequestWithResourceType(
       filter_.get(), 0, 1, net::URLRequestTestJob::test_url_2(),
       RESOURCE_TYPE_PREFETCH,  // detachable type
@@ -1137,7 +1137,7 @@
 // TODO(yhirano): Add a corresponding test case with the feature.
 TEST_F(ResourceDispatcherHostTest, DeletedFilterDetached) {
   network::mojom::URLLoaderPtr loader1, loader2;
-  TestURLLoaderClient client1, client2;
+  network::TestURLLoaderClient client1, client2;
   base::test::ScopedFeatureList feature_list;
   feature_list.InitAndDisableFeature(
       features::kKeepAliveRendererForKeepaliveRequests);
@@ -1193,7 +1193,7 @@
 // resources should continue to load, even when redirected.
 TEST_F(ResourceDispatcherHostTest, DeletedFilterDetachedRedirect) {
   network::mojom::URLLoaderPtr loader;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   network::ResourceRequest request = CreateResourceRequest(
       "GET", RESOURCE_TYPE_PREFETCH,
       net::URLRequestTestJob::test_url_redirect_to_url_2());
@@ -1241,7 +1241,7 @@
 
 TEST_F(ResourceDispatcherHostTest, CancelWhileStartIsDeferred) {
   network::mojom::URLLoaderPtr loader;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   bool was_deleted = false;
 
   // Arrange to have requests deferred before starting.
@@ -1269,7 +1269,7 @@
 
 TEST_F(ResourceDispatcherHostTest, DetachWhileStartIsDeferred) {
   network::mojom::URLLoaderPtr loader;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   bool was_deleted = false;
 
   // Arrange to have requests deferred before starting.
@@ -1314,7 +1314,7 @@
 // URLRequest will not be started.
 TEST_F(ResourceDispatcherHostTest, CancelInResourceThrottleWillStartRequest) {
   network::mojom::URLLoaderPtr loader;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   TestResourceDispatcherHostDelegate delegate;
   delegate.set_flags(CANCEL_BEFORE_START);
   host_.SetDelegate(&delegate);
@@ -1336,7 +1336,7 @@
 
 TEST_F(ResourceDispatcherHostTest, PausedStartError) {
   network::mojom::URLLoaderPtr loader;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   // Arrange to have requests deferred before processing response headers.
   TestResourceDispatcherHostDelegate delegate;
   delegate.set_flags(DEFER_PROCESSING_RESPONSE);
@@ -1356,7 +1356,7 @@
 
 TEST_F(ResourceDispatcherHostTest, ThrottleAndResumeTwice) {
   network::mojom::URLLoaderPtr loader;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   // Arrange to have requests deferred before starting.
   TestResourceDispatcherHostDelegate delegate;
   delegate.set_flags(DEFER_STARTING_REQUEST);
@@ -1393,7 +1393,7 @@
 // Tests that the delegate can cancel a request and provide a error code.
 TEST_F(ResourceDispatcherHostTest, CancelInDelegate) {
   network::mojom::URLLoaderPtr loader;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   TestResourceDispatcherHostDelegate delegate;
   delegate.set_flags(CANCEL_BEFORE_START);
   delegate.set_error_code_for_cancellation(net::ERR_ACCESS_DENIED);
@@ -1417,7 +1417,7 @@
 // TODO(yhirano): Add a corresponding test case with the feature.
 TEST_F(ResourceDispatcherHostTest, CancelRequestsForRoute) {
   network::mojom::URLLoaderPtr loader1, loader2, loader3, loader4;
-  TestURLLoaderClient client1, client2, client3, client4;
+  network::TestURLLoaderClient client1, client2, client3, client4;
   base::test::ScopedFeatureList feature_list;
   feature_list.InitAndDisableFeature(
       features::kKeepAliveRendererForKeepaliveRequests);
@@ -1473,7 +1473,7 @@
 // Tests CancelRequestsForProcess
 TEST_F(ResourceDispatcherHostTest, TestProcessCancel) {
   network::mojom::URLLoaderPtr loader1, loader2, loader3, loader4;
-  TestURLLoaderClient client1, client2, client3, client4;
+  network::TestURLLoaderClient client1, client2, client3, client4;
   scoped_refptr<TestFilter> test_filter = MakeTestFilter();
 
   // request 1 goes to the test delegate
@@ -1547,7 +1547,7 @@
 // deleted.
 TEST_F(ResourceDispatcherHostTest, CancelRequestsOnRenderFrameDeleted) {
   network::mojom::URLLoaderPtr loader1, loader2, loader3, loader4, loader5;
-  TestURLLoaderClient client1, client2, client3, client4, client5;
+  network::TestURLLoaderClient client1, client2, client3, client4, client5;
   // Requests all hang once started.  This prevents requests from being
   // destroyed due to completion.
   job_factory_->SetHangAfterStartJobGeneration(true);
@@ -1604,7 +1604,7 @@
 
 TEST_F(ResourceDispatcherHostTest, TestProcessCancelDetachedTimesOut) {
   network::mojom::URLLoaderPtr loader;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   MakeTestRequestWithResourceType(
       filter_.get(), 0, 1, net::URLRequestTestJob::test_url_4(),
       RESOURCE_TYPE_PREFETCH,  // detachable type
@@ -1651,8 +1651,8 @@
 TEST_F(ResourceDispatcherHostTest, TestBlockingResumingRequests) {
   network::mojom::URLLoaderPtr loader1, loader2, loader3, loader4, loader5,
       loader6, loader7;
-  TestURLLoaderClient client1, client2, client3, client4, client5, client6,
-      client7;
+  network::TestURLLoaderClient client1, client2, client3, client4, client5,
+      client6, client7;
 
   host_.BlockRequestsForRoute(GlobalFrameRoutingId(filter_->child_id(), 11));
   host_.BlockRequestsForRoute(GlobalFrameRoutingId(filter_->child_id(), 12));
@@ -1730,7 +1730,7 @@
 // Tests blocking and canceling requests.
 TEST_F(ResourceDispatcherHostTest, TestBlockingCancelingRequests) {
   network::mojom::URLLoaderPtr loader1, loader2, loader3, loader4, loader5;
-  TestURLLoaderClient client1, client2, client3, client4, client5;
+  network::TestURLLoaderClient client1, client2, client3, client4, client5;
 
   host_.BlockRequestsForRoute(GlobalFrameRoutingId(filter_->child_id(), 11));
 
@@ -1780,7 +1780,7 @@
 // Tests that blocked requests are canceled if their associated process dies.
 TEST_F(ResourceDispatcherHostTest, TestBlockedRequestsProcessDies) {
   network::mojom::URLLoaderPtr loader1, loader2, loader3, loader4, loader5;
-  TestURLLoaderClient client1, client2, client3, client4, client5;
+  network::TestURLLoaderClient client1, client2, client3, client4, client5;
   // This second filter is used to emulate a second process.
   scoped_refptr<TestFilter> second_filter = MakeTestFilter();
 
@@ -1832,8 +1832,8 @@
 TEST_F(ResourceDispatcherHostTest, TestBlockedRequestsDontLeak) {
   network::mojom::URLLoaderPtr loader1, loader2, loader3, loader4, loader5,
       loader6, loader7, loader8;
-  TestURLLoaderClient client1, client2, client3, client4, client5, client6,
-      client7, client8;
+  network::TestURLLoaderClient client1, client2, client3, client4, client5,
+      client6, client7, client8;
   // This second filter is used to emulate a second process.
   scoped_refptr<TestFilter> second_filter = MakeTestFilter();
 
@@ -1933,9 +1933,10 @@
 
   auto loaders =
       std::make_unique<network::mojom::URLLoaderPtr[]>(kMaxRequests + 4);
-  auto clients = std::make_unique<TestURLLoaderClient[]>(kMaxRequests + 4);
+  auto clients =
+      std::make_unique<network::TestURLLoaderClient[]>(kMaxRequests + 4);
   network::mojom::URLLoaderPtr loader1, loader2, loader3, loader4;
-  TestURLLoaderClient client1, client2, client3, client4;
+  network::TestURLLoaderClient client1, client2, client3, client4;
 
   // This second filter is used to emulate a second process.
   scoped_refptr<TestFilter> second_filter = MakeTestFilter();
@@ -2011,7 +2012,7 @@
   scoped_refptr<TestFilter> third_filter = MakeTestFilter();
 
   network::mojom::URLLoaderPtr loaders[kMaxRequests + 3];
-  TestURLLoaderClient clients[kMaxRequests + 3];
+  network::TestURLLoaderClient clients[kMaxRequests + 3];
 
   // Saturate the number of outstanding requests for our process.
   for (size_t i = 0; i < kMaxRequestsPerProcess; ++i) {
@@ -2069,7 +2070,7 @@
 // Tests that we sniff the mime type for a simple request.
 TEST_F(ResourceDispatcherHostTest, MimeSniffed) {
   network::mojom::URLLoaderPtr loader;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   std::string raw_headers("HTTP/1.1 200 OK\n\n");
   std::string response_data("<html><title>Test One</title></html>");
   SetResponse(raw_headers, response_data);
@@ -2089,7 +2090,7 @@
 // Tests that we don't sniff the mime type when the server provides one.
 TEST_F(ResourceDispatcherHostTest, MimeNotSniffed) {
   network::mojom::URLLoaderPtr loader;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   std::string raw_headers("HTTP/1.1 200 OK\n"
                           "Content-type: image/jpeg\n\n");
   std::string response_data("<html><title>Test One</title></html>");
@@ -2110,7 +2111,7 @@
 // Tests that we don't sniff the mime type when there is no message body.
 TEST_F(ResourceDispatcherHostTest, MimeNotSniffed2) {
   network::mojom::URLLoaderPtr loader;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   SetResponse("HTTP/1.1 304 Not Modified\n\n");
 
   HandleScheme("http");
@@ -2127,7 +2128,7 @@
 
 TEST_F(ResourceDispatcherHostTest, MimeSniff204) {
   network::mojom::URLLoaderPtr loader;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   SetResponse("HTTP/1.1 204 No Content\n\n");
 
   HandleScheme("http");
@@ -2144,7 +2145,7 @@
 
 TEST_F(ResourceDispatcherHostTest, MimeSniffEmpty) {
   network::mojom::URLLoaderPtr loader;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   SetResponse("HTTP/1.1 200 OK\n\n");
 
   HandleScheme("http");
@@ -2179,7 +2180,7 @@
 TEST_F(ResourceDispatcherHostTest, CancelRequestsForContextDetached) {
   EXPECT_EQ(0, host_.pending_requests());
   network::mojom::URLLoaderPtr loader;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   constexpr int render_view_id = 0;
   constexpr int request_id = 1;
 
@@ -2226,7 +2227,7 @@
   constexpr int render_view_id = 0;
   constexpr int request_id = 1;
   network::mojom::URLLoaderPtr loader;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
 
   std::string raw_headers("HTTP\n"
                           "Content-type: image/jpeg\n\n");
@@ -2351,7 +2352,7 @@
 TEST_F(ResourceDispatcherHostTest, DownloadToFile) {
   // Make a request which downloads to file.
   network::mojom::URLLoaderPtr loader;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   network::ResourceRequest request = CreateResourceRequest(
       "GET", RESOURCE_TYPE_SUB_RESOURCE, net::URLRequestTestJob::test_url_1());
   request.download_to_file = true;
@@ -2583,7 +2584,7 @@
   std::string response_data("p { text-align: center; }");
   SetResponse(raw_headers, response_data);
   network::mojom::URLLoaderPtr loader;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
 
   MakeTestRequestWithResourceType(
       filter_.get(), filter_->child_id(), 1, GURL("http://example.com/blah"),
diff --git a/content/browser/loader/resource_message_filter.cc b/content/browser/loader/resource_message_filter.cc
index 606dd4d..bb1774d9 100644
--- a/content/browser/loader/resource_message_filter.cc
+++ b/content/browser/loader/resource_message_filter.cc
@@ -16,7 +16,7 @@
 #include "content/network/cors/cors_url_loader_factory.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/resource_context.h"
-#include "content/public/common/content_features.h"
+#include "services/network/public/cpp/features.h"
 #include "storage/browser/fileapi/file_system_context.h"
 
 namespace content {
@@ -146,7 +146,7 @@
   requester_info_->set_filter(GetWeakPtr());
   url_loader_factory_ = std::make_unique<URLLoaderFactoryImpl>(requester_info_);
 
-  if (base::FeatureList::IsEnabled(features::kOutOfBlinkCORS)) {
+  if (base::FeatureList::IsEnabled(network::features::kOutOfBlinkCORS)) {
     url_loader_factory_ =
         std::make_unique<CORSURLLoaderFactory>(std::move(url_loader_factory_));
   }
diff --git a/content/browser/loader/signed_exchange_handler.cc b/content/browser/loader/signed_exchange_handler.cc
index d4cee381..95e611c 100644
--- a/content/browser/loader/signed_exchange_handler.cc
+++ b/content/browser/loader/signed_exchange_handler.cc
@@ -46,28 +46,28 @@
   if (!found_callback_)
     return;
 
-  // TODO(https://crbug.com/80374): Get the request url by parsing CBOR format.
+  // TODO(https://crbug.com/803774): Get the request url by parsing CBOR format.
   GURL request_url = GURL("https://example.com/test.html");
-  // TODO(https://crbug.com/80374): Get the request method by parsing CBOR
+  // TODO(https://crbug.com/803774): Get the request method by parsing CBOR
   // format.
   std::string request_method = "GET";
-  // TODO(https://crbug.com/80374): Get the payload by parsing CBOR format.
+  // TODO(https://crbug.com/803774): Get the payload by parsing CBOR format.
   std::string payload = original_body_string_;
   original_body_string_.clear();
 
-  // TODO(https://crbug.com/80374): Get more headers by parsing CBOR.
+  // TODO(https://crbug.com/803774): Get more headers by parsing CBOR.
   scoped_refptr<net::HttpResponseHeaders> headers(
       new net::HttpResponseHeaders("HTTP/1.1 200 OK"));
   network::ResourceResponseHead resource_response;
   resource_response.headers = headers;
   resource_response.mime_type = "text/html";
 
-  // TODO(https://crbug.com/80374): Get the certificate by parsing CBOR and
+  // TODO(https://crbug.com/803774): Get the certificate by parsing CBOR and
   // verify.
   base::Optional<net::SSLInfo> ssl_info;
 
   mojo::DataPipe pipe(kPipeSizeForSignedResponseBody);
-  // TODO(https://crbug.com/80374): Write the error handling code. This could
+  // TODO(https://crbug.com/803774): Write the error handling code. This could
   // fail.
   DCHECK(pipe.consumer_handle.is_valid());
   mojo::ScopedDataPipeConsumerHandle response_body =
diff --git a/content/browser/loader/signed_exchange_handler.h b/content/browser/loader/signed_exchange_handler.h
index aff0aec..92bdf28 100644
--- a/content/browser/loader/signed_exchange_handler.h
+++ b/content/browser/loader/signed_exchange_handler.h
@@ -29,7 +29,7 @@
 // logic nor verifying logic. It just behaves as if the passed body is a signed
 // HTTP exchange which contains a request to "https://example.com/test.html" and
 // a response with a payload which is equal to the original body.
-// TODO(https://crbug.com/80374): Implement CBOR parsing logic and verifying
+// TODO(https://crbug.com/803774): Implement CBOR parsing logic and verifying
 // logic.
 class SignedExchangeHandler final
     : public mojo::common::DataPipeDrainer::Client {
@@ -44,15 +44,15 @@
       base::OnceCallback<void(const network::URLLoaderCompletionStatus&)>;
 
   // The passed |body| will be read to parse the signed HTTP exchange.
-  // TODO(https://crbug.com/80374): Consider making SignedExchangeHandler
+  // TODO(https://crbug.com/803774): Consider making SignedExchangeHandler
   // independent from DataPipe to make it easy to port it in //net.
   explicit SignedExchangeHandler(mojo::ScopedDataPipeConsumerHandle body);
 
   ~SignedExchangeHandler() override;
 
-  // TODO(https://crbug.com/80374): Currently SignedExchangeHandler always calls
-  // found_callback and then calls finish_callback after reading the all buffer.
-  // Need to redesign this callback model when we will introduce
+  // TODO(https://crbug.com/803774): Currently SignedExchangeHandler always
+  // calls found_callback and then calls finish_callback after reading the all
+  // buffer. Need to redesign this callback model when we will introduce
   // SignedExchangeHandler::Reader class to read the body and introduce the
   // cert verification.
   void GetHTTPExchange(ExchangeFoundCallback found_callback,
diff --git a/content/browser/loader/url_loader_factory_impl_unittest.cc b/content/browser/loader/url_loader_factory_impl_unittest.cc
index 42a3702e..8f2986e 100644
--- a/content/browser/loader/url_loader_factory_impl_unittest.cc
+++ b/content/browser/loader/url_loader_factory_impl_unittest.cc
@@ -31,7 +31,6 @@
 #include "content/public/common/content_paths.h"
 #include "content/public/test/test_browser_context.h"
 #include "content/public/test/test_browser_thread_bundle.h"
-#include "content/public/test/test_url_loader_client.h"
 #include "mojo/public/c/system/data_pipe.h"
 #include "mojo/public/c/system/types.h"
 #include "mojo/public/cpp/bindings/binding.h"
@@ -52,6 +51,7 @@
 #include "services/network/public/cpp/url_loader_completion_status.h"
 #include "services/network/public/interfaces/url_loader.mojom.h"
 #include "services/network/public/interfaces/url_loader_factory.mojom.h"
+#include "services/network/test/test_url_loader_client.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
 #include "url/origin.h"
@@ -153,7 +153,7 @@
   PathService::Get(DIR_TEST_DATA, &root);
   net::URLRequestMockHTTPJob::AddUrlHandlers(root);
   network::ResourceRequest request;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   // Assume the file contents is small enough to be stored in the data pipe.
   request.url = net::URLRequestMockHTTPJob::GetMockUrl("hello.html");
   request.method = "GET";
@@ -228,7 +228,7 @@
 TEST_P(URLLoaderFactoryImplTest, GetFailedResponse) {
   network::mojom::URLLoaderPtr loader;
   network::ResourceRequest request;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   net::URLRequestFailedJob::AddUrlHandler();
   request.url = net::URLRequestFailedJob::GetMockHttpUrlWithFailurePhase(
       net::URLRequestFailedJob::START, net::ERR_TIMED_OUT);
@@ -257,7 +257,7 @@
 TEST_P(URLLoaderFactoryImplTest, GetFailedResponse2) {
   network::mojom::URLLoaderPtr loader;
   network::ResourceRequest request;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   net::URLRequestFailedJob::AddUrlHandler();
   request.url = net::URLRequestFailedJob::GetMockHttpUrlWithFailurePhase(
       net::URLRequestFailedJob::READ_ASYNC, net::ERR_TIMED_OUT);
@@ -286,7 +286,7 @@
 TEST_P(URLLoaderFactoryImplTest, InvalidURL) {
   network::mojom::URLLoaderPtr loader;
   network::ResourceRequest request;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   request.url = GURL();
   request.method = "GET";
   // |resource_type| can't be a frame type. It is because when PlzNavigate is
@@ -314,7 +314,7 @@
   RejectingResourceDispatcherHostDelegate rdh_delegate;
   rdh_.SetDelegate(&rdh_delegate);
   network::ResourceRequest request;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   request.url = GURL("http://localhost/");
   request.method = "GET";
   // |resource_type| can't be a frame type. It is because when PlzNavigate is
@@ -347,7 +347,7 @@
   net::URLRequestMockHTTPJob::AddUrlHandlers(root);
 
   network::ResourceRequest request;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   request.url = net::URLRequestMockHTTPJob::GetMockUrl("hello.html");
   request.method = "GET";
   request.resource_type = RESOURCE_TYPE_XHR;
@@ -415,7 +415,7 @@
   net::URLRequestSlowDownloadJob::AddUrlHandler();
 
   network::ResourceRequest request;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   request.url = GURL(net::URLRequestSlowDownloadJob::kKnownSizeUrl);
   request.method = "GET";
   request.resource_type = RESOURCE_TYPE_XHR;
@@ -472,7 +472,7 @@
   PathService::Get(DIR_TEST_DATA, &root);
   net::URLRequestMockHTTPJob::AddUrlHandlers(root);
   network::ResourceRequest request;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   // Assume the file contents is small enough to be stored in the data pipe.
   request.url = net::URLRequestMockHTTPJob::GetMockUrl("gzip-content.svgz");
   request.method = "GET";
@@ -532,7 +532,7 @@
   PathService::Get(DIR_TEST_DATA, &root);
   net::URLRequestFailedJob::AddUrlHandler();
   network::ResourceRequest request;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   // Assume the file contents is small enough to be stored in the data pipe.
   request.url = net::URLRequestFailedJob::GetMockHttpUrl(net::ERR_IO_PENDING);
   request.method = "GET";
diff --git a/content/browser/loader/web_package_loader.cc b/content/browser/loader/web_package_loader.cc
index d4a9d688..fe70f71d 100644
--- a/content/browser/loader/web_package_loader.cc
+++ b/content/browser/loader/web_package_loader.cc
@@ -9,6 +9,7 @@
 #include "content/browser/loader/signed_exchange_handler.h"
 #include "content/public/common/content_features.h"
 #include "net/http/http_util.h"
+#include "services/network/public/cpp/features.h"
 
 namespace content {
 
@@ -71,7 +72,7 @@
   DCHECK(base::FeatureList::IsEnabled(features::kSignedHTTPExchange));
   url_loader_.Bind(std::move(endpoints->url_loader));
 
-  if (!base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (!base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     // We don't propagate the response to the navigation request and its
     // throttles, therefore we need to call this here internally in order to
     // move it forward.
@@ -128,7 +129,7 @@
 }
 
 void WebPackageLoader::OnTransferSizeUpdated(int32_t transfer_size_diff) {
-  // TODO(https://crbug.com/80374): Implement this to progressively update the
+  // TODO(https://crbug.com/803774): Implement this to progressively update the
   // encoded data length in DevTools.
 }
 
@@ -145,8 +146,8 @@
 
 void WebPackageLoader::OnComplete(
     const network::URLLoaderCompletionStatus& status) {
-  // TODO(https://crbug.com/80374): Copy the data length information and pass to
-  // |client_| when OnHTTPExchangeFinished() is called.
+  // TODO(https://crbug.com/803774): Copy the data length information and pass
+  // to |client_| when OnHTTPExchangeFinished() is called.
 }
 
 void WebPackageLoader::FollowRedirect() {
@@ -156,7 +157,7 @@
 void WebPackageLoader::ProceedWithResponse() {
   // TODO(https://crbug.com/791049): Remove this when NetworkService is
   // enabled by default.
-  DCHECK(!base::FeatureList::IsEnabled(features::kNetworkService));
+  DCHECK(!base::FeatureList::IsEnabled(network::features::kNetworkService));
   DCHECK(pending_body_.is_valid());
   DCHECK(client_);
   client_->OnStartLoadingResponseBody(std::move(pending_body_));
@@ -167,15 +168,15 @@
 
 void WebPackageLoader::SetPriority(net::RequestPriority priority,
                                    int intra_priority_value) {
-  // TODO(https://crbug.com/80374): Implement this.
+  // TODO(https://crbug.com/803774): Implement this.
 }
 
 void WebPackageLoader::PauseReadingBodyFromNet() {
-  // TODO(https://crbug.com/80374): Implement this.
+  // TODO(https://crbug.com/803774): Implement this.
 }
 
 void WebPackageLoader::ResumeReadingBodyFromNet() {
-  // TODO(https://crbug.com/80374): Implement this.
+  // TODO(https://crbug.com/803774): Implement this.
 }
 
 void WebPackageLoader::ConnectToClient(
@@ -191,7 +192,7 @@
     const network::ResourceResponseHead& resource_response,
     base::Optional<net::SSLInfo> ssl_info,
     mojo::ScopedDataPipeConsumerHandle body) {
-  // TODO(https://crbug.com/80374): Handle no-GET request_method as a error.
+  // TODO(https://crbug.com/803774): Handle no-GET request_method as a error.
   DCHECK(original_response_timing_info_);
   forwarding_client_->OnReceiveRedirect(
       CreateRedirectInfo(request_url),
@@ -202,7 +203,7 @@
   client_->OnReceiveResponse(resource_response, std::move(ssl_info),
                              nullptr /* downloaded_file */);
 
-  if (!base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (!base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     // Need to wait until ProceedWithResponse() is called.
     pending_body_ = std::move(body);
   } else {
@@ -213,7 +214,7 @@
 void WebPackageLoader::OnHTTPExchangeFinished(
     const network::URLLoaderCompletionStatus& status) {
   if (pending_body_.is_valid()) {
-    DCHECK(!base::FeatureList::IsEnabled(features::kNetworkService));
+    DCHECK(!base::FeatureList::IsEnabled(network::features::kNetworkService));
     // If ProceedWithResponse() was not called yet, need to call OnComplete()
     // after ProceedWithResponse() is called.
     pending_completion_status_ = status;
diff --git a/content/browser/loader/web_package_request_handler.cc b/content/browser/loader/web_package_request_handler.cc
index 3f8f9d8..d9c81430 100644
--- a/content/browser/loader/web_package_request_handler.cc
+++ b/content/browser/loader/web_package_request_handler.cc
@@ -33,7 +33,7 @@
     const network::ResourceRequest& resource_request,
     ResourceContext* resource_context,
     LoaderCallback callback) {
-  // TODO(https://crbug.com/80374): Ask WebPackageFetchManager to get the
+  // TODO(https://crbug.com/803774): Ask WebPackageFetchManager to get the
   // ongoing matching SignedExchangeHandler which was created by a
   // WebPackagePrefetcher.
 
@@ -61,7 +61,7 @@
   network::mojom::URLLoaderClientPtr client;
   *client_request = mojo::MakeRequest(&client);
 
-  // TODO(https://crbug.com/80374): Consider creating a new ThrottlingURLLoader
+  // TODO(https://crbug.com/803774): Consider creating a new ThrottlingURLLoader
   // or reusing the existing ThrottlingURLLoader by reattaching URLLoaderClient,
   // to support SafeBrowsing checking of the content of the WebPackage.
   web_package_loader_ = base::MakeUnique<WebPackageLoader>(
diff --git a/content/browser/network_service_browsertest.cc b/content/browser/network_service_browsertest.cc
index ecab3580..ae882db 100644
--- a/content/browser/network_service_browsertest.cc
+++ b/content/browser/network_service_browsertest.cc
@@ -20,6 +20,7 @@
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
 #include "net/dns/mock_host_resolver.h"
+#include "services/network/public/cpp/features.h"
 
 namespace content {
 
@@ -104,7 +105,8 @@
 class NetworkServiceBrowserTest : public ContentBrowserTest {
  public:
   NetworkServiceBrowserTest() {
-    scoped_feature_list_.InitAndEnableFeature(features::kNetworkService);
+    scoped_feature_list_.InitAndEnableFeature(
+        network::features::kNetworkService);
     EXPECT_TRUE(embedded_test_server()->Start());
 
     WebUIControllerFactory::RegisterFactory(&factory_);
@@ -172,7 +174,7 @@
  public:
   NetworkServiceInProcessBrowserTest() {
     std::vector<base::Feature> features;
-    features.push_back(features::kNetworkService);
+    features.push_back(network::features::kNetworkService);
     features.push_back(features::kNetworkServiceInProcess);
     scoped_feature_list_.InitWithFeatures(features,
                                           std::vector<base::Feature>());
diff --git a/content/browser/network_service_instance.cc b/content/browser/network_service_instance.cc
index da85911..6f3fe1f 100644
--- a/content/browser/network_service_instance.cc
+++ b/content/browser/network_service_instance.cc
@@ -6,12 +6,12 @@
 
 #include "base/feature_list.h"
 #include "content/browser/network_service_client.h"
-#include "content/network/network_service_impl.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
-#include "content/public/common/content_features.h"
 #include "content/public/common/service_manager_connection.h"
 #include "content/public/common/service_names.mojom.h"
+#include "services/network/network_service_impl.h"
+#include "services/network/public/cpp/features.h"
 #include "services/service_manager/public/cpp/connector.h"
 
 namespace content {
@@ -19,7 +19,7 @@
 namespace {
 
 network::mojom::NetworkServicePtr* g_network_service_ptr = nullptr;
-NetworkServiceImpl* g_network_service;
+network::NetworkServiceImpl* g_network_service;
 
 void CreateNetworkServiceOnIO(network::mojom::NetworkServiceRequest request) {
   if (g_network_service) {
@@ -29,7 +29,7 @@
     return;
   }
 
-  g_network_service = new NetworkServiceImpl(
+  g_network_service = new network::NetworkServiceImpl(
       nullptr, std::move(request), GetContentClient()->browser()->GetNetLog());
 }
 
@@ -43,7 +43,7 @@
   static NetworkServiceClient* g_client;
   if (!g_network_service_ptr->is_bound() ||
       g_network_service_ptr->encountered_error()) {
-    if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+    if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
       ServiceManagerConnection::GetForProcess()->GetConnector()->BindInterface(
           mojom::kNetworkServiceName, g_network_service_ptr);
     } else {
@@ -62,11 +62,11 @@
   return g_network_service_ptr->get();
 }
 
-NetworkService* GetNetworkServiceImpl() {
+network::NetworkService* GetNetworkServiceImpl() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
-  DCHECK(!base::FeatureList::IsEnabled(features::kNetworkService));
+  DCHECK(!base::FeatureList::IsEnabled(network::features::kNetworkService));
   if (!g_network_service) {
-    g_network_service = new NetworkServiceImpl(
+    g_network_service = new network::NetworkServiceImpl(
         nullptr, nullptr, GetContentClient()->browser()->GetNetLog());
   }
 
@@ -75,7 +75,7 @@
 
 void FlushNetworkServiceInstanceForTesting() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
-  DCHECK(base::FeatureList::IsEnabled(features::kNetworkService));
+  DCHECK(base::FeatureList::IsEnabled(network::features::kNetworkService));
 
   if (g_network_service_ptr)
     g_network_service_ptr->FlushForTesting();
diff --git a/content/browser/network_service_restart_browsertest.cc b/content/browser/network_service_restart_browsertest.cc
index 60cd70d6..7661eca 100644
--- a/content/browser/network_service_restart_browsertest.cc
+++ b/content/browser/network_service_restart_browsertest.cc
@@ -10,7 +10,6 @@
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/network_service_instance.h"
 #include "content/public/browser/web_contents.h"
-#include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/simple_url_loader.h"
 #include "content/public/test/browser_test_utils.h"
@@ -21,6 +20,7 @@
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/http_request.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/interfaces/network_service.mojom.h"
 
 namespace content {
@@ -78,7 +78,8 @@
 class NetworkServiceRestartBrowserTest : public ContentBrowserTest {
  public:
   NetworkServiceRestartBrowserTest() {
-    scoped_feature_list_.InitAndEnableFeature(features::kNetworkService);
+    scoped_feature_list_.InitAndEnableFeature(
+        network::features::kNetworkService);
   }
 
   void SetUpOnMainThread() override {
diff --git a/content/browser/renderer_host/browser_compositor_view_mac.mm b/content/browser/renderer_host/browser_compositor_view_mac.mm
index dc41f232..eac60704d 100644
--- a/content/browser/renderer_host/browser_compositor_view_mac.mm
+++ b/content/browser/renderer_host/browser_compositor_view_mac.mm
@@ -340,7 +340,8 @@
       delegated_frame_host_scale_factor_, delegated_frame_host_size_dip_);
   delegated_frame_host_scale_factor_ = scale_factor;
 
-  GetDelegatedFrameHost()->WasResized();
+  GetDelegatedFrameHost()->WasResized(
+      cc::DeadlinePolicy::UseExistingDeadline());
 }
 
 bool BrowserCompositorMac::HasFrameOfSize(const gfx::Size& desired_size) {
diff --git a/content/browser/renderer_host/delegated_frame_host.cc b/content/browser/renderer_host/delegated_frame_host.cc
index da8d78f..89574bf 100644
--- a/content/browser/renderer_host/delegated_frame_host.cc
+++ b/content/browser/renderer_host/delegated_frame_host.cc
@@ -93,7 +93,9 @@
   if (compositor_)
     compositor_->SetLatencyInfo(latency_info);
 
-  WasResized();
+  // Use the default deadline to synchronize web content with browser UI.
+  // TODO(fsamuel): Investigate if there is a better deadline to use here.
+  WasResized(cc::DeadlinePolicy::UseDefaultDeadline());
 }
 
 bool DelegatedFrameHost::HasSavedFrame() {
@@ -286,7 +288,7 @@
   AttemptFrameSubscriberCapture(damage_rect);
 }
 
-void DelegatedFrameHost::WasResized() {
+void DelegatedFrameHost::WasResized(const cc::DeadlinePolicy& deadline_policy) {
   const viz::SurfaceId* primary_surface_id =
       client_->DelegatedFrameHostGetLayer()->GetPrimarySurfaceId();
   gfx::Size new_size_in_dip = client_->DelegatedFrameHostDesiredSizeInDIP();
@@ -299,7 +301,8 @@
 
     viz::SurfaceId surface_id(frame_sink_id_, client_->GetLocalSurfaceId());
     client_->DelegatedFrameHostGetLayer()->SetShowPrimarySurface(
-        surface_id, current_frame_size_in_dip_, GetGutterColor());
+        surface_id, current_frame_size_in_dip_, GetGutterColor(),
+        deadline_policy);
     if (compositor_ && !base::CommandLine::ForCurrentProcess()->HasSwitch(
                            switches::kDisableResizeLock)) {
       compositor_->OnChildResizing();
@@ -594,7 +597,8 @@
     }
   } else {
     client_->DelegatedFrameHostGetLayer()->SetShowPrimarySurface(
-        surface_info.id(), frame_size_in_dip, GetGutterColor());
+        surface_info.id(), frame_size_in_dip, GetGutterColor(),
+        cc::DeadlinePolicy::UseDefaultDeadline());
   }
 
   client_->DelegatedFrameHostGetLayer()->SetFallbackSurfaceId(
diff --git a/content/browser/renderer_host/delegated_frame_host.h b/content/browser/renderer_host/delegated_frame_host.h
index 8ea2b2bf..aaba449e 100644
--- a/content/browser/renderer_host/delegated_frame_host.h
+++ b/content/browser/renderer_host/delegated_frame_host.h
@@ -144,7 +144,7 @@
   void ClearDelegatedFrame();
   void WasHidden();
   void WasShown(const ui::LatencyInfo& latency_info);
-  void WasResized();
+  void WasResized(const cc::DeadlinePolicy& deadline_policy);
   bool HasSavedFrame();
   gfx::Size GetRequestedRendererSize() const;
   void SetCompositor(ui::Compositor* compositor);
diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
index 48f632b..0748492 100644
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc
@@ -193,6 +193,7 @@
 #include "ppapi/features/features.h"
 #include "services/device/public/interfaces/battery_monitor.mojom.h"
 #include "services/device/public/interfaces/constants.mojom.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/network_switches.h"
 #include "services/network/public/interfaces/network_service.mojom.h"
 #include "services/resource_coordinator/public/cpp/process_resource_coordinator.h"
@@ -1949,7 +1950,7 @@
   associated_registry->AddInterface(base::Bind(
       &RenderProcessHostImpl::CreateRendererHost, base::Unretained(this)));
 
-  if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     AddUIThreadInterface(
         registry.get(),
         base::Bind(&RenderProcessHostImpl::CreateURLLoaderFactory,
@@ -2001,7 +2002,7 @@
 
 void RenderProcessHostImpl::GetBlobURLLoaderFactory(
     network::mojom::URLLoaderFactoryRequest request) {
-  if (!base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (!base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     NOTREACHED();
     return;
   }
@@ -2057,7 +2058,7 @@
 
 void RenderProcessHostImpl::CreateURLLoaderFactory(
     network::mojom::URLLoaderFactoryRequest request) {
-  if (!base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (!base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     NOTREACHED();
     return;
   }
diff --git a/content/browser/renderer_host/render_widget_host_view_aura.cc b/content/browser/renderer_host/render_widget_host_view_aura.cc
index 668fe4d..c04004e 100644
--- a/content/browser/renderer_host/render_widget_host_view_aura.cc
+++ b/content/browser/renderer_host/render_widget_host_view_aura.cc
@@ -1595,7 +1595,7 @@
 
   host_->WasResized();
   if (delegated_frame_host_)
-    delegated_frame_host_->WasResized();
+    delegated_frame_host_->WasResized(cc::DeadlinePolicy::UseDefaultDeadline());
   if (host_->auto_resize_enabled()) {
     host_->DidAllocateLocalSurfaceIdForAutoResize(
         host_->last_auto_resize_request_number());
@@ -2046,10 +2046,11 @@
   }
 }
 
-void RenderWidgetHostViewAura::WasResized() {
+void RenderWidgetHostViewAura::WasResized(
+    const cc::DeadlinePolicy& deadline_policy) {
   window_->AllocateLocalSurfaceId();
   if (delegated_frame_host_)
-    delegated_frame_host_->WasResized();
+    delegated_frame_host_->WasResized(deadline_policy);
   if (host_->auto_resize_enabled()) {
     host_->DidAllocateLocalSurfaceIdForAutoResize(
         host_->last_auto_resize_request_number());
@@ -2192,7 +2193,7 @@
     window_->SetBounds(rect);
   host_->WasResized();
   if (delegated_frame_host_)
-    delegated_frame_host_->WasResized();
+    delegated_frame_host_->WasResized(cc::DeadlinePolicy::UseDefaultDeadline());
   if (host_->auto_resize_enabled()) {
     host_->DidAllocateLocalSurfaceIdForAutoResize(
         host_->last_auto_resize_request_number());
@@ -2486,16 +2487,16 @@
 }
 
 void RenderWidgetHostViewAura::OnSynchronizedDisplayPropertiesChanged() {
-  WasResized();
+  WasResized(cc::DeadlinePolicy::UseDefaultDeadline());
 }
 
 void RenderWidgetHostViewAura::ResizeDueToAutoResize(const gfx::Size& new_size,
                                                      uint64_t sequence_number) {
-  WasResized();
+  WasResized(cc::DeadlinePolicy::UseDefaultDeadline());
 }
 
 void RenderWidgetHostViewAura::DidNavigate() {
-  WasResized();
+  WasResized(cc::DeadlinePolicy::UseExistingDeadline());
   if (delegated_frame_host_)
     delegated_frame_host_->DidNavigate();
 }
diff --git a/content/browser/renderer_host/render_widget_host_view_aura.h b/content/browser/renderer_host/render_widget_host_view_aura.h
index 8575707..0e9fd5bf 100644
--- a/content/browser/renderer_host/render_widget_host_view_aura.h
+++ b/content/browser/renderer_host/render_widget_host_view_aura.h
@@ -21,6 +21,7 @@
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
 #include "build/build_config.h"
+#include "cc/layers/deadline_policy.h"
 #include "components/viz/common/frame_sinks/begin_frame_args.h"
 #include "components/viz/common/frame_sinks/begin_frame_source.h"
 #include "content/browser/accessibility/browser_accessibility_manager.h"
@@ -424,7 +425,7 @@
 
   void UpdateCursorIfOverSelf();
 
-  void WasResized();
+  void WasResized(const cc::DeadlinePolicy& deadline_policy);
 
   // Tracks whether SnapToPhysicalPixelBoundary() has been called.
   bool has_snapped_to_boundary() { return has_snapped_to_boundary_; }
diff --git a/content/browser/renderer_interface_binders.cc b/content/browser/renderer_interface_binders.cc
index 67e870a..0ace8e6 100644
--- a/content/browser/renderer_interface_binders.cc
+++ b/content/browser/renderer_interface_binders.cc
@@ -17,7 +17,6 @@
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/storage_partition_impl.h"
 #include "content/browser/websockets/websocket_manager.h"
-#include "content/network/restricted_cookie_manager.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
@@ -26,6 +25,7 @@
 #include "content/public/common/content_switches.h"
 #include "services/device/public/interfaces/constants.mojom.h"
 #include "services/device/public/interfaces/vibration_manager.mojom.h"
+#include "services/network/restricted_cookie_manager.h"
 #include "services/service_manager/public/cpp/binder_registry.h"
 #include "services/service_manager/public/cpp/connector.h"
 #include "services/shape_detection/public/interfaces/barcodedetection.mojom.h"
diff --git a/content/browser/security_exploit_browsertest.cc b/content/browser/security_exploit_browsertest.cc
index eb05c34..0d67ba269 100644
--- a/content/browser/security_exploit_browsertest.cc
+++ b/content/browser/security_exploit_browsertest.cc
@@ -39,7 +39,6 @@
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_navigation_observer.h"
-#include "content/public/test/test_url_loader_client.h"
 #include "content/public/test/test_utils.h"
 #include "content/shell/browser/shell.h"
 #include "content/test/content_browser_test_utils_internal.h"
@@ -54,6 +53,7 @@
 #include "services/network/public/cpp/network_switches.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/interfaces/url_loader.mojom.h"
+#include "services/network/test/test_url_loader_client.h"
 #include "third_party/WebKit/public/web/WebTriggeringEventInfo.h"
 
 using IPC::IpcSecurityTestUtil;
@@ -190,7 +190,7 @@
       int request_id,
       const network::ResourceRequest& request) {
     network::mojom::URLLoaderPtr loader;
-    TestURLLoaderClient client;
+    network::TestURLLoaderClient client;
     filter->CreateLoaderAndStart(
         mojo::MakeRequest(&loader), route_id, request_id,
         network::mojom::kURLLoadOptionNone, request,
diff --git a/content/browser/service_manager/service_manager_context.cc b/content/browser/service_manager/service_manager_context.cc
index 51355ca..e94751b 100644
--- a/content/browser/service_manager/service_manager_context.cc
+++ b/content/browser/service_manager/service_manager_context.cc
@@ -31,7 +31,6 @@
 #include "content/browser/wake_lock/wake_lock_context_host.h"
 #include "content/common/service_manager/service_manager_connection_impl.h"
 #include "content/grit/content_resources.h"
-#include "content/network/network_service_impl.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/child_process_data.h"
 #include "content/public/browser/content_browser_client.h"
@@ -57,6 +56,8 @@
 #include "services/device/public/interfaces/constants.mojom.h"
 #include "services/metrics/metrics_mojo_service.h"
 #include "services/metrics/public/interfaces/constants.mojom.h"
+#include "services/network/network_service_impl.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/interfaces/network_service_test.mojom.h"
 #include "services/resource_coordinator/public/cpp/resource_coordinator_features.h"
 #include "services/resource_coordinator/public/interfaces/service_constants.mojom.h"
@@ -320,7 +321,7 @@
   auto registry = std::make_unique<service_manager::BinderRegistry>();
   registry->AddInterface(base::BindRepeating(
       [](network::mojom::NetworkServiceTestRequest request) {}));
-  return std::make_unique<NetworkServiceImpl>(std::move(registry));
+  return std::make_unique<network::NetworkServiceImpl>(std::move(registry));
 }
 
 }  // namespace
@@ -547,7 +548,7 @@
       base::ASCIIToUTF16("Data Decoder Service");
 
   bool network_service_enabled =
-      base::FeatureList::IsEnabled(features::kNetworkService);
+      base::FeatureList::IsEnabled(network::features::kNetworkService);
   bool network_service_in_process =
       base::FeatureList::IsEnabled(features::kNetworkServiceInProcess) ||
       base::CommandLine::ForCurrentProcess()->HasSwitch(
diff --git a/content/browser/service_worker/service_worker_script_url_loader_unittest.cc b/content/browser/service_worker/service_worker_script_url_loader_unittest.cc
index 73df18d8..5296f1a 100644
--- a/content/browser/service_worker/service_worker_script_url_loader_unittest.cc
+++ b/content/browser/service_worker/service_worker_script_url_loader_unittest.cc
@@ -13,7 +13,6 @@
 #include "content/browser/service_worker/service_worker_disk_cache.h"
 #include "content/browser/url_loader_factory_getter.h"
 #include "content/public/test/test_browser_thread_bundle.h"
-#include "content/public/test/test_url_loader_client.h"
 #include "mojo/common/data_pipe_utils.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
 #include "net/base/test_completion_callback.h"
@@ -23,6 +22,7 @@
 #include "net/url_request/redirect_info.h"
 #include "services/network/public/cpp/url_loader_completion_status.h"
 #include "services/network/public/interfaces/url_loader_factory.mojom.h"
+#include "services/network/test/test_url_loader_client.h"
 #include "third_party/WebKit/common/service_worker/service_worker_registration.mojom.h"
 
 namespace content {
@@ -262,7 +262,7 @@
   std::unique_ptr<ServiceWorkerScriptURLLoader> loader_;
   std::unique_ptr<MockHTTPServer> mock_server_;
 
-  TestURLLoaderClient client_;
+  network::TestURLLoaderClient client_;
 };
 
 TEST_F(ServiceWorkerScriptURLLoaderTest, Success) {
diff --git a/content/browser/service_worker/service_worker_url_loader_job_unittest.cc b/content/browser/service_worker/service_worker_url_loader_job_unittest.cc
index bbd489c..0fd80caa 100644
--- a/content/browser/service_worker/service_worker_url_loader_job_unittest.cc
+++ b/content/browser/service_worker/service_worker_url_loader_job_unittest.cc
@@ -14,17 +14,17 @@
 #include "content/browser/service_worker/service_worker_version.h"
 #include "content/common/service_worker/service_worker_event_dispatcher.mojom.h"
 #include "content/common/service_worker/service_worker_utils.h"
-#include "content/public/common/content_features.h"
 #include "content/public/test/test_browser_thread_bundle.h"
-#include "content/public/test/test_url_loader_client.h"
 #include "mojo/common/data_pipe_utils.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
 #include "net/http/http_util.h"
 #include "net/ssl/ssl_info.h"
 #include "net/test/cert_test_util.h"
 #include "net/test/test_data_directory.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/resource_response.h"
 #include "services/network/public/interfaces/fetch_api.mojom.h"
+#include "services/network/test/test_url_loader_client.h"
 #include "storage/browser/blob/blob_data_builder.h"
 #include "storage/browser/blob/blob_data_handle.h"
 #include "storage/browser/blob/blob_impl.h"
@@ -490,7 +490,7 @@
   ~ServiceWorkerURLLoaderJobTest() override = default;
 
   void SetUp() override {
-    feature_list_.InitAndEnableFeature(features::kNetworkService);
+    feature_list_.InitAndEnableFeature(network::features::kNetworkService);
 
     // Create an active service worker.
     storage()->LazyInitializeForTest(base::BindOnce(&base::DoNothing));
@@ -610,7 +610,7 @@
   scoped_refptr<ServiceWorkerRegistration> registration_;
   scoped_refptr<ServiceWorkerVersion> version_;
   storage::BlobStorageContext blob_context_;
-  TestURLLoaderClient client_;
+  network::TestURLLoaderClient client_;
   bool was_main_resource_load_failed_called_ = false;
   std::unique_ptr<ServiceWorkerURLLoaderJob> job_;
   network::mojom::URLLoaderPtr loader_;
diff --git a/content/browser/site_per_process_browsertest.cc b/content/browser/site_per_process_browsertest.cc
index b48a58ae..916d67c 100644
--- a/content/browser/site_per_process_browsertest.cc
+++ b/content/browser/site_per_process_browsertest.cc
@@ -90,6 +90,7 @@
 #include "net/test/embedded_test_server/http_request.h"
 #include "net/test/embedded_test_server/http_response.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "services/network/public/cpp/features.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/WebKit/common/feature_policy/feature_policy.h"
@@ -2115,7 +2116,7 @@
   // cross-site, which will lead to a committed net error.
   GURL url_b = embedded_test_server()->GetURL("b.com", "/title3.html");
   bool network_service =
-      base::FeatureList::IsEnabled(features::kNetworkService);
+      base::FeatureList::IsEnabled(network::features::kNetworkService);
   std::unique_ptr<URLLoaderInterceptor> url_loader_interceptor;
   if (network_service) {
     url_loader_interceptor = std::make_unique<URLLoaderInterceptor>(
diff --git a/content/browser/storage_partition_impl.cc b/content/browser/storage_partition_impl.cc
index 375eccf8..bbb2498 100644
--- a/content/browser/storage_partition_impl.cc
+++ b/content/browser/storage_partition_impl.cc
@@ -26,8 +26,6 @@
 #include "content/browser/gpu/shader_cache_factory.h"
 #include "content/browser/notifications/platform_notification_context_impl.h"
 #include "content/common/dom_storage/dom_storage_types.h"
-#include "content/network/network_context.h"
-#include "content/network/network_service_impl.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
@@ -46,6 +44,9 @@
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "ppapi/features/features.h"
+#include "services/network/network_context.h"
+#include "services/network/network_service_impl.h"
+#include "services/network/public/cpp/features.h"
 #include "services/service_manager/public/cpp/connector.h"
 #include "storage/browser/blob/blob_registry_impl.h"
 #include "storage/browser/blob/blob_storage_context.h"
@@ -265,8 +266,8 @@
                   scoped_refptr<net::URLRequestContextGetter> context_getter) {
     DCHECK_CURRENTLY_ON(BrowserThread::IO);
     context_getter_ = std::move(context_getter);
-    network_context_ = std::make_unique<NetworkContext>(
-        static_cast<NetworkServiceImpl*>(GetNetworkServiceImpl()),
+    network_context_ = std::make_unique<network::NetworkContext>(
+        static_cast<network::NetworkServiceImpl*>(GetNetworkServiceImpl()),
         std::move(network_context_request),
         context_getter_->GetURLRequestContext());
   }
@@ -585,7 +586,7 @@
   scoped_refptr<ChromeBlobStorageContext> blob_context =
       ChromeBlobStorageContext::GetFor(context);
 
-  if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     BlobURLLoaderFactory::BlobContextGetter blob_getter =
         base::BindOnce(&BlobStorageContextGetter, blob_context);
     partition->blob_url_loader_factory_ =
@@ -623,7 +624,7 @@
 
 network::mojom::NetworkContext* StoragePartitionImpl::GetNetworkContext() {
   // Create the NetworkContext as needed, when the network service is disabled.
-  if (!base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (!base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     if (network_context_)
       return network_context_.get();
     DCHECK(!network_context_owner_);
diff --git a/content/browser/storage_partition_impl_browsertest.cc b/content/browser/storage_partition_impl_browsertest.cc
index fd06912..dfbcc753 100644
--- a/content/browser/storage_partition_impl_browsertest.cc
+++ b/content/browser/storage_partition_impl_browsertest.cc
@@ -10,18 +10,18 @@
 #include "build/build_config.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/web_contents.h"
-#include "content/public/common/content_features.h"
 #include "content/public/test/content_browser_test.h"
-#include "content/public/test/test_url_loader_client.h"
 #include "content/shell/browser/shell.h"
 #include "mojo/public/cpp/bindings/interface_request.h"
 #include "net/http/http_response_headers.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/resource_response_info.h"
 #include "services/network/public/interfaces/network_service.mojom.h"
 #include "services/network/public/interfaces/url_loader.mojom.h"
 #include "services/network/public/interfaces/url_loader_factory.mojom.h"
+#include "services/network/test/test_url_loader_client.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
 
@@ -38,7 +38,7 @@
  public:
   StoragePartititionImplBrowsertest() {
     if (GetParam() == NetworkServiceState::kEnabled)
-      feature_list_.InitAndEnableFeature(features::kNetworkService);
+      feature_list_.InitAndEnableFeature(network::features::kNetworkService);
   }
   ~StoragePartititionImplBrowsertest() override {}
 
@@ -59,7 +59,7 @@
       ->CreateURLLoaderFactory(mojo::MakeRequest(&loader_factory), 0);
 
   network::ResourceRequest request;
-  TestURLLoaderClient client;
+  network::TestURLLoaderClient client;
   request.url = embedded_test_server()->GetURL("/set-header?foo: bar");
   request.method = "GET";
   network::mojom::URLLoaderPtr loader;
diff --git a/content/browser/utility_process_host_impl.cc b/content/browser/utility_process_host_impl.cc
index 4c14a70..76d1915 100644
--- a/content/browser/utility_process_host_impl.cc
+++ b/content/browser/utility_process_host_impl.cc
@@ -298,10 +298,10 @@
     // Browser command-line switches to propagate to the utility process.
     static const char* const kSwitchNames[] = {
       network::switches::kHostResolverRules,
+      network::switches::kIgnoreCertificateErrorsSPKIList,
       network::switches::kLogNetLog,
       network::switches::kNoReferrers,
       switches::kIgnoreCertificateErrors,
-      switches::kIgnoreCertificateErrorsSPKIList,
       switches::kNoSandbox,
       switches::kOverrideUseSoftwareGLForTests,
       switches::kProxyServer,
diff --git a/content/child/DEPS b/content/child/DEPS
index 2e4293e..a3630ba8 100644
--- a/content/child/DEPS
+++ b/content/child/DEPS
@@ -10,6 +10,7 @@
   "+services/device/public/cpp/device_features.h",
   "+services/device/public/cpp/power_monitor",
   "+services/device/public/interfaces",
+  "+services/network/public/cpp",
   "+services/resource_coordinator",
   "+services/service_manager",
   "+third_party/WebKit/common",
diff --git a/content/child/blink_platform_impl.cc b/content/child/blink_platform_impl.cc
index 17dbb02..eafdb28 100644
--- a/content/child/blink_platform_impl.cc
+++ b/content/child/blink_platform_impl.cc
@@ -46,6 +46,7 @@
 #include "content/public/common/service_manager_connection.h"
 #include "content/public/common/service_names.mojom.h"
 #include "net/base/net_errors.h"
+#include "services/network/public/cpp/features.h"
 #include "third_party/WebKit/public/platform/WebData.h"
 #include "third_party/WebKit/public/platform/WebFloatPoint.h"
 #include "third_party/WebKit/public/platform/WebGestureCurve.h"
@@ -657,7 +658,8 @@
 }
 
 bool BlinkPlatformImpl::IsRendererSideResourceSchedulerEnabled() const {
-  return base::FeatureList::IsEnabled(features::kRendererSideResourceScheduler);
+  return base::FeatureList::IsEnabled(
+      network::features::kRendererSideResourceScheduler);
 }
 
 std::unique_ptr<blink::WebGestureCurve>
diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.cc
index 964f02b..2216cba75 100644
--- a/content/child/runtime_features.cc
+++ b/content/child/runtime_features.cc
@@ -17,6 +17,7 @@
 #include "content/public/common/content_switches.h"
 #include "media/base/media_switches.h"
 #include "services/device/public/cpp/device_features.h"
+#include "services/network/public/cpp/features.h"
 #include "third_party/WebKit/public/platform/WebRuntimeFeatures.h"
 #include "ui/gfx/switches.h"
 #include "ui/gl/gl_switches.h"
@@ -297,7 +298,7 @@
           features::kServiceWorkerScriptFullCodeCache));
 
   WebRuntimeFeatures::EnableNetworkService(
-      base::FeatureList::IsEnabled(features::kNetworkService));
+      base::FeatureList::IsEnabled(network::features::kNetworkService));
 
   if (base::FeatureList::IsEnabled(features::kGamepadExtensions))
     WebRuntimeFeatures::EnableGamepadExtensions(true);
@@ -321,7 +322,7 @@
   if (base::FeatureList::IsEnabled(features::kNotificationsWithMojo))
     WebRuntimeFeatures::EnableNotificationsWithMojo(true);
 
-  if (base::FeatureList::IsEnabled(features::kOutOfBlinkCORS))
+  if (base::FeatureList::IsEnabled(network::features::kOutOfBlinkCORS))
     WebRuntimeFeatures::EnableOutOfBlinkCORS(true);
 
   if (base::FeatureList::IsEnabled(features::kOriginManifest))
diff --git a/content/common/associated_interface_provider_impl.cc b/content/common/associated_interface_provider_impl.cc
index b594e22..d587632 100644
--- a/content/common/associated_interface_provider_impl.cc
+++ b/content/common/associated_interface_provider_impl.cc
@@ -52,7 +52,7 @@
 }
 
 AssociatedInterfaceProviderImpl::AssociatedInterfaceProviderImpl()
-    : local_provider_(new LocalProvider(&proxy_)) {}
+    : local_provider_(std::make_unique<LocalProvider>(&proxy_)) {}
 
 AssociatedInterfaceProviderImpl::~AssociatedInterfaceProviderImpl() {}
 
@@ -66,7 +66,11 @@
 void AssociatedInterfaceProviderImpl::OverrideBinderForTesting(
     const std::string& name,
     const base::Callback<void(mojo::ScopedInterfaceEndpointHandle)>& binder) {
-  DCHECK(local_provider_);
+  if (!local_provider_) {
+    DCHECK(proxy_.is_bound());
+    proxy_.reset();
+    local_provider_ = std::make_unique<LocalProvider>(&proxy_);
+  }
   local_provider_->SetBinderForName(name, binder);
 }
 
diff --git a/content/common/service_worker/service_worker_utils.cc b/content/common/service_worker/service_worker_utils.cc
index 8de8443..0a7f80b 100644
--- a/content/common/service_worker/service_worker_utils.cc
+++ b/content/common/service_worker/service_worker_utils.cc
@@ -18,6 +18,7 @@
 #include "content/public/common/origin_util.h"
 #include "net/http/http_byte_range.h"
 #include "net/http/http_util.h"
+#include "services/network/public/cpp/features.h"
 
 namespace content {
 
@@ -142,7 +143,7 @@
 
 // static
 bool ServiceWorkerUtils::IsServicificationEnabled() {
-  return base::FeatureList::IsEnabled(features::kNetworkService) ||
+  return base::FeatureList::IsEnabled(network::features::kNetworkService) ||
          base::FeatureList::IsEnabled(features::kServiceWorkerServicification);
 }
 
diff --git a/content/network/BUILD.gn b/content/network/BUILD.gn
index 5f2f5cd3..78c542c 100644
--- a/content/network/BUILD.gn
+++ b/content/network/BUILD.gn
@@ -3,7 +3,6 @@
 # found in the LICENSE file.
 
 import("//build/config/jumbo.gni")
-import("//services/service_manager/public/service_manifest.gni")
 
 group("network") {
   visibility = [ "//content/*" ]  # This is an internal content API.
@@ -25,8 +24,8 @@
     ":network",
     "//content",  # For the component build.
     "//content/app:*",
-    "//content/public/network/*",
     "//content/utility:utility",
+    "//services/network/public/cpp/*",
 
     # For use by StoragePartition.
     # TODO(mmenke): Remove when network service ships.
@@ -34,84 +33,25 @@
   ]
 
   sources = [
-    "cache_url_loader.cc",
-    "cache_url_loader.h",
     "cors/cors_url_loader.cc",
     "cors/cors_url_loader.h",
     "cors/cors_url_loader_factory.cc",
     "cors/cors_url_loader_factory.h",
-    "data_pipe_element_reader.cc",
-    "data_pipe_element_reader.h",
-    "http_server_properties_pref_delegate.cc",
-    "http_server_properties_pref_delegate.h",
-    "network_change_manager.cc",
-    "network_change_manager.h",
-    "network_context.cc",
-    "network_context.h",
-    "network_sandbox_hook_linux.cc",
-    "network_sandbox_hook_linux.h",
-    "network_service_impl.cc",
-    "network_service_impl.h",
-    "network_service_url_loader_factory.cc",
-    "network_service_url_loader_factory.h",
-    "proxy_resolver_factory_mojo.cc",
-    "proxy_resolver_factory_mojo.h",
-    "proxy_service_mojo.cc",
-    "proxy_service_mojo.h",
     "resource_scheduler.cc",
     "resource_scheduler.h",
-    "restricted_cookie_manager.cc",
-    "restricted_cookie_manager.h",
-    "throttling/network_conditions.cc",
-    "throttling/network_conditions.h",
-    "throttling/throttling_controller.cc",
-    "throttling/throttling_controller.h",
-    "throttling/throttling_network_interceptor.cc",
-    "throttling/throttling_network_interceptor.h",
-    "throttling/throttling_network_transaction.cc",
-    "throttling/throttling_network_transaction.h",
-    "throttling/throttling_network_transaction_factory.cc",
-    "throttling/throttling_network_transaction_factory.h",
-    "throttling/throttling_upload_data_stream.cc",
-    "throttling/throttling_upload_data_stream.h",
-    "upload_progress_tracker.cc",
-    "upload_progress_tracker.h",
-    "url_loader.cc",
-    "url_loader.h",
-    "url_request_context_builder_mojo.cc",
   ]
 
   configs += [ "//content:content_implementation" ]
 
   deps = [
     "//base",
-    "//components/cookie_config",
-    "//components/network_session_configurator/browser",
-    "//components/network_session_configurator/common",
-    "//components/prefs",
     "//content:export",
     "//content/common",
     "//content/common:mojo_bindings",
     "//content/public/common:common_sources",
-    "//content/public/network:network_sources",
-    "//mojo/public/cpp/bindings",
     "//net",
-    "//net:extras",
-    "//net:net_browser_services",
     "//services/network:network_service",
     "//services/network/public/cpp",
-    "//services/network/public/cpp:network_features",
     "//services/proxy_resolver/public/interfaces",
-    "//services/service_manager/public/cpp",
-    "//services/service_manager/public/interfaces",
   ]
-
-  if (is_linux) {
-    deps += [ "//sandbox/linux:sandbox_services" ]
-  }
-}
-
-service_manifest("manifest") {
-  name = "network"
-  source = "manifest.json"
 }
diff --git a/content/network/DEPS b/content/network/DEPS
index 6b87bac..a57bd0d6 100644
--- a/content/network/DEPS
+++ b/content/network/DEPS
@@ -1,16 +1,8 @@
 # Tight rules since this will move to services/network. See README.
 include_rules = [
-  "+components/cookie_config",
-  "+components/network_session_configurator",
-  # Prefs are used to create an independent file with a persisted key:value
-  # store for networking-related data (Like which servers support QUIC), rather
-  # than to store user preferences.
-  "+components/prefs",
   "-content",
   "+content/common/content_export.h",
   "+content/network",
-  # TODO(yhirano): Remove this dependency.
-  "+content/public/common/content_features.h",
   "+content/public/common/origin_util.h",
   "+content/public/common/request_context_type.h",
   "+content/public/common/resource_type.h",
@@ -18,7 +10,6 @@
   "+content/public/network",
   "+services/network",
   "+services/service_manager/public",
-  "+services/service_manager/sandbox",
 ]
 
 specific_include_rules = {
diff --git a/content/network/OWNERS b/content/network/OWNERS
index e157eda..28361a0 100644
--- a/content/network/OWNERS
+++ b/content/network/OWNERS
@@ -1,13 +1 @@
-ananta@chromium.org
-jam@chromium.org
-kinuko@chromium.org
-mmenke@chromium.org
-rdsmith@chromium.org
-scottmg@chromium.org
-tsepez@chromium.org
-xunjieli@chromium.org
-yhirano@chromium.org
-yzshen@chromium.org
-
-per-file manifest.json=set noparent
-per-file manifest.json=file://ipc/SECURITY_OWNERS
+file://services/network/OWNERS
diff --git a/content/network/README.md b/content/network/README.md
deleted file mode 100644
index cffabdd..0000000
--- a/content/network/README.md
+++ /dev/null
@@ -1 +0,0 @@
-content/network is a temporary location for the Network Service. While it will eventually end up in services/network, we can't move it now until content/common/url_loader.mojom can move. That is blocked on removing the old non-mojom IPC loading path (see LoadingWithMojo feature flag). Once that happens, the mojom can be self contained and we can move it and this code.
\ No newline at end of file
diff --git a/content/network/cors/cors_url_loader_factory.cc b/content/network/cors/cors_url_loader_factory.cc
index 37f20d8..2fefc68 100644
--- a/content/network/cors/cors_url_loader_factory.cc
+++ b/content/network/cors/cors_url_loader_factory.cc
@@ -5,7 +5,7 @@
 #include "content/network/cors/cors_url_loader_factory.h"
 
 #include "content/network/cors/cors_url_loader.h"
-#include "content/public/common/content_features.h"
+#include "services/network/public/cpp/features.h"
 
 namespace content {
 
@@ -23,7 +23,7 @@
     const network::ResourceRequest& resource_request,
     network::mojom::URLLoaderClientPtr client,
     const net::MutableNetworkTrafficAnnotationTag& traffic_annotation) {
-  if (base::FeatureList::IsEnabled(features::kOutOfBlinkCORS)) {
+  if (base::FeatureList::IsEnabled(network::features::kOutOfBlinkCORS)) {
     loader_bindings_.AddBinding(
         std::make_unique<CORSURLLoader>(routing_id, request_id, options,
                                         resource_request, std::move(client),
diff --git a/content/network/cors/cors_url_loader_unittest.cc b/content/network/cors/cors_url_loader_unittest.cc
index f8477b5..42b4eaa5 100644
--- a/content/network/cors/cors_url_loader_unittest.cc
+++ b/content/network/cors/cors_url_loader_unittest.cc
@@ -11,14 +11,14 @@
 #include "base/run_loop.h"
 #include "base/test/scoped_feature_list.h"
 #include "content/network/cors/cors_url_loader_factory.h"
-#include "content/public/common/content_features.h"
 #include "content/public/common/request_context_type.h"
 #include "content/public/common/resource_type.h"
-#include "content/public/test/test_url_loader_client.h"
 #include "net/http/http_request_headers.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/interfaces/url_loader.mojom.h"
 #include "services/network/public/interfaces/url_loader_factory.mojom.h"
+#include "services/network/test/test_url_loader_client.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 using network::mojom::FetchRequestMode;
@@ -93,7 +93,7 @@
  protected:
   // testing::Test implementation.
   void SetUp() override {
-    feature_list_.InitAndEnableFeature(features::kOutOfBlinkCORS);
+    feature_list_.InitAndEnableFeature(network::features::kOutOfBlinkCORS);
   }
 
   void CreateLoaderAndStart(const GURL& origin,
@@ -130,7 +130,9 @@
     test_url_loader_factory_->NotifyClientOnComplete(error_code);
   }
 
-  const TestURLLoaderClient& client() const { return test_cors_loader_client_; }
+  const network::TestURLLoaderClient& client() const {
+    return test_cors_loader_client_;
+  }
 
   void RunUntilComplete() { test_cors_loader_client_.RunUntilComplete(); }
 
@@ -150,8 +152,8 @@
   // Holds URLLoaderPtr that CreateLoaderAndStart() creates.
   network::mojom::URLLoaderPtr url_loader_;
 
-  // TestURLLoaderClient that records callback activities.
-  TestURLLoaderClient test_cors_loader_client_;
+  // network::TestURLLoaderClient that records callback activities.
+  network::TestURLLoaderClient test_cors_loader_client_;
 
   DISALLOW_COPY_AND_ASSIGN(CORSURLLoaderTest);
 };
diff --git a/content/network/network_sandbox_hook_linux.h b/content/network/network_sandbox_hook_linux.h
deleted file mode 100644
index a78f998e..0000000
--- a/content/network/network_sandbox_hook_linux.h
+++ /dev/null
@@ -1,16 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_NETWORK_NETWORK_SANDBOX_HOOK_LINUX_H_
-#define CONTENT_NETWORK_NETWORK_SANDBOX_HOOK_LINUX_H_
-
-#include "services/service_manager/sandbox/linux/sandbox_linux.h"
-
-namespace content {
-
-bool NetworkPreSandboxHook(service_manager::SandboxLinux::Options options);
-
-}  // namespace content
-
-#endif  // CONTENT_NETWORK_NETWORK_SANDBOX_HOOK_LINUX_H_
diff --git a/content/network/network_service_unittest.cc b/content/network/network_service_unittest.cc
index 652ae8f6..bcaa413 100644
--- a/content/network/network_service_unittest.cc
+++ b/content/network/network_service_unittest.cc
@@ -9,21 +9,23 @@
 #include "base/test/scoped_task_environment.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "build/build_config.h"
-#include "content/network/network_context.h"
-#include "content/network/network_service_impl.h"
 #include "content/public/common/service_names.mojom.h"
-#include "content/public/test/test_url_loader_client.h"
 #include "net/base/mock_network_change_notifier.h"
 #include "net/proxy_resolution/proxy_config.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "services/network/network_context.h"
+#include "services/network/network_service_impl.h"
 #include "services/network/public/interfaces/network_change_manager.mojom.h"
 #include "services/network/public/interfaces/network_service.mojom.h"
+#include "services/network/test/test_url_loader_client.h"
 #include "services/service_manager/public/cpp/service_context.h"
 #include "services/service_manager/public/cpp/service_test.h"
 #include "services/service_manager/public/interfaces/service_factory.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
+using network::NetworkService;
+
 namespace content {
 
 namespace {
@@ -42,7 +44,7 @@
   NetworkServiceTest()
       : scoped_task_environment_(
             base::test::ScopedTaskEnvironment::MainThreadType::IO),
-        service_(NetworkServiceImpl::CreateForTesting()) {}
+        service_(network::NetworkServiceImpl::CreateForTesting()) {}
   ~NetworkServiceTest() override {}
 
   NetworkService* service() const { return service_.get(); }
@@ -106,7 +108,7 @@
       service_manager::mojom::PIDReceiverPtr pid_receiver) override {
     if (name == mojom::kNetworkServiceName) {
       service_context_.reset(new service_manager::ServiceContext(
-          NetworkServiceImpl::CreateForTesting(), std::move(request)));
+          network::NetworkServiceImpl::CreateForTesting(), std::move(request)));
     }
   }
 
@@ -144,7 +146,7 @@
 
   void StartLoadingURL(const network::ResourceRequest& request,
                        uint32_t process_id) {
-    client_.reset(new TestURLLoaderClient());
+    client_.reset(new network::TestURLLoaderClient());
     network::mojom::URLLoaderFactoryPtr loader_factory;
     network_context_->CreateURLLoaderFactory(mojo::MakeRequest(&loader_factory),
                                              process_id);
@@ -156,7 +158,7 @@
   }
 
   net::EmbeddedTestServer* test_server() { return &test_server_; }
-  TestURLLoaderClient* client() { return client_.get(); }
+  network::TestURLLoaderClient* client() { return client_.get(); }
   network::mojom::URLLoader* loader() { return loader_.get(); }
   network::mojom::NetworkService* service() { return network_service_.get(); }
   network::mojom::NetworkContext* context() { return network_context_.get(); }
@@ -179,7 +181,7 @@
   }
 
   net::EmbeddedTestServer test_server_;
-  std::unique_ptr<TestURLLoaderClient> client_;
+  std::unique_ptr<network::TestURLLoaderClient> client_;
   network::mojom::NetworkServicePtr network_service_;
   network::mojom::NetworkContextPtr network_context_;
   network::mojom::URLLoaderPtr loader_;
@@ -374,7 +376,7 @@
   NetworkChangeTest()
       : scoped_task_environment_(
             base::test::ScopedTaskEnvironment::MainThreadType::IO) {
-    service_ = NetworkServiceImpl::CreateForTesting();
+    service_ = network::NetworkServiceImpl::CreateForTesting();
   }
 
   ~NetworkChangeTest() override {}
@@ -434,7 +436,8 @@
         service_manager::mojom::PIDReceiverPtr pid_receiver) override {
       if (name == mojom::kNetworkServiceName) {
         service_context_.reset(new service_manager::ServiceContext(
-            NetworkServiceImpl::CreateForTesting(), std::move(request)));
+            network::NetworkServiceImpl::CreateForTesting(),
+            std::move(request)));
         // Send a broadcast after NetworkService is actually created.
         // Otherwise, this NotifyObservers is a no-op.
         net::NetworkChangeNotifier::NotifyObserversOfNetworkChangeForTests(
diff --git a/content/network/network_service_url_loader_factory.h b/content/network/network_service_url_loader_factory.h
deleted file mode 100644
index f6c71660..0000000
--- a/content/network/network_service_url_loader_factory.h
+++ /dev/null
@@ -1,46 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_NETWORK_NETWORK_SERVICE_URL_LOADER_FACTORY_H_
-#define CONTENT_NETWORK_NETWORK_SERVICE_URL_LOADER_FACTORY_H_
-
-#include "base/macros.h"
-#include "net/traffic_annotation/network_traffic_annotation.h"
-#include "services/network/public/interfaces/url_loader_factory.mojom.h"
-
-namespace content {
-
-class NetworkContext;
-
-// This class is an implementation of network::mojom::URLLoaderFactory that
-// creates a network::mojom::URLLoader.
-class NetworkServiceURLLoaderFactory : public network::mojom::URLLoaderFactory {
- public:
-  // NOTE: |context| must outlive this instance.
-  NetworkServiceURLLoaderFactory(NetworkContext* context, uint32_t process_id);
-
-  ~NetworkServiceURLLoaderFactory() override;
-
-  // network::mojom::URLLoaderFactory implementation.
-  void CreateLoaderAndStart(network::mojom::URLLoaderRequest request,
-                            int32_t routing_id,
-                            int32_t request_id,
-                            uint32_t options,
-                            const network::ResourceRequest& url_request,
-                            network::mojom::URLLoaderClientPtr client,
-                            const net::MutableNetworkTrafficAnnotationTag&
-                                traffic_annotation) override;
-  void Clone(network::mojom::URLLoaderFactoryRequest request) override;
-
- private:
-  // Not owned.
-  NetworkContext* context_;
-  uint32_t process_id_;
-
-  DISALLOW_COPY_AND_ASSIGN(NetworkServiceURLLoaderFactory);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_NETWORK_NETWORK_SERVICE_URL_LOADER_FACTORY_H_
diff --git a/content/network/resource_scheduler.cc b/content/network/resource_scheduler.cc
index 46c6aa24..2601f407 100644
--- a/content/network/resource_scheduler.cc
+++ b/content/network/resource_scheduler.cc
@@ -21,7 +21,6 @@
 #include "base/strings/string_number_conversions.h"
 #include "base/supports_user_data.h"
 #include "base/trace_event/trace_event.h"
-#include "content/public/common/content_features.h"
 #include "net/base/host_port_pair.h"
 #include "net/base/load_flags.h"
 #include "net/base/request_priority.h"
@@ -29,6 +28,7 @@
 #include "net/nqe/network_quality_estimator.h"
 #include "net/url_request/url_request.h"
 #include "net/url_request/url_request_context.h"
+#include "services/network/public/cpp/features.h"
 #include "url/scheme_host_port.h"
 
 namespace content {
@@ -414,7 +414,7 @@
         resource_scheduler_(resource_scheduler),
         weak_ptr_factory_(this) {
     if (base::FeatureList::IsEnabled(
-            features::kRendererSideResourceScheduler)) {
+            network::features::kRendererSideResourceScheduler)) {
       // When kRendererSideResourceScheduler is enabled, "layout blocking"
       // concept is moved to the renderer side, so the shceduler works always
       // with the normal mode.
@@ -486,7 +486,7 @@
   void DeprecatedOnNavigate() {
     deprecated_has_html_body_ = false;
     if (base::FeatureList::IsEnabled(
-            features::kRendererSideResourceScheduler)) {
+            network::features::kRendererSideResourceScheduler)) {
       // When kRendererSideResourceScheduler is enabled, "layout blocking"
       // concept is moved to the renderer side, so the shceduler works always
       // with the normal mode.
diff --git a/content/network/url_loader_unittest.cc b/content/network/url_loader_unittest.cc
index 930871b7..6cbd1ea 100644
--- a/content/network/url_loader_unittest.cc
+++ b/content/network/url_loader_unittest.cc
@@ -20,11 +20,8 @@
 #include "base/threading/thread_task_runner_handle.h"
 #include "base/time/time.h"
 #include "build/build_config.h"
-#include "content/network/network_context.h"
-#include "content/network/url_loader.h"
 #include "content/public/common/content_paths.h"
 #include "content/public/test/controllable_http_response.h"
-#include "content/public/test/test_url_loader_client.h"
 #include "mojo/common/data_pipe_utils.h"
 #include "mojo/public/c/system/data_pipe.h"
 #include "mojo/public/cpp/system/wait.h"
@@ -44,12 +41,18 @@
 #include "net/url_request/url_request_job.h"
 #include "net/url_request/url_request_status.h"
 #include "net/url_request/url_request_test_job.h"
+#include "services/network/network_context.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/test/test_data_pipe_getter.h"
+#include "services/network/test/test_url_loader_client.h"
+#include "services/network/url_loader.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "ui/base/page_transition_types.h"
 #include "url/gurl.h"
 
+using network::NetworkContext;
+using network::URLLoader;
+
 namespace content {
 
 namespace {
@@ -182,7 +185,7 @@
   URLLoaderTest()
       : scoped_task_environment_(
             base::test::ScopedTaskEnvironment::MainThreadType::IO),
-        context_(NetworkContext::CreateForTesting()) {
+        context_(network::NetworkContext::CreateForTesting()) {
     net::URLRequestFailedJob::AddUrlHandler();
   }
   ~URLLoaderTest() override {
@@ -319,7 +322,7 @@
 
   net::EmbeddedTestServer* test_server() { return &test_server_; }
   NetworkContext* context() { return context_.get(); }
-  TestURLLoaderClient* client() { return &client_; }
+  network::TestURLLoaderClient* client() { return &client_; }
   void DestroyContext() { context_.reset(); }
 
   // Returns the path of the requested file in the test data directory.
@@ -457,7 +460,7 @@
   // made, since the test fixture is meant to be used only once.
   bool ran_ = false;
   net::test_server::HttpRequest sent_request_;
-  TestURLLoaderClient client_;
+  network::TestURLLoaderClient client_;
 };
 
 TEST_F(URLLoaderTest, Basic) {
diff --git a/content/public/android/BUILD.gn b/content/public/android/BUILD.gn
index ecdd1a9b9..4b6de92f 100644
--- a/content/public/android/BUILD.gn
+++ b/content/public/android/BUILD.gn
@@ -154,7 +154,7 @@
     "java/src/org/chromium/content/browser/accessibility/KitKatWebContentsAccessibility.java",
     "java/src/org/chromium/content/browser/accessibility/LollipopWebContentsAccessibility.java",
     "java/src/org/chromium/content/browser/accessibility/OWebContentsAccessibility.java",
-    "java/src/org/chromium/content/browser/accessibility/WebContentsAccessibility.java",
+    "java/src/org/chromium/content/browser/accessibility/WebContentsAccessibilityImpl.java",
     "java/src/org/chromium/content/browser/accessibility/captioning/CaptioningBridgeFactory.java",
     "java/src/org/chromium/content/browser/accessibility/captioning/CaptioningChangeDelegate.java",
     "java/src/org/chromium/content/browser/accessibility/captioning/CaptioningStyle.java",
@@ -254,6 +254,7 @@
     "java/src/org/chromium/content_public/browser/SelectionPopupController.java",
     "java/src/org/chromium/content_public/browser/SmartClipCallback.java",
     "java/src/org/chromium/content_public/browser/WebContents.java",
+    "java/src/org/chromium/content_public/browser/WebContentsAccessibility.java",
     "java/src/org/chromium/content_public/browser/WebContentsInternals.java",
     "java/src/org/chromium/content_public/browser/WebContentsObserver.java",
     "java/src/org/chromium/content_public/browser/WebContentsStatics.java",
@@ -374,7 +375,7 @@
     "java/src/org/chromium/content/browser/SyntheticGestureTarget.java",
     "java/src/org/chromium/content/browser/TapDisambiguator.java",
     "java/src/org/chromium/content/browser/TracingControllerAndroid.java",
-    "java/src/org/chromium/content/browser/accessibility/WebContentsAccessibility.java",
+    "java/src/org/chromium/content/browser/accessibility/WebContentsAccessibilityImpl.java",
     "java/src/org/chromium/content/browser/androidoverlay/AndroidOverlayProviderImpl.java",
     "java/src/org/chromium/content/browser/androidoverlay/DialogOverlayImpl.java",
     "java/src/org/chromium/content/browser/framehost/NavigationControllerImpl.java",
diff --git a/content/public/android/java/src/org/chromium/content/browser/ChildProcessCreationParams.java b/content/public/android/java/src/org/chromium/content/browser/ChildProcessCreationParams.java
index 99fb664d..4bb0215 100644
--- a/content/public/android/java/src/org/chromium/content/browser/ChildProcessCreationParams.java
+++ b/content/public/android/java/src/org/chromium/content/browser/ChildProcessCreationParams.java
@@ -32,7 +32,7 @@
     }
 
     // Members should all be immutable to avoid worrying about thread safety.
-    private final String mPackageNameForSandboxedService;
+    private final String mPackageNameForService;
     private final boolean mIsSandboxedServiceExternal;
     private final int mLibraryProcessType;
     private final boolean mBindToCallerCheck;
@@ -40,10 +40,10 @@
     // signals in content.
     private final boolean mIgnoreVisibilityForImportance;
 
-    public ChildProcessCreationParams(String packageNameForSandboxedService,
+    public ChildProcessCreationParams(String packageNameForService,
             boolean isExternalSandboxedService, int libraryProcessType, boolean bindToCallerCheck,
             boolean ignoreVisibilityForImportance) {
-        mPackageNameForSandboxedService = packageNameForSandboxedService;
+        mPackageNameForService = packageNameForService;
         mIsSandboxedServiceExternal = isExternalSandboxedService;
         mLibraryProcessType = libraryProcessType;
         mBindToCallerCheck = bindToCallerCheck;
@@ -54,9 +54,9 @@
         extras.putInt(EXTRA_LIBRARY_PROCESS_TYPE, mLibraryProcessType);
     }
 
-    public static String getPackageNameForSandboxedService() {
+    public static String getPackageNameForService() {
         ChildProcessCreationParams params = ChildProcessCreationParams.getDefault();
-        return params != null ? params.mPackageNameForSandboxedService
+        return params != null ? params.mPackageNameForService
                               : ContextUtils.getApplicationContext().getPackageName();
     }
 
diff --git a/content/public/android/java/src/org/chromium/content/browser/ChildProcessLauncherHelper.java b/content/public/android/java/src/org/chromium/content/browser/ChildProcessLauncherHelper.java
index 2f809b6df..819ce39 100644
--- a/content/public/android/java/src/org/chromium/content/browser/ChildProcessLauncherHelper.java
+++ b/content/public/android/java/src/org/chromium/content/browser/ChildProcessLauncherHelper.java
@@ -233,11 +233,6 @@
         sSpareSandboxedConnection = new SpareChildConnection(context, allocator, serviceBundle);
     }
 
-    public static String getPackageNameForService(boolean sandboxed) {
-        return sandboxed ? ChildProcessCreationParams.getPackageNameForSandboxedService()
-                         : ContextUtils.getApplicationContext().getPackageName();
-    }
-
     /**
      * Starts the moderate binding management that adjust a process priority in response to various
      * signals (app sent to background/foreground for example).
@@ -314,7 +309,7 @@
     @VisibleForTesting
     static ChildConnectionAllocator getConnectionAllocator(Context context, boolean sandboxed) {
         assert LauncherThread.runningOnLauncherThread();
-        final String packageName = getPackageNameForService(sandboxed);
+        final String packageName = ChildProcessCreationParams.getPackageNameForService();
         boolean bindToCaller = ChildProcessCreationParams.getBindToCallerCheck();
         boolean bindAsExternalService =
                 sandboxed && ChildProcessCreationParams.getIsSandboxedServiceExternal();
@@ -484,7 +479,7 @@
         }
 
         final Context context = ContextUtils.getApplicationContext();
-        final String packageName = ChildProcessCreationParams.getPackageNameForSandboxedService();
+        final String packageName = ChildProcessCreationParams.getPackageNameForService();
         try {
             return ChildConnectionAllocator.getNumberOfServices(
                     context, packageName, NUM_SANDBOXED_SERVICES_KEY);
diff --git a/content/public/android/java/src/org/chromium/content/browser/ContentView.java b/content/public/android/java/src/org/chromium/content/browser/ContentView.java
index 8322324..43eafc5 100644
--- a/content/public/android/java/src/org/chromium/content/browser/ContentView.java
+++ b/content/public/android/java/src/org/chromium/content/browser/ContentView.java
@@ -25,6 +25,7 @@
 import org.chromium.base.TraceEvent;
 import org.chromium.content.browser.webcontents.WebContentsImpl;
 import org.chromium.content_public.browser.ImeAdapter;
+import org.chromium.content_public.browser.WebContentsAccessibility;
 import org.chromium.ui.base.EventForwarder;
 
 /**
@@ -84,13 +85,15 @@
         mContentViewCore = cvc;
     }
 
+    protected WebContentsAccessibility getWebContentsAccessibility() {
+        return WebContentsAccessibility.fromWebContents(mContentViewCore.getWebContents());
+    }
+
     @Override
     public boolean performAccessibilityAction(int action, Bundle arguments) {
-        if (mContentViewCore.supportsAccessibilityAction(action)) {
-            return mContentViewCore.performAccessibilityAction(action, arguments);
-        }
-
-        return super.performAccessibilityAction(action, arguments);
+        WebContentsAccessibility wcax = getWebContentsAccessibility();
+        return wcax.supportsAction(action) ? wcax.performAction(action, arguments)
+                                           : super.performAccessibilityAction(action, arguments);
     }
 
     /**
@@ -116,12 +119,9 @@
 
     @Override
     public AccessibilityNodeProvider getAccessibilityNodeProvider() {
-        AccessibilityNodeProvider provider = mContentViewCore.getAccessibilityNodeProvider();
-        if (provider != null) {
-            return provider;
-        } else {
-            return super.getAccessibilityNodeProvider();
-        }
+        AccessibilityNodeProvider provider =
+                getWebContentsAccessibility().getAccessibilityNodeProvider();
+        return (provider != null) ? provider : super.getAccessibilityNodeProvider();
     }
 
     // Needed by ContentViewCore.InternalAccessDelegate
@@ -192,7 +192,7 @@
     @Override
     public boolean onHoverEvent(MotionEvent event) {
         boolean consumed = getEventForwarder().onHoverEvent(event);
-        if (!mContentViewCore.isTouchExplorationEnabled()) super.onHoverEvent(event);
+        if (!getWebContentsAccessibility().isTouchExplorationEnabled()) super.onHoverEvent(event);
         return consumed;
     }
 
@@ -341,7 +341,7 @@
 
         @Override
         public void onProvideVirtualStructure(final ViewStructure structure) {
-            mContentViewCore.onProvideVirtualStructure(structure, false);
+            getWebContentsAccessibility().onProvideVirtualStructure(structure, false);
         }
     }
 }
diff --git a/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java b/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
index a42c230..75cb551 100644
--- a/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
+++ b/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
@@ -4,20 +4,14 @@
 
 package org.chromium.content.browser;
 
-import android.annotation.TargetApi;
 import android.content.Context;
 import android.content.res.Configuration;
-import android.os.Build;
-import android.os.Bundle;
 import android.view.KeyEvent;
 import android.view.MotionEvent;
 import android.view.View;
 import android.view.ViewGroup;
-import android.view.ViewStructure;
-import android.view.accessibility.AccessibilityNodeProvider;
 
 import org.chromium.base.VisibleForTesting;
-import org.chromium.content.browser.accessibility.WebContentsAccessibility;
 import org.chromium.content.browser.input.SelectPopup;
 import org.chromium.content.browser.input.TextSuggestionHost;
 import org.chromium.content_public.browser.WebContents;
@@ -364,73 +358,6 @@
     void preserveSelectionOnNextLossOfFocus();
 
     /**
-     * Determines whether or not this ContentViewCore can handle this accessibility action.
-     * @param action The action to perform.
-     * @return Whether or not this action is supported.
-     */
-    boolean supportsAccessibilityAction(int action);
-
-    /**
-     * Attempts to perform an accessibility action on the web content.  If the accessibility action
-     * cannot be processed, it returns {@code null}, allowing the caller to know to call the
-     * super {@link View#performAccessibilityAction(int, Bundle)} method and use that return value.
-     * Otherwise the return value from this method should be used.
-     * @param action The action to perform.
-     * @param arguments Optional action arguments.
-     * @return Whether the action was performed or {@code null} if the call should be delegated to
-     *         the super {@link View} class.
-     */
-    boolean performAccessibilityAction(int action, Bundle arguments);
-
-    /**
-     * Get the WebContentsAccessibility, used for native accessibility
-     * (not script injection). This will return null when system accessibility
-     * is not enabled.
-     * @return This view's WebContentsAccessibility.
-     */
-    WebContentsAccessibility getWebContentsAccessibility();
-
-    /**
-     * If native accessibility is enabled and no other views are temporarily
-     * obscuring this one, returns an AccessibilityNodeProvider that
-     * implements native accessibility for this view. Returns null otherwise.
-     * Lazily initializes native accessibility here if it's allowed.
-     * @return The AccessibilityNodeProvider, if available, or null otherwise.
-     */
-    AccessibilityNodeProvider getAccessibilityNodeProvider();
-
-    @TargetApi(Build.VERSION_CODES.M)
-    void onProvideVirtualStructure(ViewStructure structure, boolean ignoreScrollOffset);
-
-    /**
-     * Set whether or not the web contents are obscured by another view.
-     * If true, we won't return an accessibility node provider or respond
-     * to touch exploration events.
-     */
-    void setObscuredByAnotherView(boolean isObscured);
-
-    /**
-     * Returns true if accessibility is on and touch exploration is enabled.
-     */
-    boolean isTouchExplorationEnabled();
-
-    /**
-     * Turns browser accessibility on or off.
-     * If |state| is |false|, this turns off both native and injected accessibility.
-     * Otherwise, if accessibility script injection is enabled, this will enable the injected
-     * accessibility scripts. Native accessibility is enabled on demand.
-     */
-    void setAccessibilityState(boolean state);
-
-    /**
-     * Sets whether or not we should set accessibility focus on page load.
-     * This only applies if an accessibility service like TalkBack is running.
-     * This is desirable behavior for a browser window, but not for an embedded
-     * WebView.
-     */
-    void setShouldSetAccessibilityFocusOnPageLoad(boolean on);
-
-    /**
      * @return Whether the current page seems to be mobile-optimized. This hint is based upon
      *         rendered frames and may return different values when called multiple times for the
      *         same page (particularly during page load).
diff --git a/content/public/android/java/src/org/chromium/content/browser/ContentViewCoreImpl.java b/content/public/android/java/src/org/chromium/content/browser/ContentViewCoreImpl.java
index 6ef5eda4..b090d20 100644
--- a/content/public/android/java/src/org/chromium/content/browser/ContentViewCoreImpl.java
+++ b/content/public/android/java/src/org/chromium/content/browser/ContentViewCoreImpl.java
@@ -9,7 +9,6 @@
 import android.content.Context;
 import android.content.res.Configuration;
 import android.os.Build;
-import android.os.Bundle;
 import android.os.SystemClock;
 import android.view.HapticFeedbackConstants;
 import android.view.InputDevice;
@@ -18,8 +17,6 @@
 import android.view.Surface;
 import android.view.View;
 import android.view.ViewGroup;
-import android.view.ViewStructure;
-import android.view.accessibility.AccessibilityNodeProvider;
 
 import org.chromium.base.ObserverList;
 import org.chromium.base.TraceEvent;
@@ -27,7 +24,7 @@
 import org.chromium.base.annotations.CalledByNative;
 import org.chromium.base.annotations.JNINamespace;
 import org.chromium.content.browser.ContentViewCore.InternalAccessDelegate;
-import org.chromium.content.browser.accessibility.WebContentsAccessibility;
+import org.chromium.content.browser.accessibility.WebContentsAccessibilityImpl;
 import org.chromium.content.browser.accessibility.captioning.CaptioningBridgeFactory;
 import org.chromium.content.browser.accessibility.captioning.SystemCaptioningBridge;
 import org.chromium.content.browser.accessibility.captioning.TextTrackSettings;
@@ -40,7 +37,6 @@
 import org.chromium.content.browser.input.TextSuggestionHost;
 import org.chromium.content.browser.selection.SelectionPopupControllerImpl;
 import org.chromium.content.browser.webcontents.WebContentsImpl;
-import org.chromium.content_public.browser.AccessibilitySnapshotNode;
 import org.chromium.content_public.browser.ActionModeCallbackHelper;
 import org.chromium.content_public.browser.GestureStateListener;
 import org.chromium.content_public.browser.ImeEventObserver;
@@ -174,9 +170,6 @@
 
     private boolean mPreserveSelectionOnNextLossOfFocus;
 
-    // Handles native accessibility, i.e. without any script injection.
-    private WebContentsAccessibility mWebContentsAccessibility;
-
     // Notifies the ContentViewCore when platform closed caption settings have changed
     // if they are supported. Otherwise does nothing.
     private final SystemCaptioningBridge mSystemCaptioningBridge;
@@ -320,7 +313,7 @@
         setContainerView(containerView);
         mRenderCoordinates = mWebContents.getRenderCoordinates();
         mRenderCoordinates.setDeviceScaleFactor(dipScale, windowAndroid.getContext().get());
-        mWebContentsAccessibility = WebContentsAccessibility.create(
+        WebContentsAccessibilityImpl wcax = WebContentsAccessibilityImpl.create(
                 mContext, containerView, webContents, mProductVersion);
         setContainerViewInternals(internalDispatcher);
 
@@ -343,7 +336,7 @@
         mWindowEventObservers.addObserver(getGestureListenerManager());
         mWindowEventObservers.addObserver(mTextSuggestionHost);
         mWindowEventObservers.addObserver(imeAdapter);
-        mWindowEventObservers.addObserver(mWebContentsAccessibility);
+        mWindowEventObservers.addObserver(wcax);
     }
 
     @Override
@@ -419,6 +412,10 @@
         return TapDisambiguator.fromWebContents(mWebContents);
     }
 
+    private WebContentsAccessibilityImpl getWebContentsAccessibility() {
+        return WebContentsAccessibilityImpl.fromWebContents(mWebContents);
+    }
+
     @CalledByNative
     private void onNativeContentViewCoreDestroyed(long nativeContentViewCore) {
         assert nativeContentViewCore == mNativeContentViewCore;
@@ -445,9 +442,6 @@
         mWebContents = null;
         mNativeContentViewCore = 0;
 
-        // mWebContentsAccessibility needs not nulling since CVC referencing it is going away.
-        mWebContentsAccessibility.destroy();
-
         // See warning in javadoc before adding more clean up code here.
     }
 
@@ -545,7 +539,7 @@
     public void onShow() {
         assert mWebContents != null;
         mWebContents.onShow();
-        mWebContentsAccessibility.refreshState();
+        getWebContentsAccessibility().refreshState();
         restoreSelectionPopupsIfNecessary();
     }
 
@@ -1019,7 +1013,7 @@
             popupItems.add(new SelectPopupItem(items[i], enabled[i]));
         }
         if (DeviceFormFactor.isTablet() && !multiple
-                && !mWebContentsAccessibility.isTouchExplorationEnabled()) {
+                && !getWebContentsAccessibility().isTouchExplorationEnabled()) {
             mSelectPopup = new SelectPopupDropdown(
                     this, anchorView, popupItems, selectedIndices, rightAligned);
         } else {
@@ -1072,45 +1066,6 @@
         mSystemCaptioningBridge.syncToListener(this);
     }
 
-    @Override
-    public boolean supportsAccessibilityAction(int action) {
-        return mWebContentsAccessibility.supportsAction(action);
-    }
-
-    @Override
-    public boolean performAccessibilityAction(int action, Bundle arguments) {
-        return mWebContentsAccessibility.performAction(action, arguments);
-    }
-
-    @Override
-    public WebContentsAccessibility getWebContentsAccessibility() {
-        return mWebContentsAccessibility;
-    }
-
-    @Override
-    public AccessibilityNodeProvider getAccessibilityNodeProvider() {
-        return mWebContentsAccessibility.getAccessibilityNodeProvider();
-    }
-
-    @Override
-    public void setObscuredByAnotherView(boolean isObscured) {
-        mWebContentsAccessibility.setObscuredByAnotherView(isObscured);
-    }
-
-    @TargetApi(Build.VERSION_CODES.M)
-    @Override
-    public void onProvideVirtualStructure(
-            final ViewStructure structure, final boolean ignoreScrollOffset) {
-        mWebContentsAccessibility.onProvideVirtualStructure(structure, ignoreScrollOffset);
-    }
-
-    // When creating the View structure, the left and top are relative to the parent node.
-    @TargetApi(Build.VERSION_CODES.M)
-    private void createVirtualStructure(ViewStructure viewNode, AccessibilitySnapshotNode node,
-            final boolean ignoreScrollOffset) {
-        mWebContentsAccessibility.createVirtualStructure(viewNode, node, ignoreScrollOffset);
-    }
-
     @TargetApi(Build.VERSION_CODES.LOLLIPOP)
     private void requestUnbufferedDispatch(MotionEvent touchDownEvent) {
         mContainerView.requestUnbufferedDispatch(touchDownEvent);
@@ -1128,21 +1083,6 @@
     }
 
     @Override
-    public boolean isTouchExplorationEnabled() {
-        return mWebContentsAccessibility.isTouchExplorationEnabled();
-    }
-
-    @Override
-    public void setAccessibilityState(boolean state) {
-        mWebContentsAccessibility.setState(state);
-    }
-
-    @Override
-    public void setShouldSetAccessibilityFocusOnPageLoad(boolean on) {
-        mWebContentsAccessibility.setShouldFocusOnPageLoad(on);
-    }
-
-    @Override
     public boolean getIsMobileOptimizedHint() {
         return mIsMobileOptimizedHint;
     }
diff --git a/content/public/android/java/src/org/chromium/content/browser/accessibility/KitKatWebContentsAccessibility.java b/content/public/android/java/src/org/chromium/content/browser/accessibility/KitKatWebContentsAccessibility.java
index 81140ec..b1a34467 100644
--- a/content/public/android/java/src/org/chromium/content/browser/accessibility/KitKatWebContentsAccessibility.java
+++ b/content/public/android/java/src/org/chromium/content/browser/accessibility/KitKatWebContentsAccessibility.java
@@ -6,10 +6,8 @@
 
 import android.accessibilityservice.AccessibilityServiceInfo;
 import android.annotation.TargetApi;
-import android.content.Context;
 import android.os.Build;
 import android.os.Bundle;
-import android.view.ViewGroup;
 import android.view.accessibility.AccessibilityNodeInfo;
 
 import org.chromium.base.annotations.JNINamespace;
@@ -20,12 +18,11 @@
  */
 @JNINamespace("content")
 @TargetApi(Build.VERSION_CODES.KITKAT)
-public class KitKatWebContentsAccessibility extends WebContentsAccessibility {
+public class KitKatWebContentsAccessibility extends WebContentsAccessibilityImpl {
     private String mSupportedHtmlElementTypes;
 
-    KitKatWebContentsAccessibility(Context context, ViewGroup containerView,
-            WebContents webContents, String productVersion) {
-        super(context, containerView, webContents, productVersion);
+    KitKatWebContentsAccessibility(WebContents webContents) {
+        super(webContents);
     }
 
     @Override
diff --git a/content/public/android/java/src/org/chromium/content/browser/accessibility/LollipopWebContentsAccessibility.java b/content/public/android/java/src/org/chromium/content/browser/accessibility/LollipopWebContentsAccessibility.java
index ab6a90e..d97f244 100644
--- a/content/public/android/java/src/org/chromium/content/browser/accessibility/LollipopWebContentsAccessibility.java
+++ b/content/public/android/java/src/org/chromium/content/browser/accessibility/LollipopWebContentsAccessibility.java
@@ -14,7 +14,6 @@
 import android.text.SpannableString;
 import android.text.style.LocaleSpan;
 import android.util.SparseArray;
-import android.view.ViewGroup;
 import android.view.accessibility.AccessibilityEvent;
 import android.view.accessibility.AccessibilityNodeInfo;
 import android.view.accessibility.AccessibilityNodeInfo.AccessibilityAction;
@@ -35,9 +34,8 @@
     private String mSystemLanguageTag;
     private BroadcastReceiver mBroadcastReceiver;
 
-    LollipopWebContentsAccessibility(Context context, ViewGroup containerView,
-            WebContents webContents, String productVersion) {
-        super(context, containerView, webContents, productVersion);
+    LollipopWebContentsAccessibility(WebContents webContents) {
+        super(webContents);
     }
 
     @Override
diff --git a/content/public/android/java/src/org/chromium/content/browser/accessibility/OWebContentsAccessibility.java b/content/public/android/java/src/org/chromium/content/browser/accessibility/OWebContentsAccessibility.java
index 2cde28b..50cf2d7 100644
--- a/content/public/android/java/src/org/chromium/content/browser/accessibility/OWebContentsAccessibility.java
+++ b/content/public/android/java/src/org/chromium/content/browser/accessibility/OWebContentsAccessibility.java
@@ -9,12 +9,10 @@
 import static android.view.accessibility.AccessibilityNodeInfo.EXTRA_DATA_TEXT_CHARACTER_LOCATION_KEY;
 
 import android.annotation.TargetApi;
-import android.content.Context;
 import android.graphics.Rect;
 import android.graphics.RectF;
 import android.os.Build;
 import android.os.Bundle;
-import android.view.ViewGroup;
 import android.view.accessibility.AccessibilityNodeInfo;
 
 import org.chromium.base.annotations.JNINamespace;
@@ -28,9 +26,8 @@
 @JNINamespace("content")
 @TargetApi(Build.VERSION_CODES.O)
 public class OWebContentsAccessibility extends LollipopWebContentsAccessibility {
-    OWebContentsAccessibility(Context context, ViewGroup containerView, WebContents webContents,
-            String productVersion) {
-        super(context, containerView, webContents, productVersion);
+    OWebContentsAccessibility(WebContents webContents) {
+        super(webContents);
     }
 
     @Override
diff --git a/content/public/android/java/src/org/chromium/content/browser/accessibility/WebContentsAccessibility.java b/content/public/android/java/src/org/chromium/content/browser/accessibility/WebContentsAccessibilityImpl.java
similarity index 94%
rename from content/public/android/java/src/org/chromium/content/browser/accessibility/WebContentsAccessibility.java
rename to content/public/android/java/src/org/chromium/content/browser/accessibility/WebContentsAccessibilityImpl.java
index 86db1706..4062acf 100644
--- a/content/public/android/java/src/org/chromium/content/browser/accessibility/WebContentsAccessibility.java
+++ b/content/public/android/java/src/org/chromium/content/browser/accessibility/WebContentsAccessibilityImpl.java
@@ -27,27 +27,32 @@
 import android.view.accessibility.AccessibilityNodeInfo;
 import android.view.accessibility.AccessibilityNodeProvider;
 
+import org.chromium.base.VisibleForTesting;
 import org.chromium.base.annotations.CalledByNative;
 import org.chromium.base.annotations.JNINamespace;
 import org.chromium.content.browser.RenderCoordinates;
 import org.chromium.content.browser.WindowEventObserver;
 import org.chromium.content.browser.webcontents.WebContentsImpl;
+import org.chromium.content.browser.webcontents.WebContentsUserData;
+import org.chromium.content.browser.webcontents.WebContentsUserData.UserDataFactory;
 import org.chromium.content_public.browser.AccessibilitySnapshotCallback;
 import org.chromium.content_public.browser.AccessibilitySnapshotNode;
 import org.chromium.content_public.browser.WebContents;
+import org.chromium.content_public.browser.WebContentsAccessibility;
 
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Locale;
 
 /**
+ * Implementation of {@link WebContentsAccessibility} interface.
  * Native accessibility for a {@link WebContents}. Actual native instance is
  * created lazily upon the first request from Android framework on
  *{@link AccessibilityNodeProvider}, and shares the lifetime with {@link WebContents}.
  */
 @JNINamespace("content")
-public class WebContentsAccessibility extends AccessibilityNodeProvider
-        implements AccessibilityStateChangeListener, WindowEventObserver {
+public class WebContentsAccessibilityImpl extends AccessibilityNodeProvider
+        implements AccessibilityStateChangeListener, WebContentsAccessibility, WindowEventObserver {
     // Constants from AccessibilityNodeInfo defined in the K SDK.
     private static final int ACTION_COLLAPSE = 0x00080000;
     private static final int ACTION_EXPAND = 0x00040000;
@@ -72,17 +77,17 @@
     // Constant for no granularity selected.
     private static final int NO_GRANULARITY_SELECTED = 0;
 
-    protected final AccessibilityManager mAccessibilityManager;
-    protected final Context mContext;
-    private final String mProductVersion;
-    private WebContentsImpl mWebContents;
+    private final WebContentsImpl mWebContents;
+    protected AccessibilityManager mAccessibilityManager;
+    protected Context mContext;
+    private String mProductVersion;
     protected long mNativeObj;
     private Rect mAccessibilityFocusRect;
     private boolean mIsHovering;
     private int mLastHoverId = View.NO_ID;
     protected int mCurrentRootId;
-    private final int[] mTempLocation = new int[2];
-    protected final ViewGroup mView;
+    private int[] mTempLocation = new int[2];
+    protected ViewGroup mView;
     private boolean mUserHasTouchExplored;
     private boolean mPendingScrollToMakeNodeVisible;
     private boolean mNotifyFrameInfoInitializedCalled;
@@ -110,37 +115,62 @@
     // Accessibility touch exploration state.
     private boolean mTouchExplorationEnabled;
 
+    private boolean mInitialized;
+
     /**
-     * Create a WebContentsAccessibility object.
+     * Create a WebContentsAccessibilityImpl object.
      */
-    public static WebContentsAccessibility create(Context context, ViewGroup containerView,
-            WebContents webContents, String productVersion) {
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
-            return new OWebContentsAccessibility(
-                    context, containerView, webContents, productVersion);
-        } else if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
-            return new LollipopWebContentsAccessibility(
-                    context, containerView, webContents, productVersion);
-        } else if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.KITKAT) {
-            return new KitKatWebContentsAccessibility(
-                    context, containerView, webContents, productVersion);
-        } else {
-            return new WebContentsAccessibility(
-                    context, containerView, webContents, productVersion);
+    private static class Factory implements UserDataFactory<WebContentsAccessibilityImpl> {
+        @Override
+        public WebContentsAccessibilityImpl create(WebContents webContents) {
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+                return new OWebContentsAccessibility(webContents);
+            } else if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
+                return new LollipopWebContentsAccessibility(webContents);
+            } else if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.KITKAT) {
+                return new KitKatWebContentsAccessibility(webContents);
+            } else {
+                return new WebContentsAccessibilityImpl(webContents);
+            }
         }
     }
 
-    protected WebContentsAccessibility(Context context, ViewGroup containerView,
+    private static final class UserDataFactoryLazyHolder {
+        private static final UserDataFactory<WebContentsAccessibilityImpl> INSTANCE = new Factory();
+    }
+
+    public static WebContentsAccessibilityImpl create(Context context, ViewGroup containerView,
             WebContents webContents, String productVersion) {
-        mContext = context;
+        WebContentsAccessibilityImpl wcax = WebContentsUserData.fromWebContents(webContents,
+                WebContentsAccessibilityImpl.class, UserDataFactoryLazyHolder.INSTANCE);
+        assert wcax != null && !wcax.initialized();
+        wcax.init(context, containerView, productVersion);
+        return wcax;
+    }
+
+    public static WebContentsAccessibilityImpl fromWebContents(WebContents webContents) {
+        return WebContentsUserData.fromWebContents(
+                webContents, WebContentsAccessibilityImpl.class, null);
+    }
+
+    protected WebContentsAccessibilityImpl(WebContents webContents) {
         mWebContents = (WebContentsImpl) webContents;
+    }
+
+    private void init(Context context, ViewGroup containerView, String productVersion) {
+        mContext = context;
         mView = containerView;
         mProductVersion = productVersion;
         mAccessibilityManager =
                 (AccessibilityManager) mContext.getSystemService(Context.ACCESSIBILITY_SERVICE);
+        mInitialized = true;
         // Native is initialized lazily, when node provider is actually requested.
     }
 
+    private boolean initialized() {
+        return mInitialized;
+    }
+
     /**
      * Called after the native a11y part is initialized. Overridable by subclasses
      * to do initialization that is not required until the native is set up.
@@ -168,18 +198,39 @@
     /**
      * Pretend that accessibility is enabled, for testing.
      */
+    @VisibleForTesting
     static void setAccessibilityEnabledForTesting() {
         sAccessibilityEnabledForTesting = true;
     }
 
+    // WindowEventObserver
+
+    @Override
+    public void onDetachedFromWindow() {
+        mAccessibilityManager.removeAccessibilityStateChangeListener(this);
+    }
+
+    @Override
+    public void onAttachedToWindow() {
+        mAccessibilityManager.addAccessibilityStateChangeListener(this);
+        refreshState();
+    }
+
     /**
-     * @return An AccessibilityNodeProvider.
+     * Refresh a11y state with that of {@link AccessibilityManager}.
      */
+    public void refreshState() {
+        setState(mAccessibilityManager.isEnabled());
+    }
+
+    // AccessibilityNodeProvider
+
+    @Override
     public AccessibilityNodeProvider getAccessibilityNodeProvider() {
         if (mIsObscuredByAnotherView) return null;
 
         if (!isNativeInitialized()) {
-            if (!mNativeAccessibilityAllowed || mWebContents == null) return null;
+            if (!mNativeAccessibilityAllowed) return null;
             mNativeObj = nativeInit(mWebContents);
             onNativeInit();
         }
@@ -234,6 +285,125 @@
         return false;
     }
 
+    // AccessibilityStateChangeListener
+
+    @Override
+    public void onAccessibilityStateChanged(boolean enabled) {
+        setState(enabled);
+    }
+
+    // WebContentsAccessibility
+
+    @Override
+    public void setObscuredByAnotherView(boolean isObscured) {
+        if (isObscured != mIsObscuredByAnotherView) {
+            mIsObscuredByAnotherView = isObscured;
+            mView.sendAccessibilityEvent(AccessibilityEvent.TYPE_WINDOW_CONTENT_CHANGED);
+        }
+    }
+
+    @Override
+    public boolean isTouchExplorationEnabled() {
+        return mTouchExplorationEnabled;
+    }
+
+    @Override
+    public void setState(boolean state) {
+        if (!state) {
+            mNativeAccessibilityAllowed = false;
+            mTouchExplorationEnabled = false;
+        } else {
+            mNativeAccessibilityAllowed = true;
+            mTouchExplorationEnabled = mAccessibilityManager.isTouchExplorationEnabled();
+        }
+    }
+
+    @Override
+    public void setShouldFocusOnPageLoad(boolean on) {
+        mShouldFocusOnPageLoad = on;
+    }
+
+    @Override
+    public boolean supportsAction(int action) {
+        // TODO(dmazzoni): implement this.
+        return false;
+    }
+
+    @Override
+    public boolean performAction(int action, Bundle arguments) {
+        // TODO(dmazzoni): implement this.
+        return false;
+    }
+
+    @TargetApi(Build.VERSION_CODES.M)
+    @Override
+    public void onProvideVirtualStructure(
+            final ViewStructure structure, final boolean ignoreScrollOffset) {
+        // Do not collect accessibility tree in incognito mode
+        if (mWebContents.isIncognito()) {
+            structure.setChildCount(0);
+            return;
+        }
+        structure.setChildCount(1);
+        final ViewStructure viewRoot = structure.asyncNewChild(0);
+        mWebContents.requestAccessibilitySnapshot(new AccessibilitySnapshotCallback() {
+            @Override
+            public void onAccessibilitySnapshot(AccessibilitySnapshotNode root) {
+                viewRoot.setClassName("");
+                viewRoot.setHint(mProductVersion);
+                if (root == null) {
+                    viewRoot.asyncCommit();
+                    return;
+                }
+                createVirtualStructure(viewRoot, root, ignoreScrollOffset);
+            }
+        });
+    }
+
+    // When creating the View structure, the left and top are relative to the parent node.
+    @TargetApi(Build.VERSION_CODES.M)
+    private void createVirtualStructure(ViewStructure viewNode, AccessibilitySnapshotNode node,
+            final boolean ignoreScrollOffset) {
+        viewNode.setClassName(node.className);
+        if (node.hasSelection) {
+            viewNode.setText(node.text, node.startSelection, node.endSelection);
+        } else {
+            viewNode.setText(node.text);
+        }
+        RenderCoordinates renderCoordinates = mWebContents.getRenderCoordinates();
+        int left = (int) renderCoordinates.fromLocalCssToPix(node.x);
+        int top = (int) renderCoordinates.fromLocalCssToPix(node.y);
+        int width = (int) renderCoordinates.fromLocalCssToPix(node.width);
+        int height = (int) renderCoordinates.fromLocalCssToPix(node.height);
+
+        Rect boundsInParent = new Rect(left, top, left + width, top + height);
+        if (node.isRootNode) {
+            // Offset of the web content relative to the View.
+            boundsInParent.offset(0, (int) renderCoordinates.getContentOffsetYPix());
+            if (!ignoreScrollOffset) {
+                boundsInParent.offset(-(int) renderCoordinates.getScrollXPix(),
+                        -(int) renderCoordinates.getScrollYPix());
+            }
+        }
+
+        viewNode.setDimens(boundsInParent.left, boundsInParent.top, 0, 0, width, height);
+        viewNode.setChildCount(node.children.size());
+        if (node.hasStyle) {
+            // The text size should be in physical pixels, not CSS pixels.
+            float textSize = renderCoordinates.fromLocalCssToPix(node.textSize);
+
+            int style = (node.bold ? ViewNode.TEXT_STYLE_BOLD : 0)
+                    | (node.italic ? ViewNode.TEXT_STYLE_ITALIC : 0)
+                    | (node.underline ? ViewNode.TEXT_STYLE_UNDERLINE : 0)
+                    | (node.lineThrough ? ViewNode.TEXT_STYLE_STRIKE_THRU : 0);
+            viewNode.setTextStyle(textSize, node.color, node.bgcolor, style);
+        }
+        for (int i = 0; i < node.children.size(); i++) {
+            createVirtualStructure(viewNode.asyncNewChild(i), node.children.get(i), true);
+        }
+        viewNode.asyncCommit();
+    }
+
     @Override
     public boolean performAction(int virtualViewId, int action, Bundle arguments) {
         // We don't support any actions on the host view or nodes
@@ -378,6 +548,7 @@
         return false;
     }
 
+    @Override
     public void onAutofillPopupDisplayed(View autofillPopupView) {
         if (isAccessibilityEnabled()) {
             mAutofillPopupView = autofillPopupView;
@@ -385,6 +556,7 @@
         }
     }
 
+    @Override
     public void onAutofillPopupDismissed() {
         if (isAccessibilityEnabled()) {
             nativeOnAutofillPopupDismissed(mNativeObj);
@@ -392,6 +564,7 @@
         }
     }
 
+    @Override
     public void onAutofillPopupAccessibilityFocusCleared() {
         if (isAccessibilityEnabled()) {
             int id = nativeGetIdForElementAfterElementHostingAutofillPopup(mNativeObj);
@@ -1280,147 +1453,6 @@
         return 0;
     }
 
-    // AccessibilityStateChangeListener
-
-    @Override
-    public void onAccessibilityStateChanged(boolean enabled) {
-        setState(enabled);
-    }
-
-    // Calls forwared from CVC.
-
-    public void setObscuredByAnotherView(boolean isObscured) {
-        if (isObscured != mIsObscuredByAnotherView) {
-            mIsObscuredByAnotherView = isObscured;
-            mView.sendAccessibilityEvent(AccessibilityEvent.TYPE_WINDOW_CONTENT_CHANGED);
-        }
-    }
-
-    public boolean isTouchExplorationEnabled() {
-        return mTouchExplorationEnabled;
-    }
-
-    public void setState(boolean state) {
-        if (!state) {
-            mNativeAccessibilityAllowed = false;
-            mTouchExplorationEnabled = false;
-        } else {
-            mNativeAccessibilityAllowed = true;
-            mTouchExplorationEnabled = mAccessibilityManager.isTouchExplorationEnabled();
-        }
-    }
-
-    /**
-     * Called by {@link ContentViewCore}
-     */
-    public void destroy() {
-        // WebContents is destroyed. Native a11y shall not be created afterwards.
-        // Have the state of WebContents seen by these two objects in sync.
-        mWebContents = null;
-    }
-
-    /**
-     * Refresh a11y state with that of {@link AccessibilityManager}.
-     */
-    public void refreshState() {
-        setState(mAccessibilityManager.isEnabled());
-    }
-
-    public void setShouldFocusOnPageLoad(boolean on) {
-        mShouldFocusOnPageLoad = on;
-    }
-
-    public boolean supportsAction(int action) {
-        // TODO(dmazzoni): implement this.
-        return false;
-    }
-
-    public boolean performAction(int action, Bundle arguments) {
-        // TODO(dmazzoni): implement this.
-        return false;
-    }
-
-    @TargetApi(Build.VERSION_CODES.M)
-    public void onProvideVirtualStructure(
-            final ViewStructure structure, final boolean ignoreScrollOffset) {
-        // Do not collect accessibility tree in incognito mode
-        if (mWebContents.isIncognito()) {
-            structure.setChildCount(0);
-            return;
-        }
-        structure.setChildCount(1);
-        final ViewStructure viewRoot = structure.asyncNewChild(0);
-        mWebContents.requestAccessibilitySnapshot(new AccessibilitySnapshotCallback() {
-            @Override
-            public void onAccessibilitySnapshot(AccessibilitySnapshotNode root) {
-                viewRoot.setClassName("");
-                viewRoot.setHint(mProductVersion);
-                if (root == null) {
-                    viewRoot.asyncCommit();
-                    return;
-                }
-                createVirtualStructure(viewRoot, root, ignoreScrollOffset);
-            }
-        });
-    }
-
-    // When creating the View structure, the left and top are relative to the parent node.
-    @TargetApi(Build.VERSION_CODES.M)
-    public void createVirtualStructure(ViewStructure viewNode, AccessibilitySnapshotNode node,
-            final boolean ignoreScrollOffset) {
-        viewNode.setClassName(node.className);
-        if (node.hasSelection) {
-            viewNode.setText(node.text, node.startSelection, node.endSelection);
-        } else {
-            viewNode.setText(node.text);
-        }
-        RenderCoordinates renderCoordinates = mWebContents.getRenderCoordinates();
-        int left = (int) renderCoordinates.fromLocalCssToPix(node.x);
-        int top = (int) renderCoordinates.fromLocalCssToPix(node.y);
-        int width = (int) renderCoordinates.fromLocalCssToPix(node.width);
-        int height = (int) renderCoordinates.fromLocalCssToPix(node.height);
-
-        Rect boundsInParent = new Rect(left, top, left + width, top + height);
-        if (node.isRootNode) {
-            // Offset of the web content relative to the View.
-            boundsInParent.offset(0, (int) renderCoordinates.getContentOffsetYPix());
-            if (!ignoreScrollOffset) {
-                boundsInParent.offset(-(int) renderCoordinates.getScrollXPix(),
-                        -(int) renderCoordinates.getScrollYPix());
-            }
-        }
-
-        viewNode.setDimens(boundsInParent.left, boundsInParent.top, 0, 0, width, height);
-        viewNode.setChildCount(node.children.size());
-        if (node.hasStyle) {
-            // The text size should be in physical pixels, not CSS pixels.
-            float textSize = renderCoordinates.fromLocalCssToPix(node.textSize);
-
-            int style = (node.bold ? ViewNode.TEXT_STYLE_BOLD : 0)
-                    | (node.italic ? ViewNode.TEXT_STYLE_ITALIC : 0)
-                    | (node.underline ? ViewNode.TEXT_STYLE_UNDERLINE : 0)
-                    | (node.lineThrough ? ViewNode.TEXT_STYLE_STRIKE_THRU : 0);
-            viewNode.setTextStyle(textSize, node.color, node.bgcolor, style);
-        }
-        for (int i = 0; i < node.children.size(); i++) {
-            createVirtualStructure(viewNode.asyncNewChild(i), node.children.get(i), true);
-        }
-        viewNode.asyncCommit();
-    }
-
-    // WindowEventObserver
-
-    @Override
-    public void onDetachedFromWindow() {
-        mAccessibilityManager.removeAccessibilityStateChangeListener(this);
-    }
-
-    @Override
-    public void onAttachedToWindow() {
-        mAccessibilityManager.addAccessibilityStateChangeListener(this);
-        refreshState();
-    }
-
     private native long nativeInit(WebContents webContents);
     private native void nativeOnAutofillPopupDisplayed(long nativeWebContentsAccessibilityAndroid);
     private native void nativeOnAutofillPopupDismissed(long nativeWebContentsAccessibilityAndroid);
diff --git a/content/public/android/java/src/org/chromium/content/browser/webcontents/WebContentsUserData.java b/content/public/android/java/src/org/chromium/content/browser/webcontents/WebContentsUserData.java
index af95887..8686b08 100644
--- a/content/public/android/java/src/org/chromium/content/browser/webcontents/WebContentsUserData.java
+++ b/content/public/android/java/src/org/chromium/content/browser/webcontents/WebContentsUserData.java
@@ -76,7 +76,7 @@
         WebContentsUserData data = userDataMap.get(key);
         if (data == null && userDataFactory != null) {
             T object = userDataFactory.create(webContents);
-            assert object.getClass() == key;
+            assert key.isInstance(object);
             webContentsImpl.setUserData(key, new WebContentsUserData(object));
             // Retrieves from the map again to return null in case |setUserData| fails
             // to store the object.
diff --git a/content/public/android/java/src/org/chromium/content_public/browser/WebContentsAccessibility.java b/content/public/android/java/src/org/chromium/content_public/browser/WebContentsAccessibility.java
new file mode 100644
index 0000000..9ff609a
--- /dev/null
+++ b/content/public/android/java/src/org/chromium/content_public/browser/WebContentsAccessibility.java
@@ -0,0 +1,107 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+package org.chromium.content_public.browser;
+
+import android.annotation.TargetApi;
+import android.os.Build;
+import android.os.Bundle;
+import android.view.View;
+import android.view.ViewStructure;
+import android.view.accessibility.AccessibilityNodeProvider;
+
+import org.chromium.content.browser.accessibility.WebContentsAccessibilityImpl;
+
+/**
+ * Interface providing native accessibility for a {@link WebContents}. Actual native
+ * accessibility part is lazily created upon the first request from Android framework on
+ *{@link AccessibilityNodeProvider}, and shares the lifetime with {@link WebContents}.
+ */
+public interface WebContentsAccessibility {
+    /**
+     * @param webContents {@link WebContents} object.
+     * @return {@link WebContentsAccessibility} object used for the give WebContents.
+     *         {@code null} if not available.
+     */
+    static WebContentsAccessibility fromWebContents(WebContents webContents) {
+        return WebContentsAccessibilityImpl.fromWebContents(webContents);
+    }
+
+    /**
+     * Determines whether or not the given accessibility action can be handled.
+     * @param action The action to perform.
+     * @return Whether or not this action is supported.
+     */
+    boolean supportsAction(int action);
+
+    /**
+     * Attempts to perform an accessibility action on the web content.  If the accessibility action
+     * cannot be processed, it returns {@code null}, allowing the caller to know to call the
+     * super {@link View#performAccessibilityAction(int, Bundle)} method and use that return value.
+     * Otherwise the return value from this method should be used.
+     * @param action The action to perform.
+     * @param arguments Optional action arguments.
+     * @return Whether the action was performed or {@code null} if the call should be delegated to
+     *         the super {@link View} class.
+     */
+    boolean performAction(int action, Bundle arguments);
+
+    /**
+     * If native accessibility is enabled and no other views are temporarily
+     * obscuring this one, returns an AccessibilityNodeProvider that
+     * implements native accessibility for this view. Returns null otherwise.
+     * Lazily initializes native accessibility here if it's allowed.
+     * @return The AccessibilityNodeProvider, if available, or null otherwise.
+     */
+    AccessibilityNodeProvider getAccessibilityNodeProvider();
+
+    /**
+     * @see View#onProvideVirtualStructure().
+     */
+    @TargetApi(Build.VERSION_CODES.M)
+    void onProvideVirtualStructure(ViewStructure structure, boolean ignoreScrollOffset);
+
+    /**
+     * Set whether or not the web contents are obscured by another view.
+     * If true, we won't return an accessibility node provider or respond
+     * to touch exploration events.
+     */
+    void setObscuredByAnotherView(boolean isObscured);
+
+    /**
+     * Returns true if accessibility is on and touch exploration is enabled.
+     */
+    boolean isTouchExplorationEnabled();
+
+    /**
+     * Turns browser accessibility on or off.
+     * If |state| is |false|, this turns off both native and injected accessibility.
+     * Otherwise, if accessibility script injection is enabled, this will enable the injected
+     * accessibility scripts. Native accessibility is enabled on demand.
+     */
+    void setState(boolean state);
+
+    /**
+     * Sets whether or not we should set accessibility focus on page load.
+     * This only applies if an accessibility service like TalkBack is running.
+     * This is desirable behavior for a browser window, but not for an embedded
+     * WebView.
+     */
+    void setShouldFocusOnPageLoad(boolean on);
+
+    /**
+     * Called when autofill popup is displayed. Used to upport navigation through the view.
+     * @param autofillPopupView The displayed autofill popup view.
+     */
+    void onAutofillPopupDisplayed(View autofillPopupView);
+
+    /**
+     * Called when autofill popup is dismissed.
+     */
+    void onAutofillPopupDismissed();
+
+    /**
+     * Called when the a11y focus gets cleared on the autofill popup.
+     */
+    void onAutofillPopupAccessibilityFocusCleared();
+}
diff --git a/content/public/android/javatests/src/org/chromium/content/browser/accessibility/WebContentsAccessibilityTest.java b/content/public/android/javatests/src/org/chromium/content/browser/accessibility/WebContentsAccessibilityTest.java
index 549a5e5..763fabb 100644
--- a/content/public/android/javatests/src/org/chromium/content/browser/accessibility/WebContentsAccessibilityTest.java
+++ b/content/public/android/javatests/src/org/chromium/content/browser/accessibility/WebContentsAccessibilityTest.java
@@ -39,7 +39,8 @@
 import java.lang.reflect.Method;
 
 /**
- * Tests for WebContentsAccessibility.
+ * Tests for WebContentsAccessibility. Actually tests WebContentsAccessibilityImpl that
+ * implements the interface.
  */
 @RunWith(BaseJUnit4ClassRunner.class)
 public class WebContentsAccessibilityTest {
@@ -48,7 +49,7 @@
 
     @Before
     public void setUp() throws Exception {
-        WebContentsAccessibility.setAccessibilityEnabledForTesting();
+        WebContentsAccessibilityImpl.setAccessibilityEnabledForTesting();
     }
 
     /**
@@ -77,17 +78,18 @@
      * returns something not null.
      */
     private AccessibilityNodeProvider enableAccessibilityAndWaitForNodeProvider() {
-        final ContentViewCore contentViewCore = mActivityTestRule.getContentViewCore();
-        contentViewCore.setAccessibilityState(true);
+        final WebContentsAccessibilityImpl wcax =
+                WebContentsAccessibilityImpl.fromWebContents(mActivityTestRule.getWebContents());
+        wcax.setState(true);
 
         CriteriaHelper.pollUiThread(new Criteria() {
             @Override
             public boolean isSatisfied() {
-                return contentViewCore.getAccessibilityNodeProvider() != null;
+                return wcax.getAccessibilityNodeProvider() != null;
             }
         });
 
-        return contentViewCore.getAccessibilityNodeProvider();
+        return wcax.getAccessibilityNodeProvider();
     }
 
     AccessibilityEventCallbackHelper mAccessibilityEventCallbackHelper;
@@ -112,8 +114,10 @@
 
         // Get the AccessibilityNodeProvider.
         ContentViewCore contentViewCore = mActivityTestRule.getContentViewCore();
-        contentViewCore.setAccessibilityState(true);
-        AccessibilityNodeProvider provider = contentViewCore.getAccessibilityNodeProvider();
+        WebContentsAccessibilityImpl wcax =
+                WebContentsAccessibilityImpl.fromWebContents(mActivityTestRule.getWebContents());
+        wcax.setState(true);
+        AccessibilityNodeProvider provider = wcax.getAccessibilityNodeProvider();
 
         // Wait until we find a node in the accessibility tree with the text "Text".
         // Whenever the tree is updated, an AccessibilityEvent is fired, so we can just wait until
@@ -331,4 +335,4 @@
             Assert.assertEquals(sIndex, i);
         }
     }
-}
\ No newline at end of file
+}
diff --git a/content/public/app/BUILD.gn b/content/public/app/BUILD.gn
index d9fd7ca1..d3a1f85 100644
--- a/content/public/app/BUILD.gn
+++ b/content/public/app/BUILD.gn
@@ -183,12 +183,12 @@
   name = "content_packaged_services"
   source = "mojo/content_packaged_services_manifest.json"
   packaged_services = [
-    "//content/network:manifest",
     "//media/mojo/services:cdm_manifest",
     "//media/mojo/services:media_manifest",
     "//services/data_decoder:manifest",
     "//services/device:manifest",
     "//services/metrics:manifest",
+    "//services/network:manifest",
     "//services/resource_coordinator:manifest",
     "//services/shape_detection:manifest",
     "//services/video_capture:manifest",
diff --git a/content/public/browser/content_browser_client.cc b/content/public/browser/content_browser_client.cc
index ccba0232..672f4b5 100644
--- a/content/public/browser/content_browser_client.cc
+++ b/content/public/browser/content_browser_client.cc
@@ -17,7 +17,6 @@
 #include "content/public/browser/network_service_instance.h"
 #include "content/public/browser/page_navigator.h"
 #include "content/public/browser/vpn_service_proxy.h"
-#include "content/public/common/content_features.h"
 #include "content/public/common/url_loader_throttle.h"
 #include "device/geolocation/public/cpp/location_provider.h"
 #include "media/audio/audio_manager.h"
@@ -27,6 +26,7 @@
 #include "net/ssl/client_cert_identity.h"
 #include "net/ssl/client_cert_store.h"
 #include "net/url_request/url_request_context_getter.h"
+#include "services/network/public/cpp/features.h"
 #include "services/service_manager/sandbox/sandbox_type.h"
 #include "storage/browser/quota/quota_manager.h"
 #include "ui/gfx/image/image_skia.h"
@@ -584,7 +584,7 @@
     BrowserContext* context,
     bool in_memory,
     const base::FilePath& relative_partition_path) {
-  if (!base::FeatureList::IsEnabled(features::kNetworkService))
+  if (!base::FeatureList::IsEnabled(network::features::kNetworkService))
     return nullptr;
 
   network::mojom::NetworkContextPtr network_context;
diff --git a/content/public/browser/network_service_instance.h b/content/public/browser/network_service_instance.h
index d3268a0..947fe3f5 100644
--- a/content/public/browser/network_service_instance.h
+++ b/content/public/browser/network_service_instance.h
@@ -8,13 +8,13 @@
 #include "content/common/content_export.h"
 
 namespace network {
+class NetworkService;
 namespace mojom {
 class NetworkService;
 }
 }  // namespace network
 
 namespace content {
-class NetworkService;
 
 // Returns a pointer to the NetworkService, creating / re-creating it as needed.
 // NetworkService will be running in-process if
@@ -28,7 +28,7 @@
 // pointer which is used to ease transition to network service.
 // Must only be called on the IO thread.  Must not be called if the network
 // service is enabled.
-CONTENT_EXPORT NetworkService* GetNetworkServiceImpl();
+CONTENT_EXPORT network::NetworkService* GetNetworkServiceImpl();
 
 // Call |FlushForTesting()| on cached |NetworkServicePtr|. For testing only.
 // Must only be called on the UI thread. Must not be called if the network
diff --git a/content/public/common/content_features.cc b/content/public/common/content_features.cc
index d075241..69112355 100644
--- a/content/public/common/content_features.cc
+++ b/content/public/common/content_features.cc
@@ -168,10 +168,6 @@
 const base::Feature kMemoryCoordinator{"MemoryCoordinator",
                                        base::FEATURE_DISABLED_BY_DEFAULT};
 
-// Enables the network service.
-const base::Feature kNetworkService{"NetworkService",
-                                    base::FEATURE_DISABLED_BY_DEFAULT};
-
 // If the network service is enabled, runs it in process.
 const base::Feature kNetworkServiceInProcess{"NetworkServiceInProcess",
                                              base::FEATURE_DISABLED_BY_DEFAULT};
@@ -222,10 +218,6 @@
 const base::Feature kOriginTrials{"OriginTrials",
                                   base::FEATURE_ENABLED_BY_DEFAULT};
 
-// Out of Blink CORS
-const base::Feature kOutOfBlinkCORS{"OutOfBlinkCORS",
-                                    base::FEATURE_DISABLED_BY_DEFAULT};
-
 // Whether a download can be handled by parallel jobs.
 const base::Feature kParallelDownloading {
   "ParallelDownloading",
@@ -274,10 +266,6 @@
 const base::Feature kPWAFullCodeCache{"PWAFullCodeCache",
                                       base::FEATURE_DISABLED_BY_DEFAULT};
 
-// Port some content::ResourceScheduler functionalities to renderer.
-const base::Feature kRendererSideResourceScheduler{
-    "RendererSideResourceScheduler", base::FEATURE_DISABLED_BY_DEFAULT};
-
 // Throttle Blink's rendering pipeline based on frame visibility.
 const base::Feature kRenderingPipelineThrottling{
     "RenderingPipelineThrottling", base::FEATURE_ENABLED_BY_DEFAULT};
diff --git a/content/public/common/content_features.h b/content/public/common/content_features.h
index 1010f6f5..da1fb29 100644
--- a/content/public/common/content_features.h
+++ b/content/public/common/content_features.h
@@ -52,7 +52,6 @@
 CONTENT_EXPORT extern const base::Feature kLowPriorityIframes;
 CONTENT_EXPORT extern const base::Feature kMediaDevicesSystemMonitorCache;
 CONTENT_EXPORT extern const base::Feature kMemoryCoordinator;
-CONTENT_EXPORT extern const base::Feature kNetworkService;
 CONTENT_EXPORT extern const base::Feature kNetworkServiceInProcess;
 CONTENT_EXPORT extern const base::Feature kNotificationContentImage;
 CONTENT_EXPORT extern const base::Feature kMainThreadBusyScrollIntervention;
@@ -64,14 +63,12 @@
 CONTENT_EXPORT extern const base::Feature kNotificationsWithMojo;
 CONTENT_EXPORT extern const base::Feature kOriginManifest;
 CONTENT_EXPORT extern const base::Feature kOriginTrials;
-CONTENT_EXPORT extern const base::Feature kOutOfBlinkCORS;
 CONTENT_EXPORT extern const base::Feature kParallelDownloading;
 CONTENT_EXPORT extern const base::Feature kPassiveDocumentEventListeners;
 CONTENT_EXPORT extern const base::Feature kPassiveEventListenersDueToFling;
 CONTENT_EXPORT extern const base::Feature kPepper3DImageChromium;
 CONTENT_EXPORT extern const base::Feature kPurgeAndSuspend;
 CONTENT_EXPORT extern const base::Feature kPWAFullCodeCache;
-CONTENT_EXPORT extern const base::Feature kRendererSideResourceScheduler;
 CONTENT_EXPORT extern const base::Feature kRenderingPipelineThrottling;
 CONTENT_EXPORT extern const base::Feature kReportRendererPeakMemoryStats;
 CONTENT_EXPORT extern const base::Feature kRequireCSSExtensionForFile;
diff --git a/content/public/common/content_switches.cc b/content/public/common/content_switches.cc
index 534a6b0..4a415307 100644
--- a/content/public/common/content_switches.cc
+++ b/content/public/common/content_switches.cc
@@ -543,20 +543,6 @@
 const char kHistoryEntryRequiresUserGesture[] =
     "history-entry-requires-user-gesture";
 
-// A set of public key hashes for which to ignore certificate-related errors.
-//
-// If the certificate chain presented by the server does not validate, and one
-// or more certificates have public key hashes that match a key from this list,
-// the error is ignored.
-//
-// The switch value must a be a comma-separated list of Base64-encoded SHA-256
-// SPKI Fingerprints (RFC 7469, Section 2.4).
-//
-// This switch has no effect unless --user-data-dir (as defined by the content
-// embedder) is also present.
-const char kIgnoreCertificateErrorsSPKIList[] =
-    "ignore-certificate-errors-spki-list";
-
 // Run the GPU process as a thread in the browser process.
 const char kInProcessGPU[]                  = "in-process-gpu";
 
diff --git a/content/public/common/content_switches.h b/content/public/common/content_switches.h
index a24b46b..ef74f4ab 100644
--- a/content/public/common/content_switches.h
+++ b/content/public/common/content_switches.h
@@ -164,7 +164,6 @@
 CONTENT_EXPORT extern const char kGpuStartupDialog[];
 CONTENT_EXPORT extern const char kSamplingHeapProfiler[];
 CONTENT_EXPORT extern const char kHistoryEntryRequiresUserGesture[];
-CONTENT_EXPORT extern const char kIgnoreCertificateErrorsSPKIList[];
 CONTENT_EXPORT extern const char kInProcessGPU[];
 CONTENT_EXPORT extern const char kIPCConnectionTimeout[];
 CONTENT_EXPORT extern const char kIsolateOrigins[];
diff --git a/content/public/common/network_connection_tracker_unittest.cc b/content/public/common/network_connection_tracker_unittest.cc
index 07787b1..fd13bd7 100644
--- a/content/public/common/network_connection_tracker_unittest.cc
+++ b/content/public/common/network_connection_tracker_unittest.cc
@@ -9,8 +9,8 @@
 #include "base/test/scoped_task_environment.h"
 #include "base/threading/thread.h"
 #include "base/threading/thread_checker.h"
-#include "content/public/network/network_service.h"
 #include "net/base/mock_network_change_notifier.h"
+#include "services/network/public/cpp/network_service.h"
 #include "services/network/public/interfaces/network_change_manager.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -132,8 +132,8 @@
     network::mojom::NetworkServiceRequest network_service_request =
         mojo::MakeRequest(&network_service_ptr);
     network_service_ =
-        NetworkService::Create(std::move(network_service_request),
-                               /*netlog=*/nullptr);
+        network::NetworkService::Create(std::move(network_service_request),
+                                        /*netlog=*/nullptr);
     tracker_ = std::make_unique<NetworkConnectionTracker>();
     tracker_->Initialize(network_service_.get());
     observer_ = std::make_unique<TestNetworkConnectionObserver>(tracker_.get());
@@ -141,7 +141,7 @@
 
   ~NetworkConnectionTrackerTest() override {}
 
-  NetworkService* network_service() { return network_service_.get(); }
+  network::NetworkService* network_service() { return network_service_.get(); }
 
   NetworkConnectionTracker* network_connection_tracker() {
     return tracker_.get();
@@ -165,7 +165,7 @@
  private:
   base::test::ScopedTaskEnvironment scoped_task_environment_;
   net::test::MockNetworkChangeNotifier mock_network_change_notifier_;
-  std::unique_ptr<NetworkService> network_service_;
+  std::unique_ptr<network::NetworkService> network_service_;
   std::unique_ptr<NetworkConnectionTracker> tracker_;
   std::unique_ptr<TestNetworkConnectionObserver> observer_;
 
@@ -222,8 +222,9 @@
   network::mojom::NetworkServicePtr network_service_ptr;
   network::mojom::NetworkServiceRequest network_service_request =
       mojo::MakeRequest(&network_service_ptr);
-  std::unique_ptr<NetworkService> network_service =
-      NetworkService::Create(std::move(network_service_request), nullptr);
+  std::unique_ptr<network::NetworkService> network_service =
+      network::NetworkService::Create(std::move(network_service_request),
+                                      nullptr);
   NetworkConnectionTracker tracker;
   tracker.Initialize(network_service_ptr.get());
 
diff --git a/content/public/common/simple_url_loader_unittest.cc b/content/public/common/simple_url_loader_unittest.cc
index 0781da7..d757b75 100644
--- a/content/public/common/simple_url_loader_unittest.cc
+++ b/content/public/common/simple_url_loader_unittest.cc
@@ -27,7 +27,6 @@
 #include "base/test/scoped_task_environment.h"
 #include "content/public/common/service_manager_connection.h"
 #include "content/public/common/service_names.mojom.h"
-#include "content/public/network/network_service.h"
 #include "mojo/public/c/system/types.h"
 #include "mojo/public/cpp/bindings/binding.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
@@ -41,6 +40,7 @@
 #include "net/test/embedded_test_server/http_response.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "net/url_request/redirect_info.h"
+#include "services/network/public/cpp/network_service.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/cpp/resource_response.h"
 #include "services/network/public/cpp/url_loader_completion_status.h"
@@ -382,8 +382,8 @@
     network::mojom::NetworkServiceRequest network_service_request =
         mojo::MakeRequest(&network_service_ptr);
     network_service_ =
-        NetworkService::Create(std::move(network_service_request),
-                               /*netlog=*/nullptr);
+        network::NetworkService::Create(std::move(network_service_request),
+                                        /*netlog=*/nullptr);
     network::mojom::NetworkContextParamsPtr context_params =
         network::mojom::NetworkContextParams::New();
     context_params->enable_data_url_support = true;
diff --git a/content/public/network/BUILD.gn b/content/public/network/BUILD.gn
deleted file mode 100644
index f4df623..0000000
--- a/content/public/network/BUILD.gn
+++ /dev/null
@@ -1,40 +0,0 @@
-# Copyright 2017 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-# See //content/BUILD.gn for how this works.
-group("network") {
-  if (is_component_build) {
-    public_deps = [
-      "//content",
-    ]
-  } else {
-    public_deps = [
-      ":network_sources",
-    ]
-  }
-}
-
-target("source_set", "network_sources") {
-  visibility = [ "//content/*" ]
-
-  configs += [ "//content:content_implementation" ]
-
-  sources = [
-    "ignore_errors_cert_verifier.cc",
-    "ignore_errors_cert_verifier.h",
-    "network_service.h",
-    "url_request_context_builder_mojo.h",
-    "url_request_context_owner.cc",
-    "url_request_context_owner.h",
-  ]
-
-  deps = [
-    "//base",
-    "//components/prefs",
-    "//content:export",
-    "//content/common:mojo_bindings",
-    "//content/public/common:common_sources",
-    "//services/proxy_resolver/public/interfaces",
-  ]
-}
diff --git a/content/public/network/DEPS b/content/public/network/DEPS
deleted file mode 100644
index f0de245..0000000
--- a/content/public/network/DEPS
+++ /dev/null
@@ -1,10 +0,0 @@
-specific_include_rules = {
-  ".*\.cc": [
-    # Prefs are used to create an independent file with a persisted key:value
-    # store for networking-related data (Like which servers support QUIC),
-    # rather than to store user preferences.
-    "+components/prefs",
-    "+content/network",
-    "+services/proxy_resolver/public/interfaces",
-  ],
-}
diff --git a/content/public/test/DEPS b/content/public/test/DEPS
index 18260cbc..cb21546 100644
--- a/content/public/test/DEPS
+++ b/content/public/test/DEPS
@@ -17,6 +17,7 @@
     # Testing utilities can access anything in content/
     "+content",
     "+gin/v8_initializer.h",
+    "+services/network/network_context.h",
     "+third_party/iaccessible2",
     "+ui/base/resource/resource_bundle.h",
   ],
diff --git a/content/public/test/android/javatests/src/org/chromium/content/browser/test/util/TestContentViewCore.java b/content/public/test/android/javatests/src/org/chromium/content/browser/test/util/TestContentViewCore.java
index 3415c62f..1b973fd6 100644
--- a/content/public/test/android/javatests/src/org/chromium/content/browser/test/util/TestContentViewCore.java
+++ b/content/public/test/android/javatests/src/org/chromium/content/browser/test/util/TestContentViewCore.java
@@ -6,16 +6,12 @@
 
 import android.content.Context;
 import android.content.res.Configuration;
-import android.os.Bundle;
 import android.view.KeyEvent;
 import android.view.MotionEvent;
 import android.view.ViewGroup;
-import android.view.ViewStructure;
-import android.view.accessibility.AccessibilityNodeProvider;
 
 import org.chromium.content.browser.ContentViewCore;
 import org.chromium.content.browser.ContentViewCore.InternalAccessDelegate;
-import org.chromium.content.browser.accessibility.WebContentsAccessibility;
 import org.chromium.content.browser.input.SelectPopup;
 import org.chromium.content.browser.input.TextSuggestionHost;
 import org.chromium.content_public.browser.WebContents;
@@ -220,43 +216,6 @@
     }
 
     @Override
-    public boolean supportsAccessibilityAction(int action) {
-        return false;
-    }
-
-    @Override
-    public boolean performAccessibilityAction(int action, Bundle arguments) {
-        return false;
-    }
-
-    @Override
-    public WebContentsAccessibility getWebContentsAccessibility() {
-        return null;
-    }
-
-    @Override
-    public AccessibilityNodeProvider getAccessibilityNodeProvider() {
-        return null;
-    }
-
-    @Override
-    public void onProvideVirtualStructure(ViewStructure structure, boolean ignoreScrollOffset) {}
-
-    @Override
-    public void setObscuredByAnotherView(boolean isObscured) {}
-
-    @Override
-    public boolean isTouchExplorationEnabled() {
-        return false;
-    }
-
-    @Override
-    public void setAccessibilityState(boolean state) {}
-
-    @Override
-    public void setShouldSetAccessibilityFocusOnPageLoad(boolean on) {}
-
-    @Override
     public boolean getIsMobileOptimizedHint() {
         return false;
     }
diff --git a/content/public/test/browser_test_base.cc b/content/public/test/browser_test_base.cc
index 00f5f4c3..de5597e 100644
--- a/content/public/test/browser_test_base.cc
+++ b/content/public/test/browser_test_base.cc
@@ -28,7 +28,6 @@
 #include "content/browser/tracing/tracing_controller_impl.h"
 #include "content/public/app/content_main.h"
 #include "content/public/browser/browser_thread.h"
-#include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/main_function_params.h"
 #include "content/public/common/service_manager_connection.h"
@@ -40,6 +39,7 @@
 #include "mojo/public/cpp/bindings/sync_call_restrictions.h"
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/interfaces/network_service_test.mojom.h"
 #include "services/service_manager/embedder/switches.h"
 #include "services/service_manager/public/cpp/connector.h"
@@ -418,7 +418,7 @@
   const testing::TestInfo* const test_info =
       testing::UnitTest::GetInstance()->current_test_info();
   bool network_service =
-      base::FeatureList::IsEnabled(features::kNetworkService);
+      base::FeatureList::IsEnabled(network::features::kNetworkService);
   // ProcessTransferAfterError is the only browser test which needs to modify
   // the host rules (when not using the network service).
   if (network_service ||
diff --git a/content/public/test/browser_test_utils.cc b/content/public/test/browser_test_utils.cc
index 4725c3d9..af4e6698 100644
--- a/content/public/test/browser_test_utils.cc
+++ b/content/public/test/browser_test_utils.cc
@@ -92,6 +92,7 @@
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_getter.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/interfaces/cookie_manager.mojom.h"
 #include "services/network/public/interfaces/network_service.mojom.h"
 #include "services/network/public/interfaces/network_service_test.mojom.h"
@@ -2393,14 +2394,14 @@
 }
 
 bool IsNetworkServiceRunningInProcess() {
-  return base::FeatureList::IsEnabled(features::kNetworkService) &&
+  return base::FeatureList::IsEnabled(network::features::kNetworkService) &&
          (base::CommandLine::ForCurrentProcess()->HasSwitch(
               switches::kSingleProcess) ||
           base::FeatureList::IsEnabled(features::kNetworkServiceInProcess));
 }
 
 void SimulateNetworkServiceCrash() {
-  CHECK(base::FeatureList::IsEnabled(features::kNetworkService));
+  CHECK(base::FeatureList::IsEnabled(network::features::kNetworkService));
   CHECK(!IsNetworkServiceRunningInProcess())
       << "Can't crash the network service if it's running in-process!";
   network::mojom::NetworkServiceTestPtr network_service_test;
diff --git a/content/public/test/network_service_test_helper.cc b/content/public/test/network_service_test_helper.cc
index 9d20932..b3778079 100644
--- a/content/public/test/network_service_test_helper.cc
+++ b/content/public/test/network_service_test_helper.cc
@@ -13,7 +13,6 @@
 #include "base/logging.h"
 #include "base/process/process.h"
 #include "build/build_config.h"
-#include "content/network/network_context.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/test/test_host_resolver.h"
@@ -23,6 +22,8 @@
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/test/test_data_directory.h"
+#include "services/network/network_context.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/interfaces/network_change_manager.mojom.h"
 #include "services/service_manager/sandbox/sandbox_type.h"
 
@@ -40,12 +41,13 @@
     if (base::CommandLine::ForCurrentProcess()->HasSwitch(
             switches::kUseMockCertVerifierForTesting)) {
       mock_cert_verifier_ = std::make_unique<net::MockCertVerifier>();
-      NetworkContext::SetCertVerifierForTesting(mock_cert_verifier_.get());
+      network::NetworkContext::SetCertVerifierForTesting(
+          mock_cert_verifier_.get());
     }
   }
 
   ~NetworkServiceTestImpl() override {
-    NetworkContext::SetCertVerifierForTesting(nullptr);
+    network::NetworkContext::SetCertVerifierForTesting(nullptr);
   }
 
   // network::mojom::NetworkServiceTest:
@@ -111,7 +113,7 @@
 
 void NetworkServiceTestHelper::RegisterNetworkBinders(
     service_manager::BinderRegistry* registry) {
-  if (!base::FeatureList::IsEnabled(features::kNetworkService))
+  if (!base::FeatureList::IsEnabled(network::features::kNetworkService))
     return;
 
   registry->AddInterface(
diff --git a/content/public/test/url_loader_interceptor.cc b/content/public/test/url_loader_interceptor.cc
index 3f3c27e..2b5320c 100644
--- a/content/public/test/url_loader_interceptor.cc
+++ b/content/public/test/url_loader_interceptor.cc
@@ -10,8 +10,8 @@
 #include "content/browser/loader/url_loader_factory_impl.h"
 #include "content/browser/url_loader_factory_getter.h"
 #include "content/public/browser/browser_thread.h"
-#include "content/public/common/content_features.h"
 #include "net/http/http_util.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/interfaces/url_loader.mojom.h"
 
 namespace content {
@@ -163,7 +163,7 @@
          BrowserThread::CurrentlyOn(BrowserThread::UI));
 
   if (intercept_subresources_ &&
-      base::FeatureList::IsEnabled(features::kNetworkService)) {
+      base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     RenderFrameHostImpl::SetNetworkFactoryForTesting(base::BindRepeating(
         &URLLoaderInterceptor::CreateURLLoaderFactoryForSubresources,
         base::Unretained(this)));
@@ -185,7 +185,7 @@
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 
   if (intercept_subresources_ &&
-      base::FeatureList::IsEnabled(features::kNetworkService)) {
+      base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     RenderFrameHostImpl::SetNetworkFactoryForTesting(
         RenderFrameHostImpl::CreateNetworkFactoryCallback());
   }
@@ -261,14 +261,14 @@
   // Once http://crbug.com/747130 is fixed, the codepath above will work for
   // the non-network service code path.
   if (intercept_frame_requests_ &&
-      base::FeatureList::IsEnabled(features::kNetworkService)) {
+      base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     URLLoaderFactoryGetter::SetGetNetworkFactoryCallbackForTesting(
         base::BindRepeating(&URLLoaderInterceptor::GetNetworkFactoryCallback,
                             base::Unretained(this)));
   }
 
   if (intercept_subresources_ &&
-      !base::FeatureList::IsEnabled(features::kNetworkService)) {
+      !base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     rmf_interceptor_ = std::make_unique<Interceptor>(
         this, base::BindRepeating([]() {
           return ResourceMessageFilter::GetCurrentForTesting()->child_id();
@@ -291,13 +291,13 @@
   subresource_wrappers_.clear();
 
   if (intercept_frame_requests_ &&
-      base::FeatureList::IsEnabled(features::kNetworkService)) {
+      base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     URLLoaderFactoryGetter::SetGetNetworkFactoryCallbackForTesting(
         URLLoaderFactoryGetter::GetNetworkFactoryCallback());
   }
 
   if (intercept_subresources_ &&
-      !base::FeatureList::IsEnabled(features::kNetworkService)) {
+      !base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     ResourceMessageFilter::SetNetworkFactoryForTesting(nullptr);
   }
 
diff --git a/content/renderer/BUILD.gn b/content/renderer/BUILD.gn
index fd3193e..de4272f 100644
--- a/content/renderer/BUILD.gn
+++ b/content/renderer/BUILD.gn
@@ -403,8 +403,6 @@
     "sad_plugin.h",
     "savable_resources.cc",
     "savable_resources.h",
-    "screen_orientation/screen_orientation_dispatcher.cc",
-    "screen_orientation/screen_orientation_dispatcher.h",
     "seccomp_sandbox_status_android.cc",
     "seccomp_sandbox_status_android.h",
     "service_worker/controller_service_worker_connector.cc",
diff --git a/content/renderer/child_frame_compositing_helper.cc b/content/renderer/child_frame_compositing_helper.cc
index fcd6a40..818bc78e 100644
--- a/content/renderer/child_frame_compositing_helper.cc
+++ b/content/renderer/child_frame_compositing_helper.cc
@@ -133,7 +133,8 @@
   surface_layer_->SetMasksToBounds(true);
   surface_layer_->SetBackgroundColor(SK_ColorTRANSPARENT);
 
-  surface_layer_->SetPrimarySurfaceId(surface_id, base::nullopt);
+  surface_layer_->SetPrimarySurfaceId(surface_id,
+                                      cc::DeadlinePolicy::UseDefaultDeadline());
   surface_layer_->SetFallbackSurfaceId(fallback_surface_id_);
 
   std::unique_ptr<cc_blink::WebLayerImpl> layer(
diff --git a/content/renderer/loader/resource_dispatcher.cc b/content/renderer/loader/resource_dispatcher.cc
index 12cd296..16777486 100644
--- a/content/renderer/loader/resource_dispatcher.cc
+++ b/content/renderer/loader/resource_dispatcher.cc
@@ -24,7 +24,6 @@
 #include "content/common/inter_process_time_ticks_converter.h"
 #include "content/common/navigation_params.h"
 #include "content/common/throttling_url_loader.h"
-#include "content/public/common/content_features.h"
 #include "content/public/common/resource_type.h"
 #include "content/public/renderer/fixed_received_data.h"
 #include "content/public/renderer/request_peer.h"
@@ -39,6 +38,7 @@
 #include "net/base/net_errors.h"
 #include "net/base/request_priority.h"
 #include "net/http/http_response_headers.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/cpp/resource_response.h"
 #include "services/network/public/cpp/url_loader_completion_status.h"
@@ -441,7 +441,7 @@
   uint32_t options = network::mojom::kURLLoadOptionNone;
   // TODO(jam): use this flag for ResourceDispatcherHost code path once
   // MojoLoading is the only IPC code path.
-  if (base::FeatureList::IsEnabled(features::kNetworkService) &&
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService) &&
       request->fetch_request_context_type != REQUEST_CONTEXT_TYPE_FETCH) {
     // MIME sniffing should be disabled for a request initiated by fetch().
     options |= network::mojom::kURLLoadOptionSniffMimeType;
diff --git a/content/renderer/loader/web_url_request_util.cc b/content/renderer/loader/web_url_request_util.cc
index 5b7720a..60c374fa 100644
--- a/content/renderer/loader/web_url_request_util.cc
+++ b/content/renderer/loader/web_url_request_util.cc
@@ -13,13 +13,13 @@
 #include "base/strings/string_util.h"
 #include "base/task_scheduler/post_task.h"
 #include "content/child/child_thread_impl.h"
-#include "content/public/common/content_features.h"
 #include "content/public/common/service_names.mojom.h"
 #include "content/renderer/loader/request_extra_data.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
 #include "net/base/load_flags.h"
 #include "net/base/net_errors.h"
 #include "net/http/http_util.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/interfaces/data_pipe_getter.mojom.h"
 #include "services/network/public/interfaces/request_context_frame_type.mojom.h"
 #include "services/service_manager/public/cpp/connector.h"
@@ -480,7 +480,7 @@
         }
         break;
       case WebHTTPBody::Element::kTypeBlob: {
-        if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+        if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
           if (!blob_registry.is_bound()) {
             if (ChildThreadImpl::current()) {
               ChildThreadImpl::current()->GetConnector()->BindInterface(
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index ec7ce4d..603c5b4 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -136,7 +136,6 @@
 #include "content/renderer/renderer_webapplicationcachehost_impl.h"
 #include "content/renderer/resource_timing_info_conversions.h"
 #include "content/renderer/savable_resources.h"
-#include "content/renderer/screen_orientation/screen_orientation_dispatcher.h"
 #include "content/renderer/service_worker/service_worker_network_provider.h"
 #include "content/renderer/service_worker/service_worker_provider_context.h"
 #include "content/renderer/service_worker/web_service_worker_provider_impl.h"
@@ -157,6 +156,7 @@
 #include "net/http/http_request_headers.h"
 #include "net/http/http_util.h"
 #include "ppapi/features/features.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/interfaces/request_context_frame_type.mojom.h"
 #include "services/service_manager/public/cpp/connector.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
@@ -1256,7 +1256,6 @@
       web_user_media_client_(nullptr),
       presentation_dispatcher_(nullptr),
       push_messaging_client_(nullptr),
-      screen_orientation_dispatcher_(nullptr),
       render_accessibility_(nullptr),
       previews_state_(PREVIEWS_UNSPECIFIED),
       effective_connection_type_(
@@ -3117,7 +3116,7 @@
   // cross-document navigations with the Network Service enabled.
   DCHECK(is_same_document ||
          common_params.url.SchemeIs(url::kJavaScriptScheme) ||
-         !base::FeatureList::IsEnabled(features::kNetworkService) ||
+         !base::FeatureList::IsEnabled(network::features::kNetworkService) ||
          subresource_loader_factories);
 
   SetupLoaderFactoryBundle(std::move(subresource_loader_factories));
@@ -5149,13 +5148,6 @@
   return url.GetString() == kUnreachableWebDataURL;
 }
 
-blink::WebScreenOrientationClient*
-RenderFrameImpl::GetWebScreenOrientationClient() {
-  if (!screen_orientation_dispatcher_)
-    screen_orientation_dispatcher_ = new ScreenOrientationDispatcher(this);
-  return screen_orientation_dispatcher_;
-}
-
 void RenderFrameImpl::PostAccessibilityEvent(const blink::WebAXObject& obj,
                                              blink::WebAXEvent event) {
   HandleWebAccessibilityEvent(obj, event);
diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
index a37cc12a..fceb931 100644
--- a/content/renderer/render_frame_impl.h
+++ b/content/renderer/render_frame_impl.h
@@ -166,7 +166,6 @@
 class RenderViewImpl;
 class RenderWidget;
 class RenderWidgetFullscreenPepper;
-class ScreenOrientationDispatcher;
 class SharedWorkerRepository;
 class UserMediaClientImpl;
 struct CSPViolationParams;
@@ -717,7 +716,6 @@
   bool ShouldBlockWebGL() override;
   bool AllowContentInitiatedDataUrlNavigations(
       const blink::WebURL& url) override;
-  blink::WebScreenOrientationClient* GetWebScreenOrientationClient() override;
   void PostAccessibilityEvent(const blink::WebAXObject& obj,
                               blink::WebAXEvent event) override;
   void HandleAccessibilityFindInPageResult(int identifier,
@@ -1451,10 +1449,6 @@
   // The Connector proxy used to connect to services.
   service_manager::mojom::ConnectorPtr connector_;
 
-  // The screen orientation dispatcher attached to the frame, lazily
-  // initialized.
-  ScreenOrientationDispatcher* screen_orientation_dispatcher_;
-
   // The Manifest Manager handles the manifest requests from the browser
   // process.
   std::unique_ptr<ManifestManager> manifest_manager_;
diff --git a/content/renderer/renderer_blink_platform_impl.cc b/content/renderer/renderer_blink_platform_impl.cc
index c388f556..79372e2e 100644
--- a/content/renderer/renderer_blink_platform_impl.cc
+++ b/content/renderer/renderer_blink_platform_impl.cc
@@ -91,6 +91,7 @@
 #include "mojo/public/cpp/bindings/strong_binding.h"
 #include "mojo/public/cpp/system/platform_handle.h"
 #include "ppapi/features/features.h"
+#include "services/network/public/cpp/features.h"
 #include "services/service_manager/public/cpp/connector.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 #include "services/ui/public/cpp/gpu/context_provider_command_buffer.h"
@@ -355,7 +356,7 @@
   return base::MakeRefCounted<ChildURLLoaderFactoryBundle>(
       base::BindOnce(&RendererBlinkPlatformImpl::CreateNetworkURLLoaderFactory,
                      base::Unretained(this)),
-      base::FeatureList::IsEnabled(features::kNetworkService)
+      base::FeatureList::IsEnabled(network::features::kNetworkService)
           ? base::BindOnce(&GetBlobURLLoaderFactoryGetter)
           : ChildURLLoaderFactoryBundle::FactoryGetterCallback());
 }
@@ -367,7 +368,7 @@
   PossiblyAssociatedInterfacePtr<network::mojom::URLLoaderFactory>
       url_loader_factory;
 
-  if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     network::mojom::URLLoaderFactoryPtr factory_ptr;
     connector_->BindInterface(mojom::kBrowserServiceName, &factory_ptr);
     url_loader_factory = std::move(factory_ptr);
diff --git a/content/renderer/screen_orientation/OWNERS b/content/renderer/screen_orientation/OWNERS
deleted file mode 100644
index 20b13b9..0000000
--- a/content/renderer/screen_orientation/OWNERS
+++ /dev/null
@@ -1,2 +0,0 @@
-file://third_party/WebKit/Source/modules/screen_orientation/OWNERS
-
diff --git a/content/renderer/screen_orientation/screen_orientation_dispatcher.cc b/content/renderer/screen_orientation/screen_orientation_dispatcher.cc
deleted file mode 100644
index a3d479d..0000000
--- a/content/renderer/screen_orientation/screen_orientation_dispatcher.cc
+++ /dev/null
@@ -1,94 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/screen_orientation/screen_orientation_dispatcher.h"
-
-#include "content/public/renderer/render_frame.h"
-#include "third_party/WebKit/common/associated_interfaces/associated_interface_provider.h"
-
-namespace content {
-
-using device::mojom::ScreenOrientationLockResult;
-
-ScreenOrientationDispatcher::ScreenOrientationDispatcher(
-    RenderFrame* render_frame)
-    : RenderFrameObserver(render_frame) {
-}
-
-ScreenOrientationDispatcher::~ScreenOrientationDispatcher() {
-}
-
-void ScreenOrientationDispatcher::OnDestruct() {
-  delete this;
-}
-
-void ScreenOrientationDispatcher::OnLockOrientationResult(
-    int request_id,
-    ScreenOrientationLockResult result) {
-  if (!pending_callback_ || request_id != request_id_)
-    return;
-
-  switch (result) {
-    case ScreenOrientationLockResult::SCREEN_ORIENTATION_LOCK_RESULT_SUCCESS:
-      pending_callback_->OnSuccess();
-      break;
-    case ScreenOrientationLockResult::
-        SCREEN_ORIENTATION_LOCK_RESULT_ERROR_NOT_AVAILABLE:
-      pending_callback_->OnError(blink::kWebLockOrientationErrorNotAvailable);
-      break;
-    case ScreenOrientationLockResult::
-        SCREEN_ORIENTATION_LOCK_RESULT_ERROR_FULLSCREEN_REQUIRED:
-      pending_callback_->OnError(
-          blink::kWebLockOrientationErrorFullscreenRequired);
-      break;
-    case ScreenOrientationLockResult::
-        SCREEN_ORIENTATION_LOCK_RESULT_ERROR_CANCELED:
-      pending_callback_->OnError(blink::kWebLockOrientationErrorCanceled);
-      break;
-    default:
-      NOTREACHED();
-      break;
-  }
-
-  pending_callback_.reset();
-}
-
-void ScreenOrientationDispatcher::CancelPendingLocks() {
-  if (!pending_callback_)
-    return;
-  pending_callback_->OnError(blink::kWebLockOrientationErrorCanceled);
-  pending_callback_.reset();
-}
-
-void ScreenOrientationDispatcher::LockOrientation(
-    blink::WebScreenOrientationLockType orientation,
-    std::unique_ptr<blink::WebLockOrientationCallback> callback) {
-  CancelPendingLocks();
-
-  pending_callback_ = std::move(callback);
-  EnsureScreenOrientationService();
-  screen_orientation_->LockOrientation(
-      orientation,
-      base::BindOnce(&ScreenOrientationDispatcher::OnLockOrientationResult,
-                     base::Unretained(this), ++request_id_));
-}
-
-void ScreenOrientationDispatcher::UnlockOrientation() {
-  CancelPendingLocks();
-  EnsureScreenOrientationService();
-  screen_orientation_->UnlockOrientation();
-}
-
-int ScreenOrientationDispatcher::GetRequestIdForTests() {
-  return pending_callback_ ? request_id_ : -1;
-}
-
-void ScreenOrientationDispatcher::EnsureScreenOrientationService() {
-  if (!screen_orientation_) {
-    render_frame()->GetRemoteAssociatedInterfaces()->GetInterface(
-        &screen_orientation_);
-  }
-}
-
-}  // namespace content
diff --git a/content/renderer/screen_orientation/screen_orientation_dispatcher.h b/content/renderer/screen_orientation/screen_orientation_dispatcher.h
deleted file mode 100644
index 3cf5598..0000000
--- a/content/renderer/screen_orientation/screen_orientation_dispatcher.h
+++ /dev/null
@@ -1,75 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_SCREEN_ORIENTATION_SCREEN_ORIENTATION_DISPATCHER_H_
-#define CONTENT_RENDERER_SCREEN_ORIENTATION_SCREEN_ORIENTATION_DISPATCHER_H_
-
-#include <memory>
-#include <utility>
-
-#include "base/compiler_specific.h"
-#include "base/macros.h"
-#include "content/public/renderer/render_frame_observer.h"
-#include "device/screen_orientation/public/interfaces/screen_orientation.mojom.h"
-#include "third_party/WebKit/public/platform/modules/screen_orientation/WebLockOrientationCallback.h"
-#include "third_party/WebKit/public/platform/modules/screen_orientation/WebScreenOrientationClient.h"
-#include "third_party/WebKit/public/platform/modules/screen_orientation/WebScreenOrientationLockType.h"
-#include "third_party/WebKit/public/platform/modules/screen_orientation/WebScreenOrientationType.h"
-
-namespace content {
-
-using device::mojom::ScreenOrientationAssociatedPtr;
-using device::mojom::ScreenOrientationLockResult;
-
-class RenderFrame;
-
-// ScreenOrientationDispatcher implements the WebScreenOrientationClient API
-// which handles screen lock. It sends lock (or unlock) requests to the browser
-// process and listens for responses and let Blink know about the result of the
-// request via WebLockOrientationCallback.
-class CONTENT_EXPORT ScreenOrientationDispatcher
-    : public RenderFrameObserver,
-      public blink::WebScreenOrientationClient {
- public:
-  explicit ScreenOrientationDispatcher(RenderFrame* render_frame);
-  ~ScreenOrientationDispatcher() override;
-
- private:
-  friend class ScreenOrientationDispatcherTest;
-
-  // RenderFrameObserver implementation.
-  void OnDestruct() override;
-
-  // blink::WebScreenOrientationClient implementation.
-  void LockOrientation(
-      blink::WebScreenOrientationLockType orientation,
-      std::unique_ptr<blink::WebLockOrientationCallback> callback) override;
-  void UnlockOrientation() override;
-
-  void OnLockOrientationResult(int request_id,
-                               ScreenOrientationLockResult result);
-
-  void CancelPendingLocks();
-
-  int GetRequestIdForTests();
-
-  void EnsureScreenOrientationService();
-
-  // This should only be called by ScreenOrientationDispatcherTest
-  void SetScreenOrientationForTests(
-      ScreenOrientationAssociatedPtr& screen_orientation_for_tests) {
-    screen_orientation_ = std::move(screen_orientation_for_tests);
-  }
-
-  std::unique_ptr<blink::WebLockOrientationCallback> pending_callback_;
-  int request_id_ = 0;
-
-  ScreenOrientationAssociatedPtr screen_orientation_;
-
-  DISALLOW_COPY_AND_ASSIGN(ScreenOrientationDispatcher);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_SCREEN_ORIENTATION_SCREEN_ORIENTATION_DISPATCHER_H_
diff --git a/content/renderer/service_worker/service_worker_context_client_unittest.cc b/content/renderer/service_worker/service_worker_context_client_unittest.cc
index 0c1c49a0..0648188 100644
--- a/content/renderer/service_worker/service_worker_context_client_unittest.cc
+++ b/content/renderer/service_worker/service_worker_context_client_unittest.cc
@@ -15,7 +15,6 @@
 #include "base/time/time.h"
 #include "content/child/thread_safe_sender.h"
 #include "content/common/service_worker/service_worker_utils.h"
-#include "content/public/common/content_features.h"
 #include "content/renderer/service_worker/embedded_worker_instance_client_impl.h"
 #include "content/renderer/service_worker/service_worker_dispatcher.h"
 #include "content/renderer/service_worker/service_worker_timeout_timer.h"
@@ -23,6 +22,7 @@
 #include "ipc/ipc_sync_message_filter.h"
 #include "ipc/ipc_test_sink.h"
 #include "mojo/public/cpp/bindings/associated_interface_ptr.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/WebKit/common/message_port/message_port_channel.h"
@@ -226,7 +226,7 @@
   }
 
   void EnableServicification() {
-    feature_list_.InitWithFeatures({features::kNetworkService}, {});
+    feature_list_.InitWithFeatures({network::features::kNetworkService}, {});
     ASSERT_TRUE(ServiceWorkerUtils::IsServicificationEnabled());
   }
 
diff --git a/content/renderer/service_worker/service_worker_provider_context_unittest.cc b/content/renderer/service_worker/service_worker_provider_context_unittest.cc
index 719a855..53d778f 100644
--- a/content/renderer/service_worker/service_worker_provider_context_unittest.cc
+++ b/content/renderer/service_worker/service_worker_provider_context_unittest.cc
@@ -18,7 +18,6 @@
 #include "content/public/common/content_features.h"
 #include "content/public/common/resource_type.h"
 #include "content/public/common/shared_url_loader_factory.h"
-#include "content/public/test/test_url_loader_client.h"
 #include "content/renderer/service_worker/controller_service_worker_connector.h"
 #include "content/renderer/service_worker/service_worker_dispatcher.h"
 #include "content/renderer/service_worker/service_worker_provider_context.h"
@@ -28,7 +27,9 @@
 #include "ipc/ipc_test_sink.h"
 #include "mojo/public/cpp/bindings/associated_binding_set.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/interfaces/url_loader_factory.mojom.h"
+#include "services/network/test/test_url_loader_client.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/WebKit/common/service_worker/service_worker_error_type.mojom.h"
 #include "third_party/WebKit/common/service_worker/service_worker_object.mojom.h"
@@ -277,7 +278,8 @@
   }
 
   void EnableS13nServiceWorker() {
-    scoped_feature_list_.InitAndEnableFeature(features::kNetworkService);
+    scoped_feature_list_.InitAndEnableFeature(
+        network::features::kNetworkService);
     network::mojom::URLLoaderFactoryPtr fake_loader_factory;
     fake_loader_factory_.AddBinding(MakeRequest(&fake_loader_factory));
     loader_factory_ = base::MakeRefCounted<WrapperSharedURLLoaderFactory>(
@@ -290,7 +292,7 @@
     request.url = url;
     request.resource_type = static_cast<int>(RESOURCE_TYPE_SUB_RESOURCE);
     network::mojom::URLLoaderPtr loader;
-    TestURLLoaderClient loader_client;
+    network::TestURLLoaderClient loader_client;
     factory->CreateLoaderAndStart(
         mojo::MakeRequest(&loader), 0, 0, network::mojom::kURLLoadOptionNone,
         request, loader_client.CreateInterfacePtr(),
diff --git a/content/renderer/service_worker/service_worker_subresource_loader_unittest.cc b/content/renderer/service_worker/service_worker_subresource_loader_unittest.cc
index 3fc5aeb..ae22996d 100644
--- a/content/renderer/service_worker/service_worker_subresource_loader_unittest.cc
+++ b/content/renderer/service_worker/service_worker_subresource_loader_unittest.cc
@@ -14,7 +14,6 @@
 #include "content/public/common/resource_type.h"
 #include "content/public/common/shared_url_loader_factory.h"
 #include "content/public/test/test_browser_thread_bundle.h"
-#include "content/public/test/test_url_loader_client.h"
 #include "content/renderer/service_worker/controller_service_worker_connector.h"
 #include "mojo/common/data_pipe_utils.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
@@ -22,7 +21,9 @@
 #include "net/http/http_util.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "net/url_request/url_request.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/test/test_data_pipe_getter.h"
+#include "services/network/test/test_url_loader_client.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/origin.h"
 
@@ -326,7 +327,7 @@
   ~ServiceWorkerSubresourceLoaderTest() override = default;
 
   void SetUp() override {
-    feature_list_.InitAndEnableFeature(features::kNetworkService);
+    feature_list_.InitAndEnableFeature(network::features::kNetworkService);
 
     network::mojom::URLLoaderFactoryPtr fake_loader_factory;
     mojo::MakeStrongBinding(std::make_unique<FakeNetworkURLLoaderFactory>(),
@@ -350,11 +351,12 @@
   // caller can then use functions like client.RunUntilComplete() to wait for
   // completion. Calling fake_controller_->RunUntilFetchEvent() also advances
   // the load to until |fake_controller_| receives the fetch event.
-  void StartRequest(ServiceWorkerSubresourceLoaderFactory* loader_factory,
-                    const network::ResourceRequest& request,
-                    network::mojom::URLLoaderPtr* out_loader,
-                    std::unique_ptr<TestURLLoaderClient>* out_loader_client) {
-    *out_loader_client = std::make_unique<TestURLLoaderClient>();
+  void StartRequest(
+      ServiceWorkerSubresourceLoaderFactory* loader_factory,
+      const network::ResourceRequest& request,
+      network::mojom::URLLoaderPtr* out_loader,
+      std::unique_ptr<network::TestURLLoaderClient>* out_loader_client) {
+    *out_loader_client = std::make_unique<network::TestURLLoaderClient>();
     loader_factory->CreateLoaderAndStart(
         mojo::MakeRequest(out_loader), 0, 0, network::mojom::kURLLoadOptionNone,
         request, (*out_loader_client)->CreateInterfacePtr(),
@@ -389,7 +391,7 @@
 
     // Perform the request.
     network::mojom::URLLoaderPtr loader;
-    std::unique_ptr<TestURLLoaderClient> client;
+    std::unique_ptr<network::TestURLLoaderClient> client;
     StartRequest(factory.get(), request, &loader, &client);
     client->RunUntilComplete();
 
@@ -421,7 +423,7 @@
   network::ResourceRequest request =
       CreateRequest(GURL("https://www.example.com/foo.png"));
   network::mojom::URLLoaderPtr loader;
-  std::unique_ptr<TestURLLoaderClient> client;
+  std::unique_ptr<network::TestURLLoaderClient> client;
   StartRequest(factory.get(), request, &loader, &client);
   fake_controller_.RunUntilFetchEvent();
 
@@ -441,7 +443,7 @@
   network::ResourceRequest request =
       CreateRequest(GURL("https://www.example.com/foo.png"));
   network::mojom::URLLoaderPtr loader;
-  std::unique_ptr<TestURLLoaderClient> client;
+  std::unique_ptr<network::TestURLLoaderClient> client;
   StartRequest(factory.get(), request, &loader, &client);
   client->RunUntilComplete();
 
@@ -455,7 +457,7 @@
     network::ResourceRequest request =
         CreateRequest(GURL("https://www.example.com/foo.png"));
     network::mojom::URLLoaderPtr loader;
-    std::unique_ptr<TestURLLoaderClient> client;
+    std::unique_ptr<network::TestURLLoaderClient> client;
     StartRequest(factory.get(), request, &loader, &client);
     fake_controller_.RunUntilFetchEvent();
 
@@ -472,7 +474,7 @@
     network::ResourceRequest request =
         CreateRequest(GURL("https://www.example.com/foo2.png"));
     network::mojom::URLLoaderPtr loader;
-    std::unique_ptr<TestURLLoaderClient> client;
+    std::unique_ptr<network::TestURLLoaderClient> client;
     StartRequest(factory.get(), request, &loader, &client);
     fake_controller_.RunUntilFetchEvent();
 
@@ -491,7 +493,7 @@
     network::ResourceRequest request =
         CreateRequest(GURL("https://www.example.com/foo3.png"));
     network::mojom::URLLoaderPtr loader;
-    std::unique_ptr<TestURLLoaderClient> client;
+    std::unique_ptr<network::TestURLLoaderClient> client;
     StartRequest(factory.get(), request, &loader, &client);
     fake_controller_.RunUntilFetchEvent();
 
@@ -509,7 +511,7 @@
     network::ResourceRequest request =
         CreateRequest(GURL("https://www.example.com/foo.png"));
     network::mojom::URLLoaderPtr loader;
-    std::unique_ptr<TestURLLoaderClient> client;
+    std::unique_ptr<network::TestURLLoaderClient> client;
     StartRequest(factory.get(), request, &loader, &client);
     fake_controller_.RunUntilFetchEvent();
 
@@ -528,7 +530,7 @@
     network::ResourceRequest request =
         CreateRequest(GURL("https://www.example.com/foo2.png"));
     network::mojom::URLLoaderPtr loader;
-    std::unique_ptr<TestURLLoaderClient> client;
+    std::unique_ptr<network::TestURLLoaderClient> client;
     StartRequest(factory.get(), request, &loader, &client);
     client->RunUntilComplete();
 
@@ -548,7 +550,7 @@
     network::ResourceRequest request =
         CreateRequest(GURL("https://www.example.com/foo.png"));
     network::mojom::URLLoaderPtr loader;
-    std::unique_ptr<TestURLLoaderClient> client;
+    std::unique_ptr<network::TestURLLoaderClient> client;
     StartRequest(factory.get(), request, &loader, &client);
     fake_controller_.RunUntilFetchEvent();
 
@@ -565,7 +567,7 @@
     network::ResourceRequest request =
         CreateRequest(GURL("https://www.example.com/foo2.png"));
     network::mojom::URLLoaderPtr loader;
-    std::unique_ptr<TestURLLoaderClient> client;
+    std::unique_ptr<network::TestURLLoaderClient> client;
     StartRequest(factory.get(), request, &loader, &client);
     fake_controller_.RunUntilFetchEvent();
 
@@ -578,7 +580,7 @@
   network::ResourceRequest request =
       CreateRequest(GURL("https://www.example.com/foo3.png"));
   network::mojom::URLLoaderPtr loader;
-  std::unique_ptr<TestURLLoaderClient> client;
+  std::unique_ptr<network::TestURLLoaderClient> client;
   StartRequest(factory.get(), request, &loader, &client);
 
   // Drop the connection to the ControllerServiceWorker.
@@ -602,7 +604,7 @@
   network::ResourceRequest request =
       CreateRequest(GURL("https://www.example.com/foo.png"));
   network::mojom::URLLoaderPtr loader;
-  std::unique_ptr<TestURLLoaderClient> client;
+  std::unique_ptr<network::TestURLLoaderClient> client;
   StartRequest(factory.get(), request, &loader, &client);
 
   // Try to dispatch fetch event to the bad worker.
@@ -630,7 +632,7 @@
   network::ResourceRequest request =
       CreateRequest(GURL("https://www.example.com/foo.png"));
   network::mojom::URLLoaderPtr loader;
-  std::unique_ptr<TestURLLoaderClient> client;
+  std::unique_ptr<network::TestURLLoaderClient> client;
   StartRequest(factory.get(), request, &loader, &client);
   client->RunUntilResponseReceived();
 
@@ -679,7 +681,7 @@
   network::ResourceRequest request =
       CreateRequest(GURL("https://www.example.com/foo.png"));
   network::mojom::URLLoaderPtr loader;
-  std::unique_ptr<TestURLLoaderClient> client;
+  std::unique_ptr<network::TestURLLoaderClient> client;
   StartRequest(factory.get(), request, &loader, &client);
   client->RunUntilComplete();
 
@@ -698,7 +700,7 @@
   network::ResourceRequest request =
       CreateRequest(GURL("https://www.example.com/foo.png"));
   network::mojom::URLLoaderPtr loader;
-  std::unique_ptr<TestURLLoaderClient> client;
+  std::unique_ptr<network::TestURLLoaderClient> client;
   StartRequest(factory.get(), request, &loader, &client);
   client->RunUntilComplete();
 
@@ -715,7 +717,7 @@
   network::ResourceRequest request =
       CreateRequest(GURL("https://www.example.com/foo.png"));
   network::mojom::URLLoaderPtr loader;
-  std::unique_ptr<TestURLLoaderClient> client;
+  std::unique_ptr<network::TestURLLoaderClient> client;
   StartRequest(factory.get(), request, &loader, &client);
   client->RunUntilRedirectReceived();
 
@@ -791,7 +793,7 @@
   network::ResourceRequest request =
       CreateRequest(GURL("https://www.example.com/foo.png"));
   network::mojom::URLLoaderPtr loader;
-  std::unique_ptr<TestURLLoaderClient> client;
+  std::unique_ptr<network::TestURLLoaderClient> client;
   StartRequest(factory.get(), request, &loader, &client);
 
   // The Fetch spec says: "If request’s redirect count is twenty, return a
@@ -882,7 +884,7 @@
     request.fetch_request_mode = test.fetch_request_mode;
     request.request_initiator = test.request_initiator;
     network::mojom::URLLoaderPtr loader;
-    std::unique_ptr<TestURLLoaderClient> client;
+    std::unique_ptr<network::TestURLLoaderClient> client;
     StartRequest(factory.get(), request, &loader, &client);
     client->RunUntilResponseReceived();
 
diff --git a/content/renderer/service_worker/service_worker_timeout_timer.cc b/content/renderer/service_worker/service_worker_timeout_timer.cc
index 2bca894..b9684232 100644
--- a/content/renderer/service_worker/service_worker_timeout_timer.cc
+++ b/content/renderer/service_worker/service_worker_timeout_timer.cc
@@ -8,6 +8,7 @@
 #include "base/time/default_tick_clock.h"
 #include "base/time/time.h"
 #include "content/common/service_worker/service_worker_utils.h"
+#include "services/network/public/cpp/features.h"
 
 namespace content {
 
diff --git a/content/renderer/service_worker/service_worker_timeout_timer_unittest.cc b/content/renderer/service_worker/service_worker_timeout_timer_unittest.cc
index f0d370b0..c4aa6b4 100644
--- a/content/renderer/service_worker/service_worker_timeout_timer_unittest.cc
+++ b/content/renderer/service_worker/service_worker_timeout_timer_unittest.cc
@@ -11,7 +11,7 @@
 #include "base/test/test_mock_time_task_runner.h"
 #include "base/time/tick_clock.h"
 #include "content/common/service_worker/service_worker_utils.h"
-#include "content/public/common/content_features.h"
+#include "services/network/public/cpp/features.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace content {
@@ -58,7 +58,7 @@
   }
 
   void EnableServicification() {
-    feature_list_.InitWithFeatures({features::kNetworkService}, {});
+    feature_list_.InitWithFeatures({network::features::kNetworkService}, {});
     ASSERT_TRUE(ServiceWorkerUtils::IsServicificationEnabled());
   }
 
diff --git a/content/shell/BUILD.gn b/content/shell/BUILD.gn
index 6b835ddf..8b965f6 100644
--- a/content/shell/BUILD.gn
+++ b/content/shell/BUILD.gn
@@ -217,10 +217,10 @@
     "//content/public/child",
     "//content/public/common",
     "//content/public/gpu",
-    "//content/public/network",
     "//content/public/renderer",
     "//content/public/utility",
     "//ipc",
+    "//services/network/public/cpp",
   ]
   deps = [
     ":content_shell_packaged_services_manifest_overlay",
diff --git a/content/shell/browser/layout_test/layout_test_url_request_context_getter.cc b/content/shell/browser/layout_test/layout_test_url_request_context_getter.cc
index 8968db0d..058c5d83 100644
--- a/content/shell/browser/layout_test/layout_test_url_request_context_getter.cc
+++ b/content/shell/browser/layout_test/layout_test_url_request_context_getter.cc
@@ -10,11 +10,11 @@
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
 #include "content/public/browser/browser_thread.h"
-#include "content/public/network/ignore_errors_cert_verifier.h"
 #include "content/shell/browser/shell_network_delegate.h"
 #include "content/shell/common/layout_test/layout_test_switches.h"
 #include "net/cert/cert_verifier.h"
 #include "net/proxy_resolution/proxy_service.h"
+#include "services/network/public/cpp/ignore_errors_cert_verifier.h"
 
 namespace content {
 
@@ -48,7 +48,7 @@
 
 std::unique_ptr<net::CertVerifier>
 LayoutTestURLRequestContextGetter::GetCertVerifier() {
-  return IgnoreErrorsCertVerifier::MaybeWrapCertVerifier(
+  return network::IgnoreErrorsCertVerifier::MaybeWrapCertVerifier(
       *base::CommandLine::ForCurrentProcess(), switches::kRunLayoutTest,
       net::CertVerifier::CreateDefault());
 }
diff --git a/content/shell/test_runner/BUILD.gn b/content/shell/test_runner/BUILD.gn
index 5bb641e3..7915ed2 100644
--- a/content/shell/test_runner/BUILD.gn
+++ b/content/shell/test_runner/BUILD.gn
@@ -101,8 +101,10 @@
     "//cc/paint",
     "//components/viz/common",
     "//content/public/common",
+    "//content/public/renderer",
     "//content/test:test_runner_support",
     "//device/gamepad/public/cpp:shared_with_blink",
+    "//device/screen_orientation/public/interfaces",
     "//device/sensors/public/cpp:full",
     "//gin",
     "//gpu",
diff --git a/content/shell/test_runner/DEPS b/content/shell/test_runner/DEPS
index 90735ea..2b387822 100644
--- a/content/shell/test_runner/DEPS
+++ b/content/shell/test_runner/DEPS
@@ -3,6 +3,7 @@
   "+content/public/test",
   "+device/gamepad/public/cpp",
   "+device/sensors/public/cpp",
+  "+device/screen_orientation/public/interfaces",
   "+gin",
   "+gpu/command_buffer/client",
   "+media/midi/midi_service.mojom.h",
@@ -17,4 +18,4 @@
   "+ui/events",
   "+ui/gfx",
   "+v8/include",
-]
\ No newline at end of file
+]
diff --git a/content/shell/test_runner/mock_screen_orientation_client.cc b/content/shell/test_runner/mock_screen_orientation_client.cc
index ce5be4f7..d7be85c4 100644
--- a/content/shell/test_runner/mock_screen_orientation_client.cc
+++ b/content/shell/test_runner/mock_screen_orientation_client.cc
@@ -10,6 +10,8 @@
 #include "base/logging.h"
 #include "base/single_thread_task_runner.h"
 #include "base/threading/thread_task_runner_handle.h"
+#include "content/public/renderer/render_frame.h"
+#include "third_party/WebKit/common/associated_interfaces/associated_interface_provider.h"
 #include "third_party/WebKit/public/web/WebLocalFrame.h"
 
 namespace test_runner {
@@ -24,16 +26,19 @@
 MockScreenOrientationClient::~MockScreenOrientationClient() {}
 
 void MockScreenOrientationClient::ResetData() {
+  main_frame_ = nullptr;
   current_lock_ = blink::kWebScreenOrientationLockDefault;
   device_orientation_ = blink::kWebScreenOrientationPortraitPrimary;
   current_orientation_ = blink::kWebScreenOrientationPortraitPrimary;
   is_disabled_ = false;
+  bindings_.CloseAllBindings();
 }
 
 void MockScreenOrientationClient::UpdateDeviceOrientation(
     blink::WebLocalFrame* main_frame,
     blink::WebScreenOrientationType orientation) {
   main_frame_ = main_frame;
+
   if (device_orientation_ == orientation)
     return;
   device_orientation_ = orientation;
@@ -114,13 +119,35 @@
   }
 }
 
+void MockScreenOrientationClient::AddBinding(
+    mojo::ScopedInterfaceEndpointHandle handle) {
+  bindings_.AddBinding(this, device::mojom::ScreenOrientationAssociatedRequest(
+                                 std::move(handle)));
+}
+
+void MockScreenOrientationClient::OverrideAssociatedInterfaceProviderForFrame(
+    blink::WebLocalFrame* frame) {
+  if (!frame)
+    return;
+
+  content::RenderFrame* render_frame =
+      content::RenderFrame::FromWebFrame(frame);
+  blink::AssociatedInterfaceProvider* provider =
+      render_frame->GetRemoteAssociatedInterfaces();
+
+  provider->OverrideBinderForTesting(
+      device::mojom::ScreenOrientation::Name_,
+      base::BindRepeating(&MockScreenOrientationClient::AddBinding,
+                          base::Unretained(this)));
+}
+
 void MockScreenOrientationClient::LockOrientation(
     blink::WebScreenOrientationLockType orientation,
-    std::unique_ptr<blink::WebLockOrientationCallback> callback) {
+    LockOrientationCallback callback) {
   base::ThreadTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE, base::BindOnce(&MockScreenOrientationClient::UpdateLockSync,
-                                base::Unretained(this), orientation,
-                                base::Passed(&callback)));
+      FROM_HERE,
+      base::BindOnce(&MockScreenOrientationClient::UpdateLockSync,
+                     base::Unretained(this), orientation, std::move(callback)));
 }
 
 void MockScreenOrientationClient::UnlockOrientation() {
@@ -131,12 +158,13 @@
 
 void MockScreenOrientationClient::UpdateLockSync(
     blink::WebScreenOrientationLockType lock,
-    std::unique_ptr<blink::WebLockOrientationCallback> callback) {
+    LockOrientationCallback callback) {
   DCHECK(lock != blink::kWebScreenOrientationLockDefault);
   current_lock_ = lock;
   if (!IsOrientationAllowedByCurrentLock(current_orientation_))
     UpdateScreenOrientation(SuitableOrientationForCurrentLock());
-  callback->OnSuccess();
+  std::move(callback).Run(device::mojom::ScreenOrientationLockResult::
+                              SCREEN_ORIENTATION_LOCK_RESULT_SUCCESS);
 }
 
 void MockScreenOrientationClient::ResetLockSync() {
diff --git a/content/shell/test_runner/mock_screen_orientation_client.h b/content/shell/test_runner/mock_screen_orientation_client.h
index 726c814..ae19f61 100644
--- a/content/shell/test_runner/mock_screen_orientation_client.h
+++ b/content/shell/test_runner/mock_screen_orientation_client.h
@@ -10,8 +10,10 @@
 #include "base/compiler_specific.h"
 #include "base/macros.h"
 #include "content/shell/test_runner/test_runner_export.h"
+#include "device/screen_orientation/public/interfaces/screen_orientation.mojom.h"
+#include "mojo/public/cpp/bindings/associated_binding_set.h"
+#include "mojo/public/cpp/bindings/scoped_interface_endpoint_handle.h"
 #include "third_party/WebKit/public/platform/modules/screen_orientation/WebLockOrientationCallback.h"
-#include "third_party/WebKit/public/platform/modules/screen_orientation/WebScreenOrientationClient.h"
 #include "third_party/WebKit/public/platform/modules/screen_orientation/WebScreenOrientationLockType.h"
 #include "third_party/WebKit/public/platform/modules/screen_orientation/WebScreenOrientationType.h"
 
@@ -22,7 +24,7 @@
 namespace test_runner {
 
 class TEST_RUNNER_EXPORT MockScreenOrientationClient
-    : public blink::WebScreenOrientationClient {
+    : public device::mojom::ScreenOrientation {
  public:
   explicit MockScreenOrientationClient();
   ~MockScreenOrientationClient() override;
@@ -36,15 +38,17 @@
   bool IsDisabled() const { return is_disabled_; }
   void SetDisabled(bool disabled);
 
- private:
-  // From blink::WebScreenOrientationClient.
-  void LockOrientation(
-      blink::WebScreenOrientationLockType orientation,
-      std::unique_ptr<blink::WebLockOrientationCallback> callback) override;
+  void AddBinding(mojo::ScopedInterfaceEndpointHandle handle);
+  void OverrideAssociatedInterfaceProviderForFrame(blink::WebLocalFrame* frame);
+
+  // device::mojom::ScreenOrientation implementation.
+  void LockOrientation(blink::WebScreenOrientationLockType orientation,
+                       LockOrientationCallback callback) override;
   void UnlockOrientation() override;
 
+ private:
   void UpdateLockSync(blink::WebScreenOrientationLockType,
-                      std::unique_ptr<blink::WebLockOrientationCallback>);
+                      LockOrientationCallback callback);
   void ResetLockSync();
 
   void UpdateScreenOrientation(blink::WebScreenOrientationType);
@@ -57,6 +61,7 @@
   blink::WebScreenOrientationType device_orientation_;
   blink::WebScreenOrientationType current_orientation_;
   bool is_disabled_;
+  mojo::AssociatedBindingSet<device::mojom::ScreenOrientation> bindings_;
 
   DISALLOW_COPY_AND_ASSIGN(MockScreenOrientationClient);
 };
diff --git a/content/shell/test_runner/test_runner.cc b/content/shell/test_runner/test_runner.cc
index 2b4236a..ab33773 100644
--- a/content/shell/test_runner/test_runner.cc
+++ b/content/shell/test_runner/test_runner.cc
@@ -1577,6 +1577,8 @@
     base::WeakPtr<TestRunnerForSpecificView> view_test_runner) {
   TestRunnerBindings::Install(weak_factory_.GetWeakPtr(), view_test_runner,
                               frame, is_web_platform_tests_mode());
+  mock_screen_orientation_client_->OverrideAssociatedInterfaceProviderForFrame(
+      frame);
 }
 
 void TestRunner::SetDelegate(WebTestDelegate* delegate) {
diff --git a/content/shell/test_runner/web_frame_test_client.cc b/content/shell/test_runner/web_frame_test_client.cc
index ce29430b..c99d87b 100644
--- a/content/shell/test_runner/web_frame_test_client.cc
+++ b/content/shell/test_runner/web_frame_test_client.cc
@@ -213,11 +213,6 @@
   return !test_runner()->shouldStayOnPageAfterHandlingBeforeUnload();
 }
 
-blink::WebScreenOrientationClient*
-WebFrameTestClient::GetWebScreenOrientationClient() {
-  return test_runner()->getMockScreenOrientationClient();
-}
-
 void WebFrameTestClient::PostAccessibilityEvent(const blink::WebAXObject& obj,
                                                 blink::WebAXEvent event) {
   // Only hook the accessibility events occured during the test run.
diff --git a/content/shell/test_runner/web_frame_test_client.h b/content/shell/test_runner/web_frame_test_client.h
index 5c87e37..7f03f93d 100644
--- a/content/shell/test_runner/web_frame_test_client.h
+++ b/content/shell/test_runner/web_frame_test_client.h
@@ -39,7 +39,6 @@
                             const blink::WebString& default_value,
                             blink::WebString* actual_value) override;
   bool RunModalBeforeUnloadDialog(bool is_reload) override;
-  blink::WebScreenOrientationClient* GetWebScreenOrientationClient() override;
   void PostAccessibilityEvent(const blink::WebAXObject& object,
                               blink::WebAXEvent event) override;
   void DidChangeSelection(bool is_selection_empty) override;
diff --git a/content/shell/test_runner/web_frame_test_proxy.h b/content/shell/test_runner/web_frame_test_proxy.h
index c8683019..bad25cbd 100644
--- a/content/shell/test_runner/web_frame_test_proxy.h
+++ b/content/shell/test_runner/web_frame_test_proxy.h
@@ -67,10 +67,6 @@
     return Base::CreatePlugin(params);
   }
 
-  blink::WebScreenOrientationClient* GetWebScreenOrientationClient() override {
-    return test_client()->GetWebScreenOrientationClient();
-  }
-
   void DidAddMessageToConsole(const blink::WebConsoleMessage& message,
                               const blink::WebString& source_name,
                               unsigned source_line,
diff --git a/content/test/BUILD.gn b/content/test/BUILD.gn
index e7428e7..cb4a48a 100644
--- a/content/test/BUILD.gn
+++ b/content/test/BUILD.gn
@@ -157,8 +157,6 @@
     "../public/test/test_storage_partition.h",
     "../public/test/test_synchronous_compositor_android.cc",
     "../public/test/test_synchronous_compositor_android.h",
-    "../public/test/test_url_loader_client.cc",
-    "../public/test/test_url_loader_client.h",
     "../public/test/test_utils.cc",
     "../public/test/test_utils.h",
     "../public/test/test_web_contents_factory.h",
@@ -323,6 +321,10 @@
     "//mojo/edk/system",
     "//net:test_support",
     "//services/device/public/interfaces",
+
+    # TODO(jam): remove this by adding a public header for the NetworkContext
+    # public testing method.
+    "//services/network:network_service",
     "//services/network:test_support",
     "//services/network/public/interfaces:interfaces",
     "//services/proxy_resolver:lib",
@@ -889,6 +891,7 @@
     "//services/device/public/cpp/generic_sensor",
     "//services/device/public/interfaces",
     "//services/device/public/interfaces:generic_sensor",
+    "//services/network:test_support",
     "//services/service_manager/public/cpp",
     "//services/test/echo/public/interfaces",
     "//services/ui/public/cpp/gpu",
@@ -1519,22 +1522,16 @@
     "../common/throttling_url_loader_unittest.cc",
     "../common/unique_name_helper_unittest.cc",
     "../common/webplugininfo_unittest.cc",
+
+    # TODO(jam): move these network/ tests to services/network.
     "../network/cors/cors_url_loader_unittest.cc",
-    "../network/data_pipe_element_reader_unittest.cc",
-    "../network/network_change_manager_unittest.cc",
-    "../network/network_context_unittest.cc",
     "../network/network_service_unittest.cc",
-    "../network/proxy_resolver_factory_mojo_unittest.cc",
     "../network/resource_scheduler_unittest.cc",
-    "../network/restricted_cookie_manager_unittest.cc",
-    "../network/throttling/throttling_controller_unittest.cc",
-    "../network/upload_progress_tracker_unittest.cc",
     "../network/url_loader_unittest.cc",
     "../public/common/drop_data_unittest.cc",
     "../public/common/network_connection_tracker_unittest.cc",
     "../public/common/simple_url_loader_unittest.cc",
     "../public/common/url_utils_unittest.cc",
-    "../public/network/ignore_errors_cert_verifier_unittest.cc",
     "../public/test/referrer_unittest.cc",
     "../public/test/test_browser_thread_bundle_unittest.cc",
     "../renderer/android/disambiguation_popup_helper_unittest.cc",
@@ -1588,7 +1585,6 @@
     "../renderer/presentation/test_presentation_connection.h",
     "../renderer/render_thread_impl_unittest.cc",
     "../renderer/render_widget_unittest.cc",
-    "../renderer/screen_orientation/screen_orientation_dispatcher_unittest.cc",
     "../renderer/service_worker/service_worker_context_client_unittest.cc",
     "../renderer/service_worker/service_worker_dispatcher_unittest.cc",
     "../renderer/service_worker/service_worker_provider_context_unittest.cc",
@@ -1675,7 +1671,6 @@
     "//content/public/child",
     "//content/public/common",
     "//content/public/common:service_names",
-    "//content/public/network",
     "//content/public/renderer",
     "//content/renderer:for_content_tests",
     "//crypto",
@@ -1714,6 +1709,10 @@
     "//services/file/public/interfaces",
     "//services/metrics/public/cpp:ukm_builders",
     "//services/metrics/public/interfaces",
+
+    # TODO(jam): remove once the remaining tests in content/network are moved to
+    # services/network.
+    "//services/network:network_service",
     "//services/network:test_support",
     "//services/network/public/cpp",
     "//services/network/public/cpp:network_features",
@@ -2052,8 +2051,8 @@
   name = "content_unittests"
   source = "unittests_manifest.json"
   packaged_services = [
-    "//content/network:manifest",
     "//services/file:manifest",
+    "//services/network:manifest",
   ]
 }
 
diff --git a/content/test/DEPS b/content/test/DEPS
index ea8425c..ca587cf6 100644
--- a/content/test/DEPS
+++ b/content/test/DEPS
@@ -34,6 +34,9 @@
   # For TestMojoProxyResolverFactory. Remove once it moves to the network
   # service.
   "+services/service_manager/public/cpp/service_context_ref.h",
+
+  # For ProxyServiceMojoTest. Remove once it moves to the network service.
+  "+services/network/proxy_service_mojo.h",
 ]
 
 specific_include_rules = {
diff --git a/content/test/mock_webassociatedurlloader.h b/content/test/mock_webassociatedurlloader.h
index 69677d1..413ce32 100644
--- a/content/test/mock_webassociatedurlloader.h
+++ b/content/test/mock_webassociatedurlloader.h
@@ -6,6 +6,7 @@
 #define CONTENT_TEST_MOCK_WEBASSOCIATEDURLLOADER_H_
 
 #include "base/macros.h"
+#include "base/single_thread_task_runner.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "third_party/WebKit/public/web/WebAssociatedURLLoader.h"
 
@@ -22,7 +23,7 @@
   MOCK_METHOD0(Cancel, void());
   MOCK_METHOD1(SetDefersLoading, void(bool value));
   MOCK_METHOD1(SetLoadingTaskRunner,
-               void(blink::WebTaskRunner* loading_task_runner));
+               void(base::SingleThreadTaskRunner* loading_task_runner));
 
  private:
   DISALLOW_COPY_AND_ASSIGN(MockWebAssociatedURLLoader);
diff --git a/content/test/proxy_service_mojo_unittest.cc b/content/test/proxy_service_mojo_unittest.cc
index b20b51c..2055ab4 100644
--- a/content/test/proxy_service_mojo_unittest.cc
+++ b/content/test/proxy_service_mojo_unittest.cc
@@ -13,7 +13,6 @@
 #include "base/test/scoped_task_environment.h"
 #include "base/values.h"
 #include "build/build_config.h"
-#include "content/network/proxy_service_mojo.h"
 #include "content/test/test_mojo_proxy_resolver_factory.h"
 #include "net/base/network_delegate_impl.h"
 #include "net/base/test_completion_callback.h"
@@ -28,6 +27,7 @@
 #include "net/proxy_resolution/proxy_service.h"
 #include "net/test/event_waiter.h"
 #include "net/test/gtest_util.h"
+#include "services/network/proxy_service_mojo.h"
 #include "services/proxy_resolver/public/interfaces/proxy_resolver.mojom.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -131,7 +131,7 @@
     mock_host_resolver_.rules()->AddRule("example.com", "1.2.3.4");
 
     fetcher_ = new net::MockProxyScriptFetcher;
-    proxy_resolution_service_ = CreateProxyServiceUsingMojoFactory(
+    proxy_resolution_service_ = network::CreateProxyServiceUsingMojoFactory(
         test_mojo_proxy_resolver_factory_.CreateFactoryInterface(),
         std::make_unique<net::ProxyConfigServiceFixed>(
             net::ProxyConfig::CreateFromCustomPacURL(GURL(kPacUrl))),
diff --git a/content/test/url_loader_interceptor_test.cc b/content/test/url_loader_interceptor_test.cc
index 195f0a5..b9d7c51 100644
--- a/content/test/url_loader_interceptor_test.cc
+++ b/content/test/url_loader_interceptor_test.cc
@@ -9,13 +9,13 @@
 #include "base/threading/thread_task_runner_handle.h"
 #include "build/build_config.h"
 #include "content/public/common/browser_side_navigation_policy.h"
-#include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_utils.h"
 #include "content/shell/browser/shell.h"
+#include "services/network/public/cpp/features.h"
 
 namespace content {
 namespace {
@@ -56,7 +56,7 @@
 }
 
 IN_PROC_BROWSER_TEST_F(URLLoaderInterceptorTest, MonitorFrame) {
-  if (!base::FeatureList::IsEnabled(features::kNetworkService))
+  if (!base::FeatureList::IsEnabled(network::features::kNetworkService))
     return;  // Depends on http://crbug.com/747130.
 
   bool seen = false;
@@ -76,7 +76,7 @@
 }
 
 IN_PROC_BROWSER_TEST_F(URLLoaderInterceptorTest, InterceptFrame) {
-  if (!base::FeatureList::IsEnabled(features::kNetworkService))
+  if (!base::FeatureList::IsEnabled(network::features::kNetworkService))
     return;  // Depends on http://crbug.com/747130.
 
   GURL url = GetPageURL();
diff --git a/content/test/url_request_context_builder_mojo_unittest.cc b/content/test/url_request_context_builder_mojo_unittest.cc
index a4167947..8254eea 100644
--- a/content/test/url_request_context_builder_mojo_unittest.cc
+++ b/content/test/url_request_context_builder_mojo_unittest.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/public/network/url_request_context_builder_mojo.h"
+#include "services/network/public/cpp/url_request_context_builder_mojo.h"
 
 #include "base/run_loop.h"
 #include "base/strings/stringprintf.h"
@@ -57,7 +57,7 @@
   base::test::ScopedTaskEnvironment task_environment_;
   TestMojoProxyResolverFactory test_mojo_proxy_resolver_factory_;
   net::EmbeddedTestServer test_server_;
-  URLRequestContextBuilderMojo builder_;
+  network::URLRequestContextBuilderMojo builder_;
 };
 
 TEST_F(URLRequestContextBuilderMojoTest, MojoProxyResolver) {
diff --git a/content/utility/BUILD.gn b/content/utility/BUILD.gn
index c3ce6de5..68a95c4 100644
--- a/content/utility/BUILD.gn
+++ b/content/utility/BUILD.gn
@@ -41,6 +41,7 @@
     "//sandbox",
     "//services/data_decoder:lib",
     "//services/data_decoder/public/cpp",
+    "//services/network:network_service",
     "//services/service_manager",
     "//services/service_manager/public/cpp",
     "//services/service_manager/public/interfaces",
diff --git a/content/utility/DEPS b/content/utility/DEPS
index b10de6b..a77eeb6 100644
--- a/content/utility/DEPS
+++ b/content/utility/DEPS
@@ -1,8 +1,8 @@
 include_rules = [
   "+content/child",
-  "+content/network",
   "+content/public/utility",
   "+services/data_decoder",
+  "+services/network",
   "+services/service_manager",
   "+services/shape_detection",
   "+services/video_capture",
diff --git a/content/utility/utility_main.cc b/content/utility/utility_main.cc
index 856bf88b..890477a 100644
--- a/content/utility/utility_main.cc
+++ b/content/utility/utility_main.cc
@@ -20,7 +20,7 @@
 #include "services/service_manager/sandbox/sandbox.h"
 
 #if defined(OS_LINUX)
-#include "content/network/network_sandbox_hook_linux.h"
+#include "services/network/network_sandbox_hook_linux.h"
 #include "services/service_manager/sandbox/linux/sandbox_linux.h"
 #endif
 
@@ -56,7 +56,7 @@
       sandbox_type == service_manager::SANDBOX_TYPE_NETWORK) {
     service_manager::SandboxLinux::PreSandboxHook pre_sandbox_hook;
     if (sandbox_type == service_manager::SANDBOX_TYPE_NETWORK)
-      pre_sandbox_hook = base::BindOnce(&NetworkPreSandboxHook);
+      pre_sandbox_hook = base::BindOnce(&network::NetworkPreSandboxHook);
     service_manager::Sandbox::Initialize(
         sandbox_type, std::move(pre_sandbox_hook),
         service_manager::SandboxLinux::Options());
diff --git a/content/utility/utility_service_factory.cc b/content/utility/utility_service_factory.cc
index 8bb087b..ab97ac8 100644
--- a/content/utility/utility_service_factory.cc
+++ b/content/utility/utility_service_factory.cc
@@ -11,7 +11,6 @@
 #include "base/trace_event/trace_log.h"
 #include "build/build_config.h"
 #include "content/child/child_process.h"
-#include "content/network/network_service_impl.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
@@ -22,6 +21,8 @@
 #include "media/media_features.h"
 #include "services/data_decoder/data_decoder_service.h"
 #include "services/data_decoder/public/interfaces/constants.mojom.h"
+#include "services/network/network_service_impl.h"
+#include "services/network/public/cpp/features.h"
 #include "services/service_manager/public/interfaces/service.mojom.h"
 #include "services/shape_detection/public/interfaces/constants.mojom.h"
 #include "services/shape_detection/shape_detection_service.h"
@@ -149,7 +150,7 @@
   viz_info.factory = base::Bind(&CreateVizService);
   services->insert(std::make_pair(viz::mojom::kVizServiceName, viz_info));
 
-  if (base::FeatureList::IsEnabled(features::kNetworkService)) {
+  if (base::FeatureList::IsEnabled(network::features::kNetworkService)) {
     GetContentClient()->utility()->RegisterNetworkBinders(
         network_registry_.get());
     service_manager::EmbeddedServiceInfo network_info;
@@ -174,7 +175,8 @@
 
 std::unique_ptr<service_manager::Service>
 UtilityServiceFactory::CreateNetworkService() {
-  return std::make_unique<NetworkServiceImpl>(std::move(network_registry_));
+  return std::make_unique<network::NetworkServiceImpl>(
+      std::move(network_registry_));
 }
 
 }  // namespace content
diff --git a/extensions/common/extension_features.cc b/extensions/common/extension_features.cc
index bcb9ccd..c1dc84d0 100644
--- a/extensions/common/extension_features.cc
+++ b/extensions/common/extension_features.cc
@@ -16,8 +16,9 @@
     "NewExtensionUpdaterService", base::FEATURE_DISABLED_BY_DEFAULT};
 
 // Enables splitting content script injections into multiple tasks.
+// TODO(ksakamoto): Remove this feature flag in M67.
 const base::Feature kYieldBetweenContentScriptRuns{
-    "YieldBetweenContentScriptRuns", base::FEATURE_DISABLED_BY_DEFAULT};
+    "YieldBetweenContentScriptRuns", base::FEATURE_ENABLED_BY_DEFAULT};
 
 }  // namespace features
 }  // namespace extensions
diff --git a/gpu/command_buffer/service/texture_manager.cc b/gpu/command_buffer/service/texture_manager.cc
index 30d3c7fe..72e3ef8 100644
--- a/gpu/command_buffer/service/texture_manager.cc
+++ b/gpu/command_buffer/service/texture_manager.cc
@@ -2659,9 +2659,6 @@
     TextureRef* texture_ref,
     const char* function_name,
     const DoTexImageArguments& args) {
-  // This workaround code does not work with an unpack buffer bound.
-  ScopedResetPixelUnpackBuffer scoped_reset_pbo(state);
-
   std::vector<GLenum> undefined_faces;
   Texture* texture = texture_ref->texture();
   if (texture_state->force_cube_complete ||
@@ -2693,6 +2690,8 @@
   DoTexImageArguments new_args = args;
   std::unique_ptr<char[]> zero(new char[args.pixels_size]);
   memset(zero.get(), 0, args.pixels_size);
+  // Need to clear PIXEL_UNPACK_BUFFER and UNPACK params for data uploading.
+  state->PushTextureUnpackState();
   for (GLenum face : undefined_faces) {
     new_args.target = face;
     new_args.pixels = zero.get();
@@ -2700,6 +2699,7 @@
                function_name, texture_ref, new_args);
     texture->MarkLevelAsInternalWorkaround(face, args.level);
   }
+  state->RestoreUnpackState();
 }
 
 void TextureManager::ValidateAndDoTexImage(
diff --git a/media/blink/mock_webassociatedurlloader.h b/media/blink/mock_webassociatedurlloader.h
index 8b3a4e0..1cfaaa0 100644
--- a/media/blink/mock_webassociatedurlloader.h
+++ b/media/blink/mock_webassociatedurlloader.h
@@ -6,6 +6,7 @@
 #define MEDIA_BLINK_MOCK_WEBASSOCIATEDURLLOADER_H_
 
 #include "base/macros.h"
+#include "base/single_thread_task_runner.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "third_party/WebKit/public/web/WebAssociatedURLLoader.h"
 
@@ -21,7 +22,8 @@
                     blink::WebAssociatedURLLoaderClient* client));
   MOCK_METHOD0(Cancel, void());
   MOCK_METHOD1(SetDefersLoading, void(bool value));
-  MOCK_METHOD1(SetLoadingTaskRunner, void(blink::WebTaskRunner* task_runner));
+  MOCK_METHOD1(SetLoadingTaskRunner,
+               void(base::SingleThreadTaskRunner* task_runner));
 
  private:
   DISALLOW_COPY_AND_ASSIGN(MockWebAssociatedURLLoader);
diff --git a/media/cast/sender/external_video_encoder.cc b/media/cast/sender/external_video_encoder.cc
index 4a68d0e9..6f839e7a 100644
--- a/media/cast/sender/external_video_encoder.cc
+++ b/media/cast/sender/external_video_encoder.cc
@@ -141,8 +141,10 @@
     DCHECK(task_runner_->RunsTasksInCurrentSequence());
 
     requested_bit_rate_ = bit_rate;
-    video_encode_accelerator_->RequestEncodingParametersChange(
-        bit_rate, static_cast<uint32_t>(max_frame_rate_ + 0.5));
+    if (encoder_active_) {
+      video_encode_accelerator_->RequestEncodingParametersChange(
+          bit_rate, static_cast<uint32_t>(max_frame_rate_ + 0.5));
+    }
   }
 
   // The destruction call back of the copied video frame to free its use of
@@ -161,13 +163,15 @@
       const VideoEncoder::FrameEncodedCallback& frame_encoded_callback) {
     DCHECK(task_runner_->RunsTasksInCurrentSequence());
 
-    if (!encoder_active_)
-      return;
-
     in_progress_frame_encodes_.push_back(InProgressFrameEncode(
         video_frame, reference_time, frame_encoded_callback,
         requested_bit_rate_));
 
+    if (!encoder_active_) {
+      ExitEncodingWithErrors();
+      return;
+    }
+
     scoped_refptr<media::VideoFrame> frame = video_frame;
     if (video_frame->coded_size() != frame_coded_size_) {
       DCHECK_GE(frame_coded_size_.width(), video_frame->visible_rect().width());
@@ -394,22 +398,28 @@
 
     // We need to re-add the output buffer to the encoder after we are done
     // with it.
-    video_encode_accelerator_->UseOutputBitstreamBuffer(media::BitstreamBuffer(
-        bitstream_buffer_id,
-        output_buffers_[bitstream_buffer_id]->handle(),
-        output_buffers_[bitstream_buffer_id]->mapped_size()));
+    if (encoder_active_) {
+      video_encode_accelerator_->UseOutputBitstreamBuffer(
+          media::BitstreamBuffer(
+              bitstream_buffer_id,
+              output_buffers_[bitstream_buffer_id]->handle(),
+              output_buffers_[bitstream_buffer_id]->mapped_size()));
+    }
   }
 
  private:
   friend class base::RefCountedThreadSafe<VEAClientImpl>;
 
   ~VEAClientImpl() final {
+    DCHECK(task_runner_->RunsTasksInCurrentSequence());
+
+    while (!in_progress_frame_encodes_.empty())
+      ExitEncodingWithErrors();
+
     // According to the media::VideoEncodeAccelerator interface, Destroy()
     // should be called instead of invoking its private destructor.
-    task_runner_->PostTask(
-        FROM_HERE,
-        base::Bind(&media::VideoEncodeAccelerator::Destroy,
-                   base::Unretained(video_encode_accelerator_.release())));
+    if (video_encode_accelerator_)
+      video_encode_accelerator_.release()->Destroy();
   }
 
   // Note: This method can be called on any thread.
@@ -470,7 +480,9 @@
   // Parse H264 SPS, PPS, and Slice header, and return the averaged frame
   // quantizer in the range of [0, 51], or -1 on parse error.
   double GetH264FrameQuantizer(const uint8_t* encoded_data, off_t size) {
+    DCHECK(task_runner_->RunsTasksInCurrentSequence());
     DCHECK(encoded_data);
+
     if (!size)
       return -1;
     h264_parser_.SetStream(encoded_data, size);
@@ -619,7 +631,17 @@
                  status_change_cb));
 }
 
-ExternalVideoEncoder::~ExternalVideoEncoder() = default;
+ExternalVideoEncoder::~ExternalVideoEncoder() {
+  DCHECK(cast_environment_->CurrentlyOn(CastEnvironment::MAIN));
+
+  // Ensure |client_| is destroyed from the encoder task runner by dropping the
+  // reference to it within an encoder task.
+  if (client_) {
+    client_->task_runner()->PostTask(
+        FROM_HERE, base::BindOnce([](scoped_refptr<VEAClientImpl> client) {},
+                                  std::move(client_)));
+  }
+}
 
 bool ExternalVideoEncoder::EncodeVideoFrame(
     const scoped_refptr<media::VideoFrame>& video_frame,
diff --git a/net/http/http_network_session.cc b/net/http/http_network_session.cc
index 780cbe1..2e18369 100644
--- a/net/http/http_network_session.cc
+++ b/net/http/http_network_session.cc
@@ -131,7 +131,7 @@
       quic_max_migrations_to_non_default_network_on_path_degrading(
           kMaxMigrationsToNonDefaultNetworkOnPathDegrading),
       quic_allow_server_migration(false),
-      quic_allow_remote_alt_svc(false),
+      quic_allow_remote_alt_svc(true),
       quic_disable_bidirectional_streams(false),
       quic_force_hol_blocking(false),
       quic_race_cert_verification(false),
@@ -140,7 +140,7 @@
       enable_token_binding(false),
       http_09_on_non_default_ports_enabled(false),
       disable_idle_sockets_close_on_memory_pressure(false) {
-  quic_supported_versions.push_back(QUIC_VERSION_39);
+  quic_supported_versions.push_back(QUIC_VERSION_41);
 }
 
 HttpNetworkSession::Params::Params(const Params& other) = default;
diff --git a/net/http/http_server_properties_manager_unittest.cc b/net/http/http_server_properties_manager_unittest.cc
index 20e835cf0..6e6492a 100644
--- a/net/http/http_server_properties_manager_unittest.cc
+++ b/net/http/http_server_properties_manager_unittest.cc
@@ -1373,7 +1373,7 @@
       "\"expiration\":\"13758804000000000\",\"host\":\"www.google.com\","
       "\"port\":1234,\"protocol_str\":\"h2\"}]}},"
       "{\"https://mail.google.com:80\":{\"alternative_service\":[{"
-      "\"advertised_versions\":[39],\"expiration\":\"9223372036854775807\","
+      "\"advertised_versions\":[41],\"expiration\":\"9223372036854775807\","
       "\"host\":\"foo.google.com\",\"port\":444,\"protocol_str\":\"quic\"}],"
       "\"network_stats\":{\"srtt\":42}}}],\"supports_quic\":{"
       "\"address\":\"127.0.0.1\",\"used_quic\":true},\"version\":5}";
@@ -1470,7 +1470,7 @@
       "{\"quic_servers\":{\"https://mail.google.com:80\":"
       "{\"server_info\":\"quic_server_info1\"}},\"servers\":["
       "{\"https://www.google.com:80\":"
-      "{\"alternative_service\":[{\"advertised_versions\":[39],"
+      "{\"alternative_service\":[{\"advertised_versions\":[41],"
       "\"expiration\":\"13756212000000000\",\"port\":443,"
       "\"protocol_str\":\"quic\"}]}}],\"supports_quic\":"
       "{\"address\":\"127.0.0.1\",\"used_quic\":true},\"version\":5}";
diff --git a/services/identity/DEPS b/services/identity/DEPS
index f194cc9..3d7192a 100644
--- a/services/identity/DEPS
+++ b/services/identity/DEPS
@@ -5,6 +5,7 @@
   "+components/signin/core/browser/fake_signin_manager.h",
   "+components/signin/core/browser/profile_oauth2_token_service.h",
   "+components/signin/core/browser/signin_manager_base.h",
+  "+components/signin/core/browser/signin_manager.h",
   "+components/signin/core/browser/test_signin_client.h",
   "+components/signin/public",
   "+components/sync_preferences/testing_pref_service_syncable.h",
diff --git a/services/identity/public/cpp/identity_manager.cc b/services/identity/public/cpp/identity_manager.cc
index 0d73be1..d349b80f 100644
--- a/services/identity/public/cpp/identity_manager.cc
+++ b/services/identity/public/cpp/identity_manager.cc
@@ -13,11 +13,17 @@
     : signin_manager_(signin_manager), token_service_(token_service) {
   primary_account_info_ = signin_manager_->GetAuthenticatedAccountInfo();
   signin_manager_->AddObserver(this);
+#if !defined(OS_CHROMEOS)
+  static_cast<SigninManager*>(signin_manager_)->set_diagnostics_client(this);
+#endif
   token_service_->AddDiagnosticsObserver(this);
 }
 
 IdentityManager::~IdentityManager() {
   signin_manager_->RemoveObserver(this);
+#if !defined(OS_CHROMEOS)
+  static_cast<SigninManager*>(signin_manager_)->set_diagnostics_client(nullptr);
+#endif
   token_service_->RemoveDiagnosticsObserver(this);
 }
 
@@ -96,10 +102,27 @@
                                     refresh_token);
 }
 
+#if !defined(OS_CHROMEOS)
+void IdentityManager::WillFireGoogleSigninSucceeded(
+    const AccountInfo& account_info) {
+  primary_account_info_ = account_info;
+}
+
+void IdentityManager::WillFireGoogleSignedOut(const AccountInfo& account_info) {
+  DCHECK(account_info.account_id == primary_account_info_.account_id);
+  DCHECK(account_info.gaia == primary_account_info_.gaia);
+  DCHECK(account_info.email == primary_account_info_.email);
+  primary_account_info_ = AccountInfo();
+}
+#endif
+
 void IdentityManager::GoogleSigninSucceeded(const AccountInfo& account_info) {
   // Fire observer callbacks asynchronously to mimic this callback itself coming
   // in asynchronously from the Identity Service rather than synchronously from
   // SigninManager.
+  DCHECK(account_info.account_id == primary_account_info_.account_id);
+  DCHECK(account_info.gaia == primary_account_info_.gaia);
+  DCHECK(account_info.email == primary_account_info_.email);
   base::SequencedTaskRunnerHandle::Get()->PostTask(
       FROM_HERE, base::BindOnce(&IdentityManager::HandleGoogleSigninSucceeded,
                                 base::Unretained(this), account_info));
@@ -109,6 +132,7 @@
   // Fire observer callbacks asynchronously to mimic this callback itself coming
   // in asynchronously from the Identity Service rather than synchronously from
   // SigninManager.
+  DCHECK(!HasPrimaryAccount());
   base::SequencedTaskRunnerHandle::Get()->PostTask(
       FROM_HERE, base::BindOnce(&IdentityManager::HandleGoogleSignedOut,
                                 base::Unretained(this), account_info));
@@ -129,17 +153,12 @@
 
 void IdentityManager::HandleGoogleSigninSucceeded(
     const AccountInfo& account_info) {
-  primary_account_info_ = account_info;
   for (auto& observer : observer_list_) {
     observer.OnPrimaryAccountSet(account_info);
   }
 }
 
 void IdentityManager::HandleGoogleSignedOut(const AccountInfo& account_info) {
-  DCHECK(account_info.account_id == primary_account_info_.account_id);
-  DCHECK(account_info.gaia == primary_account_info_.gaia);
-  DCHECK(account_info.email == primary_account_info_.email);
-  primary_account_info_ = AccountInfo();
   for (auto& observer : observer_list_) {
     observer.OnPrimaryAccountCleared(account_info);
   }
diff --git a/services/identity/public/cpp/identity_manager.h b/services/identity/public/cpp/identity_manager.h
index 07d184b..a84892f 100644
--- a/services/identity/public/cpp/identity_manager.h
+++ b/services/identity/public/cpp/identity_manager.h
@@ -11,12 +11,19 @@
 #include "components/signin/core/browser/signin_manager_base.h"
 #include "services/identity/public/cpp/primary_account_access_token_fetcher.h"
 
+#if !defined(OS_CHROMEOS)
+#include "components/signin/core/browser/signin_manager.h"
+#endif
+
 namespace identity {
 
 // Primary client-side interface to the Identity Service, encapsulating a
 // connection to a remote implementation of mojom::IdentityManager. See
 // ./README.md for detailed documentation.
 class IdentityManager : public SigninManagerBase::Observer,
+#if !defined(OS_CHROMEOS)
+                        public SigninManager::DiagnosticsClient,
+#endif
                         public OAuth2TokenService::DiagnosticsObserver {
  public:
   class Observer {
@@ -104,6 +111,12 @@
   void GoogleSigninSucceeded(const AccountInfo& account_info) override;
   void GoogleSignedOut(const AccountInfo& account_info) override;
 
+#if !defined(OS_CHROMEOS)
+  // SigninManagerBase::DiagnosticsClient:
+  void WillFireGoogleSigninSucceeded(const AccountInfo& account_info) override;
+  void WillFireGoogleSignedOut(const AccountInfo& account_info) override;
+#endif
+
   // OAuth2TokenService::DiagnosticsObserver:
   void OnAccessTokenRequested(
       const std::string& account_id,
diff --git a/services/identity/public/cpp/identity_manager_unittest.cc b/services/identity/public/cpp/identity_manager_unittest.cc
index 06a3a56..caa51353 100644
--- a/services/identity/public/cpp/identity_manager_unittest.cc
+++ b/services/identity/public/cpp/identity_manager_unittest.cc
@@ -61,6 +61,59 @@
   base::OnceClosure on_access_token_invalidated_callback_;
 };
 
+class TestSigninManagerObserver : public SigninManagerBase::Observer {
+ public:
+  explicit TestSigninManagerObserver(SigninManagerBase* signin_manager)
+      : signin_manager_(signin_manager) {
+    signin_manager_->AddObserver(this);
+  }
+  ~TestSigninManagerObserver() override {
+    signin_manager_->RemoveObserver(this);
+  }
+
+  void set_identity_manager(IdentityManager* identity_manager) {
+    identity_manager_ = identity_manager;
+  }
+
+  void set_on_google_signin_succeeded_callback(base::OnceClosure callback) {
+    on_google_signin_succeeded_callback_ = std::move(callback);
+  }
+  void set_on_google_signed_out_callback(base::OnceClosure callback) {
+    on_google_signed_out_callback_ = std::move(callback);
+  }
+
+  const AccountInfo& primary_account_from_signin_callback() {
+    return primary_account_from_signin_callback_;
+  }
+  const AccountInfo& primary_account_from_signout_callback() {
+    return primary_account_from_signout_callback_;
+  }
+
+ private:
+  // SigninManager::Observer:
+  void GoogleSigninSucceeded(const AccountInfo& account_info) override {
+    ASSERT_TRUE(identity_manager_);
+    primary_account_from_signin_callback_ =
+        identity_manager_->GetPrimaryAccountInfo();
+    if (on_google_signin_succeeded_callback_)
+      std::move(on_google_signin_succeeded_callback_).Run();
+  }
+  void GoogleSignedOut(const AccountInfo& account_info) override {
+    ASSERT_TRUE(identity_manager_);
+    primary_account_from_signout_callback_ =
+        identity_manager_->GetPrimaryAccountInfo();
+    if (on_google_signed_out_callback_)
+      std::move(on_google_signed_out_callback_).Run();
+  }
+
+  SigninManagerBase* signin_manager_;
+  IdentityManager* identity_manager_;
+  base::OnceClosure on_google_signin_succeeded_callback_;
+  base::OnceClosure on_google_signed_out_callback_;
+  AccountInfo primary_account_from_signin_callback_;
+  AccountInfo primary_account_from_signout_callback_;
+};
+
 class TestIdentityManagerObserver : IdentityManager::Observer {
  public:
   explicit TestIdentityManagerObserver(IdentityManager* identity_manager)
@@ -177,12 +230,7 @@
 
     signin_manager()->SetAuthenticatedAccountInfo(kTestGaiaId, kTestEmail);
 
-    identity_manager_.reset(
-        new IdentityManager(&signin_manager_, &token_service_));
-    identity_manager_observer_.reset(
-        new TestIdentityManagerObserver(identity_manager_.get()));
-    identity_manager_diagnostics_observer_.reset(
-        new TestIdentityManagerDiagnosticsObserver(identity_manager_.get()));
+    RecreateIdentityManager();
   }
 
   IdentityManager* identity_manager() { return identity_manager_.get(); }
@@ -199,6 +247,24 @@
     return &token_service_;
   }
 
+  // Used by some tests that need to re-instantiate IdentityManager after
+  // performing some other setup.
+  void RecreateIdentityManager() {
+    // Reset them all to null first to ensure that they're destroyed, as
+    // otherwise SigninManager ends up getting a new DiagnosticsObserver added
+    // before the old one is removed.
+    identity_manager_observer_.reset();
+    identity_manager_diagnostics_observer_.reset();
+    identity_manager_.reset();
+
+    identity_manager_.reset(
+        new IdentityManager(&signin_manager_, &token_service_));
+    identity_manager_observer_.reset(
+        new TestIdentityManagerObserver(identity_manager_.get()));
+    identity_manager_diagnostics_observer_.reset(
+        new TestIdentityManagerDiagnosticsObserver(identity_manager_.get()));
+  }
+
  private:
   base::MessageLoop message_loop_;
   sync_preferences::TestingPrefServiceSyncable pref_service_;
@@ -356,4 +422,56 @@
             identity_manager_diagnostics_observer()->token_requestor_scopes());
 }
 
+#if !defined(OS_CHROMEOS)
+TEST_F(IdentityManagerTest,
+       IdentityManagerGetsSignInEventBeforeSigninManagerObserver) {
+  signin_manager()->ForceSignOut();
+
+  base::RunLoop run_loop;
+  TestSigninManagerObserver signin_manager_observer(signin_manager());
+  signin_manager_observer.set_on_google_signin_succeeded_callback(
+      run_loop.QuitClosure());
+
+  // NOTE: For this test to be meaningful, TestSigninManagerObserver
+  // needs to be created before the IdentityManager instance that it's
+  // interacting with. Otherwise, even an implementation where they're
+  // both SigninManager::Observers would work as IdentityManager would
+  // get notified first during the observer callbacks.
+  RecreateIdentityManager();
+  signin_manager_observer.set_identity_manager(identity_manager());
+
+  signin_manager()->SignIn(kTestGaiaId, kTestEmail, "password");
+  run_loop.Run();
+
+  AccountInfo primary_account_from_signin_callback =
+      signin_manager_observer.primary_account_from_signin_callback();
+  EXPECT_EQ(kTestGaiaId, primary_account_from_signin_callback.gaia);
+  EXPECT_EQ(kTestEmail, primary_account_from_signin_callback.email);
+}
+
+TEST_F(IdentityManagerTest,
+       IdentityManagerGetsSignOutEventBeforeSigninManagerObserver) {
+  base::RunLoop run_loop;
+  TestSigninManagerObserver signin_manager_observer(signin_manager());
+  signin_manager_observer.set_on_google_signed_out_callback(
+      run_loop.QuitClosure());
+
+  // NOTE: For this test to be meaningful, TestSigninManagerObserver
+  // needs to be created before the IdentityManager instance that it's
+  // interacting with. Otherwise, even an implementation where they're
+  // both SigninManager::Observers would work as IdentityManager would
+  // get notified first during the observer callbacks.
+  RecreateIdentityManager();
+  signin_manager_observer.set_identity_manager(identity_manager());
+
+  signin_manager()->ForceSignOut();
+  run_loop.Run();
+
+  AccountInfo primary_account_from_signout_callback =
+      signin_manager_observer.primary_account_from_signout_callback();
+  EXPECT_EQ(std::string(), primary_account_from_signout_callback.gaia);
+  EXPECT_EQ(std::string(), primary_account_from_signout_callback.email);
+}
+#endif
+
 }  // namespace identity
diff --git a/services/metrics/public/cpp/ukm_recorder.h b/services/metrics/public/cpp/ukm_recorder.h
index 99ff5aab..093d9f8e 100644
--- a/services/metrics/public/cpp/ukm_recorder.h
+++ b/services/metrics/public/cpp/ukm_recorder.h
@@ -40,7 +40,6 @@
 namespace blink {
 class AutoplayUmaHelper;
 class Document;
-class LocalFrameView;
 }
 
 namespace cc {
@@ -148,7 +147,6 @@
   friend previews::PreviewsUKMObserver;
   friend translate::TranslateRankerImpl;
   friend ui::LatencyTracker;
-  friend blink::LocalFrameView;
   FRIEND_TEST_ALL_PREFIXES(UkmServiceTest, AddEntryWithEmptyMetrics);
   FRIEND_TEST_ALL_PREFIXES(UkmServiceTest, EntryBuilderAndSerialization);
   FRIEND_TEST_ALL_PREFIXES(UkmServiceTest,
diff --git a/services/network/BUILD.gn b/services/network/BUILD.gn
index 45be7abe..45c8a51f 100644
--- a/services/network/BUILD.gn
+++ b/services/network/BUILD.gn
@@ -3,26 +3,91 @@
 # found in the LICENSE file.
 
 import("//mojo/public/tools/bindings/mojom.gni")
+import("//services/service_manager/public/service_manifest.gni")
 
 static_library("network_service") {
   sources = [
+    "cache_url_loader.cc",
+    "cache_url_loader.h",
     "cookie_manager.cc",
     "cookie_manager.h",
+    "data_pipe_element_reader.cc",
+    "data_pipe_element_reader.h",
+    "http_server_properties_pref_delegate.cc",
+    "http_server_properties_pref_delegate.h",
+    "network_change_manager.cc",
+    "network_change_manager.h",
+    "network_context.cc",
+    "network_context.h",
+    "network_sandbox_hook_linux.cc",
+    "network_sandbox_hook_linux.h",
+    "network_service_impl.cc",
+    "network_service_impl.h",
+    "network_service_url_loader_factory.cc",
+    "network_service_url_loader_factory.h",
     "proxy_config_service_mojo.cc",
     "proxy_config_service_mojo.h",
+    "restricted_cookie_manager.cc",
+    "restricted_cookie_manager.h",
+    "throttling/network_conditions.cc",
+    "throttling/network_conditions.h",
+    "throttling/throttling_controller.cc",
+    "throttling/throttling_controller.h",
+    "throttling/throttling_network_interceptor.cc",
+    "throttling/throttling_network_interceptor.h",
+    "throttling/throttling_network_transaction.cc",
+    "throttling/throttling_network_transaction.h",
+    "throttling/throttling_network_transaction_factory.cc",
+    "throttling/throttling_network_transaction_factory.h",
+    "throttling/throttling_upload_data_stream.cc",
+    "throttling/throttling_upload_data_stream.h",
     "udp_socket.cc",
     "udp_socket.h",
     "udp_socket_factory.cc",
     "udp_socket_factory.h",
+    "upload_progress_tracker.cc",
+    "upload_progress_tracker.h",
+    "url_loader.cc",
+    "url_loader.h",
+    "url_request_context_builder_mojo.cc",
   ]
 
   deps = [
     "//base",
+    "//components/cookie_config",
+    "//components/network_session_configurator/browser",
+    "//components/network_session_configurator/common",
+    "//components/prefs",
+    "//mojo/common:common_base",
     "//mojo/public/cpp/bindings",
     "//net",
+    "//net:extras",
+    "//services/network/public/cpp",
+    "//services/network/public/cpp:network_features",
     "//services/network/public/interfaces",
+    "//services/service_manager/public/cpp",
+    "//services/service_manager/public/interfaces",
     "//url",
   ]
+
+  if (is_linux) {
+    deps += [
+      "//sandbox/linux:sandbox_services",
+      "//services/service_manager/sandbox:sandbox",
+    ]
+  }
+
+  # TODO(sdefresne): This depends on net's enable_net_mojo getting turned on for
+  # iOS, which depends on net_with_v8 as well. http://crbug.com/803149
+  if (!is_ios) {
+    sources += [
+      "proxy_resolver_factory_mojo.cc",
+      "proxy_resolver_factory_mojo.h",
+      "proxy_service_mojo.cc",
+      "proxy_service_mojo.h",
+    ]
+    deps += [ "//net:net_browser_services" ]
+  }
 }
 
 source_set("tests") {
@@ -30,18 +95,31 @@
 
   sources = [
     "cookie_manager_unittest.cc",
+    "data_pipe_element_reader_unittest.cc",
+    "network_change_manager_unittest.cc",
+    "network_context_unittest.cc",
     "proxy_config_service_mojo_unittest.cc",
+    "restricted_cookie_manager_unittest.cc",
+    "throttling/throttling_controller_unittest.cc",
     "udp_socket_factory_unittest.cc",
     "udp_socket_unittest.cc",
+    "upload_progress_tracker_unittest.cc",
   ]
 
+  if (!is_ios) {
+    sources += [ "proxy_resolver_factory_mojo_unittest.cc" ]
+  }
+
   deps = [
+    ":network_service",
     ":test_support",
     "//base",
+    "//components/network_session_configurator/browser",
+    "//mojo/common:common_base",
     "//mojo/public/cpp/bindings",
     "//net",
     "//net:test_support",
-    "//services/network:network_service",
+    "//services/network/public/cpp:network_features",
     "//services/network/public/interfaces",
     "//testing/gtest",
   ]
@@ -52,6 +130,9 @@
 
   sources = [
     "test/test_data_pipe_getter.cc",
+    "test/test_data_pipe_getter.h",
+    "test/test_url_loader_client.cc",
+    "test/test_url_loader_client.h",
     "udp_socket_test_util.cc",
     "udp_socket_test_util.h",
   ]
@@ -66,3 +147,8 @@
     "//testing/gtest",
   ]
 }
+
+service_manifest("manifest") {
+  name = "network"
+  source = "manifest.json"
+}
diff --git a/services/network/DEPS b/services/network/DEPS
index 88c57e9..47511631 100644
--- a/services/network/DEPS
+++ b/services/network/DEPS
@@ -1,4 +1,15 @@
 include_rules = [
+  "+components/cookie_config",
+  "+components/network_session_configurator",
+  # Prefs are used to create an independent file with a persisted key:value
+  # store for networking-related data (Like which servers support QUIC), rather
+  # than to store user preferences.
+  "+components/prefs",
+  "+crypto",
   "+ipc",
   "+net",
+  "+sandbox",
+  "+services/proxy_resolver/public/interfaces",
+  "+services/service_manager/public",
+  "+services/service_manager/sandbox",
 ]
diff --git a/services/network/OWNERS b/services/network/OWNERS
index 716b2b1..84687b00 100644
--- a/services/network/OWNERS
+++ b/services/network/OWNERS
@@ -1 +1,13 @@
-file://content/network/OWNERS
+ananta@chromium.org
+jam@chromium.org
+kinuko@chromium.org
+mmenke@chromium.org
+rdsmith@chromium.org
+scottmg@chromium.org
+tsepez@chromium.org
+xunjieli@chromium.org
+yhirano@chromium.org
+yzshen@chromium.org
+
+per-file manifest.json=set noparent
+per-file manifest.json=file://ipc/SECURITY_OWNERS
\ No newline at end of file
diff --git a/content/network/PRESUBMIT.py b/services/network/PRESUBMIT.py
similarity index 100%
rename from content/network/PRESUBMIT.py
rename to services/network/PRESUBMIT.py
diff --git a/content/network/cache_url_loader.cc b/services/network/cache_url_loader.cc
similarity index 85%
rename from content/network/cache_url_loader.cc
rename to services/network/cache_url_loader.cc
index b2adad91..3cf9f135 100644
--- a/content/network/cache_url_loader.cc
+++ b/services/network/cache_url_loader.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/cache_url_loader.h"
+#include "services/network/cache_url_loader.h"
 
 #include "base/bind.h"
 #include "base/macros.h"
@@ -11,7 +11,7 @@
 #include "mojo/common/data_pipe_utils.h"
 #include "net/url_request/view_cache_helper.h"
 
-namespace content {
+namespace network {
 
 namespace {
 
@@ -19,11 +19,11 @@
  public:
   CacheURLLoader(const GURL& url,
                  net::URLRequestContext* request_context,
-                 network::mojom::URLLoaderClientPtr client)
+                 mojom::URLLoaderClientPtr client)
       : client_(std::move(client)) {
     scoped_refptr<net::HttpResponseHeaders> headers(
         new net::HttpResponseHeaders("HTTP/1.1 200 OK"));
-    network::ResourceResponseHead resource_response;
+    ResourceResponseHead resource_response;
     resource_response.headers = headers;
     resource_response.mime_type = "text/html";
     client_->OnReceiveResponse(resource_response, base::nullopt, nullptr);
@@ -57,7 +57,7 @@
         mojo::common::BlockingCopyFromString(data_, data_pipe.producer_handle));
 
     client_->OnStartLoadingResponseBody(std::move(data_pipe.consumer_handle));
-    network::URLLoaderCompletionStatus status(net::OK);
+    URLLoaderCompletionStatus status(net::OK);
     status.encoded_data_length = data_.size();
     status.encoded_body_length = data_.size();
     client_->OnComplete(status);
@@ -67,17 +67,17 @@
   }
 
   std::string data_;
-  network::mojom::URLLoaderClientPtr client_;
+  mojom::URLLoaderClientPtr client_;
   net::ViewCacheHelper cache_helper_;
 
   DISALLOW_COPY_AND_ASSIGN(CacheURLLoader);
 };
-}
+}  // namespace
 
 void StartCacheURLLoader(const GURL& url,
                          net::URLRequestContext* request_context,
-                         network::mojom::URLLoaderClientPtr client) {
+                         mojom::URLLoaderClientPtr client) {
   new CacheURLLoader(url, request_context, std::move(client));
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/content/network/cache_url_loader.h b/services/network/cache_url_loader.h
similarity index 65%
rename from content/network/cache_url_loader.h
rename to services/network/cache_url_loader.h
index 9d65de284..b4d0642a 100644
--- a/content/network/cache_url_loader.h
+++ b/services/network/cache_url_loader.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_NETWORK_CACHE_URL_LOADER_H_
-#define CONTENT_NETWORK_CACHE_URL_LOADER_H_
+#ifndef SERVICES_NETWORK_CACHE_URL_LOADER_H_
+#define SERVICES_NETWORK_CACHE_URL_LOADER_H_
 
 #include "services/network/public/interfaces/url_loader.mojom.h"
 
@@ -11,13 +11,13 @@
 class URLRequestContext;
 }
 
-namespace content {
+namespace network {
 
 // Creates a URLLoader that responds to developer requests to view the cache.
 void StartCacheURLLoader(const GURL& url,
                          net::URLRequestContext* request_context,
-                         network::mojom::URLLoaderClientPtr client);
+                         mojom::URLLoaderClientPtr client);
 
-}  // namespace content
+}  // namespace network
 
-#endif  // CONTENT_NETWORK_CACHE_URL_LOADER_H_
+#endif  // SERVICES_NETWORK_CACHE_URL_LOADER_H_
diff --git a/content/network/data_pipe_element_reader.cc b/services/network/data_pipe_element_reader.cc
similarity index 93%
rename from content/network/data_pipe_element_reader.cc
rename to services/network/data_pipe_element_reader.cc
index 6650891..a5cd676 100644
--- a/content/network/data_pipe_element_reader.cc
+++ b/services/network/data_pipe_element_reader.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/data_pipe_element_reader.h"
+#include "services/network/data_pipe_element_reader.h"
 
 #include "base/bind.h"
 #include "base/callback.h"
@@ -12,11 +12,11 @@
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
 
-namespace content {
+namespace network {
 
 DataPipeElementReader::DataPipeElementReader(
-    scoped_refptr<network::ResourceRequestBody> resource_request_body,
-    network::mojom::DataPipeGetterPtr data_pipe_getter_)
+    scoped_refptr<ResourceRequestBody> resource_request_body,
+    mojom::DataPipeGetterPtr data_pipe_getter_)
     : resource_request_body_(std::move(resource_request_body)),
       data_pipe_getter_(std::move(data_pipe_getter_)),
       handle_watcher_(FROM_HERE, mojo::SimpleWatcher::ArmingPolicy::MANUAL),
@@ -127,4 +127,4 @@
   return net::ERR_FAILED;
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/content/network/data_pipe_element_reader.h b/services/network/data_pipe_element_reader.h
similarity index 81%
rename from content/network/data_pipe_element_reader.h
rename to services/network/data_pipe_element_reader.h
index f154a881..bb5997af 100644
--- a/content/network/data_pipe_element_reader.h
+++ b/services/network/data_pipe_element_reader.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_NETWORK_DATA_PIPE_ELEMENT_READER_H_
-#define CONTENT_NETWORK_DATA_PIPE_ELEMENT_READER_H_
+#ifndef SERVICES_NETWORK_DATA_PIPE_ELEMENT_READER_H_
+#define SERVICES_NETWORK_DATA_PIPE_ELEMENT_READER_H_
 
 #include <stdint.h>
 
@@ -12,7 +12,6 @@
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
-#include "content/common/content_export.h"
 #include "mojo/public/cpp/system/data_pipe.h"
 #include "mojo/public/cpp/system/simple_watcher.h"
 #include "net/base/completion_callback.h"
@@ -24,16 +23,16 @@
 class IOBuffer;
 }
 
-namespace content {
+namespace network {
 
 // A subclass of net::UploadElementReader to read data pipes.
-class CONTENT_EXPORT DataPipeElementReader : public net::UploadElementReader {
+class DataPipeElementReader : public net::UploadElementReader {
  public:
   // |resource_request_body| is just passed in to keep the object around for the
   // life of the ElementReader.
   DataPipeElementReader(
-      scoped_refptr<network::ResourceRequestBody> resource_request_body,
-      network::mojom::DataPipeGetterPtr data_pipe_getter_);
+      scoped_refptr<ResourceRequestBody> resource_request_body,
+      mojom::DataPipeGetterPtr data_pipe_getter_);
 
   ~DataPipeElementReader() override;
 
@@ -60,8 +59,8 @@
   // the caller to update |buf_| and |buf_length_| if needed.
   int ReadInternal(net::IOBuffer* buf, int buf_length);
 
-  scoped_refptr<network::ResourceRequestBody> resource_request_body_;
-  network::mojom::DataPipeGetterPtr data_pipe_getter_;
+  scoped_refptr<ResourceRequestBody> resource_request_body_;
+  mojom::DataPipeGetterPtr data_pipe_getter_;
   mojo::ScopedDataPipeConsumerHandle data_pipe_;
   mojo::SimpleWatcher handle_watcher_;
 
@@ -82,6 +81,6 @@
   DISALLOW_COPY_AND_ASSIGN(DataPipeElementReader);
 };
 
-}  // namespace content
+}  // namespace network
 
-#endif  // CONTENT_NETWORK_DATA_PIPE_ELEMENT_READER_H_
+#endif  // SERVICES_NETWORK_DATA_PIPE_ELEMENT_READER_H_
diff --git a/content/network/data_pipe_element_reader_unittest.cc b/services/network/data_pipe_element_reader_unittest.cc
similarity index 97%
rename from content/network/data_pipe_element_reader_unittest.cc
rename to services/network/data_pipe_element_reader_unittest.cc
index f3bdd68..b29bb91 100644
--- a/content/network/data_pipe_element_reader_unittest.cc
+++ b/services/network/data_pipe_element_reader_unittest.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/data_pipe_element_reader.h"
+#include "services/network/data_pipe_element_reader.h"
 
 #include <stdint.h>
 
@@ -26,11 +26,11 @@
 // Most tests of this class are at the URLLoader layer. These tests focus on
 // things too difficult to cover with integration tests.
 
-namespace content {
+namespace network {
 
 namespace {
 
-class PassThroughDataPipeGetter : public network::mojom::DataPipeGetter {
+class PassThroughDataPipeGetter : public mojom::DataPipeGetter {
  public:
   explicit PassThroughDataPipeGetter() : binding_(this) {}
 
@@ -225,4 +225,4 @@
 
 }  // namespace
 
-}  // namespace content
+}  // namespace network
diff --git a/content/network/http_server_properties_pref_delegate.cc b/services/network/http_server_properties_pref_delegate.cc
similarity index 93%
rename from content/network/http_server_properties_pref_delegate.cc
rename to services/network/http_server_properties_pref_delegate.cc
index 8621b81..81d33c6 100644
--- a/content/network/http_server_properties_pref_delegate.cc
+++ b/services/network/http_server_properties_pref_delegate.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/http_server_properties_pref_delegate.h"
+#include "services/network/http_server_properties_pref_delegate.h"
 
 #include "base/bind.h"
 #include "base/values.h"
@@ -11,7 +11,7 @@
 
 const char kPrefPath[] = "net.http_server_properties";
 
-namespace content {
+namespace network {
 
 HttpServerPropertiesPrefDelegate::HttpServerPropertiesPrefDelegate(
     PrefService* pref_service)
@@ -51,4 +51,4 @@
   }
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/content/network/http_server_properties_pref_delegate.h b/services/network/http_server_properties_pref_delegate.h
similarity index 84%
rename from content/network/http_server_properties_pref_delegate.h
rename to services/network/http_server_properties_pref_delegate.h
index a2f88b59..b0bfc79 100644
--- a/content/network/http_server_properties_pref_delegate.h
+++ b/services/network/http_server_properties_pref_delegate.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_NETWORK_HTTP_SERVER_PROPERTIES_PREF_DELEGATE_H_
-#define CONTENT_NETWORK_HTTP_SERVER_PROPERTIES_PREF_DELEGATE_H_
+#ifndef SERVICES_NETWORK_HTTP_SERVER_PROPERTIES_PREF_DELEGATE_H_
+#define SERVICES_NETWORK_HTTP_SERVER_PROPERTIES_PREF_DELEGATE_H_
 
 #include "base/callback.h"
 #include "base/macros.h"
@@ -13,7 +13,7 @@
 
 class PrefRegistrySimple;
 
-namespace content {
+namespace network {
 
 // Manages disk storage for a net::HttpServerPropertiesManager.
 class HttpServerPropertiesPrefDelegate
@@ -39,6 +39,6 @@
   DISALLOW_COPY_AND_ASSIGN(HttpServerPropertiesPrefDelegate);
 };
 
-}  // namespace content
+}  // namespace network
 
-#endif  // CONTENT_NETWORK_HTTP_SERVER_PROPERTIES_PREF_DELEGATE_H_
+#endif  // SERVICES_NETWORK_HTTP_SERVER_PROPERTIES_PREF_DELEGATE_H_
diff --git a/content/network/manifest.json b/services/network/manifest.json
similarity index 100%
rename from content/network/manifest.json
rename to services/network/manifest.json
diff --git a/content/network/network_change_manager.cc b/services/network/network_change_manager.cc
similarity index 73%
rename from content/network/network_change_manager.cc
rename to services/network/network_change_manager.cc
index f4835a6..00532f6 100644
--- a/content/network/network_change_manager.cc
+++ b/services/network/network_change_manager.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/network_change_manager.h"
+#include "services/network/network_change_manager.h"
 
 #include <algorithm>
 #include <utility>
@@ -10,14 +10,14 @@
 #include "base/logging.h"
 #include "net/base/network_change_notifier.h"
 
-namespace content {
+namespace network {
 
 NetworkChangeManager::NetworkChangeManager(
     std::unique_ptr<net::NetworkChangeNotifier> network_change_notifier)
     : network_change_notifier_(std::move(network_change_notifier)) {
   net::NetworkChangeNotifier::AddNetworkChangeObserver(this);
-  connection_type_ = network::mojom::ConnectionType(
-      net::NetworkChangeNotifier::GetConnectionType());
+  connection_type_ =
+      mojom::ConnectionType(net::NetworkChangeNotifier::GetConnectionType());
 }
 
 NetworkChangeManager::~NetworkChangeManager() {
@@ -25,12 +25,12 @@
 }
 
 void NetworkChangeManager::AddRequest(
-    network::mojom::NetworkChangeManagerRequest request) {
+    mojom::NetworkChangeManagerRequest request) {
   bindings_.AddBinding(this, std::move(request));
 }
 
 void NetworkChangeManager::RequestNotifications(
-    network::mojom::NetworkChangeManagerClientPtr client_ptr) {
+    mojom::NetworkChangeManagerClientPtr client_ptr) {
   client_ptr.set_connection_error_handler(
       base::Bind(&NetworkChangeManager::NotificationPipeBroken,
                  // base::Unretained is safe as destruction of the
@@ -48,20 +48,20 @@
 }
 
 void NetworkChangeManager::NotificationPipeBroken(
-    network::mojom::NetworkChangeManagerClient* client) {
-  clients_.erase(std::find_if(
-      clients_.begin(), clients_.end(),
-      [client](network::mojom::NetworkChangeManagerClientPtr& ptr) {
-        return ptr.get() == client;
-      }));
+    mojom::NetworkChangeManagerClient* client) {
+  clients_.erase(
+      std::find_if(clients_.begin(), clients_.end(),
+                   [client](mojom::NetworkChangeManagerClientPtr& ptr) {
+                     return ptr.get() == client;
+                   }));
 }
 
 void NetworkChangeManager::OnNetworkChanged(
     net::NetworkChangeNotifier::ConnectionType type) {
-  connection_type_ = network::mojom::ConnectionType(type);
+  connection_type_ = mojom::ConnectionType(type);
   for (const auto& client : clients_) {
     client->OnNetworkChanged(connection_type_);
   }
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/content/network/network_change_manager.h b/services/network/network_change_manager.h
similarity index 66%
rename from content/network/network_change_manager.h
rename to services/network/network_change_manager.h
index 25aa499..6862428 100644
--- a/content/network/network_change_manager.h
+++ b/services/network/network_change_manager.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_NETWORK_NETWORK_CHANGE_MANAGER_H_
-#define CONTENT_NETWORK_NETWORK_CHANGE_MANAGER_H_
+#ifndef SERVICES_NETWORK_NETWORK_CHANGE_MANAGER_H_
+#define SERVICES_NETWORK_NETWORK_CHANGE_MANAGER_H_
 
 #include <memory>
 #include <string>
@@ -11,19 +11,18 @@
 
 #include "base/macros.h"
 #include "build/build_config.h"
-#include "content/common/content_export.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
 #include "net/base/network_change_notifier.h"
 #include "services/network/public/interfaces/network_change_manager.mojom.h"
 
-namespace content {
+namespace network {
 
 // Implementation of mojom::NetworkChangeManager. All accesses to this class are
 // done through mojo on the main thread. This registers itself to receive
 // broadcasts from net::NetworkChangeNotifier and rebroadcasts the notifications
-// to network::mojom::NetworkChangeManagerClients through mojo pipes.
-class CONTENT_EXPORT NetworkChangeManager
-    : public network::mojom::NetworkChangeManager,
+// to mojom::NetworkChangeManagerClients through mojo pipes.
+class NetworkChangeManager
+    : public mojom::NetworkChangeManager,
       public net::NetworkChangeNotifier::NetworkChangeObserver {
  public:
   // If |network_change_notifier| is not null, |this| will take ownership of it.
@@ -35,31 +34,30 @@
 
   // Binds a NetworkChangeManager request to this object. Mojo messages
   // coming through the associated pipe will be served by this object.
-  void AddRequest(network::mojom::NetworkChangeManagerRequest request);
+  void AddRequest(mojom::NetworkChangeManagerRequest request);
 
   // mojom::NetworkChangeManager implementation:
   void RequestNotifications(
-      network::mojom::NetworkChangeManagerClientPtr client_ptr) override;
+      mojom::NetworkChangeManagerClientPtr client_ptr) override;
 
   size_t GetNumClientsForTesting() const;
 
  private:
   // Handles connection errors on notification pipes.
-  void NotificationPipeBroken(
-      network::mojom::NetworkChangeManagerClient* client);
+  void NotificationPipeBroken(mojom::NetworkChangeManagerClient* client);
 
   // net::NetworkChangeNotifier::NetworkChangeObserver implementation:
   void OnNetworkChanged(
       net::NetworkChangeNotifier::ConnectionType type) override;
 
   std::unique_ptr<net::NetworkChangeNotifier> network_change_notifier_;
-  mojo::BindingSet<network::mojom::NetworkChangeManager> bindings_;
-  std::vector<network::mojom::NetworkChangeManagerClientPtr> clients_;
-  network::mojom::ConnectionType connection_type_;
+  mojo::BindingSet<mojom::NetworkChangeManager> bindings_;
+  std::vector<mojom::NetworkChangeManagerClientPtr> clients_;
+  mojom::ConnectionType connection_type_;
 
   DISALLOW_COPY_AND_ASSIGN(NetworkChangeManager);
 };
 
-}  // namespace content
+}  // namespace network
 
-#endif  // CONTENT_NETWORK_NETWORK_CHANGE_MANAGER_H_
+#endif  // SERVICES_NETWORK_NETWORK_CHANGE_MANAGER_H_
diff --git a/content/network/network_change_manager_unittest.cc b/services/network/network_change_manager_unittest.cc
similarity index 75%
rename from content/network/network_change_manager_unittest.cc
rename to services/network/network_change_manager_unittest.cc
index 3d2c7cdb..ad7f4e6 100644
--- a/content/network/network_change_manager_unittest.cc
+++ b/services/network/network_change_manager_unittest.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/network_change_manager.h"
+#include "services/network/network_change_manager.h"
 
 #include <algorithm>
 #include <utility>
@@ -15,7 +15,7 @@
 #include "services/network/public/interfaces/network_change_manager.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
-namespace content {
+namespace network {
 
 namespace {
 
@@ -30,22 +30,21 @@
 };
 
 class TestNetworkChangeManagerClient
-    : public network::mojom::NetworkChangeManagerClient {
+    : public mojom::NetworkChangeManagerClient {
  public:
   explicit TestNetworkChangeManagerClient(
-      content::NetworkChangeManager* network_change_manager)
+      NetworkChangeManager* network_change_manager)
       : num_network_changed_(0),
         run_loop_(std::make_unique<base::RunLoop>()),
         notification_type_to_wait_(NONE),
-        connection_type_(network::mojom::ConnectionType::CONNECTION_UNKNOWN),
+        connection_type_(mojom::ConnectionType::CONNECTION_UNKNOWN),
         binding_(this) {
-    network::mojom::NetworkChangeManagerPtr manager_ptr;
-    network::mojom::NetworkChangeManagerRequest request(
-        mojo::MakeRequest(&manager_ptr));
+    mojom::NetworkChangeManagerPtr manager_ptr;
+    mojom::NetworkChangeManagerRequest request(mojo::MakeRequest(&manager_ptr));
     network_change_manager->AddRequest(std::move(request));
 
-    network::mojom::NetworkChangeManagerClientPtr client_ptr;
-    network::mojom::NetworkChangeManagerClientRequest client_request(
+    mojom::NetworkChangeManagerClientPtr client_ptr;
+    mojom::NetworkChangeManagerClientRequest client_request(
         mojo::MakeRequest(&client_ptr));
     binding_.Bind(std::move(client_request));
     manager_ptr->RequestNotifications(std::move(client_ptr));
@@ -54,13 +53,13 @@
   ~TestNetworkChangeManagerClient() override {}
 
   // NetworkChangeManagerClient implementation:
-  void OnInitialConnectionType(network::mojom::ConnectionType type) override {
+  void OnInitialConnectionType(mojom::ConnectionType type) override {
     connection_type_ = type;
     if (notification_type_to_wait_ == INITIAL)
       run_loop_->Quit();
   }
 
-  void OnNetworkChanged(network::mojom::ConnectionType type) override {
+  void OnNetworkChanged(mojom::ConnectionType type) override {
     num_network_changed_++;
     connection_type_ = type;
     if (notification_type_to_wait_ == NETWORK_CHANGED)
@@ -76,16 +75,14 @@
     run_loop_.reset(new base::RunLoop());
   }
 
-  network::mojom::ConnectionType connection_type() const {
-    return connection_type_;
-  }
+  mojom::ConnectionType connection_type() const { return connection_type_; }
 
  private:
   size_t num_network_changed_;
   std::unique_ptr<base::RunLoop> run_loop_;
   NotificationType notification_type_to_wait_;
-  network::mojom::ConnectionType connection_type_;
-  mojo::Binding<network::mojom::NetworkChangeManagerClient> binding_;
+  mojom::ConnectionType connection_type_;
+  mojo::Binding<mojom::NetworkChangeManagerClient> binding_;
 
   DISALLOW_COPY_AND_ASSIGN(TestNetworkChangeManagerClient);
 };
@@ -129,7 +126,7 @@
   // Simulate a new network change.
   SimulateNetworkChange(net::NetworkChangeNotifier::CONNECTION_3G);
   network_change_manager_client()->WaitForNotification(NETWORK_CHANGED);
-  EXPECT_EQ(network::mojom::ConnectionType::CONNECTION_3G,
+  EXPECT_EQ(mojom::ConnectionType::CONNECTION_3G,
             network_change_manager_client()->connection_type());
   base::RunLoop().RunUntilIdle();
   EXPECT_EQ(1u, network_change_manager_client()->num_network_changed());
@@ -145,7 +142,7 @@
 
   network_change_manager_client()->WaitForNotification(NETWORK_CHANGED);
   network_change_manager_client2->WaitForNotification(NETWORK_CHANGED);
-  EXPECT_EQ(network::mojom::ConnectionType::CONNECTION_WIFI,
+  EXPECT_EQ(mojom::ConnectionType::CONNECTION_WIFI,
             network_change_manager_client2->connection_type());
   base::RunLoop().RunUntilIdle();
 
@@ -163,7 +160,7 @@
   SimulateNetworkChange(net::NetworkChangeNotifier::CONNECTION_2G);
 
   network_change_manager_client()->WaitForNotification(NETWORK_CHANGED);
-  EXPECT_EQ(network::mojom::ConnectionType::CONNECTION_2G,
+  EXPECT_EQ(mojom::ConnectionType::CONNECTION_2G,
             network_change_manager_client()->connection_type());
   EXPECT_EQ(2u, network_change_manager_client()->num_network_changed());
 }
@@ -173,7 +170,7 @@
   SimulateNetworkChange(net::NetworkChangeNotifier::CONNECTION_BLUETOOTH);
 
   network_change_manager_client()->WaitForNotification(NETWORK_CHANGED);
-  EXPECT_EQ(network::mojom::ConnectionType::CONNECTION_BLUETOOTH,
+  EXPECT_EQ(mojom::ConnectionType::CONNECTION_BLUETOOTH,
             network_change_manager_client()->connection_type());
   base::RunLoop().RunUntilIdle();
 
@@ -182,45 +179,42 @@
   TestNetworkChangeManagerClient network_change_manager_client2(
       network_change_manager());
   network_change_manager_client2.WaitForNotification(INITIAL);
-  EXPECT_EQ(network::mojom::ConnectionType::CONNECTION_BLUETOOTH,
+  EXPECT_EQ(mojom::ConnectionType::CONNECTION_BLUETOOTH,
             network_change_manager_client2.connection_type());
 }
 
 TEST(NetworkChangeConnectionTypeTest, ConnectionTypeEnumMatch) {
   for (int typeInt = net::NetworkChangeNotifier::CONNECTION_UNKNOWN;
        typeInt != net::NetworkChangeNotifier::CONNECTION_LAST; typeInt++) {
-    network::mojom::ConnectionType mojoType =
-        network::mojom::ConnectionType(typeInt);
+    mojom::ConnectionType mojoType = mojom::ConnectionType(typeInt);
     switch (typeInt) {
       case net::NetworkChangeNotifier::CONNECTION_UNKNOWN:
-        EXPECT_EQ(network::mojom::ConnectionType::CONNECTION_UNKNOWN, mojoType);
+        EXPECT_EQ(mojom::ConnectionType::CONNECTION_UNKNOWN, mojoType);
         break;
       case net::NetworkChangeNotifier::CONNECTION_ETHERNET:
-        EXPECT_EQ(network::mojom::ConnectionType::CONNECTION_ETHERNET,
-                  mojoType);
+        EXPECT_EQ(mojom::ConnectionType::CONNECTION_ETHERNET, mojoType);
         break;
       case net::NetworkChangeNotifier::CONNECTION_WIFI:
-        EXPECT_EQ(network::mojom::ConnectionType::CONNECTION_WIFI, mojoType);
+        EXPECT_EQ(mojom::ConnectionType::CONNECTION_WIFI, mojoType);
         break;
       case net::NetworkChangeNotifier::CONNECTION_2G:
-        EXPECT_EQ(network::mojom::ConnectionType::CONNECTION_2G, mojoType);
+        EXPECT_EQ(mojom::ConnectionType::CONNECTION_2G, mojoType);
         break;
       case net::NetworkChangeNotifier::CONNECTION_3G:
-        EXPECT_EQ(network::mojom::ConnectionType::CONNECTION_3G, mojoType);
+        EXPECT_EQ(mojom::ConnectionType::CONNECTION_3G, mojoType);
         break;
       case net::NetworkChangeNotifier::CONNECTION_4G:
-        EXPECT_EQ(network::mojom::ConnectionType::CONNECTION_4G, mojoType);
+        EXPECT_EQ(mojom::ConnectionType::CONNECTION_4G, mojoType);
         break;
       case net::NetworkChangeNotifier::CONNECTION_NONE:
-        EXPECT_EQ(network::mojom::ConnectionType::CONNECTION_NONE, mojoType);
+        EXPECT_EQ(mojom::ConnectionType::CONNECTION_NONE, mojoType);
         break;
       case net::NetworkChangeNotifier::CONNECTION_BLUETOOTH:
-        EXPECT_EQ(network::mojom::ConnectionType::CONNECTION_BLUETOOTH,
-                  mojoType);
-        EXPECT_EQ(network::mojom::ConnectionType::CONNECTION_LAST, mojoType);
+        EXPECT_EQ(mojom::ConnectionType::CONNECTION_BLUETOOTH, mojoType);
+        EXPECT_EQ(mojom::ConnectionType::CONNECTION_LAST, mojoType);
         break;
     }
   }
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/content/network/network_context.cc b/services/network/network_context.cc
similarity index 84%
rename from content/network/network_context.cc
rename to services/network/network_context.cc
index 8265c25..6142855 100644
--- a/content/network/network_context.cc
+++ b/services/network/network_context.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/network_context.h"
+#include "services/network/network_context.h"
 
 #include <memory>
 #include <utility>
@@ -22,17 +22,6 @@
 #include "components/prefs/pref_registry_simple.h"
 #include "components/prefs/pref_service.h"
 #include "components/prefs/pref_service_factory.h"
-#include "content/network/cache_url_loader.h"
-#include "content/network/http_server_properties_pref_delegate.h"
-#include "content/network/network_service_impl.h"
-#include "content/network/network_service_url_loader_factory.h"
-#include "content/network/restricted_cookie_manager.h"
-#include "content/network/throttling/network_conditions.h"
-#include "content/network/throttling/throttling_controller.h"
-#include "content/network/throttling/throttling_network_transaction_factory.h"
-#include "content/network/url_loader.h"
-#include "content/public/network/ignore_errors_cert_verifier.h"
-#include "content/public/network/url_request_context_builder_mojo.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
 #include "net/cookies/cookie_monster.h"
 #include "net/dns/host_resolver.h"
@@ -49,12 +38,23 @@
 #include "net/ssl/default_channel_id_store.h"
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_builder.h"
+#include "services/network/cache_url_loader.h"
+#include "services/network/http_server_properties_pref_delegate.h"
+#include "services/network/network_service_impl.h"
+#include "services/network/network_service_url_loader_factory.h"
 #include "services/network/proxy_config_service_mojo.h"
 #include "services/network/public/cpp/features.h"
+#include "services/network/public/cpp/ignore_errors_cert_verifier.h"
 #include "services/network/public/cpp/network_switches.h"
+#include "services/network/public/cpp/url_request_context_builder_mojo.h"
+#include "services/network/restricted_cookie_manager.h"
+#include "services/network/throttling/network_conditions.h"
+#include "services/network/throttling/throttling_controller.h"
+#include "services/network/throttling/throttling_network_transaction_factory.h"
 #include "services/network/udp_socket_factory.h"
+#include "services/network/url_loader.h"
 
-namespace content {
+namespace network {
 
 namespace {
 
@@ -86,15 +86,15 @@
 }  // namespace
 
 NetworkContext::NetworkContext(NetworkServiceImpl* network_service,
-                               network::mojom::NetworkContextRequest request,
-                               network::mojom::NetworkContextParamsPtr params)
+                               mojom::NetworkContextRequest request,
+                               mojom::NetworkContextParamsPtr params)
     : network_service_(network_service),
       params_(std::move(params)),
       binding_(this, std::move(request)) {
   url_request_context_owner_ = MakeURLRequestContext(params_.get());
   url_request_context_ = url_request_context_owner_.url_request_context.get();
-  cookie_manager_ = std::make_unique<network::CookieManager>(
-      url_request_context_->cookie_store());
+  cookie_manager_ =
+      std::make_unique<CookieManager>(url_request_context_->cookie_store());
   network_service_->RegisterNetworkContext(this);
   binding_.set_connection_error_handler(base::BindOnce(
       &NetworkContext::OnConnectionError, base::Unretained(this)));
@@ -105,8 +105,8 @@
 // corresponding options to be overwritten.
 NetworkContext::NetworkContext(
     NetworkServiceImpl* network_service,
-    network::mojom::NetworkContextRequest request,
-    network::mojom::NetworkContextParamsPtr params,
+    mojom::NetworkContextRequest request,
+    mojom::NetworkContextParamsPtr params,
     std::unique_ptr<URLRequestContextBuilderMojo> builder)
     : network_service_(network_service),
       params_(std::move(params)),
@@ -116,17 +116,17 @@
       network_service->net_log());
   url_request_context_ = url_request_context_owner_.url_request_context.get();
   network_service_->RegisterNetworkContext(this);
-  cookie_manager_ = std::make_unique<network::CookieManager>(
-      url_request_context_->cookie_store());
+  cookie_manager_ =
+      std::make_unique<CookieManager>(url_request_context_->cookie_store());
 }
 
 NetworkContext::NetworkContext(NetworkServiceImpl* network_service,
-                               network::mojom::NetworkContextRequest request,
+                               mojom::NetworkContextRequest request,
                                net::URLRequestContext* url_request_context)
     : network_service_(network_service),
       url_request_context_(url_request_context),
       binding_(this, std::move(request)),
-      cookie_manager_(std::make_unique<network::CookieManager>(
+      cookie_manager_(std::make_unique<CookieManager>(
           url_request_context->cookie_store())) {
   // May be nullptr in tests.
   if (network_service_)
@@ -148,7 +148,7 @@
 
 std::unique_ptr<NetworkContext> NetworkContext::CreateForTesting() {
   return base::WrapUnique(
-      new NetworkContext(network::mojom::NetworkContextParams::New()));
+      new NetworkContext(mojom::NetworkContextParams::New()));
 }
 
 void NetworkContext::SetCertVerifierForTesting(
@@ -167,26 +167,24 @@
 }
 
 void NetworkContext::CreateURLLoaderFactory(
-    network::mojom::URLLoaderFactoryRequest request,
+    mojom::URLLoaderFactoryRequest request,
     uint32_t process_id) {
   loader_factory_bindings_.AddBinding(
       std::make_unique<NetworkServiceURLLoaderFactory>(this, process_id),
       std::move(request));
 }
 
-void NetworkContext::HandleViewCacheRequest(
-    const GURL& url,
-    network::mojom::URLLoaderClientPtr client) {
+void NetworkContext::HandleViewCacheRequest(const GURL& url,
+                                            mojom::URLLoaderClientPtr client) {
   StartCacheURLLoader(url, url_request_context_, std::move(client));
 }
 
-void NetworkContext::GetCookieManager(
-    network::mojom::CookieManagerRequest request) {
+void NetworkContext::GetCookieManager(mojom::CookieManagerRequest request) {
   cookie_manager_->AddRequest(std::move(request));
 }
 
 void NetworkContext::GetRestrictedCookieManager(
-    network::mojom::RestrictedCookieManagerRequest request,
+    mojom::RestrictedCookieManagerRequest request,
     int32_t render_process_id,
     int32_t render_frame_id) {
   // TODO(crbug.com/729800): RestrictedCookieManager should own its bindings
@@ -208,7 +206,7 @@
   delete this;
 }
 
-NetworkContext::NetworkContext(network::mojom::NetworkContextParamsPtr params)
+NetworkContext::NetworkContext(mojom::NetworkContextParamsPtr params)
     : network_service_(nullptr), params_(std::move(params)), binding_(this) {
   url_request_context_owner_ = MakeURLRequestContext(params_.get());
   url_request_context_ = url_request_context_owner_.url_request_context.get();
@@ -222,19 +220,18 @@
 }
 
 URLRequestContextOwner NetworkContext::MakeURLRequestContext(
-    network::mojom::NetworkContextParams* network_context_params) {
+    mojom::NetworkContextParams* network_context_params) {
   URLRequestContextBuilderMojo builder;
   const base::CommandLine* command_line =
       base::CommandLine::ForCurrentProcess();
 
-  if (command_line->HasSwitch(network::switches::kHostResolverRules)) {
+  if (command_line->HasSwitch(switches::kHostResolverRules)) {
     std::unique_ptr<net::HostResolver> host_resolver(
         net::HostResolver::CreateDefaultResolver(nullptr));
     std::unique_ptr<net::MappedHostResolver> remapped_host_resolver(
         new net::MappedHostResolver(std::move(host_resolver)));
     remapped_host_resolver->SetRulesFromString(
-        command_line->GetSwitchValueASCII(
-            network::switches::kHostResolverRules));
+        command_line->GetSwitchValueASCII(switches::kHostResolverRules));
     builder.set_host_resolver(std::move(remapped_host_resolver));
   }
   builder.set_accept_language("en-us,en");
@@ -291,9 +288,8 @@
   } else {
     std::unique_ptr<net::CertVerifier> cert_verifier =
         net::CertVerifier::CreateDefault();
-    builder.SetCertVerifier(
-        content::IgnoreErrorsCertVerifier::MaybeWrapCertVerifier(
-            *command_line, nullptr, std::move(cert_verifier)));
+    builder.SetCertVerifier(IgnoreErrorsCertVerifier::MaybeWrapCertVerifier(
+        *command_line, nullptr, std::move(cert_verifier)));
   }
 
   // |network_service_| may be nullptr in tests.
@@ -305,7 +301,7 @@
 
 URLRequestContextOwner NetworkContext::ApplyContextParamsToBuilder(
     URLRequestContextBuilderMojo* builder,
-    network::mojom::NetworkContextParams* network_context_params,
+    mojom::NetworkContextParams* network_context_params,
     bool quic_disabled,
     net::NetLog* net_log) {
   URLRequestContextOwner url_request_owner;
@@ -344,11 +340,10 @@
     network_context_params->initial_proxy_config =
         net::ProxyConfig::CreateDirect();
   }
-  builder->set_proxy_config_service(
-      std::make_unique<network::ProxyConfigServiceMojo>(
-          std::move(network_context_params->proxy_config_client_request),
-          std::move(network_context_params->initial_proxy_config),
-          std::move(network_context_params->proxy_config_poller_client)));
+  builder->set_proxy_config_service(std::make_unique<ProxyConfigServiceMojo>(
+      std::move(network_context_params->proxy_config_client_request),
+      std::move(network_context_params->initial_proxy_config),
+      std::move(network_context_params->proxy_config_poller_client)));
 
   if (network_context_params->http_server_properties_path) {
     scoped_refptr<JsonPrefStore> json_pref_store(new JsonPrefStore(
@@ -384,13 +379,13 @@
 #endif
 
 #if BUILDFLAG(ENABLE_REPORTING)
-  if (base::FeatureList::IsEnabled(network::features::kReporting))
+  if (base::FeatureList::IsEnabled(features::kReporting))
     builder->set_reporting_policy(std::make_unique<net::ReportingPolicy>());
   else
     builder->set_reporting_policy(nullptr);
 
   builder->set_network_error_logging_enabled(
-      base::FeatureList::IsEnabled(network::features::kNetworkErrorLogging));
+      base::FeatureList::IsEnabled(features::kNetworkErrorLogging));
 #endif  // BUILDFLAG(ENABLE_REPORTING)
 
   net::HttpNetworkSession::Params session_params;
@@ -433,7 +428,7 @@
 
 void NetworkContext::SetNetworkConditions(
     const std::string& profile_id,
-    network::mojom::NetworkConditionsPtr conditions) {
+    mojom::NetworkConditionsPtr conditions) {
   std::unique_ptr<NetworkConditions> network_conditions;
   if (conditions) {
     network_conditions.reset(new NetworkConditions(
@@ -444,11 +439,10 @@
                                       std::move(network_conditions));
 }
 
-void NetworkContext::CreateUDPSocket(
-    network::mojom::UDPSocketRequest request,
-    network::mojom::UDPSocketReceiverPtr receiver) {
+void NetworkContext::CreateUDPSocket(mojom::UDPSocketRequest request,
+                                     mojom::UDPSocketReceiverPtr receiver) {
   if (!udp_socket_factory_)
-    udp_socket_factory_ = std::make_unique<network::UDPSocketFactory>();
+    udp_socket_factory_ = std::make_unique<UDPSocketFactory>();
   udp_socket_factory_->CreateUDPSocket(std::move(request), std::move(receiver));
 }
 
@@ -462,4 +456,4 @@
   std::move(callback).Run();
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/content/network/network_context.h b/services/network/network_context.h
similarity index 69%
rename from content/network/network_context.h
rename to services/network/network_context.h
index 5ea8efaa..21684642 100644
--- a/content/network/network_context.h
+++ b/services/network/network_context.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_NETWORK_NETWORK_CONTEXT_H_
-#define CONTENT_NETWORK_NETWORK_CONTEXT_H_
+#ifndef SERVICES_NETWORK_NETWORK_CONTEXT_H_
+#define SERVICES_NETWORK_NETWORK_CONTEXT_H_
 
 #include <stdint.h>
 
@@ -14,11 +14,10 @@
 #include "base/callback.h"
 #include "base/macros.h"
 #include "base/time/time.h"
-#include "content/common/content_export.h"
-#include "content/public/network/url_request_context_owner.h"
 #include "mojo/public/cpp/bindings/binding.h"
 #include "mojo/public/cpp/bindings/strong_binding_set.h"
 #include "services/network/cookie_manager.h"
+#include "services/network/public/cpp/url_request_context_owner.h"
 #include "services/network/public/interfaces/network_service.mojom.h"
 #include "services/network/public/interfaces/udp_socket.mojom.h"
 #include "services/network/public/interfaces/url_loader_factory.mojom.h"
@@ -26,15 +25,11 @@
 namespace net {
 class CertVerifier;
 class URLRequestContext;
-class HttpServerPropertiesManager;
-}
+}  // namespace net
 
 namespace network {
-class UDPSocketFactory;
-};  // namespace network
-
-namespace content {
 class NetworkServiceImpl;
+class UDPSocketFactory;
 class URLLoader;
 class URLRequestContextBuilderMojo;
 
@@ -51,24 +46,24 @@
 // URLRequestContext. When that happens, the consumer takes ownership of the
 // NetworkContext directly, has direct access to its URLRequestContext, and is
 // responsible for destroying it before the NetworkService.
-class CONTENT_EXPORT NetworkContext : public network::mojom::NetworkContext {
+class NetworkContext : public mojom::NetworkContext {
  public:
   NetworkContext(NetworkServiceImpl* network_service,
-                 network::mojom::NetworkContextRequest request,
-                 network::mojom::NetworkContextParamsPtr params);
+                 mojom::NetworkContextRequest request,
+                 mojom::NetworkContextParamsPtr params);
 
   // Temporary constructor that allows creating an in-process NetworkContext
   // with a pre-populated URLRequestContextBuilderMojo.
   NetworkContext(NetworkServiceImpl* network_service,
-                 network::mojom::NetworkContextRequest request,
-                 network::mojom::NetworkContextParamsPtr params,
+                 mojom::NetworkContextRequest request,
+                 mojom::NetworkContextParamsPtr params,
                  std::unique_ptr<URLRequestContextBuilderMojo> builder);
 
   // Creates a NetworkContext that wraps a consumer-provided URLRequestContext
   // that the NetworkContext does not own.
   // TODO(mmenke):  Remove this constructor when the network service ships.
   NetworkContext(NetworkServiceImpl* network_service,
-                 network::mojom::NetworkContextRequest request,
+                 mojom::NetworkContextRequest request,
                  net::URLRequestContext* url_request_context);
 
   ~NetworkContext() override;
@@ -87,25 +82,22 @@
   void RegisterURLLoader(URLLoader* url_loader);
   void DeregisterURLLoader(URLLoader* url_loader);
 
-  // network::mojom::NetworkContext implementation:
-  void CreateURLLoaderFactory(network::mojom::URLLoaderFactoryRequest request,
+  // mojom::NetworkContext implementation:
+  void CreateURLLoaderFactory(mojom::URLLoaderFactoryRequest request,
                               uint32_t process_id) override;
-  void HandleViewCacheRequest(
-      const GURL& url,
-      network::mojom::URLLoaderClientPtr client) override;
-  void GetCookieManager(network::mojom::CookieManagerRequest request) override;
-  void GetRestrictedCookieManager(
-      network::mojom::RestrictedCookieManagerRequest request,
-      int32_t render_process_id,
-      int32_t render_frame_id) override;
+  void HandleViewCacheRequest(const GURL& url,
+                              mojom::URLLoaderClientPtr client) override;
+  void GetCookieManager(mojom::CookieManagerRequest request) override;
+  void GetRestrictedCookieManager(mojom::RestrictedCookieManagerRequest request,
+                                  int32_t render_process_id,
+                                  int32_t render_frame_id) override;
   void ClearNetworkingHistorySince(
       base::Time time,
       base::OnceClosure completion_callback) override;
-  void SetNetworkConditions(
-      const std::string& profile_id,
-      network::mojom::NetworkConditionsPtr conditions) override;
-  void CreateUDPSocket(network::mojom::UDPSocketRequest request,
-                       network::mojom::UDPSocketReceiverPtr receiver) override;
+  void SetNetworkConditions(const std::string& profile_id,
+                            mojom::NetworkConditionsPtr conditions) override;
+  void CreateUDPSocket(mojom::UDPSocketRequest request,
+                       mojom::UDPSocketReceiverPtr receiver) override;
   void AddHSTSForTesting(const std::string& host,
                          base::Time expiry,
                          bool include_subdomains,
@@ -122,19 +114,19 @@
   // the URLRequestContext.
   static URLRequestContextOwner ApplyContextParamsToBuilder(
       URLRequestContextBuilderMojo* builder,
-      network::mojom::NetworkContextParams* network_context_params,
+      mojom::NetworkContextParams* network_context_params,
       bool quic_disabled,
       net::NetLog* net_log);
 
  private:
   // Constructor only used in tests.
-  explicit NetworkContext(network::mojom::NetworkContextParamsPtr params);
+  explicit NetworkContext(mojom::NetworkContextParamsPtr params);
 
   // On connection errors the NetworkContext destroys itself.
   void OnConnectionError();
 
   URLRequestContextOwner MakeURLRequestContext(
-      network::mojom::NetworkContextParams* network_context_params);
+      mojom::NetworkContextParams* network_context_params);
 
   NetworkServiceImpl* const network_service_;
 
@@ -147,8 +139,7 @@
 
   // Put it below |url_request_context_| so that it outlives all the
   // NetworkServiceURLLoaderFactory instances.
-  mojo::StrongBindingSet<network::mojom::URLLoaderFactory>
-      loader_factory_bindings_;
+  mojo::StrongBindingSet<mojom::URLLoaderFactory> loader_factory_bindings_;
 
   // URLLoaders register themselves with the NetworkContext so that they can
   // be cleaned up when the NetworkContext goes away. This is needed as
@@ -156,17 +147,17 @@
   // net::URLRequestContext (held by NetworkContext) is destroyed.
   std::set<URLLoader*> url_loaders_;
 
-  network::mojom::NetworkContextParamsPtr params_;
+  mojom::NetworkContextParamsPtr params_;
 
-  mojo::Binding<network::mojom::NetworkContext> binding_;
+  mojo::Binding<mojom::NetworkContext> binding_;
 
-  std::unique_ptr<network::CookieManager> cookie_manager_;
+  std::unique_ptr<CookieManager> cookie_manager_;
 
-  std::unique_ptr<network::UDPSocketFactory> udp_socket_factory_;
+  std::unique_ptr<UDPSocketFactory> udp_socket_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(NetworkContext);
 };
 
-}  // namespace content
+}  // namespace network
 
-#endif  // CONTENT_NETWORK_NETWORK_CONTEXT_H_
+#endif  // SERVICES_NETWORK_NETWORK_CONTEXT_H_
diff --git a/content/network/network_context_unittest.cc b/services/network/network_context_unittest.cc
similarity index 86%
rename from content/network/network_context_unittest.cc
rename to services/network/network_context_unittest.cc
index 9ed878b..6800f48 100644
--- a/content/network/network_context_unittest.cc
+++ b/services/network/network_context_unittest.cc
@@ -25,8 +25,6 @@
 #include "build/build_config.h"
 #include "components/network_session_configurator/browser/network_session_configurator.h"
 #include "components/network_session_configurator/common/network_switches.h"
-#include "content/network/network_context.h"
-#include "content/network/network_service_impl.h"
 #include "mojo/public/cpp/bindings/interface_request.h"
 #include "net/base/cache_type.h"
 #include "net/base/ip_endpoint.h"
@@ -47,6 +45,8 @@
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_builder.h"
 #include "net/url_request/url_request_job_factory.h"
+#include "services/network/network_context.h"
+#include "services/network/network_service_impl.h"
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/interfaces/network_service.mojom.h"
 #include "services/network/public/interfaces/proxy_config.mojom.h"
@@ -56,13 +56,12 @@
 #include "url/scheme_host_port.h"
 #include "url/url_constants.h"
 
-namespace content {
+namespace network {
 
 namespace {
 
-network::mojom::NetworkContextParamsPtr CreateContextParams() {
-  network::mojom::NetworkContextParamsPtr params =
-      network::mojom::NetworkContextParams::New();
+mojom::NetworkContextParamsPtr CreateContextParams() {
+  mojom::NetworkContextParamsPtr params = mojom::NetworkContextParams::New();
   // Use a fixed proxy config, to avoid dependencies on local network
   // configuration.
   params->initial_proxy_config = net::ProxyConfig::CreateDirect();
@@ -78,7 +77,7 @@
   ~NetworkContextTest() override {}
 
   std::unique_ptr<NetworkContext> CreateContextWithParams(
-      network::mojom::NetworkContextParamsPtr context_params) {
+      mojom::NetworkContextParamsPtr context_params) {
     return std::make_unique<NetworkContext>(
         network_service_.get(), mojo::MakeRequest(&network_context_ptr_),
         std::move(context_params));
@@ -105,7 +104,7 @@
     return net::URLRequestContextBuilder::HttpCacheParams::IN_MEMORY;
   }
 
-  network::mojom::NetworkService* network_service() const {
+  mojom::NetworkService* network_service() const {
     return network_service_.get();
   }
 
@@ -116,7 +115,7 @@
   // since destroying this before the NetworkContext itself triggers deletion of
   // the NetworkContext. These tests are probably fine anyways, since the
   // message loop must be spun for that to happen.
-  network::mojom::NetworkContextPtr network_context_ptr_;
+  mojom::NetworkContextPtr network_context_ptr_;
 };
 
 TEST_F(NetworkContextTest, DisableQuic) {
@@ -162,8 +161,8 @@
 
 TEST_F(NetworkContextTest, EnableBrotli) {
   for (bool enable_brotli : {true, false}) {
-    network::mojom::NetworkContextParamsPtr context_params =
-        network::mojom::NetworkContextParams::New();
+    mojom::NetworkContextParamsPtr context_params =
+        mojom::NetworkContextParams::New();
     context_params->enable_brotli = enable_brotli;
     std::unique_ptr<NetworkContext> network_context =
         CreateContextWithParams(std::move(context_params));
@@ -174,8 +173,8 @@
 
 TEST_F(NetworkContextTest, ContextName) {
   const char kContextName[] = "Jim";
-  network::mojom::NetworkContextParamsPtr context_params =
-      network::mojom::NetworkContextParams::New();
+  mojom::NetworkContextParamsPtr context_params =
+      mojom::NetworkContextParams::New();
   context_params->context_name = std::string(kContextName);
   std::unique_ptr<NetworkContext> network_context =
       CreateContextWithParams(std::move(context_params));
@@ -184,8 +183,7 @@
 
 TEST_F(NetworkContextTest, QuicUserAgentId) {
   const char kQuicUserAgentId[] = "007";
-  network::mojom::NetworkContextParamsPtr context_params =
-      CreateContextParams();
+  mojom::NetworkContextParamsPtr context_params = CreateContextParams();
   context_params->quic_user_agent_id = kQuicUserAgentId;
   std::unique_ptr<NetworkContext> network_context =
       CreateContextWithParams(std::move(context_params));
@@ -197,8 +195,7 @@
 }
 
 TEST_F(NetworkContextTest, DisableDataUrlSupport) {
-  network::mojom::NetworkContextParamsPtr context_params =
-      CreateContextParams();
+  mojom::NetworkContextParamsPtr context_params = CreateContextParams();
   context_params->enable_data_url_support = false;
   std::unique_ptr<NetworkContext> network_context =
       CreateContextWithParams(std::move(context_params));
@@ -208,8 +205,7 @@
 }
 
 TEST_F(NetworkContextTest, EnableDataUrlSupport) {
-  network::mojom::NetworkContextParamsPtr context_params =
-      CreateContextParams();
+  mojom::NetworkContextParamsPtr context_params = CreateContextParams();
   context_params->enable_data_url_support = true;
   std::unique_ptr<NetworkContext> network_context =
       CreateContextWithParams(std::move(context_params));
@@ -219,8 +215,7 @@
 }
 
 TEST_F(NetworkContextTest, DisableFileUrlSupport) {
-  network::mojom::NetworkContextParamsPtr context_params =
-      CreateContextParams();
+  mojom::NetworkContextParamsPtr context_params = CreateContextParams();
   context_params->enable_file_url_support = false;
   std::unique_ptr<NetworkContext> network_context =
       CreateContextWithParams(std::move(context_params));
@@ -231,8 +226,7 @@
 
 #if !BUILDFLAG(DISABLE_FILE_SUPPORT)
 TEST_F(NetworkContextTest, EnableFileUrlSupport) {
-  network::mojom::NetworkContextParamsPtr context_params =
-      CreateContextParams();
+  mojom::NetworkContextParamsPtr context_params = CreateContextParams();
   context_params->enable_file_url_support = true;
   std::unique_ptr<NetworkContext> network_context =
       CreateContextWithParams(std::move(context_params));
@@ -243,8 +237,7 @@
 #endif  // !BUILDFLAG(DISABLE_FILE_SUPPORT)
 
 TEST_F(NetworkContextTest, DisableFtpUrlSupport) {
-  network::mojom::NetworkContextParamsPtr context_params =
-      CreateContextParams();
+  mojom::NetworkContextParamsPtr context_params = CreateContextParams();
   context_params->enable_ftp_url_support = false;
   std::unique_ptr<NetworkContext> network_context =
       CreateContextWithParams(std::move(context_params));
@@ -255,8 +248,7 @@
 
 #if !BUILDFLAG(DISABLE_FTP_SUPPORT)
 TEST_F(NetworkContextTest, EnableFtpUrlSupport) {
-  network::mojom::NetworkContextParamsPtr context_params =
-      CreateContextParams();
+  mojom::NetworkContextParamsPtr context_params = CreateContextParams();
   context_params->enable_ftp_url_support = true;
   std::unique_ptr<NetworkContext> network_context =
       CreateContextWithParams(std::move(context_params));
@@ -269,7 +261,7 @@
 #if BUILDFLAG(ENABLE_REPORTING)
 TEST_F(NetworkContextTest, DisableReporting) {
   base::test::ScopedFeatureList scoped_feature_list_;
-  scoped_feature_list_.InitAndDisableFeature(network::features::kReporting);
+  scoped_feature_list_.InitAndDisableFeature(features::kReporting);
 
   std::unique_ptr<NetworkContext> network_context =
       CreateContextWithParams(CreateContextParams());
@@ -278,7 +270,7 @@
 
 TEST_F(NetworkContextTest, EnableReporting) {
   base::test::ScopedFeatureList scoped_feature_list_;
-  scoped_feature_list_.InitAndEnableFeature(network::features::kReporting);
+  scoped_feature_list_.InitAndEnableFeature(features::kReporting);
 
   std::unique_ptr<NetworkContext> network_context =
       CreateContextWithParams(CreateContextParams());
@@ -287,8 +279,7 @@
 
 TEST_F(NetworkContextTest, DisableNetworkErrorLogging) {
   base::test::ScopedFeatureList scoped_feature_list_;
-  scoped_feature_list_.InitAndDisableFeature(
-      network::features::kNetworkErrorLogging);
+  scoped_feature_list_.InitAndDisableFeature(features::kNetworkErrorLogging);
 
   std::unique_ptr<NetworkContext> network_context =
       CreateContextWithParams(CreateContextParams());
@@ -298,8 +289,7 @@
 
 TEST_F(NetworkContextTest, EnableNetworkErrorLogging) {
   base::test::ScopedFeatureList scoped_feature_list_;
-  scoped_feature_list_.InitAndEnableFeature(
-      network::features::kNetworkErrorLogging);
+  scoped_feature_list_.InitAndEnableFeature(features::kNetworkErrorLogging);
 
   std::unique_ptr<NetworkContext> network_context =
       CreateContextWithParams(CreateContextParams());
@@ -309,8 +299,7 @@
 #endif  // BUILDFLAG(ENABLE_REPORTING)
 
 TEST_F(NetworkContextTest, Http09Disabled) {
-  network::mojom::NetworkContextParamsPtr context_params =
-      CreateContextParams();
+  mojom::NetworkContextParamsPtr context_params = CreateContextParams();
   context_params->http_09_on_non_default_ports_enabled = false;
   std::unique_ptr<NetworkContext> network_context =
       CreateContextWithParams(std::move(context_params));
@@ -322,8 +311,7 @@
 }
 
 TEST_F(NetworkContextTest, Http09Enabled) {
-  network::mojom::NetworkContextParamsPtr context_params =
-      CreateContextParams();
+  mojom::NetworkContextParamsPtr context_params = CreateContextParams();
   context_params->http_09_on_non_default_ports_enabled = true;
   std::unique_ptr<NetworkContext> network_context =
       CreateContextWithParams(std::move(context_params));
@@ -375,8 +363,7 @@
 }
 
 TEST_F(NetworkContextTest, NoCache) {
-  network::mojom::NetworkContextParamsPtr context_params =
-      CreateContextParams();
+  mojom::NetworkContextParamsPtr context_params = CreateContextParams();
   context_params->http_cache_enabled = false;
   std::unique_ptr<NetworkContext> network_context =
       CreateContextWithParams(std::move(context_params));
@@ -386,8 +373,7 @@
 }
 
 TEST_F(NetworkContextTest, MemoryCache) {
-  network::mojom::NetworkContextParamsPtr context_params =
-      CreateContextParams();
+  mojom::NetworkContextParamsPtr context_params = CreateContextParams();
   context_params->http_cache_enabled = true;
   std::unique_ptr<NetworkContext> network_context =
       CreateContextWithParams(std::move(context_params));
@@ -406,8 +392,7 @@
 }
 
 TEST_F(NetworkContextTest, DiskCache) {
-  network::mojom::NetworkContextParamsPtr context_params =
-      CreateContextParams();
+  mojom::NetworkContextParamsPtr context_params = CreateContextParams();
   context_params->http_cache_enabled = true;
 
   base::ScopedTempDir temp_dir;
@@ -438,8 +423,7 @@
 TEST_F(NetworkContextTest, SimpleCache) {
   base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
       switches::kUseSimpleCacheBackend, "on");
-  network::mojom::NetworkContextParamsPtr context_params =
-      CreateContextParams();
+  mojom::NetworkContextParamsPtr context_params = CreateContextParams();
   context_params->http_cache_enabled = true;
 
   base::ScopedTempDir temp_dir;
@@ -474,8 +458,8 @@
   const url::SchemeHostPort kSchemeHostPort("https", "foo", 443);
 
   // Create a context with on-disk storage of HTTP server properties.
-  network::mojom::NetworkContextParamsPtr context_params =
-      network::mojom::NetworkContextParams::New();
+  mojom::NetworkContextParamsPtr context_params =
+      mojom::NetworkContextParams::New();
   context_params->http_server_properties_path = file_path;
   std::unique_ptr<NetworkContext> network_context =
       CreateContextWithParams(std::move(context_params));
@@ -496,7 +480,7 @@
   scoped_task_environment_.RunUntilIdle();
 
   // Create a new NetworkContext using the same path for HTTP server properties.
-  context_params = network::mojom::NetworkContextParams::New();
+  context_params = mojom::NetworkContextParams::New();
   context_params->http_server_properties_path = file_path;
   network_context = CreateContextWithParams(std::move(context_params));
 
@@ -530,7 +514,7 @@
   const url::SchemeHostPort kSchemeHostPort("https", "foo", 443);
 
   std::unique_ptr<NetworkContext> network_context =
-      CreateContextWithParams(network::mojom::NetworkContextParams::New());
+      CreateContextWithParams(mojom::NetworkContextParams::New());
 
   EXPECT_FALSE(network_context->url_request_context()
                    ->http_server_properties()
@@ -566,10 +550,10 @@
 
 TEST_F(NetworkContextTest, CookieManager) {
   std::unique_ptr<NetworkContext> network_context =
-      CreateContextWithParams(network::mojom::NetworkContextParams::New());
+      CreateContextWithParams(mojom::NetworkContextParams::New());
 
-  network::mojom::CookieManagerPtr cookie_manager_ptr;
-  network::mojom::CookieManagerRequest cookie_manager_request(
+  mojom::CookieManagerPtr cookie_manager_ptr;
+  mojom::CookieManagerRequest cookie_manager_request(
       mojo::MakeRequest(&cookie_manager_ptr));
   network_context->GetCookieManager(std::move(cookie_manager_request));
 
@@ -618,10 +602,9 @@
   // Try each proxy config as the initial config, to make sure setting the
   // initial config works.
   for (const auto& initial_proxy_config : proxy_configs) {
-    network::mojom::NetworkContextParamsPtr context_params =
-        CreateContextParams();
+    mojom::NetworkContextParamsPtr context_params = CreateContextParams();
     context_params->initial_proxy_config = initial_proxy_config;
-    network::mojom::ProxyConfigClientPtr config_client;
+    mojom::ProxyConfigClientPtr config_client;
     context_params->proxy_config_client_request =
         mojo::MakeRequest(&config_client);
     std::unique_ptr<NetworkContext> network_context =
@@ -633,7 +616,8 @@
     // its config until it's first used.
     proxy_resolution_service->ForceReloadProxyConfig();
     EXPECT_TRUE(proxy_resolution_service->config().is_valid());
-    EXPECT_TRUE(proxy_resolution_service->config().Equals(initial_proxy_config));
+    EXPECT_TRUE(
+        proxy_resolution_service->config().Equals(initial_proxy_config));
 
     // Always go through the other configs in the same order. This has the
     // advantage of testing the case where there's no change, for
@@ -652,8 +636,7 @@
   net::ProxyConfig proxy_config;
   proxy_config.proxy_rules().ParseFromString("http=foopy:80;ftp=foopy2");
 
-  network::mojom::NetworkContextParamsPtr context_params =
-      CreateContextParams();
+  mojom::NetworkContextParamsPtr context_params = CreateContextParams();
   context_params->initial_proxy_config = proxy_config;
   std::unique_ptr<NetworkContext> network_context =
       CreateContextWithParams(std::move(context_params));
@@ -668,10 +651,9 @@
 }
 
 TEST_F(NetworkContextTest, NoInitialProxyConfig) {
-  network::mojom::NetworkContextParamsPtr context_params =
-      CreateContextParams();
+  mojom::NetworkContextParamsPtr context_params = CreateContextParams();
   context_params->initial_proxy_config.reset();
-  network::mojom::ProxyConfigClientPtr config_client;
+  mojom::ProxyConfigClientPtr config_client;
   context_params->proxy_config_client_request =
       mojo::MakeRequest(&config_client);
   std::unique_ptr<NetworkContext> network_context =
@@ -686,10 +668,10 @@
   net::ProxyInfo proxy_info;
   net::TestCompletionCallback test_callback;
   net::ProxyResolutionService::Request* request = nullptr;
-  ASSERT_EQ(net::ERR_IO_PENDING,
-            proxy_resolution_service->ResolveProxy(GURL("http://bar/"), "GET", &proxy_info,
-                                        test_callback.callback(), &request,
-                                        nullptr, net::NetLogWithSource()));
+  ASSERT_EQ(net::ERR_IO_PENDING, proxy_resolution_service->ResolveProxy(
+                                     GURL("http://bar/"), "GET", &proxy_info,
+                                     test_callback.callback(), &request,
+                                     nullptr, net::NetLogWithSource()));
   scoped_task_environment_.RunUntilIdle();
   EXPECT_FALSE(proxy_resolution_service->config().is_valid());
   EXPECT_FALSE(proxy_resolution_service->fetched_config().is_valid());
@@ -704,16 +686,15 @@
   EXPECT_EQ("foopy", proxy_info.proxy_server().host_port_pair().host());
 }
 
-class TestProxyConfigLazyPoller
-    : public network::mojom::ProxyConfigPollerClient {
+class TestProxyConfigLazyPoller : public mojom::ProxyConfigPollerClient {
  public:
   TestProxyConfigLazyPoller() : binding_(this) {}
   ~TestProxyConfigLazyPoller() override {}
 
   void OnLazyProxyConfigPoll() override { ++times_polled_; }
 
-  network::mojom::ProxyConfigPollerClientPtr BindInterface() {
-    network::mojom::ProxyConfigPollerClientPtr interface;
+  mojom::ProxyConfigPollerClientPtr BindInterface() {
+    mojom::ProxyConfigPollerClientPtr interface;
     binding_.Bind(MakeRequest(&interface));
     return interface;
   }
@@ -749,32 +730,32 @@
       CreateContextWithParams(CreateContextParams());
 
   // Create a server socket to listen for incoming datagrams.
-  network::test::UDPSocketReceiverImpl receiver;
-  mojo::Binding<network::mojom::UDPSocketReceiver> receiver_binding(&receiver);
-  network::mojom::UDPSocketReceiverPtr receiver_interface_ptr;
+  test::UDPSocketReceiverImpl receiver;
+  mojo::Binding<mojom::UDPSocketReceiver> receiver_binding(&receiver);
+  mojom::UDPSocketReceiverPtr receiver_interface_ptr;
   receiver_binding.Bind(mojo::MakeRequest(&receiver_interface_ptr));
 
   net::IPEndPoint server_addr(GetLocalHostWithAnyPort());
-  network::mojom::UDPSocketPtr server_socket;
+  mojom::UDPSocketPtr server_socket;
   network_context->CreateUDPSocket(mojo::MakeRequest(&server_socket),
                                    std::move(receiver_interface_ptr));
-  ASSERT_EQ(net::OK, network::test::UDPSocketTestHelper::OpenSync(
+  ASSERT_EQ(net::OK, test::UDPSocketTestHelper::OpenSync(
                          &server_socket, server_addr.GetFamily()));
-  ASSERT_EQ(net::OK, network::test::UDPSocketTestHelper::BindSync(
+  ASSERT_EQ(net::OK, test::UDPSocketTestHelper::BindSync(
                          &server_socket, server_addr, &server_addr));
 
   // Create a client socket to send datagrams.
-  network::mojom::UDPSocketPtr client_socket;
-  network::mojom::UDPSocketRequest client_socket_request(
+  mojom::UDPSocketPtr client_socket;
+  mojom::UDPSocketRequest client_socket_request(
       mojo::MakeRequest(&client_socket));
-  network::mojom::UDPSocketReceiverPtr client_receiver_ptr;
+  mojom::UDPSocketReceiverPtr client_receiver_ptr;
   network_context->CreateUDPSocket(std::move(client_socket_request),
                                    std::move(client_receiver_ptr));
 
   net::IPEndPoint client_addr(GetLocalHostWithAnyPort());
-  ASSERT_EQ(net::OK, network::test::UDPSocketTestHelper::OpenSync(
+  ASSERT_EQ(net::OK, test::UDPSocketTestHelper::OpenSync(
                          &client_socket, client_addr.GetFamily()));
-  ASSERT_EQ(net::OK, network::test::UDPSocketTestHelper::ConnectSync(
+  ASSERT_EQ(net::OK, test::UDPSocketTestHelper::ConnectSync(
                          &client_socket, server_addr, &client_addr));
 
   // This test assumes that the loopback interface doesn't drop UDP packets for
@@ -786,8 +767,7 @@
   for (size_t i = 0; i < kDatagramCount; ++i) {
     std::vector<uint8_t> test_msg(
         CreateTestMessage(static_cast<uint8_t>(i), kDatagramSize));
-    int result =
-        network::test::UDPSocketTestHelper::SendSync(&client_socket, test_msg);
+    int result = test::UDPSocketTestHelper::SendSync(&client_socket, test_msg);
     EXPECT_EQ(net::OK, result);
   }
 
@@ -806,4 +786,4 @@
 
 }  // namespace
 
-}  // namespace content
+}  // namespace network
diff --git a/content/network/network_sandbox_hook_linux.cc b/services/network/network_sandbox_hook_linux.cc
similarity index 92%
rename from content/network/network_sandbox_hook_linux.cc
rename to services/network/network_sandbox_hook_linux.cc
index a3068ff..983a6da 100644
--- a/content/network/network_sandbox_hook_linux.cc
+++ b/services/network/network_sandbox_hook_linux.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/network_sandbox_hook_linux.h"
+#include "services/network/network_sandbox_hook_linux.h"
 #include "sandbox/linux/syscall_broker/broker_command.h"
 
 #include "base/rand_util.h"
@@ -11,7 +11,7 @@
 using sandbox::syscall_broker::BrokerFilePermission;
 using sandbox::syscall_broker::MakeBrokerCommandSet;
 
-namespace content {
+namespace network {
 
 bool NetworkPreSandboxHook(service_manager::SandboxLinux::Options options) {
   auto* instance = service_manager::SandboxLinux::GetInstance();
@@ -35,4 +35,4 @@
   return true;
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/services/network/network_sandbox_hook_linux.h b/services/network/network_sandbox_hook_linux.h
new file mode 100644
index 0000000..9631dd4
--- /dev/null
+++ b/services/network/network_sandbox_hook_linux.h
@@ -0,0 +1,16 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef SERVICES_NETWORK_NETWORK_SANDBOX_HOOK_LINUX_H_
+#define SERVICES_NETWORK_NETWORK_SANDBOX_HOOK_LINUX_H_
+
+#include "services/service_manager/sandbox/linux/sandbox_linux.h"
+
+namespace network {
+
+bool NetworkPreSandboxHook(service_manager::SandboxLinux::Options options);
+
+}  // namespace network
+
+#endif  // SERVICES_NETWORK_NETWORK_SANDBOX_HOOK_LINUX_H_
diff --git a/content/network/network_service_impl.cc b/services/network/network_service_impl.cc
similarity index 87%
rename from content/network/network_service_impl.cc
rename to services/network/network_service_impl.cc
index ab98cdc4..763f608 100644
--- a/content/network/network_service_impl.cc
+++ b/services/network/network_service_impl.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/network_service_impl.h"
+#include "services/network/network_service_impl.h"
 
 #include <utility>
 
@@ -11,8 +11,6 @@
 #include "base/memory/ptr_util.h"
 #include "base/values.h"
 #include "build/build_config.h"
-#include "content/network/network_context.h"
-#include "content/public/network/url_request_context_builder_mojo.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
 #include "net/base/logging_network_change_observer.h"
 #include "net/base/network_change_notifier.h"
@@ -20,9 +18,11 @@
 #include "net/log/net_log.h"
 #include "net/log/net_log_util.h"
 #include "net/url_request/url_request_context_builder.h"
+#include "services/network/network_context.h"
 #include "services/network/public/cpp/network_switches.h"
+#include "services/network/public/cpp/url_request_context_builder_mojo.h"
 
-namespace content {
+namespace network {
 
 namespace {
 
@@ -51,7 +51,7 @@
 }  // namespace
 
 std::unique_ptr<NetworkService> NetworkService::Create(
-    network::mojom::NetworkServiceRequest request,
+    mojom::NetworkServiceRequest request,
     net::NetLog* net_log) {
   return std::make_unique<NetworkServiceImpl>(nullptr, std::move(request),
                                               net_log);
@@ -64,11 +64,11 @@
   // If specified by the command line, stream network events (NetLog) to a
   // file on disk. This will last for the duration of the process.
   void ProcessCommandLine(const base::CommandLine& command_line) {
-    if (!command_line.HasSwitch(network::switches::kLogNetLog))
+    if (!command_line.HasSwitch(switches::kLogNetLog))
       return;
 
     base::FilePath log_path =
-        command_line.GetSwitchValuePath(network::switches::kLogNetLog);
+        command_line.GetSwitchValuePath(switches::kLogNetLog);
 
     // TODO(eroman): Should get capture mode from the command line.
     net::NetLogCaptureMode capture_mode =
@@ -91,7 +91,7 @@
 
 NetworkServiceImpl::NetworkServiceImpl(
     std::unique_ptr<service_manager::BinderRegistry> registry,
-    network::mojom::NetworkServiceRequest request,
+    mojom::NetworkServiceRequest request,
     net::NetLog* net_log)
     : registry_(std::move(registry)), binding_(this) {
   // |registry_| is nullptr when an in-process NetworkService is
@@ -100,7 +100,7 @@
   // network service.
   if (registry_) {
     DCHECK(!request.is_pending());
-    registry_->AddInterface<network::mojom::NetworkService>(
+    registry_->AddInterface<mojom::NetworkService>(
         base::BindRepeating(&NetworkServiceImpl::Bind, base::Unretained(this)));
   } else if (request.is_pending()) {
     Bind(std::move(request));
@@ -135,10 +135,10 @@
     (*network_contexts_.begin())->Cleanup();
 }
 
-std::unique_ptr<network::mojom::NetworkContext>
+std::unique_ptr<mojom::NetworkContext>
 NetworkServiceImpl::CreateNetworkContextWithBuilder(
-    network::mojom::NetworkContextRequest request,
-    network::mojom::NetworkContextParamsPtr params,
+    mojom::NetworkContextRequest request,
+    mojom::NetworkContextParamsPtr params,
     std::unique_ptr<URLRequestContextBuilderMojo> builder,
     net::URLRequestContext** url_request_context) {
   std::unique_ptr<NetworkContext> network_context =
@@ -167,14 +167,13 @@
   network_contexts_.erase(network_context);
 }
 
-void NetworkServiceImpl::SetClient(
-    network::mojom::NetworkServiceClientPtr client) {
+void NetworkServiceImpl::SetClient(mojom::NetworkServiceClientPtr client) {
   client_ = std::move(client);
 }
 
 void NetworkServiceImpl::CreateNetworkContext(
-    network::mojom::NetworkContextRequest request,
-    network::mojom::NetworkContextParamsPtr params) {
+    mojom::NetworkContextRequest request,
+    mojom::NetworkContextParamsPtr params) {
   // The NetworkContext will destroy itself on connection error, or when the
   // service is destroyed.
   new NetworkContext(this, std::move(request), std::move(params));
@@ -209,7 +208,7 @@
 }
 
 void NetworkServiceImpl::GetNetworkChangeManager(
-    network::mojom::NetworkChangeManagerRequest request) {
+    mojom::NetworkChangeManagerRequest request) {
   network_change_manager_->AddRequest(std::move(request));
 }
 
@@ -220,9 +219,9 @@
   registry_->BindInterface(interface_name, std::move(interface_pipe));
 }
 
-void NetworkServiceImpl::Bind(network::mojom::NetworkServiceRequest request) {
+void NetworkServiceImpl::Bind(mojom::NetworkServiceRequest request) {
   DCHECK(!binding_.is_bound());
   binding_.Bind(std::move(request));
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/content/network/network_service_impl.h b/services/network/network_service_impl.h
similarity index 70%
rename from content/network/network_service_impl.h
rename to services/network/network_service_impl.h
index c9c98b4..bef84fa 100644
--- a/content/network/network_service_impl.h
+++ b/services/network/network_service_impl.h
@@ -2,18 +2,17 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_NETWORK_NETWORK_SERVICE_IMPL_H_
-#define CONTENT_NETWORK_NETWORK_SERVICE_IMPL_H_
+#ifndef SERVICES_NETWORK_NETWORK_SERVICE_IMPL_H_
+#define SERVICES_NETWORK_NETWORK_SERVICE_IMPL_H_
 
 #include <memory>
 #include <set>
 #include <string>
 
 #include "base/macros.h"
-#include "content/common/content_export.h"
-#include "content/network/network_change_manager.h"
-#include "content/public/network/network_service.h"
 #include "mojo/public/cpp/bindings/binding.h"
+#include "services/network/network_change_manager.h"
+#include "services/network/public/cpp/network_service.h"
 #include "services/network/public/interfaces/network_change_manager.mojom.h"
 #include "services/network/public/interfaces/network_service.mojom.h"
 #include "services/service_manager/public/cpp/binder_registry.h"
@@ -24,12 +23,12 @@
 class LoggingNetworkChangeObserver;
 }  // namespace net
 
-namespace content {
+namespace network {
 
 class NetworkContext;
 
-class CONTENT_EXPORT NetworkServiceImpl : public service_manager::Service,
-                                          public NetworkService {
+class NetworkServiceImpl : public service_manager::Service,
+                           public NetworkService {
  public:
   // |net_log| is an optional shared NetLog, which will be used instead of the
   // service's own NetLog. It must outlive the NetworkService.
@@ -37,21 +36,20 @@
   // TODO(https://crbug.com/767450): Once the NetworkService can always create
   // its own NetLog in production, remove the |net_log| argument.
   NetworkServiceImpl(std::unique_ptr<service_manager::BinderRegistry> registry,
-                     network::mojom::NetworkServiceRequest request = nullptr,
+                     mojom::NetworkServiceRequest request = nullptr,
                      net::NetLog* net_log = nullptr);
 
   ~NetworkServiceImpl() override;
 
-  std::unique_ptr<network::mojom::NetworkContext>
-  CreateNetworkContextWithBuilder(
-      network::mojom::NetworkContextRequest request,
-      network::mojom::NetworkContextParamsPtr params,
+  std::unique_ptr<mojom::NetworkContext> CreateNetworkContextWithBuilder(
+      mojom::NetworkContextRequest request,
+      mojom::NetworkContextParamsPtr params,
       std::unique_ptr<URLRequestContextBuilderMojo> builder,
       net::URLRequestContext** url_request_context) override;
 
   // Allows late binding if the mojo request wasn't specified in the
   // constructor.
-  void Bind(network::mojom::NetworkServiceRequest request);
+  void Bind(mojom::NetworkServiceRequest request);
 
   static std::unique_ptr<NetworkServiceImpl> CreateForTesting();
 
@@ -60,20 +58,19 @@
   void RegisterNetworkContext(NetworkContext* network_context);
   void DeregisterNetworkContext(NetworkContext* network_context);
 
-  // network::mojom::NetworkService implementation:
-  void SetClient(network::mojom::NetworkServiceClientPtr client) override;
-  void CreateNetworkContext(
-      network::mojom::NetworkContextRequest request,
-      network::mojom::NetworkContextParamsPtr params) override;
+  // mojom::NetworkService implementation:
+  void SetClient(mojom::NetworkServiceClientPtr client) override;
+  void CreateNetworkContext(mojom::NetworkContextRequest request,
+                            mojom::NetworkContextParamsPtr params) override;
   void DisableQuic() override;
   void SetRawHeadersAccess(uint32_t process_id, bool allow) override;
   void GetNetworkChangeManager(
-      network::mojom::NetworkChangeManagerRequest request) override;
+      mojom::NetworkChangeManagerRequest request) override;
 
   bool quic_disabled() const { return quic_disabled_; }
   bool HasRawHeadersAccess(uint32_t process_id) const;
 
-  network::mojom::NetworkServiceClient* client() { return client_.get(); }
+  mojom::NetworkServiceClient* client() { return client_.get(); }
   net::NetLog* net_log() const;
 
  private:
@@ -91,7 +88,7 @@
   // its own NetLog.
   net::NetLog* net_log_;
 
-  network::mojom::NetworkServiceClientPtr client_;
+  mojom::NetworkServiceClientPtr client_;
 
   // Observer that logs network changes to the NetLog. Must be below the NetLog
   // and the NetworkChangeNotifier (Once this class creates it), so it's
@@ -102,7 +99,7 @@
 
   std::unique_ptr<service_manager::BinderRegistry> registry_;
 
-  mojo::Binding<network::mojom::NetworkService> binding_;
+  mojo::Binding<mojom::NetworkService> binding_;
 
   // NetworkContexts register themselves with the NetworkService so that they
   // can be cleaned up when the NetworkService goes away. This is needed as
@@ -116,6 +113,6 @@
   DISALLOW_COPY_AND_ASSIGN(NetworkServiceImpl);
 };
 
-}  // namespace content
+}  // namespace network
 
-#endif  // CONTENT_NETWORK_NETWORK_SERVICE_IMPL_H_
+#endif  // SERVICES_NETWORK_NETWORK_SERVICE_IMPL_H_
diff --git a/content/network/network_service_url_loader_factory.cc b/services/network/network_service_url_loader_factory.cc
similarity index 75%
rename from content/network/network_service_url_loader_factory.cc
rename to services/network/network_service_url_loader_factory.cc
index 2cfb4472..3e53bf6 100644
--- a/content/network/network_service_url_loader_factory.cc
+++ b/services/network/network_service_url_loader_factory.cc
@@ -2,15 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/network_service_url_loader_factory.h"
+#include "services/network/network_service_url_loader_factory.h"
 
 #include "base/logging.h"
-#include "content/network/network_context.h"
-#include "content/network/network_service_impl.h"
-#include "content/network/url_loader.h"
+#include "services/network/network_context.h"
+#include "services/network/network_service_impl.h"
 #include "services/network/public/cpp/resource_request.h"
+#include "services/network/url_loader.h"
 
-namespace content {
+namespace network {
 
 NetworkServiceURLLoaderFactory::NetworkServiceURLLoaderFactory(
     NetworkContext* context,
@@ -22,12 +22,12 @@
 NetworkServiceURLLoaderFactory::~NetworkServiceURLLoaderFactory() = default;
 
 void NetworkServiceURLLoaderFactory::CreateLoaderAndStart(
-    network::mojom::URLLoaderRequest request,
+    mojom::URLLoaderRequest request,
     int32_t routing_id,
     int32_t request_id,
     uint32_t options,
-    const network::ResourceRequest& url_request,
-    network::mojom::URLLoaderClientPtr client,
+    const ResourceRequest& url_request,
+    mojom::URLLoaderClientPtr client,
     const net::MutableNetworkTrafficAnnotationTag& traffic_annotation) {
   bool report_raw_headers = false;
   if (url_request.report_raw_headers) {
@@ -44,8 +44,8 @@
 }
 
 void NetworkServiceURLLoaderFactory::Clone(
-    network::mojom::URLLoaderFactoryRequest request) {
+    mojom::URLLoaderFactoryRequest request) {
   context_->CreateURLLoaderFactory(std::move(request), process_id_);
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/services/network/network_service_url_loader_factory.h b/services/network/network_service_url_loader_factory.h
new file mode 100644
index 0000000..db319c6
--- /dev/null
+++ b/services/network/network_service_url_loader_factory.h
@@ -0,0 +1,46 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef SERVICES_NETWORK_NETWORK_SERVICE_URL_LOADER_FACTORY_H_
+#define SERVICES_NETWORK_NETWORK_SERVICE_URL_LOADER_FACTORY_H_
+
+#include "base/macros.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
+#include "services/network/public/interfaces/url_loader_factory.mojom.h"
+
+namespace network {
+
+class NetworkContext;
+
+// This class is an implementation of mojom::URLLoaderFactory that
+// creates a mojom::URLLoader.
+class NetworkServiceURLLoaderFactory : public mojom::URLLoaderFactory {
+ public:
+  // NOTE: |context| must outlive this instance.
+  NetworkServiceURLLoaderFactory(NetworkContext* context, uint32_t process_id);
+
+  ~NetworkServiceURLLoaderFactory() override;
+
+  // mojom::URLLoaderFactory implementation.
+  void CreateLoaderAndStart(mojom::URLLoaderRequest request,
+                            int32_t routing_id,
+                            int32_t request_id,
+                            uint32_t options,
+                            const ResourceRequest& url_request,
+                            mojom::URLLoaderClientPtr client,
+                            const net::MutableNetworkTrafficAnnotationTag&
+                                traffic_annotation) override;
+  void Clone(mojom::URLLoaderFactoryRequest request) override;
+
+ private:
+  // Not owned.
+  NetworkContext* context_;
+  uint32_t process_id_;
+
+  DISALLOW_COPY_AND_ASSIGN(NetworkServiceURLLoaderFactory);
+};
+
+}  // namespace network
+
+#endif  // SERVICES_NETWORK_NETWORK_SERVICE_URL_LOADER_FACTORY_H_
diff --git a/content/network/proxy_resolver_factory_mojo.cc b/services/network/proxy_resolver_factory_mojo.cc
similarity index 98%
rename from content/network/proxy_resolver_factory_mojo.cc
rename to services/network/proxy_resolver_factory_mojo.cc
index 16949275..805916f 100644
--- a/content/network/proxy_resolver_factory_mojo.cc
+++ b/services/network/proxy_resolver_factory_mojo.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/proxy_resolver_factory_mojo.h"
+#include "services/network/proxy_resolver_factory_mojo.h"
 
 #include <set>
 #include <utility>
@@ -31,7 +31,7 @@
 #include "net/proxy_resolution/proxy_resolver_error_observer.h"
 #include "services/proxy_resolver/public/interfaces/proxy_resolver.mojom.h"
 
-namespace content {
+namespace network {
 
 namespace {
 
@@ -374,4 +374,4 @@
   return net::ERR_IO_PENDING;
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/content/network/proxy_resolver_factory_mojo.h b/services/network/proxy_resolver_factory_mojo.h
similarity index 83%
rename from content/network/proxy_resolver_factory_mojo.h
rename to services/network/proxy_resolver_factory_mojo.h
index 4ee6203..85d829e 100644
--- a/content/network/proxy_resolver_factory_mojo.h
+++ b/services/network/proxy_resolver_factory_mojo.h
@@ -2,15 +2,14 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_NETWORK_PROXY_RESOLVER_FACTORY_MOJO_H_
-#define CONTENT_NETWORK_PROXY_RESOLVER_FACTORY_MOJO_H_
+#ifndef SERVICES_NETWORK_PROXY_RESOLVER_FACTORY_MOJO_H_
+#define SERVICES_NETWORK_PROXY_RESOLVER_FACTORY_MOJO_H_
 
 #include <memory>
 
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
-#include "content/common/content_export.h"
 #include "mojo/public/cpp/bindings/binding.h"
 #include "net/base/completion_callback.h"
 #include "net/proxy_resolution/proxy_resolver_factory.h"
@@ -23,12 +22,11 @@
 class ProxyResolverScriptData;
 }  // namespace net
 
-namespace content {
+namespace network {
 
 // Implementation of ProxyResolverFactory that connects to a Mojo service to
 // create implementations of a Mojo proxy resolver to back a ProxyResolverMojo.
-class CONTENT_EXPORT ProxyResolverFactoryMojo
-    : public net::ProxyResolverFactory {
+class ProxyResolverFactoryMojo : public net::ProxyResolverFactory {
  public:
   ProxyResolverFactoryMojo(
       proxy_resolver::mojom::ProxyResolverFactoryPtr mojo_proxy_factory,
@@ -59,6 +57,6 @@
   DISALLOW_COPY_AND_ASSIGN(ProxyResolverFactoryMojo);
 };
 
-}  // namespace content
+}  // namespace network
 
-#endif  // CONTENT_NETWORK_PROXY_RESOLVER_FACTORY_MOJO_H_
+#endif  // SERVICES_NETWORK_PROXY_RESOLVER_FACTORY_MOJO_H_
diff --git a/content/network/proxy_resolver_factory_mojo_unittest.cc b/services/network/proxy_resolver_factory_mojo_unittest.cc
similarity index 99%
rename from content/network/proxy_resolver_factory_mojo_unittest.cc
rename to services/network/proxy_resolver_factory_mojo_unittest.cc
index 9479ac0..58620207 100644
--- a/content/network/proxy_resolver_factory_mojo_unittest.cc
+++ b/services/network/proxy_resolver_factory_mojo_unittest.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/proxy_resolver_factory_mojo.h"
+#include "services/network/proxy_resolver_factory_mojo.h"
 
 #include <list>
 #include <map>
@@ -41,7 +41,7 @@
 using net::test::IsError;
 using net::test::IsOk;
 
-namespace content {
+namespace network {
 
 namespace {
 
@@ -913,4 +913,4 @@
   CreateProxyResolver();
   proxy_resolver_mojo_.reset();
 }
-}  // namespace content
+}  // namespace network
diff --git a/content/network/proxy_service_mojo.cc b/services/network/proxy_service_mojo.cc
similarity index 85%
rename from content/network/proxy_service_mojo.cc
rename to services/network/proxy_service_mojo.cc
index 25a20e8..e3daa18b 100644
--- a/content/network/proxy_service_mojo.cc
+++ b/services/network/proxy_service_mojo.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/proxy_service_mojo.h"
+#include "services/network/proxy_service_mojo.h"
 
 #include <memory>
 #include <utility>
@@ -10,13 +10,12 @@
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
 #include "base/threading/thread_task_runner_handle.h"
-#include "content/network/proxy_resolver_factory_mojo.h"
-#include "net/dns/mojo_host_resolver_impl.h"
 #include "net/proxy_resolution/network_delegate_error_observer.h"
 #include "net/proxy_resolution/proxy_resolver_factory.h"
 #include "net/proxy_resolution/proxy_service.h"
+#include "services/network/proxy_resolver_factory_mojo.h"
 
-namespace content {
+namespace network {
 
 std::unique_ptr<net::ProxyResolutionService> CreateProxyServiceUsingMojoFactory(
     proxy_resolver::mojom::ProxyResolverFactoryPtr mojo_proxy_factory,
@@ -43,10 +42,9 @@
 
   // Configure fetchers to use for PAC script downloads and auto-detect.
   proxy_resolution_service->SetProxyScriptFetchers(
-      std::move(proxy_script_fetcher),
-      std::move(dhcp_proxy_script_fetcher));
+      std::move(proxy_script_fetcher), std::move(dhcp_proxy_script_fetcher));
 
   return proxy_resolution_service;
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/content/network/proxy_service_mojo.h b/services/network/proxy_service_mojo.h
similarity index 82%
rename from content/network/proxy_service_mojo.h
rename to services/network/proxy_service_mojo.h
index e6e2343..51b49f8 100644
--- a/content/network/proxy_service_mojo.h
+++ b/services/network/proxy_service_mojo.h
@@ -2,12 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_NETWORK_PROXY_SERVICE_MOJO_H_
-#define CONTENT_NETWORK_PROXY_SERVICE_MOJO_H_
+#ifndef SERVICES_NETWORK_PROXY_SERVICE_MOJO_H_
+#define SERVICES_NETWORK_PROXY_SERVICE_MOJO_H_
 
 #include <memory>
 
-#include "content/common/content_export.h"
 #include "net/proxy_resolution/dhcp_pac_file_fetcher.h"
 #include "services/proxy_resolver/public/interfaces/proxy_resolver.mojom.h"
 
@@ -20,7 +19,7 @@
 class ProxyResolutionService;
 }  // namespace net
 
-namespace content {
+namespace network {
 
 // Creates a proxy service that uses |mojo_proxy_factory| to create and connect
 // to a Mojo proxy resolver service. This proxy service polls
@@ -35,8 +34,7 @@
 // |host_resolver| points to the host resolving dependency the PAC script
 // should use for any DNS queries. It must remain valid throughout the
 // lifetime of the ProxyResolutionService.
-std::unique_ptr<net::ProxyResolutionService> CONTENT_EXPORT
-CreateProxyServiceUsingMojoFactory(
+std::unique_ptr<net::ProxyResolutionService> CreateProxyServiceUsingMojoFactory(
     proxy_resolver::mojom::ProxyResolverFactoryPtr mojo_proxy_factory,
     std::unique_ptr<net::ProxyConfigService> proxy_config_service,
     std::unique_ptr<net::ProxyScriptFetcher> proxy_script_fetcher,
@@ -45,6 +43,6 @@
     net::NetLog* net_log,
     net::NetworkDelegate* network_delegate);
 
-}  // namespace content
+}  // namespace network
 
-#endif  // CONTENT_NETWORK_PROXY_SERVICE_MOJO_H_
+#endif  // SERVICES_NETWORK_PROXY_SERVICE_MOJO_H_
diff --git a/services/network/public/cpp/BUILD.gn b/services/network/public/cpp/BUILD.gn
index 6a7dabe..b72e41f0 100644
--- a/services/network/public/cpp/BUILD.gn
+++ b/services/network/public/cpp/BUILD.gn
@@ -8,21 +8,28 @@
   sources = [
     "cors/cors.cc",
     "cors/cors.h",
+    "ignore_errors_cert_verifier.cc",
+    "ignore_errors_cert_verifier.h",
     "loader_util.cc",
     "loader_util.h",
     "mutable_network_traffic_annotation_tag_struct_traits.h",
     "mutable_partial_network_traffic_annotation_tag_struct_traits.h",
     "net_adapters.cc",
     "net_adapters.h",
+    "network_service.h",
     "network_switches.cc",
     "network_switches.h",
     "proxy_resolving_client_socket.cc",
     "proxy_resolving_client_socket.h",
     "proxy_resolving_client_socket_factory.cc",
     "proxy_resolving_client_socket_factory.h",
+    "url_request_context_builder_mojo.h",
+    "url_request_context_owner.cc",
+    "url_request_context_owner.h",
   ]
 
   public_deps = [
+    ":network_features",
     ":typemap_dependencies",
     "//services/network/public/interfaces",
     "//url/ipc:url_ipc",
@@ -30,9 +37,11 @@
 
   deps = [
     "//base",
+    "//components/prefs",
     "//ipc",
     "//mojo/common",
     "//net",
+    "//services/proxy_resolver/public/interfaces",
   ]
 }
 
@@ -105,6 +114,7 @@
 
   sources = [
     "cors/cors_unittest.cc",
+    "ignore_errors_cert_verifier_unittest.cc",
     "mutable_network_traffic_annotation_tag_struct_traits_unittest.cc",
     "mutable_partial_network_traffic_annotation_tag_struct_traits_unittest.cc",
     "network_struct_traits_unittest.cc",
diff --git a/services/network/public/cpp/DEPS b/services/network/public/cpp/DEPS
index bdd71d8..36cb5af 100644
--- a/services/network/public/cpp/DEPS
+++ b/services/network/public/cpp/DEPS
@@ -8,4 +8,12 @@
   "resource_request\.h": [
     "+services/network/public/interfaces/cors.mojom.h",
   ],
+  ".*\.cc": [
+    # Prefs are used to create an independent file with a persisted key:value
+    # store for networking-related data (Like which servers support QUIC),
+    # rather than to store user preferences.
+    "+components/prefs",
+    "+services/network",
+    "+services/proxy_resolver/public/interfaces",
+  ],
 }
diff --git a/services/network/public/cpp/features.cc b/services/network/public/cpp/features.cc
index b34d1222..fbfa6aef 100644
--- a/services/network/public/cpp/features.cc
+++ b/services/network/public/cpp/features.cc
@@ -7,9 +7,21 @@
 namespace network {
 namespace features {
 
-const base::Feature kReporting{"Reporting", base::FEATURE_DISABLED_BY_DEFAULT};
 const base::Feature kNetworkErrorLogging{"NetworkErrorLogging",
                                          base::FEATURE_DISABLED_BY_DEFAULT};
+// Enables the network service.
+const base::Feature kNetworkService{"NetworkService",
+                                    base::FEATURE_DISABLED_BY_DEFAULT};
+
+// Out of Blink CORS
+const base::Feature kOutOfBlinkCORS{"OutOfBlinkCORS",
+                                    base::FEATURE_DISABLED_BY_DEFAULT};
+
+// Port some content::ResourceScheduler functionalities to renderer.
+const base::Feature kRendererSideResourceScheduler{
+    "RendererSideResourceScheduler", base::FEATURE_DISABLED_BY_DEFAULT};
+
+const base::Feature kReporting{"Reporting", base::FEATURE_DISABLED_BY_DEFAULT};
 
 }  // namespace features
 }  // namespace network
diff --git a/services/network/public/cpp/features.h b/services/network/public/cpp/features.h
index a555b20..b247a8c 100644
--- a/services/network/public/cpp/features.h
+++ b/services/network/public/cpp/features.h
@@ -11,8 +11,12 @@
 namespace network {
 namespace features {
 
-NETWORK_FEATURES_EXPORT extern const base::Feature kReporting;
 NETWORK_FEATURES_EXPORT extern const base::Feature kNetworkErrorLogging;
+NETWORK_FEATURES_EXPORT extern const base::Feature kNetworkService;
+NETWORK_FEATURES_EXPORT extern const base::Feature kOutOfBlinkCORS;
+NETWORK_FEATURES_EXPORT extern const base::Feature
+    kRendererSideResourceScheduler;
+NETWORK_FEATURES_EXPORT extern const base::Feature kReporting;
 
 }  // namespace features
 }  // namespace network
diff --git a/content/public/network/ignore_errors_cert_verifier.cc b/services/network/public/cpp/ignore_errors_cert_verifier.cc
similarity index 96%
rename from content/public/network/ignore_errors_cert_verifier.cc
rename to services/network/public/cpp/ignore_errors_cert_verifier.cc
index 6ece4236..bfa2f82 100644
--- a/content/public/network/ignore_errors_cert_verifier.cc
+++ b/services/network/public/cpp/ignore_errors_cert_verifier.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/public/network/ignore_errors_cert_verifier.h"
+#include "services/network/public/cpp/ignore_errors_cert_verifier.h"
 
 #include <iterator>
 #include <utility>
@@ -12,7 +12,6 @@
 #include "base/memory/ref_counted.h"
 #include "base/strings/string_piece.h"
 #include "base/strings/string_split.h"
-#include "content/public/common/content_switches.h"
 #include "crypto/sha2.h"
 #include "net/base/completion_callback.h"
 #include "net/base/hash_value.h"
@@ -22,6 +21,7 @@
 #include "net/cert/cert_verify_result.h"
 #include "net/cert/x509_certificate.h"
 #include "net/cert/x509_util.h"
+#include "services/network/public/cpp/network_switches.h"
 
 using ::net::CertVerifier;
 using ::net::CompletionCallback;
@@ -29,7 +29,7 @@
 using ::net::SHA256HashValue;
 using ::net::X509Certificate;
 
-namespace content {
+namespace network {
 
 // static
 std::unique_ptr<CertVerifier> IgnoreErrorsCertVerifier::MaybeWrapCertVerifier(
@@ -134,4 +134,4 @@
   whitelist_ = whitelist;
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/content/public/network/ignore_errors_cert_verifier.h b/services/network/public/cpp/ignore_errors_cert_verifier.h
similarity index 87%
rename from content/public/network/ignore_errors_cert_verifier.h
rename to services/network/public/cpp/ignore_errors_cert_verifier.h
index e58d34e5..5e08240 100644
--- a/content/public/network/ignore_errors_cert_verifier.h
+++ b/services/network/public/cpp/ignore_errors_cert_verifier.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_PUBLIC_NETWORK_IGNORE_ERRORS_CERT_VERIFIER_H_
-#define CONTENT_PUBLIC_NETWORK_IGNORE_ERRORS_CERT_VERIFIER_H_
+#ifndef SERVICES_NETWORK_PUBLIC_CPP_IGNORE_ERRORS_CERT_VERIFIER_H_
+#define SERVICES_NETWORK_PUBLIC_CPP_IGNORE_ERRORS_CERT_VERIFIER_H_
 
 #include <memory>
 #include <string>
@@ -11,19 +11,18 @@
 
 #include "base/command_line.h"
 #include "base/containers/flat_set.h"
-#include "content/common/content_export.h"
 #include "net/cert/cert_verifier.h"
 
 namespace net {
 struct SHA256HashValue;
 }  // namespace net
 
-namespace content {
+namespace network {
 
 // IgnoreErrorsCertVerifier wraps another CertVerifier in order to ignore
 // verification errors from certificate chains that match a whitelist of SPKI
 // fingerprints.
-class CONTENT_EXPORT IgnoreErrorsCertVerifier : public net::CertVerifier {
+class IgnoreErrorsCertVerifier : public net::CertVerifier {
  public:
   // SPKIHashSet is a set of SHA-256 SPKI fingerprints (RFC 7469, Section 2.4).
   using SPKIHashSet = base::flat_set<net::SHA256HashValue>;
@@ -73,6 +72,6 @@
   DISALLOW_COPY_AND_ASSIGN(IgnoreErrorsCertVerifier);
 };
 
-}  // namespace content
+}  // namespace network
 
-#endif  // CONTENT_PUBLIC_NETWORK_IGNORE_ERRORS_CERT_VERIFIER_H_
+#endif  // SERVICES_NETWORK_PUBLIC_CPP_IGNORE_ERRORS_CERT_VERIFIER_H_
diff --git a/content/public/network/ignore_errors_cert_verifier_unittest.cc b/services/network/public/cpp/ignore_errors_cert_verifier_unittest.cc
similarity index 97%
rename from content/public/network/ignore_errors_cert_verifier_unittest.cc
rename to services/network/public/cpp/ignore_errors_cert_verifier_unittest.cc
index ec79648..fbd4d2c2 100644
--- a/content/public/network/ignore_errors_cert_verifier_unittest.cc
+++ b/services/network/public/cpp/ignore_errors_cert_verifier_unittest.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/public/network/ignore_errors_cert_verifier.h"
+#include "services/network/public/cpp/ignore_errors_cert_verifier.h"
 
 #include "base/base64.h"
 #include "base/files/file_path.h"
@@ -10,7 +10,6 @@
 #include "base/memory/ref_counted.h"
 #include "base/strings/string_piece.h"
 #include "base/strings/string_util.h"
-#include "content/public/common/content_switches.h"
 #include "crypto/sha2.h"
 #include "net/base/net_errors.h"
 #include "net/base/test_completion_callback.h"
@@ -22,6 +21,7 @@
 #include "net/test/cert_test_util.h"
 #include "net/test/gtest_util.h"
 #include "net/test/test_data_directory.h"
+#include "services/network/public/cpp/network_switches.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -42,7 +42,7 @@
 using net::test::IsError;
 using net::test::IsOk;
 
-namespace content {
+namespace network {
 
 static const char kTestUserDataDirSwitch[] = "test-user-data-dir";
 
@@ -196,4 +196,4 @@
                         IgnoreCertificateErrorsSPKIListFlagTest,
                         ::testing::Bool());
 
-}  // namespace content
+}  // namespace network
diff --git a/content/public/network/network_service.h b/services/network/public/cpp/network_service.h
similarity index 85%
rename from content/public/network/network_service.h
rename to services/network/public/cpp/network_service.h
index 49e6f95c..0d8d3f18 100644
--- a/content/public/network/network_service.h
+++ b/services/network/public/cpp/network_service.h
@@ -2,12 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_PUBLIC_NETWORK_NETWORK_SERVICE_H_
-#define CONTENT_PUBLIC_NETWORK_NETWORK_SERVICE_H_
+#ifndef SERVICES_NETWORK_PUBLIC_CPP_NETWORK_SERVICE_H_
+#define SERVICES_NETWORK_PUBLIC_CPP_NETWORK_SERVICE_H_
 
 #include <memory>
 
-#include "content/common/content_export.h"
 #include "services/network/public/interfaces/network_service.mojom.h"
 
 namespace net {
@@ -15,12 +14,12 @@
 class URLRequestContext;
 }  // namespace net
 
-namespace content {
+namespace network {
 
 class URLRequestContextBuilderMojo;
 
 // Allows an in-process NetworkService to be set up.
-class CONTENT_EXPORT NetworkService : public network::mojom::NetworkService {
+class NetworkService : public network::mojom::NetworkService {
  public:
   // Creates a NetworkService instance on the current thread, optionally using
   // the passed-in NetLog. Does not take ownership of |net_log|. Must be
@@ -55,6 +54,6 @@
   NetworkService() {}
 };
 
-}  // namespace content
+}  // namespace network
 
-#endif  // CONTENT_PUBLIC_NETWORK_NETWORK_SERVICE_H_
+#endif  // SERVICES_NETWORK_PUBLIC_CPP_NETWORK_SERVICE_H_
diff --git a/services/network/public/cpp/network_switches.cc b/services/network/public/cpp/network_switches.cc
index 136c517..efed4b7 100644
--- a/services/network/public/cpp/network_switches.cc
+++ b/services/network/public/cpp/network_switches.cc
@@ -11,6 +11,20 @@
 // These mappings only apply to the host resolver.
 const char kHostResolverRules[] = "host-resolver-rules";
 
+// A set of public key hashes for which to ignore certificate-related errors.
+//
+// If the certificate chain presented by the server does not validate, and one
+// or more certificates have public key hashes that match a key from this list,
+// the error is ignored.
+//
+// The switch value must a be a comma-separated list of Base64-encoded SHA-256
+// SPKI Fingerprints (RFC 7469, Section 2.4).
+//
+// This switch has no effect unless --user-data-dir (as defined by the content
+// embedder) is also present.
+const char kIgnoreCertificateErrorsSPKIList[] =
+    "ignore-certificate-errors-spki-list";
+
 // Enables saving net log events to a file. If a value is given, it used as the
 // path the the file, otherwise the file is named netlog.json and placed in the
 // user data directory.
diff --git a/services/network/public/cpp/network_switches.h b/services/network/public/cpp/network_switches.h
index 4c2c5644..5fc8138 100644
--- a/services/network/public/cpp/network_switches.h
+++ b/services/network/public/cpp/network_switches.h
@@ -10,6 +10,7 @@
 namespace switches {
 
 extern const char kHostResolverRules[];
+extern const char kIgnoreCertificateErrorsSPKIList[];
 extern const char kLogNetLog[];
 extern const char kNoReferrers[];
 
diff --git a/content/public/network/url_request_context_builder_mojo.h b/services/network/public/cpp/url_request_context_builder_mojo.h
similarity index 83%
rename from content/public/network/url_request_context_builder_mojo.h
rename to services/network/public/cpp/url_request_context_builder_mojo.h
index f9667c14..e385415 100644
--- a/content/public/network/url_request_context_builder_mojo.h
+++ b/services/network/public/cpp/url_request_context_builder_mojo.h
@@ -2,17 +2,16 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_PUBLIC_NETWORK_URL_REQUEST_CONTEXT_BUILDER_MOJO_H_
-#define CONTENT_PUBLIC_NETWORK_URL_REQUEST_CONTEXT_BUILDER_MOJO_H_
+#ifndef SERVICES_NETWORK_PUBLIC_CPP_URL_REQUEST_CONTEXT_BUILDER_MOJO_H_
+#define SERVICES_NETWORK_PUBLIC_CPP_URL_REQUEST_CONTEXT_BUILDER_MOJO_H_
 
 #include <memory>
 
 #include "base/macros.h"
 #include "build/build_config.h"
-#include "content/common/content_export.h"
-#include "content/public/network/url_request_context_owner.h"
 #include "net/proxy_resolution/dhcp_pac_file_fetcher_factory.h"
 #include "net/url_request/url_request_context_builder.h"
+#include "services/network/public/cpp/url_request_context_owner.h"
 #include "services/network/public/interfaces/network_service.mojom.h"
 #include "services/proxy_resolver/public/interfaces/proxy_resolver.mojom.h"
 
@@ -24,15 +23,14 @@
 class URLRequestContext;
 }  // namespace net
 
-namespace content {
+namespace network {
 
 // Specialization of URLRequestContextBuilder that can create a
 // ProxyResolutionService that uses a Mojo ProxyResolver. The consumer is
 // responsible for providing the proxy_resolver::mojom::ProxyResolverFactory.
 // If a ProxyResolutionService is set directly via the URLRequestContextBuilder
 // API, it will be used instead.
-class CONTENT_EXPORT URLRequestContextBuilderMojo
-    : public net::URLRequestContextBuilder {
+class URLRequestContextBuilderMojo : public net::URLRequestContextBuilder {
  public:
   URLRequestContextBuilderMojo();
   ~URLRequestContextBuilderMojo() override;
@@ -55,7 +53,7 @@
   //
   // This method is intended to ease the transition to an out-of-process
   // NetworkService, and will be removed once that ships.
-  URLRequestContextOwner Create(network::mojom::NetworkContextParams* params,
+  URLRequestContextOwner Create(mojom::NetworkContextParams* params,
                                 bool quic_disabled,
                                 net::NetLog* net_log);
 
@@ -74,6 +72,6 @@
   DISALLOW_COPY_AND_ASSIGN(URLRequestContextBuilderMojo);
 };
 
-}  // namespace content
+}  // namespace network
 
-#endif  // CONTENT_PUBLIC_NETWORK_URL_REQUEST_CONTEXT_BUILDER_MOJO_H_
+#endif  // SERVICES_NETWORK_PUBLIC_CPP_URL_REQUEST_CONTEXT_BUILDER_MOJO_H_
diff --git a/content/public/network/url_request_context_owner.cc b/services/network/public/cpp/url_request_context_owner.cc
similarity index 87%
rename from content/public/network/url_request_context_owner.cc
rename to services/network/public/cpp/url_request_context_owner.cc
index 62de5cfd..01efa74d 100644
--- a/content/public/network/url_request_context_owner.cc
+++ b/services/network/public/cpp/url_request_context_owner.cc
@@ -2,12 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/public/network/url_request_context_owner.h"
+#include "services/network/public/cpp/url_request_context_owner.h"
 
 #include "components/prefs/pref_service.h"
 #include "net/url_request/url_request_context.h"
 
-namespace content {
+namespace network {
 
 URLRequestContextOwner::URLRequestContextOwner() = default;
 
@@ -24,4 +24,4 @@
   return *this;
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/content/public/network/url_request_context_owner.h b/services/network/public/cpp/url_request_context_owner.h
similarity index 68%
rename from content/public/network/url_request_context_owner.h
rename to services/network/public/cpp/url_request_context_owner.h
index 9c8a3ef..981f91c 100644
--- a/content/public/network/url_request_context_owner.h
+++ b/services/network/public/cpp/url_request_context_owner.h
@@ -2,23 +2,21 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_PUBLIC_NETWORK_URL_REQUEST_CONTEXT_OWNER_H_
-#define CONTENT_PUBLIC_NETWORK_URL_REQUEST_CONTEXT_OWNER_H_
+#ifndef SERVICES_NETWORK_PUBLIC_CPP_NETWORK_URL_REQUEST_CONTEXT_OWNER_H_
+#define SERVICES_NETWORK_PUBLIC_CPP_NETWORK_URL_REQUEST_CONTEXT_OWNER_H_
 
 #include <memory>
 
-#include "content/common/content_export.h"
-
 class PrefService;
 
 namespace net {
 class URLRequestContext;
 }
 
-namespace content {
+namespace network {
 
 // This owns a net::URLRequestContext and other state that's used with it.
-struct CONTENT_EXPORT URLRequestContextOwner {
+struct URLRequestContextOwner {
   URLRequestContextOwner();
   ~URLRequestContextOwner();
   URLRequestContextOwner(URLRequestContextOwner&& other);
@@ -30,6 +28,6 @@
   std::unique_ptr<net::URLRequestContext> url_request_context;
 };
 
-}  // namespace content
+}  // namespace network
 
-#endif  // CONTENT_PUBLIC_NETWORK_URL_REQUEST_CONTEXT_OWNER_H_
+#endif  // SERVICES_NETWORK_PUBLIC_CPP_NETWORK_URL_REQUEST_CONTEXT_OWNER_H_
diff --git a/content/network/restricted_cookie_manager.cc b/services/network/restricted_cookie_manager.cc
similarity index 91%
rename from content/network/restricted_cookie_manager.cc
rename to services/network/restricted_cookie_manager.cc
index db2e31ef..cd8db58b 100644
--- a/content/network/restricted_cookie_manager.cc
+++ b/services/network/restricted_cookie_manager.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/restricted_cookie_manager.h"
+#include "services/network/restricted_cookie_manager.h"
 
 #include <memory>
 #include <utility>
@@ -19,7 +19,7 @@
 #include "net/cookies/cookie_options.h"
 #include "net/cookies/cookie_store.h"
 
-namespace content {
+namespace network {
 
 RestrictedCookieManager::RestrictedCookieManager(net::CookieStore* cookie_store,
                                                  int render_process_id,
@@ -34,7 +34,7 @@
 void RestrictedCookieManager::GetAllForUrl(
     const GURL& url,
     const GURL& site_for_cookies,
-    network::mojom::CookieManagerGetOptionsPtr options,
+    mojom::CookieManagerGetOptionsPtr options,
     GetAllForUrlCallback callback) {
   // TODO(pwnall): Replicate the call to
   //               ChildProcessSecurityPolicy::CanAccessDataForOrigin() in
@@ -63,7 +63,7 @@
 void RestrictedCookieManager::CookieListToGetAllForUrlCallback(
     const GURL& url,
     const GURL& site_for_cookies,
-    network::mojom::CookieManagerGetOptionsPtr options,
+    mojom::CookieManagerGetOptionsPtr options,
     GetAllForUrlCallback callback,
     const net::CookieList& cookie_list) {
   // TODO(pwnall): Replicate the security checks in
@@ -75,16 +75,16 @@
 
   std::vector<net::CanonicalCookie> result;
   result.reserve(cookie_list.size());
-  network::mojom::CookieMatchType match_type = options->match_type;
+  mojom::CookieMatchType match_type = options->match_type;
   const std::string& match_name = options->name;
   for (size_t i = 0; i < cookie_list.size(); ++i) {
     const net::CanonicalCookie& cookie = cookie_list[i];
     const std::string& cookie_name = cookie.Name();
 
-    if (match_type == network::mojom::CookieMatchType::EQUALS) {
+    if (match_type == mojom::CookieMatchType::EQUALS) {
       if (cookie_name != match_name)
         continue;
-    } else if (match_type == network::mojom::CookieMatchType::STARTS_WITH) {
+    } else if (match_type == mojom::CookieMatchType::STARTS_WITH) {
       if (!base::StartsWith(cookie_name, match_name,
                             base::CompareCase::SENSITIVE)) {
         continue;
@@ -128,4 +128,4 @@
                                          std::move(callback));
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/content/network/restricted_cookie_manager.h b/services/network/restricted_cookie_manager.h
similarity index 81%
rename from content/network/restricted_cookie_manager.h
rename to services/network/restricted_cookie_manager.h
index c2b20cd..4578d2c5 100644
--- a/content/network/restricted_cookie_manager.h
+++ b/services/network/restricted_cookie_manager.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_NETWORK_RESTRICTED_COOKIE_MANAGER_H_
-#define CONTENT_NETWORK_RESTRICTED_COOKIE_MANAGER_H_
+#ifndef SERVICES_NETWORK_RESTRICTED_COOKIE_MANAGER_H_
+#define SERVICES_NETWORK_RESTRICTED_COOKIE_MANAGER_H_
 
 #include <string>
 
@@ -11,7 +11,6 @@
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
 #include "base/threading/sequenced_task_runner_handle.h"
-#include "content/common/content_export.h"
 #include "mojo/public/cpp/bindings/binding.h"
 #include "net/cookies/canonical_cookie.h"
 #include "services/network/public/interfaces/restricted_cookie_manager.mojom.h"
@@ -21,15 +20,14 @@
 class CookieStore;
 }  // namespace net
 
-namespace content {
+namespace network {
 
 // RestrictedCookieManager implementation.
 //
 // Instances of this class must be created and used on the I/O thread. Instances
 // are created by CreateMojoService() and are bound to the lifetimes of the
 // mojo connections that they serve, via mojo::StrongBinding.
-class CONTENT_EXPORT RestrictedCookieManager
-    : public network::mojom::RestrictedCookieManager {
+class RestrictedCookieManager : public mojom::RestrictedCookieManager {
  public:
   RestrictedCookieManager(net::CookieStore* cookie_store,
                           int render_process_id,
@@ -42,7 +40,7 @@
   // CookieStore.has().
   void GetAllForUrl(const GURL& url,
                     const GURL& site_for_cookies,
-                    network::mojom::CookieManagerGetOptionsPtr options,
+                    mojom::CookieManagerGetOptionsPtr options,
                     GetAllForUrlCallback callback) override;
 
   void SetCanonicalCookie(const net::CanonicalCookie& cookie,
@@ -55,7 +53,7 @@
   void CookieListToGetAllForUrlCallback(
       const GURL& url,
       const GURL& site_for_cookies,
-      network::mojom::CookieManagerGetOptionsPtr options,
+      mojom::CookieManagerGetOptionsPtr options,
       GetAllForUrlCallback callback,
       const net::CookieList& cookie_list);
 
@@ -68,6 +66,6 @@
   DISALLOW_COPY_AND_ASSIGN(RestrictedCookieManager);
 };
 
-}  // namespace content
+}  // namespace network
 
-#endif  // CONTENT_NETWORK_RESTRICTED_COOKIE_MANAGER_H_
+#endif  // SERVICES_NETWORK_RESTRICTED_COOKIE_MANAGER_H_
diff --git a/content/network/restricted_cookie_manager_unittest.cc b/services/network/restricted_cookie_manager_unittest.cc
similarity index 87%
rename from content/network/restricted_cookie_manager_unittest.cc
rename to services/network/restricted_cookie_manager_unittest.cc
index dab430a..366916564 100644
--- a/content/network/restricted_cookie_manager_unittest.cc
+++ b/services/network/restricted_cookie_manager_unittest.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/restricted_cookie_manager.h"
+#include "services/network/restricted_cookie_manager.h"
 
 #include <algorithm>
 
@@ -16,7 +16,7 @@
 #include "services/network/public/interfaces/cookie_manager.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
-namespace content {
+namespace network {
 
 // Synchronous proxies to a wrapped RestrictedCookieManager's methods.
 class RestrictedCookieManagerSync {
@@ -24,14 +24,14 @@
   // Caller must guarantee that |*cookie_service| outlives the
   // SynchronousCookieManager.
   explicit RestrictedCookieManagerSync(
-      network::mojom::RestrictedCookieManager* cookie_service)
+      mojom::RestrictedCookieManager* cookie_service)
       : cookie_service_(cookie_service) {}
   ~RestrictedCookieManagerSync() {}
 
   std::vector<net::CanonicalCookie> GetAllForUrl(
       const GURL& url,
       const GURL& site_for_cookies,
-      network::mojom::CookieManagerGetOptionsPtr options) {
+      mojom::CookieManagerGetOptionsPtr options) {
     base::RunLoop run_loop;
     std::vector<net::CanonicalCookie> cookies;
     cookie_service_->GetAllForUrl(
@@ -71,7 +71,7 @@
     run_loop->Quit();
   }
 
-  network::mojom::RestrictedCookieManager* cookie_service_;
+  mojom::RestrictedCookieManager* cookie_service_;
 
   DISALLOW_COPY_AND_ASSIGN(RestrictedCookieManagerSync);
 };
@@ -123,9 +123,9 @@
  protected:
   base::MessageLoopForIO message_loop_;
   net::CookieMonster cookie_monster_;
-  std::unique_ptr<content::RestrictedCookieManager> service_;
-  network::mojom::RestrictedCookieManagerPtr service_ptr_;
-  mojo::Binding<network::mojom::RestrictedCookieManager> binding_;
+  std::unique_ptr<RestrictedCookieManager> service_;
+  mojom::RestrictedCookieManagerPtr service_ptr_;
+  mojo::Binding<mojom::RestrictedCookieManager> binding_;
   std::unique_ptr<RestrictedCookieManagerSync> sync_service_;
 };
 
@@ -144,9 +144,9 @@
   SetSessionCookie("other-cookie-name", "other-cookie-value", "not-example.com",
                    "/");
 
-  auto options = network::mojom::CookieManagerGetOptions::New();
+  auto options = mojom::CookieManagerGetOptions::New();
   options->name = "";
-  options->match_type = network::mojom::CookieMatchType::STARTS_WITH;
+  options->match_type = mojom::CookieMatchType::STARTS_WITH;
   std::vector<net::CanonicalCookie> cookies = sync_service_->GetAllForUrl(
       GURL("http://example.com/test/"), GURL("http://example.com"),
       std::move(options));
@@ -164,9 +164,9 @@
 TEST_F(RestrictedCookieManagerTest, GetAllForUrlEmptyFilter) {
   SetSessionCookie("cookie-name", "cookie-value", "example.com", "/");
 
-  auto options = network::mojom::CookieManagerGetOptions::New();
+  auto options = mojom::CookieManagerGetOptions::New();
   options->name = "";
-  options->match_type = network::mojom::CookieMatchType::EQUALS;
+  options->match_type = mojom::CookieMatchType::EQUALS;
   std::vector<net::CanonicalCookie> cookies = sync_service_->GetAllForUrl(
       GURL("http://example.com/test/"), GURL("http://example.com"),
       std::move(options));
@@ -179,9 +179,9 @@
   SetSessionCookie("cookie-name", "cookie-value", "example.com", "/");
   SetSessionCookie("cookie-name-2", "cookie-value-2", "example.com", "/");
 
-  auto options = network::mojom::CookieManagerGetOptions::New();
+  auto options = mojom::CookieManagerGetOptions::New();
   options->name = "cookie-name";
-  options->match_type = network::mojom::CookieMatchType::EQUALS;
+  options->match_type = mojom::CookieMatchType::EQUALS;
   std::vector<net::CanonicalCookie> cookies = sync_service_->GetAllForUrl(
       GURL("http://example.com/test/"), GURL("http://example.com"),
       std::move(options));
@@ -198,9 +198,9 @@
   SetSessionCookie("cookie-name-2b", "cookie-value-2b", "example.com", "/");
   SetSessionCookie("cookie-name-3b", "cookie-value-3b", "example.com", "/");
 
-  auto options = network::mojom::CookieManagerGetOptions::New();
+  auto options = mojom::CookieManagerGetOptions::New();
   options->name = "cookie-name-2";
-  options->match_type = network::mojom::CookieMatchType::STARTS_WITH;
+  options->match_type = mojom::CookieMatchType::STARTS_WITH;
   std::vector<net::CanonicalCookie> cookies = sync_service_->GetAllForUrl(
       GURL("http://example.com/test/"), GURL("http://example.com"),
       std::move(options));
@@ -224,9 +224,9 @@
           net::COOKIE_PRIORITY_DEFAULT),
       GURL("http://example.com/test/"), GURL("http://example.com")));
 
-  auto options = network::mojom::CookieManagerGetOptions::New();
+  auto options = mojom::CookieManagerGetOptions::New();
   options->name = "new-name";
-  options->match_type = network::mojom::CookieMatchType::EQUALS;
+  options->match_type = mojom::CookieMatchType::EQUALS;
   std::vector<net::CanonicalCookie> cookies = sync_service_->GetAllForUrl(
       GURL("http://example.com/test/"), GURL("http://example.com"),
       std::move(options));
@@ -237,4 +237,4 @@
   EXPECT_EQ("new-value", cookies[0].Value());
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/content/public/test/test_url_loader_client.cc b/services/network/test/test_url_loader_client.cc
similarity index 90%
rename from content/public/test/test_url_loader_client.cc
rename to services/network/test/test_url_loader_client.cc
index d974a02..d201999 100644
--- a/content/public/test/test_url_loader_client.cc
+++ b/services/network/test/test_url_loader_client.cc
@@ -2,21 +2,21 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/public/test/test_url_loader_client.h"
+#include "services/network/test/test_url_loader_client.h"
 
 #include "base/memory/ref_counted.h"
 #include "base/run_loop.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
-namespace content {
+namespace network {
 
 TestURLLoaderClient::TestURLLoaderClient() : binding_(this) {}
 TestURLLoaderClient::~TestURLLoaderClient() {}
 
 void TestURLLoaderClient::OnReceiveResponse(
-    const network::ResourceResponseHead& response_head,
+    const ResourceResponseHead& response_head,
     const base::Optional<net::SSLInfo>& ssl_info,
-    network::mojom::DownloadedTempFilePtr downloaded_file) {
+    mojom::DownloadedTempFilePtr downloaded_file) {
   EXPECT_FALSE(has_received_response_);
   EXPECT_FALSE(has_received_cached_metadata_);
   EXPECT_FALSE(has_received_completion_);
@@ -30,7 +30,7 @@
 
 void TestURLLoaderClient::OnReceiveRedirect(
     const net::RedirectInfo& redirect_info,
-    const network::ResourceResponseHead& response_head) {
+    const ResourceResponseHead& response_head) {
   EXPECT_FALSE(has_received_cached_metadata_);
   EXPECT_FALSE(response_body_.is_valid());
   EXPECT_FALSE(has_received_response_);
@@ -99,8 +99,7 @@
     quit_closure_for_on_start_loading_response_body_.Run();
 }
 
-void TestURLLoaderClient::OnComplete(
-    const network::URLLoaderCompletionStatus& status) {
+void TestURLLoaderClient::OnComplete(const URLLoaderCompletionStatus& status) {
   EXPECT_FALSE(has_received_completion_);
   has_received_completion_ = true;
   completion_status_ = status;
@@ -108,8 +107,7 @@
     quit_closure_for_on_complete_.Run();
 }
 
-network::mojom::DownloadedTempFilePtr
-TestURLLoaderClient::TakeDownloadedTempFile() {
+mojom::DownloadedTempFilePtr TestURLLoaderClient::TakeDownloadedTempFile() {
   return std::move(downloaded_file_);
 }
 
@@ -117,8 +115,8 @@
   has_received_redirect_ = false;
 }
 
-network::mojom::URLLoaderClientPtr TestURLLoaderClient::CreateInterfacePtr() {
-  network::mojom::URLLoaderClientPtr client_ptr;
+mojom::URLLoaderClientPtr TestURLLoaderClient::CreateInterfacePtr() {
+  mojom::URLLoaderClientPtr client_ptr;
   binding_.Bind(mojo::MakeRequest(&client_ptr));
   binding_.set_connection_error_handler(base::BindOnce(
       &TestURLLoaderClient::OnConnectionError, base::Unretained(this)));
@@ -201,4 +199,4 @@
     quit_closure_for_on_connection_error_.Run();
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/content/public/test/test_url_loader_client.h b/services/network/test/test_url_loader_client.h
similarity index 77%
rename from content/public/test/test_url_loader_client.h
rename to services/network/test/test_url_loader_client.h
index 2c87fcac..a82da7e 100644
--- a/content/public/test/test_url_loader_client.h
+++ b/services/network/test/test_url_loader_client.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_PUBLIC_TEST_TEST_URL_LOADER_CLIENT_H_
-#define CONTENT_PUBLIC_TEST_TEST_URL_LOADER_CLIENT_H_
+#ifndef SERVICES_NETWORK_TEST_TEST_URL_LOADER_CLIENT_H_
+#define SERVICES_NETWORK_TEST_TEST_URL_LOADER_CLIENT_H_
 
 #include <stdint.h>
 #include <vector>
@@ -18,7 +18,7 @@
 #include "services/network/public/interfaces/url_loader.mojom.h"
 #include "services/network/public/interfaces/url_loader_factory.mojom.h"
 
-namespace content {
+namespace network {
 
 // TestURLLoaderClient records URLLoaderClient function calls.
 //
@@ -28,18 +28,16 @@
 //   client.RunUntilComplete();
 //   EXPECT_EQ(net::OK, client.completion_status().error_code);
 //   ...
-class TestURLLoaderClient final : public network::mojom::URLLoaderClient {
+class TestURLLoaderClient final : public mojom::URLLoaderClient {
  public:
   TestURLLoaderClient();
   ~TestURLLoaderClient() override;
 
-  void OnReceiveResponse(
-      const network::ResourceResponseHead& response_head,
-      const base::Optional<net::SSLInfo>& ssl_info,
-      network::mojom::DownloadedTempFilePtr downloaded_file) override;
-  void OnReceiveRedirect(
-      const net::RedirectInfo& redirect_info,
-      const network::ResourceResponseHead& response_head) override;
+  void OnReceiveResponse(const ResourceResponseHead& response_head,
+                         const base::Optional<net::SSLInfo>& ssl_info,
+                         mojom::DownloadedTempFilePtr downloaded_file) override;
+  void OnReceiveRedirect(const net::RedirectInfo& redirect_info,
+                         const ResourceResponseHead& response_head) override;
   void OnDataDownloaded(int64_t data_length, int64_t encoded_length) override;
   void OnReceiveCachedMetadata(const std::vector<uint8_t>& data) override;
   void OnTransferSizeUpdated(int32_t transfer_size_diff) override;
@@ -48,7 +46,7 @@
                         OnUploadProgressCallback ack_callback) override;
   void OnStartLoadingResponseBody(
       mojo::ScopedDataPipeConsumerHandle body) override;
-  void OnComplete(const network::URLLoaderCompletionStatus& status) override;
+  void OnComplete(const URLLoaderCompletionStatus& status) override;
 
   bool has_received_response() const { return has_received_response_; }
   bool has_received_redirect() const { return has_received_redirect_; }
@@ -60,9 +58,7 @@
     return has_received_cached_metadata_;
   }
   bool has_received_completion() const { return has_received_completion_; }
-  const network::ResourceResponseHead& response_head() const {
-    return response_head_;
-  }
+  const ResourceResponseHead& response_head() const { return response_head_; }
   const base::Optional<net::SSLInfo>& ssl_info() const { return ssl_info_; }
   const net::RedirectInfo& redirect_info() const { return redirect_info_; }
   const std::string& cached_metadata() const { return cached_metadata_; }
@@ -70,7 +66,7 @@
   mojo::ScopedDataPipeConsumerHandle response_body_release() {
     return std::move(response_body_);
   }
-  const network::URLLoaderCompletionStatus& completion_status() const {
+  const URLLoaderCompletionStatus& completion_status() const {
     return completion_status_;
   }
   int64_t download_data_length() const { return download_data_length_; }
@@ -85,10 +81,10 @@
     has_received_upload_progress_ = false;
   }
 
-  network::mojom::DownloadedTempFilePtr TakeDownloadedTempFile();
+  mojom::DownloadedTempFilePtr TakeDownloadedTempFile();
   void ClearHasReceivedRedirect();
   // Creates an InterfacePtr, binds it to |*this| and returns it.
-  network::mojom::URLLoaderClientPtr CreateInterfacePtr();
+  mojom::URLLoaderClientPtr CreateInterfacePtr();
 
   void Unbind();
 
@@ -103,14 +99,14 @@
  private:
   void OnConnectionError();
 
-  mojo::Binding<network::mojom::URLLoaderClient> binding_;
-  network::ResourceResponseHead response_head_;
+  mojo::Binding<mojom::URLLoaderClient> binding_;
+  ResourceResponseHead response_head_;
   base::Optional<net::SSLInfo> ssl_info_;
-  network::mojom::DownloadedTempFilePtr downloaded_file_;
+  mojom::DownloadedTempFilePtr downloaded_file_;
   net::RedirectInfo redirect_info_;
   std::string cached_metadata_;
   mojo::ScopedDataPipeConsumerHandle response_body_;
-  network::URLLoaderCompletionStatus completion_status_;
+  URLLoaderCompletionStatus completion_status_;
   bool has_received_response_ = false;
   bool has_received_redirect_ = false;
   bool has_data_downloaded_ = false;
@@ -127,7 +123,7 @@
   base::Closure quit_closure_for_on_complete_;
   base::Closure quit_closure_for_on_connection_error_;
 
-  network::mojom::URLLoaderFactoryPtr url_loader_factory_;
+  mojom::URLLoaderFactoryPtr url_loader_factory_;
   int64_t download_data_length_ = 0;
   int64_t encoded_download_data_length_ = 0;
   int64_t body_transfer_size_ = 0;
@@ -137,6 +133,6 @@
   DISALLOW_COPY_AND_ASSIGN(TestURLLoaderClient);
 };
 
-}  // namespace content
+}  // namespace network
 
-#endif  // CONTENT_PUBLIC_TEST_TEST_URL_LOADER_CLIENT_H_
+#endif  // SERVICES_NETWORK_TEST_TEST_URL_LOADER_CLIENT_H_
diff --git a/content/network/throttling/network_conditions.cc b/services/network/throttling/network_conditions.cc
similarity index 89%
rename from content/network/throttling/network_conditions.cc
rename to services/network/throttling/network_conditions.cc
index d4639fe..71cd4ac0 100644
--- a/content/network/throttling/network_conditions.cc
+++ b/services/network/throttling/network_conditions.cc
@@ -2,9 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/throttling/network_conditions.h"
+#include "services/network/throttling/network_conditions.h"
 
-namespace content {
+namespace network {
 
 NetworkConditions::NetworkConditions() : NetworkConditions(false) {}
 
@@ -27,4 +27,4 @@
                        (upload_throughput_ != 0));
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/content/network/throttling/network_conditions.h b/services/network/throttling/network_conditions.h
similarity index 77%
rename from content/network/throttling/network_conditions.h
rename to services/network/throttling/network_conditions.h
index 037f160..728b10e 100644
--- a/content/network/throttling/network_conditions.h
+++ b/services/network/throttling/network_conditions.h
@@ -2,20 +2,18 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTET_NETWORK_THROTTLING_NETWORK_CONDITIONS_H_
-#define CONTET_NETWORK_THROTTLING_NETWORK_CONDITIONS_H_
+#ifndef SERVICES_NETWORK_THROTTLING_NETWORK_CONDITIONS_H_
+#define SERVICES_NETWORK_THROTTLING_NETWORK_CONDITIONS_H_
 
 #include <string>
 #include <vector>
 
 #include "base/macros.h"
 
-#include "content/common/content_export.h"
-
-namespace content {
+namespace network {
 
 // NetworkConditions holds information about desired network conditions.
-class CONTENT_EXPORT NetworkConditions {
+class NetworkConditions {
  public:
   NetworkConditions();
   ~NetworkConditions();
@@ -42,6 +40,6 @@
   DISALLOW_COPY_AND_ASSIGN(NetworkConditions);
 };
 
-}  // namespace content
+}  // namespace network
 
-#endif  // CONTET_NETWORK_THROTTLING_NETWORK_CONDITIONS_H_
+#endif  // SERVICES_NETWORK_THROTTLING_NETWORK_CONDITIONS_H_
diff --git a/content/network/throttling/throttling_controller.cc b/services/network/throttling/throttling_controller.cc
similarity index 89%
rename from content/network/throttling/throttling_controller.cc
rename to services/network/throttling/throttling_controller.cc
index 8cea4eb9..d987131a 100644
--- a/content/network/throttling/throttling_controller.cc
+++ b/services/network/throttling/throttling_controller.cc
@@ -2,15 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/throttling/throttling_controller.h"
+#include "services/network/throttling/throttling_controller.h"
 
 #include <utility>
 
-#include "content/network/throttling/network_conditions.h"
-#include "content/network/throttling/throttling_network_interceptor.h"
 #include "net/http/http_request_info.h"
+#include "services/network/throttling/network_conditions.h"
+#include "services/network/throttling/throttling_network_interceptor.h"
 
-namespace content {
+namespace network {
 
 ThrottlingController* ThrottlingController::instance_ = nullptr;
 
@@ -73,4 +73,4 @@
   }
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/content/network/throttling/throttling_controller.h b/services/network/throttling/throttling_controller.h
similarity index 79%
rename from content/network/throttling/throttling_controller.h
rename to services/network/throttling/throttling_controller.h
index bc8feba..f536de62 100644
--- a/content/network/throttling/throttling_controller.h
+++ b/services/network/throttling/throttling_controller.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_NETWORK_THROTTLING_THROTTLING_NETWORK_CONTROLLER_H_
-#define CONTENT_NETWORK_THROTTLING_THROTTLING_NETWORK_CONTROLLER_H_
+#ifndef SERVICES_NETWORK_THROTTLING_THROTTLING_NETWORK_CONTROLLER_H_
+#define SERVICES_NETWORK_THROTTLING_THROTTLING_NETWORK_CONTROLLER_H_
 
 #include <map>
 #include <memory>
@@ -11,16 +11,15 @@
 
 #include "base/macros.h"
 #include "base/threading/thread_checker.h"
-#include "content/common/content_export.h"
 
-namespace content {
+namespace network {
 
 class NetworkConditions;
 class ThrottlingNetworkInterceptor;
 
 // ThrottlingController manages interceptors identified by client id
 // and their throttling conditions.
-class CONTENT_EXPORT ThrottlingController {
+class ThrottlingController {
  public:
   // Applies network emulation configuration.
   static void SetConditions(const std::string& client_id,
@@ -49,6 +48,6 @@
   DISALLOW_COPY_AND_ASSIGN(ThrottlingController);
 };
 
-}  // namespace content
+}  // namespace network
 
-#endif  // CONTENT_NETWORK_THROTTLING_THROTTLING_NETWORK_CONTROLLER_H_
+#endif  // SERVICES_NETWORK_THROTTLING_THROTTLING_NETWORK_CONTROLLER_H_
diff --git a/content/network/throttling/throttling_controller_unittest.cc b/services/network/throttling/throttling_controller_unittest.cc
similarity index 96%
rename from content/network/throttling/throttling_controller_unittest.cc
rename to services/network/throttling/throttling_controller_unittest.cc
index ea7a2caf..24638c7 100644
--- a/content/network/throttling/throttling_controller_unittest.cc
+++ b/services/network/throttling/throttling_controller_unittest.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/throttling/throttling_controller.h"
+#include "services/network/throttling/throttling_controller.h"
 
 #include <stdint.h>
 
@@ -15,17 +15,17 @@
 #include "base/message_loop/message_loop.h"
 #include "base/run_loop.h"
 #include "base/test/test_mock_time_task_runner.h"
-#include "content/network/throttling/network_conditions.h"
-#include "content/network/throttling/throttling_network_interceptor.h"
-#include "content/network/throttling/throttling_network_transaction.h"
-#include "content/network/throttling/throttling_upload_data_stream.h"
 #include "net/base/chunked_upload_data_stream.h"
 #include "net/http/http_transaction_test_util.h"
 #include "net/log/net_log_with_source.h"
+#include "services/network/throttling/network_conditions.h"
+#include "services/network/throttling/throttling_network_interceptor.h"
+#include "services/network/throttling/throttling_network_transaction.h"
+#include "services/network/throttling/throttling_upload_data_stream.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
 
-namespace content {
+namespace network {
 
 using net::kSimpleGET_Transaction;
 using net::MockHttpRequest;
@@ -324,4 +324,4 @@
   EXPECT_EQ(callback->value(), static_cast<int>(arraysize(kUploadData)));
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/content/network/throttling/throttling_network_interceptor.cc b/services/network/throttling/throttling_network_interceptor.cc
similarity index 97%
rename from content/network/throttling/throttling_network_interceptor.cc
rename to services/network/throttling/throttling_network_interceptor.cc
index 6054bfd..03deaf8 100644
--- a/content/network/throttling/throttling_network_interceptor.cc
+++ b/services/network/throttling/throttling_network_interceptor.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/throttling/throttling_network_interceptor.h"
+#include "services/network/throttling/throttling_network_interceptor.h"
 
 #include <stddef.h>
 #include <algorithm>
@@ -10,10 +10,10 @@
 #include <utility>
 
 #include "base/time/time.h"
-#include "content/network/throttling/network_conditions.h"
 #include "net/base/net_errors.h"
+#include "services/network/throttling/network_conditions.h"
 
-namespace content {
+namespace network {
 
 namespace {
 
@@ -285,4 +285,4 @@
   return conditions_->offline();
 }
 
-}  // namespace content
\ No newline at end of file
+}  // namespace network
\ No newline at end of file
diff --git a/content/network/throttling/throttling_network_interceptor.h b/services/network/throttling/throttling_network_interceptor.h
similarity index 89%
rename from content/network/throttling/throttling_network_interceptor.h
rename to services/network/throttling/throttling_network_interceptor.h
index ea857f7..0ec546a 100644
--- a/content/network/throttling/throttling_network_interceptor.h
+++ b/services/network/throttling/throttling_network_interceptor.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_NETWORK_THROTTLING_THROTTLING_NETWORK_INTERCEPTOR_H_
-#define CONTENT_NETWORK_THROTTLING_THROTTLING_NETWORK_INTERCEPTOR_H_
+#ifndef SERVICES_NETWORK_THROTTLING_THROTTLING_NETWORK_INTERCEPTOR_H_
+#define SERVICES_NETWORK_THROTTLING_THROTTLING_NETWORK_INTERCEPTOR_H_
 
 #include <stdint.h>
 
@@ -15,19 +15,18 @@
 
 #include "base/macros.h"
 #include "base/timer/timer.h"
-#include "content/common/content_export.h"
 
 namespace base {
 class TimeDelta;
 class TimeTicks;
 }  // namespace base
 
-namespace content {
+namespace network {
 class NetworkConditions;
 
 // ThrottlingNetworkInterceptor emulates network conditions for transactions
 // with specific client id.
-class CONTENT_EXPORT ThrottlingNetworkInterceptor {
+class ThrottlingNetworkInterceptor {
  public:
   using ThrottleCallback = base::Callback<void(int, int64_t)>;
 
@@ -105,6 +104,6 @@
   DISALLOW_COPY_AND_ASSIGN(ThrottlingNetworkInterceptor);
 };
 
-}  // namespace content
+}  // namespace network
 
-#endif  // CONTENT_NETWORK_THROTTLING_THROTTLING_NETWORK_INTERCEPTOR_H_
+#endif  // SERVICES_NETWORK_THROTTLING_THROTTLING_NETWORK_INTERCEPTOR_H_
diff --git a/content/network/throttling/throttling_network_transaction.cc b/services/network/throttling/throttling_network_transaction.cc
similarity index 96%
rename from content/network/throttling/throttling_network_transaction.cc
rename to services/network/throttling/throttling_network_transaction.cc
index b7df8df5..a6ada2e 100644
--- a/content/network/throttling/throttling_network_transaction.cc
+++ b/services/network/throttling/throttling_network_transaction.cc
@@ -2,21 +2,21 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/throttling/throttling_network_transaction.h"
+#include "services/network/throttling/throttling_network_transaction.h"
 
 #include <utility>
 
 #include "base/callback_helpers.h"
-#include "content/network/throttling/throttling_controller.h"
-#include "content/network/throttling/throttling_network_interceptor.h"
-#include "content/network/throttling/throttling_upload_data_stream.h"
 #include "net/base/load_timing_info.h"
 #include "net/base/net_errors.h"
 #include "net/http/http_network_transaction.h"
 #include "net/http/http_request_info.h"
 #include "net/socket/connection_attempts.h"
+#include "services/network/throttling/throttling_controller.h"
+#include "services/network/throttling/throttling_network_interceptor.h"
+#include "services/network/throttling/throttling_upload_data_stream.h"
 
-namespace content {
+namespace network {
 
 // Keep in sync with X_DevTools_Emulate_Network_Conditions_Client_Id defined in
 // HTTPNames.json5.
@@ -318,4 +318,4 @@
   network_transaction_->GetConnectionAttempts(out);
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/content/network/throttling/throttling_network_transaction.h b/services/network/throttling/throttling_network_transaction.h
similarity index 90%
rename from content/network/throttling/throttling_network_transaction.h
rename to services/network/throttling/throttling_network_transaction.h
index d34ca06..66bbb26 100644
--- a/content/network/throttling/throttling_network_transaction.h
+++ b/services/network/throttling/throttling_network_transaction.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CHROME_BROWSER_DEVTOOLS_DEVTOOLS_NETWORK_TRANSACTION_H_
-#define CHROME_BROWSER_DEVTOOLS_DEVTOOLS_NETWORK_TRANSACTION_H_
+#ifndef SERVICES_NETWORK_THROTTLING_THROTTLING_NETWORK_TRANSACTION_H_
+#define SERVICES_NETWORK_THROTTLING_THROTTLING_NETWORK_TRANSACTION_H_
 
 #include <stdint.h>
 
@@ -11,14 +11,13 @@
 
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
-#include "content/common/content_export.h"
-#include "content/network/throttling/throttling_network_interceptor.h"
 #include "net/base/completion_callback.h"
 #include "net/base/load_states.h"
 #include "net/base/net_error_details.h"
 #include "net/base/request_priority.h"
 #include "net/http/http_transaction.h"
 #include "net/websockets/websocket_handshake_stream_base.h"
+#include "services/network/throttling/throttling_network_interceptor.h"
 
 namespace net {
 class AuthCredentials;
@@ -31,7 +30,7 @@
 class X509Certificate;
 }  // namespace net
 
-namespace content {
+namespace network {
 
 class ThrottlingController;
 class ThrottlingControllerHelper;
@@ -42,8 +41,7 @@
 // parameter is saved and replaced with proxy callback. Fail method should be
 // used to simulate network outage. It runs saved callback (if any) with
 // net::ERR_INTERNET_DISCONNECTED result value.
-class CONTENT_EXPORT ThrottlingNetworkTransaction
-    : public net::HttpTransaction {
+class ThrottlingNetworkTransaction : public net::HttpTransaction {
  public:
   static const char kDevToolsEmulateNetworkConditionsClientId[];
 
@@ -94,7 +92,7 @@
   void GetConnectionAttempts(net::ConnectionAttempts* out) const override;
 
  protected:
-  friend class content::ThrottlingControllerHelper;
+  friend class ThrottlingControllerHelper;
 
  private:
   void Fail();
@@ -131,6 +129,6 @@
   DISALLOW_COPY_AND_ASSIGN(ThrottlingNetworkTransaction);
 };
 
-}  // namespace content
+}  // namespace network
 
-#endif  // CHROME_BROWSER_DEVTOOLS_DEVTOOLS_NETWORK_TRANSACTION_H_
+#endif  // SERVICES_NETWORK_THROTTLING_THROTTLING_NETWORK_TRANSACTION_H_
diff --git a/content/network/throttling/throttling_network_transaction_factory.cc b/services/network/throttling/throttling_network_transaction_factory.cc
similarity index 82%
rename from content/network/throttling/throttling_network_transaction_factory.cc
rename to services/network/throttling/throttling_network_transaction_factory.cc
index c4762c7..4008be58 100644
--- a/content/network/throttling/throttling_network_transaction_factory.cc
+++ b/services/network/throttling/throttling_network_transaction_factory.cc
@@ -2,19 +2,19 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/throttling/throttling_network_transaction_factory.h"
+#include "services/network/throttling/throttling_network_transaction_factory.h"
 
 #include <set>
 #include <string>
 #include <utility>
 
-#include "content/network/throttling/throttling_controller.h"
-#include "content/network/throttling/throttling_network_transaction.h"
 #include "net/base/net_errors.h"
 #include "net/http/http_network_layer.h"
 #include "net/http/http_network_transaction.h"
+#include "services/network/throttling/throttling_controller.h"
+#include "services/network/throttling/throttling_network_transaction.h"
 
-namespace content {
+namespace network {
 
 ThrottlingNetworkTransactionFactory::ThrottlingNetworkTransactionFactory(
     net::HttpNetworkSession* session)
@@ -43,4 +43,4 @@
   return network_layer_->GetSession();
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/content/network/throttling/throttling_network_transaction_factory.h b/services/network/throttling/throttling_network_transaction_factory.h
similarity index 79%
rename from content/network/throttling/throttling_network_transaction_factory.h
rename to services/network/throttling/throttling_network_transaction_factory.h
index 7e5a38b..17b2014 100644
--- a/content/network/throttling/throttling_network_transaction_factory.h
+++ b/services/network/throttling/throttling_network_transaction_factory.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CHROME_BROWSER_DEVTOOLS_DEVTOOLS_NETWORK_TRANSACTION_FACTORY_H_
-#define CHROME_BROWSER_DEVTOOLS_DEVTOOLS_NETWORK_TRANSACTION_FACTORY_H_
+#ifndef SERVICES_NETWORK_THROTTLING_THROTTLING_NETWORK_TRANSACTION_FACTORY_H_
+#define SERVICES_NETWORK_THROTTLING_THROTTLING_NETWORK_TRANSACTION_FACTORY_H_
 
 #include <memory>
 
@@ -17,7 +17,7 @@
 class HttpTransaction;
 }  // namespace net
 
-namespace content {
+namespace network {
 
 // NetworkTransactionFactory wraps HttpNetworkTransactions.
 class ThrottlingNetworkTransactionFactory : public net::HttpTransactionFactory {
@@ -38,6 +38,6 @@
   DISALLOW_COPY_AND_ASSIGN(ThrottlingNetworkTransactionFactory);
 };
 
-}  // namespace content
+}  // namespace network
 
-#endif  // CHROME_BROWSER_DEVTOOLS_DEVTOOLS_NETWORK_TRANSACTION_FACTORY_H_
+#endif  // SERVICES_NETWORK_THROTTLING_THROTTLING_NETWORK_TRANSACTION_FACTORY_H_
diff --git a/content/network/throttling/throttling_upload_data_stream.cc b/services/network/throttling/throttling_upload_data_stream.cc
similarity index 95%
rename from content/network/throttling/throttling_upload_data_stream.cc
rename to services/network/throttling/throttling_upload_data_stream.cc
index 4e0d1b90..e7d6d251 100644
--- a/content/network/throttling/throttling_upload_data_stream.cc
+++ b/services/network/throttling/throttling_upload_data_stream.cc
@@ -2,11 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/throttling/throttling_upload_data_stream.h"
+#include "services/network/throttling/throttling_upload_data_stream.h"
 
 #include "net/base/net_errors.h"
 
-namespace content {
+namespace network {
 
 ThrottlingUploadDataStream::ThrottlingUploadDataStream(
     net::UploadDataStream* upload_data_stream)
@@ -92,4 +92,4 @@
     interceptor_->StopThrottle(throttle_callback_);
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/content/network/throttling/throttling_upload_data_stream.h b/services/network/throttling/throttling_upload_data_stream.h
similarity index 82%
rename from content/network/throttling/throttling_upload_data_stream.h
rename to services/network/throttling/throttling_upload_data_stream.h
index 18adb63a..1b881362 100644
--- a/content/network/throttling/throttling_upload_data_stream.h
+++ b/services/network/throttling/throttling_upload_data_stream.h
@@ -2,18 +2,18 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_NETWORK_THROTTLING_THROTTLING_UPLOAD_DATA_STREAM_H_
-#define CONTENT_NETWORK_THROTTLING_THROTTLING_UPLOAD_DATA_STREAM_H_
+#ifndef SERVICES_NETWORK_THROTTLING_THROTTLING_UPLOAD_DATA_STREAM_H_
+#define SERVICES_NETWORK_THROTTLING_THROTTLING_UPLOAD_DATA_STREAM_H_
 
 #include <stdint.h>
 
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
-#include "content/network/throttling/throttling_network_interceptor.h"
 #include "net/base/completion_callback.h"
 #include "net/base/upload_data_stream.h"
+#include "services/network/throttling/throttling_network_interceptor.h"
 
-namespace content {
+namespace network {
 
 class ThrottlingNetworkInterceptor;
 
@@ -50,6 +50,6 @@
   DISALLOW_COPY_AND_ASSIGN(ThrottlingUploadDataStream);
 };
 
-}  // namespace content
+}  // namespace network
 
-#endif  // CONTENT_NETWORK_THROTTLING_THROTTLING_UPLOAD_DATA_STREAM_H_
+#endif  // SERVICES_NETWORK_THROTTLING_THROTTLING_UPLOAD_DATA_STREAM_H_
diff --git a/content/network/upload_progress_tracker.cc b/services/network/upload_progress_tracker.cc
similarity index 96%
rename from content/network/upload_progress_tracker.cc
rename to services/network/upload_progress_tracker.cc
index 353d3d2..e75e4f4 100644
--- a/content/network/upload_progress_tracker.cc
+++ b/services/network/upload_progress_tracker.cc
@@ -2,13 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/upload_progress_tracker.h"
+#include "services/network/upload_progress_tracker.h"
 
 #include "base/logging.h"
 #include "net/base/upload_progress.h"
 #include "net/url_request/url_request.h"
 
-namespace content {
+namespace network {
 namespace {
 // The interval for calls to ReportUploadProgress.
 constexpr base::TimeDelta kUploadProgressInterval =
@@ -86,4 +86,4 @@
   }
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/content/network/upload_progress_tracker.h b/services/network/upload_progress_tracker.h
similarity index 86%
rename from content/network/upload_progress_tracker.h
rename to services/network/upload_progress_tracker.h
index a14522b..279bdb7 100644
--- a/content/network/upload_progress_tracker.h
+++ b/services/network/upload_progress_tracker.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_NETWORK_UPLOAD_PROGRESS_TRACKER_H_
-#define CONTENT_NETWORK_UPLOAD_PROGRESS_TRACKER_H_
+#ifndef SERVICES_NETWORK_UPLOAD_PROGRESS_TRACKER_H_
+#define SERVICES_NETWORK_UPLOAD_PROGRESS_TRACKER_H_
 
 #include <stdint.h>
 
@@ -14,7 +14,6 @@
 #include "base/threading/sequenced_task_runner_handle.h"
 #include "base/time/time.h"
 #include "base/timer/timer.h"
-#include "content/common/content_export.h"
 #include "net/base/upload_progress.h"
 
 namespace base {
@@ -25,11 +24,11 @@
 class URLRequest;
 }
 
-namespace content {
+namespace network {
 
 // UploadProgressTracker watches the upload progress of a URL loading, and sends
 // the progress to the client in a suitable granularity and frequency.
-class CONTENT_EXPORT UploadProgressTracker {
+class UploadProgressTracker {
  public:
   using UploadProgressReportCallback =
       base::RepeatingCallback<void(const net::UploadProgress&)>;
@@ -65,6 +64,6 @@
   DISALLOW_COPY_AND_ASSIGN(UploadProgressTracker);
 };
 
-}  // namespace content
+}  // namespace network
 
-#endif  // CONTENT_NETWORK_UPLOAD_PROGRESS_TRACKER_H_
+#endif  // SERVICES_NETWORK_UPLOAD_PROGRESS_TRACKER_H_
diff --git a/content/network/upload_progress_tracker_unittest.cc b/services/network/upload_progress_tracker_unittest.cc
similarity index 98%
rename from content/network/upload_progress_tracker_unittest.cc
rename to services/network/upload_progress_tracker_unittest.cc
index 4ddf503..1de8512 100644
--- a/content/network/upload_progress_tracker_unittest.cc
+++ b/services/network/upload_progress_tracker_unittest.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/upload_progress_tracker.h"
+#include "services/network/upload_progress_tracker.h"
 
 #include "base/bind.h"
 #include "base/location.h"
@@ -14,7 +14,7 @@
 #include "net/base/upload_progress.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
-namespace content {
+namespace network {
 namespace {
 
 class TestingUploadProgressTracker : public UploadProgressTracker {
@@ -276,4 +276,4 @@
   EXPECT_FALSE(mock_task_runner_->HasPendingTask());
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/content/network/url_loader.cc b/services/network/url_loader.cc
similarity index 88%
rename from content/network/url_loader.cc
rename to services/network/url_loader.cc
index 3aec6942..6110ab8 100644
--- a/content/network/url_loader.cc
+++ b/services/network/url_loader.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/network/url_loader.h"
+#include "services/network/url_loader.h"
 
 #include <string>
 
@@ -12,9 +12,6 @@
 #include "base/task_scheduler/post_task.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "base/time/time.h"
-#include "content/network/data_pipe_element_reader.h"
-#include "content/network/network_context.h"
-#include "content/network/network_service_impl.h"
 #include "mojo/public/cpp/system/simple_watcher.h"
 #include "net/base/elements_upload_data_stream.h"
 #include "net/base/mime_sniffer.h"
@@ -24,13 +21,16 @@
 #include "net/ssl/client_cert_store.h"
 #include "net/ssl/ssl_private_key.h"
 #include "net/url_request/url_request_context.h"
+#include "services/network/data_pipe_element_reader.h"
+#include "services/network/network_context.h"
+#include "services/network/network_service_impl.h"
 #include "services/network/public/cpp/loader_util.h"
 #include "services/network/public/cpp/net_adapters.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/cpp/resource_response.h"
 #include "services/network/public/interfaces/url_loader_factory.mojom.h"
 
-namespace content {
+namespace network {
 
 namespace {
 constexpr size_t kDefaultAllocationSize = 512 * 1024;
@@ -39,7 +39,7 @@
 // content/browser/loader/resource_loader.cc
 void PopulateResourceResponse(net::URLRequest* request,
                               bool is_load_timing_enabled,
-                              network::ResourceResponse* response) {
+                              ResourceResponse* response) {
   response->head.request_time = request->request_time();
   response->head.response_time = request->response_time();
   response->head.headers = request->response_headers();
@@ -77,17 +77,17 @@
 // ResourceRequestBody.
 class BytesElementReader : public net::UploadBytesElementReader {
  public:
-  BytesElementReader(network::ResourceRequestBody* resource_request_body,
-                     const network::DataElement& element)
+  BytesElementReader(ResourceRequestBody* resource_request_body,
+                     const DataElement& element)
       : net::UploadBytesElementReader(element.bytes(), element.length()),
         resource_request_body_(resource_request_body) {
-    DCHECK_EQ(network::DataElement::TYPE_BYTES, element.type());
+    DCHECK_EQ(DataElement::TYPE_BYTES, element.type());
   }
 
   ~BytesElementReader() override {}
 
  private:
-  scoped_refptr<network::ResourceRequestBody> resource_request_body_;
+  scoped_refptr<ResourceRequestBody> resource_request_body_;
 
   DISALLOW_COPY_AND_ASSIGN(BytesElementReader);
 };
@@ -98,31 +98,31 @@
 // files survive until upload completion.
 class FileElementReader : public net::UploadFileElementReader {
  public:
-  FileElementReader(network::ResourceRequestBody* resource_request_body,
+  FileElementReader(ResourceRequestBody* resource_request_body,
                     base::TaskRunner* task_runner,
-                    const network::DataElement& element)
+                    const DataElement& element)
       : net::UploadFileElementReader(task_runner,
                                      element.path(),
                                      element.offset(),
                                      element.length(),
                                      element.expected_modification_time()),
         resource_request_body_(resource_request_body) {
-    DCHECK_EQ(network::DataElement::TYPE_FILE, element.type());
+    DCHECK_EQ(DataElement::TYPE_FILE, element.type());
   }
 
   ~FileElementReader() override {}
 
  private:
-  scoped_refptr<network::ResourceRequestBody> resource_request_body_;
+  scoped_refptr<ResourceRequestBody> resource_request_body_;
 
   DISALLOW_COPY_AND_ASSIGN(FileElementReader);
 };
 
 class RawFileElementReader : public net::UploadFileElementReader {
  public:
-  RawFileElementReader(network::ResourceRequestBody* resource_request_body,
+  RawFileElementReader(ResourceRequestBody* resource_request_body,
                        base::TaskRunner* task_runner,
-                       const network::DataElement& element)
+                       const DataElement& element)
       : net::UploadFileElementReader(
             task_runner,
             // TODO(mmenke): Is duplicating this necessary?
@@ -132,47 +132,46 @@
             element.length(),
             element.expected_modification_time()),
         resource_request_body_(resource_request_body) {
-    DCHECK_EQ(network::DataElement::TYPE_RAW_FILE, element.type());
+    DCHECK_EQ(DataElement::TYPE_RAW_FILE, element.type());
   }
 
   ~RawFileElementReader() override {}
 
  private:
-  scoped_refptr<network::ResourceRequestBody> resource_request_body_;
+  scoped_refptr<ResourceRequestBody> resource_request_body_;
 
   DISALLOW_COPY_AND_ASSIGN(RawFileElementReader);
 };
 
 // TODO: copied from content/browser/loader/upload_data_stream_builder.cc.
 std::unique_ptr<net::UploadDataStream> CreateUploadDataStream(
-    network::ResourceRequestBody* body,
+    ResourceRequestBody* body,
     base::SequencedTaskRunner* file_task_runner) {
   std::vector<std::unique_ptr<net::UploadElementReader>> element_readers;
   for (const auto& element : *body->elements()) {
     switch (element.type()) {
-      case network::DataElement::TYPE_BYTES:
+      case DataElement::TYPE_BYTES:
         element_readers.push_back(
             std::make_unique<BytesElementReader>(body, element));
         break;
-      case network::DataElement::TYPE_FILE:
+      case DataElement::TYPE_FILE:
         element_readers.push_back(std::make_unique<FileElementReader>(
             body, file_task_runner, element));
         break;
-      case network::DataElement::TYPE_RAW_FILE:
+      case DataElement::TYPE_RAW_FILE:
         element_readers.push_back(std::make_unique<RawFileElementReader>(
             body, file_task_runner, element));
         break;
-      case network::DataElement::TYPE_BLOB: {
+      case DataElement::TYPE_BLOB: {
         CHECK(false) << "Network service always uses DATA_PIPE for blobs.";
         break;
       }
-      case network::DataElement::TYPE_DATA_PIPE: {
+      case DataElement::TYPE_DATA_PIPE: {
         element_readers.push_back(std::make_unique<DataPipeElementReader>(
-            body, const_cast<network::DataElement*>(&element)
-                      ->ReleaseDataPipeGetter()));
+            body, const_cast<DataElement*>(&element)->ReleaseDataPipeGetter()));
         break;
       }
-      case network::DataElement::TYPE_UNKNOWN:
+      case DataElement::TYPE_UNKNOWN:
         NOTREACHED();
         break;
     }
@@ -185,7 +184,7 @@
 class SSLPrivateKeyInternal : public net::SSLPrivateKey {
  public:
   SSLPrivateKeyInternal(const std::vector<uint16_t>& algorithm_perferences,
-                        network::mojom::SSLPrivateKeyPtr ssl_private_key)
+                        mojom::SSLPrivateKeyPtr ssl_private_key)
       : algorithm_perferences_(algorithm_perferences),
         ssl_private_key_(std::move(ssl_private_key)) {
     ssl_private_key_.set_connection_error_handler(
@@ -228,7 +227,7 @@
   }
 
   std::vector<uint16_t> algorithm_perferences_;
-  network::mojom::SSLPrivateKeyPtr ssl_private_key_;
+  mojom::SSLPrivateKeyPtr ssl_private_key_;
 
   DISALLOW_COPY_AND_ASSIGN(SSLPrivateKeyInternal);
 };
@@ -236,11 +235,11 @@
 }  // namespace
 
 URLLoader::URLLoader(NetworkContext* context,
-                     network::mojom::URLLoaderRequest url_loader_request,
+                     mojom::URLLoaderRequest url_loader_request,
                      int32_t options,
-                     const network::ResourceRequest& request,
+                     const ResourceRequest& request,
                      bool report_raw_headers,
-                     network::mojom::URLLoaderClientPtr url_loader_client,
+                     mojom::URLLoaderClientPtr url_loader_client,
                      const net::NetworkTrafficAnnotationTag& traffic_annotation,
                      uint32_t process_id)
     : context_(context),
@@ -266,7 +265,7 @@
       GURL(request.url), request.priority, this, traffic_annotation);
   url_request_->set_method(request.method);
   url_request_->set_site_for_cookies(request.site_for_cookies);
-  url_request_->SetReferrer(network::ComputeReferrer(request.referrer));
+  url_request_->SetReferrer(ComputeReferrer(request.referrer));
   url_request_->set_referrer_policy(request.referrer_policy);
   url_request_->SetExtraRequestHeaders(request.headers);
 
@@ -392,14 +391,12 @@
   // optionally follow the redirect.
   *defer_redirect = true;
 
-  scoped_refptr<network::ResourceResponse> response =
-      new network::ResourceResponse();
+  scoped_refptr<ResourceResponse> response = new ResourceResponse();
   PopulateResourceResponse(url_request_.get(), is_load_timing_enabled_,
                            response.get());
   if (report_raw_headers_) {
-    response->head.raw_request_response_info =
-        network::BuildRawRequestResponseInfo(
-            *url_request_, raw_request_headers_, raw_response_headers_.get());
+    response->head.raw_request_response_info = BuildRawRequestResponseInfo(
+        *url_request_, raw_request_headers_, raw_response_headers_.get());
     raw_request_headers_ = net::HttpRawRequestHeaders();
     raw_response_headers_ = nullptr;
   }
@@ -456,13 +453,12 @@
     upload_progress_tracker_ = nullptr;
   }
 
-  response_ = new network::ResourceResponse();
+  response_ = new ResourceResponse();
   PopulateResourceResponse(url_request_.get(), is_load_timing_enabled_,
                            response_.get());
   if (report_raw_headers_) {
-    response_->head.raw_request_response_info =
-        network::BuildRawRequestResponseInfo(
-            *url_request_, raw_request_headers_, raw_response_headers_.get());
+    response_->head.raw_request_response_info = BuildRawRequestResponseInfo(
+        *url_request_, raw_request_headers_, raw_response_headers_.get());
     raw_request_headers_ = net::HttpRawRequestHeaders();
     raw_response_headers_ = nullptr;
   }
@@ -483,8 +479,8 @@
       base::Bind(&URLLoader::OnResponseBodyStreamReady,
                  base::Unretained(this)));
 
-  if (!(options_ & network::mojom::kURLLoadOptionSniffMimeType) ||
-      !network::ShouldSniffContent(url_request_.get(), response_.get()))
+  if (!(options_ & mojom::kURLLoadOptionSniffMimeType) ||
+      !ShouldSniffContent(url_request_.get(), response_.get()))
     SendResponseToClient();
 
   // Start reading...
@@ -504,7 +500,7 @@
   if (!pending_write_.get()) {
     // TODO: we should use the abstractions in MojoAsyncResourceHandler.
     DCHECK_EQ(0u, pending_write_buffer_offset_);
-    MojoResult result = network::NetToMojoPendingBuffer::BeginWrite(
+    MojoResult result = NetToMojoPendingBuffer::BeginWrite(
         &response_body_stream_, &pending_write_, &pending_write_buffer_size_);
     if (result != MOJO_RESULT_OK && result != MOJO_RESULT_SHOULD_WAIT) {
       // The response body stream is in a bad state. Bail.
@@ -526,7 +522,7 @@
     }
   }
 
-  auto buf = base::MakeRefCounted<network::NetToMojoIOBuffer>(
+  auto buf = base::MakeRefCounted<NetToMojoIOBuffer>(
       pending_write_.get(), pending_write_buffer_offset_);
   int bytes_read;
   url_request_->Read(buf.get(),
@@ -612,7 +608,7 @@
   if (consumer_handle_.is_valid())
     SendResponseToClient();
 
-  network::URLLoaderCompletionStatus status;
+  URLLoaderCompletionStatus status;
   status.error_code = error_code;
   status.exists_in_cache = url_request_->response_info().was_cached;
   status.completion_time = base::TimeTicks::Now();
@@ -620,8 +616,7 @@
   status.encoded_body_length = url_request_->GetRawBodyBytes();
   status.decoded_body_length = total_written_bytes_;
 
-  if ((options_ &
-       network::mojom::kURLLoadOptionSendSSLInfoForCertificateError) &&
+  if ((options_ & mojom::kURLLoadOptionSendSSLInfoForCertificateError) &&
       net::IsCertStatusError(url_request_->ssl_info().cert_status) &&
       !net::IsCertStatusMinorError(url_request_->ssl_info().cert_status)) {
     status.ssl_info = url_request_->ssl_info();
@@ -675,9 +670,9 @@
 
 void URLLoader::SendResponseToClient() {
   base::Optional<net::SSLInfo> ssl_info;
-  if (options_ & network::mojom::kURLLoadOptionSendSSLInfoWithResponse)
+  if (options_ & mojom::kURLLoadOptionSendSSLInfoWithResponse)
     ssl_info = url_request_->ssl_info();
-  network::mojom::DownloadedTempFilePtr downloaded_file_ptr;
+  mojom::DownloadedTempFilePtr downloaded_file_ptr;
   url_loader_client_->OnReceiveResponse(response_->head, ssl_info,
                                         std::move(downloaded_file_ptr));
 
@@ -743,7 +738,7 @@
 void URLLoader::OnCertificateRequestedResponse(
     const scoped_refptr<net::X509Certificate>& x509_certificate,
     const std::vector<uint16_t>& algorithm_preferences,
-    network::mojom::SSLPrivateKeyPtr ssl_private_key,
+    mojom::SSLPrivateKeyPtr ssl_private_key,
     bool cancel_certificate_selection) {
   if (cancel_certificate_selection) {
     url_request_->CancelWithError(net::ERR_SSL_CLIENT_AUTH_CERT_NEEDED);
@@ -759,4 +754,4 @@
   }
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/content/network/url_loader.h b/services/network/url_loader.h
similarity index 83%
rename from content/network/url_loader.h
rename to services/network/url_loader.h
index 7bd58494..7e4b2ddc 100644
--- a/content/network/url_loader.h
+++ b/services/network/url_loader.h
@@ -2,16 +2,14 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_NETWORK_URL_LOADER_H_
-#define CONTENT_NETWORK_URL_LOADER_H_
+#ifndef SERVICES_NETWORK_URL_LOADER_H_
+#define SERVICES_NETWORK_URL_LOADER_H_
 
 #include <stdint.h>
 
 #include <memory>
 
 #include "base/memory/weak_ptr.h"
-#include "content/common/content_export.h"
-#include "content/network/upload_progress_tracker.h"
 #include "mojo/public/cpp/bindings/binding.h"
 #include "mojo/public/cpp/system/data_pipe.h"
 #include "mojo/public/cpp/system/simple_watcher.h"
@@ -20,29 +18,26 @@
 #include "net/url_request/url_request.h"
 #include "services/network/public/interfaces/network_service.mojom.h"
 #include "services/network/public/interfaces/url_loader.mojom.h"
+#include "services/network/upload_progress_tracker.h"
 
 namespace net {
 class HttpResponseHeaders;
 }
 
 namespace network {
-class NetToMojoPendingBuffer;
-struct ResourceResponse;
-}
-
-namespace content {
 
 class NetworkContext;
+class NetToMojoPendingBuffer;
+struct ResourceResponse;
 
-class CONTENT_EXPORT URLLoader : public network::mojom::URLLoader,
-                                 public net::URLRequest::Delegate {
+class URLLoader : public mojom::URLLoader, public net::URLRequest::Delegate {
  public:
   URLLoader(NetworkContext* context,
-            network::mojom::URLLoaderRequest url_loader_request,
+            mojom::URLLoaderRequest url_loader_request,
             int32_t options,
-            const network::ResourceRequest& request,
+            const ResourceRequest& request,
             bool report_raw_headers,
-            network::mojom::URLLoaderClientPtr url_loader_client,
+            mojom::URLLoaderClientPtr url_loader_client,
             const net::NetworkTrafficAnnotationTag& traffic_annotation,
             uint32_t process_id);
   ~URLLoader() override;
@@ -50,7 +45,7 @@
   // Called when the associated NetworkContext is going away.
   void Cleanup();
 
-  // network::mojom::URLLoader implementation:
+  // mojom::URLLoader implementation:
   void FollowRedirect() override;
   void ProceedWithResponse() override;
   void SetPriority(net::RequestPriority priority,
@@ -95,7 +90,7 @@
   void OnCertificateRequestedResponse(
       const scoped_refptr<net::X509Certificate>& x509_certificate,
       const std::vector<uint16_t>& algorithm_preferences,
-      network::mojom::SSLPrivateKeyPtr ssl_private_key,
+      mojom::SSLPrivateKeyPtr ssl_private_key,
       bool cancel_certificate_selection);
 
   NetworkContext* context_;
@@ -106,12 +101,12 @@
   uint32_t render_frame_id_;
   bool connected_;
   std::unique_ptr<net::URLRequest> url_request_;
-  mojo::Binding<network::mojom::URLLoader> binding_;
-  network::mojom::URLLoaderClientPtr url_loader_client_;
+  mojo::Binding<mojom::URLLoader> binding_;
+  mojom::URLLoaderClientPtr url_loader_client_;
   int64_t total_written_bytes_ = 0;
 
   mojo::ScopedDataPipeProducerHandle response_body_stream_;
-  scoped_refptr<network::NetToMojoPendingBuffer> pending_write_;
+  scoped_refptr<NetToMojoPendingBuffer> pending_write_;
   uint32_t pending_write_buffer_size_ = 0;
   uint32_t pending_write_buffer_offset_ = 0;
   mojo::SimpleWatcher writable_handle_watcher_;
@@ -119,7 +114,7 @@
 
   // Used when deferring sending the data to the client until mime sniffing is
   // finished.
-  scoped_refptr<network::ResourceResponse> response_;
+  scoped_refptr<ResourceResponse> response_;
   mojo::ScopedDataPipeConsumerHandle consumer_handle_;
 
   bool report_raw_headers_;
@@ -144,13 +139,13 @@
   // as BodyReadFromNetBeforePaused.
   int64_t body_read_before_paused_ = -1;
 
-  network::mojom::SSLPrivateKeyPtr ssl_private_key_;
+  mojom::SSLPrivateKeyPtr ssl_private_key_;
 
   base::WeakPtrFactory<URLLoader> weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(URLLoader);
 };
 
-}  // namespace content
+}  // namespace network
 
-#endif  // CONTENT_NETWORK_URL_LOADER_H_
+#endif  // SERVICES_NETWORK_URL_LOADER_H_
diff --git a/content/network/url_request_context_builder_mojo.cc b/services/network/url_request_context_builder_mojo.cc
similarity index 60%
rename from content/network/url_request_context_builder_mojo.cc
rename to services/network/url_request_context_builder_mojo.cc
index dd876f8..935f08c2 100644
--- a/content/network/url_request_context_builder_mojo.cc
+++ b/services/network/url_request_context_builder_mojo.cc
@@ -2,16 +2,19 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/public/network/url_request_context_builder_mojo.h"
+#include "services/network/public/cpp/url_request_context_builder_mojo.h"
 
 #include "base/logging.h"
 #include "build/build_config.h"
-#include "content/network/network_context.h"
-#include "content/network/proxy_service_mojo.h"
 #include "net/proxy_resolution/pac_file_fetcher_impl.h"
 #include "net/proxy_resolution/proxy_config_service.h"
+#include "services/network/network_context.h"
 
-namespace content {
+#if !defined(OS_IOS)
+#include "services/network/proxy_service_mojo.h"
+#endif
+
+namespace network {
 
 URLRequestContextBuilderMojo::URLRequestContextBuilderMojo()
     : dhcp_fetcher_factory_(new net::DhcpProxyScriptFetcherFactory()) {}
@@ -30,7 +33,7 @@
 }
 
 URLRequestContextOwner URLRequestContextBuilderMojo::Create(
-    network::mojom::NetworkContextParams* params,
+    mojom::NetworkContextParams* params,
     bool quic_disabled,
     net::NetLog* net_log) {
   return NetworkContext::ApplyContextParamsToBuilder(this, params,
@@ -47,20 +50,23 @@
   DCHECK(url_request_context);
   DCHECK(host_resolver);
 
-  if (!mojo_proxy_resolver_factory_) {
-    return net::URLRequestContextBuilder::CreateProxyService(
-        std::move(proxy_config_service), url_request_context, host_resolver,
-        network_delegate, net_log);
+#if !defined(OS_IOS)
+  if (mojo_proxy_resolver_factory_) {
+    std::unique_ptr<net::DhcpProxyScriptFetcher> dhcp_proxy_script_fetcher =
+        dhcp_fetcher_factory_->Create(url_request_context);
+    std::unique_ptr<net::ProxyScriptFetcher> proxy_script_fetcher =
+        std::make_unique<net::ProxyScriptFetcherImpl>(url_request_context);
+    return CreateProxyServiceUsingMojoFactory(
+        std::move(mojo_proxy_resolver_factory_),
+        std::move(proxy_config_service), std::move(proxy_script_fetcher),
+        std::move(dhcp_proxy_script_fetcher), host_resolver, net_log,
+        network_delegate);
   }
+#endif
 
-  std::unique_ptr<net::DhcpProxyScriptFetcher> dhcp_proxy_script_fetcher =
-      dhcp_fetcher_factory_->Create(url_request_context);
-  std::unique_ptr<net::ProxyScriptFetcher> proxy_script_fetcher =
-      std::make_unique<net::ProxyScriptFetcherImpl>(url_request_context);
-  return CreateProxyServiceUsingMojoFactory(
-      std::move(mojo_proxy_resolver_factory_), std::move(proxy_config_service),
-      std::move(proxy_script_fetcher), std::move(dhcp_proxy_script_fetcher),
-      host_resolver, net_log, network_delegate);
+  return net::URLRequestContextBuilder::CreateProxyService(
+      std::move(proxy_config_service), url_request_context, host_resolver,
+      network_delegate, net_log);
 }
 
-}  // namespace content
+}  // namespace network
diff --git a/storage/browser/blob/blob_url_loader.cc b/storage/browser/blob/blob_url_loader.cc
index 9120e01..44d48897 100644
--- a/storage/browser/blob/blob_url_loader.cc
+++ b/storage/browser/blob/blob_url_loader.cc
@@ -174,7 +174,7 @@
   response.mime_type = mime_type;
 
   // TODO(jam): some of this code can be shared with
-  // content/network/url_loader.h
+  // services/network/url_loader.h
   client_->OnReceiveResponse(response, base::nullopt, nullptr);
   sent_headers_ = true;
 
diff --git a/testing/buildbot/chromium.perf.fyi.json b/testing/buildbot/chromium.perf.fyi.json
index 0e51f4c..b845d08 100644
--- a/testing/buildbot/chromium.perf.fyi.json
+++ b/testing/buildbot/chromium.perf.fyi.json
@@ -464,21 +464,21 @@
     "isolated_scripts": [
       {
         "args": [
-          "smoothness.maps",
+          "dummy_benchmark.histogram_benchmark_1",
           "-v",
           "--output-format=histograms",
           "--output-format=json-test-results",
           "--xvfb",
-          "--browser=release"
+          "--browser=reference"
         ],
-        "isolate_name": "telemetry_perf_tests",
+        "isolate_name": "telemetry_perf_tests_experimental",
         "merge": {
           "args": [],
           "script": "//tools/perf/upload_perf_results.py"
         },
-        "name": "benchmark1 smoothness.maps",
+        "name": "benchmark1 dummy_benchmark.histogram_benchmark_1",
         "override_compile_targets": [
-          "telemetry_perf_tests"
+          "telemetry_perf_tests_experimental"
         ],
         "swarming": {
           "can_use_on_swarming_builders": true,
@@ -496,21 +496,21 @@
       },
       {
         "args": [
-          "blink_perf.css",
+          "dummy_benchmark.stable_benchmark_1",
           "-v",
           "--output-format=histograms",
           "--output-format=json-test-results",
           "--xvfb",
-          "--browser=release"
+          "--browser=reference"
         ],
-        "isolate_name": "telemetry_perf_tests",
+        "isolate_name": "telemetry_perf_tests_experimental",
         "merge": {
           "args": [],
           "script": "//tools/perf/upload_perf_results.py"
         },
-        "name": "benchmark2 blink_perf.css",
+        "name": "benchmark2 dummy_benchmark.stable_benchmark_1",
         "override_compile_targets": [
-          "telemetry_perf_tests"
+          "telemetry_perf_tests_experimental"
         ],
         "swarming": {
           "can_use_on_swarming_builders": true,
@@ -532,7 +532,7 @@
           "--output-format=histograms",
           "--output-format=json-test-results",
           "--xvfb",
-          "--browser=release"
+          "--browser=reference"
         ],
         "isolate_name": "performance_test_suite",
         "merge": {
diff --git a/testing/buildbot/filters/mojo.fyi.network_browser_tests.filter b/testing/buildbot/filters/mojo.fyi.network_browser_tests.filter
index cb0fa18d..b0a7147 100644
--- a/testing/buildbot/filters/mojo.fyi.network_browser_tests.filter
+++ b/testing/buildbot/filters/mojo.fyi.network_browser_tests.filter
@@ -698,3 +698,36 @@
 -DeclarativeContentApiTest.EnabledForSpanningIncognito
 -SetIconAPITest.Overview
 
+# Temporarily after r532742 since in component build the test NetworkContext
+# method is in a different module than src/chrome and isn't exported.
+-SSLUIDynamicInterstitialTest.MismatchHash

+-SSLUIMITMSoftwareEnabledTest.EnterpriseManaged/1

+-SSLUIMITMSoftwareEnabledTest.EnterpriseManaged/0

+-SSLUIMITMSoftwareEnabledTest.NotEnterpriseManaged/0

+-SSLUIMITMSoftwareEnabledTest.NotEnterpriseManaged/1

+-SuperfishSSLUITest.SuperfishRecorded/1

+-SuperfishSSLUITest.SuperfishRecorded/0

+-SuperfishSSLUITest.NoSuperfishRecorded/0

+-SuperfishSSLUITest.NoSuperfishRecorded/1

+-SSLUIDynamicInterstitialTest.MismatchCertError

+-SecurityStateTabHelperTest.MixedContentWithSHA1Cert

+-SuperfishSSLUITest.SuperfishInterstitialDisabled/1

+-SuperfishSSLUITest.SuperfishInterstitialDisabled/0

+-SecurityStateTabHelperTest.BrokenHTTPS

+-SSLUIMITMSoftwareEnabledTest.EnabledWithFinch/0

+-SSLUIMITMSoftwareEnabledTest.EnabledWithFinch/1

+-CommonNameMismatchBrowserTest.ShouldShowWWWSubdomainMismatchInterstitial/0

+-CommonNameMismatchBrowserTest.ShouldShowWWWSubdomainMismatchInterstitial/1

+-CertVerifierBrowserTest.MockCertVerifierSmokeTest

+-CommonNameMismatchBrowserTest.CheckWWWSubdomainMismatchInverse/0

+-CommonNameMismatchBrowserTest.CheckWWWSubdomainMismatchInverse/1

+-SecurityStateTabHelperTest.SHA1CertificateWarning

+-SecurityStateTabHelperTest.SHA1CertificateBlocked

+-SuperfishSSLUITest.SuperfishInterstitial/1

+-SuperfishSSLUITest.SuperfishInterstitial/0

+-SSLUIDynamicInterstitialTest.MatchUnknownCertError

+-SSLUIDynamicInterstitialTest.Match

+-SSLUIMITMSoftwareEnabledTest.OverridableError_NoMITMSoftwareInterstitial/1

+-SSLUIMITMSoftwareEnabledTest.OverridableError_NoMITMSoftwareInterstitial/0

+-SecurityStateTabHelperTest.PasswordSecurityLevelNotDowngradedOnHttps

+-SecurityStateTabHelperTest.UMALogsVisitsAfterWarning

diff --git a/testing/buildbot/gn_isolate_map.pyl b/testing/buildbot/gn_isolate_map.pyl
index 1866b9c..2016a77d5 100644
--- a/testing/buildbot/gn_isolate_map.pyl
+++ b/testing/buildbot/gn_isolate_map.pyl
@@ -988,6 +988,14 @@
       "../../tools/perf/run_benchmark",
     ],
   },
+  "telemetry_perf_tests_experimental": {
+    "label": "//chrome/test:telemetry_perf_tests_experimental",
+    "type": "script",
+    "script": "//testing/scripts/run_telemetry_benchmark_as_googletest.py",
+    "args": [
+      "../../tools/perf/run_benchmark",
+    ],
+  },
   "performance_test_suite": {
     "label": "//chrome/test:performance_test_suite",
     "type": "script",
diff --git a/testing/variations/fieldtrial_testing_config.json b/testing/variations/fieldtrial_testing_config.json
index e3107037..55f50fc 100644
--- a/testing/variations/fieldtrial_testing_config.json
+++ b/testing/variations/fieldtrial_testing_config.json
@@ -4237,24 +4237,6 @@
             ]
         }
     ],
-    "YieldBetweenContentScriptRuns": [
-        {
-            "platforms": [
-                "chromeos",
-                "linux",
-                "mac",
-                "win"
-            ],
-            "experiments": [
-                {
-                    "name": "Enabled",
-                    "enable_features": [
-                        "YieldBetweenContentScriptRuns"
-                    ]
-                }
-            ]
-        }
-    ],
     "use-new-media-cache": [
         {
             "platforms": [
diff --git a/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG b/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG
index c8bbf9a..88dcafd 100644
--- a/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG
+++ b/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG
@@ -96,6 +96,7 @@
 crbug.com/591099 accessibility/inline-text-changes.html [ Failure ]
 crbug.com/591099 accessibility/inline-text-input.html [ Failure ]
 crbug.com/591099 accessibility/inline-text-word-boundaries.html [ Failure ]
+crbug.com/591099 accessibility/input-type-password-value-and-selection.html [ Pass Timeout ]
 crbug.com/591099 accessibility/input-type-range-aria-value.html [ Failure ]
 crbug.com/714962 accessibility/label-for-control-hittest.html [ Failure ]
 crbug.com/714962 accessibility/legend.html [ Failure ]
@@ -241,6 +242,7 @@
 crbug.com/591099 compositing/overflow/overflow-scroll-with-local-image-background.html [ Failure ]
 crbug.com/591099 compositing/overflow/overflow-scroll.html [ Failure ]
 crbug.com/591099 compositing/overflow/parent-overflow.html [ Failure ]
+crbug.com/591099 compositing/overflow/reflected-overlay-scrollbars-should-respect-ancestor-clip.html [ Pass Timeout ]
 crbug.com/714962 compositing/overflow/rtl-overflow.html [ Failure ]
 crbug.com/591099 compositing/overflow/scaled-mask.html [ Failure ]
 crbug.com/591099 compositing/overflow/scroll-ancestor-update.html [ Failure ]
@@ -251,14 +253,15 @@
 crbug.com/591099 compositing/overflow/textarea-scroll-touch.html [ Failure ]
 crbug.com/591099 compositing/overflow/universal-accelerated-overflow-scroll.html [ Pass Timeout ]
 crbug.com/591099 compositing/overflow/update-widget-positions-on-nested-frames-and-scrollers.html [ Failure ]
-crbug.com/591099 compositing/reflections/compositing-change-inside-reflection.html [ Failure ]
+crbug.com/591099 compositing/reflections/compositing-change-inside-reflection.html [ Failure Timeout ]
+crbug.com/591099 compositing/reflections/deeply-nested-reflections.html [ Pass Timeout ]
 crbug.com/591099 compositing/reflections/nested-reflection-mask-change.html [ Failure ]
 crbug.com/591099 compositing/reflections/nested-reflection-transformed.html [ Failure ]
 crbug.com/591099 compositing/reflections/nested-reflection-transformed2.html [ Failure ]
 crbug.com/591099 compositing/reflections/reflection-in-composited.html [ Failure ]
 crbug.com/591099 compositing/reflections/remove-add-reflection.html [ Failure ]
 crbug.com/591099 compositing/reflections/simple-composited-reflections.html [ Failure ]
-crbug.com/591099 compositing/reflections/transform-inside-reflection.html [ Failure ]
+crbug.com/591099 compositing/reflections/transform-inside-reflection.html [ Failure Timeout ]
 crbug.com/591099 compositing/render-surface-alpha-blending.html [ Failure ]
 crbug.com/591099 compositing/rtl/rtl-absolute.html [ Failure ]
 crbug.com/591099 compositing/rtl/rtl-and-writing-mode-scrolling.html [ Failure ]
@@ -661,10 +664,10 @@
 crbug.com/591099 css3/filters/effect-brightness-clamping.html [ Failure ]
 crbug.com/591099 css3/filters/effect-brightness-hw.html [ Failure ]
 crbug.com/591099 css3/filters/effect-brightness.html [ Failure ]
-crbug.com/591099 css3/filters/effect-combined-hw.html [ Failure ]
+crbug.com/591099 css3/filters/effect-combined-hw.html [ Failure Timeout ]
 crbug.com/591099 css3/filters/effect-combined.html [ Failure ]
 crbug.com/591099 css3/filters/effect-contrast.html [ Failure ]
-crbug.com/591099 css3/filters/effect-drop-shadow-hw.html [ Failure ]
+crbug.com/591099 css3/filters/effect-drop-shadow-hw.html [ Failure Timeout ]
 crbug.com/591099 css3/filters/effect-drop-shadow.html [ Failure ]
 crbug.com/591099 css3/filters/effect-grayscale-hw.html [ Failure ]
 crbug.com/591099 css3/filters/effect-grayscale.html [ Failure ]
@@ -954,7 +957,7 @@
 crbug.com/591099 editing/execCommand/insertNewLineInQuotedContent-outside-quote.html [ Failure ]
 crbug.com/591099 editing/execCommand/outdent-multiparagraph-list.html [ Failure ]
 crbug.com/591099 editing/execCommand/query-command-state.html [ Timeout ]
-crbug.com/591099 editing/execCommand/query-format-block.html [ Pass Timeout ]
+crbug.com/591099 editing/execCommand/query-format-block.html [ Timeout ]
 crbug.com/591099 editing/execCommand/queryCommandState-02.html [ Failure ]
 crbug.com/591099 editing/execCommand/remove-list-from-range-selection.html [ Failure ]
 crbug.com/591099 editing/execCommand/replaceSelectorCommand-crash.html [ Crash ]
@@ -968,7 +971,7 @@
 crbug.com/591099 editing/inserting/4875189-2.html [ Failure ]
 crbug.com/591099 editing/inserting/4959067.html [ Failure ]
 crbug.com/591099 editing/inserting/4960120-1.html [ Failure ]
-crbug.com/591099 editing/inserting/4960120-2.html [ Failure ]
+crbug.com/591099 editing/inserting/4960120-2.html [ Failure Pass ]
 crbug.com/591099 editing/inserting/5002441.html [ Failure ]
 crbug.com/591099 editing/inserting/5058163-1.html [ Failure ]
 crbug.com/591099 editing/inserting/5058163-2.html [ Failure ]
@@ -1107,7 +1110,7 @@
 crbug.com/591099 editing/selection/mixed-editability-5.html [ Failure ]
 crbug.com/591099 editing/selection/mixed-editability-6.html [ Failure ]
 crbug.com/591099 editing/selection/mixed-editability-7.html [ Failure ]
-crbug.com/591099 editing/selection/mixed-editability-8.html [ Failure ]
+crbug.com/591099 editing/selection/mixed-editability-8.html [ Failure Pass ]
 crbug.com/591099 editing/selection/mixed-editability-9.html [ Failure ]
 crbug.com/591099 editing/selection/modify_extend/extend_by_character.html [ Failure ]
 crbug.com/714962 editing/selection/modify_extend/extend_forward_line_crash.html [ Failure ]
@@ -1536,7 +1539,7 @@
 crbug.com/591099 external/wpt/css/css-shapes/spec-examples/shape-outside-018.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-shapes/spec-examples/shape-outside-019.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-style-attr/style-attr-urls-001.xht [ Failure ]
-crbug.com/591099 external/wpt/css/css-style-attr/style-attr-urls-002.xht [ Failure Pass ]
+crbug.com/591099 external/wpt/css/css-style-attr/style-attr-urls-002.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-tables/height-distribution/percentage-sizing-of-table-cell-children.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-tables/html5-table-formatting-fixed-layout-1.html [ Crash ]
 crbug.com/591099 external/wpt/css/css-tables/table-model-fixup-2.html [ Failure ]
@@ -1608,12 +1611,12 @@
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-007.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-009.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-011.xht [ Failure ]
-crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-013.xht [ Failure Pass ]
+crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-013.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-015.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-017.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-019.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-021.xht [ Failure ]
-crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-023.xht [ Failure ]
+crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-023.xht [ Failure Pass ]
 crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-025.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-027.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-029.xht [ Failure ]
@@ -1621,7 +1624,7 @@
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-033.xht [ Failure Pass ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-035.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-037.xht [ Failure Pass ]
-crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-039.xht [ Failure Pass ]
+crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-039.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-041.xht [ Failure Pass ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-043.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-045.xht [ Failure ]
@@ -1635,8 +1638,8 @@
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-061.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-063.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-065.xht [ Failure ]
-crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-067.xht [ Failure Pass ]
-crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-069.xht [ Failure Pass ]
+crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-067.xht [ Failure ]
+crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-069.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-071.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-073.xht [ Failure Pass ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-075.xht [ Failure ]
@@ -1646,7 +1649,7 @@
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-083.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-085.xht [ Failure Pass ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-087.xht [ Failure ]
-crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-089.xht [ Failure Pass ]
+crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-089.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-091.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-093.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-095.xht [ Failure Pass ]
@@ -1654,9 +1657,9 @@
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-103.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-105.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-107.xht [ Failure ]
-crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-109.xht [ Failure Pass ]
+crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-109.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-111.xht [ Failure ]
-crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-113.xht [ Failure ]
+crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-113.xht [ Failure Pass ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-115.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-117.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-119.xht [ Failure Pass ]
@@ -1666,29 +1669,29 @@
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-127.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-129.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-131.xht [ Failure ]
-crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-133.xht [ Failure Pass ]
-crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-135.xht [ Failure ]
-crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-137.xht [ Failure ]
+crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-133.xht [ Failure ]
+crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-135.xht [ Failure Pass ]
+crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-137.xht [ Failure Pass ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-139.xht [ Failure Pass ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-141.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-143.xht [ Failure Pass ]
-crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-145.xht [ Failure Pass ]
+crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-145.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-147.xht [ Failure Pass ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-149.xht [ Failure Pass ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-151.xht [ Failure Pass ]
-crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-153.xht [ Failure ]
+crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-153.xht [ Failure Pass ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-155.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-157.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-159.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-161.xht [ Failure Pass ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-163.xht [ Failure ]
-crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-165.xht [ Failure Pass ]
+crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-165.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-167.xht [ Failure Pass ]
 crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-169.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-171.xht [ Failure ]
-crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-173.xht [ Failure Pass ]
-crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-175.xht [ Failure Pass ]
-crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-177.xht [ Failure ]
+crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-173.xht [ Failure ]
+crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-175.xht [ Failure ]
+crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-177.xht [ Failure Pass ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-179.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-181.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-183.xht [ Failure ]
@@ -1702,16 +1705,16 @@
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-199.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-201.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-203.xht [ Failure ]
-crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-205.xht [ Failure Pass ]
+crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-205.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-207.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-209.xht [ Failure ]
-crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-211.xht [ Failure ]
+crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-211.xht [ Failure Pass ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-213.xht [ Failure Pass ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-215.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-217.xht [ Failure Pass ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-219.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-221.xht [ Failure ]
-crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-223.xht [ Failure Pass ]
+crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-223.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-225.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-227.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vlr-229.xht [ Failure Pass ]
@@ -1722,13 +1725,13 @@
 crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-010.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-012.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-014.xht [ Failure ]
-crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-016.xht [ Failure ]
+crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-016.xht [ Failure Pass ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-018.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-020.xht [ Failure ]
-crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-022.xht [ Failure Pass ]
+crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-022.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-024.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-026.xht [ Failure ]
-crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-028.xht [ Failure ]
+crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-028.xht [ Failure Pass ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-030.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-032.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-034.xht [ Failure ]
@@ -1748,7 +1751,7 @@
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-062.xht [ Failure Pass ]
 crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-064.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-066.xht [ Failure ]
-crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-068.xht [ Failure ]
+crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-068.xht [ Failure Pass ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-070.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-072.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-074.xht [ Failure ]
@@ -1768,7 +1771,7 @@
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-106.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-108.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-110.xht [ Failure ]
-crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-112.xht [ Failure ]
+crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-112.xht [ Failure Pass ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-114.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-116.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-118.xht [ Failure ]
@@ -1800,14 +1803,14 @@
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-170.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-172.xht [ Failure Pass ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-174.xht [ Failure ]
-crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-176.xht [ Failure ]
+crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-176.xht [ Failure Pass ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-178.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-180.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-182.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-184.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-186.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-188.xht [ Failure ]
-crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-190.xht [ Failure Pass ]
+crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-190.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-192.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-194.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/abs-pos-non-replaced-vrl-196.xht [ Failure ]
@@ -1853,7 +1856,7 @@
 crbug.com/591099 external/wpt/css/css-writing-modes/float-contiguous-vrl-006.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/float-contiguous-vrl-008.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/float-shrink-to-fit-vrl-008.xht [ Failure ]
-crbug.com/714962 external/wpt/css/css-writing-modes/float-vlr-005.xht [ Failure Pass ]
+crbug.com/714962 external/wpt/css/css-writing-modes/float-vlr-005.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/float-vlr-007.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/float-vlr-013.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/float-vrl-004.xht [ Failure ]
@@ -1931,20 +1934,20 @@
 crbug.com/714962 external/wpt/css/css-writing-modes/text-align-vlr-019.xht [ Failure Pass ]
 crbug.com/714962 external/wpt/css/css-writing-modes/text-align-vrl-002.xht [ Failure Pass ]
 crbug.com/714962 external/wpt/css/css-writing-modes/text-align-vrl-004.xht [ Failure Pass ]
-crbug.com/714962 external/wpt/css/css-writing-modes/text-align-vrl-006.xht [ Failure Pass ]
+crbug.com/714962 external/wpt/css/css-writing-modes/text-align-vrl-006.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/text-align-vrl-008.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/text-align-vrl-010.xht [ Failure Pass ]
 crbug.com/714962 external/wpt/css/css-writing-modes/text-align-vrl-012.xht [ Failure ]
-crbug.com/714962 external/wpt/css/css-writing-modes/text-align-vrl-014.xht [ Failure Pass ]
-crbug.com/714962 external/wpt/css/css-writing-modes/text-align-vrl-016.xht [ Failure Pass ]
-crbug.com/714962 external/wpt/css/css-writing-modes/text-align-vrl-018.xht [ Failure Pass ]
+crbug.com/714962 external/wpt/css/css-writing-modes/text-align-vrl-014.xht [ Failure ]
+crbug.com/714962 external/wpt/css/css-writing-modes/text-align-vrl-016.xht [ Failure ]
+crbug.com/714962 external/wpt/css/css-writing-modes/text-align-vrl-018.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/text-baseline-vlr-007.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/text-baseline-vrl-006.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/text-combine-upright-decorations-001.html [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/text-combine-upright-layout-rules-001.html [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/text-indent-vlr-003.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/text-indent-vlr-005.xht [ Failure ]
-crbug.com/714962 external/wpt/css/css-writing-modes/text-indent-vlr-011.xht [ Failure Pass ]
+crbug.com/714962 external/wpt/css/css-writing-modes/text-indent-vlr-011.xht [ Failure ]
 crbug.com/714962 external/wpt/css/css-writing-modes/text-indent-vlr-013.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/text-indent-vrl-002.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes/text-indent-vrl-004.xht [ Failure ]
@@ -1992,7 +1995,7 @@
 crbug.com/714962 external/wpt/css/cssom/medialist-dynamic-001.html [ Failure ]
 crbug.com/626703 external/wpt/css/cssom/stylesheet-replacedata-dynamic.html [ Failure ]
 crbug.com/591099 external/wpt/css/geometry/interfaces.html [ Timeout ]
-crbug.com/591099 external/wpt/css/geometry/interfaces.worker.html [ Timeout ]
+crbug.com/591099 external/wpt/css/geometry/interfaces.worker.html [ Pass Timeout ]
 crbug.com/714962 external/wpt/css/selectors/focus-within-001.html [ Failure ]
 crbug.com/591099 external/wpt/css/selectors/focus-within-004.html [ Failure ]
 crbug.com/714962 external/wpt/css/selectors/focus-within-007.html [ Failure ]
@@ -2025,7 +2028,7 @@
 crbug.com/591099 external/wpt/dom/ranges/Range-mutations-dataChange.html [ Timeout ]
 crbug.com/591099 external/wpt/dom/ranges/Range-set.html [ Timeout ]
 crbug.com/591099 external/wpt/dom/ranges/Range-surroundContents.html [ Timeout ]
-crbug.com/591099 external/wpt/domxpath/xml_xpath_runner.html [ Timeout ]
+crbug.com/591099 external/wpt/domxpath/xml_xpath_runner.html [ Pass Timeout ]
 crbug.com/591099 external/wpt/editing/run/backcolor.html [ Pass Timeout ]
 crbug.com/591099 external/wpt/editing/run/bold.html [ Timeout ]
 crbug.com/591099 external/wpt/editing/run/fontname.html [ Timeout ]
@@ -2194,6 +2197,7 @@
 crbug.com/591099 external/wpt/html/syntax/parsing/html5lib_isindex.html?run_type=uri [ Pass ]
 crbug.com/591099 external/wpt/html/syntax/parsing/html5lib_isindex.html?run_type=write [ Pass ]
 crbug.com/591099 external/wpt/html/syntax/parsing/html5lib_isindex.html?run_type=write_single [ Pass ]
+crbug.com/591099 external/wpt/html/syntax/parsing/html5lib_template.html?run_type=uri [ Pass Timeout ]
 crbug.com/591099 external/wpt/html/syntax/parsing/html5lib_tests19.html?run_type=uri [ Pass ]
 crbug.com/591099 external/wpt/html/syntax/parsing/html5lib_tests19.html?run_type=write [ Pass ]
 crbug.com/591099 external/wpt/html/syntax/parsing/html5lib_tests19.html?run_type=write_single [ Pass ]
@@ -2216,6 +2220,7 @@
 crbug.com/591099 external/wpt/mediacapture-streams/MediaStreamTrack-getSettings.https.html [ Pass ]
 crbug.com/591099 external/wpt/mimesniff/mime-types/parsing.any.html [ Timeout ]
 crbug.com/591099 external/wpt/mimesniff/mime-types/parsing.any.worker.html [ Timeout ]
+crbug.com/591099 external/wpt/offscreen-canvas/compositing/2d.composite.transparent.lighter.worker.html [ Pass Timeout ]
 crbug.com/591099 external/wpt/offscreen-canvas/fill-and-stroke-styles/2d.pattern.basic.nocontext.worker.html [ Crash ]
 crbug.com/591099 external/wpt/offscreen-canvas/the-offscreen-canvas/offscreencanvas.getcontext.worker.html [ Pass ]
 crbug.com/591099 external/wpt/payment-request/payment-allowed-by-feature-policy.https.sub.html [ Pass ]
@@ -2526,7 +2531,7 @@
 crbug.com/591099 fast/box-shadow/scaled-box-shadow.html [ Failure ]
 crbug.com/591099 fast/box-shadow/spread.html [ Failure ]
 crbug.com/591099 fast/box-shadow/transform-fringing.html [ Failure ]
-crbug.com/591099 fast/box-sizing/replaced.html [ Failure ]
+crbug.com/591099 fast/box-sizing/replaced.html [ Failure Pass ]
 crbug.com/591099 fast/canvas-api/toDataURL-supportedTypes.html [ Failure ]
 crbug.com/714962 fast/canvas/canvas-css-clip-path.html [ Failure ]
 crbug.com/591099 fast/canvas/canvas-drawImage-animated-images.html [ Failure ]
@@ -3366,7 +3371,6 @@
 crbug.com/591099 fast/forms/file/file-input-direction.html [ Failure ]
 crbug.com/591099 fast/forms/file/file-input-disabled.html [ Failure ]
 crbug.com/714962 fast/forms/file/file-input-empty-validation.html [ Timeout ]
-crbug.com/591099 fast/forms/file/file-input-pressed-state.html [ Failure Pass ]
 crbug.com/714962 fast/forms/file/file-input-reset-validation.html [ Timeout ]
 crbug.com/714962 fast/forms/file/file-input-reset.html [ Failure ]
 crbug.com/591099 fast/forms/file/file-input-webkitdirectory-click.html [ Failure ]
@@ -4712,7 +4716,7 @@
 crbug.com/591099 fast/table/percent-height-content-in-fixed-height-border-box-sized-cell-with-collapsed-border.html [ Failure ]
 crbug.com/591099 fast/table/percent-height-content-in-fixed-height-content-box-sized-cell.html [ Failure ]
 crbug.com/591099 fast/table/percent-height-overflow-auto-content-in-cell.html [ Failure Pass ]
-crbug.com/591099 fast/table/percent-height-overflow-scroll-content-in-cell.html [ Failure Pass ]
+crbug.com/591099 fast/table/percent-height-overflow-scroll-content-in-cell.html [ Failure ]
 crbug.com/591099 fast/table/percent-widths-stretch-vertical.html [ Failure ]
 crbug.com/591099 fast/table/recalc-section-first-body-crash-main.html [ Failure ]
 crbug.com/591099 fast/table/row-in-inline-block.html [ Failure ]
@@ -4928,6 +4932,8 @@
 crbug.com/591099 fast/tokenizer/missing-style-end-tag-2.html [ Failure ]
 crbug.com/591099 fast/tokenizer/nested-cached-scripts-and-stylesheet.html [ Failure ]
 crbug.com/591099 fast/tokenizer/script_extra_close.html [ Failure ]
+crbug.com/591099 fast/webgl/texImage-imageBitmap-from-canvas-resize.html [ Pass Timeout ]
+crbug.com/591099 fast/webgl/webgl-composite-modes.html [ Pass Timeout ]
 crbug.com/591099 fast/workers/shared-worker-location.html [ Failure ]
 crbug.com/591099 fast/workers/worker-location.html [ Failure ]
 crbug.com/591099 fast/writing-mode/Kusa-Makura-background-canvas.html [ Failure ]
@@ -5095,7 +5101,7 @@
 crbug.com/591099 fullscreen/model/fully-exit-fullscreen-nested-iframe.html [ Crash ]
 crbug.com/591099 fullscreen/non-ancestor-iframe.html [ Crash ]
 crbug.com/591099 hittesting/border-hittest-inlineFlowBox.html [ Failure ]
-crbug.com/714962 hittesting/border-hittest-with-image-fallback.html [ Failure Pass ]
+crbug.com/714962 hittesting/border-hittest-with-image-fallback.html [ Failure ]
 crbug.com/714962 hittesting/culled-inline.html [ Failure ]
 crbug.com/591099 hittesting/image-with-border-radius.html [ Failure ]
 crbug.com/714962 hittesting/image-with-clip-path.html [ Failure ]
@@ -5212,7 +5218,8 @@
 crbug.com/714962 http/tests/devtools/editor/text-editor-enter-behaviour.js [ Timeout ]
 crbug.com/714962 http/tests/devtools/editor/text-editor-formatter.js [ Timeout ]
 crbug.com/714962 http/tests/devtools/editor/text-editor-indent-autodetection.js [ Pass Timeout ]
-crbug.com/714962 http/tests/devtools/editor/text-editor-reveal-line.js [ Pass Timeout ]
+crbug.com/714962 http/tests/devtools/editor/text-editor-reveal-line.js [ Timeout ]
+crbug.com/591099 http/tests/devtools/editor/text-editor-word-jumps.js [ Timeout ]
 crbug.com/714962 http/tests/devtools/elements/breadcrumb-updates.js [ Crash ]
 crbug.com/714962 http/tests/devtools/elements/css-rule-hover-highlights-selectors.js [ Crash Pass ]
 crbug.com/714962 http/tests/devtools/elements/edit/edit-dom-actions-1.js [ Crash ]
@@ -5260,7 +5267,7 @@
 crbug.com/714962 http/tests/devtools/elements/styles-1/add-new-rule-with-style-after-body.js [ Crash Pass ]
 crbug.com/714962 http/tests/devtools/elements/styles-1/edit-value-url-with-color.js [ Crash ]
 crbug.com/714962 http/tests/devtools/elements/styles-2/force-pseudo-state.js [ Crash ]
-crbug.com/591099 http/tests/devtools/elements/styles-2/inject-stylesheet.js [ Crash ]
+crbug.com/591099 http/tests/devtools/elements/styles-2/inject-stylesheet.js [ Crash Pass ]
 crbug.com/714962 http/tests/devtools/elements/styles-2/paste-property.js [ Crash Pass ]
 crbug.com/714962 http/tests/devtools/elements/styles-2/pseudo-elements.js [ Crash ]
 crbug.com/591099 http/tests/devtools/elements/styles-3/shadow-dom-rules.js [ Crash Pass ]
@@ -5269,7 +5276,7 @@
 crbug.com/714962 http/tests/devtools/elements/styles-3/styles-add-invalid-property.js [ Crash Pass ]
 crbug.com/714962 http/tests/devtools/elements/styles-3/styles-add-new-rule-colon.js [ Crash ]
 crbug.com/591099 http/tests/devtools/elements/styles-3/styles-add-new-rule-tab.js [ Crash ]
-crbug.com/591099 http/tests/devtools/elements/styles-3/styles-add-new-rule.js [ Crash ]
+crbug.com/591099 http/tests/devtools/elements/styles-3/styles-add-new-rule.js [ Crash Timeout ]
 crbug.com/591099 http/tests/devtools/elements/styles-3/styles-cancel-editing.js [ Crash Pass ]
 crbug.com/591099 http/tests/devtools/elements/styles-3/styles-change-node-while-editing.js [ Crash Pass ]
 crbug.com/714962 http/tests/devtools/elements/styles-3/styles-commit-editing.js [ Crash Pass ]
@@ -5291,6 +5298,7 @@
 crbug.com/714962 http/tests/devtools/jump-to-previous-editing-location.js [ Failure ]
 crbug.com/714962 http/tests/devtools/layers/layer-canvas-log.js [ Failure ]
 crbug.com/591099 http/tests/devtools/network/network-datareceived.js [ Failure ]
+crbug.com/591099 http/tests/devtools/oopif/oopif-elements-navigate-in.js [ Crash Pass ]
 crbug.com/591099 http/tests/devtools/oopif/oopif-elements-navigate-out.js [ Crash ]
 crbug.com/591099 http/tests/devtools/oopif/oopif-elements-nesting.js [ Crash Pass ]
 crbug.com/714962 http/tests/devtools/service-workers/service-workers-view.js [ Failure ]
@@ -6298,7 +6306,7 @@
 crbug.com/591099 paint/pagination/composited-paginated-inline.html [ Failure ]
 crbug.com/591099 paint/pagination/pagination-change-clip-crash.html [ Failure ]
 crbug.com/591099 paint/printing/print-box-shadow.html [ Failure ]
-crbug.com/591099 paint/selection/drag-caret.html [ Crash ]
+crbug.com/591099 paint/selection/drag-caret.html [ Crash Pass ]
 crbug.com/714962 paint/selection/text-selection-drag.html [ Failure ]
 crbug.com/591099 paint/selection/text-selection-inline-block-rtl.html [ Failure ]
 crbug.com/591099 paint/selection/text-selection-inline-block.html [ Failure ]
@@ -6393,7 +6401,7 @@
 crbug.com/714962 shadow-dom/slotted-pseudo-element-dynamic-attribute-change.html [ Failure ]
 crbug.com/591099 shapedetection/detection-HTMLVideoElement.html [ Pass ]
 crbug.com/714962 storage/indexeddb/blob-basics-metadata.html [ Failure ]
-crbug.com/591099 storage/indexeddb/cursor-advance.html [ Pass Timeout ]
+crbug.com/591099 storage/indexeddb/cursor-advance.html [ Timeout ]
 crbug.com/591099 storage/indexeddb/cursor-continue-validity.html [ Timeout ]
 crbug.com/591099 storage/indexeddb/cursor-key-order.html [ Timeout ]
 crbug.com/591099 storage/indexeddb/cursor-update.html [ Pass Timeout ]
@@ -6633,6 +6641,7 @@
 crbug.com/714962 svg/custom/width-full-percentage.svg [ Failure ]
 crbug.com/714962 svg/dom/SVGStringList-basics.xhtml [ Failure ]
 crbug.com/591099 svg/dom/svg-root-lengths.html [ Failure ]
+crbug.com/591099 svg/dom/svgangle-units.html [ Timeout ]
 crbug.com/591099 svg/dom/tooltip-title-inline-svg.html [ Failure ]
 crbug.com/714962 svg/dynamic-updates/SVG-dynamic-css-transform.html [ Failure ]
 crbug.com/714962 svg/dynamic-updates/SVGMaskElement-dom-height-attr.html [ Failure ]
@@ -7057,6 +7066,7 @@
 crbug.com/591099 virtual/gpu-rasterization/images/image-map-zoom.html [ Failure ]
 crbug.com/591099 virtual/gpu-rasterization/images/image-zoom-to-25.html [ Failure ]
 crbug.com/591099 virtual/gpu-rasterization/images/imagemap-focus-ring-outline-color-not-inherited-from-map.html [ Failure ]
+crbug.com/591099 virtual/gpu-rasterization/images/imagemap-focus-ring-with-paint-root-offset.html [ Pass Timeout ]
 crbug.com/591099 virtual/gpu-rasterization/images/motion-jpeg-single-frame.html [ Failure ]
 crbug.com/591099 virtual/gpu-rasterization/images/pdf-as-background.html [ Failure ]
 crbug.com/591099 virtual/gpu-rasterization/images/pdf-as-tiled-background.html [ Failure ]
@@ -7071,16 +7081,18 @@
 crbug.com/591099 virtual/gpu-rasterization/images/rendering-broken-16px-images.html [ Failure ]
 crbug.com/591099 virtual/gpu-rasterization/images/rendering-broken-1px-images.html [ Failure ]
 crbug.com/591099 virtual/gpu-rasterization/images/rendering-broken-block-flow-images.html [ Failure ]
-crbug.com/591099 virtual/gpu-rasterization/images/rendering-broken-images-empty-alt.html [ Failure ]
+crbug.com/591099 virtual/gpu-rasterization/images/rendering-broken-images-empty-alt.html [ Failure Timeout ]
 crbug.com/591099 virtual/gpu-rasterization/images/rendering-broken-images.html [ Failure ]
 crbug.com/591099 virtual/gpu-rasterization/images/webp-flip.html [ Failure ]
 crbug.com/591099 virtual/gpu/fast/canvas/canvas-createImageBitmap-colorClamping.html [ Pass ]
+crbug.com/591099 virtual/gpu/fast/canvas/canvas-createImageBitmap-recursive.html [ Pass Timeout ]
 crbug.com/714962 virtual/gpu/fast/canvas/canvas-css-clip-path.html [ Crash Failure ]
 crbug.com/591099 virtual/gpu/fast/canvas/canvas-drawImage-animated-images.html [ Failure ]
 crbug.com/591099 virtual/gpu/fast/canvas/canvas-drawImage-video-imageSmoothingEnabled.html [ Pass ]
-crbug.com/591099 virtual/gpu/fast/canvas/canvas-fillPath-shadow.html [ Timeout ]
+crbug.com/591099 virtual/gpu/fast/canvas/canvas-filter-units-em-liveness.html [ Pass Timeout ]
 crbug.com/591099 virtual/gpu/fast/canvas/canvas-imageSmoothingQuality.html [ Pass ]
 crbug.com/591099 virtual/gpu/fast/canvas/canvas-measure-bidi-text.html [ Failure ]
+crbug.com/591099 virtual/gpu/fast/canvas/canvas-strokePath-gradient-shadow.html [ Pass Timeout ]
 crbug.com/714962 virtual/gpu/fast/canvas/canvas-textMetrics-width.html [ Failure ]
 crbug.com/591099 virtual/gpu/fast/canvas/canvas-transforms-during-path.html [ Failure ]
 crbug.com/591099 virtual/gpu/fast/canvas/fill-stroke-clip-reset-path.html [ Failure ]
@@ -7274,8 +7286,6 @@
 crbug.com/591099 virtual/scroll_customization/fast/events/touch/compositor-touch-hit-rects-global.html [ Pass ]
 crbug.com/591099 virtual/scroll_customization/fast/events/touch/compositor-touch-hit-rects-transform-changed-nolayout.html [ Pass ]
 crbug.com/591099 virtual/scroll_customization/fast/events/touch/compositor-touch-hit-rects.html [ Failure ]
-crbug.com/591099 virtual/service-worker-script-streaming/ [ Skip ]
-crbug.com/591099 virtual/service-worker-script-streaming/external/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/registration-attribute.https.html [ Failure Pass ]
 crbug.com/591099 virtual/spv175/ [ Skip ]
 crbug.com/591099 virtual/spv2/compositing/framesets/composited-frame-alignment.html [ Failure ]
 crbug.com/591099 virtual/spv2/paint/invalidation/box/margin.html [ Failure Pass ]
diff --git a/third_party/WebKit/LayoutTests/FlagExpectations/site-per-process b/third_party/WebKit/LayoutTests/FlagExpectations/site-per-process
index 5e17ff9c..62f01064 100644
--- a/third_party/WebKit/LayoutTests/FlagExpectations/site-per-process
+++ b/third_party/WebKit/LayoutTests/FlagExpectations/site-per-process
@@ -4,7 +4,6 @@
 # https://crbug.com/803672: Test expects cross-origin XHR to work!?
 # https://crbug.com/736308: Test also disabled in LayoutTests/TestExpectations
 crbug.com/803672 external/wpt/service-workers/service-worker/fetch-request-xhr.https.html [ Timeout ]
-crbug.com/803672 virtual/service-worker-script-streaming/external/wpt/service-workers/service-worker/fetch-request-xhr.https.html [ Timeout ]
 
 # https://crbug.com/794631: Recent regression.
 crbug.com/794631 virtual/unified-autoplay/external/wpt/feature-policy/autoplay-allowed-by-feature-policy-attribute.https.sub.html [ Failure ]
diff --git a/third_party/WebKit/LayoutTests/LeakExpectations b/third_party/WebKit/LayoutTests/LeakExpectations
index 0bbc033..0f9b688 100644
--- a/third_party/WebKit/LayoutTests/LeakExpectations
+++ b/third_party/WebKit/LayoutTests/LeakExpectations
@@ -24,9 +24,7 @@
 # Untriaged but known leaks of PausableObject (http).
 # -----------------------------------------------------------------
 crbug.com/506754 http/tests/serviceworker/chromium/resolve-after-window-close.html [ Leak ]
-crbug.com/506754 virtual/service-worker-script-streaming/http/tests/serviceworker/chromium/resolve-after-window-close.html [ Leak ]
 crbug.com/506754 http/tests/serviceworker/chromium/window-close-during-registration.html [ Leak ]
-crbug.com/506754 virtual/service-worker-script-streaming/http/tests/serviceworker/chromium/window-close-during-registration.html [ Leak ]
 
 crbug.com/664874 http/tests/xmlhttprequest/workers/xmlhttprequest-allowed-with-disabled-web-security.html [ Leak ]
 
diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index dd7031ef..8c6bbab 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations
@@ -91,7 +91,6 @@
 crbug.com/771643 virtual/spv175/paint/invalidation/svg/absolute-sized-content-with-resources.xhtml [ Failure ]
 
 crbug.com/805049 [ Mac ] virtual/spv175/compositing/iframes/fixed-position-iframe.html [ Pass Crash ]
-crbug.com/805049 virtual/spv175/paint/invalidation/scroll/fixed-scroll-simple.html [ Failure ]
 
 # spv175+root-layer-scrolls failures. They also fail with root-layer-scrolls without enable-slimming-paint-v175.
 crbug.com/417782 virtual/spv175/compositing/overflow/border-radius-composited-subframe.html [ Failure ]
@@ -604,12 +603,11 @@
 
 # ====== IncrementalShadowDOM-only failures from here ======
 
-crbug.com/776656 virtual/incremental-shadow-dom/external/wpt/shadow-dom/untriaged/elements-and-dom-objects/extensions-to-event-interface/event-path-001.html [ Failure ]
 crbug.com/776656 virtual/incremental-shadow-dom/external/wpt/shadow-dom/untriaged/styles/test-003.html [ Failure ]
-crbug.com/776656 virtual/incremental-shadow-dom/fast/dom/shadow/shadow-dom-event-dispatching-details-summary.html [ Failure ]
 
 # ====== IncrementalShadowDOM-only failures until here ======
 
+crbug.com/776656 fast/dom/shadow/shadow-dom-event-dispatching-details-summary.html [ Failure ]
 crbug.com/776656 shadow-dom/css-style-inherit.html [ Failure ]
 
 crbug.com/667560 [ Debug ] http/tests/devtools/elements/styles-3/styles-change-node-while-editing.js [ Pass Failure ]
@@ -649,13 +647,9 @@
 # Found 2061 tests; running 2060, skipping 1.
 # 2060 tests ran as expected (1968 passed, 92 didn't).
 
-# The outofblink-cors version of fetch-event.https.html, below, is also timeout-flaky.
-crbug.com/807014 external/wpt/service-workers/service-worker/fetch-event.https.html [ Pass Timeout ]
-crbug.com/807014 virtual/service-worker-script-streaming/external/wpt/service-workers/service-worker/fetch-event.https.html [ Pass Timeout ]
-
 # Crashing tests in dictionary order.
 crbug.com/736308 virtual/outofblink-cors/external/wpt/service-workers/service-worker/fetch-cors-xhr.https.html [ Failure Crash ]
-crbug.com/736308 virtual/outofblink-cors/external/wpt/service-workers/service-worker/fetch-event.https.html [ Crash Timeout ]
+crbug.com/736308 virtual/outofblink-cors/external/wpt/service-workers/service-worker/fetch-event.https.html [ Crash ]
 crbug.com/736308 virtual/outofblink-cors/external/wpt/service-workers/service-worker/fetch-event-network-error.https.html [ Crash ]
 crbug.com/736308 virtual/outofblink-cors/external/wpt/service-workers/service-worker/fetch-request-fallback.https.html [ Crash Failure ]
 crbug.com/736308 virtual/outofblink-cors/external/wpt/service-workers/service-worker/fetch-request-redirect.https.html [ Crash ]
@@ -687,8 +681,10 @@
 crbug.com/736308 virtual/outofblink-cors/external/wpt/service-workers/service-worker/sandboxed-iframe-fetch-event.https.html [ Timeout ]
 
 # Failing tests in dictionary order.
-crbug.com/736308 virtual/outofblink-cors/external/wpt/service-workers/service-worker/fetch-canvas-tainting-cache.https.html [ Failure ]
-crbug.com/736308 virtual/outofblink-cors/external/wpt/service-workers/service-worker/fetch-canvas-tainting.https.html [ Failure ]
+crbug.com/736308 virtual/outofblink-cors/external/wpt/service-workers/service-worker/fetch-canvas-tainting-image-cache.https.html [ Failure ]
+crbug.com/736308 virtual/outofblink-cors/external/wpt/service-workers/service-worker/fetch-canvas-tainting-image.https.html [ Failure ]
+crbug.com/736308 virtual/outofblink-cors/external/wpt/service-workers/service-worker/fetch-canvas-tainting-video-cache.https.html [ Failure ]
+crbug.com/736308 virtual/outofblink-cors/external/wpt/service-workers/service-worker/fetch-canvas-tainting-video.https.html [ Failure ]
 crbug.com/736308 virtual/outofblink-cors/external/wpt/service-workers/service-worker/fetch-event-referrer-policy.https.html [ Failure ]
 crbug.com/736308 virtual/outofblink-cors/external/wpt/service-workers/service-worker/fetch-request-html-imports.https.html [ Failure ]
 crbug.com/736308 virtual/outofblink-cors/external/wpt/service-workers/service-worker/fetch-request-xhr.https.html [ Failure ]
@@ -931,7 +927,6 @@
 
 # Web Components related tests (Shadow DOM, Custom Elements) failures.
 crbug.com/505364 external/wpt/shadow-dom/untriaged/styles/test-003.html [ Failure ]
-crbug.com/505364 external/wpt/shadow-dom/untriaged/elements-and-dom-objects/extensions-to-event-interface/event-path-001.html [ Failure ]
 crbug.com/505364 external/wpt/css/css-scoping/css-scoping-shadow-slot-display-override.html [ Failure ]
 crbug.com/505364 external/wpt/css/css-scoping/css-scoping-shadow-slot-style.html [ Failure ]
 crbug.com/505364 external/wpt/css/css-scoping/css-scoping-shadow-nested-slot-display-override.html [ Failure ]
@@ -1281,6 +1276,8 @@
 
 crbug.com/662010 [ Win7 ] http/tests/csspaint/invalidation-background-image.html [ Skip ]
 
+crbug.com/807152 vr/VRDisplay_rAF_fires_with_window_rAF.html [ Pass Failure ]
+
 # These tests are skipped as there is no touch support on Mac.
 crbug.com/613672 [ Mac ] fast/events/touch/multi-touch-user-gesture.html [ Skip ]
 crbug.com/613672 [ Mac ] virtual/mouseevent_fractional/fast/events/touch/multi-touch-user-gesture.html [ Skip ]
@@ -1815,9 +1812,6 @@
 crbug.com/626703 [ Android ] external/wpt/FileAPI/reading-data-section/FileReader-event-handler-attributes.html [ Crash ]
 crbug.com/626703 [ Android ] external/wpt/dom/nodes/Document-contentType/contentType/createHTMLDocument.html [ Timeout ]
 crbug.com/626703 [ Linux Mac ] virtual/outofblink-cors/external/wpt/service-workers/service-worker/clients-get-cross-origin.https.html [ Timeout ]
-crbug.com/626703 [ Linux Mac ] virtual/service-worker-script-streaming/external/wpt/service-workers/service-worker/clients-get.https.html [ Timeout ]
-crbug.com/626703 [ Linux Mac ] virtual/service-worker-script-streaming/external/wpt/service-workers/service-worker/clients-get-client-types.https.html [ Timeout ]
-crbug.com/626703 [ Linux Mac ] virtual/service-worker-script-streaming/external/wpt/service-workers/service-worker/clients-get-cross-origin.https.html [ Timeout ]
 crbug.com/626703 [ Linux Mac ] virtual/mojo-blobs/external/wpt/service-workers/service-worker/clients-get.https.html [ Timeout ]
 crbug.com/626703 external/wpt/service-workers/service-worker/clients-get-cross-origin.https.html [ Timeout ]
 crbug.com/626703 external/wpt/service-workers/service-worker/clients-get.https.html [ Timeout ]
@@ -2211,7 +2205,6 @@
 crbug.com/626703 virtual/outofblink-cors/external/wpt/fetch/api/abort/general.html [ Timeout ]
 crbug.com/626703 virtual/outofblink-cors/external/wpt/http/basic-auth-cache-test.html [ Timeout ]
 crbug.com/626703 virtual/outofblink-cors/external/wpt/service-workers/service-worker/update-bytecheck.https.html [ Timeout ]
-crbug.com/626703 virtual/service-worker-script-streaming/external/wpt/service-workers/service-worker/update-bytecheck.https.html [ Timeout ]
 crbug.com/626703 [ Win10 ] external/wpt/preload/delaying-onload-link-preload-after-discovery.html [ Timeout ]
 crbug.com/626703 [ Win ] external/wpt/css/css-writing-modes/box-offsets-rel-pos-vlr-005.xht [ Failure ]
 crbug.com/626703 [ Win ] external/wpt/css/css-writing-modes/box-offsets-rel-pos-vrl-004.xht [ Failure ]
@@ -2417,16 +2410,13 @@
 
 # This test requires a special browser flag and seems not suitable for a wpt test, see bug.
 crbug.com/691944 external/wpt/service-workers/service-worker/update-after-oneday.https.html [ Skip ]
-crbug.com/691944 virtual/service-worker-script-streaming/external/wpt/service-workers/service-worker/update-after-oneday.https.html [ Skip ]
 crbug.com/691944 virtual/mojo-blobs/external/wpt/service-workers/service-worker/update-after-oneday.https.html [ Skip ]
 crbug.com/691944 virtual/outofblink-cors/external/wpt/service-workers/service-worker/update-after-oneday.https.html [ Skip ]
 
 # These tests (erroneously) see a platform-specific User-Agent header
 crbug.com/595993 external/wpt/service-workers/service-worker/fetch-header-visibility.https.html [ Failure ]
-crbug.com/595993 virtual/service-worker-script-streaming/external/wpt/service-workers/service-worker/fetch-header-visibility.https.html [ Failure ]
 crbug.com/595993 virtual/mojo-blobs/external/wpt/service-workers/service-worker/fetch-header-visibility.https.html [ Failure ]
 crbug.com/595993 external/wpt/service-workers/service-worker/request-end-to-end.https.html [ Failure ]
-crbug.com/595993 virtual/service-worker-script-streaming/external/wpt/service-workers/service-worker/request-end-to-end.https.html [ Failure ]
 crbug.com/595993 virtual/mojo-blobs/external/wpt/service-workers/service-worker/request-end-to-end.https.html [ Failure ]
 crbug.com/595993 virtual/outofblink-cors/external/wpt/service-workers/service-worker/request-end-to-end.https.html [ Failure ]
 crbug.com/595993 virtual/outofblink-cors/external/wpt/service-workers/service-worker/fetch-header-visibility.https.html [ Failure ]
@@ -2705,7 +2695,6 @@
 
 # Flaky on trybots
 crbug.com/688486 external/wpt/service-workers/service-worker/fetch-request-resources.https.html [ Failure Pass ]
-crbug.com/688486 virtual/service-worker-script-streaming/external/wpt/service-workers/service-worker/fetch-request-resources.https.html [ Failure Pass ]
 crbug.com/688486 virtual/mojo-blobs/external/wpt/service-workers/service-worker/fetch-request-resources.https.html [ Failure Pass ]
 crbug.com/688486 virtual/outofblink-cors/external/wpt/service-workers/service-worker/fetch-request-resources.https.html [ Failure Pass ]
 
@@ -2753,8 +2742,6 @@
 crbug.com/791529 external/wpt/css/css-variables/variable-transitions-transition-property-variable-before-value.html [ Skip ]
 crbug.com/791529 external/wpt/css/css-variables/variable-transitions-value-before-transition-property-variable.html [ Skip ]
 
-crbug.com/739367 [ Win ] virtual/service-worker-script-streaming/external/wpt/service-workers/service-worker/fetch-event-redirect.https.html [ Timeout ]
-
 # Feature Policy changes fullscreen behaviour, tests need updating
 crbug.com/718155 fullscreen/full-screen-iframe-not-allowed.html [ Failure ]
 crbug.com/718155 fullscreen/full-screen-restrictions.html [ Failure Timeout ]
@@ -3202,6 +3189,8 @@
 crbug.com/770691 [ Win7 Linux Mac10.11 ] media/controls/lazy-loaded-style.html [ Failure Pass ]
 crbug.com/770691 [ Win7 Linux Mac10.11 ] virtual/new-remote-playback-pipeline/media/controls/lazy-loaded-style.html [ Failure Pass ]
 
+crbug.com/807191 fast/media/mq-color-gamut-picture.html [ Pass Failure Timeout ]
+
 # Text rendering on Win7 failing image diffs, flakily.
 crbug.com/773122 [ Win7 ] fast/text/international/unicode-bidi-plaintext-in-textarea.html [ Failure Pass ]
 crbug.com/773122 [ Win7 ] fast/text/whitespace/022.html [ Failure Pass ]
@@ -3342,6 +3331,8 @@
 
 crbug.com/802915 css3/blending/isolation-should-include-non-local-background.html [ Failure ]
 
+crbug.com/807159 hittesting/inline-with-clip-path.html [ Pass Crash ]
+
 # Sheriff faulures 2017-12-12
 crbug.com/794180 http/tests/devtools/layers/layer-compositing-reasons.js [ Failure Pass ]
 
diff --git a/third_party/WebKit/LayoutTests/VirtualTestSuites b/third_party/WebKit/LayoutTests/VirtualTestSuites
index ea7599ac..9d0f3cb 100644
--- a/third_party/WebKit/LayoutTests/VirtualTestSuites
+++ b/third_party/WebKit/LayoutTests/VirtualTestSuites
@@ -392,26 +392,6 @@
     "args": ["--enable-features=PWAFullCodeCache"]
   },
   {
-    "prefix": "service-worker-script-streaming",
-    "base": "external/wpt/service-workers",
-    "args": ["--enable-features=ServiceWorkerScriptStreaming"]
-  },
-  {
-    "prefix": "service-worker-script-streaming",
-    "base": "http/tests/serviceworker",
-    "args": ["--enable-features=ServiceWorkerScriptStreaming"]
-  },
-  {
-    "prefix": "service-worker-script-streaming",
-    "base": "http/tests/fetch/serviceworker",
-    "args": ["--enable-features=ServiceWorkerScriptStreaming"]
-  },
-  {
-    "prefix": "service-worker-script-streaming",
-    "base": "http/tests/fetch/serviceworker-proxied",
-    "args": ["--enable-features=ServiceWorkerScriptStreaming"]
-  },
-  {
     "prefix": "layout_ng",
     "base": "fast/block/basic",
     "args": ["--enable-blink-features=LayoutNG,LayoutNGPaintFragments",
diff --git a/third_party/WebKit/LayoutTests/editing/inserting/4960120-2.html b/third_party/WebKit/LayoutTests/editing/inserting/4960120-2.html
index ab79219..5f422447f 100644
--- a/third_party/WebKit/LayoutTests/editing/inserting/4960120-2.html
+++ b/third_party/WebKit/LayoutTests/editing/inserting/4960120-2.html
@@ -1,14 +1,13 @@
-<p>This tests for a bug where a newline inserted at the end of an anonymous block would be lost.</p>
-<div id="div" contenteditable="true">foo<div>bar</div></div>
-
+<!doctype html>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script src="../assert_selection.js"></script>
 <script>
-if (window.internals)
-    internals.settings.setEditingBehavior('mac');
-var div = document.getElementById("div");
-var sel = window.getSelection();
-
-sel.collapse(div, 0);
-sel.modify("move", "forward", "word");
-
-document.execCommand("InsertLineBreak");
+// This tests for a bug where a newline inserted at the end of an anonymous
+// block would be lost.
+selection_test(
+  '<div contenteditable>foo<div>bar|</div></div>',
+  'insertLineBreak',
+  '<div contenteditable>foo<div>bar<br>|<br></div></div>',
+  'InsertLineBreak at end of anonymous block');
 </script>
diff --git a/third_party/WebKit/LayoutTests/external/WPT_BASE_MANIFEST.json b/third_party/WebKit/LayoutTests/external/WPT_BASE_MANIFEST.json
index f612366..ae8b41a 100644
--- a/third_party/WebKit/LayoutTests/external/WPT_BASE_MANIFEST.json
+++ b/third_party/WebKit/LayoutTests/external/WPT_BASE_MANIFEST.json
@@ -3127,6 +3127,42 @@
      {}
     ]
    ],
+   "graphics-aam/graphics-document_on_html_element-manual.html": [
+    [
+     "/graphics-aam/graphics-document_on_html_element-manual.html",
+     {}
+    ]
+   ],
+   "graphics-aam/graphics-document_on_svg_element-manual.html": [
+    [
+     "/graphics-aam/graphics-document_on_svg_element-manual.html",
+     {}
+    ]
+   ],
+   "graphics-aam/graphics-object_on_html_element-manual.html": [
+    [
+     "/graphics-aam/graphics-object_on_html_element-manual.html",
+     {}
+    ]
+   ],
+   "graphics-aam/graphics-object_on_svg_element-manual.html": [
+    [
+     "/graphics-aam/graphics-object_on_svg_element-manual.html",
+     {}
+    ]
+   ],
+   "graphics-aam/graphics-symbol_on_html_element-manual.html": [
+    [
+     "/graphics-aam/graphics-symbol_on_html_element-manual.html",
+     {}
+    ]
+   ],
+   "graphics-aam/graphics-symbol_on_svg_element-manual.html": [
+    [
+     "/graphics-aam/graphics-symbol_on_svg_element-manual.html",
+     {}
+    ]
+   ],
    "gyroscope/Gyroscope_onerror-manual.https.html": [
     [
      "/gyroscope/Gyroscope_onerror-manual.https.html",
@@ -62609,6 +62645,90 @@
      {}
     ]
    ],
+   "css/css-transforms/transform-transformed-caption-contains-fixed-position.html": [
+    [
+     "/css/css-transforms/transform-transformed-caption-contains-fixed-position.html",
+     [
+      [
+       "/css/css-transforms/transform-transformed-caption-contains-fixed-position-ref.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
+   "css/css-transforms/transform-transformed-tbody-contains-fixed-position.html": [
+    [
+     "/css/css-transforms/transform-transformed-tbody-contains-fixed-position.html",
+     [
+      [
+       "/css/css-transforms/transform-transformed-tbody-contains-fixed-position-ref.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
+   "css/css-transforms/transform-transformed-td-contains-fixed-position.html": [
+    [
+     "/css/css-transforms/transform-transformed-td-contains-fixed-position.html",
+     [
+      [
+       "/css/css-transforms/transform-transformed-td-contains-fixed-position-ref.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
+   "css/css-transforms/transform-transformed-tfoot-contains-fixed-position.html": [
+    [
+     "/css/css-transforms/transform-transformed-tfoot-contains-fixed-position.html",
+     [
+      [
+       "/css/css-transforms/transform-transformed-tfoot-contains-fixed-position-ref.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
+   "css/css-transforms/transform-transformed-th-contains-fixed-position.html": [
+    [
+     "/css/css-transforms/transform-transformed-th-contains-fixed-position.html",
+     [
+      [
+       "/css/css-transforms/transform-transformed-th-contains-fixed-position-ref.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
+   "css/css-transforms/transform-transformed-thead-contains-fixed-position.html": [
+    [
+     "/css/css-transforms/transform-transformed-thead-contains-fixed-position.html",
+     [
+      [
+       "/css/css-transforms/transform-transformed-thead-contains-fixed-position-ref.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
+   "css/css-transforms/transform-transformed-tr-contains-fixed-position.html": [
+    [
+     "/css/css-transforms/transform-transformed-tr-contains-fixed-position.html",
+     [
+      [
+       "/css/css-transforms/transform-transformed-tr-contains-fixed-position-ref.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
    "css/css-transforms/transform-translate-001.html": [
     [
      "/css/css-transforms/transform-translate-001.html",
@@ -93276,6 +93396,36 @@
      {}
     ]
    ],
+   "bluetooth/script-tests/service/blocklisted-characteristic.js": [
+    [
+     {}
+    ]
+   ],
+   "bluetooth/script-tests/service/characteristic-not-found.js": [
+    [
+     {}
+    ]
+   ],
+   "bluetooth/script-tests/service/garbage-collection-ran-during-error.js": [
+    [
+     {}
+    ]
+   ],
+   "bluetooth/script-tests/service/get-same-object.js": [
+    [
+     {}
+    ]
+   ],
+   "bluetooth/script-tests/service/invalid-characteristic-name.js": [
+    [
+     {}
+    ]
+   ],
+   "bluetooth/script-tests/service/reconnect-during.js": [
+    [
+     {}
+    ]
+   ],
    "clear-site-data/OWNERS": [
     [
      {}
@@ -116651,6 +116801,41 @@
      {}
     ]
    ],
+   "css/css-transforms/transform-transformed-caption-contains-fixed-position-ref.html": [
+    [
+     {}
+    ]
+   ],
+   "css/css-transforms/transform-transformed-tbody-contains-fixed-position-ref.html": [
+    [
+     {}
+    ]
+   ],
+   "css/css-transforms/transform-transformed-td-contains-fixed-position-ref.html": [
+    [
+     {}
+    ]
+   ],
+   "css/css-transforms/transform-transformed-tfoot-contains-fixed-position-ref.html": [
+    [
+     {}
+    ]
+   ],
+   "css/css-transforms/transform-transformed-th-contains-fixed-position-ref.html": [
+    [
+     {}
+    ]
+   ],
+   "css/css-transforms/transform-transformed-thead-contains-fixed-position-ref.html": [
+    [
+     {}
+    ]
+   ],
+   "css/css-transforms/transform-transformed-tr-contains-fixed-position-ref.html": [
+    [
+     {}
+    ]
+   ],
    "css/css-transforms/transform-translate-ref.html": [
     [
      {}
@@ -127946,6 +128131,41 @@
      {}
     ]
    ],
+   "feature-policy/experimental-features/resources/feature-policy-image.html": [
+    [
+     {}
+    ]
+   ],
+   "feature-policy/experimental-features/resources/image.jpg": [
+    [
+     {}
+    ]
+   ],
+   "feature-policy/experimental-features/resources/image.png": [
+    [
+     {}
+    ]
+   ],
+   "feature-policy/experimental-features/resources/image.svg": [
+    [
+     {}
+    ]
+   ],
+   "feature-policy/experimental-features/resources/video.ogv": [
+    [
+     {}
+    ]
+   ],
+   "feature-policy/experimental-features/unsized-image.tentative.https.sub-expected.txt": [
+    [
+     {}
+    ]
+   ],
+   "feature-policy/experimental-features/unsized-image.tentative.https.sub.html.headers": [
+    [
+     {}
+    ]
+   ],
    "feature-policy/payment-allowed-by-feature-policy.https.sub.html.headers": [
     [
      {}
@@ -128831,6 +129051,36 @@
      {}
     ]
    ],
+   "graphics-aam/graphics-document_on_html_element-manual-expected.txt": [
+    [
+     {}
+    ]
+   ],
+   "graphics-aam/graphics-document_on_svg_element-manual-expected.txt": [
+    [
+     {}
+    ]
+   ],
+   "graphics-aam/graphics-object_on_html_element-manual-expected.txt": [
+    [
+     {}
+    ]
+   ],
+   "graphics-aam/graphics-object_on_svg_element-manual-expected.txt": [
+    [
+     {}
+    ]
+   ],
+   "graphics-aam/graphics-symbol_on_html_element-manual-expected.txt": [
+    [
+     {}
+    ]
+   ],
+   "graphics-aam/graphics-symbol_on_svg_element-manual-expected.txt": [
+    [
+     {}
+    ]
+   ],
    "gyroscope/Gyroscope-disabled-by-feature-policy.https.html.headers": [
     [
      {}
@@ -165041,6 +165291,22 @@
      }
     ]
    ],
+   "bluetooth/requestDevice/blocklisted-service-in-filter.https.html": [
+    [
+     "/bluetooth/requestDevice/blocklisted-service-in-filter.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
+   "bluetooth/requestDevice/blocklisted-service-in-optionalServices.https.html": [
+    [
+     "/bluetooth/requestDevice/blocklisted-service-in-optionalServices.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
    "bluetooth/requestDevice/canonicalizeFilter/device-name-longer-than-29-bytes.https.html": [
     [
      "/bluetooth/requestDevice/canonicalizeFilter/device-name-longer-than-29-bytes.https.html",
@@ -165193,6 +165459,94 @@
      }
     ]
    ],
+   "bluetooth/requestDevice/consumes-user-gesture.https.html": [
+    [
+     "/bluetooth/requestDevice/consumes-user-gesture.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
+   "bluetooth/requestDevice/discovery-succeeds.https.html": [
+    [
+     "/bluetooth/requestDevice/discovery-succeeds.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
+   "bluetooth/requestDevice/filter-matches.https.html": [
+    [
+     "/bluetooth/requestDevice/filter-matches.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
+   "bluetooth/requestDevice/le-not-supported.https.html": [
+    [
+     "/bluetooth/requestDevice/le-not-supported.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
+   "bluetooth/requestDevice/name-empty-device-from-name-empty-filter.https.html": [
+    [
+     "/bluetooth/requestDevice/name-empty-device-from-name-empty-filter.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
+   "bluetooth/requestDevice/not-processing-user-gesture.https.html": [
+    [
+     "/bluetooth/requestDevice/not-processing-user-gesture.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
+   "bluetooth/requestDevice/radio-not-present.https.html": [
+    [
+     "/bluetooth/requestDevice/radio-not-present.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
+   "bluetooth/requestDevice/request-from-iframe.https.html": [
+    [
+     "/bluetooth/requestDevice/request-from-iframe.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
+   "bluetooth/requestDevice/request-from-sandboxed-iframe.https.html": [
+    [
+     "/bluetooth/requestDevice/request-from-sandboxed-iframe.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
+   "bluetooth/requestDevice/same-device.https.html": [
+    [
+     "/bluetooth/requestDevice/same-device.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
+   "bluetooth/requestDevice/single-filter-single-service.https.html": [
+    [
+     "/bluetooth/requestDevice/single-filter-single-service.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
    "bluetooth/server/connect/connection-succeeds.https.html": [
     [
      "/bluetooth/server/connect/connection-succeeds.https.html",
@@ -165665,6 +166019,54 @@
      }
     ]
    ],
+   "bluetooth/service/getCharacteristic/gen-blocklisted-characteristic.https.html": [
+    [
+     "/bluetooth/service/getCharacteristic/gen-blocklisted-characteristic.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
+   "bluetooth/service/getCharacteristic/gen-characteristic-not-found.https.html": [
+    [
+     "/bluetooth/service/getCharacteristic/gen-characteristic-not-found.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
+   "bluetooth/service/getCharacteristic/gen-garbage-collection-ran-during-error.https.html": [
+    [
+     "/bluetooth/service/getCharacteristic/gen-garbage-collection-ran-during-error.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
+   "bluetooth/service/getCharacteristic/gen-get-same-object.https.html": [
+    [
+     "/bluetooth/service/getCharacteristic/gen-get-same-object.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
+   "bluetooth/service/getCharacteristic/gen-invalid-characteristic-name.https.html": [
+    [
+     "/bluetooth/service/getCharacteristic/gen-invalid-characteristic-name.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
+   "bluetooth/service/getCharacteristic/gen-reconnect-during.https.html": [
+    [
+     "/bluetooth/service/getCharacteristic/gen-reconnect-during.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
    "bluetooth/service/getCharacteristics/blocklisted-characteristics.https.html": [
     [
      "/bluetooth/service/getCharacteristics/blocklisted-characteristics.https.html",
@@ -165697,6 +166099,78 @@
      }
     ]
    ],
+   "bluetooth/service/getCharacteristics/gen-blocklisted-characteristic-with-uuid.https.html": [
+    [
+     "/bluetooth/service/getCharacteristics/gen-blocklisted-characteristic-with-uuid.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
+   "bluetooth/service/getCharacteristics/gen-characteristic-not-found-with-uuid.https.html": [
+    [
+     "/bluetooth/service/getCharacteristics/gen-characteristic-not-found-with-uuid.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
+   "bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-error-with-uuid.https.html": [
+    [
+     "/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-error-with-uuid.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
+   "bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-error.https.html": [
+    [
+     "/bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-error.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
+   "bluetooth/service/getCharacteristics/gen-get-same-object-with-uuid.https.html": [
+    [
+     "/bluetooth/service/getCharacteristics/gen-get-same-object-with-uuid.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
+   "bluetooth/service/getCharacteristics/gen-get-same-object.https.html": [
+    [
+     "/bluetooth/service/getCharacteristics/gen-get-same-object.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
+   "bluetooth/service/getCharacteristics/gen-invalid-characteristic-name.https.html": [
+    [
+     "/bluetooth/service/getCharacteristics/gen-invalid-characteristic-name.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
+   "bluetooth/service/getCharacteristics/gen-reconnect-during-with-uuid.https.html": [
+    [
+     "/bluetooth/service/getCharacteristics/gen-reconnect-during-with-uuid.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
+   "bluetooth/service/getCharacteristics/gen-reconnect-during.https.html": [
+    [
+     "/bluetooth/service/getCharacteristics/gen-reconnect-during.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
    "clear-site-data/navigation-insecure.html": [
     [
      "/clear-site-data/navigation-insecure.html",
@@ -174215,6 +174689,18 @@
      {}
     ]
    ],
+   "css/cssom-view/scrollIntoView-scrollMargin.html": [
+    [
+     "/css/cssom-view/scrollIntoView-scrollMargin.html",
+     {}
+    ]
+   ],
+   "css/cssom-view/scrollIntoView-scrollPadding.html": [
+    [
+     "/css/cssom-view/scrollIntoView-scrollPadding.html",
+     {}
+    ]
+   ],
    "css/cssom-view/scrollIntoView-shadow.html": [
     [
      "/css/cssom-view/scrollIntoView-shadow.html",
@@ -179811,6 +180297,12 @@
      }
     ]
    ],
+   "feature-policy/experimental-features/unsized-image.tentative.https.sub.html": [
+    [
+     "/feature-policy/experimental-features/unsized-image.tentative.https.sub.html",
+     {}
+    ]
+   ],
    "feature-policy/payment-allowed-by-feature-policy-attribute-redirect-on-load.https.sub.html": [
     [
      "/feature-policy/payment-allowed-by-feature-policy-attribute-redirect-on-load.https.sub.html",
@@ -192973,6 +193465,14 @@
      {}
     ]
    ],
+   "http/tests/bluetooth/https/requestDevice/cross-origin-iframe.sub.https.html": [
+    [
+     "/http/tests/bluetooth/https/requestDevice/cross-origin-iframe.sub.https.html",
+     {
+      "testdriver": true
+     }
+    ]
+   ],
    "imagebitmap-renderingcontext/bitmaprenderer-as-imagesource.html": [
     [
      "/imagebitmap-renderingcontext/bitmaprenderer-as-imagesource.html",
@@ -238088,6 +238588,14 @@
    "50eaac3e0c94933fa995c102d53b6b00b3087ea6",
    "testharness"
   ],
+  "bluetooth/requestDevice/blocklisted-service-in-filter.https.html": [
+   "7046c3d32539807824c3abdc95071e8495c619df",
+   "testharness"
+  ],
+  "bluetooth/requestDevice/blocklisted-service-in-optionalServices.https.html": [
+   "c3fbd786e7cf05f72eb0afadba8924c43f2fdc11",
+   "testharness"
+  ],
   "bluetooth/requestDevice/canonicalizeFilter/device-name-longer-than-29-bytes.https.html": [
    "238bfa4cae4a577d6725071585d3f4fb17211926",
    "testharness"
@@ -238164,12 +238672,56 @@
    "084ec334261ed7c584a0888ff3dfdec0f3538bad",
    "testharness"
   ],
+  "bluetooth/requestDevice/consumes-user-gesture.https.html": [
+   "c76d7e37417a7db3043b761989eebbfded6e6804",
+   "testharness"
+  ],
+  "bluetooth/requestDevice/discovery-succeeds.https.html": [
+   "da1be25f068cdb9602d6207b6af0170e232e68cd",
+   "testharness"
+  ],
+  "bluetooth/requestDevice/filter-matches.https.html": [
+   "22ea4176f1f5cdd67a730cce43e3fbf08d1fcfdb",
+   "testharness"
+  ],
+  "bluetooth/requestDevice/le-not-supported.https.html": [
+   "9870420cf924559cb02144ecd5da02d39f386f30",
+   "testharness"
+  ],
+  "bluetooth/requestDevice/name-empty-device-from-name-empty-filter.https.html": [
+   "93143b0311d74ad763d26db3cbfc55d4e989b1dd",
+   "testharness"
+  ],
+  "bluetooth/requestDevice/not-processing-user-gesture.https.html": [
+   "c4aa433b370a8dbecf4fe4167edfd1eb01febfc0",
+   "testharness"
+  ],
+  "bluetooth/requestDevice/radio-not-present.https.html": [
+   "47b28ec24e902fe0e9593d002f6c7ed88e379b00",
+   "testharness"
+  ],
+  "bluetooth/requestDevice/request-from-iframe.https.html": [
+   "4af485c1bb00aacd11225001ed494628063b2684",
+   "testharness"
+  ],
+  "bluetooth/requestDevice/request-from-sandboxed-iframe.https.html": [
+   "917a1be9111f04e67231c92921b1f856685deb55",
+   "testharness"
+  ],
+  "bluetooth/requestDevice/same-device.https.html": [
+   "2bf20db77582e6df2674dd0a5cf444d630b3b999",
+   "testharness"
+  ],
+  "bluetooth/requestDevice/single-filter-single-service.https.html": [
+   "f147182b894cbb0f338111b146dfa16193610265",
+   "testharness"
+  ],
   "bluetooth/resources/bluetooth-helpers.js": [
    "1944dc57df774ad737179dd22fb3cc9de842bc21",
    "support"
   ],
   "bluetooth/resources/health-thermometer-iframe.html": [
-   "5f01661918ad9d98796a8d352174d16d55da0901",
+   "f175a62907e65c03e326832449b0b8e3276387d8",
    "support"
   ],
   "bluetooth/script-tests/base_test_html.template": [
@@ -238248,6 +238800,30 @@
    "b18022b48d354825fa747abda81bc870142d9c59",
    "support"
   ],
+  "bluetooth/script-tests/service/blocklisted-characteristic.js": [
+   "cdc9a9e30e319c3eb1532ef24436d5fc454d2a5e",
+   "support"
+  ],
+  "bluetooth/script-tests/service/characteristic-not-found.js": [
+   "f010c39bfc9e08f1ee68fe9c6e1ca6054d97074b",
+   "support"
+  ],
+  "bluetooth/script-tests/service/garbage-collection-ran-during-error.js": [
+   "f851c238adc404f49b9f9bb1fb8d10cc2f4d9b38",
+   "support"
+  ],
+  "bluetooth/script-tests/service/get-same-object.js": [
+   "9ffba72c471c6ee4ba23c61aaa991dbe5e50ad9f",
+   "support"
+  ],
+  "bluetooth/script-tests/service/invalid-characteristic-name.js": [
+   "7c16b4edc418b3e6635d0a27dcced11c332cc2e2",
+   "support"
+  ],
+  "bluetooth/script-tests/service/reconnect-during.js": [
+   "fc89c44348fa1bb141d9d6d16b487cd3ea1e1d5d",
+   "support"
+  ],
   "bluetooth/server/connect/connection-succeeds.https.html": [
    "167880b07f855325a35a81a8ea833b0d006c7957",
    "testharness"
@@ -238484,6 +239060,30 @@
    "53479f342ef4aab9a24aaaa4580a63b5e6bcd30b",
    "testharness"
   ],
+  "bluetooth/service/getCharacteristic/gen-blocklisted-characteristic.https.html": [
+   "bbc9e9fbf1a84d26e60064703ad1f510d1f0d23d",
+   "testharness"
+  ],
+  "bluetooth/service/getCharacteristic/gen-characteristic-not-found.https.html": [
+   "e56889ff833346000ece4dd161dba42603ab4722",
+   "testharness"
+  ],
+  "bluetooth/service/getCharacteristic/gen-garbage-collection-ran-during-error.https.html": [
+   "ff07bf6e5c97eb527cf31cb785b3eaf6e61e3418",
+   "testharness"
+  ],
+  "bluetooth/service/getCharacteristic/gen-get-same-object.https.html": [
+   "011f75d88736c0fad0904442dbffdd24a05837a3",
+   "testharness"
+  ],
+  "bluetooth/service/getCharacteristic/gen-invalid-characteristic-name.https.html": [
+   "9d500137650d30e6ecdd2fdaa7ea0957030343ea",
+   "testharness"
+  ],
+  "bluetooth/service/getCharacteristic/gen-reconnect-during.https.html": [
+   "2c155e835979269072d21a473010eded488ac185",
+   "testharness"
+  ],
   "bluetooth/service/getCharacteristics/blocklisted-characteristics.https.html": [
    "cb0ff8a9913b54ef624a38d367d84b1656b2a536",
    "testharness"
@@ -238500,6 +239100,42 @@
    "694b69270065eb15a7129f9359a2b71d90ed9226",
    "testharness"
   ],
+  "bluetooth/service/getCharacteristics/gen-blocklisted-characteristic-with-uuid.https.html": [
+   "f11a67323cbb8948074a7ed9357d0d3c3bb420b3",
+   "testharness"
+  ],
+  "bluetooth/service/getCharacteristics/gen-characteristic-not-found-with-uuid.https.html": [
+   "a5e9744319ef73205a5cbc06993802ec4fe40ee0",
+   "testharness"
+  ],
+  "bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-error-with-uuid.https.html": [
+   "d10095452cb2c997fa37b972e05984689d531819",
+   "testharness"
+  ],
+  "bluetooth/service/getCharacteristics/gen-garbage-collection-ran-during-error.https.html": [
+   "d6b88afffb6ed44f706720a2b477c4687e82caf4",
+   "testharness"
+  ],
+  "bluetooth/service/getCharacteristics/gen-get-same-object-with-uuid.https.html": [
+   "45564351fa111f80c28eff14a6175f4594d4e2c9",
+   "testharness"
+  ],
+  "bluetooth/service/getCharacteristics/gen-get-same-object.https.html": [
+   "78bcc807683b27a57b510ebd24ec2b5e33f67fb7",
+   "testharness"
+  ],
+  "bluetooth/service/getCharacteristics/gen-invalid-characteristic-name.https.html": [
+   "9f766bf08b1ad918bd0283cdf703fb3f030bf8a4",
+   "testharness"
+  ],
+  "bluetooth/service/getCharacteristics/gen-reconnect-during-with-uuid.https.html": [
+   "3b89e9e5a43f2a6791ac5a5e3b58552a696420f8",
+   "testharness"
+  ],
+  "bluetooth/service/getCharacteristics/gen-reconnect-during.https.html": [
+   "bc66082c4b04df83449fcf883d0e8e96dc3d8b61",
+   "testharness"
+  ],
   "clear-site-data/OWNERS": [
    "8c90c19ce29952d868460d36f7b20120b155992c",
    "support"
@@ -274017,7 +274653,7 @@
    "reftest"
   ],
   "css/css-paint-api/parse-input-arguments-011.https.html": [
-   "15edc8fc44d339514911566fe7cf07ec899cf04a",
+   "b464f59c89fd6b515cdb2e027240b953bcf229d8",
    "reftest"
   ],
   "css/css-paint-api/parse-input-arguments-012.https.html": [
@@ -285184,6 +285820,62 @@
    "f1d2858aa9cea8218cfbc305890c025ccccac5a8",
    "reftest"
   ],
+  "css/css-transforms/transform-transformed-caption-contains-fixed-position-ref.html": [
+   "ce5ab6d5d3b83c27f8cd66fdc8e85812725bbd76",
+   "support"
+  ],
+  "css/css-transforms/transform-transformed-caption-contains-fixed-position.html": [
+   "30c63d6574b9f00e37fdce36c1e97a80dbbe924f",
+   "reftest"
+  ],
+  "css/css-transforms/transform-transformed-tbody-contains-fixed-position-ref.html": [
+   "567ae4674617642d23f0eac59ada4b93107903f6",
+   "support"
+  ],
+  "css/css-transforms/transform-transformed-tbody-contains-fixed-position.html": [
+   "244614107958cdca65167ba3832f567843cc4afd",
+   "reftest"
+  ],
+  "css/css-transforms/transform-transformed-td-contains-fixed-position-ref.html": [
+   "1e4095bbadfbc9a3879039978c04e669685db48a",
+   "support"
+  ],
+  "css/css-transforms/transform-transformed-td-contains-fixed-position.html": [
+   "19b1e18fd2d5130dda71cbbdaeb2b635885f2d20",
+   "reftest"
+  ],
+  "css/css-transforms/transform-transformed-tfoot-contains-fixed-position-ref.html": [
+   "19a31f7e72f5ecf84e084f3099bfe5236aa91250",
+   "support"
+  ],
+  "css/css-transforms/transform-transformed-tfoot-contains-fixed-position.html": [
+   "c70ff55205792ed3c30aac4ad0d8740767dd36e7",
+   "reftest"
+  ],
+  "css/css-transforms/transform-transformed-th-contains-fixed-position-ref.html": [
+   "5cca6be38b37bf8ed975481cf94554a393878114",
+   "support"
+  ],
+  "css/css-transforms/transform-transformed-th-contains-fixed-position.html": [
+   "a3fd389df79f592888aef277595674b7f36acbaf",
+   "reftest"
+  ],
+  "css/css-transforms/transform-transformed-thead-contains-fixed-position-ref.html": [
+   "a75603cfa4f4376a1f6d17e034a4a511ecd47016",
+   "support"
+  ],
+  "css/css-transforms/transform-transformed-thead-contains-fixed-position.html": [
+   "e04fa6c34aae262fe477f0ab632ee7a7dd063de7",
+   "reftest"
+  ],
+  "css/css-transforms/transform-transformed-tr-contains-fixed-position-ref.html": [
+   "9612a07b7d2171bbe7a55948a17a2f4054c2a481",
+   "support"
+  ],
+  "css/css-transforms/transform-transformed-tr-contains-fixed-position.html": [
+   "7d8d62227d3ee736db2c7477a96ea1e5056ea405",
+   "reftest"
+  ],
   "css/css-transforms/transform-translate-001.html": [
    "f7f3a85ab0cd4a84b5cd7e31a60a22845941fab1",
    "reftest"
@@ -296253,7 +296945,7 @@
    "testharness"
   ],
   "css/cssom-view/overscrollBehavior-manual.html": [
-   "65cb71ca6b606dc8b0b527c58902566539e771b2",
+   "785f1d881e9482b84394ef9b3466e7fd9502498e",
    "manual"
   ],
   "css/cssom-view/resources/elementsFromPoint.js": [
@@ -296272,6 +296964,14 @@
    "966ebff69f91c0ea92f4bc2f943df9ef9dc3bcf9",
    "testharness"
   ],
+  "css/cssom-view/scrollIntoView-scrollMargin.html": [
+   "b8f09964bb93bc562992c454cf7779f8bfa3be62",
+   "testharness"
+  ],
+  "css/cssom-view/scrollIntoView-scrollPadding.html": [
+   "cc6309f95e1d053aea7b1b5ac97fee219970f852",
+   "testharness"
+  ],
   "css/cssom-view/scrollIntoView-shadow.html": [
    "3c4a18992105fd7bf19cbf29f0b6d80cb12ca98c",
    "testharness"
@@ -306880,6 +307580,38 @@
    "4239ec4ef240e199f15a38145d478d2c0aa43ad2",
    "support"
   ],
+  "feature-policy/experimental-features/resources/feature-policy-image.html": [
+   "7ac7a5803b60a4f95b454aa44e0a79f363cffade",
+   "support"
+  ],
+  "feature-policy/experimental-features/resources/image.jpg": [
+   "8edf07742134d02b486ee8bdb5fa8e9043875183",
+   "support"
+  ],
+  "feature-policy/experimental-features/resources/image.png": [
+   "a2f7334bd0884f51ce49f529a745a343bdb44a1d",
+   "support"
+  ],
+  "feature-policy/experimental-features/resources/image.svg": [
+   "39f716f4bc22283fc444ea0b3a807ae426e2aadf",
+   "support"
+  ],
+  "feature-policy/experimental-features/resources/video.ogv": [
+   "7c6d80135c0688eb5ef5e79351c8ebbd24cb7d77",
+   "support"
+  ],
+  "feature-policy/experimental-features/unsized-image.tentative.https.sub-expected.txt": [
+   "18ed353c15f61f323c9130b30af67c6e0093ced4",
+   "support"
+  ],
+  "feature-policy/experimental-features/unsized-image.tentative.https.sub.html": [
+   "ac063a3e3084a9416a272bbac413016124e5289f",
+   "testharness"
+  ],
+  "feature-policy/experimental-features/unsized-image.tentative.https.sub.html.headers": [
+   "2ae1da8e026e63625a6168b842303cc156963ced",
+   "support"
+  ],
   "feature-policy/payment-allowed-by-feature-policy-attribute-redirect-on-load.https.sub.html": [
    "22d155755cd7aaff8a1c40c597468066f01eb13b",
    "testharness"
@@ -308552,6 +309284,54 @@
    "ea9edf12752af0a97cd9fe825ae927bd07090a56",
    "testharness"
   ],
+  "graphics-aam/graphics-document_on_html_element-manual-expected.txt": [
+   "026a358d7d6993eaee5cb4df5da748c7184acd7b",
+   "support"
+  ],
+  "graphics-aam/graphics-document_on_html_element-manual.html": [
+   "199638ab8b60fd4c795adfb1ef6eae22a36e6fc6",
+   "manual"
+  ],
+  "graphics-aam/graphics-document_on_svg_element-manual-expected.txt": [
+   "29ed57128920e71b7613afef0c093b5a347f284b",
+   "support"
+  ],
+  "graphics-aam/graphics-document_on_svg_element-manual.html": [
+   "126688d4b899c2b718914a9e7454f4ff14e21ae3",
+   "manual"
+  ],
+  "graphics-aam/graphics-object_on_html_element-manual-expected.txt": [
+   "511c9e308e3859dca328f234bac07d6a831db128",
+   "support"
+  ],
+  "graphics-aam/graphics-object_on_html_element-manual.html": [
+   "7529fffa48b2f0ef3cad4860ce6c3cbf8d05602a",
+   "manual"
+  ],
+  "graphics-aam/graphics-object_on_svg_element-manual-expected.txt": [
+   "c1aa6097e7711a47d3ba53d84c634c8880ddf801",
+   "support"
+  ],
+  "graphics-aam/graphics-object_on_svg_element-manual.html": [
+   "ae94b8f962584ba8afa6ccb40c992a597bb9d9af",
+   "manual"
+  ],
+  "graphics-aam/graphics-symbol_on_html_element-manual-expected.txt": [
+   "76ee2c4f8847fe33da93d1647e5cd57fc4ab5741",
+   "support"
+  ],
+  "graphics-aam/graphics-symbol_on_html_element-manual.html": [
+   "1139a213f51ace79293632e5bd928c961c863711",
+   "manual"
+  ],
+  "graphics-aam/graphics-symbol_on_svg_element-manual-expected.txt": [
+   "04428eb369fbfe592afdd82eb2c9264452cb8f82",
+   "support"
+  ],
+  "graphics-aam/graphics-symbol_on_svg_element-manual.html": [
+   "52b2e48333492373708b86cf558e578b04ac5977",
+   "manual"
+  ],
   "gyroscope/Gyroscope-disabled-by-feature-policy.https.html": [
    "bc6f85cb3506d3e3e062eef43dca88bf3a4ebe89",
    "testharness"
@@ -327928,6 +328708,10 @@
    "d5aa250e8cba8384f47fca2c559aa6a310dff457",
    "support"
   ],
+  "http/tests/bluetooth/https/requestDevice/cross-origin-iframe.sub.https.html": [
+   "dc9df7886d4a020b1853d7a54d67a8b1249c56c7",
+   "testharness"
+  ],
   "imagebitmap-renderingcontext/OWNERS": [
    "942d0f99fe9687279413b61f54edf6d59492dcc0",
    "support"
@@ -348285,7 +349069,7 @@
    "support"
   ],
   "service-workers/service-worker/fetch-event.https.html": [
-   "8bc3fcb9ba5e3c2694d5993779997507c0337da2",
+   "9d365e1960c873a48cf5378cda7615cbef49f5cd",
    "testharness"
   ],
   "service-workers/service-worker/fetch-frame-resource.https.html": [
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/resources/testhelper.js b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/resources/testhelper.js
index ae2449c..cca80f2 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/resources/testhelper.js
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/resources/testhelper.js
@@ -40,10 +40,10 @@
     case 'CSSTransformValue':
       assert_style_value_array_equals(a, b);
       break;
-    case 'CSSRotation':
+    case 'CSSRotate':
       assert_style_value_equals(a.angle, b.angle);
       // fallthrough
-    case 'CSSTranslation':
+    case 'CSSTranslate':
     case 'CSSScale':
       assert_style_value_equals(a.x, b.x);
       assert_style_value_equals(a.y, b.y);
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-normalization/transformvalue-normalization.tentative.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-normalization/transformvalue-normalization.tentative.html
index 5725f467..25b980b 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-normalization/transformvalue-normalization.tentative.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-normalization/transformvalue-normalization.tentative.html
@@ -35,32 +35,32 @@
 const gTestCases = [
   {
     cssText: 'translate(1px)',
-    expected: new CSSTranslation(CSS.px(1), CSS.px(0)),
+    expected: new CSSTranslate(CSS.px(1), CSS.px(0)),
     desc: 'translate() with X'
   },
   {
     cssText: 'translate(1%, 1px)',
-    expected: new CSSTranslation(CSS.percent(1), CSS.px(1)),
+    expected: new CSSTranslate(CSS.percent(1), CSS.px(1)),
     desc: 'translate() with X and Y'
   },
   {
     cssText: 'translateX(1%)',
-    expected: new CSSTranslation(CSS.percent(1), CSS.px(0)),
+    expected: new CSSTranslate(CSS.percent(1), CSS.px(0)),
     desc: 'translateX()'
   },
   {
     cssText: 'translateY(1px)',
-    expected: new CSSTranslation(CSS.px(0), CSS.px(1)),
+    expected: new CSSTranslate(CSS.px(0), CSS.px(1)),
     desc: 'translateY()'
   },
   {
     cssText: 'translate3d(1px, 2%, 3px)',
-    expected: new CSSTranslation(CSS.px(1), CSS.percent(2), CSS.px(3)),
+    expected: new CSSTranslate(CSS.px(1), CSS.percent(2), CSS.px(3)),
     desc: 'translate3d()'
   },
   {
     cssText: 'translateZ(1px)',
-    expected: new CSSTranslation(CSS.px(0), CSS.px(0), CSS.px(1)),
+    expected: new CSSTranslate(CSS.px(0), CSS.px(0), CSS.px(1)),
     desc: 'translateZ()'
   },
   {
@@ -95,27 +95,27 @@
   },
   {
     cssText: 'rotate(90deg)',
-    expected: new CSSRotation(CSS.deg(90)),
+    expected: new CSSRotate(CSS.deg(90)),
     desc: 'rotate()'
   },
   {
     cssText: 'rotate3d(1, 2, 3, 90deg)',
-    expected: new CSSRotation(CSS.number(1), CSS.number(2), CSS.number(3), CSS.deg(90)),
+    expected: new CSSRotate(CSS.number(1), CSS.number(2), CSS.number(3), CSS.deg(90)),
     desc: 'rotate3d()'
   },
   {
     cssText: 'rotateX(90deg)',
-    expected: new CSSRotation(CSS.number(1), CSS.number(0), CSS.number(0), CSS.deg(90)),
+    expected: new CSSRotate(CSS.number(1), CSS.number(0), CSS.number(0), CSS.deg(90)),
     desc: 'rotateX()'
   },
   {
     cssText: 'rotateY(90deg)',
-    expected: new CSSRotation(CSS.number(0), CSS.number(1), CSS.number(0), CSS.deg(90)),
+    expected: new CSSRotate(CSS.number(0), CSS.number(1), CSS.number(0), CSS.deg(90)),
     desc: 'rotateY()'
   },
   {
     cssText: 'rotateZ(90deg)',
-    expected: new CSSRotation(CSS.number(0), CSS.number(0), CSS.number(1), CSS.deg(90)),
+    expected: new CSSRotate(CSS.number(0), CSS.number(0), CSS.number(1), CSS.deg(90)),
     desc: 'rotateZ()'
   },
   {
@@ -155,8 +155,8 @@
   test_transform_normalization(t,
       'translate(1px) rotateX(90deg) perspective(1px) skew(90deg) scale3d(1, 2, 3)',
       new CSSTransformValue([
-        new CSSTranslation(CSS.px(1), CSS.px(0)),
-        new CSSRotation(CSS.number(1), CSS.number(0), CSS.number(0), CSS.deg(90)),
+        new CSSTranslate(CSS.px(1), CSS.px(0)),
+        new CSSRotate(CSS.number(1), CSS.number(0), CSS.number(0), CSS.deg(90)),
         new CSSPerspective(CSS.px(1)),
         new CSSSkew(CSS.deg(90), CSS.deg(0)),
         new CSSScale(CSS.number(1), CSS.number(2), CSS.number(3)),
@@ -167,7 +167,7 @@
   test_transform_normalization(t,
       'translate(calc(1px + 1em)) perspective(calc(1px + 1em))',
       new CSSTransformValue([
-        new CSSTranslation(new CSSMathSum(CSS.px(1), CSS.em(1)), CSS.px(0)),
+        new CSSTranslate(new CSSMathSum(CSS.px(1), CSS.em(1)), CSS.px(0)),
         new CSSPerspective(new CSSMathSum(CSS.px(1), CSS.em(1))),
       ]));
 }, 'Normalizing transforms with calc values contains CSSMathValues');
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-serialization/cssTransformValue.tentative.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-serialization/cssTransformValue.tentative.html
index 5f09cfd..8662b4f 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-serialization/cssTransformValue.tentative.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-serialization/cssTransformValue.tentative.html
@@ -10,14 +10,14 @@
 
 const gTestCases = [
   {
-    value: new CSSTranslation(CSS.percent(1), CSS.px(1)),
+    value: new CSSTranslate(CSS.percent(1), CSS.px(1)),
     cssText: 'translate(1%, 1px)',
-    desc: 'CSSTranslation with 2 arguments'
+    desc: 'CSSTranslate with 2 arguments'
   },
   {
-    value: new CSSTranslation(CSS.px(1), CSS.percent(2), CSS.px(3)),
+    value: new CSSTranslate(CSS.px(1), CSS.percent(2), CSS.px(3)),
     cssText: 'translate3d(1px, 2%, 3px)',
-    desc: 'CSSTranslation with 3 arguments'
+    desc: 'CSSTranslate with 3 arguments'
   },
   {
     value: new CSSScale(CSS.number(2), CSS.number(3)),
@@ -30,14 +30,14 @@
     desc: 'CSSScale with 3 arguments'
   },
   {
-    value: new CSSRotation(CSS.deg(90)),
+    value: new CSSRotate(CSS.deg(90)),
     cssText: 'rotate(90deg)',
-    desc: 'CSSRotation with 1 argument'
+    desc: 'CSSRotate with 1 argument'
   },
   {
-    value: new CSSRotation(CSS.number(1), CSS.number(2), CSS.number(3), CSS.deg(90)),
+    value: new CSSRotate(CSS.number(1), CSS.number(2), CSS.number(3), CSS.deg(90)),
     cssText: 'rotate3d(1, 2, 3, 90deg)',
-    desc: 'CSSRotation with 4 arguments'
+    desc: 'CSSRotate with 4 arguments'
   },
   {
     value: new CSSSkew(CSS.deg(90), CSS.deg(45)),
@@ -56,8 +56,8 @@
   },
   {
     value: new CSSTransformValue([
-      new CSSTranslation(CSS.px(1), CSS.px(0)),
-      new CSSRotation(CSS.deg(90)),
+      new CSSTranslate(CSS.px(1), CSS.px(0)),
+      new CSSRotate(CSS.deg(90)),
       new CSSPerspective(CSS.px(1)),
       new CSSSkew(CSS.deg(90), CSS.deg(45)),
       new CSSScale(CSS.number(1), CSS.number(2), CSS.number(3)),
@@ -67,8 +67,8 @@
   },
   {
     value: new CSSTransformValue([
-      new CSSTranslation(new CSSMathSum(CSS.px(1), CSS.em(1)), CSS.px(0)),
-      new CSSRotation(new CSSMathSum(CSS.deg(90), CSS.turn(1))),
+      new CSSTranslate(new CSSMathSum(CSS.px(1), CSS.em(1)), CSS.px(0)),
+      new CSSRotate(new CSSMathSum(CSS.deg(90), CSS.turn(1))),
       new CSSPerspective(new CSSMathSum(CSS.px(1), CSS.em(1))),
       new CSSSkew(new CSSMathProduct(CSS.deg(90), 2), new CSSMathProduct(CSS.turn(1), 2)),
       new CSSScale(
@@ -100,8 +100,8 @@
 
 test(() => {
   let result = new CSSTransformValue([
-    new CSSTranslation(CSS.px(1), CSS.px(2), CSS.px(3)),
-    new CSSRotation(1, 2, 3, CSS.deg(90)),
+    new CSSTranslate(CSS.px(1), CSS.px(2), CSS.px(3)),
+    new CSSRotate(1, 2, 3, CSS.deg(90)),
     new CSSScale(1, 2, 3),
   ]);
 
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-subclasses/cssRotation.tentative.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-subclasses/cssRotate.tentative.html
similarity index 60%
rename from third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-subclasses/cssRotation.tentative.html
rename to third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-subclasses/cssRotate.tentative.html
index 955d940..17490dce 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-subclasses/cssRotation.tentative.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-subclasses/cssRotate.tentative.html
@@ -1,7 +1,7 @@
 <!doctype html>
 <meta charset="utf-8">
-<title>CSSRotation tests</title>
-<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#cssrotation">
+<title>CSSRotate tests</title>
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#cssrotate">
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <script src="../resources/testhelper.js"></script>
@@ -20,57 +20,57 @@
 
 for (const {angle, desc} of gInvalidAngleTestCases) {
   test(() => {
-    assert_throws(new TypeError(), () => new CSSRotation(angle));
-    assert_throws(new TypeError(), () => new CSSRotation(0, 0, 0, angle));
-  }, 'Constructing a CSSRotation with ' + desc + ' for the angle throws a TypeError');
+    assert_throws(new TypeError(), () => new CSSRotate(angle));
+    assert_throws(new TypeError(), () => new CSSRotate(0, 0, 0, angle));
+  }, 'Constructing a CSSRotate with ' + desc + ' for the angle throws a TypeError');
 }
 
 for (const {coord, desc} of gInvalidCoordTestCases) {
   test(() => {
-    assert_throws(new TypeError(), () => new CSSRotation(coord, 0, 0, CSS.deg(0)));
-    assert_throws(new TypeError(), () => new CSSRotation(0, coord, 0, CSS.deg(0)));
-    assert_throws(new TypeError(), () => new CSSRotation(0, 0, coord, CSS.deg(0)));
-  }, 'Constructing a CSSRotation with ' + desc + ' for the coordinates throws a TypeError');
+    assert_throws(new TypeError(), () => new CSSRotate(coord, 0, 0, CSS.deg(0)));
+    assert_throws(new TypeError(), () => new CSSRotate(0, coord, 0, CSS.deg(0)));
+    assert_throws(new TypeError(), () => new CSSRotate(0, 0, coord, CSS.deg(0)));
+  }, 'Constructing a CSSRotate with ' + desc + ' for the coordinates throws a TypeError');
 }
 
 for (const attr of ['x', 'y', 'z']) {
   for (const {value, desc} of gInvalidCoordTestCases) {
     test(() => {
-      let result = new CSSRotation(0, 0, 0, CSS.deg(0));
+      let result = new CSSRotate(0, 0, 0, CSS.deg(0));
       assert_throws(new TypeError(), () => result[attr] = value);
       assert_style_value_equals(result[attr], CSS.number(0));
-    }, 'Updating CSSRotation.' + attr + ' to ' + desc + ' throws a TypeError');
+    }, 'Updating CSSRotate.' + attr + ' to ' + desc + ' throws a TypeError');
   }
 }
 
 for (const {angle, desc} of gInvalidAngleTestCases) {
   test(() => {
-    let result = new CSSRotation(CSS.deg(0));
+    let result = new CSSRotate(CSS.deg(0));
     assert_throws(new TypeError(), () => result.angle = angle);
     assert_style_value_equals(result.angle, CSS.deg(0));
-  }, 'Updating CSSRotation.angle to ' + desc + ' throws a TypeError');
+  }, 'Updating CSSRotate.angle to ' + desc + ' throws a TypeError');
 }
 
 test(() => {
-  const result = new CSSRotation(CSS.deg(3.14));
+  const result = new CSSRotate(CSS.deg(3.14));
   assert_style_value_equals(result.x, CSS.number(0));
   assert_style_value_equals(result.y, CSS.number(0));
   assert_style_value_equals(result.z, CSS.number(1));
   assert_style_value_equals(result.angle, CSS.deg(3.14));
   assert_true(result.is2D);
-}, 'CSSRotation can be constructed from a single angle');
+}, 'CSSRotate can be constructed from a single angle');
 
 test(() => {
-  const result = new CSSRotation(-3.14, CSS.number(3.14), 3.14, CSS.deg(3.14));
+  const result = new CSSRotate(-3.14, CSS.number(3.14), 3.14, CSS.deg(3.14));
   assert_style_value_equals(result.x, CSS.number(-3.14));
   assert_style_value_equals(result.y, CSS.number(3.14));
   assert_style_value_equals(result.z, CSS.number(3.14));
   assert_style_value_equals(result.angle, CSS.deg(3.14));
   assert_false(result.is2D);
-}, 'CSSRotation can be constructed from numberish coordinates');
+}, 'CSSRotate can be constructed from numberish coordinates');
 
 test(() => {
-  const result = new CSSRotation(
+  const result = new CSSRotate(
     new CSSMathSum(-3.14),
     new CSSMathProduct(3.14),
     new CSSMathNegate(-3.14),
@@ -81,46 +81,46 @@
   assert_style_value_equals(result.z, new CSSMathNegate(-3.14));
   assert_style_value_equals(result.angle, new CSSMathMax(CSS.deg(3.14)));
   assert_false(result.is2D);
-}, 'CSSRotation can be constructed from CSSMathValues');
+}, 'CSSRotate can be constructed from CSSMathValues');
 
 for (const attr of ['x', 'y', 'z']) {
   test(() => {
-    let result = new CSSRotation(0, 0, 0, CSS.deg(0));
+    let result = new CSSRotate(0, 0, 0, CSS.deg(0));
     result[attr] = 3.14;
     assert_style_value_equals(result[attr], CSS.number(3.14));
-  }, 'CSSRotation.' + attr + ' can be updated to a double');
+  }, 'CSSRotate.' + attr + ' can be updated to a double');
 
   test(() => {
-    let result = new CSSRotation(0, 0, 0, CSS.deg(0));
+    let result = new CSSRotate(0, 0, 0, CSS.deg(0));
     result[attr] = CSS.number(3.14);
     assert_style_value_equals(result[attr], CSS.number(3.14));
-  }, 'CSSRotation.' + attr + ' can be updated to a number CSSUnitValue');
+  }, 'CSSRotate.' + attr + ' can be updated to a number CSSUnitValue');
 
   test(() => {
-    let result = new CSSRotation(0, 0, 0, CSS.deg(0));
+    let result = new CSSRotate(0, 0, 0, CSS.deg(0));
     result[attr] = new CSSMathSum(3.14);
     assert_style_value_equals(result[attr], new CSSMathSum(3.14));
-  }, 'CSSRotation.' + attr + ' can be updated to a CSSMathValue matching <number>');
+  }, 'CSSRotate.' + attr + ' can be updated to a CSSMathValue matching <number>');
 }
 
 test(() => {
-  let rotation = new CSSRotation(CSS.deg(0));
+  let rotation = new CSSRotate(CSS.deg(0));
   rotation.angle = CSS.deg(6);
   assert_style_value_equals(rotation.angle, CSS.deg(6));
-}, 'CSSRotation.angle can be updated to a degree CSSUnitValue');
+}, 'CSSRotate.angle can be updated to a degree CSSUnitValue');
 
 test(() => {
-  let rotation = new CSSRotation(CSS.deg(0));
+  let rotation = new CSSRotate(CSS.deg(0));
   rotation.angle = new CSSMathSum(CSS.deg(3.14));
   assert_style_value_equals(rotation.angle, new CSSMathSum(CSS.deg(3.14)));
-}, 'CSSRotation.angle can be updated to a CSSMathValue matching <angle>');
+}, 'CSSRotate.angle can be updated to a CSSMathValue matching <angle>');
 
 test(() => {
-  let rotation = new CSSRotation(CSS.deg(0));
+  let rotation = new CSSRotate(CSS.deg(0));
   rotation.is2D = true;
   assert_true(rotation.is2D);
   rotation.is2D = false;
   assert_false(rotation.is2D);
-}, 'Modifying CSSRotation.is2D can be updated to true or false');
+}, 'Modifying CSSRotate.is2D can be updated to true or false');
 
 </script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-subclasses/cssTransformValue.tentative.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-subclasses/cssTransformValue.tentative.html
index 16b46c1..b16d7369 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-subclasses/cssTransformValue.tentative.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-subclasses/cssTransformValue.tentative.html
@@ -19,8 +19,8 @@
 test(() => {
   const values = [
     new CSSScale(1, 1),
-    new CSSTranslation(CSS.px(1), CSS.px(1)),
-    new CSSRotation(CSS.deg(90))
+    new CSSTranslate(CSS.px(1), CSS.px(1)),
+    new CSSRotate(CSS.deg(90))
   ];
 
   const transform = new CSSTransformValue(values);
@@ -30,7 +30,7 @@
 test(() => {
   const transform = new CSSTransformValue([
     new CSSScale(1, 1),
-    new CSSTranslation(CSS.px(1), CSS.px(1), CSS.px(1)),
+    new CSSTranslate(CSS.px(1), CSS.px(1), CSS.px(1)),
     new CSSScale(1, 1)
   ]);
   assert_equals(transform.is2D, false);
@@ -39,7 +39,7 @@
 test(() => {
   const transform = new CSSTransformValue([
     new CSSScale(1, 1),
-    new CSSTranslation(CSS.px(1), CSS.px(1)),
+    new CSSTranslate(CSS.px(1), CSS.px(1)),
     new CSSScale(1, 1)
   ]);
   assert_equals(transform.is2D, true);
@@ -52,25 +52,25 @@
 }, 'CSSTransformValue.is2D is readonly');
 
 test(() => {
-  assert_throws(new TypeError(), () => new CSSTransformValue([new CSSTranslation(CSS.px(1), CSS.em(1))]).toMatrix());
+  assert_throws(new TypeError(), () => new CSSTransformValue([new CSSTranslate(CSS.px(1), CSS.em(1))]).toMatrix());
   assert_throws(new TypeError(), () => new CSSTransformValue([new CSSPerspective(CSS.em(1))]).toMatrix());
 }, 'Calling CSSTransformValue.toMatrix containing relative units throws TypeError');
 
 test(() => {
   const transform = new CSSTransformValue([
-    new CSSTranslation(CSS.px(1), CSS.px(2), CSS.px(3))
+    new CSSTranslate(CSS.px(1), CSS.px(2), CSS.px(3))
   ]);
   const expectedMatrix = (new DOMMatrixReadOnly()).translate(1, 2, 3);
   assert_matrix_approx_equals(transform.toMatrix(), expectedMatrix, 1e-8);
-}, 'CSSTransformValue.toMatrix returns correct matrix for CSSTranslation');
+}, 'CSSTransformValue.toMatrix returns correct matrix for CSSTranslate');
 
 test(() => {
   const transform = new CSSTransformValue([
-    new CSSRotation(CSS.number(1), CSS.number(2), CSS.number(3), CSS.deg(90))
+    new CSSRotate(CSS.number(1), CSS.number(2), CSS.number(3), CSS.deg(90))
   ]);
   const expectedMatrix = (new DOMMatrixReadOnly()).rotateAxisAngle(1, 2, 3, 90);
   assert_matrix_approx_equals(transform.toMatrix(), expectedMatrix, EPSILON);
-}, 'CSSTransformValue.toMatrix returns correct matrix for CSSRotation');
+}, 'CSSTransformValue.toMatrix returns correct matrix for CSSRotate');
 
 test(() => {
   const transform = new CSSTransformValue([
@@ -133,8 +133,8 @@
 test(() => {
   const transformMatrix = new DOMMatrixReadOnly([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16]);
   let transformArray = [
-    new CSSTranslation(CSS.px(1), CSS.px(1), CSS.px(1)),
-    new CSSRotation(1, 2, 3, CSS.deg(90)),
+    new CSSTranslate(CSS.px(1), CSS.px(1), CSS.px(1)),
+    new CSSRotate(1, 2, 3, CSS.deg(90)),
     new CSSScale(2, 3, 2),
     new CSSMatrixComponent(transformMatrix),
   ];
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-subclasses/cssTranslate.tentative.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-subclasses/cssTranslate.tentative.html
new file mode 100644
index 0000000..7ce281d4
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-subclasses/cssTranslate.tentative.html
@@ -0,0 +1,110 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>CSSTranslate tests</title>
+<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#csstranslate">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="../resources/testhelper.js"></script>
+<script>
+'use strict';
+
+const gInvalidCoordTestCases = [
+  { coord: CSS.deg(1), desc: 'a CSSUnitValue with type other than length or percent'},
+  { coord: new CSSMathSum(CSS.deg(1)), desc: 'a CSSMathValue that doesn\'t match <length-percentage>'},
+];
+
+for (const {coord, desc} of gInvalidCoordTestCases) {
+  test(() => {
+    assert_throws(new TypeError(), () => new CSSTranslate(coord, CSS.px(0), CSS.px(0)));
+    assert_throws(new TypeError(), () => new CSSTranslate(CSS.px(0), coord, CSS.px(0)));
+    assert_throws(new TypeError(), () => new CSSTranslate(CSS.px(0), CSS.px(0), coord));
+  }, 'Constructing a CSSTranslate with ' + desc + ' for the coordinates throws a TypeError');
+}
+
+test(() => {
+  assert_throws(new TypeError(), () => new CSSTranslate(CSS.px(0), CSS.px(0), CSS.percent(0)));
+}, 'Constructing a CSSTranslate with a percent for the Z coordinate throws a TypeError');
+
+for (const attr of ['x', 'y', 'z']) {
+  for (const {value, desc} of gInvalidCoordTestCases) {
+    test(() => {
+      let result = new CSSTranslate(CSS.px(0), CSS.px(0), CSS.px(0));
+      assert_throws(new TypeError(), () => result[attr] = value);
+      assert_style_value_equals(result[attr], CSS.px(0));
+    }, 'Updating CSSTranslate.' + attr + ' to ' + desc + ' throws a TypeError');
+  }
+}
+
+test(() => {
+  let result = new CSSTranslate(CSS.px(0), CSS.px(0), CSS.px(0));
+  assert_throws(new TypeError(), () => result.z = CSS.percent(0));
+  assert_style_value_equals(result.z, CSS.px(0));
+}, 'Updating CSSTranslate.z to a percent throws a TypeError');
+
+test(() => {
+  const result = new CSSTranslate(CSS.px(-3.14), CSS.percent(3.14));
+  assert_style_value_equals(result.x, CSS.px(-3.14));
+  assert_style_value_equals(result.y, CSS.percent(3.14));
+  assert_style_value_equals(result.z, CSS.px(0));
+  assert_true(result.is2D);
+}, 'CSSTranslate can be constructed from two length or percent coordinates');
+
+test(() => {
+  const result = new CSSTranslate(CSS.px(-3.14), CSS.percent(3.14), CSS.px(10));
+  assert_style_value_equals(result.x, CSS.px(-3.14));
+  assert_style_value_equals(result.y, CSS.percent(3.14));
+  assert_style_value_equals(result.z, CSS.px(10));
+  assert_false(result.is2D);
+}, 'CSSTranslate can be constructed from three length or percent coordinates');
+
+test(() => {
+  const result = new CSSTranslate(new CSSMathSum(CSS.px(-3.14)), new CSSMathSum(CSS.percent(3.14)));
+  assert_style_value_equals(result.x, new CSSMathSum(CSS.px(-3.14)));
+  assert_style_value_equals(result.y, new CSSMathSum(CSS.percent(3.14)));
+  assert_style_value_equals(result.z, CSS.px(0));
+  assert_true(result.is2D);
+}, 'CSSTranslate can be constructed from CSSMathValues');
+
+for (const attr of ['x', 'y']) {
+  test(() => {
+    let result = new CSSTranslate(CSS.px(0), CSS.px(0), CSS.px(0));
+    result[attr] = CSS.px(3.14);
+    assert_style_value_equals(result[attr], CSS.px(3.14));
+  }, 'CSSTranslate.' + attr + ' can be updated to a length');
+
+  test(() => {
+    let result = new CSSTranslate(CSS.px(0), CSS.px(0), CSS.px(0));
+    result[attr] = CSS.percent(3.14);
+    assert_style_value_equals(result[attr], CSS.percent(3.14));
+  }, 'CSSTranslate.' + attr + ' can be updated to a percent');
+
+  test(() => {
+    let result = new CSSTranslate(CSS.px(0), CSS.px(0), CSS.px(0));
+    result[attr] = new CSSMathSum(CSS.px(3.14));
+    assert_style_value_equals(result[attr], new CSSMathSum(CSS.px(3.14)));
+    result[attr] = new CSSMathSum(CSS.percent(3.14));
+    assert_style_value_equals(result[attr], new CSSMathSum(CSS.percent(3.14)));
+  }, 'CSSTranslate.' + attr + ' can be updated to a CSSMathValue');
+}
+
+test(() => {
+  let result = new CSSTranslate(CSS.px(0), CSS.px(0), CSS.px(0));
+  result.z = CSS.px(3.14);
+  assert_style_value_equals(result.z, CSS.px(3.14));
+}, 'CSSTranslate.z can be updated to a length');
+
+test(() => {
+  let result = new CSSTranslate(CSS.px(0), CSS.px(0), CSS.px(0));
+  result.z = new CSSMathSum(CSS.px(3.14));
+  assert_style_value_equals(result.z, new CSSMathSum(CSS.px(3.14)));
+}, 'CSSTranslate.z can be updated to a CSSMathValue');
+
+test(() => {
+  let result = new CSSTranslate(CSS.px(0), CSS.px(0));
+  result.is2D = true;
+  assert_true(result.is2D);
+  result.is2D = false;
+  assert_false(result.is2D);
+}, 'Modifying CSSTranslate.is2D can be updated to true or false');
+
+</script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-subclasses/cssTranslation.tentative.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-subclasses/cssTranslation.tentative.html
deleted file mode 100644
index 808b0a1b..0000000
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-subclasses/cssTranslation.tentative.html
+++ /dev/null
@@ -1,110 +0,0 @@
-<!doctype html>
-<meta charset="utf-8">
-<title>CSSTranslation tests</title>
-<link rel="help" href="https://drafts.css-houdini.org/css-typed-om-1/#csstranslation">
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
-<script src="../resources/testhelper.js"></script>
-<script>
-'use strict';
-
-const gInvalidCoordTestCases = [
-  { coord: CSS.deg(1), desc: 'a CSSUnitValue with type other than length or percent'},
-  { coord: new CSSMathSum(CSS.deg(1)), desc: 'a CSSMathValue that doesn\'t match <length-percentage>'},
-];
-
-for (const {coord, desc} of gInvalidCoordTestCases) {
-  test(() => {
-    assert_throws(new TypeError(), () => new CSSTranslation(coord, CSS.px(0), CSS.px(0)));
-    assert_throws(new TypeError(), () => new CSSTranslation(CSS.px(0), coord, CSS.px(0)));
-    assert_throws(new TypeError(), () => new CSSTranslation(CSS.px(0), CSS.px(0), coord));
-  }, 'Constructing a CSSTranslation with ' + desc + ' for the coordinates throws a TypeError');
-}
-
-test(() => {
-  assert_throws(new TypeError(), () => new CSSTranslation(CSS.px(0), CSS.px(0), CSS.percent(0)));
-}, 'Constructing a CSSTranslation with a percent for the Z coordinate throws a TypeError');
-
-for (const attr of ['x', 'y', 'z']) {
-  for (const {value, desc} of gInvalidCoordTestCases) {
-    test(() => {
-      let result = new CSSTranslation(CSS.px(0), CSS.px(0), CSS.px(0));
-      assert_throws(new TypeError(), () => result[attr] = value);
-      assert_style_value_equals(result[attr], CSS.px(0));
-    }, 'Updating CSSTranslation.' + attr + ' to ' + desc + ' throws a TypeError');
-  }
-}
-
-test(() => {
-  let result = new CSSTranslation(CSS.px(0), CSS.px(0), CSS.px(0));
-  assert_throws(new TypeError(), () => result.z = CSS.percent(0));
-  assert_style_value_equals(result.z, CSS.px(0));
-}, 'Updating CSSTranslation.z to a percent throws a TypeError');
-
-test(() => {
-  const result = new CSSTranslation(CSS.px(-3.14), CSS.percent(3.14));
-  assert_style_value_equals(result.x, CSS.px(-3.14));
-  assert_style_value_equals(result.y, CSS.percent(3.14));
-  assert_style_value_equals(result.z, CSS.px(0));
-  assert_true(result.is2D);
-}, 'CSSTranslation can be constructed from two length or percent coordinates');
-
-test(() => {
-  const result = new CSSTranslation(CSS.px(-3.14), CSS.percent(3.14), CSS.px(10));
-  assert_style_value_equals(result.x, CSS.px(-3.14));
-  assert_style_value_equals(result.y, CSS.percent(3.14));
-  assert_style_value_equals(result.z, CSS.px(10));
-  assert_false(result.is2D);
-}, 'CSSTranslation can be constructed from three length or percent coordinates');
-
-test(() => {
-  const result = new CSSTranslation(new CSSMathSum(CSS.px(-3.14)), new CSSMathSum(CSS.percent(3.14)));
-  assert_style_value_equals(result.x, new CSSMathSum(CSS.px(-3.14)));
-  assert_style_value_equals(result.y, new CSSMathSum(CSS.percent(3.14)));
-  assert_style_value_equals(result.z, CSS.px(0));
-  assert_true(result.is2D);
-}, 'CSSTranslation can be constructed from CSSMathValues');
-
-for (const attr of ['x', 'y']) {
-  test(() => {
-    let result = new CSSTranslation(CSS.px(0), CSS.px(0), CSS.px(0));
-    result[attr] = CSS.px(3.14);
-    assert_style_value_equals(result[attr], CSS.px(3.14));
-  }, 'CSSTranslation.' + attr + ' can be updated to a length');
-
-  test(() => {
-    let result = new CSSTranslation(CSS.px(0), CSS.px(0), CSS.px(0));
-    result[attr] = CSS.percent(3.14);
-    assert_style_value_equals(result[attr], CSS.percent(3.14));
-  }, 'CSSTranslation.' + attr + ' can be updated to a percent');
-
-  test(() => {
-    let result = new CSSTranslation(CSS.px(0), CSS.px(0), CSS.px(0));
-    result[attr] = new CSSMathSum(CSS.px(3.14));
-    assert_style_value_equals(result[attr], new CSSMathSum(CSS.px(3.14)));
-    result[attr] = new CSSMathSum(CSS.percent(3.14));
-    assert_style_value_equals(result[attr], new CSSMathSum(CSS.percent(3.14)));
-  }, 'CSSTranslation.' + attr + ' can be updated to a CSSMathValue');
-}
-
-test(() => {
-  let result = new CSSTranslation(CSS.px(0), CSS.px(0), CSS.px(0));
-  result.z = CSS.px(3.14);
-  assert_style_value_equals(result.z, CSS.px(3.14));
-}, 'CSSTranslation.z can be updated to a length');
-
-test(() => {
-  let result = new CSSTranslation(CSS.px(0), CSS.px(0), CSS.px(0));
-  result.z = new CSSMathSum(CSS.px(3.14));
-  assert_style_value_equals(result.z, new CSSMathSum(CSS.px(3.14)));
-}, 'CSSTranslation.z can be updated to a CSSMathValue');
-
-test(() => {
-  let result = new CSSTranslation(CSS.px(0), CSS.px(0));
-  result.is2D = true;
-  assert_true(result.is2D);
-  result.is2D = false;
-  assert_false(result.is2D);
-}, 'Modifying CSSTranslation.is2D can be updated to true or false');
-
-</script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-subclasses/numeric-objects/cssMathValue.tentative.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-subclasses/numeric-objects/cssMathValue.tentative.html
index 1be4edf..574043e 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-subclasses/numeric-objects/cssMathValue.tentative.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-typed-om/stylevalue-subclasses/numeric-objects/cssMathValue.tentative.html
@@ -59,15 +59,6 @@
     let result = new subclass(CSS.number(1));
     assert_throws(new TypeError(), () => result.operator = 'foo');
   }, subclass.name + '.operator is readonly');
-
-  test(() => {
-    let result = new subclass(0);
-    result.value = CSS.number(1);
-    assert_style_value_equals(result.value, CSS.number(1));
-
-    result.value = 2;
-    assert_style_value_equals(result.value, CSS.number(2));
-  }, subclass.name + '.value can be updated with a numberish value');
 }
 
 </script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/cssom/MediaList.html b/third_party/WebKit/LayoutTests/external/wpt/css/cssom/MediaList.html
index 36154ff..17d4319 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/cssom/MediaList.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/cssom/MediaList.html
@@ -40,6 +40,10 @@
         assert_equals(media[3], undefined, "MediaList indexed getter with out of range after append method");
         assert_equals(media.item(2), "speech", "MediaList item method after append method");
         assert_equals(media.item(3), null, "MediaList item method after append method");
+
+        media.mediaText = null;
+        assert_equals(media.mediaText, "", "MediaList mediaText attribute should be empty string in case of null");
+        assert_equals(media.toString(), "", "MediaList toString method should be empty string in case of null");
     });
     </script>
 </head>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/custom-elements/Document-createElementNS.html b/third_party/WebKit/LayoutTests/external/wpt/custom-elements/Document-createElementNS.html
new file mode 100644
index 0000000..5711a46
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/custom-elements/Document-createElementNS.html
@@ -0,0 +1,43 @@
+<!DOCTYPE html>
+<title>Custom Elements: document.createElementNS should support custom elements</title>
+<link rel="help" content="https://dom.spec.whatwg.org/#concept-create-element">
+<link rel="help" content="https://dom.spec.whatwg.org/#internal-createelementns-steps">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<body>
+<script>
+test(() => {
+  class MyElement extends HTMLElement {};
+
+  customElements.define('my-autonomous', MyElement);
+  let element = document.createElementNS('http://www.w3.org/1999/xhtml', 'p:my-autonomous');
+  assert_true(element instanceof MyElement);
+  assert_equals(element.prefix, 'p');
+}, 'autonomous: document.createElementNS should create custom elements with prefixes.');
+
+test(() => {
+  class MyElement2 extends HTMLElement {};
+
+  customElements.define('my-autonomous2', MyElement2);
+  let element = document.createElementNS('urn:example', 'my-autonomous2');
+  assert_false(element instanceof MyElement2);
+}, 'autonomous: document.createElementNS should check namespaces.');
+
+test(() => {
+  class MyBuiltinElement extends HTMLElement {};
+
+  customElements.define('my-builtin', MyBuiltinElement, { extends: 'address' });
+  let element = document.createElementNS('http://www.w3.org/1999/xhtml', 'p:address', { is: 'my-builtin'});
+  assert_true(element instanceof MyBuiltinElement);
+  assert_equals(element.prefix, 'p');
+}, 'builtin: document.createElementNS should create custom elements with prefixes.');
+
+test(() => {
+  class MyBuiltinElement2 extends HTMLElement {};
+
+  customElements.define('my-builtin2', MyBuiltinElement2, { extends: 'address'});
+  let element = document.createElementNS('urn:example', 'address', { is: 'my-builtin2' });
+  assert_false(element instanceof MyBuiltinElement2);
+}, 'builtin: document.createElementNS should check namespaces.');
+</script>
+</body>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-document_on_html_element-manual-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-document_on_html_element-manual-expected.txt
new file mode 100644
index 0000000..2be08465
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-document_on_html_element-manual-expected.txt
@@ -0,0 +1,4 @@
+This is a testharness.js-based test.
+FAIL graphics-document on HTML element Uncaught ReferenceError: ATTAcomm is not defined
+Harness: the test ran to completion.
+
diff --git a/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-document_on_html_element-manual.html b/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-document_on_html_element-manual.html
new file mode 100644
index 0000000..9e386d55
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-document_on_html_element-manual.html
@@ -0,0 +1,103 @@
+<!doctype html>
+<html>
+  <head>
+    <title>graphics-document on HTML element</title>
+    <meta content="text/html; charset=utf-8" http-equiv="Content-Type"/>
+    <link rel="stylesheet" href="/resources/testharness.css">
+    <link rel="stylesheet" href="/wai-aria/scripts/manual.css">
+    <script src="/resources/testharness.js"></script>
+    <script src="/resources/testharnessreport.js"></script>
+    <script src="/wai-aria/scripts/ATTAcomm.js"></script>
+    <script>
+    setup({explicit_timeout: true, explicit_done: true });
+
+    var theTest = new ATTAcomm(
+    {
+   "steps" : [
+      {
+         "element" : "test",
+         "test" : {
+            "ATK" : [
+               [
+                  "property",
+                  "role",
+                  "is",
+                  "ROLE_DOCUMENT_FRAME"
+               ],
+               [
+                  "property",
+                  "objectAttributes",
+                  "contains",
+                  "xml-roles:graphics-document"
+               ]
+            ],
+            "AXAPI" : [
+               [
+                  "property",
+                  "AXRole",
+                  "is",
+                  "AXGroup"
+               ],
+               [
+                  "property",
+                  "AXSubrole",
+                  "is",
+                  "AXDocument"
+               ],
+               [
+                  "property",
+                  "AXRoleDescription",
+                  "is",
+                  "document"
+               ]
+            ],
+            "IAccessible2" : [
+               [
+                  "property",
+                  "role",
+                  "is",
+                  "ROLE_SYSTEM_DOCUMENT"
+               ],
+               [
+                  "property",
+                  "objectAttributes",
+                  "contains",
+                  "xml-roles:graphics-document"
+               ],
+               [
+                  "property",
+                  "states",
+                  "contains",
+                  "STATE_SYSTEM_READONLY"
+               ]
+            ],
+            "UIA" : [
+               [
+                  "property",
+                  "ControlType",
+                  "is",
+                  "Document"
+               ]
+            ]
+         },
+         "title" : "step 1",
+         "type" : "test"
+      }
+   ],
+   "title" : "graphics-document on HTML element"
+}
+
+    ) ;
+    </script>
+  </head>
+  <body>
+  <p>This test examines the ARIA properties for graphics-document on HTML element.</p>
+    <div id="test" role="graphics-document" aria-label="house">
+    <div role="graphics-object" aria-label="door">
+  </div>
+
+  <div id="manualMode"></div>
+  <div id="log"></div>
+  <div id="ATTAmessages"></div>
+  </body>
+</html>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-document_on_svg_element-manual-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-document_on_svg_element-manual-expected.txt
new file mode 100644
index 0000000..6a1b58d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-document_on_svg_element-manual-expected.txt
@@ -0,0 +1,4 @@
+This is a testharness.js-based test.
+FAIL graphics-document on SVG element Uncaught ReferenceError: ATTAcomm is not defined
+Harness: the test ran to completion.
+
diff --git a/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-document_on_svg_element-manual.html b/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-document_on_svg_element-manual.html
new file mode 100644
index 0000000..4984bc35
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-document_on_svg_element-manual.html
@@ -0,0 +1,106 @@
+<!doctype html>
+<html>
+  <head>
+    <title>graphics-document on SVG element</title>
+    <meta content="text/html; charset=utf-8" http-equiv="Content-Type"/>
+    <link rel="stylesheet" href="/resources/testharness.css">
+    <link rel="stylesheet" href="/wai-aria/scripts/manual.css">
+    <script src="/resources/testharness.js"></script>
+    <script src="/resources/testharnessreport.js"></script>
+    <script src="/wai-aria/scripts/ATTAcomm.js"></script>
+    <script>
+    setup({explicit_timeout: true, explicit_done: true });
+
+    var theTest = new ATTAcomm(
+    {
+   "steps" : [
+      {
+         "element" : "test",
+         "test" : {
+            "ATK" : [
+               [
+                  "property",
+                  "role",
+                  "is",
+                  "ROLE_DOCUMENT_FRAME"
+               ],
+               [
+                  "property",
+                  "objectAttributes",
+                  "contains",
+                  "xml-roles:graphics-document"
+               ]
+            ],
+            "AXAPI" : [
+               [
+                  "property",
+                  "AXRole",
+                  "is",
+                  "AXGroup"
+               ],
+               [
+                  "property",
+                  "AXSubrole",
+                  "is",
+                  "AXDocument"
+               ],
+               [
+                  "property",
+                  "AXRoleDescription",
+                  "is",
+                  "document"
+               ]
+            ],
+            "IAccessible2" : [
+               [
+                  "property",
+                  "role",
+                  "is",
+                  "ROLE_SYSTEM_DOCUMENT"
+               ],
+               [
+                  "property",
+                  "objectAttributes",
+                  "contains",
+                  "xml-roles:graphics-document"
+               ],
+               [
+                  "property",
+                  "states",
+                  "contains",
+                  "STATE_SYSTEM_READONLY"
+               ]
+            ],
+            "UIA" : [
+               [
+                  "property",
+                  "ControlType",
+                  "is",
+                  "Document"
+               ]
+            ]
+         },
+         "title" : "step 1",
+         "type" : "test"
+      }
+   ],
+   "title" : "graphics-document on SVG element"
+}
+
+    ) ;
+    </script>
+  </head>
+  <body>
+  <p>This test examines the ARIA properties for graphics-document on SVG element.</p>
+    <svg xmlns="http://www.w3.org/2000/svg" id="test" role="graphics-document">
+    <g role="graphics-object" aria-label="door">
+      <rect fill="darkKhaki" stroke="#632" width="50" height="90" />
+      <circle fill="gray" stroke="#444" stroke-width="0.7" cx="10" cy="50" r="4" />
+    </g>
+  </svg>
+
+  <div id="manualMode"></div>
+  <div id="log"></div>
+  <div id="ATTAmessages"></div>
+  </body>
+</html>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-object_on_html_element-manual-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-object_on_html_element-manual-expected.txt
new file mode 100644
index 0000000..f735916
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-object_on_html_element-manual-expected.txt
@@ -0,0 +1,4 @@
+This is a testharness.js-based test.
+FAIL graphics-object on HTML element Uncaught ReferenceError: ATTAcomm is not defined
+Harness: the test ran to completion.
+
diff --git a/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-object_on_html_element-manual.html b/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-object_on_html_element-manual.html
new file mode 100644
index 0000000..ea47792
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-object_on_html_element-manual.html
@@ -0,0 +1,97 @@
+<!doctype html>
+<html>
+  <head>
+    <title>graphics-object on HTML element</title>
+    <meta content="text/html; charset=utf-8" http-equiv="Content-Type"/>
+    <link rel="stylesheet" href="/resources/testharness.css">
+    <link rel="stylesheet" href="/wai-aria/scripts/manual.css">
+    <script src="/resources/testharness.js"></script>
+    <script src="/resources/testharnessreport.js"></script>
+    <script src="/wai-aria/scripts/ATTAcomm.js"></script>
+    <script>
+    setup({explicit_timeout: true, explicit_done: true });
+
+    var theTest = new ATTAcomm(
+    {
+   "steps" : [
+      {
+         "element" : "test",
+         "test" : {
+            "ATK" : [
+               [
+                  "property",
+                  "role",
+                  "is",
+                  "ROLE_PANEL"
+               ],
+               [
+                  "property",
+                  "objectAttributes",
+                  "contains",
+                  "xml-roles:graphics-object"
+               ]
+            ],
+            "AXAPI" : [
+               [
+                  "property",
+                  "AXRole",
+                  "is",
+                  "AXGroup"
+               ],
+               [
+                  "property",
+                  "AXSubrole",
+                  "is",
+                  "<nil>"
+               ],
+               [
+                  "property",
+                  "AXRoleDescription",
+                  "is",
+                  "group"
+               ]
+            ],
+            "IAccessible2" : [
+               [
+                  "property",
+                  "role",
+                  "is",
+                  "ROLE_SYSTEM_GROUPING"
+               ],
+               [
+                  "property",
+                  "objectAttributes",
+                  "contains",
+                  "xml-roles:graphics-object"
+               ]
+            ],
+            "UIA" : [
+               [
+                  "property",
+                  "ControlType",
+                  "is",
+                  "Group"
+               ]
+            ]
+         },
+         "title" : "step 1",
+         "type" : "test"
+      }
+   ],
+   "title" : "graphics-object on HTML element"
+}
+
+    ) ;
+    </script>
+  </head>
+  <body>
+  <p>This test examines the ARIA properties for graphics-object on HTML element.</p>
+    <div role="graphics-document" aria-label="house">
+    <div id="test" role="graphics-object" aria-label="door">
+  </div>
+
+  <div id="manualMode"></div>
+  <div id="log"></div>
+  <div id="ATTAmessages"></div>
+  </body>
+</html>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-object_on_svg_element-manual-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-object_on_svg_element-manual-expected.txt
new file mode 100644
index 0000000..e5649930
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-object_on_svg_element-manual-expected.txt
@@ -0,0 +1,4 @@
+This is a testharness.js-based test.
+FAIL graphics-object on SVG element Uncaught ReferenceError: ATTAcomm is not defined
+Harness: the test ran to completion.
+
diff --git a/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-object_on_svg_element-manual.html b/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-object_on_svg_element-manual.html
new file mode 100644
index 0000000..5c2cf28
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-object_on_svg_element-manual.html
@@ -0,0 +1,100 @@
+<!doctype html>
+<html>
+  <head>
+    <title>graphics-object on SVG element</title>
+    <meta content="text/html; charset=utf-8" http-equiv="Content-Type"/>
+    <link rel="stylesheet" href="/resources/testharness.css">
+    <link rel="stylesheet" href="/wai-aria/scripts/manual.css">
+    <script src="/resources/testharness.js"></script>
+    <script src="/resources/testharnessreport.js"></script>
+    <script src="/wai-aria/scripts/ATTAcomm.js"></script>
+    <script>
+    setup({explicit_timeout: true, explicit_done: true });
+
+    var theTest = new ATTAcomm(
+    {
+   "steps" : [
+      {
+         "element" : "test",
+         "test" : {
+            "ATK" : [
+               [
+                  "property",
+                  "role",
+                  "is",
+                  "ROLE_PANEL"
+               ],
+               [
+                  "property",
+                  "objectAttributes",
+                  "contains",
+                  "xml-roles:graphics-object"
+               ]
+            ],
+            "AXAPI" : [
+               [
+                  "property",
+                  "AXRole",
+                  "is",
+                  "AXGroup"
+               ],
+               [
+                  "property",
+                  "AXSubrole",
+                  "is",
+                  "<nil>"
+               ],
+               [
+                  "property",
+                  "AXRoleDescription",
+                  "is",
+                  "group"
+               ]
+            ],
+            "IAccessible2" : [
+               [
+                  "property",
+                  "role",
+                  "is",
+                  "ROLE_SYSTEM_GROUPING"
+               ],
+               [
+                  "property",
+                  "objectAttributes",
+                  "contains",
+                  "xml-roles:graphics-object"
+               ]
+            ],
+            "UIA" : [
+               [
+                  "property",
+                  "ControlType",
+                  "is",
+                  "Group"
+               ]
+            ]
+         },
+         "title" : "step 1",
+         "type" : "test"
+      }
+   ],
+   "title" : "graphics-object on SVG element"
+}
+
+    ) ;
+    </script>
+  </head>
+  <body>
+  <p>This test examines the ARIA properties for graphics-object on SVG element.</p>
+    <svg xmlns="http://www.w3.org/2000/svg" role="graphics-document">
+    <g id="test" role="graphics-object" aria-label="door">
+      <rect fill="darkKhaki" stroke="#632" width="50" height="90" />
+      <circle fill="gray" stroke="#444" stroke-width="0.7" cx="10" cy="50" r="4" />
+    </g>
+  </svg>
+
+  <div id="manualMode"></div>
+  <div id="log"></div>
+  <div id="ATTAmessages"></div>
+  </body>
+</html>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-symbol_on_html_element-manual-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-symbol_on_html_element-manual-expected.txt
new file mode 100644
index 0000000..f57f1a03b
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-symbol_on_html_element-manual-expected.txt
@@ -0,0 +1,4 @@
+This is a testharness.js-based test.
+FAIL graphics-symbol on HTML element Uncaught ReferenceError: ATTAcomm is not defined
+Harness: the test ran to completion.
+
diff --git a/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-symbol_on_html_element-manual.html b/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-symbol_on_html_element-manual.html
new file mode 100644
index 0000000..59d2d905
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-symbol_on_html_element-manual.html
@@ -0,0 +1,98 @@
+<!doctype html>
+<html>
+  <head>
+    <title>graphics-symbol on HTML element</title>
+    <meta content="text/html; charset=utf-8" http-equiv="Content-Type"/>
+    <link rel="stylesheet" href="/resources/testharness.css">
+    <link rel="stylesheet" href="/wai-aria/scripts/manual.css">
+    <script src="/resources/testharness.js"></script>
+    <script src="/resources/testharnessreport.js"></script>
+    <script src="/wai-aria/scripts/ATTAcomm.js"></script>
+    <script>
+    setup({explicit_timeout: true, explicit_done: true });
+
+    var theTest = new ATTAcomm(
+    {
+   "steps" : [
+      {
+         "element" : "test",
+         "test" : {
+            "ATK" : [
+               [
+                  "property",
+                  "role",
+                  "is",
+                  "ROLE_IMAGE"
+               ],
+               [
+                  "property",
+                  "objectAttributes",
+                  "contains",
+                  "xml-roles:graphics-symbol"
+               ]
+            ],
+            "AXAPI" : [
+               [
+                  "property",
+                  "AXRole",
+                  "is",
+                  "AXImage"
+               ],
+               [
+                  "property",
+                  "AXSubrole",
+                  "is",
+                  "<nil>"
+               ],
+               [
+                  "property",
+                  "AXRoleDescription",
+                  "is",
+                  "image"
+               ]
+            ],
+            "IAccessible2" : [
+               [
+                  "property",
+                  "role",
+                  "is",
+                  "ROLE_SYSTEM_GRAPHIC"
+               ],
+               [
+                  "property",
+                  "objectAttributes",
+                  "contains",
+                  "xml-roles:graphics-symbol"
+               ]
+            ],
+            "UIA" : [
+               [
+                  "property",
+                  "ControlType",
+                  "is",
+                  "Image"
+               ]
+            ]
+         },
+         "title" : "step 1",
+         "type" : "test"
+      }
+   ],
+   "title" : "graphics-symbol on HTML element"
+}
+
+    ) ;
+    </script>
+  </head>
+  <body>
+  <p>This test examines the ARIA properties for graphics-symbol on HTML element.</p>
+    <div>Spinach Salad with Strawberry & Almonds
+    <span id="test" aria-label="vegetarian" role="graphics-symbol">🌿</span>
+    <span aria-label="contains nuts" role="graphics-symbol">🌰</span>
+  </div>
+
+  <div id="manualMode"></div>
+  <div id="log"></div>
+  <div id="ATTAmessages"></div>
+  </body>
+</html>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-symbol_on_svg_element-manual-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-symbol_on_svg_element-manual-expected.txt
new file mode 100644
index 0000000..98a13d5
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-symbol_on_svg_element-manual-expected.txt
@@ -0,0 +1,4 @@
+This is a testharness.js-based test.
+FAIL graphics-symbol on SVG element Uncaught ReferenceError: ATTAcomm is not defined
+Harness: the test ran to completion.
+
diff --git a/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-symbol_on_svg_element-manual.html b/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-symbol_on_svg_element-manual.html
new file mode 100644
index 0000000..6663225
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/graphics-aam/graphics-symbol_on_svg_element-manual.html
@@ -0,0 +1,99 @@
+<!doctype html>
+<html>
+  <head>
+    <title>graphics-symbol on SVG element</title>
+    <meta content="text/html; charset=utf-8" http-equiv="Content-Type"/>
+    <link rel="stylesheet" href="/resources/testharness.css">
+    <link rel="stylesheet" href="/wai-aria/scripts/manual.css">
+    <script src="/resources/testharness.js"></script>
+    <script src="/resources/testharnessreport.js"></script>
+    <script src="/wai-aria/scripts/ATTAcomm.js"></script>
+    <script>
+    setup({explicit_timeout: true, explicit_done: true });
+
+    var theTest = new ATTAcomm(
+    {
+   "steps" : [
+      {
+         "element" : "test",
+         "test" : {
+            "ATK" : [
+               [
+                  "property",
+                  "role",
+                  "is",
+                  "ROLE_IMAGE"
+               ],
+               [
+                  "property",
+                  "objectAttributes",
+                  "contains",
+                  "xml-roles:graphics-symbol"
+               ]
+            ],
+            "AXAPI" : [
+               [
+                  "property",
+                  "AXRole",
+                  "is",
+                  "AXImage"
+               ],
+               [
+                  "property",
+                  "AXSubrole",
+                  "is",
+                  "<nil>"
+               ],
+               [
+                  "property",
+                  "AXRoleDescription",
+                  "is",
+                  "image"
+               ]
+            ],
+            "IAccessible2" : [
+               [
+                  "property",
+                  "role",
+                  "is",
+                  "ROLE_SYSTEM_GRAPHIC"
+               ],
+               [
+                  "property",
+                  "objectAttributes",
+                  "contains",
+                  "xml-roles:graphics-symbol"
+               ]
+            ],
+            "UIA" : [
+               [
+                  "property",
+                  "ControlType",
+                  "is",
+                  "Image"
+               ]
+            ]
+         },
+         "title" : "step 1",
+         "type" : "test"
+      }
+   ],
+   "title" : "graphics-symbol on SVG element"
+}
+
+    ) ;
+    </script>
+  </head>
+  <body>
+  <p>This test examines the ARIA properties for graphics-symbol on SVG element.</p>
+    <svg xmlns="http://www.w3.org/2000/svg">
+    <g id="test" role="graphics-symbol" aria-label="lightbulb">
+      <circle r="10" />
+    </g>
+  </svg>
+
+  <div id="manualMode"></div>
+  <div id="log"></div>
+  <div id="ATTAmessages"></div>
+  </body>
+</html>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/html/semantics/forms/the-input-element/radio-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/html/semantics/forms/the-input-element/radio-expected.txt
deleted file mode 100644
index 8806cd02..0000000
--- a/third_party/WebKit/LayoutTests/external/wpt/html/semantics/forms/the-input-element/radio-expected.txt
+++ /dev/null
@@ -1,11 +0,0 @@
-This is a testharness.js-based test.
-FAIL click on mutable radio fires click event, then input event, then change event assert_true: change event should fire after input event expected true got false
-PASS click on non-mutable radio doesn't fire the input event
-PASS click on non-mutable radio doesn't fire the change event
-PASS canceled activation steps on unchecked radio
-PASS only one control of a radio button group can have its checkedness set to true
-PASS radio inputs with non-ASCII name attributes belong to the same radio button group
-PASS changing the name of a radio input element and setting its checkedness to true makes all the other elements' checkedness in the same radio button group be set to false
-PASS moving radio input element out of or into a form should still work as expected
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/external/wpt/screen-orientation/resources/sandboxed-iframe-locking.html b/third_party/WebKit/LayoutTests/external/wpt/screen-orientation/resources/sandboxed-iframe-locking.html
index 74dac82..48f408b 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/screen-orientation/resources/sandboxed-iframe-locking.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/screen-orientation/resources/sandboxed-iframe-locking.html
@@ -6,13 +6,8 @@
         msg = screen.orientation.type;
     }, function(error) {
         msg = error.name;
-    });
-
-    // FIXME: for the moment, tests gets notified when there is a failure but
-    // not a success, this hack should allow us to still have the test running.
-    // That should be removed as soon as we get a resolved promise in tests.
-    setTimeout(function() {
+    }).then(function() {
         parent.window.postMessage(msg, "*");
-    })
+    });
 </script>
 </html>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting-cache.https.html b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting-image-cache.https.html
similarity index 95%
rename from third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting-cache.https.html
rename to third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting-image-cache.https.html
index 8c34bade..2132381 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting-cache.https.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting-image-cache.https.html
@@ -1,4 +1,5 @@
 <!DOCTYPE html>
+<meta charset="utf-8">
 <title>Service Worker: canvas tainting of the fetched image using cached responses</title>
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting.https.html b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting-image.https.html
similarity index 95%
rename from third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting.https.html
rename to third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting-image.https.html
index 86ed4b4..57dc7d9 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting.https.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting-image.https.html
@@ -1,4 +1,5 @@
 <!DOCTYPE html>
+<meta charset="utf-8">
 <title>Service Worker: canvas tainting of the fetched image</title>
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting-video-cache.https-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting-video-cache.https-expected.txt
new file mode 100644
index 0000000..88cdd90
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting-video-cache.https-expected.txt
@@ -0,0 +1,43 @@
+This is a testharness.js-based test.
+PASS initialize global state
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&reject" with crossOrigin "" should be LOAD_ERROR
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&reject" with crossOrigin "anonymous" should be LOAD_ERROR
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&reject" with crossOrigin "use-credentials" should be LOAD_ERROR
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&ignore" with crossOrigin "" should be NOT_TAINTED
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&ignore" with crossOrigin "" should be TAINTED
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&ignore" with crossOrigin "anonymous" should be LOAD_ERROR
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&ACAOrigin=https://web-platform.test:8444&ignore" with crossOrigin "anonymous" should be NOT_TAINTED
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&ignore" with crossOrigin "use-credentials" should be LOAD_ERROR
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&ACAOrigin=https://web-platform.test:8444&ignore" with crossOrigin "use-credentials" should be LOAD_ERROR
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&ACAOrigin=https://web-platform.test:8444&ACACredentials=true&ignore" with crossOrigin "use-credentials" should be NOT_TAINTED
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&Auth&ignore" with crossOrigin "" should be NOT_TAINTED
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&Auth&ignore" with crossOrigin "" should be TAINTED
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&Auth&ignore" with crossOrigin "anonymous" should be LOAD_ERROR
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&Auth&ignore" with crossOrigin "use-credentials" should be LOAD_ERROR
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&Auth&ACAOrigin=https://web-platform.test:8444&ignore" with crossOrigin "use-credentials" should be LOAD_ERROR
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&Auth&ACAOrigin=https://web-platform.test:8444&ACACredentials=true&ignore" with crossOrigin "use-credentials" should be NOT_TAINTED
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&mode=same-origin&url=https%3A%2F%2Fweb-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26cache%3Dtrue" with crossOrigin "" should be NOT_TAINTED
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&mode=same-origin&url=https%3A%2F%2Fweb-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26cache%3Dtrue" with crossOrigin "anonymous" should be NOT_TAINTED
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&mode=same-origin&url=https%3A%2F%2Fweb-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26cache%3Dtrue" with crossOrigin "use-credentials" should be NOT_TAINTED
+FAIL url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&mode=same-origin&url=https%3A%2F%2Fweb-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26cache%3Dtrue" with crossOrigin "" should be NOT_TAINTED assert_equals: expected "NOT_TAINTED" but got "TAINTED"
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&mode=same-origin&url=https%3A%2F%2Fweb-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26cache%3Dtrue" with crossOrigin "anonymous" should be NOT_TAINTED
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&mode=same-origin&url=https%3A%2F%2Fweb-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26cache%3Dtrue" with crossOrigin "use-credentials" should be NOT_TAINTED
+FAIL url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&mode=no-cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26cache%3Dtrue" with crossOrigin "" should be TAINTED assert_equals: expected "TAINTED" but got "NOT_TAINTED"
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&mode=no-cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26cache%3Dtrue" with crossOrigin "anonymous" should be LOAD_ERROR
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&mode=no-cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26cache%3Dtrue" with crossOrigin "use-credentials" should be LOAD_ERROR
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&mode=no-cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26cache%3Dtrue" with crossOrigin "" should be TAINTED
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&mode=no-cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26cache%3Dtrue" with crossOrigin "anonymous" should be LOAD_ERROR
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&mode=no-cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26cache%3Dtrue" with crossOrigin "use-credentials" should be LOAD_ERROR
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&mode=cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26cache%3Dtrue%26ACAOrigin%3Dhttps%3A%2F%2Fweb-platform.test%3A8444" with crossOrigin "" should be LOAD_ERROR
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&mode=cors&credentials=same-origin&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26cache%3Dtrue%26ACAOrigin%3Dhttps%3A%2F%2Fweb-platform.test%3A8444" with crossOrigin "" should be NOT_TAINTED
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&mode=cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26cache%3Dtrue%26ACAOrigin%3Dhttps%3A%2F%2Fweb-platform.test%3A8444" with crossOrigin "anonymous" should be NOT_TAINTED
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&mode=cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26cache%3Dtrue%26ACAOrigin%3Dhttps%3A%2F%2Fweb-platform.test%3A8444" with crossOrigin "use-credentials" should be LOAD_ERROR
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&mode=cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26cache%3Dtrue%26ACACredentials%3Dtrue%26ACAOrigin%3Dhttps%3A%2F%2Fweb-platform.test%3A8444" with crossOrigin "use-credentials" should be NOT_TAINTED
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&mode=cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26cache%3Dtrue%26ACAOrigin%3Dhttps%3A%2F%2Fweb-platform.test%3A8444" with crossOrigin "" should be LOAD_ERROR
+FAIL url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&mode=cors&credentials=same-origin&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26cache%3Dtrue%26ACAOrigin%3Dhttps%3A%2F%2Fweb-platform.test%3A8444" with crossOrigin "" should be NOT_TAINTED assert_equals: expected "NOT_TAINTED" but got "TAINTED"
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&mode=cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26cache%3Dtrue%26ACAOrigin%3Dhttps%3A%2F%2Fweb-platform.test%3A8444" with crossOrigin "anonymous" should be NOT_TAINTED
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&mode=cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26cache%3Dtrue%26ACAOrigin%3Dhttps%3A%2F%2Fweb-platform.test%3A8444" with crossOrigin "use-credentials" should be LOAD_ERROR
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&cache=true&mode=cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26cache%3Dtrue%26ACACredentials%3Dtrue%26ACAOrigin%3Dhttps%3A%2F%2Fweb-platform.test%3A8444" with crossOrigin "use-credentials" should be NOT_TAINTED
+PASS restore global state
+Harness: the test ran to completion.
+
diff --git a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting-cache.https.html b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting-video-cache.https.html
similarity index 78%
copy from third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting-cache.https.html
copy to third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting-video-cache.https.html
index 8c34bade..ef3d12b 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting-cache.https.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting-video-cache.https.html
@@ -1,5 +1,6 @@
 <!DOCTYPE html>
-<title>Service Worker: canvas tainting of the fetched image using cached responses</title>
+<meta charset="utf-8">
+<title>Service Worker: canvas tainting of the fetched video using cache responses</title>
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <script src="/common/get-host-info.sub.js"></script>
@@ -8,7 +9,7 @@
 <body>
 <script>
 do_canvas_tainting_tests({
-  resource_path: base_path() + 'resources/fetch-access-control.py?PNGIMAGE',
+  resource_path: base_path() + 'resources/fetch-access-control.py?VIDEO',
   cache: true
 });
 </script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting-video.https-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting-video.https-expected.txt
new file mode 100644
index 0000000..f3ae6dc
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting-video.https-expected.txt
@@ -0,0 +1,43 @@
+This is a testharness.js-based test.
+PASS initialize global state
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&reject" with crossOrigin "" should be LOAD_ERROR
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&reject" with crossOrigin "anonymous" should be LOAD_ERROR
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&reject" with crossOrigin "use-credentials" should be LOAD_ERROR
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&ignore" with crossOrigin "" should be NOT_TAINTED
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&ignore" with crossOrigin "" should be TAINTED
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&ignore" with crossOrigin "anonymous" should be LOAD_ERROR
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&ACAOrigin=https://web-platform.test:8444&ignore" with crossOrigin "anonymous" should be NOT_TAINTED
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&ignore" with crossOrigin "use-credentials" should be LOAD_ERROR
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&ACAOrigin=https://web-platform.test:8444&ignore" with crossOrigin "use-credentials" should be LOAD_ERROR
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&ACAOrigin=https://web-platform.test:8444&ACACredentials=true&ignore" with crossOrigin "use-credentials" should be NOT_TAINTED
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&Auth&ignore" with crossOrigin "" should be NOT_TAINTED
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&Auth&ignore" with crossOrigin "" should be TAINTED
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&Auth&ignore" with crossOrigin "anonymous" should be LOAD_ERROR
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&Auth&ignore" with crossOrigin "use-credentials" should be LOAD_ERROR
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&Auth&ACAOrigin=https://web-platform.test:8444&ignore" with crossOrigin "use-credentials" should be LOAD_ERROR
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&Auth&ACAOrigin=https://web-platform.test:8444&ACACredentials=true&ignore" with crossOrigin "use-credentials" should be NOT_TAINTED
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&mode=same-origin&url=https%3A%2F%2Fweb-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO" with crossOrigin "" should be NOT_TAINTED
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&mode=same-origin&url=https%3A%2F%2Fweb-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO" with crossOrigin "anonymous" should be NOT_TAINTED
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&mode=same-origin&url=https%3A%2F%2Fweb-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO" with crossOrigin "use-credentials" should be NOT_TAINTED
+FAIL url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&mode=same-origin&url=https%3A%2F%2Fweb-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO" with crossOrigin "" should be NOT_TAINTED assert_equals: expected "NOT_TAINTED" but got "TAINTED"
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&mode=same-origin&url=https%3A%2F%2Fweb-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO" with crossOrigin "anonymous" should be NOT_TAINTED
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&mode=same-origin&url=https%3A%2F%2Fweb-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO" with crossOrigin "use-credentials" should be NOT_TAINTED
+FAIL url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&mode=no-cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO" with crossOrigin "" should be TAINTED assert_equals: expected "TAINTED" but got "NOT_TAINTED"
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&mode=no-cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO" with crossOrigin "anonymous" should be LOAD_ERROR
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&mode=no-cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO" with crossOrigin "use-credentials" should be LOAD_ERROR
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&mode=no-cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO" with crossOrigin "" should be TAINTED
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&mode=no-cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO" with crossOrigin "anonymous" should be LOAD_ERROR
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&mode=no-cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO" with crossOrigin "use-credentials" should be LOAD_ERROR
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&mode=cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26ACAOrigin%3Dhttps%3A%2F%2Fweb-platform.test%3A8444" with crossOrigin "" should be LOAD_ERROR
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&mode=cors&credentials=same-origin&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26ACAOrigin%3Dhttps%3A%2F%2Fweb-platform.test%3A8444" with crossOrigin "" should be NOT_TAINTED
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&mode=cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26ACAOrigin%3Dhttps%3A%2F%2Fweb-platform.test%3A8444" with crossOrigin "anonymous" should be NOT_TAINTED
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&mode=cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26ACAOrigin%3Dhttps%3A%2F%2Fweb-platform.test%3A8444" with crossOrigin "use-credentials" should be LOAD_ERROR
+PASS url "https://web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&mode=cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26ACACredentials%3Dtrue%26ACAOrigin%3Dhttps%3A%2F%2Fweb-platform.test%3A8444" with crossOrigin "use-credentials" should be NOT_TAINTED
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&mode=cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26ACAOrigin%3Dhttps%3A%2F%2Fweb-platform.test%3A8444" with crossOrigin "" should be LOAD_ERROR
+FAIL url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&mode=cors&credentials=same-origin&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26ACAOrigin%3Dhttps%3A%2F%2Fweb-platform.test%3A8444" with crossOrigin "" should be NOT_TAINTED assert_equals: expected "NOT_TAINTED" but got "TAINTED"
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&mode=cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26ACAOrigin%3Dhttps%3A%2F%2Fweb-platform.test%3A8444" with crossOrigin "anonymous" should be NOT_TAINTED
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&mode=cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26ACAOrigin%3Dhttps%3A%2F%2Fweb-platform.test%3A8444" with crossOrigin "use-credentials" should be LOAD_ERROR
+PASS url "https://www1.web-platform.test:8444/service-workers/service-worker/resources/fetch-access-control.py?VIDEO&mode=cors&url=https%3A%2F%2Fwww1.web-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Ffetch-access-control.py%3FVIDEO%26ACACredentials%3Dtrue%26ACAOrigin%3Dhttps%3A%2F%2Fweb-platform.test%3A8444" with crossOrigin "use-credentials" should be NOT_TAINTED
+PASS restore global state
+Harness: the test ran to completion.
+
diff --git a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting.https.html b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting-video.https.html
similarity index 82%
copy from third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting.https.html
copy to third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting-video.https.html
index 86ed4b4..57765088 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting.https.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-canvas-tainting-video.https.html
@@ -1,5 +1,6 @@
 <!DOCTYPE html>
-<title>Service Worker: canvas tainting of the fetched image</title>
+<meta charset="utf-8">
+<title>Service Worker: canvas tainting of the fetched video</title>
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <script src="/common/get-host-info.sub.js"></script>
@@ -8,7 +9,7 @@
 <body>
 <script>
 do_canvas_tainting_tests({
-  resource_path: base_path() + 'resources/fetch-access-control.py?PNGIMAGE',
+  resource_path: base_path() + 'resources/fetch-access-control.py?VIDEO',
   cache: false
 });
 </script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-event.https.html b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-event.https.html
index 87a71bd..9fef304 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-event.https.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-event.https.html
@@ -197,7 +197,7 @@
       form.appendChild(input2);
       document.body.appendChild(form);
       frame.onload = function() {
-        document.body.removeChild(form);
+        form.remove();
         resolve(frame);
       };
       form.submit();
@@ -206,9 +206,11 @@
 
 promise_test(t => {
     const scope = 'resources/simple.html?form-post';
+    let registration;
     return service_worker_unregister_and_register(t, worker, scope)
       .then(reg => {
-          add_result_callback(() => { reg.unregister(); });
+          registration = reg;
+          add_completion_callback(() => { reg.unregister(); });
           return wait_for_state(t, reg.installing, 'activated');
         })
       .then(() => {
@@ -219,15 +221,18 @@
                         'POST:application/x-www-form-urlencoded:' +
                         'testName1=testValue1&testName2=testValue2');
           frame.remove();
+          return registration.unregister();
         });
   }, 'Service Worker responds to fetch event with POST form');
 
 promise_test(t => {
     // Add '?ignore' to scope so the service worker falls back to network.
     const scope = 'resources/echo-content.py?ignore';
+    let registration;
     return service_worker_unregister_and_register(t, worker, scope)
       .then(reg => {
-          add_result_callback(() => { reg.unregister(); });
+          registration = reg;
+          add_completion_callback(() => { reg.unregister(); });
           return wait_for_state(t, reg.installing, 'activated');
         })
       .then(() => {
@@ -237,6 +242,7 @@
           assert_equals(frame.contentDocument.body.textContent,
                         'testName1=testValue1&testName2=testValue2');
           frame.remove();
+          return registration.unregister();
         });
   }, 'Service Worker falls back to network in fetch event with POST form');
 
diff --git a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/resources/fetch-access-control.py b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/resources/fetch-access-control.py
index 93ea0e0a..c82ffbe 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/resources/fetch-access-control.py
+++ b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/resources/fetch-access-control.py
@@ -1,5 +1,7 @@
 import base64
 import json
+import os
+import sys
 
 def main(request, response):
     headers = []
@@ -31,6 +33,10 @@
                                    "jBoAAqMGDLwBDAwAEsoCTFWunmQAAAAASUVORK5CYII=")
         return headers, body
 
+    if "VIDEO" in request.GET:
+        headers.append(("Content-Type", "video/webm"))
+        body = open(os.path.join(request.doc_root, "media", "movie_5.ogv"), "rb").read()
+        return headers, body
 
     username = request.auth.username if request.auth.username else "undefined"
     password = request.auth.password if request.auth.username else "undefined"
diff --git a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-iframe.html b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-iframe.html
index e18a226..a65d2501 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-iframe.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-iframe.html
@@ -5,34 +5,65 @@
 const TAINTED = 'TAINTED';
 const LOAD_ERROR = 'LOAD_ERROR';
 
-// Creates an image element with src=|url| and an optional |cross_origin|
-// attibute. Tries to read from the image using a canvas element. Returns
-// NOT_TAINTED if the could be read, TAINTED if it could not be read, and
-// LOAD_ERROR if loading the image failed.
+// Creates an image/video element with src=|url| and an optional |cross_origin|
+// attibute. Tries to read from the image/video using a canvas element. Returns
+// NOT_TAINTED if it could be read, TAINTED if it could not be read, and
+// LOAD_ERROR if loading the image/video failed.
 function create_test_case_promise(url, cross_origin) {
   return new Promise(resolve => {
-      const img = document.createElement('img');
-      if (cross_origin != '') {
-        img.crossOrigin = cross_origin;
-      }
-      img.onload = function() {
-        try {
-          const canvas = document.createElement('canvas');
-          canvas.width = 100;
-          canvas.height = 100;
-          const context = canvas.getContext('2d');
-          context.drawImage(img, 0, 0);
-          context.getImageData(0, 0, 100, 100);
-          resolve(NOT_TAINTED);
-        } catch (e) {
-          resolve(TAINTED);
+      if (url.indexOf('PNGIMAGE') != -1) {
+        const img = document.createElement('img');
+        if (cross_origin != '') {
+          img.crossOrigin = cross_origin;
         }
-      };
-      img.onerror = function() {
-        resolve(LOAD_ERROR);
+        img.onload = function() {
+          try {
+            const canvas = document.createElement('canvas');
+            canvas.width = 100;
+            canvas.height = 100;
+            const context = canvas.getContext('2d');
+            context.drawImage(img, 0, 0);
+            context.getImageData(0, 0, 100, 100);
+            resolve(NOT_TAINTED);
+          } catch (e) {
+            resolve(TAINTED);
+          }
+        };
+        img.onerror = function() {
+          resolve(LOAD_ERROR);
+        }
+        img.src = url;
+        return;
       }
-      img.src = url;
-    });
+
+      if (url.indexOf('VIDEO') != -1) {
+        const video = document.createElement('video');
+        video.autoplay = true;
+        if (cross_origin != '') {
+          video.crossOrigin = cross_origin;
+        }
+        video.onplay = function() {
+          try {
+            const canvas = document.createElement('canvas');
+            canvas.width = 100;
+            canvas.height = 100;
+            const context = canvas.getContext('2d');
+            context.drawImage(video, 0, 0);
+            context.getImageData(0, 0, 100, 100);
+            resolve(NOT_TAINTED);
+          } catch (e) {
+            resolve(TAINTED);
+          }
+        };
+        video.onerror = function() {
+          resolve(LOAD_ERROR);
+        }
+        video.src = url;
+        return;
+      }
+
+      resolve('unknown resource type');
+  });
 }
 </script>
 </html>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-tests.js b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-tests.js
index ba72834..2aada36 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-tests.js
+++ b/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/resources/fetch-canvas-tainting-tests.js
@@ -18,7 +18,7 @@
 
 
 // Runs all the tests. The given |params| has these properties:
-// * |resource_path|: the relative path to the (image) resource to test.
+// * |resource_path|: the relative path to the (image/video) resource to test.
 // * |cache|: when true, the service worker bounces responses into
 //   Cache Storage and back out before responding with them.
 function do_canvas_tainting_tests(params) {
diff --git a/third_party/WebKit/LayoutTests/external/wpt/shadow-dom/untriaged/elements-and-dom-objects/extensions-to-event-interface/event-path-001.html b/third_party/WebKit/LayoutTests/external/wpt/shadow-dom/untriaged/elements-and-dom-objects/extensions-to-event-interface/event-path-001.html
deleted file mode 100644
index 455ee40..0000000
--- a/third_party/WebKit/LayoutTests/external/wpt/shadow-dom/untriaged/elements-and-dom-objects/extensions-to-event-interface/event-path-001.html
+++ /dev/null
@@ -1,56 +0,0 @@
-<!DOCTYPE html>
-<!--
-Distributed under both the W3C Test Suite License [1] and the W3C
-3-clause BSD License [2]. To contribute to a W3C Test Suite, see the
-policies and contribution forms [3].
-
-[1] http://www.w3.org/Consortium/Legal/2008/04-testsuite-license
-[2] http://www.w3.org/Consortium/Legal/2008/03-bsd-license
-[3] http://www.w3.org/2004/10/27-testcases
--->
-<html>
-<head>
-<title>Shadow DOM Test - event path</title>
-<link rel="author" title="Kazuhito Hokamura" href="mailto:k.hokamura@gmail.com">
-<link rel="help" href="https://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/shadow/index.html#extensions-to-event">
-<meta name="assert" content="Extensions to Event Interface: event.composedPath() cross the shadow boundary">
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
-<script src="../../../../html/resources/common.js"></script>
-<script src="../../../resources/shadow-dom-utils.js"></script>
-</head>
-<body>
-<div id="log"></div>
-<script>
-var t = async_test('event.composedPath() cross the shadow boundary');
-
-t.step(unit(function(ctx) {
-    var doc = newRenderedHTMLDocument(ctx);
-    var host = doc.createElement('div');
-
-    var shadowRoot = host.attachShadow({mode: 'open'});
-    var child = doc.createElement('div');
-
-    doc.body.appendChild(host);
-    shadowRoot.appendChild(child);
-
-    child.addEventListener('click', t.step_func(function(e) {
-        assert_equals(e.composedPath().length, 7, 'composedPath().length');
-        assert_equals(e.composedPath()[0], child, 'composedPath()[0] should be child');
-        assert_equals(e.composedPath()[1], shadowRoot, 'composedPath()[1] should be shadowRoot');
-        assert_equals(e.composedPath()[2], host, 'composedPath()[2] should be host');
-        assert_equals(e.composedPath()[3], doc.body, 'composedPath()[3] should be body');
-        assert_equals(e.composedPath()[4], doc.documentElement, 'composedPath()[4] should be html');
-        assert_equals(e.composedPath()[5], doc, 'composedPath()[5] should be document');
-        assert_equals(e.composedPath()[6], ctx.iframes[0].contentWindow, 'composedPath()[6] should be window');
-
-        t.done();
-    }));
-
-    var event = doc.createEvent('HTMLEvents');
-    event.initEvent('click', true, false);
-    child.dispatchEvent(event);
-}));
-</script>
-</body>
-</html>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/webxr/interfaces.https-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/webxr/interfaces.https-expected.txt
index f5d5166..3483d2b 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/webxr/interfaces.https-expected.txt
+++ b/third_party/WebKit/LayoutTests/external/wpt/webxr/interfaces.https-expected.txt
@@ -114,12 +114,12 @@
 PASS XRWebGLLayer interface: attribute framebufferWidth
 PASS XRWebGLLayer interface: attribute framebufferHeight
 PASS XRWebGLLayer interface: operation requestViewportScaling(double)
-FAIL XRPresentationContext interface: existence and properties of interface object assert_own_property: self does not have own property "XRPresentationContext" expected property "XRPresentationContext" missing
-FAIL XRPresentationContext interface object length assert_own_property: self does not have own property "XRPresentationContext" expected property "XRPresentationContext" missing
-FAIL XRPresentationContext interface object name assert_own_property: self does not have own property "XRPresentationContext" expected property "XRPresentationContext" missing
-FAIL XRPresentationContext interface: existence and properties of interface prototype object assert_own_property: self does not have own property "XRPresentationContext" expected property "XRPresentationContext" missing
-FAIL XRPresentationContext interface: existence and properties of interface prototype object's "constructor" property assert_own_property: self does not have own property "XRPresentationContext" expected property "XRPresentationContext" missing
-FAIL XRPresentationContext interface: attribute canvas assert_own_property: self does not have own property "XRPresentationContext" expected property "XRPresentationContext" missing
+PASS XRPresentationContext interface: existence and properties of interface object
+PASS XRPresentationContext interface object length
+PASS XRPresentationContext interface object name
+PASS XRPresentationContext interface: existence and properties of interface prototype object
+PASS XRPresentationContext interface: existence and properties of interface prototype object's "constructor" property
+PASS XRPresentationContext interface: attribute canvas
 PASS XRSessionEvent interface: existence and properties of interface object
 PASS XRSessionEvent interface object length
 PASS XRSessionEvent interface object name
diff --git a/third_party/WebKit/LayoutTests/external/wpt/webxr/resources/webxr_util.js b/third_party/WebKit/LayoutTests/external/wpt/webxr/resources/webxr_util.js
index a663b2d..388c757 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/webxr/resources/webxr_util.js
+++ b/third_party/WebKit/LayoutTests/external/wpt/webxr/resources/webxr_util.js
@@ -11,6 +11,7 @@
   callback(window.XRSession, 'XRSession');
   callback(window.XRSessionCreationOptions, 'XRSessionCreationOptions');
   callback(window.XRFrameRequestCallback, 'XRFrameRequestCallback');
+  callback(window.XRPresentationContext, 'XRPresentationContext');
   callback(window.XRPresentationFrame, 'XRPresentationFrame');
   callback(window.XRView, 'XRView');
   callback(window.XRViewport, 'XRViewport');
diff --git a/third_party/WebKit/LayoutTests/fast/dom/shadow/shadow-dom-event-dispatching-details-summary-expected.txt b/third_party/WebKit/LayoutTests/fast/dom/shadow/shadow-dom-event-dispatching-details-summary-expected.txt
index 929532786..fd1603b 100644
--- a/third_party/WebKit/LayoutTests/fast/dom/shadow/shadow-dom-event-dispatching-details-summary-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/dom/shadow/shadow-dom-event-dispatching-details-summary-expected.txt
@@ -4,9 +4,12 @@
 DIV	 id=sandbox
 	DIV	 id=top
 		DETAILS	 id=details
-			SUMMARY	 id=summary
-				DIV	 id=details-marker
+			SLOT	 id=details-summary
+				SUMMARY	 id=summary
+					DIV	 id=details-marker
+					SLOT	
 			DIV	 id=details-content
+				SLOT	
 
 
 Moving mouse from details to summary
diff --git a/third_party/WebKit/LayoutTests/fast/forms/file/file-user-selection.html b/third_party/WebKit/LayoutTests/fast/forms/file/file-user-selection.html
new file mode 100644
index 0000000..ef39ca4
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/forms/file/file-user-selection.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>User file selection</title>
+<link rel=help href="https://html.spec.whatwg.org/#file-upload-state-(type=file)">
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+<script src="resources/file-drag-common.js"></script>
+<body>
+<script>
+"use strict";
+
+test(() => {
+  const input = document.createElement("input");
+  input.type = "file";
+  document.body.appendChild(input);
+  const events = [];
+
+  input.addEventListener("change", () => {
+    events.push("change");
+  });
+  input.addEventListener("input", () => {
+    events.push("input");
+  });
+
+  if (window.eventSender) {
+    dragFilesOntoElement(input, ['foo.txt']);
+    assert_array_equals(events, ["input", "change"]);
+  }
+
+}, "a file input emits input, change events in order after selected files");
+</script>
\ No newline at end of file
diff --git a/third_party/WebKit/LayoutTests/fast/forms/radio/radio-keyboard-event.html b/third_party/WebKit/LayoutTests/fast/forms/radio/radio-keyboard-event.html
new file mode 100644
index 0000000..312fa012
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/forms/radio/radio-keyboard-event.html
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>radio keyboard event</title>
+<link rel=help href="https://html.spec.whatwg.org/#radio-button-state-(type=radio)">
+<script src="../../../resources/testharness.js"></script>
+<script src="../../../resources/testharnessreport.js"></script>
+
+<body>
+<script>
+"use strict";
+
+test(() => {
+  const input = document.createElement("input");
+  input.type = "radio";
+  document.body.appendChild(input);
+  const events = [];
+
+  input.addEventListener("change", () => {
+    events.push("change");
+  });
+  input.addEventListener("click", () => {
+    events.push("click");
+  });
+  input.addEventListener("input", () => {
+    events.push("input");
+  });
+
+  assert_false(input.checked);
+
+  if (window.eventSender) {
+    input.focus();
+    eventSender.keyDown(" ");
+
+    assert_true(input.checked);
+    assert_array_equals(events, ["click", "input", "change"]);
+  }
+
+}, "a radio input emits click, input, change events in order after keyboard event");
+</script>
diff --git a/third_party/WebKit/LayoutTests/http/tests/worklet/webexposed/global-interface-listing-paint-worklet-expected.txt b/third_party/WebKit/LayoutTests/http/tests/worklet/webexposed/global-interface-listing-paint-worklet-expected.txt
index 0f3c623..4130d2a 100644
--- a/third_party/WebKit/LayoutTests/http/tests/worklet/webexposed/global-interface-listing-paint-worklet-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/worklet/webexposed/global-interface-listing-paint-worklet-expected.txt
@@ -14,7 +14,6 @@
 CONSOLE MESSAGE: line 147: interface CSSMathInvert : CSSMathValue
 CONSOLE MESSAGE: line 147:     getter value
 CONSOLE MESSAGE: line 147:     method constructor
-CONSOLE MESSAGE: line 147:     setter value
 CONSOLE MESSAGE: line 147: interface CSSMathMax : CSSMathValue
 CONSOLE MESSAGE: line 147:     getter values
 CONSOLE MESSAGE: line 147:     method constructor
@@ -24,7 +23,6 @@
 CONSOLE MESSAGE: line 147: interface CSSMathNegate : CSSMathValue
 CONSOLE MESSAGE: line 147:     getter value
 CONSOLE MESSAGE: line 147:     method constructor
-CONSOLE MESSAGE: line 147:     setter value
 CONSOLE MESSAGE: line 147: interface CSSMathProduct : CSSMathValue
 CONSOLE MESSAGE: line 147:     getter values
 CONSOLE MESSAGE: line 147:     method constructor
@@ -66,7 +64,7 @@
 CONSOLE MESSAGE: line 147: interface CSSResourceValue : CSSStyleValue
 CONSOLE MESSAGE: line 147:     getter state
 CONSOLE MESSAGE: line 147:     method constructor
-CONSOLE MESSAGE: line 147: interface CSSRotation : CSSTransformComponent
+CONSOLE MESSAGE: line 147: interface CSSRotate : CSSTransformComponent
 CONSOLE MESSAGE: line 147:     getter angle
 CONSOLE MESSAGE: line 147:     getter x
 CONSOLE MESSAGE: line 147:     getter y
@@ -107,7 +105,7 @@
 CONSOLE MESSAGE: line 147:     method keys
 CONSOLE MESSAGE: line 147:     method toMatrix
 CONSOLE MESSAGE: line 147:     method values
-CONSOLE MESSAGE: line 147: interface CSSTranslation : CSSTransformComponent
+CONSOLE MESSAGE: line 147: interface CSSTranslate : CSSTransformComponent
 CONSOLE MESSAGE: line 147:     getter x
 CONSOLE MESSAGE: line 147:     getter y
 CONSOLE MESSAGE: line 147:     getter z
@@ -300,7 +298,6 @@
 CONSOLE MESSAGE: line 147: interface CSSMathInvert : CSSMathValue
 CONSOLE MESSAGE: line 147:     getter value
 CONSOLE MESSAGE: line 147:     method constructor
-CONSOLE MESSAGE: line 147:     setter value
 CONSOLE MESSAGE: line 147: interface CSSMathMax : CSSMathValue
 CONSOLE MESSAGE: line 147:     getter values
 CONSOLE MESSAGE: line 147:     method constructor
@@ -310,7 +307,6 @@
 CONSOLE MESSAGE: line 147: interface CSSMathNegate : CSSMathValue
 CONSOLE MESSAGE: line 147:     getter value
 CONSOLE MESSAGE: line 147:     method constructor
-CONSOLE MESSAGE: line 147:     setter value
 CONSOLE MESSAGE: line 147: interface CSSMathProduct : CSSMathValue
 CONSOLE MESSAGE: line 147:     getter values
 CONSOLE MESSAGE: line 147:     method constructor
@@ -352,7 +348,7 @@
 CONSOLE MESSAGE: line 147: interface CSSResourceValue : CSSStyleValue
 CONSOLE MESSAGE: line 147:     getter state
 CONSOLE MESSAGE: line 147:     method constructor
-CONSOLE MESSAGE: line 147: interface CSSRotation : CSSTransformComponent
+CONSOLE MESSAGE: line 147: interface CSSRotate : CSSTransformComponent
 CONSOLE MESSAGE: line 147:     getter angle
 CONSOLE MESSAGE: line 147:     getter x
 CONSOLE MESSAGE: line 147:     getter y
@@ -393,7 +389,7 @@
 CONSOLE MESSAGE: line 147:     method keys
 CONSOLE MESSAGE: line 147:     method toMatrix
 CONSOLE MESSAGE: line 147:     method values
-CONSOLE MESSAGE: line 147: interface CSSTranslation : CSSTransformComponent
+CONSOLE MESSAGE: line 147: interface CSSTranslate : CSSTransformComponent
 CONSOLE MESSAGE: line 147:     getter x
 CONSOLE MESSAGE: line 147:     getter y
 CONSOLE MESSAGE: line 147:     getter z
diff --git a/third_party/WebKit/LayoutTests/media/autoplay/muted-change-src.html b/third_party/WebKit/LayoutTests/media/autoplay/muted-change-src.html
new file mode 100644
index 0000000..6b589f38
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/media/autoplay/muted-change-src.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<title>Test that the autoplay muted via attribute allows change in src</title>
+<script src='../../resources/testharness.js'></script>
+<script src='../../resources/testharnessreport.js'></script>
+<script src='../media-file.js'></script>
+<video muted autoplay></video>
+<script>
+async_test(t => {
+  t.add_cleanup(() => {
+    window.internals.settings.setAutoplayPolicy('no-user-gesture-required');
+    window.internals.runtimeFlags.autoplayMutedVideosEnabled = false;
+  });
+  window.internals.settings.setAutoplayPolicy('document-user-activation-required');
+  window.internals.runtimeFlags.autoplayMutedVideosEnabled = true;
+
+  var video = document.querySelector('video');
+  video.src = findMediaFile('video', '../content/test');
+  video.addEventListener('play', t.step_func(e => {
+    setTimeout(t.step_func(() => {
+      video.src = findMediaFile('video', '../content/counting');
+      video.addEventListener('play', t.step_func_done());
+    }));
+  }), { once: true });
+});
+</script>
diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/4960120-2-expected.png b/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/4960120-2-expected.png
deleted file mode 100644
index 4cf4fca..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/4960120-2-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/4960120-2-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/4960120-2-expected.txt
deleted file mode 100644
index dcd1463..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/editing/inserting/4960120-2-expected.txt
+++ /dev/null
@@ -1,18 +0,0 @@
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {P} at (0,0) size 784x20
-        LayoutText {#text} at (0,0) size 591x19
-          text run at (0,0) width 591: "This tests for a bug where a newline inserted at the end of an anonymous block would be lost."
-      LayoutBlockFlow {DIV} at (0,36) size 784x60
-        LayoutBlockFlow (anonymous) at (0,0) size 784x40
-          LayoutText {#text} at (0,0) size 21x19
-            text run at (0,0) width 21: "foo"
-          LayoutBR {BR} at (21,15) size 0x0
-          LayoutBR {BR} at (0,20) size 0x19
-        LayoutBlockFlow {DIV} at (0,40) size 784x20
-          LayoutText {#text} at (0,0) size 20x19
-            text run at (0,0) width 20: "bar"
-caret: position 0 of child 2 {BR} of child 2 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/linux/virtual/service-worker-script-streaming/external/wpt/service-workers/service-worker/navigation-redirect.https-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/virtual/service-worker-script-streaming/external/wpt/service-workers/service-worker/navigation-redirect.https-expected.txt
deleted file mode 100644
index f757823..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/virtual/service-worker-script-streaming/external/wpt/service-workers/service-worker/navigation-redirect.https-expected.txt
+++ /dev/null
@@ -1,38 +0,0 @@
-This is a testharness.js-based test.
-PASS Normal redirect to same-origin scope.
-FAIL Normal redirect to same-origin scope with a hash fragment. assert_object_equals: Intercepted URLs should match. property "0" expected ["https://web-platform.test:8444/service-workers/service-worker/resources/navigation-redirect-scope1.py?#ref"] got ["https://web-platform.test:8444/service-workers/service-worker/resources/navigation-redirect-scope1.py?"]
-FAIL Normal redirect to same-origin scope with different hash fragments. assert_object_equals: Intercepted URLs should match. property "0" expected ["https://web-platform.test:8444/service-workers/service-worker/resources/navigation-redirect-scope1.py?#ref2"] got ["https://web-platform.test:8444/service-workers/service-worker/resources/navigation-redirect-scope1.py?"]
-PASS Normal redirect to other-origin scope.
-PASS SW-fallbacked redirect to same-origin out-scope.
-PASS SW-fallbacked redirect to same-origin same-scope.
-FAIL SW-fallbacked redirect to same-origin same-scope with a hash fragment. assert_object_equals: Intercepted URLs should match. property "0" expected ["https://web-platform.test:8444/service-workers/service-worker/resources/navigation-redirect-scope1.py?url=https%3A%2F%2Fweb-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Fnavigation-redirect-scope1.py%3F#ref", "https://web-platform.test:8444/service-workers/service-worker/resources/navigation-redirect-scope1.py?#ref"] got ["https://web-platform.test:8444/service-workers/service-worker/resources/navigation-redirect-scope1.py?url=https%3A%2F%2Fweb-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Fnavigation-redirect-scope1.py%3F", "https://web-platform.test:8444/service-workers/service-worker/resources/navigation-redirect-scope1.py?"]
-FAIL SW-fallbacked redirect to same-origin same-scope with different hash fragments. assert_object_equals: Intercepted URLs should match. property "0" expected ["https://web-platform.test:8444/service-workers/service-worker/resources/navigation-redirect-scope1.py?url=https%3A%2F%2Fweb-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Fnavigation-redirect-scope1.py%3F%23ref2#ref", "https://web-platform.test:8444/service-workers/service-worker/resources/navigation-redirect-scope1.py?#ref2"] got ["https://web-platform.test:8444/service-workers/service-worker/resources/navigation-redirect-scope1.py?url=https%3A%2F%2Fweb-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Fnavigation-redirect-scope1.py%3F%23ref2", "https://web-platform.test:8444/service-workers/service-worker/resources/navigation-redirect-scope1.py?"]
-PASS SW-fallbacked redirect to same-origin other-scope.
-PASS SW-fallbacked redirect to other-origin out-scope.
-PASS SW-fallbacked redirect to other-origin in-scope.
-PASS SW-generated redirect to same-origin out-scope.
-FAIL SW-generated redirect to same-origin out-scope with a hash fragment. assert_object_equals: Intercepted URLs should match. property "0" expected ["https://web-platform.test:8444/service-workers/service-worker/resources/navigation-redirect-scope1.py?sw=gen&url=https%3A%2F%2Fweb-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Fnavigation-redirect-out-scope.py%3F#ref"] got ["https://web-platform.test:8444/service-workers/service-worker/resources/navigation-redirect-scope1.py?sw=gen&url=https%3A%2F%2Fweb-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Fnavigation-redirect-out-scope.py%3F"]
-FAIL SW-generated redirect to same-origin out-scope with different hashfragments. assert_object_equals: Intercepted URLs should match. property "0" expected ["https://web-platform.test:8444/service-workers/service-worker/resources/navigation-redirect-scope1.py?sw=gen&url=https%3A%2F%2Fweb-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Fnavigation-redirect-out-scope.py%3F%23ref2#ref"] got ["https://web-platform.test:8444/service-workers/service-worker/resources/navigation-redirect-scope1.py?sw=gen&url=https%3A%2F%2Fweb-platform.test%3A8444%2Fservice-workers%2Fservice-worker%2Fresources%2Fnavigation-redirect-out-scope.py%3F%23ref2"]
-PASS SW-generated redirect to same-origin same-scope.
-PASS SW-generated redirect to same-origin other-scope.
-PASS SW-generated redirect to other-origin out-scope.
-PASS SW-generated redirect to other-origin in-scope.
-PASS SW-fetched redirect to same-origin out-scope.
-PASS SW-fetched redirect to same-origin same-scope.
-PASS SW-fetched redirect to same-origin other-scope.
-PASS SW-fetched redirect to other-origin out-scope.
-PASS SW-fetched redirect to other-origin in-scope.
-PASS Redirect to same-origin out-scope with opaque redirect response.
-PASS Redirect to same-origin same-scope with opaque redirect response.
-PASS Redirect to same-origin other-scope with opaque redirect response.
-PASS Redirect to other-origin out-scope with opaque redirect response.
-PASS Redirect to other-origin in-scope with opaque redirect response.
-PASS No location redirect response.
-PASS Redirect to same-origin out-scope with opaque redirect response which is passed through Cache.
-PASS Redirect to same-origin same-scope with opaque redirect response which is passed through Cache.
-PASS Redirect to same-origin other-scope with opaque redirect response which is passed through Cache.
-PASS Redirect to other-origin out-scope with opaque redirect response which is passed through Cache.
-PASS Redirect to other-origin in-scope with opaque redirect response which is passed through Cache.
-PASS No location redirect response via Cache.
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/inserting/4960120-2-expected.png b/third_party/WebKit/LayoutTests/platform/mac/editing/inserting/4960120-2-expected.png
deleted file mode 100644
index 79312fa..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/inserting/4960120-2-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/editing/inserting/4960120-2-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/editing/inserting/4960120-2-expected.txt
deleted file mode 100644
index bfa80d9..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/editing/inserting/4960120-2-expected.txt
+++ /dev/null
@@ -1,18 +0,0 @@
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {P} at (0,0) size 784x18
-        LayoutText {#text} at (0,0) size 601x18
-          text run at (0,0) width 601: "This tests for a bug where a newline inserted at the end of an anonymous block would be lost."
-      LayoutBlockFlow {DIV} at (0,34) size 784x54
-        LayoutBlockFlow (anonymous) at (0,0) size 784x36
-          LayoutText {#text} at (0,0) size 22x18
-            text run at (0,0) width 22: "foo"
-          LayoutBR {BR} at (21,14) size 1x0
-          LayoutBR {BR} at (0,18) size 0x18
-        LayoutBlockFlow {DIV} at (0,36) size 784x18
-          LayoutText {#text} at (0,0) size 21x18
-            text run at (0,0) width 21: "bar"
-caret: position 0 of child 2 {BR} of child 2 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/4960120-2-expected.png b/third_party/WebKit/LayoutTests/platform/win/editing/inserting/4960120-2-expected.png
deleted file mode 100644
index 21942b1d..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/4960120-2-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/4960120-2-expected.txt b/third_party/WebKit/LayoutTests/platform/win/editing/inserting/4960120-2-expected.txt
deleted file mode 100644
index 6612f5b..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/editing/inserting/4960120-2-expected.txt
+++ /dev/null
@@ -1,18 +0,0 @@
-layer at (0,0) size 800x600
-  LayoutView at (0,0) size 800x600
-layer at (0,0) size 800x600
-  LayoutBlockFlow {HTML} at (0,0) size 800x600
-    LayoutBlockFlow {BODY} at (8,8) size 784x584
-      LayoutBlockFlow {P} at (0,0) size 784x20
-        LayoutText {#text} at (0,0) size 562x19
-          text run at (0,0) width 562: "This tests for a bug where a newline inserted at the end of an anonymous block would be lost."
-      LayoutBlockFlow {DIV} at (0,36) size 784x60
-        LayoutBlockFlow (anonymous) at (0,0) size 784x40
-          LayoutText {#text} at (0,0) size 20x19
-            text run at (0,0) width 20: "foo"
-          LayoutBR {BR} at (20,15) size 0x0
-          LayoutBR {BR} at (0,20) size 0x19
-        LayoutBlockFlow {DIV} at (0,40) size 784x20
-          LayoutText {#text} at (0,0) size 20x19
-            text run at (0,0) width 20: "bar"
-caret: position 0 of child 2 {BR} of child 2 {DIV} of body
diff --git a/third_party/WebKit/LayoutTests/typedcssom/cssRotation.html b/third_party/WebKit/LayoutTests/typedcssom/cssRotate.html
similarity index 75%
rename from third_party/WebKit/LayoutTests/typedcssom/cssRotation.html
rename to third_party/WebKit/LayoutTests/typedcssom/cssRotate.html
index 4775e708..5786822 100644
--- a/third_party/WebKit/LayoutTests/typedcssom/cssRotation.html
+++ b/third_party/WebKit/LayoutTests/typedcssom/cssRotate.html
@@ -8,7 +8,7 @@
 
 var testParams = [
   {
-    input: new CSSRotation(new CSSUnitValue(0, 'deg')),
+    input: new CSSRotate(new CSSUnitValue(0, 'deg')),
     angle: 0,
     x: 0,
     y: 0,
@@ -18,7 +18,7 @@
     asMatrix: new DOMMatrixReadOnly([1, 0, 0, 1, 0, 0])
   },
   {
-    input: new CSSRotation(new CSSUnitValue(10, 'deg')),
+    input: new CSSRotate(new CSSUnitValue(10, 'deg')),
     angle: 10,
     x: 0,
     y: 0,
@@ -28,7 +28,7 @@
     asMatrix: new DOMMatrixReadOnly([0.9848077, 0.1736481, -0.1736481, 0.9848077, 0, 0])
   },
   {
-    input: new CSSRotation(new CSSUnitValue(-21, 'deg')),
+    input: new CSSRotate(new CSSUnitValue(-21, 'deg')),
     angle: -21,
     x: 0,
     y: 0,
@@ -38,7 +38,7 @@
     asMatrix: new DOMMatrixReadOnly([0.9335804, -0.3583679, 0.3583679, 0.9335804, 0, 0])
   },
   {
-    input: new CSSRotation(new CSSUnitValue(3.2, 'deg')),
+    input: new CSSRotate(new CSSUnitValue(3.2, 'deg')),
     angle: 3.2,
     x: 0,
     y: 0,
@@ -48,7 +48,7 @@
     asMatrix: new DOMMatrixReadOnly([0.9984407, 0.0558215, -0.0558215, 0.9984407, 0, 0])
   },
   {
-    input: new CSSRotation(0, 0, 1, new CSSUnitValue(90, 'deg')),
+    input: new CSSRotate(0, 0, 1, new CSSUnitValue(90, 'deg')),
     angle: 90,
     x: 0,
     y: 0,
@@ -58,7 +58,7 @@
     asMatrix: new DOMMatrixReadOnly([0, 1, 0, 0, -1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1])
   },
   {
-    input: new CSSRotation(2.7, -3, 4.4, new CSSUnitValue(0, 'deg')),
+    input: new CSSRotate(2.7, -3, 4.4, new CSSUnitValue(0, 'deg')),
     angle: 0,
     x: 2.7,
     y: -3,
@@ -68,7 +68,7 @@
     asMatrix: new DOMMatrixReadOnly([1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1])
   },
   {
-    input: new CSSRotation(2, 3, 4, new CSSUnitValue(10, 'deg')),
+    input: new CSSRotate(2, 3, 4, new CSSUnitValue(10, 'deg')),
     angle: 10,
     x: 2,
     y: 3,
@@ -79,7 +79,7 @@
       0.9895225, 0.0707777, 0, 0.1009279, -0.0582048, 0.9931896, 0, 0, 0, 0, 1])
   },
   {
-    input: new CSSRotation(2, 3.7, -4, new CSSUnitValue(-1.2, 'deg')),
+    input: new CSSRotate(2, 3.7, -4, new CSSUnitValue(-1.2, 'deg')),
     angle: -1.2,
     x: 2,
     y: 3.7,
@@ -90,7 +90,7 @@
     0.9998698, -0.0073125, 0, -0.0134019, 0.0071198, 0.9998848, 0, 0, 0, 0, 1])
   },
   {
-    input: new CSSRotation(1, 0, 0, new CSSUnitValue(0.5, 'turn')),
+    input: new CSSRotate(1, 0, 0, new CSSUnitValue(0.5, 'turn')),
     angle: 0.5,
     x: 1,
     y: 0,
@@ -104,10 +104,10 @@
 
 test(() => {
   // Wrong number of arguments.
-  assert_throws(new TypeError(), () => { new CSSRotation(); });
-  assert_throws(new TypeError(), () => { new CSSRotation(null); });
+  assert_throws(new TypeError(), () => { new CSSRotate(); });
+  assert_throws(new TypeError(), () => { new CSSRotate(null); });
   assert_throws(new TypeError(), () => {
-    new CSSRotation(1, 2, new CSSUnitValue(10, 'deg'));
+    new CSSRotate(1, 2, new CSSUnitValue(10, 'deg'));
   });
 }, "Invalid arguments to constructor should throw");
 
diff --git a/third_party/WebKit/LayoutTests/typedcssom/cssTranslation.html b/third_party/WebKit/LayoutTests/typedcssom/cssTranslate.html
similarity index 64%
rename from third_party/WebKit/LayoutTests/typedcssom/cssTranslation.html
rename to third_party/WebKit/LayoutTests/typedcssom/cssTranslate.html
index aeed05a..ac98e75 100644
--- a/third_party/WebKit/LayoutTests/typedcssom/cssTranslation.html
+++ b/third_party/WebKit/LayoutTests/typedcssom/cssTranslate.html
@@ -9,38 +9,38 @@
 var testParams = [
   // 2D translations
   {
-    input: new CSSTranslation(CSS.px(0), CSS.px(0)),
+    input: new CSSTranslate(CSS.px(0), CSS.px(0)),
     x: CSS.px(0), y: CSS.px(0),
     is2D: true,
     cssText: "translate(0px, 0px)"
   },
   {
-    input: new CSSTranslation(CSS.px(1.1), CSS.em(-2.2)),
+    input: new CSSTranslate(CSS.px(1.1), CSS.em(-2.2)),
     x: CSS.px(1.1), y: CSS.em(-2.2),
     is2D: true,
     cssText: "translate(1.1px, -2.2em)"
   },
   {
-    input: new CSSTranslation(CSS.percent(10), CSS.px(0)),
+    input: new CSSTranslate(CSS.percent(10), CSS.px(0)),
     x: CSS.percent(10), y: CSS.px(0),
     is2D: true,
     cssText: "translate(10%, 0px)"
   },
   // 3D translations
   {
-    input: new CSSTranslation(CSS.px(0), CSS.px(0), CSS.px(0)),
+    input: new CSSTranslate(CSS.px(0), CSS.px(0), CSS.px(0)),
     x: CSS.px(0), y: CSS.px(0), z: CSS.px(0),
     is2D: false,
     cssText: "translate3d(0px, 0px, 0px)"
   },
   {
-    input: new CSSTranslation(CSS.px(0), CSS.px(1.1), CSS.em(-2.2)),
+    input: new CSSTranslate(CSS.px(0), CSS.px(1.1), CSS.em(-2.2)),
     x: CSS.px(0), y: CSS.px(1.1), z: CSS.em(-2.2),
     is2D: false,
     cssText: "translate3d(0px, 1.1px, -2.2em)"
   },
   {
-    input: new CSSTranslation(CSS.percent(10), CSS.px(1.1), CSS.px(0)),
+    input: new CSSTranslate(CSS.percent(10), CSS.px(1.1), CSS.px(0)),
     x: CSS.percent(10), y: CSS.px(1.1), z: CSS.px(0),
     is2D: false,
     cssText: "translate3d(10%, 1.1px, 0px)"
@@ -49,16 +49,16 @@
 
 test(() => {
   assert_throws(new TypeError(), () => {
-    new CSSTranslation(CSS.px(0), CSS.px(0), CSS.percent(10));
+    new CSSTranslate(CSS.px(0), CSS.px(0), CSS.percent(10));
   });
   assert_throws(new TypeError(), () => {
-    new CSSTranslation(CSS.percent(10), CSS.percent(10), CSS.percent(10));
+    new CSSTranslate(CSS.percent(10), CSS.percent(10), CSS.percent(10));
   });
 }, "Constructor throws when z argument contains percent.");
 
 test(() => {
-  assert_throws(new TypeError(), () => { new CSSTranslation(); });
-  assert_throws(new TypeError(), () => { new CSSTranslation(CSS.px(0)); });
+  assert_throws(new TypeError(), () => { new CSSTranslate(); });
+  assert_throws(new TypeError(), () => { new CSSTranslate(CSS.px(0)); });
 }, "Invalid number of arguments to constructor throws an exception.");
 
 </script>
diff --git a/third_party/WebKit/LayoutTests/typedcssom/inlinestyle/properties/transform.html b/third_party/WebKit/LayoutTests/typedcssom/inlinestyle/properties/transform.html
index 9d77edf..9087527 100644
--- a/third_party/WebKit/LayoutTests/typedcssom/inlinestyle/properties/transform.html
+++ b/third_party/WebKit/LayoutTests/typedcssom/inlinestyle/properties/transform.html
@@ -9,12 +9,12 @@
 
 function cssTransformWithRotate(angleValue) {
   return new CSSTransformValue([
-      new CSSRotation(angleValue)]);
+      new CSSRotate(angleValue)]);
 }
 
 function cssTransformWithRotate3D(x, y, z, angleValue) {
   return new CSSTransformValue([
-      new CSSRotation(x, y, z, angleValue)]);
+      new CSSRotate(x, y, z, angleValue)]);
 }
 
 runInlineStylePropertyMapTests( {
@@ -24,12 +24,12 @@
   ],
   validObjects: [
     // Translations
-    new CSSTransformValue([new CSSTranslation(CSS.px(1), CSS.px(2))]),
+    new CSSTransformValue([new CSSTranslate(CSS.px(1), CSS.px(2))]),
     new CSSTransformValue(
-        [new CSSTranslation(CSS.px(1), CSS.px(2), CSS.px(3))]),
-    new CSSTransformValue([new CSSTranslation(CSS.px(-10), CSS.px(-20))]),
+        [new CSSTranslate(CSS.px(1), CSS.px(2), CSS.px(3))]),
+    new CSSTransformValue([new CSSTranslate(CSS.px(-10), CSS.px(-20))]),
     new CSSTransformValue(
-        [new CSSTranslation(CSS.px(-10), CSS.px(-20), CSS.px(-30))]),
+        [new CSSTranslate(CSS.px(-10), CSS.px(-20), CSS.px(-30))]),
     // Scales
     new CSSTransformValue([new CSSScale(1, 2.2)]),
     new CSSTransformValue([new CSSScale(1, 2.2, 3)]),
@@ -62,14 +62,14 @@
   validStringMappings: {
     // Translations
     'translate(10px)':
-      new CSSTransformValue([new CSSTranslation(CSS.px(10), CSS.px(0))]),
+      new CSSTransformValue([new CSSTranslate(CSS.px(10), CSS.px(0))]),
     'translateX(10em)':
-      new CSSTransformValue([new CSSTranslation(CSS.em(10), CSS.px(0))]),
+      new CSSTransformValue([new CSSTranslate(CSS.em(10), CSS.px(0))]),
     'translateY(20pc)':
-      new CSSTransformValue([new CSSTranslation(CSS.px(0), CSS.pc(20))]),
+      new CSSTransformValue([new CSSTranslate(CSS.px(0), CSS.pc(20))]),
     'translateZ(30in)':
       new CSSTransformValue(
-          [new CSSTranslation(CSS.px(0), CSS.px(0), CSS.in(30))]),
+          [new CSSTranslate(CSS.px(0), CSS.px(0), CSS.in(30))]),
     // Scales
     'scale(4)': new CSSTransformValue([new CSSScale(4, 4)]),
     'scaleX(2)': new CSSTransformValue([new CSSScale(2, 1)]),
diff --git a/third_party/WebKit/LayoutTests/typedcssom/resources/testhelper.js b/third_party/WebKit/LayoutTests/typedcssom/resources/testhelper.js
index 00403029..9e5bfd1 100644
--- a/third_party/WebKit/LayoutTests/typedcssom/resources/testhelper.js
+++ b/third_party/WebKit/LayoutTests/typedcssom/resources/testhelper.js
@@ -40,10 +40,10 @@
     case 'CSSTransformValue':
       assert_style_value_array_equals(a, b);
       break;
-    case 'CSSRotation':
+    case 'CSSRotate':
       assert_style_value_equals(a.angle, b.angle);
       // fallthrough
-    case 'CSSTranslation':
+    case 'CSSTranslate':
     case 'CSSScale':
       assert_style_value_equals(a.x, b.x);
       assert_style_value_equals(a.y, b.y);
diff --git a/third_party/WebKit/LayoutTests/virtual/service-worker-script-streaming/external/wpt/service-workers/README.txt b/third_party/WebKit/LayoutTests/virtual/service-worker-script-streaming/external/wpt/service-workers/README.txt
deleted file mode 100644
index 339e450..0000000
--- a/third_party/WebKit/LayoutTests/virtual/service-worker-script-streaming/external/wpt/service-workers/README.txt
+++ /dev/null
@@ -1 +0,0 @@
-This directory is for testing the script streaming (Tracking bug: https://crbug.com/683037).
diff --git a/third_party/WebKit/LayoutTests/virtual/service-worker-script-streaming/http/tests/fetch/serviceworker-proxied/README.txt b/third_party/WebKit/LayoutTests/virtual/service-worker-script-streaming/http/tests/fetch/serviceworker-proxied/README.txt
deleted file mode 100644
index 339e450..0000000
--- a/third_party/WebKit/LayoutTests/virtual/service-worker-script-streaming/http/tests/fetch/serviceworker-proxied/README.txt
+++ /dev/null
@@ -1 +0,0 @@
-This directory is for testing the script streaming (Tracking bug: https://crbug.com/683037).
diff --git a/third_party/WebKit/LayoutTests/virtual/service-worker-script-streaming/http/tests/fetch/serviceworker/README.txt b/third_party/WebKit/LayoutTests/virtual/service-worker-script-streaming/http/tests/fetch/serviceworker/README.txt
deleted file mode 100644
index 339e450..0000000
--- a/third_party/WebKit/LayoutTests/virtual/service-worker-script-streaming/http/tests/fetch/serviceworker/README.txt
+++ /dev/null
@@ -1 +0,0 @@
-This directory is for testing the script streaming (Tracking bug: https://crbug.com/683037).
diff --git a/third_party/WebKit/LayoutTests/virtual/service-worker-script-streaming/http/tests/serviceworker/README.txt b/third_party/WebKit/LayoutTests/virtual/service-worker-script-streaming/http/tests/serviceworker/README.txt
deleted file mode 100644
index 339e450..0000000
--- a/third_party/WebKit/LayoutTests/virtual/service-worker-script-streaming/http/tests/serviceworker/README.txt
+++ /dev/null
@@ -1 +0,0 @@
-This directory is for testing the script streaming (Tracking bug: https://crbug.com/683037).
diff --git a/third_party/WebKit/LayoutTests/virtual/spv175/paint/invalidation/scroll/fixed-scroll-simple-expected.txt b/third_party/WebKit/LayoutTests/virtual/spv175/paint/invalidation/scroll/fixed-scroll-simple-expected.txt
index 2fc218f..5cedd71 100644
--- a/third_party/WebKit/LayoutTests/virtual/spv175/paint/invalidation/scroll/fixed-scroll-simple-expected.txt
+++ b/third_party/WebKit/LayoutTests/virtual/spv175/paint/invalidation/scroll/fixed-scroll-simple-expected.txt
@@ -15,6 +15,18 @@
       "bounds": [800, 2016],
       "contentsOpaque": true,
       "backgroundColor": "#FFFFFF",
+      "paintInvalidations": [
+        {
+          "object": "LayoutBlockFlow (positioned) DIV class='green'",
+          "rect": [8, 200, 100, 100],
+          "reason": "paint property change"
+        },
+        {
+          "object": "LayoutBlockFlow (positioned) DIV class='green'",
+          "rect": [8, 100, 100, 100],
+          "reason": "paint property change"
+        }
+      ],
       "transform": 1
     }
   ],
diff --git a/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt b/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt
index 45cf6203b..42c3b74 100644
--- a/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt
+++ b/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt
@@ -646,7 +646,6 @@
     attribute @@toStringTag
     getter value
     method constructor
-    setter value
 interface CSSMathMax : CSSMathValue
     attribute @@toStringTag
     getter values
@@ -659,7 +658,6 @@
     attribute @@toStringTag
     getter value
     method constructor
-    setter value
 interface CSSMathProduct : CSSMathValue
     attribute @@toStringTag
     getter values
@@ -726,7 +724,7 @@
     attribute @@toStringTag
     getter state
     method constructor
-interface CSSRotation : CSSTransformComponent
+interface CSSRotate : CSSTransformComponent
     attribute @@toStringTag
     getter angle
     getter x
@@ -837,7 +835,7 @@
     method keys
     method toMatrix
     method values
-interface CSSTranslation : CSSTransformComponent
+interface CSSTranslate : CSSTransformComponent
     attribute @@toStringTag
     getter x
     getter y
@@ -8934,6 +8932,10 @@
 interface XRLayer
     attribute @@toStringTag
     method constructor
+interface XRPresentationContext
+    attribute @@toStringTag
+    getter canvas
+    method constructor
 interface XRPresentationFrame
     attribute @@toStringTag
     getter session
diff --git a/third_party/WebKit/PRESUBMIT.py b/third_party/WebKit/PRESUBMIT.py
index 42dbdf4..cb3bea9 100644
--- a/third_party/WebKit/PRESUBMIT.py
+++ b/third_party/WebKit/PRESUBMIT.py
@@ -143,9 +143,6 @@
     results = []
     for f in input_api.AffectedFiles():
         path = f.LocalPath()
-        _, ext = os.path.splitext(path)
-        if ext not in ('.cc', '.cpp', '.h', '.mm'):
-            continue
         errors = audit_non_blink_usage.check(path, [(i + 1, l) for i, l in enumerate(f.NewContents())])
         if errors:
             errors = audit_non_blink_usage.check(path, f.ChangedContents())
diff --git a/third_party/WebKit/PRESUBMIT_test.py b/third_party/WebKit/PRESUBMIT_test.py
index cd48b20..448fb5f 100644
--- a/third_party/WebKit/PRESUBMIT_test.py
+++ b/third_party/WebKit/PRESUBMIT_test.py
@@ -121,7 +121,6 @@
     disallow_list = [
         'GURL',
         'base::Callback<void()>',
-        'base::OnceCallback<void()>',
         'content::RenderFrame',
         'gfx::Point',
         'gfx::Rect',
@@ -151,6 +150,17 @@
             errors = self.runCheck(filename, ['// %s' % item])
             self.assertEqual([], errors)
 
+    # References in Test files should never be checked.
+    def testCheckTestsIgnored(self):
+        filename = 'third_party/WebKit/Source/core/frame/FrameTest.cc'
+        for item in self.allow_list:
+            errors = self.runCheck(filename, ['// %s' % item])
+            self.assertEqual([], errors)
+
+        for item in self.disallow_list:
+            errors = self.runCheck(filename, ['// %s' % item])
+            self.assertEqual([], errors)
+
     # core, modules, public, et cetera should all have dependency enforcement.
     def testCheckCoreEnforcement(self):
         filename = 'third_party/WebKit/Source/core/frame/frame.cc'
diff --git a/third_party/WebKit/Source/bindings/IDLUnionTypes.md b/third_party/WebKit/Source/bindings/IDLUnionTypes.md
index 244a828..050c2ca0 100644
--- a/third_party/WebKit/Source/bindings/IDLUnionTypes.md
+++ b/third_party/WebKit/Source/bindings/IDLUnionTypes.md
@@ -25,7 +25,7 @@
 Currently we use following alias(es).
 
 ```
-CanvasRenderingContext2DOrWebGLRenderingContextOrWebGL2RenderingContextOrImageBitmapRenderingContext -> RenderingContext
+CanvasRenderingContext2DOrWebGLRenderingContextOrWebGL2RenderingContextOrImageBitmapRenderingContextOrXRPresentationContext -> RenderingContext
 ```
 
 The paths for generated classes depend on the places union types are
diff --git a/third_party/WebKit/Source/bindings/bindings.gni b/third_party/WebKit/Source/bindings/bindings.gni
index 8900aea..2474de02 100644
--- a/third_party/WebKit/Source/bindings/bindings.gni
+++ b/third_party/WebKit/Source/bindings/bindings.gni
@@ -53,7 +53,6 @@
                     "core/v8/Maplike.h",
                     "core/v8/NativeValueTraits.h",
                     "core/v8/NativeValueTraitsImpl.h",
-                    "core/v8/Nullable.h",
                     "core/v8/ReferrerScriptInfo.cpp",
                     "core/v8/ReferrerScriptInfo.h",
                     "core/v8/RejectedPromises.cpp",
diff --git a/third_party/WebKit/Source/bindings/core/v8/DOMWrapperWorldTest.cpp b/third_party/WebKit/Source/bindings/core/v8/DOMWrapperWorldTest.cpp
index 4365830..2ed15cbf 100644
--- a/third_party/WebKit/Source/bindings/core/v8/DOMWrapperWorldTest.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/DOMWrapperWorldTest.cpp
@@ -4,12 +4,12 @@
 
 #include "platform/bindings/DOMWrapperWorld.h"
 
+#include "base/single_thread_task_runner.h"
 #include "bindings/core/v8/V8BindingForTesting.h"
 #include "bindings/core/v8/V8Initializer.h"
 #include "core/workers/WorkerBackingThread.h"
 #include "core/workers/WorkerBackingThreadStartupData.h"
 #include "platform/CrossThreadFunctional.h"
-#include "platform/WebTaskRunner.h"
 #include "platform/WebThreadSupportingGC.h"
 #include "platform/bindings/V8PerIsolateData.h"
 #include "platform/testing/UnitTestHelpers.h"
@@ -52,8 +52,9 @@
   return worlds;
 }
 
-void WorkerThreadFunc(WorkerBackingThread* thread,
-                      scoped_refptr<WebTaskRunner> main_thread_task_runner) {
+void WorkerThreadFunc(
+    WorkerBackingThread* thread,
+    scoped_refptr<base::SingleThreadTaskRunner> main_thread_task_runner) {
   thread->InitializeOnBackingThread(
       WorkerBackingThreadStartupData::CreateDefault());
 
@@ -118,7 +119,7 @@
   // Start a worker thread and create worlds on that.
   std::unique_ptr<WorkerBackingThread> thread = WorkerBackingThread::Create(
       WebThreadCreationParams("DOMWrapperWorld test thread"));
-  scoped_refptr<WebTaskRunner> main_thread_task_runner =
+  scoped_refptr<base::SingleThreadTaskRunner> main_thread_task_runner =
       Platform::Current()->CurrentThread()->GetWebTaskRunner();
   thread->BackingThread().PostTask(
       FROM_HERE,
diff --git a/third_party/WebKit/Source/bindings/core/v8/Nullable.h b/third_party/WebKit/Source/bindings/core/v8/Nullable.h
deleted file mode 100644
index 0d75879..0000000
--- a/third_party/WebKit/Source/bindings/core/v8/Nullable.h
+++ /dev/null
@@ -1,77 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef Nullable_h
-#define Nullable_h
-
-#include "platform/heap/Handle.h"
-#include "platform/wtf/Assertions.h"
-
-namespace blink {
-
-template <typename T>
-class Nullable {
-  DISALLOW_NEW();
-
- public:
-  Nullable() : value_(), is_null_(true) {}
-
-  Nullable(std::nullptr_t) : value_(), is_null_(true) {}
-
-  Nullable(const T& value) : value_(value), is_null_(false) {}
-
-  Nullable(const Nullable& other)
-      : value_(other.value_), is_null_(other.is_null_) {}
-
-  Nullable& operator=(const Nullable& other) {
-    value_ = other.value_;
-    is_null_ = other.is_null_;
-    return *this;
-  }
-
-  Nullable& operator=(std::nullptr_t) {
-    value_ = T();
-    is_null_ = true;
-    return *this;
-  }
-
-  void Set(const T& value) {
-    value_ = value;
-    is_null_ = false;
-  }
-
-  void Set(std::nullptr_t) {
-    value_ = T();
-    is_null_ = true;
-  }
-
-  const T& Get() const {
-    DCHECK(!is_null_);
-    return value_;
-  }
-  T& Get() {
-    DCHECK(!is_null_);
-    return value_;
-  }
-  bool IsNull() const { return is_null_; }
-
-  explicit operator bool() const { return !is_null_; }
-
-  bool operator==(const Nullable& other) const {
-    return (is_null_ && other.is_null_) ||
-           (!is_null_ && !other.is_null_ && value_ == other.value_);
-  }
-
-  void Trace(blink::Visitor* visitor) {
-    TraceIfNeeded<T>::Trace(visitor, value_);
-  }
-
- private:
-  T value_;
-  bool is_null_;
-};
-
-}  // namespace blink
-
-#endif  // Nullable_h
diff --git a/third_party/WebKit/Source/bindings/core/v8/RejectedPromises.cpp b/third_party/WebKit/Source/bindings/core/v8/RejectedPromises.cpp
index dd86e28..9369675 100644
--- a/third_party/WebKit/Source/bindings/core/v8/RejectedPromises.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/RejectedPromises.cpp
@@ -13,7 +13,6 @@
 #include "core/dom/events/EventTarget.h"
 #include "core/events/PromiseRejectionEvent.h"
 #include "core/inspector/ThreadDebugger.h"
-#include "platform/WebTaskRunner.h"
 #include "platform/bindings/ScopedPersistent.h"
 #include "platform/bindings/ScriptState.h"
 #include "platform/bindings/V8PerIsolateData.h"
diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptCustomElementDefinition.cpp b/third_party/WebKit/Source/bindings/core/v8/ScriptCustomElementDefinition.cpp
index e6458ef..a5a53d8 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptCustomElementDefinition.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptCustomElementDefinition.cpp
@@ -188,6 +188,9 @@
     return HandleCreateElementSyncException(document, tag_name, isolate,
                                             exception_state);
   }
+  // 6.1.10. Set result’s namespace prefix to prefix.
+  if (element->prefix() != tag_name.Prefix())
+    element->SetTagNameForCreateElementNS(tag_name);
   DCHECK_EQ(element->GetCustomElementState(), CustomElementState::kCustom);
   return ToHTMLElement(element);
 }
diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptStreamer.cpp b/third_party/WebKit/Source/bindings/core/v8/ScriptStreamer.cpp
index cdc7be35..8cd981f 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptStreamer.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptStreamer.cpp
@@ -506,7 +506,7 @@
     Type script_type,
     ScriptState* script_state,
     v8::ScriptCompiler::CompileOptions compile_options,
-    scoped_refptr<WebTaskRunner> loading_task_runner)
+    scoped_refptr<base::SingleThreadTaskRunner> loading_task_runner)
     : pending_script_(script),
       detached_(false),
       stream_(nullptr),
@@ -568,7 +568,7 @@
     Type script_type,
     Settings* settings,
     ScriptState* script_state,
-    scoped_refptr<WebTaskRunner> loading_task_runner) {
+    scoped_refptr<base::SingleThreadTaskRunner> loading_task_runner) {
   DCHECK(IsMainThread());
   DCHECK(script_state->ContextIsValid());
   ScriptResource* resource = ToScriptResource(script->GetResource());
diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptStreamer.h b/third_party/WebKit/Source/bindings/core/v8/ScriptStreamer.h
index fce566b8..24d26b86 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptStreamer.h
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptStreamer.h
@@ -7,8 +7,8 @@
 
 #include <memory>
 
+#include "base/single_thread_task_runner.h"
 #include "core/CoreExport.h"
-#include "platform/WebTaskRunner.h"
 #include "platform/heap/Handle.h"
 #include "platform/wtf/Noncopyable.h"
 #include "platform/wtf/text/WTFString.h"
@@ -45,7 +45,7 @@
                              Type,
                              Settings*,
                              ScriptState*,
-                             scoped_refptr<WebTaskRunner>);
+                             scoped_refptr<base::SingleThreadTaskRunner>);
 
   // Returns false if we cannot stream the given encoding.
   static bool ConvertEncoding(const char* encoding_name,
@@ -97,7 +97,7 @@
                  Type,
                  ScriptState*,
                  v8::ScriptCompiler::CompileOptions,
-                 scoped_refptr<WebTaskRunner>);
+                 scoped_refptr<base::SingleThreadTaskRunner>);
 
   void StreamingComplete();
   void NotifyFinishedToClient();
@@ -136,7 +136,7 @@
   // Encoding of the streamed script. Saved for sanity checking purposes.
   v8::ScriptCompiler::StreamedSource::Encoding encoding_;
 
-  scoped_refptr<WebTaskRunner> loading_task_runner_;
+  scoped_refptr<base::SingleThreadTaskRunner> loading_task_runner_;
 };
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptStreamerTest.cpp b/third_party/WebKit/Source/bindings/core/v8/ScriptStreamerTest.cpp
index 5ea1e01e..ce5bcf5 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptStreamerTest.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptStreamerTest.cpp
@@ -115,7 +115,7 @@
     testing::RunPendingTasks();
   }
 
-  scoped_refptr<WebTaskRunner> loading_task_runner_;
+  scoped_refptr<base::SingleThreadTaskRunner> loading_task_runner_;
   // The PendingScript where we stream from. These don't really
   // fetch any data outside the test; the test controls the data by calling
   // ScriptResource::AppendData.
diff --git a/third_party/WebKit/Source/bindings/core/v8/V8Initializer.cpp b/third_party/WebKit/Source/bindings/core/v8/V8Initializer.cpp
index 44558f7..aede214 100644
--- a/third_party/WebKit/Source/bindings/core/v8/V8Initializer.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/V8Initializer.cpp
@@ -254,8 +254,7 @@
 
   DCHECK_EQ(data.GetEvent(), v8::kPromiseRejectWithNoHandler);
 
-  v8::Local<v8::Promise> promise = data.GetPromise();
-  v8::Isolate* isolate = promise->GetIsolate();
+  v8::Isolate* isolate = script_state->GetIsolate();
   ExecutionContext* context = ExecutionContext::From(script_state);
 
   v8::Local<v8::Value> exception = data.GetValue();
diff --git a/third_party/WebKit/Source/bindings/scripts/utilities.py b/third_party/WebKit/Source/bindings/scripts/utilities.py
index b641b42..b3b43597 100644
--- a/third_party/WebKit/Source/bindings/scripts/utilities.py
+++ b/third_party/WebKit/Source/bindings/scripts/utilities.py
@@ -433,7 +433,7 @@
         # modules/canvas2d/CanvasRenderingContext2D.idl
         'CSSImageValueOrHTMLImageElementOrSVGImageElementOrHTMLVideoElementOrHTMLCanvasElementOrImageBitmapOrOffscreenCanvas': 'CanvasImageSource',
         # modules/canvas/HTMLCanvasElementModule.idl
-        'CanvasRenderingContext2DOrWebGLRenderingContextOrWebGL2RenderingContextOrImageBitmapRenderingContext': 'RenderingContext',
+        'CanvasRenderingContext2DOrWebGLRenderingContextOrWebGL2RenderingContextOrImageBitmapRenderingContextOrXRPresentationContext': 'RenderingContext',
         # core/imagebitmap/ImageBitmapFactories.idl
         'HTMLImageElementOrSVGImageElementOrHTMLVideoElementOrHTMLCanvasElementOrBlobOrImageDataOrImageBitmapOrOffscreenCanvas': 'ImageBitmapSource',
         # bindings/tests/idls/core/TestTypedefs.idl
diff --git a/third_party/WebKit/Source/bindings/scripts/v8_methods.py b/third_party/WebKit/Source/bindings/scripts/v8_methods.py
index 1cc0bed..536e031 100644
--- a/third_party/WebKit/Source/bindings/scripts/v8_methods.py
+++ b/third_party/WebKit/Source/bindings/scripts/v8_methods.py
@@ -178,7 +178,7 @@
     return {
         'activity_logging_world_list': v8_utilities.activity_logging_world_list(method),  # [ActivityLogging]
         'arguments': argument_contexts,
-        'cpp_type': (v8_types.cpp_template_type('Nullable', idl_type.cpp_type)
+        'cpp_type': (v8_types.cpp_template_type('Optional', idl_type.cpp_type)
                      if idl_type.is_explicit_nullable else idl_type.cpp_type),
         'cpp_value': this_cpp_value,
         'cpp_type_initializer': idl_type.cpp_type_initializer,
@@ -264,7 +264,7 @@
                                            used_as_variadic_argument=argument.is_variadic)
     context = {
         'cpp_type': (
-            v8_types.cpp_template_type('Nullable', this_cpp_type)
+            v8_types.cpp_template_type('Optional', this_cpp_type)
             if idl_type.is_explicit_nullable and not argument.is_variadic
             else this_cpp_type),
         'cpp_value': this_cpp_value,
@@ -365,8 +365,8 @@
     # [CallWith=ScriptState], [RaisesException]
     if use_local_result(method):
         if idl_type.is_explicit_nullable:
-            # result is of type Nullable<T>
-            cpp_value = 'result.Get()'
+            # result is of type WTF::Optional<T>
+            cpp_value = 'result.value()'
         else:
             cpp_value = 'result'
 
diff --git a/third_party/WebKit/Source/bindings/scripts/v8_types.py b/third_party/WebKit/Source/bindings/scripts/v8_types.py
index 121e356..6569ce2 100644
--- a/third_party/WebKit/Source/bindings/scripts/v8_types.py
+++ b/third_party/WebKit/Source/bindings/scripts/v8_types.py
@@ -939,8 +939,8 @@
     'Dictionary': 'V8SetReturnValue(info, {cpp_value})',
     'DictionaryStatic': '#error not implemented yet',
     # Nullable dictionaries
-    'NullableDictionary': 'V8SetReturnValue(info, result.Get())',
-    'NullableDictionaryStatic': 'V8SetReturnValue(info, result.Get(), info.GetIsolate()->GetCurrentContext()->Global())',
+    'NullableDictionary': 'V8SetReturnValue(info, result.value())',
+    'NullableDictionaryStatic': 'V8SetReturnValue(info, result.value(), info.GetIsolate()->GetCurrentContext()->Global())',
     # Union types or dictionaries
     'DictionaryOrUnion': 'V8SetReturnValue(info, result)',
     'DictionaryOrUnionStatic': 'V8SetReturnValue(info, result, info.GetIsolate()->GetCurrentContext()->Global())',
@@ -1120,7 +1120,7 @@
 
 def is_explicit_nullable(idl_type):
     # Nullable type that isn't implicit nullable (see above.) For such types,
-    # we use Nullable<T> or similar explicit ways to represent a null value.
+    # we use WTF::Optional<T> or similar explicit ways to represent a null value.
     return idl_type.is_nullable and not idl_type.is_implicit_nullable
 
 IdlTypeBase.is_implicit_nullable = property(is_implicit_nullable)
diff --git a/third_party/WebKit/Source/bindings/scripts/v8_union.py b/third_party/WebKit/Source/bindings/scripts/v8_union.py
index 8352fa12..934d65f 100644
--- a/third_party/WebKit/Source/bindings/scripts/v8_union.py
+++ b/third_party/WebKit/Source/bindings/scripts/v8_union.py
@@ -15,9 +15,9 @@
     'bindings/core/v8/Dictionary.h',
     'bindings/core/v8/ExceptionState.h',
     'bindings/core/v8/NativeValueTraits.h',
-    'bindings/core/v8/Nullable.h',
     'bindings/core/v8/V8BindingForCore.h',
     'platform/heap/Handle.h',
+    'platform/wtf/Optional.h',
 ])
 
 
diff --git a/third_party/WebKit/Source/bindings/templates/methods.cpp.tmpl b/third_party/WebKit/Source/bindings/templates/methods.cpp.tmpl
index 0bdd0a0c..891aed7c 100644
--- a/third_party/WebKit/Source/bindings/templates/methods.cpp.tmpl
+++ b/third_party/WebKit/Source/bindings/templates/methods.cpp.tmpl
@@ -303,7 +303,7 @@
 {{generate_constructor_wrapper(method)}}
 {%- elif v8_set_return_value %}
 {% if method.is_explicit_nullable %}
-if (result.IsNull())
+if (!result)
   V8SetReturnValueNull(info);
 else
   {{v8_set_return_value}};
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/V8TestObject.cpp b/third_party/WebKit/Source/bindings/tests/results/core/V8TestObject.cpp
index 7ceb58a..3c9f63c 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/V8TestObject.cpp
+++ b/third_party/WebKit/Source/bindings/tests/results/core/V8TestObject.cpp
@@ -5280,7 +5280,7 @@
     return;
   }
 
-  Nullable<Vector<int32_t>> longSequenceArg;
+  Optional<Vector<int32_t>> longSequenceArg;
   if (!info[0]->IsNullOrUndefined()) {
     longSequenceArg = NativeValueTraits<IDLSequence<IDLLong>>::NativeValue(info.GetIsolate(), info[0], exceptionState);
     if (exceptionState.HadException())
@@ -5335,11 +5335,11 @@
 static void nullableLongMethodMethod(const v8::FunctionCallbackInfo<v8::Value>& info) {
   TestObject* impl = V8TestObject::ToImpl(info.Holder());
 
-  Nullable<int32_t> result = impl->nullableLongMethod();
-  if (result.IsNull())
+  Optional<int32_t> result = impl->nullableLongMethod();
+  if (!result)
     V8SetReturnValueNull(info);
   else
-    V8SetReturnValueInt(info, result.Get());
+    V8SetReturnValueInt(info, result.value());
 }
 
 static void nullableStringMethodMethod(const v8::FunctionCallbackInfo<v8::Value>& info) {
@@ -5357,11 +5357,11 @@
 static void nullableLongSequenceMethodMethod(const v8::FunctionCallbackInfo<v8::Value>& info) {
   TestObject* impl = V8TestObject::ToImpl(info.Holder());
 
-  Nullable<Vector<int32_t>> result = impl->nullableLongSequenceMethod();
-  if (result.IsNull())
+  Optional<Vector<int32_t>> result = impl->nullableLongSequenceMethod();
+  if (!result)
     V8SetReturnValueNull(info);
   else
-    V8SetReturnValue(info, ToV8(result.Get(), info.Holder(), info.GetIsolate()));
+    V8SetReturnValue(info, ToV8(result.value(), info.Holder(), info.GetIsolate()));
 }
 
 static void testInterfaceGarbageCollectedOrDOMStringMethodMethod(const v8::FunctionCallbackInfo<v8::Value>& info) {
@@ -5716,12 +5716,12 @@
 static void nullableTestDictionaryMethodMethod(const v8::FunctionCallbackInfo<v8::Value>& info) {
   TestObject* impl = V8TestObject::ToImpl(info.Holder());
 
-  Nullable<TestDictionary> result;
+  Optional<TestDictionary> result;
   impl->nullableTestDictionaryMethod(result);
-  if (result.IsNull())
+  if (!result)
     V8SetReturnValueNull(info);
   else
-    V8SetReturnValue(info, result.Get());
+    V8SetReturnValue(info, result.value());
 }
 
 static void staticTestDictionaryMethodMethod(const v8::FunctionCallbackInfo<v8::Value>& info) {
@@ -5731,12 +5731,12 @@
 }
 
 static void staticNullableTestDictionaryMethodMethod(const v8::FunctionCallbackInfo<v8::Value>& info) {
-  Nullable<TestDictionary> result;
+  Optional<TestDictionary> result;
   TestObject::staticNullableTestDictionaryMethod(result);
-  if (result.IsNull())
+  if (!result)
     V8SetReturnValueNull(info);
   else
-    V8SetReturnValue(info, result.Get(), info.GetIsolate()->GetCurrentContext()->Global());
+    V8SetReturnValue(info, result.value(), info.GetIsolate()->GetCurrentContext()->Global());
 }
 
 static void passPermissiveDictionaryMethodMethod(const v8::FunctionCallbackInfo<v8::Value>& info) {
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/array_buffer_or_array_buffer_view_or_dictionary.h b/third_party/WebKit/Source/bindings/tests/results/core/array_buffer_or_array_buffer_view_or_dictionary.h
index a053c602..8e530b6e 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/array_buffer_or_array_buffer_view_or_dictionary.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/array_buffer_or_array_buffer_view_or_dictionary.h
@@ -14,13 +14,13 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8ArrayBufferView.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "core/typed_arrays/ArrayBufferViewHelpers.h"
 #include "core/typed_arrays/FlexibleArrayBufferView.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/boolean_or_element_sequence.h b/third_party/WebKit/Source/bindings/tests/results/core/boolean_or_element_sequence.h
index 8f34bd1e..f9b1f3d5 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/boolean_or_element_sequence.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/boolean_or_element_sequence.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/boolean_or_string_or_unrestricted_double.h b/third_party/WebKit/Source/bindings/tests/results/core/boolean_or_string_or_unrestricted_double.h
index 5ea7f89..864a88a 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/boolean_or_string_or_unrestricted_double.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/boolean_or_string_or_unrestricted_double.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/boolean_or_test_callback_interface.h b/third_party/WebKit/Source/bindings/tests/results/core/boolean_or_test_callback_interface.h
index 6cbc382..d6d2fac 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/boolean_or_test_callback_interface.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/boolean_or_test_callback_interface.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/byte_string_or_node_list.h b/third_party/WebKit/Source/bindings/tests/results/core/byte_string_or_node_list.h
index 9fb449a..c582097 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/byte_string_or_node_list.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/byte_string_or_node_list.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/byte_string_sequence_sequence_or_byte_string_byte_string_record.h b/third_party/WebKit/Source/bindings/tests/results/core/byte_string_sequence_sequence_or_byte_string_byte_string_record.h
index e0513db..df7bb47 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/byte_string_sequence_sequence_or_byte_string_byte_string_record.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/byte_string_sequence_sequence_or_byte_string_byte_string_record.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/double_or_double_or_null_sequence.h b/third_party/WebKit/Source/bindings/tests/results/core/double_or_double_or_null_sequence.h
index bea3b997..7cd16aa 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/double_or_double_or_null_sequence.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/double_or_double_or_null_sequence.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/double_or_double_sequence.h b/third_party/WebKit/Source/bindings/tests/results/core/double_or_double_sequence.h
index c2a5de2..4f89698 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/double_or_double_sequence.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/double_or_double_sequence.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/double_or_long_or_boolean_sequence.h b/third_party/WebKit/Source/bindings/tests/results/core/double_or_long_or_boolean_sequence.h
index 24c6e3e..4738ac3 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/double_or_long_or_boolean_sequence.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/double_or_long_or_boolean_sequence.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/double_or_string.h b/third_party/WebKit/Source/bindings/tests/results/core/double_or_string.h
index 2b5712a..cd139cca 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/double_or_string.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/double_or_string.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/double_or_string_or_double_or_string_sequence.h b/third_party/WebKit/Source/bindings/tests/results/core/double_or_string_or_double_or_string_sequence.h
index e876461..b09f53499 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/double_or_string_or_double_or_string_sequence.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/double_or_string_or_double_or_string_sequence.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/element_sequence_or_byte_string_double_or_string_record.h b/third_party/WebKit/Source/bindings/tests/results/core/element_sequence_or_byte_string_double_or_string_record.h
index bf3388b..82967d3 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/element_sequence_or_byte_string_double_or_string_record.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/element_sequence_or_byte_string_double_or_string_record.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/float_or_boolean.h b/third_party/WebKit/Source/bindings/tests/results/core/float_or_boolean.h
index 1e39eaf4..a548f97 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/float_or_boolean.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/float_or_boolean.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/long_or_boolean.h b/third_party/WebKit/Source/bindings/tests/results/core/long_or_boolean.h
index 55862ea0..9725866 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/long_or_boolean.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/long_or_boolean.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/long_or_test_dictionary.h b/third_party/WebKit/Source/bindings/tests/results/core/long_or_test_dictionary.h
index 13fd871..1b5debb 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/long_or_test_dictionary.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/long_or_test_dictionary.h
@@ -14,11 +14,11 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "bindings/core/v8/V8TestDictionary.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/long_sequence_or_event.h b/third_party/WebKit/Source/bindings/tests/results/core/long_sequence_or_event.h
index bb06a17..6253e33 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/long_sequence_or_event.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/long_sequence_or_event.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/nested_union_type.h b/third_party/WebKit/Source/bindings/tests/results/core/nested_union_type.h
index 41351a3..4b31182f 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/nested_union_type.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/nested_union_type.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/node_or_node_list.h b/third_party/WebKit/Source/bindings/tests/results/core/node_or_node_list.h
index 8c83695..964149a 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/node_or_node_list.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/node_or_node_list.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/string_or_array_buffer_or_array_buffer_view.h b/third_party/WebKit/Source/bindings/tests/results/core/string_or_array_buffer_or_array_buffer_view.h
index 58e9d32..6561ddb 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/string_or_array_buffer_or_array_buffer_view.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/string_or_array_buffer_or_array_buffer_view.h
@@ -14,13 +14,13 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8ArrayBufferView.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "core/typed_arrays/ArrayBufferViewHelpers.h"
 #include "core/typed_arrays/FlexibleArrayBufferView.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/string_or_double.h b/third_party/WebKit/Source/bindings/tests/results/core/string_or_double.h
index e5dce27..462190a 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/string_or_double.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/string_or_double.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/string_or_string_sequence.h b/third_party/WebKit/Source/bindings/tests/results/core/string_or_string_sequence.h
index 8981f25..43dc73d7 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/string_or_string_sequence.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/string_or_string_sequence.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/test_enum_or_double.h b/third_party/WebKit/Source/bindings/tests/results/core/test_enum_or_double.h
index 2605ff4d..1832d1d 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/test_enum_or_double.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/test_enum_or_double.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/test_enum_or_test_enum_sequence.h b/third_party/WebKit/Source/bindings/tests/results/core/test_enum_or_test_enum_sequence.h
index 3bfa099a..9615b0d 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/test_enum_or_test_enum_sequence.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/test_enum_or_test_enum_sequence.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/test_interface_2_or_uint8_array.h b/third_party/WebKit/Source/bindings/tests/results/core/test_interface_2_or_uint8_array.h
index 0c7aab4..f592835 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/test_interface_2_or_uint8_array.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/test_interface_2_or_uint8_array.h
@@ -14,7 +14,6 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8ArrayBufferView.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "bindings/core/v8/V8Uint8Array.h"
@@ -22,6 +21,7 @@
 #include "core/typed_arrays/ArrayBufferViewHelpers.h"
 #include "core/typed_arrays/FlexibleArrayBufferView.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/test_interface_garbage_collected_or_string.h b/third_party/WebKit/Source/bindings/tests/results/core/test_interface_garbage_collected_or_string.h
index 652438b..7beeeec1 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/test_interface_garbage_collected_or_string.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/test_interface_garbage_collected_or_string.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/test_interface_or_long.h b/third_party/WebKit/Source/bindings/tests/results/core/test_interface_or_long.h
index 42d023b..36c2d5b 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/test_interface_or_long.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/test_interface_or_long.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/test_interface_or_test_interface_empty.h b/third_party/WebKit/Source/bindings/tests/results/core/test_interface_or_test_interface_empty.h
index f558d26..b6e76e3 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/test_interface_or_test_interface_empty.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/test_interface_or_test_interface_empty.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/unrestricted_double_or_string.h b/third_party/WebKit/Source/bindings/tests/results/core/unrestricted_double_or_string.h
index 08e3913..eafb688 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/unrestricted_double_or_string.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/unrestricted_double_or_string.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/unsigned_long_long_or_boolean_or_test_callback_interface.h b/third_party/WebKit/Source/bindings/tests/results/core/unsigned_long_long_or_boolean_or_test_callback_interface.h
index 7a92b2e..89a2262 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/unsigned_long_long_or_boolean_or_test_callback_interface.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/unsigned_long_long_or_boolean_or_test_callback_interface.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/core/xml_http_request_or_string.h b/third_party/WebKit/Source/bindings/tests/results/core/xml_http_request_or_string.h
index bdeb53c6..86306d35 100644
--- a/third_party/WebKit/Source/bindings/tests/results/core/xml_http_request_or_string.h
+++ b/third_party/WebKit/Source/bindings/tests/results/core/xml_http_request_or_string.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "core/CoreExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/bindings/tests/results/modules/boolean_or_string.h b/third_party/WebKit/Source/bindings/tests/results/modules/boolean_or_string.h
index c86f194..a5ddd78 100644
--- a/third_party/WebKit/Source/bindings/tests/results/modules/boolean_or_string.h
+++ b/third_party/WebKit/Source/bindings/tests/results/modules/boolean_or_string.h
@@ -14,10 +14,10 @@
 #include "bindings/core/v8/Dictionary.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/NativeValueTraits.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/V8BindingForCore.h"
 #include "modules/ModulesExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/core/core_idl_files.gni b/third_party/WebKit/Source/core/core_idl_files.gni
index cb18fc7..744d9de 100644
--- a/third_party/WebKit/Source/core/core_idl_files.gni
+++ b/third_party/WebKit/Source/core/core_idl_files.gni
@@ -87,13 +87,13 @@
                     "css/cssom/CSSPerspective.idl",
                     "css/cssom/CSSPositionValue.idl",
                     "css/cssom/CSSResourceValue.idl",
-                    "css/cssom/CSSRotation.idl",
+                    "css/cssom/CSSRotate.idl",
                     "css/cssom/CSSScale.idl",
                     "css/cssom/CSSSkew.idl",
                     "css/cssom/CSSStyleValue.idl",
                     "css/cssom/CSSTransformComponent.idl",
                     "css/cssom/CSSTransformValue.idl",
-                    "css/cssom/CSSTranslation.idl",
+                    "css/cssom/CSSTranslate.idl",
                     "css/cssom/CSSURLImageValue.idl",
                     "css/cssom/CSSUnitValue.idl",
                     "css/cssom/CSSUnparsedValue.idl",
diff --git a/third_party/WebKit/Source/core/css/BUILD.gn b/third_party/WebKit/Source/core/css/BUILD.gn
index bf17f90a..018c1fd4 100644
--- a/third_party/WebKit/Source/core/css/BUILD.gn
+++ b/third_party/WebKit/Source/core/css/BUILD.gn
@@ -340,8 +340,8 @@
     "cssom/CSSPositionValue.cpp",
     "cssom/CSSPositionValue.h",
     "cssom/CSSResourceValue.h",
-    "cssom/CSSRotation.cpp",
-    "cssom/CSSRotation.h",
+    "cssom/CSSRotate.cpp",
+    "cssom/CSSRotate.h",
     "cssom/CSSScale.cpp",
     "cssom/CSSScale.h",
     "cssom/CSSSkew.cpp",
@@ -355,8 +355,8 @@
     "cssom/CSSTransformComponent.h",
     "cssom/CSSTransformValue.cpp",
     "cssom/CSSTransformValue.h",
-    "cssom/CSSTranslation.cpp",
-    "cssom/CSSTranslation.h",
+    "cssom/CSSTranslate.cpp",
+    "cssom/CSSTranslate.h",
     "cssom/CSSURLImageValue.h",
     "cssom/CSSUnitValue.cpp",
     "cssom/CSSUnitValue.h",
diff --git a/third_party/WebKit/Source/core/css/CSSLayoutFunctionValue.cpp b/third_party/WebKit/Source/core/css/CSSLayoutFunctionValue.cpp
index c9ac6f7..982b4ba 100644
--- a/third_party/WebKit/Source/core/css/CSSLayoutFunctionValue.cpp
+++ b/third_party/WebKit/Source/core/css/CSSLayoutFunctionValue.cpp
@@ -8,6 +8,7 @@
 #include "platform/wtf/text/StringBuilder.h"
 
 namespace blink {
+namespace cssvalue {
 
 CSSLayoutFunctionValue::CSSLayoutFunctionValue(CSSCustomIdentValue* name,
                                                bool is_inline)
@@ -38,4 +39,5 @@
   CSSValue::TraceAfterDispatch(visitor);
 }
 
+}  // namespace cssvalue
 }  // namespace blink
diff --git a/third_party/WebKit/Source/core/css/CSSLayoutFunctionValue.h b/third_party/WebKit/Source/core/css/CSSLayoutFunctionValue.h
index fe52722b..7bd0897 100644
--- a/third_party/WebKit/Source/core/css/CSSLayoutFunctionValue.h
+++ b/third_party/WebKit/Source/core/css/CSSLayoutFunctionValue.h
@@ -13,6 +13,8 @@
 
 class CSSCustomIdentValue;
 
+namespace cssvalue {
+
 class CSSLayoutFunctionValue : public CSSValue {
  public:
   static CSSLayoutFunctionValue* Create(CSSCustomIdentValue* name,
@@ -37,6 +39,7 @@
 
 DEFINE_CSS_VALUE_TYPE_CASTS(CSSLayoutFunctionValue, IsLayoutFunctionValue());
 
+}  // namespace cssvalue
 }  // namespace blink
 
 #endif  // CSSLayoutFunctionValue_h
diff --git a/third_party/WebKit/Source/core/css/CSSTimingFunctionValue.cpp b/third_party/WebKit/Source/core/css/CSSTimingFunctionValue.cpp
index b1e3d6c..1150393 100644
--- a/third_party/WebKit/Source/core/css/CSSTimingFunctionValue.cpp
+++ b/third_party/WebKit/Source/core/css/CSSTimingFunctionValue.cpp
@@ -28,6 +28,7 @@
 #include "platform/wtf/text/WTFString.h"
 
 namespace blink {
+namespace cssvalue {
 
 String CSSCubicBezierTimingFunctionValue::CustomCSSText() const {
   return "cubic-bezier(" + String::Number(x1_) + ", " + String::Number(y1_) +
@@ -70,4 +71,5 @@
   return frames_ == other.frames_;
 }
 
+}  // namespace cssvalue
 }  // namespace blink
diff --git a/third_party/WebKit/Source/core/css/CSSTimingFunctionValue.h b/third_party/WebKit/Source/core/css/CSSTimingFunctionValue.h
index e6ea3b9..d9d843f 100644
--- a/third_party/WebKit/Source/core/css/CSSTimingFunctionValue.h
+++ b/third_party/WebKit/Source/core/css/CSSTimingFunctionValue.h
@@ -32,6 +32,7 @@
 #include "platform/runtime_enabled_features.h"
 
 namespace blink {
+namespace cssvalue {
 
 class CSSCubicBezierTimingFunctionValue : public CSSValue {
  public:
@@ -135,6 +136,7 @@
 DEFINE_CSS_VALUE_TYPE_CASTS(CSSFramesTimingFunctionValue,
                             IsFramesTimingFunctionValue());
 
+}  // namespace cssvalue
 }  // namespace blink
 
 #endif
diff --git a/third_party/WebKit/Source/core/css/MediaList.idl b/third_party/WebKit/Source/core/css/MediaList.idl
index 180dcf1..1c20b6a 100644
--- a/third_party/WebKit/Source/core/css/MediaList.idl
+++ b/third_party/WebKit/Source/core/css/MediaList.idl
@@ -29,7 +29,7 @@
 [
     Exposed=Window
 ] interface MediaList {
-    [TreatNullAs=EmptyString] stringifier attribute DOMString mediaText;
+    stringifier attribute [TreatNullAs=EmptyString] DOMString mediaText;
     readonly attribute unsigned long length;
     [Measure] getter DOMString? item(unsigned long index);
     // TODO(foolip): appendMedium() and deleteMedium() should never throw.
diff --git a/third_party/WebKit/Source/core/css/cssom/CSSMathInvert.h b/third_party/WebKit/Source/core/css/cssom/CSSMathInvert.h
index 1206ea57..ba3fbc6 100644
--- a/third_party/WebKit/Source/core/css/cssom/CSSMathInvert.h
+++ b/third_party/WebKit/Source/core/css/cssom/CSSMathInvert.h
@@ -29,9 +29,6 @@
   String getOperator() const final { return "invert"; }
 
   void value(CSSNumberish& value) { value.SetCSSNumericValue(value_); }
-  void setValue(const CSSNumberish& value) {
-    value_ = CSSNumericValue::FromNumberish(value);
-  }
 
   // From CSSStyleValue.
   StyleValueType GetType() const final { return CSSStyleValue::kInvertType; }
diff --git a/third_party/WebKit/Source/core/css/cssom/CSSMathInvert.idl b/third_party/WebKit/Source/core/css/cssom/CSSMathInvert.idl
index 032e80a..3d9fdfc8 100644
--- a/third_party/WebKit/Source/core/css/cssom/CSSMathInvert.idl
+++ b/third_party/WebKit/Source/core/css/cssom/CSSMathInvert.idl
@@ -9,5 +9,5 @@
   Exposed=(Window,PaintWorklet),
   RuntimeEnabled=CSSTypedOM
 ] interface CSSMathInvert : CSSMathValue {
-  attribute CSSNumberish value;
+  readonly attribute CSSNumberish value;
 };
diff --git a/third_party/WebKit/Source/core/css/cssom/CSSMathNegate.h b/third_party/WebKit/Source/core/css/cssom/CSSMathNegate.h
index d7ca783..4e87fda 100644
--- a/third_party/WebKit/Source/core/css/cssom/CSSMathNegate.h
+++ b/third_party/WebKit/Source/core/css/cssom/CSSMathNegate.h
@@ -28,9 +28,6 @@
   String getOperator() const final { return "negate"; }
 
   void value(CSSNumberish& value) { value.SetCSSNumericValue(value_); }
-  void setValue(const CSSNumberish& value) {
-    value_ = CSSNumericValue::FromNumberish(value);
-  }
 
   // From CSSStyleValue.
   StyleValueType GetType() const final { return CSSStyleValue::kNegateType; }
diff --git a/third_party/WebKit/Source/core/css/cssom/CSSMathNegate.idl b/third_party/WebKit/Source/core/css/cssom/CSSMathNegate.idl
index 1481462..a137cd6 100644
--- a/third_party/WebKit/Source/core/css/cssom/CSSMathNegate.idl
+++ b/third_party/WebKit/Source/core/css/cssom/CSSMathNegate.idl
@@ -9,5 +9,5 @@
   Exposed=(Window,PaintWorklet),
   RuntimeEnabled=CSSTypedOM
 ] interface CSSMathNegate : CSSMathValue {
-  attribute CSSNumberish value;
+  readonly attribute CSSNumberish value;
 };
diff --git a/third_party/WebKit/Source/core/css/cssom/CSSRotation.cpp b/third_party/WebKit/Source/core/css/cssom/CSSRotate.cpp
similarity index 63%
rename from third_party/WebKit/Source/core/css/cssom/CSSRotation.cpp
rename to third_party/WebKit/Source/core/css/cssom/CSSRotate.cpp
index 03ab7c9..52af7be 100644
--- a/third_party/WebKit/Source/core/css/cssom/CSSRotation.cpp
+++ b/third_party/WebKit/Source/core/css/cssom/CSSRotate.cpp
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "core/css/cssom/CSSRotation.h"
+#include "core/css/cssom/CSSRotate.h"
 
 #include "bindings/core/v8/ExceptionState.h"
 #include "core/css/CSSFunctionValue.h"
@@ -23,14 +23,14 @@
          value->Type().MatchesBaseType(CSSNumericValueType::BaseType::kAngle);
 }
 
-CSSRotation* FromCSSRotate(const CSSFunctionValue& value) {
+CSSRotate* FromCSSRotate(const CSSFunctionValue& value) {
   DCHECK_EQ(value.length(), 1UL);
   CSSNumericValue* angle =
       CSSNumericValue::FromCSSValue(ToCSSPrimitiveValue(value.Item(0)));
-  return CSSRotation::Create(angle);
+  return CSSRotate::Create(angle);
 }
 
-CSSRotation* FromCSSRotate3d(const CSSFunctionValue& value) {
+CSSRotate* FromCSSRotate3d(const CSSFunctionValue& value) {
   DCHECK_EQ(value.length(), 4UL);
 
   CSSNumericValue* x =
@@ -42,10 +42,10 @@
   CSSNumericValue* angle =
       CSSNumericValue::FromCSSValue(ToCSSPrimitiveValue(value.Item(3)));
 
-  return CSSRotation::Create(x, y, z, angle);
+  return CSSRotate::Create(x, y, z, angle);
 }
 
-CSSRotation* FromCSSRotateXYZ(const CSSFunctionValue& value) {
+CSSRotate* FromCSSRotateXYZ(const CSSFunctionValue& value) {
   DCHECK_EQ(value.length(), 1UL);
 
   CSSNumericValue* angle =
@@ -53,17 +53,14 @@
 
   switch (value.FunctionType()) {
     case CSSValueRotateX:
-      return CSSRotation::Create(CSSUnitValue::Create(1),
-                                 CSSUnitValue::Create(0),
-                                 CSSUnitValue::Create(0), angle);
+      return CSSRotate::Create(CSSUnitValue::Create(1), CSSUnitValue::Create(0),
+                               CSSUnitValue::Create(0), angle);
     case CSSValueRotateY:
-      return CSSRotation::Create(CSSUnitValue::Create(0),
-                                 CSSUnitValue::Create(1),
-                                 CSSUnitValue::Create(0), angle);
+      return CSSRotate::Create(CSSUnitValue::Create(0), CSSUnitValue::Create(1),
+                               CSSUnitValue::Create(0), angle);
     case CSSValueRotateZ:
-      return CSSRotation::Create(CSSUnitValue::Create(0),
-                                 CSSUnitValue::Create(0),
-                                 CSSUnitValue::Create(1), angle);
+      return CSSRotate::Create(CSSUnitValue::Create(0), CSSUnitValue::Create(0),
+                               CSSUnitValue::Create(1), angle);
     default:
       NOTREACHED();
       return nullptr;
@@ -72,21 +69,21 @@
 
 }  // namespace
 
-CSSRotation* CSSRotation::Create(CSSNumericValue* angle,
-                                 ExceptionState& exception_state) {
+CSSRotate* CSSRotate::Create(CSSNumericValue* angle,
+                             ExceptionState& exception_state) {
   if (!IsValidRotateAngle(angle)) {
-    exception_state.ThrowTypeError("Must pass an angle to CSSRotation");
+    exception_state.ThrowTypeError("Must pass an angle to CSSRotate");
     return nullptr;
   }
-  return new CSSRotation(CSSUnitValue::Create(0), CSSUnitValue::Create(0),
-                         CSSUnitValue::Create(1), angle, true /* is2D */);
+  return new CSSRotate(CSSUnitValue::Create(0), CSSUnitValue::Create(0),
+                       CSSUnitValue::Create(1), angle, true /* is2D */);
 }
 
-CSSRotation* CSSRotation::Create(const CSSNumberish& x,
-                                 const CSSNumberish& y,
-                                 const CSSNumberish& z,
-                                 CSSNumericValue* angle,
-                                 ExceptionState& exception_state) {
+CSSRotate* CSSRotate::Create(const CSSNumberish& x,
+                             const CSSNumberish& y,
+                             const CSSNumberish& z,
+                             CSSNumericValue* angle,
+                             ExceptionState& exception_state) {
   CSSNumericValue* x_value = CSSNumericValue::FromNumberish(x);
   CSSNumericValue* y_value = CSSNumericValue::FromNumberish(y);
   CSSNumericValue* z_value = CSSNumericValue::FromNumberish(z);
@@ -97,25 +94,25 @@
     return nullptr;
   }
   if (!IsValidRotateAngle(angle)) {
-    exception_state.ThrowTypeError("Must pass an angle to CSSRotation");
+    exception_state.ThrowTypeError("Must pass an angle to CSSRotate");
     return nullptr;
   }
-  return new CSSRotation(x_value, y_value, z_value, angle, false /* is2D */);
+  return new CSSRotate(x_value, y_value, z_value, angle, false /* is2D */);
 }
 
-CSSRotation* CSSRotation::Create(CSSNumericValue* angle) {
-  return new CSSRotation(CSSUnitValue::Create(0), CSSUnitValue::Create(0),
-                         CSSUnitValue::Create(1), angle, true /* is2D */);
+CSSRotate* CSSRotate::Create(CSSNumericValue* angle) {
+  return new CSSRotate(CSSUnitValue::Create(0), CSSUnitValue::Create(0),
+                       CSSUnitValue::Create(1), angle, true /* is2D */);
 }
 
-CSSRotation* CSSRotation::Create(CSSNumericValue* x,
-                                 CSSNumericValue* y,
-                                 CSSNumericValue* z,
-                                 CSSNumericValue* angle) {
-  return new CSSRotation(x, y, z, angle, false /* is2D */);
+CSSRotate* CSSRotate::Create(CSSNumericValue* x,
+                             CSSNumericValue* y,
+                             CSSNumericValue* z,
+                             CSSNumericValue* angle) {
+  return new CSSRotate(x, y, z, angle, false /* is2D */);
 }
 
-CSSRotation* CSSRotation::FromCSSValue(const CSSFunctionValue& value) {
+CSSRotate* CSSRotate::FromCSSValue(const CSSFunctionValue& value) {
   switch (value.FunctionType()) {
     case CSSValueRotate:
       return FromCSSRotate(value);
@@ -131,16 +128,16 @@
   }
 }
 
-void CSSRotation::setAngle(CSSNumericValue* angle,
-                           ExceptionState& exception_state) {
+void CSSRotate::setAngle(CSSNumericValue* angle,
+                         ExceptionState& exception_state) {
   if (!IsValidRotateAngle(angle)) {
-    exception_state.ThrowTypeError("Must pass an angle to CSSRotation");
+    exception_state.ThrowTypeError("Must pass an angle to CSSRotate");
     return;
   }
   angle_ = angle;
 }
 
-const DOMMatrix* CSSRotation::AsMatrix(ExceptionState& exception_state) const {
+const DOMMatrix* CSSRotate::AsMatrix(ExceptionState& exception_state) const {
   CSSUnitValue* x = x_->to(CSSPrimitiveValue::UnitType::kNumber);
   CSSUnitValue* y = y_->to(CSSPrimitiveValue::UnitType::kNumber);
   CSSUnitValue* z = z_->to(CSSPrimitiveValue::UnitType::kNumber);
@@ -161,7 +158,7 @@
   return matrix;
 }
 
-const CSSFunctionValue* CSSRotation::ToCSSValue() const {
+const CSSFunctionValue* CSSRotate::ToCSSValue() const {
   DCHECK(x_->to(CSSPrimitiveValue::UnitType::kNumber));
   DCHECK(y_->to(CSSPrimitiveValue::UnitType::kNumber));
   DCHECK(z_->to(CSSPrimitiveValue::UnitType::kNumber));
@@ -189,7 +186,7 @@
   return result;
 }
 
-void CSSRotation::setX(const CSSNumberish& x, ExceptionState& exception_state) {
+void CSSRotate::setX(const CSSNumberish& x, ExceptionState& exception_state) {
   CSSNumericValue* value = CSSNumericValue::FromNumberish(x);
   if (!IsValidRotateCoord(value)) {
     exception_state.ThrowTypeError("Must specify a number unit");
@@ -198,7 +195,7 @@
   x_ = value;
 }
 
-void CSSRotation::setY(const CSSNumberish& y, ExceptionState& exception_state) {
+void CSSRotate::setY(const CSSNumberish& y, ExceptionState& exception_state) {
   CSSNumericValue* value = CSSNumericValue::FromNumberish(y);
   if (!IsValidRotateCoord(value)) {
     exception_state.ThrowTypeError("Must specify a number unit");
@@ -207,7 +204,7 @@
   y_ = value;
 }
 
-void CSSRotation::setZ(const CSSNumberish& z, ExceptionState& exception_state) {
+void CSSRotate::setZ(const CSSNumberish& z, ExceptionState& exception_state) {
   CSSNumericValue* value = CSSNumericValue::FromNumberish(z);
   if (!IsValidRotateCoord(value)) {
     exception_state.ThrowTypeError("Must specify a number unit");
@@ -216,11 +213,11 @@
   z_ = value;
 }
 
-CSSRotation::CSSRotation(CSSNumericValue* x,
-                         CSSNumericValue* y,
-                         CSSNumericValue* z,
-                         CSSNumericValue* angle,
-                         bool is2D)
+CSSRotate::CSSRotate(CSSNumericValue* x,
+                     CSSNumericValue* y,
+                     CSSNumericValue* z,
+                     CSSNumericValue* angle,
+                     bool is2D)
     : CSSTransformComponent(is2D), angle_(angle), x_(x), y_(y), z_(z) {
   DCHECK(IsValidRotateCoord(x));
   DCHECK(IsValidRotateCoord(y));
diff --git a/third_party/WebKit/Source/core/css/cssom/CSSRotation.h b/third_party/WebKit/Source/core/css/cssom/CSSRotate.h
similarity index 60%
rename from third_party/WebKit/Source/core/css/cssom/CSSRotation.h
rename to third_party/WebKit/Source/core/css/cssom/CSSRotate.h
index 3ebf02c..af6e181 100644
--- a/third_party/WebKit/Source/core/css/cssom/CSSRotation.h
+++ b/third_party/WebKit/Source/core/css/cssom/CSSRotate.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CSSRotation_h
-#define CSSRotation_h
+#ifndef CSSRotate_h
+#define CSSRotate_h
 
 #include "base/macros.h"
 #include "core/css/cssom/CSSNumericValue.h"
@@ -17,26 +17,26 @@
 
 // Represents a rotation value in a CSSTransformValue used for properties like
 // "transform".
-// See CSSRotation.idl for more information about this class.
-class CORE_EXPORT CSSRotation final : public CSSTransformComponent {
+// See CSSRotate.idl for more information about this class.
+class CORE_EXPORT CSSRotate final : public CSSTransformComponent {
   DEFINE_WRAPPERTYPEINFO();
 
  public:
   // Constructors defined in the IDL.
-  static CSSRotation* Create(CSSNumericValue* angle, ExceptionState&);
-  static CSSRotation* Create(const CSSNumberish& x,
-                             const CSSNumberish& y,
-                             const CSSNumberish& z,
-                             CSSNumericValue* angle,
-                             ExceptionState&);
+  static CSSRotate* Create(CSSNumericValue* angle, ExceptionState&);
+  static CSSRotate* Create(const CSSNumberish& x,
+                           const CSSNumberish& y,
+                           const CSSNumberish& z,
+                           CSSNumericValue* angle,
+                           ExceptionState&);
 
-  // Blink-internal ways of creating CSSRotations.
-  static CSSRotation* Create(CSSNumericValue* angle);
-  static CSSRotation* Create(CSSNumericValue* x,
-                             CSSNumericValue* y,
-                             CSSNumericValue* z,
-                             CSSNumericValue* angle);
-  static CSSRotation* FromCSSValue(const CSSFunctionValue&);
+  // Blink-internal ways of creating CSSRotates.
+  static CSSRotate* Create(CSSNumericValue* angle);
+  static CSSRotate* Create(CSSNumericValue* x,
+                           CSSNumericValue* y,
+                           CSSNumericValue* z,
+                           CSSNumericValue* angle);
+  static CSSRotate* FromCSSValue(const CSSFunctionValue&);
 
   // Getters and setters for attributes defined in the IDL.
   CSSNumericValue* angle() { return angle_.Get(); }
@@ -62,17 +62,17 @@
   }
 
  private:
-  CSSRotation(CSSNumericValue* x,
-              CSSNumericValue* y,
-              CSSNumericValue* z,
-              CSSNumericValue* angle,
-              bool is2D);
+  CSSRotate(CSSNumericValue* x,
+            CSSNumericValue* y,
+            CSSNumericValue* z,
+            CSSNumericValue* angle,
+            bool is2D);
 
   Member<CSSNumericValue> angle_;
   Member<CSSNumericValue> x_;
   Member<CSSNumericValue> y_;
   Member<CSSNumericValue> z_;
-  DISALLOW_COPY_AND_ASSIGN(CSSRotation);
+  DISALLOW_COPY_AND_ASSIGN(CSSRotate);
 };
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/core/css/cssom/CSSRotation.idl b/third_party/WebKit/Source/core/css/cssom/CSSRotate.idl
similarity index 85%
rename from third_party/WebKit/Source/core/css/cssom/CSSRotation.idl
rename to third_party/WebKit/Source/core/css/cssom/CSSRotate.idl
index 46f2e44..4426692 100644
--- a/third_party/WebKit/Source/core/css/cssom/CSSRotation.idl
+++ b/third_party/WebKit/Source/core/css/cssom/CSSRotate.idl
@@ -4,14 +4,14 @@
 
 // Represents a rotation value in a CSSTransformValue used for properties like
 // "transform".
-// Spec: https://drafts.css-houdini.org/css-typed-om/#cssrotation
+// Spec: https://drafts.css-houdini.org/css-typed-om/#cssrotate
 [
     Constructor(CSSNumericValue angleValue),
     Constructor(CSSNumberish x, CSSNumberish y, CSSNumberish z, CSSNumericValue angle),
     Exposed=(Window,PaintWorklet),
     RuntimeEnabled=CSSTypedOM,
     RaisesException=Constructor
-] interface CSSRotation : CSSTransformComponent {
+] interface CSSRotate : CSSTransformComponent {
     [RaisesException=Setter] attribute CSSNumericValue angle;
     [RaisesException=Setter] attribute CSSNumberish x;
     [RaisesException=Setter] attribute CSSNumberish y;
diff --git a/third_party/WebKit/Source/core/css/cssom/CSSStyleValue.cpp b/third_party/WebKit/Source/core/css/cssom/CSSStyleValue.cpp
index 73043e79..9029bfc 100644
--- a/third_party/WebKit/Source/core/css/cssom/CSSStyleValue.cpp
+++ b/third_party/WebKit/Source/core/css/cssom/CSSStyleValue.cpp
@@ -60,7 +60,7 @@
   return style_value_vector[0];
 }
 
-Nullable<CSSStyleValueVector> CSSStyleValue::parseAll(
+Optional<CSSStyleValueVector> CSSStyleValue::parseAll(
     const ExecutionContext* execution_context,
     const String& property_name,
     const String& value,
@@ -68,7 +68,7 @@
   CSSStyleValueVector style_value_vector = ParseCSSStyleValue(
       execution_context, property_name, value, exception_state);
   if (style_value_vector.IsEmpty())
-    return nullptr;
+    return WTF::nullopt;
 
   return style_value_vector;
 }
diff --git a/third_party/WebKit/Source/core/css/cssom/CSSStyleValue.h b/third_party/WebKit/Source/core/css/cssom/CSSStyleValue.h
index 48cee80..05e71ab 100644
--- a/third_party/WebKit/Source/core/css/cssom/CSSStyleValue.h
+++ b/third_party/WebKit/Source/core/css/cssom/CSSStyleValue.h
@@ -6,11 +6,11 @@
 #define CSSStyleValue_h
 
 #include "base/macros.h"
-#include "bindings/core/v8/Nullable.h"
 #include "core/CSSPropertyNames.h"
 #include "core/CoreExport.h"
 #include "core/css/CSSValue.h"
 #include "platform/bindings/ScriptWrappable.h"
+#include "platform/wtf/Optional.h"
 #include "platform/wtf/text/WTFString.h"
 
 namespace blink {
@@ -56,7 +56,7 @@
                               const String& property_name,
                               const String& value,
                               ExceptionState&);
-  static Nullable<CSSStyleValueVector> parseAll(const ExecutionContext*,
+  static Optional<CSSStyleValueVector> parseAll(const ExecutionContext*,
                                                 const String& property_name,
                                                 const String& value,
                                                 ExceptionState&);
diff --git a/third_party/WebKit/Source/core/css/cssom/CSSTransformComponent.cpp b/third_party/WebKit/Source/core/css/cssom/CSSTransformComponent.cpp
index 766d787..32cc164 100644
--- a/third_party/WebKit/Source/core/css/cssom/CSSTransformComponent.cpp
+++ b/third_party/WebKit/Source/core/css/cssom/CSSTransformComponent.cpp
@@ -6,10 +6,10 @@
 
 #include "core/css/cssom/CSSMatrixComponent.h"
 #include "core/css/cssom/CSSPerspective.h"
-#include "core/css/cssom/CSSRotation.h"
+#include "core/css/cssom/CSSRotate.h"
 #include "core/css/cssom/CSSScale.h"
 #include "core/css/cssom/CSSSkew.h"
-#include "core/css/cssom/CSSTranslation.h"
+#include "core/css/cssom/CSSTranslate.h"
 
 namespace blink {
 
@@ -30,7 +30,7 @@
     case CSSValueRotateY:
     case CSSValueRotateZ:
     case CSSValueRotate3d:
-      return CSSRotation::FromCSSValue(function_value);
+      return CSSRotate::FromCSSValue(function_value);
     case CSSValueScale:
     case CSSValueScaleX:
     case CSSValueScaleY:
@@ -46,7 +46,7 @@
     case CSSValueTranslateY:
     case CSSValueTranslateZ:
     case CSSValueTranslate3d:
-      return CSSTranslation::FromCSSValue(function_value);
+      return CSSTranslate::FromCSSValue(function_value);
     default:
       return nullptr;
   }
diff --git a/third_party/WebKit/Source/core/css/cssom/CSSTranslation.cpp b/third_party/WebKit/Source/core/css/cssom/CSSTranslate.cpp
similarity index 67%
rename from third_party/WebKit/Source/core/css/cssom/CSSTranslation.cpp
rename to third_party/WebKit/Source/core/css/cssom/CSSTranslate.cpp
index 3a3f0f6..967f822 100644
--- a/third_party/WebKit/Source/core/css/cssom/CSSTranslation.cpp
+++ b/third_party/WebKit/Source/core/css/cssom/CSSTranslate.cpp
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "core/css/cssom/CSSTranslation.h"
+#include "core/css/cssom/CSSTranslate.h"
 
 #include "bindings/core/v8/ExceptionState.h"
 #include "core/css/CSSPrimitiveValue.h"
@@ -24,14 +24,14 @@
          value->Type().MatchesBaseType(CSSNumericValueType::BaseType::kLength);
 }
 
-CSSTranslation* FromCSSTranslate(const CSSFunctionValue& value) {
+CSSTranslate* FromCSSTranslate(const CSSFunctionValue& value) {
   DCHECK_GT(value.length(), 0UL);
 
   CSSNumericValue* x =
       CSSNumericValue::FromCSSValue(ToCSSPrimitiveValue(value.Item(0)));
 
   if (value.length() == 1) {
-    return CSSTranslation::Create(
+    return CSSTranslate::Create(
         x, CSSUnitValue::Create(0, CSSPrimitiveValue::UnitType::kPixels));
   }
 
@@ -40,10 +40,10 @@
   CSSNumericValue* y =
       CSSNumericValue::FromCSSValue(ToCSSPrimitiveValue(value.Item(1)));
 
-  return CSSTranslation::Create(x, y);
+  return CSSTranslate::Create(x, y);
 }
 
-CSSTranslation* FromCSSTranslateXYZ(const CSSFunctionValue& value) {
+CSSTranslate* FromCSSTranslateXYZ(const CSSFunctionValue& value) {
   DCHECK_EQ(value.length(), 1UL);
 
   CSSNumericValue* length =
@@ -51,15 +51,15 @@
 
   switch (value.FunctionType()) {
     case CSSValueTranslateX:
-      return CSSTranslation::Create(
+      return CSSTranslate::Create(
           length,
           CSSUnitValue::Create(0, CSSPrimitiveValue::UnitType::kPixels));
     case CSSValueTranslateY:
-      return CSSTranslation::Create(
+      return CSSTranslate::Create(
           CSSUnitValue::Create(0, CSSPrimitiveValue::UnitType::kPixels),
           length);
     case CSSValueTranslateZ:
-      return CSSTranslation::Create(
+      return CSSTranslate::Create(
           CSSUnitValue::Create(0, CSSPrimitiveValue::UnitType::kPixels),
           CSSUnitValue::Create(0, CSSPrimitiveValue::UnitType::kPixels),
           length);
@@ -69,7 +69,7 @@
   }
 }
 
-CSSTranslation* FromCSSTranslate3D(const CSSFunctionValue& value) {
+CSSTranslate* FromCSSTranslate3D(const CSSFunctionValue& value) {
   DCHECK_EQ(value.length(), 3UL);
 
   CSSNumericValue* x =
@@ -79,50 +79,50 @@
   CSSNumericValue* z =
       CSSNumericValue::FromCSSValue(ToCSSPrimitiveValue(value.Item(2)));
 
-  return CSSTranslation::Create(x, y, z);
+  return CSSTranslate::Create(x, y, z);
 }
 
 }  // namespace
 
-CSSTranslation* CSSTranslation::Create(CSSNumericValue* x,
-                                       CSSNumericValue* y,
-                                       ExceptionState& exception_state) {
+CSSTranslate* CSSTranslate::Create(CSSNumericValue* x,
+                                   CSSNumericValue* y,
+                                   ExceptionState& exception_state) {
   if (!IsValidTranslateXY(x) || !IsValidTranslateXY(y)) {
     exception_state.ThrowTypeError(
-        "Must pass length or percentage to X and Y of CSSTranslation");
+        "Must pass length or percentage to X and Y of CSSTranslate");
     return nullptr;
   }
-  return new CSSTranslation(
+  return new CSSTranslate(
       x, y, CSSUnitValue::Create(0, CSSPrimitiveValue::UnitType::kPixels),
       true /* is2D */);
 }
 
-CSSTranslation* CSSTranslation::Create(CSSNumericValue* x,
-                                       CSSNumericValue* y,
-                                       CSSNumericValue* z,
-                                       ExceptionState& exception_state) {
+CSSTranslate* CSSTranslate::Create(CSSNumericValue* x,
+                                   CSSNumericValue* y,
+                                   CSSNumericValue* z,
+                                   ExceptionState& exception_state) {
   if (!IsValidTranslateXY(x) || !IsValidTranslateXY(y) ||
       !IsValidTranslateZ(z)) {
     exception_state.ThrowTypeError(
-        "Must pass length or percentage to X, Y and Z of CSSTranslation");
+        "Must pass length or percentage to X, Y and Z of CSSTranslate");
     return nullptr;
   }
-  return new CSSTranslation(x, y, z, false /* is2D */);
+  return new CSSTranslate(x, y, z, false /* is2D */);
 }
 
-CSSTranslation* CSSTranslation::Create(CSSNumericValue* x, CSSNumericValue* y) {
-  return new CSSTranslation(
+CSSTranslate* CSSTranslate::Create(CSSNumericValue* x, CSSNumericValue* y) {
+  return new CSSTranslate(
       x, y, CSSUnitValue::Create(0, CSSPrimitiveValue::UnitType::kPixels),
       true /* is2D */);
 }
 
-CSSTranslation* CSSTranslation::Create(CSSNumericValue* x,
-                                       CSSNumericValue* y,
-                                       CSSNumericValue* z) {
-  return new CSSTranslation(x, y, z, false /* is2D */);
+CSSTranslate* CSSTranslate::Create(CSSNumericValue* x,
+                                   CSSNumericValue* y,
+                                   CSSNumericValue* z) {
+  return new CSSTranslate(x, y, z, false /* is2D */);
 }
 
-CSSTranslation* CSSTranslation::FromCSSValue(const CSSFunctionValue& value) {
+CSSTranslate* CSSTranslate::FromCSSValue(const CSSFunctionValue& value) {
   switch (value.FunctionType()) {
     case CSSValueTranslateX:
     case CSSValueTranslateY:
@@ -138,34 +138,33 @@
   }
 }
 
-void CSSTranslation::setX(CSSNumericValue* x, ExceptionState& exception_state) {
+void CSSTranslate::setX(CSSNumericValue* x, ExceptionState& exception_state) {
   if (!IsValidTranslateXY(x)) {
     exception_state.ThrowTypeError(
-        "Must pass length or percentage to X of CSSTranslation");
+        "Must pass length or percentage to X of CSSTranslate");
     return;
   }
   x_ = x;
 }
 
-void CSSTranslation::setY(CSSNumericValue* y, ExceptionState& exception_state) {
+void CSSTranslate::setY(CSSNumericValue* y, ExceptionState& exception_state) {
   if (!IsValidTranslateXY(y)) {
     exception_state.ThrowTypeError(
-        "Must pass length or percent to Y of CSSTranslation");
+        "Must pass length or percent to Y of CSSTranslate");
     return;
   }
   y_ = y;
 }
 
-void CSSTranslation::setZ(CSSNumericValue* z, ExceptionState& exception_state) {
+void CSSTranslate::setZ(CSSNumericValue* z, ExceptionState& exception_state) {
   if (!IsValidTranslateZ(z)) {
-    exception_state.ThrowTypeError("Must pass length to Z of CSSTranslation");
+    exception_state.ThrowTypeError("Must pass length to Z of CSSTranslate");
     return;
   }
   z_ = z;
 }
 
-const DOMMatrix* CSSTranslation::AsMatrix(
-    ExceptionState& exception_state) const {
+const DOMMatrix* CSSTranslate::AsMatrix(ExceptionState& exception_state) const {
   CSSUnitValue* x = x_->to(CSSPrimitiveValue::UnitType::kPixels);
   CSSUnitValue* y = y_->to(CSSPrimitiveValue::UnitType::kPixels);
   CSSUnitValue* z = z_->to(CSSPrimitiveValue::UnitType::kPixels);
@@ -185,7 +184,7 @@
   return matrix;
 }
 
-const CSSFunctionValue* CSSTranslation::ToCSSValue() const {
+const CSSFunctionValue* CSSTranslate::ToCSSValue() const {
   const CSSValue* x = x_->ToCSSValue();
   const CSSValue* y = y_->ToCSSValue();
 
@@ -200,10 +199,10 @@
   return result;
 }
 
-CSSTranslation::CSSTranslation(CSSNumericValue* x,
-                               CSSNumericValue* y,
-                               CSSNumericValue* z,
-                               bool is2D)
+CSSTranslate::CSSTranslate(CSSNumericValue* x,
+                           CSSNumericValue* y,
+                           CSSNumericValue* z,
+                           bool is2D)
     : CSSTransformComponent(is2D), x_(x), y_(y), z_(z) {
   DCHECK(IsValidTranslateXY(x));
   DCHECK(IsValidTranslateXY(y));
diff --git a/third_party/WebKit/Source/core/css/cssom/CSSTranslate.h b/third_party/WebKit/Source/core/css/cssom/CSSTranslate.h
new file mode 100644
index 0000000..9b3b0a1
--- /dev/null
+++ b/third_party/WebKit/Source/core/css/cssom/CSSTranslate.h
@@ -0,0 +1,77 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CSSTranslate_h
+#define CSSTranslate_h
+
+#include "base/macros.h"
+#include "core/css/CSSPrimitiveValue.h"
+#include "core/css/cssom/CSSStyleValue.h"
+#include "core/css/cssom/CSSTransformComponent.h"
+#include "core/css/cssom/CSSUnitValue.h"
+
+namespace blink {
+
+class CSSNumericValue;
+class DOMMatrix;
+class ExceptionState;
+
+// Represents a translation value in a CSSTransformValue used for properties
+// like "transform".
+// See CSSTranslate.idl for more information about this class.
+class CORE_EXPORT CSSTranslate final : public CSSTransformComponent {
+  DEFINE_WRAPPERTYPEINFO();
+
+ public:
+  // Constructors defined in the IDL.
+  static CSSTranslate* Create(CSSNumericValue* x,
+                              CSSNumericValue* y,
+                              CSSNumericValue* z,
+                              ExceptionState&);
+  static CSSTranslate* Create(CSSNumericValue* x,
+                              CSSNumericValue* y,
+                              ExceptionState&);
+
+  // Blink-internal ways of creating CSSTranslates.
+  static CSSTranslate* Create(CSSNumericValue* x, CSSNumericValue* y);
+  static CSSTranslate* Create(CSSNumericValue* x,
+                              CSSNumericValue* y,
+                              CSSNumericValue* z);
+  static CSSTranslate* FromCSSValue(const CSSFunctionValue&);
+
+  // Getters and setters for attributes defined in the IDL.
+  CSSNumericValue* x() { return x_; }
+  CSSNumericValue* y() { return y_; }
+  CSSNumericValue* z() { return z_; }
+  void setX(CSSNumericValue* x, ExceptionState&);
+  void setY(CSSNumericValue* y, ExceptionState&);
+  void setZ(CSSNumericValue* z, ExceptionState&);
+
+  // Internal methods - from CSSTransformComponent.
+  TransformComponentType GetType() const final { return kTranslationType; }
+  const DOMMatrix* AsMatrix(ExceptionState&) const final;
+  const CSSFunctionValue* ToCSSValue() const final;
+
+  virtual void Trace(blink::Visitor* visitor) {
+    visitor->Trace(x_);
+    visitor->Trace(y_);
+    visitor->Trace(z_);
+    CSSTransformComponent::Trace(visitor);
+  }
+
+ private:
+  CSSTranslate(CSSNumericValue* x,
+               CSSNumericValue* y,
+               CSSNumericValue* z,
+               bool is2D);
+
+  Member<CSSNumericValue> x_;
+  Member<CSSNumericValue> y_;
+  Member<CSSNumericValue> z_;
+  DISALLOW_COPY_AND_ASSIGN(CSSTranslate);
+};
+
+}  // namespace blink
+
+#endif
diff --git a/third_party/WebKit/Source/core/css/cssom/CSSTranslation.idl b/third_party/WebKit/Source/core/css/cssom/CSSTranslate.idl
similarity index 91%
rename from third_party/WebKit/Source/core/css/cssom/CSSTranslation.idl
rename to third_party/WebKit/Source/core/css/cssom/CSSTranslate.idl
index 6e8234a2..78b8b5c7 100644
--- a/third_party/WebKit/Source/core/css/cssom/CSSTranslation.idl
+++ b/third_party/WebKit/Source/core/css/cssom/CSSTranslate.idl
@@ -4,14 +4,14 @@
 
 // Represents a translation value in a CSSTransformValue used for properties
 // like "transform".
-// Spec: https://drafts.css-houdini.org/css-typed-om/#csstranslation
+// Spec: https://drafts.css-houdini.org/css-typed-om/#csstranslate
 [
     Constructor(CSSNumericValue x, CSSNumericValue y,
         optional CSSNumericValue z),
     Exposed=(Window,PaintWorklet),
     RaisesException=Constructor,
     RuntimeEnabled=CSSTypedOM
-] interface CSSTranslation : CSSTransformComponent {
+] interface CSSTranslate : CSSTransformComponent {
     [RaisesException=Setter] attribute CSSNumericValue x;
     [RaisesException=Setter] attribute CSSNumericValue y;
     [RaisesException=Setter] attribute CSSNumericValue z;
diff --git a/third_party/WebKit/Source/core/css/cssom/CSSTranslation.h b/third_party/WebKit/Source/core/css/cssom/CSSTranslation.h
deleted file mode 100644
index 51766be..0000000
--- a/third_party/WebKit/Source/core/css/cssom/CSSTranslation.h
+++ /dev/null
@@ -1,77 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CSSTranslation_h
-#define CSSTranslation_h
-
-#include "base/macros.h"
-#include "core/css/CSSPrimitiveValue.h"
-#include "core/css/cssom/CSSStyleValue.h"
-#include "core/css/cssom/CSSTransformComponent.h"
-#include "core/css/cssom/CSSUnitValue.h"
-
-namespace blink {
-
-class CSSNumericValue;
-class DOMMatrix;
-class ExceptionState;
-
-// Represents a translation value in a CSSTransformValue used for properties
-// like "transform".
-// See CSSTranslation.idl for more information about this class.
-class CORE_EXPORT CSSTranslation final : public CSSTransformComponent {
-  DEFINE_WRAPPERTYPEINFO();
-
- public:
-  // Constructors defined in the IDL.
-  static CSSTranslation* Create(CSSNumericValue* x,
-                                CSSNumericValue* y,
-                                CSSNumericValue* z,
-                                ExceptionState&);
-  static CSSTranslation* Create(CSSNumericValue* x,
-                                CSSNumericValue* y,
-                                ExceptionState&);
-
-  // Blink-internal ways of creating CSSTranslations.
-  static CSSTranslation* Create(CSSNumericValue* x, CSSNumericValue* y);
-  static CSSTranslation* Create(CSSNumericValue* x,
-                                CSSNumericValue* y,
-                                CSSNumericValue* z);
-  static CSSTranslation* FromCSSValue(const CSSFunctionValue&);
-
-  // Getters and setters for attributes defined in the IDL.
-  CSSNumericValue* x() { return x_; }
-  CSSNumericValue* y() { return y_; }
-  CSSNumericValue* z() { return z_; }
-  void setX(CSSNumericValue* x, ExceptionState&);
-  void setY(CSSNumericValue* y, ExceptionState&);
-  void setZ(CSSNumericValue* z, ExceptionState&);
-
-  // Internal methods - from CSSTransformComponent.
-  TransformComponentType GetType() const final { return kTranslationType; }
-  const DOMMatrix* AsMatrix(ExceptionState&) const final;
-  const CSSFunctionValue* ToCSSValue() const final;
-
-  virtual void Trace(blink::Visitor* visitor) {
-    visitor->Trace(x_);
-    visitor->Trace(y_);
-    visitor->Trace(z_);
-    CSSTransformComponent::Trace(visitor);
-  }
-
- private:
-  CSSTranslation(CSSNumericValue* x,
-                 CSSNumericValue* y,
-                 CSSNumericValue* z,
-                 bool is2D);
-
-  Member<CSSNumericValue> x_;
-  Member<CSSNumericValue> y_;
-  Member<CSSNumericValue> z_;
-  DISALLOW_COPY_AND_ASSIGN(CSSTranslation);
-};
-
-}  // namespace blink
-
-#endif
diff --git a/third_party/WebKit/Source/core/css/properties/CSSParsingUtils.cpp b/third_party/WebKit/Source/core/css/properties/CSSParsingUtils.cpp
index 831b0129..ea99b07f2 100644
--- a/third_party/WebKit/Source/core/css/properties/CSSParsingUtils.cpp
+++ b/third_party/WebKit/Source/core/css/properties/CSSParsingUtils.cpp
@@ -144,7 +144,8 @@
     return nullptr;
 
   range = range_copy;
-  return CSSStepsTimingFunctionValue::Create(steps->GetIntValue(), position);
+  return cssvalue::CSSStepsTimingFunctionValue::Create(steps->GetIntValue(),
+                                                       position);
 }
 
 CSSValue* ConsumeFrames(CSSParserTokenRange& range) {
@@ -166,7 +167,7 @@
     return nullptr;
 
   range = range_copy;
-  return CSSFramesTimingFunctionValue::Create(frames_int);
+  return cssvalue::CSSFramesTimingFunctionValue::Create(frames_int);
 }
 
 CSSValue* ConsumeCubicBezier(CSSParserTokenRange& range) {
@@ -186,7 +187,7 @@
       CSSPropertyParserHelpers::ConsumeCommaIncludingWhitespace(args) &&
       CSSPropertyParserHelpers::ConsumeNumberRaw(args, y2) && args.AtEnd()) {
     range = range_copy;
-    return CSSCubicBezierTimingFunctionValue::Create(x1, y1, x2, y2);
+    return cssvalue::CSSCubicBezierTimingFunctionValue::Create(x1, y1, x2, y2);
   }
 
   return nullptr;
diff --git a/third_party/WebKit/Source/core/css/properties/ComputedStyleUtils.cpp b/third_party/WebKit/Source/core/css/properties/ComputedStyleUtils.cpp
index 751b65aa..99372bb 100644
--- a/third_party/WebKit/Source/core/css/properties/ComputedStyleUtils.cpp
+++ b/third_party/WebKit/Source/core/css/properties/ComputedStyleUtils.cpp
@@ -1466,7 +1466,7 @@
         }
         return CSSIdentifierValue::Create(value_id);
       }
-      return CSSCubicBezierTimingFunctionValue::Create(
+      return cssvalue::CSSCubicBezierTimingFunctionValue::Create(
           bezier_timing_function->X1(), bezier_timing_function->Y1(),
           bezier_timing_function->X2(), bezier_timing_function->Y2());
     }
@@ -1481,7 +1481,7 @@
              position == StepsTimingFunction::StepPosition::END);
 
       if (steps > 1)
-        return CSSStepsTimingFunctionValue::Create(steps, position);
+        return cssvalue::CSSStepsTimingFunctionValue::Create(steps, position);
       CSSValueID value_id = position == StepsTimingFunction::StepPosition::START
                                 ? CSSValueStepStart
                                 : CSSValueStepEnd;
@@ -1492,7 +1492,7 @@
       const FramesTimingFunction* frames_timing_function =
           ToFramesTimingFunction(timing_function);
       int frames = frames_timing_function->NumberOfFrames();
-      return CSSFramesTimingFunctionValue::Create(frames);
+      return cssvalue::CSSFramesTimingFunctionValue::Create(frames);
     }
 
     default:
diff --git a/third_party/WebKit/Source/core/css/properties/longhands/DisplayCustom.cpp b/third_party/WebKit/Source/core/css/properties/longhands/DisplayCustom.cpp
index ca46daa..97d2936 100644
--- a/third_party/WebKit/Source/core/css/properties/longhands/DisplayCustom.cpp
+++ b/third_party/WebKit/Source/core/css/properties/longhands/DisplayCustom.cpp
@@ -40,7 +40,7 @@
     return nullptr;
 
   range = range_copy;
-  return CSSLayoutFunctionValue::Create(
+  return cssvalue::CSSLayoutFunctionValue::Create(
       name, /* is_inline */ function == CSSValueInlineLayout);
 }
 
@@ -51,7 +51,7 @@
     Node*,
     bool allow_visited_style) const {
   if (style.IsDisplayLayoutCustomBox()) {
-    return CSSLayoutFunctionValue::Create(
+    return cssvalue::CSSLayoutFunctionValue::Create(
         CSSCustomIdentValue::Create(style.DisplayLayoutCustomName()),
         style.IsDisplayInlineType());
   }
diff --git a/third_party/WebKit/Source/core/css/resolver/CSSToStyleMap.cpp b/third_party/WebKit/Source/core/css/resolver/CSSToStyleMap.cpp
index 0b18cb7..b3ae0b7 100644
--- a/third_party/WebKit/Source/core/css/resolver/CSSToStyleMap.cpp
+++ b/third_party/WebKit/Source/core/css/resolver/CSSToStyleMap.cpp
@@ -458,8 +458,8 @@
   }
 
   if (value.IsCubicBezierTimingFunctionValue()) {
-    const CSSCubicBezierTimingFunctionValue& cubic_timing_function =
-        ToCSSCubicBezierTimingFunctionValue(value);
+    const cssvalue::CSSCubicBezierTimingFunctionValue& cubic_timing_function =
+        cssvalue::ToCSSCubicBezierTimingFunctionValue(value);
     return CubicBezierTimingFunction::Create(
         cubic_timing_function.X1(), cubic_timing_function.Y1(),
         cubic_timing_function.X2(), cubic_timing_function.Y2());
@@ -469,14 +469,14 @@
     return CSSTimingData::InitialTimingFunction();
 
   if (value.IsFramesTimingFunctionValue()) {
-    const CSSFramesTimingFunctionValue& frames_timing_function =
-        ToCSSFramesTimingFunctionValue(value);
+    const cssvalue::CSSFramesTimingFunctionValue& frames_timing_function =
+        cssvalue::ToCSSFramesTimingFunctionValue(value);
     return FramesTimingFunction::Create(
         frames_timing_function.NumberOfFrames());
   }
 
-  const CSSStepsTimingFunctionValue& steps_timing_function =
-      ToCSSStepsTimingFunctionValue(value);
+  const cssvalue::CSSStepsTimingFunctionValue& steps_timing_function =
+      cssvalue::ToCSSStepsTimingFunctionValue(value);
   if (steps_timing_function.GetStepPosition() ==
       StepsTimingFunction::StepPosition::MIDDLE) {
     if (!allow_step_middle) {
diff --git a/third_party/WebKit/Source/core/css/resolver/StyleBuilderCustom.cpp b/third_party/WebKit/Source/core/css/resolver/StyleBuilderCustom.cpp
index 2c7288f..4877a7b9 100644
--- a/third_party/WebKit/Source/core/css/resolver/StyleBuilderCustom.cpp
+++ b/third_party/WebKit/Source/core/css/resolver/StyleBuilderCustom.cpp
@@ -262,8 +262,8 @@
   }
 
   DCHECK(value.IsLayoutFunctionValue());
-  const CSSLayoutFunctionValue& layout_function_value =
-      ToCSSLayoutFunctionValue(value);
+  const cssvalue::CSSLayoutFunctionValue& layout_function_value =
+      cssvalue::ToCSSLayoutFunctionValue(value);
 
   EDisplay display = layout_function_value.IsInline()
                          ? EDisplay::kInlineLayoutCustom
diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index 8f1df68..7f15a508 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -1080,7 +1080,7 @@
   // 2.
   const AtomicString& is =
       AtomicString(GetTypeExtension(this, string_or_options, exception_state));
-  const AtomicString& name = should_create_builtin ? is : qualified_name;
+  const AtomicString& name = should_create_builtin ? is : q_name.LocalName();
 
   if (!IsValidElementName(this, qualified_name)) {
     exception_state.ThrowDOMException(
@@ -1091,11 +1091,9 @@
 
   // 3. Let definition be result of lookup up custom element definition
   CustomElementDefinition* definition = nullptr;
-  if (is_v1) {
+  if (is_v1 && namespace_uri == HTMLNames::xhtmlNamespaceURI) {
     const CustomElementDescriptor desc =
-        RuntimeEnabledFeatures::CustomElementsBuiltinEnabled()
-            ? CustomElementDescriptor(name, qualified_name)
-            : CustomElementDescriptor(qualified_name, qualified_name);
+        CustomElementDescriptor(name, q_name.LocalName());
     if (CustomElementRegistry* registry = CustomElement::Registry(*this))
       definition = registry->DefinitionFor(desc);
 
@@ -1110,7 +1108,7 @@
   // 5. Let element be the result of creating an element
   Element* element;
 
-  if (CustomElement::ShouldCreateCustomElement(q_name) || create_v1_builtin) {
+  if (definition) {
     element = CustomElement::CreateCustomElementSync(*this, q_name, definition);
   } else if (V0CustomElement::IsValidName(q_name.LocalName()) &&
              RegistrationContext()) {
diff --git a/third_party/WebKit/Source/core/dom/Document.h b/third_party/WebKit/Source/core/dom/Document.h
index d26b91e..ac79dbb 100644
--- a/third_party/WebKit/Source/core/dom/Document.h
+++ b/third_party/WebKit/Source/core/dom/Document.h
@@ -343,7 +343,12 @@
   Element* createElementNS(const AtomicString& namespace_uri,
                            const AtomicString& qualified_name,
                            ExceptionState&);
+  // Creates an element with autonomous custom element processing. If
+  // LocalName of the specified qualified name doesn't contain '-', this
+  // function is equivalent to CreateRawElement().
   Element* createElement(const QualifiedName&, CreateElementFlags);
+  // Creates an element without custom element processing.
+  Element* CreateRawElement(const QualifiedName&, CreateElementFlags);
 
   Element* ElementFromPoint(double x, double y) const;
   HeapVector<Member<Element>> ElementsFromPoint(double x, double y) const;
@@ -1537,8 +1542,6 @@
   // the LocalFrameClient.
   void ApplyFeaturePolicy(const ParsedFeaturePolicy& declared_policy);
 
-  Element* CreateRawElement(const QualifiedName&, CreateElementFlags);
-
   DocumentLifecycle lifecycle_;
 
   bool has_nodes_with_placeholder_style_;
diff --git a/third_party/WebKit/Source/core/dom/ExecutionContext.h b/third_party/WebKit/Source/core/dom/ExecutionContext.h
index a359b875..bac31c8 100644
--- a/third_party/WebKit/Source/core/dom/ExecutionContext.h
+++ b/third_party/WebKit/Source/core/dom/ExecutionContext.h
@@ -37,6 +37,7 @@
 #include "core/dom/ContextLifecycleObserver.h"
 #include "core/dom/SecurityContext.h"
 #include "platform/Supplementable.h"
+#include "platform/WebTaskRunner.h"
 #include "platform/heap/Handle.h"
 #include "platform/loader/fetch/AccessControlStatus.h"
 #include "platform/weborigin/KURL.h"
diff --git a/third_party/WebKit/Source/core/dom/IdleDeadlineTest.cpp b/third_party/WebKit/Source/core/dom/IdleDeadlineTest.cpp
index 6915c5e..2c27aef 100644
--- a/third_party/WebKit/Source/core/dom/IdleDeadlineTest.cpp
+++ b/third_party/WebKit/Source/core/dom/IdleDeadlineTest.cpp
@@ -4,6 +4,7 @@
 
 #include "core/dom/IdleDeadline.h"
 
+#include "platform/WebTaskRunner.h"
 #include "platform/scheduler/child/web_scheduler.h"
 #include "platform/testing/TestingPlatformSupportWithMockScheduler.h"
 #include "platform/wtf/Time.h"
diff --git a/third_party/WebKit/Source/core/dom/QualifiedName.cpp b/third_party/WebKit/Source/core/dom/QualifiedName.cpp
index 857a5cca..9d616661 100644
--- a/third_party/WebKit/Source/core/dom/QualifiedName.cpp
+++ b/third_party/WebKit/Source/core/dom/QualifiedName.cpp
@@ -149,4 +149,11 @@
       QualifiedName(g_null_atom, AtomicString(name), g_null_atom, true);
 }
 
+std::ostream& operator<<(std::ostream& ostream, const QualifiedName& qname) {
+  ostream << "QualifiedName(local=" << qname.LocalName()
+          << " ns=" << qname.NamespaceURI() << " prefix=" << qname.Prefix()
+          << ")";
+  return ostream;
+}
+
 }  // namespace blink
diff --git a/third_party/WebKit/Source/core/dom/QualifiedName.h b/third_party/WebKit/Source/core/dom/QualifiedName.h
index a3630fc..f3a23300 100644
--- a/third_party/WebKit/Source/core/dom/QualifiedName.h
+++ b/third_party/WebKit/Source/core/dom/QualifiedName.h
@@ -219,6 +219,8 @@
   static const bool safe_to_compare_to_empty_or_deleted = false;
 };
 
+CORE_EXPORT std::ostream& operator<<(std::ostream&, const QualifiedName&);
+
 }  // namespace blink
 
 namespace WTF {
diff --git a/third_party/WebKit/Source/core/dom/events/EventPathTest.cpp b/third_party/WebKit/Source/core/dom/events/EventPathTest.cpp
index 0ebccf6b..5d68da1 100644
--- a/third_party/WebKit/Source/core/dom/events/EventPathTest.cpp
+++ b/third_party/WebKit/Source/core/dom/events/EventPathTest.cpp
@@ -17,8 +17,8 @@
 class EventPathTest : public PageTestBase {};
 
 TEST_F(EventPathTest, ShouldBeEmptyForPseudoElementWithoutParentElement) {
-  Element* div =
-      GetDocument().createElement(HTMLNames::divTag, kCreatedByCreateElement);
+  Element* div = GetDocument().CreateRawElement(HTMLNames::divTag,
+                                                kCreatedByCreateElement);
   PseudoElement* pseudo = PseudoElement::Create(div, kPseudoIdFirstLetter);
   pseudo->Dispose();
   EventPath event_path(*pseudo);
diff --git a/third_party/WebKit/Source/core/editing/RenderedPosition.cpp b/third_party/WebKit/Source/core/editing/RenderedPosition.cpp
index 02d0de30..27cb4a9d 100644
--- a/third_party/WebKit/Source/core/editing/RenderedPosition.cpp
+++ b/third_party/WebKit/Source/core/editing/RenderedPosition.cpp
@@ -369,31 +369,51 @@
   return text_control_object->BorderBoxRect().Contains(position_in_input);
 }
 
-static CompositedSelectionBound PositionInGraphicsLayerBacking(
-    bool selection_start,
+static CompositedSelectionBound ComputeSelectionBound(
+    const PositionWithAffinity& position,
+    const LayoutObject& layout_object,
+    const LayoutPoint& edge_top_in_layer,
+    const LayoutPoint& edge_bottom_in_layer) {
+  CompositedSelectionBound bound;
+  bound.is_text_direction_rtl =
+      layout_object.HasFlippedBlocksWritingMode() ||
+      PrimaryDirectionOf(*position.AnchorNode()) == TextDirection::kRtl;
+  bound.edge_top_in_layer =
+      LocalToInvalidationBackingPoint(edge_top_in_layer, layout_object);
+  bound.edge_bottom_in_layer =
+      LocalToInvalidationBackingPoint(edge_bottom_in_layer, layout_object);
+  bound.layer = GetGraphicsLayerBacking(layout_object);
+  bound.hidden =
+      !IsVisible(layout_object, edge_top_in_layer, edge_bottom_in_layer);
+  return bound;
+}
+
+static CompositedSelectionBound StartPositionInGraphicsLayerBacking(
     const PositionWithAffinity& position) {
   const LocalCaretRect& local_caret_rect = LocalCaretRectOfPosition(position);
   const LayoutObject* const layout_object = local_caret_rect.layout_object;
   if (!layout_object)
     return CompositedSelectionBound();
 
-  CompositedSelectionBound bound;
-  bound.is_text_direction_rtl =
-      layout_object->HasFlippedBlocksWritingMode() ||
-      PrimaryDirectionOf(*position.AnchorNode()) == TextDirection::kRtl;
+  LayoutPoint edge_top_in_layer, edge_bottom_in_layer;
+  std::tie(edge_top_in_layer, edge_bottom_in_layer) =
+      GetLocalSelectionStartpoints(local_caret_rect);
+  return ComputeSelectionBound(position, *layout_object, edge_top_in_layer,
+                               edge_bottom_in_layer);
+}
+
+static CompositedSelectionBound EndPositionInGraphicsLayerBacking(
+    const PositionWithAffinity& position) {
+  const LocalCaretRect& local_caret_rect = LocalCaretRectOfPosition(position);
+  const LayoutObject* const layout_object = local_caret_rect.layout_object;
+  if (!layout_object)
+    return CompositedSelectionBound();
 
   LayoutPoint edge_top_in_layer, edge_bottom_in_layer;
   std::tie(edge_top_in_layer, edge_bottom_in_layer) =
-      selection_start ? GetLocalSelectionStartpoints(local_caret_rect)
-                      : GetLocalSelectionEndpoints(local_caret_rect);
-  bound.edge_top_in_layer =
-      LocalToInvalidationBackingPoint(edge_top_in_layer, *layout_object);
-  bound.edge_bottom_in_layer =
-      LocalToInvalidationBackingPoint(edge_bottom_in_layer, *layout_object);
-  bound.layer = GetGraphicsLayerBacking(*layout_object);
-  bound.hidden =
-      !IsVisible(*layout_object, edge_top_in_layer, edge_bottom_in_layer);
-  return bound;
+      GetLocalSelectionEndpoints(local_caret_rect);
+  return ComputeSelectionBound(position, *layout_object, edge_top_in_layer,
+                               edge_bottom_in_layer);
 }
 
 bool LayoutObjectContainsPosition(LayoutObject* target,
@@ -423,13 +443,13 @@
     return {};
 
   CompositedSelection selection;
-  selection.start = PositionInGraphicsLayerBacking(
-      true, visible_selection.ComputeStartPosition());
+  selection.start = StartPositionInGraphicsLayerBacking(
+      visible_selection.ComputeStartPosition());
   if (!selection.start.layer)
     return {};
 
-  selection.end = PositionInGraphicsLayerBacking(
-      false, visible_selection.ComputeEndPosition());
+  selection.end =
+      EndPositionInGraphicsLayerBacking(visible_selection.ComputeEndPosition());
   if (!selection.end.layer)
     return {};
 
diff --git a/third_party/WebKit/Source/core/editing/testing/EditingTestBase.cpp b/third_party/WebKit/Source/core/editing/testing/EditingTestBase.cpp
index eb6b14d..f3d87ca 100644
--- a/third_party/WebKit/Source/core/editing/testing/EditingTestBase.cpp
+++ b/third_party/WebKit/Source/core/editing/testing/EditingTestBase.cpp
@@ -25,8 +25,8 @@
       tag_name.NamespaceURI(), tag_name.LocalName());
   if (!elements->IsEmpty())
     return elements->item(0);
-  return parent->ownerDocument()->createElement(tag_name,
-                                                kCreatedByCreateElement);
+  return parent->ownerDocument()->CreateRawElement(tag_name,
+                                                   kCreatedByCreateElement);
 }
 
 }  // namespace
@@ -38,8 +38,8 @@
 void EditingTestBase::InsertStyleElement(const std::string& style_rules) {
   Element* const head = GetOrCreateElement(&GetDocument(), HTMLNames::headTag);
   DCHECK_EQ(head, GetOrCreateElement(&GetDocument(), HTMLNames::headTag));
-  Element* const style =
-      GetDocument().createElement(HTMLNames::styleTag, kCreatedByCreateElement);
+  Element* const style = GetDocument().CreateRawElement(
+      HTMLNames::styleTag, kCreatedByCreateElement);
   style->setTextContent(String(style_rules.data(), style_rules.size()));
   head->appendChild(style);
 }
diff --git a/third_party/WebKit/Source/core/exported/WebAssociatedURLLoaderImpl.h b/third_party/WebKit/Source/core/exported/WebAssociatedURLLoaderImpl.h
index 8e27774..bc6fe57 100644
--- a/third_party/WebKit/Source/core/exported/WebAssociatedURLLoaderImpl.h
+++ b/third_party/WebKit/Source/core/exported/WebAssociatedURLLoaderImpl.h
@@ -10,6 +10,7 @@
 #include "base/macros.h"
 #include "base/memory/scoped_refptr.h"
 #include "core/CoreExport.h"
+#include "platform/WebTaskRunner.h"
 #include "platform/heap/Handle.h"
 #include "public/web/WebAssociatedURLLoader.h"
 #include "public/web/WebAssociatedURLLoaderOptions.h"
diff --git a/third_party/WebKit/Source/core/frame/DOMTimerCoordinator.h b/third_party/WebKit/Source/core/frame/DOMTimerCoordinator.h
index cef136ad..d38d744 100644
--- a/third_party/WebKit/Source/core/frame/DOMTimerCoordinator.h
+++ b/third_party/WebKit/Source/core/frame/DOMTimerCoordinator.h
@@ -8,6 +8,7 @@
 #include <memory>
 
 #include "base/macros.h"
+#include "platform/WebTaskRunner.h"
 #include "platform/heap/Handle.h"
 #include "platform/wtf/Time.h"
 
@@ -16,7 +17,6 @@
 class DOMTimer;
 class ExecutionContext;
 class ScheduledAction;
-class WebTaskRunner;
 
 // Maintains a set of DOMTimers for a given page or
 // worker. DOMTimerCoordinator assigns IDs to timers; these IDs are
diff --git a/third_party/WebKit/Source/core/frame/LocalFrameView.cpp b/third_party/WebKit/Source/core/frame/LocalFrameView.cpp
index 0f8d7a6..761268d 100644
--- a/third_party/WebKit/Source/core/frame/LocalFrameView.cpp
+++ b/third_party/WebKit/Source/core/frame/LocalFrameView.cpp
@@ -128,9 +128,6 @@
 #include "public/platform/WebDisplayItemList.h"
 #include "public/platform/WebRect.h"
 #include "public/platform/WebScrollIntoViewParams.h"
-#include "services/metrics/public/cpp/ukm_builders.h"
-#include "services/metrics/public/cpp/ukm_entry_builder.h"
-#include "services/metrics/public/cpp/ukm_recorder.h"
 #include "third_party/WebKit/common/page/page_visibility_state.mojom-blink.h"
 
 // Used to check for dirty layouts violating document lifecycle rules.
@@ -156,42 +153,6 @@
 }  // namespace
 
 namespace blink {
-namespace {
-
-class ScopedUsHistogramAndUkmTimer {
-  STACK_ALLOCATED();
-
- public:
-  explicit ScopedUsHistogramAndUkmTimer(LocalFrameView* view,
-                                        CustomCountHistogram& counter,
-                                        const char* ukm_metric)
-      : view_(view),
-        start_time_(CurrentTimeTicks()),
-        counter_(&counter),
-        ukm_metric_(ukm_metric) {}
-
-  ~ScopedUsHistogramAndUkmTimer() {
-    int64_t elapsed = (CurrentTimeTicks() - start_time_).InMicroseconds();
-    counter_->Count(elapsed);
-    view_->RecordUkmPerformanceMetric(ukm_metric_, elapsed);
-  }
-
- private:
-  Member<LocalFrameView> view_;
-  const TimeTicks start_time_;
-  CustomCountHistogram* counter_;
-  const char* ukm_metric_;
-
-  DISALLOW_COPY_AND_ASSIGN(ScopedUsHistogramAndUkmTimer);
-};
-
-#define SCOPED_UMA_AND_UKM_TIMER(uma_name, ukm_name)                \
-  DEFINE_STATIC_LOCAL_IMPL(CustomCountHistogram, scoped_us_counter, \
-                           (uma_name, 0, 10000000, 50), false);     \
-  ScopedUsHistogramAndUkmTimer timer(this, scoped_us_counter, ukm_name);
-
-}  // namespace
-
 using namespace HTMLNames;
 
 // The maximum number of updatePlugins iterations that should be done before
@@ -3327,7 +3288,7 @@
   });
 
   {
-    SCOPED_UMA_AND_UKM_TIMER("Blink.PrePaint.UpdateTime", "PrePaint");
+    SCOPED_BLINK_UMA_HISTOGRAM_TIMER("Blink.PrePaint.UpdateTime");
     PrePaintTreeWalk().Walk(*this);
   }
 
@@ -3338,7 +3299,7 @@
 
 void LocalFrameView::PaintTree() {
   TRACE_EVENT0("blink", "LocalFrameView::paintTree");
-  SCOPED_UMA_AND_UKM_TIMER("Blink.Paint.UpdateTime", "Paint");
+  SCOPED_BLINK_UMA_HISTOGRAM_TIMER("Blink.Paint.UpdateTime");
 
   DCHECK(GetFrame() == GetPage()->MainFrame() ||
          (!GetFrame().Tree().Parent()->IsLocalFrame()));
@@ -3421,7 +3382,7 @@
         paint_artifact_compositor_->GetWebLayer(), &GetFrame());
   }
 
-  SCOPED_UMA_AND_UKM_TIMER("Blink.Compositing.UpdateTime", "Compositing");
+  SCOPED_BLINK_UMA_HISTOGRAM_TIMER("Blink.Compositing.UpdateTime");
 
   paint_artifact_compositor_->Update(paint_controller_->GetPaintArtifact(),
                                      composited_element_ids);
@@ -3436,7 +3397,7 @@
 }
 
 void LocalFrameView::UpdateStyleAndLayoutIfNeededRecursive() {
-  SCOPED_UMA_AND_UKM_TIMER("Blink.StyleAndLayout.UpdateTime", "StyleAndLayout");
+  SCOPED_BLINK_UMA_HISTOGRAM_TIMER("Blink.StyleAndLayout.UpdateTime");
   UpdateStyleAndLayoutIfNeededRecursiveInternal();
 }
 
@@ -5775,14 +5736,4 @@
   return page->GetScrollbarTheme();
 }
 
-void LocalFrameView::RecordUkmPerformanceMetric(const char* metric_name,
-                                                int64_t value) {
-  ukm::UkmRecorder* ukm_recorder = frame_->GetDocument()->UkmRecorder();
-  DCHECK(ukm_recorder);
-
-  std::unique_ptr<ukm::UkmEntryBuilder> builder = ukm_recorder->GetEntryBuilder(
-      frame_->GetDocument()->UkmSourceID(), "Blink.UpdateTime");
-  builder->AddMetric(metric_name, value);
-}
-
 }  // namespace blink
diff --git a/third_party/WebKit/Source/core/frame/LocalFrameView.h b/third_party/WebKit/Source/core/frame/LocalFrameView.h
index 5f4628b..c466228 100644
--- a/third_party/WebKit/Source/core/frame/LocalFrameView.h
+++ b/third_party/WebKit/Source/core/frame/LocalFrameView.h
@@ -968,11 +968,6 @@
   // scrollable area, or gains/loses a composited layer.
   void ScrollableAreasDidChange();
 
-  // Records a UKM metric for the current URL. metric_name is a metric
-  // that must be defined in ukm.xml; metric_value is in usec.
-  void RecordUkmPerformanceMetric(const char* metric_name,
-                                  int64_t metric_value);
-
  protected:
   // Scroll the content via the compositor.
   bool ScrollContentsFastPath(const IntSize& scroll_delta);
diff --git a/third_party/WebKit/Source/core/html/HTMLEmbedElement.cpp b/third_party/WebKit/Source/core/html/HTMLEmbedElement.cpp
index d0c130e0..51341db 100644
--- a/third_party/WebKit/Source/core/html/HTMLEmbedElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLEmbedElement.cpp
@@ -132,13 +132,10 @@
   }
 }
 
-void HTMLEmbedElement::ParametersForPlugin(Vector<String>& param_names,
-                                           Vector<String>& param_values) {
+void HTMLEmbedElement::ParametersForPlugin(PluginParameters& plugin_params) {
   AttributeCollection attributes = Attributes();
-  for (const Attribute& attribute : attributes) {
-    param_names.push_back(attribute.LocalName().GetString());
-    param_values.push_back(attribute.Value().GetString());
-  }
+  for (const Attribute& attribute : attributes)
+    plugin_params.AppendAttribute(attribute);
 }
 
 // FIXME: This should be unified with HTMLObjectElement::updatePlugin and
@@ -156,10 +153,8 @@
   if (!AllowedToLoadFrameURL(url_))
     return;
 
-  // FIXME: These should be joined into a PluginParameters class.
-  Vector<String> param_names;
-  Vector<String> param_values;
-  ParametersForPlugin(param_names, param_values);
+  PluginParameters plugin_params;
+  ParametersForPlugin(plugin_params);
 
   // FIXME: Can we not have layoutObject here now that beforeload events are
   // gone?
@@ -175,7 +170,7 @@
     service_type_ = "text/html";
   }
 
-  RequestObject(param_names, param_values);
+  RequestObject(plugin_params);
 }
 
 bool HTMLEmbedElement::LayoutObjectIsNeeded(const ComputedStyle& style) {
diff --git a/third_party/WebKit/Source/core/html/HTMLEmbedElement.h b/third_party/WebKit/Source/core/html/HTMLEmbedElement.h
index 575c0d51..30d846e 100644
--- a/third_party/WebKit/Source/core/html/HTMLEmbedElement.h
+++ b/third_party/WebKit/Source/core/html/HTMLEmbedElement.h
@@ -55,8 +55,7 @@
 
   void UpdatePluginInternal() override;
 
-  void ParametersForPlugin(Vector<String>& param_names,
-                           Vector<String>& param_values);
+  void ParametersForPlugin(PluginParameters& plugin_params);
 
   NamedItemType GetNamedItemType() const override {
     return NamedItemType::kName;
diff --git a/third_party/WebKit/Source/core/html/HTMLObjectElement.cpp b/third_party/WebKit/Source/core/html/HTMLObjectElement.cpp
index bf042d8..f4e0ae7 100644
--- a/third_party/WebKit/Source/core/html/HTMLObjectElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLObjectElement.cpp
@@ -128,28 +128,21 @@
   }
 }
 
-static void MapDataParamToSrc(Vector<String>* param_names,
-                              Vector<String>* param_values) {
+static void MapDataParamToSrc(PluginParameters& plugin_params) {
   // Some plugins don't understand the "data" attribute of the OBJECT tag (i.e.
   // Real and WMP require "src" attribute).
-  int src_index = -1, data_index = -1;
-  for (unsigned i = 0; i < param_names->size(); ++i) {
-    if (DeprecatedEqualIgnoringCase((*param_names)[i], "src"))
-      src_index = i;
-    else if (DeprecatedEqualIgnoringCase((*param_names)[i], "data"))
-      data_index = i;
-  }
+  int src_index = plugin_params.FindStringInNames("src");
+  int data_index = plugin_params.FindStringInNames("data");
 
   if (src_index == -1 && data_index != -1) {
-    param_names->push_back("src");
-    param_values->push_back((*param_values)[data_index]);
+    plugin_params.AppendNameWithValue("src",
+                                      plugin_params.Values()[data_index]);
   }
 }
 
 // TODO(schenney): crbug.com/572908 This function should not deal with url or
 // serviceType!
-void HTMLObjectElement::ParametersForPlugin(Vector<String>& param_names,
-                                            Vector<String>& param_values) {
+void HTMLObjectElement::ParametersForPlugin(PluginParameters& plugin_params) {
   HashSet<StringImpl*, CaseFoldingHash> unique_param_names;
 
   // Scan the PARAM children and store their name/value pairs.
@@ -161,8 +154,7 @@
       continue;
 
     unique_param_names.insert(name.Impl());
-    param_names.push_back(p->GetName());
-    param_values.push_back(p->Value());
+    plugin_params.AppendNameWithValue(p->GetName(), p->Value());
 
     // TODO(schenney): crbug.com/572908 url adjustment does not belong in this
     // function.
@@ -189,13 +181,11 @@
   AttributeCollection attributes = Attributes();
   for (const Attribute& attribute : attributes) {
     const AtomicString& name = attribute.GetName().LocalName();
-    if (!unique_param_names.Contains(name.Impl())) {
-      param_names.push_back(name.GetString());
-      param_values.push_back(attribute.Value().GetString());
-    }
+    if (!unique_param_names.Contains(name.Impl()))
+      plugin_params.AppendAttribute(attribute);
   }
 
-  MapDataParamToSrc(&param_names, &param_values);
+  MapDataParamToSrc(plugin_params);
 }
 
 bool HTMLObjectElement::HasFallbackContent() const {
@@ -268,11 +258,8 @@
     return;
   }
 
-  // TODO(schenney): crbug.com/572908 These should be joined into a
-  // PluginParameters class.
-  Vector<String> param_names;
-  Vector<String> param_values;
-  ParametersForPlugin(param_names, param_values);
+  PluginParameters plugin_params;
+  ParametersForPlugin(plugin_params);
 
   // Note: url is modified above by parametersForPlugin.
   if (!AllowedToLoadFrameURL(url_)) {
@@ -294,7 +281,7 @@
     service_type_ = "text/html";
   }
 
-  if (!HasValidClassId() || !RequestObject(param_names, param_values)) {
+  if (!HasValidClassId() || !RequestObject(plugin_params)) {
     if (!url_.IsEmpty())
       DispatchErrorEvent();
     if (HasFallbackContent())
diff --git a/third_party/WebKit/Source/core/html/HTMLObjectElement.h b/third_party/WebKit/Source/core/html/HTMLObjectElement.h
index 6c613234..35c8bcd 100644
--- a/third_party/WebKit/Source/core/html/HTMLObjectElement.h
+++ b/third_party/WebKit/Source/core/html/HTMLObjectElement.h
@@ -113,8 +113,7 @@
 
   // FIXME: This function should not deal with url or serviceType
   // so that we can better share code between <object> and <embed>.
-  void ParametersForPlugin(Vector<String>& param_names,
-                           Vector<String>& param_values);
+  void ParametersForPlugin(PluginParameters& plugin_params);
 
   bool HasValidClassId() const;
 
diff --git a/third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp b/third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp
index bc0efb3..508d3e20 100644
--- a/third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp
@@ -71,6 +71,32 @@
 
 }  // anonymous namespace
 
+const Vector<String>& PluginParameters::Names() const {
+  return names_;
+}
+
+const Vector<String>& PluginParameters::Values() const {
+  return values_;
+}
+
+void PluginParameters::AppendAttribute(const Attribute& attribute) {
+  names_.push_back(attribute.LocalName().GetString());
+  values_.push_back(attribute.Value().GetString());
+}
+void PluginParameters::AppendNameWithValue(const String& name,
+                                           const String& value) {
+  names_.push_back(name);
+  values_.push_back(value);
+}
+
+int PluginParameters::FindStringInNames(const String& str) {
+  for (size_t i = 0; i < names_.size(); ++i) {
+    if (DeprecatedEqualIgnoringCase(names_[i], str))
+      return i;
+  }
+  return -1;
+}
+
 HTMLPlugInElement::HTMLPlugInElement(
     const QualifiedName& tag_name,
     Document& doc,
@@ -119,8 +145,7 @@
 }
 
 bool HTMLPlugInElement::RequestObjectInternal(
-    const Vector<String>& param_names,
-    const Vector<String>& param_values) {
+    const PluginParameters& plugin_params) {
   if (url_.IsEmpty() && service_type_.IsEmpty())
     return false;
 
@@ -146,8 +171,8 @@
   // it be handled as a plugin to show the broken plugin icon.
   bool use_fallback =
       object_type == ObjectContentType::kNone && HasFallbackContent();
-  return LoadPlugin(completed_url, service_type_, param_names, param_values,
-                    use_fallback, true);
+  return LoadPlugin(completed_url, service_type_, plugin_params, use_fallback,
+                    true);
 }
 
 bool HTMLPlugInElement::CanProcessDrag() const {
@@ -260,15 +285,11 @@
   if (!AllowedToLoadObject(url, service_type_))
     return;
 
-  Vector<String> param_names;
-  Vector<String> param_values;
-
-  param_names.push_back("type");
-  param_values.push_back(service_type_);
+  PluginParameters plugin_params;
+  plugin_params.AppendNameWithValue("type", service_type_);
 
   bool use_fallback = false;
-  LoadPlugin(url, service_type_, param_names, param_values, use_fallback,
-             false);
+  LoadPlugin(url, service_type_, plugin_params, use_fallback, false);
 }
 
 bool HTMLPlugInElement::ShouldAccelerate() const {
@@ -550,9 +571,8 @@
                ContentFrame()->GetSecurityContext()->GetSecurityOrigin()));
 }
 
-bool HTMLPlugInElement::RequestObject(const Vector<String>& param_names,
-                                      const Vector<String>& param_values) {
-  bool result = RequestObjectInternal(param_names, param_values);
+bool HTMLPlugInElement::RequestObject(const PluginParameters& plugin_params) {
+  bool result = RequestObjectInternal(plugin_params);
 
   DEFINE_STATIC_LOCAL(
       EnumerationHistogram, result_histogram,
@@ -565,8 +585,7 @@
 
 bool HTMLPlugInElement::LoadPlugin(const KURL& url,
                                    const String& mime_type,
-                                   const Vector<String>& param_names,
-                                   const Vector<String>& param_values,
+                                   const PluginParameters& plugin_params,
                                    bool use_fallback,
                                    bool require_layout_object) {
   if (!AllowedToLoadPlugin(url, mime_type))
@@ -593,9 +612,9 @@
     LocalFrameClient::DetachedPluginPolicy policy =
         require_layout_object ? LocalFrameClient::kFailOnDetachedPlugin
                               : LocalFrameClient::kAllowDetachedPlugin;
-    WebPluginContainerImpl* plugin =
-        frame->Client()->CreatePlugin(*this, url, param_names, param_values,
-                                      mime_type, load_manually, policy);
+    WebPluginContainerImpl* plugin = frame->Client()->CreatePlugin(
+        *this, url, plugin_params.Names(), plugin_params.Values(), mime_type,
+        load_manually, policy);
     if (!plugin) {
       if (layout_object && !layout_object->ShowsUnavailablePluginIndicator()) {
         plugin_is_available_ = false;
diff --git a/third_party/WebKit/Source/core/html/HTMLPlugInElement.h b/third_party/WebKit/Source/core/html/HTMLPlugInElement.h
index e55a14d..2e972530 100644
--- a/third_party/WebKit/Source/core/html/HTMLPlugInElement.h
+++ b/third_party/WebKit/Source/core/html/HTMLPlugInElement.h
@@ -42,6 +42,23 @@
   kShouldNotPreferPlugInsForImages
 };
 
+class PluginParameters {
+ public:
+  PluginParameters() {}
+  PluginParameters(Vector<String>& param_names, Vector<String>& param_values)
+      : names_(param_names), values_(param_values) {}
+
+  const Vector<String>& Names() const;
+  const Vector<String>& Values() const;
+  void AppendAttribute(const Attribute&);
+  void AppendNameWithValue(const String& name, const String& value);
+  int FindStringInNames(const String&);
+
+ private:
+  Vector<String> names_;
+  Vector<String> values_;
+};
+
 class CORE_EXPORT HTMLPlugInElement
     : public HTMLFrameOwnerElement,
       public ActiveScriptWrappable<HTMLPlugInElement> {
@@ -116,8 +133,7 @@
   bool IsImageType();
   LayoutEmbeddedObject* GetLayoutEmbeddedObject() const;
   bool AllowedToLoadFrameURL(const String& url);
-  bool RequestObject(const Vector<String>& param_names,
-                     const Vector<String>& param_values);
+  bool RequestObject(const PluginParameters& plugin_params);
 
   void DispatchErrorEvent();
   bool IsErrorplaceholder();
@@ -163,8 +179,7 @@
 
   bool LoadPlugin(const KURL&,
                   const String& mime_type,
-                  const Vector<String>& param_names,
-                  const Vector<String>& param_values,
+                  const PluginParameters& plugin_params,
                   bool use_fallback,
                   bool require_layout_object);
   // Perform checks after we have determined that a plugin will be used to
@@ -183,8 +198,7 @@
 
   void SetPersistedPlugin(WebPluginContainerImpl*);
 
-  bool RequestObjectInternal(const Vector<String>& param_names,
-                             const Vector<String>& param_values);
+  bool RequestObjectInternal(const PluginParameters& plugin_params);
 
   v8::Global<v8::Object> plugin_wrapper_;
   bool needs_plugin_update_;
diff --git a/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContext.cpp b/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContext.cpp
index 18a73502..90243658 100644
--- a/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContext.cpp
+++ b/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContext.cpp
@@ -152,6 +152,9 @@
       RuntimeEnabledFeatures::ExperimentalCanvasFeaturesEnabled()) {
     return kContextImageBitmap;
   }
+  if (id == "xrpresent" && RuntimeEnabledFeatures::WebXREnabled()) {
+    return kContextXRPresent;
+  }
   return kContextTypeCount;
 }
 
diff --git a/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContext.h b/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContext.h
index a79e5e2c..bb948f0 100644
--- a/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContext.h
+++ b/third_party/WebKit/Source/core/html/canvas/CanvasRenderingContext.h
@@ -76,6 +76,7 @@
     kContextWebgl = 3,
     kContextWebgl2 = 4,
     kContextImageBitmap = 5,
+    kContextXRPresent = 6,
     kContextTypeCount,
   };
 
diff --git a/third_party/WebKit/Source/core/html/canvas/HTMLCanvasElement.cpp b/third_party/WebKit/Source/core/html/canvas/HTMLCanvasElement.cpp
index 16a853f..4dc97093 100644
--- a/third_party/WebKit/Source/core/html/canvas/HTMLCanvasElement.cpp
+++ b/third_party/WebKit/Source/core/html/canvas/HTMLCanvasElement.cpp
@@ -495,10 +495,7 @@
     }
   }
 
-  if (context_ &&
-      context_->GetContextType() ==
-          CanvasRenderingContext::kContextImageBitmap &&
-      context_->PlatformLayer()) {
+  if (context_ && HasImageBitmapContext() && context_->PlatformLayer()) {
     context_->PlatformLayer()->Invalidate();
   }
 
@@ -1122,8 +1119,7 @@
 
 bool HTMLCanvasElement::TryCreateImageBuffer() {
   DCHECK(context_);
-  DCHECK(context_->GetContextType() !=
-         CanvasRenderingContext::kContextImageBitmap);
+  DCHECK(!HasImageBitmapContext());
   if (!HasImageBuffer() && !did_fail_to_create_resource_provider_) {
     CreateResourceProviderInternal(nullptr);
     if (did_fail_to_create_resource_provider_ && Is2d() && !Size().IsEmpty()) {
@@ -1158,8 +1154,7 @@
   if (!context_)
     return CreateTransparentImage(Size());
 
-  if (context_->GetContextType() ==
-      CanvasRenderingContext::kContextImageBitmap) {
+  if (HasImageBitmapContext()) {
     scoped_refptr<Image> image = context_->GetImage(hint);
     // TODO(fserb): return image?
     if (image)
@@ -1270,8 +1265,7 @@
     return result;
   }
 
-  if (context_->GetContextType() ==
-      CanvasRenderingContext::kContextImageBitmap) {
+  if (HasImageBitmapContext()) {
     *status = kNormalSourceImageStatus;
     scoped_refptr<Image> result = context_->GetImage(hint);
     if (!result)
@@ -1319,8 +1313,7 @@
 }
 
 FloatSize HTMLCanvasElement::ElementSize(const FloatSize&) const {
-  if (context_ && context_->GetContextType() ==
-                      CanvasRenderingContext::kContextImageBitmap) {
+  if (context_ && HasImageBitmapContext()) {
     scoped_refptr<Image> image = context_->GetImage(kPreferNoAcceleration);
     if (image)
       return FloatSize(image->width(), image->height());
@@ -1565,4 +1558,12 @@
   return nullptr;
 }
 
+bool HTMLCanvasElement::HasImageBitmapContext() const {
+  if (!context_)
+    return false;
+  CanvasRenderingContext::ContextType type = context_->GetContextType();
+  return (type == CanvasRenderingContext::kContextImageBitmap ||
+          type == CanvasRenderingContext::kContextXRPresent);
+}
+
 }  // namespace blink
diff --git a/third_party/WebKit/Source/core/html/canvas/HTMLCanvasElement.h b/third_party/WebKit/Source/core/html/canvas/HTMLCanvasElement.h
index ba1d0fe..1099619 100644
--- a/third_party/WebKit/Source/core/html/canvas/HTMLCanvasElement.h
+++ b/third_party/WebKit/Source/core/html/canvas/HTMLCanvasElement.h
@@ -71,8 +71,8 @@
 class IntSize;
 
 class
-    CanvasRenderingContext2DOrWebGLRenderingContextOrWebGL2RenderingContextOrImageBitmapRenderingContext;
-typedef CanvasRenderingContext2DOrWebGLRenderingContextOrWebGL2RenderingContextOrImageBitmapRenderingContext
+    CanvasRenderingContext2DOrWebGLRenderingContextOrWebGL2RenderingContextOrImageBitmapRenderingContextOrXRPresentationContext;
+typedef CanvasRenderingContext2DOrWebGLRenderingContextOrWebGL2RenderingContextOrImageBitmapRenderingContextOrXRPresentationContext
     RenderingContext;
 
 class CORE_EXPORT HTMLCanvasElement final
@@ -326,6 +326,10 @@
                            const double& quality,
                            SourceDrawingBuffer) const;
 
+  // Returns true if the canvas' context type is inherited from
+  // ImageBitmapRenderingContextBase.
+  bool HasImageBitmapContext() const;
+
   HeapHashSet<WeakMember<CanvasDrawListener>> listeners_;
 
   IntSize size_;
diff --git a/third_party/WebKit/Source/core/html/custom/CustomElement.cpp b/third_party/WebKit/Source/core/html/custom/CustomElement.cpp
index 8493e5b..2b6930f 100644
--- a/third_party/WebKit/Source/core/html/custom/CustomElement.cpp
+++ b/third_party/WebKit/Source/core/html/custom/CustomElement.cpp
@@ -119,7 +119,8 @@
     const QualifiedName& tag_name,
     CustomElementDefinition* definition) {
   DCHECK(ShouldCreateCustomElement(tag_name) ||
-         ShouldCreateCustomizedBuiltinElement(tag_name));
+         ShouldCreateCustomizedBuiltinElement(tag_name))
+      << tag_name;
   HTMLElement* element;
 
   if (definition && definition->Descriptor().IsAutonomous()) {
@@ -169,8 +170,8 @@
     SECURITY_DCHECK(v0element->IsHTMLElement());
     element = ToHTMLElement(v0element);
   } else if (should_create_builtin) {
-    element = HTMLElementFactory::createHTMLElement(
-        tag_name.LocalName(), document, kCreatedByCreateElement);
+    element = ToHTMLElement(
+        document.CreateRawElement(tag_name, kCreatedByCreateElement));
   } else {
     element = HTMLElement::Create(tag_name, document);
   }
diff --git a/third_party/WebKit/Source/core/html/custom/CustomElementDefinition.cpp b/third_party/WebKit/Source/core/html/custom/CustomElementDefinition.cpp
index 10c638b..4a3704a 100644
--- a/third_party/WebKit/Source/core/html/custom/CustomElementDefinition.cpp
+++ b/third_party/WebKit/Source/core/html/custom/CustomElementDefinition.cpp
@@ -6,6 +6,7 @@
 
 #include "bindings/core/v8/ExceptionState.h"
 #include "core/dom/Attr.h"
+#include "core/dom/Document.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/html/HTMLElement.h"
 #include "core/html/custom/CustomElement.h"
@@ -121,14 +122,13 @@
     // prefix set to prefix, local name set to localName, custom element
     // state set to "undefined", custom element definition set to null,
     // is value set to is, and node document set to document.
-    auto* result = HTMLElementFactory::CreateRawHTMLElement(
-        tag_name.LocalName(), document, flags);
+    auto* result = document.CreateRawElement(tag_name, flags);
     result->SetCustomElementState(CustomElementState::kUndefined);
 
     // 5.4. Otherwise, enqueue a custom element upgrade reaction given
     // result and definition.
     EnqueueUpgradeReaction(result);
-    return result;
+    return ToHTMLElement(result);
   }
 
   // 6. If definition is non-null, then:
diff --git a/third_party/WebKit/Source/core/html/forms/FileInputType.cpp b/third_party/WebKit/Source/core/html/forms/FileInputType.cpp
index 021128f0..751a139 100644
--- a/third_party/WebKit/Source/core/html/forms/FileInputType.cpp
+++ b/third_party/WebKit/Source/core/html/forms/FileInputType.cpp
@@ -339,6 +339,7 @@
   if (files_changed) {
     // This call may cause destruction of this instance.
     // input instance is safe since it is ref-counted.
+    GetElement().DispatchInputEvent();
     GetElement().DispatchChangeEvent();
   }
 }
diff --git a/third_party/WebKit/Source/core/html/forms/HTMLSelectElement.cpp b/third_party/WebKit/Source/core/html/forms/HTMLSelectElement.cpp
index a8d58f3..c2e7f75 100644
--- a/third_party/WebKit/Source/core/html/forms/HTMLSelectElement.cpp
+++ b/third_party/WebKit/Source/core/html/forms/HTMLSelectElement.cpp
@@ -422,9 +422,7 @@
 
   if (diff < 0) {  // Add dummy elements.
     do {
-      AppendChild(
-          GetDocument().createElement(optionTag, kCreatedByCreateElement),
-          exception_state);
+      AppendChild(HTMLOptionElement::Create(GetDocument()), exception_state);
       if (exception_state.HadException())
         break;
     } while (++diff);
diff --git a/third_party/WebKit/Source/core/html/forms/RadioInputType.cpp b/third_party/WebKit/Source/core/html/forms/RadioInputType.cpp
index ba75a21..59d49ce 100644
--- a/third_party/WebKit/Source/core/html/forms/RadioInputType.cpp
+++ b/third_party/WebKit/Source/core/html/forms/RadioInputType.cpp
@@ -213,7 +213,7 @@
              checked_radio_button->GetName() == GetElement().GetName())
       checked_radio_button->setChecked(true);
   } else if (state.checked != GetElement().checked()) {
-    GetElement().DispatchChangeEventIfNeeded();
+    GetElement().DispatchInputAndChangeEventIfNeeded();
   }
   is_in_click_handler_ = false;
   // The work we did in willDispatchClick was default handling.
diff --git a/third_party/WebKit/Source/core/html/media/AutoplayPolicy.cpp b/third_party/WebKit/Source/core/html/media/AutoplayPolicy.cpp
index 0efc999d..e8db265 100644
--- a/third_party/WebKit/Source/core/html/media/AutoplayPolicy.cpp
+++ b/third_party/WebKit/Source/core/html/media/AutoplayPolicy.cpp
@@ -221,7 +221,7 @@
   return false;
 }
 
-Nullable<ExceptionCode> AutoplayPolicy::RequestPlay() {
+Optional<ExceptionCode> AutoplayPolicy::RequestPlay() {
   if (!Frame::HasTransientUserActivation(element_->GetDocument().GetFrame())) {
     autoplay_uma_helper_->OnAutoplayInitiated(AutoplaySource::kMethod);
     if (IsGestureNeededForPlayback()) {
@@ -243,7 +243,7 @@
     TryUnlockingUserGesture();
   }
 
-  return nullptr;
+  return WTF::nullopt;
 }
 
 bool AutoplayPolicy::IsAutoplayingMuted() const {
diff --git a/third_party/WebKit/Source/core/html/media/AutoplayPolicy.h b/third_party/WebKit/Source/core/html/media/AutoplayPolicy.h
index dff4eac..2f836ea 100644
--- a/third_party/WebKit/Source/core/html/media/AutoplayPolicy.h
+++ b/third_party/WebKit/Source/core/html/media/AutoplayPolicy.h
@@ -5,10 +5,10 @@
 #ifndef AutoplayPolicy_h
 #define AutoplayPolicy_h
 
-#include "bindings/core/v8/Nullable.h"
 #include "core/CoreExport.h"
 #include "core/dom/ExceptionCode.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
@@ -55,7 +55,7 @@
   // Request the playback via play() method. This method will check the autoplay
   // restrictions and record metrics. This method can only be called once
   // per call of play().
-  Nullable<ExceptionCode> RequestPlay();
+  Optional<ExceptionCode> RequestPlay();
 
   // Returns whether an umute action should pause an autoplaying element. The
   // method will check autoplay restrictions and record metrics. This method can
diff --git a/third_party/WebKit/Source/core/html/media/HTMLMediaElement.cpp b/third_party/WebKit/Source/core/html/media/HTMLMediaElement.cpp
index 513023f4..0cec95b 100644
--- a/third_party/WebKit/Source/core/html/media/HTMLMediaElement.cpp
+++ b/third_party/WebKit/Source/core/html/media/HTMLMediaElement.cpp
@@ -829,6 +829,8 @@
   have_fired_loaded_data_ = false;
   display_mode_ = kUnknown;
 
+  autoplay_policy_->StopAutoplayMutedWhenVisible();
+
   // 1 - Abort any already-running instance of the resource selection algorithm
   // for this element.
   load_state_ = kWaitingForSource;
@@ -2324,13 +2326,13 @@
   ScriptPromise promise = resolver->Promise();
   play_promise_resolvers_.push_back(resolver);
 
-  Nullable<ExceptionCode> code = Play();
-  if (!code.IsNull()) {
+  Optional<ExceptionCode> code = Play();
+  if (code) {
     DCHECK(!play_promise_resolvers_.IsEmpty());
     play_promise_resolvers_.pop_back();
 
     String message;
-    switch (code.Get()) {
+    switch (code.value()) {
       case kNotAllowedError:
         message = "play() can only be initiated by a user gesture.";
         RecordPlayPromiseRejected(
@@ -2343,24 +2345,24 @@
       default:
         NOTREACHED();
     }
-    resolver->Reject(DOMException::Create(code.Get(), message));
+    resolver->Reject(DOMException::Create(code.value(), message));
     return promise;
   }
 
   return promise;
 }
 
-Nullable<ExceptionCode> HTMLMediaElement::Play() {
+Optional<ExceptionCode> HTMLMediaElement::Play() {
   BLINK_MEDIA_LOG << "play(" << (void*)this << ")";
 
-  Nullable<ExceptionCode> exception_code = autoplay_policy_->RequestPlay();
+  Optional<ExceptionCode> exception_code = autoplay_policy_->RequestPlay();
 
   if (exception_code == kNotAllowedError) {
     // If we're already playing, then this play would do nothing anyway.
     // Call playInternal to handle scheduling the promise resolution.
     if (!paused_) {
       PlayInternal();
-      return nullptr;
+      return WTF::nullopt;
     }
     return exception_code;
   }
@@ -2370,11 +2372,11 @@
   if (error_ && error_->code() == MediaError::kMediaErrSrcNotSupported)
     return kNotSupportedError;
 
-  DCHECK(exception_code.IsNull());
+  DCHECK(!exception_code.has_value());
 
   PlayInternal();
 
-  return nullptr;
+  return WTF::nullopt;
 }
 
 void HTMLMediaElement::PlayInternal() {
@@ -3861,7 +3863,8 @@
   DCHECK(IsMainThread());
   audio_source_node_ = source_node;
 
-  AudioSourceProviderClientLockScope scope(*this);
+  // No need to lock the |audio_source_node| because it locks itself when
+  // setFormat() is invoked.
   GetAudioSourceProvider().SetClient(audio_source_node_);
 }
 
diff --git a/third_party/WebKit/Source/core/html/media/HTMLMediaElement.h b/third_party/WebKit/Source/core/html/media/HTMLMediaElement.h
index 30d8c35..ea36861 100644
--- a/third_party/WebKit/Source/core/html/media/HTMLMediaElement.h
+++ b/third_party/WebKit/Source/core/html/media/HTMLMediaElement.h
@@ -30,7 +30,6 @@
 #include <memory>
 #include "bindings/core/v8/ActiveScriptWrappable.h"
 #include "bindings/core/v8/ExceptionState.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/ScriptPromise.h"
 #include "core/CoreExport.h"
 #include "core/dom/ExceptionCode.h"
@@ -43,6 +42,7 @@
 #include "platform/audio/AudioSourceProvider.h"
 #include "platform/bindings/TraceWrapperMember.h"
 #include "platform/network/mime/MIMETypeRegistry.h"
+#include "platform/wtf/Optional.h"
 #include "public/platform/WebAudioSourceProviderClient.h"
 #include "public/platform/WebMediaPlayerClient.h"
 
@@ -187,7 +187,7 @@
   bool Loop() const;
   void SetLoop(bool);
   ScriptPromise playForBindings(ScriptState*);
-  Nullable<ExceptionCode> Play();
+  Optional<ExceptionCode> Play();
   void pause();
   void RequestRemotePlayback();
   void RequestRemotePlaybackControl();
diff --git a/third_party/WebKit/Source/core/html/parser/BackgroundHTMLParser.h b/third_party/WebKit/Source/core/html/parser/BackgroundHTMLParser.h
index d8cc4db..dbbf904 100644
--- a/third_party/WebKit/Source/core/html/parser/BackgroundHTMLParser.h
+++ b/third_party/WebKit/Source/core/html/parser/BackgroundHTMLParser.h
@@ -40,12 +40,12 @@
 #include "core/html/parser/TextResourceDecoder.h"
 #include "core/html/parser/TokenizedChunkQueue.h"
 #include "core/html/parser/XSSAuditorDelegate.h"
+#include "platform/WebTaskRunner.h"
 
 namespace blink {
 
 class HTMLDocumentParser;
 class XSSAuditor;
-class WebTaskRunner;
 
 class BackgroundHTMLParser {
   USING_FAST_MALLOC(BackgroundHTMLParser);
diff --git a/third_party/WebKit/Source/core/html/parser/HTMLParserScheduler.h b/third_party/WebKit/Source/core/html/parser/HTMLParserScheduler.h
index a5e0a0a..4dd8975 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLParserScheduler.h
+++ b/third_party/WebKit/Source/core/html/parser/HTMLParserScheduler.h
@@ -37,7 +37,6 @@
 namespace blink {
 
 class HTMLDocumentParser;
-class WebTaskRunner;
 
 class PumpSession : public NestingLevelIncrementer {
   STACK_ALLOCATED();
diff --git a/third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.h b/third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.h
index 2cf63e3..ec52647 100644
--- a/third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.h
+++ b/third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.h
@@ -41,6 +41,7 @@
 #include "core/imagebitmap/ImageBitmapOptions.h"
 #include "core/workers/WorkerGlobalScope.h"
 #include "platform/Supplementable.h"
+#include "platform/WebTaskRunner.h"
 #include "platform/bindings/ScriptState.h"
 #include "platform/geometry/IntRect.h"
 #include "third_party/skia/include/core/SkRefCnt.h"
@@ -54,7 +55,6 @@
 class ExecutionContext;
 class ImageBitmapSource;
 class ImageBitmapOptions;
-class WebTaskRunner;
 
 typedef HTMLImageElementOrSVGImageElementOrHTMLVideoElementOrHTMLCanvasElementOrBlobOrImageDataOrImageBitmapOrOffscreenCanvas
     ImageBitmapSourceUnion;
diff --git a/third_party/WebKit/Source/core/layout/ng/ng_physical_fragment.cc b/third_party/WebKit/Source/core/layout/ng/ng_physical_fragment.cc
index 0e0f3077..9651d3d 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_physical_fragment.cc
+++ b/third_party/WebKit/Source/core/layout/ng/ng_physical_fragment.cc
@@ -90,22 +90,28 @@
 
   bool has_content = false;
   if (fragment->IsBox()) {
+    const auto* box = ToNGPhysicalBoxFragment(fragment);
     if (flags & NGPhysicalFragment::DumpType) {
       builder->Append("Box");
       String box_type = StringForBoxType(*fragment);
+      has_content = true;
       if (!box_type.IsEmpty()) {
         builder->Append(" (");
         builder->Append(box_type);
         builder->Append(")");
       }
-      has_content = true;
+      if (flags & NGPhysicalFragment::DumpSelfPainting &&
+          box->HasSelfPaintingLayer()) {
+        if (box_type.IsEmpty())
+          builder->Append(" ");
+        builder->Append("(self paint)");
+      }
     }
     has_content =
         AppendFragmentOffsetAndSize(fragment, builder, flags, has_content);
 
     builder->Append("\n");
 
-    const auto* box = ToNGPhysicalBoxFragment(fragment);
     if (flags & NGPhysicalFragment::DumpSubtree) {
       const auto& children = box->Children();
       for (unsigned i = 0; i < children.size(); i++)
diff --git a/third_party/WebKit/Source/core/layout/ng/ng_physical_fragment.h b/third_party/WebKit/Source/core/layout/ng/ng_physical_fragment.h
index d6079afd..255dd98c 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_physical_fragment.h
+++ b/third_party/WebKit/Source/core/layout/ng/ng_physical_fragment.h
@@ -161,6 +161,7 @@
     DumpOffset = 0x10,
     DumpSize = 0x20,
     DumpTextOffsets = 0x40,
+    DumpSelfPainting = 0x80,
     DumpAll = -1
   };
   typedef int DumpFlags;
diff --git a/third_party/WebKit/Source/core/loader/FrameFetchContext.h b/third_party/WebKit/Source/core/loader/FrameFetchContext.h
index 937e2173..50eaae87 100644
--- a/third_party/WebKit/Source/core/loader/FrameFetchContext.h
+++ b/third_party/WebKit/Source/core/loader/FrameFetchContext.h
@@ -34,6 +34,7 @@
 #include "core/CoreExport.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "core/loader/BaseFetchContext.h"
+#include "platform/WebTaskRunner.h"
 #include "platform/heap/Handle.h"
 #include "platform/loader/fetch/ClientHintsPreferences.h"
 #include "platform/loader/fetch/FetchParameters.h"
@@ -54,7 +55,6 @@
 class ResourceResponse;
 class Settings;
 struct WebEnabledClientHints;
-class WebTaskRunner;
 
 class CORE_EXPORT FrameFetchContext final : public BaseFetchContext {
  public:
diff --git a/third_party/WebKit/Source/core/loader/SubresourceIntegrityHelper.cpp b/third_party/WebKit/Source/core/loader/SubresourceIntegrityHelper.cpp
index 6187fe8..967db27 100644
--- a/third_party/WebKit/Source/core/loader/SubresourceIntegrityHelper.cpp
+++ b/third_party/WebKit/Source/core/loader/SubresourceIntegrityHelper.cpp
@@ -25,6 +25,12 @@
     case SubresourceIntegrity::ReportInfo::UseCounterFeature::
         kSRIElementWithUnparsableIntegrityAttribute:
       return WebFeature::kSRIElementWithUnparsableIntegrityAttribute;
+    case SubresourceIntegrity::ReportInfo::UseCounterFeature::
+        kSRISignatureCheck:
+      return WebFeature::kSRISignatureCheck;
+    case SubresourceIntegrity::ReportInfo::UseCounterFeature::
+        kSRISignatureSuccess:
+      return WebFeature::kSRISignatureSuccess;
   }
   NOTREACHED();
   return WebFeature::kSRIElementWithUnparsableIntegrityAttribute;
diff --git a/third_party/WebKit/Source/core/loader/WorkerFetchContext.h b/third_party/WebKit/Source/core/loader/WorkerFetchContext.h
index 5642d2a..1ae62d5 100644
--- a/third_party/WebKit/Source/core/loader/WorkerFetchContext.h
+++ b/third_party/WebKit/Source/core/loader/WorkerFetchContext.h
@@ -8,6 +8,7 @@
 #include <memory>
 #include "core/CoreExport.h"
 #include "core/loader/BaseFetchContext.h"
+#include "platform/WebTaskRunner.h"
 #include "platform/wtf/Forward.h"
 #include "services/network/public/interfaces/request_context_frame_type.mojom-blink.h"
 
@@ -15,7 +16,6 @@
 
 class ResourceFetcher;
 class SubresourceFilter;
-class WebTaskRunner;
 class WebURLLoader;
 class WebURLLoaderFactory;
 class WebWorkerFetchContext;
diff --git a/third_party/WebKit/Source/core/paint/ObjectPaintProperties.h b/third_party/WebKit/Source/core/paint/ObjectPaintProperties.h
index 05974a97..3f9797f 100644
--- a/third_party/WebKit/Source/core/paint/ObjectPaintProperties.h
+++ b/third_party/WebKit/Source/core/paint/ObjectPaintProperties.h
@@ -159,7 +159,7 @@
 
   class UpdateResult {
    public:
-    bool ValueChanged() const { return result_ == kValueChanged; }
+    bool Unchanged() const { return result_ == kUnchanged; }
     bool NewNodeCreated() const { return result_ == kNewNodeCreated; }
 
    private:
diff --git a/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp b/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
index 99606616..845f695 100644
--- a/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintPropertyTreeBuilder.cpp
@@ -206,24 +206,23 @@
     frame_translate.Translate(
         frame_view.X() + context.current.paint_offset.X(),
         frame_view.Y() + context.current.paint_offset.Y());
-    full_context.force_subtree_update |= UpdatePreTranslation(
+    bool property_added_or_removed = UpdatePreTranslation(
         frame_view, context.current.transform, frame_translate, FloatPoint3D());
 
     FloatRoundedRect content_clip(
         NeedsFrameContentClip(frame_view.GetFrame())
             ? IntRect(IntPoint(), frame_view.VisibleContentSize())
             : LayoutRect::InfiniteIntRect());
-    full_context.force_subtree_update |= UpdateContentClip(
+    property_added_or_removed |= UpdateContentClip(
         frame_view, context.current.clip, frame_view.PreTranslation(),
         content_clip, full_context.clip_changed);
 
     if (frame_view.IsScrollable()) {
-      full_context.force_subtree_update |= UpdateScroll(frame_view, context);
+      property_added_or_removed |= UpdateScroll(frame_view, context);
     } else if (frame_view.ScrollNode()) {
       // Ensure pre-existing properties are cleared if there is no scrolling.
       frame_view.SetScrollNode(nullptr);
-      // Rebuild all descendant properties because a property was removed.
-      full_context.force_subtree_update = true;
+      property_added_or_removed = true;
     }
 
     // A scroll translation node is created for static offset (e.g., overflow
@@ -232,16 +231,22 @@
     if (frame_view.IsScrollable() || !scroll_offset.IsZero()) {
       TransformationMatrix frame_scroll;
       frame_scroll.Translate(-scroll_offset.Width(), -scroll_offset.Height());
-      full_context.force_subtree_update |=
+      property_added_or_removed |=
           UpdateScrollTranslation(frame_view, frame_view.PreTranslation(),
                                   frame_scroll, frame_view.ScrollNode());
     } else if (frame_view.ScrollTranslation()) {
       // Ensure pre-existing properties are cleared if there is no scrolling.
       frame_view.SetScrollTranslation(nullptr);
-      // Rebuild all descendant properties because a property was removed.
-      full_context.force_subtree_update = true;
+      property_added_or_removed = true;
     }
     full_context.painting_layer = frame_view.GetLayoutView()->Layer();
+
+    if (property_added_or_removed) {
+      full_context.force_subtree_update = true;
+      // We need to update property tree states of paint chunks.
+      if (RuntimeEnabledFeatures::SlimmingPaintV175Enabled())
+        frame_view.GetLayoutView()->Layer()->SetNeedsRepaint();
+    }
   }
 
   // Initialize the context for current, absolute and fixed position cases.
@@ -283,12 +288,18 @@
       const LayoutObject& object,
       PaintPropertyTreeBuilderContext& full_context,
       PaintPropertyTreeBuilderFragmentContext& context,
-      FragmentData& fragment_data)
+      FragmentData& fragment_data,
+      bool& property_added_or_removed)
       : object_(object),
         full_context_(full_context),
         context_(context),
         fragment_data_(fragment_data),
-        properties_(fragment_data.PaintProperties()) {}
+        properties_(fragment_data.PaintProperties()),
+        property_added_or_removed_(property_added_or_removed) {}
+
+  ~FragmentPaintPropertyTreeBuilder() {
+    full_context_.force_subtree_update |= property_added_or_removed_;
+  }
 
   ALWAYS_INLINE void UpdateForSelf();
   ALWAYS_INLINE void UpdateForChildren();
@@ -314,6 +325,24 @@
   ALWAYS_INLINE void UpdateScrollAndScrollTranslation();
   ALWAYS_INLINE void UpdateOutOfFlowContext();
 
+  bool NeedsPaintPropertyUpdate() const {
+    return object_.NeedsPaintPropertyUpdate() ||
+           full_context_.force_subtree_update;
+  }
+
+  void OnUpdate(const ObjectPaintProperties::UpdateResult& result) {
+    property_added_or_removed_ |= result.NewNodeCreated();
+  }
+  void OnUpdateClip(const ObjectPaintProperties::UpdateResult& result) {
+    OnUpdate(result);
+    full_context_.clip_changed |= !result.Unchanged();
+  }
+  void OnClear(bool cleared) { property_added_or_removed_ |= cleared; }
+  void OnClearClip(bool cleared) {
+    OnClear(cleared);
+    full_context_.clip_changed |= cleared;
+  }
+
   const LayoutObject& object_;
   // The tree builder context for the whole object.
   PaintPropertyTreeBuilderContext& full_context_;
@@ -322,6 +351,7 @@
   PaintPropertyTreeBuilderFragmentContext& context_;
   FragmentData& fragment_data_;
   ObjectPaintProperties* properties_;
+  bool& property_added_or_removed_;
 };
 
 static bool NeedsScrollNode(const LayoutObject& object) {
@@ -441,12 +471,12 @@
   DCHECK(properties_);
 
   if (paint_offset_translation) {
-    auto result = properties_->UpdatePaintOffsetTranslation(
+    OnUpdate(properties_->UpdatePaintOffsetTranslation(
         context_.current.transform,
         TransformationMatrix().Translate(paint_offset_translation->X(),
                                          paint_offset_translation->Y()),
         FloatPoint3D(), context_.current.should_flatten_inherited_transform,
-        context_.current.rendering_context_id);
+        context_.current.rendering_context_id));
     context_.current.transform = properties_->PaintOffsetTranslation();
     if (RuntimeEnabledFeatures::RootLayerScrollingEnabled() &&
         object_.IsLayoutView()) {
@@ -454,11 +484,8 @@
           properties_->PaintOffsetTranslation();
       context_.fixed_position.transform = properties_->PaintOffsetTranslation();
     }
-
-    full_context_.force_subtree_update |= result.NewNodeCreated();
   } else {
-    full_context_.force_subtree_update |=
-        properties_->ClearPaintOffsetTranslation();
+    OnClear(properties_->ClearPaintOffsetTranslation());
   }
 }
 
@@ -481,17 +508,15 @@
   DCHECK(object_.IsSVGForeignObject() ||
          context_.current.paint_offset == LayoutPoint());
 
-  if (object_.NeedsPaintPropertyUpdate() ||
-      full_context_.force_subtree_update) {
+  if (NeedsPaintPropertyUpdate()) {
     AffineTransform transform = object_.LocalToSVGParentTransform();
     if (NeedsTransformForNonRootSVG(object_)) {
       // The origin is included in the local transform, so leave origin empty.
-      auto result = properties_->UpdateTransform(
-          context_.current.transform, TransformationMatrix(transform),
-          FloatPoint3D());
-      full_context_.force_subtree_update |= result.NewNodeCreated();
+      OnUpdate(properties_->UpdateTransform(context_.current.transform,
+                                            TransformationMatrix(transform),
+                                            FloatPoint3D()));
     } else {
-      full_context_.force_subtree_update |= properties_->ClearTransform();
+      OnClear(properties_->ClearTransform());
     }
   }
 
@@ -553,8 +578,7 @@
 
   DCHECK(properties_);
 
-  if (object_.NeedsPaintPropertyUpdate() ||
-      full_context_.force_subtree_update) {
+  if (NeedsPaintPropertyUpdate()) {
     const ComputedStyle& style = object_.StyleRef();
     // A transform node is allocated for transforms, preserves-3d and any
     // direct compositing reason. The latter is required because this is the
@@ -580,15 +604,14 @@
       if (style.Preserves3D() && !rendering_context_id)
         rendering_context_id = PtrHash<const LayoutObject>::GetHash(&object_);
 
-      auto result = properties_->UpdateTransform(
+      OnUpdate(properties_->UpdateTransform(
           context_.current.transform, matrix, TransformOrigin(box),
           context_.current.should_flatten_inherited_transform,
           rendering_context_id, compositing_reasons,
           CompositorElementIdFromUniqueObjectId(
-              object_.UniqueId(), CompositorElementIdNamespace::kPrimary));
-      full_context_.force_subtree_update |= result.NewNodeCreated();
+              object_.UniqueId(), CompositorElementIdNamespace::kPrimary)));
     } else {
-      full_context_.force_subtree_update |= properties_->ClearTransform();
+      OnClear(properties_->ClearTransform());
     }
   }
 
@@ -660,11 +683,8 @@
   const ComputedStyle& style = object_.StyleRef();
 
   // TODO(trchen): Can't omit effect node if we have 3D children.
-  if (object_.NeedsPaintPropertyUpdate() ||
-      full_context_.force_subtree_update) {
+  if (NeedsPaintPropertyUpdate()) {
     const ClipPaintPropertyNode* output_clip = nullptr;
-    bool local_clip_added_or_removed = false;
-    bool local_clip_changed = false;
     if (NeedsEffect(object_)) {
       // We may begin to composite our subtree prior to an animation starts,
       // but a compositor element ID is only needed when an animation is
@@ -683,17 +703,12 @@
           // clip doesn't fail fast/borders/inline-mask-overlay-image-outset-
           // vertical-rl.html.
           RuntimeEnabledFeatures::SlimmingPaintV175Enabled()) {
-        FloatRoundedRect rounded_mask_clip(*mask_clip);
-        if (properties_->MaskClip() &&
-            rounded_mask_clip != properties_->MaskClip()->ClipRect())
-          local_clip_changed = true;
-        auto result = properties_->UpdateMaskClip(context_.current.clip,
-                                                  context_.current.transform,
-                                                  rounded_mask_clip);
-        local_clip_added_or_removed |= result.NewNodeCreated();
+        OnUpdateClip(properties_->UpdateMaskClip(context_.current.clip,
+                                                 context_.current.transform,
+                                                 FloatRoundedRect(*mask_clip)));
         output_clip = properties_->MaskClip();
       } else {
-        full_context_.force_subtree_update |= properties_->ClearMaskClip();
+        OnClearClip(properties_->ClearMaskClip());
       }
 
       SkBlendMode blend_mode =
@@ -702,32 +717,28 @@
                                                 style.BlendMode())
               : SkBlendMode::kSrcOver;
 
-      auto result = properties_->UpdateEffect(
+      OnUpdate(properties_->UpdateEffect(
           context_.current_effect, context_.current.transform, output_clip,
           kColorFilterNone, CompositorFilterOperations(), style.Opacity(),
           blend_mode, compositing_reasons,
           CompositorElementIdFromUniqueObjectId(
-              object_.UniqueId(), CompositorElementIdNamespace::kPrimary));
-      full_context_.force_subtree_update |= result.NewNodeCreated();
+              object_.UniqueId(), CompositorElementIdNamespace::kPrimary)));
       if (mask_clip) {
-        auto result = properties_->UpdateMask(
+        OnUpdate(properties_->UpdateMask(
             properties_->Effect(), context_.current.transform, output_clip,
             mask_color_filter, CompositorFilterOperations(), 1.f,
             SkBlendMode::kDstIn, CompositingReason::kNone,
             CompositorElementIdFromUniqueObjectId(
-                object_.UniqueId(), CompositorElementIdNamespace::kEffectMask));
-        full_context_.force_subtree_update |= result.NewNodeCreated();
+                object_.UniqueId(),
+                CompositorElementIdNamespace::kEffectMask)));
       } else {
-        full_context_.force_subtree_update |= properties_->ClearMask();
+        OnClear(properties_->ClearMask());
       }
     } else {
-      full_context_.force_subtree_update |= properties_->ClearEffect();
-      full_context_.force_subtree_update |= properties_->ClearMask();
-      local_clip_added_or_removed |= properties_->ClearMaskClip();
+      OnClear(properties_->ClearEffect());
+      OnClear(properties_->ClearMask());
+      OnClearClip(properties_->ClearMaskClip());
     }
-    full_context_.force_subtree_update |= local_clip_added_or_removed;
-    full_context_.clip_changed |=
-        local_clip_changed || local_clip_added_or_removed;
   }
 
   if (properties_->Effect()) {
@@ -749,8 +760,7 @@
   DCHECK(properties_);
   const ComputedStyle& style = object_.StyleRef();
 
-  if (object_.NeedsPaintPropertyUpdate() ||
-      full_context_.force_subtree_update) {
+  if (NeedsPaintPropertyUpdate()) {
     if (NeedsFilter(object_)) {
       CompositorFilterOperations filter;
       // Try to use the cached filter.
@@ -794,16 +804,15 @@
       DCHECK(!style.HasCurrentFilterAnimation() ||
              compositing_reasons != CompositingReason::kNone);
 
-      auto result = properties_->UpdateFilter(
+      OnUpdate(properties_->UpdateFilter(
           context_.current_effect, context_.current.transform, output_clip,
           kColorFilterNone, std::move(filter), 1.f, SkBlendMode::kSrcOver,
           compositing_reasons,
           CompositorElementIdFromUniqueObjectId(
               object_.UniqueId(), CompositorElementIdNamespace::kEffectFilter),
-          FloatPoint(context_.current.paint_offset));
-      full_context_.force_subtree_update |= result.NewNodeCreated();
+          FloatPoint(context_.current.paint_offset)));
     } else {
-      full_context_.force_subtree_update |= properties_->ClearFilter();
+      OnClear(properties_->ClearFilter());
     }
   }
 
@@ -831,31 +840,17 @@
     const PaintLayer& painting_layer) {
   DCHECK(properties_);
 
-  if (object_.NeedsPaintPropertyUpdate() ||
-      full_context_.force_subtree_update) {
-    bool local_clip_added_or_removed = false;
-    bool local_clip_changed = false;
+  if (NeedsPaintPropertyUpdate()) {
     // It's possible to still have no clips even if NeedsFragmentationClip is
     // true, in the case when the FragmentainerIterator returns none.
     if (NeedsFragmentationClip(object_, painting_layer) &&
         context_.fragment_clip) {
-      LayoutRect clip_rect(*context_.fragment_clip);
-
-      FloatRoundedRect rounded_clip_rect((FloatRect(clip_rect)));
-
-      if (properties_->FragmentClip() &&
-          properties_->FragmentClip()->ClipRect() != rounded_clip_rect)
-        local_clip_changed = true;
-
-      auto result = properties_->UpdateFragmentClip(
-          context_.current.clip, context_.current.transform, rounded_clip_rect);
-      local_clip_added_or_removed |= result.NewNodeCreated();
+      OnUpdateClip(properties_->UpdateFragmentClip(
+          context_.current.clip, context_.current.transform,
+          FloatRoundedRect(FloatRect(*context_.fragment_clip))));
     } else {
-      local_clip_added_or_removed |= properties_->ClearFragmentClip();
+      OnClearClip(properties_->ClearFragmentClip());
     }
-    full_context_.force_subtree_update |= local_clip_added_or_removed;
-    full_context_.clip_changed |=
-        local_clip_changed || local_clip_added_or_removed;
   }
 }
 
@@ -866,10 +861,7 @@
 void FragmentPaintPropertyTreeBuilder::UpdateCssClip() {
   DCHECK(properties_);
 
-  if (object_.NeedsPaintPropertyUpdate() ||
-      full_context_.force_subtree_update) {
-    bool local_clip_added_or_removed = false;
-    bool local_clip_changed = false;
+  if (NeedsPaintPropertyUpdate()) {
     if (NeedsCssClip(object_)) {
       // Create clip node for descendants that are not fixed position.
       // We don't have to setup context.absolutePosition.clip here because this
@@ -878,22 +870,12 @@
       DCHECK(object_.CanContainAbsolutePositionObjects());
       LayoutRect clip_rect =
           ToLayoutBox(object_).ClipRect(context_.current.paint_offset);
-
-      FloatRoundedRect rounded_clip_rect((FloatRect(clip_rect)));
-      if (properties_->CssClip() &&
-          properties_->CssClip()->ClipRect() != rounded_clip_rect)
-        local_clip_changed = true;
-
-      auto result = properties_->UpdateCssClip(
+      OnUpdateClip(properties_->UpdateCssClip(
           context_.current.clip, context_.current.transform,
-          FloatRoundedRect(FloatRect(clip_rect)));
-      local_clip_added_or_removed |= result.NewNodeCreated();
+          FloatRoundedRect(FloatRect(clip_rect))));
     } else {
-      local_clip_added_or_removed |= properties_->ClearCssClip();
+      OnClearClip(properties_->ClearCssClip());
     }
-    full_context_.force_subtree_update |= local_clip_added_or_removed;
-    full_context_.clip_changed |=
-        local_clip_changed || local_clip_added_or_removed;
   }
 
   if (properties_->CssClip())
@@ -901,8 +883,7 @@
 }
 
 void FragmentPaintPropertyTreeBuilder::UpdateLocalBorderBoxContext() {
-  if (!object_.NeedsPaintPropertyUpdate() &&
-      !full_context_.force_subtree_update)
+  if (!NeedsPaintPropertyUpdate())
     return;
 
   if (!object_.HasLayer() && !NeedsPaintOffsetTranslation(object_)) {
@@ -988,8 +969,7 @@
 void FragmentPaintPropertyTreeBuilder::UpdateOverflowControlsClip() {
   DCHECK(properties_);
 
-  if (!object_.NeedsPaintPropertyUpdate() &&
-      !full_context_.force_subtree_update)
+  if (!NeedsPaintPropertyUpdate())
     return;
 
   if (NeedsOverflowControlsClip(object_)) {
@@ -1011,9 +991,7 @@
 void FragmentPaintPropertyTreeBuilder::UpdateInnerBorderRadiusClip() {
   DCHECK(properties_);
 
-  if (object_.NeedsPaintPropertyUpdate() ||
-      full_context_.force_subtree_update) {
-    bool clip_added_or_removed;
+  if (NeedsPaintPropertyUpdate()) {
     if (NeedsInnerBorderRadiusClip(object_)) {
       const LayoutBox& box = ToLayoutBox(object_);
       FloatRoundedRect inner_border;
@@ -1029,19 +1007,11 @@
         inner_border = box.StyleRef().GetRoundedInnerBorderFor(
             LayoutRect(context_.current.paint_offset, box.Size()));
       }
-      auto result = properties_->UpdateInnerBorderRadiusClip(
-          context_.current.clip, context_.current.transform, inner_border);
-
-      if (!full_context_.clip_changed && properties_->InnerBorderRadiusClip() &&
-          inner_border != properties_->InnerBorderRadiusClip()->ClipRect())
-        full_context_.clip_changed = true;
-      clip_added_or_removed = result.NewNodeCreated();
+      OnUpdateClip(properties_->UpdateInnerBorderRadiusClip(
+          context_.current.clip, context_.current.transform, inner_border));
     } else {
-      clip_added_or_removed = properties_->ClearInnerBorderRadiusClip();
+      OnClearClip(properties_->ClearInnerBorderRadiusClip());
     }
-
-    full_context_.force_subtree_update |= clip_added_or_removed;
-    full_context_.clip_changed |= clip_added_or_removed;
   }
 
   if (auto* border_radius_clip = properties_->InnerBorderRadiusClip())
@@ -1051,9 +1021,7 @@
 void FragmentPaintPropertyTreeBuilder::UpdateOverflowClip() {
   DCHECK(properties_);
 
-  if (object_.NeedsPaintPropertyUpdate() ||
-      full_context_.force_subtree_update) {
-    bool clip_added_or_removed;
+  if (NeedsPaintPropertyUpdate()) {
     if (NeedsOverflowClip(object_)) {
       FloatRoundedRect clip_rect;
       FloatRoundedRect clip_rect_excluding_overlay_scrollbars;
@@ -1078,20 +1046,12 @@
         clip_rect_excluding_overlay_scrollbars = clip_rect;
       }
 
-      if (!full_context_.clip_changed && properties_->OverflowClip() &&
-          clip_rect != properties_->OverflowClip()->ClipRect())
-        full_context_.clip_changed = true;
-
-      auto result = properties_->UpdateOverflowClip(
+      OnUpdateClip(properties_->UpdateOverflowClip(
           context_.current.clip, context_.current.transform, clip_rect,
-          &clip_rect_excluding_overlay_scrollbars);
-      clip_added_or_removed = result.NewNodeCreated();
+          &clip_rect_excluding_overlay_scrollbars));
     } else {
-      clip_added_or_removed = properties_->ClearOverflowClip();
+      OnClearClip(properties_->ClearOverflowClip());
     }
-
-    full_context_.force_subtree_update |= clip_added_or_removed;
-    full_context_.clip_changed |= clip_added_or_removed;
   }
 
   if (auto* overflow_clip = properties_->OverflowClip())
@@ -1113,8 +1073,7 @@
 void FragmentPaintPropertyTreeBuilder::UpdatePerspective() {
   DCHECK(properties_);
 
-  if (object_.NeedsPaintPropertyUpdate() ||
-      full_context_.force_subtree_update) {
+  if (NeedsPaintPropertyUpdate()) {
     if (NeedsPerspective(object_)) {
       const ComputedStyle& style = object_.StyleRef();
       // The perspective node must not flatten (else nothing will get
@@ -1124,13 +1083,12 @@
           TransformationMatrix().ApplyPerspective(style.Perspective());
       FloatPoint3D origin = PerspectiveOrigin(ToLayoutBox(object_)) +
                             ToLayoutSize(context_.current.paint_offset);
-      auto result = properties_->UpdatePerspective(
+      OnUpdate(properties_->UpdatePerspective(
           context_.current.transform, matrix, origin,
           context_.current.should_flatten_inherited_transform,
-          context_.current.rendering_context_id);
-      full_context_.force_subtree_update |= result.NewNodeCreated();
+          context_.current.rendering_context_id));
     } else {
-      full_context_.force_subtree_update |= properties_->ClearPerspective();
+      OnClear(properties_->ClearPerspective());
     }
   }
 
@@ -1145,19 +1103,16 @@
   if (!object_.IsSVGRoot())
     return;
 
-  if (object_.NeedsPaintPropertyUpdate() ||
-      full_context_.force_subtree_update) {
+  if (NeedsPaintPropertyUpdate()) {
     AffineTransform transform_to_border_box =
         SVGRootPainter(ToLayoutSVGRoot(object_))
             .TransformToPixelSnappedBorderBox(context_.current.paint_offset);
     if (!transform_to_border_box.IsIdentity() &&
         NeedsSVGLocalToBorderBoxTransform(object_)) {
-      auto result = properties_->UpdateSvgLocalToBorderBoxTransform(
-          context_.current.transform, transform_to_border_box, FloatPoint3D());
-      full_context_.force_subtree_update |= result.NewNodeCreated();
+      OnUpdate(properties_->UpdateSvgLocalToBorderBoxTransform(
+          context_.current.transform, transform_to_border_box, FloatPoint3D()));
     } else {
-      full_context_.force_subtree_update |=
-          properties_->ClearSvgLocalToBorderBoxTransform();
+      OnClear(properties_->ClearSvgLocalToBorderBoxTransform());
     }
   }
 
@@ -1187,8 +1142,7 @@
 void FragmentPaintPropertyTreeBuilder::UpdateScrollAndScrollTranslation() {
   DCHECK(properties_);
 
-  if (object_.NeedsPaintPropertyUpdate() ||
-      full_context_.force_subtree_update) {
+  if (NeedsPaintPropertyUpdate()) {
     if (NeedsScrollNode(object_)) {
       const LayoutBox& box = ToLayoutBox(object_);
       auto* scrollable_area = box.GetScrollableArea();
@@ -1229,14 +1183,12 @@
       auto element_id = scrollable_area->GetCompositorElementId();
 
       // TODO(pdr): Set the correct compositing reasons here.
-      auto result = properties_->UpdateScroll(
+      OnUpdate(properties_->UpdateScroll(
           context_.current.scroll, container_rect, contents_rect,
           user_scrollable_horizontal, user_scrollable_vertical, reasons,
-          element_id);
-      full_context_.force_subtree_update |= result.NewNodeCreated();
+          element_id));
     } else {
-      // Ensure pre-existing properties are cleared.
-      full_context_.force_subtree_update |= properties_->ClearScroll();
+      OnClear(properties_->ClearScroll());
     }
 
     // A scroll translation node is created for static offset (e.g., overflow
@@ -1247,16 +1199,13 @@
       TransformationMatrix scroll_offset_matrix =
           TransformationMatrix().Translate(-scroll_offset.Width(),
                                            -scroll_offset.Height());
-      auto result = properties_->UpdateScrollTranslation(
+      OnUpdate(properties_->UpdateScrollTranslation(
           context_.current.transform, scroll_offset_matrix, FloatPoint3D(),
           context_.current.should_flatten_inherited_transform,
           context_.current.rendering_context_id, CompositingReason::kNone,
-          CompositorElementId(), properties_->Scroll());
-      full_context_.force_subtree_update |= result.NewNodeCreated();
+          CompositorElementId(), properties_->Scroll()));
     } else {
-      // Ensure pre-existing properties are cleared.
-      full_context_.force_subtree_update |=
-          properties_->ClearScrollTranslation();
+      OnClear(properties_->ClearScrollTranslation());
     }
   }
 
@@ -1322,14 +1271,12 @@
     if (context_.fixed_position.clip == css_clip->Parent()) {
       context_.fixed_position.clip = css_clip;
     } else {
-      if (object_.NeedsPaintPropertyUpdate() ||
-          full_context_.force_subtree_update) {
-        auto result = properties_->UpdateCssClipFixedPosition(
+      if (NeedsPaintPropertyUpdate()) {
+        OnUpdate(properties_->UpdateCssClipFixedPosition(
             context_.fixed_position.clip,
             const_cast<TransformPaintPropertyNode*>(
                 css_clip->LocalTransformSpace()),
-            css_clip->ClipRect());
-        full_context_.force_subtree_update |= result.NewNodeCreated();
+            css_clip->ClipRect()));
       }
       if (properties_->CssClipFixedPosition())
         context_.fixed_position.clip = properties_->CssClipFixedPosition();
@@ -1345,13 +1292,8 @@
       context_.fixed_position.containing_block_changed_under_filter = true;
   }
 
-  if (object_.NeedsPaintPropertyUpdate() ||
-      full_context_.force_subtree_update) {
-    if (properties_) {
-      full_context_.force_subtree_update |=
-          properties_->ClearCssClipFixedPosition();
-    }
-  }
+  if (NeedsPaintPropertyUpdate() && properties_)
+    OnClear(properties_->ClearCssClipFixedPosition());
 }
 
 static LayoutRect BorderBoxRectInPaginationContainer(
@@ -2097,24 +2039,31 @@
   else
     object_.GetMutableForPainting().FirstFragment().ClearNextFragment();
 
+  bool property_added_or_removed = false;
   auto* fragment_data = &object_.GetMutableForPainting().FirstFragment();
   for (auto& fragment_context : context_.fragments) {
     FragmentPaintPropertyTreeBuilder(object_, context_, fragment_context,
-                                     *fragment_data)
+                                     *fragment_data, property_added_or_removed)
         .UpdateForSelf();
     fragment_data = fragment_data->NextFragment();
   }
   DCHECK(!fragment_data);
+
+  // We need to update property tree states of paint chunks.
+  if (property_added_or_removed &&
+      RuntimeEnabledFeatures::SlimmingPaintV175Enabled())
+    context_.painting_layer->SetNeedsRepaint();
 }
 
 void ObjectPaintPropertyTreeBuilder::UpdateForChildren() {
   if (!ObjectTypeMightNeedPaintProperties(object_))
     return;
 
+  bool property_added_or_removed = false;
   auto* fragment_data = &object_.GetMutableForPainting().FirstFragment();
   for (auto& fragment_context : context_.fragments) {
     FragmentPaintPropertyTreeBuilder(object_, context_, fragment_context,
-                                     *fragment_data)
+                                     *fragment_data, property_added_or_removed)
         .UpdateForChildren();
     context_.force_subtree_update |= object_.SubtreeNeedsPaintPropertyUpdate();
     fragment_data = fragment_data->NextFragment();
@@ -2125,6 +2074,11 @@
     context_.container_for_absolute_position = &object_;
   if (object_.CanContainFixedPositionObjects())
     context_.container_for_fixed_position = &object_;
+
+  // We need to update property tree states of paint chunks.
+  if (property_added_or_removed &&
+      RuntimeEnabledFeatures::SlimmingPaintV175Enabled())
+    context_.painting_layer->SetNeedsRepaint();
 }
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/core/script/Modulator.h b/third_party/WebKit/Source/core/script/Modulator.h
index 900c959..8b312b4f 100644
--- a/third_party/WebKit/Source/core/script/Modulator.h
+++ b/third_party/WebKit/Source/core/script/Modulator.h
@@ -8,6 +8,7 @@
 #include "bindings/core/v8/ScriptModule.h"
 #include "core/CoreExport.h"
 #include "core/script/ModuleImportMeta.h"
+#include "platform/WebTaskRunner.h"
 #include "platform/bindings/ScriptWrappable.h"
 #include "platform/bindings/V8PerContextData.h"
 #include "platform/heap/Handle.h"
@@ -31,7 +32,6 @@
 class ScriptState;
 class ScriptValue;
 class SecurityOrigin;
-class WebTaskRunner;
 
 // A SingleModuleClient is notified when single module script node (node as in a
 // module tree graph) load is complete and its corresponding entry is created in
diff --git a/third_party/WebKit/Source/core/script/ModulatorImplBase.h b/third_party/WebKit/Source/core/script/ModulatorImplBase.h
index 4dfc168..0eb87e4 100644
--- a/third_party/WebKit/Source/core/script/ModulatorImplBase.h
+++ b/third_party/WebKit/Source/core/script/ModulatorImplBase.h
@@ -7,6 +7,7 @@
 
 #include "bindings/core/v8/ScriptModule.h"
 #include "core/script/Modulator.h"
+#include "platform/WebTaskRunner.h"
 #include "platform/bindings/ScriptWrappable.h"
 #include "platform/bindings/TraceWrapperMember.h"
 #include "platform/bindings/V8PerIsolateData.h"
@@ -20,7 +21,6 @@
 class ModuleScriptLoaderRegistry;
 class ModuleTreeLinkerRegistry;
 class ScriptState;
-class WebTaskRunner;
 
 // ModulatorImplBase is the base implementation of Modulator interface, which
 // represents "environment settings object" concept for module scripts.
diff --git a/third_party/WebKit/Source/core/script/ScriptRunner.h b/third_party/WebKit/Source/core/script/ScriptRunner.h
index 6702753..a234720 100644
--- a/third_party/WebKit/Source/core/script/ScriptRunner.h
+++ b/third_party/WebKit/Source/core/script/ScriptRunner.h
@@ -29,6 +29,7 @@
 #include "base/location.h"
 #include "base/macros.h"
 #include "core/CoreExport.h"
+#include "platform/WebTaskRunner.h"
 #include "platform/bindings/ScriptWrappable.h"
 #include "platform/bindings/TraceWrapperMember.h"
 #include "platform/heap/Handle.h"
@@ -39,7 +40,6 @@
 
 class Document;
 class ScriptLoader;
-class WebTaskRunner;
 
 class CORE_EXPORT ScriptRunner final
     : public GarbageCollectedFinalized<ScriptRunner>,
diff --git a/third_party/WebKit/Source/core/style/FilterOperation.h b/third_party/WebKit/Source/core/style/FilterOperation.h
index ece0aad..b86f2af 100644
--- a/third_party/WebKit/Source/core/style/FilterOperation.h
+++ b/third_party/WebKit/Source/core/style/FilterOperation.h
@@ -30,6 +30,7 @@
 #include "core/CoreExport.h"
 #include "core/style/ShadowData.h"
 #include "platform/Length.h"
+#include "platform/WebTaskRunner.h"
 #include "platform/geometry/FloatRect.h"
 #include "platform/graphics/BoxReflection.h"
 #include "platform/graphics/Color.h"
diff --git a/third_party/WebKit/Source/core/testing/DictionaryTest.cpp b/third_party/WebKit/Source/core/testing/DictionaryTest.cpp
index 5394058..d02ef86 100644
--- a/third_party/WebKit/Source/core/testing/DictionaryTest.cpp
+++ b/third_party/WebKit/Source/core/testing/DictionaryTest.cpp
@@ -81,33 +81,38 @@
 
 void DictionaryTest::get(InternalDictionary& result) {
   if (long_member_)
-    result.setLongMember(long_member_.Get());
+    result.setLongMember(long_member_.value());
   if (long_member_with_clamp_)
-    result.setLongMemberWithClamp(long_member_with_clamp_.Get());
-  if (long_member_with_enforce_range_)
-    result.setLongMemberWithEnforceRange(long_member_with_enforce_range_.Get());
+    result.setLongMemberWithClamp(long_member_with_clamp_.value());
+  if (long_member_with_enforce_range_) {
+    result.setLongMemberWithEnforceRange(
+        long_member_with_enforce_range_.value());
+  }
   result.setLongMemberWithDefault(long_member_with_default_);
   if (long_or_null_member_)
-    result.setLongOrNullMember(long_or_null_member_.Get());
-  if (long_or_null_member_with_default_)
+    result.setLongOrNullMember(long_or_null_member_.value());
+  if (long_or_null_member_with_default_) {
     result.setLongOrNullMemberWithDefault(
-        long_or_null_member_with_default_.Get());
+        long_or_null_member_with_default_.value());
+  }
   if (boolean_member_)
-    result.setBooleanMember(boolean_member_.Get());
+    result.setBooleanMember(boolean_member_.value());
   if (double_member_)
-    result.setDoubleMember(double_member_.Get());
+    result.setDoubleMember(double_member_.value());
   if (unrestricted_double_member_)
-    result.setUnrestrictedDoubleMember(unrestricted_double_member_.Get());
+    result.setUnrestrictedDoubleMember(unrestricted_double_member_.value());
   result.setStringMember(string_member_);
   result.setStringMemberWithDefault(string_member_with_default_);
   result.setByteStringMember(byte_string_member_);
   result.setUsvStringMember(usv_string_member_);
   if (string_sequence_member_)
-    result.setStringSequenceMember(string_sequence_member_.Get());
+    result.setStringSequenceMember(string_sequence_member_.value());
   result.setStringSequenceMemberWithDefault(
       string_sequence_member_with_default_);
-  if (string_sequence_or_null_member_)
-    result.setStringSequenceOrNullMember(string_sequence_or_null_member_.Get());
+  if (string_sequence_or_null_member_) {
+    result.setStringSequenceOrNullMember(
+        string_sequence_or_null_member_.value());
+  }
   result.setEnumMember(enum_member_);
   result.setEnumMemberWithDefault(enum_member_with_default_);
   result.setEnumOrNullMember(enum_or_null_member_);
@@ -119,9 +124,10 @@
   result.setObjectOrNullMemberWithDefault(object_or_null_member_with_default_);
   if (!double_or_string_member_.IsNull())
     result.setDoubleOrStringMember(double_or_string_member_);
-  if (!double_or_string_sequence_member_.IsNull())
+  if (double_or_string_sequence_member_) {
     result.setDoubleOrStringSequenceMember(
-        double_or_string_sequence_member_.Get());
+        double_or_string_sequence_member_.value());
+  }
   result.setEventTargetOrNullMember(event_target_or_null_member_);
   result.setInternalEnumOrInternalEnumSequenceMember(
       internal_enum_or_internal_enum_sequence_);
@@ -132,7 +138,7 @@
   if (!dictionary_member_properties_)
     return ScriptValue();
   V8ObjectBuilder builder(script_state);
-  HashMap<String, String> properties = dictionary_member_properties_.Get();
+  HashMap<String, String> properties = dictionary_member_properties_.value();
   for (HashMap<String, String>::iterator it = properties.begin();
        it != properties.end(); ++it)
     builder.AddString(it->key, it->value);
@@ -198,20 +204,20 @@
 }
 
 void DictionaryTest::Reset() {
-  long_member_ = nullptr;
-  long_member_with_clamp_ = nullptr;
-  long_member_with_enforce_range_ = nullptr;
+  long_member_ = WTF::nullopt;
+  long_member_with_clamp_ = WTF::nullopt;
+  long_member_with_enforce_range_ = WTF::nullopt;
   long_member_with_default_ = -1;  // This value should not be returned.
-  long_or_null_member_ = nullptr;
-  long_or_null_member_with_default_ = nullptr;
-  boolean_member_ = nullptr;
-  double_member_ = nullptr;
-  unrestricted_double_member_ = nullptr;
+  long_or_null_member_ = WTF::nullopt;
+  long_or_null_member_with_default_ = WTF::nullopt;
+  boolean_member_ = WTF::nullopt;
+  double_member_ = WTF::nullopt;
+  unrestricted_double_member_ = WTF::nullopt;
   string_member_ = String();
   string_member_with_default_ = String("Should not be returned");
-  string_sequence_member_ = nullptr;
+  string_sequence_member_ = WTF::nullopt;
   string_sequence_member_with_default_.Fill("Should not be returned", 1);
-  string_sequence_or_null_member_ = nullptr;
+  string_sequence_or_null_member_ = WTF::nullopt;
   enum_member_ = String();
   enum_member_with_default_ = String();
   enum_or_null_member_ = String();
@@ -224,7 +230,7 @@
   derived_string_member_ = String();
   derived_string_member_with_default_ = String();
   required_boolean_member_ = false;
-  dictionary_member_properties_ = nullptr;
+  dictionary_member_properties_ = WTF::nullopt;
   internal_enum_or_internal_enum_sequence_ =
       InternalEnumOrInternalEnumSequence();
 }
diff --git a/third_party/WebKit/Source/core/testing/DictionaryTest.h b/third_party/WebKit/Source/core/testing/DictionaryTest.h
index c5ae647..e7a1445 100644
--- a/third_party/WebKit/Source/core/testing/DictionaryTest.h
+++ b/third_party/WebKit/Source/core/testing/DictionaryTest.h
@@ -5,7 +5,6 @@
 #ifndef DictionaryTest_h
 #define DictionaryTest_h
 
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/ScriptValue.h"
 #include "bindings/core/v8/double_or_string.h"
 #include "bindings/core/v8/internal_enum_or_internal_enum_sequence.h"
@@ -13,6 +12,7 @@
 #include "platform/bindings/ScriptWrappable.h"
 #include "platform/heap/Handle.h"
 #include "platform/wtf/HashMap.h"
+#include "platform/wtf/Optional.h"
 #include "platform/wtf/text/WTFString.h"
 
 namespace blink {
@@ -54,27 +54,27 @@
 
   void Reset();
 
-  // The reason to use Nullable<T> is convenience; we use Nullable<T> here to
+  // The reason to use Optional<T> is convenience; we use Optional<T> here to
   // record whether the member field is set or not. Some members are not
-  // wrapped with Nullable because:
+  // wrapped with Optional because:
   //  - |longMemberWithDefault| has a non-null default value
   //  - String and PtrTypes can express whether they are null
-  Nullable<int> long_member_;
-  Nullable<int> long_member_with_clamp_;
-  Nullable<int> long_member_with_enforce_range_;
+  Optional<int> long_member_;
+  Optional<int> long_member_with_clamp_;
+  Optional<int> long_member_with_enforce_range_;
   int long_member_with_default_;
-  Nullable<int> long_or_null_member_;
-  Nullable<int> long_or_null_member_with_default_;
-  Nullable<bool> boolean_member_;
-  Nullable<double> double_member_;
-  Nullable<double> unrestricted_double_member_;
+  Optional<int> long_or_null_member_;
+  Optional<int> long_or_null_member_with_default_;
+  Optional<bool> boolean_member_;
+  Optional<double> double_member_;
+  Optional<double> unrestricted_double_member_;
   String string_member_;
   String string_member_with_default_;
   String byte_string_member_;
   String usv_string_member_;
-  Nullable<Vector<String>> string_sequence_member_;
+  Optional<Vector<String>> string_sequence_member_;
   Vector<String> string_sequence_member_with_default_;
-  Nullable<Vector<String>> string_sequence_or_null_member_;
+  Optional<Vector<String>> string_sequence_or_null_member_;
   String enum_member_;
   String enum_member_with_default_;
   String enum_or_null_member_;
@@ -83,13 +83,13 @@
   ScriptValue object_member_;
   ScriptValue object_or_null_member_with_default_;
   DoubleOrString double_or_string_member_;
-  Nullable<HeapVector<DoubleOrString>> double_or_string_sequence_member_;
+  Optional<HeapVector<DoubleOrString>> double_or_string_sequence_member_;
   Member<EventTarget> event_target_or_null_member_;
   String derived_string_member_;
   String derived_string_member_with_default_;
   String derived_derived_string_member_;
   bool required_boolean_member_;
-  Nullable<HashMap<String, String>> dictionary_member_properties_;
+  Optional<HashMap<String, String>> dictionary_member_properties_;
   InternalEnumOrInternalEnumSequence internal_enum_or_internal_enum_sequence_;
 };
 
diff --git a/third_party/WebKit/Source/core/testing/DummyModulator.h b/third_party/WebKit/Source/core/testing/DummyModulator.h
index 40efd27..b6242d2 100644
--- a/third_party/WebKit/Source/core/testing/DummyModulator.h
+++ b/third_party/WebKit/Source/core/testing/DummyModulator.h
@@ -7,13 +7,13 @@
 
 #include "bindings/core/v8/ScriptModule.h"
 #include "core/script/Modulator.h"
+#include "platform/WebTaskRunner.h"
 #include "platform/heap/Handle.h"
 
 namespace blink {
 
 class ModuleScriptLoaderClient;
 class ScriptModuleResolver;
-class WebTaskRunner;
 class ModuleScriptFetchRequest;
 
 // DummyModulator provides empty Modulator interface implementation w/
diff --git a/third_party/WebKit/Source/core/testing/RecordTest.cpp b/third_party/WebKit/Source/core/testing/RecordTest.cpp
index a4bea6e..aab475d 100644
--- a/third_party/WebKit/Source/core/testing/RecordTest.cpp
+++ b/third_party/WebKit/Source/core/testing/RecordTest.cpp
@@ -20,11 +20,11 @@
 }
 
 void RecordTest::setNullableStringLongRecord(
-    const Nullable<Vector<std::pair<String, int32_t>>>& arg) {
+    const Optional<Vector<std::pair<String, int32_t>>>& arg) {
   nullable_string_long_record_ = arg;
 }
 
-Nullable<Vector<std::pair<String, int32_t>>>
+Optional<Vector<std::pair<String, int32_t>>>
 RecordTest::getNullableStringLongRecord() {
   return nullable_string_long_record_;
 }
diff --git a/third_party/WebKit/Source/core/testing/RecordTest.h b/third_party/WebKit/Source/core/testing/RecordTest.h
index f31dc1b..34a1f5e 100644
--- a/third_party/WebKit/Source/core/testing/RecordTest.h
+++ b/third_party/WebKit/Source/core/testing/RecordTest.h
@@ -6,12 +6,12 @@
 #define RecordTest_h
 
 #include <utility>
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/boolean_or_byte_string_byte_string_record.h"
 #include "bindings/core/v8/float_or_string_element_record.h"
 #include "core/dom/Element.h"
 #include "platform/bindings/ScriptWrappable.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 #include "platform/wtf/Vector.h"
 #include "platform/wtf/text/WTFString.h"
 
@@ -28,8 +28,8 @@
   Vector<std::pair<String, int32_t>> getStringLongRecord();
 
   void setNullableStringLongRecord(
-      const Nullable<Vector<std::pair<String, int32_t>>>& arg);
-  Nullable<Vector<std::pair<String, int32_t>>> getNullableStringLongRecord();
+      const Optional<Vector<std::pair<String, int32_t>>>& arg);
+  Optional<Vector<std::pair<String, int32_t>>> getNullableStringLongRecord();
 
   Vector<std::pair<String, String>> GetByteStringByteStringRecord();
   void setByteStringByteStringRecord(
@@ -57,7 +57,7 @@
   RecordTest();
 
   Vector<std::pair<String, int32_t>> string_long_record_;
-  Nullable<Vector<std::pair<String, int32_t>>> nullable_string_long_record_;
+  Optional<Vector<std::pair<String, int32_t>>> nullable_string_long_record_;
   Vector<std::pair<String, String>> byte_string_byte_string_record_;
   HeapVector<std::pair<String, Member<Element>>> string_element_record_;
   NestedRecordType usv_string_usv_string_boolean_record_record_;
diff --git a/third_party/WebKit/Source/core/testing/SequenceTest.cpp b/third_party/WebKit/Source/core/testing/SequenceTest.cpp
index eac76157..1359480 100644
--- a/third_party/WebKit/Source/core/testing/SequenceTest.cpp
+++ b/third_party/WebKit/Source/core/testing/SequenceTest.cpp
@@ -30,8 +30,8 @@
   return arg;
 }
 
-Nullable<Vector<uint8_t>> SequenceTest::identityOctetSequenceOrNull(
-    const Nullable<Vector<uint8_t>>& arg) const {
+Optional<Vector<uint8_t>> SequenceTest::identityOctetSequenceOrNull(
+    const Optional<Vector<uint8_t>>& arg) const {
   return arg;
 }
 
diff --git a/third_party/WebKit/Source/core/testing/SequenceTest.h b/third_party/WebKit/Source/core/testing/SequenceTest.h
index 8123b95f..f91c9e14 100644
--- a/third_party/WebKit/Source/core/testing/SequenceTest.h
+++ b/third_party/WebKit/Source/core/testing/SequenceTest.h
@@ -5,11 +5,11 @@
 #ifndef SequenceTest_h
 #define SequenceTest_h
 
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/double_or_double_sequence.h"
 #include "core/dom/Element.h"
 #include "platform/bindings/ScriptWrappable.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 #include "platform/wtf/Vector.h"
 #include "platform/wtf/text/WTFString.h"
 
@@ -27,8 +27,8 @@
   Vector<double> identityDoubleSequence(const Vector<double>& arg) const;
   Vector<String> identityFoodEnumSequence(const Vector<String>& arg) const;
   Vector<int32_t> identityLongSequence(const Vector<int32_t>& arg) const;
-  Nullable<Vector<uint8_t>> identityOctetSequenceOrNull(
-      const Nullable<Vector<uint8_t>>& arg) const;
+  Optional<Vector<uint8_t>> identityOctetSequenceOrNull(
+      const Optional<Vector<uint8_t>>& arg) const;
 
   HeapVector<Member<Element>> getElementSequence() const;
   void setElementSequence(const HeapVector<Member<Element>>& arg);
diff --git a/third_party/WebKit/Source/core/workers/ParentFrameTaskRunners.h b/third_party/WebKit/Source/core/workers/ParentFrameTaskRunners.h
index 91b93390..7d219fd 100644
--- a/third_party/WebKit/Source/core/workers/ParentFrameTaskRunners.h
+++ b/third_party/WebKit/Source/core/workers/ParentFrameTaskRunners.h
@@ -10,6 +10,7 @@
 #include "core/CoreExport.h"
 #include "core/dom/ContextLifecycleObserver.h"
 #include "core/dom/TaskTypeTraits.h"
+#include "platform/WebTaskRunner.h"
 #include "platform/heap/Handle.h"
 #include "platform/wtf/Allocator.h"
 #include "platform/wtf/PtrUtil.h"
@@ -17,7 +18,6 @@
 namespace blink {
 
 class LocalFrame;
-class WebTaskRunner;
 
 // Represents a set of task runners of the parent (or associated) document's
 // frame, or default task runners of the main thread.
diff --git a/third_party/WebKit/Source/core/xml/parser/XMLErrors.cpp b/third_party/WebKit/Source/core/xml/parser/XMLErrors.cpp
index 36069d9..96c0ea03 100644
--- a/third_party/WebKit/Source/core/xml/parser/XMLErrors.cpp
+++ b/third_party/WebKit/Source/core/xml/parser/XMLErrors.cpp
@@ -97,7 +97,7 @@
 static inline Element* CreateXHTMLParserErrorHeader(
     Document* doc,
     const String& error_messages) {
-  Element* report_element = doc->createElement(
+  Element* report_element = doc->CreateRawElement(
       QualifiedName(g_null_atom, "parsererror", xhtmlNamespaceURI),
       kCreatedByParser);
 
@@ -108,12 +108,12 @@
       "1em 0 1em; margin: 1em; background-color: #fdd; color: black"));
   report_element->ParserSetAttributes(report_attributes);
 
-  Element* h3 = doc->createElement(h3Tag, kCreatedByParser);
+  Element* h3 = doc->CreateRawElement(h3Tag, kCreatedByParser);
   report_element->ParserAppendChild(h3);
   h3->ParserAppendChild(
       doc->createTextNode("This page contains the following errors:"));
 
-  Element* fixed = doc->createElement(divTag, kCreatedByParser);
+  Element* fixed = doc->CreateRawElement(divTag, kCreatedByParser);
   Vector<Attribute> fixed_attributes;
   fixed_attributes.push_back(
       Attribute(styleAttr, "font-family:monospace;font-size:12px"));
@@ -122,7 +122,7 @@
 
   fixed->ParserAppendChild(doc->createTextNode(error_messages));
 
-  h3 = doc->createElement(h3Tag, kCreatedByParser);
+  h3 = doc->CreateRawElement(h3Tag, kCreatedByParser);
   report_element->ParserAppendChild(h3);
   h3->ParserAppendChild(doc->createTextNode(
       "Below is a rendering of the page up to the first error."));
@@ -138,22 +138,24 @@
   // Create elements for display
   Element* document_element = document_->documentElement();
   if (!document_element) {
-    Element* root_element = document_->createElement(htmlTag, kCreatedByParser);
-    Element* body = document_->createElement(bodyTag, kCreatedByParser);
+    Element* root_element =
+        document_->CreateRawElement(htmlTag, kCreatedByParser);
+    Element* body = document_->CreateRawElement(bodyTag, kCreatedByParser);
     root_element->ParserAppendChild(body);
     document_->ParserAppendChild(root_element);
     document_element = body;
   } else if (document_element->namespaceURI() == SVGNames::svgNamespaceURI) {
-    Element* root_element = document_->createElement(htmlTag, kCreatedByParser);
-    Element* head = document_->createElement(headTag, kCreatedByParser);
-    Element* style = document_->createElement(styleTag, kCreatedByParser);
+    Element* root_element =
+        document_->CreateRawElement(htmlTag, kCreatedByParser);
+    Element* head = document_->CreateRawElement(headTag, kCreatedByParser);
+    Element* style = document_->CreateRawElement(styleTag, kCreatedByParser);
     head->ParserAppendChild(style);
     style->ParserAppendChild(
         document_->createTextNode("html, body { height: 100% } parsererror + "
                                   "svg { width: 100%; height: 100% }"));
     style->FinishParsingChildren();
     root_element->ParserAppendChild(head);
-    Element* body = document_->createElement(bodyTag, kCreatedByParser);
+    Element* body = document_->CreateRawElement(bodyTag, kCreatedByParser);
     root_element->ParserAppendChild(body);
 
     document_->ParserRemoveChild(*document_element);
@@ -171,7 +173,7 @@
   if (DocumentXSLT::HasTransformSourceDocument(*document_)) {
     Vector<Attribute> attributes;
     attributes.push_back(Attribute(styleAttr, "white-space: normal"));
-    Element* paragraph = document_->createElement(pTag, kCreatedByParser);
+    Element* paragraph = document_->CreateRawElement(pTag, kCreatedByParser);
     paragraph->ParserSetAttributes(attributes);
     paragraph->ParserAppendChild(document_->createTextNode(
         "This document was created as the result of an XSL transformation. The "
diff --git a/third_party/WebKit/Source/modules/BUILD.gn b/third_party/WebKit/Source/modules/BUILD.gn
index 2454cd6..a5aa683 100644
--- a/third_party/WebKit/Source/modules/BUILD.gn
+++ b/third_party/WebKit/Source/modules/BUILD.gn
@@ -297,6 +297,7 @@
     "push_messaging/PushMessageDataTest.cpp",
     "push_messaging/PushSubscriptionTest.cpp",
     "remoteplayback/RemotePlaybackTest.cpp",
+    "screen_orientation/ScreenOrientationDelegateTest.cpp",
     "serviceworkers/ServiceWorkerContainerTest.cpp",
     "serviceworkers/WebEmbeddedWorkerImplTest.cpp",
     "wake_lock/ScreenWakeLockTest.cpp",
@@ -323,6 +324,7 @@
   deps = [
     ":modules",
     ":modules_testing",
+    "//device/screen_orientation/public/interfaces:interfaces_blink",
     "//skia",
     "//testing/gmock",
     "//testing/gtest",
diff --git a/third_party/WebKit/Source/modules/ModulesInitializer.cpp b/third_party/WebKit/Source/modules/ModulesInitializer.cpp
index 735469f..ed94529 100644
--- a/third_party/WebKit/Source/modules/ModulesInitializer.cpp
+++ b/third_party/WebKit/Source/modules/ModulesInitializer.cpp
@@ -82,6 +82,7 @@
 #include "modules/webdatabase/WebDatabaseImpl.h"
 #include "modules/webgl/WebGL2RenderingContext.h"
 #include "modules/webgl/WebGLRenderingContext.h"
+#include "modules/xr/XRPresentationContext.h"
 #include "platform/CrossThreadFunctional.h"
 #include "platform/mojo/MojoHelper.h"
 #include "platform/wtf/Functional.h"
@@ -126,6 +127,8 @@
       std::make_unique<WebGL2RenderingContext::Factory>());
   HTMLCanvasElement::RegisterRenderingContextFactory(
       std::make_unique<ImageBitmapRenderingContext::Factory>());
+  HTMLCanvasElement::RegisterRenderingContextFactory(
+      std::make_unique<XRPresentationContext::Factory>());
 
   // OffscreenCanvas context types must be registered with the OffscreenCanvas.
   OffscreenCanvas::RegisterRenderingContextFactory(
@@ -165,8 +168,7 @@
       *frame.DomWindow()->navigator(),
       NavigatorContentUtilsClient::Create(web_frame));
 
-  ScreenOrientationControllerImpl::ProvideTo(
-      frame, client->GetWebScreenOrientationClient());
+  ScreenOrientationControllerImpl::ProvideTo(frame);
   if (RuntimeEnabledFeatures::PresentationEnabled())
     PresentationController::ProvideTo(frame, client->PresentationClient());
   if (RuntimeEnabledFeatures::AudioOutputDevicesEnabled()) {
diff --git a/third_party/WebKit/Source/modules/canvas/BUILD.gn b/third_party/WebKit/Source/modules/canvas/BUILD.gn
index 4a32f42..bf252f5a 100644
--- a/third_party/WebKit/Source/modules/canvas/BUILD.gn
+++ b/third_party/WebKit/Source/modules/canvas/BUILD.gn
@@ -29,6 +29,8 @@
     "htmlcanvas/HTMLCanvasElementModule.h",
     "imagebitmap/ImageBitmapRenderingContext.cpp",
     "imagebitmap/ImageBitmapRenderingContext.h",
+    "imagebitmap/ImageBitmapRenderingContextBase.cpp",
+    "imagebitmap/ImageBitmapRenderingContextBase.h",
     "offscreencanvas/OffscreenCanvasModule.cpp",
     "offscreencanvas/OffscreenCanvasModule.h",
     "offscreencanvas2d/OffscreenCanvasRenderingContext2D.cpp",
diff --git a/third_party/WebKit/Source/modules/canvas/htmlcanvas/HTMLCanvasElementModule.idl b/third_party/WebKit/Source/modules/canvas/htmlcanvas/HTMLCanvasElementModule.idl
index 6bdc7c6..b60a5fa 100644
--- a/third_party/WebKit/Source/modules/canvas/htmlcanvas/HTMLCanvasElementModule.idl
+++ b/third_party/WebKit/Source/modules/canvas/htmlcanvas/HTMLCanvasElementModule.idl
@@ -7,7 +7,8 @@
 typedef (CanvasRenderingContext2D or
          WebGLRenderingContext or
          WebGL2RenderingContext or
-         ImageBitmapRenderingContext) RenderingContext;
+         ImageBitmapRenderingContext or
+         XRPresentationContext) RenderingContext;
 
 [
     ImplementedAs=HTMLCanvasElementModule
diff --git a/third_party/WebKit/Source/modules/canvas/imagebitmap/ImageBitmapRenderingContext.cpp b/third_party/WebKit/Source/modules/canvas/imagebitmap/ImageBitmapRenderingContext.cpp
index f4611d12..611604cc 100644
--- a/third_party/WebKit/Source/modules/canvas/imagebitmap/ImageBitmapRenderingContext.cpp
+++ b/third_party/WebKit/Source/modules/canvas/imagebitmap/ImageBitmapRenderingContext.cpp
@@ -6,20 +6,14 @@
 
 #include "bindings/modules/v8/rendering_context.h"
 #include "core/imagebitmap/ImageBitmap.h"
-#include "platform/graphics/GraphicsContext.h"
 #include "platform/graphics/StaticBitmapImage.h"
-#include "platform/graphics/gpu/ImageLayerBridge.h"
-#include "third_party/skia/include/core/SkImage.h"
-#include "third_party/skia/include/core/SkSurface.h"
 
 namespace blink {
 
 ImageBitmapRenderingContext::ImageBitmapRenderingContext(
     CanvasRenderingContextHost* host,
     const CanvasContextCreationAttributes& attrs)
-    : CanvasRenderingContext(host, attrs),
-      image_layer_bridge_(
-          new ImageLayerBridge(attrs.alpha() ? kNonOpaque : kOpaque)) {}
+    : ImageBitmapRenderingContextBase(host, attrs) {}
 
 ImageBitmapRenderingContext::~ImageBitmapRenderingContext() = default;
 
@@ -37,13 +31,7 @@
     return;
   }
 
-  image_layer_bridge_->SetImage(image_bitmap ? image_bitmap->BitmapImage()
-                                             : nullptr);
-
-  DidDraw();
-
-  if (image_bitmap)
-    image_bitmap->close();
+  SetImage(image_bitmap);
 }
 
 CanvasRenderingContext* ImageBitmapRenderingContext::Factory::Create(
@@ -54,30 +42,4 @@
   return new ImageBitmapRenderingContext(host, attrs);
 }
 
-void ImageBitmapRenderingContext::Stop() {
-  image_layer_bridge_->Dispose();
-}
-
-scoped_refptr<StaticBitmapImage> ImageBitmapRenderingContext::GetImage(
-    AccelerationHint) const {
-  return image_layer_bridge_->GetImage();
-}
-
-WebLayer* ImageBitmapRenderingContext::PlatformLayer() const {
-  return image_layer_bridge_->PlatformLayer();
-}
-
-bool ImageBitmapRenderingContext::IsPaintable() const {
-  return !!image_layer_bridge_->GetImage();
-}
-
-void ImageBitmapRenderingContext::Trace(blink::Visitor* visitor) {
-  visitor->Trace(image_layer_bridge_);
-  CanvasRenderingContext::Trace(visitor);
-}
-
-bool ImageBitmapRenderingContext::IsAccelerated() const {
-  return image_layer_bridge_->IsAccelerated();
-}
-
 }  // namespace blink
diff --git a/third_party/WebKit/Source/modules/canvas/imagebitmap/ImageBitmapRenderingContext.h b/third_party/WebKit/Source/modules/canvas/imagebitmap/ImageBitmapRenderingContext.h
index ce19434a..f6bb5b3 100644
--- a/third_party/WebKit/Source/modules/canvas/imagebitmap/ImageBitmapRenderingContext.h
+++ b/third_party/WebKit/Source/modules/canvas/imagebitmap/ImageBitmapRenderingContext.h
@@ -6,17 +6,16 @@
 #define ImageBitmapRenderingContext_h
 
 #include "base/memory/scoped_refptr.h"
-#include "core/html/canvas/CanvasRenderingContext.h"
 #include "core/html/canvas/CanvasRenderingContextFactory.h"
 #include "modules/ModulesExport.h"
+#include "modules/canvas/imagebitmap/ImageBitmapRenderingContextBase.h"
 
 namespace blink {
 
 class ImageBitmap;
-class ImageLayerBridge;
 
 class MODULES_EXPORT ImageBitmapRenderingContext final
-    : public CanvasRenderingContext {
+    : public ImageBitmapRenderingContextBase {
   DEFINE_WRAPPERTYPEINFO();
 
  public:
@@ -35,42 +34,21 @@
     }
   };
 
-  void Trace(blink::Visitor*);
-
   // Script API
   void transferFromImageBitmap(ImageBitmap*, ExceptionState&);
 
-  HTMLCanvasElement* canvas() {
-    DCHECK(!Host() || !Host()->IsOffscreenCanvas());
-    return static_cast<HTMLCanvasElement*>(Host());
-  }
-
   // CanvasRenderingContext implementation
   ContextType GetContextType() const override {
     return CanvasRenderingContext::kContextImageBitmap;
   }
-  void SetIsHidden(bool) override {}
-  bool isContextLost() const override { return false; }
+
   void SetCanvasGetContextResult(RenderingContext&) final;
-  scoped_refptr<StaticBitmapImage> GetImage(AccelerationHint) const final;
-  bool IsComposited() const final { return true; }
-  bool IsAccelerated() const final;
-
-  WebLayer* PlatformLayer() const final;
-  // TODO(junov): handle lost contexts when content is GPU-backed
-  void LoseContext(LostContextMode) override {}
-
-  void Stop() override;
-
-  bool IsPaintable() const final;
 
   virtual ~ImageBitmapRenderingContext();
 
  private:
   ImageBitmapRenderingContext(CanvasRenderingContextHost*,
                               const CanvasContextCreationAttributes&);
-
-  Member<ImageLayerBridge> image_layer_bridge_;
 };
 
 DEFINE_TYPE_CASTS(ImageBitmapRenderingContext,
diff --git a/third_party/WebKit/Source/modules/canvas/imagebitmap/ImageBitmapRenderingContextBase.cpp b/third_party/WebKit/Source/modules/canvas/imagebitmap/ImageBitmapRenderingContextBase.cpp
new file mode 100644
index 0000000..6ddf07e
--- /dev/null
+++ b/third_party/WebKit/Source/modules/canvas/imagebitmap/ImageBitmapRenderingContextBase.cpp
@@ -0,0 +1,64 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "modules/canvas/imagebitmap/ImageBitmapRenderingContextBase.h"
+
+#include "bindings/modules/v8/rendering_context.h"
+#include "core/imagebitmap/ImageBitmap.h"
+#include "platform/graphics/GraphicsContext.h"
+#include "platform/graphics/StaticBitmapImage.h"
+#include "platform/graphics/gpu/ImageLayerBridge.h"
+#include "third_party/skia/include/core/SkImage.h"
+#include "third_party/skia/include/core/SkSurface.h"
+
+namespace blink {
+
+ImageBitmapRenderingContextBase::ImageBitmapRenderingContextBase(
+    CanvasRenderingContextHost* host,
+    const CanvasContextCreationAttributes& attrs)
+    : CanvasRenderingContext(host, attrs),
+      image_layer_bridge_(
+          new ImageLayerBridge(attrs.alpha() ? kNonOpaque : kOpaque)) {}
+
+ImageBitmapRenderingContextBase::~ImageBitmapRenderingContextBase() = default;
+
+void ImageBitmapRenderingContextBase::Stop() {
+  image_layer_bridge_->Dispose();
+}
+
+void ImageBitmapRenderingContextBase::SetImage(ImageBitmap* image_bitmap) {
+  DCHECK(!image_bitmap || !image_bitmap->IsNeutered());
+
+  image_layer_bridge_->SetImage(image_bitmap ? image_bitmap->BitmapImage()
+                                             : nullptr);
+
+  DidDraw();
+
+  if (image_bitmap)
+    image_bitmap->close();
+}
+
+scoped_refptr<StaticBitmapImage> ImageBitmapRenderingContextBase::GetImage(
+    AccelerationHint) const {
+  return image_layer_bridge_->GetImage();
+}
+
+WebLayer* ImageBitmapRenderingContextBase::PlatformLayer() const {
+  return image_layer_bridge_->PlatformLayer();
+}
+
+bool ImageBitmapRenderingContextBase::IsPaintable() const {
+  return !!image_layer_bridge_->GetImage();
+}
+
+void ImageBitmapRenderingContextBase::Trace(blink::Visitor* visitor) {
+  visitor->Trace(image_layer_bridge_);
+  CanvasRenderingContext::Trace(visitor);
+}
+
+bool ImageBitmapRenderingContextBase::IsAccelerated() const {
+  return image_layer_bridge_->IsAccelerated();
+}
+
+}  // namespace blink
diff --git a/third_party/WebKit/Source/modules/canvas/imagebitmap/ImageBitmapRenderingContextBase.h b/third_party/WebKit/Source/modules/canvas/imagebitmap/ImageBitmapRenderingContextBase.h
new file mode 100644
index 0000000..4c1db86
--- /dev/null
+++ b/third_party/WebKit/Source/modules/canvas/imagebitmap/ImageBitmapRenderingContextBase.h
@@ -0,0 +1,53 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef ImageBitmapRenderingContextBase_h
+#define ImageBitmapRenderingContextBase_h
+
+#include "base/memory/scoped_refptr.h"
+#include "core/html/canvas/CanvasRenderingContext.h"
+#include "core/html/canvas/CanvasRenderingContextFactory.h"
+#include "modules/ModulesExport.h"
+
+namespace blink {
+
+class ImageBitmap;
+class ImageLayerBridge;
+
+class MODULES_EXPORT ImageBitmapRenderingContextBase
+    : public CanvasRenderingContext {
+ public:
+  ImageBitmapRenderingContextBase(CanvasRenderingContextHost*,
+                                  const CanvasContextCreationAttributes&);
+  virtual ~ImageBitmapRenderingContextBase();
+
+  void Trace(blink::Visitor*);
+
+  HTMLCanvasElement* canvas() {
+    DCHECK(!Host() || !Host()->IsOffscreenCanvas());
+    return static_cast<HTMLCanvasElement*>(Host());
+  }
+
+  void SetIsHidden(bool) override {}
+  bool isContextLost() const override { return false; }
+  void SetImage(ImageBitmap*);
+  scoped_refptr<StaticBitmapImage> GetImage(AccelerationHint) const final;
+  bool IsComposited() const final { return true; }
+  bool IsAccelerated() const final;
+
+  WebLayer* PlatformLayer() const final;
+  // TODO(junov): handle lost contexts when content is GPU-backed
+  void LoseContext(LostContextMode) override {}
+
+  void Stop() override;
+
+  bool IsPaintable() const final;
+
+ protected:
+  Member<ImageLayerBridge> image_layer_bridge_;
+};
+
+}  // namespace blink
+
+#endif
diff --git a/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationData.cpp b/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationData.cpp
index c1ba78e..3425d2fc 100644
--- a/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationData.cpp
+++ b/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationData.cpp
@@ -35,18 +35,18 @@
 }
 
 DeviceOrientationData* DeviceOrientationData::Create(
-    const Nullable<double>& alpha,
-    const Nullable<double>& beta,
-    const Nullable<double>& gamma,
+    const Optional<double>& alpha,
+    const Optional<double>& beta,
+    const Optional<double>& gamma,
     bool absolute) {
   return new DeviceOrientationData(alpha, beta, gamma, absolute);
 }
 
 DeviceOrientationData* DeviceOrientationData::Create(
     const DeviceOrientationEventInit& init) {
-  Nullable<double> alpha;
-  Nullable<double> beta;
-  Nullable<double> gamma;
+  Optional<double> alpha;
+  Optional<double> beta;
+  Optional<double> gamma;
   if (init.hasAlpha())
     alpha = init.alpha();
   if (init.hasBeta())
@@ -58,9 +58,9 @@
 
 DeviceOrientationData* DeviceOrientationData::Create(
     const device::OrientationData& data) {
-  Nullable<double> alpha;
-  Nullable<double> beta;
-  Nullable<double> gamma;
+  Optional<double> alpha;
+  Optional<double> beta;
+  Optional<double> gamma;
   if (data.has_alpha)
     alpha = data.alpha;
   if (data.has_beta)
@@ -72,22 +72,22 @@
 
 DeviceOrientationData::DeviceOrientationData() : absolute_(false) {}
 
-DeviceOrientationData::DeviceOrientationData(const Nullable<double>& alpha,
-                                             const Nullable<double>& beta,
-                                             const Nullable<double>& gamma,
+DeviceOrientationData::DeviceOrientationData(const Optional<double>& alpha,
+                                             const Optional<double>& beta,
+                                             const Optional<double>& gamma,
                                              bool absolute)
     : alpha_(alpha), beta_(beta), gamma_(gamma), absolute_(absolute) {}
 
 double DeviceOrientationData::Alpha() const {
-  return alpha_.Get();
+  return alpha_.value();
 }
 
 double DeviceOrientationData::Beta() const {
-  return beta_.Get();
+  return beta_.value();
 }
 
 double DeviceOrientationData::Gamma() const {
-  return gamma_.Get();
+  return gamma_.value();
 }
 
 bool DeviceOrientationData::Absolute() const {
@@ -95,15 +95,15 @@
 }
 
 bool DeviceOrientationData::CanProvideAlpha() const {
-  return !alpha_.IsNull();
+  return alpha_.has_value();
 }
 
 bool DeviceOrientationData::CanProvideBeta() const {
-  return !beta_.IsNull();
+  return beta_.has_value();
 }
 
 bool DeviceOrientationData::CanProvideGamma() const {
-  return !gamma_.IsNull();
+  return gamma_.has_value();
 }
 
 bool DeviceOrientationData::CanProvideEventData() const {
diff --git a/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationData.h b/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationData.h
index 8c4acba..8c4f1f0 100644
--- a/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationData.h
+++ b/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationData.h
@@ -26,9 +26,9 @@
 #ifndef DeviceOrientationData_h
 #define DeviceOrientationData_h
 
-#include "bindings/core/v8/Nullable.h"
 #include "modules/ModulesExport.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace device {
 class OrientationData;
@@ -42,9 +42,9 @@
     : public GarbageCollected<DeviceOrientationData> {
  public:
   static DeviceOrientationData* Create();
-  static DeviceOrientationData* Create(const Nullable<double>& alpha,
-                                       const Nullable<double>& beta,
-                                       const Nullable<double>& gamma,
+  static DeviceOrientationData* Create(const Optional<double>& alpha,
+                                       const Optional<double>& beta,
+                                       const Optional<double>& gamma,
                                        bool absolute);
   static DeviceOrientationData* Create(const DeviceOrientationEventInit&);
   static DeviceOrientationData* Create(const device::OrientationData&);
@@ -62,14 +62,14 @@
 
  private:
   DeviceOrientationData();
-  DeviceOrientationData(const Nullable<double>& alpha,
-                        const Nullable<double>& beta,
-                        const Nullable<double>& gamma,
+  DeviceOrientationData(const Optional<double>& alpha,
+                        const Optional<double>& beta,
+                        const Optional<double>& gamma,
                         bool absolute);
 
-  Nullable<double> alpha_;
-  Nullable<double> beta_;
-  Nullable<double> gamma_;
+  Optional<double> alpha_;
+  Optional<double> beta_;
+  Optional<double> gamma_;
   bool absolute_;
 };
 
diff --git a/third_party/WebKit/Source/modules/geolocation/Geolocation.cpp b/third_party/WebKit/Source/modules/geolocation/Geolocation.cpp
index a72a2c1..9dc71a9 100644
--- a/third_party/WebKit/Source/modules/geolocation/Geolocation.cpp
+++ b/third_party/WebKit/Source/modules/geolocation/Geolocation.cpp
@@ -140,7 +140,6 @@
 }
 
 void Geolocation::ContextDestroyed(ExecutionContext*) {
-  geolocation_service_.reset();
   CancelAllRequests();
   StopUpdating();
   last_position_ = nullptr;
@@ -484,10 +483,12 @@
   if (geolocation_)
     return;
 
+  InterfaceInvalidator* invalidator =
+      GetExecutionContext()->GetInterfaceInvalidator();
   GetFrame()->GetInterfaceProvider().GetInterface(
-      mojo::MakeRequest(&geolocation_service_));
+      MakeRequest(&geolocation_service_, invalidator));
   geolocation_service_->CreateGeolocation(
-      mojo::MakeRequest(&geolocation_),
+      MakeRequest(&geolocation_, invalidator),
       Frame::HasTransientUserActivation(GetFrame()));
 
   geolocation_.set_connection_error_handler(WTF::Bind(
@@ -520,6 +521,10 @@
   UpdateGeolocationConnection();
 }
 
+bool Geolocation::HasPendingActivity() const {
+  return !one_shots_.IsEmpty() || !one_shots_being_invoked_.IsEmpty();
+}
+
 void Geolocation::OnGeolocationConnectionError() {
   StopUpdating();
   // The only reason that we would fail to get a ConnectionError is if we lack
diff --git a/third_party/WebKit/Source/modules/geolocation/Geolocation.h b/third_party/WebKit/Source/modules/geolocation/Geolocation.h
index 8bdddb6..a6fd82df 100644
--- a/third_party/WebKit/Source/modules/geolocation/Geolocation.h
+++ b/third_party/WebKit/Source/modules/geolocation/Geolocation.h
@@ -49,9 +49,11 @@
 class LocalFrame;
 class ExecutionContext;
 
-class MODULES_EXPORT Geolocation final : public ScriptWrappable,
-                                         public ContextLifecycleObserver,
-                                         public PageVisibilityObserver {
+class MODULES_EXPORT Geolocation final
+    : public ScriptWrappable,
+      public ActiveScriptWrappable<Geolocation>,
+      public ContextLifecycleObserver,
+      public PageVisibilityObserver {
   DEFINE_WRAPPERTYPEINFO();
   USING_GARBAGE_COLLECTED_MIXIN(Geolocation);
 
@@ -100,6 +102,10 @@
   // Inherited from PageVisibilityObserver.
   void PageVisibilityChanged() override;
 
+  // TODO(yukishiino): This is a short-term speculative fix for
+  // crbug.com/792604. Remove this once the bug is fixed.
+  bool HasPendingActivity() const final;
+
  private:
   explicit Geolocation(ExecutionContext*);
 
@@ -184,8 +190,8 @@
   GeolocationWatchers watchers_being_invoked_;
   Member<Geoposition> last_position_;
 
-  device::mojom::blink::GeolocationPtr geolocation_;
-  mojom::blink::GeolocationServicePtr geolocation_service_;
+  device::mojom::blink::WeakGeolocationPtr geolocation_;
+  mojom::blink::WeakGeolocationServicePtr geolocation_service_;
   bool enable_high_accuracy_ = false;
 
   // Whether a GeoNotifier is waiting for a position update.
diff --git a/third_party/WebKit/Source/modules/geolocation/Geolocation.idl b/third_party/WebKit/Source/modules/geolocation/Geolocation.idl
index 883eb58..5ec809a 100644
--- a/third_party/WebKit/Source/modules/geolocation/Geolocation.idl
+++ b/third_party/WebKit/Source/modules/geolocation/Geolocation.idl
@@ -25,6 +25,7 @@
 
 // https://www.w3.org/TR/geolocation-API/#geolocation_interface
 [
+    ActiveScriptWrappable,
     NoInterfaceObject
 ] interface Geolocation {
     [
diff --git a/third_party/WebKit/Source/modules/indexeddb/IDBDatabase.cpp b/third_party/WebKit/Source/modules/indexeddb/IDBDatabase.cpp
index d79d8e21..cd4a379 100644
--- a/third_party/WebKit/Source/modules/indexeddb/IDBDatabase.cpp
+++ b/third_party/WebKit/Source/modules/indexeddb/IDBDatabase.cpp
@@ -26,7 +26,6 @@
 #include "modules/indexeddb/IDBDatabase.h"
 
 #include "bindings/core/v8/ExceptionState.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/serialization/SerializedScriptValue.h"
 #include "bindings/modules/v8/V8BindingForModules.h"
 #include "bindings/modules/v8/v8_idb_observer_callback.h"
@@ -45,6 +44,7 @@
 #include "platform/Histogram.h"
 #include "platform/wtf/Assertions.h"
 #include "platform/wtf/Atomics.h"
+#include "platform/wtf/Optional.h"
 #include "public/platform/modules/indexeddb/WebIDBDatabaseCallbacks.h"
 #include "public/platform/modules/indexeddb/WebIDBDatabaseException.h"
 #include "public/platform/modules/indexeddb/WebIDBKeyPath.h"
@@ -492,10 +492,10 @@
     return;
   }
 
-  Nullable<unsigned long long> new_version_nullable =
-      (new_version == IDBDatabaseMetadata::kNoVersion)
-          ? Nullable<unsigned long long>()
-          : Nullable<unsigned long long>(new_version);
+  Optional<unsigned long long> new_version_nullable;
+  if (new_version != IDBDatabaseMetadata::kNoVersion) {
+    new_version_nullable = new_version;
+  }
   EnqueueEvent(IDBVersionChangeEvent::Create(
       EventTypeNames::versionchange, old_version, new_version_nullable));
 }
diff --git a/third_party/WebKit/Source/modules/indexeddb/IDBOpenDBRequest.cpp b/third_party/WebKit/Source/modules/indexeddb/IDBOpenDBRequest.cpp
index f354fd8..b0b922d 100644
--- a/third_party/WebKit/Source/modules/indexeddb/IDBOpenDBRequest.cpp
+++ b/third_party/WebKit/Source/modules/indexeddb/IDBOpenDBRequest.cpp
@@ -26,7 +26,6 @@
 #include "modules/indexeddb/IDBOpenDBRequest.h"
 
 #include <memory>
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/modules/v8/idb_object_store_or_idb_index_or_idb_cursor.h"
 #include "core/dom/DOMException.h"
 #include "core/dom/ExceptionCode.h"
@@ -35,6 +34,7 @@
 #include "modules/indexeddb/IDBDatabaseCallbacks.h"
 #include "modules/indexeddb/IDBTracing.h"
 #include "modules/indexeddb/IDBVersionChangeEvent.h"
+#include "platform/wtf/Optional.h"
 
 using blink::WebIDBDatabase;
 
@@ -88,10 +88,10 @@
   IDB_TRACE("IDBOpenDBRequest::onBlocked()");
   if (!ShouldEnqueueEvent())
     return;
-  Nullable<unsigned long long> new_version_nullable =
-      (version_ == IDBDatabaseMetadata::kDefaultVersion)
-          ? Nullable<unsigned long long>()
-          : Nullable<unsigned long long>(version_);
+  Optional<unsigned long long> new_version_nullable;
+  if (version_ != IDBDatabaseMetadata::kDefaultVersion) {
+    new_version_nullable = version_;
+  }
   EnqueueEvent(IDBVersionChangeEvent::Create(
       EventTypeNames::blocked, old_version, new_version_nullable));
 }
@@ -173,8 +173,8 @@
     old_version = IDBDatabaseMetadata::kDefaultVersion;
   }
   SetResult(IDBAny::CreateUndefined());
-  EnqueueEvent(IDBVersionChangeEvent::Create(
-      EventTypeNames::success, old_version, Nullable<unsigned long long>()));
+  EnqueueEvent(IDBVersionChangeEvent::Create(EventTypeNames::success,
+                                             old_version, WTF::nullopt));
   metrics_.RecordAndReset();
 }
 
diff --git a/third_party/WebKit/Source/modules/indexeddb/IDBVersionChangeEvent.cpp b/third_party/WebKit/Source/modules/indexeddb/IDBVersionChangeEvent.cpp
index 370ecf26..9e603b6 100644
--- a/third_party/WebKit/Source/modules/indexeddb/IDBVersionChangeEvent.cpp
+++ b/third_party/WebKit/Source/modules/indexeddb/IDBVersionChangeEvent.cpp
@@ -35,7 +35,7 @@
 IDBVersionChangeEvent::IDBVersionChangeEvent(
     const AtomicString& event_type,
     unsigned long long old_version,
-    const Nullable<unsigned long long>& new_version,
+    const Optional<unsigned long long>& new_version,
     WebIDBDataLoss data_loss,
     const String& data_loss_message)
     : Event(event_type, /*can_bubble=*/false, /*cancelable=*/false),
@@ -49,7 +49,6 @@
     const IDBVersionChangeEventInit& initializer)
     : Event(event_type, /*can_bubble=*/false, /*cancelable=*/false),
       old_version_(initializer.oldVersion()),
-      new_version_(nullptr),
       data_loss_(kWebIDBDataLossNone) {
   if (initializer.hasNewVersion())
     new_version_ = initializer.newVersion();
@@ -58,8 +57,8 @@
 }
 
 unsigned long long IDBVersionChangeEvent::newVersion(bool& is_null) const {
-  is_null = new_version_.IsNull();
-  return is_null ? 0 : new_version_.Get();
+  is_null = !new_version_.has_value();
+  return new_version_.value_or(0);
 }
 
 const AtomicString& IDBVersionChangeEvent::dataLoss() const {
diff --git a/third_party/WebKit/Source/modules/indexeddb/IDBVersionChangeEvent.h b/third_party/WebKit/Source/modules/indexeddb/IDBVersionChangeEvent.h
index 961a652..d4b149e 100644
--- a/third_party/WebKit/Source/modules/indexeddb/IDBVersionChangeEvent.h
+++ b/third_party/WebKit/Source/modules/indexeddb/IDBVersionChangeEvent.h
@@ -26,12 +26,12 @@
 #ifndef IDBVersionChangeEvent_h
 #define IDBVersionChangeEvent_h
 
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/serialization/SerializedScriptValue.h"
 #include "modules/EventModules.h"
 #include "modules/indexeddb/IDBAny.h"
 #include "modules/indexeddb/IDBRequest.h"
 #include "modules/indexeddb/IDBVersionChangeEventInit.h"
+#include "platform/wtf/Optional.h"
 #include "platform/wtf/text/WTFString.h"
 #include "public/platform/modules/indexeddb/WebIDBTypes.h"
 
@@ -45,7 +45,7 @@
   static IDBVersionChangeEvent* Create(
       const AtomicString& event_type,
       unsigned long long old_version,
-      const Nullable<unsigned long long>& new_version,
+      const Optional<unsigned long long>& new_version,
       WebIDBDataLoss data_loss = kWebIDBDataLossNone,
       const String& data_loss_message = String()) {
     return new IDBVersionChangeEvent(event_type, old_version, new_version,
@@ -71,14 +71,14 @@
   IDBVersionChangeEvent();
   IDBVersionChangeEvent(const AtomicString& event_type,
                         unsigned long long old_version,
-                        const Nullable<unsigned long long>& new_version,
+                        const Optional<unsigned long long>& new_version,
                         WebIDBDataLoss,
                         const String& data_loss);
   IDBVersionChangeEvent(const AtomicString& event_type,
                         const IDBVersionChangeEventInit&);
 
   unsigned long long old_version_;
-  Nullable<unsigned long long> new_version_;
+  Optional<unsigned long long> new_version_;
   WebIDBDataLoss data_loss_;
   String data_loss_message_;
 };
diff --git a/third_party/WebKit/Source/modules/media_controls/DEPS b/third_party/WebKit/Source/modules/media_controls/DEPS
index 0c00cbb..024ed38 100644
--- a/third_party/WebKit/Source/modules/media_controls/DEPS
+++ b/third_party/WebKit/Source/modules/media_controls/DEPS
@@ -7,6 +7,7 @@
   "+modules/media_controls",
   "+modules/remoteplayback",
   "+modules/screen_orientation",
+  "+mojo/public/cpp/bindings",
   "+services/device/public/interfaces/constants.mojom-blink.h",
   "+services/service_manager/public/cpp",
 ]
diff --git a/third_party/WebKit/Source/modules/media_controls/MediaControlsOrientationLockDelegateTest.cpp b/third_party/WebKit/Source/modules/media_controls/MediaControlsOrientationLockDelegateTest.cpp
index 3d4b041..af8d725 100644
--- a/third_party/WebKit/Source/modules/media_controls/MediaControlsOrientationLockDelegateTest.cpp
+++ b/third_party/WebKit/Source/modules/media_controls/MediaControlsOrientationLockDelegateTest.cpp
@@ -17,10 +17,13 @@
 #include "core/html_names.h"
 #include "core/loader/EmptyClients.h"
 #include "core/testing/PageTestBase.h"
+#include "device/screen_orientation/public/interfaces/screen_orientation.mojom-blink.h"
 #include "modules/device_orientation/DeviceOrientationController.h"
 #include "modules/device_orientation/DeviceOrientationData.h"
 #include "modules/media_controls/MediaControlsImpl.h"
 #include "modules/screen_orientation/ScreenOrientationControllerImpl.h"
+#include "mojo/public/cpp/bindings/associated_binding.h"
+#include "mojo/public/cpp/bindings/associated_interface_ptr.h"
 #include "platform/LayoutTestSupport.h"
 #include "platform/geometry/IntRect.h"
 #include "platform/testing/EmptyWebMediaPlayer.h"
@@ -28,7 +31,6 @@
 #include "platform/testing/UnitTestHelpers.h"
 #include "public/platform/WebSize.h"
 #include "public/platform/modules/screen_orientation/WebLockOrientationCallback.h"
-#include "public/platform/modules/screen_orientation/WebScreenOrientationClient.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -56,16 +58,32 @@
   MOCK_CONST_METHOD0(NaturalSize, WebSize());
 };
 
-class MockWebScreenOrientationClient final : public WebScreenOrientationClient {
+class MockScreenOrientation final
+    : public device::mojom::blink::ScreenOrientation {
  public:
-  // WebScreenOrientationClient overrides:
+  MockScreenOrientation() : binding_(this) {}
+
+  // device::mojom::blink::ScreenOrientation overrides:
   void LockOrientation(WebScreenOrientationLockType type,
-                       std::unique_ptr<WebLockOrientationCallback>) override {
+                       LockOrientationCallback callback) override {
+    std::move(callback).Run(device::mojom::ScreenOrientationLockResult::
+                                SCREEN_ORIENTATION_LOCK_RESULT_SUCCESS);
     LockOrientation(type);
   }
+
+  void BindRequest(
+      device::mojom::blink::ScreenOrientationAssociatedRequest request) {
+    binding_.Bind(std::move(request));
+  }
+
+  void Close() { binding_.Close(); }
+
   MOCK_METHOD0(UnlockOrientation, void());
 
   MOCK_METHOD1(LockOrientation, void(WebScreenOrientationLockType));
+
+ private:
+  mojo::AssociatedBinding<device::mojom::blink::ScreenOrientation> binding_;
 };
 
 void DidEnterFullscreen(Document* document) {
@@ -86,8 +104,13 @@
   // ChromeClient overrides:
   void InstallSupplements(LocalFrame& frame) override {
     EmptyChromeClient::InstallSupplements(frame);
-    ScreenOrientationControllerImpl::ProvideTo(frame,
-                                               &web_screen_orientation_client_);
+    ScreenOrientationControllerImpl::ProvideTo(frame);
+    device::mojom::blink::ScreenOrientationAssociatedPtr screen_orientation;
+    ScreenOrientationClient().BindRequest(
+        mojo::MakeRequestAssociatedWithDedicatedPipe(&screen_orientation));
+    ScreenOrientationControllerImpl::From(frame)
+        ->SetScreenOrientationAssociatedPtrForTests(
+            std::move(screen_orientation));
   }
   // The real ChromeClient::EnterFullscreen/ExitFullscreen implementation is
   // async due to IPC, emulate that by posting tasks:
@@ -104,12 +127,12 @@
 
   MOCK_CONST_METHOD0(GetScreenInfo, WebScreenInfo());
 
-  MockWebScreenOrientationClient& WebScreenOrientationClient() {
-    return web_screen_orientation_client_;
+  MockScreenOrientation& ScreenOrientationClient() {
+    return mock_screen_orientation_;
   }
 
  private:
-  MockWebScreenOrientationClient web_screen_orientation_client_;
+  MockScreenOrientation mock_screen_orientation_;
 };
 
 class StubLocalFrameClientForOrientationLockDelegate final
@@ -169,6 +192,7 @@
 
   void TearDown() override {
     ::testing::Mock::VerifyAndClear(&ScreenOrientationClient());
+    ScreenOrientationClient().Close();
   }
 
   static bool HasDelegate(const MediaControls& media_controls) {
@@ -243,8 +267,8 @@
   }
 
   HTMLVideoElement& Video() const { return *video_; }
-  MockWebScreenOrientationClient& ScreenOrientationClient() const {
-    return ChromeClient().WebScreenOrientationClient();
+  MockScreenOrientation& ScreenOrientationClient() const {
+    return ChromeClient().ScreenOrientationClient();
   }
   MockWebMediaPlayerForOrientationLockDelegate& MockWebMediaPlayer() const {
     return *static_cast<MockWebMediaPlayerForOrientationLockDelegate*>(
@@ -473,6 +497,7 @@
 TEST_F(MediaControlsOrientationLockDelegateTest, EnterFullscreenAfterPageLock) {
   SimulateVideoReadyState(HTMLMediaElement::kHaveMetadata);
   SimulateOrientationLock();
+  testing::RunPendingTasks();
 
   EXPECT_FALSE(DelegateWillUnlockFullscreen());
   EXPECT_CALL(ScreenOrientationClient(), LockOrientation(_)).Times(0);
@@ -486,6 +511,7 @@
 TEST_F(MediaControlsOrientationLockDelegateTest, LeaveFullscreenAfterPageLock) {
   SimulateVideoReadyState(HTMLMediaElement::kHaveMetadata);
   SimulateOrientationLock();
+  testing::RunPendingTasks();
 
   EXPECT_CALL(ScreenOrientationClient(), LockOrientation(_)).Times(0);
   EXPECT_CALL(ScreenOrientationClient(), UnlockOrientation()).Times(0);
diff --git a/third_party/WebKit/Source/modules/media_controls/MediaControlsRotateToFullscreenDelegateTest.cpp b/third_party/WebKit/Source/modules/media_controls/MediaControlsRotateToFullscreenDelegateTest.cpp
index 14d86bd8..ddd5770 100644
--- a/third_party/WebKit/Source/modules/media_controls/MediaControlsRotateToFullscreenDelegateTest.cpp
+++ b/third_party/WebKit/Source/modules/media_controls/MediaControlsRotateToFullscreenDelegateTest.cpp
@@ -17,16 +17,17 @@
 #include "core/html_names.h"
 #include "core/loader/EmptyClients.h"
 #include "core/testing/PageTestBase.h"
+#include "device/screen_orientation/public/interfaces/screen_orientation.mojom-blink.h"
 #include "modules/device_orientation/DeviceOrientationController.h"
 #include "modules/device_orientation/DeviceOrientationData.h"
 #include "modules/media_controls/MediaControlsImpl.h"
 #include "modules/screen_orientation/ScreenOrientationControllerImpl.h"
+#include "mojo/public/cpp/bindings/associated_interface_ptr.h"
 #include "platform/testing/EmptyWebMediaPlayer.h"
 #include "platform/testing/RuntimeEnabledFeaturesTestHelpers.h"
 #include "platform/testing/UnitTestHelpers.h"
 #include "platform/wtf/text/AtomicString.h"
 #include "public/platform/WebSize.h"
-#include "public/platform/modules/screen_orientation/WebScreenOrientationClient.h"
 #include "public/platform/modules/screen_orientation/WebScreenOrientationType.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -40,14 +41,6 @@
 
 namespace {
 
-class FakeWebScreenOrientationClient : public WebScreenOrientationClient {
- public:
-  // WebScreenOrientationClient overrides:
-  void LockOrientation(WebScreenOrientationLockType,
-                       std::unique_ptr<WebLockOrientationCallback>) override {}
-  void UnlockOrientation() override {}
-};
-
 class MockVideoWebMediaPlayer : public EmptyWebMediaPlayer {
  public:
   // EmptyWebMediaPlayer overrides:
@@ -61,8 +54,12 @@
   // ChromeClient overrides:
   void InstallSupplements(LocalFrame& frame) override {
     EmptyChromeClient::InstallSupplements(frame);
-    ScreenOrientationControllerImpl::ProvideTo(frame,
-                                               &web_screen_orientation_client_);
+    ScreenOrientationControllerImpl::ProvideTo(frame);
+    device::mojom::blink::ScreenOrientationAssociatedPtr screen_orientation;
+    mojo::MakeRequestAssociatedWithDedicatedPipe(&screen_orientation);
+    ScreenOrientationControllerImpl::From(frame)
+        ->SetScreenOrientationAssociatedPtrForTests(
+            std::move(screen_orientation));
   }
   void EnterFullscreen(LocalFrame& frame) override {
     Fullscreen::From(*frame.GetDocument()).DidEnterFullscreen();
@@ -72,9 +69,6 @@
   }
 
   MOCK_CONST_METHOD0(GetScreenInfo, WebScreenInfo());
-
- private:
-  FakeWebScreenOrientationClient web_screen_orientation_client_;
 };
 
 class StubLocalFrameClient : public EmptyLocalFrameClient {
diff --git a/third_party/WebKit/Source/modules/mediasource/VideoPlaybackQuality.idl b/third_party/WebKit/Source/modules/mediasource/VideoPlaybackQuality.idl
index 809bb88..6220443 100644
--- a/third_party/WebKit/Source/modules/mediasource/VideoPlaybackQuality.idl
+++ b/third_party/WebKit/Source/modules/mediasource/VideoPlaybackQuality.idl
@@ -30,7 +30,7 @@
 [
     RuntimeEnabled=MediaSourceExperimental
 ] interface VideoPlaybackQuality {
-    readonly attribute double creationTime;
+    readonly attribute DOMHighResTimeStamp creationTime;
     readonly attribute unsigned long totalVideoFrames;
     readonly attribute unsigned long droppedVideoFrames;
     readonly attribute unsigned long corruptedVideoFrames;
diff --git a/third_party/WebKit/Source/modules/modules_idl_files.gni b/third_party/WebKit/Source/modules/modules_idl_files.gni
index 7f9dee7f..93aa726 100644
--- a/third_party/WebKit/Source/modules/modules_idl_files.gni
+++ b/third_party/WebKit/Source/modules/modules_idl_files.gni
@@ -415,6 +415,7 @@
           "xr/XRDevicePose.idl",
           "xr/XRFrameOfReference.idl",
           "xr/XRLayer.idl",
+          "xr/XRPresentationContext.idl",
           "xr/XRPresentationFrame.idl",
           "xr/XRSession.idl",
           "xr/XRSessionEvent.idl",
diff --git a/third_party/WebKit/Source/modules/peerconnection/RTCPeerConnection.cpp b/third_party/WebKit/Source/modules/peerconnection/RTCPeerConnection.cpp
index a629c37..151fef2 100644
--- a/third_party/WebKit/Source/modules/peerconnection/RTCPeerConnection.cpp
+++ b/third_party/WebKit/Source/modules/peerconnection/RTCPeerConnection.cpp
@@ -38,7 +38,6 @@
 #include "base/memory/ptr_util.h"
 #include "bindings/core/v8/ExceptionMessages.h"
 #include "bindings/core/v8/ExceptionState.h"
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/ScriptPromiseResolver.h"
 #include "bindings/core/v8/ScriptValue.h"
 #include "bindings/core/v8/v8_void_function.h"
@@ -91,6 +90,7 @@
 #include "platform/peerconnection/RTCAnswerOptionsPlatform.h"
 #include "platform/peerconnection/RTCOfferOptionsPlatform.h"
 #include "platform/runtime_enabled_features.h"
+#include "platform/wtf/Optional.h"
 #include "platform/wtf/Time.h"
 #include "public/platform/Platform.h"
 #include "public/platform/TaskType.h"
@@ -907,7 +907,7 @@
 
   // Check if |keygenAlgorithm| contains the optional DOMTimeStamp |expires|
   // attribute.
-  Nullable<DOMTimeStamp> expires;
+  Optional<DOMTimeStamp> expires;
   if (keygen_algorithm.IsDictionary()) {
     Dictionary keygen_algorithm_dict = keygen_algorithm.GetAsDictionary();
     if (keygen_algorithm_dict.HasProperty("expires", exception_state)) {
@@ -920,7 +920,7 @@
                 .ToLocalChecked()
                 ->Value();
         if (expires_double >= 0) {
-          expires.Set(static_cast<DOMTimeStamp>(expires_double));
+          expires = static_cast<DOMTimeStamp>(expires_double);
         }
       }
     }
@@ -934,7 +934,7 @@
   const char* unsupported_params_string =
       "The 1st argument provided is an AlgorithmIdentifier with a supported "
       "algorithm name, but the parameters are not supported.";
-  Nullable<WebRTCKeyParams> key_params;
+  Optional<WebRTCKeyParams> key_params;
   switch (crypto_algorithm.Id()) {
     case kWebCryptoAlgorithmIdRsaSsaPkcs1v1_5:
       // name: "RSASSA-PKCS1-v1_5"
@@ -947,8 +947,8 @@
               kWebCryptoAlgorithmIdSha256) {
         unsigned modulus_length =
             crypto_algorithm.RsaHashedKeyGenParams()->ModulusLengthBits();
-        key_params.Set(
-            WebRTCKeyParams::CreateRSA(modulus_length, public_exponent));
+        key_params =
+            WebRTCKeyParams::CreateRSA(modulus_length, public_exponent);
       } else {
         return ScriptPromise::RejectWithDOMException(
             script_state, DOMException::Create(kNotSupportedError,
@@ -960,7 +960,7 @@
       // The only recognized "namedCurve" is "P-256".
       if (crypto_algorithm.EcKeyGenParams()->NamedCurve() ==
           kWebCryptoNamedCurveP256) {
-        key_params.Set(WebRTCKeyParams::CreateECDSA(kWebRTCECCurveNistP256));
+        key_params = WebRTCKeyParams::CreateECDSA(kWebRTCECCurveNistP256);
       } else {
         return ScriptPromise::RejectWithDOMException(
             script_state, DOMException::Create(kNotSupportedError,
@@ -975,14 +975,14 @@
                                              "algorithm is not supported."));
       break;
   }
-  DCHECK(!key_params.IsNull());
+  DCHECK(key_params.has_value());
 
   std::unique_ptr<WebRTCCertificateGenerator> certificate_generator =
       Platform::Current()->CreateRTCCertificateGenerator();
 
   // |keyParams| was successfully constructed, but does the certificate
   // generator support these parameters?
-  if (!certificate_generator->IsSupportedKeyParams(key_params.Get())) {
+  if (!certificate_generator->IsSupportedKeyParams(key_params.value())) {
     return ScriptPromise::RejectWithDOMException(
         script_state,
         DOMException::Create(kNotSupportedError, unsupported_params_string));
@@ -1000,12 +1000,12 @@
   scoped_refptr<WebTaskRunner> task_runner =
       ExecutionContext::From(script_state)
           ->GetTaskRunner(blink::TaskType::kUnthrottled);
-  if (expires.IsNull()) {
+  if (!expires) {
     certificate_generator->GenerateCertificate(
-        key_params.Get(), std::move(certificate_observer), task_runner);
+        key_params.value(), std::move(certificate_observer), task_runner);
   } else {
     certificate_generator->GenerateCertificateWithExpiration(
-        key_params.Get(), expires.Get(), std::move(certificate_observer),
+        key_params.value(), expires.value(), std::move(certificate_observer),
         task_runner);
   }
 
diff --git a/third_party/WebKit/Source/modules/screen_orientation/BUILD.gn b/third_party/WebKit/Source/modules/screen_orientation/BUILD.gn
index e5c75dc..3cddf13 100644
--- a/third_party/WebKit/Source/modules/screen_orientation/BUILD.gn
+++ b/third_party/WebKit/Source/modules/screen_orientation/BUILD.gn
@@ -12,6 +12,8 @@
     "ScreenOrientation.h",
     "ScreenOrientationControllerImpl.cpp",
     "ScreenOrientationControllerImpl.h",
+    "ScreenOrientationDelegate.cpp",
+    "ScreenOrientationDelegate.h",
     "ScreenOrientationDispatcher.cpp",
     "ScreenOrientationDispatcher.h",
     "ScreenScreenOrientation.cpp",
diff --git a/third_party/WebKit/Source/modules/screen_orientation/DEPS b/third_party/WebKit/Source/modules/screen_orientation/DEPS
index a626577e..9770db6 100644
--- a/third_party/WebKit/Source/modules/screen_orientation/DEPS
+++ b/third_party/WebKit/Source/modules/screen_orientation/DEPS
@@ -1,8 +1,10 @@
 include_rules = [
+    "+common/associated_interfaces/associated_interface_provider.h",
     "+device/screen_orientation/public/interfaces/screen_orientation.mojom-blink.h",
     "-modules",
     "+modules/EventTargetModules.h",
     "+modules/ModulesExport.h",
     "+modules/screen_orientation",
+    "+mojo/public/cpp/bindings/associated_interface_ptr.h",
     "+services/device/public/interfaces/constants.mojom-blink.h",
 ]
diff --git a/third_party/WebKit/Source/modules/screen_orientation/ScreenOrientationControllerImpl.cpp b/third_party/WebKit/Source/modules/screen_orientation/ScreenOrientationControllerImpl.cpp
index b9dea9f7..88ca9540f 100644
--- a/third_party/WebKit/Source/modules/screen_orientation/ScreenOrientationControllerImpl.cpp
+++ b/third_party/WebKit/Source/modules/screen_orientation/ScreenOrientationControllerImpl.cpp
@@ -13,22 +13,20 @@
 #include "core/page/ChromeClient.h"
 #include "core/page/Page.h"
 #include "modules/screen_orientation/ScreenOrientation.h"
+#include "modules/screen_orientation/ScreenOrientationDelegate.h"
 #include "modules/screen_orientation/ScreenOrientationDispatcher.h"
 #include "platform/LayoutTestSupport.h"
 #include "platform/ScopedOrientationChangeIndicator.h"
 #include "public/platform/TaskType.h"
 #include "public/platform/WebScreenInfo.h"
-#include "public/platform/modules/screen_orientation/WebScreenOrientationClient.h"
 
 namespace blink {
 
 ScreenOrientationControllerImpl::~ScreenOrientationControllerImpl() = default;
 
-void ScreenOrientationControllerImpl::ProvideTo(
-    LocalFrame& frame,
-    WebScreenOrientationClient* client) {
+void ScreenOrientationControllerImpl::ProvideTo(LocalFrame& frame) {
   ScreenOrientationController::ProvideTo(
-      frame, new ScreenOrientationControllerImpl(frame, client));
+      frame, new ScreenOrientationControllerImpl(frame));
 }
 
 ScreenOrientationControllerImpl* ScreenOrientationControllerImpl::From(
@@ -38,12 +36,12 @@
 }
 
 ScreenOrientationControllerImpl::ScreenOrientationControllerImpl(
-    LocalFrame& frame,
-    WebScreenOrientationClient* client)
+    LocalFrame& frame)
     : ScreenOrientationController(frame),
       ContextLifecycleObserver(frame.GetDocument()),
       PlatformEventController(frame.GetDocument()),
-      client_(client),
+      delegate_(std::make_unique<ScreenOrientationDelegate>(
+          frame.GetRemoteNavigationAssociatedInterfaces())),
       dispatch_event_timer_(
           frame.GetTaskRunner(TaskType::kMiscPlatformAPI),
           this,
@@ -107,7 +105,7 @@
 }
 
 bool ScreenOrientationControllerImpl::IsActive() const {
-  return orientation_ && client_;
+  return orientation_ && delegate_;
 }
 
 bool ScreenOrientationControllerImpl::IsVisible() const {
@@ -186,18 +184,18 @@
 void ScreenOrientationControllerImpl::lock(
     WebScreenOrientationLockType orientation,
     std::unique_ptr<WebLockOrientationCallback> callback) {
-  // When detached, the client is no longer valid.
-  if (!client_)
+  // When detached, the delegate is no longer valid.
+  if (!delegate_)
     return;
-  client_->LockOrientation(orientation, std::move(callback));
+  delegate_->LockOrientation(orientation, std::move(callback));
   active_lock_ = true;
 }
 
 void ScreenOrientationControllerImpl::unlock() {
-  // When detached, the client is no longer valid.
-  if (!client_)
+  // When detached, the delegate is no longer valid.
+  if (!delegate_)
     return;
-  client_->UnlockOrientation();
+  delegate_->UnlockOrientation();
   active_lock_ = false;
 }
 
@@ -231,7 +229,7 @@
 
 void ScreenOrientationControllerImpl::ContextDestroyed(ExecutionContext*) {
   StopUpdating();
-  client_ = nullptr;
+  delegate_.reset();
   active_lock_ = false;
 }
 
@@ -249,4 +247,13 @@
   PlatformEventController::Trace(visitor);
 }
 
+void ScreenOrientationControllerImpl::SetScreenOrientationAssociatedPtrForTests(
+    device::mojom::blink::ScreenOrientationAssociatedPtr
+        screen_orientation_associated_ptr) {
+  if (delegate_) {
+    delegate_->SetScreenOrientationAssociatedPtrForTests(
+        std::move(screen_orientation_associated_ptr));
+  }
+}
+
 }  // namespace blink
diff --git a/third_party/WebKit/Source/modules/screen_orientation/ScreenOrientationControllerImpl.h b/third_party/WebKit/Source/modules/screen_orientation/ScreenOrientationControllerImpl.h
index 1ac7fc8..fc09eccca 100644
--- a/third_party/WebKit/Source/modules/screen_orientation/ScreenOrientationControllerImpl.h
+++ b/third_party/WebKit/Source/modules/screen_orientation/ScreenOrientationControllerImpl.h
@@ -5,19 +5,20 @@
 #ifndef ScreenOrientationControllerImpl_h
 #define ScreenOrientationControllerImpl_h
 
+#include <memory>
 #include "core/dom/Document.h"
 #include "core/frame/PlatformEventController.h"
 #include "core/frame/ScreenOrientationController.h"
+#include "device/screen_orientation/public/interfaces/screen_orientation.mojom-blink.h"
 #include "modules/ModulesExport.h"
 #include "public/platform/modules/screen_orientation/WebLockOrientationCallback.h"
 #include "public/platform/modules/screen_orientation/WebScreenOrientationLockType.h"
 #include "public/platform/modules/screen_orientation/WebScreenOrientationType.h"
-#include <memory>
 
 namespace blink {
 
 class ScreenOrientation;
-class WebScreenOrientationClient;
+class ScreenOrientationDelegate;
 
 class MODULES_EXPORT ScreenOrientationControllerImpl final
     : public ScreenOrientationController,
@@ -38,15 +39,18 @@
   void unlock() override;
   bool MaybeHasActiveLock() const override;
 
-  static void ProvideTo(LocalFrame&, WebScreenOrientationClient*);
+  static void ProvideTo(LocalFrame&);
   static ScreenOrientationControllerImpl* From(LocalFrame&);
 
+  void SetScreenOrientationAssociatedPtrForTests(
+      device::mojom::blink::ScreenOrientationAssociatedPtr);
+
   virtual void Trace(blink::Visitor*);
 
  private:
   friend class MediaControlsOrientationLockAndRotateToFullscreenDelegateTest;
 
-  ScreenOrientationControllerImpl(LocalFrame&, WebScreenOrientationClient*);
+  explicit ScreenOrientationControllerImpl(LocalFrame&);
 
   static WebScreenOrientationType ComputeOrientation(const IntRect&, uint16_t);
 
@@ -71,7 +75,7 @@
   bool IsActiveAndVisible() const;
 
   Member<ScreenOrientation> orientation_;
-  WebScreenOrientationClient* client_;
+  std::unique_ptr<ScreenOrientationDelegate> delegate_;
   TaskRunnerTimer<ScreenOrientationControllerImpl> dispatch_event_timer_;
   bool active_lock_ = false;
 };
diff --git a/third_party/WebKit/Source/modules/screen_orientation/ScreenOrientationDelegate.cpp b/third_party/WebKit/Source/modules/screen_orientation/ScreenOrientationDelegate.cpp
new file mode 100644
index 0000000..22962ac
--- /dev/null
+++ b/third_party/WebKit/Source/modules/screen_orientation/ScreenOrientationDelegate.cpp
@@ -0,0 +1,84 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "modules/screen_orientation/ScreenOrientationDelegate.h"
+
+#include "common/associated_interfaces/associated_interface_provider.h"
+#include "platform/wtf/Functional.h"
+
+namespace blink {
+
+using device::mojom::blink::ScreenOrientationLockResult;
+
+ScreenOrientationDelegate::ScreenOrientationDelegate(
+    AssociatedInterfaceProvider* provider) {
+  if (provider)
+    provider->GetInterface(&screen_orientation_);
+}
+
+void ScreenOrientationDelegate::LockOrientation(
+    WebScreenOrientationLockType orientation,
+    std::unique_ptr<WebLockOrientationCallback> callback) {
+  CancelPendingLocks();
+
+  pending_callback_ = std::move(callback);
+  screen_orientation_->LockOrientation(
+      orientation,
+      WTF::Bind(&ScreenOrientationDelegate::OnLockOrientationResult,
+                WTF::Unretained(this), ++request_id_));
+}
+
+void ScreenOrientationDelegate::UnlockOrientation() {
+  CancelPendingLocks();
+  screen_orientation_->UnlockOrientation();
+}
+
+void ScreenOrientationDelegate::OnLockOrientationResult(
+    int request_id,
+    ScreenOrientationLockResult result) {
+  if (!pending_callback_ || request_id != request_id_)
+    return;
+
+  switch (result) {
+    case ScreenOrientationLockResult::SCREEN_ORIENTATION_LOCK_RESULT_SUCCESS:
+      pending_callback_->OnSuccess();
+      break;
+    case ScreenOrientationLockResult::
+        SCREEN_ORIENTATION_LOCK_RESULT_ERROR_NOT_AVAILABLE:
+      pending_callback_->OnError(kWebLockOrientationErrorNotAvailable);
+      break;
+    case ScreenOrientationLockResult::
+        SCREEN_ORIENTATION_LOCK_RESULT_ERROR_FULLSCREEN_REQUIRED:
+      pending_callback_->OnError(kWebLockOrientationErrorFullscreenRequired);
+      break;
+    case ScreenOrientationLockResult::
+        SCREEN_ORIENTATION_LOCK_RESULT_ERROR_CANCELED:
+      pending_callback_->OnError(kWebLockOrientationErrorCanceled);
+      break;
+    default:
+      NOTREACHED();
+      break;
+  }
+
+  pending_callback_.reset();
+}
+
+void ScreenOrientationDelegate::CancelPendingLocks() {
+  if (!pending_callback_)
+    return;
+
+  pending_callback_->OnError(kWebLockOrientationErrorCanceled);
+  pending_callback_.reset();
+}
+
+int ScreenOrientationDelegate::GetRequestIdForTests() {
+  return pending_callback_ ? request_id_ : -1;
+}
+
+void ScreenOrientationDelegate::SetScreenOrientationAssociatedPtrForTests(
+    ScreenOrientationAssociatedPtr screen_orientation_associated_ptr) {
+  screen_orientation_ = std::move(screen_orientation_associated_ptr);
+}
+
+}  // namespace blink
diff --git a/third_party/WebKit/Source/modules/screen_orientation/ScreenOrientationDelegate.h b/third_party/WebKit/Source/modules/screen_orientation/ScreenOrientationDelegate.h
new file mode 100644
index 0000000..287d6e3
--- /dev/null
+++ b/third_party/WebKit/Source/modules/screen_orientation/ScreenOrientationDelegate.h
@@ -0,0 +1,59 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef ScreenOrientationDelegate_h
+#define ScreenOrientationDelegate_h
+
+#include <memory>
+#include "device/screen_orientation/public/interfaces/screen_orientation.mojom-blink.h"
+#include "modules/ModulesExport.h"
+#include "platform/wtf/Noncopyable.h"
+#include "public/platform/modules/screen_orientation/WebLockOrientationCallback.h"
+#include "public/platform/modules/screen_orientation/WebScreenOrientationLockType.h"
+#include "public/platform/modules/screen_orientation/WebScreenOrientationType.h"
+
+namespace blink {
+
+using device::mojom::blink::ScreenOrientationAssociatedPtr;
+using device::mojom::blink::ScreenOrientationLockResult;
+
+class AssociatedInterfaceProvider;
+
+// ScreenOrientationDelegate holds a
+// device::mojom::blink::ScreenOrientationAssociatedPtr by which it sends lock
+// (or unlock) requests to the browser process. It also listens for responses
+// and let Blink know about the result of the request via
+// WebLockOrientationCallback.
+class MODULES_EXPORT ScreenOrientationDelegate {
+  WTF_MAKE_NONCOPYABLE(ScreenOrientationDelegate);
+
+ public:
+  explicit ScreenOrientationDelegate(AssociatedInterfaceProvider*);
+  virtual ~ScreenOrientationDelegate() = default;
+
+  void LockOrientation(blink::WebScreenOrientationLockType,
+                       std::unique_ptr<blink::WebLockOrientationCallback>);
+
+  void UnlockOrientation();
+
+  void SetScreenOrientationAssociatedPtrForTests(
+      ScreenOrientationAssociatedPtr);
+
+ private:
+  friend class ScreenOrientationDelegateTest;
+
+  void OnLockOrientationResult(int, ScreenOrientationLockResult);
+  void CancelPendingLocks();
+
+  int GetRequestIdForTests();
+
+  std::unique_ptr<WebLockOrientationCallback> pending_callback_;
+  int request_id_ = 0;
+
+  ScreenOrientationAssociatedPtr screen_orientation_;
+};
+
+}  // namespace blink
+
+#endif  // ScreenOrientationDelegate_h
diff --git a/content/renderer/screen_orientation/screen_orientation_dispatcher_unittest.cc b/third_party/WebKit/Source/modules/screen_orientation/ScreenOrientationDelegateTest.cpp
similarity index 80%
rename from content/renderer/screen_orientation/screen_orientation_dispatcher_unittest.cc
rename to third_party/WebKit/Source/modules/screen_orientation/ScreenOrientationDelegateTest.cpp
index f59a469..12a3b77 100644
--- a/content/renderer/screen_orientation/screen_orientation_dispatcher_unittest.cc
+++ b/third_party/WebKit/Source/modules/screen_orientation/ScreenOrientationDelegateTest.cpp
@@ -2,23 +2,20 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/renderer/screen_orientation/screen_orientation_dispatcher.h"
+#include "modules/screen_orientation/ScreenOrientationDelegate.h"
 
-#include <list>
+#include <map>
 #include <memory>
-#include <tuple>
 
-#include "base/logging.h"
-#include "base/memory/ptr_util.h"
-#include "base/message_loop/message_loop.h"
+#include "mojo/public/cpp/bindings/associated_interface_ptr.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/WebKit/public/platform/modules/screen_orientation/WebLockOrientationCallback.h"
 
-namespace content {
+namespace blink {
 
 using LockOrientationCallback =
-    device::mojom::ScreenOrientation::LockOrientationCallback;
-using LockResult = device::mojom::ScreenOrientationLockResult;
+    device::mojom::blink::ScreenOrientation::LockOrientationCallback;
+using LockResult = device::mojom::blink::ScreenOrientationLockResult;
 
 // MockLockOrientationCallback is an implementation of
 // WebLockOrientationCallback and takes a LockOrientationResultHolder* as a
@@ -51,36 +48,36 @@
   LockOrientationResultHolder* results_;
 };
 
-class ScreenOrientationDispatcherTest : public testing::Test {
+class ScreenOrientationDelegateTest : public ::testing::Test {
  protected:
   void SetUp() override {
-    dispatcher_.reset(new ScreenOrientationDispatcher(nullptr));
+    delegate_.reset(new ScreenOrientationDelegate(nullptr));
     ScreenOrientationAssociatedPtr screen_orientation;
     mojo::MakeRequestAssociatedWithDedicatedPipe(&screen_orientation);
-    dispatcher_->SetScreenOrientationForTests(screen_orientation);
+    delegate_->SetScreenOrientationAssociatedPtrForTests(
+        std::move(screen_orientation));
   }
 
   void LockOrientation(
       blink::WebScreenOrientationLockType orientation,
       std::unique_ptr<blink::WebLockOrientationCallback> callback) {
-    dispatcher_->LockOrientation(orientation, std::move(callback));
+    delegate_->LockOrientation(orientation, std::move(callback));
   }
 
-  void UnlockOrientation() { dispatcher_->UnlockOrientation(); }
+  void UnlockOrientation() { delegate_->UnlockOrientation(); }
 
-  int GetRequestId() { return dispatcher_->GetRequestIdForTests(); }
+  int GetRequestId() { return delegate_->GetRequestIdForTests(); }
 
   void RunLockResultCallback(int request_id, LockResult result) {
-    dispatcher_->OnLockOrientationResult(request_id, result);
+    delegate_->OnLockOrientationResult(request_id, result);
   }
 
-  base::MessageLoop message_loop_;
-  std::unique_ptr<ScreenOrientationDispatcher> dispatcher_;
+  std::unique_ptr<ScreenOrientationDelegate> delegate_;
 };
 
 // Test that calling lockOrientation() followed by unlockOrientation() cancel
 // the lockOrientation().
-TEST_F(ScreenOrientationDispatcherTest, CancelPending_Unlocking) {
+TEST_F(ScreenOrientationDelegateTest, CancelPending_Unlocking) {
   MockLockOrientationCallback::LockOrientationResultHolder callback_results;
 
   LockOrientation(
@@ -94,7 +91,7 @@
 }
 
 // Test that calling lockOrientation() twice cancel the first lockOrientation().
-TEST_F(ScreenOrientationDispatcherTest, CancelPending_DoubleLock) {
+TEST_F(ScreenOrientationDelegateTest, CancelPending_DoubleLock) {
   MockLockOrientationCallback::LockOrientationResultHolder callback_results;
   // We create the object to prevent leaks but never actually use it.
   MockLockOrientationCallback::LockOrientationResultHolder callback_results2;
@@ -114,7 +111,7 @@
 
 // Test that when a LockError message is received, the request is set as failed
 // with the correct values.
-TEST_F(ScreenOrientationDispatcherTest, LockRequest_Error) {
+TEST_F(ScreenOrientationDelegateTest, LockRequest_Error) {
   std::map<LockResult, blink::WebLockOrientationError> errors;
   errors[LockResult::SCREEN_ORIENTATION_LOCK_RESULT_ERROR_NOT_AVAILABLE] =
       blink::kWebLockOrientationErrorNotAvailable;
@@ -139,7 +136,7 @@
 
 // Test that when a LockSuccess message is received, the request is set as
 // succeeded.
-TEST_F(ScreenOrientationDispatcherTest, LockRequest_Success) {
+TEST_F(ScreenOrientationDelegateTest, LockRequest_Success) {
   MockLockOrientationCallback::LockOrientationResultHolder callback_results;
   LockOrientation(
       blink::kWebScreenOrientationLockPortraitPrimary,
@@ -153,12 +150,12 @@
 }
 
 // Test the following scenario:
-// - request1 is received by the dispatcher;
-// - request2 is received by the dispatcher;
+// - request1 is received by the delegate;
+// - request2 is received by the delegate;
 // - request1 is rejected;
 // - request1 success response is received.
 // Expected: request1 is still rejected, request2 has not been set as succeeded.
-TEST_F(ScreenOrientationDispatcherTest, RaceScenario) {
+TEST_F(ScreenOrientationDelegateTest, RaceScenario) {
   MockLockOrientationCallback::LockOrientationResultHolder callback_results1;
   MockLockOrientationCallback::LockOrientationResultHolder callback_results2;
 
@@ -186,4 +183,4 @@
   EXPECT_FALSE(callback_results2.failed_);
 }
 
-}  // namespace content
+}  // namespace blink
diff --git a/third_party/WebKit/Source/modules/webaudio/MediaElementAudioSourceNode.h b/third_party/WebKit/Source/modules/webaudio/MediaElementAudioSourceNode.h
index 2d496ea..a1ffa9a0 100644
--- a/third_party/WebKit/Source/modules/webaudio/MediaElementAudioSourceNode.h
+++ b/third_party/WebKit/Source/modules/webaudio/MediaElementAudioSourceNode.h
@@ -29,6 +29,7 @@
 #include <memory>
 #include "base/memory/scoped_refptr.h"
 #include "modules/webaudio/AudioNode.h"
+#include "platform/WebTaskRunner.h"
 #include "platform/audio/AudioSourceProviderClient.h"
 #include "platform/audio/MultiChannelResampler.h"
 #include "platform/wtf/ThreadingPrimitives.h"
diff --git a/third_party/WebKit/Source/modules/webaudio/OfflineAudioDestinationNode.cpp b/third_party/WebKit/Source/modules/webaudio/OfflineAudioDestinationNode.cpp
index 31aac55..d833e8a 100644
--- a/third_party/WebKit/Source/modules/webaudio/OfflineAudioDestinationNode.cpp
+++ b/third_party/WebKit/Source/modules/webaudio/OfflineAudioDestinationNode.cpp
@@ -197,9 +197,8 @@
     // data. Detect that condition by trying to take the cross-thread
     // persistent lock which is held while a GC runs. If the lock is
     // already held, simply delay rendering until the next quantum.
-    CrossThreadPersistentRegion::LockScope gc_lock(
-        ProcessHeap::GetCrossThreadPersistentRegion(), true);
-    if (!gc_lock.HasLock()) {
+    bool has_lock = ProcessHeap::CrossThreadPersistentMutex().TryLock();
+    if (!has_lock) {
       // To ensure that the rendering step eventually happens, repost.
       GetRenderingThread()->GetWebTaskRunner()->PostTask(
           FROM_HERE,
@@ -212,6 +211,7 @@
     destinations.ReserveInitialCapacity(number_of_channels);
     for (unsigned i = 0; i < number_of_channels; ++i)
       destinations.push_back(render_target_->getChannelData(i).View()->Data());
+    ProcessHeap::CrossThreadPersistentMutex().unlock();
   }
 
   // If there is more to process and there is no suspension at the moment,
diff --git a/third_party/WebKit/Source/modules/webdatabase/Database.h b/third_party/WebKit/Source/modules/webdatabase/Database.h
index 6f6beca6..fb4726df 100644
--- a/third_party/WebKit/Source/modules/webdatabase/Database.h
+++ b/third_party/WebKit/Source/modules/webdatabase/Database.h
@@ -30,6 +30,7 @@
 #include "modules/webdatabase/DatabaseError.h"
 #include "modules/webdatabase/SQLTransactionBackend.h"
 #include "modules/webdatabase/sqlite/SQLiteDatabase.h"
+#include "platform/WebTaskRunner.h"
 #include "platform/bindings/ScriptWrappable.h"
 #include "platform/bindings/TraceWrapperMember.h"
 #include "platform/weborigin/SecurityOrigin.h"
diff --git a/third_party/WebKit/Source/modules/webdatabase/DatabaseTracker.cpp b/third_party/WebKit/Source/modules/webdatabase/DatabaseTracker.cpp
index 5eea3b9..5285860 100644
--- a/third_party/WebKit/Source/modules/webdatabase/DatabaseTracker.cpp
+++ b/third_party/WebKit/Source/modules/webdatabase/DatabaseTracker.cpp
@@ -67,7 +67,7 @@
 }
 
 DatabaseTracker::DatabaseTracker() {
-  SQLiteFileSystem::RegisterSQLiteVFS();
+  SQLiteFileSystem::InitializeSQLite();
 }
 
 bool DatabaseTracker::CanEstablishDatabase(DatabaseContext* database_context,
diff --git a/third_party/WebKit/Source/modules/webdatabase/SQLTransaction.cpp b/third_party/WebKit/Source/modules/webdatabase/SQLTransaction.cpp
index 61aae1ff..dc21fd9f 100644
--- a/third_party/WebKit/Source/modules/webdatabase/SQLTransaction.cpp
+++ b/third_party/WebKit/Source/modules/webdatabase/SQLTransaction.cpp
@@ -313,14 +313,14 @@
 
 void SQLTransaction::executeSql(ScriptState* script_state,
                                 const String& sql_statement,
-                                const Nullable<Vector<ScriptValue>>& arguments,
+                                const Optional<Vector<ScriptValue>>& arguments,
                                 SQLStatementCallback* callback,
                                 SQLStatementErrorCallback* callback_error,
                                 ExceptionState& exception_state) {
   Vector<SQLValue> sql_values;
-  if (!arguments.IsNull()) {
-    sql_values.ReserveInitialCapacity(arguments.Get().size());
-    for (const ScriptValue& value : arguments.Get()) {
+  if (arguments) {
+    sql_values.ReserveInitialCapacity(arguments.value().size());
+    for (const ScriptValue& value : arguments.value()) {
       sql_values.UncheckedAppend(NativeValueTraits<SQLValue>::NativeValue(
           script_state->GetIsolate(), value.V8Value(), exception_state));
       // Historically, no exceptions were thrown if the conversion failed.
diff --git a/third_party/WebKit/Source/modules/webdatabase/SQLTransaction.h b/third_party/WebKit/Source/modules/webdatabase/SQLTransaction.h
index 77fe415..f24db90 100644
--- a/third_party/WebKit/Source/modules/webdatabase/SQLTransaction.h
+++ b/third_party/WebKit/Source/modules/webdatabase/SQLTransaction.h
@@ -30,12 +30,12 @@
 #define SQLTransaction_h
 
 #include <memory>
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/modules/v8/V8BindingForModules.h"
 #include "modules/webdatabase/SQLStatement.h"
 #include "modules/webdatabase/SQLTransactionStateMachine.h"
 #include "platform/bindings/ScriptWrappable.h"
 #include "platform/heap/Handle.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
@@ -74,7 +74,7 @@
   void executeSql(ScriptState*, const String& sql_statement, ExceptionState&);
   void executeSql(ScriptState*,
                   const String& sql_statement,
-                  const Nullable<Vector<ScriptValue>>& arguments,
+                  const Optional<Vector<ScriptValue>>& arguments,
                   SQLStatementCallback*,
                   SQLStatementErrorCallback*,
                   ExceptionState&);
diff --git a/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLiteFileSystem.cpp b/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLiteFileSystem.cpp
index aaf18e1..c88e015 100644
--- a/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLiteFileSystem.cpp
+++ b/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLiteFileSystem.cpp
@@ -39,9 +39,29 @@
 // platform-specific files SQLiteFileSystemChromium{Win|Posix}.cpp
 namespace blink {
 
-SQLiteFileSystem::SQLiteFileSystem() = default;
+#if DCHECK_IS_ON()
+// static
+bool SQLiteFileSystem::initialize_sqlite_called_ = false;
+#endif  // DCHECK_IS_ON
 
+// static
+void SQLiteFileSystem::InitializeSQLite() {
+#if DCHECK_IS_ON()
+  DCHECK(!initialize_sqlite_called_) << __func__ << " already called";
+  initialize_sqlite_called_ = true;
+#endif  // DCHECK_IS_ON()
+
+  sqlite3_initialize();
+  RegisterSQLiteVFS();
+}
+
+// static
 int SQLiteFileSystem::OpenDatabase(const String& filename, sqlite3** database) {
+#if DCHECK_IS_ON()
+  DCHECK(initialize_sqlite_called_)
+      << "InitializeSQLite() must be called before " << __func__;
+#endif  // DCHECK_IS_ON()
+
   return sqlite3_open_v2(filename.Utf8().data(), database,
                          SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE,
                          "chromium_vfs");
diff --git a/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLiteFileSystem.h b/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLiteFileSystem.h
index 10394fb..7889547 100644
--- a/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLiteFileSystem.h
+++ b/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLiteFileSystem.h
@@ -42,22 +42,31 @@
 // A class that abstracts the file system related operations required
 // by the WebKit database code.
 class SQLiteFileSystem {
-  DISALLOW_NEW();
-
  public:
-  // Registers a user-defined SQLite VFS.
-  static void RegisterSQLiteVFS();
+  // This class is used as a namespace, so instantiating it doesn't make sense.
+  SQLiteFileSystem() = delete;
+
+  // Initializes SQLite for Blink's use.
+  //
+  // This must be called exactly once in each renderer process that uses SQLite.
+  static void InitializeSQLite();
 
   // Opens a database file.
   //
-  // filemame - The name of the database file.
+  // InitializeSQLite() must be called before this method is called.
+  //
+  // filename - The name of the database file.
   // database - The SQLite structure that represents the database stored
   //            in the given file.
   static int OpenDatabase(const String& filename, sqlite3** database);
 
  private:
-  // do not instantiate this class
-  SQLiteFileSystem();
+  // Registers Chromium's VFS with SQLite.
+  static void RegisterSQLiteVFS();
+
+#if DCHECK_IS_ON()
+  static bool initialize_sqlite_called_;
+#endif  // DCHECK_IS_ON()
 };  // class SQLiteFileSystem
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLiteFileSystemPosix.cpp b/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLiteFileSystemPosix.cpp
index 449c6d0a..fdfe11e 100644
--- a/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLiteFileSystemPosix.cpp
+++ b/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLiteFileSystemPosix.cpp
@@ -320,17 +320,17 @@
   return wrapped_vfs->xSleep(wrapped_vfs, microseconds);
 }
 
-int ChromiumCurrentTime(sqlite3_vfs* vfs, double* pr_now) {
-  sqlite3_vfs* wrapped_vfs = static_cast<sqlite3_vfs*>(vfs->pAppData);
-  return wrapped_vfs->xCurrentTime(wrapped_vfs, pr_now);
-}
-
 int ChromiumGetLastError(sqlite3_vfs* vfs, int n_buf, char* z_buf) {
   if (n_buf && z_buf)
     *z_buf = '\0';
   return 0;
 }
 
+int ChromiumCurrentTimeInt64(sqlite3_vfs* vfs, sqlite3_int64* now) {
+  sqlite3_vfs* wrapped_vfs = static_cast<sqlite3_vfs*>(vfs->pAppData);
+  return wrapped_vfs->xCurrentTimeInt64(wrapped_vfs, now);
+}
+
 }  // namespace
 
 void SQLiteFileSystem::RegisterSQLiteVFS() {
@@ -340,9 +340,9 @@
   // TODO(shess): Implement local versions.
   DCHECK(wrapped_vfs->xRandomness);
   DCHECK(wrapped_vfs->xSleep);
-  DCHECK(wrapped_vfs->xCurrentTime);
+  DCHECK(wrapped_vfs->xCurrentTimeInt64);
 
-  static sqlite3_vfs chromium_vfs = {1,
+  static sqlite3_vfs chromium_vfs = {2,  // SQLite VFS API version.
                                      sizeof(chromiumVfsFile),
                                      wrapped_vfs->mxPathname,
                                      nullptr,
@@ -358,8 +358,9 @@
                                      ChromiumDlClose,
                                      ChromiumRandomness,
                                      ChromiumSleep,
-                                     ChromiumCurrentTime,
-                                     ChromiumGetLastError};
+                                     nullptr,  // CurrentTime is deprecated.
+                                     ChromiumGetLastError,
+                                     ChromiumCurrentTimeInt64};
   sqlite3_vfs_register(&chromium_vfs, 0);
 }
 
diff --git a/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLiteFileSystemWin.cpp b/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLiteFileSystemWin.cpp
index a707cca..902c80e 100644
--- a/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLiteFileSystemWin.cpp
+++ b/third_party/WebKit/Source/modules/webdatabase/sqlite/SQLiteFileSystemWin.cpp
@@ -147,17 +147,17 @@
   return wrapped_vfs->xSleep(wrapped_vfs, microseconds);
 }
 
-int ChromiumCurrentTime(sqlite3_vfs* vfs, double* pr_now) {
-  sqlite3_vfs* wrapped_vfs = static_cast<sqlite3_vfs*>(vfs->pAppData);
-  return wrapped_vfs->xCurrentTime(wrapped_vfs, pr_now);
-}
-
 int ChromiumGetLastError(sqlite3_vfs* vfs, int n_buf, char* z_buf) {
   if (n_buf && z_buf)
     *z_buf = '\0';
   return 0;
 }
 
+int ChromiumCurrentTimeInt64(sqlite3_vfs* vfs, sqlite3_int64* now) {
+  sqlite3_vfs* wrapped_vfs = static_cast<sqlite3_vfs*>(vfs->pAppData);
+  return wrapped_vfs->xCurrentTimeInt64(wrapped_vfs, now);
+}
+
 }  // namespace
 
 void SQLiteFileSystem::RegisterSQLiteVFS() {
@@ -167,9 +167,9 @@
   // TODO(shess): Implement local versions.
   DCHECK(wrapped_vfs->xRandomness);
   DCHECK(wrapped_vfs->xSleep);
-  DCHECK(wrapped_vfs->xCurrentTime);
+  DCHECK(wrapped_vfs->xCurrentTimeInt64);
 
-  static sqlite3_vfs chromium_vfs = {1,
+  static sqlite3_vfs chromium_vfs = {2,  // SQLite VFS API version.
                                      wrapped_vfs->szOsFile,
                                      wrapped_vfs->mxPathname,
                                      0,
@@ -185,8 +185,9 @@
                                      ChromiumDlClose,
                                      ChromiumRandomness,
                                      ChromiumSleep,
-                                     ChromiumCurrentTime,
-                                     ChromiumGetLastError};
+                                     nullptr,  // CurrentTime is deprecated.
+                                     ChromiumGetLastError,
+                                     ChromiumCurrentTimeInt64};
   sqlite3_vfs_register(&chromium_vfs, 0);
 }
 
diff --git a/third_party/WebKit/Source/modules/webgl/WebGLQuery.h b/third_party/WebKit/Source/modules/webgl/WebGLQuery.h
index a10f8b3d..784eee2 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLQuery.h
+++ b/third_party/WebKit/Source/modules/webgl/WebGLQuery.h
@@ -17,7 +17,6 @@
 namespace blink {
 
 class WebGL2RenderingContextBase;
-class WebTaskRunner;
 
 class WebGLQuery : public WebGLSharedPlatform3DObject {
   DEFINE_WRAPPERTYPEINFO();
diff --git a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
index 8cc11b0..6188c17 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
@@ -1339,9 +1339,9 @@
       (mask && framebuffer_binding_))
     return kSkipped;
 
-  Nullable<WebGLContextAttributes> context_attributes;
+  Optional<WebGLContextAttributes> context_attributes;
   getContextAttributes(context_attributes);
-  if (context_attributes.IsNull()) {
+  if (!context_attributes) {
     // Unlikely, but context was lost.
     return kSkipped;
   }
@@ -1363,13 +1363,13 @@
       true, true, true,
       !GetDrawingBuffer()->RequiresAlphaChannelToBePreserved());
   GLbitfield clear_mask = GL_COLOR_BUFFER_BIT;
-  if (context_attributes.Get().depth()) {
+  if (context_attributes->depth()) {
     if (!combined_clear || !depth_mask_ || !(mask & GL_DEPTH_BUFFER_BIT))
       ContextGL()->ClearDepthf(1.0f);
     clear_mask |= GL_DEPTH_BUFFER_BIT;
     ContextGL()->DepthMask(true);
   }
-  if (context_attributes.Get().stencil() ||
+  if (context_attributes->stencil() ||
       GetDrawingBuffer()->HasImplicitStencilBuffer()) {
     if (combined_clear && (mask & GL_STENCIL_BUFFER_BIT))
       ContextGL()->ClearStencil(clear_stencil_ & stencil_mask_);
@@ -2676,10 +2676,10 @@
   return WebGLActiveInfo::Create(name_impl->Substring(0, length), type, size);
 }
 
-Nullable<HeapVector<Member<WebGLShader>>>
+Optional<HeapVector<Member<WebGLShader>>>
 WebGLRenderingContextBase::getAttachedShaders(WebGLProgram* program) {
   if (isContextLost() || !ValidateWebGLObject("getAttachedShaders", program))
-    return nullptr;
+    return WTF::nullopt;
 
   HeapVector<Member<WebGLShader>> shader_objects;
   const GLenum kShaderType[] = {GL_VERTEX_SHADER, GL_FRAGMENT_SHADER};
@@ -2750,17 +2750,17 @@
 }
 
 void WebGLRenderingContextBase::getContextAttributes(
-    Nullable<WebGLContextAttributes>& result) {
+    Optional<WebGLContextAttributes>& result) {
   if (isContextLost())
     return;
-  result.Set(ToWebGLContextAttributes(CreationAttributes()));
+  result = ToWebGLContextAttributes(CreationAttributes());
   // Some requested attributes may not be honored, so we need to query the
   // underlying context/drawing buffer and adjust accordingly.
   if (CreationAttributes().depth() && !GetDrawingBuffer()->HasDepthBuffer())
-    result.Get().setDepth(false);
+    result->setDepth(false);
   if (CreationAttributes().stencil() && !GetDrawingBuffer()->HasStencilBuffer())
-    result.Get().setStencil(false);
-  result.Get().setAntialias(GetDrawingBuffer()->Multisample());
+    result->setStencil(false);
+  result->setAntialias(GetDrawingBuffer()->Multisample());
 }
 
 GLenum WebGLRenderingContextBase::getError() {
@@ -3385,9 +3385,9 @@
   return EnsureNotNull(shader->Source());
 }
 
-Nullable<Vector<String>> WebGLRenderingContextBase::getSupportedExtensions() {
+Optional<Vector<String>> WebGLRenderingContextBase::getSupportedExtensions() {
   if (isContextLost())
-    return nullptr;
+    return WTF::nullopt;
 
   Vector<String> result;
 
@@ -7697,9 +7697,9 @@
   if (framebuffer_binding_) {
     have_stencil_buffer = framebuffer_binding_->HasStencilBuffer();
   } else {
-    Nullable<WebGLContextAttributes> attributes;
+    Optional<WebGLContextAttributes> attributes;
     getContextAttributes(attributes);
-    have_stencil_buffer = !attributes.IsNull() && attributes.Get().stencil();
+    have_stencil_buffer = attributes && attributes->stencil();
   }
   EnableOrDisable(GL_STENCIL_TEST, stencil_enabled_ && have_stencil_buffer);
 }
@@ -7838,18 +7838,18 @@
   int buffer_count = 1;
   buffer_count *= 2;  // WebGL's front and back color buffers.
   int samples = GetDrawingBuffer() ? GetDrawingBuffer()->SampleCount() : 0;
-  Nullable<WebGLContextAttributes> attribs;
+  Optional<WebGLContextAttributes> attribs;
   getContextAttributes(attribs);
-  if (!attribs.IsNull()) {
+  if (attribs) {
     // Handle memory from WebGL multisample and depth/stencil buffers.
     // It is enabled only in case of explicit resolve assuming that there
     // is no memory overhead for MSAA on tile-based GPU arch.
-    if (attribs.Get().antialias() && samples > 0 &&
+    if (attribs->antialias() && samples > 0 &&
         GetDrawingBuffer()->ExplicitResolveOfMultisampleData()) {
-      if (attribs.Get().depth() || attribs.Get().stencil())
+      if (attribs->depth() || attribs->stencil())
         buffer_count += samples;  // depth/stencil multisample buffer
       buffer_count += samples;    // color multisample buffer
-    } else if (attribs.Get().depth() || attribs.Get().stencil()) {
+    } else if (attribs->depth() || attribs->stencil()) {
       buffer_count += 1;  // regular depth/stencil buffer
     }
   }
diff --git a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.h b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.h
index 37b5e02..924d02c51 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.h
+++ b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.h
@@ -28,7 +28,6 @@
 
 #include <memory>
 #include <set>
-#include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/ScriptValue.h"
 #include "core/CoreExport.h"
 #include "core/html/canvas/CanvasContextCreationAttributes.h"
@@ -49,6 +48,7 @@
 #include "platform/graphics/gpu/Extensions3DUtil.h"
 #include "platform/graphics/gpu/WebGLImageConversion.h"
 #include "platform/wtf/CheckedNumeric.h"
+#include "platform/wtf/Optional.h"
 #include "platform/wtf/text/WTFString.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebGraphicsContext3DProvider.h"
@@ -275,10 +275,10 @@
   WebGLActiveInfo* getActiveAttrib(WebGLProgram*, GLuint index);
   WebGLActiveInfo* getActiveUniform(WebGLProgram*, GLuint index);
   bool getAttachedShaders(WebGLProgram*, HeapVector<Member<WebGLShader>>&);
-  Nullable<HeapVector<Member<WebGLShader>>> getAttachedShaders(WebGLProgram*);
+  Optional<HeapVector<Member<WebGLShader>>> getAttachedShaders(WebGLProgram*);
   GLint getAttribLocation(WebGLProgram*, const String& name);
   ScriptValue getBufferParameter(ScriptState*, GLenum target, GLenum pname);
-  void getContextAttributes(Nullable<WebGLContextAttributes>&);
+  void getContextAttributes(Optional<WebGLContextAttributes>&);
   GLenum getError();
   ScriptValue getExtension(ScriptState*, const String& name);
   virtual ScriptValue getFramebufferAttachmentParameter(ScriptState*,
@@ -296,7 +296,7 @@
   WebGLShaderPrecisionFormat* getShaderPrecisionFormat(GLenum shader_type,
                                                        GLenum precision_type);
   String getShaderSource(WebGLShader*);
-  Nullable<Vector<String>> getSupportedExtensions();
+  Optional<Vector<String>> getSupportedExtensions();
   virtual ScriptValue getTexParameter(ScriptState*,
                                       GLenum target,
                                       GLenum pname);
diff --git a/third_party/WebKit/Source/modules/webmidi/MIDIOutput.idl b/third_party/WebKit/Source/modules/webmidi/MIDIOutput.idl
index 6801b98..b8a4e15 100644
--- a/third_party/WebKit/Source/modules/webmidi/MIDIOutput.idl
+++ b/third_party/WebKit/Source/modules/webmidi/MIDIOutput.idl
@@ -32,6 +32,6 @@
 
 interface MIDIOutput : MIDIPort {
     // TODO(toyoshim): implement void clear()
-    [RaisesException] void send(Uint8Array data, optional double timestamp);
-    [RaisesException] void send(sequence<unsigned long> data, optional double timestamp);
+    [RaisesException] void send(Uint8Array data, optional DOMHighResTimeStamp timestamp);
+    [RaisesException] void send(sequence<unsigned long> data, optional DOMHighResTimeStamp timestamp);
 };
diff --git a/third_party/WebKit/Source/modules/websockets/WebSocketHandle.h b/third_party/WebKit/Source/modules/websockets/WebSocketHandle.h
index 08c9ac4..9cd6e799 100644
--- a/third_party/WebKit/Source/modules/websockets/WebSocketHandle.h
+++ b/third_party/WebKit/Source/modules/websockets/WebSocketHandle.h
@@ -32,6 +32,7 @@
 #define WebSocketHandle_h
 
 #include <stdint.h>
+#include "platform/WebTaskRunner.h"
 #include "platform/wtf/Forward.h"
 #include "platform/wtf/Vector.h"
 #include "public/platform/modules/websockets/websocket.mojom-blink.h"
@@ -41,7 +42,6 @@
 class KURL;
 class SecurityOrigin;
 class WebSocketHandleClient;
-class WebTaskRunner;
 
 // WebSocketHandle is an interface class designed to be a handle of WebSocket
 // connection.  WebSocketHandle will be used together with
diff --git a/third_party/WebKit/Source/modules/xr/BUILD.gn b/third_party/WebKit/Source/modules/xr/BUILD.gn
index 815d0ee..4c15178 100644
--- a/third_party/WebKit/Source/modules/xr/BUILD.gn
+++ b/third_party/WebKit/Source/modules/xr/BUILD.gn
@@ -22,6 +22,8 @@
     "XRFrameRequestCallbackCollection.h",
     "XRLayer.cpp",
     "XRLayer.h",
+    "XRPresentationContext.cpp",
+    "XRPresentationContext.h",
     "XRPresentationFrame.cpp",
     "XRPresentationFrame.h",
     "XRSession.cpp",
diff --git a/third_party/WebKit/Source/modules/xr/XRPresentationContext.cpp b/third_party/WebKit/Source/modules/xr/XRPresentationContext.cpp
new file mode 100644
index 0000000..88576bb
--- /dev/null
+++ b/third_party/WebKit/Source/modules/xr/XRPresentationContext.cpp
@@ -0,0 +1,31 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "modules/xr/XRPresentationContext.h"
+
+#include "bindings/modules/v8/rendering_context.h"
+
+namespace blink {
+
+XRPresentationContext::XRPresentationContext(
+    CanvasRenderingContextHost* host,
+    const CanvasContextCreationAttributes& attrs)
+    : ImageBitmapRenderingContextBase(host, attrs) {}
+
+XRPresentationContext::~XRPresentationContext() {}
+
+void XRPresentationContext::SetCanvasGetContextResult(
+    RenderingContext& result) {
+  result.SetXRPresentationContext(this);
+}
+
+CanvasRenderingContext* XRPresentationContext::Factory::Create(
+    CanvasRenderingContextHost* host,
+    const CanvasContextCreationAttributes& attrs) {
+  if (!RuntimeEnabledFeatures::WebXREnabled())
+    return nullptr;
+  return new XRPresentationContext(host, attrs);
+}
+
+}  // namespace blink
diff --git a/third_party/WebKit/Source/modules/xr/XRPresentationContext.h b/third_party/WebKit/Source/modules/xr/XRPresentationContext.h
new file mode 100644
index 0000000..4baaa09
--- /dev/null
+++ b/third_party/WebKit/Source/modules/xr/XRPresentationContext.h
@@ -0,0 +1,58 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef XRPresentationContext_h
+#define XRPresentationContext_h
+
+#include "base/memory/scoped_refptr.h"
+#include "core/html/canvas/CanvasRenderingContextFactory.h"
+#include "modules/ModulesExport.h"
+#include "modules/canvas/imagebitmap/ImageBitmapRenderingContextBase.h"
+
+namespace blink {
+
+class MODULES_EXPORT XRPresentationContext final
+    : public ImageBitmapRenderingContextBase {
+  DEFINE_WRAPPERTYPEINFO();
+
+ public:
+  class Factory : public CanvasRenderingContextFactory {
+    WTF_MAKE_NONCOPYABLE(Factory);
+
+   public:
+    Factory() {}
+    ~Factory() override {}
+
+    CanvasRenderingContext* Create(
+        CanvasRenderingContextHost*,
+        const CanvasContextCreationAttributes&) override;
+    CanvasRenderingContext::ContextType GetContextType() const override {
+      return CanvasRenderingContext::kContextXRPresent;
+    }
+  };
+
+  // CanvasRenderingContext implementation
+  ContextType GetContextType() const override {
+    return CanvasRenderingContext::kContextXRPresent;
+  }
+  void SetCanvasGetContextResult(RenderingContext&) final;
+
+  virtual ~XRPresentationContext();
+
+ private:
+  XRPresentationContext(CanvasRenderingContextHost*,
+                        const CanvasContextCreationAttributes&);
+};
+
+DEFINE_TYPE_CASTS(XRPresentationContext,
+                  CanvasRenderingContext,
+                  context,
+                  context->GetContextType() ==
+                      CanvasRenderingContext::kContextXRPresent,
+                  context.GetContextType() ==
+                      CanvasRenderingContext::kContextXRPresent);
+
+}  // namespace blink
+
+#endif  // XRPresentationContext_h
diff --git a/third_party/WebKit/Source/modules/xr/XRPresentationContext.idl b/third_party/WebKit/Source/modules/xr/XRPresentationContext.idl
new file mode 100644
index 0000000..a4b61afaf
--- /dev/null
+++ b/third_party/WebKit/Source/modules/xr/XRPresentationContext.idl
@@ -0,0 +1,12 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// https://immersive-web.github.io/webxr/spec/latest/#xrpresentationcontext-interface
+[
+    SecureContext,
+    RuntimeEnabled=WebXR
+] interface XRPresentationContext {
+    // back-reference to the canvas
+    readonly attribute HTMLCanvasElement canvas;
+};
\ No newline at end of file
diff --git a/third_party/WebKit/Source/platform/WebFrameScheduler.h b/third_party/WebKit/Source/platform/WebFrameScheduler.h
index b48924fb..75573f61 100644
--- a/third_party/WebKit/Source/platform/WebFrameScheduler.h
+++ b/third_party/WebKit/Source/platform/WebFrameScheduler.h
@@ -6,6 +6,7 @@
 #define WebFrameScheduler_h
 
 #include "base/memory/scoped_refptr.h"
+#include "base/single_thread_task_runner.h"
 #include "public/platform/TaskType.h"
 #include "public/platform/WebScopedVirtualTimePauser.h"
 
@@ -13,7 +14,6 @@
 
 namespace blink {
 
-class WebTaskRunner;
 class WebViewScheduler;
 
 class WebFrameScheduler {
@@ -116,8 +116,9 @@
   // Note: old-style timer task runner corresponds to throttleable task runner
   // and unthrottled task runner corresponds to pausable task runner.
 
-  // Returns a WebTaskRunner that is suitable with the given task type.
-  virtual scoped_refptr<WebTaskRunner> GetTaskRunner(TaskType) = 0;
+  // Returns a task runner that is suitable with the given task type.
+  virtual scoped_refptr<base::SingleThreadTaskRunner> GetTaskRunner(
+      TaskType) = 0;
 
   // Returns the parent WebViewScheduler.
   virtual WebViewScheduler* GetWebViewScheduler() const = 0;
diff --git a/third_party/WebKit/Source/platform/WebTaskRunner.cpp b/third_party/WebKit/Source/platform/WebTaskRunner.cpp
index 13d7d31..a4e043d 100644
--- a/third_party/WebKit/Source/platform/WebTaskRunner.cpp
+++ b/third_party/WebKit/Source/platform/WebTaskRunner.cpp
@@ -112,13 +112,6 @@
   DCHECK(runner_);
 }
 
-void WebTaskRunner::PostTask(const base::Location& location,
-                             base::OnceClosure task) {
-  PostDelayedTask(location, std::move(task), base::TimeDelta());
-}
-
-WebTaskRunner::~WebTaskRunner() = default;
-
 // Use a custom function for base::Bind instead of WTF::Bind to
 // avoid copying the closure later in the call chain. Copying the bound state
 // can lead to data races with ref counted objects like StringImpl. See
diff --git a/third_party/WebKit/Source/platform/WebTaskRunner.h b/third_party/WebKit/Source/platform/WebTaskRunner.h
index 8839f0f..c4e4767 100644
--- a/third_party/WebKit/Source/platform/WebTaskRunner.h
+++ b/third_party/WebKit/Source/platform/WebTaskRunner.h
@@ -15,13 +15,11 @@
 #include "platform/wtf/Time.h"
 #include "public/platform/WebCommon.h"
 
-namespace base {
-class SingleThreadTaskRunner;
-}
-
 namespace blink {
 
-class WebTaskRunner;
+// TODO(yutak): WebTaskRunner is soon to be deprecated. Use
+// base::SingleThreadTaskRunner instead. See: http://crbug.com/794845
+using WebTaskRunner = base::SingleThreadTaskRunner;
 
 // TaskHandle is associated to a task posted by
 // WebTaskRunner::postCancellableTask or
@@ -62,28 +60,6 @@
   scoped_refptr<Runner> runner_;
 };
 
-// The blink representation of a chromium SingleThreadTaskRunner.
-class BLINK_PLATFORM_EXPORT WebTaskRunner
-    : public base::SingleThreadTaskRunner {
- public:
-  virtual bool PostDelayedTask(const base::Location&,
-                               base::OnceClosure,
-                               base::TimeDelta) = 0;
-
-  // Helpers for posting bound functions as tasks.
-
-  // For same-thread posting. Must be called from the associated WebThread.
-  void PostTask(const base::Location&, base::OnceClosure);
-
- protected:
-  friend ThreadSafeRefCounted<WebTaskRunner>;
-  WebTaskRunner() = default;
-  virtual ~WebTaskRunner();
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(WebTaskRunner);
-};
-
 // For cross-thread posting. Can be called from any thread.
 BLINK_PLATFORM_EXPORT void PostCrossThreadTask(WebTaskRunner&,
                                                const base::Location&,
diff --git a/third_party/WebKit/Source/platform/WebThread.cpp b/third_party/WebKit/Source/platform/WebThread.cpp
index b5dd34cb..ae73508 100644
--- a/third_party/WebKit/Source/platform/WebThread.cpp
+++ b/third_party/WebKit/Source/platform/WebThread.cpp
@@ -6,7 +6,6 @@
 
 #include "base/single_thread_task_runner.h"
 #include "build/build_config.h"
-#include "platform/WebTaskRunner.h"
 #include "platform/wtf/Assertions.h"
 
 #if defined(OS_WIN)
diff --git a/third_party/WebKit/Source/platform/WebThreadSupportingGC.h b/third_party/WebKit/Source/platform/WebThreadSupportingGC.h
index 8abe45d..a4af7ce 100644
--- a/third_party/WebKit/Source/platform/WebThreadSupportingGC.h
+++ b/third_party/WebKit/Source/platform/WebThreadSupportingGC.h
@@ -6,7 +6,6 @@
 #define WebThreadSupportingGC_h
 
 #include <memory>
-#include "platform/WebTaskRunner.h"
 #include "platform/heap/GCTaskRunner.h"
 #include "platform/wtf/Allocator.h"
 #include "platform/wtf/Noncopyable.h"
diff --git a/third_party/WebKit/Source/platform/bindings/TraceWrapperMember.h b/third_party/WebKit/Source/platform/bindings/TraceWrapperMember.h
index c13e7967..f52d103 100644
--- a/third_party/WebKit/Source/platform/bindings/TraceWrapperMember.h
+++ b/third_party/WebKit/Source/platform/bindings/TraceWrapperMember.h
@@ -89,13 +89,21 @@
   }
 }
 
+// HeapVectorBacking<TraceWrapperMember<T>> need to map to
+// HeapVectorBacking<Member<T>> for performing the swap method below.
+template <typename T, typename Traits>
+struct GCInfoTrait<HeapVectorBacking<TraceWrapperMember<T>, Traits>>
+    : public GCInfoTrait<
+          HeapVectorBacking<Member<T>, WTF::VectorTraits<Member<T>>>> {};
+
 // Swaps two HeapVectors, one containing TraceWrapperMember and one with
 // regular Members. The custom swap function is required as TraceWrapperMember
 // potentially requires emitting a write barrier.
 template <typename T>
 void swap(HeapVector<TraceWrapperMember<T>>& a, HeapVector<Member<T>>& b) {
   // HeapVector<Member<T>> and HeapVector<TraceWrapperMember<T>> have the
-  // same size and semantics.
+  // same size and semantics. This cast and swap assumes that GCInfo for both
+  // TraceWrapperMember and Member match in vector backings.
   HeapVector<Member<T>>& a_ = reinterpret_cast<HeapVector<Member<T>>&>(a);
   a_.swap(b);
   if (ThreadState::Current()->WrapperTracingInProgress()) {
diff --git a/third_party/WebKit/Source/platform/graphics/AcceleratedStaticBitmapImage.h b/third_party/WebKit/Source/platform/graphics/AcceleratedStaticBitmapImage.h
index 749a5483..5c05a21 100644
--- a/third_party/WebKit/Source/platform/graphics/AcceleratedStaticBitmapImage.h
+++ b/third_party/WebKit/Source/platform/graphics/AcceleratedStaticBitmapImage.h
@@ -5,12 +5,14 @@
 #ifndef AcceleratedStaticBitmapImage_h
 #define AcceleratedStaticBitmapImage_h
 
+#include <memory>
+
 #include "base/memory/weak_ptr.h"
 #include "base/threading/thread_checker.h"
+#include "platform/WebTaskRunner.h"
 #include "platform/graphics/StaticBitmapImage.h"
 #include "platform/graphics/TextureHolder.h"
 
-#include <memory>
 
 class GrContext;
 
diff --git a/third_party/WebKit/Source/platform/graphics/OffscreenCanvasPlaceholder.h b/third_party/WebKit/Source/platform/graphics/OffscreenCanvasPlaceholder.h
index fbccca2..0f489d6 100644
--- a/third_party/WebKit/Source/platform/graphics/OffscreenCanvasPlaceholder.h
+++ b/third_party/WebKit/Source/platform/graphics/OffscreenCanvasPlaceholder.h
@@ -9,12 +9,12 @@
 #include "base/memory/scoped_refptr.h"
 #include "base/memory/weak_ptr.h"
 #include "platform/PlatformExport.h"
+#include "platform/WebTaskRunner.h"
 
 namespace blink {
 
 class OffscreenCanvasFrameDispatcher;
 class StaticBitmapImage;
-class WebTaskRunner;
 
 class PLATFORM_EXPORT OffscreenCanvasPlaceholder {
  public:
diff --git a/third_party/WebKit/Source/platform/graphics/Path.h b/third_party/WebKit/Source/platform/graphics/Path.h
index c159be61..e657589 100644
--- a/third_party/WebKit/Source/platform/graphics/Path.h
+++ b/third_party/WebKit/Source/platform/graphics/Path.h
@@ -35,6 +35,7 @@
 #include "platform/graphics/GraphicsTypes.h"
 #include "platform/wtf/Allocator.h"
 #include "platform/wtf/Forward.h"
+#include "platform/wtf/RefCounted.h"
 #include "third_party/skia/include/core/SkPath.h"
 #include "third_party/skia/include/core/SkPathMeasure.h"
 
@@ -198,6 +199,11 @@
   SkPath path_;
 };
 
+class PLATFORM_EXPORT RefCountedPath : public Path,
+                                       public RefCounted<RefCountedPath> {
+  USING_FAST_MALLOC(RefCountedPath);
+};
+
 // Only used for DCHECKs
 PLATFORM_EXPORT bool EllipseIsRenderable(float start_angle, float end_angle);
 
diff --git a/third_party/WebKit/Source/platform/graphics/SurfaceLayerBridge.cpp b/third_party/WebKit/Source/platform/graphics/SurfaceLayerBridge.cpp
index b0a2130c..8a723109 100644
--- a/third_party/WebKit/Source/platform/graphics/SurfaceLayerBridge.cpp
+++ b/third_party/WebKit/Source/platform/graphics/SurfaceLayerBridge.cpp
@@ -71,7 +71,8 @@
     }
 
     scoped_refptr<cc::SurfaceLayer> surface_layer = cc::SurfaceLayer::Create();
-    surface_layer->SetPrimarySurfaceId(surface_info.id(), base::nullopt);
+    surface_layer->SetPrimarySurfaceId(
+        surface_info.id(), cc::DeadlinePolicy::UseDefaultDeadline());
     surface_layer->SetFallbackSurfaceId(surface_info.id());
     surface_layer->SetStretchContentToFillBounds(true);
     surface_layer->SetIsDrawable(true);
@@ -88,7 +89,8 @@
     current_surface_id_ = surface_info.id();
     cc::SurfaceLayer* surface_layer =
         static_cast<cc::SurfaceLayer*>(cc_layer_.get());
-    surface_layer->SetPrimarySurfaceId(surface_info.id(), base::nullopt);
+    surface_layer->SetPrimarySurfaceId(
+        surface_info.id(), cc::DeadlinePolicy::UseDefaultDeadline());
     surface_layer->SetFallbackSurfaceId(surface_info.id());
   }
 
diff --git a/third_party/WebKit/Source/platform/graphics/compositing/PaintArtifactCompositor.cpp b/third_party/WebKit/Source/platform/graphics/compositing/PaintArtifactCompositor.cpp
index c3b58094..161516a 100644
--- a/third_party/WebKit/Source/platform/graphics/compositing/PaintArtifactCompositor.cpp
+++ b/third_party/WebKit/Source/platform/graphics/compositing/PaintArtifactCompositor.cpp
@@ -569,18 +569,35 @@
     layer_->SetIsDrawable(true);
   }
 
-  void Update(const FloatRoundedRect& rrect) {
+  void Update(const FloatRoundedRect& rrect,
+              scoped_refptr<const RefCountedPath> path) {
     IntRect layer_bounds = EnclosingIntRect(rrect.Rect());
-    layer_->set_offset_to_transform_parent(
-        gfx::Vector2dF(layer_bounds.X(), layer_bounds.Y()));
+    gfx::Vector2dF new_layer_origin(layer_bounds.X(), layer_bounds.Y());
+
+    SkRRect new_local_rrect = rrect;
+    new_local_rrect.offset(-new_layer_origin.x(), -new_layer_origin.y());
+
+    bool path_in_layer_changed = false;
+    if (path_ == path) {
+      path_in_layer_changed = path && layer_origin_ != new_layer_origin;
+    } else if (!path_ || !path) {
+      path_in_layer_changed = true;
+    } else {
+      SkPath new_path = path->GetSkPath();
+      new_path.offset(layer_origin_.x() - new_layer_origin.x(),
+                      layer_origin_.y() - new_layer_origin.y());
+      path_in_layer_changed = path_->GetSkPath() != new_path;
+    }
+
+    if (local_rrect_ != new_local_rrect || path_in_layer_changed) {
+      layer_->SetNeedsDisplay();
+    }
+    layer_->set_offset_to_transform_parent(new_layer_origin);
     layer_->SetBounds(gfx::Size(layer_bounds.Width(), layer_bounds.Height()));
 
-    SkRRect new_rrect(rrect);
-    new_rrect.offset(-layer_bounds.X(), -layer_bounds.Y());
-    if (rrect_ == new_rrect)
-      return;
-    rrect_ = new_rrect;
-    layer_->SetNeedsDisplay();
+    layer_origin_ = new_layer_origin;
+    local_rrect_ = new_local_rrect;
+    path_ = std::move(path);
   }
 
   cc::Layer* GetLayer() const { return layer_.get(); }
@@ -597,10 +614,21 @@
       PaintingControlSetting) final {
     auto cc_list = base::MakeRefCounted<cc::DisplayItemList>(
         cc::DisplayItemList::kTopLevelDisplayItemList);
-    cc_list->StartPaint();
     cc::PaintFlags flags;
     flags.setAntiAlias(true);
-    cc_list->push<cc::DrawRRectOp>(rrect_, flags);
+    cc_list->StartPaint();
+    if (!path_) {
+      cc_list->push<cc::DrawRRectOp>(local_rrect_, flags);
+    } else {
+      cc_list->push<cc::SaveOp>();
+      cc_list->push<cc::TranslateOp>(-layer_origin_.x(), -layer_origin_.x());
+      cc_list->push<cc::ClipPathOp>(path_->GetSkPath(), SkClipOp::kIntersect,
+                                    true);
+      SkRRect rrect = local_rrect_;
+      rrect.offset(layer_origin_.x(), layer_origin_.y());
+      cc_list->push<cc::DrawRRectOp>(rrect, flags);
+      cc_list->push<cc::RestoreOp>();
+    }
     cc_list->EndPaintOfUnpaired(gfx::Rect(layer_->bounds()));
     cc_list->Finalize();
     return cc_list;
@@ -608,7 +636,9 @@
 
  private:
   scoped_refptr<cc::PictureLayer> layer_;
-  SkRRect rrect_ = SkRRect::MakeEmpty();
+  gfx::Vector2dF layer_origin_;
+  SkRRect local_rrect_ = SkRRect::MakeEmpty();
+  scoped_refptr<const RefCountedPath> path_;
   CompositorElementId mask_isolation_id_;
   CompositorElementId mask_effect_id_;
 };
@@ -628,7 +658,7 @@
 
   entry->in_use = true;
   SynthesizedClip& synthesized_clip = *entry->synthesized_clip;
-  synthesized_clip.Update(node->ClipRect());
+  synthesized_clip.Update(node->ClipRect(), node->ClipPath());
   mask_isolation_id = synthesized_clip.GetMaskIsolationId();
   mask_effect_id = synthesized_clip.GetMaskEffectId();
   return synthesized_clip.GetLayer();
diff --git a/third_party/WebKit/Source/platform/graphics/compositing/PaintArtifactCompositorTest.cpp b/third_party/WebKit/Source/platform/graphics/compositing/PaintArtifactCompositorTest.cpp
index 32aebf6..83227c2 100644
--- a/third_party/WebKit/Source/platform/graphics/compositing/PaintArtifactCompositorTest.cpp
+++ b/third_party/WebKit/Source/platform/graphics/compositing/PaintArtifactCompositorTest.cpp
@@ -544,11 +544,11 @@
 TEST_F(PaintArtifactCompositorTest, NestedClips) {
   scoped_refptr<ClipPaintPropertyNode> clip1 = ClipPaintPropertyNode::Create(
       ClipPaintPropertyNode::Root(), TransformPaintPropertyNode::Root(),
-      FloatRoundedRect(100, 100, 700, 700), nullptr,
+      FloatRoundedRect(100, 100, 700, 700), nullptr, nullptr,
       CompositingReason::kOverflowScrollingTouch);
   scoped_refptr<ClipPaintPropertyNode> clip2 = ClipPaintPropertyNode::Create(
       clip1, TransformPaintPropertyNode::Root(),
-      FloatRoundedRect(200, 200, 700, 700), nullptr,
+      FloatRoundedRect(200, 200, 700, 700), nullptr, nullptr,
       CompositingReason::kOverflowScrollingTouch);
 
   TestPaintArtifact artifact;
@@ -2590,7 +2590,7 @@
   FloatRoundedRect rrect(FloatRect(50, 50, 300, 200), corner, corner, corner,
                          corner);
   scoped_refptr<ClipPaintPropertyNode> c1 = ClipPaintPropertyNode::Create(
-      c0(), t0(), rrect, nullptr,
+      c0(), t0(), rrect, nullptr, nullptr,
       CompositingReason::kWillChangeCompositingHint);
 
   TestPaintArtifact artifact;
@@ -2635,6 +2635,65 @@
   EXPECT_EQ(SkBlendMode::kDstIn, mask_effect_0.blend_mode);
 }
 
+TEST_F(PaintArtifactCompositorTest,
+       SynthesizedClipIndirectlyCompositedClipPath) {
+  // This tests the case that a clip node needs to be synthesized due to
+  // applying clip path to a composited effect.
+  FloatRoundedRect clip_rect(50, 50, 300, 200);
+  scoped_refptr<RefCountedPath> clip_path = base::AdoptRef(new RefCountedPath);
+  scoped_refptr<ClipPaintPropertyNode> c1 =
+      ClipPaintPropertyNode::Create(c0(), t0(), clip_rect, nullptr, clip_path);
+  scoped_refptr<EffectPaintPropertyNode> e1 = EffectPaintPropertyNode::Create(
+      e0(), t0(), c1, ColorFilter(), CompositorFilterOperations(), 1,
+      SkBlendMode::kSrcOver, CompositingReason::kWillChangeCompositingHint);
+
+  TestPaintArtifact artifact;
+  artifact.Chunk(t0(), c1, e1)
+      .RectDrawing(FloatRect(0, 0, 100, 100), Color::kBlack);
+  Update(artifact.Build());
+
+  // Expectation in effect stack diagram:
+  //   l0         l1
+  // [ e1 ][ mask_effect_0 ]
+  // [  mask_isolation_0   ]
+  // [         e0          ]
+  // One content layer, one clip mask.
+  ASSERT_EQ(2u, RootLayer()->children().size());
+  ASSERT_EQ(1u, ContentLayerCount());
+  ASSERT_EQ(1u, SynthesizedClipLayerCount());
+
+  const cc::Layer* content0 = RootLayer()->children()[0].get();
+  const cc::Layer* clip_mask0 = RootLayer()->children()[1].get();
+
+  constexpr int c0_id = 1;
+  constexpr int e0_id = 1;
+
+  EXPECT_EQ(ContentLayerAt(0), content0);
+  int c1_id = content0->clip_tree_index();
+  const cc::ClipNode& cc_c1 = *GetPropertyTrees().clip_tree.Node(c1_id);
+  EXPECT_EQ(gfx::RectF(50, 50, 300, 200), cc_c1.clip);
+  ASSERT_EQ(c0_id, cc_c1.parent_id);
+  int e1_id = content0->effect_tree_index();
+  const cc::EffectNode& cc_e1 = *GetPropertyTrees().effect_tree.Node(e1_id);
+  EXPECT_EQ(c1_id, cc_e1.clip_id);
+  int mask_isolation_0_id = cc_e1.parent_id;
+  const cc::EffectNode& mask_isolation_0 =
+      *GetPropertyTrees().effect_tree.Node(mask_isolation_0_id);
+  ASSERT_EQ(e0_id, mask_isolation_0.parent_id);
+  EXPECT_EQ(c1_id, mask_isolation_0.clip_id);
+  EXPECT_EQ(SkBlendMode::kSrcOver, mask_isolation_0.blend_mode);
+
+  EXPECT_EQ(SynthesizedClipLayerAt(0), clip_mask0);
+  EXPECT_EQ(gfx::Size(300, 200), clip_mask0->bounds());
+  EXPECT_EQ(c1_id, clip_mask0->clip_tree_index());
+  int mask_effect_0_id = clip_mask0->effect_tree_index();
+  const cc::EffectNode& mask_effect_0 =
+      *GetPropertyTrees().effect_tree.Node(mask_effect_0_id);
+  ASSERT_EQ(mask_isolation_0_id, mask_effect_0.parent_id);
+  EXPECT_EQ(c1_id, mask_effect_0.clip_id);
+  EXPECT_EQ(SkBlendMode::kDstIn, mask_effect_0.blend_mode);
+}
+
 TEST_F(PaintArtifactCompositorTest, SynthesizedClipContiguous) {
   // This tests the case that a two back-to-back composited layers having
   // the same composited rounded clip can share the synthesized mask.
@@ -2647,7 +2706,7 @@
   FloatRoundedRect rrect(FloatRect(50, 50, 300, 200), corner, corner, corner,
                          corner);
   scoped_refptr<ClipPaintPropertyNode> c1 = ClipPaintPropertyNode::Create(
-      c0(), t0(), rrect, nullptr,
+      c0(), t0(), rrect, nullptr, nullptr,
       CompositingReason::kWillChangeCompositingHint);
 
   TestPaintArtifact artifact;
@@ -2719,7 +2778,7 @@
   FloatRoundedRect rrect(FloatRect(50, 50, 300, 200), corner, corner, corner,
                          corner);
   scoped_refptr<ClipPaintPropertyNode> c1 = ClipPaintPropertyNode::Create(
-      c0(), t0(), rrect, nullptr,
+      c0(), t0(), rrect, nullptr, nullptr,
       CompositingReason::kWillChangeCompositingHint);
 
   TestPaintArtifact artifact;
@@ -2809,7 +2868,7 @@
   FloatRoundedRect rrect(FloatRect(50, 50, 300, 200), corner, corner, corner,
                          corner);
   scoped_refptr<ClipPaintPropertyNode> c1 = ClipPaintPropertyNode::Create(
-      c0(), t0(), rrect, nullptr,
+      c0(), t0(), rrect, nullptr, nullptr,
       CompositingReason::kWillChangeCompositingHint);
 
   scoped_refptr<EffectPaintPropertyNode> e1 = EffectPaintPropertyNode::Create(
@@ -2882,7 +2941,7 @@
   FloatRoundedRect rrect(FloatRect(50, 50, 300, 200), corner, corner, corner,
                          corner);
   scoped_refptr<ClipPaintPropertyNode> c1 = ClipPaintPropertyNode::Create(
-      c0(), t0(), rrect, nullptr,
+      c0(), t0(), rrect, nullptr, nullptr,
       CompositingReason::kWillChangeCompositingHint);
 
   CompositorFilterOperations non_trivial_filter;
@@ -2989,7 +3048,7 @@
   FloatRoundedRect rrect(FloatRect(50, 50, 300, 200), corner, corner, corner,
                          corner);
   scoped_refptr<ClipPaintPropertyNode> c1 = ClipPaintPropertyNode::Create(
-      c0(), t0(), rrect, nullptr,
+      c0(), t0(), rrect, nullptr, nullptr,
       CompositingReason::kWillChangeCompositingHint);
 
   scoped_refptr<EffectPaintPropertyNode> e1 = EffectPaintPropertyNode::Create(
diff --git a/third_party/WebKit/Source/platform/graphics/compositing/PaintChunksToCcLayer.cpp b/third_party/WebKit/Source/platform/graphics/compositing/PaintChunksToCcLayer.cpp
index 63512cf..40922e7 100644
--- a/third_party/WebKit/Source/platform/graphics/compositing/PaintChunksToCcLayer.cpp
+++ b/third_party/WebKit/Source/platform/graphics/compositing/PaintChunksToCcLayer.cpp
@@ -224,6 +224,10 @@
       cc_list_.push<cc::ClipRRectOp>(static_cast<SkRRect>(sub_clip->ClipRect()),
                                      SkClipOp::kIntersect, true);
     }
+    if (sub_clip->ClipPath()) {
+      cc_list_.push<cc::ClipPathOp>(sub_clip->ClipPath()->GetSkPath(),
+                                    SkClipOp::kIntersect, true);
+    }
     cc_list_.EndPaintOfPairedBegin();
 
     // Step 3b: Adjust state and push previous state onto clip stack.
diff --git a/third_party/WebKit/Source/platform/graphics/compositing/PaintChunksToCcLayerTest.cpp b/third_party/WebKit/Source/platform/graphics/compositing/PaintChunksToCcLayerTest.cpp
index 300d433c..ca0a282 100644
--- a/third_party/WebKit/Source/platform/graphics/compositing/PaintChunksToCcLayerTest.cpp
+++ b/third_party/WebKit/Source/platform/graphics/compositing/PaintChunksToCcLayerTest.cpp
@@ -32,7 +32,8 @@
 };
 
 // A simple matcher that only looks for a few ops, ignoring all else.
-// Recognized ops: ClipRect, Concat, DrawRecord, Save, SaveLayer, Restore.
+// Recognized ops:
+//   ClipPath, ClipRect, Concat, DrawRecord, Save, SaveLayer, Restore.
 class PaintRecordMatcher
     : public ::testing::MatcherInterface<const cc::PaintOpBuffer&> {
  public:
@@ -51,6 +52,7 @@
     for (cc::PaintOpBuffer::Iterator it(&buffer); it; ++it, ++op_idx) {
       cc::PaintOpType op = (*it)->GetType();
       switch (op) {
+        case cc::PaintOpType::ClipPath:
         case cc::PaintOpType::ClipRect:
         case cc::PaintOpType::Concat:
         case cc::PaintOpType::DrawRecord:
@@ -522,5 +524,29 @@
                    cc::PaintOpType::Restore})));  // </layer_offset>
 }
 
+TEST_F(PaintChunksToCcLayerTest, NoncompositedClipPath) {
+  scoped_refptr<RefCountedPath> clip_path = base::AdoptRef(new RefCountedPath);
+  auto c1 = ClipPaintPropertyNode::Create(
+      c0(), t0(), FloatRoundedRect(25.f, 25.f, 100.f, 100.f), nullptr,
+      clip_path);
+
+  TestChunks chunks;
+  chunks.AddChunk(t0(), c1.get(), e0());
+
+  auto cc_list = base::MakeRefCounted<cc::DisplayItemList>(
+      cc::DisplayItemList::kTopLevelDisplayItemList);
+  PaintChunksToCcLayer::ConvertInto(chunks.GetChunkList(),
+                                    PropertyTreeState(t0(), c0(), e0()),
+                                    gfx::Vector2dF(), chunks.items, *cc_list);
+
+  EXPECT_THAT(cc_list->ReleaseAsRecord(),
+              Pointee(PaintRecordMatcher::Make(
+                  {cc::PaintOpType::Save,         //
+                   cc::PaintOpType::ClipRect,     //
+                   cc::PaintOpType::ClipPath,     // <clip_path>
+                   cc::PaintOpType::DrawRecord,   // <p0/>
+                   cc::PaintOpType::Restore})));  // </clip_path>
+}
+
 }  // namespace
 }  // namespace blink
diff --git a/third_party/WebKit/Source/platform/graphics/compositing/PropertyTreeManager.cpp b/third_party/WebKit/Source/platform/graphics/compositing/PropertyTreeManager.cpp
index 1bf701c..74e91cd3 100644
--- a/third_party/WebKit/Source/platform/graphics/compositing/PropertyTreeManager.cpp
+++ b/third_party/WebKit/Source/platform/graphics/compositing/PropertyTreeManager.cpp
@@ -481,7 +481,8 @@
   Vector<const ClipPaintPropertyNode*> pending_clips;
   for (; target_clip != current_clip_; target_clip = target_clip->Parent()) {
     DCHECK(target_clip);
-    bool should_synthesize = target_clip->ClipRect().IsRounded();
+    bool should_synthesize =
+        target_clip->ClipRect().IsRounded() || target_clip->ClipPath();
     if (should_synthesize)
       pending_clips.push_back(target_clip);
   }
diff --git a/third_party/WebKit/Source/platform/graphics/paint/ClipPaintPropertyNode.cpp b/third_party/WebKit/Source/platform/graphics/paint/ClipPaintPropertyNode.cpp
index 85b3e8a0..51edf34e 100644
--- a/third_party/WebKit/Source/platform/graphics/paint/ClipPaintPropertyNode.cpp
+++ b/third_party/WebKit/Source/platform/graphics/paint/ClipPaintPropertyNode.cpp
@@ -28,6 +28,9 @@
     json->SetString("rectExcludingOverlayScrollbars",
                     clip_rect_excluding_overlay_scrollbars_.ToString());
   }
+  if (clip_path_) {
+    json->SetBoolean("hasClipPath", true);
+  }
   if (direct_compositing_reasons_ != CompositingReason::kNone) {
     json->SetString("directCompositingReasons",
                     CompositingReason::ToString(direct_compositing_reasons_));
diff --git a/third_party/WebKit/Source/platform/graphics/paint/ClipPaintPropertyNode.h b/third_party/WebKit/Source/platform/graphics/paint/ClipPaintPropertyNode.h
index 0137475..9826d73 100644
--- a/third_party/WebKit/Source/platform/graphics/paint/ClipPaintPropertyNode.h
+++ b/third_party/WebKit/Source/platform/graphics/paint/ClipPaintPropertyNode.h
@@ -7,6 +7,7 @@
 
 #include "platform/PlatformExport.h"
 #include "platform/geometry/FloatRoundedRect.h"
+#include "platform/graphics/Path.h"
 #include "platform/graphics/paint/GeometryMapperClipCache.h"
 #include "platform/graphics/paint/PaintPropertyNode.h"
 #include "platform/graphics/paint/TransformPaintPropertyNode.h"
@@ -36,6 +37,7 @@
       scoped_refptr<const TransformPaintPropertyNode> local_transform_space,
       const FloatRoundedRect& clip_rect,
       const FloatRoundedRect* clip_rect_excluding_overlay_scrollbars = nullptr,
+      scoped_refptr<const RefCountedPath> clip_path = nullptr,
       CompositingReasons direct_compositing_reasons =
           CompositingReason::kNone) {
     return base::AdoptRef(new ClipPaintPropertyNode(
@@ -43,22 +45,23 @@
         clip_rect_excluding_overlay_scrollbars
             ? *clip_rect_excluding_overlay_scrollbars
             : clip_rect,
-        direct_compositing_reasons));
+        std::move(clip_path), direct_compositing_reasons));
   }
 
   bool Update(
       scoped_refptr<const ClipPaintPropertyNode> parent,
       scoped_refptr<const TransformPaintPropertyNode> local_transform_space,
       const FloatRoundedRect& clip_rect,
-      const FloatRoundedRect* clip_rect_excluding_overlay_scrollbars =
-          nullptr) {
+      const FloatRoundedRect* clip_rect_excluding_overlay_scrollbars = nullptr,
+      scoped_refptr<const RefCountedPath> clip_path = nullptr) {
     bool parent_changed = PaintPropertyNode::Update(std::move(parent));
 
     if (local_transform_space == local_transform_space_ &&
         clip_rect == clip_rect_ &&
         (!clip_rect_excluding_overlay_scrollbars ||
          *clip_rect_excluding_overlay_scrollbars ==
-             clip_rect_excluding_overlay_scrollbars_))
+             clip_rect_excluding_overlay_scrollbars_) &&
+        clip_path == clip_path_)
       return parent_changed;
 
     SetChanged();
@@ -68,6 +71,7 @@
         clip_rect_excluding_overlay_scrollbars
             ? *clip_rect_excluding_overlay_scrollbars
             : clip_rect;
+    clip_path_ = std::move(clip_path);
     return true;
   }
 
@@ -79,13 +83,15 @@
     return clip_rect_excluding_overlay_scrollbars_;
   }
 
+  const RefCountedPath* ClipPath() const { return clip_path_.get(); }
+
 #if DCHECK_IS_ON()
   // The clone function is used by FindPropertiesNeedingUpdate.h for recording
   // a clip node before it has been updated, to later detect changes.
   scoped_refptr<ClipPaintPropertyNode> Clone() const {
-    return base::AdoptRef(
-        new ClipPaintPropertyNode(Parent(), local_transform_space_, clip_rect_,
-                                  clip_rect_, direct_compositing_reasons_));
+    return base::AdoptRef(new ClipPaintPropertyNode(
+        Parent(), local_transform_space_, clip_rect_, clip_rect_, clip_path_,
+        direct_compositing_reasons_));
   }
 
   // The equality operator is used by FindPropertiesNeedingUpdate.h for checking
@@ -93,7 +99,7 @@
   bool operator==(const ClipPaintPropertyNode& o) const {
     return Parent() == o.Parent() &&
            local_transform_space_ == o.local_transform_space_ &&
-           clip_rect_ == o.clip_rect_ &&
+           clip_rect_ == o.clip_rect_ && clip_path_ == o.clip_path_ &&
            direct_compositing_reasons_ == o.direct_compositing_reasons_;
   }
 
@@ -112,12 +118,14 @@
       scoped_refptr<const TransformPaintPropertyNode> local_transform_space,
       const FloatRoundedRect& clip_rect,
       const FloatRoundedRect& clip_rect_excluding_overlay_scrollbars,
+      scoped_refptr<const RefCountedPath> clip_path,
       CompositingReasons direct_compositing_reasons)
       : PaintPropertyNode(std::move(parent)),
         local_transform_space_(std::move(local_transform_space)),
         clip_rect_(clip_rect),
         clip_rect_excluding_overlay_scrollbars_(
             clip_rect_excluding_overlay_scrollbars),
+        clip_path_(clip_path),
         direct_compositing_reasons_(direct_compositing_reasons) {}
 
   // For access to GetClipCache();
@@ -137,6 +145,7 @@
   scoped_refptr<const TransformPaintPropertyNode> local_transform_space_;
   FloatRoundedRect clip_rect_;
   FloatRoundedRect clip_rect_excluding_overlay_scrollbars_;
+  scoped_refptr<const RefCountedPath> clip_path_;
   CompositingReasons direct_compositing_reasons_;
 
   std::unique_ptr<GeometryMapperClipCache> geometry_mapper_clip_cache_;
diff --git a/third_party/WebKit/Source/platform/heap/Heap.cpp b/third_party/WebKit/Source/platform/heap/Heap.cpp
index 404fed6..b1d19e7 100644
--- a/third_party/WebKit/Source/platform/heap/Heap.cpp
+++ b/third_party/WebKit/Source/platform/heap/Heap.cpp
@@ -520,8 +520,6 @@
 void ThreadHeap::VisitPersistentRoots(Visitor* visitor) {
   DCHECK(thread_state_->IsInGC());
   TRACE_EVENT0("blink_gc", "ThreadHeap::visitPersistentRoots");
-  ProcessHeap::GetCrossThreadPersistentRegion().TracePersistentNodes(visitor);
-
   thread_state_->VisitPersistents(visitor);
 }
 
@@ -657,8 +655,7 @@
 
 #if defined(ADDRESS_SANITIZER)
 void ThreadHeap::PoisonAllHeaps() {
-  CrossThreadPersistentRegion::LockScope persistent_lock(
-      ProcessHeap::GetCrossThreadPersistentRegion());
+  MutexLocker persistent_lock(ProcessHeap::CrossThreadPersistentMutex());
   // Poisoning all unmarked objects in the other arenas.
   for (int i = 1; i < BlinkGC::kNumberOfArenas; i++)
     arenas_[i]->PoisonArena();
@@ -670,8 +667,7 @@
 }
 
 void ThreadHeap::PoisonEagerArena() {
-  CrossThreadPersistentRegion::LockScope persistent_lock(
-      ProcessHeap::GetCrossThreadPersistentRegion());
+  MutexLocker persistent_lock(ProcessHeap::CrossThreadPersistentMutex());
   arenas_[BlinkGC::kEagerSweepArenaIndex]->PoisonArena();
   // CrossThreadPersistents in unmarked objects may be accessed from other
   // threads (e.g. in CrossThreadPersistentRegion::shouldTracePersistent) and
diff --git a/third_party/WebKit/Source/platform/heap/Heap.h b/third_party/WebKit/Source/platform/heap/Heap.h
index 48be943a..11663bc0 100644
--- a/third_party/WebKit/Source/platform/heap/Heap.h
+++ b/third_party/WebKit/Source/platform/heap/Heap.h
@@ -45,6 +45,7 @@
 #include "platform/wtf/AddressSanitizer.h"
 #include "platform/wtf/Allocator.h"
 #include "platform/wtf/Assertions.h"
+#include "platform/wtf/Atomics.h"
 #include "platform/wtf/Forward.h"
 
 namespace blink {
diff --git a/third_party/WebKit/Source/platform/heap/HeapAllocator.h b/third_party/WebKit/Source/platform/heap/HeapAllocator.h
index 9a1d8dde..56d00336 100644
--- a/third_party/WebKit/Source/platform/heap/HeapAllocator.h
+++ b/third_party/WebKit/Source/platform/heap/HeapAllocator.h
@@ -279,6 +279,16 @@
 #endif  // BUILDFLAG(BLINK_HEAP_INCREMENTAL_MARKING)
   }
 
+  template <typename T, typename VisitorDispatcher>
+  static void TraceVectorBacking(VisitorDispatcher visitor,
+                                 T* backing,
+                                 T** backing_slot) {
+    HeapVectorBacking<T>* vector_backing =
+        reinterpret_cast<HeapVectorBacking<T>*>(backing);
+    visitor->RegisterBackingStoreReference(backing_slot);
+    visitor->Trace(vector_backing);
+  }
+
  private:
   static void BackingFree(void*);
   static bool BackingExpand(void*, size_t);
diff --git a/third_party/WebKit/Source/platform/heap/HeapTest.cpp b/third_party/WebKit/Source/platform/heap/HeapTest.cpp
index 15b15599..5fad312 100644
--- a/third_party/WebKit/Source/platform/heap/HeapTest.cpp
+++ b/third_party/WebKit/Source/platform/heap/HeapTest.cpp
@@ -352,7 +352,9 @@
 class TestGCScope {
  public:
   explicit TestGCScope(BlinkGC::StackState state)
-      : state_(ThreadState::Current()), safe_point_scope_(state) {
+      : state_(ThreadState::Current()),
+        safe_point_scope_(state),
+        persistent_lock_(ProcessHeap::CrossThreadPersistentMutex()) {
     DCHECK(state_->CheckThread());
     state_->MarkPhasePrologue(state, BlinkGC::kGCWithSweep,
                               BlinkGC::kPreciseGC);
@@ -366,6 +368,7 @@
  private:
   ThreadState* state_;
   SafePointScope safe_point_scope_;
+  MutexLocker persistent_lock_;
 };
 
 class SimpleObject : public GarbageCollected<SimpleObject> {
diff --git a/third_party/WebKit/Source/platform/heap/Persistent.h b/third_party/WebKit/Source/platform/heap/Persistent.h
index 81eb276..2d37f0a 100644
--- a/third_party/WebKit/Source/platform/heap/Persistent.h
+++ b/third_party/WebKit/Source/platform/heap/Persistent.h
@@ -165,6 +165,7 @@
   // clean LSan leak reports or to register a thread-local persistent
   // needing to be cleared out before the thread is terminated.
   PersistentBase* RegisterAsStaticReference() {
+    CHECK_EQ(weaknessConfiguration, kNonWeakPersistentConfiguration);
     if (persistent_node_) {
       DCHECK(ThreadState::Current());
       ThreadState::Current()->RegisterStaticPersistentNode(persistent_node_,
@@ -185,8 +186,7 @@
   NO_SANITIZE_ADDRESS
   void Assign(T* ptr) {
     if (crossThreadnessConfiguration == kCrossThreadPersistentConfiguration) {
-      CrossThreadPersistentRegion::LockScope persistent_lock(
-          ProcessHeap::GetCrossThreadPersistentRegion());
+      MutexLocker persistent_lock(ProcessHeap::CrossThreadPersistentMutex());
       raw_ = ptr;
     } else {
       raw_ = ptr;
@@ -208,7 +208,7 @@
     if (weaknessConfiguration == kWeakPersistentConfiguration) {
       visitor->RegisterWeakCallback(this, HandleWeakPersistent);
     } else {
-      visitor->Mark(raw_);
+      visitor->Trace(raw_);
     }
   }
 
@@ -222,15 +222,21 @@
         TraceMethodDelegate<PersistentBase,
                             &PersistentBase::TracePersistent>::Trampoline;
     if (crossThreadnessConfiguration == kCrossThreadPersistentConfiguration) {
-      ProcessHeap::GetCrossThreadPersistentRegion().AllocatePersistentNode(
-          persistent_node_, this, trace_callback);
+      CrossThreadPersistentRegion& region =
+          weaknessConfiguration == kWeakPersistentConfiguration
+              ? ProcessHeap::GetCrossThreadWeakPersistentRegion()
+              : ProcessHeap::GetCrossThreadPersistentRegion();
+      region.AllocatePersistentNode(persistent_node_, this, trace_callback);
       return;
     }
     ThreadState* state =
         ThreadStateFor<ThreadingTrait<T>::kAffinity>::GetState();
     DCHECK(state->CheckThread());
-    persistent_node_ = state->GetPersistentRegion()->AllocatePersistentNode(
-        this, trace_callback);
+    PersistentRegion* region =
+        weaknessConfiguration == kWeakPersistentConfiguration
+            ? state->GetWeakPersistentRegion()
+            : state->GetPersistentRegion();
+    persistent_node_ = region->AllocatePersistentNode(this, trace_callback);
 #if DCHECK_IS_ON()
     state_ = state;
 #endif
@@ -238,9 +244,13 @@
 
   void Uninitialize() {
     if (crossThreadnessConfiguration == kCrossThreadPersistentConfiguration) {
-      if (AcquireLoad(reinterpret_cast<void* volatile*>(&persistent_node_)))
-        ProcessHeap::GetCrossThreadPersistentRegion().FreePersistentNode(
-            persistent_node_);
+      if (AcquireLoad(reinterpret_cast<void* volatile*>(&persistent_node_))) {
+        CrossThreadPersistentRegion& region =
+            weaknessConfiguration == kWeakPersistentConfiguration
+                ? ProcessHeap::GetCrossThreadWeakPersistentRegion()
+                : ProcessHeap::GetCrossThreadPersistentRegion();
+        region.FreePersistentNode(persistent_node_);
+      }
       return;
     }
 
@@ -253,7 +263,11 @@
 #if DCHECK_IS_ON()
     DCHECK_EQ(state_, state);
 #endif
-    state->FreePersistentNode(persistent_node_);
+    PersistentRegion* region =
+        weaknessConfiguration == kWeakPersistentConfiguration
+            ? state->GetWeakPersistentRegion()
+            : state->GetPersistentRegion();
+    state->FreePersistentNode(region, persistent_node_);
     persistent_node_ = nullptr;
   }
 
@@ -618,7 +632,7 @@
 #if DCHECK_IS_ON()
     DCHECK_EQ(state_, state);
 #endif
-    state->FreePersistentNode(persistent_node_);
+    state->FreePersistentNode(state->GetPersistentRegion(), persistent_node_);
     persistent_node_ = nullptr;
   }
 
@@ -819,8 +833,8 @@
 struct BindUnwrapTraits<blink::CrossThreadWeakPersistent<T>> {
   static blink::CrossThreadPersistent<T> Unwrap(
       const blink::CrossThreadWeakPersistent<T>& wrapped) {
-    blink::CrossThreadPersistentRegion::LockScope persistentLock(
-        blink::ProcessHeap::GetCrossThreadPersistentRegion());
+    WTF::MutexLocker persistent_lock(
+        blink::ProcessHeap::CrossThreadPersistentMutex());
     return blink::CrossThreadPersistent<T>(wrapped.Get());
   }
 };
diff --git a/third_party/WebKit/Source/platform/heap/PersistentNode.cpp b/third_party/WebKit/Source/platform/heap/PersistentNode.cpp
index a949955..6f1247f0 100644
--- a/third_party/WebKit/Source/platform/heap/PersistentNode.cpp
+++ b/third_party/WebKit/Source/platform/heap/PersistentNode.cpp
@@ -6,6 +6,7 @@
 
 #include "base/debug/alias.h"
 #include "platform/heap/Handle.h"
+#include "platform/heap/ProcessHeap.h"
 
 namespace blink {
 
@@ -143,7 +144,7 @@
   // For heaps belonging to a thread that's detaching, any cross-thread
   // persistents pointing into them needs to be disabled. Do that by clearing
   // out the underlying heap reference.
-  MutexLocker lock(mutex_);
+  MutexLocker lock(ProcessHeap::CrossThreadPersistentMutex());
 
   // TODO(sof): consider ways of reducing overhead. (e.g., tracking number of
   // active CrossThreadPersistent<>s pointing into the heaps of each ThreadState
@@ -176,7 +177,7 @@
 
 #if defined(ADDRESS_SANITIZER)
 void CrossThreadPersistentRegion::UnpoisonCrossThreadPersistents() {
-  MutexLocker lock(mutex_);
+  MutexLocker lock(ProcessHeap::CrossThreadPersistentMutex());
   int persistent_count = 0;
   for (PersistentNodeSlots* slots = persistent_region_->slots_; slots;
        slots = slots->next_) {
diff --git a/third_party/WebKit/Source/platform/heap/PersistentNode.h b/third_party/WebKit/Source/platform/heap/PersistentNode.h
index 60d179c6..f88e797 100644
--- a/third_party/WebKit/Source/platform/heap/PersistentNode.h
+++ b/third_party/WebKit/Source/platform/heap/PersistentNode.h
@@ -7,6 +7,7 @@
 
 #include <memory>
 #include "platform/PlatformExport.h"
+#include "platform/heap/ProcessHeap.h"
 #include "platform/heap/ThreadState.h"
 #include "platform/wtf/Allocator.h"
 #include "platform/wtf/Assertions.h"
@@ -174,14 +175,14 @@
   void AllocatePersistentNode(PersistentNode*& persistent_node,
                               void* self,
                               TraceCallback trace) {
-    MutexLocker lock(mutex_);
+    MutexLocker lock(ProcessHeap::CrossThreadPersistentMutex());
     PersistentNode* node =
         persistent_region_->AllocatePersistentNode(self, trace);
     ReleaseStore(reinterpret_cast<void* volatile*>(&persistent_node), node);
   }
 
   void FreePersistentNode(PersistentNode*& persistent_node) {
-    MutexLocker lock(mutex_);
+    MutexLocker lock(ProcessHeap::CrossThreadPersistentMutex());
     // When the thread that holds the heap object that the cross-thread
     // persistent shuts down, prepareForThreadStateTermination() will clear out
     // the associated CrossThreadPersistent<> and PersistentNode so as to avoid
@@ -198,37 +199,10 @@
     ReleaseStore(reinterpret_cast<void* volatile*>(&persistent_node), nullptr);
   }
 
-  class LockScope final {
-    STACK_ALLOCATED();
-
-   public:
-    LockScope(CrossThreadPersistentRegion& persistent_region,
-              bool try_lock = false)
-        : persistent_region_(persistent_region), locked_(true) {
-      if (try_lock)
-        locked_ = persistent_region_.TryLock();
-      else
-        persistent_region_.lock();
-    }
-    ~LockScope() {
-      if (locked_)
-        persistent_region_.unlock();
-    }
-
-    // If the lock scope is set up with |try_lock| set to |true|, caller/user
-    // is responsible for checking whether the GC lock was taken via
-    // |HasLock()|.
-    bool HasLock() const { return locked_; }
-
-   private:
-    CrossThreadPersistentRegion& persistent_region_;
-    bool locked_;
-  };
-
   void TracePersistentNodes(Visitor* visitor) {
 // If this assert triggers, you're tracing without being in a LockScope.
 #if DCHECK_IS_ON()
-    DCHECK(mutex_.Locked());
+    DCHECK(ProcessHeap::CrossThreadPersistentMutex().Locked());
 #endif
     persistent_region_->TracePersistentNodes(
         visitor, CrossThreadPersistentRegion::ShouldTracePersistentNode);
@@ -244,13 +218,6 @@
 #endif
 
  private:
-  friend class LockScope;
-
-  void lock() { mutex_.lock(); }
-
-  void unlock() { mutex_.unlock(); }
-
-  bool TryLock() { return mutex_.TryLock(); }
 
   // We don't make CrossThreadPersistentRegion inherit from PersistentRegion
   // because we don't want to virtualize performance-sensitive methods
diff --git a/third_party/WebKit/Source/platform/heap/ProcessHeap.cpp b/third_party/WebKit/Source/platform/heap/ProcessHeap.cpp
index 176875d..dd467ce 100644
--- a/third_party/WebKit/Source/platform/heap/ProcessHeap.cpp
+++ b/third_party/WebKit/Source/platform/heap/ProcessHeap.cpp
@@ -32,6 +32,17 @@
   return persistent_region;
 }
 
+CrossThreadPersistentRegion& ProcessHeap::GetCrossThreadWeakPersistentRegion() {
+  DEFINE_THREAD_SAFE_STATIC_LOCAL(CrossThreadPersistentRegion,
+                                  persistent_region, ());
+  return persistent_region;
+}
+
+RecursiveMutex& ProcessHeap::CrossThreadPersistentMutex() {
+  DEFINE_THREAD_SAFE_STATIC_LOCAL(RecursiveMutex, mutex, ());
+  return mutex;
+}
+
 size_t ProcessHeap::total_allocated_space_ = 0;
 size_t ProcessHeap::total_allocated_object_size_ = 0;
 size_t ProcessHeap::total_marked_object_size_ = 0;
diff --git a/third_party/WebKit/Source/platform/heap/ProcessHeap.h b/third_party/WebKit/Source/platform/heap/ProcessHeap.h
index 422ba7f..51d563a1 100644
--- a/third_party/WebKit/Source/platform/heap/ProcessHeap.h
+++ b/third_party/WebKit/Source/platform/heap/ProcessHeap.h
@@ -8,6 +8,7 @@
 #include "platform/PlatformExport.h"
 #include "platform/wtf/Allocator.h"
 #include "platform/wtf/Atomics.h"
+#include "platform/wtf/ThreadingPrimitives.h"
 
 namespace blink {
 
@@ -20,6 +21,13 @@
   static void Init();
 
   static CrossThreadPersistentRegion& GetCrossThreadPersistentRegion();
+  static CrossThreadPersistentRegion& GetCrossThreadWeakPersistentRegion();
+
+  // Recursive as prepareForThreadStateTermination() clears a PersistentNode's
+  // associated Persistent<> -- it in turn freeing the PersistentNode. And both
+  // CrossThreadPersistentRegion operations need a lock on the region before
+  // mutating.
+  static RecursiveMutex& CrossThreadPersistentMutex();
 
   static void IncreaseTotalAllocatedObjectSize(size_t delta) {
     AtomicAdd(&total_allocated_object_size_, static_cast<long>(delta));
diff --git a/third_party/WebKit/Source/platform/heap/ThreadState.cpp b/third_party/WebKit/Source/platform/heap/ThreadState.cpp
index 2d327f885..9b52f9a 100644
--- a/third_party/WebKit/Source/platform/heap/ThreadState.cpp
+++ b/third_party/WebKit/Source/platform/heap/ThreadState.cpp
@@ -132,6 +132,7 @@
 ThreadState::ThreadState()
     : thread_(CurrentThread()),
       persistent_region_(std::make_unique<PersistentRegion>()),
+      weak_persistent_region_(std::make_unique<PersistentRegion>()),
       start_of_stack_(reinterpret_cast<intptr_t*>(WTF::GetStackStart())),
       end_of_stack_(reinterpret_cast<intptr_t*>(WTF::GetStackStart())),
       safe_point_scope_marker_(nullptr),
@@ -197,6 +198,8 @@
 
   ReleaseStaticPersistentNodes();
 
+  // PrepareForThreadStateTermination removes strong references so no need to
+  // call it on CrossThreadWeakPersistentRegion.
   ProcessHeap::GetCrossThreadPersistentRegion()
       .PrepareForThreadStateTermination(this);
 
@@ -298,6 +301,7 @@
 }
 
 void ThreadState::VisitPersistents(Visitor* visitor) {
+  ProcessHeap::GetCrossThreadPersistentRegion().TracePersistentNodes(visitor);
   persistent_region_->TracePersistentNodes(visitor);
   if (trace_dom_wrappers_) {
     TRACE_EVENT0("blink_gc", "V8GCController::traceDOMWrappers");
@@ -305,6 +309,12 @@
   }
 }
 
+void ThreadState::VisitWeakPersistents(Visitor* visitor) {
+  ProcessHeap::GetCrossThreadWeakPersistentRegion().TracePersistentNodes(
+      visitor);
+  weak_persistent_region_->TracePersistentNodes(visitor);
+}
+
 ThreadState::GCSnapshotInfo::GCSnapshotInfo(size_t num_object_types)
     : live_count(Vector<int>(num_object_types)),
       dead_count(Vector<int>(num_object_types)),
@@ -1162,15 +1172,16 @@
     persistent_region->ReleasePersistentNode(it.key, it.value);
 }
 
-void ThreadState::FreePersistentNode(PersistentNode* persistent_node) {
-  PersistentRegion* persistent_region = GetPersistentRegion();
+void ThreadState::FreePersistentNode(PersistentRegion* persistent_region,
+                                     PersistentNode* persistent_node) {
   persistent_region->FreePersistentNode(persistent_node);
   // Do not allow static persistents to be freed before
   // they're all released in releaseStaticPersistentNodes().
   //
   // There's no fundamental reason why this couldn't be supported,
   // but no known use for it.
-  DCHECK(!static_persistents_.Contains(persistent_node));
+  if (persistent_region == GetPersistentRegion())
+    DCHECK(!static_persistents_.Contains(persistent_node));
 }
 
 #if defined(LEAK_SANITIZER)
@@ -1270,8 +1281,7 @@
     // allocate or free PersistentNodes and we can't handle
     // that. Grabbing this lock also prevents non-attached threads
     // from accessing any GCed heap while a GC runs.
-    CrossThreadPersistentRegion::LockScope persistent_lock(
-        ProcessHeap::GetCrossThreadPersistentRegion());
+    MutexLocker persistent_lock(ProcessHeap::CrossThreadPersistentMutex());
 
     {
       TRACE_EVENT2("blink_gc,devtools.timeline", "BlinkGCMarking",
@@ -1383,6 +1393,7 @@
 }
 
 void ThreadState::MarkPhaseEpilogue() {
+  VisitWeakPersistents(current_gc_data_.visitor.get());
   Heap().PostMarkingProcessing(current_gc_data_.visitor.get());
   Heap().WeakProcessing(current_gc_data_.visitor.get());
   Heap().DecommitCallbackStacks();
diff --git a/third_party/WebKit/Source/platform/heap/ThreadState.h b/third_party/WebKit/Source/platform/heap/ThreadState.h
index c84f1f7..1b7bad0 100644
--- a/third_party/WebKit/Source/platform/heap/ThreadState.h
+++ b/third_party/WebKit/Source/platform/heap/ThreadState.h
@@ -405,11 +405,16 @@
   void RecordStackEnd(intptr_t* end_of_stack) { end_of_stack_ = end_of_stack; }
   NO_SANITIZE_ADDRESS void CopyStackUntilSafePointScope();
 
-  // A region of PersistentNodes allocated on the given thread.
+  // A region of non-weak PersistentNodes allocated on the given thread.
   PersistentRegion* GetPersistentRegion() const {
     return persistent_region_.get();
   }
-  // A region of PersistentNodes not owned by any particular thread.
+
+  // A region of PersistentNodes for WeakPersistents allocated on the given
+  // thread.
+  PersistentRegion* GetWeakPersistentRegion() const {
+    return weak_persistent_region_.get();
+  }
 
   // Visit local thread stack and trace all pointers conservatively.
   void VisitStack(Visitor*);
@@ -418,9 +423,12 @@
   // real machine stack if there is one.
   void VisitAsanFakeStackForPointer(Visitor*, Address);
 
-  // Visit all persistents allocated on this thread.
+  // Visit all non-weak persistents allocated on this thread.
   void VisitPersistents(Visitor*);
 
+  // Visit all weak persistents allocated on this thread.
+  void VisitWeakPersistents(Visitor*);
+
   struct GCSnapshotInfo {
     STACK_ALLOCATED();
     GCSnapshotInfo(size_t num_object_types);
@@ -474,7 +482,7 @@
     accumulated_sweeping_time_ += time;
   }
 
-  void FreePersistentNode(PersistentNode*);
+  void FreePersistentNode(PersistentRegion*, PersistentNode*);
 
   using PersistentClearCallback = void (*)(void*);
 
@@ -615,6 +623,7 @@
   std::unique_ptr<ThreadHeap> heap_;
   ThreadIdentifier thread_;
   std::unique_ptr<PersistentRegion> persistent_region_;
+  std::unique_ptr<PersistentRegion> weak_persistent_region_;
   BlinkGC::StackState stack_state_;
   intptr_t* start_of_stack_;
   intptr_t* end_of_stack_;
diff --git a/third_party/WebKit/Source/platform/loader/SubresourceIntegrity.cpp b/third_party/WebKit/Source/platform/loader/SubresourceIntegrity.cpp
index 1df853c..4f3fe257 100644
--- a/third_party/WebKit/Source/platform/loader/SubresourceIntegrity.cpp
+++ b/third_party/WebKit/Source/platform/loader/SubresourceIntegrity.cpp
@@ -149,11 +149,19 @@
   // Check any of the "strongest" integrity constraints.
   IntegrityAlgorithm max_algorithm = FindBestAlgorithm(metadata_set);
   CheckFunction checker = GetCheckFunctionForAlgorithm(max_algorithm);
+  bool report_ed25519 = max_algorithm == IntegrityAlgorithm::kEd25519;
+  if (report_ed25519) {
+    report_info.AddUseCount(ReportInfo::UseCounterFeature::kSRISignatureCheck);
+  }
   for (const IntegrityMetadata& metadata : metadata_set) {
     if (metadata.Algorithm() == max_algorithm &&
         (*checker)(metadata, content, size, integrity_header)) {
       report_info.AddUseCount(ReportInfo::UseCounterFeature::
                                   kSRIElementWithMatchingIntegrityAttribute);
+      if (report_ed25519) {
+        report_info.AddUseCount(
+            ReportInfo::UseCounterFeature::kSRISignatureSuccess);
+      }
       return true;
     }
   }
diff --git a/third_party/WebKit/Source/platform/loader/SubresourceIntegrity.h b/third_party/WebKit/Source/platform/loader/SubresourceIntegrity.h
index cb4edc5..353c9244 100644
--- a/third_party/WebKit/Source/platform/loader/SubresourceIntegrity.h
+++ b/third_party/WebKit/Source/platform/loader/SubresourceIntegrity.h
@@ -28,6 +28,8 @@
       kSRIElementWithNonMatchingIntegrityAttribute,
       kSRIElementIntegrityAttributeButIneligible,
       kSRIElementWithUnparsableIntegrityAttribute,
+      kSRISignatureCheck,
+      kSRISignatureSuccess,
     };
 
     void AddUseCount(UseCounterFeature);
diff --git a/third_party/WebKit/Source/platform/loader/fetch/Resource.cpp b/third_party/WebKit/Source/platform/loader/fetch/Resource.cpp
index ef8db73b..fa980a8 100644
--- a/third_party/WebKit/Source/platform/loader/fetch/Resource.cpp
+++ b/third_party/WebKit/Source/platform/loader/fetch/Resource.cpp
@@ -113,9 +113,18 @@
   return true;
 }
 
+// CachedMetadataHandlerImpl should be created when a response is received,
+// and can be used independently from Resource.
+// - It doesn't have any references to Resource. Necessary data are captured
+//   from Resource when the handler is created.
+// - It is not affected by Resource's revalidation on MemoryCache.
+//   The validity of the handler is solely checked by |response_url_| and
+//   |response_time_| (not by Resource) by the browser process, and the cached
+//   metadata written to the handler is rejected if e.g. the disk cache entry
+//   has been updated and the handler refers to an older response.
 class Resource::CachedMetadataHandlerImpl : public CachedMetadataHandler {
  public:
-  static Resource::CachedMetadataHandlerImpl* Create(Resource* resource) {
+  static Resource::CachedMetadataHandlerImpl* Create(const Resource* resource) {
     return new CachedMetadataHandlerImpl(resource);
   }
   ~CachedMetadataHandlerImpl() override = default;
@@ -123,33 +132,46 @@
   void SetCachedMetadata(uint32_t, const char*, size_t, CacheType) override;
   void ClearCachedMetadata(CacheType) override;
   scoped_refptr<CachedMetadata> GetCachedMetadata(uint32_t) const override;
-  String Encoding() const override;
+
+  // This returns the encoding at the time of ResponseReceived().
+  // Therefore this does NOT reflect encoding detection from body contents,
+  // but the final encoding after the encoding detection can be determined
+  // uniquely from Encoding(), provided the body content is the same,
+  // as we can assume the encoding detection will results in the same final
+  // encoding.
+  // TODO(hiroshige): Make this semantics cleaner.
+  String Encoding() const override { return String(encoding_.GetName()); }
+
   bool IsServedFromCacheStorage() const override {
-    return !GetResponse().CacheStorageCacheName().IsNull();
+    return !cache_storage_cache_name_.IsNull();
   }
 
   // Sets the serialized metadata retrieved from the platform's cache.
   void SetSerializedCachedMetadata(const char*, size_t);
 
  protected:
-  explicit CachedMetadataHandlerImpl(Resource*);
+  explicit CachedMetadataHandlerImpl(const Resource*);
   virtual void SendToPlatform();
-  const ResourceResponse& GetResponse() const {
-    return resource_->GetResponse();
-  }
 
   scoped_refptr<CachedMetadata> cached_metadata_;
 
+  const KURL response_url_;
+  const Time response_time_;
+  const String cache_storage_cache_name_;
+
  private:
-  Member<Resource> resource_;
+  const WTF::TextEncoding encoding_;
 };
 
 Resource::CachedMetadataHandlerImpl::CachedMetadataHandlerImpl(
-    Resource* resource)
-    : resource_(resource) {}
+    const Resource* resource)
+    : response_url_(resource->GetResponse().Url()),
+      response_time_(resource->GetResponse().ResponseTime()),
+      cache_storage_cache_name_(
+          resource->GetResponse().CacheStorageCacheName()),
+      encoding_(resource->Encoding()) {}
 
 void Resource::CachedMetadataHandlerImpl::Trace(blink::Visitor* visitor) {
-  visitor->Trace(resource_);
   CachedMetadataHandler::Trace(visitor);
 }
 
@@ -182,10 +204,6 @@
   return cached_metadata_;
 }
 
-String Resource::CachedMetadataHandlerImpl::Encoding() const {
-  return String(resource_->Encoding().GetName());
-}
-
 void Resource::CachedMetadataHandlerImpl::SetSerializedCachedMetadata(
     const char* data,
     size_t size) {
@@ -199,20 +217,20 @@
 void Resource::CachedMetadataHandlerImpl::SendToPlatform() {
   if (cached_metadata_) {
     const Vector<char>& serialized_data = cached_metadata_->SerializedData();
-    Platform::Current()->CacheMetadata(
-        GetResponse().Url(), GetResponse().ResponseTime(),
-        serialized_data.data(), serialized_data.size());
+    Platform::Current()->CacheMetadata(response_url_, response_time_,
+                                       serialized_data.data(),
+                                       serialized_data.size());
   } else {
-    Platform::Current()->CacheMetadata(
-        GetResponse().Url(), GetResponse().ResponseTime(), nullptr, 0);
+    Platform::Current()->CacheMetadata(response_url_, response_time_, nullptr,
+                                       0);
   }
 }
 
-class Resource::ServiceWorkerResponseCachedMetadataHandler
+class Resource::ServiceWorkerResponseCachedMetadataHandler final
     : public Resource::CachedMetadataHandlerImpl {
  public:
   static Resource::CachedMetadataHandlerImpl* Create(
-      Resource* resource,
+      const Resource* resource,
       const SecurityOrigin* security_origin) {
     return new ServiceWorkerResponseCachedMetadataHandler(resource,
                                                           security_origin);
@@ -224,14 +242,14 @@
   void SendToPlatform() override;
 
  private:
-  explicit ServiceWorkerResponseCachedMetadataHandler(Resource*,
+  explicit ServiceWorkerResponseCachedMetadataHandler(const Resource*,
                                                       const SecurityOrigin*);
   scoped_refptr<const SecurityOrigin> security_origin_;
 };
 
 Resource::ServiceWorkerResponseCachedMetadataHandler::
     ServiceWorkerResponseCachedMetadataHandler(
-        Resource* resource,
+        const Resource* resource,
         const SecurityOrigin* security_origin)
     : CachedMetadataHandlerImpl(resource), security_origin_(security_origin) {}
 
@@ -245,21 +263,19 @@
   // directly fetched via a ServiceWorker (eg:
   // FetchEvent.respondWith(fetch(FetchEvent.request))) to prevent an attacker's
   // Service Worker from poisoning the metadata cache of HTTPCache.
-  if (GetResponse().CacheStorageCacheName().IsNull())
+  if (cache_storage_cache_name_.IsNull())
     return;
 
   if (cached_metadata_) {
     const Vector<char>& serialized_data = cached_metadata_->SerializedData();
     Platform::Current()->CacheMetadataInCacheStorage(
-        GetResponse().Url(), GetResponse().ResponseTime(),
-        serialized_data.data(), serialized_data.size(),
-        WebSecurityOrigin(security_origin_),
-        GetResponse().CacheStorageCacheName());
+        response_url_, response_time_, serialized_data.data(),
+        serialized_data.size(), WebSecurityOrigin(security_origin_),
+        cache_storage_cache_name_);
   } else {
     Platform::Current()->CacheMetadataInCacheStorage(
-        GetResponse().Url(), GetResponse().ResponseTime(), nullptr, 0,
-        WebSecurityOrigin(security_origin_),
-        GetResponse().CacheStorageCacheName());
+        response_url_, response_time_, nullptr, 0,
+        WebSecurityOrigin(security_origin_), cache_storage_cache_name_);
   }
 }
 
diff --git a/third_party/WebKit/Source/platform/loader/testing/MockFetchContext.h b/third_party/WebKit/Source/platform/loader/testing/MockFetchContext.h
index 86b62c4..85e4622 100644
--- a/third_party/WebKit/Source/platform/loader/testing/MockFetchContext.h
+++ b/third_party/WebKit/Source/platform/loader/testing/MockFetchContext.h
@@ -22,7 +22,6 @@
 
 class KURL;
 class ResourceRequest;
-class WebTaskRunner;
 struct ResourceLoaderOptions;
 
 // Mocked FetchContext for testing.
diff --git a/third_party/WebKit/Source/platform/memory_profiler/SamplingNativeHeapProfiler.cpp b/third_party/WebKit/Source/platform/memory_profiler/SamplingNativeHeapProfiler.cpp
index 7d3e8cd..4343c4b9 100644
--- a/third_party/WebKit/Source/platform/memory_profiler/SamplingNativeHeapProfiler.cpp
+++ b/third_party/WebKit/Source/platform/memory_profiler/SamplingNativeHeapProfiler.cpp
@@ -6,6 +6,7 @@
 
 #include <cmath>
 
+#include "base/allocator/allocator_shim.h"
 #include "base/allocator/features.h"
 #include "base/atomicops.h"
 #include "base/debug/alias.h"
@@ -33,8 +34,110 @@
 uint32_t g_last_sample_ordinal = 0;
 SamplingNativeHeapProfiler* g_instance;
 
+void* AllocFn(const AllocatorDispatch* self, size_t size, void* context) {
+  void* address = self->next->alloc_function(self->next, size, context);
+  SamplingNativeHeapProfiler::MaybeRecordAlloc(address, size);
+  return address;
+}
+
+// static
+void* AllocZeroInitializedFn(const AllocatorDispatch* self,
+                             size_t n,
+                             size_t size,
+                             void* context) {
+  void* address =
+      self->next->alloc_zero_initialized_function(self->next, n, size, context);
+  SamplingNativeHeapProfiler::MaybeRecordAlloc(address, n * size);
+  return address;
+}
+
+// static
+void* AllocAlignedFn(const AllocatorDispatch* self,
+                     size_t alignment,
+                     size_t size,
+                     void* context) {
+  void* address =
+      self->next->alloc_aligned_function(self->next, alignment, size, context);
+  SamplingNativeHeapProfiler::MaybeRecordAlloc(address, size);
+  return address;
+}
+
+// static
+void* ReallocFn(const AllocatorDispatch* self,
+                void* address,
+                size_t size,
+                void* context) {
+  // Note: size == 0 actually performs free.
+  SamplingNativeHeapProfiler::MaybeRecordFree(address);
+  address = self->next->realloc_function(self->next, address, size, context);
+  SamplingNativeHeapProfiler::MaybeRecordAlloc(address, size);
+  return address;
+}
+
+// static
+void FreeFn(const AllocatorDispatch* self, void* address, void* context) {
+  SamplingNativeHeapProfiler::MaybeRecordFree(address);
+  self->next->free_function(self->next, address, context);
+}
+
+// static
+size_t GetSizeEstimateFn(const AllocatorDispatch* self,
+                         void* address,
+                         void* context) {
+  return self->next->get_size_estimate_function(self->next, address, context);
+}
+
+// static
+unsigned BatchMallocFn(const AllocatorDispatch* self,
+                       size_t size,
+                       void** results,
+                       unsigned num_requested,
+                       void* context) {
+  unsigned num_allocated = self->next->batch_malloc_function(
+      self->next, size, results, num_requested, context);
+  for (unsigned i = 0; i < num_allocated; ++i)
+    SamplingNativeHeapProfiler::MaybeRecordAlloc(results[i], size);
+  return num_allocated;
+}
+
+// static
+void BatchFreeFn(const AllocatorDispatch* self,
+                 void** to_be_freed,
+                 unsigned num_to_be_freed,
+                 void* context) {
+  for (unsigned i = 0; i < num_to_be_freed; ++i)
+    SamplingNativeHeapProfiler::MaybeRecordFree(to_be_freed[i]);
+  self->next->batch_free_function(self->next, to_be_freed, num_to_be_freed,
+                                  context);
+}
+
+// static
+void FreeDefiniteSizeFn(const AllocatorDispatch* self,
+                        void* address,
+                        size_t size,
+                        void* context) {
+  SamplingNativeHeapProfiler::MaybeRecordFree(address);
+  self->next->free_definite_size_function(self->next, address, size, context);
+}
+
+AllocatorDispatch g_allocator_dispatch = {&AllocFn,
+                                          &AllocZeroInitializedFn,
+                                          &AllocAlignedFn,
+                                          &ReallocFn,
+                                          &FreeFn,
+                                          &GetSizeEstimateFn,
+                                          &BatchMallocFn,
+                                          &BatchFreeFn,
+                                          &FreeDefiniteSizeFn,
+                                          nullptr};
+
 }  // namespace
 
+// static
+SamplingHeapProfiler* SamplingHeapProfiler::GetInstance() {
+  return SamplingNativeHeapProfiler::GetInstance();
+}
+
 SamplingNativeHeapProfiler::Sample::Sample(size_t size,
                                            size_t count,
                                            uint32_t ordinal)
@@ -44,109 +147,6 @@
   g_instance = this;
 }
 
-SamplingHeapProfiler* SamplingHeapProfiler::GetInstance() {
-  return SamplingNativeHeapProfiler::GetInstance();
-}
-
-void* SamplingNativeHeapProfiler::AllocFn(const AllocatorDispatch* self,
-                                          size_t size,
-                                          void* context) {
-  void* address = self->next->alloc_function(self->next, size, context);
-  MaybeRecordAlloc(address, size);
-  return address;
-}
-
-// static
-void* SamplingNativeHeapProfiler::AllocZeroInitializedFn(
-    const AllocatorDispatch* self,
-    size_t n,
-    size_t size,
-    void* context) {
-  void* address =
-      self->next->alloc_zero_initialized_function(self->next, n, size, context);
-  MaybeRecordAlloc(address, n * size);
-  return address;
-}
-
-// static
-void* SamplingNativeHeapProfiler::AllocAlignedFn(const AllocatorDispatch* self,
-                                                 size_t alignment,
-                                                 size_t size,
-                                                 void* context) {
-  void* address =
-      self->next->alloc_aligned_function(self->next, alignment, size, context);
-  MaybeRecordAlloc(address, size);
-  return address;
-}
-
-// static
-void* SamplingNativeHeapProfiler::ReallocFn(const AllocatorDispatch* self,
-                                            void* address,
-                                            size_t size,
-                                            void* context) {
-  // Note: size == 0 actually performs free.
-  MaybeRecordFree(address);
-  address = self->next->realloc_function(self->next, address, size, context);
-  MaybeRecordAlloc(address, size);
-  return address;
-}
-
-// static
-void SamplingNativeHeapProfiler::FreeFn(const AllocatorDispatch* self,
-                                        void* address,
-                                        void* context) {
-  MaybeRecordFree(address);
-  self->next->free_function(self->next, address, context);
-}
-
-// static
-size_t SamplingNativeHeapProfiler::GetSizeEstimateFn(
-    const AllocatorDispatch* self,
-    void* address,
-    void* context) {
-  return self->next->get_size_estimate_function(self->next, address, context);
-}
-
-// static
-unsigned SamplingNativeHeapProfiler::BatchMallocFn(
-    const AllocatorDispatch* self,
-    size_t size,
-    void** results,
-    unsigned num_requested,
-    void* context) {
-  CHECK(false) << "Not implemented.";
-  return 0;
-}
-
-// static
-void SamplingNativeHeapProfiler::BatchFreeFn(const AllocatorDispatch* self,
-                                             void** to_be_freed,
-                                             unsigned num_to_be_freed,
-                                             void* context) {
-  CHECK(false) << "Not implemented.";
-}
-
-// static
-void SamplingNativeHeapProfiler::FreeDefiniteSizeFn(
-    const AllocatorDispatch* self,
-    void* ptr,
-    size_t size,
-    void* context) {
-  CHECK(false) << "Not implemented.";
-}
-
-AllocatorDispatch SamplingNativeHeapProfiler::allocator_dispatch_ = {
-    &AllocFn,
-    &AllocZeroInitializedFn,
-    &AllocAlignedFn,
-    &ReallocFn,
-    &FreeFn,
-    &GetSizeEstimateFn,
-    &BatchMallocFn,
-    &BatchFreeFn,
-    &FreeDefiniteSizeFn,
-    nullptr};
-
 // static
 void SamplingNativeHeapProfiler::InstallAllocatorHooksOnce() {
   static bool hook_installed = InstallAllocatorHooks();
@@ -156,9 +156,9 @@
 // static
 bool SamplingNativeHeapProfiler::InstallAllocatorHooks() {
 #if BUILDFLAG(USE_ALLOCATOR_SHIM)
-  base::allocator::InsertAllocatorDispatch(&allocator_dispatch_);
+  base::allocator::InsertAllocatorDispatch(&g_allocator_dispatch);
 #else
-  base::debug::Alias(&allocator_dispatch_);
+  base::debug::Alias(&g_allocator_dispatch);
   CHECK(false)
       << "Can't enable native sampling heap profiler without the shim.";
 #endif  // BUILDFLAG(USE_ALLOCATOR_SHIM)
diff --git a/third_party/WebKit/Source/platform/memory_profiler/SamplingNativeHeapProfiler.h b/third_party/WebKit/Source/platform/memory_profiler/SamplingNativeHeapProfiler.h
index ebd52b7f..e62c9d2 100644
--- a/third_party/WebKit/Source/platform/memory_profiler/SamplingNativeHeapProfiler.h
+++ b/third_party/WebKit/Source/platform/memory_profiler/SamplingNativeHeapProfiler.h
@@ -8,7 +8,6 @@
 #include <unordered_map>
 #include <vector>
 
-#include "base/allocator/allocator_shim.h"
 #include "base/macros.h"
 #include "base/synchronization/lock.h"
 #include "base/threading/thread_local.h"
@@ -45,6 +44,9 @@
 
   std::vector<Sample> GetSamples(uint32_t profile_id);
 
+  static inline void MaybeRecordAlloc(void* address, size_t);
+  static inline void MaybeRecordFree(void* address);
+
   static SamplingNativeHeapProfiler* GetInstance();
 
  private:
@@ -54,8 +56,6 @@
   static bool InstallAllocatorHooks();
   static size_t GetNextSampleInterval(size_t base_interval);
 
-  static inline void MaybeRecordAlloc(void* address, size_t);
-  static inline void MaybeRecordFree(void* address);
   void RecordAlloc(size_t total_allocated,
                    size_t allocation_size,
                    void* address,
@@ -63,49 +63,10 @@
   void RecordFree(void* address);
   void RecordStackTrace(Sample*, unsigned skip_frames);
 
-  static void* AllocFn(const base::allocator::AllocatorDispatch* self,
-                       size_t,
-                       void* context);
-  static void* AllocZeroInitializedFn(
-      const base::allocator::AllocatorDispatch* self,
-      size_t n,
-      size_t,
-      void* context);
-  static void* AllocAlignedFn(const base::allocator::AllocatorDispatch* self,
-                              size_t alignment,
-                              size_t,
-                              void* context);
-  static void* ReallocFn(const base::allocator::AllocatorDispatch* self,
-                         void* address,
-                         size_t,
-                         void* context);
-  static void FreeFn(const base::allocator::AllocatorDispatch* self,
-                     void* address,
-                     void* context);
-  static size_t GetSizeEstimateFn(
-      const base::allocator::AllocatorDispatch* self,
-      void* address,
-      void* context);
-  static unsigned BatchMallocFn(const base::allocator::AllocatorDispatch* self,
-                                size_t,
-                                void** results,
-                                unsigned num_requested,
-                                void* context);
-  static void BatchFreeFn(const base::allocator::AllocatorDispatch* self,
-                          void** to_be_freed,
-                          unsigned num_to_be_freed,
-                          void* context);
-  static void FreeDefiniteSizeFn(const base::allocator::AllocatorDispatch* self,
-                                 void* ptr,
-                                 size_t,
-                                 void* context);
-
   base::ThreadLocalBoolean entered_;
   base::Lock mutex_;
   std::unordered_map<void*, Sample> samples_;
 
-  static base::allocator::AllocatorDispatch allocator_dispatch_;
-
   friend struct base::DefaultSingletonTraits<SamplingNativeHeapProfiler>;
 
   DISALLOW_COPY_AND_ASSIGN(SamplingNativeHeapProfiler);
diff --git a/third_party/WebKit/Source/platform/scheduler/child/web_scheduler.h b/third_party/WebKit/Source/platform/scheduler/child/web_scheduler.h
index e5325ddc..c73d366 100644
--- a/third_party/WebKit/Source/platform/scheduler/child/web_scheduler.h
+++ b/third_party/WebKit/Source/platform/scheduler/child/web_scheduler.h
@@ -6,6 +6,7 @@
 #define THIRD_PARTY_WEBKIT_SOURCE_PLATFORM_SCHEDULER_RENDERER_WEB_SCHEDULER_H_
 
 #include "base/location.h"
+#include "base/single_thread_task_runner.h"
 #include "base/time/time.h"
 #include "platform/scheduler/renderer/web_view_scheduler.h"
 #include "public/platform/WebString.h"
@@ -16,8 +17,6 @@
 
 namespace blink {
 
-class WebTaskRunner;
-
 // This class is used to submit tasks and pass other information from Blink to
 // the platform's scheduler.
 // TODO(skyostil): Replace this class with RendererScheduler.
@@ -69,16 +68,16 @@
   virtual void PostNonNestableIdleTask(const base::Location&,
                                        WebThread::IdleTask) = 0;
 
-  // Returns a WebTaskRunner for timer tasks. Can be called from any thread.
-  virtual WebTaskRunner* TimerTaskRunner() = 0;
+  // Returns a task runner for timer tasks. Can be called from any thread.
+  virtual base::SingleThreadTaskRunner* TimerTaskRunner() = 0;
 
-  // Returns a WebTaskRunner for kV8 tasks. Can be called from any thread.
-  virtual WebTaskRunner* V8TaskRunner() = 0;
+  // Returns a task runner for kV8 tasks. Can be called from any thread.
+  virtual base::SingleThreadTaskRunner* V8TaskRunner() = 0;
 
-  // Returns a WebTaskRunner for compositor tasks. This is intended only to be
+  // Returns a task runner for compositor tasks. This is intended only to be
   // used by specific animation and rendering related tasks (e.g. animated GIFS)
   // and should not generally be used.
-  virtual WebTaskRunner* CompositorTaskRunner() = 0;
+  virtual base::SingleThreadTaskRunner* CompositorTaskRunner() = 0;
 
   // Creates a new WebViewScheduler for a given WebView. Must be called from
   // the associated WebThread.
diff --git a/third_party/WebKit/Source/platform/scheduler/child/web_scheduler_impl.cc b/third_party/WebKit/Source/platform/scheduler/child/web_scheduler_impl.cc
index ac6ce488..42d963d 100644
--- a/third_party/WebKit/Source/platform/scheduler/child/web_scheduler_impl.cc
+++ b/third_party/WebKit/Source/platform/scheduler/child/web_scheduler_impl.cc
@@ -63,15 +63,15 @@
       base::BindOnce(&WebSchedulerImpl::RunIdleTask, std::move(task)));
 }
 
-blink::WebTaskRunner* WebSchedulerImpl::TimerTaskRunner() {
+base::SingleThreadTaskRunner* WebSchedulerImpl::TimerTaskRunner() {
   return timer_web_task_runner_.get();
 }
 
-blink::WebTaskRunner* WebSchedulerImpl::V8TaskRunner() {
+base::SingleThreadTaskRunner* WebSchedulerImpl::V8TaskRunner() {
   return v8_web_task_runner_.get();
 }
 
-blink::WebTaskRunner* WebSchedulerImpl::CompositorTaskRunner() {
+base::SingleThreadTaskRunner* WebSchedulerImpl::CompositorTaskRunner() {
   return nullptr;
 }
 
diff --git a/third_party/WebKit/Source/platform/scheduler/child/web_scheduler_impl.h b/third_party/WebKit/Source/platform/scheduler/child/web_scheduler_impl.h
index de4b3e3d..b0d9ecb 100644
--- a/third_party/WebKit/Source/platform/scheduler/child/web_scheduler_impl.h
+++ b/third_party/WebKit/Source/platform/scheduler/child/web_scheduler_impl.h
@@ -38,9 +38,9 @@
                     WebThread::IdleTask task) override;
   void PostNonNestableIdleTask(const base::Location& location,
                                WebThread::IdleTask task) override;
-  WebTaskRunner* TimerTaskRunner() override;
-  WebTaskRunner* V8TaskRunner() override;
-  WebTaskRunner* CompositorTaskRunner() override;
+  base::SingleThreadTaskRunner* TimerTaskRunner() override;
+  base::SingleThreadTaskRunner* V8TaskRunner() override;
+  base::SingleThreadTaskRunner* CompositorTaskRunner() override;
   std::unique_ptr<WebViewScheduler> CreateWebViewScheduler(
       InterventionReporter*,
       WebViewScheduler::WebViewSchedulerDelegate*) override;
diff --git a/third_party/WebKit/Source/platform/scheduler/child/web_task_runner_impl.h b/third_party/WebKit/Source/platform/scheduler/child/web_task_runner_impl.h
index 045b5a2..a6bea8f3 100644
--- a/third_party/WebKit/Source/platform/scheduler/child/web_task_runner_impl.h
+++ b/third_party/WebKit/Source/platform/scheduler/child/web_task_runner_impl.h
@@ -11,16 +11,17 @@
 #include "base/macros.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/optional.h"
+#include "base/single_thread_task_runner.h"
 #include "base/time/time.h"
 #include "platform/PlatformExport.h"
-#include "platform/WebTaskRunner.h"
 #include "public/platform/TaskType.h"
 
 namespace blink {
 namespace scheduler {
 class TaskQueue;
 
-class PLATFORM_EXPORT WebTaskRunnerImpl : public WebTaskRunner {
+// TODO(yutak): WebTaskRunner is no more; rename the class.
+class PLATFORM_EXPORT WebTaskRunnerImpl : public base::SingleThreadTaskRunner {
  public:
   static scoped_refptr<WebTaskRunnerImpl> Create(
       scoped_refptr<TaskQueue> task_queue,
diff --git a/third_party/WebKit/Source/platform/scheduler/child/webthread_impl_for_worker_scheduler.cc b/third_party/WebKit/Source/platform/scheduler/child/webthread_impl_for_worker_scheduler.cc
index 7f4b292..9cbcae713 100644
--- a/third_party/WebKit/Source/platform/scheduler/child/webthread_impl_for_worker_scheduler.cc
+++ b/third_party/WebKit/Source/platform/scheduler/child/webthread_impl_for_worker_scheduler.cc
@@ -115,8 +115,8 @@
   return idle_task_runner_.get();
 }
 
-blink::WebTaskRunner* WebThreadImplForWorkerScheduler::GetWebTaskRunner()
-    const {
+base::SingleThreadTaskRunner*
+WebThreadImplForWorkerScheduler::GetWebTaskRunner() const {
   return web_task_runner_.Get();
 }
 
diff --git a/third_party/WebKit/Source/platform/scheduler/child/webthread_impl_for_worker_scheduler.h b/third_party/WebKit/Source/platform/scheduler/child/webthread_impl_for_worker_scheduler.h
index 6359231..fb1e6b9 100644
--- a/third_party/WebKit/Source/platform/scheduler/child/webthread_impl_for_worker_scheduler.h
+++ b/third_party/WebKit/Source/platform/scheduler/child/webthread_impl_for_worker_scheduler.h
@@ -39,7 +39,7 @@
   // WebThread implementation.
   WebScheduler* Scheduler() const override;
   PlatformThreadId ThreadId() const override;
-  WebTaskRunner* GetWebTaskRunner() const override;
+  base::SingleThreadTaskRunner* GetWebTaskRunner() const override;
   scoped_refptr<base::SingleThreadTaskRunner> GetSingleThreadTaskRunner()
       const override;
 
diff --git a/third_party/WebKit/Source/platform/scheduler/child/worker_global_scope_scheduler.cc b/third_party/WebKit/Source/platform/scheduler/child/worker_global_scope_scheduler.cc
index e3f732b0..ede9793 100644
--- a/third_party/WebKit/Source/platform/scheduler/child/worker_global_scope_scheduler.cc
+++ b/third_party/WebKit/Source/platform/scheduler/child/worker_global_scope_scheduler.cc
@@ -28,8 +28,8 @@
 #endif
 }
 
-scoped_refptr<WebTaskRunner> WorkerGlobalScopeScheduler::GetTaskRunner(
-    TaskType type) const {
+scoped_refptr<base::SingleThreadTaskRunner>
+WorkerGlobalScopeScheduler::GetTaskRunner(TaskType type) const {
   switch (type) {
     case TaskType::kDOMManipulation:
     case TaskType::kUserInteraction:
diff --git a/third_party/WebKit/Source/platform/scheduler/child/worker_global_scope_scheduler.h b/third_party/WebKit/Source/platform/scheduler/child/worker_global_scope_scheduler.h
index 23732f27..5727642 100644
--- a/third_party/WebKit/Source/platform/scheduler/child/worker_global_scope_scheduler.h
+++ b/third_party/WebKit/Source/platform/scheduler/child/worker_global_scope_scheduler.h
@@ -5,14 +5,12 @@
 #ifndef THIRD_PARTY_WEBKIT_SOURCE_PLATFORM_SCHEDULER_CHILD_WORKER_GLOBAL_SCOPE_SCHEDULER_H_
 #define THIRD_PARTY_WEBKIT_SOURCE_PLATFORM_SCHEDULER_CHILD_WORKER_GLOBAL_SCOPE_SCHEDULER_H_
 
-#include "platform/PlatformExport.h"
+#include "base/single_thread_task_runner.h"
 #include "platform/scheduler/base/task_queue.h"
 #include "public/platform/TaskType.h"
 
 namespace blink {
 
-class WebTaskRunner;
-
 namespace scheduler {
 
 class WorkerScheduler;
@@ -29,11 +27,11 @@
   // Unregisters the task queues and cancels tasks in them.
   void Dispose();
 
-  // Returns a WebTaskRunner that is suitable with the given task type. This can
+  // Returns a task runner that is suitable with the given task type. This can
   // be called from any thread.
   //
   // This must be called only from TaskRunnerHelper::Get().
-  scoped_refptr<WebTaskRunner> GetTaskRunner(TaskType) const;
+  scoped_refptr<base::SingleThreadTaskRunner> GetTaskRunner(TaskType) const;
 
   // TODO(nhiroki): Add mechanism to throttle/suspend tasks in response to the
   // state of the parent document (https://crbug.com/670534).
diff --git a/third_party/WebKit/Source/platform/scheduler/child/worker_global_scope_scheduler_unittest.cc b/third_party/WebKit/Source/platform/scheduler/child/worker_global_scope_scheduler_unittest.cc
index de6cc2b5..25caa00 100644
--- a/third_party/WebKit/Source/platform/scheduler/child/worker_global_scope_scheduler_unittest.cc
+++ b/third_party/WebKit/Source/platform/scheduler/child/worker_global_scope_scheduler_unittest.cc
@@ -9,9 +9,9 @@
 #include "base/memory/ptr_util.h"
 #include "base/test/simple_test_tick_clock.h"
 #include "base/test/test_simple_task_runner.h"
-#include "platform/WebTaskRunner.h"
 #include "platform/scheduler/child/worker_scheduler_impl.h"
 #include "platform/scheduler/test/create_task_queue_manager_for_test.h"
+#include "platform/wtf/Functional.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
diff --git a/third_party/WebKit/Source/platform/scheduler/renderer/renderer_scheduler_impl_unittest.cc b/third_party/WebKit/Source/platform/scheduler/renderer/renderer_scheduler_impl_unittest.cc
index a6f322ec..0520efd 100644
--- a/third_party/WebKit/Source/platform/scheduler/renderer/renderer_scheduler_impl_unittest.cc
+++ b/third_party/WebKit/Source/platform/scheduler/renderer/renderer_scheduler_impl_unittest.cc
@@ -17,7 +17,6 @@
 #include "build/build_config.h"
 #include "components/viz/common/frame_sinks/begin_frame_args.h"
 #include "components/viz/test/ordered_simple_task_runner.h"
-#include "platform/WebTaskRunner.h"
 #include "platform/scheduler/base/real_time_domain.h"
 #include "platform/scheduler/renderer/auto_advancing_virtual_time_domain.h"
 #include "platform/scheduler/renderer/budget_pool.h"
@@ -3899,7 +3898,7 @@
   scheduler_->TimerTaskQueue()->PostTask(FROM_HERE, base::Bind(NullTask));
 
   loading_task_runner_->PostDelayedTask(FROM_HERE, base::BindOnce(NullTask),
-                                        TimeDelta::FromMilliseconds(10));
+                                        base::TimeDelta::FromMilliseconds(10));
 
   std::unique_ptr<base::trace_event::ConvertableToTraceFormat> value =
       scheduler_->AsValue(base::TimeTicks());
diff --git a/third_party/WebKit/Source/platform/scheduler/renderer/renderer_web_scheduler_impl.cc b/third_party/WebKit/Source/platform/scheduler/renderer/renderer_web_scheduler_impl.cc
index 363d3d5..8c35404 100644
--- a/third_party/WebKit/Source/platform/scheduler/renderer/renderer_web_scheduler_impl.cc
+++ b/third_party/WebKit/Source/platform/scheduler/renderer/renderer_web_scheduler_impl.cc
@@ -28,7 +28,7 @@
 
 RendererWebSchedulerImpl::~RendererWebSchedulerImpl() = default;
 
-WebTaskRunner* RendererWebSchedulerImpl::CompositorTaskRunner() {
+base::SingleThreadTaskRunner* RendererWebSchedulerImpl::CompositorTaskRunner() {
   return compositor_task_runner_.get();
 }
 
diff --git a/third_party/WebKit/Source/platform/scheduler/renderer/renderer_web_scheduler_impl.h b/third_party/WebKit/Source/platform/scheduler/renderer/renderer_web_scheduler_impl.h
index 6c78bcb..c5f6ca2e 100644
--- a/third_party/WebKit/Source/platform/scheduler/renderer/renderer_web_scheduler_impl.h
+++ b/third_party/WebKit/Source/platform/scheduler/renderer/renderer_web_scheduler_impl.h
@@ -19,7 +19,7 @@
   ~RendererWebSchedulerImpl() override;
 
   // WebScheduler implementation:
-  WebTaskRunner* CompositorTaskRunner() override;
+  base::SingleThreadTaskRunner* CompositorTaskRunner() override;
   std::unique_ptr<RendererPauseHandle> PauseScheduler() override
       WARN_UNUSED_RESULT;
   std::unique_ptr<WebViewScheduler> CreateWebViewScheduler(
diff --git a/third_party/WebKit/Source/platform/scheduler/renderer/web_frame_scheduler_impl.cc b/third_party/WebKit/Source/platform/scheduler/renderer/web_frame_scheduler_impl.cc
index 5eadd06..fb0d75e 100644
--- a/third_party/WebKit/Source/platform/scheduler/renderer/web_frame_scheduler_impl.cc
+++ b/third_party/WebKit/Source/platform/scheduler/renderer/web_frame_scheduler_impl.cc
@@ -224,8 +224,8 @@
   return frame_type_;
 }
 
-scoped_refptr<blink::WebTaskRunner> WebFrameSchedulerImpl::GetTaskRunner(
-    TaskType type) {
+scoped_refptr<base::SingleThreadTaskRunner>
+WebFrameSchedulerImpl::GetTaskRunner(TaskType type) {
   // TODO(haraken): Optimize the mapping from TaskTypes to task runners.
   switch (type) {
     case TaskType::kJavascriptTimer:
diff --git a/third_party/WebKit/Source/platform/scheduler/renderer/web_frame_scheduler_impl.h b/third_party/WebKit/Source/platform/scheduler/renderer/web_frame_scheduler_impl.h
index f7ac039..3f67eba7 100644
--- a/third_party/WebKit/Source/platform/scheduler/renderer/web_frame_scheduler_impl.h
+++ b/third_party/WebKit/Source/platform/scheduler/renderer/web_frame_scheduler_impl.h
@@ -66,7 +66,7 @@
   void SetCrossOrigin(bool cross_origin) override;
   bool IsCrossOrigin() const override;
   WebFrameScheduler::FrameType GetFrameType() const override;
-  scoped_refptr<WebTaskRunner> GetTaskRunner(TaskType) override;
+  scoped_refptr<base::SingleThreadTaskRunner> GetTaskRunner(TaskType) override;
   WebViewScheduler* GetWebViewScheduler() const override;
   void DidStartProvisionalLoad(bool is_main_frame) override;
   void DidCommitProvisionalLoad(bool is_web_history_inert_commit,
diff --git a/third_party/WebKit/Source/platform/scheduler/renderer/web_view_scheduler.h b/third_party/WebKit/Source/platform/scheduler/renderer/web_view_scheduler.h
index 3ad498f..50c77e76 100644
--- a/third_party/WebKit/Source/platform/scheduler/renderer/web_view_scheduler.h
+++ b/third_party/WebKit/Source/platform/scheduler/renderer/web_view_scheduler.h
@@ -67,7 +67,7 @@
     kAdvance,
 
     // In this policy virtual time is not allowed to advance. Delayed tasks
-    // posted to WebTaskRunners owned by any child WebFrameSchedulers will be
+    // posted to task runners owned by any child WebFrameSchedulers will be
     // paused, unless their scheduled run time is less than or equal to the
     // current virtual time.  Note non-delayed tasks will run as normal.
     kPause,
diff --git a/third_party/WebKit/Source/platform/scheduler/renderer/web_view_scheduler_impl_unittest.cc b/third_party/WebKit/Source/platform/scheduler/renderer/web_view_scheduler_impl_unittest.cc
index 23b3a3b..e305b531 100644
--- a/third_party/WebKit/Source/platform/scheduler/renderer/web_view_scheduler_impl_unittest.cc
+++ b/third_party/WebKit/Source/platform/scheduler/renderer/web_view_scheduler_impl_unittest.cc
@@ -14,7 +14,6 @@
 #include "base/strings/stringprintf.h"
 #include "base/test/simple_test_tick_clock.h"
 #include "components/viz/test/ordered_simple_task_runner.h"
-#include "platform/WebTaskRunner.h"
 #include "platform/scheduler/renderer/renderer_scheduler_impl.h"
 #include "platform/scheduler/renderer/web_frame_scheduler_impl.h"
 #include "platform/scheduler/test/create_task_queue_manager_for_test.h"
@@ -63,12 +62,12 @@
     return scheduler->ThrottleableTaskQueue();
   }
 
-  scoped_refptr<WebTaskRunner> ThrottleableTaskRunner() {
+  scoped_refptr<base::SingleThreadTaskRunner> ThrottleableTaskRunner() {
     return WebTaskRunnerImpl::Create(ThrottleableTaskQueue(),
                                      TaskType::kInternalTest);
   }
 
-  scoped_refptr<WebTaskRunner> LoadingTaskRunner() {
+  scoped_refptr<base::SingleThreadTaskRunner> LoadingTaskRunner() {
     return WebTaskRunnerImpl::Create(LoadingTaskQueue(),
                                      TaskType::kInternalTest);
   }
@@ -122,7 +121,7 @@
   TaskQueue* task_queue_ptr = task_queue.get();
   task_queue_ptr->PostDelayedTask(
       FROM_HERE, MakeRepeatingTask(std::move(task_queue_ptr), run_count),
-      TimeDelta::FromMilliseconds(1));
+      base::TimeDelta::FromMilliseconds(1));
 }
 
 }  // namespace
@@ -133,7 +132,7 @@
   int run_count = 0;
   ThrottleableTaskQueue()->PostDelayedTask(
       FROM_HERE, MakeRepeatingTask(ThrottleableTaskQueue(), &run_count),
-      TimeDelta::FromMilliseconds(1));
+      base::TimeDelta::FromMilliseconds(1));
 
   mock_task_runner_->RunForPeriod(base::TimeDelta::FromSeconds(1));
   EXPECT_EQ(1000, run_count);
@@ -146,7 +145,7 @@
   int run_count = 0;
   ThrottleableTaskQueue()->PostDelayedTask(
       FROM_HERE, MakeRepeatingTask(ThrottleableTaskQueue(), &run_count),
-      TimeDelta::FromMilliseconds(1));
+      base::TimeDelta::FromMilliseconds(1));
 
   mock_task_runner_->RunForPeriod(base::TimeDelta::FromSeconds(1));
   EXPECT_EQ(1, run_count);
@@ -168,7 +167,7 @@
   int run_count = 0;
   LoadingTaskQueue()->PostDelayedTask(
       FROM_HERE, MakeRepeatingTask(LoadingTaskQueue(), &run_count),
-      TimeDelta::FromMilliseconds(1));
+      base::TimeDelta::FromMilliseconds(1));
 
   mock_task_runner_->RunForPeriod(base::TimeDelta::FromSeconds(1));
   EXPECT_EQ(1000, run_count);  // Loading tasks should not be throttled
@@ -188,13 +187,13 @@
   int run_count2 = 0;
   ThrottleableTaskQueue()->PostDelayedTask(
       FROM_HERE, MakeRepeatingTask(ThrottleableTaskQueue(), &run_count1),
-      TimeDelta::FromMilliseconds(1));
+      base::TimeDelta::FromMilliseconds(1));
   ThrottleableTaskQueueForScheduler(web_frame_scheduler2.get())
       ->PostDelayedTask(FROM_HERE,
                         MakeRepeatingTask(ThrottleableTaskQueueForScheduler(
                                               web_frame_scheduler2.get()),
                                           &run_count2),
-                        TimeDelta::FromMilliseconds(1));
+                        base::TimeDelta::FromMilliseconds(1));
 
   mock_task_runner_->RunForPeriod(base::TimeDelta::FromSeconds(1));
   EXPECT_EQ(1000, run_count1);
@@ -237,19 +236,19 @@
       FROM_HERE,
       MakeVirtualTimeRecorderTask(&clock_, scheduler_.get(), &real_times,
                                   &virtual_times),
-      TimeDelta::FromMilliseconds(2));
+      base::TimeDelta::FromMilliseconds(2));
 
   ThrottleableTaskRunner()->PostDelayedTask(
       FROM_HERE,
       MakeVirtualTimeRecorderTask(&clock_, scheduler_.get(), &real_times,
                                   &virtual_times),
-      TimeDelta::FromMilliseconds(20));
+      base::TimeDelta::FromMilliseconds(20));
 
   ThrottleableTaskRunner()->PostDelayedTask(
       FROM_HERE,
       MakeVirtualTimeRecorderTask(&clock_, scheduler_.get(), &real_times,
                                   &virtual_times),
-      TimeDelta::FromMilliseconds(200));
+      base::TimeDelta::FromMilliseconds(200));
 
   mock_task_runner_->RunUntilIdle();
 
@@ -257,9 +256,10 @@
                                       initial_real_time));
   EXPECT_THAT(
       virtual_times,
-      ElementsAre(initial_virtual_time + TimeDelta::FromMilliseconds(2),
-                  initial_virtual_time + TimeDelta::FromMilliseconds(20),
-                  initial_virtual_time + TimeDelta::FromMilliseconds(200)));
+      ElementsAre(
+          initial_virtual_time + base::TimeDelta::FromMilliseconds(2),
+          initial_virtual_time + base::TimeDelta::FromMilliseconds(20),
+          initial_virtual_time + base::TimeDelta::FromMilliseconds(200)));
 }
 
 TEST_F(WebViewSchedulerImplTest, VirtualTime_LoadingTaskFastForwarding) {
@@ -276,19 +276,19 @@
       FROM_HERE,
       MakeVirtualTimeRecorderTask(&clock_, scheduler_.get(), &real_times,
                                   &virtual_times),
-      TimeDelta::FromMilliseconds(2));
+      base::TimeDelta::FromMilliseconds(2));
 
   LoadingTaskRunner()->PostDelayedTask(
       FROM_HERE,
       MakeVirtualTimeRecorderTask(&clock_, scheduler_.get(), &real_times,
                                   &virtual_times),
-      TimeDelta::FromMilliseconds(20));
+      base::TimeDelta::FromMilliseconds(20));
 
   LoadingTaskRunner()->PostDelayedTask(
       FROM_HERE,
       MakeVirtualTimeRecorderTask(&clock_, scheduler_.get(), &real_times,
                                   &virtual_times),
-      TimeDelta::FromMilliseconds(200));
+      base::TimeDelta::FromMilliseconds(200));
 
   mock_task_runner_->RunUntilIdle();
 
@@ -296,9 +296,10 @@
                                       initial_real_time));
   EXPECT_THAT(
       virtual_times,
-      ElementsAre(initial_virtual_time + TimeDelta::FromMilliseconds(2),
-                  initial_virtual_time + TimeDelta::FromMilliseconds(20),
-                  initial_virtual_time + TimeDelta::FromMilliseconds(200)));
+      ElementsAre(
+          initial_virtual_time + base::TimeDelta::FromMilliseconds(2),
+          initial_virtual_time + base::TimeDelta::FromMilliseconds(20),
+          initial_virtual_time + base::TimeDelta::FromMilliseconds(200)));
 }
 
 TEST_F(WebViewSchedulerImplTest,
@@ -310,7 +311,7 @@
   int run_count = 0;
   ThrottleableTaskQueue()->PostDelayedTask(
       FROM_HERE, MakeRepeatingTask(ThrottleableTaskQueue(), &run_count),
-      TimeDelta::FromMilliseconds(1));
+      base::TimeDelta::FromMilliseconds(1));
 
   mock_task_runner_->RunTasksWhile(mock_task_runner_->TaskRunCountBelow(2000));
   // Virtual time means page visibility is ignored.
@@ -349,13 +350,13 @@
       FROM_HERE,
       base::Bind(&DelayedRunOrderTask, 1, base::Passed(ThrottleableTaskQueue()),
                  base::Unretained(&run_order)),
-      TimeDelta::FromMilliseconds(2));
+      base::TimeDelta::FromMilliseconds(2));
 
   ThrottleableTaskQueue()->PostDelayedTask(
       FROM_HERE,
       base::Bind(&DelayedRunOrderTask, 3, base::Passed(ThrottleableTaskQueue()),
                  base::Unretained(&run_order)),
-      TimeDelta::FromMilliseconds(4));
+      base::TimeDelta::FromMilliseconds(4));
 
   mock_task_runner_->RunUntilIdle();
 
@@ -376,13 +377,13 @@
       FROM_HERE,
       base::Bind(&DelayedRunOrderTask, 1, base::Passed(ThrottleableTaskQueue()),
                  base::Unretained(&run_order)),
-      TimeDelta::FromMilliseconds(2));
+      base::TimeDelta::FromMilliseconds(2));
 
   ThrottleableTaskQueue()->PostDelayedTask(
       FROM_HERE,
       base::Bind(&DelayedRunOrderTask, 3, base::Passed(ThrottleableTaskQueue()),
                  base::Unretained(&run_order)),
-      TimeDelta::FromMilliseconds(4));
+      base::TimeDelta::FromMilliseconds(4));
 
   mock_task_runner_->RunUntilIdle();
 
@@ -406,7 +407,7 @@
   int run_count = 0;
   ThrottleableTaskQueue()->PostDelayedTask(
       FROM_HERE, MakeRepeatingTask(ThrottleableTaskQueue(), &run_count),
-      TimeDelta::FromMilliseconds(1));
+      base::TimeDelta::FromMilliseconds(1));
 
   mock_task_runner_->RunForPeriod(base::TimeDelta::FromSeconds(1));
   EXPECT_EQ(1000, run_count);
@@ -425,7 +426,7 @@
   ThrottleableTaskQueueForScheduler(web_frame_scheduler.get())
       ->PostDelayedTask(
           FROM_HERE, base::Bind(&RunOrderTask, 1, base::Unretained(&run_order)),
-          TimeDelta::FromMilliseconds(1));
+          base::TimeDelta::FromMilliseconds(1));
 
   mock_task_runner_->RunUntilIdle();
   EXPECT_TRUE(run_order.empty());
@@ -454,7 +455,7 @@
             .release();
     ThrottleableTaskQueueForScheduler(web_frame_scheduler)
         ->PostDelayedTask(FROM_HERE, MakeDeletionTask(web_frame_scheduler),
-                          TimeDelta::FromMilliseconds(1));
+                          base::TimeDelta::FromMilliseconds(1));
   }
   mock_task_runner_->RunUntilIdle();
 }
@@ -479,13 +480,13 @@
   int run_count = 0;
   timer_task_queue->PostDelayedTask(
       FROM_HERE, MakeRepeatingTask(timer_task_queue, &run_count),
-      TimeDelta::FromMilliseconds(1));
+      base::TimeDelta::FromMilliseconds(1));
 
   // Note this will run at time t = 10s since we start at time t = 5000us.
   // However, we still should run all tasks after frame scheduler deletion.
   timer_task_queue->PostDelayedTask(FROM_HERE,
                                     MakeDeletionTask(web_frame_scheduler),
-                                    TimeDelta::FromMilliseconds(9990));
+                                    base::TimeDelta::FromMilliseconds(9990));
 
   mock_task_runner_->RunForPeriod(base::TimeDelta::FromSeconds(100));
   EXPECT_EQ(90015, run_count);
@@ -617,25 +618,25 @@
       FROM_HERE,
       MakeVirtualTimeRecorderTask(&clock_, scheduler_.get(), &real_times,
                                   &virtual_times),
-      TimeDelta::FromMilliseconds(1));
+      base::TimeDelta::FromMilliseconds(1));
 
   ThrottleableTaskRunner()->PostDelayedTask(
       FROM_HERE,
       MakeVirtualTimeRecorderTask(&clock_, scheduler_.get(), &real_times,
                                   &virtual_times),
-      TimeDelta::FromMilliseconds(2));
+      base::TimeDelta::FromMilliseconds(2));
 
   ThrottleableTaskRunner()->PostDelayedTask(
       FROM_HERE,
       MakeVirtualTimeRecorderTask(&clock_, scheduler_.get(), &real_times,
                                   &virtual_times),
-      TimeDelta::FromMilliseconds(5));
+      base::TimeDelta::FromMilliseconds(5));
 
   ThrottleableTaskRunner()->PostDelayedTask(
       FROM_HERE,
       MakeVirtualTimeRecorderTask(&clock_, scheduler_.get(), &real_times,
                                   &virtual_times),
-      TimeDelta::FromMilliseconds(7));
+      base::TimeDelta::FromMilliseconds(7));
 
   web_view_scheduler_->GrantVirtualTimeBudget(
       base::TimeDelta::FromMilliseconds(5),
@@ -691,14 +692,14 @@
   web_view_scheduler_->AddVirtualTimeObserver(&mock_observer);
   web_view_scheduler_->EnableVirtualTime();
 
-  ThrottleableTaskQueue()->PostDelayedTask(FROM_HERE, base::Bind(&NopTask),
-                                           TimeDelta::FromMilliseconds(200));
+  ThrottleableTaskQueue()->PostDelayedTask(
+      FROM_HERE, base::Bind(&NopTask), base::TimeDelta::FromMilliseconds(200));
 
-  ThrottleableTaskQueue()->PostDelayedTask(FROM_HERE, base::Bind(&NopTask),
-                                           TimeDelta::FromMilliseconds(20));
+  ThrottleableTaskQueue()->PostDelayedTask(
+      FROM_HERE, base::Bind(&NopTask), base::TimeDelta::FromMilliseconds(20));
 
-  ThrottleableTaskQueue()->PostDelayedTask(FROM_HERE, base::Bind(&NopTask),
-                                           TimeDelta::FromMilliseconds(2));
+  ThrottleableTaskQueue()->PostDelayedTask(
+      FROM_HERE, base::Bind(&NopTask), base::TimeDelta::FromMilliseconds(2));
 
   web_view_scheduler_->GrantVirtualTimeBudget(
       base::TimeDelta::FromMilliseconds(1000),
@@ -869,10 +870,10 @@
 
   ThrottleableTaskQueue()->PostDelayedTask(
       FROM_HERE, base::Bind(&ExpensiveTestTask, &clock_, &run_times),
-      TimeDelta::FromMilliseconds(1));
+      base::TimeDelta::FromMilliseconds(1));
   ThrottleableTaskQueue()->PostDelayedTask(
       FROM_HERE, base::Bind(&ExpensiveTestTask, &clock_, &run_times),
-      TimeDelta::FromMilliseconds(1));
+      base::TimeDelta::FromMilliseconds(1));
 
   mock_task_runner_->RunUntilTime(base::TimeTicks() +
                                   base::TimeDelta::FromMilliseconds(3500));
@@ -889,10 +890,10 @@
 
   ThrottleableTaskQueue()->PostDelayedTask(
       FROM_HERE, base::Bind(&ExpensiveTestTask, &clock_, &run_times),
-      TimeDelta::FromMicroseconds(1));
+      base::TimeDelta::FromMicroseconds(1));
   ThrottleableTaskQueue()->PostDelayedTask(
       FROM_HERE, base::Bind(&ExpensiveTestTask, &clock_, &run_times),
-      TimeDelta::FromMicroseconds(1));
+      base::TimeDelta::FromMicroseconds(1));
 
   mock_task_runner_->RunUntilIdle();
 
@@ -934,7 +935,7 @@
     ThrottleableTaskQueueForScheduler(web_frame_scheduler1.get())
         ->PostDelayedTask(FROM_HERE,
                           base::Bind(&ExpensiveTestTask, &clock_, &run_times),
-                          TimeDelta::FromMilliseconds(1));
+                          base::TimeDelta::FromMilliseconds(1));
   }
 
   mock_task_runner_->RunUntilTime(base::TimeTicks() +
@@ -955,7 +956,7 @@
     ThrottleableTaskQueueForScheduler(web_frame_scheduler1.get())
         ->PostDelayedTask(FROM_HERE,
                           base::Bind(&ExpensiveTestTask, &clock_, &run_times),
-                          TimeDelta::FromMilliseconds(1));
+                          base::TimeDelta::FromMilliseconds(1));
   }
 
   mock_task_runner_->RunUntilTime(base::TimeTicks() +
@@ -975,7 +976,7 @@
     ThrottleableTaskQueueForScheduler(web_frame_scheduler2.get())
         ->PostDelayedTask(FROM_HERE,
                           base::Bind(&ExpensiveTestTask, &clock_, &run_times),
-                          TimeDelta::FromMilliseconds(1));
+                          base::TimeDelta::FromMilliseconds(1));
   }
 
   mock_task_runner_->RunUntilTime(base::TimeTicks() +
@@ -1000,7 +1001,7 @@
     ThrottleableTaskQueueForScheduler(web_frame_scheduler1.get())
         ->PostDelayedTask(FROM_HERE,
                           base::Bind(&ExpensiveTestTask, &clock_, &run_times),
-                          TimeDelta::FromMilliseconds(1));
+                          base::TimeDelta::FromMilliseconds(1));
   }
 
   mock_task_runner_->RunUntilIdle();
diff --git a/third_party/WebKit/Source/platform/scheduler/renderer/webthread_impl_for_renderer_scheduler.cc b/third_party/WebKit/Source/platform/scheduler/renderer/webthread_impl_for_renderer_scheduler.cc
index f6759c7e..efd993a 100644
--- a/third_party/WebKit/Source/platform/scheduler/renderer/webthread_impl_for_renderer_scheduler.cc
+++ b/third_party/WebKit/Source/platform/scheduler/renderer/webthread_impl_for_renderer_scheduler.cc
@@ -44,8 +44,8 @@
   return idle_task_runner_.get();
 }
 
-blink::WebTaskRunner* WebThreadImplForRendererScheduler::GetWebTaskRunner()
-    const {
+base::SingleThreadTaskRunner*
+WebThreadImplForRendererScheduler::GetWebTaskRunner() const {
   return web_task_runner_.get();
 }
 
diff --git a/third_party/WebKit/Source/platform/scheduler/renderer/webthread_impl_for_renderer_scheduler.h b/third_party/WebKit/Source/platform/scheduler/renderer/webthread_impl_for_renderer_scheduler.h
index c5525c0..df621c9 100644
--- a/third_party/WebKit/Source/platform/scheduler/renderer/webthread_impl_for_renderer_scheduler.h
+++ b/third_party/WebKit/Source/platform/scheduler/renderer/webthread_impl_for_renderer_scheduler.h
@@ -28,7 +28,7 @@
   // WebThread implementation.
   WebScheduler* Scheduler() const override;
   PlatformThreadId ThreadId() const override;
-  WebTaskRunner* GetWebTaskRunner() const override;
+  base::SingleThreadTaskRunner* GetWebTaskRunner() const override;
   scoped_refptr<base::SingleThreadTaskRunner> GetSingleThreadTaskRunner()
       const override;
 
diff --git a/third_party/WebKit/Source/platform/scheduler/renderer/webthread_impl_for_renderer_scheduler_unittest.cc b/third_party/WebKit/Source/platform/scheduler/renderer/webthread_impl_for_renderer_scheduler_unittest.cc
index 7f686b7..bed5007f 100644
--- a/third_party/WebKit/Source/platform/scheduler/renderer/webthread_impl_for_renderer_scheduler_unittest.cc
+++ b/third_party/WebKit/Source/platform/scheduler/renderer/webthread_impl_for_renderer_scheduler_unittest.cc
@@ -13,7 +13,6 @@
 #include "base/run_loop.h"
 #include "base/single_thread_task_runner.h"
 #include "base/test/simple_test_tick_clock.h"
-#include "platform/WebTaskRunner.h"
 #include "platform/scheduler/renderer/renderer_scheduler_impl.h"
 #include "platform/scheduler/test/create_task_queue_manager_for_test.h"
 #include "testing/gmock/include/gmock/gmock.h"
diff --git a/third_party/WebKit/Source/platform/scheduler/test/fake_web_frame_scheduler.h b/third_party/WebKit/Source/platform/scheduler/test/fake_web_frame_scheduler.h
index d0118da..76b4eb2 100644
--- a/third_party/WebKit/Source/platform/scheduler/test/fake_web_frame_scheduler.h
+++ b/third_party/WebKit/Source/platform/scheduler/test/fake_web_frame_scheduler.h
@@ -8,7 +8,6 @@
 #include <deque>
 
 #include "platform/WebFrameScheduler.h"
-#include "platform/WebTaskRunner.h"
 #include "platform/scheduler/renderer/main_thread_task_queue.h"
 
 namespace blink {
@@ -114,7 +113,7 @@
   WebFrameScheduler::FrameType GetFrameType() const override {
     return frame_type_;
   }
-  scoped_refptr<WebTaskRunner> GetTaskRunner(TaskType) override {
+  scoped_refptr<base::SingleThreadTaskRunner> GetTaskRunner(TaskType) override {
     return nullptr;
   }
   WebViewScheduler* GetWebViewScheduler() const override {
diff --git a/third_party/WebKit/Source/platform/scheduler/test/fake_web_task_runner.cc b/third_party/WebKit/Source/platform/scheduler/test/fake_web_task_runner.cc
index ac6afa1..315b39d 100644
--- a/third_party/WebKit/Source/platform/scheduler/test/fake_web_task_runner.cc
+++ b/third_party/WebKit/Source/platform/scheduler/test/fake_web_task_runner.cc
@@ -12,6 +12,7 @@
 #include "base/logging.h"
 #include "base/single_thread_task_runner.h"
 #include "platform/wtf/RefCounted.h"
+#include "platform/wtf/ThreadSafeRefCounted.h"
 
 namespace blink {
 namespace scheduler {
diff --git a/third_party/WebKit/Source/platform/scheduler/test/fake_web_task_runner.h b/third_party/WebKit/Source/platform/scheduler/test/fake_web_task_runner.h
index f290536..54ea871 100644
--- a/third_party/WebKit/Source/platform/scheduler/test/fake_web_task_runner.h
+++ b/third_party/WebKit/Source/platform/scheduler/test/fake_web_task_runner.h
@@ -10,14 +10,14 @@
 #include "base/callback.h"
 #include "base/macros.h"
 #include "base/memory/scoped_refptr.h"
+#include "base/single_thread_task_runner.h"
 #include "base/time/time.h"
-#include "platform/WebTaskRunner.h"
 
 namespace blink {
 namespace scheduler {
 
 // A dummy WebTaskRunner for tests.
-class FakeWebTaskRunner : public WebTaskRunner {
+class FakeWebTaskRunner : public base::SingleThreadTaskRunner {
  public:
   FakeWebTaskRunner();
 
diff --git a/third_party/WebKit/Source/platform/scheduler/test/renderer_scheduler_test_support.cc b/third_party/WebKit/Source/platform/scheduler/test/renderer_scheduler_test_support.cc
index 08793016..7158943 100644
--- a/third_party/WebKit/Source/platform/scheduler/test/renderer_scheduler_test_support.cc
+++ b/third_party/WebKit/Source/platform/scheduler/test/renderer_scheduler_test_support.cc
@@ -6,6 +6,7 @@
 
 #include <memory>
 
+#include "base/single_thread_task_runner.h"
 #include "base/threading/sequenced_task_runner_handle.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "platform/scheduler/renderer/renderer_scheduler_impl.h"
@@ -23,7 +24,7 @@
       : TaskQueueManager(std::move(thread_controller)) {}
 };
 
-class WebTaskRunnerProxy : public WebTaskRunner {
+class WebTaskRunnerProxy : public base::SingleThreadTaskRunner {
  public:
   explicit WebTaskRunnerProxy(
       scoped_refptr<base::SingleThreadTaskRunner> task_runner)
@@ -75,7 +76,7 @@
   return base::ThreadTaskRunnerHandle::Get();
 }
 
-scoped_refptr<WebTaskRunner> CreateWebTaskRunnerForTesting() {
+scoped_refptr<base::SingleThreadTaskRunner> CreateWebTaskRunnerForTesting() {
   return new WebTaskRunnerProxy(GetSingleThreadTaskRunnerForTesting());
 }
 
diff --git a/third_party/WebKit/Source/platform/testing/TestingPlatformSupportWithMockScheduler.cpp b/third_party/WebKit/Source/platform/testing/TestingPlatformSupportWithMockScheduler.cpp
index f472c3d..c90a0cd 100644
--- a/third_party/WebKit/Source/platform/testing/TestingPlatformSupportWithMockScheduler.cpp
+++ b/third_party/WebKit/Source/platform/testing/TestingPlatformSupportWithMockScheduler.cpp
@@ -11,6 +11,7 @@
 #include "platform/scheduler/renderer/renderer_scheduler_impl.h"
 #include "platform/scheduler/test/create_task_queue_manager_for_test.h"
 #include "platform/wtf/ThreadSpecific.h"
+#include "platform/wtf/Time.h"
 #include "public/platform/scheduler/child/webthread_base.h"
 
 namespace blink {
diff --git a/third_party/WebKit/Source/platform/wtf/Deque.h b/third_party/WebKit/Source/platform/wtf/Deque.h
index 6b84b8a..4ded18d6 100644
--- a/third_party/WebKit/Source/platform/wtf/Deque.h
+++ b/third_party/WebKit/Source/platform/wtf/Deque.h
@@ -676,29 +676,33 @@
 Deque<T, inlineCapacity, Allocator>::Trace(VisitorDispatcher visitor) {
   static_assert(Allocator::kIsGarbageCollected,
                 "Garbage collector must be enabled.");
-  const T* buffer_begin = buffer_.Buffer();
-  const T* end = buffer_begin + end_;
-  if (IsTraceableInCollectionTrait<VectorTraits<T>>::value) {
-    if (start_ <= end_) {
-      for (const T* buffer_entry = buffer_begin + start_; buffer_entry != end;
-           buffer_entry++)
-        Allocator::template Trace<VisitorDispatcher, T, VectorTraits<T>>(
-            visitor, *const_cast<T*>(buffer_entry));
-    } else {
-      for (const T* buffer_entry = buffer_begin; buffer_entry != end;
-           buffer_entry++)
-        Allocator::template Trace<VisitorDispatcher, T, VectorTraits<T>>(
-            visitor, *const_cast<T*>(buffer_entry));
-      const T* buffer_end = buffer_.Buffer() + buffer_.capacity();
-      for (const T* buffer_entry = buffer_begin + start_;
-           buffer_entry != buffer_end; buffer_entry++)
-        Allocator::template Trace<VisitorDispatcher, T, VectorTraits<T>>(
-            visitor, *const_cast<T*>(buffer_entry));
-    }
-  }
   if (buffer_.HasOutOfLineBuffer()) {
-    Allocator::MarkNoTracing(visitor, buffer_.Buffer());
-    Allocator::RegisterBackingStoreReference(visitor, buffer_.BufferSlot());
+    Allocator::TraceVectorBacking(visitor, buffer_.Buffer(),
+                                  buffer_.BufferSlot());
+  } else {
+    const T* buffer_begin = buffer_.Buffer();
+    const T* end = buffer_begin + end_;
+    if (IsTraceableInCollectionTrait<VectorTraits<T>>::value) {
+      if (start_ <= end_) {
+        for (const T* buffer_entry = buffer_begin + start_; buffer_entry != end;
+             buffer_entry++) {
+          Allocator::template Trace<VisitorDispatcher, T, VectorTraits<T>>(
+              visitor, *const_cast<T*>(buffer_entry));
+        }
+      } else {
+        for (const T* buffer_entry = buffer_begin; buffer_entry != end;
+             buffer_entry++) {
+          Allocator::template Trace<VisitorDispatcher, T, VectorTraits<T>>(
+              visitor, *const_cast<T*>(buffer_entry));
+        }
+        const T* buffer_end = buffer_.Buffer() + buffer_.capacity();
+        for (const T* buffer_entry = buffer_begin + start_;
+             buffer_entry != buffer_end; buffer_entry++) {
+          Allocator::template Trace<VisitorDispatcher, T, VectorTraits<T>>(
+              visitor, *const_cast<T*>(buffer_entry));
+        }
+      }
+    }
   }
 }
 
diff --git a/third_party/WebKit/Source/platform/wtf/Vector.h b/third_party/WebKit/Source/platform/wtf/Vector.h
index 8b451bd..3054dce0 100644
--- a/third_party/WebKit/Source/platform/wtf/Vector.h
+++ b/third_party/WebKit/Source/platform/wtf/Vector.h
@@ -1959,8 +1959,7 @@
   return !(a == b);
 }
 
-// This is only defined if the allocator is a HeapAllocator. It is used when
-// visiting during a tracing GC.
+// Only defined for HeapAllocator. Used when visiting vector object.
 template <typename T, size_t inlineCapacity, typename Allocator>
 template <typename VisitorDispatcher, typename A>
 std::enable_if_t<A::kIsGarbageCollected>
@@ -1970,23 +1969,19 @@
   if (!Buffer())
     return;
   if (this->HasOutOfLineBuffer()) {
-    // This is a performance optimization for a case where the buffer has
-    // been already traced by somewhere. This can happen if the conservative
-    // scanning traced an on-stack (false-positive or real) pointer to the
-    // HeapVector, and then visitor->trace() traces the HeapVector.
-    if (Allocator::IsHeapObjectAlive(Buffer()))
-      return;
-    Allocator::MarkNoTracing(visitor, Buffer());
-    Allocator::RegisterBackingStoreReference(visitor, Base::BufferSlot());
-  }
-  const T* buffer_begin = Buffer();
-  const T* buffer_end = Buffer() + size();
-  if (IsTraceableInCollectionTrait<VectorTraits<T>>::value) {
-    for (const T* buffer_entry = buffer_begin; buffer_entry != buffer_end;
-         buffer_entry++)
-      Allocator::template Trace<VisitorDispatcher, T, VectorTraits<T>>(
-          visitor, *const_cast<T*>(buffer_entry));
-    CheckUnusedSlots(Buffer() + size(), Buffer() + capacity());
+    Allocator::TraceVectorBacking(visitor, Buffer(), Base::BufferSlot());
+  } else {
+    // Inline buffer requires tracing immediately.
+    const T* buffer_begin = Buffer();
+    const T* buffer_end = Buffer() + size();
+    if (IsTraceableInCollectionTrait<VectorTraits<T>>::value) {
+      for (const T* buffer_entry = buffer_begin; buffer_entry != buffer_end;
+           buffer_entry++) {
+        Allocator::template Trace<VisitorDispatcher, T, VectorTraits<T>>(
+            visitor, *const_cast<T*>(buffer_entry));
+      }
+      CheckUnusedSlots(Buffer() + size(), Buffer() + capacity());
+    }
   }
 }
 
diff --git a/third_party/WebKit/Tools/Scripts/audit-non-blink-usage.py b/third_party/WebKit/Tools/Scripts/audit-non-blink-usage.py
index 81777733..2a1253a 100755
--- a/third_party/WebKit/Tools/Scripts/audit-non-blink-usage.py
+++ b/third_party/WebKit/Tools/Scripts/audit-non-blink-usage.py
@@ -245,6 +245,10 @@
         A list of line number, disallowed identifier tuples.
     """
     results = []
+    basename, ext = os.path.splitext(path)
+    # Only check code. Ignore tests.
+    if ext not in ('.cc', '.cpp', '.h', '.mm') or basename.endswith('Test'):
+        return results
     entries = _find_matching_entries(path)
     if not entries:
         return
@@ -261,12 +265,6 @@
 
 def main():
     for path in sys.stdin.read().splitlines():
-        basename, ext = os.path.splitext(path)
-        if ext not in ('.cc', '.cpp', '.h', '.mm'):
-            continue
-        # Ignore test files.
-        if basename.endswith('Test'):
-            continue
         try:
             with open(path, 'r') as f:
                 contents = f.read()
diff --git a/third_party/WebKit/public/BUILD.gn b/third_party/WebKit/public/BUILD.gn
index ef9595a..8187f6ed 100644
--- a/third_party/WebKit/public/BUILD.gn
+++ b/third_party/WebKit/public/BUILD.gn
@@ -418,7 +418,6 @@
     "platform/modules/remoteplayback/WebRemotePlaybackState.h",
     "platform/modules/screen_orientation/WebLockOrientationCallback.h",
     "platform/modules/screen_orientation/WebLockOrientationError.h",
-    "platform/modules/screen_orientation/WebScreenOrientationClient.h",
     "platform/modules/screen_orientation/WebScreenOrientationEnumTraits.h",
     "platform/modules/screen_orientation/WebScreenOrientationLockType.h",
     "platform/modules/screen_orientation/WebScreenOrientationType.h",
diff --git a/third_party/WebKit/public/platform/Platform.h b/third_party/WebKit/public/platform/Platform.h
index c75dba69..2683cc4 100644
--- a/third_party/WebKit/public/platform/Platform.h
+++ b/third_party/WebKit/public/platform/Platform.h
@@ -131,7 +131,6 @@
 class WebStorageNamespace;
 class WebSyncProvider;
 struct WebFloatPoint;
-class WebTaskRunner;
 class WebThemeEngine;
 class WebThread;
 struct WebThreadCreationParams;
@@ -469,7 +468,7 @@
   virtual WebThread* CompositorThread() const { return 0; }
 
   // Returns an interface to the file task runner.
-  WebTaskRunner* FileTaskRunner() const;
+  base::SingleThreadTaskRunner* FileTaskRunner() const;
   scoped_refptr<base::SingleThreadTaskRunner> BaseFileTaskRunner() const;
 
   // Returns an interface to the IO task runner.
diff --git a/third_party/WebKit/public/platform/WebThread.h b/third_party/WebKit/public/platform/WebThread.h
index 844e4147..e1baf6fc 100644
--- a/third_party/WebKit/public/platform/WebThread.h
+++ b/third_party/WebKit/public/platform/WebThread.h
@@ -41,7 +41,6 @@
 }
 
 class WebScheduler;
-class WebTaskRunner;
 
 // Always an integer value.
 typedef uintptr_t PlatformThreadId;
@@ -75,7 +74,9 @@
   // Default scheduler task queue does not give scheduler enough freedom to
   // manage task priorities and should not be used.
   // Use TaskRunnerHelper::Get instead (crbug.com/624696).
-  virtual WebTaskRunner* GetWebTaskRunner() const { return nullptr; }
+  virtual base::SingleThreadTaskRunner* GetWebTaskRunner() const {
+    return nullptr;
+  }
   virtual scoped_refptr<base::SingleThreadTaskRunner>
   GetSingleThreadTaskRunner() const;
 
diff --git a/third_party/WebKit/public/platform/modules/screen_orientation/WebScreenOrientationClient.h b/third_party/WebKit/public/platform/modules/screen_orientation/WebScreenOrientationClient.h
deleted file mode 100644
index 56375df..0000000
--- a/third_party/WebKit/public/platform/modules/screen_orientation/WebScreenOrientationClient.h
+++ /dev/null
@@ -1,32 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef WebScreenOrientationClient_h
-#define WebScreenOrientationClient_h
-
-#include "public/platform/modules/screen_orientation/WebScreenOrientationLockType.h"
-#include <memory>
-
-namespace blink {
-
-class WebLockOrientationCallback;
-
-// Client handling screen orientation locking for a given WebFrame.
-class WebScreenOrientationClient {
- public:
-  virtual ~WebScreenOrientationClient() = default;
-
-  // Request a screen orientation lock. The implementation will own the
-  // callback.
-  virtual void LockOrientation(WebScreenOrientationLockType,
-                               std::unique_ptr<WebLockOrientationCallback>) = 0;
-
-  // Unlock the screen orientation. No-op if the screen orientation was not
-  // locked.
-  virtual void UnlockOrientation() = 0;
-};
-
-}  // namespace blink
-
-#endif  // WebScreenOrientationClient_h
diff --git a/third_party/WebKit/public/platform/scheduler/test/renderer_scheduler_test_support.h b/third_party/WebKit/public/platform/scheduler/test/renderer_scheduler_test_support.h
index 694b2ad..873ec53e2 100644
--- a/third_party/WebKit/public/platform/scheduler/test/renderer_scheduler_test_support.h
+++ b/third_party/WebKit/public/platform/scheduler/test/renderer_scheduler_test_support.h
@@ -15,8 +15,6 @@
 
 namespace blink {
 
-class WebTaskRunner;
-
 namespace scheduler {
 
 class RendererScheduler;
@@ -37,8 +35,8 @@
 scoped_refptr<base::SingleThreadTaskRunner>
 GetSingleThreadTaskRunnerForTesting();
 
-// Creates a WebTaskRunner for testing.
-scoped_refptr<WebTaskRunner> CreateWebTaskRunnerForTesting();
+// Creates a task runner for testing.
+scoped_refptr<base::SingleThreadTaskRunner> CreateWebTaskRunnerForTesting();
 
 }  // namespace scheduler
 }  // namespace blink
diff --git a/third_party/WebKit/public/platform/web_feature.mojom b/third_party/WebKit/public/platform/web_feature.mojom
index 7ca2acc..287c713 100644
--- a/third_party/WebKit/public/platform/web_feature.mojom
+++ b/third_party/WebKit/public/platform/web_feature.mojom
@@ -1862,6 +1862,8 @@
   kV8HTMLElement_Autocapitalize_AttributeGetter = 2349,
   kV8HTMLElement_Autocapitalize_AttributeSetter = 2350,
   kCSSLegacyAlignment = 2351,
+  kSRISignatureCheck = 2352,
+  kSRISignatureSuccess = 2353,
 
   // Add new features immediately above this line. Don't change assigned
   // numbers of any item, and don't reuse removed slots.
diff --git a/third_party/WebKit/public/web/WebAssociatedURLLoader.h b/third_party/WebKit/public/web/WebAssociatedURLLoader.h
index bb85f260..e250949 100644
--- a/third_party/WebKit/public/web/WebAssociatedURLLoader.h
+++ b/third_party/WebKit/public/web/WebAssociatedURLLoader.h
@@ -35,10 +35,13 @@
 
 #include "public/platform/WebCommon.h"
 
+namespace base {
+class SingleThreadTaskRunner;
+}
+
 namespace blink {
 
 class WebAssociatedURLLoaderClient;
-class WebTaskRunner;
 class WebURLRequest;
 
 // This class is used to implement WebFrame::createAssociatedURLLoader.
@@ -50,7 +53,7 @@
                                   WebAssociatedURLLoaderClient*) = 0;
   virtual void Cancel() = 0;
   virtual void SetDefersLoading(bool) = 0;
-  virtual void SetLoadingTaskRunner(WebTaskRunner*) = 0;
+  virtual void SetLoadingTaskRunner(base::SingleThreadTaskRunner*) = 0;
 };
 
 }  // namespace blink
diff --git a/third_party/WebKit/public/web/WebFrameClient.h b/third_party/WebKit/public/web/WebFrameClient.h
index e48cb23..c6299c2 100644
--- a/third_party/WebKit/public/web/WebFrameClient.h
+++ b/third_party/WebKit/public/web/WebFrameClient.h
@@ -108,7 +108,6 @@
 class WebPushClient;
 class WebRTCPeerConnectionHandler;
 class WebRelatedAppsFetcher;
-class WebScreenOrientationClient;
 class WebString;
 class WebURL;
 class WebURLResponse;
@@ -746,13 +745,6 @@
   // content/ APIs.
   virtual bool ShouldBlockWebGL() { return false; }
 
-  // Screen Orientation --------------------------------------------------
-
-  // Access the embedder API for (client-based) screen orientation client .
-  virtual WebScreenOrientationClient* GetWebScreenOrientationClient() {
-    return nullptr;
-  }
-
   // Accessibility -------------------------------------------------------
 
   // Notifies embedder about an accessibility event.
diff --git a/third_party/sqlite/BUILD.gn b/third_party/sqlite/BUILD.gn
index 21836ba90..c23f10af 100644
--- a/third_party/sqlite/BUILD.gn
+++ b/third_party/sqlite/BUILD.gn
@@ -11,6 +11,98 @@
   use_system_sqlite = is_ios
 }
 
+# Compile-time options passed to SQLite.
+#
+# These options are used when building our own SQLite library, which happens
+# everywhere except on iOS. These compile-time options are exported via a
+# public_config to all targets using SQLite, because they're needed by the
+# sqlite.h header. To avoid name clashes (macro names are resolved using a
+# global namespace), this block should only contain preprocessor macros that
+# are unambiguously connected to SQLite.
+#
+# The vast majority of the macros here are documented at
+# https://www.sqlite.org/compile.html
+config("chromium_sqlite3_compile_options") {
+  defines = [
+    "SQLITE_ENABLE_FTS3",
+
+    # New unicode61 tokenizer with built-in tables.
+    "SQLITE_DISABLE_FTS3_UNICODE",
+
+    # Chromium currently does not enable fts4, disable extra code.
+    "SQLITE_DISABLE_FTS4_DEFERRED",
+    "SQLITE_ENABLE_ICU",
+    "SQLITE_ENABLE_MEMORY_MANAGEMENT",
+    "SQLITE_SECURE_DELETE",
+
+    # Custom flag to tweak pcache pools.
+    # TODO(shess): This shouldn't use faux-SQLite naming.
+    "SQLITE_SEPARATE_CACHE_POOLS",
+
+    # TODO(shess): SQLite adds mutexes to protect structures which cross
+    # threads. In theory Chromium should be able to turn this to "2" which
+    # should give a slight speed boost. "2" is safe as long as a single
+    # connection is not used by more than one thread at a time.
+    "SQLITE_THREADSAFE=1",
+
+    # SQLite can spawn threads to sort in parallel if configured
+    # appropriately.  Chromium doesn't configure SQLite for that, and would
+    # prefer to control distribution to worker threads.
+    "SQLITE_MAX_WORKER_THREADS=0",
+
+    # Allow 256MB mmap footprint per connection.  Should not be too open-ended
+    # as that could cause memory fragmentation.  50MB encompasses the 99th
+    # percentile of Chrome databases in the wild.
+    # TODO(shess): A 64-bit-specific value could be 1G or more.
+    # TODO(shess): Figure out if exceeding this is costly.
+    "SQLITE_MAX_MMAP_SIZE=268435456",
+
+    # Use a read-only memory map when mmap'ed I/O is enabled to prevent memory
+    # stompers from directly corrupting the database.
+    # TODO(shess): Upstream the ability to use this define.
+    "SQLITE_MMAP_READ_ONLY=1",
+
+    # By default SQLite pre-allocates 100 pages of pcache data, which will not
+    # be released until the handle is closed.  This is contrary to Chromium's
+    # memory-usage goals.
+    "SQLITE_DEFAULT_PCACHE_INITSZ=0",
+
+    # NOTE(shess): Some defines can affect the amalgamation.  Those should be
+    # added to google_generate_amalgamation.sh, and the amalgamation
+    # re-generated.  Usually this involves disabling features which include
+    # keywords or syntax, for instance SQLITE_OMIT_VIRTUALTABLE omits the
+    # virtual table syntax entirely.  Missing an item usually results in
+    # syntax working but execution failing.  Review:
+    #   src/src/parse.py
+    #   src/tool/mkkeywordhash.c
+  ]
+
+  # Pull in config.h on Linux.  This allows use of preprocessor macros which
+  # are not available to the build config.
+  if (is_linux) {
+    defines += [ "_HAVE_SQLITE_CONFIG_H" ]
+  }
+
+  if (using_sanitizer) {
+    # Limit max length of data blobs and queries for fuzzing builds by 128 MB.
+    defines += [
+      "SQLITE_MAX_LENGTH=128000000",
+      "SQLITE_MAX_SQL_LENGTH=128000000",
+      "SQLITE_PRINTF_PRECISION_LIMIT=1280000",
+    ]
+
+    # During fuzz testing, valid SQL queries generated by fuzzing engine may
+    # lead to large memory allocations. If that happens, fuzzer reports an
+    # out-of-memory error. However, such errors are not valid bugs.
+    # To avoid hitting those irrelevant OOMs, we limit max number of memory
+    # pages, so fuzzer will not crash when reaching the limit.
+    # Apply this for fuzzing builds only, not for all builds with sanitizers.
+    if (use_fuzzing_engine) {
+      defines += [ "SQLITE_MAX_PAGE_COUNT=16384" ]
+    }
+  }
+}
+
 if (!use_system_sqlite) {
   config("sqlite_warnings") {
     cflags = []
@@ -46,59 +138,8 @@
     ]
 
     cflags = []
-    defines = [
-      "SQLITE_ENABLE_FTS3",
+    defines = []
 
-      # New unicode61 tokenizer with built-in tables.
-      "SQLITE_DISABLE_FTS3_UNICODE",
-
-      # Chromium currently does not enable fts4, disable extra code.
-      "SQLITE_DISABLE_FTS4_DEFERRED",
-      "SQLITE_ENABLE_ICU",
-      "SQLITE_ENABLE_MEMORY_MANAGEMENT",
-      "SQLITE_SECURE_DELETE",
-
-      # Custom flag to tweak pcache pools.
-      # TODO(shess): This shouldn't use faux-SQLite naming.
-      "SQLITE_SEPARATE_CACHE_POOLS",
-
-      # TODO(shess): SQLite adds mutexes to protect structures which cross
-      # threads. In theory Chromium should be able to turn this to "2" which
-      # should give a slight speed boost. "2" is safe as long as a single
-      # connection is not used by more than one thread at a time.
-      "SQLITE_THREADSAFE=1",
-
-      # SQLite can spawn threads to sort in parallel if configured
-      # appropriately.  Chromium doesn't configure SQLite for that, and would
-      # prefer to control distribution to worker threads.
-      "SQLITE_MAX_WORKER_THREADS=0",
-
-      # Allow 256MB mmap footprint per connection.  Should not be too open-ended
-      # as that could cause memory fragmentation.  50MB encompasses the 99th
-      # percentile of Chrome databases in the wild.
-      # TODO(shess): A 64-bit-specific value could be 1G or more.
-      # TODO(shess): Figure out if exceeding this is costly.
-      "SQLITE_MAX_MMAP_SIZE=268435456",
-
-      # Use a read-only memory map when mmap'ed I/O is enabled to prevent memory
-      # stompers from directly corrupting the database.
-      # TODO(shess): Upstream the ability to use this define.
-      "SQLITE_MMAP_READ_ONLY=1",
-
-      # By default SQLite pre-allocates 100 pages of pcache data, which will not
-      # be released until the handle is closed.  This is contrary to Chromium's
-      # memory-usage goals.
-      "SQLITE_DEFAULT_PCACHE_INITSZ=0",
-
-      # NOTE(shess): Some defines can affect the amalgamation.  Those should be
-      # added to google_generate_amalgamation.sh, and the amalgamation
-      # re-generated.  Usually this involves disabling features which include
-      # keywords or syntax, for instance SQLITE_OMIT_VIRTUALTABLE omits the
-      # virtual table syntax entirely.  Missing an item usually results in
-      # syntax working but execution failing.  Review:
-      #   src/src/parse.py
-      #   src/tool/mkkeywordhash.c
-    ]
     if (is_component_build) {
       if (is_win) {
         defines += [ "SQLITE_API=__declspec(dllexport)" ]
@@ -106,6 +147,14 @@
         defines += [ "SQLITE_API=__attribute__((visibility(\"default\")))" ]
       }
     }
+
+    if (is_linux || is_android) {
+      defines += [
+        # Linux provides fdatasync(), a faster equivalent of fsync().
+        "fdatasync=fdatasync",
+      ]
+    }
+
     if (is_posix) {
       defines += [
         # Allow xSleep() call on Unix to use usleep() rather than sleep(), so it
@@ -118,42 +167,12 @@
         "USE_PREAD=1",
       ]
     }
-    if (is_linux || is_android) {
-      defines += [
-        # Linux provides fdatasync(), a faster equivalent of fsync().
-        "fdatasync=fdatasync",
-      ]
-    }
-
-    # Pull in config.h on Linux.  This allows use of preprocessor macros which
-    # are not available to the build config.
-    if (is_linux) {
-      defines += [ "_HAVE_SQLITE_CONFIG_H" ]
-    }
-
-    if (using_sanitizer) {
-      # Limit max length of data blobs and queries for fuzzing builds by 128 MB.
-      defines += [
-        "SQLITE_MAX_LENGTH=128000000",
-        "SQLITE_MAX_SQL_LENGTH=128000000",
-        "SQLITE_PRINTF_PRECISION_LIMIT=1280000",
-      ]
-
-      # During fuzz testing, valid SQL queries generated by fuzzing engine may
-      # lead to large memory allocations. If that happens, fuzzer reports an
-      # out-of-memory error. However, such errors are not valid bugs.
-      # To avoid hitting those irrelevant OOMs, we limit max number of memory
-      # pages, so fuzzer will not crash when reaching the limit.
-      # Apply this for fuzzing builds only, not for all builds with sanitizers.
-      if (use_fuzzing_engine) {
-        defines += [ "SQLITE_MAX_PAGE_COUNT=16384" ]
-      }
-    }
 
     include_dirs = [ "amalgamation" ]
 
     configs -= [ "//build/config/compiler:chromium_code" ]
     configs += [
+      ":chromium_sqlite3_compile_options",
       "//build/config/compiler:no_chromium_code",
 
       # Must be after no_chromium_code for warning flags to be ordered
@@ -195,7 +214,10 @@
     public_deps = [
       ":chromium_sqlite3",
     ]
-    public_configs = [ ":sqlite_export" ]
+    public_configs = [
+      ":chromium_sqlite3_compile_options",
+      ":sqlite_export",
+    ]
   }
 
   if (is_linux) {
@@ -216,6 +238,16 @@
         "//build/config:exe_and_shlib_deps",
         "//third_party/icu",
       ]
+
+      configs -= [ "//build/config/compiler:chromium_code" ]
+      configs += [
+        ":chromium_sqlite3_compile_options",
+        "//build/config/compiler:no_chromium_code",
+
+        # Must be after no_chromium_code for warning flags to be ordered
+        # correctly.
+        ":sqlite_warnings",
+      ]
     }
   }
 }
@@ -225,7 +257,7 @@
   # version shipped with Chromium. Export a "sqlite" target so the change
   # can be localized to this file.
 
-  config("sqlite_config") {
+  config("system_sqlite_config") {
     defines = [ "USE_SYSTEM_SQLITE" ]
     if (is_ios) {
       libs = [ "sqlite3" ]
@@ -235,7 +267,7 @@
   }
 
   source_set("sqlite") {
-    public_configs = [ ":sqlite_config" ]
+    public_configs = [ ":system_sqlite_config" ]
     if (is_ios) {
       public_deps = [
         ":sqlite_recover",
diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
index a8f73d7..3d5ff0e 100644
--- a/tools/metrics/histograms/enums.xml
+++ b/tools/metrics/histograms/enums.xml
@@ -17581,8 +17581,7 @@
   <int value="2228" label="DocumentPageShowRegistered"/>
   <int value="2229" label="DocumentPageShowFired"/>
   <int value="2230" label="ReplaceCharsetInXHR"/>
-  <int value="2231"
-      label="RespondToSameOriginRequestWithCrossOriginResponse (obsolete)"/>
+  <int value="2231" label="RespondToSameOriginRequestWithCrossOriginResponse"/>
   <int value="2232" label="LinkRelModulePreload"/>
   <int value="2233" label="PerformanceMeasurePassedInObject"/>
   <int value="2234" label="PerformanceMeasurePassedInNavigationTiming"/>
@@ -17705,6 +17704,8 @@
   <int value="2349" label="V8HTMLElement_Autocapitalize_AttributeGetter"/>
   <int value="2350" label="V8HTMLElement_Autocapitalize_AttributeSetter"/>
   <int value="2351" label="CSSLegacyAlignment"/>
+  <int value="2352" label="SRISignatureCheck"/>
+  <int value="2353" label="SRISignatureSuccess"/>
 </enum>
 
 <enum name="FeedbackSource">
@@ -39408,6 +39409,7 @@
     Signout including the primary account.
   </int>
   <int value="2" label="SignoutSecondary">Signout only secondary accounts.</int>
+  <int value="3" label="EnableSync">Enable Sync after signin.</int>
 </enum>
 
 <enum name="SigninDiceTokenFetchResult">
diff --git a/tools/metrics/ukm/ukm.xml b/tools/metrics/ukm/ukm.xml
index 83a37e39..c04baef 100644
--- a/tools/metrics/ukm/ukm.xml
+++ b/tools/metrics/ukm/ukm.xml
@@ -2695,31 +2695,4 @@
   </metric>
 </event>
 
-<event name="Blink.UpdateTime">
-  <owner>chrishtr@chromium.org</owner>
-  <summary>
-    Records various rendering performance metrics (in microseconds).
-  </summary>
-  <metric name="Compositing">
-    <summary>
-      Time taken by the compositing phase in microseconds.
-    </summary>
-  </metric>
-  <metric name="Paint">
-    <summary>
-      Time taken by the compositing phase in microseconds.
-    </summary>
-  </metric>
-  <metric name="PrePaint">
-    <summary>
-      Time taken by the pre-paint phase in microseconds.
-    </summary>
-  </metric>
-  <metric name="StyleAndLayout">
-    <summary>
-      Time taken by the style and layout phases in microseconds.
-    </summary>
-  </metric>
-</event>
-
 </ukm-configuration>
diff --git a/tools/perf/BUILD.gn b/tools/perf/BUILD.gn
index ae4db175..91798f6 100644
--- a/tools/perf/BUILD.gn
+++ b/tools/perf/BUILD.gn
@@ -41,3 +41,24 @@
     flag_name = "--chromium-output-directory"
   }
 }
+
+# Temporary group for running benchmarks without building Chrome
+# Will be removed as a part of crbug.com/758632
+group("perf_experimental") {
+  testonly = true
+  deps = [
+    "//tools/perf/chrome_telemetry_build:telemetry_chrome_test_experimental",
+  ]
+
+  data = [
+    "//tools/perf/",
+
+    # Field trial config
+    "//tools/variations/",
+    "//testing/variations/",
+
+    # Field trial dependencies
+    "//tools/json_comment_eater/",
+    "//tools/json_to_struct/",
+  ]
+}
diff --git a/tools/perf/chrome_telemetry_build/BUILD.gn b/tools/perf/chrome_telemetry_build/BUILD.gn
index 9a6ff760..3b4e270 100644
--- a/tools/perf/chrome_telemetry_build/BUILD.gn
+++ b/tools/perf/chrome_telemetry_build/BUILD.gn
@@ -72,3 +72,67 @@
     }
   }
 }
+
+group("telemetry_chrome_test_experimental") {
+  testonly = true
+
+  if (is_android) {
+    data_deps = [
+      "//chrome/android:chrome_public_apk",
+    ]
+
+    if (public_android_sdk) {
+      data_deps += [
+        "//android_webview:system_webview_apk",
+        "//android_webview/tools/system_webview_shell:system_webview_shell_apk",
+      ]
+    }
+  } else {
+    data_deps = [
+      "//third_party/catapult/telemetry:bitmaptools",
+    ]
+  }
+
+  data = [
+    "//tools/perf/core/",  # chrome_telemetry_build/ depends on core/
+    "//tools/perf/chrome_telemetry_build/",
+    "//third_party/catapult/",
+    "//components/crash/content/tools/generate_breakpad_symbols.py",
+  ]
+
+  if (is_win) {
+    data_deps += [ "//chrome:reorder_imports" ]
+  }
+
+  if (is_linux) {
+    data_deps += [ "//third_party/breakpad:dump_syms($host_toolchain)" ]
+  }
+
+  if (is_mac) {
+    data_deps += [
+      "//chrome:chrome_framework",
+      "//chrome:chrome_helper_app",
+      "//third_party/breakpad:dump_syms",
+      "//third_party/crashpad/crashpad/tools:crashpad_database_util",
+    ]
+  }
+
+  if (is_win && (symbol_level == 1 || symbol_level == 2)) {
+    data_deps += [
+      "//build/win:copy_cdb_to_output",
+      "//third_party/crashpad/crashpad/tools:crashpad_database_util",
+    ]
+
+    # TODO(GYP): These should be provided automatically through data_deps.
+    data += [ "$root_out_dir/chrome.exe.pdb" ]
+    if (is_component_build) {
+      data += [
+        "$root_out_dir/base.dll.pdb",
+        "$root_out_dir/blink_platform.dll.pdb",
+        "$root_out_dir/content.dll.pdb",
+      ]
+    } else {
+      data += [ "$root_out_dir/chrome_child.dll.pdb" ]
+    }
+  }
+}
diff --git a/tools/perf/chromium.perf.fyi.extras.json b/tools/perf/chromium.perf.fyi.extras.json
index bfec1e1..87e276c 100644
--- a/tools/perf/chromium.perf.fyi.extras.json
+++ b/tools/perf/chromium.perf.fyi.extras.json
@@ -277,17 +277,17 @@
     "isolated_scripts": [
       {
         "args": [
-          "smoothness.maps",
+          "dummy_benchmark.histogram_benchmark_1",
           "-v",
           "--output-format=histograms",
           "--output-format=json-test-results",
           "--xvfb",
-          "--browser=release"
+          "--browser=reference"
         ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "benchmark1 smoothness.maps",
+        "isolate_name": "telemetry_perf_tests_experimental",
+        "name": "benchmark1 dummy_benchmark.histogram_benchmark_1",
         "override_compile_targets": [
-          "telemetry_perf_tests"
+          "telemetry_perf_tests_experimental"
         ],
         "merge": {
           "args": [
@@ -310,17 +310,17 @@
       },
       {
         "args": [
-          "blink_perf.css",
+          "dummy_benchmark.stable_benchmark_1",
           "-v",
           "--output-format=histograms",
           "--output-format=json-test-results",
           "--xvfb",
-          "--browser=release"
+          "--browser=reference"
         ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "benchmark2 blink_perf.css",
+        "isolate_name": "telemetry_perf_tests_experimental",
+        "name": "benchmark2 dummy_benchmark.stable_benchmark_1",
         "override_compile_targets": [
-          "telemetry_perf_tests"
+          "telemetry_perf_tests_experimental"
         ],
         "merge": {
           "args": [
@@ -347,7 +347,7 @@
           "--output-format=histograms",
           "--output-format=json-test-results",
           "--xvfb",
-          "--browser=release"
+          "--browser=reference"
         ],
         "isolate_name": "performance_test_suite",
         "name": "performance_test_suite",
diff --git a/tools/traffic_annotation/scripts/check_annotations.py b/tools/traffic_annotation/scripts/check_annotations.py
index f394a120..0089d07 100755
--- a/tools/traffic_annotation/scripts/check_annotations.py
+++ b/tools/traffic_annotation/scripts/check_annotations.py
@@ -17,7 +17,7 @@
 # If this test starts failing, please set TEST_IS_ENABLED to "False" and file a
 # bug to get this reenabled, and cc the people listed in
 # //tools/traffic_annotation/OWNERS.
-TEST_IS_ENABLED = sys.platform != 'win32'
+TEST_IS_ENABLED = False
 
 
 class NetworkTrafficAnnotationChecker():
@@ -121,14 +121,10 @@
                                stderr=subprocess.PIPE)
     stdout_text, stderr_text = command.communicate()
 
-    if stderr_text:
-      print("Could not run network traffic annotation presubmit check. "
-            "Returned error from traffic_annotation_auditor is: %s"
-            % stderr_text)
-      print("Exit code is: %i" % command.returncode)
-      return 1
     if stdout_text:
       print(stdout_text)
+    if stderr_text:
+      print("[Run Time Errors]:\n%s" % stderr_text)
     return command.returncode
 
 
diff --git a/tools/v8_context_snapshot/v8_context_snapshot_generator.cc b/tools/v8_context_snapshot/v8_context_snapshot_generator.cc
index 6a969a0d..3a549db7 100644
--- a/tools/v8_context_snapshot/v8_context_snapshot_generator.cc
+++ b/tools/v8_context_snapshot/v8_context_snapshot_generator.cc
@@ -22,7 +22,9 @@
  public:
   bool IsCurrentThread() const override { return true; }
   blink::WebScheduler* Scheduler() const override { return nullptr; }
-  blink::WebTaskRunner* GetWebTaskRunner() const override { return nullptr; }
+  base::SingleThreadTaskRunner* GetWebTaskRunner() const override {
+    return nullptr;
+  }
   scoped_refptr<base::SingleThreadTaskRunner> GetSingleThreadTaskRunner()
       const override {
     return base::ThreadTaskRunnerHandle::Get();
diff --git a/ui/android/delegated_frame_host_android.cc b/ui/android/delegated_frame_host_android.cc
index f021a01e..d82b2d3 100644
--- a/ui/android/delegated_frame_host_android.cc
+++ b/ui/android/delegated_frame_host_android.cc
@@ -30,7 +30,8 @@
     bool surface_opaque) {
   // manager must outlive compositors using it.
   auto layer = cc::SurfaceLayer::Create();
-  layer->SetPrimarySurfaceId(surface_info.id(), base::nullopt);
+  layer->SetPrimarySurfaceId(surface_info.id(),
+                             cc::DeadlinePolicy::UseDefaultDeadline());
   layer->SetFallbackSurfaceId(surface_info.id());
   layer->SetBounds(surface_info.size_in_pixels());
   layer->SetIsDrawable(true);
diff --git a/ui/aura/local/window_port_local.cc b/ui/aura/local/window_port_local.cc
index 4cdb51a..05ad9b8 100644
--- a/ui/aura/local/window_port_local.cc
+++ b/ui/aura/local/window_port_local.cc
@@ -172,7 +172,8 @@
   DCHECK_EQ(surface_info.id().frame_sink_id(), frame_sink_id_);
   DCHECK_EQ(surface_info.id().local_surface_id(), local_surface_id_);
   window_->layer()->SetShowPrimarySurface(
-      surface_info.id(), window_->bounds().size(), SK_ColorWHITE);
+      surface_info.id(), window_->bounds().size(), SK_ColorWHITE,
+      cc::DeadlinePolicy::UseDefaultDeadline());
   window_->layer()->SetFallbackSurfaceId(surface_info.id());
 }
 
diff --git a/ui/aura/mus/client_surface_embedder.cc b/ui/aura/mus/client_surface_embedder.cc
index b22c68d..87b2ff63 100644
--- a/ui/aura/mus/client_surface_embedder.cc
+++ b/ui/aura/mus/client_surface_embedder.cc
@@ -35,8 +35,9 @@
 
 void ClientSurfaceEmbedder::SetPrimarySurfaceId(
     const viz::SurfaceId& surface_id) {
-  surface_layer_->SetShowPrimarySurface(surface_id, window_->bounds().size(),
-                                        SK_ColorWHITE);
+  surface_layer_->SetShowPrimarySurface(
+      surface_id, window_->bounds().size(), SK_ColorWHITE,
+      cc::DeadlinePolicy::UseDefaultDeadline());
 }
 
 void ClientSurfaceEmbedder::SetFallbackSurfaceInfo(
diff --git a/ui/aura/mus/window_port_mus.cc b/ui/aura/mus/window_port_mus.cc
index 777f06e..f30d2aa 100644
--- a/ui/aura/mus/window_port_mus.cc
+++ b/ui/aura/mus/window_port_mus.cc
@@ -667,7 +667,8 @@
   DCHECK_EQ(surface_info.id().frame_sink_id(), GetFrameSinkId());
   DCHECK_EQ(surface_info.id().local_surface_id(), local_surface_id_);
   window_->layer()->SetShowPrimarySurface(
-      surface_info.id(), window_->bounds().size(), SK_ColorWHITE);
+      surface_info.id(), window_->bounds().size(), SK_ColorWHITE,
+      cc::DeadlinePolicy::UseDefaultDeadline());
   window_->layer()->SetFallbackSurfaceId(surface_info.id());
 }
 
diff --git a/ui/compositor/layer.cc b/ui/compositor/layer.cc
index 2a77c47..ffd6f93 100644
--- a/ui/compositor/layer.cc
+++ b/ui/compositor/layer.cc
@@ -187,9 +187,13 @@
   // cc::Layer state.
   if (surface_layer_) {
     if (surface_layer_->primary_surface_id().is_valid()) {
-      clone->SetShowPrimarySurface(surface_layer_->primary_surface_id(),
-                                   frame_size_in_dip_,
-                                   surface_layer_->background_color());
+      clone->SetShowPrimarySurface(
+          surface_layer_->primary_surface_id(), frame_size_in_dip_,
+          surface_layer_->background_color(),
+          surface_layer_->deadline_in_frames()
+              ? cc::DeadlinePolicy::UseSpecifiedDeadline(
+                    *surface_layer_->deadline_in_frames())
+              : cc::DeadlinePolicy::UseDefaultDeadline());
     }
     if (surface_layer_->fallback_surface_id().is_valid())
       clone->SetFallbackSurfaceId(surface_layer_->fallback_surface_id());
@@ -747,7 +751,8 @@
 
 void Layer::SetShowPrimarySurface(const viz::SurfaceId& surface_id,
                                   const gfx::Size& frame_size_in_dip,
-                                  SkColor default_background_color) {
+                                  SkColor default_background_color,
+                                  const cc::DeadlinePolicy& deadline_policy) {
   DCHECK(type_ == LAYER_TEXTURED || type_ == LAYER_SOLID_COLOR);
 
   if (!surface_layer_) {
@@ -756,7 +761,7 @@
     surface_layer_ = new_layer;
   }
 
-  surface_layer_->SetPrimarySurfaceId(surface_id, base::nullopt);
+  surface_layer_->SetPrimarySurfaceId(surface_id, deadline_policy);
   surface_layer_->SetBackgroundColor(default_background_color);
 
   frame_size_in_dip_ = frame_size_in_dip;
@@ -764,7 +769,8 @@
 
   for (const auto& mirror : mirrors_) {
     mirror->dest()->SetShowPrimarySurface(surface_id, frame_size_in_dip,
-                                          default_background_color);
+                                          default_background_color,
+                                          deadline_policy);
   }
 }
 
diff --git a/ui/compositor/layer.h b/ui/compositor/layer.h
index aa3712c..8200c6d 100644
--- a/ui/compositor/layer.h
+++ b/ui/compositor/layer.h
@@ -306,7 +306,8 @@
   // Begins showing content from a surface with a particular ID.
   void SetShowPrimarySurface(const viz::SurfaceId& surface_id,
                              const gfx::Size& frame_size_in_dip,
-                             SkColor default_background_color);
+                             SkColor default_background_color,
+                             const cc::DeadlinePolicy& deadline_policy);
 
   // In the event that the primary surface is not yet available in the
   // display compositor, the fallback surface will be used.
diff --git a/ui/compositor/layer_unittest.cc b/ui/compositor/layer_unittest.cc
index b75d19e9..fc5ac814 100644
--- a/ui/compositor/layer_unittest.cc
+++ b/ui/compositor/layer_unittest.cc
@@ -1842,6 +1842,7 @@
   // The layer is already showing solid color content, so the cc layer won't
   // change.
   scoped_refptr<cc::Layer> before = child->cc_layer_for_testing();
+
   child->SetShowSolidColorContent();
   EXPECT_TRUE(child->cc_layer_for_testing());
   EXPECT_EQ(before.get(), child->cc_layer_for_testing());
@@ -1849,9 +1850,18 @@
   // Showing surface content changes the underlying cc layer.
   before = child->cc_layer_for_testing();
   child->SetShowPrimarySurface(viz::SurfaceId(), gfx::Size(10, 10),
-                               SK_ColorWHITE);
-  EXPECT_TRUE(child->cc_layer_for_testing());
-  EXPECT_NE(before.get(), child->cc_layer_for_testing());
+                               SK_ColorWHITE,
+                               cc::DeadlinePolicy::UseDefaultDeadline());
+  scoped_refptr<cc::Layer> after = child->cc_layer_for_testing();
+  const auto* surface = static_cast<cc::SurfaceLayer*>(after.get());
+  EXPECT_TRUE(after.get());
+  EXPECT_NE(before.get(), after.get());
+  EXPECT_EQ(base::nullopt, surface->deadline_in_frames());
+
+  child->SetShowPrimarySurface(viz::SurfaceId(), gfx::Size(10, 10),
+                               SK_ColorWHITE,
+                               cc::DeadlinePolicy::UseSpecifiedDeadline(4u));
+  EXPECT_EQ(4u, surface->deadline_in_frames());
 
   // Changing to painted content should change the underlying cc layer.
   before = child->cc_layer_for_testing();
@@ -1866,7 +1876,8 @@
   viz::SurfaceId surface_id(
       viz::FrameSinkId(0, 1),
       viz::LocalSurfaceId(2, base::UnguessableToken::Create()));
-  layer->SetShowPrimarySurface(surface_id, gfx::Size(10, 10), SK_ColorWHITE);
+  layer->SetShowPrimarySurface(surface_id, gfx::Size(10, 10), SK_ColorWHITE,
+                               cc::DeadlinePolicy::UseDefaultDeadline());
 
   const auto mirror = layer->Mirror();
   auto* const cc_layer = mirror->cc_layer_for_testing();
@@ -1878,11 +1889,13 @@
   surface_id =
       viz::SurfaceId(viz::FrameSinkId(1, 2),
                      viz::LocalSurfaceId(3, base::UnguessableToken::Create()));
-  layer->SetShowPrimarySurface(surface_id, gfx::Size(20, 20), SK_ColorWHITE);
+  layer->SetShowPrimarySurface(surface_id, gfx::Size(20, 20), SK_ColorWHITE,
+                               cc::DeadlinePolicy::UseDefaultDeadline());
 
   // The mirror should continue to use the same cc_layer.
   EXPECT_EQ(cc_layer, mirror->cc_layer_for_testing());
-  layer->SetShowPrimarySurface(surface_id, gfx::Size(20, 20), SK_ColorWHITE);
+  layer->SetShowPrimarySurface(surface_id, gfx::Size(20, 20), SK_ColorWHITE,
+                               cc::DeadlinePolicy::UseDefaultDeadline());
 
   // Surface updates propagate to the mirror.
   EXPECT_EQ(surface_id, surface->primary_surface_id());
@@ -1903,7 +1916,8 @@
   // Showing surface content changes the underlying cc layer.
   scoped_refptr<cc::Layer> before = layer->cc_layer_for_testing();
   layer->SetShowPrimarySurface(viz::SurfaceId(), gfx::Size(10, 10),
-                               SK_ColorWHITE);
+                               SK_ColorWHITE,
+                               cc::DeadlinePolicy::UseDefaultDeadline());
   EXPECT_EQ(layer->layer_grayscale(), 0.5f);
   EXPECT_TRUE(layer->cc_layer_for_testing());
   EXPECT_NE(before.get(), layer->cc_layer_for_testing());
diff --git a/ui/file_manager/file_manager/background/js/device_handler.js b/ui/file_manager/file_manager/background/js/device_handler.js
index 9576e46..f9538ea95 100644
--- a/ui/file_manager/file_manager/background/js/device_handler.js
+++ b/ui/file_manager/file_manager/background/js/device_handler.js
@@ -289,6 +289,16 @@
  * @private
  */
 DeviceHandler.prototype.onDeviceChanged_ = function(event) {
+  util.doIfPrimaryContext(() => {
+    this.onDeviceChangedInternal_(event);
+  });
+};
+
+/**
+ * @param {DeviceEvent} event Device event.
+ * @private
+ */
+DeviceHandler.prototype.onDeviceChangedInternal_ = function(event) {
   switch (event.type) {
     case 'disabled':
       DeviceHandler.Notification.DEVICE_EXTERNAL_STORAGE_DISABLED.show(
@@ -351,6 +361,12 @@
  * @private
  */
 DeviceHandler.prototype.onMountCompleted_ = function(event) {
+  util.doIfPrimaryContext(() => {
+    this.onMountCompletedInternal_(event);
+  });
+};
+
+DeviceHandler.prototype.onMountCompletedInternal_ = function(event) {
   var volume = event.volumeMetadata;
 
   if (event.status === 'success' && event.shouldNotify) {
@@ -545,6 +561,16 @@
  * @private
  */
 DeviceHandler.prototype.onNotificationClicked_ = function(id) {
+  util.doIfPrimaryContext(() => {
+    this.onNotificationClickedInternal_(id);
+  });
+};
+
+/**
+ * @param {string} id ID of the notification.
+ * @private
+ */
+DeviceHandler.prototype.onNotificationClickedInternal_ = function(id) {
   var pos = id.indexOf(':');
   var type = id.substr(0, pos);
   var devicePath = id.substr(pos + 1);
diff --git a/ui/file_manager/file_manager/background/js/device_handler_unittest.js b/ui/file_manager/file_manager/background/js/device_handler_unittest.js
index 22ced4bd..8f488d4 100644
--- a/ui/file_manager/file_manager/background/js/device_handler_unittest.js
+++ b/ui/file_manager/file_manager/background/js/device_handler_unittest.js
@@ -59,6 +59,10 @@
   handler = new DeviceHandler();
 }
 
+function setUpInIncognitoContext() {
+  chrome.extension.inIncognitoContext = true;
+}
+
 function testGoodDevice(callback) {
   chrome.fileManagerPrivate.onMountCompleted.dispatch({
     eventType: 'mount',
@@ -653,6 +657,36 @@
       callback);
 }
 
+function testMiscMessagesInIncognito() {
+  setUpInIncognitoContext();
+  chrome.fileManagerPrivate.onDeviceChanged.dispatch(
+      {type: 'format_start', devicePath: '/device/path'});
+  // No notification sent by this instance in incognito context.
+  assertEquals(0, Object.keys(chrome.notifications.items).length);
+  assertFalse(chrome.notifications.resolver.settled);
+}
+
+function testMountCompleteInIncognito() {
+  setUpInIncognitoContext();
+  chrome.fileManagerPrivate.onMountCompleted.dispatch({
+    eventType: 'mount',
+    status: 'success',
+    volumeMetadata: {
+      isParentDevice: false,
+      deviceType: 'usb',
+      devicePath: '/device/path',
+      deviceLabel: 'label'
+    },
+    shouldNotify: true
+  });
+
+  assertEquals(0, Object.keys(chrome.notifications.items).length);
+  // TODO(yamaguchi): I think this test is incomplete.
+  // This looks as if notification is not generated yet because the promise
+  // is not settled yet. Same for testGoodDeviceNotNavigated.
+  assertFalse(chrome.notifications.resolver.settled);
+}
+
 /**
  * @param {!VolumeManagerCommon.VolumeType} volumeType
  * @param {string} volumeId
@@ -678,6 +712,7 @@
       },
       cloudImportDisabled: false
     },
+    extension: {inIncognitoContext: false},
     fileManagerPrivate: {
       onDeviceChanged: {
         addListener: function(listener) {
@@ -688,6 +723,9 @@
         addListener: function(listener) {
           this.dispatch = listener;
         }
+      },
+      getProfiles: function(callback) {
+        callback([{profileId: 'userid@xyz.domain.org'}]);
       }
     },
     i18n: {
diff --git a/ui/file_manager/file_manager/common/js/util.js b/ui/file_manager/file_manager/common/js/util.js
index fe66400..16375f7 100644
--- a/ui/file_manager/file_manager/common/js/util.js
+++ b/ui/file_manager/file_manager/common/js/util.js
@@ -1366,3 +1366,17 @@
 
   processEntry(rootEntry);
 };
+
+/**
+ * Executes a functions only when the context is not the incognito one in a
+ * regular session.
+ * @param {function()} callback
+ */
+util.doIfPrimaryContext = function(callback) {
+  chrome.fileManagerPrivate.getProfiles((profiles) => {
+    if ((profiles[0] && profiles[0].profileId == '$guest') ||
+        !chrome.extension.inIncognitoContext) {
+      callback();
+    }
+  });
+};
diff --git a/ui/message_center/views/message_popup_collection.cc b/ui/message_center/views/message_popup_collection.cc
index ec98352..bfad9985 100644
--- a/ui/message_center/views/message_popup_collection.cc
+++ b/ui/message_center/views/message_popup_collection.cc
@@ -129,6 +129,31 @@
       alignment_delegate_->IsPrimaryDisplayForNotification();
 #endif
 
+  // Check if the popups contain a new notification.
+  bool has_new_toasts = false;
+  for (auto* popup : popups) {
+    if (!FindToast(popup->id())) {
+      has_new_toasts = true;
+      break;
+    }
+  }
+
+  // If a new notification is found, collapse all existing notifications
+  // beforehand.
+  if (has_new_toasts) {
+    for (Toasts::const_iterator iter = toasts_.begin();
+         iter != toasts_.end();) {
+      // SetExpanded() may fire PreferredSizeChanged(), which may end up
+      // removing the toast in OnNotificationUpdated(). So we have to increment
+      // the iterator in a way that is safe even if the current iterator is
+      // invalidated during the loop.
+      MessageView* view = (*iter++)->message_view();
+      if (view->IsMouseHovered() || view->manually_expanded_or_collapsed())
+        continue;
+      view->SetExpanded(false);
+    }
+  }
+
   // Iterate in the reverse order to keep the oldest toasts on screen. Newer
   // items may be ignored if there are no room to place them.
   for (NotificationList::PopupNotifications::const_reverse_iterator iter =
diff --git a/ui/message_center/views/message_popup_collection_unittest.cc b/ui/message_center/views/message_popup_collection_unittest.cc
index f1c48b1..dad8c8b 100644
--- a/ui/message_center/views/message_popup_collection_unittest.cc
+++ b/ui/message_center/views/message_popup_collection_unittest.cc
@@ -753,5 +753,34 @@
   WaitForTransitionsDone();
 }
 
+// Regression test for https://crbug.com/804389 where notifications are added
+// and removed at the same time when UpdateWidgets is called.
+#if defined(OS_CHROMEOS)
+TEST_F(MessagePopupCollectionTest, AddedAndRemovedAtSameTime) {
+  collection()->IncrementDeferCounter();
+  std::vector<std::string> notification_ids;
+  for (size_t i = 0; i < kMaxVisiblePopupNotifications; ++i)
+    notification_ids.push_back(AddNotification());
+  collection()->DecrementDeferCounter();
+  WaitForTransitionsDone();
+
+  // Depending on the timing of ScopedNotificationsIterationLock, it is possible
+  // that a new notificaiton is added before the observer method of
+  // MarkSinglePopupAsShown are called.
+  // To reproduce the similar state in the unit test, it removes observer.
+  // TODO(tetsui): Remove this workaround with ScopedNotificationsIterationLock.
+  MessageCenter::Get()->RemoveObserver(collection());
+  for (auto& notification_id : notification_ids)
+    MessageCenter::Get()->MarkSinglePopupAsShown(notification_id, false);
+  MessageCenter::Get()->AddObserver(collection());
+
+  AddNotification();
+  WaitForTransitionsDone();
+
+  CloseAllToasts();
+  WaitForTransitionsDone();
+}
+#endif
+
 }  // namespace test
 }  // namespace message_center
diff --git a/ui/message_center/views/message_view.h b/ui/message_center/views/message_view.h
index f389d51..c2c2886 100644
--- a/ui/message_center/views/message_view.h
+++ b/ui/message_center/views/message_view.h
@@ -94,6 +94,10 @@
   void set_scroller(views::ScrollView* scroller) { scroller_ = scroller; }
   std::string notification_id() const { return notification_id_; }
 
+  bool manually_expanded_or_collapsed() const {
+    return manually_expanded_or_collapsed_;
+  }
+
  protected:
   // Creates and add close button to view hierarchy when necessary. Derived
   // classes should call this after its view hierarchy is populated to ensure
@@ -107,6 +111,10 @@
   views::View* background_view() { return background_view_; }
   views::ScrollView* scroller() { return scroller_; }
 
+  void set_manually_expanded_or_collapsed() {
+    manually_expanded_or_collapsed_ = true;
+  }
+
  private:
   std::string notification_id_;
   views::View* background_view_ = nullptr;  // Owned by views hierarchy.
@@ -117,6 +125,10 @@
   // Flag if the notification is set to pinned or not.
   bool pinned_ = false;
 
+  // True if the notification is expanded/collapsed by user interaction.
+  // If true, MessagePopupCollection will not auto-collapse the notification.
+  bool manually_expanded_or_collapsed_ = false;
+
   std::unique_ptr<views::Painter> focus_painter_;
 
   views::SlideOutController slide_out_controller_;
diff --git a/ui/message_center/views/notification_view_md.cc b/ui/message_center/views/notification_view_md.cc
index 277e85f6..dda12341 100644
--- a/ui/message_center/views/notification_view_md.cc
+++ b/ui/message_center/views/notification_view_md.cc
@@ -30,6 +30,7 @@
 #include "ui/message_center/views/padded_button.h"
 #include "ui/message_center/views/proportional_image_view.h"
 #include "ui/strings/grit/ui_strings.h"
+#include "ui/views/animation/flood_fill_ink_drop_ripple.h"
 #include "ui/views/animation/ink_drop_highlight.h"
 #include "ui/views/background.h"
 #include "ui/views/border.h"
@@ -456,11 +457,19 @@
 NotificationInputContainerMD::NotificationInputContainerMD(
     NotificationInputDelegate* delegate)
     : delegate_(delegate),
+      ink_drop_container_(new views::InkDropContainerView()),
       textfield_(new NotificationInputTextfieldMD(delegate)),
       button_(new NotificationInputReplyButtonMD(this)) {
   auto* layout = SetLayoutManager(std::make_unique<views::BoxLayout>(
       views::BoxLayout::kHorizontal, gfx::Insets(), 0));
-  SetBackground(views::CreateSolidBackground(kInputContainerBackgroundColor));
+  SetBackground(views::CreateSolidBackground(kActionsRowBackgroundColor));
+
+  SetInkDropMode(InkDropMode::ON);
+  set_ink_drop_visible_opacity(1);
+
+  ink_drop_container_->SetPaintToLayer();
+  ink_drop_container_->layer()->SetFillsBoundsOpaquely(false);
+  AddChildView(ink_drop_container_);
 
   AddChildView(textfield_);
   layout->SetFlexForView(textfield_, 1);
@@ -468,6 +477,43 @@
   AddChildView(button_);
 }
 
+NotificationInputContainerMD::~NotificationInputContainerMD() = default;
+
+void NotificationInputContainerMD::AnimateBackground(
+    const ui::LocatedEvent& event) {
+  if (View::HitTestPoint(event.location()))
+    AnimateInkDrop(views::InkDropState::ACTION_PENDING,
+                   ui::LocatedEvent::FromIfValid(&event));
+}
+
+void NotificationInputContainerMD::AddInkDropLayer(ui::Layer* ink_drop_layer) {
+  textfield_->SetPaintToLayer();
+  textfield_->layer()->SetFillsBoundsOpaquely(false);
+  button_->SetPaintToLayer();
+  button_->layer()->SetFillsBoundsOpaquely(false);
+  ink_drop_container_->AddInkDropLayer(ink_drop_layer);
+  InstallInkDropMask(ink_drop_layer);
+}
+
+void NotificationInputContainerMD::RemoveInkDropLayer(
+    ui::Layer* ink_drop_layer) {
+  textfield_->DestroyLayer();
+  button_->DestroyLayer();
+  ResetInkDropMask();
+  ink_drop_container_->RemoveInkDropLayer(ink_drop_layer);
+}
+
+std::unique_ptr<views::InkDropRipple>
+NotificationInputContainerMD::CreateInkDropRipple() const {
+  return std::make_unique<views::FloodFillInkDropRipple>(
+      size(), GetInkDropCenterBasedOnLastEvent(), GetInkDropBaseColor(),
+      ink_drop_visible_opacity());
+}
+
+SkColor NotificationInputContainerMD::GetInkDropBaseColor() const {
+  return kInputContainerBackgroundColor;
+}
+
 void NotificationInputContainerMD::ButtonPressed(views::Button* sender,
                                                  const ui::Event& event) {
   if (sender == button_) {
@@ -476,8 +522,6 @@
   }
 }
 
-NotificationInputContainerMD::~NotificationInputContainerMD() = default;
-
 // InlineSettingsRadioButton ///////////////////////////////////////////////////
 
 class InlineSettingsRadioButton : public views::RadioButton {
@@ -744,6 +788,7 @@
   // |expand_button| can be focused by TAB.
   if (sender == header_row_) {
     if (IsExpandable()) {
+      set_manually_expanded_or_collapsed();
       ToggleExpanded();
       Layout();
       SchedulePaint();
@@ -760,6 +805,7 @@
       inline_reply_->textfield()->set_placeholder(
           action_buttons_[i]->placeholder());
       inline_reply_->textfield()->RequestFocus();
+      inline_reply_->AnimateBackground(*event.AsLocatedEvent());
       inline_reply_->SetVisible(true);
       action_buttons_row_->SetVisible(false);
       Layout();
diff --git a/ui/message_center/views/notification_view_md.h b/ui/message_center/views/notification_view_md.h
index f380f862..6a89940 100644
--- a/ui/message_center/views/notification_view_md.h
+++ b/ui/message_center/views/notification_view_md.h
@@ -189,12 +189,21 @@
   DISALLOW_COPY_AND_ASSIGN(NotificationInputReplyButtonMD);
 };
 
-class NotificationInputContainerMD : public views::View,
+class NotificationInputContainerMD : public views::InkDropHostView,
                                      public views::ButtonListener {
  public:
   NotificationInputContainerMD(NotificationInputDelegate* delegate);
   ~NotificationInputContainerMD() override;
 
+  void AnimateBackground(const ui::LocatedEvent& event);
+
+  // Overridden from views::InkDropHostView:
+  void AddInkDropLayer(ui::Layer* ink_drop_layer) override;
+  void RemoveInkDropLayer(ui::Layer* ink_drop_layer) override;
+  std::unique_ptr<views::InkDropRipple> CreateInkDropRipple() const override;
+  SkColor GetInkDropBaseColor() const override;
+
+  // Overridden from views::ButtonListener:
   void ButtonPressed(views::Button* sender, const ui::Event& event) override;
 
   NotificationInputTextfieldMD* textfield() const { return textfield_; };
@@ -203,6 +212,8 @@
  private:
   NotificationInputDelegate* const delegate_;
 
+  views::InkDropContainerView* const ink_drop_container_;
+
   NotificationInputTextfieldMD* const textfield_;
   NotificationInputReplyButtonMD* const button_;
 
diff --git a/ui/message_center/views/notification_view_md_unittest.cc b/ui/message_center/views/notification_view_md_unittest.cc
index b29a920..6c69cd16 100644
--- a/ui/message_center/views/notification_view_md_unittest.cc
+++ b/ui/message_center/views/notification_view_md_unittest.cc
@@ -678,6 +678,20 @@
   EXPECT_EQ(collapsed_height, notification_view()->message_view_->height());
   EXPECT_EQ(collapsed_preferred_height,
             notification_view()->GetPreferredSize().height());
+
+  // Test |manually_expanded_or_collapsed| being set when the toggle is done by
+  // user interaction.
+  EXPECT_FALSE(notification_view()->manually_expanded_or_collapsed());
+
+  // Construct a mouse click event 1 pixel inside the header.
+  gfx::Point done_cursor_location(1, 1);
+  views::View::ConvertPointToScreen(notification_view()->header_row_,
+                                    &done_cursor_location);
+  ui::test::EventGenerator generator(widget()->GetNativeWindow());
+  generator.MoveMouseTo(done_cursor_location);
+  generator.ClickLeftButton();
+
+  EXPECT_TRUE(notification_view()->manually_expanded_or_collapsed());
 }
 
 TEST_F(NotificationViewMDTest, TestAccentColor) {
diff --git a/ui/message_center/views/toast_contents_view.cc b/ui/message_center/views/toast_contents_view.cc
index 17e9a19b..310def6 100644
--- a/ui/message_center/views/toast_contents_view.cc
+++ b/ui/message_center/views/toast_contents_view.cc
@@ -83,6 +83,7 @@
 
 void ToastContentsView::SetContents(MessageView* view,
                                     bool a11y_feedback_for_updates) {
+  message_view_ = view;
   bool already_has_contents = child_count() > 0;
   RemoveAllChildViews(true);
   AddChildView(view);
diff --git a/ui/message_center/views/toast_contents_view.h b/ui/message_center/views/toast_contents_view.h
index 8322754..87c0aa9b 100644
--- a/ui/message_center/views/toast_contents_view.h
+++ b/ui/message_center/views/toast_contents_view.h
@@ -80,6 +80,8 @@
 
   const std::string& id() const { return id_; }
 
+  MessageView* message_view() { return message_view_; }
+
   // Overridden from views::View:
   void OnMouseEntered(const ui::MouseEvent& event) override;
   void OnMouseExited(const ui::MouseEvent& event) override;
@@ -141,6 +143,9 @@
   gfx::Point origin_;
   gfx::Size preferred_size_;
 
+  // Weak reference to the MessageView.
+  MessageView* message_view_ = nullptr;
+
   DISALLOW_COPY_AND_ASSIGN(ToastContentsView);
 };
 
diff --git a/ui/ozone/platform/drm/gpu/gbm_buffer.cc b/ui/ozone/platform/drm/gpu/gbm_buffer.cc
index e535bfb..78091de 100644
--- a/ui/ozone/platform/drm/gpu/gbm_buffer.cc
+++ b/ui/ozone/platform/drm/gpu/gbm_buffer.cc
@@ -311,8 +311,9 @@
     }
   }
 
-  scoped_refptr<GbmBuffer> buffer(new GbmBuffer(
-      gbm, bo, format, gbm_flags, 0, std::move(fds), size, std::move(planes)));
+  scoped_refptr<GbmBuffer> buffer(
+      new GbmBuffer(gbm, bo, format, gbm_flags, planes[0].modifier,
+                    std::move(fds), size, std::move(planes)));
 
   return buffer;
 }