diff --git a/DEPS b/DEPS
index 1ce7aea..4b0380f 100644
--- a/DEPS
+++ b/DEPS
@@ -44,7 +44,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': '13d38e4a87153ab3b0a8d0612ea1c7ee3f664d77',
+  'v8_revision': 'dcf65ba2f663c9efb8e1ce25e2a28129c8508f1b',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
diff --git a/base/process/process_metrics.h b/base/process/process_metrics.h
index b1f52ca..717cb009 100644
--- a/base/process/process_metrics.h
+++ b/base/process/process_metrics.h
@@ -230,6 +230,9 @@
   uint64_t GetVmSwapBytes() const;
 #endif  // defined(OS_LINUX) || defined(OS_ANDROID)
 
+  // Returns total memory usage of malloc.
+  size_t GetMallocUsage();
+
  private:
 #if !defined(OS_MACOSX) || defined(OS_IOS)
   explicit ProcessMetrics(ProcessHandle process);
diff --git a/base/process/process_metrics_posix.cc b/base/process/process_metrics_posix.cc
index a4445e8b..677e26d1 100644
--- a/base/process/process_metrics_posix.cc
+++ b/base/process/process_metrics_posix.cc
@@ -14,6 +14,12 @@
 #include "base/logging.h"
 #include "build/build_config.h"
 
+#if defined(OS_MACOSX)
+#include <malloc/malloc.h>
+#else
+#include <malloc.h>
+#endif
+
 namespace base {
 
 int64_t TimeValToMicroseconds(const struct timeval& tv) {
@@ -83,4 +89,19 @@
   return getpagesize();
 }
 
+size_t ProcessMetrics::GetMallocUsage() {
+#if defined(OS_MACOSX) || defined(OS_IOS)
+  malloc_statistics_t stats = {0};
+  malloc_zone_statistics(nullptr, &stats);
+  return stats.size_in_use;
+#elif defined(OS_LINUX) || defined(OS_ANDROID)
+  struct mallinfo minfo = mallinfo();
+#if defined(USE_TCMALLOC)
+  return minfo.uordblks;
+#else
+  return minfo.hblkhd + minfo.arena;
+#endif
+#endif
+}
+
 }  // namespace base
diff --git a/base/process/process_metrics_win.cc b/base/process/process_metrics_win.cc
index f5b191d..8a278998 100644
--- a/base/process/process_metrics_win.cc
+++ b/base/process/process_metrics_win.cc
@@ -17,6 +17,10 @@
 #include "base/process/memory.h"
 #include "base/sys_info.h"
 
+#if defined(OS_WIN)
+#include <windows.h>
+#endif
+
 namespace base {
 namespace {
 
@@ -367,4 +371,22 @@
   return true;
 }
 
+size_t ProcessMetrics::GetMallocUsage() {
+  // Iterate through whichever heap the CRT is using.
+  HANDLE crt_heap = reinterpret_cast<HANDLE>(_get_heap_handle());
+  if (crt_heap == NULL)
+    return 0;
+  if (!::HeapLock(crt_heap))
+    return 0;
+  size_t malloc_usage = 0;
+  PROCESS_HEAP_ENTRY heap_entry;
+  heap_entry.lpData = NULL;
+  while (::HeapWalk(crt_heap, &heap_entry) != 0) {
+    if ((heap_entry.wFlags & PROCESS_HEAP_ENTRY_BUSY) != 0)
+      malloc_usage += heap_entry.cbData;
+  }
+  ::HeapUnlock(crt_heap);
+  return malloc_usage;
+}
+
 }  // namespace base
diff --git a/chrome/android/java/strings/android_chrome_strings.grd b/chrome/android/java/strings/android_chrome_strings.grd
index c97c38e0..f5cf3ac 100644
--- a/chrome/android/java/strings/android_chrome_strings.grd
+++ b/chrome/android/java/strings/android_chrome_strings.grd
@@ -872,9 +872,8 @@
       <message name="IDS_WEBSITE_SETTINGS_CATEGORY_ADS_BLOCKED_LIST" desc="Summary text explaining that the Ads permission is set to block ads on some sites. To be shown in the list of permission categories.">
         Blocked from some sites
       </message>
-      <!-- TODO(csharrison): Mark as translateable when we've confirmed a Site Details UI.-->
-      <message name="IDS_WEBSITE_SETTINGS_PERMISSIONS_ADS_BLOCK" desc="The Blocked string for the ads permission on Site Details" translateable="false">
-         Block if site tends to show intrusive ads (placeholder)
+      <message name="IDS_WEBSITE_SETTINGS_PERMISSIONS_ADS_BLOCK" desc="The Blocked string for the ads permission on Site Details">
+         Block if site tends to show intrusive ads
       </message>
       <message name="IDS_WEBSITE_SETTINGS_CATEGORY_LOCATION_ASK" desc="Summary text explaining that sites need to ask for permission before knowing location and that it is the recommended setting.">
         Ask before allowing sites to know your location (recommended)
diff --git a/chrome/browser/resources/local_ntp/local_ntp.html b/chrome/browser/resources/local_ntp/local_ntp.html
index 43cdc3e..8482ddd 100644
--- a/chrome/browser/resources/local_ntp/local_ntp.html
+++ b/chrome/browser/resources/local_ntp/local_ntp.html
@@ -9,7 +9,7 @@
   <script src="chrome-search://local-ntp/config.js"
       integrity="{{CONFIG_INTEGRITY}}"></script>
   <script src="chrome-search://local-ntp/local-ntp.js"
-      integrity="sha256-//Ntxa12Vzvs6oUFThZ7SAu9dDxHfqgUeSTOrQKqlgE="></script>
+      integrity="sha256-lulnU8hGXcddrvssXT2LbFuVh5e/8iE6ENokfXF7NRo="></script>
   <meta charset="utf-8">
   <meta name="google" value="notranslate">
 </head>
diff --git a/chrome/browser/resources/local_ntp/local_ntp.js b/chrome/browser/resources/local_ntp/local_ntp.js
index 171ba98..df0e765 100644
--- a/chrome/browser/resources/local_ntp/local_ntp.js
+++ b/chrome/browser/resources/local_ntp/local_ntp.js
@@ -28,6 +28,7 @@
  * @return {HTMLElement} The found element or null if not found.
  */
 function $(id) {
+  // eslint-disable-next-line no-restricted-properties
   return document.getElementById(id);
 }
 
@@ -232,37 +233,27 @@
 
 /**
  * Updates the NTP style according to theme.
- * @param {Object=} opt_themeInfo The information about the theme. If it is
- * omitted the style will be reverted to the default.
+ * @param {Object} themeInfo The information about the theme.
  * @private
  */
-// TODO(treib): We actually never call this without a themeInfo. Should we?
-function setCustomThemeStyle(opt_themeInfo) {
+function setCustomThemeStyle(themeInfo) {
   var customStyleElement = $(IDS.CUSTOM_THEME_STYLE);
   var head = document.head;
-  if (opt_themeInfo && !opt_themeInfo.usingDefaultTheme) {
+  if (!themeInfo.usingDefaultTheme) {
     $(IDS.NTP_CONTENTS).classList.remove(CLASSES.DEFAULT_THEME);
     var themeStyle =
       '#attribution {' +
-      '  color: ' + convertToRGBAColor(opt_themeInfo.textColorLightRgba) + ';' +
+      '  color: ' + convertToRGBAColor(themeInfo.textColorLightRgba) + ';' +
       '}' +
       '#mv-msg {' +
-      '  color: ' + convertToRGBAColor(opt_themeInfo.textColorRgba) + ';' +
+      '  color: ' + convertToRGBAColor(themeInfo.textColorRgba) + ';' +
       '}' +
       '#mv-notice-links span {' +
-      '  color: ' + convertToRGBAColor(opt_themeInfo.textColorLightRgba) + ';' +
+      '  color: ' + convertToRGBAColor(themeInfo.textColorLightRgba) + ';' +
       '}' +
       '#mv-notice-x {' +
       '  -webkit-filter: drop-shadow(0 0 0 ' +
-          convertToRGBAColor(opt_themeInfo.textColorRgba) + ');' +
-      '}' +
-      '.mv-page-ready .mv-mask {' +
-      '  border: 1px solid ' +
-          convertToRGBAColor(opt_themeInfo.sectionBorderColorRgba) + ';' +
-      '}' +
-      '.mv-page-ready:hover .mv-mask, .mv-page-ready .mv-focused ~ .mv-mask {' +
-      '  border-color: ' +
-          convertToRGBAColor(opt_themeInfo.headerColorRgba) + ';' +
+          convertToRGBAColor(themeInfo.textColorRgba) + ');' +
       '}';
 
     if (customStyleElement) {
diff --git a/chrome/browser/search/local_ntp_source.cc b/chrome/browser/search/local_ntp_source.cc
index 4565576..d4c6127 100644
--- a/chrome/browser/search/local_ntp_source.cc
+++ b/chrome/browser/search/local_ntp_source.cc
@@ -415,7 +415,7 @@
          GetIntegritySha256Value(
              GetConfigData(default_search_provider_is_google_io_thread_)) +
          "' "
-         "'sha256-//Ntxa12Vzvs6oUFThZ7SAu9dDxHfqgUeSTOrQKqlgE=';";
+         "'sha256-lulnU8hGXcddrvssXT2LbFuVh5e/8iE6ENokfXF7NRo=';";
 }
 
 std::string LocalNtpSource::GetContentSecurityPolicyChildSrc() const {
diff --git a/components/password_manager/core/browser/password_form_manager.cc b/components/password_manager/core/browser/password_form_manager.cc
index 78ff536..9d9613e 100644
--- a/components/password_manager/core/browser/password_form_manager.cc
+++ b/components/password_manager/core/browser/password_form_manager.cc
@@ -228,7 +228,6 @@
           observed_form.IsPossibleChangePasswordFormWithoutUsername()),
       client_(client),
       user_action_(UserAction::kNone),
-      form_type_(kFormTypeUnspecified),
       form_saver_(std::move(form_saver)),
       owned_form_fetcher_(
           form_fetcher ? nullptr
@@ -255,15 +254,6 @@
   metrics_recorder_.RecordHistogramsOnSuppressedAccounts(
       observed_form_.origin.SchemeIsCryptographic(), *form_fetcher_,
       pending_credentials_);
-
-  if (form_type_ != kFormTypeUnspecified) {
-    UMA_HISTOGRAM_ENUMERATION("PasswordManager.SubmittedFormType", form_type_,
-                              kFormTypeMax);
-    if (!is_main_frame_secure_) {
-      UMA_HISTOGRAM_ENUMERATION("PasswordManager.SubmittedNonSecureFormType",
-                                form_type_, kFormTypeMax);
-    }
-  }
 }
 
 // static
@@ -458,20 +448,23 @@
       !form.new_password_value.empty() && form.password_value.empty();
   bool no_username = form.username_element.empty();
 
+  PasswordFormMetricsRecorder::SubmittedFormType type =
+      PasswordFormMetricsRecorder::kSubmittedFormTypeUnspecified;
   if (form.layout == PasswordForm::Layout::LAYOUT_LOGIN_AND_SIGNUP) {
-    form_type_ = kFormTypeLoginAndSignup;
+    type = PasswordFormMetricsRecorder::kSubmittedFormTypeLoginAndSignup;
   } else if (is_change_password_form) {
-    form_type_ = kFormTypeChangePasswordEnabled;
+    type = PasswordFormMetricsRecorder::kSubmittedFormTypeChangePasswordEnabled;
   } else if (is_signup_form) {
     if (no_username)
-      form_type_ = kFormTypeSignupNoUsername;
+      type = PasswordFormMetricsRecorder::kSubmittedFormTypeSignupNoUsername;
     else
-      form_type_ = kFormTypeSignup;
+      type = PasswordFormMetricsRecorder::kSubmittedFormTypeSignup;
   } else if (no_username) {
-    form_type_ = kFormTypeLoginNoUsername;
+    type = PasswordFormMetricsRecorder::kSubmittedFormTypeLoginNoUsername;
   } else {
-    form_type_ = kFormTypeLogin;
+    type = PasswordFormMetricsRecorder::kSubmittedFormTypeLogin;
   }
+  metrics_recorder_.SetSubmittedFormType(type);
 }
 
 void PasswordFormManager::ScoreMatches(
diff --git a/components/password_manager/core/browser/password_form_manager.h b/components/password_manager/core/browser/password_form_manager.h
index e1e00b3..6bab1697 100644
--- a/components/password_manager/core/browser/password_form_manager.h
+++ b/components/password_manager/core/browser/password_form_manager.h
@@ -261,21 +261,6 @@
       size_t filtered_count) override;
 
  private:
-  // What the form is used for. kFormTypeUnspecified is only set before
-  // the SetSubmittedForm() is called, and should never be actually uploaded.
-  enum FormType {
-    kFormTypeLogin,
-    kFormTypeLoginNoUsername,
-    kFormTypeChangePasswordEnabled,
-    kFormTypeChangePasswordDisabled,
-    kFormTypeChangePasswordNoUsername,
-    kFormTypeSignup,
-    kFormTypeSignupNoUsername,
-    kFormTypeLoginAndSignup,
-    kFormTypeUnspecified,
-    kFormTypeMax
-  };
-
   // The outcome of the form classifier.
   enum FormClassifierOutcome {
     kNoOutcome,
@@ -536,11 +521,6 @@
   // form.
   UserAction user_action_;
 
-  // Form type of the form that |this| is managing. Set after SetSubmittedForm()
-  // as our classification of the form can change depending on what data the
-  // user has entered.
-  FormType form_type_;
-
   // FormSaver instance used by |this| to all tasks related to storing
   // credentials.
   std::unique_ptr<FormSaver> form_saver_;
diff --git a/components/password_manager/core/browser/password_form_metrics_recorder.cc b/components/password_manager/core/browser/password_form_metrics_recorder.cc
index 8097db0..1bd64fa 100644
--- a/components/password_manager/core/browser/password_form_metrics_recorder.cc
+++ b/components/password_manager/core/browser/password_form_metrics_recorder.cc
@@ -41,6 +41,15 @@
           metrics_util::PASSWORD_NOT_SUBMITTED);
     }
   }
+
+  if (submitted_form_type_ != kSubmittedFormTypeUnspecified) {
+    UMA_HISTOGRAM_ENUMERATION("PasswordManager.SubmittedFormType",
+                              submitted_form_type_, kSubmittedFormTypeMax);
+    if (!is_main_frame_secure_) {
+      UMA_HISTOGRAM_ENUMERATION("PasswordManager.SubmittedNonSecureFormType",
+                                submitted_form_type_, kSubmittedFormTypeMax);
+    }
+  }
 }
 
 void PasswordFormMetricsRecorder::MarkGenerationAvailable() {
@@ -102,6 +111,11 @@
   submit_result_ = kSubmitResultFailed;
 }
 
+void PasswordFormMetricsRecorder::SetSubmittedFormType(
+    SubmittedFormType form_type) {
+  submitted_form_type_ = form_type;
+}
+
 int PasswordFormMetricsRecorder::GetActionsTakenNew() const {
   // Merge kManagerActionNone and kManagerActionBlacklisted_Obsolete. This
   // lowers the number of histogram buckets used by 33%.
diff --git a/components/password_manager/core/browser/password_form_metrics_recorder.h b/components/password_manager/core/browser/password_form_metrics_recorder.h
index e17f679f..7dd9ac5 100644
--- a/components/password_manager/core/browser/password_form_metrics_recorder.h
+++ b/components/password_manager/core/browser/password_form_metrics_recorder.h
@@ -68,6 +68,22 @@
     kSuppressedAccountExistenceMax,
   };
 
+  // What the form is used for. kSubmittedFormTypeUnspecified is only set before
+  // the SetSubmittedFormType() is called, and should never be actually
+  // uploaded.
+  enum SubmittedFormType {
+    kSubmittedFormTypeLogin,
+    kSubmittedFormTypeLoginNoUsername,
+    kSubmittedFormTypeChangePasswordEnabled,
+    kSubmittedFormTypeChangePasswordDisabled,
+    kSubmittedFormTypeChangePasswordNoUsername,
+    kSubmittedFormTypeSignup,
+    kSubmittedFormTypeSignupNoUsername,
+    kSubmittedFormTypeLoginAndSignup,
+    kSubmittedFormTypeUnspecified,
+    kSubmittedFormTypeMax
+  };
+
   // The maximum number of combinations of the ManagerAction, UserAction and
   // SubmitResult enums.
   // This is used when recording the actions taken by the form in UMA.
@@ -102,6 +118,9 @@
   void LogSubmitPassed();
   void LogSubmitFailed();
 
+  // Call this once the submitted form type has been determined.
+  void SetSubmittedFormType(SubmittedFormType form_type);
+
   // Records all histograms in the PasswordManager.SuppressedAccount.* family.
   // Takes the FormFetcher intance which owns the login data from PasswordStore.
   // |pending_credentials| stores credentials when the form was submitted but
@@ -157,6 +176,11 @@
   UserAction user_action_ = UserAction::kNone;
   SubmitResult submit_result_ = kSubmitResultNotSubmitted;
 
+  // Form type of the form that the PasswordFormManager is managing. Set after
+  // submission as the classification of the form can change depending on what
+  // data the user has entered.
+  SubmittedFormType submitted_form_type_ = kSubmittedFormTypeUnspecified;
+
   DISALLOW_COPY_AND_ASSIGN(PasswordFormMetricsRecorder);
 };
 
diff --git a/components/password_manager/core/browser/password_form_metrics_recorder_unittest.cc b/components/password_manager/core/browser/password_form_metrics_recorder_unittest.cc
index d2724ca..089d00e 100644
--- a/components/password_manager/core/browser/password_form_metrics_recorder_unittest.cc
+++ b/components/password_manager/core/browser/password_form_metrics_recorder_unittest.cc
@@ -261,4 +261,53 @@
                    "PasswordManager_LoggedInWithNewUsername"));
 }
 
+TEST(PasswordFormMetricsRecorder, SubmittedFormType) {
+  static constexpr struct {
+    // Stimuli:
+    bool is_main_frame_secure;
+    PasswordFormMetricsRecorder::SubmittedFormType form_type;
+    // Expectations:
+    // Expectation for PasswordManager.SubmittedFormType:
+    int expected_submitted_form_type;
+    // Expectation for PasswordManager.SubmittedNonSecureFormType:
+    int expected_submitted_non_secure_form_type;
+  } kTests[] = {
+      {false, PasswordFormMetricsRecorder::kSubmittedFormTypeUnspecified, 0, 0},
+      {true, PasswordFormMetricsRecorder::kSubmittedFormTypeUnspecified, 0, 0},
+      {false, PasswordFormMetricsRecorder::kSubmittedFormTypeLogin, 1, 1},
+      {true, PasswordFormMetricsRecorder::kSubmittedFormTypeLogin, 1, 0},
+  };
+  for (const auto& test : kTests) {
+    SCOPED_TRACE(testing::Message()
+                 << "is_main_frame_secure=" << test.is_main_frame_secure
+                 << ", form_type=" << test.form_type);
+
+    base::HistogramTester histogram_tester;
+
+    // Use a scoped PasswordFromMetricsRecorder because some metrics are recored
+    // on destruction.
+    {
+      PasswordFormMetricsRecorder recorder(test.is_main_frame_secure);
+      recorder.SetSubmittedFormType(test.form_type);
+    }
+
+    if (test.expected_submitted_form_type) {
+      histogram_tester.ExpectBucketCount("PasswordManager.SubmittedFormType",
+                                         test.form_type,
+                                         test.expected_submitted_form_type);
+    } else {
+      histogram_tester.ExpectTotalCount("PasswordManager.SubmittedFormType", 0);
+    }
+
+    if (test.expected_submitted_non_secure_form_type) {
+      histogram_tester.ExpectBucketCount(
+          "PasswordManager.SubmittedNonSecureFormType", test.form_type,
+          test.expected_submitted_non_secure_form_type);
+    } else {
+      histogram_tester.ExpectTotalCount(
+          "PasswordManager.SubmittedNonSecureFormType", 0);
+    }
+  }
+}
+
 }  // namespace password_manager
diff --git a/content/renderer/render_thread_impl.cc b/content/renderer/render_thread_impl.cc
index 2e686b4..25bfb8b 100644
--- a/content/renderer/render_thread_impl.cc
+++ b/content/renderer/render_thread_impl.cc
@@ -1751,42 +1751,6 @@
       base::TimeDelta::FromMinutes(90));
 }
 
-// TODO(tasak): Replace the following GetMallocUsage() with memory-infra
-// when it is possible to run memory-infra without tracing.
-#if defined(OS_WIN)
-namespace {
-
-static size_t GetMallocUsage() {
-  // Iterate through whichever heap the CRT is using.
-  HANDLE crt_heap = reinterpret_cast<HANDLE>(_get_heap_handle());
-  if (crt_heap == NULL)
-    return 0;
-  if (!::HeapLock(crt_heap))
-    return 0 ;
-  size_t malloc_usage = 0;
-  PROCESS_HEAP_ENTRY heap_entry;
-  heap_entry.lpData = NULL;
-  while (::HeapWalk(crt_heap, &heap_entry) != 0) {
-    if ((heap_entry.wFlags & PROCESS_HEAP_ENTRY_BUSY) != 0)
-      malloc_usage += heap_entry.cbData;
-  }
-  ::HeapUnlock(crt_heap);
-  return malloc_usage;
-}
-
-}  // namespace
-#elif defined(OS_MACOSX) || defined(OS_IOS)
-namespace {
-
-static size_t GetMallocUsage() {
-  malloc_statistics_t stats = {0};
-  malloc_zone_statistics(nullptr, &stats);
-  return stats.size_in_use;
-}
-
-}  // namespace
-#endif
-
 bool RenderThreadImpl::GetRendererMemoryMetrics(
     RendererMemoryMetrics* memory_metrics) const {
   DCHECK(memory_metrics);
@@ -1805,16 +1769,9 @@
       blink_stats.partition_alloc_total_allocated_bytes / 1024;
   memory_metrics->blink_gc_kb =
       blink_stats.blink_gc_total_allocated_bytes / 1024;
-#if defined(OS_LINUX) || defined(OS_ANDROID)
-  struct mallinfo minfo = mallinfo();
-#if defined(USE_TCMALLOC)
-  size_t malloc_usage = minfo.uordblks;
-#else
-  size_t malloc_usage = minfo.hblkhd + minfo.arena;
-#endif
-#else
-  size_t malloc_usage = GetMallocUsage();
-#endif
+  std::unique_ptr<base::ProcessMetrics> metric(
+      base::ProcessMetrics::CreateCurrentProcessMetrics());
+  size_t malloc_usage = metric->GetMallocUsage();
   memory_metrics->malloc_mb = malloc_usage / 1024 / 1024;
 
   discardable_memory::ClientDiscardableSharedMemoryManager::Statistics
diff --git a/content/test/data/accessibility/event/menulist-collapse-expected-win.txt b/content/test/data/accessibility/event/menulist-collapse-expected-win.txt
index 6dd490fc..5ed2eb42 100644
--- a/content/test/data/accessibility/event/menulist-collapse-expected-win.txt
+++ b/content/test/data/accessibility/event/menulist-collapse-expected-win.txt
@@ -1 +1,2 @@
+EVENT_OBJECT_STATECHANGE on role=ROLE_SYSTEM_LISTITEM name="Apple" FOCUSED,INVISIBLE,FOCUSABLE,SELECTABLE
 EVENT_OBJECT_VALUECHANGE on role=ROLE_SYSTEM_COMBOBOX COLLAPSED,FOCUSABLE,HASPOPUP
diff --git a/infra/config/cq.cfg b/infra/config/cq.cfg
index 4f47719d..c37b3fba 100644
--- a/infra/config/cq.cfg
+++ b/infra/config/cq.cfg
@@ -59,8 +59,18 @@
       #builders { name: "linux_chromium_clobber_rel_ng" }
       builders { name: "linux_chromium_compile_dbg_ng" }
       builders { name: "linux_chromium_headless_rel" }
-      builders { name: "linux_chromium_rel_ng" }
       builders { name: "linux_chromium_tsan_rel_ng" }
+      builders {
+        name: "linux_chromium_rel_ng"
+        equivalent_to {
+          # Builders in this bucket are defined in
+          # https://chromium.googlesource.com/chromium/src/+/infra/config/cr-buildbucket.cfg
+          bucket: "luci.chromium.try"
+          builder: "LUCI linux_chromium_rel_ng"
+          owner_whitelist_group: "luci-chromium-cq-dogfood"
+          percentage: 100
+        }
+      }
     }
     buckets {
       name: "master.tryserver.chromium.mac"
diff --git a/net/websockets/websocket_channel_test.cc b/net/websockets/websocket_channel_test.cc
index d5ceae8..47e73dd 100644
--- a/net/websockets/websocket_channel_test.cc
+++ b/net/websockets/websocket_channel_test.cc
@@ -8,6 +8,7 @@
 #include <stddef.h>
 #include <string.h>
 
+#include <algorithm>
 #include <iostream>
 #include <iterator>
 #include <memory>
@@ -379,7 +380,7 @@
 class EqualsFramesMatcher : public ::testing::MatcherInterface<
                                 std::vector<std::unique_ptr<WebSocketFrame>>*> {
  public:
-  EqualsFramesMatcher(const InitFrame (*expect_frames)[N])
+  explicit EqualsFramesMatcher(const InitFrame (*expect_frames)[N])
       : expect_frames_(expect_frames) {}
 
   virtual bool MatchAndExplain(
diff --git a/net/websockets/websocket_deflate_stream_fuzzer.cc b/net/websockets/websocket_deflate_stream_fuzzer.cc
index 4f9bed3..605b434 100644
--- a/net/websockets/websocket_deflate_stream_fuzzer.cc
+++ b/net/websockets/websocket_deflate_stream_fuzzer.cc
@@ -45,7 +45,7 @@
 
 class WebSocketFuzzedStream final : public WebSocketStream {
  public:
-  WebSocketFuzzedStream(base::FuzzedDataProvider* fuzzed_data_provider)
+  explicit WebSocketFuzzedStream(base::FuzzedDataProvider* fuzzed_data_provider)
       : fuzzed_data_provider_(fuzzed_data_provider) {}
 
   int ReadFrames(std::vector<std::unique_ptr<WebSocketFrame>>* frames,
diff --git a/net/websockets/websocket_extension.cc b/net/websockets/websocket_extension.cc
index a0d55607..cb6b72bd 100644
--- a/net/websockets/websocket_extension.cc
+++ b/net/websockets/websocket_extension.cc
@@ -6,6 +6,7 @@
 
 #include <map>
 #include <string>
+#include <utility>
 
 #include "base/logging.h"
 #include "net/http/http_util.h"
diff --git a/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG b/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG
index 47df20a4..8445a132 100644
--- a/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG
+++ b/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG
@@ -12755,8 +12755,8 @@
 crbug.com/591099 fast/lists/ol-reversed-dynamic.html [ Crash Failure ]
 crbug.com/591099 fast/lists/ol-reversed-nested-items.html [ Crash Failure ]
 crbug.com/591099 fast/lists/ol-reversed-nested-list.html [ Crash Failure ]
+crbug.com/591099 fast/lists/ol-reversed-simple-xhtml.xhtml [ Crash Failure ]
 crbug.com/591099 fast/lists/ol-reversed-simple.html [ Crash Failure ]
-crbug.com/591099 fast/lists/ol-reversed-simple.xhtml [ Crash Failure ]
 crbug.com/591099 fast/lists/ol-start-dynamic.html [ Crash Failure ]
 crbug.com/591099 fast/lists/ordered-list-with-no-ol-tag.html [ Crash Failure ]
 crbug.com/591099 fast/lists/remove-listmarker-and-make-anonblock-empty-2.html [ Crash ]
diff --git a/third_party/WebKit/LayoutTests/accessibility/contenteditable-notifications.html b/third_party/WebKit/LayoutTests/accessibility/contenteditable-notifications.html
index dda6c19..487f396 100644
--- a/third_party/WebKit/LayoutTests/accessibility/contenteditable-notifications.html
+++ b/third_party/WebKit/LayoutTests/accessibility/contenteditable-notifications.html
@@ -2,6 +2,7 @@
 <html>
 <head>
 <script src="../resources/js-test.js"></script>
+<script src="../resources/accessibility-helper.js"></script>
 </head>
 <body>
 
@@ -15,6 +16,9 @@
 if (window.testRunner && window.accessibilityController) {
     testRunner.dumpAsText();
 
+    // Ensure entire a11y tree has already been seen.
+    traverseAccessibilityTree(accessibilityController.rootElement);
+
     // Focus the contenteditable text box and move the cursor to the end.
     var textbox = document.getElementById("textbox");
     textbox.focus();
@@ -38,7 +42,7 @@
             else if (notification == "SelectedTextChanged")
                 selectedTextChangedCount++;
 
-            if (valueChangedCount == 8 && selectedTextChangedCount == 6) {
+            if (valueChangedCount >= 8 && selectedTextChangedCount >= 4) {
                 textbox.style.display = "none";
                 finishJSTest();
             }
diff --git a/third_party/WebKit/LayoutTests/accessibility/presentation-owned-elements.html b/third_party/WebKit/LayoutTests/accessibility/presentation-owned-elements.html
index 991011e..95c32f7 100644
--- a/third_party/WebKit/LayoutTests/accessibility/presentation-owned-elements.html
+++ b/third_party/WebKit/LayoutTests/accessibility/presentation-owned-elements.html
@@ -78,7 +78,10 @@
 
 if (window.testRunner)
     testRunner.dumpAsText();
+
 if (window.accessibilityController) {
+    // Ensure we've seen all nodes in accessibility tree.
+    traverseAccessibilityTree(accessibilityController.rootElement);
     buildAccessibilityTree(accessibilityController.focusedElement, 0, 1);
 }
 </script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/domparsing/XMLSerializer-serializeToString.html b/third_party/WebKit/LayoutTests/external/wpt/domparsing/XMLSerializer-serializeToString.html
index 60932ee..2106b43 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/domparsing/XMLSerializer-serializeToString.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/domparsing/XMLSerializer-serializeToString.html
@@ -9,18 +9,29 @@
  <body>
     <h1>domparsing_XMLSerializer_serializeToString</h1>
   <script>
-        function createXmlDoc(){
-            var input = '<?xml version="1.0" encoding="UTF-8"?><root><child1>value1</child1></root>';
-            var parser = new DOMParser();
-            var doc = parser.parseFromString(input, 'text/xml');
-            return doc;
-        }
-        test(function() {
-            var serializer = new XMLSerializer ();
-            var root = createXmlDoc().documentElement;
-            var xmlString=serializer.serializeToString(root);
-            assert_equals(xmlString, "<root><child1>value1</child1></root>");
-        }, 'check  XMLSerializer.serializeToString method could parsing xmldoc to string');
+function createXmlDoc(){
+  var input = '<?xml version="1.0" encoding="UTF-8"?><root><child1>value1</child1></root>';
+  var parser = new DOMParser();
+  return parser.parseFromString(input, 'text/xml');
+}
+
+test(function() {
+  var serializer = new XMLSerializer();
+  var root = createXmlDoc().documentElement;
+  var xmlString = serializer.serializeToString(root);
+  assert_equals(xmlString, '<root><child1>value1</child1></root>');
+}, 'check XMLSerializer.serializeToString method could parsing xmldoc to string');
+
+test(function() {
+  var serializer = new XMLSerializer();
+  var root = createXmlDoc().documentElement;
+  var element = root.ownerDocument.createElementNS('urn:foo', 'another');
+  var child1 = root.firstChild;
+  root.replaceChild(element, child1);
+  element.appendChild(child1);
+  var xmlString = serializer.serializeToString(root);
+  assert_equals(xmlString, '<root><another xmlns="urn:foo"><child1 xmlns="">value1</child1></another></root>');
+}, 'Check if the default namespace is correctly reset.');
   </script>
  </body>
 </html>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/html/rendering/non-replaced-elements/the-fieldset-element-0/legend-block-formatting-context-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/html/rendering/non-replaced-elements/the-fieldset-element-0/legend-block-formatting-context-expected.txt
deleted file mode 100644
index 9d9de2c..0000000
--- a/third_party/WebKit/LayoutTests/external/wpt/html/rendering/non-replaced-elements/the-fieldset-element-0/legend-block-formatting-context-expected.txt
+++ /dev/null
@@ -1,7 +0,0 @@
-This is a testharness.js-based test.
-FAIL in-body assert_equals: legend.offsetLeft expected 0 but got 50
-PASS rendered-legend 
-FAIL in-fieldset-second-child assert_equals: legend.offsetLeft expected 2 but got 52
-FAIL in-fieldset-descendant assert_equals: legend.offsetTop expected 50 but got 100
-Harness: the test ran to completion.
-
diff --git a/third_party/WebKit/LayoutTests/external/wpt/html/rendering/non-replaced-elements/the-fieldset-element-0/legend-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/html/rendering/non-replaced-elements/the-fieldset-element-0/legend-expected.txt
index 6d4b5f9..d2772ae 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/html/rendering/non-replaced-elements/the-fieldset-element-0/legend-expected.txt
+++ b/third_party/WebKit/LayoutTests/external/wpt/html/rendering/non-replaced-elements/the-fieldset-element-0/legend-expected.txt
@@ -1,5 +1,5 @@
 This is a testharness.js-based test.
-Found 56 tests; 49 PASS, 7 FAIL, 0 TIMEOUT, 0 NOTRUN.
+Found 56 tests; 52 PASS, 4 FAIL, 0 TIMEOUT, 0 NOTRUN.
 PASS in-body: display 
 FAIL in-body: unicodeBidi assert_equals: expected "isolate" but got "normal"
 PASS in-body: marginTop 
@@ -13,7 +13,7 @@
 PASS in-body: overflow 
 PASS in-body: height 
 PASS in-body: box-sizing 
-FAIL in-body: width assert_not_equals: got disallowed value "0px"
+PASS in-body: width 
 PASS rendered-legend: display 
 FAIL rendered-legend: unicodeBidi assert_equals: expected "isolate" but got "normal"
 PASS rendered-legend: marginTop 
@@ -41,7 +41,7 @@
 PASS in-fieldset-second-child: overflow 
 PASS in-fieldset-second-child: height 
 PASS in-fieldset-second-child: box-sizing 
-FAIL in-fieldset-second-child: width assert_not_equals: got disallowed value "0px"
+PASS in-fieldset-second-child: width 
 PASS in-fieldset-descendant: display 
 FAIL in-fieldset-descendant: unicodeBidi assert_equals: expected "isolate" but got "normal"
 PASS in-fieldset-descendant: marginTop 
@@ -55,6 +55,6 @@
 PASS in-fieldset-descendant: overflow 
 PASS in-fieldset-descendant: height 
 PASS in-fieldset-descendant: box-sizing 
-FAIL in-fieldset-descendant: width assert_not_equals: got disallowed value "0px"
+PASS in-fieldset-descendant: width 
 Harness: the test ran to completion.
 
diff --git a/third_party/WebKit/LayoutTests/fast/lists/ol-reversed-simple-xhtml-expected.txt b/third_party/WebKit/LayoutTests/fast/lists/ol-reversed-simple-xhtml-expected.txt
new file mode 100644
index 0000000..b7f9e6e
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/lists/ol-reversed-simple-xhtml-expected.txt
@@ -0,0 +1,46 @@
+This tests that reversed lists render properly.
+
+5 Five
+4 Four
+3 Three
+2 Two
+1 One
+
+This tests that reversed lists with a custom start value render properly.
+
+10 Ten
+9 Nine
+8 Eight
+7 Seven
+6 Six
+
+This tests that reversed lists with explicit item values render properly.
+
+5 Five
+4 Four
+2 Two
+1 One
+0 Zero
+
+This tests that reversed lists with a custom start value and explicit item values render properly.
+
+10 Ten
+9 Nine
+3 Three
+2 Two
+1 One
+3 Three
+2 Two
+1 One
+
+This tests that reversed lists with a negative start value render properly.
+
+-5 Minus Five
+-6 Minus Six
+-7 Minus Seven
+-8 Minus Eight
+-9 Minus Nine
+
+This tests that reversed lists have the start attribute equals the number of list items when no start value is specified.
+
+Value of start attribute of the list is : 5
diff --git a/third_party/WebKit/LayoutTests/fast/lists/ol-reversed-simple.xhtml b/third_party/WebKit/LayoutTests/fast/lists/ol-reversed-simple-xhtml.xhtml
similarity index 100%
rename from third_party/WebKit/LayoutTests/fast/lists/ol-reversed-simple.xhtml
rename to third_party/WebKit/LayoutTests/fast/lists/ol-reversed-simple-xhtml.xhtml
diff --git a/third_party/WebKit/LayoutTests/resources/accessibility-helper.js b/third_party/WebKit/LayoutTests/resources/accessibility-helper.js
index 3c0d2c8..e3b18ac4 100644
--- a/third_party/WebKit/LayoutTests/resources/accessibility-helper.js
+++ b/third_party/WebKit/LayoutTests/resources/accessibility-helper.js
@@ -31,3 +31,10 @@
 
     return true;
 }
+
+function traverseAccessibilityTree(accessibilityObject) {
+    var count = accessibilityObject.childrenCount;
+    for (var i = 0; i < count; i++)
+        traverseAccessibilityTree(accessibilityObject.childAtIndex(i));
+}
+
diff --git a/third_party/WebKit/Source/core/dom/Text.cpp b/third_party/WebKit/Source/core/dom/Text.cpp
index 776feb3..09e391a0 100644
--- a/third_party/WebKit/Source/core/dom/Text.cpp
+++ b/third_party/WebKit/Source/core/dom/Text.cpp
@@ -31,7 +31,6 @@
 #include "core/dom/LayoutTreeBuilderTraversal.h"
 #include "core/dom/NodeComputedStyle.h"
 #include "core/dom/NodeTraversal.h"
-#include "core/dom/shadow/ElementShadow.h"
 #include "core/dom/shadow/ShadowRoot.h"
 #include "core/events/ScopedEventQueue.h"
 #include "core/layout/LayoutText.h"
@@ -447,11 +446,6 @@
                                           *text_layout_object->Parent())) {
     return true;
   }
-  // Check whether this node may be about to be redistributed.
-  if (text_node.ParentElementShadow() &&
-      text_node.ParentElementShadow()->NeedsDistributionRecalc()) {
-    return true;
-  }
   if (text_layout_object->IsTextFragment()) {
     // Changes of |textNode| may change first letter part, so we should
     // reattach.
diff --git a/third_party/WebKit/Source/core/editing/serializers/MarkupFormatter.cpp b/third_party/WebKit/Source/core/editing/serializers/MarkupFormatter.cpp
index c1b46c1..7c40a15 100644
--- a/third_party/WebKit/Source/core/editing/serializers/MarkupFormatter.cpp
+++ b/third_party/WebKit/Source/core/editing/serializers/MarkupFormatter.cpp
@@ -237,9 +237,6 @@
                                       const AtomicString& prefix,
                                       const AtomicString& namespace_uri,
                                       Namespaces& namespaces) {
-  if (namespace_uri.IsEmpty())
-    return;
-
   const AtomicString& lookup_key = (!prefix) ? g_empty_atom : prefix;
   AtomicString found_uri = namespaces.at(lookup_key);
   if (found_uri != namespace_uri) {
diff --git a/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp b/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
index cd339bcc..0b1a11f 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
@@ -4290,14 +4290,8 @@
     return true;
   }
 
-  if (IsLegend()) {
-    // This is wrong; see crbug.com/727378 . It may be that our current
-    // implementation requires the rendered legend inside a FIELDSET to create a
-    // new formatting context. That should probably be fixed too, but more
-    // importantly: We should never create a new formatting context for LEGEND
-    // elements that aren't associated with a FIELDSET.
+  if (IsRenderedLegend())
     return true;
-  }
 
   if (IsTextControl()) {
     // INPUT and other replaced elements rendered by Blink itself should be
diff --git a/third_party/WebKit/Source/core/layout/LayoutBox.cpp b/third_party/WebKit/Source/core/layout/LayoutBox.cpp
index e9d534a27..9e0191f 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBox.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBox.cpp
@@ -41,6 +41,7 @@
 #include "core/layout/LayoutAnalyzer.h"
 #include "core/layout/LayoutDeprecatedFlexibleBox.h"
 #include "core/layout/LayoutEmbeddedContent.h"
+#include "core/layout/LayoutFieldset.h"
 #include "core/layout/LayoutFlexibleBox.h"
 #include "core/layout/LayoutGrid.h"
 #include "core/layout/LayoutInline.h"
@@ -2991,9 +2992,7 @@
   return GetNode() &&
          (isHTMLInputElement(*GetNode()) || isHTMLSelectElement(*GetNode()) ||
           isHTMLButtonElement(*GetNode()) ||
-          isHTMLTextAreaElement(*GetNode()) ||
-          (isHTMLLegendElement(*GetNode()) &&
-           !Style()->HasOutOfFlowPosition()));
+          isHTMLTextAreaElement(*GetNode()) || IsRenderedLegend());
 }
 
 void LayoutBox::ComputeMarginsForDirection(MarginDirection flow_direction,
@@ -5045,6 +5044,16 @@
   GetFrameView()->RemoveOrthogonalWritingModeRoot(*this);
 }
 
+bool LayoutBox::IsRenderedLegend() const {
+  if (!isHTMLLegendElement(GetNode()))
+    return false;
+  if (IsFloatingOrOutOfFlowPositioned())
+    return false;
+  const auto* parent = Parent();
+  return parent && parent->IsFieldset() &&
+         ToLayoutFieldset(parent)->FindInFlowLegend() == this;
+}
+
 void LayoutBox::AddVisualEffectOverflow() {
   if (!Style()->HasVisualOverflowingEffect())
     return;
diff --git a/third_party/WebKit/Source/core/layout/LayoutBox.h b/third_party/WebKit/Source/core/layout/LayoutBox.h
index 9bccd21..f1b11d15 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBox.h
+++ b/third_party/WebKit/Source/core/layout/LayoutBox.h
@@ -1166,6 +1166,11 @@
 
   bool IsGridItem() const { return Parent() && Parent()->IsLayoutGrid(); }
 
+  // Return true if this is the "rendered legend" of a fieldset. They get
+  // special treatment, in that they establish a new formatting context, and
+  // shrink to fit if no logical width is specified.
+  bool IsRenderedLegend() const;
+
   LayoutUnit LineHeight(
       bool first_line,
       LineDirectionMode,
diff --git a/third_party/WebKit/Source/core/layout/LayoutMenuList.cpp b/third_party/WebKit/Source/core/layout/LayoutMenuList.cpp
index 9650374..6b6590a 100644
--- a/third_party/WebKit/Source/core/layout/LayoutMenuList.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutMenuList.cpp
@@ -308,9 +308,6 @@
     return;
   last_active_index_ = option_index;
 
-  if (option_index < 0)
-    return;
-
   // We skip sending accessiblity notifications for the very first option,
   // otherwise we get extra focus and select events that are undesired.
   if (!has_updated_active_option_) {
diff --git a/third_party/WebKit/Source/core/layout/LayoutObject.cpp b/third_party/WebKit/Source/core/layout/LayoutObject.cpp
index 22544e9..18ab532 100644
--- a/third_party/WebKit/Source/core/layout/LayoutObject.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutObject.cpp
@@ -256,10 +256,6 @@
   return isHTMLHRElement(GetNode());
 }
 
-bool LayoutObject::IsLegend() const {
-  return isHTMLLegendElement(GetNode());
-}
-
 void LayoutObject::SetIsInsideFlowThreadIncludingDescendants(
     bool inside_flow_thread) {
   LayoutObject* next;
diff --git a/third_party/WebKit/Source/core/layout/LayoutObject.h b/third_party/WebKit/Source/core/layout/LayoutObject.h
index 2c90ea3..1c73a70 100644
--- a/third_party/WebKit/Source/core/layout/LayoutObject.h
+++ b/third_party/WebKit/Source/core/layout/LayoutObject.h
@@ -585,7 +585,6 @@
     return GetNode() && GetNode()->HasTagName(HTMLNames::bodyTag);
   }
   bool IsHR() const;
-  bool IsLegend() const;
 
   bool IsTablePart() const {
     return IsTableCell() || IsLayoutTableCol() || IsTableCaption() ||
diff --git a/third_party/WebKit/Source/modules/accessibility/AXMenuList.cpp b/third_party/WebKit/Source/modules/accessibility/AXMenuList.cpp
index 424319f..193badc 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXMenuList.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXMenuList.cpp
@@ -117,6 +117,8 @@
 }
 
 void AXMenuList::DidUpdateActiveOption(int option_index) {
+  bool suppress_notifications =
+      (GetNode() && !GetNode()->IsFinishedParsingChildren());
   const auto& child_objects = Children();
   if (!child_objects.IsEmpty()) {
     DCHECK(child_objects.size() == 1);
@@ -124,7 +126,7 @@
 
     if (child_objects[0]->IsMenuListPopup()) {
       if (AXMenuListPopup* popup = ToAXMenuListPopup(child_objects[0].Get()))
-        popup->DidUpdateActiveOption(option_index);
+        popup->DidUpdateActiveOption(option_index, !suppress_notifications);
     }
   }
 
diff --git a/third_party/WebKit/Source/modules/accessibility/AXMenuListPopup.cpp b/third_party/WebKit/Source/modules/accessibility/AXMenuListPopup.cpp
index 7ef8e0e..f78cb77 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXMenuListPopup.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXMenuListPopup.cpp
@@ -124,13 +124,20 @@
     AddChildren();
 }
 
-void AXMenuListPopup::DidUpdateActiveOption(int option_index) {
+void AXMenuListPopup::DidUpdateActiveOption(int option_index,
+                                            bool fire_notifications) {
   UpdateChildrenIfNecessary();
 
+  int old_index = active_index_;
+  active_index_ = option_index;
+
+  if (!fire_notifications)
+    return;
+
   AXObjectCacheImpl& cache = AxObjectCache();
-  if (active_index_ != option_index && active_index_ >= 0 &&
-      active_index_ < static_cast<int>(children_.size())) {
-    AXObjectImpl* previous_child = children_[active_index_].Get();
+  if (old_index != option_index && old_index >= 0 &&
+      old_index < static_cast<int>(children_.size())) {
+    AXObjectImpl* previous_child = children_[old_index].Get();
     cache.PostNotification(previous_child,
                            AXObjectCacheImpl::kAXMenuListItemUnselected);
   }
@@ -140,8 +147,6 @@
     cache.PostNotification(this, AXObjectCacheImpl::kAXActiveDescendantChanged);
     cache.PostNotification(child, AXObjectCacheImpl::kAXMenuListItemSelected);
   }
-
-  active_index_ = option_index;
 }
 
 void AXMenuListPopup::DidHide() {
diff --git a/third_party/WebKit/Source/modules/accessibility/AXMenuListPopup.h b/third_party/WebKit/Source/modules/accessibility/AXMenuListPopup.h
index 0f710320b..d442109 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXMenuListPopup.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXMenuListPopup.h
@@ -45,7 +45,7 @@
   bool IsEnabled() const override;
   bool IsOffScreen() const override;
 
-  void DidUpdateActiveOption(int option_index);
+  void DidUpdateActiveOption(int option_index, bool fire_notifications = true);
   void DidShow();
   void DidHide();
   AXObjectImpl* ActiveDescendant() final;
diff --git a/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp b/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp
index 65292efc..e0b1fde 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp
@@ -574,24 +574,29 @@
   aria_owner_to_ids_mapping_.erase(obj_id);
 }
 
-void AXObjectCacheImpl::SelectionChanged(Node* node) {
+AXObjectImpl* AXObjectCacheImpl::NearestExistingAncestor(Node* node) {
   // Find the nearest ancestor that already has an accessibility object, since
   // we might be in the middle of a layout.
   while (node) {
-    if (AXObjectImpl* obj = Get(node)) {
-      obj->SelectionChanged();
-      return;
-    }
+    if (AXObjectImpl* obj = Get(node))
+      return obj;
     node = node->parentNode();
   }
+  return nullptr;
+}
+
+void AXObjectCacheImpl::SelectionChanged(Node* node) {
+  AXObjectImpl* nearestAncestor = NearestExistingAncestor(node);
+  if (nearestAncestor)
+    nearestAncestor->SelectionChanged();
 }
 
 void AXObjectCacheImpl::TextChanged(Node* node) {
-  TextChanged(GetOrCreate(node));
+  TextChanged(Get(node));
 }
 
 void AXObjectCacheImpl::TextChanged(LayoutObject* layout_object) {
-  TextChanged(GetOrCreate(layout_object));
+  TextChanged(Get(layout_object));
 }
 
 void AXObjectCacheImpl::TextChanged(AXObjectImpl* obj) {
@@ -1177,7 +1182,7 @@
 
 void AXObjectCacheImpl::HandleUpdateActiveMenuOption(LayoutMenuList* menu_list,
                                                      int option_index) {
-  AXObjectImpl* obj = Get(menu_list);
+  AXObjectImpl* obj = GetOrCreate(menu_list);
   if (!obj || !obj->IsMenuList())
     return;
 
diff --git a/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.h b/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.h
index 9097193fb..6238bfb 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.h
@@ -255,6 +255,7 @@
 
   void TextChanged(Node*);
   bool NodeIsTextControl(const Node*);
+  AXObjectImpl* NearestExistingAncestor(Node*);
 
   Settings* GetSettings();
 };
diff --git a/third_party/WebKit/Source/modules/websockets/DOMWebSocket.cpp b/third_party/WebKit/Source/modules/websockets/DOMWebSocket.cpp
index 114baa6c..6346d8e 100644
--- a/third_party/WebKit/Source/modules/websockets/DOMWebSocket.cpp
+++ b/third_party/WebKit/Source/modules/websockets/DOMWebSocket.cpp
@@ -383,6 +383,7 @@
   if (!protocols.IsEmpty())
     protocol_string = JoinStrings(protocols, SubprotocolSeperator());
 
+  origin_string_ = SecurityOrigin::Create(url_)->ToString();
   channel_ = CreateChannel(GetExecutionContext(), this);
 
   if (!channel_->Connect(url_, protocol_string)) {
@@ -675,18 +676,22 @@
 void DOMWebSocket::DidReceiveTextMessage(const String& msg) {
   NETWORK_DVLOG(1) << "WebSocket " << this
                    << " DidReceiveTextMessage() Text message " << msg;
+
   if (state_ != kOpen)
     return;
   RecordReceiveTypeHistogram(kWebSocketReceiveTypeString);
 
-  event_queue_->Dispatch(
-      MessageEvent::Create(msg, SecurityOrigin::Create(url_)->ToString()));
+  DCHECK(!origin_string_.IsNull());
+  event_queue_->Dispatch(MessageEvent::Create(msg, origin_string_));
 }
 
 void DOMWebSocket::DidReceiveBinaryMessage(
     std::unique_ptr<Vector<char>> binary_data) {
   NETWORK_DVLOG(1) << "WebSocket " << this << " DidReceiveBinaryMessage() "
                    << binary_data->size() << " byte binary message";
+
+  DCHECK(!origin_string_.IsNull());
+
   switch (binary_type_) {
     case kBinaryTypeBlob: {
       size_t size = binary_data->size();
@@ -698,8 +703,7 @@
           Blob::Create(BlobDataHandle::Create(std::move(blob_data), size));
       RecordReceiveTypeHistogram(kWebSocketReceiveTypeBlob);
       RecordReceiveMessageSizeHistogram(kWebSocketReceiveTypeBlob, size);
-      event_queue_->Dispatch(
-          MessageEvent::Create(blob, SecurityOrigin::Create(url_)->ToString()));
+      event_queue_->Dispatch(MessageEvent::Create(blob, origin_string_));
       break;
     }
 
@@ -709,8 +713,8 @@
       RecordReceiveTypeHistogram(kWebSocketReceiveTypeArrayBuffer);
       RecordReceiveMessageSizeHistogram(kWebSocketReceiveTypeArrayBuffer,
                                         binary_data->size());
-      event_queue_->Dispatch(MessageEvent::Create(
-          array_buffer, SecurityOrigin::Create(url_)->ToString()));
+      event_queue_->Dispatch(
+          MessageEvent::Create(array_buffer, origin_string_));
       break;
   }
 }
diff --git a/third_party/WebKit/Source/modules/websockets/DOMWebSocket.h b/third_party/WebKit/Source/modules/websockets/DOMWebSocket.h
index 2332d98..85e885d 100644
--- a/third_party/WebKit/Source/modules/websockets/DOMWebSocket.h
+++ b/third_party/WebKit/Source/modules/websockets/DOMWebSocket.h
@@ -238,7 +238,10 @@
   Member<WebSocketChannel> channel_;
 
   State state_;
+
   KURL url_;
+  String origin_string_;
+
   uint64_t buffered_amount_;
   // The consumed buffered amount that will be reflected to m_bufferedAmount
   // later. It will be cleared once reflected.
diff --git a/third_party/WebKit/Source/platform/text/BidiContext.cpp b/third_party/WebKit/Source/platform/text/BidiContext.cpp
index 25659070..9388d319 100644
--- a/third_party/WebKit/Source/platform/text/BidiContext.cpp
+++ b/third_party/WebKit/Source/platform/text/BidiContext.cpp
@@ -37,7 +37,7 @@
 static_assert(sizeof(BidiContext) == sizeof(SameSizeAsBidiContext),
               "BidiContext should stay small");
 
-inline PassRefPtr<BidiContext> BidiContext::CreateUncached(
+inline RefPtr<BidiContext> BidiContext::CreateUncached(
     unsigned char level,
     CharDirection direction,
     bool override,
@@ -46,11 +46,11 @@
   return AdoptRef(new BidiContext(level, direction, override, source, parent));
 }
 
-PassRefPtr<BidiContext> BidiContext::Create(unsigned char level,
-                                            CharDirection direction,
-                                            bool override,
-                                            BidiEmbeddingSource source,
-                                            BidiContext* parent) {
+RefPtr<BidiContext> BidiContext::Create(unsigned char level,
+                                        CharDirection direction,
+                                        bool override,
+                                        BidiEmbeddingSource source,
+                                        BidiContext* parent) {
   DCHECK_EQ(direction, (level % 2 ? kRightToLeft : kLeftToRight));
 
   if (parent || level >= 2)
@@ -84,7 +84,7 @@
   return rtl_override_context;
 }
 
-static inline PassRefPtr<BidiContext> CopyContextAndRebaselineLevel(
+static inline RefPtr<BidiContext> CopyContextAndRebaselineLevel(
     BidiContext* context,
     BidiContext* parent) {
   DCHECK(context);
@@ -101,8 +101,7 @@
 // The BidiContext stack must be immutable -- they're re-used for re-layout
 // after DOM modification/editing -- so we copy all the non-unicode contexts,
 // and recalculate their levels.
-PassRefPtr<BidiContext>
-BidiContext::CopyStackRemovingUnicodeEmbeddingContexts() {
+RefPtr<BidiContext> BidiContext::CopyStackRemovingUnicodeEmbeddingContexts() {
   Vector<BidiContext*, 64> contexts;
   for (BidiContext* iter = this; iter; iter = iter->Parent()) {
     if (iter->Source() != kFromUnicode)
@@ -116,7 +115,7 @@
     top_context =
         CopyContextAndRebaselineLevel(contexts[i - 1], top_context.Get());
 
-  return top_context.Release();
+  return top_context;
 }
 
 bool operator==(const BidiContext& c1, const BidiContext& c2) {
diff --git a/third_party/WebKit/Source/platform/text/BidiContext.h b/third_party/WebKit/Source/platform/text/BidiContext.h
index e8ff16e..4774856 100644
--- a/third_party/WebKit/Source/platform/text/BidiContext.h
+++ b/third_party/WebKit/Source/platform/text/BidiContext.h
@@ -25,7 +25,6 @@
 
 #include "platform/PlatformExport.h"
 #include "platform/wtf/Assertions.h"
-#include "platform/wtf/PassRefPtr.h"
 #include "platform/wtf/RefCounted.h"
 #include "platform/wtf/RefPtr.h"
 #include "platform/wtf/text/Unicode.h"
@@ -37,11 +36,11 @@
 // Used to keep track of explicit embeddings.
 class PLATFORM_EXPORT BidiContext : public RefCounted<BidiContext> {
  public:
-  static PassRefPtr<BidiContext> Create(unsigned char level,
-                                        WTF::Unicode::CharDirection,
-                                        bool override = false,
-                                        BidiEmbeddingSource = kFromStyleOrDOM,
-                                        BidiContext* parent = 0);
+  static RefPtr<BidiContext> Create(unsigned char level,
+                                    WTF::Unicode::CharDirection,
+                                    bool override = false,
+                                    BidiEmbeddingSource = kFromStyleOrDOM,
+                                    BidiContext* parent = 0);
 
   BidiContext* Parent() const { return parent_.Get(); }
   unsigned char Level() const { return level_; }
@@ -53,7 +52,7 @@
     return static_cast<BidiEmbeddingSource>(source_);
   }
 
-  PassRefPtr<BidiContext> CopyStackRemovingUnicodeEmbeddingContexts();
+  RefPtr<BidiContext> CopyStackRemovingUnicodeEmbeddingContexts();
 
   // http://www.unicode.org/reports/tr9/#Modifications
   // 6.3 raised the limit from 61 to 125.
@@ -74,11 +73,11 @@
     DCHECK(level <= kMaxLevel);
   }
 
-  static PassRefPtr<BidiContext> CreateUncached(unsigned char level,
-                                                WTF::Unicode::CharDirection,
-                                                bool override,
-                                                BidiEmbeddingSource,
-                                                BidiContext* parent);
+  static RefPtr<BidiContext> CreateUncached(unsigned char level,
+                                            WTF::Unicode::CharDirection,
+                                            bool override,
+                                            BidiEmbeddingSource,
+                                            BidiContext* parent);
 
   // The maximium bidi level is 125:
   // http://unicode.org/reports/tr9/#Explicit_Levels_and_Directions
diff --git a/third_party/WebKit/Source/platform/text/BidiResolver.h b/third_party/WebKit/Source/platform/text/BidiResolver.h
index f016090..1a4142aa 100644
--- a/third_party/WebKit/Source/platform/text/BidiResolver.h
+++ b/third_party/WebKit/Source/platform/text/BidiResolver.h
@@ -29,7 +29,6 @@
 #include "platform/wtf/Allocator.h"
 #include "platform/wtf/HashMap.h"
 #include "platform/wtf/Noncopyable.h"
-#include "platform/wtf/PassRefPtr.h"
 #include "platform/wtf/Vector.h"
 
 namespace blink {
@@ -143,7 +142,7 @@
   BidiStatus(WTF::Unicode::CharDirection eor_dir,
              WTF::Unicode::CharDirection last_strong_dir,
              WTF::Unicode::CharDirection last_dir,
-             PassRefPtr<BidiContext> bidi_context)
+             RefPtr<BidiContext> bidi_context)
       : eor(eor_dir),
         last_strong(last_strong_dir),
         last(last_dir),
@@ -241,7 +240,7 @@
   }
 
   BidiContext* Context() const { return status_.context.Get(); }
-  void SetContext(PassRefPtr<BidiContext> c) { status_.context = std::move(c); }
+  void SetContext(RefPtr<BidiContext> c) { status_.context = std::move(c); }
 
   void SetLastDir(WTF::Unicode::CharDirection last_dir) {
     status_.last = last_dir;
diff --git a/third_party/WebKit/Source/platform/text/Hyphenation.h b/third_party/WebKit/Source/platform/text/Hyphenation.h
index d95e030..4be3402 100644
--- a/third_party/WebKit/Source/platform/text/Hyphenation.h
+++ b/third_party/WebKit/Source/platform/text/Hyphenation.h
@@ -30,8 +30,7 @@
 
  private:
   friend class LayoutLocale;
-  static PassRefPtr<Hyphenation> PlatformGetHyphenation(
-      const AtomicString& locale);
+  static RefPtr<Hyphenation> PlatformGetHyphenation(const AtomicString& locale);
 };
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/platform/text/TextCheckerClient.h b/third_party/WebKit/Source/platform/text/TextCheckerClient.h
index db58f5c..f191637 100644
--- a/third_party/WebKit/Source/platform/text/TextCheckerClient.h
+++ b/third_party/WebKit/Source/platform/text/TextCheckerClient.h
@@ -31,7 +31,6 @@
 #include "platform/PlatformExport.h"
 #include "platform/text/TextChecking.h"
 #include "platform/wtf/Forward.h"
-#include "platform/wtf/PassRefPtr.h"
 #include "platform/wtf/Vector.h"
 #include "platform/wtf/text/WTFString.h"
 
diff --git a/third_party/WebKit/Source/platform/text/hyphenation/HyphenationMinikin.cpp b/third_party/WebKit/Source/platform/text/hyphenation/HyphenationMinikin.cpp
index f5c263f..a6285ae 100644
--- a/third_party/WebKit/Source/platform/text/hyphenation/HyphenationMinikin.cpp
+++ b/third_party/WebKit/Source/platform/text/hyphenation/HyphenationMinikin.cpp
@@ -141,11 +141,11 @@
   return map;
 }
 
-PassRefPtr<Hyphenation> Hyphenation::PlatformGetHyphenation(
+RefPtr<Hyphenation> Hyphenation::PlatformGetHyphenation(
     const AtomicString& locale) {
   RefPtr<HyphenationMinikin> hyphenation(AdoptRef(new HyphenationMinikin));
   if (hyphenation->OpenDictionary(locale.LowerASCII()))
-    return hyphenation.Release();
+    return hyphenation;
   hyphenation.Clear();
 
   DEFINE_STATIC_LOCAL(LocaleMap, locale_fallback, (CreateLocaleFallbackMap()));
@@ -156,11 +156,11 @@
   return nullptr;
 }
 
-PassRefPtr<HyphenationMinikin> HyphenationMinikin::FromFileForTesting(
+RefPtr<HyphenationMinikin> HyphenationMinikin::FromFileForTesting(
     base::File file) {
   RefPtr<HyphenationMinikin> hyphenation(AdoptRef(new HyphenationMinikin));
   if (hyphenation->OpenDictionary(std::move(file)))
-    return hyphenation.Release();
+    return hyphenation;
   return nullptr;
 }
 
diff --git a/third_party/WebKit/Source/platform/text/hyphenation/HyphenationMinikin.h b/third_party/WebKit/Source/platform/text/hyphenation/HyphenationMinikin.h
index e35db0ab..678f4abe4 100644
--- a/third_party/WebKit/Source/platform/text/hyphenation/HyphenationMinikin.h
+++ b/third_party/WebKit/Source/platform/text/hyphenation/HyphenationMinikin.h
@@ -25,7 +25,7 @@
                             size_t before_index) const override;
   Vector<size_t, 8> HyphenLocations(const StringView&) const override;
 
-  static PassRefPtr<HyphenationMinikin> FromFileForTesting(base::File);
+  static RefPtr<HyphenationMinikin> FromFileForTesting(base::File);
 
  private:
   bool OpenDictionary(base::File);
diff --git a/third_party/WebKit/Source/platform/text/linux/HyphenationLinux.cpp b/third_party/WebKit/Source/platform/text/linux/HyphenationLinux.cpp
index 8bfeb1a..f41cb869 100644
--- a/third_party/WebKit/Source/platform/text/linux/HyphenationLinux.cpp
+++ b/third_party/WebKit/Source/platform/text/linux/HyphenationLinux.cpp
@@ -6,8 +6,7 @@
 
 namespace blink {
 
-PassRefPtr<Hyphenation> Hyphenation::PlatformGetHyphenation(
-    const AtomicString&) {
+RefPtr<Hyphenation> Hyphenation::PlatformGetHyphenation(const AtomicString&) {
   return nullptr;
 }
 
diff --git a/third_party/WebKit/Source/platform/text/mac/HyphenationMac.cpp b/third_party/WebKit/Source/platform/text/mac/HyphenationMac.cpp
index 3e2d94d..5affb8e 100644
--- a/third_party/WebKit/Source/platform/text/mac/HyphenationMac.cpp
+++ b/third_party/WebKit/Source/platform/text/mac/HyphenationMac.cpp
@@ -28,7 +28,7 @@
   RetainPtr<CFLocaleRef> locale_cf_;
 };
 
-PassRefPtr<Hyphenation> Hyphenation::PlatformGetHyphenation(
+RefPtr<Hyphenation> Hyphenation::PlatformGetHyphenation(
     const AtomicString& locale) {
   RetainPtr<CFStringRef> locale_cf_string = locale.Impl()->CreateCFString();
   RetainPtr<CFLocaleRef> locale_cf =
diff --git a/third_party/WebKit/Source/platform/text/win/HyphenationWin.cpp b/third_party/WebKit/Source/platform/text/win/HyphenationWin.cpp
index 8bfeb1a..f41cb869 100644
--- a/third_party/WebKit/Source/platform/text/win/HyphenationWin.cpp
+++ b/third_party/WebKit/Source/platform/text/win/HyphenationWin.cpp
@@ -6,8 +6,7 @@
 
 namespace blink {
 
-PassRefPtr<Hyphenation> Hyphenation::PlatformGetHyphenation(
-    const AtomicString&) {
+RefPtr<Hyphenation> Hyphenation::PlatformGetHyphenation(const AtomicString&) {
   return nullptr;
 }
 
diff --git a/third_party/WebKit/Source/platform/wtf/BUILD.gn b/third_party/WebKit/Source/platform/wtf/BUILD.gn
index 15fd60da..bcbbb7ce 100644
--- a/third_party/WebKit/Source/platform/wtf/BUILD.gn
+++ b/third_party/WebKit/Source/platform/wtf/BUILD.gn
@@ -102,6 +102,7 @@
     "PassRefPtr.h",
     "PrintStream.cpp",
     "PrintStream.h",
+    "ProcessMetrics.h",
     "PtrUtil.h",
     "RefCounted.h",
     "RefPtr.h",
diff --git a/third_party/WebKit/Source/platform/wtf/DEPS b/third_party/WebKit/Source/platform/wtf/DEPS
index eb219e53..139b5791 100644
--- a/third_party/WebKit/Source/platform/wtf/DEPS
+++ b/third_party/WebKit/Source/platform/wtf/DEPS
@@ -3,6 +3,7 @@
     # directories and files instead of writing 'base/'.
     "+base/allocator/oom.h",
     "+base/allocator/partition_allocator",
+    "+base/process/process_metrics.h",
     "+base/auto_reset.h",
     "+base/bind.h",
     "+base/bits.h",
diff --git a/third_party/WebKit/Source/platform/wtf/ProcessMetrics.h b/third_party/WebKit/Source/platform/wtf/ProcessMetrics.h
new file mode 100644
index 0000000..c624dd3a
--- /dev/null
+++ b/third_party/WebKit/Source/platform/wtf/ProcessMetrics.h
@@ -0,0 +1,20 @@
+// Copyright (c) 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef ProcessMetrics_h
+#define ProcessMetrics_h
+
+#include "base/process/process_metrics.h"
+
+namespace WTF {
+
+size_t GetMallocUsage() {
+  std::unique_ptr<base::ProcessMetrics> metric(
+      base::ProcessMetrics::CreateCurrentProcessMetrics());
+  return metric->GetMallocUsage();
+}
+
+}  // namespace WTF
+
+#endif  // ProcessMetrics_h
diff --git a/tools/clang/scripts/update.py b/tools/clang/scripts/update.py
index 8945d5eb..d62e4807 100755
--- a/tools/clang/scripts/update.py
+++ b/tools/clang/scripts/update.py
@@ -27,7 +27,7 @@
 # Do NOT CHANGE this if you don't know what you're doing -- see
 # https://chromium.googlesource.com/chromium/src/+/master/docs/updating_clang.md
 # Reverting problematic clang rolls is safe, though.
-CLANG_REVISION = '305489'
+CLANG_REVISION = '305735'
 
 use_head_revision = 'LLVM_FORCE_HEAD_REVISION' in os.environ
 if use_head_revision: